···633633634634 : Predicate taking an attribute name and an attribute value, which returns `true` to include the attribute, or `false` to exclude the attribute.
635635636636+ <!-- TIP -->
637637+ If possible, decide on `name` first and on `value` only if necessary.
638638+ This avoids evaluating the value if the name is already enough, making it possible, potentially, to have the argument reference the return value.
639639+ (Depending on context, that could still be considered a self reference by users; a common pattern in Nix.)
640640+641641+ <!-- TIP -->
642642+ `filterAttrs` is occasionally the cause of infinite recursion in configuration systems that allow self-references.
643643+ To support the widest range of user-provided logic, perform the `filterAttrs` call as late as possible.
644644+ Typically that's right before using it in a derivation, as opposed to an implicit conversion whose result is accessible to the user's expressions.
645645+636646 `set`
637647638648 : The attribute set to filter
···2323in
24242525{
2626- imports = [
2727- (lib.mkRemovedOptionModule [ "programs" "bash" "enable" ] "")
2828- ];
29263027 options = {
31283229 programs.bash = {
33303434- /*
3535- enable = lib.mkOption {
3636- default = true;
3737- description = ''
3838- Whenever to configure Bash as an interactive shell.
3939- Note that this tries to make Bash the default
4040- {option}`users.defaultUserShell`,
4141- which in turn means that you might need to explicitly
4242- set this variable if you have another shell configured
4343- with NixOS.
4444- '';
4545- type = lib.types.bool;
4646- };
4747- */
3131+ enable = lib.mkOption {
3232+ default = true;
3333+ description = ''
3434+ Whenever to configure Bash as an interactive shell.
3535+ Note that this tries to make Bash the default
3636+ {option}`users.defaultUserShell`,
3737+ which in turn means that you might need to explicitly
3838+ set this variable if you have another shell configured
3939+ with NixOS.
4040+ '';
4141+ type = lib.types.bool;
4242+ };
48434944 shellAliases = lib.mkOption {
5045 default = { };
···129124130125 };
131126132132- config = # lib.mkIf cfg.enable
133133- {
127127+ config = lib.mkIf cfg.enable {
134128135135- programs.bash = {
129129+ programs.bash = {
136130137137- shellAliases = builtins.mapAttrs (name: lib.mkDefault) cfge.shellAliases;
131131+ shellAliases = builtins.mapAttrs (name: lib.mkDefault) cfge.shellAliases;
138132139139- shellInit = ''
140140- if [ -z "$__NIXOS_SET_ENVIRONMENT_DONE" ]; then
141141- . ${config.system.build.setEnvironment}
142142- fi
133133+ shellInit = ''
134134+ if [ -z "$__NIXOS_SET_ENVIRONMENT_DONE" ]; then
135135+ . ${config.system.build.setEnvironment}
136136+ fi
143137144144- ${cfge.shellInit}
145145- '';
138138+ ${cfge.shellInit}
139139+ '';
146140147147- loginShellInit = cfge.loginShellInit;
141141+ loginShellInit = cfge.loginShellInit;
148142149149- interactiveShellInit = ''
150150- # Check the window size after every command.
151151- shopt -s checkwinsize
143143+ interactiveShellInit = ''
144144+ # Check the window size after every command.
145145+ shopt -s checkwinsize
152146153153- # Disable hashing (i.e. caching) of command lookups.
154154- set +h
147147+ # Disable hashing (i.e. caching) of command lookups.
148148+ set +h
155149156156- ${cfg.promptInit}
157157- ${cfg.promptPluginInit}
158158- ${bashAliases}
150150+ ${cfg.promptInit}
151151+ ${cfg.promptPluginInit}
152152+ ${bashAliases}
159153160160- ${cfge.interactiveShellInit}
161161- '';
154154+ ${cfge.interactiveShellInit}
155155+ '';
162156163163- };
157157+ };
164158165165- environment.etc.profile.text = ''
166166- # /etc/profile: DO NOT EDIT -- this file has been generated automatically.
