Release NixOS 24.05

(cherry picked from commit 899c542291)

.git-blame-ignore-revs

@@ -109,10 +109,6 @@ fb0e5be84331188a69b3edd31679ca6576edb75a
 # postgresql: move packages.nix to ext/default.nix
 719034f6f6749d624faa28dff259309fc0e3e730
 
-# php ecosystem: reformat with nixfmt-rfc-style
-75ae7621330ff8db944ce4dff4374e182d5d151f
-c759efa5e7f825913f9a69ef20f025f50f56dc4d
-
 # pkgs/os-specific/bsd: Reformat with nixfmt-rfc-style 2024-03-01
 3fe3b055adfc020e6a923c466b6bcd978a13069a
 
@@ -121,38 +117,3 @@ c759efa5e7f825913f9a69ef20f025f50f56dc4d
 
 # python3Packages: format with nixfmt
 59b1aef59071cae6e87859dc65de973d2cc595c0
-
-# treewide description changes (#317959)
-bf995e3641950f4183c1dd9010349263dfa0123b
-755b915a158c9d588f08e9b08da9f7f3422070cc
-f8c4a98e8e138e21353a2c33b90db3359f539b37
-
-# vscode-extensions.*: format with nixfmt (RFC 166)
-7bf9febfa6271012b1ef86647a3a06f06875fdcf
-
-# remove uses of mdDoc (#303841)
-1a24330f792c8625746d07d842290e6fd95ae6f9
-acd0e3898feb321cb9a71a0fd376f1157d0f4553
-1b28414d2886c57343864326dbb745a634d3e37d
-6afb255d976f85f3359e4929abd6f5149c323a02
-
-# azure-cli: move to by-name, nixfmt #325950
-96cd538b68bd1d0a0a37979356d669abbba32ebc
-
-# poptracker: format with nixfmt-rfc-style (#326697)
-ff5c8f6cc3d1f2e017e86d50965c14b71f00567b
-
-# mangal: format with nixfmt-rfc-style #328284
-3bb5e993cac3a6e1c3056d2bc9bf43eb2c7a5951
-
-# pico-sdk: switch to finalAttrs (#329438)
-8946018b0391ae594d167f1e58497b18de068968
-
-# ollama: format with nixfmt-rfc-style (#329353)
-bdfde18037f8d9f9b641a4016c8ada4dc4cbf856
-
-# nixos/ollama: format with nixfmt-rfc-style (#329561)
-246d1ee533810ac1946d863bbd9de9b525818d56
-
-# nixos/nvidia: apply nixfmt-rfc-style (#313440)
-fbdcdde04a7caa007e825a8b822c75fab9adb2d6

.github/CODEOWNERS

@@ -11,14 +11,11 @@
 # This also holds true for GitHub teams. Since almost none of our teams have write
 # permissions, you need to list all members of the team with commit access individually.
 
-# CI
+# GitHub actions
 /.github/workflows @NixOS/Security @Mic92 @zowoq
-/.github/workflows/check-nix-format.yml @infinisil
-/ci @infinisil @NixOS/Security
 
-# Develompent support
+# EditorConfig
 /.editorconfig @Mic92 @zowoq
-/shell.nix @infinisil @NixOS/Security
 
 # Libraries
 /lib                        @infinisil
@@ -53,7 +50,7 @@
 /pkgs/build-support/setup-hooks/auto-patchelf.py @layus
 /pkgs/pkgs-lib                                   @infinisil
 ## Format generators/serializers
-/pkgs/pkgs-lib/formats/libconfig                 @h7x4
+/pkgs/pkgs-lib/formats/libconfig                 @ckiee @h7x4
 /pkgs/pkgs-lib/formats/hocon                     @h7x4
 
 # pkgs/by-name
@@ -70,11 +67,8 @@
 /nixos/lib/make-disk-image.nix                 @raitobezarius
 
 # Nix, the package manager
-# @raitobezarius is not "code owner", but is listed here to be notified of changes
-# pertaining to the Nix package manager.
-# i.e. no authority over those files.
-pkgs/tools/package-management/nix/                    @raitobezarius
-nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius
+pkgs/tools/package-management/nix/                    @raitobezarius @ma27
+nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius @ma27
 
 # Nixpkgs documentation
 /maintainers/scripts/db-to-md.sh @jtojnar @ryantm
@@ -99,6 +93,7 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius
 /nixos/default.nix                                    @infinisil
 /nixos/lib/from-env.nix                               @infinisil
 /nixos/lib/eval-config.nix                            @infinisil
+/nixos/modules/system                                 @dasJ
 /nixos/modules/system/activation/bootspec.nix         @grahamc @cole-h @raitobezarius
 /nixos/modules/system/activation/bootspec.cue         @grahamc @cole-h @raitobezarius
 
@@ -108,9 +103,6 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius
 # NixOS QEMU virtualisation
 /nixos/virtualisation/qemu-vm.nix           @raitobezarius
 
-# ACME
-/nixos/modules/security/acme                @arianvp @flokli @aanderse # no merge permission: @m1cr0man @emilazy
-
 # Systemd
 /nixos/modules/system/boot/systemd.nix      @NixOS/systemd
 /nixos/modules/system/boot/systemd          @NixOS/systemd
@@ -121,8 +113,8 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius
 /nixos/modules/system/boot/loader/systemd-boot      @JulienMalka
 
 # Images and installer media
-/nixos/modules/installer/cd-dvd/
-/nixos/modules/installer/sd-card/
+/nixos/modules/installer/cd-dvd/            @samueldr
+/nixos/modules/installer/sd-card/           @samueldr
 
 # Updaters
 ## update.nix
@@ -132,11 +124,8 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius
 /pkgs/common-updater/scripts/update-source-version    @jtojnar
 
 # Python-related code and docs
-/doc/languages-frameworks/python.section.md   @mweinelt @natsukium
-/maintainers/scripts/update-python-libraries            @natsukium
-/pkgs/development/interpreters/python                   @natsukium
-/pkgs/top-level/python-packages.nix                     @natsukium
-/pkgs/top-level/release-python.nix                      @natsukium
+/doc/languages-frameworks/python.section.md                 @mweinelt
+/pkgs/development/interpreters/python/hooks                 @jonringer
 
 # Haskell
 /doc/languages-frameworks/haskell.section.md  @sternenseemann @maralorn @ncfavier
@@ -148,9 +137,9 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius
 /pkgs/top-level/haskell-packages.nix          @sternenseemann @maralorn @ncfavier
 
 # Perl
-/pkgs/development/interpreters/perl @stigtsp @zakame @marcusramberg
-/pkgs/top-level/perl-packages.nix   @stigtsp @zakame @marcusramberg
-/pkgs/development/perl-modules      @stigtsp @zakame @marcusramberg
+/pkgs/development/interpreters/perl @stigtsp @zakame @dasJ @marcusramberg
+/pkgs/top-level/perl-packages.nix   @stigtsp @zakame @dasJ @marcusramberg
+/pkgs/development/perl-modules      @stigtsp @zakame @dasJ @marcusramberg
 
 # R
 /pkgs/applications/science/math/R   @jbedo
@@ -163,7 +152,6 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius
 
 # C compilers
 /pkgs/development/compilers/gcc
-/pkgs/development/compilers/llvm @RossComputerGuy
 /pkgs/development/compilers/emscripten @raitobezarius
 /doc/languages-frameworks/emscripten.section.md @raitobezarius
 
@@ -231,15 +219,18 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /nixos/modules/services/networking/ntp @thoughtpolice
 
 # Network
+/pkgs/tools/networking/octodns @Janik-Haag
 /pkgs/tools/networking/kea/default.nix @mweinelt
 /pkgs/tools/networking/babeld/default.nix @mweinelt
 /nixos/modules/services/networking/babeld.nix @mweinelt
 /nixos/modules/services/networking/kea.nix @mweinelt
 /nixos/modules/services/networking/knot.nix @mweinelt
+nixos/modules/services/networking/networkmanager.nix @Janik-Haag
 /nixos/modules/services/monitoring/prometheus/exporters/kea.nix @mweinelt
 /nixos/tests/babeld.nix @mweinelt
 /nixos/tests/kea.nix @mweinelt
 /nixos/tests/knot.nix @mweinelt
+/nixos/tests/networking/* @Janik-Haag
 
 # Web servers
 /doc/packages/nginx.section.md @raitobezarius
@@ -268,13 +259,13 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/top-level/emacs-packages.nix              @adisbladis
 
 # Neovim
-/pkgs/applications/editors/neovim      @figsoda @teto
+/pkgs/applications/editors/neovim      @figsoda @jonringer @teto
 
 # VimPlugins
-/pkgs/applications/editors/vim/plugins         @figsoda
+/pkgs/applications/editors/vim/plugins         @figsoda @jonringer
 
 # VsCode Extensions
-/pkgs/applications/editors/vscode/extensions
+/pkgs/applications/editors/vscode/extensions   @jonringer
 
 # PHP interpreter, packages, extensions, tests and documentation
 /doc/languages-frameworks/php.section.md          @aanderse @drupol @globin @ma27 @talyz
@@ -294,9 +285,9 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/applications/blockchains  @mmahut @RaghavSood
 
 # Go
-/doc/languages-frameworks/go.section.md @kalbasit @katexochen @Mic92 @zowoq
-/pkgs/build-support/go @kalbasit @katexochen @Mic92 @zowoq
-/pkgs/development/compilers/go @kalbasit @katexochen @Mic92 @zowoq
+/doc/languages-frameworks/go.section.md @kalbasit @Mic92 @zowoq
+/pkgs/build-support/go @kalbasit @Mic92 @zowoq
+/pkgs/development/compilers/go @kalbasit @Mic92 @zowoq
 
 # GNOME
 /pkgs/desktops/gnome                              @jtojnar
@@ -304,11 +295,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/build-support/make-hardcode-gsettings-patch @jtojnar
 
 # Cinnamon
-/pkgs/by-name/ci/cinnamon-*    @mkg20001
-/pkgs/by-name/cj/cjs           @mkg20001
-/pkgs/by-name/mu/muffin        @mkg20001
-/pkgs/by-name/ne/nemo          @mkg20001
-/pkgs/by-name/ne/nemo-*        @mkg20001
+/pkgs/desktops/cinnamon @mkg20001
 
 # nim
 /pkgs/development/compilers/nim   @ehmry
@@ -323,15 +310,15 @@ nixos/modules/services/misc/forgejo.nix @adamcstephens @bendlas @emilylange
 pkgs/by-name/fo/forgejo/package.nix     @adamcstephens @bendlas @emilylange
 
 # Dotnet
-/pkgs/build-support/dotnet                  @corngood
-/pkgs/development/compilers/dotnet          @corngood
-/pkgs/test/dotnet                           @corngood
-/doc/languages-frameworks/dotnet.section.md @corngood
+/pkgs/build-support/dotnet                  @IvarWithoutBones
+/pkgs/development/compilers/dotnet          @IvarWithoutBones
+/pkgs/test/dotnet                           @IvarWithoutBones
+/doc/languages-frameworks/dotnet.section.md @IvarWithoutBones
 
 # Node.js
-/pkgs/build-support/node/build-npm-package      @winterqt
-/pkgs/build-support/node/fetch-npm-deps         @winterqt
-/doc/languages-frameworks/javascript.section.md @winterqt
+/pkgs/build-support/node/build-npm-package      @lilyinstarlight @winterqt
+/pkgs/build-support/node/fetch-npm-deps         @lilyinstarlight @winterqt
+/doc/languages-frameworks/javascript.section.md @lilyinstarlight @winterqt
 
 # environment.noXlibs option aka NoX
 /nixos/modules/config/no-x-libs.nix  @SuperSandro2000
@@ -374,16 +361,5 @@ nixos/tests/lxd/                        @adamcstephens
 pkgs/by-name/in/incus/                  @adamcstephens
 pkgs/by-name/lx/lxc*                    @adamcstephens
 pkgs/by-name/lx/lxd*                    @adamcstephens
+pkgs/os-specific/linux/lxc/             @adamcstephens
 
-# ExpidusOS, Flutter
-/pkgs/development/compilers/flutter @RossComputerGuy
-/pkgs/desktops/expidus              @RossComputerGuy
-
-# GNU Tar & Zip
-/pkgs/tools/archivers/gnutar        @RossComputerGuy
-/pkgs/tools/archivers/zip           @RossComputerGuy
-
-# SELinux
-/pkgs/os-specific/linux/checkpolicy @RossComputerGuy
-/pkgs/os-specific/linux/libselinux  @RossComputerGuy
-/pkgs/os-specific/linux/libsepol    @RossComputerGuy

.github/PULL_REQUEST_TEMPLATE.md

@@ -24,7 +24,7 @@ For new packages please briefly describe the package or provide a link to its ho
   - made sure NixOS tests are [linked](https://nixos.org/manual/nixpkgs/unstable/#ssec-nixos-tests-linking) to the relevant packages
 - [ ] Tested compilation of all packages that depend on this change using `nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"`. Note: all changes have to be committed, also see [nixpkgs-review usage](https://github.com/Mic92/nixpkgs-review#usage)
 - [ ] Tested basic functionality of all binary files (usually in `./result/bin/`)
-- [24.11 Release Notes](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2411.section.md) (or backporting [23.11](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2311.section.md) and [24.05](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2405.section.md) Release notes)
+- [24.05 Release Notes](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2405.section.md) (or backporting [23.05](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2305.section.md) and [23.11](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2311.section.md) Release notes)
   - [ ] (Package updates) Added a release notes entry if the change is major or breaking
   - [ ] (Module updates) Added a release notes entry if the change is significant
   - [ ] (Module addition) Added a release notes entry if adding a new NixOS module

.github/labeler.yml

@@ -12,25 +12,9 @@
   - any:
     - changed-files:
       - any-glob-to-any-file:
+        - pkgs/desktops/cinnamon/**/*
         - nixos/modules/services/x11/desktop-managers/cinnamon.nix
         - nixos/tests/cinnamon.nix
-        - nixos/tests/cinnamon-wayland.nix
-        - pkgs/by-name/ci/cinnamon-*/**/*
-        - pkgs/by-name/cj/cjs/**/*
-        - pkgs/by-name/mu/muffin/**/*
-        - pkgs/by-name/ne/nemo/**/*
-        - pkgs/by-name/ne/nemo-*/**/*
-
-"6.topic: dotnet":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - doc/languages-frameworks/dotnet.section.md
-        - maintainers/scripts/update-dotnet-lockfiles.nix
-        - pkgs/build-support/dotnet/**/*
-        - pkgs/development/compilers/dotnet/**/*
-        - pkgs/test/dotnet/**/*
-        - pkgs/top-level/dotnet-packages.nix
 
 "6.topic: emacs":
   - any:
@@ -39,9 +23,9 @@
         - nixos/modules/services/editors/emacs.nix
         - nixos/modules/services/editors/emacs.xml
         - nixos/tests/emacs-daemon.nix
-        - pkgs/applications/editors/emacs/build-support/**/*
         - pkgs/applications/editors/emacs/elisp-packages/**/*
         - pkgs/applications/editors/emacs/**/*
+        - pkgs/build-support/emacs/**/*
         - pkgs/top-level/emacs-packages.nix
 
 "6.topic: Enlightenment DE":
@@ -79,13 +63,6 @@
         - lib/systems/flake-systems.nix
         - nixos/modules/config/nix-flakes.nix
 
-"6.topic: flutter":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - pkgs/build-support/flutter/*.nix
-        - pkgs/development/compilers/flutter/**/*.nix
-
 "6.topic: GNOME":
   - any:
     - changed-files:
@@ -157,12 +134,6 @@
       - any-glob-to-any-file:
         - lib/**
 
-"6.topic: llvm/clang":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - pkgs/development/compilers/llvm/**/*
-
 "6.topic: lua":
   - any:
     - changed-files:
@@ -230,7 +201,6 @@
         - pkgs/development/node-packages/**/*
         - pkgs/development/tools/yarn/*
         - pkgs/development/tools/yarn2nix-moretea/**/*
-        - pkgs/development/tools/pnpm/**/*
         - pkgs/development/web/nodejs/*
 
 "6.topic: ocaml":
@@ -350,7 +320,6 @@
         #       *developed in this repo*;
         #       - not individual tests
         #       - not packages for test frameworks
-        - pkgs/build-support/testers/**
         - nixos/lib/testing/**
         - nixos/lib/test-driver/**
         - nixos/tests/nixos-test-driver/**

.github/workflows/backport.yml

@@ -20,11 +20,11 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Create backport PRs
-        uses: korthout/backport-action@bd410d37cdcae80be6d969823ff5a225fe5c833f # v3.0.2
+        uses: korthout/backport-action@ef20d86abccbac3ee3a73cb2efbdc06344c390e5 # v2.5.0
         with:
           # Config README: https://github.com/korthout/backport-action#backport-action
           copy_labels_pattern: 'severity:\ssecurity'

.github/workflows/basic-eval.yml

@@ -18,9 +18,9 @@ jobs:
     runs-on: ubuntu-latest
     # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-    - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
-    - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+    - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+    - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
+    - uses: cachix/cachix-action@18cf96c7c98e048e10a83abd92116114cd8504be # v14
       with:
         # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
         name: nixpkgs-ci

.github/workflows/check-by-name.yml

@@ -14,16 +14,16 @@ on:
     # While `edited` is also triggered when the PR title/body is changed,
     # this PR action is fairly quick, and PR's don't get edited that often,
     # so it shouldn't be a problem
-    # There is a feature request for adding a `base_changed` event:
-    # https://github.com/orgs/community/discussions/35058
     types: [opened, synchronize, reopened, edited]
 
 permissions: {}
 
-# We don't use a concurrency group here, because the action is triggered quite often (due to the PR edit
-# trigger), and contributers would get notified on any canceled run.
-# There is a feature request for supressing notifications on concurrency-canceled runs:
-# https://github.com/orgs/community/discussions/13015
+# Create a check-by-name concurrency group based on the pull request number. if
+# an event triggers a run on the same PR while a previous run is still in
+# progress, the previous run will be canceled and the new one will start.
+concurrency:
+  group: check-by-name-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
 
 jobs:
   check:
@@ -58,7 +58,7 @@ jobs:
 
             if [[ "$mergeable" == "null" ]]; then
               if (( retryCount == 0 )); then
-                echo "Not retrying anymore. It's likely that GitHub is having internal issues: check https://www.githubstatus.com/"
+                echo "Not retrying anymore, probably GitHub is having internal issues"
                 exit 1
               else
                 (( retryCount -= 1 )) || true
@@ -81,7 +81,7 @@ jobs:
           else
             echo "The PR cannot be merged, it has a merge conflict, skipping the rest.."
           fi
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
         if: env.mergedSha
         with:
           # pull_request_target checks out the base branch by default
@@ -94,7 +94,7 @@ jobs:
           base=$(mktemp -d)
           git worktree add "$base" "$(git rev-parse HEAD^1)"
           echo "base=$base" >> "$GITHUB_ENV"
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         if: env.mergedSha
       - name: Fetching the pinned tool
         if: env.mergedSha

.github/workflows/check-cherry-picks.yml

@@ -4,7 +4,6 @@ on:
     branches:
      - 'release-**'
      - 'staging-**'
-     - '!staging-next'
 
 permissions: {}
 
@@ -13,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+    - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
       with:
         fetch-depth: 0
         filter: blob:none

.github/workflows/check-maintainers-sorted.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
@@ -20,7 +20,7 @@ jobs:
           sparse-checkout: |
             lib
             maintainers
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true

.github/workflows/check-nix-format.yml

@@ -7,82 +7,56 @@ name: Check that Nix files are formatted
 
 on:
   pull_request_target:
-    # See the comment at the same location in ./check-by-name.yml
-    types: [opened, synchronize, reopened, edited]
 permissions:
   contents: read
 
 jobs:
   nixos:
     runs-on: ubuntu-latest
-    if: "!contains(github.event.pull_request.title, '[skip treewide]')"
+    if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-          # Fetches the merge commit and its parents
-          fetch-depth: 2
-      - name: Checking out base branch
-        run: |
-          base=$(mktemp -d)
-          baseRev=$(git rev-parse HEAD^1)
-          git worktree add "$base" "$baseRev"
-          echo "baseRev=$baseRev" >> "$GITHUB_ENV"
-          echo "base=$base" >> "$GITHUB_ENV"
-      - name: Get Nixpkgs revision for nixfmt
-        run: |
-          # pin to a commit from nixpkgs-unstable to avoid e.g. building nixfmt
-          # from staging
-          # This should not be a URL, because it would allow PRs to run arbitrary code in CI!
-          rev=$(jq -r .rev ci/pinned-nixpkgs.json)
-          echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
-          nix_path: nixpkgs=${{ env.url }}
+          # fix a commit from nixpkgs-unstable to avoid e.g. building nixfmt
+          # from staging
+          nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/4b455dc2048f73a79eb3713f342369ff58f93e0b.tar.gz
       - name: Install nixfmt
         run: "nix-env -f '<nixpkgs>' -iAP nixfmt-rfc-style"
       - name: Check that Nix files are formatted according to the RFC style
+        # Each environment variable beginning with NIX_FMT_PATHS_ is a list of
+        # paths to check with nixfmt.
+        env:
+          NIX_FMT_PATHS_BSD: pkgs/os-specific/bsd
+          NIX_FMT_PATHS_MPVSCRIPTS: pkgs/applications/video/mpv/scripts
+          # Format paths related to the Nixpkgs CUDA ecosystem.
+          NIX_FMT_PATHS_CUDA: |
+            pkgs/development/cuda-modules
+            pkgs/test/cuda
+            pkgs/top-level/cuda-packages.nix
+          NIX_FMT_PATHS_K3S: |
+            nixos/modules/services/cluster/k3s
+            nixos/tests/k3s
+            pkgs/applications/networking/cluster/k3s
+          NIX_FMT_PATHS_VSCODE_EXTS: pkgs/applications/editors/vscode/extensions
+          NIX_FMT_PATHS_PHP_PACKAGES: pkgs/development/php-packages
+          NIX_FMT_PATHS_BUILD_SUPPORT_PHP: pkgs/build-support/php
+        # Iterate over all environment variables beginning with NIX_FMT_PATHS_.
         run: |
-          unformattedFiles=()
-
-          # TODO: Make this more parallel
-
-          # Loop through all Nix files touched by the PR
-          while readarray -d '' -n 2 entry && (( ${#entry[@]} != 0 )); do
-            type=${entry[0]}
-            file=${entry[1]}
-            case $type in
-              A*)
-                source=""
-                dest=$file
-                ;;
-              M*)
-                source=$file
-                dest=$file
-                ;;
-              C*|R*)
-                source=$file
-                read -r -d '' dest
-                ;;
-              *)
-                echo "Ignoring file $file with type $type"
-                continue
-            esac
-
-            # Ignore files that weren't already formatted
-            if [[ -n "$source" ]] && ! nixfmt --check ${{ env.base }}/"$source" 2>/dev/null; then
-              echo "Ignoring file $file because it's not formatted in the base commit"
-            elif ! nixfmt --check "$dest"; then
-              unformattedFiles+=("$dest")
+          for env_var in "${!NIX_FMT_PATHS_@}"; do
+            readarray -t paths <<< "${!env_var}"
+            if [[ "${paths[*]}" == "" ]]; then
+              echo "Error: $env_var is empty."
+              exit 1
             fi
-          done < <(git diff -z --name-status ${{ env.baseRev }} -- '*.nix')
-
-          if (( "${#unformattedFiles[@]}" > 0 )); then
-            echo "Some new/changed Nix files are not properly formatted"
-            echo "Please run the following in \`nix-shell\`:"
-            echo "nixfmt ${unformattedFiles[*]@Q}"
-            exit 1
-          fi
+            echo "Checking paths: ${paths[@]}"
+            if ! nixfmt --check "${paths[@]}"; then
+              echo "Error: nixfmt failed."
+              exit 1
+            fi
+          done

.github/workflows/check-nixf-tidy.yml

@@ -1,128 +0,0 @@
-name: Check changed Nix files with nixf-tidy (experimental)
-
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened, edited]
-permissions:
-  contents: read
-
-jobs:
-  nixos:
-    runs-on: ubuntu-latest
-    if: "!contains(github.event.pull_request.title, '[skip treewide]')"
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-        with:
-          # pull_request_target checks out the base branch by default
-          ref: refs/pull/${{ github.event.pull_request.number }}/merge
-          # Fetches the merge commit and its parents
-          fetch-depth: 2
-      - name: Checking out base branch
-        run: |
-          base=$(mktemp -d)
-          baseRev=$(git rev-parse HEAD^1)
-          git worktree add "$base" "$baseRev"
-          echo "baseRev=$baseRev" >> "$GITHUB_ENV"
-          echo "base=$base" >> "$GITHUB_ENV"
-      - name: Get Nixpkgs revision for nixf
-        run: |
-          # pin to a commit from nixpkgs-unstable to avoid e.g. building nixf
-          # from staging
-          # This should not be a URL, because it would allow PRs to run arbitrary code in CI!
-          rev=$(jq -r .rev ci/pinned-nixpkgs.json)
-          echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
-        with:
-          # explicitly enable sandbox
-          extra_nix_config: sandbox = true
-          nix_path: nixpkgs=${{ env.url }}
-      - name: Install nixf and jq
-        # provided jq is incompatible with our expression
-        run: "nix-env -f '<nixpkgs>' -iAP nixf jq"
-      - name: Check that Nix files pass nixf-tidy
-        run: |
-          # Filtering error messages we don't like
-          nixf_wrapper(){
-            nixf-tidy --variable-lookup < "$1" | jq -r '
-              [
-                "sema-escaping-with"
-              ]
-              as $ignored_errors|[.[]|select(.sname as $s|$ignored_errors|index($s)|not)]
-            '
-          }
-
-          failedFiles=()
-
-          # Don't report errors to file overview
-          # to avoid duplicates when editing title and description
-          if [[ "${{ github.event.action }}" == 'edited' ]] && [[ -z "${{ github.event.edited.changes.base }}" ]]; then
-            DONT_REPORT_ERROR=1
-          else
-            DONT_REPORT_ERROR=
-          fi
-          # TODO: Make this more parallel
-
-          # Loop through all Nix files touched by the PR
-          while readarray -d '' -n 2 entry && (( ${#entry[@]} != 0 )); do
-            type=${entry[0]}
-            file=${entry[1]}
-            case $type in
-              A*)
-                source=""
-                dest=$file
-                ;;
-              M*)
-                source=$file
-                dest=$file
-                ;;
-              C*|R*)
-                source=$file
-                read -r -d '' dest
-                ;;
-              *)
-                echo "Ignoring file $file with type $type"
-                continue
-            esac
-
-            if [[ -n "$source" ]] && [[ "$(nixf_wrapper ${{ env.base }}/"$source")" != '[]' ]] 2>/dev/null; then
-              echo "Ignoring file $file because it doesn't pass nixf-tidy in the base commit"
-              echo # insert blank line
-            else
-              nixf_report="$(nixf_wrapper "$dest")"
-              if [[ "$nixf_report" != '[]' ]]; then
-                echo "$dest doesn't pass nixf-tidy. Reported by nixf-tidy:"
-                errors=$(echo "$nixf_report" | jq -r --arg dest "$dest" '
-                  def getLCur: "line=" + (.line+1|tostring) + ",col=" + (.column|tostring);
-                  def getRCur: "endLine=" + (.line+1|tostring) + ",endColumn=" + (.column|tostring);
-                  def getRange: "file=\($dest)," + (.lCur|getLCur) + "," + (.rCur|getRCur);
-                  def getBody: . as $top|(.range|getRange) + ",title="+ .sname + "::" +
-                    (.message|sub("{}" ; ($top.args.[]|tostring)));
-                  def getNote: "\n::notice " + (.|getBody);
-                  def getMessage: "::error " + (.|getBody) + (if (.notes|length)>0 then
-                    ([.notes.[]|getNote]|add) else "" end);
-                  .[]|getMessage
-                ')
-                if [[ -z "$DONT_REPORT_ERROR" ]]; then
-                  echo "$errors"
-                else
-                  # just print in plain text
-                  echo "$errors" | sed 's/^:://'
-                  echo # add one empty line
-                fi
-                failedFiles+=("$dest")
-              fi
-            fi
-          done < <(git diff -z --name-status ${{ env.baseRev }} -- '*.nix')
-
-          if [[ -n "$DONT_REPORT_ERROR" ]]; then
-            echo "Edited the PR but didn't change the base branch, only the description/title."
-            echo "Not reporting errors again to avoid duplication."
-            echo # add one empty line
-          fi
-
-          if (( "${#failedFiles[@]}" > 0 )); then
-            echo "Some new/changed Nix files don't pass nixf-tidy."
-            echo "See ${{ github.event.pull_request.html_url }}/files for reported errors."
-            echo "If you believe this is a false positive, ping @Aleksanaa and @inclyc in this PR."
-            exit 1
-          fi

.github/workflows/check-shell.yml

@@ -1,29 +0,0 @@
-name: "Check shell"
-
-on:
-  pull_request_target:
-
-permissions: {}
-
-jobs:
-  x86_64-linux:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-        with:
-          # pull_request_target checks out the base branch by default
-          ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
-      - name: Build shell
-        run: nix-build shell.nix
-
-  aarch64-darwin:
-    runs-on: macos-latest
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-        with:
-          # pull_request_target checks out the base branch by default
-          ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
-      - name: Build shell
-        run: nix-build shell.nix

.github/workflows/editorconfig.yml

@@ -24,11 +24,11 @@ jobs:
     - name: print list of changed files
       run: |
         cat "$HOME/changed_files"
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+    - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge
-    - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+    - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
       with:
         # nixpkgs commit is pinned so that it doesn't break
         # editorconfig-checker 2.4.0

.github/workflows/manual-nixos.yml

@@ -14,15 +14,15 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
-      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+      - uses: cachix/cachix-action@18cf96c7c98e048e10a83abd92116114cd8504be # v14
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
           name: nixpkgs-ci

.github/workflows/manual-nixpkgs.yml

@@ -16,15 +16,15 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
-      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+      - uses: cachix/cachix-action@18cf96c7c98e048e10a83abd92116114cd8504be # v14
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
           name: nixpkgs-ci

.github/workflows/nix-parse.yml

@@ -24,12 +24,12 @@ jobs:
         if [[ -s "$HOME/changed_files" ]]; then
           echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"
         fi
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+    - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge
       if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}
-    - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+    - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
       with:
         nix_path: nixpkgs=channel:nixpkgs-unstable
     - name: Parse all changed or added nix files

.github/workflows/periodic-merge-24h.yml

@@ -35,13 +35,13 @@ jobs:
         pairs:
           - from: master
             into: haskell-updates
-          - from: release-24.05
-            into: staging-next-24.05
-          - from: staging-next-24.05
-            into: staging-24.05
+          - from: release-23.11
+            into: staging-next-23.11
+          - from: staging-next-23.11
+            into: staging-23.11
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
         uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0

.github/workflows/periodic-merge-6h.yml

@@ -39,7 +39,7 @@ jobs:
             into: staging
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
         uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0

.github/workflows/update-terraform-providers.yml

@@ -16,8 +16,8 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.ref == 'refs/heads/master' # ensure workflow_dispatch only runs on master
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           nix_path: nixpkgs=channel:nixpkgs-unstable
       - name: setup
@@ -46,7 +46,7 @@ jobs:
         run: |
           git clean -f
       - name: create PR
-        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
+        uses: peter-evans/create-pull-request@9153d834b60caba6d51c9b9510b087acf9f33f83 # v6.0.4
         with:
           body: |
             Automatic update by [update-terraform-providers](https://github.com/NixOS/nixpkgs/blob/master/.github/workflows/update-terraform-providers.yml) action.

.gitignore

@@ -7,7 +7,6 @@
 .idea/
 .nixos-test-history
 .vscode/
-.helix/
 outputs/
 result-*
 result
@@ -20,8 +19,6 @@ tags
 /doc/manual.pdf
 /source/
 .version-suffix
-.direnv
-.envrc
 
 .DS_Store
 .mypy_cache

.mailmap

@@ -10,7 +10,6 @@ Robert Hensing <robert@roberthensing.nl> <roberth@users.noreply.github.com>
 Sandro Jäckel <sandro.jaeckel@gmail.com>
 Sandro Jäckel <sandro.jaeckel@gmail.com> <sandro.jaeckel@sap.com>
 superherointj <5861043+superherointj@users.noreply.github.com>
-Tomodachi94 <tomodachi94@protonmail.com> Tomo <68489118+Tomodachi94@users.noreply.github.com>
 Vladimír Čunát <v@cunat.cz> <vcunat@gmail.com>
 Vladimír Čunát <v@cunat.cz> <vladimir.cunat@nic.cz>
 Yifei Sun <ysun@hey.com> StepBroBD <Hi@StepBroBD.com>

CONTRIBUTING.md

@@ -330,14 +330,7 @@ Container system, boot system and library changes are some examples of the pull
 ## How to merge pull requests
 [pr-merge]: #how-to-merge-pull-requests
 
-To streamline automated updates, leverage the nixpkgs-merge-bot by simply commenting `@NixOS/nixpkgs-merge-bot merge`. The bot will verify if the following conditions are met, refusing to merge otherwise:
-
-- the commenter that issued the command should be among the package maintainers;
-- the package should reside in `pkgs/by-name`.
-
-Further, nixpkgs-merge-bot will ensure all ofBorg checks (except the Darwin-related ones) are successfully completed before merging the pull request. Should the checks still be underway, the bot patiently waits for ofBorg to finish before attempting the merge again.
-
-For other pull requests, the *Nixpkgs committers* are people who have been given
+The *Nixpkgs committers* are people who have been given
 permission to merge.
 
 It is possible for community members that have enough knowledge and experience on a special topic to contribute by merging pull requests.
@@ -366,7 +359,7 @@ See [Nix Channel Status](https://status.nixos.org/) for the current channels and
 Here's a brief overview of the main Git branches and what channels they're used for:
 
 - `master`: The main branch, used for the unstable channels such as `nixpkgs-unstable`, `nixos-unstable` and `nixos-unstable-small`.
-- `release-YY.MM` (e.g. `release-24.05`): The NixOS release branches, used for the stable channels such as `nixos-24.05`, `nixos-24.05-small` and `nixpkgs-24.05-darwin`.
+- `release-YY.MM` (e.g. `release-23.11`): The NixOS release branches, used for the stable channels such as `nixos-23.11`, `nixos-23.11-small` and `nixpkgs-23.11-darwin`.
 
 When a channel is updated, a corresponding Git branch is also updated to point to the corresponding commit.
 So e.g. the [`nixpkgs-unstable` branch](https://github.com/nixos/nixpkgs/tree/nixpkgs-unstable) corresponds to the Git commit from the [`nixpkgs-unstable` channel](https://channels.nixos.org/nixpkgs-unstable).
@@ -379,12 +372,10 @@ See [this section][branch] to know when to use the release branches.
 [staging]: #staging
 
 The staging workflow exists to batch Hydra builds of many packages together.
-It is coordinated in the [Staging room](https://matrix.to/#/#staging:nixos.org) on Matrix.
 
 It works by directing commits that cause [mass rebuilds][mass-rebuild] to a separate `staging` branch that isn't directly built by Hydra.
 Regularly, the `staging` branch is _manually_ merged into a `staging-next` branch to be built by Hydra using the [`nixpkgs:staging-next` jobset](https://hydra.nixos.org/jobset/nixpkgs/staging-next).
-The `staging-next` branch should then only receive changes that fix Hydra builds;
-**for anything else, ask the [Staging room](https://matrix.to/#/#staging:nixos.org) first**.
+The `staging-next` branch should then only receive direct commits in order to fix Hydra builds.
 Once it is verified that there are no major regressions, it is merged into `master` using [a pull request](https://github.com/NixOS/nixpkgs/pulls?q=head%3Astaging-next).
 This is done manually in order to ensure it's a good use of Hydra's computing resources.
 By keeping the `staging-next` branch separate from `staging`, this batching does not block developers from merging changes into `staging`.
@@ -557,11 +548,138 @@ Names of files and directories should be in lowercase, with dashes between words
 
 ### Syntax
 
-- Set up [editorconfig](https://editorconfig.org/) for your editor, such that [the settings](./.editorconfig) are automatically applied.
+- Use 2 spaces of indentation per indentation level in Nix expressions, 4 spaces in shell scripts.
+
+- Do not use tab characters, i.e. configure your editor to use soft tabs. For instance, use `(setq-default indent-tabs-mode nil)` in Emacs. Everybody has different tab settings so it’s asking for trouble.
 
 - Use `lowerCamelCase` for variable names, not `UpperCamelCase`. Note, this rule does not apply to package attribute names, which instead follow the rules in [package naming](./pkgs/README.md#package-naming).
 
-- New files must be formatted by entering the `nix-shell` from the repository root and running `nixfmt`.
+- Function calls with attribute set arguments are written as
+
+  ```nix
+  foo {
+    arg = <...>;
+  }
+  ```
+
+  not
+
+  ```nix
+  foo
+  {
+    arg = <...>;
+  }
+  ```
+
+  Also fine is
+
+  ```nix
+  foo { arg = <...>; }
+  ```
+
+  if it's a short call.
+
+- In attribute sets or lists that span multiple lines, the attribute names or list elements should be aligned:
+
+  ```nix
+  {
+    # A long list.
+    list = [
+      elem1
+      elem2
+      elem3
+    ];
+
+    # A long attribute set.
+    attrs = {
+      attr1 = short_expr;
+      attr2 =
+        if true then big_expr else big_expr;
+    };
+
+    # Combined
+    listOfAttrs = [
+      {
+        attr1 = 3;
+        attr2 = "fff";
+      }
+      {
+        attr1 = 5;
+        attr2 = "ggg";
+      }
+    ];
+  }
+  ```
+
+- Short lists or attribute sets can be written on one line:
+
+  ```nix
+  {
+    # A short list.
+    list = [ elem1 elem2 elem3 ];
+
+    # A short set.
+    attrs = { x = 1280; y = 1024; };
+  }
+  ```
+
+- Breaking in the middle of a function argument can give hard-to-read code, like
+
+  ```nix
+  someFunction { x = 1280;
+    y = 1024; } otherArg
+    yetAnotherArg
+  ```
+
+  (especially if the argument is very large, spanning multiple lines).
+
+  Better:
+
+  ```nix
+  someFunction
+    { x = 1280; y = 1024; }
+    otherArg
+    yetAnotherArg
+  ```
+
+  or
+
+  ```nix
+  let res = { x = 1280; y = 1024; };
+  in someFunction res otherArg yetAnotherArg
+  ```
+
+- The bodies of functions, asserts, and withs are not indented to prevent a lot of superfluous indentation levels, i.e.
+
+  ```nix
+  { arg1, arg2 }:
+  assert system == "i686-linux";
+  stdenv.mkDerivation { /* ... */ }
+  ```
+
+  not
+
+  ```nix
+  { arg1, arg2 }:
+    assert system == "i686-linux";
+      stdenv.mkDerivation { /* ... */ }
+  ```
+
+- Function formal arguments are written as:
+
+  ```nix
+  { arg1, arg2, arg3 }: { /* ... */ }
+  ```
+
+  but if they don't fit on one line they're written as:
+
+  ```nix
+  { arg1, arg2, arg3
+  , arg4
+  # Some comment...
+  ,  argN
+  }: { }
+  ```
 
 - Functions should list their expected arguments as precisely as possible. That is, write
 

ci/README.md

@@ -1,12 +0,0 @@
-# CI support files
-
-This directory contains files to support CI, such as [GitHub Actions](https://github.com/NixOS/nixpkgs/tree/master/.github/workflows) and [Ofborg](https://github.com/nixos/ofborg).
-This is in contrast with [`maintainers/scripts`](`../maintainers/scripts`) which is for human use instead.
-
-## Pinned Nixpkgs
-
-CI may need certain packages from Nixpkgs.
-In order to ensure that the needed packages are generally available without building,
-[`pinned-nixpkgs.json`](./pinned-nixpkgs.json) contains a pinned Nixpkgs version tested by Hydra.
-
-Run [`update-pinned-nixpkgs.sh`](./update-pinned-nixpkgs.sh) to update it.

ci/pinned-nixpkgs.json

@@ -1,4 +0,0 @@
-{
-  "rev": "521d48afa9ae596930a95325529df27fa7135ff5",
-  "sha256": "0a1pa5azw990narsfipdli1wng4nc3vhvrp00hb8v1qfchcq7dc9"
-}

ci/update-pinned-nixpkgs.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p jq
-
-set -euo pipefail
-
-# https://stackoverflow.com/a/246128
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-
-repo=https://github.com/nixos/nixpkgs
-branch=nixpkgs-unstable
-file=$SCRIPT_DIR/pinned-nixpkgs.json
-
-defaultRev=$(git ls-remote "$repo" refs/heads/"$branch" | cut -f1)
-rev=${1:-$defaultRev}
-sha256=$(nix-prefetch-url --unpack "$repo/archive/$rev.tar.gz" --name source)
-
-jq -n --arg rev "$rev" --arg sha256 "$sha256" '$ARGS.named' | tee /dev/stderr > $file

doc/README.md

@@ -293,7 +293,7 @@ Though this is not shown in the rendered documentation on nixos.org.
 
