···66name: Vet nixpkgs
7788on:
99+ pull_request:
1010+ paths:
1111+ - .github/workflows/nixpkgs-vet.yml
912 pull_request_target:
1013 # This workflow depends on the base branch of the PR, but changing the base branch is not included in the default trigger events, which would be `opened`, `synchronize` or `reopened`.
1114 # Instead it causes an `edited` event, so we need to add it explicitly here.
+3
.github/workflows/no-channel.yml
···11name: "No channel PR"
2233on:
44+ pull_request:
55+ paths:
66+ - .github/workflows/no-channel.yml
47 pull_request_target:
58 # Re-run should be triggered when the base branch is updated, instead of silently failing
69 types: [opened, synchronize, reopened, edited]
···382382 (splitRoot p).root
383383 (splitRoot p).subpath
384384385385- - Trying to get the parent directory of `root` using [`readDir`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-readDir) returns `root` itself:
385385+ - Trying to get the parent directory of `root` using [`dirOf`](https://nixos.org/manual/nix/stable/language/builtins.html#builtins-dirOf) returns `root` itself:
386386387387 dirOf (splitRoot p).root == (splitRoot p).root
388388
···68686969- [vwifi](https://github.com/Raizo62/vwifi), a Wi-Fi simulator daemon leveraging the `mac80211_hwsim` and `vhost_vsock` kernel modules for efficient simulation of multi-node Wi-Fi networks. Available as {option}`services.vwifi`.
70707171+- [Oncall](https://oncall.tools), a web-based calendar tool designed for scheduling and managing on-call shifts. Available as [services.oncall](options.html#opt-services.oncall).
7272+7173- [Homer](https://homer-demo.netlify.app/), a very simple static homepage for your server. Available as [services.homer](options.html#opt-services.homer).
72747375- [Ghidra](https://ghidra-sre.org/), a software reverse engineering (SRE) suite of tools. Available as [programs.ghidra](options.html#opt-programs.ghidra).
+7-7
nixos/modules/image/repart.nix
···160160 # Generated with `uuidgen`. Random but fixed to improve reproducibility.
161161 default = "0867da16-f251-457d-a9e8-c31f9a3c220b";
162162 description = ''
163163- A UUID to use as a seed. You can set this to `null` to explicitly
163163+ A UUID to use as a seed. You can set this to `null` to explicitly
164164 randomize the partition UUIDs.
165165 '';
166166 };
···169169 type = lib.types.bool;
170170 default = false;
171171 description = ''
172172- Enables generation of split artifacts from partitions. If enabled, for
172172+ Enables generation of split artifacts from partitions. If enabled, for
173173 each partition with SplitName= set, a separate output file containing
174174 just the contents of that partition is generated.
175175 '';
···180180 default = 512;
181181 example = lib.literalExpression "4096";
182182 description = ''
183183- The sector size of the disk image produced by systemd-repart. This
183183+ The sector size of the disk image produced by systemd-repart. This
184184 value must be a power of 2 between 512 and 4096.
185185 '';
186186 };
···199199 type = with lib.types; attrsOf (submodule partitionOptions);
200200 default = { };
201201 example = lib.literalExpression ''
202202- {
202202+ {
203203 "10-esp" = {
204204 contents = {
205205 "/EFI/BOOT/BOOTX64.EFI".source =
···221221 };
222222 '';
223223 description = ''
224224- Specify partitions as a set of the names of the partitions with their
224224+ Specify partitions as a set of the names of the partitions with their
225225 configuration as the key.
226226 '';
227227 };
···230230 type = with lib.types; attrsOf (listOf str);
231231 default = { };
232232 example = lib.literalExpression ''
233233- {
233233+ {
234234 vfat = [ "-S 512" "-c" ];
235235 }
236236 '';
237237 description = ''
238238- Specify extra options for created file systems. The specified options
238238+ Specify extra options for created file systems. The specified options
239239 are converted to individual environment variables of the format
240240 `SYSTEMD_REPART_MKFS_OPTIONS_<FSTYPE>`.
