···203204- `himalaya` was updated to v1.0.0-beta.4, which introduces breaking changes. Check out the [release note](https://github.com/soywod/himalaya/releases/tag/v1.0.0-beta.4) for details.
20500000000000000206- The `power.ups` module now generates `upsd.conf`, `upsd.users` and `upsmon.conf` automatically from a set of new configuration options. This breaks compatibility with existing `power.ups` setups where these files were created manually. Back up these files before upgrading NixOS.
207208- `programs.nix-ld.libraries` no longer sets `baseLibraries` via the option's default but in config and now merges any additional libraries with the default ones.
···306- `services.vikunja` systemd service now uses `vikunja` as dynamic user instead of `vikunja-api`. Database users might need to be changed.
307308- `services.vikunja.setupNginx` setting has been removed. Users now need to setup the webserver configuration on their own with a proxy pass to the vikunja service.
0000309310- `woodpecker-*` packages have been updated to v2 which includes [breaking changes](https://woodpecker-ci.org/docs/next/migrations#200).
311···575- `libjxl` version bumped from 0.8.2 to 0.9.1 [dropped support for the butteraugli API](https://github.com/libjxl/libjxl/pull/2576). You will no longer be able to set `enableButteraugli` on `libaom`.
576577- `mockgen` package source has changed to the [go.uber.org/mock](https://github.com/uber-go/mock) fork because [the original repository is no longer maintained](https://github.com/golang/mock#gomock).
578-579-- `security.pam.enableSSHAgentAuth` was renamed to `security.pam.sshAgentAuth.enable` and an `authorizedKeysFiles`
580- option was added, to control which `authorized_keys` files are trusted. It defaults to the previous behaviour,
581- **which is insecure**: see [#31611](https://github.com/NixOS/nixpkgs/issues/31611).
582583- [](#opt-boot.kernel.sysctl._net.core.wmem_max_) changed from a string to an integer because of the addition of a custom merge option (taking the highest value defined to avoid conflicts between 2 services trying to set that value), just as [](#opt-boot.kernel.sysctl._net.core.rmem_max_) since 22.11.
584
···203204- `himalaya` was updated to v1.0.0-beta.4, which introduces breaking changes. Check out the [release note](https://github.com/soywod/himalaya/releases/tag/v1.0.0-beta.4) for details.
205206+- `security.pam.enableSSHAgentAuth` was replaced by the `sshAgentAuth` attrset, and **only**
207+ `authorized_keys` files listed in [`sshAgentAuth.authorizedKeysFiles`] are trusted,
208+ defaulting to `/etc/ssh/authorized_keys.d/%u`.
209+ ::: {.warning}
210+ Users of {manpage}`pam_ssh_agent_auth(8)` must take care that the pubkeys they use (for instance with `sudo`)
211+ are listed in [`sshAgentAuth.authorizedKeysFiles`]..
212+ :::
213+ ::: {.note}
214+ Previously, all `services.openssh.authorizedKeysFiles` were trusted, including `~/.ssh/authorized_keys`,
215+ which results in an **insecure** configuration; see [#31611](https://github.com/NixOS/nixpkgs/issues/31611).
216+ :::
217+218+[`sshAgentAuth.authorizedKeysFiles`]: #opt-security.pam.sshAgentAuth.authorizedKeysFiles
219+220- The `power.ups` module now generates `upsd.conf`, `upsd.users` and `upsmon.conf` automatically from a set of new configuration options. This breaks compatibility with existing `power.ups` setups where these files were created manually. Back up these files before upgrading NixOS.
221222- `programs.nix-ld.libraries` no longer sets `baseLibraries` via the option's default but in config and now merges any additional libraries with the default ones.
···320- `services.vikunja` systemd service now uses `vikunja` as dynamic user instead of `vikunja-api`. Database users might need to be changed.
321322- `services.vikunja.setupNginx` setting has been removed. Users now need to setup the webserver configuration on their own with a proxy pass to the vikunja service.
323+324+- `services.vmagent` module deprecates `dataDir`, `group` and `user` setting in favor of systemd provided CacheDirectory and DynamicUser.
325+326+- `services.vmagent.remoteWriteUrl` setting has been renamed to `services.vmagent.remoteWrite.url` and now defaults to `null`.
327328- `woodpecker-*` packages have been updated to v2 which includes [breaking changes](https://woodpecker-ci.org/docs/next/migrations#200).
329···593- `libjxl` version bumped from 0.8.2 to 0.9.1 [dropped support for the butteraugli API](https://github.com/libjxl/libjxl/pull/2576). You will no longer be able to set `enableButteraugli` on `libaom`.
594595- `mockgen` package source has changed to the [go.uber.org/mock](https://github.com/uber-go/mock) fork because [the original repository is no longer maintained](https://github.com/golang/mock#gomock).
