···7 pull_request_target:
8 branches:
9 - master
010 paths:
11 - "nixos/**"
12 # Also build when the nixpkgs doc changed, since we take things like
···5253 - name: Build NixOS manual
54 id: build-manual
55- run: NIX_PATH=nixpkgs=$(pwd)/untrusted nix-build --option restrict-eval true untrusted/ci -A manual-nixos --argstr system ${{ matrix.system }}
5657 - name: Upload NixOS manual
58 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
···7 pull_request_target:
8 branches:
9 - master
10+ - release-*
11 paths:
12 - "nixos/**"
13 # Also build when the nixpkgs doc changed, since we take things like
···5354 - name: Build NixOS manual
55 id: build-manual
56+ run: nix-build untrusted/ci -A manual-nixos --argstr system ${{ matrix.system }}
5758 - name: Upload NixOS manual
59 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+7
ci/check-cherry-picks.md
···0000000
···1+This report is automatically generated by the `check-cherry-picks` CI workflow.
2+3+Some of the commits in this PR have not been cherry-picked exactly and require the author's and reviewer's attention.
4+5+Please make sure to follow the [backporting guidelines](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#how-to-backport-pull-requests) and cherry-pick with the `-x` flag. This requires changes to go to the unstable branches (`master` / `staging`) first, before backporting them.
6+7+Occasionally, it is not possible to cherry-pick exactly the same patch. This most frequently happens when resolving merge conflicts while cherry-picking or when updating minor versions of packages which have already advanced to the next major on unstable. If you need to merge this PR despite the warnings, please [dismiss](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review) this review.
+73-37
ci/check-cherry-picks.sh
···1#!/usr/bin/env bash
2# Find alleged cherry-picks
34-set -eo pipefail
56-if [ $# != "2" ] ; then
7- echo "usage: check-cherry-picks.sh base_rev head_rev"
8 exit 2
9fi
1000011# Make sure we are inside the nixpkgs repo, even when called from outside
12cd "$(dirname "${BASH_SOURCE[0]}")"
13···1920commits="$(git rev-list --reverse "$1..$2")"
210000000000000000000000000000000000022while read -r new_commit_sha ; do
23- if [ -z "$new_commit_sha" ] ; then
24- continue # skip empty lines
25- fi
26- if [ "$GITHUB_ACTIONS" = 'true' ] ; then
27 echo "::group::Commit $new_commit_sha"
28 else
29 echo "================================================="
···37 | grep -Eoi -m1 '[0-9a-f]{40}' || true
38 )
39 if [ -z "$original_commit_sha" ] ; then
40- if [ "$GITHUB_ACTIONS" = 'true' ] ; then
41- echo ::endgroup::
42- echo -n "::error ::"
43- else
44- echo -n " ✘ "
45- fi
46- echo "Couldn't locate original commit hash in message"
47- echo "Note this should not necessarily be treated as a hard fail, but a reviewer's attention should" \
48- "be drawn to it and github actions have no way of doing that but to raise a 'failure'"
49 problem=1
50 continue
51 fi
···6566 while read -r picked_branch ; do
67 if git merge-base --is-ancestor "$original_commit_sha" "$picked_branch" ; then
68- echo " ✔ $original_commit_sha present in branch $picked_branch"
69-70 range_diff_common='git --no-pager range-diff
71 --no-notes
72 --creation-factor=100
···75 '
7677 if $range_diff_common --no-color 2> /dev/null | grep -E '^ {4}[+-]{2}' > /dev/null ; then
78- if [ "$GITHUB_ACTIONS" = 'true' ] ; then
79- echo ::endgroup::
80- echo -n "::warning ::"
81- else
82- echo -n " ⚠ "
000000000000000083 fi
84- echo "Difference between $new_commit_sha and original $original_commit_sha may warrant inspection:"
85-86- $range_diff_common --color
8788- echo "Note this should not necessarily be treated as a hard fail, but a reviewer's attention should" \