 #### Figures
 
-To define a referenceable figure use the following fencing:
+To define a referencable figure use the following fencing:
 
 ```markdown
 ::: {.figure #nixos-logo}

doc/build-helpers.md

@@ -20,7 +20,6 @@ There is no uniform interface for build helpers.
 build-helpers/fetchers.chapter.md
 build-helpers/trivial-build-helpers.chapter.md
 build-helpers/testers.chapter.md
-build-helpers/dev-shell-tools.chapter.md
 build-helpers/special.md
 build-helpers/images.md
 hooks/index.md

doc/build-helpers/dev-shell-tools.chapter.md

@@ -1,75 +0,0 @@
-# Development Shell helpers {#chap-devShellTools}
-
-The `nix-shell` command has popularized the concept of transient shell environments for development or testing purposes.
-<!--
-  We should try to document the product, not its development process in the Nixpkgs reference manual,
-  but *something* needs to be said to provide context for this library.
-  This is the most future proof sentence I could come up with while Nix itself does yet make use of this.
-  Relevant is the current status of the devShell attribute "project": https://github.com/NixOS/nix/issues/7501
-  -->
-However, `nix-shell` is not the only way to create such environments, and even `nix-shell` itself can indirectly benefit from this library.
-
-This library provides a set of functions that help create such environments.
-
-## `devShellTools.valueToString` {#sec-devShellTools-valueToString}
-
-Converts Nix values to strings in the way the [`derivation` built-in function](https://nix.dev/manual/nix/2.23/language/derivations) does.
-
-:::{.example}
-## `valueToString` usage examples
-
-```nix
-devShellTools.valueToString (builtins.toFile "foo" "bar")
-=> "/nix/store/...-foo"
-```
-
-```nix
-devShellTools.valueToString false
-=> ""
-```
-
-:::
-
-## `devShellTools.unstructuredDerivationInputEnv` {#sec-devShellTools-unstructuredDerivationInputEnv}
-
-Convert a set of derivation attributes (as would be passed to [`derivation`]) to a set of environment variables that can be used in a shell script.
-This function does not support `__structuredAttrs`, but does support `passAsFile`.
-
-:::{.example}
-## `unstructuredDerivationInputEnv` usage example
-
-```nix
-devShellTools.unstructuredDerivationInputEnv {
-  drvAttrs = {
-    name = "foo";
-    buildInputs = [ hello figlet ];
-    builder = bash;
-    args = [ "-c" "${./builder.sh}" ];
-  };
-}
-=> {
-  name = "foo";
-  buildInputs = "/nix/store/...-hello /nix/store/...-figlet";
-  builder = "/nix/store/...-bash";
-}
-```
-
-Note that `args` is not included, because Nix does not added it to the builder process environment.
-
-:::
-
-## `devShellTools.derivationOutputEnv` {#sec-devShellTools-derivationOutputEnv}
-
-Takes the relevant parts of a derivation and returns a set of environment variables, that would be present in the derivation.
-
-:::{.example}
-## `derivationOutputEnv` usage example
-
-```nix
-let
-  pkg = hello;
-in
-devShellTools.derivationOutputEnv { outputList = pkg.outputs; outputMap = pkg; }
-```
-
-:::

doc/build-helpers/fetchers.chapter.md

@@ -365,8 +365,8 @@ If `pname` and `version` are specified, `fetchurl` will use those values and wil
   _Default value:_ `{}`.
 
 `passthru` (Attribute Set; _optional_)
-: Specifies any extra [`passthru`](#chap-passthru) attributes for the derivation returned by `fetchurl`.
-  Note that `fetchurl` defines [`passthru` attributes of its own](#ssec-pkgs-fetchers-fetchurl-passthru-outputs).
+: Specifies any extra [passthru](#var-stdenv-passthru) attributes for the derivation returned by `fetchurl`.
+  Note that `fetchurl` defines [passthru attributes of its own](#ssec-pkgs-fetchers-fetchurl-passthru-outputs).
   Attributes specified in `passthru` can override the default attributes returned by `fetchurl`.
 
   _Default value:_ `{}`.
@@ -387,7 +387,7 @@ If `pname` and `version` are specified, `fetchurl` will use those values and wil
 
 ### Passthru outputs {#ssec-pkgs-fetchers-fetchurl-passthru-outputs}
 
-`fetchurl` also defines its own [`passthru`](#chap-passthru) attributes:
+`fetchurl` also defines its own [`passthru`](#var-stdenv-passthru) attributes:
 
 `url` (String)
 
@@ -869,7 +869,7 @@ It produces packages that cannot be built automatically.
 fetchtorrent {
   config = { peer-limit-global = 100; };
   url = "magnet:?xt=urn:btih:dd8255ecdc7ca55fb0bbf81323d87062db1f6d1c";
-  hash = "";
+  sha256 = "";
 }
 ```
 

doc/build-helpers/images/dockertools.section.md

@@ -185,26 +185,13 @@ Similarly, if you encounter errors similar to `Error_Protocol ("certificate has
   _Default value:_ `"gz"`.\
   _Possible values:_ `"none"`, `"gz"`, `"zstd"`.
 
-`includeNixDB` (Boolean; _optional_)
-
-: Populate the nix database in the image with the dependencies of `copyToRoot`.
-  The main purpose is to be able to use nix commands in the container.
-
-  :::{.caution}
-  Be careful since this doesn't work well in combination with `fromImage`. In particular, in a multi-layered image, only the Nix paths from the lower image will be in the database.
-
-  This also neglects to register the store paths that are pulled into the image as a dependency of one of the other values, but aren't a dependency of `copyToRoot`.
-  :::
-
-  _Default value:_ `false`.
-
 `contents` **DEPRECATED**
 
 : This attribute is deprecated, and users are encouraged to use `copyToRoot` instead.
 
 ### Passthru outputs {#ssec-pkgs-dockerTools-buildImage-passthru-outputs}
 
-`buildImage` defines a few [`passthru`](#chap-passthru) attributes:
+`buildImage` defines a few [`passthru`](#var-stdenv-passthru) attributes:
 
 `buildArgs` (Attribute Set)
 
@@ -587,28 +574,15 @@ This allows the function to produce reproducible images.
 
   _Default value:_ `true`
 
-`includeNixDB` (Boolean; _optional_)
-
-: Populate the nix database in the image with the dependencies of `copyToRoot`.
-  The main purpose is to be able to use nix commands in the container.
-
-  :::{.caution}
-  Be careful since this doesn't work well in combination with `fromImage`. In particular, in a multi-layered image, only the Nix paths from the lower image will be in the database.
-
-  This also neglects to register the store paths that are pulled into the image as a dependency of one of the other values, but aren't a dependency of `copyToRoot`.
-  :::
-
-  _Default value:_ `false`.
-
 `passthru` (Attribute Set; _optional_)
 
-: Use this to pass any attributes as [`passthru`](#chap-passthru) for the resulting derivation.
+: Use this to pass any attributes as [passthru](#var-stdenv-passthru) for the resulting derivation.
 
   _Default value:_ `{}`
 
 ### Passthru outputs {#ssec-pkgs-dockerTools-streamLayeredImage-passthru-outputs}
 
-`streamLayeredImage` also defines its own [`passthru`](#chap-passthru) attributes:
+`streamLayeredImage` also defines its own [`passthru`](#var-stdenv-passthru) attributes:
 
 `imageTag` (String)
 

doc/build-helpers/images/makediskimage.section.md

@@ -85,14 +85,14 @@ let
 in
   make-disk-image {
     inherit pkgs lib;
-    inherit (evalConfig {
+    config = evalConfig {
       modules = [
         {
           fileSystems."/" = { device = "/dev/vda"; fsType = "ext4"; autoFormat = true; };
           boot.grub.device = "/dev/vda";
         }
       ];
-    }) config;
+    };
     format = "qcow2";
     onlyNixStore = false;
     partitionTableType = "legacy+gpt";
@@ -104,3 +104,5 @@ in
     memSize = 2048; # Qemu VM memory size in megabytes. Defaults to 1024M.
   }
 ```
+
+

doc/build-helpers/special/makesetuphook.section.md

@@ -9,40 +9,22 @@ pkgs.makeSetupHook {
   name = "something-hook";
   propagatedBuildInputs = [ pkgs.commandsomething ];
   depsTargetTargetPropagated = [ pkgs.libsomething ];
-} ./script.sh;
+} ./script.sh
 ```
 
 ### setup hook that depends on the hello package and runs hello and @shell@ is substituted with path to bash {#sec-pkgs.makeSetupHook-usage-example}
 
 ```nix
-pkgs.makeSetupHook
-  {
+pkgs.makeSetupHook {
     name = "run-hello-hook";
-    # Put dependencies here if they have hooks or necessary dependencies propagated
-    # otherwise prefer direct paths to executables.
-    propagatedBuildInputs = [
-      pkgs.hello
-      pkgs.cowsay
-    ];
-    substitutions = {
-      shell = "${pkgs.bash}/bin/bash";
-      cowsay = "${pkgs.cowsay}/bin/cowsay";
-    };
-  }
-  (
-    writeScript "run-hello-hook.sh" ''
-      #!@shell@
-      # the direct path to the executable has to be here because
-      # this will be run when the file is sourced
-      # at which point '$PATH' has not yet been populated with inputs
-      @cowsay@ cow
-
-      _printHelloHook() {
-        hello
-      }
-      preConfigureHooks+=(_printHelloHook)
-    ''
-  );
+    propagatedBuildInputs = [ pkgs.hello ];
+    substitutions = { shell = "${pkgs.bash}/bin/bash"; };
+    passthru.tests.greeting = callPackage ./test { };
+    meta.platforms = lib.platforms.linux;
+} (writeScript "run-hello-hook.sh" ''
+    #!@shell@
+    hello
+'')
 ```
 
 ## Attributes {#sec-pkgs.makeSetupHook-attributes}

doc/build-helpers/testers.chapter.md

@@ -116,63 +116,13 @@ It has two modes:
 
 : The `lychee` package to use.
 
-## `shellcheck` {#tester-shellcheck}
-
-Runs files through `shellcheck`, a static analysis tool for shell scripts.
-
-:::{.example #ex-shellcheck}
-# Run `testers.shellcheck`
-
-A single script
-
-```nix
-testers.shellcheck {
-  name = "shellcheck";
-  src = ./script.sh;
-}
-```
-
-Multiple files
-
-```nix
-let
-  inherit (lib) fileset;
-in
-testers.shellcheck {
-  name = "shellcheck";
-  src = fileset.toSource {
-    root = ./.;
-    fileset = fileset.unions [
-      ./lib.sh
-      ./nixbsd-activate
-    ];
-  };
-}
-```
-
-:::
-
-### Inputs {#tester-shellcheck-inputs}
-
-[`src` (path or string)]{#tester-shellcheck-param-src}
-
-: The path to the shell script(s) to check.
-  This can be a single file or a directory containing shell files.
-  All files in `src` will be checked, so you may want to provide `fileset`-based source instead of a whole directory.
-
-### Return value {#tester-shellcheck-return}
-
-A derivation that runs `shellcheck` on the given script(s).
-The build will fail if `shellcheck` finds any issues.
-
 ## `testVersion` {#tester-testVersion}
 
 Checks that the output from running a command contains the specified version string in it as a whole word.
 
-NOTE: In most cases, [`versionCheckHook`](#versioncheckhook) should be preferred, but this function is provided and documented here anyway. The motivation for adding either tests would be:
-
-- Catch dynamic linking errors and such and missing environment variables that should be added by wrapping.
-- Probable protection against accidentally building the wrong version, for example when using an "old" hash in a fixed-output derivation.
+Although simplistic, this test assures that the main program can run.
+While there's no substitute for a real test case, it does catch dynamic linking errors and such.
+It also provides some protection against accidentally building the wrong version, for example when using an "old" hash in a fixed-output derivation.
 
 By default, the command to be run will be inferred from the given `package` attribute:
 it will check `meta.mainProgram` first, and fall back to `pname` or `name`.

doc/build-helpers/trivial-build-helpers.chapter.md

@@ -241,7 +241,7 @@ Write a text file to the Nix store.
 `allowSubstitutes` (Bool, _optional_)
 
 : Whether to allow substituting from a binary cache.
-  Passed through to [`allowSubstitutes`](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-allowSubstitutes) of the underlying call to `builtins.derivation`.
+  Passed through to [`allowSubsitutes`](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-allowSubstitutes) of the underlying call to `builtins.derivation`.
 
   It defaults to `false`, as running the derivation's simple `builder` executable locally is assumed to be faster than network operations.
   Set it to true if the `checkPhase` step is expensive.
@@ -453,7 +453,7 @@ writeTextFile {
 
 ### `writeScriptBin` {#trivial-builder-writeScriptBin}
 
-Write a script within a `bin` subdirectory of a directory in the Nix store.
+Write a script within a `bin` subirectory of a directory in the Nix store.
 This is for consistency with the convention of software packages placing executables under `bin`.
 
 `writeScriptBin` takes the following arguments:
@@ -468,7 +468,7 @@ This is for consistency with the convention of software packages placing executa
 
 The created file is marked as executable.
 The file's contents will be put into `/nix/store/<store path>/bin/<name>`.
-The store path will include the name, and it will be a directory.
+The store path will include the the name, and it will be a directory.
 
 ::: {.example #ex-writeScriptBin}
 # Usage of `writeScriptBin`

doc/common.nix

@@ -0,0 +1,4 @@
+{
+  outputPath = "share/doc/nixpkgs";
+  indexPath = "manual.html";
+}

doc/default.nix

@@ -1,6 +1,176 @@
-{
-  pkgs ? (import ./.. { }),
-  nixpkgs ? { },
-}:
+{ pkgs ? (import ./.. { }), nixpkgs ? { }}:
+let
+  inherit (pkgs) lib;
+  inherit (lib) hasPrefix removePrefix;
 
-pkgs.nixpkgs-manual.override { inherit nixpkgs; }
+  common = import ./common.nix;
+
+  lib-docs = import ./doc-support/lib-function-docs.nix {
+    inherit pkgs nixpkgs;
+    libsets = [
+      { name = "asserts"; description = "assertion functions"; }
+      { name = "attrsets"; description = "attribute set functions"; }
+      { name = "strings"; description = "string manipulation functions"; }
+      { name = "versions"; description = "version string functions"; }
+      { name = "trivial"; description = "miscellaneous functions"; }
+      { name = "fixedPoints"; baseName = "fixed-points"; description = "explicit recursion functions"; }
+      { name = "lists"; description = "list manipulation functions"; }
+      { name = "debug"; description = "debugging functions"; }
+      { name = "options"; description = "NixOS / nixpkgs option handling"; }
+      { name = "path"; description = "path functions"; }
+      { name = "filesystem"; description = "filesystem functions"; }
+      { name = "fileset"; description = "file set functions"; }
+      { name = "sources"; description = "source filtering functions"; }
+      { name = "cli"; description = "command-line serialization functions"; }
+      { name = "gvariant"; description = "GVariant formatted string serialization functions"; }
+      { name = "customisation"; description = "Functions to customise (derivation-related) functions, derivatons, or attribute sets"; }
+      { name = "meta"; description = "functions for derivation metadata"; }
+      { name = "derivations"; description = "miscellaneous derivation-specific functions"; }
+    ];
+  };
+
+  epub = pkgs.runCommand "manual.epub" {
+    nativeBuildInputs = with pkgs; [ libxslt zip ];
+
+    epub = ''
+      <book xmlns="http://docbook.org/ns/docbook"
+            xmlns:xlink="http://www.w3.org/1999/xlink"
+            version="5.0"
+            xml:id="nixpkgs-manual">
+        <info>
+          <title>Nixpkgs Manual</title>
+          <subtitle>Version ${pkgs.lib.version}</subtitle>
+        </info>
+        <chapter>
+          <title>Temporarily unavailable</title>
+          <para>
+            The Nixpkgs manual is currently not available in EPUB format,
+            please use the <link xlink:href="https://nixos.org/nixpkgs/manual">HTML manual</link>
+            instead.
+          </para>
+          <para>
+            If you've used the EPUB manual in the past and it has been useful to you, please
+            <link xlink:href="https://github.com/NixOS/nixpkgs/issues/237234">let us know</link>.
+          </para>
+        </chapter>
+      </book>
+    '';
+
+    passAsFile = [ "epub" ];
+  } ''
+    mkdir scratch
+    xsltproc \
+      --param chapter.autolabel 0 \
+      --nonet \
+      --output scratch/ \
+      ${pkgs.docbook_xsl_ns}/xml/xsl/docbook/epub/docbook.xsl \
+      $epubPath
+
+    echo "application/epub+zip" > mimetype
+    zip -0Xq "$out" mimetype
+    cd scratch && zip -Xr9D "$out" *
+  '';
+
+  # NB: This file describes the Nixpkgs manual, which happens to use module
+  #     docs infra originally developed for NixOS.
+  optionsDoc = pkgs.nixosOptionsDoc {
+    inherit (pkgs.lib.evalModules {
+      modules = [ ../pkgs/top-level/config.nix ];
+      class = "nixpkgsConfig";
+    }) options;
+    documentType = "none";
+    transformOptions = opt:
+      opt // {
+        declarations =
+          map
+            (decl:
+              if hasPrefix (toString ../..) (toString decl)
+              then
+                let subpath = removePrefix "/" (removePrefix (toString ../.) (toString decl));
+                in { url = "https://github.com/NixOS/nixpkgs/blob/master/${subpath}"; name = subpath; }
+              else decl)
+            opt.declarations;
+        };
+  };
+in pkgs.stdenv.mkDerivation {
+  name = "nixpkgs-manual";
+
+  nativeBuildInputs = with pkgs; [
+    nixos-render-docs
+  ];
+
+  src = ./.;
+
+  postPatch = ''
+    ln -s ${optionsDoc.optionsJSON}/share/doc/nixos/options.json ./config-options.json
+  '';
+
+  buildPhase = ''
+    cat \
+      ./functions/library.md.in \
+      ${lib-docs}/index.md \
+      > ./functions/library.md
+    substitute ./manual.md.in ./manual.md \
+      --replace-fail '@MANUAL_VERSION@' '${pkgs.lib.version}'
+
+    mkdir -p out/media
+
+    mkdir -p out/highlightjs
+    cp -t out/highlightjs \
+      ${pkgs.documentation-highlighter}/highlight.pack.js \
+      ${pkgs.documentation-highlighter}/LICENSE \
+      ${pkgs.documentation-highlighter}/mono-blue.css \
+      ${pkgs.documentation-highlighter}/loader.js
+
+    cp -t out ./style.css ./anchor.min.js ./anchor-use.js
+
+    nixos-render-docs manual html \
+      --manpage-urls ./manpage-urls.json \
+      --revision ${pkgs.lib.trivial.revisionWithDefault (pkgs.rev or "master")} \
+      --stylesheet style.css \
+      --stylesheet highlightjs/mono-blue.css \
+      --script ./highlightjs/highlight.pack.js \
+      --script ./highlightjs/loader.js \
+      --script ./anchor.min.js \
+      --script ./anchor-use.js \
+      --toc-depth 1 \
+      --section-toc-depth 1 \
+      manual.md \
+      out/index.html
+  '';
+
+  installPhase = ''
+    dest="$out/${common.outputPath}"
+    mkdir -p "$(dirname "$dest")"
+    mv out "$dest"
+    mv "$dest/index.html" "$dest/${common.indexPath}"
+
+    cp ${epub} "$dest/nixpkgs-manual.epub"
+
+    mkdir -p $out/nix-support/
+    echo "doc manual $dest ${common.indexPath}" >> $out/nix-support/hydra-build-products
+    echo "doc manual $dest nixpkgs-manual.epub" >> $out/nix-support/hydra-build-products
+  '';
+
+  passthru.tests.manpage-urls = with pkgs; testers.invalidateFetcherByDrvHash
+    ({ name ? "manual_check-manpage-urls"
+     , script
+     , urlsFile
+     }: runCommand name {
+      nativeBuildInputs = [
+        cacert
+        (python3.withPackages (p: with p; [
+          aiohttp
+          rich
+          structlog
+        ]))
+      ];
+      outputHash = "sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=";  # Empty output
+    } ''
+      python3 ${script} ${urlsFile}
+      touch $out
+    '') {
+      script = ./tests/manpage-urls.py;
+      urlsFile = ./manpage-urls.json;
+    };
+}

doc/doc-support/epub.nix

@@ -1,54 +0,0 @@
-# To build this derivation, run `nix-build -A nixpkgs-manual.epub`
-{
-  lib,
-  runCommand,
-  docbook_xsl_ns,
-  libxslt,
-  zip,
-}:
-runCommand "manual.epub"
-  {
-    nativeBuildInputs = [
-      libxslt
-      zip
-    ];
-
-    epub = ''
-      <book xmlns="http://docbook.org/ns/docbook"
-            xmlns:xlink="http://www.w3.org/1999/xlink"
-            version="5.0"
-            xml:id="nixpkgs-manual">
-        <info>
-          <title>Nixpkgs Manual</title>
-          <subtitle>Version ${lib.version}</subtitle>
-        </info>
-        <chapter>
-          <title>Temporarily unavailable</title>
-          <para>
-            The Nixpkgs manual is currently not available in EPUB format,
-            please use the <link xlink:href="https://nixos.org/nixpkgs/manual">HTML manual</link>
-            instead.
-          </para>
-          <para>
-            If you've used the EPUB manual in the past and it has been useful to you, please
-            <link xlink:href="https://github.com/NixOS/nixpkgs/issues/237234">let us know</link>.
-          </para>
-        </chapter>
-      </book>
-    '';
-
-    passAsFile = [ "epub" ];
-  }
-  ''
-    mkdir scratch
-    xsltproc \
-      --param chapter.autolabel 0 \
-      --nonet \
-      --output scratch/ \
-      ${docbook_xsl_ns}/xml/xsl/docbook/epub/docbook.xsl \
-      $epubPath
-
-    echo "application/epub+zip" > mimetype
-    zip -0Xq -b "$TMPDIR" "$out" mimetype
-    cd scratch && zip -Xr9D -b "$TMPDIR" "$out" *
-  ''

doc/doc-support/lib-function-docs.nix

@@ -1,122 +1,27 @@
 # Generates the documentation for library functions via nixdoc.
-# To build this derivation, run `nix-build -A nixpkgs-manual.lib-docs`
-{
-  lib,
-  stdenvNoCC,
-  nixdoc,
-  nix,
-  nixpkgs ? { },
-  libsets ? [
-    {
-      name = "asserts";
-      description = "assertion functions";
-    }
-    {
-      name = "attrsets";
-      description = "attribute set functions";
-    }
-    {
-      name = "strings";
-      description = "string manipulation functions";
-    }
-    {
-      name = "versions";
-      description = "version string functions";
-    }
-    {
-      name = "trivial";
-      description = "miscellaneous functions";
-    }
-    {
-      name = "fixedPoints";
-      baseName = "fixed-points";
-      description = "explicit recursion functions";
-    }
-    {
-      name = "lists";
-      description = "list manipulation functions";
-    }
-    {
-      name = "debug";
-      description = "debugging functions";
-    }
-    {
-      name = "options";
-      description = "NixOS / nixpkgs option handling";
-    }
-    {
-      name = "path";
-      description = "path functions";
-    }
-    {
-      name = "filesystem";
-      description = "filesystem functions";
-    }
-    {
-      name = "fileset";
-      description = "file set functions";
-    }
-    {
-      name = "sources";
-      description = "source filtering functions";
-    }
-    {
-      name = "cli";
-      description = "command-line serialization functions";
-    }
-    {
-      name = "generators";
-      description = "functions that create file formats from nix data structures";
-    }
-    {
-      name = "gvariant";
-      description = "GVariant formatted string serialization functions";
-    }
-    {
-      name = "customisation";
-      description = "Functions to customise (derivation-related) functions, derivatons, or attribute sets";
-    }
-    {
-      name = "meta";
-      description = "functions for derivation metadata";
-    }
-    {
-      name = "derivations";
-      description = "miscellaneous derivation-specific functions";
-    }
-  ],
-}:
 
-stdenvNoCC.mkDerivation {
+{ pkgs, nixpkgs, libsets }:
+
+with pkgs;
+
+let
+  locationsJSON = import ./lib-function-locations.nix { inherit pkgs nixpkgs libsets; };
+in
+stdenv.mkDerivation {
   name = "nixpkgs-lib-docs";
+  src = ../../lib;
 
-  src = lib.fileset.toSource {
-    root = ../..;
-    fileset = ../../lib;
-  };
-
-  buildInputs = [
-    nixdoc
-    nix
-  ];
-
+  buildInputs = [ nixdoc ];
   installPhase = ''
-    export NIX_STATE_DIR=$(mktemp -d)
-    nix-instantiate --eval --strict --json ${./lib-function-locations.nix} \
-      --arg nixpkgsPath "./." \
-      --argstr revision ${nixpkgs.rev or "master"} \
-      --argstr libsetsJSON ${lib.escapeShellArg (builtins.toJSON libsets)} \
-      > locations.json
-
     function docgen {
       name=$1
       baseName=$2
       description=$3
       # TODO: wrap lib.$name in <literal>, make nixdoc not escape it
-      if [[ -e "lib/$baseName.nix" ]]; then
-        nixdoc -c "$name" -d "lib.$name: $description" -l locations.json -f "lib/$baseName.nix" > "$out/$name.md"
+      if [[ -e "../lib/$baseName.nix" ]]; then
+        nixdoc -c "$name" -d "lib.$name: $description" -l ${locationsJSON} -f "$baseName.nix" > "$out/$name.md"
       else
-        nixdoc -c "$name" -d "lib.$name: $description" -l locations.json -f "lib/$baseName/default.nix" > "$out/$name.md"
+        nixdoc -c "$name" -d "lib.$name: $description" -l ${locationsJSON} -f "$baseName/default.nix" > "$out/$name.md"
       fi
       echo "$out/$name.md" >> "$out/index.md"
     }
@@ -127,16 +32,9 @@ stdenvNoCC.mkDerivation {
     ```{=include=} sections auto-id-prefix=auto-generated
     EOF
 
-    ${lib.concatMapStrings (
-      {
-        name,
-        baseName ? name,
-        description,
-      }:
-      ''
-        docgen ${name} ${baseName} ${lib.escapeShellArg description}
-      ''
-    ) libsets}
+    ${lib.concatMapStrings ({ name, baseName ? name, description }: ''
+      docgen ${name} ${baseName} ${lib.escapeShellArg description}
+    '') libsets}
 
     echo '```' >> "$out/index.md"
   '';

doc/doc-support/lib-function-locations.nix

@@ -1,14 +1,13 @@
-{ nixpkgsPath, revision, libsetsJSON }:
+{ pkgs, nixpkgs ? { }, libsets }:
 let
-  lib = import (nixpkgsPath + "/lib");
-  libsets = builtins.fromJSON libsetsJSON;
+  revision = pkgs.lib.trivial.revisionWithDefault (nixpkgs.rev or "master");
 
   libDefPos = prefix: set:
     builtins.concatMap
       (name: [{
         name = builtins.concatStringsSep "." (prefix ++ [name]);
         location = builtins.unsafeGetAttrPos name set;
-      }] ++ lib.optionals
+      }] ++ nixpkgsLib.optionals
         (builtins.length prefix == 0 && builtins.isAttrs set.${name})
         (libDefPos (prefix ++ [name]) set.${name})
       ) (builtins.attrNames set);
@@ -21,6 +20,8 @@ let
       })
       (builtins.map (x: x.name) libsets);
 
+  nixpkgsLib = pkgs.lib;
+
   flattenedLibSubset = { subsetname, functions }:
   builtins.map
     (fn: {
@@ -37,13 +38,13 @@ let
       substr = builtins.substring prefixLen filenameLen filename;
       in substr;
 
-  removeNixpkgs = removeFilenamePrefix (builtins.toString nixpkgsPath);
+  removeNixpkgs = removeFilenamePrefix (builtins.toString pkgs.path);
 
   liblocations =
     builtins.filter
       (elem: elem.value != null)
-      (lib.lists.flatten
-        (locatedlibsets lib));
+      (nixpkgsLib.lists.flatten
+        (locatedlibsets nixpkgsLib));
 
   fnLocationRelative = { name, value }:
     {
@@ -71,4 +72,4 @@ let
     relativeLocs);
 
 in
-jsonLocs
+pkgs.writeText "locations.json" (builtins.toJSON jsonLocs)

doc/doc-support/options-doc.nix

@@ -1,28 +0,0 @@
-# To build this derivation, run `nix-build -A nixpkgs-manual.optionsDoc`
-{ lib, nixosOptionsDoc }:
-
-let
-  modules = lib.evalModules {
-    modules = [ ../../pkgs/top-level/config.nix ];
-    class = "nixpkgsConfig";
-  };
-
-  root = toString ../..;
-
-  transformDeclaration =
-    decl:
-    let
-      declStr = toString decl;
-      subpath = lib.removePrefix "/" (lib.removePrefix root declStr);
-    in
-    assert lib.hasPrefix root declStr;
-    {
-      url = "https://github.com/NixOS/nixpkgs/blob/master/${subpath}";
-      name = subpath;
-    };
-in
-nixosOptionsDoc {
-  inherit (modules) options;
-  documentType = "none";
-  transformOptions = opt: opt // { declarations = map transformDeclaration opt.declarations; };
-}

doc/doc-support/package.nix

@@ -1,106 +0,0 @@
-# This file describes the Nixpkgs manual, which happens to use module docs infra originally
-# developed for NixOS. To build this derivation, run `nix-build -A nixpkgs-manual`.
-#
-{
-  lib,
-  stdenvNoCC,
-  callPackage,
-  documentation-highlighter,
-  nixos-render-docs,
-  nixpkgs ? { },
-}:
-
-stdenvNoCC.mkDerivation (
-  finalAttrs:
-  let
-    inherit (finalAttrs.finalPackage.optionsDoc) optionsJSON;
-    inherit (finalAttrs.finalPackage) epub lib-docs pythonInterpreterTable;
-  in
-  {
-    name = "nixpkgs-manual";
-
-    nativeBuildInputs = [ nixos-render-docs ];
-
-    src = lib.fileset.toSource {
-      root = ../.;
-      fileset = lib.fileset.unions [
-        (lib.fileset.fileFilter (file: file.hasExt "md" || file.hasExt "md.in") ../.)
-        ../style.css
-        ../anchor-use.js
-        ../anchor.min.js
-        ../manpage-urls.json
-      ];
-    };
-
-    postPatch = ''
-      ln -s ${optionsJSON}/share/doc/nixos/options.json ./config-options.json
-    '';
-
-    buildPhase = ''
-      substituteInPlace ./languages-frameworks/python.section.md \
-        --subst-var-by python-interpreter-table "$(<"${pythonInterpreterTable}")"
-
-      cat \
-        ./functions/library.md.in \
-        ${lib-docs}/index.md \
-        > ./functions/library.md
-      substitute ./manual.md.in ./manual.md \
-        --replace-fail '@MANUAL_VERSION@' '${lib.version}'
-
-      mkdir -p out/media
-
-      mkdir -p out/highlightjs
-      cp -t out/highlightjs \
-        ${documentation-highlighter}/highlight.pack.js \
-        ${documentation-highlighter}/LICENSE \
-        ${documentation-highlighter}/mono-blue.css \
-        ${documentation-highlighter}/loader.js
-
-      cp -t out ./style.css ./anchor.min.js ./anchor-use.js
-
-      nixos-render-docs manual html \
-        --manpage-urls ./manpage-urls.json \
-        --revision ${lib.trivial.revisionWithDefault (nixpkgs.rev or "master")} \
-        --stylesheet style.css \
-        --stylesheet highlightjs/mono-blue.css \
-        --script ./highlightjs/highlight.pack.js \
-        --script ./highlightjs/loader.js \
-        --script ./anchor.min.js \
-        --script ./anchor-use.js \
-        --toc-depth 1 \
-        --section-toc-depth 1 \
-        manual.md \
-        out/index.html
-    '';
-
-    installPhase = ''
-      dest="$out/share/doc/nixpkgs"
-      mkdir -p "$(dirname "$dest")"
-      mv out "$dest"
-      mv "$dest/index.html" "$dest/manual.html"
-
-      cp ${epub} "$dest/nixpkgs-manual.epub"
-
-      mkdir -p $out/nix-support/
-      echo "doc manual $dest manual.html" >> $out/nix-support/hydra-build-products
-      echo "doc manual $dest nixpkgs-manual.epub" >> $out/nix-support/hydra-build-products
-    '';
-
-    passthru = {
-      lib-docs = callPackage ./lib-function-docs.nix { inherit nixpkgs; };
-
-      epub = callPackage ./epub.nix { };
-
-      optionsDoc = callPackage ./options-doc.nix { };
-
-      pythonInterpreterTable = callPackage ./python-interpreter-table.nix { };
-
-      shell = callPackage ../../pkgs/tools/nix/web-devmode.nix {
-        buildArgs = "./.";
-        open = "/share/doc/nixpkgs/manual.html";
-      };
-
-      tests.manpage-urls = callPackage ../tests/manpage-urls.nix { };
-    };
-  }
-)

doc/doc-support/python-interpreter-table.nix

@@ -1,64 +0,0 @@
-# To build this derivation, run `nix-build -A nixpkgs-manual.pythonInterpreterTable`
-{
-  lib,
-  writeText,
-  pkgs,
-  pythonInterpreters,
-}:
-let
-  isPythonInterpreter =
-    name:
-    /*
-      NB: Package names that don't follow the regular expression:
-      - `python-cosmopolitan` is not part of `pkgs.pythonInterpreters`.
-      - `_prebuilt` interpreters are used for bootstrapping internally.
-      - `python3Minimal` contains python packages, left behind conservatively.
-      - `rustpython` lacks `pythonVersion` and `implementation`.
-    */
-    (lib.strings.match "(pypy|python)([[:digit:]]*)" name) != null;
-
-  interpreterName =
-    pname:
-    let
-      cuteName = {
-        cpython = "CPython";
-        pypy = "PyPy";
-      };
-      interpreter = pkgs.${pname};
-    in
-    "${cuteName.${interpreter.implementation}} ${interpreter.pythonVersion}";
-
-  interpreters = lib.reverseList (
-    lib.naturalSort (lib.filter isPythonInterpreter (lib.attrNames pythonInterpreters))
-  );
-
-  aliases =
-    pname:
-    lib.attrNames (
-      lib.filterAttrs (
-        name: value:
-        isPythonInterpreter name && name != pname && interpreterName name == interpreterName pname
-      ) pkgs
-    );
-
-  result = map (pname: {
-    inherit pname;
-    aliases = aliases pname;
-    interpreter = interpreterName pname;
-  }) interpreters;
-
-  toMarkdown =
-    data:
-    let
-      line = package: ''
-        | ${package.pname} | ${lib.concatStringsSep ", " package.aliases or [ ]} | ${package.interpreter} |
-      '';
-    in
-    lib.concatStringsSep "" (map line data);
-
-in
-writeText "python-interpreter-table.md" ''
-  | Package | Aliases | Interpeter |
-  |---------|---------|------------|
-  ${toMarkdown result}
-''

doc/functions/generators.section.md

@@ -54,4 +54,4 @@ merge:"diff3"
 Nix store paths can be converted to strings by enclosing a derivation attribute like so: `"${drv}"`.
 :::
 
-Detailed documentation for each generator can be found [here](#sec-functions-library-generators)
+Detailed documentation for each generator can be found in `lib/generators.nix`.

doc/hooks/index.md

@@ -29,7 +29,6 @@ scons.section.md
 tetex-tex-live.section.md
 unzip.section.md
 validatePkgConfig.section.md
-versionCheckHook.section.md
 waf.section.md
 zig.section.md
 xcbuild.section.md

doc/hooks/installShellFiles.section.md

@@ -4,7 +4,7 @@ This hook helps with installing manpages and shell completion files. It exposes
 
 The `installManPage` function takes one or more paths to manpages to install. The manpages must have a section suffix, and may optionally be compressed (with `.gz` suffix). This function will place them into the correct `share/man/man<section>/` directory, in [`outputMan`](#outputman).
 