0000596597- [](#opt-boot.kernel.sysctl._net.core.wmem_max_) changed from a string to an integer because of the addition of a custom merge option (taking the highest value defined to avoid conflicts between 2 services trying to set that value), just as [](#opt-boot.kernel.sysctl._net.core.rmem_max_) since 22.11.
598
···77 description = "KDE Connect provides several features to integrate your phone and your computer";
78 homepage = "https://community.kde.org/KDEConnect";
79 license = with licenses; [ gpl2 ];
80- maintainers = with maintainers; [ fridh ];
81 mainProgram = "kdeconnect-app";
82 };
83}
···77 description = "KDE Connect provides several features to integrate your phone and your computer";
78 homepage = "https://community.kde.org/KDEConnect";
79 license = with licenses; [ gpl2 ];
080 mainProgram = "kdeconnect-app";
81 };
82}
···1-{ lib, stdenv, callPackage, clisp, coreutils, fetchurl, strace, texinfo, which, writeText, zstd
2, threadSupport ? (stdenv.hostPlatform.isx86 || "aarch64-linux" == stdenv.hostPlatform.system || "aarch64-darwin" == stdenv.hostPlatform.system)
3, linkableRuntime ? stdenv.hostPlatform.isx86
4, disableImmobileSpace ? false
···6 # Note that the created binaries still need `patchelf --set-interpreter ...`
7 # to get rid of ${glibc} dependency.
8, purgeNixReferences ? false
9-, coreCompression ? lib.versionAtLeast version "2.2.6"
10-, markRegionGC ? lib.versionAtLeast version "2.4.0"
11, version
12- # Set this to a lisp binary to use a custom bootstrap lisp compiler for
13- # SBCL. Leave as null to use the default. This is useful for local development
14- # of SBCL, because you can use your existing stock SBCL as a boostrap. On Hydra
15 # of course we can’t do that because SBCL hasn’t been built yet, so we use
16- # CLISP, but that’s much slower.
17, bootstrapLisp ? null
18}:
19···27 };
28 };
29 # Collection of pre-built SBCL binaries for platforms that need them for
30- # bootstrapping. Ideally these are to be avoided. If CLISP (or any other
31 # non-binary-distributed Lisp) can run on any of these systems, that entry
32 # should be removed from this list.
33 bootstrapBinaries = rec {
34- # This build segfaults using CLISP.
35- x86_64-darwin = {
36- version = "2.2.9";
37- system = "x86-64-darwin";
38- sha256 = "sha256-b1BLkoLIOELAYBYA9eBmMgm1OxMxJewzNP96C9ADfKY=";
39- };
40 i686-linux = {
41 version = "1.2.7";
42 system = "x86-linux";
···67 then bootstrapLisp
68 else if (builtins.hasAttr stdenv.hostPlatform.system bootstrapBinaries)
69 then "${sbclBootstrap}/bin/sbcl --disable-debugger --no-userinit --no-sysinit"
70- else "${clisp}/bin/clisp -E UTF-8 --silent -norc";
7172in
73···173 "--arch=arm64"
174 ];
175176- env.NIX_CFLAGS_COMPILE = toString (lib.optionals (lib.versionOlder self.version "2.1.10") [
177- # Workaround build failure on -fno-common toolchains like upstream
178- # clang-13. Without the change build fails as:
179- # duplicate symbol '_static_code_space_free_pointer' in: alloc.o traceroot.o
180- # Should be fixed past 2.1.10 release.
181- "-fcommon"
182- ]
183- # Fails to find `O_LARGEFILE` otherwise.
184- ++ [ "-D_GNU_SOURCE" ]);
185186 buildPhase = ''
187 runHook preBuild
···241 platforms = attrNames bootstrapBinaries ++ [
242 # These aren’t bootstrapped using the binary distribution but compiled
243 # using a separate (lisp) host
0244 "x86_64-linux"
245 "aarch64-darwin"
246 "aarch64-linux"
···1+{ lib, stdenv, callPackage, ecl, coreutils, fetchurl, strace, texinfo, which, writeText, zstd
2, threadSupport ? (stdenv.hostPlatform.isx86 || "aarch64-linux" == stdenv.hostPlatform.system || "aarch64-darwin" == stdenv.hostPlatform.system)
3, linkableRuntime ? stdenv.hostPlatform.isx86
4, disableImmobileSpace ? false
···6 # Note that the created binaries still need `patchelf --set-interpreter ...`
7 # to get rid of ${glibc} dependency.
8, purgeNixReferences ? false
9+, coreCompression ? true
10+, markRegionGC ? true
11, version
12+ # Set this to a lisp binary to use a custom bootstrap lisp compiler for SBCL.
