Merge release-24.05 into staging-next-24.05

(cherry picked from commit d9d31ef1d4)

.git-blame-ignore-revs

@@ -117,3 +117,9 @@ fb0e5be84331188a69b3edd31679ca6576edb75a
 
 # python3Packages: format with nixfmt
 59b1aef59071cae6e87859dc65de973d2cc595c0
+
+# percona: apply nixfmt
+369350afcba8e6a231dd25b6a010c4e9dec713b9
+
+# treewide nixfmt reformat pass 1, master, staging and staging-next
+776b0b45a36ec8e9bcae8e8e93085dac5d8b5a3c

.gitattributes

@@ -16,3 +16,5 @@ nixos/doc/default.nix linguist-documentation=false
 
 nixos/modules/module-list.nix merge=union
 # pkgs/top-level/all-packages.nix merge=union
+
+ci/OWNERS linguist-language=CODEOWNERS

.github/CODEOWNERS

@@ -1,365 +1,4 @@
-# CODEOWNERS file
+# Use ci/OWNERS instead
 #
-# This file is used to describe who owns what in this repository. This file does not
-# replace `meta.maintainers` but is instead used for other things than derivations
-# and modules, like documentation, package sets, and other assets.
-#
-# For documentation on this file, see https://help.github.com/articles/about-codeowners/
-# Mentioned users will get code review requests.
-#
-# IMPORTANT NOTE: in order to actually get pinged, commit access is required.
-# This also holds true for GitHub teams. Since almost none of our teams have write
-# permissions, you need to list all members of the team with commit access individually.
-
-# GitHub actions
-/.github/workflows @NixOS/Security @Mic92 @zowoq
-
-# EditorConfig
-/.editorconfig @Mic92 @zowoq
-
-# Libraries
-/lib                        @infinisil
-/lib/systems                @alyssais @ericson2314
-/lib/generators.nix         @infinisil @Profpatsch
-/lib/cli.nix                @infinisil @Profpatsch
-/lib/debug.nix              @infinisil @Profpatsch
-/lib/asserts.nix            @infinisil @Profpatsch
-/lib/path.*                 @infinisil
-/lib/fileset                @infinisil
-## Libraries / Module system
-/lib/modules.nix            @infinisil @roberth
-/lib/types.nix              @infinisil @roberth
-/lib/options.nix            @infinisil @roberth
-/lib/tests/modules.sh       @infinisil @roberth
-/lib/tests/modules          @infinisil @roberth
-
-# Nixpkgs Internals
-/default.nix                                     @Ericson2314
-/pkgs/top-level/default.nix                      @Ericson2314
-/pkgs/top-level/impure.nix                       @Ericson2314
-/pkgs/top-level/stage.nix                        @Ericson2314
-/pkgs/top-level/splice.nix                       @Ericson2314
-/pkgs/top-level/release-cross.nix                @Ericson2314
-/pkgs/stdenv/generic                             @Ericson2314
-/pkgs/stdenv/generic/check-meta.nix              @Ericson2314
-/pkgs/stdenv/cross                               @Ericson2314
-/pkgs/build-support/cc-wrapper                   @Ericson2314
-/pkgs/build-support/bintools-wrapper             @Ericson2314
-/pkgs/build-support/setup-hooks                  @Ericson2314
-/pkgs/build-support/setup-hooks/auto-patchelf.sh @layus
-/pkgs/build-support/setup-hooks/auto-patchelf.py @layus
-/pkgs/pkgs-lib                                   @infinisil
-## Format generators/serializers
-/pkgs/pkgs-lib/formats/libconfig                 @ckiee @h7x4
-/pkgs/pkgs-lib/formats/hocon                     @h7x4
-
-# pkgs/by-name
-/pkgs/test/check-by-name @infinisil
-/pkgs/by-name/README.md @infinisil
-/pkgs/top-level/by-name-overlay.nix @infinisil
-/.github/workflows/check-by-name.yml @infinisil
-
-# Nixpkgs build-support
-/pkgs/build-support/writers @lassulus @Profpatsch
-
-# Nixpkgs make-disk-image
-/doc/build-helpers/images/makediskimage.section.md  @raitobezarius
-/nixos/lib/make-disk-image.nix                 @raitobezarius
-
-# Nix, the package manager
-pkgs/tools/package-management/nix/                    @raitobezarius @ma27
-nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius @ma27
-
-# Nixpkgs documentation
-/maintainers/scripts/db-to-md.sh @jtojnar @ryantm
-/maintainers/scripts/doc @jtojnar @ryantm
-
-# Contributor documentation
-/CONTRIBUTING.md @infinisil
-/.github/PULL_REQUEST_TEMPLATE.md @infinisil
-/doc/contributing/ @infinisil
-/doc/contributing/contributing-to-documentation.chapter.md @jtojnar @infinisil
-/lib/README.md @infinisil
-/doc/README.md @infinisil
-/nixos/README.md @infinisil
-/pkgs/README.md @infinisil
-/maintainers/README.md @infinisil
-
-# User-facing development documentation
-/doc/development.md @infinisil
-/doc/development @infinisil
-
-# NixOS Internals
-/nixos/default.nix                                    @infinisil
-/nixos/lib/from-env.nix                               @infinisil
-/nixos/lib/eval-config.nix                            @infinisil
-/nixos/modules/system                                 @dasJ
-/nixos/modules/system/activation/bootspec.nix         @grahamc @cole-h @raitobezarius
-/nixos/modules/system/activation/bootspec.cue         @grahamc @cole-h @raitobezarius
-
-# NixOS integration test driver
-/nixos/lib/test-driver  @tfc
-
-# NixOS QEMU virtualisation
-/nixos/virtualisation/qemu-vm.nix           @raitobezarius
-
-# Systemd
-/nixos/modules/system/boot/systemd.nix      @NixOS/systemd
-/nixos/modules/system/boot/systemd          @NixOS/systemd
-/nixos/lib/systemd-*.nix                    @NixOS/systemd
-/pkgs/os-specific/linux/systemd             @NixOS/systemd
-
-# Systemd-boot
-/nixos/modules/system/boot/loader/systemd-boot      @JulienMalka
-
-# Images and installer media
-/nixos/modules/installer/cd-dvd/            @samueldr
-/nixos/modules/installer/sd-card/           @samueldr
-
-# Updaters
-## update.nix
-/maintainers/scripts/update.nix   @jtojnar
-/maintainers/scripts/update.py    @jtojnar
-## common-updater-scripts
-/pkgs/common-updater/scripts/update-source-version    @jtojnar
-
-# Python-related code and docs
-/doc/languages-frameworks/python.section.md                 @mweinelt
-/pkgs/development/interpreters/python/hooks                 @jonringer
-
-# Haskell
-/doc/languages-frameworks/haskell.section.md  @sternenseemann @maralorn @ncfavier
-/maintainers/scripts/haskell                  @sternenseemann @maralorn @ncfavier
-/pkgs/development/compilers/ghc               @sternenseemann @maralorn @ncfavier
-/pkgs/development/haskell-modules             @sternenseemann @maralorn @ncfavier
-/pkgs/test/haskell                            @sternenseemann @maralorn @ncfavier
-/pkgs/top-level/release-haskell.nix           @sternenseemann @maralorn @ncfavier
-/pkgs/top-level/haskell-packages.nix          @sternenseemann @maralorn @ncfavier
-
-# Perl
-/pkgs/development/interpreters/perl @stigtsp @zakame @dasJ @marcusramberg
-/pkgs/top-level/perl-packages.nix   @stigtsp @zakame @dasJ @marcusramberg
-/pkgs/development/perl-modules      @stigtsp @zakame @dasJ @marcusramberg
-
-# R
-/pkgs/applications/science/math/R   @jbedo
-/pkgs/development/r-modules         @jbedo
-
-# Rust
-/pkgs/development/compilers/rust @Mic92 @zowoq @winterqt @figsoda
-/pkgs/build-support/rust @zowoq @winterqt @figsoda
-/doc/languages-frameworks/rust.section.md @zowoq @winterqt @figsoda
-
-# C compilers
-/pkgs/development/compilers/gcc
-/pkgs/development/compilers/emscripten @raitobezarius
-/doc/languages-frameworks/emscripten.section.md @raitobezarius
-
-# Audio
-/nixos/modules/services/audio/botamusique.nix @mweinelt
-/nixos/modules/services/audio/snapserver.nix @mweinelt
-/nixos/tests/modules/services/audio/botamusique.nix @mweinelt
-/nixos/tests/snapcast.nix @mweinelt
-
-# Browsers
-/pkgs/applications/networking/browsers/firefox @mweinelt
-/pkgs/applications/networking/browsers/chromium @emilylange
-/nixos/tests/chromium.nix @emilylange
-
-# Certificate Authorities
-pkgs/data/misc/cacert/ @ajs124 @lukegb @mweinelt
-pkgs/development/libraries/nss/ @ajs124 @lukegb @mweinelt
-pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
-
-# Jetbrains
-/pkgs/applications/editors/jetbrains @edwtjo
-
-# Licenses
-/lib/licenses.nix @alyssais
-
-# Qt
-/pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000 @ttuegel
-/pkgs/development/libraries/qt-6 @K900 @NickCao @SuperSandro2000 @ttuegel
-
-# KDE / Plasma 5
-/pkgs/applications/kde @K900 @NickCao @SuperSandro2000 @ttuegel
-/pkgs/desktops/plasma-5 @K900 @NickCao @SuperSandro2000 @ttuegel
-/pkgs/development/libraries/kde-frameworks @K900 @NickCao @SuperSandro2000 @ttuegel
-
-# KDE / Plasma 6
-/pkgs/kde @K900 @NickCao @SuperSandro2000 @ttuegel
-/maintainers/scripts/kde @K900 @NickCao @SuperSandro2000 @ttuegel
-
-# PostgreSQL and related stuff
-/pkgs/servers/sql/postgresql @thoughtpolice
-/nixos/modules/services/databases/postgresql.xml @thoughtpolice
-/nixos/modules/services/databases/postgresql.nix @thoughtpolice
-/nixos/tests/postgresql.nix @thoughtpolice
-
-# Hardened profile & related modules
-/nixos/modules/profiles/hardened.nix @joachifm
-/nixos/modules/security/hidepid.nix @joachifm
-/nixos/modules/security/lock-kernel-modules.nix @joachifm
-/nixos/modules/security/misc.nix @joachifm
-/nixos/tests/hardened.nix @joachifm
-/pkgs/os-specific/linux/kernel/hardened-config.nix @joachifm
-
-# Home Automation
-/nixos/modules/services/misc/home-assistant.nix @mweinelt
-/nixos/modules/services/misc/zigbee2mqtt.nix @mweinelt
-/nixos/tests/home-assistant.nix @mweinelt
-/nixos/tests/zigbee2mqtt.nix @mweinelt
-/pkgs/servers/home-assistant @mweinelt
-/pkgs/tools/misc/esphome @mweinelt
-
-# Network Time Daemons
-/pkgs/tools/networking/chrony @thoughtpolice
-/pkgs/tools/networking/ntp @thoughtpolice
-/pkgs/tools/networking/openntpd @thoughtpolice
-/nixos/modules/services/networking/ntp @thoughtpolice
-
-# Network
-/pkgs/tools/networking/octodns @Janik-Haag
-/pkgs/tools/networking/kea/default.nix @mweinelt
-/pkgs/tools/networking/babeld/default.nix @mweinelt
-/nixos/modules/services/networking/babeld.nix @mweinelt
-/nixos/modules/services/networking/kea.nix @mweinelt
-/nixos/modules/services/networking/knot.nix @mweinelt
-nixos/modules/services/networking/networkmanager.nix @Janik-Haag
-/nixos/modules/services/monitoring/prometheus/exporters/kea.nix @mweinelt
-/nixos/tests/babeld.nix @mweinelt
-/nixos/tests/kea.nix @mweinelt
-/nixos/tests/knot.nix @mweinelt
-/nixos/tests/networking/* @Janik-Haag
-
-# Web servers
-/doc/packages/nginx.section.md @raitobezarius
-/pkgs/servers/http/nginx/ @raitobezarius
-/nixos/modules/services/web-servers/nginx/ @raitobezarius
-
-# Dhall
-/pkgs/development/dhall-modules      @Gabriella439 @Profpatsch @ehmry
-/pkgs/development/interpreters/dhall @Gabriella439 @Profpatsch @ehmry
-
-# Idris
-/pkgs/development/idris-modules @Infinisil
-
-# Bazel
-/pkgs/development/tools/build-managers/bazel @Profpatsch
-
-# NixOS modules for e-mail and dns services
-/nixos/modules/services/mail/mailman.nix    @peti
-/nixos/modules/services/mail/postfix.nix    @peti
-/nixos/modules/services/networking/bind.nix @peti
-/nixos/modules/services/mail/rspamd.nix     @peti
-
-# Emacs
-/pkgs/applications/editors/emacs/elisp-packages @adisbladis
-/pkgs/applications/editors/emacs                @adisbladis
-/pkgs/top-level/emacs-packages.nix              @adisbladis
-
-# Neovim
-/pkgs/applications/editors/neovim      @figsoda @jonringer @teto
-
-# VimPlugins
-/pkgs/applications/editors/vim/plugins         @figsoda @jonringer
-
-# VsCode Extensions
-/pkgs/applications/editors/vscode/extensions   @jonringer
-
-# PHP interpreter, packages, extensions, tests and documentation
-/doc/languages-frameworks/php.section.md          @aanderse @drupol @globin @ma27 @talyz
-/nixos/tests/php                                  @aanderse @drupol @globin @ma27 @talyz
-/pkgs/build-support/php/build-pecl.nix            @aanderse @drupol @globin @ma27 @talyz
-/pkgs/build-support/php                                     @drupol
-/pkgs/development/interpreters/php       @jtojnar @aanderse @drupol @globin @ma27 @talyz
-/pkgs/development/php-packages                    @aanderse @drupol @globin @ma27 @talyz
-/pkgs/top-level/php-packages.nix         @jtojnar @aanderse @drupol @globin @ma27 @talyz
-
-# Docker tools
-/pkgs/build-support/docker                   @roberth
-/nixos/tests/docker-tools*                   @roberth
-/doc/build-helpers/images/dockertools.section.md  @roberth
-
-# Blockchains
-/pkgs/applications/blockchains  @mmahut @RaghavSood
-
-# Go
-/doc/languages-frameworks/go.section.md @kalbasit @Mic92 @zowoq
-/pkgs/build-support/go @kalbasit @Mic92 @zowoq
-/pkgs/development/compilers/go @kalbasit @Mic92 @zowoq
-
-# GNOME
-/pkgs/desktops/gnome                              @jtojnar
-/pkgs/desktops/gnome/extensions                   @jtojnar
-/pkgs/build-support/make-hardcode-gsettings-patch @jtojnar
-
-# Cinnamon
-/pkgs/desktops/cinnamon @mkg20001
-
-# nim
-/pkgs/development/compilers/nim   @ehmry
-/pkgs/development/nim-packages    @ehmry
-/pkgs/top-level/nim-packages.nix  @ehmry
-
-# terraform providers
-/pkgs/applications/networking/cluster/terraform-providers @zowoq
-
-# Forgejo
-nixos/modules/services/misc/forgejo.nix      @bendlas @emilylange
-pkgs/applications/version-management/forgejo @bendlas @emilylange
-
-# Dotnet
-/pkgs/build-support/dotnet                  @IvarWithoutBones
-/pkgs/development/compilers/dotnet          @IvarWithoutBones
-/pkgs/test/dotnet                           @IvarWithoutBones
-/doc/languages-frameworks/dotnet.section.md @IvarWithoutBones
-
-# Node.js
-/pkgs/build-support/node/build-npm-package      @lilyinstarlight @winterqt
-/pkgs/build-support/node/fetch-npm-deps         @lilyinstarlight @winterqt
-/doc/languages-frameworks/javascript.section.md @lilyinstarlight @winterqt
-
-# environment.noXlibs option aka NoX
-/nixos/modules/config/no-x-libs.nix  @SuperSandro2000
-
-# OCaml
-/pkgs/build-support/ocaml           @ulrikstrid
-/pkgs/development/compilers/ocaml   @ulrikstrid
-/pkgs/development/ocaml-modules     @ulrikstrid
-
-# ZFS
-pkgs/os-specific/linux/zfs/2_1.nix        @raitobezarius
-pkgs/os-specific/linux/zfs/generic.nix    @raitobezarius
-nixos/modules/tasks/filesystems/zfs.nix   @raitobezarius
-nixos/tests/zfs.nix                       @raitobezarius
-
-# Zig
-/pkgs/development/compilers/zig @figsoda
-/doc/hooks/zig.section.md       @figsoda
-
-# Buildbot
-nixos/modules/services/continuous-integration/buildbot @Mic92 @zowoq
-nixos/tests/buildbot.nix                               @Mic92 @zowoq
-pkgs/development/tools/continuous-integration/buildbot @Mic92 @zowoq
-
-# Pretix
-pkgs/by-name/pr/pretix/ @mweinelt
-pkgs/by-name/pr/pretalx/ @mweinelt
-nixos/modules/services/web-apps/pretix.nix @mweinelt
-nixos/modules/services/web-apps/pretalx.nix @mweinelt
-nixos/tests/web-apps/pretix.nix @mweinelt
-nixos/tests/web-apps/pretalx.nix @mweinelt
-
-# incus/lxc/lxd
-nixos/maintainers/scripts/lxd/          @adamcstephens
-nixos/modules/virtualisation/incus.nix  @adamcstephens
-nixos/modules/virtualisation/lxc*       @adamcstephens
-nixos/modules/virtualisation/lxd*       @adamcstephens
-nixos/tests/incus/                      @adamcstephens
-nixos/tests/lxd/                        @adamcstephens
-pkgs/by-name/in/incus/                  @adamcstephens
-pkgs/by-name/lx/lxc*                    @adamcstephens
-pkgs/by-name/lx/lxd*                    @adamcstephens
-pkgs/os-specific/linux/lxc/             @adamcstephens
-
+# This file would be for the native code owner feature of GitHub,
+# but is not being used because of its problems, see ci/OWNERS

.github/workflows/check-nix-format.yml

@@ -19,13 +19,18 @@ jobs:
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      - name: Get Nixpkgs revision for nixfmt
+        run: |
+          # pin to a commit from nixpkgs-unstable to avoid e.g. building nixfmt
+          # from staging
+          # This should not be a URL, because it would allow PRs to run arbitrary code in CI!
+          rev=$(jq -r .rev ci/pinned-nixpkgs.json)
+          echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"
       - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
-          # fix a commit from nixpkgs-unstable to avoid e.g. building nixfmt
-          # from staging
-          nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/4b455dc2048f73a79eb3713f342369ff58f93e0b.tar.gz
+          nix_path: nixpkgs=${{ env.url }}
       - name: Install nixfmt
         run: "nix-env -f '<nixpkgs>' -iAP nixfmt-rfc-style"
       - name: Check that Nix files are formatted according to the RFC style
@@ -35,11 +40,14 @@ jobs:
           NIX_FMT_PATHS_BSD: pkgs/os-specific/bsd
           NIX_FMT_PATHS_MPVSCRIPTS: pkgs/applications/video/mpv/scripts
           # Format paths related to the Nixpkgs CUDA ecosystem.
-          NIX_FMT_PATHS_CUDA: |
+          NIX_FMT_PATHS_CUDA: |-
             pkgs/development/cuda-modules
             pkgs/test/cuda
             pkgs/top-level/cuda-packages.nix
-          NIX_FMT_PATHS_K3S: |
+          NIX_FMT_PATHS_MAINTAINERS: |-
+            maintainers/maintainer-list.nix
+            maintainers/team-list.nix
+          NIX_FMT_PATHS_K3S: |-
             nixos/modules/services/cluster/k3s
             nixos/tests/k3s
             pkgs/applications/networking/cluster/k3s
@@ -48,6 +56,7 @@ jobs:
           NIX_FMT_PATHS_BUILD_SUPPORT_PHP: pkgs/build-support/php
         # Iterate over all environment variables beginning with NIX_FMT_PATHS_.
         run: |
+          unformattedPaths=()
           for env_var in "${!NIX_FMT_PATHS_@}"; do
             readarray -t paths <<< "${!env_var}"
             if [[ "${paths[*]}" == "" ]]; then
@@ -56,7 +65,12 @@ jobs:
             fi
             echo "Checking paths: ${paths[@]}"
             if ! nixfmt --check "${paths[@]}"; then
-              echo "Error: nixfmt failed."
-              exit 1
+              unformattedPaths+=("${paths[@]}")
             fi
           done
+          if (( "${#unformattedPaths[@]}" > 0 )); then
+            echo "Some required Nix files are not properly formatted"
+            echo "Please run the following in \`nix-shell\`:"
+            echo "nixfmt ${unformattedPaths[*]@Q}"
+            exit 1
+          fi

.github/workflows/check-shell.yml

@@ -0,0 +1,29 @@
+name: "Check shell"
+
+on:
+  pull_request_target:
+
+permissions: {}
+
+jobs:
+  x86_64-linux:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
+      - name: Build shell
+        run: nix-build shell.nix
+
+  aarch64-darwin:
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
+      - name: Build shell
+        run: nix-build shell.nix

.github/workflows/codeowners-v2.yml

@@ -0,0 +1,104 @@
+name: Codeowners v2
+
+# This workflow depends on two GitHub Apps with the following permissions:
+# - For checking code owners:
+#   - Permissions:
+#     - Repository > Administration: read-only
+#     - Organization > Members: read-only
+#   - Install App on this repository, setting these variables:
+#     - OWNER_RO_APP_ID (variable)
+#     - OWNER_RO_APP_PRIVATE_KEY (secret)
+# - For requesting code owners:
+#   - Permissions:
+#     - Repository > Administration: read-only
+#     - Organization > Members: read-only
+#     - Repository > Pull Requests: read-write
+#   - Install App on this repository, setting these variables:
+#     - OWNER_APP_ID (variable)
+#     - OWNER_APP_PRIVATE_KEY (secret)
+#
+# This split is done because checking code owners requires handling untrusted PR input,
+# while requesting code owners requires PR write access, and those shouldn't be mixed.
+
+on:
+  pull_request_target:
+    types: [opened, ready_for_review, synchronize, reopened, edited]
+
+# We don't need any default GitHub token
+permissions: {}
+
+env:
+  OWNERS_FILE: ci/OWNERS
+  # Don't do anything on draft PRs
+  DRY_MODE: ${{ github.event.pull_request.draft && '1' || '' }}
+
+jobs:
+  # Check that code owners is valid
+  check:
+    name: Check
+    runs-on: ubuntu-latest
+    steps:
+    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+
+    - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+      if: github.repository_owner == 'NixOS'
+      with:
+        # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
+        name: nixpkgs-ci
+        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+
+    # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR itself.
+    # We later build and run code from the base branch with access to secrets,
+    # so it's important this is not the PRs code.
+    - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      with:
+        path: base
+
+    - name: Build codeowners validator
+      run: nix-build base/ci -A codeownersValidator
+
+    - uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
+      id: app-token
+      with:
+        app-id: ${{ vars.OWNER_RO_APP_ID }}
+        private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}
+
+    - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      with:
+        ref: refs/pull/${{ github.event.number }}/merge
+        path: pr
+
+    - name: Validate codeowners
+      run: result/bin/codeowners-validator
+      env:
+        OWNERS_FILE: pr/${{ env.OWNERS_FILE }}
+        GITHUB_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}
+        REPOSITORY_PATH: pr
+        OWNER_CHECKER_REPOSITORY: ${{ github.repository }}
+        # Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody
+        EXPERIMENTAL_CHECKS: "avoid-shadowing"
+
+  # Request reviews from code owners
+  request:
+    name: Request
+    runs-on: ubuntu-latest
+    steps:
+    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+
+    # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head.
+    # This is intentional, because we need to request the review of owners as declared in the base branch.
+    - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+
+    - uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
+      id: app-token
+      with:
+        app-id: ${{ vars.OWNER_APP_ID }}
+        private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
+
+    - name: Build review request package
+      run: nix-build ci -A requestReviews
+
+    - name: Request reviews
+      run: result/bin/request-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"
+      env:
+        GH_TOKEN: ${{ steps.app-token.outputs.token }}

.github/workflows/editorconfig-v2.yml

@@ -1,6 +1,8 @@
-name: "Checking EditorConfig"
+name: "Checking EditorConfig v2"
 
-permissions: read-all
+permissions:
+  pull-requests: read
+  contents: read
 
 on:
   # avoids approving first time contributors

.github/workflows/manual-nixos-v2.yml

@@ -1,6 +1,7 @@
-name: "Build NixOS manual"
+name: "Build NixOS manual v2"
 
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   pull_request_target:

.github/workflows/manual-nixpkgs-v2.yml

@@ -1,6 +1,7 @@
-name: "Build Nixpkgs manual"
+name: "Build Nixpkgs manual v2"
 
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   pull_request_target:

.github/workflows/nix-parse-v2.yml

@@ -1,6 +1,8 @@
-name: "Check whether nix files are parseable"
+name: "Check whether nix files are parseable v2"
 
-permissions: read-all
+permissions:
+  pull-requests: read
+  contents: read
 
 on:
   # avoids approving first time contributors

.gitignore

@@ -19,6 +19,7 @@ tags
 /doc/manual.pdf
 /source/
 .version-suffix
+.direnv
 
 .DS_Store
 .mypy_cache

.mailmap

@@ -1,5 +1,6 @@
 ajs124 <git@ajs124.de> <ajs124@users.noreply.github.com>
 Anderson Torres <torres.anderson.85@protonmail.com>
+Atemu <git@atemu.net> <atemu.main@gmail.com>
 Daniel Løvbrøtte Olsen <me@dandellion.xyz> <daniel.olsen99@gmail.com>
 Fabian Affolter <mail@fabian-affolter.ch> <fabian@affolter-engineering.ch>
 Janne Heß <janne@hess.ooo> <dasJ@users.noreply.github.com>

CONTRIBUTING.md

@@ -193,19 +193,12 @@ The last checkbox is about whether it fits the guidelines in this `CONTRIBUTING.
 [rebase]: #rebasing-between-branches-ie-from-master-to-staging
 
 From time to time, changes between branches must be rebased, for example, if the
-number of new rebuilds they would cause is too large for the target branch. When
-rebasing, care must be taken to include only the intended changes, otherwise
-many CODEOWNERS will be inadvertently requested for review. To achieve this,
-rebasing should not be performed directly on the target branch, but on the merge
-base between the current and target branch. As an additional precautionary measure,
-you should temporarily mark the PR as draft for the duration of the operation.
-This reduces the probability of mass-pinging people. (OfBorg might still
-request a couple of persons for reviews though.)
+number of new rebuilds they would cause is too large for the target branch.
 
 In the following example, we assume that the current branch, called `feature`,
 is based on `master`, and we rebase it onto the merge base between
-`master` and `staging` so that the PR can eventually be retargeted to
-`staging` without causing a mess. The example uses `upstream` as the remote for `NixOS/nixpkgs.git`
+`master` and `staging` so that the PR can be retargeted to
+`staging`. The example uses `upstream` as the remote for `NixOS/nixpkgs.git`
 while `origin` is the remote you are pushing to.
 
