c4patino/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-07-06 17:13:24 -05:00
Code Issues Projects Releases Packages Wiki Activity

Merge bdd995eaee into haskell-updates

Browse source
This commit is contained in:
nixpkgs-ci[bot] 2026-06-28 00:54:07 +00:00 • committed by GitHub
commit 435e7264b6
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
208 changed files with 2879 additions and 1560 deletions
Download patch file Download diff file Expand all files Collapse all files

3
ci/OWNERS
View file

@ -361,7 +361,8 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
/pkgs/development/lua-modules @NixOS/lua
# Neovim
/pkgs/applications/editors/neovim @NixOS/neovim
/pkgs/applications/editors/neovim @NixOS/neovim
/doc/languages-frameworks/neovim.section.md @NixOS/neovim
# VimPlugins
/pkgs/applications/editors/vim/plugins @NixOS/neovim

36
doc/languages-frameworks/neovim.section.md
View file

@ -25,7 +25,7 @@ neovim.override {
withRuby = false;
configure = {
customRC = ''
# here your custom viml configuration goes!
" here your custom viml configuration goes!
'';
packages.myVimPackage = with pkgs.vimPlugins; {
# See examples below on how to use custom packages.
@ -47,7 +47,7 @@ neovim-qt.override {
neovim = neovim.override {
configure = {
customRC = ''
# your custom viml configuration
" your custom viml configuration
'';
};
};
@ -64,11 +64,14 @@ For instance, `sqlite-lua` needs `g:sqlite_clib_path` to be set to work. Nixpkgs
- `wrapRc`: Nix, not being able to write in your `$HOME`, loads the
generated Neovim configuration via the `$VIMINIT` environment variable, i.e. : `export VIMINIT='lua dofile("/nix/store/…-init.lua")'`. This has side effects like preventing Neovim from sourcing your `init.lua` in `$XDG_CONFIG_HOME/nvim` (see bullet 7 of [`:help startup`](https://neovim.io/doc/user/starting.html#startup) in Neovim). Disable it if you want to generate your own wrapper. You can still reuse the generated vimscript init code via `neovim.passthru.initRc`.
- `plugins`: A list of plugins to add to the wrapper.
- `extraLuaPackages`: A function passed on to `lua.withPackages`
- `withPython3`, `withNodeJs`, `withRuby` control when to enable neovim
- `extraLuaPackages`: A function passed on to `lua.withPackages`.
- `extraPython3Packages`: A function passed on to `python3.withPackages`.
- `withPython3`, `withNodeJs`, `withRuby`, `withPerl` control when to enable neovim
providers (see `:h provider`).
- `vimAlias` and `viAlias` control whether to symlink the `vim` and `vi` binaries to `nvim` respectively.
- `extraName` is a string appended to the package name and derivation name.
```
```nix
wrapNeovimUnstable neovim-unwrapped {
autoconfigure = true;
autowrapRuntimeDeps = true;
@ -80,7 +83,8 @@ wrapNeovimUnstable neovim-unwrapped {
vim.opt.colorcolumn = { 100 }
vim.opt.termguicolors = true
'';
# plugins accepts a list of either plugins or { plugin = ...; config = ..vimscript.. };
# plugins accepts a list of either plugins or attribute sets containing:
# { plugin = ...; config = ...; type = "viml"|"lua"; } (type defaults to "viml")
plugins = with vimPlugins; [
{
plugin = vim-obsession;
@ -88,7 +92,19 @@ wrapNeovimUnstable neovim-unwrapped {
map <Leader>$ <Cmd>Obsession<CR>
'';
}
(nvim-treesitter.withPlugins (p: [ p.nix p.python ]))
{
plugin = grug-far-nvim;
type = "lua";
config = ''
require('grug-far').setup({
startInInsertMode = false,
})
'';
}
(nvim-treesitter.withPlugins (p: [
p.nix
p.python
]))
hex-nvim
];
extraLuaPackages = lp: [ lp.mpack ];
@ -98,12 +114,12 @@ wrapNeovimUnstable neovim-unwrapped {
}
```
You can explore the configuration with`nix repl` to discover these options and
You can explore the configuration with `nix repl` to discover these options and
override them. For instance:
```nix
neovim.overrideAttrs (oldAttrs: {
neovim.override {
autowrapRuntimeDeps = false;
})
}
```
## Specificities for some plugins {#neovim-plugin-specificities}

2
doc/release-notes/rl-2611.section.md
View file

@ -56,6 +56,8 @@
- `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
- `pnpm_10` was upgraded to version 10.34.1+, which introduced stricter integrity checks. If you encounter `ERR_PNPM_MISSING_TARBALL_INTEGRITY`, you can fall back to the older `pnpm_10_34_0`.
- `fetchPnpmDeps`' `fetcherVersion = 1` and `fetcherVersion = 2` have been
removed, as announced in the 26.05 release. Packages still using them now
throw an evaluation error and must migrate to `fetcherVersion = 3` (or later)

2
maintainers/README.md
View file

@ -160,7 +160,7 @@ Once approved, the team will have the right privileges to be pinged and requeste
> [!TIP]
> The team name should be as short as possible; because it is nested under the maintainers group, no -maintainers suffix is needed.
After the first [weekly team sync](../.github/workflows/team-sync.yml) with the new team, it's then also possible to link it to the entry in `team-list.nix` by setting its `github` field to the GitHub team name.
After the first [weekly team sync](../.github/workflows/teams.yml) with the new team, it's then also possible to link it to the entry in `team-list.nix` by setting its `github` field to the GitHub team name.
# Maintainer scripts

24
maintainers/maintainer-list.nix
View file

@ -11274,12 +11274,6 @@
github = "hxtmdev";
githubId = 7771007;
};
hypersw = {
email = "baltic@hypersw.net";
github = "hypersw";
githubId = 2332070;
name = "Serge Baltic";
};
hythera = {
name = "Hythera";
github = "Hythera";
@ -18137,12 +18131,6 @@
githubId = 14096356;
name = "Michael McLeod";
};
mikefaille = {
email = "michael@faille.io";
github = "mikefaille";
githubId = 978196;
name = "Michaël Faille";
};
mikehorn = {
email = "mikehornproton@proton.me";
github = "MikeHorn-git";
@ -28971,6 +28959,12 @@
github = "uxodb";
githubId = 20535246;
};
uzlkav = {
name = "Uzlkav";
github = "Uzlkav";
githubId = 177883133;
matrix = "@capybara_squash:unredacted.org";
};
V = {
name = "V";
email = "v@anomalous.eu";
@ -31282,6 +31276,12 @@
github = "zuzuleinen";
githubId = 944919;
};
zwang20 = {
name = "Michael Wang";
github = "zwang20";
githubId = 41721295;
matrix = "@michael_wzq:matrix.org";
};
zx2c4 = {
email = "Jason@zx2c4.com";
github = "zx2c4";

3
nixos/lib/test-driver/default.nix
View file

@ -18,8 +18,6 @@
netpbm,
vhost-device-vsock,
nixosTests,
qemu_pkg ? qemu_test,
qemu_test,
setuptools,
socat,
systemd,
@ -56,7 +54,6 @@ buildPythonApplication {
propagatedBuildInputs = [
coreutils
netpbm
qemu_pkg
socat
util-linux
vde2

1
nixos/lib/test-driver/src/test_driver/machine/__init__.py
View file

@ -1688,6 +1688,7 @@ class NspawnMachine(BaseMachine):
self.process = subprocess.Popen(
[self.start_command],
cwd=self.state_dir,
env={
"RUN_NSPAWN_ROOT_DIR": str(self.state_dir),
"RUN_NSPAWN_SHARED_DIR": str(self.shared_dir),

1
nixos/lib/testing/driver.nix
View file

@ -20,7 +20,6 @@ let
# the respective qemu version and with or without ocr support
testDriver = config.pythonTestDriverPackage.override {
inherit (config) enableOCR extraPythonPackages;
qemu_pkg = config.qemu.package;
enableNspawn = config.containers != { };
};

9
nixos/modules/services/hardware/udev.nix
View file

@ -461,10 +461,17 @@ in
"${config.boot.initrd.systemd.package}/lib/systemd/systemd-udevd"
"${config.boot.initrd.systemd.package}/lib/udev/ata_id"
"${config.boot.initrd.systemd.package}/lib/udev/cdrom_id"
"${config.boot.initrd.systemd.package}/lib/udev/dmi_memory_id"
"${config.boot.initrd.systemd.package}/lib/udev/scsi_id"
"${config.boot.initrd.systemd.package}/lib/udev/rules.d"
]
++ lib.optional (
# https://github.com/systemd/systemd/blob/v259/meson.build#L1529-L1530
pkgs.stdenv.hostPlatform.isx86
|| pkgs.stdenv.hostPlatform.isAarch
|| pkgs.stdenv.hostPlatform.isLoongArch64
|| pkgs.stdenv.hostPlatform.isMips
|| pkgs.stdenv.hostPlatform.isRiscV64
) "${config.boot.initrd.systemd.package}/lib/udev/dmi_memory_id"
++ map (x: "${x}/bin") config.boot.initrd.services.udev.binPackages;
# Generate the udev rules for the initrd

107
nixos/modules/services/mail/dovecot.nix
View file

@ -7,7 +7,6 @@
let
inherit (lib)
all
attrsToList
concatMapStringsSep
concatStringsSep
@ -19,7 +18,6 @@ let
isBool
isDerivation
isInt
isList
isPath
isString
listToAttrs
@ -98,53 +96,67 @@ let
i: n: v:
"${i}${toString n} = ${v}";
formatKeyValue =
indent: n: v:
if (v == null) then
""
else if isInt v then
toOption indent n (toString v)
isPrimitive = v: !isAttrs v || isDerivation v;
formatPrimitive =
v:
if isInt v then
toString v
else if isBool v then
toOption indent n (yesOrNo v)
yesOrNo v
else if isString v then
toOption indent n v
else if isList v then
if all isString v then
toOption indent n (concatStringsSep " " v)
else
map (formatKeyValue indent n) v
v
else if isPath v || isDerivation v then
# paths -> copy to store
# derivations -> just use output path instead of looping over the attrs
toOption indent n "${v}"
else if isAttrs v && v ? _section then
let
sectionType = v._section.type;
sectionName = v._section.name;
sectionTitle = concatStringsSep " " (
filter (s: s != null) [
sectionType
sectionName
]
);
in
concatStringsSep "\n" (
[
"${indent}${sectionTitle} {"
]
++ (mapAttrsToList (formatKeyValue "${indent} ") (removeAttrs v [ "_section" ]))
++ [ "${indent}}" ]
)
else if isAttrs v then
concatStringsSep "\n" (
[
"${indent}${n} {"
]
++ (mapAttrsToList (formatKeyValue "${indent} ") v)
++ [ "${indent}}" ]
)
"${v}"
else
throw (traceSeq v "services.dovecot2.settings: unexpected type");
throw (traceSeq v "services.dovecot2.settings: unexpected primitive type");
formatSection =
indent: n: v:
let
sectionTitle =
if v ? _section then
concatStringsSep " " (
filter (s: s != null) [
v._section.type
v._section.name
]
)
else
n;
inner = removeAttrs v [ "_section" ];
in
concatStringsSep "\n" (
[ "${indent}${sectionTitle} {" ]
++ flatten (mapAttrsToList (primitiveLinesFor "${indent} ") inner)
++ flatten (mapAttrsToList (sectionLinesFor "${indent} ") inner)
++ [ "${indent}}" ]
);
# emit lines for a k=v pair only when the value is a primitive
primitiveLinesFor =
indent: n: v:
let
primitives = filter isPrimitive (flatten [ v ]);
hasOnlySections = primitives == [ ] && v != [ ];
in
# Only emit an empty list if the original entry was also an empty list.
# This is so that values like k = [{ ... }] will not produce an output
# here, but k = [] will, even though they result in the same
# primitives = [].
optional (!hasOnlySections && v != null) (
toOption indent n (concatMapStringsSep " " formatPrimitive primitives)
);
# emit lines for a k=v pair only when the value is *not* a primitive
sectionLinesFor =
indent: n: v:
let
sections = filter (e: !isPrimitive e) (flatten [ v ]);
in
map (e: formatSection indent n e) sections;
doveConf =
let
@ -156,10 +168,13 @@ let
];
in
concatStringsSep "\n" (
optional (configVersion != null) (formatKeyValue "" "dovecot_config_version" configVersion)
++ optional (storageVersion != null) (formatKeyValue "" "dovecot_storage_version" storageVersion)
optionals (configVersion != null) (primitiveLinesFor "" "dovecot_config_version" configVersion)
++ optionals (storageVersion != null) (
primitiveLinesFor "" "dovecot_storage_version" storageVersion
)
++ optionals (cfg.includeFiles != [ ]) (map (f: "!include ${f}") cfg.includeFiles)
++ flatten (mapAttrsToList (formatKeyValue "") remainingSettings)
++ flatten (mapAttrsToList (primitiveLinesFor "") remainingSettings)
++ flatten (mapAttrsToList (sectionLinesFor "") remainingSettings)
);
isPre24 = versionOlder cfg.package.version "2.4";

2
nixos/modules/services/network-filesystems/kubo.nix
View file

@ -334,7 +334,7 @@ in
programs.fuse = {
enable = lib.mkIf cfg.autoMount true;
userAllowOther = lib.mkIf cfg.settings.Mounts.fuseAllowOther true;
userAllowOther = lib.mkIf cfg.settings.Mounts.FuseAllowOther true;
};
users.users = lib.mkIf (cfg.user == "ipfs") {

1
nixos/modules/services/networking/ntp/ntpd-rs.nix
View file

@ -70,6 +70,7 @@ in
services.ntpd-rs.settings = {
observability = {
log-level = lib.mkDefault "warn";
observation-path = lib.mkDefault "/var/run/ntpd-rs/observe";
};
source = lib.mkIf cfg.useNetworkingTimeServers (

7
nixos/modules/services/web-apps/tabbyapi.nix
View file

@ -167,6 +167,13 @@ in
wantedBy = [ "multi-user.target" ];
description = "TabbyAPI - OAI compatible server for Exllama";
# Triton & huggingface downloader need writable cache folders
environment = {
HOME = "/var/lib/tabbyapi";
XDG_CACHE_HOME = "/var/lib/tabbyapi/.cache";
TRITON_CACHE_DIR = "/tmp/triton";
};
serviceConfig = {
ExecStart = "${lib.getExe cfg.package} --config=${configFile}";
Restart = "on-failure";

7
nixos/modules/system/boot/networkd.nix
View file

@ -4231,8 +4231,10 @@ let
"systemd-networkd-wait-online@.service"
"systemd-networkd.service"
"systemd-networkd.socket"
"systemd-networkd-persistent-storage.service"
"systemd-networkd-resolve-hook.socket"
"systemd-networkd-varlink-metrics.socket"
"systemd-networkd-varlink.socket"
"systemd-networkd-persistent-storage.service"
];
systemd.sockets.systemd-networkd-varlink-metrics.wantedBy = [ "sockets.target" ];
@ -4314,6 +4316,9 @@ let
systemd.additionalUpstreamUnits = [
"systemd-networkd-wait-online.service"
"systemd-networkd.service"
"systemd-networkd-resolve-hook.socket"
"systemd-networkd-varlink-metrics.socket"
"systemd-networkd-varlink.socket"
"systemd-networkd.socket"
"systemd-network-generator.service"
"network-online.target"

13
nixos/modules/system/boot/resolved.nix
View file

@ -185,7 +185,11 @@ in
# added with order 501 to allow modules to go before with mkBefore
system.nssDatabases.hosts = (mkOrder 501 [ "resolve [!UNAVAIL=return]" ]);
systemd.additionalUpstreamSystemUnits = [ "systemd-resolved.service" ];
systemd.additionalUpstreamSystemUnits = [
"systemd-resolved.service"
"systemd-resolved-monitor.socket"
"systemd-resolved-varlink.socket"
];
systemd.services.systemd-resolved = {
wantedBy = [ "sysinit.target" ];
@ -248,7 +252,12 @@ in
tmpfiles.settings.systemd-resolved-stub."/etc/resolv.conf".L.argument =
"/run/systemd/resolve/stub-resolv.conf";
additionalUpstreamUnits = [ "systemd-resolved.service" ];
additionalUpstreamUnits = [
"systemd-resolved.service"
"systemd-resolved-monitor.socket"
"systemd-resolved-varlink.socket"
];
users.systemd-resolve = { };
groups.systemd-resolve = { };
storePaths = [ "${config.boot.initrd.systemd.package}/lib/systemd/systemd-resolved" ];

15
nixos/modules/system/boot/systemd.nix
View file

@ -65,6 +65,7 @@ let
# Udev.
"systemd-udevd-control.socket"
"systemd-udevd-kernel.socket"
"systemd-udevd-varlink.socket"
"systemd-udevd.service"
]
++ (optional (!config.boot.isContainer) "systemd-udev-trigger.service")
@ -157,6 +158,8 @@ let
"systemd-ask-password-wall.service"
# Varlink APIs
"systemd-ask-password@.service"
"systemd-ask-password.socket"
]
++ lib.optionals cfg.package.withBootloader [
"systemd-bootctl@.service"
@ -178,11 +181,13 @@ let
]
++ optionals cfg.package.withImportd [
"systemd-importd.service"
"systemd-importd.socket"
]
++ optionals cfg.package.withMachined [
"machine.slice"
"machines.target"
"systemd-machined.service"
"systemd-machined.socket"
]
++ optionals cfg.package.withNspawn [
"systemd-nspawn@.service"