-The `installShellCompletion` function takes one or more paths to shell completion files. By default it will autodetect the shell type from the completion file extension, but you may also specify it by passing one of `--bash`, `--fish`, or `--zsh`. These flags apply to all paths listed after them (up until another shell flag is given). Each path may also have a custom installation name provided by providing a flag `--name NAME` before the path. If this flag is not provided, zsh completions will be renamed automatically such that `foobar.zsh` becomes `_foobar`. A root name may be provided for all paths using the flag `--cmd NAME`; this synthesizes the appropriate name depending on the shell (e.g. `--cmd foo` will synthesize the name `foo.bash` for bash and `_foo` for zsh).
+The `installShellCompletion` function takes one or more paths to shell completion files. By default it will autodetect the shell type from the completion file extension, but you may also specify it by passing one of `--bash`, `--fish`, or `--zsh`. These flags apply to all paths listed after them (up until another shell flag is given). Each path may also have a custom installation name provided by providing a flag `--name NAME` before the path. If this flag is not provided, zsh completions will be renamed automatically such that `foobar.zsh` becomes `_foobar`. A root name may be provided for all paths using the flag `--cmd NAME`; this synthesizes the appropriate name depending on the shell (e.g. `--cmd foo` will synthesize the name `foo.bash` for bash and `_foo` for zsh). The path may also be a fifo or named fd (such as produced by `<(cmd)`), in which case the shell and name must be provided.
 
 ```nix
 {
@@ -17,18 +17,6 @@ The `installShellCompletion` function takes one or more paths to shell completio
     installShellCompletion --zsh --name _foobar share/completions.zsh
     # implicit behavior
     installShellCompletion share/completions/foobar.{bash,fish,zsh}
-  '';
-}
-```
-
-The path may also be a fifo or named fd (such as produced by `<(cmd)`), in which case the shell and name must be provided (see below).
-
-If the destination shell completion file is not actually present or consists of zero bytes after calling `installShellCompletion` this is treated as a build failure. In particular, if completion files are not vendored but are generated by running an executable, this is likely to fail in cross compilation scenarios. The result will be a zero byte completion file and hence a build failure. To prevent this, guard the completion commands against this, e.g.
-
-```nix
-{
-  nativeBuildInputs = [ installShellFiles ];
-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     # using named fd
     installShellCompletion --cmd foobar \
       --bash <($out/bin/foobar --bash-completion) \

doc/hooks/versionCheckHook.section.md

@@ -1,35 +0,0 @@
-# versionCheckHook {#versioncheckhook}
-
-This hook adds a `versionCheckPhase` to the [`preInstallCheckHooks`](#ssec-installCheck-phase) that runs the main program of the derivation with a `--help` or `--version` argument, and checks that the `${version}` string is found in that output. You use it like this:
-
-```nix
-{
-  lib,
-  stdenv,
-  versionCheckHook,
-  # ...
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  # ...
-
-  nativeInstallCheckInputs = [
-    versionCheckHook
-  ];
-  doInstallCheck = true;
-
-  # ...
-})
-```
-
-Note that for [`buildPythonPackage`](#buildpythonpackage-function) and [`buildPythonApplication`](#buildpythonapplication-function), `doInstallCheck` is enabled by default.
-
-It does so in a clean environment (using `env --ignore-environment`), and it checks for the `${version}` string in both the `stdout` and the `stderr` of the command. It will report to you in the build log the output it received and it will fail the build if it failed to find `${version}`.
-
-The variables that this phase control are:
-
-- `dontVersionCheck`: Disable adding this hook to the [`preDistPhases`](#var-stdenv-preDist). Useful if you do want to load the bash functions of the hook, but run them differently.
-- `versionCheckProgram`: The full path to the program that should print the `${version}` string. Defaults roughly to `${placeholder "out"}/bin/${pname}`. Using `$out` in the value of this variable won't work, as environment variables from this variable are not expanded by the hook. Hence using `placeholder` is unavoidable.
-- `versionCheckProgramArg`: The argument that needs to be passed to `versionCheckProgram`. If undefined the hook tries first `--help` and then `--version`. Examples: `version`, `-V`, `-v`.
-- `preVersionCheck`: A hook to run before the check is done.
-- `postVersionCheck`: A hook to run after the check is done.

doc/hooks/waf.section.md

@@ -20,6 +20,10 @@ If `wafPath` doesn't exist, then `wafHook` will copy the `waf` provided from Nix
 
 Controls the flags passed to waf tool during build and install phases. For settings specific to build or install phases, use `wafBuildFlags` or `wafInstallFlags` respectively.
 
+#### `dontAddWafCrossFlags` {#dont-add-waf-cross-flags}
+
+When set to `true`, don't add cross compilation flags during configure phase.
+
 #### `dontUseWafConfigure` {#dont-use-waf-configure}
 
 When set to true, don't use the predefined `wafConfigurePhase`.

doc/interoperability.md

@@ -1,5 +0,0 @@
-# Interoperability Standards {#part-interoperability}
-
-```{=include=} chapters
-interoperability/cyclonedx.md
-```

doc/interoperability/cyclonedx.md

@@ -1,79 +0,0 @@
-# CycloneDX {#chap-interop-cyclonedx}
-
-[OWASP](https://owasp.org/) [CycloneDX](https://cyclonedx.org/) is a Software [Bill of Materials](https://en.wikipedia.org/wiki/Bill_of_materials) (SBOM) standard.
-The standards described here are for including Nix specific information within SBOMs in a way that is interoperable with external SBOM tooling.
-
-## `nix` Namespace Property Taxonomy  {#sec-interop.cylonedx-nix}
-
-The following tables describe namespaces for [properties](https://cyclonedx.org/docs/1.6/json/#components_items_properties) that may be attached to components within SBOMs.
-Component properties are lists of name-value-pairs where values must be strings.
-Properties with the same name may appear more than once.
-Names and values are case-sensitive.
-
-| Property         | Description |
-|------------------|-------------|
-| `nix:store_path` | A Nix store path for the given component. This property should be contextualized by additional properties that describe the production of the store path, such as those from the `nix:narinfo:` and `nix:fod` namespaces. |
-
-
-| Namespace     | Description |
-|---------------|-------------|
-| [`nix:narinfo`](#sec-interop.cylonedx-narinfo) | Namespace for properties that are specific to how a component is stored as a [Nix archive](https://nixos.org/manual/nix/stable/glossary#gloss-nar) (NAR) in a [binary cache](https://nixos.org/manual/nix/stable/glossary#gloss-binary-cache). |
-| [`nix:fod`](#sec-interop.cylonedx-fod) | Namespace for properties that describe a [fixed-output derivation](https://nixos.org/manual/nix/stable/glossary#gloss-fixed-output-derivation). |
-
-
-### `nix:narinfo` {#sec-interop.cylonedx-narinfo}
-
-Narinfo properties describe component archives that may be available from binary caches.
-The `nix:narinfo` properties should be accompanied by a `nix:store_path` property within the same property list.
-
-| Property                  | Description |
-|---------------------------|-------------|
-| `nix:narinfo:store_path`  | Store path for the given store component. |
-| `nix:narinfo:url`         | URL path component. |
-| `nix:narinfo:nar_hash`    | Hash of the file system object part of the component when serialized as a Nix Archive. |
-| `nix:narinfo:nar_size`    | Size of the component when serialized as a Nix Archive. |
-| `nix:narinfo:compression` | The compression format that component archive is in. |
-| `nix:narinfo:file_hash`   | A digest for the compressed component archive itself, as opposed to the data contained within. |
-| `nix:narinfo:file_size`   | The size of the compressed component archive itself. |
-| `nix:narinfo:deriver`     | The path to the derivation from which this component is produced. |
-| `nix:narinfo:system`      | The hardware and software platform on which this component is produced. |
-| `nix:narinfo:sig`         | Signatures claiming that this component is what it claims to be. |
-| `nix:narinfo:ca`          | Content address of this store object's file system object, used to compute its store path. |
-| `nix:narinfo:references`  | A whitespace separated array of store paths that this component references. |
-
-### `nix:fod` {#sec-interop.cylonedx-fod}
-
-FOD properties describe a [fixed-output derivation](https://nixos.org/manual/nix/stable/glossary#gloss-fixed-output-derivation).
-The `nix:fod:method` property is required and must be accompanied by a `nix:store_path` property within the same property list.
-All other properties in this namespace are method-specific.
-To reproduce the build of a component the `nix:fod:method` value is resolved to an [appropriate function](#chap-pkgs-fetchers) within Nixpkgs whose arguments intersect with the given properties.
-When generating `nix:fod` properties the method selected should be a stable function with a minimal number arguments.
-For example, the `fetchFromGitHub` is commonly used within Nixpkgs but should be reduced to a call to the function by which it is implemented, `fetchzip`.
-
-| Property         | Description |
-|------------------|-------------|
-| `nix:fod:method` | Nixpkg function that produces this FOD. Required. Examples: `"fetchzip"`, `"fetchgit"` |
-| `nix:fod:name`   | Derivation name, present when method is `"fetchzip"` |
-| `nix:fod:ref`    | [Git ref](https://git-scm.com/docs/gitglossary#Documentation/gitglossary.txt-aiddefrefaref), present when method is `"fetchgit"` |
-| `nix:fod:rev`    | [Git rev](https://git-scm.com/docs/gitglossary#Documentation/gitglossary.txt-aiddefrevisionarevision), present when method is `"fetchgit"` |
-| `nix:fod:sha256` | FOD hash |
-| `nix:fod:url`    | URL to fetch |
-
-
-`nix:fod` properties may be extracted and evaluated to a derivation using code similar to the following, assuming a fictitious function `filterPropertiesToAttrs`:
-
-```nix
-{ pkgs, filterPropertiesToAttrs, properties }:
-let
-  fodProps = filterPropertiesToAttrs "nix:fod:" properties;
-
-  methods = {
-    fetchzip =
-      { name, url, sha256, ... }:
-      pkgs.fetchzip {
-        inherit name url sha256;
-      };
-  };
-
-in methods.${fodProps.method} fodProps
-```

doc/languages-frameworks/android.section.md

@@ -3,36 +3,10 @@
 The Android build environment provides three major features and a number of
 supporting features.
 
-## Using androidenv with Android Studio {#using-androidenv-with-android-studio}
-
-Use the `android-studio-full` attribute for a very complete Android SDK, including system images:
-
-```nix
-buildInputs = [ android-studio-full ];
-```
-
-This is identical to:
-
-```nix
-buildInputs = [ androidStudioPackages.stable.full ];
-```
-
-Alternatively, you can pass composeAndroidPackages to the `withSdk` passthru:
-
-```nix
-buildInputs = [
-  (android-studio.withSdk (androidenv.composeAndroidPackages {
-    includeNDK = true;
-  }).androidsdk)
-];
-```
-
-These will export ANDROID_SDK_ROOT and ANDROID_NDK_ROOT to the SDK and NDK directories
-in the specified Android build environment.
-
 ## Deploying an Android SDK installation with plugins {#deploying-an-android-sdk-installation-with-plugins}
 
-Alternatively, you can deploy the SDK separately with a desired set of plugins, or subsets of an SDK.
+The first use case is deploying the SDK with a desired set of plugins or subsets
+of an SDK.
 
 ```nix
 with import <nixpkgs> {};
@@ -171,14 +145,16 @@ androidComposition.platform-tools
 ## Using predefined Android package compositions {#using-predefined-android-package-compositions}
 
 In addition to composing an Android package set manually, it is also possible
-to use a predefined composition that contains a fairly complete set of Android packages:
+to use a predefined composition that contains all basic packages for a specific
+Android version, such as version 9.0 (API-level 28).
 
-The following Nix expression can be used to deploy the entire SDK:
+The following Nix expression can be used to deploy the entire SDK with all basic
+plugins:
 
 ```nix
 with import <nixpkgs> {};
 
-androidenv.androidPkgs.androidsdk
+androidenv.androidPkgs_9_0.androidsdk
 ```
 
 It is also possible to use one plugin only:
@@ -186,9 +162,50 @@ It is also possible to use one plugin only:
 ```nix
 with import <nixpkgs> {};
 
-androidenv.androidPkgs.platform-tools
+androidenv.androidPkgs_9_0.platform-tools
 ```
 
+## Building an Android application {#building-an-android-application}
+
+In addition to the SDK, it is also possible to build an Ant-based Android
+project and automatically deploy all the Android plugins that a project
+requires.
+
+
+```nix
+with import <nixpkgs> {};
+
+androidenv.buildApp {
+  name = "MyAndroidApp";
+  src = ./myappsources;
+  release = true;
+
+  # If release is set to true, you need to specify the following parameters
+  keyStore = ./keystore;
+  keyAlias = "myfirstapp";
+  keyStorePassword = "mykeystore";
+  keyAliasPassword = "myfirstapp";
+
+  # Any Android SDK parameters that install all the relevant plugins that a
+  # build requires
+  platformVersions = [ "24" ];
+
+  # When we include the NDK, then ndk-build is invoked before Ant gets invoked
+  includeNDK = true;
+}
+```
+
+Aside from the app-specific build parameters (`name`, `src`, `release` and
+keystore parameters), the `buildApp {}` function supports all the function
+parameters that the SDK composition function (the function shown in the
+previous section) supports.
+
+This build function is particularly useful when it is desired to use
+[Hydra](https://nixos.org/hydra): the Nix-based continuous integration solution
+to build Android apps. An Android APK gets exposed as a build product and can be
+installed on any Android device with a web browser by navigating to the build
+result page.
+
 ## Spawning emulator instances {#spawning-emulator-instances}
 
 For testing purposes, it can also be quite convenient to automatically generate
@@ -232,11 +249,11 @@ In addition to prebuilt APKs, you can also bind the APK parameter to a
 
 ## Notes on environment variables in Android projects {#notes-on-environment-variables-in-android-projects}
 
-* `ANDROID_HOME` should point to the Android SDK. In your Nix expressions, this should be
-  `${androidComposition.androidsdk}/libexec/android-sdk`. Note that `ANDROID_SDK_ROOT` is deprecated,
+* `ANDROID_SDK_ROOT` should point to the Android SDK. In your Nix expressions, this should be
+  `${androidComposition.androidsdk}/libexec/android-sdk`. Note that `ANDROID_HOME` is deprecated,
   but if you rely on tools that need it, you can export it too.
 * `ANDROID_NDK_ROOT` should point to the Android NDK, if you're doing NDK development.
-  In your Nix expressions, this should be `${ANDROID_HOME}/ndk-bundle`.
+  In your Nix expressions, this should be `${ANDROID_SDK_ROOT}/ndk-bundle`.
 
 If you are running the Android Gradle plugin, you need to export GRADLE_OPTS to override aapt2
 to point to the aapt2 binary in the Nix store as well, or use a FHS environment so the packaged
@@ -250,11 +267,11 @@ let
   androidComposition = <...>;
 in
 pkgs.mkShell rec {
-  ANDROID_HOME = "${androidComposition.androidsdk}/libexec/android-sdk";
-  ANDROID_NDK_ROOT = "${ANDROID_HOME}/ndk-bundle";
+  ANDROID_SDK_ROOT = "${androidComposition.androidsdk}/libexec/android-sdk";
+  ANDROID_NDK_ROOT = "${ANDROID_SDK_ROOT}/ndk-bundle";
 
   # Use the same buildToolsVersion here
-  GRADLE_OPTS = "-Dorg.gradle.project.android.aapt2FromMavenOverride=${ANDROID_HOME}/build-tools/${buildToolsVersion}/aapt2";
+  GRADLE_OPTS = "-Dorg.gradle.project.android.aapt2FromMavenOverride=${ANDROID_SDK_ROOT}/build-tools/${buildToolsVersion}/aapt2";
 }
 ```
 
@@ -270,18 +287,18 @@ let
   androidComposition = <...>;
 in
 pkgs.mkShell rec {
-  ANDROID_HOME = "${androidComposition.androidsdk}/libexec/android-sdk";
-  ANDROID_NDK_ROOT = "${ANDROID_HOME}/ndk-bundle";
+  ANDROID_SDK_ROOT = "${androidComposition.androidsdk}/libexec/android-sdk";
+  ANDROID_NDK_ROOT = "${ANDROID_SDK_ROOT}/ndk-bundle";
 
   # Use the same cmakeVersion here
   shellHook = ''
-    export PATH="$(echo "$ANDROID_HOME/cmake/${cmakeVersion}".*/bin):$PATH"
+    export PATH="$(echo "$ANDROID_SDK_ROOT/cmake/${cmakeVersion}".*/bin):$PATH"
   '';
 }
 ```
 
-Note that running Android Studio with ANDROID_HOME set will automatically write a
-`local.properties` file with `sdk.dir` set to $ANDROID_HOME if one does not already
+Note that running Android Studio with ANDROID_SDK_ROOT set will automatically write a
+`local.properties` file with `sdk.dir` set to $ANDROID_SDK_ROOT if one does not already
 exist. If you are using the NDK as well, you may have to add `ndk.dir` to this file.
 
 An example shell.nix that does all this for you is provided in examples/shell.nix.
@@ -332,44 +349,3 @@ To update the expressions run the `generate.sh` script that is stored in the
 ```bash
 ./generate.sh
 ```
-
-## Building an Android application with Ant {#building-an-android-application-with-ant}
-
-In addition to the SDK, it is also possible to build an Ant-based Android
-project and automatically deploy all the Android plugins that a project
-requires. Most newer Android projects use Gradle, and this is included for historical
-purposes.
-
-```nix
-with import <nixpkgs> {};
-
-androidenv.buildApp {
-  name = "MyAndroidApp";
-  src = ./myappsources;
-  release = true;
-
-  # If release is set to true, you need to specify the following parameters
-  keyStore = ./keystore;
-  keyAlias = "myfirstapp";
-  keyStorePassword = "mykeystore";
-  keyAliasPassword = "myfirstapp";
-
-  # Any Android SDK parameters that install all the relevant plugins that a
-  # build requires
-  platformVersions = [ "24" ];
-
-  # When we include the NDK, then ndk-build is invoked before Ant gets invoked
-  includeNDK = true;
-}
-```
-
-Aside from the app-specific build parameters (`name`, `src`, `release` and
-keystore parameters), the `buildApp {}` function supports all the function
-parameters that the SDK composition function (the function shown in the
-previous section) supports.
-
-This build function is particularly useful when it is desired to use
-[Hydra](https://nixos.org/hydra): the Nix-based continuous integration solution
-to build Android apps. An Android APK gets exposed as a build product and can be
-installed on any Android device with a web browser by navigating to the build
-result page.

doc/languages-frameworks/coq.section.md

@@ -84,7 +84,7 @@ mkCoqDerivation {
     [ mathcomp.ssreflect mathcomp.algebra mathcomp-finmap mathcomp-bigenough ];
 
   meta = {
-    description = "Coq/SSReflect Library for Monoidal Rings and Multinomials";
+    description = "A Coq/SSReflect Library for Monoidal Rings and Multinomials";
     license = lib.licenses.cecill-c;
   };
 }

doc/languages-frameworks/dart.section.md

@@ -98,12 +98,10 @@ The function `buildFlutterApplication` builds Flutter applications.
 
 See the [Dart documentation](#ssec-dart-applications) for more details on required files and arguments.
 
-`flutter` in Nixpkgs always points to `flutterPackages.stable`, which is the latest packaged version. To avoid unforeseen breakage during upgrade, packages in Nixpkgs should use a specific flutter version, such as `flutter319` and `flutter322`, instead of using `flutter` directly.
-
 ```nix
-{  flutter322, fetchFromGitHub }:
+{  flutter, fetchFromGitHub }:
 
-flutter322.buildFlutterApplication {
+flutter.buildFlutterApplication {
   pname = "firmware-updater";
   version = "0-unstable-2023-04-30";
 
@@ -114,7 +112,7 @@ flutter322.buildFlutterApplication {
     owner = "canonical";
     repo = "firmware-updater";
     rev = "6e7dbdb64e344633ea62874b54ff3990bd3b8440";
-    hash = "sha256-s5mwtr5MSPqLMN+k851+pFIFFPa0N1hqz97ys050tFA=";
+    sha256 = "sha256-s5mwtr5MSPqLMN+k851+pFIFFPa0N1hqz97ys050tFA=";
     fetchSubmodules = true;
   };
 

doc/languages-frameworks/dotnet.section.md

@@ -117,6 +117,7 @@ For more detail about managing the `deps.nix` file, see [Generating and updating
 * `useDotnetFromEnv` will change the binary wrapper so that it uses the .NET from the environment. The runtime specified by `dotnet-runtime` is given as a fallback in case no .NET is installed in the user's environment. This is most useful for .NET global tools and LSP servers, which often extend the .NET CLI and their runtime should match the users' .NET runtime.
 * `dotnet-sdk` is useful in cases where you need to change what dotnet SDK is being used. You can also set this to the result of `dotnetSdkPackages.combinePackages`, if the project uses multiple SDKs to build.
 * `dotnet-runtime` is useful in cases where you need to change what dotnet runtime is being used. This can be either a regular dotnet runtime, or an aspnetcore.
+* `dotnet-test-sdk` is useful in cases where unit tests expect a different dotnet SDK. By default, this is set to the `dotnet-sdk` attribute.
 * `testProjectFile` is useful in cases where the regular project file does not contain the unit tests. It gets restored and build, but not installed. You may need to regenerate your nuget lockfile after setting this. Note that if set, only tests from this project are executed.
 * `disabledTests` is used to disable running specific unit tests. This gets passed as: `dotnet test --filter "FullyQualifiedName!={}"`, to ensure compatibility with all unit test frameworks.
 * `dotnetRestoreFlags` can be used to pass flags to `dotnet restore`.
@@ -141,7 +142,9 @@ in buildDotnetModule rec {
   src = ./.;
 
   projectFile = "src/project.sln";
-  nugetDeps = ./deps.nix; # see "Generating and updating NuGet dependencies" section for details
+  # File generated with `nix-build -A package.passthru.fetch-deps`.
+  # To run fetch-deps when this file does not yet exist, set nugetDeps to null
+  nugetDeps = ./deps.nix;
 
   projectReferences = [ referencedProject ]; # `referencedProject` must contain `nupkg` in the folder structure.
 
@@ -194,7 +197,7 @@ This helper has the same arguments as `buildDotnetModule`, with a few difference
 
 * `pname` and `version` are required, and will be used to find the NuGet package of the tool
 * `nugetName` can be used to override the NuGet package name that will be downloaded, if it's different from `pname`
-* `nugetHash` is the hash of the fetched NuGet package. `nugetSha256` is also supported, but not recommended. Set this to `lib.fakeHash` for the first build, and it will error out, giving you the proper hash. Also remember to update it during version updates (it will not error out if you just change the version while having a fetched package in `/nix/store`)
+* `nugetSha256` is the hash of the fetched NuGet package. Set this to `lib.fakeHash256` for the first build, and it will error out, giving you the proper hash. Also remember to update it during version updates (it will not error out if you just change the version while having a fetched package in `/nix/store`)
 * `dotnet-runtime` is set to `dotnet-sdk` by default. When changing this, remember that .NET tools fetched from NuGet require an SDK.
 
 Here is an example of packaging `pbm`, an unfree binary without source available:
@@ -205,7 +208,7 @@ buildDotnetGlobalTool {
   pname = "pbm";
   version = "1.3.1";
 
-  nugetHash = "sha256-ZG2HFyKYhVNVYd2kRlkbAjZJq88OADe3yjxmLuxXDUo=";
+  nugetSha256 = "sha256-ZG2HFyKYhVNVYd2kRlkbAjZJq88OADe3yjxmLuxXDUo=";
 
   meta = {
     homepage = "https://cmd.petabridge.com/index.html";
@@ -217,12 +220,6 @@ buildDotnetGlobalTool {
 ```
 ## Generating and updating NuGet dependencies {#generating-and-updating-nuget-dependencies}
 
-When writing a new expression, you can use the generated `fetch-deps` script to initialise the lockfile.
-After creating a blank `deps.nix` and pointing `nugetDeps` to it,
-build the script with `nix-build -A package.fetch-deps` and then run the result.
-(When the root attr is your package, it's simply `nix-build -A fetch-deps`.)
-
-There is also a manual method:
 First, restore the packages to the `out` directory, ensure you have cloned
 the upstream repository and you are inside it.
 
@@ -241,15 +238,15 @@ $ nuget-to-nix out > deps.nix
 Which `nuget-to-nix` will generate an output similar to below
 ```nix
 { fetchNuGet }: [
-  (fetchNuGet { pname = "FosterFramework"; version = "0.1.15-alpha"; hash = "sha256-lM6eYgOGjl1fx6WFD7rnRi/YAQieM0mx60h0p5dr+l8="; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "8.0.1"; hash = "sha256-QbUQXjCzr8j8u/5X0af9jE++EugdoxMhT08F49MZX74="; })
-  (fetchNuGet { pname = "Microsoft.NET.ILLink.Tasks"; version = "8.0.1"; hash = "sha256-SopZpGaZ48/8dpUwDFDM3ix+g1rP4Yqs1PGuzRp+K7c="; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "8.0.1"; hash = "sha256-jajBI5GqG2IIcsIMgxTHfXbMapoXrZGl/EEhShwYq7w="; })
-  (fetchNuGet { pname = "SharpGLTF.Core"; version = "1.0.0-alpha0031"; hash = "sha256-Bs4baD5wNIH6wAbGK4Xaem0i3luQkOQs37izBWdFx1I="; })
-  (fetchNuGet { pname = "SharpGLTF.Runtime"; version = "1.0.0-alpha0031"; hash = "sha256-TwJO6b8ubmwBQh6NyHha8+JT5zHDJ4dROBbsEbUaa1M="; })
-  (fetchNuGet { pname = "Sledge.Formats"; version = "1.2.2"; hash = "sha256-0Ddhuwpu3wwIzA4NuPaEVdMkx6tUukh8uKD6nKoxFPg="; })
-  (fetchNuGet { pname = "Sledge.Formats.Map"; version = "1.1.5"; hash = "sha256-hkYJ2iWIz7vhPWlDOw2fvTenlh+4/D/37Z71tCEwnK8="; })
-  (fetchNuGet { pname = "System.Numerics.Vectors"; version = "4.5.0"; hash = "sha256-qdSTIFgf2htPS+YhLGjAGiLN8igCYJnCCo6r78+Q+c8="; })
+  (fetchNuGet { pname = "FosterFramework"; version = "0.1.15-alpha"; sha256 = "0pzsdfbsfx28xfqljcwy100xhbs6wyx0z1d5qxgmv3l60di9xkll"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "8.0.1"; sha256 = "1gjz379y61ag9whi78qxx09bwkwcznkx2mzypgycibxk61g11da1"; })
+  (fetchNuGet { pname = "Microsoft.NET.ILLink.Tasks"; version = "8.0.1"; sha256 = "1drbgqdcvbpisjn8mqfgba1pwb6yri80qc4mfvyczqwrcsj5k2ja"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "8.0.1"; sha256 = "1g5b30f4l8a1zjjr3b8pk9mcqxkxqwa86362f84646xaj4iw3a4d"; })
+  (fetchNuGet { pname = "SharpGLTF.Core"; version = "1.0.0-alpha0031"; sha256 = "0ln78mkhbcxqvwnf944hbgg24vbsva2jpih6q3x82d3h7rl1pkh6"; })
+  (fetchNuGet { pname = "SharpGLTF.Runtime"; version = "1.0.0-alpha0031"; sha256 = "0lvb3asi3v0n718qf9y367km7qpkb9wci38y880nqvifpzllw0jg"; })
+  (fetchNuGet { pname = "Sledge.Formats"; version = "1.2.2"; sha256 = "1y0l66m9rym0p1y4ifjlmg3j9lsmhkvbh38frh40rpvf1axn2dyh"; })
+  (fetchNuGet { pname = "Sledge.Formats.Map"; version = "1.1.5"; sha256 = "1bww60hv9xcyxpvkzz5q3ybafdxxkw6knhv97phvpkw84pd0jil6"; })
+  (fetchNuGet { pname = "System.Numerics.Vectors"; version = "4.5.0"; sha256 = "1kzrj37yzawf1b19jq0253rcs8hsq1l2q8g69d7ipnhzb0h97m59"; })
 ]
 ```
 
@@ -258,5 +255,6 @@ Finally, you move the `deps.nix` file to the appropriate location to be used by
 If you ever need to update the dependencies of a package, you instead do
 
 * `nix-build -A package.fetch-deps` to generate the update script for `package`
-* Run `./result` to regenerate the lockfile to the path passed for `nugetDeps` (keep in mind if it can't be resolved to a local path, the script will write to `$1` or a temporary path instead)
-* Finally, ensure the correct file was written and the derivation can be built.
+* Run `./result deps.nix` to regenerate the lockfile to `deps.nix`, keep in mind if a location isn't provided, it will write to a temporary path instead
+* Finally, move the file where needed and look at its contents to confirm it has updated the dependencies.
+

doc/languages-frameworks/gnome.section.md

@@ -143,7 +143,7 @@ You can also pass additional arguments to `makeWrapper` using `gappsWrapperArgs`
 
 ## Updating GNOME packages {#ssec-gnome-updating}
 
-Most GNOME package offer [`updateScript`](#var-passthru-updateScript), it is therefore possible to update to latest source tarball by running `nix-shell maintainers/scripts/update.nix --argstr package nautilus` or even en masse with `nix-shell maintainers/scripts/update.nix --argstr path gnome`. Read the package’s `NEWS` file to see what changed.
+Most GNOME package offer [`updateScript`](#var-passthru-updateScript), it is therefore possible to update to latest source tarball by running `nix-shell maintainers/scripts/update.nix --argstr package gnome.nautilus` or even en masse with `nix-shell maintainers/scripts/update.nix --argstr path gnome`. Read the package’s `NEWS` file to see what changed.
 
 ## Frequently encountered issues {#ssec-gnome-common-issues}
 

doc/languages-frameworks/go.section.md

@@ -66,25 +66,6 @@ The following is an example expression using `buildGoModule`:
 
 The function `buildGoPackage` builds legacy Go programs, not supporting Go modules.
 
-::: {.warning}
-`buildGoPackage` is deprecated and will be removed for the 25.05 release.
-:::
-
-### Migrating from `buildGoPackage` to `buildGoModule` {#buildGoPackage-migration}
-
-Go modules, released 6y ago, are now widely adopted in the ecosystem.
-Most upstream projects are using Go modules, and the tooling previously used for dependency management in Go is mostly deprecated, archived or at least unmaintained at this point.
-
-In case a project doesn't have external dependencies or dependencies are vendored in a way understood by `go mod init`, migration can be done with a few changes in the package.
-
-- Switch the builder from `buildGoPackage` to `buildGoModule`
-- Remove `goPackagePath` and other attributes specific to `buildGoPackage`
-- Set `vendorHash = null;`
-- Run `go mod init <module name>` in `postPatch`
-
-In case the package has external dependencies that aren't vendored or the build setup is more complex the upstream source might need to be patched.
-Examples for the migration can be found in the [issue tracking migration withing nixpkgs](https://github.com/NixOS/nixpkgs/issues/318069).
-
 ### Example for `buildGoPackage` {#example-for-buildgopackage}
 
 In the following is an example expression using `buildGoPackage`, the following arguments are of special significance to the function:

doc/languages-frameworks/gradle.section.md

@@ -1,189 +0,0 @@
-# Gradle {#gradle}
-
-Gradle is a popular build tool for Java/Kotlin. Gradle itself doesn't
-currently provide tools to make dependency resolution reproducible, so
-nixpkgs has a proxy designed for intercepting Gradle web requests to
-record dependencies so they can be restored in a reproducible fashion.
-
-## Building a Gradle package {#building-a-gradle-package}
-
-Here's how a typical derivation will look like:
-
-```nix
-stdenv.mkDerivation (finalAttrs: {
-  pname = "pdftk";
-  version = "3.3.3";
-
-  src = fetchFromGitLab {
-    owner = "pdftk-java";
-    repo = "pdftk";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-ciKotTHSEcITfQYKFZ6sY2LZnXGChBJy0+eno8B3YHY=";
-  };
-
-  nativeBuildInputs = [ gradle ];
-
-  # if the package has dependencies, mitmCache must be set
-  mitmCache = gradle.fetchDeps {
-    inherit (finalAttrs) pname;
-    data = ./deps.json;
-  };
-
-  # this is required for using mitm-cache on Darwin
-  __darwinAllowLocalNetworking = true;
-
-  gradleFlags = [ "-Dfile.encoding=utf-8" ];
-
-  # defaults to "assemble"
-  gradleBuildTask = "shadowJar";
-
-  # will run the gradleCheckTask (defaults to "test")
-  doCheck = true;
-
-  installPhase = ''
-    mkdir -p $out/{bin,share/pdftk}
-    cp build/libs/pdftk-all.jar $out/share/pdftk
-
-    makeWrapper ${jre}/bin/java $out/bin/pdftk \
-      --add-flags "-jar $out/share/pdftk/pdftk-all.jar"
-
-    cp ${finalAttrs.src}/pdftk.1 $out/share/man/man1
-  '';
-
-  meta.sourceProvenance = with lib.sourceTypes; [
-    fromSource
-    binaryBytecode # mitm cache
-  ];
-})
-```
-
-To update (or initialize) dependencies, run the update script via
-something like `$(nix-build -A <pname>.mitmCache.updateScript)`
-(`nix-build` builds the `updateScript`, `$(...)` runs the script at the
-path printed by `nix-build`).
-
-If your package can't be evaluated using a simple `pkgs.<pname>`
-expression (for example, if your package isn't located in nixpkgs, or if
-you want to override some of its attributes), you will usually have to
-pass `pkg` instead of `pname` to `gradle.fetchDeps`. There are two ways
-of doing it.
-
-The first is to add the derivation arguments required for getting the
-package. Using the pdftk example above:
-
-```nix
-{ lib
-, stdenv
-# ...
-, pdftk
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  # ...
-  mitmCache = gradle.fetchDeps {
-    pkg = pdftk;
-    data = ./deps.json;
-  };
-})
-```
-
-This allows you to `override` any arguments of the `pkg` used for
-the update script (for example, `pkg = pdftk.override { enableSomeFlag =
-true };`), so this is the preferred way.
-
-The second is to create a `let` binding for the package, like this:
-
-```nix
-let self = stdenv.mkDerivation {
-  # ...
-  mitmCache = gradle.fetchDeps {
-    pkg = self;
-    data = ./deps.json;
-  };
-}; in self
-```
-
-This is useful if you can't easily pass the derivation as its own
-argument, or if your `mkDerivation` call is responsible for building
-multiple packages.
-
-In the former case, the update script will stay the same even if the
-derivation is called with different arguments. In the latter case, the
-update script will change depending on the derivation arguments. It's up
-to you to decide which one would work best for your derivation.
-
-## Update Script {#gradle-update-script}
-
-The update script does the following:
-
-- Build the derivation's source via `pkgs.srcOnly`
-- Enter a `nix-shell` for the derivation in a `bwrap` sandbox (the
-  sandbox is only used on Linux)
-- Set the `IN_GRADLE_UPDATE_DEPS` environment variable to `1`
-- Run the derivation's `unpackPhase`, `patchPhase`, `configurePhase`
-- Run the derivation's `gradleUpdateScript` (the Gradle setup hook sets
-  a default value for it, which runs `preBuild`, `preGradleUpdate`
-  hooks, fetches the dependencies using `gradleUpdateTask`, and finally
-  runs the `postGradleUpdate` hook)
-- Finally, store all of the fetched files' hashes in the lockfile. They
-  may be `.jar`/`.pom` files from Maven repositories, or they may be
-  files otherwise used for building the package.
-
-`fetchDeps` takes the following arguments:
-
-- `attrPath` - the path to the package in nixpkgs (for example,
-  `"javaPackages.openjfx22"`). Used for update script metadata.
-- `pname` - an alias for `attrPath` for convenience. This is what you
-  will generally use instead of `pkg` or `attrPath`.
-- `pkg` - the package to be used for fetching the dependencies. Defaults
-  to `getAttrFromPath (splitString "." attrPath) pkgs`.
-- `bwrapFlags` - allows you to override bwrap flags (only relevant for
-  downstream, non-nixpkgs projects)
-- `data` - path to the dependencies lockfile (can be relative to the
-  package, can be absolute). In nixpkgs, it's discouraged to have the
-  lockfiles be named anything other `deps.json`, consider creating
-  subdirectories if your package requires multiple `deps.json` files.
-
-## Environment {#gradle-environment}
-
-The Gradle setup hook accepts the following environment variables:
-
-- `mitmCache` - the MITM proxy cache imported using `gradle.fetchDeps`
-- `gradleFlags` - command-line flags to be used for every Gradle
-  invocation (this simply registers a function that uses the necessary
-  flags).
-  - You can't use `gradleFlags` for flags that contain spaces, in that
-    case you must add `gradleFlagsArray+=("-flag with spaces")` to the
-    derivation's bash code instead.
-  - If you want to build the package using a specific Java version, you
-    can pass `"-Dorg.gradle.java.home=${jdk}"` as one of the flags.
-- `gradleBuildTask` - the Gradle task (or tasks) to be used for building
-  the package. Defaults to `assemble`.
-- `gradleCheckTask` - the Gradle task (or tasks) to be used for checking
-  the package if `doCheck` is set to `true`. Defaults to `test`.
-- `gradleUpdateTask` - the Gradle task (or tasks) to be used for
-  fetching all of the package's dependencies in
-  `mitmCache.updateScript`. Defaults to `nixDownloadDeps`.
-- `gradleUpdateScript` - the code to run for fetching all of the
-  package's dependencies in `mitmCache.updateScript`. Defaults to
-  running the `preBuild` and `preGradleUpdate` hooks, running the
-  `gradleUpdateTask`, and finally running the `postGradleUpdate` hook.
-- `gradleInitScript` - path to the `--init-script` to pass to Gradle. By
-  default, a simple init script that enables reproducible archive
-  creation is used.
-  - Note that reproducible archives might break some builds. One example
-    of an error caused by it is `Could not create task ':jar'. Replacing
-    an existing task that may have already been used by other plugins is
-    not supported`. If you get such an error, the easiest "fix" is
-    disabling reproducible archives altogether by setting
-    `gradleInitScript` to something like `writeText
-    "empty-init-script.gradle" ""`
-- `enableParallelBuilding` / `enableParallelChecking` /
-  `enableParallelUpdating` - pass `--parallel` to Gradle in the
-  build/check phase or in the update script. Defaults to true. If the
-  build fails for mysterious reasons, consider setting this to false.
-- `dontUseGradleConfigure` / `dontUseGradleBuild` / `dontUseGradleCheck`
-  \- force disable the Gradle setup hook for certain phases.
-  - Note that if you disable the configure hook, you may face issues
-    such as `Failed to load native library 'libnative-platform.so'`,
-    because the configure hook is responsible for initializing Gradle.

doc/languages-frameworks/hare.section.md

@@ -1,53 +0,0 @@
-# Hare {#sec-language-hare}
-
-## Building Hare programs with `hareHook` {#ssec-language-hare}
-
-The `hareHook` package sets up the environment for building Hare programs by
-doing the following:
-
-1. Setting the `HARECACHE`, `HAREPATH` and `NIX_HAREFLAGS` environment variables;
-1. Propagating `harec`, `qbe` and two wrapper scripts  for the hare binary.
-
-It is not a function as is the case for some other languages --- *e. g.*, Go or
-Rust ---, but a package to be added to `nativeBuildInputs`.
-
-## Attributes of `hareHook` {#hareHook-attributes}
-
-The following attributes are accepted by `hareHook`:
-
-1. `hareBuildType`: Either `release` (default) or `debug`. It controls if the
-   `-R` flag is added to `NIX_HAREFLAGS`.
-
-## Example for `hareHook` {#ex-hareHook}
-
-```nix
-{
-  hareHook,
-  lib,
-  stdenv,
-}: stdenv.mkDerivation {
-  pname = "<name>";
-  version = "<version>";
-  src = "<src>";
-
-  nativeBuildInputs = [ hareHook ];
-
-  meta = {
-    description = "<description>";
-    inherit (hareHook) badPlatforms platforms;
-  };
-}
-```
-
-## Cross Compilation {#hareHook-cross-compilation}
-
-`hareHook` should handle cross compilation out of the box. This is the main
-purpose of `NIX_HAREFLAGS`: In it, the `-a` flag is passed with the architecture
-of the `hostPlatform`.
-
-However, manual intervention may be needed when a binary compiled by the build
-process must be run for the build to complete --- *e. g.*, when using Hare's
-`hare` module for code generation.
-
-In those cases, `hareHook` provides the `hare-native` script, which is a wrapper
-around the hare binary for using the native (`buildPlatform`) toolchain.

doc/languages-frameworks/haskell.section.md

@@ -21,14 +21,25 @@ Many “normal” user facing packages written in Haskell, like `niv` or `cachix
 are also exposed at the top level, and there is nothing Haskell specific to
 installing and using them.
 
