Merge release-26.05 into staging-next-26.05

Changelog: https://github.com/hykilpikonna/hyfetch/releases/tag/2.1.0
(cherry picked from commit 052f82e811)

.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,6 @@
+<!--
+    Please note: This blank issue template is meant for extraordinary issues
+    that do not fit the templates. Unless you know your issue is relevant to
+    Nixpkgs and requires the free-form blank issue, please use the issue
+    templates instead.
+-->

.github/ISSUE_TEMPLATE/01_bug_report.yml

@@ -35,8 +35,8 @@ body:
         If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
       options:
         - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Stable (26.05)"
+        - "- Unstable (26.05)"
+        - "- Stable (25.11)"
       default: 0
     validations:
       required: true

.github/ISSUE_TEMPLATE/02_bug_report_darwin.yml

@@ -35,8 +35,8 @@ body:
         If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
       options:
         - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Stable (26.05)"
+        - "- Unstable (26.05)"
+        - "- Stable (25.11)"
       default: 0
     validations:
       required: true
@@ -99,7 +99,7 @@ body:
     attributes:
       label: "Are you using nix-darwin?"
       description: |
-        [`nix-darwin`](https://github.com/nix-darwin/nix-darwin) is a set of NixOS-like modules for macOS systems. Depending on your issue, this information may be relevant.
+        [`nix-darwin`](https://github.com/LnL7/nix-darwin) is a set of NixOS-like modules for macOS systems. Depending on your issue, this information may be relevant.
       options:
         - "Yes, I am using nix-darwin."
         - "No, I am not using nix-darwin."

.github/ISSUE_TEMPLATE/03_bug_report_nixos.yml

@@ -35,8 +35,8 @@ body:
         If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
       options:
         - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Stable (26.05)"
+        - "- Unstable (26.05)"
+        - "- Stable (25.11)"
       default: 0
     validations:
       required: true

.github/ISSUE_TEMPLATE/04_build_failure.yml

@@ -37,8 +37,8 @@ body:
         If you are purposefully trying to build an ancient version of a package in an older Nixpkgs, please coordinate with the [NixOS Archivists](https://matrix.to/#/#archivists:nixos.org).
       options:
         - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Stable (26.05)"
+        - "- Unstable (26.05)"
+        - "- Stable (25.11)"
       default: 0
     validations:
       required: true

.github/ISSUE_TEMPLATE/05_update_request.yml

@@ -37,8 +37,8 @@ body:
         If the package has been updated in unstable, but you believe the update should be backported to the stable release of Nixpkgs, please file the '**Request: backport to stable**' form instead.
       options:
         - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Stable (26.05)"
+        - "- Unstable (26.05)"
+        - "- Stable (25.11)"
       default: 0
     validations:
       required: true

.github/ISSUE_TEMPLATE/06_module_request.yml

@@ -35,8 +35,8 @@ body:
         If you are using an older or stable version, please update to the latest **unstable** version and check if the module still does not exist before continuing this request.
       options:
         - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Stable (26.05)"
+        - "- Unstable (26.05)"
+        - "- Stable (25.11)"
       default: 0
     validations:
       required: true

README.md

@@ -13,7 +13,7 @@
   <a href="https://opencollective.com/nixos"><img src="https://opencollective.com/nixos/tiers/supporter/badge.svg?label=supporters&color=brightgreen" alt="Open Collective supporters" /></a>
 </p>
 
-[Nixpkgs](https://github.com/nixos/nixpkgs) is a collection of over 140,000 software packages that can be installed with the [Nix](https://nixos.org/nix/) package manager.
+[Nixpkgs](https://github.com/nixos/nixpkgs) is a collection of over 120,000 software packages that can be installed with the [Nix](https://nixos.org/nix/) package manager.
 It also implements [NixOS](https://nixos.org/nixos/), a purely-functional Linux distribution.
 
 # Manuals

ci/OWNERS

@@ -56,12 +56,6 @@
 /pkgs/top-level/splice.nix                       @Ericson2314
 /pkgs/top-level/release-cross.nix                @Ericson2314
 /pkgs/top-level/by-name-overlay.nix              @infinisil @philiptaron
-/pkgs/top-level/config.nix                       @jopejoe1
-/pkgs/top-level/make-tarball.nix                 @jopejoe1
-/pkgs/top-level/packages-config.nix              @jopejoe1
-/pkgs/top-level/packages-info.nix                @jopejoe1
-/pkgs/top-level/release-lib.nix                  @jopejoe1
-/pkgs/top-level/release.nix                      @jopejoe1
 /pkgs/stdenv                                     @philiptaron @NixOS/stdenv
 /pkgs/stdenv/generic                             @Ericson2314 @NixOS/stdenv
 /pkgs/stdenv/generic/problems.nix                @infinisil
@@ -79,7 +73,6 @@
 
 ## Format generators/serializers
 /pkgs/pkgs-lib                                   @Stunkymonkey @h7x4
-/pkgs/pkgs-lib/formats/json2x                    @Stunkymonkey @h7x4 @figsoda
 
 # Nixpkgs build-support
 /pkgs/build-support/writers @lassulus
@@ -131,7 +124,6 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 
 # NixOS integration test driver
 /nixos/lib/test-driver  @tfc
-/nixos/lib/testing      @tfc
 
 # NixOS QEMU virtualisation
 /nixos/modules/virtualisation/qemu-vm.nix                 @raitobezarius
@@ -277,15 +269,15 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /lib/licenses @alyssais @emilazy @jopejoe1
 
 # Qt
-/pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000
-/pkgs/development/libraries/qt-6 @K900 @NickCao @SuperSandro2000
+/pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000 @ttuegel
+/pkgs/development/libraries/qt-6 @K900 @NickCao @SuperSandro2000 @ttuegel
 
 # KDE Frameworks 5
-/pkgs/development/libraries/kde-frameworks @K900 @NickCao @SuperSandro2000
+/pkgs/development/libraries/kde-frameworks @K900 @NickCao @SuperSandro2000 @ttuegel
 
 # KDE / Plasma 6
-/pkgs/kde @K900 @NickCao @SuperSandro2000
-/maintainers/scripts/kde @K900 @NickCao @SuperSandro2000
+/pkgs/kde @K900 @NickCao @SuperSandro2000 @ttuegel
+/maintainers/scripts/kde @K900 @NickCao @SuperSandro2000 @ttuegel
 
 # PostgreSQL and related stuff
 /pkgs/by-name/po/postgresqlTestHook @NixOS/postgres
@@ -445,7 +437,6 @@ nixos/tests/forgejo.nix               @adamcstephens @bendlas @christoph-heiss @
 /doc/languages-frameworks/javascript.section.md @winterqt
 /pkgs/development/tools/pnpm                    @Scrumplex @gepbird
 /pkgs/build-support/node/fetch-pnpm-deps        @Scrumplex @gepbird
-/pkgs/test/pnpm                                 @Scrumplex @gepbird
 
 # OCaml
 /pkgs/build-support/ocaml           @ulrikstrid
@@ -533,6 +524,3 @@ pkgs/by-name/wa/warp-terminal/  @emilytrau @imadnyc @FlameFlag @johnrtitor
 # Radicle
 /pkgs/build-support/fetchradicle/      @NixOS/radicle
 /pkgs/build-support/fetchradiclepatch/ @NixOS/radicle
-
-# Zellij plugins
-/pkgs/by-name/ze/zellij/plugins/   @PerchunPak

doc/README.md

@@ -207,8 +207,6 @@ When needed, each convention explains why it exists, so you can make a decision
 Note that these conventions are about the **structure** of the manual (and its source files), not about the content that goes in it.
 You, as the writer of documentation, are still in charge of its content.
 
-**For prose style, see the [documentation styleguide](./styleguide.md).**
-
 ### One sentence per line
 
 Put each sentence in its own line.
@@ -221,16 +219,17 @@ When changing existing content, update formatting if possible, but avoid excessi
 
 ### Examples first
 
-Put examples before detailed explanations (see the [styleguide](./styleguide.md) for the rationale).
+Readers look at examples first: an example communicates what something does faster than a description.
+Put examples before detailed explanations.
 
-Use this structure for each documented item:
+Prefer this structure for each documented item:
 
 1. Title
-2. Abstract (optional, one sentence max)
+2. Abstract (optional, one sentence max, the example often speaks for itself)
 3. Example
 4. Explanation (details, edge cases, types, defaults)
 
-Rendered example:
+For instance:
 
 ````markdown
 ## `lib.toUpper`
@@ -282,9 +281,11 @@ Returns the difference as a number.
 
 Use the [admonition syntax](#admonitions) for callouts and examples.
 
-### `callPackage`-compatible examples
+### Provide self-contained examples
 
-Provide at least one example per function.
+Provide at least one example per function, and make examples self-contained.
+This is easier to understand for beginners.
+It also helps with testing that it actually works – especially once we introduce automation.
 
 Example code should be such that it can be passed to `pkgs.callPackage`.
 Instead of something like:

doc/hooks/index.md

@@ -37,7 +37,6 @@ npm-install-hook.section.md
 patch-rc-path-hooks.section.md
 perl.section.md
 pkg-config.section.md
-pnpm.section.md
 postgresql-test-hook.section.md
 premake.section.md
 python.section.md
@@ -49,7 +48,6 @@ unzip.section.md
 validatePkgConfig.section.md
 versionCheckHook.section.md
 waf.section.md
-writable-tmpdir-as-home-hook.section.md
 zig.section.md
 xcbuild.section.md
 xfce4-dev-tools.section.md

doc/hooks/pnpm.section.md

@@ -1,142 +0,0 @@
-# pnpmBuildHook {#pnpm-build-hook}
-
-[pnpm](https://pnpm.io/) is a an NPM-compatible package manager focused on increasing managment speeds, and reducing disk space.
-
-The `pnpmBuildHook` in Nixpkgs overrides the default build phase for building packages that use pnpm.
-
-:::{.example #ex-pnpm-build-hook}
-## pnpmBuildHook example code snippet {#pnpm-build-hook-code-snippet}
-
-```
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchPnpmDeps,
-  pnpmConfigHook,
-  pnpmBuildHook,
-  makeBinaryWrapper,
-  pnpm_10,
-}:
-let
-  pnpm = pnpm_10;
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "coolPackages";
-  version = "1.0";
-
-  src = fetchFromGitHub {
-    owner = "JaneCool";
-    repo = "coolpackage";
-    tag = finalAttrs.version;
-    hash = lib.fakeHash;
-  };
-
-  __structuredAttrs = true;
-  strictDeps = true;
-
-  pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
-    inherit pnpm;
-    fetcherversion = 4;
-    hash = lib.fakeHash;
-  };
-
-  nativeBuildInputs = [
-    pnpmConfigHook
-    pnpmBuildHook
-    makeBinaryWrapper
-  ];
-
-  pnpmBuildScript = "build";
-  pnpmBuildFlags = [
-    "--mode"
-    "production"
-  ];
-  pnpmWorkspaces = [
-    "test"
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir "$out"
-    cp -r dist/. "$out"
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "very cool package that does cool things";
-    mainProgram = "cool";
-  };
-})
-```
-:::
-
-## Variables controlling pnpmBuildHook {#pnpm-build-hook-variables}
-
-### pnpm Exclusive Variables {#pnpm-build-hook-exclusive-variables}
-
-#### `pnpmBuildScript` {#pnpm-build-hook-script}
-
-Controls the script ran to build the package, by default the script is `build`.
-
-#### `pnpmFlags` {#pnpm-build-hook-flags}
-
-Controls flags used for all invocations of pnpm across all hooks local to this derivation.
-
-#### `pnpmBuildFlags` {#pnpm-build-hook-build-flags}
-
-Controls the flags pass only to the pnpm build script invocation.
-
-#### `dontPnpmBuild` {#pnpm-build-hook-dont}
-
-Disables automatically running `pnpmBuildHook`. The build can still be run manually if needed, for example:
-
-```
-{
-  lib,
-  rustPlatform,
-  pnpmBuildHook,
-  pnpmConfigHook,
-  fetchPnpmDeps,
-  emptyDirectory,
-  pnpm_10,
-}:
-let
-  pnpm = pnpm_10;
-in
-rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "super-fast-application";
-  version = "1.0";
-
-  src = emptyDirectory;
-
-  cargoHash = lib.fakeHash;
-
-  nativeBuildInputs = [
-    pnpmBuildHook
-    pnpmConfigHook
-  ];
-
-  pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
-    inherit pnpm;
-    fetcherversion = 3;
-    hash = lib.fakeHash;
-  }
-
-  dontPnpmBuild = true;
-  postBuild = ''
-    pnpmBuildHook
-  '';
-})
-```
-
-### Honored Variables {#pnpm-build-hook-honored-variables}
-
-The following variables are honored by `pnpmBuildHook`.
-
-* [`pnpmRoot`](#javascript-pnpm-sourceRoot)
-* [`pnpmWorkspaces`](#javascript-pnpm-workspaces)

doc/hooks/writable-tmpdir-as-home-hook.section.md

@@ -1,5 +0,0 @@
-# writableTmpDirAsHomeHook {#writableTmpDirAsHomeHook}
-
-This setup hook provides a writable home directory for packages that require it.
-
-To use, just add the hook to the `nativeBuildInputs` of the package.

doc/languages-frameworks/javascript.section.md

@@ -309,8 +309,6 @@ pnpm is available as the top-level package `pnpm`. Additionally, there are varia
 
 When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` will prepare the build environment to install the pre-fetched dependencies store. Here is an example for a package that contains `package.json` and a `pnpm-lock.yaml` files using the fetcher and setup hook above:
 
-There is also the [`pnpmBuildHook`](#pnpm-build-hook) for building packages with `pnpm`, as seen in [](#ex-pnpm-build-hook).
-
 ```nix
 {
   fetchPnpmDeps,
@@ -513,10 +511,10 @@ Changes can include workarounds or bug fixes to existing PNPM issues.
 
 ##### Version history {#javascript-pnpm-fetcherVersion-versionHistory}
 
-Version 3 is the minimum supported value. Versions 1 and 2 were removed in the 26.11 release; packages that still use them fail to evaluate and must migrate to `fetcherVersion = 3` (or later) and regenerate their hashes.
+Version 3 is the recommended value for new packages. Versions 1 and 2 are deprecated and scheduled for removal in the 26.11 release; existing packages must migrate.
 
-- 1: Initial version, nothing special. (removed in 26.11)
-- 2: [Ensure consistent permissions](https://github.com/NixOS/nixpkgs/pull/422975) (removed in 26.11)
+- 1: Initial version, nothing special.
+- 2: [Ensure consistent permissions](https://github.com/NixOS/nixpkgs/pull/422975)
 - 3: [Build a reproducible tarball](https://github.com/NixOS/nixpkgs/pull/469950)
 - 4: [Dump SQLite database to an SQL file](https://github.com/NixOS/nixpkgs/pull/522703)
 

doc/languages-frameworks/lua.section.md

@@ -232,7 +232,7 @@ The following is an example:
         vyp
         lblasc
       ];
-      license = lib.licenses.mit;
+      license.fullName = "MIT/X11";
     };
   };
 }

doc/languages-frameworks/python.section.md

@@ -48,6 +48,7 @@ Based on the packages defined in `pkgs/top-level/python-packages.nix` an
 attribute set is created for each available Python interpreter. The available
 sets are
 
+* `pkgs.python27Packages`
 * `pkgs.python3Packages`
 * `pkgs.python311Packages`
 * `pkgs.python312Packages`
@@ -59,7 +60,9 @@ sets are
 
 and the aliases
 
+* `pkgs.python2Packages` pointing to `pkgs.python27Packages`
 * `pkgs.python3Packages` pointing to `pkgs.python313Packages`
+* `pkgs.pythonPackages` pointing to `pkgs.python2Packages`
 * `pkgs.pypy2Packages` pointing to `pkgs.pypy27Packages`
 * `pkgs.pypy3Packages` pointing to `pkgs.pypy310Packages`
 * `pkgs.pypyPackages` pointing to `pkgs.pypy2Packages`
@@ -284,27 +287,29 @@ because their behaviour is different:
 The `buildPythonPackage` function has a `overridePythonAttrs` method that can be
 used to override the package. In the following example we create an environment
 where we have the `blaze` package using an older version of `pandas`. We
-first override the Python package set, then instantiate an interpreter with
-that package set.
+override first the Python interpreter and pass `packageOverrides` which contains
+the overrides for packages in the package set.
 
 ```nix
 with import <nixpkgs> { };
 
 let
-  pythonPackages = python3Packages.overrideScope (
-    final: prev: {
-      pandas = prev.pandas.overridePythonAttrs (old: rec {
-        version = "0.19.1";
-        src = fetchPypi {
-          pname = "pandas";
-          inherit version;
-          hash = "sha256-JQn+rtpy/OA2deLszSKEuxyttqBzcAil50H+JDHUdCE=";
-        };
-      });
-    }
-  );
+  python = pkgs.python3.override {
+    packageOverrides = self: super: {
+      pandas = super.pandas.overridePythonAttrs (
+        finalAttrs: prevAttrs: {
+          version = "0.19.1";
+          src = fetchPypi {
+            pname = "pandas";
+            inherit (finalAttrs) version;
+            hash = "sha256-JQn+rtpy/OA2deLszSKEuxyttqBzcAil50H+JDHUdCE=";
+          };
+        }
+      );
+    };
+  };
 in
-(pythonPackages.python.withPackages (ps: [ ps.blaze ])).env
+(python.withPackages (ps: [ ps.blaze ])).env
 ```
 
 The next example shows a non trivial overriding of the `blas` implementation to
@@ -312,16 +317,15 @@ be used through out all of the Python package set:
 
 ```nix
 {
-  python3PackagesWithBlas = python3Packages.overrideScope (
-    final: prev: {
+  python3MyBlas = pkgs.python3.override {
+    packageOverrides = self: super: {
       # We need toPythonModule for the package set to evaluate this
-      blas = final.toPythonModule (prev.blas.override { blasProvider = final.mkl; });
-      lapack = final.toPythonModule (prev.lapack.override { lapackProvider = final.mkl; });
-    }
-  );
+      blas = super.toPythonModule (super.pkgs.blas.override { blasProvider = super.pkgs.mkl; });
+      lapack = super.toPythonModule (super.pkgs.lapack.override { lapackProvider = super.pkgs.mkl; });
+    };
+  };
 }
 ```
-This will create a new Python package set with the blas and lapack implementation set to Intel MKL.
 
 This is particularly useful for numpy and scipy users who want to gain speed with other blas implementations.
 Note that using `scipy = super.scipy.override { blas = super.pkgs.mkl; };` will likely result in
@@ -453,10 +457,11 @@ Note that overriding packages deeper in the dependency graph _can_ work, but it'
 let
   pyproject = pkgs.lib.importTOML ./pyproject.toml;
 
-  myPython3Packages = pkgs.python3Packages.overrideScope (
-    final: _: {
+  myPython = pkgs.python.override {
+    self = myPython;
+    packageOverrides = pyfinal: pyprev: {
       # An editable package with a script that loads our mutable location
-      my-editable = final.mkPythonEditablePackage {
+      my-editable = pyfinal.mkPythonEditablePackage {
         # Inherit project metadata from pyproject.toml
         pname = pyproject.project.name;
         inherit (pyproject.project) version;
@@ -467,10 +472,10 @@ let
         # Inject a script (other PEP-621 entrypoints are also accepted)
         inherit (pyproject.project) scripts;
       };
-    }
-  );
+    };
+  };
 
-  pythonEnv = myPython3Packages.python.withPackages (ps: [ ps.my-editable ]);
+  pythonEnv = myPython.withPackages (ps: [ ps.my-editable ]);
 
 in
 pkgs.mkShell { packages = [ pythonEnv ]; }
@@ -570,6 +575,9 @@ In contrast to [`python.buildEnv`](#python.buildenv-function), [`python.withPack
 more advanced options such as `ignoreCollisions = true` or `postBuild`. If you
 need them, you have to use [`python.buildEnv`](#python.buildenv-function).
 
+Python 2 namespace packages may provide `__init__.py` that collide. In that case
+[`python.buildEnv`](#python.buildenv-function) should be used with `ignoreCollisions = true`.
+
 #### Setup hooks {#setup-hooks}
 
 The following are setup hooks specifically for Python packages. Most of these
@@ -621,9 +629,10 @@ buildPythonPackage.override { stdenv = customStdenv; } {
 
 Several versions of the Python interpreter are available on Nix, as well as a
 high amount of packages. The attribute `python3` refers to the default
-interpreter, which is currently CPython 3.13. It is also possible to refer to
-specific versions, e.g., `python313` refers to CPython 3.13, and `pypy` refers
-to the default PyPy interpreter.
+interpreter, which is currently CPython 3.13. The attribute `python` refers to
+CPython 2.7 for backwards compatibility. It is also possible to refer to
+specific versions, e.g., `python313` refers to CPython 3.13, and `pypy` refers to
+the default PyPy interpreter.
 
 Python is used a lot, and in different ways. This affects also how it is
 packaged. In the case of Python on Nix, an important distinction is made between
@@ -635,6 +644,14 @@ In the Nixpkgs tree Python applications can be found throughout, depending on
 what they do, and are called from the main package set. Python libraries,
 however, are in separate sets, with one set per interpreter version.
 
+The interpreters have several common attributes. One of these attributes is
+`pkgs`, which is a package set of Python libraries for this specific
+interpreter. E.g., the `toolz` package corresponding to the default interpreter
+is `python3.pkgs.toolz`, and the CPython 3.13 version is `python313.pkgs.toolz`.
+The main package set contains aliases to these package sets, e.g.
+`pythonPackages` refers to `python.pkgs` and `python313Packages` to
+`python313.pkgs`.
+
 #### Installing Python and packages {#installing-python-and-packages}
 
 The Nix and NixOS manuals explain how packages are generally installed. In the
@@ -1004,7 +1021,7 @@ information. The output of the function is a derivation.
 
 An expression for `toolz` can be found in the Nixpkgs repository. As explained
 in the introduction of this Python section, a derivation of `toolz` is available
-for each interpreter version, e.g. `python313Packages.toolz` refers to the `toolz`
+for each interpreter version, e.g. `python313.pkgs.toolz` refers to the `toolz`
 derivation corresponding to the CPython 3.13 interpreter.
 
 The above example works when you're directly working on
@@ -1019,7 +1036,7 @@ with import <nixpkgs> { };
 
 (
   let
-    my_toolz = python313Packages.buildPythonPackage (finalAttrs: {
+    my_toolz = python313.pkgs.buildPythonPackage (finalAttrs: {
       pname = "toolz";
       version = "0.10.0";
       pyproject = true;
@@ -1029,7 +1046,7 @@ with import <nixpkgs> { };
         hash = "sha256-CP3V73yWSArRHBLUct4hrNMjWZlvaaUlkpm1QP66RWA=";
       };
 
-      build-system = [ python313Packages.setuptools ];
+      build-system = [ python313.pkgs.setuptools ];
 
       # has no tests
       doCheck = false;
@@ -1042,7 +1059,7 @@ with import <nixpkgs> { };
     });
 
   in
-  python313Packages.python.withPackages (
+  python313.withPackages (
     ps: with ps; [
       numpy
       my_toolz
@@ -1063,11 +1080,6 @@ of [`withPackages`](#python.withpackages-function) we used a `let` expression. Y
 `toolz` from the Nixpkgs package set this time, but instead took our own version
 that we introduced with the `let` expression.
 
-There is also a legacy API that can be accessed via `python3.pkgs`, which will also give access to
-the Python package set for a given interpreter. This API is not recommended to be used anymore
-because the package set at `python3.pkgs` is not spliced, while the package set at `python3Packages`
-is. This can lead to strange errors during cross-compilation, or if Python is used at build time.
-
 #### Handling dependencies {#handling-dependencies}
 
 Our example, `toolz`, does not have any dependencies on other Python packages or system libraries.
@@ -1705,22 +1717,27 @@ should also be done when packaging `A`.
 
 ### How to override a Python package? {#how-to-override-a-python-package}
 
-We can override the Python package set, then instantiate an interpreter with it.
-In the following example we rename the `pandas` package and build it.
+We can override the interpreter and pass `packageOverrides`. In the following
+example we rename the `pandas` package and build it.
 
 ```nix
 with import <nixpkgs> { };
 
-let
-  pythonPackages = python3Packages.overrideScope (
-    final: prev: {
-      pandas = prev.pandas.overridePythonAttrs {
-        name = "foo";
-      };
-    }
-  );
-in
-(pythonPackages.python.withPackages (ps: [ ps.pandas ])).env
+(
+  let
+    python =
+      let
+        packageOverrides = self: super: {
+          pandas = super.pandas.overridePythonAttrs (old: {
+            name = "foo";
+          });
+        };
+      in
+      pkgs.python313.override { inherit packageOverrides; };
+
+  in
+  python.withPackages (ps: [ ps.pandas ])
+).env
 ```
 
 Using `nix-build` on this expression will build an environment that contains the
@@ -1736,10 +1753,12 @@ the updated `scipy` version.
 ```nix
 with import <nixpkgs> { };
 
-let
-  pythonPackages = python313Packages.overrideScope (_: prev: { scipy = prev.scipy_0_17; });
-in
-(pythonPackages.python.withPackages (ps: [ ps.blaze ])).env
+(
+  let
+    packageOverrides = self: super: { scipy = super.scipy_0_17; };
+  in
+  (pkgs.python313.override { inherit packageOverrides; }).withPackages (ps: [ ps.blaze ])
+).env
 ```
 
 The requested package `blaze` depends on `pandas` which itself depends on `scipy`.
@@ -1753,16 +1772,14 @@ let
   pkgs = import <nixpkgs> { };
   newpkgs = import pkgs.path {
     overlays = [
-      (_: prev: {
+      (self: super: {
         python313 =
           let
-            pythonPackages = prev.python313Packages.overrideScope (
-              _: prev: {
-                numpy = prev.numpy_1_18;
-              }
-            );
+            packageOverrides = python-self: python-super: {
+              numpy = python-super.numpy_1_18;
+            };
           in
-          pythonPackages.python3;
+          super.python313.override { inherit packageOverrides; };
       })
     ];
   };
@@ -1903,8 +1920,9 @@ pkgs.mkShell rec {
 }
 ```
 
-In case the supplied venvShellHook is insufficient, you can define your own
-shell hook and adapt to your needs like in the following example:
+In case the supplied venvShellHook is insufficient, or when Python 2 support is
+needed, you can define your own shell hook and adapt to your needs like in the
+following example:
 
 ```nix
 with import <nixpkgs> { };
@@ -1917,6 +1935,8 @@ pkgs.mkShell rec {
   name = "impurePythonEnv";
   buildInputs = [
     pythonPackages.python
+    # Needed when using python 2.7
+    # pythonPackages.virtualenv
     # ...
   ];
 
@@ -1929,6 +1949,8 @@ pkgs.mkShell rec {
       echo "Skipping venv creation, '${venvDir}' already exists"
     else
       echo "Creating new venv environment in path: '${venvDir}'"
+      # Note that the module venv was only introduced in python 3, so for 2.7
+      # this needs to be replaced with a call to virtualenv
       ${pythonPackages.python.interpreter} -m venv "${venvDir}"
     fi
 
@@ -1955,17 +1977,19 @@ If you need to change a package's attribute(s) from `configuration.nix` you coul
 
 ```nix
 {
-  nixpkgs.config.packageOverrides = final: _: {
-    python3Packages = super.python3Packages.overrideScope (pySuper: {
-      twisted = pySuper.twisted.overridePythonAttrs {
-        src = final.fetchPypi {
-          pname = "Twisted";
-          version = "19.10.0";
-          hash = "sha256-c5S6fycq5yKnTz2Wnc9Zm8TvCTvDkgOHSKSQ8XJKUV0=";
-          extension = "tar.bz2";
-        };
+  nixpkgs.config.packageOverrides = super: {
+    python3 = super.python3.override {
+      packageOverrides = python-self: python-super: {
+        twisted = python-super.twisted.overridePythonAttrs (oldAttrs: {
+          src = super.fetchPypi {
+            pname = "Twisted";
+            version = "19.10.0";
+            hash = "sha256-c5S6fycq5yKnTz2Wnc9Zm8TvCTvDkgOHSKSQ8XJKUV0=";
+            extension = "tar.bz2";
+          };
+        });
       };
-    });
+    };
   };
 }
 ```
@@ -1981,7 +2005,7 @@ this snippet:
 
 ```nix
 {
-  myPythonPackages = python3Packages.overrideScope (final: super: { twisted = <...>; });
+  myPythonPackages = python3Packages.override { overrides = self: super: { twisted = <...>; }; };
 }
 ```
 
@@ -1990,17 +2014,19 @@ this snippet:
 Use the following overlay template:
 
 ```nix
-self: _: {
-  python3Packages = super.python3Packages.overrideScope (pySuper: {
-    twisted = pySuper.twisted.overrideAttrs {
-      src = final.fetchPypi {
-        pname = "Twisted";
-        version = "19.10.0";
-        hash = "sha256-c5S6fycq5yKnTz2Wnc9Zm8TvCTvDkgOHSKSQ8XJKUV0=";
-        extension = "tar.bz2";
-      };
+self: super: {
+  python = super.python.override {
+    packageOverrides = python-self: python-super: {
+      twisted = python-super.twisted.overrideAttrs (oldAttrs: {
+        src = super.fetchPypi {
+          pname = "Twisted";
+          version = "19.10.0";
+          hash = "sha256-c5S6fycq5yKnTz2Wnc9Zm8TvCTvDkgOHSKSQ8XJKUV0=";
+          extension = "tar.bz2";
+        };
+      });
     };
-  });
+  };
 }
 ```
 

doc/packages/darwin-builder.section.md

@@ -89,7 +89,7 @@ Note that if the builder is running and you have created the above ssh conf file
 {
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-22.11-darwin";
-    darwin.url = "github:nix-darwin/nix-darwin/master";
+    darwin.url = "github:lnl7/nix-darwin/master";
     darwin.inputs.nixpkgs.follows = "nixpkgs";
   };
 

doc/redirects.json

@@ -113,9 +113,6 @@
   "ex-pkgs-replace-vars-with": [
     "index.html#ex-pkgs-replace-vars-with"
   ],
-  "ex-pnpm-build-hook": [
-    "index.html#ex-pnpm-build-hook"
-  ],
   "ex-shfmt": [
     "index.html#ex-shfmt"
   ],
@@ -349,33 +346,6 @@
   "pkgs.treefmt.withConfig": [
     "index.html#pkgs.treefmt.withConfig"
   ],
-  "pnpm-build-hook": [
-    "index.html#pnpm-build-hook"
-  ],
-  "pnpm-build-hook-build-flags": [
-    "index.html#pnpm-build-hook-build-flags"
-  ],
-  "pnpm-build-hook-code-snippet": [
-    "index.html#pnpm-build-hook-code-snippet"
-  ],
-  "pnpm-build-hook-dont": [
-    "index.html#pnpm-build-hook-dont"
-  ],
-  "pnpm-build-hook-exclusive-variables": [
-    "index.html#pnpm-build-hook-exclusive-variables"
-  ],
-  "pnpm-build-hook-flags": [
-    "index.html#pnpm-build-hook-flags"
-  ],
-  "pnpm-build-hook-script": [
-    "index.html#pnpm-build-hook-script"
-  ],
-  "pnpm-build-hook-variables": [
-    "index.html#pnpm-build-hook-variables"
-  ],
-  "pnpm-build-hook-honored-variables": [
-    "index.html#pnpm-build-hook-honored-variables"
-  ],
   "preface": [
     "index.html#preface"
   ],
@@ -442,9 +412,6 @@
   "sec-meta-identifiers-cpe": [
     "index.html#sec-meta-identifiers-cpe"
   ],
-  "sec-meta-identifiers-purl": [
-    "index.html#sec-meta-identifiers-purl"
-  ],
   "sec-modify-via-packageOverrides": [
     "index.html#sec-modify-via-packageOverrides"
   ],
@@ -466,30 +433,6 @@
   "chap-overlays": [
     "index.html#chap-overlays"
   ],
-  "sec-nixpkgs-release-26.11": [
-    "release-notes.html#sec-nixpkgs-release-26.11"
-  ],
-  "sec-nixpkgs-release-26.11-highlights": [
-    "release-notes.html#sec-nixpkgs-release-26.11-highlights"
-  ],
-  "sec-nixpkgs-release-26.11-incompatibilities": [
-    "release-notes.html#sec-nixpkgs-release-26.11-incompatibilities"
-  ],
-  "sec-nixpkgs-release-26.11-lib": [
-    "release-notes.html#sec-nixpkgs-release-26.11-lib"
-  ],
-  "sec-nixpkgs-release-26.11-lib-breaking": [
-    "release-notes.html#sec-nixpkgs-release-26.11-lib-breaking"
-  ],
-  "sec-nixpkgs-release-26.11-lib-deprecations": [
-    "release-notes.html#sec-nixpkgs-release-26.11-lib-deprecations"
-  ],
-  "sec-nixpkgs-release-26.11-lib-additions-improvements": [
-    "release-notes.html#sec-nixpkgs-release-26.11-lib-additions-improvements"
-  ],
-  "sec-nixpkgs-release-26.11-notable-changes": [
-    "release-notes.html#sec-nixpkgs-release-26.11-notable-changes"
-  ],
   "sec-nixpkgs-release-26.05": [
     "release-notes.html#sec-nixpkgs-release-26.05"
   ],
@@ -968,15 +911,6 @@
   "var-meta-identifiers-possibleCPEs": [
     "index.html#var-meta-identifiers-possibleCPEs"
   ],
-  "var-meta-identifiers-purl": [
-    "index.html#var-meta-identifiers-purl"
-  ],
-  "var-meta-identifiers-purlParts": [
-    "index.html#var-meta-identifiers-purlParts"
-  ],
-  "var-meta-identifiers-purls": [
-    "index.html#var-meta-identifiers-purls"
-  ],
   "var-meta-teams": [
     "index.html#var-meta-teams"
   ],
@@ -1085,9 +1019,6 @@
   "tar-files": [
     "index.html#tar-files"
   ],
-  "writableTmpDirAsHomeHook": [
-    "index.html#writableTmpDirAsHomeHook"
-  ],
   "x86_64-darwin-26.05": [
     "release-notes.html#x86_64-darwin-26.05"
   ],

doc/release-notes/release-notes.md

@@ -3,7 +3,6 @@
 This section lists the release notes for each stable version of Nixpkgs and the current unstable revision.
 
 ```{=include=} sections
-rl-2611.section.md
 rl-2605.section.md
 rl-2511.section.md
 rl-2505.section.md

doc/release-notes/rl-2611.section.md

@@ -1,4 +1,4 @@
-# Nixpkgs 26.11 ("Zokor", 2026.11/??) {#sec-nixpkgs-release-26.11}
+# Nixpkgs 26.11 (2026.11/??) {#sec-nixpkgs-release-26.11}
 
 ## Highlights {#sec-nixpkgs-release-26.11-highlights}
 
@@ -10,41 +10,13 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
-
-- `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.
-- `python3Packages.django-health-check` has been updated to major version 4. See its [migration guide](https://codingjoe.dev/django-health-check/migrate-to-v4/) and [changelog](https://github.com/codingjoe/django-health-check/releases/tag/4.0.0) for breaking changes.
-
-- `libgdata` has been removed, as it was archived upstream and relied on the insecure libsoup 2.4.
-
-- `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
-
-- The ARMv5 Linux kernel build now uses a standard configuration and generates a standard compressed image instead of the deprecated legacy U‐Boot image format.
-  `lib.systems.{examples,platforms}.{sheevaplug,pogoplug4}` have been unified into `lib.systems.examples.armv5tel-multiplatform`.
-  Note that there is no official support for ARMv5 and it is not possible to build even a simple NixOS configuration out of the box.
-
-- Support for the legacy U‐Boot image format has been removed from the Linux kernel builders, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
-
-- `requireFile` now sets `meta.license = lib.licenses.unfree` by default. Users of `requireFile`-based derivations that preserve this default will need to explicitly allow their evaluation as described in [](#sec-allow-unfree).
-
-- `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
-
-- `fetchPnpmDeps`' `fetcherVersion = 1` and `fetcherVersion = 2` have been
-  removed, as announced in the 26.05 release. Packages still using them now
-  throw an evaluation error and must migrate to `fetcherVersion = 3` (or later)
-  and regenerate their hashes. See the
-  [pnpm `fetcherVersion` section](#javascript-pnpm-fetcherVersion) of the manual
-  for details.
+- Create the first release note entry in this section!
 
 ## Other Notable Changes {#sec-nixpkgs-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Package-URL (PURL, https://github.com/package-url/purl-spec) metadata identifier has been added for `fetchgit`, `fetchpypi` and `fetchFromGithub` fetchers.
-  `mkDerivation` has been adjusted to reuse this information.
-  Package-URLs allow reliably identifying and locating software packages.
-  Maintainers of derivations using the adapted fetchers should rely on the `drv.src.meta.identifiers.v1.purl` default identifier and can enhance their `drv.meta.identifiers.v1.purls` list once they would like to have additional identifiers.
-  Maintainers using `fetchurl` for `drv.src` are urged to adapt their `drv.meta.identifiers.purlParts` for proper identification.
+- Create the first release note entry in this section!
 
 ## Nixpkgs Library {#sec-nixpkgs-release-26.11-lib}
 

doc/stdenv/meta.chapter.md

@@ -157,8 +157,6 @@ The list of Nix platform types for which the [Hydra](https://github.com/nixos/hy
 }
 ```
 