 
@@ -234,36 +227,6 @@ git status
 git push origin feature --force-with-lease
 ```
 
-#### Something went wrong and a lot of people were pinged
-
-It happens. Remember to be kind, especially to new contributors.
-There is no way back, so the pull request should be closed and locked
-(if possible). The changes should be re-submitted in a new PR, in which the people
-originally involved in the conversation need to manually be pinged again.
-No further discussion should happen on the original PR, as a lot of people
-are now subscribed to it.
-
-The following message (or a version thereof) might be left when closing to
-describe the situation, since closing and locking without any explanation
-is kind of rude:
-
-```markdown
-It looks like you accidentally mass-pinged a bunch of people, which are now subscribed
-and getting notifications for everything in this pull request. Unfortunately, they
-cannot be automatically unsubscribed from the issue (removing review request does not
-unsubscribe), therefore development cannot continue in this pull request anymore.
-
-Please open a new pull request with your changes, link back to this one and ping the
-people actually involved in here over there.
-
-In order to avoid this in the future, there are instructions for how to properly
-rebase between branches in our [contribution guidelines](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#rebasing-between-branches-ie-from-master-to-staging).
-Setting your pull request to draft prior to rebasing is strongly recommended.
-In draft status, you can preview the list of people that are about to be requested
-for review, which allows you to sidestep this issue.
-This is not a bulletproof method though, as OfBorg still does review requests even on draft PRs.
-```
-
 ## How to backport pull requests
 [pr-backport]: #how-to-backport-pull-requests
 

README.md

@@ -52,9 +52,9 @@ Nixpkgs and NixOS are built and tested by our continuous integration
 system, [Hydra](https://hydra.nixos.org/).
 
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for the NixOS 23.11 release](https://hydra.nixos.org/jobset/nixos/release-23.11)
+* [Continuous package builds for the NixOS 24.05 release](https://hydra.nixos.org/jobset/nixos/release-24.05)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for the NixOS 23.11 release](https://hydra.nixos.org/job/nixos/release-23.11/tested#tabs-constituents)
+* [Tests for the NixOS 24.05 release](https://hydra.nixos.org/job/nixos/release-24.05/tested#tabs-constituents)
 
 Artifacts successfully built with Hydra are published to cache at
 https://cache.nixos.org/. When successful build and test criteria are

ci/OWNERS

@@ -0,0 +1,369 @@
+# This file is used to describe who owns what in this repository.
+# Users/teams will get review requests for PRs that change their files.
+#
+# This file does not replace `meta.maintainers`
+# but is instead used for other things than derivations and modules,
+# like documentation, package sets, and other assets.
+#
+# This file uses the same syntax as the natively supported CODEOWNERS file,
+# see https://help.github.com/articles/about-codeowners/ for documentation.
+# However it comes with some notable differences:
+# - There is no need for user/team listed here to have write access.
+# - No reviews will be requested for PRs that target the wrong base branch.
+#
+# Processing of this file is implemented in workflows/codeowners-v2.yml
+
+# CI
+/.github/workflows @NixOS/Security @Mic92 @zowoq
+/.github/workflows/check-nix-format.yml @infinisil
+/.github/workflows/codeowners-v2.yml @infinisil
+/ci/OWNERS @infinisil
+/ci @infinisil @philiptaron @NixOS/Security
+
+# Develompent support
+/.editorconfig @Mic92 @zowoq
+/shell.nix @infinisil @NixOS/Security
+
+# Libraries
+/lib                        @infinisil
+/lib/systems                @alyssais @ericson2314
+/lib/generators.nix         @infinisil @Profpatsch
+/lib/cli.nix                @infinisil @Profpatsch
+/lib/debug.nix              @infinisil @Profpatsch
+/lib/asserts.nix            @infinisil @Profpatsch
+/lib/path/*                 @infinisil
+/lib/fileset                @infinisil
+## Libraries / Module system
+/lib/modules.nix            @infinisil @roberth
+/lib/types.nix              @infinisil @roberth
+/lib/options.nix            @infinisil @roberth
+/lib/tests/modules.sh       @infinisil @roberth
+/lib/tests/modules          @infinisil @roberth
+
+# Nixpkgs Internals
+/default.nix                                     @Ericson2314
+/pkgs/top-level/default.nix                      @Ericson2314
+/pkgs/top-level/impure.nix                       @Ericson2314
+/pkgs/top-level/stage.nix                        @Ericson2314
+/pkgs/top-level/splice.nix                       @Ericson2314
+/pkgs/top-level/release-cross.nix                @Ericson2314
+/pkgs/stdenv/generic                             @Ericson2314
+/pkgs/stdenv/generic/check-meta.nix              @Ericson2314
+/pkgs/stdenv/cross                               @Ericson2314
+/pkgs/build-support/cc-wrapper                   @Ericson2314
+/pkgs/build-support/bintools-wrapper             @Ericson2314
+/pkgs/build-support/setup-hooks                  @Ericson2314
+/pkgs/build-support/setup-hooks/auto-patchelf.sh @layus
+/pkgs/build-support/setup-hooks/auto-patchelf.py @layus
+/pkgs/pkgs-lib                                   @infinisil
+## Format generators/serializers
+/pkgs/pkgs-lib/formats/libconfig                 @h7x4
+/pkgs/pkgs-lib/formats/hocon                     @h7x4
+
+# pkgs/by-name
+/pkgs/test/check-by-name @infinisil
+/pkgs/by-name/README.md @infinisil
+/pkgs/top-level/by-name-overlay.nix @infinisil
+/.github/workflows/check-by-name.yml @infinisil
+
+# Nixpkgs build-support
+/pkgs/build-support/writers @lassulus @Profpatsch
+
+# Nixpkgs make-disk-image
+/doc/build-helpers/images/makediskimage.section.md  @raitobezarius
+/nixos/lib/make-disk-image.nix                 @raitobezarius
+
+# Nix, the package manager
+# @raitobezarius is not "code owner", but is listed here to be notified of changes
+# pertaining to the Nix package manager.
+# i.e. no authority over those files.
+pkgs/tools/package-management/nix/                    @NixOS/nix-team @raitobezarius
+nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobezarius
+
+# Nixpkgs documentation
+/maintainers/scripts/db-to-md.sh @jtojnar @ryantm
+/maintainers/scripts/doc @jtojnar @ryantm
+
+# Contributor documentation
+/CONTRIBUTING.md @infinisil
+/.github/PULL_REQUEST_TEMPLATE.md @infinisil
+/doc/contributing/ @infinisil
+/doc/contributing/contributing-to-documentation.chapter.md @jtojnar @infinisil
+/lib/README.md @infinisil
+/doc/README.md @infinisil
+/nixos/README.md @infinisil
+/pkgs/README.md @infinisil
+/maintainers/README.md @infinisil
+
+# User-facing development documentation
+/doc/development.md @infinisil
+/doc/development @infinisil
+
+# NixOS Internals
+/nixos/default.nix                                    @infinisil
+/nixos/lib/from-env.nix                               @infinisil
+/nixos/lib/eval-config.nix                            @infinisil
+/nixos/modules/system/activation/bootspec.nix         @grahamc @cole-h @raitobezarius
+/nixos/modules/system/activation/bootspec.cue         @grahamc @cole-h @raitobezarius
+
+# NixOS integration test driver
+/nixos/lib/test-driver  @tfc
+
+# NixOS QEMU virtualisation
+/nixos/modules/virtualisation/qemu-vm.nix           @raitobezarius
+
+# Systemd
+/nixos/modules/system/boot/systemd.nix      @NixOS/systemd
+/nixos/modules/system/boot/systemd          @NixOS/systemd
+/nixos/lib/systemd-*.nix                    @NixOS/systemd
+/pkgs/os-specific/linux/systemd             @NixOS/systemd
+
+# Systemd-boot
+/nixos/modules/system/boot/loader/systemd-boot      @JulienMalka
+
+# Images and installer media
+/nixos/modules/installer/cd-dvd/
+/nixos/modules/installer/sd-card/
+
+# Updaters
+## update.nix
+/maintainers/scripts/update.nix   @jtojnar
+/maintainers/scripts/update.py    @jtojnar
+## common-updater-scripts
+/pkgs/common-updater/scripts/update-source-version    @jtojnar
+
+# Python-related code and docs
+/doc/languages-frameworks/python.section.md                 @mweinelt
+/pkgs/development/interpreters/python/hooks
+
+# Haskell
+/doc/languages-frameworks/haskell.section.md  @sternenseemann @maralorn @ncfavier
+/maintainers/scripts/haskell                  @sternenseemann @maralorn @ncfavier
+/pkgs/development/compilers/ghc               @sternenseemann @maralorn @ncfavier
+/pkgs/development/haskell-modules             @sternenseemann @maralorn @ncfavier
+/pkgs/test/haskell                            @sternenseemann @maralorn @ncfavier
+/pkgs/top-level/release-haskell.nix           @sternenseemann @maralorn @ncfavier
+/pkgs/top-level/haskell-packages.nix          @sternenseemann @maralorn @ncfavier
+
+# Perl
+/pkgs/development/interpreters/perl @stigtsp @zakame @marcusramberg
+/pkgs/top-level/perl-packages.nix   @stigtsp @zakame @marcusramberg
+/pkgs/development/perl-modules      @stigtsp @zakame @marcusramberg
+
+# R
+/pkgs/applications/science/math/R   @jbedo
+/pkgs/development/r-modules         @jbedo
+
+# Rust
+/pkgs/development/compilers/rust @Mic92 @zowoq @winterqt @figsoda
+/pkgs/build-support/rust @zowoq @winterqt @figsoda
+/doc/languages-frameworks/rust.section.md @zowoq @winterqt @figsoda
+
+# C compilers
+/pkgs/development/compilers/gcc
+/pkgs/development/compilers/emscripten @raitobezarius
+/doc/languages-frameworks/emscripten.section.md @raitobezarius
+
+# Audio
+/nixos/modules/services/audio/botamusique.nix @mweinelt
+/nixos/modules/services/audio/snapserver.nix @mweinelt
+/nixos/tests/botamusique.nix @mweinelt
+/nixos/tests/snapcast.nix @mweinelt
+
+# Browsers
+/pkgs/applications/networking/browsers/firefox @mweinelt
+/pkgs/applications/networking/browsers/chromium @emilylange
+/nixos/tests/chromium.nix @emilylange
+
+# Certificate Authorities
+pkgs/data/misc/cacert/ @ajs124 @lukegb @mweinelt
+pkgs/development/libraries/nss/ @ajs124 @lukegb @mweinelt
+pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
+
+# Jetbrains
+/pkgs/applications/editors/jetbrains @edwtjo
+
+# Licenses
+/lib/licenses.nix @alyssais
+
+# Qt
+/pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000 @ttuegel
+/pkgs/development/libraries/qt-6 @K900 @NickCao @SuperSandro2000 @ttuegel
+
+# KDE / Plasma 5
+/pkgs/applications/kde @K900 @NickCao @SuperSandro2000 @ttuegel
+/pkgs/desktops/plasma-5 @K900 @NickCao @SuperSandro2000 @ttuegel
+/pkgs/development/libraries/kde-frameworks @K900 @NickCao @SuperSandro2000 @ttuegel
+
+# KDE / Plasma 6
+/pkgs/kde @K900 @NickCao @SuperSandro2000 @ttuegel
+/maintainers/scripts/kde @K900 @NickCao @SuperSandro2000 @ttuegel
+
+# PostgreSQL and related stuff
+/pkgs/servers/sql/postgresql @thoughtpolice
+/nixos/modules/services/databases/postgresql.md @thoughtpolice
+/nixos/modules/services/databases/postgresql.nix @thoughtpolice
+/nixos/tests/postgresql.nix @thoughtpolice
+
+# Hardened profile & related modules
+/nixos/modules/profiles/hardened.nix                       @joachifm
+/nixos/modules/security/lock-kernel-modules.nix            @joachifm
+/nixos/modules/security/misc.nix                           @joachifm
+/nixos/tests/hardened.nix                                  @joachifm
+/pkgs/os-specific/linux/kernel/hardened/        @fabianhjr @joachifm
+
+# Home Automation
+/nixos/modules/services/home-automation/home-assistant.nix @mweinelt
+/nixos/modules/services/home-automation/zigbee2mqtt.nix @mweinelt
+/nixos/tests/home-assistant.nix @mweinelt
+/nixos/tests/zigbee2mqtt.nix @mweinelt
+/pkgs/servers/home-assistant @mweinelt
+/pkgs/tools/misc/esphome @mweinelt
+
+# Network Time Daemons
+/pkgs/tools/networking/chrony @thoughtpolice
+/pkgs/tools/networking/ntp @thoughtpolice
+/pkgs/tools/networking/openntpd @thoughtpolice
+/nixos/modules/services/networking/ntp @thoughtpolice
+
+# Network
+/pkgs/tools/networking/octodns @Janik-Haag
+/pkgs/tools/networking/kea/default.nix @mweinelt
+/pkgs/tools/networking/babeld/default.nix @mweinelt
+/nixos/modules/services/networking/babeld.nix @mweinelt
+/nixos/modules/services/networking/kea.nix @mweinelt
+/nixos/modules/services/networking/knot.nix @mweinelt
+nixos/modules/services/networking/networkmanager.nix @Janik-Haag
+/nixos/modules/services/monitoring/prometheus/exporters/kea.nix @mweinelt
+/nixos/tests/babeld.nix @mweinelt
+/nixos/tests/kea.nix @mweinelt
+/nixos/tests/knot.nix @mweinelt
+/nixos/tests/networking/* @Janik-Haag
+
+# Web servers
+/doc/packages/nginx.section.md @raitobezarius
+/pkgs/servers/http/nginx/ @raitobezarius
+/nixos/modules/services/web-servers/nginx/ @raitobezarius
+
+# Dhall
+/pkgs/development/dhall-modules      @Gabriella439 @Profpatsch @ehmry
+/pkgs/development/interpreters/dhall @Gabriella439 @Profpatsch @ehmry
+
+# Idris
+/pkgs/development/idris-modules @Infinisil
+
+# Bazel
+/pkgs/development/tools/build-managers/bazel @Profpatsch
+
+# NixOS modules for e-mail and dns services
+/nixos/modules/services/mail/mailman.nix    @peti
+/nixos/modules/services/mail/postfix.nix    @peti
+/nixos/modules/services/networking/bind.nix @peti
+/nixos/modules/services/mail/rspamd.nix     @peti
+
+# Emacs
+/pkgs/applications/editors/emacs/elisp-packages @adisbladis
+/pkgs/applications/editors/emacs                @adisbladis
+/pkgs/top-level/emacs-packages.nix              @adisbladis
+
+# Neovim
+/pkgs/applications/editors/neovim      @figsoda @teto
+
+# VimPlugins
+/pkgs/applications/editors/vim/plugins         @figsoda
+
+# VsCode Extensions
+/pkgs/applications/editors/vscode/extensions
+
+# PHP interpreter, packages, extensions, tests and documentation
+/doc/languages-frameworks/php.section.md          @aanderse @drupol @globin @ma27 @talyz
+/nixos/tests/php                                  @aanderse @drupol @globin @ma27 @talyz
+/pkgs/build-support/php/build-pecl.nix            @aanderse @drupol @globin @ma27 @talyz
+/pkgs/build-support/php                                     @drupol
+/pkgs/development/interpreters/php       @jtojnar @aanderse @drupol @globin @ma27 @talyz
+/pkgs/development/php-packages                    @aanderse @drupol @globin @ma27 @talyz
+/pkgs/top-level/php-packages.nix         @jtojnar @aanderse @drupol @globin @ma27 @talyz
+
+# Docker tools
+/pkgs/build-support/docker                   @roberth
+/nixos/tests/docker-tools*                   @roberth
+/doc/build-helpers/images/dockertools.section.md  @roberth
+
+# Blockchains
+/pkgs/applications/blockchains  @mmahut @RaghavSood
+
+# Go
+/doc/languages-frameworks/go.section.md @kalbasit @Mic92 @zowoq
+/pkgs/build-support/go @kalbasit @Mic92 @zowoq
+/pkgs/development/compilers/go @kalbasit @Mic92 @zowoq
+
+# GNOME
+/pkgs/desktops/gnome                              @jtojnar
+/pkgs/desktops/gnome/extensions                   @jtojnar
+/pkgs/build-support/make-hardcode-gsettings-patch @jtojnar
+
+# Cinnamon
+/pkgs/desktops/cinnamon @mkg20001
+
+# nim
+/pkgs/development/compilers/nim   @ehmry
+
+# terraform providers
+/pkgs/applications/networking/cluster/terraform-providers @zowoq
+
+# Forgejo
+nixos/modules/services/misc/forgejo.nix @adamcstephens @bendlas @emilylange
+pkgs/by-name/fo/forgejo/package.nix     @adamcstephens @bendlas @emilylange
+
+# Dotnet
+/pkgs/build-support/dotnet                  @corngood
+/pkgs/development/compilers/dotnet          @corngood
+/pkgs/test/dotnet                           @corngood
+/doc/languages-frameworks/dotnet.section.md @corngood
+
+# Node.js
+/pkgs/build-support/node/build-npm-package      @lilyinstarlight @winterqt
+/pkgs/build-support/node/fetch-npm-deps         @lilyinstarlight @winterqt
+/doc/languages-frameworks/javascript.section.md @lilyinstarlight @winterqt
+
+# environment.noXlibs option aka NoX
+/nixos/modules/config/no-x-libs.nix  @SuperSandro2000
+
+# OCaml
+/pkgs/build-support/ocaml           @ulrikstrid
+/pkgs/development/compilers/ocaml   @ulrikstrid
+/pkgs/development/ocaml-modules     @ulrikstrid
+
+# ZFS
+pkgs/os-specific/linux/zfs/2_1.nix        @raitobezarius
+pkgs/os-specific/linux/zfs/generic.nix    @raitobezarius
+nixos/modules/tasks/filesystems/zfs.nix   @raitobezarius
+nixos/tests/zfs.nix                       @raitobezarius
+
+# Zig
+/pkgs/development/compilers/zig @figsoda
+/doc/hooks/zig.section.md       @figsoda
+
+# Buildbot
+nixos/modules/services/continuous-integration/buildbot @Mic92 @zowoq
+nixos/tests/buildbot.nix                               @Mic92 @zowoq
+pkgs/development/tools/continuous-integration/buildbot @Mic92 @zowoq
+
+# Pretix
+pkgs/by-name/pr/pretix/ @mweinelt
+pkgs/by-name/pr/pretalx/ @mweinelt
+nixos/modules/services/web-apps/pretix.nix @mweinelt
+nixos/modules/services/web-apps/pretalx.nix @mweinelt
+nixos/tests/web-apps/pretix.nix @mweinelt
+nixos/tests/web-apps/pretalx.nix @mweinelt
+
+# incus/lxc/lxd
+nixos/maintainers/scripts/lxd/          @adamcstephens
+nixos/modules/virtualisation/incus.nix  @adamcstephens
+nixos/modules/virtualisation/lxc*       @adamcstephens
+nixos/modules/virtualisation/lxd*       @adamcstephens
+nixos/tests/incus/                      @adamcstephens
+nixos/tests/lxd/                        @adamcstephens
+pkgs/by-name/in/incus/                  @adamcstephens
+pkgs/by-name/lx/lxc*                    @adamcstephens
+pkgs/by-name/lx/lxd*                    @adamcstephens

ci/README.md

@@ -0,0 +1,12 @@
+# CI support files
+
+This directory contains files to support CI, such as [GitHub Actions](https://github.com/NixOS/nixpkgs/tree/master/.github/workflows) and [Ofborg](https://github.com/nixos/ofborg).
+This is in contrast with [`maintainers/scripts`](`../maintainers/scripts`) which is for human use instead.
+
+## Pinned Nixpkgs
+
+CI may need certain packages from Nixpkgs.
+In order to ensure that the needed packages are generally available without building,
+[`pinned-nixpkgs.json`](./pinned-nixpkgs.json) contains a pinned Nixpkgs version tested by Hydra.
+
+Run [`update-pinned-nixpkgs.sh`](./update-pinned-nixpkgs.sh) to update it.

ci/codeowners-validator/default.nix

@@ -0,0 +1,31 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  fetchpatch,
+}:
+buildGoModule {
+  name = "codeowners-validator";
+  src = fetchFromGitHub {
+    owner = "mszostok";
+    repo = "codeowners-validator";
+    rev = "f3651e3810802a37bd965e6a9a7210728179d076";
+    hash = "sha256-5aSmmRTsOuPcVLWfDF6EBz+6+/Qpbj66udAmi1CLmWQ=";
+  };
+  patches = [
+    # https://github.com/mszostok/codeowners-validator/pull/222
+    (fetchpatch {
+      name = "user-write-access-check";
+      url = "https://github.com/mszostok/codeowners-validator/compare/f3651e3810802a37bd965e6a9a7210728179d076...840eeb88b4da92bda3e13c838f67f6540b9e8529.patch";
+      hash = "sha256-t3Dtt8SP9nbO3gBrM0nRE7+G6N/ZIaczDyVHYAG/6mU=";
+    })
+    # Undoes part of the above PR: We don't want to require write access
+    # to the repository, that's only needed for GitHub's native CODEOWNERS.
+    # Furthermore, it removes an unneccessary check from the code
+    # that breaks tokens generated for GitHub Apps.
+    ./permissions.patch
+    # Allows setting a custom CODEOWNERS path using the OWNERS_FILE env var
+    ./owners-file-name.patch
+  ];
+  postPatch = "rm -r docs/investigation";
+  vendorHash = "sha256-R+pW3xcfpkTRqfS2ETVOwG8PZr0iH5ewroiF7u8hcYI=";
+}

ci/codeowners-validator/owners-file-name.patch

@@ -0,0 +1,15 @@
+diff --git a/pkg/codeowners/owners.go b/pkg/codeowners/owners.go
+index 6910bd2..e0c95e9 100644
+--- a/pkg/codeowners/owners.go
++++ b/pkg/codeowners/owners.go
+@@ -39,6 +39,10 @@ func NewFromPath(repoPath string) ([]Entry, error) {
+ // openCodeownersFile finds a CODEOWNERS file and returns content.
+ // see: https://help.github.com/articles/about-code-owners/#codeowners-file-location
+ func openCodeownersFile(dir string) (io.Reader, error) {
++	if file, ok := os.LookupEnv("OWNERS_FILE"); ok {
++		return fs.Open(file)
++	}
++
+ 	var detectedFiles []string
+ 	for _, p := range []string{".", "docs", ".github"} {
+ 		pth := path.Join(dir, p)

ci/codeowners-validator/permissions.patch

@@ -0,0 +1,36 @@
+diff --git a/internal/check/valid_owner.go b/internal/check/valid_owner.go
+index a264bcc..610eda8 100644
+--- a/internal/check/valid_owner.go
++++ b/internal/check/valid_owner.go
+@@ -16,7 +16,6 @@ import (
+ const scopeHeader = "X-OAuth-Scopes"
+ 
+ var reqScopes = map[github.Scope]struct{}{
+-	github.ScopeReadOrg: {},
+ }
+ 
+ type ValidOwnerConfig struct {
+@@ -223,10 +222,7 @@ func (v *ValidOwner) validateTeam(ctx context.Context, name string) *validateErr
+ 	for _, t := range v.repoTeams {
+ 		// GitHub normalizes name before comparison
+ 		if strings.EqualFold(t.GetSlug(), team) {
+-			if t.Permissions["push"] {
+-				return nil
+-			}
+-			return newValidateError("Team %q cannot review PRs on %q as neither it nor any parent team has write permissions.", team, v.orgRepoName)
++			return nil
+ 		}
+ 	}
+ 
+@@ -245,10 +241,7 @@ func (v *ValidOwner) validateGitHubUser(ctx context.Context, name string) *valid
+ 	for _, u := range v.repoUsers {
+ 		// GitHub normalizes name before comparison
+ 		if strings.EqualFold(u.GetLogin(), userName) {
+-			if u.Permissions["push"] {
+-				return nil
+-			}
+-			return newValidateError("User %q cannot review PRs on %q as they don't have write permissions.", userName, v.orgRepoName)
++			return nil
+ 		}
+ 	}
+ 

ci/default.nix

@@ -0,0 +1,29 @@
+let
+  pinnedNixpkgs = builtins.fromJSON (builtins.readFile ./pinned-nixpkgs.json);
+in
+{
+  system ? builtins.currentSystem,
+
+  nixpkgs ? null,
+}:
+let
+  nixpkgs' =
+    if nixpkgs == null then
+      fetchTarball {
+        url = "https://github.com/NixOS/nixpkgs/archive/${pinnedNixpkgs.rev}.tar.gz";
+        sha256 = pinnedNixpkgs.sha256;
+      }
+    else
+      nixpkgs;
+
+  pkgs = import nixpkgs' {
+    inherit system;
+    config = { };
+    overlays = [ ];
+  };
+in
+{
+  inherit pkgs;
+  requestReviews = pkgs.callPackage ./request-reviews { };
+  codeownersValidator = pkgs.callPackage ./codeowners-validator { };
+}

ci/pinned-nixpkgs.json

@@ -0,0 +1,4 @@
+{
+  "rev": "929116e316068c7318c54eb4d827f7d9756d5e9c",
+  "sha256": "1am61kcakn9j47435k4cgsarvypb8klv4avszxza0jn362hp3ck8"
+}

ci/request-reviews/default.nix

@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenvNoCC,
+  makeWrapper,
+  coreutils,
+  codeowners,
+  jq,
+  curl,
+  github-cli,
+  gitMinimal,
+}:
+stdenvNoCC.mkDerivation {
+  name = "request-reviews";
+  src = lib.fileset.toSource {
+    root = ./.;
+    fileset = lib.fileset.unions [
+      ./get-reviewers.sh
+      ./request-reviews.sh
+      ./verify-base-branch.sh
+      ./dev-branches.txt
+    ];
+  };
+  nativeBuildInputs = [ makeWrapper ];
+  dontBuild = true;
+  installPhase = ''
+    mkdir -p $out/bin
+    mv dev-branches.txt $out/bin
+    for bin in *.sh; do
+      mv "$bin" "$out/bin"
+      wrapProgram "$out/bin/$bin" \
+        --set PATH ${
+          lib.makeBinPath [
+            coreutils
+            codeowners
+            jq
+            curl
+            github-cli
+            gitMinimal
+          ]
+        }
+    done
+  '';
+}

ci/request-reviews/dev-branches.txt

@@ -0,0 +1,7 @@
+# Trusted development branches:
+# These generally require PRs to update and are built by Hydra.
+master
+staging
+release-*
+staging-*
+haskell-updates

ci/request-reviews/get-reviewers.sh

@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+
+# Get the code owners of the files changed by a PR,
+# suitable to be consumed by the API endpoint to request reviews:
+# https://docs.github.com/en/rest/pulls/review-requests?apiVersion=2022-11-28#request-reviewers-for-a-pull-request
+
+set -euo pipefail
+
+log() {
+    echo "$@" >&2
+}
+
+if (( "$#" < 7 )); then
+    log "Usage: $0 GIT_REPO OWNERS_FILE BASE_REPO BASE_REF HEAD_REF PR_NUMBER PR_AUTHOR"
+    exit 1
+fi
+
+gitRepo=$1
+ownersFile=$2
+baseRepo=$3
+baseRef=$4
+headRef=$5
+prNumber=$6
+prAuthor=$7
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' exit
+
+git -C "$gitRepo" diff --name-only --merge-base "$baseRef" "$headRef" > "$tmp/touched-files"
+readarray -t touchedFiles < "$tmp/touched-files"
+log "This PR touches ${#touchedFiles[@]} files"
+
+# Get the owners file from the base, because we don't want to allow PRs to
+# remove code owners to avoid pinging them
+git -C "$gitRepo" show "$baseRef":"$ownersFile" > "$tmp"/codeowners
+
+# Associative array with the user as the key for easy de-duplication
+# Make sure to always lowercase keys to avoid duplicates with different casings
+declare -A users=()
+
+for file in "${touchedFiles[@]}"; do
+    result=$(codeowners --file "$tmp"/codeowners "$file")
+
+    read -r file owners <<< "$result"
+    if [[ "$owners" == "(unowned)" ]]; then
+        log "File $file is unowned"
+        continue
+    fi
+    log "File $file is owned by $owners"
+
+    # Split up multiple owners, separated by arbitrary amounts of spaces
+    IFS=" " read -r -a entries <<< "$owners"
+
+    for entry in "${entries[@]}"; do
+        # GitHub technically also supports Emails as code owners,
+        # but we can't easily support that, so let's not
+        if [[ ! "$entry" =~ @(.*) ]]; then
+            warn -e "\e[33mCodeowner \"$entry\" for file $file is not valid: Must start with \"@\"\e[0m" >&2
+            # Don't fail, because the PR for which this script runs can't fix it,
+            # it has to be fixed in the base branch
+            continue
+        fi
+        # The first regex match is everything after the @
+        entry=${BASH_REMATCH[1]}
+
+        if [[ "$entry" =~ (.*)/(.*) ]]; then
+            # Teams look like $org/$team
+            org=${BASH_REMATCH[1]}
+            team=${BASH_REMATCH[2]}
+
+            # Instead of requesting a review from the team itself,
+            # we request reviews from the individual users.
+            # This is because once somebody from a team reviewed the PR,
+            # the API doesn't expose that the team was already requested for a review,
+            # so we wouldn't be able to avoid rerequesting reviews
+            # without saving some some extra state somewhere
+
+            # We could also consider implementing a more advanced heuristic
+            # in the future that e.g. only pings one team member,
+            # but escalates to somebody else if that member doesn't respond in time.
+            gh api \
+                --cache=1h \
+                -H "Accept: application/vnd.github+json" \
+                -H "X-GitHub-Api-Version: 2022-11-28" \
+                "/orgs/$org/teams/$team/members" \
+                --jq '.[].login' > "$tmp/team-members"
+            readarray -t members < "$tmp/team-members"
+            log "Team $entry has these members: ${members[*]}"
+
+            for user in "${members[@]}"; do
+                users[${user,,}]=
+            done
+        else
+            # Everything else is a user
+            users[${entry,,}]=
+        fi
+    done
+
+done
+
+# Cannot request a review from the author
+if [[ -v users[${prAuthor,,}] ]]; then
+    log "One or more files are owned by the PR author, ignoring"
+    unset 'users[${prAuthor,,}]'
+fi
+
+gh api \
+    -H "Accept: application/vnd.github+json" \
+    -H "X-GitHub-Api-Version: 2022-11-28" \
+    "/repos/$baseRepo/pulls/$prNumber/reviews" \
+    --jq '.[].user.login' > "$tmp/already-reviewed-by"
+
+# And we don't want to rerequest reviews from people who already reviewed
+while read -r user; do
+    if [[ -v users[${user,,}] ]]; then
+        log "User $user is a code owner but has already left a review, ignoring"
+        unset 'users[${user,,}]'
+    fi
+done < "$tmp/already-reviewed-by"
+
+# Turn it into a JSON for the GitHub API call to request PR reviewers
+jq -n \
+    --arg users "${!users[*]}" \
+    '{
+      reviewers: $users | split(" "),
+    }'

ci/request-reviews/request-reviews.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+
+# Requests reviews for a PR after verifying that the base branch is correct
+
+set -euo pipefail
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' exit
+SCRIPT_DIR=$(dirname "$0")
+
+log() {
+    echo "$@" >&2
+}
+
+effect() {
+    if [[ -n "${DRY_MODE:-}" ]]; then
+        log "Skipping in dry mode:" "${@@Q}"
+    else
+        "$@"
+    fi
+}
+
+if (( $# < 3 )); then
+    log "Usage: $0 GITHUB_REPO PR_NUMBER OWNERS_FILE"
+    exit 1
+fi
+baseRepo=$1
+prNumber=$2
+ownersFile=$3
+
+log "Fetching PR info"
+prInfo=$(gh api \
+  -H "Accept: application/vnd.github+json" \
+  -H "X-GitHub-Api-Version: 2022-11-28" \
+  "/repos/$baseRepo/pulls/$prNumber")
+
+baseBranch=$(jq -r .base.ref <<< "$prInfo")
+log "Base branch: $baseBranch"
+prRepo=$(jq -r .head.repo.full_name <<< "$prInfo")
+log "PR repo: $prRepo"
+prBranch=$(jq -r .head.ref <<< "$prInfo")
+log "PR branch: $prBranch"
+prAuthor=$(jq -r .user.login <<< "$prInfo")
+log "PR author: $prAuthor"
+
+extraArgs=()
+if pwdRepo=$(git rev-parse --show-toplevel 2>/dev/null); then
+    # Speedup for local runs
+    extraArgs+=(--reference-if-able "$pwdRepo")
+fi
+
+log "Fetching Nixpkgs commit history"
+# We only need the commit history, not the contents, so we can do a tree-less clone using tree:0
+# https://github.blog/open-source/git/get-up-to-speed-with-partial-clone-and-shallow-clone/#user-content-quick-summary
+git clone --bare --filter=tree:0 --no-tags --origin upstream "${extraArgs[@]}" https://github.com/"$baseRepo".git "$tmp"/nixpkgs.git
+
+log "Fetching the PR commit history"
+# Fetch the PR
+git -C "$tmp/nixpkgs.git" remote add fork https://github.com/"$prRepo".git
+# This remote config is the same as --filter=tree:0 when cloning
+git -C "$tmp/nixpkgs.git" config remote.fork.partialclonefilter tree:0
+git -C "$tmp/nixpkgs.git" config remote.fork.promisor true
+
+git -C "$tmp/nixpkgs.git" fetch --no-tags fork "$prBranch"
+headRef=$(git -C "$tmp/nixpkgs.git" rev-parse refs/remotes/fork/"$prBranch")
+
+log "Checking correctness of the base branch"
+if ! "$SCRIPT_DIR"/verify-base-branch.sh "$tmp/nixpkgs.git" "$headRef" "$baseRepo" "$baseBranch" "$prRepo" "$prBranch" | tee "$tmp/invalid-base-error" >&2; then
+    log "Posting error as comment"
+    if ! response=$(effect gh api \
+        --method POST \
+        -H "Accept: application/vnd.github+json" \
+        -H "X-GitHub-Api-Version: 2022-11-28" \
+        "/repos/$baseRepo/issues/$prNumber/comments" \
+        -F "body=@$tmp/invalid-base-error"); then
+        log "Failed to post the comment: $response"
+    fi
+    exit 1
+fi
+
+log "Getting code owners to request reviews from"
+"$SCRIPT_DIR"/get-reviewers.sh "$tmp/nixpkgs.git" "$ownersFile" "$baseRepo" "$baseBranch" "$headRef" "$prNumber" "$prAuthor" > "$tmp/reviewers.json"
+
+log "Requesting reviews from: $(<"$tmp/reviewers.json")"
+
+if ! response=$(effect gh api \
+    --method POST \
+    -H "Accept: application/vnd.github+json" \
+    -H "X-GitHub-Api-Version: 2022-11-28" \
+    "/repos/$baseRepo/pulls/$prNumber/requested_reviewers" \
+    --input "$tmp/reviewers.json"); then
+    log "Failed to request reviews: $response"
+    exit 1
+fi
+
+log "Successfully requested reviews"

ci/request-reviews/verify-base-branch.sh

@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+
+# Check that a PR doesn't include commits from other development branches.
+# Fails with next steps if it does
+
+set -euo pipefail
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' exit
+SCRIPT_DIR=$(dirname "$0")
+
+log() {
+    echo "$@" >&2
+}
+
+# Small helper to check whether an element is in a list
+# Usage: `elementIn foo "${list[@]}"`
+elementIn() {
+    local e match=$1
+    shift
+    for e; do
+        if [[ "$e" == "$match" ]]; then
+            return 0
+        fi
+    done
+    return 1
+}
+
+if (( $# < 6 )); then
+    log "Usage: $0 LOCAL_REPO HEAD_REF BASE_REPO BASE_BRANCH PR_REPO PR_BRANCH"
+    exit 1
+fi
+localRepo=$1
+headRef=$2
+baseRepo=$3
+baseBranch=$4
+prRepo=$5
+prBranch=$6
+
+# All development branches
+devBranchPatterns=()
+while read -r pattern; do
+    if [[ "$pattern" != '#'* ]]; then
+        devBranchPatterns+=("$pattern")
+    fi
+done < "$SCRIPT_DIR/dev-branches.txt"
+
+git -C "$localRepo" branch --list --format "%(refname:short)" "${devBranchPatterns[@]}" > "$tmp/dev-branches"
+readarray -t devBranches < "$tmp/dev-branches"
+
+if [[ "$baseRepo" == "$prRepo" ]] && elementIn "$prBranch" "${devBranches[@]}"; then
+    log "This PR merges $prBranch into $baseBranch, no commit check necessary"
+    exit 0
+fi
+
+# The current merge base of the PR
+prMergeBase=$(git -C "$localRepo" merge-base "$baseBranch" "$headRef")
+log "The PR's merge base with the base branch $baseBranch is $prMergeBase"
+
+# This is purely for debugging
+git -C "$localRepo" rev-list --reverse "$baseBranch".."$headRef" > "$tmp/pr-commits"
+log "The PR includes these $(wc -l < "$tmp/pr-commits") commits:"
+cat <"$tmp/pr-commits" >&2
+
+for testBranch in "${devBranches[@]}"; do
+
+    if [[ -z "$(git -C "$localRepo" rev-list -1 --since="1 month ago" "$testBranch")" ]]; then
+        log "Not checking $testBranch, was inactive for the last month"
+        continue
+    fi
+    log "Checking if commits from $testBranch are included in the PR"
+
+    # We need to check for any commits that are in the PR which are also in the test branch.
+    # We could check each commit from the PR individually, but that's unnecessarily slow.
+    #
+    # This does _almost_ what we want: `git rev-list --count headRef testBranch ^baseBranch`,
+    # except that it includes commits that are reachable from _either_ headRef or testBranch,
+    # instead of restricting it to ones reachable by both
+
+    # Easily fixable though, because we can use `git merge-base testBranch headRef`
+    # to get the least common ancestor (aka merge base) commit reachable by both.
+    # If the branch being tested is indeed the right base branch,
+    # this is then also the commit from that branch that the PR is based on top of.
+    testMergeBase=$(git -C "$localRepo" merge-base "$testBranch" "$headRef")
+
+    # And then use the `git rev-list --count`, but replacing the non-working
+    # `headRef testBranch` with the merge base of the two.
+    extraCommits=$(git -C "$localRepo" rev-list --count "$testMergeBase" ^"$baseBranch")
+
+    if (( extraCommits != 0 )); then
+        log -e "\e[33m"
+        echo "The PR's base branch is set to $baseBranch, but $extraCommits commits from the $testBranch branch are included. Make sure you know the [right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions), then:"
+        echo "- If the changes should go to the $testBranch branch, [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to $testBranch"
+        echo "- If the changes should go to the $baseBranch branch, rebase your PR onto the merge base with the $baseBranch branch:"
+        echo "  \`\`\`bash"
+        echo "  # git rebase --onto \$(git merge-base upstream/$baseBranch HEAD) \$(git merge-base upstream/$testBranch HEAD)"
+        echo "  git rebase --onto $prMergeBase $testMergeBase"
+        echo "  git push --force-with-lease"
+        echo "  \`\`\`"
+        log -e "\e[m"
+        exit 1
+    fi
+done
+
+log "Base branch is correct, no commits from development branches are included"

ci/update-pinned-nixpkgs.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p jq
+
+set -euo pipefail
+
+# https://stackoverflow.com/a/246128
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+repo=https://github.com/nixos/nixpkgs
+branch=nixpkgs-unstable
+file=$SCRIPT_DIR/pinned-nixpkgs.json
+
+defaultRev=$(git ls-remote "$repo" refs/heads/"$branch" | cut -f1)
+rev=${1:-$defaultRev}
+sha256=$(nix-prefetch-url --unpack "$repo/archive/$rev.tar.gz" --name source)
+
+jq -n --arg rev "$rev" --arg sha256 "$sha256" '$ARGS.named' | tee /dev/stderr > $file

default.nix

@@ -1,6 +1,8 @@
-let requiredVersion = import ./lib/minver.nix; in
+let
+  requiredVersion = import ./lib/minver.nix;
+in
 
-if ! builtins ? nixVersion || builtins.compareVersions requiredVersion builtins.nixVersion == 1 then
+if !builtins ? nixVersion || builtins.compareVersions requiredVersion builtins.nixVersion == 1 then
 
   abort ''
 

doc/build-helpers/images/makediskimage.section.md

@@ -85,14 +85,14 @@ let
 in
   make-disk-image {
     inherit pkgs lib;
-    config = evalConfig {
+    inherit (evalConfig {
       modules = [
         {
           fileSystems."/" = { device = "/dev/vda"; fsType = "ext4"; autoFormat = true; };
           boot.grub.device = "/dev/vda";
         }
       ];
-    };
+    }) config;
     format = "qcow2";
     onlyNixStore = false;
     partitionTableType = "legacy+gpt";
@@ -104,5 +104,3 @@ in
     memSize = 2048; # Qemu VM memory size in megabytes. Defaults to 1024M.
   }
 ```
-
-

doc/build-helpers/special/makesetuphook.section.md

@@ -9,22 +9,40 @@ pkgs.makeSetupHook {
   name = "something-hook";
   propagatedBuildInputs = [ pkgs.commandsomething ];
   depsTargetTargetPropagated = [ pkgs.libsomething ];
-} ./script.sh
+} ./script.sh;
 ```
 
 ### setup hook that depends on the hello package and runs hello and @shell@ is substituted with path to bash {#sec-pkgs.makeSetupHook-usage-example}
 
