Merge master into staging-next

In 04b2b5057b (#528448), emacs.src was
changed to use `fetchgit` from `fetchzip` but the hash was left
unchanged.  This patch fixes that.

.github/workflows/backport.yml

@@ -36,7 +36,7 @@ jobs:
           permission-pull-requests: write
           permission-workflows: write
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ steps.app-token.outputs.token }}

.github/workflows/bot.yml

@@ -46,7 +46,7 @@ jobs:
       # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/build.yml

@@ -52,7 +52,7 @@ jobs:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions

.github/workflows/check.yml

@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: trusted
@@ -95,7 +95,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: trusted
@@ -137,7 +137,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions

.github/workflows/comment.yml

@@ -23,7 +23,7 @@ jobs:
     timeout-minutes: 2
     if: contains(github.event.comment.body, '@NixOS/nixpkgs-merge-bot merge')
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/eval.yml

@@ -47,7 +47,7 @@ jobs:
       ciPinBumpCommit: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommit }}
       ciPinBumpCommitShort: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommitShort }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: trusted
@@ -55,7 +55,7 @@ jobs:
             ci/supportedVersions.nix
 
       - name: Check out the PR at the test merge commit
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           ref: ${{ inputs.mergedSha }}
@@ -171,7 +171,7 @@ jobs:
           sudo mkswap /swap
           sudo swapon /swap
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -256,7 +256,7 @@ jobs:
       statuses: write # creating 'Eval Summary' commit statuses
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -471,7 +471,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions

.github/workflows/lint.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -90,7 +90,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
@@ -134,7 +134,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: true # Needed to run git fetch for large PRs.
           path: trusted

.github/workflows/merge-group.yml

@@ -25,7 +25,7 @@ jobs:
       targetSha: ${{ steps.prepare.outputs.targetSha }}
       systems: ${{ steps.prepare.outputs.systems }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/periodic-merge.yml

@@ -34,7 +34,7 @@ jobs:
           permission-contents: write
           permission-pull-requests: write
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 

.github/workflows/pull-request-target.yml

@@ -36,7 +36,7 @@ jobs:
       systems: ${{ steps.prepare.outputs.systems }}
       touched: ${{ steps.prepare.outputs.touched }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity

.github/workflows/review.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-slim
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/teams.yml

@@ -30,7 +30,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Fetch source
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout: |

.github/workflows/test.yml

@@ -19,7 +19,7 @@ jobs:
       push: ${{ steps.files.outputs.push }}
       targetSha: ${{ steps.prepare.outputs.targetSha }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           sparse-checkout-cone-mode: true # default, for clarity

README.md

@@ -13,7 +13,7 @@
   <a href="https://opencollective.com/nixos"><img src="https://opencollective.com/nixos/tiers/supporter/badge.svg?label=supporters&color=brightgreen" alt="Open Collective supporters" /></a>
 </p>
 
-[Nixpkgs](https://github.com/nixos/nixpkgs) is a collection of over 120,000 software packages that can be installed with the [Nix](https://nixos.org/nix/) package manager.
+[Nixpkgs](https://github.com/nixos/nixpkgs) is a collection of over 140,000 software packages that can be installed with the [Nix](https://nixos.org/nix/) package manager.
 It also implements [NixOS](https://nixos.org/nixos/), a purely-functional Linux distribution.
 
 # Manuals

ci/OWNERS

@@ -445,6 +445,7 @@ nixos/tests/forgejo.nix               @adamcstephens @bendlas @christoph-heiss @
 /doc/languages-frameworks/javascript.section.md @winterqt
 /pkgs/development/tools/pnpm                    @Scrumplex @gepbird
 /pkgs/build-support/node/fetch-pnpm-deps        @Scrumplex @gepbird
+/pkgs/test/pnpm                                 @Scrumplex @gepbird
 
 # OCaml
 /pkgs/build-support/ocaml           @ulrikstrid

doc/README.md

@@ -207,6 +207,8 @@ When needed, each convention explains why it exists, so you can make a decision
 Note that these conventions are about the **structure** of the manual (and its source files), not about the content that goes in it.
 You, as the writer of documentation, are still in charge of its content.
 
+**For prose style, see the [documentation styleguide](./styleguide.md).**
+
 ### One sentence per line
 
 Put each sentence in its own line.
@@ -219,17 +221,16 @@ When changing existing content, update formatting if possible, but avoid excessi
 
 ### Examples first
 
-Readers look at examples first: an example communicates what something does faster than a description.
-Put examples before detailed explanations.
+Put examples before detailed explanations (see the [styleguide](./styleguide.md) for the rationale).
 
-Prefer this structure for each documented item:
+Use this structure for each documented item:
 
 1. Title
-2. Abstract (optional, one sentence max, the example often speaks for itself)
+2. Abstract (optional, one sentence max)
 3. Example
 4. Explanation (details, edge cases, types, defaults)
 
-For instance:
+Rendered example:
 
 ````markdown
 ## `lib.toUpper`
@@ -281,11 +282,9 @@ Returns the difference as a number.
 
 Use the [admonition syntax](#admonitions) for callouts and examples.
 
-### Provide self-contained examples
+### `callPackage`-compatible examples
 
-Provide at least one example per function, and make examples self-contained.
-This is easier to understand for beginners.
-It also helps with testing that it actually works – especially once we introduce automation.
+Provide at least one example per function.
 
 Example code should be such that it can be passed to `pkgs.callPackage`.
 Instead of something like:

doc/hooks/index.md

@@ -37,6 +37,7 @@ npm-install-hook.section.md
 patch-rc-path-hooks.section.md
 perl.section.md
 pkg-config.section.md
+pnpm.section.md
 postgresql-test-hook.section.md
 premake.section.md
 python.section.md

doc/hooks/pnpm.section.md

@@ -0,0 +1,142 @@
+# pnpmBuildHook {#pnpm-build-hook}
+
+[pnpm](https://pnpm.io/) is a an NPM-compatible package manager focused on increasing managment speeds, and reducing disk space.
+
+The `pnpmBuildHook` in Nixpkgs overrides the default build phase for building packages that use pnpm.
+
+:::{.example #ex-pnpm-build-hook}
+## pnpmBuildHook example code snippet {#pnpm-build-hook-code-snippet}
+
+```
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchPnpmDeps,
+  pnpmConfigHook,
+  pnpmBuildHook,
+  makeBinaryWrapper,
+  pnpm_10,
+}:
+let
+  pnpm = pnpm_10;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "coolPackages";
+  version = "1.0";
+
+  src = fetchFromGitHub {
+    owner = "JaneCool";
+    repo = "coolpackage";
+    tag = finalAttrs.version;
+    hash = lib.fakeHash;
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    inherit pnpm;
+    fetcherversion = 4;
+    hash = lib.fakeHash;
+  };
+
+  nativeBuildInputs = [
+    pnpmConfigHook
+    pnpmBuildHook
+    makeBinaryWrapper
+  ];
+
+  pnpmBuildScript = "build";
+  pnpmBuildFlags = [
+    "--mode"
+    "production"
+  ];
+  pnpmWorkspaces = [
+    "test"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir "$out"
+    cp -r dist/. "$out"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "very cool package that does cool things";
+    mainProgram = "cool";
+  };
+})
+```
+:::
+
+## Variables controlling pnpmBuildHook {#pnpm-build-hook-variables}
+
+### pnpm Exclusive Variables {#pnpm-build-hook-exclusive-variables}
+
+#### `pnpmBuildScript` {#pnpm-build-hook-script}
+
+Controls the script ran to build the package, by default the script is `build`.
+
+#### `pnpmFlags` {#pnpm-build-hook-flags}
+
+Controls flags used for all invocations of pnpm across all hooks local to this derivation.
+
+#### `pnpmBuildFlags` {#pnpm-build-hook-build-flags}
+
+Controls the flags pass only to the pnpm build script invocation.
+
+#### `dontPnpmBuild` {#pnpm-build-hook-dont}
+
+Disables automatically running `pnpmBuildHook`. The build can still be run manually if needed, for example:
+
+```
+{
+  lib,
+  rustPlatform,
+  pnpmBuildHook,
+  pnpmConfigHook,
+  fetchPnpmDeps,
+  emptyDirectory,
+  pnpm_10,
+}:
+let
+  pnpm = pnpm_10;
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "super-fast-application";
+  version = "1.0";
+
+  src = emptyDirectory;
+
+  cargoHash = lib.fakeHash;
+
+  nativeBuildInputs = [
+    pnpmBuildHook
+    pnpmConfigHook
+  ];
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    inherit pnpm;
+    fetcherversion = 3;
+    hash = lib.fakeHash;
+  }
+
+  dontPnpmBuild = true;
+  postBuild = ''
+    pnpmBuildHook
+  '';
+})
+```
+
+### Honored Variables {#pnpm-build-hook-honored-variables}
+
+The following variables are honored by `pnpmBuildHook`.
+
+* [`pnpmRoot`](#javascript-pnpm-sourceRoot)
+* [`pnpmWorkspaces`](#javascript-pnpm-workspaces)

doc/languages-frameworks/javascript.section.md

@@ -309,6 +309,8 @@ pnpm is available as the top-level package `pnpm`. Additionally, there are varia
 
 When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` will prepare the build environment to install the pre-fetched dependencies store. Here is an example for a package that contains `package.json` and a `pnpm-lock.yaml` files using the fetcher and setup hook above:
 
+There is also the [`pnpmBuildHook`](#pnpm-build-hook) for building packages with `pnpm`, as seen in [](#ex-pnpm-build-hook).
+
 ```nix
 {
   fetchPnpmDeps,
@@ -511,10 +513,10 @@ Changes can include workarounds or bug fixes to existing PNPM issues.
 
 ##### Version history {#javascript-pnpm-fetcherVersion-versionHistory}
 
-Version 3 is the recommended value for new packages. Versions 1 and 2 are deprecated and scheduled for removal in the 26.11 release; existing packages must migrate.
+Version 3 is the minimum supported value. Versions 1 and 2 were removed in the 26.11 release; packages that still use them fail to evaluate and must migrate to `fetcherVersion = 3` (or later) and regenerate their hashes.
 
-- 1: Initial version, nothing special.
-- 2: [Ensure consistent permissions](https://github.com/NixOS/nixpkgs/pull/422975)
+- 1: Initial version, nothing special. (removed in 26.11)
+- 2: [Ensure consistent permissions](https://github.com/NixOS/nixpkgs/pull/422975) (removed in 26.11)
 - 3: [Build a reproducible tarball](https://github.com/NixOS/nixpkgs/pull/469950)
 - 4: [Dump SQLite database to an SQL file](https://github.com/NixOS/nixpkgs/pull/522703)
 

doc/redirects.json

@@ -113,6 +113,9 @@
   "ex-pkgs-replace-vars-with": [
     "index.html#ex-pkgs-replace-vars-with"
   ],
+  "ex-pnpm-build-hook": [
+    "index.html#ex-pnpm-build-hook"
+  ],
   "ex-shfmt": [
     "index.html#ex-shfmt"
   ],
@@ -346,6 +349,33 @@
   "pkgs.treefmt.withConfig": [
     "index.html#pkgs.treefmt.withConfig"
   ],
+  "pnpm-build-hook": [
+    "index.html#pnpm-build-hook"
+  ],
+  "pnpm-build-hook-build-flags": [
+    "index.html#pnpm-build-hook-build-flags"
+  ],
+  "pnpm-build-hook-code-snippet": [
+    "index.html#pnpm-build-hook-code-snippet"
+  ],
+  "pnpm-build-hook-dont": [
+    "index.html#pnpm-build-hook-dont"
+  ],
+  "pnpm-build-hook-exclusive-variables": [
+    "index.html#pnpm-build-hook-exclusive-variables"
+  ],
+  "pnpm-build-hook-flags": [
+    "index.html#pnpm-build-hook-flags"
+  ],
+  "pnpm-build-hook-script": [
+    "index.html#pnpm-build-hook-script"
+  ],
+  "pnpm-build-hook-variables": [
+    "index.html#pnpm-build-hook-variables"
+  ],
+  "pnpm-build-hook-honored-variables": [
+    "index.html#pnpm-build-hook-honored-variables"
+  ],
   "preface": [
     "index.html#preface"
   ],

doc/release-notes/rl-2611.section.md

@@ -29,6 +29,13 @@
 
 - `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
 
+- `fetchPnpmDeps`' `fetcherVersion = 1` and `fetcherVersion = 2` have been
+  removed, as announced in the 26.05 release. Packages still using them now
+  throw an evaluation error and must migrate to `fetcherVersion = 3` (or later)
+  and regenerate their hashes. See the
+  [pnpm `fetcherVersion` section](#javascript-pnpm-fetcherVersion) of the manual
+  for details.
+
 ## Other Notable Changes {#sec-nixpkgs-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

doc/styleguide.md

@@ -0,0 +1,420 @@
+# Styleguide
+
+## Writing Principles
+
+A consistent style greatly increases the usability of all documentation and communication.
+
+Use this page as a reference and style guide for our internal and external documentation.
+
+### Knowledge Expectations
+
+**Assume competence, not familiarity.**
+
+Write for someone who knows a great deal — up to but not including this project.
+
+**What readers know:**
+
+- Basic computer operation
+- Command line familiarity
+- General interest in systems configuration
+
+**What readers don't know:**
+
+- NixOS-specific concepts
+- NixOS ecosystem details or grammar
+- NixOS workflows
+
+If specific knowledge is required, mention it at the start of the page.
+
+#### Show, Don't Tell
+
+The fastest path to understanding is a working example.
+People learn by doing, not by reading about doing.
+
+**Recommended structure:**
+
+- Start with the minimal working code or command
+- Briefly explain what it does
+- Cover edge cases or variations
+- Link to further information instead of including it
+
+#### Grammar and Style
+
+**Sentence structure:**
+
+- Use simple, direct sentences
+- Break complex ideas into multiple short sentences
+- Avoid nested clauses
+
+**Bad:**
+
+> The following command, which utilizes nixos-generate-config to produce a comprehensive hardware configuration, will write the results back into the respective configuration directory located on your local machine.
+
+What the user does is hidden in the middle.
+`nixos-generate-config` is a leaked implementation detail.
+Users care about *detecting hardware*, not *the tool that does it*.
+
+**Good:**
+
+> This command detects your hardware and saves the configuration.
+
+#### Content Organization
+
+Lead with value. State what the reader will accomplish before explaining how.
+
+**Bad:**
+
+> To create a new NixOS configuration that you can later use as a webserver, first navigate to your project directory, then add a new host configuration file with the desired machine name.
+
+**Good:**
+
+Add a webserver configuration to your NixOS setup:
+
+```nix
+# hosts/webserver/configuration.nix
+{ ... }:
+{
+  services.nginx.enable = true;
+}
+```
+
+Use **progressive disclosure**. Introduce concepts only when needed.
+
+**Recommended structure:**
+
+1. State the goal (one sentence)
+2. Show the simplest working example
+3. Explain concepts if needed
+4. Provide advanced options separately or link to the reference
+
+#### No Meta-commentary
+
+Don't describe what the documentation does. Just do it.
+
+**Don't:**
+
+> This section explains how to configure networking.
+> The following guide walks you through setting up a web server.
+
+**Do:**
+
+> Configure networking by setting:
+> Set up a web server:
+
+#### Code Examples
+
+**Keep examples focused:**
+
+- Show one concept at a time
+- Use realistic but simple scenarios
+- Avoid dependencies on other examples
+
+**Minimal comments**
+
+Let the code speak for itself.
+Paste code examples directly and without further alteration.
+
+**Bad:**
+
+```nix
+# This sets the hostname for the machine
+{
+  networking.hostName = "webserver"; # Change this to your machine's hostname
+  # This enables SSH access
+  services.openssh.enable = true; # Required for remote deployment
+}
+```
+
+**Good:**
+
+```nix
+{
+  networking.hostName = "webserver";
+  services.openssh.enable = true;
+}
+```
+
+#### Lead with Practical Examples
+
+Don't front-load theory. Readers want to accomplish something first, then understand why it works.
+
+- Show configuration as *what you want*, not *how the module system works*
+- Introduce Nix-specific concepts only when they are needed to complete the task
+- Defer language mechanics to reference pages or `nix.dev`
+
+**Bad:**
+
+> Before adding a service, you need to understand the NixOS module system and attribute set merging.
+
+**Good:**
+
+Enable nginx:
+
+```nix
+{ services.nginx.enable = true; }
+```
+
+This adds nginx to your system configuration. Rebuild to apply:
+
+```bash
+sudo nixos-rebuild switch
+```
+
+#### Teach Nix through examples, not theory
+
+
+Users learn the NixOS module system by seeing patterns first.
+
+- Start with a working example
+- Explanation follows the code
+- Link deeper concepts instead of inlining them
+- Link to `nix.dev` for optional learning
+
+#### General Rules
+
+- Abbreviate keys like `ssh-ed25519 AAAAC3NzaC…`
+- Abbreviate IP addresses like `192.168.XXX.XXX`
+- Variables are capitalized and start with `$`, e.g. `$YOUR_HOSTNAME`
+- Variables should be directly usable during copy-paste
+- Do **not** describe missing code parts (`#elided`, `#omitted`)
+- **Machine vs Host**: use "machine" for the NixOS system identity, "host" for the physical or virtual hardware
+
+#### Capitalization
+
+- GB / RAM / HDD
+- bootable USB drive
+- Wi-Fi / DHCP / DNS
+- macOS / NixOS / Nix / Linux
+- Flakes
+- git
+
+#### Headings
+
+Use sentence case. A reader scanning only headings should understand the page.
+
+**Don't:**
+
+> Getting Started
+> Overview
+> Configure The Database
+
+**Do:**
+
+> Set up a PostgreSQL database
+> Configure networking
+> Add a user to the system
+
+#### Imperative Mood, Voice, and Person
+
+Use imperative mood for instructions. Address the reader as "you", not "the user". Use active voice; in other words, make the subject do the action.
+
+**Don't:**
+
+> The user should run the following command.
+> The configuration will need to be updated.
+> The key is generated by the system.
+
+**Do:**
+
+> Run the command.
+> Update the configuration.
+> The system generates the key.
+
+#### Tense
+
+Use present tense for descriptions. Future tense makes documentation feel tentative.
+
+**Don't:**
+
+> This will create a new folder.
+> Running this command will install the package.
+
+**Do:**
+
+> This creates a new folder.
+> Running this command installs the package.
+
+#### Be Confident
+
+State facts. Don't hedge with "should," "might," "typically," or "usually" unless the behavior genuinely varies.
+
+**Don't:**
+
+> This should create the configuration file.
+> The service will usually start automatically.
+
+**Do:**
+
+> This creates the configuration file.
+> The service starts automatically.
+
+#### Avoid Nominalizations
+
+A nominalization is a verb turned into a noun, often by adding *-tion*, *-meant*, or *-ance* (e.g. "explanation", "selection"). The fix: find the hidden verb and use it directly.
+
+**Don't:**
+
+> Make a selection from the list.
+> Provide an explanation of the error.
+
+**Do:**
+
+> Select from the list.
+> Explain the error.
+
+#### Plain Words
+
+Technical precision for technical terms; plain language for everything else.
+
+- "use" not "utilize"
+- "start" not "initiate"
+- "end" not "terminate"
+- "help" not "facilitate"
+- "send" not "transmit"
+- "set up" not "establish"
+- "find out" not "ascertain"
+
+#### Filler Words and Weak Phrases
+
+Cut words and phrases that add length without meaning.
+
+Delete on sight:
+
+- "simply", "just", "easily", "basically", "obviously"
+- "in order to" → use "to"
+- "allows you to" → use the verb directly
+- "it's worth noting that" → just say the thing
+- no exclamation marks in technical prose
+
+**Don't:**
+
+> Simply run `nixos-rebuild switch`.
+> In order to deploy, you first need to run the command, which allows you to push the config.
+> It's worth noting that this requires root access.
+
+**Do:**
+
+> Run `nixos-rebuild switch`.
+> To deploy, run:
+> This requires root access.
+
+Every word must earn its place.
+
+#### Writing Procedures
+
+One instruction per sentence. Don't pack multiple actions into one sentence.
+
+**Don't:**
+
+> Navigate to your project directory and run the command, then check the output.
+
+**Do:**
+
+1. Navigate to your project directory.
+2. Run the command.
+3. Check the output.
+
+Don't bury the negative. Key limitations should be prominent, not a footnote after a positive description.
+
+**Don't:**
+
+> This service supports multiple roles, integrates with existing modules, and works great for most setups (note that multiple instances are not supported).
+
+**Do:**
+
+> This service does not support multiple instances.
+
+#### Consistent Terminology
+
+Pick a term and stick to it. Don't swap synonyms to avoid repetition. In technical documentation, repetition is clarity.
+
+**Don't:**
+
+> Create a machine... configure the host... deploy the node.
+
+**Do:**
+
+> Create a machine... configure the machine... deploy the machine.
+
+#### Links
+
+Use descriptive link text. Never use "click here" or "this link."
+
+**Don't:**
+
+> For more information, see `[this page](url)`.
+> Click `[here](url)` to read the reference.
+
+**Do:**
+
+> See the `[NixOS options reference](url)` for details.
+> Read the `[NixOS module system guide](url)`.
+
+Only link when the destination is directly relevant, not for generic background context (sometimes known as "Wikipedia-style links"). Readers feel obligated to click links, fearing they'll miss something important. Don't send them to a generic article about a technology when they're looking for how *your* system uses it.
+
+**Don't:**
+
+> Our software uses [SQLite](https://sqlite.org/) for storage.
+> *(Reader clicks expecting schema details — finds a generic product page instead.)*
+
+(Note that in the above example, the SQLite link is the SQLite home page, which is likely not pertinent.)
+
+**Do:**
+
+> See `[database schema](url)` for the full table structure.
+
+#### UI Language
+
+Match UI element names exactly: wording, casing, and spacing (even if a label seems oddly worded).
+
+**Don't:**
+
+> Click the generator button.
+> Select the save option.
+
+**Do:**
+
+> Click **Generate a Key**.
+> Click **Save Changes**.
+
+Someone will go looking for a button labeled "generator." They will not find it. They will be frustrated.
+
+Consistency between documentation and interface builds confidence. Words are part of the interface.
+
+:::{.tip}
+This can be tricky as UI changes; we don't yet have a policy in place for how to handle this. We welcome comments and suggestions.
+:::
+
+#### Clean system discipline
+
+Your machine has things new users don't: cached credentials, installed tools, environment variables, existing configuration. When writing or updating documentation:
+
+**Don't:**
+
+> Write steps from memory on your development machine, assuming what works there will work everywhere.
+
+**Do:**
+
+> - Start on a clean system — a fresh VM or new user account
+> - Take notes in real time as you work through the steps
+> - Document every warning, prompt, or unexpected output the system shows
+
+Also think in combinations: WSL vs native Linux, with and without existing keys. You don't need to test every matrix square — but you need to know which ones diverge.
+
+#### Never type code — always copy-paste
+
+Always copy commands and code from a terminal where you just ran them successfully. Never retype from memory.
+
+**Don't:**
+
+> Retype a command from memory into the documentation.
+> Retype code into a code-block from memory
+
+**Do:**
+
+> Paste commands directly from the shell or IDE.
+> Paste code that has been successfully validated with nix-instantiate or nix-build
+
+Replace sensitive values with placeholders: `<YOUR-KEY>`, `<YOUR-HOST>`, `<YOUR-TOKEN>`.
+
+Typed-from-memory commands introduce subtle errors. Even the most experienced software developers have occasional typos.

maintainers/maintainer-list.nix

@@ -118,13 +118,6 @@
     github = "0xB10C";
     githubId = 19157360;
   };
-  _0xbe7a = {
-    email = "nix@be7a.de";
-    name = "Bela Stoyan";
-    github = "0xbe7a";
-    githubId = 6232980;
-    keys = [ { fingerprint = "2536 9E86 1AA5 9EB7 4C47  B138 6510 870A 77F4 9A99"; } ];
-  };
   _0xC45 = {
     email = "jason@0xc45.com";
     name = "Jason Vigil";
@@ -1882,7 +1875,10 @@
     github = "ap-1";
     githubId = 67872951;
     name = "Anish Pallati";
-    keys = [ { fingerprint = "2A0A 16F5 E026 BE3B A47F B7A6 841A FB68 9A5B ACCB"; } ];
+    keys = [
+      { fingerprint = "2A0A 16F5 E026 BE3B A47F B7A6 841A FB68 9A5B ACCB"; }
+      { fingerprint = "B89E A3F3 16A7 411C B5B2 8A14 B1CA 8321 35A8 C503"; }
+    ];
   };
   ankhers = {
     email = "me@ankhers.dev";
@@ -4374,12 +4370,6 @@
     githubId = 1516457;
     name = "Christian Albrecht";
   };
-  callahad = {
-    email = "dan.callahan@gmail.com";
-    github = "callahad";
-    githubId = 24193;
-    name = "Dan Callahan";
-  };
   callumio = {
     email = "git@cleslie.uk";
     github = "callumio";
@@ -9259,6 +9249,12 @@
     githubId = 119691;
     name = "Michael Gough";
   };
+  fraggerfox = {
+    email = "santhosh.raju@gmail.com";
+    github = "fraggerfox";
+    githubId = 189939;
+    name = "Santhosh Raju";
+  };
   fraioveio = {
     email = "francesco@vecchia.lol";
     github = "FraioVeio";
@@ -9369,14 +9365,6 @@
     githubId = 1943632;
     name = "fro_ozen";
   };
-  frogamic = {
-    email = "frogamic@protonmail.com";
-    github = "frogamic";
-    githubId = 10263813;
-    name = "Dominic Shelton";
-    matrix = "@frogamic:beeper.com";
-    keys = [ { fingerprint = "779A 7CA8 D51C C53A 9C51  43F7 AAE0 70F0 67EC 00A5"; } ];
-  };
   frontear = {
     name = "Ali Rizvi";
     email = "perm-iterate-0b@icloud.com";
@@ -11096,7 +11084,7 @@
     name = "Hugo Tavares Reis";
   };
   httprafa = {
-    email = "rafael.kienitz@gmail.com";
+    email = "rafa.kienitz@proton.me";
     github = "HttpRafa";
     githubId = 60099368;
     name = "Rafael Kienitz";
@@ -12624,6 +12612,12 @@
     githubId = 30251156;
     name = "Jesse Moore";
   };
+  jesssullivan = {
+    email = "jess@sulliwood.org";
+    github = "Jesssullivan";
+    githubId = 37297218;
+    name = "Jess Sullivan";
+  };
   jethair = {
     email = "jethair@duck.com";
     github = "JetHair";
@@ -18300,13 +18294,6 @@
     githubId = 52108954;
     name = "Matias Zwinger";
   };
-  mkf = {
-    email = "m@mikf.pl";
-    github = "mkf";
-    githubId = 7753506;
-    name = "Michał Krzysztof Feiler";
-    keys = [ { fingerprint = "1E36 9940 CC7E 01C4 CFE8  F20A E35C 2D7C 2C6A C724"; } ];
-  };
   mkg = {
     email = "mkg@vt.edu";
     github = "mkgvt";
@@ -19514,6 +19501,12 @@
     githubId = 1488603;
     name = "François Espinet";
   };
+  netpleb = {
+    email = "netpleb@proton.me";
+    github = "netpleb";
+    githubId = 130105838;
+    name = "netpleb";
+  };
   netthier = {
     email = "netthier@proton.me";
     name = "nett_hier";
@@ -20405,6 +20398,12 @@
     email = "nyu@nyuku.ru";
     githubId = 97425873;
   };
+  nyxar77 = {
+    name = "nyxar77";
+    github = "nyxar77";
+    email = "dev@nyxar.space";
+    githubId = 153492661;
+  };
   nyxonios = {
     name = "nyxonios";
     github = "Nyxonios";
@@ -21438,6 +21437,12 @@
     githubId = 7420227;
     name = "Peter Tri Ho";
   };
+  peterwaller-arm = {
+    email = "peter.waller@arm.com";
+    github = "peterwaller-arm";
+    githubId = 52030119;
+    name = "Peter Waller";
+  };
   peterwilli = {
     email = "peter@codebuffet.co";
     github = "peterwilli";
@@ -25084,6 +25089,12 @@
     githubId = 2049686;
     name = "Sebastián Estrella";
   };
+  seudonym = {
+    name = "Wahid Khan";
+    email = "wk170179+nixpkgs@gmail.com";
+    github = "seudonym";
+    githubId = 80459261;
+  };
   seven_bear = {
     name = "Edmond Freeman";
     email = "edmondfreeman7@gmail.com";
@@ -25356,12 +25367,6 @@
     githubId = 487050;
     name = "Shea Levy";
   };
-  shlok = {
-    email = "sd-nix-maintainer@quant.is";
-    github = "shlok";
-    githubId = 3000933;
-    name = "Shlok Datye";
-  };
   shmish111 = {
     email = "shmish111@gmail.com";
     github = "shmish111";
@@ -25746,6 +25751,7 @@
   };
   skyesoss = {
     name = "Skye Soss";
+    email = "skye@soss.website";
     matrix = "@skyesoss:matrix.org";
     github = "Skyb0rg007";
     githubId = 30806179;

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -12,6 +12,8 @@
 
 - [tranquil](https://tangled.org/tranquil.farm/tranquil-pds) is an ATProto PDS (personal data server) implementation in Rust. A featureful, spec conscious and community driven alternative to the Bluesky reference implementation PDS. Available as [services.tranquil-pds](#opt-services.tranquil-pds.enable).
 
+- [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -22,8 +24,12 @@
 
 - Python 2 has been removed from the top-level package set, as it is long past end-of-life. The `python2`, `python27`, `python2Full`, `python27Full`, `python2Packages`, and `python27Packages` attributes, along with the legacy `python`, `pythonFull`, and `pythonPackages` aliases, now throw an error directing you to `python3`. The `isPy2` and `isPy27` package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the `resholve` package for its `oil` dependency and is not exposed for general use.
 