13+ # Leave as null to use the default. This is useful for local development of
14+ # SBCL, because you can use your existing stock SBCL as a boostrap. On Hydra
15 # of course we can’t do that because SBCL hasn’t been built yet, so we use
16+ # ECL but that’s much slower.
17, bootstrapLisp ? null
18}:
19···27 };
28 };
29 # Collection of pre-built SBCL binaries for platforms that need them for
30+ # bootstrapping. Ideally these are to be avoided. If ECL (or any other
31 # non-binary-distributed Lisp) can run on any of these systems, that entry
32 # should be removed from this list.
33 bootstrapBinaries = rec {
00000034 i686-linux = {
35 version = "1.2.7";
36 system = "x86-linux";
···61 then bootstrapLisp
62 else if (builtins.hasAttr stdenv.hostPlatform.system bootstrapBinaries)
63 then "${sbclBootstrap}/bin/sbcl --disable-debugger --no-userinit --no-sysinit"
64+ else "${lib.getExe ecl} --norc";
6566in
67···167 "--arch=arm64"
168 ];
169170+ # Fails to find `O_LARGEFILE` otherwise.
171+ env.NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE";
0000000172173 buildPhase = ''
174 runHook preBuild
···228 platforms = attrNames bootstrapBinaries ++ [
229 # These aren’t bootstrapped using the binary distribution but compiled
230 # using a separate (lisp) host
231+ "x86_64-darwin"
232 "x86_64-linux"
233 "aarch64-darwin"
234 "aarch64-linux"
···350 '';
351 license = lib.licenses.psfl;
352 platforms = lib.platforms.all;
353- maintainers = with lib.maintainers; [ fridh ];
354 knownVulnerabilities = [
355 "Python 2.7 has reached its end of life after 2020-01-01. See https://www.python.org/doc/sunset-python-2/."
356 # Quote: That means that we will not improve it anymore after that day,
···350 '';
351 license = lib.licenses.psfl;
352 platforms = lib.platforms.all;
0353 knownVulnerabilities = [
354 "Python 2.7 has reached its end of life after 2020-01-01. See https://www.python.org/doc/sunset-python-2/."
355 # Quote: That means that we will not improve it anymore after that day,
···86 description = "An optimising static compiler for both the Python programming language and the extended Cython programming language";
87 homepage = "https://cython.org";
88 license = lib.licenses.asl20;
89- maintainers = with lib.maintainers; [ fridh ];
90 };
91}
···86 description = "An optimising static compiler for both the Python programming language and the extended Cython programming language";
87 homepage = "https://cython.org";
88 license = lib.licenses.asl20;
089 };
90}
···66 description = "An optimising static compiler for both the Python programming language and the extended Cython programming language";
67 homepage = "https://cython.org";
68 license = lib.licenses.asl20;
69- maintainers = with lib.maintainers; [ fridh ];
70 };
71}
···66 description = "An optimising static compiler for both the Python programming language and the extended Cython programming language";
67 homepage = "https://cython.org";
68 license = lib.licenses.asl20;
069 };
70}
···266 Python, providing labeled data structures similar to R data.frame
267 objects, statistical functions, and much more.
268 '';
269- maintainers = with maintainers; [ raskin fridh knedlsepp ];
270 };
271};
272in pandas
···266 Python, providing labeled data structures similar to R data.frame
267 objects, statistical functions, and much more.
268 '';
269+ maintainers = with maintainers; [ raskin knedlsepp ];
270 };
271};
272in pandas
···27 description = "A pythonic wrapper around FFTW, the FFT library, presenting a unified interface for all the supported transforms";
28 homepage = "http://hgomersall.github.com/pyFFTW/";
29 license = with licenses; [ bsd2 bsd3 ];
30- maintainers = with maintainers; [ fridh ];
31 };
32}
···27 description = "A pythonic wrapper around FFTW, the FFT library, presenting a unified interface for all the supported transforms";
28 homepage = "http://hgomersall.github.com/pyFFTW/";
29 license = with licenses; [ bsd2 bsd3 ];
030 };
31}
···27 description = "Download files using requests and save them to a target path";
28 homepage = "https://www.github.com/takluyver/requests_download";
29 license = lib.licenses.mit;
30- maintainers = [ lib.maintainers.fridh ];
31 };
32}
···27 description = "Download files using requests and save them to a target path";
28 homepage = "https://www.github.com/takluyver/requests_download";
29 license = lib.licenses.mit;
030 };
31}
···38 description = "Play and Record Sound with Python";
39 homepage = "http://python-sounddevice.rtfd.org/";
40 license = with lib.licenses; [ mit ];
41- maintainers = with lib.maintainers; [ fridh ];
42 };
43}
···38 description = "Play and Record Sound with Python";
39 homepage = "http://python-sounddevice.rtfd.org/";
40 license = with lib.licenses; [ mit ];
041 };
42}
···12, rustc
13, rustPlatform
14, rust-bindgen
15+# testing
16+, emptyFile
17+, nixos
18, nixosTests
19}@args':
2021+let overridableKernel =
22lib.makeOverridable ({ # The kernel source tarball.