167167- # This file is read for login shells.
159159+ environment.etc.profile.text = ''
160160+ # /etc/profile: DO NOT EDIT -- this file has been generated automatically.
161161+ # This file is read for login shells.
168162169169- # Only execute this file once per shell.
170170- if [ -n "$__ETC_PROFILE_SOURCED" ]; then return; fi
171171- __ETC_PROFILE_SOURCED=1
163163+ # Only execute this file once per shell.
164164+ if [ -n "$__ETC_PROFILE_SOURCED" ]; then return; fi
165165+ __ETC_PROFILE_SOURCED=1
172166173173- # Prevent this file from being sourced by interactive non-login child shells.
174174- export __ETC_PROFILE_DONE=1
167167+ # Prevent this file from being sourced by interactive non-login child shells.
168168+ export __ETC_PROFILE_DONE=1
175169176176- ${cfg.shellInit}
177177- ${cfg.loginShellInit}
170170+ ${cfg.shellInit}
171171+ ${cfg.loginShellInit}
178172179179- # Read system-wide modifications.
180180- if test -f /etc/profile.local; then
181181- . /etc/profile.local
182182- fi
173173+ # Read system-wide modifications.
174174+ if test -f /etc/profile.local; then
175175+ . /etc/profile.local
176176+ fi
183177184184- if [ -n "''${BASH_VERSION:-}" ]; then
185185- . /etc/bashrc
186186- fi
187187- '';
178178+ if [ -n "''${BASH_VERSION:-}" ]; then
179179+ . /etc/bashrc
180180+ fi
181181+ '';
188182189189- environment.etc.bashrc.text = ''
190190- # /etc/bashrc: DO NOT EDIT -- this file has been generated automatically.
183183+ environment.etc.bashrc.text = ''
184184+ # /etc/bashrc: DO NOT EDIT -- this file has been generated automatically.
191185192192- # Only execute this file once per shell.
193193- if [ -n "$__ETC_BASHRC_SOURCED" ] || [ -n "$NOSYSBASHRC" ]; then return; fi
194194- __ETC_BASHRC_SOURCED=1
186186+ # Only execute this file once per shell.
187187+ if [ -n "$__ETC_BASHRC_SOURCED" ] || [ -n "$NOSYSBASHRC" ]; then return; fi
188188+ __ETC_BASHRC_SOURCED=1
195189196196- # If the profile was not loaded in a parent process, source
197197- # it. But otherwise don't do it because we don't want to
198198- # clobber overridden values of $PATH, etc.
199199- if [ -z "$__ETC_PROFILE_DONE" ]; then
200200- . /etc/profile
201201- fi
190190+ # If the profile was not loaded in a parent process, source
191191+ # it. But otherwise don't do it because we don't want to
192192+ # clobber overridden values of $PATH, etc.
193193+ if [ -z "$__ETC_PROFILE_DONE" ]; then
194194+ . /etc/profile
195195+ fi
202196203203- # We are not always an interactive shell.
204204- if [ -n "$PS1" ]; then
205205- ${cfg.interactiveShellInit}
206206- fi
197197+ # We are not always an interactive shell.
198198+ if [ -n "$PS1" ]; then
199199+ ${cfg.interactiveShellInit}
200200+ fi
207201208208- # Read system-wide modifications.
209209- if test -f /etc/bashrc.local; then
210210- . /etc/bashrc.local
211211- fi
212212- '';
202202+ # Read system-wide modifications.
203203+ if test -f /etc/bashrc.local; then
204204+ . /etc/bashrc.local
205205+ fi
206206+ '';
213207214214- environment.etc.bash_logout.text = ''
215215- # /etc/bash_logout: DO NOT EDIT -- this file has been generated automatically.
208208+ environment.etc.bash_logout.text = ''
209209+ # /etc/bash_logout: DO NOT EDIT -- this file has been generated automatically.
216210217217- # Only execute this file once per shell.