 ```nix
-pkgs.makeSetupHook {
+pkgs.makeSetupHook
+  {
     name = "run-hello-hook";
-    propagatedBuildInputs = [ pkgs.hello ];
-    substitutions = { shell = "${pkgs.bash}/bin/bash"; };
-    passthru.tests.greeting = callPackage ./test { };
-    meta.platforms = lib.platforms.linux;
-} (writeScript "run-hello-hook.sh" ''
-    #!@shell@
-    hello
-'')
+    # Put dependencies here if they have hooks or necessary dependencies propagated
+    # otherwise prefer direct paths to executables.
+    propagatedBuildInputs = [
+      pkgs.hello
+      pkgs.cowsay
+    ];
+    substitutions = {
+      shell = "${pkgs.bash}/bin/bash";
+      cowsay = "${pkgs.cowsay}/bin/cowsay";
+    };
+  }
+  (
+    writeScript "run-hello-hook.sh" ''
+      #!@shell@
+      # the direct path to the executable has to be here because
+      # this will be run when the file is sourced
+      # at which point '$PATH' has not yet been populated with inputs
+      @cowsay@ cow
+
+      _printHelloHook() {
+        hello
+      }
+      preConfigureHooks+=(_printHelloHook)
+    ''
+  );
 ```
 
 ## Attributes {#sec-pkgs.makeSetupHook-attributes}

doc/build-helpers/testers.chapter.md

@@ -40,6 +40,131 @@ If the `moduleNames` argument is omitted, `hasPkgConfigModules` will use `meta.p
 
 :::
 
+## `lycheeLinkCheck` {#tester-lycheeLinkCheck}
+
+Check a packaged static site's links with the [`lychee` package](https://search.nixos.org/packages?show=lychee&type=packages&query=lychee).
+
+You may use Nix to reproducibly build static websites, such as for software documentation.
+Some packages will install documentation in their `out` or `doc` outputs, or maybe you have dedicated package where you've made your static site reproducible by running a generator, such as [Hugo](https://gohugo.io/) or [mdBook](https://rust-lang.github.io/mdBook/), in a derivation.
+
+If you have a static site that can be built with Nix, you can use `lycheeLinkCheck` to check that the hyperlinks in your site are correct, and do so as part of your Nix workflow and CI.
+
+:::{.example #ex-lycheelinkcheck}
+
+# Check hyperlinks in the `nix` documentation
+
+```nix
+testers.lycheeLinkCheck {
+  site = nix.doc + "/share/doc/nix/manual";
+}
+```
+
+:::
+
+### Return value {#tester-lycheeLinkCheck-return}
+
+This tester produces a package that does not produce useful outputs, but only succeeds if the hyperlinks in your site are correct. The build log will list the broken links.
+
+It has two modes:
+
+- Build the returned derivation; its build process will check that internal hyperlinks are correct. This runs in the sandbox, so it will not check external hyperlinks, but it is quick and reliable.
+
+- Invoke the `.online` attribute with [`nix run`](https://nixos.org/manual/nix/stable/command-ref/new-cli/nix3-run) ([experimental](https://nixos.org/manual/nix/stable/contributing/experimental-features#xp-feature-nix-command)). This runs outside the sandbox, and checks that both internal and external hyperlinks are correct.
+  Example:
+
+  ```shell
+  nix run nixpkgs#lychee.tests.ok.online
+  ```
+
+### Inputs {#tester-lycheeLinkCheck-inputs}
+
+`site` (path or derivation) {#tester-lycheeLinkCheck-param-site}
+
+: The path to the files to check.
+
+`remap` (attribe set, optional) {#tester-lycheeLinkCheck-param-remap}
+
+: An attribute set where the attribute names are regular expressions.
+  The values should be strings, derivations, or path values.
+
+  In the returned check's default configuration, external URLs are only checked when you run the `.online` attribute.
+
+  By adding remappings, you can check offline that URLs to external resources are correct, by providing a stand-in from the file system.
+
+  Before checking the existence of a URL, the regular expressions are matched and replaced by their corresponding values.
+
+  Example:
+
+  ```nix
+  {
+    "https://nix\\.dev/manual/nix/[a-z0-9.-]*" = "${nix.doc}/share/doc/nix/manual";
+    "https://nixos\\.org/manual/nix/(un)?stable" = "${emptyDirectory}/placeholder-to-disallow-old-nix-docs-urls";
+  }
+  ```
+
+  Store paths in the attribute values are automatically prefixed with `file://`, because lychee requires this for paths in the file system.
+  If this is a problem, or if you need to control the order in which replacements are performed, use `extraConfig.remap` instead.
+
+`extraConfig` (attribute set) {#tester-lycheeLinkCheck-param-extraConfig}
+
+: Extra configuration to pass to `lychee` in its [configuration file](https://github.com/lycheeverse/lychee/blob/master/lychee.example.toml).
+  It is automatically [translated](https://nixos.org/manual/nixos/stable/index.html#sec-settings-nix-representable) to TOML.
+
+  Example: `{ "include_verbatim" = true; }`
+
+`lychee` (derivation, optional) {#tester-lycheeLinkCheck-param-lychee}
+
+: The `lychee` package to use.
+
+## `shellcheck` {#tester-shellcheck}
+
+Runs files through `shellcheck`, a static analysis tool for shell scripts.
+
+:::{.example #ex-shellcheck}
+# Run `testers.shellcheck`
+
+A single script
+
+```nix
+testers.shellcheck {
+  name = "shellcheck";
+  src = ./script.sh;
+}
+```
+
+Multiple files
+
+```nix
+let
+  inherit (lib) fileset;
+in
+testers.shellcheck {
+  name = "shellcheck";
+  src = fileset.toSource {
+    root = ./.;
+    fileset = fileset.unions [
+      ./lib.sh
+      ./nixbsd-activate
+    ];
+  };
+}
+```
+
+:::
+
+### Inputs {#tester-shellcheck-inputs}
+
+[`src` (path or string)]{#tester-shellcheck-param-src}
+
+: The path to the shell script(s) to check.
+  This can be a single file or a directory containing shell files.
+  All files in `src` will be checked, so you may want to provide `fileset`-based source instead of a whole directory.
+
+### Return value {#tester-shellcheck-return}
+
+A derivation that runs `shellcheck` on the given script(s).
+The build will fail if `shellcheck` finds any issues.
+
 ## `testVersion` {#tester-testVersion}
 
 Checks that the output from running a command contains the specified version string in it as a whole word.
@@ -129,7 +254,7 @@ runCommand "example" {
 
 :::
 
-## `testEqualContents` {#tester-equalContents}
+## `testEqualContents` {#tester-testEqualContents}
 
 Check that two paths have the same contents.
 

doc/default.nix

@@ -1,4 +1,7 @@
-{ pkgs ? (import ./.. { }), nixpkgs ? { }}:
+{
+  pkgs ? (import ./.. { }),
+  nixpkgs ? { },
+}:
 let
   inherit (pkgs) lib;
   inherit (lib) hasPrefix removePrefix;
@@ -8,91 +11,162 @@ let
   lib-docs = import ./doc-support/lib-function-docs.nix {
     inherit pkgs nixpkgs;
     libsets = [
-      { name = "asserts"; description = "assertion functions"; }
-      { name = "attrsets"; description = "attribute set functions"; }
-      { name = "strings"; description = "string manipulation functions"; }
-      { name = "versions"; description = "version string functions"; }
-      { name = "trivial"; description = "miscellaneous functions"; }
-      { name = "fixedPoints"; baseName = "fixed-points"; description = "explicit recursion functions"; }
-      { name = "lists"; description = "list manipulation functions"; }
-      { name = "debug"; description = "debugging functions"; }
-      { name = "options"; description = "NixOS / nixpkgs option handling"; }
-      { name = "path"; description = "path functions"; }
-      { name = "filesystem"; description = "filesystem functions"; }
-      { name = "fileset"; description = "file set functions"; }
-      { name = "sources"; description = "source filtering functions"; }
-      { name = "cli"; description = "command-line serialization functions"; }
-      { name = "gvariant"; description = "GVariant formatted string serialization functions"; }
-      { name = "customisation"; description = "Functions to customise (derivation-related) functions, derivatons, or attribute sets"; }
-      { name = "meta"; description = "functions for derivation metadata"; }
-      { name = "derivations"; description = "miscellaneous derivation-specific functions"; }
+      {
+        name = "asserts";
+        description = "assertion functions";
+      }
+      {
+        name = "attrsets";
+        description = "attribute set functions";
+      }
+      {
+        name = "strings";
+        description = "string manipulation functions";
+      }
+      {
+        name = "versions";
+        description = "version string functions";
+      }
+      {
+        name = "trivial";
+        description = "miscellaneous functions";
+      }
+      {
+        name = "fixedPoints";
+        baseName = "fixed-points";
+        description = "explicit recursion functions";
+      }
+      {
+        name = "lists";
+        description = "list manipulation functions";
+      }
+      {
+        name = "debug";
+        description = "debugging functions";
+      }
+      {
+        name = "options";
+        description = "NixOS / nixpkgs option handling";
+      }
+      {
+        name = "path";
+        description = "path functions";
+      }
+      {
+        name = "filesystem";
+        description = "filesystem functions";
+      }
+      {
+        name = "fileset";
+        description = "file set functions";
+      }
+      {
+        name = "sources";
+        description = "source filtering functions";
+      }
+      {
+        name = "cli";
+        description = "command-line serialization functions";
+      }
+      {
+        name = "gvariant";
+        description = "GVariant formatted string serialization functions";
+      }
+      {
+        name = "customisation";
+        description = "Functions to customise (derivation-related) functions, derivatons, or attribute sets";
+      }
+      {
+        name = "meta";
+        description = "functions for derivation metadata";
+      }
+      {
+        name = "derivations";
+        description = "miscellaneous derivation-specific functions";
+      }
     ];
   };
 
-  epub = pkgs.runCommand "manual.epub" {
-    nativeBuildInputs = with pkgs; [ libxslt zip ];
+  epub =
+    pkgs.runCommand "manual.epub"
+      {
+        nativeBuildInputs = with pkgs; [
+          libxslt
+          zip
+        ];
 
-    epub = ''
-      <book xmlns="http://docbook.org/ns/docbook"
-            xmlns:xlink="http://www.w3.org/1999/xlink"
-            version="5.0"
-            xml:id="nixpkgs-manual">
-        <info>
-          <title>Nixpkgs Manual</title>
-          <subtitle>Version ${pkgs.lib.version}</subtitle>
-        </info>
-        <chapter>
-          <title>Temporarily unavailable</title>
-          <para>
-            The Nixpkgs manual is currently not available in EPUB format,
-            please use the <link xlink:href="https://nixos.org/nixpkgs/manual">HTML manual</link>
-            instead.
-          </para>
-          <para>
-            If you've used the EPUB manual in the past and it has been useful to you, please
-            <link xlink:href="https://github.com/NixOS/nixpkgs/issues/237234">let us know</link>.
-          </para>
-        </chapter>
-      </book>
-    '';
+        epub = ''
+          <book xmlns="http://docbook.org/ns/docbook"
+                xmlns:xlink="http://www.w3.org/1999/xlink"
+                version="5.0"
+                xml:id="nixpkgs-manual">
+            <info>
+              <title>Nixpkgs Manual</title>
+              <subtitle>Version ${pkgs.lib.version}</subtitle>
+            </info>
+            <chapter>
+              <title>Temporarily unavailable</title>
+              <para>
+                The Nixpkgs manual is currently not available in EPUB format,
+                please use the <link xlink:href="https://nixos.org/nixpkgs/manual">HTML manual</link>
+                instead.
+              </para>
+              <para>
+                If you've used the EPUB manual in the past and it has been useful to you, please
+                <link xlink:href="https://github.com/NixOS/nixpkgs/issues/237234">let us know</link>.
+              </para>
+            </chapter>
+          </book>
+        '';
 
-    passAsFile = [ "epub" ];
-  } ''
-    mkdir scratch
-    xsltproc \
-      --param chapter.autolabel 0 \
-      --nonet \
-      --output scratch/ \
-      ${pkgs.docbook_xsl_ns}/xml/xsl/docbook/epub/docbook.xsl \
-      $epubPath
+        passAsFile = [ "epub" ];
+      }
+      ''
+        mkdir scratch
+        xsltproc \
+          --param chapter.autolabel 0 \
+          --nonet \
+          --output scratch/ \
+          ${pkgs.docbook_xsl_ns}/xml/xsl/docbook/epub/docbook.xsl \
+          $epubPath
 
-    echo "application/epub+zip" > mimetype
-    zip -0Xq "$out" mimetype
-    cd scratch && zip -Xr9D "$out" *
-  '';
+        echo "application/epub+zip" > mimetype
+        zip -0Xq "$out" mimetype
+        cd scratch && zip -Xr9D "$out" *
+      '';
 
   # NB: This file describes the Nixpkgs manual, which happens to use module
   #     docs infra originally developed for NixOS.
   optionsDoc = pkgs.nixosOptionsDoc {
-    inherit (pkgs.lib.evalModules {
-      modules = [ ../pkgs/top-level/config.nix ];
-      class = "nixpkgsConfig";
-    }) options;
+    inherit
+      (pkgs.lib.evalModules {
+        modules = [ ../pkgs/top-level/config.nix ];
+        class = "nixpkgsConfig";
+      })
+      options
+      ;
     documentType = "none";
-    transformOptions = opt:
-      opt // {
-        declarations =
-          map
-            (decl:
-              if hasPrefix (toString ../..) (toString decl)
-              then
-                let subpath = removePrefix "/" (removePrefix (toString ../.) (toString decl));
-                in { url = "https://github.com/NixOS/nixpkgs/blob/master/${subpath}"; name = subpath; }
-              else decl)
-            opt.declarations;
-        };
+    transformOptions =
+      opt:
+      opt
+      // {
+        declarations = map (
+          decl:
+          if hasPrefix (toString ../..) (toString decl) then
+            let
+              subpath = removePrefix "/" (removePrefix (toString ../.) (toString decl));
+            in
+            {
+              url = "https://github.com/NixOS/nixpkgs/blob/master/${subpath}";
+              name = subpath;
+            }
+          else
+            decl
+        ) opt.declarations;
+      };
   };
-in pkgs.stdenv.mkDerivation {
+in
+pkgs.stdenv.mkDerivation {
   name = "nixpkgs-manual";
 
   nativeBuildInputs = with pkgs; [
@@ -152,25 +226,36 @@ in pkgs.stdenv.mkDerivation {
     echo "doc manual $dest nixpkgs-manual.epub" >> $out/nix-support/hydra-build-products
   '';
 
-  passthru.tests.manpage-urls = with pkgs; testers.invalidateFetcherByDrvHash
-    ({ name ? "manual_check-manpage-urls"
-     , script
-     , urlsFile
-     }: runCommand name {
-      nativeBuildInputs = [
-        cacert
-        (python3.withPackages (p: with p; [
-          aiohttp
-          rich
-          structlog
-        ]))
-      ];
-      outputHash = "sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=";  # Empty output
-    } ''
-      python3 ${script} ${urlsFile}
-      touch $out
-    '') {
-      script = ./tests/manpage-urls.py;
-      urlsFile = ./manpage-urls.json;
-    };
+  passthru.tests.manpage-urls =
+    with pkgs;
+    testers.invalidateFetcherByDrvHash
+      (
+        {
+          name ? "manual_check-manpage-urls",
+          script,
+          urlsFile,
+        }:
+        runCommand name
+          {
+            nativeBuildInputs = [
+              cacert
+              (python3.withPackages (
+                p: with p; [
+                  aiohttp
+                  rich
+                  structlog
+                ]
+              ))
+            ];
+            outputHash = "sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU="; # Empty output
+          }
+          ''
+            python3 ${script} ${urlsFile}
+            touch $out
+          ''
+      )
+      {
+        script = ./tests/manpage-urls.py;
+        urlsFile = ./manpage-urls.json;
+      };
 }

doc/doc-support/lib-function-locations.nix

@@ -1,75 +1,85 @@
-{ pkgs, nixpkgs ? { }, libsets }:
+{
+  pkgs,
+  nixpkgs ? { },
+  libsets,
+}:
 let
   revision = pkgs.lib.trivial.revisionWithDefault (nixpkgs.rev or "master");
 
-  libDefPos = prefix: set:
-    builtins.concatMap
-      (name: [{
-        name = builtins.concatStringsSep "." (prefix ++ [name]);
-        location = builtins.unsafeGetAttrPos name set;
-      }] ++ nixpkgsLib.optionals
-        (builtins.length prefix == 0 && builtins.isAttrs set.${name})
-        (libDefPos (prefix ++ [name]) set.${name})
-      ) (builtins.attrNames set);
+  libDefPos =
+    prefix: set:
+    builtins.concatMap (
+      name:
+      [
+        {
+          name = builtins.concatStringsSep "." (prefix ++ [ name ]);
+          location = builtins.unsafeGetAttrPos name set;
+        }
+      ]
+      ++ nixpkgsLib.optionals (builtins.length prefix == 0 && builtins.isAttrs set.${name}) (
+        libDefPos (prefix ++ [ name ]) set.${name}
+      )
+    ) (builtins.attrNames set);
 
-  libset = toplib:
-    builtins.map
-      (subsetname: {
-        subsetname = subsetname;
-        functions = libDefPos [] toplib.${subsetname};
-      })
-      (builtins.map (x: x.name) libsets);
+  libset =
+    toplib:
+    builtins.map (subsetname: {
+      subsetname = subsetname;
+      functions = libDefPos [ ] toplib.${subsetname};
+    }) (builtins.map (x: x.name) libsets);
 
   nixpkgsLib = pkgs.lib;
 
-  flattenedLibSubset = { subsetname, functions }:
-  builtins.map
-    (fn: {
+  flattenedLibSubset =
+    { subsetname, functions }:
+    builtins.map (fn: {
       name = "lib.${subsetname}.${fn.name}";
       value = fn.location;
-    })
-    functions;
+    }) functions;
 
   locatedlibsets = libs: builtins.map flattenedLibSubset (libset libs);
-  removeFilenamePrefix = prefix: filename:
+  removeFilenamePrefix =
+    prefix: filename:
     let
-    prefixLen = (builtins.stringLength prefix) + 1; # +1 to remove the leading /
+      prefixLen = (builtins.stringLength prefix) + 1; # +1 to remove the leading /
       filenameLen = builtins.stringLength filename;
       substr = builtins.substring prefixLen filenameLen filename;
-      in substr;
+    in
+    substr;
 
   removeNixpkgs = removeFilenamePrefix (builtins.toString pkgs.path);
 
-  liblocations =
-    builtins.filter
-      (elem: elem.value != null)
-      (nixpkgsLib.lists.flatten
-        (locatedlibsets nixpkgsLib));
+  liblocations = builtins.filter (elem: elem.value != null) (
+    nixpkgsLib.lists.flatten (locatedlibsets nixpkgsLib)
+  );
 
-  fnLocationRelative = { name, value }:
+  fnLocationRelative =
+    { name, value }:
     {
       inherit name;
-      value = value // { file = removeNixpkgs value.file; };
+      value = value // {
+        file = removeNixpkgs value.file;
+      };
     };
 
   relativeLocs = (builtins.map fnLocationRelative liblocations);
-  sanitizeId = builtins.replaceStrings
-    [ "'"      ]
-    [ "-prime" ];
+  sanitizeId = builtins.replaceStrings [ "'" ] [ "-prime" ];
 
   urlPrefix = "https://github.com/NixOS/nixpkgs/blob/${revision}";
-  jsonLocs = builtins.listToAttrs
-    (builtins.map
-      ({ name, value }: {
+  jsonLocs = builtins.listToAttrs (
+    builtins.map (
+      { name, value }:
+      {
         name = sanitizeId name;
         value =
           let
             text = "${value.file}:${builtins.toString value.line}";
             target = "${urlPrefix}/${value.file}#L${builtins.toString value.line}";
           in
-            "[${text}](${target}) in `<nixpkgs>`";
-      })
-    relativeLocs);
+          "[${text}](${target}) in `<nixpkgs>`";
+      }
+    ) relativeLocs
+  );
 
 in
 pkgs.writeText "locations.json" (builtins.toJSON jsonLocs)

doc/hooks/desktop-file-utils.section.md

@@ -0,0 +1,5 @@
+# desktop-file-utils {#desktop-file-utils}
+
+This setup hook removes the MIME cache (located at `$out/share/applications/mimeinfo.cache`) in the `preFixupPhase`.
+
+This hook is necessary because `mimeinfo.cache` can be created when a package uses `desktop-file-utils`, resulting in collisions if multiple packages are installed that contain this file (as in [#48295](https://github.com/NixOS/nixpkgs/issues/48295)).

doc/hooks/index.md

@@ -11,6 +11,7 @@ autopatchelf.section.md
 bmake.section.md
 breakpoint.section.md
 cmake.section.md
+desktop-file-utils.section.md
 gdk-pixbuf.section.md
 ghc.section.md
 gnome.section.md

doc/languages-frameworks/dart.section.md

@@ -98,10 +98,12 @@ The function `buildFlutterApplication` builds Flutter applications.
 
 See the [Dart documentation](#ssec-dart-applications) for more details on required files and arguments.
 
+`flutter` in Nixpkgs always points to `flutterPackages.stable`, which is the latest packaged version. To avoid unforeseen breakage during upgrade, packages in Nixpkgs should use a specific flutter version, such as `flutter319` and `flutter322`, instead of using `flutter` directly.
+
 ```nix
 {  flutter, fetchFromGitHub }:
 
-flutter.buildFlutterApplication {
+flutter322.buildFlutterApplication {
   pname = "firmware-updater";
   version = "0-unstable-2023-04-30";
 

doc/languages-frameworks/haskell.section.md

@@ -923,14 +923,64 @@ for this to work.
 
 `justStaticExecutables drv`
 : Only build and install the executables produced by `drv`, removing everything
-that may refer to other Haskell packages' store paths (like libraries and
-documentation). This dramatically reduces the closure size of the resulting
-derivation. Note that the executables are only statically linked against their
-Haskell dependencies, but will still link dynamically against libc, GMP and
-other system library dependencies. If dependencies use their Cabal-generated
-`Paths_*` module, this may not work as well if GHC's dead code elimination
-is unable to remove the references to the dependency's store path that module
-contains.
+  that may refer to other Haskell packages' store paths (like libraries and
+  documentation). This dramatically reduces the closure size of the resulting
+  derivation. Note that the executables are only statically linked against their
+  Haskell dependencies, but will still link dynamically against libc, GMP and
+  other system library dependencies.
+
+  If a library or its dependencies use their Cabal-generated
+  `Paths_*` module, this may not work as well if GHC's dead code elimination is
+  unable to remove the references to the dependency's store path that module
+  contains.
+  As a consequence, an unused reference may be created from the static binary to such a _library_ store path.
+  (See [nixpkgs#164630][164630] for more information.)
+
+  Nixpkgs unstable and releases from 24.11 onwards will verify that such
+  references are eliminated and fail the build if they are not.
+  You can opt in to this new behavior as follows:
+
+  ```nix
+  pkgs.haskell.lib.overrideCabal
+    (pkgs.haskell.lib.justStaticExecutables my-haskell-package)
+    (drv: {
+      disallowGhcReference = true;
+    })
+  ```
+
+  on the package you are statically linking with `justStaticExecutables`.
+  After doing so, importing the `Paths_*` module may cause builds to fail with this message:
+
+  ```
+  error: output '/nix/store/64k8iw0ryz76qpijsnl9v87fb26v28z8-my-haskell-package-1.0.0.0' is not allowed to refer to the following paths:
+           /nix/store/5q5s4a07gaz50h04zpfbda8xjs8wrnhg-ghc-9.6.3
+  ```
+
+  If that happens, temporarily disable the check for GHC references and rebuild the
+  derivation. Then use `strings` to determine which libraries are responsible:
+
+  ```
+  $ nix-build ...
+  $ strings result/bin/my-haskell-binary | grep /nix/store/
+  ...
+  /nix/store/n7ciwdlg8yyxdhbrgd6yc2d8ypnwpmgq-hs-opentelemetry-sdk-0.0.3.6/bin
+  ...
+  ```
+
+  Finally, use `remove-references-to` to delete those store paths from the produced output:
+
+  ```nix
+  pkgs.haskell.lib.overrideCabal
+    (pkgs.haskell.lib.justStaticExecutables my-haskell-package)
+    (drv: {
+      postInstall = ''
+        ${drv.postInstall or ""}
+        remove-references-to -t ${pkgs.haskellPackages.hs-opentelemetry-sdk}
+      '';
+    })
+  ```
+
+[164630]: https://github.com/NixOS/nixpkgs/issues/164630
 
 `enableSeparateBinOutput drv`
 : Install executables produced by `drv` to a separate `bin` output. This

doc/languages-frameworks/javascript.section.md

@@ -310,6 +310,120 @@ See `node2nix` [docs](https://github.com/svanderburg/node2nix) for more info.
 - `node2nix` has some [bugs](https://github.com/svanderburg/node2nix/issues/238) related to working with lock files from npm distributed with `nodejs_16`.
 - `node2nix` does not like missing packages from npm. If you see something like `Cannot resolve version: vue-loader-v16@undefined` then you might want to try another tool. The package might have been pulled off of npm.
 
+### pnpm {#javascript-pnpm}
+
+Pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_8` and `pnpm_9`, which support different sets of lock file versions.
+
+When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The functions `pnpm_8.fetchDeps` and `pnpm_9.fetchDeps` can create this pnpm store derivation. In conjunction, the setup hooks `pnpm_8.configHook` and `pnpm_9.configHook` will prepare the build environment to install the prefetched dependencies store. Here is an example for a package that contains a `package.json` and a `pnpm-lock.yaml` files using the above `pnpm_` attributes:
+
+```nix
+{
+  stdenv,
+  nodejs,
+  # This is pinned as { pnpm = pnpm_9; }
+  pnpm
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "foo";
+  version = "0-unstable-1980-01-01";
+
+  src = ...;
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm.configHook
+  ];
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    hash = "...";
+  };
+})
+```
+
+NOTE: It is highly recommended to use a pinned version of pnpm (i.e. `pnpm_8` or `pnpm_9`), to increase future reproducibility. It might also be required to use an older version, if the package needs support for a certain lock file version.
+
+In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `finalAttrs.patches` to the function as well (i.e. `inherit (finalAttrs) patches`.
+
+`pnpm.configHook` supports adding additional `pnpm install` flags via `pnpmInstallFlags` which can be set to a Nix string array.
+
+#### Dealing with `sourceRoot` {#javascript-pnpm-sourceRoot}
+
+If the pnpm project is in a subdirectory, you can just define `sourceRoot` or `setSourceRoot` for `fetchDeps`.
+If `sourceRoot` is different between the parent derivation and `fetchDeps`, you will have to set `pnpmRoot` to effectively be the same location as it is in `fetchDeps`.
+
+Assuming the following directory structure, we can define `sourceRoot` and `pnpmRoot` as follows:
+
+```
+.
+├── frontend
+│   ├── ...
+│   ├── package.json
+│   └── pnpm-lock.yaml
+└── ...
+```
+
+```nix
+  ...
+  pnpmDeps = pnpm.fetchDeps {
+    ...
+    sourceRoot = "${finalAttrs.src.name}/frontend";
+  };
+
+  # by default the working directory is the extracted source
+  pnpmRoot = "frontend";
+```
+
+#### PNPM Workspaces {#javascript-pnpm-workspaces}
+
+If you need to use a PNPM workspace for your project, then set `pnpmWorkspace = "<workspace project name>"` in your `pnpm.fetchDeps` call,
+which will make PNPM only install dependencies for that workspace package.
+
+For example:
+
+```nix
+...
+pnpmWorkspace = "@astrojs/language-server";
+pnpmDeps = pnpm.fetchDeps {
+  inherit (finalAttrs) pnpmWorkspace;
+  ...
+}
+```
+
+The above would make `pnpm.fetchDeps` call only install dependencies for the `@astrojs/language-server` workspace package.
+Note that you do not need to set `sourceRoot` to make this work.
+
+Usually in such cases, you'd want to use `pnpm --filter=$pnpmWorkspace build` to build your project, as `npmHooks.npmBuildHook` probably won't work. A `buildPhase` based on the following example will probably fit most workspace projects:
+
+```nix
+buildPhase = ''
+  runHook preBuild
+
+  pnpm --filter=@astrojs/language-server build
+
+  runHook postBuild
+'';
+```
+
+#### Additional PNPM Commands and settings {#javascript-pnpm-extraCommands}
+
+If you require setting an additional PNPM configuration setting (such as `dedupe-peer-dependents` or similar),
+set `prePnpmInstall` to the right commands to run. For example:
+
+```nix
+prePnpmInstall = ''
+  pnpm config set dedupe-peer-dependants false
+'';
+pnpmDeps = pnpm.fetchDeps {
+  inherit (finalAttrs) prePnpmInstall;
+  ...
+};
+```
+
+In this example, `prePnpmInstall` will be run by both `pnpm.configHook` and by the `pnpm.fetchDeps` builder.
+
+
 ### yarn2nix {#javascript-yarn2nix}
 
 #### Preparation {#javascript-yarn2nix-preparation}

doc/languages-frameworks/texlive.section.md

@@ -83,12 +83,13 @@ Release 23.11 ships with a new interface that will eventually replace `texlive.c
   ```nix
   stdenvNoCC.mkDerivation rec {
     src = texlive.pkgs.iwona;
+    dontUnpack = true;
 
     inherit (src) pname version;
 
     installPhase = ''
       runHook preInstall
-      install -Dm644 fonts/opentype/nowacki/iwona/*.otf -t $out/share/fonts/opentype
+      install -Dm644 $src/fonts/opentype/nowacki/iwona/*.otf -t $out/share/fonts/opentype
       runHook postInstall
     '';
   }

doc/shell.nix

@@ -1,7 +1,7 @@
 let
   pkgs = import ../. {
-    config = {};
-    overlays = [];
+    config = { };
+    overlays = [ ];
   };
 
   common = import ./common.nix;
@@ -13,8 +13,8 @@ let
     open = "/${outputPath}/${indexPath}";
   };
 in
-  pkgs.mkShell {
-    packages = [
-      web-devmode
-    ];
-  }
+pkgs.mkShell {
+  packages = [
+    web-devmode
+  ];
+}

doc/stdenv/stdenv.chapter.md

@@ -1558,6 +1558,8 @@ Both parameters take a list of flags as strings. The special `"all"` flag can be
 
 For more in-depth information on these hardening flags and hardening in general, refer to the [Debian Wiki](https://wiki.debian.org/Hardening), [Ubuntu Wiki](https://wiki.ubuntu.com/Security/Features), [Gentoo Wiki](https://wiki.gentoo.org/wiki/Project:Hardened), and the [Arch Wiki](https://wiki.archlinux.org/title/Security).
 
+Note that support for some hardening flags varies by compiler, CPU architecture, target OS and libc. Combinations of these that don't support a particular hardening flag will silently ignore attempts to enable it. To see exactly which hardening flags are being employed in any invocation, the `NIX_DEBUG` environment variable can be used.
+
 ### Hardening flags enabled by default {#sec-hardening-flags-enabled-by-default}
 
 The following flags are enabled by default and might require disabling with `hardeningDisable` if the program to package is incompatible.
@@ -1607,6 +1609,16 @@ installwatch.c:3751:5: error: conflicting types for '__open_2'
 fcntl2.h:50:4: error: call to '__open_missing_mode' declared with attribute error: open with O_CREAT or O_TMPFILE in second argument needs 3 arguments
 ```
 
+Disabling `fortify` implies disablement of `fortify3`
+
+#### `fortify3` {#fortify3}
+
+Adds the `-O2 -D_FORTIFY_SOURCE=3` compiler options. This expands the cases that can be protected by fortify-checks to include some situations with dynamic-length buffers whose length can be inferred at runtime using compiler hints.
+
+Enabling this flag implies enablement of `fortify`. Disabling this flag does not imply disablement of `fortify`.
+
+This flag can sometimes conflict with a build-system's own attempts at enabling fortify support and result in errors complaining about `redefinition of _FORTIFY_SOURCE`.
+
 #### `pic` {#pic}
 
 Adds the `-fPIC` compiler options. This options adds support for position independent code in shared libraries and thus making ASLR possible.
@@ -1648,13 +1660,27 @@ The following flags are disabled by default and should be enabled with `hardenin
 
 #### `pie` {#pie}
 
-This flag is disabled by default for normal `glibc` based NixOS package builds, but enabled by default for `musl` based package builds.
+This flag is disabled by default for normal `glibc` based NixOS package builds, but enabled by default for
+
+  - `musl`-based package builds, except on Aarch64 and Aarch32, where there are issues.
+
+  - Statically-linked for OpenBSD builds, where it appears to be required to get a working binary.
 
