ruby_2_5: 2.5.7 -> 2.5.8

Changelog: https://www.ruby-lang.org/en/news/2020/03/31/ruby-2-5-8-released/
(cherry picked from commit 99b09d6b8f)

.devcontainer/devcontainer.json

@@ -1,34 +0,0 @@
-{
-  "name": "nixpkgs",
-  "image": "mcr.microsoft.com/devcontainers/universal:2-linux",
-  "features": {
-    "ghcr.io/devcontainers/features/nix:1": {
-      // fails in the devcontainer sandbox, enable sandbox via config instead
-      "multiUser": false,
-      "packages": "nixpkgs.nixd,nixpkgs.nixfmt-rfc-style",
-      "useAttributePath": true,
-      "extraNixConfig": "experimental-features = nix-command flakes,sandbox = true"
-    }
-  },
-  // Fixup permissions inside container.
-  // https://github.com/NixOS/nix/issues/6680#issuecomment-1230902525
-  "postCreateCommand": "sudo apt-get install -y acl",
-  "postStartCommand": "sudo setfacl -k /tmp; if [ -e /dev/kvm ]; then sudo chgrp $(id -g) /dev/kvm; fi",
-  "customizations": {
-    "vscode": {
-      "extensions": [
-        "jnoortheen.nix-ide"
-      ],
-      "settings": {
-        "[nix]": {
-            "editor.formatOnSave": true
-        },
-        "nix.enableLanguageServer": true,
-        "nix.serverPath": "nixd"
-      }
-    }
-  },
-  "remoteEnv": {
-    "NIXPKGS": "/workspaces/nixpkgs"
-  }
-}

.dir-locals.el

@@ -0,0 +1,8 @@
+;;; Directory Local Variables
+;;; For more information see (info "(emacs) Directory Variables")
+
+((nil
+  (bug-reference-bug-regexp . "\\(\\(?:[Ii]ssue \\|[Ff]ixe[ds] \\|[Rr]esolve[ds]? \\|[Cc]lose[ds]? \\|[Pp]\\(?:ull [Rr]equest\\|[Rr]\\) \\|(\\)#\\([0-9]+\\))?\\)")
+  (bug-reference-url-format . "https://github.com/NixOS/nixpkgs/issues/%s"))
+ (nix-mode
+  (tab-width . 2)))

.editorconfig

@@ -1,5 +1,5 @@
 # EditorConfig configuration for nixpkgs
-# https://EditorConfig.org
+# http://EditorConfig.org
 
 # Top-most EditorConfig file
 root = true
@@ -11,85 +11,18 @@ insert_final_newline = true
 trim_trailing_whitespace = true
 charset = utf-8
 
-# Ignore diffs/patches
-[*.{diff,patch}]
-end_of_line = unset
-insert_final_newline = unset
-trim_trailing_whitespace = unset
-
-# We want readFile .version to return the version without a newline.
-[.version]
-insert_final_newline = false
-
 # see https://nixos.org/nixpkgs/manual/#chap-conventions
 
-# Match json/lockfiles/markdown/nix/perl/python/ruby/shell/docbook files, set indent to spaces
-[*.{bash,js,json,lock,md,nix,pl,pm,py,rb,sh,xml}]
+# Match nix/ruby/docbook files, set indent to spaces with width of two
+[*.{nix,rb,xml}]
 indent_style = space
-
-# Match docbook files, set indent width of one
-[*.xml]
-indent_size = 1
-
-# Match json/lockfiles/markdown/nix/ruby files, set indent width of two
-[*.{js,json,lock,md,nix,rb}]
 indent_size = 2
 
-# Match all the Bash code in Nix files, set indent width of two
-[*.{bash,sh}]
-indent_size = 2
-
-# Match Perl and Python scripts, set indent width of four
-[*.{pl,pm,py}]
+# Match shell/python/perl scripts, set indent to spaces with width of four
+[*.{sh,py,pl}]
+indent_style = space
 indent_size = 4
 
-# Match gemfiles, set indent to spaces with width of two
-[Gemfile]
-indent_size = 2
-indent_style = space
-
-# Match package.json and package-lock.json, which are generally pulled from upstream and accept them as they are
-[package{,-lock}.json]
-indent_style = unset
-insert_final_newline = unset
-
-# Disable file types or individual files
-# some of these files may be auto-generated and/or require significant changes
-
-[*.{c,h}]
-insert_final_newline = unset
-trim_trailing_whitespace = unset
-
-[*.{asc,key,ovpn}]
-insert_final_newline = unset
-end_of_line = unset
-trim_trailing_whitespace = unset
-
-[*.lock]
-indent_size = unset
-
-# Although Markdown/CommonMark allows using two trailing spaces to denote
-# a hard line break, we do not use that feature in nixpkgs since
-# it forces the surrounding paragraph to become a <literallayout> which
-# does not wrap reasonably.
-# Instead of a hard line break, start a new paragraph by inserting a blank line.
-[*.md]
-trim_trailing_whitespace = true
-
-# binaries
-[*.nib]
-end_of_line = unset
-insert_final_newline = unset
-trim_trailing_whitespace = unset
-charset = unset
-
-[eggs.nix]
-trim_trailing_whitespace = unset
-
-[registry.dat]
-end_of_line = unset
-insert_final_newline = unset
-
-# Keep this hint at the bottom:
-# Please don't add entries for subfolders here.
-# Create <subfolder>/.editorconfig instead.
+# Match diffs, avoid to trim trailing whitespace
+[*.{diff,patch}]
+trim_trailing_whitespace = false

.git-blame-ignore-revs

@@ -1,287 +0,0 @@
-# This file contains a list of commits that are not likely what you
-# are looking for in a blame, such as mass reformatting or renaming.
-#
-# If a commit's line ends with `# !autorebase <command>`,
-# where <command> is an idempotent bash command that reapplies the changes from the commit,
-# the `maintainers/scripts/auto-rebase/run.sh` script can be used to rebase
-# across that commit while automatically resolving merge conflicts caused by the commit.
-#
-# You can set this file as a default ignore file for blame by running
-# the following command.
-#
-# $ git config blame.ignoreRevsFile .git-blame-ignore-revs
-#
-# To temporarily not use this file add
-# --ignore-revs-file=""
-# to your blame command.
-#
-# The ignoreRevsFile can't be set globally due to blame failing if the file isn't present.
-# To not have to set the option in every repository it is needed in,
-# save the following script in your path with the name "git-bblame"
-# now you can run
-# $ git bblame $FILE
-# to use the .git-blame-ignore-revs file if it is present.
-#
-# #!/usr/bin/env bash
-# repo_root=$(git rev-parse --show-toplevel)
-# if [[ -e $repo_root/.git-blame-ignore-revs ]]; then
-#     git blame --ignore-revs-file="$repo_root/.git-blame-ignore-revs" $@
-# else
-#     git blame $@
-# fi
-
-
-# nixos/modules/rename: Sort alphabetically
-1f71224fe86605ef4cd23ed327b3da7882dad382
-
-# manual: fix typos
-feddd5e7f8c6f8167b48a077fa2a5394dc008999
-
-# nixos: fix module paths in rename.nix
-d08ede042b74b8199dc748323768227b88efcf7c
-
-# fix indentation in mk-python-derivation.nix
-d1c1a0c656ccd8bd3b25d3c4287f2d075faf3cf3
-
-# fix indentation in meteor default.nix
-a37a6de881ec4c6708e6b88fd16256bbc7f26bbd
-
-# pkgs/stdenv/make-derivation: Reindent
-b4cc2a2479a7ab0f6440b2e1319221920ef72699
-
-# treewide: automatically md-convert option descriptions
-2e751c0772b9d48ff6923569adfa661b030ab6a2
-
-# nixos/*: automatically convert option docs
-087472b1e5230ffc8ba642b1e4f9218adf4634a2
-
-# nixos/*: automatically convert option descriptions
-ef176dcf7e76c3639571d7c6051246c8fbadf12a
-
-# nixos/*: automatically convert option docs to MD
-61e93df1891972bae3e0c97a477bd44e8a477aa0
-
-# nixos/*: convert options with admonitions to MD
-722b99bc0eb57711c0498a86a3f55e6c69cdb05f
-
-# nixos/*: automatically convert option docs
-6039648c50c7c0858b5e506c6298773a98e0f066
-
-# nixos/*: md-convert options with unordered lists
-c915b915b5e466a0b0b2af2906cd4d2380b8a1de
-
-# nixos/*: convert options with listings
-f2ea09ecbe1fa1da32eaa6e036d64ac324a2986f
-
-# nixos/*: convert straggler options to MD
-1d41cff3dc4c8f37bb5841f51fcbff705e169178
-
-# nixos/*: normalize manpage references to single-line form
-423545fe4865d126e86721ba30da116e29c65004
-
-# nixos/documentation: split options doc build
-fc614c37c653637e5475a0b0a987489b4d1f351d
-
-# nixos/*: convert options with admonitions to MD
-722b99bc0eb57711c0498a86a3f55e6c69cdb05f
-
-# nixos/*: convert internal option descriptions to MD
-9547123258f69efd92b54763051d6dc7f3bfcaca
-
-# nixos/*: replace </para><para> with double linebreaks
-694d5b19d30bf66687b42fb77f43ea7cd1002a62
-
-# treewide: add defaultText for options with simple interpolation defaults
-fb0e5be84331188a69b3edd31679ca6576edb75a
-
-# nixos/*: mark pre-existing markdown descriptions as mdDoc
-7e7d68a250f75678451cd44f8c3d585bf750461e
-
-# nixos/*: normalize link format
-3aebb4a2be8821a6d8a695f0908d8567dc00de31
-
-# nixos/*: replace <code> in option docs with <literal>
-16102dce2fbad670bd47dd75c860a8daa5fe47ad
-
-# nixos/*: add trivial defaultText for options with simple defaults
-25124556397ba17bfd70297000270de1e6523b0a
-
-# systemd: rewrite comments
-92dfeb7b3dab820ae307c56c216d175c69ee93cd
-
-# systemd: break too long lines of Nix code
-67643f8ec84bef1482204709073e417c9f07eb87
-
-# {pkgs/development/cuda-modules,pkgs/test/cuda,pkgs/top-level/cuda-packages.nix}: reformat all CUDA files with nixfmt-rfc-style 2023-03-01
-802a1b4d3338f24cbc4efd704616654456d75a94
-
-# postgresql: move packages.nix to ext/default.nix
-719034f6f6749d624faa28dff259309fc0e3e730
-
-# php ecosystem: reformat with nixfmt-rfc-style
-75ae7621330ff8db944ce4dff4374e182d5d151f
-c759efa5e7f825913f9a69ef20f025f50f56dc4d
-
-# pkgs/os-specific/bsd: Reformat with nixfmt-rfc-style 2024-03-01
-3fe3b055adfc020e6a923c466b6bcd978a13069a
-
-# k3s: format with nixfmt-rfc-style
-6cfcd3c75428ede517bc6b15a353d704837a2830
-
-# python3Packages: format with nixfmt
-59b1aef59071cae6e87859dc65de973d2cc595c0
-
-# treewide description changes (#317959)
-bf995e3641950f4183c1dd9010349263dfa0123b
-755b915a158c9d588f08e9b08da9f7f3422070cc
-f8c4a98e8e138e21353a2c33b90db3359f539b37
-
-# vscode-extensions.*: format with nixfmt (RFC 166)
-7bf9febfa6271012b1ef86647a3a06f06875fdcf
-
-# remove uses of mdDoc (#303841)
-1a24330f792c8625746d07d842290e6fd95ae6f9
-acd0e3898feb321cb9a71a0fd376f1157d0f4553
-1b28414d2886c57343864326dbb745a634d3e37d
-6afb255d976f85f3359e4929abd6f5149c323a02
-
-# azure-cli: move to by-name, nixfmt #325950
-96cd538b68bd1d0a0a37979356d669abbba32ebc
-
-# poptracker: format with nixfmt-rfc-style (#326697)
-ff5c8f6cc3d1f2e017e86d50965c14b71f00567b
-
-# mangal: format with nixfmt-rfc-style #328284
-3bb5e993cac3a6e1c3056d2bc9bf43eb2c7a5951
-
-# pico-sdk: switch to finalAttrs (#329438)
-8946018b0391ae594d167f1e58497b18de068968
-
-# ollama: format with nixfmt-rfc-style (#329353)
-bdfde18037f8d9f9b641a4016c8ada4dc4cbf856
-
-# nixos/ollama: format with nixfmt-rfc-style (#329561)
-246d1ee533810ac1946d863bbd9de9b525818d56
-
-# steam: cleanup (#216972)
-ad815aebfbfe1415ff6436521d545029c803c3fb
-
-# nixos/nvidia: apply nixfmt-rfc-style (#313440)
-fbdcdde04a7caa007e825a8b822c75fab9adb2d6
-
-# treewide: reformat files which need reformatting after (#341407)
-e0464e47880a69896f0fb1810f00e0de469f770a
-
-# step-cli: format package.nix with nixfmt (#331629)
-fc7a83f8b62e90de5679e993d4d49ca014ea013d
-
-# ndn-cxx: format with nixfmt-rfc-style
-160b2b769c3b8a6d1ae9947afa77520fa2887db7
-
-# ndn-tools: format with nixfmt-rfc-style
-4882ef721ce3d7bb3b5e48ff80125255db515013
-
-# nfd: format with nixfmt-rfc-style
-548c2377fa81e2abfc192fbf4f521e601251c468
-
-# darwin.stdenv: format with nixfmt-rfc-style (#333962)
-93c10ac9e561c6594d3baaeaff2341907390d9b8
-
-# nrr: format with nixfmt-rfc-style (#334578)
-cffc27daf06c77c0d76bc35d24b929cb9d68c3c9
-
-# nixos/kanidm: inherit lib, nixfmt
-8f18393d380079904d072007fb19dc64baef0a3a
-
-# fetchhg: format after refactoring with lib.extendMkDerivation and make overridable (#423539)
-34a5b1eb23129f8fb62c677e3760903f6d43228f
-
-# fetchurl: nixfmt-rfc-style
-ce21e97a1f20dee15da85c084f9d1148d84f853b
-
-# percona: apply nixfmt
-8d14fa2886fec877690c6d28cfcdba4503dbbcea
-
-# nixos/virtualisation: format image-related files
-# Original formatting commit that was reverted
-04fadac429ca7d6b92025188652376c230205730
-# Revert commit
-4cec81a9959ce612b653860dcca53101a36f328a
-# Final commit that does the formatting
-88b285c01d84de82c0b2b052fd28eaf6709c2d26
-
-# sqlc: format with nixfmt
-2bdec131b2bb2c8563f4556d741d34ccb77409e2
-
-# ant: format with nixfmt-rfc-style
-2538d58436b8d0b56d29780aeebf4bf720ddb9ea
-
-# treewide: migrate packages to pkgs/by-name, take 1
-571c71e6f73af34a229414f51585738894211408
-
-# format files with nixfmt (#347275)
-adb9714bd909df283c66bbd641bd631ff50a4260
-
-# treewide: incus packages
-9ab59bb5fb943ad6740f64f5a79eae9642fb8211
-
-# treewide nixfmt reformat pass 1, master, staging and staging-next
-4f0dadbf38ee4cf4cc38cbc232b7708fddf965bc
-667d42c00d566e091e6b9a19b365099315d0e611
-84d4f874c2bac9f3118cb6907d7113b3318dcb5e
-
-# tmuxPlugins sha-to-sri.py script
-516b1e74c358a9c4b06e5591f8c1a2897aad0c33
-
-# treewide: migrate comments in lib to rfc145 style
-ef85e0daa092c9eae0d32c7ce16b889728a5fbc0
-d89ad6c70e0e89aaae75e9f886878ea4e103965a
-e0fe216f4912dd88a021d12a44155fd2cfeb31c8
-80d5b411f6397d5c3e755a0635d95742f76f3c75
-
-# nixos/movim: format with nixfmt-rfc-style
-43c1654cae47cbf987cb63758c06245fa95c1e3b
-
-# nixos/iso-image.nix: nixfmt
-da9a092c34cef6947d7aee2b134f61df45171631
-
-# python-packages: format with nixfmt-rfc-style
-5f6f5e13ae0b6960cbf1be8aeb3d0048285a08d1
-
-# python-packages: sort with keep-sorted
-fd14c067813572afc03ddbf7cdedc3eab5a59954
-783add849cbca228a36ffdf407e5d380dc2fe6c4
-
-# treewide format of all Nix files
-374e6bcc403e02a35e07b650463c01a52b13a7c8 # !autorebase nix-shell --run treefmt
-
-# nix: nixfmt-rfc-style
-a4f7e161b380b35b2f7bc432659a95fd71254ad8
-0812c9a321003c924868051d2b2e1934e8880f3f
-34f269c14ac18d89ddee9a8f54b1ca92a85bbcc6
-062c34cdace499aa44f0fa6ca6f2ca71769f6c43
-
-# haskellPackages.hercules-ci-agent (cabal2nix -> nixfmt-rfc-style)
-9314da7ee8d2aedfb15193b8c489da51efe52bb5
-
-# nix-builder-vm: nixfmt-rfc-style
-a034fb50f79816c6738fb48b48503b09ea3b0132
-
-# treewide: switch instances of lib.teams.*.members to the new meta.teams attribute
-05580f4b4433fda48fff30f60dfd303d6ee05d21
-
-# nixos/redmine: Get rid of global lib expansions
-d7f1102f04c58b2edfc74c9a1d577e3aebfca775
-
-# **/README.md: one sentence per line
-3d505c03610b6102af6d870ae3506a151cef1f68
-60e35e4ded6e91524364a74b3b4ec233ed9321f2
-99f2e655d9db009ee0b4ede3edced5f6c882c7f4
-b4532efe93882ae2e3fc579929a42a5a56544146
-
-# emacs: keep elpa/nongnu/melpa package overrides sorted
-9f2faf683ed48704aa17f693208a13aa64e22181
-
-# nixfmt 1.0.0
-62fe01651911043bd3db0add920af3d2935d9869 # !autorebase nix-shell --run treefmt
-5a0711127cd8b916c3d3128f473388c8c79df0da # !autorebase nix-shell --run treefmt

.gitattributes

@@ -1,6 +1,4 @@
 **/deps.nix linguist-generated
-**/deps.json linguist-generated
-**/deps.toml linguist-generated
 **/node-packages.nix linguist-generated
 
 pkgs/applications/editors/emacs-modes/*-generated.nix linguist-generated
@@ -16,5 +14,3 @@ nixos/doc/default.nix linguist-documentation=false
 
 nixos/modules/module-list.nix merge=union
 # pkgs/top-level/all-packages.nix merge=union
-
-ci/OWNERS linguist-language=CODEOWNERS

.github/CODEOWNERS

@@ -0,0 +1,99 @@
+# CODEOWNERS file
+#
+# This file is used to describe who owns what in this repository. This file does not
+# replace `meta.maintainers` but is instead used for other things than derivations
+# and modules, like documentation, package sets, and other assets.
+#
+# For documentation on this file, see https://help.github.com/articles/about-codeowners/
+# Mentioned users will get code review requests.
+
+# This file
+/.github/CODEOWNERS @edolstra
+
+# Libraries
+/lib                        @edolstra @nbp
+/lib/systems                @nbp @ericson2314
+/lib/generators.nix         @edolstra @nbp @Profpatsch
+/lib/debug.nix              @edolstra @nbp @Profpatsch
+
+# Nixpkgs Internals
+/default.nix                          @nbp
+/pkgs/top-level/default.nix           @nbp @Ericson2314
+/pkgs/top-level/impure.nix            @nbp @Ericson2314
+/pkgs/top-level/stage.nix             @nbp @Ericson2314
+/pkgs/stdenv/generic                  @Ericson2314
+/pkgs/stdenv/cross                    @Ericson2314
+/pkgs/build-support/cc-wrapper        @Ericson2314 @orivej
+/pkgs/build-support/bintools-wrapper  @Ericson2314 @orivej
+/pkgs/build-support/setup-hooks       @Ericson2314
+
+# NixOS Internals
+/nixos/default.nix          @nbp
+/nixos/lib/from-env.nix     @nbp
+/nixos/lib/eval-config.nix  @nbp
+/nixos/doc/manual/configuration/abstractions.xml      @nbp
+/nixos/doc/manual/configuration/config-file.xml       @nbp
+/nixos/doc/manual/configuration/config-syntax.xml     @nbp
+/nixos/doc/manual/configuration/modularity.xml        @nbp
+/nixos/doc/manual/development/assertions.xml          @nbp
+/nixos/doc/manual/development/meta-attributes.xml     @nbp
+/nixos/doc/manual/development/option-declarations.xml @nbp
+/nixos/doc/manual/development/option-def.xml          @nbp
+/nixos/doc/manual/development/option-types.xml        @nbp
+/nixos/doc/manual/development/replace-modules.xml     @nbp
+/nixos/doc/manual/development/writing-modules.xml     @nbp
+/nixos/doc/manual/man-nixos-option.xml                @nbp
+/nixos/modules/installer/tools/nixos-option.sh        @nbp
+
+# Python-related code and docs
+/maintainers/scripts/update-python-libraries	@FRidh
+/pkgs/top-level/python-packages.nix     @FRidh
+/pkgs/development/interpreters/python   @FRidh
+/pkgs/development/python-modules        @FRidh
+/doc/languages-frameworks/python.md     @FRidh
+
+# Haskell
+/pkgs/development/compilers/ghc                       @peti @ryantm @basvandijk
+/pkgs/development/haskell-modules                     @peti @ryantm @basvandijk
+/pkgs/development/haskell-modules/default.nix         @peti @ryantm @basvandijk
+/pkgs/development/haskell-modules/generic-builder.nix @peti @ryantm @basvandijk
+/pkgs/development/haskell-modules/hoogle.nix          @peti @ryantm @basvandijk
+
+# R
+/pkgs/applications/science/math/R   @peti
+/pkgs/development/r-modules         @peti
+
+# Ruby
+/pkgs/development/interpreters/ruby @zimbatm
+/pkgs/development/ruby-modules      @zimbatm
+
+# Rust
+/pkgs/development/compilers/rust @Mic92 @LnL7
+
+# Darwin-related
+/pkgs/stdenv/darwin         @NixOS/darwin-maintainers
+/pkgs/os-specific/darwin    @NixOS/darwin-maintainers
+
+# Beam-related (Erlang, Elixir, LFE, etc)
+/pkgs/development/beam-modules                  @gleber
+/pkgs/development/interpreters/erlang           @gleber
+/pkgs/development/interpreters/lfe              @gleber
+/pkgs/development/interpreters/elixir           @gleber
+/pkgs/development/tools/build-managers/rebar    @gleber
+/pkgs/development/tools/build-managers/rebar3   @gleber
+/pkgs/development/tools/erlang                  @gleber
+
+# Jetbrains
+/pkgs/applications/editors/jetbrains @edwtjo
+
+# Eclipse
+/pkgs/applications/editors/eclipse @rycee
+
+# https://github.com/NixOS/nixpkgs/issues/31401
+/lib/licenses.nix @ghost
+
+# Qt / KDE
+/pkgs/applications/kde @ttuegel
+/pkgs/desktops/plasma-5 @ttuegel
+/pkgs/development/libraries/kde-frameworks @ttuegel
+/pkgs/development/libraries/qt-5 @ttuegel

.github/CONTRIBUTING.md

@@ -0,0 +1,52 @@
+# How to contribute
+
+Note: contributing implies licensing those contributions
+under the terms of [COPYING](../COPYING), which is an MIT-like license.
+
+## Opening issues
+
+* Make sure you have a [GitHub account](https://github.com/signup/free)
+* [Submit an issue](https://github.com/NixOS/nixpkgs/issues) - assuming one does not already exist.
+  * Clearly describe the issue including steps to reproduce when it is a bug.
+  * Include information what version of nixpkgs and Nix are you using (nixos-version or git revision).
+
+## Submitting changes
+
+* Format the commit messages in the following way:
+
+  ```
+  (pkg-name | nixos/<module>): (from -> to | init at version | refactor | etc)
+
+  (Motivation for change. Additional information.)
+  ```
+
+  Examples:
+
+  * nginx: init at 2.0.1
+  * firefox: 54.0.1 -> 55.0
+  * nixos/hydra: add bazBaz option
+
+    Dual baz behavior is needed to do foo.
+  * nixos/nginx: refactor config generation
+
+    The old config generation system used impure shell scripts and could break in specific circumstances (see #1234).
+
+* `meta.description` should:
+  * Be capitalized.
+  * Not start with the package name.
+  * Not have a period at the end.
+* `meta.license` must be set and fit the upstream license.
+  * If there is no upstream license, `meta.license` should default to `stdenv.lib.licenses.unfree`.
+* `meta.maintainers` must be set.
+
+See the nixpkgs manual for more details on [standard meta-attributes](https://nixos.org/nixpkgs/manual/#sec-standard-meta-attributes) and on how to [submit changes to nixpkgs](https://nixos.org/nixpkgs/manual/#chap-submitting-changes).
+
+## Writing good commit messages
+
+In addition to writing properly formatted commit messages, it's important to include relevant information so other developers can later understand *why* a change was made. While this information usually can be found by digging code, mailing list/Discourse archives, pull request discussions or upstream changes, it may require a lot of work.
+
+For package version upgrades and such a one-line commit message is usually sufficient.
+
+## Reviewing contributions
+
+See the nixpkgs manual for more details on how to [Review contributions](https://nixos.org/nixpkgs/manual/#sec-reviewing-contributions).

.github/ISSUE_TEMPLATE.md

@@ -1,6 +1,12 @@
-<!--
-    Please note: This blank issue template is meant for extraordinary issues
-    that do not fit the templates. Unless you know your issue is relevant to
-    Nixpkgs and requires the free-form blank issue, please use the issue
-    templates instead.
--->
+## Issue description
+
+
+
+### Steps to reproduce
+
+
+
+## Technical details
+
+Please run `nix-shell -p nix-info --run "nix-info -m"` and paste the
+results.

.github/ISSUE_TEMPLATE/01_bug_report.yml

@@ -1,143 +0,0 @@
-name: "Bug report (package)"
-description: "Create a generic bug report against a package."
-title: "PACKAGENAME: BUG TITLE"
-labels: ["0.kind: bug"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`PACKAGENAME: BUG TITLE`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)) and a short title summarising what the bug entails.
-
-        > [!TIP]
-        > For instance, if you were filing a bug against the [`hello`](https://search.nixos.org/packages?channel=unstable&from=0&size=1&buckets=%7B%22package_attr_set%22%3A%5B%22No%20package%20set%22%5D%2C%22package_license_set%22%3A%5B%22GNU%20General%20Public%20License%20v3.0%20or%20later%22%5D%2C%22package_maintainers_set%22%3A%5B%5D%2C%22package_platforms%22%3A%5B%5D%7D&sort=relevance&type=packages&query=hello) package about it failing to launch on ARM Linux, your title would be as follows:
-        > ```
-        > hello: fails to launch on aarch64-linux
-        > ```
-
-        ---
-  - type: "dropdown"
-    id: "version"
-    attributes:
-      label: "Nixpkgs version"
-      description: |
-        What version of Nixpkgs are you using?
-
-        If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
-      options:
-        - "Please select a version."
-        - "- Unstable (25.11)"
-        - "- Stable (25.05)"
-      default: 0
-    validations:
-      required: true
-  - type: "textarea"
-    id: "description"
-    attributes:
-      label: "Describe the bug"
-      description: "Please include a clear and concise description of what the issue is."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "how-to-reproduce"
-    attributes:
-      label: "Steps to reproduce"
-      description: "Please include a step-by-step guide for reproducing this issue. Consider writing in concise, numbered bullet points to ensure that Nixpkgs developers can retrace your steps."
-    validations:
-      required: true
-  - type: "input"
-    id: "expected-behaviour"
-    attributes:
-      label: "Expected behaviour"
-      description: "Please write a concise description of what was supposed to happen."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "screenshots"
-    attributes:
-      label: "Screenshots"
-      description: |
-        If applicable, add screenshots to help explain your problem.
-        If you need help uploading images to GitHub, please review the [relevant documentation](https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#uploading-assets).
-    validations:
-      required: false
-  - type: "textarea"
-    id: "logs"
-    attributes:
-      label: "Relevant log output"
-      description: |
-        If applicable, copy and paste any relevant log output.
-        This will be automatically formatted into code, so no need for backticks.
-      render: "console"
-    validations:
-      required: false
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the problem here."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "metadata"
-    attributes:
-      label: "System metadata"
-      description: "Please run `nix-shell -p nix-info --run \"nix-info -m\"` on a terminal and paste the output of that command here."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |2
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      description: |
-        This bug tracker is for actionable issues that are not the result of user error. If you need help using your system and are unsure if this is a bug with Nixpkgs, please consider asking for help on the [NixOS Discourse](https://discourse.nixos.org/) or the [NixOS Matrix Space](https://matrix.to/#/#community:nixos.org) before opening an issue.
-      options:
-        - label: "I assert that this is a bug and not a support request."
-          required: true
-        - label: "I assert that this is not a [duplicate of an existing issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%220.kind%3A+bug%22+-label%3A%226.topic%3A+darwin%22+-label%3A%226.topic%3A+nixos%22). "
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/02_bug_report_darwin.yml

@@ -1,157 +0,0 @@
-name: "Bug report (macOS)"
-description: "Create a bug report against a package where the issue only occurs on macOS."
-title: "PACKAGENAME: BUG TITLE"
-labels: ["0.kind: bug", "6.topic: darwin"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`PACKAGENAME: BUG TITLE`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)) and a short title summarising what the bug entails.
-
-        > [!TIP]
-        > For instance, if you were filing a bug against the [`hello`](https://search.nixos.org/packages?channel=unstable&from=0&size=1&buckets=%7B%22package_attr_set%22%3A%5B%22No%20package%20set%22%5D%2C%22package_license_set%22%3A%5B%22GNU%20General%20Public%20License%20v3.0%20or%20later%22%5D%2C%22package_maintainers_set%22%3A%5B%5D%2C%22package_platforms%22%3A%5B%5D%7D&sort=relevance&type=packages&query=hello) package about it failing to launch on Apple Silicon, your title would be as follows:
-        > ```
-        > hello: fails to launch on aarch64-darwin
-        > ```
-
-        ---
-  - type: "dropdown"
-    id: "version"
-    attributes:
-      label: "Nixpkgs version"
-      description: |
-        What version of Nixpkgs are you using?
-
-        If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
-      options:
-        - "Please select a version."
-        - "- Unstable (25.11)"
-        - "- Stable (25.05)"
-      default: 0
-    validations:
-      required: true
-  - type: "textarea"
-    id: "description"
-    attributes:
-      label: "Describe the bug"
-      description: "Please include a clear and concise description of what the issue is."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "how-to-reproduce"
-    attributes:
-      label: "Steps to reproduce"
-      description: "Please include a step-by-step guide for reproducing this issue. Consider writing in concise, numbered bullet points to ensure that Nixpkgs developers can retrace your steps."
-    validations:
-      required: true
-  - type: "input"
-    id: "expected-behaviour"
-    attributes:
-      label: "Expected behaviour"
-      description: "Please write a concise description of what was supposed to happen."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "screenshots"
-    attributes:
-      label: "Screenshots"
-      description: |
-        If applicable, add screenshots to help explain your problem.
-        If you need help uploading images to GitHub, please review the [relevant documentation](https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#uploading-assets).
-    validations:
-      required: false
-  - type: "textarea"
-    id: "logs"
-    attributes:
-      label: "Relevant log output"
-      description: |
-        If applicable, copy and paste any relevant log output.
-        This will be automatically formatted into code, so no need for backticks.
-      render: "console"
-    validations:
-      required: false
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the problem here."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "metadata"
-    attributes:
-      label: "System metadata"
-      description: "Please run `nix-shell -p nix-info --run \"nix-info -m\"` on a terminal and paste the output of that command here."
-    validations:
-      required: true
-  - type: "dropdown"
-    id: "nix-darwin"
-    attributes:
-      label: "Are you using nix-darwin?"
-      description: |
-        [`nix-darwin`](https://github.com/LnL7/nix-darwin) is a set of NixOS-like modules for macOS systems. Depending on your issue, this information may be relevant.
-      options:
-        - "Yes, I am using nix-darwin."
-        - "No, I am not using nix-darwin."
-      default: 1
-    validations:
-      required: true
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-
-        If this issue is related to the Darwin packaging architecture as a whole, or is related to the core Darwin frameworks, consider mentioning the `@NixOS/darwin-core` team.
-      value: |2
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      description: |
-        This bug tracker is for actionable issues that are not the result of user error. If you need help using your system and are unsure if this is a bug with Nixpkgs/NixOS, please consider asking for help on the [NixOS Discourse](https://discourse.nixos.org/) or the [NixOS Matrix Space](https://matrix.to/#/#community:nixos.org) before opening an issue.
-      options:
-        - label: "I assert that this is a bug and not a support request."
-          required: true
-        - label: "I assert that this is not a [duplicate of an existing issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%220.kind%3A+bug%22+label%3A%226.topic%3A+darwin%22). "
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/03_bug_report_nixos.yml

@@ -1,147 +0,0 @@
-name: "Bug report (NixOS module)"
-description: "Create a bug report against a NixOS Module."
-title: "nixos/MODULENAME: BUG TITLE"
-labels: ["0.kind: bug", "6.topic: nixos"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`nixos/MODULENAME: BUG TITLE`** template above with the correct module name (As seen in the [NixOS Option Search](https://search.nixos.org/options)) and a short title summarising what the bug entails.
-
-        > [!TIP]
-        > For instance, if you were filing a bug against the [`systemd-boot`](https://search.nixos.org/options?channel=unstable&show=boot.loader.systemd-boot.enable&from=0&size=1) module about it failing to install [`memtest86`](https://search.nixos.org/options?channel=unstable&show=boot.loader.systemd-boot.memtest86.enable&from=0&size=1), your title would be as follows:
-        > ```
-        > nixos/systemd-boot: fails to install memtest86
-        > ```
-
-        ---
-  - type: "dropdown"
-    id: "version"
-    attributes:
-      label: "Nixpkgs version"
-      description: |
-        What version of Nixpkgs are you using?
-
-        If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
-      options:
-        - "Please select a version."
-        - "- Unstable (25.11)"
-        - "- Stable (25.05)"
-      default: 0
-    validations:
-      required: true
-  - type: "textarea"
-    id: "description"
-    attributes:
-      label: "Describe the bug"
-      description: "Please include a clear and concise description of what the issue is."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "how-to-reproduce"
-    attributes:
-      label: "Steps to reproduce"
-      description: "Please include a step-by-step guide for reproducing this issue. Consider writing in concise, numbered bullet points to ensure that Nixpkgs developers can retrace your steps."
-    validations:
-      required: true
-  - type: "input"
-    id: "expected-behaviour"
-    attributes:
-      label: "Expected behaviour"
-      description: "Please write a concise description of what was supposed to happen."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "screenshots"
-    attributes:
-      label: "Screenshots"
-      description: |
-        If applicable, add screenshots to help explain your problem.
-        If you need help uploading images to GitHub, please review the [relevant documentation](https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#uploading-assets).
-    validations:
-      required: false
-  - type: "textarea"
-    id: "logs"
-    attributes:
-      label: "Relevant log output"
-      description: |
-        If applicable, copy and paste any relevant log output.
-        This will be automatically formatted into code, so no need for backticks.
-      render: "console"
-    validations:
-      required: false
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the problem here."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "metadata"
-    attributes:
-      label: "System metadata"
-      description: "Please run `nix-shell -p nix-info --run \"nix-info -m\"` on a terminal and paste the output of that command here."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the `meta.maintainers` list of the offending module. This is done by prefixing the person's username with an '@' character. You can quickly go to the source code of a module by searching for it on the [NixOS Option Search](https://search.nixos.org/options) and clicking the "Declared in..." button.
-
-        Please note that the maintainer attribute name does not always match the maintainer's GitHub username. If that occurs, try looking in [`maintainers/maintainer-list.nix`](https://github.com/NixOS/nixpkgs/blob/master/maintainers/maintainer-list.nix) for the maintainer attribute name, and checking if the maintainer has a listed GitHub username.
-
-        If in doubt, check `git blame` for whoever last touched the module, or check the associated package's maintainers. Please add the mentions above the `---` characters.
-      value: |2
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      description: |
-        This bug tracker is for actionable issues that are not the result of user error. If you need help using your system and are unsure if this is a bug with Nixpkgs, please consider asking for help on the [NixOS Discourse](https://discourse.nixos.org/) or the [NixOS Matrix Space](https://matrix.to/#/#community:nixos.org) before opening an issue.
-      options:
-        - label: "I assert that this is a bug and not a support request."
-          required: true
-        - label: "I assert that this is not a [duplicate of an existing issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%220.kind%3A+bug%22+label%3A%226.topic%3A+nixos%22). "
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/04_build_failure.yml

@@ -1,153 +0,0 @@
-name: "Build failure"
-description: "Report a package that is failing to build."
-title: "Build failure: PACKAGENAME"
-labels: ["0.kind: build failure"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`Build failure: PACKAGENAME`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)).
-
-        > [!TIP]
-        > For instance, if you were filing a build failure against the [`hello`](https://search.nixos.org/packages?channel=unstable&from=0&size=1&buckets=%7B%22package_attr_set%22%3A%5B%22No%20package%20set%22%5D%2C%22package_license_set%22%3A%5B%22GNU%20General%20Public%20License%20v3.0%20or%20later%22%5D%2C%22package_maintainers_set%22%3A%5B%5D%2C%22package_platforms%22%3A%5B%5D%7D&sort=relevance&type=packages&query=hello) package, your title would be as follows:
-        > ```
-        > Build failure: hello
-        > ```
-
-        ---
-  - type: "dropdown"
-    id: "version"
-    attributes:
-      label: "Nixpkgs version"
-      description: |
-        In what version of Nixpkgs did the build failure occur?
-
-        If you are using an older version, please update to the latest stable version and check if the build failure persists before continuing this report.
-
-        If you are purposefully trying to build an ancient version of a package in an older Nixpkgs, please coordinate with the [NixOS Archivists](https://matrix.to/#/#archivists:nixos.org).
-      options:
-        - "Please select a version."
-        - "- Unstable (25.11)"
-        - "- Stable (25.05)"
-      default: 0
-    validations:
-      required: true
-  - type: "textarea"
-    id: "how-to-reproduce"
-    attributes:
-      label: "Steps to reproduce"
-      description: "Please include a step-by-step guide for reproducing this build failure. Consider writing in concise, numbered bullet points to ensure that Nixpkgs developers can retrace your steps."
-    validations:
-      required: true
-  - type: "dropdown"
-    id: "hydra"
-    attributes:
-      label: "Can Hydra reproduce this build failure?"
-      description: |
-        Can [Hydra](https://hydra.nixos.org), Nixpkgs' Continuous Integration system, reproduce this build failure?
-        Please use the search function in the header bar to locate the last build job for the package in question.
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-red-x-274c.svg" width="20px" align="top" alt="Red X"> icon near the package entry, say '**Yes, Hydra can reproduce this build failure.**'
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-gray-x-2716.svg" width="20px" align="top" alt="Dark Gray X"> icon near the package entry, then the build failure occurs with another package, and you need to track the original failing package by going down the chain of 'Cached failures' until you reach the final package in the failing dependency chain. Once you locate the failing package, re-write this report against that package and say '**Yes, Hydra can reproduce this build failure.**'
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-check-2714.svg" width="20px" align="top" alt="Green Check Mark"> icon near the package entry, then it most likely means it's a local issue with your system. (Maybe you ran out of space?)
-          You can still open a build failure report, but please say '**No, Hydra cannot reproduce this build failure.**' below.
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-question-2754.svg" width="20px" align="top" alt="Gray Question Mark"> icon near the package entry, say '**Hydra is currently rebuilding this package.**'
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-stopsign-1f6d1.svg" width="20px" align="top" alt="Red Stop Sign"> icon near the package entry, then the build job was stopped manually. If this occurs, please coordinate with the [Infrastructure Team](https://matrix.to/#/#infra:nixos.org), and say '**The last build job was manually cancelled.**'
-        - If Hydra isn't supposed to build the package at all, say '**Hydra doesn’t try to build the package.**'
-      options:
-        - "Please select the Hydra Status."
-        - "Yes, Hydra can reproduce this build failure."
-        - "No, Hydra cannot reproduce this build failure."
-        - "Hydra is currently rebuilding this package."
-        - "The last build job was manually cancelled."
-        - "Hydra doesn’t try to build the package."
-      default: 0
-    validations:
-      required: true
-  - type: "input"
-    id: "hydra-logs"
-    attributes:
-      label: "Link to Hydra build job"
-      description: "If you answered 'yes' in the question above, please copy-and-paste the link to the failing Hydra job here."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "logs"
-    attributes:
-      label: "Relevant log output"
-      description: |
-        Please copy and paste the logs from the failed build.
-        This will be automatically formatted into code, so no need for backticks.
-      render: "console"
-    validations:
-      required: true
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the problem here."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "metadata"
-    attributes:
-      label: "System metadata"
-      description: "Please run `nix-shell -p nix-info --run \"nix-info -m\"` on a terminal and paste the output of that command here."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |2
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      description: |
-        This bug tracker is for actionable issues that are not the result of user error. If you need help using your system and are unsure if this is a bug with Nixpkgs, please consider asking for help on the [NixOS Discourse](https://discourse.nixos.org/) or the [NixOS Matrix Space](https://matrix.to/#/#community:nixos.org) before opening an issue.
-      options:
-        - label: "I assert that this is a bug and not a support request."
-          required: true
-        - label: "I assert that this is not a [duplicate of an existing issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%220.kind%3A+build+failure%22). "
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/05_update_request.yml

@@ -1,126 +0,0 @@
-name: "Request: package update"
-description: "Create an update request for an existing, but outdated package."
-title: "Update Request: PACKAGENAME OLDVERSION → NEWVERSION"
-labels: ["0.kind: enhancement", "9.needs: package (update)"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`Update Request: PACKAGENAME OLDVERSION → NEWVERSION`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)), the current version of the package, and the latest version of the package.
-
-        > [!TIP]
-        > For instance, if you were filing a request against the out of date `hello` package, where the current version in Nixpkgs is 1.0.0, but the latest version upstream is 1.0.1, your title would be as follows:
-        > ```
-        > Update Request: hello 1.0.0 → 1.0.1
-        > ```
-
-        ---
-  - type: "dropdown"
-    id: "version"
-    attributes:
-      label: "Nixpkgs version"
-      description: |
-        What version of Nixpkgs are you using?
-
-        If you are using an older or stable version, please update to the latest **unstable** version and check if the package is still out of date.
-
-        If the package has been updated in unstable, but you believe the update should be backported to the stable release of Nixpkgs, please file the '**Request: backport to stable**' form instead.
-      options:
-        - "Please select a version."
-        - "- Unstable (25.11)"
-        - "- Stable (25.05)"
-      default: 0
-    validations:
-      required: true
-  - type: "input"
-    id: "name"
-    attributes:
-      label: "Package name"
-      description: "Please indicate the name of the package."
-    validations:
-      required: true
-  - type: "input"
-    id: "upstream-version"
-    attributes:
-      label: "Upstream version"
-      description: "Please indicate the latest version of the package."
-    validations:
-      required: true
-  - type: "input"
-    id: "nixpkgs-version"
-    attributes:
-      label: "Nixpkgs version"
-      description: |
-        Please indicate the current version number in Nixpkgs' **unstable** channel. You can check this by setting the [NixOS Package Search](https://search.nixos.org/packages?channel=unstable) channel to 'unstable' and searching for the package.
-        If you meant to request an upgrade in the stable channel, please file the '**Request: backport to stable**' form instead.
-    validations:
-      required: true
-  - type: "input"
-    id: "changelog"
-    attributes:
-      label: "Changelog"
-      description: "If applicable, please link the upstream changelog for the latest version."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the update here."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |2
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      options:
-        - label: "I assert that this package update does not yet exist in an [open pull request](https://github.com/NixOS/nixpkgs/pulls?q=is%3Aopen+is%3Apr+label%3A%228.has%3A+package+%28update%29%22) or in [Nixpkgs Unstable](https://search.nixos.org/packages?channel=unstable)."
-          required: true
-        - label: "I assert that this is not a [duplicate of any known issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%229.needs%3A+package+%28update%29%22)."
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/06_module_request.yml

@@ -1,101 +0,0 @@
-name: "Request: NixOS module"
-description: "Create a new NixOS Module request for an existing package."
-title: "Module Request: nixos/MODULENAME"
-labels: ["0.kind: enhancement", "6.topic: nixos", "9.needs: module (new)"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`Module Request: nixos/MODULENAME`** template above with the correct module name (As seen in the [NixOS Option Search](https://search.nixos.org/options)).
-
-        > [!TIP]
-        > For instance, if you were filing a request against the missing `hello` module, your title would be as follows:
-        > ```
-        > Module Request: nixos/hello
-        > ```
-
-        ---
-  - type: "dropdown"
-    id: "version"
-    attributes:
-      label: "Nixpkgs version"
-      description: |
-        What version of Nixpkgs are you using?
-
-        If you are using an older or stable version, please update to the latest **unstable** version and check if the module still does not exist before continuing this request.
-      options:
-        - "Please select a version."
-        - "- Unstable (25.11)"
-        - "- Stable (25.05)"
-      default: 0
-    validations:
-      required: true
-  - type: "textarea"
-    id: "description"
-    attributes:
-      label: "Describe the proposed module"
-      description: "Please include a clear and concise description of what the module should accomplish."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the proposed module here."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |2
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      options:
-        - label: "I assert that this module does not yet exist in an [open pull request](https://github.com/NixOS/nixpkgs/pulls?q=is%3Aopen+is%3Apr+label%3A%228.has%3A+module+%28new%29%22) or in [NixOS Unstable](https://search.nixos.org/options?channel=unstable)."
-          required: true
-        - label: "I assert that this is not a [duplicate of an existing issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%229.needs%3A+module+%28new%29%22). "
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve NixOS!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/07_backport_request.yml

@@ -1,107 +0,0 @@
-name: "Request: backport to stable"
-description: "Create a backport request for a package that is up-to-date in the unstable channel, but outdated in the stable channel."
-title: "Backport to Stable: PACKAGENAME OLDVERSION → NEWVERSION"
-labels: ["0.kind: enhancement", "9.needs: port to stable"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        > [!CAUTION]
-        > **Before you begin:** Be advised that backports are subject to the [release suitability guidelines](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#changes-acceptable-for-releases).
-        >
-        > Stable releases of Nixpkgs do not receive breaking changes, which include major package updates that have incompatible API changes and break backwards compatibility. In the [Semantic Versioning standard](https://semver.org/), this is the first version number (1.X.X).
-        >
-        > Generally, only minor package updates, such as security patches, bug fixes and feature additions (but not removals!) will be considered for backporting. Please read the rules above carefully before filing this backport request.
-
-        Welcome to Nixpkgs. Please replace the **`Backport to Stable: PACKAGENAME OLDVERSION → NEWVERSION`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)), the current version of the package in Nixpkgs Stable and the current version of the package in Nixpkgs Unstable.
-
-        > [!TIP]
-        > For instance, if you were filing a request against the out of date `hello` package, where the current version in Nixpkgs Unstable is 1.0.1, but the current version in Nixpkgs Stable is 1.0.0, your title would be as follows:
-        > ```
-        > Backport to Stable: hello 1.0.0 → 1.0.1
-        > ```
-
-        ---
-  - type: "input"
-    id: "name"
-    attributes:
-      label: "Package name"
-      description: "Please indicate the name of the package."
-    validations:
-      required: true
-  - type: "input"
-    id: "unstable-version"
-    attributes:
-      label: "Version in unstable"
-      description: "Please indicate the current version of the package in the unstable channel."
-    validations:
-      required: true
-  - type: "input"
-    id: "stable-version"
-    attributes:
-      label: "Version in stable"
-      description: "Please indicate the current version of the package in the stable channel."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "reasoning"
-    attributes:
-      label: "Reasoning for backport"
-      description: "Please briefly explain why this backport fits the [release suitability guidelines](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#changes-acceptable-for-releases) and why you think this update should be backported."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |2
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      options:
-        - label: "I assert that this backport does not yet exist in an [open pull request](https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+in%3Atitle+backport)."
-          required: true
-        - label: "I assert that this is not a [duplicate of any known issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+label%3A%229.needs%3A+port+to+stable%22+)."
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/08_documentation_request.yml