218218- if [ -n "$__ETC_BASHLOGOUT_SOURCED" ] || [ -n "$NOSYSBASHLOGOUT" ]; then return; fi
219219- __ETC_BASHLOGOUT_SOURCED=1
211211+ # Only execute this file once per shell.
212212+ if [ -n "$__ETC_BASHLOGOUT_SOURCED" ] || [ -n "$NOSYSBASHLOGOUT" ]; then return; fi
213213+ __ETC_BASHLOGOUT_SOURCED=1
220214221221- ${cfg.logout}
215215+ ${cfg.logout}
222216223223- # Read system-wide modifications.
224224- if test -f /etc/bash_logout.local; then
225225- . /etc/bash_logout.local
226226- fi
227227- '';
217217+ # Read system-wide modifications.
218218+ if test -f /etc/bash_logout.local; then
219219+ . /etc/bash_logout.local
220220+ fi
221221+ '';
228222229229- # Configuration for readline in bash. We use "option default"
230230- # priority to allow user override using both .text and .source.
231231- environment.etc.inputrc.source = lib.mkOptionDefault ./inputrc;
223223+ # Configuration for readline in bash. We use "option default"
224224+ # priority to allow user override using both .text and .source.
225225+ environment.etc.inputrc.source = lib.mkOptionDefault ./inputrc;
232226233233- users.defaultUserShell = lib.mkDefault pkgs.bashInteractive;
227227+ users.defaultUserShell = lib.mkDefault pkgs.bashInteractive;
234228235235- environment.pathsToLink = lib.optionals cfg.completion.enable [
236236- "/etc/bash_completion.d"
237237- "/share/bash-completion"
238238- ];
229229+ environment.pathsToLink = lib.optionals cfg.completion.enable [
230230+ "/etc/bash_completion.d"
231231+ "/share/bash-completion"
232232+ ];
239233240240- environment.shells = [
241241- "/run/current-system/sw/bin/bash"
242242- "/run/current-system/sw/bin/sh"
243243- "${pkgs.bashInteractive}/bin/bash"
244244- "${pkgs.bashInteractive}/bin/sh"
245245- ];
234234+ environment.shells = [
235235+ "/run/current-system/sw/bin/bash"
236236+ "/run/current-system/sw/bin/sh"
237237+ "${pkgs.bashInteractive}/bin/bash"
238238+ "${pkgs.bashInteractive}/bin/sh"
239239+ ];
246240247247- };
241241+ };
248242249243}
···335335 }
336336 );
337337338338+ environment.corePackages = [ cfg.package ];
339339+338340 # SSH configuration. Slight duplication of the sshd_config
339341 # generation in the sshd service.
340342 environment.etc."ssh/ssh_config".text = ''
-2
nixos/modules/security/wrappers/default.nix
···266266 in
267267 {
268268 # These are mount related wrappers that require the +s permission.
269269- fusermount = mkSetuidRoot "${lib.getBin pkgs.fuse}/bin/fusermount";
270270- fusermount3 = mkSetuidRoot "${lib.getBin pkgs.fuse3}/bin/fusermount3";
271269 mount = mkSetuidRoot "${lib.getBin pkgs.util-linux}/bin/mount";
272270 umount = mkSetuidRoot "${lib.getBin pkgs.util-linux}/bin/umount";
273271 };
···461461 # Add the mount helpers to the system path so that `mount' can find them.