 Adds the `-fPIE` compiler and `-pie` linker options. Position Independent Executables are needed to take advantage of Address Space Layout Randomization, supported by modern kernel versions. While ASLR can already be enforced for data areas in the stack and heap (brk and mmap), the code areas must be compiled as position-independent. Shared libraries already do this with the `pic` flag, so they gain ASLR automatically, but binary .text regions need to be build with `pie` to gain ASLR. When this happens, ROP attacks are much harder since there are no static locations to bounce off of during a memory corruption attack.
 
 Static libraries need to be compiled with `-fPIE` so that executables can link them in with the `-pie` linker option.
 If the libraries lack `-fPIE`, you will get the error `recompile with -fPIE`.
 
+#### `zerocallusedregs` {#zerocallusedregs}
+
+Adds the `-fzero-call-used-regs=used-gpr` compiler option. This causes the general-purpose registers that an architecture's calling convention considers "call-used" to be zeroed on return from the function. This can make it harder for attackers to construct useful ROP gadgets and also reduces the chance of data leakage from a function call.
+
+#### `trivialautovarinit` {#trivialautovarinit}
+
+Adds the `-ftrivial-auto-var-init=pattern` compiler option. This causes "trivially-initializable" uninitialized stack variables to be forcibly initialized with a nonzero value that is likely to cause a crash (and therefore be noticed). Uninitialized variables generally take on their values based on fragments of previous program state, and attackers can carefully manipulate that state to craft malicious initial values for these variables.
+
+Use of this flag is controversial as it can prevent tools that detect uninitialized variable use (such as valgrind) from operating correctly.
+
 [^footnote-stdenv-ignored-build-platform]: The build platform is ignored because it is a mere implementation detail of the package satisfying the dependency: As a general programming principle, dependencies are always *specified* as interfaces, not concrete implementation.
 [^footnote-stdenv-native-dependencies-in-path]: Currently, this means for native builds all dependencies are put on the `PATH`. But in the future that may not be the case for sake of matching cross: the platforms would be assumed to be unique for native and cross builds alike, so only the `depsBuild*` and `nativeBuildInputs` would be added to the `PATH`.
 [^footnote-stdenv-propagated-dependencies]: Nix itself already takes a package’s transitive dependencies into account, but this propagation ensures nixpkgs-specific infrastructure like [setup hooks](#ssec-setup-hooks) also are run as if it were a propagated dependency.

doc/using/overrides.chapter.md

@@ -40,6 +40,13 @@ import pkgs.path { overlays = [ (self: super: {
 
 In the first example, `pkgs.foo` is the result of a function call with some default arguments, usually a derivation. Using `pkgs.foo.override` will call the same function with the given new arguments.
 
+Many packages, like the `foo` example above, provide package options with default values in their arguments, to facilitate overriding.
+Because it's not usually feasible to test that packages build with all combinations of options, you might find that a package doesn't build if you override options to non-default values.
+
+Package maintainers are not expected to fix arbitrary combinations of options.
+If you find that something doesn't work, please submit a fix, ideally with a regression test.
+If you want to ensure that things keep working, consider [becoming a maintainer](https://github.com/NixOS/nixpkgs/tree/master/maintainers) for the package.
+
 ## <pkg>.overrideAttrs {#sec-pkg-overrideAttrs}
 
 The function `overrideAttrs` allows overriding the attribute set passed to a `stdenv.mkDerivation` call, producing a new derivation based on the original one. This function is available on all derivations produced by the `stdenv.mkDerivation` function, which is most packages in the nixpkgs expression `pkgs`.

flake.nix

@@ -5,14 +5,15 @@
 
   outputs = { self }:
     let
-      jobs = import ./pkgs/top-level/release.nix {
-        nixpkgs = self;
-      };
-
       libVersionInfoOverlay = import ./lib/flake-version-info.nix self;
       lib = (import ./lib).extend libVersionInfoOverlay;
 
       forAllSystems = lib.genAttrs lib.systems.flakeExposed;
+
+      jobs = forAllSystems (system: import ./pkgs/top-level/release.nix {
+        nixpkgs = self;
+        inherit system;
+      });
     in
     {
       lib = lib.extend (final: prev: {
@@ -43,12 +44,15 @@
           );
       });
 
-      checks.x86_64-linux = {
-        tarball = jobs.tarball;
+      checks = forAllSystems (system: {
+        tarball = jobs.${system}.tarball;
+        # Exclude power64 due to "libressl is not available on the requested hostPlatform" with hostPlatform being power64
+      } // lib.optionalAttrs (self.legacyPackages.${system}.stdenv.isLinux && !self.legacyPackages.${system}.targetPlatform.isPower64) {
         # Test that ensures that the nixosSystem function can accept a lib argument
         # Note: prefer not to extend or modify `lib`, especially if you want to share reusable modules
         #       alternatives include: `import` a file, or put a custom library in an option or in `_module.args.<libname>`
         nixosSystemAcceptsLib = (self.lib.nixosSystem {
+          pkgs = self.legacyPackages.${system};
           lib = self.lib.extend (final: prev: {
             ifThisFunctionIsMissingTheTestFails = final.id;
           });
@@ -64,10 +68,10 @@
             })
           ];
         }).config.system.build.toplevel;
-      };
+      });
 
       htmlDocs = {
-        nixpkgsManual = jobs.manual;
+        nixpkgsManual = jobs.x86_64-linux.manual;
         nixosManual = (import ./nixos/release-small.nix {
           nixpkgs = self;
         }).nixos.manual.x86_64-linux;

lib/ascii-table.nix

@@ -1,99 +1,100 @@
-{ "\t" =  9;
+{
+  "\t" = 9;
   "\n" = 10;
   "\r" = 13;
-  " "  = 32;
-  "!"  = 33;
+  " " = 32;
+  "!" = 33;
   "\"" = 34;
-  "#"  = 35;
-  "$"  = 36;
-  "%"  = 37;
-  "&"  = 38;
-  "'"  = 39;
-  "("  = 40;
-  ")"  = 41;
-  "*"  = 42;
-  "+"  = 43;
-  ","  = 44;
-  "-"  = 45;
-  "."  = 46;
-  "/"  = 47;
-  "0"  = 48;
-  "1"  = 49;
-  "2"  = 50;
-  "3"  = 51;
-  "4"  = 52;
-  "5"  = 53;
-  "6"  = 54;
-  "7"  = 55;
-  "8"  = 56;
-  "9"  = 57;
-  ":"  = 58;
-  ";"  = 59;
-  "<"  = 60;
-  "="  = 61;
-  ">"  = 62;
-  "?"  = 63;
-  "@"  = 64;
-  "A"  = 65;
-  "B"  = 66;
-  "C"  = 67;
-  "D"  = 68;
-  "E"  = 69;
-  "F"  = 70;
-  "G"  = 71;
-  "H"  = 72;
-  "I"  = 73;
-  "J"  = 74;
-  "K"  = 75;
-  "L"  = 76;
-  "M"  = 77;
-  "N"  = 78;
-  "O"  = 79;
-  "P"  = 80;
-  "Q"  = 81;
-  "R"  = 82;
-  "S"  = 83;
-  "T"  = 84;
-  "U"  = 85;
-  "V"  = 86;
-  "W"  = 87;
-  "X"  = 88;
-  "Y"  = 89;
-  "Z"  = 90;
-  "["  = 91;
+  "#" = 35;
+  "$" = 36;
+  "%" = 37;
+  "&" = 38;
+  "'" = 39;
+  "(" = 40;
+  ")" = 41;
+  "*" = 42;
+  "+" = 43;
+  "," = 44;
+  "-" = 45;
+  "." = 46;
+  "/" = 47;
+  "0" = 48;
+  "1" = 49;
+  "2" = 50;
+  "3" = 51;
+  "4" = 52;
+  "5" = 53;
+  "6" = 54;
+  "7" = 55;
+  "8" = 56;
+  "9" = 57;
+  ":" = 58;
+  ";" = 59;
+  "<" = 60;
+  "=" = 61;
+  ">" = 62;
+  "?" = 63;
+  "@" = 64;
+  "A" = 65;
+  "B" = 66;
+  "C" = 67;
+  "D" = 68;
+  "E" = 69;
+  "F" = 70;
+  "G" = 71;
+  "H" = 72;
+  "I" = 73;
+  "J" = 74;
+  "K" = 75;
+  "L" = 76;
+  "M" = 77;
+  "N" = 78;
+  "O" = 79;
+  "P" = 80;
+  "Q" = 81;
+  "R" = 82;
+  "S" = 83;
+  "T" = 84;
+  "U" = 85;
+  "V" = 86;
+  "W" = 87;
+  "X" = 88;
+  "Y" = 89;
+  "Z" = 90;
+  "[" = 91;
   "\\" = 92;
-  "]"  = 93;
-  "^"  = 94;
-  "_"  = 95;
-  "`"  = 96;
-  "a"  = 97;
-  "b"  = 98;
-  "c"  = 99;
-  "d"  = 100;
-  "e"  = 101;
-  "f"  = 102;
-  "g"  = 103;
-  "h"  = 104;
-  "i"  = 105;
-  "j"  = 106;
-  "k"  = 107;
-  "l"  = 108;
-  "m"  = 109;
-  "n"  = 110;
-  "o"  = 111;
-  "p"  = 112;
-  "q"  = 113;
-  "r"  = 114;
-  "s"  = 115;
-  "t"  = 116;
-  "u"  = 117;
-  "v"  = 118;
-  "w"  = 119;
-  "x"  = 120;
-  "y"  = 121;
-  "z"  = 122;
-  "{"  = 123;
-  "|"  = 124;
-  "}"  = 125;
-  "~"  = 126;
+  "]" = 93;
+  "^" = 94;
+  "_" = 95;
+  "`" = 96;
+  "a" = 97;
+  "b" = 98;
+  "c" = 99;
+  "d" = 100;
+  "e" = 101;
+  "f" = 102;
+  "g" = 103;
+  "h" = 104;
+  "i" = 105;
+  "j" = 106;
+  "k" = 107;
+  "l" = 108;
+  "m" = 109;
+  "n" = 110;
+  "o" = 111;
+  "p" = 112;
+  "q" = 113;
+  "r" = 114;
+  "s" = 115;
+  "t" = 116;
+  "u" = 117;
+  "v" = 118;
+  "w" = 119;
+  "x" = 120;
+  "y" = 121;
+  "z" = 122;
+  "{" = 123;
+  "|" = 124;
+  "}" = 125;
+  "~" = 126;
 }

lib/asserts.nix

@@ -36,10 +36,7 @@ rec {
     :::
   */
   # TODO(Profpatsch): add tests that check stderr
-  assertMsg =
-    pred:
-    msg:
-    pred || builtins.throw msg;
+  assertMsg = pred: msg: pred || builtins.throw msg;
 
   /**
     Specialized `assertMsg` for checking if `val` is one of the elements
@@ -81,14 +78,10 @@ rec {
     :::
   */
   assertOneOf =
-    name:
-    val:
-    xs:
-    assertMsg
-    (lib.elem val xs)
-    "${name} must be one of ${
-      lib.generators.toPretty {} xs}, but is: ${
-        lib.generators.toPretty {} val}";
+    name: val: xs:
+    assertMsg (lib.elem val xs) "${name} must be one of ${lib.generators.toPretty { } xs}, but is: ${
+      lib.generators.toPretty { } val
+    }";
 
   /**
     Specialized `assertMsg` for checking if every one of `vals` is one of the elements
@@ -133,12 +126,9 @@ rec {
     :::
   */
   assertEachOneOf =
-    name:
-    vals:
-    xs:
-    assertMsg
-    (lib.all (val: lib.elem val xs) vals)
-    "each element in ${name} must be one of ${
-      lib.generators.toPretty {} xs}, but is: ${
-        lib.generators.toPretty {} vals}";
+    name: vals: xs:
+    assertMsg (lib.all (val: lib.elem val xs) vals)
+      "each element in ${name} must be one of ${lib.generators.toPretty { } xs}, but is: ${
+        lib.generators.toPretty { } vals
+      }";
 }

lib/attrsets.nix

@@ -11,7 +11,7 @@ let
 in
 
 rec {
-  inherit (builtins) attrNames listToAttrs hasAttr isAttrs getAttr removeAttrs;
+  inherit (builtins) attrNames listToAttrs hasAttr isAttrs getAttr removeAttrs intersectAttrs;
 
 
   /**

lib/cli.nix

@@ -11,7 +11,6 @@ rec {
 
     `toGNUCommandLineShell` returns an escaped shell string.
 
-
     # Inputs
 
     `options`
@@ -22,7 +21,6 @@ rec {
 
     : 2\. Function argument
 
-
     # Examples
     :::{.example}
     ## `lib.cli.toGNUCommandLineShell` usage example
@@ -60,45 +58,51 @@ rec {
 
     :::
   */
-  toGNUCommandLineShell =
-    options: attrs: lib.escapeShellArgs (toGNUCommandLine options attrs);
+  toGNUCommandLineShell = options: attrs: lib.escapeShellArgs (toGNUCommandLine options attrs);
 
-  toGNUCommandLine = {
-    # how to string-format the option name;
-    # by default one character is a short option (`-`),
-    # more than one characters a long option (`--`).
-    mkOptionName ?
-      k: if builtins.stringLength k == 1
-          then "-${k}"
-          else "--${k}",
+  toGNUCommandLine =
+    {
+      # how to string-format the option name;
+      # by default one character is a short option (`-`),
+      # more than one characters a long option (`--`).
+      mkOptionName ? k: if builtins.stringLength k == 1 then "-${k}" else "--${k}",
 
-    # how to format a boolean value to a command list;
-    # by default it’s a flag option
-    # (only the option name if true, left out completely if false).
-    mkBool ? k: v: lib.optional v (mkOptionName k),
+      # how to format a boolean value to a command list;
+      # by default it’s a flag option
+      # (only the option name if true, left out completely if false).
+      mkBool ? k: v: lib.optional v (mkOptionName k),
 
-    # how to format a list value to a command list;
-    # by default the option name is repeated for each value
-    # and `mkOption` is applied to the values themselves.
-    mkList ? k: v: lib.concatMap (mkOption k) v,
+      # how to format a list value to a command list;
+      # by default the option name is repeated for each value
+      # and `mkOption` is applied to the values themselves.
+      mkList ? k: v: lib.concatMap (mkOption k) v,
 
-    # how to format any remaining value to a command list;
-    # on the toplevel, booleans and lists are handled by `mkBool` and `mkList`,
-    # though they can still appear as values of a list.
-    # By default, everything is printed verbatim and complex types
-    # are forbidden (lists, attrsets, functions). `null` values are omitted.
-    mkOption ?
-      k: v: if v == null
-            then []
-            else [ (mkOptionName k) (lib.generators.mkValueStringDefault {} v) ]
+      # how to format any remaining value to a command list;
+      # on the toplevel, booleans and lists are handled by `mkBool` and `mkList`,
+      # though they can still appear as values of a list.
+      # By default, everything is printed verbatim and complex types
+      # are forbidden (lists, attrsets, functions). `null` values are omitted.
+      mkOption ?
+        k: v:
+        if v == null then
+          [ ]
+        else
+          [
+            (mkOptionName k)
+            (lib.generators.mkValueStringDefault { } v)
+          ],
     }:
     options:
-      let
-        render = k: v:
-          if      builtins.isBool v then mkBool k v
-          else if builtins.isList v then mkList k v
-          else mkOption k v;
+    let
+      render =
+        k: v:
+        if builtins.isBool v then
+          mkBool k v
+        else if builtins.isList v then
+          mkList k v
+        else
+          mkOption k v;
 
-      in
-        builtins.concatLists (lib.mapAttrsToList render options);
+    in
+    builtins.concatLists (lib.mapAttrsToList render options);
 }

lib/debug.nix

@@ -26,7 +26,8 @@ let
     generators
     id
     mapAttrs
-    trace;
+    trace
+    ;
 in
 
 rec {
@@ -36,7 +37,6 @@ rec {
   /**
     Conditionally trace the supplied message, based on a predicate.
 
-
     # Inputs
 
     `pred`
@@ -70,15 +70,13 @@ rec {
     :::
   */
   traceIf =
-    pred:
-    msg:
-    x: if pred then trace msg x else x;
+    pred: msg: x:
+    if pred then trace msg x else x;
 
   /**
     Trace the supplied value after applying a function to it, and
     return the original value.
 
-
     # Inputs
 
     `f`
@@ -107,9 +105,7 @@ rec {
 
     :::
   */
-  traceValFn =
-    f:
-    x: trace (f x) x;
+  traceValFn = f: x: trace (f x) x;
 
   /**
     Trace the supplied value and return it.
@@ -143,7 +139,6 @@ rec {
   /**
     `builtins.trace`, but the value is `builtins.deepSeq`ed first.
 
-
     # Inputs
 
     `x`
@@ -175,16 +170,13 @@ rec {
 
     :::
   */
-  traceSeq =
-    x:
-    y: trace (builtins.deepSeq x x) y;
+  traceSeq = x: y: trace (builtins.deepSeq x x) y;
 
   /**
     Like `traceSeq`, but only evaluate down to depth n.
     This is very useful because lots of `traceSeq` usages
     lead to an infinite recursion.
 
-
     # Inputs
 
     `depth`
@@ -217,25 +209,39 @@ rec {
 
     :::
   */
-  traceSeqN = depth: x: y:
-    let snip = v: if      isList  v then noQuotes "[…]" v
-                  else if isAttrs v then noQuotes "{…}" v
-                  else v;
-        noQuotes = str: v: { __pretty = const str; val = v; };
-        modify = n: fn: v: if (n == 0) then fn v
-                      else if isList  v then map (modify (n - 1) fn) v
-                      else if isAttrs v then mapAttrs
-                        (const (modify (n - 1) fn)) v
-                      else v;
-    in trace (generators.toPretty { allowPrettyValues = true; }
-               (modify depth snip x)) y;
+  traceSeqN =
+    depth: x: y:
+    let
+      snip =
+        v:
+        if isList v then
+          noQuotes "[…]" v
+        else if isAttrs v then
+          noQuotes "{…}" v
+        else
+          v;
+      noQuotes = str: v: {
+        __pretty = const str;
+        val = v;
+      };
+      modify =
+        n: fn: v:
+        if (n == 0) then
+          fn v
+        else if isList v then
+          map (modify (n - 1) fn) v
+        else if isAttrs v then
+          mapAttrs (const (modify (n - 1) fn)) v
+        else
+          v;
+    in
+    trace (generators.toPretty { allowPrettyValues = true; } (modify depth snip x)) y;
 
   /**
     A combination of `traceVal` and `traceSeq` that applies a
     provided function to the value to be traced after `deepSeq`ing
     it.
 
-
     # Inputs
 
     `f`
@@ -246,9 +252,7 @@ rec {
 
     : Value to trace
   */
-  traceValSeqFn =
-    f:
-    v: traceValFn f (builtins.deepSeq v v);
+  traceValSeqFn = f: v: traceValFn f (builtins.deepSeq v v);
 
   /**
     A combination of `traceVal` and `traceSeq`.
@@ -258,7 +262,6 @@ rec {
     `v`
 
     : Value to trace
-
   */
   traceValSeq = traceValSeqFn id;
 
@@ -266,7 +269,6 @@ rec {
     A combination of `traceVal` and `traceSeqN` that applies a
     provided function to the value to be traced.
 
-
     # Inputs
 
     `f`
@@ -282,9 +284,8 @@ rec {
     : Value to trace
   */
   traceValSeqNFn =
-    f:
-    depth:
-    v: traceSeqN depth (f v) v;
+    f: depth: v:
+    traceSeqN depth (f v) v;
 
   /**
     A combination of `traceVal` and `traceSeqN`.
@@ -308,7 +309,6 @@ rec {
     This is useful for adding around a function call,
     to see the before/after of values as they are transformed.
 
-
     # Inputs
 
     `depth`
@@ -327,7 +327,6 @@ rec {
 
     : 4\. Function argument
 
-
     # Examples
     :::{.example}
     ## `lib.debug.traceFnSeqN` usage example
@@ -340,17 +339,16 @@ rec {
 
     :::
   */
-  traceFnSeqN = depth: name: f: v:
-    let res = f v;
-    in lib.traceSeqN
-        (depth + 1)
-        {
-          fn = name;
-          from = v;
-          to = res;
-        }
-        res;
-
+  traceFnSeqN =
+    depth: name: f: v:
+    let
+      res = f v;
+    in
+    lib.traceSeqN (depth + 1) {
+      fn = name;
+      from = v;
+      to = res;
+    } res;
 
   # -- TESTING --
 
@@ -375,7 +373,6 @@ rec {
 
     - If you want to run only a subset of the tests add the attribute `tests = ["testName"];`
 
-
     # Inputs
 
     `tests`
@@ -430,26 +427,42 @@ rec {
     :::
   */
   runTests =
-    tests: concatLists (attrValues (mapAttrs (name: test:
-    let testsToRun = if tests ? tests then tests.tests else [];
-    in if (substring 0 4 name == "test" ||  elem name testsToRun)
-       && ((testsToRun == []) || elem name tests.tests)
-       && (test.expr != test.expected)
+    tests:
+    concatLists (
+      attrValues (
+        mapAttrs (
+          name: test:
+          let
+            testsToRun = if tests ? tests then tests.tests else [ ];
+          in
+          if
+            (substring 0 4 name == "test" || elem name testsToRun)
+            && ((testsToRun == [ ]) || elem name tests.tests)
+            && (test.expr != test.expected)
 
-      then [ { inherit name; expected = test.expected; result = test.expr; } ]
-      else [] ) tests));
+          then
+            [
+              {
+                inherit name;
+                expected = test.expected;
+                result = test.expr;
+              }
+            ]
+          else
+            [ ]
+        ) tests
+      )
+    );
 
   /**
     Create a test assuming that list elements are `true`.
 
-
     # Inputs
 
     `expr`
 
     : 1\. Function argument
 
-
     # Examples
     :::{.example}
     ## `lib.debug.testAllTrue` usage example
@@ -460,5 +473,8 @@ rec {
 
     :::
   */
-  testAllTrue = expr: { inherit expr; expected = map (x: true) expr; };
+  testAllTrue = expr: {
+    inherit expr;
+    expected = map (x: true) expr;
+  };
 }

lib/default.nix

@@ -64,22 +64,21 @@ let
     # linux kernel configuration
     kernel = callLibs ./kernel.nix;
 
-    inherit (builtins) add addErrorContext attrNames concatLists
-      deepSeq elem elemAt filter genericClosure genList getAttr
-      hasAttr head isAttrs isBool isInt isList isPath isString length
-      lessThan listToAttrs pathExists readFile replaceStrings seq
-      stringLength sub substring tail trace;
+    # TODO: For consistency, all builtins should also be available from a sub-library;
+    # these are the only ones that are currently not
+    inherit (builtins) addErrorContext isPath trace;
     inherit (self.trivial) id const pipe concat or and xor bitAnd bitOr bitXor
       bitNot boolToString mergeAttrs flip mapNullable inNixShell isFloat min max
       importJSON importTOML warn warnIf warnIfNot throwIf throwIfNot checkListOfEnum
       info showWarnings nixpkgsVersion version isInOldestRelease
-      mod compare splitByAndCompare
+      mod compare splitByAndCompare seq deepSeq lessThan add sub
       functionArgs setFunctionArgs isFunction toFunction mirrorFunctionArgs
-      toHexString toBaseDigits inPureEvalMode;
+      toHexString toBaseDigits inPureEvalMode isBool isInt pathExists
+      genericClosure readFile;
     inherit (self.fixedPoints) fix fix' converge extends composeExtensions
       composeManyExtensions makeExtensible makeExtensibleWithCustomName;
     inherit (self.attrsets) attrByPath hasAttrByPath setAttrByPath
-      getAttrFromPath attrVals attrValues getAttrs catAttrs filterAttrs
+      getAttrFromPath attrVals attrNames attrValues getAttrs catAttrs filterAttrs
       filterAttrsRecursive foldlAttrs foldAttrs collect nameValuePair mapAttrs
       mapAttrs' mapAttrsToList attrsToList concatMapAttrs mapAttrsRecursive
       mapAttrsRecursiveCond genAttrs isDerivation toDerivation optionalAttrs
@@ -87,25 +86,27 @@ let
       recursiveUpdate matchAttrs mergeAttrsList overrideExisting showAttrPath getOutput
       getBin getLib getDev getMan chooseDevOutputs zipWithNames zip
       recurseIntoAttrs dontRecurseIntoAttrs cartesianProduct cartesianProductOfSets
-      mapCartesianProduct updateManyAttrsByPath;
-    inherit (self.lists) singleton forEach foldr fold foldl foldl' imap0 imap1
-      ifilter0 concatMap flatten remove findSingle findFirst any all count
+      mapCartesianProduct updateManyAttrsByPath listToAttrs hasAttr getAttr isAttrs intersectAttrs removeAttrs;
+    inherit (self.lists) singleton forEach map foldr fold foldl foldl' imap0 imap1
+      filter ifilter0 concatMap flatten remove findSingle findFirst any all count
       optional optionals toList range replicate partition zipListsWith zipLists
       reverseList listDfs toposort sort sortOn naturalSort compareLists take
       drop sublist last init crossLists unique allUnique intersectLists
-      subtractLists mutuallyExclusive groupBy groupBy';
+      subtractLists mutuallyExclusive groupBy groupBy' concatLists genList
+      length head tail elem elemAt isList;
     inherit (self.strings) concatStrings concatMapStrings concatImapStrings
+      stringLength substring isString replaceStrings
       intersperse concatStringsSep concatMapStringsSep
       concatImapStringsSep concatLines makeSearchPath makeSearchPathOutput
       makeLibraryPath makeIncludePath makeBinPath optionalString
       hasInfix hasPrefix hasSuffix stringToCharacters stringAsChars escape
       escapeShellArg escapeShellArgs
       isStorePath isStringLike
-      isValidPosixName toShellVar toShellVars
+      isValidPosixName toShellVar toShellVars trim trimWith
       escapeRegex escapeURL escapeXML replaceChars lowerChars
       upperChars toLower toUpper addContextFrom splitString
       removePrefix removeSuffix versionOlder versionAtLeast
-      getName getVersion
+      getName getVersion match split
       cmakeOptionType cmakeBool cmakeFeature
       mesonOption mesonBool mesonEnable
       nameFromURL enableFeature enableFeatureAs withFeature

lib/derivations.nix

@@ -7,14 +7,16 @@ let
     throwIfNot
     ;
 
-  showMaybeAttrPosPre = prefix: attrName: v:
-    let pos = builtins.unsafeGetAttrPos attrName v;
-    in if pos == null then "" else "${prefix}${pos.file}:${toString pos.line}:${toString pos.column}";
+  showMaybeAttrPosPre =
+    prefix: attrName: v:
+    let
+      pos = builtins.unsafeGetAttrPos attrName v;
+    in
+    if pos == null then "" else "${prefix}${pos.file}:${toString pos.line}:${toString pos.column}";
 
-  showMaybePackagePosPre = prefix: pkg:
-    if pkg?meta.position && isString pkg.meta.position
-    then "${prefix}${pkg.meta.position}"
-    else "";
+  showMaybePackagePosPre =
+    prefix: pkg:
+    if pkg ? meta.position && isString pkg.meta.position then "${prefix}${pkg.meta.position}" else "";
 in
 {
   /*
@@ -61,35 +63,33 @@ in
         (lazyDerivation { inherit derivation }).passthru
 
         (lazyDerivation { inherit derivation }).pythonPath
-
   */
   lazyDerivation =
     args@{
       # The derivation to be wrapped.
-      derivation
-    , # Optional meta attribute.
+      derivation,
+      # Optional meta attribute.
       #
       # While this function is primarily about derivations, it can improve
       # the `meta` package attribute, which is usually specified through
       # `mkDerivation`.
-      meta ? null
-    , # Optional extra values to add to the returned attrset.
+      meta ? null,
+      # Optional extra values to add to the returned attrset.
       #
       # This can be used for adding package attributes, such as `tests`.
-      passthru ? { }
-    , # Optional list of assumed outputs. Default: ["out"]
+      passthru ? { },
+      # Optional list of assumed outputs. Default: ["out"]
       #
       # This must match the set of outputs that the returned derivation has.
       # You must use this when the derivation has multiple outputs.
-      outputs ? [ "out" ]
+      outputs ? [ "out" ],
     }:
     let
       # These checks are strict in `drv` and some `drv` attributes, but the
       # attrset spine returned by lazyDerivation does not depend on it.
       # Instead, the individual derivation attributes do depend on it.
       checked =
-        throwIfNot (derivation.type or null == "derivation")
-          "lazyDerivation: input must be a derivation."
+        throwIfNot (derivation.type or null == "derivation") "lazyDerivation: input must be a derivation."
           throwIfNot
           # NOTE: Technically we could require our outputs to be a subset of the
           # actual ones, or even leave them unchecked and fail on a lazy basis.
@@ -139,7 +139,13 @@ in
       # A fixed set of derivation values, so that `lazyDerivation` can return
       # its attrset before evaluating `derivation`.
       # This must only list attributes that are available on _all_ derivations.
-      inherit (checked) outPath outputName drvPath name system;
+      inherit (checked)
+        outPath
+        outputName
+        drvPath
+        name
+        system
+        ;
       inherit outputs;
 
       # The meta attribute can either be taken from the derivation, or if the
@@ -149,29 +155,31 @@ in
     // genAttrs outputs (outputName: checked.${outputName})
     // passthru;
 
-  /* Conditionally set a derivation attribute.
+  /*
+    Conditionally set a derivation attribute.
 
-     Because `mkDerivation` sets `__ignoreNulls = true`, a derivation
-     attribute set to `null` will not impact the derivation output hash.
-     Thus, this function passes through its `value` argument if the `cond`
-     is `true`, but returns `null` if not.
+    Because `mkDerivation` sets `__ignoreNulls = true`, a derivation
+    attribute set to `null` will not impact the derivation output hash.
+    Thus, this function passes through its `value` argument if the `cond`
+    is `true`, but returns `null` if not.
 
-     Type: optionalDrvAttr :: Bool -> a -> a | Null
+    Type: optionalDrvAttr :: Bool -> a -> a | Null
 
-     Example:
-       (stdenv.mkDerivation {
-         name = "foo";
-         x = optionalDrvAttr true 1;
-         y = optionalDrvAttr false 1;
-       }).drvPath == (stdenv.mkDerivation {
-         name = "foo";
-         x = 1;
-       }).drvPath
-       => true
+    Example:
+      (stdenv.mkDerivation {
+        name = "foo";
+        x = optionalDrvAttr true 1;
+        y = optionalDrvAttr false 1;
+      }).drvPath == (stdenv.mkDerivation {
+        name = "foo";
+        x = 1;
+      }).drvPath
+      => true
   */
   optionalDrvAttr =
     # Condition
     cond:
     # Attribute value
-    value: if cond then value else null;
+    value:
+    if cond then value else null;
 }

lib/fetchers.nix

@@ -7,8 +7,16 @@
     # easy proxy configuration.  This is impure, but a fixed-output
     # derivation like fetchurl is allowed to do so since its result is
     # by definition pure.
-    "http_proxy" "https_proxy" "ftp_proxy" "all_proxy" "no_proxy"
-    "HTTP_PROXY" "HTTPS_PROXY" "FTP_PROXY" "ALL_PROXY" "NO_PROXY"
+    "http_proxy"
+    "https_proxy"
+    "ftp_proxy"
+    "all_proxy"
+    "no_proxy"
+    "HTTP_PROXY"
+    "HTTPS_PROXY"
+    "FTP_PROXY"
+    "ALL_PROXY"
+    "NO_PROXY"
   ];
 
 }

lib/fileset/default.nix

@@ -57,7 +57,6 @@
   If you need more file set functions,
   see [this issue](https://github.com/NixOS/nixpkgs/issues/266356) to request it.
 
