nixosTests.hostname: migrate to runTest (#555616)

https://github.com/evcc-io/evcc/releases/tag/0.314.3

.editorconfig

@@ -79,7 +79,7 @@ indent_size = unset
 trim_trailing_whitespace = true
 
 # binaries
-[*.nib]
+[*.{nib,torrent}]
 end_of_line = unset
 insert_final_newline = unset
 trim_trailing_whitespace = unset

.gitattributes

@@ -62,3 +62,6 @@ ci/OWNERS linguist-language=CODEOWNERS
 # patching CRLF line endings from an upstream source package.
 *.diff !text !eol
 *.patch !text !eol
+
+# Torrent files are binary files and should not be re-encoded.
+*.torrent !text !eol

.github/workflows/build.yml

@@ -59,7 +59,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true

.github/workflows/check.yml

@@ -134,6 +134,35 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
         run: gh api /rate_limit | jq
 
+  github-script:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+          sparse-checkout: .github/actions
+
+      - name: Checkout merge and target commits
+        uses: ./.github/actions/checkout
+        with:
+          merged-as-untrusted-at: ${{ inputs.mergedSha }}
+          target-as-trusted-at: ${{ inputs.targetSha }}
+
+      - name: Install dependencies to trusted/
+        run: |
+          npm ci --package-lock-only=false
+          echo "$PWD/node_modules/.bin" >> "$GITHUB_PATH"
+        working-directory: nixpkgs/trusted/ci/github-script
+
+      - name: Link trusted/ dependencies to untrusted/
+        run: ln -s "$PWD/trusted/ci/github-script/node_modules" untrusted/ci/github-script/node_modules
+        working-directory: nixpkgs
+
+      - name: Type-check ci/github-script
+        run: tsc --build
+        working-directory: nixpkgs/untrusted/ci/github-script
+
   owners:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 5
@@ -142,13 +171,14 @@ jobs:
         with:
           persist-credentials: false
           sparse-checkout: .github/actions
+
       - name: Checkout merge and target commits
         uses: ./.github/actions/checkout
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true

.github/workflows/eval.yml

@@ -139,7 +139,7 @@ jobs:
             core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)
 
       - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
 
       - name: Load supported versions
         id: versions
@@ -187,7 +187,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -277,7 +277,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
 
       - name: Combine all output paths and eval stats
         run: |
@@ -486,7 +486,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
 
       - name: Ensure flake outputs on all systems still evaluate
         run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'

.github/workflows/lint.yml

@@ -35,7 +35,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -70,7 +70,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -100,7 +100,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true

.mailmap

@@ -6,6 +6,7 @@ Christina Sørensen <christina@cafkafk.com> <christinaafk@gmail.com>
 Christina Sørensen <christina@cafkafk.com> <89321978+cafkafk@users.noreply.github.com>
 Daniel Løvbrøtte Olsen <me@dandellion.xyz> <daniel.olsen99@gmail.com>
 Ethan Carter Edwards <ethan@ethancedwards.com> Ethan Edwards <ethancarteredwards@gmail.com>
+Ethan Carter Edwards <ethan@ethancedwards.com> <ethancedwards8@users.noreply.github.com>
 Fabian Affolter <mail@fabian-affolter.ch> <fabian@affolter-engineering.ch>
 Fiona Behrens <me@kloenk.dev>
 Fiona Behrens <me@kloenk.dev> <me@kloenk.de>

ci/OWNERS

@@ -361,7 +361,10 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/applications/editors/kakoune     @philiptaron
 
 # LuaPackages
+/pkgs/development/interpreters/lua-5  @NixOS/lua
+/pkgs/development/interpreters/luajit @NixOS/lua
 /pkgs/development/lua-modules         @NixOS/lua
+/pkgs/top-level/lua-packages.nix      @NixOS/lua
 
 # Neovim
 /pkgs/applications/editors/neovim           @NixOS/neovim

ci/github-script/.gitignore

@@ -2,3 +2,4 @@ comparison
 comparison.zip
 node_modules
 step-summary.md
+*.tsbuildinfo

doc/build-helpers/fetchers.chapter.md

@@ -988,6 +988,20 @@ fetchRadiclePatch {
 }
 ```
 
+## `fetchFromTangled` {#fetchfromtangled}
+
+This is to be used with tangled repositories. `fetchFromTangled` works with
+very similar arguments to `fetchFromGithub`. However, instead of a `owner` and
+`repo`, a `did` argument is expected.
+
+```nix
+fetchFromTangled {
+  did = "did:plc:jj6ajj6duxnlthwtnob4qyuv"; # tranquil.farm/tranquil-pds
+  tag = "v6.6.0";
+  hash = "sha256-cfTsjmK/IMqT5kMKOGpwwWbBlvtrCDOerUJJ8AVI3kY=";
+}
+```
+
 ## `requireFile` {#requirefile}
 
 `requireFile` allows requesting files that cannot be fetched automatically, but whose content is known.

doc/hooks/ghc.section.md

@@ -1,3 +0,0 @@
-# GHC {#ghc}
-
-Creates a temporary package database and registers every Haskell build input in it (TODO: how?).

doc/hooks/index.md

@@ -17,7 +17,6 @@ check-phase-thread-limit-hook.section.md
 cmake.section.md
 desktop-file-utils.section.md
 gdk-pixbuf.section.md
-ghc.section.md
 gnome.section.md
 haredo.section.md
 installShellFiles.section.md

doc/languages-frameworks/beam.section.md

@@ -34,17 +34,21 @@ Inside each package set are:
 - builders: mixRelease, buildRebar3, etc
 - hooks: for composing builders and packages
 
-To use a non-default Elixir it's important to keep the rest of the package set consistent, so it's recommended to use `.extend`. This ensures that builders like `mixRelease`, `fetchMixDeps`, and `buildMix` all pick up the overridden Elixir:
+The package set is the only place Erlang and Elixir versions are chosen. Builders such as `mixRelease`, `fetchMixDeps` and `buildMix` take them from the set they are called from, and do not accept `erlang`, `elixir` or `hex` arguments.
+
+To use a non-default Elixir, derive a new set with `overrideScope`. This keeps the rest of the set consistent, so every builder picks up the overridden Elixir:
 
 ```nix
 let
-  beamPackages = beam27Packages.extend (self: super: { elixir = self.elixir_1_18; });
+  beamPackages = beam27Packages.overrideScope (final: prev: { elixir = final.elixir_1_18; });
 in
 beamPackages.mixRelease {
   # ...
 }
 ```
 
+`erlang` can be replaced the same way, which is useful for a patched OTP. Every member of the set is built from the set's own `erlang`, so overriding it rebuilds Elixir, Rebar3 and the rest against it.
+
 ## Build Tools {#beam-build-tools}
 
 ### Rebar3 {#beam-build-tools-rebar3}
@@ -332,8 +336,8 @@ Usually, we need to create a `shell.nix` file and do our development inside the
 
 with pkgs;
 let
-  # pin OTP via beam27Packages/beam28Packages/... and Elixir via .extend
-  beamPackages = beam27Packages.extend (self: super: { elixir = self.elixir_1_18; });
+  # pin OTP via beam27Packages/beam28Packages/... and Elixir via overrideScope
+  beamPackages = beam27Packages.overrideScope (final: prev: { elixir = final.elixir_1_18; });
 in
 mkShell { buildInputs = [ beamPackages.elixir ]; }
 ```
@@ -368,8 +372,8 @@ Here is an example `shell.nix`.
 with import <nixpkgs> { };
 
 let
-  # pin OTP via beam27Packages/beam28Packages/... and Elixir via .extend
-  beamPackages = beam27Packages.extend (self: super: { elixir = self.elixir_1_18; });
+  # pin OTP via beam27Packages/beam28Packages/... and Elixir via overrideScope
+  beamPackages = beam27Packages.overrideScope (final: prev: { elixir = final.elixir_1_18; });
 
   # define packages to install
   basePackages = [

doc/languages-frameworks/javascript.section.md

@@ -1,49 +1,30 @@
-# Javascript {#language-javascript}
+# JavaScript {#language-javascript}
 
 ## Introduction {#javascript-introduction}
 
-This contains instructions on how to package JavaScript applications.
-
-The various tools available will be listed in the [tools-overview](#javascript-tools-overview).
-Some general principles for packaging will follow.
-Finally, some tool-specific instructions will be given.
-
-## Getting unstuck / finding code examples {#javascript-finding-examples}
-
-If you find you are lacking inspiration for packaging JavaScript applications, the links below might prove useful.
-Searching online for prior art can be helpful if you are running into solved problems.
-
-### Github {#javascript-finding-examples-github}
-
-- Searching Nix files for `yarnConfigHook`: <https://github.com/search?q=yarnConfigHook+language%3ANix&type=code>
-- Searching just `flake.nix` files for `yarnConfigHook`: <https://github.com/search?q=yarnConfigHook+path%3A**%2Fflake.nix&type=code>
-
-### Gitlab {#javascript-finding-examples-gitlab}
-
-- Searching Nix files for `yarnConfigHook`: <https://gitlab.com/search?scope=blobs&search=yarnConfigHook+extension%3Anix>
-- Searching just `flake.nix` files for `yarnConfigHook`: <https://gitlab.com/search?scope=blobs&search=yarnConfigHook+filename%3Aflake.nix>
+Package JavaScript applications with the tools below.
 
 ## Tools overview {#javascript-tools-overview}
 
 ## General principles {#javascript-general-principles}
 
-The following principles are given in order of importance with potential exceptions.
+The principles below are ordered by importance.
 
-### Try to use the same node version used upstream {#javascript-upstream-node-version}
+### Use the project's Node.js version {#javascript-upstream-node-version}
 
-It is often not documented which node version is used upstream, but if it is, try to use the same version when packaging.
+It is often not documented which Node.js version the project uses, but if it is, use the same version when packaging.
 
-This can be a problem if upstream is using the latest and greatest and you are trying to use an earlier version of node.
+This can be a problem if the project uses the latest and greatest and you are trying to use an earlier version of Node.js.
 Some cryptic errors regarding V8 may appear.
 
-### Try to respect the package manager originally used by upstream (and use the upstream lock file) {#javascript-upstream-package-manager}
+### Use the project's package manager and lock file {#javascript-upstream-package-manager}
 
 A lock file (package-lock.json, yarn.lock...) is supposed to make reproducible installations of `node_modules` for each tool.
 
-Guidelines of package managers, recommend to commit those lock files to the repos.
-If a particular lock file is present, it is a strong indication of which package manager is used upstream.
+Package manager guidelines recommend committing those lock files to the repository.
+If a particular lock file is present, it is a strong indication of which package manager the project uses.
 
-It's better to try to use a Nix tool that understands the lock file.
+Use a Nix tool that understands the lock file.
 Using a different tool might give you a hard-to-understand error because different packages have been installed.
 
 Using a different tool forces you to commit a lock file to the repository.
@@ -51,16 +32,16 @@ These files are fairly large, so when packaging for nixpkgs, this approach does
 
 Exceptions to this rule are:
 
-- When you encounter one of the bugs from a Nix tool. In each of the tool-specific instructions, known problems will be detailed. If you have a problem with a particular tool, then it's best to try another tool, even if this means you will have to re-create a lock file and commit it to Nixpkgs.
-- Some lock files contain particular version of a package that has been pulled off npm for some reason. In that case, you can recreate upstream lock (by removing the original and `npm install`, `yarn`, ...) and commit this to nixpkgs.
+- When you encounter one of the bugs from a Nix tool. In each of the tool-specific instructions, known problems are detailed. If a tool has a problem, try another. You may have to re-create a lock file and commit it to Nixpkgs.
+- Some lock files contain a particular version of a package that has been pulled off npm for some reason. In that case, you can recreate the lock file (by removing the original and running `npm install`, `yarn`, etc.) and commit this to Nixpkgs.
 
-### Try to use upstream package.json {#javascript-upstream-package-json}
+### Use the project's `package.json` {#javascript-upstream-package-json}
 
 Exceptions to this rule are:
 
-- Sometimes the upstream repo assumes some dependencies should be installed globally. In that case, you can add them manually to the upstream `package.json` (`yarn add xxx` or `npm install xxx`, ...). Dependencies that are installed locally can be executed with `npx` for CLI tools (e.g. `npx postcss ...`, this is how you can call those dependencies in the phases).
+- Sometimes the project assumes some dependencies are installed globally. Add them to the `package.json` manually (`yarn add xxx` or `npm install xxx`). Run locally installed CLI tools with `npx`, for example `npx postcss`. That is how you call them in the phases.
 - Sometimes there is a version conflict between some dependency requirements. In that case you can fix a version by removing the `^`.
-- Sometimes the script defined in the package.json does not work as is. Some scripts for example use CLI tools that might not be available, or cd in directory with a different package.json (for workspaces notably). In that case, it's perfectly fine to look at what the particular script is doing and break this down in the phases. In the build script you can see `build:*` calling in turns several other build scripts like `build:ui` or `build:server`. If one of those fails, you can try to separate those into,
+- Sometimes a script in `package.json` does not work as is. It might call a CLI tool that is not available, or `cd` into a directory with a different `package.json`, which is common with workspaces. Read what the script does. Reproduce it in the build phases. For example, a `build` script may call `build:ui` and `build:server` in turn. If one fails, split them into separate steps.
 
   ```sh
   yarn build:ui
@@ -70,7 +51,7 @@ Exceptions to this rule are:
   npm run build:server
   ```
 
-  when you need to override a package.json. It's nice to use the one from the upstream source and do some explicit override. Here is an example:
+  When you need to override `package.json`, it is best to use the one from the project and make explicit overrides. Here is an example:
 
   ```nix
   {
@@ -82,22 +63,22 @@ Exceptions to this rule are:
   }
   ```
 
-  You will still need to commit the modified version of the lock files, but at least the overrides are explicit for everyone to see.
+  You still need to commit the modified version of the lock files, but at least the overrides are explicit for everyone to see.
 
-### Using node_modules directly {#javascript-using-node_modules}
+### Use `node_modules` directly {#javascript-using-node_modules}
 
-Each tool has an abstraction to just build the node_modules (dependencies) directory.
+Each tool has an abstraction to build the node_modules (dependencies) directory.
 You can always use the `stdenv.mkDerivation` with the node_modules to build the package (symlink the node_modules directory and then use the package build command).
-The node_modules abstraction can be also used to build some web framework frontends.
-For an example of this see how [plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/pl/plausible/package.nix) is built.
-Then when building the frontend you can just symlink the node_modules directory.
+The `node_modules` abstraction can also be used to build some web framework frontends.
+For an example of this, see how [plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/pl/plausible/package.nix) is built.
+Then, when building the frontend, you can symlink the `node_modules` directory.
 
 ## Tool-specific instructions {#javascript-tool-specific}
 
 ### buildNpmPackage {#javascript-buildNpmPackage}
 
-`buildNpmPackage` allows you to package npm-based projects in Nixpkgs without the use of an auto-generated dependencies file.
-It works by utilizing npm's cache functionality -- creating a reproducible cache that contains the dependencies of a project, and pointing npm to it.
+`buildNpmPackage` packages npm-based projects in Nixpkgs without the use of an auto-generated dependencies file.
+It uses npm's cache. It builds a reproducible cache of the project's dependencies and points npm at it.
 
 Here's an example:
 
@@ -135,9 +116,9 @@ buildNpmPackage (finalAttrs: {
 })
 ```
 
-In the default `installPhase` set by `buildNpmPackage`, it uses `npm pack --json --dry-run` to decide what files to install in `$out/lib/node_modules/$name/`, where `$name` is the `name` string defined in the package's `package.json`.
+In the default `installPhase` set by `buildNpmPackage`, it uses `npm pack --json --dry-run` to decide what files to install. They go in `$out/lib/node_modules/$name/`, where `$name` is the `name` string in the package's `package.json`.
 Additionally, the `bin` and `man` keys in the source's `package.json` are used to decide what binaries and manpages are supposed to be installed.
-If these are not defined, `npm pack` may miss some files, and no binaries will be produced.
+If these are not defined, `npm pack` may miss some files, and no binaries are produced.
 
 #### Arguments {#javascript-buildNpmPackage-arguments}
 
@@ -172,8 +153,8 @@ sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 
 `fetchNpmDeps` is a Nix function that requires the following mandatory arguments:
 
-- `src`: A directory / tarball with `package-lock.json` file
-- `hash`: The output hash of the node dependencies defined in `package-lock.json`.
+- `src`: A directory or tarball with a `package-lock.json` file
+- `hash`: The output hash of the dependencies defined in `package-lock.json`.
 
 It returns a derivation with all `package-lock.json` dependencies downloaded into `$out/`, usable as an npm cache.
 
@@ -187,7 +168,7 @@ There is no need to specify a `hash`, since it relies entirely on the integrity
 
 ##### Inputs {#javascript-buildNpmPackage-inputs}
 
-- `npmRoot`: Path to package directory containing the source tree.
+- `npmRoot`: Path to the package directory containing the source tree.
   If this is omitted, the `package` and `packageLock` arguments must be specified instead.
 - `package`: Parsed contents of `package.json`
 - `packageLock`: Parsed contents of `package-lock.json`
@@ -195,7 +176,7 @@ There is no need to specify a `hash`, since it relies entirely on the integrity
 - `version`: Package version
 - `fetcherOpts`: An attribute set of arguments forwarded to the underlying fetcher.
 
-It returns a derivation with a patched `package.json` & `package-lock.json` with all dependencies resolved to Nix store paths.
+It returns a derivation with a patched `package.json` and `package-lock.json` with all dependencies resolved to Nix store paths.
 
 :::{.note}
 `npmHooks.npmConfigHook` cannot be used with `importNpmLock`.
@@ -257,18 +238,18 @@ buildNpmPackage {
 
 `importNpmLock.buildNodeModules` returns a derivation with a pre-built `node_modules` directory, as imported by `importNpmLock`.
 
-This is to be used together with `importNpmLock.hooks.linkNodeModulesHook` to facilitate `nix-shell`/`nix develop` based development workflows.
+This is to be used together with `importNpmLock.hooks.linkNodeModulesHook` to support `nix-shell`/`nix develop` development workflows.
 
 It accepts an argument with the following attributes:
 
 `npmRoot` (Path; optional)
-: Path to package directory containing the source tree. If not specified, the `package` and `packageLock` arguments must both be specified.
+: Path to the package directory containing the source tree. If not specified, the `package` and `packageLock` arguments must both be specified.
 
 `package` (Attrset; optional)
 : Parsed contents of `package.json`, as returned by `lib.importJSON ./my-package.json`. If not specified, the `package.json` in `npmRoot` is used.
 
 `packageLock` (Attrset; optional)
-: Parsed contents of `package-lock.json`, as returned `lib.importJSON ./my-package-lock.json`. If not specified, the `package-lock.json` in `npmRoot` is used.
+: Parsed contents of `package-lock.json`, as returned by `lib.importJSON ./my-package-lock.json`. If not specified, the `package-lock.json` in `npmRoot` is used.
 
 `derivationArgs` (`mkDerivation` attrset; optional)
 : Arguments passed to `stdenv.mkDerivation`
@@ -288,26 +269,26 @@ pkgs.mkShell {
   };
 }
 ```
-will create a development shell where a `node_modules` directory is created & packages symlinked to the Nix store when activated.
+creates a development shell where a `node_modules` directory is created and packages are symlinked to the Nix store when activated.
 
 :::{.note}
-Commands like `npm install` & `npm add` that write packages & executables need to be used with `--package-lock-only`.
+Commands like `npm install` and `npm add` that write packages and executables need to be used with `--package-lock-only`.
 
-This means `npm` installs dependencies by writing into `package-lock.json` without modifying the `node_modules` folder. Installation happens through reloading the devShell.
-This might be best practice since it gives the `nix shell` virtually exclusive ownership over your `node_modules` folder.
+This means `npm` installs dependencies by writing into `package-lock.json` without modifying the `node_modules` folder. It installs by reloading the devShell.
+This gives the `nix shell` near-exclusive ownership over your `node_modules` folder.
 
-It's recommended to set `package-lock-only = true` in your project-local [`.npmrc`](https://docs.npmjs.com/cli/v11/configuring-npm/npmrc).
+Set `package-lock-only = true` in your project-local [`.npmrc`](https://docs.npmjs.com/cli/v11/configuring-npm/npmrc).
 :::
 
 ### corepack {#javascript-corepack}
 
-This package puts the corepack wrappers for pnpm and yarn in your PATH, and they will honor the `packageManager` setting in the `package.json`.
+This package puts the corepack wrappers for pnpm and yarn in your PATH, and they honor the `packageManager` setting in the `package.json`.
 
 ### pnpm {#javascript-pnpm}
 
 pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions.
 
-When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` will prepare the build environment to install the pre-fetched dependencies store. Here is an example for a package that contains `package.json` and a `pnpm-lock.yaml` files using the fetcher and setup hook above:
+When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` prepares the build environment to install the pre-fetched dependencies store. The example below uses the fetcher and setup hook for a package that has `package.json` and `pnpm-lock.yaml`:
 
 There is also the [`pnpmBuildHook`](#pnpm-build-hook) for building packages with `pnpm`, as seen in [](#ex-pnpm-build-hook).
 
@@ -350,7 +331,7 @@ stdenv.mkDerivation (finalAttrs: {
 })
 ```
 
-It is highly recommended to use a pinned version of pnpm (i.e., `pnpm_9` or `pnpm_10`), to increase future reproducibility. It might also be required to use an older version if the package needs support for a certain lock file version. To do so, you can pass the `pnpm` argument to `fetchPnpmDeps` and override the `pnpm` arg in `pnpmConfigHook`. Here are the changes in the example above to use a pinned pnpm version:
+Use a pinned version of pnpm (for example `pnpm_9` or `pnpm_10`) to increase reproducibility. An older version may be required if the package needs a certain lock file version. To do so, pass the `pnpm` argument to `fetchPnpmDeps`. Then override the `pnpm` arg in `pnpmConfigHook`. Here are the changes in the example above to use a pinned pnpm version:
 
 <!-- TODO: Does splicing still work when overriding in nativeBuildInputs here? -->
 
@@ -392,7 +373,7 @@ It is highly recommended to use a pinned version of pnpm (i.e., `pnpm_9` or `pnp
  })
 ```
 
-In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `finalAttrs.patches` to the function as well (i.e., `inherit (finalAttrs) patches`.
+In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `finalAttrs.patches` to the function as well (i.e., `inherit (finalAttrs) patches`).
 