89- "be drawn to it and github actions have no way of doing that but to raise a 'failure'"
90 problem=1
91 else
92- echo " ✔ $original_commit_sha highly similar to $new_commit_sha"
093 $range_diff_common --color
94- [ "$GITHUB_ACTIONS" = 'true' ] && echo ::endgroup::
95 fi
9697 # move on to next commit
···100 done <<< "$branches"
101 done
102103- if [ "$GITHUB_ACTIONS" = 'true' ] ; then
104- echo ::endgroup::
105- echo -n "::error ::"
106- else
107- echo -n " ✘ "
108- fi
109- echo "$original_commit_sha not found in any pickable branch"
110111 problem=1
112done <<< "$commits"
···1#!/usr/bin/env bash
2# Find alleged cherry-picks
34+set -euo pipefail
56+if [[ $# != "2" && $# != "3" ]] ; then
7+ echo "usage: check-cherry-picks.sh base_rev head_rev [markdown_file]"
8 exit 2
9fi
1011+markdown_file="$(realpath ${3:-/dev/null})"
12+[ -v 3 ] && rm -f "$markdown_file"
13+14# Make sure we are inside the nixpkgs repo, even when called from outside
15cd "$(dirname "${BASH_SOURCE[0]}")"
16···2223commits="$(git rev-list --reverse "$1..$2")"
2425+log() {
26+ type="$1"
27+ shift 1
28+29+ local -A prefix
30+ prefix[success]=" ✔ "
31+ if [ -v GITHUB_ACTIONS ]; then
32+ prefix[warning]="::warning::"
33+ prefix[error]="::error::"
34+ else
35+ prefix[warning]=" ⚠ "
36+ prefix[error]=" ✘ "
37+ fi
38+39+ echo "${prefix[$type]}$@"
40+41+ # Only logging errors and warnings, which allows comparing the markdown file
42+ # between pushes to the PR. Even if a new, proper cherry-pick, commit is added
43+ # it won't change the markdown file's content and thus not trigger another comment.
44+ if [ "$type" != "success" ]; then
45+ local -A alert
46+ alert[warning]="WARNING"
47+ alert[error]="CAUTION"
48+ echo >> $markdown_file
49+ echo "> [!${alert[$type]}]" >> $markdown_file
50+ echo "> $@" >> $markdown_file
51+ fi
52+}
53+54+endgroup() {
55+ if [ -v GITHUB_ACTIONS ] ; then
56+ echo ::endgroup::
57+ fi
58+}
59+60while read -r new_commit_sha ; do
61+ if [ -v GITHUB_ACTIONS ] ; then
00062 echo "::group::Commit $new_commit_sha"
63 else
64 echo "================================================="
···72 | grep -Eoi -m1 '[0-9a-f]{40}' || true
73 )
74 if [ -z "$original_commit_sha" ] ; then
75+ endgroup
76+ log warning "Couldn't locate original commit hash in message of $new_commit_sha."
000000077 problem=1
78 continue
79 fi
···9394 while read -r picked_branch ; do
95 if git merge-base --is-ancestor "$original_commit_sha" "$picked_branch" ; then
0096 range_diff_common='git --no-pager range-diff
97 --no-notes
98 --creation-factor=100
···101 '
102103 if $range_diff_common --no-color 2> /dev/null | grep -E '^ {4}[+-]{2}' > /dev/null ; then
104+ log success "$original_commit_sha present in branch $picked_branch"
105+ endgroup
106+ log warning "Difference between $new_commit_sha and original $original_commit_sha may warrant inspection."
107+108+ # First line contains commit SHAs, which we already printed.
109+ $range_diff_common --color | tail -n +2
110+111+ echo -e "> <details><summary>Show diff</summary>\n>" >> $markdown_file
112+ echo '> ```diff' >> $markdown_file
113+ # The output of `git range-diff` is indented with 4 spaces, which we need to match with the
114+ # code blocks indent to get proper syntax highlighting on GitHub.
115+ diff="$($range_diff_common | tail -n +2 | sed -Ee 's/^ {4}/> /g')"
116+ # Also limit the output to 10k bytes (and remove the last, potentially incomplete line), because
117+ # GitHub comments are limited in length. The value of 10k is arbitrary with the assumption, that
118+ # after the range-diff becomes a certain size, a reviewer is better off reviewing the regular diff
119+ # in GitHub's UI anyway, thus treating the commit as "new" and not cherry-picked.
