···326326 # Verify additions to this team with at least one already existing member of the team.
327327 members = [
328328 de11n
329329+ despsyched
329330 invokes-su
330331 ];
331332 scope = "Group registration for D. E. Shaw employees who collectively maintain packages.";
···345346 dhall = {
346347 members = [
347348 Gabriella439
348348- ehmry
349349 ];
350350 scope = "Maintain Dhall and related packages.";
351351 shortName = "Dhall";
+3
nixos/doc/manual/release-notes/rl-2505.section.md
···92929393- [Traccar](https://www.traccar.org/), a modern GPS Tracking Platform. Available as [services.traccar](#opt-services.traccar.enable).
94949595+- [Memos](https://www.usememos.com/), a privacy-first, lightweight note-taking solution that allows you to effortlessly capture and share your ideas.
9696+ Available as [services.memos](#opt-services.memos.enable).
9797+9598- [Schroot](https://codeberg.org/shelter/reschroot), a lightweight virtualisation tool. Securely enter a chroot and run a command or login shell. Available as [programs.schroot](#opt-programs.schroot.enable).
969997100- [Firezone](https://firezone.dev), an enterprise-ready zero-trust access platform built on WireGuard. This includes the server stack as [services.firezone.server.enable](#opt-services.firezone.server.enable), a TURN/STUN relay service as [services.firezone.relay.enable](#opt-services.firezone.relay.enable), a gateway service as [services.firezone.gateway.enable](#opt-services.firezone.gateway.enable), a headless client as [services.firezone.headless-client.enable](#opt-services.firezone.headless-client.enable) and a GUI client as [services.firezone.gui-client.enable](#opt-services.firezone.gui-client.enable).
···94949595 dns = {
9696 address = mkOption {
9797- type = types.str;
9898- default = if config.networking.resolvconf.useLocalResolver then "127.0.0.1:53" else null;
9999- defaultText = literalExpression ''
100100- if config.networking.resolvconf.useLocalResolver then
101101- "127.0.0.1:53"
102102- else
103103- null
104104- '';
9797+ type = with types; nullOr str;
9898+ default = null;
9999+ example = "127.0.0.1:53";
105100 description = ''
106106- IP and port to your DNS resolver
101101+ IP and port to your DNS resolver.
102102+103103+ Uses resolvers from /etc/resolv.conf if unset.
107104108105 ::: {.note}
109106 The configured DNS resolver must validate DNSSEC signatures.
+4-4
nixos/modules/services/mail/public-inbox.nix
···630630 ''
631631 + concatStrings (
632632 mapAttrsToList (name: inbox: ''
633633- if [ ! -e ${stateDir}/inboxes/${escapeShellArg name} ]; then
633633+ if [ ! -e ${escapeShellArg inbox.inboxdir} ]; then
634634 # public-inbox-init creates an inbox and adds it to a config file.
635635 # It tries to atomically write the config file by creating
636636 # another file in the same directory, and renaming it.
···643643 ${escapeShellArgs (
644644 [
645645 name
646646- "${stateDir}/inboxes/${name}"
646646+ inbox.inboxdir
647647 inbox.url
648648 ]
649649 ++ inbox.address
···653653 fi
654654655655 ln -sf ${inbox.description} \
656656- ${stateDir}/inboxes/${escapeShellArg name}/description
656656+ ${escapeShellArg inbox.inboxdir}/description
657657658658- export GIT_DIR=${stateDir}/inboxes/${escapeShellArg name}/all.git
658658+ export GIT_DIR=${escapeShellArg inbox.inboxdir}/all.git
659659 if test -d "$GIT_DIR"; then
660660 # Config is inherited by each epoch repository,
661661 # so just needs to be set for all.git.
+199
nixos/modules/services/misc/memos.nix
···11+{
22+ config,
33+ options,
44+ pkgs,
55+ lib,
66+ ...
77+}:
88+let
99+ cfg = config.services.memos;
1010+ opt = options.services.memos;
1111+ envFileFormat = pkgs.formats.keyValue { };
1212+in
1313+{
1414+ options.services.memos = {
1515+ enable = lib.mkEnableOption "Memos note-taking";
1616+ package = lib.mkPackageOption pkgs "Memos" {
1717+ default = "memos";
1818+ };
1919+2020+ openFirewall = lib.mkEnableOption "opening the ports in the firewall";
2121+2222+ user = lib.mkOption {
2323+ type = lib.types.str;
2424+ description = ''
2525+ The user to run Memos as.