462462 system.fsPackages = [ pkgs.dosfstools ];
463463464464- environment.systemPackages =
465465- with pkgs;
466466- [
467467- fuse3
468468- fuse
469469- ]
470470- ++ config.system.fsPackages;
464464+ environment.systemPackages = config.system.fsPackages;
471465472466 environment.etc.fstab.text =
473467 let
···55in
66{
77 name = "nixseparatedebuginfod";
88- # A binary cache with debug info and source for nix
88+ # A binary cache with debug info and source for gnumake
99 nodes.cache =
1010 { pkgs, ... }:
1111 {
···1515 openFirewall = true;
1616 };
1717 system.extraDependencies = [
1818- pkgs.nix.debug
1919- pkgs.nix.src
1818+ pkgs.gnumake.debug
1919+ pkgs.gnumake.src
2020 pkgs.sl
2121 ];
2222 };
···3333 environment.systemPackages = [
3434 pkgs.valgrind
3535 pkgs.gdb
3636+ pkgs.gnumake
3637 (pkgs.writeShellScriptBin "wait_for_indexation" ''
3738 set -x
3838- while debuginfod-find debuginfo /run/current-system/sw/bin/nix |& grep 'File too large'; do
3939+ while debuginfod-find debuginfo /run/current-system/sw/bin/make |& grep 'File too large'; do
3940 sleep 1;
4041 done
4142 '')
···56575758 # nixseparatedebuginfod needs .drv to associate executable -> source
5859 # on regular systems this would be provided by nixos-rebuild
5959- machine.succeed("nix-instantiate '<nixpkgs>' -A nix")
6060+ machine.succeed("nix-instantiate '<nixpkgs>' -A gnumake")
60616162 machine.succeed("timeout 600 wait_for_indexation")
62636364 # test debuginfod-find
6464- machine.succeed("debuginfod-find debuginfo /run/current-system/sw/bin/nix")
6565+ machine.succeed("debuginfod-find debuginfo /run/current-system/sw/bin/make")
65666667 # test that gdb can fetch source
6767- out = machine.succeed("gdb /run/current-system/sw/bin/nix --batch -x ${builtins.toFile "commands" ''
6868+ out = machine.succeed("gdb /run/current-system/sw/bin/make --batch -x ${builtins.toFile "commands" ''
6869 start
6970 l
7071 ''}")
7172 print(out)
7272- assert 'int main(' in out
7373+ assert 'main (int argc, char **argv, char **envp)' in out
73747475 # test that valgrind can display location information
7575- # this relies on the fact that valgrind complains about nix
7676- # libgc helps in this regard, and we also ask valgrind to show leak kinds
7676+ # this relies on the fact that valgrind complains about gnumake
7777+ # because we also ask valgrind to show leak kinds
7778 # which are usually false positives.
7878- out = machine.succeed("valgrind --leak-check=full --show-leak-kinds=all nix-env --version 2>&1")
7979+ out = machine.succeed("valgrind --leak-check=full --show-leak-kinds=all make --version 2>&1")
7980 print(out)
8080- assert 'main.cc' in out
8181+ assert 'main.c' in out
8182 '';
8283}
+72
nixos/tests/nixseparatedebuginfod2.nix
···11+{ pkgs, lib, ... }:
22+{
33+ name = "nixseparatedebuginfod2";
44+ # A binary cache with debug info and source for gnumake
55+ nodes.cache =
66+ { pkgs, ... }:
77+ {
88+ services.nginx = {
99+ enable = true;
1010+ virtualHosts.default = {
1111+ default = true;
1212+ addSSL = false;
1313+ root = "/var/lib/thebinarycache";
1414+ };
1515+ };
1616+ networking.firewall.allowedTCPPorts = [ 80 ];
1717+ systemd.services.buildthebinarycache = {
1818+ before = [ "nginx.service" ];
1919+ wantedBy = [ "nginx.service" ];
2020+ script = ''
2121+ ${pkgs.nix}/bin/nix --extra-experimental-features nix-command copy --to file:///var/lib/thebinarycache?index-debug-info=true ${pkgs.gnumake.debug} ${pkgs.gnumake} ${pkgs.gnumake.src} ${pkgs.sl}
2222+ '';
2323+ serviceConfig = {
2424+ User = "nginx";
2525+ Group = "nginx";
2626+ StateDirectory = "thebinarycache";
2727+ Type = "oneshot";
2828+ };
2929+ };
3030+ };
3131+ # the machine where we need the debuginfo
3232+ nodes.machine = {
3333+ services.nixseparatedebuginfod2 = {
3434+ enable = true;