+- `services.timesyncd.extraConfig` has been removed in favor of the structured [](#opt-services.timesyncd.settings.Time) option. Use `services.timesyncd.settings.Time` to set any `timesyncd.conf(5)` option directly. For example, replace `services.timesyncd.extraConfig = "PollIntervalMaxSec=180";` with `services.timesyncd.settings.Time.PollIntervalMaxSec = 180;`.
+
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- `boot.loader.systemd-boot` gained support for [Automatic Boot Assessment](https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT/) via the new [`boot.loader.systemd-boot.bootCounting`](#opt-boot.loader.systemd-boot.bootCounting.enable) options, allowing automatic detection of and recovery from bad NixOS generations. As part of this change, boot loader entries on the ESP/XBOOTLDR partition are now named `nixos-<content-hash>.conf` instead of `nixos-generation-<n>.conf`; existing entries are migrated automatically on the next `nixos-rebuild boot`/`switch`.
+
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.

nixos/modules/config/nix-channel.nix

@@ -6,12 +6,16 @@
   - ./nix.nix
   - ./nix-flakes.nix
 */
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   inherit (lib)
     mkIf
     mkOption
-    stringAfter
     types
     ;
 
@@ -98,8 +102,10 @@ in
       ''f /root/.nix-channels - - - - ${config.system.defaultChannel} nixos\n''
     ];
 
-    system.activationScripts.no-nix-channel = mkIf (!cfg.channel.enable) (
-      stringAfter [ "etc" "users" ] (builtins.readFile ./nix-channel/activation-check.sh)
+    system.preSwitchChecks.no-nix-channel = mkIf (!cfg.channel.enable) (
+      lib.replaceStrings [ "@getent@" ] [ (lib.getExe pkgs.getent) ] (
+        builtins.readFile ./nix-channel/pre-switch-check.sh
+      )
     );
   };
 }

nixos/modules/config/nix-channel/pre-switch-check.sh

@@ -1,4 +1,6 @@
-# shellcheck shell=bash
+warn() {
+    printf "\033[1;35mwarning:\033[0m %s\n" "$*" >&2
+}
 
 explainChannelWarning=0
 if [[ -e "/root/.nix-defexpr/channels" ]]; then
@@ -11,11 +13,13 @@ if [[ -e "/nix/var/nix/profiles/per-user/root/channels" ]]; then
 fi
 while IFS=: read -r _ _ _ _ _ home _ ; do
     if [[ -n  "$home" && -e "$home/.nix-defexpr/channels" ]]; then
-        warn "$home/.nix-defexpr/channels exists, but channels have been disabled." 1>&2
+        warn "$home/.nix-defexpr/channels exists, but channels have been disabled."
         explainChannelWarning=1
     fi
-done < <(getent passwd)
+done < <(@getent@ passwd)
 if [[ $explainChannelWarning -eq 1 ]]; then
-    echo "Due to https://github.com/NixOS/nix/issues/9574, Nix may still use these channels when NIX_PATH is unset." 1>&2
-    echo "Delete the above directory or directories to prevent this." 1>&2
+    echo "Due to https://github.com/NixOS/nix/issues/9574, Nix may still use these channels when NIX_PATH is unset." >&2
+    echo "Delete the above directory or directories to prevent this." >&2
 fi
+# This check is informational only and must never block a switch.
+true

nixos/modules/config/nix-channel/test.nix

@@ -1,20 +0,0 @@
-# Run:
-#   nix-build -A nixosTests.nix-channel
-{ lib, testers }:
-let
-  inherit (lib) fileset;
-
-  runShellcheck = testers.shellcheck {
-    name = "activation-check";
-    src = fileset.toSource {
-      root = ./.;
-      fileset = fileset.unions [
-        ./activation-check.sh
-      ];
-    };
-  };
-
-in
-lib.recurseIntoAttrs {
-  inherit runShellcheck;
-}

nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-plasma6.nix

@@ -36,25 +36,22 @@
   # Avoid bundling an entire MariaDB installation on the ISO.
   programs.kde-pim.enable = false;
 
-  system.activationScripts.installerDesktop =
+  systemd.tmpfiles.settings."10-installer-desktop" =
     let
-
       # Comes from documentation.nix when xserver and nixos.enable are true.
       manualDesktopFile = "/run/current-system/sw/share/applications/nixos-manual.desktop";
-
-      homeDir = "/home/nixos/";
-      desktopDir = homeDir + "Desktop/";
-
     in
-    ''
-      mkdir -p ${desktopDir}
-      chown nixos ${homeDir} ${desktopDir}
-
-      ln -sfT ${manualDesktopFile} ${desktopDir + "nixos-manual.desktop"}
-      ln -sfT ${pkgs.gparted}/share/applications/gparted.desktop ${desktopDir + "gparted.desktop"}
-      ln -sfT ${pkgs.calamares-nixos}/share/applications/calamares.desktop ${
-        desktopDir + "calamares.desktop"
-      }
-    '';
+    {
+      "/home/nixos/Desktop".d = {
+        user = "nixos";
+        group = "users";
+        mode = "0755";
+      };
+      "/home/nixos/Desktop/nixos-manual.desktop"."L+".argument = manualDesktopFile;
+      "/home/nixos/Desktop/gparted.desktop"."L+".argument =
+        "${pkgs.gparted}/share/applications/gparted.desktop";
+      "/home/nixos/Desktop/calamares.desktop"."L+".argument =
+        "${pkgs.calamares-nixos}/share/applications/calamares.desktop";
+    };
 
 }

nixos/modules/module-list.nix

@@ -887,6 +887,7 @@
   ./services/misc/ihaskell.nix
   ./services/misc/iio-niri.nix
   ./services/misc/input-remapper.nix
+  ./services/misc/inventree.nix
   ./services/misc/invidious-router.nix
   ./services/misc/irkerd.nix
   ./services/misc/jackett.nix
@@ -1017,6 +1018,7 @@
   ./services/monitoring/das_watchdog.nix
   ./services/monitoring/datadog-agent.nix
   ./services/monitoring/do-agent.nix
+  ./services/monitoring/flap-alerted.nix
   ./services/monitoring/fluent-bit.nix
   ./services/monitoring/fusion-inventory.nix
   ./services/monitoring/gatus.nix

nixos/modules/security/wrappers/default.nix

@@ -181,8 +181,23 @@ in
   ###### interface
 
   options = {
-    security.enableWrappers = lib.mkEnableOption "SUID/SGID wrappers" // {
+    security.enableWrappers = lib.mkEnableOption "" // {
       default = true;
+      description = ''
+        Whether to enable SUID/SGID wrappers.
+
+        ::: {.warning}
+        ONLY DISABLE THIS OPTION IF YOU KNOW WHAT YOU'RE DOING.
+        :::
+
+        A normal interactive NixOS system requires SUID/SGID wrappers (e.g. for
+        PAM and sudo). Disabling them, thus will lock you out from your system.
+
+        Disabling the SUID/SGID binaries is useful for non-interactive systems
+        (like a firewall appliance) to minimize the attack surface. In the
+        future, this might become available for interactive systems as well
+        (e.g. with systemd's [run0](https://www.freedesktop.org/software/systemd/man/latest/run0)).
+      '';
     };
 
     security.wrappers = lib.mkOption {

nixos/modules/services/display-managers/default.nix

@@ -1,5 +1,6 @@
 {
   config,
+  options,
   lib,
   pkgs,
   ...
@@ -7,6 +8,9 @@
 
 let
   cfg = config.services.displayManager;
+  opts = options.services.displayManager;
+
+  toPretty = lib.generators.toPretty { };
 
   installedSessions =
     pkgs.runCommand "desktops"
@@ -79,7 +83,7 @@ in
                 default = config.user != null;
                 defaultText = lib.literalExpression "config.${options.user} != null";
                 description = ''
-                  Automatically log in as {option}`autoLogin.user`.
+                  Automatically log in as {option}`${options.user}`.
                 '';
               };
 
@@ -101,16 +105,7 @@ in
       };
 
       defaultSession = lib.mkOption {
-        type = lib.types.nullOr lib.types.str // {
-          description = "session name";
-          check =
-            d:
-            lib.assertMsg (d != null -> (lib.types.str.check d && lib.elem d cfg.sessionData.sessionNames)) ''
-              Default graphical session, '${d}', not found.
-              Valid names for 'services.displayManager.defaultSession' are:
-                ${lib.concatStringsSep "\n  " cfg.sessionData.sessionNames}
-            '';
-        };
+        type = lib.types.nullOr (lib.types.str // { description = "session name"; });
         default = null;
         example = "gnome";
         description = ''
@@ -130,26 +125,12 @@ in
 
       sessionPackages = lib.mkOption {
         type = lib.types.listOf (
-          lib.types.package
+          lib.types.addCheck lib.types.package (
+            p: p ? providedSessions && p.providedSessions != [ ] && lib.all lib.isString p.providedSessions
+          )
           // {
             description = "package with provided sessions";
-            check =
-              p:
-              lib.assertMsg
-                (
-                  lib.types.package.check p
-                  && p ? providedSessions
-                  && p.providedSessions != [ ]
-                  && lib.all lib.isString p.providedSessions
-                )
-                ''
-                  Package, '${p.name}', did not specify any session names, as strings, in
-                  'passthru.providedSessions'. This is required when used as a session package.
-
-                  The session names can be looked up in:
-                    ${p}/share/xsessions
-                    ${p}/share/wayland-sessions
-                '';
+            descriptionClass = "composite";
           }
         );
         default = [ ];
@@ -208,7 +189,15 @@ in
       {
         assertion = cfg.autoLogin.enable -> cfg.autoLogin.user != null;
         message = ''
-          services.displayManager.autoLogin.enable requires services.displayManager.autoLogin.user to be set
+          `${opts.autoLogin}.enable` requires `${opts.autoLogin}.user` to be set
+        '';
+      }
+      {
+        assertion = cfg.defaultSession == null || lib.elem cfg.defaultSession cfg.sessionData.sessionNames;
+        message = ''
+          Default graphical session, ${toPretty cfg.defaultSession}, not found. Definitions:${lib.options.showDefs opts.defaultSession.definitionsWithLocations}.
+          Valid names for `${opts.defaultSession}` are:
+              ${lib.concatMapStringsSep "\n    " toPretty cfg.sessionData.sessionNames}
         '';
       }
     ];

nixos/modules/services/display-managers/gdm.nix

@@ -455,6 +455,22 @@ in
               settings.conffile = "/etc/pam/environment";
               settings.readenv = 0;
             }
+            # make sure the spawned session has the same variables as `display-manager.service`
+            # https://github.com/NixOS/nixpkgs/issues/523332
+            {
+              name = "env-greeter";
+              control = "required";
+              modulePath = "${config.security.pam.package}/lib/security/pam_env.so";
+              settings.conffile =
+                let
+                  env = config.services.displayManager.generic.environment;
+                in
+                pkgs.writeText "gdm-launch-environment-env-conf" ''
+                  PATH          DEFAULT="''${PATH}:${pkgs.gnome-session}/bin"
+                  XDG_DATA_DIRS DEFAULT="''${XDG_DATA_DIRS}:${env.XDG_DATA_DIRS}"
+                '';
+              settings.readenv = 0;
+            }
             {
               name = "systemd";
               control = "optional";

nixos/modules/services/misc/inventree.nix

@@ -0,0 +1,411 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.inventree;
+  pkg = cfg.package;
+
+  mysqlLocal = cfg.database.createLocally && cfg.database.dbtype == "mysql";
+  pgsqlLocal = cfg.database.createLocally && cfg.database.dbtype == "postgresql";
+
+  manage = pkgs.writeShellScriptBin "inventree-manage" ''
+    set -a
+    ${lib.toShellVars cfg.settings}
+    ${lib.optionalString (
+      cfg.database.passwordFile != null
+    ) ''INVENTREE_DB_PASSWORD="$(<${lib.escapeShellArg cfg.database.passwordFile})"''}
+    set +a
+
+    pushd ${lib.escapeShellArg cfg.dataDir}
+    expectedUser=${lib.escapeShellArg cfg.user}
+    sudo=()
+    if [[ "$USER" != "$expectedUser" ]]; then
+      ${
+        if config.security.sudo.enable then
+          ''sudo+=(${config.security.wrapperDir}/sudo -u "$expectedUser" -E)''
+        else
+          ''printf 'Aborting, inventree-manage must be run as user %s\n!' "$expectedUser" >&2; exit 2''
+      }
+    fi
+    exec "''${sudo[@]}" ${cfg.package}/bin/inventree "$@"
+  '';
+
+in
+{
+  meta.buildDocsInSandbox = false;
+
+  meta.maintainers = with lib.maintainers; [
+    kurogeek
+  ];
+
+  options.services.inventree = {
+    enable = lib.mkEnableOption "inventree";
+
+    dataDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/inventree";
+      description = "Inventree's data storage path.  Will be `/var/lib/inventree` by default.";
+    };
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      description = "Which package to use for the InvenTree instance.";
+      default = pkgs.inventree;
+      defaultText = lib.literalExpression "pkgs.inventree";
+    };
+
+    adminPasswordFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      example = "/run/keys/inventree-password";
+      description = "Path to a file containing admin password";
+    };
+
+    secretKeyFile = lib.mkOption {
+      type = lib.types.path;
+      default = "${cfg.dataDir}/secret_key.txt";
+      defaultText = lib.literalExpression ''"''${cfg.dataDir}/secret_key.txt"'';
+      example = "/run/keys/inventree-secret-key";
+      description = ''
+        Path to a file containing the secret key
+      '';
+    };
+
+    database = {
+      dbtype = lib.mkOption {
+        type = lib.types.nullOr (
+          lib.types.enum [
+            "postgresql"
+            "mysql"
+          ]
+        );
+        default = "postgresql";
+        description = "Database type.";
+      };
+      dbhost = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        example = "localhost";
+        description = "Database host or socket path.";
+      };
+      dbport = lib.mkOption {
+        type = lib.types.nullOr lib.types.port;
+        default = null;
+        example = 5432;
+        description = "Database host port.";
+      };
+      dbname = lib.mkOption {
+        type = lib.types.str;
+        default = "inventree";
+        description = "Database name.";
+      };
+      dbuser = lib.mkOption {
+        type = lib.types.str;
+        default = "inventree";
+        description = "Database username.";
+      };
+      passwordFile = lib.mkOption {
+        type = with lib.types; nullOr path;
+        default = null;
+        example = "/run/keys/inventree-dbpassword";
+        description = ''
+          A file containing the password corresponding to
+          <option>database.dbuser</option>.
+        '';
+      };
+      createLocally = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = "Create the database and database user locally.";
+      };
+    };
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      default = "localhost";
+      example = "inventree.example.com";
+      description = ''
+        The INVENTREE_SITE_URL option defines the base URL for the
+        InvenTree server. This is a critical setting, and it is required
+        for correct operation of the server. If not specified, the
+        server will attempt to determine the site URL automatically -
+        but this may not always be correct!
+
+        The site URL is the URL that users will use to access the
+        InvenTree server. For example, if the server is accessible at
+        `https://inventree.example.com`, the site URL should be set to
+        `https://inventree.example.com`. Note that this is not
+        necessarily the same as the internal URL that the server is
+        running on - the internal URL will depend entirely on your
+        server configuration and may be obscured by a reverse proxy or
+        other such setup.
+      '';
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "inventree";
+      description = "User under which InvenTree runs.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "inventree";
+      description = "Group under which InvenTree runs.";
+    };
+
+    settings = lib.mkOption {
+      type =
+        with lib.types;
+        attrsOf (
+          nullOr (oneOf [
+            path
+            str
+          ])
+        );
+      default = { };
+      description = ''
+        InvenTree config options.
+
+        See [the documentation](https://docs.inventree.org/en/stable/start/config/) for available options.
+      '';
+      example = {
+        INVENTREE_CACHE_ENABLED = true;
+        INVENTREE_CACHE_HOST = "localhost";
+
+        INVENTREE_EMAIL_HOST = "smtp.example.com";
+        INVENTREE_EMAIL_PORT = 25;
+      };
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        services.inventree.settings = {
+          INVENTREE_DB_ENGINE = cfg.database.dbtype;
+          INVENTREE_DB_NAME = cfg.database.dbname;
+          INVENTREE_DB_HOST = cfg.database.dbhost;
+          INVENTREE_DB_USER = cfg.database.dbuser;
+          INVENTREE_DB_PORT = if cfg.database.dbport != null then toString cfg.database.dbport else null;
+
+          INVENTREE_CONFIG_FILE = lib.mkDefault "${cfg.dataDir}/config/config.yaml";
+          INVENTREE_OIDC_PRIVATE_KEY_FILE = lib.mkDefault "${cfg.dataDir}/config/oidc_private_key.txt";
+          INVENTREE_STATIC_ROOT = lib.mkDefault "${cfg.package}/lib/inventree/static";
+          INVENTREE_MEDIA_ROOT = lib.mkDefault "${cfg.dataDir}/data/media";
+          INVENTREE_BACKUP_DIR = lib.mkDefault "${cfg.dataDir}/data/backups";
+          INVENTREE_SITE_URL = lib.mkDefault "http://${cfg.domain}";
+          INVENTREE_PLUGIN_FILE = lib.mkDefault "${cfg.dataDir}/data/plugins/plugins.txt";
+          INVENTREE_PLUGIN_DIR = lib.mkDefault "${cfg.dataDir}/data/plugins";
+          INVENTREE_ADMIN_USER = lib.mkDefault "admin";
+          INVENTREE_ADMIN_EMAIL = lib.mkDefault "admin@${cfg.domain}";
+          INVENTREE_ADMIN_PASSWORD_FILE = lib.mkDefault cfg.adminPasswordFile;
+          INVENTREE_SECRET_KEY_FILE = lib.mkDefault cfg.secretKeyFile;
+          INVENTREE_AUTO_UPDATE = lib.mkDefault "false";
+        };
+        environment.systemPackages = [ manage ];
+        systemd.tmpfiles.rules = (
+          map (dir: "d ${dir} 0755 inventree inventree") [
+            "${cfg.dataDir}"
+            "${cfg.dataDir}/config"
+            "${cfg.dataDir}/data"
+            "${cfg.dataDir}/data/media"
+            "${cfg.dataDir}/data/backups"
+            "${cfg.dataDir}/data/plugins"
+          ]
+        );
+
+        services.postgresql = lib.mkIf pgsqlLocal {
+          enable = true;
+          ensureDatabases = [ cfg.database.dbname ];
+          ensureUsers = [
+            {
+              name = cfg.database.dbuser;
+              ensureDBOwnership = true;
+            }
+          ];
+        };
+
+        services.mysql = lib.mkIf mysqlLocal {
+          enable = true;
+          package = lib.mkDefault pkgs.mariadb;
+          ensureDatabases = [ cfg.database.dbname ];
+          ensureUsers = [
+            {
+              name = cfg.database.dbuser;
+              ensurePermissions = {
+                "${cfg.database.dbname}.*" = "ALL PRIVILEGES";
+              };
+            }
+          ];
+        };
+
+        services.nginx.enable = true;
+        services.nginx.virtualHosts.${cfg.domain} = {
+          locations =
+            let
+              unixPath = config.systemd.sockets.inventree-server.socketConfig.ListenStream;
+            in
+            {
+              "/" = {
+                extraConfig = ''
+                  proxy_set_header Host $host;
+                  proxy_set_header X-Forwarded-By $server_addr:$server_port;
+                  proxy_set_header X-Forwarded-For $remote_addr;
+                  proxy_set_header X-Forwarded-Proto $scheme;
+                  proxy_set_header X-Real-IP $remote_addr;
+                  proxy_set_header CLIENT_IP $remote_addr;
+
+                  proxy_pass_request_headers on;
+
+                  proxy_redirect off;
+
+                  client_max_body_size 100M;
+
+                  proxy_buffering off;
+                  proxy_request_buffering off;
+                '';
+                proxyPass = "http://unix:${unixPath}";
+              };
+              "/auth" = {
+                extraConfig = ''
+                  internal;
+                  proxy_pass_request_body off;
+                  proxy_set_header Content-Length "";
+                  proxy_set_header X-Original-URI $request_uri;
+                '';
+                proxyPass = "http://unix:${unixPath}:/auth/";
+              };
+              "/static/" = {
+                alias = "${cfg.settings.INVENTREE_STATIC_ROOT}/";
+                extraConfig = ''
+                  autoindex on;
+
+                  # Caching settings
+                  expires 30d;
+                  add_header Pragma public;
+                  add_header Cache-Control "public";
+                '';
+              };
+              "/media/" = {
+                alias = "${cfg.settings.INVENTREE_MEDIA_ROOT}/";
+                extraConfig = ''
+                  auth_request /auth;
+                  add_header Content-disposition "attachment";
+                '';
+              };
+            };
+        };
+
+        systemd.services.inventree-setup = {
+          description = "Inventree setup";
+          wantedBy = [ "inventree.target" ];
+          partOf = [ "inventree.target" ];
+          after = lib.optional mysqlLocal "mysql.service" ++ lib.optional pgsqlLocal "postgresql.target";
+          requires = lib.optional mysqlLocal "mysql.service" ++ lib.optional pgsqlLocal "postgresql.target";
+          before = [
+            "inventree-server.service"
+            "inventree-qcluster.service"
+          ];
+          serviceConfig = {
+            Type = "oneshot";
+            User = cfg.user;
+            Group = cfg.group;
+            RemainAfterExit = true;
+            PrivateTmp = true;
+          }
+          // lib.optionalAttrs (cfg.database.passwordFile != null) {
+            LoadCredential = "db_password:${cfg.database.passwordFile}";
+          };
+          environment = cfg.settings;
+          script = ''
+            set -euo pipefail
+            umask u=rwx,g=,o=
+
+            ${
+              lib.optionalString (cfg.database.passwordFile != null) ''
+                INVENTREE_DB_PASSWORD=$(<"$CREDENTIALS_DIRECTORY/db_password")
+              ''
+            } \
+            exec ${pkg}/bin/inventree migrate
+          '';
+        };
+
+        systemd.services.inventree-server = {
+          description = "Inventree Gunicorn service";
+          requiredBy = [ "inventree.target" ];
+          partOf = [ "inventree.target" ];
+          environment = cfg.settings;
+          serviceConfig = {
+            User = cfg.user;
+            Group = cfg.group;
+            StateDirectory = "inventree";
+            PrivateTmp = true;
+          }
+          // lib.optionalAttrs (cfg.database.passwordFile != null) {
+            LoadCredential = "db_password:${cfg.database.passwordFile}";
+          };
+          script = ''
+            ${
+              lib.optionalString (cfg.database.passwordFile != null) ''
+                INVENTREE_DB_PASSWORD=$(<"$CREDENTIALS_DIRECTORY/db_password")
+              ''
+            } \
+            exec ${pkg}/bin/gunicorn InvenTree.wsgi
+          '';
+        };
+
+        systemd.sockets.inventree-server = {
+          wantedBy = [ "sockets.target" ];
+          partOf = [ "inventree.target" ];
+          socketConfig.ListenStream = "/run/inventree/gunicorn.socket";
+        };
+
+        systemd.services.inventree-qcluster = {
+          description = "InvenTree qcluster server";
+          requiredBy = [ "inventree.target" ];
+          wantedBy = [ "inventree.target" ];
+          partOf = [ "inventree.target" ];
+          environment = cfg.settings;
+          serviceConfig = {
+            User = cfg.user;
+            Group = cfg.group;
+            StateDirectory = "inventree";
+            PrivateTmp = true;
+          }
+          // lib.optionalAttrs (cfg.database.passwordFile != null) {
+            LoadCredential = "db_password:${cfg.database.passwordFile}";
+          };
+          script = ''
+            ${
+              lib.optionalString (cfg.database.passwordFile != null) ''
+                INVENTREE_DB_PASSWORD=$(<"$CREDENTIALS_DIRECTORY/db_password")
+              ''
+            } \
+            exec ${pkg}/bin/inventree qcluster
+          '';
+        };
+
+        systemd.targets.inventree = {
+          description = "Target for all InvenTree services";
+          wantedBy = [ "multi-user.target" ];
+          wants = [ "network-online.target" ];
+          after = [ "network-online.target" ];
+        };
+
+        users = lib.optionalAttrs (cfg.user == cfg.user) {
+          users.${cfg.user} = {
+            group = cfg.group;
+            isSystemUser = true;
+            home = cfg.dataDir;
+          };
+          groups.${cfg.group}.members = [ cfg.user ];
+        };
+      }
+    ]
+  );
+}

nixos/modules/services/monitoring/flap-alerted.nix

@@ -0,0 +1,147 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.flap-alerted;
+
+  settingsArgs = lib.pipe cfg.settings [
+    (lib.mapAttrsToList (
+      name: value:
+      if value == null || value == false then
+        [ ]
+      else if value == true then
+        [ "-${name}" ]
+      else
+        [
+          "-${name}"
+          (toString value)
+        ]
+    ))
+    lib.concatLists
+  ];
+in
+
+{
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  options.services.flap-alerted = {
+    enable = lib.mkEnableOption "FlapAlerted";
+
+    package = lib.mkPackageOption pkgs "flap-alerted" { };
+
+    environmentFiles = lib.mkOption {
+      type = lib.types.listOf lib.types.path;
+      default = [ ];
+      example = [ "/run/secrets/flap-alerted.env" ];
+      description = ''
+        Files to load environment variables from.
+        This is useful to avoid putting secrets into the nix store.
+        See <https://github.com/Kioubit/FlapAlerted> for a list of options.
+      '';
+    };
+
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      description = ''
+        Extra command line arguments to pass to FlapAlerted.
+        See <https://github.com/Kioubit/FlapAlerted> for a list of options.
+      '';
+      default = [ ];
+    };
+
+    settings = lib.mkOption {
+      description = ''
+        Configuration of FlapAlerted.
+        See <https://github.com/Kioubit/FlapAlerted> for a list of options.
+      '';
+      default = { };
+
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf (
+          lib.types.nullOr (
+            lib.types.oneOf [
+              lib.types.str
+              lib.types.int
+              lib.types.bool
+            ]
+          )
+        );
+
+        options = {
+          asn = lib.mkOption {
+            type = lib.types.ints.u32;
+            description = "Your ASN number";
+          };
+
+          bgpListenAddress = lib.mkOption {
+            type = lib.types.str;
+            description = "Address to listen on for incoming BGP connections";
+            default = ":1790";
+          };
+
+          debug = lib.mkOption {
+            type = lib.types.bool;
+            description = "Enable debug mode (produces a lot of output)";
+            default = false;
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.flap-alerted = {
+      wantedBy = [ "multi-user.target" ];
+
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+
+      serviceConfig = {
+        User = "flap-alerted";
+        Group = "flap-alerted";
+        DynamicUser = true;
+
+        EnvironmentFile = cfg.environmentFiles;
+
+        ExecStart = lib.escapeShellArgs ([ (lib.getExe cfg.package) ] ++ settingsArgs ++ cfg.extraArgs);
+
+        # Hardening
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = [ "" ];
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+}

nixos/modules/services/networking/firewalld/default.nix

@@ -57,7 +57,19 @@ in
     systemd.services.firewalld = {
       aliases = [ "dbus-org.fedoraproject.FirewallD1.service" ];
       wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecReload = "${lib.getExe' pkgs.coreutils "kill"} -HUP $MAINPID";
+      serviceConfig.ExecReload = [
+        ""
+        "${lib.getExe' pkgs.coreutils "kill"} -HUP $MAINPID"
+      ];
+      reloadTriggers = [
+        config.environment.etc."firewalld/firewalld.conf".source
+      ]
+      ++ lib.mapAttrsToList (
+        name: _: config.environment.etc."firewalld/zones/${name}.xml".source
+      ) config.services.firewalld.zones
+      ++ lib.mapAttrsToList (
+        name: _: config.environment.etc."firewalld/services/${name}.xml".source
+      ) config.services.firewalld.services;
       environment.NIX_FIREWALLD_CONFIG_PATH = "${paths}/lib/firewalld";
     };
   };

nixos/modules/services/networking/wpa_supplicant.nix

@@ -123,7 +123,8 @@ let
             # set up imperative config file
             "+${pkgs.coreutils}/bin/touch /etc/wpa_supplicant/imperative.conf"
             "+${pkgs.coreutils}/bin/chmod 664 /etc/wpa_supplicant/imperative.conf"
-            "+${pkgs.coreutils}/bin/chown -R wpa_supplicant:wpa_supplicant /etc/wpa_supplicant"
+            "+${pkgs.coreutils}/bin/chown wpa_supplicant:wpa_supplicant /etc/wpa_supplicant"
+            "+${pkgs.coreutils}/bin/chown wpa_supplicant:wpa_supplicant /etc/wpa_supplicant/imperative.conf"
           ]
           ++ lib.optionals cfg.userControlled [
             # set up client sockets directory

nixos/modules/services/security/opensnitch.nix

@@ -207,6 +207,7 @@ in
       };
       tmpfiles.rules = [
         "d ${cfg.settings.Rules.Path} 0750 root root - -"
+        "L+ /etc/opensnitchd/network_aliases.json - - - - ${cfg.package}/etc/opensnitchd/network_aliases.json"
         "L+ /etc/opensnitchd/system-fw.json - - - - ${cfg.package}/etc/opensnitchd/system-fw.json"
       ];
     };

nixos/modules/services/torrent/bitmagnet.nix

@@ -14,6 +14,7 @@ let
     optional
     ;
   inherit (lib.types)
+    nullOr
     bool
     port
     str
@@ -43,10 +44,10 @@ in
             type = submodule {
               inherit freeformType;
               options = {
-                port = mkOption {
+                local_address = mkOption {
                   type = str;
                   default = ":3333";
-                  description = "HTTP server listen port";
+                  description = "HTTP server listen address";
                 };
               };
             };
@@ -94,6 +95,20 @@ in
               };
             };
           };
+          tmdb = mkOption {
+            default = { };
+            description = "TMDB api settings";
+            type = submodule {
+              inherit freeformType;
+              options = {
+                api_key = mkOption {
+                  type = nullOr str;
+                  default = null;
+                  description = "TMDB api key, to avoid api limits. Leave null to use the default shared key.";
+                };
+              };
+            };
+          };
         };
       };
     };
@@ -129,6 +144,7 @@ in
       ]
       ++ optional cfg.useLocalPostgresDB "postgresql.target";
       requires = optional cfg.useLocalPostgresDB "postgresql.target";
+      restartTriggers = [ config.environment.etc."xdg/bitmagnet/config.yml".source ];
       serviceConfig = {
         Type = "simple";
         DynamicUser = true;
@@ -138,6 +154,7 @@ in
         Restart = "on-failure";
         WorkingDirectory = "/var/lib/bitmagnet";
         StateDirectory = "bitmagnet";
+        BindReadOnlyPaths = [ "/etc/xdg/bitmagnet/config.yml" ];
 
         # Sandboxing (sorted by occurrence in https://www.freedesktop.org/software/systemd/man/systemd.exec.html)
         ProtectSystem = "strict";

nixos/modules/services/torrent/transmission.nix

@@ -238,10 +238,10 @@ in
         default = null;
         example = "770";
         description = ''
-          If not `null`, is used as the permissions
-          set by `system.activationScripts.transmission-daemon`
-          on the directories [](#opt-services.transmission.settings.download-dir),
-          [](#opt-services.transmission.settings.incomplete-dir).
+          If not `null`, is used as the permissions set by
+          `transmission-setup.service` on the directories
+          [](#opt-services.transmission.settings.download-dir),
+          [](#opt-services.transmission.settings.incomplete-dir)
           and [](#opt-services.transmission.settings.watch-dir).
           Note that you may also want to change
           [](#opt-services.transmission.settings.umask).

nixos/modules/services/web-apps/weblate.nix

@@ -9,6 +9,7 @@ let
   cfg = config.services.weblate;
 
   dataDir = "/var/lib/weblate";
+  cacheDir = "${dataDir}/cache";
   settingsDir = "${dataDir}/settings";
 
   finalPackage = cfg.package.overridePythonAttrs (old: {
@@ -362,6 +363,18 @@ in
       ];
       inherit environment;
       path = weblatePath;
+      # Weblate generates SSH wrappers with some preset options that use the
+      # absolute paths of the ssh and scp binaries internally.
+      # As the wrapper is only regenerated when the generator itself is changed,
+      # this absolute nix store path becomes unusable once ssh is updated and
+      # the path is garbage collected.
+      # As generating the wrappers is a quick operation, simply deleting the
+      # wrapper directory before service start ensures they are up to date.
+      preStart = ''
+        if [ -d "${cacheDir}/ssh" ]; then
+          rm -r "${cacheDir}/ssh"
+        fi
+      '';
       serviceConfig = {
         Type = "notify";
         NotifyAccess = "all";

nixos/modules/system/activation/pre-switch-check.nix

@@ -8,9 +8,18 @@ let
   preSwitchCheckScript = lib.concatLines (
     lib.mapAttrsToList (name: text: ''
       # pre-switch check ${name}
-      if ! (
+      #
+      # Run with errexit in a subshell that is not part of an `if`/`||`
+      # condition, so that `set -e` is actually honoured inside the
+      # check body.
+      set +e
+      (
+        set -e
         ${text}
-      ) >&2 ; then
+      ) >&2
+      _rc=$?
+      set -e
+      if [ "$_rc" -ne 0 ]; then
         echo "Pre-switch check '${name}' failed" >&2
         exit 1
       fi

nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py

@@ -3,6 +3,8 @@ import argparse
 import ctypes
 import datetime
 import errno
+import functools
+import hashlib
 import os
 import re
 import shutil
@@ -11,7 +13,7 @@ import sys
 import tempfile
 import warnings
 import json
-from typing import NamedTuple, Any, Sequence
+from typing import NamedTuple, Any, Protocol, Sequence
 from dataclasses import dataclass
 from pathlib import Path
 
@@ -19,9 +21,11 @@ from pathlib import Path
 EFI_SYS_MOUNT_POINT = Path("@efiSysMountPoint@")
 BOOT_MOUNT_POINT = Path("@bootMountPoint@")
 LOADER_CONF = EFI_SYS_MOUNT_POINT / "loader/loader.conf"  # Always stored on the ESP
-NIXOS_DIR = Path("@nixosDir@".strip("/")) # Path relative to the XBOOTLDR or ESP mount point
+NIXOS_DIR = Path(
+    "@nixosDir@".strip("/")
+)  # Path relative to the XBOOTLDR or ESP mount point
 TIMEOUT = "@timeout@"
-EDITOR = "@editor@" == "1" # noqa: PLR0133
+EDITOR = "@editor@" == "1"  # noqa: PLR0133
 CONSOLE_MODE = "@consoleMode@"
 BOOTSPEC_TOOLS = "@bootspecTools@"
 DISTRO_NAME = "@distroName@"
@@ -29,13 +33,16 @@ NIX = "@nix@"
 SYSTEMD = "@systemd@"
 CONFIGURATION_LIMIT = int("@configurationLimit@")
 REBOOT_FOR_BITLOCKER = bool("@rebootForBitlocker@")
-CAN_TOUCH_EFI_VARIABLES = "@canTouchEfiVariables@"
-GRACEFUL = "@graceful@"
+CAN_TOUCH_EFI_VARIABLES = "@canTouchEfiVariables@" == "1"
+GRACEFUL = "@graceful@" == "1"
 COPY_EXTRA_FILES = "@copyExtraFiles@"
 CHECK_MOUNTPOINTS = "@checkMountpoints@"
 STORE_DIR = "@storeDir@"
+BOOT_COUNTING_TRIES = "@bootCountingTries@"
+BOOT_COUNTING = "@bootCounting@" == "True"
 
-@dataclass
+
+@dataclass(frozen=True)
 class BootSpec:
     init: Path
     initrd: Path
@@ -50,12 +57,98 @@ class BootSpec:
     initrdSecrets: str | None = None  # noqa: N815
 
 
-libc = ctypes.CDLL("libc.so.6")
+class WriteBootFile(Protocol):
+    def write_boot_file(self, path: Path, *, critical: bool) -> None: ...
 
