From 5c4108db616f7ad5d701fe1513628a2ffda8fa66 Mon Sep 17 00:00:00 2001 From: Palmer Cox Date: Sat, 6 Jun 2026 20:30:51 -0400 Subject: [PATCH 001/121] coredns: Fix on Darwin The removed replacement no longer worked and was causing the build failure. The package builds fine without it. --- pkgs/by-name/co/coredns/package.nix | 4 ---- 1 file changed, 4 deletions(-) diff --git a/pkgs/by-name/co/coredns/package.nix b/pkgs/by-name/co/coredns/package.nix index 189ab608471b..c46b4a1bd19d 100644 --- a/pkgs/by-name/co/coredns/package.nix +++ b/pkgs/by-name/co/coredns/package.nix @@ -123,10 +123,6 @@ buildGoModule (finalAttrs: { + lib.optionalString stdenv.hostPlatform.isDarwin '' # loopback interface is lo0 on macos sed -E -i 's/\blo\b/lo0/' plugin/bind/setup_test.go - - # test is apparently outdated but only exhibits this on darwin - substituteInPlace test/corefile_test.go \ - --replace-fail "TestCorefile1" "SkipCorefile1" ''; __darwinAllowLocalNetworking = true; From a231a7fe7e9f1518114981b0f82eb92e0933a891 Mon Sep 17 00:00:00 2001 From: SandaruKasa Date: Fri, 26 Jun 2026 23:06:57 +0300 Subject: [PATCH 002/121] fetchurl: make progress meter visible --- pkgs/build-support/fetchurl/builder.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/build-support/fetchurl/builder.sh b/pkgs/build-support/fetchurl/builder.sh index 228fcd2ed185..d679c2b0d128 100644 --- a/pkgs/build-support/fetchurl/builder.sh +++ b/pkgs/build-support/fetchurl/builder.sh @@ -62,7 +62,7 @@ tryDownload() { # if we get error code 18, resume partial download while [ $curlexit -eq 18 ]; do # keep this inside an if statement, since on failure it doesn't abort the script - if "${curl[@]}" -C - --fail "$url" --output "$target"; then + if "${curl[@]}" -C - --fail "$url" --output "$target" 2> >(tr '\r' '\n'); then success=1 break else From 1b89d64fe653c0921a19e3898dba4ee2ea537842 Mon Sep 17 00:00:00 2001 From: George Huebner Date: Sun, 28 Jun 2026 15:36:05 -0700 Subject: [PATCH 003/121] iio-oscilliscope: 0.17 -> 0.18 --- pkgs/by-name/ii/iio-oscilloscope/package.nix | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-) diff --git a/pkgs/by-name/ii/iio-oscilloscope/package.nix b/pkgs/by-name/ii/iio-oscilloscope/package.nix index 85ffb4703a76..73ddd48ad30e 100644 --- a/pkgs/by-name/ii/iio-oscilloscope/package.nix +++ b/pkgs/by-name/ii/iio-oscilloscope/package.nix @@ -2,7 +2,6 @@ lib, stdenv, fetchFromGitHub, - fetchpatch, cmake, pkg-config, wrapGAppsHook3, @@ -23,23 +22,15 @@ stdenv.mkDerivation (finalAttrs: { pname = "iio-oscilloscope"; - version = "0.17"; + version = "0.18"; src = fetchFromGitHub { owner = "analogdevicesinc"; repo = "iio-oscilloscope"; - rev = "v${finalAttrs.version}-master"; - hash = "sha256-wCeOLAkrytrBaXzUbNu8z2Ayz44M+b+mbyaRoWHpZYU="; + rev = "v${finalAttrs.version}-main"; + hash = "sha256-lAP8rI1YnBMmwWBDxfQOV5W8NYscQbb7lh/ZhG893p0="; }; - patches = [ - # make sure the sizeof argument to calloc is the second argument. - (fetchpatch { - url = "https://github.com/analogdevicesinc/iio-oscilloscope/commit/565cade20566d50adec7be191a6dd7b21217f878.patch"; - hash = "sha256-JeRve3xtWi+EcZR+qZlek+YwAbPB56OYxkFVd8MmIb0="; - }) - ]; - postPatch = '' # error: 'idx' may be used uninitialized substituteInPlace plugins/lidar.c --replace-fail "int i, j, idx;" "int i, j, idx = 0;" From f3c771e978d358c1ceb66a694178f3794febfc09 Mon Sep 17 00:00:00 2001 From: d18g Date: Sun, 5 Jul 2026 13:17:14 +0300 Subject: [PATCH 004/121] nixos/misskey: fixes for attrTag submodule docs Fix the declaration location of attributes of submodules of attrTag --- nixos/modules/services/web-apps/misskey.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/web-apps/misskey.nix b/nixos/modules/services/web-apps/misskey.nix index e02e4106a5ad..0bc4efce5261 100644 --- a/nixos/modules/services/web-apps/misskey.nix +++ b/nixos/modules/services/web-apps/misskey.nix @@ -231,7 +231,7 @@ in webserver = lib.mkOption { type = lib.types.attrTag { nginx = lib.mkOption { - type = lib.types.submodule (import ../web-servers/nginx/vhost-options.nix); + type = lib.types.submodule ../web-servers/nginx/vhost-options.nix; default = { }; description = '' Extra configuration for the nginx virtual host of Misskey. @@ -240,7 +240,7 @@ in }; caddy = lib.mkOption { type = lib.types.submodule ( - import ../web-servers/caddy/vhost-options.nix { cfg = config.services.caddy; } + lib.modules.importApply ../web-servers/caddy/vhost-options.nix { cfg = config.services.caddy; } ); default = { }; description = '' From 6ba89e3fc2066079ca60e0a393c171155a172ef4 Mon Sep 17 00:00:00 2001 From: George Huebner Date: Sun, 28 Jun 2026 15:36:20 -0700 Subject: [PATCH 005/121] iio-oscilliscope: add darwin support --- pkgs/by-name/ii/iio-oscilloscope/package.nix | 26 +++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/ii/iio-oscilloscope/package.nix b/pkgs/by-name/ii/iio-oscilloscope/package.nix index 73ddd48ad30e..b7629281cdc8 100644 --- a/pkgs/by-name/ii/iio-oscilloscope/package.nix +++ b/pkgs/by-name/ii/iio-oscilloscope/package.nix @@ -5,6 +5,7 @@ cmake, pkg-config, wrapGAppsHook3, + desktopToDarwinBundle, libiio, glib, gtk3, @@ -34,12 +35,21 @@ stdenv.mkDerivation (finalAttrs: { postPatch = '' # error: 'idx' may be used uninitialized substituteInPlace plugins/lidar.c --replace-fail "int i, j, idx;" "int i, j, idx = 0;" + '' + + lib.optionalString stdenv.hostPlatform.isDarwin '' + substituteInPlace oscmain.c --replace-fail '#include "osc.h"${"\n"}#include "backtrace.h"' '#include "backtrace.h"${"\n"}#include "osc.h"' + substituteInPlace CMakeLists.txt \ + --replace-fail '-D_GNU_SOURCE' '-D_DARWIN_C_SOURCE' \ + --replace-fail '${"\${CMAKE_SYSTEM_NAME} MATCHES \"Linux\""}' 'TRUE' ''; nativeBuildInputs = [ cmake pkg-config wrapGAppsHook3 + ] + ++ lib.optionals stdenv.hostPlatform.isDarwin [ + desktopToDarwinBundle ]; buildInputs = [ @@ -59,6 +69,20 @@ stdenv.mkDerivation (finalAttrs: { "-DCMAKE_POLKIT_PREFIX=${placeholder "out"}" ]; + env.NIX_CFLAGS_COMPILE = toString [ + "-Wno-error=unused-variable" + ]; + + preInstall = '' + sed -e 's/Exec=.*/Exec=osc/' \ + -e 's/Icon=.*/Icon=osc/' \ + -i adi-osc.desktop + ''; + + postInstall = '' + ln -s $out/share/osc/icons/osc.svg $out/share/icons/hicolor/scalable/apps/ + ''; + meta = { description = "GTK+ based oscilloscope application for interfacing with various IIO devices"; homepage = "https://wiki.analog.com/resources/tools-software/linux-software/iio_oscilloscope"; @@ -66,6 +90,6 @@ stdenv.mkDerivation (finalAttrs: { license = lib.licenses.gpl2Only; changelog = "https://github.com/analogdevicesinc/iio-oscilloscope/releases/tag/v${finalAttrs.version}-master"; maintainers = with lib.maintainers; [ chuangzhu ]; - platforms = lib.platforms.linux; + platforms = lib.platforms.unix; }; }) From df96ee14465990f377a88f75e7e20167887f74df Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 16 Jul 2026 15:40:31 +0000 Subject: [PATCH 006/121] consul: 1.22.7 -> 2.0.2 --- pkgs/by-name/co/consul/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/co/consul/package.nix b/pkgs/by-name/co/consul/package.nix index 23c8235ba2c4..4b9033b0334c 100644 --- a/pkgs/by-name/co/consul/package.nix +++ b/pkgs/by-name/co/consul/package.nix @@ -8,7 +8,7 @@ buildGoModule rec { pname = "consul"; - version = "1.22.7"; + version = "2.0.2"; # Note: Currently only release tags are supported, because they have the Consul UI # vendored. See @@ -22,7 +22,7 @@ buildGoModule rec { owner = "hashicorp"; repo = "consul"; tag = "v${version}"; - hash = "sha256-lcb2Dbr5rpNbtstEk7kQxEYHdN3/FQEHFH+NIa6czDU="; + hash = "sha256-Xt9Rch4pSSUb1/KI+W3fn++Jlm7ZtYNxSo9hOjXXEhw="; }; # This corresponds to paths with package main - normally unneeded but consul @@ -32,7 +32,7 @@ buildGoModule rec { "connect/certgen" ]; - vendorHash = "sha256-tFa8UKeaAQR4q+WpRl/u5P+TpjdBh9Gf6bVQcwzP5QQ="; + vendorHash = "sha256-C532h7n/2E2vYQO02EcznnF8s/eI5r7qGoB5NEiiHEg="; doCheck = false; From 4ce6722eec0b5a040a850a370e36904db1807b59 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jos=C3=A9=20Luis=20Lafuente?= Date: Tue, 14 Jul 2026 14:56:56 +0200 Subject: [PATCH 007/121] python3Packages.deepspeed: init at 0.19.2 --- .../python-modules/deepspeed/default.nix | 118 ++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 120 insertions(+) create mode 100644 pkgs/development/python-modules/deepspeed/default.nix diff --git a/pkgs/development/python-modules/deepspeed/default.nix b/pkgs/development/python-modules/deepspeed/default.nix new file mode 100644 index 000000000000..33a7836d4ff4 --- /dev/null +++ b/pkgs/development/python-modules/deepspeed/default.nix @@ -0,0 +1,118 @@ +{ + lib, + buildPythonPackage, + fetchFromGitHub, + setuptools, + einops, + hjson, + msgpack, + ninja, + numpy, + cupy, + cutlass, + packaging, + psutil, + py-cpuinfo, + pydantic, + torch, + tqdm, + nix-update-script, + cudaPackages, + symlinkJoin, +}: + +let + cudaVersion = cudaPackages.cudaMajorMinorVersion; + + inherit (torch) cudaCapabilities cudaSupport; + + cuda-native-redist = symlinkJoin { + name = "cuda-native-redist-${cudaVersion}"; + paths = with cudaPackages; [ + (lib.getDev cuda_cudart) + (lib.getLib cuda_cudart) + (lib.getStatic cuda_cudart) + cuda_nvcc + ]; + }; + +in + +buildPythonPackage (finalAttrs: { + pname = "deepspeed"; + version = "0.19.2"; + pyproject = true; + __structuredAttrs = true; + + src = fetchFromGitHub { + owner = "deepspeedai"; + repo = "DeepSpeed"; + tag = "v${finalAttrs.version}"; + hash = "sha256-Nw1rw65hdqhARFR7W+XmmRT/pLkCi5nTF+6R9L3bLyo="; + fetchSubmodules = true; + }; + + build-system = [ + setuptools + ]; + + dependencies = [ + einops + hjson + msgpack + ninja + numpy + packaging + psutil + py-cpuinfo + pydantic + setuptools + torch + tqdm + ] + ++ lib.optionals cudaSupport [ + cutlass + cupy + ]; + + postPatch = '' + substituteInPlace deepspeed/ops/op_builder/builder.py \ + --replace-fail 'import distutils' 'import setuptools._distutils' + '' + + lib.optionalString cudaSupport '' + # Hardcode CUDA_HOME to nix store path for JIT op compilation at runtime + substituteInPlace deepspeed/ops/op_builder/builder.py \ + --replace-fail \ + "cuda_home = torch.utils.cpp_extension.CUDA_HOME" \ + "cuda_home = '${cuda-native-redist}'" + + # Hardcode CUTLASS_PATH to nix store path + substituteInPlace deepspeed/ops/op_builder/evoformer_attn.py \ + --replace-fail \ + "self.cutlass_path = os.environ.get(\"CUTLASS_PATH\")" \ + "self.cutlass_path = '${cutlass}'" + ''; + + env = lib.optionalAttrs cudaSupport { + TORCH_CUDA_ARCH_LIST = lib.concatStringsSep ";" cudaCapabilities; + }; + + preConfigure = '' + # setuptools writes to ~/.cache during builds + export HOME=$TMPDIR + ''; + + pythonImportsCheck = [ + "deepspeed" + ]; + + passthru.updateScript = nix-update-script { }; + + meta = { + description = "Deep learning optimization library that makes distributed training and inference easy, efficient, and effective."; + homepage = "https://www.deepspeed.ai/"; + changelog = "https://github.com/deepspeedai/DeepSpeed/releases/tag/${finalAttrs.src.tag}"; + license = lib.licenses.asl20; + maintainers = with lib.maintainers; [ jlesquembre ]; + }; +}) diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 1ccb3285fe6d..7e161dfe0395 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -4177,6 +4177,8 @@ self: super: with self; { deepsearch-toolkit = callPackage ../development/python-modules/deepsearch-toolkit { }; + deepspeed = callPackage ../development/python-modules/deepspeed { }; + deeptoolsintervals = callPackage ../development/python-modules/deeptoolsintervals { }; deepwave = callPackage ../development/python-modules/deepwave { }; From 039812311ae83efa69fc1e855dfd863937073547 Mon Sep 17 00:00:00 2001 From: Oliver Schmidt Date: Wed, 22 Jul 2026 14:52:14 +0200 Subject: [PATCH 008/121] github-runner: 2.335.1 -> 2.336.0 Changelog: https://github.com/actions/runner/releases/tag/v2.336.0 --- pkgs/by-name/gi/github-runner/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/gi/github-runner/package.nix b/pkgs/by-name/gi/github-runner/package.nix index 3bc156df62ba..7b84b7697778 100644 --- a/pkgs/by-name/gi/github-runner/package.nix +++ b/pkgs/by-name/gi/github-runner/package.nix @@ -33,13 +33,13 @@ assert builtins.all ( buildDotnetModule (finalAttrs: { pname = "github-runner"; - version = "2.335.1"; + version = "2.336.0"; src = fetchFromGitHub { owner = "actions"; repo = "runner"; tag = "v${finalAttrs.version}"; - hash = "sha256-mFwWhpFzp0pT7WaMpF/N6PGw0IJt3I6/e7GDgw9wA2U="; + hash = "sha256-wzPGtNdKszDT8VMgL13xUUp+IhP8UzpXVHkR0T2Ns1A="; leaveDotGit = true; postFetch = '' git -C $out rev-parse --short HEAD > $out/.git-revision From 14e4152d002aec91bab648db78ed0686fd9ff572 Mon Sep 17 00:00:00 2001 From: Oliver Schmidt Date: Wed, 22 Jul 2026 14:56:53 +0200 Subject: [PATCH 009/121] github-runner: add myself as maintainer While I am not that much knowleadgeable about the dotnet ecosystem, It was sufficient enough for me to coordinate the last few release bumps. Being a maintainer will simplify backporting release bumps to older releases with the merge-bot. --- pkgs/by-name/gi/github-runner/package.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/by-name/gi/github-runner/package.nix b/pkgs/by-name/gi/github-runner/package.nix index 7b84b7697778..93a08346f5c5 100644 --- a/pkgs/by-name/gi/github-runner/package.nix +++ b/pkgs/by-name/gi/github-runner/package.nix @@ -366,6 +366,7 @@ buildDotnetModule (finalAttrs: { kfollesdal aanderse zimbatm + schmittlauch ]; platforms = [ "x86_64-linux" From 93186429f2bf3339ffa9855888ca841c1f37a8b9 Mon Sep 17 00:00:00 2001 From: Vincent Laporte Date: Thu, 23 Jul 2026 15:20:25 +0200 Subject: [PATCH 010/121] ocamlPackages.camlimages: drop camlimages.lablgtk2 --- pkgs/development/ocaml-modules/camlimages/default.nix | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/pkgs/development/ocaml-modules/camlimages/default.nix b/pkgs/development/ocaml-modules/camlimages/default.nix index a918c6b3757f..9b8dcf17721d 100644 --- a/pkgs/development/ocaml-modules/camlimages/default.nix +++ b/pkgs/development/ocaml-modules/camlimages/default.nix @@ -6,7 +6,6 @@ dune-configurator, cppo, graphics, - lablgtk, stdio, }: @@ -14,8 +13,6 @@ buildDunePackage (finalAttrs: { pname = "camlimages"; version = "5.0.5"; - minimalOCamlVersion = "4.07"; - src = fetchFromGitLab { owner = "camlspotter"; repo = "camlimages"; @@ -31,17 +28,15 @@ buildDunePackage (finalAttrs: { dune-configurator findlib graphics - lablgtk stdio ]; meta = { branch = "5.0"; - inherit (finalAttrs.src.meta) homepage; + homepage = "https://gitlab.com/camlspotter/camlimages"; description = "OCaml image processing library"; license = lib.licenses.lgpl2; maintainers = [ - lib.maintainers.vbgl lib.maintainers.mt-caret ]; }; From 23333b36b2a90c8a1fce8bdf1f71aec1420faede Mon Sep 17 00:00:00 2001 From: liberodark Date: Thu, 23 Jul 2026 00:27:39 +0200 Subject: [PATCH 011/121] coder: fix eval on unsupported systems --- pkgs/by-name/co/coder/package.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/by-name/co/coder/package.nix b/pkgs/by-name/co/coder/package.nix index db0fc4b16120..b1a74f80d186 100644 --- a/pkgs/by-name/co/coder/package.nix +++ b/pkgs/by-name/co/coder/package.nix @@ -96,6 +96,7 @@ stdenvNoCC.mkDerivation (finalAttrs: { description = "Provision remote development environments via Terraform"; homepage = "https://coder.com"; license = lib.licenses.agpl3Only; + platforms = lib.attrNames channels.${channel}.hash; mainProgram = "coder"; maintainers = with lib.maintainers; [ bpmct From f488e86f974d96bfc7f5c10de83e3f39d1f25eb8 Mon Sep 17 00:00:00 2001 From: Robert Oschwald Date: Mon, 27 Jul 2026 11:48:31 +0200 Subject: [PATCH 012/121] ptouch-print: Add missing argp-standalone arg for Darwin MacOS libc does not contain argp needed for cmake. --- pkgs/by-name/pt/ptouch-print/package.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/by-name/pt/ptouch-print/package.nix b/pkgs/by-name/pt/ptouch-print/package.nix index 5c5437d69e72..f5e0abfe70e7 100644 --- a/pkgs/by-name/pt/ptouch-print/package.nix +++ b/pkgs/by-name/pt/ptouch-print/package.nix @@ -1,4 +1,5 @@ { + argp-standalone, cmake, fetchgit, gd, @@ -36,6 +37,9 @@ stdenv.mkDerivation { libpng zlib libusb1 + ] + ++ lib.optionals (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isMusl) [ + argp-standalone ]; installPhase = '' From e4058c0ed07a55bf5bdc3f72f87ede0c065aa83f Mon Sep 17 00:00:00 2001 From: whispers Date: Sat, 1 Aug 2026 21:44:20 -0400 Subject: [PATCH 013/121] ucx: replace deprecated openmp pragma for gcc 16 UCX uses the `#pragma omp master` declaration which is deprecated since OpenMP 5.1. Since UCX builds with -Werror by default, this causes build failures in GCC 16 which introduced the `deprecated-openmp` warning. Accordingly, we replace it with the new `#pragma omp masked` version in compilers which support OpenMP 5.1. This has been PRed upstream, but not yet accepted, and so it is vendored here. We elected to vendor a patch instead of just suppressing the warning or `substituteInPlace`ing the pragma as some older compiler versions do not support the new `#pragma omp masked` (this failed a *lot* in the upstream PR CI) and older versions of GCC do not like the `deprecated-openmp`. This seems the least fragile way to take this fix. --- .../uc/ucx/deprecated-openmp-pragma.patch | 17 +++++++++++++++++ pkgs/by-name/uc/ucx/package.nix | 8 ++++++++ 2 files changed, 25 insertions(+) create mode 100644 pkgs/by-name/uc/ucx/deprecated-openmp-pragma.patch diff --git a/pkgs/by-name/uc/ucx/deprecated-openmp-pragma.patch b/pkgs/by-name/uc/ucx/deprecated-openmp-pragma.patch new file mode 100644 index 000000000000..09a0c8d07642 --- /dev/null +++ b/pkgs/by-name/uc/ucx/deprecated-openmp-pragma.patch @@ -0,0 +1,17 @@ +diff --git a/src/tools/perf/perftest.c b/src/tools/perf/perftest.c +index 52a1682f85..87e0511807 100644 +--- a/src/tools/perf/perftest.c ++++ b/src/tools/perf/perftest.c +@@ -243,7 +243,11 @@ + { + #if _OPENMP + # pragma omp barrier +-# pragma omp master ++# if _OPENMP >= 202011 ++# pragma omp masked ++# else ++# pragma omp master ++# endif + #endif + { + sock_rte_group_t *group = rte_group; diff --git a/pkgs/by-name/uc/ucx/package.nix b/pkgs/by-name/uc/ucx/package.nix index 2cfb1d498aad..20dff7a1c217 100644 --- a/pkgs/by-name/uc/ucx/package.nix +++ b/pkgs/by-name/uc/ucx/package.nix @@ -54,6 +54,14 @@ stdenv.mkDerivation (finalAttrs: { hash = "sha256-Td6L5wXDadIbHfk251bj6k9J3kIjqCYVx5lDso/u76M="; }; + # UCX uses the `#pragma omp master` declaration which is deprecated since + # OpenMP 5.1. Since UCX builds with -Werror by default, this causes build + # failures in GCC 16 which introduced the `deprecated-openmp` warning. + # Accordingly, we replace it with the new `#pragma omp masked` version in + # compilers which support OpenMP 5.1. + # https://github.com/openucx/ucx/pull/11697 + patches = [ ./deprecated-openmp-pragma.patch ]; + postPatch = '' patchShebangs config/nvcc_wrap.sh ''; From 8389f609b13b67a4e88cc3e40afc204ceda659e9 Mon Sep 17 00:00:00 2001 From: emilylange Date: Sun, 2 Aug 2026 19:57:01 +0200 Subject: [PATCH 014/121] Revert "adapta-gtk-theme: remove" This reverts commit f291f0ec1fc1e6d990637500654dc57e58a49735. --- pkgs/by-name/ad/adapta-gtk-theme/package.nix | 67 ++++++++++++++++++++ pkgs/top-level/aliases.nix | 1 - 2 files changed, 67 insertions(+), 1 deletion(-) create mode 100644 pkgs/by-name/ad/adapta-gtk-theme/package.nix diff --git a/pkgs/by-name/ad/adapta-gtk-theme/package.nix b/pkgs/by-name/ad/adapta-gtk-theme/package.nix new file mode 100644 index 000000000000..670cff3ad815 --- /dev/null +++ b/pkgs/by-name/ad/adapta-gtk-theme/package.nix @@ -0,0 +1,67 @@ +{ + lib, + stdenv, + fetchFromGitHub, + autoreconfHook, + pkg-config, + parallel, + sassc, + inkscape, + libxml2, + glib, + gdk-pixbuf, + librsvg, + gtk-engine-murrine, + gnome-shell, +}: + +stdenv.mkDerivation (finalAttrs: { + pname = "adapta-gtk-theme"; + version = "3.95.0.11"; + + src = fetchFromGitHub { + owner = "adapta-project"; + repo = "adapta-gtk-theme"; + tag = finalAttrs.version; + sha256 = "19skrhp10xx07hbd0lr3d619vj2im35d8p9rmb4v4zacci804q04"; + }; + + preferLocalBuild = true; + + nativeBuildInputs = [ + autoreconfHook + pkg-config + parallel + sassc + inkscape + libxml2 + glib.dev + gnome-shell + ]; + + buildInputs = [ + gdk-pixbuf + librsvg + ]; + + propagatedUserEnvPkgs = [ gtk-engine-murrine ]; + + postPatch = "patchShebangs ."; + + configureFlags = [ + "--disable-gtk_legacy" + "--disable-gtk_next" + "--disable-unity" + ]; + + meta = { + description = "Adaptive GTK theme based on Material Design Guidelines"; + homepage = "https://github.com/adapta-project/adapta-gtk-theme"; + license = with lib.licenses; [ + gpl2 + cc-by-sa-30 + ]; + platforms = lib.platforms.linux; + maintainers = with lib.maintainers; [ romildo ]; + }; +}) diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 8136fbc74b0d..38490474dcf1 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -272,7 +272,6 @@ mapAliases { abseil-cpp_202301 = throw "abseil-cpp_202301 has been removed as it was unused in tree"; # Added 2025-08-09 abseil-cpp_202501 = throw "abseil-cpp_202501 has been removed as it was unused in tree"; # Added 2025-09-15 acd-cli = throw "adc-cli has been removed as it was unmaintained"; # Added 2026-05-02 - adapta-gtk-theme = throw "'adapta-gtk-theme' has been removed because it depended on 'gtk-engine-murrine', which was removed because it was unmaintained upstream and depended on GTK 2."; # Added 2026-07-22 adjustor = throw "adjustor has been removed as it part of the 'handheld-daemon' package"; # Added 2025-11-16 adminer-pematon = throw "'adminer-pematon' has been renamed to/replaced by 'adminneo'"; # Converted to throw 2025-10-27 adminerneo = throw "'adminerneo' has been renamed to/replaced by 'adminneo'"; # Converted to throw 2025-10-27 From 465cac803a88e6a0d5477fe2d0808a8834159fd8 Mon Sep 17 00:00:00 2001 From: emilylange Date: Sun, 2 Aug 2026 20:56:46 +0200 Subject: [PATCH 015/121] adapta-gtk-theme: remove gtk-2 --- .../ad/adapta-gtk-theme/disable-gtk2.patch | 89 +++++++++++++++++++ pkgs/by-name/ad/adapta-gtk-theme/package.nix | 7 +- 2 files changed, 93 insertions(+), 3 deletions(-) create mode 100644 pkgs/by-name/ad/adapta-gtk-theme/disable-gtk2.patch diff --git a/pkgs/by-name/ad/adapta-gtk-theme/disable-gtk2.patch b/pkgs/by-name/ad/adapta-gtk-theme/disable-gtk2.patch new file mode 100644 index 000000000000..0a5df8c07991 --- /dev/null +++ b/pkgs/by-name/ad/adapta-gtk-theme/disable-gtk2.patch @@ -0,0 +1,89 @@ +diff --git a/configure.ac b/configure.ac +index e59085f6..908a38bc 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -24,6 +24,7 @@ AC_PREFIX_DEFAULT(/usr/local) + AM_SILENT_RULES([yes]) + + ADAPTA_OPTION([PARALLEL], [parallel], [parallel-build], [disable]) ++ADAPTA_OPTION([GTK_2], [gtk_2], [Gtk-2.0], [disable]) + ADAPTA_OPTION([GTK_NEXT], [gtk_next], [Gtk-4.0], [disable]) + ADAPTA_OPTION([GNOME], [gnome], [Gnome-Shell], [enable]) + ADAPTA_OPTION([CINNAMON], [cinnamon], [Cinnamon], [enable]) +@@ -106,7 +107,7 @@ AC_MSG_RESULT([ + | Supported Gtk+ Version + ----------------------------------------------------------------- + +- Gtk+ 2.0: always ++ Gtk+ 2.0: $ENABLE_GTK_2 (default: no) + Gtk+ 3.20: always + Gtk+ 3.22: always + Gtk+ 3.24: always +diff --git a/gtk/Makefile.am b/gtk/Makefile.am +index d3291a40..349d18ed 100644 +--- a/gtk/Makefile.am ++++ b/gtk/Makefile.am +@@ -528,7 +528,10 @@ all: + $(MKDIR_P) $(srcdir)/asset/assets-gtk2/Toolbar && \ + $(MKDIR_P) $(srcdir)/asset/assets-gtk3 + ++if ENABLE_GTK_2 + cd $(srcdir)/gtk-2.0 && ./recolor-gtk2.sh ++endif ++ + if ENABLE_PARALLEL + cd $(srcdir)/sass && $(PARALLEL) $(parallel_option) ::: \ + "$(SASSC) $(sassc_option) 3.20/gtk.scss ../gtk-3.20/gtk-contained.css" \ +@@ -593,12 +596,11 @@ if ENABLE_XFCE + endif + + if ENABLE_PARALLEL ++if ENABLE_GTK_2 + cd $(srcdir)/asset/assets-gtk2-scripts && \ + ./recolor-assets-gtk2.sh + cd $(srcdir)/asset/assets-gtk2-scripts && \ + ./clone-assets-gtk2.sh +- cd $(srcdir)/asset/assets-gtk3-scripts && \ +- ./recolor-assets-gtk3.sh + cd $(srcdir)/asset/assets-gtk2-scripts && \ + $(PARALLEL) $(parallel_option) ./render-assets-gtk2.sh ::: \ + arrow \ +@@ -611,6 +613,9 @@ if ENABLE_PARALLEL + range \ + scrollbar \ + spin ++endif ++ cd $(srcdir)/asset/assets-gtk3-scripts && \ ++ ./recolor-assets-gtk3.sh + cd $(srcdir)/asset/assets-gtk3-scripts && \ + $(PARALLEL) $(parallel_option) ./render-assets-gtk3.sh ::: \ + checkbox \ +@@ -623,10 +628,12 @@ if ENABLE_PARALLEL + window-maximize \ + window-unmaximize + else ++if ENABLE_GTK_2 + cd $(srcdir)/asset/assets-gtk2-scripts && \ + ./recolor-assets-gtk2.sh && \ + ./clone-assets-gtk2.sh && \ + ./render-assets-gtk2.sh all ++endif + cd $(srcdir)/asset/assets-gtk3-scripts && \ + ./recolor-assets-gtk3.sh && \ + ./render-assets-gtk3.sh all +@@ -686,6 +693,7 @@ install-data-local: + $(MKDIR_P) $(noktoetadir)/gtk-3.24 + cp -Rv $(gtk324noktoeta_file) $(noktoetadir)/gtk-3.24 + ++if ENABLE_GTK_2 + $(MKDIR_P) $(adaptadir)/gtk-2.0 + $(MKDIR_P) $(adaptadir)/gtk-2.0/Arrows + $(MKDIR_P) $(adaptadir)/gtk-2.0/Buttons +@@ -813,6 +821,7 @@ install-data-local: + cp -Rv $(gtk2_nokto_shadow_file) $(noktoetadir)/gtk-2.0/Shadows + cp -Rv $(gtk2_nokto_spin_file) $(noktoetadir)/gtk-2.0/Spin + cp -Rv $(gtk2_nokto_toolbar_file) $(noktoetadir)/gtk-2.0/Toolbar ++endif + + if ENABLE_GTK_NEXT + $(MKDIR_P) $(adaptadir)/gtk-4.0 diff --git a/pkgs/by-name/ad/adapta-gtk-theme/package.nix b/pkgs/by-name/ad/adapta-gtk-theme/package.nix index 670cff3ad815..844e2174a5e0 100644 --- a/pkgs/by-name/ad/adapta-gtk-theme/package.nix +++ b/pkgs/by-name/ad/adapta-gtk-theme/package.nix @@ -11,7 +11,6 @@ glib, gdk-pixbuf, librsvg, - gtk-engine-murrine, gnome-shell, }: @@ -26,6 +25,10 @@ stdenv.mkDerivation (finalAttrs: { sha256 = "19skrhp10xx07hbd0lr3d619vj2im35d8p9rmb4v4zacci804q04"; }; + patches = [ + ./disable-gtk2.patch + ]; + preferLocalBuild = true; nativeBuildInputs = [ @@ -44,8 +47,6 @@ stdenv.mkDerivation (finalAttrs: { librsvg ]; - propagatedUserEnvPkgs = [ gtk-engine-murrine ]; - postPatch = "patchShebangs ."; configureFlags = [ From e7dae7621f6991bb9f414a74ccebdf1d240171ee Mon Sep 17 00:00:00 2001 From: emilylange Date: Sun, 2 Aug 2026 23:34:36 +0200 Subject: [PATCH 016/121] adapta-gtk-theme: make use of `parallel` GNU Parallel was added to nativeBuildInputs almost 10 years ago in 31702666574390d442a4dc36568208c261678976, but as far as I can tell it always remained opt-in by upstream and thus unused. The speed up is decent, so let's make use of it instead of removing it. --- pkgs/by-name/ad/adapta-gtk-theme/package.nix | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ad/adapta-gtk-theme/package.nix b/pkgs/by-name/ad/adapta-gtk-theme/package.nix index 844e2174a5e0..e301979beac2 100644 --- a/pkgs/by-name/ad/adapta-gtk-theme/package.nix +++ b/pkgs/by-name/ad/adapta-gtk-theme/package.nix @@ -29,8 +29,6 @@ stdenv.mkDerivation (finalAttrs: { ./disable-gtk2.patch ]; - preferLocalBuild = true; - nativeBuildInputs = [ autoreconfHook pkg-config @@ -47,12 +45,18 @@ stdenv.mkDerivation (finalAttrs: { librsvg ]; - postPatch = "patchShebangs ."; + postPatch = '' + substituteInPlace gtk/Makefile.am \ + --replace-fail "--jobs 100%" '--jobs ''${NIX_BUILD_CORES}' + + patchShebangs . + ''; configureFlags = [ "--disable-gtk_legacy" "--disable-gtk_next" "--disable-unity" + "--enable-parallel" ]; meta = { From 559a7d7b2eeb3505995cb55e602536e8cfe470f2 Mon Sep 17 00:00:00 2001 From: emilylange Date: Sun, 2 Aug 2026 23:49:22 +0200 Subject: [PATCH 017/121] adapta-gtk-theme: remove unrecognized `configureFlags` ~~~ configure flags: --prefix=/nix/store/w7r75pckgl3jdp438hhx4h2z052fm81q-adapta-gtk-theme-3.95.0.11 --disable-gtk_legacy --disable-gtk_next --disable-unity --enable-parallel configure: WARNING: unrecognized options: --disable-gtk_legacy, --disable-unity ~~~ --- pkgs/by-name/ad/adapta-gtk-theme/package.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/pkgs/by-name/ad/adapta-gtk-theme/package.nix b/pkgs/by-name/ad/adapta-gtk-theme/package.nix index e301979beac2..c9e84709e640 100644 --- a/pkgs/by-name/ad/adapta-gtk-theme/package.nix +++ b/pkgs/by-name/ad/adapta-gtk-theme/package.nix @@ -53,9 +53,7 @@ stdenv.mkDerivation (finalAttrs: { ''; configureFlags = [ - "--disable-gtk_legacy" "--disable-gtk_next" - "--disable-unity" "--enable-parallel" ]; From 4a11b901e664431e7b5d1efcadb1301116792202 Mon Sep 17 00:00:00 2001 From: emilylange Date: Sun, 2 Aug 2026 23:51:33 +0200 Subject: [PATCH 018/121] adapta-gtk-theme: add emilylange as maintainer --- pkgs/by-name/ad/adapta-gtk-theme/package.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/ad/adapta-gtk-theme/package.nix b/pkgs/by-name/ad/adapta-gtk-theme/package.nix index c9e84709e640..8c5ce9e2ed07 100644 --- a/pkgs/by-name/ad/adapta-gtk-theme/package.nix +++ b/pkgs/by-name/ad/adapta-gtk-theme/package.nix @@ -65,6 +65,9 @@ stdenv.mkDerivation (finalAttrs: { cc-by-sa-30 ]; platforms = lib.platforms.linux; - maintainers = with lib.maintainers; [ romildo ]; + maintainers = with lib.maintainers; [ + romildo + emilylange + ]; }; }) From d3769c05a512fc727972e7fcb85680211f127890 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 3 Aug 2026 05:37:13 +0000 Subject: [PATCH 019/121] git-recent: 2.1.0 -> 2.2.0 --- pkgs/by-name/gi/git-recent/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/gi/git-recent/package.nix b/pkgs/by-name/gi/git-recent/package.nix index 00c1575ad9d1..7b44a7afa5a6 100644 --- a/pkgs/by-name/gi/git-recent/package.nix +++ b/pkgs/by-name/gi/git-recent/package.nix @@ -15,13 +15,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "git-recent"; - version = "2.1.0"; + version = "2.2.0"; src = fetchFromGitHub { owner = "paulirish"; repo = "git-recent"; tag = "v${finalAttrs.version}"; - hash = "sha256-qE6UNNuFfB2n3MuR+9gCRQCJKe0jOgW8ZwzlBZwvkrs="; + hash = "sha256-ScgzMG40uR9+4cjTIHwmefSoAxVNELNx8fDVXGFl8rU="; }; nativeBuildInputs = [ makeBinaryWrapper ]; From 56b87c0d5765a77a1d12ca9ffc2139f1f94b04a8 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 3 Aug 2026 16:11:37 +0000 Subject: [PATCH 020/121] clj-kondo: 2026.07.24 -> 2026.08.03 --- pkgs/by-name/cl/clj-kondo/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/cl/clj-kondo/package.nix b/pkgs/by-name/cl/clj-kondo/package.nix index 756f50175c15..c341414d1b21 100644 --- a/pkgs/by-name/cl/clj-kondo/package.nix +++ b/pkgs/by-name/cl/clj-kondo/package.nix @@ -6,11 +6,11 @@ buildGraalvmNativeImage (finalAttrs: { pname = "clj-kondo"; - version = "2026.07.24"; + version = "2026.08.03"; src = fetchurl { url = "https://github.com/clj-kondo/clj-kondo/releases/download/v${finalAttrs.version}/clj-kondo-${finalAttrs.version}-standalone.jar"; - sha256 = "sha256-QUZkiURBeuv0qxELNRhFw8MudP0m026IpZ8axG922Qg="; + sha256 = "sha256-EXZJtX1855Tz8m7a9gxI1+DGw9zbPF0oVgX0ZoMuKmg="; }; extraNativeImageBuildArgs = [ From d4da196bb008ddbe5c553ccd463276da98e08e35 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 4 Aug 2026 13:47:05 +0000 Subject: [PATCH 021/121] autobrr: 1.82.1 -> 1.83.0 --- pkgs/by-name/au/autobrr/package.