2626+2727+ ::: {.note}
2828+ If changing the default value, **you** are responsible of creating the corresponding user with [{option}`users.users`](#opt-users.users).
2929+ :::
3030+ '';
3131+ default = "memos";
3232+ };
3333+3434+ group = lib.mkOption {
3535+ type = lib.types.str;
3636+ description = ''
3737+ The group to run Memos as.
3838+3939+ ::: {.note}
4040+ If changing the default value, **you** are responsible of creating the corresponding group with [{option}`users.groups`](#opt-users.groups).
4141+ :::
4242+ '';
4343+ default = "memos";
4444+ };
4545+4646+ dataDir = lib.mkOption {
4747+ default = "/var/lib/memos/";
4848+ type = lib.types.path;
4949+ description = ''
5050+ Specifies the directory where Memos will store its data.
5151+5252+ ::: {.note}
5353+ It will be automatically created with the permissions of [{option}`services.memos.user`](#opt-services.memos.user) and [{option}`services.memos.group`](#opt-services.memos.group).
5454+ :::
5555+ '';
5656+ };
5757+5858+ settings = lib.mkOption {
5959+ type = envFileFormat.type;
6060+ description = ''
6161+ The environment variables to configure Memos.
6262+6363+ ::: {.note}
6464+ At time of writing, there is no clear documentation about possible values.
6565+ It's possible to convert CLI flags into these variables.
6666+ Example : CLI flag "--unix-sock" converts to {env}`MEMOS_UNIX_SOCK`.
6767+ :::
6868+ '';
6969+ default = {
7070+ MEMOS_MODE = "prod";
7171+ MEMOS_ADDR = "127.0.0.1";
7272+ MEMOS_PORT = "5230";
7373+ MEMOS_DATA = cfg.dataDir;
7474+ MEMOS_DRIVER = "sqlite";
7575+ MEMOS_INSTANCE_URL = "http://localhost:5230";
7676+ };
7777+ defaultText = lib.literalExpression ''
7878+ {
7979+ MEMOS_MODE = "prod";
8080+ MEMOS_ADDR = "127.0.0.1";
8181+ MEMOS_PORT = "5230";
8282+ MEMOS_DATA = config.${opt.dataDir};
8383+ MEMOS_DRIVER = "sqlite";
8484+ MEMOS_INSTANCE_URL = "http://localhost:5230";
8585+ }
8686+ '';
8787+ };
8888+8989+ environmentFile = lib.mkOption {
9090+ type = lib.types.path;
9191+ description = ''
9292+ The environment file to use when starting Memos.
9393+9494+ ::: {.note}
9595+ By default, generated from [](opt-${opt.settings}).
9696+ :::
9797+ '';
9898+ example = "/var/lib/memos/memos.env";
9999+ default = envFileFormat.generate "memos.env" cfg.settings;
100100+ defaultText = lib.literalMD ''
101101+ generated from {option}`${opt.settings}`
102102+ '';
103103+ };
104104+ };
105105+106106+ config = lib.mkIf cfg.enable {
107107+ users.users = lib.mkIf (cfg.user == "memos") {
108108+ ${cfg.user} = {
109109+ description = lib.mkDefault "Memos service user";
110110+ isSystemUser = true;
111111+ group = cfg.group;
112112+ };
113113+ };
114114+115115+ users.groups = lib.mkIf (cfg.group == "memos") {
116116+ ${cfg.group} = { };
117117+ };
118118+119119+ networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [
120120+ cfg.port
121121+ ];
122122+123123+ systemd.tmpfiles.settings."10-memos" = {
124124+ "${cfg.dataDir}" = {
125125+ d = {
126126+ mode = "0750";
127127+ user = cfg.user;
128128+ group = cfg.group;
129129+ };
130130+ };
131131+ };
132132+133133+ systemd.services.memos = {
134134+ wantedBy = [ "multi-user.target" ];
135135+ after = [ "network.target" ];
136136+ wants = [ "network.target" ];
137137+ description = "Memos, a privacy-first, lightweight note-taking solution";
138138+ serviceConfig = {
139139+ User = cfg.user;
140140+ Group = cfg.group;
141141+ Type = "simple";
142142+ RestartSec = 60;
143143+ LimitNOFILE = 65536;
144144+ NoNewPrivileges = true;
145145+ LockPersonality = true;
146146+ RemoveIPC = true;