-FILE = None | int
 
-def run(cmd: Sequence[str | Path], stdout: FILE = None) -> subprocess.CompletedProcess[str]:
-    return subprocess.run(cmd, check=True, text=True, stdout=stdout)
+@dataclass
+class CopyWriter:
+    source: Path
+
+    def write_boot_file(self, path: Path, *, critical: bool) -> None:
+        if path.exists():
+            return
+        with tempfile.NamedTemporaryFile(
+            mode="wb",
+            dir=path.parent,
+            delete=False,
+            prefix=path.name,
+            suffix=".tmp",
+        ) as tmp:
+            with open(self.source, mode="rb") as source_file:
+                shutil.copyfileobj(source_file, tmp)
+            tmp.flush()
+            os.fsync(tmp.fileno())
+            tmp.close()
+            os.rename(tmp.name, path)
+
+
+@dataclass
+class InitrdWithSecretsWriter:
+    source: Path
+    initrd_secrets: Path
+    generation: int
+
+    def write_boot_file(self, path: Path, *, critical: bool) -> None:
+        # Secrets can change between rebuilds, so always rebuild from the
+        # pristine initrd into a temp file and rename into place.
+        with tempfile.NamedTemporaryFile(
+            mode="wb",
+            dir=path.parent,
+            delete=False,
+            prefix=path.name,
+            suffix=".tmp",
+        ) as tmp:
+            try:
+                with open(self.source, mode="rb") as source_file:
+                    shutil.copyfileobj(source_file, tmp)
+                tmp.flush()
+                run([self.initrd_secrets, tmp.name])
+                os.fsync(tmp.fileno())
+            except subprocess.CalledProcessError:
+                os.unlink(tmp.name)
+                if critical:
+                    print("failed to create initrd secrets!", file=sys.stderr)
+                    sys.exit(1)
+                # Keep the entry bootable by leaving at least a pristine
+                # initrd in place. CopyWriter is a no-op if one already
+                # exists.
+                CopyWriter(source=self.source).write_boot_file(path, critical=False)
+                print(
+                    "warning: failed to update initrd secrets for an older "
+                    f"generation ({self.generation}). The previous secrets "
+                    "in this initrd will continue to be used. To silence "
+                    "this warning, restore the secret files to their "
+                    "original locations or delete this generation.",
+                    file=sys.stderr,
+                )
+                return
+            except BaseException:
+                os.unlink(tmp.name)
+                raise
+            os.rename(tmp.name, path)
+
+
+@dataclass
+class ContentsWriter:
+    contents: bytes
+
+    def write_boot_file(self, path: Path, *, critical: bool) -> None:
+        if path.exists():
+            return
+        with tempfile.NamedTemporaryFile(
+            mode="wb",
+            dir=path.parent,
+            delete=False,
+            prefix=path.name,
+            suffix=".tmp",
+        ) as tmp:
+            tmp.write(self.contents)
+            tmp.flush()
+            os.fsync(tmp.fileno())
+            tmp.close()
+            os.rename(tmp.name, path)
+
 
 class SystemIdentifier(NamedTuple):
     profile: str | None
@@ -63,51 +156,131 @@ class SystemIdentifier(NamedTuple):
     specialisation: str | None
 
 
-def copy_if_not_exists(source: Path, dest: Path) -> None:
-    if not dest.exists():
-        tmpfd, tmppath = tempfile.mkstemp(dir=dest.parent, prefix=dest.name, suffix='.tmp.')
-        shutil.copyfile(source, tmppath)
-        os.fsync(tmpfd)
-        shutil.move(tmppath, dest)
+@dataclass
+class BootFile:
+    path: Path
+    writer: WriteBootFile
+
+    @staticmethod
+    def from_source(source: Path) -> "BootFile":
+        return BootFile(
+            path=boot_path(source),
+            writer=CopyWriter(source=source),
+        )
+
+    @staticmethod
+    def from_initrd(
+        generation: int,
+        source: Path,
+        initrd_secrets: Path | None,
+    ) -> "BootFile":
+        if initrd_secrets is None:
+            return BootFile.from_source(source)
+        else:
+            # We're trying to calculate a canonical path unique to
+            # this initrd and secret-appender. The boot_path is the
+            # canonical path for files that don't need modifications,
+            # so it serves as a perfect proxy for the unique
+            # information to combine for a combined unique path. The
+            # original paths themselves would have also been fine, but
+            # boot_path is more semantically representative, since
+            # it's the actual path whose uniqueness we're trying to
+            # ensure for other things.
+            combined = "\n".join(
+                [str(boot_path(source)), str(boot_path(initrd_secrets))]
+            )
+            combined_hash = hashlib.sha256(combined.encode("utf-8")).hexdigest()
+            return BootFile(
+                path=NIXOS_DIR / f"{combined_hash}-initrd.efi",
+                writer=InitrdWithSecretsWriter(
+                    source=source,
+                    initrd_secrets=initrd_secrets,
+                    generation=generation,
+                ),
+            )
+
+    @staticmethod
+    def from_entry(contents: bytes) -> tuple["BootFile", str]:
+        contents_hash = hashlib.sha256(contents).hexdigest()
+        path_prefix = f"nixos-{contents_hash}"
+        pat = re.compile(rf"{re.escape(path_prefix)}(\+[0-9]+(-[0-9]+)?)?\.conf")
+        path = None
+        for e in os.scandir(path=BOOT_MOUNT_POINT / "loader" / "entries"):
+            if pat.fullmatch(e.name) is None:
+                continue
+            # Ignore files whose content does not match the hash in their
+            # name so GC removes them and a fresh entry is written.
+            if hashlib.sha256(Path(e.path).read_bytes()).hexdigest() != contents_hash:
+                continue
+            path = Path("loader/entries") / e.name
+            break
+        if path is None:
+            counters = f"+{BOOT_COUNTING_TRIES}" if BOOT_COUNTING else ""
+            path = Path(f"loader/entries/{path_prefix}{counters}.conf")
+        return (
+            BootFile(
+                path=path,
+                writer=ContentsWriter(contents=contents),
+            ),
+            f"{path_prefix}.conf",
+        )
+
+
+# This gets its own type alias to document that the order is very
+# important. The order ensures that entry files are written after
+# their respective kernel / initrd / etc.
+type BootFileList = list[BootFile]
+
+
+libc = ctypes.CDLL("libc.so.6")
+
+FILE = None | int
+
+
+def run(
+    cmd: Sequence[str | Path], stdout: FILE = None
+) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(cmd, check=True, text=True, stdout=stdout, stderr=sys.stderr)
 
 
 def generation_dir(profile: str | None, generation: int) -> Path:
     if profile:
-        return Path(f"/nix/var/nix/profiles/system-profiles/{profile}-{generation}-link")
+        return Path(
+            f"/nix/var/nix/profiles/system-profiles/{profile}-{generation}-link"
+        )
     else:
         return Path(f"/nix/var/nix/profiles/system-{generation}-link")
 
-def system_dir(profile: str | None, generation: int, specialisation: str | None) -> Path:
+
+def system_dir(
+    profile: str | None, generation: int, specialisation: str | None
+) -> Path:
     d = generation_dir(profile, generation)
     if specialisation:
         return d / "specialisation" / specialisation
     else:
         return d
 
-BOOT_ENTRY = """title {title}
-sort-key {sort_key}
-version Generation {generation} {description}
-linux {kernel}
-initrd {initrd}
-options {kernel_params}
-"""
 
-def generation_conf_filename(profile: str | None, generation: int, specialisation: str | None) -> str:
-    pieces = [
-        "nixos",
-        profile or None,
-        "generation",
-        str(generation),
-        f"specialisation-{specialisation}" if specialisation else None,
-    ]
-    return "-".join(p for p in pieces if p) + ".conf"
-
-
-def write_loader_conf(profile: str | None, generation: int, specialisation: str | None) -> None:
+def write_loader_conf(default_entry_id: str | None) -> None:
     tmp = LOADER_CONF.with_suffix(".tmp")
-    with tmp.open('x') as f:
+    with tmp.open("x") as f:
         f.write(f"timeout {TIMEOUT}\n")
-        f.write("default %s\n" % generation_conf_filename(profile, generation, specialisation))
+        if default_entry_id is None:
+            # No generation matched the requested default config; fall back to
+            # the newest entry as determined by Boot Loader Spec sorting.
+            f.write("default nixos-*\n")
+        elif BOOT_COUNTING:
+            # `preferred` (systemd-boot >= 260) honours boot assessment, so a
+            # generation that exhausted its boot counter is skipped and we fall
+            # through to `default`. systemd-boot sorts entries with
+            # tries_left == 0 to the end of the list and resolves the `default`
+            # glob against that order, so `nixos-*` yields the newest entry that
+            # is not bad, or a bad one only if every nixos entry is bad.
+            f.write(f"preferred {default_entry_id}\n")
+            f.write("default nixos-*\n")
+        else:
+            f.write(f"default {default_entry_id}\n")
         if not EDITOR:
             f.write("editor 0\n")
         if REBOOT_FOR_BITLOCKER:
@@ -127,7 +300,9 @@ def get_bootspec(profile: str | None, generation: int) -> BootSpec:
             try:
                 bootspec_json = json.load(f)
             except ValueError as e:
-                print(f"error: Malformed Json: {e}, in {boot_json_path}", file=sys.stderr)
+                print(
+                    f"error: Malformed Json: {e}, in {boot_json_path}", file=sys.stderr
+                )
                 sys.exit(1)
     else:
         boot_json_str = run(
@@ -143,17 +318,18 @@ def get_bootspec(profile: str | None, generation: int) -> BootSpec:
         bootspec_json = json.loads(boot_json_str)
     return bootspec_from_json(bootspec_json)
 
+
 def bootspec_from_json(bootspec_json: dict[str, Any]) -> BootSpec:
-    specialisations = bootspec_json['org.nixos.specialisation.v1']
+    specialisations = bootspec_json["org.nixos.specialisation.v1"]
     specialisations = {k: bootspec_from_json(v) for k, v in specialisations.items()}
-    systemdBootExtension = bootspec_json.get('org.nixos.systemd-boot', {})
-    sortKey = systemdBootExtension.get('sortKey', 'nixos')
-    devicetree = systemdBootExtension.get('devicetree')
+    systemdBootExtension = bootspec_json.get("org.nixos.systemd-boot", {})
+    sortKey = systemdBootExtension.get("sortKey", "nixos")
+    devicetree = systemdBootExtension.get("devicetree")
 
     if devicetree:
         devicetree = Path(devicetree)
 
-    main_json = bootspec_json['org.nixos.bootspec.v1']
+    main_json = bootspec_json["org.nixos.bootspec.v1"]
     for attr in ("kernel", "initrd", "toplevel"):
         if attr in main_json:
             main_json[attr] = Path(main_json[attr])
@@ -165,67 +341,58 @@ def bootspec_from_json(bootspec_json: dict[str, Any]) -> BootSpec:
     )
 
 
-def copy_from_file(file: Path, dry_run: bool = False) -> Path:
-    """
-    Copy a file to the boot filesystem (XBOOTLDR if in use, otherwise ESP), basing the destination filename on the store path that's being copied from. Return the destination path, relative to the boot filesystem mountpoint.
-    """
+@functools.lru_cache(maxsize=None)
+def boot_path(file: Path) -> Path:
     store_file_path = file.resolve()
     suffix = store_file_path.name
     store_subdir = store_file_path.relative_to(STORE_DIR).parts[0]
-    efi_file_path = NIXOS_DIR / (f"{suffix}.efi" if suffix == store_subdir else f"{store_subdir}-{suffix}.efi")
-    if not dry_run:
-        copy_if_not_exists(store_file_path, BOOT_MOUNT_POINT / efi_file_path)
-    return efi_file_path
+    return NIXOS_DIR / (
+        f"{suffix}.efi" if suffix == store_subdir else f"{store_subdir}-{suffix}.efi"
+    )
 
 
-def write_entry(profile: str | None, generation: int, specialisation: str | None,
-                machine_id: str | None, bootspec: BootSpec, current: bool) -> None:
+def boot_file(
+    profile: str | None,
+    generation: int,
+    specialisation: str | None,
+    machine_id: str | None,
+    bootspec: BootSpec,
+) -> tuple[BootFileList, str]:
     if specialisation:
         bootspec = bootspec.specialisations[specialisation]
-    kernel = copy_from_file(bootspec.kernel)
-    initrd = copy_from_file(bootspec.initrd)
-    devicetree = copy_from_file(bootspec.devicetree) if bootspec.devicetree is not None else None
+    kernel = BootFile.from_source(bootspec.kernel)
+    initrd = BootFile.from_initrd(
+        generation,
+        bootspec.initrd,
+        Path(bootspec.initrdSecrets) if bootspec.initrdSecrets is not None else None,
+    )
+    devicetree = None
+    if bootspec.devicetree is not None:
+        devicetree = BootFile.from_source(bootspec.devicetree)
+
+    kernel_params = " ".join([f"init={bootspec.init}"] + bootspec.kernelParams)
+    build_time = int(system_dir(profile, generation, specialisation).stat().st_ctime)
+    build_date = datetime.datetime.fromtimestamp(build_time).strftime("%F")
 
     title = "{name}{profile}{specialisation}".format(
         name=DISTRO_NAME,
         profile=" [" + profile + "]" if profile else "",
-        specialisation=" (%s)" % specialisation if specialisation else "")
-
-    try:
-        if bootspec.initrdSecrets is not None:
-            run([bootspec.initrdSecrets, BOOT_MOUNT_POINT / initrd])
-    except subprocess.CalledProcessError:
-        if current:
-            print("failed to create initrd secrets!", file=sys.stderr)
-            sys.exit(1)
-        else:
-            print("warning: failed to create initrd secrets "
-                  f'for "{title} - Configuration {generation}", an older generation', file=sys.stderr)
-            print("note: this is normal after having removed "
-                  "or renamed a file in `boot.initrd.secrets`", file=sys.stderr)
-    entry_file = BOOT_MOUNT_POINT / "loader/entries" / generation_conf_filename(profile, generation, specialisation)
-    tmp_path = entry_file.with_suffix(".tmp")
-    kernel_params = "init=%s " % bootspec.init
-
-    kernel_params = kernel_params + " ".join(bootspec.kernelParams)
-    build_time = int(system_dir(profile, generation, specialisation).stat().st_ctime)
-    build_date = datetime.datetime.fromtimestamp(build_time).strftime('%F')
-
-    with tmp_path.open("w") as f:
-        f.write(BOOT_ENTRY.format(title=title,
-                    sort_key=bootspec.sortKey,
-                    generation=generation,
-                    kernel=f"/{kernel}",
-                    initrd=f"/{initrd}",
-                    kernel_params=kernel_params,
-                    description=f"{bootspec.label}, built on {build_date}"))
-        if machine_id is not None:
-            f.write("machine-id %s\n" % machine_id)
-        if devicetree is not None:
-            f.write(f"devicetree /{devicetree}\n")
-        f.flush()
-        os.fsync(f.fileno())
-    tmp_path.rename(entry_file)
+        specialisation=" (%s)" % specialisation if specialisation else "",
+    )
+    description = f"Generation {generation} {bootspec.label}, built on {build_date}"
+    boot_entry = [
+        f"title {title}",
+        f"version {description}",
+        f"linux /{str(kernel.path)}",
+        f"initrd /{str(initrd.path)}",
+        f"options {kernel_params}",
+        f"machine-id {machine_id}" if machine_id is not None else None,
+        f"devicetree /{str(devicetree.path)}" if devicetree is not None else None,
+        f"sort-key {bootspec.sortKey}",
+    ]
+    contents = "\n".join(filter(None, boot_entry))
+    entry, bootctl_id = BootFile.from_entry(contents.encode("utf-8"))
+    return (list(filter(None, [kernel, initrd, devicetree, entry])), bootctl_id)
 
 
 def get_generations(profile: str | None = None) -> list[SystemIdentifier]:
@@ -245,43 +412,15 @@ def get_generations(profile: str | None = None) -> list[SystemIdentifier]:
     configurationLimit = CONFIGURATION_LIMIT
     configurations = [
         SystemIdentifier(
-            profile=profile,
-            generation=int(line.split()[0]),
-            specialisation=None
+            profile=profile, generation=int(line.split()[0]), specialisation=None
         )
         for line in gen_lines
     ]
     return configurations[-configurationLimit:]
 
 
-def remove_old_entries(gens: list[SystemIdentifier]) -> None:
-    rex_profile = re.compile(r"^nixos-(.*)-generation-.*\.conf$")
-    rex_generation = re.compile(r"^nixos.*-generation-([0-9]+)(-specialisation-.*)?\.conf$")
-    known_paths = []
-    for gen in gens:
-        bootspec = get_bootspec(gen.profile, gen.generation)
-        known_paths.append(copy_from_file(bootspec.kernel, True).name)
-        known_paths.append(copy_from_file(bootspec.initrd, True).name)
-        if bootspec.devicetree is not None:
-            known_paths.append(copy_from_file(bootspec.devicetree, True).name)
-    for path in (BOOT_MOUNT_POINT / "loader/entries").glob("nixos*-generation-[1-9]*.conf", case_sensitive=False):
-        if rex_profile.match(path.name):
-            prof = rex_profile.sub(r"\1", path.name)
-        else:
-            prof = None
-        try:
-            gen_number = int(rex_generation.sub(r"\1", path.name))
-        except ValueError:
-            continue
-        if (prof, gen_number, None) not in gens:
-            path.unlink()
-    for path in (BOOT_MOUNT_POINT / NIXOS_DIR).iterdir():
-        if path.name not in known_paths and not path.is_dir():
-            path.unlink()
-
-
 def cleanup_esp() -> None:
-    for path in (EFI_SYS_MOUNT_POINT / "loader/entries").glob("nixos*"):
+    for path in (EFI_SYS_MOUNT_POINT / "loader" / "entries").glob("nixos*"):
         path.unlink()
     nixos_dir = EFI_SYS_MOUNT_POINT / NIXOS_DIR
     if nixos_dir.is_dir():
@@ -291,12 +430,13 @@ def cleanup_esp() -> None:
 def get_profiles() -> list[str]:
     system_profiles = Path("/nix/var/nix/profiles/system-profiles/")
     if system_profiles.is_dir():
-        return [x.name
-            for x in system_profiles.iterdir()
-            if not x.name.endswith("-link")]
+        return [
+            x.name for x in system_profiles.iterdir() if not x.name.endswith("-link")
+        ]
     else:
         return []
 
+
 def install_bootloader(args: argparse.Namespace) -> None:
     try:
         with open("/etc/machine-id") as machine_file:
@@ -307,7 +447,10 @@ def install_bootloader(args: argparse.Namespace) -> None:
         machine_id = None
 
     if os.getenv("NIXOS_INSTALL_GRUB") == "1":
-        warnings.warn("NIXOS_INSTALL_GRUB env var deprecated, use NIXOS_INSTALL_BOOTLOADER", DeprecationWarning)
+        warnings.warn(
+            "NIXOS_INSTALL_GRUB env var deprecated, use NIXOS_INSTALL_BOOTLOADER",
+            DeprecationWarning,
+        )
         os.environ["NIXOS_INSTALL_BOOTLOADER"] = "1"
 
     # flags to pass to bootctl install/update
@@ -316,10 +459,10 @@ def install_bootloader(args: argparse.Namespace) -> None:
     if BOOT_MOUNT_POINT != EFI_SYS_MOUNT_POINT:
         bootctl_flags.append(f"--boot-path={BOOT_MOUNT_POINT}")
 
-    if CAN_TOUCH_EFI_VARIABLES != "1":
+    if not CAN_TOUCH_EFI_VARIABLES:
         bootctl_flags.append("--no-variables")
 
-    if GRACEFUL == "1":
+    if GRACEFUL:
         bootctl_flags.append("--graceful")
 
     if os.getenv("NIXOS_INSTALL_BOOTLOADER") == "1":
@@ -351,13 +494,18 @@ def install_bootloader(args: argparse.Namespace) -> None:
         #  ESP: /boot (/dev/disk/by-partuuid/9b39b4c4-c48b-4ebf-bfea-a56b2395b7e0)
         # File: ├─/EFI/systemd/HashTool.efi
         #       └─/EFI/systemd/systemd-bootx64.efi (systemd-boot 255.2)
-        installed_match = re.search(r"^\W+.*/EFI/(?:BOOT|systemd)/.*\.efi \(systemd-boot ([\d.]+[^)]*)\)$",
-                      installed_out, re.IGNORECASE | re.MULTILINE)
+        installed_match = re.search(
+            r"^\W+.*/EFI/(?:BOOT|systemd)/.*\.efi \(systemd-boot ([\d.]+[^)]*)\)$",
+            installed_out,
+            re.IGNORECASE | re.MULTILINE,
+        )
 
         available_match = re.search(r"^\((.*)\)$", available_out)
 
         if installed_match is None:
-            raise Exception("Could not find any previously installed systemd-boot. If you are switching to systemd-boot from a different bootloader, you need to run `nixos-rebuild switch --install-bootloader`")
+            raise Exception(
+                "Could not find any previously installed systemd-boot. If you are switching to systemd-boot from a different bootloader, you need to run `nixos-rebuild switch --install-bootloader`"
+            )
 
         if available_match is None:
             raise Exception("could not determine systemd-boot version")
@@ -366,7 +514,11 @@ def install_bootloader(args: argparse.Namespace) -> None:
         available_version = available_match.group(1)
 
         if installed_version < available_version:
-            print("updating systemd-boot from %s to %s" % (installed_version, available_version), file=sys.stderr)
+            print(
+                "updating systemd-boot from %s to %s"
+                % (installed_version, available_version),
+                file=sys.stderr,
+            )
             run(
                 [f"{SYSTEMD}/bin/bootctl", f"--esp-path={EFI_SYS_MOUNT_POINT}"]
                 + bootctl_flags
@@ -380,24 +532,56 @@ def install_bootloader(args: argparse.Namespace) -> None:
     for profile in get_profiles():
         gens += get_generations(profile)
 
-    remove_old_entries(gens)
+    if not gens:
+        # With zero generations we would garbage-collect every kernel,
+        # initrd and loader entry off the ESP, leaving the system
+        # unbootable.
+        print(
+            "error: no system generations found in /nix/var/nix/profiles, "
+            "refusing to remove all boot loader entries",
+            file=sys.stderr,
+        )
+        sys.exit(1)
+
+    boot_files: BootFileList = []
+    critical_paths: set[Path] = set()
+
+    default_config = Path(args.default_config)
+    default_entry_id: str | None = None
 
     for gen in gens:
-        try:
-            bootspec = get_bootspec(gen.profile, gen.generation)
-            is_default = Path(bootspec.init).parent == Path(args.default_config)
-            write_entry(*gen, machine_id, bootspec, current=is_default)
-            for specialisation in bootspec.specialisations.keys():
-                write_entry(gen.profile, gen.generation, specialisation, machine_id, bootspec, current=is_default)
+        bootspec = get_bootspec(gen.profile, gen.generation)
+        is_default = Path(bootspec.init).parent == default_config
+        new_boot_files, new_bootctl_id = boot_file(*gen, machine_id, bootspec)
+        boot_files.extend(new_boot_files)
+        if is_default:
+            default_entry_id = new_bootctl_id
+            critical_paths.update(bf.path for bf in new_boot_files)
+        for specialisation_name, specialisation in bootspec.specialisations.items():
+            is_default = Path(specialisation.init).parent == default_config
+            new_boot_files, new_bootctl_id = boot_file(
+                gen.profile,
+                gen.generation,
+                specialisation_name,
+                machine_id,
+                bootspec,
+            )
+            boot_files.extend(new_boot_files)
             if is_default:
-                write_loader_conf(*gen)
-        except OSError as e:
-            # See https://github.com/NixOS/nixpkgs/issues/114552
-            if e.errno == errno.EINVAL:
-                profile = f"profile '{gen.profile}'" if gen.profile else "default profile"
-                print("ignoring {} in the list of boot entries because of the following error:\n{}".format(profile, e), file=sys.stderr)
-            else:
-                raise e
+                default_entry_id = new_bootctl_id
+                critical_paths.update(bf.path for bf in new_boot_files)
+
+    # Garbage-collect stale kernels/initrds/entries before re-populating extra
+    # files, so that user-supplied extraEntries (which may also live under
+    # loader/entries and start with `nixos-`) are not removed again.
+    garbage_collect(boot_files)
+
+    write_boot_files(boot_files, critical_paths)
+
+    write_loader_conf(default_entry_id)
+
+    remove_extra_files()
+    run([COPY_EXTRA_FILES])
 
     if BOOT_MOUNT_POINT != EFI_SYS_MOUNT_POINT:
         # Cleanup any entries in ESP if xbootldrMountPoint is set.
@@ -405,6 +589,8 @@ def install_bootloader(args: argparse.Namespace) -> None:
         # automatically, as we don't have information about the mount point anymore.
         cleanup_esp()
 
+
+def remove_extra_files() -> None:
     extra_files_dir = BOOT_MOUNT_POINT / NIXOS_DIR / ".extra-files"
     for root, _, files in extra_files_dir.walk(top_down=False):
         relative_root = root.relative_to(extra_files_dir)
@@ -421,12 +607,45 @@ def install_bootloader(args: argparse.Namespace) -> None:
 
     extra_files_dir.mkdir(parents=True, exist_ok=True)
 
-    run([COPY_EXTRA_FILES])
+
+def garbage_collect(gc_roots: BootFileList) -> None:
+    keep = {BOOT_MOUNT_POINT / gc_root.path for gc_root in gc_roots}
+
+    def delete_path(e: os.DirEntry) -> None:
+        if e.is_file(follow_symlinks=True) and Path(e.path) not in keep:
+            os.remove(e.path)
+
+    for e in os.scandir(BOOT_MOUNT_POINT / NIXOS_DIR):
+        delete_path(e)
+
+    for e in os.scandir(BOOT_MOUNT_POINT / "loader" / "entries"):
+        match = re.fullmatch(r"nixos-.+\.conf", e.name)
+        if match:
+            delete_path(e)
+
+
+def write_boot_files(boot_files: BootFileList, critical_paths: set[Path]) -> None:
+    # Deduplicate by destination path so shared files are written once.
+    seen: set[Path] = set()
+    for boot_file in boot_files:
+        if boot_file.path in seen:
+            continue
+        seen.add(boot_file.path)
+        boot_file.writer.write_boot_file(
+            BOOT_MOUNT_POINT / boot_file.path,
+            critical=boot_file.path in critical_paths,
+        )
 
 
 def main() -> None:
-    parser = argparse.ArgumentParser(description=f"Update {DISTRO_NAME}-related systemd-boot files")
-    parser.add_argument('default_config', metavar='DEFAULT-CONFIG', help=f"The default {DISTRO_NAME} config to boot")
+    parser = argparse.ArgumentParser(
+        description=f"Update {DISTRO_NAME}-related systemd-boot files"
+    )
+    parser.add_argument(
+        "default_config",
+        metavar="DEFAULT-CONFIG",
+        help=f"The default {DISTRO_NAME} config to boot",
+    )
     args = parser.parse_args()
 
     run([CHECK_MOUNTPOINTS])
@@ -440,13 +659,18 @@ def main() -> None:
         # event sync the efi filesystem after each update.
         rc = libc.syncfs(os.open(f"{BOOT_MOUNT_POINT}", os.O_RDONLY))
         if rc != 0:
-            print(f"could not sync {BOOT_MOUNT_POINT}: {os.strerror(rc)}", file=sys.stderr)
+            print(
+                f"could not sync {BOOT_MOUNT_POINT}: {os.strerror(rc)}", file=sys.stderr
+            )
 
         if BOOT_MOUNT_POINT != EFI_SYS_MOUNT_POINT:
             rc = libc.syncfs(os.open(EFI_SYS_MOUNT_POINT, os.O_RDONLY))
             if rc != 0:
-                print(f"could not sync {EFI_SYS_MOUNT_POINT}: {os.strerror(rc)}", file=sys.stderr)
+                print(
+                    f"could not sync {EFI_SYS_MOUNT_POINT}: {os.strerror(rc)}",
+                    file=sys.stderr,
+                )
 
 
-if __name__ == '__main__':
+if __name__ == "__main__":
     main()

nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix

@@ -97,6 +97,9 @@ let
           '') cfg.extraEntries
         )}
       '';
+
+      bootCountingTries = cfg.bootCounting.tries;
+      bootCounting = if cfg.bootCounting.enable then "True" else "False";
     };
   };
 
@@ -417,6 +420,26 @@ in
       '';
     };
 
+    bootCounting = {
+      enable = mkEnableOption ''
+        [Automatic Boot Assessment](https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT/).
+
+        New boot entries are written with a boot counter in the file name. On
+        each boot, systemd-boot decrements the counter; once the booted system
+        reaches `boot-complete.target`, `systemd-bless-boot.service` removes the
+        counter and marks the entry as good. An entry whose counter reaches zero
+        is considered bad and will be skipped in favour of an older generation
+      '';
+      tries = mkOption {
+        default = 3;
+        type = types.ints.positive;
+        description = ''
+          Number of boot attempts a freshly written entry is given before it is
+          considered bad.
+        '';
+      };
+    };
+
     rebootForBitlocker = mkOption {
       default = false;
 

nixos/modules/system/boot/timesyncd.nix

@@ -1,26 +1,37 @@
-{ config, lib, ... }:
-
-with lib;
+{
+  config,
+  lib,
+  utils,
+  ...
+}:
 
 let
   cfg = config.services.timesyncd;
 in
 {
 
+  imports = [
+    (lib.mkRemovedOptionModule [
+      "services"
+      "timesyncd"
+      "extraConfig"
+    ] "Use services.timesyncd.settings.Time instead.")
+  ];
+
   options = {
 
-    services.timesyncd = with types; {
-      enable = mkOption {
+    services.timesyncd = {
+      enable = lib.mkOption {
         default = !config.boot.isContainer;
-        defaultText = literalExpression "!config.boot.isContainer";
-        type = bool;
+        defaultText = lib.literalExpression "!config.boot.isContainer";
+        type = lib.types.bool;
         description = ''
           Enables the systemd NTP client daemon.
         '';
       };
-      servers = mkOption {
+      servers = lib.mkOption {
         default = null;
-        type = nullOr (listOf str);
+        type = lib.types.nullOr (lib.types.listOf lib.types.str);
         description = ''
           The set of NTP servers from which to synchronise.
 
