Replace `services.timesyncd.extraConfig` with a freeform `services.timesyncd.settings.Time` submodule, rendered via `utils.systemdUtils.lib.settingsToSections`. `extraConfig` is removed via `mkRemovedOptionModule`.
`servers` and `fallbackServers` are kept as typed wrappers; they now bridge into `settings.Time.NTP` / `settings.Time.FallbackNTP` via `mkDefault` so users can still override them through `settings.Time`.
Adds `nixos/tests/systemd-timesyncd` to assert the rendered `timesyncd.conf` contents.
The previous `if ! ( ... )` wrapper put the check body in a context
where bash ignores `set -e`, so a failing command in the middle of a
check would not abort it and the switch would proceed. Run the
subshell outside any conditional and capture $? explicitly instead.
The CalledProcessError can only come from the append-initrd-secrets
script, so catching it in the generic write loop and then asserting
on the writer type to reach back into its `source` is the wrong
layer. Move the catch, the pristine-initrd fallback and the warning
into InitrdWithSecretsWriter itself, and pass `critical` through the
writer protocol so it can decide between aborting and falling back.
The writer carries the generation number so the warning can still
name the affected generation. write_boot_files no longer knows
anything about secrets and the isinstance assertion is gone.
Suggested-by: Will Fancher <elvishjerricco@gmail.com>
Whether a write failure must be fatal is a property of the destination
path (is it needed by the configuration we are switching to?), not of
the particular BootFile instance that happened to survive
deduplication. Compute the set of critical paths up front and look it
up in write_boot_files, so the dedup loop no longer needs to pick the
"right" instance and becomes a plain order-preserving seen-set walk.
This leaves BootFile.current unused.
Suggested-by: Will Fancher <elvishjerricco@gmail.com>
This guarantees the descriptor is closed even when copyfileobj raises,
matching the other writer implementations. The append-initrd-secrets
script reopens the file by path, so flush() is enough before invoking
it and the explicit close() is no longer needed.
Tell the user what actually happens (the old secrets stay in place) and
how to get rid of the warning, instead of just saying it is "normal".
Suggested-by: Will Fancher <elvishjerricco@gmail.com>
Shared kernels and initrds appear once per generation in boot_files, so
InitrdWithSecretsWriter rebuilt the same file repeatedly. Prefer the
current configuration's entry so its failures stay fatal.
has_gc_root() iterated the entire BootFileList for every file on the
ESP, giving O(files * roots) comparisons. Build the set of kept paths
once and use O(1) membership tests instead.
After removing or renaming a file in boot.initrd.secrets, older
generations' append scripts start failing. Aborting on that blocks
deploying the new configuration, so only treat a failure as fatal when
it belongs to the configuration being switched to.
Appending to the existing file made it grow on every rebuild and a
failed script could leave it half-written. Always rebuild from the
pristine initrd into a temp file and rename into place.
The signing service builds `fwupd_efi` as a bash array but referenced
it as a scalar, tripping SC2128 (array expanded without index) and
SC2046 (unquoted command substitution). With enableStrictShellChecks
these are promoted to errors, breaking the unit-script build when
secureBoot, fwupd and strict shell checks are all enabled.
Loop over the array and sign every matched fwupd EFI binary, quoting
the basename and the -o argument. Indexing a single element would
silently skip any additional files the glob matches.
Assisted-by: claude-code with claude-opus-4-8[1m]-high
Regular (non-symlink) /etc entries with an explicit mode are currently
written to the metadata erofs image as stubs that redirect to a
separate basedir layer. Every open() of such a file makes overlayfs open
two real files (the metadata stub and the basedir target).
composefs-dump supports embedding file content directly via the CONTENT
field (raw size limit LCFS_INLINE_CONTENT_MAX = 5000 bytes). Use it for
files up to 4096 bytes so they are served straight from erofs with a
single underlying open. Files above the threshold keep the existing basedir
redirect.
Basedir entries that are provably inlineable are filtered at eval time
(text-backed entries) so changing a small /etc file no longer rebuilds
etc-lowerdir. Other entries are filtered at build time using the
same size check as the dump generator.
On a minimal config the basedir becomes empty and an open+read+close of
/etc/sudoers drops from ~46k to ~12k kernel instructions (-73%).
The metadata image size is unchanged (content fits in erofs block slack).
time-sync.target has Wants/After=time-set.target, every OnCalendar=
timer gains an implicit After=time-set.target, and
systemd.special(7) documents it as the hook for "system clock has
been set from a local source". Without the unit file the target is
not-found, so WantedBy=time-set.target on third-party units is
silently ignored and the timer ordering is a no-op.
This resolves#523878 where /etc/ is readonly and /etc/machine-id
cannot be created. Instead, /etc/machine-id is initialized to
"uninitialized" by systemd-tmpfiles in initrd and persisted in
/var/lib/nixos.
Most of the commands executed during the "testing patched programs"
phase of the extra-utils build don't produce any output whatsoever.
Therefore, if something goes wrong in that phase, the build log is
uninformative. Mitigate this by adding a `set -x` immediately after the
"testing patched programs" message is printed, causing the shell to print
an execution trace. This way we'll at least know _which command_ failed.
Deprecated in 2020 because Xorg works better with kernel modesetting,
and the original 800x600 default is rarely the right choice anyway.
Users who still need a VESA fallback can inline
`boot.kernelParams = [ "vga=0x317" "nomodeset" ];`.
`mkRemovedOptionModule` makes the removal noisy: setting `boot.vesa`
will now fail evaluation with a pointer to the replacement.
stc-ng starts every active target (including default.target) and then
explicitly restarts nixos-activation.service. As a Type=oneshot without
RemainAfterExit the unit is inactive after login, so the default.target
start job re-runs it via Wants=, and the explicit restart runs it again
(or, depending on ordering, SIGTERMs the currently running script and re-runs it).
Set RemainAfterExit=yes so target starts are a no-op for an already-run
activation, and restartIfChanged=false so the unit-diff pass leaves it
alone when the script changes. The explicit restart in stc-ng remains
the single trigger per switch. Print that restart so it is visible in
the switch output, and drop it from the "NOT restarting" list.
Extend the user-activation-scripts test to assert the activation is
only run once, and never killed.
