Merge master into staging-next

README.md

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <a href="https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md"><img src="https://img.shields.io/github/contributors-anon/NixOS/nixpkgs" alt="Contributors badge" /></a>
+  <a href="CONTRIBUTING.md"><img src="https://img.shields.io/github/contributors-anon/NixOS/nixpkgs" alt="Contributors badge" /></a>
   <a href="https://opencollective.com/nixos"><img src="https://opencollective.com/nixos/tiers/supporter/badge.svg?label=supporters&color=brightgreen" alt="Open Collective supporters" /></a>
 </p>
 
@@ -74,7 +74,7 @@ Community contributions are always welcome through GitHub Issues and
 Pull Requests.
 
 For more information about contributing to the project, please visit
-the [contributing page](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+the [contributing page](CONTRIBUTING.md).
 
 # Donations
 

doc/doc-support/package.nix

@@ -5,6 +5,8 @@
   lib,
   stdenvNoCC,
   callPackage,
+  devmode,
+  mkShellNoCC,
   documentation-highlighter,
   nixos-render-docs,
   nixpkgs ? { },
@@ -95,10 +97,14 @@ stdenvNoCC.mkDerivation (
 
       pythonInterpreterTable = callPackage ./python-interpreter-table.nix { };
 
-      shell = callPackage ../../pkgs/tools/nix/web-devmode.nix {
-        buildArgs = "./.";
-        open = "/share/doc/nixpkgs/manual.html";
-      };
+      shell =
+        let
+          devmode' = devmode.override {
+            buildArgs = "./.";
+            open = "/share/doc/nixpkgs/manual.html";
+          };
+        in
+        mkShellNoCC { packages = [ devmode' ]; };
 
       tests.manpage-urls = callPackage ../tests/manpage-urls.nix { };
     };

nixos/doc/manual/shell.nix

@@ -6,8 +6,11 @@ let
 
   common = import ./common.nix;
   inherit (common) outputPath indexPath;
+  devmode = pkgs.devmode.override {
+    buildArgs = "../../release.nix -A manualHTML.${builtins.currentSystem}";
+    open = "/${outputPath}/${indexPath}";
+  };
 in
-pkgs.callPackage ../../../pkgs/tools/nix/web-devmode.nix {
-  buildArgs = "../../release.nix -A manualHTML.${builtins.currentSystem}";
-  open = "/${outputPath}/${indexPath}";
+pkgs.mkShellNoCC {
+  packages = [ devmode ];
 }

nixos/modules/services/development/athens.md

@@ -37,7 +37,7 @@ If you want to prevent Athens from writing to disk, you can instead configure it
 }
 ```
 
-To use the local proxy in Go builds, you can set the proxy as environment variable:
+To use the local proxy in Go builds (outside of `nix`), you can set the proxy as environment variable:
 