 `pnpmConfigHook` supports adding additional `pnpm install` flags via `pnpmInstallFlags` which can be set to a Nix string array:
 
@@ -408,14 +389,14 @@ In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `
 }
 ```
 
-If needed, `dontPnpmConfigure = true;` can be used to fully disable `pnpmConfigHook` without manually removing it from inputs.
+If needed, set `dontPnpmConfigure = true;` to fully disable `pnpmConfigHook` without removing it from inputs manually.
 
 #### Dealing with `sourceRoot` {#javascript-pnpm-sourceRoot}
 
-If the pnpm project is in a subdirectory, you can just define `sourceRoot` or `setSourceRoot` for `fetchPnpmDeps`.
-If `sourceRoot` is different between the parent derivation and `fetchPnpmDeps`, you will have to set `pnpmRoot` to effectively be the same location as it is in `fetchPnpmDeps`.
+If the pnpm project is in a subdirectory, you can define `sourceRoot` or `setSourceRoot` for `fetchPnpmDeps`.
+If `sourceRoot` is different between the parent derivation and `fetchPnpmDeps`, you have to set `pnpmRoot` to effectively be the same location as it is in `fetchPnpmDeps`.
 
-Assuming the following directory structure, we can define `sourceRoot` and `pnpmRoot` as follows:
+Assuming the directory structure below, you can define `sourceRoot` and `pnpmRoot`:
 
 ```
 .
@@ -439,10 +420,9 @@ Assuming the following directory structure, we can define `sourceRoot` and `pnpm
 }
 ```
 
-#### PNPM Workspaces {#javascript-pnpm-workspaces}
+#### pnpm workspaces {#javascript-pnpm-workspaces}
 
-If you need to use a PNPM workspace for your project, then set `pnpmWorkspaces = [ "<workspace project name 1>" "<workspace project name 2>" ]`, etc, in your `fetchPnpmDeps` call,
-which will make PNPM only install dependencies for those workspace packages.
+For a pnpm workspace, set `pnpmWorkspaces = [ "<workspace project name 1>" "<workspace project name 2>" ]` in your `fetchPnpmDeps` call. pnpm then installs only the dependencies for those workspace packages.
 
 For example:
 
@@ -458,9 +438,9 @@ For example:
 ```
 
 The above would make `fetchPnpmDeps` call only install dependencies for the `@astrojs/language-server` workspace package.
-Note that you do not need to set `sourceRoot` to make this work.
+You do not need to set `sourceRoot` to make this work.
 
-Usually, in such cases, you'd want to use `pnpm --filter=<pnpm workspace name> build` to build your project, as `npmHooks.npmBuildHook` probably won't work. A `buildPhase` based on the following example will probably fit most workspace projects:
+For these projects, build with `pnpm --filter=<pnpm workspace name> build`, because `npmHooks.npmBuildHook` may not work. The example below fits most workspace projects:
 
 ```nix
 {
@@ -474,9 +454,9 @@ Usually, in such cases, you'd want to use `pnpm --filter=<pnpm workspace name> b
 }
 ```
 
-#### Additional PNPM Commands and settings {#javascript-pnpm-extraCommands}
+#### Additional pnpm commands and settings {#javascript-pnpm-extraCommands}
 
-If you require setting an additional PNPM configuration setting (such as `dedupe-peer-dependents` or similar),
+If you require setting an additional pnpm configuration setting (such as `dedupe-peer-dependents` or similar),
 set `prePnpmInstall` to the right commands to run. For example:
 
 ```nix
@@ -491,11 +471,11 @@ set `prePnpmInstall` to the right commands to run. For example:
 }
 ```
 
-In this example, `prePnpmInstall` will be run by both `pnpmConfigHook` and by the `fetchPnpmDeps` builder.
+In this example, `prePnpmInstall` runs in both `pnpmConfigHook` and the `fetchPnpmDeps` builder.
 
 #### pnpm `fetcherVersion` {#javascript-pnpm-fetcherVersion}
 
-This is the version of the output of `fetchPnpmDeps`. New packages should use `4`:
+This is the version of the output of `fetchPnpmDeps`. Use `4` for new packages:
 
 ```nix
 {
@@ -511,7 +491,7 @@ This is the version of the output of `fetchPnpmDeps`. New packages should use `4
 When upgrading to a newer `fetcherVersion`, you need to regenerate the hash.
 
 This variable ensures that we can make changes to the output of `fetchPnpmDeps` without breaking existing hashes.
-Changes can include workarounds or bug fixes to existing PNPM issues.
+Changes can include workarounds or bug fixes to existing pnpm issues.
 
 ##### Version history {#javascript-pnpm-fetcherVersion-versionHistory}
 
@@ -524,9 +504,9 @@ Version 3 is the minimum supported value. Versions 1 and 2 were removed in the 2
 
 ### Yarn {#javascript-yarn}
 
-Yarn based projects use a `yarn.lock` file instead of a `package-lock.json` to pin dependencies.
+Yarn-based projects use a `yarn.lock` file instead of a `package-lock.json` to pin dependencies.
 
-To package yarn-based applications, you need to distinguish by the version pointers in the `yarn.lock` file. See the following sections.
+To package Yarn-based applications, you need to distinguish by the version pointers in the `yarn.lock` file. See the following sections.
 
 #### Yarn v1 {#javascript-yarn-v1}
 
@@ -595,12 +575,12 @@ This script by default runs `yarn --offline build`, and it relies upon the proje
 
 ##### `yarnInstallHook` arguments {#javascript-yarninstallhook}
 
-To install the package `yarnInstallHook` uses both `npm` and `yarn` to cleanup project files and dependencies. To disable this phase, you can set `dontYarnInstall = true` or override the `installPhase`. Below is a list of additional `mkDerivation` arguments read by this hook:
+To install the package, `yarnInstallHook` uses both `npm` and `yarn` to clean up project files and dependencies. To disable this phase, you can set `dontYarnInstall = true` or override the `installPhase`. Below is a list of additional `mkDerivation` arguments read by this hook:
 
 - `yarnKeepDevDeps`: Disables the removal of devDependencies from `node_modules` before installation.
 
 #### Yarn Berry v3/v4 {#javascript-yarn-v3-v4}
-Yarn Berry (v3 / v4) have similar formats, they start with blocks like these:
+Yarn Berry (v3 / v4) versions have similar formats. They start with blocks like these:
 
 ```yaml
 __metadata:
@@ -620,7 +600,7 @@ For these packages, we have some helpers exposed under the respective `yarn-berr
 - `fetchYarnBerryDeps`
 - `yarnBerryConfigHook`
 
-It's recommended to ensure you're explicitly pinning the major version used, for example by capturing the `yarn-berry_Xn` argument and then re-defining it as a `yarn-berry` `let` binding.
+Explicitly pin the major version. For example, capture the `yarn-berry_Xn` argument and re-define it as a `yarn-berry` `let` binding.
 
 ```nix
 {
@@ -656,26 +636,26 @@ stdenv.mkDerivation (finalAttrs: {
 ##### `yarn-berry_X.fetchYarnBerryDeps` {#javascript-fetchYarnBerryDeps}
 `fetchYarnBerryDeps` runs `yarn-berry-fetcher fetch` in a fixed-output-derivation. It is a custom fetcher designed to reproducibly download all files in the `yarn.lock` file, validating their hashes in the process. For git dependencies, it creates a checkout at `${offlineCache}/checkouts/<40-character-commit-hash>` (relying on the git commit hash to describe the contents of the checkout).
 
-To produce the `hash` argument for `fetchYarnBerryDeps` function call, the `yarn-berry-fetcher prefetch` command can be used:
+To produce the `hash` argument for the `fetchYarnBerryDeps` call, run `yarn-berry-fetcher prefetch`:
 
 ```console
 $ yarn-berry-fetcher prefetch </path/to/yarn.lock> [/path/to/missing-hashes.json]
 ```
 
-This prints the hash to stdout and can be used in update scripts to recalculate the hash for a new version of `yarn.lock`.
+This prints the hash to stdout. Use it in update scripts to recalculate the hash for a new `yarn.lock`.
 
 ##### `yarn-berry_X.yarnBerryConfigHook` {#javascript-yarnBerryConfigHook}
 `yarnBerryConfigHook` uses the store path `offlineCache` points to, to run a `yarn install` during the build, producing a usable `node_modules` directory from the downloaded dependencies.
 
 Internally, this uses a patched version of Yarn to ensure git dependencies are re-packed and any attempted downloads fail immediately.
 
-##### Patching upstream `package.json` or `yarn.lock` files {#javascript-yarnBerry-patching}
-In case patching the upstream `package.json` or `yarn.lock` is needed, it's important to pass `finalAttrs.patches` to `fetchYarnBerryDeps` as well, so the patched variants are picked up (i.e., `inherit (finalAttrs) patches`.
+##### Patching the project's `package.json` or `yarn.lock` files {#javascript-yarnBerry-patching}
+In case patching the project's `package.json` or `yarn.lock` is needed, it's important to pass `finalAttrs.patches` to `fetchYarnBerryDeps` as well, so the patched variants are picked up (i.e., `inherit (finalAttrs) patches`).
 
 ##### Missing hashes in the `yarn.lock` file {#javascript-yarnBerry-missing-hashes}
 Unfortunately, `yarn.lock` files do not include hashes for optional/platform-specific dependencies. This is [by design](https://github.com/yarnpkg/berry/issues/6759).
 
-To compensate for this, the `yarn-berry-fetcher missing-hashes` subcommand can be used to produce all missing hashes. These are usually stored in a `missing-hashes.json` file, which needs to be passed to both the build itself, as well as the `fetchYarnBerryDeps` helper:
+To compensate for this, run the `yarn-berry-fetcher missing-hashes` subcommand to produce all missing hashes. These are stored in a `missing-hashes.json` file, which needs to be passed to both the build itself, as well as the `fetchYarnBerryDeps` helper:
 
 ```nix
 {
@@ -718,7 +698,7 @@ If you are packaging something outside Nixpkgs, consider the following:
 
 ### npmlock2nix {#javascript-npmlock2nix}
 
-[npmlock2nix](https://github.com/nix-community/npmlock2nix) aims at building `node_modules` without code generation. It hasn't reached v1 yet, the API might be subject to change.
+[npmlock2nix](https://github.com/nix-community/npmlock2nix) aims at building `node_modules` without code generation. It hasn't reached v1 yet; the API may change.
 
 #### Pitfalls {#javascript-npmlock2nix-pitfalls}
 
@@ -726,7 +706,7 @@ There are some [problems with npm v7](https://github.com/tweag/npmlock2nix/issue
 
 ### nix-npm-buildpackage {#javascript-nix-npm-buildpackage}
 
-[nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage) aims at building `node_modules` without code generation. It hasn't reached v1 yet, the API might change. It supports both `package-lock.json` and yarn.lock.
+[nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage) aims at building `node_modules` without code generation. It hasn't reached v1 yet; the API may change. It supports both `package-lock.json` and yarn.lock.
 
 #### Pitfalls {#javascript-nix-npm-buildpackage-pitfalls}
 

doc/redirects.json

@@ -143,6 +143,9 @@
   "ex-writeShellApplication": [
     "index.html#ex-writeShellApplication"
   ],
+  "fetchfromtangled": [
+    "index.html#fetchfromtangled"
+  ],
   "first-package-go": [
     "index.html#first-package-go"
   ],
@@ -2798,9 +2801,6 @@
   "glycin-dont-wrap": [
     "index.html#glycin-dont-wrap"
   ],
-  "ghc": [
-    "index.html#ghc"
-  ],
   "gnome-platform": [
     "index.html#gnome-platform"
   ],
@@ -3648,7 +3648,8 @@
     "index.html#hareHook-cross-compilation"
   ],
   "haskell": [
-    "index.html#haskell"
+    "index.html#haskell",
+    "index.html#ghc"
   ],
   "haskell-available-packages": [
     "index.html#haskell-available-packages"
@@ -3777,15 +3778,9 @@
     "index.html#language-javascript"
   ],
   "javascript-introduction": [
-    "index.html#javascript-introduction"
-  ],
-  "javascript-finding-examples": [
-    "index.html#javascript-finding-examples"
-  ],
-  "javascript-finding-examples-github": [
-    "index.html#javascript-finding-examples-github"
-  ],
-  "javascript-finding-examples-gitlab": [
+    "index.html#javascript-introduction",
+    "index.html#javascript-finding-examples",
+    "index.html#javascript-finding-examples-github",
     "index.html#javascript-finding-examples-gitlab"
   ],
   "javascript-tools-overview": [

doc/release-notes/rl-2611.section.md

@@ -72,6 +72,8 @@
 
 - `alps` has been rewritten upstream, see [upstream repository](https://github.com/migadu/alps) for documentation.
 
+- `writers.makeDataWriter` has been removed. It has been deprecated since 2023. Use `pkgs.writeTextFile` instead.
+
 - `bosun` has been removed as it is no longer maintained upstream. the corresponding monitoring options has been removed.
 
 - `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
@@ -99,6 +101,8 @@
 
 - `pdns` has been updated from `5.0.x` to `5.1.x`. Please be sure to review the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-5-1-0) before upgrading. Namely LUA record updates are no longer allowed by default, and the embedded webserver no longer includes a `access-control-allow-origin: *` header by default.
 
+- LibreOffice upstream switched from Fresh/Still stable branches to a single Stable branch; `libreoffice` and `libreoffice-qt` work as before, but more specific aliases like `libreoffice-fresh` should be replaced.
+
 - `davmail` no longer supports building with GTK 2, and the `preferGtk3` override flag has been removed as GTK 3 is always used.
 
 - Support for the legacy U‐Boot image format has been removed from the Linux kernel builders, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
@@ -157,6 +161,8 @@
 
 - `buildFHSEnv`, `appimageTools.wrapAppImage`, and `appimageTools.wrapType2` now support the `finalAttrs` pattern. When using `wrapAppImage`, it is now recommended to pass the extracted AppImage to the `contents` attribute (instead of `src`), to avoid shadowing `src`. Passing the extracted contents to `src` is now deprecated and will be removed in a future release.
 
+- All databases of the MySQL family – `mysql`, `mariadb` and `percona` – now provide a client-only package `client` sub-attribute. Use the `<dbname>.client` package if the server components are not needed. The main package continues to ship the client binaries as well.
+
 - Package-URL (PURL, https://github.com/package-url/purl-spec) metadata identifier has been added for `fetchgit`, `fetchpypi` and `fetchFromGithub` fetchers.
   `mkDerivation` has been adjusted to reuse this information.
   Package-URLs allow reliably identifying and locating software packages.

doc/stdenv/stdenv.chapter.md

@@ -508,6 +508,7 @@ A number between 0 and 7 indicating how much information to log. If set to 1 or
 #### `enableParallelBuilding` {#var-stdenv-enableParallelBuilding}
 
 If set to `true`, `stdenv` will pass specific flags to `make` and other build tools to enable parallel building with up to `build-cores` workers.
+Can be overridden for a specific phase using `enableParallelInstalling` or `enableParallelChecking`.
 
 Unless set to `false`, some build systems with good support for parallel building including `cmake`, `meson`, and `qmake` will set it to `true`.
 

lib/licenses/licenses.nix

@@ -283,6 +283,12 @@ lib.mapAttrs mkLicense (
       fullName = "BSD 3-Clause Tso variant";
     };
 
+    bsdAskToEndorse = {
+      #spdxId = "BSD-ask-to-endorse"; # Accepted to SPDX waiting on next SPDX release
+      fullName = "BSD - ask to endorse";
+      url = "https://github.com/sudo-project/sudo/blob/c1307ea9ff340ce0538779f8e456501461fc44b7/plugins/sudoers/redblack.c#L24-L43";
+    };
+
     bsdAxisNoDisclaimerUnmodified = {
       fullName = "BSD-Axis without Warranty Disclaimer with Unmodified requirement";
       url = "https://scancode-licensedb.aboutcode.org/bsd-no-disclaimer-unmodified.html";
@@ -1284,6 +1290,11 @@ lib.mapAttrs mkLicense (
       fullName = "Open Data Commons Open Database License v1.0";
     };
 
+    ofl10 = {
+      spdxId = "OFL-1.0";
+      fullName = "SIL Open Font License 1.0";
+    };
+
     ofl = {
       spdxId = "OFL-1.1";
       fullName = "SIL Open Font License 1.1";
@@ -1470,12 +1481,6 @@ lib.mapAttrs mkLicense (
       fullName = "MIT-STK License";
     };
 
-    sudo = {
-      shortName = "sudo";
-      fullName = "Sudo License (ISC-style)";
-      url = "https://www.sudo.ws/about/license/";
-    };
-
     sustainableUse = {
       spdxId = "SUL-1.0";
       fullName = "Sustainable Use License";
@@ -1643,6 +1648,8 @@ lib.mapAttrs mkLicense (
     vol-sl = {
       fullName = "Volatility Software License, Version 1.0";
       url = "https://www.volatilityfoundation.org/license/vsl-v1.0";
+      free = false;
+      redistributable = true;
     };
 
     vsl10 = {

lib/systems/default.nix

@@ -161,14 +161,12 @@ let
             (with final; isWindows && isAarch64);
 
         # Use the split GCC package set (`gccNGPackages`) instead of the
-        # monolithic `gcc`. No platform selects it yet; it is opt-in, set
-        # explicitly on a platform spec, so that the split set can be exercised
-        # before anything depends on it.
+        # monolithic `gcc`.
         #
-        # I (@Ericson2314) plan on making obscure low-tier platforms (e.g.
-        # NetBSD) use it soon, so we can dogfood GCC NG and thereby iron out its
-        # bugs.
-        useGccNG = false;
+        # I (@Ericson2314) plan on making more obscure low-tier
+        # platforms (e.g. NetBSD) use it soon, so we can dogfood GCC NG
+        # and thereby iron out its bugs.
+        useGccNG = final.isCygwin;
 
         libc =
           if final.isDarwin then

maintainers/github-teams.json

@@ -694,8 +694,8 @@
       "eclairevoyant": 848000
     },
     "members": {
-      "Eveeifyeve": 88671402,
-      "daylinmorgan": 47667941
+      "daylinmorgan": 47667941,
+      "eveeifyeve": 88671402
     },
     "name": "nim"
   },
@@ -788,10 +788,11 @@
     "description": "Maintain Pantheon desktop environment and platform",
     "id": 4786995,
     "maintainers": {
+      "bobby285271": 20080233,
       "davidak": 91113
     },
     "members": {
-      "bobby285271": 20080233
+      "amz-x": 18249234
     },
     "name": "Pantheon"
   },
@@ -895,7 +896,6 @@
       "0x4A6F": 9675338
     },
     "members": {
-      "DarkKirb": 23011243,
       "dramforever": 2818072,
       "fgaz": 8182846,
       "jonhermansen": 660911

maintainers/maintainer-list.nix

@@ -4885,6 +4885,12 @@
     githubId = 543423;
     name = "Alex Wied";
   };
+  ceridwen15 = {
+    email = "me@cdwn.gay";
+    github = "NonsensicalNickname";
+    githubId = 118519066;
+    name = "Ceridwen Weaving";
+  };
   cfouche = {
     email = "chaddai.fouche@gmail.com";
     github = "Chaddai";
@@ -5425,6 +5431,12 @@
     githubId = 69784758;
     matrix = "@clot27:matrix.org";
   };
+  cloudglides = {
+    name = "Cloud";
+    email = "cloudglides@proton.me";
+    github = "cloudglides";
+    githubId = 111557161;
+  };
   cloudripper = {
     email = "dev+nixpkgs@cldrpr.com";
     github = "cloudripper";
@@ -5617,6 +5629,12 @@
     githubId = 327028;
     name = "Cole Mickens";
   };
+  colepearson27 = {
+    name = "Cole Pearson";
+    email = "colepearson27@gmail.com";
+    github = "colepearson27";
+    githubId = 113060096;
+  };
   colescott = {
     email = "colescottsf@gmail.com";
     github = "colescott";
@@ -8017,6 +8035,12 @@
     githubId = 63352906;
     keys = [ { fingerprint = "922F CA48 5FDB 20B1 ED1B  A61F 284D 11D3 33C4 D21B"; } ];
   };
+  edgarpost = {
+    name = "Edgar Post-Buijs";
+    email = "github@edgarpost.com";
+    github = "EdgarPost";
+    githubId = 488221;
+  };
   edlimerkaj = {
     name = "Edli Merkaj";
     email = "edli.merkaj@identinet.io";
@@ -8708,6 +8732,11 @@
       { fingerprint = "2E51 F618 39D1 FA94 7A73  00C2 34C0 4305 D581 DBFE"; }
     ];
   };
+  ethanthoma = {
+    name = "Ethan Thoma";
+    github = "ethanthoma";
+    githubId = 4424467;
+  };
   ethindp = {
     name = "Ethin Probst";
     email = "harlydavidsen@gmail.com";
@@ -10413,6 +10442,12 @@
     github = "gkleen";
     githubId = 20089782;
   };
+  gl1tchxd = {
+    name = "Felix Buchsteiner";
+    github = "gl1tchxd-git";
+    githubId = 92686452;
+    email = "contact@gl1tchxd.at";
+  };
   gleber = {
     email = "gleber.p@gmail.com";
     github = "gleber";
@@ -11055,6 +11090,12 @@
     githubId = 79340822;
     keys = [ { fingerprint = "3582 5B85 66C8 4F36 45C7  EC42 809F 7938 9CB1 8650"; } ];
   };
+  havunen = {
+    name = "Sampo Kivistö";
+    email = "sampo.kivisto@live.fi";
+    github = "havunen";
+    githubId = 2021355;
+  };
   hawkw = {
     email = "eliza@elizas.website";
     github = "hawkw";
@@ -11679,6 +11720,12 @@
     github = "I-Al-Istannen";
     githubId = 20284688;
   };
+  i-love-lean = {
+    name = "i-love-lean";
+    github = "i-love-lean";
+    githubId = 170473930;
+    email = "nixpkgs@unnamed.website";
+  };
   i01011001 = {
     email = "yugen.m7@gmail.com";
     github = "i01011001";
@@ -17000,6 +17047,12 @@
       }
     ];
   };
+  lunitur = {
+    email = "karlo.puselj@gmail.com";
+    github = "Lunitur";
+    githubId = 8092435;
+    name = "Karlo Pušelj";
+  };
   lunkentuss = {
     email = "peter.hansson17@gmail.com";
     matrix = "@lunkentuss:matrix.org";
@@ -17753,6 +17806,11 @@
     githubId = 29855073;
     name = "Michael Colicchia";
   };
+  Masrepus = {
+    github = "Masrepus";
+    githubId = 6538121;
+    name = "Samuel Hopstock";
+  };
   masrlinu = {
     github = "masrlinu";
     githubId = 5259918;
@@ -18772,6 +18830,12 @@
     githubId = 1387206;
     name = "Mike Sperber";
   };
+  mikilio = {
+    email = "kilian.mio@mikilio.com";
+    github = "Mikilio";
+    githubId = 86004375;
+    name = "Kilian Mio";
+  };
   mikoim = {
     email = "ek@esh.ink";
     github = "mikoim";
@@ -19116,6 +19180,12 @@
     githubId = 104795;
     name = "Marek Mahut";
   };
+  mmclinton = {
+    email = "nixpkg.concur071@simplelogin.com";
+    github = "mmclinton";
+    githubId = 96266047;
+    name = "Miller Clinton";
+  };
   mmesch = {
     github = "MMesch";
     githubId = 2597803;
@@ -19438,6 +19508,12 @@
     githubId = 15896005;
     name = "Vladyslav Burzakovskyy";
   };
+  mroboff = {
+    email = "mark.roboff@bluecircuit.ai";
+    github = "mroboff";
+    githubId = 81203001;
+    name = "Mark Roboff";
+  };
   mrsmoer = {
     email = "mrsmoer@protonmail.com";
     github = "MrSmoer";
@@ -27371,18 +27447,18 @@
     name = "Steven Allen";
     keys = [ { fingerprint = "327B 20CE 21EA 68CF A774  8675 7C92 3221 5899 410C"; } ];
   };
-  steeleduncan = {
-    email = "steeleduncan@hotmail.com";
-    github = "steeleduncan";
-    githubId = 866573;
-    name = "Duncan Steele";
-  };
   steell = {
     email = "steve@steellworks.com";
     github = "Steell";
     githubId = 1699155;
     name = "Steve Elliott";
   };
+  stefanboca = {
+    email = "stefan.r.boca@gmail.com";
+    github = "stefanboca";
+    githubId = 45266795;
+    name = "Stefan Boca";
+  };
   stefanfehrenbach = {
     email = "stefan.fehrenbach@gmail.com";
     github = "fehrenbach";
@@ -27501,6 +27577,12 @@
     githubId = 4340859;
     name = "Stian Lågstad";
   };
+  stig = {
+    email = "stig@circleci.com";
+    github = "stig";
+    githubId = 45407;
+    name = "Stig Brautaset";
+  };
   StijnDW = {
     email = "nixdev@rinsa.eu";
     github = "Stekke";
@@ -29288,6 +29370,11 @@
     githubId = 47905926;
     name = "toyboot4e";
   };
+  tpansino = {
+    name = "Tom Pansino";
+    github = "tpansino";
+    githubId = 2768420;
+  };
   tphanir = {
     github = "tphanir";
     name = "phani";
@@ -29699,6 +29786,11 @@
     githubId = 12422133;
     name = "Chromo-residuum-opec";
   };
+  ui-1 = {
+    name = "ui-1";
+    github = "ui-1";
+    githubId = 134524800;
+  };
   uku3lig = {
     name = "uku";
     email = "hi@uku.moe";
@@ -32116,6 +32208,11 @@
     githubId = 39456023;
     name = "Mike Yim";
   };
+  zeusec = {
+    name = "Cole";
+    github = "zeusec";
+    githubId = 65095161;
+  };
   zevisert = {
     email = "dev@zevisert.ca";
     github = "zevisert";

maintainers/scripts/kde/collect-licenses.sh

@@ -25,6 +25,11 @@ for k in "${!sources[@]}"; do
     mkdir "$TMPDIR/$k"
     tar -C "$TMPDIR/$k" -xf "${sources[$k]}"
 
