python3Packages.pyannote-audio: drop x86_64-darwin mention in comment

To reproduce:

    $ nix run nixpkgs/3b32825de172d0bc85664f495edb096b10862524#ast-grep \
        -- scan --update-all --inline-rules '
          id: nix-x86_64-darwin
          language: nix
          rule:
            any:
              - pattern: "\"x86_64-darwin\""
                kind: list_expression > string_expression
              - pattern:
                  context: "{ \"x86_64-darwin\" = $EXPR; }"
                  selector: binding
              - pattern:
                  context: "{ x86_64-darwin = $EXPR; }"
                  selector: binding
          fix:
            template: ""
        ' pkgs
    $ nix run nixpkgs/3b32825de172d0bc85664f495edb096b10862524#ast-grep \
        -- scan --update-all --inline-rules '
          id: json-first-x86_64-darwin
          language: json
          rule:
            kind: object > pair:nth-child(1)
            has:
              pattern: "\"x86_64-darwin\""
              field: key
          fix:
            template: ""
            expandEnd: { regex: "," }
        ' pkgs
    $ nix run nixpkgs/3b32825de172d0bc85664f495edb096b10862524#ast-grep \
        -- scan --update-all --inline-rules '
          id: json-x86_64-darwin
          language: json
          rule:
            kind: object > pair
            has:
              pattern: "\"x86_64-darwin\""
              field: key
          fix:
            template: ""
            expandStart: { regex: "," }
        ' pkgs
    $ git restore pkgs/by-name/om/omnix/package.nix
    $ git diff --name-only -z \
        | nix shell nixpkgs/3b32825de172d0bc85664f495edb096b10862524#gnused \
            -c xargs -0 sed -i '/^$/N; /^\n\? \+$/d'
    $ treefmt

.github/workflows/check.yml

@@ -92,8 +92,8 @@ jobs:
     if: inputs.baseBranch && inputs.headBranch
     permissions:
       pull-requests: write
-    runs-on: ubuntu-slim
-    timeout-minutes: 3
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 8
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:

.github/workflows/lint.yml

@@ -131,8 +131,8 @@ jobs:
     # Luckily there's no need to lint commit messages in the Merge Queue, because
     # changes to the target branch can't change commit messages on the base branch.
     if: ${{ github.event.pull_request.number }}
-    runs-on: ubuntu-slim
-    timeout-minutes: 5
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 8
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:

doc/hooks/check-phase-thread-limit-hook.section.md

@@ -1,24 +0,0 @@
-# checkPhaseThreadLimitHook {#setup-hook-check-phase-thread-limit}
-
-This hook defaults a variety of environment variables known
-to control thread counts to 1. Many of these otherwise default
-to `$(nproc)`, which causes massive overloads on build machines
-if nix build jobs and build cores are already tuned to fully utilize
-compute capacity of a builder without additional parallelism.
-
-Currently sets the following environment variables:
-- [`OMP_NUM_THREADS`](https://www.openmp.org/spec-html/5.0/openmpse50.html)
-- [`OPENBLAS_NUM_THREADS`](https://github.com/OpenMathLib/OpenBLAS/blob/e7b45174355edec1f04de1cabcf5ca6a98ea7fbc/USAGE.md#how-can-i-use-openblas-in-multi-threaded-applications)
-- [`MKL_NUM_THREADS`](https://www.intel.com/content/www/us/en/docs/onemkl/developer-guide-linux/2023-0/mkl-domain-num-threads.html)
-- [`BLIS_NUM_THREADS`](https://github.com/flame/blis/blob/b8b75b4e19459f5d618b57aa814ca38b1d82eb82/docs/Multithreading.md#specifying-multithreading)
-- `VECLIB_MAXIMUM_THREADS`: Only affects darwin, see [`man 7 Accelerate`](https://manp.gs/mac/7/Accelerate)
-- [`NUMBA_NUM_THREADS`](https://numba.readthedocs.io/en/stable/reference/envvars.html#threading-control)
-- [`NUMEXPR_NUM_THREADS`](https://numexpr.readthedocs.io/en/latest/user_guide.html#threadpool-configuration)
-
-The `NIX_CHECK_PHASE_DEFAULT_NUM_THREADS` environment variable
-can be used to override the default thread count limit.
-`dontLimitCheckPhaseThreads = true;` can be used to disable
-thread limiting on an individual package.
-
-This hook will not attempt to override already existing
-definitions for thread count environment variables.

doc/hooks/index.md

@@ -13,7 +13,6 @@ aws-c-common.section.md
 bmake.section.md
 breakpoint.section.md
 cernlib.section.md
-check-phase-thread-limit-hook.section.md
 cmake.section.md
 desktop-file-utils.section.md
 gdk-pixbuf.section.md
@@ -35,6 +34,7 @@ nodejs-install-manuals.section.md
 npm-build-hook.section.md
 npm-config-hook.section.md
 npm-install-hook.section.md
+openmp-check-hook.section.md
 patch-rc-path-hooks.section.md
 perl.section.md
 pkg-config.section.md

doc/hooks/openmp-check-hook.section.md

@@ -0,0 +1,10 @@
+# openmpCheckPhaseHook {#setup-hook-omp-check}
+
+
+This hook can be used to setup a check phase that
+requires running a OpenMP application. It mostly
+serves to limit `OMP_NUM_THREADS` to avoid overloading
+build machines.
+
+This hook will not attempt to override an already existing
+definition of `OMP_NUM_THREADS` in the environment.

doc/languages-frameworks/javascript.section.md

@@ -305,7 +305,7 @@ This package puts the corepack wrappers for pnpm and yarn in your PATH, and they
 
 ### pnpm {#javascript-pnpm}
 
-pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_8`, `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions.
+pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions.
 
 When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` will prepare the build environment to install the pre-fetched dependencies store. Here is an example for a package that contains `package.json` and a `pnpm-lock.yaml` files using the fetcher and setup hook above:
 

doc/redirects.json

@@ -2920,8 +2920,7 @@
   "setup-hook-mpi-check": [
     "index.html#setup-hook-mpi-check"
   ],
-  "setup-hook-check-phase-thread-limit": [
-    "index.html#setup-hook-check-phase-thread-limit",
+  "setup-hook-omp-check": [
     "index.html#setup-hook-omp-check"
   ],
   "ninja": [

doc/release-notes/rl-2611.section.md

@@ -31,9 +31,6 @@
   By the time of this release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
   We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
 
-- `bundlerApp` now sets `__structuredAttrs = true` for its result package.
-  Out-of-tree packages passing `postBuild` to `bundlerApp` should examine if their `postBuild` commands are compatible with structured attributes.
-
 - `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
 
 - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.

doc/style.css

@@ -114,7 +114,7 @@ html {
 body {
   font-size: 1rem;
   font-family: "Roboto", sans-serif;
-  font-weight: 300;
+  font-weight: 400;
   color: var(--main-text-color);
   background-color: var(--background);
   min-height: 100vh;
@@ -184,59 +184,52 @@ hr {
   margin-bottom: 1rem;
 }
 
-h1 {
+h1,
+h2,
+h3,
+h4,
+h5,
+h6 {
   font-weight: 800;
-  line-height: 110%;
-  font-size: 200%;
-  margin-bottom: 1rem;
+  line-height: 1.1;
+  margin: 1.5rem 0 0.5rem;
+}
+
+/*
+  Major-second scale see: https://typescale.com/
+  rounded to .025rem (0.4px)
+*/
+h1 {
+  font-size: 2rem;
   color: var(--heading-color);
 }
 
 h2 {
-  font-weight: 800;
-  line-height: 110%;
-  font-size: 170%;
-  margin-bottom: 0.625rem;
+  font-size: 1.8rem;
   color: var(--heading-color);
 }
 
-h2:not(:first-child) {
-  margin-top: 1rem;
-}
-
 h3 {
-  font-weight: 800;
-  line-height: 110%;
-  margin-bottom: 1rem;
-  font-size: 150%;
+  font-size: 1.6rem;
   color: var(--heading-color);
 }
 
-:is(.note, .tip, .warning, .caution, .important) h3 {
-  font-size: 120%;
-}
-
 h4 {
-  font-weight: 800;
-  line-height: 110%;
-  margin-bottom: 1rem;
-  font-size: 140%;
+  font-size: 1.425rem;
   color: var(--heading-color);
 }
 
 h5 {
-  font-weight: 800;
-  line-height: 110%;
-  margin-bottom: 1rem;
-  font-size: 130%;
+  font-size: 1.275rem;
   color: var(--small-heading-color);
 }
 
 h6 {
-  font-weight: 800;
-  line-height: 110%;
-  margin-bottom: 1rem;
-  font-size: 120%;
+  font-size: 1.125rem;
+}
+
+:is(.note, .tip, .warning, .caution, .important) h3 {
+  font-size: 1.425rem;
 }
 
 strong {
@@ -264,13 +257,9 @@ code {
 }
 
 code {
-  color: #ff8657;
-  background: #f4f4f4;
-  display: inline-block;
-  padding: 0 0.5rem;
-  border: 1px solid #d8d8d8;
-  border-radius: 0.5rem;
-  line-height: 1.57777778;
+  padding: 0.2em 0.4em;
+  background: var(--inline-code-background);
+  border-radius: 0.375rem;
 }
 
 div.book .programlisting,
@@ -330,11 +319,6 @@ div.appendix .programlisting {
   background: var(--caution-background);
 }
 
-div.book .section,
-div.appendix .section {
-  margin-top: 2em;
-}
-
 div.book div.example,
 div.appendix div.example {
   margin-top: 1.5em;
@@ -378,11 +362,6 @@ div.appendix dt {
 
 div.book code,
 div.appendix code {
-  padding: 0;
-  border: 0;
-  background-color: inherit;
-  color: inherit;
-  font-size: 100%;
   -webkit-hyphens: none;
   -moz-hyphens: none;
   hyphens: none;
@@ -441,6 +420,7 @@ div.appendix .variablelist .term {
   --caution-background: #ffebe8;
   --codeblock-background: #f2f8fd;
   --codeblock-text-color: #000;
+  --inline-code-background: #818b981f;
 }
 
 @media (prefers-color-scheme: dark) {
@@ -466,6 +446,7 @@ div.appendix .variablelist .term {
     --caution-background: #422522;
     --codeblock-background: #393939;
     --codeblock-text-color: #fff;
+    --inline-code-background: #656c7633;
   }
 
   :is(.note, .tip, .warning, .caution, .important) {
@@ -476,7 +457,12 @@ div.appendix .variablelist .term {
 
 @font-face {
   font-family: Roboto;
-  src: url(Roboto.ttf);
+  src:
+    url(Roboto.ttf) format("truetype") tech(variations),
+    url(Roboto.ttf) format("truetype-variations");
+  font-weight: 100 900;
+  font-style: normal;
+  font-display: swap;
 }
 
 .chapter {

lib/licenses/licenses.nix

@@ -1052,6 +1052,11 @@ lib.mapAttrs mkLicense (
       fullName = "MIT License";
     };
 
+    mit-click = {
+      spdxId = "MIT-Click";
+      fullName = "MIT Click License";
+    };
+
     mit-cmu = {
       spdxId = "MIT-CMU";
       fullName = "CMU License";

lib/services/service.nix

@@ -6,6 +6,7 @@
 # The module
 {
   lib,
+  config,
   ...
 }:
 let
@@ -49,6 +50,53 @@ in
           a shell script or `importas` from `pkgs.execline`.
         '';
       };
+
+      reloadSignal = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "HUP";
+        description = ''
+          Configures the reload signal to send to the service manager.
+        '';
+      };
+
+      reloadCommand = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = lib.literalExpression ''"''${pkgs.coreutils}/bin/kill -HUP $MAINPID"'';
+
+        description = ''
+          Command used for reloading in the underlying service manager to reload.
+        '';
+      };
+    };
+
+    notificationProtocol = mkOption {
+      type = types.listOf (
+        types.enum [
+          "systemd"
+          "s6"
+        ]
+      );
+
+      default = [ ];
+      apply = v: lib.unique v;
+      description = ''
+        Notification protocol that this service supports with the underlying service manager.
+      '';
     };
   };
+
+  config = {
+    assertions = [
+      {
+        assertion = config.process.reloadSignal != null && config.process.reloadCommand != null;
+        message = "reloadSignal conflicts with reloadCommand. Please either use reloadSignal or reloadCommand.";
+      }
+    ];
+
+    process.reloadCommand = (lib.mkIf config.process.reloadSignal != null) (
+      lib.mkForce "${pkgs.coreutils}/bin/kill -${config.process.reloadSignal} $MAINPID"
+    );
+  };
 }

maintainers/maintainer-list.nix

@@ -209,6 +209,12 @@
     github = "2hexed";
     githubId = 54501296;
   };
+  _2zqa = {
+    name = "Marijn Kok";
+    email = "hkju4b4ds@mozmail.com";
+    github = "2zqa";
+    githubId = 25235249;
+  };
   _30350n = {
     name = "Max Schlecht";
     github = "30350n";
@@ -257,11 +263,10 @@
     name = "Eske Nielsen";
   };
   _4evy = {
-    name = "_4evy";
-    email = "git@ps1.sh";
-    github = "_4evy";
+    name = "4evy";
+    email = "git@evy.pink";
+    github = "4evy";
     githubId = 57304299;
-    matrix = "@donteatoreo:matrix.org";
   };
   _4r7if3x = {
     email = "the.artifex@proton.me";
@@ -7031,12 +7036,6 @@
     github = "DimitarNestorov";
     githubId = 8790386;
   };
-  diniamo = {
-    name = "diniamo";
-    email = "diniamo53@gmail.com";
-    github = "diniamo";
-    githubId = 55629891;
-  };
   diogomdp = {
     email = "me@diogodp.dev";
     github = "diogomdp";
@@ -7742,6 +7741,7 @@
     name = "EarthGman";
     github = "EarthGman";
     githubId = 117403037;
+    keys = [ { fingerprint = "A06C 1E72 4626 7B4C EE16  CC2E 4862 31CD BCE3 AA32"; } ];
   };
   EBADBEEF = {
     name = "EBADBEEF";
@@ -15381,7 +15381,7 @@
   };
   lactose = {
     name = "lactose";
-    email = "lactose@allthingslinux.com";
+    email = "mail@lactose.dev";
     github = "juuyokka";
     githubId = 15185244;
   };
@@ -17820,6 +17820,12 @@
       { fingerprint = "838A FE0D 55DC 074E 360F  943A 84B6 9CE6 F3F6 B767"; }
     ];
   };
+  mcuste = {
+    email = "github@muratcanuste.com";
+    github = "mcuste";
+    githubId = 10829864;
+    name = "Murat Can Üste";
+  };
   mcwitt = {
     email = "mcwitt@gmail.com";
     github = "mcwitt";
@@ -18802,6 +18808,12 @@
     githubId = 830082;
     name = "Nathan Moos";
   };
+  mootfrost = {
+    email = "hello@mootfrost.dev";
+    github = "mootfrost";
+    githubId = 75925945;
+    name = "Andrew Semeykin";
+  };
   moraxyc = {
     name = "Moraxyc Xu";
     email = "i@qaq.li";
@@ -25596,12 +25608,6 @@
     githubId = 106669955;
     name = "Léon Gessner";
   };
-  shardy = {
-    email = "shardul@baral.ca";
-    github = "shardulbee";
-    githubId = 16765155;
-    name = "Shardul Baral";
-  };
   sharpchen = {
     github = "sharpchen";
     githubId = 77432836;
@@ -27266,6 +27272,11 @@
     githubId = 203195;
     name = "Szczyp";
   };
+  szhekpisov = {
+    github = "szhekpisov";
+    githubId = 87662520;
+    name = "Sergei Zhekpisov";
+  };
   szkiba = {
     email = "iszkiba@gmail.com";
     github = "szkiba";