-Note that this does not affect whether reverse dependencies of the package are built on Hydra.
-
 ### `broken` {#var-meta-broken}
 
 If set to `true`, the package is marked as "broken", meaning that it won’t show up in [search.nixos.org](https://search.nixos.org/packages), and cannot be built or installed unless [explicitly allowed](#sec-allow-broken).
@@ -342,30 +340,3 @@ A readonly attribute that concatenates all CPE parts in one string.
 #### `meta.identifiers.possibleCPEs` {#var-meta-identifiers-possibleCPEs}
 
 A readonly attribute containing the list of guesses for what CPE for this package can look like. It includes all variants of version handling mentioned above. Each item is an attrset with attributes `cpeParts` and `cpe` for each guess.
-
-### Package URL {#sec-meta-identifiers-purl}
-
-[Package-URL](https://github.com/package-url/purl-spec) (PURL) is a specification to reliably identify and locate software packages.
-Through identification of software packages, additional (non-major) use cases are e.g. software license cross-verification via third party databases or initial vulnerability response management.
-Package-URLs shall default to the `mkDerivation.src`, as the original consumed software package is the single source of truth.
-
-#### `meta.identifiers.purlParts` {#var-meta-identifiers-purlParts}
-
-This attribute contains an attribute set of all parts of the PURL for this package.
-
-* `type` mandatory [type](https://github.com/package-url/purl-spec/blob/18fd3e395dda53c00bc8b11fe481666dc7b3807a/docs/standard/summary.md) which needs to be provided
-* `spec` specify the PURL in accordance with the [purl-spec](https://github.com/package-url/purl-spec/blob/18fd3e395dda53c00bc8b11fe481666dc7b3807a/purl-specification.md)
-
-#### `meta.identifiers.purl` {#var-meta-identifiers-purl}
-
-An extendable attribute which is built based on `purlParts`.
-This is the main identifier of the software package.
-For handling edge cases, consider using the list interface [`meta.identifiers.purls`](#var-meta-identifiers-purls).
-
-#### `meta.identifiers.purls` {#var-meta-identifiers-purls}
-
-An extendable list attribute which defaults to a single element equal to [`meta.identifiers.purl`](#var-meta-identifiers-purl).
-It provides an interface for additional identifiers of `mkDerivation.src` or for identifiers of vendored dependencies inside `mkDerivation.src`, which maintainers may carefully consider to specify as well.
-
-Additional identifiers are generally not recommended, as they might cause maintenance overhead or diverge.
-For example, a source distribution `pkg:github` may be hard to keep correctly aligned with the corresponding binary distribution `pkg:pypi`.

doc/styleguide.md

@@ -1,420 +0,0 @@
-# Styleguide
-
-## Writing Principles
-
-A consistent style greatly increases the usability of all documentation and communication.
-
-Use this page as a reference and style guide for our internal and external documentation.
-
-### Knowledge Expectations
-
-**Assume competence, not familiarity.**
-
-Write for someone who knows a great deal — up to but not including this project.
-
-**What readers know:**
-
-- Basic computer operation
-- Command line familiarity
-- General interest in systems configuration
-
-**What readers don't know:**
-
-- NixOS-specific concepts
-- NixOS ecosystem details or grammar
-- NixOS workflows
-
-If specific knowledge is required, mention it at the start of the page.
-
-#### Show, Don't Tell
-
-The fastest path to understanding is a working example.
-People learn by doing, not by reading about doing.
-
-**Recommended structure:**
-
-- Start with the minimal working code or command
-- Briefly explain what it does
-- Cover edge cases or variations
-- Link to further information instead of including it
-
-#### Grammar and Style
-
-**Sentence structure:**
-
-- Use simple, direct sentences
-- Break complex ideas into multiple short sentences
-- Avoid nested clauses
-
-**Bad:**
-
-> The following command, which utilizes nixos-generate-config to produce a comprehensive hardware configuration, will write the results back into the respective configuration directory located on your local machine.
-
-What the user does is hidden in the middle.
-`nixos-generate-config` is a leaked implementation detail.
-Users care about *detecting hardware*, not *the tool that does it*.
-
-**Good:**
-
-> This command detects your hardware and saves the configuration.
-
-#### Content Organization
-
-Lead with value. State what the reader will accomplish before explaining how.
-
-**Bad:**
-
-> To create a new NixOS configuration that you can later use as a webserver, first navigate to your project directory, then add a new host configuration file with the desired machine name.
-
-**Good:**
-
-Add a webserver configuration to your NixOS setup:
-
-```nix
-# hosts/webserver/configuration.nix
-{ ... }:
-{
-  services.nginx.enable = true;
-}
-```
-
-Use **progressive disclosure**. Introduce concepts only when needed.
-
-**Recommended structure:**
-
-1. State the goal (one sentence)
-2. Show the simplest working example
-3. Explain concepts if needed
-4. Provide advanced options separately or link to the reference
-
-#### No Meta-commentary
-
-Don't describe what the documentation does. Just do it.
-
-**Don't:**
-
-> This section explains how to configure networking.
-> The following guide walks you through setting up a web server.
-
-**Do:**
-
-> Configure networking by setting:
-> Set up a web server:
-
-#### Code Examples
-
-**Keep examples focused:**
-
-- Show one concept at a time
-- Use realistic but simple scenarios
-- Avoid dependencies on other examples
-
-**Minimal comments**
-
-Let the code speak for itself.
-Paste code examples directly and without further alteration.
-
-**Bad:**
-
-```nix
-# This sets the hostname for the machine
-{
-  networking.hostName = "webserver"; # Change this to your machine's hostname
-  # This enables SSH access
-  services.openssh.enable = true; # Required for remote deployment
-}
-```
-
-**Good:**
-
-```nix
-{
-  networking.hostName = "webserver";
-  services.openssh.enable = true;
-}
-```
-
-#### Lead with Practical Examples
-
-Don't front-load theory. Readers want to accomplish something first, then understand why it works.
-
-- Show configuration as *what you want*, not *how the module system works*
-- Introduce Nix-specific concepts only when they are needed to complete the task
-- Defer language mechanics to reference pages or `nix.dev`
-
-**Bad:**
-
-> Before adding a service, you need to understand the NixOS module system and attribute set merging.
-
-**Good:**
-
-Enable nginx:
-
-```nix
-{ services.nginx.enable = true; }
-```
-
-This adds nginx to your system configuration. Rebuild to apply:
-
-```bash
-sudo nixos-rebuild switch
-```
-
-#### Teach Nix through examples, not theory
-
-
-Users learn the NixOS module system by seeing patterns first.
-
-- Start with a working example
-- Explanation follows the code
-- Link deeper concepts instead of inlining them
-- Link to `nix.dev` for optional learning
-
-#### General Rules
-
-- Abbreviate keys like `ssh-ed25519 AAAAC3NzaC…`
-- Abbreviate IP addresses like `192.168.XXX.XXX`
-- Variables are capitalized and start with `$`, e.g. `$YOUR_HOSTNAME`
-- Variables should be directly usable during copy-paste
-- Do **not** describe missing code parts (`#elided`, `#omitted`)
-- **Machine vs Host**: use "machine" for the NixOS system identity, "host" for the physical or virtual hardware
-
-#### Capitalization
-
-- GB / RAM / HDD
-- bootable USB drive
-- Wi-Fi / DHCP / DNS
-- macOS / NixOS / Nix / Linux
-- Flakes
-- git
-
-#### Headings
-
-Use sentence case. A reader scanning only headings should understand the page.
-
-**Don't:**
-
-> Getting Started
-> Overview
-> Configure The Database
-
-**Do:**
-
-> Set up a PostgreSQL database
-> Configure networking
-> Add a user to the system
-
-#### Imperative Mood, Voice, and Person
-
-Use imperative mood for instructions. Address the reader as "you", not "the user". Use active voice; in other words, make the subject do the action.
-
-**Don't:**
-
-> The user should run the following command.
-> The configuration will need to be updated.
-> The key is generated by the system.
-
-**Do:**
-
-> Run the command.
-> Update the configuration.
-> The system generates the key.
-
-#### Tense
-
-Use present tense for descriptions. Future tense makes documentation feel tentative.
-
-**Don't:**
-
-> This will create a new folder.
-> Running this command will install the package.
-
-**Do:**
-
-> This creates a new folder.
-> Running this command installs the package.
-
-#### Be Confident
-
-State facts. Don't hedge with "should," "might," "typically," or "usually" unless the behavior genuinely varies.
-
-**Don't:**
-
-> This should create the configuration file.
-> The service will usually start automatically.
-
-**Do:**
-
-> This creates the configuration file.
-> The service starts automatically.
-
-#### Avoid Nominalizations
-
-A nominalization is a verb turned into a noun, often by adding *-tion*, *-meant*, or *-ance* (e.g. "explanation", "selection"). The fix: find the hidden verb and use it directly.
-
-**Don't:**
-
-> Make a selection from the list.
-> Provide an explanation of the error.
-
-**Do:**
-
-> Select from the list.
-> Explain the error.
-
-#### Plain Words
-
-Technical precision for technical terms; plain language for everything else.
-
-- "use" not "utilize"
-- "start" not "initiate"
-- "end" not "terminate"
-- "help" not "facilitate"
-- "send" not "transmit"
-- "set up" not "establish"
-- "find out" not "ascertain"
-
-#### Filler Words and Weak Phrases
-
-Cut words and phrases that add length without meaning.
-
-Delete on sight:
-
-- "simply", "just", "easily", "basically", "obviously"
-- "in order to" → use "to"
-- "allows you to" → use the verb directly
-- "it's worth noting that" → just say the thing
-- no exclamation marks in technical prose
-
-**Don't:**
-
-> Simply run `nixos-rebuild switch`.
-> In order to deploy, you first need to run the command, which allows you to push the config.
-> It's worth noting that this requires root access.
-
-**Do:**
-
-> Run `nixos-rebuild switch`.
-> To deploy, run:
-> This requires root access.
-
-Every word must earn its place.
-
-#### Writing Procedures
-
-One instruction per sentence. Don't pack multiple actions into one sentence.
-
-**Don't:**
-
-> Navigate to your project directory and run the command, then check the output.
-
-**Do:**
-
-1. Navigate to your project directory.
-2. Run the command.
-3. Check the output.
-
-Don't bury the negative. Key limitations should be prominent, not a footnote after a positive description.
-
-**Don't:**
-
-> This service supports multiple roles, integrates with existing modules, and works great for most setups (note that multiple instances are not supported).
-
-**Do:**
-
-> This service does not support multiple instances.
-
-#### Consistent Terminology
-
-Pick a term and stick to it. Don't swap synonyms to avoid repetition. In technical documentation, repetition is clarity.
-
-**Don't:**
-
-> Create a machine... configure the host... deploy the node.
-
-**Do:**
-
-> Create a machine... configure the machine... deploy the machine.
-
-#### Links
-
-Use descriptive link text. Never use "click here" or "this link."
-
-**Don't:**
-
-> For more information, see `[this page](url)`.
-> Click `[here](url)` to read the reference.
-
-**Do:**
-
-> See the `[NixOS options reference](url)` for details.
-> Read the `[NixOS module system guide](url)`.
-
-Only link when the destination is directly relevant, not for generic background context (sometimes known as "Wikipedia-style links"). Readers feel obligated to click links, fearing they'll miss something important. Don't send them to a generic article about a technology when they're looking for how *your* system uses it.
-
-**Don't:**
-
-> Our software uses [SQLite](https://sqlite.org/) for storage.
-> *(Reader clicks expecting schema details — finds a generic product page instead.)*
-
-(Note that in the above example, the SQLite link is the SQLite home page, which is likely not pertinent.)
-
-**Do:**
-
-> See `[database schema](url)` for the full table structure.
-
-#### UI Language
-
-Match UI element names exactly: wording, casing, and spacing (even if a label seems oddly worded).
-
-**Don't:**
-
-> Click the generator button.
-> Select the save option.
-
-**Do:**
-
-> Click **Generate a Key**.
-> Click **Save Changes**.
-
-Someone will go looking for a button labeled "generator." They will not find it. They will be frustrated.
-
-Consistency between documentation and interface builds confidence. Words are part of the interface.
-
-:::{.tip}
-This can be tricky as UI changes; we don't yet have a policy in place for how to handle this. We welcome comments and suggestions.
-:::
-
-#### Clean system discipline
-
-Your machine has things new users don't: cached credentials, installed tools, environment variables, existing configuration. When writing or updating documentation:
-
-**Don't:**
-
-> Write steps from memory on your development machine, assuming what works there will work everywhere.
-
-**Do:**
-
-> - Start on a clean system — a fresh VM or new user account
-> - Take notes in real time as you work through the steps
-> - Document every warning, prompt, or unexpected output the system shows
-
-Also think in combinations: WSL vs native Linux, with and without existing keys. You don't need to test every matrix square — but you need to know which ones diverge.
-
-#### Never type code — always copy-paste
-
-Always copy commands and code from a terminal where you just ran them successfully. Never retype from memory.
-
-**Don't:**
-
-> Retype a command from memory into the documentation.
-> Retype code into a code-block from memory
-
-**Do:**
-
-> Paste commands directly from the shell or IDE.
-> Paste code that has been successfully validated with nix-instantiate or nix-build
-
-Replace sensitive values with placeholders: `<YOUR-KEY>`, `<YOUR-HOST>`, `<YOUR-TOKEN>`.
-
-Typed-from-memory commands introduce subtle errors. Even the most experienced software developers have occasional typos.

lib/.version

@@ -1 +1 @@
-26.11
+26.05

lib/customisation.nix

@@ -400,25 +400,7 @@ rec {
     condition: passthru: drv:
     let
       commonAttrs =
-        drv
-        // listToAttrs (
-          outputsList
-          ++ [
-            {
-              name = "all";
-              value = map (x: x.value) outputsList;
-            }
-          ]
-        )
-        // passthru
-        // {
-          drvPath =
-            assert condition;
-            drv.drvPath;
-          outPath =
-            assert condition;
-            drv.outPath;
-        };
+        drv // (listToAttrs outputsList) // { all = map (x: x.value) outputsList; } // passthru;
 
       outputsList = map (outputName: {
         name = outputName;
@@ -440,7 +422,15 @@ rec {
         };
       }) (drv.outputs or [ "out" ]);
     in
-    commonAttrs;
+    commonAttrs
+    // {
+      drvPath =
+        assert condition;
+        drv.drvPath;
+      outPath =
+        assert condition;
+        drv.outPath;
+    };
 
   /**
     Strip a derivation of all non-essential attributes, returning

lib/generators.nix

@@ -23,12 +23,9 @@
 let
   inherit (lib)
     addErrorContext
-    any
     assertMsg
     attrNames
-    attrValues
     concatLists
-    concatMap
     concatMapStringsSep
     concatStrings
     concatStringsSep
@@ -55,7 +52,6 @@ let
     isString
     last
     length
-    genAttrs
     mapAttrs
     mapAttrsToList
     optionals
@@ -383,69 +379,55 @@ rec {
       See the [git-config documentation](https://git-scm.com/docs/git-config#_variables) for possible values.
   */
   toGitINI =
+    attrs:
     let
       mkSectionName =
-        let
-          containsQuote = hasInfix ''"'';
-        in
         name:
         let
+          containsQuote = hasInfix ''"'' name;
           sections = splitString "." name;
+          section = head sections;
+          subsections = tail sections;
+          subsection = concatStringsSep "." subsections;
         in
-        if containsQuote name || length sections == 1 then
-          name
-        else
-          ''${head sections} "${concatStringsSep "." (tail sections)}"'';
+        if containsQuote || subsections == [ ] then name else ''${section} "${subsection}"'';
 
       mkValueString =
+        v:
         let
-          escape = replaceStrings [ "\n" "	" ''"'' "\\" ] [ "\\n" "\\t" ''\"'' "\\\\" ];
+          escapedV = ''"${replaceStrings [ "\n" "	" ''"'' "\\" ] [ "\\n" "\\t" ''\"'' "\\\\" ] v}"'';
         in
-        v: mkValueStringDefault { } (if isString v then ''"${escape v}"'' else v);
+        mkValueStringDefault { } (if isString v then escapedV else v);
 
       # generation for multiple ini values
       mkKeyValue =
+        k: v:
         let
-          mkKeyValue = mkKeyValueDefault { inherit mkValueString; } " = ";
-          attrToString = k: v: "\t" + mkKeyValue k v;
+          mkKeyValue = mkKeyValueDefault { inherit mkValueString; } " = " k;
         in
-        k: v: if isList v then concatStringsSep "\n" (map (attrToString k) v) else attrToString k v;
+        concatStringsSep "\n" (map (kv: "\t" + mkKeyValue kv) (toList v));
 
       # converts { a.b.c = 5; } to { "a.b".c = 5; } for toINI
       gitFlattenAttrs =
         let
-          isNonDrvAttrs = value: isAttrs value && !isDerivation value;
           recurse =
             path: value:
-            if isNonDrvAttrs value then
-              concatMap (name: recurse ([ name ] ++ path) value.${name}) (attrNames value)
+            if isAttrs value && !isDerivation value then
+              mapAttrsToList (name: value: recurse ([ name ] ++ path) value) value
             else if length path > 1 then
-              [
-                {
-                  ${concatStringsSep "." (reverseList (tail path))}.${head path} = value;
-                }
-              ]
+              {
+                ${concatStringsSep "." (reverseList (tail path))}.${head path} = value;
+              }
             else
-              [
-                {
-                  ${head path} = value;
-                }
-              ];
+              {
+                ${head path} = value;
+              };
         in
-        attrs:
-        let
-          # Filter the names for any that contain nested attrsets. attrs that
-          # don't contain nested attrsets can stay the same =
-          namesToRewrite = filter (
-            name: isAttrs attrs.${name} && any isNonDrvAttrs (attrValues attrs.${name})
-          ) (attrNames attrs);
-          attrsToRewrite = genAttrs namesToRewrite (name: attrs.${name});
-        in
-        removeAttrs attrs namesToRewrite // foldl recursiveUpdate { } (recurse [ ] attrsToRewrite);
+        attrs: foldl recursiveUpdate { } (flatten (recurse [ ] attrs));
 
       toINI_ = toINI { inherit mkKeyValue mkSectionName; };
     in
-    attrs: toINI_ (gitFlattenAttrs attrs);
+    toINI_ (gitFlattenAttrs attrs);
 
   /**
     `mkKeyValueDefault` wrapper that handles dconf INI quirks.

lib/licenses/licenses.nix

@@ -575,13 +575,6 @@ lib.mapAttrs mkLicense (
       free = false;
     };
 
-    enpl = {
-      fullName = "Emmi AI Non-Production License";
-      url = "https://github.com/Emmi-AI/noether/blob/main/LICENSE.txt";
-      free = false;
-      redistributable = true;
-    };
-
     epl10 = {
       spdxId = "EPL-1.0";
       fullName = "Eclipse Public License 1.0";
@@ -1157,12 +1150,6 @@ lib.mapAttrs mkLicense (
       redistributable = true; # Only if used in Netdata products.
     };
 
-    netboxLimitedUse = {
-      fullName = "NetBox Limited Use License 1.0";
-      free = false;
-      url = "https://github.com/netboxlabs/netbox-branching/blob/8465b9aee69ded23930cfe1a522695bfb8955a5a/LICENSE.md";
-    };
-
     ngpl = {
       spdxId = "NGPL";
       fullName = "Nethack General Public License";

lib/modules.nix

@@ -1158,10 +1158,8 @@ let
       value = if opt ? apply then opt.apply res.mergedValue else res.mergedValue;
 
       warnDeprecation =
-        if (opt.type.deprecationMessage != null) then
-          warn "The type `types.${opt.type.name}' of option `${showOption loc}' defined in ${showFiles opt.declarations} is deprecated. ${opt.type.deprecationMessage}"
-        else
-          x: x;
+        warnIf (opt.type.deprecationMessage != null)
+          "The type `types.${opt.type.name}' of option `${showOption loc}' defined in ${showFiles opt.declarations} is deprecated. ${opt.type.deprecationMessage}";
 
     in
     warnDeprecation opt
@@ -1600,28 +1598,6 @@ let
     inherit priority content;
   };
 
-  /**
-    Applies a function to the value inside a definition,
-    preserving all surrounding properties (`mkForce`, `mkOrder`, `mkIf`, etc.).
-  */
-  mapDefinitionValue =
-    f: def:
-    if def ? _type then
-      if def._type == "merge" then
-        def // { contents = map (mapDefinitionValue f) def.contents; }
-      else if def._type == "if" then
-        def // { content = mapDefinitionValue f def.content; }
-      else if def._type == "override" then
-        def // { content = mapDefinitionValue f def.content; }
-      else if def._type == "order" then
-        def // { content = mapDefinitionValue f def.content; }
-      else if def._type == "definition" then
-        def // { value = mapDefinitionValue f def.value; }
-      else
-        f def
-    else
-      f def;
-
   mkBefore = mkOrder 500;
   defaultOrderPriority = 1000;
   mkAfter = mkOrder 1500;
@@ -2326,7 +2302,6 @@ private
     importApply
     importJSON
     importTOML
-    mapDefinitionValue
     mergeDefinitions
     mergeAttrDefinitionsWithPrio
     mergeOptionDecls # should be private?

lib/sources.nix

@@ -7,19 +7,12 @@ let
     match
     split
     storeDir
-    escapeRegex
-    removePrefix
     ;
   inherit (lib)
     boolToString
     filter
     isString
     readFile
-    concatStrings
-    length
-    elemAt
-    isList
-    any
     ;
   inherit (lib.filesystem)
     pathIsRegularFile
@@ -520,113 +513,6 @@ let
     else
       throw "repoRevToName: invalid kind";
 
-  /**
-    Filter a source tree by a list of doublestar-style glob patterns,
-    returning a source that only contains paths matching at least one
-    pattern. `*` matches a single path component, and `**` matches any
-    number of components.
-
-    # Inputs
-
-    `src`
-
-    : The source tree to filter.
-
-    `patterns`
-
-    : List of glob patterns to include, e.g. `[ "*.py" "src/**" ]`.
-      A leading `**` (e.g. `**\/*.py` for all `.py` files at any depth)
-      is also supported; the `\` here is just a Nix string escape used
-      to avoid closing this comment.
-
-    # Examples
-    :::{.example}
-    ## `sourceByGlobs` usage example
-
-    - Include everything under a subdirectory
-    ```nix
-    src = sourceByGlobs ./. [ "src/**" "tests/**" ]
-    ```
-
-    - Include all .py files in root directory only
-    ```nix
-    src = sourceByGlobs ./. [ "*.py" ]
-    ```
-
-    :::
-  */
-  sourceByGlobs =
-    let
-      splitPath = path: filter isString (split "/" path);
-      # Make component regex
-      mkRe =
-        s:
-        if s == "**" then
-          ".*" # Has special handling below
-        else
-          concatStrings (map (tok: if isList tok then "[^/]*" else escapeRegex tok) (split "\\*+" s));
-
-      # Make a source filter function from pattern
-      mkMatcher =
-        pat:
-        let
-          globs = map mkRe (splitPath pat);
-          glen = length globs;
-        in
-        path: type:
-        let
-          path' = splitPath path;
-          plen = length path';
-
-          recurse =
-            gi: pi:
-            let
-              g = elemAt globs gi;
-              p = elemAt path' pi;
-              m = match g p != null;
-            in
-            if pi >= plen then # Reached end of path
-              gi >= glen || (type == "directory" || type == "symlink") # Only allow partial matches for directories
-            else if gi >= glen then # Reached end of globs
-              false
-            else if g == ".*" then # Special handling for **
-              (
-                # Lookahead for next glob match
-                if (gi + 1) == glen then
-                  true
-                else if (match (elemAt globs (gi + 1)) p != null) then
-                  recurse (gi + 1) pi
-                else if m then
-                  recurse gi (pi + 1)
-                else
-                  false
-              )
-            else if m then
-              recurse (gi + 1) (pi + 1)
-            else
-              false;
-
-        in
-        recurse 0 0;
-
-      mkSourceFilter =
-        root: patterns:
-        let
-          root' = "${toString root}/";
-          matchers = map mkMatcher patterns;
-        in
-        name: type:
-        let
-          name' = removePrefix root' name;
-        in
-        any (m: m name' type) matchers;
-
-    in
-    src: patterns:
-    lib.cleanSourceWith {
-      filter = mkSourceFilter src patterns;
-      inherit src;
-    };
 in
 {
   inherit
@@ -646,7 +532,6 @@ in
 
     sourceByRegex
     sourceFilesBySuffices
-    sourceByGlobs
 
     trace
     ;

lib/systems/examples.nix

@@ -40,9 +40,10 @@ rec {
     rust.rustcTarget = "powerpc-unknown-linux-gnu";
   };
 
-  armv5tel-multiplatform = {
+  sheevaplug = {
     config = "armv5tel-unknown-linux-gnueabi";
-  };
+  }
+  // platforms.sheevaplug;
 
   raspberryPi = {
     config = "armv6l-unknown-linux-gnueabihf";
@@ -98,6 +99,11 @@ rec {
     useLLVM = true;
   };
 
+  pogoplug4 = {
+    config = "armv5tel-unknown-linux-gnueabi";
+  }
+  // platforms.pogoplug4;
+
   ben-nanonote = {
     config = "mipsel-unknown-linux-uclibc";
   }
@@ -149,6 +155,7 @@ rec {
   gnu64 = {
     config = "x86_64-unknown-linux-gnu";
   };
+  gnu64_simplekernel = gnu64 // platforms.pc_simplekernel; # see test/cross/default.nix
   gnu32 = {
     config = "i686-unknown-linux-gnu";
   };

lib/systems/platforms.nix

@@ -18,6 +18,10 @@ rec {
     };
   };
 
+  pc_simplekernel = lib.recursiveUpdate pc {
+    linux-kernel.autoModules = false;
+  };
+
   ##
   ## POWER
   ##
@@ -46,15 +50,138 @@ rec {
   ## ARM
   ##
 
-  armv5tel-multiplatform = {
+  pogoplug4 = {
     linux-kernel = {
-      name = "armv5tel-multiplatform";
+      name = "pogoplug4";
 
       baseConfig = "multi_v5_defconfig";
-      DTB = true;
-      autoModules = true;
-      preferBuiltin = true;
-      target = "zImage";
+      autoModules = false;
+      extraConfig = ''
+        # Ubi for the mtd
+        MTD_UBI y
+        UBIFS_FS y
+        UBIFS_FS_XATTR y
+        UBIFS_FS_ADVANCED_COMPR y
+        UBIFS_FS_LZO y
+        UBIFS_FS_ZLIB y
+        UBIFS_FS_DEBUG n
+      '';
+      makeFlags = [ "LOADADDR=0x8000" ];
+      target = "uImage";
+      # TODO reenable once manual-config's config actually builds a .dtb and this is checked to be working
+      #DTB = true;
+    };
+    gcc = {
+      arch = "armv5te";
+    };
+  };
+
+  sheevaplug = {
+    linux-kernel = {
+      name = "sheevaplug";
+
+      baseConfig = "multi_v5_defconfig";
+      autoModules = false;
+      extraConfig = ''
+        BLK_DEV_RAM y
+        BLK_DEV_INITRD y
+        BLK_DEV_CRYPTOLOOP m
+        BLK_DEV_DM m
+        DM_CRYPT m
+        MD y
+        BTRFS_FS m
+        XFS_FS m
+        JFS_FS m
+        EXT4_FS m
+        USB_STORAGE_CYPRESS_ATACB m
+
+        # mv cesa requires this sw fallback, for mv-sha1
+        CRYPTO_SHA1 y
+        # Fast crypto
+        CRYPTO_TWOFISH y
+        CRYPTO_TWOFISH_COMMON y
+        CRYPTO_BLOWFISH y
+        CRYPTO_BLOWFISH_COMMON y
+
+        IP_PNP y
+        IP_PNP_DHCP y
+        NFS_FS y
+        ROOT_NFS y
+        TUN m
+        NFS_V4 y
+        NFS_V4_1 y
+        NFS_FSCACHE y
+        NFSD m
+        NFSD_V2_ACL y
+        NFSD_V3 y
+        NFSD_V3_ACL y
+        NFSD_V4 y
+        NETFILTER y
+        IP_NF_IPTABLES y
+        IP_NF_FILTER y
+        IP_NF_MATCH_ADDRTYPE y
+        IP_NF_TARGET_LOG y
+        IP_NF_MANGLE y
+        IPV6 m
+        VLAN_8021Q m
+
+        CIFS y
+        CIFS_XATTR y
+        CIFS_POSIX y
+        CIFS_FSCACHE y
+        CIFS_ACL y
+
+        WATCHDOG y
+        WATCHDOG_CORE y
+        ORION_WATCHDOG m
+
+        ZRAM m
+        NETCONSOLE m
+
+        # Disable OABI to have seccomp_filter (required for systemd)
+        # https://github.com/raspberrypi/firmware/issues/651
+        OABI_COMPAT n
+
+        # Fail to build
+        DRM n
+        SCSI_ADVANSYS n
+        USB_ISP1362_HCD n
+        SND_SOC n
+        SND_ALI5451 n
+        FB_SAVAGE n
+        SCSI_NSP32 n
+        ATA_SFF n
+        SUNGEM n
+        IRDA n
+        ATM_HE n
+        SCSI_ACARD n
+        BLK_DEV_CMD640_ENHANCED n
+
+        FUSE_FS m
+
+        # systemd uses cgroups
+        CGROUPS y
+
+        # Latencytop
+        LATENCYTOP y
+
+        # Ubi for the mtd
+        MTD_UBI y
+        UBIFS_FS y
+        UBIFS_FS_XATTR y
+        UBIFS_FS_ADVANCED_COMPR y
+        UBIFS_FS_LZO y
+        UBIFS_FS_ZLIB y
+        UBIFS_FS_DEBUG n
+
+        # Kdb, for kernel troubles
+        KGDB y
+        KGDB_SERIAL_CONSOLE y
+        KGDB_KDB y
+      '';
+      makeFlags = [ "LOADADDR=0x0200000" ];
+      target = "uImage";
+      DTB = true; # Beyond 3.10
     };
     gcc = {
       arch = "armv5te";
@@ -69,6 +196,11 @@ rec {
       DTB = true;
       autoModules = true;
       preferBuiltin = true;
+      extraConfig = ''
+        # Disable OABI to have seccomp_filter (required for systemd)
+        # https://github.com/raspberrypi/firmware/issues/651
+        OABI_COMPAT n
+      '';
       target = "zImage";
     };
     gcc = {
@@ -89,6 +221,15 @@ rec {
   };
 
   zero-gravitas = {
+    linux-kernel = {
+      name = "zero-gravitas";
+
+      baseConfig = "zero-gravitas_defconfig";
+      # Target verified by checking /boot on reMarkable 1 device
+      target = "zImage";
+      autoModules = false;
+      DTB = true;
+    };
     gcc = {
       fpu = "neon";
       cpu = "cortex-a9";
@@ -96,6 +237,15 @@ rec {
   };
 
   zero-sugar = {
+    linux-kernel = {
+      name = "zero-sugar";
+
+      baseConfig = "zero-sugar_defconfig";
+      DTB = true;
+      autoModules = false;
+      preferBuiltin = true;
+      target = "zImage";
+    };
     gcc = {
       cpu = "cortex-a7";
       fpu = "neon-vfpv4";
@@ -103,6 +253,49 @@ rec {
     };
   };
 
