Merge master into staging-next

.github/workflows/check-by-name.yml

···
     # as specified in nixos/release-combined.nix
     runs-on: ubuntu-latest
     steps:
+      - name: Resolving the merge commit
+        run: |
+          if result=$(git ls-remote --exit-code ${{ github.event.pull_request.base.repo.clone_url }} refs/pull/${{ github.event.pull_request.number }}/merge); then
+            mergedSha=$(cut -f1 <<< "$result")
+            echo "The PR appears to not have any conflicts, checking the merge commit $mergedSha"
+          else
+            echo "The PR may have a merge conflict"
+            exit 1
+          fi
+          echo "mergedSha=$mergedSha" >> "$GITHUB_ENV"
       - uses: actions/checkout@v4
         with:
           # pull_request_target checks out the base branch by default
-          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+          ref: ${{ env.mergedSha }}
           # Fetches the merge commit and its parents
           fetch-depth: 2
       - name: Determining PR git hashes
         run: |
-          echo "mergedSha=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
-
           # For pull_request_target this is the same as $GITHUB_SHA
           echo "baseSha=$(git rev-parse HEAD^1)" >> "$GITHUB_ENV"
 

pkgs/applications/networking/cluster/opentofu/default.nix

···
+{ stdenv
+, lib
+, buildGoModule
+, fetchFromGitHub
+, makeWrapper
+, coreutils
+, runCommand
+, runtimeShell
+, writeText
+, terraform-providers
+, installShellFiles
+}:
+
+let
+  package =  buildGoModule rec {
+    pname = "opentofu";
+    version = "1.6.0-alpha1";
+
+    src = fetchFromGitHub {
+      owner = "opentofu";
+      repo = "opentofu";
+      rev = "v${version}";
+      hash = "sha256-0FO55H1nOyhAd+ex1zA0XycH6x/HKkLlxzuIJNoaI9g=";
+    };
+    vendorHash = "sha256-3jQfIIZOgOmNHQ06rXz+3QTZ37WcuCc7A7/MhC7udrg=";
+    ldflags = [ "-s" "-w" ];
+
+    postConfigure = ''
+      # speakeasy hardcodes /bin/stty https://github.com/bgentry/speakeasy/issues/22
+      substituteInPlace vendor/github.com/bgentry/speakeasy/speakeasy_unix.go \
+        --replace "/bin/stty" "${coreutils}/bin/stty"
+    '';
+
+    nativeBuildInputs = [ installShellFiles ];
+    patches = [ ./provider-path-0_15.patch ];
+
+    passthru = {
+      inherit plugins withPlugins;
+      tests = { inherit opentofu_plugins_test; };
+    };
+
+    # https://github.com/posener/complete/blob/9a4745ac49b29530e07dc2581745a218b646b7a3/cmd/install/bash.go#L8
+    postInstall = ''
+      installShellCompletion --bash --name tofu <(echo complete -C tofu tofu)
+    '';
+
+    preCheck = ''
+      export HOME=$TMPDIR
+      export TF_SKIP_REMOTE_TESTS=1
+    '';
+
+    subPackages = [ "./cmd/..." ];
+
+    meta = with lib; {
+      description = "Tool for building, changing, and versioning infrastructure";
+      homepage = "https://opentofu.org/";
+      changelog = "https://github.com/opentofu/opentofu/blob/v${version}/CHANGELOG.md";
+      license = licenses.mpl20;
+      maintainers = with maintainers; [
+        gmemstr
+      ];
+      mainProgram = "tofu";
+    };
+  };
+
+  opentofu_plugins_test = let
+    mainTf = writeText "main.tf" ''
+      resource "random_id" "test" {}
+    '';
+    opentofu = package.withPlugins (p: [ p.random ]);
+    test = runCommand "opentofu-plugin-test" {
+      buildInputs = [ opentofu ];
+    } ''
+      # make it fail outside of sandbox
+      export HTTP_PROXY=http://127.0.0.1:0 HTTPS_PROXY=https://127.0.0.1:0
+      cp ${mainTf} main.tf
+      tofu init
+      touch $out
+    '';
+  in
+    test;
+
+  plugins = removeAttrs terraform-providers [
+    "override"
+    "overrideDerivation"
+    "recurseForDerivations"
+  ];
+
+  withPlugins = plugins:
+    let
+      actualPlugins = plugins package.plugins;
+
+      # Wrap PATH of plugins propagatedBuildInputs, plugins may have runtime dependencies on external binaries
+      wrapperInputs = lib.unique (lib.flatten
+        (lib.catAttrs "propagatedBuildInputs"
+          (builtins.filter (x: x != null) actualPlugins)));
+
+      passthru = {
+        withPlugins = newplugins:
+          withPlugins (x: newplugins x ++ actualPlugins);
+        full = withPlugins (p: lib.filter lib.isDerivation (lib.attrValues p.actualProviders));
+
+        # Expose wrappers around the override* functions of the terraform
+        # derivation.
+        #
+        # Note that this does not behave as anyone would expect if plugins
+        # are specified. The overrides are not on the user-visible wrapper
+        # derivation but instead on the function application that eventually
+        # generates the wrapper. This means:
+        #
+        # 1. When using overrideAttrs, only `passthru` attributes will
+        #    become visible on the wrapper derivation. Other overrides that
+        #    modify the derivation *may* still have an effect, but it can be
+        #    difficult to follow.
+        #
+        # 2. Other overrides may work if they modify the terraform
+        #    derivation, or they may have no effect, depending on what
+        #    exactly is being changed.
+        #
+        # 3. Specifying overrides on the wrapper is unsupported.
+        #
+        # See nixpkgs#158620 for details.
+        overrideDerivation = f:
+          (package.overrideDerivation f).withPlugins plugins;
+        overrideAttrs = f:
+          (package.overrideAttrs f).withPlugins plugins;
+        override = x:
+          (package.override x).withPlugins plugins;
+      };
+      # Don't bother wrapping unless we actually have plugins, since the wrapper will stop automatic downloading
+      # of plugins, which might be counterintuitive if someone just wants a vanilla Terraform.
+    in
+      if actualPlugins == [ ] then
+        package.overrideAttrs
+          (orig: { passthru = orig.passthru // passthru; })
+      else
+        lib.appendToName "with-plugins" (stdenv.mkDerivation {
+          inherit (package) meta pname version;
+          nativeBuildInputs = [ makeWrapper ];
+
+          # Expose the passthru set with the override functions
+          # defined above, as well as any passthru values already
+          # set on `terraform` at this point (relevant in case a
+          # user overrides attributes).
+          passthru = package.passthru // passthru;
+
+          buildCommand = ''
+            # Create wrappers for terraform plugins because Terraform only
+            # walks inside of a tree of files.
+            for providerDir in ${toString actualPlugins}
+            do
+              for file in $(find $providerDir/libexec/terraform-providers -type f)
+              do
+                relFile=''${file#$providerDir/}
+                mkdir -p $out/$(dirname $relFile)
+                cat <<WRAPPER > $out/$relFile
+            #!${runtimeShell}
+            exec "$file" "$@"
+            WRAPPER
+                chmod +x $out/$relFile
+              done
+            done
+
+            # Create a wrapper for opentofu to point it to the plugins dir.
+            mkdir -p $out/bin/
+            makeWrapper "${package}/bin/tofu" "$out/bin/tofu" \
+              --set NIX_TERRAFORM_PLUGIN_DIR $out/libexec/terraform-providers \
+              --prefix PATH : "${lib.makeBinPath wrapperInputs}"
+          '';
+        });
+in
+package