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -81,6 +81,8 @@
 
 - When Avahi's mDNS resolver is enabled (`services.avahi.nssmdns4` or `services.avahi.nssmdns6`), only the minimal mDNS resolver is enabled by default to avoid adding a 5 second delay to every failed reverse hostname lookup (e.g., delaying ping by 5 seconds). The "full" mDNS resolver now remains disabled unless `services.avahi.nssmdnsFull` is also enabled. Users who have customized [`/etc/mdns.allow`](https://github.com/avahi/nss-mdns/tree/master#etcmdnsallow) to allow mDNS domains not ending `.local` must enable `services.avahi.nssmdnsFull` to continue to resolve such domains.
 
+- String values passed to `services.phpfpm.settings`, `services.phpfpm.pools.<name>.phpEnv`, and `services.phpfpm.pools.<name>.settings` are now properly quoted and escaped, except for the `${}` syntax that is left as-is. If you are manually escaping these values, please adjust accordingly.
+
 - `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.
 
 - `matrix-appservice-discord` was removed from nixpkgs along with its NixOS module (`services.matrix-appservice-discord`) as it is no longer actively maintained upstream. Use the actively-maintained puppeting bridge [`mautrix-discord`](#opt-services.mautrix-discord.enable) instead.
@@ -99,6 +101,9 @@
 
 - `komodo` has been updated to the v2 release line (2.x). See the [upstream v1 → v2 upgrade guide](https://github.com/moghtech/komodo/releases/tag/v2.0.0).
 
+- `temporal` has been updated to the 1.31 release line. Always consult the [upstream upgrade
+  notes](https://docs.temporal.io/self-hosted-guide/upgrade-server) before upgrading between versions.
+
 - The `shell_interact()` function on interactive runs of NixOS VM tests has been deprecated. Use the SSH backdoor instead.
 
 - [services.netbox](#opt-services.netbox.enable) has received a number of updates:
@@ -134,3 +139,10 @@
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.
 
 - `zoneminder` has been updated to 1.38.x release. See [upstream release note](https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.0). While database migration should happen automatically, it's recommended that you make a backup of the database before upgrading your system.
+
+- The latest available version of Nextcloud is v34 (available as `pkgs.nextcloud34`). The installation logic is as follows:
+  - If [`services.nextcloud.package`](#opt-services.nextcloud.package) is specified explicitly, this package will be installed (**recommended**)
+  - If `system.stateVersion` is >=26.11, `pkgs.nextcloud34` will be installed by default.
+  - If [`system.stateVersion`](#opt-system.stateVersion) is >=26.05, `pkgs.nextcloud33` will be installed by default.
+  - If [`system.stateVersion`](#opt-system.stateVersion) is >=25.11, `pkgs.nextcloud32` will be installed by default.
+  - Please note that Nextcloud prohibits skipping major versions while upgrading. You can upgrade to specific versions by declaring `services.nextcloud.package = pkgs.nextcloud33;`.

nixos/modules/misc/locate.nix

@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  utils,
   pkgs,
   ...
 }:
@@ -59,7 +60,7 @@ in
     };
 
     output = lib.mkOption {
-      type = lib.types.path;
+      type = lib.types.externalPath;
       default = "/var/cache/locatedb";
       description = ''
         The database file to build.
@@ -249,27 +250,35 @@ in
     systemd.services.update-locatedb = {
       description = "Update Locate Database";
 
-      # mlocate's updatedb takes flags via a configuration file or
-      # on the command line, but not by environment variable.
-      script =
-        let
-          toFlags =
-            x: lib.optional (cfg.${x} != [ ]) "--${lib.toLower x} '${lib.concatStringsSep " " cfg.${x}}'";
-          args = lib.concatLists (
-            map toFlags [
+      serviceConfig = {
+        # mlocate's updatedb takes flags via a configuration file or
+        # on the command line, but not by environment variable.
+        ExecStart =
+          let
+            toFlags =
+              x:
+              lib.optionals (cfg.${x} != [ ]) [
+                "--${lib.toLower x}"
+                (lib.concatStringsSep " " cfg.${x})
+              ];
+            args = lib.concatMap toFlags [
               "pruneFS"
               "pruneNames"
               "prunePaths"
+            ];
+          in
+          utils.escapeSystemdExecArgs (
+            [
+              (lib.getExe' cfg.package "updatedb")
+              "--output"
+              cfg.output
+              "--prune-bind-mounts"
+              (lib.boolToYesNo cfg.pruneBindMounts)
             ]
+            ++ args
+            ++ cfg.extraFlags
           );
-        in
-        ''
-          exec ${cfg.package}/bin/updatedb \
-            --output ${toString cfg.output} ${lib.concatStringsSep " " args} \
-            --prune-bind-mounts ${lib.boolToYesNo cfg.pruneBindMounts} \
-            ${lib.concatStringsSep " " cfg.extraFlags}
-        '';
-      serviceConfig = {
+
         CapabilityBoundingSet = "CAP_DAC_READ_SEARCH CAP_CHOWN";
         Nice = 19;
         IOSchedulingClass = "idle";

nixos/modules/module-list.nix

@@ -821,6 +821,7 @@
   ./services/matrix/mautrix-whatsapp.nix
   ./services/matrix/mjolnir.nix
   ./services/matrix/pantalaimon.nix
+  ./services/matrix/rust-federation-tester.nix
   ./services/matrix/synapse-auto-compressor.nix
   ./services/matrix/synapse.nix
   ./services/matrix/tuwunel.nix

nixos/modules/services/desktops/oo7.nix

@@ -10,32 +10,32 @@ in
 {
   options.services.oo7 = {
     enable = lib.mkEnableOption ''
-      oo7, a service providing the Secret Service D-Bus API.
+      oo7, a service providing the Secret Service D-Bus API
     '';
   };
 
   config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.oo7 ];
     services.dbus.packages = [ pkgs.oo7-server ];
 
-    systemd.packages = [ pkgs.oo7-server ];
+    systemd = {
+      packages = [ pkgs.oo7-server ];
+      user.services.oo7-daemon.wantedBy = [ "default.target" ];
+    };
 
-    systemd.user.services.oo7-daemon.wantedBy = [ "default.target" ];
+    security = {
+      pam.services.login.oo7.enable = true;
+
+      wrappers.oo7-daemon = {
+        owner = "root";
+        group = "root";
+        capabilities = "cap_ipc_lock=ep";
+        source = "${pkgs.oo7-server}/libexec/oo7-daemon";
+      };
+    };
 
     xdg.portal.extraPortals = [ pkgs.oo7-portal ];
-
-    security.pam.services.login.oo7.enable = true;
-
-    security.wrappers.oo7-daemon = {
-      owner = "root";
-      group = "root";
-      capabilities = "cap_ipc_lock=ep";
-      source = "${pkgs.oo7-server}/libexec/oo7-daemon";
-    };
   };
 
-  meta = {
-    inherit (pkgs.oo7.meta)
-      maintainers
-      ;
-  };
+  meta = { inherit (pkgs.oo7.meta) maintainers; };
 }

nixos/modules/services/mail/postsrsd.nix

@@ -281,7 +281,7 @@ in
       environment.etc."postsrsd.conf".source = configFile;
 
       systemd.services.postsrsd = {
-        description = "PostSRSd SRS rewriting server";
+        description = "Sender Rewriting Scheme daemon for Postfix";
         after = [
           "network.target"
           "postsrsd-generate-secrets.service"
@@ -289,14 +289,20 @@ in
         before = [ "postfix.service" ];
         wantedBy = [ "multi-user.target" ];
         requires = [ "postsrsd-generate-secrets.service" ];
-        restartTriggers = [ configFile ];
+        reloadTriggers = [ configFile ];
 
         serviceConfig = {
+          Type = "notify-reload";
           ExecStart = utils.escapeSystemdExecArgs [
             (lib.getExe cfg.package)
             "-C"
             "/etc/postsrsd.conf"
           ];
+          ExecReload = toString [
+            (lib.getExe' pkgs.coreutils "kill")
+            "-SIGHUP"
+            "$MAINPID"
+          ];
           User = cfg.user;
           Group = cfg.group;
           RuntimeDirectory = "postsrsd";
@@ -319,7 +325,7 @@ in
           ProtectKernelModules = true;
           ProtectKernelTunables = true;
           ProtectSystem = "strict";
-          ProtectProc = "invisible";
+          ProtectProc = "noaccess";
           ProcSubset = "pid";
           RemoveIPC = true;
           RestrictAddressFamilies =

nixos/modules/services/matrix/rust-federation-tester.nix

@@ -0,0 +1,153 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+
+let
+  cfg = config.services.rust-federation-tester;
+
+  configFile = "/run/rust-federation-tester/config.yaml";
+  commonServiceConfig = {
+    DynamicUser = true;
+    RuntimeDirectory = "rust-federation-tester";
+    RuntimeDirectoryPreserve = true;
+    StateDirectory = "rust-federation-tester";
+    User = "rust-federation-tester";
+    WorkingDirectory = "%t/rust-federation-tester";
+
+    # Hardening
+    UMask = "0077";
+    CapabilityBoundingSet = [ "" ];
+    DevicePolicy = "closed";
+    PrivateTmp = true;
+    ProtectHome = true;
+    ProtectSystem = "strict";
+    MemoryDenyWriteExecute = true;
+    NoNewPrivileges = true;
+    LockPersonality = true;
+    PrivateDevices = true;
+    PrivateMounts = true;
+    ProcSubset = "pid";
+    ProtectClock = true;
+    ProtectControlGroups = true;
+    ProtectHostname = true;
+    ProtectKernelLogs = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    ProtectProc = "invisible";
+    RemoveIPC = true;
+    RestrictAddressFamilies = [
+      "AF_INET"
+      "AF_INET6"
+      "AF_UNIX"
+    ];
+    RestrictNamespaces = true;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+    SystemCallArchitectures = "native";
+    SystemCallFilter = [
+      "@system-service"
+    ];
+  };
+
+  secretsInjection = utils.genJqSecretsReplacement {
+    loadCredential = true;
+  } cfg.settings configFile;
+in
+{
+  options.services.rust-federation-tester = {
+    enable = lib.mkEnableOption "rust-federation-tester";
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = lib.types.json;
+        options = {
+          frontend_url = lib.mkOption {
+            type = lib.types.str;
+            example = "federation-tester.example.org";
+            description = ''
+              URL of the service's frontend.
+            '';
+          };
+
+          database_url = lib.mkOption {
+            type = lib.types.str;
+            default = "sqlite:///var/lib/rust-federation-tester/db?mode=rwc";
+            example = "postgres://localhost/db?currentSchema=schema";
+            description = ''
+              The database to store accounts and statistics.
+            '';
+          };
+
+          smtp = {
+            enabled = lib.mkEnableOption "mail delivery for configured alerts";
+          };
+
+          listen_addr = lib.mkOption {
+            type = lib.types.str;
+            default = "[::]:8080";
+            example = "unix:/run/rust-federation-tester/rust-federation-tester.sock";
+            description = ''
+              Address the API server should listen on.
+            '';
+          };
+        };
+      };
+
+      description = ''
+        Settings representing the values in {file}`config.yaml` of the service.
+
+        Refer to [`config.yaml.example`] for supported values.
+
+        [`config.yaml.example`]: https://github.com/MTRNord/rust-federation-tester/blob/main/config.yaml.example
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.sockets.rust-federation-tester = {
+      description = "Matrix-Federation-Tester in Rust socket";
+      wantedBy = [ "sockets.target" ];
+      listenStreams = [ (lib.removePrefix "unix:" cfg.settings.listen_addr) ];
+    };
+
+    systemd.services.rust-federation-tester-setup = {
+      description = "Matrix-Federation-Tester in Rust";
+      path = [ pkgs.rust-federation-tester ];
+
+      serviceConfig = lib.mkMerge [
+        commonServiceConfig
+        {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          LoadCredential = secretsInjection.credentials;
+          ExecStart = "${pkgs.writeShellScript "rust-federation-tester-setup" ''
+            ${secretsInjection.script}
+
+            migration up
+          ''}";
+        }
+      ];
+    };
+
+    systemd.services.rust-federation-tester = {
+      description = "Matrix-Federation-Tester in Rust";
+      wantedBy = [ "multi-user.target" ];
+      documentation = [ "https://github.com/MTRNord/rust-federation-tester" ];
+      after = [ "rust-federation-tester-setup.service" ];
+      requires = [ "rust-federation-tester-setup.service" ];
+
+      serviceConfig = lib.mkMerge [
+        commonServiceConfig
+        {
+          ExecSearchPath = lib.makeBinPath [ pkgs.rust-federation-tester ];
+          ExecStart = "rust-federation-tester";
+          Restart = "on-failure";
+        }
+      ];
+    };
+  };
+}

nixos/modules/services/misc/redmine.nix

@@ -245,19 +245,19 @@ in
       };
 
       components = {
-        subversion = lib.mkEnableOption "Subversion integration.";
+        subversion = lib.mkEnableOption "Subversion integration";
 
