Release NixOS 23.11

(cherry picked from commit 04220ed676)

.editorconfig

@@ -90,9 +90,6 @@ insert_final_newline = unset
 indent_style = unset
 trim_trailing_whitespace = unset
 
-[pkgs/misc/documentation-highlighter/**]
-insert_final_newline = unset
-
 [pkgs/servers/dict/wordnet_structures.py]
 trim_trailing_whitespace = unset
 

.github/CODEOWNERS

@@ -20,19 +20,13 @@
 
 # Libraries
 /lib                        @infinisil
-/lib/systems                @alyssais @ericson2314
+/lib/systems                @alyssais @ericson2314 @amjoseph-nixpkgs
 /lib/generators.nix         @infinisil @Profpatsch
 /lib/cli.nix                @infinisil @Profpatsch
 /lib/debug.nix              @infinisil @Profpatsch
 /lib/asserts.nix            @infinisil @Profpatsch
-/lib/path.*                 @infinisil
+/lib/path.*                 @infinisil @fricklerhandwerk
 /lib/fileset                @infinisil
-## Libraries / Module system
-/lib/modules.nix            @infinisil @roberth
-/lib/types.nix              @infinisil @roberth
-/lib/options.nix            @infinisil @roberth
-/lib/tests/modules.sh       @infinisil @roberth
-/lib/tests/modules          @infinisil @roberth
 
 # Nixpkgs Internals
 /default.nix                                     @Ericson2314
@@ -41,17 +35,17 @@
 /pkgs/top-level/stage.nix                        @Ericson2314
 /pkgs/top-level/splice.nix                       @Ericson2314
 /pkgs/top-level/release-cross.nix                @Ericson2314
-/pkgs/stdenv/generic                             @Ericson2314
+/pkgs/stdenv/generic                             @Ericson2314 @amjoseph-nixpkgs
 /pkgs/stdenv/generic/check-meta.nix              @Ericson2314 @piegamesde
-/pkgs/stdenv/cross                               @Ericson2314
-/pkgs/build-support/cc-wrapper                   @Ericson2314
+/pkgs/stdenv/cross                               @Ericson2314 @amjoseph-nixpkgs
+/pkgs/build-support/cc-wrapper                   @Ericson2314 @amjoseph-nixpkgs
 /pkgs/build-support/bintools-wrapper             @Ericson2314
 /pkgs/build-support/setup-hooks                  @Ericson2314
 /pkgs/build-support/setup-hooks/auto-patchelf.sh @layus
 /pkgs/build-support/setup-hooks/auto-patchelf.py @layus
 /pkgs/pkgs-lib                                   @infinisil
 ## Format generators/serializers
-/pkgs/pkgs-lib/formats/libconfig                 @ckiee @h7x4
+/pkgs/pkgs-lib/formats/libconfig                 @ckiee
 
 # pkgs/by-name
 /pkgs/test/nixpkgs-check-by-name @infinisil
@@ -66,10 +60,6 @@
 /doc/build-helpers/images/makediskimage.section.md  @raitobezarius
 /nixos/lib/make-disk-image.nix                 @raitobezarius
 
-# Nix, the package manager
-pkgs/tools/package-management/nix/                    @raitobezarius
-nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius
-
 # Nixpkgs documentation
 /maintainers/scripts/db-to-md.sh @jtojnar @ryantm
 /maintainers/scripts/doc @jtojnar @ryantm
@@ -77,8 +67,8 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius
 # Contributor documentation
 /CONTRIBUTING.md @infinisil
 /.github/PULL_REQUEST_TEMPLATE.md @infinisil
-/doc/contributing/ @infinisil
-/doc/contributing/contributing-to-documentation.chapter.md @jtojnar @infinisil
+/doc/contributing/ @fricklerhandwerk @infinisil
+/doc/contributing/contributing-to-documentation.chapter.md @jtojnar @fricklerhandwerk @infinisil
 /lib/README.md @infinisil
 /doc/README.md @infinisil
 /nixos/README.md @infinisil
@@ -109,9 +99,6 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius
 /nixos/lib/systemd-*.nix                    @NixOS/systemd
 /pkgs/os-specific/linux/systemd             @NixOS/systemd
 
-# Systemd-boot
-/nixos/modules/system/boot/loader/systemd-boot      @JulienMalka
-
 # Images and installer media
 /nixos/modules/installer/cd-dvd/            @samueldr
 /nixos/modules/installer/sd-card/           @samueldr
@@ -157,7 +144,7 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius
 /doc/languages-frameworks/rust.section.md @zowoq @winterqt @figsoda
 
 # C compilers
-/pkgs/development/compilers/gcc
+/pkgs/development/compilers/gcc @amjoseph-nixpkgs
 /pkgs/development/compilers/llvm @RaitoBezarius
 /pkgs/development/compilers/emscripten @raitobezarius
 /doc/languages-frameworks/emscripten.section.md @raitobezarius
@@ -170,8 +157,6 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius
 
 # Browsers
 /pkgs/applications/networking/browsers/firefox @mweinelt
-/pkgs/applications/networking/browsers/chromium @emilylange
-/nixos/tests/chromium.nix @emilylange
 
 # Certificate Authorities
 pkgs/data/misc/cacert/ @ajs124 @lukegb @mweinelt
@@ -219,7 +204,6 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /nixos/modules/services/networking/ntp @thoughtpolice
 
 # Network
-/pkgs/tools/networking/octodns @Janik-Haag
 /pkgs/tools/networking/kea/default.nix @mweinelt
 /pkgs/tools/networking/babeld/default.nix @mweinelt
 /nixos/modules/services/networking/babeld.nix @mweinelt
@@ -274,6 +258,13 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/development/php-packages                    @aanderse @drupol @etu @globin @ma27 @talyz
 /pkgs/top-level/php-packages.nix         @jtojnar @aanderse @drupol @etu @globin @ma27 @talyz
 
+# Podman, CRI-O modules and related
+/nixos/modules/virtualisation/containers.nix @adisbladis
+/nixos/modules/virtualisation/cri-o.nix      @adisbladis
+/nixos/modules/virtualisation/podman         @adisbladis
+/nixos/tests/cri-o.nix                       @adisbladis
+/nixos/tests/podman                          @adisbladis
+
 # Docker tools
 /pkgs/build-support/docker                   @roberth
 /nixos/tests/docker-tools*                   @roberth
@@ -331,16 +322,15 @@ pkgs/applications/version-management/forgejo @bendlas @emilylange
 /pkgs/development/ocaml-modules     @ulrikstrid
 
 # ZFS
-pkgs/os-specific/linux/zfs/2_1.nix        @raitobezarius
-pkgs/os-specific/linux/zfs/generic.nix    @raitobezarius
+pkgs/os-specific/linux/zfs                @raitobezarius
+nixos/lib/make-single-disk-zfs-image.nix  @raitobezarius
+nixos/lib/make-multi-disk-zfs-image.nix   @raitobezarius
 nixos/modules/tasks/filesystems/zfs.nix   @raitobezarius
 nixos/tests/zfs.nix                       @raitobezarius
 
 # Zig
-/pkgs/development/compilers/zig @figsoda
-/doc/hooks/zig.section.md       @figsoda
+/pkgs/development/compilers/zig @AndersonTorres @figsoda
+/doc/hooks/zig.section.md @AndersonTorres @figsoda
 
-# Buildbot
-nixos/modules/services/continuous-integration/buildbot @Mic92 @zowoq
-nixos/tests/buildbot.nix                               @Mic92 @zowoq
-pkgs/development/tools/continuous-integration/buildbot @Mic92 @zowoq
+# Linux Kernel
+pkgs/os-specific/linux/kernel/manual-config.nix   @amjoseph-nixpkgs

.github/ISSUE_TEMPLATE/bug_report.md

@@ -40,7 +40,7 @@ Please run `nix-shell -p nix-info --run "nix-info -m"` and paste the result.
 output here
 ```
 
----
+### Priorities
 
 Add a :+1: [reaction] to [issues you find important].
 

.github/ISSUE_TEMPLATE/build_failure.md

@@ -38,7 +38,7 @@ Please run `nix-shell -p nix-info --run "nix-info -m"` and paste the result.
 output here
 ```
 
----
+### Priorities
 
 Add a :+1: [reaction] to [issues you find important].
 

.github/ISSUE_TEMPLATE/missing_documentation.md

@@ -30,7 +30,7 @@ assignees: ''
 [open documentation issues]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+label%3A%229.needs%3A+documentation%22
 [open documentation pull requests]: https://github.com/NixOS/nixpkgs/pulls?q=is%3Aopen+is%3Apr+label%3A%228.has%3A+documentation%22%2C%226.topic%3A+documentation%22
 
----
+### Priorities
 
 Add a :+1: [reaction] to [issues you find important].
 

.github/ISSUE_TEMPLATE/out_of_date_package_report.md

@@ -27,7 +27,7 @@ There's a high chance that you'll have the new version right away while helping
 
 Note for maintainers: Please tag this issue in your PR.
 
----
+**Priorities**
 
 Add a :+1: [reaction] to [issues you find important].
 

.github/ISSUE_TEMPLATE/packaging_request.md

@@ -18,7 +18,7 @@ assignees: ''
 * license: mit, bsd, gpl2+ , ...
 * platforms: unix, linux, darwin, ...
 
----
+**Priorities**
 
 Add a :+1: [reaction] to [issues you find important].
 

.github/ISSUE_TEMPLATE/unreproducible_package.md

@@ -86,7 +86,7 @@ nix log $(nix path-info --derivation nixpkgs#<package>)
 (please share the relevant fragment of the diffoscope output here, and any
 additional analysis you may have done)
 
----
+### Priorities
 
 Add a :+1: [reaction] to [issues you find important].
 

.github/PULL_REQUEST_TEMPLATE.md

@@ -24,7 +24,7 @@ For new packages please briefly describe the package or provide a link to its ho
   - made sure NixOS tests are [linked](https://nixos.org/manual/nixpkgs/unstable/#ssec-nixos-tests-linking) to the relevant packages
 - [ ] Tested compilation of all packages that depend on this change using `nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"`. Note: all changes have to be committed, also see [nixpkgs-review usage](https://github.com/Mic92/nixpkgs-review#usage)
 - [ ] Tested basic functionality of all binary files (usually in `./result/bin/`)
-- [24.05 Release Notes](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2405.section.md) (or backporting [23.05](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2305.section.md) and [23.11](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2311.section.md) Release notes)
+- [23.11 Release Notes](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2311.section.md) (or backporting [23.05 Release notes](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2305.section.md))
   - [ ] (Package updates) Added a release notes entry if the change is major or breaking
   - [ ] (Module updates) Added a release notes entry if the change is significant
   - [ ] (Module addition) Added a release notes entry if adding a new NixOS module
@@ -41,7 +41,7 @@ List of open PRs: https://github.com/NixOS/nixpkgs/pulls
 Reviewing guidelines: https://nixos.org/manual/nixpkgs/unstable/#chap-reviewing-contributions
 -->
 
----
+### Priorities
 
 Add a :+1: [reaction] to [pull requests you find important].
 

.github/labeler.yml

@@ -65,13 +65,6 @@
   - pkgs/top-level/haskell-packages.nix
   - pkgs/top-level/release-haskell.nix
 
-"6.topic: jupyter":
-  - pkgs/development/python-modules/jupyter*/**/*
-  - pkgs/development/python-modules/mkdocs-jupyter/*
-  - nixos/modules/services/development/jupyter/**/*
-  - pkgs/applications/editors/jupyter-kernels/**/*
-  - pkgs/applications/editors/jupyter/**/*
-
 "6.topic: kernel":
   - pkgs/build-support/kernel/**/*
   - pkgs/os-specific/linux/kernel/**/*

.github/workflows/backport.yml

@@ -20,11 +20,11 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@v4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Create backport PRs
-        uses: korthout/backport-action@08bafb375e6e9a9a2b53a744b987e5d81a133191 # v2.1.1
+        uses: korthout/backport-action@v2.1.1
         with:
           # Config README: https://github.com/korthout/backport-action#backport-action
           copy_labels_pattern: 'severity:\ssecurity'

.github/workflows/basic-eval.yml

@@ -18,9 +18,9 @@ jobs:
     runs-on: ubuntu-latest
     # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback
     steps:
-    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-    - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
-    - uses: cachix/cachix-action@18cf96c7c98e048e10a83abd92116114cd8504be # v14
+    - uses: actions/checkout@v4
+    - uses: cachix/install-nix-action@v23
+    - uses: cachix/cachix-action@v12
       with:
         # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
         name: nixpkgs-ci

.github/workflows/check-by-name.yml

@@ -1,42 +1,28 @@
 # Checks pkgs/by-name (see pkgs/by-name/README.md)
 # using the nixpkgs-check-by-name tool (see pkgs/test/nixpkgs-check-by-name)
-#
-# When you make changes to this workflow, also update pkgs/test/nixpkgs-check-by-name/scripts/run-local.sh adequately
 name: Check pkgs/by-name
 
-# The tool is pinned to a pre-built version on Hydra,
-# see pkgs/test/nixpkgs-check-by-name/scripts/README.md
+# The pre-built tool is fetched from a channel,
+# making it work predictable on all PRs.
 on:
   # Using pull_request_target instead of pull_request avoids having to approve first time contributors
   pull_request_target
 
-permissions:
-  # We need this permission to cancel the workflow run if there's a merge conflict
-  actions: write
+# The tool doesn't need any permissions, it only outputs success or not based on the checkout
+permissions: {}
 
 jobs:
   check:
     # This is x86_64-linux, for which the tool is always prebuilt on the nixos-* channels,
     # as specified in nixos/release-combined.nix
     runs-on: ubuntu-latest
-    # This should take 1 minute at most, but let's be generous.
-    # The default of 6 hours is definitely too long
-    timeout-minutes: 10
     steps:
-      # This step has to be in this file,
-      # because it's needed to determine which revision of the repository to fetch,
-      # and we can only use other files from the repository once it's fetched.
       - name: Resolving the merge commit
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           # This checks for mergeability of a pull request as recommended in
           # https://docs.github.com/en/rest/guides/using-the-rest-api-to-interact-with-your-git-database?apiVersion=2022-11-28#checking-mergeability-of-pull-requests
-
-          # Retry the API query this many times
-          retryCount=3
-          # Start with 5 seconds, but double every retry
-          retryInterval=5
           while true; do
             echo "Checking whether the pull request can be merged"
             prInfo=$(gh api \
@@ -47,19 +33,10 @@ jobs:
             mergedSha=$(jq -r .merge_commit_sha <<< "$prInfo")
 
             if [[ "$mergeable" == "null" ]]; then
-              if (( retryCount == 0 )); then
-                echo "Not retrying anymore, probably GitHub is having internal issues"
-                exit 1
-              else
-                (( retryCount -= 1 )) || true
-
-                # null indicates that GitHub is still computing whether it's mergeable
-                # Wait a couple seconds before trying again
-                echo "GitHub is still computing whether this PR can be merged, waiting $retryInterval seconds before trying again ($retryCount retries left)"
-                sleep "$retryInterval"
-
-                (( retryInterval *= 2 )) || true
-              fi
+              # null indicates that GitHub is still computing whether it's mergeable
+              # Wait a couple seconds before trying again
+              echo "GitHub is still computing whether this PR can be merged, waiting 5 seconds before trying again"
+              sleep 5
             else
               break
             fi
@@ -68,42 +45,135 @@ jobs:
           if [[ "$mergeable" == "true" ]]; then
             echo "The PR can be merged, checking the merge commit $mergedSha"
           else
-            echo "The PR cannot be merged, it has a merge conflict, cancelling the workflow.."
-            gh api \
-              --method POST \
-              -H "Accept: application/vnd.github+json" \
-              -H "X-GitHub-Api-Version: 2022-11-28" \
-              /repos/"$GITHUB_REPOSITORY"/actions/runs/"$GITHUB_RUN_ID"/cancel
-            sleep 60
-            # If it's still not canceled after a minute, something probably went wrong, just exit
+            echo "The PR cannot be merged, it has a merge conflict"
             exit 1
           fi
           echo "mergedSha=$mergedSha" >> "$GITHUB_ENV"
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@v4
         with:
           # pull_request_target checks out the base branch by default
           ref: ${{ env.mergedSha }}
           # Fetches the merge commit and its parents
           fetch-depth: 2
-      - name: Checking out base branch
+      - name: Determining PR git hashes
         run: |
-          base=$(mktemp -d)
-          git worktree add "$base" "$(git rev-parse HEAD^1)"
-          echo "base=$base" >> "$GITHUB_ENV"
-      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
-      - name: Fetching the pinned tool
-        # Update the pinned version using pkgs/test/nixpkgs-check-by-name/scripts/update-pinned-tool.sh
+          # For pull_request_target this is the same as $GITHUB_SHA
+          echo "baseSha=$(git rev-parse HEAD^1)" >> "$GITHUB_ENV"
+
+          echo "headSha=$(git rev-parse HEAD^2)" >> "$GITHUB_ENV"
+      - uses: cachix/install-nix-action@v23
+      - name: Determining channel to use for dependencies
         run: |
-          # Get the direct /nix/store path from the pin to avoid having to evaluate Nixpkgs
-          toolPath=$(jq -r '."ci-path"' pkgs/test/nixpkgs-check-by-name/scripts/pinned-tool.json)
-          # This asks the substituter for the path, which should be there because Hydra will have pre-built and pushed it
-          nix-store --realise "$toolPath" --add-root result
+          echo "Determining the preferred channel to use for PR base branch $GITHUB_BASE_REF"
+          if [[ "$GITHUB_BASE_REF" =~ ^(release|staging|staging-next)-([0-9][0-9]\.[0-9][0-9])$ ]]; then
+              # Use the release channel for all PRs to release-XX.YY, staging-XX.YY and staging-next-XX.YY
+              channel=nixos-${BASH_REMATCH[2]}
+              echo "PR is for a release branch, preferred channel is $channel"
+          else
+              # Use the nixos-unstable channel for all other PRs
+              channel=nixos-unstable
+              echo "PR is for a non-release branch, preferred channel is $channel"
+          fi
+          # Check that the channel exists. It doesn't exist for fresh release branches
+          if ! curl -fSs "https://channels.nixos.org/$channel"; then
+            # Fall back to nixos-unstable, makes sense for fresh release branches
+            echo "Preferred channel $channel could not be fetched, falling back to nixos-unstable"
+            channel=nixos-unstable
+          fi
+          echo "channel=$channel" >> "$GITHUB_ENV"
+      - name: Fetching latest version of channel
+        run: |
+          echo "Fetching latest version of channel $channel"
+          # This is probably the easiest way to get Nix to output the path to a downloaded channel!
+          nixpkgs=$(nix-instantiate --find-file nixpkgs -I nixpkgs=channel:"$channel")
+          # This file only exists in channels
+          rev=$(<"$nixpkgs"/.git-revision)
+          echo "Channel $channel is at revision $rev"
+          echo "nixpkgs=$nixpkgs" >> "$GITHUB_ENV"
+          echo "rev=$rev" >> "$GITHUB_ENV"
+      - name: Fetching pre-built nixpkgs-check-by-name from the channel
+        run: |
+          echo "Fetching pre-built nixpkgs-check-by-name from channel $channel at revision $rev"
+          # Passing --max-jobs 0 makes sure that we won't build anything
+          nix-build "$nixpkgs" -A tests.nixpkgs-check-by-name --max-jobs 0
       - name: Running nixpkgs-check-by-name
         run: |
-          if result/bin/nixpkgs-check-by-name --base "$base" .; then
-            exit 0
+          echo "Checking whether the check succeeds on the base branch $GITHUB_BASE_REF"
+          git checkout -q "$baseSha"
+          if baseOutput=$(result/bin/nixpkgs-check-by-name . 2>&1); then
+            baseSuccess=1
           else
-            exitCode=$?
-            echo "To run locally: ./maintainers/scripts/check-by-name.sh $GITHUB_BASE_REF https://github.com/$GITHUB_REPOSITORY.git"
-            exit "$exitCode"
+            baseSuccess=
           fi
+          printf "%s\n" "$baseOutput"
+
+          echo "Checking whether the check would succeed after merging this pull request"
+          git checkout -q "$mergedSha"
+          if mergedOutput=$(result/bin/nixpkgs-check-by-name . 2>&1); then
+            mergedSuccess=1
+            exitCode=0
+          else
+            mergedSuccess=
+            exitCode=1
+          fi
+          printf "%s\n" "$mergedOutput"
+
+          resultToEmoji() {
+            if [[ -n "$1" ]]; then
+              echo ":heavy_check_mark:"
+            else
+              echo ":x:"
+            fi
+          }
+
+          # Print a markdown summary in GitHub actions
+          {
+            echo "| Nixpkgs version | Check result |"
+            echo "| --- | --- |"
+            echo "| Latest base commit | $(resultToEmoji "$baseSuccess") |"
+            echo "| After merging this PR | $(resultToEmoji "$mergedSuccess") |"
+            echo ""
+
+            if [[ -n "$baseSuccess" ]]; then
+              if [[ -n "$mergedSuccess" ]]; then
+                echo "The check succeeds on both the base branch and after merging this PR"
+              else
+                echo "The check succeeds on the base branch, but would fail after merging this PR:"
+                echo "\`\`\`"
+                echo "$mergedOutput"
+                echo "\`\`\`"
+                echo ""
+              fi
+            else
+              if [[ -n "$mergedSuccess" ]]; then
+                echo "The check fails on the base branch, but this PR fixes it, nicely done!"
+              else
+                echo "The check fails on both the base branch and after merging this PR, unknown if only this PRs changes would satisfy the check, the base branch needs to be fixed first."
+                echo ""
+                echo "Failure on the base branch:"
+                echo "\`\`\`"
+                echo "$baseOutput"
+                echo "\`\`\`"
+                echo ""
+                echo "Failure after merging this PR:"
+                echo "\`\`\`"
+                echo "$mergedOutput"
+                echo "\`\`\`"
+                echo ""
+              fi
+            fi
+
+            echo "### Details"
+            echo "- nixpkgs-check-by-name tool:"
+            echo "  - Channel: $channel"
+            echo "  - Nixpkgs commit: [$rev](https://github.com/${GITHUB_REPOSITORY}/commit/$rev)"
+            echo "  - Store path: \`$(realpath result)\`"
+            echo "- Tested Nixpkgs:"
+            echo "  - Base branch: $GITHUB_BASE_REF"
+            echo "  - Latest base branch commit: [$baseSha](https://github.com/${GITHUB_REPOSITORY}/commit/$baseSha)"
+            echo "  - Latest PR commit: [$headSha](https://github.com/${GITHUB_REPOSITORY}/commit/$headSha)"
+            echo "  - Merge commit: [$mergedSha](https://github.com/${GITHUB_REPOSITORY}/commit/$mergedSha)"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          exit "$exitCode"
+

.github/workflows/check-maintainers-sorted.yaml

@@ -12,11 +12,11 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@v4
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+      - uses: cachix/install-nix-action@v23
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true

.github/workflows/editorconfig.yml

@@ -24,11 +24,11 @@ jobs:
     - name: print list of changed files
       run: |
         cat "$HOME/changed_files"
-    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+    - uses: actions/checkout@v4
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge
-    - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+    - uses: cachix/install-nix-action@v23
       with:
         # nixpkgs commit is pinned so that it doesn't break
         # editorconfig-checker 2.4.0

.github/workflows/labels.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
     steps:
-    - uses: actions/labeler@ac9175f8a1f3625fd0d4fb234536d26811351594 # v4.3.0
+    - uses: actions/labeler@v4
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         sync-labels: true

.github/workflows/manual-nixos.yml

@@ -14,15 +14,15 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@v4
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+      - uses: cachix/install-nix-action@v23
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
-      - uses: cachix/cachix-action@18cf96c7c98e048e10a83abd92116114cd8504be # v14
+      - uses: cachix/cachix-action@v12
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
           name: nixpkgs-ci

.github/workflows/manual-nixpkgs.yml

@@ -15,18 +15,18 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@v4
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+      - uses: cachix/install-nix-action@v23
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
-      - uses: cachix/cachix-action@18cf96c7c98e048e10a83abd92116114cd8504be # v14
+      - uses: cachix/cachix-action@v12
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
           name: nixpkgs-ci
           signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
       - name: Building Nixpkgs manual
-        run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true pkgs/top-level/release.nix -A manual -A manual.tests
+        run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true pkgs/top-level/release.nix -A manual

.github/workflows/nix-parse.yml

@@ -1,42 +0,0 @@
-name: "Check whether nix files are parseable"
-
-permissions: read-all
-
-on:
-  # avoids approving first time contributors
-  pull_request_target:
-    branches-ignore:
-      - 'release-**'
-
-jobs:
-  tests:
-    runs-on: ubuntu-latest
-    if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
-    steps:
-    - name: Get list of changed files from PR
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        gh api \
-          repos/NixOS/nixpkgs/pulls/${{github.event.number}}/files --paginate \
-          | jq --raw-output '.[] | select(.status != "removed" and (.filename | endswith(".nix"))) | .filename' \
-          > "$HOME/changed_files"
-        if [[ -s "$HOME/changed_files" ]]; then
-          echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"
-        fi
-    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      with:
-        # pull_request_target checks out the base branch by default
-        ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}
-    - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
-      with:
-        nix_path: nixpkgs=channel:nixpkgs-unstable
-    - name: Parse all changed or added nix files
-      run: |
-        ret=0
-        while IFS= read -r file; do
-          out="$(nix-instantiate --parse "$file")" || { echo "$out" && ret=1; }
-        done < "$HOME/changed_files"
-        exit "$ret"
-      if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}

.github/workflows/periodic-merge-24h.yml

@@ -13,7 +13,6 @@ on:
     # * is a special character in YAML so you have to quote this string
     # Merge every 24 hours
     - cron:  '0 0 * * *'
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -39,16 +38,12 @@ jobs:
             into: staging-next-23.05
           - from: staging-next-23.05
             into: staging-23.05
-          - from: release-23.11
-            into: staging-next-23.11
-          - from: staging-next-23.11
-            into: staging-23.11
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@v4
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
-        uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
+        uses: devmasx/merge-branch@1.4.0
         with:
           type: now
           from_branch: ${{ matrix.pairs.from }}
@@ -56,7 +51,7 @@ jobs:
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Comment on failure
-        uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2 # v3.1.0
+        uses: peter-evans/create-or-update-comment@v3
         if: ${{ failure() }}
         with:
           issue-number: 105153

.github/workflows/periodic-merge-6h.yml

@@ -13,7 +13,6 @@ on:
     # * is a special character in YAML so you have to quote this string
     # Merge every 6 hours
     - cron:  '0 */6 * * *'
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -39,10 +38,10 @@ jobs:
             into: staging
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@v4
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
-        uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
+        uses: devmasx/merge-branch@1.4.0
         with:
           type: now
           from_branch: ${{ matrix.pairs.from }}
@@ -50,7 +49,7 @@ jobs:
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Comment on failure
-        uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2 # v3.1.0
+        uses: peter-evans/create-or-update-comment@v3
         if: ${{ failure() }}
         with:
           issue-number: 105153

.github/workflows/update-terraform-providers.yml

@@ -16,8 +16,8 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.ref == 'refs/heads/master' # ensure workflow_dispatch only runs on master
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: cachix/install-nix-action@6004951b182f8860210c8d6f0d808ec5b1a33d28 # v25
+      - uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v23
         with:
           nix_path: nixpkgs=channel:nixpkgs-unstable
       - name: setup
@@ -46,7 +46,7 @@ jobs:
         run: |
           git clean -f
       - name: create PR
-        uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38 # v5.0.2
+        uses: peter-evans/create-pull-request@v5
         with:
           body: |
             Automatic update by [update-terraform-providers](https://github.com/NixOS/nixpkgs/blob/master/.github/workflows/update-terraform-providers.yml) action.
@@ -60,7 +60,7 @@ jobs:
 
             Check that all providers build with:
             ```
-            @ofborg build opentofu.full
+            @ofborg build terraform.full
             ```
             If there is more than ten commits in the PR `ofborg` won't build it automatically and you will need to use the above command.
           branch: terraform-providers-update

.mailmap

@@ -12,5 +12,3 @@ Sandro Jäckel <sandro.jaeckel@gmail.com> <sandro.jaeckel@sap.com>
 superherointj <5861043+superherointj@users.noreply.github.com>
 Vladimír Čunát <v@cunat.cz> <vcunat@gmail.com>
 Vladimír Čunát <v@cunat.cz> <vladimir.cunat@nic.cz>
-Yifei Sun <ysun@hey.com> StepBroBD <Hi@StepBroBD.com>
-Yifei Sun <ysun@hey.com> <ysun+git@stepbrobd.com>

.version

@@ -1 +1 @@
-24.05
+23.11

CONTRIBUTING.md

@@ -26,7 +26,7 @@ This file contains general contributing information, but individual parts also h
 
 This section describes in some detail how changes can be made and proposed with pull requests.
 
-> [!Note]
+> **Note**
 > Be aware that contributing implies licensing those contributions under the terms of [COPYING](./COPYING), an MIT-like license.
 
 0. Set up a local version of Nixpkgs to work with using GitHub and Git
@@ -273,7 +273,7 @@ Once a pull request has been merged into `master`, a backport pull request to th
 
 ### Automatically backporting changes
 
-> [!Note]
+> **Note**
 > You have to be a [Nixpkgs maintainer](./maintainers) to automatically create a backport pull request.
 
 Add the [`backport release-YY.MM` label](https://github.com/NixOS/nixpkgs/labels?q=backport) to the pull request on the `master` branch.
@@ -285,17 +285,16 @@ This can be done on both open or already merged pull requests.
 To manually create a backport pull request, follow [the standard pull request process][pr-create], with these notable differences:
 
 - Use `release-YY.MM` for the base branch, both for the local branch and the pull request.
-
-> [!Warning]
-> Do not use the `nixos-YY.MM` branch, that is a branch pointing to the tested release channel commit
+  > **Warning**
+  > Do not use the `nixos-YY.MM` branch, that is a branch pointing to the tested release channel commit
 
 - Instead of manually making and committing the changes, use [`git cherry-pick -x`](https://git-scm.com/docs/git-cherry-pick) for each commit from the pull request you'd like to backport.
   Either `git cherry-pick -x <commit>` when the reason for the backport is obvious (such as minor versions, fixes, etc.), otherwise use `git cherry-pick -xe <commit>` to add a reason for the backport to the commit message.
   Here is [an example](https://github.com/nixos/nixpkgs/commit/5688c39af5a6c5f3d646343443683da880eaefb8) of this.
 
-> [!Warning]
-> Ensure the commits exists on the master branch.
-> In the case of squashed or rebased merges, the commit hash will change and the new commits can be found in the merge message at the bottom of the master pull request.
+  > **Warning**
+  > Ensure the commits exists on the master branch.
+  > In the case of squashed or rebased merges, the commit hash will change and the new commits can be found in the merge message at the bottom of the master pull request.
 
 - In the pull request description, link to the original pull request to `master`.
   The pull request title should include `[YY.MM]` matching the release you're backporting to.
@@ -306,7 +305,7 @@ To manually create a backport pull request, follow [the standard pull request pr
 ## How to review pull requests
 [pr-review]: #how-to-review-pull-requests
 
-> [!Warning]
+> **Warning**
 > The following section is a draft, and the policy for reviewing is still being discussed in issues such as [#11166](https://github.com/NixOS/nixpkgs/issues/11166) and [#20836](https://github.com/NixOS/nixpkgs/issues/20836).
 
 The Nixpkgs project receives a fairly high number of contributions via GitHub pull requests. Reviewing and approving these is an important task and a way to contribute to the project.
@@ -323,7 +322,7 @@ All the review template samples provided in this section are generic and meant a
 
 To get more information about how to review specific parts of Nixpkgs, refer to the documents linked to in the [overview section][overview].
 
-If a pull request contains documentation changes that might require feedback from the documentation team, ping [@NixOS/documentation-reviewers](https://github.com/orgs/nixos/teams/documentation-reviewers) on the pull request.
+If a pull request contains documentation changes that might require feedback from the documentation team, ping @NixOS/documentation-team on the pull request.
 
 If you consider having enough knowledge and experience in a topic and would like to be a long-term reviewer for related submissions, please contact the current reviewers for that topic. They will give you information about the reviewing process. The main reviewers for a topic can be hard to find as there is no list, but checking past pull requests to see who reviewed or git-blaming the code to see who committed to that topic can give some hints.
 
@@ -361,7 +360,7 @@ See [Nix Channel Status](https://status.nixos.org/) for the current channels and
 Here's a brief overview of the main Git branches and what channels they're used for:
 
 - `master`: The main branch, used for the unstable channels such as `nixpkgs-unstable`, `nixos-unstable` and `nixos-unstable-small`.
-- `release-YY.MM` (e.g. `release-23.11`): The NixOS release branches, used for the stable channels such as `nixos-23.11`, `nixos-23.11-small` and `nixpkgs-23.11-darwin`.
+- `release-YY.MM` (e.g. `release-23.05`): The NixOS release branches, used for the stable channels such as `nixos-23.05`, `nixos-23.05-small` and `nixpkgs-23.05-darwin`.
 
 When a channel is updated, a corresponding Git branch is also updated to point to the corresponding commit.
 So e.g. the [`nixpkgs-unstable` branch](https://github.com/nixos/nixpkgs/tree/nixpkgs-unstable) corresponds to the Git commit from the [`nixpkgs-unstable` channel](https://channels.nixos.org/nixpkgs-unstable).
@@ -378,14 +377,14 @@ The staging workflow exists to batch Hydra builds of many packages together.
 It works by directing commits that cause [mass rebuilds][mass-rebuild] to a separate `staging` branch that isn't directly built by Hydra.
 Regularly, the `staging` branch is _manually_ merged into a `staging-next` branch to be built by Hydra using the [`nixpkgs:staging-next` jobset](https://hydra.nixos.org/jobset/nixpkgs/staging-next).
 The `staging-next` branch should then only receive direct commits in order to fix Hydra builds.
-Once it is verified that there are no major regressions, it is merged into `master` using [a pull request](https://github.com/NixOS/nixpkgs/pulls?q=head%3Astaging-next).
+Once it is verified that there are no major regressions, it is merged into `master` using [a pull requests](https://github.com/NixOS/nixpkgs/pulls?q=head%3Astaging-next).
 This is done manually in order to ensure it's a good use of Hydra's computing resources.
 By keeping the `staging-next` branch separate from `staging`, this batching does not block developers from merging changes into `staging`.
 
 In order for the `staging` and `staging-next` branches to be up-to-date with the latest commits on `master`, there are regular _automated_ merges from `master` into `staging-next` and `staging`.
 This is implemented using GitHub workflows [here](.github/workflows/periodic-merge-6h.yml) and [here](.github/workflows/periodic-merge-24h.yml).
 
-> [!Note]
+> **Note**
 > Changes must be sufficiently tested before being merged into any branch.
 > Hydra builds should not be used as testing platform.
 

doc/README.md

@@ -1,18 +1,14 @@
-# Contributing to the Nixpkgs reference manual
+# Contributing to the Nixpkgs manual
 
-This directory houses the sources files for the Nixpkgs reference manual.
-
-Going forward, it should only contain [reference](https://nix.dev/contributing/documentation/diataxis#reference) documentation.
-For tutorials, guides and explanations, contribute to <https://nix.dev/> instead.
-
-For documentation only relevant for contributors, use Markdown files and code comments in the source code.
-
-Rendered documentation:
-- [Unstable (from master)](https://nixos.org/manual/nixpkgs/unstable/)
-- [Stable (from latest release)](https://nixos.org/manual/nixpkgs/stable/)
+This directory houses the sources files for the Nixpkgs manual.
 
+You can find the [rendered documentation for Nixpkgs `unstable` on nixos.org](https://nixos.org/manual/nixpkgs/unstable/).
 The rendering tool is [nixos-render-docs](../pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs), sometimes abbreviated `nrd`.
 
+[Docs for Nixpkgs stable](https://nixos.org/manual/nixpkgs/stable/) are also available.
+
+If you're only getting started with Nix, go to [nixos.org/learn](https://nixos.org/learn).
+
 ## Contributing to this documentation
 
 You can quickly check your edits with `nix-build`:
@@ -52,7 +48,7 @@ It uses the widely compatible [header attributes](https://github.com/jgm/commonm
 ## Syntax {#sec-contributing-markup}
 ```
 
-> [!Note]
+> **Note**
 > NixOS option documentation does not support headings in general.
 
 #### Inline Anchors
@@ -106,19 +102,6 @@ The following are supported:
 - [`note`](https://tdg.docbook.org/tdg/5.0/note.html)
 - [`tip`](https://tdg.docbook.org/tdg/5.0/tip.html)
 - [`warning`](https://tdg.docbook.org/tdg/5.0/warning.html)
-- [`example`](https://tdg.docbook.org/tdg/5.0/example.html)
-
-Example admonitions require a title to work.
-If you don't provide one, the manual won't be built.
-
-```markdown
-::: {.example #ex-showing-an-example}
-
-# Title for this example
-
-Text for the example.
-:::
-```
 
 #### [Definition lists](https://github.com/jgm/commonmark-hs/blob/master/commonmark-extensions/test/definition_lists.md)
 
@@ -152,62 +135,3 @@ watermelon
     Closes #216321.
 
 - If the commit contains more than just documentation changes, follow the commit message format relevant for the rest of the changes.
-
-## Documentation conventions
-
-In an effort to keep the Nixpkgs manual in a consistent style, please follow the conventions below, unless they prevent you from properly documenting something.
-In that case, please open an issue about the particular documentation convention and tag it with a "needs: documentation" label.
-
-- Put each sentence in its own line.
-  This makes reviews and suggestions much easier, since GitHub's review system is based on lines.
-  It also helps identifying long sentences at a glance.
-
-- Use the [admonition syntax](#admonitions) for callouts and examples.
-
-- Provide at least one example per function, and make examples self-contained.
-  This is easier to understand for beginners.
-  It also helps with testing that it actually works – especially once we introduce automation.
-
-  Example code should be such that it can be passed to `pkgs.callPackage`.
-  Instead of something like:
-
-  ```nix
-  pkgs.dockerTools.buildLayeredImage {
-    name = "hello";
-    contents = [ pkgs.hello ];
-  }
-  ```
-
-  Write something like:
-
-  ```nix
-  { dockerTools, hello }:
-  dockerTools.buildLayeredImage {
-    name = "hello";
-    contents = [ hello ];
-  }
-  ```
-
-- Use [definition lists](#definition-lists) to document function arguments, and the attributes of such arguments. For example:
-
-  ```markdown
-  # pkgs.coolFunction
-
-  Description of what `coolFunction` does.
-  `coolFunction` expects a single argument which should be an attribute set, with the following possible attributes:
-
-  `name`
-
-  : The name of the resulting image.
-
-  `tag` _optional_
-
-  : Tag of the generated image.
-
-    _Default value:_ the output path's hash.
-
-  ```
-
-## Getting help
-
-If you need documentation-specific help or reviews, ping [@NixOS/documentation-reviewers](https://github.com/orgs/nixos/teams/documentation-reviewers) on your pull request.

doc/build-helpers/images/appimagetools.section.md

@@ -1,167 +1,48 @@
 # pkgs.appimageTools {#sec-pkgs-appimageTools}
 
-`pkgs.appimageTools` is a set of functions for extracting and wrapping [AppImage](https://appimage.org/) files.
-They are meant to be used if traditional packaging from source is infeasible, or if it would take too long.
-To quickly run an AppImage file, `pkgs.appimage-run` can be used as well.
+`pkgs.appimageTools` is a set of functions for extracting and wrapping [AppImage](https://appimage.org/) files. They are meant to be used if traditional packaging from source is infeasible, or it would take too long. To quickly run an AppImage file, `pkgs.appimage-run` can be used as well.
 
 ::: {.warning}
 The `appimageTools` API is unstable and may be subject to backwards-incompatible changes in the future.
 :::
 
+## AppImage formats {#ssec-pkgs-appimageTools-formats}
+
+There are different formats for AppImages, see [the specification](https://github.com/AppImage/AppImageSpec/blob/74ad9ca2f94bf864a4a0dac1f369dd4f00bd1c28/draft.md#image-format) for details.
+
+- Type 1 images are ISO 9660 files that are also ELF executables.
+- Type 2 images are ELF executables with an appended filesystem.
+
+They can be told apart with `file -k`:
+
+```ShellSession
+$ file -k type1.AppImage
+type1.AppImage: ELF 64-bit LSB executable, x86-64, version 1 (SYSV) ISO 9660 CD-ROM filesystem data 'AppImage' (Lepton 3.x), scale 0-0,
+spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.000000, dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.18, BuildID[sha1]=d629f6099d2344ad82818172add1d38c5e11bc6d, stripped\012- data
+
+$ file -k type2.AppImage
+type2.AppImage: ELF 64-bit LSB executable, x86-64, version 1 (SYSV) (Lepton 3.x), scale 232-60668, spot sensor temperature -4.187500, color scheme 15, show scale bar, calibration: offset -0.000000, slope 0.000000 (Lepton 2.x), scale 4111-45000, spot sensor temperature 412442.250000, color scheme 3, minimum point enabled, calibration: offset -75402534979642766821519867692934234112.000000, slope 5815371847733706829839455140374904832.000000, dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.18, BuildID[sha1]=79dcc4e55a61c293c5e19edbd8d65b202842579f, stripped\012- data
+```
+
+Note how the type 1 AppImage is described as an `ISO 9660 CD-ROM filesystem`, and the type 2 AppImage is not.
+
 ## Wrapping {#ssec-pkgs-appimageTools-wrapping}
 
-Use `wrapType2` to wrap any AppImage.
-This will create a FHS environment with many packages [expected to exist](https://github.com/AppImage/pkg2appimage/blob/master/excludelist) for the AppImage to work.
-`wrapType2` expects an argument with the `src` attribute, and either a `name` attribute or `pname` and `version` attributes.
-
-It will eventually call into [`buildFHSEnv`](#sec-fhs-environments), and any extra attributes in the argument to `wrapType2` will be passed through to it.
-This means that you can pass the `extraInstallCommands` attribute, for example, and it will have the same effect as described in [`buildFHSEnv`](#sec-fhs-environments).
-
-::: {.note}
-In the past, `appimageTools` provided both `wrapType1` and `wrapType2`, to be used depending on the type of AppImage that was being wrapped.
-However, [those were unified early 2020](https://github.com/NixOS/nixpkgs/pull/81833), meaning that both `wrapType1` and `wrapType2` have the same behaviour now.
-:::
-
-:::{.example #ex-wrapping-appimage-from-github}
-
-# Wrapping an AppImage from GitHub
+Depending on the type of AppImage you're wrapping, you'll have to use `wrapType1` or `wrapType2`.
 