-
   # Implicit coercion from paths to file sets {#sec-fileset-path-coercion}
 
   All functions accepting file sets as arguments can also accept [paths](https://nixos.org/manual/nix/stable/language/values.html#type-path) as arguments.
@@ -155,14 +154,14 @@ let
     pipe
     ;
 
-in {
+in
+{
 
   /**
     Create a file set from a path that may or may not exist:
     - If the path does exist, the path is [coerced to a file set](#sec-fileset-path-coercion).
     - If the path does not exist, a file set containing no files is returned.
 
-
     # Inputs
 
     `path`
@@ -188,14 +187,12 @@ in {
   */
   maybeMissing =
     path:
-    if ! isPath path then
+    if !isPath path then
       if isStringLike path then
-        throw ''
-          lib.fileset.maybeMissing: Argument ("${toString path}") is a string-like value, but it should be a path instead.''
+        throw ''lib.fileset.maybeMissing: Argument ("${toString path}") is a string-like value, but it should be a path instead.''
       else
-        throw ''
-          lib.fileset.maybeMissing: Argument is of type ${typeOf path}, but it should be a path instead.''
-    else if ! pathExists path then
+        throw ''lib.fileset.maybeMissing: Argument is of type ${typeOf path}, but it should be a path instead.''
+    else if !pathExists path then
       _emptyWithoutBase
     else
       _singleton path;
@@ -211,7 +208,6 @@ in {
 
     This variant is useful for tracing file sets in the Nix repl.
 
-
     # Inputs
 
     `fileset`
@@ -248,15 +244,14 @@ in {
 
     :::
   */
-  trace = fileset:
+  trace =
+    fileset:
     let
       # "fileset" would be a better name, but that would clash with the argument name,
       # and we cannot change that because of https://github.com/nix-community/nixdoc/issues/76
       actualFileset = _coerce "lib.fileset.trace: Argument" fileset;
     in
-    seq
-      (_printFileset actualFileset)
-      (x: x);
+    seq (_printFileset actualFileset) (x: x);
 
   /**
     Incrementally evaluate and trace a file set in a pretty way.
@@ -268,7 +263,6 @@ in {
 
     This variant is useful for tracing file sets passed as arguments to other functions.
 
-
     # Inputs
 
     `fileset`
@@ -308,14 +302,14 @@ in {
 
     :::
   */
-  traceVal = fileset:
+  traceVal =
+    fileset:
     let
       # "fileset" would be a better name, but that would clash with the argument name,
       # and we cannot change that because of https://github.com/nix-community/nixdoc/issues/76
       actualFileset = _coerce "lib.fileset.traceVal: Argument" fileset;
     in
-    seq
-      (_printFileset actualFileset)
+    seq (_printFileset actualFileset)
       # We could also return the original fileset argument here,
       # but that would then duplicate work for consumers of the fileset, because then they have to coerce it again
       actualFileset;
@@ -423,10 +417,11 @@ in {
 
     :::
   */
-  toSource = {
-    root,
-    fileset,
-  }:
+  toSource =
+    {
+      root,
+      fileset,
+    }:
     let
       # We cannot rename matched attribute arguments, so let's work around it with an extra `let in` statement
       filesetArg = fileset;
@@ -437,7 +432,7 @@ in {
       filesetFilesystemRoot = (splitRoot fileset._internalBase).root;
       sourceFilter = _toSourceFilter fileset;
     in
-    if ! isPath root then
+    if !isPath root then
       if root ? _isLibCleanSourceWith then
         throw ''
           lib.fileset.toSource: `root` is a `lib.sources`-based value, but it should be a path instead.
@@ -448,38 +443,34 @@ in {
           lib.fileset.toSource: `root` (${toString root}) is a string-like value, but it should be a path instead.
               Paths in strings are not supported by `lib.fileset`, use `lib.sources` or derivations instead.''
       else
-        throw ''
-          lib.fileset.toSource: `root` is of type ${typeOf root}, but it should be a path instead.''
+        throw ''lib.fileset.toSource: `root` is of type ${typeOf root}, but it should be a path instead.''
     # Currently all Nix paths have the same filesystem root, but this could change in the future.
     # See also ../path/README.md
-    else if ! fileset._internalIsEmptyWithoutBase && rootFilesystemRoot != filesetFilesystemRoot then
+    else if !fileset._internalIsEmptyWithoutBase && rootFilesystemRoot != filesetFilesystemRoot then
       throw ''
         lib.fileset.toSource: Filesystem roots are not the same for `fileset` and `root` (${toString root}):
             `root`: Filesystem root is "${toString rootFilesystemRoot}"
             `fileset`: Filesystem root is "${toString filesetFilesystemRoot}"
             Different filesystem roots are not supported.''
-    else if ! pathExists root then
-      throw ''
-        lib.fileset.toSource: `root` (${toString root}) is a path that does not exist.''
+    else if !pathExists root then
+      throw ''lib.fileset.toSource: `root` (${toString root}) is a path that does not exist.''
     else if pathType root != "directory" then
       throw ''
         lib.fileset.toSource: `root` (${toString root}) is a file, but it should be a directory instead. Potential solutions:
             - If you want to import the file into the store _without_ a containing directory, use string interpolation or `builtins.path` instead of this function.
             - If you want to import the file into the store _with_ a containing directory, set `root` to the containing directory, such as ${toString (dirOf root)}, and set `fileset` to the file path.''
-    else if ! fileset._internalIsEmptyWithoutBase && ! hasPrefix root fileset._internalBase then
+    else if !fileset._internalIsEmptyWithoutBase && !hasPrefix root fileset._internalBase then
       throw ''
         lib.fileset.toSource: `fileset` could contain files in ${toString fileset._internalBase}, which is not under the `root` (${toString root}). Potential solutions:
             - Set `root` to ${toString fileset._internalBase} or any directory higher up. This changes the layout of the resulting store path.
             - Set `fileset` to a file set that cannot contain files outside the `root` (${toString root}). This could change the files included in the result.''
     else
-      seq sourceFilter
-      cleanSourceWith {
+      seq sourceFilter cleanSourceWith {
         name = "source";
         src = root;
         filter = sourceFilter;
       };
 
-
   /**
     The list of file paths contained in the given file set.
 
@@ -494,7 +485,6 @@ in {
 
     The resulting list of files can be turned back into a file set using [`lib.fileset.unions`](#function-library-lib.fileset.unions).
 
-
     # Inputs
 
     `fileset`
@@ -521,8 +511,7 @@ in {
 
     :::
   */
-  toList = fileset:
-    _toList (_coerce "lib.fileset.toList: Argument" fileset);
+  toList = fileset: _toList (_coerce "lib.fileset.toList: Argument" fileset);
 
   /**
     The file set containing all files that are in either of two given file sets.
@@ -533,7 +522,6 @@ in {
     The given file sets are evaluated as lazily as possible,
     with the first argument being evaluated first if needed.
 
-
     # Inputs
 
     `fileset1`
@@ -567,10 +555,9 @@ in {
     :::
   */
   union =
-    fileset1:
-    fileset2:
-    _unionMany
-      (_coerceMany "lib.fileset.union" [
+    fileset1: fileset2:
+    _unionMany (
+      _coerceMany "lib.fileset.union" [
         {
           context = "First argument";
           value = fileset1;
@@ -579,7 +566,8 @@ in {
           context = "Second argument";
           value = fileset2;
         }
-      ]);
+      ]
+    );
 
   /**
     The file set containing all files that are in any of the given file sets.
@@ -590,7 +578,6 @@ in {
     The given file sets are evaluated as lazily as possible,
     with earlier elements being evaluated first if needed.
 
-
     # Inputs
 
     `filesets`
@@ -631,16 +618,17 @@ in {
   */
   unions =
     filesets:
-    if ! isList filesets then
-      throw ''
-        lib.fileset.unions: Argument is of type ${typeOf filesets}, but it should be a list instead.''
+    if !isList filesets then
+      throw ''lib.fileset.unions: Argument is of type ${typeOf filesets}, but it should be a list instead.''
     else
       pipe filesets [
         # Annotate the elements with context, used by _coerceMany for better errors
-        (imap0 (i: el: {
-          context = "Element ${toString i}";
-          value = el;
-        }))
+        (imap0 (
+          i: el: {
+            context = "Element ${toString i}";
+            value = el;
+          }
+        ))
         (_coerceMany "lib.fileset.unions")
         _unionMany
       ];
@@ -652,7 +640,6 @@ in {
     The given file sets are evaluated as lazily as possible,
     with the first argument being evaluated first if needed.
 
-
     # Inputs
 
     `fileset1`
@@ -681,8 +668,7 @@ in {
     :::
   */
   intersection =
-    fileset1:
-    fileset2:
+    fileset1: fileset2:
     let
       filesets = _coerceMany "lib.fileset.intersection" [
         {
@@ -695,9 +681,7 @@ in {
         }
       ];
     in
-    _intersection
-      (elemAt filesets 0)
-      (elemAt filesets 1);
+    _intersection (elemAt filesets 0) (elemAt filesets 1);
 
   /**
     The file set containing all files from the first file set that are not in the second file set.
@@ -706,7 +690,6 @@ in {
     The given file sets are evaluated as lazily as possible,
     with the first argument being evaluated first if needed.
 
-
     # Inputs
 
     `positive`
@@ -744,8 +727,7 @@ in {
     :::
   */
   difference =
-    positive:
-    negative:
+    positive: negative:
     let
       filesets = _coerceMany "lib.fileset.difference" [
         {
@@ -758,14 +740,11 @@ in {
         }
       ];
     in
-    _difference
-      (elemAt filesets 0)
-      (elemAt filesets 1);
+    _difference (elemAt filesets 0) (elemAt filesets 1);
 
   /**
     Filter a file set to only contain files matching some predicate.
 
-
     # Inputs
 
     `predicate`
@@ -827,22 +806,18 @@ in {
     :::
   */
   fileFilter =
-    predicate:
-    path:
-    if ! isFunction predicate then
-      throw ''
-        lib.fileset.fileFilter: First argument is of type ${typeOf predicate}, but it should be a function instead.''
-    else if ! isPath path then
+    predicate: path:
+    if !isFunction predicate then
+      throw ''lib.fileset.fileFilter: First argument is of type ${typeOf predicate}, but it should be a function instead.''
+    else if !isPath path then
       if path._type or "" == "fileset" then
         throw ''
           lib.fileset.fileFilter: Second argument is a file set, but it should be a path instead.
               If you need to filter files in a file set, use `intersection fileset (fileFilter pred ./.)` instead.''
       else
-        throw ''
-          lib.fileset.fileFilter: Second argument is of type ${typeOf path}, but it should be a path instead.''
-    else if ! pathExists path then
-      throw ''
-        lib.fileset.fileFilter: Second argument (${toString path}) is a path that does not exist.''
+        throw ''lib.fileset.fileFilter: Second argument is of type ${typeOf path}, but it should be a path instead.''
+    else if !pathExists path then
+      throw ''lib.fileset.fileFilter: Second argument (${toString path}) is a path that does not exist.''
     else
       _fileFilter predicate path;
 
@@ -859,7 +834,6 @@ in {
     Turning the result of this function back into a source using `toSource` will therefore not preserve empty directories.
     :::
 
-
     # Inputs
 
     `source`
@@ -905,7 +879,8 @@ in {
 
     :::
   */
-  fromSource = source:
+  fromSource =
+    source:
     let
       # This function uses `._isLibCleanSourceWith`, `.origSrc` and `.filter`,
       # which are technically internal to lib.sources,
@@ -915,17 +890,15 @@ in {
       path = if isFiltered then source.origSrc else source;
     in
     # We can only support sources created from paths
-    if ! isPath path then
+    if !isPath path then
       if isStringLike path then
         throw ''
           lib.fileset.fromSource: The source origin of the argument is a string-like value ("${toString path}"), but it should be a path instead.
               Sources created from paths in strings cannot be turned into file sets, use `lib.sources` or derivations instead.''
       else
-        throw ''
-          lib.fileset.fromSource: The source origin of the argument is of type ${typeOf path}, but it should be a path instead.''
-    else if ! pathExists path then
-      throw ''
-        lib.fileset.fromSource: The source origin (${toString path}) of the argument is a path that does not exist.''
+        throw ''lib.fileset.fromSource: The source origin of the argument is of type ${typeOf path}, but it should be a path instead.''
+    else if !pathExists path then
+      throw ''lib.fileset.fromSource: The source origin (${toString path}) of the argument is a path that does not exist.''
     else if isFiltered then
       _fromSourceFilter path source.filter
     else
@@ -937,7 +910,6 @@ in {
 
     This function behaves like [`gitTrackedWith { }`](#function-library-lib.fileset.gitTrackedWith) - using the defaults.
 
-
     # Inputs
 
     `path`
@@ -966,13 +938,7 @@ in {
 
     :::
   */
-  gitTracked =
-    path:
-    _fromFetchGit
-      "gitTracked"
-      "argument"
-      path
-      {};
+  gitTracked = path: _fromFetchGit "gitTracked" "argument" path { };
 
   /**
     Create a file set containing all [Git-tracked files](https://git-scm.com/book/en/v2/Git-Basics-Recording-Changes-to-the-Repository) in a repository.
@@ -998,7 +964,6 @@ in {
     This may change in the future.
     :::
 
-
     # Inputs
 
     `options` (attribute set)
@@ -1033,19 +998,18 @@ in {
       recurseSubmodules ? false,
     }:
     path:
-    if ! isBool recurseSubmodules then
+    if !isBool recurseSubmodules then
       throw "lib.fileset.gitTrackedWith: Expected the attribute `recurseSubmodules` of the first argument to be a boolean, but it's a ${typeOf recurseSubmodules} instead."
     else if recurseSubmodules && versionOlder nixVersion _fetchGitSubmodulesMinver then
       throw "lib.fileset.gitTrackedWith: Setting the attribute `recurseSubmodules` to `true` is only supported for Nix version ${_fetchGitSubmodulesMinver} and after, but Nix version ${nixVersion} is used."
     else
-      _fromFetchGit
-        "gitTrackedWith"
-        "second argument"
-        path
+      _fromFetchGit "gitTrackedWith" "second argument" path
         # This is the only `fetchGit` parameter that makes sense in this context.
         # We can't just pass `submodules = recurseSubmodules` here because
         # this would fail for Nix versions that don't support `submodules`.
-        (lib.optionalAttrs recurseSubmodules {
-          submodules = true;
-        });
+        (
+          lib.optionalAttrs recurseSubmodules {
+            submodules = true;
+          }
+        );
 }

lib/fileset/internal.nix

@@ -1,4 +1,6 @@
-{ lib ? import ../. }:
+{
+  lib ? import ../.,
+}:
 let
 
   inherit (builtins)
@@ -87,7 +89,8 @@ rec {
       let
         parts = splitRoot filesetV0._internalBase;
       in
-      filesetV0 // {
+      filesetV0
+      // {
         _internalVersion = 1;
         _internalBaseRoot = parts.root;
         _internalBaseComponents = components parts.subpath;
@@ -98,7 +101,8 @@ rec {
     (
       filesetV1:
       # This change is backwards compatible (but not forwards compatible, so we still need a new version)
-      filesetV1 // {
+      filesetV1
+      // {
         _internalVersion = 2;
       }
     )
@@ -106,7 +110,8 @@ rec {
     # Convert v2 into v3: filesetTree's now have a representation for an empty file set without a base path
     (
       filesetV2:
-      filesetV2 // {
+      filesetV2
+      // {
         # All v1 file sets are not the new empty file set
         _internalIsEmptyWithoutBase = false;
         _internalVersion = 3;
@@ -136,7 +141,8 @@ rec {
 
   # Create a fileset, see ./README.md#fileset
   # Type: path -> filesetTree -> fileset
-  _create = base: tree:
+  _create =
+    base: tree:
     let
       # Decompose the base into its components
       # See ../path/README.md for why we're not just using `toString`
@@ -162,7 +168,8 @@ rec {
   # Coerce a value to a fileset, erroring when the value cannot be coerced.
   # The string gives the context for error messages.
   # Type: String -> (fileset | Path) -> fileset
-  _coerce = context: value:
+  _coerce =
+    context: value:
     if value._type or "" == "fileset" then
       if value._internalVersion > _currentVersion then
         throw ''
@@ -173,12 +180,14 @@ rec {
       else if value._internalVersion < _currentVersion then
         let
           # Get all the migration functions necessary to convert from the old to the current version
-          migrationsToApply = sublist value._internalVersion (_currentVersion - value._internalVersion) migrations;
+          migrationsToApply = sublist value._internalVersion (
+            _currentVersion - value._internalVersion
+          ) migrations;
         in
         foldl' (value: migration: migration value) value migrationsToApply
       else
         value
-    else if ! isPath value then
+    else if !isPath value then
       if value ? _isLibCleanSourceWith then
         throw ''
           ${context} is a `lib.sources`-based value, but it should be a file set or a path instead.
@@ -189,9 +198,8 @@ rec {
           ${context} ("${toString value}") is a string-like value, but it should be a file set or a path instead.
               Paths represented as strings are not supported by `lib.fileset`, use `lib.sources` or derivations instead.''
       else
-        throw ''
-          ${context} is of type ${typeOf value}, but it should be a file set or a path instead.''
-    else if ! pathExists value then
+        throw ''${context} is of type ${typeOf value}, but it should be a file set or a path instead.''
+    else if !pathExists value then
       throw ''
         ${context} (${toString value}) is a path that does not exist.
             To create a file set from a path that may not exist, use `lib.fileset.maybeMissing`.''
@@ -201,22 +209,21 @@ rec {
   # Coerce many values to filesets, erroring when any value cannot be coerced,
   # or if the filesystem root of the values doesn't match.
   # Type: String -> [ { context :: String, value :: fileset | Path } ] -> [ fileset ]
-  _coerceMany = functionContext: list:
+  _coerceMany =
+    functionContext: list:
     let
-      filesets = map ({ context, value }:
-        _coerce "${functionContext}: ${context}" value
-      ) list;
+      filesets = map ({ context, value }: _coerce "${functionContext}: ${context}" value) list;
 
       # Find the first value with a base, there may be none!
-      firstWithBase = findFirst (fileset: ! fileset._internalIsEmptyWithoutBase) null filesets;
+      firstWithBase = findFirst (fileset: !fileset._internalIsEmptyWithoutBase) null filesets;
       # This value is only accessed if first != null
       firstBaseRoot = firstWithBase._internalBaseRoot;
 
       # Finds the first element with a filesystem root different than the first element, if any
-      differentIndex = findFirstIndex (fileset:
+      differentIndex = findFirstIndex (
+        fileset:
         # The empty value without a base doesn't have a base path
-        ! fileset._internalIsEmptyWithoutBase
-        && firstBaseRoot != fileset._internalBaseRoot
+        !fileset._internalIsEmptyWithoutBase && firstBaseRoot != fileset._internalBaseRoot
       ) null filesets;
     in
     # Only evaluates `differentIndex` if there are any elements with a base
@@ -231,7 +238,8 @@ rec {
 
   # Create a file set from a path.
   # Type: Path -> fileset
-  _singleton = path:
+  _singleton =
+    path:
     let
       type = pathType path;
     in
@@ -244,21 +252,20 @@ rec {
       #     "default.nix" = <type>;
       #   }
       # See ./README.md#single-files
-      _create (dirOf path)
-        {
-          ${baseNameOf path} = type;
-        };
+      _create (dirOf path) {
+        ${baseNameOf path} = type;
+      };
 
   # Expand a directory representation to an equivalent one in attribute set form.
   # All directory entries are included in the result.
   # Type: Path -> filesetTree -> { <name> = filesetTree; }
-  _directoryEntries = path: value:
+  _directoryEntries =
+    path: value:
     if value == "directory" then
       readDir path
     else
       # Set all entries not present to null
-      mapAttrs (name: value: null) (readDir path)
-      // value;
+      mapAttrs (name: value: null) (readDir path) // value;
 
   /*
     A normalisation of a filesetTree suitable filtering with `builtins.path`:
@@ -271,7 +278,8 @@ rec {
 
     Type: Path -> filesetTree -> filesetTree
   */
-  _normaliseTreeFilter = path: tree:
+  _normaliseTreeFilter =
+    path: tree:
     if tree == "directory" || isAttrs tree then
       let
         entries = _directoryEntries path tree;
@@ -301,7 +309,8 @@ rec {
 
     Type: Path -> filesetTree -> filesetTree (with "emptyDir"'s)
   */
-  _normaliseTreeMinimal = path: tree:
+  _normaliseTreeMinimal =
+    path: tree:
     if tree == "directory" || isAttrs tree then
       let
         entries = _directoryEntries path tree;
@@ -334,9 +343,11 @@ rec {
   # Trace a filesetTree in a pretty way when the resulting value is evaluated.
   # This can handle both normal filesetTree's, and ones returned from _normaliseTreeMinimal
   # Type: Path -> filesetTree (with "emptyDir"'s) -> Null
-  _printMinimalTree = base: tree:
+  _printMinimalTree =
+    base: tree:
     let
-      treeSuffix = tree:
+      treeSuffix =
+        tree:
         if isAttrs tree then
           ""
         else if tree == "directory" then
@@ -349,14 +360,15 @@ rec {
           " (${tree})";
 
       # Only for attribute set trees
-      traceTreeAttrs = prevLine: indent: tree:
-        foldl' (prevLine: name:
+      traceTreeAttrs =
+        prevLine: indent: tree:
+        foldl' (
+          prevLine: name:
           let
             subtree = tree.${name};
 
             # Evaluating this prints the line for this subtree
-            thisLine =
-              trace "${indent}- ${name}${treeSuffix subtree}" prevLine;
+            thisLine = trace "${indent}- ${name}${treeSuffix subtree}" prevLine;
           in
           if subtree == null || subtree == "emptyDir" then
             # Don't print anything at all if this subtree is empty
@@ -378,24 +390,24 @@ rec {
         else
           trace "${toString base}${treeSuffix tree}" null;
     in
-    if isAttrs tree then
-      traceTreeAttrs firstLine "" tree
-    else
-      firstLine;
+    if isAttrs tree then traceTreeAttrs firstLine "" tree else firstLine;
 
   # Pretty-print a file set in a pretty way when the resulting value is evaluated
   # Type: fileset -> Null
-  _printFileset = fileset:
+  _printFileset =
+    fileset:
     if fileset._internalIsEmptyWithoutBase then
       trace "(empty)" null
     else
-      _printMinimalTree fileset._internalBase
-        (_normaliseTreeMinimal fileset._internalBase fileset._internalTree);
+      _printMinimalTree fileset._internalBase (
+        _normaliseTreeMinimal fileset._internalBase fileset._internalTree
+      );
 
   # Turn a fileset into a source filter function suitable for `builtins.path`
   # Only directories recursively containing at least one files are recursed into
   # Type: fileset -> (String -> String -> Bool)
-  _toSourceFilter = fileset:
+  _toSourceFilter =
+    fileset:
     let
       # Simplify the tree, necessary to make sure all empty directories are null
       # which has the effect that they aren't included in the result
@@ -403,7 +415,7 @@ rec {
 
       # The base path as a string with a single trailing slash
       baseString =
-        if fileset._internalBaseComponents == [] then
+        if fileset._internalBaseComponents == [ ] then
           # Need to handle the filesystem root specially
           "/"
         else
@@ -414,9 +426,11 @@ rec {
       # Check whether a list of path components under the base path exists in the tree.
       # This function is called often, so it should be fast.
       # Type: [ String ] -> Bool
-      inTree = components:
+      inTree =
+        components:
         let
-          recurse = index: localTree:
+          recurse =
+            index: localTree:
             if isAttrs localTree then
               # We have an attribute set, meaning this is a directory with at least one file
               if index >= length components then
@@ -431,7 +445,8 @@ rec {
               # If it's not an attribute set it can only be either null (in which case it's not included)
               # or a string ("directory" or "regular", etc.) in which case it's included
               localTree != null;
-        in recurse 0 tree;
+        in
+        recurse 0 tree;
 
       # Filter suited when there's no files
       empty = _: _: false;
@@ -483,16 +498,14 @@ rec {
     # Special case because the code below assumes that the _internalBase is always included in the result
     # which shouldn't be done when we have no files at all in the base
     # This also forces the tree before returning the filter, leads to earlier error messages
-    if fileset._internalIsEmptyWithoutBase || tree == null then
-      empty
-    else
-      nonEmpty;
+    if fileset._internalIsEmptyWithoutBase || tree == null then empty else nonEmpty;
 
   # Turn a builtins.filterSource-based source filter on a root path into a file set
   # containing only files included by the filter.
   # The filter is lazily called as necessary to determine whether paths are included
   # Type: Path -> (String -> String -> Bool) -> fileset
-  _fromSourceFilter = root: sourceFilter:
+  _fromSourceFilter =
+    root: sourceFilter:
     let
       # During the recursion we need to track both:
       # - The path value such that we can safely call `readDir` on it
@@ -503,9 +516,10 @@ rec {
       # which is a fairly expensive operation
 
       # Create a file set from a directory entry
-      fromDirEntry = path: pathString: type:
+      fromDirEntry =
+        path: pathString: type:
         # The filter needs to run on the path as a string
-        if ! sourceFilter pathString type then
+        if !sourceFilter pathString type then
           null
         else if type == "directory" then
           fromDir path pathString
@@ -513,7 +527,8 @@ rec {
           type;
 
       # Create a file set from a directory
-      fromDir = path: pathString:
+      fromDir =
+        path: pathString:
         mapAttrs
           # This looks a bit funny, but we need both the path-based and the path string-based values
           (name: fromDirEntry (path + "/${name}") (pathString + "/${name}"))
@@ -536,20 +551,19 @@ rec {
     else
       # Direct files are always included by builtins.path without calling the filter
       # But we need to lift up the base path to its parent to satisfy the base path invariant
-      _create (dirOf root)
-        {
-          ${baseNameOf root} = rootPathType;
-        };
+      _create (dirOf root) {
+        ${baseNameOf root} = rootPathType;
+      };
 
   # Turns a file set into the list of file paths it includes.
   # Type: fileset -> [ Path ]
-  _toList = fileset:
+  _toList =
+    fileset:
     let
-      recurse = path: tree:
+      recurse =
+        path: tree:
         if isAttrs tree then
-          concatLists (mapAttrsToList (name: value:
-            recurse (path + "/${name}") value
-          ) tree)
+          concatLists (mapAttrsToList (name: value: recurse (path + "/${name}") value) tree)
         else if tree == "directory" then
           recurse path (readDir path)
         else if tree == null then
@@ -565,9 +579,11 @@ rec {
   # Transforms the filesetTree of a file set to a shorter base path, e.g.
   # _shortenTreeBase [ "foo" ] (_create /foo/bar null)
   # => { bar = null; }
-  _shortenTreeBase = targetBaseComponents: fileset:
+  _shortenTreeBase =
+    targetBaseComponents: fileset:
     let
-      recurse = index:
+      recurse =
+        index:
         # If we haven't reached the required depth yet
         if index < length fileset._internalBaseComponents then
           # Create an attribute set and recurse as the value, this can be lazily evaluated this way
@@ -581,9 +597,11 @@ rec {
   # Transforms the filesetTree of a file set to a longer base path, e.g.
   # _lengthenTreeBase [ "foo" "bar" ] (_create /foo { bar.baz = "regular"; })
   # => { baz = "regular"; }
-  _lengthenTreeBase = targetBaseComponents: fileset:
+  _lengthenTreeBase =
+    targetBaseComponents: fileset:
     let
-      recurse = index: tree:
+      recurse =
+        index: tree:
         # If the filesetTree is an attribute set and we haven't reached the required depth yet
         if isAttrs tree && index < length targetBaseComponents then
           # Recurse with the tree under the right component (which might not exist)
@@ -602,10 +620,11 @@ rec {
   # Computes the union of a list of filesets.
   # The filesets must already be coerced and validated to be in the same filesystem root
   # Type: [ Fileset ] -> Fileset
-  _unionMany = filesets:
+  _unionMany =
+    filesets:
     let
       # All filesets that have a base, aka not the ones that are the empty value without a base
-      filesetsWithBase = filter (fileset: ! fileset._internalIsEmptyWithoutBase) filesets;
+      filesetsWithBase = filter (fileset: !fileset._internalIsEmptyWithoutBase) filesets;
 
       # The first fileset that has a base.
       # This value is only accessed if there are at all.
@@ -618,13 +637,13 @@ rec {
       # A list of path components common to all base paths.
       # Note that commonPrefix can only be fully evaluated,
       # so this cannot cause a stack overflow due to a build-up of unevaluated thunks.
-      commonBaseComponents = foldl'
-        (components: el: commonPrefix components el._internalBaseComponents)
-        firstWithBase._internalBaseComponents
-        # We could also not do the `tail` here to avoid a list allocation,
-        # but then we'd have to pay for a potentially expensive
-        # but unnecessary `commonPrefix` call
-        (tail filesetsWithBase);
+      commonBaseComponents =
+        foldl' (components: el: commonPrefix components el._internalBaseComponents)
+          firstWithBase._internalBaseComponents
+          # We could also not do the `tail` here to avoid a list allocation,
+          # but then we'd have to pay for a potentially expensive
+          # but unnecessary `commonPrefix` call
+          (tail filesetsWithBase);
 
       # The common base path assembled from a filesystem root and the common components
       commonBase = append firstWithBase._internalBaseRoot (join commonBaseComponents);
@@ -643,15 +662,13 @@ rec {
       resultTree = _unionTrees trees;
     in
     # If there's no values with a base, we have no files
-    if filesetsWithBase == [ ] then
-      _emptyWithoutBase
-    else
-      _create commonBase resultTree;
+    if filesetsWithBase == [ ] then _emptyWithoutBase else _create commonBase resultTree;
 
   # The union of multiple filesetTree's with the same base path.
   # Later elements are only evaluated if necessary.
   # Type: [ filesetTree ] -> filesetTree
-  _unionTrees = trees:
+  _unionTrees =
+    trees:
     let
       stringIndex = findFirstIndex isString null trees;
       withoutNull = filter (tree: tree != null) trees;
@@ -671,18 +688,15 @@ rec {
   # Computes the intersection of a list of filesets.
   # The filesets must already be coerced and validated to be in the same filesystem root
   # Type: Fileset -> Fileset -> Fileset
-  _intersection = fileset1: fileset2:
+  _intersection =
+    fileset1: fileset2:
     let
       # The common base components prefix, e.g.
       # (/foo/bar, /foo/bar/baz) -> /foo/bar
       # (/foo/bar, /foo/baz) -> /foo
       commonBaseComponentsLength =
         # TODO: Have a `lib.lists.commonPrefixLength` function such that we don't need the list allocation from commonPrefix here
-        length (
-          commonPrefix
-            fileset1._internalBaseComponents
-            fileset2._internalBaseComponents
-        );
+        length (commonPrefix fileset1._internalBaseComponents fileset2._internalBaseComponents);
 
       # To be able to intersect filesetTree's together, they need to have the same base path.
       # Base paths can be intersected by taking the longest one (if any)
@@ -725,12 +739,11 @@ rec {
   # The intersection of two filesetTree's with the same base path
   # The second element is only evaluated as much as necessary.
   # Type: filesetTree -> filesetTree -> filesetTree
-  _intersectTree = lhs: rhs:
+  _intersectTree =
+    lhs: rhs:
     if isAttrs lhs && isAttrs rhs then
       # Both sides are attribute sets, we can recurse for the attributes existing on both sides
-      mapAttrs
-        (name: _intersectTree lhs.${name})
-        (builtins.intersectAttrs lhs rhs)
+      mapAttrs (name: _intersectTree lhs.${name}) (builtins.intersectAttrs lhs rhs)
     else if lhs == null || isString rhs then
       # If the lhs is null, the result should also be null
       # And if the rhs is the identity element
@@ -743,18 +756,15 @@ rec {
   # Compute the set difference between two file sets.
   # The filesets must already be coerced and validated to be in the same filesystem root.
   # Type: Fileset -> Fileset -> Fileset
-  _difference = positive: negative:
+  _difference =
+    positive: negative:
     let
       # The common base components prefix, e.g.
       # (/foo/bar, /foo/bar/baz) -> /foo/bar
       # (/foo/bar, /foo/baz) -> /foo
       commonBaseComponentsLength =
         # TODO: Have a `lib.lists.commonPrefixLength` function such that we don't need the list allocation from commonPrefix here
-        length (
-          commonPrefix
-            positive._internalBaseComponents
-            negative._internalBaseComponents
-        );
+        length (commonPrefix positive._internalBaseComponents negative._internalBaseComponents);
 