@ -191,6 +196,9 @@ let
# Misc.
"systemd-sysctl.service"
"systemd-machine-id-commit.service"
"systemd-mute-console@.service"
"systemd-mute-console.socket"
]
++ optionals cfg.package.withTimedated [
"dbus-org.freedesktop.timedate1.service"
@ -209,6 +217,11 @@ let
"dbus-org.freedesktop.portable1.service"
"systemd-portabled.service"
]
++ optionals cfg.package.withRepart [
# Varlink APIs
"systemd-repart@.service"
"systemd-repart.socket"
]
++ [
"systemd-exit.service"
"systemd-update-done.service"
@ -221,6 +234,8 @@ let
"factory-reset.target"
"systemd-factory-reset-request.service"
"systemd-factory-reset-reboot.service"
"systemd-factory-reset@.service"
"systemd-factory-reset.socket"
]
++ cfg.additionalUpstreamSystemUnits;

6
nixos/modules/system/boot/systemd/repart.nix
View file

@ -157,6 +157,12 @@ in
boot.initrd.systemd = lib.mkIf initrdCfg.enable {
additionalUpstreamUnits = [
"systemd-repart.service"
# Varlink APIs
# NOTE: compared to stage 2 where the IPC is enabled in the global location, initrd
# might be optimized to keep away the repart binary.
# As a result, we enable repart IPC in the initrd only if repart is enabled in the initrd.
"systemd-repart.socket"
"systemd-repart@.service"
];
storePaths = [

1
nixos/modules/system/boot/systemd/tmpfiles.nix
View file

@ -317,6 +317,7 @@ in
mkdir -p $out/lib/tmpfiles.d
cd $out/lib/tmpfiles.d
ln -s "${systemd}/example/tmpfiles.d/credstore.conf"
ln -s "${systemd}/example/tmpfiles.d/home.conf"
ln -s "${systemd}/example/tmpfiles.d/journal-nocow.conf"
ln -s "${systemd}/example/tmpfiles.d/portables.conf"

9
nixos/modules/system/boot/systemd/tpm2.nix
View file

@ -43,6 +43,8 @@
"tpm2.target"
"systemd-tpm2-setup-early.service"
"systemd-tpm2-setup.service"
"systemd-pcrextend.socket"
"systemd-pcrextend@.service"
];
}
)
@ -69,6 +71,8 @@
boot.initrd.systemd.additionalUpstreamUnits = [
"tpm2.target"
"systemd-tpm2-setup-early.service"
"systemd-pcrextend.socket"
"systemd-pcrextend@.service"
];
boot.initrd.availableKernelModules = [
@ -81,6 +85,7 @@
pkgs.tpm2-tss
"${cfg.package}/lib/systemd/systemd-tpm2-setup"
"${cfg.package}/lib/systemd/system-generators/systemd-tpm2-generator"
"${cfg.package}/lib/systemd/systemd-pcrextend"
];
}
)
@ -89,7 +94,9 @@
cfg = config.boot.initrd.systemd;
in
lib.mkIf (cfg.enable && cfg.tpm2.enable && cfg.tpm2.pcrphases.enable) {
boot.initrd.systemd.additionalUpstreamUnits = [ "systemd-pcrphase-initrd.service" ];
boot.initrd.systemd.additionalUpstreamUnits = [
"systemd-pcrphase-initrd.service"
];
boot.initrd.systemd.services.systemd-pcrphase-initrd.wantedBy = [ "initrd.target" ];
boot.initrd.systemd.storePaths = [ "${cfg.package}/lib/systemd/systemd-pcrextend" ];
}

63
nixos/modules/virtualisation/credentials-options.nix Normal file
View file

@ -0,0 +1,63 @@
{ lib, pkgs, ... }:
{
options.virtualisation.credentials = lib.mkOption {
description = ''
Credentials to pass to the VM or container using systemd's credential system.
See {manpage}`systemd.exec(5)`, {manpage}`systemd-creds(1)` and https://systemd.io/CREDENTIALS/ for more
information about systemd credentials.
'';
default = { };
example = lib.literalExpression ''
{
database-password = {
text = "my-secret-password";
};
ssl-cert = {
source = "./cert.pem";
};
binary-key = {
source = "./private.der";
};
}
'';
type = lib.types.attrsOf (
lib.types.submodule (
{
name,
options,
config,
...
}:
{
options = {
source = lib.mkOption {
type = lib.types.nullOr (lib.types.pathWith { });
default = null;
description = ''
Source file on the host containing the credential data.
'';
};
text = lib.mkOption {
default = null;
type = lib.types.nullOr lib.types.str;
description = ''
Text content of the credential.
For binary data or when the credential content should come from
an existing file, use `source` instead.
::: {.warning}
The text here is stored in the host's nix store as a file.
:::
'';
};
};
config.source = lib.mkIf (config.text != null) (
lib.mkDerivedConfig options.text (pkgs.writeText name)
);
}
)
);
};
}

7
nixos/modules/virtualisation/nspawn-container/default.nix
View file

@ -21,6 +21,10 @@ let
cfg = config.virtualisation;
in
{
imports = [
../credentials-options.nix
];
options = {
virtualisation.cmdline = lib.mkOption {
@ -131,7 +135,8 @@ in
# Send a READY=1 notification to a socket when the container is fully booted.
"--notify-ready=yes"
];
]
++ lib.mapAttrsToList (name: cred: "--load-credential=${name}:${cred.source}") cfg.credentials;
system.build.nspawn =
let

88
nixos/modules/virtualisation/qemu-vm.nix
View file

@ -399,6 +399,7 @@ in
imports = [
../profiles/qemu-guest.nix
./disk-size-option.nix
./credentials-options.nix
(mkRenamedOptionModule
[
"virtualisation"
@ -1126,81 +1127,20 @@ in
};
virtualisation.credentials = mkOption {
description = ''
Credentials to pass to the VM using systemd's credential system.
See {manpage}`systemd.exec(5)` , {manpage}`systemd-creds(1)` and https://systemd.io/CREDENTIALS/ for more
information about systemd credentials.
'';
default = { };
example = {
database-password = {
text = "my-secret-password";
};
ssl-cert = {
source = "./cert.pem";
};
binary-key = {
mechanism = "fw_cfg";
source = "./private.der";
};
config-file = {
mechanism = "smbios";
text = ''
[database]
host=localhost
port=5432
'';
};
};
type = types.attrsOf (
lib.types.submodule (
{
name,
options,
config,
...
}:
{
options = {
mechanism = lib.mkOption {
type = lib.types.enum [
"fw_cfg"
"smbios"
];
default = if pkgs.stdenv.hostPlatform.isx86 then "smbios" else "fw_cfg";
defaultText = lib.literalExpression ''if pkgs.stdenv.hostPlatform.isx86 then "smbios" else "fw_cfg"'';
description = ''
The mechanism used to pass the credential to the VM.
'';
};
source = lib.mkOption {
type = lib.types.nullOr (lib.types.pathWith { });
default = null;
description = ''
Source file on the host containing the credential data.
'';
};
text = lib.mkOption {
default = null;
type = lib.types.nullOr lib.types.str;
description = ''
Text content of the credential.
For binary data or when the credential content should come from
an existing file, use `source` instead.
::: {.warning}
The text here is stored in the host's nix store as a file.
:::
'';
};
};
config.source = lib.mkIf (config.text != null) (
lib.mkDerivedConfig options.text (pkgs.writeText name)
);
}
)
lib.types.submodule {
options.mechanism = lib.mkOption {
type = lib.types.enum [
"fw_cfg"
"smbios"
];
default = if pkgs.stdenv.hostPlatform.isx86 then "smbios" else "fw_cfg";
defaultText = lib.literalExpression ''if pkgs.stdenv.hostPlatform.isx86 then "smbios" else "fw_cfg"'';
description = ''
The mechanism used to pass the credential to the VM.
'';
};
}
);
};

17
nixos/tests/all-tests.nix
View file

@ -446,6 +446,14 @@ in
};
coturn = runTest ./coturn.nix;
couchdb = runTest ./couchdb.nix;
credentials-fwcfg = runTest {
imports = [ ./credentials.nix ];
_module.args.mechanism = "fw_cfg";
};
credentials-smbios = runTestOn [ "x86_64-linux" ] {
imports = [ ./credentials.nix ];
_module.args.mechanism = "smbios";
};
cri-o = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./cri-o.nix;
croc = runTest ./croc.nix;
cross-seed = runTest ./cross-seed.nix;
@ -1423,14 +1431,6 @@ in
pykms = runTest ./pykms.nix;
qbittorrent = runTest ./qbittorrent.nix;
qboot = runTestOn [ "x86_64-linux" "i686-linux" ] ./qboot.nix;
qemu-vm-credentials-fwcfg = runTest {
imports = [ ./qemu-vm-credentials.nix ];
_module.args.mechanism = "fw_cfg";
};
qemu-vm-credentials-smbios = runTestOn [ "x86_64-linux" ] {
imports = [ ./qemu-vm-credentials.nix ];
_module.args.mechanism = "smbios";
};
qemu-vm-external-disk-image = runTest ./qemu-vm-external-disk-image.nix;
qemu-vm-restrictnetwork = handleTest ./qemu-vm-restrictnetwork.nix { };
qemu-vm-store = runTest ./qemu-vm-store.nix;
@ -1713,6 +1713,7 @@ in
systemd-user-settings = runTest ./systemd-user-settings.nix;
systemd-user-tmpfiles-rules = runTest ./systemd-user-tmpfiles-rules.nix;
systemd-userdbd = runTest ./systemd-userdbd.nix;
systemd-varlink = runTest ./systemd-varlink.nix;
systemtap = handleTest ./systemtap.nix { };
szurubooru = handleTest ./szurubooru.nix { };
taler = handleTest ./taler { };

2
nixos/tests/boot.nix
View file

@ -207,7 +207,7 @@ in
import os
# Create a mutable linked image backed by the read-only SD image
if os.system("qemu-img create -f qcow2 -F raw -b ${sdImage} ${mutableImage}") != 0:
if os.system("${pkgs.qemu}/bin/qemu-img create -f qcow2 -F raw -b ${sdImage} ${mutableImage}") != 0:
raise RuntimeError("Could not create mutable linked image")
machine = create_machine("${startCommand}")

8
nixos/tests/common/ec2.nix
View file

@ -51,9 +51,11 @@ in
)
os.makedirs(image_dir, mode=0o700, exist_ok=True)
disk_image = os.path.join(image_dir, "machine.qcow2")
QEMU_BIN = "${pkgs.qemu}"
QEMU_IMG = f"{QEMU_BIN}/bin/qemu-img"
subprocess.check_call(
[
"qemu-img",
QEMU_IMG,
"create",
"-f",
"qcow2",
@ -64,7 +66,7 @@ in
disk_image,
]
)
subprocess.check_call(["qemu-img", "resize", disk_image, "10G"])
subprocess.check_call([QEMU_IMG, "resize", disk_image, "10G"])
# Note: we use net=169.0.0.0/8 rather than
# net=169.254.0.0/16 to prevent dhcpcd from getting horribly
@ -74,7 +76,7 @@ in
# turn off the DHCP server, but qemu does not have an option
# to do that.
start_command = (
"qemu-kvm -m 1024"
f"{QEMU_BIN}/bin/qemu-kvm -m 1024"
+ " -device virtio-net-pci,netdev=vlan0"
+ " -netdev 'user,id=vlan0,net=169.0.0.0/8,guestfwd=tcp:169.254.169.254:80-cmd:${getExe imdsServer} ${metaData}'"
+ f" -drive file={disk_image},if=virtio,werror=report"

106
nixos/tests/credentials.nix Normal file
View file

@ -0,0 +1,106 @@
{
lib,
pkgs,
mechanism,
...
}:
let
secret = ''
foo
bar
baz
'';
secret-file = "bar";
common-credentials = {
secret-default-mechanism = {
text = "default-mechanism";
};
secret-file-nix-store = {
source = pkgs.writeText "secret-file-nix-store" secret-file;
};
secret-file-host = {
source = "./secret-file-host";
};
secret-file-host-binary = {
source = "./secret-file-host-binary";
};
};
in
{
name = "credentials-${mechanism}";
meta.maintainers = with lib.maintainers; [ arianvp ];
# No VM<->container traffic in this test; credentials are static.
requiredFeatures.devnet = lib.mkForce false;
nodes.vm = {
virtualisation.credentials = common-credentials // {
secret = {
inherit mechanism;
text = secret;
};
};
};
containers.container = {
virtualisation.credentials = common-credentials // {
secret = {
text = secret;
};
};
};
testScript = ''
import base64
secret_file_host = "baz"
# Binary data with null bytes, high bytes, and other problematic characters.
secret_file_host_binary = bytes([
0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
0xDE, 0xAD, 0xBE, 0xEF,
0xFF, 0xFE, 0xFD, 0xFC,
0x00, 0x00, 0x00, 0x00,
0x80, 0x81, 0x82, 0x83,
])
def assert_credentials(m):
with open(m.state_dir / "secret-file-host", "w") as f:
f.write(secret_file_host)
with open(m.state_dir / "secret-file-host-binary", "wb") as f2:
f2.write(secret_file_host_binary)
t.assertEqual(
m.succeed("systemd-creds --system cat secret").strip(),
"foo\nbar\nbaz",
)
t.assertEqual(
m.succeed("systemd-creds --system cat secret-default-mechanism").strip(),
"default-mechanism",
)
t.assertEqual(
m.succeed("systemd-creds --system cat secret-file-nix-store").strip(),
"${secret-file}",
)
t.assertEqual(
m.succeed("systemd-creds --system cat secret-file-host").strip(),
secret_file_host,
)
result = m.succeed(
"systemd-creds --system cat secret-file-host-binary --transcode=base64"
).strip()
expected = base64.b64encode(secret_file_host_binary).decode("ascii")
t.assertEqual(
result,
expected,
f"Binary credential mismatch: got {result}, expected {expected}",
)
assert_credentials(vm)
assert_credentials(container)
'';
}

482
nixos/tests/ec2-image.nix
View file

@ -88,294 +88,298 @@ in
};
};
testScript = ''
import os
import re
import subprocess
import tempfile
testScript =
{ nodes, ... }:
''
import os
import re
import subprocess
import tempfile
# Instance Metadata Service (IMDSv2 with 1.0 metadata version)
# TODO: Use 'latest' metadata version instead of '1.0'
# TODO: [Test matrix] also test providing the host key through IMDS
# - i.e. a test module argument to select between writing or reading the host key
def create_ec2_metadata_dir(temp_dir, client_pubkey):
"""Create fake EC2 metadata directory structure with mock data"""
metadata_dir = os.path.join(temp_dir.name, "ec2-metadata")
# Instance Metadata Service (IMDSv2 with 1.0 metadata version)
# TODO: Use 'latest' metadata version instead of '1.0'
# TODO: [Test matrix] also test providing the host key through IMDS
# - i.e. a test module argument to select between writing or reading the host key
def create_ec2_metadata_dir(temp_dir, client_pubkey):
"""Create fake EC2 metadata directory structure with mock data"""
metadata_dir = os.path.join(temp_dir.name, "ec2-metadata")
# Create directory structure
os.makedirs(os.path.join(metadata_dir, "1.0", "meta-data", "public-keys", "0"), exist_ok=True)
os.makedirs(os.path.join(metadata_dir, "latest", "api"), exist_ok=True)
# Create directory structure
os.makedirs(os.path.join(metadata_dir, "1.0", "meta-data", "public-keys", "0"), exist_ok=True)
os.makedirs(os.path.join(metadata_dir, "latest", "api"), exist_ok=True)
# Metadata version 1.0 endpoints (what fetch-ec2-metadata.sh actually fetches)
with open(os.path.join(metadata_dir, "1.0", "meta-data", "hostname"), "w") as f:
f.write("test-instance")
with open(os.path.join(metadata_dir, "1.0", "meta-data", "ami-manifest-path"), "w") as f:
f.write("(test)")
with open(os.path.join(metadata_dir, "1.0", "meta-data", "instance-id"), "w") as f:
f.write("i-1234567890abcdef0")
with open(os.path.join(metadata_dir, "1.0", "user-data"), "w") as f:
f.write("")
with open(os.path.join(metadata_dir, "1.0", "meta-data", "public-keys", "0", "openssh-key"), "w") as f:
f.write(client_pubkey)
# Metadata version 1.0 endpoints (what fetch-ec2-metadata.sh actually fetches)
with open(os.path.join(metadata_dir, "1.0", "meta-data", "hostname"), "w") as f:
f.write("test-instance")
with open(os.path.join(metadata_dir, "1.0", "meta-data", "ami-manifest-path"), "w") as f:
f.write("(test)")
with open(os.path.join(metadata_dir, "1.0", "meta-data", "instance-id"), "w") as f:
f.write("i-1234567890abcdef0")
with open(os.path.join(metadata_dir, "1.0", "user-data"), "w") as f:
f.write("")
with open(os.path.join(metadata_dir, "1.0", "meta-data", "public-keys", "0", "openssh-key"), "w") as f:
f.write(client_pubkey)
# IMDSv2 token endpoint - return a fake token
with open(os.path.join(metadata_dir, "latest", "api", "token"), "w") as f:
f.write("test-token-12345")
# IMDSv2 token endpoint - return a fake token
with open(os.path.join(metadata_dir, "latest", "api", "token"), "w") as f:
f.write("test-token-12345")
return metadata_dir
return metadata_dir
def generate_client_ssh_key():
"""Generate SSH key pair on VM host for client authentication"""
# Use temporary directory for key generation
import tempfile
with tempfile.TemporaryDirectory() as key_dir:
private_key = os.path.join(key_dir, "id_ed25519")
public_key = os.path.join(key_dir, "id_ed25519.pub")
def generate_client_ssh_key():
"""Generate SSH key pair on VM host for client authentication"""
# Use temporary directory for key generation
import tempfile
with tempfile.TemporaryDirectory() as key_dir:
private_key = os.path.join(key_dir, "id_ed25519")
public_key = os.path.join(key_dir, "id_ed25519.pub")
# Generate key pair using host SSH tools
ret = os.system(f"${hostPkgs.openssh}/bin/ssh-keygen -t ed25519 -f {private_key} -N \"\"")
if ret != 0:
raise Exception("Failed to generate SSH key pair")
# Generate key pair using host SSH tools
ret = os.system(f"${hostPkgs.openssh}/bin/ssh-keygen -t ed25519 -f {private_key} -N \"\"")
if ret != 0:
raise Exception("Failed to generate SSH key pair")
# Read the generated public key
with open(public_key, "r") as f:
client_pubkey = f.read().strip()
# Read the generated public key
with open(public_key, "r") as f:
client_pubkey = f.read().strip()
# Read the private key
with open(private_key, "r") as f:
client_private_key = f.read()
# Read the private key
with open(private_key, "r") as f:
client_private_key = f.read()
return client_pubkey, client_private_key
return client_pubkey, client_private_key
def setup_client_ssh_key(client, client_private_key):
"""Install the pre-generated SSH private key on client"""
client.succeed("mkdir -p /root/.ssh")
client.succeed(f"cat > /root/.ssh/id_ed25519 << 'EOF'\n{client_private_key}\nEOF")
client.succeed("chmod 600 /root/.ssh/id_ed25519")
def setup_client_ssh_key(client, client_private_key):
"""Install the pre-generated SSH private key on client"""
client.succeed("mkdir -p /root/.ssh")
client.succeed(f"cat > /root/.ssh/id_ed25519 << 'EOF'\n{client_private_key}\nEOF")
client.succeed("chmod 600 /root/.ssh/id_ed25519")
def setup_machine(temp_dir, client_pubkey):
"""Initialize EC2 machine with disk image, metadata server, and networking"""
# Set up disk image
image_dir = os.path.join(
os.environ.get("TMPDIR", tempfile.gettempdir()), "tmp", "vm-state-machine"
)
os.makedirs(image_dir, mode=0o700, exist_ok=True)
disk_image = os.path.join(image_dir, "machine.qcow2")
subprocess.check_call([
"qemu-img", "create", "-f", "qcow2", "-F", "qcow2",
"-o", "backing_file=${image}", disk_image
])
subprocess.check_call(["qemu-img", "resize", disk_image, "10G"])
def setup_machine(temp_dir, client_pubkey):
"""Initialize EC2 machine with disk image, metadata server, and networking"""
# Set up disk image
image_dir = os.path.join(