 ```nix
-{ appimageTools, fetchurl }:
-let
-  pname = "nuclear";
-  version = "0.6.30";
-
+appimageTools.wrapType2 { # or wrapType1
+  name = "patchwork";
   src = fetchurl {
-    url = "https://github.com/nukeop/nuclear/releases/download/v${version}/${pname}-v${version}.AppImage";
-    hash = "sha256-he1uGC1M/nFcKpMM9JKY4oeexJcnzV0ZRxhTjtJz6xw=";
+    url = "https://github.com/ssbc/patchwork/releases/download/v3.11.4/Patchwork-3.11.4-linux-x86_64.AppImage";
+    hash = "sha256-OqTitCeZ6xmWbqYTXp8sDrmVgTNjPZNW0hzUPW++mq4=";
   };
-in
-appimageTools.wrapType2 {
-  inherit pname version src;
+  extraPkgs = pkgs: with pkgs; [ ];
 }
 ```
 
-:::
-
-The argument passed to `wrapType2` can also contain an `extraPkgs` attribute, which allows you to include additional packages inside the FHS environment your AppImage is going to run in.
-`extraPkgs` must be a function that returns a list of packages.
-There are a few ways to learn which dependencies an application needs:
-
-  - Looking through the extracted AppImage files, reading its scripts and running `patchelf` and `ldd` on its executables.
-    This can also be done in `appimage-run`, by setting `APPIMAGE_DEBUG_EXEC=bash`.
+- `name` specifies the name of the resulting image.
+- `src` specifies the AppImage file to extract.
+- `extraPkgs` allows you to pass a function to include additional packages inside the FHS environment your AppImage is going to run in. There are a few ways to learn which dependencies an application needs:
+  - Looking through the extracted AppImage files, reading its scripts and running `patchelf` and `ldd` on its executables. This can also be done in `appimage-run`, by setting `APPIMAGE_DEBUG_EXEC=bash`.
   - Running `strace -vfefile` on the wrapped executable, looking for libraries that can't be found.
-
-:::{.example #ex-wrapping-appimage-with-extrapkgs}
-
-# Wrapping an AppImage with extra packages
-
-```nix
-{ appimageTools, fetchurl }:
-let
-  pname = "irccloud";
-  version = "0.16.0";
-
-  src = fetchurl {
-    url = "https://github.com/irccloud/irccloud-desktop/releases/download/v${version}/IRCCloud-${version}-linux-x86_64.AppImage";
-    sha256 = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
-  };
-in appimageTools.wrapType2 {
-  inherit pname version src;
-  extraPkgs = pkgs: [ pkgs.at-spi2-core ];
-}
-```
-
-:::
-
-## Extracting {#ssec-pkgs-appimageTools-extracting}
-
-Use `extract` if you need to extract the contents of an AppImage.
-This is usually used in Nixpkgs to install extra files in addition to [wrapping](#ssec-pkgs-appimageTools-wrapping) the AppImage.
-`extract` expects an argument with the `src` attribute, and either a `name` attribute or `pname` and `version` attributes.
-
-::: {.note}
-In the past, `appimageTools` provided both `extractType1` and `extractType2`, to be used depending on the type of AppImage that was being extracted.
-However, [those were unified early 2020](https://github.com/NixOS/nixpkgs/pull/81572), meaning that both `extractType1` and `extractType2` have the same behaviour as `extract` now.
-:::
-
-:::{.example #ex-extracting-appimage}
-
-# Extracting an AppImage to install extra files
-
-This example was adapted from a real package in Nixpkgs to show how `extract` is usually used in combination with `wrapType2`.
-Note how `appimageContents` is used in `extraInstallCommands` to install additional files that were extracted from the AppImage.
-
-```nix
-{ appimageTools, fetchurl }:
-let
-  pname = "irccloud";
-  version = "0.16.0";
-
-  src = fetchurl {
-    url = "https://github.com/irccloud/irccloud-desktop/releases/download/v${version}/IRCCloud-${version}-linux-x86_64.AppImage";
-    sha256 = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
-  };
-
-  appimageContents = appimageTools.extract {
-    inherit pname version src;
-  };
-in appimageTools.wrapType2 {
-  inherit pname version src;
-
-  extraPkgs = pkgs: [ pkgs.at-spi2-core ];
-
-  extraInstallCommands = ''
-    mv $out/bin/${pname}-${version} $out/bin/${pname}
-    install -m 444 -D ${appimageContents}/irccloud.desktop $out/share/applications/irccloud.desktop
-    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
-      $out/share/icons/hicolor/512x512/apps/irccloud.png
-    substituteInPlace $out/share/applications/irccloud.desktop \
-      --replace 'Exec=AppRun' 'Exec=${pname}'
-  '';
-}
-```
-
-:::
-
-The argument passed to `extract` can also contain a `postExtract` attribute, which allows you to execute additional commands after the files are extracted from the AppImage.
-`postExtract` must be a string with commands to run.
-
-:::{.example #ex-extracting-appimage-with-postextract}
-
-# Extracting an AppImage to install extra files, using `postExtract`
-
-This is a rewrite of [](#ex-extracting-appimage) to use `postExtract`.
-
-```nix
-{ appimageTools, fetchurl }:
-let
-  pname = "irccloud";
-  version = "0.16.0";
-
-  src = fetchurl {
-    url = "https://github.com/irccloud/irccloud-desktop/releases/download/v${version}/IRCCloud-${version}-linux-x86_64.AppImage";
-    sha256 = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
-  };
-
-  appimageContents = appimageTools.extract {
-    inherit pname version src;
-    postExtract = ''
-      substituteInPlace $out/irccloud.desktop --replace 'Exec=AppRun' 'Exec=${pname}'
-    '';
-  };
-in appimageTools.wrapType2 {
-  inherit pname version src;
-
-  extraPkgs = pkgs: [ pkgs.at-spi2-core ];
-
-  extraInstallCommands = ''
-    mv $out/bin/${pname}-${version} $out/bin/${pname}
-    install -m 444 -D ${appimageContents}/irccloud.desktop $out/share/applications/irccloud.desktop
-    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
-      $out/share/icons/hicolor/512x512/apps/irccloud.png
-  '';
-}
-```
-
-:::

doc/build-helpers/images/binarycache.section.md

@@ -1,58 +1,49 @@
 # pkgs.mkBinaryCache {#sec-pkgs-binary-cache}
 
-`pkgs.mkBinaryCache` is a function for creating Nix flat-file binary caches.
-Such a cache exists as a directory on disk, and can be used as a Nix substituter by passing `--substituter file:///path/to/cache` to Nix commands.
+`pkgs.mkBinaryCache` is a function for creating Nix flat-file binary caches. Such a cache exists as a directory on disk, and can be used as a Nix substituter by passing `--substituter file:///path/to/cache` to Nix commands.
 
-Nix packages are most commonly shared between machines using [HTTP, SSH, or S3](https://nixos.org/manual/nix/stable/package-management/sharing-packages.html), but a flat-file binary cache can still be useful in some situations.
-For example, you can copy it directly to another machine, or make it available on a network file system.
-It can also be a convenient way to make some Nix packages available inside a container via bind-mounting.
+Nix packages are most commonly shared between machines using [HTTP, SSH, or S3](https://nixos.org/manual/nix/stable/package-management/sharing-packages.html), but a flat-file binary cache can still be useful in some situations. For example, you can copy it directly to another machine, or make it available on a network file system. It can also be a convenient way to make some Nix packages available inside a container via bind-mounting.
 
-`mkBinaryCache` expects an argument with the `rootPaths` attribute.
-`rootPaths` must be a list of derivations.
-The transitive closure of these derivations' outputs will be copied into the cache.
+Note that this function is meant for advanced use-cases. The more idiomatic way to work with flat-file binary caches is via the [nix-copy-closure](https://nixos.org/manual/nix/stable/command-ref/nix-copy-closure.html) command. You may also want to consider [dockerTools](#sec-pkgs-dockerTools) for your containerization needs.
 
-::: {.note}
-This function is meant for advanced use cases.
-The more idiomatic way to work with flat-file binary caches is via the [nix-copy-closure](https://nixos.org/manual/nix/stable/command-ref/nix-copy-closure.html) command.
-You may also want to consider [dockerTools](#sec-pkgs-dockerTools) for your containerization needs.
-:::
-
-[]{#sec-pkgs-binary-cache-example}
-:::{.example #ex-mkbinarycache-copying-package-closure}
-
-# Copying a package and its closure to another machine with `mkBinaryCache`
+## Example {#sec-pkgs-binary-cache-example}
 
 The following derivation will construct a flat-file binary cache containing the closure of `hello`.
 
 ```nix
-{ mkBinaryCache, hello }:
 mkBinaryCache {
   rootPaths = [hello];
 }
 ```
 
-Build the cache on a machine.
-Note that the command still builds the exact nix package above, but adds some boilerplate to build it directly from an expression.
+- `rootPaths` specifies a list of root derivations. The transitive closure of these derivations' outputs will be copied into the cache.
+
+Here's an example of building and using the cache.
+
+Build the cache on one machine, `host1`:
 
 ```shellSession
-$ nix-build -E 'let pkgs = import <nixpkgs> {}; in pkgs.callPackage ({ mkBinaryCache, hello }: mkBinaryCache { rootPaths = [hello]; }) {}'
-/nix/store/azf7xay5xxdnia4h9fyjiv59wsjdxl0g-binary-cache
+nix-build -E 'with import <nixpkgs> {}; mkBinaryCache { rootPaths = [hello]; }'
 ```
 
-Copy the resulting directory to another machine, which we'll call `host2`:
-
 ```shellSession
-$ scp result host2:/tmp/hello-cache
+/nix/store/cc0562q828rnjqjyfj23d5q162gb424g-binary-cache
 ```
 
-At this point, the cache can be used as a substituter when building derivations on `host2`:
+Copy the resulting directory to the other machine, `host2`:
 
 ```shellSession
-$ nix-build -A hello '<nixpkgs>' \
+scp result host2:/tmp/hello-cache
+```
+
+Substitute the derivation using the flat-file binary cache on the other machine, `host2`:
+```shellSession
+nix-build -A hello '<nixpkgs>' \
   --option require-sigs false \
   --option trusted-substituters file:///tmp/hello-cache \
   --option substituters file:///tmp/hello-cache
-/nix/store/zhl06z4lrfrkw5rp0hnjjfrgsclzvxpm-hello-2.12.1
 ```
 
-:::
+```shellSession
+/nix/store/gl5a41azbpsadfkfmbilh9yk40dh5dl0-hello-2.12.1
+```

doc/build-helpers/images/dockertools.section.md

@@ -1,228 +1,33 @@
 # pkgs.dockerTools {#sec-pkgs-dockerTools}
 
-`pkgs.dockerTools` is a set of functions for creating and manipulating Docker images according to the [Docker Image Specification v1.3.0](https://github.com/moby/moby/blob/46f7ab808b9504d735d600e259ca0723f76fb164/image/spec/spec.md#image-json-field-descriptions).
-Docker itself is not used to perform any of the operations done by these functions.
+`pkgs.dockerTools` is a set of functions for creating and manipulating Docker images according to the [Docker Image Specification v1.2.0](https://github.com/moby/moby/blob/master/image/spec/v1.2.md#docker-image-specification-v120). Docker itself is not used to perform any of the operations done by these functions.
 
 ## buildImage {#ssec-pkgs-dockerTools-buildImage}
 
-This function builds a Docker-compatible repository tarball containing a single image.
-As such, the result is suitable for being loaded in Docker with `docker load` (see [](#ex-dockerTools-buildImage) for how to do this).
+This function is analogous to the `docker build` command, in that it can be used to build a Docker-compatible repository tarball containing a single image with one or multiple layers. As such, the result is suitable for being loaded in Docker with `docker load`.
 
-This function will create a single layer for all files (and dependencies) that are specified in its argument.
-Only new dependencies that are not already in the existing layers will be copied.
-If you prefer to create multiple layers for the files and dependencies you want to add to the image, see [](#ssec-pkgs-dockerTools-buildLayeredImage) or [](#ssec-pkgs-dockerTools-streamLayeredImage) instead.
+The parameters of `buildImage` with relative example values are described below:
 
-This function allows a script to be run during the layer generation process, allowing custom behaviour to affect the final results of the image (see the documentation of the `runAsRoot` and `extraCommands` attributes).
-
-The resulting repository tarball will list a single image as specified by the `name` and `tag` attributes.
-By default, that image will use a static creation date (see documentation for the `created` attribute).
-This allows `buildImage` to produce reproducible images.
-
-:::{.tip}
-When running an image built with `buildImage`, you might encounter certain errors depending on what you included in the image, especially if you did not start with any base image.
-
-If you encounter errors similar to `getProtocolByName: does not exist (no such protocol name: tcp)`, you may need to add the contents of `pkgs.iana-etc` in the `copyToRoot` attribute.
-Similarly, if you encounter errors similar to `Error_Protocol ("certificate has unknown CA",True,UnknownCa)`, you may need to add the contents of `pkgs.cacert` in the `copyToRoot` attribute.
-:::
-
-### Inputs {#ssec-pkgs-dockerTools-buildImage-inputs}
-
-`buildImage` expects an argument with the following attributes:
-
-`name` (String)
-
-: The name of the generated image.
-
-`tag` (String or Null; _optional_)
-
-: Tag of the generated image.
-  If `null`, the hash of the nix derivation will be used as the tag.
-
-  _Default value:_ `null`.
-
-`fromImage` (Path or Null; _optional_)
-
-: The repository tarball of an image to be used as the base for the generated image.
-  It must be a valid Docker image, such as one exported by `docker save`, or another image built with the `dockerTools` utility functions.
-  This can be seen as an equivalent of `FROM fromImage` in a `Dockerfile`.
-  A value of `null` can be seen as an equivalent of `FROM scratch`.
-
-  If specified, the layer created by `buildImage` will be appended to the layers defined in the base image, resulting in an image with at least two layers (one or more layers from the base image, and the layer created by `buildImage`).
-  Otherwise, the resulting image with contain the single layer created by `buildImage`.
-
-  _Default value:_ `null`.
-
-`fromImageName` (String or Null; _optional_)
-
-: Used to specify the image within the repository tarball in case it contains multiple images.
-  A value of `null` means that `buildImage` will use the first image available in the repository.
-
-  :::{.note}
-  This must be used with `fromImageTag`. Using only `fromImageName` without `fromImageTag` will make `buildImage` use the first image available in the repository.
-  :::
-
-  _Default value:_ `null`.
-
-`fromImageTag` (String or Null; _optional_)
-
-: Used to specify the image within the repository tarball in case it contains multiple images.
-  A value of `null` means that `buildImage` will use the first image available in the repository.
-
-  :::{.note}
-  This must be used with `fromImageName`. Using only `fromImageTag` without `fromImageName` will make `buildImage` use the first image available in the repository
-  :::
-
-  _Default value:_ `null`.
-
-`copyToRoot` (Path, List of Paths, or Null; _optional_)
-
-: Files to add to the generated image.
-  Anything that coerces to a path (e.g. a derivation) can also be used.
-  This can be seen as an equivalent of `ADD contents/ /` in a `Dockerfile`.
-
-  _Default value:_ `null`.
-
-`keepContentsDirlinks` (Boolean; _optional_)
-
-: When adding files to the generated image (as specified by `copyToRoot`), this attribute controls whether to preserve symlinks to directories.
-  If `false`, the symlinks will be transformed into directories.
-  This behaves the same as `rsync -k` when `keepContentsDirlinks` is `false`, and the same as `rsync -K` when `keepContentsDirlinks` is `true`.
-
-  _Default value:_ `false`.
-
-`runAsRoot` (String or Null; _optional_)
-
-: A bash script that will run as root inside a VM that contains the existing layers of the base image and the new generated layer (including the files from `copyToRoot`).
-  The script will be run with a working directory of `/`.
-  This can be seen as an equivalent of `RUN ...` in a `Dockerfile`.
-  A value of `null` means that this step in the image generation process will be skipped.
-
-  See [](#ex-dockerTools-buildImage-runAsRoot) for how to work with this attribute.
-
-  :::{.caution}
-  Using this attribute requires the `kvm` device to be available, see [`system-features`](https://nixos.org/manual/nix/stable/command-ref/conf-file.html#conf-system-features).
-  If the `kvm` device isn't available, you should consider using [`buildLayeredImage`](#ssec-pkgs-dockerTools-buildLayeredImage) or [`streamLayeredImage`](#ssec-pkgs-dockerTools-streamLayeredImage) instead.
-  Those functions allow scripts to be run as root without access to the `kvm` device.
-  :::
-
-  :::{.note}
-  At the time the script in `runAsRoot` is run, the files specified directly in `copyToRoot` will be present in the VM, but their dependencies might not be there yet.
-  Copying their dependencies into the generated image is a step that happens after `runAsRoot` finishes running.
-  :::
-
-  _Default value:_ `null`.
-
-`extraCommands` (String; _optional_)
-
-: A bash script that will run before the layer created by `buildImage` is finalised.
-  The script will be run on some (opaque) working directory which will become `/` once the layer is created.
-  This is similar to `runAsRoot`, but the script specified in `extraCommands` is **not** run as root, and does not involve creating a VM.
-  It is simply run as part of building the derivation that outputs the layer created by `buildImage`.
-
-  See [](#ex-dockerTools-buildImage-extraCommands) for how to work with this attribute, and subtle differences compared to `runAsRoot`.
-
-  _Default value:_ `""`.
-
-`config` (Attribute Set; _optional_)
-
-: Used to specify the configuration of the containers that will be started off the generated image.
-  Must be an attribute set, with each attribute as listed in the [Docker Image Specification v1.3.0](https://github.com/moby/moby/blob/46f7ab808b9504d735d600e259ca0723f76fb164/image/spec/spec.md#image-json-field-descriptions).
-
-  _Default value:_ `null`.
-
-`architecture` (String; _optional_)
-
-: Used to specify the image architecture.
-  This is useful for multi-architecture builds that don't need cross compiling.
-  If specified, its value should follow the [OCI Image Configuration Specification](https://github.com/opencontainers/image-spec/blob/main/config.md#properties), which should still be compatible with Docker.
-  According to the linked specification, all possible values for `$GOARCH` in [the Go docs](https://go.dev/doc/install/source#environment) should be valid, but will commonly be one of `386`, `amd64`, `arm`, or `arm64`.
-
-  _Default value:_ the same value from `pkgs.go.GOARCH`.
-
-`diskSize` (Number; _optional_)
-
-: Controls the disk size (in megabytes) of the VM used to run the script specified in `runAsRoot`.
-  This attribute is ignored if `runAsRoot` is `null`.
-
-  _Default value:_ 1024.
-
-`buildVMMemorySize` (Number; _optional_)
-
-: Controls the amount of memory (in megabytes) provisioned for the VM used to run the script specified in `runAsRoot`.
-  This attribute is ignored if `runAsRoot` is `null`.
-
-  _Default value:_ 512.
-
-`created` (String; _optional_)
-
-: Specifies the time of creation of the generated image.
-  This should be either a date and time formatted according to [ISO-8601](https://en.wikipedia.org/wiki/ISO_8601) or `"now"`, in which case `buildImage` will use the current date.
-
-  See [](#ex-dockerTools-buildImage-creatednow) for how to use `"now"`.
-
-  :::{.caution}
-  Using `"now"` means that the generated image will not be reproducible anymore (because the date will always change whenever it's built).
-  :::
-
-  _Default value:_ `"1970-01-01T00:00:01Z"`.
-
-`uid` (Number; _optional_)
-
-: The uid of the user that will own the files packed in the new layer built by `buildImage`.
-
-  _Default value:_ 0.
-
-`gid` (Number; _optional_)
-
-: The gid of the group that will own the files packed in the new layer built by `buildImage`.
-
-  _Default value:_ 0.
-
-`contents` **DEPRECATED**
-
-: This attribute is deprecated, and users are encouraged to use `copyToRoot` instead.
-
-### Passthru outputs {#ssec-pkgs-dockerTools-buildImage-passthru-outputs}
-
-`buildImage` defines a few [`passthru`](#var-stdenv-passthru) attributes:
-
-`buildArgs` (Attribute Set)
-
-: The argument passed to `buildImage` itself.
-  This allows you to inspect all attributes specified in the argument, as described above.
-
-`layer` (Attribute Set)
-
-: The derivation with the layer created by `buildImage`.
-  This allows easier inspection of the contents added by `buildImage` in the generated image.
-
-`imageTag` (String)
-
-: The tag of the generated image.
-  This is useful if no tag was specified in the attributes of the argument to `buildImage`, because an automatic tag will be used instead.
-  `imageTag` allows you to retrieve the value of the tag used in this case.
-
-### Examples {#ssec-pkgs-dockerTools-buildImage-examples}
-
-:::{.example #ex-dockerTools-buildImage}
-# Building a Docker image
-
-The following package builds a Docker image that runs the `redis-server` executable from the `redis` package.
-The Docker image will have name `redis` and tag `latest`.
+[]{#ex-dockerTools-buildImage}
+[]{#ex-dockerTools-buildImage-runAsRoot}
 
 ```nix
-{ dockerTools, buildEnv, redis }:
-dockerTools.buildImage {
+buildImage {
   name = "redis";
   tag = "latest";
 
-  copyToRoot = buildEnv {
+  fromImage = someBaseImage;
+  fromImageName = null;
+  fromImageTag = "latest";
+
+  copyToRoot = pkgs.buildEnv {
     name = "image-root";
-    paths = [ redis ];
+    paths = [ pkgs.redis ];
     pathsToLink = [ "/bin" ];
   };
 
   runAsRoot = ''
+    #!${pkgs.runtimeShell}
     mkdir -p /data
   '';
 
@@ -231,111 +36,68 @@ dockerTools.buildImage {
     WorkingDir = "/data";
     Volumes = { "/data" = { }; };
   };
+
+  diskSize = 1024;
+  buildVMMemorySize = 512;
 }
 ```
 
-The result of building this package is a `.tar.gz` file that can be loaded into Docker:
+The above example will build a Docker image `redis/latest` from the given base image. Loading and running this image in Docker results in `redis-server` being started automatically.
 
-```shell
-$ nix-build
-(some output removed for clarity)
-building '/nix/store/yw0adm4wpsw1w6j4fb5hy25b3arr9s1v-docker-image-redis.tar.gz.drv'...
-Adding layer...
-tar: Removing leading `/' from member names
-Adding meta...
-Cooking the image...
-Finished.
-/nix/store/p4dsg62inh9d2ksy3c7bv58xa851dasr-docker-image-redis.tar.gz
+- `name` specifies the name of the resulting image. This is the only required argument for `buildImage`.
 
-$ docker load -i /nix/store/p4dsg62inh9d2ksy3c7bv58xa851dasr-docker-image-redis.tar.gz
-(some output removed for clarity)
-Loaded image: redis:latest
+- `tag` specifies the tag of the resulting image. By default it's `null`, which indicates that the nix output hash will be used as tag.
+
+- `fromImage` is the repository tarball containing the base image. It must be a valid Docker image, such as exported by `docker save`. By default it's `null`, which can be seen as equivalent to `FROM scratch` of a `Dockerfile`.
+
+- `fromImageName` can be used to further specify the base image within the repository, in case it contains multiple images. By default it's `null`, in which case `buildImage` will peek the first image available in the repository.
+
+- `fromImageTag` can be used to further specify the tag of the base image within the repository, in case an image contains multiple tags. By default it's `null`, in which case `buildImage` will peek the first tag available for the base image.
+
+- `copyToRoot` is a derivation that will be copied in the new layer of the resulting image. This can be similarly seen as `ADD contents/ /` in a `Dockerfile`. By default it's `null`.
+
+- `runAsRoot` is a bash script that will run as root in an environment that overlays the existing layers of the base image with the new resulting layer, including the previously copied `contents` derivation. This can be similarly seen as `RUN ...` in a `Dockerfile`.
+
+> **_NOTE:_** Using this parameter requires the `kvm` device to be available.
+
+- `config` is used to specify the configuration of the containers that will be started off the built image in Docker. The available options are listed in the [Docker Image Specification v1.2.0](https://github.com/moby/moby/blob/master/image/spec/v1.2.md#image-json-field-descriptions).
+
+- `architecture` is _optional_ and used to specify the image architecture, this is useful for multi-architecture builds that don't need cross compiling. If not specified it will default to `hostPlatform`.
+
+- `diskSize` is used to specify the disk size of the VM used to build the image in megabytes. By default it's 1024 MiB.
+
+- `buildVMMemorySize` is used to specify the memory size of the VM to build the image in megabytes. By default it's 512 MiB.
+
+After the new layer has been created, its closure (to which `contents`, `config` and `runAsRoot` contribute) will be copied in the layer itself. Only new dependencies that are not already in the existing layers will be copied.
+
+At the end of the process, only one new single layer will be produced and added to the resulting image.
+
+The resulting repository will only list the single image `image/tag`. In the case of [the `buildImage` example](#ex-dockerTools-buildImage), it would be `redis/latest`.
+
+It is possible to inspect the arguments with which an image was built using its `buildArgs` attribute.
+
+> **_NOTE:_** If you see errors similar to `getProtocolByName: does not exist (no such protocol name: tcp)` you may need to add `pkgs.iana-etc` to `contents`.
+
+> **_NOTE:_** If you see errors similar to `Error_Protocol ("certificate has unknown CA",True,UnknownCa)` you may need to add `pkgs.cacert` to `contents`.
+
+By default `buildImage` will use a static date of one second past the UNIX Epoch. This allows `buildImage` to produce binary reproducible images. When listing images with `docker images`, the newly created images will be listed like this:
+
+```ShellSession
+$ docker images
+REPOSITORY   TAG      IMAGE ID       CREATED        SIZE
+hello        latest   08c791c7846e   48 years ago   25.2MB
 ```
-:::
 
-:::{.example #ex-dockerTools-buildImage-runAsRoot}
-# Building a Docker image with `runAsRoot`
-
-The following package builds a Docker image with the `hello` executable from the `hello` package.
-It uses `runAsRoot` to create a directory and a file inside the image.
-
-This works the same as [](#ex-dockerTools-buildImage-extraCommands), but uses `runAsRoot` instead of `extraCommands`.
+You can break binary reproducibility but have a sorted, meaningful `CREATED` column by setting `created` to `now`.
 
 ```nix
-{ dockerTools, buildEnv, hello }:
-dockerTools.buildImage {
+pkgs.dockerTools.buildImage {
   name = "hello";
   tag = "latest";
-
-  copyToRoot = buildEnv {
-    name = "image-root";
-    paths = [ hello ];
-    pathsToLink = [ "/bin" ];
-  };
-
-  runAsRoot = ''
-    mkdir -p /data
-    echo "some content" > my-file
-  '';
-
-  config = {
-    Cmd = [ "/bin/hello" ];
-    WorkingDir = "/data";
-  };
-}
-```
-:::
-
-:::{.example #ex-dockerTools-buildImage-extraCommands}
-# Building a Docker image with `extraCommands`
-
-The following package builds a Docker image with the `hello` executable from the `hello` package.
-It uses `extraCommands` to create a directory and a file inside the image.
-
-This works the same as [](#ex-dockerTools-buildImage-runAsRoot), but uses `extraCommands` instead of `runAsRoot`.
-Note that with `extraCommands`, we can't directly reference `/` and must create files and directories as if we were already on `/`.
-
-```nix
-{ dockerTools, buildEnv, hello }:
-dockerTools.buildImage {
-  name = "hello";
-  tag = "latest";
-
-  copyToRoot = buildEnv {
-    name = "image-root";
-    paths = [ hello ];
-    pathsToLink = [ "/bin" ];
-  };
-
-  extraCommands = ''
-    mkdir -p data
-    echo "some content" > my-file
-  '';
-
-  config = {
-    Cmd = [ "/bin/hello" ];
-    WorkingDir = "/data";
-  };
-}
-```
-:::
-
-:::{.example #ex-dockerTools-buildImage-creatednow}
-# Building a Docker image with a creation date set to the current time
-
-Note that using a value of `"now"` in the `created` attribute will break reproducibility.
-
-```nix
-{ dockerTools, buildEnv, hello }:
-dockerTools.buildImage {
-  name = "hello";
-  tag = "latest";
-
   created = "now";
-
-  copyToRoot = buildEnv {
+  copyToRoot = pkgs.buildEnv {
     name = "image-root";
-    paths = [ hello ];
+    paths = [ pkgs.hello ];
     pathsToLink = [ "/bin" ];
   };
 
@@ -343,376 +105,139 @@ dockerTools.buildImage {
 }
 ```
 
-After importing the generated repository tarball with Docker, its CLI will display a reasonable date and sort the images as expected:
+Now the Docker CLI will display a reasonable date and sort the images as expected:
 
 ```ShellSession
 $ docker images
 REPOSITORY   TAG      IMAGE ID       CREATED              SIZE
 hello        latest   de2bf4786de6   About a minute ago   25.2MB
 ```
-:::
+
+However, the produced images will not be binary reproducible.
 
 ## buildLayeredImage {#ssec-pkgs-dockerTools-buildLayeredImage}
 
-`buildLayeredImage` uses [`streamLayeredImage`](#ssec-pkgs-dockerTools-streamLayeredImage) underneath to build a compressed Docker-compatible repository tarball.
-Basically, `buildLayeredImage` runs the script created by `streamLayeredImage` to save the compressed image in the Nix store.
-`buildLayeredImage` supports the same options as `streamLayeredImage`, see [`streamLayeredImage`](#ssec-pkgs-dockerTools-streamLayeredImage) for details.
+Create a Docker image with many of the store paths being on their own layer to improve sharing between images. The image is realized into the Nix store as a gzipped tarball. Depending on the intended usage, many users might prefer to use `streamLayeredImage` instead, which this function uses internally.
 
-:::{.note}
-Despite the similar name, [`buildImage`](#ssec-pkgs-dockerTools-buildImage) works completely differently from `buildLayeredImage` and `streamLayeredImage`.
+`name`
 
-Even though some of the arguments may seem related, they cannot be interchanged.
-:::
+: The name of the resulting image.
 
-You can use this function to load an image in Docker with `docker load`.
-See [](#ex-dockerTools-buildLayeredImage-hello) to see how to do that.
+`tag` _optional_
 
-### Examples {#ssec-pkgs-dockerTools-buildLayeredImage-examples}
+: Tag of the generated image.
 
-:::{.example #ex-dockerTools-buildLayeredImage-hello}
-# Building a layered Docker image
+    *Default:* the output path's hash
 
-The following package builds a layered Docker image that runs the `hello` executable from the `hello` package.
-The Docker image will have name `hello` and tag `latest`.
+`fromImage` _optional_
+
+: The repository tarball containing the base image. It must be a valid Docker image, such as one exported by `docker save`.
+
+    *Default:* `null`, which can be seen as equivalent to `FROM scratch` of a `Dockerfile`.
+
+`contents` _optional_
+
+: Top-level paths in the container. Either a single derivation, or a list of derivations.
+
+    *Default:* `[]`
+
+`config` _optional_
+
+`architecture` is _optional_ and used to specify the image architecture, this is useful for multi-architecture builds that don't need cross compiling. If not specified it will default to `hostPlatform`.
+
+: Run-time configuration of the container. A full list of the options available is in the [Docker Image Specification v1.2.0](https://github.com/moby/moby/blob/master/image/spec/v1.2.md#image-json-field-descriptions).
+
+    *Default:* `{}`
+
+`created` _optional_
+
+: Date and time the layers were created. Follows the same `now` exception supported by `buildImage`.
+
+    *Default:* `1970-01-01T00:00:01Z`
+
+`maxLayers` _optional_
+
+: Maximum number of layers to create.
+
+    *Default:* `100`
+
+    *Maximum:* `125`
+
+`extraCommands` _optional_
+
+: Shell commands to run while building the final layer, without access to most of the layer contents. Changes to this layer are "on top" of all the other layers, so can create additional directories and files.
+
+`fakeRootCommands` _optional_
+
+: Shell commands to run while creating the archive for the final layer in a fakeroot environment. Unlike `extraCommands`, you can run `chown` to change the owners of the files in the archive, changing fakeroot's state instead of the real filesystem. The latter would require privileges that the build user does not have. Static binaries do not interact with the fakeroot environment. By default all files in the archive will be owned by root.
+
+`enableFakechroot` _optional_
+
+: Whether to run in `fakeRootCommands` in `fakechroot`, making programs behave as though `/` is the root of the image being created, while files in the Nix store are available as usual. This allows scripts that perform installation in `/` to work as expected. Considering that `fakechroot` is implemented via the same mechanism as `fakeroot`, the same caveats apply.
+
+    *Default:* `false`
+
+### Behavior of `contents` in the final image {#dockerTools-buildLayeredImage-arg-contents}
+
+Each path directly listed in `contents` will have a symlink in the root of the image.
+
+For example:
 
 ```nix
-{ dockerTools, hello }:
-dockerTools.buildLayeredImage {
+pkgs.dockerTools.buildLayeredImage {
   name = "hello";
-  tag = "latest";
-
-  contents = [ hello ];
-
-  config.Cmd = [ "/bin/hello" ];
+  contents = [ pkgs.hello ];
 }
 ```
 
-The result of building this package is a `.tar.gz` file that can be loaded into Docker:
+will create symlinks for all the paths in the `hello` package:
 
