···215215- `services.zfs.zed.enableMail` now uses the global `sendmail` wrapper defined by an email module
216216 (such as msmtp or Postfix). It no longer requires using a special ZFS build with email support.
217217218218+- `nextcloud-setup.service` no longer changes the group of each file & directory inside `/var/lib/nextcloud/{config,data,store-apps}` if one of these directories has the wrong owner group. This was part of transitioning the group used for `/var/lib/nextcloud`, but isn't necessary anymore.
219219+218220- The `krb5` module has been rewritten and moved to `security.krb5`, moving all options but `security.krb5.enable` and `security.krb5.package` into `security.krb5.settings`.
219221220222- Gitea 1.21 upgrade has several breaking changes, including:
···153153 type = types.attrs;
154154 description = lib.mdDoc ''
155155 Modify the systemd service. Can be used to, e.g., adjust the sandboxing options.
156156+ See {manpage}`systemd.exec(5)` for more options.
156157 '';
157158 example = {
158159 ProtectHome = false;
···9595 '';
9696 };
97979898+ services.resolved.dnsovertls = mkOption {
9999+ default = "false";
100100+ example = "true";
101101+ type = types.enum [ "true" "opportunistic" "false" ];
102102+ description = lib.mdDoc ''
103103+ If set to
104104+ - `"true"`:
105105+ all DNS lookups will be encrypted. This requires
106106+ that the DNS server supports DNS-over-TLS and
107107+ has a valid certificate. If the hostname was specified
108108+ via the `address#hostname` format in {option}`services.resolved.domains`
109109+ then the specified hostname is used to validate its certificate.
110110+ - `"opportunistic"`:
111111+ all DNS lookups will attempt to be encrypted, but will fallback
112112+ to unecrypted requests if the server does not support DNS-over-TLS.
113113+ Note that this mode does allow for a malicious party to conduct a
114114+ downgrade attack by immitating the DNS server and pretending to not
115115+ support encryption.
116116+ - `"false"`:
117117+ all DNS lookups are done unencrypted.
118118+ '';
119119+ };
120120+98121 services.resolved.extraConfig = mkOption {
99122 default = "";
100123 type = types.lines;
···141164 "Domains=${concatStringsSep " " cfg.domains}"}
142165 LLMNR=${cfg.llmnr}
143166 DNSSEC=${cfg.dnssec}
167167+ DNSOverTLS=${cfg.dnsovertls}
144168 ${config.services.resolved.extraConfig}
145169 '';
146170
···3636 substituteInPlace fpcsrc/compiler/systems/t_linux.pas --subst-var-by syslibpath "${glibc}/lib"
3737 # Replace the `codesign --remove-signature` command with a custom script, since `codesign` is not available
3838 # in nixpkgs
3939+ # Remove the -no_uuid strip flag which does not work on llvm-strip, only
4040+ # Apple strip.
3941 substituteInPlace fpcsrc/compiler/Makefile \
4042 --replace \
4143 "\$(CODESIGN) --remove-signature" \
4244 "${./remove-signature.sh}" \
4343- --replace "ifneq (\$(CODESIGN),)" "ifeq (\$(OS_TARGET), darwin)"
4545+ --replace "ifneq (\$(CODESIGN),)" "ifeq (\$(OS_TARGET), darwin)" \
4646+ --replace "-no_uuid" ""
4447 '';
45484649 NIX_LDFLAGS = lib.optionalString
···126126 # "All of the code in the compiler-rt project is dual licensed under the MIT
127127 # license and the UIUC License (a BSD-like license)":
128128 license = with lib.licenses; [ mit ncsa ];
129129- broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
129129+ broken = stdenv.hostPlatform.system == "aarch64-darwin"
130130+ # compiler-rt requires a Clang stdenv on 32-bit RISC-V:
131131+ # https://reviews.llvm.org/D43106#1019077
132132+ || (stdenv.hostPlatform.isRiscV32 && !stdenv.cc.isClang);
130133 };
131134}
···124124 # "All of the code in the compiler-rt project is dual licensed under the MIT
125125 # license and the UIUC License (a BSD-like license)":
126126 license = with lib.licenses; [ mit ncsa ];
127127+ # compiler-rt requires a Clang stdenv on 32-bit RISC-V:
128128+ # https://reviews.llvm.org/D43106#1019077
129129+ broken = stdenv.hostPlatform.isRiscV32 && !stdenv.cc.isClang;
127130 };
128131}
···131131 # "All of the code in the compiler-rt project is dual licensed under the MIT