-        mercurial = lib.mkEnableOption "Mercurial integration.";
+        mercurial = lib.mkEnableOption "Mercurial integration";
 
-        git = lib.mkEnableOption "git integration.";
+        git = lib.mkEnableOption "git integration";
 
-        cvs = lib.mkEnableOption "cvs integration.";
+        cvs = lib.mkEnableOption "cvs integration";
 
-        breezy = lib.mkEnableOption "bazaar integration.";
+        breezy = lib.mkEnableOption "bazaar integration";
 
-        imagemagick = lib.mkEnableOption "exporting Gant diagrams as PNG.";
+        imagemagick = lib.mkEnableOption "exporting Gant diagrams as PNG";
 
-        ghostscript = lib.mkEnableOption "exporting Gant diagrams as PDF.";
+        ghostscript = lib.mkEnableOption "exporting Gant diagrams as PDF";
 
         minimagick_font_path = lib.mkOption {
           type = lib.types.str;
@@ -265,6 +265,8 @@ in
           description = "MiniMagick font path";
           example = "/run/current-system/sw/share/X11/fonts/LiberationSans-Regular.ttf";
         };
+
+        pandoc = lib.mkEnableOption "pandoc integration for previewing LibreOffice and Microsoft Office documents";
       };
     };
   };
@@ -310,6 +312,7 @@ in
         imagemagick_convert_command = lib.optionalString cfg.components.imagemagick "${pkgs.imagemagick}/bin/convert";
         gs_command = lib.optionalString cfg.components.ghostscript "${pkgs.ghostscript}/bin/gs";
         minimagick_font_path = "${cfg.components.minimagick_font_path}";
+        pandoc_command = lib.optionalString cfg.components.pandoc "${pkgs.pandoc}/bin/pandoc";
       };
     };
 

nixos/modules/services/misc/shoko.nix

@@ -90,8 +90,5 @@ in
     };
   };
 
-  meta.maintainers = with lib.maintainers; [
-    diniamo
-    nanoyaki
-  ];
+  meta.maintainers = with lib.maintainers; [ nanoyaki ];
 }

nixos/modules/services/network-filesystems/nfsd.nix

@@ -6,6 +6,14 @@
 }:
 let
 
+  attrsToExports = lib.concatMapAttrsStringSep "\n" (
+    exportPoint: clientsAndOptions:
+    exportPoint
+    + lib.concatMapAttrsStringSep "" (
+      client: options: " ${client}(${lib.concatStringsSep "," options})"
+    ) clientsAndOptions
+  );
+
   cfg = config.services.nfs.server;
 
   exports = pkgs.writeText "exports" cfg.exports;
@@ -48,12 +56,26 @@ in
         };
 
         exports = lib.mkOption {
-          type = lib.types.lines;
+          type = with lib.types; coercedTo (attrsOf (attrsOf (listOf str))) attrsToExports lines;
           default = "";
           description = ''
             Contents of the /etc/exports file.  See
             {manpage}`exports(5)` for the format.
           '';
+          example = {
+            "/usr" = {
+              "*.local.domain" = [ "ro" ];
+              "@trusted" = [ "rw" ];
+            };
+            "/home/joe" = {
+              "pc001" = [
+                "rw"
+                "all_squash"
+                "anonuid=150"
+                "anongid=100"
+              ];
+            };
+          };
         };
 
         hostName = lib.mkOption {

nixos/modules/services/networking/syncthing.nix

@@ -25,10 +25,10 @@ let
     if
       isUnixGui
     # if cfg.guiAddress is a unix socket, tell curl explicitly about it
-    # note that the dot in front of `${path}` is the hostname, which is
+    # note that the syncthing.local in front of `${path}` is the hostname, which is
     # required.
     then
-      "--unix-socket ${lib.strings.removePrefix "unix://" cfg.guiAddress} http://.${path}"
+      "--unix-socket ${lib.strings.removePrefix "unix://" cfg.guiAddress} http://syncthing.local${path}"
     # no adjustments are needed if cfg.guiAddress is a network address
     else
       "${cfg.guiAddress}${path}";

nixos/modules/services/ttys/getty.nix

@@ -76,6 +76,24 @@ in
         '';
       };
 
+      enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Include getty in the system.
+
+          getty is quiescent until called into action and does not have
+          runtime costs if it is not used. The benefit of disabling it is
+          in reducing closure size.
+
+          Disabling getty means that console login may not be possible,
+          `machinectl shell` and `login` may not work, and other ills.
+          It is only recommended for lights-out, headless containers,
+          appliances, and similar configurations not meant for any human
+          interaction ever.
+        '';
+      };
+
       loginProgram = mkOption {
         type = types.path;
         default = "${pkgs.shadow}/bin/login";
@@ -133,7 +151,7 @@ in
 
   ###### implementation
 
-  config = {
+  config = mkIf cfg.enable {
     # Note: this is set here rather than up there so that changing
     # nixos.label would not rebuild manual pages
     services.getty.greetingLine = mkDefault ''<<< Welcome to ${config.system.nixos.distroName} ${config.system.nixos.label} (\m) - \l >>>'';

nixos/modules/services/web-apps/lasuite-meet.nix

@@ -50,7 +50,6 @@ let
     environment = pythonEnvironment;
 
     serviceConfig = {
-      RuntimeDirectory = "lasuite-meet";
       StateDirectory = "lasuite-meet";
       WorkingDirectory = "/var/lib/lasuite-meet";
 
@@ -382,6 +381,8 @@ in
         '';
 
         serviceConfig = {
+          # needs to be here so that cronjobs don't nuke it
+          RuntimeDirectory = "lasuite-meet";
           BindReadOnlyPaths = "${cfg.package}/share/static:/var/lib/lasuite-meet/static";
 
           ExecStart = utils.escapeSystemdExecArgs (

nixos/modules/services/web-apps/nextcloud.md

@@ -5,7 +5,7 @@ self-hostable cloud platform. The server setup can be automated using
 [services.nextcloud](#opt-services.nextcloud.enable). A
 desktop client is packaged at `pkgs.nextcloud-client`.
 
-The current default by NixOS is `nextcloud33` which is also the latest
+The current default by NixOS is `nextcloud34` which is also the latest
 major version available.
 
 ## Basic usage {#module-services-nextcloud-basic-usage}

nixos/modules/services/web-apps/nextcloud.nix

@@ -467,6 +467,7 @@ in
       relatedPackages = [
         "nextcloud32"
         "nextcloud33"
+        "nextcloud34"
       ];
     };
     phpPackage = lib.mkPackageOption pkgs "php" {
@@ -1195,7 +1196,7 @@ in
       {
         warnings =
           let
-            latest = 33;
+            latest = 34;
             upgradeWarning = major: nixos: ''
               A legacy Nextcloud install (from before NixOS ${nixos}) may be installed.
 
@@ -1228,7 +1229,8 @@ in
           ++ (lib.optional (lib.versionOlder cfg.package.version "30") (upgradeWarning 29 "24.11"))
           ++ (lib.optional (lib.versionOlder cfg.package.version "31") (upgradeWarning 30 "25.05"))
           ++ (lib.optional (lib.versionOlder cfg.package.version "32") (upgradeWarning 31 "25.11"))
-          ++ (lib.optional (lib.versionOlder cfg.package.version "33") (upgradeWarning 32 "26.05"));
+          ++ (lib.optional (lib.versionOlder cfg.package.version "33") (upgradeWarning 32 "26.05"))
+          ++ (lib.optional (lib.versionOlder cfg.package.version "34") (upgradeWarning 33 "26.11"));
 
         services.nextcloud.package = lib.mkDefault (
           if pkgs ? nextcloud then
@@ -1241,8 +1243,10 @@ in
             pkgs.nextcloud31
           else if lib.versionOlder stateVersion "26.05" then
             pkgs.nextcloud32
-          else
+          else if lib.versionOlder stateVersion "26.11" then
             pkgs.nextcloud33
+          else
+            pkgs.nextcloud34
         );
 
         services.nextcloud.phpOptions = lib.mkMerge [

nixos/modules/services/web-servers/nginx/default.nix

@@ -1617,6 +1617,7 @@ in
           MemoryDenyWriteExecute =
             !(
               (builtins.any (mod: (mod.allowMemoryWriteExecute or false)) cfg.package.modules)
+              || cfg.lua.enable
               || (cfg.package == pkgs.openresty)
             );
           RestrictRealtime = true;

nixos/modules/services/web-servers/phpfpm/default.nix

@@ -18,6 +18,15 @@ let
       "yes"
     else if false == value then
       "no"
+    else if isString value then
+      # Escape according to https://www.php.net/manual/en/function.parse-ini-file.php
+      # Not escaping `$` since users might want to use that to interpolate environment variables.
+      # Additionally, php-fpm applies post-processing to env values that start with `$` and replaces
+      # them with the respective env variable, with no way to escape: https://github.com/php/php-src/blob/631c366f9f58c8ba4078a48d1f56187cfbf8e549/sapi/fpm/fpm/fpm_env.c#L171-L180
+      # In all platforms except for Windows, PHP_EOL is the line feed `\n` character,
+      # which we use here as an escape value since php-fpm parses the config line-by-line.
+      # See https://github.com/NixOS/nixpkgs/pull/516530#issuecomment-4878738511 for more information.
+      ''"${replaceString "\n" ''" PHP_EOL "'' (escape [ "\"" "\\" ] value)}"''
     else
       toString value;
 

nixos/modules/services/x11/desktop-managers/mate.nix

@@ -141,6 +141,10 @@ in
       services.libinput.enable = mkDefault true;
 
       security.pam.services.mate-screensaver.unixAuth = true;
+      security.polkit = {
+        enable = true;
+        enablePkexecWrapper = mkDefault true;
+      };
 
       xdg.portal.configPackages = mkDefault [ pkgs.mate-desktop ];
 

nixos/modules/system/service/systemd/service.nix

@@ -113,6 +113,48 @@ in
       defaultText = lib.literalExpression "config.systemd.lib.escapeSystemdExecArgs config.process.argv";
     };
 
+    systemd.mainExecReload = mkOption {
+      description = ''
+        Main command line for systemd's ExecReload with systemd's specifier and
+        environment variable substitution enabled.
+
+        This option sets the primary ExecRestart entry. Additional ExecReload entries
+        can be added via `systemd.service.serviceConfig.ExecReload` with `lib.mkBefore`
+        or `lib.mkAfter`.
+
+        This option allows you to use systemd specifiers like `%n` (unit name),
+        `%i` (instance), `%t` (runtime directory), and environment variables using
+        `''${VAR}` syntax in your command line.
+
+        By default, it is either set to null or this is set to the escaped version of {option}`process.reloadCommand`
+        when specified to prevent systemd substitution. Set this option explicitly to enable
+        systemd's substitution features.
+
+        To extend {option}`process.reloadCommand` with systemd specifiers, you can append
+        to the escaped arguments:
+
+        ```nix
+        systemd.mainExecReload =
+          config.systemd.lib.escapeSystemdExecArgs config.process.reload + " --systemd-unit %n";
+        ```
+
+        This pattern allows you to pass the unit name (or other systemd specifiers)
+        as additional arguments while keeping the base command from {option}`process.argv`
+        properly escaped.
+
+        See {manpage}`systemd.service(5)` (section "COMMAND LINES") for details on
+        variable substitution and {manpage}`systemd.unit(5)` (section "SPECIFIERS")
+        for available specifiers like `%n`, `%i`, `%t`.
+      '';
+      type = types.nullOr types.str;
+      default =
+        if config.process.reloadCommand then
+          config.systemd.lib.escapeSystemdExecArgs config.process.reloadCommand
+        else
+          "";
+      defaultText = lib.literalExpression "config.systemd.lib.escapeSystemdExecArgs config.process.reloadCommand";
+    };
+
     systemd.services = mkOption {
       description = ''
         This module configures systemd services, with the notable difference that their unit names will be prefixed with the abstract service name.
@@ -170,7 +212,10 @@ in
       # TODO description;
       wantedBy = lib.mkDefault [ "multi-user.target" ];
       serviceConfig = {
-        Type = lib.mkDefault "simple";
+        ExecReload = config.systemd.mainExecReload;
+        Type = lib.mkDefault (
+          if (config.serviceManager.notificationProtocol == "systemd") then "notify" else "simple"
+        );
         Restart = lib.mkDefault "always";
         RestartSec = lib.mkDefault "5";
         ExecStart = [

nixos/tests/all-tests.nix

@@ -1005,7 +1005,6 @@ in
   matrix-conduit = runTest ./matrix/conduit.nix;
   matrix-continuwuity = runTest ./matrix/continuwuity.nix;
   matrix-synapse = runTest ./matrix/synapse.nix;
-  matrix-synapse-workers = runTest ./matrix/synapse-workers.nix;
   matrix-tuwunel = runTest ./matrix/tuwunel.nix;
   matter-server = runTest ./matter-server.nix;
   matterjs-server = runTest ./matterjs-server.nix;

nixos/tests/matrix/continuwuity.nix

@@ -20,61 +20,66 @@ in
       };
       networking.firewall.allowedTCPPorts = [ 6167 ];
     };
+
     client =
       { pkgs, ... }:
       {
         environment.systemPackages = [
-          (pkgs.writers.writePython3Bin "do_test" { libraries = [ pkgs.python3Packages.matrix-nio ]; } ''
+          (pkgs.writers.writePython3Bin "do_test" { libraries = [ pkgs.python3Packages.mautrix ]; } ''
             import asyncio
-            import nio
+
+            from mautrix.client import Client
+            from mautrix.types import EventType, RoomFilter
 
 
             async def main() -> None:
                 # Connect to continuwuity
-                client = nio.AsyncClient("http://continuwuity:6167", "${user}")
+                client = Client(
+                    mxid="@${user}:${name}",
+                    base_url="http://continuwuity:6167",
+                )
 
                 # Log in as user alice
-                response = await client.login("${pass}")
+                await client.login(password="${pass}")
 
                 # Create a new room
-                response = await client.room_create(federate=False)
-                print("Matrix room create response:", response)
-                assert isinstance(response, nio.RoomCreateResponse)
-                room_id = response.room_id
+                room_id = await client.create_room()
+                print("Created room:", room_id)
 
                 # Join the room
-                response = await client.join(room_id)
-                print("Matrix join response:", response)
-                assert isinstance(response, nio.JoinResponse)
+                await client.join_room_by_id(room_id)
+                print("Joined room")
 
                 # Send a message to the room
-                response = await client.room_send(
-                    room_id=room_id,
-                    message_type="m.room.message",
-                    content={
-                        "msgtype": "m.text",
-                        "body": "Hello continuwuity!"
-                    }
-                )
-                print("Matrix room send response:", response)
-                assert isinstance(response, nio.RoomSendResponse)
+                received = asyncio.Event()
+                msg = "Hello continuwuity!"
 