+    if [ "$k" == "kdenlive" ]; then
+        echo "[kdenlive] Applying horrible hack"
+        rm -rf "$TMPDIR/$k/"*"/data/lumas"
+    fi
+
     (cd "$TMPDIR/$k"; reuse lint --json) | jq --arg name "$k" '{$name: .summary.used_licenses | sort}' -c > "$TMPDIR/$k.json"
 done
 

maintainers/scripts/kde/utils.py

@@ -91,13 +91,13 @@ class KDERepoMetadata:
         return {p.name: p for p in self.projects}
 
     @functools.cached_property
-    def projects_by_path(self):
-        return {p.project_path: p for p in self.projects}
+    def projects_by_repo(self):
+        return {p.repo_path: p for p in self.projects}
 
     def try_lookup_package(self, path):
         if path in IGNORE:
             return None
-        project = self.projects_by_path.get(path)
+        project = self.projects_by_repo.get(path)
         if project is None and path not in WARNED:
             WARNED.add(path)
             print(f"Warning: unknown project {path}")
@@ -109,7 +109,7 @@ class KDERepoMetadata:
             Project.from_yaml(metadata_file)
             for metadata_file in repo_metadata.glob("projects-invent/**/metadata.yaml")
         ] + [
-            Project(id, None, project_path, None)
+            Project(id, None, project_path, project_path)
             for project_path, id in THIRD_PARTY.items()
         ]
 
@@ -125,11 +125,11 @@ class KDERepoMetadata:
         dep_graph = collections.defaultdict(set)
 
         if unstable:
-            spec_name = "dependency-data-kf6-qt6"
+            spec_name = "kde-dependencies-latest-kf6"
         else:
-            spec_name = "dependency-data-stable-kf6-qt6"
+            spec_name = "kde-dependencies-stable-kf6"
 
-        spec_path = repo_metadata / "dependencies" / spec_name
+        spec_path = repo_metadata / "kde-dependencies" / spec_name
         for line in spec_path.open():
             line = line.strip()
             if line.startswith("#"):

nixos/doc/manual/development/settings-options.section.md

@@ -291,10 +291,17 @@ have a predefined type and string generator already declared under
     and returning a set with JSON-specific attributes `type` and
     `generate` as specified [below](#pkgs-formats-result).
 
-`pkgs.formats.yaml` { }
+`pkgs.formats.yaml` { *`tags`* ? false }
 
-:   A function taking an empty attribute set (for future extensibility)
-    and returning a set with YAML-specific attributes `type` and
+:   A function taking an attribute set with values
+
+    `tags`
+
+    :   A boolean for controlling whether YAML tags can be generated.
+        If set, attribute sets with a single key that starts with a "!"
+        will be interpreted as a YAML tag.
+
+    It returns a set with YAML-specific attributes `type` and
     `generate` as specified [below](#pkgs-formats-result).
 
 `pkgs.formats.ini` { *`listsAsDuplicateKeys`* ? false, *`listToValue`* ? null, \.\.\. }

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -464,7 +464,7 @@
 
 - `services.pds` has been renamed to `services.bluesky-pds`.
 
-- `services.pfix-srsd` now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the [services.pfix-srsd.configurePostfix](#opt-services.pfix-srsd.configurePostfix) option.
+- `services.pfix-srsd` now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the `services.pfix-srsd.configurePostfix` option.
 
 - `services.postsrsd` now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the [services.postsrsd.configurePostfix](#opt-services.postsrsd.configurePostfix) option.
 

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -38,6 +38,8 @@
 
 - [Moonlight Qt](https://moonlight-stream.org/), a client for playing your PC games on almost any device. Available as [programs.moonlight-qt](#opt-programs.moonlight-qt.enable).
 
+- [udp514-journal](https://github.com/eworm-de/udp514-journal), a service to forward remote syslog messages to systemd-journal. Available as [services.udp514-journal](#opt-services.udp514-journal.enable).
+
 - [RomM](https://romm.app/), a self-hosted ROM manager and player. Available as [services.romm](#opt-services.romm.enable).
 
 - [scx_loader](https://github.com/sched-ext/scx-loader), a system daemon and DBus-based loader for sched_ext schedulers. `scxctl` is the command-line client for interacting with the loader, allowing users to switch schedulers, modes, and arguments dynamically. Available as [services.scx-loader](#opt-services.scx-loader.enable)
@@ -84,10 +86,14 @@
 
 - [Krill](https://nlnetlabs.nl/projects/krill/about), RPKI CA and Publication Server written in Rust. Available as [services.krill](#opt-services.krill.enable).
 
+- [vellum](https://github.com/greyxp1/vellum) is a live screen annotation overlay for Wayland. Available as [programs.vellum](#opt-programs.vellum.enable).
+
 - [stash-clipboard](https://github.com/NotAShelf/stash), a Wayland clipboard "manager" with fast persistent history and multi-media support. Available as [services.stash-clipboard](#opt-services.stash-clipboard.enable).
 
 - [OO7](https://github.com/linux-credentials/oo7) is a desktop-agnostic Secret Service provider. Available as [services.oo7](#opt-services.oo7.enable)
 
+- [rosec](https://github.com/jmylchreest/rosec), a secrets daemon implementing the freedesktop.org Secret Service API with modular backend providers. It can automatically unlock the user's vault on login via PAM. Available as [services.rosec](#opt-services.rosec.enable).
+
 - [NordVPN](https://github.com/NordSecurity/nordvpn-linux), a NordVPN client for linux. Available as [services.nordvpn](options.html#opt-services.nordvpn.enable).
 
 - [RNSD](https://reticulum.network/), the Reticulum Network Stack Daemon. It provides a secure and efficient way to communicate over the Reticulum Network. Available as [services.rnsd](#opt-services.rnsd.enable).
@@ -178,18 +184,25 @@
 
 - `services.firezone.server.provision` has been removed due to it being unmaintanable. Remove all uses of provisioning and use the WebUI to configure firezone.
 
+- `security.unprivilegedUsernsClone` has been removed. The option controls a sysctl only provided by the removed -hardened kernels. The removal should only affect users running custom hardened kernels.
+  Disabling user-namespace is possible by setting `boot.kernel.sysctl."user.max_user_namespaces"` to zero, but not generally advised, as browsers, like firefox and chrome, and many other user tools use namespaces for sandboxing.
+
 - The `services.syncthing` module now updates the Syncthing REST API using partial updates (`PATCH`) instead of full replacements (`PUT`) for general settings. Updating these settings was broken and prone to errors after updates, see [#428808](https://github.com/NixOS/nixpkgs/issues/428808) and [#528889](https://github.com/NixOS/nixpkgs/issues/528889). As a result, settings modified manually through the Syncthing Web UI that are not explicitly defined in your Nix configuration will now persist across rebuilds.
 
 - `services.plantuml-server.packages.jetty` now supports `jetty_12`, it no longer supports `jetty_11`.
 
 - `services.komodo-periphery` has been updated to support version 2.0.0. Some options have been renamed to match the new configuration structure; compatibility aliases are provided for the renamed options. The `passkeys` and `outbound.onboardingKey` options have been removed; use `passkeyFiles`, `auth.privateKey`/`auth.corePublicKeys`, or `outbound.onboardingKeyFile` instead. New outbound mode configuration is available under `outbound.*`.
 
+- `services.pfix-srsd` and the supporting `pfixtools` package have been removed, as the project is dormant and does not support pcre2.  `services.postsrsd` is the recommended replacement for Sender Rewriting Scheme support with Postfix.
+
 - Package `overseerr` has been removed as the `overseerr` and `jellyseerr` projects were merged under `seerr`.
 
 - `slskd` has been updated to v0.25.0, which renames the `global` option to `transfers`. Please review the [changelog](https://github.com/slskd/slskd/releases#release-0.25.0).
 
 - [firefox-syncserver.database.type](#opt-services.firefox-syncserver.database.type) no longer defaults to `"mysql"`. You must now explicitly choose between `"mysql"` and `"postgresql"`. New deployments should prefer PostgreSQL.
 
+- `chatgpt` has been retargeted to OpenAI's new ChatGPT desktop app, while the previous app has been renamed to `chatgpt-classic`.
+
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -233,6 +246,8 @@
 
 - `services.nginx` gained a [`lua`](#opt-services.nginx.lua.enable) option to enable Lua scripting via OpenResty's lua-nginx-module on a stock nginx, configuring `lua_package_path`/`lua_package_cpath` from the packages listed in [`services.nginx.lua.extraPackages`](#opt-services.nginx.lua.extraPackages). Use this to add Lua to a regular nginx; for the full OpenResty platform (libraries that rely on its bundled lualib, such as `lua-resty-openidc`), set `services.nginx.package` to `pkgs.openresty` instead — the option configures the Lua search path for it too.
 
+- `services.nginx.virtualHosts.<name>.locations.<name>` gained a new `useGrpcErrorPages` option. If enabled, it sets up error pages that are valid gRPC messages. This is useful if you proxy gRPC and want to emit errors from nginx, for example when adding authentication on top.
+
 - `security.polkit.settings` added for RFC42 style configuration of the polkitd daemon.
 
 - `boot.supportedFilesystems.ntfs` installs `ntfsprogs-plus` instead of `ntfs3g` on kernel version 7.1 and later, unless `boot.supportedFilesystems.ntfs-3g` is explicitly enabled.
@@ -247,7 +262,9 @@
 
 - `services.gitlab.registry` now uses PostgreSQL as database storage for new installations and supports old installations that use the filesystem as metadata storage. It creates the required PostgreSQL database and user. Users can manually migrate their filesystem based metadata storage. See [GitLab Container Registry Migration to database metadata store](#module-services-gitlab-registry-database-migration).
 
-- Enabling [`services.userborn`](#opt-services.userborn.enable) on a system that was previously managed by the default `update-users-groups.pl` script now imports the legacy state from `/var/lib/nixos/` on the first switch. Locked stub entries are added to `/etc/passwd` and `/etc/group` for every name recorded in `uid-map`/`gid-map` that no longer has a live entry, so a previously-used UID/GID cannot be reassigned to a different user. If the import fails, userborn does not start and the user database is left untouched. Inspect `journalctl -u userborn-import-legacy.service`, fix or remove the legacy state, and switch again. The import can be skipped entirely with [`services.userborn.importLegacyState`](#opt-services.userborn.importLegacyState)` = false`.
+- `services.fail2ban` now supports systemd socket activation via `fail2ban.socket`
+
+- Enabling [`services.userborn`](#opt-services.userborn.enable) on a system that was previously managed by the default `update-users-groups.pl` script now imports the legacy state from `/var/lib/nixos/` on the first switch. Locked stub entries are added to `/etc/passwd` and `/etc/group` for every name recorded in `uid-map`/`gid-map` that no longer has a live entry, so a previously-used UID/GID cannot be reassigned to a different user. Subordinate id ranges recorded in `auto-subuid-map` are seeded into the subid files as well. If the import fails, userborn does not start and the user database is left untouched. Inspect `journalctl -u userborn-import-legacy.service`, fix or remove the legacy state, and switch again. The import can be skipped entirely with [`services.userborn.importLegacyState`](#opt-services.userborn.importLegacyState)` = false`.
 
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.
 

nixos/lib/testing/meta.nix

@@ -1,4 +1,9 @@
-{ lib, options, ... }:
+{
+  config,
+  lib,
+  options,
+  ...
+}:
 let
   inherit (lib) types mkOption literalMD;
 
@@ -26,7 +31,7 @@ in
       '';
       apply = lib.filterAttrs (k: v: v != null);
       type = types.submodule (
-        { options, config, ... }:
+        { options, ... }:
         {
           options = {
             maintainers = mkOption {
@@ -71,7 +76,10 @@ in
             };
             platforms = mkOption {
               type = types.listOf types.raw;
-              default = lib.platforms.linux ++ lib.platforms.darwin;
+              default = lib.platforms.linux ++ lib.optionals (config.containers == { }) lib.platforms.darwin;
+              defaultText = literalMD ''
+                `lib.platforms.linux ++ lib.platforms.darwin` when no containers are configured; otherwise `lib.platforms.linux`.
+              '';
               description = ''
                 Sets the [`meta.platforms`](https://nixos.org/manual/nixpkgs/stable/#var-meta-platforms) attribute on the [{option}`test`](#test-opt-test) derivation.
               '';

nixos/modules/config/users-groups.nix

@@ -842,7 +842,7 @@ in
       users.users = {
         root = {
           uid = ids.uids.root;
-          description = "System administrator";
+          description = mkDefault "System administrator";
           home = "/root";
           shell = mkDefault cfg.defaultUserShell;
           group = "root";
@@ -850,7 +850,7 @@ in
         nobody = {
           uid = ids.uids.nobody;
           isSystemUser = true;
-          description = "Unprivileged account (don't use!)";
+          description = mkDefault "Unprivileged account (don't use!)";
           group = "nogroup";
         };
       };

nixos/modules/i18n/input-method/fcitx5.nix

@@ -9,6 +9,16 @@ let
   cfg = imcfg.fcitx5;
   fcitx5Package = pkgs.qt6Packages.fcitx5-with-addons.override { inherit (cfg) addons; };
   settingsFormat = pkgs.formats.ini { };
+  mkKeyValue = lib.generators.mkKeyValueDefault {
+    mkValueString =
+      v:
+      if true == v then
+        "True"
+      else if false == v then
+        "False"
+      else
+        lib.generators.mkValueStringDefault { } v;
+  } "=";
 in
 {
   options = {
@@ -131,10 +141,13 @@ in
           };
       in
       lib.attrsets.mergeAttrsList [
-        (optionalFile "config" (lib.generators.toINI { }) cfg.settings.globalOptions)
-        (optionalFile "profile" (lib.generators.toINI { }) cfg.settings.inputMethod)
+        (optionalFile "config" (lib.generators.toINI { inherit mkKeyValue; }) cfg.settings.globalOptions)
+        (optionalFile "profile" (lib.generators.toINI { inherit mkKeyValue; }) cfg.settings.inputMethod)
         (lib.concatMapAttrs (
-          name: value: optionalFile "conf/${name}.conf" (lib.generators.toINIWithGlobalSection { }) value
+          name: value:
+          optionalFile "conf/${name}.conf" (lib.generators.toINIWithGlobalSection {
+            inherit mkKeyValue;
+          }) value
         ) cfg.settings.addons)
       ];
 

nixos/modules/module-list.nix

@@ -352,6 +352,7 @@
   ./programs/udevil.nix
   ./programs/upki.nix
   ./programs/usbtop.nix
+  ./programs/vellum.nix
   ./programs/vim.nix
   ./programs/virt-manager.nix
   ./programs/vivid.nix
@@ -782,6 +783,7 @@
   ./services/logging/syslog-ng.nix
   ./services/logging/syslogd.nix
   ./services/logging/SystemdJournal2Gelf.nix
+  ./services/logging/udp514-journal.nix
   ./services/logging/ulogd.nix
   ./services/logging/vector.nix
   ./services/mail/automx2.nix
@@ -804,7 +806,6 @@
   ./services/mail/offlineimap.nix
   ./services/mail/opendkim.nix
   ./services/mail/opensmtpd.nix
-  ./services/mail/pfix-srsd.nix
   ./services/mail/postfix-tlspol.nix
   ./services/mail/postfix.nix
   ./services/mail/postgrey.nix
@@ -1319,6 +1320,7 @@
   ./services/networking/mmsd.nix
   ./services/networking/modemmanager.nix
   ./services/networking/monero.nix
+  ./services/networking/moonshine.nix
   ./services/networking/mosquitto.nix
   ./services/networking/mozillavpn.nix
   ./services/networking/mptcpd.nix
@@ -1574,6 +1576,7 @@
   ./services/security/physlock.nix
   ./services/security/pocket-id.nix
   ./services/security/reaction.nix
+  ./services/security/rosec.nix
   ./services/security/shibboleth-sp.nix
   ./services/security/sks.nix
   ./services/security/spire/agent.nix

nixos/modules/programs/atuin.nix

@@ -60,7 +60,7 @@ in
       description = ''
         Configuration written to {file}`/etc/atuin/config.toml`.
 
-        See <https://docs.atuin.sh/configuration/config/> for the full list
+        See <https://docs.atuin.sh/latest/configuration/config/> for the full list
         of options.
       '';
     };
@@ -99,7 +99,7 @@ in
         {file}`/etc/atuin/themes/theme-name.toml`
         where the name of each attribute is the theme-name
 
-        See <https://docs.atuin.sh/guide/theming/> for the full list
+        See <https://docs.atuin.sh/latest/guide/theming/> for the full list
         of options.
       '';
       default = { };

nixos/modules/programs/benchexec.nix

@@ -86,9 +86,6 @@ in
     programs = {
       cpu-energy-meter.enable = lib.mkDefault true;
     };
-
-    # See <https://github.com/sosy-lab/benchexec/blob/3.18/doc/INSTALL.md#kernel-requirements>.
-    security.unprivilegedUsernsClone = true;
   };
 
   meta.maintainers = with lib.maintainers; [ lorenzleutgeb ];

nixos/modules/programs/vellum.nix

@@ -0,0 +1,81 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.vellum;
+
+  inherit (lib)
+    getExe
+    literalExpression
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    ;
+  inherit (lib.types) separatedString;
+
+  toml = pkgs.formats.toml { };
+in
+{
+  options.programs.vellum = {
+    enable = mkEnableOption "vellum, a live screen annotation overlay for Wayland";
+
+    package = mkPackageOption pkgs "vellum" { };
+
+    settings = mkOption {
+      inherit (toml) type;
+      default = { };
+      description = ''
+        Configuration options for vellum.
+        See available options at <https://github.com/greyxp1/vellum/blob/master/docs/configuration.md>.
+      '';
+      example = literalExpression ''
+        {
+          default_tool = "arrow";
+          remember_last_tool = false;
+          feedback_duration_ms = 250;
+        }
+      '';
+    };
+
+    extraOptions = mkOption {
+      type = separatedString " ";
+      default = "";
+      description = ''
+        Extra command-line options to pass to
+        the {command}`vellum` daemon.
+      '';
+      example = "--force-backend vulkan";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment = {
+      systemPackages = [ cfg.package ];
+
+      etc."xdg/vellum/config.toml" = mkIf (cfg.settings != { }) {
+        source = toml.generate "vellum-config.toml" cfg.settings;
+      };
+    };
+
+    systemd.user.services.vellum = {
+      description = "Vellum screen annotation overlay";
+      after = [ "graphical-session.target" ];
+      partOf = [ "graphical-session.target" ];
+      wantedBy = [ "graphical-session.target" ];
+      restartTriggers = [ config.environment.etc."xdg/vellum/config.toml".source ];
+      serviceConfig = {
+        ExecStart = "${getExe cfg.package} ${cfg.extraOptions}";
+        Restart = "on-failure";
+      };
+    };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ poz ];
+  };
+}

nixos/modules/rename.nix

@@ -320,6 +320,9 @@ in
       The Javascript version of Parsoid configured through this module does not work with modern MediaWiki versions,
       and has been deprecated by upstream, so it has been removed. MediaWiki comes with a new PHP-based parser built-in, so there is no need for this module.
     '')
+    (mkRemovedOptionModule [ "services" "pfix-srsd" ] ''
+      The pfixtools project is dormant and does not support pcre2.  `services.postsrsd` is the recommended replacement for Sender Rewriting Scheme support with Postfix.
+    '')
     (mkRemovedOptionModule [ "services" "pingvin-share" ] ''
       The `pingvin-share.backend` package was broken and the project was archived upstream, so it was removed from nixpkgs.
     '')

nixos/modules/security/acme/default.nix

@@ -772,7 +772,7 @@ let
           description = ''
             Key type to use for private keys.
             For an up to date list of supported values check the --key-type option
-            at <https://go-acme.github.io/lego/usage/cli/options/>.
+            at <https://go-acme.github.io/lego/references/ref-flags/index.html#options>.
           '';
         };
 
@@ -833,7 +833,7 @@ let
           '';
           example = lib.literalExpression ''
             {
-              "RFC2136_TSIG_SECRET_FILE" = "/run/secrets/tsig-secret-example.org";
+              "DNSUPDATE_TSIG_SECRET_FILE" = "/run/secrets/tsig-secret-example.org";
             }
           '';
         };
@@ -852,8 +852,9 @@ let
           inherit (defaultAndText "ocspMustStaple" false) default defaultText;
           description = ''
             Turns on the OCSP Must-Staple TLS extension.
-            Make sure you know what you're doing! See:
-
+            Make sure you know what you're doing!
+            OCSP Must-Staple can be considered a legacy feature, that is no longer superted by Let's Encrypt. See:
+            - <https://letsencrypt.org/2024/12/05/ending-ocsp>
             - <https://blog.apnic.net/2019/01/15/is-the-web-ready-for-ocsp-must-staple/>
             - <https://blog.hboeck.de/archives/886-The-Problem-with-OCSP-Stapling-and-Must-Staple-and-why-Certificate-Revocation-is-still-broken.html>
           '';

nixos/modules/security/misc.nix

@@ -9,6 +9,16 @@
       [ "security" "virtualization" "flushL1DataCache" ]
       [ "security" "virtualisation" "flushL1DataCache" ]
     )
+    (lib.mkRemovedOptionModule
+      [
+        "security"
+        "unprivilegedUsernsClone"
+      ]
+      ''
+        to disable or enable unprivileged user namespaces please use
+        the sysctl "user.max_user_namespaces".
+      ''
+    )
   ];
 
   options = {
@@ -31,16 +41,6 @@
       '';
     };
 