+  utilite = {
+    linux-kernel = {
+      name = "utilite";
+      maseConfig = "multi_v7_defconfig";
+      autoModules = false;
+      extraConfig = ''
+        # Ubi for the mtd
+        MTD_UBI y
+        UBIFS_FS y
+        UBIFS_FS_XATTR y
+        UBIFS_FS_ADVANCED_COMPR y
+        UBIFS_FS_LZO y
+        UBIFS_FS_ZLIB y
+        UBIFS_FS_DEBUG n
+      '';
+      makeFlags = [ "LOADADDR=0x10800000" ];
+      target = "uImage";
+      DTB = true;
+    };
+    gcc = {
+      cpu = "cortex-a9";
+      fpu = "neon";
+    };
+  };
+
+  guruplug = lib.recursiveUpdate sheevaplug {
+    # Define `CONFIG_MACH_GURUPLUG' (see
+    # <http://kerneltrap.org/mailarchive/git-commits-head/2010/5/19/33618>)
+    # and other GuruPlug-specific things.  Requires the `guruplug-defconfig'
+    # patch.
+    linux-kernel.baseConfig = "guruplug_defconfig";
+  };
+
+  beaglebone = lib.recursiveUpdate armv7l-hf-multiplatform {
+    linux-kernel = {
+      name = "beaglebone";
+      baseConfig = "bb.org_defconfig";
+      autoModules = false;
+      extraConfig = ""; # TBD kernel config
+      target = "zImage";
+    };
+  };
+
   # https://developer.android.com/ndk/guides/abis#v7a
   armv7a-android = {
     linux-kernel.name = "armeabi-v7a";
@@ -116,11 +309,32 @@ rec {
   armv7l-hf-multiplatform = {
     linux-kernel = {
       name = "armv7l-hf-multiplatform";
-      baseConfig = "defconfig";
+      Major = "2.6"; # Using "2.6" enables 2.6 kernel syscalls in glibc.
+      baseConfig = "multi_v7_defconfig";
       DTB = true;
       autoModules = true;
       preferBuiltin = true;
       target = "zImage";
+      extraConfig = ''
+        # Serial port for Raspberry Pi 3. Wasn't included in ARMv7 defconfig
+        # until 4.17.
+        SERIAL_8250_BCM2835AUX y
+        SERIAL_8250_EXTENDED y
+        SERIAL_8250_SHARE_IRQ y
+
+        # Hangs ODROID-XU4
+        ARM_BIG_LITTLE_CPUIDLE n
+
+        # Disable OABI to have seccomp_filter (required for systemd)
+        # https://github.com/raspberrypi/firmware/issues/651
+        OABI_COMPAT n
+
+        # >=5.12 fails with:
+        # drivers/net/ethernet/micrel/ks8851_common.o: in function `ks8851_probe_common':
+        # ks8851_common.c:(.text+0x179c): undefined reference to `__this_module'
+        # See: https://lore.kernel.org/netdev/20210116164828.40545-1-marex@denx.de/T/
+        KS8851_MLL y
+      '';
     };
     gcc = {
       # Some table about fpu flags:
@@ -153,6 +367,22 @@ rec {
       autoModules = true;
       preferBuiltin = true;
       extraConfig = ''
+        # Raspberry Pi 3 stuff. Not needed for   s >= 4.10.
+        ARCH_BCM2835 y
+        BCM2835_MBOX y
+        BCM2835_WDT y
+        RASPBERRYPI_FIRMWARE y
+        RASPBERRYPI_POWER y
+        SERIAL_8250_BCM2835AUX y
+        SERIAL_8250_EXTENDED y
+        SERIAL_8250_SHARE_IRQ y
+
+        # Cavium ThunderX stuff.
+        PCI_HOST_THUNDER_ECAM y
+
+        # Nvidia Tegra stuff.
+        PCI_TEGRA y
+
         # The default (=y) forces us to have the XHCI firmware available in initrd,
         # which our initrd builder can't currently do easily.
         USB_XHCI_TEGRA m
@@ -186,6 +416,74 @@ rec {
   };
 
   fuloong2f_n32 = {
+    linux-kernel = {
+      name = "fuloong2f_n32";
+      baseConfig = "lemote2f_defconfig";
+      autoModules = false;
+      extraConfig = ''
+        MIGRATION n
+        COMPACTION n
+
+        # nixos mounts some cgroup
+        CGROUPS y
+
+        BLK_DEV_RAM y
+        BLK_DEV_INITRD y
+        BLK_DEV_CRYPTOLOOP m
+        BLK_DEV_DM m
+        DM_CRYPT m
+        MD y
+        EXT4_FS m
+        USB_STORAGE_CYPRESS_ATACB m
+
+        IP_PNP y
+        IP_PNP_DHCP y
+        IP_PNP_BOOTP y
+        NFS_FS y
+        ROOT_NFS y
+        TUN m
+        NFS_V4 y
+        NFS_V4_1 y
+        NFS_FSCACHE y
+        NFSD m
+        NFSD_V2_ACL y
+        NFSD_V3 y
+        NFSD_V3_ACL y
+        NFSD_V4 y
+
+        # Fail to build
+        DRM n
+        SCSI_ADVANSYS n
+        USB_ISP1362_HCD n
+        SND_SOC n
+        SND_ALI5451 n
+        FB_SAVAGE n
+        SCSI_NSP32 n
+        ATA_SFF n
+        SUNGEM n
+        IRDA n
+        ATM_HE n
+        SCSI_ACARD n
+        BLK_DEV_CMD640_ENHANCED n
+
+        FUSE_FS m
+
+        # Needed for udev >= 150
+        SYSFS_DEPRECATED_V2 n
+
+        VGA_CONSOLE n
+        VT_HW_CONSOLE_BINDING y
+        SERIAL_8250_CONSOLE y
+        FRAMEBUFFER_CONSOLE y
+        EXT2_FS y
+        EXT3_FS y
+        MAGIC_SYSRQ y
+
+        # The kernel doesn't boot at all, with FTRACE
+        FTRACE n
+      '';
+      target = "vmlinux";
+    };
     gcc = {
       arch = "loongson2f";
       float = "hard";
@@ -231,6 +529,35 @@ rec {
     };
   };
 
+  # based on:
+  #   https://www.mail-archive.com/qemu-discuss@nongnu.org/msg05179.html
+  #   https://gmplib.org/~tege/qemu.html#mips64-debian
+  mips64el-qemu-linux-gnuabi64 = {
+    linux-kernel = {
+      name = "mips64el";
+      baseConfig = "64r2el_defconfig";
+      target = "vmlinuz";
+      autoModules = false;
+      DTB = true;
+      # for qemu 9p passthrough filesystem
+      extraConfig = ''
+        MIPS_MALTA y
+        PAGE_SIZE_4KB y
+        CPU_LITTLE_ENDIAN y
+        CPU_MIPS64_R2 y
+        64BIT y
+        CPU_MIPS64_R2 y
+
+        NET_9P y
+        NET_9P_VIRTIO y
+        9P_FS y
+        9P_FS_POSIX_ACL y
+        PCI y
+        VIRTIO_PCI y
+      '';
+    };
+  };
+
   ##
   ## Other
   ##
@@ -284,7 +611,7 @@ rec {
       if version == null then
         pc
       else if lib.versionOlder version "6" then
-        armv5tel-multiplatform
+        sheevaplug
       else if lib.versionOlder version "7" then
         raspberrypi
       else

lib/tests/misc.nix

@@ -5114,96 +5114,4 @@ runTests {
     );
     expected = false;
   };
-
-  # mapDefinitionValue
-
-  testMapDefinitionValuePlain = {
-    expr = lib.modules.mapDefinitionValue (x: x + 1) 5;
-    expected = 6;
-  };
-
-  testMapDefinitionValueMkForce = {
-    expr = lib.modules.mapDefinitionValue (x: x + 1) (lib.mkForce 5);
-    expected = lib.mkForce 6;
-  };
-
-  testMapDefinitionValueMkDefault = {
-    expr = lib.modules.mapDefinitionValue (x: x + 1) (lib.mkDefault 5);
-    expected = lib.mkDefault 6;
-  };
-
-  testMapDefinitionValueMkOrder = {
-    expr = lib.modules.mapDefinitionValue (x: x + 1) (lib.mkOrder 500 5);
-    expected = lib.mkOrder 500 6;
-  };
-
-  testMapDefinitionValueMkOverrideNested = {
-    expr = lib.modules.mapDefinitionValue (x: x + 1) (lib.mkForce (lib.mkOrder 500 5));
-    expected = lib.mkForce (lib.mkOrder 500 6);
-  };
-
-  testMapDefinitionValueMkIf = {
-    expr = lib.modules.mapDefinitionValue (x: x + 1) (lib.mkIf true 5);
-    expected = lib.mkIf true 6;
-  };
-
-  testMapDefinitionValueMkMerge = {
-    expr = lib.modules.mapDefinitionValue (x: x + 1) (
-      lib.mkMerge [
-        5
-        10
-      ]
-    );
-    expected = lib.mkMerge [
-      6
-      11
-    ];
-  };
-
-  testMapDefinitionValueMkDefinition = {
-    expr = lib.modules.mapDefinitionValue (x: x + 1) (
-      lib.mkDefinition {
-        file = "test";
-        value = 5;
-      }
-    );
-    expected = lib.mkDefinition {
-      file = "test";
-      value = 6;
-    };
-  };
-
-  testMapDefinitionValueDeep = {
-    expr = lib.modules.mapDefinitionValue (x: x + 1) (lib.mkIf true (lib.mkForce (lib.mkOrder 500 5)));
-    expected = lib.mkIf true (lib.mkForce (lib.mkOrder 500 6));
-  };
-
-  testMapDefinitionValueAllNested = {
-    expr = lib.modules.mapDefinitionValue (x: x + 1) (
-      lib.mkMerge [
-        (lib.mkIf true (
-          lib.mkForce (
-            lib.mkOrder 500 (
-              lib.mkDefinition {
-                file = "test";
-                value = lib.mkBefore 5;
-              }
-            )
-          )
-        ))
-      ]
-    );
-    expected = lib.mkMerge [
-      (lib.mkIf true (
-        lib.mkForce (
-          lib.mkOrder 500 (
-            lib.mkDefinition {
-              file = "test";
-              value = lib.mkBefore 6;
-            }
-          )
-        )
-      ))
-    ];
-  };
 }

lib/tests/modules.sh

@@ -899,19 +899,6 @@ checkConfigError 'Did you mean .enable., .ebe. or .enabled.\?' config ./error-ty
 checkConfigError 'Did you mean .services\.myservice\.port. or .services\.myservice\.enable.\?' config.services.myservice ./error-typo-submodule.nix
 checkConfigError 'Did you mean .services\.nginx\.virtualHosts\."example\.com"\.ssl\.certificate. or .services\.nginx\.virtualHosts\."example\.com"\.ssl\.certificateKey.\?' config.services.nginx.virtualHosts.\"example.com\" ./error-typo-deeply-nested.nix
 
-# types.attrListOf
-checkConfigOutput '"ok"' config.assertions ./declare-attrList.nix
-checkConfigError 'A definition for option .attrListInt.badValue.a. is not of type .signed integer.. Definition values:' config.attrListIntStrict.badValue ./declare-attrList.nix
-checkConfigError 'A definition for option .attrList.badListElem. is not of type .attribute list of string.. Each list element must be a single-key attribute set, but got 2 keys' config.attrListStrict.badListElem ./declare-attrList.nix
-checkConfigError 'A definition for option .attrList.badString. is not of type .attribute list of string.. TypeError: Definition values:' config.attrListStrict.badString ./declare-attrList.nix
-checkConfigError 'A definition for option .attrList.badListString. is not of type .attribute list of string.. Each list element must be an attribute set, but got string' config.attrListStrict.badListString ./declare-attrList.nix
-
-# attrListWith valueMeta.definitions: file propagation
-checkConfigError 'the-defs-file\.nix' config.argv ./attrList-valueMeta-definitions-file-diagnostic-forwarding.nix
-
-# attrListOf does not support type merging
-checkConfigError 'The option .merged. in .*/declare-attrList-type-merge.nix. is already declared in .*/declare-attrList-type-merge.nix' config.merged ./declare-attrList-type-merge.nix
-
 cat <<EOF
 ====== module tests ======
 $pass Pass

lib/tests/modules/attrList-valueMeta-definitions-file-diagnostic-forwarding.nix

@@ -1,25 +0,0 @@
-{ lib, options, ... }:
-let
-  inherit (lib) mkOption mkMerge types;
-in
-{
-  imports = [
-    {
-      _file = "the-defs-file.nix";
-      config.flags.my-flag = 3.14;
-    }
-  ];
-
-  options.flags = mkOption {
-    type = types.attrListWith {
-      elemType = types.anything;
-      asAttrs = true;
-      mergeAttrValues = _name: vs: lib.head vs;
-    };
-  };
-  options.argv = mkOption { type = types.listOf types.str; };
-
-  # Feed definitions into argv; the float from the-defs-file.nix should cause
-  # a type error mentioning that file
-  config.argv = mkMerge options.flags.valueMeta.definitions;
-}

lib/tests/modules/declare-attrList-type-merge.nix

@@ -1,12 +0,0 @@
-# Test that attrListOf does not support type merging:
-# two declarations of the same option should fail.
-{ lib, ... }:
-let
-  inherit (lib) mkOption types;
-in
-{
-  imports = [
-    { options.merged = mkOption { type = types.attrListOf types.str; }; }
-    { options.merged = mkOption { type = types.attrListOf types.str; }; }
-  ];
-}

lib/tests/modules/declare-attrList.nix

@@ -1,925 +0,0 @@
-# Run with:
-#   cd nixpkgs
-#   ./lib/tests/modules.sh
-{ lib, config, ... }:
-let
-  inherit (lib)
-    mkOption
-    mkOrder
-    mkMerge
-    mkBefore
-    mkAfter
-    mkIf
-    mkOverride
-    mkDefault
-    mkForce
-    types
-    ;
-in
-{
-  options = {
-    attrList = mkOption {
-      type = types.lazyAttrsOf (types.attrListOf types.str);
-    };
-
-    attrListInt = mkOption {
-      type = types.lazyAttrsOf (types.attrListOf types.int);
-    };
-
-    attrListSubmodule = mkOption {
-      type = types.attrListOf (
-        types.submodule {
-          options.port = mkOption {
-            type = types.int;
-            description = "Port number";
-          };
-          options.host = mkOption {
-            type = types.str;
-            default = "localhost";
-            description = "Hostname";
-          };
-        }
-      );
-    };
-
-    # asAttrs: value is a merged attrset, ordered list in valueMeta
-    asAttrs = mkOption {
-      type = types.lazyAttrsOf (
-        types.attrListWith {
-          elemType = types.str;
-          asAttrs = true;
-          mergeAttrValues = _name: values: lib.last values;
-        }
-      );
-    };
-
-    # asAttrs with default mergeAttrValues: duplicates collected into lists
-    asAttrsDefault = mkOption {
-      type = types.lazyAttrsOf (
-        types.attrListWith {
-          elemType = types.int;
-          asAttrs = true;
-        }
-      );
-    };
-
-    # Strict wrappers that force deep evaluation, for testing error cases
-    attrListStrict = mkOption {
-      type = types.lazyAttrsOf types.raw;
-    };
-
-    attrListIntStrict = mkOption {
-      type = types.lazyAttrsOf types.raw;
-    };
-
-    # either picks attrList when input is list/attrset, int when input is int
-    eitherAttrListOrInt = mkOption {
-      type = types.either (types.attrListOf types.str) types.int;
-    };
-
-    eitherAttrListOrIntFallback = mkOption {
-      type = types.either (types.attrListOf types.str) types.int;
-    };
-
-    eitherIntOrAttrList = mkOption {
-      type = types.either types.int (types.attrListOf types.str);
-    };
-
-    eitherIntOrAttrListFallback = mkOption {
-      type = types.either types.int (types.attrListOf types.str);
-    };
-
-    assertions = mkOption { };
-  };
-
-  imports = [
-    # Second module contributing to multiModule
-    {
-      attrListInt.multiModule = [
-        { b = 2; }
-      ];
-    }
-  ];
-
-  config = {
-
-    # List input: pass-through
-    attrList.listInput = [
-      { a = "alpha"; }
-      { b = "beta"; }
-    ];
-
-    # Attrset input with explicit ordering
-    attrList.attrsetOrdered = {
-      x = mkOrder 200 "x-val";
-      y = mkOrder 100 "y-val";
-    };
-
-    # Mixed: list elements at default priority, attrset with mkOrder
-    attrList.mixed = mkMerge [
-      [
-        { m = "from-list"; }
-      ]
-      {
-        n = mkOrder 50 "from-attrset";
-      }
-    ];
-
-    # Multiple list definitions from separate modules
-    attrListInt.multiModule = [
-      { a = 1; }
-    ];
-
-    # Attrset without mkOrder uses default priority
-    attrList.attrsetNoOrder = {
-      foo = "bar";
-      baz = "qux";
-    };
-
-    # Empty list
-    attrList.empty = [ ];
-
-    # Ordering test: lower priority first
-    attrList.ordering = mkMerge [
-      {
-        last = mkOrder 1500 "last";
-      }
-      {
-        first = mkOrder 500 "first";
-      }
-      [
-        { middle = "middle"; }
-      ]
-    ];
-
-    # List elements support mkOrder/mkBefore/mkAfter
-    attrList.listOrdering = [
-      (mkAfter { z = "after"; })
-      { m = "default"; }
-      (mkBefore { a = "before"; })
-    ];
-
-    # Plain list entries land at default priority (1000):
-    # they appear after mkOrder 999 and before mkOrder 1001.
-    attrList.listDefaultPrio = mkMerge [
-      { after = mkOrder 1001 "after"; }
-      [
-        { mid = "list-entry"; }
-      ]
-      { before = mkOrder 999 "before"; }
-    ];
-
-    # mkBefore and mkAfter
-    attrList.beforeAfter = mkMerge [
-      {
-        z = mkAfter "after";
-      }
-      {
-        a = mkBefore "before";
-      }
-      [
-        { m = "default"; }
-      ]
-    ];
-
-    # mkIf: conditional definition
-    attrList.withMkIf = mkMerge [
-      (mkIf true [
-        { yes = "included"; }
-      ])
-      (mkIf false [
-        { no = "excluded"; }
-      ])
-    ];
-
-    # mkOverride: higher priority override wins
-    attrList.withOverride = mkMerge [
-      (mkOverride 100 [
-        { replaced = "gone"; }
-      ])
-      (mkOverride 50 [
-        { winner = "wins"; }
-      ])
-    ];
-
-    # mkDefault: lower priority than normal
-    attrList.withDefault = mkMerge [
-      (mkDefault [
-        { default = "overridden"; }
-      ])
-      [
-        { normal = "wins"; }
-      ]
-    ];
-
-    # mkForce on the whole option (should discard other defs)
-    attrList.withForce = mkMerge [
-      [
-        { discarded = "gone"; }
-      ]
-      (mkForce [
-        { forced = "wins"; }
-      ])
-    ];
-
-    # mkForce with mkOrder inside
-    attrList.forceWithOrder = mkForce [
-      (mkAfter { second = "after"; })
-      (mkBefore { first = "before"; })
-    ];
-
-    # mkForce on individual element values; non-forced entries are discarded.
-    # Discarded values use a mix of: plain value, mkDefault(abort ...), mkOverride 100 (abort ...).
-    # The abort variants verify laziness: peelProperties sees the wrapper without forcing the content.
-    attrListInt.forceElementValue = [
-      { a = mkDefault (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated"); }
-      { a = mkForce 42; }
-      { a = mkOverride 100 (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated"); }
-      { b = 2; }
-    ];
-
-    # mkForce on attrset format
-    attrList.forceAttrset = mkMerge [
-      [
-        { discarded = "gone"; }
-      ]
-      (mkForce {
-        x = mkOrder 200 "x-val";
-        y = mkOrder 100 "y-val";
-      })
-    ];
-
-    # mkForce on repeated key: forced entries override non-forced
-    attrList.forceRepeatedKey = [
-      { x = mkOverride 100 (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated"); }
-      { x = mkForce "wins"; }
-      { x = mkForce "wins 2"; }
-    ];
-
-    # mkForce on repeated key across mkMerge
-    attrList.forceRepeatedKeyMerge = mkMerge [
-      [
-        { x = "unused: overridden by mkForce"; }
-        { x = mkDefault (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated"); }
-      ]
-      [
-        { x = mkOverride 100 (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated"); }
-      ]
-      [
-        { x = mkForce "forced"; }
-      ]
-    ];
-
-    # mkForce on repeated key in attrset format across mkMerge
-    attrList.forceRepeatedKeyAttrs = mkMerge [
-      {
-        x = mkDefault (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated");
-        y = "kept";
-      }
-      { x = mkForce "forced"; }
-    ];
-
-    # mkForce only affects the key it's on, other keys survive
-    attrList.forcePartialAttrs = mkMerge [
-      {
-        x = "unused: overridden by mkForce";
-        y = "normal y";
-      }
-      { x = mkForce "forced x"; }
-    ];
-
-    # mkForce in attrset format overrides same key from list format
-    attrList.forceMixedFormats = mkMerge [
-      [
-        { x = mkOverride 100 (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated"); }
-        { y = "list y"; }
-      ]
-      { x = mkForce "attrset forced x"; }
-    ];
-
-    # Nesting: list format, mkOrder on element + mkForce on value
-    attrList.nestListOrderForce = mkMerge [
-      [
-        { x = mkDefault (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated"); }
-        (mkOrder 500 { x = mkForce "forced-early"; })
-        (mkOrder 1500 { y = "late"; })
-      ]
-      [
-        (mkOrder 100 { z = "earliest"; })
-      ]
-    ];
-
-    # Nesting: list format, mkOrder(mkForce(val)) on value
-    attrList.nestListOrderOfForce = mkMerge [
-      [
-        { x = mkOverride 100 (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated"); }
-        { y = "plain-early"; }
-      ]
-      [
-        { x = mkOrder 1500 (mkForce "forced-late"); }
-        { z = mkOrder 500 "earliest"; }
-      ]
-      [
-        { x = "unused: overridden by mkForce"; }
-        { w = mkOrder 1200 "mid"; }
-      ]
-    ];
-
-    # Nesting: list format, mkForce(mkOrder(val)) on value
-    attrList.nestListForceOfOrder = mkMerge [
-      [
-        { x = "unused: overridden by mkForce"; }
-        { y = "plain-early"; }
-      ]
-      [
-        { x = mkForce (mkOrder 1500 "forced-late"); }
-        { z = mkOrder 500 "earliest"; }
-      ]
-      [
-        { x = mkDefault (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated"); }
-        { w = mkOrder 1200 "mid"; }
-      ]
-    ];
-
-    # Nesting: attrset format, mkOrder wrapping mkForce
-    attrList.nestAttrsOrderOfForce = mkMerge [
-      {
-        x = mkOverride 100 (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated");
-        y = "plain-early";
-      }
-      {
-        x = mkOrder 1500 (mkForce "forced-late");
-        z = mkOrder 500 "earliest";
-      }
-      {
-        x = "unused: overridden by mkForce";
-        w = mkOrder 1200 "mid";
-      }
-    ];
-
-    # Nesting: attrset format, mkForce wrapping mkOrder
-    attrList.nestAttrsForceOfOrder = mkMerge [
-      {
-        x = "unused: overridden by mkForce";
-        y = "plain-early";
-      }
-      {
-        x = mkForce (mkOrder 1500 "forced-late");
-        z = mkOrder 500 "earliest";
-      }
-      {
-        x = mkDefault (abort "overridden by mkForce; laziness guarantee: MUST NOT be evaluated");
-        w = mkOrder 1200 "mid";
-      }
-    ];
-
-    # mkIf false on individual element value filters it out (list format)
-    attrListInt.optionalValueList = [
-      { a = mkIf true 1; }
-      { b = mkIf false 2; }
-      { c = 3; }
-    ];
-
-    # mkIf false on individual element value filters it out (attrset format)
-    attrListInt.optionalValueAttrs = {
-      a = mkIf true 1;
-      b = mkIf false 2;
-      c = 3;
-    };
-
-    # submodule elemType: produces real valueMeta
-    attrListSubmodule = [
-      {
-        web = {
-          port = 80;
-        };
-      }
-      {
-        db = {
-          port = 5432;
-          host = "dbhost";
-        };
-      }
-    ];
-
-    # asAttrs: unique keys — value is a plain attrset
-    asAttrs.unique = [
-      { a = "alpha"; }
-      { b = "beta"; }
-    ];
-
-    # asAttrs: duplicate keys — last in order wins
-    asAttrs.duplicateKeys = mkMerge [
-      { x = mkOrder 500 "first"; }
-      { x = mkOrder 1500 "last"; }
-      { y = "only"; }
-    ];
-
-    # asAttrs: with ordering — value is attrset, ordered list in valueMeta
-    asAttrs.ordered = {
-      z = mkOrder 200 "z-val";
-      a = mkOrder 100 "a-val";
-    };
-
-    # asAttrs: with mkForce — forced key overrides
-    asAttrs.withForce = mkMerge [
-      { x = "unused: overridden by mkForce"; }
-      {
-        x = mkForce "forced";
-        y = "kept";
-      }
-    ];
-
-    # asAttrs: empty
-    asAttrs.empty = [ ];
-
-    # asAttrsDefault: unique keys
-    asAttrsDefault.unique = [
-      { a = 1; }
-      { b = 2; }
-    ];
-
-    # asAttrsDefault: duplicate keys — default collects into lists
-    asAttrsDefault.duplicates = mkMerge [
-      { x = mkOrder 500 10; }
-      { x = mkOrder 1500 30; }
-      { y = 99; }
-      [
-        { x = 20; }
-      ]
-    ];
-
-    # either: attrList branch matches for list input
-    eitherAttrListOrInt = [
-      { a = "hello"; }
-      { b = "world"; }
-    ];
-
-    # either: int input falls through to int branch
-    eitherAttrListOrIntFallback = 42;
-
-    # either (swapped): int first, attrList second — int input matches int
-    eitherIntOrAttrList = 42;
-
-    # either (swapped): list input falls through to attrList branch
-    eitherIntOrAttrListFallback = [
-      { a = "hello"; }
-    ];
-
-    # Bad: string where int expected
-    attrListInt.badValue = [
-      { a = "not-an-int"; }
-    ];
-
-    # Bad: list element with multiple keys
-    attrList.badListElem = [
-      {
-        a = "ok";
-        b = "extra";
-      }
-    ];
-
-    # Bad: plain string instead of list or attrset
-    attrList.badString = "not-a-container";
-
-    # Bad: list element is a bare string, not a singleton attrset
-    attrList.badListString = [
-      "not a singleton attribute"
-    ];
-
-    attrListStrict = builtins.mapAttrs (k: v: builtins.deepSeq v v) config.attrList;
-    attrListIntStrict = builtins.mapAttrs (k: v: builtins.deepSeq v v) config.attrListInt;
-
-    assertions =
-      let
-        c = lib.evalModules {
-          modules = [ ./declare-attrList.nix ];
-        };
-        cfg = c.config;
-      in
-
-      # List input preserves elements
-      assert
-        cfg.attrList.listInput == [
-          { a = "alpha"; }
-          { b = "beta"; }
-        ];
-
-      # Attrset input with mkOrder: lower priority comes first
-      assert
-        cfg.attrList.attrsetOrdered == [
-          { y = "y-val"; }
-          { x = "x-val"; }
-        ];
-
-      # Mixed input: mkOrder 50 < default 1000
-      assert
-        cfg.attrList.mixed == [
-          { n = "from-attrset"; }
-          { m = "from-list"; }
-        ];
-
-      # Multiple definitions from separate modules concatenate
-      # (import module's definition comes before this module's)
-      assert
-        cfg.attrListInt.multiModule == [
-          { b = 2; }
-          { a = 1; }
-        ];
-
-      # Attrset without mkOrder: all at default priority
-      assert builtins.length cfg.attrList.attrsetNoOrder == 2;
-
-      # Empty list stays empty
-      assert cfg.attrList.empty == [ ];
-
-      # List elements support mkOrder/mkBefore/mkAfter
-      assert
-        cfg.attrList.listOrdering == [
-          { a = "before"; }
-          { m = "default"; }
-          { z = "after"; }
-        ];
-
-      # Plain list entries are at default priority (1000)
-      assert
-        cfg.attrList.listDefaultPrio == [
-          { before = "before"; }
-          { mid = "list-entry"; }
-          { after = "after"; }
-        ];
-
-      # Ordering: 500 < 1000 (default) < 1500
-      assert
-        cfg.attrList.ordering == [
-          { first = "first"; }
-          { middle = "middle"; }
-          { last = "last"; }
-        ];
-
-      # mkBefore (500) < default (1000) < mkAfter (1500)
-      assert
-        cfg.attrList.beforeAfter == [
-          { a = "before"; }
-          { m = "default"; }
-          { z = "after"; }
-        ];
-
-      # mkIf true includes, mkIf false excludes
-      assert
-        cfg.attrList.withMkIf == [
-          { yes = "included"; }
-        ];
-
-      # mkOverride: only lowest priority override survives
-      assert
-        cfg.attrList.withOverride == [
-          { winner = "wins"; }
-        ];
-
-      # mkDefault is overridden by normal definitions
-      assert
-        cfg.attrList.withDefault == [
-          { normal = "wins"; }
-        ];
-
-      # mkForce discards other definitions
-      assert
-        cfg.attrList.withForce == [
-          { forced = "wins"; }
-        ];
-
-      # mkForce with mkOrder inside: ordering still works
-      assert
-        cfg.attrList.forceWithOrder == [
-          { first = "before"; }
-          { second = "after"; }
-        ];
-
-      # mkForce on individual element values passes through
-      assert
-        cfg.attrListInt.forceElementValue == [
-          { a = 42; }
-          { b = 2; }
-        ];
-
-      # mkForce on attrset format: discards other defs, ordering preserved
-      assert
-        cfg.attrList.forceAttrset == [
-          { y = "y-val"; }
-          { x = "x-val"; }
-        ];
-
-      # mkForce on repeated key: forced entries override non-forced
-      assert
-        cfg.attrList.forceRepeatedKey == [
-          { x = "wins"; }
-          { x = "wins 2"; }
-        ];
-
-      # mkForce on repeated key across mkMerge: forced wins
-      assert
-        cfg.attrList.forceRepeatedKeyMerge == [
-          { x = "forced"; }
-        ];
-
-      # mkForce on repeated key in attrset format: discards other x, keeps y
-      assert
-        cfg.attrList.forceRepeatedKeyAttrs == [
-          { y = "kept"; }
-          { x = "forced"; }
-        ];
-
-      # mkForce only affects its own key
-      assert
-        cfg.attrList.forcePartialAttrs == [
-          { y = "normal y"; }
-          { x = "forced x"; }
-        ];
-
-      # mkForce in attrset format overrides same key from list format
-      assert
-        cfg.attrList.forceMixedFormats == [
-          { y = "list y"; }
-          { x = "attrset forced x"; }
-        ];
-
-      # Nesting: list format, mkOrder on element + mkForce on value
-      # z(100) < x-forced(500) < y(1500); x-discarded filtered by mkForce
-      assert
-        cfg.attrList.nestListOrderForce == [
-          { z = "earliest"; }
-          { x = "forced-early"; }
-          { y = "late"; }
-        ];
-
-      # Nesting: list format, mkOrder(mkForce(val)) on value
-      # z(500) < y(1000) < w(1200) < x-forced(1500); x-discarded entries filtered
-      assert
-        cfg.attrList.nestListOrderOfForce == [
-          { z = "earliest"; }
-          { y = "plain-early"; }
-          { w = "mid"; }
-          { x = "forced-late"; }
-        ];
-
-      # Nesting: list format, mkForce(mkOrder(val)) on value
-      # z(500) < y(1000) < w(1200) < x-forced(1500); x-discarded entries filtered
-      assert
-        cfg.attrList.nestListForceOfOrder == [
-          { z = "earliest"; }
-          { y = "plain-early"; }
-          { w = "mid"; }
-          { x = "forced-late"; }
-        ];
-
-      # Nesting: attrset format, mkOrder(mkForce(val))
-      # z(500) < y(1000) < w(1200) < x-forced(1500); x-discarded entries filtered
-      assert
-        cfg.attrList.nestAttrsOrderOfForce == [
-          { z = "earliest"; }
-          { y = "plain-early"; }
-          { w = "mid"; }
-          { x = "forced-late"; }
-        ];
-
-      # Nesting: attrset format, mkForce(mkOrder(val))
-      # z(500) < y(1000) < w(1200) < x-forced(1500); x-discarded entries filtered
-      assert
-        cfg.attrList.nestAttrsForceOfOrder == [
-          { z = "earliest"; }
-          { y = "plain-early"; }
-          { w = "mid"; }
-          { x = "forced-late"; }
-        ];
-
-      # mkIf false on individual element value filters it out (list format)
-      assert
-        cfg.attrListInt.optionalValueList == [
-          { a = 1; }
-          { c = 3; }
-        ];
-
-      # mkIf false on individual element value filters it out (attrset format)
-      assert
-        cfg.attrListInt.optionalValueAttrs == [
-          { a = 1; }
-          { c = 3; }
-        ];
-
-      # submodule: value, option descriptions, and valueMeta with real configuration metadata
-      assert
-        cfg.attrListSubmodule == [
-          {
-            web = {
-              host = "localhost";
-              port = 80;
-            };
-          }
-          {
-            db = {
-              host = "dbhost";
-              port = 5432;
-            };
-          }
-        ];
-      assert
-        builtins.map (m: m.configuration.config) c.options.attrListSubmodule.valueMeta.attrList == [
-          {
-            host = "localhost";
-            port = 80;
-          }
-          {
-            host = "dbhost";
-            port = 5432;
-          }
-        ];
-      assert
-        builtins.map (
-          m:
-          builtins.mapAttrs (n: o: o.description) (builtins.removeAttrs m.configuration.options [ "_module" ])
-        ) c.options.attrListSubmodule.valueMeta.attrList == [
-          {
-            host = "Hostname";
-            port = "Port number";
-          }
-          {
-            host = "Hostname";
-            port = "Port number";
-          }
-        ];
-
-      # valueMeta.attrList has one entry per (non-filtered) element
-      assert
-        c.options.attrList.valueMeta.attrs.listInput.attrList == [
-          { }
-          { }
-        ];
-      assert
-        c.options.attrList.valueMeta.attrs.attrsetOrdered.attrList == [
-          { }
-          { }
-        ];
-      assert
-        c.options.attrList.valueMeta.attrs.mixed.attrList == [
-          { }
-          { }
-        ];
-      assert c.options.attrList.valueMeta.attrs.empty.attrList == [ ];
-      assert
-        c.options.attrListInt.valueMeta.attrs.optionalValueList.attrList == [
-          { }
-          { }
-        ];
-
-      # either: headError is null for valid attrList input, so attrList branch is picked
-      assert
-        cfg.eitherAttrListOrInt == [
-          { a = "hello"; }
-          { b = "world"; }
-        ];
-
-      # either: headError is non-null for int input, so int branch is picked
-      assert cfg.eitherAttrListOrIntFallback == 42;
-
-      # either (swapped): int first — int input matches
-      assert cfg.eitherIntOrAttrList == 42;
-
-      # either (swapped): list input falls through to attrList branch
-      assert
-        cfg.eitherIntOrAttrListFallback == [
-          { a = "hello"; }
-        ];
-
-      # asAttrs: unique keys — value is a plain attrset
-      assert
-        cfg.asAttrs.unique == {
-          a = "alpha";
-          b = "beta";
-        };
-      # ordered list preserved in valueMeta
-      assert
-        c.options.asAttrs.valueMeta.attrs.unique.attrListValue == [
-          { a = "alpha"; }
-          { b = "beta"; }
-        ];
-
-      # asAttrs: duplicate keys — last in order wins
-      assert
-        cfg.asAttrs.duplicateKeys == {
-          x = "last";
-          y = "only";
-        };
-      assert
-        c.options.asAttrs.valueMeta.attrs.duplicateKeys.attrListValue == [
-          { x = "first"; }
-          { y = "only"; }
-          { x = "last"; }
-        ];
-
-      # asAttrs: ordered — value is attrset (unordered), list in valueMeta preserves order
-      assert
-        cfg.asAttrs.ordered == {
-          a = "a-val";
-          z = "z-val";
-        };
-      assert
-        c.options.asAttrs.valueMeta.attrs.ordered.attrListValue == [
-          { a = "a-val"; }
-          { z = "z-val"; }
-        ];
-
-      # asAttrs: mkForce — forced key overrides, value is attrset
-      assert
-        cfg.asAttrs.withForce == {
-          x = "forced";
-          y = "kept";
-        };
-
-      # asAttrs: empty — value is empty attrset
-      assert cfg.asAttrs.empty == { };
-
-      # asAttrsDefault: unique keys — each value wrapped in singleton list
-      assert
-        cfg.asAttrsDefault.unique == {
-          a = [ 1 ];
-          b = [ 2 ];
-        };
-
-      # asAttrsDefault: duplicate keys — values collected into list in order
-      assert
-        cfg.asAttrsDefault.duplicates == {
-          x = [
-            10
-            20
-            30
-          ];
-          y = [ 99 ];
-        };
-      assert
-        c.options.asAttrsDefault.valueMeta.attrs.duplicates.attrListValue == [
-          { x = 10; }
-          { y = 99; }
-          { x = 20; }
-          { x = 30; }
-        ];
-
-      # valueMeta.definitions: mkDefinition records with mkOrder-wrapped single-key attrsets
-      # Use duplicateKeys which has mixed priorities and repeated keys
-      assert
-        let
-          defs = c.options.asAttrs.valueMeta.attrs.duplicateKeys.definitions;
-          extract = d: {
-            prio = d.value.priority;
-            value = d.value.content;
-          };
-        in
-        map extract defs == [
-          {
-            prio = 500;
-            value = {
-              x = "first";
-            };
-          }
-          {
-            prio = 1000;
-            value = {
-              y = "only";
-            };
-          }
-          {
-            prio = 1500;
-            value = {
-              x = "last";
-            };
-          }
-        ];
-
-      # Round-trip: feed definitions through mapDefinitionValue + mkMerge into a listOf option
-      assert
-        let
-          rendered = lib.modules.mapDefinitionValue (attr: lib.cli.toCommandLineGNU { } attr) (
-            mkMerge c.options.asAttrs.valueMeta.attrs.duplicateKeys.definitions
-          );
-          result =
-            (lib.evalModules {
-              modules = [
-                { options.out = mkOption { type = types.listOf types.str; }; }
-                { config.out = rendered; }
-                # Interleave: mkOrder 800 lands between x(500) and y(1000)
-                { config.out = mkOrder 800 [ "--interleaved" ]; }
-              ];
-            }).config.out;
-        in
-        result == [
-          "-xfirst"
-          "--interleaved"
-          "-yonly"
-          "-xlast"
-        ];
-
-      # Error cases are tested via checkConfigError in modules.sh
-
-      "ok";
-  };
-}

lib/tests/modules/types.nix

@@ -167,28 +167,6 @@ in
           elemType = str;
           lazy = false;
         }).description == "attribute set of string";
-      assert (attrListOf str).description == "attribute list of string";
-      assert (attrListOf int).description == "attribute list of signed integer";
-      assert (attrListOf bool).description == "attribute list of boolean";
-      assert (attrListOf (either int str)).description == "attribute list of (signed integer or string)";
-      assert (attrListOf (nullOr str)).description == "attribute list of (null or string)";
-      assert (attrListOf (listOf str)).description == "attribute list of list of string";
-      assert
-        (attrListOf (attrsOf int)).description == "attribute list of attribute set of signed integer";
-      assert (attrListOf (attrListOf str)).description == "attribute list of attribute list of string";
-      assert (attrListOf ints.positive).description == "attribute list of (positive integer, meaning >0)";
-      assert
-        (attrListOf (enum [
-          "a"
-          "b"
-        ])).description == "attribute list of (one of \"a\", \"b\")";
-      assert
-        (attrListOf (strMatching "[0-9]+")).description
-        == "attribute list of string matching the pattern [0-9]+";
-      assert
-        (attrListOf (nonEmptyListOf str)).description == "attribute list of non-empty (list of string)";
-      assert (attrListOf (submodule { })).description == "attribute list of (submodule)";
-
       assert (coercedTo str abort int).description == "signed integer or string convertible to it";
       assert (coercedTo int abort str).description == "string or signed integer convertible to it";
       assert (coercedTo bool abort str).description == "string or boolean convertible to it";

lib/tests/sources.sh

@@ -70,16 +70,4 @@ dir="$(nix-instantiate --eval --strict --read-write-mode --json --expr '(with im
 EOF
 ) || die "cleanSourceWith + cleanSource"
 