-All of these packages are originally defined in the `haskellPackages` package set.
-The same packages are re-exposed with a reduced dependency closure for convenience (see `justStaticExecutables` or `separateBinOutput` below).
+All of these packages are originally defined in the `haskellPackages` package
+set and are re-exposed with a reduced dependency closure for convenience.
+(see `justStaticExecutables` or `separateBinOutput` below)
 
-:::{.note}
-See [](#chap-language-support) for techniques to explore package sets.
-:::
+The `haskellPackages` set includes at least one version of every package from
+Hackage as well as some manually injected packages. This amounts to a lot of
+packages, so it is hidden from `nix-env -qa` by default for performance reasons.
+You can still list all packages in the set like this:
 
-The `haskellPackages` set includes at least one version of every package from [Hackage](https://hackage.haskell.org/) as well as some manually injected packages.
+```console
+$ nix-env -f '<nixpkgs>' -qaP -A haskellPackages
+haskellPackages.a50                                                         a50-0.5
+haskellPackages.AAI                                                         AAI-0.2.0.1
+haskellPackages.aasam                                                       aasam-0.2.0.0
+haskellPackages.abacate                                                     abacate-0.0.0.0
+haskellPackages.abc-puzzle                                                  abc-puzzle-0.2.1
+…
+```
+Also, the `haskellPackages` set is included on [search.nixos.org].
 
 The attribute names in `haskellPackages` always correspond with their name on
 Hackage. Since Hackage allows names that are not valid Nix without escaping,
@@ -38,7 +49,8 @@ For packages that are part of [Stackage] (a curated set of known to be
 compatible packages), we use the version prescribed by a Stackage snapshot
 (usually the current LTS one) as the default version. For all other packages we
 use the latest version from [Hackage](https://hackage.org) (the repository of
-basically all open source Haskell packages). See [below](#haskell-available-versions) for a few more details on this.
+basically all open source Haskell packages). See [below](#haskell-available-
+versions) for a few more details on this.
 
 Roughly half of the 16K packages contained in `haskellPackages` don’t actually
 build and are [marked as broken semi-automatically](https://github.com/NixOS/nixpkgs/blob/haskell-updates/pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml).
@@ -51,15 +63,68 @@ How you can help with that is
 described in [Fixing a broken package](#haskell-fixing-a-broken-package).
 -->
 
-`haskellPackages` is built with our default compiler, but we also provide other releases of GHC and package sets built with them.
-Available compilers are collected under `haskell.compiler`.
+`haskellPackages` is built with our default compiler, but we also provide other
+releases of GHC and package sets built with them. You can list all available
+compilers like this:
 
-Each of those compiler versions has a corresponding attribute set `packages` built with
+```console
+$ nix-env -f '<nixpkgs>' -qaP -A haskell.compiler
+haskell.compiler.ghc810                  ghc-8.10.7
+haskell.compiler.ghc90                   ghc-9.0.2
+haskell.compiler.ghc925                  ghc-9.2.5
+haskell.compiler.ghc926                  ghc-9.2.6
+haskell.compiler.ghc927                  ghc-9.2.7
+haskell.compiler.ghc92                   ghc-9.2.8
+haskell.compiler.ghc945                  ghc-9.4.5
+haskell.compiler.ghc946                  ghc-9.4.6
+haskell.compiler.ghc947                  ghc-9.4.7
+haskell.compiler.ghc94                   ghc-9.4.8
+haskell.compiler.ghc963                  ghc-9.6.3
+haskell.compiler.ghc96                   ghc-9.6.4
+haskell.compiler.ghc98                   ghc-9.8.1
+haskell.compiler.ghcHEAD                 ghc-9.9.20231121
+haskell.compiler.ghc8107Binary           ghc-binary-8.10.7
+haskell.compiler.ghc865Binary            ghc-binary-8.6.5
+haskell.compiler.ghc924Binary            ghc-binary-9.2.4
+haskell.compiler.integer-simple.ghc8107  ghc-integer-simple-8.10.7
+haskell.compiler.integer-simple.ghc810   ghc-integer-simple-8.10.7
+haskell.compiler.native-bignum.ghc90     ghc-native-bignum-9.0.2
+haskell.compiler.native-bignum.ghc902    ghc-native-bignum-9.0.2
+haskell.compiler.native-bignum.ghc925    ghc-native-bignum-9.2.5
+haskell.compiler.native-bignum.ghc926    ghc-native-bignum-9.2.6
+haskell.compiler.native-bignum.ghc927    ghc-native-bignum-9.2.7
+haskell.compiler.native-bignum.ghc92     ghc-native-bignum-9.2.8
+haskell.compiler.native-bignum.ghc928    ghc-native-bignum-9.2.8
+haskell.compiler.native-bignum.ghc945    ghc-native-bignum-9.4.5
+haskell.compiler.native-bignum.ghc946    ghc-native-bignum-9.4.6
+haskell.compiler.native-bignum.ghc947    ghc-native-bignum-9.4.7
+haskell.compiler.native-bignum.ghc94     ghc-native-bignum-9.4.8
+haskell.compiler.native-bignum.ghc948    ghc-native-bignum-9.4.8
+haskell.compiler.native-bignum.ghc963    ghc-native-bignum-9.6.3
+haskell.compiler.native-bignum.ghc96     ghc-native-bignum-9.6.4
+haskell.compiler.native-bignum.ghc964    ghc-native-bignum-9.6.4
+haskell.compiler.native-bignum.ghc98     ghc-native-bignum-9.8.1
+haskell.compiler.native-bignum.ghc981    ghc-native-bignum-9.8.1
+haskell.compiler.native-bignum.ghcHEAD   ghc-native-bignum-9.9.20231121
+haskell.compiler.ghcjs                   ghcjs-8.10.7
+```
+
+Each of those compiler versions has a corresponding attribute set built using
 it. However, the non-standard package sets are not tested regularly and, as a
 result, contain fewer working packages. The corresponding package set for GHC
 9.4.5 is `haskell.packages.ghc945`. In fact `haskellPackages` is just an alias
 for `haskell.packages.ghc964`:
 
+```console
+$ nix-env -f '<nixpkgs>' -qaP -A haskell.packages.ghc927
+haskell.packages.ghc927.a50                                                         a50-0.5
+haskell.packages.ghc927.AAI                                                         AAI-0.2.0.1
+haskell.packages.ghc927.aasam                                                       aasam-0.2.0.0
+haskell.packages.ghc927.abacate                                                     abacate-0.0.0.0
+haskell.packages.ghc927.abc-puzzle                                                  abc-puzzle-0.2.1
+…
+```
+
 Every package set also re-exposes the GHC used to build its packages as `haskell.packages.*.ghc`.
 
 ### Available package versions {#haskell-available-versions}
@@ -858,61 +923,14 @@ for this to work.
 
 `justStaticExecutables drv`
 : Only build and install the executables produced by `drv`, removing everything
-  that may refer to other Haskell packages' store paths (like libraries and
-  documentation). This dramatically reduces the closure size of the resulting
-  derivation. Note that the executables are only statically linked against their
-  Haskell dependencies, but will still link dynamically against libc, GMP and
-  other system library dependencies.
-
-  If a library or its dependencies use their Cabal-generated
-  `Paths_*` module, this may not work as well if GHC's dead code elimination is
-  unable to remove the references to the dependency's store path that module
-  contains.
-  As a consequence, an unused reference may be created from the static binary to such a _library_ store path.
-  (See [nixpkgs#164630][164630] for more information.)
-
-  Importing the `Paths_*` module may cause builds to fail with this message:
-
-  ```
-  error: output '/nix/store/64k8iw0ryz76qpijsnl9v87fb26v28z8-my-haskell-package-1.0.0.0' is not allowed to refer to the following paths:
-           /nix/store/5q5s4a07gaz50h04zpfbda8xjs8wrnhg-ghc-9.6.3
-  ```
-
-  If that happens, first disable the check for GHC references and rebuild the
-  derivation:
-
-  ```nix
-  pkgs.haskell.lib.overrideCabal
-    (pkgs.haskell.lib.justStaticExecutables my-haskell-package)
-    (drv: {
-      disallowGhcReference = false;
-    })
-  ```
-
-  Then use `strings` to determine which libraries are responsible:
-
-  ```
-  $ nix-build ...
-  $ strings result/bin/my-haskell-binary | grep /nix/store/
-  ...
-  /nix/store/n7ciwdlg8yyxdhbrgd6yc2d8ypnwpmgq-hs-opentelemetry-sdk-0.0.3.6/bin
-  ...
-  ```
-
-  Finally, use `remove-references-to` to delete those store paths from the produced output:
-
-  ```nix
-  pkgs.haskell.lib.overrideCabal
-    (pkgs.haskell.lib.justStaticExecutables my-haskell-package)
-    (drv: {
-      postInstall = ''
-        ${drv.postInstall or ""}
-        remove-references-to -t ${pkgs.haskellPackages.hs-opentelemetry-sdk}
-      '';
-    })
-  ```
-
-[164630]: https://github.com/NixOS/nixpkgs/issues/164630
+that may refer to other Haskell packages' store paths (like libraries and
+documentation). This dramatically reduces the closure size of the resulting
+derivation. Note that the executables are only statically linked against their
+Haskell dependencies, but will still link dynamically against libc, GMP and
+other system library dependencies. If dependencies use their Cabal-generated
+`Paths_*` module, this may not work as well if GHC's dead code elimination
+is unable to remove the references to the dependency's store path that module
+contains.
 
 `enableSeparateBinOutput drv`
 : Install executables produced by `drv` to a separate `bin` output. This

doc/languages-frameworks/idris2.section.md

@@ -19,7 +19,7 @@ let lspLibPkg = idris2Packages.buildIdris {
   };
   idrisLibraries = [ ];
 };
-in lspLibPkg.library { withSource = true; }
+in lspLibPkg.library
 ```
 
 The above results in a derivation with the installed library results (with sourcecode).
@@ -30,7 +30,6 @@ A slightly more involved example of a fully packaged executable would be the [`i
 
 # Assuming the previous example lives in `lsp-lib.nix`:
 let lspLib = callPackage ./lsp-lib.nix { };
-    inherit (idris2Packages) idris2Api;
     lspPkg = idris2Packages.buildIdris {
       ipkgName = "idris2-lsp";
       src = fetchFromGitHub {
@@ -39,9 +38,10 @@ let lspLib = callPackage ./lsp-lib.nix { };
          rev = "main";
          hash = "sha256-vQTzEltkx7uelDtXOHc6QRWZ4cSlhhm5ziOqWA+aujk=";
       };
-      idrisLibraries = [idris2Api lspLib];
+      idrisLibraries = [(idris2Packages.idris2Api { }) (lspLib { })];
     };
 in lspPkg.executable
 ```
 
-The above uses the default value of `withSource = false` for the `idris2Api` but could be modified to include that library's source by passing `(idris2Api { withSource = true; })` to `idrisLibraries` instead. `idris2Api` in the above derivation comes built in with `idris2Packages`. This library exposes many of the otherwise internal APIs of the Idris2 compiler.
+The above uses the default value of `withSource = false` for both of the two required Idris libraries that the `idris2-lsp` executable depends on. `idris2Api` in the above derivation comes built in with `idris2Packages`. This library exposes many of the otherwise internal APIs of the Idris2 compiler.
+

doc/languages-frameworks/index.md

@@ -2,54 +2,6 @@
 
 The [standard build environment](#chap-stdenv) makes it easy to build typical Autotools-based packages with very little code. Any other kind of package can be accommodated by overriding the appropriate phases of `stdenv`. However, there are specialised functions in Nixpkgs to easily build packages for other programming languages, such as Perl or Haskell. These are described in this chapter.
 
-Each supported language or software ecosystem has its own package set named `<language or ecosystem>Packages`, which can be explored in various ways:
-
-- Search on [search.nixos.org](https://search.nixos.org/packages)
-
-  For example, search for [`haskellPackages`](https://search.nixos.org/packages?query=haskellPackages) or [`rubyPackages`](https://search.nixos.org/packages?query=rubyPackages).
-
-- Navigate attribute sets with [`nix repl`](https://nixos.org/manual/nix/stable/command-ref/new-cli/nix3-repl).
-
-  This technique is generally useful to inspect Nix language data structures.
-
-  :::{.example #example-navigte-nix-repl}
-
-  # Navigate Java compiler variants in `javaPackages` with `nix repl`
-
-  ```shell-session
-  $ nix repl '<nixpkgs>' -I nixpkgs=channel:nixpkgs-unstable
-  nix-repl> javaPackages.<tab>
-  javaPackages.compiler               javaPackages.openjfx15              javaPackages.openjfx21              javaPackages.recurseForDerivations
-  javaPackages.jogl_2_4_0             javaPackages.openjfx17              javaPackages.openjfx22
-  javaPackages.mavenfod               javaPackages.openjfx19              javaPackages.override
-  javaPackages.openjfx11              javaPackages.openjfx20              javaPackages.overrideDerivation
-  ```
-  :::
-
-- List all derivations on the command line with [`nix-env --query`](https://nixos.org/manual/nix/stable/command-ref/nix-env/query).
-
-  `nix-env` is the only convenient way to do that, as it will skip attributes that fail [assertions](https://nixos.org/manual/nix/stable/language/constructs#assertions), such as when a package is [marked as broken](#var-meta-broken), rather than failing the entire evaluation.
-
-  :::{.example #example-list-haskellPackages}
-
-  # List all Python packages in Nixpkgs
-
-  The following command lists all [derivations names](https://nixos.org/manual/nix/stable/language/derivations#attr-name) with their attribute path from the latest Nixpkgs rolling release (`nixpkgs-unstable`).
-
-  ```shell-session
-  $ nix-env -qaP -f '<nixpkgs>' -A pythonPackages -I nixpkgs=channel:nixpkgs-unstable
-  ```
-
-  ```console
-  pythonPackages.avahi                                                  avahi-0.8
-  pythonPackages.boost                                                  boost-1.81.0
-  pythonPackages.caffe                                                  caffe-1.0
-  pythonPackages.caffeWithCuda                                          caffe-1.0
-  pythonPackages.cbeams                                                 cbeams-1.0.3
-  …
-  ```
-  :::
-
 ```{=include=} sections
 agda.section.md
 android.section.md
@@ -67,7 +19,6 @@ dotnet.section.md
 emscripten.section.md
 gnome.section.md
 go.section.md
-hare.section.md
 haskell.section.md
 hy.section.md
 idris.section.md
@@ -90,7 +41,6 @@ qt.section.md
 r.section.md
 ruby.section.md
 rust.section.md
-scheme.section.md
 swift.section.md
 texlive.section.md
 titanium.section.md

doc/languages-frameworks/javascript.section.md

@@ -206,7 +206,7 @@ buildNpmPackage rec {
   NODE_OPTIONS = "--openssl-legacy-provider";
 
   meta = {
-    description = "Modern web UI for various torrent clients with a Node.js backend and React frontend";
+    description = "A modern web UI for various torrent clients with a Node.js backend and React frontend";
     homepage = "https://flood.js.org";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ winter ];
@@ -233,7 +233,7 @@ If these are not defined, `npm pack` may miss some files, and no binaries will b
 * `npmPruneFlags`: Flags to pass to `npm prune`. Defaults to the value of `npmInstallFlags`.
 * `makeWrapperArgs`: Flags to pass to `makeWrapper`, added to executable calling the generated `.js` with `node` as an interpreter. These scripts are defined in `package.json`.
 * `nodejs`: The `nodejs` package to build against, using the corresponding `npm` shipped with that version of `node`. Defaults to `pkgs.nodejs`.
-* `npmDeps`: The dependencies used to build the npm package. Especially useful to not have to recompute workspace dependencies.
+* `npmDeps`: The dependencies used to build the npm package. Especially useful to not have to recompute workspace depedencies.
 
 #### prefetch-npm-deps {#javascript-buildNpmPackage-prefetch-npm-deps}
 
@@ -310,139 +310,8 @@ See `node2nix` [docs](https://github.com/svanderburg/node2nix) for more info.
 - `node2nix` has some [bugs](https://github.com/svanderburg/node2nix/issues/238) related to working with lock files from npm distributed with `nodejs_16`.
 - `node2nix` does not like missing packages from npm. If you see something like `Cannot resolve version: vue-loader-v16@undefined` then you might want to try another tool. The package might have been pulled off of npm.
 
-### pnpm {#javascript-pnpm}
-
-Pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_8` and `pnpm_9`, which support different sets of lock file versions.
-
-When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The functions `pnpm_8.fetchDeps` and `pnpm_9.fetchDeps` can create this pnpm store derivation. In conjunction, the setup hooks `pnpm_8.configHook` and `pnpm_9.configHook` will prepare the build environment to install the prefetched dependencies store. Here is an example for a package that contains a `package.json` and a `pnpm-lock.yaml` files using the above `pnpm_` attributes:
-
-```nix
-{
-  stdenv,
-  nodejs,
-  # This is pinned as { pnpm = pnpm_9; }
-  pnpm
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "foo";
-  version = "0-unstable-1980-01-01";
-
-  src = ...;
-
-  nativeBuildInputs = [
-    nodejs
-    pnpm.configHook
-  ];
-
-  pnpmDeps = pnpm.fetchDeps {
-    inherit (finalAttrs) pname version src;
-    hash = "...";
-  };
-})
-```
-
-NOTE: It is highly recommended to use a pinned version of pnpm (i.e. `pnpm_8` or `pnpm_9`), to increase future reproducibility. It might also be required to use an older version, if the package needs support for a certain lock file version.
-
-In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `finalAttrs.patches` to the function as well (i.e. `inherit (finalAttrs) patches`.
-
-#### Dealing with `sourceRoot` {#javascript-pnpm-sourceRoot}
-
-NOTE: Nixpkgs pnpm tooling doesn't support building projects with a `pnpm-workspace.yaml`, or building monorepos. It maybe possible to use `pnpm.fetchDeps` for these projects, but it may be hard or impossible to produce a binary from such projects ([an example attempt](https://github.com/NixOS/nixpkgs/pull/290715#issuecomment-2144543728)).
-
-If the pnpm project is in a subdirectory, you can just define `sourceRoot` or `setSourceRoot` for `fetchDeps`. Note, that projects using `pnpm-workspace.yaml` are currently not supported, and will probably not work using this approach.
-If `sourceRoot` is different between the parent derivation and `fetchDeps`, you will have to set `pnpmRoot` to effectively be the same location as it is in `fetchDeps`.
-
-Assuming the following directory structure, we can define `sourceRoot` and `pnpmRoot` as follows:
-
-```
-.
-├── frontend
-│   ├── ...
-│   ├── package.json
-│   └── pnpm-lock.yaml
-└── ...
-```
-
-```nix
-  ...
-  pnpmDeps = pnpm.fetchDeps {
-    ...
-    sourceRoot = "${finalAttrs.src.name}/frontend";
-  };
-
-  # by default the working directory is the extracted source
-  pnpmRoot = "frontend";
-```
-
-### Yarn {#javascript-yarn}
-
-Yarn based projects use a `yarn.lock` file instead of a `package-lock.json` to pin dependencies. Nixpkgs provides the Nix function `fetchYarnDeps` which fetches an offline cache suitable for running `yarn install` before building the project. In addition, Nixpkgs provides the hooks:
-
-- `yarnConfigHook`: Fetches the dependencies from the offline cache and installs them into `node_modules`.
-- `yarnBuildHook`: Runs `yarn build` or a specified `yarn` command that builds the project.
-
-An example usage of the above attributes is:
-
-```nix
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchYarnDeps,
-  yarnConfigHook,
-  yarnBuildHook,
-  nodejs,
-  npmHooks,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "...";
-  version = "...";
-
-  src = fetchFromGitHub {
-    owner = "...";
-    repo = "...";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-  };
-
-  yarnOfflineCache = fetchYarnDeps {
-    yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-mo8urQaWIHu33+r0Y7mL9mJ/aSe/5CihuIetTeDHEUQ=";
-  };
-
-  nativeBuildInputs = [
-    yarnConfigHook
-    yarnBuildHook
-    # Needed for executing package.json scripts
-    nodejs
-    npmHooks.npmInstallHook
-  ];
-
-  meta = {
-    # ...
-  };
-})
-```
-
-Note that there is no setup hook for installing yarn based packages - `npmHooks.npmInstallHook` should fit most cases, but sometimes you may need to override the `installPhase` completely.
-
-#### `yarnConfigHook` arguments {#javascript-yarnconfighook}
-
-By default, `yarnConfigHook` relies upon the attribute `${yarnOfflineCache}` (or `${offlineCache}` if the former is not set) to find the location of the offline cache produced by `fetchYarnDeps`. To disable this phase, you can set `dontYarnInstallDeps = true` or override the `configurePhase`.
-
-#### `yarnBuildHook` arguments {#javascript-yarnbuildhook}
-
-This script by default runs `yarn --offline build`, and it relies upon the project's dependencies installed at `node_modules`. Below is a list of additional `mkDerivation` arguments read by this hook:
-
-- `yarnBuildScript`: Sets a different `yarn --offline` subcommand (defaults to `build`).
-- `yarnBuildFlags`: Single string list of additional flags to pass the above command, or a Nix list of such additional flags.
-
 ### yarn2nix {#javascript-yarn2nix}
 
-WARNING: The `yarn2nix` functions have been deprecated in favor of the new `yarnConfigHook` and `yarnBuildHook`. Documentation for them still appears here for the sake of the packages that still use them. See also a tracking issue [#324246](https://github.com/NixOS/nixpkgs/issues/324246).
-
 #### Preparation {#javascript-yarn2nix-preparation}
 
 You will need at least a `yarn.lock` file. If upstream does not have one you need to generate it and reference it in your package definition.

doc/languages-frameworks/nim.section.md

@@ -7,7 +7,7 @@ The following example shows a Nim program that depends only on Nim libraries:
 ```nix
 { lib, buildNimPackage, fetchFromGitHub }:
 
-buildNimPackage (finalAttrs: {
+buildNimPackage { } (finalAttrs: {
   pname = "ttop";
   version = "1.2.7";
 
@@ -80,6 +80,7 @@ For example, to propagate a dependency on SDL2 for lockfiles that select the Nim
   /* … */
   sdl2 =
     lockAttrs:
+    finalAttrs:
     { buildInputs ? [ ], ... }:
     {
       buildInputs = buildInputs ++ [ SDL2 ];
@@ -88,8 +89,9 @@ For example, to propagate a dependency on SDL2 for lockfiles that select the Nim
 }
 ```
 
-The annotations in the `nim-overrides.nix` set are functions that take two arguments and return a new attrset to be overlaid on the package being built.
+The annotations in the `nim-overrides.nix` set are functions that take three arguments and return a new attrset to be overlayed on the package being built.
 - lockAttrs: the attrset for this library from within a lockfile. This can be used to implement library version constraints, such as marking libraries as broken or insecure.
+- finalAttrs: the final attrset passed by `buildNimPackage` to `stdenv.mkDerivation`.
 - prevAttrs: the attrset produced by initial arguments to `buildNimPackage` and any preceding lockfile overlays.
 
 ### Overriding an Nim library override {#nim-lock-overrides-overrides}

doc/languages-frameworks/ocaml.section.md

@@ -113,13 +113,21 @@ buildDunePackage rec {
 
   meta = {
     homepage = "https://github.com/flowtype/ocaml-wtf8";
-    description = "WTF-8 is a superset of UTF-8 that allows unpaired surrogates";
+    description = "WTF-8 is a superset of UTF-8 that allows unpaired surrogates.";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.eqyiel ];
   };
 }
 ```
 
+Note about `minimalOCamlVersion`.  A deprecated version of this argument was
+spelled `minimumOCamlVersion`; setting the old attribute wrongly modifies the
+derivation hash and is therefore inappropriate. As a technical dept, currently
+packaged libraries may still use the old spelling: maintainers are invited to
+fix this when updating packages. Massive renaming is strongly discouraged as it
+would be challenging to review, difficult to test, and will cause unnecessary
+rebuild.
+
 The build will automatically fail if two distinct versions of the same library
 are added to `buildInputs` (which usually happens transitively because of
 `propagatedBuildInputs`). Set `dontDetectOcamlConflicts` to true to disable this

doc/languages-frameworks/perl.section.md

@@ -158,7 +158,7 @@ $ nix-generate-from-cpan XML::Simple
     };
     propagatedBuildInputs = [ XMLNamespaceSupport XMLSAX XMLSAXExpat ];
     meta = {
-      description = "API for simple XML files";
+      description = "An API for simple XML files";
       license = with lib.licenses; [ artistic1 gpl1Plus ];
     };
   };

doc/languages-frameworks/php.section.md

@@ -283,10 +283,7 @@ in {
   ];
 
   composerRepository = php.mkComposerRepository {
-    inherit (finalAttrs) pname version src;
-    composerNoDev = true;
-    composerNoPlugins = true;
-    composerNoScripts = true;
+    inherit (finalAttrs) src;
     # Specifying a custom composer.lock since it is not present in the sources.
     composerLock = ./composer.lock;
     # The composer vendor hash

doc/languages-frameworks/python.section.md

@@ -4,7 +4,16 @@
 
 ### Interpreters {#interpreters}
 
-@python-interpreter-table@
+| Package    | Aliases         | Interpreter |
+|------------|-----------------|-------------|
+| python27   | python2, python | CPython 2.7 |
+| python39   |                 | CPython 3.9 |
+| python310  |                 | CPython 3.10 |
+| python311  | python3         | CPython 3.11 |
+| python312  |                 | CPython 3.12 |
+| python313  |                 | CPython 3.13 |
+| pypy27     | pypy2, pypy     | PyPy2.7 |
+| pypy39     | pypy3           | PyPy 3.9 |
 
 The Nix expressions for the interpreters can be found in
 `pkgs/development/interpreters/python`.
@@ -31,8 +40,8 @@ Each interpreter has the following attributes:
 
 ### Building packages and applications {#building-packages-and-applications}
 
-Python libraries and applications that use tools to follow PEP 517 (e.g. `setuptools` or `hatchling`, etc.) or
-previous tools such as `distutils` are typically built with respectively the [`buildPythonPackage`](#buildpythonpackage-function) and
+Python libraries and applications that use `setuptools` or
+`distutils` are typically built with respectively the [`buildPythonPackage`](#buildpythonpackage-function) and
 [`buildPythonApplication`](#buildpythonapplication-function) functions. These two functions also support installing a `wheel`.
 
 All Python packages reside in `pkgs/top-level/python-packages.nix` and all
@@ -78,7 +87,6 @@ The following is an example:
 , fetchPypi
 
 # build-system
-, setuptools
 , setuptools-scm
 
 # dependencies
@@ -108,7 +116,6 @@ buildPythonPackage rec {
   '';
 
   build-system = [
-    setuptools
     setuptools-scm
   ];
 
@@ -136,13 +143,13 @@ buildPythonPackage rec {
 
 The `buildPythonPackage` mainly does four things:
 
-* In the [`buildPhase`](#build-phase), it calls `${python.pythonOnBuildForHost.interpreter} -m build --wheel` to
+* In the [`buildPhase`](#build-phase), it calls `${python.pythonOnBuildForHost.interpreter} setup.py bdist_wheel` to
   build a wheel binary zipfile.
-* In the [`installPhase`](#ssec-install-phase), it installs the wheel file using `${python.pythonOnBuildForHost.interpreter} -m installer *.whl`.
+* In the [`installPhase`](#ssec-install-phase), it installs the wheel file using `pip install *.whl`.
 * In the [`postFixup`](#var-stdenv-postFixup) phase, the `wrapPythonPrograms` bash function is called to
   wrap all programs in the `$out/bin/*` directory to include `$PATH`
   environment variable and add dependent libraries to script's `sys.path`.
-* In the [`installCheck`](#ssec-installCheck-phase) phase, `${python.interpreter} -m pytest` is run.
+* In the [`installCheck`](#ssec-installCheck-phase) phase, `${python.interpreter} setup.py test` is run.
 
 By default tests are run because [`doCheck = true`](#var-stdenv-doCheck). Test dependencies, like
 e.g. the test runner, should be added to [`nativeCheckInputs`](#var-stdenv-nativeCheckInputs).
@@ -179,6 +186,10 @@ following are specific to `buildPythonPackage`:
   `makeWrapperArgs = ["--set FOO BAR" "--set BAZ QUX"]`.
 * `namePrefix`: Prepends text to `${name}` parameter. In case of libraries, this
   defaults to `"python3.8-"` for Python 3.8, etc., and in case of applications to `""`.
+* `pipInstallFlags ? []`: A list of strings. Arguments to be passed to `pip
+  install`. To pass options to `python setup.py install`, use
+  `--install-option`. E.g., `pipInstallFlags=["--install-option='--cpp_implementation'"]`.
+* `pipBuildFlags ? []`: A list of strings. Arguments to be passed to `pip wheel`.
 * `pypaBuildFlags ? []`: A list of strings. Arguments to be passed to `python -m build --wheel`.
 * `pythonPath ? []`: List of packages to be added into `$PYTHONPATH`. Packages
   in `pythonPath` are not propagated (contrary to [`propagatedBuildInputs`](#var-stdenv-propagatedBuildInputs)).
@@ -296,6 +307,7 @@ python3Packages.buildPythonApplication rec {
 
   build-system = with python3Packages; [
     setuptools
+    wheel
   ];
 
   dependencies = with python3Packages; [
@@ -462,11 +474,13 @@ are used in [`buildPythonPackage`](#buildpythonpackage-function).
   with the `eggInstallHook`
 - `eggBuildHook` to skip building for eggs.
 - `eggInstallHook` to install eggs.
+- `pipBuildHook` to build a wheel using `pip` and PEP 517. Note a build system
+  (e.g. `setuptools` or `flit`) should still be added as `build-system`.
 - `pypaBuildHook` to build a wheel using
   [`pypa/build`](https://pypa-build.readthedocs.io/en/latest/index.html) and
   PEP 517/518. Note a build system (e.g. `setuptools` or `flit`) should still
   be added as `build-system`.
-- `pypaInstallHook` to install wheels.
+- `pipInstallHook` to install wheels.
 - `pytestCheckHook` to run tests with `pytest`. See [example usage](#using-pytestcheckhook).
 - `pythonCatchConflictsHook` to fail if the package depends on two different versions of the same dependency.
 - `pythonImportsCheckHook` to check whether importing the listed modules works.
@@ -604,8 +618,7 @@ that sets up an interpreter pointing to them. This matters much more for "big"
 modules like `pytorch` or `tensorflow`.
 
 Module names usually match their names on [pypi.org](https://pypi.org/), but
-normalized according to PEP 503/508. (e.g. Foo__Bar.baz -> foo-bar-baz)
-You can use the [Nixpkgs search website](https://nixos.org/nixos/packages.html)
+you can use the [Nixpkgs search website](https://nixos.org/nixos/packages.html)
 to find them as well (along with non-python packages).
 
 At this point we can create throwaway experimental Python environments with
@@ -833,6 +846,7 @@ building Python libraries is [`buildPythonPackage`](#buildpythonpackage-function
 , buildPythonPackage
 , fetchPypi
 , setuptools
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -847,6 +861,7 @@ buildPythonPackage rec {
 
   build-system = [
     setuptools
+    wheel
   ];
 
   # has no tests
@@ -870,7 +885,7 @@ buildPythonPackage rec {
 What happens here? The function [`buildPythonPackage`](#buildpythonpackage-function) is called and as argument
 it accepts a set. In this case the set is a recursive set, `rec`. One of the
 arguments is the name of the package, which consists of a basename (generally
-following the name on PyPI) and a version. Another argument, `src` specifies the
+following the name on PyPi) and a version. Another argument, `src` specifies the
 source, which in this case is fetched from PyPI using the helper function
 `fetchPypi`. The argument `doCheck` is used to set whether tests should be run
 when building the package. Since there are no tests, we rely on [`pythonImportsCheck`](#using-pythonimportscheck)
@@ -905,6 +920,7 @@ with import <nixpkgs> {};
 
       build-system = [
         python311.pkgs.setuptools
+        python311.pkgs.wheel
       ];
 
       # has no tests
@@ -957,13 +973,13 @@ order to build [`datashape`](https://github.com/blaze/datashape).
 , fetchPypi
 
 # build dependencies
-, setuptools
+, setuptools, wheel
 
 # dependencies
 , numpy, multipledispatch, python-dateutil
 
 # tests
-, pytestCheckHook
+, pytest
 }:
 
 buildPythonPackage rec {
@@ -978,6 +994,7 @@ buildPythonPackage rec {
 
   build-system = [
     setuptools
+    wheel
   ];
 
   dependencies = [
@@ -987,21 +1004,21 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
+    pytest
   ];
 
   meta = {
     changelog = "https://github.com/blaze/datashape/releases/tag/${version}";
     homepage = "https://github.com/ContinuumIO/datashape";
-    description = "Data description language";
+    description = "A data description language";
     license = lib.licenses.bsd2;
   };
 }
 ```
 
 We can see several runtime dependencies, `numpy`, `multipledispatch`, and
-`python-dateutil`. Furthermore, we have [`nativeCheckInputs`](#var-stdenv-nativeCheckInputs) with `pytestCheckHook`.
-`pytestCheckHook` is a test runner hook and is only used during the [`checkPhase`](#ssec-check-phase) and is
+`python-dateutil`. Furthermore, we have [`nativeCheckInputs`](#var-stdenv-nativeCheckInputs) with `pytest`.
+`pytest` is a test runner and is only used during the [`checkPhase`](#ssec-check-phase) and is
 therefore not added to `dependencies`.
 
 In the previous case we had only dependencies on other Python packages to consider.
@@ -1014,6 +1031,7 @@ when building the bindings and are therefore added as [`buildInputs`](#var-stden
 , buildPythonPackage
 , fetchPypi
 , setuptools
+, wheel
 , libxml2
 , libxslt
 }:
@@ -1030,6 +1048,7 @@ buildPythonPackage rec {
 
   build-system = [
     setuptools
+    wheel
   ];
 
   buildInputs = [
@@ -1037,14 +1056,6 @@ buildPythonPackage rec {
     libxslt
   ];
 
-  # tests are meant to be ran "in-place" in the same directory as src
-  doCheck = false;
-
-  pythonImportsCheck = [
-    "lxml"
-    "lxml.etree"
-  ];
-
   meta = {
     changelog = "https://github.com/lxml/lxml/releases/tag/lxml-${version}";
     description = "Pythonic binding for the libxml2 and libxslt libraries";
@@ -1072,6 +1083,7 @@ therefore we have to set `LDFLAGS` and `CFLAGS`.
 
 # build dependencies
 , setuptools
+, wheel
 
 # dependencies
 , fftw
@@ -1082,7 +1094,7 @@ therefore we have to set `LDFLAGS` and `CFLAGS`.
 }:
 
 buildPythonPackage rec {
-  pname = "pyfftw";
+  pname = "pyFFTW";
   version = "0.9.2";
   pyproject = true;
 
@@ -1093,6 +1105,7 @@ buildPythonPackage rec {
 
   build-system = [
     setuptools
+    wheel
   ];
 
   buildInputs = [
@@ -1114,11 +1127,9 @@ buildPythonPackage rec {
   # Tests cannot import pyfftw. pyfftw works fine though.
   doCheck = false;
 
-  pythonImportsCheck = [ "pyfftw" ];
-
   meta = {
     changelog = "https://github.com/pyFFTW/pyFFTW/releases/tag/v${version}";
-    description = "Pythonic wrapper around FFTW, the FFT library, presenting a unified interface for all the supported transforms";
+    description = "A pythonic wrapper around FFTW, the FFT library, presenting a unified interface for all the supported transforms";
     homepage = "http://hgomersall.github.com/pyFFTW";
     license = with lib.licenses; [ bsd2 bsd3 ];
   };
@@ -1131,8 +1142,10 @@ Note also the line [`doCheck = false;`](#var-stdenv-doCheck), we explicitly disa
 
 It is highly encouraged to have testing as part of the package build. This
 helps to avoid situations where the package was able to build and install,
-but is not usable at runtime.
-Your package should provide its own [`checkPhase`](#ssec-check-phase).
+but is not usable at runtime. Currently, all packages will use the `test`
+command provided by the setup.py (i.e. `python setup.py test`). However,
+this is currently deprecated https://github.com/pypa/setuptools/pull/1878
+and your package should provide its own [`checkPhase`](#ssec-check-phase).
 
 ::: {.note}
 The [`checkPhase`](#ssec-check-phase) for python maps to the `installCheckPhase` on a
@@ -1203,11 +1216,9 @@ been removed, in this case, it's recommended to use `pytestCheckHook`.
 
 #### Using pytestCheckHook {#using-pytestcheckhook}
 
-`pytestCheckHook` is a convenient hook which will set up (or configure)
-a [`checkPhase`](#ssec-check-phase) to run `pytest`. This is also beneficial
+`pytestCheckHook` is a convenient hook which will substitute the setuptools
+`test` command for a [`checkPhase`](#ssec-check-phase) which runs `pytest`. This is also beneficial
 when a package may need many items disabled to run the test suite.
-Most packages use `pytest` or `unittest`, which is compatible with `pytest`,
-so you will most likely use `pytestCheckHook`.
 
 Using the example above, the analogous `pytestCheckHook` usage would be:
 
@@ -1315,6 +1326,9 @@ we can do:
 
 ```nix
 {
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+  ];
   pythonRelaxDeps = [
     "pkg1"
     "pkg3"
@@ -1337,6 +1351,7 @@ example:
 
 ```nix
 {
+  nativeBuildInputs = [ pythonRelaxDepsHook ];
   pythonRelaxDeps = true;
 }
 ```
@@ -1359,14 +1374,9 @@ Keep in mind that while the examples above are done with `requirements.txt`,
 `pythonRelaxDepsHook` works by modifying the resulting wheel file, so it should
 work with any of the [existing hooks](#setup-hooks).
 