os.environ.get("TMPDIR", tempfile.gettempdir()), "tmp", "vm-state-machine"
)
os.makedirs(image_dir, mode=0o700, exist_ok=True)
disk_image = os.path.join(image_dir, "machine.qcow2")
QEMU = "${nodes.machine.virtualisation.qemu.package}"
QEMU_IMG = f"{QEMU}/bin/qemu-img"
subprocess.check_call([
QEMU_IMG, "create", "-f", "qcow2", "-F", "qcow2",
"-o", "backing_file=${image}", disk_image
])
subprocess.check_call([QEMU_IMG, "resize", disk_image, "10G"])
# Create fake EC2 metadata in temporary directory with client's public key
metadata_dir = create_ec2_metadata_dir(temp_dir, client_pubkey)
# Create fake EC2 metadata in temporary directory with client's public key
metadata_dir = create_ec2_metadata_dir(temp_dir, client_pubkey)
# Add both VLAN networking (matching test framework) and EC2 metadata server
vlan_net = (
" -device virtio-net-pci,netdev=vlan1,mac=52:54:00:12:01:02"
+ ' -netdev vde,id=vlan1,sock="$QEMU_VDE_SOCKET_1"'
)
metadata_net = (
" -device virtio-net-pci,netdev=ec2meta"
+ f" -netdev 'user,id=ec2meta,net=169.0.0.0/8,guestfwd=tcp:169.254.169.254:80-cmd:${lib.getExe imdsServer} {metadata_dir}'"
)
# Add both VLAN networking (matching test framework) and EC2 metadata server
vlan_net = (
" -device virtio-net-pci,netdev=vlan1,mac=52:54:00:12:01:02"
+ ' -netdev vde,id=vlan1,sock="$QEMU_VDE_SOCKET_1"'
)
metadata_net = (
" -device virtio-net-pci,netdev=ec2meta"
+ f" -netdev 'user,id=ec2meta,net=169.0.0.0/8,guestfwd=tcp:169.254.169.254:80-cmd:${lib.getExe imdsServer} {metadata_dir}'"
)
start_command = (
"qemu-kvm -m 1024"
+ f" -drive file={disk_image},if=virtio,werror=report"
+ vlan_net
+ metadata_net
+ " $QEMU_OPTS"
)
start_command = (
f"{QEMU}/bin/qemu-kvm -m 1024"
+ f" -drive file={disk_image},if=virtio,werror=report"
+ vlan_net
+ metadata_net
+ " $QEMU_OPTS"
)
return create_machine(start_command), metadata_dir
return create_machine(start_command), metadata_dir
def test_userdata_decompression(machine, user_data_path, compressed_data, format_name):
"""Test that compressed user-data is decompressed by fetch-ec2-metadata"""
test_marker = f"{format_name}-decompression-test"
with open(user_data_path, "wb") as f:
f.write(compressed_data)
machine.succeed("systemctl reset-failed fetch-ec2-metadata; systemctl restart fetch-ec2-metadata")
result = machine.succeed("cat /etc/ec2-metadata/user-data")
assert test_marker in result, f"Expected '{test_marker}' in decompressed {format_name} content, got: {result}"
journal = machine.succeed("journalctl -u fetch-ec2-metadata --no-pager -b")
assert "decompressing:" in journal, f"Expected decompression log in journal for {format_name}"
def test_userdata_decompression(machine, user_data_path, compressed_data, format_name):
"""Test that compressed user-data is decompressed by fetch-ec2-metadata"""
test_marker = f"{format_name}-decompression-test"
with open(user_data_path, "wb") as f:
f.write(compressed_data)
machine.succeed("systemctl reset-failed fetch-ec2-metadata; systemctl restart fetch-ec2-metadata")
result = machine.succeed("cat /etc/ec2-metadata/user-data")
assert test_marker in result, f"Expected '{test_marker}' in decompressed {format_name} content, got: {result}"
journal = machine.succeed("journalctl -u fetch-ec2-metadata --no-pager -b")
assert "decompressing:" in journal, f"Expected decompression log in journal for {format_name}"
# Create temporary directory for metadata (scoped for cleanup)
temp_dir = tempfile.TemporaryDirectory()
# Create temporary directory for metadata (scoped for cleanup)
temp_dir = tempfile.TemporaryDirectory()
# Start client first (but don't wait for it to boot)
client.start()
# Start client first (but don't wait for it to boot)
client.start()
# Generate SSH key pair on VM host before starting machine
client_pubkey, client_private_key = generate_client_ssh_key()
# Generate SSH key pair on VM host before starting machine
client_pubkey, client_private_key = generate_client_ssh_key()
# Set up machine with client's public key in metadata service
machine, metadata_dir = setup_machine(temp_dir, client_pubkey)
user_data_path = os.path.join(metadata_dir, "1.0", "user-data")
# Set up machine with client's public key in metadata service
machine, metadata_dir = setup_machine(temp_dir, client_pubkey)
user_data_path = os.path.join(metadata_dir, "1.0", "user-data")
try:
machine.start()
try:
machine.start()
# Wait for services to be ready
machine.wait_for_unit("sshd.service")
machine.wait_for_unit("print-host-key.service")
machine.wait_for_unit("apply-ec2-data.service")
# Wait for services to be ready
machine.wait_for_unit("sshd.service")
machine.wait_for_unit("print-host-key.service")
machine.wait_for_unit("apply-ec2-data.service")
# Extract shared variables outside subtests
machine_ip = "${config.nodes.machine.networking.primaryIPAddress}"
# Extract shared variables outside subtests
machine_ip = "${config.nodes.machine.networking.primaryIPAddress}"
with subtest("EC2 metadata service connectivity"):
# Obtain an IMDSv2 token, then use it to fetch metadata
imds_token = machine.succeed(
"curl -sf -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 600'"
" http://169.254.169.254/latest/api/token"
).strip()
assert imds_token, "Failed to obtain IMDSv2 token"
hostname_response = machine.succeed(
f"curl -sf -H 'X-aws-ec2-metadata-token: {imds_token}'"
" http://169.254.169.254/1.0/meta-data/hostname"
)
assert "test-instance" in hostname_response, f"Expected 'test-instance', got: {hostname_response}"
with subtest("EC2 metadata service connectivity"):
# Obtain an IMDSv2 token, then use it to fetch metadata
imds_token = machine.succeed(
"curl -sf -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 600'"
" http://169.254.169.254/latest/api/token"
).strip()
assert imds_token, "Failed to obtain IMDSv2 token"
hostname_response = machine.succeed(
f"curl -sf -H 'X-aws-ec2-metadata-token: {imds_token}'"
" http://169.254.169.254/1.0/meta-data/hostname"
)
assert "test-instance" in hostname_response, f"Expected 'test-instance', got: {hostname_response}"
with subtest("SSH host key extraction from console"):
console_log = machine.get_console_log()
assert "-----BEGIN SSH HOST KEY FINGERPRINTS-----" in console_log
assert "-----END SSH HOST KEY FINGERPRINTS-----" in console_log
assert "-----BEGIN SSH HOST KEY KEYS-----" in console_log
assert "-----END SSH HOST KEY KEYS-----" in console_log
with subtest("SSH host key extraction from console"):
console_log = machine.get_console_log()
assert "-----BEGIN SSH HOST KEY FINGERPRINTS-----" in console_log
assert "-----END SSH HOST KEY FINGERPRINTS-----" in console_log
assert "-----BEGIN SSH HOST KEY KEYS-----" in console_log
assert "-----END SSH HOST KEY KEYS-----" in console_log
keys_pattern = r"-----BEGIN SSH HOST KEY KEYS-----(.*?)-----END SSH HOST KEY KEYS-----"
keys_match = re.search(keys_pattern, console_log, re.DOTALL)
assert keys_match, "Could not find SSH host keys section"
keys_content = keys_match.group(1).strip()
assert "ssh-" in keys_content, "SSH keys should contain ssh- prefix"
keys_pattern = r"-----BEGIN SSH HOST KEY KEYS-----(.*?)-----END SSH HOST KEY KEYS-----"
keys_match = re.search(keys_pattern, console_log, re.DOTALL)
assert keys_match, "Could not find SSH host keys section"
keys_content = keys_match.group(1).strip()
assert "ssh-" in keys_content, "SSH keys should contain ssh- prefix"
with subtest("Network connectivity"):
client.succeed(f"ping -c 1 {machine_ip}")
with subtest("Network connectivity"):
client.succeed(f"ping -c 1 {machine_ip}")
with subtest("SSH connectivity with strict host key checking"):
# Install the pre-generated private key on client
setup_client_ssh_key(client, client_private_key)
with subtest("SSH connectivity with strict host key checking"):
# Install the pre-generated private key on client
setup_client_ssh_key(client, client_private_key)
# Get console log and extract host keys
console_log = machine.get_console_log()
keys_pattern = r"-----BEGIN SSH HOST KEY KEYS-----(.*?)-----END SSH HOST KEY KEYS-----"
keys_match = re.search(keys_pattern, console_log, re.DOTALL)
assert keys_match, "Could not find SSH host keys section"
# Get console log and extract host keys
console_log = machine.get_console_log()
keys_pattern = r"-----BEGIN SSH HOST KEY KEYS-----(.*?)-----END SSH HOST KEY KEYS-----"
keys_match = re.search(keys_pattern, console_log, re.DOTALL)
assert keys_match, "Could not find SSH host keys section"
# Create known_hosts file from console-extracted host keys
keys_content = keys_match.group(1).strip()
known_hosts_entries = []
for line in keys_content.split('\n'):
if line.strip() and line.startswith('ssh-'):
known_hosts_entries.append(f"{machine_ip} {line.strip()}")
# Create known_hosts file from console-extracted host keys
keys_content = keys_match.group(1).strip()
known_hosts_entries = []
for line in keys_content.split('\n'):
if line.strip() and line.startswith('ssh-'):
known_hosts_entries.append(f"{machine_ip} {line.strip()}")
assert known_hosts_entries, "No SSH host keys found for known_hosts generation"
assert known_hosts_entries, "No SSH host keys found for known_hosts generation"
known_hosts_content = '\n'.join(known_hosts_entries)
client.succeed(f"cat > /root/.ssh/known_hosts << 'EOF'\n{known_hosts_content}\nEOF")
known_hosts_content = '\n'.join(known_hosts_entries)
client.succeed(f"cat > /root/.ssh/known_hosts << 'EOF'\n{known_hosts_content}\nEOF")
# Test SSH connectivity with strict host key checking
ssh_result = client.succeed(f"ssh -o ConnectTimeout=60 -o BatchMode=yes -i /root/.ssh/id_ed25519 root@{machine_ip} 'echo Hello from $(hostname)'")
assert "Hello from test-instance" in ssh_result, f"Unexpected SSH result: {ssh_result}"
# Test SSH connectivity with strict host key checking
ssh_result = client.succeed(f"ssh -o ConnectTimeout=60 -o BatchMode=yes -i /root/.ssh/id_ed25519 root@{machine_ip} 'echo Hello from $(hostname)'")
assert "Hello from test-instance" in ssh_result, f"Unexpected SSH result: {ssh_result}"
with subtest("Basic EC2 functionality"):
machine.succeed("findmnt / -o SIZE -n | grep -E '[0-9]+G'")
with subtest("Basic EC2 functionality"):
machine.succeed("findmnt / -o SIZE -n | grep -E '[0-9]+G'")
with subtest("Decompression of gzip-compressed user-data"):
import gzip as gzip_mod
test_data = b"#!/bin/bash\necho gzip-decompression-test\n"
test_userdata_decompression(machine, user_data_path, gzip_mod.compress(test_data), "gzip")
with subtest("Decompression of gzip-compressed user-data"):
import gzip as gzip_mod
test_data = b"#!/bin/bash\necho gzip-decompression-test\n"
test_userdata_decompression(machine, user_data_path, gzip_mod.compress(test_data), "gzip")
with subtest("Decompression of bzip2-compressed user-data"):
import bz2
test_data = b"#!/bin/bash\necho bzip2-decompression-test\n"
test_userdata_decompression(machine, user_data_path, bz2.compress(test_data), "bzip2")
with subtest("Decompression of bzip2-compressed user-data"):
import bz2
test_data = b"#!/bin/bash\necho bzip2-decompression-test\n"
test_userdata_decompression(machine, user_data_path, bz2.compress(test_data), "bzip2")
with subtest("Decompression of xz-compressed user-data"):
import lzma
test_data = b"#!/bin/bash\necho xz-decompression-test\n"
test_userdata_decompression(machine, user_data_path, lzma.compress(test_data), "xz")
with subtest("Decompression of xz-compressed user-data"):
import lzma
test_data = b"#!/bin/bash\necho xz-decompression-test\n"
test_userdata_decompression(machine, user_data_path, lzma.compress(test_data), "xz")
with subtest("Decompression of zstd-compressed user-data"):
test_data = b"#!/bin/bash\necho zstd-decompression-test\n"
proc = subprocess.run(
["${hostPkgs.zstd}/bin/zstd", "-c"],
input=test_data, capture_output=True, check=True,
)
test_userdata_decompression(machine, user_data_path, proc.stdout, "zstd")
with subtest("Decompression of zstd-compressed user-data"):
test_data = b"#!/bin/bash\necho zstd-decompression-test\n"
proc = subprocess.run(
["${hostPkgs.zstd}/bin/zstd", "-c"],
input=test_data, capture_output=True, check=True,
)
test_userdata_decompression(machine, user_data_path, proc.stdout, "zstd")
with subtest("Decompression of lzip-compressed user-data"):
test_data = b"#!/bin/bash\necho lzip-decompression-test\n"
proc = subprocess.run(
["${hostPkgs.lzip}/bin/lzip", "-c"],
input=test_data, capture_output=True, check=True,
)
test_userdata_decompression(machine, user_data_path, proc.stdout, "lzip")
with subtest("Decompression of lzip-compressed user-data"):
test_data = b"#!/bin/bash\necho lzip-decompression-test\n"
proc = subprocess.run(
["${hostPkgs.lzip}/bin/lzip", "-c"],
input=test_data, capture_output=True, check=True,
)
test_userdata_decompression(machine, user_data_path, proc.stdout, "lzip")
with subtest("IPv6 IMDS fallback"):
# Save hostname fetched via IPv4 for later comparison
original_hostname = machine.succeed("cat /etc/ec2-metadata/hostname").strip()
with subtest("IPv6 IMDS fallback"):
# Save hostname fetched via IPv4 for later comparison
original_hostname = machine.succeed("cat /etc/ec2-metadata/hostname").strip()
# Assign the EC2 IPv6 IMDS address to loopback
machine.succeed("ip -6 addr add fd00:ec2::254/128 dev lo")
# Assign the EC2 IPv6 IMDS address to loopback
machine.succeed("ip -6 addr add fd00:ec2::254/128 dev lo")
# Create metadata directory structure for the IPv6 endpoint
machine.succeed(
"mkdir -p /tmp/ipv6-metadata/1.0/meta-data/public-keys/0"
" && mkdir -p /tmp/ipv6-metadata/latest/api"
" && cp /etc/ec2-metadata/hostname /tmp/ipv6-metadata/1.0/meta-data/hostname"
" && cp /etc/ec2-metadata/ami-manifest-path /tmp/ipv6-metadata/1.0/meta-data/ami-manifest-path"
" && echo i-1234567890abcdef0 > /tmp/ipv6-metadata/1.0/meta-data/instance-id"
" && echo ipv6-test-token > /tmp/ipv6-metadata/latest/api/token"
" && touch /tmp/ipv6-metadata/1.0/user-data"
)
machine.execute(
"test -f /etc/ec2-metadata/public-keys-0-openssh-key"
" && cp /etc/ec2-metadata/public-keys-0-openssh-key"
" /tmp/ipv6-metadata/1.0/meta-data/public-keys/0/openssh-key"
)
# Create metadata directory structure for the IPv6 endpoint
machine.succeed(
"mkdir -p /tmp/ipv6-metadata/1.0/meta-data/public-keys/0"
" && mkdir -p /tmp/ipv6-metadata/latest/api"
" && cp /etc/ec2-metadata/hostname /tmp/ipv6-metadata/1.0/meta-data/hostname"
" && cp /etc/ec2-metadata/ami-manifest-path /tmp/ipv6-metadata/1.0/meta-data/ami-manifest-path"
" && echo i-1234567890abcdef0 > /tmp/ipv6-metadata/1.0/meta-data/instance-id"
" && echo ipv6-test-token > /tmp/ipv6-metadata/latest/api/token"
" && touch /tmp/ipv6-metadata/1.0/user-data"
)
machine.execute(
"test -f /etc/ec2-metadata/public-keys-0-openssh-key"
" && cp /etc/ec2-metadata/public-keys-0-openssh-key"
" /tmp/ipv6-metadata/1.0/meta-data/public-keys/0/openssh-key"
)
# Serve metadata on the IPv6 IMDS address via socat + imds-server (inetd-style)
machine.succeed(
"systemd-run --unit=ipv6-imds --"
" socat TCP6-LISTEN:80,bind=[fd00:ec2::254],fork,reuseaddr"
" SYSTEM:'${lib.getExe imdsServer} /tmp/ipv6-metadata'"
)
# Serve metadata on the IPv6 IMDS address via socat + imds-server (inetd-style)
machine.succeed(
"systemd-run --unit=ipv6-imds --"
" socat TCP6-LISTEN:80,bind=[fd00:ec2::254],fork,reuseaddr"
" SYSTEM:'${lib.getExe imdsServer} /tmp/ipv6-metadata'"
)
# Wait for IPv6 IMDS to become reachable (token endpoint doesn't require auth)
machine.wait_until_succeeds(
"curl -sf -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 600'"
" http://[fd00:ec2::254]/latest/api/token"
)
# Wait for IPv6 IMDS to become reachable (token endpoint doesn't require auth)
machine.wait_until_succeeds(
"curl -sf -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 600'"
" http://[fd00:ec2::254]/latest/api/token"
)
# Block IPv4 IMDS to force fallback to IPv6
machine.succeed(
"iptables -I OUTPUT -d 169.254.169.254 -p tcp --dport 80 -j REJECT"
)
# Block IPv4 IMDS to force fallback to IPv6
machine.succeed(
"iptables -I OUTPUT -d 169.254.169.254 -p tcp --dport 80 -j REJECT"
)
# Verify IPv4 IMDS is now unreachable
machine.fail(
"curl -sf --connect-timeout 2 http://169.254.169.254/1.0/meta-data/hostname"
)
# Verify IPv4 IMDS is now unreachable
machine.fail(
"curl -sf --connect-timeout 2 http://169.254.169.254/1.0/meta-data/hostname"
)
# Clear fetched metadata and re-run the fetcher
machine.succeed("rm -f /etc/ec2-metadata/*")
machine.succeed("systemctl restart fetch-ec2-metadata")
# Clear fetched metadata and re-run the fetcher
machine.succeed("rm -f /etc/ec2-metadata/*")
machine.succeed("systemctl restart fetch-ec2-metadata")
# Verify metadata was successfully re-fetched via IPv6
hostname = machine.succeed("cat /etc/ec2-metadata/hostname").strip()
assert hostname == original_hostname, f"Expected '{original_hostname}', got '{hostname}'"
# Verify metadata was successfully re-fetched via IPv6
hostname = machine.succeed("cat /etc/ec2-metadata/hostname").strip()
assert hostname == original_hostname, f"Expected '{original_hostname}', got '{hostname}'"
# Clean up: restore IPv4 IMDS access
machine.succeed(
"iptables -D OUTPUT -d 169.254.169.254 -p tcp --dport 80 -j REJECT"
)
machine.succeed("systemctl stop ipv6-imds")
# Clean up: restore IPv4 IMDS access
machine.succeed(
"iptables -D OUTPUT -d 169.254.169.254 -p tcp --dport 80 -j REJECT"
)
machine.succeed("systemctl stop ipv6-imds")
finally:
machine.shutdown()
temp_dir.cleanup()
'';
finally:
machine.shutdown()
temp_dir.cleanup()
'';
}

83
nixos/tests/qemu-vm-credentials.nix
View file

@ -1,83 +0,0 @@
{
lib,
pkgs,
mechanism,
...