147147+ ReadWritePaths = [
148148+ cfg.dataDir
149149+ ];
150150+ ProtectSystem = "strict";
151151+ PrivateUsers = true;
152152+ ProtectHome = true;
153153+ PrivateTmp = true;
154154+ PrivateDevices = true;
155155+ ProtectHostname = true;
156156+ ProtectClock = true;
157157+ UMask = "0077";
158158+ ProtectKernelTunables = true;
159159+ ProtectKernelModules = true;
160160+ ProtectControlGroups = true;
161161+ ProtectProc = "invisible";
162162+ SystemCallFilter = [
163163+ " " # This is needed to clear the SystemCallFilter existing definitions
164164+ "~@reboot"
165165+ "~@swap"
166166+ "~@obsolete"
167167+ "~@mount"
168168+ "~@module"
169169+ "~@debug"
170170+ "~@cpu-emulation"
171171+ "~@clock"
172172+ "~@raw-io"
173173+ "~@privileged"
174174+ "~@resources"
175175+ ];
176176+ CapabilityBoundingSet = [
177177+ " " # Reset all capabilities to an empty set
178178+ ];
179179+ RestrictAddressFamilies = [
180180+ " " # This is needed to clear the RestrictAddressFamilies existing definitions
181181+ "none" # Remove all addresses families
182182+ "AF_UNIX"
183183+ "AF_INET"
184184+ "AF_INET6"
185185+ ];
186186+ DevicePolicy = "closed";
187187+ ProtectKernelLogs = true;
188188+ SystemCallArchitectures = "native";
189189+ RestrictNamespaces = true;
190190+ RestrictRealtime = true;
191191+ RestrictSUIDSGID = true;
192192+ EnvironmentFile = cfg.environmentFile;
193193+ ExecStart = lib.getExe cfg.package;
194194+ };
195195+ };
196196+ };
197197+198198+ meta.maintainers = [ lib.maintainers.m0ustach3 ];
199199+}
···209209 platforms = platforms.unix;
210210 maintainers = with maintainers; [
211211 jcumming
212212- ehmry
213212 ];
214213215214 # `Makefile.am` assumes the ability to run the hostPlatform's python binary at build time
···26262727stdenv.mkDerivation rec {
2828 pname = "argyllcms";
2929- version = "3.4.0";
2929+ version = "3.4.1";
30303131 src = fetchzip {
3232 # Kind of flacky URL, it was reaturning 406 and inconsistent binaries for a
3333 # while on me. It might be good to find a mirror
3434 url = "https://www.argyllcms.com/Argyll_V${version}_src.zip";
3535- hash = "sha256-jY6X9mQaP9NTIkbpW5QO31s+5Iv/mFEDgtwDgYXzIU4=";
3535+ hash = "sha256-QVugWtAk8xBn+/fRFqCoi072Q2q8OlB0LRhavrHC5MI=";
3636 };
37373838 nativeBuildInputs = [
···4242 description = "Data compression library providing in-memory LZMA compression and decompression functions, including integrity checking of the decompressed data";
4343 license = lib.licenses.bsd2;
4444 platforms = lib.platforms.all;
4545- maintainers = with lib.maintainers; [ ehmry ];
4645 };
4746})
-1
pkgs/by-name/ma/ma/package.nix
···4343 description = "Minimalistic variant of the Acme editor";
4444 homepage = "http://call-with-current-continuation.org/ma/ma.html";
4545 mainProgram = "ma";
4646- maintainers = with lib.maintainers; [ ehmry ];
4746 # Per the README:
4847 # > All of MA's source code is hereby placed in the public domain
4948 license = lib.licenses.publicDomain;
···126126 multithreading, image loading and saving in a variety of popular formats,
127127 database support, HTML viewing and printing, and much more.
128128 '';
129129- license = licenses.wxWindows;
129129+ license = with licenses; [
130130+ lgpl2Plus
131131+ wxWindowsException31
132132+ ];
130133 maintainers = with maintainers; [ tfmoraes ];
131134 platforms = platforms.unix;
132135 };
+4-1
pkgs/by-name/wx/wxGTK32/package.nix
···147147 multithreading, image loading and saving in a variety of popular formats,
148148 database support, HTML viewing and printing, and much more.
