fwupd is now built with `efi_app_location = /run/fwupd-efi` so that
setups signing their EFI binaries (lanzaboote, sbctl, ...) can place the
signed app next to the unsigned one, which is impossible inside the
read-only store.
Nothing created that directory yet, so copy the unsigned app there from
`fwupd.fwupd-efi`. `C+` merges into an existing directory without
replacing files, so signed variants written by a bootloader module are
kept; the copy is refreshed whenever the rule (and thus the fwupd-efi
store path) changes.
Assisted-by: claude-code with claude-opus-5[1m]-high
The fwupd package ships /etc/grub.d/35_fwupd, which the module
symlinks unconditionally via filesInstalledToEtc.
Gate it on config.boot.loader.grub.enable option
so the hook only appears on GRUB systems.
Assisted-by: claude-code with Opus 4.7 xhigh
The path unit is responsible for starting the service whenever the specified path exists.
Restart=always effectively does nothing while the path exists, and only restarts the service unnecessarily when it doesn't.
Combined with a delay starting at 2 seconds, we never hit the configured start limit and kept indefinitely restarting the service.
This in turn also makes things like `nixos-rebuild switch` fail if it believes the service needs to be restarted.
scanservjs has been ignoring the configuration options set by the NixOS
module since the v3.0.4 upgrade. This fixes it.
Create dirs/files in the NixOS module as needed by the new scanservjs
build.
Fixes: 7432e50d62 ("scanservjs: 2.27.1 -> 3.0.4")
Fixes: https://github.com/NixOS/nixpkgs/issues/475043 ("nixos/scanservjs: settings (host/port) ignored in v3.0.4")
Co-authored-by: Bjørn Forsman <bjorn.forsman@gmail.com>
Upstream's intended bypass is TrustedUids in fwupd.conf, but on NixOS
the fwupd-refresh uid is allocated at activation time and is not known
during evaluation. Add a polkit rule keyed on the user name instead.
Scope:
- Combination of
- Textual matches of "baseNameOf (toString"
- Redundant toString calls I've found with my latest
"lazy paths" nix branch as they force lazy fetches into
the store. More info and new PR soon.
- Only cases I believe are worthwhile or easily determined
I've determined the validity by
- testing llvmPackages instantiation
- figuring out which types can pass into any particular
toString call - "human fuzzy type checker"
Behavior considerations by type:
- `path`: converted back to a string *without* context
`baseNameOf` does not copy things to the store on its own,
equivalent to its behavior for string inputs
- `null`: converted to `""` -> may be valid input!
ok if "" would not have been acceptable anyway
- `string` itself: passed through identically -> trivial
- `attrset` with `outPath`: same coercion as built into
the `baseNameOf` function -> trivial
- other atomic types: generally not sensible inputs to
`baseNameOf` -> fuzzy but true
This service is essentially a random sleep() call that old software that
is unable to properly handle modern hardware initialisation being
asynchronous can use to *mostly* get by.
Over the years is has caused so many issues in NixOS, like introducing
long delays in the boot process[1], complete deadlocks[2] and even failures
when reloading services or activating a new configuration[3].
systemd has been discouraging its use since 2011 (15 years ago!), then
it officially deprecated it in 2018 and since 2020 it started to show on
every boot a huge wall of text calling out all the offending services
that still use it.
Around 2021 we managed to fix around 15 NixOS modules[4] that were
relying on systemd-udev-settle and practically ZFS[5] was the only
remaining one. However, since then, people have actually started to
bring it back with new services[6][7][8]. This is not acceptable.
So, to prevent any more (lazy) uses of systemd-udev-settle, we stop
providing the systemd-udev-settle.service unit entirely. For existing
modules that unfortunately still need it, we replace it with the command
`udevadm settle --timeout=180`, which is all that the service does.
Hopefully this will also increase the awareness that it's bad and
something to be fixed.
Note: I tested this change using
- `nixosTests.zfs`,
- `nixosTests.ifstate`,
- `nixosTests.misc`,
- `nixosTests.openvswitch`,
- `nixosTests.predictable-interface-names`
- `nixosTests.nvidia-container-toolkit`
and making sure that none of the 165 packages that provide upstream
units (via the `systemd.packages` option) had a dependency on
systemd-udev-settle.service.
[1]: https://github.com/NixOS/nixpkgs/pull/25311
[2]: https://github.com/NixOS/nixpkgs/issues/107341
[3]: https://github.com/NixOS/nixpkgs/pull/113804
[4]: https://github.com/NixOS/nixpkgs/issues/73095
[5]: https://github.com/openzfs/zfs/issues/10891
[6]: https://github.com/NixOS/nixpkgs/pull/257525#discussion_r1442702970
[7]: https://github.com/NixOS/nixpkgs/pull/460075
[8]: https://github.com/NixOS/nixpkgs/pull/284507
Fixes `nixos.tests.hibernate` nondeterministic failure.
The documentation in `systemd.special(7)` recommends using this
`StopWhenUnneeded` method, rather than using custom unit logic
post-resume. This method is sufficiently general, and matches
systemd's typical model of using `ExecStart` and `ExecStop` as duals
that mirror each others processes across symmetric events in the
system's life cycle, e.g. bootup / shutdown.
This involved removing `post-resume.target`. This was introduced in
d5604f0b22 as a way to notify services
of resume events, but as discussed, this is not the typical model.
See: https://github.com/NixOS/nixpkgs/pull/488429/changes#r3038005884