3535+ substituter = "http://cache";
3636+ };
3737+ environment.systemPackages = [
3838+ pkgs.valgrind
3939+ pkgs.gdb
4040+ pkgs.gnumake
4141+ ];
4242+ };
4343+ testScript = ''
4444+ start_all()
4545+ cache.wait_for_unit("nginx.service")
4646+ cache.wait_for_open_port(80)
4747+ machine.wait_for_unit("nixseparatedebuginfod2.service")
4848+ machine.wait_for_open_port(1950)
4949+5050+ with subtest("check that the binary cache works"):
5151+ machine.succeed("nix-store --extra-substituters http://cache --option require-sigs false -r ${pkgs.sl}")
5252+5353+ # test debuginfod-find
5454+ machine.succeed("debuginfod-find debuginfo /run/current-system/sw/bin/make")
5555+5656+ # test that gdb can fetch source
5757+ out = machine.succeed("gdb /run/current-system/sw/bin/make --batch -x ${builtins.toFile "commands" ''
5858+ start
5959+ l
6060+ ''}")
6161+ print(out)
6262+ assert 'main (int argc, char **argv, char **envp)' in out
6363+6464+ # test that valgrind can display location information
6565+ # this relies on the fact that valgrind complains about gnumake
6666+ # because we also ask valgrind to show leak kinds
6767+ # which are usually false positives.
6868+ out = machine.succeed("valgrind --leak-check=full --show-leak-kinds=all make --version 2>&1")
6969+ print(out)
7070+ assert 'main.c' in out
7171+ '';
7272+}
+24-5
nixos/tests/tayga.nix
···3131 };
32323333 nodes = {
3434- # The server is configured with static IPv4 addresses. RFC 6052 Section 3.1
3535- # disallows the mapping of non-global IPv4 addresses like RFC 1918 into the
3636- # Well-Known Prefix 64:ff9b::/96. TAYGA also does not allow the mapping of
3737- # documentation space (RFC 5737). To circumvent this, 100.64.0.2/24 from
3838- # RFC 6589 (Carrier Grade NAT) is used here.
3434+ # The server is configured with static IPv4 addresses. We have to disable the
3535+ # well-known prefix restrictions (as required by RFC 6052 Section 3.1) because
3636+ # we're using private space (TAYGA also considers documentation space non-global,
3737+ # unfortunately).
3938 # To reach the IPv4 address pool of the NAT64 gateway, there is a static
4039 # route configured. In normal cases, where the router would also source NAT
4140 # the pool addresses to one IPv4 addresses, this would not be needed.
···6362 };
6463 };
6564 programs.mtr.enable = true;
6565+ environment.systemPackages = [ pkgs.tcpdump ];
6666 };
67676868 # The router is configured with static IPv4 addresses towards the server
···8787 ];
88888989 networking = {
9090+ hostName = "router-systemd";
9091 useDHCP = false;
9192 useNetworkd = true;
9293 firewall.enable = false;
···137138 mappings = {
138139 "192.0.2.42" = "2001:db8::2";
139140 };
141141+ log = [
142142+ "drop"
143143+ "reject"
144144+ "icmp"
145145+ "self"
146146+ ];
147147+ wkpfStrict = false;
140148 };
149149+ environment.systemPackages = [ pkgs.tcpdump ];
141150 };
142151143152 router_nixos = {
···152161 ];
153162154163 networking = {
164164+ hostName = "router-nixos";
155165 useDHCP = false;
156166 firewall.enable = false;
157167 interfaces.eth1 = lib.mkForce {
···201211 mappings = {
202212 "192.0.2.42" = "2001:db8::2";
203213 };
214214+ log = [
215215+ "drop"
216216+ "reject"
217217+ "icmp"
218218+ "self"
219219+ ];
220220+ wkpfStrict = false;
204221 };
222222+ environment.systemPackages = [ pkgs.tcpdump ];
205223 };
206224207225 # The client is configured with static IPv6 addresses. It has also a static
···233251 };
234252 };
235253 programs.mtr.enable = true;
254254+ environment.systemPackages = [ pkgs.tcpdump ];
236255 };
237256 };
238257
···5252 "tests/typecheck"
5353 ];
54545555+ # Tests are not shipped with PyPI
5656+5557 pythonImportsCheck = [ "django_stubs_ext" ];
56585759 meta = with lib; {
···141141 {
142142 structuredExtraConfig ? { },
143143 ...