@@ -1,89 +0,0 @@
-name: "Request: documentation"
-description: "Report missing or incorrect documentation in the NixOS or Nixpkgs manuals."
-title: "Missing Documentation: PACKAGENAME"
-labels: ["0.kind: enhancement", "9.needs: documentation"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`Missing Documentation: PACKAGENAME`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)) or module name (As seen in the [NixOS Option Search](https://search.nixos.org/options)).
-
-        > [!TIP]
-        > For instance, if you were filing an issue against the [`hello`](https://search.nixos.org/packages?channel=unstable&from=0&size=1&buckets=%7B%22package_attr_set%22%3A%5B%22No%20package%20set%22%5D%2C%22package_license_set%22%3A%5B%22GNU%20General%20Public%20License%20v3.0%20or%20later%22%5D%2C%22package_maintainers_set%22%3A%5B%5D%2C%22package_platforms%22%3A%5B%5D%7D&sort=relevance&type=packages&query=hello) package about it not having any NixOS-specific documentation, your title would be as follows:
-        > ```
-        > Missing Documentation: hello
-        > ```
-
-        ---
-  - type: "textarea"
-    id: "description"
-    attributes:
-      label: "Describe the problem"
-      description: "Please include a clear and concise description of what the issue is."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "proposal"
-    attributes:
-      label: "Proposed solution"
-      description: |
-        If possible, please draft a tentative documentation chapter to resolve this issue.
-        Your proposal should be written in CommonMark Markdown, optionally enhanced with [Nix-specific extensions](https://github.com/NixOS/nixpkgs/tree/master/doc#syntax).
-      render: "markdown"
-    validations:
-      required: false
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |2
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      options:
-        - label: "I assert that this request is not already implemented in the latest [NixOS](https://nixos.org/manual/nixos/unstable/) or [Nixpkgs](https://nixos.org/manual/nixpkgs/unstable/) manuals."
-          required: true
-        - label: "I assert that this is not a [duplicate of an existing documentation issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+label%3A%229.needs%3A+documentation%22)."
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "priorisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/09_unreproducible_package.yml

@@ -1,159 +0,0 @@
-name: "Unreproducible Package"
-description: "Report a package that does not produce a bit-by-bit reproducible result each time it is built."
-title: "Unreproducible Package: PACKAGENAME"
-labels: ["0.kind: enhancement", "6.topic: reproducible builds"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`Unreproducible Package: PACKAGENAME`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)).
-
-        > [!NOTE]
-        > This form is for reporting unreproducible packages. For more information, see the [Reproducible Builds Status](https://reproducible.nixos.org/) page.
-        >
-        > To report a package that fails to build entirely, please use the "Build Failure" form instead.
-
-        ---
-  - type: "input"
-    id: "version"
-    attributes:
-      label: "Nixpkgs Revision"
-      description: "In which commit of Nixpkgs is this package displaying unreproducibility?"
-  - type: "textarea"
-    id: "introduction"
-    attributes:
-      label: "Introduction"
-      description: |
-        This is a generic introduction to build reproducibility.
-        Please replace **PACKAGENAME** below with the canonical package name of the package, as you have done for the title above.
-      value: |
-        Building **PACKAGENAME** multiple times does not yield bit-by-bit identical
-        results, complicating the detection of Continuous Integration (CI) breaches. For
-        more information on this issue, visit [reproducible-builds.org](https://reproducible-builds.org/).
-
-        Fixing bit-by-bit reproducibility also has additional advantages, such as
-        avoiding hard-to-reproduce bugs, making content-addressed storage more effective
-        and reducing rebuilds in such systems.
-    validations:
-      required: true
-  - type: "textarea"
-    id: "how-to-reproduce"
-    attributes:
-      label: "Steps to reproduce"
-      description: |
-        This is a step-by-step instruction set meant for maintainers to debug the package that is failing to reproduce. You should also follow it to gather the `diffoscope` logs that will be needed below.
-        Please replace **PACKAGENAME** below with the canonical package name of the package, as you have done for the introduction and the title above.
-      value: |
-        ### 1. Build the package
-
-        This step will build the package. Specific arguments are passed to the command
-        to keep the build artifacts so we can compare them in case of differences.
-
-        Execute the following command:
-
-        ```
-        nix-build '<nixpkgs>' -A PACKAGENAME && nix-build '<nixpkgs>' -A PACKAGENAME --check --keep-failed
-        ```
-
-        Or using the new command line style:
-
-        ```
-        nix build nixpkgs#PACKAGENAME && nix build nixpkgs#PACKAGENAME --rebuild --keep-failed
-        ```
-
-        ### 2. Compare the build artifacts
-
-        If the previous command completes successfully, no differences were found and
-        there's nothing to do, builds are reproducible.
-        If it terminates with the error message `error: derivation '<X>' may not be
-        deterministic: output '<Y>' differs from '<Z>'`, use `diffoscope` to investigate
-        the discrepancies between the two build outputs. You may need to add the
-        `--exclude-directory-metadata recursive` option to ignore files and directories
-        metadata (*e.g. timestamp*) differences.
-
-        ```
-        nix run nixpkgs#diffoscopeMinimal -- --exclude-directory-metadata recursive <Y> <Z>
-        ```
-
-        ### 3. Examine the build log
-
-        To examine the build log, use:
-
-        ```
-        nix-store --read-log $(nix-instantiate '<nixpkgs>' -A PACKAGENAME)
-        ```
-
-        Or with the new command line style:
-
-        ```
-        nix log $(nix path-info --derivation nixpkgs#PACKAGENAME)
-        ```
-    validations:
-      required: true
-  - type: "textarea"
-    id: "logs"
-    attributes:
-      label: "Diffoscope log"
-      description: |
-        Please copy and paste the relevant `diffoscope` log output, gathered from the steps above.
-        This will be automatically formatted into a monospaced text block, so no need for backticks.
-      render: "console"
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the problem here."
-    validations:
-      required: false
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |2
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      options:
-        - label: "I assert that this is not a [duplicate of any known issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%226.topic%3A+reproducible+builds%22)."
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,47 +1,20 @@
+###### Motivation for this change
 
-<!--
-^ Please summarise the changes you have done and explain why they are necessary here ^
 
-For package updates please link to a changelog or describe changes, this helps your fellow maintainers discover breaking updates.
-For new packages please briefly describe the package or provide a link to its homepage.
--->
-
-## Things done
+###### Things done
 
 <!-- Please check what applies. Note that these are not hard requirements but merely serve as information for reviewers. -->
 
-- Built on platform:
-  - [ ] x86_64-linux
-  - [ ] aarch64-linux
-  - [ ] x86_64-darwin
-  - [ ] aarch64-darwin
-- Tested, as applicable:
-  - [ ] [NixOS tests] in [nixos/tests].
-  - [ ] [Package tests] at `passthru.tests`.
-  - [ ] Tests in [lib/tests] or [pkgs/test] for functions and "core" functionality.
-- [ ] Ran `nixpkgs-review` on this PR. See [nixpkgs-review usage].
-- [ ] Tested basic functionality of all binary files, usually in `./result/bin/`.
-- Nixpkgs Release Notes
-  - [ ] Package update: when the change is major or breaking.
-- NixOS Release Notes
-  - [ ] Module addition: when adding a new NixOS module.
-  - [ ] Module update: when the change is significant.
-- [ ] Fits [CONTRIBUTING.md], [pkgs/README.md], [maintainers/README.md] and other READMEs.
-
-[NixOS tests]: https://nixos.org/manual/nixos/unstable/index.html#sec-nixos-tests
-[Package tests]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#package-tests
-[nixpkgs-review usage]: https://github.com/Mic92/nixpkgs-review#usage
-
-[CONTRIBUTING.md]: https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md
-[lib/tests]: https://github.com/NixOS/nixpkgs/blob/master/lib/tests
-[maintainers/README.md]: https://github.com/NixOS/nixpkgs/blob/master/maintainers/README.md
-[nixos/tests]: https://github.com/NixOS/nixpkgs/blob/master/nixos/tests
-[pkgs/README.md]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md
-[pkgs/test]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/test
+- [ ] Tested using sandboxing ([nix.useSandbox](http://nixos.org/nixos/manual/options.html#opt-nix.useSandbox) on NixOS, or option `sandbox` in [`nix.conf`](http://nixos.org/nix/manual/#sec-conf-file) on non-NixOS)
+- Built on platform(s)
+   - [ ] NixOS
+   - [ ] macOS
+   - [ ] other Linux distributions
+- [ ] Tested via one or more NixOS test(s) if existing and applicable for the change (look inside [nixos/tests](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests))
+- [ ] Tested compilation of all pkgs that depend on this change using `nix-shell -p nox --run "nox-review wip"`
+- [ ] Tested execution of all binary files (usually in `./result/bin/`)
+- [ ] Determined the impact on package closure size (by running `nix path-info -S` before and after)
+- [ ] Fits [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/.github/CONTRIBUTING.md).
 
 ---
 
-Add a :+1: [reaction] to [pull requests you find important].
-
-[reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-[pull requests you find important]: https://github.com/NixOS/nixpkgs/pulls?q=is%3Aopen+sort%3Areactions-%2B1-desc

.github/STALE-BOT.md

@@ -1,36 +0,0 @@
-# Stale bot information
-
-- Thanks for your contribution!
-- Our stale bot will never close an issue or PR.
-- To remove the stale label, just leave a new comment.
-- _How to find the right people to ping?_ → [`git blame`](https://git-scm.com/docs/git-blame) to the rescue! (or GitHub's history and blame buttons.)
-- You can always ask for help on [our Discourse Forum](https://discourse.nixos.org/), [our Matrix room](https://matrix.to/#/#nix:nixos.org), or on the [#nixos IRC channel](https://web.libera.chat/#nixos).
-
-## Suggestions for PRs
-
-1. GitHub sometimes doesn't notify people who commented / reviewed a PR previously, when you (force) push commits. If you have addressed the reviews you can [officially ask for a review](https://docs.github.com/en/free-pro-team@latest/github/collaborating-with-issues-and-pull-requests/requesting-a-pull-request-review) from those who commented to you or anyone else.
-2. If it is unfinished but you plan to finish it, please mark it as a draft.
-3. If you don't expect to work on it any time soon, closing it with a short comment may encourage someone else to pick up your work.
-4. To get things rolling again, rebase the PR against the target branch and address valid comments.
-5. If you need a review to move forward, ask in [the Discourse thread for PRs that need help](https://discourse.nixos.org/t/prs-in-distress/3604).
-6. If all you need is a merge, check the git history to find and [request reviews](https://docs.github.com/en/github/collaborating-with-issues-and-pull-requests/requesting-a-pull-request-review) from people who usually merge related contributions.
-
-## Suggestions for issues
-
-1. If it is resolved (either for you personally, or in general), please consider closing it.
-2. If this might still be an issue, but you are not interested in promoting its resolution, please consider closing it while encouraging others to take over and reopen an issue if they care enough.
-3. If you still have interest in resolving it, try to ping somebody who you believe might have an interest in the topic. Consider discussing the problem in [our Discourse Forum](https://discourse.nixos.org/).
-4. As with all open source projects, your best option is to submit a Pull Request that addresses this issue. We :heart: this attitude!
-
-**Memorandum on closing issues**
-
-Don't be afraid to close an issue that holds valuable information. Closed issues stay in the system for people to search, read, cross-reference, or even reopen--nothing is lost! Closing obsolete issues is an important way to help maintainers focus their time and effort.
-
-## Useful GitHub search queries
-
-- [Open PRs with any stale-bot interaction](https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+is%3Aopen+commenter%3Aapp%2Fstale+)
-- [Open PRs with any stale-bot interaction and `2.status: stale`](https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+is%3Aopen+commenter%3Aapp%2Fstale+label%3A%222.status%3A+stale%22)
-- [Open PRs with any stale-bot interaction and NOT `2.status: stale`](https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+is%3Aopen+commenter%3Aapp%2Fstale+-label%3A%222.status%3A+stale%22+)
-- [Open Issues with any stale-bot interaction](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+commenter%3Aapp%2Fstale+)
-- [Open Issues with any stale-bot interaction and `2.status: stale`](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+commenter%3Aapp%2Fstale+label%3A%222.status%3A+stale%22+)
-- [Open Issues with any stale-bot interaction and NOT `2.status: stale`](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+commenter%3Aapp%2Fstale+-label%3A%222.status%3A+stale%22+)

.github/actions/get-merge-commit/action.yml

@@ -1,95 +0,0 @@
-name: Get merge commit
-
-description: 'Checks whether the Pull Request is mergeable and checks out the repo at up to two commits: The result of a temporary merge of the head branch into the target branch ("merged"), and the parent of that commit on the target branch ("target"). Handles push events and merge conflicts gracefully.'
-
-inputs:
-  mergedSha:
-    description: "The merge commit SHA, previously collected."
-    type: string
-  merged-as-untrusted:
-    description: "Whether to checkout the merge commit in the ./untrusted folder."
-    type: boolean
-  targetSha:
-    description: "The target commit SHA, previously collected."
-    type: string
-  target-as-trusted:
-    description: "Whether to checkout the target commit in the ./trusted folder."
-    type: boolean
-
-outputs:
-  mergedSha:
-    description: "The merge commit SHA"
-    value: ${{ steps.commits.outputs.mergedSha }}
-  targetSha:
-    description: "The target commit SHA"
-    value: ${{ steps.commits.outputs.targetSha }}
-
-runs:
-  using: composite
-  steps:
-    - id: commits
-      if: ${{ !inputs.mergedSha && !inputs.targetSha }}
-      uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-      with:
-        script: |
-          if (context.eventName == 'push') return core.setOutput('mergedSha', context.sha)
-
-          for (const retryInterval of [5, 10, 20, 40, 80]) {
-            console.log("Checking whether the pull request can be merged...")
-            const prInfo = (await github.rest.pulls.get({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: context.payload.pull_request.number
-            })).data
-
-            if (prInfo.state != 'open') throw new Error ("PR is not open anymore.")
-
-            if (prInfo.mergeable == null) {
-              console.log(`GitHub is still computing whether this PR can be merged, waiting ${retryInterval} seconds before trying again...`)
-              await new Promise(resolve => setTimeout(resolve, retryInterval * 1000))
-              continue
-            }
-
-            let mergedSha, targetSha
-
-            if (prInfo.mergeable) {
-              console.log("The PR can be merged.")
-
-              mergedSha = prInfo.merge_commit_sha
-              targetSha = (await github.rest.repos.getCommit({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                ref: prInfo.merge_commit_sha
-              })).data.parents[0].sha
-            } else {
-              console.log("The PR has a merge conflict.")
-
-              mergedSha = prInfo.head.sha
-              targetSha = (await github.rest.repos.compareCommitsWithBasehead({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                basehead: `${prInfo.base.sha}...${prInfo.head.sha}`
-              })).data.merge_base_commit.sha
-            }
-
-            console.log(`Checking the commits:\nmerged:${mergedSha}\ntarget:${targetSha}`)
-            core.setOutput('mergedSha', mergedSha)
-            core.setOutput('targetSha', targetSha)
-            return
-          }
-          throw new Error("Not retrying anymore. It's likely that GitHub is having internal issues: check https://www.githubstatus.com.")
-
-    - if: inputs.merged-as-untrusted && (inputs.mergedSha || steps.commits.outputs.mergedSha)
-      # Would be great to do the checkouts in git worktrees of the existing spare checkout instead,
-      # but Nix is broken with them:
-      # https://github.com/NixOS/nix/issues/6073
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      with:
-        ref: ${{ inputs.mergedSha || steps.commits.outputs.mergedSha }}
-        path: untrusted
-
-    - if: inputs.target-as-trusted && (inputs.targetSha || steps.commits.outputs.targetSha)
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      with:
-        ref: ${{ inputs.targetSha || steps.commits.outputs.targetSha }}
-        path: trusted

.github/dependabot.yml

@@ -1,7 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    labels: []

.github/labeler-development-branches.yml

@@ -1,23 +0,0 @@
-# This file is used by .github/workflows/labels.yml
-# This version is only run for Pull Requests from development branches like staging-next, haskell-updates or python-updates.
-
-"4.workflow: package set update":
-  - any:
-      - head-branch:
-          - '-updates$'
-
-"4.workflow: staging":
-  - any:
-      - head-branch:
-          - '^staging-next$'
-          - '^staging-next-'
-
-"6.topic: haskell":
-  - any:
-      - head-branch:
-          - '^haskell-updates$'
-
-"6.topic: python":
-  - any:
-      - head-branch:
-          - '^python-updates$'

.github/labeler-no-sync.yml

@@ -1,32 +0,0 @@
-# This file is used by .github/workflows/labels.yml
-# This version uses `sync-labels: false`, meaning that a non-match will NOT remove the label
-
-# keep-sorted start case=no numeric=yes newline_separated=yes skip_lines=1
-
-"6.topic: policy discussion":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - .github/**/*
-              - CONTRIBUTING.md
-              - pkgs/README.md
-              - nixos/README.md
-              - maintainers/README.md
-              - lib/README.md
-              - doc/README.md
-
-"8.has: documentation":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/**/*
-              - nixos/doc/**/*
-
-"backport release-25.05":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - .github/workflows/*
-              - ci/**/*.*
-
-# keep-sorted end

.github/labeler.yml

@@ -1,604 +0,0 @@
-# This file is used by .github/workflows/labels.yml
-# This version uses `sync-labels: true`, meaning that a non-match will remove the label
-
-# keep-sorted start case=no numeric=yes newline_separated=yes skip_lines=1
-
-"4.workflow: backport":
-  - any:
-      - base-branch:
-          - '^release-'
-          - '^staging-\d'
-          - '^staging-next-\d'
-
-# NOTE: bsd, darwin and cross-compilation labels are handled by ofborg
-"6.topic: agda":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/agda.section.md
-              - nixos/tests/agda.nix
-              - pkgs/build-support/agda/**/*
-              - pkgs/development/libraries/agda/**/*
-              - pkgs/top-level/agda-packages.nix
-
-"6.topic: cinnamon":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/x11/desktop-managers/cinnamon.nix
-              - nixos/tests/cinnamon.nix
-              - nixos/tests/cinnamon-wayland.nix
-              - pkgs/by-name/ci/cinnamon-*/**/*
-              - pkgs/by-name/cj/cjs/**/*
-              - pkgs/by-name/mu/muffin/**/*
-              - pkgs/by-name/ne/nemo/**/*
-              - pkgs/by-name/ne/nemo-*/**/*
-
-"6.topic: continuous integration":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - .github/**/*
-              - ci/**/*.*
-
-"6.topic: coq":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/applications/science/logic/coq/**/*
-              - pkgs/development/coq-modules/**/*
-              - pkgs/top-level/coq-packages.nix
-
-"6.topic: COSMIC":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/desktop-managers/cosmic.nix
-              - nixos/modules/services/display-managers/cosmic-greeter.nix
-              - nixos/tests/cosmic.nix
-              - pkgs/by-name/co/cosmic-*/**/*
-              - pkgs/by-name/xd/xdg-desktop-portal-cosmic/*
-
-"6.topic: crystal":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/development/compilers/crystal/**/*
-
-"6.topic: cuda":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/development/cuda-modules/**/*
-              - pkgs/top-level/cuda-packages.nix
-
-"6.topic: deepin":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/desktops/deepin/**/*
-              - pkgs/desktops/deepin/**/*
-
-"6.topic: docker tools":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/applications/virtualization/docker/**/*
-
-"6.topic: dotnet":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/dotnet.section.md
-              - maintainers/scripts/update-dotnet-lockfiles.nix
-              - pkgs/build-support/dotnet/**/*
-              - pkgs/development/compilers/dotnet/**/*
-              - pkgs/test/dotnet/**/*
-              - pkgs/top-level/dotnet-packages.nix
-
-"6.topic: emacs":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/editors/emacs.nix
-              - nixos/modules/services/editors/emacs.xml
-              - nixos/tests/emacs-daemon.nix
-              - pkgs/applications/editors/emacs/build-support/**/*
-              - pkgs/applications/editors/emacs/elisp-packages/**/*
-              - pkgs/applications/editors/emacs/**/*
-              - pkgs/top-level/emacs-packages.nix
-
-"6.topic: Enlightenment DE":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/x11/desktop-managers/enlightenment.nix
-              - pkgs/desktops/enlightenment/**/*
-              - pkgs/development/python-modules/python-efl/*
-
-"6.topic: erlang":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/beam.section.md
-              - pkgs/development/beam-modules/**/*
-              - pkgs/development/interpreters/elixir/**/*
-              - pkgs/development/interpreters/erlang/**/*
-              - pkgs/development/tools/build-managers/rebar/**/*
-              - pkgs/development/tools/build-managers/rebar3/**/*
-              - pkgs/development/tools/erlang/**/*
-              - pkgs/top-level/beam-packages.nix
-
-"6.topic: fetch":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/build-support/fetch*/**/*
-
-"6.topic: flakes":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - '**/flake.nix'
-              - lib/systems/flake-systems.nix
-              - nixos/modules/config/nix-flakes.nix
-
-"6.topic: flutter":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/build-support/flutter/*.nix
-              - pkgs/development/compilers/flutter/**/*.nix
-
-"6.topic: games":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/games/**/*
-
-"6.topic: GNOME":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/gnome.section.md
-              - nixos/modules/services/desktops/gnome/**/*
-              - nixos/modules/services/desktop-managers/gnome.nix
-              - nixos/tests/gnome-xorg.nix
-              - nixos/tests/gnome.nix
-              - pkgs/desktops/gnome/**/*
-
-"6.topic: golang":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/go.section.md
-              - pkgs/build-support/go/**/*
-              - pkgs/development/compilers/go/**/*
-
-"6.topic: hardware":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/hardware/**/*
-
-"6.topic: haskell":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/haskell.section.md
-              - maintainers/scripts/haskell/**/*
-              - pkgs/development/compilers/ghc/**/*
-              - pkgs/development/haskell-modules/**/*
-              - pkgs/development/tools/haskell/**/*
-              - pkgs/test/haskell/**/*
-              - pkgs/top-level/haskell-packages.nix
-              - pkgs/top-level/release-haskell.nix
-
-"6.topic: java":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              # Distributions
-              - pkgs/development/compilers/adoptopenjdk-icedtea-web/**/*
-              - pkgs/development/compilers/corretto/**/*
-              - pkgs/development/compilers/graalvm/**/*
-              - pkgs/development/compilers/openjdk/**/*
-              - pkgs/by-name/op/openjfx/**/*
-              - pkgs/development/compilers/semeru-bin/**/*
-              - pkgs/development/compilers/temurin-bin/**/*
-              - pkgs/development/compilers/zulu/**/*
-              # Documentation
-              - doc/languages-frameworks/java.section.md
-              # Gradle
-              - doc/languages-frameworks/gradle.section.md
-              - pkgs/development/tools/build-managers/gradle/**/*
-              - pkgs/by-name/gr/gradle-completion/**/*
-              # Maven
-              - pkgs/by-name/ma/maven/**/*
-              - doc/languages-frameworks/maven.section.md
-              # Ant
-              - pkgs/by-name/an/ant/**/*
-              # javaPackages attrset
-              - pkgs/development/java-modules/**/*
-              - pkgs/top-level/java-packages.nix
-              # Maintainer tooling
-              - pkgs/by-name/ni/nixpkgs-openjdk-updater/**/*
-              # Misc
-              - nixos/modules/programs/java.nix
-
-"6.topic: jitsi":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/networking/jitsi-videobridge.nix
-              - nixos/modules/services/web-apps/jitsi-meet.nix
-              - pkgs/servers/web-apps/jitsi-meet/**/*
-              - pkgs/servers/jitsi-videobridge/**/*
-              - pkgs/applications/networking/instant-messengers/jitsi/**/*
-
-"6.topic: julia":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/julia.section.md
-              - pkgs/development/compilers/julia/**/*
-              - pkgs/development/julia-modules/**/*
-
-"6.topic: jupyter":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/development/python-modules/jupyter*/**/*
-              - pkgs/development/python-modules/mkdocs-jupyter/*
-              - nixos/modules/services/development/jupyter/**/*
-              - pkgs/applications/editors/jupyter-kernels/**/*
-              - pkgs/applications/editors/jupyter/**/*
-
-"6.topic: k3s":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/cluster/k3s/**/*
-              - nixos/tests/k3s/**/*
-              - pkgs/applications/networking/cluster/k3s/**/*
-
-"6.topic: kernel":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/build-support/kernel/**/*
-              - pkgs/os-specific/linux/kernel/**/*
-
-"6.topic: lib":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - lib/**
-
-"6.topic: llvm/clang":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/development/compilers/llvm/**/*
-
-"6.topic: lua":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/development/tools/misc/luarocks/*
-              - pkgs/development/interpreters/lua-5/**/*
-              - pkgs/development/interpreters/luajit/**/*
-              - pkgs/development/lua-modules/**/*
-              - pkgs/top-level/lua-packages.nix
-
-"6.topic: Lumina DE":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/x11/desktop-managers/lumina.nix
-              - pkgs/desktops/lumina/**/*
-
-"6.topic: LXQt":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/x11/desktop-managers/lxqt.nix
-              - pkgs/desktops/lxqt/**/*
-
-"6.topic: mate":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/x11/desktop-managers/mate.nix
-              - nixos/tests/mate.nix
-              - pkgs/desktops/mate/**/*
-
-"6.topic: module system":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - lib/modules.nix
-              - lib/types.nix
-              - lib/options.nix
-              - lib/tests/modules.sh
-              - lib/tests/modules/**
-
-"6.topic: musl":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/os-specific/linux/musl/**/*
-
-"6.topic: nim":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/nim.section.md
-              - pkgs/build-support/build-nim-package.nix
-              - pkgs/build-support/build-nim-sbom.nix
-              - pkgs/by-name/ni/nim*
-              - pkgs/top-level/nim-overrides.nix
-
-"6.topic: nixos":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/**/*
-              - pkgs/by-name/sw/switch-to-configuration-ng/**/*
-              - pkgs/by-name/ni/nixos-rebuild-ng/**/*
-              - pkgs/os-specific/linux/nixos-rebuild/**/*
-
-"6.topic: nixos-container":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/virtualisation/nixos-containers.nix
-              - pkgs/tools/virtualization/nixos-container/**/*
-
-"6.topic: nodejs":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/javascript.section.md
-              - pkgs/build-support/node/**/*
-              - pkgs/development/node-packages/**/*
-              - pkgs/development/tools/yarn/*
-              - pkgs/development/tools/yarn2nix-moretea/**/*
-              - pkgs/development/tools/pnpm/**/*
-              - pkgs/development/web/nodejs/*
-
-"6.topic: nvidia":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/hardware/video/nvidia.nix
-              - nixos/modules/services/hardware/nvidia-container-toolkit/**/*
-              - nixos/modules/services/hardware/nvidia-optimus.nix
-              - pkgs/os-specific/linux/nvidia-x11/**/*
-
-"6.topic: ocaml":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/ocaml.section.md
-              - pkgs/development/compilers/ocaml/**/*
-              - pkgs/development/compilers/reason/**/*
-              - pkgs/development/ocaml-modules/**/*
-              - pkgs/development/tools/ocaml/**/*
-              - pkgs/top-level/ocaml-packages.nix
-
-"6.topic: pantheon":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/desktops/pantheon/**/*
-              - nixos/modules/services/x11/desktop-managers/pantheon.nix
-              - nixos/modules/services/x11/display-managers/lightdm-greeters/pantheon.nix
-              - nixos/tests/pantheon.nix
-              - pkgs/desktops/pantheon/**/*
-
-"6.topic: php":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/php.section.md
-              - nixos/tests/php/**/*
-              - pkgs/build-support/php/**/*
-              - pkgs/development/interpreters/php/**/*
-              - pkgs/development/php-packages/**/*
-              - pkgs/test/php/default.nix
-              - pkgs/top-level/php-packages.nix
-
-"6.topic: printing":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/printing/cupsd.nix
-              - pkgs/misc/cups/**/*
-
-"6.topic: python":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/python.section.md
-              - pkgs/development/interpreters/python/**/*
-              - pkgs/development/python-modules/**/*
-              - pkgs/top-level/python-packages.nix
-
-"6.topic: qt/kde":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/qt.section.md
-              - nixos/modules/services/x11/desktop-managers/plasma5.nix
-              - nixos/tests/plasma5.nix
-              - pkgs/applications/kde/**/*
-              - pkgs/desktops/plasma-5/**/*
-              - pkgs/development/libraries/kde-frameworks/**/*
-              - pkgs/development/libraries/qt-5/**/*
-
-"6.topic: R":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/applications/science/math/R/**/*
-              - pkgs/development/r-modules/**/*
-
-"6.topic: rocm":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/development/rocm-modules/**/*
-
-"6.topic: ruby":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/ruby.section.md
-              - pkgs/development/interpreters/ruby/**/*
-              - pkgs/development/ruby-modules/**/*
-              - pkgs/top-level/ruby-packages.nix
-
-"6.topic: rust":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/rust.section.md
-              - pkgs/build-support/rust/**/*
-              - pkgs/development/compilers/rust/**/*
-
-"6.topic: stdenv":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/stdenv/**/*
-
-"6.topic: steam":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/games/steam/**/*
-
-"6.topic: systemd":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/os-specific/linux/systemd/**/*
-              - nixos/modules/system/boot/systemd*/**/*
-
-"6.topic: tcl":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/tcl.section.md
-              - pkgs/development/interpreters/tcl/*
-              - pkgs/development/tcl-modules/**/*
-              - pkgs/top-level/tcl-packages.nix
-
-"6.topic: teams":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - maintainers/team-list.nix
-
-"6.topic: testing":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              # NOTE: Let's keep the scope limited to test frameworks that are
-              #       *developed in this repo*;
-              #       - not individual tests
-              #       - not packages for test frameworks
-              - pkgs/build-support/testers/**
-              - nixos/lib/testing/**
-              - nixos/lib/test-driver/**
-              - nixos/tests/nixos-test-driver/**
-              - nixos/lib/testing-python.nix # legacy
-              - nixos/tests/make-test-python.nix # legacy
-              # lib/debug.nix has a test framework (runTests) but it's not the main focus
-
-"6.topic: TeX":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/texlive.section.md
-              - pkgs/test/texlive/**
-              - pkgs/tools/typesetting/tex/**/*
-
-"6.topic: updaters":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/common-updater/**/*
-
-"6.topic: vim":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/vim.section.md
-              - pkgs/applications/editors/vim/**/*
-              - pkgs/applications/editors/vim/plugins/**/*
-              - nixos/modules/programs/neovim.nix
-              - pkgs/applications/editors/neovim/**/*
-
-"6.topic: vscode":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/applications/editors/vscode/**/*
-
-"6.topic: windows":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/os-specific/windows/**/*
-
-"6.topic: xen-project":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/virtualisation/xen*
-              - pkgs/by-name/xe/xen/*
-              - pkgs/by-name/qe/qemu_xen/*
-              - pkgs/by-name/xe/xen-guest-agent/*
-              - pkgs/by-name/xt/xtf/*
-              - pkgs/build-support/xen/*
-              - pkgs/development/ocaml-modules/xen*/*
-              - pkgs/development/ocaml-modules/vchan/*
-
-"6.topic: xfce":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/doc/manual/configuration/xfce.xml
-              - nixos/modules/services/x11/desktop-managers/xfce.nix
-              - nixos/tests/xfce.nix
-              - pkgs/desktops/xfce/**/*
-
-"6.topic: zig":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/development/compilers/zig/**/*
-              - doc/hooks/zig.section.md
-
-"8.has: changelog":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/release-notes/**/*
-              - nixos/doc/manual/release-notes/**/*
-
-"8.has: maintainer-list (update)":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - maintainers/maintainer-list.nix
-
-"8.has: module (update)":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/**/*
-
-# keep-sorted end

.github/workflows/README.md

@@ -1,63 +0,0 @@
-# GitHub Actions Workflows
-
-Some architectural notes about key decisions and concepts in our workflows:
-
-- Instead of `pull_request` we use [`pull_request_target`](https://docs.github.com/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request_target) for all PR-related workflows.
-  This has the advantage that those workflows will run without prior approval for external contributors.
-
-- Running on `pull_request_target` also optionally provides us with a GH_TOKEN with elevated privileges (write access), which we need to do things like adding labels, requesting reviewers or pushing branches.
-  **Note about security:** We need to be careful to limit the scope of elevated privileges as much as possible.
-  Thus they should be lowered to the minimum with `permissions: {}` in every workflow by default.
-
-- By definition `pull_request_target` runs in the context of the **base** of the pull request.
-  This means, that the workflow files to run will be taken from the base branch, not the PR, and actions/checkout will not checkout the PR, but the base branch, by default.
-  To protect our secrets, we need to make sure to **never execute code** from the pull request and always evaluate or build nix code from the pull request with the **sandbox enabled**.
-
-- To test the pull request's contents, we checkout the "test merge commit".
-  This is a temporary commit that GitHub creates automatically as "what would happen, if this PR was merged into the base branch now?".
-  The checkout could be done via the virtual branch `refs/pull/<pr-number>/merge`, but doing so would cause failures when this virtual branch doesn't exist (anymore).
-  This can happen when the PR has conflicts, in which case the virtual branch is not created, or when the PR is getting merged while workflows are still running, in which case the branch won't exist anymore at the time of checkout.
-  Thus, we use the `get-merge-commit.yml` workflow to check whether the PR is mergeable and the test merge commit exists and only then run the relevant jobs.
-
-- Various workflows need to make comparisons against the base branch.
-  In this case, we checkout the parent of the "test merge commit" for best results.
-  Note, that this is not necessarily the same as the default commit that actions/checkout would use, which is also a commit from the base branch (see above), but might be older.
-
-## Terminology
-
-- **base commit**: The pull_request_target event's context commit, i.e. the base commit given by GitHub Actions.
-  Same as `github.event.pull_request.base.sha`.
-- **head commit**: The HEAD commit in the pull request's branch.
-  Same as `github.event.pull_request.head.sha`.
-- **merge commit**: The temporary "test merge commit" that GitHub Actions creates and updates for the pull request.
-  Same as `refs/pull/${{ github.event.pull_request.number }}/merge`.
-- **target commit**: The base branch's parent of the "test merge commit" to compare against.
-
-## Concurrency Groups
-
-We use [GitHub's Concurrency Groups](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/control-the-concurrency-of-workflows-and-jobs) to cancel older jobs on pushes to Pull Requests.
-When two workflows are in the same group, a newer workflow cancels an older workflow.
-Thus, it is important how to construct the group keys:
-
-- Because we want to run jobs for different events at same time, we add `github.event_name` to the key.
-  This is the case for the `pull_request` which runs on changes to the workflow files to test the new files and the same workflow from the base branch run via `pull_request_event`.
-
-- We don't want workflows of different Pull Requests to cancel each other, so we include `github.event.pull_request.number`.
-  The [GitHub docs](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/control-the-concurrency-of-workflows-and-jobs#example-using-a-fallback-value) show using `github.head_ref` for this purpose, but this doesn't work well with forks: Different users could have the same head branch name in their forks and run CI for their PRs at the same time.
-
-- Sometimes, there is no `pull_request.number`.
-  To ensure non-PR runs are never cancelled, we add a fallback of `github.run_id`.
-  This is a unique value for each workflow run.
-
-- Of course, we run multiple workflows at the same time, so we add `github.workflow` to the key.
-  Otherwise workflows would cancel each other.
-
-- There is a special case for reusable workflows called via `workflow_call` - they will have `github.workflow` set to their parent workflow's name.
-  Thus, they would cancel each other.
-  That's why we additionally hardcode the name of the workflow as well.
-
-This results in a key with the following semantics:
-
-```
-<running-workflow>-<triggering-workflow>-<triggered-event>-<pull-request/fallback>
-```

.github/workflows/backport.yml

@@ -1,76 +0,0 @@
-# WARNING:
-# When extending this action, be aware that $GITHUB_TOKEN allows write access to
-# the GitHub repository. This means that it should not evaluate user input in a
-# way that allows code injection.
-
-name: Backport
-
-on:
-  pull_request_target:
-    types: [closed, labeled]
-
-permissions:
-  contents: read
-  issues: write
-  pull-requests: write
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  backport:
-    name: Backport Pull Request
-    if: vars.NIXPKGS_CI_APP_ID && github.event.pull_request.merged == true && (github.event.action != 'labeled' || startsWith(github.event.label.name, 'backport'))
-    runs-on: ubuntu-24.04-arm
-    steps:
-      # Use a GitHub App to create the PR so that CI gets triggered
-      # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        id: app-token
-        with:
-          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
-          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-          permission-contents: write
-          permission-pull-requests: write
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          token: ${{ steps.app-token.outputs.token }}
-
-      - name: Log current API rate limits
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: gh api /rate_limit | jq
-
-      - name: Create backport PRs
-        id: backport
-        uses: korthout/backport-action@0193454f0c5947491d348f33a275c119f30eb736 # v3.2.1
-        with:
-          # Config README: https://github.com/korthout/backport-action#backport-action
-          copy_labels_pattern: 'severity:\ssecurity'
-          github_token: ${{ steps.app-token.outputs.token }}
-          pull_description: |-
-            Bot-based backport to `${target_branch}`, triggered by a label in #${pull_number}.
-
-            * [ ] Before merging, ensure that this backport is [acceptable for the release](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#changes-acceptable-for-releases).
-              * Even as a non-committer, if you find that it is not acceptable, leave a comment.
-
-      - name: Log current API rate limits
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: gh api /rate_limit | jq
-
-      - name: "Add 'has: port to stable' label"
-        if: steps.backport.outputs.created_pull_numbers != ''
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        with:
-          # Not using the app on purpose to avoid triggering another workflow run after adding this label.
-          script: |
-            await github.rest.issues.addLabels({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.payload.pull_request.number,
-              labels: [ '8.has: port to stable' ]
-            })

.github/workflows/build.yml

@@ -1,100 +0,0 @@
-name: Build
-
-on:
-  workflow_call:
-    inputs:
-      baseBranch:
-        required: true
-        type: string
-      mergedSha:
-        required: true
-        type: string
-    secrets:
-      CACHIX_AUTH_TOKEN:
-        required: true
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  build:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: ubuntu-24.04
-            system: x86_64-linux
-            builds: [shell, manual-nixos, lib-tests, tarball]
-            desc: shell, docs, lib, tarball
-          - runner: ubuntu-24.04-arm
-            system: aarch64-linux
-            builds: [shell, manual-nixos, manual-nixpkgs, manual-nixpkgs-tests]
-            desc: shell, docs
-          - runner: macos-13
-            system: x86_64-darwin
-            builds: [shell]
-            desc: shell
-          - runner: macos-14
-            system: aarch64-darwin
-            builds: [shell]
-            desc: shell
-    name: '${{ matrix.system }}: ${{ matrix.desc }}'
-    runs-on: ${{ matrix.runner }}
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and checkout the merge commit
-        uses: ./.github/actions/get-merge-commit
-        with:
-          mergedSha: ${{ inputs.mergedSha }}
-          merged-as-untrusted: true
-
-      - uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31
-        with:
-          extra_nix_config: sandbox = true
-
-      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
-        with:
-          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
-          name: nixpkgs-ci
-          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
-
-      - name: Build shell
-        if: contains(matrix.builds, 'shell')
-        run: nix-build untrusted/ci -A shell
-
-      - name: Build NixOS manual
-        if: |
-          contains(matrix.builds, 'manual-nixos') && !cancelled() &&
-          contains(fromJSON(inputs.baseBranch).type, 'primary')
-        run: nix-build untrusted/ci -A manual-nixos --argstr system ${{ matrix.system }} --out-link nixos-manual
-
-      - name: Build Nixpkgs manual
-        if: contains(matrix.builds, 'manual-nixpkgs') && !cancelled()
-        run: nix-build untrusted/ci -A manual-nixpkgs -A manual-nixpkgs-tests
-
-      - name: Build Nixpkgs manual tests
-        if: contains(matrix.builds, 'manual-nixpkgs-tests') && !cancelled()
-        run: nix-build untrusted/ci -A manual-nixpkgs-tests
-
-      - name: Build lib tests
-        if: contains(matrix.builds, 'lib-tests') && !cancelled()
-        run: nix-build untrusted/ci -A lib-tests
-
-      - name: Build tarball
-        if: contains(matrix.builds, 'tarball') && !cancelled()
-        run: nix-build untrusted/ci -A tarball
-
-      - name: Upload NixOS manual
-        if: |
-          contains(matrix.builds, 'manual-nixos') && !cancelled() &&
-          contains(fromJSON(inputs.baseBranch).type, 'primary')
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: nixos-manual-${{ matrix.system }}
-          path: nixos-manual
-          if-no-files-found: error

.github/workflows/check.yml

@@ -1,71 +0,0 @@
-name: Check
-
-on:
-  workflow_call:
-    inputs:
-      baseBranch:
-        required: true
-        type: string
-      headBranch:
-        required: true
-        type: string
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  no-channel-base:
-    name: no channel base
-    if: contains(fromJSON(inputs.baseBranch).type, 'channel')
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - run: |
-          cat <<EOF
-          The nixos-* and nixpkgs-* branches are pushed to by the channel
-          release script and should not be merged into directly.
-
-          Please target the equivalent release-* branch or master instead.
-          EOF
-          exit 1
-
-  cherry-pick:
-    if: |
-      github.event_name == 'pull_request' ||
-      (fromJSON(inputs.baseBranch).stable && !contains(fromJSON(inputs.headBranch).type, 'development'))
-    permissions:
-      pull-requests: write
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-          filter: tree:0
-          path: trusted
-
-      - name: Install dependencies
-        run: npm install bottleneck
-
-      - name: Log current API rate limits
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: gh api /rate_limit | jq
-
-      - name: Check cherry-picks
-        id: check
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        with:
-          script: |
-            require('./trusted/ci/github-script/commits.js')({
-              github,
-              context,
-              core,
-              dry: context.eventName == 'pull_request',
-            })
-
-      - name: Log current API rate limits
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: gh api /rate_limit | jq

.github/workflows/codeowners-v2.yml

@@ -1,147 +0,0 @@
-# This workflow depends on two GitHub Apps with the following permissions:
-# - For checking code owners:
-#   - Permissions:
-#     - Repository > Administration: read-only
-#     - Organization > Members: read-only
-#   - Install App on this repository, setting these variables:
-#     - OWNER_RO_APP_ID (variable)
-#     - OWNER_RO_APP_PRIVATE_KEY (secret)
-# - For requesting code owners:
-#   - Permissions:
-#     - Repository > Administration: read-only
-#     - Organization > Members: read-only
-#     - Repository > Pull Requests: read-write
-#   - Install App on this repository, setting these variables:
-#     - OWNER_APP_ID (variable)
-#     - OWNER_APP_PRIVATE_KEY (secret)
-#
-# This split is done because checking code owners requires handling untrusted PR input,
-# while requesting code owners requires PR write access, and those shouldn't be mixed.
-#
-# Note that the latter is also used for ./eval.yml requesting reviewers.
-
-name: Codeowners v2
-
-on:
-  pull_request:
-    paths:
-      - .github/workflows/codeowners-v2.yml
-  pull_request_target:
-    types: [opened, ready_for_review, synchronize, reopened]
-
-concurrency:
-  group: codeowners-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-env:
-  OWNERS_FILE: ci/OWNERS
-  # Don't do anything on draft PRs
-  DRY_MODE: ${{ github.event.pull_request.draft && '1' || '' }}
-
-jobs:
-  # Check that code owners is valid
-  check:
-    name: Check
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and checkout the merge and target commits
-        uses: ./.github/actions/get-merge-commit
-        with:
-          merged-as-untrusted: true
-          target-as-trusted: true
-
-      - uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31
-
-      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
-        with:
-          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
-          name: nixpkgs-ci
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-
-      - name: Build codeowners validator
-        run: nix-build trusted/ci -A codeownersValidator
-
-      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        if: github.event_name == 'pull_request_target' && vars.OWNER_RO_APP_ID
-        id: app-token
-        with:
-          app-id: ${{ vars.OWNER_RO_APP_ID }}
-          private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}
-          permission-administration: read
-          permission-members: read
-
-      - name: Log current API rate limits
-        if: steps.app-token.outputs.token
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: gh api /rate_limit | jq
-
-      - name: Validate codeowners
-        if: steps.app-token.outputs.token
-        env:
-          OWNERS_FILE: untrusted/${{ env.OWNERS_FILE }}
-          GITHUB_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}
-          REPOSITORY_PATH: untrusted
-          OWNER_CHECKER_REPOSITORY: ${{ github.repository }}
-          # Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody
-          EXPERIMENTAL_CHECKS: "avoid-shadowing"
-        run: result/bin/codeowners-validator
-
-      - name: Log current API rate limits
-        if: steps.app-token.outputs.token
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: gh api /rate_limit | jq
-
-  # Request reviews from code owners
-  request:
-    name: Request
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31
-
-      # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head.
-      # This is intentional, because we need to request the review of owners as declared in the base branch.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          path: trusted
-
-      - name: Build review request package
-        run: nix-build trusted/ci -A requestReviews
-
-      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        if: github.event_name == 'pull_request_target' && vars.OWNER_APP_ID
-        id: app-token
-        with:
-          app-id: ${{ vars.OWNER_APP_ID }}
-          private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
-          permission-administration: read
-          permission-members: read
-          permission-pull-requests: write
-
-      - name: Log current API rate limits
-        if: steps.app-token.outputs.token
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: gh api /rate_limit | jq
-
-      - name: Request reviews
-        if: steps.app-token.outputs.token
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"
-
-      - name: Log current API rate limits
-        if: steps.app-token.outputs.token
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: gh api /rate_limit | jq

.github/workflows/dismissed-review.yml

@@ -1,65 +0,0 @@
-name: Dismissed review
-
-on:
-  workflow_run:
-    workflows:
-      - Review dismissed
-    types: [completed]
-
-concurrency:
-  group: dismissed-review-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-permissions:
-  pull-requests: write
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  # The `check-cherry-picks` workflow creates review comments which reviewers
-  # are encouraged to manually dismiss if they're not relevant.
-  # When a CI-generated review is dismissed, this job automatically minimizes
-  # it, preventing it from cluttering the PR.
-  minimize:
-    name: Minimize as resolved
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        with:
-          script: |
-            // PRs from forks don't have any PRs associated by default.
-            // Thus, we request the PR number with an API call *to* the fork's repo.
-            // Multiple pull requests can be open from the same head commit, either via
-            // different base branches or head branches.
-            const { head_repository, head_sha, repository } = context.payload.workflow_run
-            await Promise.all(
-              (await github.paginate(github.rest.repos.listPullRequestsAssociatedWithCommit, {
-                owner: head_repository.owner.login,
-                repo: head_repository.name,
-                commit_sha: head_sha
-              }))
-              .filter(pull_request => pull_request.base.repo.id == repository.id)
-              .map(async (pull_request) =>
-                Promise.all(
-                  (await github.paginate(github.rest.pulls.listReviews, {
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    pull_number: pull_request.number
-                  })).filter(review =>
-                    review.user.login == 'github-actions[bot]' &&
-                    review.state == 'DISMISSED'
-                  ).map(review => github.graphql(`
-                    mutation($node_id:ID!) {
-                      minimizeComment(input: {
-                        classifier: RESOLVED,
-                        subjectId: $node_id
-                      })
-                      { clientMutationId }
-                    }`,
-                    { node_id: review.node_id }
-                  ))
-                )
-              )
-            )

.github/workflows/edited.yml

@@ -1,58 +0,0 @@
-# Some workflows depend on the base branch of the PR, but changing the base branch is not included in the default trigger events, which would be `opened`, `synchronize` or `reopened`.
-# Instead it causes an `edited` event.
-# Since `edited` is also triggered when PR title/body is changed, we use this wrapper workflow, to run the other workflows conditionally only.
-# There are already feature requests for adding a `base_changed` event:
-# - https://github.com/orgs/community/discussions/35058
-# - https://github.com/orgs/community/discussions/64119
-#
-# Instead of adding this to each workflow's pull_request_target event, we trigger this in a separate workflow.
-# This has the advantage, that we can actually skip running those jobs for simple edits like changing the title or description.
-# The actual trigger happens by closing and re-opening the pull request, which triggers the default pull_request_target events.
-# This is much simpler and reliable than other approaches.
-
-name: "Edited base branch"
-
-on:
-  pull_request_target:
-    types: [edited]
-
-concurrency:
-  group: edited-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  base:
-    name: Trigger jobs
-    runs-on: ubuntu-24.04
-    if: github.event.changes.base.ref.from && github.event.changes.base.ref.from != github.event.pull_request.base.ref
-    steps:
-      # Use a GitHub App to create the PR so that CI gets triggered
-      # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      # We only need Pull Requests: write here, but the app is also used for backports.
-      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        id: app-token
-        with:
-          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
-          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-          permission-pull-requests: write
-
-      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        with:
-          github-token: ${{ steps.app-token.outputs.token }}
-          script: |
-            function changeState(state) {
-              return github.rest.pulls.update({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                pull_number: context.payload.pull_request.number,
-                state
-              })
-            }
-            await changeState('closed')
-            await changeState('open')