-    security.unprivilegedUsernsClone = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = ''
-        When disabled, unprivileged users will not be able to create new namespaces.
-        By default unprivileged user namespaces are disabled.
-        This option only works in a hardened profile.
-      '';
-    };
-
     security.protectKernelImage = lib.mkOption {
       type = lib.types.bool;
       default = false;
@@ -121,10 +121,6 @@
       ];
     })
 
-    (lib.mkIf config.security.unprivilegedUsernsClone {
-      boot.kernel.sysctl."kernel.unprivileged_userns_clone" = lib.mkDefault true;
-    })
-
     (lib.mkIf config.security.protectKernelImage {
       # Disable hibernation (allows replacing the running kernel)
       boot.kernelParams = [ "nohibernate" ];

nixos/modules/security/pam.nix

@@ -686,6 +686,18 @@ let
           '';
         };
 
+        rosec = {
+          enable = lib.mkOption {
+            default = false;
+            type = lib.types.bool;
+            description = ''
+              If enabled, pam_rosec will attempt to automatically unlock the
+              user's rosec vault upon login. If the user login password does not
+              match their vault password, rosec will prompt separately after login.
+            '';
+          };
+        };
+
         enableUMask = lib.mkOption {
           default = config.security.pam.enableUMask;
           defaultText = lib.literalExpression "config.security.pam.enableUMask";
@@ -1209,6 +1221,7 @@ let
                       || cfg.kwallet.enable
                       || cfg.enableGnomeKeyring
                       || cfg.oo7.enable
+                      || cfg.rosec.enable
                       || config.services.intune.enable
                       || cfg.googleAuthenticator.enable
                       || cfg.gnupg.enable
@@ -1278,6 +1291,12 @@ let
                       control = "optional";
                       modulePath = "${pkgs.oo7-pam}/lib/security/pam_oo7.so";
                     }
+                    {
+                      name = "rosec";
+                      enable = cfg.rosec.enable;
+                      control = "optional";
+                      modulePath = "${pkgs.rosec}/lib/security/pam_rosec.so";
+                    }
                     {
                       name = "intune";
                       enable = config.services.intune.enable;
@@ -1499,6 +1518,12 @@ let
                 control = "optional";
                 modulePath = "${pkgs.oo7-pam}/lib/security/pam_oo7.so";
               }
+              {
+                name = "rosec";
+                enable = cfg.rosec.enable;
+                control = "optional";
+                modulePath = "${pkgs.rosec}/lib/security/pam_rosec.so";
+              }
             ];
 
             session = utils.pam.autoOrderRules [
@@ -1726,6 +1751,12 @@ let
                   auto_start = true;
                 };
               }
+              {
+                name = "rosec";
+                enable = cfg.rosec.enable;
+                control = "optional";
+                modulePath = "${pkgs.rosec}/lib/security/pam_rosec.so";
+              }
               {
                 name = "gnupg";
                 enable = cfg.gnupg.enable;

nixos/modules/security/tpm2.md

@@ -59,6 +59,9 @@ So the raw tpm character device, the kernel RM, and `tabrmd` are all "TCTIs".
 The ESAPI library speaks the client side of the TCTI protocol, and can be connected to any server TCTI.
 All of the other libraries or programs that work with TPM all use ESAPI under the hood, and so a common characteristic among all these libraries is that you will find you need to configure them in some way as to which TCTI they should be talking to.
 
+A TPM-enabled system should choose to enable either the Linux kernel resource manager or the `tabrmd` resource manager. The tpm2-software group does not have absolute guidance on this, but the userspace resource manager supports an anti-contention feature known as session un-gapping but has not seen recent development.
+The kernel resource manager has seen more active development and is the resource manager of choice in immutable distributions such as Fedora Silverblue.
+
 #### Higher Level Interfaces {#module-security-tpm2-introduction-hli}
 
 As alluded to previously, there are a number of ways of speaking the client side TCTI that all amount to wrappers around ESAPI. They include:
@@ -73,6 +76,16 @@ As alluded to previously, there are a number of ways of speaking the client side
 