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/au/autobrr/package.nix b/pkgs/by-name/au/autobrr/package.nix index 7da263486503..cd70b8d782ab 100644 --- a/pkgs/by-name/au/autobrr/package.nix +++ b/pkgs/by-name/au/autobrr/package.nix @@ -16,12 +16,12 @@ let pname = "autobrr"; - version = "1.82.1"; + version = "1.83.0"; src = fetchFromGitHub { owner = "autobrr"; repo = "autobrr"; tag = "v${version}"; - hash = "sha256-dB/lk05v9L8GAF//N1We3byhsK+156rzRT+r9Q+EVD4="; + hash = "sha256-zVhrQrsv7+qLAGGYCSIcalzZPbmKuUVbgBpubzFuz04="; }; autobrr-web = stdenvNoCC.mkDerivation { @@ -46,7 +46,7 @@ let ; pnpm = pnpm_11; fetcherVersion = 4; - hash = "sha256-wlikd38tAfgaSSD9L7DiSXRQFYcfVq5YA1eWs5NE4n8="; + hash = "sha256-sb4nRsQQnf/j7BTKb5h1joDnV5OSTuY6Omjzaz8f+k4="; }; postBuild = '' @@ -65,7 +65,7 @@ buildGoModule (finalAttrs: { src ; - vendorHash = "sha256-tsGl0uiQV25aemEQvedZUISrlO4IPE+V87nl31m8hZI="; + vendorHash = "sha256-WOf3MCqRCGqR2BJ8CV3o/zl/AYVgaTYVDPC9cFw+8rs="; preBuild = '' cp -r ${finalAttrs.passthru.autobrr-web}/* web/dist From 31fab31559a8f9b4b2108171893b2b967579c9f2 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 4 Aug 2026 15:18:14 +0000 Subject: [PATCH 022/121] censor: 0.9.1 -> 0.10.0 --- pkgs/by-name/ce/censor/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ce/censor/package.nix b/pkgs/by-name/ce/censor/package.nix index 47266846f920..2333f757ff7a 100644 --- a/pkgs/by-name/ce/censor/package.nix +++ b/pkgs/by-name/ce/censor/package.nix @@ -13,14 +13,14 @@ python3Packages.buildPythonApplication (finalAttrs: { pname = "censor"; - version = "0.9.1"; + version = "0.10.0"; pyproject = false; src = fetchFromCodeberg { owner = "censor"; repo = "Censor"; tag = "v${finalAttrs.version}"; - hash = "sha256-4eRJetI/BZPBiG7M3TYQ/QOd2+x1MrCLTOcL9RJYYuo="; + hash = "sha256-F6ODQyI1hELVpHENmOfEDg0uenniqaICQVPvdDKKLzE="; }; nativeBuildInputs = [ From bd9f9eb651de5322b2bcb608f979a15e9e862dc1 Mon Sep 17 00:00:00 2001 From: Felix Singer Date: Sat, 1 Aug 2026 23:53:48 +0200 Subject: [PATCH 023/121] nixos/gerrit: Set ProtectSystem to strict https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#ProtectSystem= Signed-off-by: Felix Singer --- nixos/modules/services/web-apps/gerrit.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/web-apps/gerrit.nix b/nixos/modules/services/web-apps/gerrit.nix index 92464bb49a75..8295eb03bfc7 100644 --- a/nixos/modules/services/web-apps/gerrit.nix +++ b/nixos/modules/services/web-apps/gerrit.nix @@ -246,7 +246,7 @@ in ProtectKernelModules = true; ProtectKernelTunables = true; ProtectProc = "invisible"; - ProtectSystem = "full"; + ProtectSystem = "strict"; RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" From 49ccd7310b8dee98d81c3891ec27222b1c62ca65 Mon Sep 17 00:00:00 2001 From: liberodark Date: Sat, 25 Jul 2026 02:41:44 +0200 Subject: [PATCH 024/121] libkrun: fix riscv64-linux build --- pkgs/by-name/li/libkrun/package.nix | 7 + .../li/libkrun/riscv64-non-tee-memory.patch | 357 ++++++++++++++++++ 2 files changed, 364 insertions(+) create mode 100644 pkgs/by-name/li/libkrun/riscv64-non-tee-memory.patch diff --git a/pkgs/by-name/li/libkrun/package.nix b/pkgs/by-name/li/libkrun/package.nix index ba4641449d8f..c5afdcc5b024 100644 --- a/pkgs/by-name/li/libkrun/package.nix +++ b/pkgs/by-name/li/libkrun/package.nix @@ -71,6 +71,13 @@ stdenv.mkDerivation (finalAttrs: { rustc ]; + patches = lib.optionals stdenv.hostPlatform.isRiscV64 [ + # https://github.com/libkrun/libkrun/commit/d4bb6e0 + # Fix riscv64 non-TEE memory region setup + # Remove in next release (Not included in 1.19.4) + ./riscv64-non-tee-memory.patch + ]; + buildInputs = [ libcap_ng libkrunfw' diff --git a/pkgs/by-name/li/libkrun/riscv64-non-tee-memory.patch b/pkgs/by-name/li/libkrun/riscv64-non-tee-memory.patch new file mode 100644 index 000000000000..47b5856b6e41 --- /dev/null +++ b/pkgs/by-name/li/libkrun/riscv64-non-tee-memory.patch @@ -0,0 +1,357 @@ +From d4bb6e040ad7b6e6a6cf68ffced3b895c2753a18 Mon Sep 17 00:00:00 2001 +From: Zewei Yang +Date: Thu, 19 Mar 2026 09:40:43 +0800 +Subject: [PATCH] vmm: fix riscv64 non-TEE memory region setup + +In non-x86 builds that don't use TEE features, vstate.rs used cfg!() to +distinguish between TEE and non-TEE memory setup paths. + +cfg!() only evaluates to a compile-time constant; code in both branches +still participates in compilation and type checking. As a result, normal +riscv64 builds still type-check guest_memfd and memory attribute code, +which leads to build failures. + +Refactor the memory-region setup into cfg-gated helpers so non-TEE builds +do not compile TEE-only memory setup code, and reject unsupported +TEE+architecture combinations during VM setup instead of during memory +initialization. + +Upstream: https://github.com/libkrun/libkrun/commit/d4bb6e040ad7b6e6a6cf68ffced3b895c2753a18 +Backported to v1.19.0: the upstream diff does not apply as-is because of +the intervening Rust 2024 edition migration / cargo fmt reordering of the +`use kvm_bindings::{...}` blocks. Only those import hunks were adjusted; +no functional change. + +Signed-off-by: Zewei Yang +--- +diff --git a/src/vmm/src/builder.rs b/src/vmm/src/builder.rs +index 6d50e7f..c0521b1 100644 +--- a/src/vmm/src/builder.rs ++++ b/src/vmm/src/builder.rs +@@ -1562,6 +1562,23 @@ pub(crate) fn setup_vm( + .map_err(StartMicrovmError::Internal)?; + Ok(vm) + } ++ ++#[cfg(all(feature = "tee", target_arch = "x86_64"))] ++fn validate_tee_config(tee: Tee) -> std::result::Result<(), StartMicrovmError> { ++ match tee { ++ #[cfg(feature = "amd-sev")] ++ Tee::Snp => Ok(()), ++ #[cfg(feature = "tdx")] ++ Tee::Tdx => Ok(()), ++ _ => Err(StartMicrovmError::InvalidTee), ++ } ++} ++ ++#[cfg(all(feature = "tee", not(target_arch = "x86_64")))] ++fn validate_tee_config(_tee: Tee) -> std::result::Result<(), StartMicrovmError> { ++ Err(StartMicrovmError::InvalidTee) ++} ++ + #[cfg(all(target_os = "linux", feature = "tee"))] + pub(crate) fn setup_vm( + kvm: &KvmContext, +@@ -1569,6 +1586,8 @@ pub(crate) fn setup_vm( + resources: &super::resources::VmResources, + #[cfg(feature = "tdx")] _sender: Sender, + ) -> std::result::Result { ++ validate_tee_config(resources.tee_config().tee)?; ++ + let mut vm = Vm::new( + kvm.fd(), + resources.tee_config(), +diff --git a/src/vmm/src/linux/vstate.rs b/src/vmm/src/linux/vstate.rs +index 05e58fb..d87b743 100644 +--- a/src/vmm/src/linux/vstate.rs ++++ b/src/vmm/src/linux/vstate.rs +@@ -41,7 +41,9 @@ use kbs_types::Tee; + use crate::resources::TeeConfig; + use crate::vmm_config::machine_config::CpuFeaturesTemplate; + #[cfg(target_arch = "x86_64")] +-use cpuid::{c3, filter_cpuid, t2, VmSpec}; ++use cpuid::{VmSpec, c3, filter_cpuid, t2}; ++#[cfg(not(feature = "tee"))] ++use kvm_bindings::kvm_userspace_memory_region; + #[cfg(target_arch = "x86_64")] + use kvm_bindings::{ + kvm_clock_data, kvm_debugregs, kvm_irqchip, kvm_lapic_state, kvm_mp_state, kvm_pit_state2, +@@ -49,14 +51,14 @@ use kvm_bindings::{ + KVM_CLOCK_TSC_STABLE, KVM_IRQCHIP_IOAPIC, KVM_IRQCHIP_PIC_MASTER, KVM_IRQCHIP_PIC_SLAVE, + KVM_MAX_CPUID_ENTRIES, + }; ++use kvm_bindings::{KVM_API_VERSION, KVM_SYSTEM_EVENT_RESET, KVM_SYSTEM_EVENT_SHUTDOWN}; ++#[cfg(feature = "tee")] ++use kvm_bindings::{KVM_CAP_EXIT_HYPERCALL, KVM_MEMORY_EXIT_FLAG_PRIVATE, kvm_enable_cap}; ++#[cfg(all(feature = "tee", target_arch = "x86_64"))] + use kvm_bindings::{ +- kvm_create_guest_memfd, kvm_userspace_memory_region, kvm_userspace_memory_region2, +- KVM_API_VERSION, KVM_MEM_GUEST_MEMFD, KVM_SYSTEM_EVENT_RESET, KVM_SYSTEM_EVENT_SHUTDOWN, ++ KVM_MEM_GUEST_MEMFD, KVM_MEMORY_ATTRIBUTE_PRIVATE, kvm_create_guest_memfd, ++ kvm_memory_attributes, kvm_userspace_memory_region2, + }; +-#[cfg(feature = "tee")] +-use kvm_bindings::{kvm_enable_cap, KVM_CAP_EXIT_HYPERCALL, KVM_MEMORY_EXIT_FLAG_PRIVATE}; +-#[cfg(not(target_arch = "riscv64"))] +-use kvm_bindings::{kvm_memory_attributes, KVM_MEMORY_ATTRIBUTE_PRIVATE}; + use kvm_ioctls::{Cap::*, *}; + use utils::eventfd::EventFd; + use utils::signal::{register_signal_handler, sigrtmin, Killable}; +@@ -661,90 +663,121 @@ impl Vm { + None + } + +- #[allow(unused_mut)] +- fn memory_region_set( ++ // GuestMemfd is generally intended for either of two purposes: ++ // * sharing the memory with out-of-process components, and conversely, ++ // * hiding the memory completely from the VMM process (Confidential Computing). ++ // ++ // We only use it for the second use case currently, so don't even try to use it ++ // outside of TEE builds. Software-protected VMs are only available on x86_64 and ++ // are marked with strongly-worded warnings about them being for development only, ++ // as of late 2025. Also, on other architectures like aarch64, guest_memfd in ++ // general is unstable for now, so don't try to use it without a reason. ++ ++ #[cfg(not(feature = "tee"))] ++ fn create_guest_physical_memory_slot( + &mut self, +- guest_mem: &GuestMemoryMmap, ++ host_addr: u64, ++ start: u64, + region: &GuestRegionMmap, + ) -> Result<()> { +- let host_addr = guest_mem.get_host_address(region.start_addr()).unwrap(); +- let start = region.start_addr().raw_value(); +- let end = start + region.len(); ++ let memory_region = kvm_userspace_memory_region { ++ slot: self.next_mem_slot, ++ guest_phys_addr: start, ++ memory_size: region.len(), ++ userspace_addr: host_addr, ++ flags: 0, ++ }; + +- // GuestMemfd is generally intended for either of two purposes: +- // * sharing the memory with out-of-process components, and conversely, +- // * hiding the memory completely from the VMM process (Confidential Computing). +- // +- // We only use it for the second use case currently, so don't even try to use it +- // outside of TEE builds. Software-protected VMs are only available on x86_64 and +- // are marked with strongly-worded warnings about them being for development only, +- // as of late 2025. Also, on other architectures like aarch64, guest_memfd in +- // general is unstable for now, so don't try to use it without a reason. +- +- if cfg!(not(feature = "tee")) { +- let memory_region = kvm_userspace_memory_region { +- slot: self.next_mem_slot, +- guest_phys_addr: start, +- memory_size: region.len(), +- userspace_addr: host_addr as u64, +- flags: 0, +- }; ++ // Safe because we mapped the memory region and ensured regions do not overlap. ++ unsafe { ++ self.fd ++ .set_user_memory_region(memory_region) ++ .map_err(Error::SetUserMemoryRegion)?; ++ }; + +- // Safe because we mapped the memory region, we made sure that the regions +- // are not overlapping. +- unsafe { +- self.fd +- .set_user_memory_region(memory_region) +- .map_err(Error::SetUserMemoryRegion)?; +- }; +- } else { +- if !self.fd.check_extension(GuestMemfd) { +- return Err(Error::KvmCap(GuestMemfd)); +- } ++ Ok(()) ++ } + +- // Create a guest_memfd and set the region. +- let guest_memfd = self +- .fd +- .create_guest_memfd(kvm_create_guest_memfd { +- size: region.size() as u64, +- flags: 0, +- reserved: [0; 6], +- }) +- .map_err(Error::CreateGuestMemfd)?; +- +- let memory_region = kvm_userspace_memory_region2 { +- slot: self.next_mem_slot, +- flags: KVM_MEM_GUEST_MEMFD, +- guest_phys_addr: start, +- memory_size: region.len(), +- userspace_addr: host_addr as u64, +- guest_memfd_offset: 0, +- guest_memfd: guest_memfd as u32, +- pad1: 0, +- pad2: [0; 14], +- }; +- +- // Safe because we mapped the memory region, we made sure that the regions +- // are not overlapping. +- unsafe { +- self.fd +- .set_user_memory_region2(memory_region) +- .map_err(Error::SetUserMemoryRegion)?; +- }; +- +- let attr = kvm_memory_attributes { +- address: start, +- size: region.len(), +- attributes: KVM_MEMORY_ATTRIBUTE_PRIVATE as u64, ++ #[cfg(all(feature = "tee", target_arch = "x86_64"))] ++ fn create_guest_physical_memory_slot( ++ &mut self, ++ host_addr: u64, ++ start: u64, ++ region: &GuestRegionMmap, ++ ) -> Result<()> { ++ let end = start + region.len(); ++ ++ if !self.fd.check_extension(GuestMemfd) { ++ return Err(Error::KvmCap(GuestMemfd)); ++ } ++ ++ // GuestMemfd is only used for confidential-memory setups in TEE builds. ++ let guest_memfd = self ++ .fd ++ .create_guest_memfd(kvm_create_guest_memfd { ++ size: region.size() as u64, + flags: 0, +- }; ++ reserved: [0; 6], ++ }) ++ .map_err(Error::CreateGuestMemfd)?; ++ ++ let memory_region = kvm_userspace_memory_region2 { ++ slot: self.next_mem_slot, ++ flags: KVM_MEM_GUEST_MEMFD, ++ guest_phys_addr: start, ++ memory_size: region.len(), ++ userspace_addr: host_addr, ++ guest_memfd_offset: 0, ++ guest_memfd: guest_memfd as u32, ++ pad1: 0, ++ pad2: [0; 14], ++ }; + ++ // Safe because we mapped the memory region and ensured regions do not overlap. ++ unsafe { + self.fd +- .set_memory_attributes(attr) +- .map_err(Error::SetMemoryAttributes)?; ++ .set_user_memory_region2(memory_region) ++ .map_err(Error::SetUserMemoryRegion)?; ++ }; + +- self.guest_memfds.push((Range { start, end }, guest_memfd)); +- } ++ let attr = kvm_memory_attributes { ++ address: start, ++ size: region.len(), ++ attributes: KVM_MEMORY_ATTRIBUTE_PRIVATE as u64, ++ flags: 0, ++ }; ++ ++ self.fd ++ .set_memory_attributes(attr) ++ .map_err(Error::SetMemoryAttributes)?; ++ ++ self.guest_memfds.push((Range { start, end }, guest_memfd)); ++ ++ Ok(()) ++ } ++ ++ #[cfg(all(feature = "tee", not(target_arch = "x86_64")))] ++ fn create_guest_physical_memory_slot( ++ &mut self, ++ _host_addr: u64, ++ _start: u64, ++ _region: &GuestRegionMmap, ++ ) -> Result<()> { ++ // TEE support should be rejected during VM setup on non-x86_64 targets. ++ // Do not silently fall back to the non-TEE path here, because that would ++ // ignore an invalid TEE configuration and create a normal VM instead. ++ Err(Error::InvalidTee) ++ } ++ ++ fn memory_region_set( ++ &mut self, ++ guest_mem: &GuestMemoryMmap, ++ region: &GuestRegionMmap, ++ ) -> Result<()> { ++ let host_addr = guest_mem.get_host_address(region.start_addr()).unwrap() as u64; ++ let start = region.start_addr().raw_value(); ++ ++ self.create_guest_physical_memory_slot(host_addr, start, region)?; + + self.next_mem_slot += 1; + +diff --git a/src/vmm/src/worker.rs b/src/vmm/src/worker.rs +index d0131b9..a28ed55 100644 +--- a/src/vmm/src/worker.rs ++++ b/src/vmm/src/worker.rs +@@ -1,20 +1,20 @@ + use std::io; + use std::sync::{Arc, Mutex}; + +-#[cfg(feature = "tee")] ++#[cfg(all(feature = "tee", target_arch = "x86_64"))] + use utils::worker_message::MemoryProperties; + use utils::worker_message::WorkerMessage; + + use crossbeam_channel::Receiver; +-#[cfg(feature = "tee")] ++#[cfg(all(feature = "tee", target_arch = "x86_64"))] + use crossbeam_channel::Sender; +-#[cfg(feature = "tee")] +-use kvm_bindings::{kvm_memory_attributes, KVM_MEMORY_ATTRIBUTE_PRIVATE}; +-#[cfg(feature = "tee")] +-use libc::{fallocate, madvise, FALLOC_FL_KEEP_SIZE, FALLOC_FL_PUNCH_HOLE, MADV_DONTNEED}; +-#[cfg(feature = "tee")] ++#[cfg(all(feature = "tee", target_arch = "x86_64"))] ++use kvm_bindings::{KVM_MEMORY_ATTRIBUTE_PRIVATE, kvm_memory_attributes}; ++#[cfg(all(feature = "tee", target_arch = "x86_64"))] ++use libc::{FALLOC_FL_KEEP_SIZE, FALLOC_FL_PUNCH_HOLE, MADV_DONTNEED, fallocate, madvise}; ++#[cfg(all(feature = "tee", target_arch = "x86_64"))] + use std::ffi::c_void; +-#[cfg(feature = "tee")] ++#[cfg(all(feature = "tee", target_arch = "x86_64"))] + use vm_memory::{ + guest_memory::GuestMemory, Address, GuestAddress, GuestMemoryRegion, MemoryRegionAddress, + }; +@@ -59,15 +59,21 @@ impl super::Vmm { + .send(self.vm.fd().set_irq_line(irq, active).is_ok()) + .unwrap(); + } +- WorkerMessage::ConvertMemory(_sender, _properties) => +- { +- #[cfg(feature = "tee")] +- self.convert_memory(_sender, _properties) ++ WorkerMessage::ConvertMemory(_sender, _properties) => { ++ #[cfg(all(feature = "tee", target_arch = "x86_64"))] ++ { ++ self.convert_memory(_sender, _properties); ++ } ++ ++ #[cfg(not(all(feature = "tee", target_arch = "x86_64")))] ++ { ++ let _ = _sender.send(false); ++ } + } + } + } + +- #[cfg(feature = "tee")] ++ #[cfg(all(feature = "tee", target_arch = "x86_64"))] + fn convert_memory(&self, sender: Sender, properties: MemoryProperties) { + let Some((guest_memfd, region_start)) = self.kvm_vm().guest_memfd_get(properties.gpa) + else { +-- +2.51.0 From 3a024909cbae51ddd7f7ff65c7f1c284db14addb Mon Sep 17 00:00:00 2001 From: liberodark Date: Sat, 20 Jun 2026 12:20:52 +0200 Subject: [PATCH 025/121] deno: add binding output --- pkgs/by-name/de/deno/package.nix | 2 ++ pkgs/by-name/de/deno/rusty-v8/default.nix | 7 +++++++ 2 files changed, 9 insertions(+) diff --git a/pkgs/by-name/de/deno/package.nix b/pkgs/by-name/de/deno/package.nix index 284eb950d8d2..14e4635096b0 100644 --- a/pkgs/by-name/de/deno/package.nix +++ b/pkgs/by-name/de/deno/package.nix @@ -100,6 +100,8 @@ rustPlatform.buildRustPackage (finalAttrs: { # The v8 package will try to download a `librusty_v8.a` release at build time to our read-only filesystem # To avoid this we pre-download the file and export it via RUSTY_V8_ARCHIVE env.RUSTY_V8_ARCHIVE = librusty_v8; + # Workaround for riscv64 because it has no pre-generated bindings. + env.RUSTY_V8_SRC_BINDING_PATH = librusty_v8.binding; # Don't run checks on hydra as they've been observed to be flakey for us and # other distros CI: https://gitlab.alpinelinux.org/alpine/aports/-/blob/bec8b026686323b496365b825ad14fdf4473adf2/community/deno/APKBUILD#L79 diff --git a/pkgs/by-name/de/deno/rusty-v8/default.nix b/pkgs/by-name/de/deno/rusty-v8/default.nix index 8a61c63adce2..6d0426317894 100644 --- a/pkgs/by-name/de/deno/rusty-v8/default.nix +++ b/pkgs/by-name/de/deno/rusty-v8/default.nix @@ -163,10 +163,17 @@ rustPlatform.buildRustPackage (finalAttrs: { "--skip=scope" ]; + outputs = [ + "out" + "binding" + ]; + installPhase = '' runHook preInstall cp target/*/release/gn_out/obj/librusty_v8${stdenv.hostPlatform.extensions.staticLibrary} $out + # workaround for riscv64 because has no pre-generated bindings. + cp target/*/release/gn_out/src_binding.rs $binding runHook postInstall ''; From 796577f77f99c28e1865fe5b5b9d2a52b01d3e4d Mon Sep 17 00:00:00 2001 From: liberodark Date: Thu, 6 Aug 2026 11:52:26 +0200 Subject: [PATCH 026/121] deno: add riscv64-linux support --- pkgs/by-name/de/deno/package.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/by-name/de/deno/package.nix b/pkgs/by-name/de/deno/package.nix index 14e4635096b0..0828bc69ff02 100644 --- a/pkgs/by-name/de/deno/package.nix +++ b/pkgs/by-name/de/deno/package.nix @@ -128,6 +128,8 @@ rustPlatform.buildRustPackage (finalAttrs: { "aarch64" else if stdenv.hostPlatform.isx86_64 then "x64" + else if stdenv.hostPlatform.isRiscV64 then + "riscv64" else throw "Unsupported architecture"; in @@ -297,6 +299,7 @@ rustPlatform.buildRustPackage (finalAttrs: { platforms = [ "x86_64-linux" "aarch64-linux" + "riscv64-linux" "aarch64-darwin" ]; }; From aee0feed85314800372d9d243ca75425c477163a Mon Sep 17 00:00:00 2001 From: Kenichi Kamiya Date: Thu, 6 Aug 2026 19:26:42 +0900 Subject: [PATCH 027/121] fishnet: 2.13.2 -> 2.14.0 Diff: https://github.com/lichess-org/fishnet/compare/v2.13.2...v2.14.0 Changelog: https://github.com/lichess-org/fishnet/releases/tag/v2.14.0 This update also updates updateScript. The new stockfish revision f4bcd40409f94bd397a083c5d6243bac6dcc6d85 includes https://github.com/official-stockfish/Stockfish/commit/ab8f901d25def6c17f83b7a1b4b84eaec404c0f4 which drops the small net. --- pkgs/by-name/fi/fishnet/package.nix | 36 +++++++++++------------------ pkgs/by-name/fi/fishnet/update.bash | 23 +++++------------- 2 files changed, 19 insertions(+), 40 deletions(-) diff --git a/pkgs/by-name/fi/fishnet/package.nix b/pkgs/by-name/fi/fishnet/package.nix index cc6adf916652..638c9ba28a77 100644 --- a/pkgs/by-name/fi/fishnet/package.nix +++ b/pkgs/by-name/fi/fishnet/package.nix @@ -12,40 +12,32 @@ }: let - # These files can be found in Stockfish/src/evaluate.h - nnueBigFile = "nn-9a0cc2a62c52.nnue"; - nnueBigHash = "sha256-mgzCpixSClN6rTrG6QiowJiqkAidyny8h0zCGXYYvyM="; - nnueBig = fetchurl { - url = "https://tests.stockfishchess.org/api/nn/${nnueBigFile}"; - hash = nnueBigHash; - }; - nnueSmallFile = "nn-47fc8b7fff06.nnue"; - nnueSmallHash = "sha256-R/yLf/8GfSQEdJO4TkKrhVwPzrUFjAFsafjuXE7kvWk="; - nnueSmall = fetchurl { - url = "https://tests.stockfishchess.org/api/nn/${nnueSmallFile}"; - hash = nnueSmallHash; + # This file can be found in Stockfish/src/evaluate.h + nnueFile = "nn-89cb98a217f7.nnue"; + nnueHash = "sha256-icuYohf3IBR8coYXYQl76koEKJl90iDsioGlYkMbu+Y="; + nnue = fetchurl { + url = "https://tests.stockfishchess.org/api/nn/${nnueFile}"; + hash = nnueHash; }; in rustPlatform.buildRustPackage (finalAttrs: { pname = "fishnet"; - version = "2.13.2"; + version = "2.14.0"; src = fetchFromGitHub { owner = "lichess-org"; repo = "fishnet"; tag = "v${finalAttrs.version}"; - hash = "sha256-0ArTovfr9znjudo53W5hnnSZlzfEnAd7E+7DXTqtN6w="; + hash = "sha256-p6gZEQfC/XX0qp7nJZps5FNDea5iOVXN4hQ6f5nGKCc="; fetchSubmodules = true; }; postPatch = '' - cp -v '${nnueBig}' 'Stockfish/src/${nnueBigFile}' - cp -v '${nnueBig}' 'Fairy-Stockfish/src/${nnueBigFile}' - cp -v '${nnueSmall}' 'Stockfish/src/${nnueSmallFile}' - cp -v '${nnueSmall}' 'Fairy-Stockfish/src/${nnueSmallFile}' + cp -v '${nnue}' 'Stockfish/src/${nnueFile}' + cp -v '${nnue}' 'Fairy-Stockfish/src/${nnueFile}' ''; - cargoHash = "sha256-mkioBmawYR5GvR0WSlaicGyXV4EVVVQuai5UF5+Thk8="; + cargoHash = "sha256-S3mgeYujRLvEoJYLG8Np1f1JYuftF3lZlptG33QqbNM="; nativeInstallCheckInputs = [ versionCheckHook @@ -68,10 +60,8 @@ rustPlatform.buildRustPackage (finalAttrs: { PNAME = finalAttrs.pname; PKG_FILE = toString ./package.nix; GITHUB_REPOSITORY = "${finalAttrs.src.owner}/${finalAttrs.src.repo}"; - NNUE_BIG_FILE = nnueBigFile; - NNUE_BIG_HASH = nnueBigHash; - NNUE_SMALL_FILE = nnueSmallFile; - NNUE_SMALL_HASH = nnueSmallHash; + NNUE_FILE = nnueFile; + NNUE_HASH = nnueHash; }; text = builtins.readFile ./update.bash; diff --git a/pkgs/by-name/fi/fishnet/update.bash b/pkgs/by-name/fi/fishnet/update.bash index 6e40cba6bfec..b8890a0d4887 100644 --- a/pkgs/by-name/fi/fishnet/update.bash +++ b/pkgs/by-name/fi/fishnet/update.bash @@ -9,31 +9,20 @@ stockfish_revision="$( stockfish_header="$( curl --fail --silent "https://raw.githubusercontent.com/official-stockfish/Stockfish/$stockfish_revision/src/evaluate.h" )" -new_nnue_big_file="$( +new_nnue_file="$( echo "$stockfish_header" | - grep --perl-regexp --only-matching 'EvalFileDefaultNameBig "\Knn-(\w+).nnue' + grep --perl-regexp --only-matching 'EvalFileDefaultName "\Knn-(\w+).nnue' )" -new_nnue_big_hash="$( +new_nnue_hash="$( nix --extra-experimental-features nix-command hash to-sri --type sha256 "$( - nix-prefetch-url --type sha256 "https://tests.stockfishchess.org/api/nn/${new_nnue_big_file}" - )" -)" -new_nnue_small_file="$( - echo "$stockfish_header" | - grep --perl-regexp --only-matching 'EvalFileDefaultNameSmall "\Knn-(\w+).nnue' -)" -new_nnue_small_hash="$( - nix --extra-experimental-features nix-command hash to-sri --type sha256 "$( - nix-prefetch-url --type sha256 "https://tests.stockfishchess.org/api/nn/${new_nnue_small_file}" + nix-prefetch-url --type sha256 "https://tests.stockfishchess.org/api/nn/${new_nnue_file}" )" )" # Update NNUE pkg_body="$(<"$PKG_FILE")" -pkg_body="${pkg_body//"$NNUE_BIG_FILE"/"$new_nnue_big_file"}" -pkg_body="${pkg_body//"$NNUE_BIG_HASH"/"$new_nnue_big_hash"}" -pkg_body="${pkg_body//"$NNUE_SMALL_FILE"/"$new_nnue_small_file"}" -pkg_body="${pkg_body//"$NNUE_SMALL_HASH"/"$new_nnue_small_hash"}" +pkg_body="${pkg_body//"$NNUE_FILE"/"$new_nnue_file"}" +pkg_body="${pkg_body//"$NNUE_HASH"/"$new_nnue_hash"}" echo "$pkg_body" >"$PKG_FILE" # Update version, src From 0b9cb62462019f8c632d5f0c9fff1da5454a6c74 Mon Sep 17 00:00:00 2001 From: gbhu753 Date: Tue, 28 Jul 2026 23:19:56 +1200 Subject: [PATCH 028/121] vicinae: add aarch64-darwin support --- pkgs/by-name/vi/vicinae/package.nix | 51 ++++++++++++++++++++++++----- 1 file changed, 42 insertions(+), 9 deletions(-) diff --git a/pkgs/by-name/vi/vicinae/package.nix b/pkgs/by-name/vi/vicinae/package.nix index 07305a7859d3..7c3520632e41 100644 --- a/pkgs/by-name/vi/vicinae/package.nix +++ b/pkgs/by-name/vi/vicinae/package.nix @@ -1,4 +1,5 @@ { + apple-sdk, cmake, cmark-gfm, coreutils, @@ -15,10 +16,12 @@ pkg-config, qt6, stdenv, + swift, wayland, libxml2, udevCheckHook, }: + stdenv.mkDerivation (finalAttrs: { pname = "vicinae"; version = "0.23.2"; @@ -45,7 +48,11 @@ stdenv.mkDerivation (finalAttrs: { "VICINAE_PROVENANCE" = "nix"; "INSTALL_NODE_MODULES" = "OFF"; "INSTALL_BROWSER_NATIVE_HOST" = "OFF"; + "USE_SYSTEM_CMARK_GFM" = "ON"; "USE_SYSTEM_GLAZE" = "ON"; + "USE_SYSTEM_KF6" = "ON"; + "USE_SYSTEM_QT_KEYCHAIN" = "ON"; + "BUNDLE_SOULVER_CORE" = "OFF"; "CMAKE_INSTALL_PREFIX" = placeholder "out"; "CMAKE_INSTALL_DATAROOTDIR" = "share"; "CMAKE_INSTALL_BINDIR" = "bin"; @@ -60,22 +67,34 @@ stdenv.mkDerivation (finalAttrs: { nodejs pkg-config qt6.wrapQtAppsHook + ] + ++ lib.optionals stdenv.hostPlatform.isDarwin [ + qt6.qttools + swift ]; buildInputs = [ cmark-gfm glaze - kdePackages.layer-shell-qt kdePackages.qtkeychain kdePackages.syntax-highlighting libqalculate minizip nodejs qt6.qtbase + qt6.qtdeclarative + qt6.qtimageformats qt6.qtsvg + qt6.qtshadertools + libxml2 + ] + ++ lib.optionals stdenv.hostPlatform.isLinux [ + kdePackages.layer-shell-qt qt6.qtwayland wayland - libxml2 + ] + ++ lib.optionals stdenv.hostPlatform.isDarwin [ + apple-sdk ]; postPatch = '' @@ -98,14 +117,28 @@ stdenv.mkDerivation (finalAttrs: { }" ]; - postFixup = '' - substituteInPlace $out/share/systemd/user/vicinae.service \ - --replace-fail "/bin/kill" "${lib.getExe' coreutils "kill"}"\ - --replace-fail "ExecStart=vicinae" "ExecStart=$out/bin/vicinae" + postInstall = lib.optionalString stdenv.hostPlatform.isDarwin '' + app=$out/Applications/Vicinae.app + install -Dm755 bin/vicinae-server "$app/Contents/MacOS/Vicinae" + install -Dm755 bin/vicinae "$app/Contents/MacOS/vicinae-cli" + install -Dm644 Info.plist "$app/Contents/Info.plist" + install -Dm644 ../extra/vicinae.icns "$app/Contents/Resources/vicinae.icns" + cp -r ../extra/themes "$app/Contents/Resources/themes" + rm -f "$out/bin/vicinae" ''; - doInstallCheck = true; - nativeInstallCheckInputs = [ udevCheckHook ]; + postFixup = + lib.optionalString stdenv.hostPlatform.isLinux '' + substituteInPlace $out/share/systemd/user/vicinae.service \ + --replace-fail "/bin/kill" "${lib.getExe' coreutils "kill"}"\ + --replace-fail "ExecStart=vicinae" "ExecStart=$out/bin/vicinae" + '' + + lib.optionalString stdenv.hostPlatform.isDarwin '' + ln -s ../Applications/Vicinae.app/Contents/MacOS/vicinae-cli "$out/bin/vicinae" + ''; + + doInstallCheck = stdenv.hostPlatform.isLinux; + nativeInstallCheckInputs = lib.optionals stdenv.hostPlatform.isLinux [ udevCheckHook ]; passthru.updateScript = ./update.sh; @@ -114,7 +147,7 @@ stdenv.mkDerivation (finalAttrs: { homepage = "https://github.com/vicinaehq/vicinae"; license = lib.licenses.gpl3Plus; maintainers = with lib.maintainers; [ zstg ]; - platforms = lib.platforms.linux; + platforms = lib.platforms.linux ++ lib.platforms.darwin; mainProgram = "vicinae"; }; }) From 47358e861fbcb2c633602934e97b990c94ab90ba Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 7 Aug 2026 09:36:36 +0000 Subject: [PATCH 029/121] temporal-ui-server: 2.52.1 -> 2.53.1 --- pkgs/by-name/te/temporal-ui-server/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/te/temporal-ui-server/package.nix b/pkgs/by-name/te/temporal-ui-server/package.nix index 6e68bf22576f..216f3f69d958 100644 --- a/pkgs/by-name/te/temporal-ui-server/package.nix +++ b/pkgs/by-name/te/temporal-ui-server/package.nix @@ -8,16 +8,16 @@ buildGoModule (finalAttrs: { pname = "temporal-ui-server"; - version = "2.52.1"; + version = "2.53.1"; src = fetchFromGitHub { owner = "temporalio"; repo = "ui-server"; tag = "v${finalAttrs.version}"; - hash = "sha256-Z6lDqzDDzyHh2ZLf1paqUT9f6+ioR0qnVhX4/QFa9D0="; + hash = "sha256-qeSIrU+Jh1PINlF9RPEXYVzeI6mn3mJgeVTbtPDwJg8="; }; - vendorHash = "sha256-E9pg16YJRDahBmiHwQY3r8kA+vBfza7KdFYqdw+qBSY="; + vendorHash = "sha256-a4b4Z0/1KZyQdpvnwhGAXLVYUdUBXNdRoWSLfOmL6h4="; postInstall = '' mv $out/bin/server $out/bin/temporal-ui-server From cbe0baa90db190428a6b14568acf7715b1deef06 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Thu, 6 Aug 2026 16:00:56 +0200 Subject: [PATCH 030/121] home-assistant.python3Packages.pytest-homeassistant-custom-component: fix e2e tests --- ...t-homeassistant-custom-component-tmpdir.patch | 16 ++++++++++++++++ .../pytest-homeassistant-custom-component.nix | 5 +++++ 2 files changed, 21 insertions(+) create mode 100644 pkgs/servers/home-assistant/pytest-homeassistant-custom-component-tmpdir.patch diff --git a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component-tmpdir.patch b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component-tmpdir.patch new file mode 100644 index 000000000000..906742eeac53 --- /dev/null +++ b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component-tmpdir.patch @@ -0,0 +1,16 @@ +diff --git a/src/pytest_homeassistant_custom_component/common.py b/src/pytest_homeassistant_custom_component/common.py +--- a/src/pytest_homeassistant_custom_component/common.py ++++ b/src/pytest_homeassistant_custom_component/common.py +@@ -167,7 +167,11 @@ + + def get_test_config_dir(*add_path): + """Return a path to a test config dir.""" +- return os.path.join(os.path.dirname(__file__), "testing_config", *add_path) ++ if not hasattr(get_test_config_dir, "_tmpdir"): ++ import tempfile ++ get_test_config_dir._tmpdir = tempfile.mkdtemp(prefix="pytest-hass-") ++ os.makedirs(os.path.join(get_test_config_dir._tmpdir, "testing_config"), exist_ok=True) ++ return os.path.join(get_test_config_dir._tmpdir, "testing_config", *add_path) + + + class StoreWithoutWriteLoad[_T: (Mapping[str, Any] | Sequence[Any])](storage.Store[_T]): diff --git a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix index 4973219c462f..529c7e9e3a92 100644 --- a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix +++ b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix @@ -31,6 +31,11 @@ buildPythonPackage rec { hash = "sha256-odLMKgdhaG0Wd6Pi4pX4WtCosKxSDRIALhiVjah16no="; }; + patches = [ + # e2e tests should write temporary files into a temporary directory instead of into the installation directory aka the nix store + ./pytest-homeassistant-custom-component-tmpdir.patch + ]; + build-system = [ setuptools ]; pythonRemoveDeps = true; From 4c1eabfb177778acf66951c9735cd4d94cae15ce Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Thu, 6 Aug 2026 16:10:46 +0200 Subject: [PATCH 031/121] home-assistant-custom-components.plant: enable tests that now work --- .../home-assistant/custom-components/plant/package.nix | 6 ------ 1 file changed, 6 deletions(-) diff --git a/pkgs/servers/home-assistant/custom-components/plant/package.nix b/pkgs/servers/home-assistant/custom-components/plant/package.nix index d0c610193893..de0e4670cacb 100644 --- a/pkgs/servers/home-assistant/custom-components/plant/package.nix +++ b/pkgs/servers/home-assistant/custom-components/plant/package.nix @@ -30,12 +30,6 @@ buildHomeAssistantComponent rec { pytestCheckHook ]; - disabledTestPaths = [ - # pytest_homeassistant_custom_component wants to write into its nix store path - "tests/test_conditions.py" - "tests/test_triggers.py" - ]; - meta = { description = "Alternative Plant component of home assistant"; homepage = "https://github.com/Olen/homeassistant-plant"; From 4647117adb3d2e7e3aaa455ac462373af9fb7e5b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Thu, 6 Aug 2026 16:13:52 +0200 Subject: [PATCH 032/121] home-assistant-custom-components.blueprints-updater: enable tests that now work --- .../custom-components/blueprints-updater/package.nix | 7 ------- 1 file changed, 7 deletions(-) diff --git a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix index 838e567486aa..0d1f35a040bb 100644 --- a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix +++ b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix @@ -46,13 +46,6 @@ buildHomeAssistantComponent rec { pytestCheckHook ]; - disabledTestPaths = [ - # pytest-homeassistant-custom-component tries to create temporary directories inside the nix store - "tests/integration/test_init.py::test_full_update_lifecycle" - "tests/integration/test_services.py::test_restore_blueprint_service" - "tests/integration/test_services.py::test_update_all_service" - ]; - meta = { description = "Automatically update Home Assistant blueprints via native update entities"; homepage = "https://github.com/luuquangvu/blueprints-updater/"; From 387d9f57a91f9b62dd92d254203ddb8026d96b31 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Thu, 6 Aug 2026 16:42:40 +0200 Subject: [PATCH 033/121] home-assistant-custom-components.moonraker: enable tests that now work, do not randomly disable phases --- .../custom-components/moonraker/package.nix | 9 --------- 1 file changed, 9 deletions(-) diff --git a/pkgs/servers/home-assistant/custom-components/moonraker/package.nix b/pkgs/servers/home-assistant/custom-components/moonraker/package.nix index a415ca09f4c1..adb8577500f6 100644 --- a/pkgs/servers/home-assistant/custom-components/moonraker/package.nix +++ b/pkgs/servers/home-assistant/custom-components/moonraker/package.nix @@ -34,15 +34,6 @@ buildHomeAssistantComponent rec { ] ++ home-assistant.getPackages "camera" home-assistant.python3Packages; - disabledTests = [ - # tests try to open sockets - "test_thumbnail_camera_from_img_to_none" - "test_bad_connection_config_flow" - ]; - - #skip phases with nothing to do - dontConfigure = true; - meta = { changelog = "https://github.com/marcolivierarsenault/moonraker-home-assistant/releases/tag/${version}"; description = "Custom integration for Moonraker and Klipper in Home Assistant"; From b7b9a1a3e801f5860e119ad544842c21e083e515 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Thu, 6 Aug 2026 16:45:34 +0200 Subject: [PATCH 034/121] home-assistant-custom-components.thewatchman: enable tests that now work --- .../home-assistant/custom-components/thewatchman/package.