pkgs/applications/networking/cluster/opentofu/provider-path-0_15.patch

···
+diff -Naur terraform.old/internal/command/init.go terraform.new/internal/command/init.go
+--- terraform.old/internal/command/init.go
++++ terraform.new/internal/command/init.go
+@@ -3,6 +3,7 @@
+ import (
+ 	"context"
+ 	"fmt"
++	"os"
+ 	"log"
+ 	"strings"
+ 
+@@ -55,6 +56,11 @@
+ 
+ 	var diags tfdiags.Diagnostics
+ 
++	val, ok := os.LookupEnv("NIX_TERRAFORM_PLUGIN_DIR")
++	if ok {
++		flagPluginPath = append(flagPluginPath, val)
++	}
++
+ 	if len(flagPluginPath) > 0 {
+ 		c.pluginPath = flagPluginPath
+ 	}

pkgs/development/python-modules/pyfaidx/default.nix

···
 
 buildPythonPackage rec {
   pname = "pyfaidx";
-  version = "0.7.2.1";
+  version = "0.7.2.2";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MPDSCp49UzU/sg62m34i5vAaU+1PIbPhfdQI8L5QUaA=";
+    hash = "sha256-O3aTwFLIJpEAD+SpJHXbgv/DtachoSsQ37yHEZxLTTA=";
   };
 
   nativeBuildInputs = [

pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix

···
-{lib, stdenv, fetchurl, alsa-lib, gettext, makeWrapper, ncurses, libsamplerate, pciutils, which, fftw}:
+{lib, stdenv, fetchurl, fetchpatch, alsa-lib, gettext, makeWrapper, ncurses, libsamplerate, pciutils, which, fftw}:
 
 stdenv.mkDerivation rec {
   pname = "alsa-utils";
···
     url = "mirror://alsa/utils/${pname}-${version}.tar.bz2";
     sha256 = "sha256-EEti7H8Cp84WynefSBVhbfHMIZM1A3g6kQe1lE+DBjo=";
   };
+  patches = [
+    # Backport fixes for musl libc. Remove on next release
+    (fetchpatch {
+      url = "https://github.com/alsa-project/alsa-utils/commit/8c229270f6bae83b705a03714c46067a7aa57b02.patch";
+      hash = "sha256-sUaBHY8EHf4805nF6tyNV5jYXcJf3O+r04VXFu4dUCE=";
+    })
+    (fetchpatch {
+      url = "https://github.com/alsa-project/alsa-utils/commit/0925ad7f09b2dc77015784f9ac2f5e34dd0dd5c3.patch";
+      hash = "sha256-bgGU9On82AUbOjo+KN6WfuhqUAWM87OHnKN7plpG284=";
+    })
+  ];
 
   nativeBuildInputs = [ gettext makeWrapper ];
   buildInputs = [ alsa-lib ncurses libsamplerate fftw ];

pkgs/top-level/all-packages.nix

···
 
   opensp = callPackage ../tools/text/sgml/opensp { };
 
+  opentofu = callPackage ../applications/networking/cluster/opentofu { };
+
   opentrack = libsForQt5.callPackage ../applications/misc/opentrack { };
 
   opentracker = callPackage ../applications/networking/p2p/opentracker { };