       # We need filesetTree's with the same base to be able to compute the difference between them
       # This here is the filesetTree from the negative file set, but for a base path that matches the positive file set.
@@ -786,9 +796,7 @@ rec {
           null;
 
       resultingTree =
-        _differenceTree
-          positive._internalBase
-          positive._internalTree
+        _differenceTree positive._internalBase positive._internalTree
           negativeTreeWithPositiveBase;
     in
     # If the first file set is empty, we can never have any files in the result
@@ -805,7 +813,8 @@ rec {
 
   # Computes the set difference of two filesetTree's
   # Type: Path -> filesetTree -> filesetTree
-  _differenceTree = path: lhs: rhs:
+  _differenceTree =
+    path: lhs: rhs:
     # If the lhs doesn't have any files, or the right hand side includes all files
     if lhs == null || isString rhs then
       # The result will always be empty
@@ -816,17 +825,19 @@ rec {
       lhs
     else
       # Otherwise we always have two attribute sets to recurse into
-      mapAttrs (name: lhsValue:
-        _differenceTree (path + "/${name}") lhsValue (rhs.${name} or null)
-      ) (_directoryEntries path lhs);
+      mapAttrs (name: lhsValue: _differenceTree (path + "/${name}") lhsValue (rhs.${name} or null)) (
+        _directoryEntries path lhs
+      );
 
   # Filters all files in a path based on a predicate
   # Type: ({ name, type, ... } -> Bool) -> Path -> FileSet
-  _fileFilter = predicate: root:
+  _fileFilter =
+    predicate: root:
     let
       # Check the predicate for a single file
       # Type: String -> String -> filesetTree
-      fromFile = name: type:
+      fromFile =
+        name: type:
         if
           predicate {
             inherit name type;
@@ -834,7 +845,8 @@ rec {
 
             # To ensure forwards compatibility with more arguments being added in the future,
             # adding an attribute which can't be deconstructed :)
-            "lib.fileset.fileFilter: The predicate function passed as the first argument must be able to handle extra attributes for future compatibility. If you're using `{ name, file, hasExt }:`, use `{ name, file, hasExt, ... }:` instead." = null;
+            "lib.fileset.fileFilter: The predicate function passed as the first argument must be able to handle extra attributes for future compatibility. If you're using `{ name, file, hasExt }:`, use `{ name, file, hasExt, ... }:` instead." =
+              null;
           }
         then
           type
@@ -843,12 +855,10 @@ rec {
 
       # Check the predicate for all files in a directory
       # Type: Path -> filesetTree
-      fromDir = path:
-        mapAttrs (name: type:
-          if type == "directory" then
-            fromDir (path + "/${name}")
-          else
-            fromFile name type
+      fromDir =
+        path:
+        mapAttrs (
+          name: type: if type == "directory" then fromDir (path + "/${name}") else fromFile name type
         ) (readDir path);
 
       rootType = pathType root;
@@ -858,8 +868,7 @@ rec {
     else
       # Single files are turned into a directory containing that file or nothing.
       _create (dirOf root) {
-        ${baseNameOf root} =
-          fromFile (baseNameOf root) rootType;
+        ${baseNameOf root} = fromFile (baseNameOf root) rootType;
       };
 
   # Support for `builtins.fetchGit` with `submodules = true` was introduced in 2.4
@@ -876,22 +885,21 @@ rec {
   # - The store path must not include files that don't exist in the respective local path.
   #
   # Type: Path -> String -> FileSet
-  _mirrorStorePath = localPath: storePath:
+  _mirrorStorePath =
+    localPath: storePath:
     let
-      recurse = focusedStorePath:
-        mapAttrs (name: type:
-          if type == "directory" then
-            recurse (focusedStorePath + "/${name}")
-          else
-            type
+      recurse =
+        focusedStorePath:
+        mapAttrs (
+          name: type: if type == "directory" then recurse (focusedStorePath + "/${name}") else type
         ) (builtins.readDir focusedStorePath);
     in
-    _create localPath
-      (recurse storePath);
+    _create localPath (recurse storePath);
 
   # Create a file set from the files included in the result of a fetchGit call
   # Type: String -> String -> Path -> Attrs -> FileSet
-  _fromFetchGit = function: argument: path: extraFetchGitAttrs:
+  _fromFetchGit =
+    function: argument: path: extraFetchGitAttrs:
     let
       # The code path for when isStorePath is true
       tryStorePath =
@@ -922,31 +930,33 @@ rec {
           # With the [lazy trees PR](https://github.com/NixOS/nix/pull/6530),
           # the unnecessarily import could be avoided.
           # However a simpler alternative still would be [a builtins.gitLsFiles](https://github.com/NixOS/nix/issues/2944).
-          fetchResult = fetchGit ({
-            url = path;
-          }
-          # In older Nix versions, repositories were always assumed to be deep clones, which made `fetchGit` fail for shallow clones
-          # For newer versions this was fixed, but the `shallow` flag is required.
-          # The only behavioral difference is that for shallow clones, `fetchGit` doesn't return a `revCount`,
-          # which we don't need here, so it's fine to always pass it.
+          fetchResult = fetchGit (
+            {
+              url = path;
+            }
+            # In older Nix versions, repositories were always assumed to be deep clones, which made `fetchGit` fail for shallow clones
+            # For newer versions this was fixed, but the `shallow` flag is required.
+            # The only behavioral difference is that for shallow clones, `fetchGit` doesn't return a `revCount`,
+            # which we don't need here, so it's fine to always pass it.
 
-          # Unfortunately this means older Nix versions get a poor error message for shallow repositories, and there's no good way to improve that.
-          # Checking for `.git/shallow` doesn't seem worth it, especially since that's more of an implementation detail,
-          # and would also require more code to handle worktrees where `.git` is a file.
-          // optionalAttrs (versionAtLeast nixVersion _fetchGitShallowMinver) { shallow = true; }
-          // extraFetchGitAttrs);
+            # Unfortunately this means older Nix versions get a poor error message for shallow repositories, and there's no good way to improve that.
+            # Checking for `.git/shallow` doesn't seem worth it, especially since that's more of an implementation detail,
+            # and would also require more code to handle worktrees where `.git` is a file.
+            // optionalAttrs (versionAtLeast nixVersion _fetchGitShallowMinver) { shallow = true; }
+            // extraFetchGitAttrs
+          );
         in
         # We can identify local working directories by checking for .git,
         # see https://git-scm.com/docs/gitrepository-layout#_description.
         # Note that `builtins.fetchGit` _does_ work for bare repositories (where there's no `.git`),
         # even though `git ls-files` wouldn't return any files in that case.
-        if ! pathExists (path + "/.git") then
+        if !pathExists (path + "/.git") then
           throw "lib.fileset.${function}: Expected the ${argument} (${toString path}) to point to a local working tree of a Git repository, but it's not."
         else
           _mirrorStorePath path fetchResult.outPath;
 
     in
-    if ! isPath path then
+    if !isPath path then
       throw "lib.fileset.${function}: Expected the ${argument} to be a path, but it's a ${typeOf path} instead."
     else if pathType path != "directory" then
       throw "lib.fileset.${function}: Expected the ${argument} (${toString path}) to be a directory, but it's a file instead."

lib/fileset/mock-splitRoot.nix

@@ -8,18 +8,21 @@
 #    }
 self: super: {
   path = super.path // {
-    splitRoot = path:
+    splitRoot =
+      path:
       let
         parts = super.path.splitRoot path;
         components = self.path.subpath.components parts.subpath;
         count = self.length components;
-        rootIndex = count - self.lists.findFirstIndex
-          (component: component == "mock-root")
-          (self.length components)
-          (self.reverseList components);
+        rootIndex =
+          count
+          - self.lists.findFirstIndex (component: component == "mock-root") (self.length components) (
+            self.reverseList components
+          );
         root = self.path.append parts.root (self.path.subpath.join (self.take rootIndex components));
         subpath = self.path.subpath.join (self.drop rootIndex components);
-      in {
+      in
+      {
         inherit root subpath;
       };
   };

lib/fixed-points.nix

@@ -72,7 +72,12 @@ rec {
       fix (self: [ 1 2 (elemAt self 0 + elemAt self 1) ])
       => [ 1 2 3 ]
   */
-  fix = f: let x = f x; in x;
+  fix =
+    f:
+    let
+      x = f x;
+    in
+    x;
 
   /*
     A variant of `fix` that records the original recursive attribute set in the
@@ -81,7 +86,14 @@ rec {
     This is useful in combination with the `extends` function to
     implement deep overriding.
   */
-  fix' = f: let x = f x // { __unfix__ = f; }; in x;
+  fix' =
+    f:
+    let
+      x = f x // {
+        __unfix__ = f;
+      };
+    in
+    x;
 
   /*
     Return the fixpoint that `f` converges to when called iteratively, starting
@@ -94,13 +106,12 @@ rec {
 
     Type: (a -> a) -> a -> a
   */
-  converge = f: x:
+  converge =
+    f: x:
     let
       x' = f x;
     in
-      if x' == x
-      then x
-      else converge f x';
+    if x' == x then x else converge f x';
 
   /*
     Extend a function using an overlay.
@@ -109,7 +120,6 @@ rec {
     A fixed-point function is a function which is intended to be evaluated by passing the result of itself as the argument.
     This is possible due to Nix's lazy evaluation.
 
-
     A fixed-point function returning an attribute set has the form
 
     ```nix
@@ -259,9 +269,11 @@ rec {
   */
   composeExtensions =
     f: g: final: prev:
-      let fApplied = f final prev;
-          prev' = prev // fApplied;
-      in fApplied // g final prev';
+    let
+      fApplied = f final prev;
+      prev' = prev // fApplied;
+    in
+    fApplied // g final prev';
 
   /*
     Compose several extending functions of the type expected by 'extends' into
@@ -273,8 +285,7 @@ rec {
                               ^final        ^prev         ^overrides     ^final        ^prev         ^overrides
     ```
   */
-  composeManyExtensions =
-    lib.foldr (x: y: composeExtensions x y) (final: prev: {});
+  composeManyExtensions = lib.foldr (x: y: composeExtensions x y) (final: prev: { });
 
   /*
     Create an overridable, recursive attribute set. For example:
@@ -302,8 +313,13 @@ rec {
     Same as `makeExtensible` but the name of the extending attribute is
     customized.
   */
-  makeExtensibleWithCustomName = extenderName: rattrs:
-    fix' (self: (rattrs self) // {
-      ${extenderName} = f: makeExtensibleWithCustomName extenderName (extends f rattrs);
-    });
+  makeExtensibleWithCustomName =
+    extenderName: rattrs:
+    fix' (
+      self:
+      (rattrs self)
+      // {
+        ${extenderName} = f: makeExtensibleWithCustomName extenderName (extends f rattrs);
+      }
+    );
 }

lib/flake-version-info.nix

@@ -13,8 +13,9 @@ finalLib: prevLib: # lib overlay
 
 {
   trivial = prevLib.trivial // {
-    versionSuffix =
-      ".${finalLib.substring 0 8 (self.lastModifiedDate or "19700101")}.${self.shortRev or "dirty"}";
+    versionSuffix = ".${
+      finalLib.substring 0 8 (self.lastModifiedDate or "19700101")
+    }.${self.shortRev or "dirty"}";
     revisionWithDefault = default: self.rev or default;
   };
 }

lib/flake.nix

@@ -1,10 +1,12 @@
 {
   description = "Library of low-level helper functions for nix expressions.";
 
-  outputs = { self }:
+  outputs =
+    { self }:
     let
       lib0 = import ./.;
-    in {
+    in
+    {
       lib = lib0.extend (import ./flake-version-info.nix self);
     };
 }

lib/gvariant.nix

@@ -14,7 +14,12 @@
 
 let
   inherit (lib)
-    concatMapStringsSep concatStrings escape head replaceStrings;
+    concatMapStringsSep
+    concatStrings
+    escape
+    head
+    replaceStrings
+    ;
 
   mkPrimitive = t: v: {
     _type = "gvariant";
@@ -41,10 +46,11 @@ let
     variant = "v";
   };
 
-  /* Check if a value is a GVariant value
+  /*
+    Check if a value is a GVariant value
 
-     Type:
-       isGVariant :: Any -> Bool
+    Type:
+      isGVariant :: Any -> Bool
   */
   isGVariant = v: v._type or "" == "gvariant";
 
@@ -100,13 +106,15 @@ rec {
     }
   ];
 
-  /* Returns the GVariant value that most closely matches the given Nix value.
-     If no GVariant value can be found unambiguously then error is thrown.
+  /*
+    Returns the GVariant value that most closely matches the given Nix value.
+    If no GVariant value can be found unambiguously then error is thrown.
 
-     Type:
-       mkValue :: Any -> gvariant
+    Type:
+      mkValue :: Any -> gvariant
   */
-  mkValue = v:
+  mkValue =
+    v:
     if builtins.isBool v then
       mkBoolean v
     else if builtins.isFloat v then
@@ -119,84 +127,99 @@ rec {
       v
     else if builtins.isInt v then
       let
-        validConstructors = builtins.filter ({ min, max, ... }: (min == null || min <= v) && (max == null || v <= max)) intConstructors;
+        validConstructors = builtins.filter (
+          { min, max, ... }: (min == null || min <= v) && (max == null || v <= max)
+        ) intConstructors;
       in
       throw ''
         The GVariant type for number “${builtins.toString v}” is unclear.
         Please wrap the value with one of the following, depending on the value type in GSettings schema:
 
-        ${lib.concatMapStringsSep "\n" ({ name, type, ...}: "- `lib.gvariant.${name}` for `${type}`") validConstructors}
+        ${lib.concatMapStringsSep "\n" (
+          { name, type, ... }: "- `lib.gvariant.${name}` for `${type}`"
+        ) validConstructors}
       ''
     else if builtins.isAttrs v then
       throw "Cannot construct GVariant value from an attribute set. If you want to construct a dictionary, you will need to create an array containing items constructed with `lib.gvariant.mkDictionaryEntry`."
     else
       throw "The GVariant type of “${builtins.typeOf v}” can't be inferred.";
 
-  /* Returns the GVariant array from the given type of the elements and a Nix list.
+  /*
+    Returns the GVariant array from the given type of the elements and a Nix list.
 
-     Type:
-       mkArray :: [Any] -> gvariant
+    Type:
+      mkArray :: [Any] -> gvariant
 
-     Example:
-       # Creating a string array
-       lib.gvariant.mkArray [ "a" "b" "c" ]
+    Example:
+      # Creating a string array
+      lib.gvariant.mkArray [ "a" "b" "c" ]
   */
-  mkArray = elems:
+  mkArray =
+    elems:
     let
       vs = map mkValue (lib.throwIf (elems == [ ]) "Please create empty array with mkEmptyArray." elems);
-      elemType = lib.throwIfNot (lib.all (t: (head vs).type == t) (map (v: v.type) vs))
-        "Elements in a list should have same type."
-        (head vs).type;
+      elemType = lib.throwIfNot (lib.all (t: (head vs).type == t) (
+        map (v: v.type) vs
+      )) "Elements in a list should have same type." (head vs).type;
     in
-    mkPrimitive (type.arrayOf elemType) vs // {
-      __toString = self:
-        "@${self.type} [${concatMapStringsSep "," toString self.value}]";
+    mkPrimitive (type.arrayOf elemType) vs
+    // {
+      __toString = self: "@${self.type} [${concatMapStringsSep "," toString self.value}]";
     };
 
-  /* Returns the GVariant array from the given empty Nix list.
+  /*
+    Returns the GVariant array from the given empty Nix list.
 
-     Type:
-       mkEmptyArray :: gvariant.type -> gvariant
+    Type:
+      mkEmptyArray :: gvariant.type -> gvariant
 
-     Example:
-       # Creating an empty string array
-       lib.gvariant.mkEmptyArray (lib.gvariant.type.string)
+    Example:
+      # Creating an empty string array
+      lib.gvariant.mkEmptyArray (lib.gvariant.type.string)
   */
-  mkEmptyArray = elemType: mkPrimitive (type.arrayOf elemType) [ ] // {
-    __toString = self: "@${self.type} []";
-  };
+  mkEmptyArray =
+    elemType:
+    mkPrimitive (type.arrayOf elemType) [ ]
+    // {
+      __toString = self: "@${self.type} []";
+    };
 
+  /*
+    Returns the GVariant variant from the given Nix value. Variants are containers
+    of different GVariant type.
 
-  /* Returns the GVariant variant from the given Nix value. Variants are containers
-     of different GVariant type.
+    Type:
+      mkVariant :: Any -> gvariant
 
-     Type:
-       mkVariant :: Any -> gvariant
-
-     Example:
-       lib.gvariant.mkArray [
-         (lib.gvariant.mkVariant "a string")
-         (lib.gvariant.mkVariant (lib.gvariant.mkInt32 1))
-       ]
+    Example:
+      lib.gvariant.mkArray [
+        (lib.gvariant.mkVariant "a string")
+        (lib.gvariant.mkVariant (lib.gvariant.mkInt32 1))
+      ]
   */
-  mkVariant = elem:
-    let gvarElem = mkValue elem;
-    in mkPrimitive type.variant gvarElem // {
+  mkVariant =
+    elem:
+    let
+      gvarElem = mkValue elem;
+    in
+    mkPrimitive type.variant gvarElem
+    // {
       __toString = self: "<${toString self.value}>";
     };
 
-  /* Returns the GVariant dictionary entry from the given key and value.
+  /*
+    Returns the GVariant dictionary entry from the given key and value.
 
-     Type:
-       mkDictionaryEntry :: String -> Any -> gvariant
+    Type:
+      mkDictionaryEntry :: String -> Any -> gvariant
 
-     Example:
-       # A dictionary describing an Epiphany’s search provider
-       [
-         (lib.gvariant.mkDictionaryEntry "url" (lib.gvariant.mkVariant "https://duckduckgo.com/?q=%s&t=epiphany"))
-         (lib.gvariant.mkDictionaryEntry "bang" (lib.gvariant.mkVariant "!d"))
-         (lib.gvariant.mkDictionaryEntry "name" (lib.gvariant.mkVariant "DuckDuckGo"))
-       ]
+    Example:
+      # A dictionary describing an Epiphany’s search provider
+      [
+        (lib.gvariant.mkDictionaryEntry "url" (lib.gvariant.mkVariant "https://duckduckgo.com/?q=%s&t=epiphany"))
+        (lib.gvariant.mkDictionaryEntry "bang" (lib.gvariant.mkVariant "!d"))
+        (lib.gvariant.mkDictionaryEntry "name" (lib.gvariant.mkVariant "DuckDuckGo"))
+      ]
   */
   mkDictionaryEntry =
     # The key of the entry
@@ -208,143 +231,176 @@ rec {
       value' = mkValue value;
       dictionaryType = type.dictionaryEntryOf name'.type value'.type;
     in
-    mkPrimitive dictionaryType { inherit name value; } // {
+    mkPrimitive dictionaryType { inherit name value; }
+    // {
       __toString = self: "@${self.type} {${name'},${value'}}";
     };
 
-  /* Returns the GVariant maybe from the given element type.
+  /*
+    Returns the GVariant maybe from the given element type.
 
-     Type:
-       mkMaybe :: gvariant.type -> Any -> gvariant
+    Type:
+      mkMaybe :: gvariant.type -> Any -> gvariant
   */
-  mkMaybe = elemType: elem:
-    mkPrimitive (type.maybeOf elemType) elem // {
-      __toString = self:
-        if self.value == null then
-          "@${self.type} nothing"
-        else
-          "just ${toString self.value}";
+  mkMaybe =
+    elemType: elem:
+    mkPrimitive (type.maybeOf elemType) elem
+    // {
+      __toString =
+        self: if self.value == null then "@${self.type} nothing" else "just ${toString self.value}";
     };
 
-  /* Returns the GVariant nothing from the given element type.
+  /*
+    Returns the GVariant nothing from the given element type.
 
-     Type:
-       mkNothing :: gvariant.type -> gvariant
+    Type:
+      mkNothing :: gvariant.type -> gvariant
   */
   mkNothing = elemType: mkMaybe elemType null;
 
-  /* Returns the GVariant just from the given Nix value.
+  /*
+    Returns the GVariant just from the given Nix value.
 
-     Type:
-       mkJust :: Any -> gvariant
+    Type:
+      mkJust :: Any -> gvariant
   */
-  mkJust = elem: let gvarElem = mkValue elem; in mkMaybe gvarElem.type gvarElem;
+  mkJust =
+    elem:
+    let
+      gvarElem = mkValue elem;
+    in
+    mkMaybe gvarElem.type gvarElem;
 
-  /* Returns the GVariant tuple from the given Nix list.
+  /*
+    Returns the GVariant tuple from the given Nix list.
 
-     Type:
-       mkTuple :: [Any] -> gvariant
+    Type:
+      mkTuple :: [Any] -> gvariant
   */
-  mkTuple = elems:
+  mkTuple =
+    elems:
     let
       gvarElems = map mkValue elems;
       tupleType = type.tupleOf (map (e: e.type) gvarElems);
     in
-    mkPrimitive tupleType gvarElems // {
-      __toString = self:
-        "@${self.type} (${concatMapStringsSep "," toString self.value})";
+    mkPrimitive tupleType gvarElems
+    // {
+      __toString = self: "@${self.type} (${concatMapStringsSep "," toString self.value})";
     };
 
-  /* Returns the GVariant boolean from the given Nix bool value.
+  /*
+    Returns the GVariant boolean from the given Nix bool value.
 
-     Type:
-       mkBoolean :: Bool -> gvariant
+    Type:
+      mkBoolean :: Bool -> gvariant
   */
-  mkBoolean = v:
-    mkPrimitive type.boolean v // {
+  mkBoolean =
+    v:
+    mkPrimitive type.boolean v
+    // {
       __toString = self: if self.value then "true" else "false";
     };
 
-  /* Returns the GVariant string from the given Nix string value.
+  /*
+    Returns the GVariant string from the given Nix string value.
 
-     Type:
-       mkString :: String -> gvariant
+    Type:
+      mkString :: String -> gvariant
   */
-  mkString = v:
-    let sanitize = s: replaceStrings [ "\n" ] [ "\\n" ] (escape [ "'" "\\" ] s);
-    in mkPrimitive type.string v // {
+  mkString =
+    v:
+    let
+      sanitize = s: replaceStrings [ "\n" ] [ "\\n" ] (escape [ "'" "\\" ] s);
+    in
+    mkPrimitive type.string v
+    // {
       __toString = self: "'${sanitize self.value}'";
     };
 
-  /* Returns the GVariant object path from the given Nix string value.
+  /*
+    Returns the GVariant object path from the given Nix string value.
 
-     Type:
-       mkObjectpath :: String -> gvariant
+    Type:
+      mkObjectpath :: String -> gvariant
   */
-  mkObjectpath = v:
-    mkPrimitive type.string v // {
+  mkObjectpath =
+    v:
+    mkPrimitive type.string v
+    // {
       __toString = self: "objectpath '${escape [ "'" ] self.value}'";
     };
 
-  /* Returns the GVariant uchar from the given Nix int value.
+  /*
+    Returns the GVariant uchar from the given Nix int value.
 
-     Type:
-       mkUchar :: Int -> gvariant
+    Type:
+      mkUchar :: Int -> gvariant
   */
   mkUchar = mkPrimitive type.uchar;
 
-  /* Returns the GVariant int16 from the given Nix int value.
+  /*
+    Returns the GVariant int16 from the given Nix int value.
 
-     Type:
-       mkInt16 :: Int -> gvariant
+    Type:
+      mkInt16 :: Int -> gvariant
   */
   mkInt16 = mkPrimitive type.int16;
 
-  /* Returns the GVariant uint16 from the given Nix int value.
+  /*
+    Returns the GVariant uint16 from the given Nix int value.
 
-     Type:
-       mkUint16 :: Int -> gvariant
+    Type:
+      mkUint16 :: Int -> gvariant
   */
   mkUint16 = mkPrimitive type.uint16;
 
-  /* Returns the GVariant int32 from the given Nix int value.
+  /*
+    Returns the GVariant int32 from the given Nix int value.
 
-     Type:
-       mkInt32 :: Int -> gvariant
+    Type:
+      mkInt32 :: Int -> gvariant
   */
-  mkInt32 = v:
-    mkPrimitive type.int32 v // {
+  mkInt32 =
+    v:
+    mkPrimitive type.int32 v
+    // {
       __toString = self: toString self.value;
     };
 
-  /* Returns the GVariant uint32 from the given Nix int value.
+  /*
+    Returns the GVariant uint32 from the given Nix int value.
 
-     Type:
-       mkUint32 :: Int -> gvariant
+    Type:
+      mkUint32 :: Int -> gvariant
   */
   mkUint32 = mkPrimitive type.uint32;
 
-  /* Returns the GVariant int64 from the given Nix int value.
+  /*
+    Returns the GVariant int64 from the given Nix int value.
 
-     Type:
-       mkInt64 :: Int -> gvariant
+    Type:
+      mkInt64 :: Int -> gvariant
   */
   mkInt64 = mkPrimitive type.int64;
 
-  /* Returns the GVariant uint64 from the given Nix int value.
+  /*
+    Returns the GVariant uint64 from the given Nix int value.
 
-     Type:
-       mkUint64 :: Int -> gvariant
+    Type:
+      mkUint64 :: Int -> gvariant
   */
   mkUint64 = mkPrimitive type.uint64;
 
-  /* Returns the GVariant double from the given Nix float value.
+  /*
+    Returns the GVariant double from the given Nix float value.
 
-     Type:
-       mkDouble :: Float -> gvariant
+    Type:
+      mkDouble :: Float -> gvariant
   */
-  mkDouble = v:
-    mkPrimitive type.double v // {
+  mkDouble =
+    v:
+    mkPrimitive type.double v
+    // {
       __toString = self: toString self.value;
     };
 }

lib/kernel.nix

@@ -5,22 +5,34 @@ let
 in
 {
 
-
   # Keeping these around in case we decide to change this horrible implementation :)
-  option = x:
-      x // { optional = true; };
-
-  yes      = { tristate    = "y";  optional = false; };
-  no       = { tristate    = "n";  optional = false; };
-  module   = { tristate    = "m";  optional = false; };
-  unset    = { tristate    = null; optional = false; };
-  freeform = x: { freeform = x; optional = false; };
+  option = x: x // { optional = true; };
 
+  yes = {
+    tristate = "y";
+    optional = false;
+  };
+  no = {
+    tristate = "n";
+    optional = false;
+  };
+  module = {
+    tristate = "m";
+    optional = false;
+  };
+  unset = {
+    tristate = null;
+    optional = false;
+  };
+  freeform = x: {
+    freeform = x;
+    optional = false;
+  };
 
   #  Common patterns/legacy used in common-config/hardened/config.nix
   whenHelpers = version: {
     whenAtLeast = ver: mkIf (versionAtLeast version ver);
-    whenOlder   = ver: mkIf (versionOlder version ver);
+    whenOlder = ver: mkIf (versionOlder version ver);
     # range is (inclusive, exclusive)
     whenBetween = verLow: verHigh: mkIf (versionAtLeast version verLow && versionOlder version verHigh);
   };

lib/licenses.nix

@@ -902,6 +902,17 @@ in mkLicense lset) ({
     free = false;
   };
 
+  ncbiPd = {
+    spdxId = "NCBI-PD";
+    fullname = "NCBI Public Domain Notice";
+    # Due to United States copyright law, anything with this "license" does not have a copyright in the
+    # jurisdiction of the United States. However, other jurisdictions may assign the United States
+    # government copyright to the work, and the license explicitly states that in such a case, no license
+    # is granted. This is nonfree and nonredistributable in most jurisdictions other than the United States.
+    free = false;
+    redistributable = false;
+  };
+
   ncsa = {
     spdxId = "NCSA";
     fullName = "University of Illinois/NCSA Open Source License";

lib/path/default.nix

@@ -1,4 +1,4 @@
-/* Functions for working with path values. */
+# Functions for working with path values.
 # See ./README.md for internal docs
 { lib }:
 let
@@ -41,8 +41,9 @@ let
     ;
 
   # Return the reason why a subpath is invalid, or `null` if it's valid
-  subpathInvalidReason = value:
-    if ! isString value then
+  subpathInvalidReason =
+    value:
+    if !isString value then
       "The given value is of type ${builtins.typeOf value}, but a string was expected"
     else if value == "" then
       "The given string is empty"
@@ -51,11 +52,13 @@ let
     # We don't support ".." components, see ./path.md#parent-directory
     else if match "(.*/)?\\.\\.(/.*)?" value != null then
       "The given string \"${value}\" contains a `..` component, which is not allowed in subpaths"
-    else null;
+    else
+      null;
 
   # Split and normalise a relative path string into its components.
   # Error for ".." components and doesn't include "." components
-  splitRelPath = path:
+  splitRelPath =
+    path:
     let
       # Split the string into its parts using regex for efficiency. This regex
       # matches patterns like "/", "/./", "/././", with arbitrarily many "/"s
@@ -86,26 +89,31 @@ let
       componentCount = partCount - skipEnd - skipStart;
 
     in
-      # Special case of a single "." path component. Such a case leaves a
-      # componentCount of -1 due to the skipStart/skipEnd not verifying that
-      # they don't refer to the same character
-      if path == "." then []
+    # Special case of a single "." path component. Such a case leaves a
+    # componentCount of -1 due to the skipStart/skipEnd not verifying that
+    # they don't refer to the same character
+    if path == "." then
+      [ ]
 
-      # Generate the result list directly. This is more efficient than a
-      # combination of `filter`, `init` and `tail`, because here we don't
-      # allocate any intermediate lists
-      else genList (index:
+    # Generate the result list directly. This is more efficient than a
+    # combination of `filter`, `init` and `tail`, because here we don't
+    # allocate any intermediate lists
+    else
+      genList (
+        index:
         # To get to the element we need to add the number of parts we skip and
         # multiply by two due to the interleaved layout of `parts`
         elemAt parts ((skipStart + index) * 2)
       ) componentCount;
 
   # Join relative path components together
-  joinRelPath = components:
+  joinRelPath =
+    components:
     # Always return relative paths with `./` as a prefix (./path.md#leading-dots-for-relative-paths)
-    "./" +
-    # An empty string is not a valid relative path, so we need to return a `.` when we have no components
-    (if components == [] then "." else concatStringsSep "/" components);
+    "./"
+    +
+      # An empty string is not a valid relative path, so we need to return a `.` when we have no components
+      (if components == [ ] then "." else concatStringsSep "/" components);
 
   # Type: Path -> { root :: Path, components :: [ String ] }
   #
@@ -117,11 +125,18 @@ let
   # because it can distinguish different filesystem roots
   deconstructPath =
     let
-      recurse = components: base:
+      recurse =
+        components: base:
         # If the parent of a path is the path itself, then it's a filesystem root
-        if base == dirOf base then { root = base; inherit components; }
-        else recurse ([ (baseNameOf base) ] ++ components) (dirOf base);
-    in recurse [];
+        if base == dirOf base then
+          {
+            root = base;
+            inherit components;
+          }
+        else
+          recurse ([ (baseNameOf base) ] ++ components) (dirOf base);
+    in
+    recurse [ ];
 
   # The components of the store directory, typically [ "nix" "store" ]
   storeDirComponents = splitRelPath ("./" + storeDir);
@@ -132,7 +147,8 @@ let
   #
   # Whether path components have a store path as a prefix, according to
   # https://nixos.org/manual/nix/stable/store/store-path.html#store-path.
-  componentsHaveStorePathPrefix = components:
+  componentsHaveStorePathPrefix =
+    components:
     # path starts with the store directory (typically /nix/store)
     listHasPrefix storeDirComponents components
     # is not the store directory itself, meaning there's at least one extra component
@@ -145,7 +161,9 @@ let
     # We care more about discerning store path-ness on realistic values. Making it airtight would be fragile and slow.
     && match ".{32}-.+" (elemAt components storeDirLength) != null;
 
-in /* No rec! Add dependencies on this file at the top. */ {
+in
+# No rec! Add dependencies on this file at the top.
+{
 