-```shell
-$ nix-build
-(some output removed for clarity)
-building '/nix/store/bk8bnrbw10nq7p8pvcmdr0qf57y6scha-hello.tar.gz.drv'...
-No 'fromImage' provided
-Creating layer 1 from paths: ['/nix/store/i93s7xxblavsacpy82zdbn4kplsyq48l-libunistring-1.1']
-Creating layer 2 from paths: ['/nix/store/ji01n9vinnj22nbrb86nx8a1ssgpilx8-libidn2-2.3.4']
-Creating layer 3 from paths: ['/nix/store/ldrslljw4rg026nw06gyrdwl78k77vyq-xgcc-12.3.0-libgcc']
-Creating layer 4 from paths: ['/nix/store/9y8pmvk8gdwwznmkzxa6pwyah52xy3nk-glibc-2.38-27']
-Creating layer 5 from paths: ['/nix/store/zhl06z4lrfrkw5rp0hnjjfrgsclzvxpm-hello-2.12.1']
-Creating layer 6 with customisation...
-Adding manifests...
-Done.
-/nix/store/hxcz7snvw7f8rzhbh6mv8jq39d992905-hello.tar.gz
-
-$ docker load -i /nix/store/hxcz7snvw7f8rzhbh6mv8jq39d992905-hello.tar.gz
-(some output removed for clarity)
-Loaded image: hello:latest
+```ShellSession
+/bin/hello -> /nix/store/h1zb1padqbbb7jicsvkmrym3r6snphxg-hello-2.10/bin/hello
+/share/info/hello.info -> /nix/store/h1zb1padqbbb7jicsvkmrym3r6snphxg-hello-2.10/share/info/hello.info
+/share/locale/bg/LC_MESSAGES/hello.mo -> /nix/store/h1zb1padqbbb7jicsvkmrym3r6snphxg-hello-2.10/share/locale/bg/LC_MESSAGES/hello.mo
 ```
-:::
+
+### Automatic inclusion of `config` references {#dockerTools-buildLayeredImage-arg-config}
+
+The closure of `config` is automatically included in the closure of the final image.
+
+This allows you to make very simple Docker images with very little code. This container will start up and run `hello`:
+
+```nix
+pkgs.dockerTools.buildLayeredImage {
+  name = "hello";
+  config.Cmd = [ "${pkgs.hello}/bin/hello" ];
+}
+```
+
+### Adjusting `maxLayers` {#dockerTools-buildLayeredImage-arg-maxLayers}
+
+Increasing the `maxLayers` increases the number of layers which have a chance to be shared between different images.
+
+Modern Docker installations support up to 128 layers, but older versions support as few as 42.
+
+If the produced image will not be extended by other Docker builds, it is safe to set `maxLayers` to `128`. However, it will be impossible to extend the image further.
+
+The first (`maxLayers-2`) most "popular" paths will have their own individual layers, then layer \#`maxLayers-1` will contain all the remaining "unpopular" paths, and finally layer \#`maxLayers` will contain the Image configuration.
+
+Docker's Layers are not inherently ordered, they are content-addressable and are not explicitly layered until they are composed in to an Image.
 
 ## streamLayeredImage {#ssec-pkgs-dockerTools-streamLayeredImage}
 
-`streamLayeredImage` builds a **script** which, when run, will stream to stdout a Docker-compatible repository tarball containing a single image, using multiple layers to improve sharing between images.
-This means that `streamLayeredImage` does not output an image into the Nix store, but only a script that builds the image, saving on IO and disk/cache space, particularly with large images.
+Builds a script which, when run, will stream an uncompressed tarball of a Docker image to stdout. The arguments to this function are as for `buildLayeredImage`. This method of constructing an image does not realize the image into the Nix store, so it saves on IO and disk/cache space, particularly with large images.
 
-You can use this function to load an image in Docker with `docker load`.
-See [](#ex-dockerTools-streamLayeredImage-hello) to see how to do that.
+The image produced by running the output script can be piped directly into `docker load`, to load it into the local docker daemon:
 
-For this function, you specify a [store path](https://nixos.org/manual/nix/stable/store/store-path) or a list of store paths to be added to the image, and the functions will automatically include any dependencies of those paths in the image.
-The function will attempt to create one layer per object in the Nix store that needs to be added to the image.
-In case there are more objects to include than available layers, the function will put the most ["popular"](https://github.com/NixOS/nixpkgs/tree/release-23.11/pkgs/build-support/references-by-popularity) objects in their own layers, and group all remaining objects into a single layer.
-
-An additional layer will be created with symlinks to the store paths you specified to be included in the image.
-These symlinks are built with [`symlinkJoin`](#trivial-builder-symlinkJoin), so they will be included in the root of the image.
-See [](#ex-dockerTools-streamLayeredImage-exploringlayers) to understand how these symlinks are laid out in the generated image.
-
-`streamLayeredImage` allows scripts to be run when creating the additional layer with symlinks, allowing custom behaviour to affect the final results of the image (see the documentation of the `extraCommands` and `fakeRootCommands` attributes).
-
-The resulting repository tarball will list a single image as specified by the `name` and `tag` attributes.
-By default, that image will use a static creation date (see documentation for the `created` attribute).
-This allows the function to produce reproducible images.
-
-### Inputs {#ssec-pkgs-dockerTools-streamLayeredImage-inputs}
-
-`streamLayeredImage` expects one argument with the following attributes:
-
-`name` (String)
-
-: The name of the generated image.
-
-`tag` (String; _optional_)
-
-: Tag of the generated image.
-  If `null`, the hash of the nix derivation will be used as the tag.
-
-  _Default value:_ `null`.
-
-`fromImage`(Path or Null; _optional_)
-
-: The repository tarball of an image to be used as the base for the generated image.
-  It must be a valid Docker image, such as one exported by `docker save`, or another image built with the `dockerTools` utility functions.
-  This can be seen as an equivalent of `FROM fromImage` in a `Dockerfile`.
-  A value of `null` can be seen as an equivalent of `FROM scratch`.
-
-  If specified, the created layers will be appended to the layers defined in the base image.
-
-  _Default value:_ `null`.
-
-`contents` (Path or List of Paths; _optional_) []{#dockerTools-buildLayeredImage-arg-contents}
-
-: Directories whose contents will be added to the generated image.
-  Things that coerce to paths (e.g. a derivation) can also be used.
-  This can be seen as an equivalent of `ADD contents/ /` in a `Dockerfile`.
-
-  All the contents specified by `contents` will be added as a final layer in the generated image.
-  They will be added as links to the actual files (e.g. links to the store paths).
-  The actual files will be added in previous layers.
-
-  _Default value:_ `[]`
-
-`config` (Attribute Set; _optional_) []{#dockerTools-buildLayeredImage-arg-config}
-
-: Used to specify the configuration of the containers that will be started off the generated image.
-  Must be an attribute set, with each attribute as listed in the [Docker Image Specification v1.3.0](https://github.com/moby/moby/blob/46f7ab808b9504d735d600e259ca0723f76fb164/image/spec/spec.md#image-json-field-descriptions).
-
-  If any packages are used directly in `config`, they will be automatically included in the generated image.
-  See [](#ex-dockerTools-streamLayeredImage-configclosure) for an example.
-
-  _Default value:_ `null`.
-
-`architecture` (String; _optional_)
-
-: Used to specify the image architecture.
-  This is useful for multi-architecture builds that don't need cross compiling.
-  If specified, its value should follow the [OCI Image Configuration Specification](https://github.com/opencontainers/image-spec/blob/main/config.md#properties), which should still be compatible with Docker.
-  According to the linked specification, all possible values for `$GOARCH` in [the Go docs](https://go.dev/doc/install/source#environment) should be valid, but will commonly be one of `386`, `amd64`, `arm`, or `arm64`.
-
-  _Default value:_ the same value from `pkgs.go.GOARCH`.
-
-`created` (String; _optional_)
-
-: Specifies the time of creation of the generated image.
-  This should be either a date and time formatted according to [ISO-8601](https://en.wikipedia.org/wiki/ISO_8601) or `"now"`, in which case the current date will be used.
-
-  :::{.caution}
-  Using `"now"` means that the generated image will not be reproducible anymore (because the date will always change whenever it's built).
-  :::
-
-  _Default value:_ `"1970-01-01T00:00:01Z"`.
-
-`maxLayers` (Number; _optional_) []{#dockerTools-buildLayeredImage-arg-maxLayers}
-
-: The maximum number of layers that will be used by the generated image.
-  If a `fromImage` was specified, the number of layers used by `fromImage` will be subtracted from `maxLayers` to ensure that the image generated will have at most `maxLayers`.
-
-  :::{.caution}
-  Depending on the tool/runtime where the image will be used, there might be a limit to the number of layers that an image can have.
-  For Docker, see [this issue on GitHub](https://github.com/docker/docs/issues/8230).
-  :::
-
-  _Default value:_ 100.
-
-`extraCommands` (String; _optional_)
-
-: A bash script that will run in the context of the layer created with the contents specified by `contents`.
-  At the moment this script runs, only the contents directly specified by `contents` will be available as links.
-
-  _Default value:_ `""`.
-
-`fakeRootCommands` (String; _optional_)
-
-: A bash script that will run in the context of the layer created with the contents specified by `contents`.
-  During the process to generate that layer, the script in `extraCommands` will be run first, if specified.
-  After that, a {manpage}`fakeroot(1)` environment will be entered.
-  The script specified in `fakeRootCommands` runs inside the fakeroot environment, and the layer is then generated from the view of the files inside the fakeroot environment.
-
-  This is useful to change the owners of the files in the layer (by running `chown`, for example), or performing any other privileged operations related to file manipulation (by default, all files in the layer will be owned by root, and the build environment doesn't have enough privileges to directly perform privileged operations on these files).
-
-  For more details, see the manpage for {manpage}`fakeroot(1)`.
-
-  :::{.caution}
-  Due to how fakeroot works, static binaries cannot perform privileged file operations in `fakeRootCommands`, unless `enableFakechroot` is set to `true`.
-  :::
-
-  _Default value:_ `""`.
-
-`enableFakechroot` (Boolean; _optional_)
-
-: By default, the script specified in `fakeRootCommands` only runs inside a fakeroot environment.
-  If `enableFakechroot` is `true`, a more complete chroot environment will be created using [`proot`](https://proot-me.github.io/) before running the script in `fakeRootCommands`.
-  Files in the Nix store will be available.
-  This allows scripts that perform installation in `/` to work as expected.
-  This can be seen as an equivalent of `RUN ...` in a `Dockerfile`.
-
-  _Default value:_ `false`
-
-`includeStorePaths` (Boolean; _optional_)
-
-: The files specified in `contents` are put into layers in the generated image.
-  If `includeStorePaths` is `false`, the actual files will not be included in the generated image, and only links to them will be added instead.
-  It is **not recommended** to set this to `false` unless you have other tooling to insert the store paths via other means (such as bind mounting the host store) when running containers with the generated image.
-  If you don't provide any extra tooling, the generated image won't run properly.
-
-  See [](#ex-dockerTools-streamLayeredImage-exploringlayers) to understand the impact of setting `includeStorePaths` to `false`.
-
-  _Default value:_ `true`
-
-`passthru` (Attribute Set; _optional_)
-
-: Use this to pass any attributes as [passthru](#var-stdenv-passthru) for the resulting derivation.
-
-  _Default value:_ `{}`
-
-### Passthru outputs {#ssec-pkgs-dockerTools-streamLayeredImage-passthru-outputs}
-
-`streamLayeredImage` also defines its own [`passthru`](#var-stdenv-passthru) attributes:
-
-`imageTag` (String)
-
-: The tag of the generated image.
-  This is useful if no tag was specified in the attributes of the argument to the function, because an automatic tag will be used instead.
-  `imageTag` allows you to retrieve the value of the tag used in this case.
-
-### Examples {#ssec-pkgs-dockerTools-streamLayeredImage-examples}
-
-:::{.example #ex-dockerTools-streamLayeredImage-hello}
-# Streaming a layered Docker image
-
-The following package builds a **script** which, when run, will stream a layered Docker image that runs the `hello` executable from the `hello` package.
-The Docker image will have name `hello` and tag `latest`.
-
-```nix
-{ dockerTools, hello }:
-dockerTools.streamLayeredImage {
-  name = "hello";
-  tag = "latest";
-
-  contents = [ hello ];
-
-  config.Cmd = [ "/bin/hello" ];
-}
+```ShellSession
+$(nix-build) | docker load
 ```
 
-The result of building this package is a script.
-Running this script and piping it into `docker load` gives you the same image that was built in [](#ex-dockerTools-buildLayeredImage-hello).
-Note that in this case, the image is never added to the Nix store, but instead streamed directly into Docker.
+Alternatively, the image be piped via `gzip` into `skopeo`, e.g., to copy it into a registry:
 
-```shell
-$ nix-build
-(output removed for clarity)
-/nix/store/wsz2xl8ckxnlb769irvq6jv1280dfvxd-stream-hello
-
-$ /nix/store/wsz2xl8ckxnlb769irvq6jv1280dfvxd-stream-hello | docker load
-No 'fromImage' provided
-Creating layer 1 from paths: ['/nix/store/i93s7xxblavsacpy82zdbn4kplsyq48l-libunistring-1.1']
-Creating layer 2 from paths: ['/nix/store/ji01n9vinnj22nbrb86nx8a1ssgpilx8-libidn2-2.3.4']
-Creating layer 3 from paths: ['/nix/store/ldrslljw4rg026nw06gyrdwl78k77vyq-xgcc-12.3.0-libgcc']
-Creating layer 4 from paths: ['/nix/store/9y8pmvk8gdwwznmkzxa6pwyah52xy3nk-glibc-2.38-27']
-Creating layer 5 from paths: ['/nix/store/zhl06z4lrfrkw5rp0hnjjfrgsclzvxpm-hello-2.12.1']
-Creating layer 6 with customisation...
-Adding manifests...
-Done.
-(some output removed for clarity)
-Loaded image: hello:latest
+```ShellSession
+$(nix-build) | gzip --fast | skopeo copy docker-archive:/dev/stdin docker://some_docker_registry/myimage:tag
 ```
-:::
-
-:::{.example #ex-dockerTools-streamLayeredImage-exploringlayers}
-# Exploring the layers in an image built with `streamLayeredImage`
-
-Assume the following package, which builds a layered Docker image with the `hello` package.
-
-```nix
-{ dockerTools, hello }:
-dockerTools.streamLayeredImage {
-  name = "hello";
-  contents = [ hello ];
-}
-```
-
-The `hello` package depends on 4 other packages:
-
-```shell
-$ nix-store --query -R $(nix-build -A hello)
-/nix/store/i93s7xxblavsacpy82zdbn4kplsyq48l-libunistring-1.1
-/nix/store/ji01n9vinnj22nbrb86nx8a1ssgpilx8-libidn2-2.3.4
-/nix/store/ldrslljw4rg026nw06gyrdwl78k77vyq-xgcc-12.3.0-libgcc
-/nix/store/9y8pmvk8gdwwznmkzxa6pwyah52xy3nk-glibc-2.38-27
-/nix/store/zhl06z4lrfrkw5rp0hnjjfrgsclzvxpm-hello-2.12.1
-```
-
-This means that all these packages will be included in the image generated by `streamLayeredImage`.
-It will put each package in its own layer, for a total of 5 layers with actual files in them.
-A final layer will be created only with symlinks for the `hello` package.
-
-The image generated will have the following directory structure (some directories were collapsed for readability):
-
-```
-├── bin
-│   └── hello → /nix/store/zhl06z4lrfrkw5rp0hnjjfrgsclzvxpm-hello-2.12.1/bin/hello
-├── nix
-│   └── store
-│       ├─⊕ 9y8pmvk8gdwwznmkzxa6pwyah52xy3nk-glibc-2.38-27
-│       ├─⊕ i93s7xxblavsacpy82zdbn4kplsyq48l-libunistring-1.1
-│       ├─⊕ ji01n9vinnj22nbrb86nx8a1ssgpilx8-libidn2-2.3.4
-│       ├─⊕ ldrslljw4rg026nw06gyrdwl78k77vyq-xgcc-12.3.0-libgcc
-│       └─⊕ zhl06z4lrfrkw5rp0hnjjfrgsclzvxpm-hello-2.12.1
-└── share
-    ├── info
-    │   └── hello.info → /nix/store/zhl06z4lrfrkw5rp0hnjjfrgsclzvxpm-hello-2.12.1/share/info/hello.info
-    ├─⊕ locale
-    └── man
-        └── man1
-            └── hello.1.gz → /nix/store/zhl06z4lrfrkw5rp0hnjjfrgsclzvxpm-hello-2.12.1/share/man/man1/hello.1.gz
-```
-
-Each of the packages in `/nix/store` comes from a layer in the image.
-The final layer adds the `/bin` and `/share` directories, but they only contain links to the actual files in `/nix/store`.
-
-If our package sets `includeStorePaths` to `false`, we'll end up with only the final layer with the links, but the actual files won't exist in the image:
-
-```nix
-{ dockerTools, hello }:
-dockerTools.streamLayeredImage {
-  name = "hello";
-  contents = [ hello ];
-}
-```
-
-After building this package, the image will have the following directory structure:
-
-```
-├── bin
-│   └── hello → /nix/store/zhl06z4lrfrkw5rp0hnjjfrgsclzvxpm-hello-2.12.1/bin/hello
-└── share
-    ├── info
-    │   └── hello.info → /nix/store/zhl06z4lrfrkw5rp0hnjjfrgsclzvxpm-hello-2.12.1/share/info/hello.info
-    ├─⊕ locale
-    └── man
-        └── man1
-            └── hello.1.gz → /nix/store/zhl06z4lrfrkw5rp0hnjjfrgsclzvxpm-hello-2.12.1/share/man/man1/hello.1.gz
-```
-
-Note how the links point to paths in `/nix/store`, but they're not included in the image itself.
-This is why you need extra tooling when using `includeStorePaths`:
-a container created from such image won't find any of the files it needs to run otherwise.
-:::
-
-::: {.example #ex-dockerTools-streamLayeredImage-configclosure}
-# Building a layered Docker image with packages directly in `config`
-
-The closure of `config` is automatically included in the generated image.
-The following package shows a more compact way to create the same output generated in [](#ex-dockerTools-streamLayeredImage-hello).
-
-```nix
-{ dockerTools, hello, lib }:
-dockerTools.streamLayeredImage {
-  name = "hello";
-  tag = "latest";
-  config.Cmd = [ "${lib.getExe hello}" ];
-}
-```
-:::
 
 ## pullImage {#ssec-pkgs-dockerTools-fetchFromRegistry}
 

doc/build-helpers/special.md

@@ -7,5 +7,4 @@ special/fhs-environments.section.md
 special/makesetuphook.section.md
 special/mkshell.section.md
 special/vm-tools.section.md
-special/checkpoint-build.section.md
 ```

doc/build-helpers/special/checkpoint-build.section.md

@@ -1,39 +0,0 @@
-# pkgs.checkpointBuildTools  {#sec-checkpoint-build}
-
-`pkgs.checkpointBuildTools` provides a way to build derivations incrementally. It consists of two functions to make checkpoint builds using Nix possible.
-
-For hermeticity, Nix derivations do not allow any state to be carried over between builds, making a transparent incremental build within a derivation impossible.
-
-However, we can tell Nix explicitly what the previous build state was, by representing that previous state as a derivation output. This allows the passed build state to be used for an incremental build.
-
-To change a normal derivation to a checkpoint based build, these steps must be taken:
-  - apply `prepareCheckpointBuild` on the desired derivation, e.g.
-```nix
-checkpointArtifacts = (pkgs.checkpointBuildTools.prepareCheckpointBuild pkgs.virtualbox);
-```
-  - change something you want in the sources of the package, e.g. use a source override:
-```nix
-changedVBox = pkgs.virtualbox.overrideAttrs (old: {
-  src = path/to/vbox/sources;
-});
-```
-  - use `mkCheckpointBuild changedVBox checkpointArtifacts`
-  - enjoy shorter build times
-
-## Example {#sec-checkpoint-build-example}
-```nix
-{ pkgs ? import <nixpkgs> {} }:
-let
-  inherit (pkgs.checkpointBuildTools)
-    prepareCheckpointBuild
-    mkCheckpointBuild
-    ;
-  helloCheckpoint = prepareCheckpointBuild pkgs.hello;
-  changedHello = pkgs.hello.overrideAttrs (_: {
-    doCheck = false;
-    patchPhase = ''
-      sed -i 's/Hello, world!/Hello, Nix!/g' src/hello.c
-    '';
-  });
-in mkCheckpointBuild changedHello helloCheckpoint
-```

doc/build-helpers/special/mkshell.section.md

@@ -29,10 +29,6 @@ pkgs.mkShell {
 
 ... all the attributes of `stdenv.mkDerivation`.
 
-## Variants {#sec-pkgs-mkShell-variants}
-
-`pkgs.mkShellNoCC` is a variant that uses `stdenvNoCC` instead of `stdenv` as base environment. This is useful if no C compiler is needed in the shell environment.
-
 ## Building the shell {#sec-pkgs-mkShell-building}
 
 This derivation output will contain a text file that contains a reference to

doc/build-helpers/testers.chapter.md

@@ -1,5 +1,4 @@
 # Testers {#chap-testers}
-
 This chapter describes several testing builders which are available in the `testers` namespace.
 
 ## `hasPkgConfigModules` {#tester-hasPkgConfigModules}
@@ -7,11 +6,19 @@ This chapter describes several testing builders which are available in the `test
 <!-- Old anchor name so links still work -->
 []{#tester-hasPkgConfigModule}
 Checks whether a package exposes a given list of `pkg-config` modules.
-If the `moduleNames` argument is omitted, `hasPkgConfigModules` will use `meta.pkgConfigModules`.
+If the `moduleNames` argument is omitted, `hasPkgConfigModules` will
+use `meta.pkgConfigModules`.
 
-:::{.example #ex-haspkgconfigmodules-defaultvalues}
+Example:
 
-# Check that `pkg-config` modules are exposed using default values
+```nix
+passthru.tests.pkg-config = testers.hasPkgConfigModules {
+  package = finalAttrs.finalPackage;
+  moduleNames = [ "libfoo" ];
+};
+```
+
+If the package in question has `meta.pkgConfigModules` set, it is even simpler:
 
 ```nix
 passthru.tests.pkg-config = testers.hasPkgConfigModules {
@@ -21,66 +28,40 @@ passthru.tests.pkg-config = testers.hasPkgConfigModules {
 meta.pkgConfigModules = [ "libfoo" ];
 ```
 
-:::
-
-:::{.example #ex-haspkgconfigmodules-explicitmodules}
-
-# Check that `pkg-config` modules are exposed using explicit module names
-
-```nix
-passthru.tests.pkg-config = testers.hasPkgConfigModules {
-  package = finalAttrs.finalPackage;
-  moduleNames = [ "libfoo" ];
-};
-```
-
-:::
-
 ## `testVersion` {#tester-testVersion}
 
-Checks that the output from running a command contains the specified version string in it as a whole word.
+Checks the command output contains the specified version
 
-Although simplistic, this test assures that the main program can run.
-While there's no substitute for a real test case, it does catch dynamic linking errors and such.
-It also provides some protection against accidentally building the wrong version, for example when using an "old" hash in a fixed-output derivation.
+Although simplistic, this test assures that the main program
+can run. While there's no substitute for a real test case,
+it does catch dynamic linking errors and such. It also provides
+some protection against accidentally building the wrong version,
+for example when using an 'old' hash in a fixed-output derivation.
 
-By default, the command to be run will be inferred from the given `package` attribute:
-it will check `meta.mainProgram` first, and fall back to `pname` or `name`.
-The default argument to the command is `--version`, and the version to be checked will be inferred from the given `package` attribute as well.
-
-:::{.example #ex-testversion-hello}
-
-# Check a program version using all the default values
-
-This example will run the command `hello --version`, and then check that the version of the `hello` package is in the output of the command.
+Examples:
 
 ```nix
 passthru.tests.version = testers.testVersion { package = hello; };
-```
-
-:::
-
-:::{.example #ex-testversion-different-commandversion}
-
-# Check the program version using a specified command and expected version string
-
-This example will run the command `leetcode -V`, and then check that `leetcode 0.4.2` is in the output of the command as a whole word (separated by whitespaces).
-This means that an output like "leetcode 0.4.21" would fail the tests, and an output like "You're running leetcode 0.4.2" would pass the tests.
-
-A common usage of the `version` attribute is to specify `version = "v${version}"`.
-
-```nix
-version = "0.4.2";
 
 passthru.tests.version = testers.testVersion {
-  package = leetcode-cli;
-  command = "leetcode -V";
-  version = "leetcode ${version}";
+  package = seaweedfs;
+  command = "weed version";
+};
+
+passthru.tests.version = testers.testVersion {
+  package = key;
+  command = "KeY --help";
+  # Wrong '2.5' version in the code. Drop on next version.
+  version = "2.5";
+};
+
+passthru.tests.version = testers.testVersion {
+  package = ghr;
+  # The output needs to contain the 'version' string without any prefix or suffix.
+  version = "v${version}";
 };
 ```
 
-:::
-
 ## `testBuildFailure` {#tester-testBuildFailure}
 
 Make sure that a build does not succeed. This is useful for testing testers.
@@ -91,18 +72,7 @@ This returns a derivation with an override on the builder, with the following ef
  - Move `$out` to `$out/result`, if it exists (assuming `out` is the default output)
  - Save the build log to `$out/testBuildFailure.log` (same)
 
-While `testBuildFailure` is designed to keep changes to the original builder's environment to a minimum, some small changes are inevitable:
-
- - The file `$TMPDIR/testBuildFailure.log` is present. It should not be deleted.
- - `stdout` and `stderr` are a pipe instead of a tty. This could be improved.
- - One or two extra processes are present in the sandbox during the original builder's execution.
- - The derivation and output hashes are different, but not unusual.
- - The derivation includes a dependency on `buildPackages.bash` and `expect-failure.sh`, which is built to include a transitive dependency on `buildPackages.coreutils` and possibly more.
-   These are not added to `PATH` or any other environment variable, so they should be hard to observe.
-
-:::{.example #ex-testBuildFailure-showingenvironmentchanges}
-
-# Check that a build fails, and verify the changes made during build
+Example:
 
 ```nix
 runCommand "example" {
@@ -119,15 +89,24 @@ runCommand "example" {
 '';
 ```
 
-:::
+While `testBuildFailure` is designed to keep changes to the original builder's
+environment to a minimum, some small changes are inevitable.
+
+ - The file `$TMPDIR/testBuildFailure.log` is present. It should not be deleted.
+ - `stdout` and `stderr` are a pipe instead of a tty. This could be improved.
+ - One or two extra processes are present in the sandbox during the original
+   builder's execution.
+ - The derivation and output hashes are different, but not unusual.
+ - The derivation includes a dependency on `buildPackages.bash` and
+   `expect-failure.sh`, which is built to include a transitive dependency on
+   `buildPackages.coreutils` and possibly more. These are not added to `PATH`
+   or any other environment variable, so they should be hard to observe.
 
 ## `testEqualContents` {#tester-equalContents}
 
 Check that two paths have the same contents.
 
-:::{.example #ex-testEqualContents-toyexample}
-
-# Check that two paths have the same contents
+Example:
 
 ```nix
 testers.testEqualContents {
@@ -147,20 +126,17 @@ testers.testEqualContents {
 }
 ```
 
-:::
-
 ## `testEqualDerivation` {#tester-testEqualDerivation}
 
 Checks that two packages produce the exact same build instructions.
 
-This can be used to make sure that a certain difference of configuration, such as the presence of an overlay does not cause a cache miss.
+This can be used to make sure that a certain difference of configuration,
+such as the presence of an overlay does not cause a cache miss.
 
 When the derivations are equal, the return value is an empty file.
 Otherwise, the build log explains the difference via `nix-diff`.
 
-:::{.example #ex-testEqualDerivation-hello}
-
-# Check that two packages produce the same derivation
+Example:
 
 ```nix
 testers.testEqualDerivation
@@ -169,28 +145,29 @@ testers.testEqualDerivation
   (hello.overrideAttrs(o: { doCheck = true; }))
 ```
 
-:::
-
 ## `invalidateFetcherByDrvHash` {#tester-invalidateFetcherByDrvHash}
 
 Use the derivation hash to invalidate the output via name, for testing.
 
 Type: `(a@{ name, ... } -> Derivation) -> a -> Derivation`
 
-Normally, fixed output derivations can and should be cached by their output hash only, but for testing we want to re-fetch everytime the fetcher changes.
+Normally, fixed output derivations can and should be cached by their output
+hash only, but for testing we want to re-fetch everytime the fetcher changes.
 
-Changes to the fetcher become apparent in the drvPath, which is a hash of how to fetch, rather than a fixed store path.
-By inserting this hash into the name, we can make sure to re-run the fetcher every time the fetcher changes.
+Changes to the fetcher become apparent in the drvPath, which is a hash of
+how to fetch, rather than a fixed store path.
+By inserting this hash into the name, we can make sure to re-run the fetcher
+every time the fetcher changes.
 
-This relies on the assumption that Nix isn't clever enough to reuse its database of local store contents to optimize fetching.
+This relies on the assumption that Nix isn't clever enough to reuse its
+database of local store contents to optimize fetching.
 
-You might notice that the "salted" name derives from the normal invocation, not the final derivation.
-`invalidateFetcherByDrvHash` has to invoke the fetcher function twice:
-once to get a derivation hash, and again to produce the final fixed output derivation.
+You might notice that the "salted" name derives from the normal invocation,
+not the final derivation. `invalidateFetcherByDrvHash` has to invoke the fetcher
+function twice: once to get a derivation hash, and again to produce the final
+fixed output derivation.
 
-:::{.example #ex-invalidateFetcherByDrvHash-nix}
-
-# Prevent nix from reusing the output of a fetcher
+Example:
 
 ```nix
 tests.fetchgit = testers.invalidateFetcherByDrvHash fetchgit {
@@ -201,17 +178,13 @@ tests.fetchgit = testers.invalidateFetcherByDrvHash fetchgit {
 };
 ```
 
-:::
-
 ## `runNixOSTest` {#tester-runNixOSTest}
 
 A helper function that behaves exactly like the NixOS `runTest`, except it also assigns this Nixpkgs package set as the `pkgs` of the test and makes the `nixpkgs.*` options read-only.
 
 If your test is part of the Nixpkgs repository, or if you need a more general entrypoint, see ["Calling a test" in the NixOS manual](https://nixos.org/manual/nixos/stable/index.html#sec-calling-nixos-tests).
 
-:::{.example #ex-runNixOSTest-hello}
-
-# Run a NixOS test using `runNixOSTest`
+Example:
 
 ```nix
 pkgs.testers.runNixOSTest ({ lib, ... }: {
@@ -225,17 +198,19 @@ pkgs.testers.runNixOSTest ({ lib, ... }: {
 })
 ```
 
-:::
-
 ## `nixosTest` {#tester-nixosTest}
 
 Run a NixOS VM network test using this evaluation of Nixpkgs.
 
 NOTE: This function is primarily for external use. NixOS itself uses `make-test-python.nix` directly. Packages defined in Nixpkgs [reuse NixOS tests via `nixosTests`, plural](#ssec-nixos-tests-linking).
 
-It is mostly equivalent to the function `import ./make-test-python.nix` from the [NixOS manual](https://nixos.org/nixos/manual/index.html#sec-nixos-tests), except that the current application of Nixpkgs (`pkgs`) will be used, instead of letting NixOS invoke Nixpkgs anew.
+It is mostly equivalent to the function `import ./make-test-python.nix` from the
+[NixOS manual](https://nixos.org/nixos/manual/index.html#sec-nixos-tests),
+except that the current application of Nixpkgs (`pkgs`) will be used, instead of
+letting NixOS invoke Nixpkgs anew.
 
-If a test machine needs to set NixOS options under `nixpkgs`, it must set only the `nixpkgs.pkgs` option.
+If a test machine needs to set NixOS options under `nixpkgs`, it must set only the
+`nixpkgs.pkgs` option.
 
 ### Parameter {#tester-nixosTest-parameter}
 

doc/build-helpers/trivial-build-helpers.chapter.md

@@ -1,7 +1,6 @@
 # Trivial build helpers {#chap-trivial-builders}
 
-Nixpkgs provides a variety of wrapper functions that help build commonly useful derivations.
-Like [`stdenv.mkDerivation`](#sec-using-stdenv), each of these build helpers creates a derivation, but the arguments passed are different (usually simpler) from those required by `stdenv.mkDerivation`.
+Nixpkgs provides a couple of functions that help with building derivations. The most important one, `stdenv.mkDerivation`, has already been documented above. The following functions wrap `stdenv.mkDerivation`, making it easier to use in certain cases.
 
 ## `runCommand` {#trivial-builder-runCommand}
 
@@ -59,416 +58,63 @@ Variant of `runCommand` that forces the derivation to be built locally, it is no
 This sets [`allowSubstitutes` to `false`](https://nixos.org/nix/manual/#adv-attr-allowSubstitutes), so only use `runCommandLocal` if you are certain the user will always have a builder for the `system` of the derivation. This should be true for most trivial use cases (e.g., just copying some files to a different location or adding symlinks) because there the `system` is usually the same as `builtins.currentSystem`.
 :::
 
-## Writing text files {#trivial-builder-text-writing}
+## `writeTextFile`, `writeText`, `writeTextDir`, `writeScript`, `writeScriptBin` {#trivial-builder-writeText}
 
-Nixpkgs provides the following functions for producing derivations which write text files or executable scripts into the Nix store.
-They are useful for creating files from Nix expression, and are all implemented as convenience wrappers around `writeTextFile`.
+These functions write `text` to the Nix store. This is useful for creating scripts from Nix expressions. `writeTextFile` takes an attribute set and expects two arguments, `name` and `text`. `name` corresponds to the name used in the Nix store path. `text` will be the contents of the file. You can also set `executable` to true to make this file have the executable bit set.
 
-Each of these functions will cause a derivation to be produced.
-When you coerce the result of each of these functions to a string with [string interpolation](https://nixos.org/manual/nix/stable/language/string-interpolation) or [`builtins.toString`](https://nixos.org/manual/nix/stable/language/builtins#builtins-toString), it will evaluate to the [store path](https://nixos.org/manual/nix/stable/store/store-path) of this derivation.
-
-:::: {.note}
-Some of these functions will put the resulting files within a directory inside the [derivation output](https://nixos.org/manual/nix/stable/language/derivations#attr-outputs).
-If you need to refer to the resulting files somewhere else in a Nix expression, append their path to the derivation's store path.
-
-For example, if the file destination is a directory:
-
-```nix
-my-file = writeTextFile {
-  name = "my-file";
-  text = ''
-    Contents of File
-  '';
-  destination = "/share/my-file";
-}
-```
-
-Remember to append "/share/my-file" to the resulting store path when using it elsewhere:
-
-```nix
-writeShellScript "evaluate-my-file.sh" ''
-  cat ${my-file}/share/my-file
-'';
-```
-::::
-
-### `writeTextFile` {#trivial-builder-writeTextFile}
-
-Write a text file to the Nix store.
-
-`writeTextFile` takes an attribute set with the following possible attributes:
-
-`name` (String)
-
-: Corresponds to the name used in the Nix store path identifier.
-
-`text` (String)
-
-: The contents of the file.
-
-`executable` (Bool, _optional_)
-
-: Make this file have the executable bit set.
-
-  Default: `false`
-
-`destination` (String, _optional_)
-
-: A subpath under the derivation's output path into which to put the file.
-  Subdirectories are created automatically when the derivation is realised.
-
-  By default, the store path itself will be a file containing the text contents.
-
-  Default: `""`
-
-`checkPhase` (String, _optional_)
-
-: Commands to run after generating the file.
-
-  Default: `""`
-
-`meta` (Attribute set, _optional_)
-
-: Additional metadata for the derivation.
-
-  Default: `{}`
-
-`allowSubstitutes` (Bool, _optional_)
-
-: Whether to allow substituting from a binary cache.
-  Passed through to [`allowSubsitutes`](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-allowSubstitutes) of the underlying call to `builtins.derivation`.
-
-  It defaults to `false`, as running the derivation's simple `builder` executable locally is assumed to be faster than network operations.
-  Set it to true if the `checkPhase` step is expensive.
-
-  Default: `false`
-
-`preferLocalBuild` (Bool, _optional_)
-
-: Whether to prefer building locally, even if faster [remote build machines](https://nixos.org/manual/nix/stable/command-ref/conf-file#conf-substituters) are available.
-
-  Passed through to [`preferLocalBuild`](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-preferLocalBuild) of the underlying call to `builtins.derivation`.
-
-  It defaults to `true` for the same reason `allowSubstitutes` defaults to `false`.
-
-  Default: `true`
-
-The resulting store path will include some variation of the name, and it will be a file unless `destination` is used, in which case it will be a directory.
-
-::: {.example #ex-writeTextFile}
-# Usage 1 of `writeTextFile`
-
-Write `my-file` to `/nix/store/<store path>/some/subpath/my-cool-script`, making it executable.
-Also run a check on the resulting file in a `checkPhase`, and supply values for the less-used options.
-
-```nix
-writeTextFile {
-  name = "my-cool-script";
-  text = ''
-    #!/bin/sh
-    echo "This is my cool script!"
-  '';
-  executable = true;
-  destination = "/some/subpath/my-cool-script";
-  checkPhase = ''
-    ${pkgs.shellcheck}/bin/shellcheck $out/some/subpath/my-cool-script
-  '';
-  meta = {
-    license = pkgs.lib.licenses.cc0;
-  };
-  allowSubstitutes = true;
-  preferLocalBuild = false;
-};
-```
-:::
-
-::: {.example #ex2-writeTextFile}
-# Usage 2 of `writeTextFile`
-
-Write the string `Contents of File` to `/nix/store/<store path>`.
-See also the [](#trivial-builder-writeText) helper function.
+Many more commands wrap `writeTextFile` including `writeText`, `writeTextDir`, `writeScript`, and `writeScriptBin`. These are convenience functions over `writeTextFile`.
 
+Here are a few examples:
 ```nix
+# Writes my-file to /nix/store/<store path>
 writeTextFile {
   name = "my-file";
   text = ''
     Contents of File
   '';
 }
-```
-:::
+# See also the `writeText` helper function below.
 
-::: {.example #ex3-writeTextFile}
-# Usage 3 of `writeTextFile`
-
-Write an executable script `my-script` to `/nix/store/<store path>/bin/my-script`.
-See also the [](#trivial-builder-writeScriptBin) helper function.
-
-```nix
+# Writes executable my-file to /nix/store/<store path>/bin/my-file
 writeTextFile {
-  name = "my-script";
+  name = "my-file";
   text = ''
-    echo "hi"
+    Contents of File
   '';
   executable = true;
-  destination = "/bin/my-script";
+  destination = "/bin/my-file";
 }
-```
-:::
-
-### `writeText` {#trivial-builder-writeText}
-
-Write a text file to the Nix store
-
-`writeText` takes the following arguments:
-a string.
-
-`name` (String)
-
-: The name used in the Nix store path.
-
-`text` (String)
-
-: The contents of the file.
-
-The store path will include the name, and it will be a file.
-
-::: {.example #ex-writeText}
-# Usage of `writeText`
-
-Write the string `Contents of File` to `/nix/store/<store path>`:
-
-```nix
+# Writes contents of file to /nix/store/<store path>
 writeText "my-file"
   ''
   Contents of File
   '';
-```
-:::
-
-This is equivalent to:
-
-```nix
-writeTextFile {
-  name = "my-file";
-  text = ''
-    Contents of File
-  '';
-}
-```
-
-### `writeTextDir` {#trivial-builder-writeTextDir}
-
-Write a text file within a subdirectory of the Nix store.
-
-`writeTextDir` takes the following arguments:
-
-`path` (String)
-
-: The destination within the Nix store path under which to create the file.
-
-`text` (String)
-
-: The contents of the file.
-
-The store path will be a directory.
-
-::: {.example #ex-writeTextDir}
-# Usage of `writeTextDir`
-
-Write the string `Contents of File` to `/nix/store/<store path>/share/my-file`:
-
-```nix
+# Writes contents of file to /nix/store/<store path>/share/my-file
 writeTextDir "share/my-file"
   ''
   Contents of File
   '';
-```
-:::
-
-This is equivalent to:
-
-```nix
-writeTextFile {
-  name = "my-file";
-  text = ''
-    Contents of File
-  '';
-  destination = "share/my-file";
-}
-```
-
-### `writeScript` {#trivial-builder-writeScript}
-
-Write an executable script file to the Nix store.
-
-`writeScript` takes the following arguments:
-
-`name` (String)
-
-: The name used in the Nix store path.
-
-`text` (String)
-
-: The contents of the file.
-
-The created file is marked as executable.
-The store path will include the name, and it will be a file.
-
-::: {.example #ex-writeScript}
-# Usage of `writeScript`
-
-Write the string `Contents of File` to `/nix/store/<store path>` and make the file executable.
-
-```nix
+# Writes my-file to /nix/store/<store path> and makes executable
 writeScript "my-file"
   ''
   Contents of File
   '';
-```
-:::
-
-This is equivalent to:
-
-```nix
-writeTextFile {
-  name = "my-file";
-  text = ''
-    Contents of File
-  '';
-  executable = true;
-}
-```
-
-### `writeScriptBin` {#trivial-builder-writeScriptBin}
-
-Write a script within a `bin` subirectory of a directory in the Nix store.
-This is for consistency with the convention of software packages placing executables under `bin`.
-
-`writeScriptBin` takes the following arguments:
-
-`name` (String)
-
-: The name used in the Nix store path and within the file created under the store path.
-
-`text` (String)
-
-: The contents of the file.
-
-The created file is marked as executable.
-The file's contents will be put into `/nix/store/<store path>/bin/<name>`.
-The store path will include the the name, and it will be a directory.
-
-::: {.example #ex-writeScriptBin}
-# Usage of `writeScriptBin`
-
-```nix
-writeScriptBin "my-script"
+# Writes my-file to /nix/store/<store path>/bin/my-file and makes executable.
+writeScriptBin "my-file"
   ''
-  echo "hi"
+  Contents of File
   '';
-```
-:::
-
-This is equivalent to:
-
-```nix
-writeTextFile {
-  name = "my-script";
-  text = ''
-    echo "hi"
-  '';
-  executable = true;
-  destination = "bin/my-script"
-}
-```
-
-### `writeShellScript` {#trivial-builder-writeShellScript}
-
-Write a Bash script to the store.
-
-`writeShellScript` takes the following arguments:
-
-`name` (String)
-
-: The name used in the Nix store path.
-
-`text` (String)
-
-: The contents of the file.
-
-The created file is marked as executable.
-The store path will include the name, and it will be a file.
-
-This function is almost exactly like [](#trivial-builder-writeScript), except that it prepends to the file a [shebang](https://en.wikipedia.org/wiki/Shebang_%28Unix%29) line that points to the version of Bash used in Nixpkgs.
-<!-- this cannot be changed in practice, so there is no point pretending it's somehow generic -->
-
-::: {.example #ex-writeShellScript}
-# Usage of `writeShellScript`
-
-```nix
-writeShellScript "my-script"
+# Writes my-file to /nix/store/<store path> and makes executable.
+writeShellScript "my-file"
   ''
-  echo "hi"
+  Contents of File
   '';
-```
-:::
-
-This is equivalent to:
-
-```nix
-writeTextFile {
-  name = "my-script";
-  text = ''
-    #! ${pkgs.runtimeShell}
-    echo "hi"
-  '';
-  executable = true;
-}
-```
-
-### `writeShellScriptBin` {#trivial-builder-writeShellScriptBin}
-
-Write a Bash script to a "bin" subdirectory of a directory in the Nix store.
-
-`writeShellScriptBin` takes the following arguments:
-
-`name` (String)
-
-: The name used in the Nix store path and within the file generated under the store path.
-
-`text` (String)
-
-: The contents of the file.
-
-The file's contents will be put into `/nix/store/<store path>/bin/<name>`.
-The store path will include the the name, and it will be a directory.
-
-This function is a combination of [](#trivial-builder-writeShellScript) and [](#trivial-builder-writeScriptBin).
-
-::: {.example #ex-writeShellScriptBin}
-# Usage of `writeShellScriptBin`
-
-```nix
-writeShellScriptBin "my-script"
+# Writes my-file to /nix/store/<store path>/bin/my-file and makes executable.
+writeShellScriptBin "my-file"
   ''
-  echo "hi"
+  Contents of File
   '';
-```
-:::
 
-This is equivalent to:
-
-```nix
-writeTextFile {
-  name = "my-script";
-  text = ''
-    #! ${pkgs.runtimeShell}
-    echo "hi"
-  '';
-  executable = true;
-  destination = "bin/my-script"
-}
 ```
 
 ## `concatTextFile`, `concatText`, `concatScript` {#trivial-builder-concatText}

doc/default.nix

@@ -149,26 +149,4 @@ in pkgs.stdenv.mkDerivation {
     echo "doc manual $dest ${common.indexPath}" >> $out/nix-support/hydra-build-products
     echo "doc manual $dest nixpkgs-manual.epub" >> $out/nix-support/hydra-build-products
   '';
-
-  passthru.tests.manpage-urls = with pkgs; testers.invalidateFetcherByDrvHash
-    ({ name ? "manual_check-manpage-urls"
-     , script
-     , urlsFile
-     }: runCommand name {
-      nativeBuildInputs = [
-        cacert
-        (python3.withPackages (p: with p; [
-          aiohttp
-          rich
-          structlog
-        ]))
-      ];
-      outputHash = "sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=";  # Empty output
-    } ''
-      python3 ${script} ${urlsFile}
-      touch $out
-    '') {
-      script = ./tests/manpage-urls.py;
-      urlsFile = ./manpage-urls.json;
-    };
 }

doc/languages-frameworks/cuda.section.md

@@ -68,45 +68,16 @@ All new projects should use the CUDA redistributables available in [`cudaPackage
 ### Updating CUDA redistributables {#updating-cuda-redistributables}
 
 1. Go to NVIDIA's index of CUDA redistributables: <https://developer.download.nvidia.com/compute/cuda/redist/>
-2. Make a note of the new version of CUDA available.
-3. Run
+2. Copy the `redistrib_*.json` corresponding to the release to `pkgs/development/compilers/cudatoolkit/redist/manifests`.
+3. Generate the `redistrib_features_*.json` file by running:
 
-   ```bash
-   nix run github:connorbaker/cuda-redist-find-features -- \
-      download-manifests \
-      --log-level DEBUG \
-      --version <newest CUDA version> \
-      https://developer.download.nvidia.com/compute/cuda/redist \
-      ./pkgs/development/cuda-modules/cuda/manifests
-   ```
+    ```bash
+    nix run github:ConnorBaker/cuda-redist-find-features -- <path to manifest>
+    ```
 
-   This will download a copy of the manifest for the new version of CUDA.
-4. Run
+    That command will generate the `redistrib_features_*.json` file in the same directory as the manifest.
 
-   ```bash
-   nix run github:connorbaker/cuda-redist-find-features -- \
-      process-manifests \
-      --log-level DEBUG \
-      --version <newest CUDA version> \
-      https://developer.download.nvidia.com/compute/cuda/redist \
-      ./pkgs/development/cuda-modules/cuda/manifests
-   ```
-
-   This will generate a `redistrib_features_<newest CUDA version>.json` file in the same directory as the manifest.
-5. Update the `cudaVersionMap` attribute set in `pkgs/development/cuda-modules/cuda/extension.nix`.
-
-### Updating cuTensor {#updating-cutensor}
-
-1. Repeat the steps present in [Updating CUDA redistributables](#updating-cuda-redistributables) with the following changes:
-   - Use the index of cuTensor redistributables: <https://developer.download.nvidia.com/compute/cutensor/redist>
-   - Use the newest version of cuTensor available instead of the newest version of CUDA.
-   - Use `pkgs/development/cuda-modules/cutensor/manifests` instead of `pkgs/development/cuda-modules/cuda/manifests`.
-   - Skip the step of updating `cudaVersionMap` in `pkgs/development/cuda-modules/cuda/extension.nix`.
-
-### Updating supported compilers and GPUs {#updating-supported-compilers-and-gpus}
-
-1. Update `nvcc-compatibilities.nix` in `pkgs/development/cuda-modules/` to include the newest release of NVCC, as well as any newly supported host compilers.
-2. Update `gpus.nix` in `pkgs/development/cuda-modules/` to include any new GPUs supported by the new release of CUDA.
+4. Include the path to the new manifest in `pkgs/development/compilers/cudatoolkit/redist/extension.nix`.
 