-
-dir="$(nix-instantiate --eval --strict --read-write-mode --json --expr '(with import <nixpkgs/lib>; "${
-  sources.sourceByGlobs '"$work"' [ "*.md" "**/*.o" ]
-}")' | crudeUnquoteJSON)"
-(cd "$dir"; find) | sort -f | diff -U10 - <(cat <<EOF
-.
-./module.o
-./README.md
-EOF
-) || die "sourceByGlobs 1"
-
-
 echo >&2 tests ok

lib/trivial.nix

@@ -504,7 +504,7 @@ in
     On each release the first letter is bumped and a new animal is chosen
     starting with that new letter.
   */
-  codeName = "Zokor";
+  codeName = "Yarara";
 
   /**
     Returns the current nixpkgs version suffix as string.

lib/types.nix

@@ -20,7 +20,6 @@ let
     isStorePath
     isString
     substring
-    sort
     throwIf
     toDerivation
     toList
@@ -28,7 +27,6 @@ let
     ;
   inherit (lib.lists)
     concatLists
-    concatMap
     elemAt
     filter
     foldl'
@@ -72,11 +70,6 @@ let
     mergeDefinitions
     fixupOptionType
     mergeOptionDecls
-    defaultOrderPriority
-    defaultOverridePriority
-    mkDefinition
-    mkOrder
-    mkOverride
     ;
   inherit (lib.fileset)
     isFileset
@@ -812,179 +805,6 @@ rec {
       substSubModules = m: nonEmptyListOf (elemType.substSubModules m);
     };
 
-  attrListOf = elemType: attrListWith { inherit elemType; };
-
-  attrListWith =
-    {
-      elemType,
-      asAttrs ? false,
-      mergeAttrValues ? _name: values: values,
-    }:
-    mkOptionType rec {
-      name = "attrListOf";
-      description = "attribute list of ${
-        optionDescriptionPhrase (class: class == "noun" || class == "composite") elemType
-      }";
-      descriptionClass = "composite";
-      check = {
-        __functor = _self: x: isList x || isAttrs x;
-        isV2MergeCoherent = true;
-      };
-      merge = {
-        __functor =
-          self: loc: defs:
-          (self.v2 { inherit loc defs; }).value;
-        v2 =
-          { loc, defs }:
-          let
-            # Peel order and override properties from a value in any nesting order.
-            # Returns { value, prio, overridePrio }.
-            # mkOrder is stripped (we consume it for sorting).
-            # mkOverride is preserved in value (mergeDefinitions strips it).
-            peelProperties =
-              value:
-              let
-                type = value._type or null;
-              in
-              if type == "order" then
-                let
-                  inner = peelProperties value.content;
-                in
-                {
-                  inherit (inner) value overridePrio;
-                  prio = value.priority;
-                }
-              else if type == "override" then
-                let
-                  inner = peelProperties value.content;
-                in
-                {
-                  inherit (inner) prio;
-                  overridePrio = value.priority;
-                  # Re-wrap mkOverride around the inner value (with mkOrder stripped)
-                  value = mkOverride value.priority inner.value;
-                }
-              else
-                {
-                  inherit value;
-                  prio = defaultOrderPriority;
-                  overridePrio = defaultOverridePriority;
-                };
-
-            # Extract { file, key, value, prio, overridePrio } from a single-key attrset,
-            # optionally wrapped in mkOrder at the element level (list format).
-            extractItem =
-              file: raw:
-              let
-                hasOrder = isType "order" raw;
-                item = if hasOrder then raw.content else raw;
-                key = head (attrNames item);
-                peeled = peelProperties item.${key};
-              in
-              if isAttrs item && length (attrNames item) == 1 then
-                peeled
-                // {
-                  inherit file key;
-                  prio = if hasOrder then raw.priority else peeled.prio;
-                }
-              else
-                throw "A definition for option `${showOption loc}' is not of type `${description}'. ${
-                  if !isAttrs item then
-                    "Each list element must be an attribute set, but got ${builtins.typeOf item}"
-                  else
-                    "Each list element must be a single-key attribute set, but got ${toString (length (attrNames item))} keys"
-                }.${
-                  showDefs [
-                    {
-                      inherit file;
-                      value = raw;
-                    }
-                  ]
-                }";
-
-            # Convert a definition to a flat list of { file, key, value, prio, overridePrio }
-            defToItems =
-              def:
-              if isList def.value then
-                map (extractItem def.file) def.value
-              else
-                # isAttrs: properties are on the values directly
-                map (
-                  key:
-                  peelProperties def.value.${key}
-                  // {
-                    inherit (def) file;
-                    inherit key;
-                  }
-                ) (attrNames def.value);
-
-            allItems = concatMap defToItems defs;
-
-            # Per key, find the highest override priority (lowest number)
-            winningOverridePrio = foldl' (
-              acc: item:
-              let
-                prev = acc.${item.key} or defaultOverridePriority;
-              in
-              if item.overridePrio < prev then
-                acc // { ${item.key} = item.overridePrio; }
-              else
-                # minimize `//` operations
-                acc
-            ) { } allItems;
-
-            # Keep only items at the winning override priority for their key
-            items = sort (a: b: a.prio < b.prio) (
-              filter (
-                item: item.overridePrio == winningOverridePrio.${item.key} or defaultOverridePriority
-              ) allItems
-            );
-
-            evals = filter (e: e.eval.optionalValue ? value) (
-              map (item: {
-                inherit (item) key file prio;
-                eval = mergeDefinitions (loc ++ [ item.key ]) elemType [
-                  {
-                    inherit (item) file value;
-                  }
-                ];
-              }) items
-            );
-
-            attrListValue = map (e: { ${e.key} = e.eval.optionalValue.value or e.eval.mergedValue; }) evals;
-          in
-          {
-            headError = checkDefsForError check loc defs;
-            value = if asAttrs then zipAttrsWith mergeAttrValues attrListValue else attrListValue;
-            valueMeta.attrList = map (e: e.eval.checkedAndMerged.valueMeta) evals;
-            /**
-              The ordered list representation, especially useful when asAttrs is set.
-            */
-            valueMeta.attrListValue = attrListValue;
-            valueMeta.definitions = map (
-              e:
-              mkDefinition {
-                inherit (e) file;
-                value = mkOrder e.prio { ${e.key} = e.eval.optionalValue.value or e.eval.mergedValue; };
-              }
-            ) evals;
-          };
-      };
-      emptyValue = {
-        value = if asAttrs then { } else [ ];
-      };
-      getSubOptions = prefix: elemType.getSubOptions (prefix ++ [ "*" ]);
-      getSubModules = elemType.getSubModules;
-      substSubModules =
-        m:
-        attrListWith {
-          inherit asAttrs mergeAttrValues;
-          elemType = elemType.substSubModules m;
-        };
-      typeMerge = t: null; # Disable type merging
-      nestedTypes.elemType = elemType;
-    };
-
   attrsOf = elemType: attrsWith { inherit elemType; };
 
   # A version of attrsOf that's lazy in its values at the expense of

maintainers/maintainer-list.nix

@@ -118,6 +118,13 @@
     github = "0xB10C";
     githubId = 19157360;
   };
+  _0xbe7a = {
+    email = "nix@be7a.de";
+    name = "Bela Stoyan";
+    github = "0xbe7a";
+    githubId = 6232980;
+    keys = [ { fingerprint = "2536 9E86 1AA5 9EB7 4C47  B138 6510 870A 77F4 9A99"; } ];
+  };
   _0xC45 = {
     email = "jason@0xc45.com";
     name = "Jason Vigil";
@@ -703,12 +710,6 @@
     githubId = 25004152;
     name = "Adrian Gunnar Lauterer";
   };
-  adrielvelazquez = {
-    email = "AdrielVelazquez@gmail.com";
-    github = "AdrielVelazquez";
-    githubId = 3443378;
-    name = "Adriel Velazquez";
-  };
   AdrienLemaire = {
     email = "lemaire.adrien@gmail.com";
     github = "AdrienLemaire";
@@ -1875,10 +1876,7 @@
     github = "ap-1";
     githubId = 67872951;
     name = "Anish Pallati";
-    keys = [
-      { fingerprint = "2A0A 16F5 E026 BE3B A47F B7A6 841A FB68 9A5B ACCB"; }
-      { fingerprint = "B89E A3F3 16A7 411C B5B2 8A14 B1CA 8321 35A8 C503"; }
-    ];
+    keys = [ { fingerprint = "2A0A 16F5 E026 BE3B A47F B7A6 841A FB68 9A5B ACCB"; } ];
   };
   ankhers = {
     email = "me@ankhers.dev";
@@ -4284,12 +4282,6 @@
       { fingerprint = "D088 A5AF C45B 78D1 CD4F  457C 6957 B3B6 46F2 BB4E"; }
     ];
   };
-  c6rg0 = {
-    email = "c6rg0@protonmail.com";
-    github = "c6rg0";
-    githubId = 64259221;
-    name = "c6rg0";
-  };
   caarlos0 = {
     name = "Carlos A Becker";
     email = "carlos@becker.software";
@@ -4370,6 +4362,12 @@
     githubId = 1516457;
     name = "Christian Albrecht";
   };
+  callahad = {
+    email = "dan.callahan@gmail.com";
+    github = "callahad";
+    githubId = 24193;
+    name = "Dan Callahan";
+  };
   callumio = {
     email = "git@cleslie.uk";
     github = "callumio";
@@ -4557,12 +4555,6 @@
     githubId = 53847249;
     name = "Casey Avila";
   };
-  castorNova2 = {
-    email = "solemnsquire@gmail.com";
-    github = "castorNova2";
-    githubId = 84083897;
-    name = "Nidhish Chauhan";
-  };
   catap = {
     email = "kirill@korins.ky";
     github = "catap";
@@ -7612,11 +7604,6 @@
     githubId = 54573;
     name = "Edward Amsden";
   };
-  eana = {
-    github = "eana";
-    githubId = 18534280;
-    name = "Jonas Eana";
-  };
   earldouglas = {
     email = "james@earldouglas.com";
     github = "earldouglas";
@@ -7653,12 +7640,6 @@
     github = "eclairevoyant";
     name = "éclairevoyant";
   };
-  eConnah = {
-    email = "git@econnah.uk";
-    github = "eConnah";
-    githubId = 63052937;
-    name = "Connor Alecks";
-  };
   edanaher = {
     email = "nixos@edanaher.net";
     github = "edanaher";
@@ -8315,11 +8296,6 @@
     githubId = 5427394;
     name = "Ersin Akinci";
   };
-  es-sai-fi = {
-    name = "es-sai-fi";
-    github = "es-sai-fi";
-    githubId = 96452903;
-  };
   esau79p = {
     github = "EsAu79p";
     githubId = 21313906;
@@ -8676,13 +8652,6 @@
     githubId = 88741530;
     name = "Fabian Rigoll";
   };
-  fabiob = {
-    email = "fabio@atelie.dev.br";
-    github = "fabiob";
-    githubId = 140875;
-    name = "Fábio Batista";
-    keys = [ { fingerprint = "D2D8 69D8 5EEC 30AD D327  B4A5 6CD5 5257 DB01 8B72"; } ];
-  };
   fallenbagel = {
     name = "fallenbagel";
     github = "fallenbagel";
@@ -9249,12 +9218,6 @@
     githubId = 119691;
     name = "Michael Gough";
   };
-  fraggerfox = {
-    email = "santhosh.raju@gmail.com";
-    github = "fraggerfox";
-    githubId = 189939;
-    name = "Santhosh Raju";
-  };
   fraioveio = {
     email = "francesco@vecchia.lol";
     github = "FraioVeio";
@@ -9365,6 +9328,14 @@
     githubId = 1943632;
     name = "fro_ozen";
   };
+  frogamic = {
+    email = "frogamic@protonmail.com";
+    github = "frogamic";
+    githubId = 10263813;
+    name = "Dominic Shelton";
+    matrix = "@frogamic:beeper.com";
+    keys = [ { fingerprint = "779A 7CA8 D51C C53A 9C51  43F7 AAE0 70F0 67EC 00A5"; } ];
+  };
   frontear = {
     name = "Ali Rizvi";
     email = "perm-iterate-0b@icloud.com";
@@ -10153,12 +10124,6 @@
     githubId = 6893840;
     name = "Yacine Hmito";
   };
-  gquetel = {
-    email = "gregor.quetel@telecom-paris.fr";
-    github = "gquetel";
-    githubId = 48437427;
-    name = "Grégor Quetel";
-  };
   gracicot = {
     email = "dev@gracicot.com";
     matrix = "@gracicot-59e8f173d73408ce4f7ac803:gitter.im";
@@ -11084,7 +11049,7 @@
     name = "Hugo Tavares Reis";
   };
   httprafa = {
-    email = "rafa.kienitz@proton.me";
+    email = "rafael.kienitz@gmail.com";
     github = "HttpRafa";
     githubId = 60099368;
     name = "Rafael Kienitz";
@@ -11705,12 +11670,6 @@
     githubId = 7348004;
     name = "Benjamin Levy";
   };
-  iogamaster = {
-    email = "iogamastercode+nixpkgs@gmail.com";
-    name = "IogaMaster";
-    github = "IogaMaster";
-    githubId = 67164465;
-  };
   ionutnechita = {
     email = "ionut_n2001@yahoo.com";
     github = "ionutnechita";
@@ -12612,12 +12571,6 @@
     githubId = 30251156;
     name = "Jesse Moore";
   };
-  jesssullivan = {
-    email = "jess@sulliwood.org";
-    github = "Jesssullivan";
-    githubId = 37297218;
-    name = "Jess Sullivan";
-  };
   jethair = {
     email = "jethair@duck.com";
     github = "JetHair";
@@ -14380,6 +14333,12 @@
     githubId = 451835;
     name = "Kirill Elagin";
   };
+  kirikaza = {
+    email = "k@kirikaza.ru";
+    github = "kirikaza";
+    githubId = 804677;
+    name = "Kirill Kazakov";
+  };
   kirillrdy = {
     email = "kirillrdy@gmail.com";
     github = "kirillrdy";
@@ -15624,6 +15583,12 @@
     githubId = 4312404;
     name = "Chris Rendle-Short";
   };
+  lightdiscord = {
+    email = "root@arnaud.sh";
+    github = "lightdiscord";
+    githubId = 24509182;
+    name = "Arnaud Pascal";
+  };
   lightquantum = {
     email = "self@lightquantum.me";
     github = "PhotonQuantum";
@@ -15830,6 +15795,12 @@
     githubId = 23727619;
     name = "Luca Ruperto";
   };
+  lnl7 = {
+    email = "daiderd@gmail.com";
+    github = "LnL7";
+    githubId = 689294;
+    name = "Daiderd Jordan";
+  };
   lo1tuma = {
     email = "schreck.mathias@gmail.com";
     github = "lo1tuma";
@@ -16294,11 +16265,6 @@
     githubId = 26020062;
     name = "lumi";
   };
-  luminarleaf = {
-    github = "LuminarLeaf";
-    githubId = 80571430;
-    name = "Luminar Leaf";
-  };
   luna_1024 = {
     email = "contact@luna.computer";
     github = "luna-1024";
@@ -16477,12 +16443,6 @@
     githubId = 8094643;
     keys = [ { fingerprint = "BAA9 7711 58CA D457 B4AE  8B06 8188 423D 2FA2 0A65"; } ];
   };
-  m4r1vs = {
-    email = "marius.niveri@gmail.com";
-    name = "Marius Niveri";
-    github = "m4r1vs";
-    githubId = 26097311;
-  };
   m7medvision = {
     name = "Mohammed";
     github = "m7medVision";
@@ -17421,6 +17381,12 @@
     githubId = 613740;
     name = "Martin Baillie";
   };
+  mbbx6spp = {
+    email = "me@susanpotter.net";
+    github = "mbbx6spp";
+    githubId = 564;
+    name = "Susan Potter";
+  };
   mbe = {
     email = "brandonedens@gmail.com";
     github = "brandonedens";
@@ -18294,6 +18260,13 @@
     githubId = 52108954;
     name = "Matias Zwinger";
   };
+  mkf = {
+    email = "m@mikf.pl";
+    github = "mkf";
+    githubId = 7753506;
+    name = "Michał Krzysztof Feiler";
+    keys = [ { fingerprint = "1E36 9940 CC7E 01C4 CFE8  F20A E35C 2D7C 2C6A C724"; } ];
+  };
   mkg = {
     email = "mkg@vt.edu";
     github = "mkgvt";
@@ -18726,10 +18699,10 @@
     keys = [ { fingerprint = "3B66 ACFA D10F 02AA B1D5  2CB1 8DD0 D81D 7D1F C61A"; } ];
   };
   mshnwq = {
-    email = "hmachnouk@proton.me";
+    email = "mshnwq.com@gmail.com";
     github = "mshnwq";
     githubId = 68467027;
-    name = "Mshnwq";
+    name = "Hayan Al-Machnouk";
   };
   msiedlarek = {
     email = "mikolaj@siedlarek.pl";
@@ -19398,11 +19371,6 @@
     githubId = 79978224;
     name = "winston";
   };
-  nelind = {
-    name = "Nel";
-    github = "nelind3";
-    githubId = 57587152;
-  };
   nelsonjeppesen = {
     email = "nix@jeppesen.io";
     github = "NelsonJeppesen";
@@ -19431,12 +19399,6 @@
     name = "neo";
     email = "chojs990222@gmail.com";
   };
-  neonvoid = {
-    email = "me@neonvoid.dev";
-    github = "neonvoidx";
-    githubId = 25580051;
-    name = "neonvoid";
-  };
   neosimsim = {
     email = "me@abn.sh";
     github = "neosimsim";
@@ -19501,12 +19463,6 @@
     githubId = 1488603;
     name = "François Espinet";
   };
-  netpleb = {
-    email = "netpleb@proton.me";
-    github = "netpleb";
-    githubId = 130105838;
-    name = "netpleb";
-  };
   netthier = {
     email = "netthier@proton.me";
     name = "nett_hier";
@@ -20398,12 +20354,6 @@
     email = "nyu@nyuku.ru";
     githubId = 97425873;
   };
-  nyxar77 = {
-    name = "nyxar77";
-    github = "nyxar77";
-    email = "dev@nyxar.space";
-    githubId = 153492661;
-  };
   nyxonios = {
     name = "nyxonios";
     github = "Nyxonios";
@@ -22158,12 +22108,6 @@
     githubId = 246631;
     keys = [ { fingerprint = "3E46 7EF1 54AA A1D0 C7DF  A694 E45C B17F 1940 CA52"; } ];
   };
-  pretentiousUsername = {
-    name = "Ian Mitchell";
-    email = "mitchell.ian.2001@gmail.com";
-    github = "pretentiousUsername";
-    githubId = 94192644;
-  };
   priegger = {
     email = "philipp@riegger.name";
     github = "priegger";
@@ -23398,6 +23342,12 @@
     githubId = 6047658;
     name = "Ryan Horiguchi";
   };
+  rht = {
+    email = "rhtbot@protonmail.com";
+    github = "rht";
+    githubId = 395821;
+    name = "rht";
+  };
   rhydianjenkins = {
     name = "Rhydian Jenkins";
     github = "RhydianJenkins";
@@ -23433,13 +23383,6 @@
     githubId = 61013287;
     name = "Ricardo Steijn";
   };
-  ricardomaps = {
-    email = "ricardomapurungajunior@gmail.com";
-    github = "ricardomaps";
-    githubId = 49507078;
-    name = "Ricardo Mapurunga Junior";
-    matrix = "@ricmaps:matrix.org";
-  };
   richar = {
     github = "ri-char";
     githubId = 17962023;
@@ -25089,12 +25032,6 @@
     githubId = 2049686;
     name = "Sebastián Estrella";
   };
-  seudonym = {
-    name = "Wahid Khan";
-    email = "wk170179+nixpkgs@gmail.com";
-    github = "seudonym";
-    githubId = 80459261;
-  };
   seven_bear = {
     name = "Edmond Freeman";
     email = "edmondfreeman7@gmail.com";
@@ -25367,6 +25304,12 @@
     githubId = 487050;
     name = "Shea Levy";
   };
+  shlok = {
+    email = "sd-nix-maintainer@quant.is";
+    github = "shlok";
+    githubId = 3000933;
+    name = "Shlok Datye";
+  };
   shmish111 = {
     email = "shmish111@gmail.com";
     github = "shmish111";
@@ -25709,6 +25652,12 @@
     githubId = 216167;
     name = "Steve Jones";
   };
+  sjmackenzie = {
+    email = "setori88@gmail.com";
+    github = "sjmackenzie";
+    githubId = 158321;
+    name = "Stewart Mackenzie";
+  };
   skaphi = {
     name = "Oskar Philipsson";
     email = "oskar.philipsson@gmail.com";
@@ -25751,7 +25700,6 @@
   };
   skyesoss = {
     name = "Skye Soss";
-    email = "skye@soss.website";
     matrix = "@skyesoss:matrix.org";
     github = "Skyb0rg007";
     githubId = 30806179;
@@ -26149,12 +26097,6 @@
     name = "sportshead";
     keys = [ { fingerprint = "A6B6 D031 782E BDF7 631A  8E7E A874 DB2C BFD3 CFD0"; } ];
   };
-  spotdemo4 = {
-    email = "me@trev.xyz";
-    github = "spotdemo4";
-    githubId = 3732640;
-    name = "spotdemo4";
-  };
   spreetin = {
     email = "spreetin@protonmail.com";
     name = "David Falk";
@@ -28400,6 +28342,12 @@
     githubId = 77488956;
     name = "Timothy Tschnitzel";
   };
+  ttuegel = {
+    email = "ttuegel@mailbox.org";
+    github = "ttuegel";
+    githubId = 563054;
+    name = "Thomas Tuegel";
+  };
   tu-maurice = {
     email = "valentin.gehrke+nixpkgs@zom.bi";
     github = "tu-maurice";
@@ -28586,12 +28534,6 @@
     githubId = 30677291;
     name = "u2x1";
   };
-  u3kkasha = {
-    email = "fida.waseque@gmail.com";
-    github = "u3kkasha";
-    githubId = 146055002;
-    name = "Fida Waseque Choudhury";
-  };
   uakci = {
     name = "uakci";
     email = "git@uakci.space";
@@ -29491,12 +29433,6 @@
     github = "wdavidw";
     githubId = 46896;
   };
-  wduo87391 = {
-    name = "wduo87391";
-    email = "wduo87391@gmail.com";
-    github = "wduo87391";
-    githubId = 197874825;
-  };
   weathercold = {
     name = "Weathercold";
     email = "weathercold.scr@proton.me";
@@ -29683,11 +29619,6 @@
       }
     ];
   };
-  wilaz = {
-    name = "Wilaz";
-    github = "Wilaz";
-    githubId = 98198668;
-  };
   wildsebastian = {
     name = "Sebastian Wild";
     email = "sebastian@wild-siena.com";

maintainers/scripts/luarocks-packages.csv

@@ -168,7 +168,6 @@ telescope.nvim,,,,,5.1,
 tiktoken_core,,,,,,natsukium
 tl,,,,,,mephistophiles
 toml-edit,,,,,5.1,mrcjkb
-tomlua,,,,,,birdee
 tree-sitter-cli,,,,,,
 tree-sitter-http,,,,0.0.33-1,,
 tree-sitter-norg,,,,,5.1,mrcjkb
@@ -176,7 +175,6 @@ tree-sitter-norg-meta,,,,,,
 tree-sitter-orgmode,,,,,5.1,
 utf8,,,,,,
 tree-sitter-teal,,,,,,
-vicious,,,,,,
 vstruct,,,,,,
 vusted,,,,,,
 xml2lua,,,,,,teto

nixos/doc/manual/configuration/profiles/headless.section.md

@@ -2,7 +2,7 @@
 
 Common configuration for headless machines (e.g., Amazon EC2 instances).
 
-Disables serial consoles,
+Disables [vesa](#opt-boot.vesa), serial consoles,
 [emergency mode](#opt-systemd.enableEmergencyMode),
 [grub splash images](#opt-boot.loader.grub.splashImage)
 and configures the kernel to reboot automatically on panic.

nixos/doc/manual/development/modular-services.md

@@ -6,7 +6,7 @@ Status: in development. This functionality is new in NixOS 25.11, and significan
 Traditionally, NixOS services were defined using sets of options *in* modules, not *as* modules. This made them non-modular, resulting in problems with composability, reuse, and portability.
 
 A configuration management framework is an application of `evalModules` with the `class` and `specialArgs` input attribute set to particular values.
-NixOS is such a configuration management framework, and so are [Home Manager](https://github.com/nix-community/home-manager) and [`nix-darwin`](https://github.com/nix-darwin/nix-darwin).
+NixOS is such a configuration management framework, and so are [Home Manager](https://github.com/nix-community/home-manager) and [`nix-darwin`](https://github.com/lnl7/nix-darwin).
 
 The service management component of a configuration management framework is the set of module options that connects Nix expressions with the underlying service (or process) manager.
 For NixOS this is the module wrapping [`systemd`](https://systemd.io/), on `nix-darwin` this is the module wrapping [`launchd`](https://en.wikipedia.org/wiki/Launchd).

nixos/doc/manual/development/option-types.section.md

@@ -494,47 +494,6 @@ Composed types are types that take a type as parameter. `listOf
 
       Displays the option as `foo.<id>` in the manual.
 
-`types.attrListOf` *`t`*
-
-:   An ordered list of single-attribute attribute sets, where each value is of *`t`* type.
-    The output is always `[ { name1 = value1; } { name2 = value2; } ... ]`.
-
-    Definitions can be provided in two formats, which may be mixed via `lib.mkMerge`, `imports`, etc:
-
-    - **List format**: `[ { a = 1; } { b = 2; } ]` — each element must be a single-attribute attribute set.
-      Elements may be wrapped in `lib.mkOrder` (or `lib.mkBefore`/`lib.mkAfter`) to control ordering;
-      unwrapped elements use the default order priority.
-
-    - **Attribute set format**: `{ a = lib.mkOrder 100 1; b = 2; }` — each name-value pair becomes a single-attribute attribute set in the output.
-      Values may be wrapped in `lib.mkOrder` (or `lib.mkBefore`/`lib.mkAfter`) to control ordering.
-      Values without `lib.mkOrder` use the default priority.
-
-    Multiple definitions of the same option are concatenated and then sorted by priority.
-    Entries at the same priority level preserve their definition order.
-
-`types.attrListWith` { *`elemType`*, *`asAttrs`* ? false, *`mergeAttrValues`* ? _name: values: values }
-
-:   An ordered list of single-attribute attribute sets, where each value is of *`elemType`* type.
-
-    **Parameters**
-
-    `elemType` (Required)
-    : Specifies the type of each value in the attribute list.
-
-    `asAttrs`
-    : When `true`, the option value is an attribute set instead of a list.
-      Duplicate keys are merged using `mergeAttrValues`.
-      The ordered list is always available via `valueMeta.attrListValue`.
-
-    `mergeAttrValues`
-    : A function `name: values: mergedValue` that controls how duplicate keys
-      are combined when `asAttrs = true`. This is passed as the callback to
-      `lib.zipAttrsWith`. The `values` list is in order of priority.
-      By default, all values are collected into a list.
-
-    **Behavior**
-
-    - `attrListWith { elemType = t; }` is equivalent to `attrListOf t`
 
