diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 8ed4c9ca820cb..2aec0fbc67591 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -58,13 +58,9 @@ /maintainers/scripts/db-to-md.sh @jtojnar @ryantm /maintainers/scripts/doc @jtojnar @ryantm -/doc/* @fricklerhandwerk /doc/build-aux/pandoc-filters @jtojnar -/doc/builders/trivial-builders.chapter.md @fricklerhandwerk /doc/contributing/ @fricklerhandwerk /doc/contributing/contributing-to-documentation.chapter.md @jtojnar @fricklerhandwerk -/doc/stdenv @fricklerhandwerk -/doc/using @fricklerhandwerk # NixOS Internals /nixos/default.nix @infinisil @@ -302,9 +298,9 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt /doc/languages-frameworks/javascript.section.md @winterqt # OCaml -/pkgs/build-support/ocaml @romildo @ulrikstrid -/pkgs/development/compilers/ocaml @romildo @ulrikstrid -/pkgs/development/ocaml-modules @romildo @ulrikstrid +/pkgs/build-support/ocaml @ulrikstrid +/pkgs/development/compilers/ocaml @ulrikstrid +/pkgs/development/ocaml-modules @ulrikstrid # ZFS pkgs/os-specific/linux/zfs @raitobezarius diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index 4fb4c0f68f9b4..b2ec787313e02 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -22,7 +22,7 @@ For new packages please briefly describe the package or provide a link to its ho - made sure NixOS tests are [linked](https://nixos.org/manual/nixpkgs/unstable/#ssec-nixos-tests-linking) to the relevant packages - [ ] Tested compilation of all packages that depend on this change using `nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"`. Note: all changes have to be committed, also see [nixpkgs-review usage](https://github.com/Mic92/nixpkgs-review#usage) - [ ] Tested basic functionality of all binary files (usually in `./result/bin/`) -- [23.11 Release Notes (or backporting 23.05 Release notes)](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#generating-2305-release-notes) +- [23.11 Release Notes](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2311.section.md) (or backporting [23.05 Release notes](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2305.section.md)) - [ ] (Package updates) Added a release notes entry if the change is major or breaking - [ ] (Module updates) Added a release notes entry if the change is significant - [ ] (Module addition) Added a release notes entry if adding a new NixOS module diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml index 60ceb304ee8a8..81fc5306fea1c 100644 --- a/.github/workflows/backport.yml +++ b/.github/workflows/backport.yml @@ -24,7 +24,7 @@ jobs: with: ref: ${{ github.event.pull_request.head.sha }} - name: Create backport PRs - uses: korthout/backport-action@v1.2.0 + uses: korthout/backport-action@v1.3.1 with: # Config README: https://github.com/korthout/backport-action#backport-action copy_labels_pattern: 'severity:\ssecurity' diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 1ba2ae48da4e5..2dd9b62cf953e 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -66,9 +66,12 @@ Useful git commands that can help a lot with this are `git commit --patch --amen From time to time, changes between branches must be rebased, for example, if the number of new rebuilds they would cause is too large for the target branch. When rebasing, care must be taken to include only the intended changes, otherwise -many CODEOWNERS will be inadvertently requested for review. To achieve this, +many CODEOWNERS will be inadvertently requested for review. To achieve this, rebasing should not be performed directly on the target branch, but on the merge -base between the current and target branch. +base between the current and target branch. As an additional precautionary measure, +you should temporarily mark the PR as draft for the duration of the operation. +This reduces the probability of mass-pinging people. (OfBorg might still +request a couple of persons for reviews though.) In the following example, we assume that the current branch, called `feature`, is based on `master`, and we rebase it onto the merge base between @@ -102,6 +105,36 @@ git status git push origin feature --force-with-lease ``` +### Something went wrong and a lot of people were pinged + +It happens. Remember to be kind, especially to new contributors. +There is no way back, so the pull request should be closed and locked +(if possible). The changes should be re-submitted in a new PR, in which the people +originally involved in the conversation need to manually be pinged again. +No further discussion should happen on the original PR, as a lot of people +are now subscribed to it. + +The following message (or a version thereof) might be left when closing to +describe the situation, since closing and locking without any explanation +is kind of rude: + +```markdown +It looks like you accidentally mass-pinged a bunch of people, which are now subscribed +and getting notifications for everything in this pull request. Unfortunately, they +cannot be automatically unsubscribed from the issue (removing review request does not +unsubscribe), therefore development cannot continue in this pull request anymore. + +Please open a new pull request with your changes, link back to this one and ping the +people actually involved in here over there. + +In order to avoid this in the future, there are instructions for how to properly +rebase between branches in our [contribution guidelines](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#rebasing-between-branches-ie-from-master-to-staging). +Setting your pull request to draft prior to rebasing is strongly recommended. +In draft status, you can preview the list of people that are about to be requested +for review, which allows you to sidestep this issue. +This is not a bulletproof method though, as OfBorg still does review requests even on draft PRs. +``` + ## Backporting changes Follow these steps to backport a change into a release branch in compliance with the [commit policy](https://nixos.org/nixpkgs/manual/#submitting-changes-stable-release-branches). @@ -128,19 +161,6 @@ Anything that does not cause user or downstream dependency regressions can be ba - Services which require a client to be up-to-date regardless. (E.g. `spotify`, `steam`, or `discord`) - Security critical applications (E.g. `firefox`) -## Generating 23.11 Release Notes - - -Documentation in nixpkgs is transitioning to a markdown-centric workflow. In the past release notes required a translation step to convert from markdown to a compatible docbook document, but this is no longer necessary. - -Steps for updating 23.11 Release notes: - -1. Edit `nixos/doc/manual/release-notes/rl-2311.section.md` with the desired changes -2. Commit changes to `rl-2311.section.md`. - ## Reviewing contributions See the nixpkgs manual for more details on how to [Review contributions](https://nixos.org/nixpkgs/manual/#chap-reviewing-contributions). diff --git a/doc/Makefile b/doc/Makefile index 208f23f5023a4..d5c0eeef69e27 100644 --- a/doc/Makefile +++ b/doc/Makefile @@ -66,18 +66,13 @@ out/html/index.html: doc-support/result manual-full.xml style.css highlightjs cp doc-support/result/xsl/docbook/images/callouts/*.svg out/html/images/callouts/ chmod u+w -R out/html/ -out/epub/manual.epub: manual-full.xml +out/epub/manual.epub: epub.xml mkdir -p out/epub/scratch xsltproc --nonet \ --output out/epub/scratch/ \ doc-support/result/epub.xsl \ - ./manual-full.xml + ./epub.xml - cp -r $(pandoc_media_dir) out/epub/scratch/OEBPS - cp ./overrides.css out/epub/scratch/OEBPS - cp ./style.css out/epub/scratch/OEBPS - mkdir -p out/epub/scratch/OEBPS/images/callouts/ - cp doc-support/result/xsl/docbook/images/callouts/*.svg out/epub/scratch/OEBPS/images/callouts/ echo "application/epub+zip" > mimetype zip -0Xq "out/epub/manual.epub" mimetype rm mimetype diff --git a/doc/builders/fetchers.chapter.md b/doc/builders/fetchers.chapter.md index b86fffa460423..4d4f3f427cd49 100644 --- a/doc/builders/fetchers.chapter.md +++ b/doc/builders/fetchers.chapter.md @@ -132,11 +132,16 @@ A number of fetcher functions wrap part of `fetchurl` and `fetchzip`. They are m `fetchFromGitHub` expects four arguments. `owner` is a string corresponding to the GitHub user or organization that controls this repository. `repo` corresponds to the name of the software repository. These are located at the top of every GitHub HTML page as `owner`/`repo`. `rev` corresponds to the Git commit hash or tag (e.g `v1.0`) that will be downloaded from Git. Finally, `hash` corresponds to the hash of the extracted directory. Again, other hash algorithms are also available, but `hash` is currently preferred. +To use a different GitHub instance, use `githubBase` (defaults to `"github.com"`). + `fetchFromGitHub` uses `fetchzip` to download the source archive generated by GitHub for the specified revision. If `leaveDotGit`, `deepClone` or `fetchSubmodules` are set to `true`, `fetchFromGitHub` will use `fetchgit` instead. Refer to its section for documentation of these options. ## `fetchFromGitLab` {#fetchfromgitlab} -This is used with GitLab repositories. The arguments expected are very similar to `fetchFromGitHub` above. +This is used with GitLab repositories. It behaves similarly to `fetchFromGitHub`, and expects `owner`, `repo`, `rev`, and `hash`. + +To use a specific GitLab instance, use `domain` (defaults to `"gitlab.com"`). + ## `fetchFromGitiles` {#fetchfromgitiles} @@ -144,7 +149,7 @@ This is used with Gitiles repositories. The arguments expected are similar to `f ## `fetchFromBitbucket` {#fetchfrombitbucket} -This is used with BitBucket repositories. The arguments expected are very similar to fetchFromGitHub above. +This is used with BitBucket repositories. The arguments expected are very similar to `fetchFromGitHub` above. ## `fetchFromSavannah` {#fetchfromsavannah} diff --git a/doc/builders/special/darwin-builder.section.md b/doc/builders/special/darwin-builder.section.md index 30bf2d0951029..b5b6ab8971e98 100644 --- a/doc/builders/special/darwin-builder.section.md +++ b/doc/builders/special/darwin-builder.section.md @@ -62,7 +62,7 @@ builders-use-substitutes = true $ sudo launchctl kickstart -k system/org.nixos.nix-daemon ``` -## Example flake usage +## Example flake usage {#sec-darwin-builder-example-flake} ``` { @@ -120,7 +120,7 @@ $ sudo launchctl kickstart -k system/org.nixos.nix-daemon } ``` -## Reconfiguring the builder +## Reconfiguring the builder {#sec-darwin-builder-reconfiguring} Initially you should not change the builder configuration else you will not be able to use the binary cache. However, after you have the builder running locally diff --git a/doc/builders/special/makesetuphook.section.md b/doc/builders/special/makesetuphook.section.md index fee508dc29c2a..eb042412137b8 100644 --- a/doc/builders/special/makesetuphook.section.md +++ b/doc/builders/special/makesetuphook.section.md @@ -12,7 +12,7 @@ pkgs.makeSetupHook { } ./script.sh ``` -#### setup hook that depends on the hello package and runs hello and @shell@ is substituted with path to bash {#sec-pkgs.makeSetupHook-usage-example} +### setup hook that depends on the hello package and runs hello and @shell@ is substituted with path to bash {#sec-pkgs.makeSetupHook-usage-example} ```nix pkgs.makeSetupHook { diff --git a/doc/builders/special/vm-tools.section.md b/doc/builders/special/vm-tools.section.md index 3b6fb0d2556b8..8feab04902d8f 100644 --- a/doc/builders/special/vm-tools.section.md +++ b/doc/builders/special/vm-tools.section.md @@ -6,7 +6,7 @@ A set of VM related utilities, that help in building some packages in more advan A bash script fragment that produces a disk image at `destination`. -### Attributes +### Attributes {#vm-tools-createEmptyImage-attributes} * `size`. The disk size, in MiB. * `fullName`. Name that will be written to `${destination}/nix-support/full-name`. @@ -20,14 +20,14 @@ Thus, any pure Nix derivation should run unmodified. If the build fails and Nix is run with the `-K/--keep-failed` option, a script `run-vm` will be left behind in the temporary build directory that allows you to boot into the VM and debug it interactively. -### Attributes +### Attributes {#vm-tools-runInLinuxVM-attributes} * `preVM` (optional). Shell command to be evaluated *before* the VM is started (i.e., on the host). * `memSize` (optional, default `512`). The memory size of the VM in MiB. * `diskImage` (optional). A file system image to be attached to `/dev/sda`. Note that currently we expect the image to contain a filesystem, not a full disk image with a partition table etc. -### Examples +### Examples {#vm-tools-runInLinuxVM-examples} Build the derivation hello inside a VM: ```nix @@ -56,13 +56,13 @@ runInLinuxVM (hello.overrideAttrs (_: { Takes a file, such as an ISO, and extracts its contents into the store. -### Attributes +### Attributes {#vm-tools-extractFs-attributes} * `file`. Path to the file to be extracted. Note that currently we expect the image to contain a filesystem, not a full disk image with a partition table etc. * `fs` (optional). Filesystem of the contents of the file. -### Examples +### Examples {#vm-tools-extractFs-examples} Extract the contents of an ISO file: ```nix @@ -82,7 +82,7 @@ Like [](#vm-tools-runInLinuxVM), but instead of using `stdenv` from the Nix stor Generate a script that can be used to run an interactive session in the given image. -### Examples +### Examples {#vm-tools-makeImageTestScript-examples} Create a script for running a Fedora 27 VM: ```nix @@ -100,7 +100,7 @@ makeImageTestScript diskImages.ubuntu2004x86_64 A set of functions that build a predefined set of minimal Linux distributions images. -### Images +### Images {#vm-tools-diskImageFuns-images} * Fedora * `fedora26x86_64` @@ -126,12 +126,12 @@ A set of functions that build a predefined set of minimal Linux distributions im * `debian11i386` * `debian11x86_64` -### Attributes +### Attributes {#vm-tools-diskImageFuns-attributes} * `size` (optional, defaults to `4096`). The size of the image, in MiB. * `extraPackages` (optional). A list names of additional packages from the distribution that should be included in the image. -### Examples +### Examples {#vm-tools-diskImageFuns-examples} 8GiB image containing Firefox in addition to the default packages: ```nix diff --git a/doc/builders/testers.chapter.md b/doc/builders/testers.chapter.md index 928a57673e770..fb6a28b7ee4b2 100644 --- a/doc/builders/testers.chapter.md +++ b/doc/builders/testers.chapter.md @@ -1,5 +1,5 @@ # Testers {#chap-testers} -This chapter describes several testing builders which are available in the testers namespace. +This chapter describes several testing builders which are available in the `testers` namespace. ## `hasPkgConfigModule` {#tester-hasPkgConfigModule} diff --git a/doc/contributing/coding-conventions.chapter.md b/doc/contributing/coding-conventions.chapter.md index 7a538de18d152..03cd3dd458c80 100644 --- a/doc/contributing/coding-conventions.chapter.md +++ b/doc/contributing/coding-conventions.chapter.md @@ -220,7 +220,9 @@ There are a few naming guidelines: - The `version` attribute _must_ start with a digit e.g`"0.3.1rc2". -- If a package is not a release but a commit from a repository, then the `version` attribute _must_ be the date of that (fetched) commit. The date _must_ be in `"unstable-YYYY-MM-DD"` format. +- If a package is a commit from a repository without a version assigned, then the `version` attribute _should_ be the latest upstream version preceding that commit, followed by `-unstable-` and the date of the (fetched) commit. The date _must_ be in `"YYYY-MM-DD"` format. + +Example: Given a project had its latest releases `2.2` in November 2021, and `3.0` in January 2022, a commit authored on March 15, 2022 for an upcoming bugfix release `2.2.1` would have `version = "2.2-unstable-2022-03-15"`. - Dashes in the package `pname` _should_ be preserved in new variable names, rather than converted to underscores or camel cased — e.g., `http-parser` instead of `http_parser` or `httpParser`. The hyphenated style is preferred in all three package names. diff --git a/doc/contributing/reviewing-contributions.chapter.md b/doc/contributing/reviewing-contributions.chapter.md index 6685c5b60a2c2..b4caf11f6d4bf 100644 --- a/doc/contributing/reviewing-contributions.chapter.md +++ b/doc/contributing/reviewing-contributions.chapter.md @@ -12,7 +12,7 @@ When reviewing a pull request, please always be nice and polite. Controversial c GitHub provides reactions as a simple and quick way to provide feedback to pull requests or any comments. The thumb-down reaction should be used with care and if possible accompanied with some explanation so the submitter has directions to improve their contribution. -pull request reviews should include a list of what has been reviewed in a comment, so other reviewers and mergers can know the state of the review. +Pull request reviews should include a list of what has been reviewed in a comment, so other reviewers and mergers can know the state of the review. All the review template samples provided in this section are generic and meant as examples. Their usage is optional