.github/workflows/eval.yml

@@ -1,255 +0,0 @@
-name: Eval
-
-on:
-  workflow_call:
-    inputs:
-      mergedSha:
-        required: true
-        type: string
-      targetSha:
-        type: string
-      systems:
-        required: true
-        type: string
-    secrets:
-      OWNER_APP_PRIVATE_KEY:
-        required: false
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  eval:
-    runs-on: ubuntu-24.04-arm
-    strategy:
-      fail-fast: false
-      matrix:
-        system: ${{ fromJSON(inputs.systems) }}
-    name: ${{ matrix.system }}
-    outputs:
-      targetRunId: ${{ steps.targetRunId.outputs.targetRunId }}
-    steps:
-      - name: Enable swap
-        run: |
-          sudo fallocate -l 10G /swap
-          sudo chmod 600 /swap
-          sudo mkswap /swap
-          sudo swapon /swap
-
-      - name: Check out the PR at the test merge commit
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ inputs.mergedSha }}
-          path: untrusted
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31
-        with:
-          extra_nix_config: sandbox = true
-
-      - name: Evaluate the ${{ matrix.system }} output paths for all derivation attributes
-        env:
-          MATRIX_SYSTEM: ${{ matrix.system }}
-        run: |
-          nix-build untrusted/ci -A eval.singleSystem \
-            --argstr evalSystem "$MATRIX_SYSTEM" \
-            --arg chunkSize 10000 \
-            --out-link merged
-          # If it uses too much memory, slightly decrease chunkSize
-
-      - name: Upload the output paths and eval stats
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: merged-${{ matrix.system }}
-          path: merged/*
-
-      - name: Log current API rate limits
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: gh api /rate_limit | jq
-
-      - name: Get target run id
-        if: inputs.targetSha
-        id: targetRunId
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        env:
-          MATRIX_SYSTEM: ${{ matrix.system }}
-          TARGET_SHA: ${{ inputs.targetSha }}
-        with:
-          script: |
-            const system = process.env.MATRIX_SYSTEM
-            const targetSha = process.env.TARGET_SHA
-
-            let run_id
-            try {
-              run_id = (await github.rest.actions.listWorkflowRuns({
-                ...context.repo,
-                workflow_id: 'push.yml',
-                event: 'push',
-                head_sha: targetSha
-              })).data.workflow_runs[0].id
-            } catch {
-              throw new Error(`Could not find a push.yml workflow run for ${targetSha}.`)
-            }
-
-            // Waiting 120 * 5 sec = 10 min. max.
-            // Eval takes max 5-6 minutes, normally.
-            for (let i = 0; i < 120; i++) {
-              const result = await github.rest.actions.listWorkflowRunArtifacts({
-                ...context.repo,
-                run_id,
-                name: `merged-${system}`
-              })
-              if (result.data.total_count > 0) {
-                core.setOutput('targetRunId', run_id)
-                return
-              }
-              await new Promise(resolve => setTimeout(resolve, 5000))
-            }
-            // No artifact found at this stage. This usually means that Eval failed on the target branch.
-            // This should only happen when Eval is broken on the target branch and this PR fixes it.
-            // Continue without targetRunId to skip the remaining steps, but pass the job.
-
-      - name: Log current API rate limits
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: gh api /rate_limit | jq
-
-      - uses: actions/download-artifact@v4
-        if: steps.targetRunId.outputs.targetRunId
-        with:
-          run-id: ${{ steps.targetRunId.outputs.targetRunId }}
-          name: merged-${{ matrix.system }}
-          path: target
-          github-token: ${{ github.token }}
-          merge-multiple: true
-
-      - name: Compare outpaths against the target branch
-        if: steps.targetRunId.outputs.targetRunId
-        env:
-          MATRIX_SYSTEM: ${{ matrix.system }}
-        run: |
-          nix-build untrusted/ci -A eval.diff \
-            --arg beforeDir ./target \
-            --arg afterDir "$(readlink ./merged)" \
-            --argstr evalSystem "$MATRIX_SYSTEM" \
-            --out-link diff
-
-      - name: Upload outpaths diff and stats
-        if: steps.targetRunId.outputs.targetRunId
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: diff-${{ matrix.system }}
-          path: diff/*
-
-  compare:
-    runs-on: ubuntu-24.04-arm
-    needs: [eval]
-    if: needs.eval.outputs.targetRunId
-    permissions:
-      statuses: write
-    steps:
-      - name: Download output paths and eval stats for all systems
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
-        with:
-          pattern: diff-*
-          path: diff
-          merge-multiple: true
-
-      - name: Check out the PR at the target commit
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ inputs.targetSha }}
-          path: trusted
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31
-        with:
-          extra_nix_config: sandbox = true
-
-      - name: Combine all output paths and eval stats
-        run: |
-          nix-build trusted/ci -A eval.combine \
-            --arg diffDir ./diff \
-            --out-link combined
-
-      - name: Compare against the target branch
-        env:
-          AUTHOR_ID: ${{ github.event.pull_request.user.id }}
-        run: |
-          git -C trusted fetch --depth 1 origin ${{ inputs.mergedSha }}
-          git -C trusted diff --name-only ${{ inputs.mergedSha }} \
-            | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
-
-          # Use the target branch to get accurate maintainer info
-          nix-build trusted/ci -A eval.compare \
-            --arg combinedDir "$(realpath ./combined)" \
-            --arg touchedFilesJson ./touched-files.json \
-            --argstr githubAuthorId "$AUTHOR_ID" \
-            --out-link comparison
-
-          cat comparison/step-summary.md >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Upload the comparison results
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: comparison
-          path: comparison/*
-
-      - name: Add eval summary to commit statuses
-        if: ${{ github.event_name == 'pull_request_target' }}
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        with:
-          script: |
-            const { readFile } = require('node:fs/promises')
-            const changed = JSON.parse(await readFile('comparison/changed-paths.json', 'utf-8'))
-            const description =
-              'Package: ' + [
-                `added ${changed.attrdiff.added.length}`,
-                `removed ${changed.attrdiff.removed.length}`,
-                `changed ${changed.attrdiff.changed.length}`
-              ].join(', ') +
-              ' — Rebuild: ' + [
-                `linux ${changed.rebuildCountByKernel.linux}`,
-                `darwin ${changed.rebuildCountByKernel.darwin}`
-              ].join(', ')
-
-            const { serverUrl, repo, runId, payload } = context
-            const target_url =
-              `${serverUrl}/${repo.owner}/${repo.repo}/actions/runs/${runId}?pr=${payload.pull_request.number}`
-
-            await github.rest.repos.createCommitStatus({
-              ...repo,
-              sha: payload.pull_request.head.sha,
-              context: 'Eval Summary',
-              state: 'success',
-              description,
-              target_url
-            })
-
-  misc:
-    if: ${{ github.event_name != 'push' }}
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and checkout the merge commit
-        uses: ./.github/actions/get-merge-commit
-        with:
-          merged-as-untrusted: true
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31
-        with:
-          extra_nix_config: sandbox = true
-
-      - name: Ensure flake outputs on all systems still evaluate
-        run: nix flake check --all-systems --no-build ./untrusted
-
-      - name: Query nixpkgs with aliases enabled to check for basic syntax errors
-        run: |
-          time nix-env -I ./untrusted -f ./untrusted -qa '*' --option restrict-eval true --option allow-import-from-derivation false >/dev/null

.github/workflows/labels.yml

@@ -1,120 +0,0 @@
-# WARNING:
-# When extending this action, be aware that $GITHUB_TOKEN allows some write
-# access to the GitHub API. This means that it should not evaluate user input in
-# a way that allows code injection.
-
-name: Labels
-
-on:
-  schedule:
-    - cron: '07,17,27,37,47,57 * * * *'
-  workflow_call:
-    inputs:
-      headBranch:
-        required: true
-        type: string
-    secrets:
-      NIXPKGS_CI_APP_PRIVATE_KEY:
-        required: true
-  workflow_dispatch:
-
-concurrency:
-  # This explicitly avoids using `run_id` for the concurrency key to make sure that only
-  # *one* scheduled run can run at a time.
-  group: labels-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number }}
-  # PR-triggered runs will be cancelled, but scheduled runs will be queued.
-  cancel-in-progress: ${{ github.event_name != 'schedule' }}
-
-# This is used as fallback without app only.
-# This happens when testing in forks without setting up that app.
-permissions:
-  issues: write
-  pull-requests: write
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  update:
-    runs-on: ubuntu-24.04-arm
-    if: github.event_name != 'schedule' || github.repository_owner == 'NixOS'
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          sparse-checkout: |
-            ci/github-script
-
-      - name: Install dependencies
-        run: npm install @actions/artifact bottleneck
-
-      # Use a GitHub App, because it has much higher rate limits: 12,500 instead of 5,000 req / hour.
-      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        if: vars.NIXPKGS_CI_APP_ID
-        id: app-token
-        with:
-          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
-          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-          permission-issues: write
-          permission-pull-requests: write
-
-      - name: Log current API rate limits
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
-        run: gh api /rate_limit | jq
-
-      - name: Labels from API data and Eval results
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        with:
-          github-token: ${{ steps.app-token.outputs.token || github.token }}
-          retries: 3
-          script: |
-            require('./ci/github-script/labels.js')({
-              github,
-              context,
-              core,
-              dry: context.eventName == 'pull_request'
-            })
-
-      - name: Log current API rate limits
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
-        run: gh api /rate_limit | jq
-
-      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
-        name: Labels from touched files
-        if: |
-          github.event_name == 'pull_request_target' &&
-          !contains(fromJSON(inputs.headBranch).type, 'development')
-        with:
-          repo-token: ${{ steps.app-token.outputs.token }}
-          configuration-path: .github/labeler.yml # default
-          sync-labels: true
-
-      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
-        name: Labels from touched files (no sync)
-        if: |
-          github.event_name == 'pull_request_target' &&
-          !contains(fromJSON(inputs.headBranch).type, 'development')
-        with:
-          repo-token: ${{ steps.app-token.outputs.token }}
-          configuration-path: .github/labeler-no-sync.yml
-          sync-labels: false
-
-      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
-        name: Labels from touched files (development branches)
-        # Development branches like staging-next, haskell-updates and python-updates get special labels.
-        # This is to avoid the mass of labels there, which is mostly useless - and really annoying for
-        # the backport labels.
-        if: |
-          github.event_name == 'pull_request_target' &&
-          contains(fromJSON(inputs.headBranch).type, 'development')
-        with:
-          repo-token: ${{ steps.app-token.outputs.token }}
-          configuration-path: .github/labeler-development-branches.yml
-          sync-labels: true
-
-      - name: Log current API rate limits
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
-        run: gh api /rate_limit | jq

.github/workflows/lint.yml

@@ -1,105 +0,0 @@
-name: Lint
-
-on:
-  workflow_call:
-    inputs:
-      mergedSha:
-        required: true
-        type: string
-      targetSha:
-        required: true
-        type: string
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  treefmt:
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and checkout the merge commit
-        uses: ./.github/actions/get-merge-commit
-        with:
-          mergedSha: ${{ inputs.mergedSha }}
-          merged-as-untrusted: true
-
-      - uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31
-        with:
-          extra_nix_config: sandbox = true
-
-      - name: Check that files are formatted
-        run: |
-          # Note that it's fine to run this on untrusted code because:
-          # - There's no secrets accessible here
-          # - The build is sandboxed
-          if ! nix-build untrusted/ci -A fmt.check; then
-            echo "Some files are not properly formatted"
-            echo "Please format them by going to the Nixpkgs root directory and running one of:"
-            echo "  nix-shell --run treefmt"
-            echo "  nix develop --command treefmt"
-            echo "  nix fmt"
-            echo "Make sure your branch is up to date with master; rebase if not."
-            echo "If you're having trouble, please ping @NixOS/nix-formatting"
-            exit 1
-          fi
-
-  parse:
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and checkout the merge commit
-        uses: ./.github/actions/get-merge-commit
-        with:
-          mergedSha: ${{ inputs.mergedSha }}
-          merged-as-untrusted: true
-
-      - uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31
-        with:
-          extra_nix_config: sandbox = true
-
-      - name: Parse all nix files
-        run: |
-          # Tests multiple versions at once, let's make sure all of them run, so keep-going.
-          nix-build untrusted/ci -A parse --keep-going
-
-  nixpkgs-vet:
-    runs-on: ubuntu-24.04-arm
-    # This should take 1 minute at most, but let's be generous. The default of 6 hours is definitely too long.
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and checkout merged and target commits
-        uses: ./.github/actions/get-merge-commit
-        with:
-          mergedSha: ${{ inputs.mergedSha }}
-          merged-as-untrusted: true
-          targetSha: ${{ inputs.targetSha }}
-          target-as-trusted: true
-
-      - uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31
-        with:
-          extra_nix_config: sandbox = true
-
-      - name: Running nixpkgs-vet
-        env:
-          # Force terminal colors to be enabled. The library that `nixpkgs-vet` uses respects https://bixense.com/clicolors/
-          CLICOLOR_FORCE: 1
-        run: |
-          if nix-build untrusted/ci -A nixpkgs-vet --arg base "./trusted" --arg head "./untrusted"; then
-            exit 0
-          else
-            exitCode=$?
-            echo "To run locally: ./ci/nixpkgs-vet.sh $GITHUB_BASE_REF https://github.com/$GITHUB_REPOSITORY.git"
-            echo "If you're having trouble, ping @NixOS/nixpkgs-vet"
-            exit "$exitCode"
-          fi

.github/workflows/periodic-merge-24h.yml

@@ -1,46 +0,0 @@
-# This action periodically merges base branches into staging branches.
-# This is done to
-#  * prevent conflicts or rather resolve them early
-#  * make all potential breakage happen on the staging branch
-#  * and make sure that all major rebuilds happen before the staging
-#    branch get’s merged back into its base branch.
-
-name: "Periodic Merges (24h)"
-
-on:
-  schedule:
-    # * is a special character in YAML so you have to quote this string
-    # Merge every 24 hours
-    - cron: '0 0 * * *'
-  workflow_dispatch:
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  periodic-merge:
-    if: github.repository_owner == 'NixOS'
-    strategy:
-      # don't fail fast, so that all pairs are tried
-      fail-fast: false
-      # certain branches need to be merged in order, like master->staging-next->staging
-      # and disabling parallelism ensures the order of the pairs below.
-      max-parallel: 1
-      matrix:
-        pairs:
-          - from: release-25.05
-            into: staging-next-25.05
-          - from: staging-next-25.05
-            into: staging-25.05
-          - name: merge-base(master,staging) → haskell-updates
-            from: master staging
-            into: haskell-updates
-    uses: ./.github/workflows/periodic-merge.yml
-    with:
-      from: ${{ matrix.pairs.from }}
-      into: ${{ matrix.pairs.into }}
-    name: ${{ matrix.pairs.name || format('{0} → {1}', matrix.pairs.from, matrix.pairs.into) }}
-    secrets: inherit

.github/workflows/periodic-merge-6h.yml

@@ -1,43 +0,0 @@
-# This action periodically merges base branches into staging branches.
-# This is done to
-#  * prevent conflicts or rather resolve them early
-#  * make all potential breakage happen on the staging branch
-#  * and make sure that all major rebuilds happen before the staging
-#    branch get’s merged back into its base branch.
-
-name: "Periodic Merges (6h)"
-
-on:
-  schedule:
-    # * is a special character in YAML so you have to quote this string
-    # Merge every 6 hours
-    - cron: '0 */6 * * *'
-  workflow_dispatch:
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  periodic-merge:
-    if: github.repository_owner == 'NixOS'
-    strategy:
-      # don't fail fast, so that all pairs are tried
-      fail-fast: false
-      # certain branches need to be merged in order, like master->staging-next->staging
-      # and disabling parallelism ensures the order of the pairs below.
-      max-parallel: 1
-      matrix:
-        pairs:
-          - from: master
-            into: staging-next
-          - from: staging-next
-            into: staging
-    uses: ./.github/workflows/periodic-merge.yml
-    with:
-      from: ${{ matrix.pairs.from }}
-      into: ${{ matrix.pairs.into }}
-    name: ${{ format('{0} → {1}', matrix.pairs.from, matrix.pairs.into) }}
-    secrets: inherit

.github/workflows/periodic-merge.yml

@@ -1,63 +0,0 @@
-name: "Merge"
-
-on:
-  workflow_call:
-    inputs:
-      from:
-        description: Branch to merge into target branch. Can also be two branches separated by space to find the merge base between them.
-        required: true
-        type: string
-      into:
-        description: Target branch to merge into.
-        required: true
-        type: string
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  merge:
-    runs-on: ubuntu-24.04-arm
-    steps:
-      # Use a GitHub App to create the PR so that CI gets triggered
-      # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        id: app-token
-        with:
-          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
-          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-          permission-contents: write
-          permission-pull-requests: write
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Find merge base between two branches
-        if: contains(inputs.from, ' ')
-        id: merge_base
-        env:
-          branches: ${{ inputs.from }}
-        run: |
-          # turn into bash array, split on space
-          read -ra branches <<< "$branches"
-          git fetch --shallow-since="1 month ago" origin "${branches[@]}"
-          merge_base="$(git merge-base "refs/remotes/origin/${branches[0]}" "refs/remotes/origin/${branches[1]}")"
-          echo "Found merge base: $merge_base" >&2
-          echo "merge_base=$merge_base" >> "$GITHUB_OUTPUT"
-
-      - name: ${{ inputs.from }} → ${{ inputs.into }}
-        uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
-        with:
-          type: now
-          from_branch: ${{ steps.merge_base.outputs.merge_base || inputs.from }}
-          target_branch: ${{ inputs.into }}
-          github_token: ${{ steps.app-token.outputs.token }}
-
-      - name: Comment on failure
-        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
-        if: ${{ failure() }}
-        with:
-          issue-number: 105153
-          body: |
-            Periodic merge from `${{ inputs.from }}` into `${{ inputs.into }}` has [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).
-          token: ${{ steps.app-token.outputs.token }}

.github/workflows/pr.yml

@@ -1,149 +0,0 @@
-name: PR
-
-on:
-  pull_request:
-    paths:
-      - .github/workflows/build.yml
-      - .github/workflows/check.yml
-      - .github/workflows/eval.yml
-      - .github/workflows/lint.yml
-      - .github/workflows/pr.yml
-      - .github/workflows/labels.yml
-      - .github/workflows/reviewers.yml # needs eval results from the same event type
-  pull_request_target:
-
-concurrency:
-  group: pr-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  prepare:
-    runs-on: ubuntu-24.04-arm
-    outputs:
-      baseBranch: ${{ steps.branches.outputs.base }}
-      headBranch: ${{ steps.branches.outputs.head }}
-      mergedSha: ${{ steps.get-merge-commit.outputs.mergedSha }}
-      targetSha: ${{ steps.get-merge-commit.outputs.targetSha }}
-      systems: ${{ steps.systems.outputs.systems }}
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          sparse-checkout: |
-            .github/actions
-            ci/supportedBranches.js
-            ci/supportedSystems.json
-      - name: Check if the PR can be merged and get the test merge commit
-        uses: ./.github/actions/get-merge-commit
-        id: get-merge-commit
-
-      - name: Load supported systems
-        id: systems
-        run: |
-          echo "systems=$(jq -c <ci/supportedSystems.json)" >> "$GITHUB_OUTPUT"
-
-      - name: Determine branch type
-        id: branches
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        with:
-          script: |
-            const { classify } = require('./ci/supportedBranches.js')
-            const { base, head } = context.payload.pull_request
-
-            const baseClassification = classify(base.ref)
-            core.setOutput('base', baseClassification)
-            core.info('base classification:', baseClassification)
-
-            const headClassification =
-              (base.repo.full_name == head.repo.full_name) ?
-              classify(head.ref) :
-              // PRs from forks are always considered WIP.
-              { type: ['wip'] }
-            core.setOutput('head', headClassification)
-            core.info('head classification:', headClassification)
-
-  check:
-    name: Check
-    needs: [prepare]
-    uses: ./.github/workflows/check.yml
-    permissions:
-      # cherry-picks
-      pull-requests: write
-    with:
-      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
-      headBranch: ${{ needs.prepare.outputs.headBranch }}
-
-  lint:
-    name: Lint
-    needs: [prepare]
-    uses: ./.github/workflows/lint.yml
-    with:
-      mergedSha: ${{ needs.prepare.outputs.mergedSha }}
-      targetSha: ${{ needs.prepare.outputs.targetSha }}
-
-  eval:
-    name: Eval
-    needs: [prepare]
-    uses: ./.github/workflows/eval.yml
-    permissions:
-      # compare
-      statuses: write
-    secrets:
-      OWNER_APP_PRIVATE_KEY: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
-    with:
-      mergedSha: ${{ needs.prepare.outputs.mergedSha }}
-      targetSha: ${{ needs.prepare.outputs.targetSha }}
-      systems: ${{ needs.prepare.outputs.systems }}
-
-  labels:
-    name: Labels
-    needs: [prepare, eval]
-    uses: ./.github/workflows/labels.yml
-    permissions:
-      issues: write
-      pull-requests: write
-    secrets:
-      NIXPKGS_CI_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-    with:
-      headBranch: ${{ needs.prepare.outputs.headBranch }}
-
-  reviewers:
-    name: Reviewers
-    needs: [prepare, eval]
-    if: |
-      needs.prepare.outputs.targetSha &&
-      !contains(fromJSON(needs.prepare.outputs.headBranch).type, 'development')
-    uses: ./.github/workflows/reviewers.yml
-    secrets:
-      OWNER_APP_PRIVATE_KEY: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
-
-  build:
-    name: Build
-    needs: [prepare]
-    uses: ./.github/workflows/build.yml
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
-    with:
-      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
-      mergedSha: ${{ needs.prepare.outputs.mergedSha }}
-
-  # This job's only purpose is to serve as a target for the "Required Status Checks" branch ruleset.
-  # It "needs" all the jobs that should block merging a PR.
-  # If they pass, it is skipped — which counts as "success" for purposes of the branch ruleset.
-  # However, if any of them fail, this job will also fail — thus blocking the branch ruleset.
-  no-pr-failures:
-    # Modify this list to add or remove jobs from required status checks.
-    needs:
-      - check
-      - lint
-      - eval
-      - build
-    # WARNING:
-    # Do NOT change the name of this job, otherwise the rule will not catch it anymore.
-    # This would prevent all PRs from merging.
-    name: no PR failures
-    if: ${{ failure() }}
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - run: exit 1

.github/workflows/push.yml

@@ -1,48 +0,0 @@
-name: Push
-
-on:
-  pull_request:
-    paths:
-      - .github/workflows/push.yml
-      # eval is tested via pr.yml
-  push:
-    # Keep this synced with ci/request-reviews/dev-branches.txt
-    branches:
-      - master
-      - staging
-      - release-*
-      - staging-*
-      - haskell-updates
-      - python-updates
-
-permissions: {}
-
-jobs:
-  prepare:
-    runs-on: ubuntu-24.04-arm
-    outputs:
-      systems: ${{ steps.systems.outputs.systems }}
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          sparse-checkout: |
-            ci/supportedSystems.json
-
-      - name: Load supported systems
-        id: systems
-        run: |
-          echo "systems=$(jq -c <ci/supportedSystems.json)" >> "$GITHUB_OUTPUT"
-
-  eval:
-    name: Eval
-    needs: [prepare]
-    uses: ./.github/workflows/eval.yml
-    # Those are not actually used on push, but will throw an error if not set.
-    permissions:
-      # compare
-      issues: write
-      pull-requests: write
-      statuses: write
-    with:
-      mergedSha: ${{ github.sha }}
-      systems: ${{ needs.prepare.outputs.systems }}

.github/workflows/review-dismissed.yml

@@ -1,17 +0,0 @@
-name: Review dismissed
-
-on:
-  pull_request_review:
-    types: [dismissed]
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  trigger:
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - run: echo This is a no-op only used as a trigger for workflow_run.

.github/workflows/reviewers.yml

@@ -1,144 +0,0 @@
-# This workflow will request reviews from the maintainers of each package
-# listed in the PR's most recent eval comparison artifact.
-
-name: Reviewers
-
-on:
-  pull_request:
-    paths:
-      - .github/workflows/reviewers.yml
-  pull_request_target:
-    types: [ready_for_review]
-  workflow_call:
-    secrets:
-      OWNER_APP_PRIVATE_KEY:
-        required: true
-
-concurrency:
-  group: reviewers-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  request:
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - name: Check out the PR at the base commit
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          path: trusted
-          sparse-checkout: ci
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31
-        with:
-          extra_nix_config: sandbox = true
-
-      - name: Build the requestReviews derivation
-        run: nix-build trusted/ci -A requestReviews
-
-      # See ./codeowners-v2.yml, reuse the same App because we need the same permissions
-      # Can't use the token received from permissions above, because it can't get enough permissions
-      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        if: github.event_name == 'pull_request_target' && vars.OWNER_APP_ID
-        id: app-token
-        with:
-          app-id: ${{ vars.OWNER_APP_ID }}
-          private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
-          permission-administration: read
-          permission-members: read
-          permission-pull-requests: write
-
-      - name: Log current API rate limits (github.token)
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: gh api /rate_limit | jq
-
-      # In the regular case, this workflow is called via workflow_call from the eval workflow directly.
-      # In the more special case, when a PR is undrafted an eval run will have started already.
-      - name: Wait for comparison to be done
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        id: eval
-        with:
-          script: |
-            const run_id = (await github.rest.actions.listWorkflowRuns({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: 'pr.yml',
-              event: context.eventName,
-              head_sha: context.payload.pull_request.head.sha
-            })).data.workflow_runs[0].id
-
-            core.setOutput('run-id', run_id)
-
-            // Waiting 120 * 5 sec = 10 min. max.
-            // The extreme case is an Eval run that just started when the PR is undrafted.
-            // Eval takes max 5-6 minutes, normally.
-            for (let i = 0; i < 120; i++) {
-              const result = await github.rest.actions.listWorkflowRunArtifacts({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                run_id,
-                name: 'comparison'
-              })
-              if (result.data.total_count > 0) return
-              await new Promise(resolve => setTimeout(resolve, 5000))
-            }
-            throw new Error("No comparison artifact found.")
-
-      - name: Log current API rate limits (github.token)
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: gh api /rate_limit | jq
-
-      - name: Download the comparison results
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
-        with:
-          run-id: ${{ steps.eval.outputs.run-id }}
-          github-token: ${{ github.token }}
-          pattern: comparison
-          path: comparison
-          merge-multiple: true
-
-      - name: Log current API rate limits (app-token)
-        if: ${{ steps.app-token.outputs.token }}
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: gh api /rate_limit | jq
-
-      - name: Log current API rate limits (github.token)
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: gh api /rate_limit | jq
-
-      - name: Requesting maintainer reviews
-        if: ${{ steps.app-token.outputs.token }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPOSITORY: ${{ github.repository }}
-          NUMBER: ${{ github.event.number }}
-          AUTHOR: ${{ github.event.pull_request.user.login }}
-          # Don't request reviewers on draft PRs
-          DRY_MODE: ${{ github.event.pull_request.draft && '1' || '' }}
-        run: |
-          # maintainers.json contains GitHub IDs. Look up handles to request reviews from.
-          # There appears to be no API to request reviews based on GitHub IDs
-          jq -r 'keys[]' comparison/maintainers.json \
-            | while read -r id; do gh api /user/"$id" --jq .login; done \
-            | GH_TOKEN=${{ steps.app-token.outputs.token }} result/bin/request-reviewers.sh "$REPOSITORY" "$NUMBER" "$AUTHOR"
-
-      - name: Log current API rate limits (app-token)
-        if: ${{ steps.app-token.outputs.token }}
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: gh api /rate_limit | jq
-
-      - name: Log current API rate limits (github.token)
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: gh api /rate_limit | jq

.gitignore

@@ -2,41 +2,15 @@
 ,*
 .*.swp
 .*.swo
-.\#*
-\#*\#
-.idea/
-.nixos-test-history
-.vscode/
-.helix/
-outputs/
-result-*
 result
-repl-result-*
-tags
-!pkgs/development/python-modules/result
+result-*
 /doc/NEWS.html
 /doc/NEWS.txt
 /doc/manual.html
 /doc/manual.pdf
-/source/
 .version-suffix
-.direnv
-.envrc
 
 .DS_Store
-.mypy_cache
-__pycache__
 
 /pkgs/development/libraries/qt-5/*/tmp/
-/pkgs/desktops/kde-5/*/tmp/
-/pkgs/development/mobile/androidenv/xml/*
-
-# generated by pkgs/common-updater/update-script.nix
-update-git-commits.txt
-/*.log
-
-# JetBrains IDEA module declaration file
-/nixpkgs.iml
-
-# Usually used for manual backports
-.worktree/
+/pkgs/desktops/kde-5/*/tmp/

.mailmap

@@ -1,34 +0,0 @@
-ajs124 <git@ajs124.de> <ajs124@users.noreply.github.com>
-Anderson Torres <torres.anderson.85@protonmail.com>
-Atemu <git@atemu.net> <atemu.main@gmail.com>
-Christina Sørensen <christina@cafkafk.com>
-Christina Sørensen <christina@cafkafk.com> <christinaafk@gmail.com>
-Christina Sørensen <christina@cafkafk.com> <89321978+cafkafk@users.noreply.github.com>
-Daniel Løvbrøtte Olsen <me@dandellion.xyz> <daniel.olsen99@gmail.com>
-Ethan Carter Edwards <ethan@ethancedwards.com> Ethan Edwards <ethancarteredwards@gmail.com>
-Fabian Affolter <mail@fabian-affolter.ch> <fabian@affolter-engineering.ch>
-Fiona Behrens <me@kloenk.dev>
-Fiona Behrens <me@kloenk.dev> <me@kloenk.de>
-goatastronaut0212 <goatastronaut0212@outlook.com> <goatastronaut0212@proton.me>
-Janne Heß <janne@hess.ooo> <dasJ@users.noreply.github.com>
-jopejoe1 <nixpkgs@missing.ninja>
-jopejoe1 <nixpkgs@missing.ninja> <johannes@joens.email>
-jopejoe1 <nixpkgs@missing.ninja> <34899572+jopejoe1@users.noreply.github.com>
-Jörg Thalheim <joerg@thalheim.io> <Mic92@users.noreply.github.com>
-Lin Jian <me@linj.tech> <linj.dev@outlook.com>
-Lin Jian <me@linj.tech> <75130626+jian-lin@users.noreply.github.com>
-Martin Weinelt <hexa@darmstadt.ccc.de> <mweinelt@users.noreply.github.com>
-Martin Häcker <spamfaenger@gmx.de> <spamfaenger@gmx.de>
-moni <lythe1107@gmail.com> <lythe1107@icloud.com>
-R. RyanTM <ryantm-bot@ryantm.com>
-Robert Hensing <robert@roberthensing.nl> <roberth@users.noreply.github.com>
-Sandro Jäckel <sandro.jaeckel@gmail.com>
-Sandro Jäckel <sandro.jaeckel@gmail.com> <sandro.jaeckel@sap.com>
-superherointj <5861043+superherointj@users.noreply.github.com>
-Tomodachi94 <tomodachi94@protonmail.com> Tomo <68489118+Tomodachi94@users.noreply.github.com>
-Vladimír Čunát <v@cunat.cz> <vcunat@gmail.com>
-Vladimír Čunát <v@cunat.cz> <vladimir.cunat@nic.cz>
-Yifei Sun <ysun@hey.com>
-Yifei Sun <ysun@hey.com> StepBroBD <ysun@hey.com>
-Yifei Sun <ysun@hey.com> StepBroBD <Hi@StepBroBD.com>
-Yifei Sun <ysun@hey.com> <ysun+git@stepbrobd.com>