149149 '';
150150- license = licenses.wxWindows;
150150+ license = with licenses; [
151151+ lgpl2Plus
152152+ wxWindowsException31
153153+ ];
151154 maintainers = with maintainers; [
152155 tfmoraes
153156 fliegendewurst
+4-1
pkgs/by-name/wx/wxc/package.nix
···3737 meta = {
3838 description = "C language binding for wxWidgets";
3939 homepage = "https://wiki.haskell.org/WxHaskell";
4040- license = lib.licenses.wxWindows;
4040+ license = with lib.licenses; [
4141+ lgpl2Plus
4242+ wxWindowsException31
4343+ ];
4144 maintainers = with lib.maintainers; [ fgaz ];
4245 platforms = wxGTK32.meta.platforms;
4346 };
+4-1
pkgs/by-name/wx/wxwidgets_3_3/package.nix
···127127 multithreading, image loading and saving in a variety of popular formats,
128128 database support, HTML viewing and printing, and much more.
129129 '';
130130- license = lib.licenses.wxWindows;
130130+ license = with lib.licenses; [
131131+ lgpl2Plus
132132+ wxWindowsException31
133133+ ];
131134 maintainers = with lib.maintainers; [
132135 tfmoraes
133136 fliegendewurst
···151151 maintainers = with maintainers; [
152152 sjmackenzie
153153 zimbatm
154154- ehmry
155154 obadz
156155 danielfullmer
157156 mic92 # also can test darwin
···410410 # Those are annoyingly flaky, but not enough to be marked as such upstream.
411411 "test-wasi"
412412 ]
413413+ ++ lib.optionals stdenv.hostPlatform.isMusl [
414414+ # Doesn't work in sandbox on x86_64.
415415+ "test-dns-set-default-order"
416416+ ]
413417 ++ lib.optionals (stdenv.buildPlatform.isDarwin && stdenv.buildPlatform.isx86_64) [
414418 # These tests fail on x86_64-darwin (even without sandbox).
415419 # TODO: revisit at a later date.
···33 lib,
44 blackmagic-desktop-video,
55 kernel,
66- fetchpatch,
76}:
87stdenv.mkDerivation (finalAttrs: {
98 pname = "decklink";
···1211 # and desktop service, since the version of the two have to match anyways.
1312 # See pkgs/by-name/bl/blackmagic-desktop-video/package.nix for more.
1413 inherit (blackmagic-desktop-video) src version;
1515-1616- patches =
1717- (lib.optionals (lib.versionAtLeast kernel.modDirVersion "6.13") [
1818- # needed for version 14.4.x to build for kernel 6.13
1919- (fetchpatch {
2020- name = "01-update-makefiles";
2121- url = "https://aur.archlinux.org/cgit/aur.git/plain/01-update-makefiles.patch?h=decklink";
2222- hash = "sha256-l3iu0fG/QJMdGI/WSlNn+qjF4nK25JxoiwhPrMGTqE4=";
2323- })
2424- ])
2525- ++ (lib.optionals (lib.versionAtLeast kernel.modDirVersion "6.15") [
2626- # needed for version 14.4.x to build for kernel 6.15
2727- ./02-rename-timer-delete.patch
2828- ]);
29143015 KERNELDIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
3116 INSTALL_MOD_PATH = placeholder "out";
···3722 arch = stdenv.hostPlatform.uname.processor;
3823 in
3924 ''
4040- tar xf Blackmagic_Desktop_Video_Linux_${lib.head (lib.splitString "a" finalAttrs.version)}/other/${arch}/desktopvideo-${finalAttrs.version}-${arch}.tar.gz
4141- moduleRoot=$NIX_BUILD_TOP/desktopvideo-${finalAttrs.version}-${stdenv.hostPlatform.uname.processor}/usr/src
2525+ tar xf Blackmagic_Desktop_Video_Linux_${finalAttrs.version}/other/${arch}/desktopvideo-${finalAttrs.version}*-${arch}.tar.gz
2626+ bmVersion=$(ls -d $NIX_BUILD_TOP/desktopvideo-${finalAttrs.version}*-${arch}/usr/src | sed -e 's/.*desktopvideo-\([[:digit:]\.a-z]\+\).*/\1/')
2727+2828+ moduleRoot=$NIX_BUILD_TOP/desktopvideo-$bmVersion-${arch}/usr/src