and the reviewer is free to adapt them to their liking. @@ -201,7 +201,7 @@ checks should be performed: them to either recommit using that key or to remove their key information. - Given a maintainter entry like this: + Given a maintainer entry like this: ``` nix { diff --git a/doc/default.nix b/doc/default.nix index 4f55c95a04c1d..86b4a8d978146 100644 --- a/doc/default.nix +++ b/doc/default.nix @@ -20,7 +20,33 @@ in pkgs.stdenv.mkDerivation { ln -s ${doc-support} ./doc-support/result ''; + epub = '' + + + Nixpkgs Manual + Version ${pkgs.lib.version} + + + Temporarily unavailable + + The Nixpkgs manual is currently not available in EPUB format, + please use the HTML manual + instead. + + + If you've used the EPUB manual in the past and it has been useful to you, please + let us know. + + + + ''; + passAsFile = [ "epub" ]; + preBuild = '' + cp $epubPath epub.xml make -j$NIX_BUILD_CORES render-md ''; diff --git a/doc/functions/generators.section.md b/doc/functions/generators.section.md index d54e5027c799c..8b3ae6843a227 100644 --- a/doc/functions/generators.section.md +++ b/doc/functions/generators.section.md @@ -16,7 +16,7 @@ let if v == true then ''"yes"'' else if v == false then ''"no"'' else if isString v then ''"${v}"'' - # and delegats all other values to the default generator + # and delegates all other values to the default generator else generators.mkValueStringDefault {} v; } ":"; }; diff --git a/doc/hooks/autoconf.section.md b/doc/hooks/autoconf.section.md index 13d75910f1929..90e4681ef93fe 100644 --- a/doc/hooks/autoconf.section.md +++ b/doc/hooks/autoconf.section.md @@ -1,4 +1,3 @@ - -### Autoconf {#setup-hook-autoconf} +# Autoconf {#setup-hook-autoconf} The `autoreconfHook` derivation adds `autoreconfPhase`, which runs autoreconf, libtoolize and automake, essentially preparing the configure script in autotools-based builds. Most autotools-based packages come with the configure script pre-generated, but this hook is necessary for a few packages and when you need to patch the package’s configure scripts. diff --git a/doc/hooks/automake.section.md b/doc/hooks/automake.section.md index 562ac18fcd93c..dd0ff9c0cc096 100644 --- a/doc/hooks/automake.section.md +++ b/doc/hooks/automake.section.md @@ -1,4 +1,3 @@ - -### Automake {#setup-hook-automake} +# Automake {#setup-hook-automake} Adds the `share/aclocal` subdirectory of each build input to the `ACLOCAL_PATH` environment variable. diff --git a/doc/hooks/autopatchelf.section.md b/doc/hooks/autopatchelf.section.md index 9c2852ccf2794..008a90d46140c 100644 --- a/doc/hooks/autopatchelf.section.md +++ b/doc/hooks/autopatchelf.section.md @@ -1,5 +1,4 @@ - -### autoPatchelfHook {#setup-hook-autopatchelfhook} +# autoPatchelfHook {#setup-hook-autopatchelfhook} This is a special setup hook which helps in packaging proprietary software in that it automatically tries to find missing shared library dependencies of ELF files based on the given `buildInputs` and `nativeBuildInputs`. diff --git a/doc/hooks/breakpoint.section.md b/doc/hooks/breakpoint.section.md index 9600e06b79342..424a9424b55e8 100644 --- a/doc/hooks/breakpoint.section.md +++ b/doc/hooks/breakpoint.section.md @@ -1,5 +1,4 @@ - -### breakpointHook {#breakpointhook} +# breakpointHook {#breakpointhook} This hook will make a build pause instead of stopping when a failure happens. It prevents nix from cleaning up the build environment immediately and allows the user to attach to a build environment using the `cntr` command. Upon build error it will print instructions on how to use `cntr`, which can be used to enter the environment for debugging. Installing cntr and running the command will provide shell access to the build sandbox of failed build. At `/var/lib/cntr` the sandboxed filesystem is mounted. All commands and files of the system are still accessible within the shell. To execute commands from the sandbox use the cntr exec subcommand. `cntr` is only supported on Linux-based platforms. To use it first add `cntr` to your `environment.systemPackages` on NixOS or alternatively to the root user on non-NixOS systems. Then in the package that is supposed to be inspected, add `breakpointHook` to `nativeBuildInputs`. diff --git a/doc/hooks/cmake.section.md b/doc/hooks/cmake.section.md index 58fbfa45a2e06..b5dc5a914434b 100644 --- a/doc/hooks/cmake.section.md +++ b/doc/hooks/cmake.section.md @@ -1,4 +1,3 @@ - -### cmake {#cmake} +# cmake {#cmake} Overrides the default configure phase to run the CMake command. By default, we use the Make generator of CMake. In addition, dependencies are added automatically to `CMAKE_PREFIX_PATH` so that packages are correctly detected by CMake. Some additional flags are passed in to give similar behavior to configure-based packages. You can disable this hook’s behavior by setting `configurePhase` to a custom value, or by setting `dontUseCmakeConfigure`. `cmakeFlags` controls flags passed only to CMake. By default, parallel building is enabled as CMake supports parallel building almost everywhere. When Ninja is also in use, CMake will detect that and use the ninja generator. diff --git a/doc/hooks/gdk-pixbuf.section.md b/doc/hooks/gdk-pixbuf.section.md index 565216560abcb..cf7203dfc66ff 100644 --- a/doc/hooks/gdk-pixbuf.section.md +++ b/doc/hooks/gdk-pixbuf.section.md @@ -1,4 +1,3 @@ - -### gdk-pixbuf {#setup-hook-gdk-pixbuf} +# gdk-pixbuf {#setup-hook-gdk-pixbuf} Exports `GDK_PIXBUF_MODULE_FILE` environment variable to the builder. Add librsvg package to `buildInputs` to get svg support. See also the [setup hook description in GNOME platform docs](#ssec-gnome-hooks-gdk-pixbuf). diff --git a/doc/hooks/ghc.section.md b/doc/hooks/ghc.section.md index a4b0841ea486c..ac054b954a92b 100644 --- a/doc/hooks/ghc.section.md +++ b/doc/hooks/ghc.section.md @@ -1,4 +1,3 @@ - -### GHC {#ghc} +# GHC {#ghc} Creates a temporary package database and registers every Haskell build input in it (TODO: how?). diff --git a/doc/hooks/gnome.section.md b/doc/hooks/gnome.section.md index 8c209d9b472ce..b10e808020279 100644 --- a/doc/hooks/gnome.section.md +++ b/doc/hooks/gnome.section.md @@ -1,4 +1,3 @@ - -### GNOME platform {#gnome-platform} +# GNOME platform {#gnome-platform} Hooks related to GNOME platform and related libraries like GLib, GTK and GStreamer are described in [](#sec-language-gnome). diff --git a/doc/hooks/installShellFiles.section.md b/doc/hooks/installShellFiles.section.md index d27527503fedd..84adea2fa30c0 100644 --- a/doc/hooks/installShellFiles.section.md +++ b/doc/hooks/installShellFiles.section.md @@ -1,5 +1,4 @@ - -### `installShellFiles` {#installshellfiles} +# `installShellFiles` {#installshellfiles} This hook helps with installing manpages and shell completion files. It exposes 2 shell functions `installManPage` and `installShellCompletion` that can be used from your `postInstall` hook. diff --git a/doc/hooks/libiconv.section.md b/doc/hooks/libiconv.section.md index c228fe339e149..0ffa6d09b0a8a 100644 --- a/doc/hooks/libiconv.section.md +++ b/doc/hooks/libiconv.section.md @@ -1,4 +1,3 @@ - -### libiconv, libintl {#libiconv-libintl} +# libiconv, libintl {#libiconv-libintl} A few libraries automatically add to `NIX_LDFLAGS` their library, making their symbols automatically available to the linker. This includes libiconv and libintl (gettext). This is done to provide compatibility between GNU Linux, where libiconv and libintl are bundled in, and other systems where that might not be the case. Sometimes, this behavior is not desired. To disable this behavior, set `dontAddExtraLibs`. diff --git a/doc/hooks/libxml2.section.md b/doc/hooks/libxml2.section.md index 770ef9ff3ffec..df387fb5e2226 100644 --- a/doc/hooks/libxml2.section.md +++ b/doc/hooks/libxml2.section.md @@ -1,4 +1,3 @@ - -### libxml2 {#setup-hook-libxml2} +# libxml2 {#setup-hook-libxml2} Adds every file named `catalog.xml` found under the `xml/dtd` and `xml/xsl` subdirectories of each build input to the `XML_CATALOG_FILES` environment variable. diff --git a/doc/hooks/meson.section.md b/doc/hooks/meson.section.md index 32804b5e32f22..fd7779e6468f6 100644 --- a/doc/hooks/meson.section.md +++ b/doc/hooks/meson.section.md @@ -1,26 +1,25 @@ - -### Meson {#meson} +# Meson {#meson} Overrides the configure phase to run meson to generate Ninja files. To run these files, you should accompany Meson with ninja. By default, `enableParallelBuilding` is enabled as Meson supports parallel building almost everywhere. -#### Variables controlling Meson {#variables-controlling-meson} +## Variables controlling Meson {#variables-controlling-meson} -##### `mesonFlags` {#mesonflags} +### `mesonFlags` {#mesonflags} Controls the flags passed to meson. -##### `mesonBuildType` {#mesonbuildtype} +### `mesonBuildType` {#mesonbuildtype} Which [`--buildtype`](https://mesonbuild.com/Builtin-options.html#core-options) to pass to Meson. We default to `plain`. -##### `mesonAutoFeatures` {#mesonautofeatures} +### `mesonAutoFeatures` {#mesonautofeatures} What value to set [`-Dauto_features=`](https://mesonbuild.com/Builtin-options.html#core-options) to. We default to `enabled`. -##### `mesonWrapMode` {#mesonwrapmode} +### `mesonWrapMode` {#mesonwrapmode} What value to set [`-Dwrap_mode=`](https://mesonbuild.com/Builtin-options.html#core-options) to. We default to `nodownload` as we disallow network access. -##### `dontUseMesonConfigure` {#dontusemesonconfigure} +### `dontUseMesonConfigure` {#dontusemesonconfigure} Disables using Meson’s `configurePhase`. diff --git a/doc/hooks/ninja.section.md b/doc/hooks/ninja.section.md index 5ea1ee87070ad..4b0e33feb5c39 100644 --- a/doc/hooks/ninja.section.md +++ b/doc/hooks/ninja.section.md @@ -1,4 +1,3 @@ - -### ninja {#ninja} +# ninja {#ninja} Overrides the build, install, and check phase to run ninja instead of make. You can disable this behavior with the `dontUseNinjaBuild`, `dontUseNinjaInstall`, and `dontUseNinjaCheck`, respectively. Parallel building is enabled by default in Ninja. diff --git a/doc/hooks/perl.section.md b/doc/hooks/perl.section.md index 403227a9bf181..06942bd3c0e17 100644 --- a/doc/hooks/perl.section.md +++ b/doc/hooks/perl.section.md @@ -1,4 +1,3 @@ - -### Perl {#setup-hook-perl} +# Perl {#setup-hook-perl} Adds the `lib/site_perl` subdirectory of each build input to the `PERL5LIB` environment variable. For instance, if `buildInputs` contains Perl, then the `lib/site_perl` subdirectory of each input is added to the `PERL5LIB` environment variable. diff --git a/doc/hooks/pkg-config.section.md b/doc/hooks/pkg-config.section.md index 969c81f6d18ab..c98701cf9c9d9 100644 --- a/doc/hooks/pkg-config.section.md +++ b/doc/hooks/pkg-config.section.md @@ -1,4 +1,3 @@ - -### pkg-config {#setup-hook-pkg-config} +# pkg-config {#setup-hook-pkg-config} Adds the `lib/pkgconfig` and `share/pkgconfig` subdirectories of each build input to the `PKG_CONFIG_PATH` environment variable. diff --git a/doc/hooks/python.section.md b/doc/hooks/python.section.md index a46a727e95b10..ecaae491e994a 100644 --- a/doc/hooks/python.section.md +++ b/doc/hooks/python.section.md @@ -1,4 +1,3 @@ - -### Python {#setup-hook-python} +# Python {#setup-hook-python} Adds the `lib/${python.libPrefix}/site-packages` subdirectory of each build input to the `PYTHONPATH` environment variable. diff --git a/doc/hooks/qt-4.section.md b/doc/hooks/qt-4.section.md index f15d858e2377c..4b704df495973 100644 --- a/doc/hooks/qt-4.section.md +++ b/doc/hooks/qt-4.section.md @@ -1,4 +1,3 @@ - -### Qt 4 {#qt-4} +# Qt 4 {#qt-4} Sets the `QTDIR` environment variable to Qt’s path. diff --git a/doc/hooks/scons.section.md b/doc/hooks/scons.section.md index 1392269e5d55d..0a7a7aa023b63 100644 --- a/doc/hooks/scons.section.md +++ b/doc/hooks/scons.section.md @@ -1,4 +1,3 @@ - -### scons {#scons} +# scons {#scons} Overrides the build, install, and check phases. This uses the scons build system as a replacement for make. scons does not provide a configure phase, so everything is managed at build and install time. diff --git a/doc/hooks/tetex-tex-live.section.md b/doc/hooks/tetex-tex-live.section.md index 0ecdcc12e45ab..b702971d727c6 100644 --- a/doc/hooks/tetex-tex-live.section.md +++ b/doc/hooks/tetex-tex-live.section.md @@ -1,4 +1,3 @@ - -### teTeX / TeX Live {#tetex-tex-live} +# teTeX / TeX Live {#tetex-tex-live} Adds the `share/texmf-nix` subdirectory of each build input to the `TEXINPUTS` environment variable. diff --git a/doc/hooks/unzip.section.md b/doc/hooks/unzip.section.md index 91dc072de6621..5ec67e576a332 100644 --- a/doc/hooks/unzip.section.md +++ b/doc/hooks/unzip.section.md @@ -1,4 +1,3 @@ - -### unzip {#unzip} +# unzip {#unzip} This setup hook will allow you to unzip .zip files specified in `$src`. There are many similar packages like `unrar`, `undmg`, etc. diff --git a/doc/hooks/validatePkgConfig.section.md b/doc/hooks/validatePkgConfig.section.md index 8719ae930fcb0..aa6e0c06c2239 100644 --- a/doc/hooks/validatePkgConfig.section.md +++ b/doc/hooks/validatePkgConfig.section.md @@ -1,4 +1,3 @@ - -### validatePkgConfig {#validatepkgconfig} +# validatePkgConfig {#validatepkgconfig} The `validatePkgConfig` hook validates all pkg-config (`.pc`) files in a package. This helps catching some common errors in pkg-config files, such as undefined variables. diff --git a/doc/hooks/waf.section.md b/doc/hooks/waf.section.md index de65abde4502b..ee1bccff1d0aa 100644 --- a/doc/hooks/waf.section.md +++ b/doc/hooks/waf.section.md @@ -1,4 +1,3 @@ - -### wafHook {#wafhook} +# wafHook {#wafhook} Overrides the configure, build, and install phases. This will run the “waf” script used by many projects. If `wafPath` (default `./waf`) doesn’t exist, it will copy the version of waf available in Nixpkgs. `wafFlags` can be used to pass flags to the waf script. diff --git a/doc/hooks/xcbuild.section.md b/doc/hooks/xcbuild.section.md index 1426431f6dce2..bf404b64c3f9b 100644 --- a/doc/hooks/xcbuild.section.md +++ b/doc/hooks/xcbuild.section.md @@ -1,4 +1,3 @@ - -### xcbuildHook {#xcbuildhook} +# xcbuildHook {#xcbuildhook} Overrides the build and install phases to run the "xcbuild" command. This hook is needed when a project only comes with build files for the XCode build system. You can disable this behavior by setting buildPhase and configurePhase to a custom value. xcbuildFlags controls flags passed only to xcbuild. diff --git a/doc/languages-frameworks/bower.section.md b/doc/languages-frameworks/bower.section.md index 6226dc0702d70..fceb6aaccb6d2 100644 --- a/doc/languages-frameworks/bower.section.md +++ b/doc/languages-frameworks/bower.section.md @@ -1,6 +1,6 @@ # Bower {#sec-bower} -[Bower](https://bower.io) is a package manager for web site front-end components. Bower packages (comprising of build artefacts and sometimes sources) are stored in `git` repositories, typically on Github. The package registry is run by the Bower team with package metadata coming from the `bower.json` file within each package. +[Bower](https://bower.io) is a package manager for web site front-end components. Bower packages (comprising of build artifacts and sometimes sources) are stored in `git` repositories, typically on Github. The package registry is run by the Bower team with package metadata coming from the `bower.json` file within each package. The end result of running Bower is a `bower_components` directory which can be included in the web app's build process. @@ -41,32 +41,18 @@ The function is implemented in [pkgs/development/bower-modules/generic/default.n ### Example buildBowerComponents {#ex-buildBowerComponents} -```{=docbook} - +```nix bowerComponents = buildBowerComponents { name = "my-web-app"; - generated = ./bower-packages.nix; - src = myWebApp; + generated = ./bower-packages.nix; # note 1 + src = myWebApp; # note 2 }; - ``` In ["buildBowerComponents" example](#ex-buildBowerComponents) the following arguments are of special significance to the function: -```{=docbook} - - - - generated specifies the file which was created by bower2nix. - - - - - src is your project's sources. It needs to contain a bower.json file. - - - -``` +1. `generated` specifies the file which was created by {command}`bower2nix`. +2. `src` is your project's sources. It needs to contain a {file}`bower.json` file. `buildBowerComponents` will run Bower to link together the output of `bower2nix`, resulting in a `bower_components` directory which can be used. @@ -91,10 +77,9 @@ gulp.task('build', [], function () { ### Example Full example — default.nix {#ex-buildBowerComponentsDefaultNix} -```{=docbook} - +```nix { myWebApp ? { outPath = ./.; name = "myWebApp"; } -, pkgs ? import <nixpkgs> {} +, pkgs ? import {} }: pkgs.stdenv.mkDerivation { @@ -103,49 +88,29 @@ pkgs.stdenv.mkDerivation { buildInputs = [ pkgs.nodePackages.gulp ]; - bowerComponents = pkgs.buildBowerComponents { + bowerComponents = pkgs.buildBowerComponents { # note 1 name = "my-web-app"; generated = ./bower-packages.nix; src = myWebApp; }; buildPhase = '' - cp --reflink=auto --no-preserve=mode -R $bowerComponents/bower_components . - export HOME=$PWD - ${pkgs.nodePackages.gulp}/bin/gulp build + cp --reflink=auto --no-preserve=mode -R $bowerComponents/bower_components . # note 2 + export HOME=$PWD # note 3 + ${pkgs.nodePackages.gulp}/bin/gulp build # note 4 ''; installPhase = "mv gulpdist $out"; } - ``` A few notes about [Full example — `default.nix`](#ex-buildBowerComponentsDefaultNix): -```{=docbook} - - - - The result of buildBowerComponents is an input to the frontend build. - - - - - Whether to symlink or copy the bower_components directory depends on the build tool in use. In this case a copy is used to avoid gulp silliness with permissions. - - - - - gulp requires HOME to refer to a writeable directory. - - - - - The actual build command. Other tools could be used. - - - -``` +1. The result of `buildBowerComponents` is an input to the frontend build. +2. Whether to symlink or copy the {file}`bower_components` directory depends on the build tool in use. + In this case a copy is used to avoid {command}`gulp` silliness with permissions. +3. {command}`gulp` requires `HOME` to refer to a writeable directory. +4. The actual build command in this example is {command}`gulp`. Other tools could be used instead. ## Troubleshooting {#ssec-bower2nix-troubleshooting} diff --git a/doc/languages-frameworks/gnome.section.md b/doc/languages-frameworks/gnome.section.md index 3c8539ac4244e..5208f1013cbdb 100644 --- a/doc/languages-frameworks/gnome.section.md +++ b/doc/languages-frameworks/gnome.section.md @@ -27,7 +27,7 @@ The modules are typically installed to `lib/gio/modules/` directory of a package In particular, we recommend: -* adding `dconf.lib` for any software on Linux that reads [GSettings](#ssec-gnome-settings) (even transitivily through e.g. GTK’s file manager) +* adding `dconf.lib` for any software on Linux that reads [GSettings](#ssec-gnome-settings) (even transitively through e.g. GTK’s file manager) * adding `glib-networking` for any software that accesses network using GIO or libsoup – glib-networking contains a module that implements TLS support and loads system-wide proxy settings To allow software to use various virtual file systems, `gvfs` package can be also added. But that is usually an optional feature so we typically use `gvfs` from the system (e.g. installed globally using NixOS module). @@ -137,15 +137,15 @@ Most GNOME package offer [`updateScript`](#var-passthru-updateScript), it is the ## Frequently encountered issues {#ssec-gnome-common-issues} -#### `GLib-GIO-ERROR **: 06:04:50.903: No GSettings schemas are installed on the system` {#ssec-gnome-common-issues-no-schemas} +### `GLib-GIO-ERROR **: 06:04:50.903: No GSettings schemas are installed on the system` {#ssec-gnome-common-issues-no-schemas} There are no schemas available in `XDG_DATA_DIRS`. Temporarily add a random package containing schemas like `gsettings-desktop-schemas` to `buildInputs`. [`glib`](#ssec-gnome-hooks-glib) and [`wrapGAppsHook`](#ssec-gnome-hooks-wrapgappshook) setup hooks will take care of making the schemas available to application and you will see the actual missing schemas with the [next error](#ssec-gnome-common-issues-missing-schema). Or you can try looking through the source code for the actual schemas used. -#### `GLib-GIO-ERROR **: 06:04:50.903: Settings schema ‘org.gnome.foo’ is not installed` {#ssec-gnome-common-issues-missing-schema} +### `GLib-GIO-ERROR **: 06:04:50.903: Settings schema ‘org.gnome.foo’ is not installed` {#ssec-gnome-common-issues-missing-schema} Package is missing some GSettings schemas. You can find out the package containing the schema with `nix-locate org.gnome.foo.gschema.xml` and let the hooks handle the wrapping as [above](#ssec-gnome-common-issues-no-schemas). -#### When using `wrapGAppsHook` with special derivers you can end up with double wrapped binaries. {#ssec-gnome-common-issues-double-wrapped} +### When using `wrapGAppsHook` with special derivers you can end up with double wrapped binaries. {#ssec-gnome-common-issues-double-wrapped} This is because derivers like `python.pkgs.buildPythonApplication` or `qt5.mkDerivation` have setup-hooks automatically added that produce wrappers with makeWrapper. The simplest way to workaround that is to disable the `wrapGAppsHook` automatic wrapping with `dontWrapGApps = true;` and pass the arguments it intended to pass to makeWrapper to another. @@ -193,7 +193,7 @@ mkDerivation { } ``` -#### I am packaging a project that cannot be wrapped, like a library or GNOME Shell extension. {#ssec-gnome-common-issues-unwrappable-package} +### I am packaging a project that cannot be wrapped, like a library or GNOME Shell extension. {#ssec-gnome-common-issues-unwrappable-package} You can rely on applications depending on the library setting the necessary environment variables but that is often easy to miss. Instead we recommend to patch the paths in the source code whenever possible. Here are some examples: @@ -209,6 +209,6 @@ You can rely on applications depending on the library setting the necessary envi []{#ssec-gnome-common-issues-unwrappable-package-gsettings-c} [Hard-coding GSettings schema path in C library](https://github.com/NixOS/nixpkgs/blob/29c120c065d03b000224872251bed93932d42412/pkgs/development/libraries/glib-networking/default.nix#L31-L34) – nothing special other than using [Coccinelle patch](https://github.com/NixOS/nixpkgs/pull/67957#issuecomment-527717467) to generate the patch itself. -#### I need to wrap a binary outside `bin` and `libexec` directories. {#ssec-gnome-common-issues-weird-location} +### I need to wrap a binary outside `bin` and `libexec` directories. {#ssec-gnome-common-issues-weird-location} You can manually trigger the wrapping with `wrapGApp` in `preFixup` phase. It takes a path to a program as a first argument; the remaining arguments are passed directly to [`wrapProgram`](#fun-wrapProgram) function. diff --git a/doc/languages-frameworks/haskell.section.md b/doc/languages-frameworks/haskell.section.md index 894eba1494e5a..87da2e63663a1 100644 --- a/doc/languages-frameworks/haskell.section.md +++ b/doc/languages-frameworks/haskell.section.md @@ -1057,7 +1057,7 @@ benchmark component. `dontBenchmark drv` : Set `doBenchmark` to `false` for `drv`. -`setBuildTargets list drv` +`setBuildTargets drv list` : Sets the `buildTarget` argument for `drv` so that the targets specified in `list` are built. `doCoverage drv` diff --git a/doc/languages-frameworks/ios.section.md b/doc/languages-frameworks/ios.section.md index 04b013be12e26..eb8e2ca553267 100644 --- a/doc/languages-frameworks/ios.section.md +++ b/doc/languages-frameworks/ios.section.md @@ -104,7 +104,7 @@ The above function takes a variety of parameters: and the location where the source code resides * `sdkVersion` specifies which version of the iOS SDK to use. -It also possile to adjust the `xcodebuild` parameters. This is only needed in +It also possible to adjust the `xcodebuild` parameters. This is only needed in rare circumstances. In most cases the default values should suffice: * Specifies which `xcodebuild` target to build. By default it takes the target @@ -130,7 +130,7 @@ In addition, you need to set the following parameters: store certificates. * `generateIPA` specifies that we want to produce an IPA file (this is probably what you want) -* `generateXCArchive` specifies thet we want to produce an xcarchive file. +* `generateXCArchive` specifies that we want to produce an xcarchive file. When building IPA files on Hydra and when it is desired to allow iOS devices to install IPAs by browsing to the Hydra build products page, you can enable the diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md index fdb570ebc3204..a6c5aad15c15c 100644 --- a/doc/languages-frameworks/javascript.section.md +++ b/doc/languages-frameworks/javascript.section.md @@ -143,7 +143,7 @@ To update NPM packages in nixpkgs, run the same `generate.sh` script: #### Git protocol error {#javascript-git-error} Some packages may have Git dependencies from GitHub specified with `git://`. -GitHub has [disabled unecrypted Git connections](https://github.blog/2021-09-01-improving-git-protocol-security-github/#no-more-unauthenticated-git), so you may see the following error when running the generate script: +GitHub has [disabled unencrypted Git connections](https://github.blog/2021-09-01-improving-git-protocol-security-github/#no-more-unauthenticated-git), so you may see the following error when running the generate script: ``` The unauthenticated git protocol on port 9418 is no longer supported diff --git a/doc/languages-frameworks/nim.section.md b/doc/languages-frameworks/nim.section.md index 4f97c7585f335..6b0fb3df03115 100644 --- a/doc/languages-frameworks/nim.section.md +++ b/doc/languages-frameworks/nim.section.md @@ -15,32 +15,23 @@ case of packages not containing exported library code the attribute The following example shows a Nim program that depends only on Nim libraries: ```nix -{ lib, nimPackages, fetchurl }: - -nimPackages.buildNimPackage rec { - pname = "hottext"; - version = "1.4"; +{ lib, nimPackages, fetchFromGitHub }: +nimPackages.buildNimPackage (finalAttrs: { + pname = "ttop"; + version = "1.0.1"; nimBinOnly = true; - src = fetchurl { - url = "https://git.sr.ht/~ehmry/hottext/archive/v${version}.tar.gz"; - hash = "sha256-hIUofi81zowSMbt1lUsxCnVzfJGN3FEiTtN8CEFpwzY="; + src = fetchFromGitHub { + owner = "inv2004"; + repo = "ttop"; + rev = "v${finalAttrs.version}"; + hash = "sha256-x4Uczksh6p3XX/IMrOFtBxIleVHdAPX9e8n32VAUTC4="; }; - buildInputs = with nimPackages; [ - bumpy - chroma - flatty - nimsimd - pixie - sdl2 - typography - vmath - zippy - ]; -} + buildInputs = with nimPackages; [ asciigraph illwill parsetoml zippy ]; +}) ``` ## Nim library packages in Nixpkgs {#nim-library-packages-in-nixpkgs} @@ -60,15 +51,15 @@ non-Nim package: ```nix { lib, buildNimPackage, fetchNimble, SDL2 }: -buildNimPackage rec { +buildNimPackage (finalAttrs: { pname = "sdl2"; version = "2.0.4"; src = fetchNimble { - inherit pname version; - hash = "sha256-qDtVSnf+7rTq36WAxgsUZ8XoUk4sKwHyt8EJcY5WP+o="; + inherit (finalAttrs) pname version; + hash = "sha256-Vtcj8goI4zZPQs2TbFoBFlcR5UqDtOldaXSH/+/xULk="; }; propagatedBuildInputs = [ SDL2 ]; -} +}) ``` ## `buildNimPackage` parameters {#buildnimpackage-parameters} diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md index 10f5e3938ce49..d9a13aef6e603 100644 --- a/doc/languages-frameworks/python.section.md +++ b/doc/languages-frameworks/python.section.md @@ -995,7 +995,7 @@ and in this case the `python3` interpreter is automatically used. ### Interpreters {#interpreters} Versions 2.7, 3.8, 3.9, 3.10 and 3.11 of the CPython interpreter are available -as respectively `python27`, python38`, `python39`, `python310` and `python311`. +as respectively `python27`, `python38`, `python39`, `python310` and `python311`. The aliases `python2` and `python3` correspond to respectively `python27` and `python310`. The attribute `python` maps to `python2`. The PyPy interpreters compatible with Python 2.7 and 3 are available as `pypy27` and `pypy3`, with diff --git a/doc/languages-frameworks/qt.section.md b/doc/languages-frameworks/qt.section.md index e09194e391e1c..2300c5f60edeb 100644 --- a/doc/languages-frameworks/qt.section.md +++ b/doc/languages-frameworks/qt.section.md @@ -10,37 +10,22 @@ pure and explicit at build-time, at the cost of introducing an extra indirection ## Nix expression for a Qt package (default.nix) {#qt-default-nix} -```{=docbook} - -{ stdenv, lib, qtbase, wrapQtAppsHook }: +```nix +{ stdenv, lib, qtbase, wrapQtAppsHook }: stdenv.mkDerivation { pname = "myapp"; version = "1.0"; buildInputs = [ qtbase ]; - nativeBuildInputs = [ wrapQtAppsHook ]; + nativeBuildInputs = [ wrapQtAppsHook ]; } - - - - - - Import Qt modules directly, that is: qtbase, qtdeclarative, etc. - Do not import Qt package sets such as qt5 - because the Qt versions of dependencies may not be coherent, causing build and runtime failures. - - - - - All Qt packages must include wrapQtAppsHook in - nativeBuildInputs, or you must explicitly set - dontWrapQtApps. - - - ``` +It is important to import Qt modules directly, that is: `qtbase`, `qtdeclarative`, etc. *Do not* import Qt package sets such as `qt5` because the Qt versions of dependencies may not be coherent, causing build and runtime failures. + +Additionally all Qt packages must include `wrapQtAppsHook` in `nativeBuildInputs`, or you must explicitly set `dontWrapQtApps`. + ## Locating runtime dependencies {#qt-runtime-dependencies} Qt applications must be wrapped to find runtime dependencies. diff --git a/doc/stdenv/meta.chapter.md b/doc/stdenv/meta.chapter.md index a21dfd0821af5..e626e79429968 100644 --- a/doc/stdenv/meta.chapter.md +++ b/doc/stdenv/meta.chapter.md @@ -70,7 +70,7 @@ A list of the maintainers of this Nix expression. Maintainers are defined in [`n ### `mainProgram` {#var-meta-mainProgram} -The name of the main binary for the package. This effects the binary `nix run` executes and falls back to the name of the package. Example: `"rg"` +The name of the main binary for the package. This affects the binary `nix run` executes and falls back to the name of the package. Example: `"rg"` ### `priority` {#var-meta-priority} @@ -128,7 +128,7 @@ Prefer `passthru.tests` for tests that are introduced in nixpkgs because: * we can run `passthru.tests` independently * `installCheckPhase` adds overhead to each build -For more on how to write and run package tests, see . +For more on how to write and run package tests, see [](#sec-package-tests). #### NixOS tests {#var-meta-tests-nixos} diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md index a923da935ced6..71d28282e9b25 100644 --- a/doc/stdenv/stdenv.chapter.md +++ b/doc/stdenv/stdenv.chapter.md @@ -286,7 +286,7 @@ This is where “sum-like” comes in from above: We can just sum all of the hos Because of the bounds checks, the uncommon cases are `h = t` and `h + 2 = t`. In the former case, the motivation for `mapOffset` is that since its host and target platforms are the same, no transitive dependency of it should be able to “discover” an offset greater than its reduced target offsets. `mapOffset` effectively “squashes” all its transitive dependencies’ offsets so that none will ever be greater than the target offset of the original `h = t` package. In the other case, `h + 1` is skipped over between the host and target offsets. Instead of squashing the offsets, we need to “rip” them apart so no transitive dependencies’ offset is that one. -Overall, the unifying theme here is that propagation shouldn’t be introducing transitive dependencies involving platforms the depending package is unaware of. \[One can imagine the dependending package asking for dependencies with the platforms it knows about; other platforms it doesn’t know how to ask for. The platform description in that scenario is a kind of unforagable capability.\] The offset bounds checking and definition of `mapOffset` together ensure that this is the case. Discovering a new offset is discovering a new platform, and since those platforms weren’t in the derivation “spec” of the needing package, they cannot be relevant. From a capability perspective, we can imagine that the host and target platforms of a package are the capabilities a package requires, and the depending package must provide the capability to the dependency. +Overall, the unifying theme here is that propagation shouldn’t be introducing transitive dependencies involving platforms the depending package is unaware of. \[One can imagine the depending package asking for dependencies with the platforms it knows about; other platforms it doesn’t know how to ask for. The platform description in that scenario is a kind of unforgeable capability.