 ### Updating the CUDA Toolkit runfile installer {#updating-the-cuda-toolkit}
 
@@ -128,7 +99,7 @@ All new projects should use the CUDA redistributables available in [`cudaPackage
    nix store prefetch-file --hash-type sha256 <link>
    ```
 
-4. Update `pkgs/development/cuda-modules/cudatoolkit/releases.nix` to include the release.
+4. Update `pkgs/development/compilers/cudatoolkit/versions.toml` to include the release.
 
 ### Updating the CUDA package set {#updating-the-cuda-package-set}
 
@@ -136,7 +107,7 @@ All new projects should use the CUDA redistributables available in [`cudaPackage
 
    - NOTE: Changing the default CUDA package set should occur in a separate PR, allowing time for additional testing.
 
-2. Successfully build the closure of the new package set, updating `pkgs/development/cuda-modules/cuda/overrides.nix` as needed. Below are some common failures:
+2. Successfully build the closure of the new package set, updating `pkgs/development/compilers/cudatoolkit/redist/overrides.nix` as needed. Below are some common failures:
 
 | Unable to ... | During ... | Reason | Solution | Note |
 | --- | --- | --- | --- | --- |

doc/languages-frameworks/dart.section.md

@@ -4,33 +4,22 @@
 
 The function `buildDartApplication` builds Dart applications managed with pub.
 
-It fetches its Dart dependencies automatically through `pub2nix`, and (through a series of hooks) builds and installs the executables specified in the pubspec file. The hooks can be used in other derivations, if needed. The phases can also be overridden to do something different from installing binaries.
+It fetches its Dart dependencies automatically through `fetchDartDeps`, and (through a series of hooks) builds and installs the executables specified in the pubspec file. The hooks can be used in other derivations, if needed. The phases can also be overridden to do something different from installing binaries.
 
 If you are packaging a Flutter desktop application, use [`buildFlutterApplication`](#ssec-dart-flutter) instead.
 
-`pubspecLock` is the parsed pubspec.lock file. pub2nix uses this to download required packages.
-This can be converted to JSON from YAML with something like `yq . pubspec.lock`, and then read by Nix.
+`vendorHash`: is the hash of the output of the dependency fetcher derivation. To obtain it, set it to `lib.fakeHash` (or omit it) and run the build ([more details here](#sec-source-hashes)).
 
-Alternatively, `autoPubspecLock` can be used instead, and set to a path to a regular `pubspec.lock` file. This relies on import-from-derivation, and is not permitted in Nixpkgs, but can be useful at other times.
+If the upstream source is missing a `pubspec.lock` file, you'll have to vendor one and specify it using `pubspecLockFile`. If it is needed, one will be generated for you and printed when attempting to build the derivation.
 
-::: {.warning}
-When using `autoPubspecLock` with a local source directory, make sure to use a
-concatenation operator (e.g. `autoPubspecLock = src + "/pubspec.lock";`), and
-not string interpolation.
-
-String interpolation will copy your entire source directory to the Nix store and
-use its store path, meaning that unrelated changes to your source tree will
-cause the generated `pubspec.lock` derivation to rebuild!
-:::
-
-If the package has Git package dependencies, the hashes must be provided in the `gitHashes` set. If a hash is missing, an error message prompting you to add it will be shown.
+The `depsListFile` must always be provided when packaging in Nixpkgs. It will be generated and printed if the derivation is attempted to be built without one. Alternatively, `autoDepsList` may be set to `true` only when outside of Nixpkgs, as it relies on import-from-derivation.
 
 The `dart` commands run can be overridden through `pubGetScript` and `dartCompileCommand`, you can also add flags using `dartCompileFlags` or `dartJitFlags`.
 
 Dart supports multiple [outputs types](https://dart.dev/tools/dart-compile#types-of-output), you can choose between them using `dartOutputType` (defaults to `exe`). If you want to override the binaries path or the source path they come from, you can use `dartEntryPoints`. Outputs that require a runtime will automatically be wrapped with the relevant runtime (`dartaotruntime` for `aot-snapshot`, `dart run` for `jit-snapshot` and `kernel`, `node` for `js`), this can be overridden through `dartRuntimeCommand`.
 
 ```nix
-{ lib, buildDartApplication, fetchFromGitHub }:
+{ buildDartApplication, fetchFromGitHub }:
 
 buildDartApplication rec {
   pname = "dart-sass";
@@ -43,55 +32,12 @@ buildDartApplication rec {
     hash = "sha256-U6enz8yJcc4Wf8m54eYIAnVg/jsGi247Wy8lp1r1wg4=";
   };
 
-  pubspecLock = lib.importJSON ./pubspec.lock.json;
+  pubspecLockFile = ./pubspec.lock;
+  depsListFile = ./deps.json;
+  vendorHash = "sha256-Atm7zfnDambN/BmmUf4BG0yUz/y6xWzf0reDw3Ad41s=";
 }
 ```
 
-### Patching dependencies {#ssec-dart-applications-patching-dependencies}
-
-Some Dart packages require patches or build environment changes. Package derivations can be customised with the `customSourceBuilders` argument.
-
-A collection of such customisations can be found in Nixpkgs, in the `development/compilers/dart/package-source-builders` directory.
-
-This allows fixes for packages to be shared between all applications that use them. It is strongly recommended to add to this collection instead of including fixes in your application derivation itself.
-
-### Running executables from dev_dependencies {#ssec-dart-applications-build-tools}
-
-Many Dart applications require executables from the `dev_dependencies` section in `pubspec.yaml` to be run before building them.
-
-This can be done in `preBuild`, in one of two ways:
-
-1. Packaging the tool with `buildDartApplication`, adding it to Nixpkgs, and running it like any other application
-2. Running the tool from the package cache
-
-Of these methods, the first is recommended when using a tool that does not need
-to be of a specific version.
-
-For the second method, the `packageRun` function from the `dartConfigHook` can be used.
-This is an alternative to `dart run` that does not rely on Pub.
-
-e.g., for `build_runner`:
-
-```bash
-packageRun build_runner build
-```
-
-Do _not_ use `dart run <package_name>`, as this will attempt to download dependencies with Pub.
-
-### Usage with nix-shell {#ssec-dart-applications-nix-shell}
-
-#### Using dependencies from the Nix store {#ssec-dart-applications-nix-shell-deps}
-
-As `buildDartApplication` provides dependencies instead of `pub get`, Dart needs to be explicitly told where to find them.
-
-Run the following commands in the source directory to configure Dart appropriately.
-Do not use `pub` after doing so; it will download the dependencies itself and overwrite these changes.
-
-```bash
-cp --no-preserve=all "$pubspecLockFilePath" pubspec.lock
-mkdir -p .dart_tool && cp --no-preserve=all "$packageConfig" .dart_tool/package_config.json
-```
-
 ## Flutter applications {#ssec-dart-flutter}
 
 The function `buildFlutterApplication` builds Flutter applications.
@@ -105,9 +51,6 @@ flutter.buildFlutterApplication {
   pname = "firmware-updater";
   version = "unstable-2023-04-30";
 
-  # To build for the Web, use the targetFlutterPlatform argument.
-  # targetFlutterPlatform = "web";
-
   src = fetchFromGitHub {
     owner = "canonical";
     repo = "firmware-updater";
@@ -116,21 +59,8 @@ flutter.buildFlutterApplication {
     fetchSubmodules = true;
   };
 
-  pubspecLock = lib.importJSON ./pubspec.lock.json;
+  pubspecLockFile = ./pubspec.lock;
+  depsListFile = ./deps.json;
+  vendorHash = "sha256-cdMO+tr6kYiN5xKXa+uTMAcFf2C75F3wVPrn21G4QPQ=";
 }
 ```
-
-### Usage with nix-shell {#ssec-dart-flutter-nix-shell}
-
-Flutter-specific `nix-shell` usage notes are included here. See the [Dart documentation](#ssec-dart-applications-nix-shell) for general `nix-shell` instructions.
-
-#### Entering the shell {#ssec-dart-flutter-nix-shell-enter}
-
-By default, dependencies for only the `targetFlutterPlatform` are available in the
-build environment. This is useful for keeping closures small, but be problematic
-during development. It's common, for example, to build Web apps for Linux during
-development to take advantage of native features such as stateful hot reload.
-
-To enter a shell with all the usual target platforms available, use the `multiShell` attribute.
-
-e.g. `nix-shell '<nixpkgs>' -A fluffychat-web.multiShell`.

doc/languages-frameworks/go.section.md

@@ -1,41 +1,26 @@
 # Go {#sec-language-go}
 
-## Building Go modules with `buildGoModule` {#ssec-language-go}
+## Go modules {#ssec-language-go}
 
-The function `buildGoModule` builds Go programs managed with Go modules. It builds [Go Modules](https://github.com/golang/go/wiki/Modules) through a two phase build:
+The function `buildGoModule` builds Go programs managed with Go modules. It builds a [Go Modules](https://github.com/golang/go/wiki/Modules) through a two phase build:
 
-- An intermediate fetcher derivation called `goModules`. This derivation will be used to fetch all the dependencies of the Go module.
+- An intermediate fetcher derivation. This derivation will be used to fetch all of the dependencies of the Go module.
 - A final derivation will use the output of the intermediate derivation to build the binaries and produce the final output.
 
-### Attributes of `buildGoModule` {#buildgomodule-parameters}
-
-The `buildGoModule` function accepts the following parameters in addition to the [attributes accepted by both Go builders](#ssec-go-common-attributes):
-
-- `vendorHash`: is the hash of the output of the intermediate fetcher derivation (the dependencies of the Go modules).
-
-  `vendorHash` can be set to `null`.
-  In that case, rather than fetching the dependencies, the dependencies already vendored in the `vendor` directory of the source repo will be used.
-
-  To avoid updating this field when dependencies change, run `go mod vendor` in your source repo and set `vendorHash = null;`.
-  You can read more about [vendoring in the Go documentation](https://go.dev/ref/mod#vendoring).
-
-  To obtain the actual hash, set `vendorHash = lib.fakeHash;` and run the build ([more details here](#sec-source-hashes)).
-- `proxyVendor`: If `true`, the intermediate fetcher downloads dependencies from the
-  [Go module proxy](https://go.dev/ref/mod#module-proxy) (using `go mod download`) instead of vendoring them. The resulting
-  [module cache](https://go.dev/ref/mod#module-cache) is then passed to the final derivation.
-
-  This is useful if your code depends on C code and `go mod tidy` does not include the needed sources to build or
-  if any dependency has case-insensitive conflicts which will produce platform-dependent `vendorHash` checksums.
-
-  Defaults to `false`.
-- `modPostBuild`: Shell commands to run after the build of the goModules executes `go mod vendor`, and before calculating fixed output derivation's `vendorHash`.
-  Note that if you change this attribute, you need to update `vendorHash` attribute.
-- `modRoot`: The root directory of the Go module that contains the `go.mod` file.
-  Defaults to `./`, which is the root of `src`.
-
 ### Example for `buildGoModule` {#ex-buildGoModule}
 
-The following is an example expression using `buildGoModule`:
+In the following is an example expression using `buildGoModule`, the following arguments are of special significance to the function:
+
+- `vendorHash`: is the hash of the output of the intermediate fetcher derivation.
+
+  `vendorHash` can also be set to `null`.
+  In that case, rather than fetching the dependencies and vendoring them, the dependencies vendored in the source repo will be used.
+
+  To avoid updating this field when dependencies change, run `go mod vendor` in your source repo and set `vendorHash = null;`
+
+  To obtain the actual hash, set `vendorHash = lib.fakeHash;` and run the build ([more details here](#sec-source-hashes)).
+- `proxyVendor`: Fetches (go mod download) and proxies the vendor directory. This is useful if your code depends on c code and go mod tidy does not include the needed sources to build or if any dependency has case-insensitive conflicts which will produce platform-dependent `vendorHash` checksums.
+- `modPostBuild`: Shell commands to run after the build of the goModules executes `go mod vendor`, and before calculating fixed output derivation's `vendorHash`. Note that if you change this attribute, you need to update `vendorHash` attribute.
 
 ```nix
 pet = buildGoModule rec {
@@ -66,7 +51,7 @@ The function `buildGoPackage` builds legacy Go programs, not supporting Go modul
 
 ### Example for `buildGoPackage` {#example-for-buildgopackage}
 
-In the following is an example expression using `buildGoPackage`, the following arguments are of special significance to the function:
+In the following is an example expression using buildGoPackage, the following arguments are of special significance to the function:
 
 - `goPackagePath` specifies the package's canonical Go import path.
 - `goDeps` is where the Go dependencies of a Go program are listed as a list of package source identified by Go import path. It could be imported as a separate `deps.nix` file for readability. The dependency data structure is described below.
@@ -118,7 +103,7 @@ The `goDeps` attribute can be imported from a separate `nix` file that defines w
 ]
 ```
 
-To extract dependency information from a Go package in automated way use [go2nix (deprecated)](https://github.com/kamilchm/go2nix). It can produce complete derivation and `goDeps` file for Go programs.
+To extract dependency information from a Go package in automated way use [go2nix](https://github.com/kamilchm/go2nix). It can produce complete derivation and `goDeps` file for Go programs.
 
 You may use Go packages installed into the active Nix profiles by adding the following to your ~/.bashrc:
 
@@ -128,7 +113,7 @@ for p in $NIX_PROFILES; do
 done
 ```
 
-## Attributes used by both builders {#ssec-go-common-attributes}
+## Attributes used by the builders {#ssec-go-common-attributes}
 
 Many attributes [controlling the build phase](#variables-controlling-the-build-phase) are respected by both `buildGoModule` and `buildGoPackage`. Note that `buildGoModule` reads the following attributes also when building the `vendor/` goModules fixed output derivation as well:
 
@@ -139,21 +124,15 @@ Many attributes [controlling the build phase](#variables-controlling-the-build-p
 - [`postPatch`](#var-stdenv-postPatch)
 - [`preBuild`](#var-stdenv-preBuild)
 
-To control test execution of the build derivation, the following attributes are of interest:
-
-- [`checkInputs`](#var-stdenv-checkInputs)
-- [`preCheck`](#var-stdenv-preCheck)
-- [`checkFlags`](#var-stdenv-checkFlags)
-
 In addition to the above attributes, and the many more variables respected also by `stdenv.mkDerivation`, both `buildGoModule` and `buildGoPackage` respect Go-specific attributes that tweak them to behave slightly differently:
 
 ### `ldflags` {#var-go-ldflags}
 
-A string list of flags to pass to the Go linker tool via the `-ldflags` argument of `go build`. Possible values can be retrieved by running `go tool link --help`.
-The most common use case for this argument is to make the resulting executable aware of its own version by injecting the value of string variable using the `-X` flag. For example:
+Arguments to pass to the Go linker tool via the `-ldflags` argument of `go build`. The most common use case for this argument is to make the resulting executable aware of its own version. For example:
 
 ```nix
   ldflags = [
+    "-s" "-w"
     "-X main.Version=${version}"
     "-X main.Commit=${version}"
   ];
@@ -161,7 +140,7 @@ The most common use case for this argument is to make the resulting executable a
 
 ### `tags` {#var-go-tags}
 
-A string list of [Go build tags (also called build constraints)](https://pkg.go.dev/cmd/go#hdr-Build_constraints) that are passed via the `-tags` argument of `go build`.  These constraints control whether Go files from the source should be included in the build. For example:
+Arguments to pass to the Go via the `-tags` argument of `go build`. For example:
 
 ```nix
   tags = [
@@ -170,101 +149,18 @@ A string list of [Go build tags (also called build constraints)](https://pkg.go.
   ];
 ```
 
-Tags can also be set conditionally:
-
 ```nix
   tags = [ "production" ] ++ lib.optionals withSqlite [ "sqlite" ];
 ```
 
 ### `deleteVendor` {#var-go-deleteVendor}
 
-If set to `true`, removes the pre-existing vendor directory. This should only be used if the dependencies included in the vendor folder are broken or incomplete.
+Removes the pre-existing vendor directory. This should only be used if the dependencies included in the vendor folder are broken or incomplete.
 
 ### `subPackages` {#var-go-subPackages}
 
 Specified as a string or list of strings. Limits the builder from building child packages that have not been listed. If `subPackages` is not specified, all child packages will be built.
 
-Many Go projects keep the main package in a `cmd` directory.
-Following example could be used to only build the example-cli and example-server binaries:
-
-```nix
-subPackages = [
-  "cmd/example-cli"
-  "cmd/example-server"
-];
-```
-
 ### `excludedPackages` {#var-go-excludedPackages}
 
-Specified as a string or list of strings. Causes the builder to skip building child packages that match any of the provided values.
-
-### `CGO_ENABLED` {#var-go-CGO_ENABLED}
-
-When set to `0`, the [cgo](https://pkg.go.dev/cmd/cgo) command is disabled. As consequence, the build
-program can't link against C libraries anymore, and the resulting binary is statically linked.
-
-When building with CGO enabled, Go will likely link some packages from the Go standard library against C libraries,
-even when the target code does not explicitly call into C dependencies. With `CGO_ENABLED = 0;`, Go
-will always use the Go native implementation of these internal packages. For reference see
-[net](https://pkg.go.dev/net#hdr-Name_Resolution) and [os/user](https://pkg.go.dev/os/user#pkg-overview) packages.
-Notice that the decision whether these packages should use native Go implementation or not can also be controlled
-on a per package level using build tags (`tags`). In case CGO is disabled, these tags have no additional effect.
-
-When a Go program depends on C libraries, place those dependencies in `buildInputs`:
-
-```nix
-  buildInputs = [
-    libvirt
-    libxml2
-  ];
-```
-
-`CGO_ENABLED` defaults to `1`.
-
-### `enableParallelBuilding` {#var-go-enableParallelBuilding}
-
-Whether builds and tests should run in parallel.
-
-Defaults to `true`.
-
-### `allowGoReference` {#var-go-allowGoReference}
-
-Whether the build result should be allowed to contain references to the Go tool chain. This might be needed for programs that are coupled with the compiler, but shouldn't be set without a good reason.
-
-Defaults to `false`
-
-## Controlling the Go environment {#ssec-go-environment}
-
-The Go build can be further tweaked by setting environment variables. In most cases, this isn't needed. Possible values can be found in the [Go documentation of accepted environment variables](https://pkg.go.dev/cmd/go#hdr-Environment_variables). Notice that some of these flags are set by the builder itself and should not be set explicitly. If in doubt, grep the implementation of the builder.
-
-## Skipping tests {#ssec-skip-go-tests}
-
-`buildGoModule` runs tests by default. Failing tests can be disabled using the `checkFlags` parameter.
-This is done with the [`-skip` or `-run`](https://pkg.go.dev/cmd/go#hdr-Testing_flags) flags of the `go test` command.
-
-For example, only a selection of tests could be run with:
-
-```nix
-  # -run and -skip accept regular expressions
-  checkFlags = [
-    "-run=^Test(Simple|Fast)$"
-  ];
-```
-
-If a larger amount of tests should be skipped, the following pattern can be used:
-
-```nix
-  checkFlags =
-    let
-      # Skip tests that require network access
-      skippedTests = [
-        "TestNetwork"
-        "TestDatabase/with_mysql" # exclude only the subtest
-        "TestIntegration"
-      ];
-    in
-    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
-```
-
-To disable tests altogether, set `doCheck = false;`.
-`buildGoPackage` does not execute tests by default.
+Specified as a string or list of strings. Causes the builder to skip building child packages that match any of the provided values. If `excludedPackages` is not specified, all child packages will be built.

doc/languages-frameworks/idris2.section.md

@@ -1,47 +0,0 @@
-# Idris2 {#sec-idris2}
-
-In addition to exposing the Idris2 compiler itself, Nixpkgs exposes an `idris2Packages.buildIdris` helper to make it a bit more ergonomic to build Idris2 executables or libraries.
-
-The `buildIdris` function takes a package set that defines at a minimum the `src` and `projectName` of the package to be built and any `idrisLibraries` required to build it. The `src` is the same source you're familiar with but the `projectName` must be the name of the `ipkg` file for the project (omitting the `.ipkg` extension). The `idrisLibraries` is a list of other library derivations created with `buildIdris`. You can optionally specify other derivation properties as needed but sensible defaults for `configurePhase`, `buildPhase`, and `installPhase` are provided.
-
-Importantly, `buildIdris` does not create a single derivation but rather an attribute set with two properties: `executable` and `library`. The `executable` property is a derivation and the `library` property is a function that will return a derivation for the library with or without source code included. Source code need not be included unless you are aiming to use IDE or LSP features that are able to jump to definitions within an editor.
-
-A simple example of a fully packaged library would be the [`LSP-lib`](https://github.com/idris-community/LSP-lib) found in the `idris-community` GitHub organization.
-```nix
-{ fetchFromGitHub, idris2Packages }:
-let lspLibPkg = idris2Packages.buildIdris {
-  projectName = "lsp-lib";
-  src = fetchFromGitHub {
-   owner = "idris-community";
-   repo = "LSP-lib";
-   rev = "main";
-   hash = "sha256-EvSyMCVyiy9jDZMkXQmtwwMoLaem1GsKVFqSGNNHHmY=";
-  };
-  idrisLibraries = [ ];
-};
-in lspLibPkg.library
-```
-
-The above results in a derivation with the installed library results (with sourcecode).
-
-A slightly more involved example of a fully packaged executable would be the [`idris2-lsp`](https://github.com/idris-community/idris2-lsp) which is an Idris2 language server that uses the `LSP-lib` found above.
-```nix
-{ callPackage, fetchFromGitHub, idris2Packages }:
-
-# Assuming the previous example lives in `lsp-lib.nix`:
-let lspLib = callPackage ./lsp-lib.nix { };
-    lspPkg = idris2Packages.buildIdris {
-      projectName = "idris2-lsp";
-      src = fetchFromGitHub {
-         owner = "idris-community";
-         repo = "idris2-lsp";
-         rev = "main";
-         hash = "sha256-vQTzEltkx7uelDtXOHc6QRWZ4cSlhhm5ziOqWA+aujk=";
-      };
-      idrisLibraries = [(idris2Packages.idris2Api { }) (lspLib { })];
-    };
-in lspPkg.executable
-```
-
-The above uses the default value of `withSource = false` for both of the two required Idris libraries that the `idris2-lsp` executable depends on. `idris2Api` in the above derivation comes built in with `idris2Packages`. This library exposes many of the otherwise internal APIs of the Idris2 compiler.
-

doc/languages-frameworks/index.md

@@ -21,11 +21,9 @@ go.section.md
 haskell.section.md
 hy.section.md
 idris.section.md
-idris2.section.md
 ios.section.md
 java.section.md
 javascript.section.md
-julia.section.md
 lisp.section.md
 lua.section.md
 maven.section.md

doc/languages-frameworks/javascript.section.md

@@ -354,7 +354,6 @@ mkYarnPackage rec {
 
   - The `echo 9` steps comes from this answer: <https://stackoverflow.com/a/49139496>
   - Exporting the headers in `npm_config_nodedir` comes from this issue: <https://github.com/nodejs/node-gyp/issues/1191#issuecomment-301243919>
-- `offlineCache` (described [above](#javascript-yarn2nix-preparation)) must be specified to avoid [Import From Derivation](#ssec-import-from-derivation) (IFD) when used inside Nixpkgs.
 
 ## Outside Nixpkgs {#javascript-outside-nixpkgs}
 

doc/languages-frameworks/julia.section.md

@@ -1,69 +0,0 @@
-# Julia {#language-julia}
-
-## Introduction {#julia-introduction}
-
-Nixpkgs includes Julia as the `julia` derivation.
-You can get specific versions by looking at the other `julia*` top-level derivations available.
-For example, `julia_19` corresponds to Julia 1.9.
-We also provide the current stable version as `julia-stable`, and an LTS version as `julia-lts`.
-
-Occasionally, a Julia version has been too difficult to build from source in Nixpkgs and has been fetched prebuilt instead.
-These Julia versions are differentiated with the `*-bin` suffix; for example, `julia-stable-bin`.
-
-## julia.withPackages {#julia-withpackage}
-
-The basic Julia derivations only provide the built-in packages that come with the distribution.
-
-You can build Julia environments with additional packages using the `julia.withPackages` command.
-This function accepts a list of strings representing Julia package names.
-For example, you can build a Julia environment with the `Plots` package as follows.
-
-```nix
-julia.withPackages ["Plots"]
-```
-
-Arguments can be passed using `.override`.
-For example:
-
-```nix
-(julia.withPackages.override {
-  precompile = false; # Turn off precompilation
-}) ["Plots"]
-```
-
-Here's a nice way to run a Julia environment with a shell one-liner:
-
-```sh
-nix-shell -p 'julia.withPackages ["Plots"]' --run julia
-```
-
-### Arguments {#julia-withpackage-arguments}
-
-* `precompile`: Whether to run `Pkg.precompile()` on the generated environment.
-
-  This will make package imports faster, but may fail in some cases.
-  For example, there is an upstream issue with `Gtk.jl` that prevents precompilation from working in the Nix build sandbox, because the precompiled code tries to access a display.
-  Packages like this will work fine if you build with `precompile=false`, and then precompile as needed once your environment starts.
-
-  Defaults: `true`
-
-* `extraLibs`: Extra library dependencies that will be placed on the `LD_LIBRARY_PATH` for Julia.
-
-  Should not be needed as we try to obtain library dependencies automatically using Julia's artifacts system.
-
-* `makeWrapperArgs`: Extra arguments to pass to the `makeWrapper` call which we use to wrap the Julia binary.
-* `setDefaultDepot`: Whether to automatically prepend `$HOME/.julia` to the `JULIA_DEPOT_PATH`.
-
-  This is useful because Julia expects a writable depot path as the first entry, which the one we build in Nixpkgs is not.
-  If there's no writable depot, then Julia will show a warning and be unable to save command history logs etc.
-
-  Default: `true`
-
-* `packageOverrides`: Allows you to override packages by name by passing an alternative source.
-
-  For example, you can use a custom version of the `LanguageServer` package by passing `packageOverrides = { "LanguageServer" = fetchFromGitHub {...}; }`.
-
-* `augmentedRegistry`: Allows you to change the registry from which Julia packages are drawn.
-
-  This normally points at a special augmented version of the Julia [General packages registry](https://github.com/JuliaRegistries/General).
-  If you want to use a bleeding-edge version to pick up the latest package updates, you can plug in a later revision than the one in Nixpkgs.

doc/languages-frameworks/nim.section.md

@@ -1,38 +1,74 @@
 # Nim {#nim}
 
-The Nim compiler and a builder function is available.
-Nim programs are built using `buildNimPackage` and a lockfile containing Nim dependencies.
+## Overview {#nim-overview}
+
+The Nim compiler, a builder function, and some packaged libraries are available
+in Nixpkgs. Until now each compiler release has been effectively backwards
+compatible so only the latest version is available.
+
+## Nim program packages in Nixpkgs {#nim-program-packages-in-nixpkgs}
+
+Nim programs can be built using `nimPackages.buildNimPackage`. In the
+case of packages not containing exported library code the attribute
+`nimBinOnly` should be set to `true`.
 
 The following example shows a Nim program that depends only on Nim libraries:
-```nix
-{ lib, buildNimPackage, fetchFromGitHub }:
 
-buildNimPackage { } (finalAttrs: {
+```nix
+{ lib, nimPackages, fetchFromGitHub }:
+
+nimPackages.buildNimPackage (finalAttrs: {
   pname = "ttop";
-  version = "1.2.7";
+  version = "1.0.1";
+  nimBinOnly = true;
 
   src = fetchFromGitHub {
     owner = "inv2004";
     repo = "ttop";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-oPdaUqh6eN1X5kAYVvevOndkB/xnQng9QVLX9bu5P5E=";
+    hash = "sha256-x4Uczksh6p3XX/IMrOFtBxIleVHdAPX9e8n32VAUTC4=";
   };
 
-  lockFile = ./lock.json;
+  buildInputs = with nimPackages; [ asciigraph illwill parsetoml zippy ];
 
-  nimFlags = [
-    "-d:NimblePkgVersion=${finalAttrs.version}"
-  ];
+})
+```
+
+## Nim library packages in Nixpkgs {#nim-library-packages-in-nixpkgs}
+
+
+Nim libraries can also be built using `nimPackages.buildNimPackage`, but
+often the product of a fetcher is sufficient to satisfy a dependency.
+The `fetchgit`, `fetchFromGitHub`, and `fetchNimble` functions yield an
+output that can be discovered during the `configurePhase` of `buildNimPackage`.
+
+Nim library packages are listed in
+[pkgs/top-level/nim-packages.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/top-level/nim-packages.nix) and implemented at
+[pkgs/development/nim-packages](https://github.com/NixOS/nixpkgs/tree/master/pkgs/development/nim-packages).
+
+The following example shows a Nim library that propagates a dependency on a
+non-Nim package:
+```nix
+{ lib, buildNimPackage, fetchNimble, SDL2 }:
+
+buildNimPackage (finalAttrs: {
+  pname = "sdl2";
+  version = "2.0.4";
+  src = fetchNimble {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-Vtcj8goI4zZPQs2TbFoBFlcR5UqDtOldaXSH/+/xULk=";
+  };
+  propagatedBuildInputs = [ SDL2 ];
 })
 ```
 
 ## `buildNimPackage` parameters {#buildnimpackage-parameters}
 
-The `buildNimPackage` function takes an attrset of parameters that are passed on to `stdenv.mkDerivation`.
+All parameters from `stdenv.mkDerivation` function are still supported. The
+following are specific to `buildNimPackage`:
 
-The following parameters are specific to `buildNimPackage`:
-
-* `lockFile`: JSON formatted lockfile.
+* `nimBinOnly ? false`: If `true` then build only the programs listed in
+  the Nimble file in the packages sources.
 * `nimbleFile`: Specify the Nimble file location of the package being built
   rather than discover the file at build-time.
 * `nimRelease ? true`: Build the package in *release* mode.
@@ -41,85 +77,6 @@ The following parameters are specific to `buildNimPackage`:
   Use this to specify defines with arguments in the form of `-d:${name}=${value}`.
 * `nimDoc` ? false`: Build and install HTML documentation.
 
-## Lockfiles {#nim-lockfiles}
-Nim lockfiles are created with the `nim_lk` utility.
-Run `nim_lk` with the source directory as an argument and it will print a lockfile to stdout.
-```sh
-$ cd nixpkgs
-$ nix build -f . ttop.src
-$ nix run -f . nim_lk ./result | jq --sort-keys > pkgs/by-name/tt/ttop/lock.json
-```
-
-## Overriding Nim packages {#nim-overrides}
-
-The `buildNimPackage` function generates flags and additional build dependencies from the `lockFile` parameter passed to `buildNimPackage`. Using [`overrideAttrs`](#sec-pkg-overrideAttrs) on the final package will apply after this has already been generated, so this can't be used to override the `lockFile` in a package built with `buildNimPackage`. To be able to override parameters before flags and build dependencies are generated from the `lockFile`, use `overrideNimAttrs` instead with the same syntax as `overrideAttrs`:
-
-```nix
-pkgs.nitter.overrideNimAttrs {
-  # using a different source which has different dependencies from the standard package
-  src = pkgs.fetchFromGithub { /* … */ };
-  # new lock file generated from the source
-  lockFile = ./custom-lock.json;
-}
-```
-
-## Lockfile dependency overrides {#nim-lock-overrides}
-
-The `buildNimPackage` function matches the libraries specified by `lockFile` to attrset of override functions that are then applied to the package derivation.
-The default overrides are maintained as the top-level `nimOverrides` attrset at `pkgs/top-level/nim-overrides.nix`.
-
-For example, to propagate a dependency on SDL2 for lockfiles that select the Nim `sdl2` library, an overlay is added to the set in the `nim-overrides.nix` file:
-```nix
-{ lib
-/* … */
-, SDL2
-/* … */
-}:
-
-{
-  /* … */
-  sdl2 =
-    lockAttrs:
-    finalAttrs:
-    { buildInputs ? [ ], ... }:
-    {
-      buildInputs = buildInputs ++ [ SDL2 ];
-    };
-  /* … */
-}
-```
-
-The annotations in the `nim-overrides.nix` set are functions that take three arguments and return a new attrset to be overlayed on the package being built.
-- lockAttrs: the attrset for this library from within a lockfile. This can be used to implement library version constraints, such as marking libraries as broken or insecure.
-- finalAttrs: the final attrset passed by `buildNimPackage` to `stdenv.mkDerivation`.
-- prevAttrs: the attrset produced by initial arguments to `buildNimPackage` and any preceding lockfile overlays.
-
-### Overriding an Nim library override {#nim-lock-overrides-overrides}
-
-The `nimOverrides` attrset makes it possible to modify overrides in a few different ways.
-
-Override a package internal to its definition:
-```nix
-{ lib, buildNimPackage, nimOverrides, libressl }:
-
-let
-  buildNimPackage' = buildNimPackage.override {
-    nimOverrides = nimOverrides.override { openssl = libressl; };
-  };
-in buildNimPackage' (finalAttrs: {
-  pname = "foo";
-  # …
-})
-
-```
-
-Override a package externally:
-```nix
-{ pkgs }: {
-  foo = pkgs.foo.override {
-    buildNimPackage = pkgs.buildNimPackage.override {
-      nimOverrides = pkgs.nimOverrides.override { openssl = libressl; };
-    };
-  };
-}
-```
+* `buildInputs` ? []: The packages listed here will be searched for `*.nimble`
+  files which are used to populate the Nim library path. Otherwise the standard
+  behavior is in effect.

doc/languages-frameworks/python.section.md

@@ -299,13 +299,14 @@ python3Packages.buildPythonApplication rec {
     hash  = "sha256-Pe229rT0aHwA98s+nTHQMEFKZPo/yw6sot8MivFDvAw=";
   };
 
-  nativeBuildInputs = with python3Packages; [
-    setuptools
+  nativeBuildInputs = [
+    python3Packages.setuptools
+    python3Packages.wheel
   ];
 
-  propagatedBuildInputs = with python3Packages; [
-    tornado
-    python-daemon
+  propagatedBuildInputs = [
+    python3Packages.tornado
+    python3Packages.python-daemon
   ];
 
   meta = with lib; {
@@ -2060,7 +2061,7 @@ and create update commits, and supports the `fetchPypi`, `fetchurl` and
 hosted on GitHub, exporting a `GITHUB_API_TOKEN` is highly recommended.
 
 Updating packages in bulk leads to lots of breakages, which is why a
-stabilization period on the `python-updates` branch is required.
+stabilization period on the `python-unstable` branch is required.
 
 If a package is fragile and often breaks during these bulks updates, it
 may be reasonable to set `passthru.skipBulkUpdate = true` in the

doc/languages-frameworks/qt.section.md

@@ -26,17 +26,6 @@ It is important to import Qt modules directly, that is: `qtbase`, `qtdeclarative
 
 Additionally all Qt packages must include `wrapQtAppsHook` in `nativeBuildInputs`, or you must explicitly set `dontWrapQtApps`.
 
-`pkgs.callPackage` does not provide injections for `qtbase` or the like.
-Instead you want to either use `pkgs.libsForQt5.callPackage`, or `pkgs.qt6Packages.callPackage`, depending on the Qt version you want to use.
-
-For example (from [here](https://github.com/NixOS/nixpkgs/blob/2f9286912cb215969ece465147badf6d07aa43fe/pkgs/top-level/all-packages.nix#L30106))
-
-```nix
-  zeal-qt5 = libsForQt5.callPackage ../data/documentation/zeal { };
-  zeal-qt6 = qt6Packages.callPackage ../data/documentation/zeal { };
-  zeal = zeal-qt5;
-```
-
 ## Locating runtime dependencies {#qt-runtime-dependencies}
 
 Qt applications must be wrapped to find runtime dependencies.

doc/languages-frameworks/ruby.section.md

@@ -2,13 +2,13 @@
 
 ## Using Ruby {#using-ruby}
 
-Several versions of Ruby interpreters are available on Nix, as well as over 250 gems and many applications written in Ruby. The attribute `ruby` refers to the default Ruby interpreter, which is currently MRI 3.1. It's also possible to refer to specific versions, e.g. `ruby_3_y`, `jruby`, or `mruby`.
+Several versions of Ruby interpreters are available on Nix, as well as over 250 gems and many applications written in Ruby. The attribute `ruby` refers to the default Ruby interpreter, which is currently MRI 2.6. It's also possible to refer to specific versions, e.g. `ruby_2_y`, `jruby`, or `mruby`.
 
 In the Nixpkgs tree, Ruby packages can be found throughout, depending on what they do, and are called from the main package set. Ruby gems, however are separate sets, and there's one default set for each interpreter (currently MRI only).
 
 There are two main approaches for using Ruby with gems. One is to use a specifically locked `Gemfile` for an application that has very strict dependencies. The other is to depend on the common gems, which we'll explain further down, and rely on them being updated regularly.
 
-The interpreters have common attributes, namely `gems`, and `withPackages`. So you can refer to `ruby.gems.nokogiri`, or `ruby_3_2.gems.nokogiri` to get the Nokogiri gem already compiled and ready to use.
+The interpreters have common attributes, namely `gems`, and `withPackages`. So you can refer to `ruby.gems.nokogiri`, or `ruby_2_7.gems.nokogiri` to get the Nokogiri gem already compiled and ready to use.
 
 Since not all gems have executables like `nokogiri`, it's usually more convenient to use the `withPackages` function like this: `ruby.withPackages (p: with p; [ nokogiri ])`. This will also make sure that the Ruby in your environment will be able to find the gem and it can be used in your Ruby code (for example via `ruby` or `irb` executables) via `require "nokogiri"` as usual.
 
@@ -33,7 +33,7 @@ Again, it's possible to launch the interpreter from the shell. The Ruby interpre
 #### Load Ruby environment from `.nix` expression {#load-ruby-environment-from-.nix-expression}
 
 As explained [in the `nix-shell` section](https://nixos.org/manual/nix/stable/command-ref/nix-shell) of the Nix manual, `nix-shell` can also load an expression from a `.nix` file.
-Say we want to have Ruby, `nokogori`, and `pry`. Consider a `shell.nix` file with:
+Say we want to have Ruby 2.6, `nokogori`, and `pry`. Consider a `shell.nix` file with:
 
 ```nix
 with import <nixpkgs> {};
@@ -114,7 +114,7 @@ With this file in your directory, you can run `nix-shell` to build and use the g
 
 The `bundlerEnv` is a wrapper over all the gems in your gemset. This means that all the `/lib` and `/bin` directories will be available, and the executables of all gems (even of indirect dependencies) will end up in your `$PATH`. The `wrappedRuby` provides you with all executables that come with Ruby itself, but wrapped so they can easily find the gems in your gemset.
 
-One common issue that you might have is that you have Ruby, but also `bundler` in your gemset. That leads to a conflict for `/bin/bundle` and `/bin/bundler`. You can resolve this by wrapping either your Ruby or your gems in a `lowPrio` call. So in order to give the `bundler` from your gemset priority, it would be used like this:
+One common issue that you might have is that you have Ruby 2.6, but also `bundler` in your gemset. That leads to a conflict for `/bin/bundle` and `/bin/bundler`. You can resolve this by wrapping either your Ruby or your gems in a `lowPrio` call. So in order to give the `bundler` from your gemset priority, it would be used like this:
 
 ```nix
 # ...

doc/languages-frameworks/rust.section.md

@@ -44,22 +44,21 @@ rustPlatform.buildRustPackage rec {
 }
 ```
 
-`buildRustPackage` requires either the `cargoHash` or the `cargoSha256`
-attribute which is computed over all crate sources of this package.
-`cargoSha256` is used for traditional Nix SHA-256 hashes. `cargoHash` should
-instead be used for [SRI](https://www.w3.org/TR/SRI/) hashes and should be
-preferred. For example:
+`buildRustPackage` requires either the `cargoSha256` or the
+`cargoHash` attribute which is computed over all crate sources of this
+package. `cargoHash256` is used for traditional Nix SHA-256 hashes,
+such as the one in the example above. `cargoHash` should instead be
+used for [SRI](https://www.w3.org/TR/SRI/) hashes. For example:
+
+Exception: If the application has cargo `git` dependencies, the `cargoHash`/`cargoSha256`
+approach will not work, and you will need to copy the `Cargo.lock` file of the application
+to nixpkgs and continue with the next section for specifying the options of the`cargoLock`
+section.
 