 `types.uniq` *`t`*
 

nixos/doc/manual/redirects.json

@@ -2363,21 +2363,6 @@
   "ch-release-notes": [
     "release-notes.html#ch-release-notes"
   ],
-  "sec-release-26.11": [
-    "release-notes.html#sec-release-26.11"
-  ],
-  "sec-release-26.11-highlights": [
-    "release-notes.html#sec-release-26.11-highlights"
-  ],
-  "sec-release-26.11-new-modules": [
-    "release-notes.html#sec-release-26.11-new-modules"
-  ],
-  "sec-release-26.11-incompatibilities": [
-    "release-notes.html#sec-release-26.11-incompatibilities"
-  ],
-  "sec-release-26.11-notable-changes": [
-    "release-notes.html#sec-release-26.11-notable-changes"
-  ],
   "sec-release-26.05": [
     "release-notes.html#sec-release-26.05"
   ],

nixos/doc/manual/release-notes/release-notes.md

@@ -3,7 +3,6 @@
 This section lists the release notes for each stable version of NixOS and current unstable revision.
 
 ```{=include=} sections
-rl-2611.section.md
 rl-2605.section.md
 rl-2511.section.md
 rl-2505.section.md

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -96,8 +96,6 @@
 
 - [kiwix-serve](https://wiki.kiwix.org/wiki/Kiwix-serve), a service that serves ZIM files (such as Wikipedia archives) over HTTP. Available as [services.kiwix-serve](#opt-services.kiwix-serve.enable).
 
-- [matterjs-server](https://github.com/matter-js/matterjs-server), a Matter controller with a Home Assistant compatible WebSocket API. Available as [services.matterjs-server](#opt-services.matterjs-server.enable).
-
 - [Remark42](https://remark42.com/), a self-hosted comment engine. Available as [services.remark42](#opt-services.remark42.enable).
 
 - [LibreChat](https://www.librechat.ai/), open-source self-hostable ChatGPT clone with Agents and RAG APIs. Available as [services.librechat](#opt-services.librechat.enable).
@@ -197,8 +195,6 @@
 
 - `services.home-assistant.config.lovelace.mode` has been renamed to `lovelace.dashboards` and `lovelace.resource_mode` to match the [configuration format](https://www.home-assistant.io/dashboards/dashboards/) required by Home Assistant 2026.8. Users who explicitly set `lovelace.mode` should remove it; the module generates the correct entries automatically.
 
-- `fulcrum` has been updated to 2.x. If run against an existing v1.x database without the `--db-upgrade` flag it refuses to start; the upgrade takes around an hour on Bitcoin mainnet.
-
 - `opentrack`, `slushload`, `synthesia`, `vtfedit`, `winbox`, `wineasio`, and `yabridge` use wineWow64Packages instead of wineWowPackages as wine versions >= 11.0 have deprecated wineWowPackages. As such, the prefixes for these packages are NOT backwards compatible and need to be regenerated with potential for data loss.
 
 - []{#sec-release-26.05-incompatibilities-profiles-hardened-removed} `profiles/hardened` has been removed, because:

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -1,4 +1,4 @@
-# Release 26.11 ("Zokor", 2026.11/??) {#sec-release-26.11}
+# Release 26.11 (2026.11/??) {#sec-release-26.11}
 
 ## Highlights {#sec-release-26.11-highlights}
 
@@ -10,7 +10,7 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- [tranquil](https://tangled.org/tranquil.farm/tranquil-pds) is an ATProto PDS (personal data server) implementation in Rust. A featureful, spec conscious and community driven alternative to the Bluesky reference implementation PDS. Available as [services.tranquil-pds](#opt-services.tranquil-pds.enable).
+- Create the first release note entry in this section!
 
 - [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).
 
@@ -18,18 +18,10 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- `boot.vesa` has been removed. It was deprecated in 2020 because Xorg now works better with kernel modesetting. If you still need the legacy VESA 800x600 fallback, set `boot.kernelParams = [ "vga=0x317" "nomodeset" ];` directly.
-
-- Support for the legacy U‐Boot image format has been removed from the initrd generators, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
-
-- Python 2 has been removed from the top-level package set, as it is long past end-of-life. The `python2`, `python27`, `python2Full`, `python27Full`, `python2Packages`, and `python27Packages` attributes, along with the legacy `python`, `pythonFull`, and `pythonPackages` aliases, now throw an error directing you to `python3`. The `isPy2` and `isPy27` package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the `resholve` package for its `oil` dependency and is not exposed for general use.
-
-- `services.timesyncd.extraConfig` has been removed in favor of the structured [](#opt-services.timesyncd.settings.Time) option. Use `services.timesyncd.settings.Time` to set any `timesyncd.conf(5)` option directly. For example, replace `services.timesyncd.extraConfig = "PollIntervalMaxSec=180";` with `services.timesyncd.settings.Time.PollIntervalMaxSec = 180;`.
+- Create the first release note entry in this section!
 
 ## Other Notable Changes {#sec-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- `boot.loader.systemd-boot` gained support for [Automatic Boot Assessment](https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT/) via the new [`boot.loader.systemd-boot.bootCounting`](#opt-boot.loader.systemd-boot.bootCounting.enable) options, allowing automatic detection of and recovery from bad NixOS generations. As part of this change, boot loader entries on the ESP/XBOOTLDR partition are now named `nixos-<content-hash>.conf` instead of `nixos-generation-<n>.conf`; existing entries are migrated automatically on the next `nixos-rebuild boot`/`switch`.
-
-- The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.
+- Create the first release note entry in this section!

nixos/lib/systemd-lib.nix

@@ -78,13 +78,16 @@ rec {
         {
           preferLocalBuild = true;
           allowSubstitutes = false;
-          text = unit.text or "";
-          __structuredAttrs = true;
+          # unit.text can be null. But variables that are null listed in
+          # passAsFile are ignored by nix, resulting in no file being created,
+          # making the mv operation fail.
+          text = optionalString (unit.text != null) unit.text;
+          passAsFile = [ "text" ];
         }
         ''
           name=${shellEscape name}
           mkdir -p "$out/$(dirname -- "$name")"
-          printf "%s" "$text" > "$out/$name"
+          mv "$textPath" "$out/$name"
         ''
     else
       pkgs.runCommand "unit-${mkPathSafeName name}-disabled"

nixos/lib/test-driver/default.nix

@@ -11,7 +11,6 @@
   ptpython,
   pydantic,
   python,
-  ovmfvartool,
   remote-pdb,
   ruff,
   ty,
@@ -50,7 +49,6 @@ buildPythonApplication {
     junit-xml
     ptpython
     pydantic
-    ovmfvartool
     remote-pdb
   ]
   ++ extraPythonPackages python.pkgs;

nixos/lib/test-driver/src/test_driver/efi.py

@@ -1,233 +0,0 @@
-import binascii
-import io
-import os.path
-import uuid
-from collections.abc import Generator
-from contextlib import contextmanager
-from pathlib import Path
-from typing import IO, Any, TypeVar
-
-from ovmfvartool import (
-    AuthenticatedVariable,
-    FirmwareVolumeHeader,
-    UEFITime,
-    VariableStoreHeader,
-    resolveUUID,
-)
-
-import test_driver.machine
-from test_driver.errors import RequestedAssertionFailed
-
-EfiVariableT = TypeVar("EfiVariableT", bound="EfiVariable")
-
-# See edk2.git/OvmfPkg/Bhyve/VarStore.fdf.inc
-_NV_FTW_WORKING_OFFSET = 0x41000
-_NV_FTW_WORKING_VALUE = binascii.unhexlify(
-    b"2b29589e687c7d49a0ce6500fd9f1b952caf2c64feffffffe00f000000000000"
-)
-_NV_FTW_SIZE = 0x42000
-_NV_FTW_MAIN_PLUS_SPARE_SIZE = _NV_FTW_SIZE * 2
-
-
-class EfiVariable(AuthenticatedVariable):
-    class Flags:
-        NON_VOLATILE = 0x1
-        BOOTSERVICE_ACCESS = 0x2
-        RUNTIME_ACCESS = 0x4
-        TIME_BASED_AUTHENTICATED_WRITE_ACCESS = 0x20
-
-    class State:
-        VAR_HEADER_VALID_ONLY = 0x7F
-        VAR_ADDED = 0x3F
-
-    volatile = False
-    boot_access = False
-    runtime_access = False
-    hardware_error_record = False
-    authenticated_write_access = False
-    time_based_authenticated_write_access = False
-    append_write = False
-
-    def __init__(
-        self,
-        vendor_uuid: uuid.UUID | None = None,
-        name: str | None = None,
-        data: bytes | None = None,
-        state: int | None = None,
-        flags: int | None = None,
-    ) -> None:
-        self.magic = 0x55AA
-        self.reserved1 = 0
-        self.monotonicCount = 0
-        self.timestamp = UEFITime()
-        self.pubKeyIdx = 0
-        self.state = 0
-        self.flags = 0
-
-        if vendor_uuid is not None:
-            self.vendorUUID = uuid.UUID(bytes=vendor_uuid.bytes_le)
-
-        if state is not None:
-            self.state = state ^ 0xFF
-        else:
-            self.state = (0x40 | 0x80) ^ 0xFF
-
-        if flags is not None:
-            self.flags = flags
-
-        if name is not None:
-            self.name = name
-            self.nameLen = len(name) * 2 + 2
-
-        if data is not None:
-            self.data = data
-            self.dataLen = len(data)
-
-    def _read_flags(self) -> None:
-        if not (self.flags & 0x1):
-            self.volatile = True
-        if self.flags & 0x2:
-            self.boot_access = True
-        if self.flags & 0x4:
-            self.runtime_access = True
-        if self.flags & 0x8:
-            self.hardware_error_record = True
-        if self.flags & 0x10:
-            self.authenticated_write_access = True
-        if self.flags & 0x20:
-            self.time_based_authenticated_write_access = True
-        if self.flags & 0x40:
-            self.append_write = True
-
-        self.flags &= ~(0x1 | 0x2 | 0x4 | 0x8 | 0x10 | 0x20 | 0x40)
-
-    @classmethod
-    def deserialize(cls: type[EfiVariableT], f: Any) -> EfiVariableT | None:
-        # pylint: disable=no-member
-        # false positive https://github.com/PyCQA/pylint/issues/981
-        ret = super().deserialize(f)
-        if ret:
-            ret._read_flags()
-        return ret
-
-    @classmethod
-    def deserializeFromDocument(  # noqa: N802
-        cls: type[EfiVariableT],
-        vendorID: str,  # noqa: N803
-        name: str,
-        doc: dict[str, Any],
-    ) -> EfiVariableT:
-        # pylint: disable=no-member
-        # false positive https://github.com/PyCQA/pylint/issues/981
-        ret = super(cls, cls).deserializeFromDocument(vendorID, name, doc)
-        if ret:
-            ret._read_flags()
-        return ret
-
-
-class EfiVars:
-    """A container around the ovmf variables"""
-
-    state_path: Path
-    machine: "test_driver.machine.QemuMachine"
-
-    def __init__(self, state_path: Path, machine: Any):
-        self.state_path = state_path
-        self.machine = machine
-
-    def _assert_stopped(self) -> None:
-        if self.machine.booted:
-            raise RequestedAssertionFailed(
-                "System is currently running and concurrent reads / writes to the OVMF variables is unsupported"
-            )
-
-    def read_content(self) -> dict[str, dict[str, EfiVariable]] | None:
-        self._assert_stopped()
-        try:
-            with open(self.state_path, "rb") as f:
-                fvh = FirmwareVolumeHeader.deserialize(f)
-                vsh = VariableStoreHeader.deserialize(f)
-                _ = fvh
-                _ = vsh
-                variables: dict[str, dict[str, EfiVariable]] = {}
-
-                while True:
-                    v = EfiVariable.deserialize(f)
-                    if not v:
-                        break
-                    if v.isDeleted:
-                        continue
-
-                    k = resolveUUID(v.vendorUUID)
-                    variables.setdefault(k, {})
-                    variables[k][v.name] = v
-
-                return variables
-
-        except FileNotFoundError:
-            return None
-
-    @contextmanager
-    def _write_store(self, *args, **kwargs) -> Generator[IO[bytes]]:
-        with open(self.state_path, "wb") as fo:
-            fm = io.BytesIO(b"\xff" * _NV_FTW_MAIN_PLUS_SPARE_SIZE)
-            fm.write(FirmwareVolumeHeader.create().serialize())
-            fm.write(VariableStoreHeader.create().serialize())
-
-            try:
-                yield fm
-            finally:
-                fm.seek(_NV_FTW_WORKING_OFFSET)
-                fm.write(_NV_FTW_WORKING_VALUE)
-                fm.seek(0)
-                fo.write(fm.read())
-
-    def create_empty(self) -> None:
-        self._assert_stopped()
-
-        if os.path.exists(self.state_path):
-            raise RequestedAssertionFailed("OVMF variables store exists")
-
-        with self._write_store():
-            pass
-
-    def write(self, add: list[EfiVariable]) -> None:
-        self._assert_stopped()
-
-        variables = self.read_content()
-        if not variables:
-            variables = {}
-
-        for var in add:
-            k = resolveUUID(var.vendorUUID)
-            variables.setdefault(k, {})
-            variables[k][var.name] = var
-
-        with self._write_store() as fm:
-            for _, vendor in variables.items():
-                for _, v in vendor.items():
-                    fm.write(v.serialize())
-                    if fm.tell() % 4:
-                        fm.write(b"\xff" * (4 - (fm.tell() % 4)))
-                    assert (fm.tell() % 4) == 0
-
-
-class EfiGuid:
-    from ovmfvartool import (
-        gEdkiiVarErrorFlagGuid,
-        gEfiAuthenticatedVariableGuid,
-        gEfiCertDbGuid,
-        gEfiCustomModeEnableGuid,
-        gEfiGlobalVariableGuid,
-        gEfiImageSecurityDatabaseGuid,
-        gEfiIp4Config2ProtocolGuid,
-        gEfiIScsiInitiatorNameProtocolGuid,
-        gEfiMemoryTypeInformationGuid,
-        gEfiSecureBootEnableDisableGuid,
-        gEfiSystemNvDataFvGuid,
-        gEfiVendorKeysNvGuid,
-        gIScsiConfigGuid,
-        gMicrosoftVendorGuid,
-        gMtcVendorGuid,
-        mBmHardDriveBootVariableGuid,
-    )

nixos/lib/test-driver/src/test_driver/machine/__init__.py

@@ -22,7 +22,6 @@ from pathlib import Path
 from queue import Queue
 from typing import Any
 
-from test_driver.efi import EfiVariable, EfiVars
 from test_driver.errors import MachineError, RequestedAssertionFailed
 from test_driver.logger import AbstractLogger
 from test_driver.machine.ocr import (
@@ -193,7 +192,6 @@ class QemuStartCommand:
     def build_environment(
         state_dir: Path,
         shared_dir: Path,
-        efi_vars_path: Path | None = None,
     ) -> dict:
         # We make a copy to not update the current environment
         env = dict(os.environ)
@@ -204,13 +202,6 @@ class QemuStartCommand:
                 "USE_TMPDIR": "1",
             }
         )
-        if efi_vars_path is not None:
-            env.update(
-                {
-                    "NIX_EFI_VARS": str(efi_vars_path),
-                }
-            )
-
         return env
 
     def run(
@@ -221,7 +212,6 @@ class QemuStartCommand:
         qmp_socket_path: Path,
         shell_socket_path: Path,
         allow_reboot: bool,
-        efi_vars_path: Path | None = None,
         vsock_guest: Path | None = None,
     ) -> subprocess.Popen:
         return subprocess.Popen(
@@ -237,9 +227,7 @@ class QemuStartCommand:
             stderr=subprocess.STDOUT,
             shell=True,
             cwd=state_dir,
-            env=self.build_environment(
-                state_dir, shared_dir, efi_vars_path=efi_vars_path
-            ),
+            env=self.build_environment(state_dir, shared_dir),
         )
 
 
@@ -762,9 +750,6 @@ class QemuMachine(BaseMachine):
     # Store all console output for full log retrieval
     full_console_log: list[str]
 
-    efi_vars_path: Path
-    efi_vars: EfiVars
-
     def __init__(
         self,
         out_dir: Path,
@@ -806,9 +791,6 @@ class QemuMachine(BaseMachine):
         self.booted = False
         self.connected = False
 
-        self.efi_vars_path = self.state_dir / f"{self.name}-efi-vars.fd"
-        self.efi_vars = EfiVars(self.efi_vars_path, self)
-
     def ssh_backdoor_command(self) -> str:
         assert self.vsock_host is not None
         return f"ssh -o User=root vsock-mux/{self.vsock_host}"
@@ -1049,7 +1031,6 @@ class QemuMachine(BaseMachine):
             As soon as we read some data from the socket here, we assume that
             our root shell is operational.
             """
-            assert self.shell
             (ready, _, _) = select.select([self.shell], [], [], timeout_secs)
             return bool(ready)
 
@@ -1182,25 +1163,24 @@ class QemuMachine(BaseMachine):
         # to match multiline regexes.
         console = io.StringIO()
 
-        def console_matches(_last_try: bool, block: bool = False) -> bool:
+        def console_matches(_last_try: bool) -> bool:
             nonlocal console
             try:
-                while True:
-                    # This will return as soon as possible and
-                    # sleep 1 second.
-                    console.write(self.last_lines.get(block=block))
-                    console.seek(0)
-                    matches = re.search(regex, console.read())
-                    if matches is not None:
-                        return True
+                # This will return as soon as possible and
+                # sleep 1 second.
+                console.write(self.last_lines.get(block=False))
             except queue.Empty:
-                return False
+                pass
+            console.seek(0)
+            matches = re.search(regex, console.read())
+            return matches is not None
 
         with self.nested(f"waiting for {regex} to appear on console"):
             if timeout is not None:
                 retry(console_matches, timeout)
             else:
-                console_matches(False, block=True)
+                while not console_matches(False):
+                    pass
 
     def get_console_log(self) -> str:
         """
@@ -1267,7 +1247,6 @@ class QemuMachine(BaseMachine):
             self.qmp_path,
             self.shell_path,
             allow_reboot,
-            self.efi_vars_path,
             self.vsock_guest,
         )
 
@@ -1452,28 +1431,6 @@ class QemuMachine(BaseMachine):
         self.connected = False
         self.connect()
 
-    def dump_efi_vars(self) -> None:
-        for var in self.read_efi_vars():
-            var.print()
-
-    def read_efi_vars(self) -> list[EfiVariable]:
-        config = self.efi_vars.read_content()
-        if not config:
-            return []
-
-        out = []
-        for vendor, variables in config.items():
-            for name, v in variables.items():
-                out.append(v)
-
-        return out
-
-    def create_efi_vars(self) -> None:
-        self.efi_vars.create_empty()
-
-    def write_efi_vars(self, add: list[EfiVariable]) -> None:
-        self.efi_vars.write(add)
-
 
 class NspawnMachine(BaseMachine):
     """

nixos/lib/testing/driver.nix

@@ -5,12 +5,7 @@
   ...
 }:
 let
-  inherit (lib)
-    mkOption
-    types
-    literalExpression
-    literalMD
-    ;
+  inherit (lib) mkOption types literalMD;
 
   inherit (config) sshBackdoor;
 
@@ -122,10 +117,9 @@ in
 {
   options = {
     pythonTestDriverPackage = mkOption {
-      description = "Package containing the python NixOS test driver implementation";
+      description = "Package containing the python NixOS test driver implemetnation";
       type = types.package;
       default = hostPkgs.nixos-test-driver;
-      defaultText = literalExpression "hostPkgs.nixos-test-driver";
       readOnly = true;
     };
 

nixos/modules/config/console.nix

@@ -217,7 +217,7 @@ in
           # When imperative, seed /etc/vconsole.conf on first boot from declared
           # defaults so the keymap isn't lost before localectl is ever used
           systemd.tmpfiles.rules = lib.mkIf i18nCfg.imperativeLocale [
-            "C /etc/vconsole.conf - - - - ${vconsoleConf true}"
+            "C /etc/vconsole.conf - - - - ${vconsoleConf}"
           ];
 
           systemd.services.reload-systemd-vconsole-setup = {

nixos/modules/config/nix-channel.nix

@@ -6,16 +6,12 @@
   - ./nix.nix
   - ./nix-flakes.nix
 */
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
+{ config, lib, ... }:
 let
   inherit (lib)
     mkIf
     mkOption
+    stringAfter
     types
     ;
 
@@ -74,7 +70,7 @@ in
       defaultChannel = mkOption {
         internal = true;
         type = types.str;
-        default = "https://channels.nixos.org/nixos-unstable";
+        default = "https://channels.nixos.org/nixos-26.05";
         description = "Default NixOS channel to which the root user is subscribed.";
       };
     };
@@ -102,10 +98,8 @@ in
       ''f /root/.nix-channels - - - - ${config.system.defaultChannel} nixos\n''
     ];
 
-    system.preSwitchChecks.no-nix-channel = mkIf (!cfg.channel.enable) (
-      lib.replaceStrings [ "@getent@" ] [ (lib.getExe pkgs.getent) ] (
-        builtins.readFile ./nix-channel/pre-switch-check.sh
-      )
+    system.activationScripts.no-nix-channel = mkIf (!cfg.channel.enable) (
+      stringAfter [ "etc" "users" ] (builtins.readFile ./nix-channel/activation-check.sh)
     );
   };
 }

nixos/modules/config/nix-channel/activation-check.sh

@@ -1,6 +1,4 @@
-warn() {
-    printf "\033[1;35mwarning:\033[0m %s\n" "$*" >&2
-}
+# shellcheck shell=bash
 
 explainChannelWarning=0
 if [[ -e "/root/.nix-defexpr/channels" ]]; then
@@ -13,13 +11,11 @@ if [[ -e "/nix/var/nix/profiles/per-user/root/channels" ]]; then
 fi
 while IFS=: read -r _ _ _ _ _ home _ ; do
     if [[ -n  "$home" && -e "$home/.nix-defexpr/channels" ]]; then
-        warn "$home/.nix-defexpr/channels exists, but channels have been disabled."
+        warn "$home/.nix-defexpr/channels exists, but channels have been disabled." 1>&2
         explainChannelWarning=1
     fi
-done < <(@getent@ passwd)
+done < <(getent passwd)
 if [[ $explainChannelWarning -eq 1 ]]; then
-    echo "Due to https://github.com/NixOS/nix/issues/9574, Nix may still use these channels when NIX_PATH is unset." >&2
-    echo "Delete the above directory or directories to prevent this." >&2
+    echo "Due to https://github.com/NixOS/nix/issues/9574, Nix may still use these channels when NIX_PATH is unset." 1>&2
+    echo "Delete the above directory or directories to prevent this." 1>&2
 fi
-# This check is informational only and must never block a switch.
-true

nixos/modules/config/nix-channel/test.nix

@@ -0,0 +1,20 @@
+# Run:
+#   nix-build -A nixosTests.nix-channel
+{ lib, testers }:
+let
+  inherit (lib) fileset;
+
+  runShellcheck = testers.shellcheck {
+    name = "activation-check";
+    src = fileset.toSource {
+      root = ./.;
+      fileset = fileset.unions [
+        ./activation-check.sh
+      ];
+    };
+  };
+
+in
+lib.recurseIntoAttrs {
+  inherit runShellcheck;
+}

nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-plasma6.nix

@@ -36,22 +36,25 @@
   # Avoid bundling an entire MariaDB installation on the ISO.
   programs.kde-pim.enable = false;
 
-  systemd.tmpfiles.settings."10-installer-desktop" =
+  system.activationScripts.installerDesktop =
     let
+
       # Comes from documentation.nix when xserver and nixos.enable are true.
       manualDesktopFile = "/run/current-system/sw/share/applications/nixos-manual.desktop";
+
+      homeDir = "/home/nixos/";
+      desktopDir = homeDir + "Desktop/";
+
     in
-    {
-      "/home/nixos/Desktop".d = {
-        user = "nixos";
-        group = "users";
-        mode = "0755";
-      };
-      "/home/nixos/Desktop/nixos-manual.desktop"."L+".argument = manualDesktopFile;
-      "/home/nixos/Desktop/gparted.desktop"."L+".argument =
-        "${pkgs.gparted}/share/applications/gparted.desktop";
-      "/home/nixos/Desktop/calamares.desktop"."L+".argument =
-        "${pkgs.calamares-nixos}/share/applications/calamares.desktop";
-    };
+    ''
+      mkdir -p ${desktopDir}
+      chown nixos ${homeDir} ${desktopDir}
+
+      ln -sfT ${manualDesktopFile} ${desktopDir + "nixos-manual.desktop"}
+      ln -sfT ${pkgs.gparted}/share/applications/gparted.desktop ${desktopDir + "gparted.desktop"}
+      ln -sfT ${pkgs.calamares-nixos}/share/applications/calamares.desktop ${
+        desktopDir + "calamares.desktop"
+      }
+    '';
 
 }

nixos/modules/installer/tools/nixos-generate-config.pl

@@ -505,7 +505,7 @@ EOF
     # This should work for single and multi-device systems.
     # still needs subvolume support
     if ($fsType eq "bcachefs") {
-        my ($status, @info) = runCommand("@bcachefs@ fs usage $rootDir$mountPoint");
+        my ($status, @info) = runCommand("bcachefs fs usage $rootDir$mountPoint");
         my $UUID = $info[0];
 
         if ($status == 0 && $UUID =~ /^Filesystem:[ \t\n]*([0-9a-z-]+)/) {

nixos/modules/installer/tools/tools.nix

@@ -30,20 +30,15 @@ let
     name = "nixos-generate-config";
     src = ./nixos-generate-config.pl;
     replacements = {
-      perl = lib.getExe (
+      perl = "${
         pkgs.perl.withPackages (p: [
           p.FileSlurp
           p.ConfigIniFiles
         ])
-      );
+      }/bin/perl";
       hostPlatformSystem = pkgs.stdenv.hostPlatform.system;
-      detectvirt = lib.getExe' config.systemd.package "systemd-detect-virt";
-      bcachefs =
-        if pkgs.bcachefs-tools.meta.broken then
-          lib.getExe' pkgs.coreutils "false"
-        else
-          lib.getExe pkgs.bcachefs-tools;
-      btrfs = lib.getExe pkgs.btrfs-progs;
+      detectvirt = "${config.systemd.package}/bin/systemd-detect-virt";
+      btrfs = "${pkgs.btrfs-progs}/bin/btrfs";
       inherit (config.system.nixos-generate-config) configuration desktopConfiguration flake;
       xserverEnabled = config.services.xserver.enable;
     };
@@ -319,27 +314,6 @@ in
         name = "nixos-rebuild";
         package = config.system.build.nixos-rebuild;
       })
-      (
-        { config, ... }:
-        {
-          options.system.tools.nixos-rebuild.enableRun0Elevation = lib.mkEnableOption ''
-            support for being targeted by `nixos-rebuild --elevate=run0
-            --ask-elevate-password`.
-
-            This enables polkit and adds {command}`polkit-stdin-agent` to
-            {option}`environment.systemPackages` so that a deploying host
-            can find a target-architecture agent at
-            {file}`<toplevel>/sw/bin/polkit-stdin-agent` after copying the
-            closure (which is required for cross-architecture deploys and
-            mismatched nixpkgs revisions to work).
-          '';
-
-          config = lib.mkIf config.system.tools.nixos-rebuild.enableRun0Elevation {
-            security.polkit.enable = lib.mkDefault true;
-            environment.systemPackages = [ pkgs.polkit-stdin-agent ];
-          };
-        }
-      )
       (mkToolModule {
         name = "nixos-version";
         package = nixos-version;

nixos/modules/misc/version.nix

@@ -51,6 +51,7 @@ let
       VENDOR_URL = optionalString isNixos "https://nixos.org/";
       DOCUMENTATION_URL = optionalString isNixos "https://nixos.org/learn.html";
       SUPPORT_URL = optionalString isNixos "https://nixos.org/community.html";
+      SUPPORT_END = "2026-12-31";
       BUG_REPORT_URL = optionalString isNixos "https://github.com/NixOS/nixpkgs/issues";
       ANSI_COLOR = optionalString isNixos "0;38;2;126;186;228";
       IMAGE_ID = optionalString (config.system.image.id != null) config.system.image.id;

nixos/modules/module-list.nix

@@ -394,6 +394,7 @@
   ./security/ca.nix
   ./security/chromium-suid-sandbox.nix
   ./security/default.nix
+  ./security/dhparams.nix
   ./security/doas.nix
   ./security/duosec.nix
   ./security/google_oslogin.nix
@@ -732,7 +733,6 @@
   ./services/home-automation/home-assistant.nix
   ./services/home-automation/homebridge.nix
   ./services/home-automation/matter-server.nix
-  ./services/home-automation/matterjs-server.nix
   ./services/home-automation/openthread-border-router.nix
   ./services/home-automation/wyoming/faster-whisper.nix
   ./services/home-automation/wyoming/openwakeword.nix
@@ -887,7 +887,6 @@
   ./services/misc/ihaskell.nix
   ./services/misc/iio-niri.nix
   ./services/misc/input-remapper.nix
-  ./services/misc/inventree.nix
   ./services/misc/invidious-router.nix
   ./services/misc/irkerd.nix
   ./services/misc/jackett.nix
@@ -1794,7 +1793,6 @@
   ./services/web-apps/suwayomi-server.nix
   ./services/web-apps/szurubooru.nix
   ./services/web-apps/tabbyapi.nix
-  ./services/web-apps/tranquil-pds.nix
   ./services/web-apps/trilium.nix
   ./services/web-apps/tt-rss.nix
   ./services/web-apps/tuliprox.nix

nixos/modules/programs/gamemode.nix

@@ -15,8 +15,6 @@ in
     programs.gamemode = {
       enable = lib.mkEnableOption "GameMode to optimise system performance on demand";
 
-      package = lib.mkPackageOption pkgs "gamemode" { };
-
       enableRenice =
         lib.mkEnableOption "CAP_SYS_NICE on gamemoded to support lowering process niceness"
         // {
@@ -55,7 +53,7 @@ in
 
   config = lib.mkIf cfg.enable {
     environment = {
-      systemPackages = [ cfg.package ];
+      systemPackages = [ pkgs.gamemode ];
       etc."gamemode.ini".source = configFile;
     };
 
@@ -65,14 +63,14 @@ in
         gamemoded = {
           owner = "root";
           group = "root";
-          source = "${cfg.package}/bin/gamemoded";
+          source = "${pkgs.gamemode}/bin/gamemoded";
           capabilities = "cap_sys_nice+ep";
         };
       };
     };
 
     systemd = {
-      packages = [ cfg.package ];
+      packages = [ pkgs.gamemode ];
       user.services.gamemoded = {
         # Use pkexec from the security wrappers to allow users to
         # run libexec/cpugovctl & libexec/gpuclockctl as root with

nixos/modules/programs/gamescope.nix

@@ -26,8 +26,6 @@ in
 
     package = lib.mkPackageOption pkgs "gamescope" { };
 
-    enableWsi = lib.mkEnableOption "gamescope-wsi, the Vulkan WSI layer, alongside gamescope";
-
     capSysNice = lib.mkOption {
       type = lib.types.bool;
       default = false;
@@ -78,11 +76,6 @@ in
     };
 
     environment.systemPackages = lib.mkIf (!cfg.capSysNice) [ gamescope ];
-
-    hardware.graphics = lib.optionalAttrs cfg.enableWsi {
-      extraPackages = with pkgs; [ gamescope-wsi ];
-      extraPackages32 = with pkgs; [ pkgsi686Linux.gamescope-wsi ];
-    };
   };
 
   meta.maintainers = [ ];

nixos/modules/programs/shadow.nix

@@ -267,22 +267,13 @@ in
             group = "root";
             inherit source;
           };
-          mkCapRoot = capabilities: source: {
-            inherit capabilities source;
-            owner = "root";
-            group = "root";
-          };
         in
         {
           su = mkSetuidRoot "${config.security.shadow.su.package}/bin/su";
           sg = mkSetuidRoot "${cfg.package.out}/bin/sg";
           newgrp = mkSetuidRoot "${cfg.package.out}/bin/newgrp";
-          # File capabilities instead of setuid root, mirroring shadow's
-          # own --with-fcaps install mode and what Arch/Fedora/Debian ship.
-          # The kernel only requires CAP_SETUID/CAP_SETGID over the parent
-          # userns to write a multi-line /proc/<pid>/[ug]id_map.
-          newuidmap = mkCapRoot "cap_setuid+ep" "${cfg.package.out}/bin/newuidmap";
-          newgidmap = mkCapRoot "cap_setgid+ep" "${cfg.package.out}/bin/newgidmap";
+          newuidmap = mkSetuidRoot "${cfg.package.out}/bin/newuidmap";
+          newgidmap = mkSetuidRoot "${cfg.package.out}/bin/newgidmap";
         }
         // lib.optionalAttrs config.users.mutableUsers {
           chsh = mkSetuidRoot "${cfg.package.out}/bin/chsh";

nixos/modules/programs/steam.nix

@@ -56,29 +56,38 @@ in
       '';
       apply =
         steam:
-        steam.override (prev: {
-          extraEnv =
-            (lib.optionalAttrs (cfg.extraCompatPackages != [ ]) {
-              STEAM_EXTRA_COMPAT_TOOLS_PATHS = extraCompatPaths;
-            })
-            // (lib.optionalAttrs cfg.extest.enable {
-              LD_PRELOAD = "${pkgs.pkgsi686Linux.extest}/lib/libextest.so";
-            })
-            // (prev.extraEnv or { });
-          extraLibraries =
-            pkgs:
-            let
-              prevLibs = if prev ? extraLibraries then prev.extraLibraries pkgs else [ ];
-              additionalLibs =
-                with config.hardware.graphics;
-                if pkgs.stdenv.hostPlatform.is64bit then
-                  [ package ] ++ extraPackages
-                else
-                  [ package32 ] ++ extraPackages32;
-            in
-            prevLibs ++ additionalLibs;
-          extraPkgs = p: (cfg.extraPackages ++ lib.optionals (prev ? extraPkgs) (prev.extraPkgs p));
-        });
+        steam.override (
+          prev:
+          {
+            extraEnv =
+              (lib.optionalAttrs (cfg.extraCompatPackages != [ ]) {
+                STEAM_EXTRA_COMPAT_TOOLS_PATHS = extraCompatPaths;
+              })
+              // (lib.optionalAttrs cfg.extest.enable {
+                LD_PRELOAD = "${pkgs.pkgsi686Linux.extest}/lib/libextest.so";
+              })
+              // (prev.extraEnv or { });
+            extraLibraries =
+              pkgs:
+              let
+                prevLibs = if prev ? extraLibraries then prev.extraLibraries pkgs else [ ];
+                additionalLibs =
+                  with config.hardware.graphics;
+                  if pkgs.stdenv.hostPlatform.is64bit then
+                    [ package ] ++ extraPackages
+                  else
+                    [ package32 ] ++ extraPackages32;
+              in
+              prevLibs ++ additionalLibs;
+            extraPkgs = p: (cfg.extraPackages ++ lib.optionals (prev ? extraPkgs) (prev.extraPkgs p));
+          }
+          // lib.optionalAttrs (cfg.gamescopeSession.enable && gamescopeCfg.capSysNice) {
+            buildFHSEnv = pkgs.buildFHSEnv.override {
+              # use the setuid wrapped bubblewrap
+              bubblewrap = "${config.security.wrapperDir}/..";
+            };
+          }
+        );
       description = ''
         The Steam package to use. Additional libraries are added from the system
         configuration to ensure graphics work properly.
@@ -209,6 +218,16 @@ in
       enable32Bit = true;
     };
 
+    security.wrappers = lib.mkIf (cfg.gamescopeSession.enable && gamescopeCfg.capSysNice) {
+      # needed or steam fails
+      bwrap = {
+        owner = "root";
+        group = "root";
+        source = "${pkgs.bubblewrap}/bin/bwrap";
+        setuid = true;
+      };
+    };
+
     programs.steam.extraPackages = cfg.fontPackages;
 
     programs.gamescope.enable = lib.mkDefault cfg.gamescopeSession.enable;

nixos/modules/programs/throne.nix

@@ -23,7 +23,7 @@ in
         enable = lib.mkEnableOption "TUN mode of Throne";
 
         setuid = lib.mkEnableOption ''
-          setting suid bit for ThroneCore to run as root, which is less
+          setting suid bit for throne-core to run as root, which is less
           secure than default setcap method but closer to upstream assumptions.
           Enable this if you find the default setcap method configured in
           this module doesn't work for you
@@ -36,8 +36,8 @@ in
 
     environment.systemPackages = [ cfg.package ];
 
-    security.wrappers."ThroneCore" = lib.mkIf cfg.tunMode.enable {
-      source = "${cfg.package}/share/throne/ThroneCore";
+    security.wrappers.throne-core = lib.mkIf cfg.tunMode.enable {
+      source = "${cfg.package}/share/throne/Core";
       owner = "root";
       group = "root";
       setuid = lib.mkIf cfg.tunMode.setuid true;
@@ -49,7 +49,7 @@ in
 
     # avoid resolvectl password prompt popping up three times
     # https://github.com/SagerNet/sing-tun/blob/0686f8c4f210f4e7039c352d42d762252f9d9cf5/tun_linux.go#L1062
-    # We use a hack here to determine whether the requested process is ThroneCore
+    # We use a hack here to determine whether the requested process is throne-core
     # Detect whether its capabilities contain at least `net_admin` and `net_raw`.
     # This does not reduce security, as we can already bypass `resolved` with them.
     # Alternatives to consider:
@@ -61,7 +61,7 @@ in
     #    change its own cmdline. `/proc/<pid>/exe` is reliable but kernel forbids
     #    checking that entry of process from different users, and polkit runs `spawn`
     #    as an unprivileged user.
-    # 3. Put ThroneCore into a systemd service, and let polkit check service name.
+    # 3. Put throne-core into a systemd service, and let polkit check service name.
     #    This is the most secure and convenient way but requires heavy modification
