fwupd stopped honouring the FWUPD_EFIAPPDIR environment variable in
https://github.com/fwupd/fwupd/pull/9846; the location is a compile-time
constant (`EFI_APP_LOCATION`) since then, so setting the variable on
fwupd.service had no effect.
Drop `RuntimeDirectory` from the signing unit too: the directory is now
created and populated by the fwupd module, and RuntimeDirectoryPreserve
defaults to `no`, so systemd removed it (together with the unsigned app)
whenever the unit stopped -- which `partOf = fwupd.service` makes happen
on every fwupd restart.
Cover the whole path in the limine secure boot test, which so far never
enabled fwupd: it now asserts that both the unsigned app and the signed
variant end up in /run/fwupd-efi.
Assisted-by: claude-code with claude-opus-5[1m]-high
This makes it possible to build a system without Perl at all.
The actual original consumer of this perl environment was
`nixos/modules/system/activation/switch-to-configuration.pl`, which was
deleted in c59d4343f9, (replaced by Rust
switch-to-configuration-ng). That commit did not touch `top-level.nix`
or `activatable-system.nix`, so this Perl environment was left behind
even though its original (and, as far as I could trace, only) in-tree
consumer was gone.
Any out-of-tree/third-party activation script that happens to read this
`perl` variable will break but can be easily fixed by simply
reintroducing the deleted assignment. Nixpkgs doesn't have any such
consumers so it seems.
The installer being placed directly at (e.g.)
/nix/store/272h8d4df6by64ycl3s01bixrcaq5a9a-limine-install.py causes
Python to search the script's directory for imports if -P is not added,
so add -P to avoid Python automatically adding /nix/store to the script's
sys.path.
From the python manpage:
> -P: Don't automatically prepend a potentially unsafe path to sys.path
> such as the current directory, the script's directory or an empty string.
> See also the PYTHONSAFEPATH environment variable.
`systemd.mainExecReload` fell back to `""` when `process.reloadCommand` was
unset, while `systemd.services."".serviceConfig.ExecReload` was defined
unconditionally. `serviceConfig` entries use `unitOption`, which concatenates
definitions only when one of them is a list; two plain strings go through
`mergeEqualOption` instead. So any service setting `ExecReload` through the
systemd escape hatch failed to evaluate, as in `nixosTests.php85.fpm-modular`.
The `""` fallback was also rendered as a bare `ExecReload=` line in every unit
without a reload command, since `attrsToSection` does not filter empty strings.
Default `systemd.mainExecReload` to `process.reloadCommand` itself, which makes
its existing `defaultText` accurate, and guard the definition with `lib.mkIf`,
so the framework leaves `ExecReload` undefined unless there really is a reload
command.
Assisted-by: Claude:claude-opus-5
Signed-off-by: cinereal <cinereal@riseup.net>
the description in question turned out correct for `mainExecStart`, not for
`mainExecReload`
Assisted-by: Claude:claude-opus-5
Signed-off-by: cinereal <cinereal@riseup.net>
audit 4.2 rejects overlong values (max 15 bytes) for the kernel comm.
systemd attempts to send the full 19 bytes of "systemd-update-utmp",
and the systemd-update-utmp service fails to start. this was changed to
truncate instead of reject in audit 4.2.1, but until we can take the
mass rebuild on staging, we fetch the systemd patch which shortens
"systemd-update-utmp" to "update-utmp". this is in the nixos module as
`apply` instead of part of the systemd package as that would be a larger
rebuild and would delay other fixes making their way to master.
When setting `hardware.deviceTree.name` and `.enable`, a DeviceTree
section is added to UKI. This is nice default behavior for arm64
systems. When `hardware.deviceTree.package` plumbs into UEFI firmware
(e.g. u-boot), the UKI replaces the UEFI-supplied DTB. Besides bloating
the UKI, this has the side-effect of preventing UEFI firmware from
making modifications to the devicetree.