-The `pythonRelaxDepsHook` has no effect on build time dependencies, such as
-those specified in `build-system`. If a package requires incompatible build
-time dependencies, they should be removed in `postPatch` through
-`substituteInPlace` or similar.
-
 #### Using unittestCheckHook {#using-unittestcheckhook}
 
-`unittestCheckHook` is a hook which will set up (or configure) a [`checkPhase`](#ssec-check-phase) to run `python -m unittest discover`:
+`unittestCheckHook` is a hook which will substitute the setuptools `test` command for a [`checkPhase`](#ssec-check-phase) which runs `python -m unittest discover`:
 
 ```nix
 {
@@ -1380,8 +1390,6 @@ time dependencies, they should be removed in `postPatch` through
 }
 ```
 
-`pytest` is compatible with `unittest`, so in most cases you can use `pytestCheckHook` instead.
-
 #### Using sphinxHook {#using-sphinxhook}
 
 The `sphinxHook` is a helpful tool to build documentation and manpages
@@ -1460,6 +1468,7 @@ We first create a function that builds `toolz` in `~/path/to/toolz/release.nix`
 , buildPythonPackage
 , fetchPypi
 , setuptools
+, wheel
 }:
 
 buildPythonPackage rec {
@@ -1474,6 +1483,7 @@ buildPythonPackage rec {
 
   build-system = [
     setuptools
+    wheel
   ];
 
   meta = {
@@ -1493,9 +1503,10 @@ with import <nixpkgs> {};
 
 ( let
     toolz = callPackage /path/to/toolz/release.nix {
-      buildPythonPackage = python3Packages.buildPythonPackage;
+      buildPythonPackage = python310
+Packages.buildPythonPackage;
     };
-  in python3.withPackages (ps: [
+  in python310.withPackages (ps: [
     ps.numpy
     toolz
   ])
@@ -1916,8 +1927,6 @@ because we can only provide security support for non-vendored dependencies.
 We recommend [nix-init](https://github.com/nix-community/nix-init) for creating new python packages within nixpkgs,
 as it already prefetches the source, parses dependencies for common formats and prefills most things in `meta`.
 
-See also [contributing section](#contributing).
-
 ### Are Python interpreters built deterministically? {#deterministic-builds}
 
 The Python interpreters are now built deterministically. Minor modifications had
@@ -1935,15 +1944,16 @@ Both are also exported in `nix-shell`.
 It is recommended to test packages as part of the build process.
 Source distributions (`sdist`) often include test files, but not always.
 
-The best practice today is to pass a test hook (e.g. pytestCheckHook, unittestCheckHook) into nativeCheckInputs.
-This will reconfigure the checkPhase to make use of that particular test framework.
-Occasionally packages don't make use of a common test framework, which may then require a custom checkPhase.
+By default the command `python setup.py test` is run as part of the
+[`checkPhase`](#ssec-check-phase), but often it is necessary to pass a custom [`checkPhase`](#ssec-check-phase). An
+example of such a situation is when `py.test` is used.
 
 #### Common issues {#common-issues}
 
-* Non-working tests can often be deselected. Most Python modules
-  do follow the standard test protocol where the pytest runner can be used.
-  `pytest` supports the `-k` and `--ignore` parameters to ignore test
+* Non-working tests can often be deselected. By default [`buildPythonPackage`](#buildpythonpackage-function)
+  runs `python setup.py test`. which is deprecated. Most Python modules however
+  do follow the standard test protocol where the pytest runner can be used
+  instead. `pytest` supports the `-k` and `--ignore` parameters to ignore test
   methods or classes as well as whole files. For `pytestCheckHook` these are
   conveniently exposed as `disabledTests` and `disabledTestPaths` respectively.
 
@@ -1984,25 +1994,14 @@ The following rules are desired to be respected:
 * Python applications live outside of `python-packages.nix` and are packaged
   with [`buildPythonApplication`](#buildpythonapplication-function).
 * Make sure libraries build for all Python interpreters.
-  If it fails to build on some Python versions, consider disabling them by setting `disable = pythonAtLeast "3.x"` along with a comment.
-* The two parameters, `pyproject` and `build-system` are set to avoid the legacy setuptools/distutils build.
-* Only unversioned attributes (e.g. `pydantic`, but not `pypdantic_1`) can be included in `dependencies`,
-  since due to `PYTHONPATH` limitations we can only ever support a single version for libraries
-  without running into duplicate module name conflicts.
-* The version restrictions of `dependencies` can be relaxed by [`pythonRelaxDepsHook`](#using-pythonrelaxdepshook).
-* Make sure the tests are enabled using for example [`pytestCheckHook`](#using-pytestcheckhook) and, in the case of
+* By default we enable tests. Make sure the tests are found and, in the case of
   libraries, are passing for all interpreters. If certain tests fail they can be
   disabled individually. Try to avoid disabling the tests altogether. In any
   case, when you disable tests, leave a comment explaining why.
-* `pythonImportsCheck` is set. This is still a good smoke test even if `pytestCheckHook` is set.
-* `meta.platforms` takes the default value in many cases.
-  It does not need to be set explicitly unless the package requires a specific platform.
-* The file is formatted with `nixfmt-rfc-style`.
 * Commit names of Python libraries should reflect that they are Python
   libraries, so write for example `python311Packages.numpy: 1.11 -> 1.12`.
   It is highly recommended to specify the current default version to enable
   automatic build by ofborg.
-  Note that `pythonPackages` is an alias for `python27Packages`.
 * Attribute names in `python-packages.nix` as well as `pname`s should match the
   library's name on PyPI, but be normalized according to [PEP
   0503](https://www.python.org/dev/peps/pep-0503/#normalized-names). This means
@@ -2016,8 +2015,6 @@ The following rules are desired to be respected:
 * Attribute names in `python-packages.nix` should be sorted alphanumerically to
   avoid merge conflicts and ease locating attributes.
 
-This list is useful for reviewers as well as for self-checking when submitting packages.
-
 ## Package set maintenance {#python-package-set-maintenance}
 
 The whole Python package set has a lot of packages that do not see regular

doc/languages-frameworks/rust.section.md

@@ -38,7 +38,7 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-jtBw4ahSl88L0iuCXxQgZVm1EcboWRJMNtjxLVTtzts=";
 
   meta = {
-    description = "Fast line-oriented regex search tool, similar to ag and ack";
+    description = "A fast line-oriented regex search tool, similar to ag and ack";
     homepage = "https://github.com/BurntSushi/ripgrep";
     license = lib.licenses.unlicense;
     maintainers = [];
@@ -46,16 +46,11 @@ rustPlatform.buildRustPackage rec {
 }
 ```
 
-`buildRustPackage` requires a `cargoHash` attribute, computed over all crate sources of this package.
-
-::: {.warning}
-`cargoSha256` is already deprecated, and is subject to removal in favor of
-`cargoHash` which supports [SRI](https://www.w3.org/TR/SRI/) hashes.
-
-If you are still using `cargoSha256`, you can simply replace it with
-`cargoHash` and recompute the hash, or convert the original sha256 to SRI
-hash using `nix-hash --to-sri --type sha256 "<original sha256>"`.
-:::
+`buildRustPackage` requires either a `cargoHash` (preferred) or a
+`cargoSha256` attribute, computed over all crate sources of this package.
+`cargoHash` supports [SRI](https://www.w3.org/TR/SRI/) hashes and should be
+preferred over `cargoSha256` which was used for traditional Nix SHA-256 hashes.
+For example:
 
 ```nix
 {
@@ -63,7 +58,7 @@ hash using `nix-hash --to-sri --type sha256 "<original sha256>"`.
 }
 ```
 
-Exception: If the application has cargo `git` dependencies, the `cargoHash`
+Exception: If the application has cargo `git` dependencies, the `cargoHash`/`cargoSha256`
 approach will not work, and you will need to copy the `Cargo.lock` file of the application
 to nixpkgs and continue with the next section for specifying the options of the `cargoLock`
 section.
@@ -81,6 +76,14 @@ then be taken from the failed build. A fake hash can be used for
 }
 ```
 
+For `cargoSha256` you can use:
+
+```nix
+{
+  cargoSha256 = lib.fakeSha256;
+}
+```
+
 Per the instructions in the [Cargo Book](https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html)
 best practices guide, Rust applications should always commit the `Cargo.lock`
 file in git to ensure a reproducible build. However, a few packages do not, and
@@ -95,7 +98,7 @@ directory into a tar.gz archive.
 The tarball with vendored dependencies contains a directory with the
 package's `name`, which is normally composed of `pname` and
 `version`. This means that the vendored dependencies hash
-(`cargoHash`) is dependent on the package name and
+(`cargoHash`/`cargoSha256`) is dependent on the package name and
 version. The `cargoDepsName` attribute can be used to use another name
 for the directory of vendored dependencies. For example, the hash can
 be made invariant to the version by setting `cargoDepsName` to
@@ -120,7 +123,7 @@ rustPlatform.buildRustPackage rec {
 
 ### Importing a `Cargo.lock` file {#importing-a-cargo.lock-file}
 
-Using a vendored hash (`cargoHash`) is tedious when using
+Using a vendored hash (`cargoHash`/`cargoSha256`) is tedious when using
 `buildRustPackage` within a project, since it requires that the hash
 is updated after every change to `Cargo.lock`. Therefore,
 `buildRustPackage` also supports vendoring dependencies directly from
@@ -251,7 +254,7 @@ By default, it takes the `stdenv.hostPlatform.config` and replaces components
 where they are known to differ. But there are ways to customize the argument:
 
  - To choose a different target by name, define
-   `stdenv.hostPlatform.rust.rustcTarget` as that name (a string), and that
+   `stdenv.hostPlatform.rustc.config` as that name (a string), and that
    name will be used instead.
 
    For example:
@@ -259,7 +262,7 @@ where they are known to differ. But there are ways to customize the argument:
    ```nix
    import <nixpkgs> {
      crossSystem = (import <nixpkgs/lib>).systems.examples.armhf-embedded // {
-       rust.rustcTarget = "thumbv7em-none-eabi";
+       rustc.config = "thumbv7em-none-eabi";
      };
    }
    ```
@@ -271,10 +274,10 @@ where they are known to differ. But there are ways to customize the argument:
    ```
 
  - To pass a completely custom target, define
-   `stdenv.hostPlatform.rust.rustcTarget` with its name, and
-   `stdenv.hostPlatform.rust.platform` with the value.  The value will be
+   `stdenv.hostPlatform.rustc.config` with its name, and
+   `stdenv.hostPlatform.rustc.platform` with the value.  The value will be
    serialized to JSON in a file called
-   `${stdenv.hostPlatform.rust.rustcTarget}.json`, and the path of that file
+   `${stdenv.hostPlatform.rustc.config}.json`, and the path of that file
    will be used instead.
 
    For example:
@@ -282,8 +285,8 @@ where they are known to differ. But there are ways to customize the argument:
    ```nix
    import <nixpkgs> {
      crossSystem = (import <nixpkgs/lib>).systems.examples.armhf-embedded // {
-       rust.rustcTarget = "thumb-crazy";
-       rust.platform = { foo = ""; bar = ""; };
+       rustc.config = "thumb-crazy";
+       rustc.platform = { foo = ""; bar = ""; };
      };
    }
    ```
@@ -997,7 +1000,7 @@ rustPlatform.buildRustPackage rec {
   doCheck = false;
 
   meta = {
-    description = "Fast line-oriented regex search tool, similar to ag and ack";
+    description = "A fast line-oriented regex search tool, similar to ag and ack";
     homepage = "https://github.com/BurntSushi/ripgrep";
     license = with lib.licenses; [ mit unlicense ];
     maintainers = with lib.maintainers; [];

doc/languages-frameworks/scheme.section.md

@@ -1,35 +0,0 @@
-# Scheme {#sec-scheme}
-
-## Package Management {#sec-scheme-package-management}
-
-### Akku {#sec-scheme-package-management-akku}
-
-About two hundred R6RS & R7RS libraries from [Akku](https://akkuscm.org/)
-(which also mirrors [snow-fort](https://snow-fort.org/pkg))
-are available inside the `akkuPackages` attrset, and the Akku executable
-itself is at the top level as `akku`. The packages could be used
-in a derivation's `buildInputs`, work inside of `nix-shell`, and
-are tested using [Chez](https://www.scheme.com/) &
-[Chibi](https://synthcode.com/wiki/chibi-scheme)
-Scheme during build time.
-
-Including a package as a build input is done in the typical Nix fashion.
-For example, to include
-[a bunch of SRFIs](https://akkuscm.org/packages/chez-srfi/)
-primarily for Chez Scheme in a derivation, one might write:
-
-```nix
-{
-  buildInputs = [
-    chez
-    akkuPackages.chez-srfi
-  ];
-}
-
-```
-
-The package index is located in `pkgs/tools/package-management/akku`
-as `deps.toml`, and should be updated occasionally by running `./update.sh`
-in the directory. Doing so will pull the source URLs for new packages and
-more recent versions, then write them to the TOML.
-

doc/languages-frameworks/texlive.section.md

@@ -83,13 +83,12 @@ Release 23.11 ships with a new interface that will eventually replace `texlive.c
   ```nix
   stdenvNoCC.mkDerivation rec {
     src = texlive.pkgs.iwona;
-    dontUnpack = true;
 
     inherit (src) pname version;
 
     installPhase = ''
       runHook preInstall
-      install -Dm644 $src/fonts/opentype/nowacki/iwona/*.otf -t $out/share/fonts/opentype
+      install -Dm644 fonts/opentype/nowacki/iwona/*.otf -t $out/share/fonts/opentype
       runHook postInstall
     '';
   }
@@ -183,7 +182,7 @@ let
     '';
 
     meta = {
-      description = "LaTeX2e class for overhead transparencies";
+      description = "A LaTeX2e class for overhead transparencies";
       license = lib.licenses.unfreeRedistributable;
       maintainers = with lib.maintainers; [ veprbl ];
       platforms = lib.platforms.all;

doc/languages-frameworks/vim.section.md

@@ -214,7 +214,7 @@ Note: this is not possible anymore for Neovim.
 
 Nix expressions for Vim plugins are stored in [pkgs/applications/editors/vim/plugins](https://github.com/NixOS/nixpkgs/tree/master/pkgs/applications/editors/vim/plugins). For the vast majority of plugins, Nix expressions are automatically generated by running [`nix-shell -p vimPluginsUpdater --run vim-plugins-updater`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/updater.nix). This creates a [generated.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/generated.nix) file based on the plugins listed in [vim-plugin-names](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/vim-plugin-names).
 
-When the vim updater detects an nvim-treesitter update, it also runs [`nvim-treesitter/update.py $(nix-build -A vimPlugins.nvim-treesitter)`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/update.py) to update the tree sitter grammars for `nvim-treesitter`.
+After running the updater, if nvim-treesitter received an update, also run [`nvim-treesitter/update.py`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/update.py) to update the tree sitter grammars for `nvim-treesitter`.
 
 Some plugins require overrides in order to function properly. Overrides are placed in [overrides.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/overrides.nix). Overrides are most often required when a plugin requires some dependencies, or extra steps are required during the build process. For example `deoplete-fish` requires both `deoplete-nvim` and `vim-fish`, and so the following override was added:
 
@@ -226,18 +226,18 @@ Some plugins require overrides in order to function properly. Overrides are plac
 }
 ```
 
-Sometimes plugins require an override that must be changed when the plugin is updated. This can cause issues when Vim plugins are auto-updated but the associated override isn't updated. For these plugins, the override should be written so that it specifies all information required to install the plugin, and running `nix-shell -p vimPluginsUpdater --run vim-plugins-updater` doesn't change the derivation for the plugin. Manually updating the override is required to update these types of plugins. An example of such a plugin is `LanguageClient-neovim`.
+Sometimes plugins require an override that must be changed when the plugin is updated. This can cause issues when Vim plugins are auto-updated but the associated override isn't updated. For these plugins, the override should be written so that it specifies all information required to install the plugin, and running `./update.py` doesn't change the derivation for the plugin. Manually updating the override is required to update these types of plugins. An example of such a plugin is `LanguageClient-neovim`.
 
-To add a new plugin, run `nix-shell -p vimPluginsUpdater --run 'vim-plugins-updater add "[owner]/[name]"'`. **NOTE**: This script automatically commits to your git repository. Be sure to check out a fresh branch before running.
+To add a new plugin, run `./update.py add "[owner]/[name]"`. **NOTE**: This script automatically commits to your git repository. Be sure to check out a fresh branch before running.
 
-Finally, there are some plugins that are also packaged in nodePackages because they have Javascript-related build steps, such as running webpack. Those plugins are not listed in `vim-plugin-names` or managed by `vimPluginsUpdater` at all, and are included separately in `overrides.nix`. Currently, all these plugins are related to the `coc.nvim` ecosystem of the Language Server Protocol integration with Vim/Neovim.
+Finally, there are some plugins that are also packaged in nodePackages because they have Javascript-related build steps, such as running webpack. Those plugins are not listed in `vim-plugin-names` or managed by `update.py` at all, and are included separately in `overrides.nix`. Currently, all these plugins are related to the `coc.nvim` ecosystem of the Language Server Protocol integration with Vim/Neovim.
 
 ## Updating plugins in nixpkgs {#updating-plugins-in-nixpkgs}
 
 Run the update script with a GitHub API token that has at least `public_repo` access. Running the script without the token is likely to result in rate-limiting (429 errors). For steps on creating an API token, please refer to [GitHub's token documentation](https://docs.github.com/en/free-pro-team@latest/github/authenticating-to-github/creating-a-personal-access-token).
 
 ```sh
-nix-shell -p vimPluginsUpdater --run 'vim-plugins-updater --github-token=mytoken' # or set GITHUB_API_TOKEN environment variable
+GITHUB_API_TOKEN=my_token ./pkgs/applications/editors/vim/plugins/update.py
 ```
 
 Alternatively, set the number of processes to a lower count to avoid rate-limiting.

doc/manual.md.in

@@ -12,5 +12,4 @@ stdenv.md
 build-helpers.md
 development.md
 contributing.md
-interoperability.md
 ```

doc/packages/ibus.section.md

@@ -11,8 +11,7 @@ On NixOS, you need to explicitly enable `ibus` with given engines before customi
 ```nix
 { pkgs, ... }: {
   i18n.inputMethod = {
-    enable = true;
-    type = "ibus";
+    enabled = "ibus";
     ibus.engines = with pkgs.ibus-engines; [ typing-booster ];
   };
 }

doc/packages/index.md

@@ -24,7 +24,6 @@ shell-helpers.section.md
 steam.section.md
 cataclysm-dda.section.md
 urxvt.section.md
-vcpkg.section.md
 weechat.section.md
 xorg.section.md
 ```

doc/packages/linux.section.md

@@ -40,29 +40,31 @@ pkgs.linux_latest.override {
 ## Manual kernel configuration {#sec-manual-kernel-configuration}
 
 Sometimes it may not be desirable to use kernels built with `pkgs.buildLinux`, especially if most of the common configuration has to be altered or disabled to achieve a kernel as expected by the target use case.
-An example of this is building a kernel for use in a VM or micro VM. You can use `pkgs.linuxPackages_custom` in these cases. It requires the `src`, `version`, and `configfile` attributes to be specified.
+An example of this is building a kernel for use in a VM or micro VM. You can use `pkgs.linuxManualConfig` in these cases. It requires the `src`, `version`, and `configfile` attributes to be specified.
 
 :::{.example #ex-using-linux-manual-config}
 
-# Using `pkgs.linuxPackages_custom` with a specific source, version, and config file
+# Using `pkgs.linuxManualConfig` with a specific source, version, and config file
 
 ```nix
-{ pkgs, ... }:
-pkgs.linuxPackages_custom {
+{ pkgs, ... }: {
   version = "6.1.55";
   src = pkgs.fetchurl {
     url = "https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-${version}.tar.xz";
     hash = "sha256:1h0mzx52q9pvdv7rhnvb8g68i7bnlc9rf8gy9qn4alsxq4g28zm8";
   };
   configfile = ./path_to_config_file;
+  linux = pkgs.linuxManualConfig {
+    inherit version src configfile;
+    allowImportFromDerivation = true;
+  };
 }
 ```
 
 If necessary, the version string can be slightly modified to explicitly mark it as a custom version. If you do so, ensure the `modDirVersion` attribute matches the source's version, otherwise the build will fail.
 
 ```nix
-{ pkgs, ... }:
-pkgs.linuxPackages_custom {
+{ pkgs, ... }: {
   version = "6.1.55-custom";
   modDirVersion = "6.1.55";
   src = pkgs.fetchurl {
@@ -70,12 +72,16 @@ pkgs.linuxPackages_custom {
     hash = "sha256:1h0mzx52q9pvdv7rhnvb8g68i7bnlc9rf8gy9qn4alsxq4g28zm8";
   };
   configfile = ./path_to_config_file;
+  linux = pkgs.linuxManualConfig {
+    inherit version modDirVersion src configfile;
+    allowImportFromDerivation = true;
+  };
 }
 ```
 
 :::
 
-Additional attributes can be used with `linuxManualConfig` for further customisation instead of `linuxPackages_custom`. You're encouraged to read [the `pkgs.linuxManualConfig` source code](https://github.com/NixOS/nixpkgs/blob/d77bda728d5041c1294a68fb25c79e2d161f62b9/pkgs/os-specific/linux/kernel/manual-config.nix) to understand how to use them.
+Additional attributes can be used with `linuxManualConfig` for further customisation. You're encouraged to read [the `pkgs.linuxManualConfig` source code](https://github.com/NixOS/nixpkgs/blob/d77bda728d5041c1294a68fb25c79e2d161f62b9/pkgs/os-specific/linux/kernel/manual-config.nix) to understand how to use them.
 
 To edit the `.config` file for Linux X.Y from within Nix, proceed as follows:
 

doc/packages/steam.section.md

@@ -40,6 +40,20 @@ Use `programs.steam.enable = true;` if you want to add steam to `systemPackages`
 
     have a look at [this pull request](https://github.com/NixOS/nixpkgs/pull/20269).
 
+- **Java**
+
+  1. There is no java in steam chrootenv by default. If you get a message like:
+
+    ```
+    /home/foo/.local/share/Steam/SteamApps/common/towns/towns.sh: line 1: java: command not found
+    ```
+
+    you need to add:
+
+    ```nix
+    steam.override { withJava = true; }
+    ```
+
 ## steam-run {#sec-steam-run}
 
 The FHS-compatible chroot used for Steam can also be used to run other Linux games that expect a FHS environment. To use it, install the `steam-run` package and run the game with:

doc/packages/vcpkg.section.md

@@ -1,24 +0,0 @@
-# VCPKG {#sec-vcpkg}
-
-The `vcpkg-tool` package  has a wrapper around the `vcpkg` executable to avoid writing to the nix store.
-The wrapper will also be present in `vcpkg`, unless you specify `vcpkg.override { vcpkg-tool = vcpkg-tool-unwrapped; }`
-
-The wrapper has been made in a way so that it will provide default cli arguments, but tries not to interfere if the user provides the same arguments.
-The arguments also have corresponding environment variables that can be used as an alternative way of overriding these paths.
-
-Run the wrapper with the environment variable `NIX_VCPKG_DEBUG_PRINT_ENVVARS=true` to get a full list of corresponding environment variables.
-
-## Nix specific environment variables {#sec-vcpkg-nix-envvars}
-
-The wrapper also provides some new nix-specific environment variables that lets you control some of the wrapper functionality.
-
-- `NIX_VCPKG_WRITABLE_PATH = <path>`
-
-   Set this environment variable to specify the path where `vcpkg` will store buildtime artifacts.
-   This will become the base path for all of the other paths.
-
-- `NIX_VCPKG_DEBUG_PRINT_ENVVARS = true | false`
-
-   Set this to `true` for the wrapper to print the corresponding environment variables for the arguments that will be provided to the unwrapped executable.
-   The list of variables will be printed right before invoking `vcpkg`.
-   This can be useful if you suspect that the wrapper for some reason was unable to prioritize user-provided cli args over its default ones, or for fixing other issues like typos or unexpanded environment variables.

doc/shell.nix

@@ -1,7 +1,20 @@
 let
   pkgs = import ../. {
-    config = { };
-    overlays = [ ];
+    config = {};
+    overlays = [];
+  };
+
+  common = import ./common.nix;
+  inherit (common) outputPath indexPath;
+
+  web-devmode = import ../pkgs/tools/nix/web-devmode.nix {
+    inherit pkgs;
+    buildArgs = "./.";
+    open = "/${outputPath}/${indexPath}";
   };
 in
-pkgs.nixpkgs-manual.shell
+  pkgs.mkShell {
+    packages = [
+      web-devmode
+    ];
+  }

doc/stdenv.md

@@ -3,7 +3,6 @@
 ```{=include=} chapters
 stdenv/stdenv.chapter.md
 stdenv/meta.chapter.md
-stdenv/passthru.chapter.md
 stdenv/multiple-output.chapter.md
 stdenv/cross-compilation.chapter.md
 stdenv/platform-notes.chapter.md

doc/stdenv/meta.chapter.md

@@ -5,7 +5,7 @@ Nix packages can declare *meta-attributes* that contain information about a pack
 ```nix
 {
   meta = {
-    description = "Program that produces a familiar, friendly greeting";
+    description = "A program that produces a familiar, friendly greeting";
     longDescription = ''
       GNU Hello is a program that prints "Hello, world!" when you run it.
       It is fully customizable.
@@ -22,10 +22,6 @@ Meta-attributes are not passed to the builder of the package. Thus, a change to
 
 ## Standard meta-attributes {#sec-standard-meta-attributes}
 
-If the package is to be submitted to Nixpkgs, please check out the
-[requirements for meta attributes](https://github.com/NixOS/nixpkgs/tree/master/pkgs#meta-attributes)
-in the contributing documentation.
-
 It is expected that each meta-attribute is one of the following:
 
 ### `description` {#var-meta-description}
@@ -33,21 +29,11 @@ It is expected that each meta-attribute is one of the following:
 A short (one-line) description of the package.
 This is displayed on [search.nixos.org](https://search.nixos.org/packages).
 
-The general requirements of a description are:
-
-- Be short, just one sentence.
-- Be capitalized.
-- Not start with definite ("The") or indefinite ("A"/"An") article.
-- Not start with the package name.
-  - More generally, it should not refer to the package name.
-- Not end with a period (or any punctuation for that matter).
-- Provide factual information.
-  - Avoid subjective language.
-
+Don’t include a period at the end. Don’t include newline characters. Capitalise the first character. For brevity, don’t repeat the name of package --- just describe what it does.
 
 Wrong: `"libpng is a library that allows you to decode PNG images."`
 
-Right: `"Library for decoding PNG images"`
+Right: `"A library for decoding PNG images"`
 
 ### `longDescription` {#var-meta-longDescription}
 
@@ -81,12 +67,6 @@ The license, or licenses, for the package. One from the attribute set defined in
 
 For details, see [Licenses](#sec-meta-license).
 
-### `sourceProvenance` {#var-meta-sourceProvenance}
-
-A list containing the type or types of source inputs from which the package is built, e.g. original source code, pre-built binaries, etc.
-
-For details, see [Source provenance](#sec-meta-sourceProvenance).
-
 ### `maintainers` {#var-meta-maintainers}
 
 A list of the maintainers of this Nix expression. Maintainers are defined in [`nixpkgs/maintainers/maintainer-list.nix`](https://github.com/NixOS/nixpkgs/blob/master/maintainers/maintainer-list.nix). There is no restriction to becoming a maintainer, just add yourself to that list in a separate commit titled “maintainers: add alice” in the same pull request, and reference maintainers with `maintainers = with lib.maintainers; [ alice bob ]`.
@@ -130,6 +110,83 @@ Some packages use this to automatically detect the maximum set of features with
 For example, `systemd` [requires dynamic linking](https://github.com/systemd/systemd/issues/20600#issuecomment-912338965), and [has a `meta.badPlatforms` setting](https://github.com/NixOS/nixpkgs/blob/b03ac42b0734da3e7be9bf8d94433a5195734b19/pkgs/os-specific/linux/systemd/default.nix#L752) similar to the one above.
 Packages which can be built with or without `systemd` support will use `lib.meta.availableOn` to detect whether or not `systemd` is available on the [`hostPlatform`](#ssec-cross-platform-parameters) for which they are being built; if it is not available (e.g. due to a statically-linked host platform like `pkgsStatic`) this support will be disabled by default.
 
+### `tests` {#var-meta-tests}
+
+::: {.warning}
+This attribute is special in that it is not actually under the `meta` attribute set but rather under the `passthru` attribute set. This is due to how `meta` attributes work, and the fact that they are supposed to contain only metadata, not derivations.
+:::
+
+An attribute set with tests as values. A test is a derivation that builds when the test passes and fails to build otherwise.
+
+You can run these tests with:
+
+```ShellSession
+$ cd path/to/nixpkgs
+$ nix-build -A your-package.tests
+```
+
+#### Package tests {#var-meta-tests-packages}
+
+Tests that are part of the source package are often executed in the `installCheckPhase`.
+
+Prefer `passthru.tests` for tests that are introduced in nixpkgs because:
+
+* `passthru.tests` tests the 'real' package, independently from the environment in which it was built
+* we can run `passthru.tests` independently
+* `installCheckPhase` adds overhead to each build
+
+For more on how to write and run package tests, see [](#sec-package-tests).
+
+#### NixOS tests {#var-meta-tests-nixos}
+
+The NixOS tests are available as `nixosTests` in parameters of derivations. For instance, the OpenSMTPD derivation includes lines similar to:
+
+```nix
+{ /* ... , */ nixosTests }:
+{
+  # ...
+  passthru.tests = {
+    basic-functionality-and-dovecot-integration = nixosTests.opensmtpd;
+  };
+}
+```
+
+NixOS tests run in a VM, so they are slower than regular package tests. For more information see [NixOS module tests](https://nixos.org/manual/nixos/stable/#sec-nixos-tests).
+
+Alternatively, you can specify other derivations as tests. You can make use of
+the optional parameter to inject the correct package without
+relying on non-local definitions, even in the presence of `overrideAttrs`.
+Here that's `finalAttrs.finalPackage`, but you could choose a different name if
+`finalAttrs` already exists in your scope.
+
+`(mypkg.overrideAttrs f).passthru.tests` will be as expected, as long as the
+definition of `tests` does not rely on the original `mypkg` or overrides it in
+all places.
+
+```nix
+# my-package/default.nix
+{ stdenv, callPackage }:
+stdenv.mkDerivation (finalAttrs: {
+  # ...
+  passthru.tests.example = callPackage ./example.nix { my-package = finalAttrs.finalPackage; };
+})
+```
+
+```nix
+# my-package/example.nix
+{ runCommand, lib, my-package, ... }:
+runCommand "my-package-test" {
+  nativeBuildInputs = [ my-package ];
+  src = lib.sources.sourcesByRegex ./. [ ".*.in" ".*.expected" ];
+} ''
+  my-package --help
+  my-package <example.in >example.actual
+  diff -U3 --color=auto example.expected example.actual
+  mkdir $out
+''
+```
+
+
 ### `timeout` {#var-meta-timeout}
 
 A timeout (in seconds) for building the derivation. If the derivation takes longer than this time to build, Hydra will fail it due to breaking the timeout. However, all computers do not have the same computing power, hence some builders may decide to apply a multiplicative factor to this value. When filling this value in, try to keep it approximately consistent with other values already present in `nixpkgs`.

doc/stdenv/passthru.chapter.md

@@ -1,134 +0,0 @@
-# Passthru-attributes {#chap-passthru}
-[]{#var-stdenv-passthru} []{#special-variables} <!-- legacy anchors -->
-
-As opposed to most other `mkDerivation` input attributes, `passthru` is not passed to the derivation's [`builder` executable](https://nixos.org/manual/nix/stable/expressions/derivations.html#attr-builder).
-Changing it will not trigger a rebuild – it is "passed through".
-Its value can be accessed as if it was set inside a derivation.
-
-::: {.note}
-`passthru` attributes follow no particular schema, but there are a few [conventional patterns](#sec-common-passthru-attributes).
-:::
-
-:::{.example #ex-accessing-passthru}
-
-## Setting and accessing `passthru` attributes
-
-```nix
-{ stdenv, fetchGit }:
-let
-  hello = stdenv.mkDerivation {
-    pname = "hello";
-    src = fetchGit { /* ... */ };
-
-    passthru = {
-      foo = "bar";
-      baz = {
-        value1 = 4;
-        value2 = 5;
-      };
-    };
-  };
-in
-hello.baz.value1
-```
-
-```
-4
-```
-:::
-
-## Common `passthru`-attributes {#sec-common-passthru-attributes}
-
-Many `passthru` attributes are situational, so this section only lists recurring patterns.
-They fall in one of these categories:
-
-- Global conventions, which are applied almost universally in Nixpkgs.
-
-  Generally these don't entail any special support built into the derivation they belong to.
-  Common examples of this type are [`passthru.tests`](#var-passthru-tests) and [`passthru.updateScript`](#var-passthru-updateScript).
-
-- Conventions for adding extra functionality to a derivation.
-
-  These tend to entail support from the derivation or the `passthru` attribute in question.
-  Common examples of this type are `passthru.optional-dependencies`, `passthru.withPlugins`, and `passthru.withPackages`.
-  All of those allow associating the package with a set of components built for that specific package, such as when building Python runtime environments using (`python.withPackages`)[#python.withpackages-function].
-
-Attributes that apply only to particular [build helpers](#part-builders) or [language ecosystems](#chap-language-support) are documented there.
-
-### `passthru.tests` {#var-passthru-tests}
-[]{#var-meta-tests} <!-- legacy anchor -->
-
-An attribute set with tests as values.
-A test is a derivation that builds when the test passes and fails to build otherwise.
-
-Run these tests with:
-
-```ShellSession
-$ cd path/to/nixpkgs
-$ nix-build -A your-package.tests
-```
-
-:::{.note}
-The Nixpkgs systems for continuous integration [Hydra](https://hydra.nixos.org/) and [`nixpkgs-review`](https://github.com/Mic92/nixpkgs-review) don't build these derivations by default, and ([`@ofborg`](https://github.com/NixOS/ofborg)) only builds them when evaluating pull requests for that particular package, or when manually instructed.
-:::
-
-#### Package tests {#var-passthru-tests-packages}
-[]{#var-meta-tests-packages} <!-- legacy anchor -->
-
-Besides tests provided by upstream, that you run in the [`checkPhase`](#ssec-check-phase), you may want to define tests derivations in the `passthru.tests` attribute, which won't change the build. `passthru.tests` have several advantages over running tests during any of the [standard phases](#sec-stdenv-phases):
-
-- They access the package as consumers would, independently from the environment in which it was built
-- They can be run and debugged without rebuilding the package, which is useful if that takes a long time
-- They don't add overhead to each build, as opposed checks added to the [`distPhase`](#ssec-distribution-phase), such as [`versionCheckHook`](#versioncheckhook).
-
-It is also possible to use `passthru.tests` to test the version with [`testVersion`](#tester-testVersion), but since that is pretty trivial and recommended thing to do, we recommend using [`versionCheckHook`](#versioncheckhook) for that, which has the following advantages over `passthru.tests`:
-
-- If the `versionCheckPhase` (the phase defined by [`versionCheckHook`](#versioncheckhook)) fails, it triggers a failure which can't be ignored if you use the package, or if you find out about it in a [`nixpkgs-review`](https://github.com/Mic92/nixpkgs-review) report.
-- Sometimes packages become silently broken - meaning they fail to launch but their build passes because they don't perform any tests in the `checkPhase`. If you use this tool infrequently, such a silent breakage may rot in your system / profile configuration, and you will not notice the failure until you will want to use this package. Testing such basic functionality ensures you have to deal with the failure when you update your system / profile.
-- When you open a PR, [ofborg](https://github.com/NixOS/ofborg)'s CI _will_ run `passthru.tests` of [packages that are directly changed by your PR (according to your commits' messages)](https://github.com/NixOS/ofborg?tab=readme-ov-file#automatic-building), but if you'd want to use the [`@ofborg build`](https://github.com/NixOS/ofborg?tab=readme-ov-file#build) command for dependent packages, you won't have to specify in addition the `.tests` attribute of the packages you want to build, and no body will be able to avoid these tests.
-
-<!-- NOTE(@fricklerhandwerk): one may argue whether that testing guide should rather be in the user's manual -->
-For more on how to write and run package tests for Nixpkgs, see the [testing section in the package contributor guide](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#package-tests).
-
-#### NixOS tests {#var-passthru-tests-nixos}
-[]{#var-meta-tests-nixos} <!-- legacy anchor -->
-
-Tests written for NixOS are available as the `nixosTests` argument to package recipes.
-For instance, the [OpenSMTPD derivation](https://search.nixos.org/packages?show=opensmtpd) includes lines similar to:
-
-```nix
-{ nixosTests, ... }:
-{
-  # ...
-  passthru.tests = {
-    basic-functionality-and-dovecot-integration = nixosTests.opensmtpd;
-  };
-}
-```
-
-NixOS tests run in a virtual machine (VM), so they are slower than regular package tests.
-For more information see the NixOS manual on [NixOS module tests](https://nixos.org/manual/nixos/stable/#sec-nixos-tests).
-
-### `passthru.updateScript` {#var-passthru-updateScript}
-<!-- legacy anchors -->
-[]{#var-passthru-updateScript-command}
-[]{#var-passthru-updateScript-set-command}
-[]{#var-passthru-updateScript-set-attrPath}
-[]{#var-passthru-updateScript-set-supportedFeatures}
-[]{#var-passthru-updateScript-env-UPDATE_NIX_NAME}
-[]{#var-passthru-updateScript-env-UPDATE_NIX_PNAME}
-[]{#var-passthru-updateScript-env-UPDATE_NIX_OLD_VERSION}
-[]{#var-passthru-updateScript-env-UPDATE_NIX_ATTR_PATH}
-[]{#var-passthru-updateScript-execution}
-[]{#var-passthru-updateScript-supported-features}
-[]{#var-passthru-updateScript-commit}
-[]{#var-passthru-updateScript-commit-attrPath}
-[]{#var-passthru-updateScript-commit-oldVersion}
-[]{#var-passthru-updateScript-commit-newVersion}
-[]{#var-passthru-updateScript-commit-files}
-[]{#var-passthru-updateScript-commit-commitBody}
-[]{#var-passthru-updateScript-commit-commitMessage}
-[]{#var-passthru-updateScript-example-commit}
-
-Nixpkgs tries to automatically update all packages that have an `passthru.updateScript` attribute.
-See the [section on automatic package updates in the package contributor guide](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#automatic-package-updates) for details.

doc/stdenv/stdenv.chapter.md

@@ -442,6 +442,145 @@ If set to `true`, `stdenv` will pass specific flags to `make` and other build to
 
 Unless set to `false`, some build systems with good support for parallel building including `cmake`, `meson`, and `qmake` will set it to `true`.
 
+### Special variables {#special-variables}
+
+#### `passthru` {#var-stdenv-passthru}
+
+This is an attribute set which can be filled with arbitrary values. For example:
+
+```nix
+{
+  passthru = {
+    foo = "bar";
+    baz = {
+      value1 = 4;
+      value2 = 5;
+    };
+  };
+}
+```
+
+Values inside it are not passed to the builder, so you can change them without triggering a rebuild. However, they can be accessed outside of a derivation directly, as if they were set inside a derivation itself, e.g. `hello.baz.value1`. We don’t specify any usage or schema of `passthru` - it is meant for values that would be useful outside the derivation in other parts of a Nix expression (e.g. in other derivations). An example would be to convey some specific dependency of your derivation which contains a program with plugins support. Later, others who make derivations with plugins can use passed-through dependency to ensure that their plugin would be binary-compatible with built program.
+
+#### `passthru.updateScript` {#var-passthru-updateScript}
+
+A script to be run by `maintainers/scripts/update.nix` when the package is matched. The attribute can contain one of the following:
+
+- []{#var-passthru-updateScript-command} an executable file, either on the file system:
+
+  ```nix
+  {
+    passthru.updateScript = ./update.sh;
+  }
+  ```
+
+  or inside the expression itself:
+
+  ```nix
+  {
+    passthru.updateScript = writeScript "update-zoom-us" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p curl pcre2 common-updater-scripts
+
+      set -eu -o pipefail
+
+      version="$(curl -sI https://zoom.us/client/latest/zoom_x86_64.tar.xz | grep -Fi 'Location:' | pcre2grep -o1 '/(([0-9]\.?)+)/')"
+      update-source-version zoom-us "$version"
+    '';
+  }
+  ```
+
+- a list, a script followed by arguments to be passed to it:
+
+  ```nix
+  {
+    passthru.updateScript = [ ../../update.sh pname "--requested-release=unstable" ];
+  }
+  ```
+
+- an attribute set containing:
+  - [`command`]{#var-passthru-updateScript-set-command} – a string or list in the [format expected by `passthru.updateScript`](#var-passthru-updateScript-command).
+  - [`attrPath`]{#var-passthru-updateScript-set-attrPath} (optional) – a string containing the canonical attribute path for the package. If present, it will be passed to the update script instead of the attribute path on which the package was discovered during Nixpkgs traversal.
+  - [`supportedFeatures`]{#var-passthru-updateScript-set-supportedFeatures} (optional) – a list of the [extra features](#var-passthru-updateScript-supported-features) the script supports.
+
+  ```nix
+  {
+    passthru.updateScript = {
+      command = [ ../../update.sh pname ];
+      attrPath = pname;
+      supportedFeatures = [ /* ... */ ];
+    };
+  }
+  ```
+
+::: {.tip}
+A common pattern is to use the [`nix-update-script`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/common-updater/nix-update.nix) attribute provided in Nixpkgs, which runs [`nix-update`](https://github.com/Mic92/nix-update):
+
+```nix
+{
+  passthru.updateScript = nix-update-script { };
+}
+```
+
+For simple packages, this is often enough, and will ensure that the package is updated automatically by [`nixpkgs-update`](https://ryantm.github.io/nixpkgs-update) when a new version is released. The [update bot](https://nix-community.org/update-bot) runs periodically to attempt to automatically update packages, and will run `passthru.updateScript` if set. While not strictly necessary if the project is listed on [Repology](https://repology.org), using `nix-update-script` allows the package to update via many more sources (e.g. GitHub releases).
+:::
+
+##### How update scripts are executed? {#var-passthru-updateScript-execution}
+
+Update scripts are to be invoked by `maintainers/scripts/update.nix` script. You can run `nix-shell maintainers/scripts/update.nix` in the root of Nixpkgs repository for information on how to use it. `update.nix` offers several modes for selecting packages to update (e.g. select by attribute path, traverse Nixpkgs and filter by maintainer, etc.), and it will execute update scripts for all matched packages that have an `updateScript` attribute.
+
+Each update script will be passed the following environment variables:
+
+- [`UPDATE_NIX_NAME`]{#var-passthru-updateScript-env-UPDATE_NIX_NAME} – content of the `name` attribute of the updated package.
+- [`UPDATE_NIX_PNAME`]{#var-passthru-updateScript-env-UPDATE_NIX_PNAME} – content of the `pname` attribute of the updated package.
+- [`UPDATE_NIX_OLD_VERSION`]{#var-passthru-updateScript-env-UPDATE_NIX_OLD_VERSION} – content of the `version` attribute of the updated package.
+- [`UPDATE_NIX_ATTR_PATH`]{#var-passthru-updateScript-env-UPDATE_NIX_ATTR_PATH} – attribute path the `update.nix` discovered the package on (or the [canonical `attrPath`](#var-passthru-updateScript-set-attrPath) when available). Example: `pantheon.elementary-terminal`
+
+::: {.note}
+An update script will be usually run from the root of the Nixpkgs repository but you should not rely on that. Also note that `update.nix` executes update scripts in parallel by default so you should avoid running `git commit` or any other commands that cannot handle that.
+:::
+
+::: {.tip}
+While update scripts should not create commits themselves, `maintainers/scripts/update.nix` supports automatically creating commits when running it with `--argstr commit true`. If you need to customize commit message, you can have the update script implement [`commit`](#var-passthru-updateScript-commit) feature.
+:::
+
+##### Supported features {#var-passthru-updateScript-supported-features}
+###### `commit` {#var-passthru-updateScript-commit}
+
+This feature allows update scripts to *ask* `update.nix` to create Git commits.
+
+When support of this feature is declared, whenever the update script exits with `0` return status, it is expected to print a JSON list containing an object described below for each updated attribute to standard output.
+
+When `update.nix` is run with `--argstr commit true` arguments, it will create a separate commit for each of the objects. An empty list can be returned when the script did not update any files, for example, when the package is already at the latest version.
+
+The commit object contains the following values:
+
+- [`attrPath`]{#var-passthru-updateScript-commit-attrPath} – a string containing attribute path.
+- [`oldVersion`]{#var-passthru-updateScript-commit-oldVersion} – a string containing old version.
+- [`newVersion`]{#var-passthru-updateScript-commit-newVersion} – a string containing new version.
+- [`files`]{#var-passthru-updateScript-commit-files} – a non-empty list of file paths (as strings) to add to the commit.
+- [`commitBody`]{#var-passthru-updateScript-commit-commitBody} (optional) – a string with extra content to be appended to the default commit message (useful for adding changelog links).
+- [`commitMessage`]{#var-passthru-updateScript-commit-commitMessage} (optional) – a string to use instead of the default commit message.
+
+If the returned array contains exactly one object (e.g. `[{}]`), all values are optional and will be determined automatically.
+
+::: {.example #var-passthru-updateScript-example-commit}
+# Standard output of an update script using commit feature
+
+```json
+[
+  {
+    "attrPath": "volume_key",
+    "oldVersion": "0.3.11",
+    "newVersion": "0.3.12",
+    "files": [
+      "/path/to/nixpkgs/pkgs/development/libraries/volume-key/default.nix"
+    ]
+  }
+]
+```
+:::
+
 ### Fixed-point arguments of `mkDerivation` {#mkderivation-recursive-attributes}
 
 If you pass a function to `mkDerivation`, it will receive as its argument the final arguments, including the overrides when reinvoked via `overrideAttrs`. For example:
@@ -494,7 +633,7 @@ in pkg
 
 Unlike the `pkg` binding in the above example, the `finalAttrs` parameter always references the final attributes. For instance `(pkg.overrideAttrs(x)).finalAttrs.finalPackage` is identical to `pkg.overrideAttrs(x)`, whereas `(pkg.overrideAttrs(x)).original` is the same as the original `pkg`.
 
-See also the section about [`passthru.tests`](#var-passthru-tests).
+See also the section about [`passthru.tests`](#var-meta-tests).
 
 ## Phases {#sec-stdenv-phases}
 
@@ -762,8 +901,6 @@ Before and after running `make`, the hooks `preBuild` and `postBuild` are called
 
 The check phase checks whether the package was built correctly by running its test suite. The default `checkPhase` calls `make $checkTarget`, but only if the [`doCheck` variable](#var-stdenv-doCheck) is enabled.
 
-It is highly recommended, for packages' sources that are not distributed with any tests, to at least use [`versionCheckHook`](#versioncheckhook) to test that the resulting executable is basically functional.
-
 #### Variables controlling the check phase {#variables-controlling-the-check-phase}
 
 ##### `doCheck` {#var-stdenv-doCheck}
@@ -1008,7 +1145,7 @@ This setup works as follows:
 The installCheck phase checks whether the package was installed correctly by running its test suite against the installed directories. The default `installCheck` calls `make installcheck`.
 
 It is often better to add tests that are not part of the source distribution to `passthru.tests` (see
-[](#var-passthru-tests)). This avoids adding overhead to every build and enables us to run them independently.
+[](#var-meta-tests)). This avoids adding overhead to every build and enables us to run them independently.
 
 #### Variables controlling the installCheck phase {#variables-controlling-the-installcheck-phase}
 
@@ -1421,8 +1558,6 @@ Both parameters take a list of flags as strings. The special `"all"` flag can be
 
 For more in-depth information on these hardening flags and hardening in general, refer to the [Debian Wiki](https://wiki.debian.org/Hardening), [Ubuntu Wiki](https://wiki.ubuntu.com/Security/Features), [Gentoo Wiki](https://wiki.gentoo.org/wiki/Project:Hardened), and the [Arch Wiki](https://wiki.archlinux.org/title/Security).
 
-Note that support for some hardening flags varies by compiler, CPU architecture, target OS and libc. Combinations of these that don't support a particular hardening flag will silently ignore attempts to enable it. To see exactly which hardening flags are being employed in any invocation, the `NIX_DEBUG` environment variable can be used.
-
 ### Hardening flags enabled by default {#sec-hardening-flags-enabled-by-default}
 
 The following flags are enabled by default and might require disabling with `hardeningDisable` if the program to package is incompatible.
@@ -1472,16 +1607,6 @@ installwatch.c:3751:5: error: conflicting types for '__open_2'
 fcntl2.h:50:4: error: call to '__open_missing_mode' declared with attribute error: open with O_CREAT or O_TMPFILE in second argument needs 3 arguments
 ```
 