}:
let
secret = ''
foo
bar
baz
'';
secret-file = "bar";
in
{
name = "qemu-vm-credentials-${mechanism}";
meta.maintainers = with lib.maintainers; [ arianvp ];
nodes = {
machine = {
virtualisation.credentials = {
secret = {
inherit mechanism;
text = secret;
};
secret-default-mechanism = {
text = "default-mechanism";
};
secret-file-nix-store = {
inherit mechanism;
source = pkgs.writeText "secret-file-nix-store" secret-file;
};
secret-file-host = {
inherit mechanism;
source = "./secret-file-host";
};
secret-file-host-binary = {
inherit mechanism;
source = "./secret-file-host-binary";
};
};
};
};
testScript = ''
import base64
secret_file_host = "baz"
# Binary data with null bytes, high bytes, and all sorts of problematic characters
secret_file_host_binary = bytes([
0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, # null and control chars
0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
0xDE, 0xAD, 0xBE, 0xEF, # classic binary pattern
0xFF, 0xFE, 0xFD, 0xFC, # high bytes
0x00, 0x00, 0x00, 0x00, # multiple nulls
0x80, 0x81, 0x82, 0x83, # more high bytes
])
with open(machine.state_dir / "secret-file-host", "w") as f:
f.write(secret_file_host)
with open(machine.state_dir / "secret-file-host-binary", "wb") as f2:
f2.write(secret_file_host_binary)
# Test text credential
t.assertEqual(machine.succeed("systemd-creds --system cat secret").strip(), "foo\nbar\nbaz")
t.assertEqual(machine.succeed("systemd-creds --system cat secret-default-mechanism").strip(), "default-mechanism")
# Test credential from nix store
t.assertEqual(machine.succeed("systemd-creds --system cat secret-file-nix-store").strip(), "${secret-file}")
# Test credential from host file
t.assertEqual(machine.succeed("systemd-creds --system cat secret-file-host").strip(), secret_file_host)
# Test binary credential - verify exact binary content
result = machine.succeed("systemd-creds --system cat secret-file-host-binary --transcode=base64").strip()
expected = base64.b64encode(secret_file_host_binary).decode('ascii')
t.assertEqual(result, expected, f"Binary credential mismatch: got {result}, expected {expected}")
'';
}

16
nixos/tests/systemd-initrd-simple.nix
View file

@ -1,15 +1,15 @@
{ pkgs, ... }:
{
name = "systemd-initrd-simple";
nodes.machine =
{ pkgs, ... }:
{
testing.initrdBackdoor = true;
boot.initrd.systemd.enable = true;
virtualisation.fileSystems."/".autoResize = true;
};
nodes.machine = {
testing.initrdBackdoor = true;
boot.initrd.systemd.enable = true;
virtualisation.fileSystems."/".autoResize = true;
};
testScript =
{ nodes, ... }:
# python
''
import subprocess
@ -43,7 +43,7 @@
oldAvail = machine.succeed("df --output=avail / | sed 1d")
machine.shutdown()
subprocess.check_call(["qemu-img", "resize", "vm-state-machine/machine.qcow2", "+1G"])
subprocess.check_call(["${nodes.machine.virtualisation.qemu.package}/bin/qemu-img", "resize", "vm-state-machine/machine.qcow2", "+1G"])
machine.start()
machine.switch_root()

46
nixos/tests/systemd-varlink.nix Normal file
View file

@ -0,0 +1,46 @@
{ lib, ... }:
{
name = "systemd-varlink";
meta.maintainers = [ lib.maintainers.raitobezarius ];
nodes.machine =
{ config, pkgs, ... }:
{
networking.useNetworkd = true;
services.resolved.enable = true;
systemd.network.enable = true;
};
testScript = ''
def list_interfaces(intf_path: str) -> list[str]:
return machine.succeed(f"varlinkctl list-interfaces {intf_path}").split('\n')
expected_reg_sd_interfaces = [
("BootControl", "bootctl"),
("Credentials", "creds"),
("Hostname", "hostnamed"),
("JournalAccess", "journald"),
("Import", "importd"),
("Machine", "machined"),
("Resolve", "resolved-varlink"),
("Resolve.Monitor", "resolved-monitor"),
("Udev", "udevd-varlink"),
("MuteConsole", "mute-console"),
("FactoryReset", "factory-reset"),
("AskPassword", "ask-password"),
("Network", "networkd-varlink"),
("Repart", "repart"),
]
expected_priv_sd_interfaces = [
("Login", None), # systemd-logind-varlink.socket exist but is not necessary.
]
expected_interfaces = [
(f"io.systemd.{intf}", f"systemd-{socket_name}", f"/run/varlink/registry/io.systemd.{intf}") for intf, socket_name in expected_reg_sd_interfaces
] + [
(f"io.systemd.{intf}", f"systemd-{socket_name}" if socket_name is not None else None, f"/run/systemd/io.systemd.{intf}") for intf, socket_name in expected_priv_sd_interfaces
]
for intf, socket_name, intf_path in expected_interfaces:
if socket_name is not None:
machine.wait_for_unit(f"{socket_name}.socket")
assert intf in list_interfaces(intf_path), f"Interface '{intf}' not found in the Varlink registry"
'';
}

34
nixos/tests/systemd.nix
View file

@ -38,21 +38,23 @@
services.journald.extraConfig = "Storage=volatile";
test-support.displayManager.auto.user = "alice";
systemd.shutdown.test = pkgs.writeScript "test.shutdown" ''
#!${pkgs.runtimeShell}
PATH=${
lib.makeBinPath (
with pkgs;
[
util-linux
coreutils
]
)
}
mount -t 9p shared -o trans=virtio,version=9p2000.L /tmp/shared
touch /tmp/shared/shutdown-test
umount /tmp/shared
'';
systemd.shutdownRamfs.contents."/etc/systemd/system-shutdown/test".source =
pkgs.writeShellScript "test.shutdown" ''
PATH=${
lib.makeBinPath (
with pkgs;
[
util-linux
coreutils
]
)
}
mkdir -p /tmp/shared
mount -t 9p shared -o trans=virtio,version=9p2000.L /tmp/shared
touch /tmp/shared/shutdown-test
umount /tmp/shared
'';
systemd.shutdownRamfs.storePaths = [ "${pkgs.util-linux}/bin" ];
systemd.services.oncalendar-test = {
description = "calendar test";
@ -147,7 +149,7 @@
subprocess.check_call(
[
"qemu-img",
"${nodes.machine.virtualisation.qemu.package}/bin/qemu-img",
"convert",
"-O",
"raw",

26
pkgs/applications/editors/neovim/tests/default.nix
View file

@ -204,23 +204,23 @@ pkgs.lib.recurseIntoAttrs rec {
${nvim_with_plug}/bin/nvim -V3log.txt -i NONE -c 'color base16-tomorrow-night' +quit! -e
'';
nvim_with_autoconfigure = pkgs.neovim.overrideAttrs {
plugins = [
vimPlugins.unicode-vim
vimPlugins.fzf-hoogle-vim
];
nvim_with_autoconfigure = pkgs.neovim.override {
configure = {
packages.myPlugins.start = [
vimPlugins.unicode-vim
vimPlugins.fzf-hoogle-vim
];
};
autoconfigure = true;
# legacy wrapper sets it to false
wrapRc = true;
};
nvim_with_runtimeDeps = pkgs.neovim.overrideAttrs {
plugins = [
pkgs.vimPlugins.hex-nvim
];
nvim_with_runtimeDeps = pkgs.neovim.override {
configure = {
packages.myPlugins.start = [
pkgs.vimPlugins.hex-nvim
];
};
autowrapRuntimeDeps = true;
# legacy wrapper sets it to false
wrapRc = true;
};
nvim_with_ftplugin =

3
pkgs/applications/editors/vscode/generic.nix
View file

@ -249,6 +249,9 @@ stdenv.mkDerivation (
})
];
strictDeps = true;
__structuredAttrs = true;
buildInputs = [
libsecret
]

6
pkgs/applications/emulators/libretro/cores/opera.nix
View file

@ -6,13 +6,13 @@
}:
mkLibretroCore {
core = "opera";
version = "0-unstable-2026-06-15";
version = "0-unstable-2026-06-19";
src = fetchFromGitHub {
owner = "libretro";
repo = "opera-libretro";
rev = "78f834b175bf2de3cc2cf05122d10d4c3d980c34";
hash = "sha256-E8/mD+4HKAZQciJBy0CsUIvCkfufkQCcudpMzvVoBhg=";
rev = "eb3a9162e99a71da221107aa58e7650fd076bbca";
hash = "sha256-swFdGY8ScsQG/8E/JWzGRL80jdMVzsr1BJ+UAisSJ9g=";
};
makefile = "Makefile";

22
pkgs/applications/networking/cluster/terraform-providers/providers.json
View file

@ -209,13 +209,13 @@
"vendorHash": "sha256-rCWeetM6nhNb1I1PmB66E5K1ku9ODRqN87MU9y6W/dc="
},
"cloudflare_cloudflare": {
"hash": "sha256-y3GAU5wLLETSrmYqGZs2I0qg8jnGcu32Xt/UHGS1NTA=",
"hash": "sha256-SHEK/NJrs1ZkyDc8jSnb39dT/wX7ixSsHc//cwhTfz8=",
"homepage": "https://registry.terraform.io/providers/cloudflare/cloudflare",
"owner": "cloudflare",
"repo": "terraform-provider-cloudflare",
"rev": "v5.20.0",
"rev": "v5.21.1",
"spdx": "Apache-2.0",
"vendorHash": "sha256-LGibxg94dOiMfNynQfBoxQ6zR8A7xDfGNTujmEJcu14="
"vendorHash": "sha256-YLgIcohvOYBVt/GOkiqxdJVThhcphG2l8Lha1MwU9L4="
},
"cloudfoundry-community_cloudfoundry": {
"hash": "sha256-1nYncJLVU/f9WD6Quh9IieIXgixPzbPk4zbtI1zmf9g=",
@ -787,13 +787,13 @@
"vendorHash": "sha256-mnKXYT0GfIS+ODzBCS9l4rLF1ugadesmpgdOgj74nLg="
},
"jianyuan_sentry": {
"hash": "sha256-p1vaKwWrkNaaicQWFfnjgQ8O2P/194PvslzWdVwn6IE=",
"hash": "sha256-mJVuJJzNw/nkg1OoPG2iIE30RVsnj3YTQ3VAYITB6tE=",
"homepage": "https://registry.terraform.io/providers/jianyuan/sentry",
"owner": "jianyuan",
"repo": "terraform-provider-sentry",
"rev": "v0.15.2",
"rev": "v0.15.3",
"spdx": "MIT",
"vendorHash": "sha256-7O7/m4N7MDb+AU7w6dqQqzsqDO3jWGwOHnRX2OkJirM="
"vendorHash": "sha256-+LDSNV2Y5jDFyOu/PFtJhP7VgWAVvozC/yBXzTU7YXQ="
},
"joneshf_openwrt": {
"hash": "sha256-z78IceF2VJtiQpVqC+rTUDsph73LZawIK+az3rEhljA=",
@ -905,11 +905,11 @@
"vendorHash": "sha256-t4dbDJNjEQ6/u+/6zqk2Sdd3LVn/L2BCJujpiLdGc58="
},
"metio_migadu": {
"hash": "sha256-F/eTAR0Du0NeRwH9m8hHzjIkx31xv8aRGNWuVrntxjQ=",
"hash": "sha256-KDk/uSxycO9hiaiEKHq58ktwum88J9StpB52mNQYer4=",
"homepage": "https://registry.terraform.io/providers/metio/migadu",
"owner": "metio",
"repo": "terraform-provider-migadu",
"rev": "2026.6.18",
"rev": "2026.6.25",
"spdx": "0BSD",
"vendorHash": "sha256-7/2iHstATnmeuvoIFIQw2Gi3QSIoXp5W69fnUYHipxc="
},
@ -1346,13 +1346,13 @@
"vendorHash": "sha256-SF11E60OQiRdf+Pf6XyJg60yGRnGOcSzhrYccrWaeYE="
},
"terraform-lxd_lxd": {
"hash": "sha256-ovYvRpGY8tUiX5zYpTkb8uuQcKsW7o/bDgUPbkXnVnI=",
"hash": "sha256-vrrQxld9Ymu2RcSRlkUzknTIBJteVeb9Jqr19CV3XzM=",
"homepage": "https://registry.terraform.io/providers/terraform-lxd/lxd",
"owner": "terraform-lxd",
"repo": "terraform-provider-lxd",
"rev": "v2.7.1",
"rev": "v3.0.1",
"spdx": "MPL-2.0",
"vendorHash": "sha256-vOip6KfD0hOQtNEc7U6DfMjitFGOleNlF88qKtbssng="
"vendorHash": "sha256-jOZw/va3dA0DYmnYSKbASHvyL7levjf1Bk6WelLga+Q="
},
"terraform-provider-openstack_openstack": {
"hash": "sha256-6TcyPUacJNfGsaevg1DQ+WJrMFvGeo2mmsE2+P3RAZM=",

794
pkgs/applications/networking/mailreaders/thunderbird-bin/release_esr_sources.nix
View file

File diff suppressed because it is too large Load diff

1
pkgs/build-support/build-nim-package.nix
View file

@ -15,6 +15,7 @@ let
baseAttrs = {
strictDeps = true;
enableParallelBuilding = true;
__structuredAttrs = true;
doCheck = true;
configurePhase = ''
runHook preConfigure

10
pkgs/build-support/node/fetch-pnpm-deps/default.nix
View file

@ -49,13 +49,9 @@ in
filterFlags = lib.map (package: "--filter=${package}") pnpmWorkspaces;
pnpm-fixup-state-db' =
if pnpm.nodejs-slim or null != null then
pnpm-fixup-state-db.override {
inherit (pnpm) nodejs-slim;
}
else
pnpm-fixup-state-db;
pnpm-fixup-state-db' = pnpm-fixup-state-db.override {
inherit (pnpm) nodejs-slim;
};
in
assert
fetcherVersion != null

8
pkgs/by-name/al/allmytoes/package.nix
View file

@ -2,6 +2,8 @@
lib,
nix-update-script,
rustPlatform,
makeWrapper,
shared-mime-info,
fetchFromGitLab,
}:
rustPlatform.buildRustPackage (finalAttrs: {
@ -15,8 +17,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
hash = "sha256-BYKcDJN/uKESj0pnb2xvrx1lO6rOGdi+PVT6ywZqjbQ=";
};
nativeBuildInputs = [ makeWrapper ];
cargoHash = "sha256-Pzbruv1E4mMohw//lf1JBoK+4BHDJVr4/9xXE4FrWbA==";
postInstall = ''
wrapProgram "$out/bin/allmytoes" --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
'';
passthru.updateScript = nix-update-script { };
__structuredAttrs = true;

6
pkgs/by-name/am/amule/package.nix
View file

@ -21,6 +21,7 @@
gtk3,
libayatana-appindicator,
libsysprof-capture,
libmaxminddb,
libpng,
pkg-config,
readline,
@ -52,13 +53,13 @@ stdenv.mkDerivation (finalAttrs: {
+ lib.optionalString enableDaemon "-daemon"
+ lib.optionalString client "-gui"
+ lib.optionalString textClient "-cmd";
version = "3.0.0";
version = "3.0.1";
src = fetchFromGitHub {
owner = "amule-org";
repo = "amule";
tag = finalAttrs.version;
hash = "sha256-2qQof2/JFTfOmqd25+YVWBpZgCDCOwf3NBo1aHcMPds=";
hash = "sha256-zLd8mt+dYEilGcFn3qspZv5EkZ4TmBbKgvgcuSvswFk=";
};
__structuredAttrs = true;
@ -108,6 +109,7 @@ stdenv.mkDerivation (finalAttrs: {
libayatana-appindicator
]
++ lib.optional httpServer libpng
++ lib.optional (monolithic || enableDaemon || client) libmaxminddb
# gettext runtime for NLS; on glibc libintl is part of libc
++ lib.optional (!stdenv.hostPlatform.isGnu) libintl
# line editing in the interactive consoles of amulecmd and amuleweb

10
pkgs/by-name/an/antigravity-cli/package.nix
View file

@ -6,7 +6,7 @@
versionCheckHook,
}:
let
wholeVersion = "1.0.8-6513509081677824"; # unfortunately this has dumb versioning
wholeVersion = "1.0.12-6156052174077952"; # unfortunately this has dumb versioning
version = builtins.head (lib.splitString "-" wholeVersion);
throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}";
@ -14,19 +14,19 @@ let
sourceData = {