 A typical configuration is:
 ```
+security.tpm2 = {
+    enable = true;
+    pkcs11.enable = true;
+
+    tctiEnvironment.enable = true;
+}
+```
+
+Or to use the `tpm2-abrmd` resource manager:
+```
 security.tpm2 = {
     enable = true;
     abrmd.enable = true;
@@ -85,7 +98,6 @@ security.tpm2 = {
 `enable = true;` is required for any tpm functionality other than the raw character device and kernel resource manager to be available.
 
 `abrmd.enable = true;` causes the tpm2-abrmd program (the user-space resource manager) to run as a systemd service.
-Generally you want this because the user-space resource manager gets more frequent updates than the kernel-space RM, and there aren't any kernel RM features that are unavailable in the user-space RM.
 
 `pkcs11.enable = true;` makes the PKCS11 tool and libraries available in the system path.
 Generally you want this because it's unlikely to cause problems and it's required by one of the more common TPM use cases, which is protecting an ssh key using the TPM.

nixos/modules/services/databases/chromadb.nix

@@ -27,7 +27,7 @@ in
 
   options = {
     services.chromadb = {
-      enable = mkEnableOption "ChromaDB, an open-source AI application database.";
+      enable = mkEnableOption "ChromaDB, an open-source AI application database";
 
       package = mkPackageOption pkgs [ "python3Packages" "chromadb" ] { };
 

nixos/modules/services/databases/mysql.nix

@@ -213,7 +213,7 @@ in
       initialScript = lib.mkOption {
         type = lib.types.nullOr lib.types.path;
         default = null;
-        description = "A file containing SQL statements to be executed on the first startup. Can be used for granting certain permissions on the database.";
+        description = "A file containing SQL statements to be executed on the first startup. Can be used for granting certain permissions on the database. Run as superuser.";
       };
 
       ensureDatabases = lib.mkOption {

nixos/modules/services/logging/udp514-journal.nix

@@ -0,0 +1,95 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.udp514-journal;
+  description = "Forward syslog from network (udp/514) to journal";
+in
+{
+  options = {
+    services.udp514-journal = {
+      enable = lib.mkEnableOption "the udp514-journal systemd socket/service";
+
+      openFirewall = lib.mkEnableOption "" // {
+        description = "Whether to open the port in the firewall.";
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 514;
+        description = "Port to listen on";
+      };
+
+      package = lib.mkPackageOption pkgs "udp514-journal" { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.sockets.udp514-journal = {
+      enable = true;
+      name = "udp514-journal.socket";
+      inherit description;
+      listenDatagrams = [ (builtins.toString cfg.port) ];
+      wantedBy = [ "sockets.target" ];
+    };
+
+    systemd.services.udp514-journal = {
+      enable = true;
+      name = "udp514-journal.service";
+      inherit description;
+      requires = [
+        "systemd-journald.socket"
+        "udp514-journal.socket"
+      ];
+      serviceConfig = {
+        Type = "notify";
+        Restart = "always";
+        ExecStart = "${cfg.package}/bin/udp514-journal";
+        DynamicUser = "on";
+        CapabilityBoundingSet = "";
+        AmbientCapabilities = "";
+        ProtectSystem = "strict";
+        ProtectHome = "on";
+        PrivateDevices = "on";
+        PrivateTmp = true;
+        PrivateUsers = "self";
+        PrivateNetwork = "on";
+        RestrictAddressFamilies = [ "AF_UNIX" ];
+        RestrictNamespaces = true;
+        RestrictSUIDSGID = true;
+        RestrictRealtime = true;
+        LockPersonality = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        ProtectClock = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = "on";
+        ProtectControlGroups = "strict";
+        ProtectProc = "noaccess";
+        ProcSubset = "pid";
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        MemoryMax = "5M";
+        UMask = "0077";
+      };
+      confinement = {
+        enable = true;
+        binSh = null;
+      };
+    };
+
+    networking.firewall.allowedUDPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ usovalx ];
+}

nixos/modules/services/mail/pfix-srsd.nix

@@ -1,81 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.services.pfix-srsd;
-in
-{
-
-  ###### interface
-
-  options = {
-
-    services.pfix-srsd = {
-      enable = lib.mkOption {
-        default = false;
-        type = lib.types.bool;
-        description = "Whether to run the postfix sender rewriting scheme daemon.";
-      };
-
-      domain = lib.mkOption {
-        description = "The domain for which to enable srs";
-        type = lib.types.str;
-        example = "example.com";
-      };
-
-      secretsFile = lib.mkOption {
-        description = ''
-          The secret data used to encode the SRS address.
-          to generate, use a command like:
-          `for n in $(seq 5); do dd if=/dev/urandom count=1 bs=1024 status=none | sha256sum | sed 's/  -$//' | sed 's/^/          /'; done`
-        '';
-        type = lib.types.path;
-        default = "/var/lib/pfix-srsd/secrets";
-      };
-
-      configurePostfix = lib.mkOption {
-        type = lib.types.bool;
-        default = true;
-        description = ''
-          Whether to configure the required settings to use pfix-srsd in the local Postfix instance.
-        '';
-      };
-    };
-  };
-
-  ###### implementation
-
-  config = lib.mkMerge [
-    (lib.mkIf (cfg.enable && cfg.configurePostfix && config.services.postfix.enable) {
-      services.postfix.settings.main = {
-        sender_canonical_maps = [ "tcp:127.0.0.1:10001" ];
-        sender_canonical_classes = [ "envelope_sender" ];
-        recipient_canonical_maps = [ "tcp:127.0.0.1:10002" ];
-        recipient_canonical_classes = [ "envelope_recipient" ];
-      };
-    })
-
-    (lib.mkIf cfg.enable {
-      environment = {
-        systemPackages = [ pkgs.pfixtools ];
-      };
-
-      systemd.services.pfix-srsd = {
-        description = "Postfix sender rewriting scheme daemon";
-        before = [ "postfix.service" ];
-        #note that we use requires rather than wants because postfix
-        #is unable to process (almost) all mail without srsd
-        requiredBy = [ "postfix.service" ];
-        serviceConfig = {
-          Type = "forking";
-          PIDFile = "/run/pfix-srsd.pid";
-          ExecStart = "${pkgs.pfixtools}/bin/pfix-srsd -p /run/pfix-srsd.pid -I ${config.services.pfix-srsd.domain} ${config.services.pfix-srsd.secretsFile}";
-        };
-      };
-    })
-  ];
-}

nixos/modules/services/mail/postfix.nix

@@ -1296,6 +1296,5 @@ in
       [ "services" "postfix" "settings" "main" "smtp_tls_security_level" ]
       (config: lib.mkIf config.services.postfix.useDane "dane")
     )
-    (lib.mkRenamedOptionModule [ "services" "postfix" "useSrs" ] [ "services" "pfix-srsd" "enable" ])
   ];
 }

nixos/modules/services/misc/atuin.nix

@@ -74,7 +74,7 @@ in
         default = null;
         description = ''
           Environment file, used to set any secret ATUIN_* environment variables, such as ATUIN_DB_URI containing a password.
-          See https://docs.atuin.sh/cli/self-hosting/server-setup/#configuration for available environment variables.
+          See <https://docs.atuin.sh/latest/self-hosting/server-setup/#configuration> for available environment variables.
         '';
       };
     };

nixos/modules/services/monitoring/beszel-hub.nix

@@ -71,7 +71,7 @@ in
       serviceConfig = {
         ExecStartPre = [
           "${cfg.package}/bin/beszel-hub migrate up"
-          "${cfg.package}/bin/beszel-hub history-sync"
+          "${cfg.package}/bin/beszel-hub migrate history-sync"
         ];
         ExecStart = ''
           ${cfg.package}/bin/beszel-hub serve --http='${cfg.host}:${toString cfg.port}'

nixos/modules/services/monitoring/grafana.nix

@@ -2090,7 +2090,6 @@ in
       serviceConfig = {
         ExecStartPre = [
           "${lib.getExe' pkgs.coreutils "ln"} -fs ${cfg.package}/share/grafana/conf ${cfg.dataDir}"
-          "${lib.getExe' pkgs.coreutils "ln"} -fs ${cfg.package}/share/grafana/tools ${cfg.dataDir}"
         ];
         ExecStart = "${lib.getExe cfg.package} server -homepath ${cfg.dataDir} -config ${configFile}";
 

nixos/modules/services/networking/crab-hole.nix

@@ -35,6 +35,12 @@ in
 
       package = lib.mkPackageOption pkgs "crab-hole" { };
 
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Open ports in the firewall for crab-hole's DNS server.";
+      };
+
       supplementaryGroups = lib.mkOption {
         type = lib.types.listOf lib.types.str;
         default = [ ];
@@ -170,6 +176,11 @@ in
         RestartSec = 1;
       };
     };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedUDPPorts = [ 53 ];
+      allowedTCPPorts = [ 53 ];
+    };
   };
 
   meta.maintainers = [

nixos/modules/services/networking/moonshine.nix

@@ -0,0 +1,188 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.moonshine;
+  tomlFormat = pkgs.formats.toml { };
+  configFile = tomlFormat.generate "moonshine-config.toml" cfg.settings;
+
+  runScript = pkgs.writeShellScriptBin "moonshine-server" ''
+    export XDG_RUNTIME_DIR="''${XDG_RUNTIME_DIR:-/run/user/$(${lib.getExe' pkgs.coreutils "id"} -u)}"
+    export DBUS_SESSION_BUS_ADDRESS="''${DBUS_SESSION_BUS_ADDRESS:-unix:path=$XDG_RUNTIME_DIR/bus}"
+    exec ${lib.getExe cfg.package} ${configFile} "$@"
+  '';
+in
+{
+  options.services.moonshine = {
+    enable = lib.mkEnableOption "Moonshine, a headless game streaming server for Moonlight clients";
+
+    package = lib.mkPackageOption pkgs "moonshine" { };
+
+    user = lib.mkOption {
+      type = lib.types.nonEmptyStr;
+      example = "alice";
+      description = ''
+        User under which to run Moonshine. The user must be declared separately
+        in {option}`users.users`. Lingering is enabled automatically so the
+        server can run without an active login session.
+      '';
+    };
+
+    settings = lib.mkOption {
+      type = tomlFormat.type;
+      default = { };
+      example = lib.literalExpression ''
+        {
+          name = "my-desktop";
+          address = "0.0.0.0";
+          application = [
+            {
+              title = "Steam";
+              command = [ "steam" "steam://open/bigpicture" ];
+            }
+          ];
+          application_scanner = [
+            {
+              type = "steam";
+              library = "$HOME/.local/share/Steam";
+              command = [ "steam" "-bigpicture" "steam://rungameid/{game_id}" ];
+            }
+          ];
+        }
+      '';
+      description = ''
+        Moonshine configuration, generated as a TOML file in the Nix store.
+        See <https://github.com/hgaiser/moonshine/blob/main/moonshine-core/src/config.rs>
+        for the available settings and <https://github.com/hgaiser/moonshine#configuration> for some examples.
+
+        Do not leave this option empty: Moonshine's upstream defaults configure
+        Steam at {file}`/usr/bin/steam`, which does not exist on NixOS. Define
+        at least `application` with an executable in the Nix store, as shown in
+        the example. Setting `application` explicitly is sufficient;
+        `application_scanners` may be omitted.
+
+        Moonshine stores {file}`cert.pem` and {file}`key.pem` in
+        {file}`~/.config/moonshine/`, and paired-client state in
+        {file}`~/.local/share/moonshine/state.toml` for the configured user.
+
+        Since the service runs without a desktop session, its notification
+        action cannot reliably open the pairing page. Pair clients by visiting
+        {file}`http://<host>:47989/pin` in a browser instead.
+      '';
+    };
+
+    extraPackages = lib.mkOption {
+      type = lib.types.listOf lib.types.package;
+      default = [ ];
+      example = lib.literalExpression "[ pkgs.steam ]";
+      description = ''
+        Packages added to the service's {env}`PATH` for applications launched
+        by Moonshine.
+      '';
+    };
+
+    environment = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = { };
+      example = {
+        MESA_VK_DEVICE_SELECT = "10de:25a2!";
+      };
+      description = ''
+        Environment variables set for Moonshine.
+
+        ::: {.note}
+        Those are not inherited by launched applications.
+        :::
+      '';
+    };
+
+    firewallInterfaces = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [
+        "tailscale0"
+        "wg0"
+      ];
+      description = ''
+        Network interfaces on which to open the Moonlight/GameStream ports.
+        The ports are not opened when this list is empty.
+        Moonshine is not designed for use on public networks. Do not expose Moonshine ports directly to the internet. See https://github.com/hgaiser/moonshine#security
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = lib.hasAttr cfg.user config.users.users;
+        message = "services.moonshine.user refers to undeclared user '${cfg.user}'.";
+      }
+    ];
+
+    boot.kernelModules = [
+      "uinput"
+      "uhid"
+    ];
+
+    environment.systemPackages = [ cfg.package ];
+
+    # Make the implicit WSI Vulkan layer available to launched applications.
+    hardware.graphics = {
+      enable = true;
+      extraPackages = [ cfg.package ];
+    };
+
+    networking.firewall.interfaces = lib.genAttrs cfg.firewallInterfaces (_: {
+      allowedTCPPorts = [
+        (cfg.settings.webserver.port_https or 47984)
+        (cfg.settings.webserver.port or 47989)
+        (cfg.settings.stream.port or 48010)
+      ];
+      allowedUDPPorts = [
+        5353 # moonshine has an embedded mDNS responder that does not conflict with avahi
+        (cfg.settings.stream.video.port or 47998)
+        (cfg.settings.stream.control.port or 47999)
+        (cfg.settings.stream.audio.port or 48000)
+      ];
+    });
+
+    services.udev.packages = [ cfg.package ];
+
+    systemd.services.moonshine = {
+      description = "Streaming server using the NVIDIA GameStream / Moonlight protocol.";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      path = [ pkgs.xwayland ] ++ cfg.extraPackages;
+      environment = {
+        MOONSHINE_LOG = "moonshine=info";
+      }
+      // cfg.environment;
+      serviceConfig = {
+        User = cfg.user;
+        SupplementaryGroups = [ "moonshine" ];
+        ExecStart = lib.getExe runScript;
+        Restart = "on-failure";
+        RestartSec = 5;
+        DeviceAllow = [
+          "/dev/uinput rw"
+          "/dev/uhid rw"
+          "char-drm rw"
+          "char-nvidia rw"
+          "char-nvidia-uvm rw"
+        ];
+      };
+    };
+
+    users = {
+      groups.moonshine = { };
+      users.${cfg.user} = {
+        linger = true;
+        extraGroups = [ "input" ];
+      };
+    };
+  };
+}

nixos/modules/services/security/crowdsec.nix

@@ -825,6 +825,7 @@ in
             RestrictSUIDSGID = true;
             ExecReload = [
               " " # This is needed to clear the ExecReload definitions from upstream
+              "${lib.getExe' pkgs.util-linux "kill"} -HUP $MAINPID"
             ];
             ExecStart = [
               " " # This is needed to clear the ExecStart definitions from upstream

nixos/modules/services/security/fail2ban.nix

@@ -400,12 +400,8 @@ in
         # Security
         NoNewPrivileges = true;
         # Directory
-        RuntimeDirectory = "fail2ban";
         RuntimeDirectoryMode = "0750";
-        StateDirectory = "fail2ban";
         StateDirectoryMode = "0750";
-        LogsDirectory = "fail2ban";
-        LogsDirectoryMode = "0750";
         # Sandboxing
         ProtectSystem = "strict";
         ProtectHome = true;
@@ -417,6 +413,10 @@ in
         ProtectControlGroups = true;
       };
     };
+    systemd.sockets.fail2ban.wantedBy = [
+      "sockets.target"
+      "fail2ban.service"
+    ];
 
     # Defaults for the daemon settings
     services.fail2ban.daemonSettings.Definition = {

nixos/modules/services/security/rosec.nix

@@ -0,0 +1,50 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.rosec;
+in
+{
+  options.services.rosec = {
+    enable = lib.mkEnableOption "rosec, a secrets daemon implementing the freedesktop.org Secret Service API";
+
+    package = lib.mkPackageOption pkgs "rosec" { };
+
+    pam = {
+      enable = lib.mkEnableOption "PAM integration to automatically unlock the rosec vault on login";
+
+      services = lib.mkOption {
+        type = with lib.types; listOf str;
+        default = [ "login" ];
+        example = [
+          "login"
+          "greetd"
+        ];
+        description = ''
+          List of PAM services for which to enable rosec automatic unlock.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    services.dbus.packages = [ cfg.package ];
+
+    systemd.packages = [ cfg.package ];
+
+    xdg.portal.extraPortals = [ cfg.package ];
+
+    security.pam.services = lib.mkIf cfg.pam.enable (
+      lib.genAttrs cfg.pam.services (_: {
+        rosec.enable = true;
+      })
+    );
+  };
+
+  meta.maintainers = with lib.maintainers; [ mikilio ];
+}

nixos/modules/services/security/tinyauth.nix

@@ -149,6 +149,11 @@ in
       default = "tinyauth";
       description = "Group account under which Tinyauth runs.";
     };
+
+    enableUnixSocket = mkEnableOption (
+      "a UNIX domain socket at `/run/tinyauth/tinyauth.sock`"
+      + " instead of listening on an IP address and port."
+    );
   };
 
   config = mkIf cfg.enable {
@@ -174,6 +179,7 @@ in
         GIN_MODE = "release";
         TINYAUTH_DATABASE_PATH = "${cfg.dataDir}/tinyauth.db";
         TINYAUTH_RESOURCES_PATH = "${cfg.dataDir}/resources";
+        TINYAUTH_SERVER_SOCKETPATH = mkIf cfg.enableUnixSocket "%t/tinyauth/tinyauth.sock";
       };
 
       serviceConfig = {
@@ -181,6 +187,8 @@ in
         User = cfg.user;
         Group = cfg.group;
         WorkingDirectory = cfg.dataDir;
+        RuntimeDirectory = mkIf cfg.enableUnixSocket "tinyauth";
+        RuntimeDirectoryMode = mkIf cfg.enableUnixSocket "750";
         ExecStart = getExe cfg.package;
         Restart = "always";
 
@@ -224,7 +232,7 @@ in
           "~@privileged"
           "~@resources"
         ];
-        UMask = "0077";
+        UMask = if cfg.enableUnixSocket then "0007" else "0077";
       };
     };
 

nixos/modules/services/system/userborn.nix

@@ -31,6 +31,15 @@ let
         ;
       isNormal = opts.isNormalUser;
       shell = utils.toShellPath opts.shell;
+      autoSubIdRange = opts.autoSubUidGidRange;
+      subUidRanges = map (r: {
+        start = r.startUid;
+        inherit (r) count;
+      }) opts.subUidRanges;
+      subGidRanges = map (r: {
+        start = r.startGid;
+        inherit (r) count;
+      }) opts.subGidRanges;
     }) (lib.filterAttrs (_: u: u.enable) config.users.users);
   };
 
@@ -47,12 +56,19 @@ let
   previousConfigPath = "/var/lib/userborn/previous-userborn.json";
 
   immutableEtc = config.system.etc.overlay.enable && !config.system.etc.overlay.mutable;
+  # The files live outside /etc and need to be linked or bind-mounted there.
+  filesOutsideEtc = !cfg.static && cfg.passwordFilesLocation != "/etc";
   # The filenames created by userborn.
   passwordFiles = [
     "group"
     "passwd"
     "shadow"
   ];
+  # newuidmap opens these with O_NOFOLLOW, no symlinks in /etc.
+  subIdFiles = [
+    "subuid"
+    "subgid"
+  ];
 
 in
 {
@@ -93,6 +109,9 @@ in
         write the files directly to `/etc`.
 
         However this can also serve other use cases, e.g. when `/etc` is on a `tmpfs`.
+
+        The subid files are an exception: `newuidmap` rejects symlinks, so
+        they are bind-mounted into `/etc` instead of being symlinked.
       '';
     };
 
@@ -228,13 +247,16 @@ in
 
             # Make the source files writable before executing userborn.
             (lib.mkIf (!userCfg.mutableUsers) (
-              lib.map (file: "-${pkgs.util-linux}/bin/umount ${cfg.passwordFilesLocation}/${file}") passwordFiles
+              lib.map (file: "-${pkgs.util-linux}/bin/umount ${cfg.passwordFilesLocation}/${file}") (
+                passwordFiles ++ subIdFiles
+              )
             ))
           ];
 
           ExecStartPost =
             if userCfg.mutableUsers then
-              # Store the config somewhere for the next invocation
+              # Store the config so the next run can tell declarative changes
+              # from manual edits (see USERBORN_PREVIOUS_CONFIG).
               [
                 "${pkgs.coreutils}/bin/ln -sf ${userbornConfigJson} ${previousConfigPath}"
               ]
@@ -243,9 +265,33 @@ in
               (lib.map (
                 file:
                 "${pkgs.util-linux}/bin/mount --bind -o ro ${cfg.passwordFilesLocation}/${file} ${cfg.passwordFilesLocation}/${file}"
-              ) passwordFiles);
+              ) (passwordFiles ++ subIdFiles));
         };
       };
+
+      # Bind-mount the subid files into /etc when they live elsewhere,
+      # newuidmap rejects symlinks.
+      mounts = lib.mkIf filesOutsideEtc (
+        map (file: {
+          what = "${cfg.passwordFilesLocation}/${file}";
+          where = "/etc/${file}";
+          type = "none";
+          options = "bind";
+          after = [ "userborn.service" ];
+          requires = [ "userborn.service" ];
+          wantedBy = [ "sysinit.target" ];
+          requiredBy = [ "sysinit-reactivation.target" ];
+          before = [
+            "sysinit.target"
+            "sysinit-reactivation.target"
+            "shutdown.target"
+          ];
+          conflicts = [ "shutdown.target" ];
+          # Re-mount after userborn's atomic rename replaces the inode.
+          restartTriggers = [ userbornConfigJson ];
+          unitConfig.DefaultDependencies = false;
+        }) subIdFiles
+      );
     };
 
     environment.etc = lib.mkMerge [
@@ -258,11 +304,11 @@ in
               source = "${userbornStaticFiles}/${file}";
               mode = if file == "shadow" then "0000" else "0644";
             }
-          ) passwordFiles
+          ) (passwordFiles ++ subIdFiles)
         )
       ))
 
-      (lib.mkIf (!cfg.static && cfg.passwordFilesLocation != "/etc") (
+      (lib.mkIf filesOutsideEtc (
         # Statically create the symlinks to passwordFilesLocation when they're not
         # inside /etc because we will not be able to do it at runtime in case of a
         # (non-static) immutable /etc!
@@ -276,6 +322,19 @@ in
           ) passwordFiles
         )
       ))
+
+      (lib.mkIf filesOutsideEtc (
+        # Placeholder mount points for the subid bind mounts.
+        lib.listToAttrs (
+          lib.map (
+            file:
+            lib.nameValuePair file {
+              text = "";
+              mode = "0644";
+            }
+          ) subIdFiles
+        )
+      ))
     ];
   };
 

nixos/modules/services/ttys/kmscon.nix

@@ -160,6 +160,10 @@ in
     );
 
     environment.systemPackages = [ cfg.package ];
+
+    # Install at least one monospace font, as otherwise the fallback is DejaVu Sans, a non-monospace font
+    fonts.packages = [ pkgs.hack-font ];
+
     systemd.packages = [ cfg.package ];
 
     systemd.services."kmsconvt@" = {

nixos/modules/services/video/frigate.nix

@@ -787,6 +787,7 @@ in
 
         # Caches
         PrivateTmp = true;
+        TemporaryFileSystem = "/dev/shm:mode=1777,nosuid,nodev";
         CacheDirectory = [
           "frigate"
           # https://github.com/blakeblackshear/frigate/discussions/18129

nixos/modules/services/web-apps/ente.nix

@@ -342,10 +342,17 @@ in
               '';
             };
           };
+          virtualHosts.${domainFor "albums"} = {
+            forceSSL = mkDefault true;
+            locations."/" = {
+              root = webPackage "albums";
+              tryFiles = "$uri $uri.html /index.html";
+              extraConfig = ''
+                add_header Access-Control-Allow-Origin 'https://${cfgWeb.domains.api}';
+              '';
+            };
+          };
           virtualHosts.${domainFor "photos"} = {
-            serverAliases = [
-              (domainFor "albums") # the albums app is shared with the photos frontend
-            ];
             forceSSL = mkDefault true;
             locations."/" = {
               root = webPackage "photos";

nixos/modules/services/web-apps/immich.nix

@@ -137,7 +137,15 @@ in
     host = mkOption {
       type = types.str;
       default = "localhost";
-      description = "The host that immich will listen on.";
+      example = ""; # all interfaces
+      # hint: the use of "" for IMMICH_HOST is not documented
+      # see https://docs.immich.app/install/environment-variables/#ports
+      # or https://github.com/immich-app/immich/blob/767caf9bfec2ec74ebdef6f58643ee9505da8550/docs/docs/install/environment-variables.md?plain=1#L70
+      # impl: https://github.com/immich-app/immich/blob/60f4dedb2991c8356d2977f1dc9cfa2cf666788c/server/src/app.common.ts#L90
+      description = ''
+        The host that immich will listen on.
+        Set to an empty string (`""`) to listen on all interfaces.
+      '';
     };
     port = mkOption {
       type = types.port;

nixos/modules/services/web-apps/mediawiki.nix

@@ -109,12 +109,12 @@ let
       '';
 
   dbAddr =
-    if cfg.database.socket == null then
+    if cfg.database.type == "postgres" then
+      (if cfg.database.socket == null then cfg.database.host else cfg.database.socket)
+    else if cfg.database.socket == null then
       "${cfg.database.host}:${toString cfg.database.port}"
     else if cfg.database.type == "mysql" then
       "${cfg.database.host}:${cfg.database.socket}"
-    else if cfg.database.type == "postgres" then
-      "${cfg.database.socket}"
     else
       throw "Unsupported database type: ${cfg.database.type} for socket: ${cfg.database.socket}";
 

nixos/modules/services/web-apps/rustical.nix

@@ -145,7 +145,7 @@ in
 
       serviceConfig = {
         DynamicUser = true;
-        ExecStart = lib.getExe cfg.package;
+        ExecStart = "${lib.getExe cfg.package} serve";