 ```nix
 {
@@ -47,6 +47,21 @@ To use the local proxy in Go builds, you can set the proxy as environment variab
 }
 ```
 
-It is currently not possible to use the local proxy for builds done by the Nix daemon. This might be enabled
-by experimental features, specifically [`configurable-impure-env`](https://nixos.org/manual/nix/unstable/contributing/experimental-features#xp-feature-configurable-impure-env),
-in upcoming Nix versions.
+To also use the local proxy for Go builds happening in `nix` (with `buildGoModule`), the nix daemon can be configured to pass the GOPROXY environment variable to the `goModules` fixed-output derivation.
+
+This can either be done via the nix-daemon systemd unit:
+
+```nix
+{
+  systemd.services.nix-daemon.environment.GOPROXY = "http://localhost:3000";
+}
+```
+
+or via the [impure-env experimental feature](https://nix.dev/manual/nix/2.24/command-ref/conf-file#conf-impure-env):
+
+```nix
+{
+  nix.settings.experimental-features = [ "configurable-impure-env" ];
+  nix.settings.impure-env = "GOPROXY=http://localhost:3000";
+}
+```

nixos/modules/system/boot/systemd/initrd.nix

@@ -482,6 +482,9 @@ in {
 
         # so NSS can look up usernames
         "${pkgs.glibc}/lib/libnss_files.so.2"
+
+        # Resolving sysroot symlinks without code exec
+        "${pkgs.chroot-realpath}/bin/chroot-realpath"
       ] ++ optionals cfg.package.withCryptsetup [
         # fido2 support
         "${cfg.package}/lib/cryptsetup/libcryptsetup-token-systemd-fido2.so"
@@ -522,7 +525,7 @@ in {
 
         script = /* bash */ ''
           set -uo pipefail
-          export PATH="/bin:${cfg.package.util-linux}/bin"
+          export PATH="/bin:${cfg.package.util-linux}/bin:${pkgs.chroot-realpath}/bin"
 
           # Figure out what closure to boot
           closure=
@@ -543,7 +546,7 @@ in {
 
           # Resolve symlinks in the init parameter. We need this for some boot loaders
           # (e.g. boot.loader.generationsDir).
-          closure="$(chroot /sysroot ${pkgs.coreutils}/bin/realpath "$closure")"
+          closure="$(chroot-realpath /sysroot "$closure")"
 
           # Assume the directory containing the init script is the closure.
           closure="$(dirname "$closure")"
@@ -578,14 +581,10 @@ in {
       ];
 
       services.initrd-nixos-activation = {
-        requires = [
-          config.boot.initrd.systemd.services.initrd-find-nixos-closure.name
-        ];
-        after = [
-          "initrd-fs.target"
-          config.boot.initrd.systemd.services.initrd-find-nixos-closure.name
-        ];
-        requiredBy = [ "initrd.target" ];
+        after = [ "initrd-switch-root.target" ];
+        requiredBy = [ "initrd-switch-root.service" ];
+        before = [ "initrd-switch-root.service" ];
+        unitConfig.DefaultDependencies = false;
         unitConfig = {
           AssertPathExists = "/etc/initrd-release";
           RequiresMountsFor = [

nixos/modules/system/etc/etc-activation.nix

@@ -139,10 +139,10 @@
 
                 closure="$(realpath /nixos-closure)"
 
-                metadata_image="$(chroot /sysroot ${lib.getExe' pkgs.coreutils "realpath"} "$closure/etc-metadata-image")"
+                metadata_image="$(${pkgs.chroot-realpath}/bin/chroot-realpath /sysroot "$closure/etc-metadata-image")"
                 ln -s "/sysroot$metadata_image" /etc-metadata-image
 
-                basedir="$(chroot /sysroot ${lib.getExe' pkgs.coreutils "realpath"} "$closure/etc-basedir")"
+                basedir="$(${pkgs.chroot-realpath}/bin/chroot-realpath /sysroot "$closure/etc-basedir")"
                 ln -s "/sysroot$basedir" /etc-basedir
               '';
             };

pkgs/applications/terminal-emulators/kitty/default.nix

@@ -28,6 +28,8 @@
 , go_1_23
 , buildGo123Module
 , nix-update-script
+, makeBinaryWrapper
+, autoSignDarwinBinariesHook
 }:
 
 with python3Packages;
@@ -85,9 +87,11 @@ buildPythonApplication rec {
     sphinx-inline-tabs
     go_1_23
     fontconfig
+    makeBinaryWrapper
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
     imagemagick
     libicns  # For the png2icns tool.