 ```nix
   cargoHash = "sha256-l1vL2ZdtDRxSGvP0X/l3nMw8+6WF67KPutJEzUROjg8=";
 ```
 
-Exception: If the application has cargo `git` dependencies, the `cargoHash`/`cargoSha256`
-approach will not work, and you will need to copy the `Cargo.lock` file of the application
-to nixpkgs and continue with the next section for specifying the options of the `cargoLock`
-section.
-
-
 Both types of hashes are permitted when contributing to nixpkgs. The
 Cargo hash is obtained by inserting a fake checksum into the
 expression and building the package once. The correct checksum can
@@ -964,7 +963,7 @@ repository:
      lib.updateManyAttrsByPath [{
        path = [ "packages" "stable" ];
        update = old: old.overrideScope(final: prev: {
-         rustc-unwrapped = prev.rustc-unwrapped.overrideAttrs (_: {
+         rustc = prev.rustc.overrideAttrs (_: {
            src = lib.cleanSource /git/scratch/rust;
            # do *not* put passthru.isReleaseTarball=true here
          });
@@ -1004,3 +1003,4 @@ nix-build $NIXPKGS -A package-broken-by-rust-changes
 The `git submodule update --init` and `cargo vendor` commands above
 require network access, so they can't be performed from within the
 `rustc` derivation, unfortunately.
+

doc/languages-frameworks/texlive.section.md

@@ -208,23 +208,3 @@ EOF
   cp test.pdf $out
 ''
 ```
-
-## LuaLaTeX font cache {#sec-language-texlive-lualatex-font-cache}
-
-The font cache for LuaLaTeX is written to `$HOME`.
-Therefore, it is necessary to set `$HOME` to a writable path, e.g. [before using LuaLaTeX in nix derivations](https://github.com/NixOS/nixpkgs/issues/180639):
-```nix
-runCommandNoCC "lualatex-hello-world" {
-  buildInputs = [ texliveFull ];
-} ''
-  mkdir $out
-  echo '\documentclass{article} \begin{document} Hello world \end{document}' > main.tex
-  env HOME=$(mktemp -d) lualatex  -interaction=nonstopmode -output-format=pdf -output-directory=$out ./main.tex
-''
-```
-
-Additionally, [the cache of a user can diverge from the nix store](https://github.com/NixOS/nixpkgs/issues/278718).
-To resolve font issues that might follow, the cache can be removed by the user:
-```ShellSession
-luaotfload-tool --cache=erase --flush-lookups --force
-```

doc/manpage-urls.json

@@ -1,318 +1,34 @@
 {
-  "gnunet.conf(5)": "https://docs.gnunet.org/latest/users/configuration.html",
+  "gnunet.conf(5)": "https://docs.gnunet.org/users/configuration.html",
   "mpd(1)": "https://mpd.readthedocs.io/en/latest/mpd.1.html",
   "mpd.conf(5)": "https://mpd.readthedocs.io/en/latest/mpd.conf.5.html",
   "nix.conf(5)": "https://nixos.org/manual/nix/stable/command-ref/conf-file.html",
 
   "portals.conf(5)": "https://github.com/flatpak/xdg-desktop-portal/blob/1.18.1/doc/portals.conf.rst.in",
 
-  "bootctl(1)": "https://www.freedesktop.org/software/systemd/man/bootctl.html",
-  "busctl(1)": "https://www.freedesktop.org/software/systemd/man/busctl.html",
-  "coredumpctl(1)": "https://www.freedesktop.org/software/systemd/man/coredumpctl.html",
-  "homectl(1)": "https://www.freedesktop.org/software/systemd/man/homectl.html",
-  "hostnamectl(1)": "https://www.freedesktop.org/software/systemd/man/hostnamectl.html",
-  "init(1)": "https://www.freedesktop.org/software/systemd/man/init.html",
-  "journalctl(1)": "https://www.freedesktop.org/software/systemd/man/journalctl.html",
-  "localectl(1)": "https://www.freedesktop.org/software/systemd/man/localectl.html",
-  "loginctl(1)": "https://www.freedesktop.org/software/systemd/man/loginctl.html",
-  "machinectl(1)": "https://www.freedesktop.org/software/systemd/man/machinectl.html",
-  "mount.ddi(1)": "https://www.freedesktop.org/software/systemd/man/mount.ddi.html",
-  "networkctl(1)": "https://www.freedesktop.org/software/systemd/man/networkctl.html",
-  "oomctl(1)": "https://www.freedesktop.org/software/systemd/man/oomctl.html",
-  "portablectl(1)": "https://www.freedesktop.org/software/systemd/man/portablectl.html",
-  "resolvconf(1)": "https://www.freedesktop.org/software/systemd/man/resolvconf.html",
-  "resolvectl(1)": "https://www.freedesktop.org/software/systemd/man/resolvectl.html",
-  "systemctl(1)": "https://www.freedesktop.org/software/systemd/man/systemctl.html",
-  "systemd-ac-power(1)": "https://www.freedesktop.org/software/systemd/man/systemd-ac-power.html",
-  "systemd-analyze(1)": "https://www.freedesktop.org/software/systemd/man/systemd-analyze.html",
-  "systemd-ask-password(1)": "https://www.freedesktop.org/software/systemd/man/systemd-ask-password.html",
-  "systemd-cat(1)": "https://www.freedesktop.org/software/systemd/man/systemd-cat.html",
-  "systemd-cgls(1)": "https://www.freedesktop.org/software/systemd/man/systemd-cgls.html",
-  "systemd-cgtop(1)": "https://www.freedesktop.org/software/systemd/man/systemd-cgtop.html",
-  "systemd-creds(1)": "https://www.freedesktop.org/software/systemd/man/systemd-creds.html",
-  "systemd-cryptenroll(1)": "https://www.freedesktop.org/software/systemd/man/systemd-cryptenroll.html",
-  "systemd-delta(1)": "https://www.freedesktop.org/software/systemd/man/systemd-delta.html",
-  "systemd-detect-virt(1)": "https://www.freedesktop.org/software/systemd/man/systemd-detect-virt.html",
-  "systemd-dissect(1)": "https://www.freedesktop.org/software/systemd/man/systemd-dissect.html",
-  "systemd-escape(1)": "https://www.freedesktop.org/software/systemd/man/systemd-escape.html",
-  "systemd-id128(1)": "https://www.freedesktop.org/software/systemd/man/systemd-id128.html",
-  "systemd-inhibit(1)": "https://www.freedesktop.org/software/systemd/man/systemd-inhibit.html",
-  "systemd-machine-id-setup(1)": "https://www.freedesktop.org/software/systemd/man/systemd-machine-id-setup.html",
-  "systemd-measure(1)": "https://www.freedesktop.org/software/systemd/man/systemd-measure.html",
-  "systemd-mount(1)": "https://www.freedesktop.org/software/systemd/man/systemd-mount.html",
-  "systemd-notify(1)": "https://www.freedesktop.org/software/systemd/man/systemd-notify.html",
-  "systemd-nspawn(1)": "https://www.freedesktop.org/software/systemd/man/systemd-nspawn.html",
-  "systemd-path(1)": "https://www.freedesktop.org/software/systemd/man/systemd-path.html",
-  "systemd-run(1)": "https://www.freedesktop.org/software/systemd/man/systemd-run.html",
-  "systemd-socket-activate(1)": "https://www.freedesktop.org/software/systemd/man/systemd-socket-activate.html",
-  "systemd-stdio-bridge(1)": "https://www.freedesktop.org/software/systemd/man/systemd-stdio-bridge.html",
-  "systemd-tty-ask-password-agent(1)": "https://www.freedesktop.org/software/systemd/man/systemd-tty-ask-password-agent.html",
-  "systemd-umount(1)": "https://www.freedesktop.org/software/systemd/man/systemd-umount.html",
-  "systemd(1)": "https://www.freedesktop.org/software/systemd/man/systemd.html",
-  "timedatectl(1)": "https://www.freedesktop.org/software/systemd/man/timedatectl.html",
-  "userdbctl(1)": "https://www.freedesktop.org/software/systemd/man/userdbctl.html",
-  "binfmt.d(5)": "https://www.freedesktop.org/software/systemd/man/binfmt.d.html",
-  "coredump.conf(5)": "https://www.freedesktop.org/software/systemd/man/coredump.conf.html",
-  "coredump.conf.d(5)": "https://www.freedesktop.org/software/systemd/man/coredump.conf.d.html",
-  "crypttab(5)": "https://www.freedesktop.org/software/systemd/man/crypttab.html",
-  "dnssec-trust-anchors.d(5)": "https://www.freedesktop.org/software/systemd/man/dnssec-trust-anchors.d.html",
-  "environment.d(5)": "https://www.freedesktop.org/software/systemd/man/environment.d.html",
-  "extension-release(5)": "https://www.freedesktop.org/software/systemd/man/extension-release.html",
-  "homed.conf(5)": "https://www.freedesktop.org/software/systemd/man/homed.conf.html",
-  "homed.conf.d(5)": "https://www.freedesktop.org/software/systemd/man/homed.conf.d.html",
-  "hostname(5)": "https://www.freedesktop.org/software/systemd/man/hostname.html",
-  "initrd-release(5)": "https://www.freedesktop.org/software/systemd/man/initrd-release.html",
-  "integritytab(5)": "https://www.freedesktop.org/software/systemd/man/integritytab.html",
-  "iocost.conf(5)": "https://www.freedesktop.org/software/systemd/man/iocost.conf.html",
-  "journal-remote.conf(5)": "https://www.freedesktop.org/software/systemd/man/journal-remote.conf.html",
-  "journal-remote.conf.d(5)": "https://www.freedesktop.org/software/systemd/man/journal-remote.conf.d.html",
-  "journal-upload.conf(5)": "https://www.freedesktop.org/software/systemd/man/journal-upload.conf.html",
-  "journal-upload.conf.d(5)": "https://www.freedesktop.org/software/systemd/man/journal-upload.conf.d.html",
   "journald.conf(5)": "https://www.freedesktop.org/software/systemd/man/journald.conf.html",
-  "journald.conf.d(5)": "https://www.freedesktop.org/software/systemd/man/journald.conf.d.html",
-  "journald@.conf(5)": "https://www.freedesktop.org/software/systemd/man/journald@.conf.html",
-  "loader.conf(5)": "https://www.freedesktop.org/software/systemd/man/loader.conf.html",
-  "locale.conf(5)": "https://www.freedesktop.org/software/systemd/man/locale.conf.html",
-  "localtime(5)": "https://www.freedesktop.org/software/systemd/man/localtime.html",
   "logind.conf(5)": "https://www.freedesktop.org/software/systemd/man/logind.conf.html",
-  "logind.conf.d(5)": "https://www.freedesktop.org/software/systemd/man/logind.conf.d.html",
-  "machine-id(5)": "https://www.freedesktop.org/software/systemd/man/machine-id.html",
-  "machine-info(5)": "https://www.freedesktop.org/software/systemd/man/machine-info.html",
-  "modules-load.d(5)": "https://www.freedesktop.org/software/systemd/man/modules-load.d.html",
   "networkd.conf(5)": "https://www.freedesktop.org/software/systemd/man/networkd.conf.html",
-  "networkd.conf.d(5)": "https://www.freedesktop.org/software/systemd/man/networkd.conf.d.html",
-  "oomd.conf(5)": "https://www.freedesktop.org/software/systemd/man/oomd.conf.html",
-  "oomd.conf.d(5)": "https://www.freedesktop.org/software/systemd/man/oomd.conf.d.html",
-  "org.freedesktop.LogControl1(5)": "https://www.freedesktop.org/software/systemd/man/org.freedesktop.LogControl1.html",
-  "org.freedesktop.home1(5)": "https://www.freedesktop.org/software/systemd/man/org.freedesktop.home1.html",
-  "org.freedesktop.hostname1(5)": "https://www.freedesktop.org/software/systemd/man/org.freedesktop.hostname1.html",
-  "org.freedesktop.import1(5)": "https://www.freedesktop.org/software/systemd/man/org.freedesktop.import1.html",
-  "org.freedesktop.locale1(5)": "https://www.freedesktop.org/software/systemd/man/org.freedesktop.locale1.html",
-  "org.freedesktop.login1(5)": "https://www.freedesktop.org/software/systemd/man/org.freedesktop.login1.html",
-  "org.freedesktop.machine1(5)": "https://www.freedesktop.org/software/systemd/man/org.freedesktop.machine1.html",
-  "org.freedesktop.network1(5)": "https://www.freedesktop.org/software/systemd/man/org.freedesktop.network1.html",
-  "org.freedesktop.oom1(5)": "https://www.freedesktop.org/software/systemd/man/org.freedesktop.oom1.html",
-  "org.freedesktop.portable1(5)": "https://www.freedesktop.org/software/systemd/man/org.freedesktop.portable1.html",
-  "org.freedesktop.resolve1(5)": "https://www.freedesktop.org/software/systemd/man/org.freedesktop.resolve1.html",
-  "org.freedesktop.systemd1(5)": "https://www.freedesktop.org/software/systemd/man/org.freedesktop.systemd1.html",
-  "org.freedesktop.timedate1(5)": "https://www.freedesktop.org/software/systemd/man/org.freedesktop.timedate1.html",
-  "os-release(5)": "https://www.freedesktop.org/software/systemd/man/os-release.html",
-  "pstore.conf(5)": "https://www.freedesktop.org/software/systemd/man/pstore.conf.html",
-  "pstore.conf.d(5)": "https://www.freedesktop.org/software/systemd/man/pstore.conf.d.html",
-  "repart.d(5)": "https://www.freedesktop.org/software/systemd/man/repart.d.html",
-  "resolved.conf(5)": "https://www.freedesktop.org/software/systemd/man/resolved.conf.html",
-  "resolved.conf.d(5)": "https://www.freedesktop.org/software/systemd/man/resolved.conf.d.html",
-  "sleep.conf.d(5)": "https://www.freedesktop.org/software/systemd/man/sleep.conf.d.html",
-  "sysctl.d(5)": "https://www.freedesktop.org/software/systemd/man/sysctl.d.html",
-  "system.conf.d(5)": "https://www.freedesktop.org/software/systemd/man/system.conf.d.html",
-  "systemd-sleep.conf(5)": "https://www.freedesktop.org/software/systemd/man/systemd-sleep.conf.html",
-  "systemd-system.conf(5)": "https://www.freedesktop.org/software/systemd/man/systemd-system.conf.html",
-  "systemd-user-runtime-dir(5)": "https://www.freedesktop.org/software/systemd/man/systemd-user-runtime-dir.html",
-  "systemd-user.conf(5)": "https://www.freedesktop.org/software/systemd/man/systemd-user.conf.html",
   "systemd.automount(5)": "https://www.freedesktop.org/software/systemd/man/systemd.automount.html",
-  "systemd.device(5)": "https://www.freedesktop.org/software/systemd/man/systemd.device.html",
-  "systemd.dnssd(5)": "https://www.freedesktop.org/software/systemd/man/systemd.dnssd.html",
   "systemd.exec(5)": "https://www.freedesktop.org/software/systemd/man/systemd.exec.html",
-  "systemd.kill(5)": "https://www.freedesktop.org/software/systemd/man/systemd.kill.html",
   "systemd.link(5)": "https://www.freedesktop.org/software/systemd/man/systemd.link.html",
   "systemd.mount(5)": "https://www.freedesktop.org/software/systemd/man/systemd.mount.html",
-  "systemd.negative(5)": "https://www.freedesktop.org/software/systemd/man/systemd.negative.html",
   "systemd.netdev(5)": "https://www.freedesktop.org/software/systemd/man/systemd.netdev.html",
   "systemd.network(5)": "https://www.freedesktop.org/software/systemd/man/systemd.network.html",
   "systemd.nspawn(5)": "https://www.freedesktop.org/software/systemd/man/systemd.nspawn.html",
   "systemd.path(5)": "https://www.freedesktop.org/software/systemd/man/systemd.path.html",
-  "systemd.positive(5)": "https://www.freedesktop.org/software/systemd/man/systemd.positive.html",
-  "systemd.preset(5)": "https://www.freedesktop.org/software/systemd/man/systemd.preset.html",
   "systemd.resource-control(5)": "https://www.freedesktop.org/software/systemd/man/systemd.resource-control.html",
   "systemd.scope(5)": "https://www.freedesktop.org/software/systemd/man/systemd.scope.html",
   "systemd.service(5)": "https://www.freedesktop.org/software/systemd/man/systemd.service.html",
   "systemd.slice(5)": "https://www.freedesktop.org/software/systemd/man/systemd.slice.html",
   "systemd.socket(5)": "https://www.freedesktop.org/software/systemd/man/systemd.socket.html",
-  "systemd.swap(5)": "https://www.freedesktop.org/software/systemd/man/systemd.swap.html",
-  "systemd.target(5)": "https://www.freedesktop.org/software/systemd/man/systemd.target.html",
   "systemd.timer(5)": "https://www.freedesktop.org/software/systemd/man/systemd.timer.html",
   "systemd.unit(5)": "https://www.freedesktop.org/software/systemd/man/systemd.unit.html",
-  "sysupdate.d(5)": "https://www.freedesktop.org/software/systemd/man/sysupdate.d.html",
-  "sysusers.d(5)": "https://www.freedesktop.org/software/systemd/man/sysusers.d.html",
+  "systemd-system.conf(5)": "https://www.freedesktop.org/software/systemd/man/systemd-system.conf.html",
+  "systemd-user.conf(5)": "https://www.freedesktop.org/software/systemd/man/systemd-user.conf.html",
   "timesyncd.conf(5)": "https://www.freedesktop.org/software/systemd/man/timesyncd.conf.html",
-  "timesyncd.conf.d(5)": "https://www.freedesktop.org/software/systemd/man/timesyncd.conf.d.html",
   "tmpfiles.d(5)": "https://www.freedesktop.org/software/systemd/man/tmpfiles.d.html",
-  "udev.conf(5)": "https://www.freedesktop.org/software/systemd/man/udev.conf.html",
-  "user-runtime-dir@.service(5)": "https://www.freedesktop.org/software/systemd/man/user-runtime-dir@.service.html",
-  "user.conf.d(5)": "https://www.freedesktop.org/software/systemd/man/user.conf.d.html",
-  "user@.service(5)": "https://www.freedesktop.org/software/systemd/man/user@.service.html",
-  "vconsole.conf(5)": "https://www.freedesktop.org/software/systemd/man/vconsole.conf.html",
-  "veritytab(5)": "https://www.freedesktop.org/software/systemd/man/veritytab.html",
-  "bootup(7)": "https://www.freedesktop.org/software/systemd/man/bootup.html",
-  "daemon(7)": "https://www.freedesktop.org/software/systemd/man/daemon.html",
-  "file-hierarchy(7)": "https://www.freedesktop.org/software/systemd/man/file-hierarchy.html",
-  "hwdb(7)": "https://www.freedesktop.org/software/systemd/man/hwdb.html",
-  "kernel-command-line(7)": "https://www.freedesktop.org/software/systemd/man/kernel-command-line.html",
-  "linuxaa64.efi.stub(7)": "https://www.freedesktop.org/software/systemd/man/linuxaa64.efi.stub.html",
-  "linuxia32.efi.stub(7)": "https://www.freedesktop.org/software/systemd/man/linuxia32.efi.stub.html",
-  "linuxx64.efi.stub(7)": "https://www.freedesktop.org/software/systemd/man/linuxx64.efi.stub.html",
-  "sd-boot(7)": "https://www.freedesktop.org/software/systemd/man/sd-boot.html",
-  "sd-stub(7)": "https://www.freedesktop.org/software/systemd/man/sd-stub.html",
-  "smbios-type-11(7)": "https://www.freedesktop.org/software/systemd/man/smbios-type-11.html",
-  "systemd-boot(7)": "https://www.freedesktop.org/software/systemd/man/systemd-boot.html",
-  "systemd-stub(7)": "https://www.freedesktop.org/software/systemd/man/systemd-stub.html",
-  "systemd.directives(7)": "https://www.freedesktop.org/software/systemd/man/systemd.directives.html",
-  "systemd.environment-generator(7)": "https://www.freedesktop.org/software/systemd/man/systemd.environment-generator.html",
-  "systemd.generator(7)": "https://www.freedesktop.org/software/systemd/man/systemd.generator.html",
-  "systemd.image-policy(7)": "https://www.freedesktop.org/software/systemd/man/systemd.image-policy.html",
-  "systemd.index(7)": "https://www.freedesktop.org/software/systemd/man/systemd.index.html",
-  "systemd.journal-fields(7)": "https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html",
-  "systemd.net-naming-scheme(7)": "https://www.freedesktop.org/software/systemd/man/systemd.net-naming-scheme.html",
-  "systemd.offline-updates(7)": "https://www.freedesktop.org/software/systemd/man/systemd.offline-updates.html",
-  "systemd.special(7)": "https://www.freedesktop.org/software/systemd/man/systemd.special.html",
-  "systemd.syntax(7)": "https://www.freedesktop.org/software/systemd/man/systemd.syntax.html",
-  "systemd.system-credentials(7)": "https://www.freedesktop.org/software/systemd/man/systemd.system-credentials.html",
   "systemd.time(7)": "https://www.freedesktop.org/software/systemd/man/systemd.time.html",
-  "udev(7)": "https://www.freedesktop.org/software/systemd/man/udev.html",
-  "30-systemd-environment-d-generator(8)": "https://www.freedesktop.org/software/systemd/man/30-systemd-environment-d-generator.html",
-  "halt(8)": "https://www.freedesktop.org/software/systemd/man/halt.html",
-  "kernel-install(8)": "https://www.freedesktop.org/software/systemd/man/kernel-install.html",
-  "libnss_myhostname.so.2(8)": "https://www.freedesktop.org/software/systemd/man/libnss_myhostname.so.2.html",
-  "libnss_mymachines.so.2(8)": "https://www.freedesktop.org/software/systemd/man/libnss_mymachines.so.2.html",
-  "libnss_resolve.so.2(8)": "https://www.freedesktop.org/software/systemd/man/libnss_resolve.so.2.html",
-  "libnss_systemd.so.2(8)": "https://www.freedesktop.org/software/systemd/man/libnss_systemd.so.2.html",
-  "nss-myhostname(8)": "https://www.freedesktop.org/software/systemd/man/nss-myhostname.html",
-  "nss-mymachines(8)": "https://www.freedesktop.org/software/systemd/man/nss-mymachines.html",
-  "nss-resolve(8)": "https://www.freedesktop.org/software/systemd/man/nss-resolve.html",
-  "nss-systemd(8)": "https://www.freedesktop.org/software/systemd/man/nss-systemd.html",
-  "pam_systemd(8)": "https://www.freedesktop.org/software/systemd/man/pam_systemd.html",
-  "pam_systemd_home(8)": "https://www.freedesktop.org/software/systemd/man/pam_systemd_home.html",
-  "poweroff(8)": "https://www.freedesktop.org/software/systemd/man/poweroff.html",
-  "reboot(8)": "https://www.freedesktop.org/software/systemd/man/reboot.html",
-  "shutdown(8)": "https://www.freedesktop.org/software/systemd/man/shutdown.html",
-  "systemd-ask-password-console.path(8)": "https://www.freedesktop.org/software/systemd/man/systemd-ask-password-console.path.html",
-  "systemd-ask-password-console.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-ask-password-console.service.html",
-  "systemd-ask-password-wall.path(8)": "https://www.freedesktop.org/software/systemd/man/systemd-ask-password-wall.path.html",
-  "systemd-ask-password-wall.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-ask-password-wall.service.html",
-  "systemd-backlight(8)": "https://www.freedesktop.org/software/systemd/man/systemd-backlight.html",
-  "systemd-backlight@.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-backlight@.service.html",
-  "systemd-battery-check(8)": "https://www.freedesktop.org/software/systemd/man/systemd-battery-check.html",
-  "systemd-binfmt(8)": "https://www.freedesktop.org/software/systemd/man/systemd-binfmt.html",
-  "systemd-bless-boot-generator(8)": "https://www.freedesktop.org/software/systemd/man/systemd-bless-boot-generator.html",
-  "systemd-bless-boot(8)": "https://www.freedesktop.org/software/systemd/man/systemd-bless-boot.html",
-  "systemd-boot-check-no-failures(8)": "https://www.freedesktop.org/software/systemd/man/systemd-boot-check-no-failures.html",
-  "systemd-boot-random-seed.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-boot-random-seed.service.html",
-  "systemd-confext(8)": "https://www.freedesktop.org/software/systemd/man/systemd-confext.html",
-  "systemd-confext.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-confext.service.html",
-  "systemd-coredump(8)": "https://www.freedesktop.org/software/systemd/man/systemd-coredump.html",
-  "systemd-coredump.socket(8)": "https://www.freedesktop.org/software/systemd/man/systemd-coredump.socket.html",
-  "systemd-coredump@.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-coredump@.service.html",
-  "systemd-cryptsetup-generator(8)": "https://www.freedesktop.org/software/systemd/man/systemd-cryptsetup-generator.html",
-  "systemd-cryptsetup(8)": "https://www.freedesktop.org/software/systemd/man/systemd-cryptsetup.html",
-  "systemd-cryptsetup@.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-cryptsetup@.service.html",
-  "systemd-debug-generator(8)": "https://www.freedesktop.org/software/systemd/man/systemd-debug-generator.html",
-  "systemd-environment-d-generator(8)": "https://www.freedesktop.org/software/systemd/man/systemd-environment-d-generator.html",
-  "systemd-fsck-root.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-fsck-root.service.html",
-  "systemd-fsck-usr.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-fsck-usr.service.html",
-  "systemd-fsck(8)": "https://www.freedesktop.org/software/systemd/man/systemd-fsck.html",
-  "systemd-fsck@.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-fsck@.service.html",
   "systemd-fstab-generator(8)": "https://www.freedesktop.org/software/systemd/man/systemd-fstab-generator.html",
-  "systemd-getty-generator(8)": "https://www.freedesktop.org/software/systemd/man/systemd-getty-generator.html",
-  "systemd-gpt-auto-generator(8)": "https://www.freedesktop.org/software/systemd/man/systemd-gpt-auto-generator.html",
-  "systemd-growfs-root.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-growfs-root.service.html",
-  "systemd-growfs(8)": "https://www.freedesktop.org/software/systemd/man/systemd-growfs.html",
-  "systemd-growfs@.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-growfs@.service.html",
-  "systemd-halt.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-halt.service.html",
-  "systemd-hibernate-resume-generator(8)": "https://www.freedesktop.org/software/systemd/man/systemd-hibernate-resume-generator.html",
-  "systemd-hibernate-resume(8)": "https://www.freedesktop.org/software/systemd/man/systemd-hibernate-resume.html",
-  "systemd-hibernate.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-hibernate.service.html",
-  "systemd-homed(8)": "https://www.freedesktop.org/software/systemd/man/systemd-homed.html",
-  "systemd-hostnamed(8)": "https://www.freedesktop.org/software/systemd/man/systemd-hostnamed.html",
-  "systemd-hwdb(8)": "https://www.freedesktop.org/software/systemd/man/systemd-hwdb.html",
-  "systemd-hybrid-sleep.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-hybrid-sleep.service.html",
-  "systemd-importd(8)": "https://www.freedesktop.org/software/systemd/man/systemd-importd.html",
-  "systemd-integritysetup-generator(8)": "https://www.freedesktop.org/software/systemd/man/systemd-integritysetup-generator.html",
-  "systemd-integritysetup(8)": "https://www.freedesktop.org/software/systemd/man/systemd-integritysetup.html",
-  "systemd-integritysetup@.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-integritysetup@.service.html",
-  "systemd-journal-gatewayd(8)": "https://www.freedesktop.org/software/systemd/man/systemd-journal-gatewayd.html",
-  "systemd-journal-gatewayd.socket(8)": "https://www.freedesktop.org/software/systemd/man/systemd-journal-gatewayd.socket.html",
-  "systemd-journal-remote(8)": "https://www.freedesktop.org/software/systemd/man/systemd-journal-remote.html",
-  "systemd-journal-remote.socket(8)": "https://www.freedesktop.org/software/systemd/man/systemd-journal-remote.socket.html",
-  "systemd-journal-upload(8)": "https://www.freedesktop.org/software/systemd/man/systemd-journal-upload.html",
-  "systemd-journald-audit.socket(8)": "https://www.freedesktop.org/software/systemd/man/systemd-journald-audit.socket.html",
-  "systemd-journald-dev-log.socket(8)": "https://www.freedesktop.org/software/systemd/man/systemd-journald-dev-log.socket.html",
-  "systemd-journald-varlink@.socket(8)": "https://www.freedesktop.org/software/systemd/man/systemd-journald-varlink@.socket.html",
-  "systemd-journald(8)": "https://www.freedesktop.org/software/systemd/man/systemd-journald.html",
-  "systemd-journald.socket(8)": "https://www.freedesktop.org/software/systemd/man/systemd-journald.socket.html",
-  "systemd-journald@.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-journald@.service.html",
-  "systemd-journald@.socket(8)": "https://www.freedesktop.org/software/systemd/man/systemd-journald@.socket.html",
-  "systemd-kexec.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-kexec.service.html",
-  "systemd-localed(8)": "https://www.freedesktop.org/software/systemd/man/systemd-localed.html",
-  "systemd-logind(8)": "https://www.freedesktop.org/software/systemd/man/systemd-logind.html",
-  "systemd-machine-id-commit.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-machine-id-commit.service.html",
-  "systemd-machined(8)": "https://www.freedesktop.org/software/systemd/man/systemd-machined.html",
-  "systemd-makefs(8)": "https://www.freedesktop.org/software/systemd/man/systemd-makefs.html",
-  "systemd-makefs@.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-makefs@.service.html",
-  "systemd-mkswap@.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-mkswap@.service.html",
-  "systemd-modules-load(8)": "https://www.freedesktop.org/software/systemd/man/systemd-modules-load.html",
-  "systemd-network-generator(8)": "https://www.freedesktop.org/software/systemd/man/systemd-network-generator.html",
-  "systemd-networkd-wait-online(8)": "https://www.freedesktop.org/software/systemd/man/systemd-networkd-wait-online.html",
-  "systemd-networkd-wait-online@.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-networkd-wait-online@.service.html",
-  "systemd-networkd(8)": "https://www.freedesktop.org/software/systemd/man/systemd-networkd.html",
-  "systemd-oomd(8)": "https://www.freedesktop.org/software/systemd/man/systemd-oomd.html",
-  "systemd-pcrfs-root.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-pcrfs-root.service.html",
-  "systemd-pcrfs@.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-pcrfs@.service.html",
-  "systemd-pcrmachine.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-pcrmachine.service.html",
-  "systemd-pcrphase-initrd.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-pcrphase-initrd.service.html",
-  "systemd-pcrphase-sysinit.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-pcrphase-sysinit.service.html",
-  "systemd-pcrphase(8)": "https://www.freedesktop.org/software/systemd/man/systemd-pcrphase.html",
-  "systemd-portabled(8)": "https://www.freedesktop.org/software/systemd/man/systemd-portabled.html",
-  "systemd-poweroff.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-poweroff.service.html",
-  "systemd-pstore(8)": "https://www.freedesktop.org/software/systemd/man/systemd-pstore.html",
-  "systemd-random-seed(8)": "https://www.freedesktop.org/software/systemd/man/systemd-random-seed.html",
-  "systemd-reboot.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-reboot.service.html",
-  "systemd-remount-fs(8)": "https://www.freedesktop.org/software/systemd/man/systemd-remount-fs.html",
-  "systemd-repart(8)": "https://www.freedesktop.org/software/systemd/man/systemd-repart.html",
-  "systemd-repart.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-repart.service.html",
-  "systemd-resolved(8)": "https://www.freedesktop.org/software/systemd/man/systemd-resolved.html",
-  "systemd-rfkill(8)": "https://www.freedesktop.org/software/systemd/man/systemd-rfkill.html",
-  "systemd-rfkill.socket(8)": "https://www.freedesktop.org/software/systemd/man/systemd-rfkill.socket.html",
-  "systemd-run-generator(8)": "https://www.freedesktop.org/software/systemd/man/systemd-run-generator.html",
-  "systemd-shutdown(8)": "https://www.freedesktop.org/software/systemd/man/systemd-shutdown.html",
-  "systemd-sleep(8)": "https://www.freedesktop.org/software/systemd/man/systemd-sleep.html",
-  "systemd-socket-proxyd(8)": "https://www.freedesktop.org/software/systemd/man/systemd-socket-proxyd.html",
-  "systemd-soft-reboot.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-soft-reboot.service.html",
-  "systemd-suspend-then-hibernate.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-suspend-then-hibernate.service.html",
-  "systemd-suspend.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-suspend.service.html",
-  "systemd-sysctl(8)": "https://www.freedesktop.org/software/systemd/man/systemd-sysctl.html",
-  "systemd-sysext(8)": "https://www.freedesktop.org/software/systemd/man/systemd-sysext.html",
-  "systemd-sysext.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-sysext.service.html",
-  "systemd-system-update-generator(8)": "https://www.freedesktop.org/software/systemd/man/systemd-system-update-generator.html",
-  "systemd-sysupdate-reboot.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-sysupdate-reboot.service.html",
-  "systemd-sysupdate-reboot.timer(8)": "https://www.freedesktop.org/software/systemd/man/systemd-sysupdate-reboot.timer.html",
-  "systemd-sysupdate(8)": "https://www.freedesktop.org/software/systemd/man/systemd-sysupdate.html",
-  "systemd-sysupdate.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-sysupdate.service.html",
-  "systemd-sysupdate.timer(8)": "https://www.freedesktop.org/software/systemd/man/systemd-sysupdate.timer.html",
-  "systemd-sysusers(8)": "https://www.freedesktop.org/software/systemd/man/systemd-sysusers.html",
-  "systemd-sysusers.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-sysusers.service.html",
-  "systemd-time-wait-sync(8)": "https://www.freedesktop.org/software/systemd/man/systemd-time-wait-sync.html",
-  "systemd-timedated(8)": "https://www.freedesktop.org/software/systemd/man/systemd-timedated.html",
-  "systemd-timesyncd(8)": "https://www.freedesktop.org/software/systemd/man/systemd-timesyncd.html",
-  "systemd-tmpfiles-clean.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-tmpfiles-clean.service.html",
-  "systemd-tmpfiles-clean.timer(8)": "https://www.freedesktop.org/software/systemd/man/systemd-tmpfiles-clean.timer.html",
-  "systemd-tmpfiles-setup-dev-early.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-tmpfiles-setup-dev-early.service.html",
-  "systemd-tmpfiles-setup-dev.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-tmpfiles-setup-dev.service.html",
-  "systemd-tmpfiles-setup.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-tmpfiles-setup.service.html",
-  "systemd-tmpfiles(8)": "https://www.freedesktop.org/software/systemd/man/systemd-tmpfiles.html",
-  "systemd-udev-settle.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-udev-settle.service.html",
-  "systemd-udevd-control.socket(8)": "https://www.freedesktop.org/software/systemd/man/systemd-udevd-control.socket.html",
-  "systemd-udevd-kernel.socket(8)": "https://www.freedesktop.org/software/systemd/man/systemd-udevd-kernel.socket.html",
-  "systemd-udevd(8)": "https://www.freedesktop.org/software/systemd/man/systemd-udevd.html",
-  "systemd-update-done(8)": "https://www.freedesktop.org/software/systemd/man/systemd-update-done.html",
-  "systemd-update-utmp-runlevel.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-update-utmp-runlevel.service.html",
-  "systemd-update-utmp(8)": "https://www.freedesktop.org/software/systemd/man/systemd-update-utmp.html",
-  "systemd-user-sessions(8)": "https://www.freedesktop.org/software/systemd/man/systemd-user-sessions.html",
-  "systemd-userdbd(8)": "https://www.freedesktop.org/software/systemd/man/systemd-userdbd.html",
-  "systemd-vconsole-setup(8)": "https://www.freedesktop.org/software/systemd/man/systemd-vconsole-setup.html",
-  "systemd-veritysetup-generator(8)": "https://www.freedesktop.org/software/systemd/man/systemd-veritysetup-generator.html",
-  "systemd-veritysetup(8)": "https://www.freedesktop.org/software/systemd/man/systemd-veritysetup.html",
-  "systemd-veritysetup@.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-veritysetup@.service.html",
-  "systemd-volatile-root(8)": "https://www.freedesktop.org/software/systemd/man/systemd-volatile-root.html",
-  "systemd-xdg-autostart-generator(8)": "https://www.freedesktop.org/software/systemd/man/systemd-xdg-autostart-generator.html",
-  "udevadm(8)": "https://www.freedesktop.org/software/systemd/man/udevadm.html"
+  "systemd-networkd-wait-online.service(8)": "https://www.freedesktop.org/software/systemd/man/systemd-networkd-wait-online.service.html"
 }

doc/manual.md.in

@@ -1,4 +1,4 @@
-# Nixpkgs Reference Manual {#nixpkgs-manual}
+# Nixpkgs Manual {#nixpkgs-manual}
 ## Version @MANUAL_VERSION@
 
 ```{=include=} chapters

doc/packages/linux.section.md

@@ -2,112 +2,40 @@
 
 The Nix expressions to build the Linux kernel are in [`pkgs/os-specific/linux/kernel`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/os-specific/linux/kernel).
 
-The function [`pkgs.buildLinux`](https://github.com/NixOS/nixpkgs/blob/d77bda728d5041c1294a68fb25c79e2d161f62b9/pkgs/os-specific/linux/kernel/generic.nix) builds a kernel with [common configuration values](https://github.com/NixOS/nixpkgs/blob/d77bda728d5041c1294a68fb25c79e2d161f62b9/pkgs/os-specific/linux/kernel/common-config.nix).
-This is the preferred option unless you have a very specific use case.
-Most kernels packaged in Nixpkgs are built that way, and it will also generate kernels suitable for NixOS.
-[`pkgs.linuxManualConfig`](https://github.com/NixOS/nixpkgs/blob/d77bda728d5041c1294a68fb25c79e2d161f62b9/pkgs/os-specific/linux/kernel/manual-config.nix) requires a complete configuration to be passed.
-It has fewer additional features than `pkgs.buildLinux`, which provides common configuration values and exposes the `features` attribute, as explained below.
+The function that builds the kernel has an argument `kernelPatches` which should be a list of `{name, patch, extraConfig}` attribute sets, where `name` is the name of the patch (which is included in the kernel’s `meta.description` attribute), `patch` is the patch itself (possibly compressed), and `extraConfig` (optional) is a string specifying extra options to be concatenated to the kernel configuration file (`.config`).
 
-Both functions have an argument `kernelPatches` which should be a list of `{name, patch, extraConfig}` attribute sets, where `name` is the name of the patch (which is included in the kernel’s `meta.description` attribute), `patch` is the patch itself (possibly compressed), and `extraConfig` (optional) is a string specifying extra options to be concatenated to the kernel configuration file (`.config`).
-
-The kernel derivation created with `pkgs.buildLinux` exports an attribute `features` specifying whether optional functionality is or isn’t enabled. This is used in NixOS to implement kernel-specific behaviour.
-
-If you are using a kernel packaged in Nixpkgs, you can customize it by overriding its arguments. For details on how each argument affects the generated kernel, refer to [the `pkgs.buildLinux` source code](https://github.com/NixOS/nixpkgs/blob/d77bda728d5041c1294a68fb25c79e2d161f62b9/pkgs/os-specific/linux/kernel/generic.nix).
-
-:::{.example #ex-overriding-kernel-derivation}
-
-# Overriding the kernel derivation
-
-Assuming you are using the kernel from `pkgs.linux_latest`:
+The kernel derivation exports an attribute `features` specifying whether optional functionality is or isn’t enabled. This is used in NixOS to implement kernel-specific behaviour. For instance, if the kernel has the `iwlwifi` feature (i.e., has built-in support for Intel wireless chipsets), then NixOS doesn’t have to build the external `iwlwifi` package:
 