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/pkgs/servers/home-assistant/custom-components/thewatchman/package.nix b/pkgs/servers/home-assistant/custom-components/thewatchman/package.nix index 11899f1cb21d..0242678f4cd8 100644 --- a/pkgs/servers/home-assistant/custom-components/thewatchman/package.nix +++ b/pkgs/servers/home-assistant/custom-components/thewatchman/package.nix @@ -37,8 +37,6 @@ buildHomeAssistantComponent rec { ]; disabledTests = [ - # the test relies on NOT changing the hass config_dir and tries to write into the nix store - "test_status_sensor_safe_mode" # flaky "test_automations_parsing" # Timing sensitive: Should still not be called (T=2.5 < T=3) From a10ec952d8c4dadb0e2c9bdccf299e8c1c228ffe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Thu, 6 Aug 2026 16:46:13 +0200 Subject: [PATCH 035/121] home-assistant-custom-components.yandex-station: enable tests that now work --- .../custom-components/yandex-station/package.nix | 9 --------- 1 file changed, 9 deletions(-) diff --git a/pkgs/servers/home-assistant/custom-components/yandex-station/package.nix b/pkgs/servers/home-assistant/custom-components/yandex-station/package.nix index f59180a2050c..ae6cbed77410 100644 --- a/pkgs/servers/home-assistant/custom-components/yandex-station/package.nix +++ b/pkgs/servers/home-assistant/custom-components/yandex-station/package.nix @@ -23,15 +23,6 @@ buildHomeAssistantComponent rec { zeroconf ]; - disabledTests = [ - # 'µg/m³' vs 'μg/m³' - "test_sensor_qingping" - ]; - - disabledTestPaths = [ - # this test seems to be broken - "tests/test_local.py::test_track" - ]; nativeCheckInputs = [ home-assistant pytestCheckHook From 2eb68ffe8230d762f0326330f6a95478905313c9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Thu, 6 Aug 2026 16:47:31 +0200 Subject: [PATCH 036/121] home-assistant-custom-components.blitzortung: enable tests that now work --- .../home-assistant/custom-components/blitzortung/package.nix | 5 ----- 1 file changed, 5 deletions(-) diff --git a/pkgs/servers/home-assistant/custom-components/blitzortung/package.nix b/pkgs/servers/home-assistant/custom-components/blitzortung/package.nix index 102ba62329cd..5600f7edd3fd 100644 --- a/pkgs/servers/home-assistant/custom-components/blitzortung/package.nix +++ b/pkgs/servers/home-assistant/custom-components/blitzortung/package.nix @@ -28,11 +28,6 @@ buildHomeAssistantComponent (finalAttrs: { pytestCheckHook ]; - disabledTests = [ - # 2026.5.0 compat issue - "test_connect_with_server_stats" - ]; - meta = { description = "Custom Component for fetching lightning data from blitzortung.org"; homepage = "https://github.com/mrk-its/homeassistant-blitzortung"; From c50abd7574ad75e24f949019eb8b0e314fccf3ae Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Thu, 6 Aug 2026 16:48:37 +0200 Subject: [PATCH 037/121] home-assistant-custom-components.powercalc: enable tests that now work --- .../home-assistant/custom-components/powercalc/package.nix | 5 ----- 1 file changed, 5 deletions(-) diff --git a/pkgs/servers/home-assistant/custom-components/powercalc/package.nix b/pkgs/servers/home-assistant/custom-components/powercalc/package.nix index 34cb46f4cde5..666573d63e4d 100644 --- a/pkgs/servers/home-assistant/custom-components/powercalc/package.nix +++ b/pkgs/servers/home-assistant/custom-components/powercalc/package.nix @@ -41,11 +41,6 @@ buildHomeAssistantComponent rec { tests/setup.sh ''; - disabledTests = [ - # test contacts api.powercalc.nl - "test_exception_is_raised_on_github_resource_unavailable" - ]; - meta = { changelog = "https://github.com/bramstroker/homeassistant-powercalc/releases/tag/${src.tag}"; description = "Custom Home Assistant component for virtual power sensors"; From fb63b523527b39abff31aa2956a7c54aba9e4f0d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Thu, 6 Aug 2026 16:49:28 +0200 Subject: [PATCH 038/121] home-assistant-custom-components.midea_ac: enable tests that now work --- .../custom-components/midea_ac/package.nix | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/pkgs/servers/home-assistant/custom-components/midea_ac/package.nix b/pkgs/servers/home-assistant/custom-components/midea_ac/package.nix index e72ccb9f856d..8c8cc1b008a1 100644 --- a/pkgs/servers/home-assistant/custom-components/midea_ac/package.nix +++ b/pkgs/servers/home-assistant/custom-components/midea_ac/package.nix @@ -26,17 +26,6 @@ buildHomeAssistantComponent rec { pytestCheckHook ]; - disabledTests = [ - # tests try to open sockets - "test_manual_flow_ac_device" - "test_manual_flow_cc_device" - # lingering datacoordinator timer on test teardown - "test_refresh_apply_race_condition" - "test_refresh_apply_race_condition_with_proxy" - "test_group5_entity_request_enable" - "test_energy_sensor_request_enable" - ]; - meta = { changelog = "https://github.com/mill1000/midea-ac-py/releases/tag/${src.tag}"; description = "Home Assistant custom integration to control Midea (and associated brands) air conditioners via LAN"; From dd29ae4ccb8d801899690528ffc181c2d81acba2 Mon Sep 17 00:00:00 2001 From: Johannes Kirschbauer Date: Fri, 7 Aug 2026 17:16:57 +0200 Subject: [PATCH 039/121] pkgs/nixos-render-docs: fix included content should be 'page' to avoid class collisions --- doc/style.css | 3 ++- .../nixos-render-docs/src/nixos_render_docs/manual.py | 10 +++++----- .../src/nixos_render_docs/manual_structure.py | 4 ++-- 3 files changed, 9 insertions(+), 8 deletions(-) diff --git a/doc/style.css b/doc/style.css index 5ca664ed61f7..042c3f42de82 100644 --- a/doc/style.css +++ b/doc/style.css @@ -465,7 +465,8 @@ div.appendix .variablelist .term { font-display: swap; } -.chapter { +div.chapter, +div.page { content-visibility: auto; } diff --git a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py index 551465ad4881..66f65c85df18 100644 --- a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py +++ b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py @@ -236,7 +236,7 @@ class RendererMixin(Renderer): 'included_preface': lambda *args: self._included_thing("preface", *args), 'included_parts': lambda *args: self._included_thing("part", *args), 'included_appendix': lambda *args: self._included_thing("appendix", *args), - 'included_content': lambda *args: self._included_thing("content", *args), + 'included_page': lambda *args: self._included_thing("page", *args), 'included_options': self.included_options, } @@ -396,7 +396,7 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer): intersection_observer_js = """ // Token: included = [self._build_config_item(node, config_file) for node in nodes] - token = Token('included_content', '', 0, map=[0, 1]) + token = Token('included_page', '', 0, map=[0, 1]) token.meta['included'] = included token.meta['include-args'] = {} return token @@ -749,7 +749,7 @@ class HTMLConverter(BaseConverter[ManualHTMLRenderer]): path = (config_file.parent / node.file).resolve() leaf_src = path.read_text() self._base_paths.append(path) - self._current_type.append('content') + self._current_type.append('page') try: fragment = self._parse(leaf_src) finally: @@ -884,7 +884,7 @@ class HTMLConverter(BaseConverter[ManualHTMLRenderer]): title_html = ( f"{title_html}" if typ == 'chapter' - else title_html if typ in [ 'book', 'part', 'content' ] + else title_html if typ in [ 'book', 'part', 'page' ] else f'the section called “{title_html}”' ) return XrefTarget(id, title_html, toc_html, re.sub('<.*?>', '', title), path, drop_fragment) diff --git a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual_structure.py b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual_structure.py index 204b5aa9b933..56b122918285 100644 --- a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual_structure.py +++ b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual_structure.py @@ -15,8 +15,8 @@ FragmentType = Literal['preface', 'part', 'chapter', 'section', 'appendix'] # the TOC allows every fragment type. it also allows the enclosing book. # it allows 'example' and 'figure'. -# --experimental-config adds a generic 'content' kind. -TocEntryType = Literal['book', 'preface', 'part', 'chapter', 'section', 'appendix', 'example', 'figure', 'content'] +# --experimental-config adds a generic 'page' kind. +TocEntryType = Literal['book', 'preface', 'part', 'chapter', 'section', 'appendix', 'example', 'figure', 'page'] def is_include(token: Token) -> bool: return token.type == "fence" and token.info.startswith("{=include=} ") From 3d24d4e4fd94456556ca33964ebca7adfb474375 Mon Sep 17 00:00:00 2001 From: Kerstin Humm Date: Tue, 30 Jun 2026 15:58:03 +0200 Subject: [PATCH 040/121] mobilizon: 5.2.3 -> 5.2.4 Changelog: https://framagit.org/kaihuri/mobilizon/-/releases/5.2.4 --- nixos/modules/services/web-apps/mobilizon.nix | 4 + nixos/tests/mobilizon.nix | 5 +- pkgs/by-name/mo/mobilizon/alias.patch | 13 -- pkgs/by-name/mo/mobilizon/common.nix | 11 +- pkgs/by-name/mo/mobilizon/frontend.nix | 9 +- pkgs/by-name/mo/mobilizon/json_polyfill.patch | 25 +++ pkgs/by-name/mo/mobilizon/mix.nix | 210 +++++++++++------- pkgs/by-name/mo/mobilizon/package.nix | 33 ++- 8 files changed, 197 insertions(+), 113 deletions(-) delete mode 100644 pkgs/by-name/mo/mobilizon/alias.patch create mode 100644 pkgs/by-name/mo/mobilizon/json_polyfill.patch diff --git a/nixos/modules/services/web-apps/mobilizon.nix b/nixos/modules/services/web-apps/mobilizon.nix index 77a19e60a074..8803ec71d35c 100644 --- a/nixos/modules/services/web-apps/mobilizon.nix +++ b/nixos/modules/services/web-apps/mobilizon.nix @@ -241,6 +241,10 @@ in ); message = "Setting the IP mobilizon listens on is only possible when the nginx config is not used, as it is hardcoded there."; } + { + assertion = lib.versionOlder config.services.postgresql.finalPackage.version "18"; + message = "Mobilizon currently doesn't support PostgreSQL versions above 18. See https://framagit.org/kaihuri/mobilizon/-/work_items/2070 for the upstream issue."; + } ]; services.mobilizon.settings = { diff --git a/nixos/tests/mobilizon.nix b/nixos/tests/mobilizon.nix index 5800ac702f16..c5a9779ac798 100644 --- a/nixos/tests/mobilizon.nix +++ b/nixos/tests/mobilizon.nix @@ -13,7 +13,7 @@ in ]; nodes.server = - { ... }: + { pkgs, ... }: { services.mobilizon = { enable = true; @@ -37,6 +37,9 @@ in }; networking.hosts."::1" = [ mobilizonDomain ]; + + # https://framagit.org/kaihuri/mobilizon/-/work_items/2070 + services.postgresql.package = pkgs.postgresql_17; }; testScript = '' diff --git a/pkgs/by-name/mo/mobilizon/alias.patch b/pkgs/by-name/mo/mobilizon/alias.patch deleted file mode 100644 index 02319e461c95..000000000000 --- a/pkgs/by-name/mo/mobilizon/alias.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/lib/federation/activity_pub/types/resources.ex b/lib/federation/activity_pub/types/resources.ex -index fd1831e68..0fa00129a 100644 ---- a/lib/federation/activity_pub/types/resources.ex -+++ b/lib/federation/activity_pub/types/resources.ex -@@ -4,7 +4,7 @@ defmodule Mobilizon.Federation.ActivityPub.Types.Resources do - alias Mobilizon.Actors.Actor - alias Mobilizon.Federation.ActivityPub.Permission - alias Mobilizon.Federation.ActivityPub.Types.Entity -- alias alias Mobilizon.Federation.ActivityStream -+ alias Mobilizon.Federation.ActivityStream - alias Mobilizon.Federation.ActivityStream.Convertible - alias Mobilizon.Resources.Resource - alias Mobilizon.Service.Activity.Resource, as: ResourceActivity diff --git a/pkgs/by-name/mo/mobilizon/common.nix b/pkgs/by-name/mo/mobilizon/common.nix index bcc8494681e0..cb26dbf9fcc7 100644 --- a/pkgs/by-name/mo/mobilizon/common.nix +++ b/pkgs/by-name/mo/mobilizon/common.nix @@ -2,13 +2,20 @@ rec { pname = "mobilizon"; - version = "5.2.3"; + version = "5.2.4"; src = fetchFromGitLab { domain = "framagit.org"; owner = "kaihuri"; repo = pname; tag = version; - hash = "sha256-uMMmRP3T9KlF+S0xDk2rY2bqEjjM8zWJVRbegth4pdw="; + hash = "sha256-qsyuk3RnJXXG7ZYgtZlGvY3Wtq9aLKCrFiG/9nONUPw="; }; + + patches = [ + # Portion of + # https://framagit.org/kaihuri/mobilizon/-/commit/df7f9ce8081aedf94856b6c58067b3db6ce0eb39, + # but framagit put Anubis in front of everything, so we can't download the patch anymore… + ./json_polyfill.patch + ]; } diff --git a/pkgs/by-name/mo/mobilizon/frontend.nix b/pkgs/by-name/mo/mobilizon/frontend.nix index 6861254546bd..0ba21f8b8f77 100644 --- a/pkgs/by-name/mo/mobilizon/frontend.nix +++ b/pkgs/by-name/mo/mobilizon/frontend.nix @@ -9,9 +9,14 @@ let common = callPackage ./common.nix { }; in buildNpmPackage { - inherit (common) pname version src; + inherit (common) + pname + version + src + patches + ; - npmDepsHash = "sha256-nqjqRdIF583cmUd/mg9+PogA8Tpo5mfh0R9IylDpWZg="; + npmDepsHash = "sha256-gvAHUgfS21UrZYUL/QUsAMymqh4g/Moo/+vTl6RH/7I="; nativeBuildInputs = [ imagemagick ]; diff --git a/pkgs/by-name/mo/mobilizon/json_polyfill.patch b/pkgs/by-name/mo/mobilizon/json_polyfill.patch new file mode 100644 index 000000000000..3f046dbab5b6 --- /dev/null +++ b/pkgs/by-name/mo/mobilizon/json_polyfill.patch @@ -0,0 +1,25 @@ +diff --git a/mix.exs b/mix.exs +index 82fd7bf11..31d40fd26 100644 +--- a/mix.exs ++++ b/mix.exs +@@ -246,8 +246,7 @@ defmodule Mobilizon.Mixfile do + {:haversine, "~> 0.1.0"}, + {:ecto_dev_logger, "~> 0.7"}, + {:castore, "~> 1.0"}, +- {:credo_code_climate, "~> 0.1.0", only: [:dev, :test]}, +- {:json_polyfill, "~> 0.2"} ++ {:credo_code_climate, "~> 0.1.0", only: [:dev, :test]} + ] ++ oauth_deps() + end + +--- a/mix.lock ++++ b/mix.lock +@@ -82,7 +82,6 @@ + "ip_reserved": {:hex, :ip_reserved, "0.1.1", "e5112d71f1abf05207f82fd9597d369a5fde1e0b6d1bbe77c02a99bb26ecdc33", [:mix], [{:inet_cidr, "~> 1.0.0", [hex: :inet_cidr, repo: "hexpm", optional: false]}], "hexpm", "55fcd2b6e211caef09ea3f54ef37d43030bec486325d12fe865ab5ed8140a4fe"}, + "jason": {:hex, :jason, "1.4.5", "2e3a008590b0b8d7388c20293e9dcc9cf3e5d642fd2a114e4cbbb52e595d940a", [:mix], [{:decimal, "~> 1.0 or ~> 2.0 or ~> 3.0", [hex: :decimal, repo: "hexpm", optional: true]}], "hexpm", "b0c823996102bcd0239b3c2444eb00409b72f6a140c1950bc8b457d836b30684"}, + "jose": {:hex, :jose, "1.11.12", "06e62b467b61d3726cbc19e9b5489f7549c37993de846dfb3ee8259f9ed208b3", [:mix, :rebar3], [], "hexpm", "31e92b653e9210b696765cdd885437457de1add2a9011d92f8cf63e4641bab7b"}, +- "json_polyfill": {:hex, :json_polyfill, "0.2.2", "789016c5b87a043f12196c840480264e630b1955e2e28f124cd38df7b0a95b25", [:rebar3], [], "hexpm", "33cb73ade53df5967375817e64e8af3c6ba35524b2f8b31eb94c265291e724d9"}, + "jumper": {:hex, :jumper, "1.0.2", "68cdcd84472a00ac596b4e6459a41b3062d4427cbd4f1e8c8793c5b54f1406a7", [:mix], [], "hexpm", "9b7782409021e01ab3c08270e26f36eb62976a38c1aa64b2eaf6348422f165e1"}, + "junit_formatter": {:hex, :junit_formatter, "3.4.0", "d0e8db6c34dab6d3c4154c3b46b21540db1109ae709d6cf99ba7e7a2ce4b1ac2", [:mix], [], "hexpm", "bb36e2ae83f1ced6ab931c4ce51dd3dbef1ef61bb4932412e173b0cfa259dacd"}, + "linkify": {:hex, :linkify, "0.5.3", "5f8143d8f61f5ff08d3aeeff47ef6509492b4948d8f08007fbf66e4d2246a7f2", [:mix], [], "hexpm", "3ef35a1377d47c25506e07c1c005ea9d38d700699d92ee92825f024434258177"}, + diff --git a/pkgs/by-name/mo/mobilizon/mix.nix b/pkgs/by-name/mo/mobilizon/mix.nix index f62eed115866..7c6f9cd65777 100644 --- a/pkgs/by-name/mo/mobilizon/mix.nix +++ b/pkgs/by-name/mo/mobilizon/mix.nix @@ -17,12 +17,12 @@ let { absinthe = buildMix rec { name = "absinthe"; - version = "1.9.1"; + version = "1.11.0"; src = fetchHex { pkg = "absinthe"; version = "${version}"; - sha256 = "d93e1aa61d68b974f48d5660104cb911ae045ee3a5d69954d251f91f3dbe2077"; + sha256 = "39b3b4b6e3eb405fa98b449feef0dacff81d89bf01c2866cfa513616c5530ba6"; }; beamDeps = [ @@ -35,12 +35,12 @@ let absinthe_phoenix = buildMix rec { name = "absinthe_phoenix"; - version = "2.0.4"; + version = "2.0.5"; src = fetchHex { pkg = "absinthe_phoenix"; version = "${version}"; - sha256 = "66617ee63b725256ca16264364148b10b19e2ecb177488cd6353584f2e6c1cf3"; + sha256 = "086c6d4a1c32f7444713130d204c87b1b006169f5159026b73f02f7d38ccd05c"; }; beamDeps = [ @@ -55,12 +55,12 @@ let absinthe_plug = buildMix rec { name = "absinthe_plug"; - version = "1.5.9"; + version = "1.5.10"; src = fetchHex { pkg = "absinthe_plug"; version = "${version}"; - sha256 = "dcdc84334b0e9e2cd439bd2653678a822623f212c71088edf0a4a7d03f1fa225"; + sha256 = "489ac1951c8e4128571141c60a0669a720619bc161f801a8c6be8cfaf7ab0979"; }; beamDeps = [ @@ -100,12 +100,12 @@ let bandit = buildMix rec { name = "bandit"; - version = "1.10.3"; + version = "1.12.0"; src = fetchHex { pkg = "bandit"; version = "${version}"; - sha256 = "99a52d909c48db65ca598e1962797659e3c0f1d06e825a50c3d75b74a5e2db18"; + sha256 = "45dac82dc86f45cf4a196dee9cc5a8b791d9c9469d996055f055e6ee36c66e20"; }; beamDeps = [ @@ -150,12 +150,12 @@ let castore = buildMix rec { name = "castore"; - version = "1.0.18"; + version = "1.0.19"; src = fetchHex { pkg = "castore"; version = "${version}"; - sha256 = "f393e4fe6317829b158fb74d86eb681f737d2fe326aa61ccf6293c4104957e34"; + sha256 = "3669e6cab13f54c2df26b3e6833745d647f35b6e30d8ddd5975df0d5c842ca98"; }; beamDeps = [ ]; @@ -176,12 +176,12 @@ let cldr_utils = buildMix rec { name = "cldr_utils"; - version = "2.29.5"; + version = "2.29.7"; src = fetchHex { pkg = "cldr_utils"; version = "${version}"; - sha256 = "962d3a2028b232ee0a5373941dc411028a9442f53444a4d5d2c354f687db1835"; + sha256 = "4bddcd597fee34e2d2829ae9ef62bcfef8d97ae5f6b75f0c6ee37a3db31aa73a"; }; beamDeps = [ @@ -245,12 +245,12 @@ let credo = buildMix rec { name = "credo"; - version = "1.7.17"; + version = "1.7.19"; src = fetchHex { pkg = "credo"; version = "${version}"; - sha256 = "1eb5645c835f0b6c9b5410f94b5a185057bcf6d62a9c2b476da971cde8749645"; + sha256 = "2d8bc95d5a7bb99dd2613621d4f08c6a3575c3fd4b62e6a2b48a100352a557b8"; }; beamDeps = [ @@ -294,12 +294,12 @@ let db_connection = buildMix rec { name = "db_connection"; - version = "2.9.0"; + version = "2.10.1"; src = fetchHex { pkg = "db_connection"; version = "${version}"; - sha256 = "17d502eacaf61829db98facf6f20808ed33da6ccf495354a41e64fe42f9c509c"; + sha256 = "18ed94c6e627b4bf452dbd4df61b69a35a1e768525140bc1917b7a685026a6a3"; }; beamDeps = [ telemetry ]; @@ -307,12 +307,12 @@ let decimal = buildMix rec { name = "decimal"; - version = "2.3.0"; + version = "2.4.1"; src = fetchHex { pkg = "decimal"; version = "${version}"; - sha256 = "a4d66355cb29cb47c3cf30e71329e58361cfcb37c34235ef3bf1d7bf3773aeac"; + sha256 = "7e618897933a8455f19a727d7c5e50a2c071a544b700e5e724298ecb4340187f"; }; beamDeps = [ ]; @@ -333,18 +333,15 @@ let digital_token = buildMix rec { name = "digital_token"; - version = "1.0.0"; + version = "2.0.0"; src = fetchHex { pkg = "digital_token"; version = "${version}"; - sha256 = "8ed6f5a8c2fa7b07147b9963db506a1b4c7475d9afca6492136535b064c9e9e6"; + sha256 = "cbd2fff52770284a8251540a4b4e529e9738c6fe052d7f3c3428eb5c817385cd"; }; - beamDeps = [ - cldr_utils - jason - ]; + beamDeps = [ ]; }; doctor = buildMix rec { @@ -362,12 +359,12 @@ let earmark_parser = buildMix rec { name = "earmark_parser"; - version = "1.4.44"; + version = "1.4.45"; src = fetchHex { pkg = "earmark_parser"; version = "${version}"; - sha256 = "4778ac752b4701a5599215f7030989c989ffdc4f6df457c5f36938cc2d2a2750"; + sha256 = "d3ec045bf122965db20c0bdb420e19ee1415843135327124918473feb4b328e8"; }; beamDeps = [ ]; @@ -388,12 +385,12 @@ let ecto = buildMix rec { name = "ecto"; - version = "3.13.5"; + version = "3.13.6"; src = fetchHex { pkg = "ecto"; version = "${version}"; - sha256 = "df9efebf70cf94142739ba357499661ef5dbb559ef902b68ea1f3c1fabce36de"; + sha256 = "8afa059bc16cd2c94739ec0a11e3e5df69d828125119109bef35f20a21a76af2"; }; beamDeps = [ @@ -503,12 +500,12 @@ let elixir_make = buildMix rec { name = "elixir_make"; - version = "0.9.0"; + version = "0.10.0"; src = fetchHex { pkg = "elixir_make"; version = "${version}"; - sha256 = "db23d4fd8b757462ad02f8aa73431a426fe6671c80b200d9710caf3d1dd0ffdb"; + sha256 = "dc1f09fb7fa68866b886abd5f0f3c83553b1a19a52359a899e92af1bb3b31982"; }; beamDeps = [ ]; @@ -516,12 +513,12 @@ let erlex = buildMix rec { name = "erlex"; - version = "0.2.8"; + version = "0.2.9"; src = fetchHex { pkg = "erlex"; version = "${version}"; - sha256 = "9d66ff9fedf69e49dc3fd12831e12a8a37b76f8651dd21cd45fcf5561a8a7590"; + sha256 = "8cfffc0ec7159e6d73de2ab28a588064de80f88b2798d5cbe4482cbbc200178b"; }; beamDeps = [ ]; @@ -555,12 +552,12 @@ let ex_cldr = buildMix rec { name = "ex_cldr"; - version = "2.47.2"; + version = "2.47.4"; src = fetchHex { pkg = "ex_cldr"; version = "${version}"; - sha256 = "4a7cef380a1c2546166b45d6ee5e8e2f707ea695b12ae6dadd250201588b4f16"; + sha256 = "918aabc032955f3eac70abbdf2c5469433132edfaaaccee55451f074ee1ccdba"; }; beamDeps = [ @@ -574,12 +571,12 @@ let ex_cldr_calendars = buildMix rec { name = "ex_cldr_calendars"; - version = "2.4.2"; + version = "2.4.3"; src = fetchHex { pkg = "ex_cldr_calendars"; version = "${version}"; - sha256 = "ab69fd04bc1ae18baf9d2e57335d4754c5ac263076ea397eb112621702251fe5"; + sha256 = "b46ef6bd74f7e2dc3de27366f79372b1e630563bcf09b7803fec162e28d4a85e"; }; beamDeps = [ @@ -591,12 +588,12 @@ let ex_cldr_currencies = buildMix rec { name = "ex_cldr_currencies"; - version = "2.17.1"; + version = "2.17.2"; src = fetchHex { pkg = "ex_cldr_currencies"; version = "${version}"; - sha256 = "e266a0a61f4c7d83608154d49b59e4d7485b2aaa7ba1d0e17b3c55910595de51"; + sha256 = "797095c106a2fe6632981531e29cfb1d2f8ee7de626f4d6243f974d6f74a0112"; }; beamDeps = [ @@ -639,12 +636,12 @@ let ex_cldr_numbers = buildMix rec { name = "ex_cldr_numbers"; - version = "2.38.1"; + version = "2.38.3"; src = fetchHex { pkg = "ex_cldr_numbers"; version = "${version}"; - sha256 = "4f95738f1dc4e821485e52226666f7691c9276bf6eba49cba8d23c8a2db05e84"; + sha256 = "3a0d87ef2747c66d78ae8967023d415d3d76aa310981047ad601e3287e8fe73c"; }; beamDeps = [ @@ -658,12 +655,12 @@ let ex_cldr_plugs = buildMix rec { name = "ex_cldr_plugs"; - version = "1.3.4"; + version = "1.4.0"; src = fetchHex { pkg = "ex_cldr_plugs"; version = "${version}"; - sha256 = "30829e097eac403013101dc087e6cabf5e01a1c5e3a6b23ea4562e85521ff52a"; + sha256 = "0859ccd533bddd00a36008ea970ba2d6440c8f01b1d73b115f445015046277bc"; }; beamDeps = [ @@ -676,12 +673,12 @@ let ex_doc = buildMix rec { name = "ex_doc"; - version = "0.40.1"; + version = "0.40.3"; src = fetchHex { pkg = "ex_doc"; version = "${version}"; - sha256 = "bcef0e2d360d93ac19f01a85d58f91752d930c0a30e2681145feea6bd3516e00"; + sha256 = "2756e357742fecd9749b489b85d67c9ce99c465f2e75728d9e6dc8d704b973de"; }; beamDeps = [ @@ -874,12 +871,12 @@ let floki = buildMix rec { name = "floki"; - version = "0.38.1"; + version = "0.38.4"; src = fetchHex { pkg = "floki"; version = "${version}"; - sha256 = "e744bf0db7ee34b2c8b62767f04071107af0516a81144b9a2f73fe0494200e5b"; + sha256 = "bdb34645eee8e79845c7edaca2d4099a52804ee4d4a3ecc683a69451f0244973"; }; beamDeps = [ ]; @@ -944,12 +941,12 @@ let geolix = buildMix rec { name = "geolix"; - version = "2.0.0"; + version = "2.1.0"; src = fetchHex { pkg = "geolix"; version = "${version}"; - sha256 = "8742bf588ed0bb7def2c443204d09d355990846c6efdff96ded66aac24c301df"; + sha256 = "0b871bc2db8efd0114d1fd7087c83180056a1fff20d90946c89d32200e368651"; }; beamDeps = [ ]; @@ -1109,15 +1106,15 @@ let http_signatures = buildMix rec { name = "http_signatures"; - version = "0.1.2"; + version = "0.1.3"; src = fetchHex { pkg = "http_signatures"; version = "${version}"; - sha256 = "f08aa9ac121829dae109d608d83c84b940ef2f183ae50f2dd1e9a8bc619d8be7"; + sha256 = "20313a65516db88006f85b090f6f76cc5b04e9609b45943657e6781eb91174f4"; }; - beamDeps = [ ]; + beamDeps = [ plug ]; }; httpoison = buildMix rec { @@ -1174,12 +1171,12 @@ let jason = buildMix rec { name = "jason"; - version = "1.4.4"; + version = "1.4.5"; src = fetchHex { pkg = "jason"; version = "${version}"; - sha256 = "c5eb0cab91f094599f94d55bc63409236a8ec69a21a67814529e8d5f6cc90b3b"; + sha256 = "b0c823996102bcd0239b3c2444eb00409b72f6a140c1950bc8b457d836b30684"; }; beamDeps = [ decimal ]; @@ -1268,12 +1265,12 @@ let makeup_erlang = buildMix rec { name = "makeup_erlang"; - version = "1.0.3"; + version = "1.1.0"; src = fetchHex { pkg = "makeup_erlang"; version = "${version}"; - sha256 = "953297c02582a33411ac6208f2c6e55f0e870df7f80da724ed613f10e6706afd"; + sha256 = "1cd6780fb1dd1a03979abaed0fe82712b0625118fd5257d3ebbf73f960c73c3c"; }; beamDeps = [ makeup ]; @@ -1320,12 +1317,12 @@ let mimerl = buildRebar3 rec { name = "mimerl"; - version = "1.4.0"; + version = "1.5.0"; src = fetchHex { pkg = "mimerl"; version = "${version}"; - sha256 = "13af15f9f68c65884ecca3a3891d50a7b57d82152792f3e19d88650aa126b144"; + sha256 = "db648ce065bae14ea84ca8b5dd123f42f49417cef693541110bf6f9e9be9ecc4"; }; beamDeps = [ ]; @@ -1476,12 +1473,12 @@ let oauth2 = buildMix rec { name = "oauth2"; - version = "2.1.0"; + version = "2.1.1"; src = fetchHex { pkg = "oauth2"; version = "${version}"; - sha256 = "8ac07f85b3307dd1acfeb0ec852f64161b22f57d0ce0c15e616a1dfc8ebe2b41"; + sha256 = "1d5997cb1ff1643dac17076b6c00c91e4381d8389f3c49a8c390984606dad439"; }; beamDeps = [ tesla ]; @@ -1502,12 +1499,12 @@ let oban = buildMix rec { name = "oban"; - version = "2.20.3"; + version = "2.23.0"; src = fetchHex { pkg = "oban"; version = "${version}"; - sha256 = "075ffbf1279a96bec495bc63d647b08929837d70bcc0427249ffe4d1dddaec33"; + sha256 = "8e5f0cec5abecce78dd08cb14dc5438db90ec3884987b44773ce76fe60dd3f81"; }; beamDeps = [ @@ -1518,6 +1515,23 @@ let ]; }; + oidcc = buildMix rec { + name = "oidcc"; + version = "3.7.2"; + + src = fetchHex { + pkg = "oidcc"; + version = "${version}"; + sha256 = "e3f1ed91509fdeb31ec8b9de4ecda0e80cb68b463a9f5b7a9ee1ee40e521e445"; + }; + + beamDeps = [ + jose + telemetry + telemetry_registry + ]; + }; + paasaa = buildMix rec { name = "paasaa"; version = "1.0.0"; @@ -1546,12 +1560,12 @@ let phoenix = buildMix rec { name = "phoenix"; - version = "1.8.5"; + version = "1.8.8"; src = fetchHex { pkg = "phoenix"; version = "${version}"; - sha256 = "83b2bb125127e02e9f475c8e3e92736325b5b01b0b9b05407bcb4083b7a32485"; + sha256 = "f0c843037bd2e7012fc1d1ec9574dfa6972b7e3d09e9b77fd23aa283af0aa994"; }; beamDeps = [ @@ -1632,12 +1646,12 @@ let phoenix_live_view = buildMix rec { name = "phoenix_live_view"; - version = "1.1.27"; + version = "1.2.3"; src = fetchHex { pkg = "phoenix_live_view"; version = "${version}"; - sha256 = "415735d0b2c612c9104108b35654e977626a0cb346711e1e4f1ed16e3c827ede"; + sha256 = "449affd6aea24daaa2f6b43748fc1e2c6a87610df996cc1f54e7b19a7a18e638"; }; beamDeps = [ @@ -1714,12 +1728,12 @@ let plug = buildMix rec { name = "plug"; - version = "1.19.1"; + version = "1.20.1"; src = fetchHex { pkg = "plug"; version = "${version}"; - sha256 = "560a0017a8f6d5d30146916862aaf9300b7280063651dd7e532b8be168511e62"; + sha256 = "892d2a1a7a3f5368c5a3b9067bba1050c031495f48c430ec00b09691dbf211b7"; }; beamDeps = [ @@ -1757,12 +1771,12 @@ let postgrex = buildMix rec { name = "postgrex"; - version = "0.22.0"; + version = "0.22.2"; src = fetchHex { pkg = "postgrex"; version = "${version}"; - sha256 = "a68c4261e299597909e03e6f8ff5a13876f5caadaddd0d23af0d0a61afcc5d84"; + sha256 = "8946382ddb06294f56026ac4278b3cc212bac8a2c82ed68b4087819ed1abc53b"; }; beamDeps = [ @@ -1877,12 +1891,12 @@ let sleeplocks = buildRebar3 rec { name = "sleeplocks"; - version = "1.1.3"; + version = "1.1.4"; src = fetchHex { pkg = "sleeplocks"; version = "${version}"; - sha256 = "d3b3958552e6eb16f463921e70ae7c767519ef8f5be46d7696cc1ed649421321"; + sha256 = "bc12752ab0693ea4e4a3bcf4e063cef408d71197a3c0fad75497fabd475f5481"; }; beamDeps = [ ]; @@ -1968,12 +1982,12 @@ let swoosh = buildMix rec { name = "swoosh"; - version = "1.23.1"; + version = "1.26.2"; src = fetchHex { pkg = "swoosh"; version = "${version}"; - sha256 = "3193813b462d6dd519e907c680df04988c47bae372b4159e0c4c9f1c42dffea3"; + sha256 = "08c6a1636b82721d0f64259053a733526526d077011ff6a7776f80e21dc60757"; }; beamDeps = [ @@ -1990,25 +2004,38 @@ let telemetry = buildRebar3 rec { name = "telemetry"; - version = "1.4.1"; + version = "1.4.2"; src = fetchHex { pkg = "telemetry"; version = "${version}"; - sha256 = "2172e05a27531d3d31dd9782841065c50dd5c3c7699d95266b2edd54c2dafa1c"; + sha256 = "928f6495066506077862c0d1646609eed891a4326bee3126ba54b60af61febb1"; }; beamDeps = [ ]; }; + telemetry_registry = buildMix rec { + name = "telemetry_registry"; + version = "0.3.2"; + + src = fetchHex { + pkg = "telemetry_registry"; + version = "${version}"; + sha256 = "e7ed191eb1d115a3034af8e1e35e4e63d5348851d556646d46ca3d1b4e16bab9"; + }; + + beamDeps = [ telemetry ]; + }; + tesla = buildMix rec { name = "tesla"; - version = "1.16.0"; + version = "1.20.0"; src = fetchHex { pkg = "tesla"; version = "${version}"; - sha256 = "eb3bdfc0c6c8a23b4e3d86558e812e3577acff1cb4acb6cfe2da1985a1035b89"; + sha256 = "3ecb41cb458772332752c3acdfe983e23abb991f5a43cfd69a64e9ea3f4b0061"; }; beamDeps = [ @@ -2023,12 +2050,12 @@ let thousand_island = buildMix rec { name = "thousand_island"; - version = "1.4.3"; + version = "1.5.0"; src = fetchHex { pkg = "thousand_island"; version = "${version}"; - sha256 = "6e4ce09b0fd761a58594d02814d40f77daff460c48a7354a15ab353bb998ea0b"; + sha256 = "708923d40523e43cf99041ab37a0d4b0ec426ac6438fa3716ab23d919eaeb412"; }; beamDeps = [ telemetry ]; @@ -2053,12 +2080,12 @@ let tls_certificate_check = buildRebar3 rec { name = "tls_certificate_check"; - version = "1.32.0"; + version = "1.33.0"; src = fetchHex { pkg = "tls_certificate_check"; version = "${version}"; - sha256 = "38e38db768244d808e11ed27f812e7d927ea5f999007b07d0473db44d7f7cc51"; + sha256 = "cab9a7439e2dbfe91b38104f2d8a4b6d61dbc4d3a5ad59ac364713a88c6cfd9b"; }; beamDeps = [ ssl_verify_fun ]; @@ -2084,12 +2111,12 @@ let tzdata = buildMix rec { name = "tzdata"; - version = "1.1.3"; + version = "1.1.4"; src = fetchHex { pkg = "tzdata"; version = "${version}"; - sha256 = "d4ca85575a064d29d4e94253ee95912edfb165938743dbf002acdf0dcecb0c28"; + sha256 = "ab48888699de8ff4a255522fd858abe81bac2e64690a375e6cb590112cf4a24e"; }; beamDeps = [ hackney ]; @@ -2221,6 +2248,23 @@ let ]; }; + ueberauth_oidcc = buildMix rec { + name = "ueberauth_oidcc"; + version = "0.4.2"; + + src = fetchHex { + pkg = "ueberauth_oidcc"; + version = "${version}"; + sha256 = "b9ea3c981464a5052e4f4fbf0a3c716e124da056aca30b9754654c5c6f90f8c2"; + }; + + beamDeps = [ + oidcc + plug + ueberauth + ]; + }; + ueberauth_twitter = buildMix rec { name = "ueberauth_twitter"; version = "0.4.1"; diff --git a/pkgs/by-name/mo/mobilizon/package.nix b/pkgs/by-name/mo/mobilizon/package.nix index 3409d5b8b97c..7869ea7fc009 100644 --- a/pkgs/by-name/mo/mobilizon/package.nix +++ b/pkgs/by-name/mo/mobilizon/package.nix @@ -1,10 +1,11 @@ { lib, callPackage, - writeScript, + writeShellScriptBin, beam, mix2nix, fetchFromGitHub, + applyPatches, git, cmake, nixosTests, @@ -18,10 +19,12 @@ let common = callPackage ./common.nix { }; in beamPackages.mixRelease rec { - inherit (common) pname version src; - - # A typo that is a build failure on elixir 1.18 - patches = [ ./alias.patch ]; + inherit (common) + pname + version + src + patches + ; nativeBuildInputs = [ git @@ -51,8 +54,8 @@ beamPackages.mixRelease rec { repo = "cldr"; rev = "v${old.version}"; hash = - assert old.version == "2.47.2"; - "sha256-XiShurm4i/Qxop1nE4Z/8tMj5953kUqn+4kBrILxO+Y="; + assert old.version == "2.47.4"; + "sha256-LIQK6pZRAW1T3Ej2XAjnuPo82hPJ2KiMPWYmHWgx008="; }; postInstall = '' cp $src/priv/cldr/locales/* $out/lib/erlang/lib/ex_cldr-${old.version}/priv/cldr/locales/ @@ -141,12 +144,18 @@ beamPackages.mixRelease rec { passthru = { tests = { inherit (nixosTests) mobilizon; }; - updateScript = writeScript "update-mobilizon" '' - set -euo pipefail + updateScript = + let + patchedSource = applyPatches { + inherit src patches; + }; + in + writeShellScriptBin "update-mobilizon" '' + set -euo pipefail - ${lib.getExe mix2nix} '${src}/mix.lock' > pkgs/by-name/mo/mobilizon/mix.nix - ${lib.getExe nixfmt} pkgs/by-name/mo/mobilizon/mix.nix - ''; + ${lib.getExe mix2nix} '${patchedSource}/mix.lock' > pkgs/by-name/mo/mobilizon/mix.nix + ${lib.getExe nixfmt} pkgs/by-name/mo/mobilizon/mix.nix + ''; elixirPackage = beamPackages.elixir; inherit mixNixDeps; }; From 1b61a9765dbbf7ea9b27c3bcb7f9c0fc3cc4c0a9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Thu, 6 Aug 2026 16:51:28 +0200 Subject: [PATCH 041/121] home-assistant-custom-components.homematicip_local: enable tests that now work and disable a new one --- .../custom-components/homematicip_local/package.nix | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix b/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix index cce0af2bcbbb..8231f20266e0 100644 --- a/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix +++ b/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix @@ -49,13 +49,8 @@ buildHomeAssistantComponent rec { ]; disabledTestPaths = [ - # tries to write to the Nix store - "tests/test_blueprints.py" - ]; - - disabledTests = [ - # custom_components.homematicip_local.support.InvalidConfig: C - "test_async_validate_config_and_get_system_information" + # zeroconf fails with: No such device + "tests/test_config_flow.py::TestReauthFlow::test_reauth_flow_success" ]; meta = { From d77378d8bbe543068806b0061c722c3b9e2c3654 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 7 Aug 2026 23:19:34 +0000 Subject: [PATCH 042/121] blackfire: 2026.7.0 -> 2026.8.0 --- pkgs/by-name/bl/blackfire/package.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/bl/blackfire/package.nix b/pkgs/by-name/bl/blackfire/package.nix index 07e82ae20747..1ffb8958d480 100644 --- a/pkgs/by-name/bl/blackfire/package.nix +++ b/pkgs/by-name/bl/blackfire/package.nix @@ -11,7 +11,7 @@ stdenv.mkDerivation rec { pname = "blackfire"; - version = "2026.7.0"; + version = "2026.8.0"; src = passthru.sources.${stdenv.hostPlatform.system} @@ -60,19 +60,19 @@ stdenv.mkDerivation rec { sources = { "x86_64-linux" = fetchurl { url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_amd64.deb"; - hash = "sha256-GzhcK+7NrQEP48XFmOQ9PVrvvsUzrCy/VRcshTSic9E="; + hash = "sha256-9hBHQvR4w7AnJGL5FdzfYyxoAOnoFtsOC8Fd+7A+Y0M="; }; "i686-linux" = fetchurl { url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_i386.deb"; - hash = "sha256-F6U7YHSBE5Ogie2yBSGGUKt0XsE8jogKi2GP28H1Eeo="; + hash = "sha256-HnNgdGVhzX+WIXzgfukPZAKB7jr9PwxOUJ8iMOaMOI8="; }; "aarch64-linux" = fetchurl { url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_arm64.deb"; - hash = "sha256-eDJAjd/5omgUJ6sw5kCqxu7Ok2AYei/WGlXV96Ynd/U="; + hash = "sha256-Q89i59KSA2oN8PEVScmnf56i6MJZgDbpTNW8Eojd8To="; }; "aarch64-darwin" = fetchurl { url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_arm64.pkg.tar.gz"; - hash = "sha256-xzWw6us+9/r8lMMHZTgE++rX7ZZShAL7L7fOneALA4Q="; + hash = "sha256-h3vTwK8/wZLoAsAnFSSiDe6CvZNtPG0TAAt4Vts4GBE="; }; }; From e5af6ff1c64601053d8ef402cd29e8c1177296e0 Mon Sep 17 00:00:00 2001 From: liberodark Date: Thu, 16 Jul 2026 18:43:04 +0200 Subject: [PATCH 043/121] livekit-libwebrtc: fix eval on unsupported systems --- pkgs/by-name/li/livekit-libwebrtc/package.nix | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/li/livekit-libwebrtc/package.nix b/pkgs/by-name/li/livekit-libwebrtc/package.nix index f7e1fd2e88b3..bbe8a140b8cd 100644 --- a/pkgs/by-name/li/livekit-libwebrtc/package.nix +++ b/pkgs/by-name/li/livekit-libwebrtc/package.nix @@ -49,7 +49,7 @@ let "aarch64" = "arm64"; }; cpuName = stdenv.hostPlatform.parsed.cpu.name; - gnArch = platformMap."${cpuName}" or (throw "unsupported arch ${cpuName}"); + gnArch = platformMap."${cpuName}" or "unsupported"; gnOs = if stdenv.hostPlatform.isLinux then "linux" @@ -352,6 +352,8 @@ stdenv.mkDerivation { WeetHet niklaskorz ]; - platforms = lib.platforms.linux ++ lib.platforms.darwin; + platforms = lib.intersectLists (lib.platforms.linux ++ lib.platforms.darwin) ( + lib.platforms.x86 ++ lib.platforms.aarch64 ++ lib.platforms.arm + ); }; } From a3a4e22a1c67d5b6f15f167016ba1cee6955637b Mon Sep 17 00:00:00 2001 From: liberodark Date: Thu, 16 Jul 2026 19:15:03 +0200 Subject: [PATCH 044/121] python3Packages.jaxlib: fix eval on unsupported systems --- pkgs/development/python-modules/jaxlib/bin.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/development/python-modules/jaxlib/bin.nix b/pkgs/development/python-modules/jaxlib/bin.nix index 4b5a1742e6c2..a3109dab2a26 100644 --- a/pkgs/development/python-modules/jaxlib/bin.nix +++ b/pkgs/development/python-modules/jaxlib/bin.nix @@ -129,5 +129,11 @@ buildPythonPackage { sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ]; license = lib.licenses.asl20; maintainers = with lib.maintainers; [ samuela ]; + platforms = [ + "i686-linux" + "x86_64-linux" + "aarch64-linux" + "aarch64-darwin" + ]; }; } From a51d12f0fc27aee5be0687bb1c317705b5fc9372 Mon Sep 17 00:00:00 2001 From: liberodark Date: Thu, 16 Jul 2026 19:08:12 +0200 Subject: [PATCH 045/121] slack: fix eval on unsupported systems --- pkgs/by-name/sl/slack/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/sl/slack/package.nix b/pkgs/by-name/sl/slack/package.nix index d347bd66ef14..897537c4fe83 100644 --- a/pkgs/by-name/sl/slack/package.nix +++ b/pkgs/by-name/sl/slack/package.nix @@ -34,5 +34,5 @@ let in callPackage (if stdenvNoCC.hostPlatform.isDarwin then ./darwin.nix else ./linux.nix) { inherit pname passthru meta; - inherit (sources.${system} or (throw "Unsupported system: ${system}")) version src; + inherit (sources.${system} or sources.x86_64-linux) version src; } From 98341da50fe636ffb13f85104534aa348d0078be Mon Sep 17 00:00:00 2001 From: liberodark Date: Thu, 16 Jul 2026 19:28:48 +0200 Subject: [PATCH 046/121] dbeaver-bin: fix eval on unsupported systems --- pkgs/by-name/db/dbeaver-bin/package.nix | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/db/dbeaver-bin/package.nix b/pkgs/by-name/db/dbeaver-bin/package.nix index b7594ad914c2..7b455076f982 100644 --- a/pkgs/by-name/db/dbeaver-bin/package.nix +++ b/pkgs/by-name/db/dbeaver-bin/package.nix @@ -142,7 +142,11 @@ stdenvNoCC.mkDerivation (finalAttrs: { ''; sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ]; license = lib.licenses.asl20; - platforms = lib.platforms.linux ++ lib.platforms.darwin; + platforms = [ + "x86_64-linux" + "aarch64-linux" + "aarch64-darwin" + ]; maintainers = with lib.maintainers; [ gepbird mkg20001 From 5dbe411c568c11a26f89f2761b56a9fc6ecc8617 Mon Sep 17 00:00:00 2001 From: liberodark Date: Thu, 16 Jul 2026 19:39:25 +0200 Subject: [PATCH 047/121] zulu: fix eval on unsupported systems --- pkgs/development/compilers/zulu/common.nix | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/pkgs/development/compilers/zulu/common.nix b/pkgs/development/compilers/zulu/common.nix index 46724ffea83c..0038ab2e7bf4 100644 --- a/pkgs/development/compilers/zulu/common.nix +++ b/pkgs/development/compilers/zulu/common.nix @@ -32,16 +32,14 @@ ffmpeg, }: let - dist = - dists.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}"); + dist = dists.${stdenv.hostPlatform.system} or (builtins.head (builtins.attrValues dists)); arch = { "aarch64" = "aarch64"; "x86_64" = "x64"; } - .${stdenv.hostPlatform.parsed.cpu.name} - or (throw "Unsupported architecture: ${stdenv.hostPlatform.parsed.cpu.name}"); + .${stdenv.hostPlatform.parsed.cpu.name} or "unsupported"; platform = { From 42d3f6864e6136841249ca2fad299180ba983e6e Mon Sep 17 00:00:00 2001 From: liberodark Date: Thu, 16 Jul 2026 19:54:22 +0200 Subject: [PATCH 048/121] polyglot: fix eval on unsupported systems --- pkgs/by-name/po/polyglot/package.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/po/polyglot/package.nix b/pkgs/by-name/po/polyglot/package.nix index f80f7cbbd8bf..d7f6e5036e00 100644 --- a/pkgs/by-name/po/polyglot/package.nix +++ b/pkgs/by-name/po/polyglot/package.nix @@ -79,7 +79,10 @@ maven.buildMavenPackage rec { changelog = "https://github.com/DraqueT/PolyGlot/releases/tag/v${version}"; license = lib.licenses.mit; maintainers = with lib.maintainers; [ noodlez1232 ]; - platforms = lib.platforms.linux; + platforms = [ + "x86_64-linux" + "aarch64-linux" + ]; mainProgram = "PolyGlot"; }; } From cecffd4a1c31eb33a2612427996ac731356a558d Mon Sep 17 00:00:00 2001 From: liberodark Date: Thu, 16 Jul 2026 20:02:04 +0200 Subject: [PATCH 049/121] boundary: fix eval on unsupported systems --- pkgs/by-name/bo/boundary/package.nix | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/bo/boundary/package.nix b/pkgs/by-name/bo/boundary/package.nix index c0c2ead360fc..95c26313ec54 100644 --- a/pkgs/by-name/bo/boundary/package.nix +++ b/pkgs/by-name/bo/boundary/package.nix @@ -71,7 +71,11 @@ stdenv.mkDerivation rec { jk techknowlogick ]; - platforms = lib.platforms.unix; + platforms = [ + "x86_64-linux" + "aarch64-linux" + "aarch64-darwin" + ]; mainProgram = "boundary"; }; } From 55791a76a2a0f84e37529205f6bd63ba3a12e251 Mon Sep 17 00:00:00 2001 From: liberodark Date: Thu, 16 Jul 2026 20:02:46 +0200 Subject: [PATCH 050/121] oracle-instantclient: fix eval on unsupported systems --- pkgs/by-name/or/oracle-instantclient/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/or/oracle-instantclient/package.nix b/pkgs/by-name/or/oracle-instantclient/package.nix index aeae686adf0c..9d1d30d9d04e 100644 --- a/pkgs/by-name/or/oracle-instantclient/package.nix +++ b/pkgs/by-name/or/oracle-instantclient/package.nix @@ -17,7 +17,7 @@ assert odbcSupport -> unixodbc != null; let inherit (lib) optional optionalString; - throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}"; + throwSystem = "unsupported"; # assemble list of components components = [ From 434d5ed55866304f2e117bf0689479f62a1b95cf Mon Sep 17 00:00:00 2001 From: liberodark Date: Thu, 16 Jul 2026 20:21:52 +0200 Subject: [PATCH 051/121] router: fix eval on unsupported systems --- pkgs/by-name/ro/router/package.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/by-name/ro/router/package.nix b/pkgs/by-name/ro/router/package.nix index bbdfe1339043..346923a2412f 100644 --- a/pkgs/by-name/ro/router/package.nix +++ b/pkgs/by-name/ro/router/package.nix @@ -53,6 +53,11 @@ rustPlatform.buildRustPackage rec { description = "Configurable, high-performance routing runtime for Apollo Federation"; homepage = "https://www.apollographql.com/docs/router/"; license = lib.licenses.elastic20; + platforms = [ + "x86_64-linux" + "aarch64-linux" + "aarch64-darwin" + ]; maintainers = [ lib.maintainers.bbigras ]; }; } From 499bb1d40e990c66d00b3df4dc6dbde51dff63e1 Mon Sep 17 00:00:00 2001 From: liberodark Date: Thu, 16 Jul 2026 20:22:34 +0200 Subject: [PATCH 052/121] goose-cli: fix eval on unsupported systems --- pkgs/by-name/go/goose-cli/package.nix | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/go/goose-cli/package.nix b/pkgs/by-name/go/goose-cli/package.nix index 2c535194e247..8d73fdb59a81 100644 --- a/pkgs/by-name/go/goose-cli/package.nix +++ b/pkgs/by-name/go/goose-cli/package.nix @@ -191,6 +191,10 @@ rustPlatform.buildRustPackage (finalAttrs: { miniharinn caniko ]; - platforms = lib.platforms.linux ++ lib.platforms.darwin; + platforms = [ + "x86_64-linux" + "aarch64-linux" + "aarch64-darwin" + ]; }; }) From 7d7f7e74bbaa9c22a2b631a9a92310391b9d1a9e Mon Sep 17 00:00:00 2001 From: liberodark Date: Thu, 16 Jul 2026 20:23:33 +0200 Subject: [PATCH 053/121] spacetimedb: fix eval on unsupported systems --- pkgs/by-name/sp/spacetimedb/package.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/by-name/sp/spacetimedb/package.nix b/pkgs/by-name/sp/spacetimedb/package.nix index ff1ee1a3a42b..cb80cfa721e1 100644 --- a/pkgs/by-name/sp/spacetimedb/package.nix +++ b/pkgs/by-name/sp/spacetimedb/package.nix @@ -86,6 +86,11 @@ rustPlatform.buildRustPackage (finalAttrs: { passthru.updateScript = nix-update-script { }; meta = { + platforms = [ + "x86_64-linux" + "aarch64-linux" + "aarch64-darwin" + ]; description = "Full-featured relational database system that lets you run your application logic inside the database"; homepage = "https://github.com/clockworklabs/SpacetimeDB"; license = lib.licenses.bsl11; From c1701039b8ad7c483ed59ec54c9330d65fc691fb Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 8 Aug 2026 18:25:23 +0000 Subject: [PATCH 054/121] zigfetch: 0.27.2 -> 0.28.0 --- pkgs/by-name/zi/zigfetch/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/zi/zigfetch/package.nix b/pkgs/by-name/zi/zigfetch/package.nix index 67e2dc7eafa4..cf7103775055 100644 --- a/pkgs/by-name/zi/zigfetch/package.nix +++ b/pkgs/by-name/zi/zigfetch/package.nix @@ -11,13 +11,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "zigfetch"; - version = "0.27.2"; + version = "0.28.0"; src = fetchFromGitHub { owner = "utox39"; repo = "zigfetch"; rev = "v${finalAttrs.version}"; - hash = "sha256-PFZqtKgZYRRVXf0bNUKYFsahmJ9g2qcm58LFTR4ZzCU="; + hash = "sha256-FDIZnmMzhHH1MmvwyuHnV6KiNSH1E5ZEg5G6C5BBJWE="; }; patches = lib.optionals stdenv.hostPlatform.isDarwin [ From 5dca4722f4246b6de71cb9a73c42fdf8ee8855a7 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 8 Aug 2026 19:46:02 +0000 Subject: [PATCH 055/121] libkcapi: 1.5.0 -> 1.5.1 --- pkgs/by-name/li/libkcapi/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/li/libkcapi/package.nix b/pkgs/by-name/li/libkcapi/package.nix index aea06836eb4e..8b3c77f7e9f4 100644 --- a/pkgs/by-name/li/libkcapi/package.nix +++ b/pkgs/by-name/li/libkcapi/package.nix @@ -15,13 +15,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "libkcapi"; - version = "1.5.0"; + version = "1.5.1"; src = fetchFromGitHub { owner = "smuellerDD"; repo = "libkcapi"; rev = "v${finalAttrs.version}"; - hash = "sha256-xOI29cjhUGUeHLaYIrPA5ZwwCE9lBdZG6kaW0lo1uL8="; + hash = "sha256-xNhN6MWSNU8eufI5J/NOxhvw21nS0s7+V/Feg4N65jg="; }; outputs = [ From 3d072e88ad52d331ebb74c1d14a0b48f353d7e6b Mon Sep 17 00:00:00 2001 From: Yifei Sun Date: Sat, 8 Aug 2026 22:40:56 +0200 Subject: [PATCH 056/121] ocamlPackages.magic-trace: set to x86_64-linux only --- pkgs/development/ocaml-modules/magic-trace/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/ocaml-modules/magic-trace/default.nix b/pkgs/development/ocaml-modules/magic-trace/default.nix index 4debd6a5994c..46d761367c45 100644 --- a/pkgs/development/ocaml-modules/magic-trace/default.nix +++ b/pkgs/development/ocaml-modules/magic-trace/default.nix @@ -56,7 +56,7 @@ buildDunePackage (finalAttrs: { license = lib.licenses.mit; maintainers = [ lib.maintainers.alizter ]; homepage = "https://github.com/janestreet/magic-trace"; - platforms = lib.platforms.linux; + platforms = [ "x86_64-linux" ]; mainProgram = "magic-trace"; }; }) From 56282877ccd5c5417ee07ba010ec00a60e55c5f6 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 9 Aug 2026 01:50:04 +0000 Subject: [PATCH 057/121] tabularis: 0.17.0 -> 0.18.0 --- pkgs/by-name/ta/tabularis/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ta/tabularis/package.nix b/pkgs/by-name/ta/tabularis/package.nix index 93d96337cc5c..039dd8d8a83f 100644 --- a/pkgs/by-name/ta/tabularis/package.nix +++ b/pkgs/by-name/ta/tabularis/package.nix @@ -19,14 +19,14 @@ let in rustPlatform.buildRustPackage (finalAttrs: { pname = "tabularis"; - version = "0.17.0"; + version = "0.18.0"; __structuredAttrs = true; src = fetchFromGitHub { owner = "TabularisDB"; repo = "tabularis"; tag = "v${finalAttrs.version}"; - hash = "sha256-LMQonEjgOdeedy8SJvxEJW6fvqCs5jB247VXIBtLGqs="; + hash = "sha256-Z+cvIKa5Ly81PmE8A4X6umKObe+ConLRIumNOk1iNrE="; }; strictDeps = true; @@ -34,7 +34,7 @@ rustPlatform.buildRustPackage (finalAttrs: { cargoRoot = "src-tauri"; buildAndTestSubdir = finalAttrs.cargoRoot; - cargoHash = "sha256-vXw76T+CA7m0s2b8uVof20Hww3YrQJL1/bKzUzmxKXo="; + cargoHash = "sha256-kVhKEnqNNEF1IaXFATE2XiSPebb7v6PDd2x9evktOJI="; pnpmDeps = fetchPnpmDeps { inherit (finalAttrs) pname version src; From 52d6eea53d1252dea09ee953f1030d7e3f48014c Mon Sep 17 00:00:00 2001 From: jopejoe1 Date: Sun, 9 Aug 2026 08:50:00 +0200 Subject: [PATCH 058/121] {free,net,open}bsd: index for search and ci --- pkgs/top-level/all-packages.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 3735560b0e13..122a39daa087 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -10990,11 +10990,11 @@ with pkgs; meta.license = lib.licenses.mit; } ../os-specific/bsd/setup-hook.sh; - freebsd = callPackage ../os-specific/bsd/freebsd { }; + freebsd = recurseIntoAttrs (callPackage ../os-specific/bsd/freebsd { }); - netbsd = callPackage ../os-specific/bsd/netbsd { }; + netbsd = recurseIntoAttrs (callPackage ../os-specific/bsd/netbsd { }); - openbsd = callPackage ../os-specific/bsd/openbsd { }; + openbsd = recurseIntoAttrs (callPackage ../os-specific/bsd/openbsd { }); radicle-node-unstable = callPackage ../by-name/ra/radicle-node/unstable.nix { }; From 6e4b044e85473744ee1031f6952080fb00c7323c Mon Sep 17 00:00:00 2001 From: Tom Hunze Date: Sun, 9 Aug 2026 11:35:55 +0200 Subject: [PATCH 059/121] sv-lang: fix build with fmt 12.2 From the fmt 12.2 changelog [1]: - Made the `` header equivalent to `` by default. Code that relied on `` pulling in `` must now either include `` directly or define `FMT_DEPRECATED_HEAVY_CORE` to opt back in. [1] https://github.com/fmtlib/fmt/blob/60ccad511fd680cb91d8b60a315759f71c67bef9/ChangeLog.md#1220---2026-06-16 --- pkgs/by-name/sv/sv-lang/package.nix | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/pkgs/by-name/sv/sv-lang/package.nix b/pkgs/by-name/sv/sv-lang/package.nix index 2f49a2bbbead..5740701c3f21 100644 --- a/pkgs/by-name/sv/sv-lang/package.nix +++ b/pkgs/by-name/sv/sv-lang/package.nix @@ -2,6 +2,7 @@ lib, stdenv, fetchFromGitHub, + fetchpatch, boost, catch2_3, cmake, @@ -22,6 +23,20 @@ stdenv.mkDerivation (finalAttrs: { hash = "sha256-popHzwX0qwv2POAl7/qX3e//OwJRXGtSl9xogpSn2LI="; }; + patches = [ + (fetchpatch { + name = "fmt-12.2.patch"; + url = "https://github.com/MikePopoloski/slang/commit/5a898b4b9225d281902fcd59fe4732b1561677d2.patch"; + excludes = [ "tests/unittests/diagnostics/WaiverTests.cpp" ]; + hash = "sha256-Y+GG8UINWXh7eTXEweM42oPY8ByP4DQYgTjSLukz4I4="; + }) + ]; + + patchFlags = [ + "-p1" + "-F3" + ]; + cmakeFlags = [ # fix for https://github.com/NixOS/nixpkgs/issues/144170 "-DCMAKE_INSTALL_INCLUDEDIR=include" From 4d790b7f3fe5d03638b4849d6cb0cf50b1156adc Mon Sep 17 00:00:00 2001 From: Yifei Sun Date: Sat, 8 Aug 2026 22:29:31 +0200 Subject: [PATCH 060/121] ocamlPackages.cohttp-async: fix build on darwin --- pkgs/development/ocaml-modules/cohttp/async.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/ocaml-modules/cohttp/async.nix b/pkgs/development/ocaml-modules/cohttp/async.nix index 7d37f69f503d..1afbbd09fdf4 100644 --- a/pkgs/development/ocaml-modules/cohttp/async.nix +++ b/pkgs/development/ocaml-modules/cohttp/async.nix @@ -51,6 +51,8 @@ buildDunePackage { ipaddr ]; + __darwinAllowLocalNetworking = true; + doCheck = true; checkInputs = [ ounit From 69411a37a2d24de04b91a131adf2045f9b82084c Mon Sep 17 00:00:00 2001 From: Yifei Sun Date: Sat, 8 Aug 2026 22:29:32 +0200 Subject: [PATCH 061/121] ocamlPackages.cohttp-eio: fix build on darwin --- pkgs/development/ocaml-modules/cohttp/eio.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/ocaml-modules/cohttp/eio.nix b/pkgs/development/ocaml-modules/cohttp/eio.nix index 90a7d26c8205..37d4a613187a 100644 --- a/pkgs/development/ocaml-modules/cohttp/eio.nix +++ b/pkgs/development/ocaml-modules/cohttp/eio.nix @@ -33,6 +33,8 @@ buildDunePackage { uri ]; + __darwinAllowLocalNetworking = true; + doCheck = true; checkInputs = [ alcotest From ebc7ecf6d0540ae694f64f618f51e67fe240b6f9 Mon Sep 17 00:00:00 2001 From: Yifei Sun Date: Sat, 8 Aug 2026 22:29:32 +0200 Subject: [PATCH 062/121] ocamlPackages.cohttp_static_handler: fix build on darwin --- pkgs/development/ocaml-modules/janestreet/0.17.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/development/ocaml-modules/janestreet/0.17.nix b/pkgs/development/ocaml-modules/janestreet/0.17.nix index 23dcd03452ff..68785cc5a647 100644 --- a/pkgs/development/ocaml-modules/janestreet/0.17.nix +++ b/pkgs/development/ocaml-modules/janestreet/0.17.nix @@ -445,6 +445,7 @@ with self; hash = "sha256-RB/sUq1tL8A3m9YhHHx2LFqoExTX187VeZI9MRb1NeA="; meta.description = "Library for easily creating a cohttp handler for static files"; propagatedBuildInputs = [ cohttp-async_5_3 ]; + __darwinAllowLocalNetworking = true; }; content_security_policy = janePackage { From daf876f6c4858477c2bda62071be7cbcbd8b6df5 Mon Sep 17 00:00:00 2001 From: Yifei Sun Date: Sat, 8 Aug 2026 22:29:32 +0200 Subject: [PATCH 063/121] ocamlPackages.cohttp_async_websocket: fix build on darwin --- pkgs/development/ocaml-modules/janestreet/0.17.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/development/ocaml-modules/janestreet/0.17.nix b/pkgs/development/ocaml-modules/janestreet/0.17.nix index 68785cc5a647..daf76526e0b6 100644 --- a/pkgs/development/ocaml-modules/janestreet/0.17.nix +++ b/pkgs/development/ocaml-modules/janestreet/0.17.nix @@ -438,6 +438,7 @@ with self; ppx_jane uri-sexp ]; + __darwinAllowLocalNetworking = true; }; cohttp_static_handler = janePackage { From a6ea38cbc8e48a9567e95ba2dfe7c0fbd10b3000 Mon Sep 17 00:00:00 2001 From: Yifei Sun Date: Sat, 8 Aug 2026 22:29:32 +0200 Subject: [PATCH 064/121] ocamlPackages.async_rpc_websocket: fix build on darwin --- pkgs/development/ocaml-modules/janestreet/0.17.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/development/ocaml-modules/janestreet/0.17.nix b/pkgs/development/ocaml-modules/janestreet/0.17.nix index daf76526e0b6..e37d9c284622 100644 --- a/pkgs/development/ocaml-modules/janestreet/0.17.nix +++ b/pkgs/development/ocaml-modules/janestreet/0.17.nix @@ -177,6 +177,7 @@ with self; async_websocket cohttp_async_websocket ]; + __darwinAllowLocalNetworking = true; }; async_sendfile = janePackage { From 22d8bafd8c94f8701c818fa42cb69b7f75708fb1 Mon Sep 17 00:00:00 2001 From: Yifei Sun Date: Sat, 8 Aug 2026 23:22:02 +0200 Subject: [PATCH 065/121] ocamlPackages.ctypes-foreign: fix build for darwin ocaml 5.5 --- pkgs/development/ocaml-modules/ctypes/foreign.nix | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/pkgs/development/ocaml-modules/ctypes/foreign.nix b/pkgs/development/ocaml-modules/ctypes/foreign.nix index d1a0371bb7ef..393e460c342e 100644 --- a/pkgs/development/ocaml-modules/ctypes/foreign.nix +++ b/pkgs/development/ocaml-modules/ctypes/foreign.nix @@ -1,4 +1,7 @@ { + lib, + stdenv, + ocaml, buildDunePackage, ctypes, dune-configurator, @@ -10,7 +13,7 @@ buildDunePackage { pname = "ctypes-foreign"; - inherit (ctypes) version src doCheck; + inherit (ctypes) version src; buildInputs = [ dune-configurator ]; @@ -27,6 +30,9 @@ buildDunePackage { # Fix build with gcc 14 env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types"; + # closure lifetime tests crash on darwin ocaml 5.5 + doCheck = !(stdenv.hostPlatform.isDarwin && lib.versionAtLeast ocaml.version "5.5"); + meta = ctypes.meta // { description = "Dynamic access to foreign C libraries using Ctypes"; }; From eee761967785d218446d012a8202133832c06e7b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 9 Aug 2026 12:29:25 +0000 Subject: [PATCH 066/121] bdf2psf: 1.248 -> 1.249 --- pkgs/by-name/bd/bdf2psf/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/bd/bdf2psf/package.nix b/pkgs/by-name/bd/bdf2psf/package.nix index 1518b915e157..c3961a27967a 100644 --- a/pkgs/by-name/bd/bdf2psf/package.nix +++ b/pkgs/by-name/bd/bdf2psf/package.nix @@ -8,11 +8,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "bdf2psf"; - version = "1.248"; + version = "1.249"; src = fetchurl { url = "mirror://debian/pool/main/c/console-setup/bdf2psf_${finalAttrs.version}_all.deb"; - sha256 = "sha256-51PE9o1kmISd/kYHLm8NUBDKi2eyXJkL0MkWlp1f8co="; + sha256 = "sha256-7qfp9gq+7klgcTuETw2XFT3AWV5bSNMnrnziqL8k2PE="; }; nativeBuildInputs = [ dpkg ]; From 9eeb54d21400ef9bc400e2fc326e80ee1b94cd06 Mon Sep 17 00:00:00 2001 From: EKHH <90589480+EKHH@users.noreply.github.com> Date: Sun, 9 Aug 2026 12:05:56 +0000 Subject: [PATCH 067/121] libreoffice: set JAVA_HOME --- pkgs/applications/office/libreoffice/default.nix | 1 + pkgs/applications/office/libreoffice/wrapper.nix | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix index 839ec6db93d2..cc8a9e5f959b 100644 --- a/pkgs/applications/office/libreoffice/default.nix +++ b/pkgs/applications/office/libreoffice/default.nix @@ -811,6 +811,7 @@ stdenv.mkDerivation (finalAttrs: { passthru = { inherit srcs; + inherit withJava; jdk = if withJava then jre' else null; python = python3; # for unoconv updateScript = [ diff --git a/pkgs/applications/office/libreoffice/wrapper.nix b/pkgs/applications/office/libreoffice/wrapper.nix index 165482e3bf16..e66d6fa895f4 100644 --- a/pkgs/applications/office/libreoffice/wrapper.nix +++ b/pkgs/applications/office/libreoffice/wrapper.nix @@ -118,6 +118,11 @@ let fi '') ] + ++ lib.optionals unwrapped.withJava [ + "--set" + "JAVA_HOME" + "${unwrapped.jdk.home}" + ] ++ [ "--inherit-argv0" ] From d1ca460de801d2003fa836c48cea6debe72ea23e Mon Sep 17 00:00:00 2001 From: Mukul Agarwal Date: Sun, 2 Aug 2026 11:46:01 -0400 Subject: [PATCH 068/121] libgphoto2: fix build on macOS We remove `libgphoto2` from its own package.nix inputs (it is an unused argument) and move `gettext` from nativeBuildInputs to buildInputs, since `libgphoto2` links against it. --- pkgs/by-name/li/libgphoto2/package.nix | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/pkgs/by-name/li/libgphoto2/package.nix b/pkgs/by-name/li/libgphoto2/package.nix index d9567a060145..4ea08ea78d6e 100644 --- a/pkgs/by-name/li/libgphoto2/package.nix +++ b/pkgs/by-name/li/libgphoto2/package.nix @@ -9,7 +9,6 @@ libusb1, libtool, libexif, - libgphoto2, libjpeg, curl, libxml2, @@ -31,21 +30,18 @@ stdenv.mkDerivation rec { nativeBuildInputs = [ autoreconfHook - gettext libtool pkg-config ]; buildInputs = [ + gettext libjpeg libtool # for libltdl libusb1 curl libxml2 gd - ] - ++ lib.optionals stdenv.hostPlatform.isDarwin [ - gettext ]; doInstallCheck = true; From 7466e48509fa614648bfdd1a3f863daa2baec06c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=F0=9D=91=B7=F0=9D=92=89=F0=9D=92=8A=F0=9D=92=8D?