120+ # Note: This could still lead to a too lengthy comment with multiple commits touching the limit. We
121+ # consider this too unlikely to happen, to deal with explicitly.
122+ max_length=10000
123+ if [ "${#diff}" -gt $max_length ]; then
124+ printf -v diff "%s\n\n[...truncated...]" "$(echo "$diff" | head -c $max_length | head -n-1)"
125 fi
126+ echo "$diff" >> $markdown_file
127+ echo '> ```' >> $markdown_file
128+ echo "> </details>" >> $markdown_file
12900130 problem=1
131 else
132+ log success "$original_commit_sha present in branch $picked_branch"
133+ log success "$original_commit_sha highly similar to $new_commit_sha"
134 $range_diff_common --color
135+ endgroup
136 fi
137138 # move on to next commit
···141 done <<< "$branches"
142 done
143144+ endgroup
145+ log error "$original_commit_sha given in $new_commit_sha not found in any pickable branch."
00000146147 problem=1
148done <<< "$commits"
···1+# udevCheckHook {#udevcheckhook}
2+3+The `udevCheckHook` derivation adds `udevCheckPhase` to the [`preInstallCheckHooks`](#ssec-installCheck-phase),
4+which finds all udev rules in all outputs and verifies them using `udevadm verify --resolve-names=never --no-style`.
5+It should be used in any package that has udev rules outputs to ensure the rules are and stay valid.
6+7+The hook runs in `installCheckPhase`, requiring `doInstallCheck` is enabled for the hook to take effect:
8+```nix
9+{
10+ lib,
11+ stdenv,
12+ udevCheckHook,
13+# ...
14+}:
15+16+stdenv.mkDerivation (finalAttrs: {
17+ # ...
18+19+ nativeInstallCheckInputs = [
20+ udevCheckHook
21+ ];
22+ doInstallCheck = true;
23+24+ # ...
25+})
26+```
27+Note that for [`buildPythonPackage`](#buildpythonpackage-function) and [`buildPythonApplication`](#buildpythonapplication-function), `doInstallCheck` is enabled by default.
28+29+All outputs are scanned for their `/{etc,lib}/udev/rules.d` paths.
30+If no rule output is found, the hook is basically a no-op.
31+32+The `udevCheckHook` adds a dependency on `systemdMinimal`.
33+It is internally guarded behind `hostPlatform` supporting udev and `buildPlatform` being able to execute `udevadm`.
34+The hook does not need explicit platform checks in the places where it is used.
35+36+The hook can be disabled using `dontUdevCheck`, which is necessary if you want to run some different task in `installCheckPhase` on a package with broken udev rule outputs.
···7 config,
8 lib,
9 pkgs,
10+ utils,
11 ...
12}:
1314let
15 cfg = config.services.desktopManager.cosmic;
16+ excludedCorePkgs = lib.lists.intersectLists corePkgs config.environment.cosmic.excludePackages;
17+ # **ONLY ADD PACKAGES WITHOUT WHICH COSMIC CRASHES, NOTHING ELSE**
18+ corePkgs =
19+ with pkgs;
20+ [
21+ cosmic-applets
22+ cosmic-applibrary
23+ cosmic-bg
24+ cosmic-comp
25+ cosmic-files
26+ config.services.displayManager.cosmic-greeter.package
27+ cosmic-idle
28+ cosmic-launcher
29+ cosmic-notifications
30+ cosmic-osd
31+ cosmic-panel
32+ cosmic-session
33+ cosmic-settings
34+ cosmic-settings-daemon
35+ cosmic-workspaces-epoch
36+ ]
37+ ++ lib.optionals cfg.xwayland.enable [
38+ # Why would you want to enable XWayland but exclude the package
39+ # providing XWayland support? Doesn't make sense. Add `xwayland` to the
40+ # `corePkgs` list.