   /*
     Append a subpath string to a path.
@@ -194,8 +212,8 @@ in /* No rec! Add dependencies on this file at the top. */ {
     path:
     # The subpath string to append
     subpath:
-    assert assertMsg (isPath path) ''
-      lib.path.append: The first argument is of type ${builtins.typeOf path}, but a path was expected'';
+    assert assertMsg (isPath path)
+      ''lib.path.append: The first argument is of type ${builtins.typeOf path}, but a path was expected'';
     assert assertMsg (isValid subpath) ''
       lib.path.append: Second argument is not a valid subpath string:
           ${subpathInvalidReason subpath}'';
@@ -225,25 +243,23 @@ in /* No rec! Add dependencies on this file at the top. */ {
   */
   hasPrefix =
     path1:
-    assert assertMsg
-      (isPath path1)
+    assert assertMsg (isPath path1)
       "lib.path.hasPrefix: First argument is of type ${typeOf path1}, but a path was expected";
     let
       path1Deconstructed = deconstructPath path1;
     in
-      path2:
-      assert assertMsg
-        (isPath path2)
-        "lib.path.hasPrefix: Second argument is of type ${typeOf path2}, but a path was expected";
-      let
-        path2Deconstructed = deconstructPath path2;
-      in
-        assert assertMsg
-        (path1Deconstructed.root == path2Deconstructed.root) ''
-          lib.path.hasPrefix: Filesystem roots must be the same for both paths, but paths with different roots were given:
-              first argument: "${toString path1}" with root "${toString path1Deconstructed.root}"
-              second argument: "${toString path2}" with root "${toString path2Deconstructed.root}"'';
-        take (length path1Deconstructed.components) path2Deconstructed.components == path1Deconstructed.components;
+    path2:
+    assert assertMsg (isPath path2)
+      "lib.path.hasPrefix: Second argument is of type ${typeOf path2}, but a path was expected";
+    let
+      path2Deconstructed = deconstructPath path2;
+    in
+    assert assertMsg (path1Deconstructed.root == path2Deconstructed.root) ''
+      lib.path.hasPrefix: Filesystem roots must be the same for both paths, but paths with different roots were given:
+          first argument: "${toString path1}" with root "${toString path1Deconstructed.root}"
+          second argument: "${toString path2}" with root "${toString path2Deconstructed.root}"'';
+    take (length path1Deconstructed.components) path2Deconstructed.components
+    == path1Deconstructed.components;
 
   /*
     Remove the first path as a component-wise prefix from the second path.
@@ -270,33 +286,29 @@ in /* No rec! Add dependencies on this file at the top. */ {
   */
   removePrefix =
     path1:
-    assert assertMsg
-      (isPath path1)
+    assert assertMsg (isPath path1)
       "lib.path.removePrefix: First argument is of type ${typeOf path1}, but a path was expected.";
     let
       path1Deconstructed = deconstructPath path1;
       path1Length = length path1Deconstructed.components;
     in
-      path2:
-      assert assertMsg
-        (isPath path2)
-        "lib.path.removePrefix: Second argument is of type ${typeOf path2}, but a path was expected.";
-      let
-        path2Deconstructed = deconstructPath path2;
-        success = take path1Length path2Deconstructed.components == path1Deconstructed.components;
-        components =
-          if success then
-            drop path1Length path2Deconstructed.components
-          else
-            throw ''
-              lib.path.removePrefix: The first path argument "${toString path1}" is not a component-wise prefix of the second path argument "${toString path2}".'';
-      in
-        assert assertMsg
-        (path1Deconstructed.root == path2Deconstructed.root) ''
-          lib.path.removePrefix: Filesystem roots must be the same for both paths, but paths with different roots were given:
-              first argument: "${toString path1}" with root "${toString path1Deconstructed.root}"
-              second argument: "${toString path2}" with root "${toString path2Deconstructed.root}"'';
-        joinRelPath components;
+    path2:
+    assert assertMsg (isPath path2)
+      "lib.path.removePrefix: Second argument is of type ${typeOf path2}, but a path was expected.";
+    let
+      path2Deconstructed = deconstructPath path2;
+      success = take path1Length path2Deconstructed.components == path1Deconstructed.components;
+      components =
+        if success then
+          drop path1Length path2Deconstructed.components
+        else
+          throw ''lib.path.removePrefix: The first path argument "${toString path1}" is not a component-wise prefix of the second path argument "${toString path2}".'';
+    in
+    assert assertMsg (path1Deconstructed.root == path2Deconstructed.root) ''
+      lib.path.removePrefix: Filesystem roots must be the same for both paths, but paths with different roots were given:
+          first argument: "${toString path1}" with root "${toString path1Deconstructed.root}"
+          second argument: "${toString path2}" with root "${toString path2Deconstructed.root}"'';
+    joinRelPath components;
 
   /*
     Split the filesystem root from a [path](https://nixos.org/manual/nix/stable/language/values.html#type-path).
@@ -336,12 +348,12 @@ in /* No rec! Add dependencies on this file at the top. */ {
   splitRoot =
     # The path to split the root off of
     path:
-    assert assertMsg
-      (isPath path)
+    assert assertMsg (isPath path)
       "lib.path.splitRoot: Argument is of type ${typeOf path}, but a path was expected";
     let
       deconstructed = deconstructPath path;
-    in {
+    in
+    {
       root = deconstructed.root;
       subpath = joinRelPath deconstructed.components;
     };
@@ -387,12 +399,12 @@ in /* No rec! Add dependencies on this file at the top. */ {
       hasStorePathPrefix /nix/store/nvl9ic0pj1fpyln3zaqrf4cclbqdfn1j-foo.drv
       => true
   */
-  hasStorePathPrefix = path:
+  hasStorePathPrefix =
+    path:
     let
       deconstructed = deconstructPath path;
     in
-    assert assertMsg
-      (isPath path)
+    assert assertMsg (isPath path)
       "lib.path.hasStorePathPrefix: Argument is of type ${typeOf path}, but a path was expected";
     assert assertMsg
       # This function likely breaks or needs adjustment if used with other filesystem roots, if they ever get implemented.
@@ -446,9 +458,7 @@ in /* No rec! Add dependencies on this file at the top. */ {
   */
   subpath.isValid =
     # The value to check
-    value:
-    subpathInvalidReason value == null;
-
+    value: subpathInvalidReason value == null;
 
   /*
     Join subpath strings together using `/`, returning a normalised subpath string.
@@ -511,18 +521,20 @@ in /* No rec! Add dependencies on this file at the top. */ {
     # The list of subpaths to join together
     subpaths:
     # Fast in case all paths are valid
-    if all isValid subpaths
-    then joinRelPath (concatMap splitRelPath subpaths)
+    if all isValid subpaths then
+      joinRelPath (concatMap splitRelPath subpaths)
     else
       # Otherwise we take our time to gather more info for a better error message
       # Strictly go through each path, throwing on the first invalid one
       # Tracks the list index in the fold accumulator
-      foldl' (i: path:
-        if isValid path
-        then i + 1
-        else throw ''
-          lib.path.subpath.join: Element at index ${toString i} is not a valid subpath string:
-              ${subpathInvalidReason path}''
+      foldl' (
+        i: path:
+        if isValid path then
+          i + 1
+        else
+          throw ''
+            lib.path.subpath.join: Element at index ${toString i} is not a valid subpath string:
+                ${subpathInvalidReason path}''
       ) 0 subpaths;
 
   /*

lib/path/tests/default.nix

@@ -2,8 +2,8 @@
   nixpkgs ? ../../..,
   system ? builtins.currentSystem,
   pkgs ? import nixpkgs {
-    config = {};
-    overlays = [];
+    config = { };
+    overlays = [ ];
     inherit system;
   },
   nixVersions ? import ../../tests/nix-for-tests.nix { inherit pkgs; },
@@ -12,34 +12,38 @@
   seed ? null,
 }:
 
-pkgs.runCommand "lib-path-tests" {
-  nativeBuildInputs = [
-    nixVersions.stable
-  ] ++ (with pkgs; [
-    jq
-    bc
-  ]);
-} ''
-  # Needed to make Nix evaluation work
-  export TEST_ROOT=$(pwd)/test-tmp
-  export NIX_BUILD_HOOK=
-  export NIX_CONF_DIR=$TEST_ROOT/etc
-  export NIX_LOCALSTATE_DIR=$TEST_ROOT/var
-  export NIX_LOG_DIR=$TEST_ROOT/var/log/nix
-  export NIX_STATE_DIR=$TEST_ROOT/var/nix
-  export NIX_STORE_DIR=$TEST_ROOT/store
-  export PAGER=cat
+pkgs.runCommand "lib-path-tests"
+  {
+    nativeBuildInputs =
+      [
+        nixVersions.stable
+      ]
+      ++ (with pkgs; [
+        jq
+        bc
+      ]);
+  }
+  ''
+    # Needed to make Nix evaluation work
+    export TEST_ROOT=$(pwd)/test-tmp
+    export NIX_BUILD_HOOK=
+    export NIX_CONF_DIR=$TEST_ROOT/etc
+    export NIX_LOCALSTATE_DIR=$TEST_ROOT/var
+    export NIX_LOG_DIR=$TEST_ROOT/var/log/nix
+    export NIX_STATE_DIR=$TEST_ROOT/var/nix
+    export NIX_STORE_DIR=$TEST_ROOT/store
+    export PAGER=cat
 
-  cp -r ${libpath} lib
-  export TEST_LIB=$PWD/lib
+    cp -r ${libpath} lib
+    export TEST_LIB=$PWD/lib
 
-  echo "Running unit tests lib/path/tests/unit.nix"
-  nix-instantiate --eval --show-trace \
-    --argstr libpath "$TEST_LIB" \
-    lib/path/tests/unit.nix
+    echo "Running unit tests lib/path/tests/unit.nix"
+    nix-instantiate --eval --show-trace \
+      --argstr libpath "$TEST_LIB" \
+      lib/path/tests/unit.nix
 
-  echo "Running property tests lib/path/tests/prop.sh"
-  bash lib/path/tests/prop.sh ${toString seed}
+    echo "Running property tests lib/path/tests/prop.sh"
+    bash lib/path/tests/prop.sh ${toString seed}
 
-  touch $out
-''
+    touch $out
+  ''

lib/path/tests/prop.nix

@@ -16,14 +16,15 @@ let
   lib = import libpath;
 
   # read each file into a string
-  strings = map (name:
-    builtins.readFile (dir + "/${name}")
-  ) (builtins.attrNames (builtins.readDir dir));
+  strings = map (name: builtins.readFile (dir + "/${name}")) (
+    builtins.attrNames (builtins.readDir dir)
+  );
 
   inherit (lib.path.subpath) normalise isValid;
   inherit (lib.asserts) assertMsg;
 
-  normaliseAndCheck = str:
+  normaliseAndCheck =
+    str:
     let
       originalValid = isValid str;
 
@@ -33,28 +34,27 @@ let
       absConcatOrig = /. + ("/" + str);
       absConcatNormalised = /. + ("/" + tryOnce.value);
     in
-      # Check the lib.path.subpath.normalise property to only error on invalid subpaths
-      assert assertMsg
-        (originalValid -> tryOnce.success)
-        "Even though string \"${str}\" is valid as a subpath, the normalisation for it failed";
-      assert assertMsg
-        (! originalValid -> ! tryOnce.success)
-        "Even though string \"${str}\" is invalid as a subpath, the normalisation for it succeeded";
+    # Check the lib.path.subpath.normalise property to only error on invalid subpaths
+    assert assertMsg (
+      originalValid -> tryOnce.success
+    ) "Even though string \"${str}\" is valid as a subpath, the normalisation for it failed";
+    assert assertMsg (
+      !originalValid -> !tryOnce.success
+    ) "Even though string \"${str}\" is invalid as a subpath, the normalisation for it succeeded";
 
-      # Check normalisation idempotency
-      assert assertMsg
-        (originalValid -> tryTwice.success)
-        "For valid subpath \"${str}\", the normalisation \"${tryOnce.value}\" was not a valid subpath";
-      assert assertMsg
-        (originalValid -> tryOnce.value == tryTwice.value)
-        "For valid subpath \"${str}\", normalising it once gives \"${tryOnce.value}\" but normalising it twice gives a different result: \"${tryTwice.value}\"";
+    # Check normalisation idempotency
+    assert assertMsg (
+      originalValid -> tryTwice.success
+    ) "For valid subpath \"${str}\", the normalisation \"${tryOnce.value}\" was not a valid subpath";
+    assert assertMsg (originalValid -> tryOnce.value == tryTwice.value)
+      "For valid subpath \"${str}\", normalising it once gives \"${tryOnce.value}\" but normalising it twice gives a different result: \"${tryTwice.value}\"";
 
-      # Check that normalisation doesn't change a string when appended to an absolute Nix path value
-      assert assertMsg
-        (originalValid -> absConcatOrig == absConcatNormalised)
-        "For valid subpath \"${str}\", appending to an absolute Nix path value gives \"${absConcatOrig}\", but appending the normalised result \"${tryOnce.value}\" gives a different value \"${absConcatNormalised}\"";
+    # Check that normalisation doesn't change a string when appended to an absolute Nix path value
+    assert assertMsg (originalValid -> absConcatOrig == absConcatNormalised)
+      "For valid subpath \"${str}\", appending to an absolute Nix path value gives \"${absConcatOrig}\", but appending the normalised result \"${tryOnce.value}\" gives a different value \"${absConcatNormalised}\"";
 
-      # Return an empty string when failed
-      if tryOnce.success then tryOnce.value else "";
+    # Return an empty string when failed
+    if tryOnce.success then tryOnce.value else "";
 
-in lib.genAttrs strings normaliseAndCheck
+in
+lib.genAttrs strings normaliseAndCheck

lib/path/tests/unit.nix

@@ -3,7 +3,14 @@
 { libpath }:
 let
   lib = import libpath;
-  inherit (lib.path) hasPrefix removePrefix append splitRoot hasStorePathPrefix subpath;
+  inherit (lib.path)
+    hasPrefix
+    removePrefix
+    append
+    splitRoot
+    hasStorePathPrefix
+    subpath
+    ;
 
   # This is not allowed generally, but we're in the tests here, so we'll allow ourselves.
   storeDirPath = /. + builtins.storeDir;
@@ -79,15 +86,24 @@ let
 
     testSplitRootExample1 = {
       expr = splitRoot /foo/bar;
-      expected = { root = /.; subpath = "./foo/bar"; };
+      expected = {
+        root = /.;
+        subpath = "./foo/bar";
+      };
     };
     testSplitRootExample2 = {
       expr = splitRoot /.;
-      expected = { root = /.; subpath = "./."; };
+      expected = {
+        root = /.;
+        subpath = "./.";
+      };
     };
     testSplitRootExample3 = {
       expr = splitRoot /foo/../bar;
-      expected = { root = /.; subpath = "./bar"; };
+      expected = {
+        root = /.;
+        subpath = "./bar";
+      };
     };
     testSplitRootExample4 = {
       expr = (builtins.tryEval (splitRoot "/foo/bar")).success;
@@ -111,7 +127,9 @@ let
       expected = false;
     };
     testHasStorePathPrefixExample5 = {
-      expr = hasStorePathPrefix (storeDirPath + "/.links/10gg8k3rmbw8p7gszarbk7qyd9jwxhcfq9i6s5i0qikx8alkk4hq");
+      expr = hasStorePathPrefix (
+        storeDirPath + "/.links/10gg8k3rmbw8p7gszarbk7qyd9jwxhcfq9i6s5i0qikx8alkk4hq"
+      );
       expected = false;
     };
     testHasStorePathPrefixExample6 = {
@@ -188,11 +206,18 @@ let
 
     # Test examples from the lib.path.subpath.join documentation
     testSubpathJoinExample1 = {
-      expr = subpath.join [ "foo" "bar/baz" ];
+      expr = subpath.join [
+        "foo"
+        "bar/baz"
+      ];
       expected = "./foo/bar/baz";
     };
     testSubpathJoinExample2 = {
-      expr = subpath.join [ "./foo" "." "bar//./baz/" ];
+      expr = subpath.join [
+        "./foo"
+        "."
+        "bar//./baz/"
+      ];
       expected = "./foo/bar/baz";
     };
     testSubpathJoinExample3 = {
@@ -273,7 +298,11 @@ let
     };
     testSubpathComponentsExample2 = {
       expr = subpath.components "./foo//bar/./baz/";
-      expected = [ "foo" "bar" "baz" ];
+      expected = [
+        "foo"
+        "bar"
+        "baz"
+      ];
     };
     testSubpathComponentsExample3 = {
       expr = (builtins.tryEval (subpath.components "/foo")).success;
@@ -281,5 +310,7 @@ let
     };
   };
 in
-  if cases == [] then "Unit tests successful"
-  else throw "Path unit tests failed: ${lib.generators.toPretty {} cases}"
+if cases == [ ] then
+  "Unit tests successful"
+else
+  throw "Path unit tests failed: ${lib.generators.toPretty { } cases}"

lib/source-types.nix

@@ -5,15 +5,16 @@ let
     shortName = tname;
     isSource = false;
   };
-in lib.mapAttrs (tname: tset: defaultSourceType tname // tset) {
+in
+lib.mapAttrs (tname: tset: defaultSourceType tname // tset) {
 
   fromSource = {
     isSource = true;
   };
 
-  binaryNativeCode = {};
+  binaryNativeCode = { };
 
-  binaryBytecode = {};
+  binaryBytecode = { };
 
-  binaryFirmware = {};
+  binaryFirmware = { };
 }

lib/sources.nix

@@ -1,4 +1,4 @@
-/* Functions for copying sources to the Nix store. */
+# Functions for copying sources to the Nix store.
 { lib }:
 
 # Tested in lib/tests/sources.sh
@@ -23,22 +23,34 @@ let
     directories of version control system, backup files (*~)
     and some generated files.
   */
-  cleanSourceFilter = name: type: let baseName = baseNameOf (toString name); in ! (
-    # Filter out version control software files/directories
-    (baseName == ".git" || type == "directory" && (baseName == ".svn" || baseName == "CVS" || baseName == ".hg")) ||
-    # Filter out editor backup / swap files.
-    lib.hasSuffix "~" baseName ||
-    match "^\\.sw[a-z]$" baseName != null ||
-    match "^\\..*\\.sw[a-z]$" baseName != null ||
+  cleanSourceFilter =
+    name: type:
+    let
+      baseName = baseNameOf (toString name);
+    in
+    !(
+      # Filter out version control software files/directories
+      (
+        baseName == ".git"
+        || type == "directory" && (baseName == ".svn" || baseName == "CVS" || baseName == ".hg")
+      )
+      ||
+        # Filter out editor backup / swap files.
+        lib.hasSuffix "~" baseName
+      || match "^\\.sw[a-z]$" baseName != null
+      || match "^\\..*\\.sw[a-z]$" baseName != null
+      ||
 
-    # Filter out generates files.
-    lib.hasSuffix ".o" baseName ||
-    lib.hasSuffix ".so" baseName ||
-    # Filter out nix-build result symlinks
-    (type == "symlink" && lib.hasPrefix "result" baseName) ||
-    # Filter out sockets and other types of files we can't have in the store.
-    (type == "unknown")
-  );
+        # Filter out generates files.
+        lib.hasSuffix ".o" baseName
+      || lib.hasSuffix ".so" baseName
+      ||
+        # Filter out nix-build result symlinks
+        (type == "symlink" && lib.hasPrefix "result" baseName)
+      ||
+        # Filter out sockets and other types of files we can't have in the store.
+        (type == "unknown")
+    );
 
   /*
     Filters a source tree removing version control files and directories using cleanSourceFilter.
@@ -46,7 +58,12 @@ let
     Example:
              cleanSource ./.
   */
-  cleanSource = src: cleanSourceWith { filter = cleanSourceFilter; inherit src; };
+  cleanSource =
+    src:
+    cleanSourceWith {
+      filter = cleanSourceFilter;
+      inherit src;
+    };
 
   /*
     Like `builtins.filterSource`, except it will compose with itself,
@@ -65,7 +82,6 @@ let
 
         builtins.filterSource f (builtins.filterSource g ./.)
         # Fails!
-
   */
   cleanSourceWith =
     {
@@ -80,11 +96,12 @@ let
       filter ? _path: _type: true,
       # Optional name to use as part of the store path.
       # This defaults to `src.name` or otherwise `"source"`.
-      name ? null
+      name ? null,
     }:
     let
       orig = toSourceAttributes src;
-    in fromSourceAttributes {
+    in
+    fromSourceAttributes {
       inherit (orig) origSrc;
       filter = path: type: filter path type && orig.filter path type;
       name = if name != null then name else orig.name;
@@ -101,31 +118,40 @@ let
     let
       attrs = toSourceAttributes src;
     in
-      fromSourceAttributes (
-        attrs // {
-          filter = path: type:
-            let
-              r = attrs.filter path type;
-            in
-              builtins.trace "${attrs.name}.filter ${path} = ${boolToString r}" r;
-        }
-      ) // {
-        satisfiesSubpathInvariant = src ? satisfiesSubpathInvariant && src.satisfiesSubpathInvariant;
-      };
+    fromSourceAttributes (
+      attrs
+      // {
+        filter =
+          path: type:
+          let
+            r = attrs.filter path type;
+          in
+          builtins.trace "${attrs.name}.filter ${path} = ${boolToString r}" r;
+      }
+    )
+    // {
+      satisfiesSubpathInvariant = src ? satisfiesSubpathInvariant && src.satisfiesSubpathInvariant;
+    };
 
   /*
     Filter sources by a list of regular expressions.
 
     Example: src = sourceByRegex ./my-subproject [".*\.py$" "^database.sql$"]
   */
-  sourceByRegex = src: regexes:
+  sourceByRegex =
+    src: regexes:
     let
       isFiltered = src ? _isLibCleanSourceWith;
       origSrc = if isFiltered then src.origSrc else src;
-    in lib.cleanSourceWith {
-      filter = (path: type:
-        let relPath = lib.removePrefix (toString origSrc + "/") (toString path);
-        in lib.any (re: match re relPath != null) regexes);
+    in
+    lib.cleanSourceWith {
+      filter = (
+        path: type:
+        let
+          relPath = lib.removePrefix (toString origSrc + "/") (toString path);
+        in
+        lib.any (re: match re relPath != null) regexes
+      );
       inherit src;
     };
 
@@ -145,21 +171,29 @@ let
     src:
     # A list of file suffix strings
     exts:
-    let filter = name: type:
-      let base = baseNameOf (toString name);
-      in type == "directory" || lib.any (ext: lib.hasSuffix ext base) exts;
-    in cleanSourceWith { inherit filter src; };
+    let
+      filter =
+        name: type:
+        let
+          base = baseNameOf (toString name);
+        in
+        type == "directory" || lib.any (ext: lib.hasSuffix ext base) exts;
+    in
+    cleanSourceWith { inherit filter src; };
 
-  pathIsGitRepo = path: (_commitIdFromGitRepoOrError path)?value;
+  pathIsGitRepo = path: (_commitIdFromGitRepoOrError path) ? value;
 
   /*
     Get the commit id of a git repo.
 
     Example: commitIdFromGitRepo <nixpkgs/.git>
   */
-  commitIdFromGitRepo = path:
-    let commitIdOrError = _commitIdFromGitRepoOrError path;
-    in commitIdOrError.value or (throw commitIdOrError.error);
+  commitIdFromGitRepo =
+    path:
+    let
+      commitIdOrError = _commitIdFromGitRepoOrError path;
+    in
+    commitIdOrError.value or (throw commitIdOrError.error);
 
   # Get the commit id of a git repo.
 
@@ -168,55 +202,68 @@ let
   # Example: commitIdFromGitRepo <nixpkgs/.git>
   # not exported, used for commitIdFromGitRepo
   _commitIdFromGitRepoOrError =
-    let readCommitFromFile = file: path:
-        let fileName       = path + "/${file}";
-            packedRefsName = path + "/packed-refs";
-            absolutePath   = base: path:
-              if lib.hasPrefix "/" path
-              then path
-              else toString (/. + "${base}/${path}");
-        in if pathIsRegularFile path
-           # Resolve git worktrees. See gitrepository-layout(5)
-           then
-             let m   = match "^gitdir: (.*)$" (lib.fileContents path);
-             in if m == null
-                then { error = "File contains no gitdir reference: " + path; }
-                else
-                  let gitDir      = absolutePath (dirOf path) (lib.head m);
-                      commonDir'' = if pathIsRegularFile "${gitDir}/commondir"
-                                    then lib.fileContents "${gitDir}/commondir"
-                                    else gitDir;
-                      commonDir'  = lib.removeSuffix "/" commonDir'';
-                      commonDir   = absolutePath gitDir commonDir';
-                      refFile     = lib.removePrefix "${commonDir}/" "${gitDir}/${file}";
-                  in readCommitFromFile refFile commonDir
+    let
+      readCommitFromFile =
+        file: path:
+        let
+          fileName = path + "/${file}";
+          packedRefsName = path + "/packed-refs";
+          absolutePath =
+            base: path: if lib.hasPrefix "/" path then path else toString (/. + "${base}/${path}");
+        in
+        if
+          pathIsRegularFile path
+        # Resolve git worktrees. See gitrepository-layout(5)
+        then
+          let
+            m = match "^gitdir: (.*)$" (lib.fileContents path);
+          in
+          if m == null then
+            { error = "File contains no gitdir reference: " + path; }
+          else
+            let
+              gitDir = absolutePath (dirOf path) (lib.head m);
+              commonDir'' =
+                if pathIsRegularFile "${gitDir}/commondir" then lib.fileContents "${gitDir}/commondir" else gitDir;
+              commonDir' = lib.removeSuffix "/" commonDir'';
+              commonDir = absolutePath gitDir commonDir';
+              refFile = lib.removePrefix "${commonDir}/" "${gitDir}/${file}";
+            in
+            readCommitFromFile refFile commonDir
 
-           else if pathIsRegularFile fileName
-           # Sometimes git stores the commitId directly in the file but
-           # sometimes it stores something like: «ref: refs/heads/branch-name»
-           then
-             let fileContent = lib.fileContents fileName;
-                 matchRef    = match "^ref: (.*)$" fileContent;
-             in if  matchRef == null
-                then { value = fileContent; }
-                else readCommitFromFile (lib.head matchRef) path
+        else if
+          pathIsRegularFile fileName
+        # Sometimes git stores the commitId directly in the file but
+        # sometimes it stores something like: «ref: refs/heads/branch-name»
+        then
+          let
+            fileContent = lib.fileContents fileName;
+            matchRef = match "^ref: (.*)$" fileContent;
+          in
+          if matchRef == null then { value = fileContent; } else readCommitFromFile (lib.head matchRef) path
 
-           else if pathIsRegularFile packedRefsName
-           # Sometimes, the file isn't there at all and has been packed away in the
-           # packed-refs file, so we have to grep through it:
-           then
-             let fileContent = readFile packedRefsName;
-                 matchRef = match "([a-z0-9]+) ${file}";
-                 isRef = s: isString s && (matchRef s) != null;
-                 # there is a bug in libstdc++ leading to stackoverflow for long strings:
-                 # https://github.com/NixOS/nix/issues/2147#issuecomment-659868795
-                 refs = filter isRef (split "\n" fileContent);
-             in if refs == []
-                then { error = "Could not find " + file + " in " + packedRefsName; }
-                else { value = lib.head (matchRef (lib.head refs)); }
+        else if
+          pathIsRegularFile packedRefsName
+        # Sometimes, the file isn't there at all and has been packed away in the
+        # packed-refs file, so we have to grep through it:
+        then
+          let
+            fileContent = readFile packedRefsName;
+            matchRef = match "([a-z0-9]+) ${file}";
+            isRef = s: isString s && (matchRef s) != null;
+            # there is a bug in libstdc++ leading to stackoverflow for long strings:
+            # https://github.com/NixOS/nix/issues/2147#issuecomment-659868795
+            refs = filter isRef (split "\n" fileContent);
+          in
+          if refs == [ ] then
+            { error = "Could not find " + file + " in " + packedRefsName; }
+          else
+            { value = lib.head (matchRef (lib.head refs)); }
 
-           else { error = "Not a .git directory: " + toString path; };
-    in readCommitFromFile "HEAD";
+        else
+          { error = "Not a .git directory: " + toString path; };
+    in
+    readCommitFromFile "HEAD";
 
   pathHasContext = builtins.hasContext or (lib.hasPrefix storeDir);
 
@@ -233,7 +280,8 @@ let
   # like class of objects in the wild.
   # (Existing ones being: paths, strings, sources and x//{outPath})
   # So instead of exposing internals, we build a library of combinator functions.
-  toSourceAttributes = src:
+  toSourceAttributes =
+    src:
     let
       isFiltered = src ? _isLibCleanSourceWith;
     in
@@ -247,26 +295,38 @@ let
   # fromSourceAttributes : SourceAttrs -> Source
   #
   # Inverse of toSourceAttributes for Source objects.
-  fromSourceAttributes = { origSrc, filter, name }:
+  fromSourceAttributes =
+    {
+      origSrc,
+      filter,
+      name,
+    }:
     {
       _isLibCleanSourceWith = true;
       inherit origSrc filter name;
-      outPath = builtins.path { inherit filter name; path = origSrc; };
+      outPath = builtins.path {
+        inherit filter name;
+        path = origSrc;
+      };
     };
 
-in {
+in
+{
 
-  pathType = lib.warnIf (lib.isInOldestRelease 2305)
-    "lib.sources.pathType has been moved to lib.filesystem.pathType."
-    lib.filesystem.pathType;
+  pathType =
+    lib.warnIf (lib.isInOldestRelease 2305)
+      "lib.sources.pathType has been moved to lib.filesystem.pathType."
+      lib.filesystem.pathType;
 
-  pathIsDirectory = lib.warnIf (lib.isInOldestRelease 2305)
-    "lib.sources.pathIsDirectory has been moved to lib.filesystem.pathIsDirectory."
-    lib.filesystem.pathIsDirectory;
+  pathIsDirectory =
+    lib.warnIf (lib.isInOldestRelease 2305)
+      "lib.sources.pathIsDirectory has been moved to lib.filesystem.pathIsDirectory."
+      lib.filesystem.pathIsDirectory;
 
-  pathIsRegularFile = lib.warnIf (lib.isInOldestRelease 2305)
-    "lib.sources.pathIsRegularFile has been moved to lib.filesystem.pathIsRegularFile."
-    lib.filesystem.pathIsRegularFile;
+  pathIsRegularFile =
+    lib.warnIf (lib.isInOldestRelease 2305)
+      "lib.sources.pathIsRegularFile has been moved to lib.filesystem.pathIsRegularFile."
+      lib.filesystem.pathIsRegularFile;
 
   inherit
     pathIsGitRepo

lib/strings.nix

@@ -157,6 +157,68 @@ rec {
   */
   replicate = n: s: concatStrings (lib.lists.replicate n s);
 
+  /*
+    Remove leading and trailing whitespace from a string.
+
+    Whitespace is defined as any of the following characters:
+      " ", "\t" "\r" "\n"
+
+    Type: trim :: string -> string
+
+    Example:
+      trim "   hello, world!   "
+      => "hello, world!"
+  */
+  trim = trimWith {
+    start = true;
+    end = true;
+  };
+
+  /*
+    Remove leading and/or trailing whitespace from a string.
+
+    Whitespace is defined as any of the following characters:
+      " ", "\t" "\r" "\n"
+
+    Type: trimWith :: Attrs -> string -> string
+
+    Example:
+      trimWith { start = true; } "   hello, world!   "}
+      => "hello, world!   "
+      trimWith { end = true; } "   hello, world!   "}
+      => "   hello, world!"
+  */
+  trimWith =
+    {
+      # Trim leading whitespace
+      start ? false,
+      # Trim trailing whitespace
+      end ? false,
+    }:
+    s:
+    let
+      # Define our own whitespace character class instead of using
+      # `[:space:]`, which is not well-defined.
+      chars = " \t\r\n";
+
+      # To match up until trailing whitespace, we need to capture a
+      # group that ends with a non-whitespace character.
+      regex =
+        if start && end then
+          "[${chars}]*(.*[^${chars}])[${chars}]*"
+        else if start then
+          "[${chars}]*(.*)"
+        else if end then
+          "(.*[^${chars}])[${chars}]*"
+        else
+          "(.*)";
+
+      # If the string was empty or entirely whitespace,
+      # then the regex may not match and `res` will be `null`.
+      res = match regex s;
+    in
+      optionalString (res != null) (head res);
+
   /* Construct a Unix-style, colon-separated search path consisting of
      the given `subDir` appended to each of the given paths.
 