 ```nix
-pkgs.linux_latest.override {
-  ignoreConfigErrors = true;
-  autoModules = false;
-  kernelPreferBuiltin = true;
-  extraStructuredConfig = with lib.kernel; {
-    DEBUG_KERNEL = yes;
-    FRAME_POINTER = yes;
-    KGDB = yes;
-    KGDB_SERIAL_CONSOLE = yes;
-    DEBUG_INFO = yes;
-  };
-}
+modulesTree = [kernel]
+  ++ pkgs.lib.optional (!kernel.features ? iwlwifi) kernelPackages.iwlwifi
+  ++ ...;
 ```
 
-:::
+How to add a new (major) version of the Linux kernel to Nixpkgs:
 
-## Manual kernel configuration {#sec-manual-kernel-configuration}
+1.  Copy the old Nix expression (e.g., `linux-2.6.21.nix`) to the new one (e.g., `linux-2.6.22.nix`) and update it.
 
-Sometimes it may not be desirable to use kernels built with `pkgs.buildLinux`, especially if most of the common configuration has to be altered or disabled to achieve a kernel as expected by the target use case.
-An example of this is building a kernel for use in a VM or micro VM. You can use `pkgs.linuxManualConfig` in these cases. It requires the `src`, `version`, and `configfile` attributes to be specified.
+2.  Add the new kernel to the `kernels` attribute set in `linux-kernels.nix` (e.g., create an attribute `kernel_2_6_22`).
 
-:::{.example #ex-using-linux-manual-config}
+3.  Now we’re going to update the kernel configuration. First unpack the kernel. Then for each supported platform (`i686`, `x86_64`, `uml`) do the following:
 
-# Using `pkgs.linuxManualConfig` with a specific source, version, and config file
+    1.  Make a copy from the old config (e.g., `config-2.6.21-i686-smp`) to the new one (e.g., `config-2.6.22-i686-smp`).
 
-```nix
-{ pkgs, ... }: {
-  version = "6.1.55";
-  src = pkgs.fetchurl {
-    url = "https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-${version}.tar.xz";
-    hash = "sha256:1h0mzx52q9pvdv7rhnvb8g68i7bnlc9rf8gy9qn4alsxq4g28zm8";
-  };
-  configfile = ./path_to_config_file;
-  linux = pkgs.linuxManualConfig {
-    inherit version src configfile;
-    allowImportFromDerivation = true;
-  };
-}
-```
+    2.  Copy the config file for this platform (e.g., `config-2.6.22-i686-smp`) to `.config` in the kernel source tree.
 
-If necessary, the version string can be slightly modified to explicitly mark it as a custom version. If you do so, ensure the `modDirVersion` attribute matches the source's version, otherwise the build will fail.
+    3.  Run `make oldconfig ARCH={i386,x86_64,um}` and answer all questions. (For the uml configuration, also add `SHELL=bash`.) Make sure to keep the configuration consistent between platforms (i.e., don’t enable some feature on `i686` and disable it on `x86_64`).
 
-```nix
-{ pkgs, ... }: {
-  version = "6.1.55-custom";
-  modDirVersion = "6.1.55";
-  src = pkgs.fetchurl {
-    url = "https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-${modDirVersion}.tar.xz";
-    hash = "sha256:1h0mzx52q9pvdv7rhnvb8g68i7bnlc9rf8gy9qn4alsxq4g28zm8";
-  };
-  configfile = ./path_to_config_file;
-  linux = pkgs.linuxManualConfig {
-    inherit version modDirVersion src configfile;
-    allowImportFromDerivation = true;
-  };
-}
-```
+    4.  If needed, you can also run `make menuconfig`:
 
-:::
+        ```ShellSession
+        $ nix-env -f "<nixpkgs>" -iA ncurses
+        $ export NIX_CFLAGS_LINK=-lncurses
+        $ make menuconfig ARCH=arch
+        ```
 
-Additional attributes can be used with `linuxManualConfig` for further customisation. You're encouraged to read [the `pkgs.linuxManualConfig` source code](https://github.com/NixOS/nixpkgs/blob/d77bda728d5041c1294a68fb25c79e2d161f62b9/pkgs/os-specific/linux/kernel/manual-config.nix) to understand how to use them.
+    5.  Copy `.config` over the new config file (e.g., `config-2.6.22-i686-smp`).
 
-To edit the `.config` file for Linux X.Y from within Nix, proceed as follows:
+4.  Test building the kernel: `nix-build -A linuxKernel.kernels.kernel_2_6_22`. If it compiles, ship it! For extra credit, try booting NixOS with it.
 
-```ShellSession
-$ nix-shell '<nixpkgs>' -A linuxKernel.kernels.linux_X_Y.configEnv
-$ unpackPhase
-$ cd linux-*
-$ make nconfig
-```
-
-## Developing kernel modules {#sec-linux-kernel-developing-modules}
-
-When developing kernel modules it's often convenient to run the edit-compile-run loop as quickly as possible.
-See the snippet below as an example.
-
-:::{.example #ex-edit-compile-run-kernel-modules}
-
-# Edit-compile-run loop when developing `mellanox` drivers
-
-```ShellSession
-$ nix-build '<nixpkgs>' -A linuxPackages.kernel.dev
-$ nix-shell '<nixpkgs>' -A linuxPackages.kernel
-$ unpackPhase
-$ cd linux-*
-$ make -C $dev/lib/modules/*/build M=$(pwd)/drivers/net/ethernet/mellanox modules
-# insmod ./drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.ko
-```
-
-:::
+5.  It may be that the new kernel requires updating the external kernel modules and kernel-dependent packages listed in the `linuxPackagesFor` function in `linux-kernels.nix` (such as the NVIDIA drivers, AUFS, etc.). If the updated packages aren’t backwards compatible with older kernels, you may need to keep the older versions around.

doc/packages/nginx.section.md

@@ -8,4 +8,4 @@ HTTP has a couple of different mechanisms for caching to prevent clients from ha
 
 Fortunately, HTTP supports an alternative (and more effective) caching mechanism: the [`ETag`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag) response header. The value of the `ETag` header specifies some identifier for the particular content that the server is sending (e.g., a hash). When a client makes a second request for the same resource, it sends that value back in an `If-None-Match` header. If the ETag value is unchanged, then the server does not need to resend the content.
 
-As of NixOS 19.09, the nginx package in Nixpkgs is patched such that when nginx serves a file out of `/nix/store`, the hash in the store path is used as the `ETag` header in the HTTP response, thus providing proper caching functionality. With NixOS 24.05 and later, the `ETag` additionally includes the response content length, to ensure files served with static compression do not share `ETag`s with their uncompressed version. This `ETag` functionality is enabled automatically; you do not need to do modify any configuration to get this behavior.
+As of NixOS 19.09, the nginx package in Nixpkgs is patched such that when nginx serves a file out of `/nix/store`, the hash in the store path is used as the `ETag` header in the HTTP response, thus providing proper caching functionality. This happens automatically; you do not need to do modify any configuration to get this behavior.

doc/preface.chapter.md

@@ -6,15 +6,11 @@ The Nix Packages collection (Nixpkgs) is a set of thousands of packages for the
 Packages are available for several platforms, and can be used with the Nix
 package manager on most GNU/Linux distributions as well as [NixOS](https://nixos.org/nixos).
 
-This document is the user [_reference_](https://nix.dev/contributing/documentation/diataxis#reference) manual for Nixpkgs.
-It describes entire public interface of Nixpkgs in a concise and orderly manner, and all relevant behaviors, with examples and cross-references.
-
-To discover other kinds of documentation:
-- [nix.dev](https://nix.dev/): Tutorials and guides for getting things done with Nix
-- [NixOS **Option Search**](https://search.nixos.org/options) and reference documentation
-- [Nixpkgs **Package Search**](https://search.nixos.org/packages)
-- [**NixOS** manual](https://nixos.org/manual/nixos/stable/): Reference documentation for the NixOS Linux distribution
-- [`CONTRIBUTING.md`](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md): Contributing to Nixpkgs, including this manual
+This manual primarily describes how to write packages for the Nix Packages collection
+(Nixpkgs). Thus it’s mainly for packagers and developers who want to add packages to
+Nixpkgs. If you like to learn more about the Nix package manager and the Nix
+expression language, then you are kindly referred to the [Nix manual](https://nixos.org/nix/manual/).
+The NixOS distribution is documented in the [NixOS manual](https://nixos.org/nixos/manual/).
 
 ## Overview of Nixpkgs {#overview-of-nixpkgs}
 

doc/stdenv/stdenv.chapter.md

@@ -261,50 +261,14 @@ For more complex cases, like libraries linked into an executable which is then e
 
 As described in the Nix manual, almost any `*.drv` store path in a derivation’s attribute set will induce a dependency on that derivation. `mkDerivation`, however, takes a few attributes intended to include all the dependencies of a package. This is done both for structure and consistency, but also so that certain other setup can take place. For example, certain dependencies need their bin directories added to the `PATH`. That is built-in, but other setup is done via a pluggable mechanism that works in conjunction with these dependency attributes. See [](#ssec-setup-hooks) for details.
 
-Dependencies can be broken down along these axes: their host and target platforms relative to the new derivation’s. The platform distinctions are motivated by cross compilation; see [](#chap-cross) for exactly what each platform means. [^footnote-stdenv-ignored-build-platform] But even if one is not cross compiling, the platforms imply whether a dependency is needed at run-time or build-time.
+Dependencies can be broken down along three axes: their host and target platforms relative to the new derivation’s, and whether they are propagated. The platform distinctions are motivated by cross compilation; see [](#chap-cross) for exactly what each platform means. [^footnote-stdenv-ignored-build-platform] But even if one is not cross compiling, the platforms imply whether or not the dependency is needed at run-time or build-time, a concept that makes perfect sense outside of cross compilation. By default, the run-time/build-time distinction is just a hint for mental clarity, but with `strictDeps` set it is mostly enforced even in the native case.
 
 The extension of `PATH` with dependencies, alluded to above, proceeds according to the relative platforms alone. The process is carried out only for dependencies whose host platform matches the new derivation’s build platform i.e. dependencies which run on the platform where the new derivation will be built. [^footnote-stdenv-native-dependencies-in-path] For each dependency \<dep\> of those dependencies, `dep/bin`, if present, is added to the `PATH` environment variable.
 
-### Dependency propagation {#ssec-stdenv-dependencies-propagated}
+A dependency is said to be **propagated** when some of its other-transitive (non-immediate) downstream dependencies also need it as an immediate dependency.
+[^footnote-stdenv-propagated-dependencies]
 
-Propagated dependencies are made available to all downstream dependencies.
-This is particularly useful for interpreted languages, where all transitive dependencies have to be present in the same environment.
-Therefore it is used for the Python infrastructure in Nixpkgs.
-
-:::{.note}
-Propagated dependencies should be used with care, because they obscure the actual build inputs of dependent derivations and cause side effects through setup hooks.
-This can lead to conflicting dependencies that cannot easily be resolved.
-:::
-
-:::{.example}
-# A propagated dependency
-
-```nix
-with import <nixpkgs> {};
-let
-  bar = stdenv.mkDerivation {
-    name = "bar";
-    dontUnpack = true;
-    # `hello` is also made available to dependents, such as `foo`
-    propagatedBuildInputs = [ hello ];
-    postInstall = "mkdir $out";
-  };
-  foo = stdenv.mkDerivation {
-    name = "foo";
-    dontUnpack = true;
-    # `bar` is a direct dependency, which implicitly includes the propagated `hello`
-    buildInputs = [ bar ];
-    # The `hello` binary is available!
-    postInstall = "hello > $out";
-  };
-in
-foo
-```
-:::
-
-Dependency propagation takes cross compilation into account, meaning that dependencies that cross platform boundaries are properly adjusted.
-
-To determine the exact rules for dependency propagation, we start by assigning to each dependency a couple of ternary numbers (`-1` for `build`, `0` for `host`, and `1` for `target`) representing its [dependency type](#possible-dependency-types), which captures how its host and target platforms are each "offset" from the depending derivation’s host and target platforms. The following table summarize the different combinations that can be obtained:
+It is important to note that dependencies are not necessarily propagated as the same sort of dependency that they were before, but rather as the corresponding sort so that the platform rules still line up. To determine the exact rules for dependency propagation, we start by assigning to each dependency a couple of ternary numbers (`-1` for `build`, `0` for `host`, and `1` for `target`) representing its [dependency type](#possible-dependency-types), which captures how its host and target platforms are each "offset" from the depending derivation’s host and target platforms. The following table summarize the different combinations that can be obtained:
 
 | `host → target`     | attribute name      | offset   |
 | ------------------- | ------------------- | -------- |
@@ -475,11 +439,11 @@ A script to be run by `maintainers/scripts/update.nix` when the package is match
   ```nix
   passthru.updateScript = writeScript "update-zoom-us" ''
     #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p curl pcre2 common-updater-scripts
+    #!nix-shell -i bash -p curl pcre common-updater-scripts
 
     set -eu -o pipefail
 
-    version="$(curl -sI https://zoom.us/client/latest/zoom_x86_64.tar.xz | grep -Fi 'Location:' | pcre2grep -o1 '/(([0-9]\.?)+)/')"
+    version="$(curl -sI https://zoom.us/client/latest/zoom_x86_64.tar.xz | grep -Fi 'Location:' | pcregrep -o1 '/(([0-9]\.?)+)/')"
     update-source-version zoom-us "$version"
   '';
   ```
@@ -627,7 +591,7 @@ See also the section about [`passthru.tests`](#var-meta-tests).
 
 `stdenv.mkDerivation` sets the Nix [derivation](https://nixos.org/manual/nix/stable/expressions/derivations.html#derivations)'s builder to a script that loads the stdenv `setup.sh` bash library and calls `genericBuild`. Most packaging functions rely on this default builder.
 
-This generic command either invokes a script at *buildCommandPath*, or a *buildCommand*, or a number of *phases*. Package builds are split into phases to make it easier to override specific parts of the build (e.g., unpacking the sources or installing the binaries).
+This generic command invokes a number of *phases*. Package builds are split into phases to make it easier to override specific parts of the build (e.g., unpacking the sources or installing the binaries).
 
 Each phase can be overridden in its entirety either by setting the environment variable `namePhase` to a string containing some shell commands to be executed, or by redefining the shell function `namePhase`. The former is convenient to override a phase from the derivation, while the latter is convenient from a build script. However, typically one only wants to *add* some commands to a phase, e.g. by defining `postInstall` or `preFixup`, as skipping some of the default actions may have unexpected consequences. The default script for each phase is defined in the file `pkgs/stdenv/generic/setup.sh`.
 
@@ -867,7 +831,7 @@ Note that shell arrays cannot be passed through environment variables, so you ca
 
 ##### `buildFlags` / `buildFlagsArray` {#var-stdenv-buildFlags}
 
-A list of strings passed as additional flags to `make`. Like `makeFlags` and `makeFlagsArray`, but only used by the build phase. Any build targets should be specified as part of the `buildFlags`.
+A list of strings passed as additional flags to `make`. Like `makeFlags` and `makeFlagsArray`, but only used by the build phase.
 
 ##### `preBuild` {#var-stdenv-preBuild}
 
@@ -908,7 +872,7 @@ If unset, use `check` if it exists, otherwise `test`; if neither is found, do no
 
 ##### `checkFlags` / `checkFlagsArray` {#var-stdenv-checkFlags}
 
-A list of strings passed as additional flags to `make`. Like `makeFlags` and `makeFlagsArray`, but only used by the check phase. Unlike with `buildFlags`, the `checkTarget` is automatically added to the `make` invocation in addition to any `checkFlags` specified.
+A list of strings passed as additional flags to `make`. Like `makeFlags` and `makeFlagsArray`, but only used by the check phase.
 
 ##### `checkInputs` {#var-stdenv-checkInputs}
 
@@ -950,7 +914,7 @@ installTargets = "install-bin install-doc";
 
 ##### `installFlags` / `installFlagsArray` {#var-stdenv-installFlags}
 
-A list of strings passed as additional flags to `make`. Like `makeFlags` and `makeFlagsArray`, but only used by the install phase. Unlike with `buildFlags`, the `installTargets` are automatically added to the `make` invocation in addition to any `installFlags` specified.
+A list of strings passed as additional flags to `make`. Like `makeFlags` and `makeFlagsArray`, but only used by the install phase.
 
 ##### `preInstall` {#var-stdenv-preInstall}
 

doc/tests/manpage-urls.py

@@ -1,109 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -i "python3 -I" -p "python3.withPackages(p: with p; [ aiohttp rich structlog ])"
-
-from argparse import ArgumentParser, Namespace
-from collections import defaultdict
-from collections.abc import Mapping, Sequence
-from enum import IntEnum
-from http import HTTPStatus
-from pathlib import Path
-from typing import Optional
-import asyncio, json, logging
-
-import aiohttp, structlog
-from structlog.contextvars import bound_contextvars as log_context
-
-
-LogLevel = IntEnum('LogLevel', {
-    lvl: getattr(logging, lvl)
-    for lvl in ('DEBUG', 'INFO', 'WARNING', 'ERROR', 'CRITICAL')
-})
-LogLevel.__str__ = lambda self: self.name
-
-
-EXPECTED_STATUS=frozenset((
-    HTTPStatus.OK, HTTPStatus.FOUND,
-    HTTPStatus.NOT_FOUND,
-))
-
-async def check(session: aiohttp.ClientSession, manpage: str, url: str) -> HTTPStatus:
-    with log_context(manpage=manpage, url=url):
-        logger.debug("Checking")
-        async with session.head(url) as resp:
-            st = HTTPStatus(resp.status)
-            match st:
-                case HTTPStatus.OK | HTTPStatus.FOUND:
-                    logger.debug("OK!")
-                case HTTPStatus.NOT_FOUND:
-                    logger.error("Broken link!")
-                case _ if st < 400:
-                    logger.info("Unexpected code", status=st)
-                case _ if 400 <= st < 600:
-                    logger.warn("Unexpected error", status=st)
-
-            return st
-
-async def main(urls_path: Path) -> Mapping[HTTPStatus, int]:
-    logger.info(f"Parsing {urls_path}")
-    with urls_path.open() as urls_file:
-        urls = json.load(urls_file)
-
-    count: defaultdict[HTTPStatus, int] = defaultdict(lambda: 0)
-
-    logger.info(f"Checking URLs from {urls_path}")
-    async with aiohttp.ClientSession() as session:
-        for status in asyncio.as_completed([
-            check(session, manpage, url)
-            for manpage, url in urls.items()
-        ]):
-            count[await status]+=1
-
-    ok = count[HTTPStatus.OK] + count[HTTPStatus.FOUND]
-    broken = count[HTTPStatus.NOT_FOUND]
-    unknown = sum(c for st, c in count.items() if st not in EXPECTED_STATUS)
-    logger.info(f"Done: {broken} broken links, "
-                f"{ok} correct links, and {unknown} unexpected status")
-
-    return count
-
-
-def parse_args(args: Optional[Sequence[str]] = None) -> Namespace:
-    parser = ArgumentParser(
-        prog = 'check-manpage-urls',
-        description = 'Check the validity of the manpage URLs linked in the nixpkgs manual',
-    )
-    parser.add_argument(
-        '-l', '--log-level',
-        default = os.getenv('LOG_LEVEL', 'INFO'),
-        type = lambda s: LogLevel[s],
-        choices = list(LogLevel),
-    )
-    parser.add_argument(
-        'file',
-        type = Path,
-        nargs = '?',
-    )
-
-    return parser.parse_args(args)
-
-
-if __name__ == "__main__":
-    import os, sys
-
-    args = parse_args()
-
-    structlog.configure(
-        wrapper_class=structlog.make_filtering_bound_logger(args.log_level),
-    )
-    logger = structlog.getLogger("check-manpage-urls.py")
-
-    urls_path = args.file
-    if urls_path is None:
-        REPO_ROOT = Path(__file__).parent.parent.parent.parent
-        logger.info(f"Assuming we are in a nixpkgs repo rooted at {REPO_ROOT}")
-
-        urls_path = REPO_ROOT / 'doc' / 'manpage-urls.json'
-
-    count = asyncio.run(main(urls_path))
-
-    sys.exit(0 if count[HTTPStatus.NOT_FOUND] == 0 else 1)

flake.nix

@@ -9,8 +9,7 @@
         nixpkgs = self;
       };
 
-      libVersionInfoOverlay = import ./lib/flake-version-info.nix self;
-      lib = (import ./lib).extend libVersionInfoOverlay;
+      lib = import ./lib;
 
       forAllSystems = lib.genAttrs lib.systems.flakeExposed;
     in
@@ -21,38 +20,22 @@
 
         nixosSystem = args:
           import ./nixos/lib/eval-config.nix (
-            {
-              lib = final;
+            args // {
+              modules = args.modules ++ [{
+                system.nixos.versionSuffix =
+                  ".${final.substring 0 8 (self.lastModifiedDate or self.lastModified or "19700101")}.${self.shortRev or "dirty"}";
+                system.nixos.revision = final.mkIf (self ? rev) self.rev;
+              }];
+            } // lib.optionalAttrs (! args?system) {
               # Allow system to be set modularly in nixpkgs.system.
               # We set it to null, to remove the "legacy" entrypoint's
               # non-hermetic default.
               system = null;
-            } // args
+            }
           );
       });
 
-      checks.x86_64-linux = {
-        tarball = jobs.tarball;
-        # Test that ensures that the nixosSystem function can accept a lib argument
-        # Note: prefer not to extend or modify `lib`, especially if you want to share reusable modules
-        #       alternatives include: `import` a file, or put a custom library in an option or in `_module.args.<libname>`
-        nixosSystemAcceptsLib = (self.lib.nixosSystem {
-          lib = self.lib.extend (final: prev: {
-            ifThisFunctionIsMissingTheTestFails = final.id;
-          });
-          modules = [
-            ./nixos/modules/profiles/minimal.nix
-            ({ lib, ... }: lib.ifThisFunctionIsMissingTheTestFails {
-              # Define a minimal config without eval warnings
-              nixpkgs.hostPlatform = "x86_64-linux";
-              boot.loader.grub.enable = false;
-              fileSystems."/".device = "nodev";
-              # See https://search.nixos.org/options?show=system.stateVersion&query=stateversion
-              system.stateVersion = lib.versions.majorMinor lib.version; # DON'T do this in real configs!
-            })
-          ];
-        }).config.system.build.toplevel;
-      };
+      checks.x86_64-linux.tarball = jobs.tarball;
 
       htmlDocs = {
         nixpkgsManual = jobs.manual;
@@ -70,11 +53,7 @@
       # attribute it displays `omitted` instead of evaluating all packages,
       # which keeps `nix flake show` on Nixpkgs reasonably fast, though less
       # information rich.
-      legacyPackages = forAllSystems (system:
-        (import ./. { inherit system; }).extend (final: prev: {
-          lib = prev.lib.extend libVersionInfoOverlay;
-        })
-      );
+      legacyPackages = forAllSystems (system: import ./. { inherit system; });
 
       nixosModules = {
         notDetected = ./nixos/modules/installer/scan/not-detected.nix;

lib/README.md

@@ -36,76 +36,13 @@ The [module system](https://nixos.org/manual/nixpkgs/#module-system) spans multi
 - [`options.nix`](options.nix): `lib.options` for anything relating to option definitions
 - [`types.nix`](types.nix): `lib.types` for module system types
 
-## PR Guidelines
-
-Follow these guidelines for proposing a change to the interface of `lib`.
-
-### Provide a Motivation
-
-Clearly describe why the change is necessary and its use cases.
-
-Make sure that the change benefits the user more than the added mental effort of looking it up and keeping track of its definition.
-If the same can reasonably be done with the existing interface,
-consider just updating the documentation with more examples and links.
-This is also known as the [Fairbairn Threshold](https://wiki.haskell.org/Fairbairn_threshold).
-
-Through this principle we avoid the human cost of duplicated functionality in an overly large library.
-
-### Make one PR for each change
-
-Don't have multiple changes in one PR, instead split it up into multiple ones.
-
-This keeps the conversation focused and has a higher chance of getting merged.
-
-### Name the interface appropriately
-
-When introducing new names to the interface, such as new function, or new function attributes,
-make sure to name it appropriately.
-
-Names should be self-explanatory and consistent with the rest of `lib`.
-If there's no obvious best name, include the alternatives you considered.
-
-### Write documentation
-
-Update the [reference documentation](#reference-documentation) to reflect the change.
-
-Be generous with links to related functionality.
-
-### Write tests
-
-Add good test coverage for the change, including:
-
-- Tests for edge cases, such as empty values or lists.
-- Tests for tricky inputs, such as a string with string context or a path that doesn't exist.
-- Test all code paths, such as `if-then-else` branches and returned attributes.
-- If the tests for the sub-library are written in bash,
-  test messages of custom errors, such as `throw` or `abortMsg`,
-
-  At the time this is only not necessary for sub-libraries tested with [`tests/misc.nix`](./tests/misc.nix).
-
-See [running tests](#running-tests) for more details on the test suites.
-
-### Write tidy code
-
-Name variables well, even if they're internal.
-The code should be as self-explanatory as possible.
-Be generous with code comments when appropriate.
-
-As a baseline, follow the [Nixpkgs code conventions](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#code-conventions).
-
-### Write efficient code
-
-Nix generally does not have free abstractions.
-Be aware that seemingly straightforward changes can cause more allocations and a decrease in performance.
-That said, don't optimise prematurely, especially in new code.
-
 ## Reference documentation
 
 Reference documentation for library functions is written above each function as a multi-line comment.
 These comments are processed using [nixdoc](https://github.com/nix-community/nixdoc) and [rendered in the Nixpkgs manual](https://nixos.org/manual/nixpkgs/stable/#chap-functions).
 The nixdoc README describes the [comment format](https://github.com/nix-community/nixdoc#comment-format).
 
-See [doc/README.md](../doc/README.md) for how to build the manual.
+See the [chapter on contributing to the Nixpkgs manual](https://nixos.org/manual/nixpkgs/#chap-contributing) for how to build the manual.
 
 ## Running tests
 

lib/attrsets.nix

@@ -14,14 +14,6 @@ rec {
 
   /* Return an attribute from nested attribute sets.
 
-     Nix has an [attribute selection operator `. or`](https://nixos.org/manual/nix/stable/language/operators#attribute-selection) which is sufficient for such queries, as long as the number of attributes is static. For example:
-
-     ```nix
-     (x.a.b or 6) == attrByPath ["a" "b"] 6 x
-     # and
-     (x.${f p}."example.com" or 6) == attrByPath [ (f p) "example.com" ] 6 x
-     ```
-
      Example:
        x = { a = { b = 3; }; }
        # ["a" "b"] is equivalent to x.a.b
@@ -42,44 +34,21 @@ rec {
     default:
     # The nested attribute set to select values from
     set:
-    let
-      lenAttrPath = length attrPath;
-      attrByPath' = n: s: (
-        if n == lenAttrPath then s
-        else (
-          let
-            attr = elemAt attrPath n;
-          in
-          if s ? ${attr} then attrByPath' (n + 1) s.${attr}
-          else default
-        )
-      );
+    let attr = head attrPath;
     in
-      attrByPath' 0 set;
+      if attrPath == [] then set
+      else if set ? ${attr}
+      then attrByPath (tail attrPath) default set.${attr}
+      else default;
 
   /* Return if an attribute from nested attribute set exists.
 
-     Nix has a [has attribute operator `?`](https://nixos.org/manual/nix/stable/language/operators#has-attribute), which is sufficient for such queries, as long as the number of attributes is static. For example:
-
-     ```nix
-     (x?a.b) == hasAttryByPath ["a" "b"] x
-     # and
-     (x?${f p}."example.com") == hasAttryByPath [ (f p) "example.com" ] x
-     ```
-
-     **Laws**:
-      1.  ```nix
-          hasAttrByPath [] x == true
-          ```
-
      Example:
        x = { a = { b = 3; }; }
        hasAttrByPath ["a" "b"] x
        => true
        hasAttrByPath ["z" "z"] x
        => false
-       hasAttrByPath [] (throw "no need")
-       => true
 
     Type:
       hasAttrByPath :: [String] -> AttrSet -> Bool
@@ -89,84 +58,13 @@ rec {
     attrPath:
     # The nested attribute set to check
     e:
-    let
-      lenAttrPath = length attrPath;
-      hasAttrByPath' = n: s: (
-        n == lenAttrPath || (
-          let
-            attr = elemAt attrPath n;
-          in
-          if s ? ${attr} then hasAttrByPath' (n + 1) s.${attr}
-          else false
-        )
-      );
+    let attr = head attrPath;
     in
-      hasAttrByPath' 0 e;
+      if attrPath == [] then true
+      else if e ? ${attr}
+      then hasAttrByPath (tail attrPath) e.${attr}
+      else false;
 
-  /*
-    Return the longest prefix of an attribute path that refers to an existing attribute in a nesting of attribute sets.
-
-    Can be used after [`mapAttrsRecursiveCond`](#function-library-lib.attrsets.mapAttrsRecursiveCond) to apply a condition,
-    although this will evaluate the predicate function on sibling attributes as well.
-
-    Note that the empty attribute path is valid for all values, so this function only throws an exception if any of its inputs does.
-
-    **Laws**:
-    1.  ```nix
-        attrsets.longestValidPathPrefix [] x == []
-        ```
-
-    2.  ```nix
-        hasAttrByPath (attrsets.longestValidPathPrefix p x) x == true
-        ```
-
-    Example:
-      x = { a = { b = 3; }; }
-      attrsets.longestValidPathPrefix ["a" "b" "c"] x
-      => ["a" "b"]
-      attrsets.longestValidPathPrefix ["a"] x
-      => ["a"]
-      attrsets.longestValidPathPrefix ["z" "z"] x
-      => []
-      attrsets.longestValidPathPrefix ["z" "z"] (throw "no need")
-      => []
-
-    Type:
-      attrsets.longestValidPathPrefix :: [String] -> Value -> [String]
-  */
-  longestValidPathPrefix =
-    # A list of strings representing the longest possible path that may be returned.
-    attrPath:
-    # The nested attribute set to check.
-    v:
-    let
-      lenAttrPath = length attrPath;
-      getPrefixForSetAtIndex =
-        # The nested attribute set to check, if it is an attribute set, which
-        # is not a given.
-        remainingSet:
-        # The index of the attribute we're about to check, as well as
-        # the length of the prefix we've already checked.
-        remainingPathIndex:
-
-          if remainingPathIndex == lenAttrPath then
-            # All previously checked attributes exist, and no attr names left,
-            # so we return the whole path.
-            attrPath
-          else
-            let
-              attr = elemAt attrPath remainingPathIndex;
-            in
-            if remainingSet ? ${attr} then
-              getPrefixForSetAtIndex
-                remainingSet.${attr}      # advance from the set to the attribute value
-                (remainingPathIndex + 1)  # advance the path
-            else
-              # The attribute doesn't exist, so we return the prefix up to the
-              # previously checked length.
-              take remainingPathIndex attrPath;
-    in
-      getPrefixForSetAtIndex v 0;
 
   /* Create a new attribute set with `value` set at the nested attribute location specified in `attrPath`.
 
@@ -193,14 +91,6 @@ rec {
   /* Like `attrByPath`, but without a default value. If it doesn't find the
      path it will throw an error.
 
-     Nix has an [attribute selection operator](https://nixos.org/manual/nix/stable/language/operators#attribute-selection) which is sufficient for such queries, as long as the number of attributes is static. For example:
-
-    ```nix
-     x.a.b == getAttrByPath ["a" "b"] x
-     # and
-     x.${f p}."example.com" == getAttrByPath [ (f p) "example.com" ] x
-     ```
-
      Example:
        x = { a = { b = 3; }; }
        getAttrFromPath ["a" "b"] x
@@ -993,10 +883,7 @@ rec {
     recursiveUpdateUntil (path: lhs: rhs: !(isAttrs lhs && isAttrs rhs)) lhs rhs;
 
 
-  /*
-    Recurse into every attribute set of the first argument and check that:
-    - Each attribute path also exists in the second argument.
-    - If the attribute's value is not a nested attribute set, it must have the same value in the right argument.
+  /* Returns true if the pattern is contained in the set. False otherwise.
 
      Example:
        matchAttrs { cpu = {}; } { cpu = { bits = 64; }; }
@@ -1008,24 +895,16 @@ rec {
   matchAttrs =
     # Attribute set structure to match
     pattern:
-    # Attribute set to check
+    # Attribute set to find patterns in
     attrs:
     assert isAttrs pattern;
-    all
-    ( # Compare equality between `pattern` & `attrs`.
-      attr:
-      # Missing attr, not equal.
-      attrs ? ${attr} && (
-        let
-          lhs = pattern.${attr};
-          rhs = attrs.${attr};
-        in
-        # If attrset check recursively
-        if isAttrs lhs then isAttrs rhs && matchAttrs lhs rhs
-        else lhs == rhs
-      )
-    )
-    (attrNames pattern);
+    all id (attrValues (zipAttrsWithNames (attrNames pattern) (n: values:
+      let pat = head values; val = elemAt values 1; in
+      if length values == 1 then false
+      else if isAttrs pat then isAttrs val && matchAttrs pat val
+      else pat == val
+    ) [pattern attrs]));
+
 
   /* Override only the attributes that are already present in the old set
     useful for deep-overriding.

lib/customisation.nix

@@ -1,17 +1,5 @@
 { lib }:
 
-let
-  inherit (builtins)
-    intersectAttrs;
-  inherit (lib)
-    functionArgs isFunction mirrorFunctionArgs isAttrs setFunctionArgs
-    optionalAttrs attrNames filter elemAt concatStringsSep sortOn take length
-    filterAttrs optionalString flip pathIsDirectory head pipe isDerivation listToAttrs
-    mapAttrs seq flatten deepSeq warnIf isInOldestRelease extends
-    ;
-  inherit (lib.strings) levenshtein levenshteinAtMost;
-
-in
 rec {
 
 
@@ -55,15 +43,15 @@ rec {
   overrideDerivation = drv: f:
     let
       newDrv = derivation (drv.drvAttrs // (f drv));
-    in flip (extendDerivation (seq drv.drvPath true)) newDrv (
+    in lib.flip (extendDerivation (builtins.seq drv.drvPath true)) newDrv (
       { meta = drv.meta or {};
         passthru = if drv ? passthru then drv.passthru else {};
       }
       //
       (drv.passthru or {})
       //
-      optionalAttrs (drv ? __spliced) {
-        __spliced = {} // (mapAttrs (_: sDrv: overrideDerivation sDrv f) drv.__spliced);
+      lib.optionalAttrs (drv ? __spliced) {
+        __spliced = {} // (lib.mapAttrs (_: sDrv: overrideDerivation sDrv f) drv.__spliced);
       });
 
 
@@ -91,30 +79,30 @@ rec {
   makeOverridable = f:
     let
       # Creates a functor with the same arguments as f
-      mirrorArgs = mirrorFunctionArgs f;
+      mirrorArgs = lib.mirrorFunctionArgs f;
     in
     mirrorArgs (origArgs:
     let
       result = f origArgs;
 
       # Changes the original arguments with (potentially a function that returns) a set of new attributes
-      overrideWith = newArgs: origArgs // (if isFunction newArgs then newArgs origArgs else newArgs);
+      overrideWith = newArgs: origArgs // (if lib.isFunction newArgs then newArgs origArgs else newArgs);
 
       # Re-call the function but with different arguments
       overrideArgs = mirrorArgs (newArgs: makeOverridable f (overrideWith newArgs));
       # Change the result of the function call by applying g to it
       overrideResult = g: makeOverridable (mirrorArgs (args: g (f args))) origArgs;
     in
-      if isAttrs result then
+      if builtins.isAttrs result then
         result // {
           override = overrideArgs;
           overrideDerivation = fdrv: overrideResult (x: overrideDerivation x fdrv);
           ${if result ? overrideAttrs then "overrideAttrs" else null} = fdrv:
             overrideResult (x: x.overrideAttrs fdrv);
         }
-      else if isFunction result then
+      else if lib.isFunction result then
         # Transform the result into a functor while propagating its arguments
-        setFunctionArgs result (functionArgs result) // {
+        lib.setFunctionArgs result (lib.functionArgs result) // {
           override = overrideArgs;
         }
       else result);
@@ -152,39 +140,39 @@ rec {
   */
   callPackageWith = autoArgs: fn: args:
     let
-      f = if isFunction fn then fn else import fn;
-      fargs = functionArgs f;
+      f = if lib.isFunction fn then fn else import fn;
+      fargs = lib.functionArgs f;
 
       # All arguments that will be passed to the function
       # This includes automatic ones and ones passed explicitly
-      allArgs = intersectAttrs fargs autoArgs // args;
+      allArgs = builtins.intersectAttrs fargs autoArgs // args;
 
       # a list of argument names that the function requires, but
       # wouldn't be passed to it
-      missingArgs =
+      missingArgs = lib.attrNames
         # Filter out arguments that have a default value
-        (filterAttrs (name: value: ! value)
+        (lib.filterAttrs (name: value: ! value)
         # Filter out arguments that would be passed
-        (removeAttrs fargs (attrNames allArgs)));
+        (removeAttrs fargs (lib.attrNames allArgs)));
 
       # Get a list of suggested argument names for a given missing one
-      getSuggestions = arg: pipe (autoArgs // args) [
-        attrNames
+      getSuggestions = arg: lib.pipe (autoArgs // args) [
+        lib.attrNames
         # Only use ones that are at most 2 edits away. While mork would work,
         # levenshteinAtMost is only fast for 2 or less.
-        (filter (levenshteinAtMost 2 arg))
+        (lib.filter (lib.strings.levenshteinAtMost 2 arg))
         # Put strings with shorter distance first
-        (sortOn (levenshtein arg))
+        (lib.sort (x: y: lib.strings.levenshtein x arg < lib.strings.levenshtein y arg))
         # Only take the first couple results
-        (take 3)
+        (lib.take 3)
         # Quote all entries
         (map (x: "\"" + x + "\""))
       ];
 
       prettySuggestions = suggestions:
         if suggestions == [] then ""
-        else if length suggestions == 1 then ", did you mean ${elemAt suggestions 0}?"
-        else ", did you mean ${concatStringsSep ", " (lib.init suggestions)} or ${lib.last suggestions}?";
+        else if lib.length suggestions == 1 then ", did you mean ${lib.elemAt suggestions 0}?"
+        else ", did you mean ${lib.concatStringsSep ", " (lib.init suggestions)} or ${lib.last suggestions}?";
 
       errorForArg = arg:
         let
@@ -192,22 +180,16 @@ rec {
           # loc' can be removed once lib/minver.nix is >2.3.4, since that includes
           # https://github.com/NixOS/nix/pull/3468 which makes loc be non-null
           loc' = if loc != null then loc.file + ":" + toString loc.line
-            else if ! isFunction fn then
-              toString fn + optionalString (pathIsDirectory fn) "/default.nix"
+            else if ! lib.isFunction fn then
+              toString fn + lib.optionalString (lib.sources.pathIsDirectory fn) "/default.nix"
             else "<unknown location>";
         in "Function called without required argument \"${arg}\" at "
         + "${loc'}${prettySuggestions (getSuggestions arg)}";
 
       # Only show the error for the first missing argument
-      error = errorForArg (head (attrNames missingArgs));
+      error = errorForArg (lib.head missingArgs);
 
-    in if missingArgs == {}
-       then makeOverridable f allArgs
-       # This needs to be an abort so it can't be caught with `builtins.tryEval`,
-       # which is used by nix-env and ofborg to filter out packages that don't evaluate.
-       # This way we're forced to fix such errors in Nixpkgs,
-       # which is especially relevant with allowAliases = false
-       else abort "lib.customisation.callPackageWith: ${error}";
+    in if missingArgs == [] then makeOverridable f allArgs else abort error;
 
 
   /* Like callPackage, but for a function that returns an attribute
@@ -219,17 +201,17 @@ rec {
   */
   callPackagesWith = autoArgs: fn: args:
     let
-      f = if isFunction fn then fn else import fn;
-      auto = intersectAttrs (functionArgs f) autoArgs;
+      f = if lib.isFunction fn then fn else import fn;
+      auto = builtins.intersectAttrs (lib.functionArgs f) autoArgs;
       origArgs = auto // args;
       pkgs = f origArgs;
       mkAttrOverridable = name: _: makeOverridable (newArgs: (f newArgs).${name}) origArgs;
     in
-      if isDerivation pkgs then throw
+      if lib.isDerivation pkgs then throw
         ("function `callPackages` was called on a *single* derivation "
           + ''"${pkgs.name or "<unknown-name>"}";''
           + " did you mean to use `callPackage` instead?")
-      else mapAttrs mkAttrOverridable pkgs;
+      else lib.mapAttrs mkAttrOverridable pkgs;
 