\] The offset bounds checking and definition of `mapOffset` together ensure that this is the case. Discovering a new offset is discovering a new platform, and since those platforms weren’t in the derivation “spec” of the needing package, they cannot be relevant. From a capability perspective, we can imagine that the host and target platforms of a package are the capabilities a package requires, and the depending package must provide the capability to the dependency. #### Variables specifying dependencies {#variables-specifying-dependencies} @@ -971,7 +971,8 @@ to `~/.gdbinit`. GDB will then be able to find debug information installed via ` The installCheck phase checks whether the package was installed correctly by running its test suite against the installed directories. The default `installCheck` calls `make installcheck`. -It is often better to add tests that are not part of the source distribution to `passthru.tests` (see ). This avoids adding overhead to every build and enables us to run them independently. +It is often better to add tests that are not part of the source distribution to `passthru.tests` (see +[](#var-meta-tests)). This avoids adding overhead to every build and enables us to run them independently. #### Variables controlling the installCheck phase {#variables-controlling-the-installcheck-phase} @@ -1234,7 +1235,7 @@ This runs the strip command on installed binaries and libraries. This removes un This setup hook patches installed scripts to add Nix store paths to their shebang interpreter as found in the build environment. The [shebang](https://en.wikipedia.org/wiki/Shebang_(Unix)) line tells a Unix-like operating system which interpreter to use to execute the script's contents. -::: note +::: {.note} The [generic builder][generic-builder] populates `PATH` from inputs of the derivation. ::: @@ -1272,7 +1273,7 @@ patchShebangs --build configure Interpreter paths that point to a valid Nix store location are not changed. -::: note +::: {.note} A script file must be marked as executable, otherwise it will not be considered. ::: diff --git a/lib/licenses.nix b/lib/licenses.nix index a9a1170050a6f..c91eca9278ed4 100644 --- a/lib/licenses.nix +++ b/lib/licenses.nix @@ -98,6 +98,11 @@ in mkLicense lset) ({ fullName = "Artistic License 1.0"; }; + artistic1-cl8 = { + spdxId = "Artistic-1.0-cl8"; + fullName = "Artistic License 1.0 w/clause 8"; + }; + artistic2 = { spdxId = "Artistic-2.0"; fullName = "Artistic License 2.0"; @@ -178,6 +183,11 @@ in mkLicense lset) ({ fullName = ''BSD 3-clause "New" or "Revised" License''; }; + bsd3Clear = { + spdxId = "BSD-3-Clause-Clear"; + fullName = "BSD 3-Clause Clear License"; + }; + bsdOriginal = { spdxId = "BSD-4-Clause"; fullName = ''BSD 4-clause "Original" or "Old" License''; @@ -215,6 +225,12 @@ in mkLicense lset) ({ url = "https://opensource.org/licenses/CAL-1.0"; }; + caldera = { + spdxId = "Caldera"; + fullName = "Caldera License"; + url = "http://www.lemis.com/grog/UNIX/ancient-source-all.pdf"; + }; + capec = { fullName = "Common Attack Pattern Enumeration and Classification"; url = "https://capec.mitre.org/about/termsofuse.html"; @@ -284,11 +300,26 @@ in mkLicense lset) ({ free = false; }; + cc-by-sa-10 = { + spdxId = "CC-BY-SA-1.0"; + fullName = "Creative Commons Attribution Share Alike 1.0"; + }; + + cc-by-sa-20 = { + spdxId = "CC-BY-SA-2.0"; + fullName = "Creative Commons Attribution Share Alike 2.0"; + }; + cc-by-sa-25 = { spdxId = "CC-BY-SA-2.5"; fullName = "Creative Commons Attribution Share Alike 2.5"; }; + cc-by-10 = { + spdxId = "CC-BY-1.0"; + fullName = "Creative Commons Attribution 1.0"; + }; + cc-by-30 = { spdxId = "CC-BY-3.0"; fullName = "Creative Commons Attribution 3.0"; @@ -475,6 +506,16 @@ in mkLicense lset) ({ url = "http://www.schristiancollins.com/generaluser.php"; # license included in sources }; + gfl = { + fullName = "GUST Font License"; + url = "http://www.gust.org.pl/fonts/licenses/GUST-FONT-LICENSE.txt"; + }; + + gfsl = { + fullName = "GUST Font Source License"; + url = "http://www.gust.org.pl/fonts/licenses/GUST-FONT-SOURCE-LICENSE.txt"; + }; + gpl1Only = { spdxId = "GPL-1.0-only"; fullName = "GNU General Public License v1.0 only"; @@ -556,6 +597,12 @@ in mkLicense lset) ({ fullName = "Imlib2 License"; }; + info-zip = { + spdxId = "Info-ZIP"; + fullName = "Info-ZIP License"; + url = "http://www.info-zip.org/pub/infozip/license.html"; + }; + inria-compcert = { fullName = "INRIA Non-Commercial License Agreement for the CompCert verified compiler"; url = "https://compcert.org/doc/LICENSE.txt"; @@ -609,6 +656,11 @@ in mkLicense lset) ({ free = false; }; + knuth = { + fullName = "Knuth CTAN License"; + spdxId = "Knuth-CTAN"; + }; + lal12 = { spdxId = "LAL-1.2"; fullName = "Licence Art Libre 1.2"; @@ -685,11 +737,21 @@ in mkLicense lset) ({ url = "https://opensource.franz.com/preamble.html"; }; + lppl1 = { + spdxId = "LPPL-1.0"; + fullName = "LaTeX Project Public License v1.0"; + }; + lppl12 = { spdxId = "LPPL-1.2"; fullName = "LaTeX Project Public License v1.2"; }; + lppl13a = { + spdxId = "LPPL-1.3a"; + fullName = "LaTeX Project Public License v1.3a"; + }; + lppl13c = { spdxId = "LPPL-1.3c"; fullName = "LaTeX Project Public License v1.3c"; diff --git a/lib/lists.nix b/lib/lists.nix index 2186cd4a79f60..5d9af0cf7114e 100644 --- a/lib/lists.nix +++ b/lib/lists.nix @@ -198,8 +198,38 @@ rec { default: # Input list list: - let found = filter pred list; - in if found == [] then default else head found; + let + # A naive recursive implementation would be much simpler, but + # would also overflow the evaluator stack. We use `foldl'` as a workaround + # because it reuses the same stack space, evaluating the function for one + # element after another. We can't return early, so this means that we + # sacrifice early cutoff, but that appears to be an acceptable cost. A + # clever scheme with "exponential search" is possible, but appears over- + # engineered for now. See https://github.com/NixOS/nixpkgs/pull/235267 + + # Invariant: + # - if index < 0 then el == elemAt list (- index - 1) and all elements before el didn't satisfy pred + # - if index >= 0 then pred (elemAt list index) and all elements before (elemAt list index) didn't satisfy pred + # + # We start with index -1 and the 0'th element of the list, which satisfies the invariant + resultIndex = foldl' (index: el: + if index < 0 then + # No match yet before the current index, we need to check the element + if pred el then + # We have a match! Turn it into the actual index to prevent future iterations from modifying it + - index - 1 + else + # Still no match, update the index to the next element (we're counting down, so minus one) + index - 1 + else + # There's already a match, propagate the index without evaluating anything + index + ) (-1) list; + in + if resultIndex < 0 then + default + else + elemAt list resultIndex; /* Return true if function `pred` returns true for at least one element of `list`. diff --git a/lib/systems/architectures.nix b/lib/systems/architectures.nix index 57b9184ca60cd..f8cf0e2b933f3 100644 --- a/lib/systems/architectures.nix +++ b/lib/systems/architectures.nix @@ -28,6 +28,7 @@ rec { znver1 = [ "sse3" "ssse3" "sse4_1" "sse4_2" "sse4a" "aes" "avx" "avx2" "fma" ]; znver2 = [ "sse3" "ssse3" "sse4_1" "sse4_2" "sse4a" "aes" "avx" "avx2" "fma" ]; znver3 = [ "sse3" "ssse3" "sse4_1" "sse4_2" "sse4a" "aes" "avx" "avx2" "fma" ]; + znver4 = [ "sse3" "ssse3" "sse4_1" "sse4_2" "sse4a" "aes" "avx" "avx2" "avx512" "fma" ]; # other armv5te = [ ]; armv6 = [ ]; @@ -86,6 +87,7 @@ rec { znver1 = [ "skylake" ] ++ inferiors.skylake; znver2 = [ "znver1" ] ++ inferiors.znver1; znver3 = [ "znver2" ] ++ inferiors.znver2; + znver4 = [ "znver3" ] ++ inferiors.znver3; # other armv5te = [ ]; diff --git a/lib/systems/default.nix b/lib/systems/default.nix index f4784c61c6752..eaf070ca71113 100644 --- a/lib/systems/default.nix +++ b/lib/systems/default.nix @@ -9,6 +9,39 @@ rec { examples = import ./examples.nix { inherit lib; }; architectures = import ./architectures.nix { inherit lib; }; + /* + Elaborated systems contain functions, which means that they don't satisfy + `==` for a lack of reflexivity. + + They might *appear* to satisfy `==` reflexivity when the same exact value is + compared to itself, because object identity is used as an "optimization"; + compare the value with a reconstruction of itself, e.g. with `f == a: f a`, + or perhaps calling `elaborate` twice, and one will see reflexivity fail as described. + + Hence a custom equality test. + + Note that this does not canonicalize the systems, so you'll want to make sure + both arguments have been `elaborate`-d. + */ + equals = + let removeFunctions = a: lib.filterAttrs (_: v: !builtins.isFunction v) a; + in a: b: removeFunctions a == removeFunctions b; + + /* + Try to convert an elaborated system back to a simple string. If not possible, + return null. So we have the property: + + sys: _valid_ sys -> + sys == elaborate (toLosslessStringMaybe sys) + + NOTE: This property is not guaranteed when `sys` was elaborated by a different + version of Nixpkgs. + */ + toLosslessStringMaybe = sys: + if lib.isString sys then sys + else if equals sys (elaborate sys.system) then sys.system + else null; + /* List of all Nix system doubles the nixpkgs flake will expose the package set for. All systems listed here must be supported by nixpkgs as `localSystem`. @@ -193,8 +226,7 @@ rec { }; wine = (pkgs.winePackagesFor "wine${toString final.parsed.cpu.bits}").minimal; in - if final.parsed.kernel.name == pkgs.stdenv.hostPlatform.parsed.kernel.name && - pkgs.stdenv.hostPlatform.canExecute final + if pkgs.stdenv.hostPlatform.canExecute final then "${pkgs.runtimeShell} -c '\"$@\"' --" else if final.isWindows then "${wine}/bin/wine${lib.optionalString (final.parsed.cpu.bits == 64) "64"}" diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix index 231f19c513eb2..ce980436c1bcb 100644 --- a/lib/tests/misc.nix +++ b/lib/tests/misc.nix @@ -518,6 +518,46 @@ runTests { expected = false; }; + testFindFirstExample1 = { + expr = findFirst (x: x > 3) 7 [ 1 6 4 ]; + expected = 6; + }; + + testFindFirstExample2 = { + expr = findFirst (x: x > 9) 7 [ 1 6 4 ]; + expected = 7; + }; + + testFindFirstEmpty = { + expr = findFirst (abort "when the list is empty, the predicate is not needed") null []; + expected = null; + }; + + testFindFirstSingleMatch = { + expr = findFirst (x: x == 5) null [ 5 ]; + expected = 5; + }; + + testFindFirstSingleDefault = { + expr = findFirst (x: false) null [ (abort "if the predicate doesn't access the value, it must not be evaluated") ]; + expected = null; + }; + + testFindFirstNone = { + expr = builtins.tryEval (findFirst (x: x == 2) null [ 1 (throw "the last element must be evaluated when there's no match") ]); + expected = { success = false; value = false; }; + }; + + # Makes sure that the implementation doesn't cause a stack overflow + testFindFirstBig = { + expr = findFirst (x: x == 1000000) null (range 0 1000000); + expected = 1000000; + }; + + testFindFirstLazy = { + expr = findFirst (x: x == 1) 7 [ 1 (abort "list elements after the match must not be evaluated") ]; + expected = 1; + }; # ATTRSETS diff --git a/lib/tests/release.nix b/lib/tests/release.nix index c3bf58db241f8..5bade7112f19e 100644 --- a/lib/tests/release.nix +++ b/lib/tests/release.nix @@ -53,6 +53,9 @@ let echo "Running lib/tests/sources.sh" TEST_LIB=$PWD/lib bash lib/tests/sources.sh + echo "Running lib/tests/systems.nix" + [[ $(nix-instantiate --eval --strict lib/tests/systems.nix | tee /dev/stderr) == '[ ]' ]]; + mkdir $out echo success > $out/${nix.version} ''; diff --git a/lib/tests/systems.nix b/lib/tests/systems.nix index 2afe128c4208a..862496313e902 100644 --- a/lib/tests/systems.nix +++ b/lib/tests/systems.nix @@ -1,10 +1,8 @@ -# We assert that the new algorithmic way of generating these lists matches the -# way they were hard-coded before. +# Run: +# [nixpkgs]$ nix-instantiate --eval --strict lib/tests/systems.nix +# Expected output: [], or the failed cases # -# One might think "if we exhaustively test, what's the point of procedurally -# calculating the lists anyway?". The answer is one can mindlessly update these -# tests as new platforms become supported, and then just give the diff a quick -# sanity check before committing :). +# OfBorg runs (approximately) nix-build lib/tests/release.nix let lib = import ../default.nix; mseteq = x: y: { @@ -12,7 +10,16 @@ let expected = lib.sort lib.lessThan y; }; in -with lib.systems.doubles; lib.runTests { +lib.runTests ( +# We assert that the new algorithmic way of generating these lists matches the +# way they were hard-coded before. +# +# One might think "if we exhaustively test, what's the point of procedurally +# calculating the lists anyway?". The answer is one can mindlessly update these +# tests as new platforms become supported, and then just give the diff a quick +# sanity check before committing :). + +(with lib.systems.doubles; { testall = mseteq all (linux ++ darwin ++ freebsd ++ openbsd ++ netbsd ++ illumos ++ wasi ++ windows ++ embedded ++ mmix ++ js ++ genode ++ redox); testarm = mseteq arm [ "armv5tel-linux" "armv6l-linux" "armv6l-netbsd" "armv6l-none" "armv7a-linux" "armv7a-netbsd" "armv7l-linux" "armv7l-netbsd" "arm-none" "armv7a-darwin" ]; @@ -39,4 +46,44 @@ with lib.systems.doubles; lib.runTests { testopenbsd = mseteq openbsd [ "i686-openbsd" "x86_64-openbsd" ]; testwindows = mseteq windows [ "i686-cygwin" "x86_64-cygwin" "i686-windows" "x86_64-windows" ]; testunix = mseteq unix (linux ++ darwin ++ freebsd ++ openbsd ++ netbsd ++ illumos ++ cygwin ++ redox); +}) + +// { + test_equals_example_x86_64-linux = { + expr = lib.systems.equals (lib.systems.elaborate "x86_64-linux") (lib.systems.elaborate "x86_64-linux"); + expected = true; + }; + + test_toLosslessStringMaybe_example_x86_64-linux = { + expr = lib.systems.toLosslessStringMaybe (lib.systems.elaborate "x86_64-linux"); + expected = "x86_64-linux"; + }; + test_toLosslessStringMaybe_fail = { + expr = lib.systems.toLosslessStringMaybe (lib.systems.elaborate "x86_64-linux" // { something = "extra"; }); + expected = null; + }; } + +# Generate test cases to assert that a change in any non-function attribute makes a platform unequal +// lib.concatMapAttrs (platformAttrName: origValue: { + + ${"test_equals_unequal_${platformAttrName}"} = + let modified = + assert origValue != arbitraryValue; + lib.systems.elaborate "x86_64-linux" // { ${platformAttrName} = arbitraryValue; }; + arbitraryValue = x: "<>"; + in { + expr = lib.systems.equals (lib.systems.elaborate "x86_64-linux") modified; + expected = { + # Changes in these attrs are not detectable because they're function. + # The functions should be derived from the data, so this is not a problem. + canExecute = null; + emulator = null; + emulatorAvailable = null; + isCompatible = null; + }?${platformAttrName}; + }; + +}) (lib.systems.elaborate "x86_64-linux" /* arbitrary choice, just to get all the elaborated attrNames */) + +) diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index 7586a34a64f6d..a2cfa44e43c84 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -64,6 +64,12 @@ githubId = 64707304; name = "Dmitry Kulikov"; }; + _0x120581f = { + email = "nixpkgs@0x120581f.dev"; + name = "0x120581f"; + github = "0x120581f"; + githubId = 130835755; + }; _0x4A6F = { email = "mail-maintainer@0x4A6F.dev"; matrix = "@0x4a6f:matrix.org"; @@ -516,6 +522,12 @@ githubId = 44871469; name = "Etienne Wodey"; }; + aither64 = { + email = "aither@havefun.cz"; + github = "aither64"; + githubId = 4717906; + name = "Jakub Skokan"; + }; ajgrf = { email = "a@ajgrf.com"; github = "ajgrf"; @@ -1945,6 +1957,16 @@ fingerprint = "E9A3 7864 2165 28CE 507C CA82 72EA BF75 C331 CD25"; }]; }; + Benjamin-L = { + name = "Benjamin Lee"; + email = "benjamin@computer.surgery"; + matrix = "@benjamin:computer.surgery"; + github = "Benjamin-L"; + githubId = 6504174; + keys = [{ + fingerprint = "9D84 09A0 44FC 1EEB AE2D FA30 FB96 24E2 885D 55A4"; + }]; + }; benkuhn = { email = "ben@ben-kuhn.com"; github = "ben-kuhn"; @@ -2216,6 +2238,13 @@ githubId = 68566724; name = "bootstrap-prime"; }; + boozedog = { + email = "code@booze.dog"; + github = "boozedog"; + githubId = 1410808; + matrix = "@boozedog:matrix.org"; + name = "David A. Buser"; + }; borisbabic = { email = "boris.ivan.babic@gmail.com"; github = "borisbabic"; @@ -3079,6 +3108,15 @@ githubId = 34317; name = "Corey O'Connor"; }; + code-asher = { + email = "ash@coder.com"; + github = "code-asher"; + githubId = 45609798; + name = "Asher"; + keys = [{ + fingerprint = "6E3A FA6D 915C C2A4 D26F C53E 7BB4 BA9C 783D 2BBC"; + }]; + }; CodeLongAndProsper90 = { github = "CodeLongAndProsper90"; githubId = 50145141; @@ -3554,6 +3592,12 @@ fingerprint = "4779 D1D5 3C97 2EAE 34A5 ED3D D8AF C4BF 0567 0F9D"; }]; }; + dariof4 = { + name = "dariof4"; + email = "dazedtank@gmail.com"; + github = "dariof4"; + githubId = 9992814; + }; darkonion0 = { name = "Alexandre Peruggia"; email = "darkgenius1@protonmail.com"; @@ -3739,6 +3783,12 @@ fingerprint = "9B43 6B14 77A8 79C2 6CDB 6604 C171 2510 02C2 00F2"; }]; }; + deemp = { + email = "deempleton@gmail.com"; + github = "deemp"; + githubId = 48378098; + name = "Danila Danko"; + }; deepfire = { email = "_deepfire@feelingofgreen.ru"; github = "deepfire"; @@ -4940,6 +4990,12 @@ githubId = 1847524; name = "Evan Stoll"; }; + evanrichter = { + email = "evanjrichter@gmail.com"; + github = "evanrichter"; + githubId = 330292; + name = "Evan Richter"; + }; evax = { email = "nixos@evax.fr"; github = "evax"; @@ -5743,6 +5799,19 @@ githubId = 10353047; name = "Tobias Happ"; }; + getchoo = { + email = "getchoo@tuta.io"; + github = "getchoo"; + githubId = 48872998; + name = "Seth"; + }; + getpsyched = { + name = "Priyanshu Tripathi"; + email = "priyanshutr@proton.me"; + matrix = "@getpsyched:matrix.org"; + github = "getpsyched"; + githubId = 43472218; + }; gfrascadorio = { email = "gfrascadorio@tutanota.com"; github = "gfrascadorio"; @@ -6571,6 +6640,11 @@ fingerprint = "78C2 E81C 828A 420B 269A EBC1 49FA 39F8 A7F7 35F9"; }]; }; + hulr = { + github = "hulr"; + githubId = 17255815; + name = "hulr"; + }; humancalico = { email = "humancalico@disroot.org"; github = "humancalico"; @@ -7057,6 +7131,12 @@ github = "j4m3s-s"; githubId = 9413812; }; + jacfal = { + name = "Jakub Pravda"; + email = "me@jakubpravda.net"; + github = "jakub-pravda"; + githubId = 16310411; + }; jacg = { name = "Jacek Generowicz"; email = "jacg@my-post-office.net"; @@ -8332,6 +8412,12 @@ githubId = 546087; name = "Kristoffer