     #    to Throne source code. Would be good to let upstream support that eventually.
     security.polkit.extraConfig =
@@ -69,7 +69,6 @@ in
         ''
           polkit.addRule(function(action, subject) {
             const allowedActionIds = [
-              "org.freedesktop.resolve1.revert",
               "org.freedesktop.resolve1.set-domains",
               "org.freedesktop.resolve1.set-default-route",
               "org.freedesktop.resolve1.set-dns-servers"

nixos/modules/programs/zsh/zsh.nix

@@ -249,8 +249,8 @@ in
         setopt ${builtins.concatStringsSep " " cfg.setOptions}
       ''}
 
-      # Determine current fqdn hostname
-      HOST=$(hostname --fqdn)
+      # Alternative method of determining short and full hostname.
+      HOST=${config.networking.fqdnOrHostName}
 
       # Setup command line history.
       # Don't export these, otherwise other shells (bash) will try to use same HISTFILE.

nixos/modules/rename.nix

@@ -125,9 +125,6 @@ in
     (mkRemovedOptionModule [ "programs" "yabar" ]
       "programs.yabar has been removed from NixOS. This is because the yabar repository has been archived upstream."
     )
-    (mkRemovedOptionModule [ "security" "dhparams" ] ''
-      The security.dhparams module has been removed as RFC 7919 has shown that generating your own params is problematic.
-    '')
     (mkRemovedOptionModule [ "security" "hideProcessInformation" ] ''
       The hidepid module was removed, since the underlying machinery
       is broken when using cgroups-v2.

nixos/modules/security/dhparams.nix

@@ -0,0 +1,223 @@
+{
+  config,
+  lib,
+  options,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib) literalExpression mkOption types;
+  cfg = config.security.dhparams;
+  opt = options.security.dhparams;
+
+  bitType = types.addCheck types.int (b: b >= 16) // {
+    name = "bits";
+    description = "integer of at least 16 bits";
+  };
+
+  paramsSubmodule =
+    { name, config, ... }:
+    {
+      options.bits = mkOption {
+        type = bitType;
+        default = cfg.defaultBitSize;
+        defaultText = literalExpression "config.${opt.defaultBitSize}";
+        description = ''
+          The bit size for the prime that is used during a Diffie-Hellman
+          key exchange.
+        '';
+      };
+
+      options.path = mkOption {
+        type = types.path;
+        readOnly = true;
+        description = ''
+          The resulting path of the generated Diffie-Hellman parameters
+          file for other services to reference. This could be either a
+          store path or a file inside the directory specified by
+          {option}`security.dhparams.path`.
+        '';
+      };
+
+      config.path =
+        let
+          generated = pkgs.runCommand "dhparams-${name}.pem" {
+            nativeBuildInputs = [ pkgs.openssl ];
+          } "openssl dhparam -out \"$out\" ${toString config.bits}";
+        in
+        if cfg.stateful then "${cfg.path}/${name}.pem" else generated;
+    };
+
+in
+{
+  options = {
+    security.dhparams = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to generate new DH params and clean up old DH params.
+        '';
+      };
+
+      params = mkOption {
+        type =
+          with types;
+          let
+            coerce = bits: { inherit bits; };
+          in
+          attrsOf (coercedTo int coerce (submodule paramsSubmodule));
+        default = { };
+        example = lib.literalExpression "{ nginx.bits = 3072; }";
+        description = ''
+          Diffie-Hellman parameters to generate.
+
+          The value is the size (in bits) of the DH params to generate. The
+          generated DH params path can be found in
+          `config.security.dhparams.params.«name».path`.
+
+          ::: {.note}
+          The name of the DH params is taken as being the name of
+          the service it serves and the params will be generated before the
+          said service is started.
+          :::
+
+          ::: {.warning}
+          If you are removing all dhparams from this list, you
+          have to leave {option}`security.dhparams.enable` for at
+          least one activation in order to have them be cleaned up. This also
+          means if you rollback to a version without any dhparams the
+          existing ones won't be cleaned up. Of course this only applies if
+          {option}`security.dhparams.stateful` is
+          `true`.
+          :::
+
+          ::: {.note}
+          **For module implementers:** It's recommended
+          to not set a specific bit size here, so that users can easily
+          override this by setting
+          {option}`security.dhparams.defaultBitSize`.
+          :::
+        '';
+      };
+
+      stateful = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether generation of Diffie-Hellman parameters should be stateful or
+          not. If this is enabled, PEM-encoded files for Diffie-Hellman
+          parameters are placed in the directory specified by
+          {option}`security.dhparams.path`. Otherwise the files are
+          created within the Nix store.
+
+          ::: {.note}
+          If this is `false` the resulting store
+          path will be non-deterministic and will be rebuilt every time the
+          `openssl` package changes.
+          :::
+        '';
+      };
+
+      defaultBitSize = mkOption {
+        type = bitType;
+        default = 2048;
+        description = ''
+          This allows to override the default bit size for all of the
+          Diffie-Hellman parameters set in
+          {option}`security.dhparams.params`.
+        '';
+      };
+
+      path = mkOption {
+        type = types.str;
+        default = "/var/lib/dhparams";
+        description = ''
+          Path to the directory in which Diffie-Hellman parameters will be
+          stored. This only is relevant if
+          {option}`security.dhparams.stateful` is
+          `true`.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
+      warnings = [
+        ''
+          The `security.dhparams` module is deprecated and scheduled for removal in NixOS 26.11.
+          Generating your own params has been shown to be problematic in RFC 7919 (2016).
+
+          Remove any uses of DHE and migrate to ECDHE (RFC 8422, 2018) and
+          Hybrid PQ (draft-ietf-tls-ecdhe-mlkem, 2026) key exchange algorithms.
+        ''
+      ];
+    })
+    (lib.mkIf (cfg.enable && cfg.stateful) {
+      systemd.services = {
+        dhparams-init = {
+          description = "Clean Up Old Diffie-Hellman Parameters";
+
+          # Clean up even when no DH params is set
+          wantedBy = [ "multi-user.target" ];
+
+          serviceConfig.RemainAfterExit = true;
+          serviceConfig.Type = "oneshot";
+
+          script = ''
+            if [ ! -d ${cfg.path} ]; then
+              mkdir -p ${cfg.path}
+            fi
+
+            # Remove old dhparams
+            for file in ${cfg.path}/*; do
+              if [ ! -f "$file" ]; then
+                continue
+              fi
+              ${lib.concatStrings (
+                lib.mapAttrsToList (
+                  name:
+                  { bits, path, ... }:
+                  ''
+                    if [ "$file" = ${lib.escapeShellArg path} ] && \
+                       ${pkgs.openssl}/bin/openssl dhparam -in "$file" -text \
+                       | head -n 1 | grep "(${toString bits} bit)" > /dev/null; then
+                      continue
+                    fi
+                  ''
+                ) cfg.params
+              )}
+              rm "$file"
+            done
+
+            # TODO: Ideally this would be removing the *former* cfg.path, though
+            # this does not seem really important as changes to it are quite
+            # unlikely
+            rmdir --ignore-fail-on-non-empty ${cfg.path}
+          '';
+        };
+      }
+      // lib.mapAttrs' (
+        name:
+        { bits, path, ... }:
+        lib.nameValuePair "dhparams-gen-${name}" {
+          description = "Generate Diffie-Hellman Parameters for ${name}";
+          after = [ "dhparams-init.service" ];
+          before = [ "${name}.service" ];
+          requiredBy = [ "${name}.service" ];
+          wantedBy = [ "multi-user.target" ];
+          unitConfig.ConditionPathExists = "!${path}";
+          serviceConfig.Type = "oneshot";
+          script = ''
+            mkdir -p ${lib.escapeShellArg cfg.path}
+            ${pkgs.openssl}/bin/openssl dhparam -out ${lib.escapeShellArg path} \
+              ${toString bits}
+          '';
+        }
+      ) cfg.params;
+    })
+  ];
+
+}

nixos/modules/security/pam.nix

@@ -8,21 +8,6 @@
   ...
 }:
 let
-  inherit (lib)
-    attrNames
-    catAttrs
-    concatLines
-    concatMap
-    filter
-    unique
-    flip
-    elem
-    attrValues
-    concatMapStrings
-    hasPrefix
-    concatStringsSep
-    sort
-    ;
 
   moduleSettingsType =
     with lib.types;
@@ -896,30 +881,41 @@ let
 
         text =
           let
+            ensureUniqueOrder =
+              type: rules:
+              let
+                checkPair =
+                  a: b:
+                  assert lib.assertMsg (a.order != b.order)
+                    "security.pam.services.${name}.rules.${type}: rules '${a.name}' and '${b.name}' cannot have the same order value (${toString a.order})";
+                  b;
+                checked = lib.zipListsWith checkPair rules (lib.drop 1 rules);
+              in
+              lib.take 1 rules ++ checked;
             # Formats a string for use in `module-arguments`. See `man pam.conf`.
             formatModuleArgument =
               token: if lib.hasInfix " " token then "[${lib.replaceStrings [ "]" ] [ "\\]" ] token}]" else token;
-
             formatRules =
               type:
-              concatStringsSep "\n" (
-                map
-                  (
-                    rule:
-                    "${type} ${rule.control} ${rule.modulePath}${
-                      if rule.args == [ ] then "" else " " + concatStringsSep " " (map formatModuleArgument rule.args)
-                    } # ${rule.name} (order ${toString rule.order})"
+              lib.pipe cfg.rules.${type} [
+                lib.attrValues
+                (lib.filter (rule: rule.enable))
+                (lib.sort (a: b: a.order < b.order))
+                (ensureUniqueOrder type)
+                (map (
+                  rule:
+                  lib.concatStringsSep " " (
+                    [
+                      type
+                      rule.control
+                      rule.modulePath
+                    ]
+                    ++ map formatModuleArgument rule.args
+                    ++ [ "# ${rule.name} (order ${toString rule.order})" ]
                   )
-                  (
-                    sort (
-                      a: b:
-                      if a.order != b.order then
-                        a.order < b.order
-                      else
-                        throw "security.pam.services.${name}.rules.${type}: rules '${a.name}' and '${b.name}' cannot have the same order value (${toString a.order})"
-                    ) (filter (rule: rule.enable) (attrValues cfg.rules.${type}))
-                  )
-              );
+                ))
+                (lib.concatStringsSep "\n")
+              ];
           in
           lib.mkDefault ''
             # Account management.
@@ -2641,29 +2637,35 @@ in
     };
 
     security.apparmor.includes."abstractions/pam" =
-      concatMapStrings (name: "r ${config.environment.etc."pam.d/${name}".source},\n") (
-        attrNames enabledServices
+      lib.concatMapStrings (name: "r ${config.environment.etc."pam.d/${name}".source},\n") (
+        lib.attrNames enabledServices
       )
       + (
-        let
-          types = concatMap attrValues (catAttrs "rules" (attrValues enabledServices));
-          rules = concatMap attrValues types;
-
-          isDirect = flip elem [
-            "include"
-            "substack"
-          ];
-          activeRules = filter (rule: rule.enable && !isDirect rule.control) rules;
-
-          modulePaths = concatMap (
+        with lib;
+        pipe enabledServices [
+          lib.attrValues
+          (catAttrs "rules")
+          (lib.concatMap lib.attrValues)
+          (lib.concatMap lib.attrValues)
+          (lib.filter (rule: rule.enable))
+          (lib.filter (
             rule:
-            if (!hasPrefix "/" rule.modulePath) then
-              throw ''non-absolute PAM modulePath "${rule.modulePath}" is unsupported by apparmor''
-            else
-              [ rule.modulePath ]
-          ) activeRules;
-        in
-        concatLines (map (module: "mr ${module},") (unique modulePaths))
+            !builtins.elem rule.control [
+              "include"
+              "substack"
+            ]
+          ))
+          (lib.catAttrs "modulePath")
+          (map (
+            modulePath:
+            lib.throwIfNot (lib.hasPrefix "/" modulePath)
+              ''non-absolute PAM modulePath "${modulePath}" is unsupported by apparmor''
+              modulePath
+          ))
+          lib.unique
+          (map (module: "mr ${module},"))
+          concatLines
+        ]
       );
 
     security.sudo.extraConfig = optionalSudoConfigForSSHAgentAuth;

nixos/modules/security/pam_mount.nix

@@ -179,10 +179,10 @@ in
           }" />
           <!-- specify the binaries to be called -->
           <!-- the comma in front of the options is necessary for empty options -->
-          <fusemount>${pkgs.fuse3}/bin/mount.fuse3 %(VOLUME) %(MNTPT) -o ,${
+          <fusemount>${pkgs.fuse}/bin/mount.fuse %(VOLUME) %(MNTPT) -o ,${
             lib.concatStringsSep "," (cfg.fuseMountOptions ++ [ "%(OPTIONS)" ])
           }'</fusemount>
-          <fuseumount>${pkgs.fuse3}/bin/fusermount3 -u %(MNTPT)</fuseumount>
+          <fuseumount>${pkgs.fuse}/bin/fusermount -u %(MNTPT)</fuseumount>
           <!-- the comma in front of the options is necessary for empty options -->
           <cryptmount>${pkgs.pam_mount}/bin/mount.crypt -o ,${
             lib.concatStringsSep "," (cfg.cryptMountOptions ++ [ "%(OPTIONS)" ])

nixos/modules/security/wrappers/default.nix

@@ -181,23 +181,8 @@ in
   ###### interface
 
   options = {
-    security.enableWrappers = lib.mkEnableOption "" // {
+    security.enableWrappers = lib.mkEnableOption "SUID/SGID wrappers" // {
       default = true;
-      description = ''
-        Whether to enable SUID/SGID wrappers.
-
-        ::: {.warning}
-        ONLY DISABLE THIS OPTION IF YOU KNOW WHAT YOU'RE DOING.
-        :::
-
-        A normal interactive NixOS system requires SUID/SGID wrappers (e.g. for
-        PAM and sudo). Disabling them, thus will lock you out from your system.
-
-        Disabling the SUID/SGID binaries is useful for non-interactive systems
-        (like a firewall appliance) to minimize the attack surface. In the
-        future, this might become available for interactive systems as well
-        (e.g. with systemd's [run0](https://www.freedesktop.org/software/systemd/man/latest/run0)).
-      '';
     };
 
     security.wrappers = lib.mkOption {

nixos/modules/services/continuous-integration/gitlab-runner/runner.nix

@@ -189,15 +189,11 @@ let
                         [ "--docker-image ${service.dockerImage}" ]
                         ++ optional service.dockerDisableCache "--docker-disable-cache"
                         ++ optional service.dockerPrivileged "--docker-privileged"
-                        ++ optional service.dockerServicesPrivileged "--docker-services_privileged true"
                         ++ optional (service.dockerPullPolicy != null) "--docker-pull-policy ${service.dockerPullPolicy}"
                         ++ map (v: "--docker-volumes ${escapeShellArg v}") service.dockerVolumes
                         ++ map (v: "--docker-extra-hosts ${escapeShellArg v}") service.dockerExtraHosts
                         ++ map (v: "--docker-allowed-images ${escapeShellArg v}") service.dockerAllowedImages
                         ++ map (v: "--docker-allowed-services ${escapeShellArg v}") service.dockerAllowedServices
-                        ++ map (
-                          v: "--docker-allowed-privileged-services ${escapeShellArg v}"
-                        ) service.dockerAllowedPrivilegedServices
                       )
                     )
                   )
@@ -525,13 +521,6 @@ in
                 Give extended privileges to container.
               '';
             };
-            dockerServicesPrivileged = mkOption {
-              type = types.bool;
-              default = false;
-              description = ''
-                Give extended privileges to services.
-              '';
-            };
             dockerExtraHosts = mkOption {
               type = types.listOf types.str;
               default = [ ];
@@ -565,19 +554,6 @@ in
                 Whitelist allowed services.
               '';
             };
-            dockerAllowedPrivilegedServices = mkOption {
-              type = types.listOf types.str;
-              default = [ ];
-              example = [
-                "docker.io/library/docker:*-dind-rootless"
-                "docker.io/library/docker:dind-rootless"
-                "docker:*-dind-rootless"
-                "docker:dind-rootless"
-              ];
-              description = ''
-                Whitelist allowed privileged services.
-              '';
-            };
             preGetSourcesScript = mkOption {
               type = types.nullOr (types.either types.str types.path);
               default = null;

nixos/modules/services/development/gemstash.nix

@@ -36,8 +36,6 @@ in
       '';
     };
 
-    package = lib.mkPackageOption pkgs "gemstash" { };
-
     settings = lib.mkOption {
       default = { };
       description = ''
@@ -98,7 +96,7 @@ in
       after = [ "network.target" ];
       serviceConfig = lib.mkMerge [
         {
-          ExecStart = "${lib.getExe cfg.package} start --no-daemonize --config-file ${settingsFormat.generate "gemstash.yaml" (prefixColon cfg.settings)}";
+          ExecStart = "${pkgs.gemstash}/bin/gemstash start --no-daemonize --config-file ${settingsFormat.generate "gemstash.yaml" (prefixColon cfg.settings)}";
           NoNewPrivileges = true;
           User = "gemstash";
           Group = "gemstash";

nixos/modules/services/display-managers/cosmic-greeter.nix

@@ -26,7 +26,6 @@ in
   config = lib.mkIf cfg.enable {
     environment.systemPackages = [
       pkgs.cosmic-comp
-      pkgs.cosmic-icons
       cfg.package
     ];
 

nixos/modules/services/display-managers/default.nix

@@ -1,6 +1,5 @@
 {
   config,
-  options,
   lib,
   pkgs,
   ...
@@ -8,9 +7,6 @@
 
 let
   cfg = config.services.displayManager;
-  opts = options.services.displayManager;
-
-  toPretty = lib.generators.toPretty { };
 
   installedSessions =
     pkgs.runCommand "desktops"
@@ -83,7 +79,7 @@ in
                 default = config.user != null;
                 defaultText = lib.literalExpression "config.${options.user} != null";
                 description = ''
-                  Automatically log in as {option}`${options.user}`.
+                  Automatically log in as {option}`autoLogin.user`.
                 '';
               };
 
@@ -189,15 +185,15 @@ in
       {
         assertion = cfg.autoLogin.enable -> cfg.autoLogin.user != null;
         message = ''
-          `${opts.autoLogin}.enable` requires `${opts.autoLogin}.user` to be set
+          services.displayManager.autoLogin.enable requires services.displayManager.autoLogin.user to be set
         '';
       }
       {
         assertion = cfg.defaultSession == null || lib.elem cfg.defaultSession cfg.sessionData.sessionNames;
         message = ''
-          Default graphical session, ${toPretty cfg.defaultSession}, not found. Definitions:${lib.options.showDefs opts.defaultSession.definitionsWithLocations}.
-          Valid names for `${opts.defaultSession}` are:
-              ${lib.concatMapStringsSep "\n    " toPretty cfg.sessionData.sessionNames}
+          Default graphical session, '${toString cfg.defaultSession}', not found.
+          Valid names for 'services.displayManager.defaultSession' are:
+            ${lib.concatStringsSep "\n    " cfg.sessionData.sessionNames}
         '';
       }
     ];

nixos/modules/services/home-automation/matterjs-server.nix

@@ -1,127 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.services.matterjs-server;
-in
-{
-  options.services.matterjs-server = {
-    enable = lib.mkEnableOption "matterjs-server, a Matter Controller WebSocket server based on Matter.js";
-
-    package = lib.mkPackageOption pkgs "matterjs-server" { };
-
-    listenAddress = lib.mkOption {
-      type = lib.types.str;
-      default = "127.0.0.1";
-      description = "IP address the WebSocket API binds to.";
-    };
-
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 5580;
-      description = "TCP port the WebSocket API listens on.";
-    };
-
-    openFirewall = lib.mkEnableOption null // {
-      description = "Whether to open the WebSocket API port in the firewall.";
-    };
-
-    bluetoothSupport = lib.mkEnableOption ''
-      BLE (Bluetooth Low Energy) commissioning support. Select an adapter with
-      `--bluetooth-adapter=<id>` in
-      {option}`services.matterjs-server.extraArgs`
-    '';
-
-    extraArgs = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      example = [
-        "--primary-interface=enp11s0"
-        "--log-level=debug"
-      ];
-      description = ''
-        Additional command-line arguments passed to `matterjs-server`. See
-        `matterjs-server --help` for the full list of options.
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedTCPPorts = [ cfg.port ];
-    };
-
-    systemd.services.matterjs-server = {
-      description = "Matter Controller WebSocket server based on Matter.js";
-      documentation = [ "https://github.com/matter-js/matterjs-server" ];
-
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network-online.target" ];
-      wants = [ "network-online.target" ];
-
-      serviceConfig =
-        let
-          bluetoothCaps = [
-            "CAP_NET_RAW"
-            "CAP_NET_ADMIN"
-          ];
-        in
-        {
-          ExecStart = lib.escapeShellArgs (
-            [
-              (lib.getExe cfg.package)
-              "--storage-path=%S/matterjs-server"
-              "--listen-address=${cfg.listenAddress}"
-              "--port=${toString cfg.port}"
-              "--production-mode"
-            ]
-            ++ cfg.extraArgs
-          );
-
-          StateDirectory = "matterjs-server";
-          StateDirectoryMode = "0700";
-
-          DynamicUser = true;
-
-          # Required for interaction with hci devices and bluetooth sockets
-          AmbientCapabilities = lib.optionals cfg.bluetoothSupport bluetoothCaps;
-          CapabilityBoundingSet = lib.optionals cfg.bluetoothSupport bluetoothCaps;
-          LockPersonality = true;
-          NoNewPrivileges = true;
-          PrivateTmp = true;
-          PrivateUsers = !cfg.bluetoothSupport; # Prevents gaining capabilities in the host namespace
-          ProcSubset = "pid";
-          ProtectClock = true;
-          ProtectControlGroups = true;
-          ProtectHome = true;
-          ProtectHostname = true;
-          ProtectKernelLogs = true;
-          ProtectKernelModules = true;
-          ProtectKernelTunables = true;
-          ProtectProc = "invisible";
-          ProtectSystem = "strict";
-          RestrictAddressFamilies = [
-            "AF_INET"
-            "AF_INET6"
-            "AF_NETLINK"
-            "AF_UNIX"
-          ]
-          ++ lib.optional cfg.bluetoothSupport "AF_BLUETOOTH";
-          RestrictNamespaces = true;
-          RestrictRealtime = true;
-          RestrictSUIDSGID = true;
-          SystemCallArchitectures = "native";
-          SystemCallFilter = [
-            "@system-service"
-            "~@privileged"
-          ];
-          UMask = "0077";
-        };
-    };
-  };
-
-  meta.maintainers = with lib.maintainers; [ kranzes ];
-}

nixos/modules/services/misc/inventree.nix

@@ -1,411 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  cfg = config.services.inventree;
-  pkg = cfg.package;
-
-  mysqlLocal = cfg.database.createLocally && cfg.database.dbtype == "mysql";
-  pgsqlLocal = cfg.database.createLocally && cfg.database.dbtype == "postgresql";
-
-  manage = pkgs.writeShellScriptBin "inventree-manage" ''
-    set -a
-    ${lib.toShellVars cfg.settings}
-    ${lib.optionalString (
-      cfg.database.passwordFile != null
-    ) ''INVENTREE_DB_PASSWORD="$(<${lib.escapeShellArg cfg.database.passwordFile})"''}
-    set +a
-
-    pushd ${lib.escapeShellArg cfg.dataDir}
-    expectedUser=${lib.escapeShellArg cfg.user}
-    sudo=()
-    if [[ "$USER" != "$expectedUser" ]]; then
-      ${
-        if config.security.sudo.enable then
-          ''sudo+=(${config.security.wrapperDir}/sudo -u "$expectedUser" -E)''
-        else
-          ''printf 'Aborting, inventree-manage must be run as user %s\n!' "$expectedUser" >&2; exit 2''
-      }
-    fi
-    exec "''${sudo[@]}" ${cfg.package}/bin/inventree "$@"
-  '';
-
-in
-{
-  meta.buildDocsInSandbox = false;
-
-  meta.maintainers = with lib.maintainers; [
-    kurogeek
-  ];
-
-  options.services.inventree = {
-    enable = lib.mkEnableOption "inventree";
-
-    dataDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/inventree";
-      description = "Inventree's data storage path.  Will be `/var/lib/inventree` by default.";
-    };
-
-    package = lib.mkOption {
-      type = lib.types.package;
-      description = "Which package to use for the InvenTree instance.";
-      default = pkgs.inventree;
-      defaultText = lib.literalExpression "pkgs.inventree";
-    };
-
-    adminPasswordFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      default = null;
-      example = "/run/keys/inventree-password";
-      description = "Path to a file containing admin password";
-    };
-
-    secretKeyFile = lib.mkOption {
-      type = lib.types.path;
-      default = "${cfg.dataDir}/secret_key.txt";
-      defaultText = lib.literalExpression ''"''${cfg.dataDir}/secret_key.txt"'';
-      example = "/run/keys/inventree-secret-key";
-      description = ''
-        Path to a file containing the secret key
-      '';
-    };
-
-    database = {
-      dbtype = lib.mkOption {
-        type = lib.types.nullOr (
-          lib.types.enum [
-            "postgresql"
-            "mysql"
-          ]
-        );
-        default = "postgresql";
-        description = "Database type.";
-      };
-      dbhost = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
-        default = null;
-        example = "localhost";
-        description = "Database host or socket path.";
-      };
-      dbport = lib.mkOption {
-        type = lib.types.nullOr lib.types.port;
-        default = null;
-        example = 5432;
-        description = "Database host port.";
-      };
-      dbname = lib.mkOption {
-        type = lib.types.str;
-        default = "inventree";
-        description = "Database name.";
-      };
-      dbuser = lib.mkOption {
-        type = lib.types.str;
-        default = "inventree";
-        description = "Database username.";
-      };
-      passwordFile = lib.mkOption {
-        type = with lib.types; nullOr path;
-        default = null;
-        example = "/run/keys/inventree-dbpassword";
-        description = ''
-          A file containing the password corresponding to
-          <option>database.dbuser</option>.
-        '';
-      };
-      createLocally = lib.mkOption {
-        type = lib.types.bool;
-        default = true;
-        description = "Create the database and database user locally.";
-      };
-    };
-
-    domain = lib.mkOption {
-      type = lib.types.str;
-      default = "localhost";
-      example = "inventree.example.com";
-      description = ''
-        The INVENTREE_SITE_URL option defines the base URL for the
-        InvenTree server. This is a critical setting, and it is required
-        for correct operation of the server. If not specified, the
-        server will attempt to determine the site URL automatically -
-        but this may not always be correct!
-
-        The site URL is the URL that users will use to access the
-        InvenTree server. For example, if the server is accessible at
-        `https://inventree.example.com`, the site URL should be set to
-        `https://inventree.example.com`. Note that this is not
-        necessarily the same as the internal URL that the server is
-        running on - the internal URL will depend entirely on your
-        server configuration and may be obscured by a reverse proxy or
-        other such setup.
-      '';
-    };
-
-    user = lib.mkOption {
-      type = lib.types.str;
-      default = "inventree";
-      description = "User under which InvenTree runs.";
-    };
-
-    group = lib.mkOption {
-      type = lib.types.str;
-      default = "inventree";
-      description = "Group under which InvenTree runs.";
-    };
-
-    settings = lib.mkOption {
-      type =
-        with lib.types;
-        attrsOf (
-          nullOr (oneOf [
-            path
-            str
-          ])
-        );
-      default = { };
-      description = ''
-        InvenTree config options.
-
-        See [the documentation](https://docs.inventree.org/en/stable/start/config/) for available options.
-      '';
-      example = {
-        INVENTREE_CACHE_ENABLED = true;
-        INVENTREE_CACHE_HOST = "localhost";
-
-        INVENTREE_EMAIL_HOST = "smtp.example.com";
-        INVENTREE_EMAIL_PORT = 25;
-      };
-    };
-
-  };
-
-  config = lib.mkIf cfg.enable (
-    lib.mkMerge [
-      {
-        services.inventree.settings = {
-          INVENTREE_DB_ENGINE = cfg.database.dbtype;
-          INVENTREE_DB_NAME = cfg.database.dbname;
-          INVENTREE_DB_HOST = cfg.database.dbhost;
-          INVENTREE_DB_USER = cfg.database.dbuser;
-          INVENTREE_DB_PORT = if cfg.database.dbport != null then toString cfg.database.dbport else null;
-
-          INVENTREE_CONFIG_FILE = lib.mkDefault "${cfg.dataDir}/config/config.yaml";
-          INVENTREE_OIDC_PRIVATE_KEY_FILE = lib.mkDefault "${cfg.dataDir}/config/oidc_private_key.txt";
-          INVENTREE_STATIC_ROOT = lib.mkDefault "${cfg.package}/lib/inventree/static";
-          INVENTREE_MEDIA_ROOT = lib.mkDefault "${cfg.dataDir}/data/media";
-          INVENTREE_BACKUP_DIR = lib.mkDefault "${cfg.dataDir}/data/backups";
-          INVENTREE_SITE_URL = lib.mkDefault "http://${cfg.domain}";
-          INVENTREE_PLUGIN_FILE = lib.mkDefault "${cfg.dataDir}/data/plugins/plugins.txt";
-          INVENTREE_PLUGIN_DIR = lib.mkDefault "${cfg.dataDir}/data/plugins";
-          INVENTREE_ADMIN_USER = lib.mkDefault "admin";
-          INVENTREE_ADMIN_EMAIL = lib.mkDefault "admin@${cfg.domain}";
-          INVENTREE_ADMIN_PASSWORD_FILE = lib.mkDefault cfg.adminPasswordFile;
-          INVENTREE_SECRET_KEY_FILE = lib.mkDefault cfg.secretKeyFile;
-          INVENTREE_AUTO_UPDATE = lib.mkDefault "false";
-        };
-        environment.systemPackages = [ manage ];
-        systemd.tmpfiles.rules = (
-          map (dir: "d ${dir} 0755 inventree inventree") [
-            "${cfg.dataDir}"
-            "${cfg.dataDir}/config"
-            "${cfg.dataDir}/data"
-            "${cfg.dataDir}/data/media"
-            "${cfg.dataDir}/data/backups"
-            "${cfg.dataDir}/data/plugins"
-          ]
-        );
-
-        services.postgresql = lib.mkIf pgsqlLocal {
-          enable = true;
-          ensureDatabases = [ cfg.database.dbname ];
-          ensureUsers = [
-            {
-              name = cfg.database.dbuser;
-              ensureDBOwnership = true;
-            }
-          ];
-        };
-
-        services.mysql = lib.mkIf mysqlLocal {
-          enable = true;
-          package = lib.mkDefault pkgs.mariadb;
-          ensureDatabases = [ cfg.database.dbname ];
-          ensureUsers = [
-            {
-              name = cfg.database.dbuser;
-              ensurePermissions = {
-                "${cfg.database.dbname}.*" = "ALL PRIVILEGES";
-              };
-            }
-          ];
-        };
-
-        services.nginx.enable = true;
-        services.nginx.virtualHosts.${cfg.domain} = {
-          locations =
-            let
-              unixPath = config.systemd.sockets.inventree-server.socketConfig.ListenStream;
-            in
-            {
-              "/" = {
-                extraConfig = ''
-                  proxy_set_header Host $host;
-                  proxy_set_header X-Forwarded-By $server_addr:$server_port;
-                  proxy_set_header X-Forwarded-For $remote_addr;
-                  proxy_set_header X-Forwarded-Proto $scheme;
-                  proxy_set_header X-Real-IP $remote_addr;
-                  proxy_set_header CLIENT_IP $remote_addr;
-
-                  proxy_pass_request_headers on;
-
-                  proxy_redirect off;
-
-                  client_max_body_size 100M;
-
-                  proxy_buffering off;
-                  proxy_request_buffering off;
-                '';
-                proxyPass = "http://unix:${unixPath}";
-              };
-              "/auth" = {
-                extraConfig = ''
-                  internal;
-                  proxy_pass_request_body off;
-                  proxy_set_header Content-Length "";
-                  proxy_set_header X-Original-URI $request_uri;
-                '';
-                proxyPass = "http://unix:${unixPath}:/auth/";
-              };
-              "/static/" = {
-                alias = "${cfg.settings.INVENTREE_STATIC_ROOT}/";
-                extraConfig = ''
-                  autoindex on;
-
-                  # Caching settings
-                  expires 30d;
-                  add_header Pragma public;
-                  add_header Cache-Control "public";
-                '';
-              };
-              "/media/" = {
-                alias = "${cfg.settings.INVENTREE_MEDIA_ROOT}/";
-                extraConfig = ''
-                  auth_request /auth;
-                  add_header Content-disposition "attachment";
-                '';
-              };
-            };
-        };
-
-        systemd.services.inventree-setup = {
-          description = "Inventree setup";
-          wantedBy = [ "inventree.target" ];
-          partOf = [ "inventree.target" ];
-          after = lib.optional mysqlLocal "mysql.service" ++ lib.optional pgsqlLocal "postgresql.target";
-          requires = lib.optional mysqlLocal "mysql.service" ++ lib.optional pgsqlLocal "postgresql.target";
-          before = [
-            "inventree-server.service"
-            "inventree-qcluster.service"
-          ];
-          serviceConfig = {
-            Type = "oneshot";
-            User = cfg.user;
-            Group = cfg.group;
-            RemainAfterExit = true;
-            PrivateTmp = true;
-          }
-          // lib.optionalAttrs (cfg.database.passwordFile != null) {
-            LoadCredential = "db_password:${cfg.database.passwordFile}";
-          };
-          environment = cfg.settings;
-          script = ''
-            set -euo pipefail
-            umask u=rwx,g=,o=
-
-            ${
-              lib.optionalString (cfg.database.passwordFile != null) ''
-                INVENTREE_DB_PASSWORD=$(<"$CREDENTIALS_DIRECTORY/db_password")
-              ''
-            } \
-            exec ${pkg}/bin/inventree migrate
-          '';
-        };
-
-        systemd.services.inventree-server = {
-          description = "Inventree Gunicorn service";
-          requiredBy = [ "inventree.target" ];
-          partOf = [ "inventree.target" ];
-          environment = cfg.settings;
-          serviceConfig = {
-            User = cfg.user;
-            Group = cfg.group;
-            StateDirectory = "inventree";
-            PrivateTmp = true;
-          }
-          // lib.optionalAttrs (cfg.database.passwordFile != null) {
-            LoadCredential = "db_password:${cfg.database.passwordFile}";
-          };
-          script = ''
-            ${
-              lib.optionalString (cfg.database.passwordFile != null) ''
-                INVENTREE_DB_PASSWORD=$(<"$CREDENTIALS_DIRECTORY/db_password")
-              ''
-            } \
-            exec ${pkg}/bin/gunicorn InvenTree.wsgi