.version

@@ -1 +0,0 @@
-lib/.version

.version

@@ -0,0 +1 @@
+18.09

CONTRIBUTING.md

@@ -1,848 +0,0 @@
-# Contributing to Nixpkgs
-
-This document is for people wanting to contribute to Nixpkgs.
-This involves changes that are proposed using [GitHub](https://github.com) [pull requests](https://docs.github.com/pull-requests) to the [Nixpkgs repository](https://github.com/nixos/nixpkgs).
-
-A GitHub account is recommended, which you can sign up for [here](https://github.com/signup).
-See [here](https://discourse.nixos.org/t/about-the-patches-category/477) for how to contribute without a GitHub account.
-
-This document assumes that you already know how to use GitHub and Git.
-If that's not the case, we recommend learning about it [here](https://docs.github.com/en/get-started/quickstart/hello-world).
-
-## Overview
-[overview]: #overview
-
-This file contains general contributing information.
-More specific information about individual parts of Nixpkgs can be found here:
-- [`doc`](./doc/README.md): Sources and infrastructure for the [Nixpkgs manual](https://nixos.org/manual/nixpkgs/stable/)
-- [`lib`](./lib/README.md): Sources and documentation of the [library functions](https://nixos.org/manual/nixpkgs/stable/#chap-functions)
-- [`maintainers`](./maintainers/README.md): Nixpkgs maintainer and team listings, maintainer scripts
-- [`nixos`](./nixos/README.md): Implementation of [NixOS](https://nixos.org/manual/nixos/stable/)
-- [`pkgs`](./pkgs/README.md): Package and [builder](https://nixos.org/manual/nixpkgs/stable/#part-builders) definitions
-
-# How to's
-
-## How to create pull requests
-[pr-create]: #how-to-create-pull-requests
-
-This section describes how changes can be proposed with a pull request (PR).
-
-> [!Note]
-> Be aware that contributing implies licensing those contributions under the terms of [COPYING](./COPYING), an MIT-like license.
-
-0. Set up a local version of Nixpkgs to work with:
-   1. [Fork](https://docs.github.com/en/get-started/quickstart/fork-a-repo#forking-a-repository) the [Nixpkgs repository](https://github.com/nixos/nixpkgs).
-   1. [Clone the forked repository](https://docs.github.com/en/get-started/quickstart/fork-a-repo#cloning-your-forked-repository) into a local `nixpkgs` directory.
-   1. [Configure the upstream Nixpkgs repository](https://docs.github.com/en/get-started/quickstart/fork-a-repo#configuring-git-to-sync-your-fork-with-the-upstream-repository).
-
-1. Select the appropriate [base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/about-branches#working-with-branches) for the change, as [described here][branch].
-   If in doubt, use `master`.
-   This can be changed later by [rebasing][rebase].
-
-2. Create a new Git branch, ideally such that:
-   - The name of the branch hints at your change, e.g. `update-hello`.
-   - The branch contains the most recent base branch.
-
-   We'll assume the base branch `master` here.
-
-   ```bash
-   # Make sure you have the latest changes from upstream Nixpkgs
-   git fetch upstream
-
-   # Create and switch to a new branch, based on the base branch in Nixpkgs
-   git switch --create update-hello upstream/master
-   ```
-
-   To avoid potentially having to download and build many derivations, you can base on a specific [Git commit](https://www.git-scm.com/docs/gitglossary#def_commit) instead:
-   - The commit of the latest `nixpkgs-unstable` channel, available [here](https://channels.nixos.org/nixpkgs-unstable/git-revision).
-   - The commit of a local Nixpkgs downloaded using [nix-channel](https://nixos.org/manual/nix/stable/command-ref/nix-channel), available using `nix-instantiate --eval --expr '(import <nixpkgs/lib>).trivial.revisionWithDefault null'`
-   - If you're using NixOS, the commit of your NixOS installation, available with `nixos-version --revision`.
-
-   You can use this commit instead of `upstream/master` in the above command:
-   ```bash
-   # Here, b9c03fbb is an example commit from nixpkgs-unstable
-   git switch --create update-hello b9c03fbb
-   ```
-
-3. Make your changes in the local Nixpkgs repository and:
-   - Adhere to both the [general code conventions][code-conventions], and the relevant [specific code conventions][overview].
-   - Test the changes.
-   - If necessary, document the changes.
-
-   See the [overview section][overview] for more specific information.
-
-4. Commit your changes using `git commit`.
-   Make sure to adhere to the [commit conventions](#commit-conventions).
-
-   Repeat the steps 3-4 as many times as necessary.
-   Advance to the next step once all the commits make sense together.
-   You can view your commits with `git log`.
-
-5. Push your commits to your fork of Nixpkgs:
-   ```
-   git push --set-upstream origin HEAD
-   ```
-
-   The above command will output a link to directly do the next step:
-   ```
-   remote: Create a pull request for 'update-hello' on GitHub by visiting:
-   remote:      https://github.com/myUser/nixpkgs/pull/new/update-hello
-   ```
-
-6. [Create a pull request](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request#creating-the-pull-request) from the new branch in your Nixpkgs fork to the upstream Nixpkgs repository.
-   Use the branch from step 1 as the PR's base branch.
-   Go through the [pull request template](#pull-request-template).
-
-7. Respond to review comments and potentially to CI failures and merge conflicts by updating the PR.
-   Always keep it in a mergeable state.
-
-   The non-technical side of this process is covered in [I opened a PR, how do I get it merged?](#i-opened-a-pr-how-do-i-get-it-merged).
-
-   The [ofborg](https://github.com/NixOS/ofborg) CI system will perform checks to ensure code quality.
-   You can see the results at the bottom of the PR.
-   See [the ofborg Readme](https://github.com/NixOS/ofborg#readme) for more details.
-
-   - To add new commits, repeat steps 3-4 and push the result:
-     ```
-     git push
-     ```
-
-   - To change existing commits, [rewrite the Git history](https://git-scm.com/book/en/v2/Git-Tools-Rewriting-History).
-     Useful Git commands for this are `git commit --patch --amend` and `git rebase --interactive`.
-     With a rewritten history you need to force-push the commits:
-     ```
-     git push --force-with-lease
-     ```
-
-   - If there are merge conflicts, you will have to [rebase the branch](https://git-scm.com/book/en/v2/Git-Branching-Rebasing) onto the current **base branch**.
-     Sometimes this can be done [on GitHub directly](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/keeping-your-pull-request-in-sync-with-the-base-branch#updating-your-pull-request-branch).
-     To rebase locally:
-     ```
-     git fetch upstream
-     git rebase upstream/master
-     git push --force-with-lease
-     ```
-
-     Use the base branch from step 1 instead of `upstream/master`.
-
-   - If you need to change the base branch, [rebase][rebase].
-
-8. If your PR is merged and [acceptable for releases][release-acceptable], you may [backport][pr-backport] it.
-
-### Pull request template
-[pr-template]: #pull-request-template
-
-The pull request template helps to determine which steps have been taken so far.
-Details not covered by the title and links to existing related issues should go at the top.
-
-When a PR is created, it will be pre-populated with some checkboxes.
-
-#### Tested using sandboxing
-
-When sandbox builds are enabled, Nix will set up an isolated environment for each build process.
-It is used to remove further hidden dependencies set by the build environment, to improve reproducibility.
-This includes access to the network during the build outside of `fetch*` functions and files outside the Nix store.
-Depending on the operating system, access to other resources is blocked as well; see [sandbox](https://nixos.org/manual/nix/stable/command-ref/conf-file#conf-sandbox) in the Nix manual for details.
-
-Please test builds with sandboxing enabled, because it is also used in [Hydra](https://nixos.org/hydra).
-
-If you are on Linux, sandboxing is enabled by default.
-On other platforms, sandboxing is disabled by default due to a small performance hit on each build.
-
-Please enable sandboxing **before** building the package by adding the following to `/etc/nix/nix.conf`:
-
-  ```ini
-  sandbox = true
-  ```
-
-#### Built on platform(s)
-
-Many Nix packages are designed to run on multiple platforms.
-As such, it’s important to let the maintainer know which platforms you have tested on.
-It’s not always practical to test all platforms, and it’s not required for a pull request to be merged.
-Only check the platforms you tested the build on in this section.
-
-#### Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
-
-Packages with automated tests are likely merged quicker, because they don’t require as much manual testing.
-If there are existing tests for the package, they should be run.
-NixOS tests can only be run on linux.
-For more details on writing and running tests, see the [section in the NixOS manual](https://nixos.org/nixos/manual/index.html#sec-nixos-tests).
-
-#### Tested compilation of all pkgs that depend on this change using `nixpkgs-review`
-
-If you are modifying a package, you can use `nixpkgs-review` to make sure all packages that depend on the updated package still build.
-It can work on uncommitted changes with the `wip` option or on a specific pull request.
-
-Review changes from pull request number 12345:
-
-```ShellSession
-nix-shell -p nixpkgs-review --run "nixpkgs-review pr 12345"
-```
-
-Alternatively, with flakes (and analogously for the other commands below):
-
-```ShellSession
-nix run nixpkgs#nixpkgs-review -- pr 12345
-```
-
-Review uncommitted changes:
-
-```ShellSession
-nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
-```
-
-Review changes from the last commit:
-
-```ShellSession
-nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"
-```
-
-#### Tested execution of all binary files (usually in `./result/bin/`)
-
-It's important to test a modified package's executables.
-Look into `./result/bin` and run all files in there, or at a minimum, the main executable.
-For example, if you make a change to `texlive`, you probably would only check the binaries associated with the change you made, rather than testing all of them.
-
-#### Meets Nixpkgs contribution standards
-
-The last checkbox is about whether it fits the guidelines in this `CONTRIBUTING.md` file.
-This document details our standards for commit messages, reviews, licensing of contributions, etc...
-Everyone should read and understand these standards before submitting a pull request.
-
-### Rebasing between branches (i.e. from master to staging)
-[rebase]: #rebasing-between-branches-ie-from-master-to-staging
-
-Sometimes, changes must be rebased between branches.
-One example is, if the number of rebuilds caused is too large for the original target branch.
-
-In the following example, the current `feature` branch is based on `master`, and we rebase it to have the PR target `staging`.
-We rebase on the _merge base_ between `master` and `staging` to avoid too many local rebuilds.
-
-
-```console
-# Rebase your commits onto the common merge base
-git rebase --onto upstream/staging... upstream/master
-# Force push your changes
-git push origin feature --force-with-lease
-```
-
-The syntax `upstream/staging...` is equivalent to `upstream/staging...HEAD` and stands for the merge base between `upstream/staging` and `HEAD` (hence between `upstream/staging` and `upstream/master`).
-
-Then use the *Edit* button in the upper right corner of the GitHub PR, and switch the base branch from `master` to `staging`.
-*After* the PR has been retargeted, a final rebase onto the target branch might be needed to resolve merge conflicts.
-
-```console
-# Rebase onto target branch
-git rebase upstream/staging
-# Review and fixup possible conflicts
-git status
-# Force push your changes
-git push origin feature --force-with-lease
-```
-
-## How to backport pull requests
-[pr-backport]: #how-to-backport-pull-requests
-
-Once a PR has been merged, a backport to the corresponding `release-YY.MM` branch can be created.
-
-### Automatically backporting changes
-
-> [!Note]
-> You have to be a [Nixpkgs maintainer](./maintainers) to automatically create a backport pull request.
-
-Add the [`backport release-YY.MM` label](https://github.com/NixOS/nixpkgs/labels?q=backport) to the PR on the `master` branch.
-This will cause [a GitHub Action](.github/workflows/backport.yml) to open a new PR to the `release-YY.MM` branch a few minutes later.
-This can be done on both open or already merged pull requests.
-
-### Manually backporting changes
-
-To manually create a backport, follow [the standard pull request process][pr-create], but:
-
-- Use `release-YY.MM` for the base branch, both for the local branch and the pull request.
-
-> [!Warning]
-> Do not use the `nixos-YY.MM` branch.
-> It points to the latest _tested_ release channel commit.
-
-- Instead of manually making and committing the changes, use [`git cherry-pick -x`](https://git-scm.com/docs/git-cherry-pick) for each commit.
-  Use `git cherry-pick -x <commit>` when the reason is obvious, for example for minor version bumps and fixes.
-  Otherwise, use `git cherry-pick -xe <commit>` to add a reason for the backport.
-  Here is [an example](https://github.com/nixos/nixpkgs/commit/5688c39af5a6c5f3d646343443683da880eaefb8).
-
-> [!Warning]
-> Ensure the commits exist on the master branch.
-> In the case of squashed or rebased merges, the commit hash will change and the new commits can be found in the merge message at the bottom of the master pull request.
-
-- In the pull request description, link to the original pull request to `master`.
-  The pull request title should include `[YY.MM]` matching the release you're backporting to.
-
-## How to review pull requests
-[pr-review]: #how-to-review-pull-requests
-
-The Nixpkgs project receives a high number of pull requests.
-Anyone may review and approve PRs and it is an important contribution to the project.
-
-The high change rate makes any PR that remains open for too long subject to merge conflicts.
-To avoid extra work, reviewing PRs timely and being responsive is key.
-GitHub provides sort filters to see the [most recently updated](https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+is%3Aopen+sort%3Aupdated-desc) pull requests.
-We highly encourage looking at [this list of ready to merge, unreviewed pull requests](https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+is%3Aopen+review%3Anone+status%3Asuccess+no%3Aproject+no%3Aassignee+no%3Amilestone).
-
-Controversial changes can lead to controversial opinions, but it is important to respect every community member and their work.
-Always be nice and polite.
-
-GitHub provides reactions for quick feedback to pull requests or comments.
-The thumb-down reaction should be used with care and, if possible, accompanied with explanation for the submitter to improve their contribution.
-
-When doing a review:
-- Aim to drive the proposal to a timely conclusion.
-- Focus on the proposed changes and keep the scope narrow.
-- Help the contributor prioritise their efforts towards getting their change merged.
-
-If you find anything related that could be improved but is not immediately required for acceptance, consider:
-- Implementing the changes yourself in a follow-up pull request,
-- Tracking your idea in an issue,
-- Offering to review a follow-up pull request,
-- Making concrete [suggestions](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/incorporating-feedback-in-your-pull-request) in the same pull request.
-
-For example, follow-up changes could involve refactoring code in the affected files.
-
-But please remember not to make such additional considerations a blocker, and communicate that to the contributor, for example by following the [conventional comments](https://conventionalcomments.org) pattern.
-If the related change is essential for the contribution at hand, make clear why you think it is important to address that first.
-
-Pull request reviews should include a list of what has been reviewed in a comment, so other reviewers and mergers can know the state of the review.
-
-All the review templates provided are generic examples.
-Their usage is optional and the reviewer is free to adapt them.
-
-To get more information about how to review specific parts of Nixpkgs, refer to the documents linked to in the [overview section][overview].
-
-If a pull request contains documentation changes that might require feedback from the documentation team, ping [@NixOS/documentation-team](https://github.com/orgs/nixos/teams/documentation-team) on the pull request.
-
-If you have enough knowledge and experience in a topic and would like to be a long-term reviewer for related submissions, please contact the current reviewers for that topic.
-The main reviewers for a topic can be hard to find as there is no list, but checking past pull requests or git-blaming the code can give some hints.
-
-## How to merge pull requests yourself
-[pr-merge]: #how-to-merge-pull-requests
-
-You can invoke the nixpkgs-merge-bot by commenting `@NixOS/nixpkgs-merge-bot merge`.
-The bot will verify the following conditions, refusing to merge otherwise:
-
-- the PR author should be @r-ryantm or a Nixpkgs committer;
-- the invoker should be among the package maintainers;
-- the package should reside in `pkgs/by-name`.
-
-Further, nixpkgs-merge-bot will ensure all CI checks and the ofborg builds for Linux have successfully completed before merging the pull request.
-Should the checks still be underway, the bot will wait for them to finish before attempting the merge again.
-
-For other pull requests, please see [I opened a PR, how do I get it merged?](#i-opened-a-pr-how-do-i-get-it-merged).
-
-In case the PR is stuck waiting for the author to apply a trivial change and the author allowed members to modify the PR, consider applying it yourself.
-You should pay extra attention to make sure the addition doesn't go against the idea of the original PR and would not be opposed by the author.
-
-Please see the discussion in [GitHub nixpkgs issue #321665](https://github.com/NixOS/nixpkgs/issues/321665) for information on how to proceed to be granted this level of access.
-
-As a maintainer, when you leave the Nix community, please create an issue or post on [Discourse](https://discourse.nixos.org) with references to the packages and modules you maintained, so they can be taken over by other contributors.
-
-# Flow of merged pull requests
-
-After a pull request is merged, it eventually makes it to [Hydra](https://hydra.nixos.org).
-Hydra regularly evaluates and builds Nixpkgs, updating [the official channels](https://channels.nixos.org) when their jobs succeed.
-See [Nix Channel Status](https://status.nixos.org) for the current channel states.
-
-Our primary development branches and their related channels are:
-
-- `master`: The main branch, used for the unstable channels `nixos-unstable`, `nixos-unstable-small` and `nixpkgs-unstable`.
-- `release-YY.MM`: The release branches, used for the stable channels `nixos-YY.MM`, `nixos-YY.MM-small` and `nixpkgs-YY.MM-darwin`.
-
-When a channel is updated, its corresponding branch is also updated to the same commit.
-Example: The [`nixpkgs-unstable` branch](https://github.com/nixos/nixpkgs/tree/nixpkgs-unstable) corresponds to the commit from the [`nixpkgs-unstable` channel](https://channels.nixos.org/nixpkgs-unstable).
-
-Nixpkgs is tied to the NixOS release process, which is documented in the [NixOS Release Wiki](https://nixos.github.io/release-wiki/).
-
-See [this section][branch] to know when to use the release branches.
-
-## Staging
-[staging]: #staging
-
-The staging workflow exists to batch Hydra builds of many packages together.
-It is coordinated in the [Staging room](https://matrix.to/#/#staging:nixos.org) on Matrix.
-
-It works by directing commits that cause [mass rebuilds][mass-rebuild] to a separate `staging` branch that isn't directly built by Hydra.
-Regularly, the `staging` branch is _manually_ merged into a `staging-next` branch to be built by Hydra using the [`nixpkgs:staging-next` jobset](https://hydra.nixos.org/jobset/nixpkgs/staging-next).
-The `staging-next` branch should then only receive changes that fix Hydra builds; **for anything else, ask the [Staging room](https://matrix.to/#/#staging:nixos.org) first**.
-Once it is verified that there are no major regressions, `staging-next` is merged into `master` using [a pull request](https://github.com/NixOS/nixpkgs/issues?q=label%3A%224.workflow%3A+staging%22).
-This is done manually to ensure it's a good use of Hydra's computing resources.
-Since `staging-next` is separate from `staging`, you may merge changes into `staging` at any time.
-
-In order for the `staging` and `staging-next` branches to be up-to-date with the latest commits on `master`, there are regular _automated_ merges from `master` into `staging-next`, and from `staging-next` into `staging`.
-This is implemented using GitHub workflows [here](.github/workflows/periodic-merge-6h.yml) and [here](.github/workflows/periodic-merge-24h.yml).
-
-> [!Note]
-> Changes must be well tested before being merged into any branch.
-> Hydra builds should not be used as a testing platform.
-
-Here is a Git history diagram showing the flow of commits between the three branches:
-```mermaid
-%%{init: {
-    'theme': 'base',
-    'themeVariables': {
-        'gitInv0': '#ff0000',
-        'gitInv1': '#ff0000',
-        'git2': '#ff4444',
-        'commitLabelFontSize': '15px'
-    },
-    'gitGraph': {
-        'showCommitLabel':true,
-        'mainBranchName': 'master',
-        'rotateCommitLabel': true
-    }
-} }%%
-gitGraph
-    commit id:" "
-    branch staging
-    commit id:"  "
-    branch staging-next
-
-    merge master id:"automatic"
-    checkout staging
-    merge staging-next id:"automatic "
-
-    checkout staging-next
-    merge staging type:HIGHLIGHT id:"manual"
-    commit id:"fixup"
-
-    checkout master
-    checkout staging
-    checkout master
-    commit id:"       "
-    checkout staging-next
-    merge master id:"automatic  "
-    checkout staging
-    merge staging-next id:"automatic   "
-
-    checkout staging-next
-    commit id:"fixup "
-    checkout master
-    merge staging-next type:HIGHLIGHT id:"manual (PR)"
-```
-
-
-Here's an overview of the different branches:
-
-| branch | `master` | `staging-next` | `staging` |
-| --- | --- | --- | --- |
-| Used for development | ✔️ | ❌ | ✔️ |
-| Built by Hydra | ✔️ | ✔️ | ❌ |
-| [Mass rebuilds][mass-rebuild] | ❌ | ⚠️  Only to fix Hydra builds | ✔️ |
-| Critical security fixes | ✔️ for non-mass-rebuilds | ✔️ for mass-rebuilds | ❌ |
-| Automatically merged into | `staging-next` | `staging` | - |
-| Manually merged into | - | `master` | `staging-next` |
-
-The staging workflow is used for all stable branches with corresponding names:
-- `master`/`release-YY.MM`
-- `staging`/`staging-YY.MM`
-- `staging-next`/`staging-next-YY.MM`
-
-# Conventions
-
-## Branch conventions
-<!-- This section is relevant to both contributors and reviewers -->
-[branch]: #branch-conventions
-
-Most changes should go to `master`, but sometimes other branches should be used instead.
-Use the following decision process to figure out the right branch:
-
-Is the change [acceptable for releases][release-acceptable] and do you wish to have the change in the release?
-- No: Use the `master` branch, do not backport the pull request.
-- Yes: Can the change be implemented the same way on the `master` and release branches?
-  For example, a package's major version might differ between the `master` and release branches, such that separate security patches are required.
-  - Yes: Use the `master` branch and [backport the pull request](#how-to-backport-pull-requests).
-  - No: Create separate pull requests to the `master` and `release-YY.MM` branches.
-
-If the change causes a [mass rebuild][mass-rebuild], use the staging branch instead:
-- Mass rebuilds to `master` should go to `staging` instead.
-- Mass rebuilds to `release-YY.MM` should go to `staging-YY.MM` instead.
-
-See [this section][staging] for how such changes propagate between the branches.
-
-### Changes acceptable for releases
-[release-acceptable]: #changes-acceptable-for-releases
-
-Only changes to _supported_ releases may be accepted.
-The oldest supported release (`YYMM`) can be found using
-```
-nix-instantiate --eval -A lib.trivial.oldestSupportedRelease
-```
-
-The release branches should generally only receive backwards-compatible changes, both for the Nix expressions and derivations.
-Here are some examples of changes that are okay to backport:
-- ✔️ New packages, modules and functions
-- ✔️ Security fixes
-- ✔️ Package version updates
-  - ✔️ Patch versions with fixes
-  - ✔️ Minor versions with new functionality, but no breaking changes
-
-In addition, major package version updates with breaking changes are also acceptable for:
-- ✔️ Services that would fail without up-to-date client software, such as `spotify`, `steam`, and `discord`
-- ✔️ Security critical applications, such as `firefox` and `chromium`
-
-### Changes causing mass rebuilds
-[mass-rebuild]: #changes-causing-mass-rebuilds
-
-Which changes cause mass rebuilds is not formally defined.
-In order to help the decision, CI automatically assigns [`rebuild` labels](https://github.com/NixOS/nixpkgs/labels?q=rebuild) to pull requests based on the number of packages they cause rebuilds for.
-As a rule of thumb, if the number of rebuilds is **over 500**, it can be considered a mass rebuild.
-To get a sense for what changes are considered mass rebuilds, see [previously merged pull requests to the staging branches](https://github.com/NixOS/nixpkgs/issues?q=base%3Astaging+-base%3Astaging-next+is%3Amerged).
-
-## Commit conventions
-[commit-conventions]: #commit-conventions
-
-- Create one commit for each logical unit.
-
-- If you have commits `pkg-name: oh, forgot to insert whitespace`: squash commits in this case.
-  Use `git rebase -i`.
-  See [Squashing Commits](https://git-scm.com/book/en/v2/Git-Tools-Rewriting-History#_squashing) for additional information.
-
-- For consistency, there should not be a period at the end of the commit message's summary line (the first line of the commit message).
-
-- When adding yourself to `maintainer-list.nix`, make a separate commit with the message `maintainers: add <handle>`.
-  Add the commit before those making changes to the package or module.
-  See [Nixpkgs Maintainers](./maintainers/README.md) for details.
-
-- Make sure you read about any commit conventions specific to the area you're touching.
-  See:
-  - [Commit conventions](./doc/README.md#commit-conventions) for changes to `doc`, the Nixpkgs manual.
-  - [Commit conventions](./lib/README.md#commit-conventions) for changes to `lib`.
-  - [Commit conventions](./nixos/README.md#commit-conventions) for changes to `nixos`.
-  - [Commit conventions](./pkgs/README.md#commit-conventions) for changes to `pkgs`.
-
-### Writing good commit messages
-[writing-good-commit-messages]: #writing-good-commit-messages
-
-It's important to include relevant information in the *commit message*, so others can later understand *why* a change was made.
-While this potentially can be understood by reading code, PR discussion or upstream changes, doing so often requires a lot of work.
-
-Simple package version updates need to include the attribute name, old and new versions, as well as a reference to the release notes or changelog.
-Package upgrades with more extensive changes require more verbose commit messages.
-
-Pull requests should not be squash-merged, as this discards information including detail from commit messages, GPG signatures, and authorship.
-Many pull requests don't make sense as a single commit anyway.
-
-## Code conventions
-[code-conventions]: #code-conventions
-
-### Release notes
-
-If you removed packages or made some major NixOS changes, write about it in the next release notes in [`nixos/doc/manual/release-notes`](./nixos/doc/manual/release-notes).
-
-### File naming and organisation
-
-Names of files and directories should be in lowercase, with dashes between words — kebab case, not camel case.
-For instance, it should be `all-packages.nix`, not `allPackages.nix` or `AllPackages.nix`.
-
-### Formatting
-
-CI [enforces](./.github/workflows/lint.yml) all Nix files to be formatted using the [official Nix formatter](https://github.com/NixOS/nixfmt).
-
-You can ensure this locally using either of these commands:
-```
-nix-shell --run treefmt
-nix develop --command treefmt
-nix fmt
-```
-
-If you're starting your editor in `nix-shell` or `nix develop`, you can also set it up to automatically run `treefmt` on save.
-
-If you have any problems with formatting, please ping the [formatting team](https://nixos.org/community/teams/formatting/) via [@NixOS/nix-formatting](https://github.com/orgs/NixOS/teams/nix-formatting).
-
-### Syntax
-
-- Set up [editorconfig](https://editorconfig.org) for your editor, such that [the settings](./.editorconfig) are automatically applied.
-
-- Use `lowerCamelCase` for variable names, not `UpperCamelCase`.
-  Note, this rule does not apply to package attribute names, which instead follow the rules in [package naming](./pkgs/README.md#package-naming).
-
-- Functions should list their expected arguments as precisely as possible.
-  That is, write
-
-  ```nix
-  {
-    stdenv,
-    fetchurl,
-    perl,
-  }:
-  <...>
-  ```
-
-  instead of
-
-  ```nix
-  args: with args; <...>
-  ```
-
-  or
-
-  ```nix
-  {
-    stdenv,
-    fetchurl,
-    perl,
-    ...
-  }:
-  <...>
-  ```
-
-  For functions that are truly generic in the number of arguments, but have some required arguments, you should write them using an `@`-pattern:
-
-  ```nix
-  {
-    stdenv,
-    doCoverageAnalysis ? false,
-    ...
-  }@args:
-
-  stdenv.mkDerivation (args // { foo = if doCoverageAnalysis then "bla" else ""; })
-  ```
-
-  instead of
-
-  ```nix
-  args:
-
-  args.stdenv.mkDerivation (
-    args
-    // {
-      foo = if args ? doCoverageAnalysis && args.doCoverageAnalysis then "bla" else "";
-    }
-  )
-  ```
-
-- Unnecessary string conversions should be avoided.
-  Do
-
-  ```nix
-  { rev = version; }
-  ```
-
-  instead of
-
-  ```nix
-  { rev = "${version}"; }
-  ```
-
-- Building lists conditionally _should_ be done with `lib.optional(s)` instead of using `if cond then [ ... ] else null` or `if cond then [ ... ] else [ ]`.
-
-  ```nix
-  { buildInputs = lib.optional stdenv.hostPlatform.isDarwin iconv; }
-  ```
-
-  instead of
-
-  ```nix
-  { buildInputs = if stdenv.hostPlatform.isDarwin then [ iconv ] else null; }
-  ```
-
-  As an exception, an explicit conditional expression with null can be used when fixing a important bug without triggering a mass rebuild.
-  If this is done a follow up pull request _should_ be created to change the code to `lib.optional(s)`.
-
-# Practical contributing advice
-
-To contribute effectively and efficiently, you need to be aware of how the process generally works.
-This section aims to document the process as we live it in Nixpkgs to set the right expectations and give practical tips on how to work with it.
-
-## I opened a PR, how do I get it merged?
-[i-opened-a-pr-how-do-i-get-it-merged]:#i-opened-a-pr-how-do-i-get-it-merged
-
-In order for your PR to be merged, a committer needs to review and merge it.
-Because committers are mostly independent, unpaid volunteers, this can take time.
-It is entirely normal for your PR to sit around without any feedback for days, weeks or sometimes even months.
-We strive to avoid this, but the reality is that it happens frequently.
-Even when you get feedback, follow-ups may take just as long.
-Don't be intimidated and kindly ask for feedback again every so often.
-If your change is good, it will eventually be merged.
-
-You can often speed up the process by understanding the committer's perspective and preparing your PR with reviewing in mind.
-
-### The committer's perspective
-
-PRs have varying quality and even the best people make mistakes.
-Committers need to assess whether a PR's changes are good or not.
-To merge, at least one committer has to be confident about its quality.
-
-Committers typically assess three aspects:
-
-1. Whether the change's intention is necessary and desirable.
-2. Whether the code quality of your changes is good.
-3. Whether the produced artifacts are good.
-
-To get your PR merged quickly and smoothly, you should help convince committers in these aspects.
-
-### How to help committers assess your PR
-
-It's best to explain *why* you've made your change, because guessing the intention is not always possible.
-This does not apply to trivial changes like version updates, because the intention is obvious.
-For more nuanced changes or even major version upgrades, it helps if you explain the background behind your change.
-For example, if you're adding a package, explain what it is and why it should be in Nixpkgs.
-This goes hand in hand with [Writing good commit messages](#writing-good-commit-messages).
-
-To show the quality of your code, you should focus on making it *reviewable*.
-First, take a look at your code changes yourself and try to put yourself into the shoes of someone who didn't just write that code.
-Would you immediately know what the code does or why it is needed by glancing at it?
-If not, reviewers will notice this and will ask you to clarify the code by refactoring it and/or adding code comments.
-Doing this preemptively can save a lot of time.
-Doing multiple unrelated changes in a single commit can become hard to review quickly.
-Thus, consider multiple atomic commits to tell the story of your change.
-There is a balance to strike however: over-fragmentation causes friction.
-
-The artifacts are the hardest to assess because PRs touch all sorts of components: applications, libraries, NixOS modules, editor plugins and many other things.
-Any individual committer can only really assess components that they themselves know how to use.
-Yet, they must still be convinced somehow.
-There isn't a good generic solution to this but there are some ways to ease it:
-
-- Provide smoke tests that can be run without much research or setup.
-
-  Committers usually don't have the time or interest to learn how your component works and how they could test its functionality.
-  Try to provide a quick guide on how to use it in a meaningful way or a ready-made command that demonstrates that it works as expected.
-  The committer can use this to convince themselves that your change is good.
-  If it can be automated, you could even turn this into an automated NixOS test which reviewers could simply run.
-
-- Invite other users of the component to try it out and report their findings.
-
-  Seeing other users testing the changes and having it work for them can convince committers, too.
-
-- Describe what you have done to test your PR.
-
-  It also helps, if you can additionally show that you have done sufficient quality assurance on your changes.
-
-- Become a maintainer of the component.
-
-  Listed maintainers generally receive more trust when it comes to changes to their maintained components.
-
-Even if you adhere to all of these recommendations, it is still quite possible for your PR to be forgotten or abandoned by any given committer.
-Please remain mindful of them doing this work on their own volition and unpaid in their free time and therefore [owing you nothing](https://mikemcquaid.com/open-source-maintainers-owe-you-nothing/).
-Causing a stink in such a situation is a surefire way to get any other potential committer to not want to look at your PR either.
-Ask them nicely whether they still intend to review your PR and find yourself another committer to look at your PR if not.
-
-### How can I get a committer to look at my PR?
-
-- Improve skimmability: use a simple descriptive PR title outlining _what_ is done and _why_.
-  Details go in commit messages.
-- Improve discoverability: apply all relevant labels, tick all relevant PR body checkboxes.
-- Wait.
-  Reviewers frequently browse open PRs and may happen to run across yours and take a look.
-- Get non-committers to review/approve.
-  Many committers filter open PRs for low-hanging fruit that have already been reviewed.
-- [@-mention](https://github.blog/news-insights/mention-somebody-they-re-notified/) someone and ask them nicely.
-- Post in one of the channels made for this purpose if there has been no activity for at least one week:
-  - The current "PRs ready for review" or "PRs already reviewed" threads in the [NixOS Discourse](https://discourse.nixos.org/c/dev/14).
-  - The [Nixpkgs Review Requests Matrix room](https://matrix.to/#/#review-requests:nixos.org).
-  - Similar threads/rooms in unofficial NixOS spaces, such as Discord.
-
-### CI failed or got stuck on my PR, what do I do?
-
-First, ensure that the failure is actually related to your change.
-Sometimes, the CI system simply has a hiccup or the check was broken by someone else before.
-Read through the error message; it's usually quite easy to tell whether it is caused by changes to the component you touched.
-If it is indeed caused by your change, try to fix it.
-Don't be afraid of asking for advice if you're uncertain how to do that, others might have fixed such issues already and can help you out.
-Your PR will not be merged while CI is still failing.
-
-ofborg builds can often get stuck, particularly in PRs targeting `staging` and in builders for the Darwin platform.
-Reviewers will know how to handle them or when to ignore them.
-Don't worry about it.
-However, if there is a build failure and it was caused by your change, you need to investigate it.
-If ofborg reveals the build to be broken on a platform that you don't have access to, consider setting your package's `meta.broken`, `meta.badPlatforms` or `meta.platforms` accordingly.
-
-When in any doubt, please ask via comments or through one of the help channels.
-
-## I received a review, how do I get it over the finish line?
-
-Most likely, a reviewer wants you to change a few things or requires further input.
-
-A reviewer may have taken a look at the code and it looked good to them ("Diff LGTM"), but they still need to be convinced of the artifact's quality.
-They might also be waiting on input from other users or maintainers on whether the intention and direction of your PR makes sense.
-If you know of people who could help clarify any of this, please bring the PR to their attention.
-The current state of the PR is frequently not clearly communicated, so please don't hesitate to ask about it if it's unclear to you.
-
-It's also possible for the reviewer to not be convinced that your PR is necessary or that the method you've chosen is the right one.
-
-Please explain your intentions and reasoning to the committer in such a case.
-There may be constraints you had to work with which they're not aware of or qualities of your approach that they didn't immediately notice.
-If these weren't clear to the reviewer, that's a good sign you should explain them in your commit message or code comments!
-
-There are some further pitfalls and realities to be aware of:
-
-### Aim to reduce cycles
-
-Be prepared for it to take a while for the reviewer to get back to you after you respond.
-This is simply the reality of projects at the scale of Nixpkgs.
-As such, make sure to respond to _all_ feedback at once.
-It wastes everyone's time to wait for a couple of days just to have the reviewer need to remind you to address something they asked for.
-
-### A reviewer requested a bunch of insubstantial changes
-
-The people involved in Nixpkgs care about code quality.
-Once in Nixpkgs, the code needs to be maintained for many years to come.
-Therefore, you will likely be asked to do something different or adhere to a standard.
-
-Sometimes however, they also care a bit too much and may ask you to adhere to a personal preference of theirs.
-It's not always easy to tell whether or not the requested changes must be addressed.
-Sometimes, another reviewer may even have a _conflicting_ opinion on some points.
-
-It is convention to mark review comments that are not required to merge as nitpicks, but this is not always followed.
-As the author, you should still take a look at these, as they will often reveal best practices and unwritten rules.
-Those usually have good reasons behind them and you may want to pick them up as well.
-
-Please keep in mind that reviewers always mean well.
-Their intent is not to denounce your code, they want your code to be as good as it can be.
-Through their experience, they may also take notice of a seemingly insignificant issue that has caused problems before.
-
-Sometimes however, they can also get a bit carried away and become too perfectionistic.
-If you feel some of the requests are unreasonable, out of scope, or merely a matter of personal preference, try to nicely ask the reviewers whether these requests are *critical* to the PR's success.
-
-While we do have a set of [official standards for the Nix community](https://github.com/NixOS/rfcs), we don't have standards for everything and there are often multiple valid ways to achieve the same goal.
-Unless there are standards forbidding the patterns used in your code or there are serious technical, maintainability or readability issues with your code, you can disregard these requests.
-Please communicate this clearly though; a simple "I prefer it this way and see no major issue maintaining it" can save a lot of arguing.
-
-If you are unsure about some change requests, please ask reviewers *why* they requested them.
-This will usually reveal how important they deem it to be and will help educate you about standards, best practices, unwritten rules as well as preferences people have and why.
-
-Some committers have stronger opinions on some things and may not want to merge your PR if you don't follow their requests.
-It is totally fine to get yourself a second or third opinion in such a case.
-
-### Committers work on a push-basis
-
-It's possible for you to get a review but nothing happens afterwards, even if you respond to review comments.
-A committer not following up on your PR does not necessarily mean they're disinterested, they may have simply had other circumstances preventing them from doing so.
-
-Committers typically handle many PRs at the same time and it is not realistic for them to keep up with all of them immediately.
-If someone approved and didn't merge a few days later, they most likely just forgot.
-
-Please see it as your responsibility to actively remind reviewers of your open PRs.
-
-The easiest way to do so is to notify them via GitHub.
-Github notifies people involved, whenever you add a comment or push to your PR or re-request their review.
-Doing any of that will get their attention again.
-Everyone deserves proper attention, and yes, that includes you!
-However, please be mindful that committers can sadly not always give everyone the attention they deserve.
-
-It may very well be the case that you have to do this every time you need the committer to follow up upon your PR.
-Again, this is a community project so please be mindful of people's circumstances here; be nice when requesting reviews again.
-
-It may also be the case that the committer has lost interest or isn't familiar enough with the component you're touching to be comfortable to merge.
-They will likely not immediately state that fact, so please ask for clarification and don't hesitate to find yourself another committer to take a look.
-
-### Nothing helped
-
-If you followed these guidelines but still got no results or if you feel that you have been wronged, please explicitly reach out to the greater community.
-
-The [NixOS Discourse](https://discourse.nixos.org) is a great place to do this, as it has historically been the asynchronous medium with the greatest concentration of committers and other people who are involved in Nixpkgs.
-There is a dedicated discourse thread [PRs in distress](https://discourse.nixos.org/t/prs-in-distress/3604) where you can link your PR, if everything else fails.
-The [Nixpkgs / NixOS contributions Matrix channel](https://matrix.to/#/#dev:nixos.org) is the best synchronous channel with the same qualities.
-
-Please reserve these for cases where you've made a serious effort in trying to get the attention of multiple active committers and provided realistic means for them to assess your PR's quality.
-As mentioned previously, it is unfortunately perfectly normal for a PR to sit around for weeks.
-
-Please don't blow up situations where progress is happening but is merely not going fast enough for your tastes.
-Honking in a traffic jam will not make you go any faster.

COPYING

@@ -1,4 +1,4 @@
-Copyright (c) 2003-2025 Eelco Dolstra and the Nixpkgs/NixOS contributors
+Copyright (c) 2003-2018 Eelco Dolstra and the Nixpkgs/NixOS contributors
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
@@ -18,3 +18,12 @@ NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
 LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
 OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+======================================================================
+
+Note: the license above does not apply to the packages built by the
+Nix Packages collection, merely to the package descriptions (i.e., Nix
+expressions, build scripts, etc.).  It also might not apply to patches
+included in Nixpkgs, which may be derivative works of the packages to
+which they apply.  The aforementioned artifacts are all covered by the
+licenses of the respective packages.

README.md

@@ -1,85 +1,41 @@
-<p align="center">
-  <a href="https://nixos.org">
-    <picture>
-      <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos.svg">
-      <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos-white.png">
-      <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos.svg" width="500px" alt="NixOS logo">
-    </picture>
-  </a>
-</p>
+[<img src="https://nixos.org/logo/nixos-hires.png" width="500px" alt="logo" />](https://nixos.org/nixos)
 
-<p align="center">
-  <a href="CONTRIBUTING.md"><img src="https://img.shields.io/github/contributors-anon/NixOS/nixpkgs" alt="Contributors badge" /></a>
-  <a href="https://opencollective.com/nixos"><img src="https://opencollective.com/nixos/tiers/supporter/badge.svg?label=supporters&color=brightgreen" alt="Open Collective supporters" /></a>
-</p>
+[![Code Triagers Badge](https://www.codetriage.com/nixos/nixpkgs/badges/users.svg)](https://www.codetriage.com/nixos/nixpkgs)
 
-[Nixpkgs](https://github.com/nixos/nixpkgs) is a collection of over 120,000 software packages that can be installed with the [Nix](https://nixos.org/nix/) package manager.
-It also implements [NixOS](https://nixos.org/nixos/), a purely-functional Linux distribution.
+Nixpkgs is a collection of packages for the [Nix](https://nixos.org/nix/) package
+manager. It is periodically built and tested by the [Hydra](https://hydra.nixos.org/)
+build daemon as so-called channels. To get channel information via git, add
+[nixpkgs-channels](https://github.com/NixOS/nixpkgs-channels.git) as a remote:
 
-# Manuals
+```
+% git remote add channels https://github.com/NixOS/nixpkgs-channels.git
+```
 
-* [NixOS Manual](https://nixos.org/nixos/manual) - how to install, configure, and maintain a purely-functional Linux distribution
-* [Nixpkgs Manual](https://nixos.org/nixpkgs/manual/) - contributing to Nixpkgs and using programming-language-specific Nix expressions
-* [Nix Package Manager Manual](https://nixos.org/nix/manual) - how to write Nix expressions (programs), and how to use Nix command line tools
+For stability and maximum binary package support, it is recommended to maintain
+custom changes on top of one of the channels, e.g. `nixos-18.09` for the latest
+release and `nixos-unstable` for the latest successful build of master:
 
-# Community
+```
+% git remote update channels
+% git rebase channels/nixos-18.09
+```
+
+For pull-requests, please rebase onto nixpkgs `master`.
+
+[NixOS](https://nixos.org/nixos/) Linux distribution source code is located inside
+`nixos/` folder.
+
+* [NixOS installation instructions](https://nixos.org/nixos/manual/#ch-installation)
+* [Documentation (Nix Expression Language chapter)](https://nixos.org/nix/manual/#ch-expression-language)
+* [Manual (How to write packages for Nix)](https://nixos.org/nixpkgs/manual/)
+* [Manual (NixOS)](https://nixos.org/nixos/manual/)
+* [Community maintained wiki](https://nixos.wiki/)
+* [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
+* [Continuous package builds for 18.09 release](https://hydra.nixos.org/jobset/nixos/release-18.09)
+* [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
+* [Tests for 18.09 release](https://hydra.nixos.org/job/nixos/release-18.09/tested#tabs-constituents)
+
+Communication:
 
 * [Discourse Forum](https://discourse.nixos.org/)
-* [Matrix Chat](https://matrix.to/#/#space:nixos.org)
-* [NixOS Weekly](https://weekly.nixos.org/)
-* [Official wiki](https://wiki.nixos.org/)
-* [Community-maintained list of ways to get in touch](https://wiki.nixos.org/wiki/Get_In_Touch#Chat) (Discord, Telegram, IRC, etc.)
-
-# Other Project Repositories
-
-The sources of all official Nix-related projects are in the [NixOS organization on GitHub](https://github.com/NixOS/).
-Here are some of the main ones:
-
-* [Nix](https://github.com/NixOS/nix) - the purely functional package manager
-* [NixOps](https://github.com/NixOS/nixops) - the tool to remotely deploy NixOS machines
-* [nixos-hardware](https://github.com/NixOS/nixos-hardware) - NixOS profiles to optimize settings for different hardware
-* [Nix RFCs](https://github.com/NixOS/rfcs) - the formal process for making substantial changes to the community
-* [NixOS homepage](https://github.com/NixOS/nixos-homepage) - the [NixOS.org](https://nixos.org) website
-* [hydra](https://github.com/NixOS/hydra) - our continuous integration system
-* [NixOS Artwork](https://github.com/NixOS/nixos-artwork) - NixOS artwork
-
-# Continuous Integration and Distribution
-
-Nixpkgs and NixOS are built and tested by our continuous integration system, [Hydra](https://hydra.nixos.org/).
-
-* [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for the NixOS 25.05 release](https://hydra.nixos.org/jobset/nixos/release-25.05)
-* [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for the NixOS 25.05 release](https://hydra.nixos.org/job/nixos/release-25.05/tested#tabs-constituents)
-
-Artifacts successfully built with Hydra are published to cache at https://cache.nixos.org/.
-When successful build and test criteria are met, the Nixpkgs expressions are distributed via [Nix channels](https://nix.dev/manual/nix/stable/command-ref/nix-channel.html).
-
-# Contributing
-
-Nixpkgs is among the most active projects on GitHub.
-While thousands of open issues and pull requests might seem a lot at first, it helps consider it in the context of the scope of the project.
-Nixpkgs describes how to build tens of thousands of pieces of software and implements a Linux distribution.
-The [GitHub Insights](https://github.com/NixOS/nixpkgs/pulse) page gives a sense of the project activity.
-
-Community contributions are always welcome through GitHub Issues and Pull Requests.
-
-For more information about contributing to the project, please visit the [contributing page](CONTRIBUTING.md).
-
-# Donations
-
-The infrastructure for NixOS and related projects is maintained by a nonprofit organization, the [NixOS Foundation](https://nixos.org/nixos/foundation.html).
-To ensure the continuity and expansion of the NixOS infrastructure, we are looking for donations to our organization.
-
-You can donate to the NixOS foundation through [SEPA bank transfers](https://nixos.org/donate.html) or by using Open Collective:
-
-<a href="https://opencollective.com/nixos#support"><img src="https://opencollective.com/nixos/tiers/supporter.svg?width=890" /></a>
-
-# License
-
-Nixpkgs is licensed under the [MIT License](COPYING).
-
-Note:
-MIT license does not apply to the packages built by Nixpkgs, merely to the files in this repository (the Nix expressions, build scripts, NixOS modules, etc.).
-It also might not apply to patches included in Nixpkgs, which may be derivative works of the packages to which they apply.
-The aforementioned artifacts are all covered by the licenses of the respective packages.
+* [IRC - #nixos on freenode.net](irc://irc.freenode.net/#nixos)

ci/OWNERS

@@ -1,502 +0,0 @@
-# This file is used to describe who owns what in this repository.
-# Users/teams will get review requests for PRs that change their files.
-#
-# This file does not replace `meta.maintainers`
-# but is instead used for other things than derivations and modules,
-# like documentation, package sets, and other assets.
-#
-# This file uses the same syntax as the natively supported CODEOWNERS file,
-# see https://help.github.com/articles/about-codeowners/ for documentation.
-# However it comes with some notable differences:
-# - There is no need for user/team listed here to have write access.
-# - No reviews will be requested for PRs that target the wrong base branch.
-#
-# Processing of this file is implemented in workflows/codeowners-v2.yml
-
-# CI
-/.github/*_TEMPLATE*                    @SigmaSquadron
-/.github/actions                        @NixOS/nixpkgs-ci
-/.github/workflows                      @NixOS/nixpkgs-ci
-/ci                                     @NixOS/nixpkgs-ci
-/ci/OWNERS                              @infinisil @philiptaron
-
-# Development support
-/.editorconfig @Mic92 @zowoq
-/shell.nix @infinisil @NixOS/Security
-
-# Libraries
-/lib                        @infinisil @hsjobeki
-/lib/generators.nix         @infinisil @hsjobeki @Profpatsch
-/lib/cli.nix                @infinisil @hsjobeki @Profpatsch
-/lib/debug.nix              @infinisil @hsjobeki @Profpatsch
-/lib/asserts.nix            @infinisil @hsjobeki @Profpatsch
-/lib/path/*                 @infinisil @hsjobeki
-/lib/fileset                @infinisil @hsjobeki
-## Standard environment–related libraries
-/lib/customisation.nix      @alyssais @NixOS/stdenv
-/lib/derivations.nix        @alyssais @NixOS/stdenv
-/lib/fetchers.nix           @alyssais @NixOS/stdenv
-/lib/meta.nix               @alyssais @NixOS/stdenv
-/lib/source-types.nix       @alyssais @NixOS/stdenv
-/lib/systems                @alyssais @NixOS/stdenv
-## Libraries / Module system
-/lib/modules.nix            @infinisil @roberth @hsjobeki
-/lib/types.nix              @infinisil @roberth @hsjobeki
-/lib/options.nix            @infinisil @roberth @hsjobeki
-/lib/tests/modules.sh       @infinisil @roberth @hsjobeki
-/lib/tests/modules          @infinisil @roberth @hsjobeki
-
-# Nixpkgs Internals
-/default.nix                                     @Ericson2314
-/pkgs/top-level/default.nix                      @Ericson2314
-/pkgs/top-level/impure.nix                       @Ericson2314
-/pkgs/top-level/stage.nix                        @Ericson2314
-/pkgs/top-level/splice.nix                       @Ericson2314
-/pkgs/top-level/release-cross.nix                @Ericson2314
-/pkgs/top-level/by-name-overlay.nix              @infinisil @philiptaron
-/pkgs/stdenv                                     @philiptaron @NixOS/stdenv
-/pkgs/stdenv/generic                             @Ericson2314 @NixOS/stdenv
-/pkgs/stdenv/generic/check-meta.nix              @Ericson2314 @NixOS/stdenv
-/pkgs/stdenv/cross                               @Ericson2314 @NixOS/stdenv
-/pkgs/build-support                              @philiptaron
-/pkgs/build-support/cc-wrapper                   @Ericson2314
-/pkgs/build-support/bintools-wrapper             @Ericson2314
-/pkgs/build-support/setup-hooks                  @Ericson2314
-/pkgs/build-support/setup-hooks/arrayUtilities   @ConnorBaker
-/pkgs/build-support/setup-hooks/auto-patchelf.sh @layus
-/pkgs/by-name/au/auto-patchelf                   @layus
-
-## Format generators/serializers
-/pkgs/pkgs-lib                                   @Stunkymonkey @h7x4
-
-# Nixpkgs build-support
-/pkgs/build-support/writers @lassulus @Profpatsch
-
-# Nixpkgs make-disk-image
-/doc/build-helpers/images/makediskimage.section.md  @raitobezarius
-/nixos/lib/make-disk-image.nix                 @raitobezarius
-
-# Nix, the package manager
-# @raitobezarius is not "code owner", but is listed here to be notified of changes
-# pertaining to the Nix package manager.
-# i.e. no authority over those files.
-pkgs/tools/package-management/nix/                    @NixOS/nix-team @raitobezarius
-nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobezarius
-
-# Nixpkgs documentation
-/maintainers/scripts/db-to-md.sh @jtojnar @ryantm
-/maintainers/scripts/doc @jtojnar @ryantm
-
-# Contributor documentation
-/CONTRIBUTING.md @infinisil
-/.github/PULL_REQUEST_TEMPLATE.md @infinisil
-/doc/contributing/ @infinisil
-/doc/contributing/contributing-to-documentation.chapter.md @jtojnar @infinisil
-/lib/README.md @infinisil
-/doc/README.md @infinisil
-/nixos/README.md @infinisil
-/pkgs/README.md @infinisil
-/pkgs/by-name/README.md @infinisil
-/maintainers/README.md @infinisil
-
-# User-facing development documentation
-/doc/development.md @infinisil
-/doc/development @infinisil
-
-# NixOS Internals
-/nixos/default.nix                                    @infinisil
-/nixos/lib/from-env.nix                               @infinisil
-/nixos/lib/eval-config.nix                            @infinisil
-/nixos/modules/misc/ids.nix                           @R-VdP
-/nixos/modules/system/activation/bootspec.nix         @grahamc @cole-h @raitobezarius
-/nixos/modules/system/activation/bootspec.cue         @grahamc @cole-h @raitobezarius
-
-# NixOS Render Docs
-/pkgs/by-name/ni/nixos-render-docs @fricklerhandwerk @GetPsyched @hsjobeki
-/doc/redirects.json                @fricklerhandwerk @GetPsyched @hsjobeki
-/nixos/doc/manual/redirects.json   @fricklerhandwerk @GetPsyched @hsjobeki
-
-# NixOS integration test driver
-/nixos/lib/test-driver  @tfc
-
-# NixOS QEMU virtualisation
-/nixos/modules/virtualisation/qemu-vm.nix           @raitobezarius
-
-# ACME
-/nixos/modules/security/acme                @NixOS/acme
-
-# Systemd
-/nixos/modules/system/boot/systemd.nix      @NixOS/systemd
-/nixos/modules/system/boot/systemd          @NixOS/systemd
-/nixos/lib/systemd-*.nix                    @NixOS/systemd
-/pkgs/os-specific/linux/systemd             @NixOS/systemd
-
-# Systemd-boot
-/nixos/modules/system/boot/loader/systemd-boot      @JulienMalka
-
-# Limine
-/nixos/modules/system/boot/loader/limine        @lzcunt @phip1611 @programmerlexi @johnrtitor
-/nixos/tests/limine                             @johnrtitor
-
-# Images and installer media
-/nixos/modules/profiles/installation-device.nix @ElvishJerricco
-/nixos/modules/installer/cd-dvd/                @ElvishJerricco
-/nixos/modules/installer/sd-card/
-
-# Amazon
-/nixos/modules/virtualisation/amazon-init.nix                  @arianvp
-/nixos/modules/virtualisation/ec2-data.nix                     @arianvp
-/nixos/modules/virtualisation/amazon-options.nix               @arianvp
-/nixos/modules/virtualisation/amazon-image.nix                 @arianvp
-/nixos/maintainers/scripts/ec2/                                @arianvp
-/nixos/modules/services/misc/amazon-ssm-agent.nix              @arianvp
-/nixos/tests/amazon-ssm-agent.nix                              @arianvp
-/nixos/modules/system/boot/grow-partition.nix                  @arianvp
-/nixos/modules/services/monitoring/amazon-cloudwatch-agent.nix @philipmw
-/nixos/tests/amazon-cloudwatch-agent.nix                       @philipmw
-
-# Monitoring
-/nixos/modules/services/monitoring/fluent-bit.nix @arianvp
-/nixos/tests/fluent-bit.nix                       @arianvp
-
-# nixos-rebuild-ng
-/pkgs/by-name/ni/nixos-rebuild-ng                 @thiagokokada
-
-# Updaters
-## update.nix
-/maintainers/scripts/update.nix   @jtojnar
-/maintainers/scripts/update.py    @jtojnar
-## common-updater-scripts
-/pkgs/common-updater/scripts/update-source-version    @jtojnar
-
-# Android tools, libraries, and environments
-/pkgs/development/android*                    @NixOS/android
-/pkgs/development/mobile/android*             @NixOS/android
-/pkgs/applications/editors/android-studio*    @NixOS/android
-/doc/languages-frameworks/android*            @NixOS/android
-/pkgs/by-name/an/android*                     @NixOS/android
-
-# Python-related code and docs
-/doc/languages-frameworks/python.section.md   @mweinelt @natsukium
-/maintainers/scripts/update-python-libraries  @mweinelt @natsukium
-/pkgs/by-name/up/update-python-libraries      @mweinelt @natsukium
-/pkgs/development/interpreters/python         @mweinelt @natsukium
-/pkgs/top-level/python-packages.nix                     @natsukium
-/pkgs/top-level/release-python.nix                      @natsukium
-
-# CUDA
-/pkgs/top-level/cuda-packages.nix             @NixOS/cuda-maintainers
-/pkgs/top-level/release-cuda.nix              @NixOS/cuda-maintainers
-/pkgs/development/cuda-modules                @NixOS/cuda-maintainers
-
-# Haskell
-/doc/languages-frameworks/haskell.section.md  @sternenseemann @maralorn @wolfgangwalther
-/maintainers/scripts/haskell                  @sternenseemann @maralorn @wolfgangwalther
-/pkgs/development/compilers/ghc               @sternenseemann @maralorn @wolfgangwalther
-/pkgs/development/haskell-modules             @sternenseemann @maralorn @wolfgangwalther
-/pkgs/test/haskell                            @sternenseemann @maralorn @wolfgangwalther
-/pkgs/top-level/release-haskell.nix           @sternenseemann @maralorn @wolfgangwalther
-/pkgs/top-level/haskell-packages.nix          @sternenseemann @maralorn @wolfgangwalther
-
-# Perl
-/pkgs/development/interpreters/perl @stigtsp @zakame @marcusramberg
-/pkgs/top-level/perl-packages.nix   @stigtsp @zakame @marcusramberg
-/pkgs/development/perl-modules      @stigtsp @zakame @marcusramberg
-
-# R
-/pkgs/applications/science/math/R   @jbedo
-/pkgs/development/r-modules         @jbedo
-
-# Rust
-/pkgs/development/compilers/rust @alyssais @Mic92 @zowoq @winterqt @figsoda
-/pkgs/build-support/rust @zowoq @winterqt @figsoda
-/pkgs/build-support/rust/fetch-cargo-vendor* @TomaSajt
-/doc/languages-frameworks/rust.section.md @zowoq @winterqt @figsoda
-
-# Tcl
-/pkgs/development/interpreters/tcl  @fgaz
-/pkgs/development/libraries/tk      @fgaz
-/pkgs/top-level/tcl-packages.nix    @fgaz
-/pkgs/development/tcl-modules       @fgaz
-/doc/languages-frameworks/tcl.section.md @fgaz
-
-# C compilers
-/pkgs/development/compilers/gcc
-/pkgs/development/compilers/llvm @alyssais @RossComputerGuy @NixOS/llvm
-/pkgs/development/compilers/emscripten @raitobezarius
-/doc/toolchains/llvm.chapter.md @alyssais @RossComputerGuy @NixOS/llvm
-/doc/languages-frameworks/emscripten.section.md @raitobezarius
-
-# Audio
-/nixos/modules/services/audio/botamusique.nix @mweinelt
-/nixos/modules/services/audio/snapserver.nix @mweinelt
-/nixos/tests/botamusique.nix @mweinelt
-/nixos/tests/snapcast.nix @mweinelt
-
-# Browsers
-/pkgs/build-support/build-mozilla-mach @mweinelt
-/pkgs/applications/networking/browsers/firefox/update.nix
-/pkgs/applications/networking/browsers/firefox/packages/firefox.nix @mweinelt
-/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-*.nix @mweinelt
-/pkgs/applications/networking/browsers/librewolf @squalus @DominicWrege @fpletz @LordGrimmauld
-/pkgs/applications/networking/browsers/chromium @emilylange @networkException
-/nixos/tests/chromium.nix @emilylange @networkException
-
-# Certificate Authorities
-pkgs/by-name/ca/cacert @ajs124 @lukegb @mweinelt
-pkgs/development/libraries/nss/ @ajs124 @lukegb @mweinelt
-pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
-
-# Java
-/doc/languages-frameworks/java.section.md @NixOS/java
-/doc/languages-frameworks/gradle.section.md @NixOS/java
-/doc/languages-frameworks/maven.section.md @NixOS/java
-/nixos/modules/programs/java.nix @NixOS/java
-/pkgs/top-level/java-packages.nix @NixOS/java
-
-# Jetbrains
-/pkgs/applications/editors/jetbrains @edwtjo @leona-ya @theCapypara
-
-# Licenses
-/lib/licenses.nix @alyssais @emilazy
-
-# Qt
-/pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000 @ttuegel
-/pkgs/development/libraries/qt-6 @K900 @NickCao @SuperSandro2000 @ttuegel
-
-# KDE / Plasma 5
-/pkgs/applications/kde @K900 @NickCao @SuperSandro2000 @ttuegel
-/pkgs/desktops/plasma-5 @K900 @NickCao @SuperSandro2000 @ttuegel
-/pkgs/development/libraries/kde-frameworks @K900 @NickCao @SuperSandro2000 @ttuegel
-
-# KDE / Plasma 6
-/pkgs/kde @K900 @NickCao @SuperSandro2000 @ttuegel
-/maintainers/scripts/kde @K900 @NickCao @SuperSandro2000 @ttuegel
-
-# PostgreSQL and related stuff
-/pkgs/by-name/po/postgresqlTestHook @NixOS/postgres
-/pkgs/by-name/ps/psqlodbc @NixOS/postgres
-/pkgs/servers/sql/postgresql @NixOS/postgres
-/pkgs/development/tools/rust/cargo-pgrx @NixOS/postgres
-/nixos/modules/services/databases/postgresql.md @NixOS/postgres
-/nixos/modules/services/databases/postgresql.nix @NixOS/postgres
-/nixos/tests/postgresql @NixOS/postgres
-
-# MySQL/MariaDB and related stuff
-/nixos/modules/services/databases/mysql.nix     @6543
-/nixos/modules/services/backup/mysql-backup.nix @6543
-
-# Hardened profile & related modules
-/nixos/modules/profiles/hardened.nix                       @joachifm
-/nixos/modules/security/lock-kernel-modules.nix            @joachifm
-/nixos/modules/security/misc.nix                           @joachifm
-/nixos/tests/hardened.nix                                  @joachifm
-/pkgs/os-specific/linux/kernel/hardened/        @fabianhjr @joachifm
-
-# Home Automation
-/nixos/modules/services/home-automation/home-assistant.nix @mweinelt
-/nixos/modules/services/home-automation/zigbee2mqtt.nix @mweinelt
-/nixos/tests/home-assistant.nix @mweinelt
-/nixos/tests/zigbee2mqtt.nix @mweinelt
-/pkgs/servers/home-assistant @mweinelt
-/pkgs/by-name/es/esphome @mweinelt
-
-# Linux kernel
-/pkgs/top-level/linux-kernels.nix @NixOS/linux-kernel
-/pkgs/os-specific/linux/kernel/ @NixOS/linux-kernel
-
-# Network Time Daemons
-/pkgs/by-name/ch/chrony @thoughtpolice
-/pkgs/by-name/nt/ntp @thoughtpolice
-/pkgs/by-name/op/openntpd @thoughtpolice
-/nixos/modules/services/networking/ntp @thoughtpolice
-
-# Network
-/pkgs/by-name/ke/kea @mweinelt
-/pkgs/by-name/ba/babeld @mweinelt
-/nixos/modules/services/networking/babeld.nix @mweinelt
-/nixos/modules/services/networking/kea.nix @mweinelt
-/nixos/modules/services/networking/knot.nix @mweinelt
-/nixos/modules/services/monitoring/prometheus/exporters/kea.nix @mweinelt
-/nixos/tests/babeld.nix @mweinelt
-/nixos/tests/kea.nix @mweinelt
-/nixos/tests/knot.nix @mweinelt
-
-# Web servers
-/doc/packages/nginx.section.md @raitobezarius
-/pkgs/servers/http/nginx/ @raitobezarius
-/nixos/modules/services/web-servers/nginx/ @raitobezarius
-
-# D
-/pkgs/build-support/dlang @jtbx @TomaSajt
-
-# Dhall
-/pkgs/development/dhall-modules      @Gabriella439 @Profpatsch
-/pkgs/development/interpreters/dhall @Gabriella439 @Profpatsch
-
-# Idris
-/pkgs/development/idris-modules @Infinisil
-/pkgs/development/compilers/idris2 @mattpolzin
-
-# Bazel
-/pkgs/development/tools/build-managers/bazel @Profpatsch
-
-# NixOS modules for e-mail and dns services
-/nixos/modules/services/mail/mailman.nix    @peti
-/nixos/modules/services/mail/postfix.nix    @peti
-/nixos/modules/services/networking/bind.nix @peti
-/nixos/modules/services/mail/rspamd.nix     @peti
-
-# Emacs
-/pkgs/applications/editors/emacs/elisp-packages @NixOS/emacs
-/pkgs/applications/editors/emacs                @NixOS/emacs
-/pkgs/top-level/emacs-packages.nix              @NixOS/emacs
-/doc/packages/emacs.section.md                  @NixOS/emacs
-/nixos/modules/services/editors/emacs.md        @NixOS/emacs
-
-# Kakoune
-/pkgs/applications/editors/kakoune     @philiptaron
-
-# LuaPackages
-/pkgs/development/lua-modules         @NixOS/lua
-
-# Neovim
-/pkgs/applications/editors/neovim      @NixOS/neovim
-
-# VimPlugins
-/pkgs/applications/editors/vim/plugins         @NixOS/neovim
-
-# VsCode Extensions
-/pkgs/applications/editors/vscode/extensions
-
-# PHP interpreter, packages, extensions, tests and documentation
-/doc/languages-frameworks/php.section.md          @aanderse @drupol @globin @ma27 @talyz
-/nixos/tests/php                                  @aanderse @drupol @globin @ma27 @talyz
-/pkgs/build-support/php/build-pecl.nix            @aanderse @drupol @globin @ma27 @talyz
-/pkgs/build-support/php                                     @drupol
-/pkgs/development/interpreters/php       @jtojnar @aanderse @drupol @globin @ma27 @talyz
-/pkgs/development/php-packages                    @aanderse @drupol @globin @ma27 @talyz
-/pkgs/top-level/php-packages.nix         @jtojnar @aanderse @drupol @globin @ma27 @talyz
-
-# Docker tools
-/pkgs/build-support/docker                   @roberth
-/nixos/tests/docker-tools*                   @roberth
-/doc/build-helpers/images/dockertools.section.md  @roberth
-
-# Blockchains
-/pkgs/applications/blockchains  @mmahut @RaghavSood
-
-# Go
-/doc/languages-frameworks/go.section.md @kalbasit @katexochen @Mic92 @zowoq
-/pkgs/build-support/go @kalbasit @katexochen @Mic92 @zowoq
-/pkgs/development/compilers/go @kalbasit @katexochen @Mic92 @zowoq
-
-# GNOME
-/pkgs/desktops/gnome                              @jtojnar
-/pkgs/desktops/gnome/extensions                   @jtojnar
-/pkgs/build-support/make-hardcode-gsettings-patch @jtojnar
-
-# Cinnamon
-/pkgs/by-name/ci/cinnamon-*    @mkg20001
-/pkgs/by-name/cj/cjs           @mkg20001
-/pkgs/by-name/mu/muffin        @mkg20001
-/pkgs/by-name/ne/nemo          @mkg20001
-/pkgs/by-name/ne/nemo-*        @mkg20001
-
-# Xfce
-/doc/hooks/xfce4-dev-tools.section.md @NixOS/xfce
-
-# terraform providers
-/pkgs/applications/networking/cluster/terraform-providers @zowoq
-
-# Forgejo
-nixos/modules/services/misc/forgejo.nix @adamcstephens @bendlas @emilylange
-pkgs/by-name/fo/forgejo/                @adamcstephens @bendlas @emilylange
-
-# Dotnet
-/pkgs/build-support/dotnet                  @corngood
-/pkgs/development/compilers/dotnet          @corngood
-/pkgs/test/dotnet                           @corngood
-/doc/languages-frameworks/dotnet.section.md @corngood
-
-# Node.js
-/pkgs/build-support/node/build-npm-package      @winterqt
-/pkgs/build-support/node/fetch-npm-deps         @winterqt
-/doc/languages-frameworks/javascript.section.md @winterqt
-/pkgs/development/tools/pnpm                    @Scrumplex @gepbird
-
-# OCaml
-/pkgs/build-support/ocaml           @ulrikstrid
-/pkgs/development/compilers/ocaml   @ulrikstrid
-/pkgs/development/ocaml-modules     @ulrikstrid
-
-# ZFS
-/nixos/modules/tasks/filesystems/zfs.nix @adamcstephens @amarshall
-/nixos/tests/zfs.nix                     @adamcstephens @amarshall
-/pkgs/os-specific/linux/zfs              @adamcstephens @amarshall
-
-# Zig
-/pkgs/development/compilers/zig @figsoda @RossComputerGuy
-/doc/hooks/zig.section.md       @figsoda @RossComputerGuy
-
-# Buildbot
-nixos/modules/services/continuous-integration/buildbot @Mic92 @zowoq
-nixos/tests/buildbot.nix                               @Mic92 @zowoq
-pkgs/development/tools/continuous-integration/buildbot @Mic92 @zowoq
-
-# Pretix
-pkgs/by-name/pr/pretix/ @mweinelt
-pkgs/by-name/pr/pretalx/ @mweinelt
-nixos/modules/services/web-apps/pretix.nix @mweinelt
-nixos/modules/services/web-apps/pretalx.nix @mweinelt
-nixos/tests/web-apps/pretix.nix @mweinelt
-nixos/tests/web-apps/pretalx.nix @mweinelt
-
-# incus/lxc
-nixos/maintainers/scripts/incus/        @adamcstephens
-nixos/modules/virtualisation/incus.nix  @adamcstephens
-nixos/modules/virtualisation/lxc*       @adamcstephens
-nixos/tests/incus/                      @adamcstephens
-pkgs/by-name/in/incus/                  @adamcstephens
-pkgs/by-name/lx/lxc*                    @adamcstephens
-
-# ExpidusOS, Flutter
-/pkgs/development/compilers/flutter @RossComputerGuy
-/pkgs/desktops/expidus              @RossComputerGuy
-
-# GNU Tar & Zip
-/pkgs/tools/archivers/gnutar        @RossComputerGuy
-/pkgs/by-name/zi/zip           @RossComputerGuy
-
-# SELinux
-/pkgs/by-name/ch/checkpolicy @RossComputerGuy
-/pkgs/by-name/li/libselinux  @RossComputerGuy
-/pkgs/by-name/li/libsepol    @RossComputerGuy
-
-# installShellFiles
-/pkgs/by-name/in/installShellFiles/*     @Ericson2314
-/pkgs/test/install-shell-files/*         @Ericson2314
-/doc/hooks/installShellFiles.section.md  @Ericson2314
-
-# Darwin
-/pkgs/by-name/ap/apple-sdk                     @NixOS/darwin-core
-/pkgs/os-specific/darwin/apple-source-releases @NixOS/darwin-core
-/pkgs/stdenv/darwin                            @NixOS/darwin-core
-
-# BEAM
-pkgs/development/beam-modules/          @NixOS/beam
-pkgs/development/interpreters/erlang/   @NixOS/beam
-pkgs/development/interpreters/elixir/   @NixOS/beam
-pkgs/development/interpreters/lfe/      @NixOS/beam
-
-# Authelia
-pkgs/servers/authelia/ @06kellyjac @dit7ya @nicomem
-
-# OctoDNS
-pkgs/by-name/oc/octodns/ @anthonyroussel
-
-# Teleport
-pkgs/by-name/te/teleport*   @arianvp @justinas @sigma @tomberek @freezeboy @techknowlogick @JuliusFreudenberger
-
-# Warp-terminal
-pkgs/by-name/wa/warp-terminal/  @emilytrau @imadnyc @donteatoreo @johnrtitor

