···203203204204- `himalaya` was updated to v1.0.0-beta.4, which introduces breaking changes. Check out the [release note](https://github.com/soywod/himalaya/releases/tag/v1.0.0-beta.4) for details.
205205206206+- `security.pam.enableSSHAgentAuth` was replaced by the `sshAgentAuth` attrset, and **only**
207207+ `authorized_keys` files listed in [`sshAgentAuth.authorizedKeysFiles`] are trusted,
208208+ defaulting to `/etc/ssh/authorized_keys.d/%u`.
209209+ ::: {.warning}
210210+ Users of {manpage}`pam_ssh_agent_auth(8)` must take care that the pubkeys they use (for instance with `sudo`)
211211+ are listed in [`sshAgentAuth.authorizedKeysFiles`]..
212212+ :::
213213+ ::: {.note}
214214+ Previously, all `services.openssh.authorizedKeysFiles` were trusted, including `~/.ssh/authorized_keys`,
215215+ which results in an **insecure** configuration; see [#31611](https://github.com/NixOS/nixpkgs/issues/31611).
216216+ :::
217217+218218+[`sshAgentAuth.authorizedKeysFiles`]: #opt-security.pam.sshAgentAuth.authorizedKeysFiles
219219+206220- The `power.ups` module now generates `upsd.conf`, `upsd.users` and `upsmon.conf` automatically from a set of new configuration options. This breaks compatibility with existing `power.ups` setups where these files were created manually. Back up these files before upgrading NixOS.
207221208222- `programs.nix-ld.libraries` no longer sets `baseLibraries` via the option's default but in config and now merges any additional libraries with the default ones.
···306320- `services.vikunja` systemd service now uses `vikunja` as dynamic user instead of `vikunja-api`. Database users might need to be changed.
307321308322- `services.vikunja.setupNginx` setting has been removed. Users now need to setup the webserver configuration on their own with a proxy pass to the vikunja service.
323323+324324+- `services.vmagent` module deprecates `dataDir`, `group` and `user` setting in favor of systemd provided CacheDirectory and DynamicUser.
325325+326326+- `services.vmagent.remoteWriteUrl` setting has been renamed to `services.vmagent.remoteWrite.url` and now defaults to `null`.
309327310328- `woodpecker-*` packages have been updated to v2 which includes [breaking changes](https://woodpecker-ci.org/docs/next/migrations#200).
311329···575593- `libjxl` version bumped from 0.8.2 to 0.9.1 [dropped support for the butteraugli API](https://github.com/libjxl/libjxl/pull/2576). You will no longer be able to set `enableButteraugli` on `libaom`.
576594577595- `mockgen` package source has changed to the [go.uber.org/mock](https://github.com/uber-go/mock) fork because [the original repository is no longer maintained](https://github.com/golang/mock#gomock).
578578-579579-- `security.pam.enableSSHAgentAuth` was renamed to `security.pam.sshAgentAuth.enable` and an `authorizedKeysFiles`
580580- option was added, to control which `authorized_keys` files are trusted. It defaults to the previous behaviour,
581581- **which is insecure**: see [#31611](https://github.com/NixOS/nixpkgs/issues/31611).
582596583597- [](#opt-boot.kernel.sysctl._net.core.wmem_max_) changed from a string to an integer because of the addition of a custom merge option (taking the highest value defined to avoid conflicts between 2 services trying to set that value), just as [](#opt-boot.kernel.sysctl._net.core.rmem_max_) since 22.11.
584598
···11-{ lib, stdenv, callPackage, clisp, coreutils, fetchurl, strace, texinfo, which, writeText, zstd
11+{ lib, stdenv, callPackage, ecl, coreutils, fetchurl, strace, texinfo, which, writeText, zstd
22, threadSupport ? (stdenv.hostPlatform.isx86 || "aarch64-linux" == stdenv.hostPlatform.system || "aarch64-darwin" == stdenv.hostPlatform.system)
33, linkableRuntime ? stdenv.hostPlatform.isx86
44, disableImmobileSpace ? false
···66 # Note that the created binaries still need `patchelf --set-interpreter ...`
77 # to get rid of ${glibc} dependency.