Filter out null boot.uki.settings values so that a NixOS configuration
can set `boot.uki.settings.UKI.DeviceTree = null;` to remove the default
behavior of packing the dtb into the UKI.
There is valid scenarios to NOT have certain keys in /etc/resolved.conf, e.g. WSL mDNS.
This was reported in https://github.com/NixOS/nixpkgs/pull/535649#issuecomment-5103574775.
Empty configs can still be achieved passing an empty list (`[]`) or empty string (`""`),
while passing `null` will now remove the key from the config file.
Wasi P2 is different enough to Wasi P1 to warrant being treated entirely
separately, rather than as two minor variants of the same thing. P3 will
likewise want to be a different target.
I've left aliases in place; maybe eventually, those can be deprecated
and removed. I've tested this, but it's possible there might be breakage
somewhere (e.g., the canonical doubles for P1 have changed, though I
can't imagine why anyone would rely on that).
Fixes https://github.com/NixOS/nixpkgs/issues/435954
In a previous change the transformSettings function was modified to look
at the Resolve section, but since it got a second consumer in the mean
time this regressed. We now target the resolved.conf explicitly instead.
This reverts commit 66353ca989.
In the meantime a new option was added that consumes the
`transformSettings` function, which broke by looking at just at the
Resolve section.
Fixes several correctness bugs primarily around modular services' recent
reload/notification options (#535695) and adds compliance coverage to guard them.
Fixes:
- `lib/services/service.nix`:
- the reload-conflict assertion had inverted polarity, so it fired on the
default configuration
- the `mkIf` guard on `process.reloadCommand` had a misplaced paren, applying
`!= null` to the `mkIf` result rather than to the condition
- `process.reloadSignal` derives `process.reloadCommand`, so the assertion
could not check `reloadCommand != null` -- that fired on every signal-only
service. The command is now derived at `mkDefault` priority and the
assertion is gated on `options.process.reloadCommand.highestPrio`, firing
only when the user also set `reloadCommand` explicitly.
- change `notificationProtocol` to a sub-module type
- `nixos/modules/system/service/systemd/service.nix`:
- `systemd.mainExecReload`'s default ran `escapeSystemdExecArgs` (a list
escaper) on the `nullOr str` `process.reloadCommand`; this threw
`expected a list but found a string` and would have mangled `$MAINPID`. It
now uses `process.reloadCommand` verbatim.
- the `Type` default read a non-existent
`config.serviceManager.notificationProtocol` instead of
`config.notificationProtocol`.
Tests:
Extend the modular-service compliance suite to guard the above:
- Portable (manager-agnostic) eval assertions: `reloadSignal` derives
`reloadCommand`, the conflict assertion does not fire on signal-only services
but does when both are set explicitly, and `notificationProtocol.systemd`/`.s6`
default to `false`.
- systemd-specific eval assertions: `serviceConfig.Type` (simple/notify) and
`serviceConfig.ExecReload` are asserted on the resolved host units. This
directly guards the `mainExecReload` fix, which threw before it.
- Runtime reload compliance test: a nested reloadable sub-service is started and
reloaded, asserting the service observed the reload (recorded a SIGHUP marker).
`callReload` receives the service's name path (the list of names from the
top-level service down to the target sub-service); each integration joins it
per its own unit-naming convention (NixOS dash-joins to the systemd unit name,
e.g. `reload-inner.service`). Keeping it a path list rather than a read-only
submodule option keeps the suite manager-agnostic.
- `doc/build-helpers/testers.chapter.md`: document `callReload`.
Follow-up to #535695.