 
   /* Add attributes to each output of a derivation without changing
@@ -242,7 +224,7 @@ rec {
     let
       outputs = drv.outputs or [ "out" ];
 
-      commonAttrs = drv // (listToAttrs outputsList) //
+      commonAttrs = drv // (builtins.listToAttrs outputsList) //
         ({ all = map (x: x.value) outputsList; }) // passthru;
 
       outputToAttrListElement = outputName:
@@ -256,7 +238,7 @@ rec {
             # TODO: give the derivation control over the outputs.
             #       `overrideAttrs` may not be the only attribute that needs
             #       updating when switching outputs.
-            optionalAttrs (passthru?overrideAttrs) {
+            lib.optionalAttrs (passthru?overrideAttrs) {
               # TODO: also add overrideAttrs when overrideAttrs is not custom, e.g. when not splicing.
               overrideAttrs = f: (passthru.overrideAttrs f).${outputName};
             };
@@ -282,11 +264,11 @@ rec {
 
       commonAttrs =
         { inherit (drv) name system meta; inherit outputs; }
-        // optionalAttrs (drv._hydraAggregate or false) {
+        // lib.optionalAttrs (drv._hydraAggregate or false) {
           _hydraAggregate = true;
-          constituents = map hydraJob (flatten drv.constituents);
+          constituents = map hydraJob (lib.flatten drv.constituents);
         }
-        // (listToAttrs outputsList);
+        // (lib.listToAttrs outputsList);
 
       makeOutput = outputName:
         let output = drv.${outputName}; in
@@ -301,9 +283,9 @@ rec {
 
       outputsList = map makeOutput outputs;
 
-      drv' = (head outputsList).value;
+      drv' = (lib.head outputsList).value;
     in if drv == null then null else
-      deepSeq drv' drv';
+      lib.deepSeq drv' drv';
 
   /* Make a set of packages with a common scope. All packages called
      with the provided `callPackage` will be evaluated with the same
@@ -322,11 +304,11 @@ rec {
     let self = f self // {
           newScope = scope: newScope (self // scope);
           callPackage = self.newScope {};
-          overrideScope = g: makeScope newScope (extends g f);
+          overrideScope = g: makeScope newScope (lib.fixedPoints.extends g f);
           # Remove after 24.11 is released.
-          overrideScope' = g: warnIf (isInOldestRelease 2311)
+          overrideScope' = g: lib.warnIf (lib.isInOldestRelease 2311)
             "`overrideScope'` (from `lib.makeScope`) has been renamed to `overrideScope`."
-            (makeScope newScope (extends g f));
+            (makeScope newScope (lib.fixedPoints.extends g f));
           packages = f;
         };
     in self;
@@ -402,7 +384,7 @@ rec {
         overrideScope = g: (makeScopeWithSplicing'
           { inherit splicePackages newScope; }
           { inherit otherSplices keep extra;
-            f = extends g f;
+            f = lib.fixedPoints.extends g f;
           });
         packages = f;
       };

lib/default.nix

@@ -91,7 +91,7 @@ let
     inherit (self.lists) singleton forEach foldr fold foldl foldl' imap0 imap1
       concatMap flatten remove findSingle findFirst any all count
       optional optionals toList range replicate partition zipListsWith zipLists
-      reverseList listDfs toposort sort sortOn naturalSort compareLists take
+      reverseList listDfs toposort sort naturalSort compareLists take
       drop sublist last init crossLists unique allUnique intersectLists
       subtractLists mutuallyExclusive groupBy groupBy';
     inherit (self.strings) concatStrings concatMapStrings concatImapStrings
@@ -120,8 +120,7 @@ let
     inherit (self.meta) addMetaAttrs dontDistribute setName updateName
       appendToName mapDerivationAttrset setPrio lowPrio lowPrioSet hiPrio
       hiPrioSet getLicenseFromSpdxId getExe getExe';
-    inherit (self.filesystem) pathType pathIsDirectory pathIsRegularFile
-      packagesFromDirectoryRecursive;
+    inherit (self.filesystem) pathType pathIsDirectory pathIsRegularFile;
     inherit (self.sources) cleanSourceFilter
       cleanSource sourceByRegex sourceFilesBySuffices
       commitIdFromGitRepo cleanSourceWith pathHasContext

lib/fileset/default.nix

@@ -107,7 +107,7 @@ let
     _printFileset
     _intersection
     _difference
-    _fromFetchGit
+    _mirrorStorePath
     _fetchGitSubmodulesMinver
     _emptyWithoutBase
     ;
@@ -148,6 +148,7 @@ let
   inherit (lib.trivial)
     isFunction
     pipe
+    inPureEvalMode
     ;
 
 in {
@@ -753,22 +754,23 @@ in {
       This directory must contain a `.git` file or subdirectory.
     */
     path:
-    _fromFetchGit
-      "gitTracked"
-      "argument"
-      path
-      {};
+    # See the gitTrackedWith implementation for more explanatory comments
+    let
+      fetchResult = builtins.fetchGit path;
+    in
+    if inPureEvalMode then
+      throw "lib.fileset.gitTracked: This function is currently not supported in pure evaluation mode, since it currently relies on `builtins.fetchGit`. See https://github.com/NixOS/nix/issues/9292."
+    else if ! isPath path then
+      throw "lib.fileset.gitTracked: Expected the argument to be a path, but it's a ${typeOf path} instead."
+    else if ! pathExists (path + "/.git") then
+      throw "lib.fileset.gitTracked: Expected the argument (${toString path}) to point to a local working tree of a Git repository, but it's not."
+    else
+      _mirrorStorePath path fetchResult.outPath;
 
   /*
     Create a file set containing all [Git-tracked files](https://git-scm.com/book/en/v2/Git-Basics-Recording-Changes-to-the-Repository) in a repository.
     The first argument allows configuration with an attribute set,
     while the second argument is the path to the Git working tree.
-
-    `gitTrackedWith` does not perform any filtering when the path is a [Nix store path](https://nixos.org/manual/nix/stable/store/store-path.html#store-path) and not a repository.
-    In this way, it accommodates the use case where the expression that makes the `gitTracked` call does not reside in an actual git repository anymore,
-    and has presumably already been fetched in a way that excludes untracked files.
-    Fetchers with such equivalent behavior include `builtins.fetchGit`, `builtins.fetchTree` (experimental), and `pkgs.fetchgit` when used without `leaveDotGit`.
-
     If you don't need the configuration,
     you can use [`gitTracked`](#function-library-lib.fileset.gitTracked) instead.
 
@@ -805,19 +807,35 @@ in {
       This directory must contain a `.git` file or subdirectory.
     */
     path:
-    if ! isBool recurseSubmodules then
-      throw "lib.fileset.gitTrackedWith: Expected the attribute `recurseSubmodules` of the first argument to be a boolean, but it's a ${typeOf recurseSubmodules} instead."
-    else if recurseSubmodules && versionOlder nixVersion _fetchGitSubmodulesMinver then
-      throw "lib.fileset.gitTrackedWith: Setting the attribute `recurseSubmodules` to `true` is only supported for Nix version ${_fetchGitSubmodulesMinver} and after, but Nix version ${nixVersion} is used."
-    else
-      _fromFetchGit
-        "gitTrackedWith"
-        "second argument"
-        path
+    let
+      # This imports the files unnecessarily, which currently can't be avoided
+      # because `builtins.fetchGit` is the only function exposing which files are tracked by Git.
+      # With the [lazy trees PR](https://github.com/NixOS/nix/pull/6530),
+      # the unnecessarily import could be avoided.
+      # However a simpler alternative still would be [a builtins.gitLsFiles](https://github.com/NixOS/nix/issues/2944).
+      fetchResult = builtins.fetchGit {
+        url = path;
+
         # This is the only `fetchGit` parameter that makes sense in this context.
         # We can't just pass `submodules = recurseSubmodules` here because
         # this would fail for Nix versions that don't support `submodules`.
-        (lib.optionalAttrs recurseSubmodules {
-          submodules = true;
-        });
+        ${if recurseSubmodules then "submodules" else null} = true;
+      };
+    in
+    if inPureEvalMode then
+      throw "lib.fileset.gitTrackedWith: This function is currently not supported in pure evaluation mode, since it currently relies on `builtins.fetchGit`. See https://github.com/NixOS/nix/issues/9292."
+    else if ! isBool recurseSubmodules then
+      throw "lib.fileset.gitTrackedWith: Expected the attribute `recurseSubmodules` of the first argument to be a boolean, but it's a ${typeOf recurseSubmodules} instead."
+    else if recurseSubmodules && versionOlder nixVersion _fetchGitSubmodulesMinver then
+      throw "lib.fileset.gitTrackedWith: Setting the attribute `recurseSubmodules` to `true` is only supported for Nix version ${_fetchGitSubmodulesMinver} and after, but Nix version ${nixVersion} is used."
+    else if ! isPath path then
+      throw "lib.fileset.gitTrackedWith: Expected the second argument to be a path, but it's a ${typeOf path} instead."
+    # We can identify local working directories by checking for .git,
+    # see https://git-scm.com/docs/gitrepository-layout#_description.
+    # Note that `builtins.fetchGit` _does_ work for bare repositories (where there's no `.git`),
+    # even though `git ls-files` wouldn't return any files in that case.
+    else if ! pathExists (path + "/.git") then
+      throw "lib.fileset.gitTrackedWith: Expected the second argument (${toString path}) to point to a local working tree of a Git repository, but it's not."
+    else
+      _mirrorStorePath path fetchResult.outPath;
 }

lib/fileset/internal.nix

@@ -10,7 +10,6 @@ let
     split
     trace
     typeOf
-    fetchGit
     ;
 
   inherit (lib.attrsets)
@@ -41,8 +40,6 @@ let
   inherit (lib.path)
     append
     splitRoot
-    hasStorePathPrefix
-    splitStorePath
     ;
 
   inherit (lib.path.subpath)
@@ -58,9 +55,6 @@ let
     hasSuffix
     ;
 
-  inherit (lib.trivial)
-    inPureEvalMode
-    ;
 in
 # Rare case of justified usage of rec:
 # - This file is internal, so the return value doesn't matter, no need to make things overridable
@@ -858,61 +852,4 @@ rec {
     in
     _create localPath
       (recurse storePath);
-
-  # Create a file set from the files included in the result of a fetchGit call
-  # Type: String -> String -> Path -> Attrs -> FileSet
-  _fromFetchGit = function: argument: path: extraFetchGitAttrs:
-    let
-      # The code path for when isStorePath is true
-      tryStorePath =
-        if pathExists (path + "/.git") then
-          # If there is a `.git` directory in the path,
-          # it means that the path was imported unfiltered into the Nix store.
-          # This function should throw in such a case, because
-          # - `fetchGit` doesn't generally work with `.git` directories in store paths
-          # - Importing the entire path could include Git-tracked files
-          throw ''
-            lib.fileset.${function}: The ${argument} (${toString path}) is a store path within a working tree of a Git repository.
-                This indicates that a source directory was imported into the store using a method such as `import "''${./.}"` or `path:.`.
-                This function currently does not support such a use case, since it currently relies on `builtins.fetchGit`.
-                You could make this work by using a fetcher such as `fetchGit` instead of copying the whole repository.
-                If you can't avoid copying the repo to the store, see https://github.com/NixOS/nix/issues/9292.''
-        else
-          # Otherwise we're going to assume that the path was a Git directory originally,
-          # but it was fetched using a method that already removed files not tracked by Git,
-          # such as `builtins.fetchGit`, `pkgs.fetchgit` or others.
-          # So we can just import the path in its entirety.
-          _singleton path;
-
-      # The code path for when isStorePath is false
-      tryFetchGit =
-        let
-          # This imports the files unnecessarily, which currently can't be avoided
-          # because `builtins.fetchGit` is the only function exposing which files are tracked by Git.
-          # With the [lazy trees PR](https://github.com/NixOS/nix/pull/6530),
-          # the unnecessarily import could be avoided.
-          # However a simpler alternative still would be [a builtins.gitLsFiles](https://github.com/NixOS/nix/issues/2944).
-          fetchResult = fetchGit ({
-            url = path;
-          } // extraFetchGitAttrs);
-        in
-        # We can identify local working directories by checking for .git,
-        # see https://git-scm.com/docs/gitrepository-layout#_description.
-        # Note that `builtins.fetchGit` _does_ work for bare repositories (where there's no `.git`),
-        # even though `git ls-files` wouldn't return any files in that case.
-        if ! pathExists (path + "/.git") then
-          throw "lib.fileset.${function}: Expected the ${argument} (${toString path}) to point to a local working tree of a Git repository, but it's not."
-        else
-          _mirrorStorePath path fetchResult.outPath;
-
-    in
-    if ! isPath path then
-      throw "lib.fileset.${function}: Expected the ${argument} to be a path, but it's a ${typeOf path} instead."
-    else if pathType path != "directory" then
-      throw "lib.fileset.${function}: Expected the ${argument} (${toString path}) to be a directory, but it's a file instead."
-    else if hasStorePathPrefix path then
-      tryStorePath
-    else
-      tryFetchGit;
-
 }

lib/fileset/tests.sh

@@ -43,17 +43,29 @@ crudeUnquoteJSON() {
     cut -d \" -f2
 }
 
-prefixExpression='
-  let
-    lib = import <nixpkgs/lib>;
-    internal = import <nixpkgs/lib/fileset/internal.nix> {
-      inherit lib;
-    };
-  in
-  with lib;
-  with internal;
-  with lib.fileset;
-'
+prefixExpression() {
+    echo 'let
+      lib =
+        (import <nixpkgs/lib>)
+    '
+    if [[ "${1:-}" == "--simulate-pure-eval" ]]; then
+        echo '
+        .extend (final: prev: {
+          trivial = prev.trivial // {
+            inPureEvalMode = true;
+          };
+        })'
+    fi
+    echo '
+      ;
+      internal = import <nixpkgs/lib/fileset/internal.nix> {
+        inherit lib;
+      };
+    in
+    with lib;
+    with internal;
+    with lib.fileset;'
+}
 
 # Check that two nix expression successfully evaluate to the same value.
 # The expressions have `lib.fileset` in scope.
@@ -62,7 +74,7 @@ expectEqual() {
     local actualExpr=$1
     local expectedExpr=$2
     if actualResult=$(nix-instantiate --eval --strict --show-trace 2>"$tmp"/actualStderr \
-        --expr "$prefixExpression ($actualExpr)"); then
+        --expr "$(prefixExpression) ($actualExpr)"); then
         actualExitCode=$?
     else
         actualExitCode=$?
@@ -70,7 +82,7 @@ expectEqual() {
     actualStderr=$(< "$tmp"/actualStderr)
 
     if expectedResult=$(nix-instantiate --eval --strict --show-trace 2>"$tmp"/expectedStderr \
-        --expr "$prefixExpression ($expectedExpr)"); then
+        --expr "$(prefixExpression) ($expectedExpr)"); then
         expectedExitCode=$?
     else
         expectedExitCode=$?
@@ -98,7 +110,7 @@ expectEqual() {
 expectStorePath() {
     local expr=$1
     if ! result=$(nix-instantiate --eval --strict --json --read-write-mode --show-trace 2>"$tmp"/stderr \
-        --expr "$prefixExpression ($expr)"); then
+        --expr "$(prefixExpression) ($expr)"); then
         cat "$tmp/stderr" >&2
         die "$expr failed to evaluate, but it was expected to succeed"
     fi
@@ -111,10 +123,16 @@ expectStorePath() {
 # The expression has `lib.fileset` in scope.
 # Usage: expectFailure NIX REGEX
 expectFailure() {
+    if [[ "$1" == "--simulate-pure-eval" ]]; then
+        maybePure="--simulate-pure-eval"
+        shift
+    else
+        maybePure=""
+    fi
     local expr=$1
     local expectedErrorRegex=$2
     if result=$(nix-instantiate --eval --strict --read-write-mode --show-trace 2>"$tmp/stderr" \
-        --expr "$prefixExpression $expr"); then
+        --expr "$(prefixExpression $maybePure) $expr"); then
         die "$expr evaluated successfully to $result, but it was expected to fail"
     fi
     stderr=$(<"$tmp/stderr")
@@ -131,12 +149,12 @@ expectTrace() {
     local expectedTrace=$2
 
     nix-instantiate --eval --show-trace >/dev/null 2>"$tmp"/stderrTrace \
-        --expr "$prefixExpression trace ($expr)" || true
+        --expr "$(prefixExpression) trace ($expr)" || true
 
     actualTrace=$(sed -n 's/^trace: //p' "$tmp/stderrTrace")
 
     nix-instantiate --eval --show-trace >/dev/null 2>"$tmp"/stderrTraceVal \
-        --expr "$prefixExpression traceVal ($expr)" || true
+        --expr "$(prefixExpression) traceVal ($expr)" || true
 
     actualTraceVal=$(sed -n 's/^trace: //p' "$tmp/stderrTraceVal")
 
@@ -1299,12 +1317,6 @@ rm -rf -- *
 expectFailure 'gitTracked null' 'lib.fileset.gitTracked: Expected the argument to be a path, but it'\''s a null instead.'
 expectFailure 'gitTrackedWith {} null' 'lib.fileset.gitTrackedWith: Expected the second argument to be a path, but it'\''s a null instead.'
 
-# The path must be a directory
-touch a
-expectFailure 'gitTracked ./a' 'lib.fileset.gitTracked: Expected the argument \('"$work"'/a\) to be a directory, but it'\''s a file instead'
-expectFailure 'gitTrackedWith {} ./a' 'lib.fileset.gitTrackedWith: Expected the second argument \('"$work"'/a\) to be a directory, but it'\''s a file instead'
-rm -rf -- *
-
 # The path has to contain a .git directory
 expectFailure 'gitTracked ./.' 'lib.fileset.gitTracked: Expected the argument \('"$work"'\) to point to a local working tree of a Git repository, but it'\''s not.'
 expectFailure 'gitTrackedWith {} ./.' 'lib.fileset.gitTrackedWith: Expected the second argument \('"$work"'\) to point to a local working tree of a Git repository, but it'\''s not.'
@@ -1313,7 +1325,7 @@ expectFailure 'gitTrackedWith {} ./.' 'lib.fileset.gitTrackedWith: Expected the
 expectFailure 'gitTrackedWith { recurseSubmodules = null; } ./.' 'lib.fileset.gitTrackedWith: Expected the attribute `recurseSubmodules` of the first argument to be a boolean, but it'\''s a null instead.'
 
 # recurseSubmodules = true is not supported on all Nix versions
-if [[ "$(nix-instantiate --eval --expr "$prefixExpression (versionAtLeast builtins.nixVersion _fetchGitSubmodulesMinver)")" == true ]]; then
+if [[ "$(nix-instantiate --eval --expr "$(prefixExpression) (versionAtLeast builtins.nixVersion _fetchGitSubmodulesMinver)")" == true ]]; then
     fetchGitSupportsSubmodules=1
 else
     fetchGitSupportsSubmodules=
@@ -1383,60 +1395,10 @@ createGitRepo() {
     git -C "$1" commit -q --allow-empty -m "Empty commit"
 }
 
-# Check that gitTracked[With] works as expected when evaluated out-of-tree
-
-## First we create a git repositories (and a subrepository) with `default.nix` files referring to their local paths
-## Simulating how it would be used in the wild
+# Check the error message for pure eval mode
 createGitRepo .
-echo '{ fs }: fs.toSource { root = ./.; fileset = fs.gitTracked ./.; }' > default.nix
-git add .
-
-## We can evaluate it locally just fine, `fetchGit` is used underneath to filter git-tracked files
-expectEqual '(import ./. { fs = lib.fileset; }).outPath' '(builtins.fetchGit ./.).outPath'
-
-## We can also evaluate when importing from fetched store paths
-storePath=$(expectStorePath 'builtins.fetchGit ./.')
-expectEqual '(import '"$storePath"' { fs = lib.fileset; }).outPath' \""$storePath"\"
-
-## But it fails if the path is imported with a fetcher that doesn't remove .git (like just using "${./.}")
-expectFailure 'import "${./.}" { fs = lib.fileset; }' 'lib.fileset.gitTracked: The argument \(.*\) is a store path within a working tree of a Git repository.
-\s*This indicates that a source directory was imported into the store using a method such as `import "\$\{./.\}"` or `path:.`.
-\s*This function currently does not support such a use case, since it currently relies on `builtins.fetchGit`.
-\s*You could make this work by using a fetcher such as `fetchGit` instead of copying the whole repository.
-\s*If you can'\''t avoid copying the repo to the store, see https://github.com/NixOS/nix/issues/9292.'
-
-## Even with submodules
-if [[ -n "$fetchGitSupportsSubmodules" ]]; then
-    ## Both the main repo with the submodule
-    echo '{ fs }: fs.toSource { root = ./.; fileset = fs.gitTrackedWith { recurseSubmodules = true; } ./.; }' > default.nix
-    createGitRepo sub
-    git submodule add ./sub sub >/dev/null
-    ## But also the submodule itself
-    echo '{ fs }: fs.toSource { root = ./.; fileset = fs.gitTracked ./.; }' > sub/default.nix
-    git -C sub add .
-
-    ## We can evaluate it locally just fine, `fetchGit` is used underneath to filter git-tracked files
-    expectEqual '(import ./. { fs = lib.fileset; }).outPath' '(builtins.fetchGit { url = ./.; submodules = true; }).outPath'
-    expectEqual '(import ./sub { fs = lib.fileset; }).outPath' '(builtins.fetchGit ./sub).outPath'
-
-    ## We can also evaluate when importing from fetched store paths
-    storePathWithSub=$(expectStorePath 'builtins.fetchGit { url = ./.; submodules = true; }')
-    expectEqual '(import '"$storePathWithSub"' { fs = lib.fileset; }).outPath' \""$storePathWithSub"\"
-    storePathSub=$(expectStorePath 'builtins.fetchGit ./sub')
-    expectEqual '(import '"$storePathSub"' { fs = lib.fileset; }).outPath' \""$storePathSub"\"
-
-    ## But it fails if the path is imported with a fetcher that doesn't remove .git (like just using "${./.}")
-    expectFailure 'import "${./.}" { fs = lib.fileset; }' 'lib.fileset.gitTrackedWith: The second argument \(.*\) is a store path within a working tree of a Git repository.
-    \s*This indicates that a source directory was imported into the store using a method such as `import "\$\{./.\}"` or `path:.`.
-    \s*This function currently does not support such a use case, since it currently relies on `builtins.fetchGit`.
-    \s*You could make this work by using a fetcher such as `fetchGit` instead of copying the whole repository.
-    \s*If you can'\''t avoid copying the repo to the store, see https://github.com/NixOS/nix/issues/9292.'
-    expectFailure 'import "${./.}/sub" { fs = lib.fileset; }' 'lib.fileset.gitTracked: The argument \(.*/sub\) is a store path within a working tree of a Git repository.
-    \s*This indicates that a source directory was imported into the store using a method such as `import "\$\{./.\}"` or `path:.`.
-    \s*This function currently does not support such a use case, since it currently relies on `builtins.fetchGit`.
-    \s*You could make this work by using a fetcher such as `fetchGit` instead of copying the whole repository.
-    \s*If you can'\''t avoid copying the repo to the store, see https://github.com/NixOS/nix/issues/9292.'
-fi
+expectFailure --simulate-pure-eval 'toSource { root = ./.; fileset = gitTracked ./.; }' 'lib.fileset.gitTracked: This function is currently not supported in pure evaluation mode, since it currently relies on `builtins.fetchGit`. See https://github.com/NixOS/nix/issues/9292.'
+expectFailure --simulate-pure-eval 'toSource { root = ./.; fileset = gitTrackedWith {} ./.; }' 'lib.fileset.gitTrackedWith: This function is currently not supported in pure evaluation mode, since it currently relies on `builtins.fetchGit`. See https://github.com/NixOS/nix/issues/9292.'
 rm -rf -- *
 
 # Go through all stages of Git files

lib/filesystem.nix

@@ -9,22 +9,11 @@ let
   inherit (builtins)
     readDir
     pathExists
-    toString
-    ;
-
-  inherit (lib.attrsets)
-    mapAttrs'
-    filterAttrs
     ;
 
   inherit (lib.filesystem)
     pathType
     ;
-
-  inherit (lib.strings)
-    hasSuffix
-    removeSuffix
-    ;
 in
 
 {
@@ -165,147 +154,4 @@ in
       dir + "/${name}"
   ) (builtins.readDir dir));
 
-  /*
-    Transform a directory tree containing package files suitable for
-    `callPackage` into a matching nested attribute set of derivations.
-
-    For a directory tree like this:
-
-    ```
-    my-packages
-    ├── a.nix
-    ├── b.nix
-    ├── c
-    │  ├── my-extra-feature.patch
-    │  ├── package.nix
-    │  └── support-definitions.nix
-    └── my-namespace
-       ├── d.nix
-       ├── e.nix
-       └── f
-          └── package.nix
-    ```
-
-    `packagesFromDirectoryRecursive` will produce an attribute set like this:
-
-    ```nix
-    # packagesFromDirectoryRecursive {
-    #   callPackage = pkgs.callPackage;
-    #   directory = ./my-packages;
-    # }
-    {
-      a = pkgs.callPackage ./my-packages/a.nix { };
-      b = pkgs.callPackage ./my-packages/b.nix { };
-      c = pkgs.callPackage ./my-packages/c/package.nix { };
-      my-namespace = {
-        d = pkgs.callPackage ./my-packages/my-namespace/d.nix { };
-        e = pkgs.callPackage ./my-packages/my-namespace/e.nix { };
-        f = pkgs.callPackage ./my-packages/my-namespace/f/package.nix { };
-      };
-    }
-    ```
-
-    In particular:
-    - If the input directory contains a `package.nix` file, then
-      `callPackage <directory>/package.nix { }` is returned.
-    - Otherwise, the input directory's contents are listed and transformed into
-      an attribute set.
-      - If a file name has the `.nix` extension, it is turned into attribute
-        where:
-        - The attribute name is the file name without the `.nix` extension
-        - The attribute value is `callPackage <file path> { }`
-      - Other files are ignored.
-      - Directories are turned into an attribute where:
-        - The attribute name is the name of the directory
-        - The attribute value is the result of calling
-          `packagesFromDirectoryRecursive { ... }` on the directory.
-
-        As a result, directories with no `.nix` files (including empty
-        directories) will be transformed into empty attribute sets.
-
-    Example:
-      packagesFromDirectoryRecursive {
-        inherit (pkgs) callPackage;
-        directory = ./my-packages;
-      }
-      => { ... }
-
-      lib.makeScope pkgs.newScope (
-        self: packagesFromDirectoryRecursive {
-          callPackage = self.callPackage;
-          directory = ./my-packages;
-        }
-      )
-      => { ... }
-
-    Type:
-      packagesFromDirectoryRecursive :: AttrSet -> AttrSet
-  */
-  packagesFromDirectoryRecursive =
-    # Options.
-    {
-      /*
-        `pkgs.callPackage`
-
-        Type:
-          Path -> AttrSet -> a
-      */
-      callPackage,
-      /*
-        The directory to read package files from
-
-        Type:
-          Path
-      */
-      directory,
-      ...
-    }:
-    let
-      # Determine if a directory entry from `readDir` indicates a package or
-      # directory of packages.
-      directoryEntryIsPackage = basename: type:
-        type == "directory" || hasSuffix ".nix" basename;
-
-      # List directory entries that indicate packages in the given `path`.
-      packageDirectoryEntries = path:
-        filterAttrs directoryEntryIsPackage (readDir path);
-
-      # Transform a directory entry (a `basename` and `type` pair) into a
-      # package.
-      directoryEntryToAttrPair = subdirectory: basename: type:
-        let
-          path = subdirectory + "/${basename}";
-        in
-        if type == "regular"
-        then
-        {
-          name = removeSuffix ".nix" basename;
-          value = callPackage path { };
-        }
-        else
-        if type == "directory"
-        then
-        {
-          name = basename;
-          value = packagesFromDirectory path;
-        }
-        else
-        throw
-          ''
-            lib.filesystem.packagesFromDirectoryRecursive: Unsupported file type ${type} at path ${toString subdirectory}
-          '';
-
-      # Transform a directory into a package (if there's a `package.nix`) or
-      # set of packages (otherwise).
-      packagesFromDirectory = path:
-        let
-          defaultPackagePath = path + "/package.nix";
-        in
-        if pathExists defaultPackagePath
-        then callPackage defaultPackagePath { }
-        else mapAttrs'
-          (directoryEntryToAttrPair path)
-          (packageDirectoryEntries path);
-    in
-    packagesFromDirectory directory;
 }

lib/fixed-points.nix

@@ -103,155 +103,42 @@ rec {
       else converge f x';
 
   /*
-    Extend a function using an overlay.
-
-    Overlays allow modifying and extending fixed-point functions, specifically ones returning attribute sets.
-    A fixed-point function is a function which is intended to be evaluated by passing the result of itself as the argument.
-    This is possible due to Nix's lazy evaluation.
-
-
-    A fixed-point function returning an attribute set has the form
+    Modify the contents of an explicitly recursive attribute set in a way that
+    honors `self`-references. This is accomplished with a function
 
     ```nix
-    final: { # attributes }
+    g = self: super: { foo = super.foo + " + "; }
     ```
 
-    where `final` refers to the lazily evaluated attribute set returned by the fixed-point function.
+    that has access to the unmodified input (`super`) as well as the final
+    non-recursive representation of the attribute set (`self`). `extends`
+    differs from the native `//` operator insofar as that it's applied *before*
+    references to `self` are resolved:
 
-    An overlay to such a fixed-point function has the form
-
-    ```nix
-    final: prev: { # attributes }
+    ```
+    nix-repl> fix (extends g f)
+    { bar = "bar"; foo = "foo + "; foobar = "foo + bar"; }
     ```
 
-    where `prev` refers to the result of the original function to `final`, and `final` is the result of the composition of the overlay and the original function.
+    The name of the function is inspired by object-oriented inheritance, i.e.
+    think of it as an infix operator `g extends f` that mimics the syntax from
+    Java. It may seem counter-intuitive to have the "base class" as the second
+    argument, but it's nice this way if several uses of `extends` are cascaded.
 
-    Applying an overlay is done with `extends`:
+    To get a better understanding how `extends` turns a function with a fix
+    point (the package set we start with) into a new function with a different fix
+    point (the desired packages set) lets just see, how `extends g f`
+    unfolds with `g` and `f` defined above:
 
-    ```nix
-    let
-      f = final: { # attributes };
-      overlay = final: prev: { # attributes };
-    in extends overlay f;
     ```
-
-    To get the value of `final`, use `lib.fix`:
-
-    ```nix
-    let
-      f = final: { # attributes };
-      overlay = final: prev: { # attributes };
-      g = extends overlay f;
-    in fix g
+    extends g f = self: let super = f self; in super // g self super;
+                = self: let super = { foo = "foo"; bar = "bar"; foobar = self.foo + self.bar; }; in super // g self super
+                = self: { foo = "foo"; bar = "bar"; foobar = self.foo + self.bar; } // g self { foo = "foo"; bar = "bar"; foobar = self.foo + self.bar; }
+                = self: { foo = "foo"; bar = "bar"; foobar = self.foo + self.bar; } // { foo = "foo" + " + "; }
+                = self: { foo = "foo + "; bar = "bar"; foobar = self.foo + self.bar; }
     ```
-
-    :::{.example}
-
-    # Extend a fixed-point function with an overlay
-
-    Define a fixed-point function `f` that expects its own output as the argument `final`:
-
-    ```nix-repl
-    f = final: {
-      # Constant value a
-      a = 1;
-
-      # b depends on the final value of a, available as final.a
-      b = final.a + 2;
-    }
-    ```
-
-    Evaluate this using [`lib.fix`](#function-library-lib.fixedPoints.fix) to get the final result:
-
-    ```nix-repl
-    fix f
-    => { a = 1; b = 3; }
-    ```
-
-    An overlay represents a modification or extension of such a fixed-point function.
-    Here's an example of an overlay:
-
-    ```nix-repl
-    overlay = final: prev: {
-      # Modify the previous value of a, available as prev.a
-      a = prev.a + 10;
-
-      # Extend the attribute set with c, letting it depend on the final values of a and b
-      c = final.a + final.b;
-    }
-    ```
-
-    Use `extends overlay f` to apply the overlay to the fixed-point function `f`.
-    This produces a new fixed-point function `g` with the combined behavior of `f` and `overlay`:
-
-    ```nix-repl
-    g = extends overlay f
-    ```
-
-    The result is a function, so we can't print it directly, but it's the same as:
-
-    ```nix-repl
-    g' = final: {
-      # The constant from f, but changed with the overlay
-      a = 1 + 10;
-
-      # Unchanged from f
-      b = final.a + 2;
-
-      # Extended in the overlay
-      c = final.a + final.b;
-    }
-    ```
-
-    Evaluate this using [`lib.fix`](#function-library-lib.fixedPoints.fix) again to get the final result:
-
-    ```nix-repl
-    fix g
-    => { a = 11; b = 13; c = 24; }
-    ```
-    :::
-
-    Type:
-      extends :: (Attrs -> Attrs -> Attrs) # The overlay to apply to the fixed-point function
-              -> (Attrs -> Attrs) # A fixed-point function
-              -> (Attrs -> Attrs) # The resulting fixed-point function
-
-    Example:
-      f = final: { a = 1; b = final.a + 2; }
-
-      fix f
-      => { a = 1; b = 3; }
-
-      fix (extends (final: prev: { a = prev.a + 10; }) f)
-      => { a = 11; b = 13; }
-
-      fix (extends (final: prev: { b = final.a + 5; }) f)
-      => { a = 1; b = 6; }
-
-      fix (extends (final: prev: { c = final.a + final.b; }) f)
-      => { a = 1; b = 3; c = 4; }
-
-    :::{.note}
-    The argument to the given fixed-point function after applying an overlay will *not* refer to its own return value, but rather to the value after evaluating the overlay function.
-
-    The given fixed-point function is called with a separate argument than if it was evaluated with `lib.fix`.
-    The new argument
-    :::
   */
-  extends =
-    # The overlay to apply to the fixed-point function
-    overlay:
-    # The fixed-point function
-    f:
-    # Wrap with parenthesis to prevent nixdoc from rendering the `final` argument in the documentation
-    # The result should be thought of as a function, the argument of that function is not an argument to `extends` itself
-    (
-      final:
-      let
-        prev = f final;
-      in
-      prev // overlay final prev
-    );
+  extends = f: rattrs: self: let super = rattrs self; in super // f self super;
 
   /*
     Compose two extending functions of the type expected by 'extends'

lib/flake-version-info.nix

@@ -1,20 +0,0 @@
-# This function produces a lib overlay to be used by the nixpkgs
-# & nixpkgs/lib flakes to provide meaningful values for
-# `lib.trivial.version` et al..
-#
-# Internal and subject to change, don't use this anywhere else!
-# Instead, consider using a public interface, such as this flake here
-# in this directory, `lib/`, or use the nixpkgs flake, which applies
-# this logic for you in its `lib` output attribute.
-
-self: # from the flake
-
-finalLib: prevLib: # lib overlay
-
-{
-  trivial = prevLib.trivial // {
-    versionSuffix =
-      ".${finalLib.substring 0 8 (self.lastModifiedDate or "19700101")}.${self.shortRev or "dirty"}";
-    revisionWithDefault = default: self.rev or default;
-  };
-}

lib/flake.nix

@@ -1,10 +1,5 @@
 {
   description = "Library of low-level helper functions for nix expressions.";
 
-  outputs = { self }:
-    let
-      lib0 = import ./.;
-    in {
-      lib = lib0.extend (import ./flake-version-info.nix self);
-    };
+  outputs = { self }: { lib = import ./.; };
 }

lib/generators.nix

@@ -525,8 +525,6 @@ ${expr "" v}
           "(${v.expr})"
         else if v == { } then
           "{}"
-        else if libAttr.isDerivation v then
-          ''"${toString v}"''
         else
           "{${introSpace}${concatItems (
             lib.attrsets.mapAttrsToList (key: value: "[${builtins.toJSON key}] = ${toLua innerArgs value}") v

lib/licenses.nix

@@ -38,13 +38,6 @@ in mkLicense lset) ({
     redistributable = false;
   };
 
-  activision = {
-    # https://doomwiki.org/wiki/Raven_source_code_licensing
-    fullName = "Activision EULA";
-    url = "https://www.doomworld.com/eternity/activision_eula.txt";
-    free = false;
-  };
-
   afl20 = {
     spdxId = "AFL-2.0";
     fullName = "Academic Free License v2.0";
@@ -104,7 +97,6 @@ in mkLicense lset) ({
   };
 
   arphicpl = {
-    spdxId = "Arphic-1999";
     fullName = "Arphic Public License";
     url = "https://www.freedesktop.org/wiki/Arphic_Public_License/";
   };
@@ -237,7 +229,6 @@ in mkLicense lset) ({
   };
 
   cal10 = {
-    spdxId = "CAL-1.0";
     fullName = "Cryptographic Autonomy License version 1.0 (CAL-1.0)";
     url = "https://opensource.org/licenses/CAL-1.0";
   };
@@ -431,7 +422,6 @@ in mkLicense lset) ({
   };
 
   elastic20 = {
-    spdxId = "Elastic-2.0";
     fullName = "Elastic License 2.0";
     url = "https://github.com/elastic/elasticsearch/blob/main/licenses/ELASTIC-LICENSE-2.0.txt";
     free = false;
@@ -601,7 +591,6 @@ in mkLicense lset) ({
 
   # Intel's license, seems free
   iasl = {
-    spdxId = "Intel-ACPI";
     fullName = "iASL";
     url = "https://old.calculate-linux.org/packages/licenses/iASL";
   };
@@ -613,7 +602,7 @@ in mkLicense lset) ({
 
   imagemagick = {
     fullName = "ImageMagick License";
-    spdxId = "ImageMagick";
+    spdxId = "imagemagick";
   };
 
   imlib2 = {
@@ -807,7 +796,6 @@ in mkLicense lset) ({
   };
 
   miros = {
-    spdxId = "MirOS";
     fullName = "MirOS License";
     url = "https://opensource.org/licenses/MirOS";
   };
@@ -1073,12 +1061,6 @@ in mkLicense lset) ({
     url = "https://github.com/thestk/stk/blob/master/LICENSE";
   };
 
-  sudo = {
-    shortName = "sudo";
-    fullName = "Sudo License (ISC-style)";
-    url = "https://www.sudo.ws/about/license/";
-  };
-
   sustainableUse = {
     shortName = "sustainable";
     fullName = "Sustainable Use License";
@@ -1143,7 +1125,6 @@ in mkLicense lset) ({
   };
 
   upl = {
-    spdxId = "UPL-1.0";
     fullName = "Universal Permissive License";
     url = "https://oss.oracle.com/licenses/upl/";
   };
@@ -1200,7 +1181,6 @@ in mkLicense lset) ({
   };
 
   xfig = {
-    spdxId = "Xfig";
     fullName = "xfig";
     url = "https://mcj.sourceforge.net/authors.html#xfig";
   };

lib/lists.nix

@@ -4,7 +4,6 @@ let
   inherit (lib.strings) toInt;
   inherit (lib.trivial) compare min id;
   inherit (lib.attrsets) mapAttrs;
-  inherit (lib.lists) sort;
 in
 rec {
 
@@ -592,15 +591,9 @@ rec {
      the second argument.  The returned list is sorted in an increasing
      order.  The implementation does a quick-sort.
 
-     See also [`sortOn`](#function-library-lib.lists.sortOn), which applies the
-     default comparison on a function-derived property, and may be more efficient.
-
      Example:
-       sort (p: q: p < q) [ 5 3 7 ]
+       sort (a: b: a < b) [ 5 3 7 ]
        => [ 3 5 7 ]
-
-     Type:
-       sort :: (a -> a -> Bool) -> [a] -> [a]
   */
   sort = builtins.sort or (
     strictLess: list:
@@ -619,42 +612,6 @@ rec {
       if len < 2 then list
       else (sort strictLess pivot.left) ++  [ first ] ++  (sort strictLess pivot.right));
 
-  /*
-    Sort a list based on the default comparison of a derived property `b`.
-
-    The items are returned in `b`-increasing order.
-
-    **Performance**:
-
-    The passed function `f` is only evaluated once per item,
-    unlike an unprepared [`sort`](#function-library-lib.lists.sort) using
-    `f p < f q`.
-
-    **Laws**:
-    ```nix
-    sortOn f == sort (p: q: f p < f q)
-    ```
-
-    Example:
-      sortOn stringLength [ "aa" "b" "cccc" ]
-      => [ "b" "aa" "cccc" ]
-
-    Type:
-      sortOn :: (a -> b) -> [a] -> [a], for comparable b
-  */
-  sortOn = f: list:
-    let
-      # Heterogenous list as pair may be ugly, but requires minimal allocations.
-      pairs = map (x: [(f x) x]) list;
-    in
-      map
-        (x: builtins.elemAt x 1)
-        (sort
-          # Compare the first element of the pairs
-          # Do not factor out the `<`, to avoid calls in hot code; duplicate instead.
-          (a: b: head a < head b)
-          pairs);
-
   /* Compare two lists element-by-element.
 
