use-case: deeply replace packages

[alex-ameen]

No description provided.

[roberth]

Can I pass the baton to @nbp?

EDIT: looks decent, but I don't know the review criteria as I'm not directly involved with the working group.

[phaer]

LGTM, except for the pending update of the example :)

[KFearsoff]

LGTM, but I think a little more detail should be given about the "deep replacing" exactly.

I think providing a convenient way to deep-replace is cool, but I think an even better solution would be making deep-replace the baseline, and shallow replace to be opt-in.

Perhaps an example would help illustrate the point. I imagine an API like this:

• Deep replace (default and easy):

let patched-treesitter = pkgs.nvim-treesitter { # pkgs.nvim-treesitter is a module in this context
  src = { # submodule that is merged on top of defaults
    version = "1.2.4"; # instead of 1.2.3 in this example
    sha256 = "<sha256>";
  };
};
nvim-treesitter.enable = true;
nvim-treesitter.package = patched-treesitter;
nvim-treesitter-terraform.enable = true; # will use patched treesitter

• Shallow replace:

let patched-treesitter = pkgs.nvim-treesitter { # pkgs.nvim-treesitter is a module in this context
  src = { # submodule that is merged on top of defaults
    version = "1.2.4"; # instead of 1.2.3 in this example
    sha256 = "<sha256>";
  };
};
nvim-treesitter.enable = true;
nvim-treesitter-terraform.enable = true;
nvim-treesitter-terraform.package.inputs = { # attrset of modules
  nvim-treesitter = treesitter-patched; # replace input module with our module
};

The main challenge here would be that modules are mutable, and we need to create a deep clone of a module to customize it. We also have to be wary of infinite recursion. But I do feel that "Deep replace" should be the expected behavior when you override hello.package option, and "Shallow replace" should be the expected behavior when you override hello.inputs.glibc.

EDIT: I think that API would be quite possible if a "package module" is a function like this: overrideArgs ? {}: if (overrideArgs == {}) then (module) else (overridenModule)

[dblsaiko]

security patching

This would cause full rebuilds unlike NixOS/nixpkgs#10851 wants to do however, from what I can see, right?

[phaer]

LGTM!

[DavHau]

@aakropotkin In an earlier meeting (which you might have missed) we agreed that the approval of all individual team members is required before a PR can get merged. Therefore this PR has been merged too early.