x86_64-linux = fetchurl {
url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/linux-x64/cli_linux_x64.tar.gz";
hash = "sha256-/BxcglSN6NqZdEbq50MypFW4bv2bCN37L0PqcuYz+e4=";
hash = "sha256-fjB132jrrViqHPQiMenYuDvyiVtbBYqxc2sLY4PHUAg=";
};
aarch64-linux = fetchurl {
url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/linux-arm/cli_linux_arm64.tar.gz";
hash = "sha256-QWQevvVezRdubRbG3V64C/XMHunfDsdA1OM8yhHoCHA=";
hash = "sha256-oDZ+WHWsG4imwLFjyG69XRPJvvkH9EaaZRb/aQIb8tQ=";
};
aarch64-darwin = fetchurl {
url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/darwin-arm/cli_mac_arm64.tar.gz";
hash = "sha256-j+/brIYCKjIOa0KSGZHt4Ic4tjTzOrfPtA4J8iY9tHE=";
hash = "sha256-U/cwihF/cP5+7KSmkAToI5yOoYydguR5ZrKQMytpuCk=";
};
x86_64-darwin = fetchurl {
url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/darwin-x64/cli_mac_x64.tar.gz";
hash = "sha256-0Cp76whEYtBdZS6GOnC+qqICGoqexX+v3KCFJmfaFAU=";
hash = "sha256-A8YjMmFUiHKxdlR+OpOPQGKC+68z/83vtjw1yiJGt6g=";
};
};
in

6
pkgs/by-name/ar/arnis/package.nix
View file

@ -12,16 +12,16 @@
}:
rustPlatform.buildRustPackage (finalAttrs: {
pname = "arnis";
version = "2.8.0";
version = "2.9.0";
src = fetchFromGitHub {
owner = "louis-e";
repo = "arnis";
tag = "v${finalAttrs.version}";
hash = "sha256-hNVECK6+I3ML/knsBdvEx2Uz1w4jXHynanlQfgrM9oM=";
hash = "sha256-SJT1dSQ6P5UCglYP5Song/cvisYLVXepsHH6AC5kJK4=";
};
cargoHash = "sha256-Kff+76lZ6hsSbssYhrupmE2xAt1gwia8sMZR15ReqgU=";
cargoHash = "sha256-h8DuDgRtI9ZUq3hPqso/DZQnGInnilFIuzTPf0qpsbo=";
nativeBuildInputs = [
cargo-tauri.hook

8
pkgs/by-name/at/attic-client/package.nix
View file

@ -21,13 +21,13 @@ in
rustPlatform.buildRustPackage {
pname = "attic";
version = "0-unstable-2026-06-14";
version = "0-unstable-2026-06-26";
src = fetchFromGitHub {
owner = "zhaofengli";
repo = "attic";
rev = "6b22d76ca351c5a07a5e5a60b95bc23320f7e791";
hash = "sha256-sboz+gG8z0KX+q0kkvLloNcogXYLwiY5iw2xwN36rFo=";
rev = "b7c905657cb81b8ec9c26b0d9f53aa2e4f231810";
hash = "sha256-//gQFVLVFhwHyI9yrpPqX0MQJGYqS6nE/iLV872K+PU=";
};
nativeBuildInputs = [
@ -38,7 +38,7 @@ rustPlatform.buildRustPackage {
buildInputs = lib.optional needNixInclude nix ++ [ boost ];
cargoBuildFlags = lib.concatMapStrings (c: "-p ${c} ") crates;
cargoHash = "sha256-LqE4jOIasxIG4DAhgZJMlTSyt/a900QR06wBFtRNRO8=";
cargoHash = "sha256-fYWRlgP3uwntULe6o2MC1yB/ea2x+27m1Op7o2wUd+U=";
env = {
ATTIC_DISTRIBUTOR = "nixpkgs";

4
pkgs/by-name/au/auto-editor/package.nix
View file

@ -54,6 +54,8 @@ buildNimPackage rec {
# buildNimPackage hack
substituteInPlace ae.nimble \
--replace-fail '"main=auto-editor"' '"main"'
mv tests/unit.nim tests/tunit.nim # buildNimPackage expects tests to start with t
'';
nativeCheckInputs = [
@ -64,7 +66,7 @@ buildNimPackage rec {
checkPhase = ''
runHook preCheck
eval "nim r --nimcache:$NIX_BUILD_TOP/nimcache $nimFlags $src/tests/unit.nim"
nim_builder --phase:check
substituteInPlace tests/test.py \
--replace-fail '"./auto-editor"' "\"$out/bin/main\""

71
pkgs/by-name/aw/aws-ofi-nccl/package.nix Normal file
View file

@ -0,0 +1,71 @@
{
lib,
stdenv,
fetchFromGitHub,
nix-update-script,
autoAddDriverRunpath,
autoreconfHook,
numactl,
libuuid,
rdma-core,
libfabric,
hwloc,
cudaPackages,
}:
stdenv.mkDerivation (finalAttrs: {
pname = "aws-ofi-nccl";
version = "1.19.2";
__structuredAttrs = true;
strictDeps = true;
src = fetchFromGitHub {
owner = "aws";
repo = "aws-ofi-nccl";
tag = "v${finalAttrs.version}";
hash = "sha256-1gPIuZzS53cMRckiBkRRzMw3RzoAvu3v0xzt0rwyysk=";
};
nativeBuildInputs = [
autoAddDriverRunpath
autoreconfHook
];
buildInputs = [
numactl
libuuid
rdma-core
libfabric
hwloc
]
++ (with cudaPackages; [
cuda_cudart
nccl
]);
postPatch = ''
patchShebangs m4
echo "$version" > .release_version
'';
preConfigure = ''
./autogen.sh
'';
configureFlags = [
"--enable-platform-aws"
"--with-cuda=${cudaPackages.cuda_nvcc}"
"--with-libfabric=${libfabric}"
];
passthru.updateScript = nix-update-script { };
meta = {
description = "This is a plugin which lets EC2 developers use libfabric as network provider while running NCCL applications";
homepage = "https://github.com/aws/aws-ofi-nccl";
changelog = "https://github.com/aws/aws-ofi-nccl/releases/tag/${finalAttrs.src.tag}";
license = lib.licenses.asl20;
maintainers = with lib.maintainers; [ jlesquembre ];
platforms = lib.platforms.all;
};
})

17
pkgs/by-name/aw/aws-sso-cli/package.nix
View file

@ -6,19 +6,20 @@
lib,
makeWrapper,
stdenv,
writableTmpDirAsHomeHook,
xdg-utils,
}:
buildGoModule (finalAttrs: {
pname = "aws-sso-cli";
version = "2.2.4";
version = "2.3.1";
src = fetchFromGitHub {
owner = "synfinatic";
repo = "aws-sso-cli";
rev = "v${finalAttrs.version}";
hash = "sha256-JkCHzIbIeFvmXrIkQaybjUtPDzmZ2XPv6tz3fA6ni44=";
hash = "sha256-JFaCTgvH6qzQ8gMt5QgqAPBal2m8FZEemTgbqyECFck=";
};
vendorHash = "sha256-euqhgbyz8H/fQ1RAP0k4GMOjOu7gVeYzQv75tjCh5z0=";
vendorHash = "sha256-f9qSnEOUw8QWbc0rgStyzuL6lWtfy3UFhjqDAnJkKJA=";
nativeBuildInputs = [
makeWrapper
@ -41,7 +42,14 @@ buildGoModule (finalAttrs: {
--zsh <($out/bin/aws-sso setup completions --source --shell=zsh)
'';
nativeCheckInputs = [ getent ];
nativeCheckInputs = [
getent
writableTmpDirAsHomeHook
];
preCheck = ''
mkdir -p "$HOME/.config/aws-sso"
'';
checkFlags =
let
@ -51,6 +59,7 @@ buildGoModule (finalAttrs: {
"TestAWSConsoleUrlEU"
"TestAWSConsoleUrlUSEast"
"TestAWSConsoleUrlUSGov"
"TestGetScriptsAutoDetect"
]
++ lib.optionals stdenv.hostPlatform.isDarwin [ "TestDetectShellBash" ];
in

6
pkgs/by-name/ay/ayatana-indicator-power/package.nix
View file

@ -13,7 +13,7 @@
libayatana-common,
libnotify,
librda,
lomiri,
lomiri-qt6,
pkg-config,
python3,
systemd,
@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
# Path needed for build-time codegen
substituteInPlace src/CMakeLists.txt \
--replace-fail '/usr/share/accountsservice/interfaces/com.lomiri.touch.AccountsService.Sound.xml' '${lomiri.lomiri-schemas}/share/accountsservice/interfaces/com.lomiri.touch.AccountsService.Sound.xml'
--replace-fail '/usr/share/accountsservice/interfaces/com.lomiri.touch.AccountsService.Sound.xml' '${lomiri-qt6.lomiri-schemas}/share/accountsservice/interfaces/com.lomiri.touch.AccountsService.Sound.xml'
'';
strictDeps = true;
@ -58,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
librda
systemd
]
++ (with lomiri; [
++ (with lomiri-qt6; [
cmake-extras
deviceinfo
lomiri-schemas

4
pkgs/by-name/ay/ayatana-indicator-session/package.nix
View file

@ -13,7 +13,7 @@
intltool,
libayatana-common,
librda,
lomiri,
lomiri-qt6,
mate-settings-daemon,
pkg-config,
systemd,
@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
];
buildInputs = [
lomiri.cmake-extras
lomiri-qt6.cmake-extras
glib
gsettings-desktop-schemas
libayatana-common

7
pkgs/by-name/be/bellepoule/package.nix
View file

@ -19,13 +19,14 @@
stdenv.mkDerivation (finalAttrs: {
pname = "bellepoule";
version = "5.5";
version = "5.7";
src =
(fetchgit {
url = "https://git.launchpad.net/bellepoule";
rev = finalAttrs.version;
hash = "sha256-SNL6yaaKk/GU8+EvHki4ysMuCHEQxFjPd3iwVIdJtCs=";
# No tag available on launchpad for this version
rev = "06516d698fde9662d95cf6a8758eb1fbcc89e983";
hash = "sha256-9bbFzi9JPryJK2zv4O1TUDaeoB9GVV7LRNn6Xl8lajg=";
}).overrideAttrs
(oldAttrs: {
env = oldAttrs.env or { } // {

258
pkgs/by-name/bi/bisq1/package.nix Normal file
View file

@ -0,0 +1,258 @@
{
stdenv,
lib,
makeBinaryWrapper,
fetchurl,
writeShellScript,
makeDesktopItem,
copyDesktopItems,
imagemagick,
zulu21,
dpkg,
zip,
xz,
gnupg,
coreutils,
tor,
# Native libraries required by the JavaFX natives that Bisq extracts from its bundled
# javafx-graphics jar into ~/.openjfx/cache at runtime. Those .so files are
# bare (no rpath), so every direct needed library must be on LD_LIBRARY_PATH.
# The set below is exactly the verified closure (readelf NEEDED + ldd not_found=0).
gtk3,
glib,
cairo,
pango,
atk,
gdk-pixbuf,
harfbuzz,
freetype,
fontconfig,
libGL,
libglvnd,
libx11,
libxtst,
libxxf86vm,
}:
let
version = "1.10.2";
# JDK 21 is the toolchain required by docs/build.md. enableJavaFX is not
# strictly required (Bisq bundles its own JavaFX jars), but mirrors the
# sibling bisq2 package and gives a JDK that can host JavaFX.
jdk = zulu21.override {
enableJavaFX = true;
};
# JVM arguments sourced from bisq/desktop/build.gradle, applicationDefaultJvmArgs
bisqJvmArgs = lib.concatStringsSep " " [
"-XX:MaxRAM=8g"
"-Xss1280k"
"-XX:+UseG1GC"
"-XX:MaxHeapFreeRatio=10"
"-XX:MinHeapFreeRatio=5"
"-XX:+UseStringDeduplication"
"-Djava.net.preferIPv4Stack=true"
"--add-opens=javafx.controls/javafx.scene.control.skin=ALL-UNNAMED"
];
# JVM arguments added for nixpkgs, not present in the bisq source tree.
nixpkgsJvmArgs = lib.concatStringsSep " " [
# solving this error at application startup:
# > class com.jfoenix.skins.JFXSpinnerSkin (in unnamed module @0x77ec78b9) cannot access class com.sun.javafx.scene.NodeHelper (in module javafx.graphics) because module javafx.graphics does not export com.sun.javafx.scene to unnamed module @0x77ec78b9
"--add-exports=javafx.graphics/com.sun.javafx.scene=ALL-UNNAMED"
# solving this error at application startup:
# > class com.jfoenix.skins.JFXTabPaneSkin$TabHeaderContainer (in unnamed module @0x77ec78b9) cannot access class com.sun.javafx.scene.control.LambdaMultiplePropertyChangeListenerHandler (in module javafx.controls) because module javafx.controls does not export com.sun.javafx.scene.control to unnamed module @0x77ec78b9
"--add-exports=javafx.controls/com.sun.javafx.scene.control=ALL-UNNAMED"
# solving this error at application startup:
# > class com.jfoenix.skins.JFXTabPaneSkin (in unnamed module @0x77ec78b9) cannot access class com.sun.javafx.scene.control.behavior.TabPaneBehavior (in module javafx.controls) because module javafx.controls does not export com.sun.javafx.scene.control.behavior to unnamed module @0x77ec78b9
"--add-exports=javafx.controls/com.sun.javafx.scene.control.behavior=ALL-UNNAMED"
];
bisq-launcher =
args:
writeShellScript "bisq-launcher" ''
exec "${lib.getExe jdk}" \
${bisqJvmArgs} \
${nixpkgsJvmArgs} \
-classpath @out@/lib/app/desktop.jar:@out@/lib/app/* \
${args} bisq.desktop.app.BisqAppMain "$@"
'';
# keys taken from bisq/docs/release-process.md
publicKey = {
"E222AA02" = fetchurl {
url = "https://github.com/bisq-network/bisq/releases/download/v${version}/E222AA02.asc";
hash = "sha256-Ue/UmS6F440/ybEEIAR+pdPEIksAt6QSMN6G5TZVWzc=";
};
"4A133008" = fetchurl {
url = "https://github.com/bisq-network/bisq/releases/download/v${version}/4A133008.asc";
hash = "sha256-UijG3DkJNNTakVJd2wl30mDepa27n6R/Xxfl4sjt0sk=";
};
"387C8307" = fetchurl {
url = "https://github.com/bisq-network/bisq/releases/download/v${version}/387C8307.asc";
hash = "sha256-PrRYZLT0xv82dUscOBgQGKNf6zwzWUDhriAffZbNpmI=";
};
};
binPath = lib.makeBinPath [
coreutils
tor
];
libraryPath = lib.makeLibraryPath [
gtk3
glib
cairo
pango
atk
gdk-pixbuf
harfbuzz
freetype
fontconfig
libGL
libglvnd
libx11
libxtst
libxxf86vm
stdenv.cc.cc
];
in
stdenv.mkDerivation (finalAttrs: {
inherit version;
pname = "bisq1";
strictDeps = true;
__structuredAttrs = true;
src = fetchurl {
url = "https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb";
hash = "sha256-e7rPUhA6KF3Tz3zlYqEfM9G0owe9hAUFDifKseRvb6A=";
# Verify the upstream Debian package's detached PGP signature prior to use.
# This ensures that a successful build of this Nix package requires the
# signed Debian package to pass verification, preserving Bisq's trust model.
nativeBuildInputs = [ gnupg ];
downloadToTemp = true;
postFetch = ''
pushd $(mktemp -d)
export GNUPGHOME=./gnupg
mkdir -m 700 -p $GNUPGHOME
ln -s $downloadedFile ./Bisq-64bit-${version}.deb
ln -s ${finalAttrs.signature} ./signature.asc
gpg --import ${publicKey."E222AA02"}
gpg --import ${publicKey."4A133008"}
gpg --import ${publicKey."387C8307"}
gpg --batch --verify signature.asc Bisq-64bit-${version}.deb
popd
mv $downloadedFile $out
'';
};
signature = fetchurl {
url = "https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb.asc";
hash = "sha256-kBRaOXuP22DvXMkJ1XQatwvTmu/Ds8FvmUgYnRT7Vg0=";
};
nativeBuildInputs = [
copyDesktopItems
dpkg
imagemagick
makeBinaryWrapper
zip
xz
gnupg
];
desktopItems = [
(makeDesktopItem {
name = "bisq";
exec = "bisq";
icon = "bisq";
desktopName = "Bisq";
genericName = "Decentralized bitcoin exchange";
categories = [
"Network"
"P2P"
];
})
(makeDesktopItem {
name = "bisq-hidpi";
exec = "bisq-hidpi";
icon = "bisq";
desktopName = "Bisq (HiDPI)";
genericName = "Decentralized bitcoin exchange";
categories = [
"Network"
"P2P"
];
})
];
unpackPhase = ''
runHook preUnpack
dpkg -x $src .