lib/systems/default.nix

@@ -81,7 +81,7 @@ let
         && final.parsed.kernel == platform.parsed.kernel;
       isCompatible = _: throw "2022-05-23: isCompatible has been removed in favor of canExecute, refer to the 22.11 changelog for details";
       # Derived meta-data
-      useLLVM = final.isFreeBSD;
+      useLLVM = final.isFreeBSD || final.isOpenBSD;
 
       libc =
         /**/ if final.isDarwin              then "libSystem"
@@ -93,6 +93,7 @@ let
         else if final.isAndroid             then "bionic"
         else if final.isLinux /* default */ then "glibc"
         else if final.isFreeBSD             then "fblibc"
+        else if final.isOpenBSD             then "oblibc"
         else if final.isNetBSD              then "nblibc"
         else if final.isAvr                 then "avrlibc"
         else if final.isGhcjs               then null
@@ -254,6 +255,22 @@ let
         if final.isMacOS then "MACOSX_DEPLOYMENT_TARGET"
         else if final.isiOS then "IPHONEOS_DEPLOYMENT_TARGET"
         else null;
+
+      # Remove before 25.05
+      androidSdkVersion =
+        if (args ? sdkVer && !args ? androidSdkVersion) then
+          throw "For android `sdkVer` has been renamed to `androidSdkVersion`"
+        else if (args ? androidSdkVersion) then
+          args.androidSdkVersion
+        else
+          null;
+      androidNdkVersion =
+        if (args ? ndkVer && !args ? androidNdkVersion) then
+          throw "For android `ndkVer` has been renamed to `androidNdkVersion`"
+        else if (args ? androidSdkVersion) then
+          args.androidNdkVersion
+        else
+          null;
     } // (
       let
         selectEmulator = pkgs:

lib/systems/examples.nix

@@ -60,23 +60,23 @@ rec {
   armv7a-android-prebuilt = {
     config = "armv7a-unknown-linux-androideabi";
     rustc.config = "armv7-linux-androideabi";
-    sdkVer = "28";
-    ndkVer = "24";
+    androidSdkVersion = "28";
+    androidNdkVersion = "24";
     useAndroidPrebuilt = true;
   } // platforms.armv7a-android;
 
   aarch64-android-prebuilt = {
     config = "aarch64-unknown-linux-android";
     rustc.config = "aarch64-linux-android";
-    sdkVer = "28";
-    ndkVer = "24";
+    androidSdkVersion = "28";
+    androidNdkVersion = "24";
     useAndroidPrebuilt = true;
   };
 
   aarch64-android = {
     config = "aarch64-unknown-linux-android";
-    sdkVer = "30";
-    ndkVer = "24";
+    androidSdkVersion = "30";
+    androidNdkVersion = "24";
     libc = "bionic";
     useAndroidPrebuilt = false;
     useLLVM = true;
@@ -256,7 +256,7 @@ rec {
   iphone64 = {
     config = "aarch64-apple-ios";
     # config = "aarch64-apple-darwin14";
-    sdkVer = "14.3";
+    darwinSdkVersion = "14.3";
     xcodeVer = "12.3";
     xcodePlatform = "iPhoneOS";
     useiOSPrebuilt = true;
@@ -265,7 +265,7 @@ rec {
   iphone32 = {
     config = "armv7a-apple-ios";
     # config = "arm-apple-darwin10";
-    sdkVer = "14.3";
+    darwinSdkVersion = "14.3";
     xcodeVer = "12.3";
     xcodePlatform = "iPhoneOS";
     useiOSPrebuilt = true;
@@ -274,7 +274,7 @@ rec {
   iphone64-simulator = {
     config = "x86_64-apple-ios";
     # config = "x86_64-apple-darwin14";
-    sdkVer = "14.3";
+    darwinSdkVersion = "14.3";
     xcodeVer = "12.3";
     xcodePlatform = "iPhoneSimulator";
     darwinPlatform = "ios-simulator";
@@ -284,7 +284,7 @@ rec {
   iphone32-simulator = {
     config = "i686-apple-ios";
     # config = "i386-apple-darwin11";
-    sdkVer = "14.3";
+    darwinSdkVersion = "14.3";
     xcodeVer = "12.3";
     xcodePlatform = "iPhoneSimulator";
     darwinPlatform = "ios-simulator";
@@ -342,6 +342,11 @@ rec {
     useLLVM = true;
   };
 
+  x86_64-openbsd = {
+    config = "x86_64-unknown-openbsd";
+    useLLVM = true;
+  };
+
   #
   # WASM
   #

lib/systems/flake-systems.nix

@@ -16,12 +16,12 @@
   "armv6l-linux"
   "armv7l-linux"
   "i686-linux"
-  "mipsel-linux"
+  # "mipsel-linux" is excluded because it is not bootstrapped
 
   # Other platforms with sufficient support in stdenv which is not formally
   # mandated by their platform tier.
   "aarch64-darwin"
-  "armv5tel-linux"
+  # "armv5tel-linux" is excluded because it is not bootstrapped
   "powerpc64le-linux"
   "riscv64-linux"
 

lib/systems/parse.nix

@@ -469,6 +469,7 @@ rec {
               elem (elemAt l 2) [ "wasi" "redox" "mmixware" "ghcjs" "mingw32" ] ||
               hasPrefix "freebsd" (elemAt l 2) ||
               hasPrefix "netbsd" (elemAt l 2) ||
+              hasPrefix "openbsd" (elemAt l 2) ||
               hasPrefix "genode" (elemAt l 2)
       then {
         cpu    = elemAt l 0;

lib/systems/platforms.nix

@@ -490,12 +490,42 @@ rec {
   };
 
   # can execute on 32bit chip
-  gcc_mips32r2_o32 = { gcc = { arch = "mips32r2"; abi =  "32"; }; };
-  gcc_mips32r6_o32 = { gcc = { arch = "mips32r6"; abi =  "32"; }; };
-  gcc_mips64r2_n32 = { gcc = { arch = "mips64r2"; abi = "n32"; }; };
-  gcc_mips64r6_n32 = { gcc = { arch = "mips64r6"; abi = "n32"; }; };
-  gcc_mips64r2_64  = { gcc = { arch = "mips64r2"; abi =  "64"; }; };
-  gcc_mips64r6_64  = { gcc = { arch = "mips64r6"; abi =  "64"; }; };
+  gcc_mips32r2_o32 = {
+    gcc = {
+      arch = "mips32r2";
+      abi = "32";
+    };
+  };
+  gcc_mips32r6_o32 = {
+    gcc = {
+      arch = "mips32r6";
+      abi = "32";
+    };
+  };
+  gcc_mips64r2_n32 = {
+    gcc = {
+      arch = "mips64r2";
+      abi = "n32";
+    };
+  };
+  gcc_mips64r6_n32 = {
+    gcc = {
+      arch = "mips64r6";
+      abi = "n32";
+    };
+  };
+  gcc_mips64r2_64 = {
+    gcc = {
+      arch = "mips64r2";
+      abi = "64";
+    };
+  };
+  gcc_mips64r6_64 = {
+    gcc = {
+      arch = "mips64r6";
+      abi = "64";
+    };
+  };
 
   # based on:
   #   https://www.mail-archive.com/qemu-discuss@nongnu.org/msg05179.html
@@ -546,27 +576,38 @@ rec {
   # This function takes a minimally-valid "platform" and returns an
   # attrset containing zero or more additional attrs which should be
   # included in the platform in order to further elaborate it.
-  select = platform:
+  select =
+    platform:
     # x86
-    /**/ if platform.isx86 then pc
+    if platform.isx86 then
+      pc
 
     # ARM
-    else if platform.isAarch32 then let
-      version = platform.parsed.cpu.version or null;
-      in     if version == null then pc
-        else if lib.versionOlder version "6" then sheevaplug
-        else if lib.versionOlder version "7" then raspberrypi
-        else armv7l-hf-multiplatform
+    else if platform.isAarch32 then
+      let
+        version = platform.parsed.cpu.version or null;
+      in
+      if version == null then
+        pc
+      else if lib.versionOlder version "6" then
+        sheevaplug
+      else if lib.versionOlder version "7" then
+        raspberrypi
+      else
+        armv7l-hf-multiplatform
 
     else if platform.isAarch64 then
-      if platform.isDarwin then apple-m1
-      else aarch64-multiplatform
+      if platform.isDarwin then apple-m1 else aarch64-multiplatform
 
-    else if platform.isRiscV then riscv-multiplatform
+    else if platform.isRiscV then
+      riscv-multiplatform
 
-    else if platform.parsed.cpu == lib.systems.parse.cpuTypes.mipsel then (import ./examples.nix { inherit lib; }).mipsel-linux-gnu
+    else if platform.parsed.cpu == lib.systems.parse.cpuTypes.mipsel then
+      (import ./examples.nix { inherit lib; }).mipsel-linux-gnu
 
-    else if platform.parsed.cpu == lib.systems.parse.cpuTypes.powerpc64le then powernv
+    else if platform.parsed.cpu == lib.systems.parse.cpuTypes.powerpc64le then
+      powernv
 
-    else { };
+    else
+      { };
 }

lib/tests/check-eval.nix

@@ -1,7 +1,10 @@
 # Throws an error if any of our lib tests fail.
 
-let tests = [ "misc" "systems" ];
-    all = builtins.concatLists (map (f: import (./. + "/${f}.nix")) tests);
-in if all == []
-     then null
-   else throw (builtins.toJSON all)
+let
+  tests = [
+    "misc"
+    "systems"
+  ];
+  all = builtins.concatLists (map (f: import (./. + "/${f}.nix")) tests);
+in
+if all == [ ] then null else throw (builtins.toJSON all)

lib/tests/maintainer-module.nix

@@ -1,7 +1,8 @@
 { lib, ... }:
 let
   inherit (lib) types;
-in {
+in
+{
   options = {
     name = lib.mkOption {
       type = types.str;
@@ -23,10 +24,12 @@ in {
       default = null;
     };
     keys = lib.mkOption {
-      type = types.listOf (types.submodule {
-        options.fingerprint = lib.mkOption { type = types.str; };
-      });
-      default = [];
+      type = types.listOf (
+        types.submodule {
+          options.fingerprint = lib.mkOption { type = types.str; };
+        }
+      );
+      default = [ ];
     };
   };
 }

lib/tests/maintainers.nix

@@ -1,53 +1,76 @@
 # to run these tests (and the others)
 # nix-build nixpkgs/lib/tests/release.nix
 # These tests should stay in sync with the comment in maintainers/maintainers-list.nix
-{ # The pkgs used for dependencies for the testing itself
-  pkgs ? import ../.. {}
-, lib ? pkgs.lib
+{
+  # The pkgs used for dependencies for the testing itself
+  pkgs ? import ../.. { },
+  lib ? pkgs.lib,
 }:
 
 let
-  checkMaintainer = handle: uncheckedAttrs:
-  let
-      prefix = [ "lib" "maintainers" handle ];
-      checkedAttrs = (lib.modules.evalModules {
-        inherit prefix;
-        modules = [
-          ./maintainer-module.nix
-          {
-            _file = toString ../../maintainers/maintainer-list.nix;
-            config = uncheckedAttrs;
-          }
-        ];
-      }).config;
+  checkMaintainer =
+    handle: uncheckedAttrs:
+    let
+      prefix = [
+        "lib"
+        "maintainers"
+        handle
+      ];
+      checkedAttrs =
+        (lib.modules.evalModules {
+          inherit prefix;
+          modules = [
+            ./maintainer-module.nix
+            {
+              _file = toString ../../maintainers/maintainer-list.nix;
+              config = uncheckedAttrs;
+            }
+          ];
+        }).config;
 
-      checks = lib.optional (checkedAttrs.github != null && checkedAttrs.githubId == null) ''
-        echo ${lib.escapeShellArg (lib.showOption prefix)}': If `github` is specified, `githubId` must be too.'
-        # Calling this too often would hit non-authenticated API limits, but this
-        # shouldn't happen since such errors will get fixed rather quickly
-        info=$(curl -sS https://api.github.com/users/${checkedAttrs.github})
-        id=$(jq -r '.id' <<< "$info")
-        echo "The GitHub ID for GitHub user ${checkedAttrs.github} is $id:"
-        echo -e "    githubId = $id;\n"
-      '' ++ lib.optional (checkedAttrs.email == null && checkedAttrs.github == null && checkedAttrs.matrix == null) ''
-        echo ${lib.escapeShellArg (lib.showOption prefix)}': At least one of `email`, `github` or `matrix` must be specified, so that users know how to reach you.'
-      '' ++ lib.optional (checkedAttrs.email != null && lib.hasSuffix "noreply.github.com" checkedAttrs.email) ''
-        echo ${lib.escapeShellArg (lib.showOption prefix)}': If an email address is given, it should allow people to reach you. If you do not want that, you can just provide `github` or `matrix` instead.'
-      '';
-    in lib.deepSeq checkedAttrs checks;
+      checks =
+        lib.optional (checkedAttrs.github != null && checkedAttrs.githubId == null) ''
+          echo ${lib.escapeShellArg (lib.showOption prefix)}': If `github` is specified, `githubId` must be too.'
+          # Calling this too often would hit non-authenticated API limits, but this
+          # shouldn't happen since such errors will get fixed rather quickly
+          info=$(curl -sS https://api.github.com/users/${checkedAttrs.github})
+          id=$(jq -r '.id' <<< "$info")
+          echo "The GitHub ID for GitHub user ${checkedAttrs.github} is $id:"
+          echo -e "    githubId = $id;\n"
+        ''
+        ++
+          lib.optional
+            (checkedAttrs.email == null && checkedAttrs.github == null && checkedAttrs.matrix == null)
+            ''
+              echo ${lib.escapeShellArg (lib.showOption prefix)}': At least one of `email`, `github` or `matrix` must be specified, so that users know how to reach you.'
+            ''
+        ++
+          lib.optional (checkedAttrs.email != null && lib.hasSuffix "noreply.github.com" checkedAttrs.email)
+            ''
+              echo ${lib.escapeShellArg (lib.showOption prefix)}': If an email address is given, it should allow people to reach you. If you do not want that, you can just provide `github` or `matrix` instead.'
+            '';
+    in
+    lib.deepSeq checkedAttrs checks;
 
   missingGithubIds = lib.concatLists (lib.mapAttrsToList checkMaintainer lib.maintainers);
 
-  success = pkgs.runCommand "checked-maintainers-success" {} ">$out";
+  success = pkgs.runCommand "checked-maintainers-success" { } ">$out";
 
-  failure = pkgs.runCommand "checked-maintainers-failure" {
-    nativeBuildInputs = [ pkgs.curl pkgs.jq ];
-    outputHash = "sha256:${lib.fakeSha256}";
-    outputHAlgo = "sha256";
-    outputHashMode = "flat";
-    SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
-  } ''
-    ${lib.concatStringsSep "\n" missingGithubIds}
-    exit 1
-  '';
-in if missingGithubIds == [] then success else failure
+  failure =
+    pkgs.runCommand "checked-maintainers-failure"
+      {
+        nativeBuildInputs = [
+          pkgs.curl
+          pkgs.jq
+        ];
+        outputHash = "sha256:${lib.fakeSha256}";
+        outputHAlgo = "sha256";
+        outputHashMode = "flat";
+        SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+      }
+      ''
+        ${lib.concatStringsSep "\n" missingGithubIds}
+        exit 1
+      '';
+in
+if missingGithubIds == [ ] then success else failure

lib/tests/misc.nix

@@ -352,6 +352,72 @@ runTests {
     expected = "hellohellohellohellohello";
   };
 
+  # Test various strings are trimmed correctly
+  testTrimString = {
+    expr =
+    let
+      testValues = f: mapAttrs (_: f) {
+        empty = "";
+        cr = "\r";
+        lf = "\n";
+        tab = "\t";
+        spaces = "   ";
+        leading = "  Hello, world";
+        trailing = "Hello, world   ";
+        mixed = " Hello, world ";
+        mixed-tabs = " \t\tHello, world \t \t ";
+        multiline = "  Hello,\n  world!  ";
+        multiline-crlf = "  Hello,\r\n  world!  ";
+      };
+    in
+      {
+        leading = testValues (strings.trimWith { start = true; });
+        trailing = testValues (strings.trimWith { end = true; });
+        both = testValues strings.trim;
+      };
+    expected = {
+      leading = {
+        empty = "";
+        cr = "";
+        lf = "";
+        tab = "";
+        spaces = "";
+        leading = "Hello, world";
+        trailing = "Hello, world   ";
+        mixed = "Hello, world ";
+        mixed-tabs = "Hello, world \t \t ";
+        multiline = "Hello,\n  world!  ";
+        multiline-crlf = "Hello,\r\n  world!  ";
+      };
+      trailing = {
+        empty = "";
+        cr = "";
+        lf = "";
+        tab = "";
+        spaces = "";
+        leading = "  Hello, world";
+        trailing = "Hello, world";
+        mixed = " Hello, world";
+        mixed-tabs = " \t\tHello, world";
+        multiline = "  Hello,\n  world!";
+        multiline-crlf = "  Hello,\r\n  world!";
+      };
+      both = {
+        empty = "";
+        cr = "";
+        lf = "";
+        tab = "";
+        spaces = "";
+        leading = "Hello, world";
+        trailing = "Hello, world";
+        mixed = "Hello, world";
+        mixed-tabs = "Hello, world";
+        multiline = "Hello,\n  world!";
+        multiline-crlf = "Hello,\r\n  world!";
+      };
+    };
+  };
+
   testSplitStringsSimple = {
     expr = strings.splitString "." "a.b.c.d";
     expected = [ "a" "b" "c" "d" ];

lib/tests/modules.sh

@@ -497,21 +497,21 @@ checkConfigOutput '^"pear\\npear"$' config.twice.raw ./merge-module-with-key.nix
 
 # Declaration positions
 # Line should be present for direct options
-checkConfigOutput '^10$' options.imported.line10.declarationPositions.0.line ./declaration-positions.nix
+checkConfigOutput '^14$' options.imported.line10.declarationPositions.0.line ./declaration-positions.nix
 checkConfigOutput '/declaration-positions.nix"$' options.imported.line10.declarationPositions.0.file ./declaration-positions.nix
 # Generated options may not have line numbers but they will at least get the
 # right file
 checkConfigOutput '/declaration-positions.nix"$' options.generated.line18.declarationPositions.0.file ./declaration-positions.nix
 checkConfigOutput '^null$' options.generated.line18.declarationPositions.0.line ./declaration-positions.nix
 # Submodules don't break it
-checkConfigOutput '^39$' config.submoduleLine34.submodDeclLine39.0.line ./declaration-positions.nix
+checkConfigOutput '^45$' config.submoduleLine34.submodDeclLine39.0.line ./declaration-positions.nix
 checkConfigOutput '/declaration-positions.nix"$' config.submoduleLine34.submodDeclLine39.0.file ./declaration-positions.nix
 # New options under freeform submodules get collected into the parent submodule
 # (consistent with .declarations behaviour, but weird; notably appears in system.build)
-checkConfigOutput '^34|23$' options.submoduleLine34.declarationPositions.0.line ./declaration-positions.nix
-checkConfigOutput '^34|23$' options.submoduleLine34.declarationPositions.1.line ./declaration-positions.nix
+checkConfigOutput '^38|27$' options.submoduleLine34.declarationPositions.0.line ./declaration-positions.nix
+checkConfigOutput '^38|27$' options.submoduleLine34.declarationPositions.1.line ./declaration-positions.nix
 # nested options work
-checkConfigOutput '^30$' options.nested.nestedLine30.declarationPositions.0.line ./declaration-positions.nix
+checkConfigOutput '^34$' options.nested.nestedLine30.declarationPositions.0.line ./declaration-positions.nix
 
 cat <<EOF
 ====== module tests ======

lib/tests/modules/adhoc-freeformType-survives-type-merge.nix

@@ -1,5 +1,9 @@
-{ lib, ... }: {
-  options.dummy = lib.mkOption { type = lib.types.anything; default = {}; };
+{ lib, ... }:
+{
+  options.dummy = lib.mkOption {
+    type = lib.types.anything;
+    default = { };
+  };
   freeformType =
     let
       a = lib.types.attrsOf (lib.types.submodule { options.bar = lib.mkOption { }; });
@@ -7,7 +11,8 @@
     # modifying types like this breaks type merging.
     # This test makes sure that type merging is not performed when only a single declaration exists.
     # Don't modify types in practice!
-    a // {
+    a
+    // {
       merge = loc: defs: { freeformItems = a.merge loc defs; };
     };
   config.foo.bar = "ok";

lib/tests/modules/alias-with-priority-can-override.nix

@@ -30,7 +30,7 @@ in
     # mkAliasOptionModule sets warnings, so this has to be defined.
     warnings = mkOption {
       internal = true;
-      default = [];
+      default = [ ];
       type = types.listOf types.str;
       example = [ "The `foo' service is deprecated and will go away soon!" ];
       description = ''
@@ -46,14 +46,16 @@ in
 
     # Disable the aliased option with a high priority so it
     # should override the next import.
-    ( { config, lib, ... }:
+    (
+      { config, lib, ... }:
       {
         enableAlias = mkForce false;
       }
     )
 
     # Enable the normal (non-aliased) option.
-    ( { config, lib, ... }:
+    (
+      { config, lib, ... }:
       {
         enable = true;
       }

lib/tests/modules/alias-with-priority.nix

@@ -30,7 +30,7 @@ in
     # mkAliasOptionModule sets warnings, so this has to be defined.
     warnings = mkOption {
       internal = true;
-      default = [];
+      default = [ ];
       type = types.listOf types.str;
       example = [ "The `foo' service is deprecated and will go away soon!" ];
       description = ''
@@ -46,14 +46,16 @@ in
 
     # Disable the aliased option, but with a default (low) priority so it
     # should be able to be overridden by the next import.
-    ( { config, lib, ... }:
+    (
+      { config, lib, ... }:
       {
         enableAlias = mkDefault false;
       }
     )
 
     # Enable the normal (non-aliased) option.
-    ( { config, lib, ... }:
+    (
+      { config, lib, ... }:
       {
         enable = true;
       }

lib/tests/modules/attrsOf-conditional-check.nix

@@ -1,6 +1,7 @@
-{ lib, config, ... }: {
+{ lib, config, ... }:
+{
   options.conditionalWorks = lib.mkOption {
-    default = ! config.value ? foo;
+    default = !config.value ? foo;
   };
 
   config.value.foo = lib.mkIf false "should not be defined";

lib/tests/modules/attrsOf-lazy-check.nix

@@ -1,6 +1,7 @@
-{ lib, config, ... }: {
+{ lib, config, ... }:
+{
   options.isLazy = lib.mkOption {
-    default = ! config.value ? foo;
+    default = !config.value ? foo;
   };
 
   config.value.bar = throw "is not lazy";

lib/tests/modules/boolByOr.nix

@@ -1,14 +1,26 @@
-{ lib, ... }: {
+{ lib, ... }:
+{
 
   options.value = lib.mkOption {
     type = lib.types.lazyAttrsOf lib.types.boolByOr;
   };
 
   config.value = {
-    falseFalse = lib.mkMerge [ false false ];
-    trueFalse = lib.mkMerge [ true false ];
-    falseTrue = lib.mkMerge [ false true ];
-    trueTrue = lib.mkMerge [ true true ];
+    falseFalse = lib.mkMerge [
+      false
+      false
+    ];
+    trueFalse = lib.mkMerge [
+      true
+      false
+    ];
+    falseTrue = lib.mkMerge [
+      false
+      true
+    ];
+    trueTrue = lib.mkMerge [
+      true
+      true
+    ];
   };
 }
-

lib/tests/modules/class-check.nix

@@ -1,4 +1,5 @@
-{ lib, ... }: {
+{ lib, ... }:
+{
   options = {
     sub = {
       nixosOk = lib.mkOption {
@@ -40,37 +41,39 @@
   ];
   config = {
     _module.freeformType = lib.types.anything;
-    ok =
-      lib.evalModules {
-        class = "nixos";
-        modules = [
-          ./module-class-is-nixos.nix
-        ];
-      };
+    ok = lib.evalModules {
+      class = "nixos";
+      modules = [
+        ./module-class-is-nixos.nix
+      ];
+    };
 
-    fail =
-      lib.evalModules {
-        class = "nixos";
-        modules = [
-          ./module-class-is-nixos.nix
-          ./module-class-is-darwin.nix
-        ];
-      };
+    fail = lib.evalModules {
+      class = "nixos";
+      modules = [
+        ./module-class-is-nixos.nix
+        ./module-class-is-darwin.nix
+      ];
+    };
 
-    fail-anon =
-      lib.evalModules {
-        class = "nixos";
-        modules = [
-          ./module-class-is-nixos.nix
-          { _file = "foo.nix#darwinModules.default";
-            _class = "darwin";
-            config = {};
-            imports = [];
-          }
-        ];
-      };
+    fail-anon = lib.evalModules {
+      class = "nixos";
+      modules = [
+        ./module-class-is-nixos.nix
+        {
+          _file = "foo.nix#darwinModules.default";
+          _class = "darwin";
+          config = { };
+          imports = [ ];
+        }
+      ];
+    };
 
-    sub.nixosOk = { _class = "nixos"; };
-    sub.nixosFail = { imports = [ ./module-class-is-darwin.nix ]; };
+    sub.nixosOk = {
+      _class = "nixos";
+    };
+    sub.nixosFail = {
+      imports = [ ./module-class-is-darwin.nix ];
+    };
   };
 }

lib/tests/modules/declaration-positions.nix

@@ -1,9 +1,13 @@
 { lib, options, ... }:
-let discardPositions = lib.mapAttrs (k: v: v);
+let
+  discardPositions = lib.mapAttrs (k: v: v);
 in
 # unsafeGetAttrPos is unspecified best-effort behavior, so we only want to consider this test on an evaluator that satisfies some basic assumptions about this function.
 assert builtins.unsafeGetAttrPos "a" { a = true; } != null;
-assert builtins.unsafeGetAttrPos "a" (discardPositions { a = true; }) == null;
+assert
+  builtins.unsafeGetAttrPos "a" (discardPositions {
+    a = true;
+  }) == null;
 {
   imports = [
     {
@@ -35,15 +39,19 @@ assert builtins.unsafeGetAttrPos "a" (discardPositions { a = true; }) == null;
     default = { };
     type = lib.types.submoduleWith {
       modules = [
-        ({ options, ... }: {
-          options.submodDeclLine39 = lib.mkOption { };
-        })
+        (
+          { options, ... }:
+          {
+            options.submodDeclLine39 = lib.mkOption { };
+          }
+        )
         { freeformType = with lib.types; lazyAttrsOf (uniq unspecified); }
       ];
     };
   };
 
   config = {
-    submoduleLine34.submodDeclLine39 = (options.submoduleLine34.type.getSubOptions [ ]).submodDeclLine39.declarationPositions;
+    submoduleLine34.submodDeclLine39 =
+      (options.submoduleLine34.type.getSubOptions [ ]).submodDeclLine39.declarationPositions;
   };
 }

lib/tests/modules/declare-attrsOf.nix

@@ -1,13 +1,13 @@
 { lib, ... }:
 let
-  deathtrapArgs = lib.mapAttrs
-    (k: _: throw "The module system is too strict, accessing an unused option's ${k} mkOption-attribute.")
-    (lib.functionArgs lib.mkOption);
+  deathtrapArgs = lib.mapAttrs (
+    k: _: throw "The module system is too strict, accessing an unused option's ${k} mkOption-attribute."
+  ) (lib.functionArgs lib.mkOption);
 in
 {
   options.value = lib.mkOption {
     type = lib.types.attrsOf lib.types.str;
-    default = {};
+    default = { };
   };
   options.testing-laziness-so-don't-read-me = lib.mkOption deathtrapArgs;
 }

lib/tests/modules/declare-attrsOfSub-any-enable.nix

@@ -1,25 +1,27 @@
 { lib, ... }:
 
 let
-  submod = { ... }: {
-    options = {
-      enable = lib.mkOption {
-        default = false;
-        example = true;
-        type = lib.types.bool;
-        description = ''
-          Some descriptive text
-        '';
+  submod =
+    { ... }:
+    {
+      options = {
+        enable = lib.mkOption {
+          default = false;
+          example = true;
+          type = lib.types.bool;
+          description = ''
+            Some descriptive text
+          '';
+        };
       };
     };
-  };
 in
 
 {
   options = {
     attrsOfSub = lib.mkOption {
-      default = {};
-      example = {};
+      default = { };
+      example = { };
       type = lib.types.attrsOf (lib.types.submodule [ submod ]);
       description = ''
         Some descriptive text

lib/tests/modules/declare-bare-submodule.nix

@@ -8,7 +8,7 @@ in
       modules = [ ];
       shorthandOnlyDefinesConfig = config.shorthandOnlyDefinesConfig;
     };
-    default = {};
+    default = { };
   };
 
   # config-dependent options: won't recommend, but useful for making this test parameterized

lib/tests/modules/declare-either.nix

@@ -1,4 +1,5 @@
-{ lib, ... }: {
+{ lib, ... }:
+{
   options.value = lib.mkOption {
     type = lib.types.either lib.types.int lib.types.str;
   };

lib/tests/modules/declare-lazyAttrsOf.nix

@@ -1,6 +1,7 @@
-{ lib, ... }: {
+{ lib, ... }:
+{
   options.value = lib.mkOption {
     type = lib.types.lazyAttrsOf (lib.types.str // { emptyValue.value = "empty"; });
-    default = {};
+    default = { };
   };
 }

lib/tests/modules/declare-mkPackageOption.nix

@@ -1,9 +1,11 @@
-{ lib, ... }: let
+{ lib, ... }:
+let
   pkgs.hello = {
     type = "derivation";
     pname = "hello";
   };
-in {
+in
+{
   options = {
     package = lib.mkPackageOption pkgs "hello" { };
 
@@ -46,8 +48,14 @@ in {
       pkgsText = "myPkgs";
     };
 
-    packageFromOtherSet = let myPkgs = {
-      hello = pkgs.hello // { pname = "hello-other"; };
-    }; in lib.mkPackageOption myPkgs "hello" { };
+    packageFromOtherSet =
+      let
+        myPkgs = {
+          hello = pkgs.hello // {
+            pname = "hello-other";
+          };
+        };
+      in
+      lib.mkPackageOption myPkgs "hello" { };
   };
 }

lib/tests/modules/declare-oneOf.nix

@@ -1,4 +1,5 @@
-{ lib, ... }: {
+{ lib, ... }:
+{
   options.value = lib.mkOption {
     type = lib.types.oneOf [
       lib.types.int

lib/tests/modules/declare-set.nix

@@ -3,7 +3,9 @@
 {
   options.set = lib.mkOption {
     default = { };
-    example = { a = 1; };
+    example = {
+      a = 1;
+    };
     type = lib.types.attrsOf lib.types.int;
     description = ''
       Some descriptive text

lib/tests/modules/declare-submodule-via-evalModules.nix

@@ -1,25 +1,32 @@
-{ lib, ... }: {
+{ lib, ... }:
+{
   options.submodule = lib.mkOption {
-    inherit (lib.evalModules {
-      modules = [
-        {
-          options.inner = lib.mkOption {
-            type = lib.types.bool;
-            default = false;
-          };
-        }
-      ];
-    }) type;
-    default = {};
+    inherit
+      (lib.evalModules {
+        modules = [
+          {
+            options.inner = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+            };
+          }
+        ];
+      })
+      type
+      ;
+    default = { };
   };
 
   config.submodule = lib.mkMerge [
-    ({ lib, ... }: {
-      options.outer = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-      };
-    })
+    (
+      { lib, ... }:
+      {
+        options.outer = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+      }
+    )
     {
       inner = true;
       outer = true;

lib/tests/modules/declare-submoduleWith-modules.nix

@@ -1,4 +1,5 @@
-{ lib, ... }: {
+{ lib, ... }:
+{
   options.submodule = lib.mkOption {
     type = lib.types.submoduleWith {
       modules = [
@@ -10,16 +11,19 @@
         }
       ];
     };
-    default = {};
+    default = { };
   };
 
   config.submodule = lib.mkMerge [
-    ({ lib, ... }: {
-      options.outer = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-      };
-    })
+    (
+      { lib, ... }:
+      {
+        options.outer = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+        };
+      }
+    )
     {
       inner = true;
       outer = true;

lib/tests/modules/declare-submoduleWith-noshorthand.nix

@@ -1,13 +1,15 @@
-{ lib, ... }: let
+{ lib, ... }:
+let
   sub.options.config = lib.mkOption {
     type = lib.types.bool;
     default = false;
   };
-in {
+in
+{
   options.submodule = lib.mkOption {
     type = lib.types.submoduleWith {
       modules = [ sub ];
     };
-    default = {};
+    default = { };
   };
 }

lib/tests/modules/declare-submoduleWith-path.nix

@@ -1,11 +1,12 @@
-{ lib, ... }: {
+{ lib, ... }:
+{
   options.submodule = lib.mkOption {
     type = lib.types.submoduleWith {
       modules = [
         ./declare-enable.nix
       ];
     };
-    default = {};
+    default = { };
   };
 
   config.submodule = ./define-enable.nix;

lib/tests/modules/declare-submoduleWith-shorthand.nix

@@ -1,14 +1,16 @@
-{ lib, ... }: let
+{ lib, ... }:
+let
   sub.options.config = lib.mkOption {
     type = lib.types.bool;
     default = false;
   };
-in {
+in
+{
   options.submodule = lib.mkOption {
     type = lib.types.submoduleWith {
       modules = [ sub ];
       shorthandOnlyDefinesConfig = true;
     };
-    default = {};
+    default = { };
   };
 }

lib/tests/modules/declare-submoduleWith-special.nix

@@ -1,17 +1,21 @@
-{ lib, ... }: {
+{ lib, ... }:
+{
   options.submodule = lib.mkOption {
     type = lib.types.submoduleWith {
       modules = [
-        ({ lib, ... }: {
-          options.foo = lib.mkOption {
-            default = lib.foo;
-          };
-        })
+        (
+          { lib, ... }:
+          {
+            options.foo = lib.mkOption {
+              default = lib.foo;
+            };
+          }
+        )
       ];
       specialArgs.lib = lib // {
         foo = "foo";
       };
     };
-    default = {};
+    default = { };
   };
 }

lib/tests/modules/declare-variants.nix

@@ -1,9 +1,10 @@
 { lib, moduleType, ... }:
-let inherit (lib) mkOption types;
+let
+  inherit (lib) mkOption types;
 in
 {
   options.variants = mkOption {
     type = types.lazyAttrsOf moduleType;
-    default = {};
+    default = { };
   };
 }