23 src
24···215 }; # end of configfile derivation
216217 kernel = (callPackage ./manual-config.nix { inherit lib stdenv buildPackages; }) (basicArgs // {
218+ inherit kernelPatches randstructSeed extraMakeFlags extraMeta configfile modDirVersion;
219 pos = builtins.unsafeGetAttrPos "version" args;
220221+ config = {
222+ CONFIG_MODULES = "y";
223+ CONFIG_FW_LOADER = "m";
224+ CONFIG_RUST = lib.mkIf withRust "y";
225+ };
226+ });
227228in
229kernel.overrideAttrs (finalAttrs: previousAttrs: {
···249 + toString (lib.attrNames (lib.toFunction args { }))
250 ) overridableKernel;
251 };
252+ /* Certain arguments must be evaluated lazily; so that only the output(s) depend on them.
253+ Original reproducer / simplified use case:
254+ */
255+ versionDoesNotDependOnPatchesEtcNixOS =
256+ builtins.seq
257+ (nixos ({ config, pkgs, ... }: {
258+ boot.kernelPatches = [
259+ (builtins.seq config.boot.kernelPackages.kernel.version { patch = pkgs.emptyFile; })
260+ ];
261+ })).config.boot.kernelPackages.kernel.outPath
262+ emptyFile;
263+ versionDoesNotDependOnPatchesEtc =
264+ builtins.seq
265+ (import ./generic.nix args' (args // (
266+ let explain = attrName:
267+ ''
268+ The ${attrName} attribute must be able to access the kernel.version attribute without an infinite recursion.
269+ That means that the kernel attrset (attrNames) and the kernel.version attribute must not depend on the ${attrName} argument.
270+ The fact that this exception is raised shows that such a dependency does exist.
271+ This is a problem for the configurability of ${attrName} in version-aware logic such as that in NixOS.
272+ Strictness can creep in through optional attributes, or assertions and warnings that run as part of code that shouldn't access what is checked.
273+ '';
274+ in {
275+ kernelPatches = throw (explain "kernelPatches");
276+ structuredExtraConfig = throw (explain "structuredExtraConfig");
277+ modDirVersion = throw (explain "modDirVersion");
278+ }))).version
279+ emptyFile;
280+ in [
281+ (nixosTests.kernel-generic.passthru.testsForKernel overridableKernel)
282+ versionDoesNotDependOnPatchesEtc
283+ # Disabled by default, because the infinite recursion is hard to understand. The other test's error is better and produces a shorter trace.
284+ # versionDoesNotDependOnPatchesEtcNixOS
285+ ] ++ kernelTests;
286 };
287288+}));
289+in overridableKernel
···26 extraMakeFlags ? [],
27 # The name of the kernel module directory
28 # Needs to be X.Y.Z[-extra], so pad with zeros if needed.
29- modDirVersion ? lib.versions.pad 3 version,
30 # The kernel source (tarball, git checkout, etc.)
31 src,
32 # a list of { name=..., patch=..., extraConfig=...} patches
···54}:
5556let
000000057 inherit (lib)
58 hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
59
···26 extraMakeFlags ? [],
27 # The name of the kernel module directory
28 # Needs to be X.Y.Z[-extra], so pad with zeros if needed.
29+ modDirVersion ? null /* derive from version */,
30 # The kernel source (tarball, git checkout, etc.)
31 src,
32 # a list of { name=..., patch=..., extraConfig=...} patches
···54}:
5556let
57+ # Provide defaults. Note that we support `null` so that callers don't need to use optionalAttrs,
58+ # which can lead to unnecessary strictness and infinite recursions.
59+ modDirVersion_ = if modDirVersion == null then lib.versions.pad 3 version else modDirVersion;
60+in
61+let
62+ # Shadow the un-defaulted parameter; don't want null.
63+ modDirVersion = modDirVersion_;
64 inherit (lib)
65 hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
66
···29 description = "A program that compares two Nix expressions and determines which attributes changed";
30 homepage = "https://github.com/FRidh/niff";
31 license = lib.licenses.mit;
32- maintainers = [ lib.maintainers.fridh ];
33 mainProgram = "niff";
34 };
35}
···29 description = "A program that compares two Nix expressions and determines which attributes changed";
30 homepage = "https://github.com/FRidh/niff";
31 license = lib.licenses.mit;
032 mainProgram = "niff";
33 };
34}