         EnvironmentFile = cfg.environmentFiles;
         Restart = "on-failure";
         StateDirectory = "rustical";

nixos/modules/services/web-servers/nginx/default.nix

@@ -398,6 +398,11 @@ let
 
         hostListen = if vhost.forceSSL then filter (x: x.ssl) defaultListen else defaultListen;
 
+        # If there's any location setting `useGrpcErrorPages`, we need to add the location blocks.
+        locationsWantGrpcErrorPages = builtins.any (location: location.useGrpcErrorPages) (
+          attrValues vhost.locations
+        );
+
         listenString =
           {
             addr,
@@ -515,6 +520,10 @@ let
 
           ${mkBasicAuth vhostName vhost}
 
+          ${optionalString locationsWantGrpcErrorPages ''
+            include ${./grpc-locations.conf};
+          ''}
+
           ${optionalString (vhost.root != null) "root ${vhost.root};"}
 
           ${optionalString (vhost.globalRedirect != null) ''
@@ -559,6 +568,9 @@ let
               optionalAttrs (config.fastcgiParams != { }) (defaultFastcgiParams // config.fastcgiParams)
             )
           )}
+          ${optionalString config.useGrpcErrorPages ''
+            include ${./grpc-error-pages.conf};
+          ''}
           ${optionalString (config.index != null) "index ${config.index};"}
           ${optionalString (config.tryFiles != null) "try_files ${config.tryFiles};"}
           ${optionalString (config.root != null) "root ${config.root};"}

nixos/modules/services/web-servers/nginx/grpc-error-pages.conf

@@ -0,0 +1,22 @@
+error_page 400 = @grpc_internal;
+error_page 401 = @grpc_unauthenticated;
+error_page 403 = @grpc_permission_denied;
+error_page 404 = @grpc_unimplemented;
+error_page 429 = @grpc_unavailable;
+error_page 502 = @grpc_unavailable;
+error_page 503 = @grpc_unavailable;
+error_page 504 = @grpc_unavailable;
+# NGINX-to-gRPC status code mappings
+# Ref: https://github.com/grpc/grpc/blob/master/doc/statuscodes.md
+#
+error_page 405 = @grpc_internal; # Method not allowed
+error_page 408 = @grpc_deadline_exceeded; # Request timeout
+error_page 413 = @grpc_resource_exhausted; # Payload too large
+error_page 414 = @grpc_resource_exhausted; # Request URI too large
+error_page 415 = @grpc_internal; # Unsupported media type;
+error_page 426 = @grpc_internal; # HTTP request was sent to HTTPS port
+error_page 495 = @grpc_unauthenticated; # Client certificate authentication error
+error_page 496 = @grpc_unauthenticated; # Client certificate not presented
+error_page 497 = @grpc_internal; # HTTP request was sent to mutual TLS port
+error_page 500 = @grpc_internal; # Server error
+error_page 501 = @grpc_internal; # Not implemented

nixos/modules/services/web-servers/nginx/grpc-locations.conf

@@ -0,0 +1,46 @@
+# gRPC error responses
+# Ref: https://github.com/grpc/grpc-go/blob/master/codes/codes.go
+# Ref: https://grpc.io/docs/guides/wire
+#
+location @grpc_deadline_exceeded {
+  add_header grpc-status 4;
+  add_header grpc-message 'deadline exceeded';
+  default_type application/grpc;
+  return 200;
+}
+location @grpc_permission_denied {
+  add_header grpc-status 7;
+  add_header grpc-message 'permission denied';
+  default_type application/grpc;
+  return 200;
+}
+location @grpc_resource_exhausted {
+  add_header grpc-status 8;
+  add_header grpc-message 'resource exhausted';
+  default_type application/grpc;
+  return 200;
+}
+location @grpc_unimplemented {
+  add_header grpc-status 12;
+  add_header grpc-message unimplemented;
+  default_type application/grpc;
+  return 200;
+}
+location @grpc_internal {
+  add_header grpc-status 13;
+  add_header grpc-message 'internal error';
+  default_type application/grpc;
+  return 200;
+}
+location @grpc_unavailable {
+  add_header grpc-status 14;
+  add_header grpc-message unavailable;
+  default_type application/grpc;
+  return 200;
+}
+location @grpc_unauthenticated {
+  add_header grpc-status 16;
+  add_header grpc-message unauthenticated;
+  default_type application/grpc;
+  return 200;
+}

nixos/modules/services/web-servers/nginx/location-options.nix

@@ -158,5 +158,17 @@ with lib;
         Enable recommended uwsgi settings.
       '';
     };
+
+    useGrpcErrorPages = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to configure error codes to be emitted as gRPC-compatible errors.
+
+        Should be set when proxying gRPC, and returning responses from nginx (like when adding authentication).
+
+        This defines a few `@grpc-*` locations inside the containing vhost.
+      '';
+    };
   };
 }

nixos/modules/services/web-servers/varnish/default.nix

@@ -200,6 +200,7 @@ in
         AmbientCapabilities = "cap_net_bind_service";
         NoNewPrivileges = true;
         LimitNOFILE = 131072;
+        LimitMEMLOCK = "infinity";
       };
     };
 

nixos/modules/system/boot/systemd/nspawn.nix

@@ -55,10 +55,14 @@ let
       "LinkJournal"
       "Ephemeral"
       "AmbientCapability"
+      "SuppressSync"
+      "PrivateUsersDelegate"
+      "RestrictAddressFamilies"
     ])
     (assertValueOneOf "Boot" boolValues)
     (assertValueOneOf "ProcessTwo" boolValues)
     (assertValueOneOf "NotifyReady" boolValues)
+    (assertValueOneOf "SuppressSync" boolValues)
   ];
 
   checkFiles = checkUnitConfig "Files" [
@@ -74,6 +78,7 @@ let
       "BindUser"
       "Inaccessible"
       "PrivateUsersOwnership"
+      "BindUserShell"
     ])
     (assertValueOneOf "ReadOnly" boolValues)
     (assertValueOneOf "Volatile" (boolValues ++ [ "state" ]))
@@ -97,6 +102,7 @@ let
       "Bridge"
       "Zone"
       "Port"
+      "NamespacePath"
     ])
     (assertValueOneOf "Private" boolValues)
     (assertValueOneOf "VirtualEthernet" boolValues)

nixos/modules/system/boot/systemd/tmpfiles.nix

@@ -322,7 +322,7 @@ in
         ln -s "${systemd}/example/tmpfiles.d/credstore.conf"
         ln -s "${systemd}/example/tmpfiles.d/home.conf"
         ln -s "${systemd}/example/tmpfiles.d/journal-nocow.conf"
-        ln -s "${systemd}/example/tmpfiles.d/portables.conf"
+        ${optionalString systemd.withPortabled ''ln -s "${systemd}/example/tmpfiles.d/portables.conf"''}
         ln -s "${systemd}/example/tmpfiles.d/static-nodes-permissions.conf"
         ln -s "${systemd}/example/tmpfiles.d/systemd.conf"
         ln -s "${systemd}/example/tmpfiles.d/systemd-nologin.conf"

nixos/modules/virtualisation/containers.nix

@@ -78,7 +78,7 @@ in
         description = ''
           List of repositories to search.
 
-          Deprecated, examine {option}`virtualisation.registries.settings` instead.
+          Deprecated, examine {option}`virtualisation.containers.registries.settings` instead.
         '';
       };
 
@@ -89,7 +89,7 @@ in
         description = ''
           List of insecure repositories.
 
-          Deprecated, examine {option}`virtualisation.registries.settings` instead.
+          Deprecated, examine {option}`virtualisation.containers.registries.settings` instead.
         '';
       };
 
@@ -100,7 +100,7 @@ in
         description = ''
           List of blocked repositories.
 
-          Deprecated, examine {option}`virtualisation.registries.settings` instead.
+          Deprecated, examine {option}`virtualisation.containers.registries.settings` instead.
         '';
       };
 
@@ -145,7 +145,7 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    warnings = lib.optional oldRegistriesOptionsUsed "the options virtualisation.registries.search / insecure / block are deprecated. See virtualisation.registries.settings instead.";
+    warnings = lib.optional oldRegistriesOptionsUsed "the options virtualisation.containers.registries.search / insecure / block are deprecated. See virtualisation.containers.registries.settings instead.";
 
     virtualisation.containers.registries.settings = lib.mkIf oldRegistriesOptionsUsed {
       registries = {

nixos/modules/virtualisation/nixos-containers.nix

@@ -526,7 +526,7 @@ let
 
   # Parses an IP address with an optional prefix
   ipFromString =
-    str:
+    str: defaultPrefix:
     let
       segments = lib.splitString "/" str;
       prefix = lib.elemAt segments 1;
@@ -534,7 +534,7 @@ let
     in
     {
       address = lib.head segments;
-      prefixLength = if hasPrefix then builtins.fromJSON prefix else 32;
+      prefixLength = if hasPrefix then builtins.fromJSON prefix else defaultPrefix;
     };
 
 in
@@ -610,10 +610,10 @@ in
                                 networking.interfaces = lib.mkIf config.privateNetwork (
                                   lib.mkMerge [
                                     (lib.mkIf (config.localAddress != null) {
-                                      eth0.ipv4.addresses = [ (ipFromString config.localAddress) ];
+                                      eth0.ipv4.addresses = [ (ipFromString config.localAddress 32) ];
                                     })
                                     (lib.mkIf (config.localAddress6 != null) {
-                                      eth0.ipv6.addresses = [ (ipFromString config.localAddress6) ];
+                                      eth0.ipv6.addresses = [ (ipFromString config.localAddress6 128) ];
                                     })
                                   ]
                                 );

nixos/tests/all-tests.nix

@@ -20,16 +20,20 @@ let
     isFunction
     mapAttrs
     elem
+    meta
     recurseIntoAttrs
     ;
 
+  callSupportedTest =
+    test: if meta.availableOn pkgs.stdenv.hostPlatform test then callTest test else { };
+
   # TODO: remove when handleTest is gone (make sure nixosTests and nixos/release.nix#tests are unaffected)
   # TODO: when removing, also deprecate `test` attribute in ../lib/testing/run.nix
   discoverTests =
     val:
     if isAttrs val then
       if (val ? test) then
-        callTest val
+        callSupportedTest val
       else
         mapAttrs (n: s: if n == "passthru" then s else discoverTests s) val
     else if isFunction val then
@@ -120,7 +124,7 @@ let
         if tree ? recurseForDerivations && tree.recurseForDerivations then
           mapAttrs (k: findTests) (removeAttrs tree [ "recurseForDerivations" ])
         else
-          callTest tree;
+          callSupportedTest tree;
 
       runTest =
         arg:
@@ -690,7 +694,10 @@ in
   ghostunnel = runTest ./ghostunnel.nix;
   ghostunnel-modular = runTest ./ghostunnel-modular.nix;
   gitdaemon = runTest ./gitdaemon.nix;
-  gitea = handleTest ./gitea.nix { giteaPackage = pkgs.gitea; };
+  gitea = import ./gitea.nix {
+    inherit pkgs runTest;
+    inherit (pkgs) lib;
+  };
   github-runner = runTest ./github-runner.nix;
   gitlab = import ./gitlab {
     inherit runTest;
@@ -806,7 +813,10 @@ in
   homer = handleTest ./homer { };
   honk = runTest ./honk.nix;
   hoogle = runTest ./hoogle.nix;
-  hostname = handleTest ./hostname.nix { };
+  hostname = import ./hostname.nix {
+    inherit pkgs runTest;
+    inherit (pkgs) lib;
+  };
   hound = runTest ./hound.nix;
   hub = runTest ./git/hub.nix;
   hydra = runTest ./hydra;
@@ -1168,6 +1178,7 @@ in
   nginx-etag = runTest ./nginx-etag.nix;
   nginx-etag-compression = runTest ./nginx-etag-compression.nix;
   nginx-globalredirect = runTest ./nginx-globalredirect.nix;
+  nginx-grpc-error-pages = runTest ./nginx-grpc-error-pages.nix;
   nginx-http3 = import ./nginx-http3.nix { inherit pkgs runTest; };
   nginx-lua = runTest ./nginx-lua.nix;
   nginx-mime = runTest ./nginx-mime.nix;
@@ -1524,6 +1535,7 @@ in
   rnsd = runTest ./networking/rnsd.nix;
   robustirc-bridge = runTest ./robustirc-bridge.nix;
   romm = runTest ./romm.nix;
+  rosec = runTest ./rosec.nix;
   rosenpass = runTest ./rosenpass.nix;
   roundcube = runTest ./roundcube.nix;
   routinator = handleTest ./routinator.nix { };
@@ -1824,6 +1836,7 @@ in
   ucarp = runTest ./ucarp.nix;
   udisks2 = runTest ./udisks2.nix;
   udp-over-tcp = runTest ./udp-over-tcp.nix;
+  udp514-journal = runTest ./udp514-journal.nix;
   ulogd = runTest ./ulogd/ulogd.nix;
   umami = runTest ./web-apps/umami.nix;
   umurmur = runTest ./umurmur.nix;
@@ -1849,6 +1862,9 @@ in
   userborn-mutable-etc = runTest ./userborn-mutable-etc.nix;
   userborn-mutable-users = runTest ./userborn-mutable-users.nix;
   userborn-static = runTest ./userborn-static.nix;
+  userborn-subids = runTest ./userborn-subids.nix;
+  userborn-subids-immutable-etc = runTest ./userborn-subids-immutable-etc.nix;
+  userborn-subids-mutable-etc = runTest ./userborn-subids-mutable-etc.nix;
   ustreamer = runTest ./ustreamer.nix;
   utils = pkgs.callPackage ./utils { inherit runTest; };
   utmp = runTest ./utmp.nix;

nixos/tests/curl-impersonate.nix

@@ -9,7 +9,7 @@
     2. Spins up an nghttpd2 server to test client HTTP/2 headers against
        known-good headers
 
-    See https://github.com/lwthiker/curl-impersonate/tree/main/tests/signatures
+    See https://github.com/lexiforest/curl-impersonate/tree/main/tests/signatures
     for details.
 
   Notes:
@@ -22,18 +22,20 @@
     - We started skipping the test_http2_headers test due to log format differences
       between the nghttpd2 version in nixpkgs and the outdated one curl-impersonate
       uses upstream for its tests.
+    - test_http3_fingerprint is skipped because it requires connecting to
+      third-party endpoint (fp.impersonate.pro) which isn't reachable from the test VM
 */
-
-{ pkgs, lib, ... }:
+{ config, lib, ... }:
 let
+  pkgs = config.node.pkgs;
+
   # Update with domains in TestImpersonate.TEST_URLS if needed from:
-  # https://github.com/lwthiker/curl-impersonate/blob/main/tests/test_impersonate.py
+  # https://github.com/lexiforest/curl-impersonate/blob/main/tests/test_impersonate.py
   domains = [
     "www.wikimedia.org"
     "www.wikipedia.org"
     "www.mozilla.org"
     "www.apache.org"
-    "www.kernel.org"
     "git-scm.com"
   ];
 
@@ -92,7 +94,12 @@ let
           }
           ''
             mkdir -p $out/bin
-            $CC -Wall -Werror -o $out/bin/minicurl ${pkgs.curl-impersonate.src}/tests/minicurl.c `curl-config --libs`
+            sed -e 's/opts->local_port_end - opts->local_port_start);/(long)(opts->local_port_end - opts->local_port_start));/' \
+                -e 's/^\( *\)opts->local_port_start);/\1(long)opts->local_port_start);/' \
+                -e 's/CURLOPT_SSL_VERIFYPEER, 0)/CURLOPT_SSL_VERIFYPEER, 0L)/' \
+                -e 's/CURLOPT_SSL_VERIFYHOST, 0)/CURLOPT_SSL_VERIFYHOST, 0L)/' \
+                ${pkgs.curl-impersonate.src}/tests/minicurl.c > minicurl.c
+            $CC -Wall -Werror -o $out/bin/minicurl minicurl.c `curl-config --libs`
           '';
     in
     pkgs.writeShellScript "curl-impersonate-test" ''
@@ -127,50 +134,42 @@ let
 
       # Run tests
       cd tests
-      pytest . --install-dir ../usr --capture-interface eth1 --exitfirst -k 'not test_http2_headers'
+      pytest . --install-dir ../usr --capture-interface eth1 --exitfirst -k 'not test_http2_headers and not test_http3_fingerprint'
     '';
 in
 {
   name = "curl-impersonate";
 
   meta = {
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      ui-1
+    ];
   };
 
   nodes = {
-    web =
-      {
-        nodes,
-        pkgs,
-        lib,
-        config,
-        ...
-      }:
-      {
-        networking.firewall.allowedTCPPorts = [
-          80
-          443
-        ];
+    web = { ... }: {
+      networking.firewall.allowedTCPPorts = [
+        80
+        443
+      ];
 
-        services = {
-          nginx = {
-            enable = true;
-            virtualHosts."curl-impersonate.nixos.test" = {
-              default = true;
-              addSSL = true;
-              sslCertificate = "${tls-certs}/cert.pem";
-              sslCertificateKey = "${tls-certs}/key.pem";
-            };
+      services = {
+        nginx = {
+          enable = true;
+          virtualHosts."curl-impersonate.nixos.test" = {
+            default = true;
+            addSSL = true;
+            sslCertificate = "${tls-certs}/cert.pem";
+            sslCertificateKey = "${tls-certs}/key.pem";
           };
         };
       };
+    };
 
     curl =
       {
         nodes,
-        pkgs,
         lib,
-        config,
         ...
       }:
       {
@@ -182,22 +181,20 @@ in
       };
   };
 
-  testScript =
-    { nodes, ... }:
-    ''
-      start_all()
+  testScript = { ... }: ''
+    start_all()
 
-      with subtest("Wait for network"):
-          web.systemctl("start network-online.target")
-          curl.systemctl("start network-online.target")
-          web.wait_for_unit("network-online.target")
-          curl.wait_for_unit("network-online.target")
+    with subtest("Wait for network"):
+        web.systemctl("start network-online.target")
+        curl.systemctl("start network-online.target")
+        web.wait_for_unit("network-online.target")
+        curl.wait_for_unit("network-online.target")
 
-      with subtest("Wait for web server"):
-          web.wait_for_unit("nginx.service")
-          web.wait_for_open_port(443)
+    with subtest("Wait for web server"):
+        web.wait_for_unit("nginx.service")
+        web.wait_for_open_port(443)
 
-      with subtest("Run curl-impersonate tests"):
-          curl.succeed("${curl-impersonate-test}")
-    '';
+    with subtest("Run curl-impersonate tests"):
+        curl.succeed("${curl-impersonate-test}")
+  '';
 }

nixos/tests/fail2ban.nix

@@ -2,7 +2,7 @@
 {
   name = "fail2ban";
 
-  nodes.machine = _: {
+  nodes.machine = { ... }: {
     services.fail2ban = {
       enable = true;
       bantime-increment.enable = true;
@@ -11,7 +11,7 @@
     networking.nftables.enable = true;
   };
 
-  nodes.client = _: {
+  nodes.client = { pkgs, ... }: {
     environment.systemPackages = [
       pkgs.sshpass
       pkgs.netcat
@@ -31,16 +31,41 @@
     client_addr = "2001:db8:1::1"
     machine_addr = "2001:db8:1::2"
 
+    # Verify that querying the version works
+    clientVersion = machine.succeed("fail2ban-client -V").rstrip()
+    t.assertEqual(clientVersion, "${pkgs.fail2ban.version}")
+    serverVersion = machine.succeed("fail2ban-server -V").rstrip()
+    t.assertEqual(serverVersion, "${pkgs.fail2ban.version}")
+
+    # Verify that fail2ban-client can communicate with the server
+    machine.succeed("fail2ban-client ping")
+
     # Verify there is not ban and the port is reachable from the client.
     machine.succeed(f"test 0 -eq $(fail2ban-client get sshd banned {client_addr})")
     client.succeed(f"nc -w3 -z {machine_addr} 22")
 
-    # Cause authentication failure log entries.
-    for _ in range(2):
-      client.fail(f"sshpass -p 'wrongpassword' ssh -o StrictHostKeyChecking=no {machine_addr}")
+    # Cause authentication failure log entries (detach second command since ban may cause timeout).
+    client.fail(f"sshpass -p 'wrongpassword' ssh -o StrictHostKeyChecking=no {machine_addr}")
+    client.execute(f"sshpass -p 'wrongpassword' ssh -o StrictHostKeyChecking=no {machine_addr} >&2 &")
 
     # Verify there is a ban and the port is unreachable from the client.
     machine.wait_until_succeeds(f"test 1 -eq $(fail2ban-client get sshd banned {client_addr})")
     client.fail(f"nc -w3 -z {machine_addr} 22")
+
+    # Verify that unbanning works
+    machine.succeed(f"fail2ban-client unban {client_addr}")
+    client.succeed(f"nc -w3 -z {machine_addr} 22")
+
+    # Verify that fail2ban-regex works
+    regex = r"^matching log entry: <HOST>$"
+    line = "matching log entry: 1.2.3.4"
+    matches = machine.succeed(f"fail2ban-regex -o matches '{line}' '{regex}'")
+    t.assertIn(line, matches)
+
+    # Verify that socket activation works
+    machine.succeed("systemctl stop fail2ban.service")
+    machine.fail("systemctl --quiet is-active fail2ban.service")
+    machine.succeed("fail2ban-client ping")
+    machine.succeed("systemctl --quiet is-active fail2ban.service")
   '';
 }

nixos/tests/fcitx5/default.nix

@@ -37,7 +37,7 @@
         ];
         fcitx5.settings = {
           globalOptions = {
-            "Hotkey"."EnumerateSkipFirst" = "False";
+            "Hotkey"."EnumerateSkipFirst" = false;
             "Hotkey/TriggerKeys"."0" = "Control+space";
             "Hotkey/EnumerateForwardKeys"."0" = "Alt+Shift_L";
             "Hotkey/EnumerateBackwardKeys"."0" = "Alt+Shift_R";

nixos/tests/gitea.nix

@@ -1,12 +1,11 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  giteaPackage ? pkgs.gitea,
-  pkgs ? import ../.. { inherit system config; },
+  pkgs,
+  lib,
+  runTest,
+  ...
 }:
 
-with import ../lib/testing-python.nix { inherit system pkgs; };
-with pkgs.lib;
+with lib;
 
 let
   ## gpg --faked-system-time='20230301T010000!' --quick-generate-key snakeoil ed25519 sign
@@ -31,8 +30,8 @@ let
   ];
   makeGiteaTest =
     type:
-    nameValuePair type (makeTest {
-      name = "${giteaPackage.pname}-${type}";
+    nameValuePair type (runTest {
+      name = "${pkgs.gitea.pname}-${type}";
       meta.maintainers = with maintainers; [
         aanderse
         kolaente
@@ -46,7 +45,7 @@ let
             services.gitea = {
               enable = true;
               database = { inherit type; };
-              package = giteaPackage;
+              package = pkgs.gitea;
               metricsTokenFile = (pkgs.writeText "metrics_secret" "fakesecret").outPath;
               settings.service.DISABLE_REGISTRATION = true;
               settings."repository.signing".SIGNING_KEY = signingPrivateKeyId;
@@ -54,7 +53,7 @@ let
               settings.metrics.ENABLED = true;
             };
             environment.systemPackages = [
-              giteaPackage
+              pkgs.gitea
               pkgs.gnupg
               pkgs.jq
             ];

nixos/tests/hostname.nix

@@ -1,11 +1,10 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
+  pkgs,
+  runTest,
+  lib,
 }:
 
-with import ../lib/testing-python.nix { inherit system pkgs; };
-with pkgs.lib;
+with lib;
 
 let
   makeHostNameTest =
@@ -19,7 +18,7 @@ let
         in
         if (res.success && res.value != null) then res.value else "null";
     in
-    makeTest {
+    runTest {
       name = "hostname-${fqdn}";
       meta = with pkgs.lib.maintainers; {
         maintainers = [

nixos/tests/jool.nix

@@ -71,6 +71,7 @@ in
         ];
       };
 
+      boot.kernelPackages = pkgs.linuxPackages_latest;
       networking.jool.enable = true;
       networking.jool.siit.default.global.pool6 = "fd::/96";
     };
@@ -191,6 +192,7 @@ in
         ];
       };
 
+      boot.kernelPackages = pkgs.linuxPackages_latest;
       networking.jool.enable = true;
       networking.jool.nat64.default = {
         bib = [
@@ -206,17 +208,17 @@ in
           {
             protocol = "TCP";
             prefix = "203.0.113.1/32";
-            "port range" = "40001-65535";
+            "port range" = "20000-29999";
           }
           {
             protocol = "UDP";
             prefix = "203.0.113.1/32";
-            "port range" = "40001-65535";
+            "port range" = "20000-29999";
           }
           {
             protocol = "ICMP";
             prefix = "203.0.113.1/32";
-            "port range" = "40001-65535";
+            "port range" = "20000-29999";
           }
           # Ports for static BIB entries
           {

nixos/tests/matrix/mjolnir.nix

@@ -118,7 +118,7 @@ in
           (pkgs.writers.writePython3Bin "create_management_room_and_invite_mjolnir"
             {
               libraries = with pkgs.python3Packages; [
-                (matrix-nio.override { withOlm = true; })
+                (matrix-nio.override { withVodozemac = true; })
               ];
             }
             ''

nixos/tests/mediawiki.nix

@@ -4,16 +4,16 @@ let
   shared =
     { pkgs, ... }:
     {
-      services.mediawiki.enable = true;
-      services.mediawiki.httpd.virtualHost.hostName = "localhost";
-      services.mediawiki.httpd.virtualHost.adminAddr = "root@example.com";
-      services.mediawiki.passwordFile = pkgs.writeText "password" "correcthorsebatterystaple";
-      services.mediawiki.extensions = {
-        Matomo = pkgs.fetchzip {
-          url = "https://github.com/DaSchTour/matomo-mediawiki-extension/archive/v4.0.1.tar.gz";
-          sha256 = "0g5rd3zp0avwlmqagc59cg9bbkn3r7wx7p6yr80s644mj6dlvs1b";
+      services.mediawiki = {
+        enable = true;
+        httpd.virtualHost = {
+          hostName = "localhost";
+          adminAddr = "root@example.com";
+        };
+        passwordFile = pkgs.writeText "password" "correcthorsebatterystaple";
+        extensions = {
+          ParserFunctions = null;
         };
-        ParserFunctions = null;
       };
     };
 
@@ -21,7 +21,7 @@ let
     t:
     runTest {
       imports = [
-        { nodes.machine.imports = [ shared ]; }
+        { containers.machine.imports = [ shared ]; }
         t
       ];
     };
@@ -29,7 +29,7 @@ in
 {
   mysql = makeTest {
     name = "mediawiki-mysql";
-    nodes.machine = {
+    containers.machine = {
       services.mediawiki.database.type = "mysql";
     };
     testScript = ''
@@ -44,7 +44,7 @@ in
 
   postgresql = makeTest {
     name = "mediawiki-postgres";
-    nodes.machine = {
+    containers.machine = {
       services.mediawiki.database.type = "postgres";
     };
     testScript = ''
@@ -59,7 +59,7 @@ in
 
   sqlite = makeTest {
     name = "mediawiki-sqlite";
-    nodes.machine = {
+    containers.machine = {
       services.mediawiki.database.type = "sqlite";
     };
     testScript = ''
@@ -74,29 +74,29 @@ in
 
   nohttpd = makeTest {
     name = "mediawiki-nohttpd";
-    nodes.machine = {
+    containers.machine = {
       services.mediawiki.webserver = "none";
     };
     testScript =
-      { nodes, ... }:
+      { containers, ... }:
       ''
         start_all()
         machine.wait_for_unit("phpfpm-mediawiki.service")
         env = (
           "SCRIPT_NAME=/index.php",
-          "SCRIPT_FILENAME=${nodes.machine.services.mediawiki.finalPackage}/share/mediawiki/index.php",
+          "SCRIPT_FILENAME=${containers.machine.services.mediawiki.finalPackage}/share/mediawiki/index.php",
           "REMOTE_ADDR=127.0.0.1",
           'QUERY_STRING=title=Main_Page',
           "REQUEST_METHOD=GET",
         );
