Fixes a bug that was originally found by Claude and reported to the NixOS
security team by Anthropic as a security issue.
Previously, the file list was never output for merge commits.
This could have allowed someone who buried an edit to a file that shouldn't be
edited manually in a merge commit to not trigger the check.
It isn't a security issue, though, because the manual-file-edits check is not
a security boundary (just a friendly reminder to committers).
Anthropic report ID: ANT-2026-223Q3FSE
PR #545026 updated ruff to 0.16.0, which caused the
`config.system.build.image` output to fail due to a linting error in
`amend-repart-definitions.py`. This commit fixes the formatting so that
`nixosTests.appliance-repart-image` again passes.
`systemd.mainExecReload` fell back to `""` when `process.reloadCommand` was
unset, while `systemd.services."".serviceConfig.ExecReload` was defined
unconditionally. `serviceConfig` entries use `unitOption`, which concatenates
definitions only when one of them is a list; two plain strings go through
`mergeEqualOption` instead. So any service setting `ExecReload` through the
systemd escape hatch failed to evaluate, as in `nixosTests.php85.fpm-modular`.
The `""` fallback was also rendered as a bare `ExecReload=` line in every unit
without a reload command, since `attrsToSection` does not filter empty strings.
Default `systemd.mainExecReload` to `process.reloadCommand` itself, which makes
its existing `defaultText` accurate, and guard the definition with `lib.mkIf`,
so the framework leaves `ExecReload` undefined unless there really is a reload
command.
Assisted-by: Claude:claude-opus-5
Signed-off-by: cinereal <cinereal@riseup.net>
C binaries embed store paths of gcc and *-dev inputs as strings
(include/comp_dir style). Nix treats those as runtime dependencies,
keeping the full compiler and header packages in the closure.
Remove the accidental references with remove-references-to and guard
with disallowedRequisites. Measured x86_64-linux closure drop:
~867M -> ~543M.
Assisted-by: Grok by xAI (Grok Build)