Signed-off-by: cinereal <cinereal@riseup.net>
Assisted-by: Claude:claude-opus-4-8
libfido2 links against pcsclite's libpcsclite.so.1, which since
pcsclite 2.3.1 is a shim that dlopens libpcsclite_real.so.1. nixpkgs
patches that dlopen to an absolute store path. make-initrd-ng only
follows DT_NEEDED, so the real library never ends up in the initrd.
systemd-cryptsetup then logs at boot:
loading ".../pcsclite-2.4.1-lib/lib/libpcsclite_real.so.1" failed:
cannot open shared object file: No such file or directory
and FIDO2 tokens behind PC/SC (NFC readers) cannot be used to unlock
LUKS in stage 1. Add the real library to the initrd store paths.
systemd v261 added systemd-pcrlogin@.service, which logind starts on
first login of a user to measure the user record into the 'login'
NvPCR. NixOS does not install the unit, so every first login logs:
systemd-logind: Failed to start user measurement service
'systemd-pcrlogin@1000.service', ignoring: Unit not found.
Install the unit on systems with systemd.tpm2.enable. The unit has ConditionSecurity=measured-os and does nothing elsewhere.
Adds modular service option `process.environment` to pass an attrset of
env vars to the service manager.
`null` values actively unset the variable before the process starts.
Values are `coercedTo (either path package) str` via interpolation,
mirroring `pathOrStr`, so paths and packages render to store-path strings
with string context preserved. The type is `lazyAttrsOf`, allowing one
entry to reference another (recursive env definitions).
The systemd backend unsets entries using `unexport` in `ExecStart`,
so the variable is absent even when `Environment=` or
the inherited environment would otherwise supply it.
The systemd backend lifts non-null entries onto the primary unit wrapped
per-key with `lib.mkDefault` so they merge with the existing priority-100
`environment.PATH` binding in `nixos/lib/systemd-lib.nix` while still letting
explicit `systemd.service.environment.<k>` overrides win.
The systemd extra-root modules are loaded via `importApply`, closing `pkgs`
over `systemd/service.nix` as a non-module argument (matching the portable
`lib/services/service.nix` convention) instead of passing a redundant `pkgs`
specialArg. The docs eval threads `pkgs = throw` accordingly.
Portable coverage lives in `testers.modularServiceCompliance`: an eval-level
check that a set value round-trips and a `null` value is preserved, plus an
integration test that records the service's own `/proc/$$/environ` and asserts
the set variable is present and the null variable is absent. The
systemd-specific grep assertions in `systemd/test.nix` cover how systemd
achieves this (`Environment=` rendering, null filtering, the `unexport`
wrapper, and override precedence).
Assisted-by: Claude:claude-opus-4-8
The documentation describes this as a set of files copied to /boot, with
the attribute name denoting the destination file name in /boot.
This uses essentially the same description as refind, systemd-boot and
grub. However limine put it into limine_install_dir (/boot/limine by
default) by accident, which broke downstream users.
For example, nixos-apple-silicon uses boot.loader.limine.additionalFiles
(and similar directives for other bootloaders) to update its m1n1
bootloader (which chainloads into u-boot, which chainloads into the
bootloader selected in NixOS), and due to this bug, put new versions of
it in the wrong location, effectively never updating m1n1.
Fix this, by updating the location. The next commit adds a regression VM
test for it.
systemd v261 lists the new systemd-boot-fallback binary in `bootctl
status`, so our regex picked up the older fallback version and ran
`bootctl update` on an already current ESP, which then exits non-zero.
Switch from parsing the `bootctl --status` output to having bootctl
compare versions itself by calling io.systemd.BootControl.Install over
Varlink. bootctl is spawned as a stdio Varlink server so that we always
use the bootctl from the target closure. An already current binary comes
back as an io.systemd.System error carrying ESTALE, which we treat as
success.
Because all options are below the [Resolve] section, and we nest them as
such below `settings.Resolve` we need to apply the transformations one
level down for it to match the relevant keys.
This is for instance useful on Asahi where an additional initrd archive
containing firmware blobs and per-device calibration files is placed
on the ESP and updated by the Asahi Linux Installer.
These need to be loaded alongside the NixOS initrd.
Implemented for systemd-boot and Limine. Grub is left out since its
install script does not use bootspec yet.
Co-authored-by: Florian Klink <flokli@flokli.de>