K. Føllesdal"; }; + khaser = { + email = "a-horohorin@mail.ru"; + github = "khaser"; + githubId = 59027018; + name = "Andrey Khorokhorin"; + }; kho-dialga = { email = "ivandashenyou@gmail.com"; github = "Kho-Dialga"; @@ -9196,6 +9282,12 @@ fingerprint = "74F5 E5CC 19D3 B5CB 608F 6124 68FF 81E6 A785 0F49"; }]; }; + liyangau = { + email = "d@aufomm.com"; + github = "liyangau"; + githubId = 71299093; + name = "Li Yang"; + }; lizelive = { email = "nixpkgs@lize.live"; github = "lizelive"; @@ -9283,6 +9375,12 @@ githubId = 5624721; name = "Ben Wolsieffer"; }; + lord-valen = { + name = "Lord Valen"; + matrix = "@lord-valen:matrix.org"; + github = "Lord-Valen"; + githubId = 46138807; + }; lorenz = { name = "Lorenz Brun"; email = "lorenz@brun.one"; @@ -9390,6 +9488,12 @@ githubId = 59375051; name = "Lucas Ransan"; }; + LucaGuerra = { + email = "luca@guerra.sh"; + github = "LucaGuerra"; + githubId = 35580196; + name = "Luca Guerra"; + }; lucasew = { email = "lucas59356@gmail.com"; github = "lucasew"; @@ -9469,6 +9573,12 @@ fingerprint = "97A0 AE5E 03F3 499B 7D7A 65C6 76A4 1432 37EF 5817"; }]; }; + lukaswrz = { + email = "lukas@wrz.one"; + github = "lukaswrz"; + githubId = 84395723; + name = "Lukas Wurzinger"; + }; lukeadams = { email = "luke.adams@belljar.io"; github = "lukeadams"; @@ -10372,6 +10482,12 @@ github = "michaelBelsanti"; githubId = 62124625; }; + michaelCTS = { + email = "michael.vogel@cts.co"; + name = "Michael Vogel"; + github = "michaelCTS"; + githubId = 132582212; + }; michaelgrahamevans = { email = "michaelgrahamevans@gmail.com"; name = "Michael Evans"; @@ -10769,6 +10885,12 @@ fingerprint = "6460 4147 C434 F65E C306 A21F 135E EDD0 F719 34F3"; }]; }; + moody = { + email = "moody@posixcafe.org"; + github = "majiru"; + githubId = 3579600; + name = "Jacob Moody"; + }; moosingin3space = { email = "moosingin3space@gmail.com"; github = "moosingin3space"; @@ -11758,7 +11880,7 @@ name = "Kartik Gokte"; }; nullishamy = { - email = "amy.codes@null.net"; + email = "spam@amyerskine.me"; name = "nullishamy"; github = "nullishamy"; githubId = 99221043; @@ -11956,6 +12078,15 @@ github = "jackyliu16"; githubId = 50787361; }; + onemoresuza = { + name = "Coutinho de Souza"; + email = "dev@onemoresuza.mailer.me"; + github = "onemoresuza"; + githubId = 106456302; + keys = [{ + fingerprint = "484F D3B8 BAD7 BF5D 8B68 2AEA A2ED 1159 935E 4D7E"; + }]; + }; onixie = { email = "onixie@gmail.com"; github = "onixie"; @@ -12520,6 +12651,12 @@ githubId = 421510; name = "Noé Rubinstein"; }; + pho = { + email = "phofin@gmail.com"; + github = "pho"; + githubId = 88469; + name = "Jaime Breva"; + }; photex = { email = "photex@gmail.com"; github = "photex"; @@ -13581,7 +13718,7 @@ name = "Riley Inman"; }; riotbib = { - email = "github-nix@lnrt.de"; + email = "lennart@cope.cool"; github = "riotbib"; githubId = 43172581; name = "Lennart Mühlenmeier"; @@ -13964,6 +14101,15 @@ githubId = 889991; name = "Ryan Artecona"; }; + ryane = { + email = "ryanesc@gmail.com"; + github = "ryane"; + githubId = 7346; + name = "Ryan Eschinger"; + keys = [{ + fingerprint = "E4F4 1EAB BF0F C785 06D8 62EF EF68 CF41 D42A 593D"; + }]; + }; ryanorendorff = { github = "ryanorendorff"; githubId = 12442942; @@ -14440,6 +14586,12 @@ fingerprint = "A317 37B3 693C 921B 480C C629 4A2A AAA3 82F8 294C"; }]; }; + sestrella = { + email = "sestrella.me@gmail.com"; + github = "sestrella"; + githubId = 2049686; + name = "Sebastián Estrella"; + }; seylerius = { name = "Sable Seyler"; email = "sable@seyleri.us"; @@ -14664,6 +14816,12 @@ githubId = 16090; name = "Yann Hodique"; }; + sigmanificient = { + email = "sigmanificient@gmail.com"; + github = "Sigmanificient"; + githubId = 53050011; + name = "Yohann Boniface"; + }; sikmir = { email = "sikmir@disroot.org"; github = "sikmir"; @@ -16501,6 +16659,15 @@ fingerprint = "EE59 5E29 BB5B F2B3 5ED2 3F1C D276 FF74 6700 7335"; }]; }; + undefined-moe = { + name = "undefined"; + email = "i@undefined.moe"; + github = "undefined-moe"; + githubId = 29992205; + keys = [{ + fingerprint = "6684 4E7D D213 C75D 8828 6215 C714 A58B 6C1E 0F52"; + }]; + }; unhammer = { email = "unhammer@fsfe.org"; github = "unhammer"; @@ -16741,6 +16908,12 @@ github = "vdot0x23"; githubId = 40716069; }; + vector1dev = { + name = "vector1dev"; + matrix = "@vector1dev:vector1.dev"; + github = "vector1dev"; + githubId = 127302590; + }; veehaitch = { name = "Vincent Haupert"; email = "mail@vincent-haupert.de"; @@ -17024,6 +17197,16 @@ github = "wdavidw"; githubId = 46896; }; + weathercold = { + name = "Weathercold"; + email = "weathercold.scr@gmail.com"; + matrix = "@weathercold:matrix.org"; + github = "Weathercold"; + githubId = 49368953; + keys = [{ + fingerprint = "D20F C904 A145 8B28 53D8 FBA0 0422 0096 01E4 87FC"; + }]; + }; wegank = { name = "Weijia Wang"; email = "contact@weijia.wang"; @@ -17802,6 +17985,12 @@ githubId = 2189609; name = "Zhaofeng Li"; }; + zi3m5f = { + name = "zi3m5f"; + email = "k7n3o3a6f@mozmail.com"; + github = "zi3m5f"; + githubId = 113244000; + }; ziguana = { name = "Zig Uana"; email = "git@ziguana.dev"; diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix index dd4f88a298ec5..6e699d3398609 100644 --- a/maintainers/team-list.nix +++ b/maintainers/team-list.nix @@ -272,6 +272,14 @@ with lib.maintainers; { enableFeatureFreezePing = true; }; + flutter = { + members = [ gilice mkg20001 RossComputerGuy FlafyDev hacker1024 ]; + scope = "Maintain Flutter and Dart-related packages and build tools"; + shortName = "flutter"; + enableFeatureFreezePing = false; + githubTeams = [ "flutter" ]; + }; + freedesktop = { members = [ jtojnar ]; scope = "Maintain Freedesktop.org packages for graphical desktop."; @@ -538,7 +546,6 @@ with lib.maintainers; { ma27 fadenb mguentner - ekleog ralith dandellion sumnerevans diff --git a/nixos/doc/manual/configuration/customizing-packages.section.md b/nixos/doc/manual/configuration/customizing-packages.section.md index bceeeb2d7a16a..709a07b09cead 100644 --- a/nixos/doc/manual/configuration/customizing-packages.section.md +++ b/nixos/doc/manual/configuration/customizing-packages.section.md @@ -12,6 +12,29 @@ Unfortunately, Nixpkgs currently lacks a way to query available configuration options. ::: +::: {.note} +Alternatively, many packages come with extensions one might add. +Examples include: +- [`passExtensions.pass-otp`](https://search.nixos.org/packages/query=passExtensions.pass-otp) +- [`python310Packages.requests`](https://search.nixos.org/packages/query=python310Packages.requests) + +You can use them like this: +```nix +environment.systemPackages = with pkgs; [ + sl + (pass.withExtensions (subpkgs: with subpkgs; [ + pass-audit + pass-otp + pass-genphrase + ])) + (python3.withPackages (subpkgs: with subpkgs; [ + requests + ])) + cowsay +]; +``` +::: + Apart from high-level options, it's possible to tweak a package in almost arbitrary ways, such as changing or disabling dependencies of a package. For instance, the Emacs package in Nixpkgs by default has a diff --git a/nixos/doc/manual/default.nix b/nixos/doc/manual/default.nix index 68132f302e42d..3052b353ee775 100644 --- a/nixos/doc/manual/default.nix +++ b/nixos/doc/manual/default.nix @@ -267,19 +267,41 @@ in rec { manualEpub = runCommand "nixos-manual-epub" { nativeBuildInputs = [ buildPackages.libxml2.bin buildPackages.libxslt.bin buildPackages.zip ]; + doc = '' + + + NixOS Manual + Version ${lib.version} + + + Temporarily unavailable + + The NixOS manual is currently not available in EPUB format, + please use the HTML manual + instead. + + + If you've used the EPUB manual in the past and it has been useful to you, please + let us know. + + + + ''; + passAsFile = [ "doc" ]; } '' # Generate the epub manual. dst=$out/share/doc/nixos xsltproc \ - ${manualXsltprocOptions} \ + --param chapter.autolabel 0 \ --nonet --xinclude --output $dst/epub/ \ ${docbook_xsl_ns}/xml/xsl/docbook/epub/docbook.xsl \ - ${manual-combined}/manual-combined.xml + $docPath - mkdir -p $dst/epub/OEBPS/images/callouts - cp -r ${docbook_xsl_ns}/xml/xsl/docbook/images/callouts/*.svg $dst/epub/OEBPS/images/callouts # */ echo "application/epub+zip" > mimetype manual="$dst/nixos-manual.epub" zip -0Xq "$manual" mimetype diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md index ca658ad9a592f..4d45463adea45 100644 --- a/nixos/doc/manual/release-notes/rl-2305.section.md +++ b/nixos/doc/manual/release-notes/rl-2305.section.md @@ -42,6 +42,9 @@ In addition to numerous new and updated packages, this release has the following - [KDE Plasma](https://kde.org/de/plasma-desktop/) has been updated to version 5.27, see [the release notes](https://kde.org/announcements/plasma/5/5.27.0/) for what was changed. +- `openra` was updated to `20230225`. Due to large scope of the update, currently only `openraPackages.engines.release` and `openraPackages.engines.latest` packages are available. + If you want to use the old engine versions or mods, they were moved to the `openraPackages_2019` namespace. + ## New Services {#sec-release-23.05-new-services} - [Akkoma](https://akkoma.social), an ActivityPub microblogging server. Available as [services.akkoma](options.html#opt-services.akkoma.enable). @@ -198,7 +201,7 @@ In addition to numerous new and updated packages, this release has the following - `graylog` has been updated to version 5, which can not be updated directly from the previously packaged version 3.3. If you had installed the previously packaged version 3.3, please follow the [upgrade path](https://go2docs.graylog.org/5-0/upgrading_graylog/upgrade_path.htm) from 3.3 to 4.0 to 4.3 to 5.0. -- `buildFHSUserEnv` is now called `buildFHSEnv` and uses FlatPak's Bubblewrap sandboxing tool rather than Nixpkgs' own chrootenv. The old chrootenv-based implemenation is still available via `buildFHSEnvChrootenv` but is considered deprecated and will be removed when the remaining uses inside Nixpkgs have been migrated. If your FHSEnv-wrapped application misbehaves when using the new bubblewrap implementation, please create an issue in Nixpkgs. +- `buildFHSUserEnv` is now called `buildFHSEnv` and uses FlatPak's Bubblewrap sandboxing tool rather than Nixpkgs' own chrootenv. The old chrootenv-based implemenation is still available via `buildFHSEnvChroot` but is considered deprecated and will be removed when the remaining uses inside Nixpkgs have been migrated. If your FHSEnv-wrapped application misbehaves when using the new bubblewrap implementation, please create an issue in Nixpkgs. - `nushell` has been updated to at least version 0.77.0, which includes potential breaking changes in aliases. The old aliases are now available as `old-alias` but it is recommended you migrate to the new format. See [Reworked aliases](https://www.nushell.sh/blog/2023-03-14-nushell_0_77.html#reworked-aliases-breaking-changes-kubouch). @@ -522,7 +525,7 @@ In addition to numerous new and updated packages, this release has the following - The new option `services.tailscale.useRoutingFeatures` controls various settings for using Tailscale features like exit nodes and subnet routers. If you wish to use your machine as an exit node, you can set this setting to `server`, otherwise if you wish to use an exit node you can set this setting to `client`. The strict RPF warning has been removed as the RPF will be loosened automatically based on the value of this setting. -- `openjdk` from versioggn 11 and above is not build with `openjfx` (i.e.: JavaFX) support by default anymore. You can re-enable it by overriding, e.g.: `openjdk11.override { enableJavaFX = true; };`. +- `openjdk` from version 11 and above is not build with `openjfx` (i.e.: JavaFX) support by default anymore. You can re-enable it by overriding, e.g.: `openjdk11.override { enableJavaFX = true; };`. - [Xastir](https://xastir.org/index.php/Main_Page) can now access AX.25 interfaces via the `libax25` package. @@ -550,7 +553,7 @@ In addition to numerous new and updated packages, this release has the following - `buildDunePackage` now defaults to `strictDeps = true` which means that any library should go into `buildInputs` or `checkInputs`. Any executable that is run on the building machine should go into `nativeBuildInputs` or `nativeCheckInputs` respectively. Example of executables are `ocaml`, `findlib` and `menhir`. PPXs are libraries which are built by dune and should therefore not go into `nativeBuildInputs`. -- `buildFHSUserEnv` is now called `buildFHSEnv` and uses FlatPak's Bubblewrap sandboxing tool rather than Nixpkgs' own chrootenv. The old chrootenv-based implemenation is still available via `buildFHSEnvChrootenv` but is considered deprecated and will be removed when the remaining uses inside Nixpkgs have been migrated. If your FHSEnv-wrapped application misbehaves when using the new bubblewrap implementation, please create an issue in Nixpkgs. +- `buildFHSUserEnv` is now called `buildFHSEnv` and uses FlatPak's Bubblewrap sandboxing tool rather than Nixpkgs' own chrootenv. The old chrootenv-based implemenation is still available via `buildFHSEnvChroot` but is considered deprecated and will be removed when the remaining uses inside Nixpkgs have been migrated. If your FHSEnv-wrapped application misbehaves when using the new bubblewrap implementation, please create an issue in Nixpkgs. - Top-level `buildPlatform`, `hostPlatform`, `targetPlatform` have been deprecated, use `stdenv.X` instead. diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md index 08c316a123c4d..caafc49b9ec10 100644 --- a/nixos/doc/manual/release-notes/rl-2311.section.md +++ b/nixos/doc/manual/release-notes/rl-2311.section.md @@ -14,6 +14,8 @@ - [river](https://github.com/riverwm/river), A dynamic tiling wayland compositor. Available as [programs.river](#opt-programs.river.enable). +- [GoToSocial](https://gotosocial.org/), an ActivityPub social network server, written in Golang. Available as [services.gotosocial](#opt-services.gotosocial.enable). + - [sitespeed-io](https://sitespeed.io), a tool that can generate metrics (timings, diagnostics) for websites. Available as [services.sitespeed-io](#opt-services.sitespeed-io.enable). ## Backward Incompatibilities {#sec-release-23.11-incompatibilities} @@ -24,18 +26,50 @@ - `python3.pkgs.fetchPypi` (and `python3Packages.fetchPypi`) has been deprecated in favor of top-level `fetchPypi`. +- `mariadb` now defaults to `mariadb_1011` instead of `mariadb_106`, meaning the default version was upgraded from 10.6.x to 10.11.x. See the [upgrade notes](https://mariadb.com/kb/en/upgrading-from-mariadb-10-6-to-mariadb-10-11/) for potential issues. + +- `getent` has been moved from `glibc`'s `bin` output to its own dedicated output, reducing closure size for many dependents. Dependents using the `getent` alias should not be affected; others should move from using `glibc.bin` or `getBin glibc` to `getent` (which also improves compatibility with non-glibc platforms). + - `etcd` has been updated to 3.5, you will want to read the [3.3 to 3.4](https://etcd.io/docs/v3.5/upgrades/upgrade_3_4/) and [3.4 to 3.5](https://etcd.io/docs/v3.5/upgrades/upgrade_3_5/) upgrade guides +- `himalaya` has been updated to `0.8.0`, which drops the native TLS support (in favor of Rustls) and add OAuth 2.0 support. See the [release note](https://github.com/soywod/himalaya/releases/tag/v0.8.0) for more details. + +- The [services.caddy.acmeCA](#opt-services.caddy.acmeCA) option now defaults to `null` instead of `"https://acme-v02.api.letsencrypt.org/directory"`, to use all of Caddy's default ACME CAs and enable Caddy's automatic issuer fallback feature by default, as recommended by upstream. + - `util-linux` is now supported on Darwin and is no longer an alias to `unixtools`. Use the `unixtools.util-linux` package for access to the Apple variants of the utilities. +- The `vlock` program from the `kbd` package has been moved into its own package output and should now be referenced explicitly as `kbd.vlock` or replaced with an alternative such as the standalone `vlock` package or `physlock`. + - `fileSystems..autoFormat` now uses `systemd-makefs`, which does not accept formatting options. Therefore, `fileSystems..formatOptions` has been removed. - `fileSystems..autoResize` now uses `systemd-growfs` to resize the file system online in stage 2. This means that `f2fs` and `ext2` can no longer be auto resized, while `xfs` and `btrfs` now can be. +- `services.lemmy.settings.federation` was removed in 0.17.0 and no longer has any effect. To enable federation, the hostname must be set in the configuration file and then federation must be enabled in the admin web UI. See the [release notes](https://github.com/LemmyNet/lemmy/blob/c32585b03429f0f76d1e4ff738786321a0a9df98/RELEASES.md#upgrade-instructions) for more details. + ## Other Notable Changes {#sec-release-23.11-notable-changes} - The Cinnamon module now enables XDG desktop integration by default. If you are experiencing collisions related to xdg-desktop-portal-gtk you can safely remove `xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];` from your NixOS configuration. +- The latest available version of Nextcloud is v27 (available as `pkgs.nextcloud27`). The installation logic is as follows: + - If [`services.nextcloud.package`](#opt-services.nextcloud.package) is specified explicitly, this package will be installed (**recommended**) + - If [`system.stateVersion`](#opt-system.stateVersion) is >=23.11, `pkgs.nextcloud27` will be installed by default. + - If [`system.stateVersion`](#opt-system.stateVersion) is >=23.05, `pkgs.nextcloud26` will be installed by default. + - Please note that an upgrade from v25 (or older) to v27 directly is not possible. Please upgrade to `nextcloud26` (or earlier) first. Nextcloud prohibits skipping major versions while upgrading. You can upgrade by declaring [`services.nextcloud.package = pkgs.nextcloud26;`](options.html#opt-services.nextcloud.package). + - A new option was added to the virtualisation module that enables specifying explicitly named network interfaces in QEMU VMs. The existing `virtualisation.vlans` is still supported for cases where the name of the network interface is irrelevant. - `services.nginx` gained a `defaultListen` option at server-level with support for PROXY protocol listeners, also `proxyProtocol` is now exposed in `services.nginx.virtualHosts..listen` option. It is now possible to run PROXY listeners and non-PROXY listeners at a server-level, see [#213510](https://github.com/NixOS/nixpkgs/pull/213510/) for more details. + +## Nixpkgs internals {#sec-release-23.11-nixpkgs-internals} + +- The `qemu-vm.nix` module by default now identifies block devices via + persistent names available in `/dev/disk/by-*`. Because the rootDevice is + identfied by its filesystem label, it needs to be formatted before the VM is + started. The functionality of automatically formatting the rootDevice in the + initrd is removed from the QEMU module. However, for tests that depend on + this functionality, a test utility for the scripted initrd is added + (`nixos/tests/common/auto-format-root-device.nix`). To use this in a NixOS + test, import the module, e.g. `imports = [ + ./common/auto-format-root-device.nix ];` When you use the systemd initrd, you + can automatically format the root device by setting + `virtualisation.fileSystems."