88, purgeNixReferences ? false
99-, coreCompression ? lib.versionAtLeast version "2.2.6"
1010-, markRegionGC ? lib.versionAtLeast version "2.4.0"
99+, coreCompression ? true
1010+, markRegionGC ? true
1111, version
1212- # Set this to a lisp binary to use a custom bootstrap lisp compiler for
1313- # SBCL. Leave as null to use the default. This is useful for local development
1414- # of SBCL, because you can use your existing stock SBCL as a boostrap. On Hydra
1212+ # Set this to a lisp binary to use a custom bootstrap lisp compiler for SBCL.
1313+ # Leave as null to use the default. This is useful for local development of
1414+ # SBCL, because you can use your existing stock SBCL as a boostrap. On Hydra
1515 # of course we can’t do that because SBCL hasn’t been built yet, so we use
1616- # CLISP, but that’s much slower.
1616+ # ECL but that’s much slower.
1717, bootstrapLisp ? null
1818}:
1919···2727 };
2828 };
2929 # Collection of pre-built SBCL binaries for platforms that need them for
3030- # bootstrapping. Ideally these are to be avoided. If CLISP (or any other
3030+ # bootstrapping. Ideally these are to be avoided. If ECL (or any other
3131 # non-binary-distributed Lisp) can run on any of these systems, that entry
3232 # should be removed from this list.
3333 bootstrapBinaries = rec {
3434- # This build segfaults using CLISP.
3535- x86_64-darwin = {
3636- version = "2.2.9";
3737- system = "x86-64-darwin";
3838- sha256 = "sha256-b1BLkoLIOELAYBYA9eBmMgm1OxMxJewzNP96C9ADfKY=";
3939- };
4034 i686-linux = {
4135 version = "1.2.7";
4236 system = "x86-linux";
···6761 then bootstrapLisp
6862 else if (builtins.hasAttr stdenv.hostPlatform.system bootstrapBinaries)
6963 then "${sbclBootstrap}/bin/sbcl --disable-debugger --no-userinit --no-sysinit"
7070- else "${clisp}/bin/clisp -E UTF-8 --silent -norc";
6464+ else "${lib.getExe ecl} --norc";
71657266in
7367···173167 "--arch=arm64"
174168 ];
175169176176- env.NIX_CFLAGS_COMPILE = toString (lib.optionals (lib.versionOlder self.version "2.1.10") [
177177- # Workaround build failure on -fno-common toolchains like upstream
178178- # clang-13. Without the change build fails as:
179179- # duplicate symbol '_static_code_space_free_pointer' in: alloc.o traceroot.o
180180- # Should be fixed past 2.1.10 release.
181181- "-fcommon"
182182- ]
183183- # Fails to find `O_LARGEFILE` otherwise.
184184- ++ [ "-D_GNU_SOURCE" ]);
170170+ # Fails to find `O_LARGEFILE` otherwise.
171171+ env.NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
185172186173 buildPhase = ''
187174 runHook preBuild
···241228 platforms = attrNames bootstrapBinaries ++ [
242229 # These aren’t bootstrapped using the binary distribution but compiled
243230 # using a separate (lisp) host
231231+ "x86_64-darwin"
244232 "x86_64-linux"
245233 "aarch64-darwin"
246234 "aarch64-linux"
···350350 '';
351351 license = lib.licenses.psfl;
352352 platforms = lib.platforms.all;
353353- maintainers = with lib.maintainers; [ fridh ];
354353 knownVulnerabilities = [
355354 "Python 2.7 has reached its end of life after 2020-01-01. See https://www.python.org/doc/sunset-python-2/."
356355 # Quote: That means that we will not improve it anymore after that day,
···266266 Python, providing labeled data structures similar to R data.frame
267267 objects, statistical functions, and much more.
268268 '';
269269- maintainers = with maintainers; [ raskin fridh knedlsepp ];
269269+ maintainers = with maintainers; [ raskin knedlsepp ];
270270 };
271271};
272272in pandas
···2727 description = "A pythonic wrapper around FFTW, the FFT library, presenting a unified interface for all the supported transforms";
2828 homepage = "http://hgomersall.github.com/pyFFTW/";
2929 license = with licenses; [ bsd2 bsd3 ];
3030- maintainers = with maintainers; [ fridh ];
3130 };
3231}
···1212, rustc
1313, rustPlatform
1414, rust-bindgen
1515+# testing
1616+, emptyFile
1717+, nixos
1518, nixosTests
1619}@args':
17202121+let overridableKernel =
1822lib.makeOverridable ({ # The kernel source tarball.