241241
···163163164164 hostPkgs = config.virtualisation.host.pkgs;
165165166166- script = hostPkgs.writeShellScriptBin "create-builder" (
166166+ add-keys = hostPkgs.writeShellScriptBin "add-keys" (
167167 ''
168168 set -euo pipefail
169169 ''
···191191 if ! ${hostPkgs.diffutils}/bin/cmp "''${PUBLIC_KEY}" ${publicKey}; then
192192 (set -x; sudo --reset-timestamp ${installCredentials} "''${KEYS}")
193193 fi
194194- KEYS="$(${hostPkgs.nix}/bin/nix-store --add "$KEYS")" ${lib.getExe config.system.build.vm}
195194 ''
196195 );
197196197197+ run-builder = hostPkgs.writeShellScriptBin "run-builder" (''
198198+ set -euo pipefail
199199+ KEYS="''${KEYS:-./keys}"
200200+ KEYS="$(${hostPkgs.nix}/bin/nix-store --add "$KEYS")" ${lib.getExe config.system.build.vm}
201201+ '');
202202+203203+ script = hostPkgs.writeShellScriptBin "create-builder" (''
204204+ set -euo pipefail
205205+ export KEYS="''${KEYS:-./keys}"
206206+ ${lib.getExe add-keys}
207207+ ${lib.getExe run-builder}
208208+ '');
209209+198210 in
199211 script.overrideAttrs (old: {
200212 pos = __curPos; # sets meta.position to point here; see script binding above for package definition
···205217 # Let users in the repl inspect the config
206218 nixosConfig = config;
207219 nixosOptions = options;
220220+221221+ inherit add-keys run-builder;
208222 };
209223 });
210224
+203
nixos/modules/services/web-apps/oncall.nix
···11+{
22+ config,
33+ lib,
44+ pkgs,
55+ ...
66+}:
77+let
88+99+ cfg = config.services.oncall;
1010+ settingsFormat = pkgs.formats.yaml { };
1111+ configFile = settingsFormat.generate "oncall_extra_settings.yaml" cfg.settings;
1212+1313+in
1414+{
1515+ options.services.oncall = {
1616+1717+ enable = lib.mkEnableOption "Oncall web app";
1818+1919+ package = lib.mkPackageOption pkgs "oncall" { };
2020+2121+ database.createLocally = lib.mkEnableOption "Create the database and database user locally." // {
2222+ default = true;
2323+ };
2424+2525+ settings = lib.mkOption {
2626+ type = lib.types.submodule {
2727+ freeformType = settingsFormat.type;
2828+ options = {
2929+ oncall_host = lib.mkOption {
3030+ type = lib.types.str;
3131+ default = "localhost";
3232+ description = "FQDN for the Oncall instance.";
3333+ };
3434+ db.conn = {
3535+ kwargs = {
3636+ user = lib.mkOption {
3737+ type = lib.types.str;
3838+ default = "oncall";
3939+ description = "Database user.";
4040+ };
4141+ host = lib.mkOption {
4242+ type = lib.types.str;
4343+ default = "localhost";
4444+ description = "Database host.";
4545+ };
4646+ database = lib.mkOption {
4747+ type = lib.types.str;
4848+ default = "oncall";
4949+ description = "Database name.";
5050+ };
5151+ };
5252+ str = lib.mkOption {
5353+ type = lib.types.str;
5454+ default = "%(scheme)s://%(user)s@%(host)s:%(port)s/%(database)s?charset=%(charset)s&unix_socket=/run/mysqld/mysqld.sock";
5555+ description = ''
5656+ Database connection scheme. The default specifies the
5757+ connection through a local socket.
5858+ '';
5959+ };
6060+ require_auth = lib.mkOption {
6161+ type = lib.types.bool;
6262+ default = true;
6363+ description = ''
6464+ Whether authentication is required to access the web app.
6565+ '';
6666+ };
6767+ };
6868+ };
6969+ };
7070+ default = { };
7171+ description = ''
7272+ Extra configuration options to append or override.
7373+ For available and default option values see
7474+ [upstream configuration file](https://github.com/linkedin/oncall/blob/master/configs/config.yaml)
7575+ and the administration part in the
7676+ [offical documentation](https://oncall.tools/docs/admin_guide.html).