= =?UTF-8?q?=F0=9D=92=90=F0=9D=92=84=F0=9D=92=82=F0=9D=92=8D=F0=9D=92=9A?= =?UTF-8?q?=F0=9D=92=94=F0=9D=92=95?= Date: Fri, 15 May 2026 22:19:47 -0400 Subject: [PATCH 069/121] gloox: patch for openssl removed broken field after local machine test --- pkgs/by-name/gl/gloox/package.nix | 11 +++++++++-- pkgs/by-name/gl/gloox/tls-openssl-clang.patch | 12 ++++++++++++ 2 files changed, 21 insertions(+), 2 deletions(-) create mode 100644 pkgs/by-name/gl/gloox/tls-openssl-clang.patch diff --git a/pkgs/by-name/gl/gloox/package.nix b/pkgs/by-name/gl/gloox/package.nix index 46a4f1b755bb..5c630b209795 100644 --- a/pkgs/by-name/gl/gloox/package.nix +++ b/pkgs/by-name/gl/gloox/package.nix @@ -19,6 +19,15 @@ stdenv.mkDerivation (finalAttrs: { sha256 = "sha256-WRvRLCSe3gtQoe9rmawN6O+cG6T9Lhhvl6dAIVzFlmw="; }; + patches = [ + # Clang rejects `{ 0 }` as SSL_export_keying_material's context pointer + # argument. Use a plain `0` rather than `nullptr`: gloox's ./configure + # unconditionally adds `-ansi` (C++98) on all non-Windows platforms, and + # while Clang tolerates `nullptr` there as an extension, GCC hard-errors + # on it as an undeclared identifier. + ./tls-openssl-clang.patch + ]; + # needed since gcc12 postPatch = '' sed '1i#include ' -i \ @@ -39,7 +48,5 @@ stdenv.mkDerivation (finalAttrs: { license = lib.licenses.gpl3; maintainers = [ ]; platforms = lib.platforms.unix; - # The last successful Darwin Hydra build was in 2023 - broken = stdenv.hostPlatform.isDarwin; }; }) diff --git a/pkgs/by-name/gl/gloox/tls-openssl-clang.patch b/pkgs/by-name/gl/gloox/tls-openssl-clang.patch new file mode 100644 index 000000000000..dca93aae6eb1 --- /dev/null +++ b/pkgs/by-name/gl/gloox/tls-openssl-clang.patch @@ -0,0 +1,12 @@ +diff --git a/src/tlsopensslclient.cpp b/src/tlsopensslclient.cpp +--- a/src/tlsopensslclient.cpp ++++ b/src/tlsopensslclient.cpp +@@ -51,7 +51,7 @@ + { + unsigned char buf[32]; + const char* const label = "EXPORTER-Channel-Binding"; +- SSL_export_keying_material( m_ssl, buf, 32, label, strlen( label ), { 0 }, 1, 0 ); ++ SSL_export_keying_material( m_ssl, buf, 32, label, strlen( label ), 0, 0, 0 ); + return std::string( reinterpret_cast( buf ), 32 ); + } + else From cb25efc174d49bbbb68642b74de5d60187837eca Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=F0=9D=91=B7=F0=9D=92=89=F0=9D=92=8A=F0=9D=92=8D?= =?UTF-8?q?=F0=9D=92=90=F0=9D=92=84=F0=9D=92=82=F0=9D=92=8D=F0=9D=92=9A?= =?UTF-8?q?=F0=9D=92=94=F0=9D=92=95?= Date: Fri, 15 May 2026 22:29:18 -0400 Subject: [PATCH 070/121] gloox: switched to a subinplace we love failiblity --- pkgs/by-name/gl/gloox/package.nix | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/gl/gloox/package.nix b/pkgs/by-name/gl/gloox/package.nix index 5c630b209795..f81fadc6d8f5 100644 --- a/pkgs/by-name/gl/gloox/package.nix +++ b/pkgs/by-name/gl/gloox/package.nix @@ -30,9 +30,17 @@ stdenv.mkDerivation (finalAttrs: { # needed since gcc12 postPatch = '' - sed '1i#include ' -i \ - src/tests/{tag/tag_perf.cpp,zlib/zlib_perf.cpp} \ - src/examples/*.cpp + substituteInPlace \ + src/tests/tag/tag_perf.cpp \ + src/tests/zlib/zlib_perf.cpp \ + --replace-fail \ + "#include " \ + $'#include \n#include ' + + substituteInPlace src/examples/*.cpp \ + --replace-fail \ + "#include " \ + $'#include \n#include ' ''; buildInputs = From 8d87f68c7d518df8993360f1e355b60f225f56b9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=F0=9D=91=B7=F0=9D=92=89=F0=9D=92=8A=F0=9D=92=8D?= =?UTF-8?q?=F0=9D=92=90=F0=9D=92=84=F0=9D=92=82=F0=9D=92=8D=F0=9D=92=9A?= =?UTF-8?q?=F0=9D=92=94=F0=9D=92=95?= Date: Fri, 15 May 2026 22:31:04 -0400 Subject: [PATCH 071/121] gloox: cleaner buildinputs --- pkgs/by-name/gl/gloox/package.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/gl/gloox/package.nix b/pkgs/by-name/gl/gloox/package.nix index f81fadc6d8f5..f3f1e499fe85 100644 --- a/pkgs/by-name/gl/gloox/package.nix +++ b/pkgs/by-name/gl/gloox/package.nix @@ -43,11 +43,11 @@ stdenv.mkDerivation (finalAttrs: { $'#include \n#include ' ''; - buildInputs = - [ ] - ++ lib.optional zlibSupport zlib - ++ lib.optional sslSupport openssl - ++ lib.optional idnSupport libidn; + buildInputs = lib.flatten [ + (lib.optional zlibSupport zlib) + (lib.optional sslSupport openssl) + (lib.optional idnSupport libidn) + ]; meta = { description = "Portable high-level Jabber/XMPP library for C++"; From 6f7e99c5aef7ad6919f9a61bb112320244119327 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=F0=9D=91=B7=F0=9D=92=89=F0=9D=92=8A=F0=9D=92=8D?= =?UTF-8?q?=F0=9D=92=90=F0=9D=92=84=F0=9D=92=82=F0=9D=92=8D=F0=9D=92=9A?= =?UTF-8?q?=F0=9D=92=94=F0=9D=92=95?= Date: Fri, 15 May 2026 22:37:13 -0400 Subject: [PATCH 072/121] gloox: added maintainer --- pkgs/by-name/gl/gloox/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/gl/gloox/package.nix b/pkgs/by-name/gl/gloox/package.nix index f3f1e499fe85..7ede1434140d 100644 --- a/pkgs/by-name/gl/gloox/package.nix +++ b/pkgs/by-name/gl/gloox/package.nix @@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: { mainProgram = "gloox-config"; homepage = "http://camaya.net/gloox"; license = lib.licenses.gpl3; - maintainers = [ ]; + maintainers = [ lib.maintainers.philocalyst ]; platforms = lib.platforms.unix; }; }) From 7844d6384d12d7b82256f7fb5c41e6059f24832a Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 9 Aug 2026 15:12:47 +0000 Subject: [PATCH 073/121] gelly: 1.9.5 -> 1.9.7 --- pkgs/by-name/ge/gelly/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ge/gelly/package.nix b/pkgs/by-name/ge/gelly/package.nix index 18206ca31d3b..1366478800f7 100644 --- a/pkgs/by-name/ge/gelly/package.nix +++ b/pkgs/by-name/ge/gelly/package.nix @@ -19,16 +19,16 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "gelly"; - version = "1.9.5"; + version = "1.9.7"; src = fetchFromGitHub { owner = "Fingel"; repo = "gelly"; tag = "v${finalAttrs.version}"; - hash = "sha256-k6LgXEK5xoVrjiXCkYnFgC7Hs7oz+v3Kz47CELPqN9Q="; + hash = "sha256-KPU16kQUmM+TOOzw8JXFjlchhFHQy9Zt7brky9YW/fE="; }; - cargoHash = "sha256-RbOs5CEj3KRe6F1RJSGx97wBoQKSynx+iza929ipfjA="; + cargoHash = "sha256-CUbQp1E+snaIuduXmEXErOoOELFXmEm3Td1y5Mou+UA="; nativeBuildInputs = [ pkg-config From 9e4b9f8fb0ce18b1b3cc11722126dde4e9d78520 Mon Sep 17 00:00:00 2001 From: jopejoe1 Date: Sun, 9 Aug 2026 09:23:39 +0000 Subject: [PATCH 074/121] python313Packages.blackrenderer: 0.6.0 -> 0.8.2 --- pkgs/development/python-modules/blackrenderer/default.nix | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/blackrenderer/default.nix b/pkgs/development/python-modules/blackrenderer/default.nix index 6b36da006cd7..fadd6cc4134c 100644 --- a/pkgs/development/python-modules/blackrenderer/default.nix +++ b/pkgs/development/python-modules/blackrenderer/default.nix @@ -13,14 +13,14 @@ buildPythonPackage rec { pname = "blackrenderer"; - version = "0.6.0"; + version = "0.8.2"; pyproject = true; src = fetchFromGitHub { owner = "BlackFoundryCom"; repo = "black-renderer"; tag = "v${version}"; - hash = "sha256-b2W0M32Y4HUyxObjvh0yMUBe5gfcSDXnw1GfhW7hoZk="; + hash = "sha256-6mC+JSg0u2hwi7SDFHBoUYCu8sYisWSCOuaTtc0FXi4="; }; build-system = [ @@ -46,6 +46,8 @@ buildPythonPackage rec { # Wants None existing fonts "Tests/test_mainprog.py" "Tests/test_glyph_render.py" + "Tests/test_canvas_api.py" + "Tests/test_compareImages.py" ]; pythonImportsCheck = [ "blackrenderer" ]; From c6d9db2496bb338af9020a050bbcfbe1e9cb9a12 Mon Sep 17 00:00:00 2001 From: emilylange Date: Sun, 9 Aug 2026 19:24:33 +0200 Subject: [PATCH 075/121] adapta-gtk-theme: fix and try to clarify licensing The license bump from cc-by-sa-30 to cc-by-sa-40 in [3.89.3.1] appears to have slipped through e0d18259939f1fe1a25b08b4922c3f798df53aa5. [3.89.3.1]: https://github.com/adapta-project/adapta-gtk-theme/releases/tag/3.89.3.1 --- pkgs/by-name/ad/adapta-gtk-theme/package.nix | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/ad/adapta-gtk-theme/package.nix b/pkgs/by-name/ad/adapta-gtk-theme/package.nix index 8c5ce9e2ed07..deddea76d137 100644 --- a/pkgs/by-name/ad/adapta-gtk-theme/package.nix +++ b/pkgs/by-name/ad/adapta-gtk-theme/package.nix @@ -60,10 +60,18 @@ stdenv.mkDerivation (finalAttrs: { meta = { description = "Adaptive GTK theme based on Material Design Guidelines"; homepage = "https://github.com/adapta-project/adapta-gtk-theme"; - license = with lib.licenses; [ - gpl2 - cc-by-sa-30 - ]; + license = + with lib.licenses; + # cc-by-sa-40 (svg files) is technically incompatible with gpl2 (everything else), + # but cc-by-sa-40 is compatible with gpl3, which this project used to be licensed + # under at some point. The intent behind this exact license combination is effectively + # lost to time, as more than 700 issues have been made inaccessible even prior to the + # repository's archival. At the very least we know it's not `OR [ gpl2 cc-by-sa-40 ]` + # based on the README.md and the svg sources (which say cc-by-sa-40 in their xml). + AND [ + gpl2 + cc-by-sa-40 + ]; platforms = lib.platforms.linux; maintainers = with lib.maintainers; [ romildo From 7af5d3cd11c0af97e8b8af2bcbaec524dc22f770 Mon Sep 17 00:00:00 2001 From: emilylange Date: Sun, 9 Aug 2026 19:39:39 +0200 Subject: [PATCH 076/121] adapta-gtk-theme: enable `__structuredAttrs` and `strictDeps` --- pkgs/by-name/ad/adapta-gtk-theme/package.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/by-name/ad/adapta-gtk-theme/package.nix b/pkgs/by-name/ad/adapta-gtk-theme/package.nix index deddea76d137..090e15a94b74 100644 --- a/pkgs/by-name/ad/adapta-gtk-theme/package.nix +++ b/pkgs/by-name/ad/adapta-gtk-theme/package.nix @@ -25,6 +25,9 @@ stdenv.mkDerivation (finalAttrs: { sha256 = "19skrhp10xx07hbd0lr3d619vj2im35d8p9rmb4v4zacci804q04"; }; + __structuredAttrs = true; + strictDeps = true; + patches = [ ./disable-gtk2.patch ]; From 1f60fb9e5a1290aeb53e79ab984fbc4ffb304fbc Mon Sep 17 00:00:00 2001 From: emilylange Date: Sun, 9 Aug 2026 19:46:52 +0200 Subject: [PATCH 077/121] adapta-gtk-theme: restrict platforms to unix instead of linux Co-authored-by: Gavin John --- pkgs/by-name/ad/adapta-gtk-theme/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/ad/adapta-gtk-theme/package.nix b/pkgs/by-name/ad/adapta-gtk-theme/package.nix index 090e15a94b74..83445c036dcd 100644 --- a/pkgs/by-name/ad/adapta-gtk-theme/package.nix +++ b/pkgs/by-name/ad/adapta-gtk-theme/package.nix @@ -75,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: { gpl2 cc-by-sa-40 ]; - platforms = lib.platforms.linux; + platforms = lib.platforms.unix; maintainers = with lib.maintainers; [ romildo emilylange From 8cc04b1b02e839176cf5a4589a43b080ddb825c5 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 9 Aug 2026 18:17:27 +0000 Subject: [PATCH 078/121] matrix-tuwunel: 1.8.2 -> 1.8.3 --- pkgs/by-name/ma/matrix-tuwunel/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ma/matrix-tuwunel/package.nix b/pkgs/by-name/ma/matrix-tuwunel/package.nix index ae7ca4a8c419..eba046c3852d 100644 --- a/pkgs/by-name/ma/matrix-tuwunel/package.nix +++ b/pkgs/by-name/ma/matrix-tuwunel/package.nix @@ -88,16 +88,16 @@ let in rustPlatform.buildRustPackage (finalAttrs: { pname = "matrix-tuwunel"; - version = "1.8.2"; + version = "1.8.3"; src = fetchFromGitHub { owner = "matrix-construct"; repo = "tuwunel"; tag = "v${finalAttrs.version}"; - hash = "sha256-mfdX5HmuXf6s7zyT9AJUoz4v5v9Km+VX8z6KvRGq8F8="; + hash = "sha256-Csq8eHV2r28POX+Ce1lZ0ybIw5Wt3ABUbWg2W8p2lOw="; }; - cargoHash = "sha256-jIgL/4i17H216goZ8DiFvIJTCKyjEHGiky3MTO5sQoY="; + cargoHash = "sha256-mShVBCwd8cwF7K1ILf1gn7ImaxwF73KP2YiDiAJV0f0="; nativeBuildInputs = [ pkg-config From d4cc798ef8f676c9d2225d8ec940c4a798e776cf Mon Sep 17 00:00:00 2001 From: Johannes Kirschbauer Date: Sun, 9 Aug 2026 21:03:35 +0200 Subject: [PATCH 079/121] Revert "Reapply "nixos/nixpkgs.config: make use of the module defined in config.nix"" This reverts commit e701ff054bbfdcbd8bfefd4c53c6ab87edad2dd7. --- nixos/modules/misc/nixpkgs.nix | 64 ++++++++++++------ pkgs/test/config-nix-unit.nix | 117 --------------------------------- pkgs/test/default.nix | 20 ------ pkgs/top-level/config.nix | 40 +++-------- pkgs/top-level/default.nix | 37 ++++------- 5 files changed, 65 insertions(+), 213 deletions(-) delete mode 100644 pkgs/test/config-nix-unit.nix diff --git a/nixos/modules/misc/nixpkgs.nix b/nixos/modules/misc/nixpkgs.nix index 7b0fed338073..dcb05e349197 100644 --- a/nixos/modules/misc/nixpkgs.nix +++ b/nixos/modules/misc/nixpkgs.nix @@ -2,12 +2,51 @@ config, options, lib, + pkgs, ... }: let cfg = config.nixpkgs; opt = options.nixpkgs; + isConfig = x: builtins.isAttrs x || lib.isFunction x; + + optCall = f: x: if lib.isFunction f then f x else f; + + mergeConfig = + lhs_: rhs_: + let + lhs = optCall lhs_ { inherit lib pkgs; }; + rhs = optCall rhs_ { inherit lib pkgs; }; + in + lib.recursiveUpdate lhs rhs + // lib.optionalAttrs (lhs ? allowUnfreePackages) { + allowUnfreePackages = lhs.allowUnfreePackages ++ (lib.attrByPath [ "allowUnfreePackages" ] [ ] rhs); + } + // lib.optionalAttrs (lhs ? packageOverrides) { + packageOverrides = + pkgs: + optCall lhs.packageOverrides pkgs // optCall (lib.attrByPath [ "packageOverrides" ] { } rhs) pkgs; + } + // lib.optionalAttrs (lhs ? perlPackageOverrides) { + perlPackageOverrides = + pkgs: + optCall lhs.perlPackageOverrides pkgs + // optCall (lib.attrByPath [ "perlPackageOverrides" ] { } rhs) pkgs; + }; + + configType = lib.mkOptionType { + name = "nixpkgs-config"; + description = "nixpkgs config"; + check = + x: + let + traceXIfNot = c: if c x then true else lib.traceSeqN 1 x false; + in + traceXIfNot isConfig; + merge = args: lib.foldr (def: mergeConfig def.value) { }; + }; + overlayType = lib.mkOptionType { name = "nixpkgs-overlay"; description = "nixpkgs overlay"; @@ -34,8 +73,6 @@ let ++ lib.optional (opt.localSystem.highestPrio < (lib.mkOptionDefault { }).priority) opt.localSystem ++ lib.optional (opt.crossSystem.highestPrio < (lib.mkOptionDefault { }).priority) opt.crossSystem; - _configDefinitions = opt.config.definitionsWithLocations; - defaultPkgs = if opt.hostPlatform.isDefined then let @@ -53,21 +90,14 @@ let in import ../../.. ( { - inherit _configDefinitions; - inherit (cfg) overlays; - # Explicitly set config to prevent impure.nix from filling it - # from the NIXPKGS_CONFIG environment variable. - config = { }; + inherit (cfg) config overlays; } // systemArgs ) else import ../../.. { - inherit _configDefinitions; - # Explicitly set config to prevent impure.nix from filling it - # from the NIXPKGS_CONFIG environment variable. - config = { }; inherit (cfg) + config overlays localSystem crossSystem @@ -135,15 +165,7 @@ in example = lib.literalExpression '' { allowBroken = true; allowUnfree = true; } ''; - type = lib.types.deferredModuleWith { - staticModules = [ - { _module.args.docPrefix = "https://nixos.org/manual/nixpkgs/unstable/"; } - ../../../pkgs/top-level/config.nix - ]; - }; - # Returns pkgs.config instead of nixpkgs.config - # This shadows the deferredModule to make it look like a submodule - apply = _: finalPkgs.config; + type = configType; description = '' Global configuration for Nixpkgs. The complete list of [Nixpkgs configuration options](https://nixos.org/manual/nixpkgs/unstable/#sec-config-options-reference) is in the [Nixpkgs manual section on global configuration](https://nixos.org/manual/nixpkgs/unstable/#chap-packageconfig). @@ -384,7 +406,7 @@ in ''; } { - assertion = opt.pkgs.isDefined -> opt.config.highestPrio == (lib.mkOptionDefault null).priority; + assertion = opt.pkgs.isDefined -> cfg.config == { }; message = '' Your system configures nixpkgs with an externally created instance. `nixpkgs.config` options should be passed when creating the instance instead. diff --git a/pkgs/test/config-nix-unit.nix b/pkgs/test/config-nix-unit.nix deleted file mode 100644 index cd16d5ca1c43..000000000000 --- a/pkgs/test/config-nix-unit.nix +++ /dev/null @@ -1,117 +0,0 @@ -# Tests for nixpkgs config forwarding from NixOS modules. -# -# Run with: -# nix-unit pkgs/test/config-nix-unit.nix -# or -# nix-build -A tests.config-nix-unit -# -{ - nixpkgsPath ? ../.., - pkgs ? import nixpkgsPath { }, -}: -let - lib = pkgs.lib; - - # Test helper - evalNixos = - modules: - import (nixpkgsPath + "/nixos/lib/eval-config.nix") { - modules = [ { nixpkgs.hostPlatform = "x86_64-linux"; } ] ++ modules; - }; -in -{ - # Basic: a single config option is forwarded correctly. - testSingleConfigOption = { - expr = (evalNixos [ { nixpkgs.config.allowUnfree = true; } ]).config.nixpkgs.config.allowUnfree; - expected = true; - }; - - # Multiple config definitions from separate modules are merged. - testMultipleModulesMerge = { - expr = - let - eval = evalNixos [ - { nixpkgs.config.allowUnfree = true; } - { nixpkgs.config.allowBroken = true; } - ]; - in - { - inherit (eval.config.nixpkgs.config) allowUnfree allowBroken; - }; - expected = { - allowUnfree = true; - allowBroken = true; - }; - }; - - # mkForce works. Also covers other properties - testMkForce = { - expr = - (evalNixos [ - { nixpkgs.config.allowUnfree = true; } - { nixpkgs.config.allowUnfree = lib.mkForce false; } - ]).config.nixpkgs.config.allowUnfree; - expected = false; - }; - - testDefaults = { - expr = (evalNixos [ ]).config.nixpkgs.config.allowUnfree; - expected = false; - }; - - # Standalone nixpkgs (i.e. import { ... }) - testStandaloneConfig = { - expr = (import nixpkgsPath { config.allowUnfree = true; }).config.allowUnfree; - expected = true; - }; - - # Standalone nixpkgs with a function (i.e. import ({pkgs, lib, ...}: { ... }) - testStandaloneConfigFunctionPkgs = { - expr = - (import nixpkgsPath { - config = - { pkgs, lib, ... }: - { - allowUnfree = lib.isAttrs pkgs; - }; - }).config.allowUnfree; - expected = true; - }; - - # NixOS module sets nixpkgs.config as a function - testNixosConfigFunction = { - expr = - (evalNixos [ - { - nixpkgs.config = - { lib, ... }: - { - allowUnfree = lib.isFunction lib.id; - }; - } - ]).config.nixpkgs.config.allowUnfree; - expected = true; - }; - - # Passing both config and _configDefinitions is not allowed - testConfigAndDefinitionsMutuallyExclusive = { - expr = - (import nixpkgsPath { - config = { - allowUnfree = true; - }; - _configDefinitions = [ - { - file = "test"; - value = { - allowBroken = true; - }; - } - ]; - }).config.allowUnfree; - expectedError = { - type = "ThrownError"; - msg = ".*_configDefinitions.*internal.*must not be combined.*"; - }; - }; -} diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix index 8fc201288c5e..35f3f2c8aa82 100644 --- a/pkgs/test/default.nix +++ b/pkgs/test/default.nix @@ -128,26 +128,6 @@ in config = callPackage ./config.nix { }; - # Technically nix-unit binds to a fixed nix version - # We have tests in lib to test the module system itself against different nix-versions - # Based on this assumption (transitivity of correctness) this test should therefore also cover all tested nix-versions - config-nix-unit = - pkgs.runCommand "config-nix-unit" - { - nativeBuildInputs = [ pkgs.nix-unit ]; - } - '' - export HOME=$TMPDIR - nix-unit --eval-store "$HOME" ${./config-nix-unit.nix} \ - --arg nixpkgsPath "${ - builtins.path { - path = pkgs.path; - name = "source"; - } - }" - mkdir $out - ''; - top-level = callPackage ./top-level { }; haskell = callPackage ./haskell { }; diff --git a/pkgs/top-level/config.nix b/pkgs/top-level/config.nix index 97199162932c..058e383e0b7a 100644 --- a/pkgs/top-level/config.nix +++ b/pkgs/top-level/config.nix @@ -6,12 +6,7 @@ # nix-build -A tests.config # -{ - config, - lib, - docPrefix, - ... -}: +{ config, lib, ... }: let inherit (lib) @@ -148,13 +143,13 @@ let gitConfig = mkOption { type = types.attrsOf (types.attrsOf types.anything); description = '' - The default [git configuration](https://git-scm.com/docs/git-config#_variables) for all [`pkgs.fetchgit`](${docPrefix}#fetchgit) calls. + The default [git configuration](https://git-scm.com/docs/git-config#_variables) for all [`pkgs.fetchgit`](#fetchgit) calls. Among many other potential uses, this can be used to override URLs to point to local mirrors. Changing this will not cause any rebuilds because `pkgs.fetchgit` produces a [fixed-output derivation](https://nix.dev/manual/nix/stable/glossary.html?highlight=fixed-output%20derivation#gloss-fixed-output-derivation). - To set the configuration file directly, use the [`gitConfigFile`](${docPrefix}#opt-gitConfigFile) option instead. + To set the configuration file directly, use the [`gitConfigFile`](#opt-gitConfigFile) option instead. To set the configuration file for individual calls, use `fetchgit { gitConfigFile = "..."; }`. ''; @@ -168,9 +163,9 @@ let gitConfigFile = mkOption { type = types.nullOr types.path; description = '' - A path to a [git configuration](https://git-scm.com/docs/git-config#_variables) file, to be used for all [`pkgs.fetchgit`](${docPrefix}#fetchgit) calls. + A path to a [git configuration](https://git-scm.com/docs/git-config#_variables) file, to be used for all [`pkgs.fetchgit`](#fetchgit) calls. - This overrides the [`gitConfig`](${docPrefix}#opt-gitConfig) option, see its documentation for more details. + This overrides the [`gitConfig`](#opt-gitConfig) option, see its documentation for more details. ''; default = if config.gitConfig != { } then @@ -188,7 +183,7 @@ let For example, an override like `"registry.npmjs.org" = "my-mirror.local/registry.npmjs.org"` will replace a URL like `https://registry.npmjs.org/foo.tar.gz` with `https://my-mirror.local/registry.npmjs.org/foo.tar.gz`. - To set the string directly, see [`npmRegistryOverridesString`](${docPrefix}#opt-npmRegistryOverridesString). + To set the string directly, see [`npmRegistryOverridesString`](#opt-npmRegistryOverridesString). ''; default = { }; example = { @@ -207,7 +202,7 @@ let description = '' A string containing a string with a JSON representation of npm registry overrides for `fetchNpmDeps`. - This overrides the [`npmRegistryOverrides`](${docPrefix}#opt-npmRegistryOverrides) option, see its documentation for more details. + This overrides the [`npmRegistryOverrides`](#opt-npmRegistryOverrides) option, see its documentation for more details. ''; default = builtins.toJSON config.npmRegistryOverrides; }; @@ -445,7 +440,7 @@ let type = types.listOf types.str; default = [ "https://tarballs.nixos.org" ]; description = '' - The set of content-addressed/hashed mirror URLs used by [`pkgs.fetchurl`](${docPrefix}#sec-pkgs-fetchers-fetchurl). + The set of content-addressed/hashed mirror URLs used by [`pkgs.fetchurl`](#sec-pkgs-fetchers-fetchurl). In case `pkgs.fetchurl` can't download from the given URLs, it will try the hashed mirrors based on the expected output hash. @@ -498,27 +493,11 @@ let binaries for the platform. It is provided only as an escape hatch for custom setups, and comes with no support. - See the [release notes](${docPrefix}#x86_64-darwin-26.11) for more + See the [release notes](#x86_64-darwin-26.11) for more information. ''; }; - packageOverrides = mkOption { - type = types.functionTo types.attrs; - default = pkgs: { }; - description = '' - A function to replace or add packages in `pkgs` expects an attrset to be returned when called. - ''; - }; - - perlPackageOverrides = mkOption { - type = types.functionTo types.attrs; - default = pkgs: { }; - description = '' - The same as `packageOverrides` but for packages in the perl package set. - ''; - }; - problems = (import ../stdenv/generic/problems.nix { inherit lib; }).configOptions; }; @@ -542,7 +521,6 @@ in inherit options; config = { - _module.args.docPrefix = lib.mkDefault ""; warnings = optionals config.warnUndeclaredOptions ( mapAttrsToList (k: v: "undeclared Nixpkgs option set: config.${k}") config._undeclared or { } diff --git a/pkgs/top-level/default.nix b/pkgs/top-level/default.nix index 421f11cbca6b..c00efe313abd 100644 --- a/pkgs/top-level/default.nix +++ b/pkgs/top-level/default.nix @@ -45,11 +45,6 @@ # list it returns. stdenvStages ? import ../stdenv, - # Temporary parameter to unify nixpkgs/pkgs evaluation - # Internal, do not use this manually! - # Will be removed again within the next releases - _configDefinitions ? null, - # Ignore unexpected args. ... }@args: @@ -114,13 +109,11 @@ let (throwIfNot (lib.all lib.isFunction overlays) "All overlays passed to nixpkgs must be functions.") (throwIfNot (lib.isList crossOverlays) "The crossOverlays argument to nixpkgs must be a list.") (throwIfNot (lib.all lib.isFunction crossOverlays) "All crossOverlays passed to nixpkgs must be functions.") - (throwIf ( - ((localSystem.isDarwin && localSystem.isx86) || (crossSystem.isDarwin && crossSystem.isx86)) - && config.allowDeprecatedx86_64Darwin != "force" - ) x86_64DarwinDeprecationMessage) ( - throwIfNot (_configDefinitions == null || config0 == { }) - "The `_configDefinitions` argument is an internal interface and must not be combined with `config`." + throwIf ( + ((localSystem.isDarwin && localSystem.isx86) || (crossSystem.isDarwin && crossSystem.isx86)) + && config.allowDeprecatedx86_64Darwin != "force" + ) x86_64DarwinDeprecationMessage ); localSystem = lib.systems.elaborate args.localSystem; @@ -145,24 +138,20 @@ let # Allow both: # { /* the config */ } and - # { lib, pkgs, ... } : { /* the config */ } + # { pkgs, ... } : { /* the config */ } config1 = if lib.isFunction config0 then config0 { inherit lib pkgs; } else config0; configEval = lib.evalModules { modules = [ ./config.nix - ] - ++ ( - if _configDefinitions != null then - map (def: lib.modules.setDefaultModuleLocation def.file def.value) _configDefinitions - else - [ - { - _file = "nixpkgs.config"; - config = config1; - } - ] - ); + ( + { options, ... }: + { + _file = "nixpkgs.config"; + config = config1; + } + ) + ]; class = "nixpkgsConfig"; }; From 99f66da263fab1e08ab7f6626466f3e7d74d489d Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 9 Aug 2026 19:42:53 +0000 Subject: [PATCH 080/121] spruce: 1.35.14 -> 1.35.15 --- pkgs/by-name/sp/spruce/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/sp/spruce/package.nix b/pkgs/by-name/sp/spruce/package.nix index 6920919b8d90..de2147e9b53f 100644 --- a/pkgs/by-name/sp/spruce/package.nix +++ b/pkgs/by-name/sp/spruce/package.nix @@ -6,13 +6,13 @@ buildGoModule (finalAttrs: { pname = "spruce"; - version = "1.35.14"; + version = "1.35.15"; src = fetchFromGitHub { owner = "geofffranks"; repo = "spruce"; rev = "v${finalAttrs.version}"; - hash = "sha256-EKhspLsuovnzJVFyp8+0cUSA+kRzPwJ0YHN5iUe5NRM="; + hash = "sha256-JzHLdKafvqcmolDO6To4R3xtvyctxVTe1h65GUEsO/o="; }; vendorHash = null; From 2a3f8c8ec0198e64d95545c78ff6e79d5b3bf380 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 9 Aug 2026 21:02:35 +0000 Subject: [PATCH 081/121] dealii: 9.7.1 -> 9.8.0 --- pkgs/by-name/de/dealii/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/de/dealii/package.nix b/pkgs/by-name/de/dealii/package.nix index aa3af4742cfc..7bb66e30625f 100644 --- a/pkgs/by-name/de/dealii/package.nix +++ b/pkgs/by-name/de/dealii/package.nix @@ -8,13 +8,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "dealii"; - version = "9.7.1"; + version = "9.8.0"; src = fetchFromGitHub { owner = "dealii"; repo = "dealii"; tag = "v${finalAttrs.version}"; - hash = "sha256-hy7Z9DUcSv/k5UU5TOfYzCIEiKXBZZEUrRnJ7jN1gus="; + hash = "sha256-TivjhIy2IVcyQqS42d7Tnp2pFnrD0UWa9RLgRHUnIFc="; }; nativeBuildInputs = [ cmake ]; From 0c18529692022694b8f6fd7a88498f2a410c9276 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 9 Aug 2026 21:08:32 +0000 Subject: [PATCH 082/121] camunda-modeler: 5.50.0 -> 5.50.1 --- pkgs/by-name/ca/camunda-modeler/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ca/camunda-modeler/package.nix b/pkgs/by-name/ca/camunda-modeler/package.nix index 66e0d9762c94..669be5a713c2 100644 --- a/pkgs/by-name/ca/camunda-modeler/package.nix +++ b/pkgs/by-name/ca/camunda-modeler/package.nix @@ -10,11 +10,11 @@ stdenvNoCC.mkDerivation rec { pname = "camunda-modeler"; - version = "5.50.0"; + version = "5.50.1"; src = fetchurl { url = "https://github.com/camunda/camunda-modeler/releases/download/v${version}/camunda-modeler-${version}-linux-x64.tar.gz"; - hash = "sha256-khLBro0jYICQhZpRLNNlX++vEmSiQ5RCnyEz1+D95b4="; + hash = "sha256-bDwPJTyKmtbkZYFNzxL6Ow3B5FFP00j+e3btXqHhRME="; }; sourceRoot = "camunda-modeler-${version}-linux-x64"; From 1330bf0e6b447f2714e31a3ab1f2817d3d099443 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 9 Aug 2026 21:20:58 +0000 Subject: [PATCH 083/121] talhelper: 3.1.15 -> 3.1.16 --- pkgs/by-name/ta/talhelper/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ta/talhelper/package.nix b/pkgs/by-name/ta/talhelper/package.nix index 2641eec0b996..bf3e4229da0e 100644 --- a/pkgs/by-name/ta/talhelper/package.nix +++ b/pkgs/by-name/ta/talhelper/package.nix @@ -9,16 +9,16 @@ buildGoModule (finalAttrs: { pname = "talhelper"; - version = "3.1.15"; + version = "3.1.16"; src = fetchFromGitHub { owner = "budimanjojo"; repo = "talhelper"; tag = "v${finalAttrs.version}"; - hash = "sha256-1jvUf/YsCdj/zJ+BoIv+52CobScWMlc+hIHUN9VPN04="; + hash = "sha256-E2cJFl0jZuR6dtxMWUxwpmtxN/3Qyzh9nEgLCLXxfJk="; }; - vendorHash = "sha256-mXM7c6T5qcAHez5QrmxFmGE0DLyL2RADIFTdrQaH2GQ="; + vendorHash = "sha256-bBjeLyqX3t2msjiAXWnkII8yyg2x8oQ5zdWNlpV4NXc="; ldflags = [ "-s" From 33ece8ba82d5908b446d93063fa5649a6f29daf9 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 2 Aug 2026 00:53:42 +0200 Subject: [PATCH 084/121] networkmanager: 1.56.0 -> 1.58.0 https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/raw/1.58.0/NEWS Fixes: CVE-2026-10805 --- .../by-name/ne/networkmanager/fix-paths.patch | 26 ++----------------- pkgs/by-name/ne/networkmanager/package.nix | 19 +++++++++++--- 2 files changed, 17 insertions(+), 28 deletions(-) diff --git a/pkgs/by-name/ne/networkmanager/fix-paths.patch b/pkgs/by-name/ne/networkmanager/fix-paths.patch index 3cacf8152c2f..959b9ed1fb46 100644 --- a/pkgs/by-name/ne/networkmanager/fix-paths.patch +++ b/pkgs/by-name/ne/networkmanager/fix-paths.patch @@ -10,29 +10,8 @@ index 148acade5c..6395fbfbe5 100644 +PROGRAM="@runtimeShell@ -c '@ethtool@/bin/ethtool -i $$1 |@gnused@/bin/sed -n s/^driver:\ //p' -- $env{INTERFACE}", ENV{ID_NET_DRIVER}="%c" LABEL="nm_drivers_end" -diff --git a/src/core/devices/nm-device.c b/src/core/devices/nm-device.c -index e310a9c680..ed8d838e43 100644 ---- a/src/core/devices/nm-device.c -+++ b/src/core/devices/nm-device.c -@@ -15239,14 +15239,14 @@ nm_device_start_ip_check(NMDevice *self) - gw = nm_l3_config_data_get_best_default_route(l3cd, AF_INET); - if (gw) { - nm_inet4_ntop(NMP_OBJECT_CAST_IP4_ROUTE(gw)->gateway, buf); -- ping_binary = nm_utils_find_helper("ping", "/usr/bin/ping", NULL); -+ ping_binary = "@iputils@/bin/ping"; - log_domain = LOGD_IP4; - } - } else if (priv->ip_data_6.state == NM_DEVICE_IP_STATE_READY) { - gw = nm_l3_config_data_get_best_default_route(l3cd, AF_INET6); - if (gw) { - nm_inet6_ntop(&NMP_OBJECT_CAST_IP6_ROUTE(gw)->gateway, buf); -- ping_binary = nm_utils_find_helper("ping6", "/usr/bin/ping6", NULL); -+ ping_binary = "@iputils@/bin/ping"; - log_domain = LOGD_IP6; - } - } diff --git a/src/libnmc-base/nm-vpn-helpers.c b/src/libnmc-base/nm-vpn-helpers.c -index cbe76f5f1c..6ec684f9fe 100644 +index cbe76f5f1c..0fc28b83e7 100644 --- a/src/libnmc-base/nm-vpn-helpers.c +++ b/src/libnmc-base/nm-vpn-helpers.c @@ -284,15 +284,6 @@ nm_vpn_openconnect_authenticate_helper(NMSettingVpn *s_vpn, GPtrArray *secrets, @@ -51,7 +30,7 @@ index cbe76f5f1c..6ec684f9fe 100644 const char *oc_argv[(12 + 2 * G_N_ELEMENTS(oc_property_args))]; const char *gw; int port; -@@ -311,13 +302,8 @@ nm_vpn_openconnect_authenticate_helper(NMSettingVpn *s_vpn, GPtrArray *secrets, +@@ -311,13 +302,7 @@ nm_vpn_openconnect_authenticate_helper(NMSettingVpn *s_vpn, GPtrArray *secrets, port = extract_url_port(gw); @@ -63,7 +42,6 @@ index cbe76f5f1c..6ec684f9fe 100644 - NULL, - error); + path = g_find_program_in_path("openconnect"); -+ if (!path) return FALSE; diff --git a/pkgs/by-name/ne/networkmanager/package.nix b/pkgs/by-name/ne/networkmanager/package.nix index fa7bfdfec1d8..2260ab7d72ff 100644 --- a/pkgs/by-name/ne/networkmanager/package.nix +++ b/pkgs/by-name/ne/networkmanager/package.nix @@ -3,10 +3,14 @@ stdenv, fetchurl, replaceVars, + bpftools, gettext, pkg-config, + clang, dbus, gitUpdater, + slang, + libbpf, libuuid, polkit, gnutls, @@ -30,7 +34,6 @@ newt, ethtool, gnused, - iputils, kmod, jansson, elfutils, @@ -64,11 +67,11 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "networkmanager"; - version = "1.56.0"; + version = "1.58.0"; src = fetchurl { url = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/releases/${finalAttrs.version}/downloads/NetworkManager-${finalAttrs.version}.tar.xz"; - hash = "sha256-WaMtOFzB564m5DeYxvEtB/9hmKvQQewGILOgjPwCHMw="; + hash = "sha256-DG8nA6LJsBfNaPv+HS6KGl1/8FE3x1HsQhy6NulFRro="; }; outputs = [ @@ -79,6 +82,10 @@ stdenv.mkDerivation (finalAttrs: { "doc" ]; + # TODO: only disable for clang used for bpf builds + # this breaks clang target bpf, which does not support -fzero-call-used-regs=used-gpr + hardeningDisable = [ "zerocallusedregs" ]; + # Right now we hardcode quite a few paths at build time. Probably we should # patch networkmanager to allow passing these path in config file. This will # remove unneeded build-time dependencies. @@ -103,6 +110,7 @@ stdenv.mkDerivation (finalAttrs: { # Features # Allow using iwd when configured to do so + (lib.mesonBool "clat" (lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform)) # fails to find UAPI headers "-Diwd=true" "-Dpppd=${ppp}/bin/pppd" "-Diptables=${iptables}/bin/iptables" @@ -132,7 +140,6 @@ stdenv.mkDerivation (finalAttrs: { patches = [ (replaceVars ./fix-paths.patch { inherit - iputils ethtool gnused ; @@ -146,6 +153,7 @@ stdenv.mkDerivation (finalAttrs: { buildInputs = [ (if withSystemd then systemd else udev) + libbpf libselinux audit libpsl @@ -162,6 +170,7 @@ stdenv.mkDerivation (finalAttrs: { newt jansson dbus # used to get directory paths with pkg-config during configuration + slang ] ++ lib.optionals withNbft [ libnvme @@ -173,6 +182,8 @@ stdenv.mkDerivation (finalAttrs: { ]; nativeBuildInputs = [ + bpftools + clang meson ninja gettext From cfd18c9b6187152ffd7d4a54f86745696270d3e2 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 2 Aug 2026 02:27:34 +0200 Subject: [PATCH 085/121] networkmanager: modernize, sort, clean --- pkgs/by-name/ne/networkmanager/package.nix | 242 +++++++++++---------- 1 file changed, 130 insertions(+), 112 deletions(-) diff --git a/pkgs/by-name/ne/networkmanager/package.nix b/pkgs/by-name/ne/networkmanager/package.nix index 2260ab7d72ff..0ed904f95df5 100644 --- a/pkgs/by-name/ne/networkmanager/package.nix +++ b/pkgs/by-name/ne/networkmanager/package.nix @@ -1,68 +1,84 @@ { - lib, - stdenv, fetchurl, - replaceVars, - bpftools, - gettext, - pkg-config, - clang, - dbus, gitUpdater, - slang, - libbpf, - libuuid, - polkit, - gnutls, - ppp, - dhcpcd, - iptables, - nftables, - python3, - vala, - libgcrypt, - dnsmasq, - bluez5, - readline, - libselinux, - audit, - gobject-introspection, - perl, - modemmanager, - openresolv, - libndp, - newt, - ethtool, - gnused, - kmod, - jansson, + lib, + nixosTests, + replaceVars, + stdenv, + + # build + bpftools, + clang, elfutils, - gtk-doc, - libxslt, - docbook_xsl, - docbook_xml_dtd_412, - docbook_xml_dtd_42, - docbook_xml_dtd_43, - curl, + gettext, + gnused, meson, mesonEmulatorHook, ninja, - libnvme, - libpsl, - mobile-broadband-provider-info, + perl, + pkg-config, + vala, runtimeShell, buildPackages, - nixosTests, + + # libs + audit, + curl, + dbus, + gnutls, + gobject-introspection, + jansson, + libbpf, + libnvme, + libpsl, + libselinux, + libuuid, + polkit, + readline, + slang, systemd, udev, - udevCheckHook, withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd, + + # external deps + bluez5, + dhcpcd, + dnsmasq, + ethtool, + iptables, + kmod, + libgcrypt, + libndp, + modemmanager, + mobile-broadband-provider-info, + newt, + nftables, + openresolv, + ppp, + + # docs + docbook_xml_dtd_412, + docbook_xml_dtd_42, + docbook_xml_dtd_43, + docbook_xsl, + gtk-doc, + libxslt, + python3, + + # install tests + udevCheckHook, + # NBFT (NVMe Boot Firmware Table) support, opt-in due to closure size # https://github.com/NixOS/nixpkgs/pull/446121#discussion_r2380598419 withNbft ? false, }: let + inherit (lib) + mesonBool + mesonOption + ; + pythonForDocs = python3.pythonOnBuildForHost.withPackages (pkgs: with pkgs; [ pygobject3 ]); in stdenv.mkDerivation (finalAttrs: { @@ -93,48 +109,47 @@ stdenv.mkDerivation (finalAttrs: { # System paths "--sysconfdir=/etc" "--localstatedir=/var" - (lib.mesonOption "systemdsystemunitdir" ( + (mesonOption "systemdsystemunitdir" ( if withSystemd then "${placeholder "out"}/etc/systemd/system" else "no" )) # to enable link-local connections - "-Dudev_dir=${placeholder "out"}/lib/udev" - "-Ddbus_conf_dir=${placeholder "out"}/share/dbus-1/system.d" - "-Dkernel_firmware_dir=/run/current-system/firmware" + (mesonOption "udev_dir" "${placeholder "out"}/lib/udev") + (mesonOption "dbus_conf_dir" "${placeholder "out"}/share/dbus-1/system.d") + (mesonOption "kernel_firmware_dir" "/run/current-system/firmware") # Platform - "-Dmodprobe=${kmod}/bin/modprobe" - (lib.mesonOption "session_tracking" (if withSystemd then "systemd" else "no")) - (lib.mesonBool "systemd_journal" withSystemd) - "-Dlibaudit=yes-disabled-by-default" - "-Dpolkit_agent_helper_1=/run/wrappers/bin/polkit-agent-helper-1" + (mesonOption "modprobe" (lib.getExe' kmod "modprobe")) + (mesonOption "session_tracking" (if withSystemd then "systemd" else "no")) + (mesonBool "systemd_journal" withSystemd) + (mesonOption "libaudit" "yes-disabled-by-default") + (mesonOption "polkit_agent_helper_1" "/run/wrappers/bin/polkit-agent-helper-1") # Features - # Allow using iwd when configured to do so - (lib.mesonBool "clat" (lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform)) # fails to find UAPI headers - "-Diwd=true" - "-Dpppd=${ppp}/bin/pppd" - "-Diptables=${iptables}/bin/iptables" - "-Dnft=${nftables}/bin/nft" - "-Dmodem_manager=true" - "-Dnmtui=true" - "-Ddnsmasq=${dnsmasq}/bin/dnsmasq" - "-Dqt=false" - (lib.mesonBool "nbft" withNbft) + (mesonBool "clat" (lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform)) # fails to find UAPI headers + (mesonBool "iwd" true) + (mesonOption "pppd" (lib.getExe' ppp "pppd")) + (mesonOption "iptables" (lib.getExe iptables)) + (mesonOption "nft" (lib.getExe nftables)) + (mesonBool "modem_manager" true) + (mesonBool "nmtui" true) + (mesonOption "dnsmasq" (lib.getExe dnsmasq)) + (mesonBool "qt" false) + (mesonBool "nbft" withNbft) # Handlers - "-Dresolvconf=${openresolv}/bin/resolvconf" + (mesonOption "resolvconf" (lib.getExe openresolv)) # DHCP clients - "-Ddhcpcd=${dhcpcd}/bin/dhcpcd" + (mesonOption "dhcpcd" (lib.getExe dhcpcd)) # Miscellaneous # almost cross-compiles, however fails with # ** (process:9234): WARNING **: Failed to load shared library '/nix/store/...-networkmanager-aarch64-unknown-linux-gnu-1.38.2/lib/libnm.so.0' referenced by the typelib: /nix/store/...-networkmanager-aarch64-unknown-linux-gnu-1.38.2/lib/libnm.so.0: cannot open shared object file: No such file or directory - "-Ddocs=${lib.boolToString (stdenv.buildPlatform == stdenv.hostPlatform)}" - "-Dman=${lib.boolToString (stdenv.buildPlatform == stdenv.hostPlatform)}" - "-Dtests=no" - "-Dcrypto=gnutls" - "-Dmobile_broadband_provider_info_database=${mobile-broadband-provider-info}/share/mobile-broadband-provider-info/serviceproviders.xml" + (mesonBool "docs" (lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform)) + (mesonBool "man" (lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform)) + (mesonOption "tests" "no") + (mesonOption "crypto" "gnutls") + (mesonOption "mobile_broadband_provider_info_database" "${mobile-broadband-provider-info}/share/mobile-broadband-provider-info/serviceproviders.xml") ]; patches = [ @@ -151,26 +166,52 @@ stdenv.mkDerivation (finalAttrs: { ./fix-install-paths.patch ]; + nativeBuildInputs = [ + bpftools + clang + elfutils # used to find jansson soname + gettext + gobject-introspection + meson + ninja + perl + pkg-config + vala + udevCheckHook + + # Docs + gtk-doc + libxslt + docbook_xsl + docbook_xml_dtd_412 + docbook_xml_dtd_42 + docbook_xml_dtd_43 + pythonForDocs + ] + ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [ + mesonEmulatorHook + ]; + buildInputs = [ - (if withSystemd then systemd else udev) - libbpf - libselinux audit + bluez5 + curl + dbus # used to get directory paths with pkg-config during configuration + dnsmasq + jansson + libbpf + libndp libpsl + libselinux libuuid + mobile-broadband-provider-info + modemmanager + newt polkit ppp - libndp - curl - mobile-broadband-provider-info - bluez5 - dnsmasq - modemmanager readline - newt - jansson - dbus # used to get directory paths with pkg-config during configuration slang + (if withSystemd then systemd else udev) ] ++ lib.optionals withNbft [ libnvme @@ -181,30 +222,7 @@ stdenv.mkDerivation (finalAttrs: { libgcrypt ]; - nativeBuildInputs = [ - bpftools - clang - meson - ninja - gettext - pkg-config - vala - gobject-introspection - perl - elfutils # used to find jansson soname - # Docs - gtk-doc - libxslt - docbook_xsl - docbook_xml_dtd_412 - docbook_xml_dtd_42 - docbook_xml_dtd_43 - pythonForDocs - udevCheckHook - ] - ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [ - mesonEmulatorHook - ]; + nativeInstallCheckInputs = [ udevCheckHook ]; doCheck = false; # requires /sys, the net @@ -218,7 +236,7 @@ stdenv.mkDerivation (finalAttrs: { '' + lib.optionalString withSystemd '' substituteInPlace data/NetworkManager.service.in \ - --replace-fail /usr/bin/busctl ${systemd}/bin/busctl + --replace-fail /usr/bin/busctl ${lib.getExe' systemd "busctl"} ''; preBuild = '' @@ -230,7 +248,7 @@ stdenv.mkDerivation (finalAttrs: { ln -s $PWD/src/libnm-client-impl/libnm.so.0 ${placeholder "out"}/lib/libnm.so.0 ''; - postFixup = lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) '' + postFixup = lib.optionalString (!lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform) '' cp -r ${buildPackages.networkmanager.devdoc} $devdoc cp -r ${buildPackages.networkmanager.man} $man ''; From a61e0179cbd354668f53825f412577d043ed9e8c Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 2 Aug 2026 02:27:54 +0200 Subject: [PATCH 086/121] networkmanager: make passthru tests an unnested attrset This way they get picked up by `nix-build -A networkmanager.tests`. --- pkgs/by-name/ne/networkmanager/package.nix | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/pkgs/by-name/ne/networkmanager/package.nix b/pkgs/by-name/ne/networkmanager/package.nix index 0ed904f95df5..3dfd4067399f 100644 --- a/pkgs/by-name/ne/networkmanager/package.nix +++ b/pkgs/by-name/ne/networkmanager/package.nix @@ -260,9 +260,7 @@ stdenv.mkDerivation (finalAttrs: { odd-unstable = true; url = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git"; }; - tests = { - inherit (nixosTests.networking) networkmanager; - }; + tests = nixosTests.networking.networkmanager; }; meta = { From e0cdac98fae7ab02bb35fc8651ce4ef6c29dee3a Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 2 Aug 2026 02:28:36 +0200 Subject: [PATCH 087/121] nixosTests.networkmanager.eap{,files}: fix log match --- nixos/tests/networking/networkmanager.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/nixos/tests/networking/networkmanager.nix b/nixos/tests/networking/networkmanager.nix index 55f65897e3cc..27703a4d8afb 100644 --- a/nixos/tests/networking/networkmanager.nix +++ b/nixos/tests/networking/networkmanager.nix @@ -245,8 +245,8 @@ let client.wait_for_unit("NetworkManager.service") router.wait_for_unit("freeradius.service") router.wait_for_unit("hostapd.service") - router.wait_until_succeeds("journalctl -b --unit freeradius.service | grep \"Sent Access-Accept\"") - router.wait_until_succeeds("journalctl -b --unit freeradius.service | grep \"TLS-Client-Cert-Common-Name := \\\"client1.example.com\\\"\"") + router.wait_until_succeeds("journalctl -b --unit freeradius.service --grep='Sent Access-Accept'") + router.wait_until_succeeds("journalctl -b --unit freeradius.service --grep='TLS-Client-Cert-Common-Name = \"client1.example.com\"'") ''; }; eapFiles = { @@ -294,8 +294,8 @@ let client.wait_for_unit("NetworkManager.service") router.wait_for_unit("freeradius.service") router.wait_for_unit("hostapd.service") - router.wait_until_succeeds("journalctl -b --unit freeradius.service | grep \"Sent Access-Accept\"") - router.wait_until_succeeds("journalctl -b --unit freeradius.service | grep \"TLS-Client-Cert-Common-Name := \\\"client1.example.com\\\"\"") + router.wait_until_succeeds("journalctl -b --unit freeradius.service --grep='Sent Access-Accept'") + router.wait_until_succeeds("journalctl -b --unit freeradius.service --grep='TLS-Client-Cert-Common-Name = \"client1.example.com\"'") ''; }; }; From 1747ed63a0e6bb5ed4a975447d698b724b985f26 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 2 Aug 2026 02:32:43 +0200 Subject: [PATCH 088/121] freeradius: run networkmanager eap tests in passthru They regressed in one of the last updates, so lets hook them up here. --- pkgs/by-name/fr/freeradius/package.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pkgs/by-name/fr/freeradius/package.nix b/pkgs/by-name/fr/freeradius/package.nix index 3aa2e394b9f5..638c4c0b677c 100644 --- a/pkgs/by-name/fr/freeradius/package.nix +++ b/pkgs/by-name/fr/freeradius/package.nix @@ -32,6 +32,7 @@ sqlite, withYubikey ? false, libyubikey, + nixosTests, }: assert withRest -> withJson; @@ -101,6 +102,13 @@ stdenv.mkDerivation rec { "doc" ]; + passthru.tests = { + inherit (nixosTests.networking.networkmanager) + eap + eapFiles + ; + }; + meta = { homepage = "https://freeradius.org/"; description = "Modular, high performance free RADIUS suite"; From 52914d446fb7c684fffdbd1ba125e5229acc0ed2 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 9 Aug 2026 22:24:11 +0000 Subject: [PATCH 089/121] python3Packages.types-openpyxl: 3.1.5.20260724 -> 3.1.5.20260807 --- pkgs/development/python-modules/types-openpyxl/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/types-openpyxl/default.nix b/pkgs/development/python-modules/types-openpyxl/default.nix index 63c4dcb61b7f..c528c5381ef7 100644 --- a/pkgs/development/python-modules/types-openpyxl/default.nix +++ b/pkgs/development/python-modules/types-openpyxl/default.nix @@ -6,14 +6,14 @@ }: buildPythonPackage (finalAttrs: { pname = "types-openpyxl"; - version = "3.1.5.20260724"; + version = "3.1.5.20260807"; pyproject = true; src = fetchPypi { pname = "types_openpyxl"; inherit (finalAttrs) version; - hash = "sha256-27IA+KYVvoIFIjFKfacPGw5fRwIp4KmnJVDNy9xiR7E="; + hash = "sha256-GgpCsSX4Aj066DzAV+N50wGof0XmC2FgkXgk/vKKsBU="; }; build-system = [ setuptools ]; From a31fdcf0cea962d5097d12df7c9bea7c19493c8f Mon Sep 17 00:00:00 2001 From: Logan Devine Date: Sat, 8 Aug 2026 19:47:10 -0700 Subject: [PATCH 090/121] vscode-extensions.arktypeio.arkdark: init at 6.6.0 --- .../editors/vscode/extensions/default.nix | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix index be0e4ba63a75..531e7866262a 100644 --- a/pkgs/applications/editors/vscode/extensions/default.nix +++ b/pkgs/applications/editors/vscode/extensions/default.nix @@ -361,6 +361,22 @@ let }; }; + arktypeio.arkdark = buildVscodeMarketplaceExtension { + mktplcRef = { + publisher = "arktypeio"; + name = "arkdark"; + version = "6.6.0"; + hash = "sha256-9QsHaH8mXM7D7QE5+xTFrGyxh6MShPF9Wk0hFHpxk8A="; + }; + meta = { + description = "Syntax highlighting and inline errors for ArkType"; + downloadPage = "https://marketplace.visualstudio.com/items?itemName=arktypeio.arkdark"; + homepage = "https://github.com/arktypeio/arktype"; + license = lib.licenses.mit; + maintainers = with lib.maintainers; [ logn ]; + }; + }; + arrterian.nix-env-selector = buildVscodeMarketplaceExtension { mktplcRef = { name = "nix-env-selector"; From 427cf9d688cec5b8d241d78146b5986f81f22851 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 9 Aug 2026 23:19:38 +0000 Subject: [PATCH 091/121] atmos: 1.224.1 -> 1.225.0 --- pkgs/by-name/at/atmos/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/at/atmos/package.nix b/pkgs/by-name/at/atmos/package.nix index 63d6d0d8afc9..211de0f0d67f 100644 --- a/pkgs/by-name/at/atmos/package.nix +++ b/pkgs/by-name/at/atmos/package.nix @@ -7,16 +7,16 @@ buildGoModule (finalAttrs: { pname = "atmos"; - version = "1.224.1"; + version = "1.225.0"; src = fetchFromGitHub { owner = "cloudposse"; repo = "atmos"; tag = "v${finalAttrs.version}"; - hash = "sha256-ew07sucTTLLUU2bdN3HKyJJ6i5z6jqgfYR3fHLnzcHA="; + hash = "sha256-PP2yOYwNnvk08QJtNSvpF/ZEQIrh1dQlMH9CUf6Ozr8="; }; - vendorHash = "sha256-MP30jhbhcf6+TWB0q/VLPY6DYd0TLUWZmg3D+d8IpXg="; + vendorHash = "sha256-1lyBg1slFnCCdmP749Ub7Hjx1zFvNaZaMVwOnSuqG/M="; env.CGO_ENABLED = 0; # Compiles a pure statically linked Go binary. From 7854a554740db405392b8cc9db42ae48a2bd9023 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 9 Aug 2026 23:31:57 +0000 Subject: [PATCH 092/121] koffan: 2.12.3 -> 2.13.0 --- pkgs/by-name/ko/koffan/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ko/koffan/package.nix b/pkgs/by-name/ko/koffan/package.nix index 761bf44658fc..501be9ffd4db 100644 --- a/pkgs/by-name/ko/koffan/package.nix +++ b/pkgs/by-name/ko/koffan/package.nix @@ -7,13 +7,13 @@ buildGoModule (finalAttrs: { pname = "koffan"; - version = "2.12.3"; + version = "2.13.0"; src = fetchFromGitHub { owner = "PanSalut"; repo = "Koffan"; tag = "v${finalAttrs.version}"; - hash = "sha256-mApQftAsoXh6CTFRPu28O9iK5Ow2/QwkAx4V8XPWTvg="; + hash = "sha256-kaObQYEgyMBRVqcKP8dzMKAdOMN8K7xa7X55XvneoXg="; }; vendorHash = "sha256-BYehi5LQQ0MIsKG/fN3DHaQwKVmxUFrvWGrKZeKj+ow="; From af67d90f57efbfdabe6c9b9a0f24be2a2361c02c Mon Sep 17 00:00:00 2001 From: dish Date: Sun, 9 Aug 2026 22:21:11 -0400 Subject: [PATCH 093/121] python3Packages.django-celery-email: format to pyproject Also some slight cleanups and explain why it doesn't use pytestCheckHook --- .../python-modules/django-celery-email/default.nix | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/pkgs/development/python-modules/django-celery-email/default.nix b/pkgs/development/python-modules/django-celery-email/default.nix index 368dce09ba1e..3965a8c2fa85 100644 --- a/pkgs/development/python-modules/django-celery-email/default.nix +++ b/pkgs/development/python-modules/django-celery-email/default.nix @@ -2,18 +2,19 @@ lib, buildPythonPackage, fetchFromGitHub, + setuptools, django, django-appconf, celery, pytest-django, - pytestCheckHook, + pytest, python, }: buildPythonPackage rec { pname = "django-celery-email"; version = "3.0.0"; - format = "setuptools"; + pyproject = true; src = fetchFromGitHub { owner = "pmclanahan"; @@ -22,7 +23,9 @@ buildPythonPackage rec { hash = "sha256-LBavz5Nh2ObmIwLCem8nHvsuKgPwkzbS/OzFPmSje/M="; }; - propagatedBuildInputs = [ + build-system = [ setuptools ]; + + dependencies = [ django django-appconf celery @@ -32,9 +35,12 @@ buildPythonPackage rec { nativeCheckInputs = [ pytest-django - pytestCheckHook + pytest ]; + pytestFlags = [ "tests/tests.py" ]; + + # Don't use pytestCheckHook since tests need to override the django `EMAIL_BACKEND` which can only be done in python checkPhase = '' ${python.executable} runtests.py ''; From 2e081737988c8a5f0c8b79911c41fb2b87c6b38c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Mon, 10 Aug 2026 06:51:29 +0200 Subject: [PATCH 094/121] nixos/tests/installer: add missing libcap-text-verifier --- nixos/tests/installer.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix index d90fbafd93e8..af8feebd1a1b 100644 --- a/nixos/tests/installer.nix +++ b/nixos/tests/installer.nix @@ -748,6 +748,7 @@ let kbd.dev kmod.dev libarchive.dev + libcap-text-verifier libxml2.bin libxslt.bin nixos-artwork.wallpapers.simple-dark-gray-bottom From 34ab6dd2b5c3baa5374d02f05adbb62b5a1b0a69 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 10 Aug 2026 06:09:46 +0000 Subject: [PATCH 095/121] burpsuite: 2026.7.2 -> 2026.7.3 --- pkgs/by-name/bu/burpsuite/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/bu/burpsuite/package.nix b/pkgs/by-name/bu/burpsuite/package.nix index 753aba974a1b..9a32820150af 100644 --- a/pkgs/by-name/bu/burpsuite/package.nix +++ b/pkgs/by-name/bu/burpsuite/package.nix @@ -15,7 +15,7 @@ assert lib.assertMsg ( let pname = "burpsuite"; - version = "2026.7.2"; + version = "2026.7.3"; src = fetchurl { name = "burpsuite.jar"; @@ -24,7 +24,7 @@ let "https://portswigger.net/burp/releases/download?product=desktop&version=${version}&type=Jar" "https://web.archive.org/web/https://portswigger.net/burp/releases/download?product=desktop&version=${version}&type=Jar" ]; - hash = "sha256-WLmuv09RKq4B4/L1iWFEPck45Fix/5DTFs/MPYJmC8M="; + hash = "sha256-yCYtxUJvOL7cSQ1mxdIbb/d9bcbYXO/mpmyIJpATQGk="; }; description = "Integrated platform for performing security testing of web applications"; From 180bb059891edb2ec0fafdc0fc120a2525496267 Mon Sep 17 00:00:00 2001 From: Vincent Laporte Date: Mon, 10 Aug 2026 08:13:05 +0200 Subject: [PATCH 096/121] =?UTF-8?q?ocamlPackages.jingoo:=201.5.2=20?= =?UTF-8?q?=E2=86=92=201.5.4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkgs/development/ocaml-modules/jingoo/default.nix | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/pkgs/development/ocaml-modules/jingoo/default.nix b/pkgs/development/ocaml-modules/jingoo/default.nix index fdf296aa94b2..300ddf9e0945 100644 --- a/pkgs/development/ocaml-modules/jingoo/default.nix +++ b/pkgs/development/ocaml-modules/jingoo/default.nix @@ -3,7 +3,6 @@ buildDunePackage, fetchFromGitHub, menhir, - ppxlib, ppx_deriving, re, uutf, @@ -13,18 +12,17 @@ buildDunePackage (finalAttrs: { pname = "jingoo"; - version = "1.5.2"; + version = "1.5.4"; src = fetchFromGitHub { owner = "tategakibunko"; repo = "jingoo"; tag = finalAttrs.version; - hash = "sha256-1357XOYZseItCrIm/qNP46aL8tQyX8CFh77CBycL1ew="; + hash = "sha256-FltjCOGGztYm3tFqRkdWmNmopmC8DDhhmY0LqfYgh40="; }; nativeBuildInputs = [ menhir ]; propagatedBuildInputs = [ - ppxlib ppx_deriving re uutf From 6c74807efcf5eafc050f79a91d28aa19a8b8981a Mon Sep 17 00:00:00 2001 From: andre4ik3 Date: Wed, 3 Jun 2026 03:40:05 +0000 Subject: [PATCH 097/121] nixos/zapret2: init module --- nixos/doc/manual/redirects.json | 18 + .../manual/release-notes/rl-2611.section.md | 2 + nixos/modules/module-list.nix | 1 + nixos/modules/services/networking/zapret2.md | 246 ++++++++ nixos/modules/services/networking/zapret2.nix | 563 ++++++++++++++++++ nixos/tests/all-tests.nix | 1 + nixos/tests/zapret2.nix | 153 +++++ pkgs/by-name/za/zapret2/package.nix | 3 + 8 files changed, 987 insertions(+) create mode 100644 nixos/modules/services/networking/zapret2.md create mode 100644 nixos/modules/services/networking/zapret2.nix create mode 100644 nixos/tests/zapret2.nix diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json index 28db6d9841c3..6e8a587f02c4 100644 --- a/nixos/doc/manual/redirects.json +++ b/nixos/doc/manual/redirects.json @@ -214,6 +214,24 @@ "module-services-tdarr-server-only": [ "index.html#module-services-tdarr-server-only" ], + "module-services-zapret2": [ + "index.html#module-services-zapret2" + ], + "module-services-zapret2-configuration": [ + "index.html#module-services-zapret2-configuration" + ], + "module-services-zapret2-configuration-firewall": [ + "index.html#module-services-zapret2-configuration-firewall" + ], + "module-services-zapret2-configuration-lua-files": [ + "index.html#module-services-zapret2-configuration-lua-files" + ], + "module-services-zapret2-configuration-profiles": [ + "index.html#module-services-zapret2-configuration-profiles" + ], + "module-services-zapret2-quick-start": [ + "index.html#module-services-zapret2-quick-start" + ], "module-virtualisation-xen": [ "index.html#module-virtualisation-xen" ], diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md index b05d7808451b..640b584a5668 100644 --- a/nixos/doc/manual/release-notes/rl-2611.section.md +++ b/nixos/doc/manual/release-notes/rl-2611.section.md @@ -56,6 +56,8 @@ - [Koito](https://koito.io/), a modern, themeable scrobbler that you can use with any program that scrobbles to a custom ListenBrainz URL. Available as [services.koito](#opt-services.koito.enable). +- [Zapret2](https://github.com/bol-van/zapret2), an extensible DPI bypass program. Available as [services.zapret2](#opt-services.zapret2.enable). + - [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable). - [gocron](https://github.com/flohoss/gocron), a task scheduler with web interface. Available as [services.gocron](#opt-services.gocron.enable). diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 7a7d54a9c6dd..ac9f434822d5 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -1498,6 +1498,7 @@ ./services/networking/xrdp.nix ./services/networking/yggdrasil-jumper.nix ./services/networking/yggdrasil.nix + ./services/networking/zapret2.nix ./services/networking/zapret.nix ./services/networking/zenohd.nix ./services/networking/zerobin.nix diff --git a/nixos/modules/services/networking/zapret2.md b/nixos/modules/services/networking/zapret2.md new file mode 100644 index 000000000000..12b542a01e6f --- /dev/null +++ b/nixos/modules/services/networking/zapret2.md @@ -0,0 +1,246 @@ +# Zapret2 {#module-services-zapret2} + +[Zapret2](https://github.com/bol-van/zapret2) is a service that enables +bypassing DPI systems using extensible Lua filters that process outgoing +network traffic. + +For details on which parameters are available and their usage, consult the +[upstream documentation][1]. + +## Quick Start {#module-services-zapret2-quick-start} + +A simple, minimal setup that includes only a single profile that applies two +Lua [instances][2] to TLS ClientHello packets can be defined as follows: + +```nix +{ + services.zapret2 = { + enable = true; + profiles.default.parameters = [ + "--filter-tcp=443" + "--payload=tls_client_hello" + "--lua-desync=fake:blob=fake_default_tls:tcp_ts=-1000:repeats=1" + "--lua-desync=fakedsplit:pos=1,midsld:tcp_ts=-1000" + ]; + }; +} +``` + +## Configuration {#module-services-zapret2-configuration} + +The NixOS module for Zapret2 adds a small structured interface on top of the +typical plain argument list that is passed to `nfqws2`. This allows e.g. +profiles to be defined across multiple modules and merged correctly. + +### Profiles {#module-services-zapret2-configuration-profiles} + +Each Zapret2 profile is defined under the {option}`services.zapret2.profiles` +option. Multiple profiles can be defined at once, however it's important to +ensure that each profile can only match one category of traffic by using +`--filter-*` parameters, because otherwise a profile will match all traffic, +and since first match wins, no other profile can match it, even if it has a +more specific filter: + +```nix +{ + services.zapret2.profiles = { + http.parameters = [ + "--filter-tcp=80" + "--payload=http_req" + "--lua-desync=http_methodeol" + ]; + https.parameters = [ + "--filter-tcp=443" + "--payload=tls_client_hello" + "--lua-desync=multisplit:pos=1,sniext+1,host+1,midsld-2,midsld,midsld+2,endhost-1" + ]; + stun.parameters = [ + "--filter-udp=*" + "--payload=stun,discord_ip_discovery" + "--lua-desync=fake:blob=0x00000000000000000000000000000000:repeats=2" + ]; + }; +} +``` + +Since profiles are matched on their order and first match wins, each profile +also has a {option}`services.zapret2.profiles.