+    autoSignDarwinBinariesHook
   ] ++ lib.optionals stdenv.hostPlatform.isLinux [
     wayland-scanner
   ];

pkgs/applications/video/mkvtoolnix/default.nix

@@ -99,8 +99,7 @@ stdenv.mkDerivation rec {
     zlib
   ]
   ++ optionals withGUI [ cmark ]
-  ++ optionals stdenv.hostPlatform.isLinux [ qtwayland ]
-  ++ optionals stdenv.hostPlatform.isDarwin [ libiconv ];
+  ++ optionals stdenv.hostPlatform.isLinux [ qtwayland ];
 
   # autoupdate is not needed but it silences a ton of pointless warnings
   postPatch = ''

pkgs/by-name/ba/baidupcs-go/package.nix

@@ -1,33 +1,37 @@
 {
+  fetchFromGitHub,
   buildGo122Module,
   lib,
-  fetchFromGitHub,
   versionCheckHook,
 }:
 buildGo122Module rec {
   pname = "baidupcs-go";
-  version = "3.9.5";
+  version = "3.9.5-unstable-2024-06-23";
   src = fetchFromGitHub {
     owner = "qjfoidnh";
     repo = "BaiduPCS-Go";
-    rev = "v${version}";
-    hash = "sha256-zNodRQzflOOB3hAeq4KbjRFlHQwknVy+4ucipUcoufY=";
+    rev = "5612fc337b9556ed330274987a2f876961639cff";
+    hash = "sha256-4mCJ5gVHjjvR6HNo47NTJvQEu7cdZZMfO8qQA7Kqzqo=";
   };
 
   vendorHash = "sha256-msTlXtidxLTe3xjxTOWCqx/epFT0XPdwGPantDJUGpc=";
   doCheck = false;
 
+  ldflags = [
+    "-X main.Version=${version}"
+  ];
+
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
   doInstallCheck = true;
   versionCheckProgram = "${placeholder "out"}/bin/${meta.mainProgram}";
 
   meta = {
+    mainProgram = "BaiduPCS-Go";
     maintainers = with lib.maintainers; [ xddxdd ];
     description = "Baidu Netdisk commandline client, mimicking Linux shell file handling commands";
     homepage = "https://github.com/qjfoidnh/BaiduPCS-Go";
     license = lib.licenses.asl20;
-    mainProgram = "BaiduPCS-Go";
   };
 }

pkgs/by-name/ch/chroot-realpath/package.nix

@@ -0,0 +1,21 @@
+{
+  lib,
+  rustPlatform,
+}:
+
+let
+  cargo = lib.importTOML ./src/Cargo.toml;
+in
+rustPlatform.buildRustPackage {
+  pname = cargo.package.name;
+  version = cargo.package.version;
+
+  src = ./src;
+
+  cargoLock.lockFile = ./src/Cargo.lock;
+
+  meta = {
+    description = "Output a path's realpath within a chroot.";
+    maintainers = [ lib.maintainers.elvishjerricco ];
+  };
+}

pkgs/by-name/ch/chroot-realpath/src/Cargo.toml

@@ -0,0 +1,9 @@
+[package]
+name = "chroot-realpath"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+
+[profile.release]
+opt-level = "z"

pkgs/by-name/ch/chroot-realpath/src/src/main.rs

@@ -0,0 +1,24 @@
+use std::env;
+use std::io::{stdout, Error, ErrorKind, Write};
+use std::os::unix::ffi::OsStrExt;
+use std::os::unix::fs;
+
+fn main() -> std::io::Result<()> {
+    let args: Vec<String> = env::args().collect();
+
+    if args.len() != 3 {
+        return Err(Error::new(
+            ErrorKind::InvalidInput,
+            format!("Usage: {} <chroot> <path>", args[0]),
+        ));
+    }
+
+    fs::chroot(&args[1])?;
+    std::env::set_current_dir("/")?;
+
+    let path = std::fs::canonicalize(&args[2])?;
+
+    stdout().write_all(path.into_os_string().as_bytes())?;
+
+    Ok(())
+}

pkgs/by-name/cp/cpm-cmake/package.nix

@@ -1,6 +1,7 @@
-{ lib
-, stdenvNoCC
-, fetchFromGitHub
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
@@ -14,6 +15,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     hash = "sha256-KIRVztkE72juIgXquZlC6AYo78QKHBD7iCvCa+ri66k=";
   };
 
+  postPatch = ''
+    substituteInPlace cmake/CPM.cmake \
+      --replace-fail "set(CURRENT_CPM_VERSION 1.0.0-development-version)" "set(CURRENT_CPM_VERSION ${finalAttrs.version})"
+  '';
+
   dontConfigure = true;
   dontBuild = true;
 
@@ -27,7 +33,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/cpm-cmake/CPM.cmake";
     description = "CMake's missing package manager";
     longDescription = ''
@@ -36,8 +42,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       CMake's FetchContent module that adds version control, caching, a
       simple API and more.
     '';
-    license = licenses.mit;
-    maintainers = [ ];
-    platforms = platforms.all;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pandapip1 ];
+    platforms = lib.platforms.all;
   };
 })