7777+ '';
7878+ };
7979+8080+ secretFile = lib.mkOption {
8181+ type = lib.types.pathWith {
8282+ inStore = false;
8383+ absolute = true;
8484+ };
8585+ example = "/run/keys/oncall-dbpassword";
8686+ description = ''
8787+ A YAML file containing secrets such as database or user passwords.
8888+ Some variables that can be considered secrets are:
8989+9090+ - db.conn.kwargs.password:
9191+ Password used to authenticate to the database.
9292+9393+ - session.encrypt_key:
9494+ Key for encrypting/signing session cookies.
9595+ Change to random long values in production.
9696+9797+ - session.sign_key:
9898+ Key for encrypting/signing session cookies.
9999+ Change to random long values in production.
100100+ '';
101101+ };
102102+103103+ };
104104+105105+ config = lib.mkIf cfg.enable {
106106+107107+ # Disable debug, only needed for development
108108+ services.oncall.settings = lib.mkMerge [
109109+ ({
110110+ debug = lib.mkDefault false;
111111+ auth.debug = lib.mkDefault false;
112112+ })
113113+ ];
114114+115115+ services.uwsgi = {
116116+ enable = true;
117117+ plugins = [ "python3" ];
118118+ user = "oncall";
119119+ instance = {
120120+ type = "emperor";
121121+ vassals = {
122122+ oncall = {
123123+ type = "normal";
124124+ env = [
125125+ "PYTHONPATH=${pkgs.oncall.pythonPath}"
126126+ (
127127+ "ONCALL_EXTRA_CONFIG="
128128+ + (lib.concatStringsSep "," (
129129+ [ configFile ] ++ lib.optional (cfg.secretFile != null) cfg.secretFile
130130+ ))
131131+ )
132132+ "STATIC_ROOT=/var/lib/oncall"
133133+ ];
134134+ module = "oncall.app:get_wsgi_app()";
135135+ socket = "${config.services.uwsgi.runDir}/oncall.sock";
136136+ socketGroup = "nginx";
137137+ immediate-gid = "nginx";
138138+ chmod-socket = "770";
139139+ pyargv = "${pkgs.oncall}/share/configs/config.yaml";
140140+ buffer-size = 32768;
141141+ };
142142+ };
143143+ };
144144+ };
145145+146146+ services.nginx = {
147147+ enable = lib.mkDefault true;
148148+ virtualHosts."${cfg.settings.oncall_host}".locations = {
149149+ "/".extraConfig = "uwsgi_pass unix://${config.services.uwsgi.runDir}/oncall.sock;";
150150+ };
151151+ };
152152+153153+ services.mysql = lib.mkIf cfg.database.createLocally {
154154+ enable = true;
155155+ package = lib.mkDefault pkgs.mariadb;
156156+ ensureDatabases = [ cfg.settings.db.conn.kwargs.database ];
157157+ ensureUsers = [
158158+ {
159159+ name = cfg.settings.db.conn.kwargs.user;
160160+ ensurePermissions = {
161161+ "${cfg.settings.db.conn.kwargs.database}.*" = "ALL PRIVILEGES";
162162+ };
163163+ }
164164+ ];
165165+ };
166166+167167+ users.users.oncall = {
168168+ group = "nginx";
169169+ isSystemUser = true;
170170+ };
171171+172172+ systemd = {
173173+ services = {
174174+ uwsgi.serviceConfig.StateDirectory = "oncall";
175175+ oncall-setup-database = lib.mkIf cfg.database.createLocally {
176176+ description = "Set up Oncall database";
177177+ serviceConfig = {
178178+ Type = "oneshot";