-Disabling `fortify` implies disablement of `fortify3`
-
-#### `fortify3` {#fortify3}
-
-Adds the `-O2 -D_FORTIFY_SOURCE=3` compiler options. This expands the cases that can be protected by fortify-checks to include some situations with dynamic-length buffers whose length can be inferred at runtime using compiler hints.
-
-Enabling this flag implies enablement of `fortify`. Disabling this flag does not imply disablement of `fortify`.
-
-This flag can sometimes conflict with a build-system's own attempts at enabling fortify support and result in errors complaining about `redefinition of _FORTIFY_SOURCE`.
-
 #### `pic` {#pic}
 
 Adds the `-fPIC` compiler options. This options adds support for position independent code in shared libraries and thus making ASLR possible.
@@ -1517,43 +1642,19 @@ This flag can break dynamic shared object loading. For instance, the module syst
 intel_drv.so: undefined symbol: vgaHWFreeHWRec
 ```
 
-#### `zerocallusedregs` {#zerocallusedregs}
-
-Adds the `-fzero-call-used-regs=used-gpr` compiler option. This causes the general-purpose registers that an architecture's calling convention considers "call-used" to be zeroed on return from the function. This can make it harder for attackers to construct useful ROP gadgets and also reduces the chance of data leakage from a function call.
-
 ### Hardening flags disabled by default {#sec-hardening-flags-disabled-by-default}
 
 The following flags are disabled by default and should be enabled with `hardeningEnable` for packages that take untrusted input like network services.
 
 #### `pie` {#pie}
 
-This flag is disabled by default for normal `glibc` based NixOS package builds, but enabled by default for
-
-  - `musl`-based package builds, except on Aarch64 and Aarch32, where there are issues.
-
-  - Statically-linked for OpenBSD builds, where it appears to be required to get a working binary.
+This flag is disabled by default for normal `glibc` based NixOS package builds, but enabled by default for `musl` based package builds.
 
 Adds the `-fPIE` compiler and `-pie` linker options. Position Independent Executables are needed to take advantage of Address Space Layout Randomization, supported by modern kernel versions. While ASLR can already be enforced for data areas in the stack and heap (brk and mmap), the code areas must be compiled as position-independent. Shared libraries already do this with the `pic` flag, so they gain ASLR automatically, but binary .text regions need to be build with `pie` to gain ASLR. When this happens, ROP attacks are much harder since there are no static locations to bounce off of during a memory corruption attack.
 
 Static libraries need to be compiled with `-fPIE` so that executables can link them in with the `-pie` linker option.
 If the libraries lack `-fPIE`, you will get the error `recompile with -fPIE`.
 
-#### `trivialautovarinit` {#trivialautovarinit}
-
-Adds the `-ftrivial-auto-var-init=pattern` compiler option. This causes "trivially-initializable" uninitialized stack variables to be forcibly initialized with a nonzero value that is likely to cause a crash (and therefore be noticed). Uninitialized variables generally take on their values based on fragments of previous program state, and attackers can carefully manipulate that state to craft malicious initial values for these variables.
-
-Use of this flag is controversial as it can prevent tools that detect uninitialized variable use (such as valgrind) from operating correctly.
-
-This should be turned off or fixed for build errors such as:
-
-```
-sorry, unimplemented: __builtin_clear_padding not supported for variable length aggregates
-```
-
-#### `stackclashprotection` {#stackclashprotection}
-
-This flag adds the `-fstack-clash-protection` compiler option, which causes growth of a program's stack to access each successive page in order. This should force the guard page to be accessed and cause an attempt to "jump over" this guard page to crash.
-
 [^footnote-stdenv-ignored-build-platform]: The build platform is ignored because it is a mere implementation detail of the package satisfying the dependency: As a general programming principle, dependencies are always *specified* as interfaces, not concrete implementation.
 [^footnote-stdenv-native-dependencies-in-path]: Currently, this means for native builds all dependencies are put on the `PATH`. But in the future that may not be the case for sake of matching cross: the platforms would be assumed to be unique for native and cross builds alike, so only the `depsBuild*` and `nativeBuildInputs` would be added to the `PATH`.
 [^footnote-stdenv-propagated-dependencies]: Nix itself already takes a package’s transitive dependencies into account, but this propagation ensures nixpkgs-specific infrastructure like [setup hooks](#ssec-setup-hooks) also are run as if it were a propagated dependency.

doc/style.css

@@ -431,11 +431,6 @@ div.appendix .informaltable td {
     padding: 0.5rem;
 }
 
-div.book .variablelist .term,
-div.appendix .variablelist .term {
-    font-weight: 500;
-}
-
 /*
   This relies on highlight.js applying certain classes on the prompts.
   For more details, see https://highlightjs.readthedocs.io/en/latest/css-classes-reference.html#stylable-scopes

doc/tests/manpage-urls.nix

@@ -1,32 +0,0 @@
-# To build this derivation, run `nix-build -A nixpkgs-manual.tests.manpage-urls`
-{
-  lib,
-  runCommand,
-  invalidateFetcherByDrvHash,
-  cacert,
-  python3,
-}:
-
-invalidateFetcherByDrvHash (
-  {
-    name ? "manual_check-manpage-urls",
-    script ? ./manpage-urls.py,
-    urlsFile ? ../manpage-urls.json,
-  }:
-  runCommand name
-    {
-      nativeBuildInputs = [
-        cacert
-        (python3.withPackages (p: [
-          p.aiohttp
-          p.rich
-          p.structlog
-        ]))
-      ];
-      outputHash = "sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU="; # Empty output
-    }
-    ''
-      python3 ${script} ${urlsFile}
-      touch $out
-    ''
-) { }

flake.nix

@@ -5,15 +5,14 @@
 
   outputs = { self }:
     let
+      jobs = import ./pkgs/top-level/release.nix {
+        nixpkgs = self;
+      };
+
       libVersionInfoOverlay = import ./lib/flake-version-info.nix self;
       lib = (import ./lib).extend libVersionInfoOverlay;
 
       forAllSystems = lib.genAttrs lib.systems.flakeExposed;
-
-      jobs = forAllSystems (system: import ./pkgs/top-level/release.nix {
-        nixpkgs = self;
-        inherit system;
-      });
     in
     {
       lib = lib.extend (final: prev: {
@@ -44,15 +43,12 @@
           );
       });
 
-      checks = forAllSystems (system: {
-        tarball = jobs.${system}.tarball;
-        # Exclude power64 due to "libressl is not available on the requested hostPlatform" with hostPlatform being power64
-      } // lib.optionalAttrs (self.legacyPackages.${system}.stdenv.isLinux && !self.legacyPackages.${system}.targetPlatform.isPower64) {
+      checks.x86_64-linux = {
+        tarball = jobs.tarball;
         # Test that ensures that the nixosSystem function can accept a lib argument
         # Note: prefer not to extend or modify `lib`, especially if you want to share reusable modules
         #       alternatives include: `import` a file, or put a custom library in an option or in `_module.args.<libname>`
         nixosSystemAcceptsLib = (self.lib.nixosSystem {
-          pkgs = self.legacyPackages.${system};
           lib = self.lib.extend (final: prev: {
             ifThisFunctionIsMissingTheTestFails = final.id;
           });
@@ -68,13 +64,13 @@
             })
           ];
         }).config.system.build.toplevel;
-      });
+      };
 
       htmlDocs = {
-        nixpkgsManual = builtins.mapAttrs (_: jobSet: jobSet.manual) jobs;
+        nixpkgsManual = jobs.manual;
         nixosManual = (import ./nixos/release-small.nix {
           nixpkgs = self;
-        }).nixos.manual;
+        }).nixos.manual.x86_64-linux;
       };
 
       # The "legacy" in `legacyPackages` doesn't imply that the packages exposed

lib/.version

@@ -1 +1 @@
-24.11
+24.05

lib/attrsets.nix

@@ -11,7 +11,7 @@ let
 in
 
 rec {
-  inherit (builtins) attrNames listToAttrs hasAttr isAttrs getAttr removeAttrs intersectAttrs;
+  inherit (builtins) attrNames listToAttrs hasAttr isAttrs getAttr removeAttrs;
 
 
   /**
@@ -1764,7 +1764,6 @@ rec {
   /**
     Get a package output.
     If no output is found, fallback to `.out` and then to the default.
-    The function is idempotent: `getOutput "b" (getOutput "a" p) == getOutput "a" p`.
 
 
     # Inputs
@@ -1780,7 +1779,7 @@ rec {
     # Type
 
     ```
-    getOutput :: String -> :: Derivation -> Derivation
+    getOutput :: String -> Derivation -> String
     ```
 
     # Examples
@@ -1788,7 +1787,7 @@ rec {
     ## `lib.attrsets.getOutput` usage example
 
     ```nix
-    "${getOutput "dev" pkgs.openssl}"
+    getOutput "dev" pkgs.openssl
     => "/nix/store/9rz8gxhzf8sw4kf2j2f1grr49w8zx5vj-openssl-1.0.1r-dev"
     ```
 
@@ -1799,49 +1798,6 @@ rec {
       then pkg.${output} or pkg.out or pkg
       else pkg;
 
-  /**
-    Get the first of the `outputs` provided by the package, or the default.
-    This function is alligned with `_overrideFirst()` from the `multiple-outputs.sh` setup hook.
-    Like `getOutput`, the function is idempotent.
-
-    # Inputs
-
-    `outputs`
-
-    : 1\. Function argument
-
-    `pkg`
-
-    : 2\. Function argument
-
-    # Type
-
-    ```
-    getFirstOutput :: [String] -> Derivation -> Derivation
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.attrsets.getFirstOutput` usage example
-
-    ```nix
-    "${getFirstOutput [ "include" "dev" ] pkgs.openssl}"
-    => "/nix/store/00000000000000000000000000000000-openssl-1.0.1r-dev"
-    ```
-
-    :::
-  */
-  getFirstOutput =
-    candidates: pkg:
-    let
-      outputs = builtins.filter (name: hasAttr name pkg) candidates;
-      output = builtins.head outputs;
-    in
-    if pkg.outputSpecified or false || outputs == [ ] then
-      pkg
-    else
-      pkg.${output};
-
   /**
     Get a package's `bin` output.
     If the output does not exist, fallback to `.out` and then to the default.
@@ -1855,7 +1811,7 @@ rec {
     # Type
 
     ```
-    getBin :: Derivation -> Derivation
+    getBin :: Derivation -> String
     ```
 
     # Examples
@@ -1863,8 +1819,8 @@ rec {
     ## `lib.attrsets.getBin` usage example
 
     ```nix
-    "${getBin pkgs.openssl}"
-    => "/nix/store/00000000000000000000000000000000-openssl-1.0.1r"
+    getBin pkgs.openssl
+    => "/nix/store/9rz8gxhzf8sw4kf2j2f1grr49w8zx5vj-openssl-1.0.1r"
     ```
 
     :::
@@ -1885,7 +1841,7 @@ rec {
     # Type
 
     ```
-    getLib :: Derivation -> Derivation
+    getLib :: Derivation -> String
     ```
 
     # Examples
@@ -1893,7 +1849,7 @@ rec {
     ## `lib.attrsets.getLib` usage example
 
     ```nix
-    "${getLib pkgs.openssl}"
+    getLib pkgs.openssl
     => "/nix/store/9rz8gxhzf8sw4kf2j2f1grr49w8zx5vj-openssl-1.0.1r-lib"
     ```
 
@@ -1901,35 +1857,6 @@ rec {
   */
   getLib = getOutput "lib";
 
-  /**
-    Get a package's `static` output.
-    If the output does not exist, fallback to `.lib`, then to `.out`, and then to the default.
-
-    # Inputs
-
-    `pkg`
-
-    : The package whose `static` output will be retrieved.
-
-    # Type
-
-    ```
-    getStatic :: Derivation -> Derivation
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.attrsets.getStatic` usage example
-
-    ```nix
-    "${lib.getStatic pkgs.glibc}"
-    => "/nix/store/00000000000000000000000000000000-glibc-2.39-52-static"
-    ```
-
-    :::
-  */
-  getStatic = getFirstOutput [ "static" "lib" "out" ];
-
 
   /**
     Get a package's `dev` output.
@@ -1944,7 +1871,7 @@ rec {
     # Type
 
     ```
-    getDev :: Derivation -> Derivation
+    getDev :: Derivation -> String
     ```
 
     # Examples
@@ -1952,7 +1879,7 @@ rec {
     ## `lib.attrsets.getDev` usage example
 
     ```nix
-    "${getDev pkgs.openssl}"
+    getDev pkgs.openssl
     => "/nix/store/9rz8gxhzf8sw4kf2j2f1grr49w8zx5vj-openssl-1.0.1r-dev"
     ```
 
@@ -1960,35 +1887,6 @@ rec {
   */
   getDev = getOutput "dev";
 
-  /**
-    Get a package's `include` output.
-    If the output does not exist, fallback to `.dev`, then to `.out`, and then to the default.
-
-    # Inputs
-
-    `pkg`
-
-    : The package whose `include` output will be retrieved.
-
-    # Type
-
-    ```
-    getInclude :: Derivation -> Derivation
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.attrsets.getInclude` usage example
-
-    ```nix
-    "${getInclude pkgs.openssl}"
-    => "/nix/store/00000000000000000000000000000000-openssl-1.0.1r-dev"
-    ```
-
-    :::
-  */
-  getInclude = getFirstOutput [ "include" "dev" "out" ];
-
 
   /**
     Get a package's `man` output.
@@ -2003,7 +1901,7 @@ rec {
     # Type
 
     ```
-    getMan :: Derivation -> Derivation
+    getMan :: Derivation -> String
     ```
 
     # Examples
@@ -2011,7 +1909,7 @@ rec {
     ## `lib.attrsets.getMan` usage example
 
     ```nix
-    "${getMan pkgs.openssl}"
+    getMan pkgs.openssl
     => "/nix/store/9rz8gxhzf8sw4kf2j2f1grr49w8zx5vj-openssl-1.0.1r-man"
     ```
 
@@ -2031,7 +1929,7 @@ rec {
     # Type
 
     ```
-    chooseDevOutputs :: [Derivation] -> [Derivation]
+    chooseDevOutputs :: [Derivation] -> [String]
     ```
   */
   chooseDevOutputs = builtins.map getDev;

lib/cli.nix

@@ -7,6 +7,8 @@ rec {
     This helps protect against malformed command lines and also to reduce
     boilerplate related to command-line construction for simple use cases.
 
+    `toGNUCommandLine` returns a list of nix strings.
+
     `toGNUCommandLineShell` returns an escaped shell string.
 
 
@@ -14,86 +16,17 @@ rec {
 
     `options`
 
-    : How to format the arguments, see `toGNUCommandLine`
+    : 1\. Function argument
 
     `attrs`
 
-    : The attributes to transform into arguments.
+    : 2\. Function argument
 
 
     # Examples
     :::{.example}
     ## `lib.cli.toGNUCommandLineShell` usage example
 
-    ```nix
-    cli.toGNUCommandLineShell {} {
-      data = builtins.toJSON { id = 0; };
-      X = "PUT";
-      retry = 3;
-      retry-delay = null;
-      url = [ "https://example.com/foo" "https://example.com/bar" ];
-      silent = false;
-      verbose = true;
-    }
-    => "'-X' 'PUT' '--data' '{\"id\":0}' '--retry' '3' '--url' 'https://example.com/foo' '--url' 'https://example.com/bar' '--verbose'";
-    ```
-
-    :::
-  */
-  toGNUCommandLineShell =
-    options: attrs: lib.escapeShellArgs (toGNUCommandLine options attrs);
-
-  /**
-    Automatically convert an attribute set to a list of command-line options.
-
-    `toGNUCommandLine` returns a list of string arguments.
-
-
-    # Inputs
-
-    `options`
-
-    : How to format the arguments, see below.
-
-    `attrs`
-
-    : The attributes to transform into arguments.
-
-    # Options
-
-    `mkOptionName`
-
-    : How to string-format the option name;
-    By default one character is a short option (`-`), more than one characters a long option (`--`).
-
-    `mkBool`
-
-    : How to format a boolean value to a command list;
-    By default it’s a flag option (only the option name if true, left out completely if false).
-
-    `mkList`
-
-    : How to format a list value to a command list;
-    By default the option name is repeated for each value and `mkOption` is applied to the values themselves.
-
-
-    `mkOption`
-
-    : How to format any remaining value to a command list;
-    On the toplevel, booleans and lists are handled by `mkBool` and `mkList`, though they can still appear as values of a list.
-    By default, everything is printed verbatim and complex types are forbidden (lists, attrsets, functions). `null` values are omitted.
-
-    `optionValueSeparator`
-
-    : How to separate an option from its flag;
-    By default, there is no separator, so option `-c` and value `5` would become ["-c" "5"].
-    This is useful if the command requires equals, for example, `-c=5`.
-
-
-    # Examples
-    :::{.example}
-    ## `lib.cli.toGNUCommandLine` usage example
-
     ```nix
     cli.toGNUCommandLine {} {
       data = builtins.toJSON { id = 0; };
@@ -112,29 +45,52 @@ rec {
       "--url" "https://example.com/bar"
       "--verbose"
     ]
+
+    cli.toGNUCommandLineShell {} {
+      data = builtins.toJSON { id = 0; };
+      X = "PUT";
+      retry = 3;
+      retry-delay = null;
+      url = [ "https://example.com/foo" "https://example.com/bar" ];
+      silent = false;
+      verbose = true;
+    }
+    => "'-X' 'PUT' '--data' '{\"id\":0}' '--retry' '3' '--url' 'https://example.com/foo' '--url' 'https://example.com/bar' '--verbose'";
     ```
 
     :::
   */
+  toGNUCommandLineShell =
+    options: attrs: lib.escapeShellArgs (toGNUCommandLine options attrs);
+
   toGNUCommandLine = {
+    # how to string-format the option name;
+    # by default one character is a short option (`-`),
+    # more than one characters a long option (`--`).
     mkOptionName ?
       k: if builtins.stringLength k == 1
           then "-${k}"
           else "--${k}",
 
+    # how to format a boolean value to a command list;
+    # by default it’s a flag option
+    # (only the option name if true, left out completely if false).
     mkBool ? k: v: lib.optional v (mkOptionName k),
 
+    # how to format a list value to a command list;
+    # by default the option name is repeated for each value
+    # and `mkOption` is applied to the values themselves.
     mkList ? k: v: lib.concatMap (mkOption k) v,
 
+    # how to format any remaining value to a command list;
+    # on the toplevel, booleans and lists are handled by `mkBool` and `mkList`,
+    # though they can still appear as values of a list.
+    # By default, everything is printed verbatim and complex types
+    # are forbidden (lists, attrsets, functions). `null` values are omitted.
     mkOption ?
       k: v: if v == null
             then []
-            else if optionValueSeparator == null then
-              [ (mkOptionName k) (lib.generators.mkValueStringDefault {} v) ]
-            else
-              [ "${mkOptionName k}${optionValueSeparator}${lib.generators.mkValueStringDefault {} v}" ],
-
-    optionValueSeparator ? null
+            else [ (mkOptionName k) (lib.generators.mkValueStringDefault {} v) ]
     }:
     options:
       let

lib/default.nix

@@ -64,52 +64,48 @@ let
     # linux kernel configuration
     kernel = callLibs ./kernel.nix;
 
-    # network
-    network = callLibs ./network;
-
-    # TODO: For consistency, all builtins should also be available from a sub-library;
-    # these are the only ones that are currently not
-    inherit (builtins) addErrorContext isPath trace typeOf unsafeGetAttrPos;
+    inherit (builtins) add addErrorContext attrNames concatLists
+      deepSeq elem elemAt filter genericClosure genList getAttr
+      hasAttr head isAttrs isBool isInt isList isPath isString length
+      lessThan listToAttrs pathExists readFile replaceStrings seq
+      stringLength sub substring tail trace;
     inherit (self.trivial) id const pipe concat or and xor bitAnd bitOr bitXor
       bitNot boolToString mergeAttrs flip mapNullable inNixShell isFloat min max
       importJSON importTOML warn warnIf warnIfNot throwIf throwIfNot checkListOfEnum
       info showWarnings nixpkgsVersion version isInOldestRelease
-      mod compare splitByAndCompare seq deepSeq lessThan add sub
+      mod compare splitByAndCompare
       functionArgs setFunctionArgs isFunction toFunction mirrorFunctionArgs
-      fromHexString toHexString toBaseDigits inPureEvalMode isBool isInt pathExists
-      genericClosure readFile;
+      toHexString toBaseDigits inPureEvalMode;
     inherit (self.fixedPoints) fix fix' converge extends composeExtensions
       composeManyExtensions makeExtensible makeExtensibleWithCustomName;
     inherit (self.attrsets) attrByPath hasAttrByPath setAttrByPath
-      getAttrFromPath attrVals attrNames attrValues getAttrs catAttrs filterAttrs
+      getAttrFromPath attrVals attrValues getAttrs catAttrs filterAttrs
       filterAttrsRecursive foldlAttrs foldAttrs collect nameValuePair mapAttrs
       mapAttrs' mapAttrsToList attrsToList concatMapAttrs mapAttrsRecursive
       mapAttrsRecursiveCond genAttrs isDerivation toDerivation optionalAttrs
       zipAttrsWithNames zipAttrsWith zipAttrs recursiveUpdateUntil
-      recursiveUpdate matchAttrs mergeAttrsList overrideExisting showAttrPath getOutput getFirstOutput
-      getBin getLib getStatic getDev getInclude getMan chooseDevOutputs zipWithNames zip
+      recursiveUpdate matchAttrs mergeAttrsList overrideExisting showAttrPath getOutput
+      getBin getLib getDev getMan chooseDevOutputs zipWithNames zip
       recurseIntoAttrs dontRecurseIntoAttrs cartesianProduct cartesianProductOfSets
-      mapCartesianProduct updateManyAttrsByPath listToAttrs hasAttr getAttr isAttrs intersectAttrs removeAttrs;
-    inherit (self.lists) singleton forEach map foldr fold foldl foldl' imap0 imap1
-      filter ifilter0 concatMap flatten remove findSingle findFirst any all count
+      mapCartesianProduct updateManyAttrsByPath;
+    inherit (self.lists) singleton forEach foldr fold foldl foldl' imap0 imap1
+      ifilter0 concatMap flatten remove findSingle findFirst any all count
       optional optionals toList range replicate partition zipListsWith zipLists
       reverseList listDfs toposort sort sortOn naturalSort compareLists take
       drop sublist last init crossLists unique allUnique intersectLists
-      subtractLists mutuallyExclusive groupBy groupBy' concatLists genList
-      length head tail elem elemAt isList;
+      subtractLists mutuallyExclusive groupBy groupBy';
     inherit (self.strings) concatStrings concatMapStrings concatImapStrings
-      stringLength substring isString replaceStrings
       intersperse concatStringsSep concatMapStringsSep
       concatImapStringsSep concatLines makeSearchPath makeSearchPathOutput
       makeLibraryPath makeIncludePath makeBinPath optionalString
       hasInfix hasPrefix hasSuffix stringToCharacters stringAsChars escape
       escapeShellArg escapeShellArgs
       isStorePath isStringLike
-      isValidPosixName toShellVar toShellVars trim trimWith
+      isValidPosixName toShellVar toShellVars
       escapeRegex escapeURL escapeXML replaceChars lowerChars
       upperChars toLower toUpper addContextFrom splitString
       removePrefix removeSuffix versionOlder versionAtLeast
-      getName getVersion match split
+      getName getVersion
       cmakeOptionType cmakeBool cmakeFeature
       mesonOption mesonBool mesonEnable
       nameFromURL enableFeature enableFeatureAs withFeature
@@ -123,7 +119,7 @@ let
     inherit (self.derivations) lazyDerivation optionalDrvAttr;
     inherit (self.meta) addMetaAttrs dontDistribute setName updateName
       appendToName mapDerivationAttrset setPrio lowPrio lowPrioSet hiPrio
-      hiPrioSet getLicenseFromSpdxId getLicenseFromSpdxIdOr getExe getExe';
+      hiPrioSet getLicenseFromSpdxId getExe getExe';
     inherit (self.filesystem) pathType pathIsDirectory pathIsRegularFile
       packagesFromDirectoryRecursive;
     inherit (self.sources) cleanSourceFilter

lib/deprecated/misc.nix

@@ -29,10 +29,9 @@ let
     nameValuePair
     tail
     toList
-    warn
     ;
 
-  inherit (lib.attrsets) removeAttrs mapAttrsToList;
+  inherit (lib.attrsets) removeAttrs;
 
   # returns default if env var is not set
   maybeEnv = name: default:
@@ -213,7 +212,7 @@ let
     else closePropagationSlow;
 
   # calls a function (f attr value ) for each record item. returns a list
-  mapAttrsFlatten = warn "lib.misc.mapAttrsFlatten is deprecated, please use lib.attrsets.mapAttrsToList instead." mapAttrsToList;
+  mapAttrsFlatten = f: r: map (attr: f attr r.${attr}) (attrNames r);
 
   # attribute set containing one attribute
   nvs = name: value: listToAttrs [ (nameValuePair name value) ];

lib/derivations.nix

@@ -17,7 +17,7 @@ let
     else "";
 in
 {
-  /**
+  /*
     Restrict a derivation to a predictable set of attribute names, so
     that the returned attrset is not strict in the actual derivation,
     saving a lot of computation when the derivation is non-trivial.
@@ -62,36 +62,25 @@ in
 
         (lazyDerivation { inherit derivation }).pythonPath
 
-    # Inputs
-
-    Takes an attribute set with the following attributes
-
-    `derivation`
-    : The derivation to be wrapped.
-
-    `meta`
-    : Optional meta attribute.
-
-      While this function is primarily about derivations, it can improve
-      the `meta` package attribute, which is usually specified through
-      `mkDerivation`.
-
-    `passthru`
-    : Optional extra values to add to the returned attrset.
-
-      This can be used for adding package attributes, such as `tests`.
-
-    `outputs`
-    : Optional list of assumed outputs. Default: ["out"]
-
-      This must match the set of outputs that the returned derivation has.
-      You must use this when the derivation has multiple outputs.
   */
   lazyDerivation =
     args@{
-      derivation,
-      meta ? null,
-      passthru ? { },
+      # The derivation to be wrapped.
+      derivation
+    , # Optional meta attribute.
+      #
+      # While this function is primarily about derivations, it can improve
+      # the `meta` package attribute, which is usually specified through
+      # `mkDerivation`.
+      meta ? null
+    , # Optional extra values to add to the returned attrset.
+      #
+      # This can be used for adding package attributes, such as `tests`.
+      passthru ? { }
+    , # Optional list of assumed outputs. Default: ["out"]
+      #
+      # This must match the set of outputs that the returned derivation has.
+      # You must use this when the derivation has multiple outputs.
       outputs ? [ "out" ]
     }:
     let
@@ -160,50 +149,29 @@ in
     // genAttrs outputs (outputName: checked.${outputName})
     // passthru;
 
-  /**
-    Conditionally set a derivation attribute.
+  /* Conditionally set a derivation attribute.
 
-    Because `mkDerivation` sets `__ignoreNulls = true`, a derivation
-    attribute set to `null` will not impact the derivation output hash.
-    Thus, this function passes through its `value` argument if the `cond`
-    is `true`, but returns `null` if not.
+     Because `mkDerivation` sets `__ignoreNulls = true`, a derivation
+     attribute set to `null` will not impact the derivation output hash.
+     Thus, this function passes through its `value` argument if the `cond`
+     is `true`, but returns `null` if not.
 
+     Type: optionalDrvAttr :: Bool -> a -> a | Null
 
-    # Inputs
-
-    `cond`
-
-    : Condition
-
-    `value`
-
-    : Attribute value
-
-    # Type
-
-    ```
-    optionalDrvAttr :: Bool -> a -> a | Null
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.derivations.optionalDrvAttr` usage example
-
-    ```nix
-    (stdenv.mkDerivation {
-      name = "foo";
-      x = optionalDrvAttr true 1;
-      y = optionalDrvAttr false 1;
-    }).drvPath == (stdenv.mkDerivation {
-      name = "foo";
-      x = 1;
-    }).drvPath
-    => true
-    ```
-
-    :::
+     Example:
+       (stdenv.mkDerivation {
+         name = "foo";
+         x = optionalDrvAttr true 1;
+         y = optionalDrvAttr false 1;
+       }).drvPath == (stdenv.mkDerivation {
+         name = "foo";
+         x = 1;
+       }).drvPath
+       => true
   */
   optionalDrvAttr =
+    # Condition
     cond:
+    # Attribute value
     value: if cond then value else null;
 }

lib/fileset/README.md

@@ -236,7 +236,7 @@ File sets cannot add single files to the store, they can only import files under
 Arguments:
 - (+) There's no point in using this library for a single file, since you can't do anything other than add it to the store or not.
   And it would be unclear how the library should behave if the one file wouldn't be added to the store:
-  `toSource { root = ./file.nix; fileset = <empty>; }` has no reasonable result because returning an empty store path wouldn't match the file type, and there's no way to have an empty file store path, whatever that would mean.
+  `toSource { root = ./file.nix; fileset = <empty>; }` has no reasonable result because returing an empty store path wouldn't match the file type, and there's no way to have an empty file store path, whatever that would mean.
 
 ### `fileFilter` takes a path
 

lib/filesystem.nix

@@ -1,4 +1,4 @@
-/**
+/*
   Functions for querying information about the filesystem
   without copying any files to the Nix store.
 */
@@ -29,35 +29,19 @@ in
 
 {
 
-  /**
+  /*
     The type of a path. The path needs to exist and be accessible.
     The result is either "directory" for a directory, "regular" for a regular file, "symlink" for a symlink, or "unknown" for anything else.
 