-                # Sync responses
-                response = await client.sync(timeout=30000)
-                print("Matrix sync response:", response)
-                assert isinstance(response, nio.SyncResponse)
+                async def on_message(evt):
+                    if (
+                        evt.room_id != room_id
+                        or evt.sender != client.mxid
+                        or evt.type != EventType.ROOM_MESSAGE
+                    ):
+                        return
 
-                # Check the message was received by continuwuity
-                last_message = response.rooms.join[room_id].timeline.events[-1].body
-                assert last_message == "Hello continuwuity!"
+                    assert evt.content.body == msg
+                    received.set()
+
+                client.add_event_handler(EventType.ROOM_MESSAGE, on_message)
+                sync_task = client.start(RoomFilter(rooms=[room_id]))
+
+                await client.send_text(room_id, msg)
+
+                # Sync until message is received
+                await asyncio.wait_for(received.wait(), timeout=30)
 
                 # Leave the room
-                response = await client.room_leave(room_id)
-                print("Matrix room leave response:", response)
-                assert isinstance(response, nio.RoomLeaveResponse)
+                await client.leave_room(room_id)
+                print("Left room")
 
                 # Close the client
-                await client.close()
+                client.stop()
+                await sync_task
 
 
             if __name__ == "__main__":
@@ -96,6 +101,7 @@ in
   '';
 
   meta.maintainers = with lib.maintainers; [
+    bartoostveen
     nyabinary
     snaki
   ];

nixos/tests/matrix/synapse-workers.nix

@@ -1,53 +0,0 @@
-{ pkgs, ... }:
-{
-  name = "matrix-synapse-workers";
-  meta = {
-    inherit (pkgs.matrix-synapse.meta) maintainers;
-  };
-
-  nodes = {
-    homeserver =
-      {
-        pkgs,
-        nodes,
-        ...
-      }:
-      {
-        services.postgresql = {
-          enable = true;
-          initialScript = pkgs.writeText "synapse-init.sql" ''
-            CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
-            CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
-            TEMPLATE template0
-            LC_COLLATE = "C"
-            LC_CTYPE = "C";
-          '';
-        };
-
-        services.matrix-synapse = {
-          enable = true;
-          settings = {
-            database = {
-              name = "psycopg2";
-              args.password = "synapse";
-            };
-            enable_registration = true;
-            enable_registration_without_verification = true;
-
-            federation_sender_instances = [ "federation_sender" ];
-          };
-          configureRedisLocally = true;
-          workers = {
-            "federation_sender" = { };
-          };
-        };
-      };
-  };
-
-  testScript = ''
-    start_all()
-
-    homeserver.wait_for_unit("matrix-synapse.service");
-    homeserver.wait_for_unit("matrix-synapse-worker-federation_sender.service");
-  '';
-}

nixos/tests/matrix/synapse.nix

@@ -1,101 +1,194 @@
 { pkgs, ... }:
 let
-
   ca_key = mailerCerts.ca.key;
   ca_pem = mailerCerts.ca.cert;
 
-  bundle =
-    pkgs.runCommand "bundle"
+  aliceName = "alice";
+  alicePassword = "alicealice";
+  aliceEmail = "alice@example.com";
+
+  bobName = "bob";
+  bobPassword = "hunter2";
+
+  mkBundle =
+    domain:
+    pkgs.runCommand "bundle-${domain}"
       {
         nativeBuildInputs = [ pkgs.minica ];
       }
       ''
         minica -ca-cert ${ca_pem} -ca-key ${ca_key} \
-          -domains localhost
-        install -Dm444 -t $out localhost/{key,cert}.pem
+          -domains ${domain}
+        install -Dm444 -t $out ${domain}/{key,cert}.pem
       '';
 
   mailerCerts = import ../common/acme/server/snakeoil-certs.nix;
   mailerDomain = mailerCerts.domain;
   registrationSharedSecret = "unsecure123";
-  testUser = "alice";
-  testPassword = "alicealice";
-  testEmail = "alice@example.com";
 
-  listeners = [
+  anonHash = "hunter2hunter2hunter2";
+  anonHashF = pkgs.writeText "hash" anonHash;
+
+  mkHomeserverBase =
+    domain: nodes:
+    let
+      bundle = mkBundle domain;
+    in
+    { lib, ... }:
     {
-      port = 8448;
-      bind_addresses = [
-        "127.0.0.1"
-        "::1"
+      security.pki.certificateFiles = [
+        mailerCerts.ca.cert
       ];
-      type = "http";
-      tls = true;
-      x_forwarded = false;
-      resources = [
-        {
-          names = [
-            "client"
-          ];
-          compress = true;
-        }
-        {
-          names = [
-            "federation"
-          ];
-          compress = false;
-        }
-      ];
-    }
-  ];
 
+      networking = {
+        hostName = lib.head (lib.strings.splitString "." domain);
+        domain = lib.last (lib.strings.splitString "." domain);
+        firewall.allowedTCPPorts = [
+          80
+          443
+          8448
+        ];
+      };
+
+      services.nginx = {
+        enable = true;
+        virtualHosts."${domain}" = {
+          sslCertificate = "${bundle}/cert.pem";
+          sslCertificateKey = "${bundle}/key.pem";
+          addSSL = true;
+          locations."/.well-known/matrix/server".extraConfig = ''
+            default_type application/json;
+            return 200 '${
+              builtins.toJSON {
+                "m.server" = "${domain}:8448";
+              }
+            }';
+          '';
+        };
+      };
+    };
+
+  mkSynapseConfig =
+    domain: primaryIP:
+    let
+      bundle = mkBundle domain;
+    in
+    {
+      enable = true;
+      settings = {
+        # We're in a test environment with local machines, so
+        # we actually _want_ to use RFC1918 addresses.
+        ip_range_blacklist = [ ];
+
+        trusted_key_servers = [
+          { server_name = "hs1.test"; }
+          { server_name = "hs2.test"; }
+        ];
+
+        registration_shared_secret = registrationSharedSecret;
+        public_baseurl = "https://${domain}";
+        tls_certificate_path = "${bundle}/cert.pem";
+        tls_private_key_path = "${bundle}/key.pem";
+        listeners = [
+          # Using a local listener, otherwise matrix-synapse-register_new_matrix_user will
+          # fail because it'll try to connect to the first bind address, but via TLS resulting
+          # in a signature verification failure.
+          {
+            port = 8008;
+            type = "http";
+            tls = false;
+            resources = [
+              {
+                names = [ "client" ];
+                compress = true;
+              }
+            ];
+            bind_addresses = [ "::1" ];
+          }
+          {
+            port = 8448;
+            bind_addresses = [
+              primaryIP
+            ];
+            type = "http";
+            tls = true;
+            x_forwarded = false;
+            resources = [
+              {
+                names = [
+                  "client"
+                ];
+                compress = true;
+              }
+              {
+                names = [
+                  "federation"
+                ];
+                compress = false;
+              }
+            ];
+          }
+        ];
+      };
+    };
 in
 {
-
   name = "matrix-synapse";
   meta = {
     inherit (pkgs.matrix-synapse.meta) maintainers;
   };
 
   nodes = {
-    # Since 0.33.0, matrix-synapse doesn't allow underscores in server names
-    serverpostgres =
+    synapse-with-workers =
       {
+        lib,
+        config,
         pkgs,
         nodes,
-        config,
         ...
       }:
-      let
-        mailserverIP = nodes.mailserver.networking.primaryIPAddress;
-      in
       {
-        services.matrix-synapse = {
-          enable = true;
-          settings = {
-            inherit listeners;
-            database = {
-              name = "psycopg2";
-              args.password = "synapse";
+        imports = [
+          (mkHomeserverBase "hs1.test" nodes)
+        ];
+
+        services.matrix-synapse = lib.mkMerge [
+          (mkSynapseConfig "hs1.test" config.networking.primaryIPAddress)
+          {
+            settings = {
+              server_name = "hs1.test";
+              email = {
+                smtp_host = mailerDomain;
+                smtp_port = 25;
+                require_transport_security = true;
+                notif_from = "matrix <matrix@${mailerDomain}>";
+                app_name = "Matrix";
+              };
+              listeners = [
+                {
+                  path = "/run/matrix-synapse/main_replication.sock";
+                  type = "http";
+                  resources = [
+                    {
+                      names = [ "replication" ];
+                      compress = false;
+                    }
+                  ];
+                }
+              ];
+              database = {
+                name = "psycopg2";
+                args.password = "synapse";
+              };
+              federation_sender_instances = [ "federation_sender" ];
             };
-            redis = {
-              enabled = true;
-              host = "localhost";
-              port = config.services.redis.servers.matrix-synapse.port;
+            configureRedisLocally = true;
+            workers = {
+              "federation_sender" = { };
             };
-            tls_certificate_path = "${bundle}/cert.pem";
-            tls_private_key_path = "${bundle}/key.pem";
-            registration_shared_secret = registrationSharedSecret;
-            public_baseurl = "https://example.com";
-            email = {
-              smtp_host = mailerDomain;
-              smtp_port = 25;
-              require_transport_security = true;
-              notif_from = "matrix <matrix@${mailerDomain}>";
-              app_name = "Matrix";
-            };
-          };
-        };
+          }
+        ];
+
         services.postgresql = {
           enable = true;
 
@@ -113,20 +206,6 @@ in
           '';
         };
 
-        services.redis.servers.matrix-synapse = {
-          enable = true;
-          port = 6380;
-        };
-
-        networking.extraHosts = ''
-          ${mailserverIP} ${mailerDomain}
-        '';
-
-        security.pki.certificateFiles = [
-          mailerCerts.ca.cert
-          ca_pem
-        ];
-
         environment.systemPackages =
           let
             sendTestMailStarttls = pkgs.writeScriptBin "send-testmail-starttls" ''
@@ -140,7 +219,7 @@ in
                 smtp.ehlo()
                 smtp.starttls(context=ctx)
                 smtp.ehlo()
-                smtp.sendmail('matrix@${mailerDomain}', '${testEmail}', 'Subject: Test STARTTLS\n\nTest data.')
+                smtp.sendmail('matrix@${mailerDomain}', '${aliceEmail}', 'Subject: Test STARTTLS\n\nTest data.')
                 smtp.quit()
             '';
 
@@ -149,16 +228,14 @@ in
                 # adding the email through the API is quite complicated as it involves more than one step and some
                 # client-side calculation
                 insertEmailForAlice = pkgs.writeText "alice-email.sql" ''
-                  INSERT INTO user_threepids (user_id, medium, address, validated_at, added_at) VALUES ('${testUser}@serverpostgres', 'email', '${testEmail}', '1629149927271', '1629149927270');
+                  INSERT INTO user_threepids (user_id, medium, address, validated_at, added_at) VALUES ('${aliceName}@serverpostgres', 'email', '${aliceEmail}', '1629149927271', '1629149927270');
                 '';
               in
               pkgs.writeScriptBin "obtain-token-and-register-email" ''
                 #!${pkgs.runtimeShell}
-                set -o errexit
-                set -o pipefail
-                set -o nounset
+                set -euxo pipefail
                 su postgres -c "psql -d matrix-synapse -f ${insertEmailForAlice}"
-                curl --fail -XPOST 'https://localhost:8448/_matrix/client/r0/account/password/email/requestToken' -d '{"email":"${testEmail}","client_secret":"foobar","send_attempt":1}' -v
+                curl --fail -XPOST 'https://hs1.test:8448/_matrix/client/r0/account/password/email/requestToken' -d '{"email":"${aliceEmail}","client_secret":"foobar","send_attempt":1}' -v
               '';
           in
           [
@@ -168,74 +245,189 @@ in
           ];
       };
 
-    # test mail delivery
-    mailserver = args: {
-      security.pki.certificateFiles = [
-        mailerCerts.ca.cert
-      ];
+    mailserver =
+      { lib, ... }:
+      {
+        security.pki.certificateFiles = [
+          mailerCerts.ca.cert
+        ];
 
-      networking.firewall.enable = false;
+        networking = {
+          hostName = lib.head (lib.strings.splitString "." mailerDomain);
+          domain = lib.last (lib.strings.splitString "." mailerDomain);
+          firewall.enable = false;
+        };
 
-      services.postfix = {
-        enable = true;
-        enableSubmission = true;
+        services.postfix = {
+          enable = true;
+          enableSubmission = true;
 
-        # blackhole transport
-        transport = "example.com discard:silently";
+          # blackhole transport
+          transport = "example.com discard:silently";
 
-        settings.main = {
-          myhostname = "${mailerDomain}";
-          # open relay for subnet
-          mynetworks_style = "subnet";
-          debug_peer_level = "10";
-          smtpd_relay_restrictions = [
-            "permit_mynetworks"
-            "reject_unauth_destination"
-          ];
+          settings.main = {
+            myhostname = "${mailerDomain}";
+            # open relay for subnet
+            mynetworks_style = "subnet";
+            debug_peer_level = "10";
+            smtpd_relay_restrictions = [
+              "permit_mynetworks"
+              "reject_unauth_destination"
+            ];
 
-          # disable obsolete protocols, something old versions of twisted are still using
-          smtpd_tls_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
-          smtpd_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
-          smtpd_tls_chain_files = [
-            "${mailerCerts.${mailerDomain}.key}"
-            "${mailerCerts.${mailerDomain}.cert}"
-          ];
+            # disable obsolete protocols, something old versions of twisted are still using
+            smtpd_tls_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
+            smtpd_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
+            smtpd_tls_chain_files = [
+              "${mailerCerts.${mailerDomain}.key}"
+              "${mailerCerts.${mailerDomain}.cert}"
+            ];
+          };
         };
       };
-    };
 
