Merge master into staging-nixos

Both `pam_unix.so` and `pam_unix_ng.so` look at `ENCRYPT_METHOD` in
`/etc/login.defs` to determine the algorithm to use for password
encryption: 66fbd0382b/src/pam_unix_ng-common.c (L27-L62)
If this is not set, both already default to `YESCRYPT`.
The shadow module makes this configurable via
`security.loginDefs.settings.ENCRYPT_METHOD`, which also defaults to `YESCRYPT`.
Seeing as what was previously hardcoded is default anyways, with a global
configuration option to change it, there is no point to keep this.

nixos/lib/test-driver/src/test_driver/__init__.py

@@ -89,6 +89,11 @@ def main() -> None:
         type=Path,
         required=True,
     )
+    arg_parser.add_argument(
+        "--test-script",
+        help="path to a test script to run, taking precedence over the one defined in the config file",
+        type=Path,
+    )
     arg_parser.add_argument(
         "--keep-vm-state",
         help=argparse.SUPPRESS,
@@ -163,8 +168,12 @@ def main() -> None:
     if args.debug_hook_attach is not None:
         debugger = Debug(logger, args.debug_hook_attach)
 
+    config = load_driver_configuration(args.config)
+    if args.test_script is not None:
+        config.test_script = args.test_script
+
     with Driver(
-        config=load_driver_configuration(args.config),
+        config=config,
         out_dir=output_directory,
         logger=logger,
         keep_machine_state=args.keep_machine_state,

nixos/modules/security/pam.nix

@@ -1422,7 +1422,6 @@ let
                 modulePath = config.security.pam.pam_unixModulePath;
                 settings = {
                   nullok = true;
-                  yescrypt = lib.mkIf config.security.pam.enableLegacySettings true;
                 };
               }
               {

nixos/modules/services/display-managers/gdm.nix

@@ -577,7 +577,6 @@ in
               control = "requisite";
               modulePath = config.security.pam.pam_unixModulePath;
               settings.nullok = true;
-              settings.yescrypt = true;
             }
           ];
 

nixos/modules/services/x11/display-managers/lightdm.nix

@@ -456,7 +456,6 @@ in
             control = "requisite";
             modulePath = config.security.pam.pam_unixModulePath;
             settings.nullok = true;
-            settings.yescrypt = true;
           }
         ];
 

nixos/tests/all-tests.nix

@@ -153,6 +153,7 @@ in
     console-log = runTest ./nixos-test-driver/console-log.nix;
     containers = runTest ./nixos-test-driver/containers.nix;
     nspawn-daemon-reexec-dbus = runTest ./nspawn-daemon-reexec-dbus.nix;
+    multi-arch-test = runTest ./nixos-test-driver/multi-arch-test.nix;
     skip-typecheck = runTest ./nixos-test-driver/skip-typecheck.nix;
     console-timeout = runTest ./nixos-test-driver/console-timeout.nix;
     options-doc-regression = import ./nixos-test-driver/options-doc-regression.nix { inherit pkgs; };

nixos/tests/login-nosuid.nix

@@ -57,6 +57,7 @@
     with subtest("create user"):
         machine.succeed("useradd -m alice")
         machine.succeed("(echo foobar; echo foobar) | passwd alice")
+        machine.succeed("grep -F 'alice:$y$' /etc/shadow")
 
     with subtest("Check whether switching VTs works"):
         machine.fail("pgrep -f 'agetty.*tty2'")

nixos/tests/login.nix

@@ -28,6 +28,7 @@
     with subtest("create user"):
         machine.succeed("useradd -m alice")
         machine.succeed("(echo foobar; echo foobar) | passwd alice")
+        machine.succeed("grep -F 'alice:$y$' /etc/shadow")
 
     with subtest("Check whether switching VTs works"):
         machine.fail("pgrep -f 'agetty.*tty2'")