‹name›.priority` option. Lower +values will cause the profile to be ordered *before* others, higher values will +cause the profile to be ordered *after* others. The default priority is `1000`. +In other words, if you want to define a "fallback" profile that matches traffic +not matched by any other profile, you should set the priority to a higher value +such as `1500`. + +Each profile's parameters can have the typical filters such as `--filter-tcp=*` +or `--filter-udp=*`, however for matching hostnames and IP addresses, there are +a few options to make this more convenient: + +```nix +{ + services.zapret2.profiles.default = { + hosts = { + # Automatically keep track of which hosts need the DPI bypass and which + # don't. This works by Zapret2 checking if the connection would otherwise + # be matched by the profile, and if it is, it first bypasses it, however + # it monitors the connection to see if it gets denied (for example, if a + # TCP RST packet is received right after the TLS ClientHello is sent). If + # this happens, it will then add it to the auto host list (that is + # persisted on disk), so subsequent connections will succeed. + autodetect.enable = true; + + # If you wish to change where the automatic hostlist file is saved, from + # the default location of `/var/lib/zapret2/‹name›-hosts.txt`, for + # example to share between multiple profiles: + autodetect.file = "/var/lib/zapret2/hosts.txt"; + + # Hardcoded list of DNS domains to include/exclude. Note that domains are + # matched including all their subdomains, so `nixos.org` also includes + # `cache.nixos.org` for example, and `ru` includes `gosuslugi.ru`. If you + # don't want this behaviour, you should add `^` to the beginning of the + # entry, e.g. `^example.com` will match `example.com` but not + # `www.example.com`. + include = [ + "cachix.org" + "nixos.org" + ]; + exclude = [ "ru" ]; + }; + + ips = { + # Like with hostnames, hardcoded list of IP addresses or subnets in CIDR + # notation to include/exclude. Note that by default, the firewall already + # excludes local networks (as defined by RFC 1918), so they are not + # passed to Zapret2. + include = [ "213.59.192.0/18" ]; + exclude = [ "173.245.48.0/20" ]; + }; + }; +} +``` + +If either an IP/host include list is defined, or {option}`hosts.autodetect` is +enabled, the profile will enter a whitelist mode, where traffic by default +won't be matched (except the special connection tracking case of the auto +mode). If an IP/host exclude list is defined, traffic not on the exclude list +is still matched by default, unless an include list is also defined. + +In addition to the options above, you may of course define `--ipset-*` or +`--hostlist-*` options in the profile's parameters. This can be useful to e.g. +maintain an externally updated list that is not hardcoded into the NixOS +configuration. If you use these options, make sure the file paths are +accessible by the user that Zapret2 runs as (by default, it runs as a dynamic +user). + +### Lua Files {#module-services-zapret2-configuration-lua-files} + +By default, the module loads the `zapret-lib` and `zapret-antidpi` files from +the package defined by {option}`services.zapret2.package`. The list of files to +load can be customised using the {option}`services.zapret2.files` option, as +follows: + +```nix +{ + services.zapret2.files = [ + "zapret-lib" + "zapret-antidpi" + "zapret-obfs" + ./my-lib.lua + "/path/to/read/at/runtime/my-lib.lua" + ]; +} +``` + +Each entry in the list of files can either be a path value, an absolute string +path (with the `.lua` extension), or the name of a [Zapret2 Lua library][3] +(without the `.lua` extension). For example, `zapret-lib` gets resolved to +`zapret-lib.lua` from the defined {option}`services.zapret2.package`. By +default, `zapret-lib` and `zapret-antidpi` are already included, so for the +simple case of DPI bypass using the standard libraries, configuring this option +isn't needed. + +However, note that if you *do* customise this option, it overrides the default +list of files completely. So, for example, if you are writing custom Lua desync +functions, you will need to not only include your library's full path, but also +any libraries that it depends on (typically `zapret-lib`). + +### Firewall {#module-services-zapret2-configuration-firewall} + +Options for the generated nftables firewall configuration can be customised +under the {option}`services.zapret2.firewall` option. Since Zapret2 is a +userspace program and all network traffic originates in the kernel, all +matching network traffic has to be passed from kernel space to userspace. This +is an expensive process that can slow down network traffic if too much traffic +is processed. So, it is important to process as little traffic as possible to +maintain high network throughput. The predefined firewall already excludes +local IP ranges (as defined by RFC 1918), and the module includes a number of +options to further reduce how much traffic is passed to Zapret2: + +```nix +{ + services.zapret2.firewall = { + # The maximum number of packets *per each connection* that is passed to + # Zapret2, where connection is defined by conntrack. So for the default + # value of 16, it will pass the first 16 packets of the connection to + # Zapret2 for processing. After 16 packets the firewall won't pass any + # packets, and the connection will completely bypass Zapret2. This is + # sufficient for most anti-DPI mangling. However if you are doing more + # complex processing, you may have to increase this. If you are doing + # obfuscation, you will want to set this to `null` so that every packet is + # passed. Otherwise obfuscation will only apply to the first 16 packets. + maxPackets = 16; + + # The interfaces on which traffic will be passed to Zapret2 for processing. + # By default this is `null`, which matches every interface including e.g. + # loopback and VPN tunnels, which don't need processing. You should almost + # always set this to your actual outbound network interface(s) to prevent + # VPN traffic on the inside of the tunnel from getting mangled. + interfaces = [ "eth0" ]; + + # TCP and UDP ports routed to Zapret2 at the firewall level. Any ports not + # in these lists will bypass processing completely. No profile can ever + # match ports not on these lists, since they are not even passed to + # Zapret2. By default these are both `null`, meaning connections to all + # ports are passed. + tcpPorts = [ + 80 + 443 + ]; + udpPorts = [ 443 ]; + + # Internal parameters used by the firewall that mustn't be used by any + # other application, or in your own firewall configuration, for example if + # you are doing some kind of advanced setup on a router. + queue = 200; + desyncFwmark = "0x40000000"; + }; +} +``` + +Since Zapret2 works using nfqueue, it's important that the queue number is not +used by any other application on the system. If the default queue number of +`200` is already used by another application, you should set the option +{option}`services.zapret2.firewall.queue` to a queue number that isn't used. + +Likewise, it's also important that the desync mark used to mark +already-processed packets is also not used by any other application. Otherwise, +it may cause issues such as packet loops or some packets being ignored by the +conflicting applications. If the default desync mark of `0x40000000` is used by +another application (or within your firewall configuration), you should set the +option {option}`services.zapret2.firewall.desyncFwmark` to a desync mark that +isn't used. Note that the desync mark is expected to be a bitmask, i.e. it +should be a single bit. As such, the option uses a string instead of a number, +and the module checks that it only has a single bit set in it. + +The firewall configuration in the module only supports nftables, it does not +support iptables. If you wish to use iptables, or otherwise want to define your +own firewall configuration (for example, if you are running Zapret2 server-side +instead of client-side), you can disable the built-in firewall configuration by +setting {option}`services.zapret2.firewall.configureAutomatically` to `false`. +Note that, even if the option is disabled, the module still uses the queue +number and desync mark defined in the module's options, as they are passed as +command-line arguments to Zapret2. None of the other firewall options are used. + +[1]: https://github.com/bol-van/zapret2/blob/master/docs/manual.en.md +[2]: https://github.com/bol-van/zapret2/blob/master/docs/manual.en.md#traffic-processing-scheme +[3]: https://github.com/bol-van/zapret2/tree/master/lua + diff --git a/nixos/modules/services/networking/zapret2.nix b/nixos/modules/services/networking/zapret2.nix new file mode 100644 index 000000000000..4bf88e4ecb74 --- /dev/null +++ b/nixos/modules/services/networking/zapret2.nix @@ -0,0 +1,563 @@ +{ + utils, + config, + pkgs, + lib, + ... +}: + +let + cfg = config.services.zapret2; + + profileSubmodule = + { config, name, ... }: + { + options = { + name = lib.mkOption { + type = lib.types.nonEmptyStr; + default = name; + defaultText = "‹name›"; + description = "A unique string that identifies this profile."; + }; + + priority = lib.mkOption { + type = lib.types.int; + default = 1000; + example = 0; + description = '' + The priority for the profile when constructing the command-line + parameters. Lower priority values will cause the profile to be + ordered before others, meaning it will be matched before others. + Higher priority values will cause the profile to be ordered after + others, meaning it will be matched after others. + ''; + }; + + ips = { + include = lib.mkOption { + type = lib.types.nullOr (lib.types.uniq (lib.types.listOf lib.types.nonEmptyStr)); + default = null; + example = [ + "213.59.192.0/18" + ]; + description = '' + An explicit list of IP addresses to include in the DPI bypass. + Each member is an IPv4 or IPv6 address, or a subnet in CIDR + notation. + + If set to null (the default), no include list is set, meaning all + IP addresses are included in the DPI bypass. If set to an empty + list, the include list will be empty, and no IP address will be + included in the DPI bypass. + ''; + }; + + exclude = lib.mkOption { + type = lib.types.nullOr (lib.types.uniq (lib.types.listOf lib.types.nonEmptyStr)); + default = null; + example = [ + "173.245.48.0/20" + "103.21.244.0/22" + "103.22.200.0/22" + "103.31.4.0/22" + "141.101.64.0/18" + "108.162.192.0/18" + "190.93.240.0/20" + "188.114.96.0/20" + "197.234.240.0/22" + "198.41.128.0/17" + "162.158.0.0/15" + "104.16.0.0/13" + "104.24.0.0/14" + "172.64.0.0/13" + "131.0.72.0/22" + ]; + description = '' + An explicit list of IP addresses to exclude from the DPI bypass. + Each member is an IPv4 or IPv6 address, or a subnet in CIDR + notation. + + If set to null (the default) or an empty list, no exclude list is + set, meaning no IP addresses are excluded from the DPI bypass. + ''; + }; + }; + + hosts = { + include = lib.mkOption { + type = lib.types.nullOr (lib.types.uniq (lib.types.listOf lib.types.nonEmptyStr)); + default = null; + example = [ + "youtube.com" + "chess.com" + ]; + description = '' + An explicit list of hostnames to include in the DPI bypass. Each + member is a hostname, optionally prefixed with ^ to be a strict + match (by default all subdomains are matched). + + If set to null (the default), no include list is set, meaning all + hostnames are included in the DPI bypass. If set to an empty + list, the include list will be empty, and no hostname will be + included in the DPI bypass. + ''; + }; + + exclude = lib.mkOption { + type = lib.types.nullOr (lib.types.uniq (lib.types.listOf lib.types.nonEmptyStr)); + default = null; + example = [ + "ru" + "yandex.net" + "yastatic.net" + ]; + description = '' + An explicit list of hostnames to exclude from the DPI bypass. + Each member is a hostname, optionally prefixed with ^ to be a + strict match (by default all subdomains are matched). + + If set to null (the default) or an empty list, no exclude list is + set, meaning no hostnames are excluded from the DPI bypass. + ''; + }; + + autodetect = { + enable = lib.mkEnableOption '' + automatic tracking of which hosts the DPI bypass is necessary for + ''; + + file = lib.mkOption { + type = lib.types.path; + default = "/var/lib/zapret2/${config.name}-hosts.txt"; + defaultText = "/var/lib/zapret2/‹name›-hosts.txt"; + description = '' + The file where the automatic host list is saved. This path must + be writable by the user Zapret2 runs as (by default, it uses a + dynamic user, so it should generally be in + {file}`/var/lib/zapret2`). + ''; + }; + }; + }; + + parameters = lib.mkOption { + type = lib.types.listOf lib.types.str; + default = [ ]; + example = [ + "--filter-tcp=443" + "--payload=tls_client_hello" + "--lua-desync=fake:blob=fake_default_tls:tcp_ts=-1000:repeats=1" + "--lua-desync=fakedsplit:pos=1,midsld:tcp_ts=-1000" + ]; + description = '' + The parameters to use for this profile. Note that, when using + multiple profiles, a {option}`--filter-*` parameter MUST be defined, + otherwise the first profile will match everything and no other + profile will even be executed. + + To obtain a list of suitable parameters, consider running the + `blockcheck2` program (part of the zapret2 package), searching the + [Zapret forums][1] for community solutions, or consulting the + [Zapret manual][2]. + + [1]: https://ntc.party/c/community-software/zapret-antidpi/ + [2]: https://github.com/bol-van/zapret2/blob/master/docs/manual.en.md + ''; + }; + }; + + config.parameters = lib.mkMerge [ + (lib.mkIf (config.ips.include != null) ( + lib.mkBefore [ + "--ipset=${pkgs.writeText "zapret2-ips-include.txt" (lib.concatLines config.ips.include)}" + ] + )) + (lib.mkIf (config.ips.exclude != null) ( + lib.mkBefore [ + "--ipset-exclude=${pkgs.writeText "zapret2-ips-exclude.txt" (lib.concatLines config.ips.exclude)}" + ] + )) + (lib.mkIf (config.hosts.include != null) ( + lib.mkBefore [ + "--hostlist=${pkgs.writeText "zapret2-hosts-include.txt" (lib.concatLines config.hosts.include)}" + ] + )) + (lib.mkIf (config.hosts.exclude != null) ( + lib.mkBefore [ + "--hostlist-exclude=${pkgs.writeText "zapret2-hosts-exclude.txt" (lib.concatLines config.hosts.exclude)}" + ] + )) + (lib.mkIf config.hosts.autodetect.enable ( + lib.mkAfter [ + "--hostlist-auto=${config.hosts.autodetect.file}" + ] + )) + ]; + }; + + arguments = + let + fileOptions = + let + isAbsolute = x: builtins.isPath x || lib.hasPrefix "/" x; + toFile = x: if isAbsolute x then x else "${cfg.package}/share/zapret2/lua/${x}.lua"; + in + map (x: "--lua-init=@${toFile x}") cfg.files; + profileOptions = + let + sorted = builtins.sort (a: b: a.priority < b.priority) (builtins.attrValues cfg.profiles); + toArgs = profile: [ "--name=${profile.name}" ] ++ profile.parameters; + in + builtins.foldl' (acc: p: acc ++ lib.optional (acc != [ ]) "--new" ++ toArgs p) [ ] sorted; + in + [ + (lib.getExe cfg.package) + "--qnum=${toString cfg.firewall.queue}" + "--fwmark=${cfg.firewall.desyncFwmark}" + ] + ++ fileOptions + ++ profileOptions + ++ cfg.extraOptions; +in + +{ + options.services.zapret2 = { + enable = lib.mkEnableOption "zapret2, an extensible DPI bypass program"; + package = lib.mkPackageOption pkgs "zapret2" { }; + + profiles = lib.mkOption { + type = lib.types.attrsOf (lib.types.submodule profileSubmodule); + default = { }; + example = { + https.parameters = [ + "--filter-tcp=443" + "--payload=tls_client_hello" + "--lua-desync=fake:blob=fake_default_tls:tcp_ts=-1000:repeats=1" + "--lua-desync=fakedsplit:pos=1,midsld:tcp_ts=-1000" + ]; + }; + description = '' + Defines DPI bypass profiles for Zapret2. + + Note that each profile should have a unique {option}`--filter-*` + option. By default, a profile matches all traffic, and when a profile + matches some traffic, no other profile is evaluated. Since profiles are + matched in order they are passed on the command line, the ordering of + profiles is important, and if a "fallback"/catch-all profile is + defined, it should be defined with a high priority to make sure it is + last in the list of profiles. + + Each profile will be prepended with the {option}`--name` option to set + the name, and then joined together with {option}`--new` between + profiles to form the final command-line parameters that will be passed + to Zapret2. Therefore, neither {option}`--name` nor {option}`--new` + should be used in the values. + ''; + }; + + extraOptions = lib.mkOption { + type = lib.types.listOf lib.types.str; + default = [ ]; + example = [ "--debug" ]; + description = '' + Extra command line parameters to pass to Zapret2. + + Profiles and desync strategies should not be set here, instead the + {option}`services.zapret2.profiles` option should be used instead, + which allows profiles to be defined and merged correctly across + multiple NixOS modules. + + The {option}`--lua-init` parameters should not be included here, the + files to load should instead be set via the + {option}`services.zapret2.files` option. + + Likewise, the {option}`--qnum` and {option}`--fwmark` parameters should + also not be included, instead the queue number and firewall desync mark + can be set using the {option}`services.zapret2.firewall.queue` and + {option}`services.zapret2.firewall.desyncFwmark` options respectively. + ''; + }; + + files = lib.mkOption { + type = lib.types.listOf (lib.types.either lib.types.nonEmptyStr lib.types.path); + default = [ + "zapret-lib" + "zapret-antidpi" + ]; + example = [ + "zapret-lib" + "zapret-obfs" + "/path/to/custom.lua" + ]; + description = '' + List of Lua files that will be loaded and executed once on startup. + Each entry in the list can be either an absolute path (including the + .lua extension) or the name of a standard library file bundled with + zapret2 (without the .lua extension). In case of the latter, they + will be automatically resolved to the files in the configured zapret2 + package. + ''; + }; + + firewall = { + configureAutomatically = lib.mkOption { + type = lib.types.bool; + default = true; + example = false; + description = '' + Whether to automatically configure the firewall rules to apply the + DPI bypass to all outgoing non-local connections (using nftables). + + If disabled, the only options that will be used are + {option}`firewall.queue` and {option}`firewall.desyncFwmark`, for the + {option}`--qnum` and {option}`--fwmark` parameters respectively. + ''; + }; + + maxPackets = lib.mkOption { + type = lib.types.nullOr (lib.types.ints.between 2 65535); + default = 16; + example = 20; + description = '' + The number of packets in each connection to route via Zapret2. For + example, a value of 16 will only subject the first 16 packets in each + connection to anti-DPI measures. It's recommended to keep this value + low in order to avoid routing unnecessary traffic through userspace + if possible. However, if necessary, all traffic can be routed by + setting this option to null. + ''; + }; + + interfaces = lib.mkOption { + type = lib.types.nullOr (lib.types.nonEmptyListOf lib.types.nonEmptyStr); + default = null; + example = [ "eth0" ]; + description = '' + A filter for which interfaces to apply the DPI bypass to. Setting + this option to null (the default) means the DPI bypass applies to + all interfaces. + ''; + }; + + tcpPorts = lib.mkOption { + type = lib.types.nullOr (lib.types.listOf lib.types.port); + default = null; + example = [ + 80 + 443 + ]; + description = '' + A list of destination TCP ports that are routed to Zapret2 at the + firewall level. Setting this option to null (the default) means all + TCP connections are routed to Zapret2. Setting this option to an + empty list disables routing to Zapret2 for any TCP connection. + ''; + }; + + udpPorts = lib.mkOption { + type = lib.types.nullOr (lib.types.listOf lib.types.port); + default = null; + example = [ 443 ]; + description = '' + A list of destination UDP ports that are routed to Zapret2 at the + firewall level. Setting this option to null (the default) means all + UDP connections are routed to Zapret2. Setting this option to an + empty list disables routing to Zapret2 for any UDP connection. + ''; + }; + + queue = lib.mkOption { + type = lib.types.ints.between 0 65535; + default = 200; + example = 400; + description = '' + The nfqueue queue number to use. This number must be unique between + all other programs using nfqueue. + ''; + }; + + desyncFwmark = lib.mkOption { + type = lib.types.strMatching "0x(1|2|4|8)(0){0,7}"; + default = "0x40000000"; + example = "0x10000000"; + description = '' + The desync mark bitmask to use. This bitmask must contain only a + single bit, and must be unique among all other nftables rules. + ''; + }; + }; + }; + + config = lib.mkIf cfg.enable { + assertions = [ + { + assertion = cfg.firewall.configureAutomatically -> config.networking.nftables.enable; + message = "When Zapret2 is set to configure the firewall automatically (services.zapret2.firewall.configureAutomatically), nftables must be enabled (networking.nftables.enable must be true)."; + } + ]; + + # For the systemd nfqws@.service template unit + systemd.packages = [ cfg.package ]; + + systemd.services."nfqws2@default" = { + overrideStrategy = "asDropin"; + wantedBy = [ "multi-user.target" ]; + serviceConfig = lib.mkMerge [ + { + ExecStart = [ + "" + (utils.escapeSystemdExecArgs arguments) + ]; + CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW"; + AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_RAW"; + NoNewPrivileges = true; + ProtectSystem = "full"; + DynamicUser = true; + SystemCallFilter = "@system-service"; + SystemCallArchitectures = "native"; + } + (lib.mkIf (builtins.any (p: p.hosts.autodetect.enable) (builtins.attrValues cfg.profiles)) { + StateDirectory = "zapret2"; + }) + ]; + }; + + networking.nftables = lib.mkIf cfg.firewall.configureAutomatically { + enable = lib.mkDefault true; + tables.zapret2 = { + family = "inet"; + content = '' + define DESYNC_MARK = ${cfg.firewall.desyncFwmark} + define QNUM = ${toString cfg.firewall.queue} + ${lib.optionalString (cfg.firewall.interfaces != null) '' + define WAN = { ${lib.concatMapStringsSep ", " (x: ''"${x}"'') cfg.firewall.interfaces} } + ''} + ${lib.optionalString (cfg.firewall.maxPackets != null) '' + define PKT = 1-${toString cfg.firewall.maxPackets} + ''} + ${lib.optionalString (cfg.firewall.tcpPorts != null && cfg.firewall.tcpPorts != [ ]) '' + define TCP_PORT = { ${lib.concatMapStringsSep ", " toString cfg.firewall.tcpPorts} } + ''} + ${lib.optionalString (cfg.firewall.udpPorts != null && cfg.firewall.udpPorts != [ ]) '' + define UDP_PORT = { ${lib.concatMapStringsSep ", " toString cfg.firewall.udpPorts} } + ''} + + set local4 { + type ipv4_addr + flags interval + elements = { + 127.0.0.0/8, + 10.0.0.0/8, + 100.64.0.0/10, + 172.16.0.0/12, + 192.168.0.0/16, + 169.254.0.0/16 + } + } + + set local6 { + type ipv6_addr + flags interval + elements = { + ::1/128, + fe80::/10, + fc00::/7, + ff00::/8 + } + } + + chain post { + type filter hook postrouting priority 101; policy accept; + + ${lib.concatStringsSep " " [ + (lib.optionalString (cfg.firewall.interfaces != null) "oifname $WAN") + "ip daddr @local4 accept" + ]} + ${lib.concatStringsSep " " [ + (lib.optionalString (cfg.firewall.interfaces != null) "oifname $WAN") + "ip6 daddr @local6 accept" + ]} + + ${lib.optionalString (cfg.firewall.tcpPorts != [ ]) '' + ${lib.concatStringsSep " " [ + (lib.optionalString (cfg.firewall.interfaces != null) "oifname $WAN") + "meta mark & $DESYNC_MARK == 0" + "meta l4proto tcp" + (lib.optionalString (cfg.firewall.tcpPorts != null) "tcp dport $TCP_PORT") + (lib.optionalString (cfg.firewall.maxPackets == null) "ct direction original") + (lib.optionalString (cfg.firewall.maxPackets != null) "ct original packets $PKT") + "queue num $QNUM bypass" + ]} + ''} + + ${lib.optionalString (cfg.firewall.udpPorts != [ ]) '' + ${lib.concatStringsSep " " [ + (lib.optionalString (cfg.firewall.interfaces != null) "oifname $WAN") + "meta mark & $DESYNC_MARK == 0" + "meta l4proto udp" + (lib.optionalString (cfg.firewall.udpPorts != null) "udp dport $UDP_PORT") + (lib.optionalString (cfg.firewall.maxPackets == null) "ct direction original") + (lib.optionalString (cfg.firewall.maxPackets != null) "ct original packets $PKT") + "queue num $QNUM bypass" + ]} + ''} + } + + chain pre { + type filter hook prerouting priority -101; policy accept; + + ${lib.concatStringsSep " " [ + (lib.optionalString (cfg.firewall.interfaces != null) "iifname $WAN") + "ip saddr @local4 accept" + ]} + ${lib.concatStringsSep " " [ + (lib.optionalString (cfg.firewall.interfaces != null) "iifname $WAN") + "ip6 saddr @local6 accept" + ]} + + ${lib.optionalString (cfg.firewall.tcpPorts != [ ]) '' + ${lib.concatStringsSep " " [ + (lib.optionalString (cfg.firewall.interfaces != null) "iifname $WAN") + "meta mark & $DESYNC_MARK == 0" + "meta l4proto tcp" + (lib.optionalString (cfg.firewall.tcpPorts != null) "tcp sport $TCP_PORT") + (lib.optionalString (cfg.firewall.maxPackets == null) "ct direction reply") + (lib.optionalString (cfg.firewall.maxPackets != null) "ct reply packets $PKT") + "queue num $QNUM bypass" + ]} + ''} + + ${lib.optionalString (cfg.firewall.udpPorts != [ ]) '' + ${lib.concatStringsSep " " [ + (lib.optionalString (cfg.firewall.interfaces != null) "iifname $WAN") + "meta mark & $DESYNC_MARK == 0" + "meta l4proto udp" + (lib.optionalString (cfg.firewall.udpPorts != null) "udp sport $UDP_PORT") + (lib.optionalString (cfg.firewall.maxPackets == null) "ct direction reply") + (lib.optionalString (cfg.firewall.maxPackets != null) "ct reply packets $PKT") + "queue num $QNUM bypass" + ]} + ''} + } + + chain predefrag { + type filter hook output priority -401; policy accept; + meta mark & $DESYNC_MARK != 0 notrack + } + ''; + }; + }; + + boot.kernel.sysctl = { + # From the zapret2 quickstart example commands, the RST packets that DPI + # systems inject can sometimes be dropped as invalid before they reach + # nfqueue. So relax the conntrack rules so that they aren't dropped. + "net.netfilter.nf_conntrack_tcp_be_liberal" = lib.mkDefault true; + }; + }; + + meta = { + maintainers = with lib.maintainers; [ andre4ik3 ]; + doc = ./zapret2.md; + }; +} diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index f9a730ac833c..8a8b7850867b 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -1924,6 +1924,7 @@ in yggdrasil = runTest ./yggdrasil.nix; your_spotify = runTest ./your_spotify.nix; zammad = runTest ./zammad.nix; + zapret2 = runTest ./zapret2.nix; zenohd = runTest ./zenohd.nix; zeronet-conservancy = runTest ./zeronet-conservancy.nix; zfs = import ./zfs.nix { inherit system pkgs runTest; }; diff --git a/nixos/tests/zapret2.nix b/nixos/tests/zapret2.nix new file mode 100644 index 000000000000..06fd8340a93f --- /dev/null +++ b/nixos/tests/zapret2.nix @@ -0,0 +1,153 @@ +{ pkgs, lib, ... }: + +let + serverIP = "203.0.113.1"; + clientIP = "203.0.113.2"; + + mkInterface = address: { + ipv4.addresses = lib.singleton { + inherit address; + prefixLength = 24; + }; + }; + + # naive DPI to block any TCP stream with "acme.test" + suricataRules = pkgs.writeText "suricata.rules" '' + drop tcp-pkt any any -> any any (msg:"Block acme.test"; flow:established,to_server; content:"acme.test"; nocase; sid:1000001; rev:1;) + ''; +in + +{ + name = "zapret2"; + meta.maintainers = with lib.maintainers; [ andre4ik3 ]; + + nodes = { + router = { + virtualisation.vlans = [ + 1 + 2 + ]; + networking = { + useDHCP = false; + interfaces = { + eth1.ipv4.addresses = lib.mkForce [ ]; + eth2.ipv4.addresses = lib.mkForce [ ]; + }; + }; + + # disable suricata-update because this requires an Internet connection + systemd.services.suricata-update.enable = false; + + services.suricata = { + enable = true; + settings = { + outputs = lib.singleton { + fast.enabled = true; + }; + + af-packet = [ + { + interface = "eth1"; + threads = 1; + defrag = false; + cluster-type = "cluster_flow"; + cluster-id = 98; + copy-mode = "ips"; + copy-iface = "eth2"; + buffer-size = 64535; + } + { + interface = "eth2"; + threads = 1; + cluster-id = 97; + defrag = false; + cluster-type = "cluster_flow"; + copy-mode = "ips"; + copy-iface = "eth1"; + buffer-size = 64535; + } + ]; + + classification-file = "${pkgs.suricata}/etc/suricata/classification.config"; + }; + }; + + systemd.tmpfiles.rules = [ + "C /var/lib/suricata/rules/suricata.rules - - - - ${suricataRules}" + "z /var/lib/suricata/rules/suricata.rules 644 suricata suricata -" + ]; + }; + + server = { + virtualisation.vlans = [ 1 ]; + networking = { + useDHCP = false; + interfaces.eth1 = mkInterface serverIP; + firewall.allowedTCPPorts = [ 443 ]; + }; + + security.pki.certificates = lib.singleton (builtins.readFile ./common/acme/server/ca.cert.pem); + + services.nginx = { + enable = true; + virtualHosts."acme.test" = { + onlySSL = true; + reuseport = true; + sslCertificate = ./common/acme/server/acme.test.cert.pem; + sslCertificateKey = ./common/acme/server/acme.test.key.pem; + root = lib.mkForce ( + pkgs.runCommandLocal "testdir" { } '' + mkdir "$out" + cat > "$out/index.html" <Hello World! + EOF + '' + ); + }; + }; + }; + + client = { + virtualisation.vlans = [ 2 ]; + networking = { + useDHCP = false; + interfaces.eth1 = mkInterface clientIP; + }; + + security.pki.certificates = lib.singleton (builtins.readFile ./common/acme/server/ca.cert.pem); + + services.zapret2 = { + enable = true; + firewall.interfaces = [ "eth1" ]; + profiles.default.parameters = [ + "--filter-tcp=443" + "--payload=tls_client_hello" + "--lua-desync=multisplit:pos=host+1,midsld,endhost-1" + ]; + }; + + networking.extraHosts = '' + ${serverIP} acme.test + ''; + }; + }; + + testScript = '' + start_all() + + for machine in [client, router, server]: + machine.wait_for_unit("multi-user.target") + + server.wait_for_unit("nginx.service") + router.wait_for_unit("suricata.service") + + # with nfqws2 running, the request should succeed + client.wait_for_unit("nfqws2@default.service") + client.sleep(5) + client.succeed("curl -s --max-time 5 https://acme.test | grep -F 'Hello World!'") + + # with nfqws2 stopped, the DPI should block it + client.stop_job("nfqws2@default.service") + client.fail("curl -s --max-time 5 https://acme.test") + ''; +} diff --git a/pkgs/by-name/za/zapret2/package.nix b/pkgs/by-name/za/zapret2/package.nix index 35334aa7b656..ef985f84db1e 100644 --- a/pkgs/by-name/za/zapret2/package.nix +++ b/pkgs/by-name/za/zapret2/package.nix @@ -16,6 +16,7 @@ libnetfilter_queue, systemdLibs, zlib, + nixosTests, }: stdenv.mkDerivation (finalAttrs: { @@ -131,6 +132,8 @@ stdenv.mkDerivation (finalAttrs: { runHook postInstall ''; + passthru.tests = { inherit (nixosTests) zapret2; }; + meta = { description = "Anti-DPI software for bypassing DPI systems"; homepage = "https://github.com/bol-van/zapret2"; From 923216034b81bd53842af1c5d1a4d60acb6a6745 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Sun, 9 Aug 2026 09:38:05 +0200 Subject: [PATCH 098/121] python3Packages.iamdata: 0.1.202608081 -> 0.1.202608091 Diff: https://github.com/cloud-copilot/iam-data-python/compare/v0.1.202608081...v0.1.202608091 Changelog: https://github.com/cloud-copilot/iam-data-python/releases/tag/v0.1.202608091 --- pkgs/development/python-modules/iamdata/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix index bbc03b6f6c0e..03fbec7f67ca 100644 --- a/pkgs/development/python-modules/iamdata/default.nix +++ b/pkgs/development/python-modules/iamdata/default.nix @@ -8,14 +8,14 @@ buildPythonPackage (finalAttrs: { pname = "iamdata"; - version = "0.1.202608081"; + version = "0.1.202608091"; pyproject = true; src = fetchFromGitHub { owner = "cloud-copilot"; repo = "iam-data-python"; tag = "v${finalAttrs.version}"; - hash = "sha256-mrWojeKUsPTgpYwAzsKmZcJR0WjZg/IFz1GkR4uzDY0="; + hash = "sha256-1waDF/1JJDVhmNDpLJxuNVDiw+5PIdtud/M/Qo7hBBQ="; }; __darwinAllowLocalNetworking = true; From bf99861276e81fef588d3707f8382c80294d23d0 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Mon, 10 Aug 2026 08:03:35 +0200 Subject: [PATCH 099/121] python3Packages.iamdata: 0.1.202608091 -> 0.1.202608101 Diff: https://github.com/cloud-copilot/iam-data-python/compare/v0.1.202608091...v0.1.202608101 Changelog: https://github.com/cloud-copilot/iam-data-python/releases/tag/v0.1.202608101 --- pkgs/development/python-modules/iamdata/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix index 03fbec7f67ca..f62b82ab1292 100644 --- a/pkgs/development/python-modules/iamdata/default.nix +++ b/pkgs/development/python-modules/iamdata/default.nix @@ -8,14 +8,14 @@ buildPythonPackage (finalAttrs: { pname = "iamdata"; - version = "0.1.202608091"; + version = "0.1.202608101"; pyproject = true; src = fetchFromGitHub { owner = "cloud-copilot"; repo = "iam-data-python"; tag = "v${finalAttrs.version}"; - hash = "sha256-1waDF/1JJDVhmNDpLJxuNVDiw+5PIdtud/M/Qo7hBBQ="; + hash = "sha256-vTKY+x9g5NscQFxqlMX3/aI9ZU9cneoA8zSGU0/V4Yk="; }; __darwinAllowLocalNetworking = true; From 34984cfa97b860469ac415cef6e00839f63279c5 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Mon, 10 Aug 2026 09:13:45 +0200 Subject: [PATCH 100/121] python3Packages.intellifire4py: 4.5.0 -> 4.5.1 Diff: https://github.com/jeeftor/intellifire4py/compare/v4.5.0...v4.5.1 Changelog: https://github.com/jeeftor/intellifire4py/releases/tag/v4.5.1 --- pkgs/development/python-modules/intellifire4py/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/intellifire4py/default.nix b/pkgs/development/python-modules/intellifire4py/default.nix index 31ee7fa6fcdf..4564ffc9b016 100644 --- a/pkgs/development/python-modules/intellifire4py/default.nix +++ b/pkgs/development/python-modules/intellifire4py/default.nix @@ -15,14 +15,14 @@ buildPythonPackage (finalAttrs: { pname = "intellifire4py"; - version = "4.5.0"; + version = "4.5.1"; pyproject = true; src = fetchFromGitHub { owner = "jeeftor"; repo = "intellifire4py"; tag = "v${finalAttrs.version}"; - hash = "sha256-MBuKYBKV0376j048tfbqMD9p2Gh1wlC188SGOMSMSm8="; + hash = "sha256-2L4T3GdjvhMk0GlRVZsh/aBP0DUosBDrP79eSX2Sc8g="; }; build-system = [ hatchling ]; From 2a29d282d5ae968afa9697109c82f6880ac4ee3d Mon Sep 17 00:00:00 2001 From: jopejoe1 Date: Sun, 9 Aug 2026 09:26:06 +0000 Subject: [PATCH 101/121] xeve: 0.5.1 -> 0.7.0 --- ...txt-Disable-static-linking-on-Darwin.patch | 27 ---------- .../0002-sse2neon-Cast-to-variable-type.patch | 27 ---------- pkgs/by-name/xe/xeve/package.nix | 50 +------------------ 3 files changed, 2 insertions(+), 102 deletions(-) delete mode 100644 pkgs/by-name/xe/xeve/0001-CMakeLists.txt-Disable-static-linking-on-Darwin.patch delete mode 100644 pkgs/by-name/xe/xeve/0002-sse2neon-Cast-to-variable-type.patch diff --git a/pkgs/by-name/xe/xeve/0001-CMakeLists.txt-Disable-static-linking-on-Darwin.patch b/pkgs/by-name/xe/xeve/0001-CMakeLists.txt-Disable-static-linking-on-Darwin.patch deleted file mode 100644 index 7f4c49562bdc..000000000000 --- a/pkgs/by-name/xe/xeve/0001-CMakeLists.txt-Disable-static-linking-on-Darwin.patch +++ /dev/null @@ -1,27 +0,0 @@ -From f3927c3cb05ffc77f62026bafd7cea1d25de1e72 Mon Sep 17 00:00:00 2001 -From: toonn -Date: Tue, 2 Jul 2024 19:23:11 +0200 -Subject: [PATCH 1/2] CMakeLists.txt: Disable static linking on Darwin - ---- - CMakeLists.txt | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/CMakeLists.txt b/CMakeLists.txt -index e0873d5..1d639c4 100644 ---- a/CMakeLists.txt -+++ b/CMakeLists.txt -@@ -64,7 +64,9 @@ if(NOT ARM) - else() - add_definitions(-DARM=1) - set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -flax-vector-conversions") -- set(CMAKE_EXE_LINKER_FLAGS "-static") -+ if(NOT "${CMAKE_SYSTEM_NAME}" STREQUAL "Darwin") -+ set(CMAKE_EXE_LINKER_FLAGS "-static") -+ endif() - endif() - message("ARM=${ARM}") - --- -2.44.1 - diff --git a/pkgs/by-name/xe/xeve/0002-sse2neon-Cast-to-variable-type.patch b/pkgs/by-name/xe/xeve/0002-sse2neon-Cast-to-variable-type.patch deleted file mode 100644 index b9a9995c8e2e..000000000000 --- a/pkgs/by-name/xe/xeve/0002-sse2neon-Cast-to-variable-type.patch +++ /dev/null @@ -1,27 +0,0 @@ -From d1a480867c0778ee46ff0213e2b1e494afcb67fc Mon Sep 17 00:00:00 2001 -From: toonn -Date: Mon, 1 Jul 2024 15:19:37 +0200 -Subject: [PATCH 2/2] sse2neon: Cast to variable type - -The `__m128d` type corresponds to `float32x4_t` or `float64x2_t` -depending on the platform. The cast cannot explicitly use either type. ---- - src_base/neon/sse2neon.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src_base/neon/sse2neon.h b/src_base/neon/sse2neon.h -index 490c0a4..3290fa3 100644 ---- a/src_base/neon/sse2neon.h -+++ b/src_base/neon/sse2neon.h -@@ -6003,7 +6003,7 @@ FORCE_INLINE void _mm_storeu_si32(void *p, __m128i a) - FORCE_INLINE void _mm_stream_pd(double *p, __m128d a) - { - #if __has_builtin(__builtin_nontemporal_store) -- __builtin_nontemporal_store(a, (float32x4_t *) p); -+ __builtin_nontemporal_store(a, (__m128d *) p); - #elif defined(__aarch64__) - vst1q_f64(p, vreinterpretq_f64_m128d(a)); - #else --- -2.44.1 - diff --git a/pkgs/by-name/xe/xeve/package.nix b/pkgs/by-name/xe/xeve/package.nix index 0b478314be39..71153bc92fb0 100644 --- a/pkgs/by-name/xe/xeve/package.nix +++ b/pkgs/by-name/xe/xeve/package.nix @@ -1,7 +1,6 @@ { lib, fetchFromGitHub, - fetchpatch2, gitUpdater, stdenv, cmake, @@ -9,43 +8,15 @@ stdenv.mkDerivation (finalAttrs: { pname = "xeve"; - version = "0.5.1"; + version = "0.7.0"; src = fetchFromGitHub { owner = "mpeg5"; repo = "xeve"; rev = "v${finalAttrs.version}"; - hash = "sha256-/DcYv2fInr8MN1wpOgJHcFWEvW//7SIXccheRfeaTHM="; + hash = "sha256-QA9+0PsPyg3gQYR2TpIO1nwL5H/BFpOtCX8xBQ4Qjmg="; }; - patches = - map fetchpatch2 [ - { - url = "https://github.com/mpeg5/xeve/commit/954ed6e0494cd2438fd15c717c0146e88e582b33.patch?full_index=1"; - hash = "sha256-//NtOUm1fqPFvOM955N6gF+QgmOdmuVunwx/3s/G/J8="; - } - { - url = "https://github.com/mpeg5/xeve/commit/07a6f2a6d13dfaa0f73c3752f8cd802c251d8252.patch?full_index=1"; - hash = "sha256-P9J7Y9O/lb/MSa5oCfft7z764AbLBLZnMmrmPEZPcws="; - } - { - url = "https://github.com/mpeg5/xeve/commit/0a0f3bd397161253b606bdbeaa518fbe019d24e1.patch?full_index=1"; - hash = "sha256-PoZpE64gWkTUS4Q+SK+DH1I1Ac0UEzwwnlvpYN16hsI="; - } - { - url = "https://github.com/mpeg5/xeve/commit/e029f1619ecedbda152b8680641fa10eea9eeace.patch?full_index=1"; - hash = "sha256-ooIBzNtGSjDgYvTzA8T0KB+QzsUiy14mPpoRqrHF3Pg="; - } - ] - ++ [ - # Backport to 0.5.0 of upstream patch c564ac77c103dbba472df3e13f4733691fd499ed - ./0001-CMakeLists.txt-Disable-static-linking-on-Darwin.patch - - # Rejected upstream, can be dropped when a fix for - # https://github.com/mpeg5/xeve/pull/123 is in a version bump. - ./0002-sse2neon-Cast-to-variable-type.patch - ]; - postPatch = '' echo v$version > version.txt ''; @@ -60,23 +31,6 @@ stdenv.mkDerivation (finalAttrs: { optional isAarch64 (cmakeBool "ARM" true) ++ optional isDarwin (cmakeFeature "CMAKE_SYSTEM_NAME" "Darwin"); - env.NIX_CFLAGS_COMPILE = toString ( - map (w: "-Wno-" + w) [ - # Patch addressing an if without a body was rejected upstream, third - # line-based comment in this thread, https://github.com/mpeg5/xeve/pull/122#pullrequestreview-2187744305 - # Evaluate on version bump whether still necessary. - "empty-body" - - # Evaluate on version bump whether still necessary. - "parentheses-equality" - "unknown-warning-option" - - # Fixed upstream in 325fd9f94f3fdf0231fa931a31ebb72e63dc3498 but might - # change behavior, therefore opted to leave it out for now. - "for-loop-analysis" - ] - ); - postInstall = '' ln $dev/include/xeve/* $dev/include/ ''; From e890a51e6ae318d1ff3d6d2465342c460e5b93c1 Mon Sep 17 00:00:00 2001 From: jopejoe1 Date: Sun, 9 Aug 2026 09:26:10 +0000 Subject: [PATCH 102/121] xevd: 0.5.0 -> 0.7.0 --- pkgs/by-name/xe/xevd/package.nix | 50 ++------------------------------ 1 file changed, 2 insertions(+), 48 deletions(-) diff --git a/pkgs/by-name/xe/xevd/package.nix b/pkgs/by-name/xe/xevd/package.nix index a98cfbecf0d9..feb0b45430ce 100644 --- a/pkgs/by-name/xe/xevd/package.nix +++ b/pkgs/by-name/xe/xevd/package.nix @@ -1,7 +1,6 @@ { lib, fetchFromGitHub, - fetchpatch2, stdenv, gitUpdater, testers, @@ -10,45 +9,15 @@ stdenv.mkDerivation (finalAttrs: { pname = "xevd"; - version = "0.5.0"; + version = "0.7.0"; src = fetchFromGitHub { owner = "mpeg5"; repo = "xevd"; rev = "v${finalAttrs.version}"; - hash = "sha256-Dc2V77t+DrZo9252FAL0eczrmikrseU02ob2RLBdVvU="; + hash = "sha256-MMqtgXEcIYLr5gyIpGj1p0aPiEW0zb6ZAQ+75kHhyxU="; }; - patches = lib.optionals (!lib.versionOlder "0.5.0" finalAttrs.version) ( - map fetchpatch2 [ - # Upstream accepted patches, should be dropped on next version bump. - { - url = "https://github.com/mpeg5/xevd/commit/7eda92a6ebb622189450f7b63cfd4dcd32fd6dff.patch?full_index=1"; - hash = "sha256-Ru7jGk1b+Id5x1zaiGb7YKZGTNaTcArZGYyHbJURfgs="; - } - { - url = "https://github.com/mpeg5/xevd/commit/499bc0153a99f8c8fd00143dd81fc0d858a5b509.patch?full_index=1"; - hash = "sha256-3ExBNTeBhj/IBweYkgWZ2ZgUypFua4oSC24XXFmjxXA="; - } - { - url = "https://github.com/mpeg5/xevd/commit/b099623a09c09cddfe7f732fb795b2af8a020620.patch?full_index=1"; - hash = "sha256-Ee/PQmsGpUCU7KUMbdGEXEEKOc8BHYcGF4mq+mmWb/w="; - } - { - url = "https://github.com/mpeg5/xevd/commit/2e6b24bf1f946c30d789b114dfd56e91b99039fe.patch?full_index=1"; - hash = "sha256-thT0kVSKwWruyhIjDFBulyUNeyG9zQ8rQtpZVmRvYxI="; - } - { - url = "https://github.com/mpeg5/xevd/commit/c1f23a41b8def84ab006a8ce4e9221b2fff84a1a.patch?full_index=1"; - hash = "sha256-MOJ9mU5txk6ISzJsQdK+TTb2dlWD8ofGZI0nfq9rsPo="; - } - { - url = "https://github.com/mpeg5/xevd/commit/adf1c45d6edb0d235997a40261689d7454b711c5.patch?full_index=1"; - hash = "sha256-tGIPaswx9S1Oy8QF928RzV/AHr710kYxXfMRYg6SLR4="; - } - ] - ); - postPatch = '' echo v$version > version.txt ''; @@ -63,21 +32,6 @@ stdenv.mkDerivation (finalAttrs: { optional isAarch64 (cmakeBool "ARM" true) ++ optional isDarwin (cmakeFeature "CMAKE_SYSTEM_NAME" "Darwin"); - env.NIX_CFLAGS_COMPILE = toString ( - map (w: "-Wno-" + w) ( - [ - # Evaluate on version bump whether still necessary. - "sometimes-uninitialized" - "unknown-warning-option" - ] - ++ ( - # Fixed upstream in 325fd9f94f3fdf0231fa931a31ebb72e63dc3498 but might - # change behavior, therefore opted to leave it out for now. - lib.optional (!lib.versionOlder "0.5.0" finalAttrs.version) "for-loop-analysis" - ) - ) - ); - postInstall = '' ln $dev/include/xevd/* $dev/include/ ''; From fe94b0a95053c0bbf339b174130b2ba84613faeb Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 10 Aug 2026 07:25:38 +0000 Subject: [PATCH 103/121] rmux: 0.9.1 -> 0.10.0 --- pkgs/by-name/rm/rmux/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/rm/rmux/package.nix b/pkgs/by-name/rm/rmux/package.nix index 3b76c1f4c518..f0dc94b0573d 100644 --- a/pkgs/by-name/rm/rmux/package.nix +++ b/pkgs/by-name/rm/rmux/package.nix @@ -8,18 +8,18 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "rmux"; - version = "0.9.1"; + version = "0.10.0"; src = fetchFromGitHub { owner = "Helvesec"; repo = "rmux"; tag = "v${finalAttrs.version}"; - hash = "sha256-dp0faMC2v8mArWE9EEeGggnm/vM3zXn7INXMcwaQZ5M="; + hash = "sha256-YHWCUP5NvzWCDLIYDLSV0a7VWc6B2sFZ0EwzRwAYX3g="; }; __structuredAttrs = true; - cargoHash = "sha256-YMA42V2Wk4GeCDQsWZkWbOL1a74AzB+radfCkUZCuZ8="; + cargoHash = "sha256-vgd9oduIFSCezuqWcGazcyqjluhFmNnm0jWJwPgYux0="; nativeBuildInputs = [ installShellFiles ]; From 747743e6e2b305d200e5c24370a1991c4f8e5567 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 10 Aug 2026 07:25:48 +0000 Subject: [PATCH 104/121] python3Packages.pylitterbot: 2025.6.2 -> 2025.6.4 --- pkgs/development/python-modules/pylitterbot/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/pylitterbot/default.nix b/pkgs/development/python-modules/pylitterbot/default.nix index 04e0190b4617..c139deeb00d8 100644 --- a/pkgs/development/python-modules/pylitterbot/default.nix +++ b/pkgs/development/python-modules/pylitterbot/default.nix @@ -20,14 +20,14 @@ buildPythonPackage (finalAttrs: { pname = "pylitterbot"; - version = "2025.6.2"; + version = "2025.6.4"; pyproject = true; src = fetchFromGitHub { owner = "natekspencer"; repo = "pylitterbot"; tag = finalAttrs.version; - hash = "sha256-8hPM5YWt6wI1duW929np5ZvAoUMCXa5QrUIKfYcp/wg="; + hash = "sha256-kAs1iRNyyr0lV4yJ13GVIZ7T3n44HMEwPSONPcBetrI="; }; build-system = [ From 4c1d0ea2269c5922509dc79a0b57c76f40e2d653 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 10 Aug 2026 07:43:01 +0000 Subject: [PATCH 105/121] ku: 0.10.0 -> 0.11.0 --- pkgs/by-name/ku/ku/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ku/ku/package.nix b/pkgs/by-name/ku/ku/package.nix index dc12360a5546..fa68a8b5c02e 100644 --- a/pkgs/by-name/ku/ku/package.nix +++ b/pkgs/by-name/ku/ku/package.nix @@ -8,14 +8,14 @@ buildGo126Module (finalAttrs: { pname = "ku"; - version = "0.10.0"; + version = "0.11.0"; __structuredAttrs = true; src = fetchFromGitHub { owner = "bjarneo"; repo = "ku"; tag = "v${finalAttrs.version}"; - hash = "sha256-MXtZdogaUhaMQcZdave5rz3afq+6T/tvQkZVzk0WCfg="; + hash = "sha256-UO390xbjUVhlDN8NzvRl2BXMQCYngfU5cXu+tNiVvoA="; }; vendorHash = "sha256-x7O2/uKnIIFDr8WK0ej3FJiIGxN5Fq5Czqrv4OJ5A44="; From 68e532a19161b6e394da263b25fd41f2520882aa Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Mon, 10 Aug 2026 09:45:10 +0200 Subject: [PATCH 106/121] python3Packages.newversion: modernize --- .../python-modules/newversion/default.nix | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/pkgs/development/python-modules/newversion/default.nix b/pkgs/development/python-modules/newversion/default.nix index 328161064375..cbd9405c846d 100644 --- a/pkgs/development/python-modules/newversion/default.nix +++ b/pkgs/development/python-modules/newversion/default.nix @@ -3,12 +3,13 @@ buildPythonPackage, fetchFromGitHub, packaging, + pyprojectVersionPatchHook, pytestCheckHook, setuptools, typing-extensions, }: -buildPythonPackage rec { +buildPythonPackage (finalAttrs: { pname = "newversion"; version = "3.1.0"; pyproject = true; @@ -16,13 +17,15 @@ buildPythonPackage rec { src = fetchFromGitHub { owner = "vemel"; repo = "newversion"; - tag = version; + tag = finalAttrs.version; hash = "sha256-R26yZQnQN/+e8XD3YKl+3bJKGnZaVzOVoTlGHOyratg="; }; - nativeBuildInputs = [ setuptools ]; + build-system = [ setuptools ]; - propagatedBuildInputs = [ + nativeBuildInputs = [ pyprojectVersionPatchHook ]; + + dependencies = [ packaging typing-extensions ]; @@ -34,9 +37,9 @@ buildPythonPackage rec { meta = { description = "PEP 440 version manager"; homepage = "https://github.com/vemel/newversion"; - changelog = "https://github.com/vemel/newversion/releases/tag/${version}"; + changelog = "https://github.com/vemel/newversion/releases/tag/${finalAttrs.src.tag}"; license = lib.licenses.mit; maintainers = with lib.maintainers; [ fab ]; mainProgram = "newversion"; }; -} +}) From 32751beeeb8cd89f881843a9880e53b914aa1f5e Mon Sep 17 00:00:00 2001 From: Johannes Kirschbauer Date: Sun, 12 Jul 2026 20:52:43 +0200 Subject: [PATCH 107/121] doc/readme: tidy up meta commentary meta-commentary is discouraged as per doc/styleguide.md --- doc/README.md | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/doc/README.md b/doc/README.md index 49ab93677d73..14de0dd2651b 100644 --- a/doc/README.md +++ b/doc/README.md @@ -14,17 +14,12 @@ Use **examples** first to show how to get something done. Keep **Explanation** l Use our [styleguide](./styleguide.md) for more in depth guidance on writing good documentation. -This directory contains **guides** and **reference** documentation for Nixpkgs. +Documentation about Nixpkgs belongs here, this includes 'getting-started'-guides and 'onboarding-guides' for *using* Nixpkgs and the language frameworks it ships. -Borrowing from [Diátaxis framework](https://diataxis.fr/) what suits our needs: +Write **guides** task-first: lead with a working example, then explain in prose. +Write **reference** as the specification of functions and attributes. -**Guides** are task-oriented. They can be tutorial-style walkthroughs or how-to sections. -Explanations appear as prose after examples. - -**Reference** documentation is the specification of functions and attributes. - -We are actively working to generate **all** reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code. -This also provides the benefit of using `:doc` in the `nix repl` to view reference documentation locally on the fly. +We are actively working to generate reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code, which also lets you view it locally with `:doc` in `nix repl`. See [Document structure](#document-structure) for a structural template. From 6a227e78593519c45f78a098128520db3f742f6c Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 10 Aug 2026 08:24:55 +0000 Subject: [PATCH 108/121] upower: 1.91.2 -> 1.91.3 --- pkgs/by-name/up/upower/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/up/upower/package.nix b/pkgs/by-name/up/upower/package.nix index df714dfef4c3..a317da29cb3c 100644 --- a/pkgs/by-name/up/upower/package.nix +++ b/pkgs/by-name/up/upower/package.nix @@ -38,7 +38,7 @@ assert withDocs -> withIntrospection; stdenv.mkDerivation (finalAttrs: { pname = "upower"; - version = "1.91.2"; + version = "1.91.3"; outputs = [ "out" @@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: { owner = "upower"; repo = "upower"; rev = "v${finalAttrs.version}"; - hash = "sha256-lr7Va7jmC7Hy+kY8YIbAEE5mK3TxU9LtgTKxEyM1QY8="; + hash = "sha256-QdAJxaua43iGovQeRg+n1MypS5CS0Ro3gqF9Tv8eMBg="; }; patches = From 24432311d26c009fabf86cac9f7a917bf8f147c1 Mon Sep 17 00:00:00 2001 From: jopejoe1 Date: Mon, 10 Aug 2026 10:09:04 +0200 Subject: [PATCH 109/121] hayabusa-sec: fix eval of update script --- pkgs/by-name/ha/hayabusa-sec/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/ha/hayabusa-sec/package.nix b/pkgs/by-name/ha/hayabusa-sec/package.nix index 91a867cd6b87..9539953964ab 100644 --- a/pkgs/by-name/ha/hayabusa-sec/package.nix +++ b/pkgs/by-name/ha/hayabusa-sec/package.nix @@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: { makeWrapper $out/share/hayabusa-sec/hayabusa $out/bin/hayabusa ''; - passthru.updateScript = nix-update-script { rev-prefix = "v"; }; + passthru.updateScript = nix-update-script { }; meta = { description = "Sigma-based threat hunting and fast forensics timeline generator for Windows event logs"; From 5e4b381048d9244632c6ec527d64138a66b436da Mon Sep 17 00:00:00 2001 From: liberodark Date: Mon, 10 Aug 2026 10:33:47 +0200 Subject: [PATCH 110/121] zulu: fix eval on unsupported systems --- pkgs/development/compilers/zulu/common.nix | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/pkgs/development/compilers/zulu/common.nix b/pkgs/development/compilers/zulu/common.nix index 46724ffea83c..0038ab2e7bf4 100644 --- a/pkgs/development/compilers/zulu/common.nix +++ b/pkgs/development/compilers/zulu/common.nix @@ -32,16 +32,14 @@ ffmpeg, }: let - dist = - dists.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}"); + dist = dists.${stdenv.hostPlatform.system} or (builtins.head (builtins.attrValues dists)); arch = { "aarch64" = "aarch64"; "x86_64" = "x64"; } - .${stdenv.hostPlatform.parsed.cpu.name} - or (throw "Unsupported architecture: ${stdenv.hostPlatform.parsed.cpu.name}"); + .${stdenv.hostPlatform.parsed.cpu.name} or "unsupported"; platform = { From af726863b0810b839327831fc86bce6566bb75ec Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Fri, 7 Aug 2026 09:13:51 +0200 Subject: [PATCH 111/121] python3Packages.tencentcloud-sdk-python: 3.1.151 -> 3.1.152 Diff: https://github.com/TencentCloud/tencentcloud-sdk-python/compare/3.1.151...3.1.152 Changelog: https://github.com/TencentCloud/tencentcloud-sdk-python/blob/3.1.152/CHANGELOG.md --- .../python-modules/tencentcloud-sdk-python/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix index cd4876f5a640..f684c8524913 100644 --- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix +++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix @@ -9,14 +9,14 @@ buildPythonPackage (finalAttrs: { pname = "tencentcloud-sdk-python"; - version = "3.1.151"; + version = "3.1.152"; pyproject = true; src = fetchFromGitHub { owner = "TencentCloud"; repo = "tencentcloud-sdk-python"; tag = finalAttrs.version; - hash = "sha256-EPwHnj7iVrHjXnORxufQ78CGaXVlobzzJ+NU73+Vrks="; + hash = "sha256-QxkKyNYY0/1tEaGqfFPWikly5ZpX+Mz9ysA9IdTZlnw="; }; build-system = [ setuptools ]; From b86b6d9a3c2d591369d681730172b8e80641900e Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Mon, 10 Aug 2026 10:44:50 +0200 Subject: [PATCH 112/121] python3Packages.tencentcloud-sdk-python: 3.1.152 -> 3.1.153 Diff: https://github.com/TencentCloud/tencentcloud-sdk-python/compare/3.1.152...3.1.153 Changelog: https://github.com/TencentCloud/tencentcloud-sdk-python/blob/3.1.153/CHANGELOG.md --- .../python-modules/tencentcloud-sdk-python/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix index f684c8524913..c85a57e21a2c 100644 --- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix +++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix @@ -9,14 +9,14 @@ buildPythonPackage (finalAttrs: { pname = "tencentcloud-sdk-python"; - version = "3.1.152"; + version = "3.1.153"; pyproject = true; src = fetchFromGitHub { owner = "TencentCloud"; repo = "tencentcloud-sdk-python"; tag = finalAttrs.version; - hash = "sha256-QxkKyNYY0/1tEaGqfFPWikly5ZpX+Mz9ysA9IdTZlnw="; + hash = "sha256-HHmUS8nTkmBdaWcoWIsMGWPf+HjTJiW+sd7wqHK00Vk="; }; build-system = [ setuptools ]; From 15696e8919884381e6fb6b940fe9c1044631d305 Mon Sep 17 00:00:00 2001 From: jopejoe1 Date: Mon, 10 Aug 2026 10:59:05 +0200 Subject: [PATCH 113/121] elmPackages.elm-wrap: use pname instead of name --- pkgs/development/compilers/elm/packages/elm-wrap/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/compilers/elm/packages/elm-wrap/default.nix b/pkgs/development/compilers/elm/packages/elm-wrap/default.nix index c7138ed8913f..59d48fdbeec5 100644 --- a/pkgs/development/compilers/elm/packages/elm-wrap/default.nix +++ b/pkgs/development/compilers/elm/packages/elm-wrap/default.nix @@ -9,7 +9,7 @@ lib, }: stdenv.mkDerivation rec { - name = "elm-wrap"; + pname = "elm-wrap"; version = "1.0.1"; src = fetchFromGitHub { From 791a71d03ae8e64738d6dc7d27d7483746e5b47f Mon Sep 17 00:00:00 2001 From: jopejoe1 Date: Mon, 10 Aug 2026 11:09:35 +0200 Subject: [PATCH 114/121] python3Packages.runtype: use pname instead of name --- pkgs/development/python-modules/runtype/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/python-modules/runtype/default.nix b/pkgs/development/python-modules/runtype/default.nix index 51299dde3c44..981415ce59f9 100644 --- a/pkgs/development/python-modules/runtype/default.nix +++ b/pkgs/development/python-modules/runtype/default.nix @@ -5,7 +5,7 @@ poetry-core, }: buildPythonPackage (finalAttrs: { - name = "runtype"; + pname = "runtype"; version = "0.5.3"; __structuredAttrs = true; From 6eb3f91474b4676efc905bbe2deed4ca0d1bc3c1 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 10 Aug 2026 10:13:55 +0000 Subject: [PATCH 115/121] azure-cli-extensions.vm-repair: 2.2.1 -> 2.2.3 --- pkgs/by-name/az/azure-cli/extensions-manual.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/az/azure-cli/extensions-manual.nix b/pkgs/by-name/az/azure-cli/extensions-manual.nix index 92d95ced7137..fef683724d9f 100644 --- a/pkgs/by-name/az/azure-cli/extensions-manual.nix +++ b/pkgs/by-name/az/azure-cli/extensions-manual.nix @@ -345,9 +345,9 @@ vm-repair = mkAzExtension rec { pname = "vm-repair"; - version = "2.2.1"; + version = "2.2.3"; url = "https://azcliprod.blob.core.windows.net/cli-extensions/vm_repair-${version}-py2.py3-none-any.whl"; - hash = "sha256-k/6ATtYT2YXaHm5nbb0Tf7xE98Oz9svRlbjodCOOuo8="; + hash = "sha256-u5Pjksq2NiN4P4awFKiq2h/P2qGDgEQoMm/w10wAkX4="; description = "Support for repairing Azure Virtual Machines"; propagatedBuildInputs = with python3Packages; [ opencensus ]; meta.maintainers = [ ]; From e4494824d22f9e3e5ac30a1eeea328d63bd303b2 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 10 Aug 2026 10:19:29 +0000 Subject: [PATCH 116/121] retroarch-assets: 1.22.0-unstable-2026-06-27 -> 1.22.0-unstable-2026-08-08 --- pkgs/by-name/re/retroarch-assets/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/re/retroarch-assets/package.nix b/pkgs/by-name/re/retroarch-assets/package.nix index 5ea32385bb9e..03d7c8e00fc3 100644 --- a/pkgs/by-name/re/retroarch-assets/package.nix +++ b/pkgs/by-name/re/retroarch-assets/package.nix @@ -7,13 +7,13 @@ stdenvNoCC.mkDerivation { pname = "retroarch-assets"; - version = "1.22.0-unstable-2026-06-27"; + version = "1.22.0-unstable-2026-08-08"; src = fetchFromGitHub { owner = "libretro"; repo = "retroarch-assets"; - rev = "a12a7be0898de32ab3eefb891e6778ff5130e5fb"; - hash = "sha256-Mhp9+Mr/M79ZqIt9H6RrciOH+bE1cI5TLTjGzz4zKrw="; + rev = "6a1bbdeff5bca537a5712e2226a2aeeaee211fd0"; + hash = "sha256-BZyGCveK4h/T2toveGeeKwM6PnZurZLq9URzzf6mfmw="; }; makeFlags = [ From 08e379d97c285061efc6e240a1369373f1721689 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 10 Aug 2026 10:35:33 +0000 Subject: [PATCH 117/121] flying-carpet: 10.0.2 -> 10.0.3 --- pkgs/by-name/fl/flying-carpet/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/fl/flying-carpet/package.nix b/pkgs/by-name/fl/flying-carpet/package.nix index 2ceef4e10577..ac24ce63bc33 100644 --- a/pkgs/by-name/fl/flying-carpet/package.nix +++ b/pkgs/by-name/fl/flying-carpet/package.nix @@ -19,13 +19,13 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "flying-carpet"; - version = "10.0.2"; + version = "10.0.3"; src = fetchFromGitHub { owner = "spieglt"; repo = "FlyingCarpet"; tag = "v${finalAttrs.version}"; - hash = "sha256-38gPXTP+WAZ43oVhgYEFy0lD41uV4JxlNktiD+tJOu0="; + hash = "sha256-PmUi4nN2PDgHgYl3Wx2LiGwDaz7hjQT2ccCFRciJqIo="; }; cargoHash = "sha256-WZ93Gk2n8GJox7I4o/McC0AgrBh6CZAJFcXWvALk9TM="; From bae2e15e53bfcbcad4f76fccf99bbc86622d0300 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Mon, 10 Aug 2026 20:51:07 +1000 Subject: [PATCH 118/121] nix-eval-jobs: 2.35.0 -> 2.35.1 Diff: https://github.com/NixOS/nix-eval-jobs/compare/v2.35.0...v2.35.1 --- pkgs/tools/package-management/nix-eval-jobs/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/package-management/nix-eval-jobs/default.nix b/pkgs/tools/package-management/nix-eval-jobs/default.nix index 7b6b3d62b0a1..bf3e872fae79 100644 --- a/pkgs/tools/package-management/nix-eval-jobs/default.nix +++ b/pkgs/tools/package-management/nix-eval-jobs/default.nix @@ -12,13 +12,13 @@ }: stdenv.mkDerivation rec { pname = "nix-eval-jobs"; - version = "2.35.0"; + version = "2.35.1"; src = fetchFromGitHub { owner = "NixOS"; repo = "nix-eval-jobs"; tag = "v${version}"; - hash = "sha256-/C5wyGYe4uMKKH26vy3knpwP/hvjOHO/58cySL8ADC4="; + hash = "sha256-EFJnN35L7UieL8zV8qPrpqfdfzztWksY8JYuXF+mr9o="; }; buildInputs = [ From 3bcc2b1b2778b62c59e30edc29bc78dbdeb67aa2 Mon Sep 17 00:00:00 2001 From: whispers Date: Mon, 10 Aug 2026 07:28:43 -0400 Subject: [PATCH 119/121] Revert "alsa-plugins: pin ffmpeg_8" This reverts commit ecc6d7edeabbf88ec1c9b0e84470afdd14016be1. --- pkgs/by-name/al/alsa-plugins/package.nix | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/al/alsa-plugins/package.nix b/pkgs/by-name/al/alsa-plugins/package.nix index cbc9b2a08a37..e86e24ba25f7 100644 --- a/pkgs/by-name/al/alsa-plugins/package.nix +++ b/pkgs/by-name/al/alsa-plugins/package.nix @@ -4,8 +4,7 @@ lib, pkg-config, alsa-lib, - # FIXME: unpin when upstream supports ffmpeg 9 - ffmpeg_8, + ffmpeg, libjack2, libogg, libpulseaudio, @@ -26,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: { buildInputs = [ alsa-lib - ffmpeg_8 + ffmpeg libjack2 libogg libpulseaudio From 99e5aff3f0c20e7fbe6904a7014ea236e33642f1 Mon Sep 17 00:00:00 2001 From: whispers Date: Sat, 8 Aug 2026 20:31:01 -0400 Subject: [PATCH 120/121] alsa-plugins: fix build with ffmpeg 9 failing build logs: https://hydra.nixos.org/build/341407667 --- pkgs/by-name/al/alsa-plugins/package.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/pkgs/by-name/al/alsa-plugins/package.nix b/pkgs/by-name/al/alsa-plugins/package.nix index e86e24ba25f7..0cdecfd9b168 100644 --- a/pkgs/by-name/al/alsa-plugins/package.nix +++ b/pkgs/by-name/al/alsa-plugins/package.nix @@ -1,6 +1,7 @@ { stdenv, fetchurl, + fetchpatch, lib, pkg-config, alsa-lib, @@ -21,6 +22,14 @@ stdenv.mkDerivation (finalAttrs: { hash = "sha256-e9ioPTBOji2GoliV2Nyw7wJFqN8y4nGVnNvcavObZvI="; }; + patches = [ + (fetchpatch { + name = "ffmpeg-9-compatibility.patch"; + url = "https://gitlab.archlinux.org/archlinux/packaging/packages/alsa-plugins/-/raw/7f250af93b76e9b3d552af509beb8ea1356114d1/ffmpeg9.patch"; + hash = "sha256-heAl6Ym3iYI8mhuuQpwBpc0FeFYsQZRHx4UUvqiVtBo="; + }) + ]; + nativeBuildInputs = [ pkg-config ]; buildInputs = [ From 821d02ef62c43cbf5a7c0f9eb7d36bba469e42b1 Mon Sep 17 00:00:00 2001 From: yaaaarn Date: Mon, 10 Aug 2026 12:42:42 +0100 Subject: [PATCH 121/121] overused-grotesk: init at 0.5-alpha.2 --- pkgs/by-name/ov/overused-grotesk/package.nix | 33 ++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 pkgs/by-name/ov/overused-grotesk/package.nix diff --git a/pkgs/by-name/ov/overused-grotesk/package.nix b/pkgs/by-name/ov/overused-grotesk/package.nix new file mode 100644 index 000000000000..3df4974ead94 --- /dev/null +++ b/pkgs/by-name/ov/overused-grotesk/package.nix @@ -0,0 +1,33 @@ +{ + lib, + stdenvNoCC, + fetchzip, + installFonts, +}: + +stdenvNoCC.mkDerivation (finalAttrs: { + pname = "overused-grotesk"; + version = "0.5-alpha.2"; + + __structuredAttrs = true; + strictDeps = true; + + src = fetchzip { + url = "https://github.com/RandomMaerks/Overused-Grotesk/releases/download/v${finalAttrs.version}/OverusedGrotesk-v${finalAttrs.version}.zip"; + stripRoot = false; + hash = "sha256-XNylWbD9ZjEAcIUNCQECEy4ATlTlrzXrKP4Fb5YSCUw="; + }; + + nativeBuildInputs = [ installFonts ]; + + sourceRoot = "${finalAttrs.src.name}/ttf"; + + meta = { + homepage = "https://randommaerks.github.io/overused-grotesk"; + changelog = "https://github.com/RandomMaerks/Overused-Grotesk/releases"; + description = "A variable sans serif typeface inspired by the classic neo-grotesk Swiss design"; + license = lib.licenses.ofl; + platforms = lib.platforms.all; + maintainers = with lib.maintainers; [ yarn ]; + }; +})