-    serversqlite = args: {
-      services.matrix-synapse = {
-        enable = true;
-        settings = {
-          inherit listeners;
-          database.name = "sqlite3";
-          tls_certificate_path = "${bundle}/cert.pem";
-          tls_private_key_path = "${bundle}/key.pem";
+    synapse-minimal =
+      {
+        nodes,
+        config,
+        lib,
+        ...
+      }:
+      {
+        imports = [
+          (mkHomeserverBase "hs2.test" nodes)
+        ];
+
+        services.matrix-synapse = lib.mkMerge [
+          (mkSynapseConfig "hs2.test" config.networking.primaryIPAddress)
+          {
+            settings = {
+              database.name = "sqlite3";
+              server_name = "hs2.test";
+            };
+          }
+        ];
+      };
+
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          # `pkgs.olm` is cached on c.n.o, even if this test isn't built due
+          # to it being allow-listed in `pkgs/top-level/release.nix`.
+          (import pkgs.path {
+            config = pkgs.config // {
+              permittedInsecurePackages = [ "olm-3.2.16" ];
+            };
+          }).matrix-commander
+          pkgs.jq
+        ];
+
+        security.pki.certificateFiles = [ mailerCerts.ca.cert ];
+
+        users.users = {
+          alice.isNormalUser = true;
+          bob.isNormalUser = true;
+        };
+
+        networking.useNetworkd = true;
+        services.rust-federation-tester = {
+          enable = true;
+          settings = {
+            listen_addr = "unix:/run/rust-federation-tester/rust-federation-tester.sock";
+            frontend_url = "http://localhost:8080";
+            database_url = "sqlite:///var/lib/rust-federation-tester/db?mode=rwc";
+            magic_token_secret = "foobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobar";
+            statistics = {
+              enabled = true;
+              prometheus_enabled = true;
+              anonymization_salt._secret = "${anonHashF}";
+              raw_retention_days = 30;
+            };
+          };
         };
       };
-    };
   };
 
   testScript = ''
+    import json
+    from pprint import pprint
+
     start_all()
-    mailserver.wait_for_unit("postfix.service")
-    serverpostgres.succeed("send-testmail-starttls")
-    serverpostgres.wait_for_unit("matrix-synapse.service")
-    serverpostgres.wait_until_succeeds(
-        "curl --fail -L --cacert ${ca_pem} https://localhost:8448/"
-    )
-    serverpostgres.wait_until_succeeds(
+
+    synapse_with_workers.wait_for_unit("multi-user.target")
+    synapse_minimal.wait_for_unit("multi-user.target")
+    mailserver.wait_for_unit("multi-user.target")
+
+    synapse_with_workers.wait_until_succeeds(
         "journalctl -u matrix-synapse.service | grep -q 'Connected to redis'"
     )
-    serverpostgres.require_unit_state("postgresql.target")
-    serverpostgres.succeed("REQUESTS_CA_BUNDLE=${ca_pem} register_new_matrix_user -u ${testUser} -p ${testPassword} -a -k ${registrationSharedSecret} https://localhost:8448/")
-    serverpostgres.succeed("obtain-token-and-register-email")
-    serversqlite.wait_for_unit("matrix-synapse.service")
-    serversqlite.wait_until_succeeds(
-        "curl --fail -L --cacert ${ca_pem} https://localhost:8448/"
-    )
-    serversqlite.succeed("[ -e /var/lib/matrix-synapse/homeserver.db ]")
-  '';
+    synapse_with_workers.wait_for_unit("matrix-synapse-worker-federation_sender.service");
 
+    with subtest("register user with email confirmation"):
+        synapse_with_workers.succeed("send-testmail-starttls")
+        synapse_with_workers.succeed("REQUESTS_CA_BUNDLE=${mailerCerts.ca.cert} register_new_matrix_user -u ${aliceName} -p ${alicePassword} -a -k ${registrationSharedSecret} https://hs1.test:8448/")
+        synapse_with_workers.succeed("obtain-token-and-register-email")
+
+    with subtest("matrix-synapse-register_new_matrix_user"):
+        synapse_minimal.succeed("matrix-synapse-register_new_matrix_user -u ${bobName} -p ${bobPassword} --no-admin")
+        synapse_minimal.succeed("[ -e /var/lib/matrix-synapse/homeserver.db ]")
+
+    with subtest("Federation tester"):
+        expected_anonymization_hashes = {
+            "hs1.test": "0558582846d6e2d90612900d449871dfcbf9878ba78de4a8469d8aba2d9c037b",
+            "hs2.test": "d3d88c2033c03b74ec1e086e15c0251514de060de5e51cb381e896f892a5b0cd",
+        }
+
+        # /metrics are cached for up to 30 seconds
+        for n, domain in enumerate(["hs2.test", "hs1.test"], start=3):
+            result = json.loads(
+                client.succeed(
+                    f"curl --fail --unix-socket /run/rust-federation-tester/rust-federation-tester.sock 'http://localhost:8080/api/federation/report?server_name={domain}&stats_opt_in=true'"
+                )
+            )
+            pprint(result)
+            t.assertTrue(result["FederationOK"])
+            t.assertTrue(result["ConnectionReports"][f"192.168.1.{n}:8448"]["Checks"]["AllChecksOK"])
+            t.assertEqual(f"{domain}:8448", result["WellKnownResult"][f"192.168.1.{n}:443"]["m.server"])
+
+        client.sleep(30)
+        # /metrics are cached for up to 30 seconds
+        for domain in ["hs2.test", "hs1.test"]:
+            metrics = client.succeed("curl --unix-socket /run/rust-federation-tester/rust-federation-tester.sock http://localhost:8080/metrics --fail")
+            t.assertRegex(
+                metrics,
+                f'federation_request_total\\{{server=\\"{expected_anonymization_hashes[domain]}\\",result=\\"success\\",[^}}]+\\}} 1'
+            )
+
+    def run_as_alice(cmd):
+        return client.succeed(f"sudo -u alice matrix-commander -c /home/alice/credentials.json -s /home/alice/matrix {cmd}")
+
+    def run_as_bob(cmd):
+        return client.succeed(f"sudo -u bob matrix-commander -c /home/bob/credentials.json -s /home/bob/matrix {cmd}")
+
+    with subtest("Login"):
+        run_as_alice("--login password --homeserver https://hs1.test:8448 --user-login @${aliceName}:hs1.test --password ${alicePassword} --device commander --room-default '#welcome:hs1.test'")
+        run_as_bob("--login password --homeserver https://hs2.test:8448 --user-login @${bobName}:hs2.test --password ${bobPassword} --device commander --room-default '#welcome:hs1.test'")
+
+    with subtest("Create/Invite/Join"):
+        run_as_alice("--room-create '#welcome:hs1.test'")
+
+        run_as_alice("--room-invite '#welcome:hs1.test' -u @${bobName}:hs2.test")
+        run_as_bob("--listen once --room-invites 'list+join'")
+
+    with subtest("Send/receive messages"):
+        senders = {
+            "alice": ("hs1", run_as_alice),
+            "bob": ("hs2", run_as_bob),
+        }
+
+        for name, (hs, fn) in senders.items():
+            fn(f"-m 'hello, I am {name}'")
+            for _, run in senders.values():
+                msg_data = json.loads(run("--listen once --listen-self --output json"))
+                pprint(msg_data)
+                t.assertEqual(msg_data["source"]["content"]["body"], f"hello, I am {name}")
+                t.assertEqual(msg_data["source"]["sender"], f"@{name}:{hs}.test")
+  '';
 }

nixos/tests/nextcloud/default.nix

@@ -149,5 +149,6 @@ listToAttrs (
   concatMap genTests [
     32
     33
+    34
   ]
 )

nixos/tests/nfs/kerberos.nix

@@ -83,9 +83,16 @@ import ../make-test-python.nix (
 
           services.nfs.server.enable = true;
           services.nfs.server.createMountPoints = true;
-          services.nfs.server.exports = ''
-            /data *(rw,no_root_squash,fsid=0,sec=krb5p)
-          '';
+          services.nfs.server.exports = {
+            "/data" = {
+              "*" = [
+                "rw"
+                "no_root_squash"
+                "fsid=0"
+                "sec=krb5p"
+              ];
+            };
+          };
         };
     };
 

nixos/tests/nfs/simple.nix

@@ -37,9 +37,16 @@ import ../make-test-python.nix (
         { ... }:
         {
           services.nfs.server.enable = true;
-          services.nfs.server.exports = ''
-            /data 192.168.1.0/255.255.255.0(rw,no_root_squash,no_subtree_check,fsid=0)
-          '';
+          services.nfs.server.exports = {
+            "/data" = {
+              "192.168.1.0/255.255.255.0" = [
+                "rw"
+                "no_root_squash"
+                "no_subtree_check"
+                "fsid=0"
+              ];
+            };
+          };
           services.nfs.server.createMountPoints = true;
           networking.firewall.enable = false; # FIXME: figure out what ports need to be allowed
         };

nixos/tests/php/fpm.nix

@@ -44,6 +44,13 @@
           "pm.min_spare_servers" = 1;
           "pm.start_servers" = 2;
         };
+        phpEnv = {
+          # check that keywords and special characters are escaped properly
+          keyword = "false";
+          characters = "^ = \\";
+          quoted = "\"'";
+          newline = "hello\nworld";
+        };
       };
     };
   testScript =
@@ -56,6 +63,15 @@
       response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1:80/")
       t.assertIn("PHP Version ${php.version}", response, "PHP version not detected")
 
+      expected_env = {
+        "keyword": "false",
+        "characters": "^ = \\",
+        "quoted": ""'",
+        "newline": "hello\nworld",
+      }
+      for env, value in expected_env.items():
+        assert f'<tr><td class="e">{env} </td><td class="v">{value} </td></tr>' in response, f"phpEnv.{env} not detected"
+
       # Check so we have database and some other extensions loaded
       for ext in ["json", "opcache", "pdo_mysql", "pdo_pgsql", "pdo_sqlite", "apcu"]:
           assert ext in response, f"Missing {ext} extension"

nixos/tests/shoko.nix

@@ -17,10 +17,7 @@
         machine.succeed("curl --fail http://localhost:8111")
       '';
 
-      meta.maintainers = with lib.maintainers; [
-        diniamo
-        nanoyaki
-      ];
+      meta.maintainers = with lib.maintainers; [ nanoyaki ];
     }
   );
 

pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/package.nix

@@ -47,7 +47,6 @@ melpaBuild (finalAttrs: {
     platforms = [
       "aarch64-darwin"
       "aarch64-linux"
-      "x86_64-darwin"
       "x86_64-linux"
       "x86_64-windows"
     ];

pkgs/applications/editors/jetbrains/ides/clion.nix

@@ -28,10 +28,6 @@ let
       url = "https://download.jetbrains.com/cpp/CLion-2026.1.4-aarch64.tar.gz";
       hash = "sha256-I6IKQng4lNtRlQIq08K5bueqgKI/q1awX4EuRnyAnOk=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/cpp/CLion-2026.1.4.dmg";
-      hash = "sha256-AJt+K1zv4eyjdzubUeFGwB9mqzvOeb3ffA2k0MajPBs=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/cpp/CLion-2026.1.4-aarch64.dmg";
       hash = "sha256-i3stX7dyRgSOJkFTMD9/hkw6e2mGNqn13S7X/vJ66RQ=";

pkgs/applications/editors/jetbrains/ides/datagrip.nix

@@ -19,10 +19,6 @@ let
       url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3-aarch64.tar.gz";
       hash = "sha256-G+tinD/+qM5HVR4u2E0cNXtdVsbwgK8/PdZ3ic6hf4M=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3.dmg";
-      hash = "sha256-vW2LEonl0D9S0VxbeJX4jRrwhELGBwlOXwiHslvh06E=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3-aarch64.dmg";
       hash = "sha256-Kyt3fYPXzwTVxPFVKd+atiHWb/i7gjGahz1MJ4iXxy8=";

pkgs/applications/editors/jetbrains/ides/dataspell.nix

@@ -21,10 +21,6 @@ let
       url = "https://download.jetbrains.com/python/dataspell-2026.1.2-aarch64.tar.gz";
       hash = "sha256-SSmIPF0pDMolxeXL21UaHMbZdtYbChWVxTKZOsPhH+I=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/python/dataspell-2026.1.2.dmg";
-      hash = "sha256-2qzwzGMYuy1qEuTprxwNa5gOPgCZq2MadSKN8FT8w8c=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/python/dataspell-2026.1.2-aarch64.dmg";
       hash = "sha256-MGWufS0nlswdqhACNQWtlXJwfPiYw8wUx7olIxPS15k=";

pkgs/applications/editors/jetbrains/ides/gateway.nix

@@ -19,10 +19,6 @@ let
       url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3-aarch64.tar.gz";
       hash = "sha256-CSe04BBo4jS1cIhu4NfZqaSHMaNue2eFUPa+1gOxuoo=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3.dmg";
-      hash = "sha256-WKwIP19y5EKO98JgEm468ofaRp/JO5z8lqNhtpsH4tY=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3-aarch64.dmg";
       hash = "sha256-AHY/lY0ARkW0VoSgy0t7LLNXA965PLooWBSWxBKBV5M=";

pkgs/applications/editors/jetbrains/ides/goland.nix

@@ -19,10 +19,6 @@ let
       url = "https://download.jetbrains.com/go/goland-2026.1.4-aarch64.tar.gz";
       hash = "sha256-7s98kY08aKjdRGQLDkffeVhgj1FWurLmTTYmtb5Qx6c=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/go/goland-2026.1.4.dmg";
-      hash = "sha256-RbvcLpLVyeL4B1DJ2/9Ub/6Cz6fJGXMPCHsJ705GsAo=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/go/goland-2026.1.4-aarch64.dmg";
       hash = "sha256-y7mEke0z0MvQs+kMtrmrq7EeAtJUbgo6sGZrOB0MraM=";