ci/README.md

@@ -1,52 +0,0 @@
-# CI support files
-
-This directory contains files to support CI, such as [GitHub Actions](https://github.com/NixOS/nixpkgs/tree/master/.github/workflows) and [Ofborg](https://github.com/nixos/ofborg).
-This is in contrast with [`maintainers/scripts`](../maintainers/scripts) which is for human use instead.
-
-## Pinned Nixpkgs
-
-CI may need certain packages from Nixpkgs.
-In order to ensure that the needed packages are generally available without building, [`pinned.json`](./pinned.json) contains a pinned Nixpkgs version tested by Hydra.
-
-Run [`update-pinned.sh`](./update-pinned.sh) to update it.
-
-## `ci/nixpkgs-vet.sh BASE_BRANCH [REPOSITORY]`
-
-Runs the [`nixpkgs-vet` tool](https://github.com/NixOS/nixpkgs-vet) on the HEAD commit, closely matching what CI does.
-This can't do exactly the same as CI, because CI needs to rely on GitHub's server-side Git history to compute the mergeability of PRs before the check can be started.
-In turn, when contributors are running this tool locally, we don't want to have to push commits to test them, and we can also rely on the local Git history to do the mergeability check.
-
-Arguments:
-
-- `BASE_BRANCH`: The base branch to use, e.g. master or release-24.05
-- `REPOSITORY`: The repository from which to fetch the base branch.
-  Defaults to <https://github.com/NixOS/nixpkgs.git>.
-
-# Branch classification
-
-For the purposes of CI, branches in the NixOS/nixpkgs repository are classified as follows:
-
-- **Channel** branches
-  - `nixos-` or `nixpkgs-` prefix
-  - Are only updated from `master` or `release-` branches, when hydra passes.
-  - Otherwise not worked on, Pull Requests are not allowed.
-  - Long-lived, no deletion, no force push.
-- **Primary development** branches
-  - `release-` prefix and `master`
-  - Pull Requests required.
-  - Long-lived, no deletion, no force push.
-- **Secondary development** branches
-  - `staging-` prefix, `haskell-updates` and `python-updates`
-  - Pull Requests normally required, except when merging development branches into each other.
-  - Long-lived, no deletion, no force push.
-- **Work-In-Progress** branches
-  - `backport-`, `revert-` and `wip-` prefixes.
-  - Deprecated: All other branches, not matched by channel/development.
-  - Pull Requests are optional.
-  - Short-lived, force push allowed, deleted after merge.
-
-Some branches also have a version component, which is either `unstable` or `YY.MM`.
-
-`ci/supportedBranches.js` is a script imported by CI to classify the base and head branches of a Pull Request.
-This classification will then be used to skip certain jobs.
-This script can also be run locally to print basic test cases.

ci/codeowners-validator/default.nix

@@ -1,31 +0,0 @@
-{
-  buildGoModule,
-  fetchFromGitHub,
-  fetchpatch,
-}:
-buildGoModule {
-  name = "codeowners-validator";
-  src = fetchFromGitHub {
-    owner = "mszostok";
-    repo = "codeowners-validator";
-    rev = "f3651e3810802a37bd965e6a9a7210728179d076";
-    hash = "sha256-5aSmmRTsOuPcVLWfDF6EBz+6+/Qpbj66udAmi1CLmWQ=";
-  };
-  patches = [
-    # https://github.com/mszostok/codeowners-validator/pull/222
-    (fetchpatch {
-      name = "user-write-access-check";
-      url = "https://github.com/mszostok/codeowners-validator/compare/f3651e3810802a37bd965e6a9a7210728179d076...840eeb88b4da92bda3e13c838f67f6540b9e8529.patch";
-      hash = "sha256-t3Dtt8SP9nbO3gBrM0nRE7+G6N/ZIaczDyVHYAG/6mU=";
-    })
-    # Undoes part of the above PR: We don't want to require write access
-    # to the repository, that's only needed for GitHub's native CODEOWNERS.
-    # Furthermore, it removes an unnecessary check from the code
-    # that breaks tokens generated for GitHub Apps.
-    ./permissions.patch
-    # Allows setting a custom CODEOWNERS path using the OWNERS_FILE env var
-    ./owners-file-name.patch
-  ];
-  postPatch = "rm -r docs/investigation";
-  vendorHash = "sha256-R+pW3xcfpkTRqfS2ETVOwG8PZr0iH5ewroiF7u8hcYI=";
-}

ci/codeowners-validator/owners-file-name.patch

@@ -1,15 +0,0 @@
-diff --git a/pkg/codeowners/owners.go b/pkg/codeowners/owners.go
-index 6910bd2..e0c95e9 100644
---- a/pkg/codeowners/owners.go
-+++ b/pkg/codeowners/owners.go
-@@ -39,6 +39,10 @@ func NewFromPath(repoPath string) ([]Entry, error) {
- // openCodeownersFile finds a CODEOWNERS file and returns content.
- // see: https://help.github.com/articles/about-code-owners/#codeowners-file-location
- func openCodeownersFile(dir string) (io.Reader, error) {
-+	if file, ok := os.LookupEnv("OWNERS_FILE"); ok {
-+		return fs.Open(file)
-+	}
-+
- 	var detectedFiles []string
- 	for _, p := range []string{".", "docs", ".github"} {
- 		pth := path.Join(dir, p)

ci/codeowners-validator/permissions.patch

@@ -1,36 +0,0 @@
-diff --git a/internal/check/valid_owner.go b/internal/check/valid_owner.go
-index a264bcc..610eda8 100644
---- a/internal/check/valid_owner.go
-+++ b/internal/check/valid_owner.go
-@@ -16,7 +16,6 @@ import (
- const scopeHeader = "X-OAuth-Scopes"
- 
- var reqScopes = map[github.Scope]struct{}{
--	github.ScopeReadOrg: {},
- }
- 
- type ValidOwnerConfig struct {
-@@ -223,10 +222,7 @@ func (v *ValidOwner) validateTeam(ctx context.Context, name string) *validateErr
- 	for _, t := range v.repoTeams {
- 		// GitHub normalizes name before comparison
- 		if strings.EqualFold(t.GetSlug(), team) {
--			if t.Permissions["push"] {
--				return nil
--			}
--			return newValidateError("Team %q cannot review PRs on %q as neither it nor any parent team has write permissions.", team, v.orgRepoName)
-+			return nil
- 		}
- 	}
- 
-@@ -245,10 +241,7 @@ func (v *ValidOwner) validateGitHubUser(ctx context.Context, name string) *valid
- 	for _, u := range v.repoUsers {
- 		// GitHub normalizes name before comparison
- 		if strings.EqualFold(u.GetLogin(), userName) {
--			if u.Permissions["push"] {
--				return nil
--			}
--			return newValidateError("User %q cannot review PRs on %q as they don't have write permissions.", userName, v.orgRepoName)
-+			return nil
- 		}
- 	}
- 

ci/default.nix

@@ -1,131 +0,0 @@
-let
-  pinned = (builtins.fromJSON (builtins.readFile ./pinned.json)).pins;
-in
-{
-  system ? builtins.currentSystem,
-
-  nixpkgs ? null,
-}:
-let
-  nixpkgs' =
-    if nixpkgs == null then
-      fetchTarball {
-        inherit (pinned.nixpkgs) url;
-        sha256 = pinned.nixpkgs.hash;
-      }
-    else
-      nixpkgs;
-
-  pkgs = import nixpkgs' {
-    inherit system;
-    config = {
-      permittedInsecurePackages = [ "nix-2.3.18" ];
-    };
-    overlays = [ ];
-  };
-
-  fmt =
-    let
-      treefmtNixSrc = fetchTarball {
-        inherit (pinned.treefmt-nix) url;
-        sha256 = pinned.treefmt-nix.hash;
-      };
-      treefmtEval = (import treefmtNixSrc).evalModule pkgs {
-        # Important: The auto-rebase script uses `git filter-branch --tree-filter`,
-        # which creates trees within the Git repository under `.git-rewrite/t`,
-        # notably without having a `.git` themselves.
-        # So if this projectRootFile were the default `.git/config`,
-        # having the auto-rebase script use treefmt on such a tree would make it
-        # format all files in the _parent_ Git tree as well.
-        projectRootFile = ".git-blame-ignore-revs";
-
-        # Be a bit more verbose by default, so we can see progress happening
-        settings.verbose = 1;
-
-        # By default it's info, which is too noisy since we have many unmatched files
-        settings.on-unmatched = "debug";
-
-        programs.actionlint.enable = true;
-
-        programs.keep-sorted.enable = true;
-
-        # This uses nixfmt underneath,
-        # the default formatter for Nix code.
-        # See https://github.com/NixOS/nixfmt
-        programs.nixfmt.enable = true;
-
-        programs.yamlfmt = {
-          enable = true;
-          settings.formatter = {
-            retain_line_breaks = true;
-          };
-        };
-        settings.formatter.yamlfmt.excludes = [
-          # Breaks helm templating
-          "nixos/tests/k3s/k3s-test-chart/templates/*"
-          # Aligns comments with whitespace
-          "pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml"
-          # TODO: Fix formatting for auto-generated file
-          "pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml"
-        ];
-
-        settings.formatter.editorconfig-checker = {
-          command = "${pkgs.lib.getExe pkgs.editorconfig-checker}";
-          options = [ "-disable-indent-size" ];
-          includes = [ "*" ];
-          priority = 1;
-        };
-      };
-      fs = pkgs.lib.fileset;
-      nixFilesSrc = fs.toSource {
-        root = ../.;
-        fileset = fs.difference ../. (fs.maybeMissing ../.git);
-      };
-    in
-    {
-      shell = treefmtEval.config.build.devShell;
-      pkg = treefmtEval.config.build.wrapper;
-      check = treefmtEval.config.build.check nixFilesSrc;
-    };
-
-in
-rec {
-  inherit pkgs fmt;
-  requestReviews = pkgs.callPackage ./request-reviews { };
-  codeownersValidator = pkgs.callPackage ./codeowners-validator { };
-
-  # FIXME(lf-): it might be useful to test other Nix implementations
-  # (nixVersions.stable and Lix) here somehow at some point to ensure we don't
-  # have eval divergence.
-  eval = pkgs.callPackage ./eval {
-    nix = pkgs.nixVersions.latest;
-  };
-
-  # CI jobs
-  lib-tests = import ../lib/tests/release.nix { inherit pkgs; };
-  manual-nixos = (import ../nixos/release.nix { }).manual.${system} or null;
-  manual-nixpkgs = (import ../doc { });
-  manual-nixpkgs-tests = (import ../doc { }).tests;
-  nixpkgs-vet = pkgs.callPackage ./nixpkgs-vet.nix { };
-  parse = pkgs.lib.recurseIntoAttrs {
-    latest = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.latest; };
-    lix = pkgs.callPackage ./parse.nix { nix = pkgs.lix; };
-    # TODO: Raise nixVersions.minimum to 2.24 and flip back to it.
-    minimum = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.nix_2_24; };
-  };
-  shell = import ../shell.nix { inherit nixpkgs system; };
-  tarball = import ../pkgs/top-level/make-tarball.nix {
-    # Mirrored from top-level release.nix:
-    nixpkgs = {
-      outPath = pkgs.lib.cleanSource ../.;
-      revCount = 1234;
-      shortRev = "abcdef";
-      revision = "0000000000000000000000000000000000000000";
-    };
-    officialRelease = false;
-    inherit pkgs lib-tests;
-    # 2.28 / 2.29 take 9x longer than 2.30 or Lix.
-    # TODO: Switch back to nixVersions.latest
-    nix = pkgs.lix;
-  };
-}

ci/eval/README.md

@@ -1,26 +0,0 @@
-# Nixpkgs CI evaluation
-
-The code in this directory is used by the [eval.yml](../../.github/workflows/eval.yml) GitHub Actions workflow to evaluate the majority of Nixpkgs for all PRs, effectively making sure that when the development branches are processed by Hydra, no evaluation failures are encountered.
-
-Furthermore it also allows local evaluation using
-```
-nix-build ci -A eval.full \
-  --max-jobs 4 \
-  --cores 2 \
-  --arg chunkSize 10000 \
-  --arg evalSystems '["x86_64-linux" "aarch64-darwin"]'
-```
-
-- `--max-jobs`: The maximum number of derivations to run at the same time.
-  Only each [supported system](../supportedSystems.json) gets a separate derivation, so it doesn't make sense to set this higher than that number.
-- `--cores`: The number of cores to use for each job.
-  Recommended to set this to the amount of cores on your system divided by `--max-jobs`.
-- `chunkSize`: The number of attributes that are evaluated simultaneously on a single core.
-  Lowering this decreases memory usage at the cost of increased evaluation time.
-  If this is too high, there won't be enough chunks to process them in parallel, and will also increase evaluation time.
-- `evalSystems`: The set of systems for which `nixpkgs` should be evaluated.
-  Defaults to the four official platforms (`x86_64-linux`, `aarch64-linux`, `x86_64-darwin` and `aarch64-darwin`).
-
-A good default is to set `chunkSize` to 10000, which leads to about 3.6GB max memory usage per core, so suitable for fully utilising machines with 4 cores and 16GB memory, 8 cores and 32GB memory or 16 cores and 64GB memory.
-
-Note that 16GB memory is the recommended minimum, while with less than 8GB memory evaluation time suffers greatly.

ci/eval/compare/cmp-stats.py

@@ -1,154 +0,0 @@
-import json
-import os
-from scipy.stats import ttest_rel
-import pandas as pd
-import numpy as np
-from pathlib import Path
-
-# Define metrics of interest (can be expanded as needed)
-METRIC_PREFIXES = ("nr", "gc")
-
-def flatten_data(json_data: dict) -> dict:
-    """
-    Extracts and flattens metrics from JSON data.
-    This is needed because the JSON data can be nested.
-    For example, the JSON data entry might look like this:
-
-    "gc":{"cycles":13,"heapSize":5404549120,"totalBytes":9545876464}
-
-    Flattened:
-
-    "gc.cycles": 13
-    "gc.heapSize": 5404549120
-    ...
-
-    Args:
-        json_data (dict): JSON data containing metrics.
-    Returns:
-        dict: Flattened metrics with keys as metric names.
-    """
-    flat_metrics = {}
-    for k, v in json_data.items():
-        if isinstance(v, (int, float)):
-            flat_metrics[k] = v
-        elif isinstance(v, dict):
-            for sub_k, sub_v in v.items():
-                flat_metrics[f"{k}.{sub_k}"] = sub_v
-    return flat_metrics
-
-
-
-
-def load_all_metrics(directory: Path) -> dict:
-    """
-    Loads all stats JSON files in the specified directory and extracts metrics.
-
-    Args:
-        directory (Path): Directory containing JSON files.
-    Returns:
-        dict: Dictionary with filenames as keys and extracted metrics as values.
-    """
-    metrics = {}
-    for system_dir in directory.iterdir():
-        assert system_dir.is_dir()
-
-        for chunk_output in system_dir.iterdir():
-                with chunk_output.open() as f:
-                    data = json.load(f)
-                metrics[f"{system_dir.name}/${chunk_output.name}"] = flatten_data(data)
-
-    return metrics
-
-def dataframe_to_markdown(df: pd.DataFrame) -> str:
-    df = df.sort_values(by=df.columns[0], ascending=True)
-    markdown_lines = []
-
-    # Header (get column names and format them)
-    header = '\n| ' + ' | '.join(df.columns) + ' |'
-    markdown_lines.append(header)
-    markdown_lines.append("| - " * (len(df.columns)) + "|")  # Separator line
-
-    # Iterate over rows to build Markdown rows
-    for _, row in df.iterrows():
-        # TODO: define threshold for highlighting
-        highlight = False
-
-        fmt = lambda x: f"**{x}**" if highlight else f"{x}"
-
-        # Check for no change and NaN in p_value/t_stat
-        row_values = []
-        for val in row:
-            if isinstance(val, float) and np.isnan(val):  # For NaN values in p-value or t-stat
-                row_values.append("-")  # Custom symbol for NaN
-            elif isinstance(val, float) and val == 0:  # For no change (mean_diff == 0)
-                row_values.append("-")  # Custom symbol for no change
-            else:
-                row_values.append(fmt(f"{val:.4f}" if isinstance(val, float) else str(val)))
-
-        markdown_lines.append('| ' + ' | '.join(row_values) + ' |')
-
-    return '\n'.join(markdown_lines)
-
-
-def perform_pairwise_tests(before_metrics: dict, after_metrics: dict) -> pd.DataFrame:
-    common_files = sorted(set(before_metrics) & set(after_metrics))
-    all_keys = sorted({ metric_keys for file_metrics in before_metrics.values() for metric_keys in file_metrics.keys() })
-
-    results = []
-
-    for key in all_keys:
-        before_vals, after_vals = [], []
-
-        for fname in common_files:
-            if key in before_metrics[fname] and key in after_metrics[fname]:
-                before_vals.append(before_metrics[fname][key])
-                after_vals.append(after_metrics[fname][key])
-
-        if len(before_vals) >= 2:
-            before_arr = np.array(before_vals)
-            after_arr = np.array(after_vals)
-
-            diff = after_arr - before_arr
-            pct_change = 100 * diff / before_arr
-            t_stat, p_val = ttest_rel(after_arr, before_arr)
-
-            results.append({
-                "metric": key,
-                "mean_before": np.mean(before_arr),
-                "mean_after": np.mean(after_arr),
-                "mean_diff": np.mean(diff),
-                "mean_%_change": np.mean(pct_change),
-                "p_value": p_val,
-                "t_stat": t_stat
-            })
-
-    df = pd.DataFrame(results).sort_values("p_value")
-    return df
-
-
-if __name__ == "__main__":
-    before_dir = os.environ.get("BEFORE_DIR")
-    after_dir = os.environ.get("AFTER_DIR")
-
-    if not before_dir or not after_dir:
-        print("Error: Environment variables 'BEFORE_DIR' and 'AFTER_DIR' must be set.")
-        exit(1)
-
-    before_stats = Path(before_dir) / "stats"
-    after_stats = Path(after_dir) / "stats"
-
-    # This may happen if the pull request target does not include PR#399720 yet.
-    if not before_stats.exists():
-        print("⚠️  Skipping comparison: stats directory is missing in the target commit.")
-        exit(0)
-
-    # This should never happen, but we're exiting gracefully anyways
-    if not after_stats.exists():
-        print("⚠️  Skipping comparison: stats directory missing in current PR evaluation.")
-        exit(0)
-
-    before_metrics = load_all_metrics(before_stats)
-    after_metrics = load_all_metrics(after_stats)
-    df1 = perform_pairwise_tests(before_metrics, after_metrics)
-    markdown_table = dataframe_to_markdown(df1)
-    print(markdown_table)

ci/eval/compare/default.nix

@@ -1,186 +0,0 @@
-{
-  callPackage,
-  lib,
-  jq,
-  runCommand,
-  writeText,
-  python3,
-}:
-{
-  combinedDir,
-  touchedFilesJson,
-  githubAuthorId,
-  byName ? false,
-}:
-let
-  /*
-    Derivation that computes which packages are affected (added, changed or removed) between two revisions of nixpkgs.
-    Note: "platforms" are "x86_64-linux", "aarch64-darwin", ...
-
-    ---
-    Inputs:
-    - beforeDir, afterDir: The evaluation result from before and after the change.
-      They can be obtained by running `nix-build -A ci.eval.full` on both revisions.
-
-    ---
-    Outputs:
-      - changed-paths.json: Various information about the changes:
-        {
-          attrdiff: {
-            added: ["package1"],
-            changed: ["package2", "package3"],
-            removed: ["package4"],
-          },
-          labels: {
-            "10.rebuild-darwin: 1-10": true,
-            "10.rebuild-linux: 1-10": true
-          },
-          rebuildsByKernel: {
-            darwin: ["package1", "package2"],
-            linux: ["package1", "package2", "package3"]
-          },
-          rebuildCountByKernel: {
-            darwin: 2,
-            linux: 3,
-          },
-          rebuildsByPlatform: {
-            aarch64-darwin: ["package1", "package2"],
-            aarch64-linux: ["package1", "package2"],
-            x86_64-linux: ["package1", "package2", "package3"],
-            x86_64-darwin: ["package1"],
-          },
-        }
-      - step-summary.md: A markdown render of the changes
-
-    ---
-    Implementation details:
-
-    Helper functions can be found in ./utils.nix.
-    Two main "types" are important:
-
-    - `packagePlatformPath`: A string of the form "<PACKAGE_PATH>.<PLATFORM>"
-      Example: "python312Packages.numpy.x86_64-linux"
-
-    - `packagePlatformAttr`: An attrs representation of a packagePlatformPath:
-      Example: { name = "python312Packages.numpy"; platform = "x86_64-linux"; }
-  */
-  inherit (import ./utils.nix { inherit lib; })
-    groupByKernel
-    convertToPackagePlatformAttrs
-    groupByPlatform
-    extractPackageNames
-    getLabels
-    ;
-
-  # Attrs
-  # - keys: "added", "changed" and "removed"
-  # - values: lists of `packagePlatformPath`s
-  diffAttrs = builtins.fromJSON (builtins.readFile "${combinedDir}/combined-diff.json");
-
-  rebuilds = diffAttrs.added ++ diffAttrs.changed;
-  rebuildsPackagePlatformAttrs = convertToPackagePlatformAttrs rebuilds;
-
-  changed-paths =
-    let
-      rebuildsByPlatform = groupByPlatform rebuildsPackagePlatformAttrs;
-      rebuildsByKernel = groupByKernel rebuildsPackagePlatformAttrs;
-      rebuildCountByKernel = lib.mapAttrs (
-        kernel: kernelRebuilds: lib.length kernelRebuilds
-      ) rebuildsByKernel;
-    in
-    writeText "changed-paths.json" (
-      builtins.toJSON {
-        attrdiff = lib.mapAttrs (_: extractPackageNames) diffAttrs;
-        inherit
-          rebuildsByPlatform
-          rebuildsByKernel
-          rebuildCountByKernel
-          ;
-        labels =
-          getLabels rebuildCountByKernel
-          # Sets "10.rebuild-*-stdenv" label to whether the "stdenv" attribute was changed.
-          // lib.mapAttrs' (
-            kernel: rebuilds: lib.nameValuePair "10.rebuild-${kernel}-stdenv" (lib.elem "stdenv" rebuilds)
-          ) rebuildsByKernel
-          # Set the "11.by: package-maintainer" label to whether all packages directly
-          # changed are maintained by the PR's author.
-          # (https://github.com/NixOS/ofborg/blob/df400f44502d4a4a80fa283d33f2e55a4e43ee90/ofborg/src/tagger.rs#L83-L88)
-          // {
-            "11.by: package-maintainer" =
-              maintainers ? ${githubAuthorId}
-              && lib.all (lib.flip lib.elem maintainers.${githubAuthorId}) (
-                lib.flatten (lib.attrValues maintainers)
-              );
-          };
-      }
-    );
-
-  maintainers = callPackage ./maintainers.nix { } {
-    changedattrs = lib.attrNames (lib.groupBy (a: a.name) rebuildsPackagePlatformAttrs);
-    changedpathsjson = touchedFilesJson;
-    inherit byName;
-  };
-in
-runCommand "compare"
-  {
-    nativeBuildInputs = [
-      jq
-      (python3.withPackages (
-        ps: with ps; [
-          numpy
-          pandas
-          scipy
-        ]
-      ))
-
-    ];
-    maintainers = builtins.toJSON maintainers;
-    passAsFile = [ "maintainers" ];
-    env = {
-      BEFORE_DIR = "${combinedDir}/before";
-      AFTER_DIR = "${combinedDir}/after";
-    };
-  }
-  ''
-    mkdir $out
-
-    cp ${changed-paths} $out/changed-paths.json
-
-
-    if jq -e '(.attrdiff.added | length == 0) and (.attrdiff.removed | length == 0)' "${changed-paths}" > /dev/null; then
-      # Chunks have changed between revisions
-      # We cannot generate a performance comparison
-      {
-        echo
-        echo "# Performance comparison"
-        echo
-        echo "This compares the performance of this branch against its pull request base branch (e.g., 'master')"
-        echo
-        echo "For further help please refer to: [ci/README.md](https://github.com/NixOS/nixpkgs/blob/master/ci/README.md)"
-        echo
-      } >> $out/step-summary.md
-
-      python3 ${./cmp-stats.py} >> $out/step-summary.md
-
-    else
-      # Package chunks are the same in both revisions
-      # We can use the to generate a performance comparison
-      {
-        echo
-        echo "# Performance Comparison"
-        echo
-        echo "Performance stats were skipped because the package sets differ between the two revisions."
-        echo
-        echo "For further help please refer to: [ci/README.md](https://github.com/NixOS/nixpkgs/blob/master/ci/README.md)"
-      } >> $out/step-summary.md
-    fi
-
-    {
-      echo
-      echo "# Packages"
-      echo
-      jq -r -f ${./generate-step-summary.jq} < ${changed-paths}
-    } >> $out/step-summary.md
-
-    cp "$maintainersPath" "$out/maintainers.json"
-  ''

ci/eval/compare/generate-step-summary.jq

@@ -1,30 +0,0 @@
-def truncate(xs; n):
-  if xs | length > n then xs[:n] + ["..."]
-  else xs
-  end;
-
-def itemize_packages(xs):
-  truncate(xs; 2000) |
-    map("- [\(.)](https://search.nixos.org/packages?channel=unstable&show=\(.)&from=0&size=50&sort=relevance&type=packages&query=\(.))")  |
-    join("\n");
-
-def get_title(s; xs):
-  s + " (" + (xs | length | tostring) + ")";
-
-def section(title; xs):
-  "<details> <summary>" + get_title(title; xs) + "</summary>\n\n" + itemize_packages(xs) + "</details>";
-
-def fallback_document(content; n):
-  if content | utf8bytelength > n then
-    get_title("Added packages"; .attrdiff.added) + "\n\n" +
-    get_title("Removed packages"; .attrdiff.removed) + "\n\n" +
-    get_title("Changed packages"; .attrdiff.changed)
-  else content
-  end;
-
-# we truncate the list to stay below the GitHub limit of 1MB per step summary.
-fallback_document(
-  section("Added packages"; .attrdiff.added) + "\n\n" +
-  section("Removed packages"; .attrdiff.removed) + "\n\n" +
-  section("Changed packages"; .attrdiff.changed); 1000 * 1000
-)

ci/eval/compare/maintainers.nix

@@ -1,114 +0,0 @@
-{
-  lib,
-}:
-# Almost directly vendored from https://github.com/NixOS/ofborg/blob/5a4e743f192fb151915fcbe8789922fa401ecf48/ofborg/src/maintainers.nix
-{
-  changedattrs,
-  changedpathsjson,
-  byName ? false,
-}:
-let
-  pkgs = import ../../.. {
-    system = "x86_64-linux";
-    config = { };
-    overlays = [ ];
-  };
-
-  changedpaths = builtins.fromJSON (builtins.readFile changedpathsjson);
-
-  anyMatchingFile =
-    filename: builtins.any (changed: lib.strings.hasSuffix changed filename) changedpaths;
-
-  anyMatchingFiles = files: builtins.any anyMatchingFile files;
-
-  enrichedAttrs = builtins.map (name: {
-    path = lib.splitString "." name;
-    name = name;
-  }) changedattrs;
-
-  validPackageAttributes = builtins.filter (
-    pkg:
-    if (lib.attrsets.hasAttrByPath pkg.path pkgs) then
-      (
-        let
-          value = lib.attrsets.attrByPath pkg.path null pkgs;
-        in
-        if (builtins.tryEval value).success then
-          if value != null then true else builtins.trace "${pkg.name} exists but is null" false
-        else
-          builtins.trace "Failed to access ${pkg.name} even though it exists" false
-      )
-    else
-      builtins.trace "Failed to locate ${pkg.name}." false
-  ) enrichedAttrs;
-
-  attrsWithPackages = builtins.map (
-    pkg: pkg // { package = lib.attrsets.attrByPath pkg.path null pkgs; }
-  ) validPackageAttributes;
-
-  attrsWithMaintainers = builtins.map (
-    pkg:
-    let
-      meta = pkg.package.meta or { };
-    in
-    pkg
-    // {
-      # TODO: Refactor this so we can ping entire teams instead of the individual members.
-      # Note that this will require keeping track of GH team IDs in "maintainers/teams.nix".
-      maintainers = meta.maintainers or [ ];
-    }
-  ) attrsWithPackages;
-
-  relevantFilenames =
-    drv:
-    (lib.lists.unique (
-      builtins.map (pos: lib.strings.removePrefix (toString ../..) pos.file) (
-        builtins.filter (x: x != null) [
-          ((drv.meta or { }).maintainersPosition or null)
-          ((drv.meta or { }).teamsPosition or null)
-          (builtins.unsafeGetAttrPos "src" drv)
-          # broken because name is always set by stdenv:
-          #    # A hack to make `nix-env -qa` and `nix search` ignore broken packages.
-          #    # TODO(@oxij): remove this assert when something like NixOS/nix#1771 gets merged into nix.
-          #    name = assert validity.handled; name + lib.optionalString
-          #(builtins.unsafeGetAttrPos "name" drv)
-          (builtins.unsafeGetAttrPos "pname" drv)
-          (builtins.unsafeGetAttrPos "version" drv)
-
-          # Use ".meta.position" for cases when most of the package is
-          # defined in a "common" section and the only place where
-          # reference to the file with a derivation the "pos"
-          # attribute.
-          #
-          # ".meta.position" has the following form:
-          #   "pkgs/tools/package-management/nix/default.nix:155"
-          # We transform it to the following:
-          #   { file = "pkgs/tools/package-management/nix/default.nix"; }
-          { file = lib.head (lib.splitString ":" (drv.meta.position or "")); }
-        ]
-      )
-    ));
-
-  attrsWithFilenames = builtins.map (
-    pkg: pkg // { filenames = relevantFilenames pkg.package; }
-  ) attrsWithMaintainers;
-
-  attrsWithModifiedFiles = builtins.filter (pkg: anyMatchingFiles pkg.filenames) attrsWithFilenames;
-
-  listToPing = lib.concatMap (
-    pkg:
-    builtins.map (maintainer: {
-      id = maintainer.githubId;
-      inherit (maintainer) github;
-      packageName = pkg.name;
-      dueToFiles = pkg.filenames;
-    }) pkg.maintainers
-  ) attrsWithModifiedFiles;
-
-  byMaintainer = lib.groupBy (ping: toString ping.${if byName then "github" else "id"}) listToPing;
-
-  packagesPerMaintainer = lib.attrsets.mapAttrs (
-    maintainer: packages: builtins.map (pkg: pkg.packageName) packages
-  ) byMaintainer;
-in
-packagesPerMaintainer

ci/eval/compare/utils.nix

@@ -1,195 +0,0 @@
-{ lib, ... }:
-rec {
-  # Borrowed from https://github.com/NixOS/nixpkgs/pull/355616
-  uniqueStrings = list: builtins.attrNames (builtins.groupBy lib.id list);
-
-  /*
-    Converts a `packagePlatformPath` into a `packagePlatformAttr`
-
-    Turns
-      "hello.aarch64-linux"
-    into
-      {
-        name = "hello";
-        packagePath = [ "hello" ];
-        platform = "aarch64-linux";
-      }
-  */
-  convertToPackagePlatformAttr =
-    packagePlatformPath:
-    let
-      # python312Packages.numpy.aarch64-linux -> ["python312Packages" "numpy" "aarch64-linux"]
-      splittedPath = lib.splitString "." packagePlatformPath;
-
-      # ["python312Packages" "numpy" "aarch64-linux"] -> ["python312Packages" "numpy"]
-      packagePath = lib.sublist 0 (lib.length splittedPath - 1) splittedPath;
-
-      # "python312Packages.numpy"
-      name = lib.concatStringsSep "." packagePath;
-    in
-    if name == "" then
-      null
-    else
-      {
-        # [ "python312Packages" "numpy" ]
-        inherit packagePath;
-
-        # python312Packages.numpy
-        inherit name;
-
-        # "aarch64-linux"
-        platform = lib.last splittedPath;
-      };
-
-  /*
-    Converts a list of `packagePlatformPath`s into a list of `packagePlatformAttr`s
-
-    Turns
-      [
-        "hello.aarch64-linux"
-        "hello.x86_64-linux"
-        "hello.aarch64-darwin"
-        "hello.x86_64-darwin"
-        "bye.x86_64-darwin"
-        "bye.aarch64-darwin"
-        "release-checks"  <- Will be dropped
-      ]
-    into
-      [
-        { name = "hello"; platform = "aarch64-linux"; packagePath = [ "hello" ]; }
-        { name = "hello"; platform = "x86_64-linux"; packagePath = [ "hello" ]; }
-        { name = "hello"; platform = "aarch64-darwin"; packagePath = [ "hello" ]; }
-        { name = "hello"; platform = "x86_64-darwin"; packagePath = [ "hello" ]; }
-        { name = "bye"; platform = "aarch64-darwin"; packagePath = [ "hello" ]; }
-        { name = "bye"; platform = "x86_64-darwin"; packagePath = [ "hello" ]; }
-      ]
-  */
-  convertToPackagePlatformAttrs =
-    packagePlatformPaths:
-    builtins.filter (x: x != null) (builtins.map convertToPackagePlatformAttr packagePlatformPaths);
-
-  /*
-    Converts a list of `packagePlatformPath`s directly to a list of (unique) package names
-
-    Turns
-      [
-        "hello.aarch64-linux"
-        "hello.x86_64-linux"
-        "hello.aarch64-darwin"
-        "hello.x86_64-darwin"
-        "bye.x86_64-darwin"
-        "bye.aarch64-darwin"
-      ]
-    into
-      [
-        "hello"
-        "bye"
-      ]
-  */
-  extractPackageNames =
-    packagePlatformPaths:
-    let
-      packagePlatformAttrs = convertToPackagePlatformAttrs (uniqueStrings packagePlatformPaths);
-    in
-    uniqueStrings (builtins.map (p: p.name) packagePlatformAttrs);
-
-  /*
-    Group a list of `packagePlatformAttr`s by platforms
-
-    Turns
-      [
-        { name = "hello"; platform = "aarch64-linux"; ... }
-        { name = "hello"; platform = "x86_64-linux"; ... }
-        { name = "hello"; platform = "aarch64-darwin"; ... }
-        { name = "hello"; platform = "x86_64-darwin"; ... }
-        { name = "bye"; platform = "aarch64-darwin"; ... }
-        { name = "bye"; platform = "x86_64-darwin"; ... }
-      ]
-    into
-      {
-        aarch64-linux = [ "hello" ];
-        x86_64-linux = [ "hello" ];
-        aarch64-darwin = [ "hello" "bye" ];
-        x86_64-darwin = [ "hello" "bye" ];
-      }
-  */
-  groupByPlatform =
-    packagePlatformAttrs:
-    let
-      packagePlatformAttrsByPlatform = builtins.groupBy (p: p.platform) packagePlatformAttrs;
-      extractPackageNames = map (p: p.name);
-    in
-    lib.mapAttrs (_: extractPackageNames) packagePlatformAttrsByPlatform;
-
-  # Turns
-  # [
-  #   { name = "hello"; platform = "aarch64-linux"; ... }
-  #   { name = "hello"; platform = "x86_64-linux"; ... }
-  #   { name = "hello"; platform = "aarch64-darwin"; ... }
-  #   { name = "hello"; platform = "x86_64-darwin"; ... }
-  #   { name = "bye"; platform = "aarch64-darwin"; ... }
-  #   { name = "bye"; platform = "x86_64-darwin"; ... }
-  # ]
-  #
-  # into
-  #
-  # {
-  #   linux = [ "hello" ];
-  #   darwin = [ "hello" "bye" ];
-  # }
-  groupByKernel =
-    packagePlatformAttrs:
-    let
-      filterKernel =
-        kernel:
-        builtins.attrNames (
-          builtins.groupBy (p: p.name) (
-            builtins.filter (p: lib.hasSuffix kernel p.platform) packagePlatformAttrs
-          )
-        );
-    in
-    lib.genAttrs [ "linux" "darwin" ] filterKernel;
-
-  /*
-    Maps an attrs of `kernel - rebuild counts` mappings to an attrs of labels
-
-    Turns
-      {
-        linux = 56;
-        darwin = 1;
-      }
-    into
-      {
-        "10.rebuild-darwin: 1" = true;
-        "10.rebuild-darwin: 1-10" = true;
-        "10.rebuild-darwin: 11-100" = false;
-        # [...]
-        "10.rebuild-darwin: 1" = false;
-        "10.rebuild-darwin: 1-10" = false;
-        "10.rebuild-linux: 11-100" = true;
-        # [...]
-      }
-  */
-  getLabels =
-    rebuildCountByKernel:
-    lib.mergeAttrsList (
-      lib.mapAttrsToList (
-        kernel: rebuildCount:
-        let
-          range = from: to: from <= rebuildCount && (to == null || rebuildCount <= to);
-        in
-        lib.mapAttrs' (number: lib.nameValuePair "10.rebuild-${kernel}: ${number}") {
-          "0" = range 0 0;
-          "1" = range 1 1;
-          "1-10" = range 1 10;
-          "11-100" = range 11 100;
-          "101-500" = range 101 500;
-          "501-1000" = range 501 1000;
-          "501+" = range 501 null;
-          "1001-2500" = range 1001 2500;
-          "2501-5000" = range 2501 5000;
-          "5001+" = range 5001 null;
-        }
-      ) rebuildCountByKernel
-    );
-}

ci/eval/default.nix

@@ -1,281 +0,0 @@
-# Evaluates all the accessible paths in nixpkgs.
-# *This only builds on Linux* since it requires the Linux sandbox isolation to
-# be able to write in various places while evaluating inside the sandbox.
-#
-# This file is used by nixpkgs CI (see .github/workflows/eval.yml) as well as
-# being used directly as an entry point in Lix's CI (in `flake.nix` in the Lix
-# repo).
-#
-# If you know you are doing a breaking API change, please ping the nixpkgs CI
-# maintainers and the Lix maintainers (`nix eval -f . lib.teams.lix`).
-{
-  callPackage,
-  lib,
-  runCommand,
-  writeShellScript,
-  symlinkJoin,
-  time,
-  procps,
-  nix,
-  jq,
-}:
-
-let
-  nixpkgs =
-    with lib.fileset;
-    toSource {
-      root = ../..;
-      fileset = unions (
-        map (lib.path.append ../..) [
-          "default.nix"
-          "doc"
-          "lib"
-          "maintainers"
-          "nixos"
-          "pkgs"
-          ".version"
-          "ci/supportedSystems.json"
-        ]
-      );
-    };
-
-  supportedSystems = builtins.fromJSON (builtins.readFile ../supportedSystems.json);
-
-  attrpathsSuperset =
-    {
-      evalSystem,
-    }:
-    runCommand "attrpaths-superset.json"
-      {
-        src = nixpkgs;
-        nativeBuildInputs = [
-          nix
-          time
-        ];
-      }
-      ''
-        export NIX_STATE_DIR=$(mktemp -d)
-        mkdir $out
-        export GC_INITIAL_HEAP_SIZE=4g
-        command time -f "Attribute eval done [%MKB max resident, %Es elapsed] %C" \
-          nix-instantiate --eval --strict --json --show-trace \
-            "$src/pkgs/top-level/release-attrpaths-superset.nix" \
-            -A paths \
-            -I "$src" \
-            --option restrict-eval true \
-            --option allow-import-from-derivation false \
-            --option eval-system "${evalSystem}" > $out/paths.json
-      '';
-
-  singleSystem =
-    {
-      # The system to evaluate.
-      # Note that this is intentionally not called `system`,
-      # because `--argstr system` would only be passed to the ci/default.nix file!
-      evalSystem,
-      # The path to the `paths.json` file from `attrpathsSuperset`
-      attrpathFile ? "${attrpathsSuperset { inherit evalSystem; }}/paths.json",
-      # The number of attributes per chunk, see ./README.md for more info.
-      chunkSize,
-      checkMeta ? true,
-
-      # Don't try to eval packages marked as broken.
-      includeBroken ? false,
-      # Whether to just evaluate a single chunk for quick testing
-      quickTest ? false,
-    }:
-    let
-      singleChunk = writeShellScript "single-chunk" ''
-        set -euo pipefail
-        chunkSize=$1
-        myChunk=$2
-        system=$3
-        outputDir=$4
-
-        export NIX_SHOW_STATS=1
-        export NIX_SHOW_STATS_PATH="$outputDir/stats/$myChunk"
-        echo "Chunk $myChunk on $system start"
-        set +e
-        command time -o "$outputDir/timestats/$myChunk" \
-          -f "Chunk $myChunk on $system done [%MKB max resident, %Es elapsed] %C" \
-          nix-env -f "${nixpkgs}/pkgs/top-level/release-outpaths-parallel.nix" \
-          --eval-system "$system" \
-          --option restrict-eval true \
-          --option allow-import-from-derivation false \
-          --query --available \
-          --out-path --json \
-          --show-trace \
-          --arg chunkSize "$chunkSize" \
-          --arg myChunk "$myChunk" \
-          --arg attrpathFile "${attrpathFile}" \
-          --arg systems "[ \"$system\" ]" \
-          --arg checkMeta ${lib.boolToString checkMeta} \
-          --arg includeBroken ${lib.boolToString includeBroken} \
-          -I ${nixpkgs} \
-          -I ${attrpathFile} \
-          > "$outputDir/result/$myChunk" \
-          2> "$outputDir/stderr/$myChunk"
-        exitCode=$?
-        set -e
-        cat "$outputDir/stderr/$myChunk"
-        cat "$outputDir/timestats/$myChunk"
-        if (( exitCode != 0 )); then
-          echo "Evaluation failed with exit code $exitCode"
-          # This immediately halts all xargs processes
-          kill $PPID
-        elif [[ -s "$outputDir/stderr/$myChunk" ]]; then
-          echo "Nixpkgs on $system evaluated with warnings, aborting"
-          kill $PPID
-        fi
-      '';
-    in
-    runCommand "nixpkgs-eval-${evalSystem}"
-      {
-        nativeBuildInputs = [
-          nix
-          time
-          procps
-          jq
-        ];
-        env = {
-          inherit evalSystem chunkSize;
-        };
-      }
-      ''
-        export NIX_STATE_DIR=$(mktemp -d)
-        nix-store --init
-
-        echo "System: $evalSystem"
-        cores=$NIX_BUILD_CORES
-        echo "Cores: $cores"
-        attrCount=$(jq length "${attrpathFile}")
-        echo "Attribute count: $attrCount"
-        echo "Chunk size: $chunkSize"
-        # Same as `attrCount / chunkSize` but rounded up
-        chunkCount=$(( (attrCount - 1) / chunkSize + 1 ))
-        echo "Chunk count: $chunkCount"
-
-        mkdir -p $out/${evalSystem}
-
-        # Record and print stats on free memory and swap in the background
-        (
-          while true; do
-            availMemory=$(free -b | grep Mem | awk '{print $7}')
-            freeSwap=$(free -b | grep Swap | awk '{print $4}')
-            echo "Available memory: $(( availMemory / 1024 / 1024 )) MiB, free swap: $(( freeSwap / 1024 / 1024 )) MiB"
-
-            if [[ ! -f "$out/${evalSystem}/min-avail-memory" ]] || (( availMemory < $(<$out/${evalSystem}/min-avail-memory) )); then
-              echo "$availMemory" > $out/${evalSystem}/min-avail-memory
-            fi
-            if [[ ! -f $out/${evalSystem}/min-free-swap ]] || (( availMemory < $(<$out/${evalSystem}/min-free-swap) )); then
-              echo "$freeSwap" > $out/${evalSystem}/min-free-swap
-            fi
-            sleep 4
-          done
-        ) &
-
-        seq_end=$(( chunkCount - 1 ))
-
-        ${lib.optionalString quickTest ''
-          seq_end=0
-        ''}
-
-        chunkOutputDir=$(mktemp -d)
-        mkdir "$chunkOutputDir"/{result,stats,timestats,stderr}
-
-        seq -w 0 "$seq_end" |
-          command time -f "%e" -o "$out/${evalSystem}/total-time" \
-          xargs -I{} -P"$cores" \
-          ${singleChunk} "$chunkSize" {} "$evalSystem" "$chunkOutputDir"
-
-        cp -r "$chunkOutputDir"/stats $out/${evalSystem}/stats-by-chunk
-
-        if (( chunkSize * chunkCount != attrCount )); then
-          # A final incomplete chunk would mess up the stats, don't include it
-          rm "$chunkOutputDir"/stats/"$seq_end"
-        fi
-
-        cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.outputs)' > $out/${evalSystem}/paths.json
-      '';
-
-  diff = callPackage ./diff.nix { };
-
-  combine =
-    {
-      diffDir,
-    }:
-    runCommand "combined-eval"
-      {
-        nativeBuildInputs = [
-          jq
-        ];
-      }
-      ''
-        mkdir -p $out
-
-        # Combine output paths from all systems
-        cat ${diffDir}/*/diff.json | jq -s '
-          reduce .[] as $item ({}; {
-            added: (.added + $item.added),
-            changed: (.changed + $item.changed),
-            removed: (.removed + $item.removed)
-          })
-        ' > $out/combined-diff.json
-
-        mkdir -p $out/before/stats
-        for d in ${diffDir}/before/*; do
-          cp -r "$d"/stats-by-chunk $out/before/stats/$(basename "$d")
-        done
-
-        mkdir -p $out/after/stats
-        for d in ${diffDir}/after/*; do
-          cp -r "$d"/stats-by-chunk $out/after/stats/$(basename "$d")
-        done
-      '';
-
-  compare = callPackage ./compare { };
-
-  full =
-    {
-      # Whether to evaluate on a specific set of systems, by default all are evaluated
-      evalSystems ? if quickTest then [ "x86_64-linux" ] else supportedSystems,
-      # The number of attributes per chunk, see ./README.md for more info.
-      chunkSize,
-      quickTest ? false,
-    }:
-    let
-      diffs = symlinkJoin {
-        name = "diffs";
-        paths = map (
-          evalSystem:
-          let
-            eval = singleSystem {
-              inherit quickTest evalSystem chunkSize;
-            };
-          in
-          diff {
-            inherit evalSystem;
-            # Local "full" evaluation doesn't do a real diff.
-            beforeDir = eval;
-            afterDir = eval;
-          }
-        ) evalSystems;
-      };
-    in
-    combine {
-      diffDir = diffs;
-    };
-
-in
-{
-  inherit
-    attrpathsSuperset
-    singleSystem
-    diff
-    combine
-    compare
-    # The above three are used by separate VMs in a GitHub workflow,
-    # while the below is intended for testing on a single local machine
-    full
-    ;
-}

ci/eval/diff.nix

@@ -1,61 +0,0 @@
-{
-  lib,
-  runCommand,
-  writeText,
-}:
-
-{
-  beforeDir,
-  afterDir,
-  evalSystem,
-}:
-
-let
-  /*
-    Computes the key difference between two attrs
-
-    {
-      added: [ <keys only in the second object> ],
-      removed: [ <keys only in the first object> ],
-      changed: [ <keys with different values between the two objects> ],
-    }
-  */
-  diff =
-    let
-      filterKeys = cond: attrs: lib.attrNames (lib.filterAttrs cond attrs);
-    in
-    old: new: {
-      added = filterKeys (n: _: !(old ? ${n})) new;
-      removed = filterKeys (n: _: !(new ? ${n})) old;
-      changed = filterKeys (
-        n: v:
-        # Filter out attributes that don't exist anymore
-        (new ? ${n})
-
-        # Filter out attributes that are the same as the new value
-        && (v != (new.${n}))
-      ) old;
-    };
-
-  getAttrs =
-    dir:
-    let
-      raw = builtins.readFile "${dir}/${evalSystem}/paths.json";
-      # The file contains Nix paths; we need to ignore them for evaluation purposes,
-      # else there will be a "is not allowed to refer to a store path" error.
-      data = builtins.unsafeDiscardStringContext raw;
-    in
-    builtins.fromJSON data;
-
-  beforeAttrs = getAttrs beforeDir;
-  afterAttrs = getAttrs afterDir;
-  diffAttrs = diff beforeAttrs afterAttrs;
-  diffJson = writeText "diff.json" (builtins.toJSON diffAttrs);
-in
-runCommand "diff" { } ''
-  mkdir -p $out/${evalSystem}
-
-  cp -r ${beforeDir} $out/before
-  cp -r ${afterDir} $out/after
-  cp ${diffJson} $out/${evalSystem}/diff.json
-''

ci/github-script/.editorconfig

@@ -1,3 +0,0 @@
-[run]
-indent_style = space
-indent_size = 2

ci/github-script/.gitignore

@@ -1,2 +0,0 @@
-node_modules
-step-summary.md

ci/github-script/.npmrc

@@ -1,2 +0,0 @@
-package-lock-only = true
-save-exact = true

ci/github-script/README.md

@@ -1,17 +0,0 @@
-# GitHub specific CI scripts
-
-This folder contains [`actions/github-script`](https://github.com/actions/github-script)-based JavaScript code.
-It provides a `nix-shell` environment to run and test these actions locally.
-
-To run any of the scripts locally:
-
-- Enter `nix-shell` in `./ci/github-script`.
-- Ensure `gh` is authenticated.
-
-## Check commits
-
-Run `./run commits OWNER REPO PR`, where OWNER is your username or "NixOS", REPO is the name of your fork or "nixpkgs" and PR is the number of the pull request to check.
-
-## Labeler
-
-Run `./run labels OWNER REPO`, where OWNER is your username or "NixOS" and REPO the name of your fork or "nixpkgs".