runHook postUnpack
'';
buildPhase = ''
runHook preBuild
# Replace the Tor binary bundled in tor-binary-linux64-*.jar
# (native/linux/x64/tor.tar.xz) with the Tor binary from Nixpkgs. The
# bundled tor is a dynamically-linked ELF expecting the
# /lib64/ld-linux-x86-64.so.2 interpreter, which does not exist on NixOS.
makeWrapper ${lib.getExe' tor "tor"} ./tor
mkdir -p native/linux/x64
tar -cf - ./tor | xz > native/linux/x64/tor.tar.xz
zip opt/bisq/lib/app/tor-binary-linux64-*.jar native/linux/x64/tor.tar.xz >/dev/null
runHook postBuild
'';
installPhase = ''
runHook preInstall
mkdir -p $out/lib $out/bin
cp -r opt/bisq/lib/app $out/lib
install -D -m 777 ${bisq-launcher ""} $out/bin/bisq
substituteAllInPlace $out/bin/bisq
wrapProgram $out/bin/bisq --prefix PATH : ${binPath} --prefix LD_LIBRARY_PATH : ${libraryPath}
install -D -m 777 ${bisq-launcher "-Dglass.gtk.uiScale=2.0"} $out/bin/bisq-hidpi
substituteAllInPlace $out/bin/bisq-hidpi
wrapProgram $out/bin/bisq-hidpi --prefix PATH : ${binPath} --prefix LD_LIBRARY_PATH : ${libraryPath}
for n in 16 24 32 48 64 96 128 256; do
size=$n"x"$n
magick opt/bisq/lib/Bisq.png -resize $size bisq.png
install -Dm644 -t $out/share/icons/hicolor/$size/apps bisq.png
done
runHook postInstall
'';
meta = {
description = "Decentralized bitcoin exchange network (Bisq 1)";
homepage = "https://bisq.network";
mainProgram = "bisq";
sourceProvenance = with lib.sourceTypes; [
binaryBytecode
binaryNativeCode
];
license = lib.licenses.agpl3Only;
maintainers = with lib.maintainers; [ pmw ];
platforms = [
"x86_64-linux"
];
};
})

14
pkgs/by-name/bl/blesh/package.nix
View file

@ -10,14 +10,14 @@
stdenvNoCC.mkDerivation (finalAttrs: {
pname = "blesh";
version = "0.4.0-devel3-unstable-2026-06-21";
version = "0.4.0-devel3-unstable-2026-06-27";
src = fetchFromGitHub {
owner = "akinomyoga";
repo = "ble.sh";
rev = "6cffa910eccce252fa391875c7c03c94fb6f1b09";
rev = "5d39ebe6db67a46de4195f8ce8186e34cd2618d1";
fetchSubmodules = true;
hash = "sha256-CUIHfK1m00p6rBBNp/XqXifeRcG7BKpkdF7kl4+2tZY=";
hash = "sha256-12aSZl0qx0CwaIq/U77pCFz9Ij2CrzhojQuBngc7oag=";
};
nativeBuildInputs = [
@ -28,10 +28,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
# Fix the cache invalidation not working; see
# https://github.com/NixOS/nixpkgs/pull/521218#issuecomment-4641313131
./fix-cache-invalidation.patch
# ble.sh reaches a runtime-dir fallback under the install base when the
# others are unusable (always on WSL); see
# https://github.com/NixOS/nixpkgs/pull/521218#issuecomment-4686973408
./skip-readonly-runtime-dir.patch
];
# ble.sh embeds the commit id, normally read from .git, which fetchFromGitHub omits.
@ -41,6 +37,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
"BLE_GIT_BRANCH=master"
];
postPatch = ''
patchShebangs --build make_command.sh make
'';
doCheck = true;
# auto-detection runs `make -n check` without makeFlags, which fails without BLE_GIT_COMMIT_ID
checkTarget = "check";

10
pkgs/by-name/bl/blesh/skip-readonly-runtime-dir.patch
View file

@ -1,10 +0,0 @@
--- a/ble.pp
+++ b/ble.pp
@@ -1934,6 +1934,7 @@
function ble/base/initialize-runtime-directory/.base {
local tmp_dir=$_ble_base/run
if [[ ! -d $tmp_dir ]]; then
+ [[ -w $_ble_base ]] || return 1
ble/bin/mkdir -p "$tmp_dir" || return 1
ble/bin/chmod a+rwxt "$tmp_dir" || return 1
fi

131
pkgs/by-name/ca/cai/package.nix Normal file
View file

@ -0,0 +1,131 @@
{
lib,
python3Packages,
fetchFromGitHub,
nix-update-script,
writableTmpDirAsHomeHook,
}:
python3Packages.buildPythonApplication (finalAttrs: {
pname = "cai";
version = "1.1.5-unstable-2026-06-05";
pyproject = true;
__structuredAttrs = true;
src = fetchFromGitHub {
owner = "aliasrobotics";
repo = "cai";
rev = "1c79507140845d0c57455e3b623e489680fd80e8";
hash = "sha256-LcU9GoUulpeAaaBZr2Mg/C+UmjZ74UL+SGqdB0P9JtA=";
};
pythonRemoveDeps = [
"cryptography"
"dotenv"
"openinference-instrumentation-openai"
"pypdf2"
];
pythonRelaxDeps = [ "openai" ];
build-system = with python3Packages; [ hatchling ];
dependencies = with python3Packages; [
cryptography
curl-cffi
dnspython
docker
fastapi
flask
folium
graphviz
griffe
litellm
mako
matplotlib
mcp
mkdocs
mkdocs-material
nest-asyncio
networkx
numpy
numpy
openai
openinference-instrumentation-openai
pandas
paramiko
prompt-toolkit
pydantic
pypdf
python-dotenv
questionary
requests
rich
textual
trafilatura
types-requests
typing-extensions
wasabi
websockets
];
nativeInstallCheckInputs = with python3Packages; [
inline-snapshot
litellm
pytest-asyncio
pytestCheckHook
writableTmpDirAsHomeHook
];
pythonImportsCheck = [ "cai" ];
disabledTestPaths = [
# Exclude examples
"examples/"
# API key is required
"tests/agents/test_agent_inference.py"
"tests/agents/test_agent_one_tool.py"
"tests/agents/test_blue_teamer_gctr.py"
"tests/api/test_api.py"
"tests/cli/test_cli_headless_cancellation.py"
"tests/commands/"
"tests/integration/"
"tests/refusals/"
"tests/test_unified_pattern.py"
"tools/tpm_test.py"
# openai 2.x API changes
"tests/cli/test_cli_streaming.py"
"tests/core/test_openai_chatcompletions.py"
"tests/core/test_openai_chatcompletions_stream.py"
"tests/mcp/test_runner_calls_mcp.py"
"tests/tracing/test_agent_tracing.py"
"tests/tracing/test_responses_tracing.py"
"tests/tracing/test_tracing.py"
"tests/tracing/test_tracing_errors.py"
"tests/tracing/test_tracing_errors_streamed.py"
"tests/voice/test_workflow.py"
# Missing symbols (version mismatch)
"tests/core/test_auto_compact.py"
"tests/core/test_context_optimization.py"
# Probing the live interpreter outside sandbox
"tests/continuous_ops/test_wizard_worker_python_bin.py"
# Tests requires live CTF infrastructure
"tests/ctfs/test_ctf.py"
# Other error
"tests/test_cli_print_deduplication.py"
"tests/tools/test_output_tool.py"
"tests/util/test_wait_hints_compact.py"
];
passthru.updateScript = nix-update-script { };
meta = {
description = "Framework for AI Security";
homepage = "https://github.com/aliasrobotics/cai";
changelog = "https://github.com/aliasrobotics/cai/releases/tag/${finalAttrs.src.rev}";
license = lib.licenses.mit;
maintainers = with lib.maintainers; [ fab ];
mainProgram = "cai";
};
})

10
pkgs/by-name/ca/caido-cli/package.nix
View file

@ -9,25 +9,25 @@
stdenv.mkDerivation (finalAttrs: {
pname = "caido-cli";
version = "0.56.2";
version = "0.57.0";
src = fetchurl (
{
x86_64-linux = {
url = "https://caido.download/releases/v${finalAttrs.version}/caido-cli-v${finalAttrs.version}-linux-x86_64.tar.gz";
hash = "sha256-SUkysiFdH4ilA6MKYMiSqC80NkYZ9YVO/7CT0hQY++Q=";
hash = "sha256-ujpGYERNceUPartkgx4o38xUfPwWvnmiEnjkvmEbybA=";
};
aarch64-linux = {
url = "https://caido.download/releases/v${finalAttrs.version}/caido-cli-v${finalAttrs.version}-linux-aarch64.tar.gz";
hash = "sha256-rYRzo3iYjWAvRGm1+wBLGkr3eUoAGbi71+AX0qmoIXs=";
hash = "sha256-d1xzF0N6emShCQpotFiQEj1wV3hdt1DK7R+6Smlxrmg=";
};
x86_64-darwin = {
url = "https://caido.download/releases/v${finalAttrs.version}/caido-cli-v${finalAttrs.version}-mac-x86_64.zip";
hash = "sha256-mMWivNwgAmMYitERwnP/lAzgzua/2UDDDffSbgZXlr4=";
hash = "sha256-xh6kaYPJ7dwDHM1CkDzxYBHM4cKUex+XPXceqvQgWX4=";
};
aarch64-darwin = {
url = "https://caido.download/releases/v${finalAttrs.version}/caido-cli-v${finalAttrs.version}-mac-aarch64.zip";
hash = "sha256-19eEV79yk6PCHdl7oTw4Gqt10B7rYnZCJxBebDssFZc=";
hash = "sha256-FwbKLEwjiFzZWdBS6RgsDtc/EkI9AT2CBGwdmgEdDnw=";
};
}
.${stdenv.hostPlatform.system}

10
pkgs/by-name/ca/caido-desktop/package.nix
View file

@ -9,24 +9,24 @@
let
pname = "caido-desktop";
version = "0.56.2";
version = "0.57.0";
sources = {
x86_64-linux = {
url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-linux-x86_64.AppImage";
hash = "sha256-GW8prdvR9+WNO7bdz9ok27Aqra9+jgpZyBnYIM+G5Ys=";
hash = "sha256-a+WHhJ+TvwhOqHOxU7Y5LXeXAJ6T8hk71meFuTR+ra8=";
};
aarch64-linux = {
url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-linux-aarch64.AppImage";
hash = "sha256-mN5wf9RUllfbR/CfLTE6Ywzoj8wKmEG1clVCKRqPUtU=";
hash = "sha256-B7dw9uoG++AqT264ZlyHxGpv68fH5SlYzDKUaIM8c14=";
};
x86_64-darwin = {
url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-mac-x86_64.dmg";
hash = "sha256-4B3DQJL8M6otnLpFjr4haZA4EWHpgVADQW4DcwsDhIM=";
hash = "sha256-0VCLjl0Lpe+4Mgnrp6X8ApJWjAjuhkaZOxQ4P3C8MSM=";
};
aarch64-darwin = {
url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-mac-aarch64.dmg";
hash = "sha256-kZdfcZueMmgEHpNTIPANsN7X4lnVOfZXbKHxComaalM=";
hash = "sha256-GmpMnaGR7gYz1RvSO5xj9AA3xU1mn2IBInakmVkuG7A=";
};
};

4
pkgs/by-name/ca/calibre/package.nix
View file

@ -40,11 +40,11 @@ let
in
stdenv.mkDerivation (finalAttrs: {
pname = "calibre";
version = "9.9.0";
version = "9.10.0";
src = fetchurl {
url = "https://download.calibre-ebook.com/${finalAttrs.version}/calibre-${finalAttrs.version}.tar.xz";
hash = "sha256-ozwoRlJThVLiFmaR0fXdfxLDTEF4935rQGLZ+MzwXLk=";
hash = "sha256-U7iid8dm5sP7Xfsm+ikRn0oSm/j5qVS0I1qWPIowwwE=";
};
patches =

6
pkgs/by-name/ca/cargo-show-asm/package.nix
View file

@ -10,14 +10,14 @@
rustPlatform.buildRustPackage (finalAttrs: {
pname = "cargo-show-asm";
version = "0.2.59";
version = "0.2.62";
src = fetchCrate {
inherit (finalAttrs) pname version;
hash = "sha256-5RNfokTD86OFGzWRUyY29+d5P3sWWHmzGCGdIkzIK/g=";
hash = "sha256-gR1+Daz3EY6HtijWqbaCg6nD2B8gi6EYMYFspW39nlw=";
};
cargoHash = "sha256-EcnxozYMjxFHwLpeYwh5dP18+1tiPsY6uQBie3SCg18=";
cargoHash = "sha256-QpitYFYRkzntVW15PJimVIX6AaIU+qVY7g3Y88GnKkA=";
nativeBuildInputs = [
installShellFiles

4
pkgs/by-name/cb/cbmc/package.nix
View file

@ -17,13 +17,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "cbmc";
version = "6.9.0";
version = "6.10.0";
src = fetchFromGitHub {
owner = "diffblue";
repo = "cbmc";
tag = "cbmc-${finalAttrs.version}";
hash = "sha256-SMJBnzoyTwcwJa9L2X1iX2W4Z/Mwoirf8EXfoyG0dRI=";
hash = "sha256-GCagpb2TFhOEH+lzMth+PWiJxlEw0L+H1DYUEQoMF3g=";
};
srcglucose = fetchFromGitHub {

6
pkgs/by-name/co/codex/package.nix
View file

@ -26,18 +26,18 @@
}:
rustPlatform.buildRustPackage (finalAttrs: {
pname = "codex";
version = "0.142.0";
version = "0.142.2";
src = fetchFromGitHub {
owner = "openai";
repo = "codex";
tag = "rust-v${finalAttrs.version}";
hash = "sha256-F8wlv0vSuljNFDgIzoeuVxvD0dk90z2FBtpBTMih7AA=";
hash = "sha256-580LZSn3+lqyW5x7zkVX0TjW+d6apb/P1eG4q586dio=";
};
sourceRoot = "${finalAttrs.src.name}/codex-rs";
cargoHash = "sha256-fvEFNE12J6zaLZrN6oQB8X+jXoKPSCWrL17Sl28+7/c=";
cargoHash = "sha256-1gDiCB3Nf/0aIm+EoL3g9C0xbCi3cv6TfH5VytjJpOY=";
__structuredAttrs = true;

4
pkgs/by-name/co/context7-mcp/package.nix
View file

@ -18,13 +18,13 @@ let
in
stdenv.mkDerivation (finalAttrs: {
pname = "context7-mcp";
version = "3.2.1";
version = "3.2.2";
src = fetchFromGitHub {
owner = "upstash";
repo = "context7";
tag = "${tag-prefix}@${finalAttrs.version}";
hash = "sha256-Gf3GnVOceAMzsc1SYGQVriDzDD/dQYSoBSrCuQ5M4UI=";
hash = "sha256-v3zKMnZsc0gWVAdgZwFTskWcFVlOU6sG2i+qDwjx+dw=";
};
nativeBuildInputs = [

4
pkgs/by-name/co/copilot-language-server/package.nix
View file

@ -10,11 +10,11 @@
}:
stdenvNoCC.mkDerivation (finalAttrs: {
pname = "copilot-language-server";
version = "1.509.0";
version = "1.513.0";
src = fetchzip {
url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
hash = "sha256-PY4pr9FHKHSJjNctq7bGlsZ1yvDM6IqbmfobI1WsDP0=";
hash = "sha256-wVibxZjUW6BX4YhdYlyE0/zp0fst2H/XmmqZLqxGXH8=";
stripRoot = false;
};

7
pkgs/by-name/cy/cyberchef/package.nix
View file

@ -21,15 +21,16 @@ let
categories = [ "Development" ];
}
);
version = "11.0.0";
version = "11.2.0";
commit = "d358d82cbcb269d764a2deb598a37043bd054f45";
in
stdenv.mkDerivation {
pname = "cyberchef";
inherit version;
src = fetchzip {
url = "https://github.com/gchq/CyberChef/releases/download/v${version}/CyberChef_v${version}.zip";
hash = "sha256-Hom0YFel1GVdyx/1q7N93se6uLUVutp0Lu31WNhkPPA=";
url = "https://github.com/gchq/CyberChef/releases/download/v${version}/CyberChef_${commit}.zip";
hash = "sha256-3DXIrxCefiEYqZOPs8pO5jWdHFj7cPGgrwZcwE4ESPg=";
stripRoot = false;
};

10
pkgs/by-name/db/dbeaver-bin/package.nix
View file

@ -19,7 +19,7 @@
stdenvNoCC.mkDerivation (finalAttrs: {
pname = "dbeaver-bin";
version = "26.1.0";
version = "26.1.1";
src =
let
@ -32,10 +32,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
aarch64-darwin = "macos-aarch64.dmg";
};
hash = selectSystem {
x86_64-linux = "sha256-zAkHddh5xm9SHMV6OcJpl2A3+lS4GMJDbZ/+zg/5PzE=";
aarch64-linux = "sha256-0Tv45N+nZ2lRgn/Lo5HpPjuGigI0X2CJIIV96UO0bs8=";
x86_64-darwin = "sha256-INfXvR9FJZcruC8KeRtc0SIHUUHc0p3jjDNk4eBk7Lo=";
aarch64-darwin = "sha256-s+NQ5hp3NiQpJ/b3mp7Fdjh5rEmf1UnSz/Ai5Z43qEg=";
x86_64-linux = "sha256-atbQ00lq589FlNem85NgzTKGyhTRpFII8OSfVfYQuD0=";
aarch64-linux = "sha256-Sde0q31hXMqX2oxfhgj5EcpeUYYFZJy61usaJVpZkLM=";
x86_64-darwin = "sha256-EmTHuzEc4beM52hC2T7poZ1SOKa9kO2Rp3NnctlsBYo=";
aarch64-darwin = "sha256-PwuFwEE+aBEG/ykwNrEBl20yfrade8BdUUHdLJGBkwc=";
};
in
fetchurl {

4
pkgs/by-name/dd/ddhx/package.nix
View file

@ -5,13 +5,13 @@
}:
buildDubPackage (finalAttrs: {
pname = "ddhx";
version = "0.9.3";
version = "0.10.0";
src = fetchFromGitHub {
owner = "dd86k";
repo = "ddhx";
tag = "v${finalAttrs.version}";
hash = "sha256-7sXXkn/B9iN8Iq4X/Rj7BufdHKDBS1aG3pXcInG+UaI=";
hash = "sha256-1dbY7xUOpwihrppuB+tyHuV2b12E4Yv2J69LXULxmg0=";
};
dubLock = ./dub-lock.json;

6
pkgs/by-name/de/defuddle/package.nix
View file

@ -7,16 +7,16 @@
buildNpmPackage rec {
pname = "defuddle";
version = "0.18.1";
version = "0.19.1";
src = fetchFromGitHub {
owner = "kepano";
repo = "defuddle";
tag = version;
hash = "sha256-e/+eigIzpP0g+ZqTeyZnF6mloaY6UeKcMWfqryCcLbM=";
hash = "sha256-Fn203XKjZ2qbM1o0zs6mgxCdjWLOwz9Na+s1WSQG9XM=";
};
npmDepsHash = "sha256-1NFwhYEGTKpjzCdK/eHK0TWtOEpn67FA+B3QZ11w1Rs=";
npmDepsHash = "sha256-quqWhbcaSNj4Bk++4N4LYq3Y8U5nQqnwc+MqU0LLgso=";