pkgs/applications/editors/jetbrains/ides/idea.nix

@@ -22,10 +22,6 @@ let
       url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4-aarch64.tar.gz";
       hash = "sha256-MDZFuLrUxcCIc0Zhi4QhgKPeU7Pgs9oJ/FxQH1n3gBM=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4.dmg";
-      hash = "sha256-8K+LiewiINP4S9eqV0kGWtfy2Ff/zvBwX89iX7mYZ78=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4-aarch64.dmg";
       hash = "sha256-XIBK/+Lxaz9dX+Lxl7HXsl+Z3Z7GBzSuDxNssb/4A2s=";

pkgs/applications/editors/jetbrains/ides/mps.nix

@@ -19,10 +19,6 @@ let
       url = "https://download.jetbrains.com/mps/2025.3/MPS-2025.3.tar.gz";
       hash = "sha256-xAI+UrTheCTWHSdoI4YZvhTlrlc121M+OVFkfzd7a3k=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/mps/2025.3/MPS-2025.3-macos.dmg";
-      hash = "sha256-whYAjKkF79mrknHflZnvOOy2bLosYUguelZDSuPt3uY=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/mps/2025.3/MPS-2025.3-macos-aarch64.dmg";
       hash = "sha256-3HnEHOhRRI9IYjBhc5FO7h5j4jBBDtZTVkmO/S1fBEQ=";

pkgs/applications/editors/jetbrains/ides/phpstorm.nix

@@ -19,10 +19,6 @@ let
       url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4-aarch64.tar.gz";
       hash = "sha256-T9q3/nxv/AA6y7CHWtOhUibR7bnKN8OZmfN3NWYTsIQ=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4.dmg";
-      hash = "sha256-W7EwYu7S3hs1564tXq8H1Uok/Gwx/8QJO4brUGOfFY4=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4-aarch64.dmg";
       hash = "sha256-XGcfEWHHeLugvkT/WlQDsVRN33F46b1PCNhINQitqSY=";

pkgs/applications/editors/jetbrains/ides/pycharm.nix

@@ -20,10 +20,6 @@ let
       url = "https://download.jetbrains.com/python/pycharm-2026.1.4-aarch64.tar.gz";
       hash = "sha256-71FbYpN0seJ5k/yZA7aoXgU4W/N1BhjtKl7W7Hic9UE=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/python/pycharm-2026.1.4.dmg";
-      hash = "sha256-Q5hTcYoNUzmAxwcsXJNS4medQjFKWc/Sgkybt4PQPfg=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/python/pycharm-2026.1.4-aarch64.dmg";
       hash = "sha256-qxSgp8r4S0KXjCCTIoAiEZFCn3uBE/0pWLLA6td0Fq0=";

pkgs/applications/editors/jetbrains/ides/rider.nix

@@ -31,10 +31,6 @@ let
       url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4-aarch64.tar.gz";
       hash = "sha256-GXmyBrqxUpwK4djjwllvK+pnfktDrDHpLJKoe4D2xFo=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4.dmg";
-      hash = "sha256-GfQ5WpKunJ+JhE1VcArm3UxZ5udCbfnS1Kw3D4gZorA=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4-aarch64.dmg";
       hash = "sha256-cfwT22BN1jzKZzrZHMQqYFJPGuRwta/sqoOJOp+PfBE=";

pkgs/applications/editors/jetbrains/ides/ruby-mine.nix

@@ -19,10 +19,6 @@ let
       url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4-aarch64.tar.gz";
       hash = "sha256-oSu19pkGVWt31vWBdAffSZsu4QzsUznVbUSwDy98nug=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4.dmg";
-      hash = "sha256-BLo2weIJK8gQAcMtAiETM7FMdhw9aoFIGh5Yqjv3k7s=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4-aarch64.dmg";
       hash = "sha256-4wEnwcPRtwp0wxePUMiLow6sMxirwndRMdmJL8LBh9k=";

pkgs/applications/editors/jetbrains/ides/rust-rover.nix

@@ -25,10 +25,6 @@ let
       url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4-aarch64.tar.gz";
       hash = "sha256-KpF3jCnLKCEeEXkBdB8ZsPPqP9FOVRTwRV/FQLKyh1Q=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4.dmg";
-      hash = "sha256-2BwgAD0xF9IxRJh+gW4vLzBW13rFQSzQPbEwdmQGvLU=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4-aarch64.dmg";
       hash = "sha256-Hly4NBv9mg/RMmxCM6m9w5eS/CQ7ycxp7V2VQZwyGQE=";

pkgs/applications/editors/jetbrains/ides/webstorm.nix

@@ -19,10 +19,6 @@ let
       url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3-aarch64.tar.gz";
       hash = "sha256-oZQaxpVV0O4WlDE6Ia+KzHIF0SfWQBubBFIopSRMbvE=";
     };
-    x86_64-darwin = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3.dmg";
-      hash = "sha256-KUcQRWYUD/+4HHWnkGuqoltqL2an0WQkUEfUcttwjCI=";
-    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3-aarch64.dmg";
       hash = "sha256-1N1RtN1QLvuJ1QL8jbN5TdbOHAHSN84W9XEK2PEPijI=";

pkgs/applications/editors/jetbrains/updater/updateInfo.json

@@ -4,7 +4,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/cpp/CLion-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/cpp/CLion-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.dmg"
     }
   },
@@ -13,7 +12,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/datagrip/datagrip-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/datagrip/datagrip-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/datagrip/datagrip-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/datagrip/datagrip-{version}-aarch64.dmg"
     }
   },
@@ -22,7 +20,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/python/dataspell-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/python/dataspell-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/python/dataspell-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/python/dataspell-{version}-aarch64.dmg"
     }
   },
@@ -31,7 +28,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}-aarch64.dmg"
     }
   },
@@ -40,7 +36,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/go/goland-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/go/goland-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/go/goland-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/go/goland-{version}-aarch64.dmg"
     }
   },
@@ -49,7 +44,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/idea/ideaIU-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/idea/ideaIU-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/idea/ideaIU-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/idea/ideaIU-{version}-aarch64.dmg"
     }
   },
@@ -62,7 +56,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}-macos.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}-macos-aarch64.dmg"
     }
   },
@@ -71,7 +64,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/webide/PhpStorm-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/webide/PhpStorm-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/webide/PhpStorm-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/webide/PhpStorm-{version}-aarch64.dmg"
     }
   },
@@ -80,7 +72,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/python/pycharm-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/python/pycharm-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/python/pycharm-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/python/pycharm-{version}-aarch64.dmg"
     }
   },
@@ -93,7 +84,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}-aarch64.dmg"
     }
   },
@@ -102,7 +92,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/ruby/RubyMine-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/ruby/RubyMine-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/ruby/RubyMine-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/ruby/RubyMine-{version}-aarch64.dmg"
     }
   },
@@ -111,7 +100,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/rustrover/RustRover-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/rustrover/RustRover-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/rustrover/RustRover-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/rustrover/RustRover-{version}-aarch64.dmg"
     }
   },
@@ -120,7 +108,6 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/webstorm/WebStorm-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/webstorm/WebStorm-{version}-aarch64.tar.gz",
-      "x86_64-darwin": "https://download.jetbrains.com/webstorm/WebStorm-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/webstorm/WebStorm-{version}-aarch64.dmg"
     }
   }

pkgs/applications/editors/vim/plugins/non-generated/windsurf-nvim/default.nix

@@ -14,7 +14,6 @@ let
   codeiumHashes = {
     x86_64-linux = "sha256-IeNK7UQtOhqC/eQv7MAya4jB1WIGykSR7IgutZatmHM=";
     aarch64-linux = "sha256-ujTFki/3V79El2WCkG0PJhbaMT0knC9mrS9E7Uv9HD4=";
-    x86_64-darwin = "sha256-r2KloEQsUku9sk8h76kwyQuMTHcq/vwfTSK2dkiXDzE=";
     aarch64-darwin = "sha256-1jNH0Up8mAahDgvPF6g42LV+RVDVsPqDM54lE2KYY48=";
   };
 
@@ -30,7 +29,6 @@ let
           {
             x86_64-linux = "linux_x64";
             aarch64-linux = "linux_arm";
-            x86_64-darwin = "macos_x64";
             aarch64-darwin = "macos_arm";
           }
           .${system} or throwSystem;

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -3316,6 +3316,7 @@ assertNoAdditions {
   };
 
   nvim-jdtls = super.nvim-jdtls.overrideAttrs (old: {
+    runtimeDeps = [ python3 ];
     meta = old.meta // {
       license = lib.licenses.gpl3Only;
     };

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -27,10 +27,6 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
           arch = "linux-arm64";
           hash = "sha256-A8CrNx6GfFmaFWe1Awck/2B0VuJhNX6HHI5YNSG1qVo=";
         };
-        "x86_64-darwin" = {
-          arch = "darwin-x64";
-          hash = "sha256-egXg308OJWvMyMqLHiANNEIGCSza/yKPFIqWq1X6JdE=";
-        };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
           hash = "sha256-BmI7NTlKUVMnTBS8nf2jqYYSA+LT3qP9Yu5gQIv7Mxo=";
@@ -60,7 +56,6 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
-      "x86_64-darwin"
       "aarch64-darwin"
     ];
   };

pkgs/applications/editors/vscode/extensions/charliermarsh.ruff/default.nix

@@ -14,10 +14,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
           arch = "linux-x64";
           hash = "sha256-lhDt8XEF90y4pj8RLUZgfZNmHkV1XlmHsYuT6sGJMRc=";
         };
-        "x86_64-darwin" = {
-          arch = "darwin-x64";
-          hash = "sha256-SqFRn5FVQ+LcpmYT7/AIdIKTOxbapaKvPi+I360dVW8=";
-        };
         "aarch64-linux" = {
           arch = "linux-arm64";
           hash = "sha256-iuYVCG4YWPFI8o4GmuNjkbXvzJsAre0gSSEWq6CUk2E=";
@@ -57,7 +53,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
       "aarch64-linux"
       "aarch64-darwin"
       "x86_64-linux"
-      "x86_64-darwin"
     ];
     maintainers = [ lib.maintainers.azd325 ];
   };

pkgs/applications/editors/vscode/extensions/continue.continue/default.nix

@@ -13,10 +13,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
           arch = "linux-x64";
           hash = "sha256-4GiTNT+UPdTth9VDhHTXfqhQ5gM6vfLAaU5Cy3VMTCI=";
         };
-        "x86_64-darwin" = {
-          arch = "darwin-x64";
-          hash = "sha256-XJfDXWYpxYV5YHIBINqNJdyVho7Xd9OGMu11WE0LENM=";
-        };
         "aarch64-linux" = {
           arch = "linux-arm64";
           hash = "sha256-QngCharrjiDKrY7RgWtKzIJxjXazuRvpuHVUAxknWfA=";
@@ -44,7 +40,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
     maintainers = with lib.maintainers; [ flacks ];
     platforms = [
       "x86_64-linux"
-      "x86_64-darwin"
       "aarch64-darwin"
       "aarch64-linux"
     ];

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1950,8 +1950,8 @@ let
         mktplcRef = {
           publisher = "github";
           name = "codespaces";
-          version = "1.18.14";
-          hash = "sha256-i/J5inu6iJ3CPgoBf+pMFuM33Ex/0KqhfzfRl/BIe7Y=";
+          version = "1.18.15";
+          hash = "sha256-NcW2XVQ6F7s6k4mIesEXhCkVVRfudwFr3glqB+TjrqM=";
         };
 
         meta = {
@@ -3190,10 +3190,6 @@ let
                 arch = "linux-x64";
                 hash = "sha256-pmA7BNwyHiaU93j61/MyrBV5kH0DlW+7BA6HNlKGnso=";
               };
-              "x86_64-darwin" = {
-                arch = "darwin-x64";
-                hash = "sha256-E2KRzjIxLFmwArzEKittjejacrCOFFNNzphWw8v5CpE=";
-              };
               "aarch64-linux" = {
                 arch = "linux-arm64";
                 hash = "sha256-pnQP1OKr3NJgUuXzO1InYqGA49OuMFn2iEf8wpl4PqM=";
@@ -3224,7 +3220,6 @@ let
           maintainers = [ lib.maintainers.magnouvean ];
           platforms = [
             "x86_64-linux"
-            "x86_64-darwin"
             "aarch64-darwin"
             "aarch64-linux"
           ];

pkgs/applications/editors/vscode/extensions/docker.docker/default.nix

@@ -10,10 +10,6 @@ let
       hash = "sha256-jfjd2V7IJ4GQlz/pXmrY/LlBjQ2qtlsQV4ZRD8RiWTg=";
       arch = "linux-x64";
     };
-    x86_64-darwin = {
-      hash = "sha256-aOFoTLVaaMFsdGoWV0OC31/nmOHXUhr2Y8K4SWcNil8=";
-      arch = "darwin-x64";
-    };
     aarch64-linux = {
       hash = "sha256-ugluaghNNZ/VrQORVIhc0Fuv3rHo++LO3Uwg2ujmsQc=";
       arch = "linux-arm64";

pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix

@@ -45,7 +45,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
-      "x86_64-darwin"
       "aarch64-darwin"
     ];
   };

pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix

@@ -14,10 +14,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
           arch = "linux-x64";
           hash = "sha256-uPmJyEq7X6uJzE1M5Xywax1mrnTcg6jOb9MlpKZ0WRk=";
         };
-        "x86_64-darwin" = {
-          arch = "darwin-x64";
-          hash = "sha256-oEVt3VbRUPD4tfQs0EU7RX6671fCJiMi38wF+76RzZI=";
-        };
         "aarch64-linux" = {
           arch = "linux-arm64";
           hash = "sha256-b46f0f99rjBivewC9jUbAFiKK+DS1XKv+AynUlKHliw=";
@@ -52,7 +48,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
       "aarch64-linux"
       "aarch64-darwin"
       "x86_64-linux"
-      "x86_64-darwin"
     ];
     maintainers = with lib.maintainers; [ xiaoxiangmoe ];
   };