-    # Inputs
+    Type:
+      pathType :: Path -> String
 
-    path
+    Example:
+      pathType /.
+      => "directory"
 
-    : The path to query
-
-    # Type
-
-    ```
-    pathType :: Path -> String
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.filesystem.pathType` usage example
-
-    ```nix
-    pathType /.
-    => "directory"
-
-    pathType /some/file.nix
-    => "regular"
-    ```
-
-    :::
+      pathType /some/file.nix
+      => "regular"
   */
   pathType =
     builtins.readFileType or
@@ -75,97 +59,53 @@ in
       else (readDir (dirOf path)).${baseNameOf path}
     );
 
-  /**
+  /*
     Whether a path exists and is a directory.
 
+    Type:
+      pathIsDirectory :: Path -> Bool
 
-    # Inputs
+    Example:
+      pathIsDirectory /.
+      => true
 
-    `path`
+      pathIsDirectory /this/does/not/exist
+      => false
 
-    : 1\. Function argument
-
-    # Type
-
-    ```
-    pathIsDirectory :: Path -> Bool
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.filesystem.pathIsDirectory` usage example
-
-    ```nix
-    pathIsDirectory /.
-    => true
-
-    pathIsDirectory /this/does/not/exist
-    => false
-
-    pathIsDirectory /some/file.nix
-    => false
-    ```
-
-    :::
+      pathIsDirectory /some/file.nix
+      => false
   */
   pathIsDirectory = path:
     pathExists path && pathType path == "directory";
 
-  /**
+  /*
     Whether a path exists and is a regular file, meaning not a symlink or any other special file type.
 
+    Type:
+      pathIsRegularFile :: Path -> Bool
 
-    # Inputs
+    Example:
+      pathIsRegularFile /.
+      => false
 
-    `path`
+      pathIsRegularFile /this/does/not/exist
+      => false
 
-    : 1\. Function argument
-
-    # Type
-
-    ```
-    pathIsRegularFile :: Path -> Bool
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.filesystem.pathIsRegularFile` usage example
-
-    ```nix
-    pathIsRegularFile /.
-    => false
-
-    pathIsRegularFile /this/does/not/exist
-    => false
-
-    pathIsRegularFile /some/file.nix
-    => true
-    ```
-
-    :::
+      pathIsRegularFile /some/file.nix
+      => true
   */
   pathIsRegularFile = path:
     pathExists path && pathType path == "regular";
 
-  /**
+  /*
     A map of all haskell packages defined in the given path,
     identified by having a cabal file with the same name as the
     directory itself.
 
-
-    # Inputs
-
-    `root`
-
-    : The directory within to search
-
-    # Type
-
-    ```
-    Path -> Map String Path
-    ```
+    Type: Path -> Map String Path
   */
   haskellPathsInDir =
+    # The directory within to search
     root:
     let # Files in the root
         root-files = builtins.attrNames (builtins.readDir root);
@@ -180,30 +120,17 @@ in
             builtins.pathExists (value + "/${name}.cabal")
           ) root-files-with-paths;
     in builtins.listToAttrs cabal-subdirs;
-  /**
+  /*
     Find the first directory containing a file matching 'pattern'
     upward from a given 'file'.
     Returns 'null' if no directories contain a file matching 'pattern'.
 
-
-    # Inputs
-
-    `pattern`
-
-    : The pattern to search for
-
-    `file`
-
-    : The file to start searching upward from
-
-    # Type
-
-    ```
-    RegExp -> Path -> Nullable { path : Path; matches : [ MatchResults ]; }
-    ```
+    Type: RegExp -> Path -> Nullable { path : Path; matches : [ MatchResults ]; }
   */
   locateDominatingFile =
+    # The pattern to search for
     pattern:
+    # The file to start searching upward from
     file:
     let go = path:
           let files = builtins.attrNames (builtins.readDir path);
@@ -223,23 +150,13 @@ in
     in go (if isDir then file else parent);
 
 
-  /**
+  /*
     Given a directory, return a flattened list of all files within it recursively.
 
-
-    # Inputs
-
-    `dir`
-
-    : The path to recursively list
-
-    # Type
-
-    ```
-    Path -> [ Path ]
-    ```
+    Type: Path -> [ Path ]
   */
   listFilesRecursive =
+    # The path to recursively list
     dir:
     lib.flatten (lib.mapAttrsToList (name: type:
     if type == "directory" then
@@ -248,7 +165,7 @@ in
       dir + "/${name}"
   ) (builtins.readDir dir));
 
-  /**
+  /*
     Transform a directory tree containing package files suitable for
     `callPackage` into a matching nested attribute set of derivations.
 
@@ -306,57 +223,40 @@ in
         As a result, directories with no `.nix` files (including empty
         directories) will be transformed into empty attribute sets.
 
-    # Inputs
-
-    Structured function argument
-
-    : Attribute set containing the following attributes.
-      Additional attributes are ignored.
-
-      `callPackage`
-
-      : `pkgs.callPackage`
-
-        Type: `Path -> AttrSet -> a`
-
-      `directory`
-
-      : The directory to read package files from
-
-        Type: `Path`
-
-
-    # Type
-
-    ```
-    packagesFromDirectoryRecursive :: AttrSet -> AttrSet
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.filesystem.packagesFromDirectoryRecursive` usage example
-
-    ```nix
-    packagesFromDirectoryRecursive {
-      inherit (pkgs) callPackage;
-      directory = ./my-packages;
-    }
-    => { ... }
-
-    lib.makeScope pkgs.newScope (
-      self: packagesFromDirectoryRecursive {
-        callPackage = self.callPackage;
+    Example:
+      packagesFromDirectoryRecursive {
+        inherit (pkgs) callPackage;
         directory = ./my-packages;
       }
-    )
-    => { ... }
-    ```
+      => { ... }
 
-    :::
+      lib.makeScope pkgs.newScope (
+        self: packagesFromDirectoryRecursive {
+          callPackage = self.callPackage;
+          directory = ./my-packages;
+        }
+      )
+      => { ... }
+
+    Type:
+      packagesFromDirectoryRecursive :: AttrSet -> AttrSet
   */
   packagesFromDirectoryRecursive =
+    # Options.
     {
+      /*
+        `pkgs.callPackage`
+
+        Type:
+          Path -> AttrSet -> a
+      */
       callPackage,
+      /*
+        The directory to read package files from
+
+        Type:
+          Path
+      */
       directory,
       ...
     }:

lib/fixed-points.nix

@@ -1,6 +1,6 @@
 { lib, ... }:
 rec {
-  /**
+  /*
     `fix f` computes the fixed point of the given function `f`. In other words, the return value is `x` in `x = f x`.
 
     `f` must be a lazy function.
@@ -63,52 +63,27 @@ rec {
     See [`extends`](#function-library-lib.fixedPoints.extends) for an example use case.
     There `self` is also often called `final`.
 
+    Type: fix :: (a -> a) -> a
 
-    # Inputs
+    Example:
+      fix (self: { foo = "foo"; bar = "bar"; foobar = self.foo + self.bar; })
+      => { bar = "bar"; foo = "foo"; foobar = "foobar"; }
 
-    `f`
-
-    : 1\. Function argument
-
-    # Type
-
-    ```
-    fix :: (a -> a) -> a
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.fixedPoints.fix` usage example
-
-    ```nix
-    fix (self: { foo = "foo"; bar = "bar"; foobar = self.foo + self.bar; })
-    => { bar = "bar"; foo = "foo"; foobar = "foobar"; }
-
-    fix (self: [ 1 2 (elemAt self 0 + elemAt self 1) ])
-    => [ 1 2 3 ]
-    ```
-
-    :::
+      fix (self: [ 1 2 (elemAt self 0 + elemAt self 1) ])
+      => [ 1 2 3 ]
   */
   fix = f: let x = f x; in x;
 
-  /**
+  /*
     A variant of `fix` that records the original recursive attribute set in the
     result, in an attribute named `__unfix__`.
 
     This is useful in combination with the `extends` function to
     implement deep overriding.
-
-
-    # Inputs
-
-    `f`
-
-    : 1\. Function argument
   */
   fix' = f: let x = f x // { __unfix__ = f; }; in x;
 
-  /**
+  /*
     Return the fixpoint that `f` converges to when called iteratively, starting
     with the input `x`.
 
@@ -117,22 +92,7 @@ rec {
     0
     ```
 
-
-    # Inputs
-
-    `f`
-
-    : 1\. Function argument
-
-    `x`
-
-    : 2\. Function argument
-
-    # Type
-
-    ```
-    (a -> a) -> a -> a
-    ```
+    Type: (a -> a) -> a -> a
   */
   converge = f: x:
     let
@@ -142,7 +102,7 @@ rec {
       then x
       else converge f x';
 
-  /**
+  /*
     Extend a function using an overlay.
 
     Overlays allow modifying and extending fixed-point functions, specifically ones returning attribute sets.
@@ -257,50 +217,32 @@ rec {
     ```
     :::
 
+    Type:
+      extends :: (Attrs -> Attrs -> Attrs) # The overlay to apply to the fixed-point function
+              -> (Attrs -> Attrs) # A fixed-point function
+              -> (Attrs -> Attrs) # The resulting fixed-point function
 
-    # Inputs
+    Example:
+      f = final: { a = 1; b = final.a + 2; }
 
-    `overlay`
+      fix f
+      => { a = 1; b = 3; }
 
-    : The overlay to apply to the fixed-point function
+      fix (extends (final: prev: { a = prev.a + 10; }) f)
+      => { a = 11; b = 13; }
 
-    `f`
+      fix (extends (final: prev: { b = final.a + 5; }) f)
+      => { a = 1; b = 6; }
 
-    : The fixed-point function
-
-    # Type
-
-    ```
-    extends :: (Attrs -> Attrs -> Attrs) # The overlay to apply to the fixed-point function
-            -> (Attrs -> Attrs) # A fixed-point function
-            -> (Attrs -> Attrs) # The resulting fixed-point function
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.fixedPoints.extends` usage example
-
-    ```nix
-    f = final: { a = 1; b = final.a + 2; }
-
-    fix f
-    => { a = 1; b = 3; }
-
-    fix (extends (final: prev: { a = prev.a + 10; }) f)
-    => { a = 11; b = 13; }
-
-    fix (extends (final: prev: { b = final.a + 5; }) f)
-    => { a = 1; b = 6; }
-
-    fix (extends (final: prev: { c = final.a + final.b; }) f)
-    => { a = 1; b = 3; c = 4; }
-    ```
-
-    :::
+      fix (extends (final: prev: { c = final.a + final.b; }) f)
+      => { a = 1; b = 3; c = 4; }
   */
   extends =
+    # The overlay to apply to the fixed-point function
     overlay:
+    # The fixed-point function
     f:
+    # Wrap with parenthesis to prevent nixdoc from rendering the `final` argument in the documentation
     # The result should be thought of as a function, the argument of that function is not an argument to `extends` itself
     (
       final:
@@ -310,29 +252,10 @@ rec {
       prev // overlay final prev
     );
 
-  /**
+  /*
     Compose two extending functions of the type expected by 'extends'
     into one where changes made in the first are available in the
     'super' of the second
-
-
-    # Inputs
-
-    `f`
-
-    : 1\. Function argument
-
-    `g`
-
-    : 2\. Function argument
-
-    `final`
-
-    : 3\. Function argument
-
-    `prev`
-
-    : 4\. Function argument
   */
   composeExtensions =
     f: g: final: prev:
@@ -340,7 +263,7 @@ rec {
           prev' = prev // fApplied;
       in fApplied // g final prev';
 
-  /**
+  /*
     Compose several extending functions of the type expected by 'extends' into
     one where changes made in preceding functions are made available to
     subsequent ones.
@@ -353,7 +276,7 @@ rec {
   composeManyExtensions =
     lib.foldr (x: y: composeExtensions x y) (final: prev: {});
 
-  /**
+  /*
     Create an overridable, recursive attribute set. For example:
 
     ```
@@ -375,20 +298,9 @@ rec {
   */
   makeExtensible = makeExtensibleWithCustomName "extend";
 
-  /**
+  /*
     Same as `makeExtensible` but the name of the extending attribute is
     customized.
-
-
-    # Inputs
-
-    `extenderName`
-
-    : 1\. Function argument
-
-    `rattrs`
-
-    : 2\. Function argument
   */
   makeExtensibleWithCustomName = extenderName: rattrs:
     fix' (self: (rattrs self) // {

lib/generators.nix

@@ -1,23 +1,18 @@
-/**
-  Functions that generate widespread file
-  formats from nix data structures.
-
-  They all follow a similar interface:
-
-  ```nix
-  generator { config-attrs } data
-  ```
-
-  `config-attrs` are “holes” in the generators
-  with sensible default implementations that
-  can be overwritten. The default implementations
-  are mostly generators themselves, called with
-  their respective default values; they can be reused.
-
-  Tests can be found in ./tests/misc.nix
-
-  Further Documentation can be found [here](#sec-generators).
-*/
+/* Functions that generate widespread file
+ * formats from nix data structures.
+ *
+ * They all follow a similar interface:
+ * generator { config-attrs } data
+ *
+ * `config-attrs` are “holes” in the generators
+ * with sensible default implementations that
+ * can be overwritten. The default implementations
+ * are mostly generators themselves, called with
+ * their respective default values; they can be reused.
+ *
+ * Tests can be found in ./tests/misc.nix
+ * Documentation in the manual, #sec-generators
+ */
 { lib }:
 
 let
@@ -73,20 +68,11 @@ let
     ;
 
   ## -- HELPER FUNCTIONS & DEFAULTS --
-in rec {
-  /**
-    Convert a value to a sensible default string representation.
-    The builtin `toString` function has some strange defaults,
-    suitable for bash scripts but not much else.
 
-    # Inputs
-
-    Options
-    : Empty set, there may be configuration options in the future
-
-    `v`
-    : 2\. Function argument
-  */
+  /* Convert a value to a sensible default string representation.
+   * The builtin `toString` function has some strange defaults,
+   * suitable for bash scripts but not much else.
+   */
   mkValueStringDefault = {}: v:
     let err = t: v: abort
           ("generators.mkValueStringDefault: " +
@@ -114,36 +100,15 @@ in rec {
     else err "this value is" (toString v);
 
 
-  /**
-    Generate a line of key k and value v, separated by
-    character sep. If sep appears in k, it is escaped.
-    Helper for synaxes with different separators.
-
-    mkValueString specifies how values should be formatted.
-
-    ```nix
-    mkKeyValueDefault {} ":" "f:oo" "bar"
-    > "f\:oo:bar"
-    ```
-
-    # Inputs
-
-    Structured function argument
-    : mkValueString (optional, default: `mkValueStringDefault {}`)
-      : Function to convert values to strings
-
-    `sep`
-
-    : 2\. Function argument
-
-    `k`
-
-    : 3\. Function argument
-
-    `v`
-
-    : 4\. Function argument
-  */
+  /* Generate a line of key k and value v, separated by
+   * character sep. If sep appears in k, it is escaped.
+   * Helper for synaxes with different separators.
+   *
+   * mkValueString specifies how values should be formatted.
+   *
+   * mkKeyValueDefault {} ":" "f:oo" "bar"
+   * > "f\:oo:bar"
+   */
   mkKeyValueDefault = {
     mkValueString ? mkValueStringDefault {}
   }: sep: k: v:
@@ -153,23 +118,10 @@ in rec {
   ## -- FILE FORMAT GENERATORS --
 
 
-  /**
-    Generate a key-value-style config file from an attrset.
-
-    # Inputs
-
-    Structured function argument
-
-    : mkKeyValue (optional, default: `mkKeyValueDefault {} "="`)
-      : format a setting line from key and value
-
-    : listsAsDuplicateKeys (optional, default: `false`)
-      : allow lists as values for duplicate keys
-
-    : indent (optional, default: `""`)
-      : Initial indentation level
-
-  */
+  /* Generate a key-value-style config file from an attrset.
+   *
+   * mkKeyValue is the same as in toINI.
+   */
   toKeyValue = {
     mkKeyValue ? mkKeyValueDefault {} "=",
     listsAsDuplicateKeys ? false,
@@ -182,51 +134,32 @@ in rec {
   in attrs: concatStrings (concatLists (mapAttrsToList mkLines attrs));
 
 
-  /**
-    Generate an INI-style config file from an
-    attrset of sections to an attrset of key-value pairs.
-
-    # Inputs
-
-    Structured function argument
-
-    : mkSectionName (optional, default: `(name: escape [ "[" "]" ] name)`)
-      : apply transformations (e.g. escapes) to section names
-
-    : mkKeyValue (optional, default: `{} "="`)
-      : format a setting line from key and value
-
-    : listsAsDuplicateKeys (optional, default: `false`)
-      : allow lists as values for duplicate keys
-
-    # Examples
-    :::{.example}
-    ## `lib.generators.toINI` usage example
-
-    ```nix
-    generators.toINI {} {
-      foo = { hi = "${pkgs.hello}"; ciao = "bar"; };
-      baz = { "also, integers" = 42; };
-    }
-
-    > [baz]
-    > also, integers=42
-    >
-    > [foo]
-    > ciao=bar
-    > hi=/nix/store/y93qql1p5ggfnaqjjqhxcw0vqw95rlz0-hello-2.10
-    ```
-
-    The mk* configuration attributes can generically change
-    the way sections and key-value strings are generated.
-
-    For more examples see the test cases in ./tests/misc.nix.
-
-    :::
-  */
+  /* Generate an INI-style config file from an
+   * attrset of sections to an attrset of key-value pairs.
+   *
+   * generators.toINI {} {
+   *   foo = { hi = "${pkgs.hello}"; ciao = "bar"; };
+   *   baz = { "also, integers" = 42; };
+   * }
+   *
+   *> [baz]
+   *> also, integers=42
+   *>
+   *> [foo]
+   *> ciao=bar
+   *> hi=/nix/store/y93qql1p5ggfnaqjjqhxcw0vqw95rlz0-hello-2.10
+   *
+   * The mk* configuration attributes can generically change
+   * the way sections and key-value strings are generated.
+   *
+   * For more examples see the test cases in ./tests/misc.nix.
+   */
   toINI = {
+    # apply transformations (e.g. escapes) to section names
     mkSectionName ? (name: escape [ "[" "]" ] name),
+    # format a setting line from key and value
     mkKeyValue    ? mkKeyValueDefault {} "=",
+    # allow lists as values for duplicate keys
     listsAsDuplicateKeys ? false
   }: attrsOfAttrs:
     let
@@ -241,70 +174,43 @@ in rec {
       # map input to ini sections
       mapAttrsToStringsSep "\n" mkSection attrsOfAttrs;
 
-  /**
-    Generate an INI-style config file from an attrset
-    specifying the global section (no header), and an
-    attrset of sections to an attrset of key-value pairs.
-
-    # Inputs
-
-    1\. Structured function argument
-
-    : mkSectionName (optional, default: `(name: escape [ "[" "]" ] name)`)
-      : apply transformations (e.g. escapes) to section names
-
-    : mkKeyValue (optional, default: `{} "="`)
-      : format a setting line from key and value
-
-    : listsAsDuplicateKeys (optional, default: `false`)
-      : allow lists as values for duplicate keys
-
-    2\. Structured function argument
-
-    : globalSection (required)
-      : global section key-value pairs
-
-    : sections (optional, default: `{}`)
-      : attrset of sections to key-value pairs
-
-    # Examples
-    :::{.example}
-    ## `lib.generators.toINIWithGlobalSection` usage example
-
-    ```nix
-    generators.toINIWithGlobalSection {} {
-      globalSection = {
-        someGlobalKey = "hi";
-      };
-      sections = {
-        foo = { hi = "${pkgs.hello}"; ciao = "bar"; };
-        baz = { "also, integers" = 42; };
-    }
-
-    > someGlobalKey=hi
-    >
-    > [baz]
-    > also, integers=42
-    >
-    > [foo]
-    > ciao=bar
-    > hi=/nix/store/y93qql1p5ggfnaqjjqhxcw0vqw95rlz0-hello-2.10
-    ```
-
-    The mk* configuration attributes can generically change
-    the way sections and key-value strings are generated.
-
-    For more examples see the test cases in ./tests/misc.nix.
-
-    :::
-
-    If you don’t need a global section, you can also use
-    `generators.toINI` directly, which only takes
-    the part in `sections`.
-  */
+  /* Generate an INI-style config file from an attrset
+   * specifying the global section (no header), and an
+   * attrset of sections to an attrset of key-value pairs.
+   *
+   * generators.toINIWithGlobalSection {} {
+   *   globalSection = {
+   *     someGlobalKey = "hi";
+   *   };
+   *   sections = {
+   *     foo = { hi = "${pkgs.hello}"; ciao = "bar"; };
+   *     baz = { "also, integers" = 42; };
+   * }
+   *
+   *> someGlobalKey=hi
+   *>
+   *> [baz]
+   *> also, integers=42
+   *>
+   *> [foo]
+   *> ciao=bar
+   *> hi=/nix/store/y93qql1p5ggfnaqjjqhxcw0vqw95rlz0-hello-2.10
+   *
+   * The mk* configuration attributes can generically change
+   * the way sections and key-value strings are generated.
+   *
+   * For more examples see the test cases in ./tests/misc.nix.
+   *
+   * If you don’t need a global section, you can also use
+   * `generators.toINI` directly, which only takes
+   * the part in `sections`.
+   */
   toINIWithGlobalSection = {
+    # apply transformations (e.g. escapes) to section names
     mkSectionName ? (name: escape [ "[" "]" ] name),
+    # format a setting line from key and value
     mkKeyValue    ? mkKeyValueDefault {} "=",
+    # allow lists as values for duplicate keys
     listsAsDuplicateKeys ? false
   }: { globalSection, sections ? {} }:
     ( if globalSection == {}
@@ -313,43 +219,24 @@ in rec {
            + "\n")
     + (toINI { inherit mkSectionName mkKeyValue listsAsDuplicateKeys; } sections);
 
-  /**
-    Generate a git-config file from an attrset.
-
-    It has two major differences from the regular INI format:
-
-    1. values are indented with tabs
-    2. sections can have sub-sections
-
-    Further: https://git-scm.com/docs/git-config#EXAMPLES
-
-    # Examples
-    :::{.example}
-    ## `lib.generators.toGitINI` usage example
-
-    ```nix
-    generators.toGitINI {
-      url."ssh://git@github.com/".insteadOf = "https://github.com";
-      user.name = "edolstra";
-    }
-
-    > [url "ssh://git@github.com/"]
-    >   insteadOf = "https://github.com"
-    >
-    > [user]
-    >   name = "edolstra"
-    ```
-
-    :::
-
-    # Inputs
-
-    `attrs`
-
-    : Key-value pairs to be converted to a git-config file.
-      See: https://git-scm.com/docs/git-config#_variables for possible values.
-
-  */
+  /* Generate a git-config file from an attrset.
+   *
+   * It has two major differences from the regular INI format:
+   *
+   * 1. values are indented with tabs
+   * 2. sections can have sub-sections
+   *
+   * generators.toGitINI {
+   *   url."ssh://git@github.com/".insteadOf = "https://github.com";
+   *   user.name = "edolstra";
+   * }
+   *
+   *> [url "ssh://git@github.com/"]
+   *>   insteadOf = "https://github.com"
+   *>
+   *> [user]
+   *>   name = "edolstra"
+   */
   toGitINI = attrs:
     let
       mkSectionName = name:
@@ -393,40 +280,20 @@ in rec {
     in
       toINI_ (gitFlattenAttrs attrs);
 
-  /**
-    mkKeyValueDefault wrapper that handles dconf INI quirks.
-    The main differences of the format is that it requires strings to be quoted.
-  */
+  # mkKeyValueDefault wrapper that handles dconf INI quirks.
+  # The main differences of the format is that it requires strings to be quoted.
   mkDconfKeyValue = mkKeyValueDefault { mkValueString = v: toString (gvariant.mkValue v); } "=";
 
-  /**
-    Generates INI in dconf keyfile style. See https://help.gnome.org/admin/system-admin-guide/stable/dconf-keyfiles.html.en
-    for details.
-  */
+  # Generates INI in dconf keyfile style. See https://help.gnome.org/admin/system-admin-guide/stable/dconf-keyfiles.html.en
+  # for details.
   toDconfINI = toINI { mkKeyValue = mkDconfKeyValue; };
 
-  /**
-    Recurses through a `Value` limited to a certain depth. (`depthLimit`)
-
-    If the depth is exceeded, an error is thrown, unless `throwOnDepthLimit` is set to `false`.
-
-    # Inputs
-
-    Structured function argument
-
-    : depthLimit (required)
-      : If this option is not null, the given value will stop evaluating at a certain depth
-
-    : throwOnDepthLimit (optional, default: `true`)
-      : If this option is true, an error will be thrown, if a certain given depth is exceeded
-
-    Value
-    : The value to be evaluated recursively
-  */
   withRecursion =
     {
-      depthLimit,
-      throwOnDepthLimit ? true
+      /* If this option is not null, the given value will stop evaluating at a certain depth */
+      depthLimit
+      /* If this option is true, an error will be thrown, if a certain given depth is exceeded */
+    , throwOnDepthLimit ? true
     }:
       assert isInt depthLimit;
       let
@@ -456,33 +323,20 @@ in rec {
       in
         mapAny 0;
 
-  /**
-    Pretty print a value, akin to `builtins.trace`.
-
-    Should probably be a builtin as well.
-
-    The pretty-printed string should be suitable for rendering default values
-    in the NixOS manual. In particular, it should be as close to a valid Nix expression
-    as possible.
-
-    # Inputs
-
-    Structured function argument
-    : allowPrettyValues
-      : If this option is true, attrsets like { __pretty = fn; val = …; }
-        will use fn to convert val to a pretty printed representation.
-        (This means fn is type Val -> String.)
-    : multiline
-      : If this option is true, the output is indented with newlines for attribute sets and lists
-    : indent
-      : Initial indentation level
-
-    Value
-    : The value to be pretty printed
-  */
+  /* Pretty print a value, akin to `builtins.trace`.
+   * Should probably be a builtin as well.
+   * The pretty-printed string should be suitable for rendering default values
+   * in the NixOS manual. In particular, it should be as close to a valid Nix expression
+   * as possible.
+   */
   toPretty = {
+    /* If this option is true, attrsets like { __pretty = fn; val = …; }
+       will use fn to convert val to a pretty printed representation.
+       (This means fn is type Val -> String.) */
     allowPrettyValues ? false,
+    /* If this option is true, the output is indented with newlines for attribute sets and lists */
     multiline ? true,
+    /* Initial indentation level */
     indent ? ""
   }:
     let
@@ -543,17 +397,7 @@ in rec {
     else abort "generators.toPretty: should never happen (v = ${v})";
   in go indent;
 
-  /**
-    Translate a simple Nix expression to [Plist notation](https://en.wikipedia.org/wiki/Property_list).
-
-    # Inputs
-
-    Options
-    : Empty set, there may be configuration options in the future
-
-    Value
-      : The value to be converted to Plist
-  */
+  # PLIST handling
   toPlist = {}: v: let
     expr = ind: x:
       if x == null  then "" else
@@ -603,21 +447,9 @@ in rec {
 ${expr "" v}
 </plist>'';
 
-  /**
-    Translate a simple Nix expression to Dhall notation.
-
-    Note that integers are translated to Integer and never
-    the Natural type.
-
-    # Inputs
-
-    Options
-
-    : Empty set, there may be configuration options in the future
-
-    Value
-
-    : The value to be converted to Dhall
+  /* Translate a simple Nix expression to Dhall notation.
+   * Note that integers are translated to Integer and never
+   * the Natural type.
   */
   toDhall = { }@args: v:
     let concatItems = concatStringsSep ", ";
@@ -639,71 +471,46 @@ ${expr "" v}
     else
       toJSON v;
 
-  /**
-    Translate a simple Nix expression to Lua representation with occasional
-    Lua-inlines that can be constructed by mkLuaInline function.
+  /*
+   Translate a simple Nix expression to Lua representation with occasional
+   Lua-inlines that can be constructed by mkLuaInline function.
 
-    Configuration:
+   Configuration:
+     * multiline - by default is true which results in indented block-like view.
+     * indent - initial indent.
+     * asBindings - by default generate single value, but with this use attrset to set global vars.
 
-    * multiline - by default is true which results in indented block-like view.
-    * indent - initial indent.
-    * asBindings - by default generate single value, but with this use attrset to set global vars.
+   Attention:
+     Regardless of multiline parameter there is no trailing newline.
 
-    Attention:
-
-    Regardless of multiline parameter there is no trailing newline.
-
-
-    # Inputs
-
-    Structured function argument
-
-    : multiline (optional, default: `true`)
-      : If this option is true, the output is indented with newlines for attribute sets and lists
-    : indent (optional, default: `""`)
-      : Initial indentation level
-    : asBindings (optional, default: `false`)
-      : Interpret as variable bindings
-
-    Value
-
-    : The value to be converted to Lua
-
-    # Type
-
-    ```
-    toLua :: AttrSet -> Any -> String
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.generators.toLua` usage example
-
-    ```nix
-    generators.toLua {}
-      {
-        cmd = [ "typescript-language-server" "--stdio" ];
-        settings.workspace.library = mkLuaInline ''vim.api.nvim_get_runtime_file("", true)'';
-      }
-    ->
-     {
-       ["cmd"] = {
-         "typescript-language-server",
-         "--stdio"
-       },
-       ["settings"] = {
-         ["workspace"] = {
-           ["library"] = (vim.api.nvim_get_runtime_file("", true))
-         }
+   Example:
+     generators.toLua {}
+       {
+         cmd = [ "typescript-language-server" "--stdio" ];
+         settings.workspace.library = mkLuaInline ''vim.api.nvim_get_runtime_file("", true)'';
        }
-     }
-    ```
+     ->
+      {
+        ["cmd"] = {
+          "typescript-language-server",
+          "--stdio"
+        },
+        ["settings"] = {
+          ["workspace"] = {
+            ["library"] = (vim.api.nvim_get_runtime_file("", true))
+          }
+        }
+      }
 
-    :::
+   Type:
+     toLua :: AttrSet -> Any -> String
   */
   toLua = {
+    /* If this option is true, the output is indented with newlines for attribute sets and lists */
     multiline ? true,
+    /* Initial indentation level */
     indent ? "",
+    /* Interpret as variable bindings */
     asBindings ? false,
   }@args: v:
     let
@@ -752,55 +559,44 @@ ${expr "" v}
     else
       abort "generators.toLua: type ${typeOf v} is unsupported";
 
-  /**
-    Mark string as Lua expression to be inlined when processed by toLua.
+  /*
+   Mark string as Lua expression to be inlined when processed by toLua.
 
-
-    # Inputs
-
-    `expr`
-
-    : 1\. Function argument
-
-    # Type
-
-    ```
-    mkLuaInline :: String -> AttrSet
-    ```
+   Type:
+     mkLuaInline :: String -> AttrSet
   */
   mkLuaInline = expr: { _type = "lua-inline"; inherit expr; };
-} // {
-  /**
-    Generates JSON from an arbitrary (non-function) value.
-    For more information see the documentation of the builtin.
 
-    # Inputs
+in
 
-    Options
+# Everything in this attrset is the public interface of the file.
+{
+  inherit
+    mkDconfKeyValue
+    mkKeyValueDefault
+    mkLuaInline
+    mkValueStringDefault
+    toDconfINI
+    toDhall
+    toGitINI
+    toINI
+    toINIWithGlobalSection
+    toKeyValue
+    toLua
+    toPlist
+    toPretty
+    withRecursion
+    ;
 
-    : Empty set, there may be configuration options in the future
+  /* Generates JSON from an arbitrary (non-function) value.
+    * For more information see the documentation of the builtin.
+    */
+  toJSON = {}: toJSON;
 
-    Value
-
-    : The value to be converted to JSON
-  */
-  toJSON = {}: lib.strings.toJSON;
-
-  /**
-    YAML has been a strict superset of JSON since 1.2, so we
-    use toJSON. Before it only had a few differences referring
-    to implicit typing rules, so it should work with older
-    parsers as well.
-
-    # Inputs
-
-    Options
-
-    : Empty set, there may be configuration options in the future
-
-    Value
-
-    : The value to be converted to YAML
-  */
-  toYAML = {}: lib.strings.toJSON;
+  /* YAML has been a strict superset of JSON since 1.2, so we
+    * use toJSON. Before it only had a few differences referring
+    * to implicit typing rules, so it should work with older
+    * parsers as well.
+    */
+  toYAML = {}: toJSON;
 }

lib/gvariant.nix

@@ -1,4 +1,4 @@
-/**
+/*
   A partial and basic implementation of GVariant formatted strings.
   See [GVariant Format Strings](https://docs.gtk.org/glib/gvariant-format-strings.html) for details.
 
@@ -41,28 +41,17 @@ let
     variant = "v";
   };
 
+  /* Check if a value is a GVariant value
+
+     Type:
+       isGVariant :: Any -> Bool
+  */
+  isGVariant = v: v._type or "" == "gvariant";
+
 in
 rec {
 
-  inherit type;
-
-  /**
-    Check if a value is a GVariant value
-
-
-    # Inputs
-
-    `v`
-
-    : value to check
-
-    # Type
-
-    ```
-    isGVariant :: Any -> Bool
-    ```
-  */
-  isGVariant = v: v._type or "" == "gvariant";
+  inherit type isGVariant;
 
   intConstructors = [
     {
@@ -111,22 +100,11 @@ rec {
     }
   ];
 
-  /**
-    Returns the GVariant value that most closely matches the given Nix value.
-    If no GVariant value can be found unambiguously then error is thrown.
+  /* Returns the GVariant value that most closely matches the given Nix value.
+     If no GVariant value can be found unambiguously then error is thrown.
 
-
-    # Inputs
-
-    `v`
-
-    : 1\. Function argument
-
-    # Type
-
-    ```
-    mkValue :: Any -> gvariant
-    ```
+     Type:
+       mkValue :: Any -> gvariant
   */
   mkValue = v:
     if builtins.isBool v then
@@ -154,32 +132,14 @@ rec {
     else
       throw "The GVariant type of “${builtins.typeOf v}” can't be inferred.";
 
-  /**
-    Returns the GVariant array from the given type of the elements and a Nix list.
+  /* Returns the GVariant array from the given type of the elements and a Nix list.
 
+     Type:
+       mkArray :: [Any] -> gvariant
 
-    # Inputs
-
-    `elems`
-
-    : 1\. Function argument
-
-    # Type
-
-    ```
-    mkArray :: [Any] -> gvariant
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.gvariant.mkArray` usage example
-
-    ```nix
-    # Creating a string array
-    lib.gvariant.mkArray [ "a" "b" "c" ]
-    ```
-
-    :::
+     Example:
+       # Creating a string array
+       lib.gvariant.mkArray [ "a" "b" "c" ]
   */
   mkArray = elems:
     let
@@ -193,67 +153,31 @@ rec {
         "@${self.type} [${concatMapStringsSep "," toString self.value}]";
     };
 
-  /**
-    Returns the GVariant array from the given empty Nix list.
+  /* Returns the GVariant array from the given empty Nix list.
 
+     Type:
+       mkEmptyArray :: gvariant.type -> gvariant
 
-    # Inputs
-
-    `elemType`
-
-    : 1\. Function argument
-
-    # Type
-
-    ```
-    mkEmptyArray :: gvariant.type -> gvariant
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.gvariant.mkEmptyArray` usage example
-
-    ```nix
-    # Creating an empty string array
-    lib.gvariant.mkEmptyArray (lib.gvariant.type.string)
-    ```
-
-    :::
+     Example:
+       # Creating an empty string array
+       lib.gvariant.mkEmptyArray (lib.gvariant.type.string)
   */
   mkEmptyArray = elemType: mkPrimitive (type.arrayOf elemType) [ ] // {
     __toString = self: "@${self.type} []";
   };
 
 
-  /**
-    Returns the GVariant variant from the given Nix value. Variants are containers
-    of different GVariant type.
+  /* Returns the GVariant variant from the given Nix value. Variants are containers
+     of different GVariant type.
 
+     Type:
+       mkVariant :: Any -> gvariant
 
-    # Inputs
-
-    `elem`
-
-    : 1\. Function argument
-
-    # Type
-
-    ```
-    mkVariant :: Any -> gvariant
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.gvariant.mkVariant` usage example
-
-    ```nix
-    lib.gvariant.mkArray [
-      (lib.gvariant.mkVariant "a string")
-      (lib.gvariant.mkVariant (lib.gvariant.mkInt32 1))
-    ]
-    ```
-
-    :::
+     Example:
+       lib.gvariant.mkArray [
+         (lib.gvariant.mkVariant "a string")
+         (lib.gvariant.mkVariant (lib.gvariant.mkInt32 1))
+       ]
   */
   mkVariant = elem:
     let gvarElem = mkValue elem;
@@ -261,43 +185,23 @@ rec {
       __toString = self: "<${toString self.value}>";
     };
 
-  /**
-    Returns the GVariant dictionary entry from the given key and value.
+  /* Returns the GVariant dictionary entry from the given key and value.
 