41+ xwayland
42+ ];
43in
44{
45 meta.maintainers = lib.teams.cosmic.members;
···48 services.desktopManager.cosmic = {
49 enable = lib.mkEnableOption "Enable the COSMIC desktop environment";
5051+ showExcludedPkgsWarning = lib.mkEnableOption "Disable the warning for excluding core packages." // {
52+ default = true;
53+ };
54+55 xwayland.enable = lib.mkEnableOption "Xwayland support for the COSMIC compositor" // {
56 default = true;
57 };
58+ };
59+60+ environment.cosmic.excludePackages = lib.mkOption {
61+ description = "List of packages to exclude from the COSMIC environment.";
62+ type = lib.types.listOf lib.types.package;
63+ default = [ ];
64+ example = lib.literalExpression "[ pkgs.cosmic-player ]";
65 };
66 };
67···71 "/share/backgrounds"
72 "/share/cosmic"
73 ];
74+ environment.systemPackages = utils.removePackagesByName (
75+ corePkgs
76+ ++ (
77+ with pkgs;
78+ [
79+ adwaita-icon-theme
80+ alsa-utils
81+ cosmic-edit
82+ cosmic-icons
83+ cosmic-player
84+ cosmic-randr
85+ cosmic-screenshot
86+ cosmic-term
87+ cosmic-wallpapers
88+ hicolor-icon-theme
89+ playerctl
90+ pop-icon-theme
91+ pop-launcher
92+ xdg-user-dirs
93+ ]
94+ ++ lib.optionals config.services.flatpak.enable [
95+ # User may have Flatpaks enabled but might not want the `cosmic-store` package.
96+ cosmic-store
97+ ]
98+ )
99+ ) config.environment.cosmic.excludePackages;
0000000000000100101 # Distro-wide defaults for graphical sessions
102 services.graphical-desktop.enable = true;
···157 services.power-profiles-daemon.enable = lib.mkDefault (
158 !config.hardware.system76.power-daemon.enable
159 );
160+161+ warnings = lib.optionals (cfg.showExcludedPkgsWarning && excludedCorePkgs != [ ]) [
162+ ''
163+ The `environment.cosmic.excludePackages` option was used to exclude some
164+ packages from the environment which also includes some packages that the
165+ maintainers of the COSMIC DE deem necessary for the COSMIC DE to start
166+ and initialize. Excluding said packages creates a high probability that
167+ the COSMIC DE will fail to initialize properly, or completely. This is an
168+ unsupported use case. If this was not intentional, please assign an empty
169+ list to the `environment.cosmic.excludePackages` option. If you want to
170+ exclude non-essential packages, please look at the NixOS module for the
171+ COSMIC DE and look for the essential packages in the `corePkgs` list.
172+173+ You can stop this warning from appearing by setting the option
174+ `services.desktopManager.cosmic.showExcludedPkgsWarning` to `false`.
175+ ''
176+ ];
177 };
178}
+12-16
nixos/modules/services/mail/stalwart-mail.nix
···31 default = false;
32 description = ''
33 Whether to open TCP firewall ports, which are specified in
34- {option}`services.stalwart-mail.settings.listener` on all interfaces.
35 '';
36 };
37···107 resolver.public-suffix = lib.mkDefault [
108 "file://${pkgs.publicsuffix-list}/share/publicsuffix/public_suffix_list.dat"
109 ];
110- config = {
111- spam-filter.resource = lib.mkDefault "file://${cfg.package}/etc/stalwart/spamfilter.toml";
112- webadmin =
113- let
114- hasHttpListener = builtins.any (listener: listener.protocol == "http") (
115- lib.attrValues cfg.settings.server.listener
116- );
117- in
118- {
119- path = "/var/cache/stalwart-mail";
120- }
121- // lib.optionalAttrs ((builtins.hasAttr "listener" cfg.settings.server) && hasHttpListener) {
122- resource = lib.mkDefault "file://${cfg.package.webadmin}/webadmin.zip";
123- };
124- };
125 };
126127 # This service stores a potentially large amount of data.