-          '';
-        };
-
-        systemd.sockets.inventree-server = {
-          wantedBy = [ "sockets.target" ];
-          partOf = [ "inventree.target" ];
-          socketConfig.ListenStream = "/run/inventree/gunicorn.socket";
-        };
-
-        systemd.services.inventree-qcluster = {
-          description = "InvenTree qcluster server";
-          requiredBy = [ "inventree.target" ];
-          wantedBy = [ "inventree.target" ];
-          partOf = [ "inventree.target" ];
-          environment = cfg.settings;
-          serviceConfig = {
-            User = cfg.user;
-            Group = cfg.group;
-            StateDirectory = "inventree";
-            PrivateTmp = true;
-          }
-          // lib.optionalAttrs (cfg.database.passwordFile != null) {
-            LoadCredential = "db_password:${cfg.database.passwordFile}";
-          };
-          script = ''
-            ${
-              lib.optionalString (cfg.database.passwordFile != null) ''
-                INVENTREE_DB_PASSWORD=$(<"$CREDENTIALS_DIRECTORY/db_password")
-              ''
-            } \
-            exec ${pkg}/bin/inventree qcluster
-          '';
-        };
-
-        systemd.targets.inventree = {
-          description = "Target for all InvenTree services";
-          wantedBy = [ "multi-user.target" ];
-          wants = [ "network-online.target" ];
-          after = [ "network-online.target" ];
-        };
-
-        users = lib.optionalAttrs (cfg.user == cfg.user) {
-          users.${cfg.user} = {
-            group = cfg.group;
-            isSystemUser = true;
-            home = cfg.dataDir;
-          };
-          groups.${cfg.group}.members = [ cfg.user ];
-        };
-      }
-    ]
-  );
-}

nixos/modules/services/misc/klipper.nix

@@ -14,14 +14,7 @@ let
         lib.generators.mkValueStringDefault { } (lib.head l)
       else
         lib.concatMapStrings (s: "\n  ${lib.generators.mkValueStringDefault { } s}") l;
-    mkKeyValue =
-      key: value:
-      lib.generators.mkKeyValueDefault { } ":" key (
-        if builtins.isString value && lib.hasInfix "\n" value then
-          "\n  ${lib.replaceString "\n" "\n  " value}"
-        else
-          value
-      );
+    mkKeyValue = lib.generators.mkKeyValueDefault { } ":";
   };
   firmwareSubmodule = lib.types.submodule (
     { name, ... }@local:
@@ -40,27 +33,11 @@ let
         '';
         serial = lib.mkOption {
           type = lib.types.nullOr lib.types.path;
-          description = "Path to serial port this mcu is connected to. Derived from `service.klipper.settings` by default.";
+          description = "Path to serial port this printer is connected to. Derived from `service.klipper.settings` by default.";
           defaultText = lib.literalExpression "config.services.klipper.settings.<name>.serial";
           default =
             if lib.hasAttrByPath [ "${mcu}" "serial" ] cfg.settings then cfg.settings."${mcu}".serial else null;
         };
-        canbus_uuid = lib.mkOption {
-          type = lib.types.nullOr lib.types.str;
-          description = "CAN bus uuid of this mcu. Derived from `service.klipper.settings` by default.";
-          defaultText = lib.literalExpression "config.services.klipper.settings.<name>.canbus_uuid";
-          default =
-            if lib.hasAttrByPath [ "${mcu}" "canbus_uuid" ] cfg.settings then
-              cfg.settings."${mcu}".canbus_uuid
-            else
-              null;
-        };
-        canbusNetwork = lib.mkOption {
-          type = lib.types.nullOr lib.types.str;
-          description = "CAN bus network this mcu is connected to. Defaults to can0 if canbus_uuid is set.";
-          defaultText = lib.literalExpression ''if canbus_uuid != null then "can0" else null'';
-          default = if subcfg.canbus_uuid != null then "can0" else null;
-        };
         configFile = lib.mkOption {
           type = lib.types.path;
           description = "Path to firmware config which is generated using `klipper-genconf`";
@@ -94,8 +71,6 @@ let
               klipper-firmware = subcfg.package;
               mcu = lib.strings.sanitizeDerivationName mcu;
               flashDevice = subcfg.serial;
-              canbusDevice = subcfg.canbus_uuid;
-              canbusNetwork = subcfg.canbusNetwork;
               firmwareConfig = subcfg.configFile;
             }
           else
@@ -242,15 +217,12 @@ in
       }
     ]
     ++ lib.mapAttrsToList (mcu: firmware: {
-      assertion =
-        firmware.enableKlipperFlash -> (firmware.serial != null || firmware.canbus_uuid != null);
+      assertion = firmware.enableKlipperFlash -> firmware.serial != null;
       message = ''
-        Unable to determine the serial or canbus connection for services.klipper.firmwares."${mcu}". Please set one of the following:
+        Unable to determine the serial connection for services.klipper.firmwares."${mcu}". Please set one of the following:
 
           - services.klipper.firmwares."${mcu}".serial
-          - services.klipper.firmwares."${mcu}".canbus_uuid
           - services.klipper.settings."${mcu}".serial
-          - services.klipper.settings."${mcu}".canbus_uuid
       '';
     }) cfg.firmwares;
 
@@ -329,6 +301,7 @@ in
 
     environment.systemPackages =
       let
+        default = a: b: if a != null then a else b;
         genconf = pkgs.klipper-genconf.override {
           klipper = cfg.package;
         };

nixos/modules/services/networking/bird.nix

@@ -93,7 +93,6 @@ in
     systemd.services.bird = {
       description = "BIRD Internet Routing Daemon";
       wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
       reloadTriggers = lib.optional cfg.autoReload config.environment.etc."bird/bird.conf".source;
       serviceConfig = {
         Type = "forking";

nixos/modules/services/networking/firewalld/default.nix

@@ -57,19 +57,7 @@ in
     systemd.services.firewalld = {
       aliases = [ "dbus-org.fedoraproject.FirewallD1.service" ];
       wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecReload = [
-        ""
-        "${lib.getExe' pkgs.coreutils "kill"} -HUP $MAINPID"
-      ];
-      reloadTriggers = [
-        config.environment.etc."firewalld/firewalld.conf".source
-      ]
-      ++ lib.mapAttrsToList (
-        name: _: config.environment.etc."firewalld/zones/${name}.xml".source
-      ) config.services.firewalld.zones
-      ++ lib.mapAttrsToList (
-        name: _: config.environment.etc."firewalld/services/${name}.xml".source
-      ) config.services.firewalld.services;
+      serviceConfig.ExecReload = "${lib.getExe' pkgs.coreutils "kill"} -HUP $MAINPID";
       environment.NIX_FIREWALLD_CONFIG_PATH = "${paths}/lib/firewalld";
     };
   };

nixos/modules/services/networking/llama-swap.nix

@@ -166,6 +166,7 @@ in
         SystemCallErrorNumber = "EPERM";
         ProtectProc = "invisible";
         ProtectHostname = true;
+        ProcSubset = "pid";
         WorkingDirectory = "/tmp";
       };
     };

nixos/modules/services/networking/pangolin.nix

@@ -9,7 +9,7 @@
 let
   cfg = config.services.pangolin;
   format = pkgs.formats.yaml { };
-  finalSettings = lib.attrsets.recursiveUpdate options.services.pangolin.settings.default cfg.settings;
+  finalSettings = lib.attrsets.recursiveUpdate pangolinConf cfg.settings;
   cfgFile = format.generate "config.yml" finalSettings;
   # override the type to allow for optionality
   nullOrOpt = t: lib.types.nullOr t // { _optional = true; };
@@ -33,6 +33,25 @@ let
       fi
     '';
   };
+
+  pangolinConf = {
+    app.dashboard_url = "https://${cfg.dashboardDomain}";
+    domains.domain1 = {
+      base_domain = cfg.baseDomain;
+      prefer_wildcard_cert = false;
+    };
+    server = {
+      external_port = 3000;
+      internal_port = 3001;
+      next_port = 3002;
+      integration_port = 3003;
+      # needs to be set, otherwise this fails silently
+      # see https://github.com/fosrl/newt/issues/37
+      internal_hostname = "localhost";
+    };
+    gerbil.base_endpoint = cfg.dashboardDomain;
+    flags.enable_integration_api = false;
+  };
 in
 {
   options.services = {
@@ -42,50 +61,7 @@ in
 
       settings = lib.mkOption {
         inherit (format) type;
-        default = {
-          app.dashboard_url = "https://${cfg.dashboardDomain}";
-          domains.domain1 = {
-            base_domain = cfg.baseDomain;
-            prefer_wildcard_cert = false;
-          };
-          server = {
-            external_port = 3000;
-            internal_port = 3001;
-            next_port = 3002;
-            integration_port = 3003;
-            # needs to be set, otherwise this fails silently
-            # see https://github.com/fosrl/newt/issues/37
-            internal_hostname = "localhost";
-          };
-          gerbil.base_endpoint = cfg.dashboardDomain;
-          flags = {
-            disable_signup_without_invite = true;
-            enable_integration_api = false;
-          };
-        };
-        defaultText = lib.literalExpression ''
-          {
-            app.dashboard_url = "https://''${config.services.pangolin.dashboardDomain}";
-            domains.domain1 = {
-              base_domain = cfg.baseDomain;
-              prefer_wildcard_cert = false;
-            };
-            server = {
-              external_port = 3000;
-              internal_port = 3001;
-              next_port = 3002;
-              integration_port = 3003;
-              # needs to be set, otherwise this fails silently
-              # see https://github.com/fosrl/newt/issues/37
-              internal_hostname = "localhost";
-            };
-            gerbil.base_endpoint = config.services.pangolin.dashboardDomain;
-            flags = {
-              disable_signup_without_invite = true;
-              enable_integration_api = false;
-            };
-          }
-        '';
+        default = { };
         description = ''
           Additional attributes to be merged with the configuration options and written to Pangolin's {file}`config.yml` file.
         '';

nixos/modules/services/security/opensnitch.nix

@@ -207,7 +207,6 @@ in
       };
       tmpfiles.rules = [
         "d ${cfg.settings.Rules.Path} 0750 root root - -"
-        "L+ /etc/opensnitchd/network_aliases.json - - - - ${cfg.package}/etc/opensnitchd/network_aliases.json"
         "L+ /etc/opensnitchd/system-fw.json - - - - ${cfg.package}/etc/opensnitchd/system-fw.json"
       ];
     };

nixos/modules/services/torrent/bitmagnet.nix

@@ -14,7 +14,6 @@ let
     optional
     ;
   inherit (lib.types)
-    nullOr
     bool
     port
     str
@@ -44,10 +43,10 @@ in
             type = submodule {
               inherit freeformType;
               options = {
-                local_address = mkOption {
+                port = mkOption {
                   type = str;
                   default = ":3333";
-                  description = "HTTP server listen address";
+                  description = "HTTP server listen port";
                 };
               };
             };
@@ -95,20 +94,6 @@ in
               };
             };
           };
-          tmdb = mkOption {
-            default = { };
-            description = "TMDB api settings";
-            type = submodule {
-              inherit freeformType;
-              options = {
-                api_key = mkOption {
-                  type = nullOr str;
-                  default = null;
-                  description = "TMDB api key, to avoid api limits. Leave null to use the default shared key.";
-                };
-              };
-            };
-          };
         };
       };
     };
@@ -144,7 +129,6 @@ in
       ]
       ++ optional cfg.useLocalPostgresDB "postgresql.target";
       requires = optional cfg.useLocalPostgresDB "postgresql.target";
-      restartTriggers = [ config.environment.etc."xdg/bitmagnet/config.yml".source ];
       serviceConfig = {
         Type = "simple";
         DynamicUser = true;
@@ -154,7 +138,6 @@ in
         Restart = "on-failure";
         WorkingDirectory = "/var/lib/bitmagnet";
         StateDirectory = "bitmagnet";
-        BindReadOnlyPaths = [ "/etc/xdg/bitmagnet/config.yml" ];
 
         # Sandboxing (sorted by occurrence in https://www.freedesktop.org/software/systemd/man/systemd.exec.html)
         ProtectSystem = "strict";

nixos/modules/services/ttys/kmscon.nix

@@ -2,7 +2,6 @@
   config,
   pkgs,
   lib,
-  utils,
   ...
 }:
 let
@@ -11,6 +10,8 @@ let
     mkEnableOption
     mkOption
     mkPackageOption
+    optional
+    optionals
     types
     ;
 
@@ -21,12 +22,7 @@ let
   configDir = pkgs.writeTextFile {
     name = "kmscon-config";
     destination = "/kmscon.conf";
-    text =
-      let
-        mkKeyValue =
-          k: v: if lib.isBool v then (lib.optionalString (!v) "no-") + k else "${k}=${toString v}";
-      in
-      lib.generators.toKeyValue { inherit mkKeyValue; } (lib.filterAttrs (_: v: v != null) cfg.config);
+    text = cfg.extraConfig;
   };
 
   baseLoginOptions = "-p";
@@ -59,68 +55,58 @@ in
 
       Check `services.getty.autologinUser` instead.
     '')
-    (lib.mkRemovedOptionModule [ "services" "kmscon" "fonts" ] ''
-      `services.kmscon.fonts` is removed.
-
-      Add your font to `fonts.packages` and configure it with
-      `services.kmscon.config.font-name` instead.
-    '')
-    (lib.mkRemovedOptionModule [ "services" "kmscon" "extraConfig" ] ''
-      `services.kmscon.extraConfig` is removed.
-
-      Add your configurations to the new `services.kmscon.config` instead.
-    '')
-    (lib.mkRenamedOptionModule [ "services" "kmscon" "term" ] [ "services" "kmscon" "config" "term" ])
-    (lib.mkRenamedOptionModule
-      [ "services" "kmscon" "hwRender" ]
-      [ "services" "kmscon" "config" "hwaccel" ]
-    )
   ];
 
   options = {
     services.kmscon = {
       enable = mkEnableOption ''
-        use kmscon instead of autovt.
+        Use kmscon instead of autovt.
 
         Kmscon is a simple terminal emulator based on linux kernel mode setting (KMS).
-        It is an attempt to replace the in-kernel VT implementation with a userspace console
+        It is an attempt to replace the in-kernel VT implementation with a userspace console.
       '';
 
       package = mkPackageOption pkgs "kmscon" { };
 
-      useXkbConfig = mkEnableOption ''
-        configure keymap from xserver keyboard settings.
+      hwRender = mkEnableOption "3D hardware acceleration to render the console";
 
-        If enabled, configurations under `services.xserver.xkb` will be injected into kmscon's configuration
-      '';
-
-      config = mkOption {
-        description = ''
-          Configuration for kmscon. See {manpage}`kmscon.conf(5)`
-          for available options.
-        '';
-        default = { };
-        type = types.submodule {
-          freeformType =
-            with types;
-            attrsOf (oneOf [
-              bool
-              int
-              str
-            ]);
-          options = {
-            hwaccel = mkEnableOption "use hardware acceleration for rendering";
-            libseat = mkOption {
-              type = types.bool;
-              default = true;
-              description = ''
-                Whether to use libseat for session management.
-                This is the default for kmscon newer than 10.0.0 and prevents
-                launching another GUI from kmscon by `kmscon-launch-gui`.
-              '';
+      fonts = mkOption {
+        description = "Fonts used by kmscon, in order of priority.";
+        default = null;
+        example = lib.literalExpression ''[ { name = "Source Code Pro"; package = pkgs.source-code-pro; } ]'';
+        type =
+          with types;
+          let
+            fontType = submodule {
+              options = {
+                name = mkOption {
+                  type = str;
+                  description = "Font name, as used by fontconfig.";
+                };
+                package = mkOption {
+                  type = package;
+                  description = "Package providing the font.";
+                };
+              };
             };
-          };
-        };
+          in
+          nullOr (nonEmptyListOf fontType);
+      };
+
+      useXkbConfig = mkEnableOption "configure keymap from xserver keyboard settings.";
+
+      term = mkOption {
+        description = "Value for the TERM environment variable.";
+        type = types.nullOr types.str;
+        default = null;
+        example = "xterm-256color";
+      };
+
+      extraConfig = mkOption {
+        description = "Extra contents of the kmscon.conf file.";
+        type = types.lines;
+        default = "";
+        example = "font-size=14";
       };
 
       extraOptions = mkOption {
@@ -138,54 +124,30 @@ in
         assertion = gettyCfg.loginOptions == null;
         message = "services.getty.loginOptions is not supported when services.kmscon is enabled.";
       }
-      {
-        assertion = (cfg.config ? font-name) -> config.fonts.fontconfig.enable;
-        message = "Font configuration for kmscon requires fontconfig to be enabled.";
-      }
-      {
-        assertion = cfg.config.hwaccel -> config.hardware.graphics.enable;
-        message = "Hardware acceleration for kmscon requires `hardware.graphics.enable` to be true.";
-      }
     ];
 
-    services.kmscon.config = lib.mkIf cfg.useXkbConfig (
-      lib.mapAttrs (_: lib.mkDefault) (
-        lib.filterAttrs (_: v: v != "") {
-          xkb-layout = config.services.xserver.xkb.layout;
-          xkb-model = config.services.xserver.xkb.model;
-          xkb-options = config.services.xserver.xkb.options;
-          xkb-variant = config.services.xserver.xkb.variant;
-        }
-      )
-    );
-
     environment.systemPackages = [ cfg.package ];
     systemd.packages = [ cfg.package ];
 
     systemd.services."kmsconvt@" = {
-      serviceConfig = {
-        User = lib.mkIf (!cfg.config.libseat) "";
-        PAMName = lib.mkIf (!cfg.config.libseat) "";
-        Environment = [ "XKB_CONFIG_ROOT=${config.services.xserver.xkb.dir}" ];
-        ExecStart = [
-          "" # override upstream default with an empty ExecStart
-          (builtins.concatStringsSep " " (
-            [
-              "${cfg.package}/bin/kmscon"
-              "--configdir"
-              configDir
-              "--vt=%I"
-              "--no-switchvt"
-              "--login"
-            ]
-            ++ lib.optional (cfg.extraOptions != "") cfg.extraOptions
-            ++ [
-              "--"
-              loginScript
-            ]
-          ))
-        ];
-      };
+      serviceConfig.ExecStart = [
+        "" # override upstream default with an empty ExecStart
+        (builtins.concatStringsSep " " (
+          [
+            "${cfg.package}/bin/kmscon"
+            "--configdir"
+            configDir
+            "--vt=%I"
+            "--no-switchvt"
+            "--login"
+          ]
+          ++ lib.optional (cfg.extraOptions != "") cfg.extraOptions
+          ++ [
+            "--"
+            loginScript
+          ]
+        ))
+      ];
 
       restartIfChanged = false;
       # logind spawns autovt@ttyN.service on VT switch; point it at kmscon
@@ -194,55 +156,40 @@ in
 
     # tty1 is special: logind does not spawn autovt@tty1, it expects a static
     # pull-in via getty.target. With getty@ suppressed, we must replace it.
-    systemd.targets.getty.wants = lib.mkIf (!config.services.displayManager.enable) [
+    systemd.services."getty.target".wants = lib.mkIf (!config.services.displayManager.enable) [
       "kmsconvt@tty1.service"
     ];
 
     systemd.suppressedSystemUnits = [ "getty@.service" ];
 
-    security.pam.services.kmscon = lib.mkIf cfg.config.libseat {
-      useDefaultRules = false;
-      rules = {
-        auth = utils.pam.autoOrderRules [
-          {
-            name = "permit";
-            control = "required";
-            modulePath = "${config.security.pam.package}/lib/security/pam_permit.so";
-          }
-        ];
-        account = utils.pam.autoOrderRules [
-          {
-            name = "unix";
-            control = "required";
-            modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
-          }
-        ];
-        session = utils.pam.autoOrderRules [
-          {
-            name = "env";
-            control = "required";
-            modulePath = "${config.security.pam.package}/lib/security/pam_env.so";
-            settings = {
-              conffile = "/etc/pam/environment";
-              readenv = 0;
-            };
-          }
-          {
-            name = "unix";
-            control = "required";
-            modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
-          }
-          {
-            name = "systemd";
-            control = "optional";
-            modulePath = "${config.systemd.package}/lib/security/pam_systemd.so";
-            settings = {
-              type = "tty";
-              class = "greeter";
-            };
-          }
-        ];
-      };
+    services.kmscon.extraConfig = lib.concatLines (
+      optionals cfg.useXkbConfig (
+        lib.mapAttrsToList (n: v: "xkb-${n}=${v}") (
+          lib.filterAttrs (
+            n: v:
+            builtins.elem n [
+              "layout"
+              "model"
+              "options"
+              "variant"
+            ]
+            && v != ""
+          ) config.services.xserver.xkb
+        )
+      )
+      ++ optionals cfg.hwRender [
+        "drm"
+        "hwaccel"
+      ]
+      ++ optional (cfg.fonts != null) "font-name=${lib.concatMapStringsSep ", " (f: f.name) cfg.fonts}"
+      ++ optional (cfg.term != null) "term=${cfg.term}"
+    );
+
+    hardware.graphics.enable = mkIf cfg.hwRender true;
+
+    fonts = mkIf (cfg.fonts != null) {
+      fontconfig.enable = true;
+      packages = map (f: f.package) cfg.fonts;
     };
   };
 

nixos/modules/services/web-apps/docuseal.nix

@@ -56,8 +56,6 @@ in
       default = { };
       description = ''
         Extra environment variables to pass to DocuSeal services.
-
-        Refer to <https://www.docuseal.com/docs/configuring-docuseal-via-environment-variables>.
       '';
     };
 

nixos/modules/services/web-apps/immich.nix

@@ -380,6 +380,8 @@ in
       MACHINE_LEARNING_WORKERS = "1";
       MACHINE_LEARNING_WORKER_TIMEOUT = "120";
       MACHINE_LEARNING_CACHE_FOLDER = "/var/cache/immich";
+      # TODO: drop when insightface no longer unconditionally imports matplotlib
+      MPLCONFIGDIR = "/var/cache/immich";
       XDG_CACHE_HOME = "/var/cache/immich";
       IMMICH_HOST = "localhost";
       IMMICH_PORT = "3003";

nixos/modules/services/web-apps/rsshub.nix

@@ -49,7 +49,7 @@ in
         {
           REQUEST_TIMEOUT = "3000";
           REQUEST_RETRY = "10";
-          CHROMIUM_EXECUTABLE_PATH = lib.getExe pkgs.chromium;
+          PUPPETEER_EXECUTABLE_PATH = lib.getExe pkgs.chromium";
         }
       '';
       description = ''

nixos/modules/services/web-apps/strichliste.nix

@@ -246,16 +246,6 @@ in
               };
             };
 
-            splitInvoice = {
-              enabled = mkOption {
-                type = types.bool;
-                default = true;
-                description = ''
-                  Whether to allow splitting invoices.
-                '';
-              };
-            };
-
             transaction = {
               enabled = mkOption {
                 type = types.bool;
@@ -474,22 +464,26 @@ in
         wants = unitDependencies;
         after = unitDependencies;
         inherit (cfg) environment;
+        preStart = ''
+          set -ex
+          if [ ! -e "/var/lib/strichliste/.db-init" ]; then
+            ${lib.optionalString (lib.hasInfix "sqlite" cfg.environment.DATABASE_URL) ''
+              ${lib.getExe cfg.packages.backend} doctrine:database:create
+            ''}
+            ${lib.getExe cfg.packages.backend} doctrine:schema:create
+            touch "/var/lib/strichliste/.db-init"
+          fi
+        '';
         serviceConfig = {
-          Type = "oneshot";
+          Type = "exec";
           User = "strichliste";
           Group = "strichliste";
           EnvironmentFile = cfg.environmentFiles;
-          ExecStart = map toString [
-            [
-              (lib.getExe cfg.packages.backend)
-              "cache:clear"
-            ]
-            [
-              (lib.getExe cfg.packages.backend)
-              "doctrine:migrations:migrate"
-              "--allow-no-migration"
-              "--no-interaction"
-            ]
+          ExecStart = toString [
+            (lib.getExe cfg.packages.backend)
+            "doctrine:migrations:migrate"
+            "--allow-no-migration"
+            "--no-interaction"
           ];
         };
       };

nixos/modules/services/web-apps/tranquil-pds.nix

@@ -1,251 +0,0 @@
-{
-  lib,
-  pkgs,
-  config,
-  ...
-}:
-let
-  cfg = config.services.tranquil-pds;
-
-  inherit (lib) types mkPackageOption mkOption;
-
-  settingsFormat = pkgs.formats.toml { };
-in
-{
-  options.services.tranquil-pds = {
-    enable = lib.mkEnableOption "tranquil-pds AT Protocol personal data server";
-
-    package = mkPackageOption pkgs "tranquil-pds" { };
-
-    user = mkOption {
-      type = types.str;
-      default = "tranquil-pds";
-      description = "User under which tranquil-pds runs";
-    };
-
-    group = mkOption {
-      type = types.str;
-      default = "tranquil-pds";
-      description = "Group under which tranquil-pds runs";
-    };
-
-    dataDir = mkOption {
-      type = types.str;
-      default = "/var/lib/tranquil-pds";
-      description = "Working directory for tranquil-pds. Also expected to be used for data (blobs)";
-    };
-
-    environmentFiles = mkOption {
-      type = types.listOf types.path;
-      default = [ ];
-      description = ''
-        File to load environment variables from. Loaded variables override
-        values set in {option}`environment`.
-
-        Use it to set values of `JWT_SECRET`, `DPOP_SECRET` and `MASTER_KEY`.
-
-        Generate these with:
-        ```
-        openssl rand -base64 48
-        ```
-      '';
-    };
-
-    database.createLocally = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Create the postgres database and user on the local host.
-      '';
-    };
-
-    settings = mkOption {
-      type = types.submodule {
-        freeformType = settingsFormat.type;
-
-        options = {
-          server = {
-            host = mkOption {
-              type = types.str;
-              default = "127.0.0.1";
-              description = "Host for tranquil-pds to listen on";
-            };
-
-            port = mkOption {
-              type = types.int;
-              default = 3000;
-              description = "Port for tranquil-pds to listen on";
-            };
-
-            hostname = mkOption {
-              type = types.str;
-              default = "";
-              example = "pds.example.com";
-              description = "The public-facing hostname of the PDS";
-            };
-
-            max_blob_size = mkOption {
-              type = types.int;
-              default = 10737418240; # 10 GiB
-              description = "Maximum allowed blob size in bytes.";
-            };
-          };
-
-          frontend = {
-            enabled =
-              lib.mkEnableOption "serving the frontend from the backend. Disable to serve the frontend manually"
-              // {
-                default = true;
-              };
-
-            dir = mkPackageOption pkgs "tranquil-pds-frontend" { };
-          };
-
-          storage = {
-            path = mkOption {
-              type = types.path;
-              default = "${cfg.dataDir}/blobs";
-              defaultText = "\${cfg.dataDir}/blobs";
-              description = "Directory for storing blobs";
-            };
-          };
-          tranquil_store = {
-            data_dir = mkOption {
-              type = types.path;
-              default = "${cfg.dataDir}/store";
-              defaultText = "\${cfg.dataDir}/store";
-              description = "Directory for tranquil-store files";
-            };
-          };
-        };
-      };
-
-      description = ''
-        Configuration options to set for the service. Secrets should be
-        specified using {option}`environmentFile`.
-
-        Refer to <https://tangled.org/tranquil.farm/tranquil-pds/blob/main/example.toml>
-        for available configuration options.
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable (
-    lib.mkMerge [
-      (lib.mkIf cfg.database.createLocally {
-        services.postgresql = {
-          enable = true;
-          ensureDatabases = [ cfg.user ];
-          ensureUsers = [
-            {
-              name = cfg.user;
-              ensureDBOwnership = true;
-            }
-          ];
-        };
-
-        services.tranquil-pds.settings.database.url =
-          lib.mkDefault "postgresql:///${cfg.user}?host=/run/postgresql";
-
-        systemd.services.tranquil-pds = {
-          requires = [ "postgresql.service" ];
-          after = [ "postgresql.service" ];
-        };
-      })
-
-      {
-        users.users.${cfg.user} = {
-          isSystemUser = true;
-          inherit (cfg) group;
-          home = cfg.dataDir;
-        };
-
-        users.groups.${cfg.group} = { };
-
-        systemd.tmpfiles.settings."tranquil-pds" =
-          lib.genAttrs
-            [
-              cfg.dataDir
-              cfg.settings.storage.path
-              cfg.settings.tranquil_store.data_dir
-            ]
-            (_: {
-              d = {
-                mode = "0750";
-                inherit (cfg) user group;
-              };
-            });
-
-        environment.etc = {
-          "tranquil-pds/config.toml".source =
-            let
-              conf = settingsFormat.generate "tranquil-pds.toml" cfg.settings;
-            in
-            pkgs.runCommandLocal "validated-tranquil-config" { nativeBuildInputs = [ cfg.package ]; } ''
-              tranquil-server --config ${conf} validate --ignore-secrets
-              ln -s ${conf} $out
-            '';
-        };
-
-        systemd.services.tranquil-pds = {
-          description = "Tranquil PDS - ATProtocol Personal Data Server";
-          after = [ "network-online.target" ];
-          wants = [ "network-online.target" ];
-          wantedBy = [ "multi-user.target" ];
-
-          serviceConfig = {
-            User = cfg.user;
-            Group = cfg.group;
-            UMask = "0077";
-            ExecStart = lib.getExe cfg.package;
-            Restart = "on-failure";
-            RestartSec = 5;
-
-            WorkingDirectory = cfg.dataDir;
-            StateDirectory = "tranquil-pds";
-            ReadWritePaths = [
-              cfg.settings.storage.path
-            ];
-
-            EnvironmentFile = cfg.environmentFiles;
-
-            CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
-            ProtectProc = "invisible";
-            ProcSubset = "pid";
-            NoNewPrivileges = true;
-            ProtectSystem = "strict";
-            ProtectHome = true;
-            PrivateTmp = true;
-            PrivateDevices = true;
-            PrivateUsers = true;
-            ProtectHostname = true;
-            ProtectClock = true;
-            ProtectKernelTunables = true;
-            ProtectKernelModules = true;
-            ProtectKernelLogs = true;
-            ProtectControlGroups = true;
-            RestrictAddressFamilies = [
-              "AF_INET"
-              "AF_INET6"
-              "AF_UNIX"
-            ];
-            RestrictNamespaces = true;
-            LockPersonality = true;
-            MemoryDenyWriteExecute = true;
-            RestrictRealtime = true;
-            RestrictSUIDSGID = true;
-            RemoveIPC = true;
-            PrivateMounts = true;
-            SystemCallFilter = [
-              "@system-service"
-              "~@privileged @resources"
-            ];
-            SystemCallArchitectures = "native";
-          };
-        };
-      }
-    ]
-  );
-
-  meta.maintainers = with lib.maintainers; [ nelind ];
-}

nixos/modules/services/web-servers/nginx/default.nix

@@ -206,6 +206,11 @@ let
                 if lib.isList cfg.sslCiphers then (lib.concatStringsSep ":" cfg.sslCiphers) else cfg.sslCiphers
               };"
             }
+            ${optionalString (cfg.sslDhparam != false)
+              "ssl_dhparam ${
+                if cfg.sslDhparam == true then config.security.dhparams.params.nginx.path else cfg.sslDhparam
+              };"
+            }
 
             ${optionalString cfg.recommendedTlsSettings ''
               # Consider https://ssl-config.mozilla.org/#server=nginx&config=intermediate as the lower bound
@@ -976,6 +981,9 @@ in
           "ECDHE-RSA-AES256-GCM-SHA384"
           "ECDHE-ECDSA-CHACHA20-POLY1305"
           "ECDHE-RSA-CHACHA20-POLY1305"
+          "DHE-RSA-AES128-GCM-SHA256"
+          "DHE-RSA-AES256-GCM-SHA384"
+          "DHE-RSA-CHACHA20-POLY1305"
         ];
         description = ''
           List of available cipher suites to choose from when negotiating TLS sessions.
@@ -994,6 +1002,13 @@ in
         description = "Allowed TLS protocol versions.";
       };
 
+      sslDhparam = mkOption {
+        type = types.either types.path types.bool;
+        default = false;
+        example = "/path/to/dhparams.pem";
+        description = "Path to DH parameters file, or `true` to generate with `security.dhparms.params.nginx`.";
+      };
+
       proxyResolveWhileRunning = mkOption {
         type = types.bool;
         default = false;
@@ -1293,13 +1308,6 @@ in
   };
 
   imports = [
-    (mkRemovedOptionModule [ "services" "nginx" "sslDhparam" ] ''
-      DHE cipher suites have been removed from the default nginx cipher list.
-
-      No additional configuration is required as ECDHE is used by default already.
-
-      If you wish to use Hybrid PQ key exchange, you can set services.nginx.recommendedTlsSettings = true.
-    '')
     (mkRemovedOptionModule [ "services" "nginx" "stateDir" ] ''
       The Nginx log directory has been moved to /var/log/nginx, the cache directory
       to /var/cache/nginx. The option services.nginx.stateDir has been removed.
@@ -1670,6 +1678,8 @@ in
       in
       listToAttrs acmePairs;
 
+    security.dhparams.params.nginx = lib.mkIf (cfg.sslDhparam == true) { };
+
     users.users = optionalAttrs (cfg.user == "nginx") {
       nginx = {
         group = cfg.group;

nixos/modules/services/web-servers/varnish/default.nix

@@ -21,9 +21,20 @@ let
   # Varnish has very strong opinions and very complicated code around handling
   # the stateDir. After a lot of back and forth, we decided that we a)
   # do not want a configurable option here, as most of the handling depends
-  # on the compile time options. Putting everything into /var/run (RAM backed)
-  # is absolutely recommended by Varnish anyways.
-  stateDir = "/var/run/varnishd";
+  # on the version and the compile time options. Putting everything into
+  # /var/run (RAM backed) is absolutely recommended by Varnish anyways.
+  # We do need to pay attention to the version-dependend variations, though!
+  stateDir =
+    if
+      (lib.versionOlder cfg.package.version "7")
+    # Remove after Varnish 6.0 is gone. In 6.0 varnishadm always appends the
+    # hostname (by default) and can't be nudged to not use any name. This has
+    # long changed by 7.5 and can be used without the host name.
+    then
+      "/var/run/varnish/${config.networking.hostName}"
+    # Newer varnish uses this:
+    else
+      "/var/run/varnishd";
 
   # from --help:
   #   -a [<name>=]address[:port][,proto] # HTTP listen address and port

nixos/modules/system/boot/kernel.nix

@@ -35,15 +35,6 @@ in
 
 {
 
-  imports = [
-    (mkRemovedOptionModule [ "boot" "vesa" ] ''
-      The `boot.vesa` option has been removed. It was deprecated in 2020
-      because Xorg now works better with kernel modesetting. If you still
-      need the legacy VESA 800x600 fallback, set
-      `boot.kernelParams = [ "vga=0x317" "nomodeset" ];` directly.
-    '')
-  ];
-
   ###### interface
 
   options = {
@@ -190,6 +181,19 @@ in
       '';
     };
 
+    boot.vesa = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        (Deprecated) This option, if set, activates the VESA 800x600 video
+        mode on boot and disables kernel modesetting. It is equivalent to
+        specifying `[ "vga=0x317" "nomodeset" ]` in the
+        {option}`boot.kernelParams` option. This option is