132132 # license and the UIUC License (a BSD-like license)":
133133 license = with lib.licenses; [ mit ncsa ];
134134+ # compiler-rt requires a Clang stdenv on 32-bit RISC-V:
135135+ # https://reviews.llvm.org/D43106#1019077
136136+ broken = stdenv.hostPlatform.isRiscV32 && !stdenv.cc.isClang;
134137 };
135138}
···139139 # "All of the code in the compiler-rt project is dual licensed under the MIT
140140 # license and the UIUC License (a BSD-like license)":
141141 license = with lib.licenses; [ mit ncsa ];
142142+ # compiler-rt requires a Clang stdenv on 32-bit RISC-V:
143143+ # https://reviews.llvm.org/D43106#1019077
144144+ broken = stdenv.hostPlatform.isRiscV32 && !stdenv.cc.isClang;
142145 };
143146}
···138138 # "All of the code in the compiler-rt project is dual licensed under the MIT
139139 # license and the UIUC License (a BSD-like license)":
140140 license = with lib.licenses; [ mit ncsa ];
141141+ # compiler-rt requires a Clang stdenv on 32-bit RISC-V:
142142+ # https://reviews.llvm.org/D43106#1019077
143143+ broken = stdenv.hostPlatform.isRiscV32 && !stdenv.cc.isClang;
141144 };
142145}
···152152 # "All of the code in the compiler-rt project is dual licensed under the MIT
153153 # license and the UIUC License (a BSD-like license)":
154154 license = with lib.licenses; [ mit ncsa ];
155155+ # compiler-rt requires a Clang stdenv on 32-bit RISC-V:
156156+ # https://reviews.llvm.org/D43106#1019077
157157+ broken = stdenv.hostPlatform.isRiscV32 && !stdenv.cc.isClang;
155158 };
156159}
···152152 # "All of the code in the compiler-rt project is dual licensed under the MIT
153153 # license and the UIUC License (a BSD-like license)":
154154 license = with lib.licenses; [ mit ncsa ];
155155+ # compiler-rt requires a Clang stdenv on 32-bit RISC-V:
156156+ # https://reviews.llvm.org/D43106#1019077
157157+ broken = stdenv.hostPlatform.isRiscV32 && !stdenv.cc.isClang;
155158 };
156159}
···115115 # "All of the code in the compiler-rt project is dual licensed under the MIT
116116 # license and the UIUC License (a BSD-like license)":
117117 license = with lib.licenses; [ mit ncsa ];
118118- broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
118118+ broken = stdenv.hostPlatform.system == "aarch64-darwin"
119119+ # compiler-rt requires a Clang stdenv on 32-bit RISC-V:
120120+ # https://reviews.llvm.org/D43106#1019077
121121+ || (stdenv.hostPlatform.isRiscV32 && !stdenv.cc.isClang);
119122 };
120123}
···152152 # "All of the code in the compiler-rt project is dual licensed under the MIT
153153 # license and the UIUC License (a BSD-like license)":
154154 license = with lib.licenses; [ mit ncsa ];
155155+ # compiler-rt requires a Clang stdenv on 32-bit RISC-V:
156156+ # https://reviews.llvm.org/D43106#1019077
157157+ broken = stdenv.hostPlatform.isRiscV32 && !stdenv.cc.isClang;
155158 };
156159}
···4343 ];
44444545 # it would use the erroneous tag v0.47
4646- passthru.skipBulkUpdate = false;
4646+ passthru.skipBulkUpdate = true;
47474848 meta = with lib; {
4949 description = "An unofficial Dynalite DyNET interface creating devices";
···219219 # oggvideotools is broken on Darwin, please put it back when it will be fixed?
220220 ++ lib.optionals stdenv.isLinux [ oggvideotools ]
221221 # This doesn't work on aarch64-darwin
222222- ++ lib.optionals (stdenv.hostPlatform != "aarch64-darwin") [ gnumeric ]
222222+ ++ lib.optionals (stdenv.hostPlatform.system != "aarch64-darwin") [ gnumeric ]
223223 ));
224224225225 nativeCheckInputs = with python3.pkgs; [
···248248 "test_non_unicode_filename"
249249 "test_listing"
250250 "test_symlink_root"
251251+252252+ # Appears to be a sandbox related issue
253253+ "test_trim_stderr_in_command"
254254+ # Seems to be a bug caused by having different versions of rdata than
255255+ # expected. Will file upstream.
256256+ "test_item_rdb"
257257+ # Caused by getting an otool command instead of llvm-objdump. Could be Nix
258258+ # setup, could be upstream bug. Will file upstream.
259259+ "test_libmix_differences"
251260 ];
252261253262 disabledTestPaths = [