staging-next-25.11 iteration 1 - 2025-12-06#468267
Merged
vcunat merged 140 commits intorelease-25.11from Dec 15, 2025
Merged
Conversation
This commit, together with #442540, changes the way python environments are built: * When generating wrappers for python executables, we inherit argv[0] from the wrapper. This causes python to initialize its configuration in the environment with all the correct paths. * We also resolve argv[0] to absolute path when invoking python from PATH. This helps set python's prefix correctly on Darwin. The end result is that python environments no longer appear to be venvs, and behave more like a vanilla python installation. In addition it's possible to create a venv using an environment and use packages from both the environment and the venv. (cherry picked from commit abe61db)
(cherry picked from commit 2e7e7c7)
(cherry picked from commit 1af2b4e)
(cherry picked from commit 9e6e563)
(cherry picked from commit 9eff836)
This patch is included in 2.58.1. (cherry picked from commit 2344c36)
This is a security release and the APNG patch applies as is without modification from 1.6.50 Link: https://www.openwall.com/lists/oss-security/2025/11/22/1 Fixes: CVE-2025-64505, CVE-2025-64506, CVE-2025-64720, CVE-2025-65018 (cherry picked from commit 2a692fc)
Fixes CVE-2025-9820 (low severity) http://www.gnutls.org/security-new.html#GNUTLS-SA-2025-11-18 https://lists.gnupg.org/pipermail/gnutls-help/2025-November/004906.html (cherry picked from commit 0425be6)
Static linux-pam is marked broken. (cherry picked from commit 49ba430)
(cherry picked from commit 866aaf8)
Member
Author
|
The binary on cache.nixos.org was broken, probably badly signed, as shown e.g. by ./result-bin/bin/autogen --help It's unknown how it broke, but we need to rebuild it to fix many builds https://hydra.nixos.org/build/315983923/nixlog/4/tail Thanks to emilazy for finding the problem and workaround.
It's failing on Hydra even after many retries. I fail to reproduce the issue and log looks like some parallel-make problem: https://hydra.nixos.org/build/315811942#tabs-buildsteps It's weird that other versions and other platforms don't seem to suffer from this issue. Unfortunately, hundreds of Hydra jobs depend on this one.
(cherry picked from commit 728441c) This fixes the build. I haven't investigated what's going on. https://hydra.nixos.org/build/316138852/nixlog/3/tail
Boulder has mostly removed keys and certificates for testing in the meantime. They have to be generated on-the-fly. The ipki keys just require minica. The webpki keys would require softhsm and this somehow fails. We currently get away without them, probably because we have disabled all the tests that require them. (cherry picked from commit edcf84b) This fixes the build. I haven't investigated what's going on. https://hydra.nixos.org/build/315683959/nixlog/3/tail
Signed-off-by: Matthias Beyer <mail@beyermatthias.de> (cherry picked from commit 717c6fc)
(cherry picked from commit 4c883a2) This fixes the build. I haven't investigated what's going on. https://hydra.nixos.org/build/315685706/nixlog/4/tail
(cherry picked from commit 8a9d84b) This fixes the build. I haven't investigated what's going on. https://hydra.nixos.org/build/316012891/nixlog/3/tail
(cherry picked from commit 41c3b51) This fixes the build. I haven't investigated what's going on. https://hydra.nixos.org/build/315744664/nixlog/4/tail
(cherry picked from commit cb2743d) This fixes the build. I haven't investigated what's going on. https://hydra.nixos.org/build/315971344/nixlog/3/tail
(cherry picked from commit 7916753) https://hydra.nixos.org/build/316140666/nixlog/3/tail
(cherry picked from commit fb6b69a) This fixes the build. I haven't investigated what's going on. https://hydra.nixos.org/build/315984931/nixlog/3/tail
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Helpful links
https://hydra.nixos.org/job/nixpkgs/staging-next-25.11/unstable#tabs-constituents
https://hydra.nixos.org/job/nixpkgs/staging-next-25.11/darwin-tested#tabs-constituents
https://hydra.nixos.org/job/nixos/staging-next-25.11-small/tested#tabs-constituents
https://hydra.nixos.org/jobset/nixpkgs/staging-next-25.11
https://hydra.nixos.org/jobset/nixos/staging-next-25.11-small
Important breakages
nothing so far