@@ -31,10 +42,10 @@ in
           See {manpage}`timesyncd.conf(5)` for details.
         '';
       };
-      fallbackServers = mkOption {
+      fallbackServers = lib.mkOption {
         default = config.networking.timeServers;
-        defaultText = literalExpression "config.networking.timeServers";
-        type = nullOr (listOf str);
+        defaultText = lib.literalExpression "config.networking.timeServers";
+        type = lib.types.nullOr (lib.types.listOf lib.types.str);
         description = ''
           The set of fallback NTP servers from which to synchronise.
 
@@ -45,21 +56,23 @@ in
           See {manpage}`timesyncd.conf(5)` for details.
         '';
       };
-      extraConfig = mkOption {
-        default = "";
-        type = lines;
-        example = ''
-          PollIntervalMaxSec=180
-        '';
+      settings.Time = lib.mkOption {
+        default = { };
+        type = lib.types.submodule {
+          freeformType = lib.types.attrsOf utils.systemdUtils.unitOptions.unitOption;
+        };
+        example = {
+          PollIntervalMaxSec = 180;
+        };
         description = ''
-          Extra config options for systemd-timesyncd. See
-          {manpage}`timesyncd.conf(5)` for available options.
+          Settings for systemd-timesyncd. See {manpage}`timesyncd.conf(5)` for
+          available options.
         '';
       };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     systemd.additionalUpstreamSystemUnits = [ "systemd-timesyncd.service" ];
 
@@ -76,16 +89,17 @@ in
       environment.LD_LIBRARY_PATH = config.system.nssModules.path;
     };
 
-    environment.etc."systemd/timesyncd.conf".text = ''
-      [Time]
-    ''
-    + optionalString (cfg.servers != null) ''
-      NTP=${concatStringsSep " " cfg.servers}
-    ''
-    + optionalString (cfg.fallbackServers != null) ''
-      FallbackNTP=${concatStringsSep " " cfg.fallbackServers}
-    ''
-    + cfg.extraConfig;
+    services.timesyncd.settings.Time = lib.mkMerge [
+      (lib.mkIf (cfg.servers != null) {
+        NTP = lib.mkDefault (lib.concatStringsSep " " cfg.servers);
+      })
+      (lib.mkIf (cfg.fallbackServers != null) {
+        FallbackNTP = lib.mkDefault (lib.concatStringsSep " " cfg.fallbackServers);
+      })
+    ];
+
+    environment.etc."systemd/timesyncd.conf".text =
+      utils.systemdUtils.lib.settingsToSections cfg.settings;
 
     users.users.systemd-timesync = {
       uid = config.ids.uids.systemd-timesync;

nixos/modules/system/etc/etc-activation.nix

@@ -173,5 +173,18 @@
 
     })
 
+    (lib.mkIf (config.system.etc.overlay.enable && !config.system.etc.overlay.mutable) {
+      # Systemd requires /etc/machine-id exists or can be initialized on first
+      # boot. This file should not be part of an image or system config because
+      # it is unique to the machine, so it is initialized at first boot and
+      # persisted in the system state directory, /var/lib/nixos.
+      environment.etc."machine-id".source = lib.mkDefault "/var/lib/nixos/machine-id";
+      boot.initrd.systemd.tmpfiles.settings.machine-id."/sysroot/var/lib/nixos/machine-id".f =
+        lib.mkDefault
+          {
+            argument = "uninitialized";
+          };
+    })
+
   ];
 }

nixos/modules/tasks/network-interfaces-scripted.nix

@@ -430,8 +430,9 @@ let
                 rm -f /run/${n}.interfaces
               '';
               reload = ''
+                # shellcheck disable=SC2013
                 # Un-enslave child interfaces (old list of interfaces)
-                for interface in `cat /run/${n}.interfaces`; do
+                for interface in $(cat /run/${n}.interfaces); do
                   ip link set dev "$interface" nomaster up
                 done
 

nixos/modules/virtualisation/qemu-vm.nix

@@ -1379,6 +1379,7 @@ in
         "-device usb-tablet,bus=usb-bus.0"
       ])
       (mkIf pkgs.stdenv.hostPlatform.isAarch [
+        "-device virtio-gpu-pci"
         "-device usb-ehci,id=usb0"
         "-device usb-kbd"
         "-device usb-tablet"

nixos/tests/all-tests.nix

@@ -597,6 +597,7 @@ in
   firezone = runTest ./firezone/firezone.nix;
   fish = runTest ./fish.nix;
   flannel = runTestOn [ "x86_64-linux" ] ./flannel.nix;
+  flap-alerted = runTest ./flap-alerted.nix;
   flaresolverr = runTest ./flaresolverr.nix;
   flood = runTest ./flood.nix;
   fluent-bit = runTest ./fluent-bit.nix;
@@ -801,6 +802,7 @@ in
   installer = handleTest ./installer.nix { systemdStage1 = false; };
   installer-systemd-stage-1 = handleTest ./installer.nix { systemdStage1 = true; };
   intune = runTest ./intune.nix;
+  inventree = runTest ./inventree.nix;
   invidious = runTest ./invidious.nix;
   invoiceplane = runTest ./invoiceplane.nix;
   iodine = runTest ./iodine.nix;
@@ -940,7 +942,7 @@ in
   lomiri-system-settings = runTest ./lomiri-system-settings.nix;
   lorri = handleTest ./lorri/default.nix { };
   luks = runTest ./luks.nix;
-  lvm2 = handleTest ./lvm2 { };
+  lvm2 = import ./lvm2 { inherit pkgs runTest; };
   lxc = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./lxc;
   lxd-image-server = runTest ./lxd-image-server.nix;
   lxqt = runTest ./lxqt.nix;
@@ -1121,7 +1123,6 @@ in
   nimdow = runTest ./nimdow.nix;
   nipap = runTest ./web-apps/nipap.nix;
   nitter = runTest ./nitter.nix;
-  nix-channel = pkgs.callPackage ../modules/config/nix-channel/test.nix { };
   nix-config = runTest ./nix-config.nix;
   nix-daemon-firewall = runTest ./nix-daemon-firewall.nix;
   nix-daemon-unprivileged = runTest ./nix-daemon-unprivileged.nix;
@@ -1593,7 +1594,10 @@ in
   systemd = runTest ./systemd.nix;
   systemd-analyze = runTest ./systemd-analyze.nix;
   systemd-binfmt = handleTestOn [ "x86_64-linux" ] ./systemd-binfmt.nix { };
-  systemd-boot = import ./systemd-boot.nix { inherit runTest runTestOn; };
+  systemd-boot = import ./systemd-boot.nix {
+    inherit runTest runTestOn;
+    inherit (pkgs) lib;
+  };
   systemd-bpf = runTest ./systemd-bpf.nix;
   systemd-capsules = runTest ./systemd-capsules.nix;
   systemd-confinement = handleTest ./systemd-confinement { };
@@ -1662,6 +1666,7 @@ in
   systemd-sysusers-immutable = runTest ./systemd-sysusers-immutable.nix;
   systemd-sysusers-mutable = runTest ./systemd-sysusers-mutable.nix;
   systemd-sysusers-password-option-override-ordering = runTest ./systemd-sysusers-password-option-override-ordering.nix;
+  systemd-timesyncd = runTest ./systemd-timesyncd.nix;
   systemd-timesyncd-nscd-dnssec = runTest ./systemd-timesyncd-nscd-dnssec.nix;
   systemd-user-linger = runTest ./systemd-user-linger.nix;
   systemd-user-linger-purge = runTest ./systemd-user-linger-purge.nix;
@@ -1844,7 +1849,7 @@ in
   zammad = runTest ./zammad.nix;
   zenohd = runTest ./zenohd.nix;
   zeronet-conservancy = runTest ./zeronet-conservancy.nix;
-  zfs = handleTest ./zfs.nix { };
+  zfs = import ./zfs.nix { inherit system pkgs runTest; };
   zigbee2mqtt = runTest ./zigbee2mqtt.nix;
   zipline = runTest ./zipline.nix;
   zoneminder = runTest ./zoneminder.nix;

nixos/tests/caddy.nix

@@ -73,7 +73,7 @@
           services.caddy = {
             package = pkgs.caddy.withPlugins {
               plugins = [ "github.com/caddyserver/replace-response@v0.0.0-20250618171559-80962887e4c6" ];
-              hash = "sha256-kKWXpxEAn23yud8tcgw7FFOaxLjoodZ/cuM1239TRoY=";
+              hash = "sha256-0N/bQAM5yT6g9UAteWsfxofGcelmU/NDTroS2oL43Gs=";
             };
             configFile = pkgs.writeText "Caddyfile" ''
               {

nixos/tests/chhoto-url.nix

@@ -38,7 +38,7 @@
 
     resp = json.loads(machine.succeed("curl localhost:8000/api/getconfig"))
     assert resp["success"] is False
-    assert resp["reason"] == "No valid authentication was found"
+    assert resp["reason"] == "No valid authentication."
 
     resp = json.loads(machine.succeed("curl -H 'X-API-Key: api_key' localhost:8000/api/getconfig"))
     expected_version = "${config.nodes.machine.services.chhoto-url.package.version}"

nixos/tests/flap-alerted.nix

@@ -0,0 +1,128 @@
+{ config, lib, ... }:
+
+{
+  name = "flap-alerted";
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  nodes.machine = {
+    services.flap-alerted = {
+      enable = true;
+      settings = {
+        asn = 4213370001;
+        bgpListenAddress = ":1790";
+        routeChangeCounter = 5;
+        overThresholdTarget = 1;
+      };
+    };
+
+    services.bird = {
+      enable = true;
+      preCheckConfig = ''
+        mkdir -p /tmp/bird
+        touch /tmp/bird/routes.conf
+      '';
+      config = ''
+        router id 192.168.1.1;
+
+        protocol device { }
+
+        protocol bgp flapalerted {
+          local 2001:db8:1::1 as 4213370001;
+          neighbor ::1 as 4213370001 port 1790;
+
+          ipv4 {
+            add paths on;
+            export all;
+            import none;
+            extended next hop on;
+          };
+
+          ipv6 {
+            add paths on;
+            export all;
+            import none;
+          };
+        }
+
+        protocol static {
+          include "/tmp/bird/routes.conf";
+
+          ipv4 {
+            import all;
+            export none;
+          };
+        }
+      '';
+    };
+
+    systemd.services.bird.serviceConfig.BindReadOnlyPaths = [ "/tmp/bird" ];
+
+    systemd.tmpfiles.settings.bird-static-routes."/tmp/bird/routes.conf".f = { };
+  };
+
+  interactive.sshBackdoor.enable = true;
+  interactive.defaults.virtualisation.graphics = false;
+
+  interactive.nodes.machine = {
+    services.flap-alerted.settings.httpAPIListenAddress = ":8699";
+    networking.firewall.allowedTCPPorts = [ 8699 ];
+    virtualisation.forwardPorts = [
+      {
+        from = "host";
+        host.port = 8699;
+        guest.port = 8699;
+      }
+    ];
+  };
+
+  testScript = ''
+    import json
+    import random
+    import time
+
+    machine.log(machine.succeed("systemd-analyze security flap-alerted.service --threshold=11 --no-pager"))
+
+    machine.wait_for_unit("bird.service")
+    machine.wait_for_unit("flap-alerted.service")
+    machine.wait_for_open_port(1790)
+    machine.wait_for_open_port(8699)
+
+    resp = json.loads(machine.succeed("curl localhost:8699/capabilities"))
+    expected_version = "v${config.nodes.machine.services.flap-alerted.package.version}"
+    assert resp["Version"] == expected_version
+
+    for _ in range(10):
+      resp = json.loads(machine.succeed("curl localhost:8699/sessions"))
+      if len(resp) == 1: break
+      time.sleep(1)
+    else:
+      assert False, "failed to establish bgp session"
+    assert resp[0]["RouterID"] == "192.168.1.1"
+
+    resp = json.loads(machine.succeed("curl localhost:8699/flaps/active/compact"))
+    assert resp == []
+
+    def flap():
+      route = lambda idx, gw: f"""
+        route 10.0.{idx}.0/24 via 10.254.254.{gw} dev \"eth0\" onlink {{
+          bgp_path.prepend(4213370002);
+          bgp_path.prepend({4213370002 + gw});
+        }};
+      """
+      with open("routes.conf", "w") as f:
+        for i in range(1, 4): # stable routes
+          f.write(route(i, i))
+        for i in range(4, 7): # flappy routes
+          f.write(route(i, random.randint(1, 254)))
+      machine.copy_from_host("routes.conf", "/tmp/bird/routes.conf")
+      machine.succeed("birdc configure")
+
+    t = time.time()
+    while time.time() - t < 70:
+      flap()
+      time.sleep(1)
+
+    resp = json.loads(machine.succeed("curl localhost:8699/flaps/active/compact"))
+    assert sorted(x["Prefix"] for x in resp) == ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"]
+  '';
+}

nixos/tests/gocryptfs.nix

@@ -14,7 +14,8 @@
       ];
 
       specialisation.fstab-test.configuration = {
-        fileSystems."/plain" = {
+        # This can't be fileSytems, as the qemu machinery doesn't honor it.
+        virtualisation.fileSystems."/plain" = {
           device = "/encrypted";
           fsType = "fuse.gocryptfs";
           options = [
@@ -27,31 +28,27 @@
     };
 
   testScript = ''
+    # Initialize a gocryptfs filesystem and mount it
+    machine.succeed("openssl rand -base64 32 > /tmp/password.txt")
+    machine.succeed("mkdir -p /encrypted /plain")
+    machine.succeed("gocryptfs -init /encrypted  -passfile /tmp/password.txt -quiet")
+    machine.succeed("gocryptfs /encrypted /plain  -passfile /tmp/password.txt -quiet")
 
-    # Generate a password
-    machine.execute("openssl rand -base64 32 > /tmp/password.txt")
+    # Drop a canary file and unmount
+    machine.succeed("echo success > /plain/data.txt")
+    machine.succeed("fusermount -u /plain")
 
-    # Initialize an encrypted vault
-    machine.execute("mkdir -p /encrypted /plain")
-    machine.execute("gocryptfs -init /encrypted  -passfile /password.txt -quiet")
+    # Switch to a specialisation that has this in /etc/fstab
+    machine.succeed("/run/current-system/specialisation/fstab-test/bin/switch-to-configuration switch")
 
-    # Open and mount vault
-    machine.execute("gocryptfs /encrypted /plain  -passfile /tmp/password.txt -quiet")
-
-    machine.execute("echo test > /plain/data.txt")
-    machine.execute("echo test > /tmp/data.txt")
-
-    # Unmount
-    machine.execute("fusermount -u /plain")
-
-    # Switch to the specialisation
-    machine.succeed("/run/current-system/specialisation/fstab-test/bin/switch-to-configuration test")
-
-    # Wait for mount
+    # Wait for mounts
     machine.wait_for_unit("local-fs.target")
 
-    # Check data
-    machine.succeed("diff /plain/data.txt /tmp/data.txt")
+    # Sometimes gocryptfs files are slow to appear
+    machine.wait_for_file("/plain/data.txt")
+
+    # Ensure the canary is alive
+    machine.succeed("grep -q success /plain/data.txt")
 
   '';
 }

nixos/tests/incus/incus-tests-module.nix

@@ -1,10 +1,12 @@
 {
+  config,
   lib,
   pkgs,
   ...
 }:
 let
   jsonFormat = pkgs.formats.json { };
+  cfg = config.tests.incus;
 in
 {
   options.tests.incus = {
@@ -74,7 +76,11 @@ in
             config =
               let
                 releases = import ../../release.nix {
-                  configuration = config.nixosConfig;
+                  configuration = lib.recursiveUpdate config.nixosConfig {
+                    virtualisation.incus = {
+                      inherit (cfg) package;
+                    };
+                  };
                 };
 
                 images = {

nixos/tests/initrd-luks-empty-passphrase.nix

@@ -61,47 +61,63 @@ in
       };
     };
 
-  testScript = ''
-    # Encrypt key with empty key so boot should try keyfile and then fallback to empty passphrase
+  testScript =
+    { nodes, ... }:
+    let
+      toplevel = nodes.machine.system.build.toplevel;
+      boot-luks-missing-keyfile =
+        nodes.machine.specialisation.boot-luks-missing-keyfile.configuration.system.build.toplevel;
+      boot-luks-wrong-keyfile =
+        nodes.machine.specialisation.boot-luks-wrong-keyfile.configuration.system.build.toplevel;
+    in
+    # python
+    ''
+      # Encrypt key with empty key so boot should try keyfile and then fallback to empty passphrase
 
 
-    def grub_select_boot_luks_wrong_key_file():
-        """
-        Selects "boot-luks" from the GRUB menu
-        to trigger a login request.
-        """
-        machine.send_monitor_command("sendkey down")
-        machine.send_monitor_command("sendkey down")
-        machine.send_monitor_command("sendkey ret")
+      def grub_select_boot_luks_wrong_key_file():
+          """
+          Selects "boot-luks" from the GRUB menu
+          to trigger a login request.
+          """
+          machine.send_monitor_command("sendkey down")
+          machine.send_monitor_command("sendkey down")
+          machine.send_monitor_command("sendkey ret")
 
-    def grub_select_boot_luks_missing_key_file():
-        """
-        Selects "boot-luks" from the GRUB menu
-        to trigger a login request.
-        """
-        machine.send_monitor_command("sendkey down")
-        machine.send_monitor_command("sendkey ret")
+      def grub_select_boot_luks_missing_key_file():
+          """
+          Selects "boot-luks" from the GRUB menu
+          to trigger a login request.
+          """
+          machine.send_monitor_command("sendkey down")
+          machine.send_monitor_command("sendkey ret")
 
-    # Create encrypted volume
-    machine.wait_for_unit("multi-user.target")
-    machine.succeed("echo "" | cryptsetup luksFormat /dev/vdb --batch-mode")
-    machine.succeed("echo "" | cryptsetup luksOpen /dev/vdb cryptroot")
-    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-wrong-keyfile.conf")
-    machine.succeed("sync")
-    machine.crash()
+      # Create encrypted volume
+      machine.wait_for_unit("multi-user.target")
+      machine.succeed("echo "" | cryptsetup luksFormat /dev/vdb --batch-mode")
+      machine.succeed("echo "" | cryptsetup luksOpen /dev/vdb cryptroot")
+      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
+      machine.succeed("${boot-luks-wrong-keyfile}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
 
-    # Check if rootfs is on /dev/mapper/cryptroot
-    machine.wait_for_unit("multi-user.target")
-    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+      # Check if rootfs is on /dev/mapper/cryptroot
+      machine.wait_for_unit("multi-user.target")
+      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
 
-    # Choose boot-luks-missing-keyfile specialisation
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-missing-keyfile.conf")
-    machine.succeed("sync")
-    machine.crash()
+      # Choose boot-luks-missing-keyfile specialisation
+      machine.succeed(
+          "mkdir -p /nix/var/nix/profiles",
+          "ln -sfn ${toplevel} /nix/var/nix/profiles/system-1-link",
+          "ln -sfn system-1-link /nix/var/nix/profiles/system",
+      )
 
-    # Check if rootfs is on /dev/mapper/cryptroot
-    machine.wait_for_unit("multi-user.target")
-    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
-  '';
+      machine.succeed("${boot-luks-missing-keyfile}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
+
+      # Check if rootfs is on /dev/mapper/cryptroot
+      machine.wait_for_unit("multi-user.target")
+      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+    '';
 }

nixos/tests/inventree.nix

@@ -0,0 +1,33 @@
+{ lib, ... }:
+{
+  name = "inventree";
+  meta.maintainers = with lib.maintainers; [
+    kurogeek
+  ];
+
+  nodes = {
+    psqlTest = {
+      services.inventree = {
+        enable = true;
+      };
+    };
+    mysqlTest = {
+      services.inventree = {
+        enable = true;
+        database.dbtype = "mysql";
+      };
+    };
+  };
+  testScript = ''
+    start_all()
+    psqlTest.wait_for_unit("inventree.target")
+    psqlTest.wait_for_unit("inventree-server.service")
+    psqlTest.wait_for_open_unix_socket("/run/inventree/gunicorn.socket")
+    psqlTest.wait_until_succeeds("curl -sf http://localhost/web")
+
+    mysqlTest.wait_for_unit("inventree.target")
+    mysqlTest.wait_for_unit("inventree-server.service")
+    mysqlTest.wait_for_open_unix_socket("/run/inventree/gunicorn.socket")
+    mysqlTest.wait_until_succeeds("curl -sf http://localhost/web")
+  '';
+}

nixos/tests/lomiri.nix

@@ -142,7 +142,40 @@ let
       with machine.nested("Ensuring terminalTextColor {} stays present on the screen:".format(terminalTextColor)):
         retry(fn=check_for_color_continued_presence(terminalTextColor), timeout_seconds=5)
 
-    def ensure_lomiri_running() -> None:
+    def change_tty_back_forth(ttynumMain: int, ttynumDiff: int) -> None:
+      """
+      A qtmir bump made the image get stuck, a tty switch back and forth fixes it.
+      """
+
+      machine.send_key(f"ctrl-alt-f{ttynumDiff}")
+      machine.sleep(10)
+      machine.send_key(f"ctrl-alt-f{ttynumMain}")
+      machine.sleep(10)
+
+    def ensure_greeter_launched() -> None:
+      """
+      Ensure that Lomiri (in greeter mode) has started up and is responsive.
+      Execution will stop at the user selection.
+      """
+
+      machine.wait_for_unit("display-manager.service")
+      machine.wait_until_succeeds("pgrep -u lightdm -f 'lomiri --mode=greeter'")
+
+      # Start page shows current time
+      wait_for_text(r"(AM|PM)")
+
+      # Display "hangs" since qtmir bump? Not sure why. Switch to a different tty and back, and ensure that time is still shown
+      # Greeter runs on: tty1
+      change_tty_back_forth(1, 2)
+      wait_for_text(r"(AM|PM)")
+      machine.screenshot("lomiri_greeter_launched")
+
+      # Advance to user selection, to make sure display really isn't stuck anymore
+      machine.send_key("ret")
+      wait_for_text("${description}")
+      machine.screenshot("lomiri_greeter_login")
+
+    def ensure_lomiri_running(ttynumMain: int = 1, ttynumDiff: int = 2) -> None:
       """
       Ensure that Lomiri has finished starting up.
       """
@@ -150,9 +183,6 @@ let
       # Process runs
       machine.wait_until_succeeds("pgrep -u ${user} -f 'lomiri --mode=full-shell'")
 
-      # Output rendering from Lomiri has started when it starts printing performance diagnostics
-      machine.wait_for_console_text("Last frame took")
-
       # One of the last UI elements that loads is the clock. In the past, we could OCR for AM/PM to ensure it's there. That is now flaky.
       # The next best thing is to look for the launcher button, and ensure it stays around for awhile (DE doesn't crash).
       launcherColor: str = "#5277C3"
@@ -161,6 +191,15 @@ let
       with machine.nested("Ensuring launcherColor {} stays present on the screen:".format(launcherColor)):
         retry(fn=check_for_color_continued_presence(launcherColor), timeout_seconds=30)
 
+      # Display "hangs" since qtmir bump? Not sure why. Switch to a different tty and back, and ensure that launcher button is still shown
+      change_tty_back_forth(ttynumMain, ttynumDiff)
+      with machine.nested("Waiting for the screen to have launcherColor {} on it:".format(launcherColor)):
+        retry(check_for_color(launcherColor))
+
+      # First input seems to get dropped while Mir registers the new input device. Send a key that does nothing, to get that out of the way, and sleep a tiny bit for registration to finish.
+      machine.send_key("left")
+      machine.sleep(3)
+
       machine.screenshot("lomiri_launched")
 
     def wait_for_text(text) -> None:
@@ -358,17 +397,7 @@ in
 
           # Lomiri in greeter mode should work & be able to start a session
           with subtest("lomiri greeter works"):
-              machine.wait_for_unit("display-manager.service")
-              machine.wait_until_succeeds("pgrep -u lightdm -f 'lomiri --mode=greeter'")
-
-              # Start page shows current time
-              wait_for_text(r"(AM|PM)")
-              machine.screenshot("lomiri_greeter_launched")
-
-              # Advance to login part
-              machine.send_key("ret")
-              wait_for_text("${description}")
-              machine.screenshot("lomiri_greeter_login")
+              ensure_greeter_launched()
 
               # Login
               machine.send_chars("${password}\n")
@@ -771,24 +800,14 @@ in
 
             # Lomiri in greeter mode should use the correct keymap
             with subtest("lomiri greeter keymap works"):
-                machine.wait_for_unit("display-manager.service")
-                machine.wait_until_succeeds("pgrep -u lightdm -f 'lomiri --mode=greeter'")
-
-                # Start page shows current time
-                # And the greeter *actually* renders our wallpaper!
-                wait_for_text(r"(AM|PM|Lorem|ipsum)")
-                machine.screenshot("lomiri_greeter_launched")
-
-                # Advance to login part
-                machine.send_key("ret")
-                wait_for_text("${description}")
-                machine.screenshot("lomiri_greeter_login")
+                ensure_greeter_launched()
 
                 # Login
                 machine.send_chars("${pwInput}\n")
 
                 # And the desktop doesn't render the wallpaper anymore. Grumble grumble...
-                ensure_lomiri_running()
+                # When going lomiri(greeter) -> lomiri(desktop), we run on tty2
+                ensure_lomiri_running(2, 1)
 
             # Lomiri in desktop mode should use the correct keymap
             with subtest("lomiri session keymap works"):

nixos/tests/luks.nix

@@ -1,6 +1,6 @@
 # Tests LUKS specifically with scripted stage 1. Remove in 26.11.
 
-{ lib, pkgs, ... }:
+{ lib, ... }:
 {
   name = "luks";
 
@@ -47,41 +47,59 @@
 
   enableOCR = true;
 
-  testScript = ''
-    # Create encrypted volume
-    machine.wait_for_unit("multi-user.target")
-    machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
-    machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdb cryptroot")
-    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
+  testScript =
+    { nodes, ... }:
+    let
+      toplevel = nodes.machine.system.build.toplevel;
+      boot-luks = nodes.machine.specialisation.boot-luks.configuration.system.build.toplevel;
+      boot-luks-custom-keymap =
+        nodes.machine.specialisation.boot-luks-custom-keymap.configuration.system.build.toplevel;
+    in
+    # python
+    ''
+      # Create encrypted volume
+      machine.wait_for_unit("multi-user.target")
+      machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+      machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdb cryptroot")
+      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
 
-    machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
-    machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdc cryptroot2")
-    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
+      machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
+      machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdc cryptroot2")
+      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
 
-    # Boot from the encrypted disk
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
-    machine.succeed("sync")
-    machine.crash()
+      # Boot from the encrypted disk
+      machine.succeed("${boot-luks}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
 
-    # Boot and decrypt the disk
-    machine.start()
-    machine.wait_for_text("Passphrase for")
-    machine.send_chars("supersecret\n")
-    machine.wait_for_unit("multi-user.target")
+      # Boot and decrypt the disk
+      machine.start()
+      machine.wait_for_text("Passphrase for")
+      machine.send_chars("supersecret\n")
+      machine.wait_for_unit("multi-user.target")
 
-    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
 
-    # Boot from the encrypted disk with custom keymap
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks-custom-keymap.conf")
-    machine.succeed("sync")
-    machine.crash()
+      # The new root is empty, so it has no /nix/var/nix/profiles. Without a
+      # system profile, systemd-boot-builder finds zero generations and
+      # bails. So we manually create the one profile link that we need.
+      machine.succeed(
+          "mkdir -p /nix/var/nix/profiles",
+          "ln -sfn ${toplevel} /nix/var/nix/profiles/system-1-link",
+          "ln -sfn system-1-link /nix/var/nix/profiles/system",
+      )
 
-    # Boot and decrypt the disk
-    machine.start()
-    machine.wait_for_text("Passphrase for")
-    machine.send_chars("havfkhfrkfl\n")
-    machine.wait_for_unit("multi-user.target")
+      # Boot from the encrypted disk with custom keymap
+      machine.succeed("${boot-luks-custom-keymap}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
 
-    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
-  '';
+      # Boot and decrypt the disk
+      machine.start()
+      machine.wait_for_text("Passphrase for")
+      machine.send_chars("havfkhfrkfl\n")
+      machine.wait_for_unit("multi-user.target")
+
+      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+    '';
 }

nixos/tests/lvm2/default.nix

@@ -1,8 +1,6 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../../.. { inherit system config; },
-  lib ? pkgs.lib,
+  pkgs,
+  runTest,
   kernelVersionsToTest ? [
     "5.10"
     "5.15"
@@ -15,38 +13,36 @@
 
 # For quickly running a test, the nixosTests.lvm2.lvm-thinpool-linux-latest attribute is recommended
 let
-  tests =
-    let
-      callTest = p: lib.flip (import p) { inherit system pkgs; };
-    in
-    {
-      thinpool = {
-        test = callTest ./thinpool.nix;
-        kernelFilter = lib.id;
-      };
-      # we would like to test all versions, but the kernel module currently does not compile against the other versions
-      vdo = {
-        test = callTest ./vdo.nix;
-        kernelFilter = lib.filter (v: v == "latest");
-      };
+  inherit (pkgs) lib;
 
-      # systemd in stage 1
-      raid-sd-stage-1 = {
-        test = callTest ./systemd-stage-1.nix;
-        kernelFilter = lib.filter (v: v != "5.15");
-        flavour = "raid";
-      };
-      thinpool-sd-stage-1 = {
-        test = callTest ./systemd-stage-1.nix;
-        kernelFilter = lib.id;
-        flavour = "thinpool";
-      };
-      vdo-sd-stage-1 = {
-        test = callTest ./systemd-stage-1.nix;
-        kernelFilter = lib.filter (v: v == "latest");
-        flavour = "vdo";
-      };
+  tests = {
+    thinpool = {
+      test = ./thinpool.nix;
+      kernelFilter = lib.id;
     };
+    # we would like to test all versions, but the kernel module currently does not compile against the other versions
+    vdo = {
+      test = ./vdo.nix;
+      kernelFilter = lib.filter (v: v == "latest");
+    };
+
+    # systemd in stage 1
+    raid-sd-stage-1 = {
+      test = ./systemd-stage-1.nix;
+      kernelFilter = lib.filter (v: v != "5.15");
+      flavour = "raid";
+    };
+    thinpool-sd-stage-1 = {
+      test = ./systemd-stage-1.nix;
+      kernelFilter = lib.id;
+      flavour = "thinpool";
+    };
+    vdo-sd-stage-1 = {
+      test = ./systemd-stage-1.nix;
+      kernelFilter = lib.filter (v: v == "latest");
+      flavour = "vdo";
+    };
+  };
 in
 lib.listToAttrs (
   lib.filter (x: x.value != { }) (
@@ -61,18 +57,17 @@ lib.listToAttrs (
       lib.flip lib.mapAttrsToList tests (
         name: t:
         lib.nameValuePair "lvm-${name}-linux-${v'}" (
-          lib.optionalAttrs (builtins.elem version (t.kernelFilter kernelVersionsToTest)) (
-            t.test (
-              {
-                kernelPackages = pkgs."linuxPackages_${v'}";
-                inherit mkXfsFlags;
-              }
-              // removeAttrs t [
-                "test"
-                "kernelFilter"
-              ]
-            )
-          )
+          lib.optionalAttrs (builtins.elem version (t.kernelFilter kernelVersionsToTest)) (runTest {
+            imports = [ t.test ];
+            _module.args = {
+              kernelPackages = pkgs."linuxPackages_${v'}";
+              inherit mkXfsFlags;
+            }
+            // removeAttrs t [
+              "test"
+              "kernelFilter"
+            ];
+          })
         )
       )
     )

nixos/tests/lvm2/systemd-stage-1.nix

@@ -1,7 +1,9 @@
 {
+  lib,
   kernelPackages ? null,
   flavour,
   mkXfsFlags ? "",
+  ...
 }:
 let
   preparationCode =
@@ -66,57 +68,61 @@ let
     .${flavour};
 
 in
-import ../make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "lvm2-${flavour}-systemd-stage-1";
-    meta.maintainers = with lib.maintainers; [
-      das_j
-      helsinki-Jo
-    ];
+{
+  name = "lvm2-${flavour}-systemd-stage-1";
+  meta.maintainers = with lib.maintainers; [
+    das_j
+    helsinki-Jo
+  ];
 