ci/github-script/check-cherry-picks.md

@@ -1,10 +0,0 @@
-This report is automatically generated by the `PR / Check / cherry-pick` CI workflow.
-
-Some of the commits in this PR require the author's and reviewer's attention.
-
-Please follow the [backporting guidelines](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#how-to-backport-pull-requests) and cherry-pick with the `-x` flag.
-This requires changes to the unstable `master` and `staging` branches first, before backporting them.
-
-Occasionally, it is not possible to cherry-pick exactly the same patch.
-This most frequently happens when resolving merge conflicts or when updating minor versions of packages which have already advanced to the next major on unstable.
-If you need to merge this PR despite the warnings, please [dismiss](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review) this review shortly before merging.

ci/github-script/commits.js

@@ -1,281 +0,0 @@
-module.exports = async function ({ github, context, core, dry }) {
-  const { execFileSync } = require('node:child_process')
-  const { readFile } = require('node:fs/promises')
-  const { join } = require('node:path')
-  const { classify } = require('../supportedBranches.js')
-  const withRateLimit = require('./withRateLimit.js')
-
-  await withRateLimit({ github, core }, async (stats) => {
-    stats.prs = 1
-
-    const pull_number = context.payload.pull_request.number
-
-    const job_url =
-      context.runId &&
-      (
-        await github.paginate(github.rest.actions.listJobsForWorkflowRun, {
-          ...context.repo,
-          run_id: context.runId,
-          per_page: 100,
-        })
-      ).find(({ name }) => name == 'Check / cherry-pick').html_url +
-        '?pr=' +
-        pull_number
-
-    async function handle({ sha, commit }) {
-      // Using the last line with "cherry" + hash, because a chained backport
-      // can result in multiple of those lines. Only the last one counts.
-      const match = Array.from(
-        commit.message.matchAll(/cherry.*([0-9a-f]{40})/g),
-      ).at(-1)
-
-      if (!match)
-        return {
-          sha,
-          commit,
-          severity: 'warning',
-          message: `Couldn't locate original commit hash in message of ${sha}.`,
-        }
-
-      const original_sha = match[1]
-
-      let branches
-      try {
-        branches = (
-          await github.request({
-            // This is an undocumented endpoint to fetch the branches a commit is part of.
-            // There is no equivalent in neither the REST nor the GraphQL API.
-            // The endpoint itself is unlikely to go away, because GitHub uses it to display
-            // the list of branches on the detail page of a commit.
-            url: `https://github.com/${context.repo.owner}/${context.repo.repo}/branch_commits/${original_sha}`,
-            headers: {
-              accept: 'application/json',
-            },
-          })
-        ).data.branches
-          .map(({ branch }) => branch)
-          .filter((branch) => classify(branch).type.includes('development'))
-      } catch (e) {
-        // For some unknown reason a 404 error comes back as 500 without any more details in a GitHub Actions runner.
-        // Ignore these to return a regular error message below.
-        if (![404, 500].includes(e.status)) throw e
-      }
-      if (!branches?.length)
-        return {
-          sha,
-          commit,
-          severity: 'error',
-          message: `${original_sha} given in ${sha} not found in any pickable branch.`,
-        }
-
-      const diff = execFileSync('git', [
-        '-C',
-        __dirname,
-        'range-diff',
-        '--no-color',
-        '--ignore-all-space',
-        '--no-notes',
-        // 100 means "any change will be reported"; 0 means "no change will be reported"
-        '--creation-factor=100',
-        `${original_sha}~..${original_sha}`,
-        `${sha}~..${sha}`,
-      ])
-        .toString()
-        .split('\n')
-        // First line contains commit SHAs, which we'll print separately.
-        .slice(1)
-        // # The output of `git range-diff` is indented with 4 spaces, but we'll control indentation manually.
-        .map((line) => line.replace(/^ {4}/, ''))
-
-      if (!diff.some((line) => line.match(/^[+-]{2}/)))
-        return {
-          sha,
-          commit,
-          severity: 'info',
-          message: `✔ ${original_sha} is highly similar to ${sha}.`,
-        }
-
-      const colored_diff = execFileSync('git', [
-        '-C',
-        __dirname,
-        'range-diff',
-        '--color',
-        '--no-notes',
-        '--creation-factor=100',
-        `${original_sha}~..${original_sha}`,
-        `${sha}~..${sha}`,
-      ]).toString()
-
-      return {
-        sha,
-        commit,
-        diff,
-        colored_diff,
-        severity: 'warning',
-        message: `Difference between ${sha} and original ${original_sha} may warrant inspection.`,
-      }
-    }
-
-    const commits = await github.paginate(github.rest.pulls.listCommits, {
-      ...context.repo,
-      pull_number,
-    })
-
-    const results = await Promise.all(commits.map(handle))
-
-    // Log all results without truncation, with better highlighting and all whitespace changes to the job log.
-    results.forEach(({ sha, commit, severity, message, colored_diff }) => {
-      core.startGroup(`Commit ${sha}`)
-      core.info(`Author: ${commit.author.name} ${commit.author.email}`)
-      core.info(`Date: ${new Date(commit.author.date)}`)
-      core[severity](message)
-      core.endGroup()
-      if (colored_diff) core.info(colored_diff)
-    })
-
-    // Only create step summary below in case of warnings or errors.
-    // Also clean up older reviews, when all checks are good now.
-    if (results.every(({ severity }) => severity == 'info')) {
-      if (!dry) {
-        await Promise.all(
-          (
-            await github.paginate(github.rest.pulls.listReviews, {
-              ...context.repo,
-              pull_number,
-            })
-          )
-            .filter((review) => review.user.login == 'github-actions[bot]')
-            .map(async (review) => {
-              if (review.state == 'CHANGES_REQUESTED') {
-                await github.rest.pulls.dismissReview({
-                  ...context.repo,
-                  pull_number,
-                  review_id: review.id,
-                  message: 'All cherry-picks are good now, thank you!',
-                })
-              }
-              await github.graphql(
-                `mutation($node_id:ID!) {
-                  minimizeComment(input: {
-                    classifier: RESOLVED,
-                    subjectId: $node_id
-                  })
-                  { clientMutationId }
-                }`,
-                { node_id: review.node_id },
-              )
-            }),
-        )
-      }
-      return
-    }
-
-    // In the case of "error" severity, we also fail the job.
-    // Those should be considered blocking and not be dismissable via review.
-    if (results.some(({ severity }) => severity == 'error'))
-      process.exitCode = 1
-
-    core.summary.addRaw(
-      await readFile(join(__dirname, 'check-cherry-picks.md'), 'utf-8'),
-      true,
-    )
-    results.forEach(({ severity, message, diff }) => {
-      if (severity == 'info') return
-
-      // The docs for markdown alerts only show examples with markdown blockquote syntax, like this:
-      //   > [!WARNING]
-      //   > message
-      // However, our testing shows that this also works with a `<blockquote>` html tag, as long as there
-      // is an empty line:
-      //   <blockquote>
-      //
-      //   [!WARNING]
-      //   message
-      //   </blockquote>
-      // Whether this is intended or just an implementation detail is unclear.
-      core.summary.addRaw('<blockquote>')
-      core.summary.addRaw(
-        `\n\n[!${severity == 'warning' ? 'WARNING' : 'CAUTION'}]`,
-        true,
-      )
-      core.summary.addRaw(`${message}`, true)
-
-      if (diff) {
-        // Limit the output to 10k bytes and remove the last, potentially incomplete line, because GitHub
-        // comments are limited in length. The value of 10k is arbitrary with the assumption, that after
-        // the range-diff becomes a certain size, a reviewer is better off reviewing the regular diff in
-        // GitHub's UI anyway, thus treating the commit as "new" and not cherry-picked.
-        // Note: if multiple commits are close to the limit, this approach could still lead to a comment
-        // that's too long. We think this is unlikely to happen, and so don't deal with it explicitly.
-        const truncated = []
-        let total_length = 0
-        for (line of diff) {
-          total_length += line.length
-          if (total_length > 10000) {
-            truncated.push('', '[...truncated...]')
-            break
-          } else {
-            truncated.push(line)
-          }
-        }
-
-        core.summary.addRaw('<details><summary>Show diff</summary>')
-        core.summary.addRaw('\n\n``````````diff', true)
-        core.summary.addRaw(truncated.join('\n'), true)
-        core.summary.addRaw('``````````', true)
-        core.summary.addRaw('</details>')
-      }
-
-      core.summary.addRaw('</blockquote>')
-    })
-
-    if (job_url)
-      core.summary.addRaw(
-        `\n\n_Hint: The full diffs are also available in the [runner logs](${job_url}) with slightly better highlighting._`,
-      )
-
-    const body = core.summary.stringify()
-    core.summary.write()
-
-    const pendingReview = (
-      await github.paginate(github.rest.pulls.listReviews, {
-        ...context.repo,
-        pull_number,
-      })
-    ).find(
-      (review) =>
-        review.user.login == 'github-actions[bot]' &&
-        // If a review is still pending, we can just update this instead
-        // of posting a new one.
-        (review.state == 'CHANGES_REQUESTED' ||
-          // No need to post a new review, if an older one with the exact
-          // same content had already been dismissed.
-          review.body == body),
-    )
-
-    if (dry) {
-      if (pendingReview)
-        core.info('pending review found: ' + pendingReview.html_url)
-      else core.info('no pending review found')
-    } else {
-      // Either of those two requests could fail for very long comments. This can only happen
-      // with multiple commits all hitting the truncation limit for the diff. If you ever hit
-      // this case, consider just splitting up those commits into multiple PRs.
-      if (pendingReview) {
-        await github.rest.pulls.updateReview({
-          ...context.repo,
-          pull_number,
-          review_id: pendingReview.id,
-          body,
-        })
-      } else {
-        await github.rest.pulls.createReview({
-          ...context.repo,
-          pull_number,
-          event: 'REQUEST_CHANGES',
-          body,
-        })
-      }
-    }
-  })
-}

ci/github-script/labels.js

@@ -1,414 +0,0 @@
-module.exports = async function ({ github, context, core, dry }) {
-  const path = require('node:path')
-  const { DefaultArtifactClient } = require('@actions/artifact')
-  const { readFile, writeFile } = require('node:fs/promises')
-  const withRateLimit = require('./withRateLimit.js')
-
-  const artifactClient = new DefaultArtifactClient()
-
-  async function handlePullRequest({ item, stats }) {
-    const log = (k, v) => core.info(`PR #${item.number} - ${k}: ${v}`)
-
-    const pull_number = item.number
-
-    // This API request is important for the merge-conflict label, because it triggers the
-    // creation of a new test merge commit. This is needed to actually determine the state of a PR.
-    const pull_request = (
-      await github.rest.pulls.get({
-        ...context.repo,
-        pull_number,
-      })
-    ).data
-
-    const reviews = await github.paginate(github.rest.pulls.listReviews, {
-      ...context.repo,
-      pull_number,
-    })
-
-    const approvals = new Set(
-      reviews
-        .filter((review) => review.state == 'APPROVED')
-        .map((review) => review.user?.id),
-    )
-
-    // After creation of a Pull Request, `merge_commit_sha` will be null initially:
-    // The very first merge commit will only be calculated after a little while.
-    // To avoid labeling the PR as conflicted before that, we wait a few minutes.
-    // This is intentionally less than the time that Eval takes, so that the label job
-    // running after Eval can indeed label the PR as conflicted if that is the case.
-    const merge_commit_sha_valid =
-      new Date() - new Date(pull_request.created_at) > 3 * 60 * 1000
-
-    const prLabels = {
-      // We intentionally don't use the mergeable or mergeable_state attributes.
-      // Those have an intermediate state while the test merge commit is created.
-      // This doesn't work well for us, because we might have just triggered another
-      // test merge commit creation by request the pull request via API at the start
-      // of this function.
-      // The attribute merge_commit_sha keeps the old value of null or the hash *until*
-      // the new test merge commit has either successfully been created or failed so.
-      // This essentially means we are updating the merge conflict label in two steps:
-      // On the first pass of the day, we just fetch the pull request, which triggers
-      // the creation. At this stage, the label is likely not updated, yet.
-      // The second pass will then read the result from the first pass and set the label.
-      '2.status: merge conflict':
-        merge_commit_sha_valid && !pull_request.merge_commit_sha,
-      '12.approvals: 1': approvals.size == 1,
-      '12.approvals: 2': approvals.size == 2,
-      '12.approvals: 3+': approvals.size >= 3,
-      '12.first-time contribution': [
-        'NONE',
-        'FIRST_TIMER',
-        'FIRST_TIME_CONTRIBUTOR',
-      ].includes(pull_request.author_association),
-    }
-
-    const { id: run_id, conclusion } =
-      (
-        await github.rest.actions.listWorkflowRuns({
-          ...context.repo,
-          workflow_id: 'pr.yml',
-          event: 'pull_request_target',
-          exclude_pull_requests: true,
-          head_sha: pull_request.head.sha,
-        })
-      ).data.workflow_runs[0] ??
-      // TODO: Remove this after 2025-09-17, at which point all eval.yml artifacts will have expired.
-      (
-        await github.rest.actions.listWorkflowRuns({
-          ...context.repo,
-          // In older PRs, we need eval.yml instead of pr.yml.
-          workflow_id: 'eval.yml',
-          event: 'pull_request_target',
-          status: 'success',
-          exclude_pull_requests: true,
-          head_sha: pull_request.head.sha,
-        })
-      ).data.workflow_runs[0] ??
-      {}
-
-    // Newer PRs might not have run Eval to completion, yet.
-    // Older PRs might not have an eval.yml workflow, yet.
-    // In either case we continue without fetching an artifact on a best-effort basis.
-    log('Last eval run', run_id ?? '<n/a>')
-
-    if (conclusion === 'success') {
-      Object.assign(prLabels, {
-        // We only set this label if the latest eval run was successful, because if it was not, it
-        // *could* have requested reviewers. We will let the PR author fix CI first, before "escalating"
-        // this PR to "needs: reviewer".
-        // Since the first Eval run on a PR always sets rebuild labels, the same PR will be "recently
-        // updated" for the next scheduled run. Thus, this label will still be set within a few minutes
-        // after a PR is created, if required.
-        // Note that a "requested reviewer" disappears once they have given a review, so we check
-        // existing reviews, too.
-        '9.needs: reviewer':
-          !pull_request.draft &&
-          pull_request.requested_reviewers.length == 0 &&
-          reviews.length == 0,
-      })
-    }
-
-    const artifact =
-      run_id &&
-      (
-        await github.rest.actions.listWorkflowRunArtifacts({
-          ...context.repo,
-          run_id,
-          name: 'comparison',
-        })
-      ).data.artifacts[0]
-
-    // Instead of checking the boolean artifact.expired, we will give us a minute to
-    // actually download the artifact in the next step and avoid that race condition.
-    // Older PRs, where the workflow run was already eval.yml, but the artifact was not
-    // called "comparison", yet, will skip the download.
-    const expired =
-      !artifact ||
-      new Date(artifact?.expires_at ?? 0) <
-        new Date(new Date().getTime() + 60 * 1000)
-    log('Artifact expires at', artifact?.expires_at ?? '<n/a>')
-    if (!expired) {
-      stats.artifacts++
-
-      await artifactClient.downloadArtifact(artifact.id, {
-        findBy: {
-          repositoryName: context.repo.repo,
-          repositoryOwner: context.repo.owner,
-          token: core.getInput('github-token'),
-        },
-        path: path.resolve(pull_number.toString()),
-        expectedHash: artifact.digest,
-      })
-
-      const maintainers = new Set(
-        Object.keys(
-          JSON.parse(
-            await readFile(`${pull_number}/maintainers.json`, 'utf-8'),
-          ),
-        ).map((m) => Number.parseInt(m, 10)),
-      )
-
-      const evalLabels = JSON.parse(
-        await readFile(`${pull_number}/changed-paths.json`, 'utf-8'),
-      ).labels
-
-      Object.assign(
-        prLabels,
-        // Ignore `evalLabels` if it's an array.
-        // This can happen for older eval runs, before we switched to objects.
-        // The old eval labels would have been set by the eval run,
-        // so now they'll be present in `before`.
-        // TODO: Simplify once old eval results have expired (~2025-10)
-        Array.isArray(evalLabels) ? undefined : evalLabels,
-        {
-          '12.approved-by: package-maintainer': Array.from(maintainers).some(
-            (m) => approvals.has(m),
-          ),
-        },
-      )
-    }
-
-    return prLabels
-  }
-
-  async function handle({ item, stats }) {
-    try {
-      const log = (k, v, skip) => {
-        core.info(`#${item.number} - ${k}: ${v}` + (skip ? ' (skipped)' : ''))
-        return skip
-      }
-
-      log('Last updated at', item.updated_at)
-      log('URL', item.html_url)
-
-      const issue_number = item.number
-
-      const itemLabels = {}
-
-      if (item.pull_request || context.payload.pull_request) {
-        stats.prs++
-        Object.assign(itemLabels, await handlePullRequest({ item, stats }))
-      } else {
-        stats.issues++
-      }
-
-      const latest_event_at = new Date(
-        (
-          await github.paginate(github.rest.issues.listEventsForTimeline, {
-            ...context.repo,
-            issue_number,
-            per_page: 100,
-          })
-        )
-          .filter(({ event }) =>
-            [
-              // These events are hand-picked from:
-              //   https://docs.github.com/en/rest/using-the-rest-api/issue-event-types?apiVersion=2022-11-28
-              // Each of those causes a PR/issue to *not* be considered as stale anymore.
-              // Most of these use created_at.
-              'assigned',
-              'commented', // uses updated_at, because that could be > created_at
-              'committed', // uses committer.date
-              'head_ref_force_pushed',
-              'milestoned',
-              'pinned',
-              'ready_for_review',
-              'renamed',
-              'reopened',
-              'review_dismissed',
-              'review_requested',
-              'reviewed', // uses submitted_at
-              'unlocked',
-              'unmarked_as_duplicate',
-            ].includes(event),
-          )
-          .map(
-            ({ created_at, updated_at, committer, submitted_at }) =>
-              new Date(
-                updated_at ?? created_at ?? submitted_at ?? committer.date,
-              ),
-          )
-          // Reverse sort by date value. The default sort() sorts by string representation, which is bad for dates.
-          .sort((a, b) => b - a)
-          .at(0) ?? item.created_at,
-      )
-      log('latest_event_at', latest_event_at.toISOString())
-
-      const stale_at = new Date(new Date().setDate(new Date().getDate() - 180))
-
-      // Create a map (Label -> Boolean) of all currently set labels.
-      // Each label is set to True and can be disabled later.
-      const before = Object.fromEntries(
-        (
-          await github.paginate(github.rest.issues.listLabelsOnIssue, {
-            ...context.repo,
-            issue_number,
-          })
-        ).map(({ name }) => [name, true]),
-      )
-
-      Object.assign(itemLabels, {
-        '2.status: stale':
-          !before['1.severity: security'] && latest_event_at < stale_at,
-      })
-
-      const after = Object.assign({}, before, itemLabels)
-
-      // No need for an API request, if all labels are the same.
-      const hasChanges = Object.keys(after).some(
-        (name) => (before[name] ?? false) != after[name],
-      )
-      if (log('Has changes', hasChanges, !hasChanges)) return
-
-      // Skipping labeling on a pull_request event, because we have no privileges.
-      const labels = Object.entries(after)
-        .filter(([, value]) => value)
-        .map(([name]) => name)
-      if (log('Set labels', labels, dry)) return
-
-      await github.rest.issues.setLabels({
-        ...context.repo,
-        issue_number,
-        labels,
-      })
-    } catch (cause) {
-      throw new Error(`Labeling #${item.number} failed.`, { cause })
-    }
-  }
-
-  await withRateLimit({ github, core }, async (stats) => {
-    if (context.payload.pull_request) {
-      await handle({ item: context.payload.pull_request, stats })
-    } else {
-      const lastRun = (
-        await github.rest.actions.listWorkflowRuns({
-          ...context.repo,
-          workflow_id: 'labels.yml',
-          event: 'schedule',
-          status: 'success',
-          exclude_pull_requests: true,
-          per_page: 1,
-        })
-      ).data.workflow_runs[0]
-
-      const cutoff = new Date(
-        Math.max(
-          // Go back as far as the last successful run of this workflow to make sure
-          // we are not leaving anyone behind on GHA failures.
-          // Defaults to go back 1 hour on the first run.
-          new Date(lastRun?.created_at ?? new Date().getTime() - 1 * 60 * 60 * 1000).getTime(),
-          // Go back max. 1 day to prevent hitting all API rate limits immediately,
-          // when GH API returns a wrong workflow by accident.
-          new Date().getTime() - 24 * 60 * 60 * 1000,
-        ),
-      )
-      core.info('cutoff timestamp: ' + cutoff.toISOString())
-
-      const updatedItems = await github.paginate(
-        github.rest.search.issuesAndPullRequests,
-        {
-          q: [
-            `repo:"${context.repo.owner}/${context.repo.repo}"`,
-            'is:open',
-            `updated:>=${cutoff.toISOString()}`,
-          ].join(' AND '),
-          per_page: 100,
-          // TODO: Remove in 2025-10, when it becomes the default.
-          advanced_search: true,
-        },
-      )
-
-      let cursor
-
-      // No workflow run available the first time.
-      if (lastRun) {
-        // The cursor to iterate through the full list of issues and pull requests
-        // is passed between jobs as an artifact.
-        const artifact = (
-          await github.rest.actions.listWorkflowRunArtifacts({
-            ...context.repo,
-            run_id: lastRun.id,
-            name: 'pagination-cursor',
-          })
-        ).data.artifacts[0]
-
-        // If the artifact is not available, the next iteration starts at the beginning.
-        if (artifact) {
-          stats.artifacts++
-
-          const { downloadPath } = await artifactClient.downloadArtifact(
-            artifact.id,
-            {
-              findBy: {
-                repositoryName: context.repo.repo,
-                repositoryOwner: context.repo.owner,
-                token: core.getInput('github-token'),
-              },
-              expectedHash: artifact.digest,
-            },
-          )
-
-          cursor = await readFile(path.resolve(downloadPath, 'cursor'), 'utf-8')
-        }
-      }
-
-      // From GitHub's API docs:
-      //   GitHub's REST API considers every pull request an issue, but not every issue is a pull request.
-      //   For this reason, "Issues" endpoints may return both issues and pull requests in the response.
-      //   You can identify pull requests by the pull_request key.
-      const allItems = await github.rest.issues.listForRepo({
-        ...context.repo,
-        state: 'open',
-        sort: 'created',
-        direction: 'asc',
-        per_page: 100,
-        after: cursor,
-      })
-
-      // Regex taken and comment adjusted from:
-      // https://github.com/octokit/plugin-paginate-rest.js/blob/8e5da25f975d2f31dda6b8b588d71f2c768a8df2/src/iterator.ts#L36-L41
-      // `allItems.headers.link` format:
-      //   <https://api.github.com/repositories/4542716/issues?page=3&per_page=100&after=Y3Vyc29yOnYyOpLPAAABl8qNnYDOvnSJxA%3D%3D>; rel="next",
-      //   <https://api.github.com/repositories/4542716/issues?page=1&per_page=100&before=Y3Vyc29yOnYyOpLPAAABl8xFV9DOvoouJg%3D%3D>; rel="prev"
-      // Sets `next` to undefined if "next" URL is not present or `link` header is not set.
-      const next = ((allItems.headers.link ?? '').match(
-        /<([^<>]+)>;\s*rel="next"/,
-      ) ?? [])[1]
-      if (next) {
-        cursor = new URL(next).searchParams.get('after')
-        const uploadPath = path.resolve('cursor')
-        await writeFile(uploadPath, cursor, 'utf-8')
-        if (dry) {
-          core.info(`pagination-cursor: ${cursor} (upload skipped)`)
-        } else {
-          // No stats.artifacts++, because this does not allow passing a custom token.
-          // Thus, the upload will not happen with the app token, but the default github.token.
-          await artifactClient.uploadArtifact(
-            'pagination-cursor',
-            [uploadPath],
-            path.resolve('.'),
-            {
-              retentionDays: 1,
-            },
-          )
-        }
-      }
-
-      // Some items might be in both search results, so filtering out duplicates as well.
-      const items = []
-        .concat(updatedItems, allItems.data)
-        .filter(
-          (thisItem, idx, arr) =>
-            idx ==
-            arr.findIndex((firstItem) => firstItem.number == thisItem.number),
-        )
-
-      ;(await Promise.allSettled(items.map((item) => handle({ item, stats }))))
-        .filter(({ status }) => status == 'rejected')
-        .map(({ reason }) =>
-          core.setFailed(`${reason.message}\n${reason.cause.stack}`),
-        )
-    }
-  })
-}

ci/github-script/package.json

@@ -1,10 +0,0 @@
-{
-  "private": true,
-  "dependencies": {
-    "@actions/artifact": "2.3.2",
-    "@actions/core": "1.11.1",
-    "@actions/github": "6.0.1",
-    "bottleneck": "2.19.5",
-    "commander": "14.0.0"
-  }
-}

ci/github-script/run

@@ -1,72 +0,0 @@
-#!/usr/bin/env -S node --import ./run
-import { execSync } from 'node:child_process'
-import { closeSync, mkdtempSync, openSync, rmSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { program } from 'commander'
-import * as core from '@actions/core'
-import { getOctokit } from '@actions/github'
-
-async function run(action, owner, repo, pull_number, dry = true) {
-  const token = execSync('gh auth token', { encoding: 'utf-8' }).trim()
-
-  const github = getOctokit(token)
-
-  const payload = !pull_number ? {} : {
-    pull_request: (await github.rest.pulls.get({
-      owner,
-      repo,
-      pull_number,
-    })).data
-  }
-
-  process.env['INPUT_GITHUB-TOKEN'] = token
-
-  closeSync(openSync('step-summary.md', 'w'))
-  process.env.GITHUB_STEP_SUMMARY = 'step-summary.md'
-
-  await action({
-    github,
-    context: {
-      payload,
-      repo: {
-        owner,
-        repo,
-      },
-    },
-    core,
-    dry,
-  })
-}
-
-program
-  .command('commits')
-  .description('Check commit structure of a pull request.')
-  .argument('<owner>', 'Owner of the GitHub repository to check (Example: NixOS)')
-  .argument('<repo>', 'Name of the GitHub repository to check (Example: nixpkgs)')
-  .argument('<pr>', 'Number of the Pull Request to check')
-  .action(async (owner, repo, pr) => {
-    const commits = (await import('./commits.js')).default
-    run(commits, owner, repo, pr)
-  })
-
-program
-  .command('labels')
-  .description('Manage labels on pull requests.')
-  .argument('<owner>', 'Owner of the GitHub repository to label (Example: NixOS)')
-  .argument('<repo>', 'Name of the GitHub repository to label (Example: nixpkgs)')
-  .argument('[pr]', 'Number of the Pull Request to label')
-  .option('--no-dry', 'Make actual modifications')
-  .action(async (owner, repo, pr, options) => {
-    const labels = (await import('./labels.js')).default
-    const tmp = mkdtempSync(join(tmpdir(), 'github-script-'))
-    try {
-      process.env.GITHUB_WORKSPACE = tmp
-      process.chdir(tmp)
-      run(labels, owner, repo, pr, options.dry)
-    } finally {
-      rmSync(tmp, { recursive: true })
-    }
-  })
-
-await program.parse()

ci/github-script/shell.nix

@@ -1,25 +0,0 @@
-{
-  system ? builtins.currentSystem,
-  pkgs ? (import ../. { inherit system; }).pkgs,
-}:
-
-pkgs.callPackage (
-  {
-    gh,
-    importNpmLock,
-    mkShell,
-    nodejs,
-  }:
-  mkShell {
-    packages = [
-      gh
-      importNpmLock.hooks.linkNodeModulesHook
-      nodejs
-    ];
-
-    npmDeps = importNpmLock.buildNodeModules {
-      npmRoot = ./.;
-      inherit nodejs;
-    };
-  }
-) { }

ci/github-script/withRateLimit.js

@@ -1,63 +0,0 @@
-module.exports = async function ({ github, core }, callback) {
-  const Bottleneck = require('bottleneck')
-
-  const stats = {
-    issues: 0,
-    prs: 0,
-    requests: 0,
-    artifacts: 0,
-  }
-
-  // Rate-Limiting and Throttling, see for details:
-  //   https://github.com/octokit/octokit.js/issues/1069#throttling
-  //   https://docs.github.com/en/rest/using-the-rest-api/best-practices-for-using-the-rest-api
-  const allLimits = new Bottleneck({
-    // Avoid concurrent requests
-    maxConcurrent: 1,
-    // Will be updated with first `updateReservoir()` call below.
-    reservoir: 0,
-  })
-  // Pause between mutative requests
-  const writeLimits = new Bottleneck({ minTime: 1000 }).chain(allLimits)
-  github.hook.wrap('request', async (request, options) => {
-    // Requests to a different host do not count against the rate limit.
-    if (options.url.startsWith('https://github.com')) return request(options)
-    // Requests to the /rate_limit endpoint do not count against the rate limit.
-    if (options.url == '/rate_limit') return request(options)
-    // Search requests are in a different resource group, which allows 30 requests / minute.
-    // We do less than a handful each run, so not implementing throttling for now.
-    if (options.url.startsWith('/search/')) return request(options)
-    stats.requests++
-    if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(options.method))
-      return writeLimits.schedule(request.bind(null, options))
-    else return allLimits.schedule(request.bind(null, options))
-  })
-
-  async function updateReservoir() {
-    let response
-    try {
-      response = await github.rest.rateLimit.get()
-    } catch (err) {
-      core.error(`Failed updating reservoir:\n${err}`)
-      // Keep retrying on failed rate limit requests instead of exiting the script early.
-      return
-    }
-    // Always keep 1000 spare requests for other jobs to do their regular duty.
-    // They normally use below 100, so 1000 is *plenty* of room to work with.
-    const reservoir = Math.max(0, response.data.resources.core.remaining - 1000)
-    core.info(`Updating reservoir to: ${reservoir}`)
-    allLimits.updateSettings({ reservoir })
-  }
-  await updateReservoir()
-  // Update remaining requests every minute to account for other jobs running in parallel.
-  const reservoirUpdater = setInterval(updateReservoir, 60 * 1000)
-
-  try {
-    await callback(stats)
-  } finally {
-    clearInterval(reservoirUpdater)
-    core.notice(
-      `Processed ${stats.prs} PRs, ${stats.issues} Issues, made ${stats.requests + stats.artifacts} API requests and downloaded ${stats.artifacts} artifacts.`,
-    )
-  }
-}

ci/nixpkgs-vet.nix

@@ -1,53 +0,0 @@
-{
-  lib,
-  nix,
-  nixpkgs-vet,
-  runCommand,
-}:
-{
-  base ? ../.,
-  head ? ../.,
-}:
-let
-  filtered =
-    with lib.fileset;
-    path:
-    toSource {
-      fileset = (gitTracked path);
-      root = path;
-    };
-in
-runCommand "nixpkgs-vet"
-  {
-    nativeBuildInputs = [
-      nixpkgs-vet
-    ];
-    env.NIXPKGS_VET_NIX_PACKAGE = nix;
-  }
-  ''
-    export NIX_STATE_DIR=$(mktemp -d)
-
-    nixpkgs-vet --base ${filtered base} ${filtered head}
-
-    # TODO: Upstream into nixpkgs-vet, see:
-    # https://github.com/NixOS/nixpkgs-vet/issues/164
-    badFiles=$(find ${filtered head}/pkgs -type f -name '*.nix' -print | xargs grep -l '^[^#]*<nixpkgs/' || true)
-    if [[ -n $badFiles ]]; then
-      echo "Nixpkgs is not allowed to use <nixpkgs> to refer to itself."
-      echo "The offending files:"
-      echo "$badFiles"
-      exit 1
-    fi
-
-    # TODO: Upstream into nixpkgs-vet, see:
-    # https://github.com/NixOS/nixpkgs-vet/issues/166
-    conflictingPaths=$(find ${filtered head} | awk '{ print $1 " " tolower($1) }' | sort -k2 | uniq -D -f 1 | cut -d ' ' -f 1)
-    if [[ -n $conflictingPaths ]]; then
-      echo "Files in nixpkgs must not vary only by case."
-      echo "The offending paths:"
-      echo "$conflictingPaths"
-      exit 1
-    fi
-
-    touch $out
-  ''

ci/nixpkgs-vet.sh

@@ -1,66 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p jq
-
-set -o pipefail -o errexit -o nounset
-
-trace() { echo >&2 "$@"; }
-
-tmp=$(mktemp -d)
-cleanup() {
-    # Don't exit early if anything fails to cleanup
-    set +o errexit
-
-    trace -n "Cleaning up.. "
-
-    [[ -e "$tmp/base" ]] && git worktree remove --force "$tmp/base"
-    [[ -e "$tmp/merged" ]] && git worktree remove --force "$tmp/merged"
-
-    rm -rf "$tmp"
-
-    trace "Done"
-}
-trap cleanup exit
-
-
-repo=https://github.com/NixOS/nixpkgs.git
-
-if (( $# != 0 )); then
-    baseBranch=$1
-    shift
-else
-    trace "Usage: $0 BASE_BRANCH [REPOSITORY]"
-    trace "BASE_BRANCH: The base branch to use, e.g. master or release-23.11"
-    trace "REPOSITORY: The repository to fetch the base branch from, defaults to $repo"
-    exit 1
-fi
-
-if (( $# != 0 )); then
-    repo=$1
-    shift
-fi
-
-if [[ -n "$(git status --porcelain)" ]]; then
-    trace -e "\e[33mWarning: Dirty tree, uncommitted changes won't be taken into account\e[0m"
-fi
-headSha=$(git rev-parse HEAD)
-trace -e "Using HEAD commit \e[34m$headSha\e[0m"
-
-trace -n "Creating Git worktree for the HEAD commit in $tmp/merged.. "
-git worktree add --detach -q "$tmp/merged" HEAD
-trace "Done"
-
-trace -n "Fetching base branch $baseBranch to compare against.. "
-git fetch -q "$repo" refs/heads/"$baseBranch"
-baseSha=$(git rev-parse FETCH_HEAD)
-trace -e "\e[34m$baseSha\e[0m"
-
-trace -n "Creating Git worktree for the base branch in $tmp/base.. "
-git worktree add -q "$tmp/base" "$baseSha"
-trace "Done"
-
-trace -n "Merging base branch into the HEAD commit in $tmp/merged.. "
-git -C "$tmp/merged" merge -q --no-edit "$baseSha"
-trace -e "\e[34m$(git -C "$tmp/merged" rev-parse HEAD)\e[0m"
-
-trace "Running nixpkgs-vet.."
-nix-build ci -A nixpkgs-vet --arg base "$tmp/base" --arg head "$tmp/merged"

ci/parse.nix

@@ -1,43 +0,0 @@
-{
-  lib,
-  nix,
-  runCommand,
-}:
-let
-  nixpkgs =
-    with lib.fileset;
-    toSource {
-      root = ../.;
-      fileset = (fileFilter (file: file.hasExt "nix") ../.);
-    };
-in
-runCommand "nix-parse-${nix.name}"
-  {
-    nativeBuildInputs = [
-      nix
-    ];
-  }
-  ''
-    export NIX_STORE_DIR=$TMPDIR/store
-    export NIX_STATE_DIR=$TMPDIR/state
-
-    cd "${nixpkgs}"
-
-    # Passes all files to nix-instantiate at once.
-    # Much faster, but will only show first error.
-    parse-all() {
-      find . -type f -iname '*.nix' | xargs -P $(nproc) nix-instantiate --parse >/dev/null 2>/dev/null
-    }
-
-    # Passes each file separately to nix-instantiate with -n1.
-    # Much slower, but will show all errors.
-    parse-each() {
-      find . -type f -iname '*.nix' | xargs -n1 -P $(nproc) nix-instantiate --parse >/dev/null
-    }
-
-    if ! parse-all; then
-      parse-each
-    fi
-
-    touch $out
-  ''

ci/pinned.json

@@ -1,31 +0,0 @@
-{
-  "pins": {
-    "nixpkgs": {
-      "type": "Git",
-      "repository": {
-        "type": "GitHub",
-        "owner": "NixOS",
-        "repo": "nixpkgs"
-      },
-      "branch": "nixpkgs-unstable",
-      "submodules": false,
-      "revision": "2baf8e1658cba84a032c3a8befb1e7b06629242a",
-      "url": "https://github.com/NixOS/nixpkgs/archive/2baf8e1658cba84a032c3a8befb1e7b06629242a.tar.gz",
-      "hash": "0l48zkf2zs7r53fjq46j770vpb5avxihyfypra3fv429akqnsmm1"
-    },
-    "treefmt-nix": {
-      "type": "Git",
-      "repository": {
-        "type": "GitHub",
-        "owner": "numtide",
-        "repo": "treefmt-nix"
-      },
-      "branch": "main",
-      "submodules": false,
-      "revision": "421b56313c65a0815a52b424777f55acf0b56ddf",
-      "url": "https://github.com/numtide/treefmt-nix/archive/421b56313c65a0815a52b424777f55acf0b56ddf.tar.gz",
-      "hash": "1l57hzz704s7izkkcl3xsg77xjfza57cl0fchs24rdpdhmry2dmp"
-    }
-  },
-  "version": 5
-}

ci/request-reviews/default.nix

@@ -1,44 +0,0 @@
-{
-  lib,
-  stdenvNoCC,
-  makeWrapper,
-  coreutils,
-  codeowners,
-  jq,
-  curl,
-  github-cli,
-  gitMinimal,
-}:
-stdenvNoCC.mkDerivation {
-  name = "request-reviews";
-  src = lib.fileset.toSource {
-    root = ./.;
-    fileset = lib.fileset.unions [
-      ./get-code-owners.sh
-      ./request-reviewers.sh
-      ./request-code-owner-reviews.sh
-      ./verify-base-branch.sh
-      ./dev-branches.txt
-    ];
-  };
-  nativeBuildInputs = [ makeWrapper ];
-  dontBuild = true;
-  installPhase = ''
-    mkdir -p $out/bin
-    mv dev-branches.txt $out/bin
-    for bin in *.sh; do
-      mv "$bin" "$out/bin"
-      wrapProgram "$out/bin/$bin" \
-        --set PATH ${
-          lib.makeBinPath [
-            coreutils
-            codeowners
-            jq
-            curl
-            github-cli
-            gitMinimal
-          ]
-        }
-    done
-  '';
-}

ci/request-reviews/dev-branches.txt

@@ -1,9 +0,0 @@
-# Trusted development branches:
-# These generally require PRs to update and are built by Hydra.
-# Keep this synced with the branches in .github/workflows/eval.yml
-master
-staging
-release-*
-staging-*
-haskell-updates
-python-updates

ci/request-reviews/get-code-owners.sh

@@ -1,97 +0,0 @@
-#!/usr/bin/env bash
-
-# Get the code owners of the files changed by a PR, returning one username per line
-
-set -euo pipefail
-
-log() {
-    echo "$@" >&2
-}
-
-if (( "$#" < 4 )); then
-    log "Usage: $0 GIT_REPO OWNERS_FILE BASE_REF HEAD_REF"
-    exit 1
-fi
-
-gitRepo=$1
-ownersFile=$2
-baseRef=$3
-headRef=$4
-
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' exit
-
-git -C "$gitRepo" diff --name-only --merge-base "$baseRef" "$headRef" > "$tmp/touched-files"
-readarray -t touchedFiles < "$tmp/touched-files"
-log "This PR touches ${#touchedFiles[@]} files"
-
-# Get the owners file from the base, because we don't want to allow PRs to
-# remove code owners to avoid pinging them
-git -C "$gitRepo" show "$baseRef":"$ownersFile" > "$tmp"/codeowners
-
-# Associative array with the user as the key for easy de-duplication
-# Make sure to always lowercase keys to avoid duplicates with different casings
-declare -A users=()
-
-for file in "${touchedFiles[@]}"; do
-    result=$(codeowners --file "$tmp"/codeowners "$file")
-
-    # Remove the file prefix and trim the surrounding spaces
-    read -r owners <<< "${result#"$file"}"
-    if [[ "$owners" == "(unowned)" ]]; then
-        log "File $file is unowned"
-        continue
-    fi
-    log "File $file is owned by $owners"
-
-    # Split up multiple owners, separated by arbitrary amounts of spaces
-    IFS=" " read -r -a entries <<< "$owners"
-
-    for entry in "${entries[@]}"; do
-        # GitHub technically also supports Emails as code owners,
-        # but we can't easily support that, so let's not
-        if [[ ! "$entry" =~ @(.*) ]]; then
-            warn -e "\e[33mCodeowner \"$entry\" for file $file is not valid: Must start with \"@\"\e[0m" >&2
-            # Don't fail, because the PR for which this script runs can't fix it,
-            # it has to be fixed in the base branch
-            continue
-        fi
-        # The first regex match is everything after the @
-        entry=${BASH_REMATCH[1]}
-
-        if [[ "$entry" =~ (.*)/(.*) ]]; then
-            # Teams look like $org/$team
-            org=${BASH_REMATCH[1]}
-            team=${BASH_REMATCH[2]}
-
-            # Instead of requesting a review from the team itself,
-            # we request reviews from the individual users.
-            # This is because once somebody from a team reviewed the PR,
-            # the API doesn't expose that the team was already requested for a review,
-            # so we wouldn't be able to avoid rerequesting reviews
-            # without saving some some extra state somewhere
-
-            # We could also consider implementing a more advanced heuristic
-            # in the future that e.g. only pings one team member,
-            # but escalates to somebody else if that member doesn't respond in time.
-            gh api \
-                --cache=1h \
-                -H "Accept: application/vnd.github+json" \
-                -H "X-GitHub-Api-Version: 2022-11-28" \
-                "/orgs/$org/teams/$team/members" \
-                --jq '.[].login' > "$tmp/team-members"
-            readarray -t members < "$tmp/team-members"
-            log "Team $entry has these members: ${members[*]}"
-
-            for user in "${members[@]}"; do
-                users[${user,,}]=
-            done
-        else
-            # Everything else is a user
-            users[${entry,,}]=
-        fi
-    done
-
-done
-
-printf "%s\n" "${!users[@]}"