/".autoFormat = true;`. diff --git a/nixos/lib/make-disk-image.nix b/nixos/lib/make-disk-image.nix index 33d834e36b44e..fc121345d6b10 100644 --- a/nixos/lib/make-disk-image.nix +++ b/nixos/lib/make-disk-image.nix @@ -573,6 +573,7 @@ let format' = format; in let # In this throwaway resource, we only have /dev/vda, but the actual VM may refer to another disk for bootloader, e.g. /dev/vdb # Use this option to create a symlink from vda to any arbitrary device you want. ${optionalString (config.boot.loader.grub.device != "/dev/vda") '' + mkdir -p $(dirname ${config.boot.loader.grub.device}) ln -s /dev/vda ${config.boot.loader.grub.device} ''} diff --git a/nixos/lib/test-driver/test_driver/machine.py b/nixos/lib/test-driver/test_driver/machine.py index 1d1d5bef9bf4e..7ef0ae89910b0 100644 --- a/nixos/lib/test-driver/test_driver/machine.py +++ b/nixos/lib/test-driver/test_driver/machine.py @@ -514,7 +514,11 @@ def _next_newline_closed_block_from_shell(self) -> str: return "".join(output_buffer) def execute( - self, command: str, check_return: bool = True, timeout: Optional[int] = 900 + self, + command: str, + check_return: bool = True, + check_output: bool = True, + timeout: Optional[int] = 900, ) -> Tuple[int, str]: self.run_callbacks() self.connect() @@ -535,6 +539,9 @@ def execute( assert self.shell self.shell.send(out_command.encode()) + if not check_output: + return (-2, "") + # Get the output output = base64.b64decode(self._next_newline_closed_block_from_shell()) @@ -641,7 +648,7 @@ def check_failure(_: Any) -> bool: return status != 0 with self.nested(f"waiting for failure: {command}"): - retry(check_failure) + retry(check_failure, timeout) return output def wait_for_shutdown(self) -> None: @@ -868,7 +875,7 @@ def wait_for_console_text(self, regex: str, timeout: int | None = None) -> None: # to match multiline regexes. console = io.StringIO() - def console_matches() -> bool: + def console_matches(_: Any) -> bool: nonlocal console try: # This will return as soon as possible and @@ -884,7 +891,7 @@ def console_matches() -> bool: if timeout is not None: retry(console_matches, timeout) else: - while not console_matches(): + while not console_matches(False): pass def send_key( diff --git a/nixos/maintainers/scripts/ec2/amazon-image.nix b/nixos/maintainers/scripts/ec2/amazon-image.nix index 490a79e0b66c1..d12339bca1f8f 100644 --- a/nixos/maintainers/scripts/ec2/amazon-image.nix +++ b/nixos/maintainers/scripts/ec2/amazon-image.nix @@ -43,7 +43,7 @@ in { sizeMB = mkOption { type = with types; either (enum [ "auto" ]) int; - default = 2048; + default = 3072; example = 8192; description = lib.mdDoc "The size in MB of the image"; }; diff --git a/nixos/modules/config/fonts/fontconfig.nix b/nixos/modules/config/fonts/fontconfig.nix index 5781679241eff..2eee5cd34d063 100644 --- a/nixos/modules/config/fonts/fontconfig.nix +++ b/nixos/modules/config/fonts/fontconfig.nix @@ -77,18 +77,6 @@ let ${fcBool cfg.hinting.autohint} - - ${cfg.hinting.style} - - - ${fcBool cfg.antialias} - - - ${cfg.subpixel.rgba} - - - lcd${cfg.subpixel.lcdfilter} - @@ -177,6 +165,13 @@ let ''; + # Replace default linked config with a different variant + replaceDefaultConfig = defaultConfig: newConfig: '' + rm $dst/${defaultConfig} + ln -s ${pkg.out}/share/fontconfig/conf.avail/${newConfig} \ + $dst/ + ''; + # fontconfig configuration package confPkg = pkgs.runCommand "fontconfig-conf" { preferLocalBuild = true; @@ -196,6 +191,26 @@ let ln -s ${pkg.out}/etc/fonts/conf.d/*.conf \ $dst/ + ${optionalString (!cfg.antialias) + (replaceDefaultConfig "10-yes-antialias.conf" + "10-no-antialias.conf") + } + + ${optionalString (cfg.hinting.style != "slight") + (replaceDefaultConfig "10-hinting-slight.conf" + "10-hinting-${cfg.hinting.style}.conf") + } + + ${optionalString (cfg.subpixel.rgba != "none") + (replaceDefaultConfig "10-sub-pixel-none.conf" + "10-sub-pixel-${cfg.subpixel.rgba}.conf") + } + + ${optionalString (cfg.subpixel.lcdfilter != "default") + (replaceDefaultConfig "11-lcdfilter-default.conf" + "11-lcdfilter-${cfg.subpixel.lcdfilter}.conf") + } + # 00-nixos-cache.conf ln -s ${cacheConf} $dst/00-nixos-cache.conf @@ -367,17 +382,25 @@ in }; style = mkOption { - type = types.enum [ "hintnone" "hintslight" "hintmedium" "hintfull" ]; - default = "hintslight"; + type = types.enum ["none" "slight" "medium" "full"]; + default = "slight"; description = lib.mdDoc '' Hintstyle is the amount of font reshaping done to line up to the grid. - hintslight will make the font more fuzzy to line up to the grid - but will be better in retaining font shape, while hintfull will - be a crisp font that aligns well to the pixel grid but will lose - a greater amount of font shape. + slight will make the font more fuzzy to line up to the grid but + will be better in retaining font shape, while full will be a + crisp font that aligns well to the pixel grid but will lose a + greater amount of font shape. ''; + apply = + val: + let + from = "fonts.fontconfig.hinting.style"; + val' = lib.removePrefix "hint" val; + warning = "The option `${from}` contains a deprecated value `${val}`. Use `${val'}` instead."; + in + lib.warnIf (lib.hasPrefix "hint" val) warning val'; }; }; @@ -394,7 +417,7 @@ in subpixel = { rgba = mkOption { - default = "rgb"; + default = "none"; type = types.enum ["rgb" "bgr" "vrgb" "vbgr" "none"]; description = lib.mdDoc '' Subpixel order. The overwhelming majority of displays are diff --git a/nixos/modules/config/no-x-libs.nix b/nixos/modules/config/no-x-libs.nix index 0dce3b918458a..676d2abda08f1 100644 --- a/nixos/modules/config/no-x-libs.nix +++ b/nixos/modules/config/no-x-libs.nix @@ -39,7 +39,8 @@ with lib; graphviz = super.graphviz-nox; gst_all_1 = super.gst_all_1 // { gst-plugins-bad = super.gst_all_1.gst-plugins-bad.override { guiSupport = false; }; - gst-plugins-base = super.gst_all_1.gst-plugins-base.override { enableX11 = false; }; + gst-plugins-base = super.gst_all_1.gst-plugins-base.override { enableWayland = false; enableX11 = false; }; + gst-plugins-good = super.gst_all_1.gst-plugins-good.override { enableX11 = false; }; }; imagemagick = super.imagemagick.override { libX11Support = false; libXtSupport = false; }; imagemagickBig = super.imagemagickBig.override { libX11Support = false; libXtSupport = false; }; diff --git a/nixos/modules/config/qt.nix b/nixos/modules/config/qt.nix index 6405166920e02..cf4e9621d70dd 100644 --- a/nixos/modules/config/qt.nix +++ b/nixos/modules/config/qt.nix @@ -20,7 +20,7 @@ let pkgs.adwaita-qt6 ] else if isQtStyle then [ pkgs.libsForQt5.qtstyleplugins ] - else if isQt5ct then [ pkgs.libsForQt5.qt5ct ] + else if isQt5ct then [ pkgs.libsForQt5.qt5ct pkgs.qt6Packages.qt6ct ] else if isLxqt then [ pkgs.lxqt.lxqt-qtplugin pkgs.lxqt.lxqt-config ] else if isKde then [ pkgs.libsForQt5.plasma-integration pkgs.libsForQt5.systemsettings ] else throw "`qt.platformTheme` ${cfg.platformTheme} and `qt.style` ${cfg.style} are not compatible."; diff --git a/nixos/modules/config/users-groups.nix b/nixos/modules/config/users-groups.nix index d1e9c8072eac4..4640a0f3d6bef 100644 --- a/nixos/modules/config/users-groups.nix +++ b/nixos/modules/config/users-groups.nix @@ -652,7 +652,7 @@ in { deps = [ "users" ]; text = '' users=() - while IFS=: read -r user hash tail; do + while IFS=: read -r user hash _; do if [[ "$hash" = "$"* && ! "$hash" =~ ^\''$${cryptSchemeIdPatternGroup}\$ ]]; then users+=("$user") fi diff --git a/nixos/modules/hardware/i2c.nix b/nixos/modules/hardware/i2c.nix index c0423cc5d997b..9a5a2e44813ed 100644 --- a/nixos/modules/hardware/i2c.nix +++ b/nixos/modules/hardware/i2c.nix @@ -1,4 +1,4 @@ -{ config, lib, ... }: +{ config, lib, pkgs, ... }: with lib; @@ -31,10 +31,14 @@ in i2c = { }; }; - services.udev.extraRules = '' - # allow group ${cfg.group} and users with a seat use of i2c devices - ACTION=="add", KERNEL=="i2c-[0-9]*", TAG+="uaccess", GROUP="${cfg.group}", MODE="660" - ''; + services.udev.packages = lib.singleton (pkgs.writeTextFile + { name = "i2c-udev-rules"; + text = '' + # allow group ${cfg.group} and users with a seat use of i2c devices + ACTION=="add", KERNEL=="i2c-[0-9]*", TAG+="uaccess", GROUP="${cfg.group}", MODE="660" + ''; + destination = "/etc/udev/rules.d/70-i2c.rules"; + }); }; diff --git a/nixos/modules/installer/tools/nix-fallback-paths.nix b/nixos/modules/installer/tools/nix-fallback-paths.nix index 1058a34133b14..582334a5aeaf5 100644 --- a/nixos/modules/installer/tools/nix-fallback-paths.nix +++ b/nixos/modules/installer/tools/nix-fallback-paths.nix @@ -1,7 +1,7 @@ { - x86_64-linux = "/nix/store/mc43d38fibi94pp5crfwacl5gbslccd0-nix-2.13.3"; - i686-linux = "/nix/store/09m966pj26cgd4ihlg8ihl1106j3vih8-nix-2.13.3"; - aarch64-linux = "/nix/store/7f191d125akld27gc6jl0r13l8pl7x0h-nix-2.13.3"; - x86_64-darwin = "/nix/store/1wn9jkvi2zqfjnjgg7lnp30r2q2y8whd-nix-2.13.3"; - aarch64-darwin = "/nix/store/8w0v2mffa10chrf1h66cbvbpw86qmh85-nix-2.13.3"; + x86_64-linux = "/nix/store/ny9r65799s7xhp605bc2753sjvzkxrrs-nix-2.15.1"; + i686-linux = "/nix/store/ck55dz5klc7szi8rx9ghhm8gi2b5q5bw-nix-2.15.1"; + aarch64-linux = "/nix/store/cl0a02vr28913dgw98hrm45a4baqr3z1-nix-2.15.1"; + x86_64-darwin = "/nix/store/wq228jdbz16pp2lnxf32n8dv27pw53p8-nix-2.15.1"; + aarch64-darwin = "/nix/store/x11cpsjg4q236msfz5scc325pfp9xy64-nix-2.15.1"; } diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl index c2a5ecbe9e2ea..2e572ef02473b 100644 --- a/nixos/modules/installer/tools/nixos-generate-config.pl +++ b/nixos/modules/installer/tools/nixos-generate-config.pl @@ -85,7 +85,7 @@ sub debug { # nixpkgs.system -push @attrs, "nixpkgs.hostPlatform = lib.mkDefault \"@system@\";"; +push @attrs, "nixpkgs.hostPlatform = lib.mkDefault \"@hostPlatformSystem@\";"; my $cpuinfo = read_file "/proc/cpuinfo"; diff --git a/nixos/modules/installer/tools/tools.nix b/nixos/modules/installer/tools/tools.nix index 5133ad18f4bb5..1e36d10b391f8 100644 --- a/nixos/modules/installer/tools/tools.nix +++ b/nixos/modules/installer/tools/tools.nix @@ -35,7 +35,7 @@ let name = "nixos-generate-config"; src = ./nixos-generate-config.pl; perl = "${pkgs.perl.withPackages (p: [ p.FileSlurp ])}/bin/perl"; - system = pkgs.stdenv.hostPlatform.system; + hostPlatformSystem = pkgs.stdenv.hostPlatform.system; detectvirt = "${config.systemd.package}/bin/systemd-detect-virt"; btrfs = "${pkgs.btrfs-progs}/bin/btrfs"; inherit (config.system.nixos-generate-config) configuration desktopConfiguration; diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 83b2a45dbd3b1..7eb8b9b71e916 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -328,6 +328,8 @@ ./services/audio/spotifyd.nix ./services/audio/squeezelite.nix ./services/audio/tts.nix + ./services/audio/wyoming/faster-whisper.nix + ./services/audio/wyoming/piper.nix ./services/audio/ympd.nix ./services/backup/automysqlbackup.nix ./services/backup/bacula.nix @@ -1188,6 +1190,7 @@ ./services/web-apps/galene.nix ./services/web-apps/gerrit.nix ./services/web-apps/gotify-server.nix + ./services/web-apps/gotosocial.nix ./services/web-apps/grocy.nix ./services/web-apps/pixelfed.nix ./services/web-apps/healthchecks.nix diff --git a/nixos/modules/programs/cfs-zen-tweaks.nix b/nixos/modules/programs/cfs-zen-tweaks.nix index 97c2570475c4d..fc05bcd11ecbb 100644 --- a/nixos/modules/programs/cfs-zen-tweaks.nix +++ b/nixos/modules/programs/cfs-zen-tweaks.nix @@ -23,6 +23,12 @@ in config = mkIf cfg.enable { systemd.packages = [ pkgs.cfs-zen-tweaks ]; - systemd.services.set-cfs-tweak.wantedBy = [ "multi-user.target" "suspend.target" "hibernate.target" "hybrid-sleep.target" "suspend-then-hibernate.target" ]; + systemd.services.set-cfs-tweaks.wantedBy = [ + "multi-user.target" + "suspend.target" + "hibernate.target" + "hybrid-sleep.target" + "suspend-then-hibernate.target" + ]; }; } diff --git a/nixos/modules/programs/nano.nix b/nixos/modules/programs/nano.nix index 16bab620d6e2a..7705bf0ddc72c 100644 --- a/nixos/modules/programs/nano.nix +++ b/nixos/modules/programs/nano.nix @@ -35,8 +35,17 @@ in ###### implementation config = lib.mkIf (cfg.nanorc != "" || cfg.syntaxHighlight) { - environment.etc.nanorc.text = lib.concatStrings [ cfg.nanorc - (lib.optionalString cfg.syntaxHighlight ''${LF}include "${pkgs.nano}/share/nano/*.nanorc"'') ]; + environment.etc.nanorc.text = lib.concatStringsSep LF ( + ( lib.optionals cfg.syntaxHighlight [ + "# The line below is added because value of programs.nano.syntaxHighlight is set to true" + ''include "${pkgs.nano}/share/nano/*.nanorc"'' + "" + ]) + ++ ( lib.optionals (cfg.nanorc != "") [ + "# The lines below have been set from value of programs.nano.nanorc" + cfg.nanorc + ]) + ); }; } diff --git a/nixos/modules/programs/nix-ld.nix b/nixos/modules/programs/nix-ld.nix index f0c265f0e5a31..d54b3917f89a8 100644 --- a/nixos/modules/programs/nix-ld.nix +++ b/nixos/modules/programs/nix-ld.nix @@ -2,15 +2,14 @@ let cfg = config.programs.nix-ld; - # TODO make glibc here configurable? - nix-ld-so = pkgs.runCommand "ld.so" {} '' - ln -s "$(cat '${pkgs.stdenv.cc}/nix-support/dynamic-linker')" $out - ''; - nix-ld-libraries = pkgs.buildEnv { name = "lb-library-path"; pathsToLink = [ "/lib" ]; paths = map lib.getLib cfg.libraries; + # TODO make glibc here configurable? + postBuild = '' + ln -s ${pkgs.stdenv.cc.bintools.dynamicLinker} $out/share/nix-ld/lib/ld.so + ''; extraPrefix = "/share/nix-ld"; ignoreCollisions = true; }; @@ -38,12 +37,7 @@ in meta.maintainers = [ lib.maintainers.mic92 ]; options.programs.nix-ld = { enable = lib.mkEnableOption (lib.mdDoc ''nix-ld, Documentation: ''); - package = lib.mkOption { - type = lib.types.package; - description = lib.mdDoc "Which package to use for the nix-ld."; - default = pkgs.nix-ld; - defaultText = lib.literalExpression "pkgs.nix-ld"; - }; + package = lib.mkPackageOptionMD pkgs "nix-ld" { }; libraries = lib.mkOption { type = lib.types.listOf lib.types.package; description = lib.mdDoc "Libraries that automatically become available to all programs. The default set includes common libraries."; @@ -60,7 +54,7 @@ in environment.pathsToLink = [ "/share/nix-ld" ]; environment.variables = { - NIX_LD = toString nix-ld-so; + NIX_LD = "/run/current-system/sw/share/nix-ld/lib/ld.so"; NIX_LD_LIBRARY_PATH = "/run/current-system/sw/share/nix-ld/lib"; }; }; diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index eac67cfdec5a6..4172bc6fbe1e7 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -484,6 +484,9 @@ let optionalString cfg.mysqlAuth '' account sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf '' + + optionalString (config.services.kanidm.enablePam) '' + account sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user + '' + optionalString (config.services.sssd.enable && cfg.sssdStrictAccess==false) '' account sufficient ${pkgs.sssd}/lib/security/pam_sss.so '' + @@ -617,6 +620,9 @@ let optionalString use_ldap '' auth sufficient ${pam_ldap}/lib/security/pam_ldap.so use_first_pass '' + + optionalString config.services.kanidm.enablePam '' + auth sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user use_first_pass + '' + optionalString config.services.sssd.enable '' auth sufficient ${pkgs.sssd}/lib/security/pam_sss.so use_first_pass '' + @@ -653,6 +659,9 @@ let optionalString cfg.mysqlAuth '' password sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf '' + + optionalString config.services.kanidm.enablePam '' + password sufficient ${pkgs.kanidm}/lib/pam_kanidm.so + '' + optionalString config.services.sssd.enable '' password sufficient ${pkgs.sssd}/lib/security/pam_sss.so '' + @@ -714,6 +723,9 @@ let optionalString cfg.mysqlAuth '' session optional ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf '' + + optionalString config.services.kanidm.enablePam '' + session optional ${pkgs.kanidm}/lib/pam_kanidm.so + '' + optionalString config.services.sssd.enable '' session optional ${pkgs.sssd}/lib/security/pam_sss.so '' + @@ -1298,6 +1310,7 @@ in # Include the PAM modules in the system path mostly for the manpages. [ pkgs.pam ] ++ optional config.users.ldap.enable pam_ldap + ++ optional config.services.kanidm.enablePam pkgs.kanidm ++ optional config.services.sssd.enable pkgs.sssd ++ optionals config.security.pam.krb5.enable [pam_krb5 pam_ccreds] ++ optionals config.security.pam.enableOTPW [ pkgs.otpw ] @@ -1364,6 +1377,9 @@ in optionalString use_ldap '' mr ${pam_ldap}/lib/security/pam_ldap.so, '' + + optionalString config.services.kanidm.enablePam '' + mr ${pkgs.kanidm}/lib/pam_kanidm.so, + '' + optionalString config.services.sssd.enable '' mr ${pkgs.sssd}/lib/security/pam_sss.so, '' + diff --git a/nixos/modules/services/audio/wyoming/faster-whisper.nix b/nixos/modules/services/audio/wyoming/faster-whisper.nix new file mode 100644 index 0000000000000..6317709b24750 --- /dev/null +++ b/nixos/modules/services/audio/wyoming/faster-whisper.nix @@ -0,0 +1,186 @@ +{ config +, lib +, pkgs +, ... +}: + +let + cfg = config.services.wyoming.faster-whisper; + + inherit (lib) + escapeShellArgs + mkOption + mdDoc + mkEnableOption + mkPackageOptionMD + types + ; + + inherit (builtins) + toString + ; + +in + +{ + options.services.wyoming.faster-whisper = with types; { + package = mkPackageOptionMD pkgs "wyoming-faster-whisper" { }; + + servers = mkOption { + default = {}; + description = mdDoc '' + Attribute set of faster-whisper instances to spawn. + ''; + type = types.attrsOf (types.submodule ( + { ... }: { + options = { + enable = mkEnableOption (mdDoc "Wyoming faster-whisper server"); + + model = mkOption { + type = enum [ + "tiny" + "tiny-int8" + "base" + "base-int8" + "small" + "small-int8" + "medium" + "medium-int8" + ]; + default = "tiny-int8"; + example = "medium-int8"; + description = mdDoc '' + Name of the voice model to use. + ''; + }; + + uri = mkOption { + type = strMatching "^(tcp|unix)://.*$"; + example = "tcp://0.0.0.0:10300"; + description = mdDoc '' + URI to bind the wyoming server to. + ''; + }; + + device = mkOption { + # https://opennmt.net/CTranslate2/python/ctranslate2.models.Whisper.html# + type = types.enum [ + "cpu" + "cuda" + "auto" + ]; + default = "cpu"; + description = mdDoc '' + Id of a speaker in a multi-speaker model. + ''; + }; + + language = mkOption { + type = enum [ + # https://github.com/home-assistant/addons/blob/master/whisper/config.yaml#L20 + "auto" "af" "am" "ar" "as" "az" "ba" "be" "bg" "bn" "bo" "br" "bs" "ca" "cs" "cy" "da" "de" "el" "en" "es" "et" "eu" "fa" "fi" "fo" "fr" "gl" "gu" "ha" "haw" "he" "hi" "hr" "ht" "hu" "hy" "id" "is" "it" "ja" "jw" "ka" "kk" "km" "kn" "ko" "la" "lb" "ln" "lo" "lt" "lv" "mg" "mi" "mk" "ml" "mn" "mr" "ms" "mt" "my" "ne" "nl" "nn" "no" "oc" "pa" "pl" "ps" "pt" "ro" "ru" "sa" "sd" "si" "sk" "sl" "sn" "so" "sq" "sr" "su" "sv" "sw" "ta" "te" "tg" "th" "tk" "tl" "tr" "tt" "uk" "ur" "uz" "vi" "yi" "yo" "zh" + ]; + example = "en"; + description = mdDoc '' + The language used to to parse words and sentences. + ''; + }; + + beamSize = mkOption { + type = ints.unsigned; + default = 1; + example = 5; + description = mdDoc '' + The number of beams to use in beam search. + ''; + apply = toString; + }; + + extraArgs = mkOption { + type = listOf str; + default = [ ]; + description = mdDoc '' + Extra arguments to pass to the server commandline. + ''; + apply = escapeShellArgs; + }; + }; + } + )); + }; + }; + + config = let + inherit (lib) + mapAttrs' + mkIf + nameValuePair + ; + in mkIf (cfg.servers != {}) { + systemd.services = mapAttrs' (server: options: + nameValuePair "wyoming-faster-whisper-${server}" { + description = "Wyoming faster-whisper server instance ${server}"; + after = [ + "network-online.target" + ]; + wantedBy = [ + "multi-user.target" + ]; + serviceConfig = { + DynamicUser = true; + User = "wyoming-faster-whisper"; + StateDirectory = "wyoming/faster-whisper"; + # https://github.com/home-assistant/addons/blob/master/whisper/rootfs/etc/s6-overlay/s6-rc.d/whisper/run + ExecStart = '' + ${cfg.package}/bin/wyoming-faster-whisper \ + --data-dir $STATE_DIRECTORY \ + --download-dir $STATE_DIRECTORY \ + --uri ${options.uri} \ + --model ${options.model} \ + --language ${options.language} \ + --beam-size ${options.beamSize} ${options.extraArgs} + ''; + CapabilityBoundingSet = ""; + DeviceAllow = if builtins.elem options.device [ "cuda" "auto" ] then [ + # https://docs.nvidia.com/dgx/pdf/dgx-os-5-user-guide.pdf + "/dev/nvidia1" + "/dev/nvidia2" + "/dev/nvidia3" + "/dev/nvidia4" + "/dev/nvidia-caps/nvidia-cap1" + "/dev/nvidia-caps/nvidia-cap2" + "/dev/nvidiactl" + "/dev/nvidia-modeset" + "/dev/nvidia-uvm" + "/dev/nvidia-uvm-tools" + ] else ""; + DevicePolicy = "closed"; + LockPersonality = true; + MemoryDenyWriteExecute = true; + PrivateDevices = true; + PrivateUsers = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectControlGroups = true; + ProtectProc = "invisible"; + ProcSubset = "pid"; + RestrictAddressFamilies = [ + "AF_INET" + "AF_INET6" + "AF_UNIX" + ]; + RestrictNamespaces = true; + RestrictRealtime = true; + SystemCallArchitectures = "native"; + SystemCallFilter = [ + "@system-service" + "~@privileged" + ]; + UMask = "0077"; + }; + }) cfg.servers; + }; +} diff --git a/nixos/modules/services/audio/wyoming/piper.nix b/nixos/modules/services/audio/wyoming/piper.nix new file mode 100644 index 0000000000000..ed50bd9f48e95 --- /dev/null +++ b/nixos/modules/services/audio/wyoming/piper.nix @@ -0,0 +1,174 @@ +{ config +, lib +, pkgs +, ... +}: + +let + cfg = config.services.wyoming.piper; + + inherit (lib) + escapeShellArgs + mkOption + mdDoc + mkEnableOption + mkPackageOptionMD + types + ; + + inherit (builtins) + toString + ; + +in + +{ + meta.buildDocsInSandbox = false; + + options.services.wyoming.piper = with types; { + package = mkPackageOptionMD pkgs "wyoming-piper" { }; + + servers = mkOption { + default = {}; + description = mdDoc '' + Attribute set of piper instances to spawn. + ''; + type = types.attrsOf (types.submodule ( + { ... }: { + options = { + enable = mkEnableOption (mdDoc "Wyoming Piper server"); + + piper = mkPackageOptionMD pkgs "piper-tts" { }; + + voice = mkOption { + type = str; + example = "en-us-ryan-medium"; + description = mdDoc '' + Name of the voice model to use. See the following website for samples: + https://rhasspy.github.io/piper-samples/ + ''; + }; + + uri = mkOption { + type = strMatching "^(tcp|unix)://.*$"; + example = "tcp://0.0.0.0:10200"; + description = mdDoc '' + URI to bind the wyoming server to. + ''; + }; + + speaker = mkOption { + type = ints.unsigned; + default = 0; + description = mdDoc '' + ID of a specific speaker in a multi-speaker model. + ''; + apply = toString; + }; + + noiseScale = mkOption { + type = float; + default = 0.667; + description = mdDoc '' + Generator noise value. + ''; + apply = toString; + }; + + noiseWidth = mkOption { + type = float; + default = 0.333; + description = mdDoc '' + Phoneme width noise value. + ''; + apply = toString; + }; + + lengthScale = mkOption { + type = float; + default = 1.0; + description = mdDoc '' + Phoneme length value. + ''; + apply = toString; + }; + + extraArgs = mkOption { + type = listOf str; + default = [ ]; + description = mdDoc '' + Extra arguments to pass to the server commandline. + ''; + apply = escapeShellArgs; + }; + }; + } + )); + }; + }; + + config = let + inherit (lib) + mapAttrs' + mkIf + nameValuePair + ; + in mkIf (cfg.servers != {}) { + systemd.services = mapAttrs' (server: options: + nameValuePair "wyoming-piper-${server}" { + description = "Wyoming Piper server instance ${server}"; + after = [ + "network-online.target" + ]; + wantedBy = [ + "multi-user.target" + ]; + serviceConfig = { + DynamicUser = true; + User = "wyoming-piper"; + StateDirectory = "wyoming/piper"; + # https://github.com/home-assistant/addons/blob/master/piper/rootfs/etc/s6-overlay/s6-rc.d/piper/run + ExecStart = '' + ${cfg.package}/bin/wyoming-piper \ + --data-dir $STATE_DIRECTORY \ + --download-dir $STATE_DIRECTORY \ + --uri ${options.uri} \ + --piper ${options.piper}/bin/piper \ + --voice ${options.voice} \ + --speaker ${options.speaker} \ + --length-scale ${options.lengthScale} \ + --noise-scale ${options.noiseScale} \ + --noise-w ${options.noiseWidth} ${options.extraArgs} + ''; + CapabilityBoundingSet = ""; + DeviceAllow = ""; + DevicePolicy = "closed"; + LockPersonality = true; + MemoryDenyWriteExecute = true; + PrivateDevices = true; + PrivateUsers = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectControlGroups = true; + ProtectProc = "invisible"; + ProcSubset = "pid"; + RestrictAddressFamilies = [ + "AF_INET" + "AF_INET6" + "AF_UNIX" + ]; + RestrictNamespaces = true; + RestrictRealtime = true; + SystemCallArchitectures = "native"; + SystemCallFilter = [ + "@system-service" + "~@privileged" + ]; + UMask = "0077"; + }; + }) cfg.servers; + }; +} diff --git a/nixos/modules/services/continuous-integration/buildkite-agents.nix b/nixos/modules/services/continuous-integration/buildkite-agents.nix index 7c8f77580ff61..a40b939a16c74 100644 --- a/nixos/modules/services/continuous-integration/buildkite-agents.nix +++ b/nixos/modules/services/continuous-integration/buildkite-agents.nix @@ -11,7 +11,7 @@ let default = null; description = lib.mdDoc description; type = types.nullOr types.lines; - } // (if example == null then {} else { inherit example; }); + } // (lib.optionalAttrs (example != null) { inherit example; }); }; mkHookOptions = hooks: listToAttrs (map mkHookOption hooks); diff --git a/nixos/modules/services/continuous-integration/github-runner.nix b/nixos/modules/services/continuous-integration/github-runner.nix index 67e71659d6b73..27cfee92c75a3 100644 --- a/nixos/modules/services/continuous-integration/github-runner.nix +++ b/nixos/modules/services/continuous-integration/github-runner.nix @@ -21,5 +21,5 @@ in services.github-runners.${cfg.name} = cfg; }; - meta.maintainers = with maintainers; [ veehaitch newam ]; + meta.maintainers = with maintainers; [ veehaitch newam thomasjm ]; } diff --git a/nixos/modules/services/databases/foundationdb.md b/nixos/modules/services/databases/foundationdb.md index f852c6888d841..0815c139152f3 100644 --- a/nixos/modules/services/databases/foundationdb.md +++ b/nixos/modules/services/databases/foundationdb.md @@ -6,7 +6,7 @@ *Maintainer:* Austin Seipp -*Available version(s):* 5.1.x, 5.2.x, 6.0.x +*Available version(s):* 7.1.x FoundationDB (or "FDB") is an open source, distributed, transactional key-value store. @@ -17,7 +17,7 @@ To enable FoundationDB, add the following to your {file}`configuration.nix`: ``` services.foundationdb.enable = true; -services.foundationdb.package = pkgs.foundationdb52; # FoundationDB 5.2.x +services.foundationdb.package = pkgs.foundationdb71; # FoundationDB 7.1.x ``` The {option}`services.foundationdb.package` option is required, and @@ -66,7 +66,7 @@ necessary Python modules). ```ShellSession a@link> cat fdb-status.py #! /usr/bin/env nix-shell -#! nix-shell -i python -p python pythonPackages.foundationdb52 +#! nix-shell -i python -p python pythonPackages.foundationdb71 import fdb import json diff --git a/nixos/modules/services/hardware/fwupd.nix b/nixos/modules/services/hardware/fwupd.nix index b8c2ac94845b0..9ea1d0cf4165d 100644 --- a/nixos/modules/services/hardware/fwupd.nix +++ b/nixos/modules/services/hardware/fwupd.nix @@ -13,16 +13,13 @@ let }; customEtc = { - "fwupd/daemon.conf" = { - source = format.generate "daemon.conf" { + "fwupd/fwupd.conf" = { + source = format.generate "fwupd.conf" { fwupd = cfg.daemonSettings; - }; - }; - - "fwupd/uefi_capsule.conf" = { - source = format.generate "uefi_capsule.conf" { uefi_capsule = cfg.uefiCapsuleSettings; }; + # fwupd tries to chmod the file if it doesn't have the right permissions + mode = "0640"; }; }; diff --git a/nixos/modules/services/mail/exim.nix b/nixos/modules/services/mail/exim.nix index a9504acee3511..1d1258913b674 100644 --- a/nixos/modules/services/mail/exim.nix +++ b/nixos/modules/services/mail/exim.nix @@ -116,8 +116,8 @@ in wantedBy = [ "multi-user.target" ]; restartTriggers = [ config.environment.etc."exim.conf".source ]; serviceConfig = { - ExecStart = "+${cfg.package}/bin/exim -bdf -q${cfg.queueRunnerInterval}"; - ExecReload = "+${coreutils}/bin/kill -HUP $MAINPID"; + ExecStart = "!${cfg.package}/bin/exim -bdf -q${cfg.queueRunnerInterval}"; + ExecReload = "!${coreutils}/bin/kill -HUP $MAINPID"; User = cfg.user; }; preStart = '' diff --git a/nixos/modules/services/mail/public-inbox.nix b/nixos/modules/services/mail/public-inbox.nix index 099997fa9fe9b..a7d7097065a28 100644 --- a/nixos/modules/services/mail/public-inbox.nix +++ b/nixos/modules/services/mail/public-inbox.nix @@ -177,8 +177,7 @@ in description = lib.mdDoc "The email addresses of the public-inbox."; }; options.url = mkOption { - type = with types; nullOr str; - default = null; + type = types.nonEmptyStr; example = "https://example.org/lists/example-discuss"; description = lib.mdDoc "URL where this inbox can be accessed over HTTP."; }; diff --git a/nixos/modules/services/mail/rspamd.nix b/nixos/modules/services/mail/rspamd.nix index f9be9024dd4f8..ca88d81221798 100644 --- a/nixos/modules/services/mail/rspamd.nix +++ b/nixos/modules/services/mail/rspamd.nix @@ -215,7 +215,7 @@ let text = v.extraConfig; }) (filterAttrs (n: v: v.extraConfig != "") cfg.workers)) - // (if cfg.extraConfig == "" then {} else { + // (lib.optionalAttrs (cfg.extraConfig != "") { "extra-config.inc".text = cfg.extraConfig; }); in diff --git a/nixos/modules/services/misc/atuin.nix b/nixos/modules/services/misc/atuin.nix index c603042fb306f..202bd4dfca11e 100644 --- a/nixos/modules/services/misc/atuin.nix +++ b/nixos/modules/services/misc/atuin.nix @@ -46,6 +46,13 @@ in description = mdDoc "Open ports in the firewall for the atuin server."; }; + database = { + createLocally = mkOption { + type = types.bool; + default = true; + description = lib.mdDoc "Create the database and database user locally."; + }; + }; }; }; @@ -65,7 +72,8 @@ in systemd.services.atuin = { description = "atuin server"; - after = [ "network.target" "postgresql.service" ]; + requires = lib.optionals cfg.database.createLocally [ "postgresql.service" ]; + after = [ "network.target" ] ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ] ; wantedBy = [ "multi-user.target" ]; serviceConfig = { @@ -80,7 +88,7 @@ in ATUIN_PORT = toString cfg.port; ATUIN_MAX_HISTORY_LENGTH = toString cfg.maxHistoryLength; ATUIN_OPEN_REGISTRATION = boolToString cfg.openRegistration; - ATUIN_DB_URI = "postgresql:///atuin"; + ATUIN_DB_URI = mkIf cfg.database.createLocally "postgresql:///atuin"; ATUIN_PATH = cfg.path; ATUIN_CONFIG_DIR = "/run/atuin"; # required to start, but not used as configuration is via environment variables }; diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix index f37d197f1621d..7b1282b15b314 100644 --- a/nixos/modules/services/misc/nix-daemon.nix +++ b/nixos/modules/services/misc/nix-daemon.nix @@ -520,10 +520,17 @@ in will set up automatically for each build. This prevents impurities in builds by disallowing access to dependencies outside of the Nix store by using network and mount namespaces in a chroot environment. + This is enabled by default even though it has a possible performance impact due to the initial setup time of a sandbox for each build. It doesn't affect derivation hashes, so changing this option will not trigger a rebuild of packages. + + When set to "relaxed", this option permits derivations that set + `__noChroot = true;` to run outside of the sandboxed environment. + Exercise caution when using this mode of operation! It is intended to + be a quick hack when building with packages that are not easily setup + to be built reproducibly. ''; }; @@ -641,7 +648,7 @@ in ''; description = lib.mdDoc '' Configuration for Nix, see - or + or {manpage}`nix.conf(5)` for available options. The value declared here will be translated directly to the key-value pairs Nix expects. diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix index e74ee641db386..1786b09e28af2 100644 --- a/nixos/modules/services/monitoring/grafana.nix +++ b/nixos/modules/services/monitoring/grafana.nix @@ -5,25 +5,25 @@ with lib; let cfg = config.services.grafana; opt = options.services.grafana; - provisioningSettingsFormat = pkgs.formats.yaml {}; + provisioningSettingsFormat = pkgs.formats.yaml { }; declarativePlugins = pkgs.linkFarm "grafana-plugins" (builtins.map (pkg: { name = pkg.pname; path = pkg; }) cfg.declarativePlugins); useMysql = cfg.settings.database.type == "mysql"; usePostgresql = cfg.settings.database.type == "postgres"; - settingsFormatIni = pkgs.formats.ini {}; + settingsFormatIni = pkgs.formats.ini { }; configFile = settingsFormatIni.generate "config.ini" cfg.settings; mkProvisionCfg = name: attr: provisionCfg: if provisionCfg.path != null - then provisionCfg.path + then provisionCfg.path else provisioningSettingsFormat.generate "${name}.yaml" (if provisionCfg.settings != null - then provisionCfg.settings - else { - apiVersion = 1; - ${attr} = []; - }); + then provisionCfg.settings + else { + apiVersion = 1; + ${attr} = [ ]; + }); datasourceFileOrDir = mkProvisionCfg "datasource" "datasources" cfg.provision.datasources; dashboardFileOrDir = mkProvisionCfg "dashboard" "providers" cfg.provision.dashboards; @@ -35,9 +35,10 @@ let notifierFileOrDir = pkgs.writeText "notifier.yaml" (builtins.toJSON notifierConfiguration); - generateAlertingProvisioningYaml = x: if (cfg.provision.alerting."