      Example:

lib/meta.nix

@@ -4,8 +4,8 @@
 { lib }:
 
 let
-  inherit (lib) matchAttrs any all isDerivation getBin assertMsg;
-  inherit (builtins) isString match typeOf;
+  inherit (lib) matchAttrs any all;
+  inherit (builtins) isString;
 
 in
 rec {
@@ -154,12 +154,16 @@ rec {
        getExe pkgs.mustache-go
        => "/nix/store/am9ml4f4ywvivxnkiaqwr0hyxka1xjsf-mustache-go-1.3.0/bin/mustache"
   */
-  getExe = x: getExe' x (x.meta.mainProgram or (
-    # This could be turned into an error when 23.05 is at end of life
-    lib.warn "getExe: Package ${lib.strings.escapeNixIdentifier x.meta.name or x.pname or x.name} does not have the meta.mainProgram attribute. We'll assume that the main program has the same name for now, but this behavior is deprecated, because it leads to surprising errors when the assumption does not hold. If the package has a main program, please set `meta.mainProgram` in its definition to make this warning go away. Otherwise, if the package does not have a main program, or if you don't control its definition, use getExe' to specify the name to the program, such as lib.getExe' foo \"bar\"."
-    lib.getName
-    x
-  ));
+  getExe = x:
+    let
+      y = x.meta.mainProgram or (
+        # This could be turned into an error when 23.05 is at end of life
+        lib.warn "getExe: Package ${lib.strings.escapeNixIdentifier x.meta.name or x.pname or x.name} does not have the meta.mainProgram attribute. We'll assume that the main program has the same name for now, but this behavior is deprecated, because it leads to surprising errors when the assumption does not hold. If the package has a main program, please set `meta.mainProgram` in its definition to make this warning go away. Otherwise, if the package does not have a main program, or if you don't control its definition, use getExe' to specify the name to the program, such as lib.getExe' foo \"bar\"."
+          lib.getName
+          x
+      );
+    in
+    getExe' x y;
 
   /* Get the path of a program of a derivation.
 
@@ -171,11 +175,11 @@ rec {
        => "/nix/store/5rs48jamq7k6sal98ymj9l4k2bnwq515-imagemagick-7.1.1-15/bin/convert"
   */
   getExe' = x: y:
-    assert assertMsg (isDerivation x)
-      "lib.meta.getExe': The first argument is of type ${typeOf x}, but it should be a derivation instead.";
-    assert assertMsg (isString y)
-      "lib.meta.getExe': The second argument is of type ${typeOf y}, but it should be a string instead.";
-    assert assertMsg (match ".*\/.*" y == null)
-      "lib.meta.getExe': The second argument \"${y}\" is a nested path with a \"/\" character, but it should just be the name of the executable instead.";
-    "${getBin x}/bin/${y}";
+    assert lib.assertMsg (lib.isDerivation x)
+      "lib.meta.getExe': The first argument is of type ${builtins.typeOf x}, but it should be a derivation instead.";
+    assert lib.assertMsg (lib.isString y)
+     "lib.meta.getExe': The second argument is of type ${builtins.typeOf y}, but it should be a string instead.";
+    assert lib.assertMsg (builtins.length (lib.splitString "/" y) == 1)
+     "lib.meta.getExe': The second argument \"${y}\" is a nested path with a \"/\" character, but it should just be the name of the executable instead.";
+    "${lib.getBin x}/bin/${y}";
 }

lib/modules.nix

@@ -275,8 +275,6 @@ let
                 "The option `${optText}' does not exist. Definition values:${defText}";
           in
             if attrNames options == [ "_module" ]
-              # No options were declared at all (`_module` is built in)
-              # but we do have unmatched definitions, and no freeformType (earlier conditions)
               then
                 let
                   optionName = showOption prefix;

lib/path/default.nix

@@ -9,7 +9,6 @@ let
     split
     match
     typeOf
-    storeDir
     ;
 
   inherit (lib.lists)
@@ -25,8 +24,6 @@ let
     drop
     ;
 
-  listHasPrefix = lib.lists.hasPrefix;
-
   inherit (lib.strings)
     concatStringsSep
     substring
@@ -123,28 +120,6 @@ let
         else recurse ([ (baseNameOf base) ] ++ components) (dirOf base);
     in recurse [];
 
-  # The components of the store directory, typically [ "nix" "store" ]
-  storeDirComponents = splitRelPath ("./" + storeDir);
-  # The number of store directory components, typically 2
-  storeDirLength = length storeDirComponents;
-
-  # Type: [ String ] -> Bool
-  #
-  # Whether path components have a store path as a prefix, according to
-  # https://nixos.org/manual/nix/stable/store/store-path.html#store-path.
-  componentsHaveStorePathPrefix = components:
-    # path starts with the store directory (typically /nix/store)
-    listHasPrefix storeDirComponents components
-    # is not the store directory itself, meaning there's at least one extra component
-    && storeDirComponents != components
-    # and the first component after the store directory has the expected format.
-    # NOTE: We could change the hash regex to be [0-9a-df-np-sv-z],
-    # because these are the actual ASCII characters used by Nix's base32 implementation,
-    # but this is not fully specified, so let's tie this too much to the currently implemented concept of store paths.
-    # Similar reasoning applies to the validity of the name part.
-    # We care more about discerning store path-ness on realistic values. Making it airtight would be fragile and slow.
-    && match ".{32}-.+" (elemAt components storeDirLength) != null;
-
 in /* No rec! Add dependencies on this file at the top. */ {
 
   /*
@@ -346,62 +321,6 @@ in /* No rec! Add dependencies on this file at the top. */ {
       subpath = joinRelPath deconstructed.components;
     };
 
-  /*
-    Whether a [path](https://nixos.org/manual/nix/stable/language/values.html#type-path)
-    has a [store path](https://nixos.org/manual/nix/stable/store/store-path.html#store-path)
-    as a prefix.
-
-    :::{.note}
-    As with all functions of this `lib.path` library, it does not work on paths in strings,
-    which is how you'd typically get store paths.
-
-    Instead, this function only handles path values themselves,
-    which occur when Nix files in the store use relative path expressions.
-    :::
-
-    Type:
-      hasStorePathPrefix :: Path -> Bool
-
-    Example:
-      # Subpaths of derivation outputs have a store path as a prefix
-      hasStorePathPrefix /nix/store/nvl9ic0pj1fpyln3zaqrf4cclbqdfn1j-foo/bar/baz
-      => true
-
-      # The store directory itself is not a store path
-      hasStorePathPrefix /nix/store
-      => false
-
-      # Derivation outputs are store paths themselves
-      hasStorePathPrefix /nix/store/nvl9ic0pj1fpyln3zaqrf4cclbqdfn1j-foo
-      => true
-
-      # Paths outside the Nix store don't have a store path prefix
-      hasStorePathPrefix /home/user
-      => false
-
-      # Not all paths under the Nix store are store paths
-      hasStorePathPrefix /nix/store/.links/10gg8k3rmbw8p7gszarbk7qyd9jwxhcfq9i6s5i0qikx8alkk4hq
-      => false
-
-      # Store derivations are also store paths themselves
-      hasStorePathPrefix /nix/store/nvl9ic0pj1fpyln3zaqrf4cclbqdfn1j-foo.drv
-      => true
-  */
-  hasStorePathPrefix = path:
-    let
-      deconstructed = deconstructPath path;
-    in
-    assert assertMsg
-      (isPath path)
-      "lib.path.hasStorePathPrefix: Argument is of type ${typeOf path}, but a path was expected";
-    assert assertMsg
-      # This function likely breaks or needs adjustment if used with other filesystem roots, if they ever get implemented.
-      # Let's try to error nicely in such a case, though it's unclear how an implementation would work even and whether this could be detected.
-      # See also https://github.com/NixOS/nix/pull/6530#discussion_r1422843117
-      (deconstructed.root == /. && toString deconstructed.root == "/")
-      "lib.path.hasStorePathPrefix: Argument has a filesystem root (${toString deconstructed.root}) that's not /, which is currently not supported.";
-    componentsHaveStorePathPrefix deconstructed.components;
-
   /*
     Whether a value is a valid subpath string.
 

lib/path/tests/unit.nix

@@ -3,10 +3,7 @@
 { libpath }:
 let
   lib = import libpath;
-  inherit (lib.path) hasPrefix removePrefix append splitRoot hasStorePathPrefix subpath;
-
-  # This is not allowed generally, but we're in the tests here, so we'll allow ourselves.
-  storeDirPath = /. + builtins.storeDir;
+  inherit (lib.path) hasPrefix removePrefix append splitRoot subpath;
 
   cases = lib.runTests {
     # Test examples from the lib.path.append documentation
@@ -94,31 +91,6 @@ let
       expected = false;
     };
 
-    testHasStorePathPrefixExample1 = {
-      expr = hasStorePathPrefix (storeDirPath + "/nvl9ic0pj1fpyln3zaqrf4cclbqdfn1j-foo/bar/baz");
-      expected = true;
-    };
-    testHasStorePathPrefixExample2 = {
-      expr = hasStorePathPrefix storeDirPath;
-      expected = false;
-    };
-    testHasStorePathPrefixExample3 = {
-      expr = hasStorePathPrefix (storeDirPath + "/nvl9ic0pj1fpyln3zaqrf4cclbqdfn1j-foo");
-      expected = true;
-    };
-    testHasStorePathPrefixExample4 = {
-      expr = hasStorePathPrefix /home/user;
-      expected = false;
-    };
-    testHasStorePathPrefixExample5 = {
-      expr = hasStorePathPrefix (storeDirPath + "/.links/10gg8k3rmbw8p7gszarbk7qyd9jwxhcfq9i6s5i0qikx8alkk4hq");
-      expected = false;
-    };
-    testHasStorePathPrefixExample6 = {
-      expr = hasStorePathPrefix (storeDirPath + "/nvl9ic0pj1fpyln3zaqrf4cclbqdfn1j-foo.drv");
-      expected = true;
-    };
-
     # Test examples from the lib.path.subpath.isValid documentation
     testSubpathIsValidExample1 = {
       expr = subpath.isValid null;

lib/strings.nix

@@ -715,12 +715,12 @@ rec {
        getName pkgs.youtube-dl
        => "youtube-dl"
   */
-  getName = let
-    parse = drv: (parseDrvName drv).name;
-  in x:
-    if isString x
-    then parse x
-    else x.pname or (parse x.name);
+  getName = x:
+   let
+     parse = drv: (parseDrvName drv).name;
+   in if isString x
+      then parse x
+      else x.pname or (parse x.name);
 
   /* This function takes an argument that's either a derivation or a
      derivation's "name" attribute and extracts the version part from that
@@ -732,12 +732,12 @@ rec {
        getVersion pkgs.youtube-dl
        => "2016.01.01"
   */
-  getVersion = let
-    parse = drv: (parseDrvName drv).version;
-  in x:
-    if isString x
-    then parse x
-    else x.version or (parse x.name);
+  getVersion = x:
+   let
+     parse = drv: (parseDrvName drv).version;
+   in if isString x
+      then parse x
+      else x.version or (parse x.name);
 
   /* Extract name with version from URL. Ask for separator which is
      supposed to start extension.
@@ -771,13 +771,12 @@ rec {
        cmakeOptionType "string" "ENGINE" "sdl2"
        => "-DENGINE:STRING=sdl2"
   */
-  cmakeOptionType = let
-    types = [ "BOOL" "FILEPATH" "PATH" "STRING" "INTERNAL" ];
-  in type: feature: value:
-    assert (elem (toUpper type) types);
-    assert (isString feature);
-    assert (isString value);
-    "-D${feature}:${toUpper type}=${value}";
+  cmakeOptionType = type: feature: value:
+    assert (lib.elem (lib.toUpper type)
+      [ "BOOL" "FILEPATH" "PATH" "STRING" "INTERNAL" ]);
+    assert (lib.isString feature);
+    assert (lib.isString value);
+    "-D${feature}:${lib.toUpper type}=${value}";
 
   /* Create a -D<condition>={TRUE,FALSE} string that can be passed to typical
      CMake invocations.
@@ -978,11 +977,9 @@ rec {
      Many types of value are coercible to string this way, including int, float,
      null, bool, list of similarly coercible values.
   */
-  isConvertibleWithToString = let
-    types = [ "null" "int" "float" "bool" ];
-  in x:
+  isConvertibleWithToString = x:
     isStringLike x ||
-    elem (typeOf x) types ||
+    elem (typeOf x) [ "null" "int" "float" "bool" ] ||
     (isList x && lib.all isConvertibleWithToString x);
 
   /* Check whether a value can be coerced to a string.

lib/systems/default.nix

@@ -89,13 +89,6 @@ rec {
         # is why we use the more obscure "bfd" and not "binutils" for this
         # choice.
         else                                     "bfd";
-      # The standard lib directory name that non-nixpkgs binaries distributed
-      # for this platform normally assume.
-      libDir = if final.isLinux then
-        if final.isx86_64 || final.isMips64 || final.isPower64
-        then "lib64"
-        else "lib"
-      else null;
       extensions = lib.optionalAttrs final.hasSharedLibraries {
         sharedLibrary =
           if      final.isDarwin  then ".dylib"
@@ -331,8 +324,7 @@ rec {
               "riscv64" = "riscv64gc";
             }.${cpu.name} or cpu.name;
             vendor_ = final.rust.platform.vendor;
-          # TODO: deprecate args.rustc in favour of args.rust after 23.05 is EOL.
-          in args.rust.rustcTarget or args.rustc.config
+          in rust.config
             or "${cpu_}-${vendor_}-${kernel.name}${lib.optionalString (abi.name != "unknown") "-${abi.name}"}";
 
           # The name of the rust target if it is standard, or the json file

lib/systems/inspect.nix

@@ -62,8 +62,7 @@ rec {
 
     is32bit        = { cpu = { bits = 32; }; };
     is64bit        = { cpu = { bits = 64; }; };
-    isILP32        = [ { cpu = { family = "wasm"; bits = 32; }; } ] ++
-                     map (a: { abi = { abi = a; }; }) [ "n32" "ilp32" "x32" ];
+    isILP32        = map (a: { abi = { abi = a; }; }) [ "n32" "ilp32" "x32" ];
     isBigEndian    = { cpu = { significantByte = significantBytes.bigEndian; }; };
     isLittleEndian = { cpu = { significantByte = significantBytes.littleEndian; }; };
 
@@ -99,9 +98,6 @@ rec {
       { cpu = { family = "riscv"; }; }
       { cpu = { family = "x86"; }; }
     ];
-
-    isElf          = { kernel.execFormat = execFormats.elf; };
-    isMacho        = { kernel.execFormat = execFormats.macho; };
   };
 
   # given two patterns, return a pattern which is their logical AND.

lib/tests/misc.nix

@@ -650,28 +650,6 @@ runTests {
     expected = [2 30 40 42];
   };
 
-  testSortOn = {
-    expr = sortOn stringLength [ "aa" "b" "cccc" ];
-    expected = [ "b" "aa" "cccc" ];
-  };
-
-  testSortOnEmpty = {
-    expr = sortOn (throw "nope") [ ];
-    expected = [ ];
-  };
-
-  testSortOnIncomparable = {
-    expr =
-      map
-        (x: x.f x.ok)
-        (sortOn (x: x.ok) [
-          { ok = 1; f = x: x; }
-          { ok = 3; f = x: x + 3; }
-          { ok = 2; f = x: x; }
-        ]);
-    expected = [ 1 2 6 ];
-  };
-
   testReplicate = {
     expr = replicate 3 "a";
     expected = ["a" "a" "a"];
@@ -697,51 +675,6 @@ runTests {
     expected = false;
   };
 
-  testHasAttrByPathNonStrict = {
-    expr = hasAttrByPath [] (throw "do not use");
-    expected = true;
-  };
-
-  testLongestValidPathPrefix_empty_empty = {
-    expr = attrsets.longestValidPathPrefix [ ] { };
-    expected = [ ];
-  };
-
-  testLongestValidPathPrefix_empty_nonStrict = {
-    expr = attrsets.longestValidPathPrefix [ ] (throw "do not use");
-    expected = [ ];
-  };
-
-  testLongestValidPathPrefix_zero = {
-    expr = attrsets.longestValidPathPrefix [ "a" (throw "do not use") ] { d = null; };
-    expected = [ ];
-  };
-
-  testLongestValidPathPrefix_zero_b = {
-    expr = attrsets.longestValidPathPrefix [ "z" "z" ] "remarkably harmonious";
-    expected = [ ];
-  };
-
-  testLongestValidPathPrefix_one = {
-    expr = attrsets.longestValidPathPrefix [ "a" "b" "c" ] { a = null; };
-    expected = [ "a" ];
-  };
-
-  testLongestValidPathPrefix_two = {
-    expr = attrsets.longestValidPathPrefix [ "a" "b" "c" ] { a.b = null; };
-    expected = [ "a" "b" ];
-  };
-
-  testLongestValidPathPrefix_three = {
-    expr = attrsets.longestValidPathPrefix [ "a" "b" "c" ] { a.b.c = null; };
-    expected = [ "a" "b" "c" ];
-  };
-
-  testLongestValidPathPrefix_three_extra = {
-    expr = attrsets.longestValidPathPrefix [ "a" "b" "c" ] { a.b.c.d = throw "nope"; };
-    expected = [ "a" "b" "c" ];
-  };
-
   testFindFirstIndexExample1 = {
     expr = lists.findFirstIndex (x: x > 3) (abort "index found, so a default must not be evaluated") [ 1 6 4 ];
     expected = 1;
@@ -898,26 +831,6 @@ runTests {
     };
   };
 
-  testMatchAttrsMatchingExact = {
-    expr = matchAttrs { cpu = { bits = 64; }; } { cpu = { bits = 64; }; };
-    expected = true;
-  };
-
-  testMatchAttrsMismatch = {
-    expr = matchAttrs { cpu = { bits = 128; }; } { cpu = { bits = 64; }; };
-    expected = false;
-  };
-
-  testMatchAttrsMatchingImplicit = {
-    expr = matchAttrs { cpu = { }; } { cpu = { bits = 64; }; };
-    expected = true;
-  };
-
-  testMatchAttrsMissingAttrs = {
-    expr = matchAttrs { cpu = {}; } { };
-    expected = false;
-  };
-
   testOverrideExistingEmpty = {
     expr = overrideExisting {} { a = 1; };
     expected = {};
@@ -1959,18 +1872,6 @@ runTests {
     expr = (with types; int).description;
     expected = "signed integer";
   };
-  testTypeDescriptionIntsPositive = {
-    expr = (with types; ints.positive).description;
-    expected = "positive integer, meaning >0";
-  };
-  testTypeDescriptionIntsPositiveOrEnumAuto = {
-    expr = (with types; either ints.positive (enum ["auto"])).description;
-    expected = ''positive integer, meaning >0, or value "auto" (singular enum)'';
-  };
-  testTypeDescriptionListOfPositive = {
-    expr = (with types; listOf ints.positive).description;
-    expected = "list of (positive integer, meaning >0)";
-  };
   testTypeDescriptionListOfInt = {
     expr = (with types; listOf int).description;
     expected = "list of signed integer";
@@ -2067,37 +1968,4 @@ runTests {
     expr = meta.platformMatch { } "x86_64-linux";
     expected = false;
   };
-
-  testPackagesFromDirectoryRecursive = {
-    expr = packagesFromDirectoryRecursive {
-      callPackage = path: overrides: import path overrides;
-      directory = ./packages-from-directory;
-    };
-    expected = {
-      a = "a";
-      b = "b";
-      # Note: Other files/directories in `./test-data/c/` are ignored and can be
-      # used by `package.nix`.
-      c = "c";
-      my-namespace = {
-        d = "d";
-        e = "e";
-        f = "f";
-        my-sub-namespace = {
-          g = "g";
-          h = "h";
-        };
-      };
-    };
-  };
-
-  # Check that `packagesFromDirectoryRecursive` can process a directory with a
-  # top-level `package.nix` file into a single package.
-  testPackagesFromDirectoryRecursiveTopLevelPackageNix = {
-    expr = packagesFromDirectoryRecursive {
-      callPackage = path: overrides: import path overrides;
-      directory = ./packages-from-directory/c;
-    };
-    expected = "c";
-  };
 }

lib/tests/modules.sh

@@ -24,14 +24,14 @@ evalConfig() {
     local attr=$1
     shift
     local script="import ./default.nix { modules = [ $* ];}"
-    nix-instantiate --timeout 1 -E "$script" -A "$attr" --eval-only --show-trace --read-write-mode --json
+    nix-instantiate --timeout 1 -E "$script" -A "$attr" --eval-only --show-trace --read-write-mode
 }
 
 reportFailure() {
     local attr=$1
     shift
     local script="import ./default.nix { modules = [ $* ];}"
-    echo 2>&1 "$ nix-instantiate -E '$script' -A '$attr' --eval-only --json"
+    echo 2>&1 "$ nix-instantiate -E '$script' -A '$attr' --eval-only"
     evalConfig "$attr" "$@" || true
     ((++fail))
 }
@@ -94,14 +94,6 @@ checkConfigOutput '^true$' config.result ./module-argument-default.nix
 # gvariant
 checkConfigOutput '^true$' config.assertion ./gvariant.nix
 
-# https://github.com/NixOS/nixpkgs/pull/131205
-# We currently throw this error already in `config`, but throwing in `config.wrong1` would be acceptable.
-checkConfigError 'It seems as if you.re trying to declare an option by placing it into .config. rather than .options.' config.wrong1 ./error-mkOption-in-config.nix
-# We currently throw this error already in `config`, but throwing in `config.nest.wrong2` would be acceptable.
-checkConfigError 'It seems as if you.re trying to declare an option by placing it into .config. rather than .options.' config.nest.wrong2 ./error-mkOption-in-config.nix
-checkConfigError 'The option .sub.wrong2. does not exist. Definition values:' config.sub ./error-mkOption-in-submodule-config.nix
-checkConfigError '.*This can happen if you e.g. declared your options in .types.submodule.' config.sub ./error-mkOption-in-submodule-config.nix
-
 # types.pathInStore
 checkConfigOutput '".*/store/0lz9p8xhf89kb1c1kk6jxrzskaiygnlh-bash-5.2-p15.drv"' config.pathInStore.ok1 ./types.nix
 checkConfigOutput '".*/store/0fb3ykw9r5hpayd05sr0cizwadzq1d8q-bash-5.2-p15"' config.pathInStore.ok2 ./types.nix
@@ -119,12 +111,6 @@ checkConfigError 'The option .* does not exist. Definition values:\n\s*- In .*'
 checkConfigError 'while evaluating a definition from `.*/define-enable-abort.nix' config.enable ./define-enable-abort.nix
 checkConfigError 'while evaluating the error message for definitions for .enable., which is an option that does not exist' config.enable ./define-enable-abort.nix
 
-# Check boolByOr type.
-checkConfigOutput '^false$' config.value.falseFalse ./boolByOr.nix
-checkConfigOutput '^true$' config.value.trueFalse ./boolByOr.nix
-checkConfigOutput '^true$' config.value.falseTrue ./boolByOr.nix
-checkConfigOutput '^true$' config.value.trueTrue ./boolByOr.nix
-
 checkConfigOutput '^1$' config.bare-submodule.nested ./declare-bare-submodule.nix ./declare-bare-submodule-nested-option.nix
 checkConfigOutput '^2$' config.bare-submodule.deep ./declare-bare-submodule.nix ./declare-bare-submodule-deep-option.nix
 checkConfigOutput '^42$' config.bare-submodule.nested ./declare-bare-submodule.nix ./declare-bare-submodule-nested-option.nix ./declare-bare-submodule-deep-option.nix ./define-bare-submodule-values.nix
@@ -148,7 +134,7 @@ checkConfigOutput '^42$' config.value ./declare-either.nix ./define-value-int-po
 checkConfigOutput '^"24"$' config.value ./declare-either.nix ./define-value-string.nix
 # types.oneOf
 checkConfigOutput '^42$' config.value ./declare-oneOf.nix ./define-value-int-positive.nix
-checkConfigOutput '^\[\]$' config.value ./declare-oneOf.nix ./define-value-list.nix
+checkConfigOutput '^\[ \]$' config.value ./declare-oneOf.nix ./define-value-list.nix
 checkConfigOutput '^"24"$' config.value ./declare-oneOf.nix ./define-value-string.nix
 
 # Check mkForce without submodules.
@@ -328,7 +314,7 @@ checkConfigOutput '^"24"$' config.value ./freeform-attrsOf.nix ./define-value-st
 # Shorthand modules interpret `meta` and `class` as config items
 checkConfigOutput '^true$' options._module.args.value.result ./freeform-attrsOf.nix ./define-freeform-keywords-shorthand.nix
 # No freeform assignments shouldn't make it error
-checkConfigOutput '^{}$' config ./freeform-attrsOf.nix
+checkConfigOutput '^{ }$' config ./freeform-attrsOf.nix
 # but only if the type matches
 checkConfigError 'A definition for option .* is not of type .*' config.value ./freeform-attrsOf.nix ./define-value-list.nix
 # and properties should be applied
@@ -366,19 +352,19 @@ checkConfigError 'The option .* has conflicting definitions' config.value ./type
 checkConfigOutput '^0$' config.value.int ./types-anything/equal-atoms.nix
 checkConfigOutput '^false$' config.value.bool ./types-anything/equal-atoms.nix
 checkConfigOutput '^""$' config.value.string ./types-anything/equal-atoms.nix
-checkConfigOutput '^"/[^"]+"$' config.value.path ./types-anything/equal-atoms.nix
+checkConfigOutput '^/$' config.value.path ./types-anything/equal-atoms.nix
 checkConfigOutput '^null$' config.value.null ./types-anything/equal-atoms.nix
 checkConfigOutput '^0.1$' config.value.float ./types-anything/equal-atoms.nix
 # Functions can't be merged together
 checkConfigError "The option .value.multiple-lambdas.<function body>. has conflicting option types" config.applied.multiple-lambdas ./types-anything/functions.nix
-checkConfigOutput '^true$' config.valueIsFunction.single-lambda ./types-anything/functions.nix
+checkConfigOutput '^<LAMBDA>$' config.value.single-lambda ./types-anything/functions.nix
 checkConfigOutput '^null$' config.applied.merging-lambdas.x ./types-anything/functions.nix
 checkConfigOutput '^null$' config.applied.merging-lambdas.y ./types-anything/functions.nix
 # Check that all mk* modifiers are applied
 checkConfigError 'attribute .* not found' config.value.mkiffalse ./types-anything/mk-mods.nix
-checkConfigOutput '^{}$' config.value.mkiftrue ./types-anything/mk-mods.nix
+checkConfigOutput '^{ }$' config.value.mkiftrue ./types-anything/mk-mods.nix
 checkConfigOutput '^1$' config.value.mkdefault ./types-anything/mk-mods.nix
-checkConfigOutput '^{}$' config.value.mkmerge ./types-anything/mk-mods.nix
+checkConfigOutput '^{ }$' config.value.mkmerge ./types-anything/mk-mods.nix
 checkConfigOutput '^true$' config.value.mkbefore ./types-anything/mk-mods.nix
 checkConfigOutput '^1$' config.value.nested.foo ./types-anything/mk-mods.nix
 checkConfigOutput '^"baz"$' config.value.nested.bar.baz ./types-anything/mk-mods.nix
@@ -398,16 +384,16 @@ checkConfigOutput '^"a b y z"$' config.resultFooBar ./declare-variants.nix ./def
 checkConfigOutput '^"a b c"$' config.resultFooFoo ./declare-variants.nix ./define-variant.nix
 
 ## emptyValue's
-checkConfigOutput "\[\]" config.list.a ./emptyValues.nix
-checkConfigOutput "{}" config.attrs.a ./emptyValues.nix
+checkConfigOutput "[ ]" config.list.a ./emptyValues.nix
+checkConfigOutput "{ }" config.attrs.a ./emptyValues.nix
 checkConfigOutput "null" config.null.a ./emptyValues.nix
-checkConfigOutput "{}" config.submodule.a ./emptyValues.nix
+checkConfigOutput "{ }" config.submodule.a ./emptyValues.nix
 # These types don't have empty values
 checkConfigError 'The option .int.a. is used but not defined' config.int.a ./emptyValues.nix
 checkConfigError 'The option .nonEmptyList.a. is used but not defined' config.nonEmptyList.a ./emptyValues.nix
 
 ## types.raw
-checkConfigOutput '^true$' config.unprocessedNestingEvaluates.success ./raw.nix
+checkConfigOutput "{ foo = <CODE>; }" config.unprocessedNesting ./raw.nix
 checkConfigOutput "10" config.processedToplevel ./raw.nix
 checkConfigError "The option .multiple. is defined multiple times" config.multiple ./raw.nix
 checkConfigOutput "bar" config.priorities ./raw.nix
@@ -441,13 +427,13 @@ checkConfigOutput 'ok' config.freeformItems.foo.bar ./adhoc-freeformType-survive
 checkConfigOutput '^1$' config.sub.specialisation.value ./extendModules-168767-imports.nix
 
 # Class checks, evalModules
-checkConfigOutput '^{}$' config.ok.config ./class-check.nix
+checkConfigOutput '^{ }$' config.ok.config ./class-check.nix
 checkConfigOutput '"nixos"' config.ok.class ./class-check.nix
 checkConfigError 'The module .*/module-class-is-darwin.nix was imported into nixos instead of darwin.' config.fail.config ./class-check.nix
 checkConfigError 'The module foo.nix#darwinModules.default was imported into nixos instead of darwin.' config.fail-anon.config ./class-check.nix
 
 # Class checks, submoduleWith
-checkConfigOutput '^{}$' config.sub.nixosOk ./class-check.nix
+checkConfigOutput '^{ }$' config.sub.nixosOk ./class-check.nix
 checkConfigError 'The module .*/module-class-is-darwin.nix was imported into nixos instead of darwin.' config.sub.nixosFail.config ./class-check.nix
 
 # submoduleWith type merge with different class

lib/tests/modules/boolByOr.nix

@@ -1,14 +0,0 @@
-{ lib, ... }: {
-
-  options.value = lib.mkOption {
-    type = lib.types.lazyAttrsOf lib.types.boolByOr;
-  };
-
-  config.value = {
-    falseFalse = lib.mkMerge [ false false ];
-    trueFalse = lib.mkMerge [ true false ];
-    falseTrue = lib.mkMerge [ false true ];
-    trueTrue = lib.mkMerge [ true true ];
-  };
-}
-

lib/tests/modules/error-mkOption-in-config.nix

@@ -1,14 +0,0 @@
-{ lib, ... }:
-let
-  inherit (lib) mkOption;
-in
-{
-  wrong1 = mkOption {
-  };
-  # This is not actually reported separately, so could be omitted from the test
-  # but it makes the example more realistic.
-  # Making it parse this _config_ as options would too risky. What if it's not
-  # options but other values, that abort, throw, diverge, etc?
-  nest.wrong2 = mkOption {
-  };
-}

lib/tests/modules/error-mkOption-in-submodule-config.nix

@@ -1,12 +0,0 @@
-{ lib, ... }:
-let
-  inherit (lib) mkOption;
-in
-{
-  options.sub = lib.mkOption {
-    type = lib.types.submodule {
-      wrong2 = mkOption {};
-    };
-    default = {};
-  };
-}

lib/tests/modules/raw.nix

@@ -1,4 +1,4 @@
-{ lib, config, ... }: {
+{ lib, ... }: {
 
   options = {
     processedToplevel = lib.mkOption {
@@ -13,9 +13,6 @@
     priorities = lib.mkOption {
       type = lib.types.raw;
     };
-    unprocessedNestingEvaluates = lib.mkOption {
-      default = builtins.tryEval config.unprocessedNesting;
-    };
   };
 
   config = {

lib/tests/modules/types-anything/equal-atoms.nix

@@ -9,7 +9,7 @@
       value.int = 0;
       value.bool = false;
       value.string = "";
-      value.path = ./.;
+      value.path = /.;
       value.null = null;
       value.float = 0.1;
     }
@@ -17,7 +17,7 @@
       value.int = 0;
       value.bool = false;
       value.string = "";
-      value.path = ./.;
+      value.path = /.;
       value.null = null;
       value.float = 0.1;
     }

lib/tests/modules/types-anything/functions.nix

@@ -1,9 +1,5 @@
 { lib, config, ... }: {
 
-  options.valueIsFunction = lib.mkOption {
-    default = lib.mapAttrs (name: lib.isFunction) config.value;
-  };
-
   options.value = lib.mkOption {
     type = lib.types.anything;
   };

lib/tests/packages-from-directory/a.nix

@@ -1,2 +0,0 @@
-{ }:
-"a"

lib/tests/packages-from-directory/b.nix

@@ -1,2 +0,0 @@
-{ }:
-"b"

lib/tests/packages-from-directory/c/package.nix

@@ -1,2 +0,0 @@
-{ }:
-"c"

lib/tests/packages-from-directory/my-namespace/d.nix

@@ -1,2 +0,0 @@
-{ }:
-"d"

lib/tests/packages-from-directory/my-namespace/e.nix

@@ -1,2 +0,0 @@
-{ }:
-"e"

lib/tests/packages-from-directory/my-namespace/f/package.nix

@@ -1,2 +0,0 @@
-{ }:
-"f"

lib/tests/packages-from-directory/my-namespace/my-sub-namespace/g.nix

@@ -1,2 +0,0 @@
-{ }:
-"g"

lib/tests/packages-from-directory/my-namespace/my-sub-namespace/h.nix

@@ -1,2 +0,0 @@
-{ }:
-"h"

lib/tests/release.nix

@@ -67,17 +67,5 @@ let
 in
   pkgs.symlinkJoin {
     name = "nixpkgs-lib-tests";
-    paths = map testWithNix nixVersions ++
-
-      #
-      # TEMPORARY MIGRATION MECHANISM
-      #
-      # This comment and the expression which follows it should be
-      # removed as part of resolving this issue:
-      #
-      #   https://github.com/NixOS/nixpkgs/issues/272591
-      #
-      [(import ../../pkgs/test/release {})]
-    ;
-
+    paths = map testWithNix nixVersions;
   }

lib/trivial.nix

@@ -1,18 +1,6 @@
 { lib }:
 
-let
-  inherit (lib.trivial)
-    isFunction
-    isInt
-    functionArgs
-    pathExists
-    release
-    setFunctionArgs
-    toBaseDigits
-    version
-    versionSuffix
-    warn;
-in {
+rec {
 
   ## Simple (higher order) functions
 
@@ -70,7 +58,9 @@ in {
      of the next function, and the last function returns the
      final value.
   */
-  pipe = builtins.foldl' (x: f: f x);
+  pipe = val: functions:
+    let reverseApply = x: f: f x;
+    in builtins.foldl' reverseApply val functions;
 
   # note please don’t add a function like `compose = flip pipe`.
   # This would confuse users, because the order of the functions
@@ -205,7 +195,7 @@ in {
      On each release the first letter is bumped and a new animal is chosen
      starting with that new letter.
   */
-  codeName = "Uakari";
+  codeName = "Tapir";
 
   /* Returns the current nixpkgs version suffix as string. */
   versionSuffix =
@@ -449,7 +439,7 @@ in {
   */
   functionArgs = f:
     if f ? __functor
-    then f.__functionArgs or (functionArgs (f.__functor f))
+    then f.__functionArgs or (lib.functionArgs (f.__functor f))
     else builtins.functionArgs f;
 
   /* Check whether something is a function or something
@@ -520,20 +510,22 @@ in {
 
      toHexString 250 => "FA"
   */
-  toHexString = let
-    hexDigits = {
-      "10" = "A";
-      "11" = "B";
-      "12" = "C";
-      "13" = "D";
-      "14" = "E";
-      "15" = "F";
-    };
-    toHexDigit = d:
-      if d < 10
-      then toString d
-      else hexDigits.${toString d};
-  in i: lib.concatMapStrings toHexDigit (toBaseDigits 16 i);
+  toHexString = i:
+    let
+      toHexDigit = d:
+        if d < 10
+        then toString d
+        else
+          {
+            "10" = "A";
+            "11" = "B";
+            "12" = "C";
+            "13" = "D";
+            "14" = "E";
+            "15" = "F";
+          }.${toString d};
+    in
+      lib.concatMapStrings toHexDigit (toBaseDigits 16 i);
 
   /* `toBaseDigits base i` converts the positive integer i to a list of its
      digits in the given base. For example:

lib/types.nix

@@ -67,7 +67,6 @@ let
     ;
   outer_types =
 rec {
-  __attrsFailEvaluation = true;
   isType = type: x: (x._type or "") == type;
 
   setType = typeName: value: value // {
@@ -113,14 +112,9 @@ rec {
     , # Description of the type, defined recursively by embedding the wrapped type if any.
       description ? null
       # A hint for whether or not this description needs parentheses. Possible values:
-      #  - "noun": a noun phrase
-      #    Example description: "positive integer",
-      #  - "conjunction": a phrase with a potentially ambiguous "or" connective
-      #    Example description: "int or string"
+      #  - "noun": a simple noun phrase such as "positive integer"
+      #  - "conjunction": a phrase with a potentially ambiguous "or" connective.
       #  - "composite": a phrase with an "of" connective
-      #    Example description: "list of string"
-      #  - "nonRestrictiveClause": a noun followed by a comma and a clause
-      #    Example description: "positive integer, meaning >0"
       # See the `optionDescriptionPhrase` function.
     , descriptionClass ? null
     , # DO NOT USE WITHOUT KNOWING WHAT YOU ARE DOING!
@@ -281,22 +275,6 @@ rec {
       merge = mergeEqualOption;
     };
 
-    boolByOr = mkOptionType {
-      name = "boolByOr";
-      description = "boolean (merged using or)";
-      descriptionClass = "noun";
-      check = isBool;
-      merge = loc: defs:
-        foldl'
-          (result: def:
-            # Under the assumption that .check always runs before merge, we can assume that all defs.*.value
-            # have been forced, and therefore we assume we don't introduce order-dependent strictness here
-            result || def.value
-          )
-          false
-          defs;
-    };
-
     int = mkOptionType {
       name = "int";
       description = "signed integer";
@@ -343,12 +321,10 @@ rec {
         unsigned = addCheck types.int (x: x >= 0) // {
           name = "unsignedInt";
           description = "unsigned integer, meaning >=0";
-          descriptionClass = "nonRestrictiveClause";
         };
         positive = addCheck types.int (x: x > 0) // {
           name = "positiveInt";
           description = "positive integer, meaning >0";
-          descriptionClass = "nonRestrictiveClause";
         };
         u8 = unsign 8 256;
         u16 = unsign 16 65536;
@@ -390,12 +366,10 @@ rec {
       nonnegative = addCheck number (x: x >= 0) // {
         name = "numberNonnegative";
         description = "nonnegative integer or floating point number, meaning >=0";
-        descriptionClass = "nonRestrictiveClause";
       };
       positive = addCheck number (x: x > 0) // {
         name = "numberPositive";
         description = "positive integer or floating point number, meaning >0";
-        descriptionClass = "nonRestrictiveClause";
       };
     };
 
@@ -472,7 +446,6 @@ rec {
     passwdEntry = entryType: addCheck entryType (str: !(hasInfix ":" str || hasInfix "\n" str)) // {
       name = "passwdEntry ${entryType.name}";
       description = "${optionDescriptionPhrase (class: class == "noun") entryType}, not containing newlines or colons";
-      descriptionClass = "nonRestrictiveClause";
     };
 
     attrs = mkOptionType {
@@ -880,13 +853,7 @@ rec {
     # Either value of type `t1` or `t2`.
     either = t1: t2: mkOptionType rec {
       name = "either";
-      description =
-        if t1.descriptionClass or null == "nonRestrictiveClause"
-        then
-          # Plain, but add comma
-          "${t1.description}, or ${optionDescriptionPhrase (class: class == "noun" || class == "conjunction") t2}"
-        else
-          "${optionDescriptionPhrase (class: class == "noun" || class == "conjunction") t1} or ${optionDescriptionPhrase (class: class == "noun" || class == "conjunction" || class == "composite") t2}";
+      description = "${optionDescriptionPhrase (class: class == "noun" || class == "conjunction") t1} or ${optionDescriptionPhrase (class: class == "noun" || class == "conjunction" || class == "composite") t2}";
       descriptionClass = "conjunction";
       check = x: t1.check x || t2.check x;
       merge = loc: defs:

maintainers/README.md

@@ -165,10 +165,3 @@ team after giving the existing members a few days to respond.
 
 *Important:* If a team says it is a closed group, do not merge additions
 to the team without an approval by at least one existing member.
-
-
-# Maintainer scripts
-
-Various utility scripts, which are mainly useful for nixpkgs maintainers,
-are available under `./scripts/`.  See its [README](./scripts/README.md)
-for further information.