+        deprecated as of 2020: Xorg now works better with modesetting, and
+        you might want a different VESA vga setting, anyway.
+      '';
+    };
+
     boot.extraModulePackages = mkOption {
       type = types.listOf types.package;
       default = [ ];
@@ -423,6 +427,10 @@ in
       # (so you don't need to reboot to have changes take effect).
       boot.kernelParams = [
         "loglevel=${toString config.boot.consoleLogLevel}"
+      ]
+      ++ optionals config.boot.vesa [
+        "vga=0x317"
+        "nomodeset"
       ];
 
       boot.kernel.sysctl."kernel.printk" = mkDefault config.boot.consoleLogLevel;

nixos/modules/system/boot/loader/limine/limine.nix

@@ -29,7 +29,7 @@ let
       resolution = cfg.resolution;
       maxGenerations = if cfg.maxGenerations == null then 0 else cfg.maxGenerations;
       hostArchitecture = pkgs.stdenv.hostPlatform.parsed.cpu;
-      timeout = if config.boot.loader.timeout == null then "no" else config.boot.loader.timeout;
+      timeout = if config.boot.loader.timeout != null then config.boot.loader.timeout else 10;
       enableEditor = cfg.enableEditor;
       extraConfig = cfg.extraConfig;
       extraEntries = cfg.extraEntries;

nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py

@@ -3,8 +3,6 @@ import argparse
 import ctypes
 import datetime
 import errno
-import functools
-import hashlib
 import os
 import re
 import shutil
@@ -13,7 +11,7 @@ import sys
 import tempfile
 import warnings
 import json
-from typing import NamedTuple, Any, Protocol, Sequence
+from typing import NamedTuple, Any, Sequence
 from dataclasses import dataclass
 from pathlib import Path
 
@@ -21,11 +19,9 @@ from pathlib import Path
 EFI_SYS_MOUNT_POINT = Path("@efiSysMountPoint@")
 BOOT_MOUNT_POINT = Path("@bootMountPoint@")
 LOADER_CONF = EFI_SYS_MOUNT_POINT / "loader/loader.conf"  # Always stored on the ESP
-NIXOS_DIR = Path(
-    "@nixosDir@".strip("/")
-)  # Path relative to the XBOOTLDR or ESP mount point
+NIXOS_DIR = Path("@nixosDir@".strip("/")) # Path relative to the XBOOTLDR or ESP mount point
 TIMEOUT = "@timeout@"
-EDITOR = "@editor@" == "1"  # noqa: PLR0133
+EDITOR = "@editor@" == "1" # noqa: PLR0133
 CONSOLE_MODE = "@consoleMode@"
 BOOTSPEC_TOOLS = "@bootspecTools@"
 DISTRO_NAME = "@distroName@"
@@ -33,16 +29,13 @@ NIX = "@nix@"
 SYSTEMD = "@systemd@"
 CONFIGURATION_LIMIT = int("@configurationLimit@")
 REBOOT_FOR_BITLOCKER = bool("@rebootForBitlocker@")
-CAN_TOUCH_EFI_VARIABLES = "@canTouchEfiVariables@" == "1"
-GRACEFUL = "@graceful@" == "1"
+CAN_TOUCH_EFI_VARIABLES = "@canTouchEfiVariables@"
+GRACEFUL = "@graceful@"
 COPY_EXTRA_FILES = "@copyExtraFiles@"
 CHECK_MOUNTPOINTS = "@checkMountpoints@"
 STORE_DIR = "@storeDir@"
-BOOT_COUNTING_TRIES = "@bootCountingTries@"
-BOOT_COUNTING = "@bootCounting@" == "True"
 
-
-@dataclass(frozen=True)
+@dataclass
 class BootSpec:
     init: Path
     initrd: Path
@@ -57,98 +50,12 @@ class BootSpec:
     initrdSecrets: str | None = None  # noqa: N815
 
 
-class WriteBootFile(Protocol):
-    def write_boot_file(self, path: Path, *, critical: bool) -> None: ...
+libc = ctypes.CDLL("libc.so.6")
 
+FILE = None | int
 
-@dataclass
-class CopyWriter:
-    source: Path
-
-    def write_boot_file(self, path: Path, *, critical: bool) -> None:
-        if path.exists():
-            return
-        with tempfile.NamedTemporaryFile(
-            mode="wb",
-            dir=path.parent,
-            delete=False,
-            prefix=path.name,
-            suffix=".tmp",
-        ) as tmp:
-            with open(self.source, mode="rb") as source_file:
-                shutil.copyfileobj(source_file, tmp)
-            tmp.flush()
-            os.fsync(tmp.fileno())
-            tmp.close()
-            os.rename(tmp.name, path)
-
-
-@dataclass
-class InitrdWithSecretsWriter:
-    source: Path
-    initrd_secrets: Path
-    generation: int
-
-    def write_boot_file(self, path: Path, *, critical: bool) -> None:
-        # Secrets can change between rebuilds, so always rebuild from the
-        # pristine initrd into a temp file and rename into place.
-        with tempfile.NamedTemporaryFile(
-            mode="wb",
-            dir=path.parent,
-            delete=False,
-            prefix=path.name,
-            suffix=".tmp",
-        ) as tmp:
-            try:
-                with open(self.source, mode="rb") as source_file:
-                    shutil.copyfileobj(source_file, tmp)
-                tmp.flush()
-                run([self.initrd_secrets, tmp.name])
-                os.fsync(tmp.fileno())
-            except subprocess.CalledProcessError:
-                os.unlink(tmp.name)
-                if critical:
-                    print("failed to create initrd secrets!", file=sys.stderr)
-                    sys.exit(1)
-                # Keep the entry bootable by leaving at least a pristine
-                # initrd in place. CopyWriter is a no-op if one already
-                # exists.
-                CopyWriter(source=self.source).write_boot_file(path, critical=False)
-                print(
-                    "warning: failed to update initrd secrets for an older "
-                    f"generation ({self.generation}). The previous secrets "
-                    "in this initrd will continue to be used. To silence "
-                    "this warning, restore the secret files to their "
-                    "original locations or delete this generation.",
-                    file=sys.stderr,
-                )
-                return
-            except BaseException:
-                os.unlink(tmp.name)
-                raise
-            os.rename(tmp.name, path)
-
-
-@dataclass
-class ContentsWriter:
-    contents: bytes
-
-    def write_boot_file(self, path: Path, *, critical: bool) -> None:
-        if path.exists():
-            return
-        with tempfile.NamedTemporaryFile(
-            mode="wb",
-            dir=path.parent,
-            delete=False,
-            prefix=path.name,
-            suffix=".tmp",
-        ) as tmp:
-            tmp.write(self.contents)
-            tmp.flush()
-            os.fsync(tmp.fileno())
-            tmp.close()
-            os.rename(tmp.name, path)
-
+def run(cmd: Sequence[str | Path], stdout: FILE = None) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(cmd, check=True, text=True, stdout=stdout)
 
 class SystemIdentifier(NamedTuple):
     profile: str | None
@@ -156,131 +63,51 @@ class SystemIdentifier(NamedTuple):
     specialisation: str | None
 
 
-@dataclass
-class BootFile:
-    path: Path
-    writer: WriteBootFile
-
-    @staticmethod
-    def from_source(source: Path) -> "BootFile":
-        return BootFile(
-            path=boot_path(source),
-            writer=CopyWriter(source=source),
-        )
-
-    @staticmethod
-    def from_initrd(
-        generation: int,
-        source: Path,
-        initrd_secrets: Path | None,
-    ) -> "BootFile":
-        if initrd_secrets is None:
-            return BootFile.from_source(source)
-        else:
-            # We're trying to calculate a canonical path unique to
-            # this initrd and secret-appender. The boot_path is the
-            # canonical path for files that don't need modifications,
-            # so it serves as a perfect proxy for the unique
-            # information to combine for a combined unique path. The
-            # original paths themselves would have also been fine, but
-            # boot_path is more semantically representative, since
-            # it's the actual path whose uniqueness we're trying to
-            # ensure for other things.
-            combined = "\n".join(
-                [str(boot_path(source)), str(boot_path(initrd_secrets))]
-            )
-            combined_hash = hashlib.sha256(combined.encode("utf-8")).hexdigest()
-            return BootFile(
-                path=NIXOS_DIR / f"{combined_hash}-initrd.efi",
-                writer=InitrdWithSecretsWriter(
-                    source=source,
-                    initrd_secrets=initrd_secrets,
-                    generation=generation,
-                ),
-            )
-
-    @staticmethod
-    def from_entry(contents: bytes) -> tuple["BootFile", str]:
-        contents_hash = hashlib.sha256(contents).hexdigest()
-        path_prefix = f"nixos-{contents_hash}"
-        pat = re.compile(rf"{re.escape(path_prefix)}(\+[0-9]+(-[0-9]+)?)?\.conf")
-        path = None
-        for e in os.scandir(path=BOOT_MOUNT_POINT / "loader" / "entries"):
-            if pat.fullmatch(e.name) is None:
-                continue
-            # Ignore files whose content does not match the hash in their
-            # name so GC removes them and a fresh entry is written.
-            if hashlib.sha256(Path(e.path).read_bytes()).hexdigest() != contents_hash:
-                continue
-            path = Path("loader/entries") / e.name
-            break
-        if path is None:
-            counters = f"+{BOOT_COUNTING_TRIES}" if BOOT_COUNTING else ""
-            path = Path(f"loader/entries/{path_prefix}{counters}.conf")
-        return (
-            BootFile(
-                path=path,
-                writer=ContentsWriter(contents=contents),
-            ),
-            f"{path_prefix}.conf",
-        )
-
-
-# This gets its own type alias to document that the order is very
-# important. The order ensures that entry files are written after
-# their respective kernel / initrd / etc.
-type BootFileList = list[BootFile]
-
-
-libc = ctypes.CDLL("libc.so.6")
-
-FILE = None | int
-
-
-def run(
-    cmd: Sequence[str | Path], stdout: FILE = None
-) -> subprocess.CompletedProcess[str]:
-    return subprocess.run(cmd, check=True, text=True, stdout=stdout, stderr=sys.stderr)
+def copy_if_not_exists(source: Path, dest: Path) -> None:
+    if not dest.exists():
+        tmpfd, tmppath = tempfile.mkstemp(dir=dest.parent, prefix=dest.name, suffix='.tmp.')
+        shutil.copyfile(source, tmppath)
+        os.fsync(tmpfd)
+        shutil.move(tmppath, dest)
 
 
 def generation_dir(profile: str | None, generation: int) -> Path:
     if profile:
-        return Path(
-            f"/nix/var/nix/profiles/system-profiles/{profile}-{generation}-link"
-        )
+        return Path(f"/nix/var/nix/profiles/system-profiles/{profile}-{generation}-link")
     else:
         return Path(f"/nix/var/nix/profiles/system-{generation}-link")
 
-
-def system_dir(
-    profile: str | None, generation: int, specialisation: str | None
-) -> Path:
+def system_dir(profile: str | None, generation: int, specialisation: str | None) -> Path:
     d = generation_dir(profile, generation)
     if specialisation:
         return d / "specialisation" / specialisation
     else:
         return d
 
+BOOT_ENTRY = """title {title}
+sort-key {sort_key}
+version Generation {generation} {description}
+linux {kernel}
+initrd {initrd}
+options {kernel_params}
+"""
 
-def write_loader_conf(default_entry_id: str | None) -> None:
+def generation_conf_filename(profile: str | None, generation: int, specialisation: str | None) -> str:
+    pieces = [
+        "nixos",
+        profile or None,
+        "generation",
+        str(generation),
+        f"specialisation-{specialisation}" if specialisation else None,
+    ]
+    return "-".join(p for p in pieces if p) + ".conf"
+
+
+def write_loader_conf(profile: str | None, generation: int, specialisation: str | None) -> None:
     tmp = LOADER_CONF.with_suffix(".tmp")
-    with tmp.open("x") as f:
+    with tmp.open('x') as f:
         f.write(f"timeout {TIMEOUT}\n")
-        if default_entry_id is None:
-            # No generation matched the requested default config; fall back to
-            # the newest entry as determined by Boot Loader Spec sorting.
-            f.write("default nixos-*\n")
-        elif BOOT_COUNTING:
-            # `preferred` (systemd-boot >= 260) honours boot assessment, so a
-            # generation that exhausted its boot counter is skipped and we fall
-            # through to `default`. systemd-boot sorts entries with
-            # tries_left == 0 to the end of the list and resolves the `default`
-            # glob against that order, so `nixos-*` yields the newest entry that
-            # is not bad, or a bad one only if every nixos entry is bad.
-            f.write(f"preferred {default_entry_id}\n")
-            f.write("default nixos-*\n")
-        else:
-            f.write(f"default {default_entry_id}\n")
+        f.write("default %s\n" % generation_conf_filename(profile, generation, specialisation))
         if not EDITOR:
             f.write("editor 0\n")
         if REBOOT_FOR_BITLOCKER:
@@ -300,9 +127,7 @@ def get_bootspec(profile: str | None, generation: int) -> BootSpec:
             try:
                 bootspec_json = json.load(f)
             except ValueError as e:
-                print(
-                    f"error: Malformed Json: {e}, in {boot_json_path}", file=sys.stderr
-                )
+                print(f"error: Malformed Json: {e}, in {boot_json_path}", file=sys.stderr)
                 sys.exit(1)
     else:
         boot_json_str = run(
@@ -318,18 +143,17 @@ def get_bootspec(profile: str | None, generation: int) -> BootSpec:
         bootspec_json = json.loads(boot_json_str)
     return bootspec_from_json(bootspec_json)
 
-
 def bootspec_from_json(bootspec_json: dict[str, Any]) -> BootSpec:
-    specialisations = bootspec_json["org.nixos.specialisation.v1"]
+    specialisations = bootspec_json['org.nixos.specialisation.v1']
     specialisations = {k: bootspec_from_json(v) for k, v in specialisations.items()}
-    systemdBootExtension = bootspec_json.get("org.nixos.systemd-boot", {})
-    sortKey = systemdBootExtension.get("sortKey", "nixos")
-    devicetree = systemdBootExtension.get("devicetree")
+    systemdBootExtension = bootspec_json.get('org.nixos.systemd-boot', {})
+    sortKey = systemdBootExtension.get('sortKey', 'nixos')
+    devicetree = systemdBootExtension.get('devicetree')
 
     if devicetree:
         devicetree = Path(devicetree)
 
-    main_json = bootspec_json["org.nixos.bootspec.v1"]
+    main_json = bootspec_json['org.nixos.bootspec.v1']
     for attr in ("kernel", "initrd", "toplevel"):
         if attr in main_json:
             main_json[attr] = Path(main_json[attr])
@@ -341,58 +165,67 @@ def bootspec_from_json(bootspec_json: dict[str, Any]) -> BootSpec:
     )
 
 
-@functools.lru_cache(maxsize=None)
-def boot_path(file: Path) -> Path:
+def copy_from_file(file: Path, dry_run: bool = False) -> Path:
+    """
+    Copy a file to the boot filesystem (XBOOTLDR if in use, otherwise ESP), basing the destination filename on the store path that's being copied from. Return the destination path, relative to the boot filesystem mountpoint.
+    """
     store_file_path = file.resolve()
     suffix = store_file_path.name
     store_subdir = store_file_path.relative_to(STORE_DIR).parts[0]
-    return NIXOS_DIR / (
-        f"{suffix}.efi" if suffix == store_subdir else f"{store_subdir}-{suffix}.efi"
-    )
+    efi_file_path = NIXOS_DIR / (f"{suffix}.efi" if suffix == store_subdir else f"{store_subdir}-{suffix}.efi")
+    if not dry_run:
+        copy_if_not_exists(store_file_path, BOOT_MOUNT_POINT / efi_file_path)
+    return efi_file_path
 
 
-def boot_file(
-    profile: str | None,
-    generation: int,
-    specialisation: str | None,
-    machine_id: str | None,
-    bootspec: BootSpec,
-) -> tuple[BootFileList, str]:
+def write_entry(profile: str | None, generation: int, specialisation: str | None,
+                machine_id: str | None, bootspec: BootSpec, current: bool) -> None:
     if specialisation:
         bootspec = bootspec.specialisations[specialisation]
-    kernel = BootFile.from_source(bootspec.kernel)
-    initrd = BootFile.from_initrd(
-        generation,
-        bootspec.initrd,
-        Path(bootspec.initrdSecrets) if bootspec.initrdSecrets is not None else None,
-    )
-    devicetree = None
-    if bootspec.devicetree is not None:
-        devicetree = BootFile.from_source(bootspec.devicetree)
-
-    kernel_params = " ".join([f"init={bootspec.init}"] + bootspec.kernelParams)
-    build_time = int(system_dir(profile, generation, specialisation).stat().st_ctime)
-    build_date = datetime.datetime.fromtimestamp(build_time).strftime("%F")
+    kernel = copy_from_file(bootspec.kernel)
+    initrd = copy_from_file(bootspec.initrd)
+    devicetree = copy_from_file(bootspec.devicetree) if bootspec.devicetree is not None else None
 
     title = "{name}{profile}{specialisation}".format(
         name=DISTRO_NAME,
         profile=" [" + profile + "]" if profile else "",
-        specialisation=" (%s)" % specialisation if specialisation else "",
-    )
-    description = f"Generation {generation} {bootspec.label}, built on {build_date}"
-    boot_entry = [
-        f"title {title}",
-        f"version {description}",
-        f"linux /{str(kernel.path)}",
-        f"initrd /{str(initrd.path)}",
-        f"options {kernel_params}",
-        f"machine-id {machine_id}" if machine_id is not None else None,
-        f"devicetree /{str(devicetree.path)}" if devicetree is not None else None,
-        f"sort-key {bootspec.sortKey}",
-    ]
-    contents = "\n".join(filter(None, boot_entry))
-    entry, bootctl_id = BootFile.from_entry(contents.encode("utf-8"))
-    return (list(filter(None, [kernel, initrd, devicetree, entry])), bootctl_id)
+        specialisation=" (%s)" % specialisation if specialisation else "")
+
+    try:
+        if bootspec.initrdSecrets is not None:
+            run([bootspec.initrdSecrets, BOOT_MOUNT_POINT / initrd])
+    except subprocess.CalledProcessError:
+        if current:
+            print("failed to create initrd secrets!", file=sys.stderr)
+            sys.exit(1)
+        else:
+            print("warning: failed to create initrd secrets "
+                  f'for "{title} - Configuration {generation}", an older generation', file=sys.stderr)
+            print("note: this is normal after having removed "
+                  "or renamed a file in `boot.initrd.secrets`", file=sys.stderr)
+    entry_file = BOOT_MOUNT_POINT / "loader/entries" / generation_conf_filename(profile, generation, specialisation)
+    tmp_path = entry_file.with_suffix(".tmp")
+    kernel_params = "init=%s " % bootspec.init
+
+    kernel_params = kernel_params + " ".join(bootspec.kernelParams)
+    build_time = int(system_dir(profile, generation, specialisation).stat().st_ctime)
+    build_date = datetime.datetime.fromtimestamp(build_time).strftime('%F')
+
+    with tmp_path.open("w") as f:
+        f.write(BOOT_ENTRY.format(title=title,
+                    sort_key=bootspec.sortKey,
+                    generation=generation,
+                    kernel=f"/{kernel}",
+                    initrd=f"/{initrd}",
+                    kernel_params=kernel_params,
+                    description=f"{bootspec.label}, built on {build_date}"))
+        if machine_id is not None:
+            f.write("machine-id %s\n" % machine_id)
+        if devicetree is not None:
+            f.write(f"devicetree /{devicetree}\n")
+        f.flush()
+        os.fsync(f.fileno())
+    tmp_path.rename(entry_file)
 
 
 def get_generations(profile: str | None = None) -> list[SystemIdentifier]:
@@ -412,15 +245,43 @@ def get_generations(profile: str | None = None) -> list[SystemIdentifier]:
     configurationLimit = CONFIGURATION_LIMIT
     configurations = [
         SystemIdentifier(
-            profile=profile, generation=int(line.split()[0]), specialisation=None
+            profile=profile,
+            generation=int(line.split()[0]),
+            specialisation=None
         )
         for line in gen_lines
     ]
     return configurations[-configurationLimit:]
 
 
+def remove_old_entries(gens: list[SystemIdentifier]) -> None:
+    rex_profile = re.compile(r"^nixos-(.*)-generation-.*\.conf$")
+    rex_generation = re.compile(r"^nixos.*-generation-([0-9]+)(-specialisation-.*)?\.conf$")
+    known_paths = []
+    for gen in gens:
+        bootspec = get_bootspec(gen.profile, gen.generation)
+        known_paths.append(copy_from_file(bootspec.kernel, True).name)
+        known_paths.append(copy_from_file(bootspec.initrd, True).name)
+        if bootspec.devicetree is not None:
+            known_paths.append(copy_from_file(bootspec.devicetree, True).name)
+    for path in (BOOT_MOUNT_POINT / "loader/entries").glob("nixos*-generation-[1-9]*.conf", case_sensitive=False):
+        if rex_profile.match(path.name):
+            prof = rex_profile.sub(r"\1", path.name)
+        else:
+            prof = None
+        try:
+            gen_number = int(rex_generation.sub(r"\1", path.name))
+        except ValueError:
+            continue
+        if (prof, gen_number, None) not in gens:
+            path.unlink()
+    for path in (BOOT_MOUNT_POINT / NIXOS_DIR).iterdir():
+        if path.name not in known_paths and not path.is_dir():
+            path.unlink()
+
+
 def cleanup_esp() -> None:
-    for path in (EFI_SYS_MOUNT_POINT / "loader" / "entries").glob("nixos*"):
+    for path in (EFI_SYS_MOUNT_POINT / "loader/entries").glob("nixos*"):
         path.unlink()
     nixos_dir = EFI_SYS_MOUNT_POINT / NIXOS_DIR
     if nixos_dir.is_dir():
@@ -430,13 +291,12 @@ def cleanup_esp() -> None:
 def get_profiles() -> list[str]:
     system_profiles = Path("/nix/var/nix/profiles/system-profiles/")
     if system_profiles.is_dir():
-        return [
-            x.name for x in system_profiles.iterdir() if not x.name.endswith("-link")
-        ]
+        return [x.name
+            for x in system_profiles.iterdir()
+            if not x.name.endswith("-link")]
     else:
         return []
 
-
 def install_bootloader(args: argparse.Namespace) -> None:
     try:
         with open("/etc/machine-id") as machine_file:
@@ -447,10 +307,7 @@ def install_bootloader(args: argparse.Namespace) -> None:
         machine_id = None
 
     if os.getenv("NIXOS_INSTALL_GRUB") == "1":
-        warnings.warn(
-            "NIXOS_INSTALL_GRUB env var deprecated, use NIXOS_INSTALL_BOOTLOADER",
-            DeprecationWarning,
-        )
+        warnings.warn("NIXOS_INSTALL_GRUB env var deprecated, use NIXOS_INSTALL_BOOTLOADER", DeprecationWarning)
         os.environ["NIXOS_INSTALL_BOOTLOADER"] = "1"
 
     # flags to pass to bootctl install/update
@@ -459,10 +316,10 @@ def install_bootloader(args: argparse.Namespace) -> None:
     if BOOT_MOUNT_POINT != EFI_SYS_MOUNT_POINT:
         bootctl_flags.append(f"--boot-path={BOOT_MOUNT_POINT}")
 
-    if not CAN_TOUCH_EFI_VARIABLES:
+    if CAN_TOUCH_EFI_VARIABLES != "1":
         bootctl_flags.append("--no-variables")
 
-    if GRACEFUL:
+    if GRACEFUL == "1":
         bootctl_flags.append("--graceful")
 
     if os.getenv("NIXOS_INSTALL_BOOTLOADER") == "1":
@@ -494,18 +351,13 @@ def install_bootloader(args: argparse.Namespace) -> None:
         #  ESP: /boot (/dev/disk/by-partuuid/9b39b4c4-c48b-4ebf-bfea-a56b2395b7e0)
         # File: ├─/EFI/systemd/HashTool.efi
         #       └─/EFI/systemd/systemd-bootx64.efi (systemd-boot 255.2)
-        installed_match = re.search(
-            r"^\W+.*/EFI/(?:BOOT|systemd)/.*\.efi \(systemd-boot ([\d.]+[^)]*)\)$",
-            installed_out,
-            re.IGNORECASE | re.MULTILINE,
-        )
+        installed_match = re.search(r"^\W+.*/EFI/(?:BOOT|systemd)/.*\.efi \(systemd-boot ([\d.]+[^)]*)\)$",
+                      installed_out, re.IGNORECASE | re.MULTILINE)
 
         available_match = re.search(r"^\((.*)\)$", available_out)
 
         if installed_match is None:
-            raise Exception(
-                "Could not find any previously installed systemd-boot. If you are switching to systemd-boot from a different bootloader, you need to run `nixos-rebuild switch --install-bootloader`"
-            )
+            raise Exception("Could not find any previously installed systemd-boot. If you are switching to systemd-boot from a different bootloader, you need to run `nixos-rebuild switch --install-bootloader`")
 
         if available_match is None:
             raise Exception("could not determine systemd-boot version")
@@ -514,11 +366,7 @@ def install_bootloader(args: argparse.Namespace) -> None:
         available_version = available_match.group(1)
 
         if installed_version < available_version:
-            print(
-                "updating systemd-boot from %s to %s"
-                % (installed_version, available_version),
-                file=sys.stderr,
-            )
+            print("updating systemd-boot from %s to %s" % (installed_version, available_version), file=sys.stderr)
             run(
                 [f"{SYSTEMD}/bin/bootctl", f"--esp-path={EFI_SYS_MOUNT_POINT}"]
                 + bootctl_flags
@@ -532,56 +380,24 @@ def install_bootloader(args: argparse.Namespace) -> None:
     for profile in get_profiles():
         gens += get_generations(profile)
 
-    if not gens:
-        # With zero generations we would garbage-collect every kernel,
-        # initrd and loader entry off the ESP, leaving the system
-        # unbootable.
-        print(
-            "error: no system generations found in /nix/var/nix/profiles, "
-            "refusing to remove all boot loader entries",
-            file=sys.stderr,
-        )
-        sys.exit(1)
-
-    boot_files: BootFileList = []
-    critical_paths: set[Path] = set()
-
-    default_config = Path(args.default_config)
-    default_entry_id: str | None = None
+    remove_old_entries(gens)
 
     for gen in gens:
-        bootspec = get_bootspec(gen.profile, gen.generation)
-        is_default = Path(bootspec.init).parent == default_config
-        new_boot_files, new_bootctl_id = boot_file(*gen, machine_id, bootspec)
-        boot_files.extend(new_boot_files)
-        if is_default:
-            default_entry_id = new_bootctl_id
-            critical_paths.update(bf.path for bf in new_boot_files)
-        for specialisation_name, specialisation in bootspec.specialisations.items():
-            is_default = Path(specialisation.init).parent == default_config
-            new_boot_files, new_bootctl_id = boot_file(
-                gen.profile,
-                gen.generation,
-                specialisation_name,
-                machine_id,
-                bootspec,
-            )
-            boot_files.extend(new_boot_files)
+        try:
+            bootspec = get_bootspec(gen.profile, gen.generation)
+            is_default = Path(bootspec.init).parent == Path(args.default_config)
+            write_entry(*gen, machine_id, bootspec, current=is_default)
+            for specialisation in bootspec.specialisations.keys():
+                write_entry(gen.profile, gen.generation, specialisation, machine_id, bootspec, current=is_default)
             if is_default:
-                default_entry_id = new_bootctl_id
-                critical_paths.update(bf.path for bf in new_boot_files)
-
-    # Garbage-collect stale kernels/initrds/entries before re-populating extra
-    # files, so that user-supplied extraEntries (which may also live under
-    # loader/entries and start with `nixos-`) are not removed again.
-    garbage_collect(boot_files)
-
-    write_boot_files(boot_files, critical_paths)
-
-    write_loader_conf(default_entry_id)
-
-    remove_extra_files()
-    run([COPY_EXTRA_FILES])
+                write_loader_conf(*gen)
+        except OSError as e:
+            # See https://github.com/NixOS/nixpkgs/issues/114552
+            if e.errno == errno.EINVAL:
+                profile = f"profile '{gen.profile}'" if gen.profile else "default profile"
+                print("ignoring {} in the list of boot entries because of the following error:\n{}".format(profile, e), file=sys.stderr)
+            else:
+                raise e
 
     if BOOT_MOUNT_POINT != EFI_SYS_MOUNT_POINT:
         # Cleanup any entries in ESP if xbootldrMountPoint is set.
@@ -589,8 +405,6 @@ def install_bootloader(args: argparse.Namespace) -> None:
         # automatically, as we don't have information about the mount point anymore.
         cleanup_esp()
 
-
-def remove_extra_files() -> None:
     extra_files_dir = BOOT_MOUNT_POINT / NIXOS_DIR / ".extra-files"
     for root, _, files in extra_files_dir.walk(top_down=False):
         relative_root = root.relative_to(extra_files_dir)
@@ -607,45 +421,12 @@ def remove_extra_files() -> None:
 
     extra_files_dir.mkdir(parents=True, exist_ok=True)
 
-
-def garbage_collect(gc_roots: BootFileList) -> None:
-    keep = {BOOT_MOUNT_POINT / gc_root.path for gc_root in gc_roots}
-
-    def delete_path(e: os.DirEntry) -> None:
-        if e.is_file(follow_symlinks=True) and Path(e.path) not in keep:
-            os.remove(e.path)
-
-    for e in os.scandir(BOOT_MOUNT_POINT / NIXOS_DIR):
-        delete_path(e)
-
-    for e in os.scandir(BOOT_MOUNT_POINT / "loader" / "entries"):
-        match = re.fullmatch(r"nixos-.+\.conf", e.name)
-        if match:
-            delete_path(e)
-
-
-def write_boot_files(boot_files: BootFileList, critical_paths: set[Path]) -> None:
-    # Deduplicate by destination path so shared files are written once.
-    seen: set[Path] = set()
-    for boot_file in boot_files:
-        if boot_file.path in seen:
-            continue
-        seen.add(boot_file.path)
-        boot_file.writer.write_boot_file(
-            BOOT_MOUNT_POINT / boot_file.path,
-            critical=boot_file.path in critical_paths,
-        )
+    run([COPY_EXTRA_FILES])
 
 
 def main() -> None:
-    parser = argparse.ArgumentParser(
-        description=f"Update {DISTRO_NAME}-related systemd-boot files"
-    )
-    parser.add_argument(
-        "default_config",
-        metavar="DEFAULT-CONFIG",
-        help=f"The default {DISTRO_NAME} config to boot",
-    )
+    parser = argparse.ArgumentParser(description=f"Update {DISTRO_NAME}-related systemd-boot files")
+    parser.add_argument('default_config', metavar='DEFAULT-CONFIG', help=f"The default {DISTRO_NAME} config to boot")
     args = parser.parse_args()
 
     run([CHECK_MOUNTPOINTS])
@@ -659,18 +440,13 @@ def main() -> None:
         # event sync the efi filesystem after each update.
         rc = libc.syncfs(os.open(f"{BOOT_MOUNT_POINT}", os.O_RDONLY))
         if rc != 0:
-            print(
-                f"could not sync {BOOT_MOUNT_POINT}: {os.strerror(rc)}", file=sys.stderr
-            )
+            print(f"could not sync {BOOT_MOUNT_POINT}: {os.strerror(rc)}", file=sys.stderr)
 
         if BOOT_MOUNT_POINT != EFI_SYS_MOUNT_POINT:
             rc = libc.syncfs(os.open(EFI_SYS_MOUNT_POINT, os.O_RDONLY))
             if rc != 0:
-                print(
-                    f"could not sync {EFI_SYS_MOUNT_POINT}: {os.strerror(rc)}",
-                    file=sys.stderr,
-                )
+                print(f"could not sync {EFI_SYS_MOUNT_POINT}: {os.strerror(rc)}", file=sys.stderr)
 
 
-if __name__ == "__main__":
+if __name__ == '__main__':
     main()

nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix

@@ -97,9 +97,6 @@ let
           '') cfg.extraEntries
         )}
       '';
-
-      bootCountingTries = cfg.bootCounting.tries;
-      bootCounting = if cfg.bootCounting.enable then "True" else "False";
     };
   };
 
@@ -420,26 +417,6 @@ in
       '';
     };
 
-    bootCounting = {
-      enable = mkEnableOption ''
-        [Automatic Boot Assessment](https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT/).
-
-        New boot entries are written with a boot counter in the file name. On
-        each boot, systemd-boot decrements the counter; once the booted system
-        reaches `boot-complete.target`, `systemd-bless-boot.service` removes the
-        counter and marks the entry as good. An entry whose counter reaches zero
-        is considered bad and will be skipped in favour of an older generation
-      '';
-      tries = mkOption {
-        default = 3;
-        type = types.ints.positive;
-        description = ''
-          Number of boot attempts a freshly written entry is given before it is
-          considered bad.
-        '';
-      };
-    };
-
     rebootForBitlocker = mkOption {
       default = false;
 

nixos/modules/system/boot/timesyncd.nix

@@ -1,37 +1,26 @@
-{
-  config,
-  lib,
-  utils,
-  ...
-}:
+{ config, lib, ... }:
+
+with lib;
 
 let
   cfg = config.services.timesyncd;
 in
 {
 
-  imports = [
-    (lib.mkRemovedOptionModule [
-      "services"
-      "timesyncd"
-      "extraConfig"
-    ] "Use services.timesyncd.settings.Time instead.")
-  ];
-
   options = {
 
-    services.timesyncd = {
-      enable = lib.mkOption {
+    services.timesyncd = with types; {
+      enable = mkOption {
         default = !config.boot.isContainer;
-        defaultText = lib.literalExpression "!config.boot.isContainer";
-        type = lib.types.bool;
+        defaultText = literalExpression "!config.boot.isContainer";
+        type = bool;
         description = ''
           Enables the systemd NTP client daemon.
         '';
       };
-      servers = lib.mkOption {
+      servers = mkOption {
         default = null;
-        type = lib.types.nullOr (lib.types.listOf lib.types.str);
+        type = nullOr (listOf str);
         description = ''
           The set of NTP servers from which to synchronise.
 
@@ -42,10 +31,10 @@ in
           See {manpage}`timesyncd.conf(5)` for details.
         '';
       };
-      fallbackServers = lib.mkOption {
+      fallbackServers = mkOption {
         default = config.networking.timeServers;
-        defaultText = lib.literalExpression "config.networking.timeServers";
-        type = lib.types.nullOr (lib.types.listOf lib.types.str);
+        defaultText = literalExpression "config.networking.timeServers";
+        type = nullOr (listOf str);
         description = ''
           The set of fallback NTP servers from which to synchronise.
 
@@ -56,23 +45,21 @@ in
           See {manpage}`timesyncd.conf(5)` for details.
         '';
       };
-      settings.Time = lib.mkOption {
-        default = { };
-        type = lib.types.submodule {
-          freeformType = lib.types.attrsOf utils.systemdUtils.unitOptions.unitOption;
-        };
-        example = {
-          PollIntervalMaxSec = 180;
-        };
+      extraConfig = mkOption {
+        default = "";
+        type = lines;
+        example = ''
+          PollIntervalMaxSec=180
+        '';
         description = ''
-          Settings for systemd-timesyncd. See {manpage}`timesyncd.conf(5)` for
-          available options.
+          Extra config options for systemd-timesyncd. See
+          {manpage}`timesyncd.conf(5)` for available options.
         '';
       };
     };
   };
 
-  config = lib.mkIf cfg.enable {
+  config = mkIf cfg.enable {
 
     systemd.additionalUpstreamSystemUnits = [ "systemd-timesyncd.service" ];
 
@@ -89,17 +76,16 @@ in
       environment.LD_LIBRARY_PATH = config.system.nssModules.path;
     };
 
-    services.timesyncd.settings.Time = lib.mkMerge [
-      (lib.mkIf (cfg.servers != null) {
-        NTP = lib.mkDefault (lib.concatStringsSep " " cfg.servers);
-      })
-      (lib.mkIf (cfg.fallbackServers != null) {
-        FallbackNTP = lib.mkDefault (lib.concatStringsSep " " cfg.fallbackServers);
-      })
-    ];
-
-    environment.etc."systemd/timesyncd.conf".text =
-      utils.systemdUtils.lib.settingsToSections cfg.settings;
+    environment.etc."systemd/timesyncd.conf".text = ''
+      [Time]
+    ''
+    + optionalString (cfg.servers != null) ''
+      NTP=${concatStringsSep " " cfg.servers}
+    ''
+    + optionalString (cfg.fallbackServers != null) ''
+      FallbackNTP=${concatStringsSep " " cfg.fallbackServers}
+    ''
+    + cfg.extraConfig;
 
     users.users.systemd-timesync = {
       uid = config.ids.uids.systemd-timesync;

nixos/modules/system/etc/etc-activation.nix

@@ -173,18 +173,5 @@
 
     })
 
-    (lib.mkIf (config.system.etc.overlay.enable && !config.system.etc.overlay.mutable) {
-      # Systemd requires /etc/machine-id exists or can be initialized on first
-      # boot. This file should not be part of an image or system config because
-      # it is unique to the machine, so it is initialized at first boot and
-      # persisted in the system state directory, /var/lib/nixos.
-      environment.etc."machine-id".source = lib.mkDefault "/var/lib/nixos/machine-id";
-      boot.initrd.systemd.tmpfiles.settings.machine-id."/sysroot/var/lib/nixos/machine-id".f =
-        lib.mkDefault
-          {
-            argument = "uninitialized";
-          };
-    })
-
   ];
 }