ci/request-reviews/request-code-owner-reviews.sh

@@ -1,82 +0,0 @@
-#!/usr/bin/env bash
-
-# Requests reviews for a PR after verifying that the base branch is correct
-
-set -euo pipefail
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' exit
-SCRIPT_DIR=$(dirname "$0")
-
-log() {
-    echo "$@" >&2
-}
-
-effect() {
-    if [[ -n "${DRY_MODE:-}" ]]; then
-        log "Skipping in dry mode:" "${@@Q}"
-    else
-        "$@"
-    fi
-}
-
-if (( $# < 3 )); then
-    log "Usage: $0 GITHUB_REPO PR_NUMBER OWNERS_FILE"
-    exit 1
-fi
-baseRepo=$1
-prNumber=$2
-ownersFile=$3
-
-log "Fetching PR info"
-prInfo=$(gh api \
-  -H "Accept: application/vnd.github+json" \
-  -H "X-GitHub-Api-Version: 2022-11-28" \
-  "/repos/$baseRepo/pulls/$prNumber")
-
-baseBranch=$(jq -r .base.ref <<< "$prInfo")
-log "Base branch: $baseBranch"
-prRepo=$(jq -r .head.repo.full_name <<< "$prInfo")
-log "PR repo: $prRepo"
-prBranch=$(jq -r .head.ref <<< "$prInfo")
-log "PR branch: $prBranch"
-prAuthor=$(jq -r .user.login <<< "$prInfo")
-log "PR author: $prAuthor"
-
-extraArgs=()
-if pwdRepo=$(git rev-parse --show-toplevel 2>/dev/null); then
-    # Speedup for local runs
-    extraArgs+=(--reference-if-able "$pwdRepo")
-fi
-
-log "Fetching Nixpkgs commit history"
-# We only need the commit history, not the contents, so we can do a tree-less clone using tree:0
-# https://github.blog/open-source/git/get-up-to-speed-with-partial-clone-and-shallow-clone/#user-content-quick-summary
-git clone --bare --filter=tree:0 --no-tags --origin upstream "${extraArgs[@]}" https://github.com/"$baseRepo".git "$tmp"/nixpkgs.git
-
-log "Fetching the PR commit history"
-# Fetch the PR
-git -C "$tmp/nixpkgs.git" remote add fork https://github.com/"$prRepo".git
-# This remote config is the same as --filter=tree:0 when cloning
-git -C "$tmp/nixpkgs.git" config remote.fork.partialclonefilter tree:0
-git -C "$tmp/nixpkgs.git" config remote.fork.promisor true
-
-git -C "$tmp/nixpkgs.git" fetch --no-tags fork "$prBranch"
-headRef=$(git -C "$tmp/nixpkgs.git" rev-parse refs/remotes/fork/"$prBranch")
-
-log "Checking correctness of the base branch"
-if ! "$SCRIPT_DIR"/verify-base-branch.sh "$tmp/nixpkgs.git" "$headRef" "$baseRepo" "$baseBranch" "$prRepo" "$prBranch" | tee "$tmp/invalid-base-error" >&2; then
-    log "Posting error as comment"
-    if ! response=$(effect gh api \
-        --method POST \
-        -H "Accept: application/vnd.github+json" \
-        -H "X-GitHub-Api-Version: 2022-11-28" \
-        "/repos/$baseRepo/issues/$prNumber/comments" \
-        -F "body=@$tmp/invalid-base-error"); then
-        log "Failed to post the comment: $response"
-    fi
-    exit 1
-fi
-
-log "Requesting reviews from code owners"
-"$SCRIPT_DIR"/get-code-owners.sh "$tmp/nixpkgs.git" "$ownersFile" "$baseBranch" "$headRef" | \
-    "$SCRIPT_DIR"/request-reviewers.sh "$baseRepo" "$prNumber" "$prAuthor"

ci/request-reviews/request-reviewers.sh

@@ -1,88 +0,0 @@
-#!/usr/bin/env bash
-
-# Request reviewers for a PR, reading line-separated usernames on stdin,
-# filtering for valid reviewers before using the API endpoint to request reviews:
-# https://docs.github.com/en/rest/pulls/review-requests?apiVersion=2022-11-28#request-reviewers-for-a-pull-request
-
-set -euo pipefail
-
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' exit
-
-log() {
-    echo "$@" >&2
-}
-
-effect() {
-    if [[ -n "${DRY_MODE:-}" ]]; then
-        log "Skipping in dry mode:" "${@@Q}"
-    else
-        "$@"
-    fi
-}
-
-if (( "$#" < 3 )); then
-    log "Usage: $0 BASE_REPO PR_NUMBER PR_AUTHOR"
-    exit 1
-fi
-
-baseRepo=$1
-prNumber=$2
-prAuthor=$3
-
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' exit
-
-declare -A users=()
-while read -r handle && [[ -n "$handle" ]]; do
-    users[${handle,,}]=
-done
-
-# Cannot request a review from the author
-if [[ -v users[${prAuthor,,}] ]]; then
-    log "One or more files are owned by the PR author, ignoring"
-    unset 'users[${prAuthor,,}]'
-fi
-
-gh api \
-    -H "Accept: application/vnd.github+json" \
-    -H "X-GitHub-Api-Version: 2022-11-28" \
-    "/repos/$baseRepo/pulls/$prNumber/reviews" \
-    --jq '.[].user.login' > "$tmp/already-reviewed-by"
-
-# And we don't want to rerequest reviews from people who already reviewed
-while read -r user; do
-    if [[ -v users[${user,,}] ]]; then
-        log "User $user is a potential reviewer, but has already left a review, ignoring"
-        unset 'users[${user,,}]'
-    fi
-done < "$tmp/already-reviewed-by"
-
-for user in "${!users[@]}"; do
-    if ! gh api \
-        -H "Accept: application/vnd.github+json" \
-        -H "X-GitHub-Api-Version: 2022-11-28" \
-        "/repos/$baseRepo/collaborators/$user" >&2; then
-        log "User $user is not a repository collaborator, probably missed the automated invite to the maintainers team (see <https://github.com/NixOS/nixpkgs/issues/234293>), ignoring"
-        unset 'users[$user]'
-    fi
-done
-
-if [[ "${#users[@]}" -gt 10 ]]; then
-    log "Too many reviewers (${!users[*]}), skipping review requests"
-    exit 0
-fi
-
-for user in "${!users[@]}"; do
-    log "Requesting review from: $user"
-
-    if ! response=$(jq -n --arg user "$user" '{ reviewers: [ $user ] }' | \
-        effect gh api \
-            --method POST \
-            -H "Accept: application/vnd.github+json" \
-            -H "X-GitHub-Api-Version: 2022-11-28" \
-            "/repos/$baseRepo/pulls/$prNumber/requested_reviewers" \
-            --input -); then
-        log "Failed to request review from $user: $response"
-    fi
-done

ci/request-reviews/verify-base-branch.sh

@@ -1,104 +0,0 @@
-#!/usr/bin/env bash
-
-# Check that a PR doesn't include commits from other development branches.
-# Fails with next steps if it does
-
-set -euo pipefail
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' exit
-SCRIPT_DIR=$(dirname "$0")
-
-log() {
-    echo "$@" >&2
-}
-
-# Small helper to check whether an element is in a list
-# Usage: `elementIn foo "${list[@]}"`
-elementIn() {
-    local e match=$1
-    shift
-    for e; do
-        if [[ "$e" == "$match" ]]; then
-            return 0
-        fi
-    done
-    return 1
-}
-
-if (( $# < 6 )); then
-    log "Usage: $0 LOCAL_REPO HEAD_REF BASE_REPO BASE_BRANCH PR_REPO PR_BRANCH"
-    exit 1
-fi
-localRepo=$1
-headRef=$2
-baseRepo=$3
-baseBranch=$4
-prRepo=$5
-prBranch=$6
-
-# All development branches
-devBranchPatterns=()
-while read -r pattern; do
-    if [[ "$pattern" != '#'* ]]; then
-        devBranchPatterns+=("$pattern")
-    fi
-done < "$SCRIPT_DIR/dev-branches.txt"
-
-git -C "$localRepo" branch --list --format "%(refname:short)" "${devBranchPatterns[@]}" > "$tmp/dev-branches"
-readarray -t devBranches < "$tmp/dev-branches"
-
-if [[ "$baseRepo" == "$prRepo" ]] && elementIn "$prBranch" "${devBranches[@]}"; then
-    log "This PR merges $prBranch into $baseBranch, no commit check necessary"
-    exit 0
-fi
-
-# The current merge base of the PR
-prMergeBase=$(git -C "$localRepo" merge-base "$baseBranch" "$headRef")
-log "The PR's merge base with the base branch $baseBranch is $prMergeBase"
-
-# This is purely for debugging
-git -C "$localRepo" rev-list --reverse "$baseBranch".."$headRef" > "$tmp/pr-commits"
-log "The PR includes these $(wc -l < "$tmp/pr-commits") commits:"
-cat <"$tmp/pr-commits" >&2
-
-for testBranch in "${devBranches[@]}"; do
-
-    if [[ -z "$(git -C "$localRepo" rev-list -1 --since="1 month ago" "$testBranch")" ]]; then
-        log "Not checking $testBranch, was inactive for the last month"
-        continue
-    fi
-    log "Checking if commits from $testBranch are included in the PR"
-
-    # We need to check for any commits that are in the PR which are also in the test branch.
-    # We could check each commit from the PR individually, but that's unnecessarily slow.
-    #
-    # This does _almost_ what we want: `git rev-list --count headRef testBranch ^baseBranch`,
-    # except that it includes commits that are reachable from _either_ headRef or testBranch,
-    # instead of restricting it to ones reachable by both
-
-    # Easily fixable though, because we can use `git merge-base testBranch headRef`
-    # to get the least common ancestor (aka merge base) commit reachable by both.
-    # If the branch being tested is indeed the right base branch,
-    # this is then also the commit from that branch that the PR is based on top of.
-    testMergeBase=$(git -C "$localRepo" merge-base "$testBranch" "$headRef")
-
-    # And then use the `git rev-list --count`, but replacing the non-working
-    # `headRef testBranch` with the merge base of the two.
-    extraCommits=$(git -C "$localRepo" rev-list --count "$testMergeBase" ^"$baseBranch")
-
-    if (( extraCommits != 0 )); then
-        log -e "\e[33m"
-        echo "The PR's base branch is set to $baseBranch, but $extraCommits commits from the $testBranch branch are included. Make sure you know the [right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions), then:"
-        echo "- If the changes should go to the $testBranch branch, [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to $testBranch"
-        echo "- If the changes should go to the $baseBranch branch, rebase your PR onto the merge base with the $baseBranch branch:"
-        echo "  \`\`\`bash"
-        echo "  # git rebase --onto \$(git merge-base upstream/$baseBranch HEAD) \$(git merge-base upstream/$testBranch HEAD)"
-        echo "  git rebase --onto $prMergeBase $testMergeBase"
-        echo "  git push --force-with-lease"
-        echo "  \`\`\`"
-        log -e "\e[m"
-        exit 1
-    fi
-done
-
-log "Base branch is correct, no commits from development branches are included"

ci/supportedBranches.js

@@ -1,62 +0,0 @@
-#!/usr/bin/env nix-shell
-/*
-#!nix-shell -i node -p nodejs
-*/
-
-const typeConfig = {
-  master: ['development', 'primary'],
-  release: ['development', 'primary'],
-  staging: ['development', 'secondary'],
-  'staging-next': ['development', 'secondary'],
-  'haskell-updates': ['development', 'secondary'],
-  'python-updates': ['development', 'secondary'],
-  nixos: ['channel'],
-  nixpkgs: ['channel'],
-}
-
-function split(branch) {
-  return { ...branch.match(/(?<prefix>.+?)(-(?<version>\d{2}\.\d{2}|unstable)(?:-(?<suffix>.*))?)?$/).groups }
-}
-
-function classify(branch) {
-  const { prefix, version } = split(branch)
-  return {
-    stable: (version ?? 'unstable') !== 'unstable',
-    type: typeConfig[prefix] ?? [ 'wip' ]
-  }
-}
-
-module.exports = { classify }
-
-// If called directly via CLI, runs the following tests:
-if (!module.parent) {
-  console.log('split(branch)')
-  function testSplit(branch) {
-    console.log(branch, split(branch))
-  }
-  testSplit('master')
-  testSplit('release-25.05')
-  testSplit('staging-next')
-  testSplit('staging-25.05')
-  testSplit('staging-next-25.05')
-  testSplit('nixpkgs-25.05-darwin')
-  testSplit('nixpkgs-unstable')
-  testSplit('haskell-updates')
-  testSplit('backport-123-to-release-25.05')
-
-  console.log('')
-
-  console.log('classify(branch)')
-  function testClassify(branch) {
-    console.log(branch, classify(branch))
-  }
-  testClassify('master')
-  testClassify('release-25.05')
-  testClassify('staging-next')
-  testClassify('staging-25.05')
-  testClassify('staging-next-25.05')
-  testClassify('nixpkgs-25.05-darwin')
-  testClassify('nixpkgs-unstable')
-  testClassify('haskell-updates')
-  testClassify('backport-123-to-release-25.05')
-}

ci/supportedSystems.json

@@ -1,6 +0,0 @@
-[
-  "aarch64-linux",
-  "aarch64-darwin",
-  "x86_64-linux",
-  "x86_64-darwin"
-]

ci/update-pinned.sh

@@ -1,8 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p npins
-
-set -euo pipefail
-
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-npins --lock-file pinned.json update

default.nix

@@ -1,8 +1,6 @@
-let
-  requiredVersion = import ./lib/minver.nix;
-in
+let requiredVersion = import ./lib/minver.nix; in
 
-if !builtins ? nixVersion || builtins.compareVersions requiredVersion builtins.nixVersion == 1 then
+if ! builtins ? nixVersion || builtins.compareVersions requiredVersion builtins.nixVersion == 1 then
 
   abort ''
 
@@ -16,11 +14,11 @@ if !builtins ? nixVersion || builtins.compareVersions requiredVersion builtins.n
     - If you installed Nix using the install script (https://nixos.org/nix/install),
       it is safe to upgrade by running it again:
 
-          curl -L https://nixos.org/nix/install | sh
+          curl https://nixos.org/nix/install | sh
 
     For more information, please see the NixOS release notes at
     https://nixos.org/nixos/manual or locally at
-    ${toString ./nixos/doc/manual/release-notes}.
+    ${toString ./doc/manual/release-notes}.
 
     If you need further help, see https://nixos.org/nixos/support.html
   ''

doc/.gitignore

@@ -0,0 +1,7 @@
+*.chapter.xml
+*.section.xml
+.version
+out
+manual-full.xml
+highlightjs
+functions/library/locations.xml

doc/Makefile

@@ -0,0 +1,104 @@
+MD_TARGETS=$(addsuffix .xml, $(basename $(wildcard ./*.md ./**/*.md)))
+
+.PHONY: all
+all: validate format out/html/index.html out/epub/manual.epub
+
+.PHONY: debug
+debug:
+	nix-shell --run "xmloscopy --docbook5 ./manual.xml ./manual-full.xml"
+
+.PHONY: format
+format:
+	find . -iname '*.xml' -type f -print0 | xargs -0 -I{} -n1 \
+		xmlformat --config-file "$$XMLFORMAT_CONFIG" -i {}
+
+.PHONY: fix-misc-xml
+fix-misc-xml:
+	find . -iname '*.xml' -type f \
+		-exec ../nixos/doc/varlistentry-fixer.rb {} ';'
+
+.PHONY: clean
+clean:
+	rm -f ${MD_TARGETS} .version manual-full.xml functions/library/locations.xml
+	rm -rf ./out/ ./highlightjs
+
+.PHONY: validate
+validate: manual-full.xml
+	jing "$$RNG" manual-full.xml
+
+out/html/index.html: manual-full.xml style.css highlightjs
+	mkdir -p out/html
+	xsltproc ${xsltFlags} \
+		--nonet --xinclude \
+		--output $@ \
+		"$$XSL/docbook/xhtml/docbook.xsl" \
+		./manual-full.xml
+
+	mkdir -p out/html/highlightjs/
+	cp -r highlightjs out/html/
+
+	cp ./overrides.css out/html/
+	cp ./style.css out/html/style.css
+
+	mkdir -p out/html/images/callouts
+	cp "$$XSL/docbook/images/callouts/"*.svg out/html/images/callouts/
+	chmod u+w -R out/html/
+
+out/epub/manual.epub: manual-full.xml
+	mkdir -p out/epub/scratch
+	xsltproc ${xsltFlags} --nonet \
+		--output out/epub/scratch/ \
+		"$$XSL/docbook/epub/docbook.xsl" \
+		./manual-full.xml
+
+	cp ./overrides.css out/epub/scratch/OEBPS
+	cp ./style.css out/epub/scratch/OEBPS
+	mkdir -p out/epub/scratch/OEBPS/images/callouts/
+	cp "$$XSL/docbook/images/callouts/"*.svg out/epub/scratch/OEBPS/images/callouts/
+	echo "application/epub+zip" > mimetype
+	zip -0Xq "out/epub/manual.epub" mimetype
+	rm mimetype
+	cd "out/epub/scratch/" && zip -Xr9D "../manual.epub" *
+	rm -rf "out/epub/scratch/"
+
+highlightjs:
+	mkdir -p highlightjs
+	cp -r "$$HIGHLIGHTJS/highlight.pack.js" highlightjs/
+	cp -r "$$HIGHLIGHTJS/LICENSE" highlightjs/
+	cp -r "$$HIGHLIGHTJS/mono-blue.css" highlightjs/
+	cp -r "$$HIGHLIGHTJS/loader.js" highlightjs/
+
+
+manual-full.xml: ${MD_TARGETS} .version functions/library/locations.xml *.xml **/*.xml **/**/*.xml
+	xmllint --nonet --xinclude --noxincludenode manual.xml --output manual-full.xml
+
+.version:
+	nix-instantiate --eval \
+		-E '(import ../lib).version' > .version
+
+functions/library/locations.xml:
+	nix-build ./lib-function-locations.nix \
+		--out-link ./functions/library/locations.xml
+
+%.section.xml: %.section.md
+	pandoc $^ -w docbook+smart \
+		-f markdown+smart \
+	  | sed -e 's|<ulink url=|<link xlink:href=|' \
+	      -e 's|</ulink>|</link>|' \
+	      -e 's|<sect. id=|<section xml:id=|' \
+	      -e 's|</sect[0-9]>|</section>|' \
+	      -e '1s| id=| xml:id=|' \
+	      -e '1s|\(<[^ ]* \)|\1xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" |' \
+	| cat  > $@
+
+%.chapter.xml: %.chapter.md
+	pandoc $^ -w docbook+smart \
+		--top-level-division=chapter \
+		-f markdown+smart \
+	  | sed -e 's|<ulink url=|<link xlink:href=|' \
+	      -e 's|</ulink>|</link>|' \
+	      -e 's|<sect. id=|<section xml:id=|' \
+	      -e 's|</sect[0-9]>|</section>|' \
+	      -e '1s| id=| xml:id=|' \
+	      -e '1s|\(<[^ ]* \)|\1|' \
+	| cat  > $@

doc/README.md

@@ -1,422 +0,0 @@
-# Contributing to the Nixpkgs reference manual
-
-This directory houses the sources files for the Nixpkgs reference manual.
-
-> [!IMPORTANT]
-> We are actively restructuring our documentation to follow the [Diátaxis framework](https://diataxis.fr/)
->
-> Going forward, this directory should **only** contain [reference documentation](https://nix.dev/contributing/documentation/diataxis#reference).
-> For tutorials, guides and explanations, contribute to <https://nix.dev/> instead.
->
-> We are actively working to generate **all** reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code.
-> This also provides the benefit of using `:doc` in the `nix repl` to view reference documentation locally on the fly.
-
-For documentation only relevant for contributors, use Markdown files next to the source and regular code comments.
-
-> [!TIP]
-> Feedback for improving support for parsing and rendering doc-comments is highly appreciated.
-> [Open an issue](https://github.com/NixOS/nixpkgs/issues/new?labels=6.topic%3A+documentation&title=Doc%3A+) to request bugfixes or new features.
-
-Rendered documentation:
-- [Unstable (from master)](https://nixos.org/manual/nixpkgs/unstable/)
-- [Stable (from latest release)](https://nixos.org/manual/nixpkgs/stable/)
-
-The rendering tool is [nixos-render-docs](../pkgs/by-name/ni/nixos-render-docs), sometimes abbreviated `nrd`.
-
-## Contributing to this documentation
-
-You can quickly check your edits with `nix-build`:
-
-```ShellSession
-$ cd /path/to/nixpkgs
-$ nix-build doc
-```
-
-If the build succeeds, the manual will be in `./result/share/doc/nixpkgs/manual.html`.
-
-### Development environment
-
-In order to reduce repetition, consider using tools from the provided development environment:
-
-Load it from the Nixpkgs documentation directory with
-
-```ShellSession
-$ cd /path/to/nixpkgs/doc
-$ nix-shell
-```
-
-To load the development utilities automatically when entering that directory, [set up `nix-direnv`](https://nix.dev/guides/recipes/direnv).
-
-Make sure that your local files aren't added to Git history by adding the following lines to `.git/info/exclude` at the root of the Nixpkgs repository:
-
-```
-/**/.envrc
-/**/.direnv
-```
-
-#### `devmode`
-
-Use [`devmode`](../pkgs/by-name/de/devmode/README.md) for a live preview when editing the manual.
-
-### Testing redirects
-
-Once you have a successful build, you can open the relevant HTML (path mentioned above) in a browser along with the anchor, and observe the redirection.
-
-Note that if you already loaded the page and *then* input the anchor, you will need to perform a reload.
-This is because browsers do not re-run client JS code when only the anchor has changed.
-
-## Syntax
-
-As per [RFC 0072](https://github.com/NixOS/rfcs/pull/72), all new documentation content should be written in [CommonMark](https://commonmark.org/) Markdown dialect.
-
-Additional syntax extensions are available, all of which can be used in NixOS option documentation.
-The following extensions are currently used:
-
-#### Tables
-
-Tables, using the [GitHub-flavored Markdown syntax](https://github.github.com/gfm/#tables-extension-).
-
-#### Anchors
-
-Explicitly defined **anchors** on headings, to allow linking to sections.
-These should be always used, to ensure the anchors can be linked even when the heading text changes, and to prevent conflicts between [automatically assigned identifiers](https://github.com/jgm/commonmark-hs/blob/master/commonmark-extensions/test/auto_identifiers.md).
-
-It uses the widely compatible [header attributes](https://github.com/jgm/commonmark-hs/blob/master/commonmark-extensions/test/attributes.md) syntax:
-
-```markdown
-## Syntax {#sec-contributing-markup}
-```
-
-> [!Note]
-> NixOS option documentation does not support headings in general.
-
-#### Inline Anchors
-
-Allow linking arbitrary place in the text (e.g. individual list items, sentences…).
-
-They are defined using a hybrid of the link syntax with the attributes syntax known from headings, called [bracketed spans](https://github.com/jgm/commonmark-hs/blob/master/commonmark-extensions/test/bracketed_spans.md):
-
-```markdown
-- []{#ssec-gnome-hooks-glib} `glib` setup hook will populate `GSETTINGS_SCHEMAS_PATH` and then `wrapGApps*` hook will prepend it to `XDG_DATA_DIRS`.
-```
-
-#### Automatic links
-
-If you **omit a link text** for a link pointing to a section, the text will be substituted automatically.
-For example `[](#chap-contributing)`.
-
-This syntax is taken from [MyST](https://myst-parser.readthedocs.io/en/latest/using/syntax.html#targets-and-cross-referencing).
-
-
-#### HTML
-
-Inlining HTML is not allowed.
-Parts of the documentation gets rendered to various non-HTML formats, such as man pages in the case of NixOS manual.
-
-#### Roles
-
-If you want to link to a man page, you can use `` {manpage}`nix.conf(5)` ``.
-The references will turn into links when a mapping exists in [`doc/manpage-urls.json`](./manpage-urls.json).
-Please keep the `manpage-urls.json` file alphabetically sorted.
-
-A few markups for other kinds of literals are also available:
-
-- `` {command}`rm -rfi` ``
-- `` {env}`XDG_DATA_DIRS` ``
-- `` {file}`/etc/passwd` ``
-- `` {option}`networking.useDHCP` ``
-- `` {var}`/etc/passwd` ``
-
-These literal kinds are used mostly in NixOS option documentation.
-
-This syntax is taken from [MyST](https://myst-parser.readthedocs.io/en/latest/syntax/syntax.html#roles-an-in-line-extension-point).
-Though, the feature originates from [reStructuredText](https://www.sphinx-doc.org/en/master/usage/restructuredtext/roles.html#role-manpage) with slightly different syntax.
-They are handled by `myst_role` defined per renderer. <!-- reverse references in code -->
-
-#### Admonitions
-
-Set off from the text to bring attention to something.
-
-It uses pandoc’s [fenced `div`s syntax](https://github.com/jgm/commonmark-hs/blob/master/commonmark-extensions/test/fenced_divs.md):
-
-```markdown
-::: {.warning}
-This is a warning
-:::
-```
-
-The following are supported:
-
-- `caution`
-- `important`
-- `note`
-- `tip`
-- `warning`
-- `example`
-
-Example admonitions require a title to work.
-If you don't provide one, the manual won't be built.
-
-```markdown
-::: {.example #ex-showing-an-example}
-
-# Title for this example
-
-Text for the example.
-:::
-```
-
-#### [Definition lists](https://github.com/jgm/commonmark-hs/blob/master/commonmark-extensions/test/definition_lists.md)
-
-For defining a group of terms:
-
-```markdown
-pear
-:   green or yellow bulbous fruit
-
-watermelon
-:   green fruit with red flesh
-```
-
-## Commit conventions
-
-- Make sure you read about the [commit conventions](../CONTRIBUTING.md#commit-conventions) common to Nixpkgs as a whole.
-
-- If creating a commit purely for documentation changes, format the commit message in the following way:
-
-  ```
-  doc: (documentation summary)
-
-  (Motivation for change, relevant links, additional information.)
-  ```
-
-  Examples:
-
-  * doc: update the kernel config documentation to use `nix-shell`
-  * doc: add information about `nix-update-script`
-
-    Closes #216321.
-
-- If the commit contains more than just documentation changes, follow the commit message format relevant for the rest of the changes.
-
-## Documentation conventions
-
-In an effort to keep the Nixpkgs manual in a consistent style, please follow the conventions below, unless they prevent you from properly documenting something.
-In that case, please open an issue about the particular documentation convention and tag it with a "needs: documentation" label.
-When needed, each convention explain why it exists, so you can make a decision whether to follow it or not based on your particular case.
-Note that these conventions are about the **structure** of the manual (and its source files), not about the content that goes in it.
-You, as the writer of documentation, are still in charge of its content.
-
-### One sentence per line
-
-Put each sentence in its own line.
-This makes reviews and suggestions much easier, since GitHub's review system is based on lines.
-It also helps identifying long sentences at a glance.
-
-### Callouts and examples
-
-Use the [admonition syntax](#admonitions) for callouts and examples.
-
-### Provide self-contained examples
-
-Provide at least one example per function, and make examples self-contained.
-This is easier to understand for beginners.
-It also helps with testing that it actually works – especially once we introduce automation.
-
-Example code should be such that it can be passed to `pkgs.callPackage`.
-Instead of something like:
-
-```nix
-pkgs.dockerTools.buildLayeredImage {
-  name = "hello";
-  contents = [ pkgs.hello ];
-}
-```
-
-Write something like:
-
-```nix
-{ dockerTools, hello }:
-dockerTools.buildLayeredImage {
-  name = "hello";
-  contents = [ hello ];
-}
-```
-
-### REPLs
-
-When showing inputs/outputs of any [REPL](https://en.wikipedia.org/wiki/Read%E2%80%93eval%E2%80%93print_loop), such as a shell or the Nix REPL, use a format as you'd see in the REPL, while trying to visually separate inputs from outputs.
-This means that for a shell, you should use a format like the following:
-```shell
-$ nix-build -A hello '<nixpkgs>' \
-  --option require-sigs false \
-  --option trusted-substituters file:///tmp/hello-cache \
-  --option substituters file:///tmp/hello-cache
-/nix/store/zhl06z4lrfrkw5rp0hnjjfrgsclzvxpm-hello-2.12.1
-```
-Note how the input is preceded by `$` on the first line and indented on subsequent lines, and how the output is provided as you'd see on the shell.
-
-For the Nix REPL, you should use a format like the following:
-```shell
-nix-repl> builtins.attrNames { a = 1; b = 2; }
-[ "a" "b" ]
-```
-Note how the input is preceded by `nix-repl>` and the output is provided as you'd see on the Nix REPL.
-
-### Headings for inputs, outputs and examples
-
-When documenting functions or anything that has inputs/outputs and example usage, use nested headings to clearly separate inputs, outputs, and examples.
-Keep examples as the last nested heading, and link to the examples wherever applicable in the documentation.
-
-The purpose of this convention is to provide a familiar structure for navigating the manual, so any reader can expect to find content related to inputs in an "inputs" heading, examples in an "examples" heading, and so on.
-An example:
-```
-## buildImage
-
-Some explanation about the function here.
-Describe a particular scenario, and point to [](#ex-dockerTools-buildImage), which is an example demonstrating it.
-
-### Inputs
-
-Documentation for the inputs of `buildImage`.
-Perhaps even point to [](#ex-dockerTools-buildImage) again when talking about something specifically linked to it.
-
-### Passthru outputs
-
-Documentation for any passthru outputs of `buildImage`.
-
-### Examples
-
-Note that this is the last nested heading in the `buildImage` section.
-
-:::{.example #ex-dockerTools-buildImage}
-
-# Using `buildImage`
-
-Example of how to use `buildImage` goes here.
-
-:::
-```
-
-### Function arguments
-
-Use [definition lists](#definition-lists) to document function arguments, and the attributes of such arguments as well as their [types](https://nixos.org/manual/nix/stable/language/values).
-For example:
-
-```markdown
-# pkgs.coolFunction {#pkgs.coolFunction}
-
-`pkgs.coolFunction` *`name`* *`config`*
-
-Description of what `callPackage` does.
-
-
-## Inputs {#pkgs-coolFunction-inputs}
-
-If something's special about `coolFunction`'s general argument handling, you can say so here.
-Otherwise, just describe the single argument or start the arguments' definition list without introduction.
-
-*`name`* (String)
-
-: The name of the resulting image.
-
-*`config`* (Attribute set)
-
-: Introduce the parameter. Maybe you have a test to make sure `{ }` is a sensible default; then you can say: these attributes are optional; `{ }` is a valid argument.
-
-  `outputHash` (String; _optional_)
-
-  : A brief explanation including when and when not to pass this attribute.
-
-  : _Default:_ the output path's hash.
-```
-
-Checklist:
-- Start with a synopsis, to show the order of positional arguments.
-- Metavariables are in emphasized code spans: ``` *`arg1`* ```.
-  Metavariables are placeholders where users may write arbitrary expressions.
-  This includes positional arguments.
-- Attribute names are regular code spans: ``` `attr1` ```.
-  These identifiers can _not_ be picked freely by users, so they are _not_ metavariables.
-- _optional_ attributes have a _`Default:`_ if it's easily described as a value.
-- _optional_ attributes have a _`Default behavior:`_ if it's not easily described using a value.
-- Nix types aren't in code spans, because they are not code
-- Nix types are capitalized, to distinguish them from the camelCase Module System types, which _are_ code and behave like functions.
-
-#### Examples
-
-To define a referenceable figure use the following fencing:
-
-```markdown
-:::{.example #an-attribute-set-example}
-# An attribute set example
-
-You can add text before
-
-    ```nix
-    { a = 1; b = 2;}
-    ```
-
-and after code fencing
-:::
-```
-
-Defining examples through the `example` fencing class adds them to a "List of Examples" section after the Table of Contents.
-Though this is not shown in the rendered documentation on nixos.org.
-
-#### Figures
-
-To define a referenceable figure use the following fencing:
-
-```markdown
-::: {.figure #nixos-logo}
-# NixOS Logo
-![NixOS logo](./nixos_logo.png)
-:::
-```
-
-Defining figures through the `figure` fencing class adds them to a `List  of Figures` after the `Table of Contents`.
-Though this is not shown in the rendered documentation on nixos.org.
-
-#### Footnotes
-
-To add a foonote explanation, use the following syntax:
-
-```markdown
-Sometimes it's better to add context [^context] in a footnote.
-
-[^context]: This explanation will be rendered at the end of the chapter.
-```
-
-#### Inline comments
-
-Inline comments are supported with following syntax:
-
-```markdown
-<!-- This is an inline comment -->
-```
-
-The comments will not be rendered in the rendered HTML.
-
-#### Link reference definitions
-
-Links can reference a label, for example, to make the link target reusable:
-
-```markdown
-::: {.note}
-Reference links can also be used to [shorten URLs][url-id] and keep the markdown readable.
-:::
-
-[url-id]: https://github.com/NixOS/nixpkgs/blob/19d4f7dc485f74109bd66ef74231285ff797a823/doc/README.md
-```
-
-This syntax is taken from [CommonMark](https://spec.commonmark.org/0.30/#link-reference-definitions).
-
-#### Typographic replacements
-
-Typographic replacements are enabled.
-Check the [list of possible replacement patterns check](https://github.com/executablebooks/markdown-it-py/blob/3613e8016ecafe21709471ee0032a90a4157c2d1/markdown_it/rules_core/replacements.py#L1-L15).
-
-## Getting help
-
-If you need documentation-specific help or reviews, ping [@NixOS/documentation-team](https://github.com/orgs/nixos/teams/documentation-team) on your pull request.

doc/anchor-use.js

@@ -1,3 +0,0 @@
-document.addEventListener('DOMContentLoaded', function(event) {
-  anchors.add('h1[id]:not(div.note h1, div.warning h1, div.tip h1, div.caution h1, div.important h1), h2[id]:not(div.note h2, div.warning h2, div.tip h2, div.caution h2, div.important h2), h3[id]:not(div.note h3, div.warning h3, div.tip h3, div.caution h3, div.important h3), h4[id]:not(div.note h4, div.warning h4, div.tip h4, div.caution h4, div.important h4), h5[id]:not(div.note h5, div.warning h5, div.tip h5, div.caution h5, div.important h5), h6[id]:not(div.note h6, div.warning h6, div.tip h6, div.caution h6, div.important h6)');
-});

doc/build-helpers.md

@@ -1,30 +0,0 @@
-# Build helpers {#part-builders}
-
-A build helper is a function that produces derivations.
-
-:::{.warning}
-This is not to be confused with the [`builder` argument of the Nix `derivation` primitive](https://nixos.org/manual/nix/unstable/language/derivations.html), which refers to the executable that produces the build result, or [remote builder](https://nixos.org/manual/nix/stable/advanced-topics/distributed-builds.html), which refers to a remote  machine that could run such an executable.
-:::
-
-Such a function is usually designed to abstract over a typical workflow for a given programming language or framework.
-This allows declaring a build recipe by setting a limited number of options relevant to the particular use case instead of using the `derivation` function directly.
-
-[`stdenv.mkDerivation`](#part-stdenv) is the most widely used build helper, and serves as a basis for many others.
-In addition, it offers various options to customize parts of the builds.
-
-There is no uniform interface for build helpers.
-[Trivial build helpers](#chap-trivial-builders) and [fetchers](#chap-pkgs-fetchers) have various input types for convenience.
-[Language- or framework-specific build helpers](#chap-language-support) usually follow the style of `stdenv.mkDerivation`, which accepts an attribute set or a fixed-point function taking an attribute set.
-
-```{=include=} chapters
-build-helpers/fixed-point-arguments.chapter.md
-build-helpers/fetchers.chapter.md
-build-helpers/trivial-build-helpers.chapter.md
-build-helpers/testers.chapter.md
-build-helpers/dev-shell-tools.chapter.md
-build-helpers/special.md
-build-helpers/images.md
-hooks/index.md
-languages-frameworks/index.md
-packages/index.md
-```

doc/build-helpers/dev-shell-tools.chapter.md

@@ -1,84 +0,0 @@
-# Development Shell helpers {#chap-devShellTools}
-
-The `nix-shell` command has popularized the concept of transient shell environments for development or testing purposes.
-<!--
-  We should try to document the product, not its development process in the Nixpkgs reference manual,
-  but *something* needs to be said to provide context for this library.
-  This is the most future proof sentence I could come up with while Nix itself does yet make use of this.
-  Relevant is the current status of the devShell attribute "project": https://github.com/NixOS/nix/issues/7501
-  -->
-However, `nix-shell` is not the only way to create such environments, and even `nix-shell` itself can indirectly benefit from this library.
-
-This library provides a set of functions that help create such environments.
-
-## `devShellTools.valueToString` {#sec-devShellTools-valueToString}
-
-Converts Nix values to strings in the way the [`derivation` built-in function](https://nix.dev/manual/nix/2.23/language/derivations) does.
-
-:::{.example}
-## `valueToString` usage examples
-
-```nix
-devShellTools.valueToString (builtins.toFile "foo" "bar")
-# => "/nix/store/...-foo"
-```
-
-```nix
-devShellTools.valueToString false
-# => ""
-```
-
-:::
-
-## `devShellTools.unstructuredDerivationInputEnv` {#sec-devShellTools-unstructuredDerivationInputEnv}
-
-Convert a set of derivation attributes (as would be passed to [`derivation`]) to a set of environment variables that can be used in a shell script.
-This function does not support `__structuredAttrs`, but does support `passAsFile`.
-
-:::{.example}
-## `unstructuredDerivationInputEnv` usage example
-
-```nix
-devShellTools.unstructuredDerivationInputEnv {
-  drvAttrs = {
-    name = "foo";
-    buildInputs = [
-      hello
-      figlet
-    ];
-    builder = bash;
-    args = [
-      "-c"
-      "${./builder.sh}"
-    ];
-  };
-}
-# => {
-#  name = "foo";
-#  buildInputs = "/nix/store/...-hello /nix/store/...-figlet";
-#  builder = "/nix/store/...-bash";
-#}
-```
-
-Note that `args` is not included, because Nix does not added it to the builder process environment.
-
-:::
-
-## `devShellTools.derivationOutputEnv` {#sec-devShellTools-derivationOutputEnv}
-
-Takes the relevant parts of a derivation and returns a set of environment variables, that would be present in the derivation.
-
-:::{.example}
-## `derivationOutputEnv` usage example
-
-```nix
-let
-  pkg = hello;
-in
-devShellTools.derivationOutputEnv {
-  outputList = pkg.outputs;
-  outputMap = pkg;
-}
-```
-
-:::