-    nodes.machine =
-      { pkgs, lib, ... }:
-      {
-        imports = [ extraConfig ];
-        # Use systemd-boot
-        virtualisation = {
-          emptyDiskImages = [
-            8192
-            8192
-          ];
-          useBootLoader = true;
-          useEFIBoot = true;
-          # To boot off the LVM disk, we need to have a init script which comes from the Nix store.
-          mountHostNixStore = true;
-        };
-        boot.loader.systemd-boot.enable = true;
-        boot.loader.efi.canTouchEfiVariables = true;
-
-        environment.systemPackages = with pkgs; [ xfsprogs ];
-        boot = {
-          initrd.systemd = {
-            enable = true;
-            emergencyAccess = true;
-          };
-          initrd.services.lvm.enable = true;
-          kernelPackages = lib.mkIf (kernelPackages != null) kernelPackages;
-        };
-
-        specialisation.boot-lvm.configuration.virtualisation = {
-          useDefaultFilesystems = false;
-          fileSystems = {
-            "/" = {
-              device = "/dev/test_vg/test_lv";
-              fsType = "xfs";
-            };
-          };
-
-          rootDevice = "/dev/test_vg/test_lv";
+  nodes.machine =
+    { pkgs, lib, ... }:
+    {
+      imports = [ extraConfig ];
+      # Use systemd-boot
+      virtualisation = {
+        emptyDiskImages = [
+          8192
+          8192
+        ];
+        useBootLoader = true;
+        useEFIBoot = true;
+        # To boot off the LVM disk, we need to have a init script which comes from the Nix store.
+        mountHostNixStore = true;
+      };
+      boot.loader.systemd-boot.enable = true;
+      boot.loader.efi.canTouchEfiVariables = true;
+
+      environment.systemPackages = with pkgs; [ xfsprogs ];
+      boot = {
+        initrd.systemd = {
+          enable = true;
+          emergencyAccess = true;
         };
+        initrd.services.lvm.enable = true;
+        kernelPackages = lib.mkIf (kernelPackages != null) kernelPackages;
       };
 
-    testScript = ''
+      specialisation.boot-lvm.configuration.virtualisation = {
+        useDefaultFilesystems = false;
+        fileSystems = {
+          "/" = {
+            device = "/dev/test_vg/test_lv";
+            fsType = "xfs";
+          };
+        };
+
+        rootDevice = "/dev/test_vg/test_lv";
+      };
+    };
+
+  testScript =
+    { nodes, ... }:
+    let
+      boot-lvm = nodes.machine.specialisation.boot-lvm.configuration.system.build.toplevel;
+    in
+    # python
+    ''
       machine.wait_for_unit("multi-user.target")
       # Create a VG for the root
       ${preparationCode}
@@ -124,7 +130,7 @@ import ../make-test-python.nix (
       machine.succeed("mkdir -p /mnt && mount /dev/test_vg/test_lv /mnt && echo hello > /mnt/test && umount /mnt")
 
       # Boot from LVM
-      machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-lvm.conf")
+      machine.succeed("${boot-lvm}/bin/switch-to-configuration boot")
       machine.succeed("sync")
       machine.crash()
       machine.wait_for_unit("multi-user.target")
@@ -135,5 +141,4 @@ import ../make-test-python.nix (
       assert "hello" in machine.succeed("cat /test")
       ${extraCheck}
     '';
-  }
-)
+}

nixos/tests/lvm2/thinpool.nix

@@ -1,49 +1,48 @@
 {
+  lib,
   kernelPackages ? null,
   mkXfsFlags ? "",
+  ...
 }:
-import ../make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "lvm2-thinpool";
-    meta.maintainers = with lib.maintainers; [
-      das_j
-      helsinki-Jo
-    ];
+{
+  name = "lvm2-thinpool";
+  meta.maintainers = with lib.maintainers; [
+    das_j
+    helsinki-Jo
+  ];
 
-    nodes.machine =
-      { pkgs, lib, ... }:
-      {
-        virtualisation.emptyDiskImages = [ 4096 ];
-        services.lvm = {
-          boot.thin.enable = true;
-          dmeventd.enable = true;
-        };
-        environment.systemPackages = with pkgs; [ xfsprogs ];
-        environment.etc."lvm/lvm.conf".text = ''
-          activation/thin_pool_autoextend_percent = 10
-          activation/thin_pool_autoextend_threshold = 80
-        '';
-        boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+  nodes.machine =
+    { pkgs, lib, ... }:
+    {
+      virtualisation.emptyDiskImages = [ 4096 ];
+      services.lvm = {
+        boot.thin.enable = true;
+        dmeventd.enable = true;
       };
-
-    testScript =
-      let
-        mkXfsFlags =
-          lib.optionalString (lib.versionOlder kernelPackages.kernel.version "5.10") " -m bigtime=0 -m inobtcount=0 "
-          + lib.optionalString (lib.versionOlder kernelPackages.kernel.version "5.19") " -i nrext64=0 ";
-      in
-      ''
-        machine.succeed("vgcreate test_vg /dev/vdb")
-        machine.succeed("lvcreate -L 512M -T test_vg/test_thin_pool")
-        machine.succeed("lvcreate -n test_lv -V 16G --thinpool test_thin_pool test_vg")
-        machine.succeed("mkfs.xfs ${mkXfsFlags} /dev/test_vg/test_lv")
-        machine.succeed("mkdir /mnt; mount /dev/test_vg/test_lv /mnt")
-        assert "/dev/mapper/test_vg-test_lv" == machine.succeed("findmnt -no SOURCE /mnt").strip()
-        machine.succeed("dd if=/dev/zero of=/mnt/empty.file bs=1M count=1024")
-        machine.succeed("journalctl -u dm-event.service | grep \"successfully resized\"")
-        machine.succeed("umount /mnt")
-        machine.succeed("vgchange -a n")
+      environment.systemPackages = with pkgs; [ xfsprogs ];
+      environment.etc."lvm/lvm.conf".text = ''
+        activation/thin_pool_autoextend_percent = 10
+        activation/thin_pool_autoextend_threshold = 80
       '';
-  }
-)
+      boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+    };
+
+  testScript =
+    let
+      mkXfsFlags =
+        lib.optionalString (lib.versionOlder kernelPackages.kernel.version "5.10") " -m bigtime=0 -m inobtcount=0 "
+        + lib.optionalString (lib.versionOlder kernelPackages.kernel.version "5.19") " -i nrext64=0 ";
+    in
+    ''
+      machine.succeed("vgcreate test_vg /dev/vdb")
+      machine.succeed("lvcreate -L 512M -T test_vg/test_thin_pool")
+      machine.succeed("lvcreate -n test_lv -V 16G --thinpool test_thin_pool test_vg")
+      machine.succeed("mkfs.xfs ${mkXfsFlags} /dev/test_vg/test_lv")
+      machine.succeed("mkdir /mnt; mount /dev/test_vg/test_lv /mnt")
+      assert "/dev/mapper/test_vg-test_lv" == machine.succeed("findmnt -no SOURCE /mnt").strip()
+      machine.succeed("dd if=/dev/zero of=/mnt/empty.file bs=1M count=1024")
+      machine.succeed("journalctl -u dm-event.service | grep \"successfully resized\"")
+      machine.succeed("umount /mnt")
+      machine.succeed("vgchange -a n")
+    '';
+}

nixos/tests/lvm2/vdo.nix

@@ -1,35 +1,34 @@
 {
+  lib,
   kernelPackages ? null,
   mkXfsFlags ? "",
+  ...
 }:
-import ../make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "lvm2-vdo";
-    meta.maintainers = [ ];
+{
+  name = "lvm2-vdo";
+  meta.maintainers = [ ];
 
-    nodes.machine =
-      { pkgs, lib, ... }:
-      {
-        # Minimum required size for VDO volume: 5063921664 bytes
-        virtualisation.emptyDiskImages = [ 8192 ];
-        services.lvm = {
-          boot.vdo.enable = true;
-          dmeventd.enable = true;
-        };
-        environment.systemPackages = with pkgs; [ xfsprogs ];
-        boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+  nodes.machine =
+    { pkgs, lib, ... }:
+    {
+      # Minimum required size for VDO volume: 5063921664 bytes
+      virtualisation.emptyDiskImages = [ 8192 ];
+      services.lvm = {
+        boot.vdo.enable = true;
+        dmeventd.enable = true;
       };
+      environment.systemPackages = with pkgs; [ xfsprogs ];
+      boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+    };
 
-    testScript = ''
-      machine.succeed("vgcreate test_vg /dev/vdb")
-      machine.succeed("lvcreate --type vdo -n vdo_lv -L 6G -V 12G test_vg/vdo_pool_lv")
-      machine.succeed("mkfs.xfs ${mkXfsFlags} -K /dev/test_vg/vdo_lv")
-      machine.succeed("mkdir /mnt; mount /dev/test_vg/vdo_lv /mnt")
-      assert "/dev/mapper/test_vg-vdo_lv" == machine.succeed("findmnt -no SOURCE /mnt").strip()
-      machine.succeed("umount /mnt")
-      machine.succeed("vdostats")
-      machine.succeed("vgchange -a n")
-    '';
-  }
-)
+  testScript = ''
+    machine.succeed("vgcreate test_vg /dev/vdb")
+    machine.succeed("lvcreate --type vdo -n vdo_lv -L 6G -V 12G test_vg/vdo_pool_lv")
+    machine.succeed("mkfs.xfs ${mkXfsFlags} -K /dev/test_vg/vdo_lv")
+    machine.succeed("mkdir /mnt; mount /dev/test_vg/vdo_lv /mnt")
+    assert "/dev/mapper/test_vg-vdo_lv" == machine.succeed("findmnt -no SOURCE /mnt").strip()
+    machine.succeed("umount /mnt")
+    machine.succeed("vdostats")
+    machine.succeed("vgchange -a n")
+  '';
+}

nixos/tests/opensnitch.nix

@@ -54,10 +54,23 @@ in
               action = "allow";
               duration = "always";
               operator = {
-                type = "simple";
-                sensitive = false;
-                operand = "process.path";
-                data = "${pkgs.curl}/bin/curl";
+                type = "list";
+                operand = "list";
+                list = [
+                  {
+                    type = "simple";
+                    sensitive = false;
+                    operand = "process.path";
+                    data = "${pkgs.curl}/bin/curl";
+                  }
+                  # Check that network aliases like "LAN" are properly resolved.
+                  {
+                    type = "network";
+                    sensitive = false;
+                    operand = "dest.network";
+                    data = "LAN";
+                  }
+                ];
               };
             };
           };

nixos/tests/switch-test.nix

@@ -788,6 +788,11 @@ in
         echo this will fail
         false
       '';
+      specialisation.failingMidCheck.configuration.system.preSwitchChecks.failsInTheMiddle = ''
+        echo before
+        nonexistent-command
+        echo after
+      '';
     };
   };
 
@@ -888,6 +893,11 @@ in
           machine.succeed("${stderrRunner} ${otherSystem}/bin/switch-to-configuration check")
           out = switch_to_specialisation("${otherSystem}", "failingCheck", action="check", fail=True)
           assert_contains(out, "this will fail")
+          # errexit must be honoured inside the check body
+          out = switch_to_specialisation("${otherSystem}", "failingMidCheck", action="check", fail=True)
+          assert_contains(out, "before")
+          assert_contains(out, "Pre-switch check 'failsInTheMiddle' failed")
+          assert_lacks(out, "after")
 
       with subtest("switch inhibitors"):
           # Start without any inhibitors

nixos/tests/systemd-boot.nix

@@ -1,10 +1,37 @@
 {
   runTest,
   runTestOn,
+  lib,
   ...
 }:
 
 let
+  testScriptPreamble =
+    # python
+    ''
+      def check_current_system(system_path):
+          machine.succeed(f'test $(readlink -f /run/current-system) = "{system_path}"')
+
+      def check_generation(generation: int, tries_left=0, tries_failed=0, specialisation=None) -> list[str]:
+          if specialisation:
+              title = f"NixOS ({specialisation})"
+          else:
+              title = "NixOS"
+
+          conf_files = machine.succeed(
+              f"grep --files-with-matches 'version Generation {generation} NixOS' /boot/loader/entries/nixos-*.conf | xargs grep --line-regexp --fixed-strings --files-with-matches 'title {title}'"
+          ).split("\n")
+
+          suffix = ""
+          if tries_left:
+              suffix += f"+{tries_left}"
+          if tries_failed:
+              suffix += f"-{tries_failed}"
+
+          assert conf_files[0].endswith(f"{suffix}.conf"), f"Expected {conf_files[0]} to end with {suffix}.conf"
+          return conf_files
+    '';
+
   common =
     { pkgs, ... }:
     {
@@ -14,6 +41,10 @@ let
       boot.loader.efi.canTouchEfiVariables = true;
       environment.systemPackages = [ pkgs.efibootmgr ];
       system.switch.enable = true;
+      # Needed for machine-id to be persisted between reboots.
+      # Must be a valid (non-zero) ID, otherwise sd_id128_get_machine()
+      # returns -ENOMEDIUM and dbus-broker refuses to start.
+      environment.etc."machine-id".text = "1234567890abcdef1234567890abcdef\n";
     };
 
   commonXbootldr =
@@ -68,30 +99,150 @@ let
       boot.loader.systemd-boot.xbootldrMountPoint = "/boot";
     };
 
-  customDiskImage = nodes: ''
-    import os
-    import subprocess
-    import tempfile
+  customDiskImage =
+    nodes:
+    # python
+    ''
+      import os
+      import subprocess
+      import tempfile
 
-    tmp_disk_image = tempfile.NamedTemporaryFile()
+      tmp_disk_image = tempfile.NamedTemporaryFile()
 
-    subprocess.run([
-      "${nodes.machine.virtualisation.qemu.package}/bin/qemu-img",
-      "create",
-      "-f",
-      "qcow2",
-      "-b",
-      "${nodes.machine.system.build.diskImage}/nixos.qcow2",
-      "-F",
-      "qcow2",
-      tmp_disk_image.name,
-    ])
+      subprocess.run([
+        "${nodes.machine.virtualisation.qemu.package}/bin/qemu-img",
+        "create",
+        "-f",
+        "qcow2",
+        "-b",
+        "${nodes.machine.system.build.diskImage}/nixos.qcow2",
+        "-F",
+        "qcow2",
+        tmp_disk_image.name,
+      ])
 
-    # Set NIX_DISK_IMAGE so that the qemu script finds the right disk image.
-    os.environ['NIX_DISK_IMAGE'] = tmp_disk_image.name
-  '';
+      # Set NIX_DISK_IMAGE so that the qemu script finds the right disk image.
+      os.environ['NIX_DISK_IMAGE'] = tmp_disk_image.name
+    '';
+
+  # Check that we are booting the default entry and not the generation with largest version number
+  defaultEntry =
+    {
+      withBootCounting ? false,
+      ...
+    }:
+    runTest {
+      name = "systemd-boot-default-entry" + lib.optionalString withBootCounting "-with-boot-counting";
+      meta.maintainers = with lib.maintainers; [ julienmalka ];
+
+      nodes = {
+        machine =
+          { nodes, ... }:
+          {
+            imports = [ common ];
+            system.extraDependencies = [ nodes.other_machine.system.build.toplevel ];
+            boot.loader.systemd-boot.bootCounting.enable = withBootCounting;
+          };
+
+        other_machine =
+          { pkgs, ... }:
+          {
+            imports = [ common ];
+            boot.loader.systemd-boot.bootCounting.enable = withBootCounting;
+            environment.systemPackages = [ pkgs.hello ];
+          };
+      };
+      testScript =
+        { nodes, ... }:
+        let
+          orig = nodes.machine.system.build.toplevel;
+          other = nodes.other_machine.system.build.toplevel;
+        in
+        # python
+        ''
+          ${testScriptPreamble}
+
+          orig = "${orig}"
+          other = "${other}"
+
+          check_current_system(orig)
+
+          # Switch to other configuration
+          machine.succeed("nix-env -p /nix/var/nix/profiles/system --set ${other}")
+          machine.succeed(f"{other}/bin/switch-to-configuration boot")
+          # Rollback, default entry is now generation 1
+          machine.succeed("nix-env -p /nix/var/nix/profiles/system --rollback")
+          machine.succeed(f"{orig}/bin/switch-to-configuration boot")
+          machine.shutdown()
+          machine.start()
+          machine.wait_for_unit("multi-user.target")
+          # Check that we booted generation 1 (default)
+          # even though generation 2 comes first in alphabetical order
+          check_current_system(orig)
+        '';
+    };
+
+  garbage-collect-entry =
+    {
+      withBootCounting ? false,
+      ...
+    }:
+    runTest (
+      { lib, ... }:
+      {
+        name =
+          "systemd-boot-garbage-collect-entry" + lib.optionalString withBootCounting "-with-boot-counting";
+        meta.maintainers = with lib.maintainers; [ julienmalka ];
+
+        nodes = {
+          inherit common;
+          machine =
+            { nodes, ... }:
+            {
+              imports = [ common ];
+
+              boot.loader.systemd-boot.bootCounting.enable = withBootCounting;
+              boot.loader.systemd-boot.memtest86.enable = true;
+
+              # These are configs for different nodes, but we'll use them here in `machine`
+              system.extraDependencies = [
+                nodes.common.system.build.toplevel
+              ];
+            };
+        };
+
+        testScript =
+          { nodes, ... }:
+          let
+            baseSystem = nodes.common.system.build.toplevel;
+          in
+          # python
+          ''
+            ${testScriptPreamble}
+
+            machine.succeed("nix-env -p /nix/var/nix/profiles/system --set ${baseSystem}")
+            machine.succeed("nix-env -p /nix/var/nix/profiles/system --delete-generations 1")
+
+            conf_file = check_generation(1)[0]
+            new_conf_file = conf_file.replace(".conf", "+1-3.conf")
+
+            # At this point generation 1 has already been marked as good so we reintroduce counters artificially
+            ${lib.optionalString withBootCounting ''
+              machine.succeed(f"mv {conf_file} {new_conf_file}")
+            ''}
+            machine.succeed("${baseSystem}/bin/switch-to-configuration boot")
+            machine.fail(
+              "grep --files-with-matches 'version Generation 1 NixOS' /boot/loader/entries/nixos-*.conf"
+            )
+            check_generation(2)
+          '';
+      }
+    );
 in
 {
+  defaultEntry = defaultEntry { };
+  garbage-collect-entry = garbage-collect-entry { };
+
   basic = runTest (
     { lib, ... }:
     {
@@ -103,22 +254,26 @@ in
 
       nodes.machine = common;
 
-      testScript = ''
-        machine.start()
-        machine.wait_for_unit("multi-user.target")
+      testScript = # python
+        ''
+          ${testScriptPreamble}
 
-        machine.succeed("test -e /boot/loader/entries/nixos-generation-1.conf")
-        machine.succeed("grep 'sort-key nixos' /boot/loader/entries/nixos-generation-1.conf")
+          machine.start()
+          machine.wait_for_unit("multi-user.target")
 
-        # Ensure we actually booted using systemd-boot
-        # Magic number is the vendor UUID used by systemd-boot.
-        machine.succeed(
-            "test -e /sys/firmware/efi/efivars/LoaderEntrySelected-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f"
-        )
+          conf_file = check_generation(1)[0]
 
-        # "bootctl install" should have created an EFI entry
-        machine.succeed('efibootmgr | grep "Linux Boot Manager"')
-      '';
+          machine.succeed(f"grep 'sort-key nixos' {conf_file}")
+
+          # Ensure we actually booted using systemd-boot
+          # Magic number is the vendor UUID used by systemd-boot.
+          machine.succeed(
+              "test -e /sys/firmware/efi/efivars/LoaderEntrySelected-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f"
+          )
+
+          # "bootctl install" should have created an EFI entry
+          machine.succeed('efibootmgr | grep "Linux Boot Manager"')
+        '';
     }
   );
 
@@ -141,6 +296,7 @@ in
         let
           efiArch = pkgs.stdenv.hostPlatform.efiArch;
         in
+        #python
         ''
           machine.start(allow_reboot=True)
           machine.wait_for_unit("multi-user.target")
@@ -169,14 +325,17 @@ in
 
       testScript =
         { nodes, ... }:
+        #python
         ''
+          ${testScriptPreamble}
+
           ${customDiskImage nodes}
 
           machine.start()
           machine.wait_for_unit("multi-user.target")
 
           machine.succeed("test -e /efi/EFI/systemd/systemd-bootx64.efi")
-          machine.succeed("test -e /boot/loader/entries/nixos-generation-1.conf")
+          check_generation(1)
 
           # Ensure we actually booted using systemd-boot
           # Magic number is the vendor UUID used by systemd-boot.
@@ -225,32 +384,33 @@ in
         };
 
       testScript =
-        { nodes, ... }:
+        # python
         ''
+          ${testScriptPreamble}
+
           machine.start()
           machine.wait_for_unit("multi-user.target")
 
+          conf_files = check_generation(1, specialisation="something")
           machine.succeed(
-              "test -e /boot/loader/entries/nixos-generation-1-specialisation-something.conf"
-          )
-          machine.succeed(
-              "grep -q 'title NixOS (something)' /boot/loader/entries/nixos-generation-1-specialisation-something.conf"
-          )
-          machine.succeed(
-              "grep 'sort-key something' /boot/loader/entries/nixos-generation-1-specialisation-something.conf"
-          )
-        ''
-        + pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isAarch64 ''
-          machine.succeed(
-              r"grep 'devicetree /EFI/nixos/[a-z0-9]\{32\}.*dummy' /boot/loader/entries/nixos-generation-1-specialisation-something.conf"
+              f"grep --fixed-strings --line-regexp 'sort-key something' {" ".join(conf_files)}"
           )
+
+          ${lib.optionalString pkgs.stdenv.hostPlatform.isAarch64
+            #python
+            ''
+              machine.succeed(
+                  fr"grep 'devicetree /EFI/nixos/[a-z0-9]\{32\}.*dummy' {" ".join(conf_files)}"
+              )
+            ''
+          }
         '';
     }
   );
 
   # Boot without having created an EFI entry--instead using default "/EFI/BOOT/BOOTX64.EFI"
   fallback = runTest (
-    { pkgs, lib, ... }:
+    { lib, ... }:
     {
       name = "systemd-boot-fallback";
       meta.maintainers = with lib.maintainers; [
@@ -259,27 +419,31 @@ in
       ];
 
       nodes.machine =
-        { pkgs, lib, ... }:
+        { lib, ... }:
         {
           imports = [ common ];
           boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
         };
 
-      testScript = ''
-        machine.start()
-        machine.wait_for_unit("multi-user.target")
+      testScript =
+        # python
+        ''
+          ${testScriptPreamble}
 
-        machine.succeed("test -e /boot/loader/entries/nixos-generation-1.conf")
+          machine.start()
+          machine.wait_for_unit("multi-user.target")
 
-        # Ensure we actually booted using systemd-boot
-        # Magic number is the vendor UUID used by systemd-boot.
-        machine.succeed(
-            "test -e /sys/firmware/efi/efivars/LoaderEntrySelected-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f"
-        )
+          check_generation(1)
 
-        # "bootctl install" should _not_ have created an EFI entry
-        machine.fail('efibootmgr | grep "Linux Boot Manager"')
-      '';
+          # Ensure we actually booted using systemd-boot
+          # Magic number is the vendor UUID used by systemd-boot.
+          machine.succeed(
+              "test -e /sys/firmware/efi/efivars/LoaderEntrySelected-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f"
+          )
+
+          # "bootctl install" should _not_ have created an EFI entry
+          machine.fail('efibootmgr | grep "Linux Boot Manager"')
+        '';
     }
   );
 
@@ -295,35 +459,37 @@ in
 
       nodes.machine = common;
 
-      testScript = ''
-        machine.succeed("mount -o remount,rw /boot")
+      testScript =
+        # python
+        ''
+          machine.succeed("mount -o remount,rw /boot")
 
-        def switch():
-            # Replace version inside sd-boot with something older. See magic[] string in systemd src/boot/efi/boot.c
-            machine.succeed(
-              """
-              find /boot -iname '*boot*.efi' -print0 | \
-              xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot .* ####/#### LoaderInfo: systemd-boot 000.0-1-notnixos ####/' '{}'
-              """
-            )
-            return machine.succeed("/run/current-system/bin/switch-to-configuration boot 2>&1")
+          def switch():
+              # Replace version inside sd-boot with something older. See magic[] string in systemd src/boot/efi/boot.c
+              machine.succeed(
+                """
+                find /boot -iname '*boot*.efi' -print0 | \
+                xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot .* ####/#### LoaderInfo: systemd-boot 000.0-1-notnixos ####/' '{}'
+                """
+              )
+              return machine.succeed("/run/current-system/bin/switch-to-configuration boot 2>&1")
 
-        output = switch()
-        assert "updating systemd-boot from 000.0-1-notnixos to " in output, "Couldn't find systemd-boot update message"
-        assert 'to "/boot/EFI/systemd/systemd-bootx64.efi"' in output, "systemd-boot not copied to to /boot/EFI/systemd/systemd-bootx64.efi"
-        assert 'to "/boot/EFI/BOOT/BOOTX64.EFI"' in output, "systemd-boot not copied to to /boot/EFI/BOOT/BOOTX64.EFI"
+          output = switch()
+          assert "updating systemd-boot from 000.0-1-notnixos to " in output, "Couldn't find systemd-boot update message"
+          assert 'to "/boot/EFI/systemd/systemd-bootx64.efi"' in output, "systemd-boot not copied to to /boot/EFI/systemd/systemd-bootx64.efi"
+          assert 'to "/boot/EFI/BOOT/BOOTX64.EFI"' in output, "systemd-boot not copied to to /boot/EFI/BOOT/BOOTX64.EFI"
 
-        with subtest("Test that updating works with lowercase bootx64.efi"):
-            machine.succeed(
-                # Move to tmp file name first, otherwise mv complains the new location is the same
-                "mv /boot/EFI/BOOT/BOOTX64.EFI /boot/EFI/BOOT/bootx64.efi.new",
-                "mv /boot/EFI/BOOT/bootx64.efi.new /boot/EFI/BOOT/bootx64.efi",
-            )
-            output = switch()
-            assert "updating systemd-boot from 000.0-1-notnixos to " in output, "Couldn't find systemd-boot update message"
-            assert 'to "/boot/EFI/systemd/systemd-bootx64.efi"' in output, "systemd-boot not copied to to /boot/EFI/systemd/systemd-bootx64.efi"
-            assert 'to "/boot/EFI/BOOT/BOOTX64.EFI"' in output, "systemd-boot not copied to to /boot/EFI/BOOT/BOOTX64.EFI"
-      '';
+          with subtest("Test that updating works with lowercase bootx64.efi"):
+              machine.succeed(
+                  # Move to tmp file name first, otherwise mv complains the new location is the same
+                  "mv /boot/EFI/BOOT/BOOTX64.EFI /boot/EFI/BOOT/bootx64.efi.new",
+                  "mv /boot/EFI/BOOT/bootx64.efi.new /boot/EFI/BOOT/bootx64.efi",
+              )
+              output = switch()
+              assert "updating systemd-boot from 000.0-1-notnixos to " in output, "Couldn't find systemd-boot update message"
+              assert 'to "/boot/EFI/systemd/systemd-bootx64.efi"' in output, "systemd-boot not copied to to /boot/EFI/systemd/systemd-bootx64.efi"
+              assert 'to "/boot/EFI/BOOT/BOOTX64.EFI"' in output, "systemd-boot not copied to to /boot/EFI/BOOT/BOOTX64.EFI"
+        '';
     }
   );
 
@@ -333,17 +499,17 @@ in
       name = "systemd-boot-memtest86";
       meta.maintainers = with lib.maintainers; [ julienmalka ];
 
-      nodes.machine =
-        { pkgs, lib, ... }:
-        {
-          imports = [ common ];
-          boot.loader.systemd-boot.memtest86.enable = true;
-        };
+      nodes.machine = {
+        imports = [ common ];
+        boot.loader.systemd-boot.memtest86.enable = true;
+      };
 
-      testScript = ''
-        machine.succeed("test -e /boot/loader/entries/memtest86.conf")
-        machine.succeed("test -e /boot/efi/memtest86/memtest.efi")
-      '';
+      testScript =
+        # python
+        ''
+          machine.succeed("test -e /boot/loader/entries/memtest86.conf")
+          machine.succeed("test -e /boot/efi/memtest86/memtest.efi")
+        '';
     }
   );
 
@@ -353,17 +519,17 @@ in
       name = "systemd-boot-netbootxyz";
       meta.maintainers = with lib.maintainers; [ julienmalka ];
 
-      nodes.machine =
-        { pkgs, lib, ... }:
-        {
-          imports = [ common ];
-          boot.loader.systemd-boot.netbootxyz.enable = true;
-        };
+      nodes.machine = {
+        imports = [ common ];
+        boot.loader.systemd-boot.netbootxyz.enable = true;
+      };
 
-      testScript = ''
-        machine.succeed("test -e /boot/loader/entries/netbootxyz.conf")
-        machine.succeed("test -e /boot/efi/netbootxyz/netboot.xyz.efi")
-      '';
+      testScript =
+        # python
+        ''
+          machine.succeed("test -e /boot/loader/entries/netbootxyz.conf")
+          machine.succeed("test -e /boot/efi/netbootxyz/netboot.xyz.efi")
+        '';
     }
   );
 
@@ -380,10 +546,12 @@ in
           boot.loader.systemd-boot.edk2-uefi-shell.enable = true;
         };
 
-      testScript = ''
-        machine.succeed("test -e /boot/loader/entries/edk2-uefi-shell.conf")
-        machine.succeed("test -e /boot/efi/edk2-uefi-shell/shell.efi")
-      '';
+      testScript =
+        # python
+        ''
+          machine.succeed("test -e /boot/loader/entries/edk2-uefi-shell.conf")
+          machine.succeed("test -e /boot/efi/edk2-uefi-shell/shell.efi")
+        '';
     }
   );
 
@@ -411,29 +579,31 @@ in
           };
         };
 
-      testScript = ''
-        machine.succeed("test -e /boot/efi/edk2-uefi-shell/shell.efi")
+      testScript =
+        # python
+        ''
+          machine.succeed("test -e /boot/efi/edk2-uefi-shell/shell.efi")
 
-        machine.succeed("test -e /boot/loader/entries/windows_7.conf")
-        machine.succeed("test -e /boot/loader/entries/windows_Ten.conf")
-        machine.succeed("test -e /boot/loader/entries/windows_11.conf")
+          machine.succeed("test -e /boot/loader/entries/windows_7.conf")
+          machine.succeed("test -e /boot/loader/entries/windows_Ten.conf")
+          machine.succeed("test -e /boot/loader/entries/windows_11.conf")
 
-        machine.succeed("grep 'efi /efi/edk2-uefi-shell/shell.efi' /boot/loader/entries/windows_7.conf")
-        machine.succeed("grep 'efi /efi/edk2-uefi-shell/shell.efi' /boot/loader/entries/windows_Ten.conf")
-        machine.succeed("grep 'efi /efi/edk2-uefi-shell/shell.efi' /boot/loader/entries/windows_11.conf")
+          machine.succeed("grep 'efi /efi/edk2-uefi-shell/shell.efi' /boot/loader/entries/windows_7.conf")
+          machine.succeed("grep 'efi /efi/edk2-uefi-shell/shell.efi' /boot/loader/entries/windows_Ten.conf")
+          machine.succeed("grep 'efi /efi/edk2-uefi-shell/shell.efi' /boot/loader/entries/windows_11.conf")
 