${x}".path == null) - then provisioningSettingsFormat.generate "${x}.yaml" cfg.provision.alerting."${x}".settings - else cfg.provision.alerting."${x}".path; + generateAlertingProvisioningYaml = x: + if (cfg.provision.alerting."${x}".path == null) + then provisioningSettingsFormat.generate "${x}.yaml" cfg.provision.alerting."${x}".settings + else cfg.provision.alerting."${x}".path; rulesFileOrDir = generateAlertingProvisioningYaml "rules"; contactPointsFileOrDir = generateAlertingProvisioningYaml "contactPoints"; policiesFileOrDir = generateAlertingProvisioningYaml "policies"; @@ -102,7 +103,7 @@ let description = lib.mdDoc "Datasource type. Required."; }; access = mkOption { - type = types.enum ["proxy" "direct"]; + type = types.enum [ "proxy" "direct" ]; default = "proxy"; description = lib.mdDoc "Access mode. proxy or direct (Server or Browser in the UI). Required."; }; @@ -121,6 +122,11 @@ let default = false; description = lib.mdDoc "Allow users to edit datasources from the UI."; }; + jsonData = mkOption { + type = types.nullOr types.attrs; + default = null; + description = lib.mdDoc "Extra data for datasource plugins."; + }; secureJsonData = mkOption { type = types.nullOr types.attrs; default = null; @@ -165,7 +171,7 @@ let description = lib.mdDoc "Notifier name."; }; type = mkOption { - type = types.enum ["dingding" "discord" "email" "googlechat" "hipchat" "kafka" "line" "teams" "opsgenie" "pagerduty" "prometheus-alertmanager" "pushover" "sensu" "sensugo" "slack" "telegram" "threema" "victorops" "webhook"]; + type = types.enum [ "dingding" "discord" "email" "googlechat" "hipchat" "kafka" "line" "teams" "opsgenie" "pagerduty" "prometheus-alertmanager" "pushover" "sensu" "sensugo" "slack" "telegram" "threema" "victorops" "webhook" ]; description = lib.mdDoc "Notifier type."; }; uid = mkOption { @@ -220,7 +226,8 @@ let }; }; }; -in { +in +{ imports = [ (mkRenamedOptionModule [ "services" "grafana" "protocol" ] [ "services" "grafana" "settings" "server" "protocol" ]) (mkRenamedOptionModule [ "services" "grafana" "addr" ] [ "services" "grafana" "settings" "server" "http_addr" ]) @@ -349,7 +356,7 @@ in { protocol = mkOption { description = lib.mdDoc "Which protocol to listen."; default = "http"; - type = types.enum ["http" "https" "h2" "socket"]; + type = types.enum [ "http" "https" "h2" "socket" ]; }; http_addr = mkOption { @@ -371,17 +378,61 @@ in { }; domain = mkOption { - description = lib.mdDoc "The public facing domain name used to access grafana from a browser."; + description = lib.mdDoc '' + The public facing domain name used to access grafana from a browser. + + This setting is only used in the default value of the `root_url` setting. + If you set the latter manually, this option does not have to be specified. + ''; default = "localhost"; type = types.str; }; + enforce_domain = mkOption { + description = lib.mdDoc '' + Redirect to correct domain if the host header does not match the domain. + Prevents DNS rebinding attacks. + ''; + default = false; + type = types.bool; + }; + root_url = mkOption { - description = lib.mdDoc "Full public facing url."; + description = lib.mdDoc '' + This is the full URL used to access Grafana from a web browser. + This is important if you use Google or GitHub OAuth authentication (for the callback URL to be correct). + + This setting is also important if you have a reverse proxy in front of Grafana that exposes it through a subpath. + In that case add the subpath to the end of this URL setting. + ''; + # https://github.com/grafana/grafana/blob/cb7e18938b8eb6860a64b91aaba13a7eb31bc95b/conf/defaults.ini#L54 default = "%(protocol)s://%(domain)s:%(http_port)s/"; type = types.str; }; + serve_from_sub_path = mkOption { + description = lib.mdDoc '' + Serve Grafana from subpath specified in the `root_url` setting. + By default it is set to `false` for compatibility reasons. + + By enabling this setting and using a subpath in `root_url` above, + e.g. `root_url = "http://localhost:3000/grafana"`, + Grafana is accessible on `http://localhost:3000/grafana`. + If accessed without subpath, Grafana will redirect to an URL with the subpath. + ''; + default = false; + type = types.bool; + }; + + router_logging = mkOption { + description = lib.mdDoc '' + Set to `true` for Grafana to log all HTTP requests (not just errors). + These are logged as Info level events to the Grafana log. + ''; + default = false; + type = types.bool; + }; + static_root_path = mkOption { description = lib.mdDoc "Root path for static assets."; default = "${cfg.package}/share/grafana/public"; @@ -391,60 +442,119 @@ in { enable_gzip = mkOption { description = lib.mdDoc '' - Set this option to true to enable HTTP compression, this can improve transfer speed and bandwidth utilization. - It is recommended that most users set it to true. By default it is set to false for compatibility reasons. + Set this option to `true` to enable HTTP compression, this can improve transfer speed and bandwidth utilization. + It is recommended that most users set it to `true`. By default it is set to `false` for compatibility reasons. ''; default = false; type = types.bool; }; cert_file = mkOption { - description = lib.mdDoc "Cert file for ssl."; + description = lib.mdDoc '' + Path to the certificate file (if `protocol` is set to `https` or `h2`). + ''; default = ""; type = types.str; }; cert_key = mkOption { - description = lib.mdDoc "Cert key for ssl."; + description = lib.mdDoc '' + Path to the certificate key file (if `protocol` is set to `https` or `h2`). + ''; default = ""; type = types.str; }; + socket_gid = mkOption { + description = lib.mdDoc '' + GID where the socket should be set when `protocol=socket`. + Make sure that the target group is in the group of Grafana process and that Grafana process is the file owner before you change this setting. + It is recommended to set the gid as http server user gid. + Not set when the value is -1. + ''; + default = -1; + type = types.int; + }; + + socket_mode = mkOption { + description = lib.mdDoc '' + Mode where the socket should be set when `protocol=socket`. + Make sure that Grafana process is the file owner before you change this setting. + ''; + # I assume this value is interpreted as octal literal by grafana. + # If this was an int, people following tutorials or porting their + # old config could stumble across nix not having octal literals. + default = "0660"; + type = types.str; + }; + socket = mkOption { - description = lib.mdDoc "Path where the socket should be created when protocol=socket. Make sure that Grafana has appropriate permissions before you change this setting."; + description = lib.mdDoc '' + Path where the socket should be created when `protocol=socket`. + Make sure that Grafana has appropriate permissions before you change this setting. + ''; default = "/run/grafana/grafana.sock"; type = types.str; }; + + cdn_url = mkOption { + description = lib.mdDoc '' + Specify a full HTTP URL address to the root of your Grafana CDN assets. + Grafana will add edition and version paths. + + For example, given a cdn url like `https://cdn.myserver.com` + grafana will try to load a javascript file from `http://cdn.myserver.com/grafana-oss/7.4.0/public/build/app..js`. + ''; + default = ""; + type = types.str; + }; + + read_timeout = mkOption { + description = lib.mdDoc '' + Sets the maximum time using a duration format (5s/5m/5ms) + before timing out read of an incoming request and closing idle connections. + 0 means there is no timeout for reading the request. + ''; + default = "0"; + type = types.str; + }; }; database = { type = mkOption { description = lib.mdDoc "Database type."; default = "sqlite3"; - type = types.enum ["mysql" "sqlite3" "postgres"]; + type = types.enum [ "mysql" "sqlite3" "postgres" ]; }; host = mkOption { - description = lib.mdDoc "Database host."; + description = lib.mdDoc '' + Only applicable to MySQL or Postgres. + Includes IP or hostname and port or in case of Unix sockets the path to it. + For example, for MySQL running on the same host as Grafana: `host = "127.0.0.1:3306"` + or with Unix sockets: `host = "/var/run/mysqld/mysqld.sock"` + ''; default = "127.0.0.1:3306"; type = types.str; }; name = mkOption { - description = lib.mdDoc "Database name."; + description = lib.mdDoc "The name of the Grafana database."; default = "grafana"; type = types.str; }; user = mkOption { - description = lib.mdDoc "Database user."; + description = lib.mdDoc "The database user (not applicable for `sqlite3`)."; default = "root"; type = types.str; }; password = mkOption { description = lib.mdDoc '' - Database password. Please note that the contents of this option + The database user's password (not applicable for `sqlite3`). + + Please note that the contents of this option will end up in a world-readable Nix store. Use the file provider pointing at a reasonably secured file in the local filesystem to work around that. Look at the documentation for details: @@ -454,15 +564,144 @@ in { type = types.str; }; + max_idle_conn = mkOption { + description = lib.mdDoc "The maximum number of connections in the idle connection pool."; + default = 2; + type = types.int; + }; + + max_open_conn = mkOption { + description = lib.mdDoc "The maximum number of open connections to the database."; + default = 0; # https://github.com/grafana/grafana/blob/cb7e18938b8eb6860a64b91aaba13a7eb31bc95b/conf/defaults.ini#L123-L124 + type = types.int; + }; + + conn_max_lifetime = mkOption { + description = lib.mdDoc '' + Sets the maximum amount of time a connection may be reused. + The default is 14400 (which means 14400 seconds or 4 hours). + For MySQL, this setting should be shorter than the `wait_timeout` variable. + ''; + default = 14400; + type = types.int; + }; + + locking_attempt_timeout_sec = mkOption { + description = lib.mdDoc '' + For `mysql`, if the `migrationLocking` feature toggle is set, + specify the time (in seconds) to wait before failing to lock the database for the migrations. + ''; + default = 0; + type = types.int; + }; + + log_queries = mkOption { + description = lib.mdDoc "Set to `true` to log the sql calls and execution times"; + default = false; + type = types.bool; + }; + + ssl_mode = mkOption { + description = lib.mdDoc '' + For Postgres, use either `disable`, `require` or `verify-full`. + For MySQL, use either `true`, `false`, or `skip-verify`. + ''; + default = "disable"; # https://github.com/grafana/grafana/blob/cb7e18938b8eb6860a64b91aaba13a7eb31bc95b/conf/defaults.ini#L134 + type = types.enum [ "disable" "require" "verify-full" "true" "false" "skip-verify" ]; + }; + + isolation_level = mkOption { + description = lib.mdDoc '' + Only the MySQL driver supports isolation levels in Grafana. + In case the value is empty, the driver's default isolation level is applied. + ''; + default = null; + type = types.nullOr (types.enum [ "READ-UNCOMMITTED" "READ-COMMITTED" "REPEATABLE-READ" "SERIALIZABLE" ]); + }; + + ca_cert_path = mkOption { + description = lib.mdDoc "The path to the CA certificate to use."; + default = ""; + type = types.str; + }; + + client_key_path = mkOption { + description = lib.mdDoc "The path to the client key. Only if server requires client authentication."; + default = ""; + type = types.str; + }; + + client_cert_path = mkOption { + description = lib.mdDoc "The path to the client cert. Only if server requires client authentication."; + default = ""; + type = types.str; + }; + + server_cert_name = mkOption { + description = lib.mdDoc '' + The common name field of the certificate used by the `mysql` or `postgres` server. + Not necessary if `ssl_mode` is set to `skip-verify`. + ''; + default = ""; + type = types.str; + }; + path = mkOption { - description = lib.mdDoc "Only applicable to sqlite3 database. The file path where the database will be stored."; + description = lib.mdDoc "Only applicable to `sqlite3` database. The file path where the database will be stored."; default = "${cfg.dataDir}/data/grafana.db"; defaultText = literalExpression ''"''${config.${opt.dataDir}}/data/grafana.db"''; type = types.path; }; + + cache_mode = mkOption { + description = lib.mdDoc '' + For `sqlite3` only. + [Shared cache](https://www.sqlite.org/sharedcache.html) setting used for connecting to the database. + ''; + default = "private"; + type = types.enum [ "private" "shared" ]; + }; + + wal = mkOption { + description = lib.mdDoc '' + For `sqlite3` only. + Setting to enable/disable [Write-Ahead Logging](https://sqlite.org/wal.html). + ''; + default = false; + type = types.bool; + }; + + query_retries = mkOption { + description = lib.mdDoc '' + This setting applies to `sqlite3` only and controls the number of times the system retries a query when the database is locked. + ''; + default = 0; + type = types.int; + }; + + transaction_retries = mkOption { + description = lib.mdDoc '' + This setting applies to `sqlite3` only and controls the number of times the system retries a transaction when the database is locked. + ''; + default = 5; + type = types.int; + }; + + # TODO Add "instrument_queries" option when upgrading to grafana 10.0 + # instrument_queries = mkOption { + # description = lib.mdDoc "Set to `true` to add metrics and tracing for database queries."; + # default = false; + # type = types.bool; + # }; }; security = { + disable_initial_admin_creation = mkOption { + description = lib.mdDoc "Disable creation of admin user on first start of Grafana."; + default = false; + type = types.bool; + }; + admin_user = mkOption { description = lib.mdDoc "Default admin username."; default = "admin"; @@ -481,6 +720,12 @@ in { type = types.str; }; + admin_email = mkOption { + description = lib.mdDoc "The email of the default Grafana Admin, created on startup."; + default = "admin@localhost"; + type = types.str; + }; + secret_key = mkOption { description = lib.mdDoc '' Secret key used for signing. Please note that the contents of this option @@ -492,6 +737,139 @@ in { default = "SW2YcwTIb9zpOOhoPsMm"; type = types.str; }; + + disable_gravatar = mkOption { + description = lib.mdDoc "Set to `true` to disable the use of Gravatar for user profile images."; + default = false; + type = types.bool; + }; + + data_source_proxy_whitelist = mkOption { + description = lib.mdDoc '' + Define a whitelist of allowed IP addresses or domains, with ports, + to be used in data source URLs with the Grafana data source proxy. + Format: `ip_or_domain:port` separated by spaces. + PostgreSQL, MySQL, and MSSQL data sources do not use the proxy and are therefore unaffected by this setting. + ''; + default = ""; + type = types.str; + }; + + disable_brute_force_login_protection = mkOption { + description = lib.mdDoc "Set to `true` to disable [brute force login protection](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#account-lockout)."; + default = false; + type = types.bool; + }; + + cookie_secure = mkOption { + description = lib.mdDoc "Set to `true` if you host Grafana behind HTTPS."; + default = false; + type = types.bool; + }; + + cookie_samesite = mkOption { + description = lib.mdDoc '' + Sets the `SameSite` cookie attribute and prevents the browser from sending this cookie along with cross-site requests. + The main goal is to mitigate the risk of cross-origin information leakage. + This setting also provides some protection against cross-site request forgery attacks (CSRF), + [read more about SameSite here](https://owasp.org/www-community/SameSite). + Using value `disabled` does not add any `SameSite` attribute to cookies. + ''; + default = "lax"; + type = types.enum [ "lax" "strict" "none" "disabled" ]; + }; + + allow_embedding = mkOption { + description = lib.mdDoc '' + When `false`, the HTTP header `X-Frame-Options: deny` will be set in Grafana HTTP responses + which will instruct browsers to not allow rendering Grafana in a ``, `