pkgs/applications/editors/vscode/extensions/ms-dotnettools.csdevkit/default.nix

@@ -22,10 +22,6 @@ let
         arch = "linux-arm64";
         hash = "sha256-1zz9xrMALIOXzMpArWSwO12WmRE+0ldbIwUFH1G2GQI=";
       };
-      x86_64-darwin = {
-        arch = "darwin-x64";
-        hash = "sha256-3PoSbp8M2X4bhSQyxvNC7jtNDVNEuEKeYRZQMFOmbtQ=";
-      };
       aarch64-darwin = {
         arch = "darwin-arm64";
         hash = "sha256-F4CsyiX46SpjilJNV+qYps1JAw09pVruLmW+muN9/B4=";
@@ -138,7 +134,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
-      "x86_64-darwin"
       "aarch64-darwin"
     ];
   };

pkgs/applications/editors/vscode/extensions/ms-dotnettools.csharp/default.nix

@@ -24,10 +24,6 @@ let
         arch = "linux-arm64";
         hash = "sha256-EV3745OXbwrRmc8P5e13DZbomyJGcYQUF07WflRWU1Q=";
       };
-      x86_64-darwin = {
-        arch = "darwin-x64";
-        hash = "sha256-i2cALeaSXfwIdfXNeWfND99nFYIiOFwsxbqU7/Effx8=";
-      };
       aarch64-darwin = {
         arch = "darwin-arm64";
         hash = "sha256-KCIkjBmYZPiuFmQ3/aDycARYIHPyDTmMkoGcuG5DQX8=";
@@ -159,7 +155,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
-      "x86_64-darwin"
       "aarch64-darwin"
     ];
   };

pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix

@@ -18,10 +18,6 @@ let
       hash = "sha256-HQfmDV6rJX6l1pGybe8//2QrTSwE+rlEJOi4/iW69lY=";
       arch = "linux-x64";
     };
-    x86_64-darwin = {
-      hash = "sha256-tAZyt2fwB/GOhffY5lhHJTmbXG8UloynPtjoMtWRHok=";
-      arch = "darwin-x64";
-    };
     aarch64-linux = {
       hash = "sha256-v7fatW/LMJ8CeSRrE/5b7dLqOrhNhwzUySUxtAMuBUE=";
       arch = "linux-arm64";

pkgs/applications/editors/vscode/extensions/ms-vscode.vscode-speech/default.nix

@@ -16,10 +16,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
           arch = "linux-x64";
           hash = "sha256-dZwOBehoYEqaYskvcPB55IKnG1CMToioyUJXlndqorA=";
         };
-        "x86_64-darwin" = {
-          arch = "darwin-x64";
-          hash = "sha256-b6LobvVngC0TFuWTC9JBQrECkoX7ewLNCpCROkXHk20=";
-        };
         "aarch64-linux" = {
           arch = "linux-arm64";
           hash = "sha256-/EaOfoubfq1ufwB7TTQ2hqmh1ZJiZ1+B6QeYu3MoFPI=";
@@ -68,7 +64,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
     license = lib.licenses.unfree;
     platforms = [
       "x86_64-linux"
-      "x86_64-darwin"
       "aarch64-linux"
       "aarch64-darwin"
     ];

pkgs/applications/editors/vscode/extensions/redhat.vscode-xml/default.nix

@@ -13,10 +13,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
           arch = "linux-x64";
           hash = "sha256-cP/oFn19CZ/G3kjdHNZGqXvoDE1qUtg6xrg/2MO14Lo=";
         };
-        "x86_64-darwin" = {
-          arch = "darwin-x64";
-          hash = "sha256-wtk8SasxXEQ3pCJpVTWR8wcY/bNaIZmImbAtrFWYWOo=";
-        };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
           hash = "sha256-XYdwVoDqK+88ZYUm6APyamFNx6XlYjy0R4CIhSMuRmU=";
@@ -42,7 +38,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
     platforms = [
       "x86_64-linux"
       "aarch64-darwin"
-      "x86_64-darwin"
     ];
   };
 }

pkgs/applications/editors/vscode/extensions/sourcery.sourcery/default.nix

@@ -15,10 +15,6 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       arch = "linux-x64";
       hash = "sha256-Oz4Buraof4yXIxGeKXIsDkvEQQ0Gzf/b5mdses1nHlo=";
     };
-    "x86_64-darwin" = {
-      arch = "darwin-x64";
-      hash = "sha256-Iqe4KZXQHenKAypXK/qzG2BCXbk2cZ0i/0xhWhlfQxo=";
-    };
     "aarch64-darwin" = {
       arch = "darwin-arm64";
       hash = "sha256-vMDB5zmdBNt3R5AkeuCYhxzW/rSGwM+wtU5K4v3ZU/U=";

pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix

@@ -20,10 +20,6 @@ let
         arch = "linux-arm64";
         hash = "sha256-Z3cRojI4mCCS2t3aLojgImULQOobq5liDwoeHuzKEhY=";
       };
-      x86_64-darwin = {
-        arch = "darwin-x64";
-        hash = "sha256-Th0cseTJk+CD3BO/99t0VMD7zcF6nxAfmHFhfN8j5sw=";
-      };
       aarch64-darwin = {
         arch = "darwin-arm64";
         hash = "sha256-rHgMl71YCs9ea0nFnx+E2U8isL4zQzIvvE9tgxM7IiA=";
@@ -66,7 +62,6 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       "aarch64-linux"
       "aarch64-darwin"
       "x86_64-linux"
-      "x86_64-darwin"
     ];
     maintainers = [ ];
   };

pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix

@@ -10,10 +10,6 @@ let
       hash = "sha256-DWrKvjWpUYvyqgZCShqwBKw33MHW31cxb4ERV65O+uc=";
       arch = "linux-x64";
     };
-    x86_64-darwin = {
-      hash = "sha256-CYDutYtU0+AAn6PYO/EQ/Suv8BNuMtvePpFdKRtiqAs=";
-      arch = "darwin-x64";
-    };
     aarch64-linux = {
       hash = "sha256-iFHeZiTubXA/t2Gib9hP42d7yjq/WRyywp+l8VhGfmo=";
       arch = "linux-arm64";

pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix

@@ -15,10 +15,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
           arch = "linux-x64";
           hash = "sha256-htZGjy7ZnQLGZUncokGaGHyLpvPM5jzWUvCdnfN1vbM=";
         };
-        "x86_64-darwin" = {
-          arch = "darwin-x64";
-          hash = "sha256-OFdrXunh63xBZW/HwDDjj17TTiOLGY1Enb6ARxNc4bI=";
-        };
         "aarch64-linux" = {
           arch = "linux-arm64";
           hash = "sha256-rgeNJbl6G2yKAWYW7NarQwVLmd3oZ4YTOVeCUat6ZqQ=";
@@ -56,7 +52,6 @@ vscode-utils.buildVscodeMarketplaceExtension {
       "aarch64-linux"
       "aarch64-darwin"
       "x86_64-linux"
-      "x86_64-darwin"
     ];
     maintainers = with lib.maintainers; [ sandarukasa ];
   };

pkgs/applications/editors/vscode/generic.nix

@@ -429,7 +429,6 @@ stdenv.mkDerivation (
           # see https://www.npmjs.com/package/@vscode/ripgrep-universal?activeTab=code
           ripgrepSystem =
             {
-              x86_64-darwin = "darwin-x64";
               aarch64-darwin = "darwin-arm64";
               armv7l-linux = "linux-arm";
               aarch64-linux = "linux-arm64";

pkgs/applications/editors/vscode/vscode.nix

@@ -24,7 +24,6 @@ let
   plat =
     {
       x86_64-linux = "linux-x64";
-      x86_64-darwin = "darwin";
       aarch64-linux = "linux-arm64";
       aarch64-darwin = "darwin-arm64";
       armv7l-linux = "linux-armhf";
@@ -36,7 +35,6 @@ let
   hash =
     {
       x86_64-linux = "sha256-4G+zZ5HJuvdJXUt9wPWqqCVOfRpgpe5D5sfevAXJYrU=";
-      x86_64-darwin = "sha256-+o+UZwmJMeGyf2n1VZcm0zl4dzuC/0UBV5jyUANKsEQ=";
       aarch64-linux = "sha256-UEkpGlTV/KZ8Qcw/OBOCNDQHblD7gHHloSzM62FvDnw=";
       aarch64-darwin = "sha256-IHu9EwW9/oS2FTr/mB7ugMss5Pku3IyslqFYr4riZyk=";
       armv7l-linux = "sha256-Rfp2H6L7bXXhdxf2yphW9YXDGW1+Ea0nKdyTFS8Y/tU=";
@@ -128,7 +126,6 @@ buildVscode {
     ];
     platforms = [
       "x86_64-linux"
-      "x86_64-darwin"
       "aarch64-darwin"
       "aarch64-linux"
       "armv7l-linux"

pkgs/applications/editors/vscode/vscodium.nix

@@ -15,7 +15,6 @@ let
   plat =
     {
       x86_64-linux = "linux-x64";
-      x86_64-darwin = "darwin-x64";
       aarch64-linux = "linux-arm64";
       aarch64-darwin = "darwin-arm64";
       armv7l-linux = "linux-armhf";
@@ -28,7 +27,6 @@ let
   hash =
     {
       x86_64-linux = "sha256-LJsGc11MH6zlcJNfSWjTWPn2Jp9dkjeBPQuCXH1woUM=";
-      x86_64-darwin = "sha256-bC7AfH2eKmmsWIOHifNGKD/kVQCYyuMfU3SUil0DXkM=";
       aarch64-linux = "sha256-mT5dvw8GOZ0GnZaKRS/TAzQDEEYDOgcj6w6lNLy5kQ0=";
       aarch64-darwin = "sha256-c8K17XKpRG1ji2mUfoyg2+cRF+qc1KVMYVkaQoUIz7Y=";
       armv7l-linux = "sha256-91ZHhEUDVoDiRBLwMHVLhzKmb9gWcPBUsVRZVLhCA4M=";
@@ -88,7 +86,6 @@ buildVscode rec {
     mainProgram = "codium";
     platforms = [
       "x86_64-linux"
-      "x86_64-darwin"
       "aarch64-linux"
       "aarch64-darwin"
       "armv7l-linux"

pkgs/applications/emulators/libretro/cores/atari800.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore rec {
   core = "atari800";
-  version = "0-unstable-2026-05-28";
+  version = "0-unstable-2026-07-10";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-atari800";
-    rev = "b6638e72b9d7770144837b0b63c637dd7ab2b39c";
-    hash = "sha256-G1RJXhgMq8txotriK0Xy8HdDDCzeDbEQ+3LQ5sUt8G0=";
+    rev = "3f036fd69a0f0948d32a9a7cd97af3e0dd7ec434";
+    hash = "sha256-WnozEFNpW6qmSsQGTKzflitG6TVaozyOMcnAka+E1fE=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/beetle-psx.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2026-07-01";
+  version = "0-unstable-2026-07-11";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-psx-libretro";
-    rev = "b84c0c11677ea76fcad1e8958b9d25863c43a88f";
-    hash = "sha256-oKdM++ZH9FCGLVEkkbWGvyjk80HDOraU2rdPG7Mcle0=";
+    rev = "004268513bb56655fff358b8caee88503a141776";
+    hash = "sha256-47US8cQ0efhlTao8aW31yOdK/aGtWikYAtsAjQi83y4=";
   };
 
   extraBuildInputs = lib.optionals withHw [

pkgs/applications/emulators/libretro/cores/fceumm.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fceumm";
-  version = "0-unstable-2026-06-30";
+  version = "0-unstable-2026-07-06";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-fceumm";
-    rev = "6e00afac498903586330492cdd81354a6c4c0d4c";
-    hash = "sha256-0WPMqXj/hNtFxUAIL16B80SxZ8FW31M4g/8wVMZLv/w=";
+    rev = "0d610d9a6401697157f693a5407adf450a0e52fb";
+    hash = "sha256-4QroyuhQrH5FhK86nuUztvrIwG4Ibj2zltPhhdLuJm0=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/flycast.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2026-06-26";
+  version = "0-unstable-2026-07-10";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "7ec978e8521f75427ad38eb8f8f4f3cabaa891d0";
-    hash = "sha256-3ChQnJP6xI/Wd3BOlkauTYCNQz1MjSHk0lDmjX+Iugg=";
+    rev = "f09d1f22ef8d199b8b7a2395d0b46774e08a58c2";
+    hash = "sha256-labl5MPpBNkg/M95WzJgiKVdvHJDN6jeFSLsHg5+G78=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2026-06-19";
+  version = "0-unstable-2026-07-10";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "f33876ca3e4f021f4b273aeabed42b551243b71c";
-    hash = "sha256-cmA4aBzR33Df3SNyB3e/reQnQmF0alT6RIeXK+ew+us=";
+    rev = "fa4dca561e08d5be9077419f7b255e1da213ed21";
+    hash = "sha256-FfO5LzCH0hYqiVpE2qPJhX4gOrXqqYCoW4XRbz93La4=";
   };
 
   meta = {

pkgs/applications/emulators/wine/packages.nix

@@ -84,7 +84,6 @@ in
         if pkgs.stdenv.hostPlatform.isAarch64 then [ "--enable-archs=aarch64" ] else [ "--enable-win64" ];
       platforms = [
         "x86_64-linux"
-        "x86_64-darwin"
         "aarch64-linux"
       ];
       mainProgram = "wine";
@@ -145,7 +144,6 @@ in
           [ "--enable-archs=x86_64,i386" ];
       platforms = [
         "x86_64-linux"
-        "x86_64-darwin"
         "aarch64-linux"
       ];
       mainProgram = "wine";

pkgs/applications/misc/sweethome3d/default.nix

@@ -29,7 +29,6 @@ let
     ];
     platforms = [
       "i686-linux"
-      "x86_64-darwin"
       "x86_64-linux"
       "aarch64-darwin"
     ];

pkgs/applications/networking/browsers/firefox-bin/default.nix

@@ -41,7 +41,6 @@ let
     aarch64-linux = "linux-aarch64";
     # bundles are universal and can be re-used for both darwin architectures
     aarch64-darwin = "mac";
-    x86_64-darwin = "mac";
   };
 
   arch = mozillaPlatforms.${stdenv.hostPlatform.system};

pkgs/applications/networking/cluster/docker-machine/hyperkit.nix

@@ -30,6 +30,6 @@ buildGoModule rec {
     description = "HyperKit driver for docker-machine";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ atkinschang ];
-    platforms = [ "x86_64-darwin" ];
+    platforms = [ ];
   };
 }

pkgs/applications/networking/cluster/hadoop/default.nix

@@ -26,7 +26,6 @@
 
 assert lib.elem stdenv.system [
   "x86_64-linux"
-  "x86_64-darwin"
   "aarch64-linux"
   "aarch64-darwin"
 ];
@@ -178,7 +177,6 @@ in
         srcHash = "sha256-AkZjpHk57S3pYiZambxgRHR7PD51HSI4H1HHW9ICah4=";
         variant = "lean";
       };
-      x86_64-darwin = x86_64-linux;
       aarch64-linux = {
         version = "3.4.0";
         hash = "sha256-QWxzKtNyw/AzcHMv0v7kj91pw1HO7VAN9MHO84caFk8=";
@@ -199,7 +197,6 @@ in
         hash = "sha256-9RlQWcDUECrap//xf3sqhd+Qa8tuGZSHFjGfmXhkGgQ=";
         srcHash = "sha256-4OEsVhBNV9CJ+PN4FgCduUCVA9/el5yezSCZ6ko3+bU=";
       };
-      x86_64-darwin = x86_64-linux;
       aarch64-linux = x86_64-linux // {
         hash = "sha256-5Lv2uA72BJEva5v2yncyPe5gKNCNOPNsoHffVt6KXQ0=";
       };