···31 default = false;
32 description = ''
33 Whether to open TCP firewall ports, which are specified in
34+ {option}`services.stalwart-mail.settings.server.listener` on all interfaces.
35 '';
36 };
37···107 resolver.public-suffix = lib.mkDefault [
108 "file://${pkgs.publicsuffix-list}/share/publicsuffix/public_suffix_list.dat"
109 ];
110+ spam-filter.resource = lib.mkDefault "file://${cfg.package}/etc/stalwart/spamfilter.toml";
111+ webadmin =
112+ let
113+ hasHttpListener = builtins.any (listener: listener.protocol == "http") (
114+ lib.attrValues (cfg.settings.server.listener or { })
115+ );
116+ in
117+ {
118+ path = "/var/cache/stalwart-mail";
119+ resource = lib.mkIf (hasHttpListener) (lib.mkDefault "file://${cfg.package.webadmin}/webadmin.zip");
120+ };
0000121 };
122123 # This service stores a potentially large amount of data.
···78buildGoModule rec {
9 pname = "melange";
10- version = "0.24.0";
1112 src = fetchFromGitHub {
13 owner = "chainguard-dev";
14 repo = "melange";
15 rev = "v${version}";
16- hash = "sha256-LlcPkxTeT1jD6PTj22Jn4T6kD8HBuw58LXhEdX5MDtk=";
17 # populate values that require us to use git. By doing this in postFetch we
18 # can delete .git afterwards and maintain better reproducibility of the src.
19 leaveDotGit = true;
···78buildGoModule rec {
9 pname = "melange";
10+ version = "0.26.0";
1112 src = fetchFromGitHub {
13 owner = "chainguard-dev";
14 repo = "melange";
15 rev = "v${version}";
16+ hash = "sha256-tdZsroG5rwOr+rMA3PPv/XVK1ubqZAu3v75zEa3wQpY=";
17 # populate values that require us to use git. By doing this in postFetch we
18 # can delete .git afterwards and maintain better reproducibility of the src.
19 leaveDotGit = true;
···278 homepage = "https://github.com/HarbourMasters/Shipwright";
279 description = "A PC port of Ocarina of Time with modern controls, widescreen, high-resolution, and more";
280 mainProgram = "soh";
281- platforms = [ "x86_64-linux" ] ++ lib.platforms.darwin;
282 maintainers = with lib.maintainers; [
283 j0lol
284 matteopacini
···278 homepage = "https://github.com/HarbourMasters/Shipwright";
279 description = "A PC port of Ocarina of Time with modern controls, widescreen, high-resolution, and more";
280 mainProgram = "soh";
281+ platforms = lib.platforms.linux ++ lib.platforms.darwin;
282 maintainers = with lib.maintainers; [
283 j0lol
284 matteopacini
···448 CoinMP = coinmp; # Added 2024-06-12
449 collada-dom = opencollada; # added 2024-02-21
450 colorpicker = throw "'colorpicker' has been removed due to lack of maintenance upstream. Consider using 'xcolor', 'gcolor3', 'eyedropper' or 'gpick' instead"; # Added 2024-10-19
0451 coriander = throw "'coriander' has been removed because it depends on GNOME 2 libraries"; # Added 2024-06-27
452 corretto19 = throw "Corretto 19 was removed as it has reached its end of life"; # Added 2024-08-01
453 cosmic-tasks = tasks; # Added 2024-07-04
···448 CoinMP = coinmp; # Added 2024-06-12
449 collada-dom = opencollada; # added 2024-02-21
450 colorpicker = throw "'colorpicker' has been removed due to lack of maintenance upstream. Consider using 'xcolor', 'gcolor3', 'eyedropper' or 'gpick' instead"; # Added 2024-10-19
451+ connman-ncurses = throw "'connman-ncurses' has been removed due to lack of maintenance upstream."; # Added 2025-05-27
452 coriander = throw "'coriander' has been removed because it depends on GNOME 2 libraries"; # Added 2024-06-27
453 corretto19 = throw "Corretto 19 was removed as it has reached its end of life"; # Added 2024-08-01
454 cosmic-tasks = tasks; # Added 2024-07-04