-        page = machine.succeed(f"{' '.join(env)} ${lib.getExe nodes.machine.nixpkgs.pkgs.fcgi} -bind -connect ${nodes.machine.services.phpfpm.pools.mediawiki.socket}")
+        page = machine.succeed(f"{' '.join(env)} ${lib.getExe containers.machine.nixpkgs.pkgs.fcgi} -bind -connect ${containers.machine.services.phpfpm.pools.mediawiki.socket}")
         assert "MediaWiki has been installed" in page, f"no 'MediaWiki has been installed' in:\n{page}"
       '';
   };
 
   nginx = makeTest {
     name = "mediawiki-nginx";
-    nodes.machine = {
+    containers.machine = {
       services.mediawiki.webserver = "nginx";
     };
     testScript = ''

nixos/tests/mysql/common.nix

@@ -10,5 +10,8 @@
     inherit (pkgs) percona-server_8_4;
   };
   mkTestName =
-    pkg: "mariadb_${builtins.replaceStrings [ "." ] [ "" ] (lib.versions.majorMinor pkg.version)}";
+    pkg:
+    "${builtins.replaceStrings [ "-" ] [ "_" ] pkg.pname}_${
+      builtins.replaceStrings [ "." ] [ "" ] (lib.versions.majorMinor pkg.version)
+    }";
 }

nixos/tests/mysql/mysql.nix

@@ -33,7 +33,7 @@ let
 
       nodes = {
         ${name} =
-          { pkgs, ... }:
+          { pkgs, config, ... }:
           {
 
             users = {
@@ -61,18 +61,18 @@ let
               # note that using pkgs.writeText here is generally not a good idea,
               # as it will store the password in world-readable /nix/store ;)
               initialScript = pkgs.writeText "mysql-init.sql" (
-                if (!useSocketAuth) then
-                  ''
-                    CREATE USER 'testuser3'@'localhost' IDENTIFIED BY 'secure';
-                    GRANT ALL PRIVILEGES ON testdb3.* TO 'testuser3'@'localhost';
-                  ''
-                else
+                if config.services.mysql.package.pname == "mariadb" then
                   ''
                     ALTER USER root@localhost IDENTIFIED WITH unix_socket;
                     DELETE FROM mysql.user WHERE password = ''' AND plugin = ''';
                     DELETE FROM mysql.user WHERE user = ''';
                     FLUSH PRIVILEGES;
                   ''
+                else
+                  # just some smoketest initial script sql statement
+                  ''
+                    SELECT * FROM mysql.user;
+                  ''
               );
 
               ensureDatabases = [
@@ -104,61 +104,66 @@ let
           };
       };
 
-      testScript = ''
-        start_all()
+      testScript =
+        { nodes, ... }:
+        let
+          mysqlClient = lib.getExe nodes.${name}.services.mysql.package.client;
+        in
+        ''
+          start_all()
 
-        machine = ${name}
-        machine.wait_for_unit("mysql")
-        machine.succeed(
-            "echo 'use testdb; create table tests (test_id INT, PRIMARY KEY (test_id));' | sudo -u testuser mysql -u testuser"
-        )
-        machine.succeed(
-            "echo 'use testdb; insert into tests values (42);' | sudo -u testuser mysql -u testuser"
-        )
-        # Ensure testuser2 is not able to insert into testdb as mysql testuser2
-        machine.fail(
-            "echo 'use testdb; insert into tests values (23);' | sudo -u testuser2 mysql -u testuser2"
-        )
-        # Ensure testuser2 is not able to authenticate as mysql testuser
-        machine.fail(
-            "echo 'use testdb; insert into tests values (23);' | sudo -u testuser2 mysql -u testuser"
-        )
-        machine.succeed(
-            "echo 'use testdb; select test_id from tests;' | sudo -u testuser mysql -u testuser -N | grep 42"
-        )
+          machine = ${name}
+          machine.wait_for_unit("mysql")
+          machine.succeed(
+              "echo 'use testdb; create table tests (test_id INT, PRIMARY KEY (test_id));' | sudo -u testuser ${mysqlClient} -u testuser"
+          )
+          machine.succeed(
+              "echo 'use testdb; insert into tests values (42);' | sudo -u testuser ${mysqlClient} -u testuser"
+          )
+          # Ensure testuser2 is not able to insert into testdb as mysql testuser2
+          machine.fail(
+              "echo 'use testdb; insert into tests values (23);' | sudo -u testuser2 ${mysqlClient} -u testuser2"
+          )
+          # Ensure testuser2 is not able to authenticate as mysql testuser
+          machine.fail(
+              "echo 'use testdb; insert into tests values (23);' | sudo -u testuser2 ${mysqlClient} -u testuser"
+          )
+          machine.succeed(
+              "echo 'use testdb; select test_id from tests;' | sudo -u testuser ${mysqlClient} -u testuser -N | grep 42"
+          )
 
-        ${lib.optionalString hasMroonga ''
-          # Check if Mroonga plugin works
-          machine.succeed(
-              "echo 'use testdb; create table mroongadb (test_id INT, PRIMARY KEY (test_id)) ENGINE = Mroonga;' | sudo -u testuser mysql -u testuser"
-          )
-          machine.succeed(
-              "echo 'use testdb; insert into mroongadb values (25);' | sudo -u testuser mysql -u testuser"
-          )
-          machine.succeed(
-              "echo 'use testdb; select test_id from mroongadb;' | sudo -u testuser mysql -u testuser -N | grep 25"
-          )
-          machine.succeed(
-              "echo 'use testdb; drop table mroongadb;' | sudo -u testuser mysql -u testuser"
-          )
-        ''}
+          ${lib.optionalString hasMroonga ''
+            # Check if Mroonga plugin works
+            machine.succeed(
+                "echo 'use testdb; create table mroongadb (test_id INT, PRIMARY KEY (test_id)) ENGINE = Mroonga;' | sudo -u testuser ${mysqlClient} -u testuser"
+            )
+            machine.succeed(
+                "echo 'use testdb; insert into mroongadb values (25);' | sudo -u testuser ${mysqlClient} -u testuser"
+            )
+            machine.succeed(
+                "echo 'use testdb; select test_id from mroongadb;' | sudo -u testuser ${mysqlClient} -u testuser -N | grep 25"
+            )
+            machine.succeed(
+                "echo 'use testdb; drop table mroongadb;' | sudo -u testuser ${mysqlClient} -u testuser"
+            )
+          ''}
 
-        ${lib.optionalString hasRocksDB ''
-          # Check if RocksDB plugin works
-          machine.succeed(
-              "echo 'use testdb; create table rocksdb (test_id INT, PRIMARY KEY (test_id)) ENGINE = RocksDB;' | sudo -u testuser mysql -u testuser"
-          )
-          machine.succeed(
-              "echo 'use testdb; insert into rocksdb values (28);' | sudo -u testuser mysql -u testuser"
-          )
-          machine.succeed(
-              "echo 'use testdb; select test_id from rocksdb;' | sudo -u testuser mysql -u testuser -N | grep 28"
-          )
-          machine.succeed(
-              "echo 'use testdb; drop table rocksdb;' | sudo -u testuser mysql -u testuser"
-          )
-        ''}
-      '';
+          ${lib.optionalString hasRocksDB ''
+            # Check if RocksDB plugin works
+            machine.succeed(
+                "echo 'use testdb; create table rocksdb (test_id INT, PRIMARY KEY (test_id)) ENGINE = RocksDB;' | sudo -u testuser ${mysqlClient} -u testuser"
+            )
+            machine.succeed(
+                "echo 'use testdb; insert into rocksdb values (28);' | sudo -u testuser ${mysqlClient} -u testuser"
+            )
+            machine.succeed(
+                "echo 'use testdb; select test_id from rocksdb;' | sudo -u testuser ${mysqlClient} -u testuser -N | grep 28"
+            )
+            machine.succeed(
+                "echo 'use testdb; drop table rocksdb;' | sudo -u testuser ${mysqlClient} -u testuser"
+            )
+          ''}
+        '';
     };
 in
 lib.mapAttrs (
@@ -180,7 +185,6 @@ lib.mapAttrs (
   _: package:
   makeMySQLTest {
     inherit package;
-    name = builtins.replaceStrings [ "-" ] [ "_" ] package.pname;
     hasMroonga = false;
     useSocketAuth = false;
   }

nixos/tests/nginx-grpc-error-pages.nix

@@ -0,0 +1,40 @@
+{ ... }:
+{
+  name = "nginx-grpc-error-pages";
+
+  containers = {
+    webserver =
+      { pkgs, ... }:
+      {
+        services.nginx = {
+          enable = true;
+
+          virtualHosts.test = {
+            locations = {
+              "=/".return = "200 blub";
+              "/grpc.reflection.v1.ServerReflection" = {
+                useGrpcErrorPages = true;
+                extraConfig = ''
+                  grpc_pass unix:/run/some-service.sock;
+                  # Let's pretend there was a more sophisticated check here
+                  return 401;
+                '';
+              };
+            };
+          };
+        };
+      };
+  };
+
+  testScript = ''
+    webserver.wait_for_unit("nginx")
+    webserver.wait_for_open_port(80)
+
+    # regular HTTP requests should behave normally
+    webserver.succeed("curl --fail http://localhost")
+    t.assertEqual(webserver.succeed("curl -s -o /dev/null -w '%{http_code}' http://localhost/404").strip(), "404")
+
+    # a gRPC 401 becomes HTTP code 2xx, with grpc-message and grpc-status headers set.
+    t.assertEqual(webserver.succeed("curl -s -o /dev/null --fail -w '%header{grpc-status}_%header{grpc-message}' http://localhost/grpc.reflection.v1.ServerReflection").strip(), "16_unauthenticated")
+  '';
+}

nixos/tests/printing.nix

@@ -103,7 +103,7 @@ in
         "${pkgs.groff.doc}/share/doc/*/examples/mom/penguin.pdf",
         "${pkgs.groff.doc}/share/doc/*/meref.ps",
         "${pkgs.cups.out}/share/doc/cups/images/cups.png",
-        "${pkgs.pcre.doc}/share/doc/pcre/pcre.txt",
+        "${pkgs.groff.doc}/share/doc/*/examples/mom/README.txt",
     ]:
         file_name = os.path.basename(file)
         with subtest(f"print {file_name}"):

nixos/tests/rosec.nix

@@ -0,0 +1,101 @@
+{ pkgs, lib, ... }:
+let
+  rosec-config = pkgs.writeText "rosec-config.toml" ''
+    [[provider]]
+    id = "local"
+    kind = "local"
+    path = "/home/alice/.local/share/rosec/providers/local.vault"
+  '';
+in
+{
+  name = "rosec";
+  meta.maintainers = [ lib.maintainers.mikilio ];
+  # NOTE: PAM auto-unlock subtest requires interactive TTY login, which is
+  # architecture-dependent on QEMU (serial device and GPU differ between x86
+  # and aarch64). No existing test in nixpkgs handles this cross-platform.
+  # The D-Bus activation and PAM config subtests are platform-agnostic.
+  meta.broken = pkgs.stdenv.hostPlatform.isAarch64;
+
+  nodes.machine =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+    in
+    {
+      imports = [ ./common/user-account.nix ];
+
+      services.rosec = {
+        enable = true;
+        pam.enable = true;
+      };
+
+      environment.systemPackages = [ pkgs.libsecret ];
+
+      environment.etc."rosec/test-askpass" = {
+        text = ''
+          #!/bin/sh
+          echo "${user.password}"
+        '';
+        mode = "0755";
+      };
+
+      environment.variables = {
+        SSH_ASKPASS = lib.mkForce "/etc/rosec/test-askpass";
+        SSH_ASKPASS_REQUIRE = lib.mkForce "force";
+        DBUS_SESSION_BUS_ADDRESS = "unix:path=/run/user/${toString user.uid}/bus";
+      };
+    };
+
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.users.users.alice;
+      config-path = "${rosec-config}";
+    in
+    ''
+      machine.wait_until_tty_matches("1", "login: ")
+      machine.send_chars("alice\n")
+      machine.wait_until_tty_matches("1", "login: alice")
+      machine.wait_until_succeeds("pgrep login")
+      machine.wait_until_tty_matches("1", "Password: ")
+      machine.send_chars("${user.password}\n")
+      machine.wait_until_succeeds("pgrep -u alice bash")
+
+      machine.succeed("su - alice -c 'mkdir -p ~/.config/rosec ~/.local/share/rosec/providers'")
+      machine.succeed("su - alice -c 'cp ${config-path} ~/.config/rosec/config.toml'")
+      machine.succeed("su - alice -c 'systemctl --user import-environment SSH_ASKPASS SSH_ASKPASS_REQUIRE'")
+
+      with subtest("D-Bus activation starts rosecd and registers portal"):
+          machine.succeed("su - alice -c 'secret-tool lookup application nonexistent-rosec-test >/dev/null 2>&1 || true'")
+          _, output = machine.systemctl("status rosecd --no-pager", "alice")
+          assert "Active: active (running)" in output
+          machine.succeed("su - alice -c 'busctl --user list | grep -q org.freedesktop.impl.portal.desktop.rosec'")
+
+      with subtest("PAM is configured with pam_rosec"):
+          login_pam = machine.succeed("cat /etc/pam.d/login")
+
+          import re
+          assert any(re.match(r"auth\s+.*pam_rosec", l) for l in login_pam.splitlines()), "pam_rosec missing from auth stack"
+          assert any(re.match(r"password\s+.*pam_rosec", l) for l in login_pam.splitlines()), "pam_rosec missing from password stack"
+          assert any(re.match(r"session\s+.*pam_rosec", l) for l in login_pam.splitlines()), "pam_rosec missing from session stack"
+
+      with subtest("PAM auto-unlocks the vault on login"):
+          machine.succeed("su - alice -c 'echo ${user.password} | secret-tool store --label=PamTest application rosec-pam-test'")
+          machine.succeed("su - alice -c 'rosec lock'")
+
+          machine.send_chars("exit\n")
+          machine.wait_until_fails("pgrep -u alice bash")
+          machine.wait_until_tty_matches("1", "login: ")
+          machine.send_chars("alice\n")
+          machine.wait_until_tty_matches("1", "login: alice")
+          machine.wait_until_succeeds("pgrep login")
+          machine.wait_until_tty_matches("1", "Password: ")
+          machine.send_chars("${user.password}\n")
+          machine.wait_until_succeeds("pgrep -u alice bash")
+
+          machine.wait_until_succeeds("su - alice -c 'systemctl --user is-active rosecd'", timeout=30)
+          machine.succeed("su - alice -c 'timeout 30 bash -c \"until secret-tool lookup application rosec-pam-test >/dev/null 2>&1; do sleep 1; done\"'")
+          result = machine.succeed("su - alice -c 'secret-tool lookup application rosec-pam-test'")
+          assert "${user.password}" in result
+    '';
+}

nixos/tests/scx/default.nix

@@ -20,6 +20,7 @@
       flow.configuration.services.scx.scheduler = "scx_flow";
       forge.configuration.services.scx.scheduler = "scx_forge";
       lavd.configuration.services.scx.scheduler = "scx_lavd";
+      mlfq.configuration.services.scx.scheduler = "scx_mlfq";
       p2dq.configuration.services.scx.scheduler = "scx_p2dq";
       pandemonium.configuration.services.scx.scheduler = "scx_pandemonium";
       rlfifo.configuration.services.scx.scheduler = "scx_rlfifo";
@@ -40,6 +41,7 @@
       "flow",
       "forge",
       "lavd",
+      "mlfq",
       "p2dq",
       "pandemonium",
       "rlfifo",

nixos/tests/taskchampion-sync-server.nix

@@ -42,6 +42,13 @@
 
       # Useful for debugging
       client.copy_from_machine("/root/.task", "client")
-      server.copy_from_machine("${cfg.dataDir}", "server")
+      server.copy_from_machine(
+          # Ever since DynamicUser defaults to true[1], dataDir is a symlink
+          # into /var/lib/private, and symlink resolving is needed.
+          #
+          # [1]: https://github.com/NixOS/nixpkgs/commit/95fc26d18a19207b20acfee182db120efc36d1d3
+          server.succeed("readlink -f ${cfg.dataDir}").strip(),
+          "server",
+      )
     '';
 }

nixos/tests/udp514-journal.nix

@@ -0,0 +1,26 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+{
+  name = "udp514-journal";
+  meta.maintainers = with lib.maintainers; [ usovalx ];
+
+  containers.machine = {
+    services.udp514-journal.enable = true;
+    environment.systemPackages = [ pkgs.netcat ];
+  };
+
+  testScript = ''
+    import datetime
+    start_all()
+
+    machine.wait_for_unit("udp514-journal.socket");
+
+    # send a test log entry via UDP, RFC 5424 format
+    machine.execute('echo "<34>1 2026-08-01T00:24:15.123+01:00 router01 - testing" | nc -w1 -u localhost 514')
+
+    machine.wait_until_succeeds('journalctl -u udp514-journal --grep "router01 - testing"', timeout = datetime.timedelta(seconds=60))
+  '';
+}

nixos/tests/userborn-migration.nix

@@ -1,8 +1,9 @@
 { lib, ... }:
 
 # Verifies that switching from update-users-groups.pl to userborn honours
-# /var/lib/nixos/{uid,gid}-map and declarative-{users,groups}, so removed
-# users keep their ids reserved and are not reassigned.
+# /var/lib/nixos/{uid,gid}-map, auto-subuid-map and declarative-{users,groups},
+# so removed users keep their ids reserved and are not reassigned, and
+# subordinate id allocations survive the migration.
 
 {
   name = "userborn-migration";
@@ -17,6 +18,7 @@
     users.users = {
       survivor = {
         isNormalUser = true;
+        autoSubUidGidRange = true;
       };
       ghost = {
         isNormalUser = true;
@@ -79,6 +81,10 @@
           t.assertEqual(uid_map["ghost"], ghost_uid)
           t.assertEqual(uid_map["survivor"], survivor_uid)
 
+          survivor_subuid = machine.succeed("grep '^survivor:' /etc/subuid").strip()
+          auto_subuid_map = json.loads(machine.succeed("cat /var/lib/nixos/auto-subuid-map"))
+          t.assertEqual(auto_subuid_map["survivor"], int(survivor_subuid.split(":")[1]))
+
       with subtest("perl: remove ghost"):
           switch("base-ghost-removed")
           machine.fail("getent passwd ghost")
@@ -113,6 +119,18 @@
               "journalctl -u userborn-import-legacy.service --grep 'synthesised.*previous-userborn.json'"
           )
 
+      with subtest("userborn: subid allocations survive the migration"):
+          t.assertEqual(
+              machine.succeed("grep '^survivor:' /etc/subuid").strip(),
+              survivor_subuid,
+              "survivor's subuid range changed across migration",
+          )
+          t.assertEqual(
+              machine.succeed("grep '^survivor:' /etc/subgid").strip(),
+              survivor_subuid,
+              "survivor's subgid range changed across migration",
+          )
+
       with subtest("userborn: no uid collision for new user"):
           intruder_uid = uid("intruder")
           t.assertNotEqual(

nixos/tests/userborn-subids-immutable-etc.nix

@@ -0,0 +1,111 @@
+{ lib, pkgs, ... }:
+
+# Immutable /etc, subid files written to passwordFilesLocation and exposed
+# in /etc via systemd bind mount units over build-time placeholders.
+
+let
+  common = {
+    services.userborn.enable = true;
+    boot.initrd.systemd.enable = true;
+    networking.useNetworkd = true;
+    system.etc.overlay = {
+      enable = true;
+      mutable = false;
+    };
+  };
+  users = {
+    # Auto allocation at runtime, must work on an immutable /etc.
+    alice.isNormalUser = true;
+
+    explicit = {
+      isNormalUser = true;
+      subUidRanges = [
+        {
+          startUid = 700000;
+          count = 65536;
+        }
+      ];
+      subGidRanges = [
+        {
+          startGid = 700000;
+          count = 65536;
+        }
+      ];
+    };
+  };
+in
+{
+  name = "userborn-subids-immutable-etc";
+
+  meta.maintainers = with lib.maintainers; [ rvdp ];
+
+  nodes.machine =
+    { ... }:
+    {
+      imports = [ common ];
+
+      users.users = users;
+
+      specialisation.with-bob = {
+        inheritParentConfig = false;
+        configuration = {
+          nixpkgs = { inherit pkgs; };
+          imports = [ common ];
+          users.users = users // {
+            bob.isNormalUser = true;
+          };
+        };
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("userborn.service")
+
+    def parse(path):
+        out = {}
+        for line in machine.succeed(f"cat {path}").splitlines():
+            name, start, count = line.split(":")
+            out.setdefault(name, []).append((int(start), int(count)))
+        return out
+
+    with subtest("/etc/subuid is a bind mount backed by passwordFilesLocation"):
+        assert machine.succeed("stat -c '%F' /etc/subuid").strip() == "regular file"
+        machine.succeed("mountpoint -q /etc/subuid")
+        machine.succeed("systemctl is-active etc-subuid.mount etc-subgid.mount")
+        a = machine.succeed("stat -c %d:%i /etc/subuid").strip()
+        b = machine.succeed("stat -c %d:%i /var/lib/nixos/subuid").strip()
+        assert a == b
+
+    subuid = parse("/etc/subuid")
+    subgid = parse("/etc/subgid")
+    with subtest("alice got an auto range and explicit's range is present"):
+        assert len(subuid["alice"]) == 1
+        assert subuid["alice"][0][1] == 65536
+        assert subuid["explicit"] == [(700000, 65536)]
+        assert subgid["explicit"] == [(700000, 65536)]
+
+    with subtest("newuidmap accepts the bind-mounted file"):
+        machine.succeed("runuser -u alice -- unshare --user --map-auto -- true")
+
+    before = machine.succeed("cat /etc/subuid")
+    machine.succeed(
+        "/run/current-system/specialisation/with-bob/bin/switch-to-configuration switch"
+    )
+
+    with subtest("bind is refreshed across activations without stacking"):
+        n = machine.succeed("grep -c ' /etc/subuid ' /proc/self/mountinfo").strip()
+        assert n == "1", f"expected 1 mount on /etc/subuid, got {n}"
+        a = machine.succeed("stat -c %d:%i /etc/subuid").strip()
+        b = machine.succeed("stat -c %d:%i /var/lib/nixos/subuid").strip()
+        assert a == b
+
+    with subtest("existing ranges survived and bob was added"):
+        after = machine.succeed("cat /etc/subuid")
+        assert "bob:" in after
+        for line in before.splitlines():
+            assert line in after
+
+    with subtest("newuidmap still works after the switch"):
+        machine.succeed("runuser -u alice -- unshare --user --map-auto -- true")
+  '';
+}

nixos/tests/userborn-subids-mutable-etc.nix

@@ -0,0 +1,61 @@
+{ lib, ... }:
+
+# Custom passwordFilesLocation with mutable /etc, subid files exposed via
+# systemd bind mount units.
+
+{
+  name = "userborn-subids-mutable-etc";
+
+  meta.maintainers = with lib.maintainers; [ rvdp ];
+
+  nodes.machine =
+    { ... }:
+    {
+      services.userborn = {
+        enable = true;
+        passwordFilesLocation = "/var/lib/nixos";
+      };
+
+      users.users.alice.isNormalUser = true;
+
+      specialisation.with-bob.configuration = {
+        users.users.bob.isNormalUser = true;
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("userborn.service")
+
+    with subtest("/etc/subuid is a regular file backed by passwordFilesLocation"):
+        assert machine.succeed("stat -c '%F' /etc/subuid").strip() == "regular file"
+        machine.succeed("mountpoint -q /etc/subuid")
+        machine.succeed("systemctl is-active etc-subuid.mount etc-subgid.mount")
+        a = machine.succeed("stat -c %d:%i /etc/subuid").strip()
+        b = machine.succeed("stat -c %d:%i /var/lib/nixos/subuid").strip()
+        assert a == b
+
+    with subtest("newuidmap accepts the bind-mounted file"):
+        machine.succeed("runuser -u alice -- unshare --user --map-auto -- true")
+
+    before = machine.succeed("cat /etc/subuid")
+    machine.succeed(
+        "/run/current-system/specialisation/with-bob/bin/switch-to-configuration switch"
+    )
+
+    with subtest("bind is refreshed across activations without stacking"):
+        n = machine.succeed("grep -c ' /etc/subuid ' /proc/self/mountinfo").strip()
+        assert n == "1", f"expected 1 mount on /etc/subuid, got {n}"
+        a = machine.succeed("stat -c %d:%i /etc/subuid").strip()
+        b = machine.succeed("stat -c %d:%i /var/lib/nixos/subuid").strip()
+        assert a == b
+
+    with subtest("alice's range survived and bob was added"):
+        after = machine.succeed("cat /etc/subuid")
+        assert "alice:" in after and "bob:" in after
+        for line in before.splitlines():
+            assert line in after
+
+    with subtest("newuidmap still works after the swap"):
+        machine.succeed("runuser -u alice -- unshare --user --map-auto -- true")
+  '';
+}

nixos/tests/userborn-subids.nix

@@ -0,0 +1,137 @@
+{ lib, pkgs, ... }:
+
+# /etc/sub{u,g}id management via userborn.
+
+{
+  name = "userborn-subids";
+
+  meta.maintainers = with lib.maintainers; [ rvdp ];
+
+  nodes.machine =
+    { ... }:
+    {
+      services.userborn.enable = true;
+
+      users.users = {
+        alice.isNormalUser = true;
+
+        explicit = {
+          isNormalUser = true;
+          subUidRanges = [
+            {
+              startUid = 700000;
+              count = 65536;
+            }
+          ];
+          subGidRanges = [
+            {
+              startGid = 700000;
+              count = 65536;
+            }
+          ];
+        };
+
+        # Huge root range like incus sets, auto allocations must avoid it.
+        root = {
+          subUidRanges = [
+            {
+              startUid = 1000000;
+              count = 1000000000;
+            }
+          ];
+          subGidRanges = [
+            {
+              startGid = 1000000;
+              count = 1000000000;
+            }
+          ];
+        };
+      };
+
+      environment.systemPackages = [ pkgs.util-linux ];
+
+      specialisation = {
+        with-bob.configuration = {
+          users.users.bob.isNormalUser = true;
+        };
+
+        # Overlaps alice's auto allocation, must fail before writing.
+        conflict.configuration = {
+          users.users.mallory = {
+            isNormalUser = true;
+            subUidRanges = [
+              {
+                startUid = 100000;
+                count = 200000;
+              }
+            ];
+          };
+        };
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("userborn.service")
+
+    def switch_to(spec):
+        machine.succeed(
+            f"/run/booted-system/specialisation/{spec}/bin/switch-to-configuration switch"
+        )
+
+    def parse(path):
+        out = {}
+        for line in machine.succeed(f"cat {path}").splitlines():
+            name, start, count = line.split(":")
+            out.setdefault(name, []).append((int(start), int(count)))
+        return out
+
+    def overlaps(a, b):
+        return a[0] < b[0] + b[1] and b[0] < a[0] + a[1]
+
+    with subtest("/etc/subuid is a plain regular file (newuidmap O_NOFOLLOW)"):