doc/build-helpers/fetchers.chapter.md

@@ -1,949 +0,0 @@
-# Fetchers {#chap-pkgs-fetchers}
-
-Building software with Nix often requires downloading source code and other files from the internet.
-To this end, we use functions that we call _fetchers_, which obtain remote sources via various protocols and services.
-
-Nix provides built-in fetchers such as [`builtins.fetchTarball`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-fetchTarball).
-Nixpkgs provides its own fetchers, which work differently:
-
-- A built-in fetcher will download and cache files at evaluation time and produce a [store path](https://nixos.org/manual/nix/stable/glossary#gloss-store-path).
-  A Nixpkgs fetcher will create a ([fixed-output](https://nixos.org/manual/nix/stable/glossary#gloss-fixed-output-derivation)) [derivation](https://nixos.org/manual/nix/stable/glossary#gloss-derivation), and files are downloaded at build time.
-- Built-in fetchers will invalidate their cache after [`tarball-ttl`](https://nixos.org/manual/nix/stable/command-ref/conf-file#conf-tarball-ttl) expires, and will require network activity to check if the cache entry is up to date.
-  Nixpkgs fetchers only re-download if the specified hash changes or the store object is not available.
-- Built-in fetchers do not use [substituters](https://nixos.org/manual/nix/stable/command-ref/conf-file#conf-substituters).
-  Derivations produced by Nixpkgs fetchers will use any configured binary cache transparently.
-
-This significantly reduces the time needed to evaluate Nixpkgs, and allows [Hydra](https://nixos.org/hydra) to retain and re-distribute sources used by Nixpkgs in the [public binary cache](https://cache.nixos.org).
-For these reasons, Nix's built-in fetchers are not allowed in Nixpkgs.
-
-The following table summarises the differences:
-
-| Fetchers | Download | Output | Cache | Re-download when |
-|-|-|-|-|-|
-| `builtins.fetch*` | evaluation time | store path | `/nix/store`, `~/.cache/nix` | `tarball-ttl` expires, cache miss in `~/.cache/nix`, output store object not in local store |
-| `pkgs.fetch*` | build time | derivation | `/nix/store`, substituters | output store object not available |
-
-:::{.tip}
-`pkgs.fetchFrom*` helpers retrieve _snapshots_ of version-controlled sources, as opposed to the entire version history, which is more efficient.
-`pkgs.fetchgit` by default also has the same behaviour, but can be changed through specific attributes given to it.
-:::
-
-## Caveats {#chap-pkgs-fetchers-caveats}
-
-Because Nixpkgs fetchers are fixed-output derivations, an [output hash](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-outputHash) has to be specified, usually indirectly through a `hash` attribute.
-This hash refers to the derivation output, which can be different from the remote source itself!
-
-This has the following implications that you should be aware of:
-
-- Use Nix (or Nix-aware) tooling to produce the output hash.
-
-- When changing any fetcher parameters, always update the output hash.
-  Use one of the methods from [](#sec-pkgs-fetchers-updating-source-hashes).
-  Otherwise, existing store objects that match the output hash will be re-used rather than fetching new content.
-
-  :::{.note}
-  A similar problem arises while testing changes to a fetcher's implementation.
-  If the output of the derivation already exists in the Nix store, test failures can go undetected.
-  The [`invalidateFetcherByDrvHash`](#tester-invalidateFetcherByDrvHash) function helps prevent reusing cached derivations.
-  :::
-
-## Updating source hashes {#sec-pkgs-fetchers-updating-source-hashes}
-
-There are several ways to obtain the hash corresponding to a remote source.
-Unless you understand how the fetcher you're using calculates the hash from the downloaded contents, you should use [the fake hash method](#sec-pkgs-fetchers-updating-source-hashes-fakehash-method).
-
-1. []{#sec-pkgs-fetchers-updating-source-hashes-fakehash-method} The fake hash method: In your package recipe, set the hash to one of
-
-   - `""`
-   - `lib.fakeHash`
-   - `lib.fakeSha256`
-   - `lib.fakeSha512`
-
-   Attempt to build, extract the calculated hashes from error messages, and put them into the recipe.
-
-   :::{.warning}
-   You must use one of these four fake hashes and not some arbitrarily-chosen hash.
-   See [](#sec-pkgs-fetchers-secure-hashes) for details.
-   :::
-
-   :::{.example #ex-fetchers-update-fod-hash}
-   # Update source hash with the fake hash method
-
-   Consider the following recipe that produces a plain file:
-
-   ```nix
-   { fetchurl }:
-   fetchurl {
-     url = "https://raw.githubusercontent.com/NixOS/nixpkgs/23.05/.version";
-     hash = "sha256-ZHl1emidXVojm83LCVrwULpwIzKE/mYwfztVkvpruOM=";
-   }
-   ```
-
-   A common mistake is to update a fetcher parameter, such as `url`, without updating the hash:
-
-   ```nix
-   { fetchurl }:
-   fetchurl {
-     url = "https://raw.githubusercontent.com/NixOS/nixpkgs/23.11/.version";
-     hash = "sha256-ZHl1emidXVojm83LCVrwULpwIzKE/mYwfztVkvpruOM=";
-   }
-   ```
-
-   **This will produce the same output as before!**
-   Set the hash to an empty string:
-
-   ```nix
-   { fetchurl }:
-   fetchurl {
-     url = "https://raw.githubusercontent.com/NixOS/nixpkgs/23.11/.version";
-     hash = "";
-   }
-   ```
-
-   When building the package, use the error message to determine the correct hash:
-
-   ```shell
-   $ nix-build
-   (some output removed for clarity)
-   error: hash mismatch in fixed-output derivation '/nix/store/7yynn53jpc93l76z9zdjj4xdxgynawcw-version.drv':
-           specified: sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-               got:    sha256-BZqI7r0MNP29yGH5+yW2tjU9OOpOCEvwWKrWCv5CQ0I=
-   error: build of '/nix/store/bqdjcw5ij5ymfbm41dq230chk9hdhqff-version.drv' failed
-   ```
-   :::
-
-2. Prefetch the source with [`nix-prefetch-<type> <URL>`](https://search.nixos.org/packages?buckets={%22package_attr_set%22%3A[%22No%20package%20set%22]%2C%22package_license_set%22%3A[]%2C%22package_maintainers_set%22%3A[]%2C%22package_platforms%22%3A[]}&query=nix-prefetch), where `<type>` is one of
-
-   - `url`
-   - `git`
-   - `hg`
-   - `cvs`
-   - `bzr`
-   - `svn`
-
-   The hash is printed to stdout.
-
-3. Prefetch by package source (with `nix-prefetch-url '<nixpkgs>' -A <package>.src`, where `<package>` is package attribute name).
-   The hash is printed to stdout.
-
-   This works well when you've upgraded the existing package version and want to find out new hash, but is useless if the package can't be accessed by attribute or the package has multiple sources (`.srcs`, architecture-dependent sources, etc).
-
-4. Upstream hash: use it when upstream provides `sha256` or `sha512`.
-   Don't use it when upstream provides `md5`, compute `sha256` instead.
-
-   A little nuance is that `nix-prefetch-*` tools produce hashes with the `nix32` encoding (a Nix-specific base32 adaptation), but upstream usually provides hexadecimal (`base16`) encoding.
-   Fetchers understand both formats.
-   Nixpkgs does not standardise on any one format.
-
-   You can convert between hash formats with [`nix-hash`](https://nixos.org/manual/nix/stable/command-ref/nix-hash).
-
-5. Extract the hash from a local source archive with `sha256sum`.
-   Use `nix-prefetch-url file:///path/to/archive` if you want the custom Nix `base32` hash.
-
-## Obtaining hashes securely {#sec-pkgs-fetchers-secure-hashes}
-
-It's always a good idea to avoid Man-in-the-Middle (MITM) attacks when downloading source contents.
-Otherwise, you could unknowingly download malware instead of the intended source, and instead of the actual source hash, you'll end up using the hash of malware.
-Here are security considerations for this scenario:
-
-- `http://` URLs are not secure to prefetch hashes.
-
-- Upstream hashes should be obtained via a secure protocol.
-
-- `https://` URLs give you more protections when using `nix-prefetch-*` or for upstream hashes.
-
-- `https://` URLs are secure when using the [fake hash method](#sec-pkgs-fetchers-updating-source-hashes-fakehash-method) *only if* you use one of the listed fake hashes.
-  If you use any other hash, the download will be exposed to MITM attacks even if you use HTTPS URLs.
-
-  In more concrete terms, if you use any other hash, the [`--insecure` flag](https://curl.se/docs/manpage.html#-k) will be passed to the underlying call to `curl` when downloading content.
-
-## Proxy usage {#sec-pkgs-fetchers-proxy}
-
-Nixpkgs fetchers can make use of a http(s) proxy. Each fetcher will automatically inherit proxy-related environment variables (`http_proxy`, `https_proxy`, etc) via [impureEnvVars](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-impureEnvVars).
-
-The environment variable `NIX_SSL_CERT_FILE` is also inherited in fetchers, and can be used to provide a custom certificate bundle to fetchers. This is usually required for a https proxy to work without certificate validation errors.
-
-To use a temporary Tor instance as a proxy for fetching from `.onion` addresses, add `nativeBuildInputs = [ tor.proxyHook ];` to the fetcher parameters.
-
-[]{#fetchurl}
-## `fetchurl` {#sec-pkgs-fetchers-fetchurl}
-
-`fetchurl` returns a [fixed-output derivation](https://nixos.org/manual/nix/stable/glossary.html#gloss-fixed-output-derivation) which downloads content from a given URL and stores the unaltered contents within the Nix store.
-
-It uses {manpage}`curl(1)` internally, and allows its behaviour to be modified by specifying a few attributes in the argument to `fetchurl` (see the documentation for attributes `curlOpts`, `curlOptsList`, and `netrcPhase`).
-
-The resulting [store path](https://nixos.org/manual/nix/stable/store/store-path) is determined by the hash given to `fetchurl`, and also the `name` (or `pname` and `version`) values.
-
-If neither `name` nor `pname` and `version` are specified when calling `fetchurl`, it will default to using the [basename](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-baseNameOf) of `url` or the first element of `urls`.
-If `pname` and `version` are specified, `fetchurl` will use those values and will ignore `name`, even if it is also specified.
-
-### Inputs {#sec-pkgs-fetchers-fetchurl-inputs}
-
-`fetchurl` requires an attribute set with the following attributes:
-
-`url` (String; _optional_)
-: The URL to download from.
-
-  :::{.note}
-  Either `url` or `urls` must be specified, but not both.
-  :::
-
-  All URLs of the format [specified here](https://curl.se/docs/url-syntax.html#rfc-3986-plus) are supported.
-
-  _Default value:_ `""`.
-
-`urls` (List of String; _optional_)
-: A list of URLs, specifying download locations for the same content.
-  Each URL will be tried in order until one of them succeeds with some content or all of them fail.
-  See [](#ex-fetchers-fetchurl-nixpkgs-version-multiple-urls) to understand how this attribute affects the behaviour of `fetchurl`.
-
-  :::{.note}
-  Either `url` or `urls` must be specified, but not both.
-  :::
-
-  _Default value:_ `[]`.
-
-`hash` (String; _optional_)
-: Hash of the derivation output of `fetchurl`, following the format for integrity metadata as defined by [SRI](https://www.w3.org/TR/SRI/).
-  For more information, see [](#chap-pkgs-fetchers-caveats).
-
-  :::{.note}
-  It is recommended that you use the `hash` attribute instead of the other hash-specific attributes that exist for backwards compatibility.
-
-  If `hash` is not specified, you must specify `outputHash` and `outputHashAlgo`, or one of `sha512`, `sha256`, or `sha1`.
-  :::
-
-  _Default value:_ `""`.
-
-`outputHash` (String; _optional_)
-: Hash of the derivation output of `fetchurl` in the format expected by Nix.
-  See [the documentation on the Nix manual](https://nixos.org/manual/nix/stable/language/advanced-attributes.html#adv-attr-outputHash) for more information about its format.
-
-  :::{.note}
-  It is recommended that you use the `hash` attribute instead.
-
-  If `outputHash` is specified, you must also specify `outputHashAlgo`.
-  :::
-
-  _Default value:_ `""`.
-
-`outputHashAlgo` (String; _optional_)
-: Algorithm used to generate the value specified in `outputHash`.
-  See [the documentation on the Nix manual](https://nixos.org/manual/nix/stable/language/advanced-attributes.html#adv-attr-outputHashAlgo) for more information about the values it supports.
-
-  :::{.note}
-  It is recommended that you use the `hash` attribute instead.
-
-  The value specified in `outputHashAlgo` will be ignored if `outputHash` isn't also specified.
-  :::
-
-  _Default value:_ `""`.
-
-`sha1` (String; _optional_)
-: SHA-1 hash of the derivation output of `fetchurl` in the format expected by Nix.
-  See [the documentation on the Nix manual](https://nixos.org/manual/nix/stable/language/advanced-attributes.html#adv-attr-outputHash) for more information about its format.
-
-  :::{.note}
-  It is recommended that you use the `hash` attribute instead.
-  :::
-
-  _Default value:_ `""`.
-
-`sha256` (String; _optional_)
-: SHA-256 hash of the derivation output of `fetchurl` in the format expected by Nix.
-  See [the documentation on the Nix manual](https://nixos.org/manual/nix/stable/language/advanced-attributes.html#adv-attr-outputHash) for more information about its format.
-
-  :::{.note}
-  It is recommended that you use the `hash` attribute instead.
-  :::
-
-  _Default value:_ `""`.
-
-`sha512` (String; _optional_)
-: SHA-512 hash of the derivation output of `fetchurl` in the format expected by Nix.
-  See [the documentation on the Nix manual](https://nixos.org/manual/nix/stable/language/advanced-attributes.html#adv-attr-outputHash) for more information about its format.
-
-  :::{.note}
-  It is recommended that you use the `hash` attribute instead.
-  :::
-
-  _Default value:_ `""`.
-
-`name` (String; _optional_)
-: The symbolic name of the downloaded file when saved in the Nix store.
-  See [the `fetchurl` overview](#sec-pkgs-fetchers-fetchurl) for details on how the name of the file is decided.
-
-  _Default value:_ `""`.
-
-`pname` (String; _optional_)
-: A base name, which will be combined with `version` to form the symbolic name of the downloaded file when saved in the Nix store.
-  See [the `fetchurl` overview](#sec-pkgs-fetchers-fetchurl) for details on how the name of the file is decided.
-
-  :::{.note}
-  If `pname` is specified, you must also specify `version`, otherwise `fetchurl` will ignore the value of `pname`.
-  :::
-
-  _Default value:_ `""`.
-
-`version` (String; _optional_)
-: A version, which will be combined with `pname` to form the symbolic name of the downloaded file when saved in the Nix store.
-  See [the `fetchurl` overview](#sec-pkgs-fetchers-fetchurl) for details on how the name of the file is decided.
-
-  _Default value:_ `""`.
-
-`recursiveHash` (Boolean; _optional_) []{#sec-pkgs-fetchers-fetchurl-inputs-recursiveHash}
-: If set to `true`, will signal to Nix that the hash given to `fetchurl` was calculated using the `"recursive"` mode.
-  See [the documentation on the Nix manual](https://nixos.org/manual/nix/stable/language/advanced-attributes.html#adv-attr-outputHashMode) for more information about the existing modes.
-
-  By default, `fetchurl` uses `"recursive"` mode when the `executable` attribute is set to `true`, so you don't need to specify `recursiveHash` in this case.
-
-  _Default value:_ `false`.
-
-`executable` (Boolean; _optional_)
-: If `true`, sets the executable bit on the downloaded file.
-
-  _Default value_: `false`.
-
-`downloadToTemp` (Boolean; _optional_) []{#sec-pkgs-fetchers-fetchurl-inputs-downloadToTemp}
-: If `true`, saves the downloaded file to a temporary location instead of the expected Nix store location.
-  This is useful when used in conjunction with `postFetch` attribute, otherwise `fetchurl` will not produce any meaningful output.
-
-  The location of the downloaded file will be set in the `$downloadedFile` variable, which should be used by the script in the `postFetch` attribute.
-  See [](#ex-fetchers-fetchurl-nixpkgs-version-postfetch) to understand how to work with this attribute.
-
-  _Default value:_ `false`.
-
-`postFetch` (String; _optional_)
-: Script executed after the file has been downloaded successfully, and before `fetchurl` finishes running.
-  Useful for post-processing, to check or transform the file in some way.
-  See [](#ex-fetchers-fetchurl-nixpkgs-version-postfetch) to understand how to work with this attribute.
-
-  _Default value:_ `""`.
-
-`netrcPhase` (String or Null; _optional_)
-: Script executed to create a {manpage}`netrc(5)` file to be used with {manpage}`curl(1)`.
-  The script should create the `netrc` file (note that it does not begin with a ".") in the directory it's currently running in (`$PWD`).
-
-  The script is executed during the setup done by `fetchurl` before it runs any of its code to download the specified content.
-
-  :::{.note}
-  If specified, `fetchurl` will automatically alter its invocation of {manpage}`curl(1)` to use the `netrc` file, so you don't need to add anything to `curlOpts` or `curlOptsList`.
-  :::
-
-  :::{.caution}
-  Since `netrcPhase` needs to be specified in your source Nix code, any secrets that you put directly in it will be world-readable by design (both in your source code, and when the derivation gets created in the Nix store).
-
-  If you want to avoid this behaviour, see the documentation of `netrcImpureEnvVars` for an alternative way of dealing with these secrets.
-  :::
-
-  _Default value_: `null`.
-
-`netrcImpureEnvVars` (List of String; _optional_)
-: If specified, `fetchurl` will add these environment variable names to the list of [impure environment variables](https://nixos.org/manual/nix/stable/language/advanced-attributes.html#adv-attr-impureEnvVars), which will be passed from the environment of the calling user to the builder running the `fetchurl` code.
-
-  This is useful when used with `netrcPhase` to hide any secrets that are used in it, because the script in `netrcPhase` only needs to reference the environment variables with the secrets in them instead.
-  However, note that these are called _impure_ variables for a reason:
-  the environment that starts the build needs to have these variables declared for everything to work properly, which means that additional setup is required outside what Nix controls.
-
-  _Default value:_ `[]`.
-
-`curlOpts` (String; _optional_)
-: If specified, this value will be appended to the invocation of {manpage}`curl(1)` when downloading the URL(s) given to `fetchurl`.
-  Multiple arguments can be separated by spaces normally, but values with whitespaces will be interpreted as multiple arguments (instead of a single value), even if the value is escaped.
-  See `curlOptsList` for a way to pass values with whitespaces in them.
-
-  _Default value:_ `""`.
-
-`curlOptsList` (List of String; _optional_)
-: If specified, each element of this list will be passed as an argument to the invocation of {manpage}`curl(1)` when downloading the URL(s) given to `fetchurl`.
-  This allows passing values that contain spaces, with no escaping needed.
-
-  _Default value:_ `[]`.
-
-`showURLs` (Boolean; _optional_)
-: If set to `true`, this will stop `fetchurl` from downloading anything at all.
-  Instead, it will output a list of all the URLs it would've used to download the content (after resolving `mirror://` URLs, for example).
-  This is useful for debugging.
-
-  _Default value:_ `false`.
-
-`meta` (Attribute Set; _optional_)
-: Specifies any [meta-attributes](#chap-meta) for the derivation returned by `fetchurl`.
-
-  _Default value:_ `{}`.
-
-`passthru` (Attribute Set; _optional_)
-: Specifies any extra [`passthru`](#chap-passthru) attributes for the derivation returned by `fetchurl`.
-  Note that `fetchurl` defines [`passthru` attributes of its own](#ssec-pkgs-fetchers-fetchurl-passthru-outputs).
-  Attributes specified in `passthru` can override the default attributes returned by `fetchurl`.
-
-  _Default value:_ `{}`.
-
-`preferLocalBuild` (Boolean; _optional_)
-: This is the same attribute as [defined in the Nix manual](https://nixos.org/manual/nix/stable/language/advanced-attributes.html#adv-attr-preferLocalBuild).
-  It is `true` by default because making a remote machine download the content just duplicates network traffic (since the local machine might download the results from the derivation anyway), but this could be useful in cases where network access is restricted on local machines.
-
-  _Default value:_ `true`.
-
-`nativeBuildInputs` (List of Attribute Set; _optional_)
-: Additional packages needed to download the content.
-  This is useful if you need extra packages for `postFetch` or `netrcPhase`, for example.
-  Has the same semantics as in [](#var-stdenv-nativeBuildInputs).
-  See [](#ex-fetchers-fetchurl-nixpkgs-version-postfetch) to understand how this can be used with `postFetch`.
-
-  _Default value:_ `[]`.
-
-### Passthru outputs {#ssec-pkgs-fetchers-fetchurl-passthru-outputs}
-
-`fetchurl` also defines its own [`passthru`](#chap-passthru) attributes:
-
-`url` (String)
-
-: The same `url` attribute passed in the argument to `fetchurl`.
-
-### Examples {#ssec-pkgs-fetchers-fetchurl-examples}
-
-:::{.example #ex-fetchers-fetchurl-nixpkgs-version}
-# Using `fetchurl` to download a file
-
-The following package downloads a small file from a URL and shows the most common way to use `fetchurl`:
-
-```nix
-{ fetchurl }:
-fetchurl {
-  url = "https://raw.githubusercontent.com/NixOS/nixpkgs/23.11/.version";
-  hash = "sha256-BZqI7r0MNP29yGH5+yW2tjU9OOpOCEvwWKrWCv5CQ0I=";
-}
-```
-
-After building the package, the file will be downloaded and place into the Nix store:
-
-```shell
-$ nix-build
-(output removed for clarity)
-/nix/store/4g9y3x851wqrvim4zcz5x2v3zivmsq8n-version
-
-$ cat /nix/store/4g9y3x851wqrvim4zcz5x2v3zivmsq8n-version
-23.11
-```
-:::
-
-:::{.example #ex-fetchers-fetchurl-nixpkgs-version-multiple-urls}
-# Using `fetchurl` to download a file with multiple possible URLs
-
-The following package adapts [](#ex-fetchers-fetchurl-nixpkgs-version) to use multiple URLs.
-The first URL was crafted to intentionally return an error to illustrate how `fetchurl` will try multiple URLs until it finds one that works (or all URLs fail).
-
-```nix
-{ fetchurl }:
-fetchurl {
-  urls = [
-    "https://raw.githubusercontent.com/NixOS/nixpkgs/23.11/does-not-exist"
-    "https://raw.githubusercontent.com/NixOS/nixpkgs/23.11/.version"
-  ];
-  hash = "sha256-BZqI7r0MNP29yGH5+yW2tjU9OOpOCEvwWKrWCv5CQ0I=";
-}
-```
-
-After building the package, both URLs will be used to download the file:
-
-```shell
-$ nix-build
-(some output removed for clarity)
-trying https://raw.githubusercontent.com/NixOS/nixpkgs/23.11/does-not-exist
-(some output removed for clarity)
-curl: (22) The requested URL returned error: 404
-
-trying https://raw.githubusercontent.com/NixOS/nixpkgs/23.11/.version
-(some output removed for clarity)
-/nix/store/n9asny31z32q7sdw6a8r1gllrsfy53kl-does-not-exist
-
-$ cat /nix/store/n9asny31z32q7sdw6a8r1gllrsfy53kl-does-not-exist
-23.11
-```
-
-However, note that the name of the file was derived from the first URL (this is further explained in [the `fetchurl` overview](#sec-pkgs-fetchers-fetchurl)).
-To ensure the result will have the same name regardless of which URLs are used, we can modify the package:
-
-```nix
-{ fetchurl }:
-fetchurl {
-  name = "nixpkgs-version";
-  urls = [
-    "https://raw.githubusercontent.com/NixOS/nixpkgs/23.11/does-not-exist"
-    "https://raw.githubusercontent.com/NixOS/nixpkgs/23.11/.version"
-  ];
-  hash = "sha256-BZqI7r0MNP29yGH5+yW2tjU9OOpOCEvwWKrWCv5CQ0I=";
-}
-```
-
-After building the package, the result will have the name we specified:
-
-```shell
-$ nix-build
-(output removed for clarity)
-/nix/store/zczb6wl3al6jm9sm5h3pr6nqn0i5ji9z-nixpkgs-version
-```
-:::
-
-:::{.example #ex-fetchers-fetchurl-nixpkgs-version-postfetch}
-# Manipulating the content downloaded by `fetchurl`
-
-It might be useful to manipulate the content downloaded by `fetchurl` directly in its derivation.
-In this example, we'll adapt [](#ex-fetchers-fetchurl-nixpkgs-version) to append the result of running the `hello` package to the contents we download, purely to illustrate how to manipulate the content.
-
-```nix
-{
-  fetchurl,
-  hello,
-  lib,
-}:
-fetchurl {
-  url = "https://raw.githubusercontent.com/NixOS/nixpkgs/23.11/.version";
-
-  nativeBuildInputs = [ hello ];
-
-  downloadToTemp = true;
-  postFetch = ''
-    ${lib.getExe hello} >> $downloadedFile
-    mv $downloadedFile $out
-  '';
-
-  hash = "sha256-ceooQQYmDx5+0nfg40uU3NNI2yKrixP7HZ/xLZUNv+w=";
-}
-```
-
-After building the package, the resulting file will have "Hello, world!" appended to it:
-
-```shell
-$ nix-build
-(output removed for clarity)
-/nix/store/ifi6pp7q0ag5h7c5v9h1c1c7bhd10c7f-version
-
-$ cat /nix/store/ifi6pp7q0ag5h7c5v9h1c1c7bhd10c7f-version
-23.11
-Hello, world!
-```
-
-Note that the `hash` specified in the package is different than the hash specified in [](#ex-fetchers-fetchurl-nixpkgs-version), because the contents of the output have changed (even though the actual file that was downloaded is the same).
-See [](#chap-pkgs-fetchers-caveats) for more details on how to work with the `hash` attribute when the output changes.
-:::
-
-## `fetchzip` {#sec-pkgs-fetchers-fetchzip}
-
-Returns a [fixed-output derivation](https://nixos.org/manual/nix/stable/glossary.html#gloss-fixed-output-derivation) which downloads an archive from a given URL and decompresses it.
-
-Despite its name, `fetchzip` is not limited to `.zip` files but can also be used with [various compressed tarball formats](#tar-files) by default.
-This can extended by specifying additional attributes, see [](#ex-fetchers-fetchzip-rar-archive) to understand how to do that.
-
-### Inputs {#sec-pkgs-fetchers-fetchzip-inputs}
-
-`fetchzip` requires an attribute set, and most attributes are passed to the underlying call to [`fetchurl`](#sec-pkgs-fetchers-fetchurl).
-
-The attributes below are treated differently by `fetchzip` when compared to what `fetchurl` expects:
-
-`name` (String; _optional_)
-: Works as defined in `fetchurl`, but has a different default value than `fetchurl`.
-
-  _Default value:_ `"source"`.
-
-`nativeBuildInputs` (List of Attribute Set; _optional_)
-: Works as defined in `fetchurl`, but it is also augmented by `fetchzip` to include packages to deal with additional archives (such as `.zip`).
-
-  _Default value:_ `[]`.
-
-`postFetch` (String; _optional_)
-: Works as defined in `fetchurl`, but it is also augmented with the code needed to make `fetchzip` work.
-
-  :::{.caution}
-  It is only safe to modify files in `$out` in `postFetch`.
-  Consult the implementation of `fetchzip` for anything more involved.
-  :::
-
-  _Default value:_ `""`.
-
-`stripRoot` (Boolean; _optional_)
-: If `true`, the decompressed contents are moved one level up the directory tree.
-
-  This is useful for archives that decompress into a single directory which commonly includes some values that change with time, such as version numbers.
-  When this is the case (and `stripRoot` is `true`), `fetchzip` will remove this directory and make the decompressed contents available in the top-level directory.
-
-  [](#ex-fetchers-fetchzip-simple-striproot) shows what this attribute does.
-
-  This attribute is **not** passed through to `fetchurl`.
-
-  _Default value:_ `true`.
-
-`extension` (String or Null; _optional_)
-: If set, the archive downloaded by `fetchzip` will be renamed to a filename with the extension specified in this attribute.
-
-  This is useful when making `fetchzip` support additional types of archives, because the implementation may use the extension of an archive to determine whether they can decompress it.
-  If the URL you're using to download the contents doesn't end with the extension associated with the archive, use this attribute to fix the filename of the archive.
-
-  This attribute is **not** passed through to `fetchurl`.
-
-  _Default value:_ `null`.
-
-`recursiveHash` (Boolean; _optional_)
-: Works [as defined in `fetchurl`](#sec-pkgs-fetchers-fetchurl-inputs-recursiveHash), but its default value is different than for `fetchurl`.
-
-  _Default value:_ `true`.
-
-`downloadToTemp` (Boolean; _optional_)
-: Works [as defined in `fetchurl`](#sec-pkgs-fetchers-fetchurl-inputs-downloadToTemp), but its default value is different than for `fetchurl`.
-
-  _Default value:_ `true`.
-
-`extraPostFetch` **DEPRECATED**
-: This attribute is deprecated.
-  Please use `postFetch` instead.
-
-  This attribute is **not** passed through to `fetchurl`.
-
-### Examples {#sec-pkgs-fetchers-fetchzip-examples}
-
-::::{.example #ex-fetchers-fetchzip-simple-striproot}
-# Using `fetchzip` to output contents directly
-
-The following recipe shows how to use `fetchzip` to decompress a `.tar.gz` archive:
-
-```nix
-{ fetchzip }:
-fetchzip {
-  url = "https://github.com/NixOS/patchelf/releases/download/0.18.0/patchelf-0.18.0.tar.gz";
-  hash = "sha256-3ABYlME9R8klcpJ7MQpyFEFwHmxDDEzIYBqu/CpDYmg=";
-}
-```
-
-This archive has all its contents in a directory named `patchelf-0.18.0`.
-This means that after decompressing, you'd have to enter this directory to see the contents of the archive.
-However, `fetchzip` makes this easier through the attribute `stripRoot` (enabled by default).
-
-After building the recipe, the derivation output will show all the files in the archive at the top level:
-
-```shell
-$ nix-build
-(output removed for clarity)
-/nix/store/1b7h3fvmgrcddvs0m299hnqxlgli1yjw-source
-
-$ ls /nix/store/1b7h3fvmgrcddvs0m299hnqxlgli1yjw-source
-aclocal.m4  completions  configure.ac  m4           Makefile.in  patchelf.spec     README.md  tests
-build-aux   configure    COPYING       Makefile.am  patchelf.1   patchelf.spec.in  src        version
-```
-
-If `stripRoot` is set to `false`, the derivation output will be the decompressed archive as-is:
-
-```nix
-{ fetchzip }:
-fetchzip {
-  url = "https://github.com/NixOS/patchelf/releases/download/0.18.0/patchelf-0.18.0.tar.gz";
-  hash = "sha256-uv3FuKE4DqpHT3yfE0qcnq0gYjDNQNKZEZt2+PUAneg=";
-  stripRoot = false;
-}
-```
-
-:::{.caution}
-The hash changed!
-Whenever changing attributes of a Nixpkgs fetcher, [remember to invalidate the hash](#chap-pkgs-fetchers-caveats), otherwise you won't get the results you're expecting!
-:::
-
-After building the recipe:
-
-```shell
-$ nix-build
-(output removed for clarity)
-/nix/store/2hy5bxw7xgbgxkn0i4x6hjr8w3dbx16c-source
-
-$ ls /nix/store/2hy5bxw7xgbgxkn0i4x6hjr8w3dbx16c-source
-patchelf-0.18.0
-```
-::::
-
-::::{.example #ex-fetchers-fetchzip-rar-archive}
-# Using `fetchzip` to decompress a `.rar` file
-
-The `unrar` package provides a [setup hook](#ssec-setup-hooks) to decompress `.rar` archives during the [unpack phase](#ssec-unpack-phase), which can be used with `fetchzip` to decompress those archives:
-
-```nix
-{ fetchzip, unrar }:
-fetchzip {
-  url = "https://archive.org/download/SpaceCadet_Plus95/Space_Cadet.rar";
-  hash = "sha256-fC+zsR8BY6vXpUkVd6i1jF0IZZxVKVvNi6VWCKT+pA4=";
-  stripRoot = false;
-  nativeBuildInputs = [ unrar ];
-}
-```
-
-Since this particular `.rar` file doesn't put its contents in a directory inside the archive, `stripRoot` must be set to `false`.
-
-After building the recipe, the derivation output will show the decompressed files:
-
-```shell
-$ nix-build
-(output removed for clarity)
-/nix/store/zpn7knxfva6rfjja2gbb4p3l9w1f0d36-source
-
-$ ls /nix/store/zpn7knxfva6rfjja2gbb4p3l9w1f0d36-source
-FONT.DAT      PINBALL.DAT  PINBALL.EXE	PINBALL2.MID  TABLE.BMP    WMCONFIG.EXE
-MSCREATE.DIR  PINBALL.DOC  PINBALL.MID	Sounds	     WAVEMIX.INF
-```
-::::
-
-## `fetchpatch` {#fetchpatch}
-
-`fetchpatch` works very similarly to `fetchurl` with the same arguments expected. It expects patch files as a source and performs normalization on them before computing the checksum. For example, it will remove comments or other unstable parts that are sometimes added by version control systems and can change over time.
-
-- `relative`: Similar to using `git-diff`'s `--relative` flag, only keep changes inside the specified directory, making paths relative to it.
-- `stripLen`: Remove the first `stripLen` components of pathnames in the patch.
-- `decode`: Pipe the downloaded data through this command before processing it as a patch.
-- `extraPrefix`: Prefix pathnames by this string.
-- `excludes`: Exclude files matching these patterns (applies after the above arguments).
-- `includes`: Include only files matching these patterns (applies after the above arguments).
-- `revert`: Revert the patch.
-
-Note that because the checksum is computed after applying these effects, using or modifying these arguments will have no effect unless the `hash` argument is changed as well.
-
-
-Most other fetchers return a directory rather than a single file.
-
-
-## `fetchDebianPatch` {#fetchdebianpatch}
-
-A wrapper around `fetchpatch`, which takes:
-- `patch` and `hash`: the patch's filename,
-  and its hash after normalization by `fetchpatch` ;
-- `pname`: the Debian source package's name ;
-- `version`: the upstream version number ;
-- `debianRevision`: the [Debian revision number] if applicable ;
-- the `area` of the Debian archive: `main` (default), `contrib`, or `non-free`.
-
-Here is an example of `fetchDebianPatch` in action:
-
-```nix
-{
-  lib,
-  fetchDebianPatch,
-  buildPythonPackage,
-}:
-
-buildPythonPackage rec {
-  pname = "pysimplesoap";
-  version = "1.16.2";
-  src = <...>;
-
-  patches = [
-    (fetchDebianPatch {
-      inherit pname version;
-      debianRevision = "5";
-      patch = "Add-quotes-to-SOAPAction-header-in-SoapClient.patch";
-      hash = "sha256-xA8Wnrpr31H8wy3zHSNfezFNjUJt1HbSXn3qUMzeKc0=";
-    })
-  ];
-
-  # ...
-}
-```
-
-Patches are fetched from `sources.debian.org`, and so must come from a
-package version that was uploaded to the Debian archive.  Packages may
-be removed from there once that specific version isn't in any suite
-anymore (stable, testing, unstable, etc.), so maintainers should use
-`copy-tarballs.pl` to archive the patch if it needs to be available
-longer-term.
-
-[Debian revision number]: https://www.debian.org/doc/debian-policy/ch-controlfields.html#version
-
-
-## `fetchsvn` {#fetchsvn}
-
-Used with Subversion. Expects `url` to a Subversion directory, `rev`, and `hash`.
-
-## `fetchgit` {#fetchgit}
-
-Used with Git. Expects `url` to a Git repo, `rev`, and `hash`. `rev` in this case can be full the git commit id (SHA1 hash) or a tag name like `refs/tags/v1.0`.
-
-If you want to fetch a tag you should pass the `tag` parameter instead of `rev` which has the same effect as setting `rev = "refs/tags"/${version}"`.
-This is safer than just setting `rev = version` w.r.t. possible branch and tag name conflicts.
-
-Additionally, the following optional arguments can be given:
-
-*`fetchSubmodules`* (Boolean)
-
-: Whether to also fetch the submodules of a repository.
-
-*`fetchLFS`* (Boolean)
-
-: Whether to fetch LFS objects.
-
-*`preFetch`* (String)
-
-: Shell code to be executed before the repository has been fetched, to allow
-  changing the environment the fetcher runs in.
-
-*`postFetch`* (String)
-
-: Shell code executed after the repository has been fetched successfully.
-  This can do things like check or transform the file.
-
-*`leaveDotGit`* (Boolean)
-
-: Whether the `.git` directory of the clone should *not* be removed after checkout.
-
-  Be warned though that the git repository format is not stable and this flag is therefore not suitable for actual use by itself.
-  Only use this for testing purposes or in conjunction with removing the `.git` directory in `postFetch`.
-
-*`deepClone`* (Boolean)
-
-: Clone the entire repository as opposing to just creating a shallow clone.
-  This implies `leaveDotGit`.
-
-*`fetchTags`* (Boolean)
-
-: Whether to fetch all tags from the remote repository. This is useful when the build process needs to run `git describe` or other commands that require tag information to be available. This parameter implies `leaveDotGit`, as tags are stored in the `.git` directory.
-
-*`sparseCheckout`* (List of String)
-
-: Prevent git from fetching unnecessary blobs from server.
-  This is useful if only parts of the repository are needed.
-
-  ::: {.example #ex-fetchgit-sparseCheckout}
-
-  # Use `sparseCheckout` to only include some directories:
-
-  ```nix
-  { stdenv, fetchgit }:
-
-  stdenv.mkDerivation {
-    name = "hello";
-    src = fetchgit {
-      url = "https://...";
-      sparseCheckout = [
-        "directory/to/be/included"
-        "another/directory"
-      ];
-      hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-    };
-  }
-  ```
-  :::
-
-  See [git sparse-checkout](https://git-scm.com/docs/git-sparse-checkout) for more information.
-
-Some additional parameters for niche use-cases can be found listed in the function parameters in the declaration of `fetchgit`: `pkgs/build-support/fetchgit/default.nix`.
-Future parameters additions might also happen without immediately being documented here.
-
-## `fetchfossil` {#fetchfossil}
-
-Used with Fossil. Expects `url` to a Fossil archive, `rev`, and `hash`.
-
-## `fetchcvs` {#fetchcvs}
-
-Used with CVS. Expects `cvsRoot`, `tag`, and `hash`.
-
-## `fetchhg` {#fetchhg}
-
-Used with Mercurial. Expects `url`, `rev`, `hash`, overridable with [`<pkg>.overrideAttrs`](#sec-pkg-overrideAttrs).
-
-A number of fetcher functions wrap part of `fetchurl` and `fetchzip`. They are mainly convenience functions intended for commonly used destinations of source code in Nixpkgs. These wrapper fetchers are listed below.
-
-## `fetchFromGitea` {#fetchfromgitea}
-
-`fetchFromGitea` expects five arguments. `domain` is the gitea server name. `owner` is a string corresponding to the Gitea user or organization that controls this repository. `repo` corresponds to the name of the software repository. These are located at the top of every Gitea HTML page as `owner`/`repo`. `rev` corresponds to the Git commit hash or tag (e.g `v1.0`) that will be downloaded from Git. Finally, `hash` corresponds to the hash of the extracted directory. Again, other hash algorithms are also available but `hash` is currently preferred.
-
-## `fetchFromGitHub` {#fetchfromgithub}
-
-`fetchFromGitHub` expects four arguments. `owner` is a string corresponding to the GitHub user or organization that controls this repository. `repo` corresponds to the name of the software repository. These are located at the top of every GitHub HTML page as `owner`/`repo`. `rev` corresponds to the Git commit hash or tag (e.g `v1.0`) that will be downloaded from Git. If you need to fetch a tag however, you should prefer to use the `tag` parameter which achieves this in a safer way with less boilerplate. Finally, `hash` corresponds to the hash of the extracted directory. Again, other hash algorithms are also available, but `hash` is currently preferred.
-
-To use a different GitHub instance, use `githubBase` (defaults to `"github.com"`).
-
-`fetchFromGitHub` uses `fetchzip` to download the source archive generated by GitHub for the specified revision. If `leaveDotGit`, `deepClone` or `fetchSubmodules` are set to `true`, `fetchFromGitHub` will use `fetchgit` instead. Refer to its section for documentation of these options.
-
-## `fetchFromGitLab` {#fetchfromgitlab}
-
-This is used with GitLab repositories. It behaves similarly to `fetchFromGitHub`, and expects `owner`, `repo`, `rev`, and `hash`.
-
-To use a specific GitLab instance, use `domain` (defaults to `"gitlab.com"`).
-
-
-## `fetchFromGitiles` {#fetchfromgitiles}
-
-This is used with Gitiles repositories. The arguments expected are similar to `fetchgit`.
-
-## `fetchFromBitbucket` {#fetchfrombitbucket}
-
-This is used with BitBucket repositories. The arguments expected are very similar to `fetchFromGitHub` above.
-
-## `fetchFromSavannah` {#fetchfromsavannah}
-
-This is used with Savannah repositories. The arguments expected are very similar to `fetchFromGitHub` above.
-
-## `fetchFromRepoOrCz` {#fetchfromrepoorcz}
-
-This is used with repo.or.cz repositories. The arguments expected are very similar to `fetchFromGitHub` above.
-
-## `fetchFromSourcehut` {#fetchfromsourcehut}
-
-This is used with sourcehut repositories. Similar to `fetchFromGitHub` above,
-it expects `owner`, `repo`, `rev` and `hash`, but don't forget the tilde (~)
-in front of the username! Expected arguments also include `vc` ("git" (default)
-or "hg"), `domain` and `fetchSubmodules`.
-
-If `fetchSubmodules` is `true`, `fetchFromSourcehut` uses `fetchgit`
-or `fetchhg` with `fetchSubmodules` or `fetchSubrepos` set to `true`,
-respectively. Otherwise, the fetcher uses `fetchzip`.
-
-## `requireFile` {#requirefile}
-
-`requireFile` allows requesting files that cannot be fetched automatically, but whose content is known.
-This is a useful last-resort workaround for license restrictions that prohibit redistribution, or for downloads that are only accessible after authenticating interactively in a browser.
-If the requested file is present in the Nix store, the resulting derivation will not be built, because its expected output is already available.
-Otherwise, the builder will run, but fail with a message explaining to the user how to provide the file. The following code, for example:
-
-```nix
-requireFile {
-  name = "jdk-${version}_linux-x64_bin.tar.gz";
-  url = "https://www.oracle.com/java/technologies/javase-jdk11-downloads.html";
-  hash = "sha256-lL00+F7jjT71nlKJ7HRQuUQ7kkxVYlZh//5msD8sjeI=";
-}
-```
-results in this error message:
-```
-***
-Unfortunately, we cannot download file jdk-11.0.10_linux-x64_bin.tar.gz automatically.
-Please go to https://www.oracle.com/java/technologies/javase-jdk11-downloads.html to download it yourself, and add it to the Nix store
-using either
-  nix-store --add-fixed sha256 jdk-11.0.10_linux-x64_bin.tar.gz
-or
-  nix-prefetch-url --type sha256 file:///path/to/jdk-11.0.10_linux-x64_bin.tar.gz
-
-***
-```
-
-This function should only be used by non-redistributable software with an unfree license that we need to require the user to download manually.
-It produces packages that cannot be built automatically.
-
-## `fetchtorrent` {#fetchtorrent}
-
-`fetchtorrent` expects two arguments. `url` which can either be a Magnet URI (Magnet Link) such as `magnet:?xt=urn:btih:dd8255ecdc7ca55fb0bbf81323d87062db1f6d1c` or an HTTP URL pointing to a `.torrent` file. It can also take a `config` argument which will craft a `settings.json` configuration file and give it to `transmission`, the underlying program that is performing the fetch. The available config options for `transmission` can be found [here](https://github.com/transmission/transmission/blob/main/docs/Editing-Configuration-Files.md#options)
-
-```nix
-{ fetchtorrent }:
-
-fetchtorrent {
-  config = {
-    peer-limit-global = 100;
-  };
-  url = "magnet:?xt=urn:btih:dd8255ecdc7ca55fb0bbf81323d87062db1f6d1c";
-  hash = "";
-}
-```
-
-### Parameters {#fetchtorrent-parameters}
-
-- `url`: Magnet URI (Magnet Link) such as `magnet:?xt=urn:btih:dd8255ecdc7ca55fb0bbf81323d87062db1f6d1c` or an HTTP URL pointing to a `.torrent` file.
-
-- `backend`: Which bittorrent program to use. Default: `"transmission"`. Valid values are `"rqbit"` or `"transmission"`. These are the two most suitable torrent clients for fetching in a fixed-output derivation at the time of writing, as they can be easily exited after usage. `rqbit` is written in Rust and has a smaller closure size than `transmission`, and the performance and peer discovery properties differs between these clients, requiring experimentation to decide upon which is the best.
-
-- `config`: When using `transmission` as the `backend`, a json configuration can
-  be supplied to transmission. Refer to the [upstream documentation](https://github.com/transmission/transmission/blob/main/docs/Editing-Configuration-Files.md) for information on how to configure.
-

doc/build-helpers/fixed-point-arguments.chapter.md

@@ -1,71 +0,0 @@
-# Fixed-point arguments of build helpers {#chap-build-helpers-finalAttrs}
-
-As mentioned in the beginning of this part, `stdenv.mkDerivation` could alternatively accept a fixed-point function. The input of such function, typically named `finalAttrs`, is expected to be the final state of the attribute set.
-A build helper like this is said to accept **fixed-point arguments**.
-
-Build helpers don't always support fixed-point arguments yet, as support in [`stdenv.mkDerivation`](#mkderivation-recursive-attributes) was first included in Nixpkgs 22.05.
-
-## Defining a build helper with `lib.extendMkDerivation` {#sec-build-helper-extendMkDerivation}
-
-Developers can use the Nixpkgs library function [`lib.customisation.extendMkDerivation`](#function-library-lib.customisation.extendMkDerivation) to define a build helper supporting fixed-point arguments from an existing one with such support, with an attribute overlay similar to the one taken by [`<pkg>.overrideAttrs`](#sec-pkg-overrideAttrs).
-
-Beside overriding, `lib.extendMkDerivation` also supports `excludeDrvArgNames` to optionally exclude some arguments in the input fixed-point arguments from passing down the base build helper (specified as `constructDrv`).
-
-:::{.example #ex-build-helpers-extendMkDerivation}
-
-# Example definition of `mkLocalDerivation` extended from `stdenv.mkDerivation` with `lib.extendMkDerivation`
-
-We want to define a build helper named `mkLocalDerivation` that builds locally without using substitutes by default.
-
-Instead of taking a plain attribute set,
-
-```nix
-{
-  preferLocalBuild ? true,
-  allowSubstitute ? false,
-  specialArg ? (_: false),
-  ...
-}@args:
-
-stdenv.mkDerivation (
-  removeAttrs [
-    # Don't pass specialArg into mkDerivation.
-    "specialArg"
-  ] args
-  // {
-    # Arguments to pass
-    inherit preferLocalBuild allowSubstitute;
-    # Some expressions involving specialArg
-    greeting = if specialArg "hi" then "hi" else "hello";
-  }
-)
-```
-
-we could define with `lib.extendMkDerivation` an attribute overlay to make the result build helper also accepts the the attribute set's fixed point passing to the underlying `stdenv.mkDerivation`, named `finalAttrs` here:
-
-```nix
-lib.extendMkDerivation {
-  constructDrv = stdenv.mkDerivation;
-  excludeDrvArgNames = [
-    # Don't pass specialArg into mkDerivation.
-    "specialArg"
-  ];
-  extendDrvArgs =
-    finalAttrs:
-    {
-      preferLocalBuild ? true,
-      allowSubstitute ? false,
-      specialArg ? (_: false),
-      ...
-    }@args:
-    {
-      # Arguments to pass
-      inherit preferLocalBuild allowSubstitute;
-      # Some expressions involving specialArg
-      greeting = if specialArg "hi" then "hi" else "hello";
-    };
-}
-```
-:::
-
-If one needs to apply extra changes to the result derivation, pass the derivation transformation function to `lib.extendMkDerivation` as `lib.customisation.extendMkDerivation { transformDrv = drv: ...; }`.

doc/build-helpers/images.md

@@ -1,12 +0,0 @@
-# Images {#chap-images}
-
-This chapter describes tools for creating various types of images.
-
-```{=include=} sections
-images/appimagetools.section.md
-images/dockertools.section.md
-images/ocitools.section.md
-images/portableservice.section.md
-images/makediskimage.section.md
-images/binarycache.section.md
-```

doc/build-helpers/images/appimagetools.section.md

@@ -1,166 +0,0 @@
-# pkgs.appimageTools {#sec-pkgs-appimageTools}
-
-`pkgs.appimageTools` is a set of functions for extracting and wrapping [AppImage](https://appimage.org/) files.
-They are meant to be used if traditional packaging from source is infeasible, or if it would take too long.
-To quickly run an AppImage file, `pkgs.appimage-run` can be used as well.
-
-::: {.warning}
-The `appimageTools` API is unstable and may be subject to backwards-incompatible changes in the future.
-:::
-
-## Wrapping {#ssec-pkgs-appimageTools-wrapping}
-
-Use `wrapType2` to wrap any AppImage.
-This will create a FHS environment with many packages [expected to exist](https://github.com/AppImage/pkg2appimage/blob/master/excludelist) for the AppImage to work.
-`wrapType2` expects an argument with the `src` attribute, and either a `name` attribute or `pname` and `version` attributes.
-
-It will eventually call into [`buildFHSEnv`](#sec-fhs-environments), and any extra attributes in the argument to `wrapType2` will be passed through to it.
-This means that you can pass the `extraInstallCommands` attribute, for example, and it will have the same effect as described in [`buildFHSEnv`](#sec-fhs-environments).
-
-::: {.note}
-In the past, `appimageTools` provided both `wrapType1` and `wrapType2`, to be used depending on the type of AppImage that was being wrapped.
-However, [those were unified early 2020](https://github.com/NixOS/nixpkgs/pull/81833), meaning that both `wrapType1` and `wrapType2` have the same behaviour now.
-:::
-
-:::{.example #ex-wrapping-appimage-from-github}
-
-# Wrapping an AppImage from GitHub
-
-```nix
-{ appimageTools, fetchurl }:
-let
-  pname = "nuclear";
-  version = "0.6.30";
-
-  src = fetchurl {
-    url = "https://github.com/nukeop/nuclear/releases/download/v${version}/nuclear-v${version}.AppImage";
-    hash = "sha256-he1uGC1M/nFcKpMM9JKY4oeexJcnzV0ZRxhTjtJz6xw=";
-  };
-in
-appimageTools.wrapType2 { inherit pname version src; }
-```
-
-:::
-
-The argument passed to `wrapType2` can also contain an `extraPkgs` attribute, which allows you to include additional packages inside the FHS environment your AppImage is going to run in.
-`extraPkgs` must be a function that returns a list of packages.
-There are a few ways to learn which dependencies an application needs:
-
-  - Looking through the extracted AppImage files, reading its scripts and running `patchelf` and `ldd` on its executables.
-    This can also be done in `appimage-run`, by setting `APPIMAGE_DEBUG_EXEC=bash`.
-  - Running `strace -vfefile` on the wrapped executable, looking for libraries that can't be found.
-
-:::{.example #ex-wrapping-appimage-with-extrapkgs}
-
-# Wrapping an AppImage with extra packages
-
-```nix
-{ appimageTools, fetchurl }:
-let
-  pname = "irccloud";
-  version = "0.16.0";
-
-  src = fetchurl {
-    url = "https://github.com/irccloud/irccloud-desktop/releases/download/v${version}/IRCCloud-${version}-linux-x86_64.AppImage";
-    hash = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
-  };
-in
-appimageTools.wrapType2 {
-  inherit pname version src;
-  extraPkgs = pkgs: [ pkgs.at-spi2-core ];
-}
-```
-
-:::
-
-## Extracting {#ssec-pkgs-appimageTools-extracting}
-
-Use `extract` if you need to extract the contents of an AppImage.
-This is usually used in Nixpkgs to install extra files in addition to [wrapping](#ssec-pkgs-appimageTools-wrapping) the AppImage.
-`extract` expects an argument with the `src` attribute, and either a `name` attribute or `pname` and `version` attributes.
-
-::: {.note}
-In the past, `appimageTools` provided both `extractType1` and `extractType2`, to be used depending on the type of AppImage that was being extracted.
-However, [those were unified early 2020](https://github.com/NixOS/nixpkgs/pull/81572), meaning that both `extractType1` and `extractType2` have the same behaviour as `extract` now.
-:::
-
-:::{.example #ex-extracting-appimage}
-
-# Extracting an AppImage to install extra files
-
-This example was adapted from a real package in Nixpkgs to show how `extract` is usually used in combination with `wrapType2`.
-Note how `appimageContents` is used in `extraInstallCommands` to install additional files that were extracted from the AppImage.
-
-```nix
-{ appimageTools, fetchurl }:
-let
-  pname = "irccloud";
-  version = "0.16.0";
-
-  src = fetchurl {
-    url = "https://github.com/irccloud/irccloud-desktop/releases/download/v${version}/IRCCloud-${version}-linux-x86_64.AppImage";
-    hash = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
-  };
-
-  appimageContents = appimageTools.extract { inherit pname version src; };
-in
-appimageTools.wrapType2 {
-  inherit pname version src;
-
-  extraPkgs = pkgs: [ pkgs.at-spi2-core ];
-
-  extraInstallCommands = ''
-    mv $out/bin/${pname}-${version} $out/bin/${pname}
-    install -m 444 -D ${appimageContents}/irccloud.desktop $out/share/applications/irccloud.desktop
-    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
-      $out/share/icons/hicolor/512x512/apps/irccloud.png
-    substituteInPlace $out/share/applications/irccloud.desktop \
-      --replace-fail 'Exec=AppRun' 'Exec=${pname}'
-  '';
-}
-```
-
-:::
-
-The argument passed to `extract` can also contain a `postExtract` attribute, which allows you to execute additional commands after the files are extracted from the AppImage.
-`postExtract` must be a string with commands to run.
-
-:::{.example #ex-extracting-appimage-with-postextract}
-
-# Extracting an AppImage to install extra files, using `postExtract`
-
-This is a rewrite of [](#ex-extracting-appimage) to use `postExtract`.
-
-```nix
-{ appimageTools, fetchurl }:
-let
-  pname = "irccloud";
-  version = "0.16.0";
-
-  src = fetchurl {
-    url = "https://github.com/irccloud/irccloud-desktop/releases/download/v${version}/IRCCloud-${version}-linux-x86_64.AppImage";
-    hash = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
-  };
-
-  appimageContents = appimageTools.extract {
-    inherit pname version src;
-    postExtract = ''
-      substituteInPlace $out/irccloud.desktop --replace-fail 'Exec=AppRun' 'Exec=${pname}'
-    '';
-  };
-in
-appimageTools.wrapType2 {
-  inherit pname version src;
-
-  extraPkgs = pkgs: [ pkgs.at-spi2-core ];
-
-  extraInstallCommands = ''
-    mv $out/bin/${pname}-${version} $out/bin/${pname}
-    install -m 444 -D ${appimageContents}/irccloud.desktop $out/share/applications/irccloud.desktop
-    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
-      $out/share/icons/hicolor/512x512/apps/irccloud.png
-  '';
-}
-```
-
-:::

doc/build-helpers/images/binarycache.section.md

@@ -1,63 +0,0 @@
-# pkgs.mkBinaryCache {#sec-pkgs-binary-cache}
-
-`pkgs.mkBinaryCache` is a function for creating Nix flat-file binary caches.
-Such a cache exists as a directory on disk, and can be used as a Nix substituter by passing `--substituter file:///path/to/cache` to Nix commands.
-
-Nix packages are most commonly shared between machines using [HTTP, SSH, or S3](https://nixos.org/manual/nix/stable/package-management/sharing-packages.html), but a flat-file binary cache can still be useful in some situations.
-For example, you can copy it directly to another machine, or make it available on a network file system.
-It can also be a convenient way to make some Nix packages available inside a container via bind-mounting.
-
-`mkBinaryCache` expects an argument with the `rootPaths` attribute.
-`rootPaths` must be a list of derivations.
-The transitive closure of these derivations' outputs will be copied into the cache.
-
-## Optional arguments {#sec-pkgs-binary-cache-arguments}
-
-`compression` (`"none"` or `"xz"` or `"zstd"`; _optional_)
-
-: The compression algorithm to use.
-
-  _Default value:_ `zstd`.
-
-::: {.note}
-This function is meant for advanced use cases.
-The more idiomatic way to work with flat-file binary caches is via the [nix-copy-closure](https://nixos.org/manual/nix/stable/command-ref/nix-copy-closure.html) command.
-You may also want to consider [dockerTools](#sec-pkgs-dockerTools) for your containerization needs.
-:::
-
-[]{#sec-pkgs-binary-cache-example}
-:::{.example #ex-mkbinarycache-copying-package-closure}
-
-# Copying a package and its closure to another machine with `mkBinaryCache`
-
-The following derivation will construct a flat-file binary cache containing the closure of `hello`.
-
-```nix
-{ mkBinaryCache, hello }: mkBinaryCache { rootPaths = [ hello ]; }
-```
-
-Build the cache on a machine.
-Note that the command still builds the exact nix package above, but adds some boilerplate to build it directly from an expression.
-
-```shellSession
-$ nix-build -E 'let pkgs = import <nixpkgs> {}; in pkgs.callPackage ({ mkBinaryCache, hello }: mkBinaryCache { rootPaths = [hello]; }) {}'
-/nix/store/azf7xay5xxdnia4h9fyjiv59wsjdxl0g-binary-cache
-```
-
-Copy the resulting directory to another machine, which we'll call `host2`:
-
-```shellSession
-$ scp result host2:/tmp/hello-cache
-```
-
-At this point, the cache can be used as a substituter when building derivations on `host2`:
-
-```shellSession
-$ nix-build -A hello '<nixpkgs>' \
-  --option require-sigs false \
-  --option trusted-substituters file:///tmp/hello-cache \
-  --option substituters file:///tmp/hello-cache
-/nix/store/zhl06z4lrfrkw5rp0hnjjfrgsclzvxpm-hello-2.12.1
-```
-
-:::