144144- }:
145145- {
146146- settings = structuredExtraConfig;
147147- }
144144+ }@args:
145145+ if args ? extraStructuredConfig then
146146+ throw ''
147147+ Passing `extraStructuredConfig` to the Linux kernel (e.g.
148148+ via `boot.kernelPatches` in NixOS) is not supported anymore. Use
149149+ `structuredExtraConfig` instead.
150150+ ''
151151+ else
152152+ {
153153+ settings = structuredExtraConfig;
154154+ }
148155 ) kernelPatches;
149156150157 # appends kernel patches extraConfig
+2-2
pkgs/os-specific/linux/kernel/zen-kernels.nix
···1616 variants = {
1717 # ./update-zen.py zen
1818 zen = {
1919- version = "6.15.8"; # zen
1919+ version = "6.16"; # zen
2020 suffix = "zen1"; # zen
2121- sha256 = "010k50c9anjbcrwh9cgc6wn91hh3xa1x3mpxbaa2x1v8f5773vd4"; # zen
2121+ sha256 = "1ckysnshlrhfycz0yppna6jrnvgc9k49wr5srvl15wj1hck84p7d"; # zen
2222 isLqx = false;
2323 };
2424 # ./update-zen.py lqx
+4-16
pkgs/os-specific/linux/systemd/default.nix
···256256 ./0019-meson-Don-t-link-ssh-dropins.patch
257257258258 ./0020-install-unit_file_exists_full-follow-symlinks.patch
259259-260260- # add nspawn build option flag
261261- # required to disable nspawn for systemdLibs to avoid dependency on getent
262262- # https://github.com/systemd/systemd/pull/36876, remove for systemd 258
263263- (fetchpatch {
264264- # required for the actual patch to apply
265265- url = "https://github.com/systemd/systemd/commit/b1fb2d971c810e0bdf9ff0ae567a1c6c230e4e5d.patch";
266266- hash = "sha256-JBheazg1OFkx8vUl2l8+34BoEPVURBQJHxqntOBYB60=";
267267- includes = [ "src/nspawn/meson.build" ];
268268- })
269269- (fetchpatch {
270270- url = "https://github.com/systemd/systemd/commit/d95818f5221d9b9b19648cffa0cb2407f023b27e.patch";
271271- hash = "sha256-FTpWGec5ivlkyEEDMCPaLE+BH91e7JI0kH8pS88bBDY=";
272272- excludes = [ "test/fuzz/meson.build" ];
273273- })
274259 ]
275260 ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
276261 ./0021-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
···600585 (lib.mesonEnable "gnutls" false)
601586 (lib.mesonEnable "xkbcommon" false)
602587 (lib.mesonEnable "man" true)
603603- (lib.mesonEnable "nspawn" withNspawn)
588588+ # (lib.mesonEnable "nspawn" withNspawn) # nspawn build can be turned off on systemd 258, on 257.x it will just not be installed in systemdLibs but the build is unconditional
604589605590 (lib.mesonBool "analyze" withAnalyze)
606591 (lib.mesonBool "logind" withLogind)
···697682 ]
698683 ++ lib.optionals withNspawn [
699684 {
685685+ # we only need to patch getent when nspawn will actually be built/installed
686686+ # as of systemd 257.x, nspawn will not be installed on systemdLibs, so we don't need to patch it
687687+ # patching getent unconditionally here introduces infinite recursion on musl
700688 search = "/usr/bin/getent";
701689 replacement = "${getent}/bin/getent";
702690 where = [ "src/nspawn/nspawn-setuid.c" ];