4229 sourceRoot=$moduleRoot
4330 '';
44314532 buildPhase = ''
4633 runHook preBuild
4747- make -C $moduleRoot/blackmagic-${finalAttrs.version} -j$NIX_BUILD_CORES
4848- make -C $moduleRoot/blackmagic-io-${finalAttrs.version} -j$NIX_BUILD_CORES
3434+ make -C $moduleRoot/blackmagic-$bmVersion -j$NIX_BUILD_CORES
3535+ make -C $moduleRoot/blackmagic-io-$bmVersion -j$NIX_BUILD_CORES
4936 runHook postBuild
5037 '';
51385239 installPhase = ''
5340 runHook preInstall
5454- make -C $KERNELDIR M=$moduleRoot/blackmagic-${finalAttrs.version} modules_install
5555- make -C $KERNELDIR M=$moduleRoot/blackmagic-io-${finalAttrs.version} modules_install
4141+ make -C $KERNELDIR M=$moduleRoot/blackmagic-$bmVersion modules_install
4242+ make -C $KERNELDIR M=$moduleRoot/blackmagic-io-$bmVersion modules_install
5643 runHook postInstall
5744 '';
5845
+2-1
pkgs/os-specific/linux/firmware/ath9k/default.nix
···164164 license = with lib.licenses; [
165165 # see NOTICE.txt for details
166166 bsd3 # almost everything; "the ClearBSD licence"
167167- gpl2ClasspathPlus # **/*cmnos_printf.c, only three files
167167+ gpl2Plus # **/*cmnos_printf.c, only three files
168168+ classpathException20 # **/*cmnos_printf.c, only three files
168169 mit # **/xtos, **/xtensa
169170 ];
170171
···11-diff --git a/src/ntfs_io.c b/src/ntfs_io.c
22-index 7f57edd..4b718bb 100644
33---- a/src/ntfs_io.c
44-+++ b/src/ntfs_io.c
55-@@ -154,8 +154,8 @@ static int ntfs_device_testdisk_io_stat(struct ntfs_device *dev, struct stat *bu
66- return -1;
77- }
88-99--static int ntfs_device_testdisk_io_ioctl(struct ntfs_device *dev, int request,
1010-- void *argp)
1111-+static int ntfs_device_testdisk_io_ioctl(struct ntfs_device *dev,
1212-+ unsigned long request, void *argp)
1313- {
1414- log_warning( "ntfs_device_testdisk_io_ioctl() unimplemented\n");
1515- #ifdef ENOTSUP
+2
pkgs/top-level/aliases.nix
···25472547 zabbix50 = throw "'zabbix50' has been removed, it would have reached its End of Life a few days after the release of NixOS 25.05. Consider upgrading to 'zabbix60' or 'zabbix70'.";
25482548 zabbix64 = throw "'zabbix64' has been removed because it reached its End of Life. Consider upgrading to 'zabbix70'.";
25492549 zbackup = throw "'zbackup' has been removed due to being unmaintained upstream"; # Added 2025-08-22
25502550+ zeal-qt5 = lib.warnOnInstantiate "'zeal-qt5' has been removed from nixpkgs. Please use 'zeal' instead" zeal; # Added 2025-08-31
25512551+ zeal-qt6 = lib.warnOnInstantiate "'zeal-qt6' has been renamed to 'zeal'" zeal; # Added 2025-08-31
25502552 zeroadPackages = recurseIntoAttrs {
25512553 zeroad = lib.warnOnInstantiate "'zeroadPackages.zeroad' has been renamed to 'zeroad'" zeroad; # Added 2025-03-22
25522554 zeroad-data = lib.warnOnInstantiate "'zeroadPackages.zeroad-data' has been renamed to 'zeroad-data'" zeroad-data; # Added 2025-03-22
-6
pkgs/top-level/all-packages.nix
···11131111311113211132 xlsx2csv = with python3Packages; toPythonApplication xlsx2csv;
11133111331113411134- zeal-qt5 = libsForQt5.callPackage ../data/documentation/zeal { };
1113511135- zeal = zeal-qt5;
1113611136- zeal-qt6 = qt6Packages.callPackage ../data/documentation/zeal {
1113711137- qtx11extras = null; # Because it does not exist in qt6
1113811138- };
1113911139-1114011134 ### APPLICATIONS / GIS
11141111351114211136 qgis-ltr = callPackage ../applications/gis/qgis/ltr.nix { };