[pull] master from NixOS:master

.git-blame-ignore-revs

@@ -221,3 +221,5 @@ adb9714bd909df283c66bbd641bd631ff50a4260
 667d42c00d566e091e6b9a19b365099315d0e611
 84d4f874c2bac9f3118cb6907d7113b3318dcb5e
 
+# tmuxPlugins sha-to-sri.py script
+516b1e74c358a9c4b06e5591f8c1a2897aad0c33

ci/request-reviews/get-code-owners.sh

@@ -36,7 +36,8 @@ declare -A users=()
 for file in "${touchedFiles[@]}"; do
     result=$(codeowners --file "$tmp"/codeowners "$file")
 
-    read -r file owners <<< "$result"
+    # Remove the file prefix and trim the surrounding spaces
+    read -r owners <<< "${result#"$file"}"
     if [[ "$owners" == "(unowned)" ]]; then
         log "File $file is unowned"
         continue

doc/doc-support/python-interpreter-table.nix

@@ -37,7 +37,10 @@ let
     lib.attrNames (
       lib.filterAttrs (
         name: value:
-        isPythonInterpreter name && name != pname && interpreterName name == interpreterName pname
+        # use tryEval to handle entries in aliases.nix
+        (builtins.tryEval (
+          isPythonInterpreter name && name != pname && interpreterName name == interpreterName pname
+        )).value
       ) pkgs
     );
 

doc/languages-frameworks/python.section.md

@@ -57,7 +57,6 @@ sets are
 * `pkgs.python313Packages`
 * `pkgs.python314Packages`
 * `pkgs.pypy27Packages`
-* `pkgs.pypy39Packages`
 * `pkgs.pypy310Packages`
 
 and the aliases
@@ -66,7 +65,7 @@ and the aliases
 * `pkgs.python3Packages` pointing to `pkgs.python312Packages`
 * `pkgs.pythonPackages` pointing to `pkgs.python2Packages`
 * `pkgs.pypy2Packages` pointing to `pkgs.pypy27Packages`
-* `pkgs.pypy3Packages` pointing to `pkgs.pypy39Packages`
+* `pkgs.pypy3Packages` pointing to `pkgs.pypy310Packages`
 * `pkgs.pypyPackages` pointing to `pkgs.pypy2Packages`
 
 

flake.nix

@@ -85,10 +85,6 @@
           self.legacyPackages.${system}.stdenv.hostPlatform.isLinux
           # Exclude power64 due to "libressl is not available on the requested hostPlatform" with hostPlatform being power64
           && !self.legacyPackages.${system}.targetPlatform.isPower64
-          # Exclude armv6l-linux due to "cannot bootstrap GHC on this platform ('armv6l-linux' with libc 'defaultLibc')"
-          && system != "armv6l-linux"
-          # Exclude riscv64-linux due to "cannot bootstrap GHC on this platform ('riscv64-linux' with libc 'defaultLibc')"
-          && system != "riscv64-linux"
         )
       {
         # Test that ensures that the nixosSystem function can accept a lib argument

lib/generators.nix

@@ -606,12 +606,12 @@ in rec {
 
   in
   # TODO: As discussed in #356502, deprecated functionality should be removed sometime after 25.11.
-  lib.warnIf (!escape && lib.oldestSupportedReleaseIsAtLeast 2505) "Using `lib.generators.toPlist` without `escape = true` is deprecated"
-  ''<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-${expr "" v}
-</plist>'';
+  lib.warnIf (!escape && lib.oldestSupportedReleaseIsAtLeast 2505) "Using `lib.generators.toPlist` without `escape = true` is deprecated" ''
+  <?xml version="1.0" encoding="UTF-8"?>
+  <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+  <plist version="1.0">
+  ${expr "" v}
+  </plist>'';
 
   /**
     Translate a simple Nix expression to Dhall notation.

lib/lists.nix

@@ -1748,8 +1748,8 @@ rec {
     ```
     :::
   */
-  crossLists = warn
-    ''lib.crossLists is deprecated, use lib.mapCartesianProduct instead.
+  crossLists = warn ''
+    lib.crossLists is deprecated, use lib.mapCartesianProduct instead.
 