-        machine.succeed("grep 'HD0c1:EFI\\\\Microsoft\\\\Boot\\\\Bootmgfw.efi' /boot/loader/entries/windows_7.conf")
-        machine.succeed("grep 'FS0:EFI\\\\Microsoft\\\\Boot\\\\Bootmgfw.efi' /boot/loader/entries/windows_Ten.conf")
-        machine.succeed("grep 'HD0d4:EFI\\\\Microsoft\\\\Boot\\\\Bootmgfw.efi' /boot/loader/entries/windows_11.conf")
+          machine.succeed("grep 'HD0c1:EFI\\\\Microsoft\\\\Boot\\\\Bootmgfw.efi' /boot/loader/entries/windows_7.conf")
+          machine.succeed("grep 'FS0:EFI\\\\Microsoft\\\\Boot\\\\Bootmgfw.efi' /boot/loader/entries/windows_Ten.conf")
+          machine.succeed("grep 'HD0d4:EFI\\\\Microsoft\\\\Boot\\\\Bootmgfw.efi' /boot/loader/entries/windows_11.conf")
 
-        machine.succeed("grep 'sort-key before_all_others' /boot/loader/entries/windows_7.conf")
-        machine.succeed("grep 'sort-key o_windows_Ten' /boot/loader/entries/windows_Ten.conf")
-        machine.succeed("grep 'sort-key zzz' /boot/loader/entries/windows_11.conf")
+          machine.succeed("grep 'sort-key before_all_others' /boot/loader/entries/windows_7.conf")
+          machine.succeed("grep 'sort-key o_windows_Ten' /boot/loader/entries/windows_Ten.conf")
+          machine.succeed("grep 'sort-key zzz' /boot/loader/entries/windows_11.conf")
 
-        machine.succeed("grep 'title Windows 7' /boot/loader/entries/windows_7.conf")
-        machine.succeed("grep 'title Windows Ten' /boot/loader/entries/windows_Ten.conf")
-        machine.succeed('grep "title Title with-_-punctuation ...?!" /boot/loader/entries/windows_11.conf')
-      '';
+          machine.succeed("grep 'title Windows 7' /boot/loader/entries/windows_7.conf")
+          machine.succeed("grep 'title Windows Ten' /boot/loader/entries/windows_Ten.conf")
+          machine.succeed('grep "title Title with-_-punctuation ...?!" /boot/loader/entries/windows_11.conf')
+        '';
     }
   );
 
@@ -443,19 +613,19 @@ in
       name = "systemd-boot-memtest-sortkey";
       meta.maintainers = with lib.maintainers; [ julienmalka ];
 
-      nodes.machine =
-        { pkgs, lib, ... }:
-        {
-          imports = [ common ];
-          boot.loader.systemd-boot.memtest86.enable = true;
-          boot.loader.systemd-boot.memtest86.sortKey = "apple";
-        };
+      nodes.machine = {
+        imports = [ common ];
+        boot.loader.systemd-boot.memtest86.enable = true;
+        boot.loader.systemd-boot.memtest86.sortKey = "apple";
+      };
 
-      testScript = ''
-        machine.succeed("test -e /boot/loader/entries/memtest86.conf")
-        machine.succeed("test -e /boot/efi/memtest86/memtest.efi")
-        machine.succeed("grep 'sort-key apple' /boot/loader/entries/memtest86.conf")
-      '';
+      testScript =
+        # python
+        ''
+          machine.succeed("test -e /boot/loader/entries/memtest86.conf")
+          machine.succeed("test -e /boot/efi/memtest86/memtest.efi")
+          machine.succeed("grep 'sort-key apple' /boot/loader/entries/memtest86.conf")
+        '';
     }
   );
 
@@ -466,15 +636,14 @@ in
       name = "systemd-boot-entry-filename-xbootldr";
       meta.maintainers = with lib.maintainers; [ sdht0 ];
 
-      nodes.machine =
-        { pkgs, lib, ... }:
-        {
-          imports = [ commonXbootldr ];
-          boot.loader.systemd-boot.memtest86.enable = true;
-        };
+      nodes.machine = {
+        imports = [ commonXbootldr ];
+        boot.loader.systemd-boot.memtest86.enable = true;
+      };
 
       testScript =
         { nodes, ... }:
+        # python
         ''
           ${customDiskImage nodes}
 
@@ -494,21 +663,21 @@ in
       name = "systemd-boot-extra-entries";
       meta.maintainers = with lib.maintainers; [ julienmalka ];
 
-      nodes.machine =
-        { pkgs, lib, ... }:
-        {
-          imports = [ common ];
-          boot.loader.systemd-boot.extraEntries = {
-            "banana.conf" = ''
-              title banana
-            '';
-          };
+      nodes.machine = {
+        imports = [ common ];
+        boot.loader.systemd-boot.extraEntries = {
+          "banana.conf" = ''
+            title banana
+          '';
         };
+      };
 
-      testScript = ''
-        machine.succeed("test -e /boot/loader/entries/banana.conf")
-        machine.succeed("test -e /boot/efi/nixos/.extra-files/loader/entries/banana.conf")
-      '';
+      testScript =
+        # python
+        ''
+          machine.succeed("test -e /boot/loader/entries/banana.conf")
+          machine.succeed("test -e /boot/efi/nixos/.extra-files/loader/entries/banana.conf")
+        '';
     }
   );
 
@@ -519,7 +688,7 @@ in
       meta.maintainers = with lib.maintainers; [ julienmalka ];
 
       nodes.machine =
-        { pkgs, lib, ... }:
+        { pkgs, ... }:
         {
           imports = [ common ];
           boot.loader.systemd-boot.extraFiles = {
@@ -527,10 +696,12 @@ in
           };
         };
 
-      testScript = ''
-        machine.succeed("test -e /boot/efi/fruits/tomato.efi")
-        machine.succeed("test -e /boot/efi/nixos/.extra-files/efi/fruits/tomato.efi")
-      '';
+      testScript =
+        # python
+        ''
+          machine.succeed("test -e /boot/efi/fruits/tomato.efi")
+          machine.succeed("test -e /boot/efi/nixos/.extra-files/efi/fruits/tomato.efi")
+        '';
     }
   );
 
@@ -558,12 +729,10 @@ in
             ];
           };
 
-        with_netbootxyz =
-          { pkgs, ... }:
-          {
-            imports = [ common ];
-            boot.loader.systemd-boot.netbootxyz.enable = true;
-          };
+        with_netbootxyz = {
+          imports = [ common ];
+          boot.loader.systemd-boot.netbootxyz.enable = true;
+        };
       };
 
       testScript =
@@ -573,6 +742,7 @@ in
           baseSystem = nodes.common.system.build.toplevel;
           finalSystem = nodes.with_netbootxyz.system.build.toplevel;
         in
+        # python
         ''
           machine.succeed("test -e /boot/efi/fruits/tomato.efi")
           machine.succeed("test -e /boot/efi/nixos/.extra-files/efi/fruits/tomato.efi")
@@ -602,41 +772,6 @@ in
     }
   );
 
-  garbage-collect-entry = runTest (
-    { lib, ... }:
-    {
-      name = "systemd-boot-garbage-collect-entry";
-      meta.maintainers = with lib.maintainers; [ julienmalka ];
-
-      nodes = {
-        inherit common;
-        machine =
-          { pkgs, nodes, ... }:
-          {
-            imports = [ common ];
-
-            # These are configs for different nodes, but we'll use them here in `machine`
-            system.extraDependencies = [
-              nodes.common.system.build.toplevel
-            ];
-          };
-      };
-
-      testScript =
-        { nodes, ... }:
-        let
-          baseSystem = nodes.common.system.build.toplevel;
-        in
-        ''
-          machine.succeed("nix-env -p /nix/var/nix/profiles/system --set ${baseSystem}")
-          machine.succeed("nix-env -p /nix/var/nix/profiles/system --delete-generations 1")
-          machine.succeed("${baseSystem}/bin/switch-to-configuration boot")
-          machine.fail("test -e /boot/loader/entries/nixos-generation-1.conf")
-          machine.succeed("test -e /boot/loader/entries/nixos-generation-2.conf")
-        '';
-    }
-  );
-
   no-bootspec = runTest (
     { lib, ... }:
     {
@@ -648,10 +783,182 @@ in
         boot.bootspec.enable = false;
       };
 
-      testScript = ''
-        machine.start()
-        machine.wait_for_unit("multi-user.target")
-      '';
+      testScript =
+        # python
+        ''
+          machine.start()
+          machine.wait_for_unit("multi-user.target")
+        '';
     }
   );
+
+  bootCounting =
+    let
+      baseConfig = {
+        imports = [ common ];
+
+        boot.loader.systemd-boot.bootCounting = {
+          enable = true;
+          tries = 2;
+        };
+      };
+    in
+    runTest {
+      name = "systemd-boot-counting";
+      meta.maintainers = with lib.maintainers; [ julienmalka ];
+
+      nodes = {
+        machine =
+          { nodes, ... }:
+          {
+            imports = [ baseConfig ];
+            system.extraDependencies = [
+              nodes.bad_machine.system.build.toplevel
+              nodes.unused_machine.system.build.toplevel
+            ];
+          };
+
+        unused_machine =
+          { pkgs, ... }:
+          {
+            imports = [ baseConfig ];
+            # Distinguish this closure from `machine` without pulling in extra deps.
+            environment.systemPackages = [ pkgs.hello ];
+          };
+
+        bad_machine = {
+          imports = [ baseConfig ];
+
+          systemd.services."failing" = {
+            script = "exit 1";
+            requiredBy = [ "boot-complete.target" ];
+            before = [ "boot-complete.target" ];
+            serviceConfig.Type = "oneshot";
+          };
+        };
+      };
+      testScript =
+        { nodes, ... }:
+        let
+          orig = nodes.machine.system.build.toplevel;
+          bad = nodes.bad_machine.system.build.toplevel;
+          unused = nodes.unused_machine.system.build.toplevel;
+        in
+        # python
+        ''
+          ${testScriptPreamble}
+
+          orig = "${orig}"
+          bad = "${bad}"
+          unused = "${unused}"
+
+          machine.start(allow_reboot=True)
+
+          # Ensure we booted using an entry with counters enabled
+          machine.succeed(
+              "test -e /sys/firmware/efi/efivars/LoaderBootCountPath-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f"
+          )
+
+          # systemd-bless-boot should have already removed the "+2" suffix from the boot entry
+          machine.wait_for_unit("systemd-bless-boot.service")
+          conf_file = check_generation(1)
+          check_current_system(orig)
+
+          print(machine.succeed("cat /boot/loader/entries/*.conf"))
+
+          # Register the bad configuration as generation 2 and another good
+          # configuration as generation 3, then make generation 2 the default.
+          # This verifies that `preferred` in loader.conf selects gen 2 even
+          # though gen 3 sorts higher, and that once gen 2 is marked bad we
+          # fall back to the newest non-bad entry (gen 3).
+          machine.succeed("nix-env -p /nix/var/nix/profiles/system --set ${bad}")
+          machine.succeed("nix-env -p /nix/var/nix/profiles/system --set ${unused}")
+          machine.succeed(f"{bad}/bin/switch-to-configuration boot")
+
+          # Ensure new bootloader entries have initialized counters
+          check_generation(1)
+          check_generation(2, 2)
+          check_generation(3, 2)
+
+          machine.reboot()
+
+          machine.wait_for_unit("multi-user.target")
+          check_current_system(bad)
+          check_generation(1)
+          check_generation(2, 1, 1)
+          check_generation(3, 2)
+
+          machine.reboot()
+
+          machine.wait_for_unit("multi-user.target")
+          check_current_system(bad)
+          check_generation(1)
+          check_generation(2, 0, 2)
+          check_generation(3, 2)
+
+          machine.reboot()
+
+          machine.wait_for_unit("multi-user.target")
+          # Gen 2 has exhausted its tries; `preferred` skips it and `default
+          # nixos-*` resolves to the newest non-bad entry, which is gen 3.
+          check_current_system(unused)
+          machine.wait_for_unit("systemd-bless-boot.service")
+          check_generation(2, 0, 2)
+          check_generation(3)
+        '';
+    };
+
+  bootCountingSpecialisation =
+    let
+      baseConfig = {
+        imports = [ common ];
+        boot.loader.systemd-boot.bootCounting = {
+          enable = true;
+          tries = 2;
+        };
+      };
+
+      specialisationName = "+something+-+that+-+breaks-parsing+-+";
+    in
+    runTest {
+      name = "systemd-boot-counting-specialisation";
+      meta.maintainers = with lib.maintainers; [ julienmalka ];
+
+      nodes = {
+        machine =
+          { nodes, lib, ... }:
+          {
+            imports = [ baseConfig ];
+            specialisation.${specialisationName}.configuration = {
+              boot.loader.systemd-boot.sortKey = "something";
+            };
+          };
+      };
+      testScript =
+        { nodes, ... }:
+        let
+          orig = nodes.machine.system.build.toplevel;
+        in
+        # python
+        ''
+          ${testScriptPreamble}
+
+          orig = "${orig}"
+
+          # Ensure we booted using an entry with counters enabled
+          machine.succeed(
+              "test -e /sys/firmware/efi/efivars/LoaderBootCountPath-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f"
+          )
+
+          check_generation(1)
+          check_current_system(orig)
+
+          # Ensure the bootloader entry for the specialisation has initialized the boot counter
+          check_generation(1, 2, specialisation="${specialisationName}")
+        '';
+    };
+
+  defaultEntryWithBootCounting = defaultEntry { withBootCounting = true; };
+
+  garbageCollectEntryWithBootCounting = garbage-collect-entry { withBootCounting = true; };
 }

nixos/tests/systemd-initrd-btrfs-raid.nix

@@ -1,4 +1,4 @@
-{ lib, pkgs, ... }:
+{ lib, ... }:
 {
   name = "systemd-initrd-btrfs-raid";
 
@@ -33,21 +33,27 @@
       };
     };
 
-  testScript = ''
-    # Create RAID
-    machine.succeed("mkfs.btrfs -d raid0 /dev/vdb /dev/vdc")
-    machine.succeed("mkdir -p /mnt && mount /dev/vdb /mnt && echo hello > /mnt/test && umount /mnt")
+  testScript =
+    { nodes, ... }:
+    let
+      boot-btrfs-raid = nodes.machine.specialisation.boot-btrfs-raid.configuration.system.build.toplevel;
+    in
+    # python
+    ''
+      # Create RAID
+      machine.succeed("mkfs.btrfs -d raid0 /dev/vdb /dev/vdc")
+      machine.succeed("mkdir -p /mnt && mount /dev/vdb /mnt && echo hello > /mnt/test && umount /mnt")
 
-    # Boot from the RAID
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-btrfs-raid.conf")
-    machine.succeed("sync")
-    machine.crash()
-    machine.wait_for_unit("multi-user.target")
+      # Boot from the RAID
+      machine.succeed("${boot-btrfs-raid}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
+      machine.wait_for_unit("multi-user.target")
 
-    # Ensure we have successfully booted from the RAID
-    assert "(initrd)" in machine.succeed("systemd-analyze")  # booted with systemd in stage 1
-    assert "/dev/vdb on / type btrfs" in machine.succeed("mount")
-    assert "hello" in machine.succeed("cat /test")
-    assert "Total devices 2" in machine.succeed("btrfs filesystem show")
-  '';
+      # Ensure we have successfully booted from the RAID
+      assert "(initrd)" in machine.succeed("systemd-analyze")  # booted with systemd in stage 1
+      assert "/dev/vdb on / type btrfs" in machine.succeed("mount")
+      assert "hello" in machine.succeed("cat /test")
+      assert "Total devices 2" in machine.succeed("btrfs filesystem show")
+    '';
 }

nixos/tests/systemd-initrd-luks-fido2.nix

@@ -1,6 +1,5 @@
 {
   lib,
-  pkgs,
   hostPkgs,
   ...
 }:
@@ -43,19 +42,25 @@
       };
     };
 
-  testScript = ''
-    # Create encrypted volume
-    machine.wait_for_unit("multi-user.target")
-    machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
-    machine.succeed("PASSWORD=supersecret SYSTEMD_LOG_LEVEL=debug systemd-cryptenroll --fido2-device=auto /dev/vdb |& systemd-cat")
+  testScript =
+    { nodes, ... }:
+    let
+      boot-luks = nodes.machine.specialisation.boot-luks.configuration.system.build.toplevel;
+    in
+    # python
+    ''
+      # Create encrypted volume
+      machine.wait_for_unit("multi-user.target")
+      machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+      machine.succeed("PASSWORD=supersecret SYSTEMD_LOG_LEVEL=debug systemd-cryptenroll --fido2-device=auto /dev/vdb |& systemd-cat")
 
-    # Boot from the encrypted disk
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
-    machine.succeed("sync")
-    machine.crash()
+      # Boot from the encrypted disk
+      machine.succeed("${boot-luks}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
 
-    # Boot and decrypt the disk
-    machine.wait_for_unit("multi-user.target")
-    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
-  '';
+      # Boot and decrypt the disk
+      machine.wait_for_unit("multi-user.target")
+      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+    '';
 }

nixos/tests/systemd-initrd-luks-keyfile.nix

@@ -42,20 +42,26 @@ in
       };
     };
 
-  testScript = ''
-    # Create encrypted volume
-    machine.wait_for_unit("multi-user.target")
-    machine.succeed("cryptsetup luksFormat -q --iter-time=1 -d ${keyfile} /dev/vdb")
-    machine.succeed("cryptsetup luksOpen --key-file ${keyfile} /dev/vdb cryptroot")
-    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
+  testScript =
+    { nodes, ... }:
+    let
+      boot-luks = nodes.machine.specialisation.boot-luks.configuration.system.build.toplevel;
+    in
+    # python
+    ''
+      # Create encrypted volume
+      machine.wait_for_unit("multi-user.target")
+      machine.succeed("cryptsetup luksFormat -q --iter-time=1 -d ${keyfile} /dev/vdb")
+      machine.succeed("cryptsetup luksOpen --key-file ${keyfile} /dev/vdb cryptroot")
+      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
 
-    # Boot from the encrypted disk
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
-    machine.succeed("sync")
-    machine.crash()
+      # Boot from the encrypted disk
+      machine.succeed("${boot-luks}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
 
-    # Boot and decrypt the disk
-    machine.wait_for_unit("multi-user.target")
-    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
-  '';
+      # Boot and decrypt the disk
+      machine.wait_for_unit("multi-user.target")
+      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+    '';
 }

nixos/tests/systemd-initrd-luks-password.nix

@@ -1,4 +1,4 @@
-{ lib, pkgs, ... }:
+{ lib, ... }:
 {
   name = "systemd-initrd-luks-password";
 
@@ -39,30 +39,36 @@
       };
     };
 
-  testScript = ''
-    # Create encrypted volume
-    machine.wait_for_unit("multi-user.target")
+  testScript =
+    { nodes, ... }:
+    let
+      boot-luks = nodes.machine.specialisation.boot-luks.configuration.system.build.toplevel;
+    in
+    # python
+    ''
+      # Create encrypted volume
+      machine.wait_for_unit("multi-user.target")
 
-    machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
-    machine.succeed("echo -n supersecret | cryptsetup luksOpen   -q               /dev/vdb cryptroot")
-    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
+      machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+      machine.succeed("echo -n supersecret | cryptsetup luksOpen   -q               /dev/vdb cryptroot")
+      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
 
-    machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
-    machine.succeed("echo -n supersecret | cryptsetup luksOpen   -q               /dev/vdc cryptroot2")
-    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
+      machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
+      machine.succeed("echo -n supersecret | cryptsetup luksOpen   -q               /dev/vdc cryptroot2")
+      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
 
-    # Boot from the encrypted disk
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
-    machine.succeed("sync")
-    machine.crash()
+      # Boot from the encrypted disk
+      machine.succeed("${boot-luks}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
 
-    # Boot and decrypt the disk
-    machine.start()
-    machine.wait_for_console_text("Please enter passphrase for disk cryptroot")
-    machine.send_console("supersecret\n")
-    machine.wait_for_unit("multi-user.target")
+      # Boot and decrypt the disk
+      machine.start()
+      machine.wait_for_console_text("Please enter passphrase for disk cryptroot")
+      machine.send_console("supersecret\n")
+      machine.wait_for_unit("multi-user.target")
 
-    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount"), "/dev/mapper/cryptroot do not appear in mountpoints list"
-    assert "/dev/mapper/cryptroot2 on /cryptroot2 type ext4" in machine.succeed("mount")
-  '';
+      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount"), "/dev/mapper/cryptroot do not appear in mountpoints list"
+      assert "/dev/mapper/cryptroot2 on /cryptroot2 type ext4" in machine.succeed("mount")
+    '';
 }

nixos/tests/systemd-initrd-luks-tpm2.nix

@@ -35,21 +35,27 @@
       };
     };
 
-  testScript = ''
-    # Create encrypted volume
-    machine.wait_for_unit("multi-user.target")
-    machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
-    machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdb cryptroot")
-    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
-    machine.succeed("PASSWORD=supersecret SYSTEMD_LOG_LEVEL=debug systemd-cryptenroll --tpm2-pcrs= --tpm2-device=auto /dev/vdb |& systemd-cat")
+  testScript =
+    { nodes, ... }:
+    let
+      boot-luks = nodes.machine.specialisation.boot-luks.configuration.system.build.toplevel;
+    in
+    # python
+    ''
+      # Create encrypted volume
+      machine.wait_for_unit("multi-user.target")
+      machine.succeed("echo -n supersecret | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+      machine.succeed("echo -n supersecret | cryptsetup luksOpen -q /dev/vdb cryptroot")
+      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
+      machine.succeed("PASSWORD=supersecret SYSTEMD_LOG_LEVEL=debug systemd-cryptenroll --tpm2-pcrs= --tpm2-device=auto /dev/vdb |& systemd-cat")
 
-    # Boot from the encrypted disk
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
-    machine.succeed("sync")
-    machine.crash()
+      # Boot from the encrypted disk
+      machine.succeed("${boot-luks}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
 
-    # Boot and decrypt the disk
-    machine.wait_for_unit("multi-user.target")
-    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
-  '';
+      # Boot and decrypt the disk
+      machine.wait_for_unit("multi-user.target")
+      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount")
+    '';
 }

nixos/tests/systemd-initrd-luks-unl0kr.nix

@@ -82,33 +82,39 @@ in
       };
     };
 
-  testScript = ''
-    machine.wait_for_unit("multi-user.target")
+  testScript =
+    { nodes, ... }:
+    let
+      boot-luks = nodes.machine.specialisation.boot-luks.configuration.system.build.toplevel;
+    in
+    # python
+    ''
+      machine.wait_for_unit("multi-user.target")
 
-    machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
-    machine.succeed("echo -n ${passphrase} | cryptsetup luksOpen   -q               /dev/vdb cryptroot")
-    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
+      machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdb -")
+      machine.succeed("echo -n ${passphrase} | cryptsetup luksOpen   -q               /dev/vdb cryptroot")
+      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot")
 
-    machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
-    machine.succeed("echo -n ${passphrase} | cryptsetup luksOpen   -q               /dev/vdc cryptroot2")
-    machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
+      machine.succeed("echo -n ${passphrase} | cryptsetup luksFormat -q --iter-time=1 /dev/vdc -")
+      machine.succeed("echo -n ${passphrase} | cryptsetup luksOpen   -q               /dev/vdc cryptroot2")
+      machine.succeed("mkfs.ext4 /dev/mapper/cryptroot2")
 
-    # Boot from the encrypted disk
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-luks.conf")
-    machine.succeed("sync")
-    machine.crash()
+      # Boot from the encrypted disk
+        machine.succeed("${boot-luks}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
 
-    # Boot and decrypt the disk. This part of the test is SLOW.
-    machine.start()
-    machine.wait_for_unit("unl0kr-agent.service")
-    machine.screenshot("prompt")
-    machine.send_chars("${passphrase}")
-    machine.screenshot("pw")
-    machine.send_chars("\n")
-    machine.switch_root()
-    machine.wait_for_unit("multi-user.target")
+      # Boot and decrypt the disk. This part of the test is SLOW.
+      machine.start()
+      machine.wait_for_unit("unl0kr-agent.service")
+      machine.screenshot("prompt")
+      machine.send_chars("${passphrase}")
+      machine.screenshot("pw")
+      machine.send_chars("\n")
+      machine.switch_root()
+      machine.wait_for_unit("multi-user.target")
 
-    assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount"), "/dev/mapper/cryptroot do not appear in mountpoints list"
-    assert "/dev/mapper/cryptroot2 on /cryptroot2 type ext4" in machine.succeed("mount")
-  '';
+      assert "/dev/mapper/cryptroot on / type ext4" in machine.succeed("mount"), "/dev/mapper/cryptroot do not appear in mountpoints list"
+      assert "/dev/mapper/cryptroot2 on /cryptroot2 type ext4" in machine.succeed("mount")
+    '';
 }

nixos/tests/systemd-initrd-swraid.nix

@@ -1,4 +1,4 @@
-{ lib, pkgs, ... }:
+{ lib, ... }:
 {
   name = "systemd-initrd-swraid";
 
@@ -41,30 +41,36 @@
       specialisation.build-old-initrd.configuration.boot.initrd.systemd.enable = lib.mkForce false;
     };
 
-  testScript = ''
-    # Create RAID
-    machine.succeed("mdadm --create --force /dev/md0 -n 2 --level=raid1 /dev/vdb /dev/vdc --metadata=0.90 --bitmap=internal")
-    machine.succeed("mkfs.ext4 -L testraid /dev/md0")
-    machine.succeed("mkdir -p /mnt && mount /dev/md0 /mnt && echo hello > /mnt/test && umount /mnt")
+  testScript =
+    { nodes, ... }:
+    let
+      boot-swraid = nodes.machine.specialisation.boot-swraid.configuration.system.build.toplevel;
+    in
+    # python
+    ''
+      # Create RAID
+      machine.succeed("mdadm --create --force /dev/md0 -n 2 --level=raid1 /dev/vdb /dev/vdc --metadata=0.90 --bitmap=internal")
+      machine.succeed("mkfs.ext4 -L testraid /dev/md0")
+      machine.succeed("mkdir -p /mnt && mount /dev/md0 /mnt && echo hello > /mnt/test && umount /mnt")
 
-    # Boot from the RAID
-    machine.succeed("bootctl set-default nixos-generation-1-specialisation-boot-swraid.conf")
-    machine.succeed("sync")
-    machine.crash()
-    machine.wait_for_unit("multi-user.target")
+      # Boot from the RAID
+      machine.succeed("${boot-swraid}/bin/switch-to-configuration boot")
+      machine.succeed("sync")
+      machine.crash()
+      machine.wait_for_unit("multi-user.target")
 
-    # Ensure we have successfully booted from the RAID
-    assert "(initrd)" in machine.succeed("systemd-analyze")  # booted with systemd in stage 1
-    assert "/dev/md0 on / type ext4" in machine.succeed("mount")
-    assert "hello" in machine.succeed("cat /test")
-    assert "md0" in machine.succeed("cat /proc/mdstat")
+      # Ensure we have successfully booted from the RAID
+      assert "(initrd)" in machine.succeed("systemd-analyze")  # booted with systemd in stage 1
+      assert "/dev/md0 on / type ext4" in machine.succeed("mount")
+      assert "hello" in machine.succeed("cat /test")
+      assert "md0" in machine.succeed("cat /proc/mdstat")
 
-    # Verify the RAID array was properly auto-detected and assembled
-    detail = machine.succeed("mdadm --detail /dev/md0")
-    assert "raid1" in detail, f"Expected raid1 in mdadm detail output: {detail}"
-    assert "/dev/vdb" in detail, f"Expected /dev/vdb in array: {detail}"
-    assert "/dev/vdc" in detail, f"Expected /dev/vdc in array: {detail}"
+      # Verify the RAID array was properly auto-detected and assembled
+      detail = machine.succeed("mdadm --detail /dev/md0")
+      assert "raid1" in detail, f"Expected raid1 in mdadm detail output: {detail}"
+      assert "/dev/vdb" in detail, f"Expected /dev/vdb in array: {detail}"
+      assert "/dev/vdc" in detail, f"Expected /dev/vdc in array: {detail}"
 
-    machine.wait_for_unit("mdmonitor.service")
-  '';
+      machine.wait_for_unit("mdmonitor.service")
+    '';
 }

nixos/tests/systemd-timesyncd-nscd-dnssec.nix

@@ -20,7 +20,7 @@ let
   ntpIP = "192.0.2.1";
 in
 {
-  name = "systemd-timesyncd";
+  name = "systemd-timesyncd-nscd-dnssec";
   nodes.machine =
     {
       pkgs,
@@ -50,9 +50,7 @@ in
       # Configure systemd-timesyncd to use our NTP hostname
       services.timesyncd.enable = lib.mkForce true;
       services.timesyncd.servers = [ ntpHostname ];
-      services.timesyncd.extraConfig = ''
-        FallbackNTP=${ntpHostname}
-      '';
+      services.timesyncd.settings.Time.FallbackNTP = ntpHostname;
 
       # The debug output is necessary to determine whether systemd-timesyncd successfully resolves our NTP hostname or not
       systemd.services.systemd-timesyncd.environment.SYSTEMD_LOG_LEVEL = "debug";

nixos/tests/systemd-timesyncd.nix

@@ -0,0 +1,31 @@
+{
+  name = "systemd-timesyncd";
+  meta = {
+    maintainers = [ ];
+  };
+
+  nodes.machine =
+    { lib, ... }:
+    {
+      services.timesyncd = {
+        enable = lib.mkForce true;
+        servers = [ "ntp.example.com" ];
+        fallbackServers = [ "fallback.example.com" ];
+        settings.Time = {
+          PollIntervalMaxSec = "180";
+          RootDistanceMaxSec = "5";
+        };
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+
+    with subtest("settings.Time renders timesyncd.conf"):
+      machine.succeed("grep -F '[Time]' /etc/systemd/timesyncd.conf")
+      machine.succeed("grep -F 'NTP=ntp.example.com' /etc/systemd/timesyncd.conf")
+      machine.succeed("grep -F 'FallbackNTP=fallback.example.com' /etc/systemd/timesyncd.conf")
+      machine.succeed("grep -F 'PollIntervalMaxSec=180' /etc/systemd/timesyncd.conf")
+      machine.succeed("grep -F 'RootDistanceMaxSec=5' /etc/systemd/timesyncd.conf")
+  '';
+}

nixos/tests/uptermd.nix

@@ -21,6 +21,11 @@ in
           enable = true;
           openFirewall = true;
           port = 1337;
+          # required to match certificate principals
+          extraFlags = [
+            "--hostname"
+            "server"
+          ];
         };
       };
     client1 = client;
@@ -58,7 +63,7 @@ in
     client2.execute("ssh-keygen -t ed25519 -N \"\" -f /root/.ssh/id_ed25519")
 
     # Grep the ssh connect command from the output of 'upterm host'
-    ssh_command = client1.succeed("grep 'SSH Command' /tmp/session-details | awk -F'│' '{print $3}'").strip()
+    ssh_command = client1.succeed("grep -m1 '^[[:space:]]*ssh' /tmp/session-details").strip()
 