nixos/tests/nixos-test-driver/multi-arch-test.nix

@@ -0,0 +1,55 @@
+{ pkgs, lib, ... }:
+{
+  name = "multi-arch-test";
+  meta.maintainers = with pkgs.lib.maintainers; [ tfc ];
+
+  node.pkgsReadOnly = false;
+
+  nodes = {
+    # Setting build = host platform because such standard VM setups
+    # are well-cached by the multi-arch build infrastructure of the
+    # project.
+    vmIntel = {
+      nixpkgs.buildPlatform = "x86_64-linux";
+      nixpkgs.hostPlatform = "x86_64-linux";
+    };
+    vmArm = {
+      nixpkgs.buildPlatform = "aarch64-linux";
+      nixpkgs.hostPlatform = "aarch64-linux";
+    };
+  };
+
+  defaults = {
+    # not needed for this test and shrinks the closure
+    # because we dont' need qemu for all architectures
+    virtualisation.qemu.guestAgent.enable = false;
+
+    # the test is already very slow but we don't need DHCP anyway
+    networking.dhcpcd.enable = false;
+
+    # fix the network-online target, otherwise it doesn't work
+    # properly as a synchronization mechanism.
+    systemd.network.wait-online.enable = true;
+    systemd.network.wait-online.anyInterface = true;
+  };
+
+  # slow due to SW emulation but shouldn't be slower than that
+  globalTimeout = 5 * 60;
+
+  testScript = { nodes, ... }: /* python */ ''
+    start_all()
+
+    vmIntel.systemctl("start network-online.target")
+    vmArm.systemctl("start network-online.target")
+    vmIntel.wait_for_unit("network-online.target")
+    vmArm.wait_for_unit("network-online.target")
+
+    vmIntel.succeed("ping -c 1 vmArm")
+    vmArm.succeed("ping -c 1 vmIntel")
+
+    archIntel = vmIntel.succeed("uname -m")
+    t.assertIn("${nodes.vmIntel.nixpkgs.hostPlatform.qemuArch}", archIntel, "machine1 is an intel VM")
+    archArm = vmArm.succeed("uname -m")
+    t.assertIn("${nodes.vmArm.nixpkgs.hostPlatform.qemuArch}", archArm, "machine1 is an ARM VM")
+  '';
+}

pkgs/by-name/dn/dn42-registry-wizard/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dn42-registry-wizard";
-  version = "0.4.20";
+  version = "0.4.21";
 
   src = fetchFromGitHub {
     owner = "Kioubit";
     repo = "dn42_registry_wizard";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WFU1K0Ib1ETSib2WJkwus3zHYJXoVOtFDqv4/QNiP7E=";
+    hash = "sha256-PvB+rlIaedjCVA/8sDW754vvomVASIDhkUQlimZGiRg=";
   };
 
-  cargoHash = "sha256-o8MF6uqk8f0Zc2fjBqLGElh56TKjLRRtNxrll5nY+bM=";
+  cargoHash = "sha256-tSxxsRQCbbP6iRT8sNfA/JVLm72PsSSCsC80hD5ZVxw=";
 
   postInstall = ''
     mv $out/bin/{registry_wizard,dn42-registry-wizard}

pkgs/by-name/op/openresolv/package.nix

@@ -13,8 +13,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "NetworkConfiguration";
     repo = "openresolv";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-I86BHiSI3G4xlYRJC99elHw8RyUd3eHdkV5kiEGRXNE=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-I86BHiSI3G4xlYRJC99elHw8RyUd3eHdkV5kiEGRXNE=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -38,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
+    changelog = "https://github.com/NetworkConfiguration/openresolv/releases/tag/${finalAttrs.src.tag}";
     description = "Program to manage /etc/resolv.conf";
     mainProgram = "resolvconf";
     homepage = "https://roy.marples.name/projects/openresolv";

pkgs/top-level/all-packages.nix

@@ -7981,7 +7981,6 @@ with pkgs;
 
   qemu_test = lowPrio (
     qemu.override {
-      hostCpuOnly = true;
       nixosTestRunner = true;
     }
   );