# jsdom is both a peerDependency and devDependency; pruning
# devDependencies removes it, but the CLI needs it at runtime.

14
pkgs/by-name/de/devin-desktop/info.json Normal file
View file

@ -0,0 +1,14 @@
{
"aarch64-darwin": {
"version": "3.3.18",
"vscodeVersion": "1.110.1",
"url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/16737566f57f3b53bde136375fe0544eca12fac4/Devin-darwin-arm64-3.3.18.zip",
"sha256": "7ac789baa5d818b09f6a62315d34b55dde02b0a409a22903d0228a819ea734e7"
},
"x86_64-linux": {
"version": "3.3.18",
"vscodeVersion": "1.110.1",
"url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/16737566f57f3b53bde136375fe0544eca12fac4/Devin-linux-x64-3.3.18.tar.gz",
"sha256": "05c7fa988c324a1633038ebe90e217d17a7f188197a5070f397460864ef41292"
}
}

20
pkgs/by-name/wi/windsurf/package.nix → pkgs/by-name/de/devin-desktop/package.nix
View file

@ -16,15 +16,16 @@ buildVscode {
inherit commandLineArgs useVSCodeRipgrep;
inherit (info) version vscodeVersion;
pname = "windsurf";
executableName = "windsurf";
longName = "Windsurf";
shortName = "windsurf";
libraryName = "windsurf";
iconName = "windsurf";
pname = "devin-desktop";
sourceRoot = if stdenv.hostPlatform.isDarwin then "Windsurf.app" else "Windsurf";
executableName = "devin-desktop";
longName = "devin-desktop";
shortName = "devin-desktop";
libraryName = "devin-desktop";
iconName = "devin-desktop";
sourceRoot = if stdenv.hostPlatform.isDarwin then "Devin.app" else "Devin";
src = fetchurl { inherit (info) url sha256; };
@ -41,9 +42,9 @@ buildVscode {
description = "Agentic IDE powered by AI Flow paradigm";
longDescription = ''
The first agentic IDE, and then some.
The Windsurf Editor is where the work of developers and AI truly flow together, allowing for a coding experience that feels like literal magic.
Devin Desktop is where the work of developers and AI truly flow together, allowing for a coding experience that feels like literal magic.
'';
homepage = "https://codeium.com/windsurf";
homepage = "https://devin.ai/desktop";
license = lib.licenses.unfree;
maintainers = with lib.maintainers; [
sarahec
@ -51,7 +52,6 @@ buildVscode {
];
platforms = [
"aarch64-darwin"
"x86_64-darwin"
"x86_64-linux"
];
sourceProvenance = [ lib.sourceTypes.binaryBytecode ];

0
pkgs/by-name/wi/windsurf/update/.gitignore → pkgs/by-name/de/devin-desktop/update/.gitignore vendored
View file

0
pkgs/by-name/wi/windsurf/update/package.json → pkgs/by-name/de/devin-desktop/update/package.json
View file

0
pkgs/by-name/wi/windsurf/update/tsconfig.json → pkgs/by-name/de/devin-desktop/update/tsconfig.json
View file

9
pkgs/by-name/wi/windsurf/update/update.mts → pkgs/by-name/de/devin-desktop/update/update.mts
View file

@ -17,7 +17,7 @@ interface LatestInfo {
readonly productVersion: string;
}
const platforms = ["aarch64-darwin", "x86_64-darwin", "x86_64-linux"] as const;
const platforms = ["aarch64-darwin", "x86_64-linux"] as const;
type Platform = (typeof platforms)[number];
type InfoMap = Record<
Platform,
@ -29,7 +29,7 @@ type InfoMap = Record<
}
>;
async function getInfo(targetSystem: "darwin-arm64" | "darwin-x64" | "linux-x64") {
async function getInfo(targetSystem: "darwin-arm64" | "linux-x64") {
const url =
`https://windsurf-stable.codeium.com/api/update/${targetSystem}/stable/latest` as const;
@ -57,7 +57,6 @@ async function main() {
const info: InfoMap = {
"aarch64-darwin": await getInfo("darwin-arm64"),
"x86_64-darwin": await getInfo("darwin-x64"),
"x86_64-linux": await getInfo("linux-x64"),
};
if (JSON.stringify(oldInfo) === JSON.stringify(info)) {
@ -66,7 +65,7 @@ async function main() {
}
for (const platform of platforms) {
console.log(
`[update] Updating Windsurf ${platform} ${oldInfo[platform].version} -> ${info[platform].version}`,
`[update] Updating Devin Desktop ${platform} ${oldInfo[platform].version} -> ${info[platform].version}`,
);
}
await fsPromises.writeFile(
@ -74,7 +73,7 @@ async function main() {
JSON.stringify(info, null, 2) + "\n",
"utf-8",
);
console.log("[update] Updating Windsurf complete");
console.log("[update] Updating Devin Desktop complete");
}
if (process.argv[1] === __filename) {

4
pkgs/by-name/di/dioxus-cli/package.nix
View file

@ -9,7 +9,7 @@
installShellFiles,
makeWrapper,
esbuild,
wasm-bindgen-cli_0_2_118,
wasm-bindgen-cli_0_2_126,
testers,
dioxus-cli,
withTelemetry ? false,
@ -81,7 +81,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
--suffix PATH : ${
lib.makeBinPath [
esbuild
wasm-bindgen-cli_0_2_118
wasm-bindgen-cli_0_2_126
]
}
'';

4
pkgs/by-name/do/dolphin-emu/package.nix
View file

@ -55,13 +55,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "dolphin-emu";
version = "2603a";
version = "2606";
src = fetchFromGitHub {
owner = "dolphin-emu";
repo = "dolphin";
tag = finalAttrs.version;
hash = "sha256-+3/JtjKFsTEkKQa0LjycqNmDz0M8o2FndWQtw5R5/jQ=";
hash = "sha256-Rs/b5Vnm1VAYpvC6YWj3bZqHBCw2SCHnzLro1UrvsdY=";
fetchSubmodules = true;
leaveDotGit = true;
postFetch = ''

6
pkgs/by-name/dr/drawio/package.nix
View file

@ -14,14 +14,14 @@
stdenv.mkDerivation (finalAttrs: {
pname = "drawio";
version = "30.0.4";
version = "30.2.4";
src = fetchFromGitHub {
owner = "jgraph";
repo = "drawio-desktop";
rev = "v${finalAttrs.version}";
fetchSubmodules = true;
hash = "sha256-kkKiGRxztEVFo/wlcdBYcDlxadNarcTyL1MqwonfVY4=";
hash = "sha256-+Lmv9I+9dShnvdR5v8O8enj8G2iXBzWTd5ImkNkDioI=";
};
# `@electron/fuses` tries to run `codesign` and fails. Disable and use autoSignDarwinBinariesHook instead
@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
offlineCache = fetchNpmDeps {
src = finalAttrs.src;
hash = "sha256-hv1LQwsSOsBR5l/joUmXq6foQsVilH+jw3Wje24ISCg=";
hash = "sha256-87Z+abu9tH/BUT9Rey5Je1YeSGdWaD0TXP7ZJGIv6hI=";
};
nativeBuildInputs = [

4
pkgs/by-name/dw/dwproton-bin/package.nix
View file

@ -11,11 +11,11 @@ proton-ge-bin.overrideAttrs (
inherit steamDisplayName;
pname = "dwproton-bin";
version = "dwproton-11.0-3";
version = "dwproton-11.0-5";
src = fetchzip {
url = "https://dawn.wine/dawn-winery/dwproton/releases/download/${finalAttrs.version}/${finalAttrs.version}-x86_64.tar.xz";
hash = "sha256-e/YzKvwe30KveLHRUsntKDwzdEbr7a3Wfkqe/pu93WE=";
hash = "sha256-2x4xotJ2aJYbg+G2TDPqyU7uuoc/hZQon9CA6SFGin0=";
};
preFixup = ''

5
pkgs/by-name/fa/far2l/package.nix
View file

@ -130,10 +130,7 @@ stdenv.mkDerivation rec {
description = "Linux port of FAR Manager v2, a program for managing files and archives in Windows operating systems";
homepage = "https://github.com/elfmz/far2l";
license = lib.licenses.gpl2Only;
maintainers = with lib.maintainers; [
hypersw
smakarov
];
maintainers = with lib.maintainers; [ smakarov ];
platforms = lib.platforms.unix;
};
}

6
pkgs/by-name/fe/feishin/package.nix
View file

@ -8,7 +8,7 @@
mpv-unwrapped,
fetchPnpmDeps,
pnpmConfigHook,
pnpm_10_29_2,
pnpm_10,
darwin,
actool,
copyDesktopItems,
@ -42,7 +42,7 @@ buildNpmPackage {
version
src
;
pnpm = pnpm_10_29_2;
pnpm = pnpm_10;
fetcherVersion = 3;
hash = "sha256-zNOGJ24G0xcgsGK4DmbBm7d1PHTp7IJS+RTALGRtfDg=";
};
@ -50,7 +50,7 @@ buildNpmPackage {
env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
nativeBuildInputs = [
pnpm_10_29_2
pnpm_10
]
++ lib.optionals (stdenv.hostPlatform.isLinux) [ copyDesktopItems ]
++ lib.optionals stdenv.hostPlatform.isDarwin [

10
pkgs/by-name/fr/freelens-bin/package.nix
View file

@ -16,24 +16,24 @@
let
pname = "freelens-bin";
version = "1.9.0";
version = "1.10.1";
sources = {
x86_64-linux = {
url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-linux-amd64.AppImage";
hash = "sha256-aM3sS87kpb9UhVMdG7cPeCp4j9KBW71H+MJR+oN4908=";
hash = "sha256-Hbu28vbgaSEjJTAVSfHJ3cZGd2PRU0ex7dNv0wo1SrI=";
};
aarch64-linux = {
url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-linux-arm64.AppImage";
hash = "sha256-/DUMuGAhVV0Ro4UbAF6lwjgB4/Wi1AY2UKn9ZuN7fDc=";
hash = "sha256-JrApeOjMXNNi/wCq6vY6rYpPGgMWti0H+2i7QNEXaTc=";
};
x86_64-darwin = {
url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-macos-amd64.dmg";
hash = "sha256-xKH/RBR2if37WiquCC+ZSxGyoFF32iIPvYdGNfDbDFw=";
hash = "sha256-BIBEaQFny/DvzrvsC38UPiIqBFaxUO/DOVQTIe2gL+Q=";
};
aarch64-darwin = {
url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-macos-arm64.dmg";
hash = "sha256-dp/kD6NHmK/CNZEF2BKh6NAChBTMgjZLY7eIwhyWgWk=";
hash = "sha256-5duswriuDmL92tXqLckBhH2RMPFDqFRG/WW9oYMClGY=";
};
};

9
pkgs/by-name/fr/freescout/package.nix
View file

@ -7,13 +7,13 @@
stdenv.mkDerivation (finalAttrs: {
preferLocalBuild = true;
pname = "freescout";
version = "1.8.225";
version = "1.8.226";
src = fetchFromGitHub {
owner = "freescout-help-desk";
repo = "freescout";
tag = finalAttrs.version;
hash = "sha256-kXZ6bjF36YO1p6q+KTugnBO+KxqQZci5O0RNM7lqecQ=";
hash = "sha256-9fojG6S6yb2+W94cHrLuYIRjRL8JWspsj4bNE4QKSuk=";
};
patches = [
@ -46,9 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
runHook postInstall
'';
passthru.tests = {
inherit (nixosTests) freescout;
};
passthru.tests = lib.attrValues nixosTests.freescout;
# Because freescout is searching for some folders only relative to it's own source location, we need to have the symlinks to the actual locations in here
dontCheckForBrokenSymlinks = true;
@ -56,6 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
__structuredAttrs = true;
meta = with lib; {
changelog = "https://github.com/freescout-help-desk/freescout/releases/tag/${finalAttrs.src.tag}";
description = "Free self-hosted help desk & shared mailbox";
license = licenses.agpl3Only;
homepage = "https://freescout.net/";

8
pkgs/by-name/gi/github-desktop/package.nix
View file

@ -29,19 +29,19 @@
let
inherit (stdenv.hostPlatform.node) arch platform;
cacheRootHash = "sha256-OJDxq1Yep3swLU87YyJz7WfpPzpxo5ISukB4pIwxJBA=";
cacheAppHash = "sha256-DYUlLNxWn4sn7PBir/miJUoDVAQ2/nbOVGWSGN+IPxw=";
cacheRootHash = "sha256-/3niIma45fx3cmplxZsSxmnuS+vGtzjF2wqqZ5DcuJI=";
cacheAppHash = "sha256-/hmUmaPNGoIaIY9qdlP5CG/IKn2nnKCpOqf9Wvj1AwM=";
in
stdenv.mkDerivation (finalAttrs: {
pname = "github-desktop";
version = "3.5.12";
version = "3.6.1";
src = fetchFromGitHub {
owner = "desktop";
repo = "desktop";
tag = "release-${finalAttrs.version}";
hash = "sha256-/ehwjv1ipvxhmZYye1avkpz8uyO8YEWl0iM8U8n6pwE=";
hash = "sha256-S4lWh+6tOP3hw5nAgg6i6//Sd+gaI2aQnoRDQzHsxUg=";
fetchSubmodules = true;
postCheckout = "git -C $out rev-parse HEAD > $out/.gitrev";
};

6
pkgs/by-name/gl/glab/package.nix
View file

@ -13,13 +13,13 @@
buildGoModule (finalAttrs: {
pname = "glab";
version = "1.101.0";
version = "1.105.0";
src = fetchFromGitLab {
owner = "gitlab-org";
repo = "cli";
tag = "v${finalAttrs.version}";
hash = "sha256-K8QL9Ff5FHmiXyBEdsUE8kwhSF0camSFh08LbfJb3wo=";
hash = "sha256-MKb46PHgm+jfHGf2rEh0o7ghtb6JR4UE3Mam9z+2gw8=";
leaveDotGit = true;
postFetch = ''
cd "$out"
@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
'';
};
vendorHash = "sha256-u1zvzMrQGyTVcl/lnIGK3dfisxGYRa2LGpDMBDq6rJk=";
vendorHash = "sha256-aFrTCqvxVaiEJFKa4zY0kFW1P6QDDD4UG5x+yHK6vZ8=";
ldflags = [
"-s"

2
pkgs/by-name/gr/graphite/package.nix
View file

@ -12,7 +12,6 @@
lld,
pkg-config,
binaryen,
wasm-pack,
cargo-about,
nodejs,
wasm-bindgen-cli_0_2_121,
@ -97,7 +96,6 @@ stdenv.mkDerivation (finalAttrs: {
npmHooks.npmConfigHook
binaryen
wasm-bindgen-cli_0_2_121
wasm-pack
nodejs
cargo-about
removeReferencesTo

8
pkgs/by-name/gr/gren/generated-backend-package.nix
View file

@ -29,11 +29,11 @@
}:
mkDerivation {
pname = "gren";
version = "0.6.5";
version = "0.6.6";
src = fetchgit {
url = "https://github.com/gren-lang/compiler.git";
sha256 = "1865x63y0kcp2ax49333i5512vwh845iiyq3b30jm31pr113csvr";
rev = "ba2a2153b78086d75fe01ba45bdd630d6f5fc2fc";