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -35,7 +35,7 @@ let
         self = discord-development;
       };
     };
-    x86_64-darwin = {
+    aarch64-darwin = {
       discord = rec {
         branch = "stable";
         binaryName = desktopName;
@@ -62,7 +62,6 @@ let
       };
     };
 
-    aarch64-darwin = x86_64-darwin;
     default = x86_64-linux; # Used for unsupported platforms, so we can return *something* there.
   };
 
@@ -81,7 +80,6 @@ let
     ];
     platforms = [
       "x86_64-linux"
-      "x86_64-darwin"
       "aarch64-darwin"
     ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];

pkgs/applications/networking/instant-messengers/discord/linux.nix

@@ -222,7 +222,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontUnpack = true;
 
-  inherit libPath;
+  inherit libPath stageModules;
 
   autoPatchelfIgnoreMissingDeps = [
     "libssl.so.1.1"
@@ -262,7 +262,7 @@ stdenv.mkDerivation (finalAttrs: {
         --prefix LD_LIBRARY_PATH : ${finalAttrs.libPath}:$out/opt/${binaryName}:${addDriverRunpath.driverLink}/lib \
         --suffix VK_ADD_DRIVER_FILES : "${addDriverRunpath.driverLink}/share/vulkan/icd.d" \
         ${lib.strings.optionalString disableUpdates "--run ${lib.getExe disableBreakingUpdates}"} \
-        --run "${stageModules} $out/opt/${binaryName}/modules" \
+        --run "${finalAttrs.stageModules} $out/opt/${binaryName}/modules" \
         --add-flags ${lib.escapeShellArg commandLineArgs}
 
     ln -s $out/opt/${binaryName}/${binaryName} $out/bin/

pkgs/applications/networking/instant-messengers/ripcord/darwin.nix

@@ -33,6 +33,6 @@ stdenvNoCC.mkDerivation rec {
     # See: https://cancel.fm/ripcord/shareware-redistribution/
     license = lib.licenses.unfreeRedistributable;
     maintainers = with lib.maintainers; [ mikroskeem ];
-    platforms = [ "x86_64-darwin" ];
+    platforms = [ ];
   };
 }

pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix

@@ -41,7 +41,6 @@ let
     x86_64-linux = "linux-x86_64";
     # bundles are universal and can be re-used for both darwin architectures
     aarch64-darwin = "mac";
-    x86_64-darwin = "mac";
   };
 
   throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";

pkgs/applications/office/libreoffice/darwin/default.nix

@@ -18,13 +18,6 @@ let
       url = "https://download.documentfoundation.org/libreoffice/stable/${version}/mac/${arch}/LibreOffice_${version}_MacOS_${archSuffix}.dmg";
       sha256 = "64e0ad05564554eeee639d49b08b20908a38d4722ec95f1620d05c99bcbe9fb1";
     };
-
-    x86_64-darwin = rec {
-      arch = "x86_64";
-      archSuffix = "x86-64";
-      url = "https://download.documentfoundation.org/libreoffice/stable/${version}/mac/${arch}/LibreOffice_${version}_MacOS_${archSuffix}.dmg";
-      sha256 = "f92ba40fdada173232fe929bf77973a1ffcccec55ae7971957a6de84d33f0f1e";
-    };
   };
 in
 stdenvNoCC.mkDerivation {
@@ -78,7 +71,6 @@ stdenvNoCC.mkDerivation {
     maintainers = with lib.maintainers; [ tricktron ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     platforms = [
-      "x86_64-darwin"
       "aarch64-darwin"
     ];
   };

pkgs/applications/science/chemistry/quantum-espresso/default.nix

@@ -134,7 +134,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2;
     platforms = [
       "x86_64-linux"
-      "x86_64-darwin"
     ];
     maintainers = [ lib.maintainers.costrouc ];
   };

pkgs/applications/science/math/R/default.nix

@@ -27,6 +27,7 @@
   pkg-config,
   bison,
   which,
+  llvmPackages,
   jdk,
   blas,
   lapack,
@@ -68,7 +69,10 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     tzdata
     which
-  ];
+  ]
+  # TODO: Remove once #536365 reaches this branch
+  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.lld;
+
   buildInputs = [
     bzip2
     gfortran
@@ -126,6 +130,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontDisableStatic = static;
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    # TODO: Remove once #536365 reaches this branch
+    NIX_CFLAGS_LINK = "-fuse-ld=lld";
+  };
+
   preConfigure = ''
     configureFlagsArray=(
       --disable-lto

pkgs/applications/video/mplayer/default.nix

@@ -300,7 +300,6 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = [
       "i686-linux"
       "x86_64-linux"
-      "x86_64-darwin"
       "aarch64-darwin"
       "aarch64-linux"
     ];

pkgs/build-support/build-fhsenv-bubblewrap/default.nix

@@ -348,6 +348,8 @@ runCommandLocal name
     // {
       inherit nativeBuildInputs;
 
+      __structuredAttrs = true;
+
       passthru = passthru // {
         env =
           runCommandLocal "${name}-shell-env"

pkgs/build-support/build-typst-package.nix

@@ -40,9 +40,6 @@ lib.extendMkDerivation {
     {
       name = "typst-package-${finalAttrs.pname}-${finalAttrs.version}";
 
-      strictDeps = true;
-      __structuredAttrs = true;
-
       dontBuild = true;
 
       installPhase =

pkgs/build-support/go/module.nix

@@ -320,15 +320,10 @@ lib.extendMkDerivation {
               }
 
               getGoDirs() {
-                local -r type="$1"
-
-                # Support strucuredAttrs, they are not space seperated
-                local -a subPackagesArray
-                concatTo subPackagesArray subPackages
-
-                # Outputs each element prefixed with './' if the array is not empty
-                if [[ ''${#subPackagesArray[@]} -gt 0 ]]; then
-                  echo "''${subPackagesArray[*]/#/./}"
+                local type;
+                type="$1"
+                if [ -n "$subPackages" ]; then
+                  echo "$subPackages" | sed "s,\(^\| \),\1./,g"
                 else
                   find . -type f -name \*$type.go -exec dirname {} \; | grep -v "/vendor/" | sort --unique | grep -v "$exclude"
                 fi

pkgs/build-support/lake/default.nix

@@ -43,6 +43,8 @@ lib.extendMkDerivation {
   extendDrvArgs =
     finalAttrs:
     {
+      pname,
+      version,
       nativeBuildInputs ? [ ],
       passthru ? { },
 
@@ -66,12 +68,6 @@ lib.extendMkDerivation {
       ...
     }@args:
     let
-      lakeDeps' = args.lakeDeps or null;
-      lakeHash = args.lakeHash or null;
-      leanDeps = args.leanDeps or [ ];
-      overrideLakeDepsAttrs = args.overrideLakeDepsAttrs or (_: _: { });
-      buildTargets = args.buildTargets or [ ];
-      isLibrary = args.isLibrary or true;
       leanPackageName = args.leanPackageName or finalAttrs.pname;
 
       allLeanDeps = lib.unique (
@@ -79,14 +75,13 @@ lib.extendMkDerivation {
       );
 
       computedLakeDeps =
-        if lakeDeps' != null then
-          lakeDeps'
+        if lakeDeps != null then
+          lakeDeps
         else if lakeHash == null then
           null
         else
           (fetchLakeDeps {
-            name = finalAttrs.name or "${finalAttrs.pname}-${finalAttrs.version}";
-            inherit (finalAttrs) src;
+            inherit (finalAttrs) src pname version;
             hash = lakeHash;
             sourceRoot = finalAttrs.sourceRoot or "";
             patches = finalAttrs.patches or [ ];
@@ -233,6 +228,8 @@ lib.extendMkDerivation {
       };
 
       meta = meta // {
+        # Note: This conflates the platforms that the Lean compiler can run on (a package build system) and the platforms the Lean compiler
+        # can target (build host)
         platforms = meta.platforms or lean4.meta.platforms;
       };
     };

pkgs/build-support/lake/fetch-lake-deps.nix

@@ -13,83 +13,88 @@
   jq,
 }:
 
-{
-  name,
-  src,
-  hash,
-  sourceRoot ? "",
-  patches ? [ ],
-  prePatch ? "",
-  postPatch ? "",
-  # Package names to skip (e.g. already packaged in nix).
-  excludePackages ? [ ],
-}:
+lib.extendMkDerivation {
+  constructDrv = stdenvNoCC.mkDerivation;
 
-stdenvNoCC.mkDerivation {
-  name = "${name}-lake-deps";
-
-  inherit
-    src
-    sourceRoot
-    patches
-    prePatch
-    postPatch
-    ;
-
-  nativeBuildInputs = [
-    gitMinimal
-    cacert
-    jq
+  excludeDrvArgNames = [
+    "excludePackages"
   ];
 
-  impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
-    "GIT_PROXY_COMMAND"
-    "SOCKS_SERVER"
-  ];
+  extendDrvArgs =
+    finalAttrs:
+    {
+      pname,
+      version,
+      src,
+      hash,
+      sourceRoot ? "",
+      patches ? [ ],
+      prePatch ? "",
+      postPatch ? "",
+      # Package names to skip (e.g. already packaged in nix).
+      excludePackages ? [ ],
+    }:
+    {
+      strictDeps = true;
+      __structuredAttrs = true;
 
-  dontConfigure = true;
+      pname = "${pname}-lake-deps";
 
-  buildPhase = ''
-    runHook preBuild
+      nativeBuildInputs = [
+        gitMinimal
+        cacert
+        jq
+      ];
 
-    if [ ! -f lake-manifest.json ]; then
-      echo "fetchLakeDeps: lake-manifest.json not found" >&2
-      exit 1
-    fi
+      impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
+        "GIT_PROXY_COMMAND"
+        "SOCKS_SERVER"
+      ];
 
-    export HOME="$TMPDIR"
-    export GIT_SSL_CAINFO="$NIX_SSL_CERT_FILE"
+      dontConfigure = true;
 
-    mkdir -p "$TMPDIR/packages"
+      buildPhase = ''
+        runHook preBuild
 
-    jq -c --argjson exclude ${lib.escapeShellArg (builtins.toJSON excludePackages)} \
-      '.packages[] | select(.type == "git") | select(.name as $n | $exclude | index($n) | not)' \
-      lake-manifest.json | while IFS= read -r pkg; do
-      name=$(echo "$pkg" | jq -r '.name')
-      url=$(echo "$pkg" | jq -r '.url')
-      rev=$(echo "$pkg" | jq -r '.rev')
+        if [ ! -f lake-manifest.json ]; then
+          echo "fetchLakeDeps: lake-manifest.json not found" >&2
+          exit 1
+        fi
 
-      echo "fetchLakeDeps: cloning $name ($url @ $rev)"
+        export HOME="$TMPDIR"
+        export GIT_SSL_CAINFO="$NIX_SSL_CERT_FILE"
 
-      git clone --filter=blob:none --no-checkout "$url" "$TMPDIR/packages/$name"
-      git -C "$TMPDIR/packages/$name" checkout "$rev" --quiet
+        mkdir -p "$TMPDIR/packages"
 
-      # Remove .git to make output deterministic
-      rm -rf "$TMPDIR/packages/$name/.git"
-    done
+        jq -c --argjson exclude ${lib.escapeShellArg (builtins.toJSON excludePackages)} \
+          '.packages[] | select(.type == "git") | select(.name as $n | $exclude | index($n) | not)' \
+          lake-manifest.json | while IFS= read -r pkg; do
+          name=$(echo "$pkg" | jq -r '.name')
+          url=$(echo "$pkg" | jq -r '.url')
+          rev=$(echo "$pkg" | jq -r '.rev')
 
-    runHook postBuild
-  '';
+          echo "fetchLakeDeps: cloning $name ($url @ $rev)"
 
-  installPhase = ''
-    runHook preInstall
-    mv "$TMPDIR/packages" "$out"
-    runHook postInstall
-  '';
+          git clone --filter=blob:none --no-checkout "$url" "$TMPDIR/packages/$name"
+          git -C "$TMPDIR/packages/$name" checkout "$rev" --quiet
 
-  dontFixup = true;
+          # Remove .git to make output deterministic
+          rm -rf "$TMPDIR/packages/$name/.git"
+        done
 
-  outputHashMode = "recursive";
-  outputHash = hash;
-  outputHashAlgo = if hash == "" then "sha256" else null;
+        runHook postBuild
+      '';
+
+      installPhase = ''
+        runHook preInstall
+        mv "$TMPDIR/packages" "$out"
+        runHook postInstall
+      '';
+
+      dontFixup = true;
+
+      outputHashMode = "recursive";
+      outputHash = hash;
+      outputHashAlgo = if hash == "" then "sha256" else null;
+    };
 }

pkgs/build-support/setup-hooks/make-wrapper.sh

@@ -3,8 +3,6 @@
 # assertExecutable FILE
 assertExecutable() {
     local file="$1"
-    [[ -e "$file" ]] || \
-        die "Cannot wrap '$file' because it does not exist"
     [[ -f "$file" && -x "$file" ]] || \
         die "Cannot wrap '$file' because it is not an executable file"
 }