     # Connect with client2. Because we used '--force-command hostname' we should get "client1" as the output
     output = client2.succeed(ssh_command)

nixos/tests/web-apps/pdfding/basic.nix

@@ -34,6 +34,10 @@
 
         # enable mailpit
         services.mailpit.instances.default = { };
+
+        # allows running nixos test on qemu without kvm, eg. github actions on aarch64-linux
+        systemd.settings.Manager.DefaultDeviceTimeoutSec = lib.mkForce 1800;
+        boot.initrd.kernelModules = [ "virtio_console" ];
       };
   };
 

nixos/tests/web-apps/pdfding/e2e.nix

@@ -42,6 +42,10 @@
             # it only cares about files in static/
           ))
         ];
+
+        # allows running nixos test on qemu without kvm, eg. github actions on aarch64-linux
+        systemd.settings.Manager.DefaultDeviceTimeoutSec = lib.mkForce 1800;
+        boot.initrd.kernelModules = [ "virtio_console" ];
       };
   };
 

nixos/tests/web-apps/pdfding/postgres.nix

@@ -25,6 +25,10 @@
         environment.systemPackages = [
           config.services.postgresql.finalPackage
         ];
+
+        # allows running nixos test on qemu without kvm, eg. github actions on aarch64-linux
+        systemd.settings.Manager.DefaultDeviceTimeoutSec = lib.mkForce 1800;
+        boot.initrd.kernelModules = [ "virtio_console" ];
       };
   };
 

nixos/tests/web-apps/pdfding/s3-backups.nix

@@ -92,6 +92,10 @@ in
           minio-client
           sqlite
         ];
+
+        # allows running nixos test on qemu without kvm, eg. github actions on aarch64-linux
+        systemd.settings.Manager.DefaultDeviceTimeoutSec = lib.mkForce 1800;
+        boot.initrd.kernelModules = [ "virtio_console" ];
       };
   };
 

nixos/tests/web-apps/pixelfed/default.nix

@@ -4,6 +4,7 @@
 let
   supportedSystems = [
     "x86_64-linux"
+    "aarch64-linux"
     "i686-linux"
   ];
 in

nixos/tests/web-apps/pixelfed/standard.nix

@@ -4,7 +4,7 @@
 
   nodes = {
     server =
-      { pkgs, ... }:
+      { pkgs, lib, ... }:
       {
         services.pixelfed = {
           enable = true;
@@ -19,16 +19,25 @@
           );
           settings."FORCE_HTTPS_URLS" = false;
         };
+
+        # to prevent getting killed by oom
+        virtualisation.memorySize = 2048;
+        virtualisation.emptyDiskImages = [ 4096 ];
+        swapDevices = [ { device = "/dev/vdb"; } ];
+
+        # allows running nixos test on qemu without kvm, eg. github actions on aarch64-linux
+        systemd.settings.Manager.DefaultDeviceTimeoutSec = lib.mkForce 1800;
+        boot.initrd.kernelModules = [ "virtio_console" ];
       };
   };
 
   testScript = ''
     # Wait for Pixelfed PHP pool
-    server.wait_for_unit("phpfpm-pixelfed.service")
+    server.wait_for_unit("phpfpm-pixelfed.service", timeout=1800)
     # Wait for NGINX
-    server.wait_for_unit("nginx.service")
+    server.wait_for_unit("nginx.service", timeout=1800)
     # Wait for HTTP port
-    server.wait_for_open_port(80)
+    server.wait_for_open_port(80, timeout=1800)
     # Access the homepage.
     server.succeed("curl -H 'Host: pixelfed.local' http://localhost")
     # Create an account

nixos/tests/zfs.nix

@@ -1,12 +1,11 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
+  system,
+  pkgs,
+  runTest,
 }:
 
-with import ../lib/testing-python.nix { inherit system pkgs; };
-
 let
+  inherit (pkgs) lib;
 
   makeZfsTest =
     {
@@ -15,11 +14,9 @@ let
       zfsPackage,
       extraTest ? "",
     }:
-    makeTest {
+    runTest {
       name = zfsPackage.kernelModuleAttribute;
-      meta = with pkgs.lib.maintainers; {
-        maintainers = [ elvishjerricco ];
-      };
+      meta.maintainers = with lib.maintainers; [ elvishjerricco ];
 
       nodes.machine =
         {
@@ -124,82 +121,90 @@ let
           };
         };
 
-      testScript = ''
-        machine.wait_for_unit("multi-user.target")
-        machine.succeed(
-            "zpool status",
-            "parted --script /dev/vdb mklabel msdos",
-            "parted --script /dev/vdb -- mkpart primary 1024M -1s",
-            "parted --script /dev/vdc mklabel msdos",
-            "parted --script /dev/vdc -- mkpart primary 1024M -1s",
-        )
+      testScript =
+        { nodes, ... }:
+        let
+          samba = nodes.machine.specialisation.samba.configuration.system.build.toplevel;
+          encryption = nodes.machine.specialisation.encryption.configuration.system.build.toplevel;
+          forcepool = nodes.machine.specialisation.forcepool.configuration.system.build.toplevel;
+        in
+        # python
+        ''
+          machine.wait_for_unit("multi-user.target")
+          machine.succeed(
+              "zpool status",
+              "parted --script /dev/vdb mklabel msdos",
+              "parted --script /dev/vdb -- mkpart primary 1024M -1s",
+              "parted --script /dev/vdc mklabel msdos",
+              "parted --script /dev/vdc -- mkpart primary 1024M -1s",
+          )
 
-        with subtest("sharesmb works"):
-            machine.succeed(
-                "zpool create rpool /dev/vdb1",
-                "zfs create -o mountpoint=legacy rpool/root",
-                # shared datasets cannot have legacy mountpoint
-                "zfs create rpool/shared_smb",
-                "bootctl set-default nixos-generation-1-specialisation-samba.conf",
-                "sync",
-            )
-            machine.crash()
-            machine.wait_for_unit("multi-user.target")
-            machine.succeed("zfs set sharesmb=on rpool/shared_smb")
-            machine.succeed(
-                "smbclient -gNL localhost | grep rpool_shared_smb",
-                "umount /tmp/mnt",
-                "zpool destroy rpool",
-            )
+          with subtest("sharesmb works"):
+              machine.succeed(
+                  "zpool create rpool /dev/vdb1",
+                  "zfs create -o mountpoint=legacy rpool/root",
+                  # shared datasets cannot have legacy mountpoint
+                  "zfs create rpool/shared_smb",
+                  "${samba}/bin/switch-to-configuration boot",
+                  "sync",
+              )
+              machine.crash()
+              machine.wait_for_unit("multi-user.target")
+              machine.succeed("zfs set sharesmb=on rpool/shared_smb")
+              machine.succeed(
+                  "smbclient -gNL localhost | grep rpool_shared_smb",
+                  "umount /tmp/mnt",
+                  "zpool destroy rpool",
+              )
 
-        with subtest("encryption works"):
-            machine.succeed(
-                'echo password | zpool create -O mountpoint=legacy '
-                + "-O encryption=aes-256-gcm -O keyformat=passphrase automatic /dev/vdb1",
-                "zpool create -O mountpoint=legacy manual /dev/vdc1",
-                "echo otherpass | zfs create "
-                + "-o encryption=aes-256-gcm -o keyformat=passphrase manual/encrypted",
-                "zfs create -o encryption=aes-256-gcm -o keyformat=passphrase "
-                + "-o keylocation=http://localhost/zfskey manual/httpkey",
-                "bootctl set-default nixos-generation-1-specialisation-encryption.conf",
-                "sync",
-                "zpool export automatic",
-                "zpool export manual",
-            )
-            machine.crash()
-            machine.start()
-            machine.wait_for_console_text("Starting password query on")
-            machine.send_console("password\n")
-            machine.wait_for_unit("multi-user.target")
-            machine.succeed(
-                "zfs get -Ho value keystatus manual/encrypted | grep -Fx unavailable",
-                "echo otherpass | zfs load-key manual/encrypted",
-                "systemctl start manual-encrypted.mount",
-                "zfs load-key manual/httpkey",
-                "systemctl start manual-httpkey.mount",
-                "umount /automatic /manual/encrypted /manual/httpkey /manual",
-                "zpool destroy automatic",
-                "zpool destroy manual",
-            )
+          with subtest("encryption works"):
+              machine.succeed(
+                  'echo password | zpool create -O mountpoint=legacy '
+                  + "-O encryption=aes-256-gcm -O keyformat=passphrase automatic /dev/vdb1",
+                  "zpool create -O mountpoint=legacy manual /dev/vdc1",
+                  "echo otherpass | zfs create "
+                  + "-o encryption=aes-256-gcm -o keyformat=passphrase manual/encrypted",
+                  "zfs create -o encryption=aes-256-gcm -o keyformat=passphrase "
+                  + "-o keylocation=http://localhost/zfskey manual/httpkey",
+                  "${encryption}/bin/switch-to-configuration boot",
+                  "sync",
+                  "zpool export automatic",
+                  "zpool export manual",
+              )
+              machine.crash()
+              machine.start()
+              machine.wait_for_console_text("Starting password query on")
+              machine.send_console("password\n")
+              machine.wait_for_unit("multi-user.target")
+              machine.succeed(
+                  "zfs get -Ho value keystatus manual/encrypted | grep -Fx unavailable",
+                  "echo otherpass | zfs load-key manual/encrypted",
+                  "systemctl start manual-encrypted.mount",
+                  "zfs load-key manual/httpkey",
+                  "systemctl start manual-httpkey.mount",
+                  "umount /automatic /manual/encrypted /manual/httpkey /manual",
+                  "zpool destroy automatic",
+                  "zpool destroy manual",
+              )
 
-        with subtest("boot.zfs.forceImportAll works"):
-            machine.succeed(
-                "rm /etc/hostid",
-                "zgenhostid deadcafe",
-                "zpool create forcepool /dev/vdb1 -O mountpoint=legacy",
-                "bootctl set-default nixos-generation-1-specialisation-forcepool.conf",
-                "rm /etc/hostid",
-                "sync",
-            )
-            machine.crash()
-            machine.wait_for_unit("multi-user.target")
-            machine.fail("zpool import forcepool")
-            machine.succeed(
-                "systemctl start forcepool.mount",
-                "mount | grep forcepool",
-            )
-      ''
-      + extraTest;
+          with subtest("boot.zfs.forceImportAll works"):
+              machine.succeed(
+                  "rm /etc/hostid",
+                  "zgenhostid deadcafe",
+                  "zpool create forcepool /dev/vdb1 -O mountpoint=legacy",
+                  "${forcepool}/bin/switch-to-configuration boot",
+                  "rm /etc/hostid",
+                  "sync",
+              )
+              machine.crash()
+              machine.wait_for_unit("multi-user.target")
+              machine.fail("zpool import forcepool")
+              machine.succeed(
+                  "systemctl start forcepool.mount",
+                  "mount | grep forcepool",
+              )
+        ''
+        + extraTest;
 
     };
 
@@ -250,7 +255,7 @@ in
       systemdStage1 = true;
     }).zfsroot;
 
-  expand-partitions = makeTest {
+  expand-partitions = runTest {
     name = "multi-disk-zfs";
     nodes = {
       machine =

pkgs/applications/editors/android-studio/default.nix

@@ -21,14 +21,14 @@ let
     url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2025.3.4.7/android-studio-panda4-patch1-linux.tar.gz";
   };
   betaVersion = {
-    version = "2026.1.1.6"; # "Android Studio Quail 1 | 2026.1.1 RC 1"
-    sha256Hash = "sha256-b6PVgBTTjIgm6BI171RL7T6GJD9ApnTWGOTqvt703PQ=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.1.6/android-studio-quail1-rc1-linux.tar.gz";
+    version = "2026.1.1.7"; # "Android Studio Quail 1 | 2026.1.1 RC 2"
+    sha256Hash = "sha256-TB9hPynvVq1axv6oAw8un6WHVHakZPvEBjfPCs+Dwj0=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.1.7/android-studio-quail1-rc2-linux.tar.gz";
   };
   latestVersion = {
-    version = "2026.1.2.2"; # "Android Studio Quail 2 | 2026.1.2 Canary 2"
-    sha256Hash = "sha256-+FmW72k48GF71yzCdpIAl//qi6w26Qg8gZUW5/Nuh58=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.2.2/android-studio-quail2-canary2-linux.tar.gz";
+    version = "2026.1.2.4"; # "Android Studio Quail 2 | 2026.1.2 Canary 4"
+    sha256Hash = "sha256-fnJYHZPy9bOZJ2leG2+Mr5JGH5HMc2HeMeYGHBUxJXo=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.2.4/android-studio-quail2-canary4-linux.tar.gz";
   };
 in
 {

pkgs/applications/editors/emacs/default.nix

@@ -13,10 +13,24 @@ lib.makeScope pkgs.newScope (
       inherit lib;
       inherit (pkgs)
         fetchFromGitHub
-        fetchzip
+        fetchgit
         ;
     };
 
+    emacs31 = callPackage (self.sources.emacs31) inheritedArgs;
+
+    emacs31-gtk3 = self.emacs31.override {
+      withGTK3 = true;
+    };
+
+    emacs31-nox = self.emacs31.override {
+      noGui = true;
+    };
+
+    emacs31-pgtk = self.emacs31.override {
+      withPgtk = true;
+    };
+
     emacs30 = callPackage (self.sources.emacs30) inheritedArgs;
 
     emacs30-gtk3 = self.emacs30.override {
@@ -31,11 +45,6 @@ lib.makeScope pkgs.newScope (
       withPgtk = true;
     };
 
-    emacs30-macport = callPackage (self.sources.emacs30-macport) (
-      inheritedArgs
-      // {
-        srcRepo = true;
-      }
-    );
+    emacs30-macport = callPackage (self.sources.emacs30-macport) inheritedArgs;
   }
 )

pkgs/applications/editors/emacs/elisp-packages/manual-packages/ebuild-mode/package.nix

@@ -6,11 +6,11 @@
 
 melpaBuild (finalAttrs: {
   pname = "ebuild-mode";
-  version = "1.82";
+  version = "1.83";
 
   src = fetchzip {
     url = "https://gitweb.gentoo.org/proj/ebuild-mode.git/snapshot/ebuild-mode-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-Rb1L++Ln7jGmdIpXTIBg7x64hHAm0b/yJqILKllCNQs=";
+    hash = "sha256-xZA3Vkh8frgXzyGZs5UELdBh0vrcsXJN/2aJX56QH0Y=";
   };
 
   meta = {

pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix

@@ -13,13 +13,13 @@ let
 
   pname = "ghostel";
 
-  version = "0-unstable-2026-05-23";
+  version = "0.31.0-unstable-2026-06-01";
 
   src = fetchFromGitHub {
     owner = "dakra";
     repo = "ghostel";
-    rev = "cd32af7bd6b9c827701a62ed8f0c3bc705800f13";
-    hash = "sha256-5XmHI+lkzLFW8VNVC3eyc+msi6y+Qh6q6WsBZpHNEf4=";
+    rev = "09aad9fefffce6370256a9888a1ed4f77535fcfd";
+    hash = "sha256-CKN0m+DVvxJhLkr/Hi/44w0m+kJVrx28axLCKLogIQs=";
   };
 
   module = stdenv.mkDerivation (finalAttrs: {

pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix

@@ -773,7 +773,7 @@ let
           mozc = super.mozc.overrideAttrs (attrs: {
             postPatch = attrs.postPatch or "" + ''
               substituteInPlace src/unix/emacs/mozc.el \
-                --replace '"mozc_emacs_helper"' '"${pkgs.ibus-engines.mozc}/lib/mozc/mozc_emacs_helper"'
+                --replace '"mozc_emacs_helper"' '"${pkgs.mozc}/bin/mozc_emacs_helper"'
             '';
           });
 

pkgs/applications/editors/emacs/make-emacs.nix

@@ -29,7 +29,6 @@
   gtk3-x11,
   harfbuzz,
   imagemagick,
-  jansson,
   libxaw,
   libxcursor,
   libxft,
@@ -66,7 +65,7 @@
   # Boolean flags
   withNativeCompilation ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
   noGui ? false,
-  srcRepo ? false,
+  srcRepo ? true,
   withAcl ? false,
   withAlsaLib ? false,
   withAthena ? false,
@@ -80,8 +79,6 @@
   withGpm ? stdenv.hostPlatform.isLinux,
   # https://github.com/emacs-mirror/emacs/blob/emacs-27.2/etc/NEWS#L118-L120
   withImageMagick ? false,
-  # Emacs 30+ has native JSON support
-  withJansson ? lib.versionOlder version "30",
   withMailutils ? true,
   withMotif ? false,
   withNS ? stdenv.hostPlatform.isDarwin && !(variant == "macport" || noGui),
@@ -256,9 +253,6 @@ stdenv.mkDerivation (finalAttrs: {
     gnutls
     (lib.getDev harfbuzz)
   ]
-  ++ lib.optionals withJansson [
-    jansson
-  ]
   ++ [
     libxml2
     ncurses

pkgs/applications/editors/emacs/sources.nix

@@ -1,7 +1,7 @@
 {
   lib,
   fetchFromGitHub,
-  fetchzip,
+  fetchgit,
 }:
 
 let
@@ -26,9 +26,9 @@ let
       src =
         {
           "mainline" = (
-            fetchzip {
-              url = "mirror://gnu/emacs/${rev}.tar.xz";
-              inherit hash;
+            fetchgit {
+              url = "https://https.git.savannah.gnu.org/git/emacs.git";
+              inherit rev hash;
             }
           );
           "macport" = (
@@ -74,7 +74,7 @@ let
         '';
         changelog =
           {
-            "mainline" = "https://www.gnu.org/savannah-checkouts/gnu/emacs/news/NEWS.${version}";
+            "mainline" = "https://cgit.git.savannah.gnu.org/cgit/emacs.git/plain/etc/NEWS?h=${rev}";
             "macport" = "https://github.com/jdtsmith/emacs-mac/blob/${rev}/NEWS-mac";
           }
           .${variant};
@@ -105,12 +105,20 @@ let
     };
 in
 {
+  emacs31 = import ./make-emacs.nix (mkArgs {
+    pname = "emacs";
+    version = "31.0.90";
+    variant = "mainline";
+    rev = "emacs-31.0.90";
+    hash = "sha256-Rzlnn+NKQ+jICXLNop27RnVInq79myn4hueJieDO2Ck=";
+  });
+
   emacs30 = import ./make-emacs.nix (mkArgs {
     pname = "emacs";
     version = "30.2";
     variant = "mainline";
     rev = "emacs-30.2";
-    hash = "sha256-W2eZ+cNQhi/fMeRkwOqSKU7Vzvp43WUOpiwaLLNEXtg=";
+    hash = "sha256-3Lfb3HqdlXqSnwJfxe7npa4GGR9djldy8bKRpkQCdSA=";
     patches = fetchpatch: [
       (fetchpatch {
         name = "fix-off-by-one-mistake-80851-CVE-2026-6861.patch";

pkgs/applications/editors/neovim/tests/default.nix

@@ -9,6 +9,7 @@
 */
 {
   vimUtils,
+  neovimUtils,
   writeText,
   neovim,
   vimPlugins,
@@ -444,4 +445,117 @@ pkgs.lib.recurseIntoAttrs rec {
   '';
 
   inherit (vimPlugins) corePlugins;
+
+  nvim_require_check_lua_module =
+    let
+      inherit (neovim-unwrapped.lua.pkgs) luaexpat luassert;
+    in
+    vimUtils.buildVimPlugin {
+      pname = "neovim-require-check-lua-module-test";
+      version = "0";
+      src = runCommandLocal "neovim-require-check-lua-module-src" { } ''
+        mkdir -p "$out/lua/require-check-luamods"
+        mkdir -p "$out/plugin"
+        cat > "$out/plugin/require-check-luamods.vim" <<'EOF'
+        let g:require_check_luamods_plugin_loaded = 1
+        EOF
+        cat > "$out/lua/require-check-luamods/init.lua" <<'EOF'
+        if vim.g.require_check_luamods_plugin_loaded ~= 1 then
+          error("plugin script was not sourced")
+        end
+        -- lxp: direct C dependency from luaexpat (package.cpath)
+        require("lxp")
+        -- say: transitive dependency of luassert (package.path closure)
+        require("say")
+        return {}
+        EOF
+      '';
+      requiredLuaModules = [
+        luaexpat
+        luassert
+      ];
+    };
+
+  nvim_require_check_passthru_lua_module =
+    let
+      inherit (neovim-unwrapped.lua.pkgs) luassert;
+    in
+    vimUtils.buildVimPlugin {
+      pname = "neovim-require-check-passthru-lua-module-test";
+      version = "0";
+      src = runCommandLocal "neovim-require-check-passthru-lua-module-src" { } ''
+        mkdir -p "$out/lua/require-check-passthru-luamods"
+        cat > "$out/lua/require-check-passthru-luamods/init.lua" <<'EOF'
+        require("say")
+        return {}
+        EOF
+      '';
+      passthru.requiredLuaModules = [ luassert ];
+    };
+
+  nvim_require_check_neovim_plugin =
+    let
+      luaPkg = neovim-unwrapped.lua.pkgs.buildLuarocksPackage {
+        pname = "neovim-require-check-fails";
+        version = "0.0.1-1";
+        src = runCommandLocal "neovim-require-check-fails-src" { } ''
+          mkdir -p "$out"
+          cat > "$out/neovim-require-check-fails-0.0.1-1.rockspec" <<'EOF'
+          package = "neovim-require-check-fails"
+          version = "0.0.1-1"
+          source = {
+            url = "."
+          }
+          build = {
+            type = "none"
+          }
+          EOF
+        '';
+      };
+    in
+    testers.testBuildFailure (
+      neovimUtils.buildNeovimPlugin {
+        luaAttr = luaPkg;
+        doCheck = true;
+        postInstall = ''
+          mkdir -p "$out/lua"
+          cat > "$out/lua/require_check_fails.lua" <<'EOF'
+          error("neovimRequireCheckHook required installed module")
+          EOF
+        '';
+      }
+    );
+
+  nvim_require_check_ignores_test_modules = vimUtils.buildVimPlugin {
+    pname = "neovim-require-check-ignores-test-modules";
+    version = "0";
+    src = runCommandLocal "neovim-require-check-ignores-test-modules-src" { } ''
+      mkdir -p \
+        "$out/lua/require-check-ignores"/{debug,script,scripts,test,tests,spec,_meta} \
+        "$out/lua/require-check-ignores"
+      cat > "$out/lua/require-check-ignores/init.lua" <<'EOF'
+      return {}
+      EOF
+      for dir in debug script scripts test tests spec _meta; do
+        cat > "$out/lua/require-check-ignores/$dir/failing.lua" <<EOF
+      error("excluded $dir directory was required")
+      EOF
+      done
+      cat > "$out/lua/require-check-ignores/failing_meta.lua" <<'EOF'
+      error("excluded _meta module was required")
+      EOF
+      cat > "$out/lua/require-check-ignores/failing_spec.lua" <<'EOF'
+      error("excluded _spec module was required")
+      EOF
+      cat > "$out/lua/require-check-ignores/failing.spec.lua" <<'EOF'
+      error("excluded .spec module was required")
+      EOF
+      cat > "$out/lua/require-check-ignores/failing.test.lua" <<'EOF'
+      error("excluded .test module was required")
+      EOF
+      cat > "$out/lua/require-check-ignores/meta.lua" <<'EOF'
+      error("excluded meta module was required")
+      EOF
+    '';
+  };
 }

pkgs/applications/editors/vim/plugins/hooks/neovim-require-check-hook.sh

@@ -4,17 +4,27 @@ echo "Sourcing neovim-require-check-hook.sh"
 
 # Discover modules automatically if nvimRequireCheck is not set
 discover_modules() {
-    echo "Running module discovery in source directory..."
+    echo "Running module discovery in output directory..."
 
     # Create unique lists so we can organize later
     modules=()
 
     while IFS= read -r lua_file; do
-        # Ignore certain infra directories
-        if [[ "$lua_file" =~ (^|/)(debug|script|scripts|test|tests|spec)(/|$) || "$lua_file" =~ .*\meta.lua ]]; then
-            continue
+        # Ignore infrastructure directories and non-runtime module files
+        case "/$lua_file/" in
+            */debug/* | */script/* | */scripts/* | */test/* | */tests/* | */spec/* | */_meta/*)
+                continue
+                ;;
+        esac
+
+        case "${lua_file##*/}" in
+            *meta.lua | *_spec.lua | *.spec.lua | *.test.lua)
+                continue
+                ;;
+        esac
+
         # Ignore optional telescope and lualine modules
-        elif [[ "$lua_file" =~ ^lua/telescope/_extensions/(.+)\.lua || "$lua_file" =~ ^lua/lualine/(.+)\.lua ]]; then
+        if [[ "$lua_file" =~ ^lua/telescope/_extensions/(.+)\.lua || "$lua_file" =~ ^lua/lualine/(.+)\.lua ]]; then
             continue
         # Grab main module names
         elif [[ "$lua_file" =~ ^lua/([^/]+)/init.lua$ ]]; then
@@ -30,7 +40,7 @@ discover_modules() {
             echo "$lua_file"
             modules+=("${BASH_REMATCH[1]}")
         fi
-    done < <(find "$src" -name '*.lua' | xargs -n 1 realpath --relative-to="$src")
+    done < <(find "$out" -name '*.lua' -exec realpath --relative-to="$out" {} +)
 
     nvimRequireCheck=("${modules[@]}")
     echo "Discovered modules: ${nvimRequireCheck[*]}"
@@ -53,6 +63,12 @@ run_require_checks() {
     local deps="${dependencies[*]}"
     local nativeCheckInputs="${nativeBuildInputs[*]}"
     local checkInputs="${buildInputs[*]}"
+
+    local -a luaPathArgs=()
+    if [ -n "${nvimRequireCheckLuaPath:-}" ] || [ -n "${nvimRequireCheckLuaCPath:-}" ]; then
+        luaPathArgs=(--cmd "lua package.path='${nvimRequireCheckLuaPath:-}'..';'..package.path; package.cpath='${nvimRequireCheckLuaCPath:-}'..';'..package.cpath")
+    fi
+
     set +e
 
     if [ -v 'nvimSkipModule' ]; then
@@ -60,6 +76,15 @@ run_require_checks() {
         echo "WARNING: nvimSkipModule got renamed to nvimSkipModules, please update package $name"
     fi
 
+    # Some modules rely on things like globals or user commands being initialised by plugin/ scripts.
+    # So this hook sets up a dummy packpath containing only the plugin to be tested
+    # and adds it with packadd before requiring each module.
+    nvimDataDir=$(nvim -u NONE -i NONE --headless --cmd "lua io.write(vim.fn.stdpath('data'))" +q)
+    packPathDir="$nvimDataDir/site"
+    packdir="$nvimDataDir/site/pack/nvimRequireCheckHook/opt"
+    mkdir -p "$packdir"
+    ln -s "$out" "$packdir/testPlugin"
+
     for name in "${nvimRequireCheck[@]}"; do
         local skip=false
         for module in "${nvimSkipModules[@]}"; do
@@ -76,6 +101,9 @@ run_require_checks() {
                 --cmd "set rtp+=$out,${deps// /,}" \
                 --cmd "set rtp+=$out,${nativeCheckInputs// /,}" \
                 --cmd "set rtp+=$out,${checkInputs// /,}" \
+                "${luaPathArgs[@]}" \
+                --cmd "set packpath^=$packPathDir" \
+                --cmd "packadd testPlugin" \
                 --cmd "lua require('$name')"; then
                 check_passed=true
                 successful_modules+=("$name")

pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix

@@ -92,7 +92,6 @@ vimUtils.buildVimPlugin {
     "avante.providers.azure"
     "avante.providers.copilot"
     "avante.providers.gemini"
-    "avante.providers.ollama"
     "avante.providers.vertex"
     "avante.providers.vertex_claude"
   ];

pkgs/applications/editors/vim/plugins/non-generated/codediff-nvim/default.nix

@@ -11,13 +11,13 @@
 }:
 vimUtils.buildVimPlugin rec {
   pname = "codediff.nvim";
-  version = "2.45.0";
+  version = "2.45.1";
 
   src = fetchFromGitHub {
     owner = "esmuellert";
     repo = "codediff.nvim";
     tag = "v${version}";
-    hash = "sha256-Up4vH5yk13don0HrmHHpqrPIKtc1MTtDbZ6QcMHQYAU=";
+    hash = "sha256-1F6z/rhZxiuI6W1ReyHP6EQFxys4qm3fbINxoy1hQZA=";
   };
 
   dependencies = [ vimPlugins.nui-nvim ];

pkgs/applications/editors/vim/plugins/non-generated/difftastic-nvim/default.nix

@@ -0,0 +1,63 @@
+{
+  vimPlugins,
+  lib,
+  vimUtils,
+  rustPlatform,
+  stdenv,
+  nix-update-script,
+  fetchFromGitHub,
+}:
+let
+  version = "0.0.9";
+  src = fetchFromGitHub {
+    owner = "clabby";
+    repo = "difftastic.nvim";
+    rev = "6041ef0244b3fecf3b7f07de9af8cfbf8dbc4945";
+    hash = "sha256-23NGKhytF3OsLJgdrC51IH/sIGoqe/yBfmPsZKHOMSk=";
+  };
+
+  difftastic-nvim-lib = rustPlatform.buildRustPackage {
+    pname = "difftastic-nvim-lib";
+    inherit version src;
+    cargoHash = "sha256-VSlFlLa4knQ7bH8yFHSKTTtt1cQ76dstlCdWBAtkf1I=";
+    postInstall = ''
+      ln -s $out/lib/libdifftastic_nvim${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/difftastic_nvim.so
+    '';
+    env.RUSTFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-C link-arg=-undefined -C link-arg=dynamic_lookup";
+  };
+in
+vimUtils.buildVimPlugin {
+  pname = "difftastic-nvim";
+  inherit version src;
+  dependencies = [
+    vimPlugins.nui-nvim
+  ];
+
+  postPatch = ''
+    substituteInPlace lua/difftastic-nvim/binary.lua \
+      --replace-fail \
+      'release_dir = plugin_root .. "/target/release"' \
+      "release_dir = '${difftastic-nvim-lib}/lib'"
+  '';
+
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "vimPlugins.difftastic-nvim.difftastic-nvim-lib";
+    };
+
+    # needed for the update script
+    inherit difftastic-nvim-lib;
+
+  };
+
+  meta = {
+    description = "Neovim plugin that displays difftastic's structural diffs in a side-by-side view with syntax highlighting";
+    homepage = "https://github.com/clabby/difftastic.nvim/";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+
+    maintainers = with lib.maintainers; [
+      auscyber
+    ];
+  };
+}

pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix

@@ -144,8 +144,6 @@ let
   grammarPlugins = lib.mapAttrs (_: grammarToPlugin) parsersWithMeta;
 in
 {
-  nvimSkipModules = [ "nvim-treesitter._meta.parsers" ];
-
   passthru = super.nvim-treesitter.passthru or { } // {
     inherit
       buildQueries

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -33,6 +33,7 @@
   libgit2,
   llvmPackages,
   neovim-unwrapped,
+  nix,
   nodejs,
   openscad,
   openssh,
@@ -228,14 +229,6 @@ assertNoAdditions {
     ];
   };
 
-  artio-nvim = super.artio-nvim.overrideAttrs {
-    # Requires extui enabled
-    nvimSkipModules = [
-      "artio.view"
-      "artio.picker"
-    ];
-  };
-
   astrocore = super.astrocore.overrideAttrs {
     dependencies = [ self.lazy-nvim ];
   };
@@ -304,9 +297,6 @@ assertNoAdditions {
       "bamboo.colors"
       "bamboo.terminal"
       "bamboo.highlights"
-      "bamboo-light"
-      "bamboo-vulgaris"
-      "bamboo-multiplex"
       "barbecue.theme.bamboo"
     ];
     meta = old.meta // {
@@ -349,15 +339,6 @@ assertNoAdditions {
 
   base46 = super.base46.overrideAttrs (old: {
     dependencies = [ self.nvchad-ui ];
-    # Requires global config setup
-    nvimSkipModules = [
-      "nvchad.configs.cmp"
-      "nvchad.configs.gitsigns"
-      "nvchad.configs.luasnip"
-      "nvchad.configs.mason"
-      "nvchad.configs.nvimtree"
-      "nvchad.configs.telescope"
-    ];
     meta = old.meta // {
       license = lib.licenses.mit;
     };
@@ -410,12 +391,6 @@ assertNoAdditions {
 
   blink-cmp-npm-nvim = super.blink-cmp-npm-nvim.overrideAttrs {
     nvimSkipModules = [
-      # Test files
-      "blink-cmp-npm.utils.compute_meta_spec"
-      "blink-cmp-npm.utils.generate_doc_spec"
-      "blink-cmp-npm.utils.ignore_version_spec"
-      "blink-cmp-npm.utils.is_cursor_in_dependencies_node_spec"
-      "blink-cmp-npm.utils.semantic_sort_spec"
       "minit"
     ];
   };
@@ -482,8 +457,6 @@ assertNoAdditions {
   catppuccin-nvim = super.catppuccin-nvim.overrideAttrs {
     nvimSkipModules = [
       "catppuccin.groups.integrations.noice"
-      "catppuccin.groups.integrations.feline"
-      "catppuccin.lib.vim.init"
 