1923 src
2024···211215 }; # end of configfile derivation
212216213217 kernel = (callPackage ./manual-config.nix { inherit lib stdenv buildPackages; }) (basicArgs // {
214214- inherit kernelPatches randstructSeed extraMakeFlags extraMeta configfile;
218218+ inherit kernelPatches randstructSeed extraMakeFlags extraMeta configfile modDirVersion;
215219 pos = builtins.unsafeGetAttrPos "version" args;
216220217217- config = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; } // lib.optionalAttrs withRust { CONFIG_RUST = "y"; };
218218- } // lib.optionalAttrs (modDirVersion != null) { inherit modDirVersion; });
221221+ config = {
222222+ CONFIG_MODULES = "y";
223223+ CONFIG_FW_LOADER = "m";
224224+ CONFIG_RUST = lib.mkIf withRust "y";
225225+ };
226226+ });
219227220228in
221229kernel.overrideAttrs (finalAttrs: previousAttrs: {
···241249 + toString (lib.attrNames (lib.toFunction args { }))
242250 ) overridableKernel;
243251 };
244244- in [ (nixosTests.kernel-generic.passthru.testsForKernel overridableKernel) ] ++ kernelTests;
252252+ /* Certain arguments must be evaluated lazily; so that only the output(s) depend on them.
253253+ Original reproducer / simplified use case:
254254+ */
255255+ versionDoesNotDependOnPatchesEtcNixOS =
256256+ builtins.seq
257257+ (nixos ({ config, pkgs, ... }: {
258258+ boot.kernelPatches = [
259259+ (builtins.seq config.boot.kernelPackages.kernel.version { patch = pkgs.emptyFile; })
260260+ ];
261261+ })).config.boot.kernelPackages.kernel.outPath
262262+ emptyFile;
263263+ versionDoesNotDependOnPatchesEtc =
264264+ builtins.seq
265265+ (import ./generic.nix args' (args // (
266266+ let explain = attrName:
267267+ ''
268268+ The ${attrName} attribute must be able to access the kernel.version attribute without an infinite recursion.
269269+ That means that the kernel attrset (attrNames) and the kernel.version attribute must not depend on the ${attrName} argument.
270270+ The fact that this exception is raised shows that such a dependency does exist.
271271+ This is a problem for the configurability of ${attrName} in version-aware logic such as that in NixOS.
272272+ Strictness can creep in through optional attributes, or assertions and warnings that run as part of code that shouldn't access what is checked.
273273+ '';
274274+ in {
275275+ kernelPatches = throw (explain "kernelPatches");
276276+ structuredExtraConfig = throw (explain "structuredExtraConfig");
277277+ modDirVersion = throw (explain "modDirVersion");
278278+ }))).version
279279+ emptyFile;
280280+ in [
281281+ (nixosTests.kernel-generic.passthru.testsForKernel overridableKernel)
282282+ versionDoesNotDependOnPatchesEtc
283283+ # Disabled by default, because the infinite recursion is hard to understand. The other test's error is better and produces a shorter trace.
284284+ # versionDoesNotDependOnPatchesEtcNixOS
285285+ ] ++ kernelTests;
245286 };
246287247247-}))
288288+}));
289289+in overridableKernel
···2626 extraMakeFlags ? [],
2727 # The name of the kernel module directory
2828 # Needs to be X.Y.Z[-extra], so pad with zeros if needed.
2929- modDirVersion ? lib.versions.pad 3 version,
2929+ modDirVersion ? null /* derive from version */,
3030 # The kernel source (tarball, git checkout, etc.)
3131 src,
3232 # a list of { name=..., patch=..., extraConfig=...} patches
···5454}:
55555656let
5757+ # Provide defaults. Note that we support `null` so that callers don't need to use optionalAttrs,
5858+ # which can lead to unnecessary strictness and infinite recursions.
5959+ modDirVersion_ = if modDirVersion == null then lib.versions.pad 3 version else modDirVersion;
6060+in
6161+let
6262+ # Shadow the un-defaulted parameter; don't want null.
6363+ modDirVersion = modDirVersion_;
5764 inherit (lib)
5865 hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
5966