sha256 = "02hin22kyh2zgxn2fklnfa60iw3ppfr3xnv4z7r39vkf6c2q7fhq";
rev = "03c52374f82036e7a3276a94e345a4aa98738b9b";
fetchSubmodules = true;
};
isLibrary = false;
@ -83,6 +83,6 @@ mkDerivation {
jailbreak = true;
homepage = "https://gren-lang.org";
description = "The `gren` command line interface";
license = lib.licensesSpdx."BSD-3-Clause";
license = lib.meta.getLicenseFromSpdxId "BSD-3-Clause";
mainProgram = "gren";
}

4
pkgs/by-name/gr/gren/package.nix
View file

@ -11,13 +11,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "gren";
version = "0.6.5";
version = "0.6.6";
src = fetchFromGitHub {
owner = "gren-lang";
repo = "compiler";
tag = finalAttrs.version;
hash = "sha256-eWs2Qsg3jCrBWAP7GAtBkG8RSoljjES6EpdN4IfpxaA=";
hash = "sha256-GLqDBTNu7jTy+WTbPrK7d/AIjHKWTidsf19AP4WwEQo=";
};
buildInputs = [ nodejs ];

4
pkgs/by-name/ha/haproxy/package.nix
View file

@ -33,11 +33,11 @@ let
in
stdenv.mkDerivation (finalAttrs: {
pname = "haproxy";
version = "3.4.0";
version = "3.4.1";
src = fetchurl {
url = "https://www.haproxy.org/download/${lib.versions.majorMinor finalAttrs.version}/src/haproxy-${finalAttrs.version}.tar.gz";
hash = "sha256-kpj1ZcKpuopOf4nFS+LF0/2WC1swTrVRXhXSnSwV1Pc=";
hash = "sha256-LmLEzk/XfTvHzxflhkMWY0VEVqB4t8hGW48BJbW8Ivg=";
};
buildInputs = [

3
pkgs/by-name/he/helm/package.nix
View file

@ -70,6 +70,9 @@ stdenv.mkDerivation (finalAttrs: {
substituteInPlace src/common/load_save.cpp \
--replace-fail "/usr/share/" "$out/share/"
substituteInPlace JUCE/modules/juce_audio_formats/codecs/flac/libFLAC/cpu.c \
--replace-fail "__sigemptyset(&sigill_sse.sa_mask);" "sigemptyset(&sigill_sse.sa_mask);"
'';
meta = {

6
pkgs/by-name/im/immich-go/package.nix
View file

@ -9,13 +9,13 @@
}:
buildGoModule (finalAttrs: {
pname = "immich-go";
version = "0.31.0";
version = "0.32.0";
src = fetchFromGitHub {
owner = "simulot";
repo = "immich-go";
tag = "v${finalAttrs.version}";
hash = "sha256-u+laNZ0/UncwH+3Ylk7g40DB99dAbQRrBNOVk80FrMc=";
hash = "sha256-bMbLMlLZpzFP7Zh9kqWzEELt3MdOR8HMkH0gTU8qD9U=";
# Inspired by: https://github.com/NixOS/nixpkgs/blob/f2d7a289c5a5ece8521dd082b81ac7e4a57c2c5c/pkgs/applications/graphics/pdfcpu/default.nix#L20-L32
# The intention here is to write the information into files in the `src`'s
@ -32,7 +32,7 @@ buildGoModule (finalAttrs: {
'';
};
vendorHash = "sha256-C6IQ6g5vdGqv8mzdTzLicZqP5lh3l2uNH2gIZELNAHg=";
vendorHash = "sha256-BwrP+eG+XPcTAbSKhJk0BOrfBlNeLHEeRhq49ZkQhwY=";
# options used by upstream:
# https://github.com/simulot/immich-go/blob/v0.25.0/.goreleaser.yaml

4
pkgs/by-name/in/incus-ui-canonical/package.nix
View file

@ -20,14 +20,14 @@ let
in
stdenv.mkDerivation (finalAttrs: {
pname = "incus-ui-canonical";
version = "0.21.0";
version = "0.21.2";
src = fetchFromGitHub {
owner = "zabbly";
repo = "incus-ui-canonical";
# only use tags prefixed by incus- they are the tested fork versions
tag = "incus-${finalAttrs.version}";
hash = "sha256-X5s9pxNI+XjL4mp/C/bS8K0lAJ/HsRJNTwLiF3mzY4s=";
hash = "sha256-nCussrzWjFbZ6its3X74KBktv/dZO76OJGwG7upjkMw=";
};
offlineCache = fetchYarnDeps {

15
pkgs/by-name/in/intel-llvm/package.nix
View file

@ -111,7 +111,20 @@ let
mkdir "$rsrc"
echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
ln -s "${lib.getLib self.unwrapped}/lib/clang/${self.llvmMajorVersion}/include" "$rsrc"
'';
''
+ (lib.concatStrings (
lib.mapAttrsToList (k: v: ''
echo "export ${k}=${v}" >> $out/nix-support/setup-hook
'') self.unwrapped.unified-runtime.setupVars
))
+ (lib.optionalString (self.unwrapped.unified-runtime.setupVars ? CUDA_PATH) ''
# SYCL CUDA runtime libs (e.g. libonemath_blas_cublas.so) carry DT_NEEDED: libcuda.so.1.
# GNU ld resolves transitive DT_NEEDED via -rpath-link, not -L; point it at the stubs.
echo "-rpath-link,${self.unwrapped.unified-runtime.setupVars.CUDA_PATH}/lib/stubs" >> $out/nix-support/cc-ldflags
# The SYCL CUDA backend discovers libdevice by finding ptxas in PATH.
echo "export PATH=${self.unwrapped.unified-runtime.setupVars.CUDA_PATH}/bin''${PATH:+:$PATH}" >> $out/nix-support/setup-hook
'');
extraPackages =
# We need to explicitly link to the dev package to get headers like sycl.hpp

19
pkgs/by-name/in/intel-llvm/unified-runtime.nix
View file

@ -18,6 +18,7 @@
pkg-config,
lit,
filecheck,
buildPackages,
rocmPackages ? { },
rocmGpuTargets ? lib.optionalString (rocmPackages ? clr.gpuTargets) (
builtins.concatStringsSep ";" rocmPackages.clr.gpuTargets
@ -41,10 +42,22 @@ let
];
};
# Minimal rocm join required at runtime
# We pass this to clang in its wrapper later.
# This is a separate join from the above because we don't
# need to pull in hsakmt and comgr at runtime, only build time.
rocmPath = symlinkJoin {
name = "rocm-path";
paths = with rocmPackages; [
clr
rocm-device-libs
];
};
cudatoolkit_joined = symlinkJoin {
name = "cuda-merged";
paths = with cudaPackages; [
paths = with buildPackages.cudaPackages; [
cuda_cudart
cuda_nvcc
cuda_nvml_dev.include
@ -158,6 +171,10 @@ stdenv.mkDerivation (finalAttrs: {
(lib.cmakeFeature "CUDA_cupti_LIBRARY" "${cudatoolkit_joined}/lib/libcupti.so")
];
passthru.setupVars =
lib.optionalAttrs rocmSupport { ROCM_PATH = rocmPath; }
// lib.optionalAttrs cudaSupport { CUDA_PATH = cudatoolkit_joined; };
passthru.backends =
lib.optionals levelZeroSupport [
"level_zero"

6
pkgs/by-name/jo/joplin-desktop/package.nix
View file

@ -1,7 +1,7 @@
{
lib,
stdenv,
nodejs,
nodejs_22,
makeDesktopItem,
copyDesktopItems,
makeWrapper,
@ -25,7 +25,9 @@
}:
let
yarn-berry = yarn-berry_4;
# nodejs pin should be obsolete once #522655 is in master
nodejs = nodejs_22;
yarn-berry = yarn-berry_4.override { inherit nodejs; };
releaseData = lib.importJSON ./release-data.json;
in

4
pkgs/by-name/jo/joplin-desktop/release-data.json
View file

@ -1,6 +1,6 @@
{
"version": "3.6.14",
"hash": "sha256-0mioVPCBhWmcXkVqCOku1KsPN29fGDp5jGhxnwD0MUk=",
"version": "3.6.15",
"hash": "sha256-uCF0nsHZowb9SuqBNni8/MWjGv9JyAUJs/gQprEoGjU=",
"plugins": {
"io.github.jackgruber.backup": {
"name": "joplin-plugin-backup",

20
pkgs/by-name/ki/kicad/versions.nix
View file

@ -47,23 +47,23 @@
};
"kicad-unstable" = {
kicadVersion = {
version = "2026-05-08";
version = "2026-06-27";
src = {
rev = "76f8839fd232594f81180f644e3370c390025144";
sha256 = "0nbr3cmrz1ca4rcwbfxvlrnwxy091lscgsqd92pqyy9sjcvqdfjg";
rev = "26010f14414a39852891c13a5f37261691608bb6";
sha256 = "1jd7dc7vabi2zl38aci3xlg3qwyrnwj0j2jzlfln7zq9p8h3fnsc";
};
};
libVersion = {
version = "2026-05-08";
version = "2026-06-27";
libSources = {
symbols.rev = "5a41d2112853c72129a9128df01021278c1aec11";
symbols.sha256 = "05h8dbygch2kp4s5ikspxngwv999j7jwsiwm4pzwwcrir7dqzdfl";
symbols.rev = "c7e226a4946cbd123ac57131b79a73979891d82f";
symbols.sha256 = "0sj2kxr48wqz075fda6jiwk9ajdf6iirbiw92wlilq3w8i3xa431";
templates.rev = "3ed4538b0f965d821df63a5fffc4441e723cfe7f";
templates.sha256 = "0zs29zn8qjgxv0w1vyr8yxmj02m8752zagn4vcraqgik46dwg2id";
footprints.rev = "098da23b916d287a0c7913752df53e6bfdf640a2";
footprints.sha256 = "1h1v44qc5lvvqvmi1i7b79jhxsfq8snk0mcfl6r73hj6w0b25l84";
packages3d.rev = "394aeaa41d7be7f717715d9ba004d7d0d8b74b36";
packages3d.sha256 = "01nbjcs3890hyfmafc623ldmfi9n8sjr5m0wripz5fq5fjdnzqxl";
footprints.rev = "645402ed82e16096cf827fea7114fdbef4c46948";
footprints.sha256 = "0plw6h6vr3rj9y7i59wa9c9qx9l8lsvzgan48q2k87wbs4x1gwsl";
packages3d.rev = "0bc64e922178140eb6890377646efd45e15011bd";
packages3d.sha256 = "0mkc9km540n6ri5is4fjw5abv8afidwj9q7fmbs66l6kx1z3lxky";
};
};
};

12
pkgs/by-name/ki/kiro/package.nix
View file

@ -5,6 +5,7 @@
fetchurl,
extraCommandLineArgs ? "",
useVSCodeRipgrep ? stdenv.hostPlatform.isDarwin,
_7zz,
}:
let
@ -31,7 +32,16 @@ in
url = sources.url;
hash = sources.hash;
};
sourceRoot = "Kiro";
# Kiro.dmg is APFS formatted, unpack with 7zz
extraNativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ _7zz ];
sourceRoot = if stdenv.hostPlatform.isDarwin then "Kiro.app" else "Kiro";
sourceExecutableName = if stdenv.hostPlatform.isDarwin then "code" else "kiro";
dontFixup = stdenv.hostPlatform.isDarwin;
patchVSCodePath = true;
tests = { };

4
pkgs/by-name/kn/knossosnet/package.nix
View file

@ -11,13 +11,13 @@
buildDotnetModule rec {
pname = "knossosnet";
version = "1.3.7";
version = "1.3.8";
src = fetchFromGitHub {
owner = "KnossosNET";
repo = "Knossos.NET";
tag = "v${version}";
hash = "sha256-zUV+sQdQ71ORKOZzd4yxgRK1HjtZc9wgkmnzz6bG8FA=";
hash = "sha256-G/RSopDFn6ma5rXFkRth3NncbTVrVF6OqgqaJZl3EkE=";
};
patches = [ ./dotnet-8-upgrade.patch ];

2
pkgs/by-name/kp/kpt/package.nix
View file

@ -30,6 +30,6 @@ buildGoModule (finalAttrs: {
mainProgram = "kpt";
homepage = "https://github.com/kptdev/kpt";
license = lib.licenses.asl20;
maintainers = with lib.maintainers; [ mikefaille ];
maintainers = [ ];
};
})

10
pkgs/by-name/kt/ktailctl/package.nix
View file

@ -11,21 +11,21 @@
}:
let
version = "0.21.5";
version = "0.22.0";
src = fetchFromGitHub {
owner = "f-koehler";
repo = "KTailctl";
rev = "v${version}";
hash = "sha256-DqPerb8NcNynMMmoG8Ld0ZEyhrNg2q17TaErAbXIHC0=";
hash = "sha256-20hR/N3m1BsbMGiaWVV/SH/OHgfk7ZC1+WWhYqQpIls=";
};
goDeps =
(buildGoModule {
pname = "ktailctl-go-wrapper";
inherit src version;
modRoot = "src/wrapper";
vendorHash = "sha256-jA1yortzyaBOP9GenmARhBBNDdpkGo9DNz0CXlh3BIU=";
modRoot = "src/tailscale/wrapper";
vendorHash = "sha256-h2gf9igVOguNRroGK6qvinUlEkpeZ2YJTtKArvlMj88=";
}).goModules;
in
stdenv.mkDerivation {
@ -33,7 +33,7 @@ stdenv.mkDerivation {
inherit version src;
postPatch = ''
cp -r --reflink=auto ${goDeps} src/wrapper/vendor
cp -r --reflink=auto ${goDeps} src/tailscale/wrapper/vendor
'';
# needed for go build to work

6
pkgs/by-name/ku/kube-state-metrics/package.nix
View file

@ -6,16 +6,16 @@
buildGoModule (finalAttrs: {
pname = "kube-state-metrics";
version = "2.17.0";
version = "2.19.1";
src = fetchFromGitHub {
owner = "kubernetes";
repo = "kube-state-metrics";
rev = "v${finalAttrs.version}";
hash = "sha256-w55FOWw9p7yV/bt4leZucOLqjVyHYFF+gVLWLGQKF9M=";
hash = "sha256-PZC3ZiVnChy7IdibZKB3IRv8+1AfmvAWY7RquwTcS1Y=";
};
vendorHash = "sha256-pcoqeYyOehFNkwD4fWqrk9725BJkv+8sKy1NLv+HJPE=";
vendorHash = "sha256-vmmXEDzkv+ZQaKJ6++HpPHj2M9gaquonNjXG2DOlxwI=";
excludedPackages = [
"./tests/e2e"

4
pkgs/by-name/li/linyaps-box/package.nix
View file

@ -13,13 +13,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "linyaps-box";
version = "2.2.0";
version = "2.2.1";
src = fetchFromGitHub {
owner = "OpenAtom-Linyaps";
repo = "linyaps-box";
rev = finalAttrs.version;
hash = "sha256-s17BI5nftQFrDZQVKBJjQYSOJHDPlkA2VLG4Hd61xSY=";
hash = "sha256-KULNPztaDeO6Dih98KcnawMz2rDjQd6AYT9FgAADhIg=";
};
nativeBuildInputs = [

14
pkgs/by-name/li/livekit-cli/package.nix
View file

@ -4,20 +4,28 @@
fetchFromGitHub,
nix-update-script,
testers,
pkg-config,
portaudio,
}:
buildGoModule (finalAttrs: {
pname = "livekit-cli";
version = "2.16.4";
version = "2.16.6";
src = fetchFromGitHub {
owner = "livekit";
repo = "livekit-cli";
tag = "v${finalAttrs.version}";
hash = "sha256-D3moluv7tWi9BIvhHq4NDgDmCBNtWPEJPIbvpaAHtao=";
hash = "sha256-lsvbnc2YGPX2OYmdH6ZW0a6eNF+o3S8Y0eLuYsb4dUs=";
};
vendorHash = "sha256-/vhISkzvfsPswsM0g4/RuyTZxqEEtfbtyAQV8YDRmu8=";
vendorHash = "sha256-BzEv2wpcXX7at6jJdgy9DtErbIU8ZPL+ollK1rlUWSA=";
# Use nixpkgs portaudio package + pkg-config rather than relying on a vendored
# git submodule, similar to the homebrew solution
nativeBuildInputs = [ pkg-config ];
buildInputs = [ portaudio ];
tags = [ "portaudio_system" ];
subPackages = [ "cmd/lk" ];

Some files were not shown because too many files have changed in this diff Show more