179179+ RemainAfterExit = true;
180180+ };
181181+ requiredBy = [ "uwsgi.service" ];
182182+ after = [ "mysql.service" ];
183183+ script =
184184+ let
185185+ mysql = "${lib.getExe' config.services.mysql.package "mysql"}";
186186+ in
187187+ ''
188188+ if [ ! -f /var/lib/oncall/.dbexists ]; then
189189+ # Load database schema provided with package
190190+ ${mysql} ${cfg.settings.db.conn.kwargs.database} < ${cfg.package}/share/db/schema.v0.sql
191191+ ${mysql} ${cfg.settings.db.conn.kwargs.database} < ${cfg.package}/share/db/schema-update.v0-1602184489.sql
192192+ touch /var/lib/oncall/.dbexists
193193+ fi
194194+ '';
195195+ };
196196+ };
197197+ };
198198+199199+ };
200200+201201+ meta.maintainers = with lib.maintainers; [ onny ];
202202+203203+}
+1
nixos/modules/system/activation/lib/test.sh
···2626}
2727trap onerr ERR
28282929+# shellcheck source-path=SCRIPTDIR
2930source ./lib.sh
30313132(warn hi, this works >/dev/null) 2>&1 | grep -E $'.*warning:.* hi, this works' >/dev/null
+1
nixos/tests/all-tests.nix
···618618 odoo = handleTest ./odoo.nix { };
619619 odoo17 = handleTest ./odoo.nix { package = pkgs.odoo17; };
620620 odoo16 = handleTest ./odoo.nix { package = pkgs.odoo16; };
621621+ oncall = runTest ./web-apps/oncall.nix;
621622 # 9pnet_virtio used to mount /nix partition doesn't support
622623 # hibernation. This test happens to work on x86_64-linux but
623624 # not on other platforms.
···286286 "test_vsioss_6"
287287 # flaky?
288288 "test_tiledb_read_arbitrary_array"
289289+ # tests for magic numbers, seem to change with different poppler versions,
290290+ # and architectures
291291+ "test_pdf_extra_rasters"
289292 ]
290293 ++ lib.optionals (!stdenv.hostPlatform.isx86_64) [
291294 # likely precision-related expecting x87 behaviour
-1
pkgs/by-name/ge/geant4/package.nix
···141141 '';
142142143143 meta = with lib; {
144144- broken = (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64);
145144 description = "Toolkit for the simulation of the passage of particles through matter";
146145 longDescription = ''
147146 Geant4 is a toolkit for the simulation of the passage of particles through matter.
···6677rustPlatform.buildRustPackage rec {
88 pname = "sendme";
99- version = "0.25.0";
99+ version = "0.26.0";
10101111 src = fetchFromGitHub {
1212 owner = "n0-computer";
1313 repo = "sendme";
1414 rev = "v${version}";
1515- hash = "sha256-OmP2FLvBupeJeGhMMBgcTpMSgQZ5JWzXBVeFZt7EU4Q=";
1515+ hash = "sha256-21JNyncChl8rv3IDdvYRF/nvMpAGCBps4xsBP9b/1lA=";
1616 };
17171818 useFetchCargoVendor = true;
1919- cargoHash = "sha256-8Ry3rpGTNcvMIA3Q10Cb3uJHOBQin9AhlLNRekaKw/0=";
1919+ cargoHash = "sha256-1VVpjeGU6/+apTHv7klo7FkAQ3AVjiziQRNI7yFbvh0=";
2020+2121+ __darwinAllowLocalNetworking = true;
2222+2323+ # On Darwin, sendme invokes CoreFoundation APIs that read ICU data from the
2424+ # system. Ensure these paths are accessible in the sandbox to avoid segfaults
2525+ # during checkPhase.