+        assert machine.succeed("stat -c '%F' /etc/subuid").strip() == "regular file"
+        assert machine.succeed("stat -c '%a' /etc/subuid").strip() == "644"
+        machine.fail("mountpoint -q /etc/subuid")
+
+    subuid = parse("/etc/subuid")
+    subgid = parse("/etc/subgid")
+
+    with subtest("explicit ranges are honoured verbatim"):
+        assert subuid["explicit"] == [(700000, 65536)]
+        assert subuid["root"] == [(1000000, 1000000000)]
+
+    with subtest("alice gets an auto range below the root range"):
+        (start, count), = subuid["alice"]
+        assert count == 65536
+        assert start >= 100000
+        assert not overlaps((start, count), (1000000, 1000000000))
+        assert subgid["alice"] == subuid["alice"]
+
+    with subtest("newuidmap accepts the file"):
+        machine.succeed(
+            "runuser -u alice -- unshare --user --map-auto -- true"
+        )
+
+    alice_before = subuid["alice"]
+    switch_to("with-bob")
+    subuid = parse("/etc/subuid")
+
+    with subtest("alice's range is preserved across generations"):
+        assert subuid["alice"] == alice_before
+
+    with subtest("bob's range does not overlap anything"):
+        (bstart, bcount), = subuid["bob"]
+        for owner, ranges in subuid.items():
+            if owner == "bob":
+                continue
+            for r in ranges:
+                assert not overlaps((bstart, bcount), r), f"bob overlaps {owner}"
+
+    with subtest("overlapping ranges fail the service"):
+        machine.fail(
+            "/run/booted-system/specialisation/conflict/bin/switch-to-configuration switch"
+        )
+        # File must be unchanged (no mallory entry written).
+        assert "mallory" not in machine.succeed("cat /etc/subuid")
+  '';
+}

nixos/tests/web-apps/immich.nix

@@ -17,6 +17,7 @@
       services.immich = {
         enable = true;
         environment.IMMICH_LOG_LEVEL = "verbose";
+        host = ""; # all interfaces (example from module option)
         settings = {
           backup.database = {
             enabled = true;
@@ -46,6 +47,9 @@
     machine.wait_for_open_port(3003) # Machine learning
     machine.succeed("curl --fail http://localhost:2283/")
 
+    with subtest("verify listening to any IP (i.e. v4 & v6)"):
+      machine.succeed("ss -tln | grep -F '*:2283'")
+
     machine.succeed("""
       curl -f --json '{ "email": "test@example.com", "name": "Admin", "password": "admin" }' http://localhost:2283/api/auth/admin-sign-up
     """)

pkgs/applications/audio/deadbeef/plugins/lyricbar.nix

@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation {
   pname = "deadbeef-lyricbar-plugin";
-  version = "unstable-2019-01-29";
+  version = "0.1-unstable-2019-01-29";
 
   src = fetchFromGitHub {
     owner = "C0rn3j";

pkgs/applications/editors/android-studio/darwin.nix

@@ -0,0 +1,152 @@
+{
+  channel,
+  pname,
+  version,
+  sources,
+  meta,
+}:
+
+{
+  androidenv,
+  fetchurl,
+  lib,
+  makeWrapper,
+  runCommand,
+  runtimeShell,
+  stdenvNoCC,
+  undmg,
+}:
+
+let
+  source = sources.${stdenvNoCC.hostPlatform.system};
+  appName =
+    {
+      stable = "Android Studio.app";
+      beta = "Android Studio Preview Beta.app";
+      canary = "Android Studio Preview Canary.app";
+      dev = "Android Studio Preview Dev.app";
+    }
+    .${channel};
+
+  androidStudio = stdenvNoCC.mkDerivation {
+    pname = "${pname}-unwrapped";
+    inherit version;
+
+    src = fetchurl {
+      inherit (source) url;
+      sha256 = source.sha256Hash;
+    };
+
+    nativeBuildInputs = [
+      makeWrapper
+      undmg
+    ];
+
+    sourceRoot = ".";
+    dontFixup = true;
+
+    installPhase = ''
+      runHook preInstall
+
+      shopt -s nullglob
+      apps=( *.app )
+      if (( ''${#apps[@]} != 1 )); then
+        echo "expected exactly one app bundle, found ''${#apps[@]}" >&2
+        exit 1
+      fi
+
+      mkdir -p "$out/Applications/${appName}" "$out/bin"
+      cp -R "''${apps[0]}/." "$out/Applications/${appName}"
+      /usr/bin/xattr -cr "$out/Applications/${appName}"
+      makeWrapper \
+        "$out/Applications/${appName}/Contents/MacOS/studio" \
+        "$out/bin/studio"
+
+      runHook postInstall
+    '';
+
+    meta.mainProgram = "studio";
+  };
+
+  mkAndroidStudioWrapper =
+    {
+      androidStudio,
+      androidSdk ? null,
+    }:
+    runCommand "${pname}-${version}"
+      {
+        inherit pname version;
+        dontFixup = true;
+        startScript =
+          let
+            hasAndroidSdk = androidSdk != null;
+            androidHome = lib.optionalString hasAndroidSdk "${androidSdk}/libexec/android-sdk";
+          in
+          ''
+            #!${runtimeShell}
+            ${lib.optionalString hasAndroidSdk ''
+              echo "=== nixpkgs Android Studio wrapper" >&2
+
+              # Default ANDROID_HOME to the packaged one, if not provided.
+              ANDROID_HOME="''${ANDROID_HOME-${androidHome}}"
+
+              if [ -d "$ANDROID_HOME" ]; then
+                export ANDROID_HOME
+                echo "  - ANDROID_HOME=$ANDROID_HOME" >&2
+
+                # Legacy compatibility.
+                export ANDROID_SDK_ROOT="$ANDROID_HOME"
+
+                # See if we can export ANDROID_NDK_ROOT too.
+                ANDROID_NDK_ROOT="$ANDROID_SDK_ROOT/ndk-bundle"
+                if [ ! -d "$ANDROID_NDK_ROOT" ]; then
+                  ANDROID_NDK_ROOT="$(ls "$ANDROID_SDK_ROOT/ndk/"* 2>/dev/null | head -n1)"
+                fi
+
+                if [ -d "$ANDROID_NDK_ROOT" ]; then
+                  export ANDROID_NDK_ROOT
+                  echo "  - ANDROID_NDK_ROOT=$ANDROID_NDK_ROOT" >&2
+                else
+                  unset ANDROID_NDK_ROOT
+                fi
+              else
+                unset ANDROID_HOME
+                unset ANDROID_SDK_ROOT
+              fi
+            ''}
+            exec "${androidStudio}/Applications/${appName}/Contents/MacOS/studio" "$@"
+          '';
+        preferLocalBuild = true;
+        allowSubstitutes = false;
+        passthru =
+          let
+            withSdk = androidSdk: mkAndroidStudioWrapper { inherit androidStudio androidSdk; };
+          in
+          {
+            unwrapped = androidStudio;
+            full = withSdk androidenv.androidPkgs.androidsdk;
+            inherit withSdk;
+            sdk = androidSdk;
+            updateScript = [
+              ./update.sh
+              "${channel}"
+            ];
+          };
+        inherit meta;
+      }
+      ''
+        appDir="$out/Applications/${appName}/Contents"
+        unwrappedAppDir="${androidStudio}/Applications/${appName}/Contents"
+
+        mkdir -p "$appDir/MacOS" "$appDir/Resources" "$out/bin"
+        cp "$unwrappedAppDir/Info.plist" "$appDir/Info.plist"
+        cp "$unwrappedAppDir/Resources/"*.icns "$appDir/Resources/"
+
+        echo -n "$startScript" > "$appDir/MacOS/studio"
+        chmod +x "$appDir/MacOS/studio"
+        ln -s "../Applications/${appName}/Contents/MacOS/studio" "$out/bin/${pname}"
+
+        /usr/bin/codesign --force --sign - "$out/Applications/${appName}"
+      '';
+in
+mkAndroidStudioWrapper { inherit androidStudio; }

pkgs/applications/editors/android-studio/default.nix

@@ -1,34 +1,117 @@
 {
   callPackage,
+  lib,
   makeFontsConf,
   buildFHSEnv,
+  stdenv,
   tiling_wm ? false,
 }:
 
 let
   mkStudio =
     opts:
-    callPackage (import ./common.nix opts) {
-      fontsConf = makeFontsConf {
-        fontDirectories = [ ];
+    let
+      inherit (opts) channel pname;
+      meta = {
+        description = "Official IDE for Android (${channel} channel)";
+        longDescription = ''
+          Android Studio is the official IDE for Android app development, based on
+          IntelliJ IDEA.
+        '';
+        homepage =
+          if channel == "stable" then
+            "https://developer.android.com/studio/index.html"
+          else
+            "https://developer.android.com/studio/preview/index.html";
+        license = with lib.licenses; [
+          asl20
+          unfree
+        ]; # The code is under Apache-2.0, but:
+        # If one selects Help -> Licenses in Android Studio, the dialog shows the following:
+        # "Android Studio includes proprietary code subject to separate license,
+        # including JetBrains CLion(R) (www.jetbrains.com/clion) and IntelliJ(R)
+        # IDEA Community Edition (www.jetbrains.com/idea)."
+        # Also: For actual development the Android SDK is required and the Google
+        # binaries are also distributed as proprietary software (unlike the
+        # source-code itself).
+        platforms = [
+          "x86_64-linux"
+          "aarch64-darwin"
+        ];
+        maintainers =
+          rec {
+            stable = with lib.maintainers; [
+              alapshin
+            ];
+            beta = stable;
+            canary = stable;
+            dev = stable;
+          }
+          ."${channel}";
+        teams =
+          rec {
+            stable = with lib.teams; [
+              android
+            ];
+            beta = stable;
+            canary = stable;
+            dev = stable;
+          }
+          ."${channel}";
+        mainProgram = pname;
+        sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
       };
-      inherit buildFHSEnv;
-      inherit tiling_wm;
-    };
+      builder = if stdenv.hostPlatform.isDarwin then ./darwin.nix else ./linux.nix;
+    in
+    callPackage (import builder (opts // { inherit meta; })) (
+      if stdenv.hostPlatform.isDarwin then
+        { }
+      else
+        {
+          inherit buildFHSEnv tiling_wm;
+          fontsConf = makeFontsConf {
+            fontDirectories = [ ];
+          };
+        }
+    );
   stableVersion = {
     version = "2026.1.3.8"; # "Android Studio Quail 3 | 2026.1.3 Patch 1"
-    sha256Hash = "sha256-W9XuXW50exP4L7oyQTgL01jML0qEeBXI6GB1ffE9w18=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.3.8/android-studio-quail3-patch1-linux.tar.gz";
+    sources = {
+      x86_64-linux = {
+        sha256Hash = "sha256-W9XuXW50exP4L7oyQTgL01jML0qEeBXI6GB1ffE9w18=";
+        url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.3.8/android-studio-quail3-patch1-linux.tar.gz";
+      };
+      aarch64-darwin = {
+        sha256Hash = "sha256-qnfvaRmyK+UVZtzXlgPDI/fEA/qR3HncQT7tf2oFwEg=";
+        url = "https://edgedl.me.gvt1.com/android/studio/install/2026.1.3.8/android-studio-quail3-patch1-mac_arm.dmg";
+      };
+    };
   };
   betaVersion = {
     version = "2026.1.3.6"; # "Android Studio Quail 3 | 2026.1.3 RC 2"
-    sha256Hash = "sha256-Mgwy+Cbx5yBCHWUEcvMfAsC1zMk3j7A5fWtMrVJgmAk=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.3.6/android-studio-quail3-rc2-linux.tar.gz";
+    sources = {
+      x86_64-linux = {
+        sha256Hash = "sha256-Mgwy+Cbx5yBCHWUEcvMfAsC1zMk3j7A5fWtMrVJgmAk=";
+        url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.3.6/android-studio-quail3-rc2-linux.tar.gz";
+      };
+      aarch64-darwin = {
+        sha256Hash = "sha256-5SJmTQRweFeAJsZWv0vHgK+ZtSHu0gp+al8iDGEAg+E=";
+        url = "https://edgedl.me.gvt1.com/android/studio/install/2026.1.3.6/android-studio-quail3-rc2-mac_arm.dmg";
+      };
+    };
   };
   latestVersion = {
     version = "2026.1.4.4"; # "Android Studio Quail 4 | 2026.1.4 Canary 4"
-    sha256Hash = "sha256-gcVlZzJ1/euSsKVrmYLXHt1Ym2kNghTzIk6crZXhGKQ=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.4.4/android-studio-quail4-canary4-linux.tar.gz";
+    sources = {
+      x86_64-linux = {
+        sha256Hash = "sha256-gcVlZzJ1/euSsKVrmYLXHt1Ym2kNghTzIk6crZXhGKQ=";
+        url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.4.4/android-studio-quail4-canary4-linux.tar.gz";
+      };
+      aarch64-darwin = {
+        sha256Hash = "sha256-lEgZnmRbMNZ9HKC5JtjSo01MLX5hCFp7CvV67eKHGr0=";
+        url = "https://edgedl.me.gvt1.com/android/studio/install/2026.1.4.4/android-studio-quail4-canary4-mac_arm.dmg";
+      };
+    };
   };
 in
 {

pkgs/applications/editors/android-studio/linux.nix

@@ -2,8 +2,8 @@
   channel,
   pname,
   version,
-  url,
-  sha256Hash,
+  sources,
+  meta,
 }:
 
 {
@@ -83,14 +83,15 @@
 
 let
   filename = "android-studio-${version}-linux.tar.gz";
+  source = sources.${stdenv.hostPlatform.system};
 
   androidStudio = stdenv.mkDerivation {
     pname = "${pname}-unwrapped";
     inherit version;
 
     src = fetchurl {
-      url = url;
-      sha256 = sha256Hash;
+      inherit (source) url;
+      sha256 = source.sha256Hash;
     };
 
     nativeBuildInputs = [
@@ -305,52 +306,7 @@ let
               "${channel}"
             ];
           };
-        meta = {
-          description = "Official IDE for Android (${channel} channel)";
-          longDescription = ''
-            Android Studio is the official IDE for Android app development, based on
-            IntelliJ IDEA.
-          '';
-          homepage =
-            if channel == "stable" then
-              "https://developer.android.com/studio/index.html"
-            else
-              "https://developer.android.com/studio/preview/index.html";
-          license = with lib.licenses; [
-            asl20
-            unfree
-          ]; # The code is under Apache-2.0, but:
-          # If one selects Help -> Licenses in Android Studio, the dialog shows the following:
-          # "Android Studio includes proprietary code subject to separate license,
-          # including JetBrains CLion(R) (www.jetbrains.com/clion) and IntelliJ(R)
-          # IDEA Community Edition (www.jetbrains.com/idea)."
-          # Also: For actual development the Android SDK is required and the Google
-          # binaries are also distributed as proprietary software (unlike the
-          # source-code itself).
-          platforms = [ "x86_64-linux" ];
-          maintainers =
-            rec {
-              stable = with lib.maintainers; [
-                alapshin
-              ];
-              beta = stable;
-              canary = stable;
-              dev = stable;
-            }
-            ."${channel}";
-          teams =
-            rec {
-              stable = with lib.teams; [
-                android
-              ];
-              beta = stable;
-              canary = stable;
-              dev = stable;
-            }
-            ."${channel}";
-          mainProgram = pname;
-          sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
-        };
+        inherit meta;
       }
       ''
         mkdir -p $out/{bin,share/pixmaps}

pkgs/applications/editors/android-studio/update.sh

@@ -1,10 +1,14 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -I nixpkgs=./. -i bash -p jq nix-prefetch-scripts
+#! nix-shell -I nixpkgs=./. -i bash -p jq
 
 set -euo pipefail
 
 DEFAULT_NIX="$(realpath "./pkgs/applications/editors/android-studio/default.nix")"
 RELEASES_JSON="$(curl --silent -L https://jb.gg/android-studio-releases-list.json)"
+PLATFORMS=(
+    "x86_64-linux|-linux.tar.gz"
+    "aarch64-darwin|-mac_arm.dmg"
+)
 
 # Available channels: Release/Patch (stable), Beta, Canary
 getLatest() {
@@ -15,7 +19,8 @@ getLatest() {
         "beta") local select='.channel == "Beta" or .channel == "RC"' ;;
         *) local select=".channel == \"${channel^}\"" ;;
     esac
-    local result="$(echo "$RELEASES_JSON" \
+    local result
+    result="$(echo "$RELEASES_JSON" \
         | jq -r ".content.item[] | select(${select}) | [.version, (${attribute})] | join(\" \")" \
         | sort --version-sort \
         | cut -d' ' -f 2- \
@@ -31,31 +36,52 @@ getLatest() {
 
 updateChannel() {
     local channel="$1"
-    local latestVersion="$(getLatest ".version" "$channel")"
+    local latestVersion
+    latestVersion="$(getLatest ".version" "$channel")"
 
-    local localVersion="$(nix --extra-experimental-features nix-command eval --raw --file . androidStudioPackages."${channel}".version)"
+    local localVersion
+    localVersion="$(nix --extra-experimental-features nix-command eval --raw --file . androidStudioPackages."${channel}".version)"
     if [[ "${latestVersion}" == "${localVersion}" ]]; then
         echo "$channel is already up to date at $latestVersion"
         return 0
     fi
     echo "updating $channel from $localVersion to $latestVersion"
 
-    local latestUrl="$(getLatest "[.download[] | select(.link | endswith(\"-linux.tar.gz\"))][0].link" "$channel")"
-    local latestHash="$(getLatest "[.download[] | select(.link | endswith(\"-linux.tar.gz\"))][0].checksum" "$channel")"
+    local platformSpec
+    local replacements=()
+    for platformSpec in "${PLATFORMS[@]}"; do
+        local system="${platformSpec%%|*}"
+        local suffix="${platformSpec#*|}"
+        local latestUrl
+        latestUrl="$(getLatest "[.download[] | select(.link | endswith(\"${suffix}\"))][0].link" "$channel")"
+        local latestHash
+        latestHash="$(getLatest "[.download[] | select(.link | endswith(\"${suffix}\"))][0].checksum" "$channel")"
 
-    if [[ "$latestUrl" != https://edgedl.me.gvt1.com/android/studio/* ]]; then
-        echo "URL '$latestUrl' had an unexpected value, maybe the server changed?" >&2
-        exit 1
-    fi
+        if [[ "$latestUrl" != https://edgedl.me.gvt1.com/android/studio/* ]]; then
+            echo "URL '$latestUrl' had an unexpected value, maybe the server changed?" >&2
+            exit 1
+        fi
 
-    local latestSri="$(nix --extra-experimental-features nix-command hash convert --from base16 --hash-algo sha256 "$latestHash")"
-    local localUrl="$(nix --extra-experimental-features nix-command eval --json --file . androidStudioPackages."${channel}".unwrapped.src.drvAttrs.urls | jq -r '.[0]')"
-    local localHash="$(nix --extra-experimental-features nix-command eval --raw --file . androidStudioPackages."${channel}".unwrapped.src.drvAttrs.outputHash)"
-    sed -i "s~${localHash}~${latestSri}~g" "${DEFAULT_NIX}"
+        local latestSri
+        latestSri="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$latestHash")"
+        local localUrl
+        localUrl="$(nix --extra-experimental-features nix-command eval --system "$system" --json --file . androidStudioPackages."${channel}".unwrapped.src.drvAttrs.urls | jq -r '.[0]')"
+        local localHash
+        localHash="$(nix --extra-experimental-features nix-command eval --system "$system" --raw --file . androidStudioPackages."${channel}".unwrapped.src.drvAttrs.outputHash)"
+        replacements+=("${localHash}|${latestSri}")
+        replacements+=("${localUrl}|${latestUrl}")
+    done
+
+    local replacement
+    for replacement in "${replacements[@]}"; do
+        local oldValue="${replacement%%|*}"
+        local newValue="${replacement#*|}"
+        sed -i "s~${oldValue}~${newValue}~g" "${DEFAULT_NIX}"
+    done
 
     # Match the formatting of default.nix: `version = "2021.3.1.14"; # "Android Studio Dolphin (2021.3.1) Beta 5"`
-    local versionString="${latestVersion}\"; # \"$(getLatest ".name" "${channel}")\""
-    sed -i "s~${localUrl}~${latestUrl}~g" "${DEFAULT_NIX}"
+    local versionString
+    versionString="${latestVersion}\"; # \"$(getLatest ".name" "${channel}")\""
     sed -i "s~${localVersion}.*~${versionString}~g" "${DEFAULT_NIX}"
     echo "updated ${channel} to ${latestVersion}" >&2
 }

pkgs/applications/editors/eclipse/eclipses.json

@@ -1,90 +1,90 @@
 {
   "platform_major": "4",
-  "platform_minor": "39",
-  "version": "4.39",
+  "platform_minor": "40",
+  "version": "4.40",
   "year": "2026",
-  "month": "03",
-  "buildmonth": "02",
-  "dayHourMinute": "260420",
+  "month": "06",
+  "buildmonth": "06",
+  "dayHourMinute": "010713",
   "eclipses": {
     "cpp": {
       "description": "Eclipse IDE for C/C++ Developers",
       "dropUrl": false,
       "hashes": {
-        "x86_64": "sha256-2Mnh73FgzNjR4EU6KMG6MvGDeIIYXMj3mZFYR31pqfY=",
-        "aarch64": "sha256-kq94vQYN2CEHodme8V6V0EZ33Pf96fmj/zMD/vkJbp8="
+        "x86_64": "sha256-b+H8RW9VBysVEVqEHV907FmUXvl5guCFeCW9tmk3UMM=",
+        "aarch64": "sha256-51UBeTa7w56nZcoBI6Sj4Qg8K26wMmRCSoR9NjGcpb4="
       }
     },
     "dsl": {
       "description": "Eclipse IDE for Java and DSL Developers",
       "dropUrl": false,
       "hashes": {
-        "x86_64": "sha256-dOvQSOk4tPiLiNFHn4+a+gA69BhXjp9IbEZMJET7BfU=",
-        "aarch64": "sha256-EPLQccE19bYITjaWnZjcB9/c7M95/7gbfJVPHkrXAWM="
+        "x86_64": "sha256-PfI3nBXddsVEG5BPnni9ZDibS4oyuHK5LMt8gVhmsLo=",
+        "aarch64": "sha256-cG68toeueODJgWClEDHe1Uwj49icbi5XvUfC/cdaDwc="
       }
     },
     "embedcpp": {
       "description": "Eclipse IDE for Embedded C/C++ Developers",
       "dropUrl": false,
       "hashes": {
-        "x86_64": "sha256-zX0MMRGMANowMxWxCxpz2oQAXFEF8HRXQ0q76B4NnEY=",
-        "aarch64": "sha256-XRfs2dJL/mXMWF7akXBw1Plh8jabSvhULOrC7dWGg7Q="
+        "x86_64": "sha256-Fen7qR/w2TkKxom/iBReSwJ5tXpUv30tQZ4hZikeTUc=",
+        "aarch64": "sha256-4bFpMX01VtT38S/Vxm7cA8Ye5o0Swc6oKFg5DGCW4Lw="
       }
     },
     "modeling": {
       "description": "Eclipse Modeling Tools",
       "dropUrl": false,
       "hashes": {
-        "x86_64": "sha256-5yI90w7vJGCnUvYxTnQ19NzZYJpPPmKtjS/rXmowOTE=",
-        "aarch64": "sha256-SZE4f2CR/FuG1B08Zf0eKrMBKRy7d2CWISGKWVpwhDw="
+        "x86_64": "sha256-jWeFmMGKEJvUAWzUx+b/ErcFBNiwTktpcc86oaxgL3A=",
+        "aarch64": "sha256-5IiL8Bjx0Jz+3bmnkS8/RNZKNgrUkFmAYrne39jJhd0="
       }
     },
     "platform": {
       "description": "Eclipse Platform ${year}-${month}",
       "dropUrl": true,
       "hashes": {
-        "x86_64": "sha256-VpV40IdWwUdePo1NqOrgnzta1x7jXDLkF+pZ4LWatew=",
-        "aarch64": "sha256-Q//rkfpyY319BW4w/sK3Bd7Qb4Oi88hnr0aGULquV3g="
+        "x86_64": "sha256-GOKcF3LFRwNv2W76ZjOiy9F3RUt4xqnPJ1+6Fr7J35U=",
+        "aarch64": "sha256-qraHWcsBZR5iAWkXobH4CueVKCgnI8KokH7siy2RVg0="
       }
     },
     "SDK": {
       "description": "Eclipse ${year}-${month} Classic",
       "dropUrl": true,
       "hashes": {
-        "x86_64": "sha256-ifXUPmZSvJP/LMCHFmX+01+qF75jVEGFmGxfElBz1K8=",
-        "aarch64": "sha256-grzJNEFvXhgrJM+hSiS29n0ardlmhM6kIffeWPh/vMs="
+        "x86_64": "sha256-RQwJWf7myQEBsQr1/l3zXiOqcYYDvSFn9U+Ti7ngawg=",
+        "aarch64": "sha256-233IvE4BjvwoAP18qqmwXO6a90O9pzbs+OtBHALADx0="
       }
     },
     "java": {
       "description": "Eclipse IDE for Java Developers",
       "dropUrl": false,
       "hashes": {
-        "x86_64": "sha256-DtRK/x4u7YQpjcKYh/9PdAeppjaxTEBTdL/AQhPFIlU=",
-        "aarch64": "sha256-Gu5d8qMig6cCc9JVnNDMsj+xsYfkbHrTl1MvlSIfmhE="
+        "x86_64": "sha256-Xg9sJB/QRTBhjfUm2EcVAWPCpjnyvWqlcMpgj/h48e4=",
+        "aarch64": "sha256-Df0EMVLfpB29Rw8uos0PT8B23iMaxIHKDwUa0bUV3Qo="
       }
     },
     "jee": {
       "description": "Eclipse IDE for Enterprise Java and Web Developers",
       "dropUrl": false,
       "hashes": {
-        "x86_64": "sha256-86Qi1nZElwyo9gumtLUlsnOxsF2TE4DpXGmPS+C2l2M=",
-        "aarch64": "sha256-iAtto9kxFjbXo6KQmOlnY6TRskHkx20VJUeW7FO3lZI="
+        "x86_64": "sha256-Id72dbNgKN1YrZAsxnjUTlQY8ao3GuVoNqcYt14D/F0=",
+        "aarch64": "sha256-PMFyR/IS6KOhiHTsZ8e9GytwndqHta45sfMuxxWcM8Q="
       }
     },
     "committers": {
       "description": "Eclipse IDE for Eclipse Committers and Eclipse Platform Plugin Developers",
       "dropUrl": false,
       "hashes": {
-        "x86_64": "sha256-fq5dfqqqyxO1fZRMd5aygDWKN116Mx3VqglVsRiTAAE=",
-        "aarch64": "sha256-/6+0zMMVeARHldxOenRN16sxSkUP97g7ERmePdwxi78="
+        "x86_64": "sha256-D7Y0XW2BAUj0FjWo3RSEy0rLC+8coZ0KmQKSOj4FYYw=",
+        "aarch64": "sha256-ci/ZJqxyF5krHsNd0ZfgOi5Y/0WID6GvX5yyXmXvvGs="
       }
     },
     "rcp": {
       "description": "Eclipse IDE for RCP and RAP Developers",
       "dropUrl": false,
       "hashes": {
-        "x86_64": "sha256-VQTCGRqb6Fn7DdhM0S1gJX17Rv/H8Ych2rZmBYRiaq4=",
-        "aarch64": "sha256-o+Rd5vuhvSjs0oLkLnAgHpyq1EuYLZAJY5GTwBEmPog="
+        "x86_64": "sha256-eo2I1lfFmN8auCxJp+YlAK+dLaYfqhuFyWOKrXQLMQ0=",
+        "aarch64": "sha256-TXz4DEk0QITXkNOIkd3055QhfS7zOfI6FEIupIE97BE="
       }
     }
   }

pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix

@@ -58,13 +58,13 @@ in
 melpaBuild (finalAttrs: {
   pname = "ghostel";
 
-  version = "0.50.0";
+  version = "0.51.0";
 
   src = fetchFromGitHub {
     owner = "dakra";
     repo = "ghostel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oRd5PEqMJWsnpcd5sE5Kd+ZPcyzfyT/wm4RP3/654mE=";
+    hash = "sha256-a1SY54yo2BIuSA6a6UTwrb+hcV/9IMKZrCrVVgBAsxo=";
   };
 
   # these can be put into mkModule, but we put them here to ease user overrideAttrs

pkgs/applications/editors/emacs/elisp-packages/manual-packages/info-variable-pitch/package.nix

@@ -0,0 +1,28 @@
+{
+  lib,
+  melpaBuild,
+  fetchFromGitHub,
+  s,
+  unstableGitUpdater,
+}:
+melpaBuild {
+  pname = "info-variable-pitch";
+  version = "0-unstable-2022-06-18";
+  src = fetchFromGitHub {
+    owner = "kisaragi-hiu";
+    repo = "info-variable-pitch";
+    rev = "e18e8dfb5dbea304fcf2312eb6cc8a0736e6eda0";
+    hash = "sha256-/xp28m7RLRSXIveeTJnSElfu0XIXDmVvE3uJb8fpRJo=";
+  };
+
+  packageRequires = [ s ];
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = {
+    homepage = "https://github.com/kisaragi-hiu/info-variable-pitch";
+    description = "Like org-variable-pitch but for Info";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ johnhamelink ];
+  };
+}

pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix

@@ -489,6 +489,7 @@ let
               pkgs.zlib
             ];
             nativeBuildInputs = old.nativeBuildInputs ++ [ pkgs.pkg-config ];
+            propagatedUserEnvPkgs = old.propagatedUserEnvPkgs or [ ] ++ [ pkgs.qrencode ];
 
             postPatch = ''
               substituteInPlace telega-customize.el \

pkgs/applications/editors/neovim/plugin-submodule.nix

@@ -22,7 +22,7 @@ let
       options = {
         config = mkOption {
           type = types.nullOr types.lines;
-          description = "viml configuration associated with this plugin.";
+          description = "Configuration associated with this plugin. Use the 'type' plugin option to set the language (viml by default).";
           default = null;
           example = "set title";
         };