       # TODO(@mrcjkb): re-enable when https://github.com/catppuccin/nvim/pull/995
       # has been merged and released.
@@ -664,6 +637,14 @@ assertNoAdditions {
     checkInputs = [ self.nvim-cmp ];
   };
 
+  cmp-buffer = super.cmp-buffer.overrideAttrs {
+    checkInputs = [ self.nvim-cmp ];
+  };
+
+  cmp-calc = super.cmp-calc.overrideAttrs {
+    checkInputs = [ self.nvim-cmp ];
+  };
+
   cmp-clippy = super.cmp-clippy.overrideAttrs {
     checkInputs = [ self.nvim-cmp ];
     dependencies = with self; [
@@ -675,6 +656,10 @@ assertNoAdditions {
     checkInputs = [ self.nvim-cmp ];
   };
 
+  cmp-cmdline-history = super.cmp-cmdline-history.overrideAttrs {
+    checkInputs = [ self.nvim-cmp ];
+  };
+
   cmp-conjure = super.cmp-conjure.overrideAttrs {
     checkInputs = [ self.nvim-cmp ];
     dependencies = [ self.conjure ];
@@ -696,13 +681,6 @@ assertNoAdditions {
 
   cmp-dictionary = super.cmp-dictionary.overrideAttrs {
     checkInputs = [ self.nvim-cmp ];
-    nvimSkipModules = [
-      # Test files
-      "cmp_dictionary.dict.external_spec"
-      "cmp_dictionary.dict.trie_spec"
-      "cmp_dictionary.lib.trie_spec"
-      "cmp_dictionary.lib.unknown_spec"
-    ];
   };
 
   cmp-digraphs = super.cmp-digraphs.overrideAttrs {
@@ -713,6 +691,10 @@ assertNoAdditions {
     checkInputs = [ self.nvim-cmp ];
   };
 
+  cmp-emoji = super.cmp-emoji.overrideAttrs {
+    checkInputs = [ self.nvim-cmp ];
+  };
+
   cmp-fish = super.cmp-fish.overrideAttrs {
     checkInputs = [ self.nvim-cmp ];
   };
@@ -736,6 +718,10 @@ assertNoAdditions {
     checkInputs = [ self.nvim-cmp ];
   };
 
+  cmp-latex-symbols = super.cmp-look.overrideAttrs {
+    checkInputs = [ self.nvim-cmp ];
+  };
+
   cmp-look = super.cmp-look.overrideAttrs {
     checkInputs = [ self.nvim-cmp ];
   };
@@ -746,6 +732,7 @@ assertNoAdditions {
   };
 
   cmp-nixpkgs-maintainers = super.cmp-nixpkgs-maintainers.overrideAttrs {
+    nativeCheckInputs = [ nix ];
     checkInputs = [ self.nvim-cmp ];
   };
 
@@ -754,6 +741,10 @@ assertNoAdditions {
     dependencies = [ self.plenary-nvim ];
   };
 
+  cmp-nvim-lsp-document-symbol = super.cmp-nvim-lsp-document-symbol.overrideAttrs {
+    checkInputs = [ self.nvim-cmp ];
+  };
+
   cmp-nvim-lsp-signature-help = super.cmp-nvim-lsp-signature-help.overrideAttrs {
     checkInputs = [ self.nvim-cmp ];
   };
@@ -770,6 +761,10 @@ assertNoAdditions {
     checkInputs = [ self.nvim-cmp ];
   };
 
+  cmp-omni = super.cmp-omni.overrideAttrs {
+    checkInputs = [ self.nvim-cmp ];
+  };
+
   cmp-pandoc-nvim = super.cmp-pandoc-nvim.overrideAttrs {
     checkInputs = [ self.nvim-cmp ];
     dependencies = [ self.plenary-nvim ];
@@ -792,6 +787,10 @@ assertNoAdditions {
     dependencies = [ self.nvim-snippy ];
   };
 
+  cmp-spell = super.cmp-spell.overrideAttrs {
+    checkInputs = [ self.nvim-cmp ];
+  };
+
   cmp-tabby = super.cmp-tabby.overrideAttrs {
     checkInputs = [ self.nvim-cmp ];
   };
@@ -811,6 +810,10 @@ assertNoAdditions {
     dependencies = [ tmux ];
   };
 
+  cmp-treesitter = super.cmp-treesitter.overrideAttrs {
+    checkInputs = [ self.nvim-cmp ];
+  };
+
   cmp-vim-lsp = super.cmp-vim-lsp.overrideAttrs {
     checkInputs = [ self.nvim-cmp ];
     dependencies = [ self.vim-lsp ];
@@ -839,6 +842,10 @@ assertNoAdditions {
     dependencies = [ self.luasnip ];
   };
 
+  cmp_yanky = super.cmp_yanky.overrideAttrs {
+    checkInputs = [ self.nvim-cmp ];
+  };
+
   cobalt2-nvim = super.cobalt2-nvim.overrideAttrs {
     dependencies = with self; [ colorbuddy-nvim ];
     # Few broken themes
@@ -905,12 +912,6 @@ assertNoAdditions {
     ];
     dependencies = [ self.plenary-nvim ];
     nvimSkipModules = [
-      # Requires setup call
-      "codecompanion.actions.static"
-      "codecompanion.actions.init"
-      # Address in use error from fzf-lua on darwin
-      # https://github.com/NixOS/nixpkgs/issues/431458
-      "codecompanion.providers.actions.fzf_lua"
       # Test
       "minimal"
     ];
@@ -991,13 +992,6 @@ assertNoAdditions {
   conjure = super.conjure.overrideAttrs {
     dependencies = [ self.plenary-nvim ];
     nvimSkipModules = [
-      # Test mismatch of directory because of nix generated path
-      "conjure-spec.client.clojure.nrepl.server_spec"
-      "conjure-spec.client.common-lisp.swank_spec"
-      "conjure-spec.client.fennel.nfnl_spec"
-      "conjure-spec.client.guile.socket_spec"
-      "conjure-spec.client.scheme.stdio_spec"
-      "conjure-spec.process_spec"
       # No parser for fennel
       "conjure.client.fennel.def-str-util"
     ];
@@ -1164,8 +1158,6 @@ assertNoAdditions {
 
   darkearth-nvim = super.darkearth-nvim.overrideAttrs {
     dependencies = [ self.lush-nvim ];
-    # Lua module used to build theme
-    nvimSkipModules = [ "shipwright_build" ];
   };
 
   ddc-filter-matcher_head = super.ddc-filter-matcher_head.overrideAttrs {
@@ -1321,50 +1313,24 @@ assertNoAdditions {
     dependencies = [ self.image-nvim ];
   };
 
-  diffs-nvim = super.diffs-nvim.overrideAttrs {
-    nvimSkipModules = [
-      "minimal_init"
-    ];
-  };
-
   diffview-nvim = super.diffview-nvim.overrideAttrs (old: {
     dependencies = [ self.plenary-nvim ];
 
-    nvimSkipModules = [
-      # https://github.com/sindrets/diffview.nvim/issues/498
-      "diffview.api.views.diff.diff_view"
-      "diffview.scene.layouts.diff_2"
-      "diffview.scene.layouts.diff_2_hor"
-      "diffview.scene.layouts.diff_2_ver"
-      "diffview.scene.layouts.diff_3"
-      "diffview.scene.layouts.diff_3_hor"
-      "diffview.scene.layouts.diff_3_mixed"
-      "diffview.scene.layouts.diff_3_ver"
-      "diffview.scene.layouts.diff_4"
-      "diffview.scene.layouts.diff_4_mixed"
-      "diffview.scene.views.diff.diff_view"
-      "diffview.scene.views.file_history.file_history_panel"
-      "diffview.scene.views.file_history.option_panel"
-      "diffview.scene.window"
-      "diffview.ui.panels.commit_log_panel"
-      "diffview.ui.panels.help_panel"
-      "diffview.ui.panel"
-      "diffview.vcs.adapters.git.init"
-      "diffview.vcs.adapters.hg.init"
-      "diffview.vcs.adapter"
-      "diffview.vcs.init"
-      "diffview.vcs.utils"
-      "diffview.job"
-      "diffview.lib"
-      "diffview.multi_job"
-    ];
-
     doInstallCheck = true;
     meta = old.meta // {
       license = lib.licenses.gpl3Plus;
     };
   });
 
+  diffview-plus-nvim = super.diffview-plus-nvim.overrideAttrs (old: {
+    dependencies = [ self.plenary-nvim ];
+    doInstallCheck = true;
+    meta = old.meta // {
+      license = lib.licenses.gpl3Plus;
+      description = "Cycle through diffs for all modified files for any git rev (dlyongemallo's active fork)";
+    };
+  });
+
   direnv-vim = super.direnv-vim.overrideAttrs (old: {
     preFixup = old.preFixup or "" + ''
       substituteInPlace $out/autoload/direnv.vim \
@@ -1452,6 +1418,13 @@ assertNoAdditions {
     dependencies = [ self.nui-nvim ];
   };
 
+  faster-nvim = super.faster-nvim.overrideAttrs {
+    nvimSkipModules = [
+      # attempt to index global 'FasterConfig' (a nil value)
+      "faster.commands"
+    ];
+  };
+
   fastfold = super.fastfold.overrideAttrs (old: {
     meta = old.meta // {
       # This plugin is under the license "Rien à Branler", which is a French translation of the WTFPL license.
@@ -1549,17 +1522,6 @@ assertNoAdditions {
     ];
   };
 
-  fyler-nvim = super.fyler-nvim.overrideAttrs {
-    nvimSkipModules = [
-      # Requires setup call
-      "fyler.views.explorer.init"
-      "fyler.views.explorer.actions"
-      "fyler.views.explorer.ui"
-      "fyler.explorer.ui"
-      "fyler.explorer"
-    ];
-  };
-
   fzf-checkout-vim = super.fzf-checkout-vim.overrideAttrs {
     # The plugin has a makefile which tries to run tests in a docker container.
     # This prevents it.
@@ -1589,7 +1551,6 @@ assertNoAdditions {
   fzf-lua = super.fzf-lua.overrideAttrs {
     runtimeDeps = [ fzf ];
     nvimSkipModules = [
-      "fzf-lua.shell_helper"
       "fzf-lua.spawn"
       "fzf-lua.rpc"
       "fzf-lua.types"
@@ -1674,16 +1635,8 @@ assertNoAdditions {
       "go.ai.init"
       "go.comment"
       "go.format"
-      "go.ginkgo"
-      "go.gotest"
       "go.gotests"
-      "go.inlay"
       "go.project"
-      "go.snips"
-      "go.tags"
-      "go.ts.go"
-      "go.ts.nodes"
-      "snips.go"
     ];
   };
 
@@ -1785,10 +1738,6 @@ assertNoAdditions {
 
   harpoon2 = super.harpoon2.overrideAttrs {
     dependencies = [ self.plenary-nvim ];
-    nvimSkipModules = [
-      # Access harpoon data file
-      "harpoon.scratch.toggle"
-    ];
   };
 
   haskell-scope-highlighting-nvim = super.haskell-scope-highlighting-nvim.overrideAttrs {
@@ -1804,16 +1753,16 @@ assertNoAdditions {
     checkInputs = [ self.telescope-nvim ];
   };
 
+  heirline-components-nvim = super.heirline-components-nvim.overrideAttrs {
+    nvimRequireCheck = "heirline-components.all";
+  };
+
   helm-ls-nvim = super.helm-ls-nvim.overrideAttrs {
     runtimeDeps = [
       helm-ls
     ];
   };
 
-  helpview-nvim = super.helpview-nvim.overrideAttrs {
-    nvimSkipModules = [ "definitions.__vimdoc" ];
-  };
-
   hex-nvim = super.hex-nvim.overrideAttrs {
     runtimeDeps = [ xxd ];
   };
@@ -1849,12 +1798,6 @@ assertNoAdditions {
     doCheck = false;
   };
 
-  hover-nvim = super.hover-nvim.overrideAttrs {
-    # Single provider issue with reading from config
-    # /lua/hover/providers/fold_preview.lua:27: attempt to index local 'config' (a nil value)
-    nvimSkipModules = "hover.providers.fold_preview";
-  };
-
   html5-vim = super.html5-vim.overrideAttrs (old: {
     meta = old.meta // {
       # README contains the MIT license text.
@@ -2033,14 +1976,6 @@ assertNoAdditions {
     ];
   };
 
-  kanagawa-paper-nvim = super.kanagawa-paper-nvim.overrideAttrs {
-    nvimSkipModules = [
-      # skipping wezterm theme switcher since it relies on a wezterm module
-      # that does not seem to be available, tried to build setting wezterm-nvim as a dep
-      "wezterm.theme_switcher"
-    ];
-  };
-
   kulala-nvim = super.kulala-nvim.overrideAttrs (
     old:
     let
@@ -2054,6 +1989,10 @@ assertNoAdditions {
       );
     in
     {
+      patches = (old.patches or [ ]) ++ [
+        ./patches/kulala-nvim/use-packaged-tree-sitter-parser.patch
+      ];
+
       dependencies = [ kulala-http-grammar ];
 
       postPatch = ''
@@ -2064,6 +2003,10 @@ assertNoAdditions {
       nvimSkipModules = [
         # Requires some extra work to get CLI working in nixpkgs
         "cli.kulala_cli"
+        # Upstream test harnesses are not require-safe modules
+        "minit"
+        "minitest"
+        "test"
         # Legacy parser module; active parsing is handled by kulala-core
         "kulala.parser.treesitter"
       ];
@@ -2121,19 +2064,15 @@ assertNoAdditions {
       "lazyvim.plugins.extras.ai.copilot-native"
       "lazyvim.plugins.extras.ai.sidekick"
       "lazyvim.plugins.extras.ai.tabnine"
-      "lazyvim.plugins.extras.coding.blink"
       "lazyvim.plugins.extras.coding.luasnip"
       "lazyvim.plugins.extras.coding.neogen"
       "lazyvim.plugins.extras.editor.fzf"
+      "lazyvim.plugins.extras.editor.refactoring"
       "lazyvim.plugins.extras.editor.snacks_picker"
       "lazyvim.plugins.extras.editor.telescope"
       "lazyvim.plugins.extras.formatting.prettier"
       "lazyvim.plugins.extras.lang.dotnet"
       "lazyvim.plugins.extras.lang.markdown"
-      "lazyvim.plugins.extras.lang.omnisharp"
-      "lazyvim.plugins.extras.lang.python"
-      "lazyvim.plugins.extras.lang.svelte"
-      "lazyvim.plugins.extras.lang.typescript"
       "lazyvim.plugins.extras.lang.typescript.init"
       "lazyvim.plugins.extras.lang.typescript.vtsls"
       "lazyvim.plugins.init"
@@ -2309,12 +2248,6 @@ assertNoAdditions {
       telescope-nvim
       plenary-nvim
     ];
-    nvimSkipModules = [
-      # Attempt to connect to sqlitedb
-      "lispdocs.db"
-      "lispdocs.finder"
-      "lispdocs"
-    ];
   };
 
   litee-calltree-nvim = super.litee-calltree-nvim.overrideAttrs (old: {
@@ -2352,26 +2285,11 @@ assertNoAdditions {
       telescope-nvim
     ];
 
-    nvimSkipModules = [
-      # Ignore livepreview._spec as it fails nvimRequireCheck.
-      # This file runs tests on require which unfortunately fails as it attempts to require the base plugin. See https://github.com/brianhuster/live-preview.nvim/blob/5890c4f7cb81a432fd5f3b960167757f1b4d4702/lua/livepreview/_spec.lua#L25
-      "livepreview._spec"
-    ];
     meta = old.meta // {
       license = lib.licenses.gpl3Only;
     };
   });
 
-  live-share-nvim = super.live-share-nvim.overrideAttrs (old: {
-    nvimSkipModules = (old.nvimSkipModules or [ ]) ++ [
-      # These modules unconditionally load OpenSSL via LuaJIT FFI and abort in
-      # the headless require check on Darwin.
-      "live-share.host"
-      "live-share.guest"
-      "live-share.collab.crypto"
-    ];
-  });
-
   lsp-format-modifications-nvim = super.lsp-format-modifications-nvim.overrideAttrs {
     dependencies = [ self.plenary-nvim ];
   };
@@ -2604,7 +2522,6 @@ assertNoAdditions {
       "minuet.backends.claude"
       "minuet.backends.codestral"
       "minuet.backends.gemini"
-      "minuet.backends.huggingface"
       "minuet.backends.openai"
       "minuet.backends.openai_compatible"
       "minuet.backends.openai_fim_compatible"
@@ -2746,9 +2663,8 @@ assertNoAdditions {
     dependencies = [ self.plenary-nvim ];
     nvimSkipModules = [
       # E5108: Error executing lua ...vim-2024-06-13/lua/diffview/api/views/diff/diff_view.lua:13: attempt to index global 'DiffviewGlobal' (a nil value)
+      # Requires diffview-nvim's plugin script to be sourced.
       "neogit.integrations.diffview"
-      "neogit.popups.diff.actions"
-      "neogit.popups.diff.init"
     ];
   };
 
@@ -2908,18 +2824,6 @@ assertNoAdditions {
       plenary-nvim
       nvim-treesitter-parsers.cpp
     ];
-    nvimSkipModules = [
-      # lua/plenary/path.lua:511: FileNotFoundError from mkdir because of stdpath parent path missing
-      "neotest-gtest.executables.global_registry"
-      "neotest-gtest.executables.init"
-      "neotest-gtest.executables.registry"
-      "neotest-gtest.executables.ui"
-      "neotest-gtest"
-      "neotest-gtest.neotest_adapter"
-      "neotest-gtest.report"
-      "neotest-gtest.storage"
-      "neotest-gtest.utils"
-    ];
   };
 
   neotest-haskell = super.neotest-haskell.overrideAttrs {
@@ -3167,7 +3071,6 @@ assertNoAdditions {
       # Requires global config setup
       "nvchad.configs.cmp"
       "nvchad.configs.gitsigns"
-      "nvchad.configs.luasnip"
       "nvchad.configs.mason"
       "nvchad.configs.nvimtree"
       "nvchad.configs.telescope"
@@ -3178,7 +3081,6 @@ assertNoAdditions {
     dependencies = [ self.nvzone-volt ];
     nvimSkipModules = [
       # Requires global config setup
-      "nvchad.tabufline.modules"
       "nvchad.term.init"
       "nvchad.themes.init"
       "nvchad.themes.mappings"
@@ -3305,17 +3207,6 @@ assertNoAdditions {
     doInstallCheck = true;
   };
 
-  nvim-highlight-colors = super.nvim-highlight-colors.overrideAttrs {
-    # Test module
-    nvimSkipModules = [
-      "nvim-highlight-colors.utils_spec"
-      "nvim-highlight-colors.buffer_utils_spec"
-      "nvim-highlight-colors.color.converters_spec"
-      "nvim-highlight-colors.color.patterns_spec"
-      "nvim-highlight-colors.color.utils_spec"
-    ];
-  };
-
   nvim-highlite = super.nvim-highlite.overrideAttrs (old: {
     meta = old.meta // {
       license = lib.licenses.gpl3Plus;
@@ -3517,12 +3408,6 @@ assertNoAdditions {
       nvim-treesitter-parsers.typescript
       nvim-treesitter-parsers.zig
     ];
-    nvimSkipModules = [
-      # Broken runners
-      "nvim-test.runners.zig"
-      "nvim-test.runners.hspec"
-      "nvim-test.runners.stack"
-    ];
   };
 
   nvim-tinygit = super.nvim-tinygit.overrideAttrs {
@@ -3534,35 +3419,6 @@ assertNoAdditions {
   };
 
   nvim-tree-lua = super.nvim-tree-lua.overrideAttrs (old: {
-    nvimSkipModules = [
-      # Meta can't be required
-      "nvim-tree._meta.api"
-      "nvim-tree._meta.api_decorator"
-      "nvim-tree._meta.api.decorator_example"
-      "nvim-tree._meta.classes"
-      "nvim-tree._meta.config.filters"
-      "nvim-tree._meta.config.actions"
-      "nvim-tree._meta.config.git"
-      "nvim-tree._meta.config.renderer"
-      "nvim-tree._meta.config.experimental"
-      "nvim-tree._meta.config.tab"
-      "nvim-tree._meta.config.modified"
-      "nvim-tree._meta.config.help"
-      "nvim-tree._meta.config.notify"
-      "nvim-tree._meta.config.sort"
-      "nvim-tree._meta.config.view"
-      "nvim-tree._meta.config.update_focused_file"
-      "nvim-tree._meta.config.diagnostics"
-      "nvim-tree._meta.config.log"
-      "nvim-tree._meta.config.system_open"
-      "nvim-tree._meta.config.ui"
-      "nvim-tree._meta.config.hijack_directories"
-      "nvim-tree._meta.config.trash"
-      "nvim-tree._meta.config.filesystem_watchers"
-      "nvim-tree._meta.config.live_filter"
-      "nvim-tree._meta.config.bookmarks"
-      "nvim-tree._meta.config"
-    ];
     meta = old.meta // {
       license = lib.licenses.gpl3Plus;
     };
@@ -3572,11 +3428,6 @@ assertNoAdditions {
     callPackage ./nvim-treesitter/overrides.nix { } self super
   );
 
-  nvim-treesitter-context = super.nvim-treesitter-context.overrideAttrs {
-    # Meant for CI installing parsers
-    nvimSkipModules = [ "install_parsers" ];
-  };
-
   # TODO: raise warning at 26.05; drop at 26.11
   nvim-treesitter-legacy =
     let
@@ -3792,7 +3643,6 @@ assertNoAdditions {
     # FIXME: can't find plugin root dir
     nvimSkipModules = [
       "openscad"
-      "openscad.snippets.openscad"
       "openscad.utilities"
     ];
   };
@@ -3814,13 +3664,6 @@ assertNoAdditions {
 
   otter-nvim = super.otter-nvim.overrideAttrs {
     dependencies = [ self.nvim-lspconfig ];
-    nvimSkipModules = [
-      # requires config setup
-      "otter.keeper"
-      "otter.lsp.handlers"
-      "otter.lsp.init"
-      "otter.diagnostics"
-    ];
   };
 
   outline-nvim = super.outline-nvim.overrideAttrs {
@@ -3897,21 +3740,6 @@ assertNoAdditions {
     checkInputs = with self; [
       fzf-lua
     ];
-    nvimSkipModules = [
-      # Address in use error from fzf-lua on darwin
-      # https://github.com/NixOS/nixpkgs/issues/431458
-      "perfanno.fzf_lua"
-    ];
-  };
-
-  persisted-nvim = super.persisted-nvim.overrideAttrs {
-    nvimSkipModules = [
-      # /lua/persisted/init.lua:44: attempt to index upvalue 'config' (a nil value)
-      # https://github.com/olimorris/persisted.nvim/issues/146
-      "persisted"
-      "persisted.config"
-      "persisted.utils"
-    ];
   };
 
   persistent-breakpoints-nvim = super.persistent-breakpoints-nvim.overrideAttrs {
@@ -4004,16 +3832,6 @@ assertNoAdditions {
 
   qmk-nvim = super.qmk-nvim.overrideAttrs {
     dependencies = [ self.plenary-nvim ];
-    nvimSkipModules = [
-      # Test assertions
-      "qmk.config.init_spec"
-      "qmk.format.keymap_spec"
-      "qmk.format.qmk_spec"
-      "qmk.format.zmk_spec"
-      "qmk.parse.qmk.init_spec"
-      "qmk.parse.zmk.init_spec"
-      "qmk_spec"
-    ];
   };
 
   quarto-nvim = super.quarto-nvim.overrideAttrs (old: {
@@ -4025,9 +3843,6 @@ assertNoAdditions {
       nvim-lspconfig
       otter-nvim
     ];
-    nvimSkipModules = [
-      "quarto.runner.init"
-    ];
     meta = old.meta // {
       # LICENSE says GPL-2.0-or-later.
       license = lib.licenses.gpl2Plus;
@@ -4248,7 +4063,6 @@ assertNoAdditions {
   smart-splits-nvim = super.smart-splits-nvim.overrideAttrs {
     nvimSkipModules = [
       "vimdoc-gen"
-      "vimdocrc"
     ];
   };
 
@@ -4262,37 +4076,6 @@ assertNoAdditions {
     # Optional trouble integration
     checkInputs = [ self.trouble-nvim ];
     nvimSkipModules = [
-      # Requires setup call first
-      # attempt to index global 'Snacks' (a nil value)
-      "snacks.dashboard"
-      "snacks.debug"
-      "snacks.dim"
-      "snacks.explorer.init"
-      "snacks.gh.actions"
-      "snacks.gh.buf"
-      "snacks.gh.init"
-      "snacks.gh.render"
-      "snacks.gh.render.init"
-      "snacks.git"
-      "snacks.image.convert"
-      "snacks.image.image"
-      "snacks.image.init"
-      "snacks.image.placement"
-      "snacks.indent"
-      "snacks.input"
-      "snacks.lazygit"
-      "snacks.notifier"
-      "snacks.picker.actions"
-      "snacks.picker.config.highlights"
-      "snacks.picker.core.list"
-      "snacks.picker.source.gh"
-      "snacks.picker.util.diff"
-      "snacks.scratch"
-      "snacks.scroll"
-      "snacks.terminal"
-      "snacks.win"
-      "snacks.words"
-      "snacks.zen"
       # TODO: Plugin requires libsqlite available, create a test for it
       "snacks.picker.util.db"
     ];
@@ -4307,9 +4090,6 @@ assertNoAdditions {
       "snap.consumer.fzy.score"
       # circular import
       "snap.producer.create"
-      # https://github.com/camspiers/snap/pull/97
-      "snap.preview.help"
-      "snap.producer.vim.help"
     ];
   };
 
@@ -4354,8 +4134,6 @@ assertNoAdditions {
       nvimSkipModules = [
         # Require "sql.utils" ?
         "sqlite.tbl.cache"
-        # attempt to write to read only database
-        "sqlite.examples.bookmarks"
       ];
     }
   );
@@ -4749,8 +4527,6 @@ assertNoAdditions {
     nvimSkipModules = [
       # Meta file
       "tokyonight.docs"
-      # Optional integration
-      "tokyonight.extra.fzf"
     ];
   };
 
@@ -5516,11 +5292,6 @@ assertNoAdditions {
     };
   });
 
-  vim-matchup = super.vim-matchup.overrideAttrs {
-    # Optional treesitter integration
-    nvimSkipModules = "treesitter-matchup.third-party.query";
-  };
-
   vim-mediawiki-editor = super.vim-mediawiki-editor.overrideAttrs {
     passthru.python3Dependencies = [ python3.pkgs.mwclient ];
   };

pkgs/applications/editors/vim/plugins/patches/kulala-nvim/use-packaged-tree-sitter-parser.patch

@@ -0,0 +1,29 @@
+diff --git a/lua/kulala/config/parser.lua b/lua/kulala/config/parser.lua
+index 5f37046..c60c474 100644
+--- a/lua/kulala/config/parser.lua
++++ b/lua/kulala/config/parser.lua
+@@ -37,7 +37,6 @@ local function sync_queries()
+ end
+ 
+ local function load_parser()
+-  if not Fs.file_exists(parser_target_path) then return false end
+   return vim.treesitter.language.add(parser_name) == true
+ end
+ 
+@@ -48,7 +47,6 @@ M.register_parser = function()
+   -- queries/kulala_http/*.scm live under lua/tree-sitter/queries/
+   vim.opt.rtp:prepend(parser_source_path)
+   ensure_site_rtp()
+-  sync_queries()
+   vim.treesitter.language.register(parser_name, filetypes)
+   vim.treesitter.language.register("markdown", "kulala_ui")
+   local backend = require("kulala.backend")
+@@ -94,7 +92,7 @@ local function has_kulala_parser()
+ end
+ 
+ M.is_up_to_date = function()
+-  return has_kulala_parser() and is_parser_ver_current()
++  return load_parser()
+ end
+ 
+ M.setup = function()

pkgs/applications/editors/vim/plugins/utils/vim-utils.nix

@@ -4,6 +4,7 @@
   stdenv,
   vim,
   vimPlugins,
+  neovim-unwrapped,
   buildEnv,
   symlinkJoin,
   writeText,
@@ -516,35 +517,47 @@ rec {
     drv:
     let
       drv-name = drv.name or "${drv.pname}-${drv.version}";
+      lua = neovim-unwrapped.lua;
     in
-    drv.overrideAttrs (oldAttrs: {
-      name = "vimplugin-${drv-name}";
-      # dont move the "doc" folder since vim expects it
-      forceShare = [
-        "man"
-        "info"
-      ];
-
-      nativeBuildInputs =
-        oldAttrs.nativeBuildInputs or [ ]
-        ++ lib.optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
-          vimGenDocHook
+    drv.overrideAttrs (
+      finalAttrs: oldAttrs:
+      let
+        getRequiredLuaModules = attrs: attrs.requiredLuaModules or attrs.passthru.requiredLuaModules or [ ];
+        modules = getRequiredLuaModules finalAttrs;
+        luaEnv = lua.withPackages (_: modules);
+      in
+      {
+        name = "vimplugin-${drv-name}";
+        # dont move the "doc" folder since vim expects it
+        forceShare = [
+          "man"
+          "info"
         ];
 
-      doCheck = oldAttrs.doCheck or true;
+        nativeBuildInputs =
+          oldAttrs.nativeBuildInputs or [ ]
+          ++ lib.optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+            vimGenDocHook
+          ];
 
-      nativeCheckInputs =
-        oldAttrs.nativeCheckInputs or [ ]
-        ++ lib.optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
-          vimCommandCheckHook
-          # many neovim plugins keep using buildVimPlugin
-          neovimRequireCheckHook
-        ];
+        doCheck = oldAttrs.doCheck or true;
 
-      passthru = (oldAttrs.passthru or { }) // {
-        vimPlugin = true;
-      };
-    });
+        nativeCheckInputs =
+          oldAttrs.nativeCheckInputs or [ ]
+          ++ lib.optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+            vimCommandCheckHook
+            # many neovim plugins keep using buildVimPlugin
+            neovimRequireCheckHook
+          ];
+
+        nvimRequireCheckLuaPath = lib.optionalString (modules != [ ]) (lua.pkgs.getLuaPath luaEnv);
+        nvimRequireCheckLuaCPath = lib.optionalString (modules != [ ]) (lua.pkgs.getLuaCPath luaEnv);
+
+        passthru = (oldAttrs.passthru or { }) // {
+          vimPlugin = true;
+        };
+      }
+    );
 }
 // lib.optionalAttrs config.allowAliases {
   vimWithRC = throw "vimWithRC was removed, please use vim.customize instead";

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -371,6 +371,7 @@ https://github.com/nvim-lua/diagnostic-nvim/,,
 https://github.com/3rd/diagram.nvim/,,
 https://github.com/monaqa/dial.nvim/,,
 https://github.com/barrettruth/diffs.nvim/,,
+https://github.com/dlyongemallo/diffview-plus.nvim/,,
 https://github.com/sindrets/diffview.nvim/,,
 https://github.com/elihunter173/dirbuf.nvim/,,
 https://github.com/direnv/direnv.vim/,,
@@ -520,6 +521,7 @@ https://github.com/travitch/hasksyn/,,
 https://github.com/StackInTheWild/headhunter.nvim/,,
 https://github.com/lukas-reineke/headlines.nvim/,,
 https://github.com/rebelot/heirline.nvim/,,
+https://github.com/Zeioth/heirline-components.nvim/,,
 https://github.com/qvalentin/helm-ls.nvim/,,
 https://github.com/OXY2DEV/helpview.nvim/,,
 https://github.com/RaafatTurki/hex.nvim/,,

pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
   mktplcRef = {
     name = "amazon-q-vscode";
     publisher = "AmazonWebServices";
-    version = "2.1.0";
-    hash = "sha256-DTh8IoJfKuAoNx5XS41wZlafoJwi68g0oJn0vXbEGDo=";
+    version = "2.2.0";
+    hash = "sha256-HwgInQOaSKHSs8CU+Ng4jYA6aaP/g3l4CSb/0ewkmc4=";
   };
 
   meta = {