2626+ sandboxProfile = ''
2727+ (allow file-read* (subpath "/usr/share/icu"))
2828+ '';
20292130 meta = with lib; {
2231 description = "Tool to send files and directories, based on iroh";
+4-4
pkgs/by-name/se/servo/package.nix
···61616262rustPlatform.buildRustPackage {
6363 pname = "servo";
6464- version = "0-unstable-2025-04-27";
6464+ version = "0-unstable-2025-05-13";
65656666 src = fetchFromGitHub {
6767 owner = "servo";
6868 repo = "servo";
6969- rev = "e22ce3988b5962c254857419afbf36cced9648aa";
7070- hash = "sha256-shhvxwnhQXMVtXufd4IE8aeUeDm84MLpVktMkodFmeg=";
6969+ rev = "a572bf1191f8807e63d6bec4734ecae2b50439c3";
7070+ hash = "sha256-iMB2dJA0TVV6l14WqZt8KJehHRoGozycjjCHPXPjMsI=";
7171 # Breaks reproducibility depending on whether the picked commit
7272 # has other ref-names or not, which may change over time, i.e. with
7373 # "ref-names: HEAD -> main" as long this commit is the branch HEAD
···7878 };
79798080 useFetchCargoVendor = true;
8181- cargoHash = "sha256-TUhxQFuRINNHEfnnIKejMP6/j3K7t0y9bovcT/l6SZU=";
8181+ cargoHash = "sha256-HtyRHaYBadqqpJ8dSBOMp5xOwzRfBYjeuj4Kb/xx5ds=";
82828383 # set `HOME` to a temp dir for write access
8484 # Fix invalid option errors during linking (https://github.com/mozilla/nixpkgs-mozilla/commit/c72ff151a3e25f14182569679ed4cd22ef352328)
···66 pkg-config,
77 mpi,
88 mpiCheckPhaseHook,
99+ ctestCheckHook,
910 gfortran,
1011 blas,
1112 lapack,
···152153 # Can not run parallel checks generally as it requires exactly multiples of 4 MPI ranks
153154 # Even cpu_serial tests had to be disabled as they require scalapack routines in the sandbox
154155 # and run into the same problem as MPI tests
155155- checkPhase = ''
156156- runHook preCheck
157157-158158- ctest --output-on-failure --label-exclude integration_test
159159-160160- runHook postCheck
161161- '';
156156+ checkFlags = [
157157+ "--label-exclude"
158158+ "integration_test"
159159+ ];
162160163161 nativeCheckInputs = [
164162 mpiCheckPhaseHook
163163+ ctestCheckHook
165164 ];
166165167166 meta = with lib; {
···5252 })
5353 # Fix Threads::Threads target for static from https://github.com/oneapi-src/oneTBB/pull/1248
5454 # This is a conflict-resolved cherry-pick of the above PR to due to formatting differences.
5555- ./patches/fix-cmake-threads-threads-target-for-static.patch
5555+ (fetchpatch {
5656+ name = "fix-cmake-threads-threads-target-for-static.patch";
5757+ url = "https://patch-diff.githubusercontent.com/raw/uxlfoundation/oneTBB/pull/1248.patch";
5858+ hash = "sha256-3WKzxU93vxuy7NgW+ap+ocZz5Q5utZ/pK7+FQExzLLA=";
5959+ })
6060+ ];
6161+6262+ patchFlags = [
6363+ "-p1"
6464+ "--ignore-whitespace"
5665 ];
57665867 # Fix build with modern gcc
···5858 homepage = "https://sequoia-pgp.gitlab.io/pysequoia";
5959 license = licenses.asl20;
6060 maintainers = with maintainers; [ doronbehar ];
6161- # Broken since the 0.1.20 update according to ofborg. The errors are not clear...
6262- broken = stdenv.hostPlatform.isDarwin;
6361 };
6462}
···654654 flutter319 = throw "flutter319 has been removed because it isn't updated anymore, and no packages in nixpkgs use it. If you still need it, use flutter.mkFlutter to get a custom version"; # Added 2024-12-03
655655 flutter322 = throw "flutter322 has been removed because it isn't updated anymore, and no packages in nixpkgs use it. If you still need it, use flutter.mkFlutter to get a custom version"; # Added 2024-10-05
656656 flutter323 = throw "flutter323 has been removed because it isn't updated anymore, and no packages in nixpkgs use it. If you still need it, use flutter.mkFlutter to get a custom version"; # Added 2024-10-05
657657+ fluxctl = throw "fluxctl is unmaintained and has been removed. Migration to flux2 is recommended"; # Added 2025-05-11
657658 fluxus = throw "fluxus has been removed because it hasn't been updated in 9 years and depended on insecure Racket 7.9"; # Added 2024-12-06
658659 fmt_8 = throw "fmt_8 has been removed as it is obsolete and was no longer used in the tree"; # Added 2024-11-12
659660 fntsample = throw "fntsample has been removed as it is unmaintained upstream"; # Added 2025-04-21