+     Type:
+       mkDictionaryEntry :: String -> Any -> gvariant
 
-    # Inputs
-
-    `name`
-
-    : The key of the entry
-
-    `value`
-
-    : The value of the entry
-
-    # Type
-
-    ```
-    mkDictionaryEntry :: String -> Any -> gvariant
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.gvariant.mkDictionaryEntry` usage example
-
-    ```nix
-    # A dictionary describing an Epiphany’s search provider
-    [
-      (lib.gvariant.mkDictionaryEntry "url" (lib.gvariant.mkVariant "https://duckduckgo.com/?q=%s&t=epiphany"))
-      (lib.gvariant.mkDictionaryEntry "bang" (lib.gvariant.mkVariant "!d"))
-      (lib.gvariant.mkDictionaryEntry "name" (lib.gvariant.mkVariant "DuckDuckGo"))
-    ]
-    ```
-
-    :::
+     Example:
+       # A dictionary describing an Epiphany’s search provider
+       [
+         (lib.gvariant.mkDictionaryEntry "url" (lib.gvariant.mkVariant "https://duckduckgo.com/?q=%s&t=epiphany"))
+         (lib.gvariant.mkDictionaryEntry "bang" (lib.gvariant.mkVariant "!d"))
+         (lib.gvariant.mkDictionaryEntry "name" (lib.gvariant.mkVariant "DuckDuckGo"))
+       ]
   */
   mkDictionaryEntry =
+    # The key of the entry
     name:
+    # The value of the entry
     value:
     let
       name' = mkValue name;
@@ -308,25 +212,10 @@ rec {
       __toString = self: "@${self.type} {${name'},${value'}}";
     };
 
-  /**
-    Returns the GVariant maybe from the given element type.
+  /* Returns the GVariant maybe from the given element type.
 
-
-    # Inputs
-
-    `elemType`
-
-    : 1\. Function argument
-
-    `elem`
-
-    : 2\. Function argument
-
-    # Type
-
-    ```
-    mkMaybe :: gvariant.type -> Any -> gvariant
-    ```
+     Type:
+       mkMaybe :: gvariant.type -> Any -> gvariant
   */
   mkMaybe = elemType: elem:
     mkPrimitive (type.maybeOf elemType) elem // {
@@ -337,57 +226,24 @@ rec {
           "just ${toString self.value}";
     };
 
-  /**
-    Returns the GVariant nothing from the given element type.
+  /* Returns the GVariant nothing from the given element type.
 
-
-    # Inputs
-
-    `elemType`
-
-    : 1\. Function argument
-
-    # Type
-
-    ```
-    mkNothing :: gvariant.type -> gvariant
-    ```
+     Type:
+       mkNothing :: gvariant.type -> gvariant
   */
   mkNothing = elemType: mkMaybe elemType null;
 
-  /**
-    Returns the GVariant just from the given Nix value.
+  /* Returns the GVariant just from the given Nix value.
 
-
-    # Inputs
-
-    `elem`
-
-    : 1\. Function argument
-
-    # Type
-
-    ```
-    mkJust :: Any -> gvariant
-    ```
+     Type:
+       mkJust :: Any -> gvariant
   */
   mkJust = elem: let gvarElem = mkValue elem; in mkMaybe gvarElem.type gvarElem;
 
-  /**
-    Returns the GVariant tuple from the given Nix list.
+  /* Returns the GVariant tuple from the given Nix list.
 
-
-    # Inputs
-
-    `elems`
-
-    : 1\. Function argument
-
-    # Type
-
-    ```
-    mkTuple :: [Any] -> gvariant
-    ```
+     Type:
+       mkTuple :: [Any] -> gvariant
   */
   mkTuple = elems:
     let
@@ -399,42 +255,20 @@ rec {
         "@${self.type} (${concatMapStringsSep "," toString self.value})";
     };
 
-  /**
-    Returns the GVariant boolean from the given Nix bool value.
+  /* Returns the GVariant boolean from the given Nix bool value.
 
-
-    # Inputs
-
-    `v`
-
-    : 1\. Function argument
-
-    # Type
-
-    ```
-    mkBoolean :: Bool -> gvariant
-    ```
+     Type:
+       mkBoolean :: Bool -> gvariant
   */
   mkBoolean = v:
     mkPrimitive type.boolean v // {
       __toString = self: if self.value then "true" else "false";
     };
 
-  /**
-    Returns the GVariant string from the given Nix string value.
+  /* Returns the GVariant string from the given Nix string value.
 
-
-    # Inputs
-
-    `v`
-
-    : 1\. Function argument
-
-    # Type
-
-    ```
-    mkString :: String -> gvariant
-    ```
+     Type:
+       mkString :: String -> gvariant
   */
   mkString = v:
     let sanitize = s: replaceStrings [ "\n" ] [ "\\n" ] (escape [ "'" "\\" ] s);
@@ -442,129 +276,72 @@ rec {
       __toString = self: "'${sanitize self.value}'";
     };
 
-  /**
-    Returns the GVariant object path from the given Nix string value.
+  /* Returns the GVariant object path from the given Nix string value.
 
-
-    # Inputs
-
-    `v`
-
-    : 1\. Function argument
-
-    # Type
-
-    ```
-    mkObjectpath :: String -> gvariant
-    ```
+     Type:
+       mkObjectpath :: String -> gvariant
   */
   mkObjectpath = v:
     mkPrimitive type.string v // {
       __toString = self: "objectpath '${escape [ "'" ] self.value}'";
     };
 
-  /**
-    Returns the GVariant uchar from the given Nix int value.
+  /* Returns the GVariant uchar from the given Nix int value.
 
-    # Type
-
-    ```
-    mkUchar :: Int -> gvariant
-    ```
+     Type:
+       mkUchar :: Int -> gvariant
   */
   mkUchar = mkPrimitive type.uchar;
 
-  /**
-    Returns the GVariant int16 from the given Nix int value.
+  /* Returns the GVariant int16 from the given Nix int value.
 
-    # Type
-
-    ```
-    mkInt16 :: Int -> gvariant
-    ```
+     Type:
+       mkInt16 :: Int -> gvariant
   */
   mkInt16 = mkPrimitive type.int16;
 
-  /**
-    Returns the GVariant uint16 from the given Nix int value.
+  /* Returns the GVariant uint16 from the given Nix int value.
 
-    # Type
-
-    ```
-    mkUint16 :: Int -> gvariant
-    ```
+     Type:
+       mkUint16 :: Int -> gvariant
   */
   mkUint16 = mkPrimitive type.uint16;
 
-  /**
-    Returns the GVariant int32 from the given Nix int value.
+  /* Returns the GVariant int32 from the given Nix int value.
 
-
-    # Inputs
-
-    `v`
-
-    : 1\. Function argument
-
-    # Type
-
-    ```
-    mkInt32 :: Int -> gvariant
-    ```
+     Type:
+       mkInt32 :: Int -> gvariant
   */
   mkInt32 = v:
     mkPrimitive type.int32 v // {
       __toString = self: toString self.value;
     };
 
-  /**
-    Returns the GVariant uint32 from the given Nix int value.
+  /* Returns the GVariant uint32 from the given Nix int value.
 
-    # Type
-
-    ```
-    mkUint32 :: Int -> gvariant
-    ```
+     Type:
+       mkUint32 :: Int -> gvariant
   */
   mkUint32 = mkPrimitive type.uint32;
 
-  /**
-    Returns the GVariant int64 from the given Nix int value.
+  /* Returns the GVariant int64 from the given Nix int value.
 
-    # Type
-
-    ```
-    mkInt64 :: Int -> gvariant
-    ```
+     Type:
+       mkInt64 :: Int -> gvariant
   */
   mkInt64 = mkPrimitive type.int64;
 
-  /**
-    Returns the GVariant uint64 from the given Nix int value.
+  /* Returns the GVariant uint64 from the given Nix int value.
 
-    # Type
-
-    ```
-    mkUint64 :: Int -> gvariant
-    ```
+     Type:
+       mkUint64 :: Int -> gvariant
   */
   mkUint64 = mkPrimitive type.uint64;
 
-  /**
-    Returns the GVariant double from the given Nix float value.
+  /* Returns the GVariant double from the given Nix float value.
 
-
-    # Inputs
-
-    `v`
-
-    : 1\. Function argument
-
-    # Type
-
-    ```
-    mkDouble :: Float -> gvariant
-    ```
+     Type:
+       mkDouble :: Float -> gvariant
   */
   mkDouble = v:
     mkPrimitive type.double v // {

lib/licenses.nix

@@ -1,29 +1,25 @@
 { lib }:
-let
-  inherit (lib) optionalAttrs;
 
-  mkLicense = lname: {
-    shortName ? lname,
-    # Most of our licenses are Free, explicitly declare unfree additions as such!
-    free ? true,
-    deprecated ? false,
-    spdxId ? null,
-    url ? null,
-    fullName ? null,
-    redistributable ? free
-  }@attrs: {
-    inherit shortName free deprecated redistributable;
-  } // optionalAttrs (attrs ? spdxId) {
-    inherit spdxId;
-    url = "https://spdx.org/licenses/${spdxId}.html";
-  } // optionalAttrs (attrs ? url) {
-    inherit url;
-  } // optionalAttrs (attrs ? fullName) {
-    inherit fullName;
+lib.mapAttrs (lname: lset: let
+  defaultLicense = {
+    shortName = lname;
+    free = true; # Most of our licenses are Free, explicitly declare unfree additions as such!
+    deprecated = false;
   };
 
-in
-lib.mapAttrs mkLicense ({
+  mkLicense = licenseDeclaration: let
+    applyDefaults = license: defaultLicense // license;
+    applySpdx = license:
+      if license ? spdxId
+      then license // { url = "https://spdx.org/licenses/${license.spdxId}.html"; }
+      else license;
+    applyRedistributable = license: { redistributable = license.free; } // license;
+  in lib.pipe licenseDeclaration [
+    applyDefaults
+    applySpdx
+    applyRedistributable
+  ];
+in mkLicense lset) ({
   /* License identifiers from spdx.org where possible.
    * If you cannot find your license here, then look for a similar license or
    * add it to this list. The URL mentioned above is a good source for inspiration.
@@ -321,12 +317,6 @@ lib.mapAttrs mkLicense ({
     free = false;
   };
 
-  cc-by-nd-40 = {
-    spdxId = "CC-BY-ND-4.0";
-    fullName = "Creative Commons Attribution-No Derivative Works v4.0";
-    free = false;
-  };
-
   cc-by-sa-10 = {
     spdxId = "CC-BY-SA-1.0";
     fullName = "Creative Commons Attribution Share Alike 1.0";
@@ -372,12 +362,6 @@ lib.mapAttrs mkLicense ({
     fullName = "Creative Commons Attribution Share Alike 4.0";
   };
 
-  cc-sa-10 = {
-    shortName = "CC-SA-1.0";
-    fullName = "Creative Commons Share Alike 1.0";
-    url = "https://creativecommons.org/licenses/sa/1.0";
-  };
-
   cddl = {
     spdxId = "CDDL-1.0";
     fullName = "Common Development and Distribution License 1.0";
@@ -540,13 +524,6 @@ lib.mapAttrs mkLicense ({
     fullName = "Unspecified free software license";
   };
 
-  fsl11Mit = {
-    fullName = "Functional Source License, Version 1.1, MIT Future License";
-    url = "https://fsl.software/FSL-1.1-MIT.template.md";
-    free = false;
-    redistributable = true;
-  };
-
   ftl = {
     spdxId = "FTL";
     fullName = "Freetype Project License";
@@ -927,7 +904,7 @@ lib.mapAttrs mkLicense ({
 
   ncbiPd = {
     spdxId = "NCBI-PD";
-    fullName = "NCBI Public Domain Notice";
+    fullname = "NCBI Public Domain Notice";
     # Due to United States copyright law, anything with this "license" does not have a copyright in the
     # jurisdiction of the United States. However, other jurisdictions may assign the United States
     # government copyright to the work, and the license explicitly states that in such a case, no license
@@ -1171,7 +1148,7 @@ lib.mapAttrs mkLicense ({
     shortName = "TSL";
     fullName = "Timescale License Agreegment";
     url = "https://github.com/timescale/timescaledb/blob/main/tsl/LICENSE-TIMESCALE";
-    free = false;
+    unfree = true;
   };
 
   tcltk = {
@@ -1295,21 +1272,11 @@ lib.mapAttrs mkLicense ({
     fullName = "xinetd License";
   };
 
-  xskat = {
-    spdxId = "XSkat";
-    fullName = "XSkat License";
-  };
-
   zlib = {
     spdxId = "Zlib";
     fullName = "zlib License";
   };
 
-  zsh = {
-    url = "https://github.com/zsh-users/zsh/blob/master/LICENCE";
-    fullName = "Zsh License";
-  };
-
   zpl20 = {
     spdxId = "ZPL-2.0";
     fullName = "Zope Public License 2.0";
@@ -1320,6 +1287,10 @@ lib.mapAttrs mkLicense ({
     fullName = "Zope Public License 2.1";
   };
 
+  xskat = {
+    spdxId = "XSkat";
+    fullName = "XSkat License";
+  };
 } // {
   # TODO: remove legacy aliases
   apsl10 = {

lib/meta.nix

@@ -1,7 +1,5 @@
-/**
-  Some functions for manipulating meta attributes, as well as the
-  name attribute.
-*/
+/* Some functions for manipulating meta attributes, as well as the
+   name attribute. */
 
 { lib }:
 
@@ -13,225 +11,86 @@ in
 rec {
 
 
-  /**
-    Add to or override the meta attributes of the given
-    derivation.
+  /* Add to or override the meta attributes of the given
+     derivation.
 
-    # Inputs
-
-    `newAttrs`
-
-    : 1\. Function argument
-
-    `drv`
-
-    : 2\. Function argument
-
-
-    # Examples
-    :::{.example}
-    ## `lib.meta.addMetaAttrs` usage example
-
-    ```nix
-    addMetaAttrs {description = "Bla blah";} somePkg
-    ```
-
-    :::
+     Example:
+       addMetaAttrs {description = "Bla blah";} somePkg
   */
   addMetaAttrs = newAttrs: drv:
     drv // { meta = (drv.meta or {}) // newAttrs; };
 
 
-  /**
-    Disable Hydra builds of given derivation.
-
-    # Inputs
-
-    `drv`
-
-    : 1\. Function argument
+  /* Disable Hydra builds of given derivation.
   */
   dontDistribute = drv: addMetaAttrs { hydraPlatforms = []; } drv;
 
 
-  /**
-    Change the [symbolic name of a derivation](https://nixos.org/manual/nix/stable/language/derivations.html#attr-name).
-
-    :::{.warning}
-    Dependent derivations will be rebuilt when the symbolic name is changed.
-    :::
-
-    # Inputs
-
-    `name`
-
-    : 1\. Function argument
-
-    `drv`
-
-    : 2\. Function argument
+  /* Change the symbolic name of a package for presentation purposes
+     (i.e., so that nix-env users can tell them apart).
   */
   setName = name: drv: drv // {inherit name;};
 
 
-  /**
-    Like `setName`, but takes the previous name as an argument.
+  /* Like `setName`, but takes the previous name as an argument.
 
-    # Inputs
-
-    `updater`
-
-    : 1\. Function argument
-
-    `drv`
-
-    : 2\. Function argument
-
-
-    # Examples
-    :::{.example}
-    ## `lib.meta.updateName` usage example
-
-    ```nix
-    updateName (oldName: oldName + "-experimental") somePkg
-    ```
-
-    :::
+     Example:
+       updateName (oldName: oldName + "-experimental") somePkg
   */
   updateName = updater: drv: drv // {name = updater (drv.name);};
 
 
-  /**
-    Append a suffix to the name of a package (before the version
-    part).
-
-    # Inputs
-
-    `suffix`
-
-    : 1\. Function argument
-  */
+  /* Append a suffix to the name of a package (before the version
+     part). */
   appendToName = suffix: updateName (name:
     let x = builtins.parseDrvName name; in "${x.name}-${suffix}-${x.version}");
 
 
-  /**
-    Apply a function to each derivation and only to derivations in an attrset.
-
-
-    # Inputs
-
-    `f`
-
-    : 1\. Function argument
-
-    `set`
-
-    : 2\. Function argument
+  /* Apply a function to each derivation and only to derivations in an attrset.
   */
   mapDerivationAttrset = f: set: lib.mapAttrs (name: pkg: if lib.isDerivation pkg then (f pkg) else pkg) set;
 
-  /**
-    Set the nix-env priority of the package.
-
-    # Inputs
-
-    `priority`
-    : 1\. Function argument
-
-    `drv`
-    : 2\. Function argument
+  /* Set the nix-env priority of the package.
   */
   setPrio = priority: addMetaAttrs { inherit priority; };
 
-  /**
-    Decrease the nix-env priority of the package, i.e., other
-    versions/variants of the package will be preferred.
-
-    # Inputs
-
-    `drv`
-
-    : 1\. Function argument
-
+  /* Decrease the nix-env priority of the package, i.e., other
+     versions/variants of the package will be preferred.
   */
   lowPrio = setPrio 10;
 
-  /**
-    Apply lowPrio to an attrset with derivations
-
-
-    # Inputs
-
-    `set`
-
-    : 1\. Function argument
+  /* Apply lowPrio to an attrset with derivations
   */
   lowPrioSet = set: mapDerivationAttrset lowPrio set;
 
 
-  /**
-    Increase the nix-env priority of the package, i.e., this
-    version/variant of the package will be preferred.
-
-    # Inputs
-
-    `drv`
-
-    : 1\. Function argument
+  /* Increase the nix-env priority of the package, i.e., this
+     version/variant of the package will be preferred.
   */
   hiPrio = setPrio (-10);
 
-  /**
-    Apply hiPrio to an attrset with derivations
-
-
-    # Inputs
-
-    `set`
-
-    : 1\. Function argument
+  /* Apply hiPrio to an attrset with derivations
   */
   hiPrioSet = set: mapDerivationAttrset hiPrio set;
 
 
-  /**
-    Check to see if a platform is matched by the given `meta.platforms`
-    element.
+  /* Check to see if a platform is matched by the given `meta.platforms`
+     element.
 
-    A `meta.platform` pattern is either
+     A `meta.platform` pattern is either
 
-    1. (legacy) a system string.
+       1. (legacy) a system string.
 
-    2. (modern) a pattern for the entire platform structure (see `lib.systems.inspect.platformPatterns`).
+       2. (modern) a pattern for the entire platform structure (see `lib.systems.inspect.platformPatterns`).
 
-    3. (modern) a pattern for the platform `parsed` field (see `lib.systems.inspect.patterns`).
+       3. (modern) a pattern for the platform `parsed` field (see `lib.systems.inspect.patterns`).
 
-    We can inject these into a pattern for the whole of a structured platform,
-    and then match that.
+     We can inject these into a pattern for the whole of a structured platform,
+     and then match that.
 
-
-    # Inputs
-
-    `platform`
-
-    : 1\. Function argument
-
-    `elem`
-
-    : 2\. Function argument
-
-
-    # Examples
-    :::{.example}
-    ## `lib.meta.platformMatch` usage example
-
-    ```nix
-    lib.meta.platformMatch { system = "aarch64-darwin"; } "aarch64-darwin"
-    => true
-    ```
-
-    :::
+     Example:
+      lib.meta.platformMatch { system = "aarch64-darwin"; } "aarch64-darwin"
+      => true
   */
   platformMatch = platform: elem: (
     # Check with simple string comparison if elem was a string.
@@ -249,151 +108,59 @@ rec {
     ) platform
   );
 
-  /**
-    Check if a package is available on a given platform.
+  /* Check if a package is available on a given platform.
 
-    A package is available on a platform if both
+     A package is available on a platform if both
 
-    1. One of `meta.platforms` pattern matches the given
-        platform, or `meta.platforms` is not present.
+       1. One of `meta.platforms` pattern matches the given
+          platform, or `meta.platforms` is not present.
 
-    2. None of `meta.badPlatforms` pattern matches the given platform.
+       2. None of `meta.badPlatforms` pattern matches the given platform.
 
-
-    # Inputs
-
-    `platform`
-
-    : 1\. Function argument
-
-    `pkg`
-
-    : 2\. Function argument
-
-
-    # Examples
-    :::{.example}
-    ## `lib.meta.availableOn` usage example
-
-    ```nix
-    lib.meta.availableOn { system = "aarch64-darwin"; } pkg.zsh
-    => true
-    ```
-
-    :::
+     Example:
+       lib.meta.availableOn { system = "aarch64-darwin"; } pkg.zsh
+       => true
   */
   availableOn = platform: pkg:
     ((!pkg?meta.platforms) || any (platformMatch platform) pkg.meta.platforms) &&
     all (elem: !platformMatch platform elem) (pkg.meta.badPlatforms or []);
 
-  /**
-    Get the corresponding attribute in lib.licenses from the SPDX ID
-    or warn and fallback to `{ shortName = <license string>; }`.
+  /* Get the corresponding attribute in lib.licenses
+     from the SPDX ID.
+     For SPDX IDs, see
+     https://spdx.org/licenses
 
-    For SPDX IDs, see https://spdx.org/licenses
+     Type:
+       getLicenseFromSpdxId :: str -> AttrSet
 
-    # Type
-
-    ```
-    getLicenseFromSpdxId :: str -> AttrSet
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.meta.getLicenseFromSpdxId` usage example
-
-    ```nix
-    lib.getLicenseFromSpdxId "MIT" == lib.licenses.mit
-    => true
-    lib.getLicenseFromSpdxId "mIt" == lib.licenses.mit
-    => true
-    lib.getLicenseFromSpdxId "MY LICENSE"
-    => trace: warning: getLicenseFromSpdxId: No license matches the given SPDX ID: MY LICENSE
-    => { shortName = "MY LICENSE"; }
-    ```
-
-    :::
+     Example:
+       lib.getLicenseFromSpdxId "MIT" == lib.licenses.mit
+       => true
+       lib.getLicenseFromSpdxId "mIt" == lib.licenses.mit
+       => true
+       lib.getLicenseFromSpdxId "MY LICENSE"
+       => trace: warning: getLicenseFromSpdxId: No license matches the given SPDX ID: MY LICENSE
+       => { shortName = "MY LICENSE"; }
   */
   getLicenseFromSpdxId =
-    licstr:
-      getLicenseFromSpdxIdOr licstr (
+    let
+      spdxLicenses = lib.mapAttrs (id: ls: assert lib.length ls == 1; builtins.head ls)
+        (lib.groupBy (l: lib.toLower l.spdxId) (lib.filter (l: l ? spdxId) (lib.attrValues lib.licenses)));
+    in licstr:
+      spdxLicenses.${ lib.toLower licstr } or (
         lib.warn "getLicenseFromSpdxId: No license matches the given SPDX ID: ${licstr}"
         { shortName = licstr; }
       );
 
-  /**
-    Get the corresponding attribute in lib.licenses from the SPDX ID
-    or fallback to the given default value.
+  /* Get the path to the main program of a package based on meta.mainProgram
 
-    For SPDX IDs, see https://spdx.org/licenses
+     Type: getExe :: package -> string
 
-    # Inputs
-
-    `licstr`
-    : 1\. SPDX ID string to find a matching license
-
-    `default`
-    : 2\. Fallback value when a match is not found
-
-    # Type
-
-    ```
-    getLicenseFromSpdxIdOr :: str -> Any -> Any
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.meta.getLicenseFromSpdxIdOr` usage example
-
-    ```nix
-    lib.getLicenseFromSpdxIdOr "MIT" null == lib.licenses.mit
-    => true
-    lib.getLicenseFromSpdxId "mIt" null == lib.licenses.mit
-    => true
-    lib.getLicenseFromSpdxIdOr "MY LICENSE" lib.licenses.free == lib.licenses.free
-    => true
-    lib.getLicenseFromSpdxIdOr "MY LICENSE" null
-    => null
-    lib.getLicenseFromSpdxIdOr "MY LICENSE" (builtins.throw "No SPDX ID matches MY LICENSE")
-    => error: No SPDX ID matches MY LICENSE
-    ```
-    :::
-  */
-  getLicenseFromSpdxIdOr =
-    let
-      spdxLicenses = lib.mapAttrs (id: ls: assert lib.length ls == 1; builtins.head ls)
-        (lib.groupBy (l: lib.toLower l.spdxId) (lib.filter (l: l ? spdxId) (lib.attrValues lib.licenses)));
-    in licstr: default:
-      spdxLicenses.${ lib.toLower licstr } or default;
-
-  /**
-    Get the path to the main program of a package based on meta.mainProgram
-
-
-    # Inputs
-
-    `x`
-
-    : 1\. Function argument
-
-    # Type
-
-    ```
-    getExe :: package -> string
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.meta.getExe` usage example
-
-    ```nix
-    getExe pkgs.hello
-    => "/nix/store/g124820p9hlv4lj8qplzxw1c44dxaw1k-hello-2.12/bin/hello"
-    getExe pkgs.mustache-go
-    => "/nix/store/am9ml4f4ywvivxnkiaqwr0hyxka1xjsf-mustache-go-1.3.0/bin/mustache"
-    ```
-
-    :::
+     Example:
+       getExe pkgs.hello
+       => "/nix/store/g124820p9hlv4lj8qplzxw1c44dxaw1k-hello-2.12/bin/hello"
+       getExe pkgs.mustache-go
+       => "/nix/store/am9ml4f4ywvivxnkiaqwr0hyxka1xjsf-mustache-go-1.3.0/bin/mustache"
   */
   getExe = x: getExe' x (x.meta.mainProgram or (
     # This could be turned into an error when 23.05 is at end of life
@@ -402,38 +169,14 @@ rec {
     x
   ));
 
-  /**
-    Get the path of a program of a derivation.
+  /* Get the path of a program of a derivation.
 
-
-    # Inputs
-
-    `x`
-
-    : 1\. Function argument
-
-    `y`
-
-    : 2\. Function argument
-
-    # Type
-
-    ```
-    getExe' :: derivation -> string -> string
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.meta.getExe'` usage example
-
-    ```nix
-    getExe' pkgs.hello "hello"
-    => "/nix/store/g124820p9hlv4lj8qplzxw1c44dxaw1k-hello-2.12/bin/hello"
-    getExe' pkgs.imagemagick "convert"
-    => "/nix/store/5rs48jamq7k6sal98ymj9l4k2bnwq515-imagemagick-7.1.1-15/bin/convert"
-    ```
-
-    :::
+     Type: getExe' :: derivation -> string -> string
+     Example:
+       getExe' pkgs.hello "hello"
+       => "/nix/store/g124820p9hlv4lj8qplzxw1c44dxaw1k-hello-2.12/bin/hello"
+       getExe' pkgs.imagemagick "convert"
+       => "/nix/store/5rs48jamq7k6sal98ymj9l4k2bnwq515-imagemagick-7.1.1-15/bin/convert"
   */
   getExe' = x: y:
     assert assertMsg (isDerivation x)

lib/modules.nix

@@ -2,7 +2,6 @@
 
 let
   inherit (lib)
-    addErrorContext
     all
     any
     attrByPath
@@ -14,16 +13,13 @@ let
     elem
     filter
     foldl'
-    functionArgs
     getAttrFromPath
-    genericClosure
     head
     id
     imap1
     isAttrs
     isBool
     isFunction
-    isInOldestRelease
     isList
     isString
     length
@@ -36,17 +32,9 @@ let
     optionalString
     recursiveUpdate
     reverseList sort
-    seq
     setAttrByPath
-    substring
-    throwIfNot
-    trace
-    typeOf
     types
-    unsafeGetAttrPos
-    warn
     warnIf
-    zipAttrs
     zipAttrsWith
     ;
   inherit (lib.options)
@@ -101,8 +89,8 @@ let
                 }:
     let
       withWarnings = x:
-        warnIf (evalModulesArgs?args) "The args argument to evalModules is deprecated. Please set config._module.args instead."
-        warnIf (evalModulesArgs?check) "The check argument to evalModules is deprecated. Please set config._module.check instead."
+        lib.warnIf (evalModulesArgs?args) "The args argument to evalModules is deprecated. Please set config._module.args instead."
+        lib.warnIf (evalModulesArgs?check) "The check argument to evalModules is deprecated. Please set config._module.check instead."
         x;
 
       legacyModules =
@@ -277,9 +265,9 @@ let
               let
                 optText = showOption (prefix ++ firstDef.prefix);
                 defText =
-                  addErrorContext
+                  builtins.addErrorContext
                     "while evaluating the error message for definitions for `${optText}', which is an option that does not exist"
-                    (addErrorContext
+                    (builtins.addErrorContext
                       "while evaluating a definition from `${firstDef.file}'"
                       ( showDefs [ firstDef ])
                     );
@@ -310,7 +298,7 @@ let
             else throw baseMsg
         else null;
 
-      checked = seq checkUnmatched;
+      checked = builtins.seq checkUnmatched;
 
       extendModules = extendArgs@{
         modules ? [],
@@ -324,7 +312,7 @@ let
             prefix = extendArgs.prefix or evalModulesArgs.prefix or [];
           });
 
-      type = types.submoduleWith {
+      type = lib.types.submoduleWith {
         inherit modules specialArgs class;
       };
 
@@ -356,8 +344,8 @@ let
           else
             throw (
               "Could not load a value as a module, because it is of type ${lib.strings.escapeNixString m._type}"
-              + optionalString (fallbackFile != unknownModule) ", in file ${toString fallbackFile}."
-              + optionalString (m._type == "configuration") " If you do intend to import this configuration, please only import the modules that make up the configuration. You may have to create a `let` binding, file or attribute to give yourself access to the relevant modules.\nWhile loading a configuration into the module system is a very sensible idea, it can not be done cleanly in practice."
+              + lib.optionalString (fallbackFile != unknownModule) ", in file ${toString fallbackFile}."
+              + lib.optionalString (m._type == "configuration") " If you do intend to import this configuration, please only import the modules that make up the configuration. You may have to create a `let` binding, file or attribute to give yourself access to the relevant modules.\nWhile loading a configuration into the module system is a very sensible idea, it can not be done cleanly in practice."
                # Extended explanation: That's because a finalized configuration is more than just a set of modules. For instance, it has its own `specialArgs` that, by the nature of `specialArgs` can't be loaded through `imports` or the the `modules` argument. So instead, we have to ask you to extract the relevant modules and use those instead. This way, we keep the module system comparatively simple, and hopefully avoid a bad surprise down the line.
             )
         else if isList m then
@@ -427,7 +415,7 @@ let
           moduleKey = file: m:
             if isString m
             then
-              if substring 0 1 m == "/"
+              if builtins.substring 0 1 m == "/"
               then m
               else toString modulesPath + "/" + m
 
@@ -445,11 +433,11 @@ let
 
             else if isAttrs m
             then throw "Module `${file}` contains a disabledModules item that is an attribute set, presumably a module, that does not have a `key` attribute. This means that the module system doesn't have any means to identify the module that should be disabled. Make sure that you've put the correct value in disabledModules: a string path relative to modulesPath, a path value, or an attribute set with a `key` attribute."
-            else throw "Each disabledModules item must be a path, string, or a attribute set with a key attribute, or a value supported by toString. However, one of the disabledModules items in `${toString file}` is none of that, but is of type ${typeOf m}.";
+            else throw "Each disabledModules item must be a path, string, or a attribute set with a key attribute, or a value supported by toString. However, one of the disabledModules items in `${toString file}` is none of that, but is of type ${builtins.typeOf m}.";
 
           disabledKeys = concatMap ({ file, disabled }: map (moduleKey file) disabled) disabled;
           keyFilter = filter (attrs: ! elem attrs.key disabledKeys);
-        in map (attrs: attrs.module) (genericClosure {
+        in map (attrs: attrs.module) (builtins.genericClosure {
           startSet = keyFilter modules;
           operator = attrs: keyFilter attrs.modules;
         });
@@ -487,7 +475,7 @@ let
         }
     else
       # shorthand syntax
-      throwIfNot (isAttrs m) "module ${file} (${key}) does not look like a module."
+      lib.throwIfNot (isAttrs m) "module ${file} (${key}) does not look like a module."
       { _file = toString m._file or file;
         _class = m._class or null;
         key = toString m.key or key;
@@ -497,10 +485,10 @@ let
         config = addFreeformType (removeAttrs m ["_class" "_file" "key" "disabledModules" "require" "imports" "freeformType"]);
       };
 
-  applyModuleArgsIfFunction = key: f: args@{ config, ... }:
+  applyModuleArgsIfFunction = key: f: args@{ config, options, lib, ... }:
     if isFunction f then applyModuleArgs key f args else f;
 
-  applyModuleArgs = key: f: args@{ config, ... }:
+  applyModuleArgs = key: f: args@{ config, options, lib, ... }:
     let
       # Module arguments are resolved in a strict manner when attribute set
       # deconstruction is used.  As the arguments are now defined with the
@@ -515,10 +503,10 @@ let
       # not their values.  The values are forwarding the result of the
       # evaluation of the option.
       context = name: ''while evaluating the module argument `${name}' in "${key}":'';
-      extraArgs = mapAttrs (name: _:
-        addErrorContext (context name)
+      extraArgs = builtins.mapAttrs (name: _:
+        builtins.addErrorContext (context name)
           (args.${name} or config._module.args.${name})
-      ) (functionArgs f);
+      ) (lib.functionArgs f);
 
       # Note: we append in the opposite order such that we can add an error
       # context on the explicit arguments of "args" too. This update
@@ -559,16 +547,16 @@ let
           (n: concatLists)
           (map
             (module: let subtree = module.options; in
-              if !(isAttrs subtree) then
+              if !(builtins.isAttrs subtree) then
                 throw ''
-                  An option declaration for `${concatStringsSep "." prefix}' has type
-                  `${typeOf subtree}' rather than an attribute set.
+                  An option declaration for `${builtins.concatStringsSep "." prefix}' has type
+                  `${builtins.typeOf subtree}' rather than an attribute set.
                   Did you mean to define this outside of `options'?
                 ''
               else
                 mapAttrs
                   (n: option:
-                    [{ inherit (module) _file; pos = unsafeGetAttrPos n subtree; options = option; }]
+                    [{ inherit (module) _file; pos = builtins.unsafeGetAttrPos n subtree; options = option; }]
                   )
                   subtree
               )
@@ -577,17 +565,17 @@ let
       # The root of any module definition must be an attrset.
       checkedConfigs =
         assert
-          all
+          lib.all
             (c:
               # TODO: I have my doubts that this error would occur when option definitions are not matched.
               #       The implementation of this check used to be tied to a superficially similar check for
               #       options, so maybe that's why this is here.
               isAttrs c.config || throw ''
-                In module `${c.file}', you're trying to define a value of type `${typeOf c.config}'
+                In module `${c.file}', you're trying to define a value of type `${builtins.typeOf c.config}'
                 rather than an attribute set for the option
-                `${concatStringsSep "." prefix}'!
+                `${builtins.concatStringsSep "." prefix}'!
 
-                This usually happens if `${concatStringsSep "." prefix}' has option
+                This usually happens if `${builtins.concatStringsSep "." prefix}' has option
                 definitions inside that are not matched. Please check how to properly define
                 this option by e.g. referring to `man 5 configuration.nix'!
               ''
@@ -679,7 +667,7 @@ let
                 let
                   nonOptions = filter (m: !isOption m.options) decls;
                 in
-                throw "The option `${showOption loc}' in module `${(head optionDecls)._file}' would be a parent of the following options, but its type `${(head optionDecls).options.type.description or "<no description>"}' does not support nested options.\n${
+                throw "The option `${showOption loc}' in module `${(lib.head optionDecls)._file}' would be a parent of the following options, but its type `${(lib.head optionDecls).options.type.description or "<no description>"}' does not support nested options.\n${
                   showRawDecls loc nonOptions
                 }"
           else
@@ -818,7 +806,7 @@ let
           "The type `types.${opt.type.name}' of option `${showOption loc}' defined in ${showFiles opt.declarations} is deprecated. ${opt.type.deprecationMessage}";
 
     in warnDeprecation opt //
-      { value = addErrorContext "while evaluating the option `${showOption loc}':" value;
+      { value = builtins.addErrorContext "while evaluating the option `${showOption loc}':" value;
         inherit (res.defsFinal') highestPrio;
         definitions = map (def: def.value) res.defsFinal;
         files = map (def: def.file) res.defsFinal;
@@ -834,7 +822,7 @@ let
       let
         # Process mkMerge and mkIf properties.
         defs' = concatMap (m:
-          map (value: { inherit (m) file; inherit value; }) (addErrorContext "while evaluating definitions from `${m.file}':" (dischargeProperties m.value))
+          map (value: { inherit (m) file; inherit value; }) (builtins.addErrorContext "while evaluating definitions from `${m.file}':" (dischargeProperties m.value))
         ) defs;
 
         # Process mkOverride properties.
@@ -984,12 +972,12 @@ let
   mergeAttrDefinitionsWithPrio = opt:
         let
             defsByAttr =
-              zipAttrs (
-                concatLists (
-                  concatMap
+              lib.zipAttrs (
+                lib.concatLists (
+                  lib.concatMap
                     ({ value, ... }@def:
                       map
-                        (mapAttrsToList (k: value: { ${k} = def // { inherit value; }; }))
+                        (lib.mapAttrsToList (k: value: { ${k} = def // { inherit value; }; }))
                         (pushDownProperties value)
                     )
                     opt.definitionsWithLocations
@@ -997,9 +985,9 @@ let
               );
         in
           assert opt.type.name == "attrsOf" || opt.type.name == "lazyAttrsOf";
-          mapAttrs
+          lib.mapAttrs
                 (k: v:
-                  let merging = mergeDefinitions (opt.loc ++ [k]) opt.type.nestedTypes.elemType v;
+                  let merging = lib.mergeDefinitions (opt.loc ++ [k]) opt.type.nestedTypes.elemType v;
                   in {
                     value = merging.mergedValue;
                     inherit (merging.defsFinal') highestPrio;
@@ -1035,9 +1023,9 @@ let
   mkForce = mkOverride 50;
   mkVMOverride = mkOverride 10; # used by ‘nixos-rebuild build-vm’
 
-  defaultPriority = warnIf (isInOldestRelease 2305) "lib.modules.defaultPriority is deprecated, please use lib.modules.defaultOverridePriority instead." defaultOverridePriority;
+  defaultPriority = lib.warnIf (lib.isInOldestRelease 2305) "lib.modules.defaultPriority is deprecated, please use lib.modules.defaultOverridePriority instead." defaultOverridePriority;
 
-  mkFixStrictness = warn "lib.mkFixStrictness has no effect and will be removed. It returns its argument unmodified, so you can just remove any calls." id;
+  mkFixStrictness = lib.warn "lib.mkFixStrictness has no effect and will be removed. It returns its argument unmodified, so you can just remove any calls." id;
 
   mkOrder = priority: content:
     { _type = "order";
@@ -1133,7 +1121,7 @@ let
     inherit from to;
     visible = false;
     warn = true;
-    use = trace "Obsolete option `${showOption from}' is used. It was renamed to `${showOption to}'.";
+    use = builtins.trace "Obsolete option `${showOption from}' is used. It was renamed to `${showOption to}'.";
   };
 
   mkRenamedOptionModuleWith = {
@@ -1151,8 +1139,8 @@ let
   }: doRename {
     inherit from to;
     visible = false;
-    warn = isInOldestRelease sinceRelease;
-    use = warnIf (isInOldestRelease sinceRelease)
+    warn = lib.isInOldestRelease sinceRelease;
+    use = lib.warnIf (lib.isInOldestRelease sinceRelease)
       "Obsolete option `${showOption from}' is used. It was renamed to `${showOption to}'.";
   };
 
@@ -1384,8 +1372,8 @@ let
     config = lib.importTOML file;
   };
 
-  private = mapAttrs
-    (k: warn "External use of `lib.modules.${k}` is deprecated. If your use case isn't covered by non-deprecated functions, we'd like to know more and perhaps support your use case well, instead of providing access to these low level functions. In this case please open an issue in https://github.com/nixos/nixpkgs/issues/.")
+  private = lib.mapAttrs
+    (k: lib.warn "External use of `lib.modules.${k}` is deprecated. If your use case isn't covered by non-deprecated functions, we'd like to know more and perhaps support your use case well, instead of providing access to these low level functions. In this case please open an issue in https://github.com/nixos/nixpkgs/issues/.")
     {
       inherit
         applyModuleArgsIfFunction

lib/network/default.nix

@@ -1,49 +0,0 @@
-{ lib }:
-let
-  inherit (import ./internal.nix { inherit lib; }) _ipv6;
-in
-{
-  ipv6 = {
-    /**
-      Creates an `IPv6Address` object from an IPv6 address as a string. If
-      the prefix length is omitted, it defaults to 64. The parser is limited
-      to the first two versions of IPv6 addresses addressed in RFC 4291.
-      The form "x:x:x:x:x:x:d.d.d.d" is not yet implemented. Addresses are
-      NOT compressed, so they are not always the same as the canonical text
-      representation of IPv6 addresses defined in RFC 5952.
-
-      # Type
-
-      ```
-      fromString :: String -> IPv6Address
-      ```
-
-      # Examples
-
-      ```nix
-      fromString "2001:DB8::ffff/32"
-      => {
-        address = "2001:db8:0:0:0:0:0:ffff";
-        prefixLength = 32;
-      }
-      ```
-
-      # Arguments
-
-      - [addr] An IPv6 address with optional prefix length.
-    */
-    fromString =
-      addr:
-      let
-        splittedAddr = _ipv6.split addr;
-
-        addrInternal = splittedAddr.address;
-        prefixLength = splittedAddr.prefixLength;
-
-        address = _ipv6.toStringFromExpandedIp addrInternal;
-      in
-      {
-        inherit address prefixLength;
-      };
-  };
-}