     For example, the following function call:
 

lib/meta.nix

@@ -475,7 +475,7 @@ rec {
       "lib.meta.getExe': The first argument is of type ${typeOf x}, but it should be a derivation instead.";
     assert assertMsg (isString y)
       "lib.meta.getExe': The second argument is of type ${typeOf y}, but it should be a string instead.";
-    assert assertMsg (match ".*\/.*" y == null)
+    assert assertMsg (match ".*/.*" y == null)
       "lib.meta.getExe': The second argument \"${y}\" is a nested path with a \"/\" character, but it should just be the name of the executable instead.";
     "${getBin x}/bin/${y}";
 }

lib/options.nix

@@ -426,7 +426,7 @@ rec {
     # If the part is a named placeholder of the form "<...>" don't escape it.
     # It may cause misleading escaping if somebody uses literally "<...>" in their option names.
     # This is the trade-off to allow for placeholders in option names.
-    isNamedPlaceholder = builtins.match "\<(.*)\>";
+    isNamedPlaceholder = builtins.match "<(.*)>";
     escapeOptionPart = part:
       if part == "*" || isNamedPlaceholder part != null
         then part

lib/strings-with-deps.nix

@@ -52,10 +52,81 @@ let
 in
 rec {
 
-  /* !!! The interface of this function is kind of messed up, since
-     it's way too overloaded and almost but not quite computes a
-     topological sort of the depstrings. */
+  /**
+    Topologically sort a collection of dependent strings.
+    Only the values to keys listed in `arg` and their dependencies will be included in the result.
+
+    ::: {.note}
+    This function doesn't formally fulfill the definition of topological sorting, but it's good enough for our purposes in Nixpkgs.
+    :::
+
+    # Inputs
+
+    `predefined` (attribute set)
+
+    : strings with annotated dependencies (strings or attribute set)
+      A value can be a simple string if it has no dependencies.
+      Otherwise, is can be an attribute set with the following attributes:
+      - `deps` (list of strings)
+      - `text` (Any
+
+    `arg` (list of strings)
+
+    : Keys for which the values in the dependency closure will be included in the result
+
+    # Type
+
+    ```
+    textClosureList :: { ${phase} :: { deps :: [String]; text :: String; } | String; } -> [String] -> [String]
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.stringsWithDeps.textClosureList` usage example
+
+    ```nix
+    textClosureList {
+      a = {
+        deps = [ "b" "c" "e" ];
+        text = "a: depends on b, c and e";
+      };
+      b = {
+        deps = [ ];
+        text = "b: no dependencies";
+      };
+      c = {
+        deps = [ "b" ];
+        text = "c: depends on b";
+      };
+      d = {
+        deps = [ "c" ];
+        text = "d: not being depended on by anything in `arg`";
+      };
+      e = {
+        deps = [ "c" ];
+        text = "e: depends on c, depended on by a, not in `arg`";
+      };
+    } [
+      "a"
+      "b"
+      "c"
+    ]
+    => [
+      "b: no dependencies"
+      "c: depends on b"
+      "e: depends on c, depended on by a, not in `arg`"
+      "a: depends on b, c and e"
+    ]
+    ```
+    :::
+
+    Common real world usages are:
+    - Ordering the dependent phases of `system.activationScripts`
+    - Ordering the dependent phases of `system.userActivationScripts`
+
+    For further examples see: [NixOS activation script](https://nixos.org/manual/nixos/stable/#sec-activation-script)
 
+  */
   textClosureList = predefined: arg:
     let
       f = done: todo:

lib/tests/modules/strMatching-merge.nix

@@ -3,12 +3,12 @@
   imports = [
     {
       options.sm = lib.mkOption {
-        type = lib.types.strMatching "\(.*\)";
+        type = lib.types.strMatching "\\(.*\\)";
       };
     }
     {
       options.sm = lib.mkOption {
-        type = lib.types.strMatching "\(.*\)";
+        type = lib.types.strMatching "\\(.*\\)";
       };
     }
   ];

maintainers/maintainer-list.nix

@@ -2138,6 +2138,11 @@
     name = "aszlig";
     keys = [ { fingerprint = "DD52 6BC7 767D BA28 16C0 95E5 6840 89CE 67EB B691"; } ];
   };
+  atagen = {
+    name = "atagen";
+    github = "atagen";
+    githubId = 11548989;
+  };
   atalii = {
     email = "[email protected]";
     github = "atalii";
@@ -4291,6 +4296,12 @@
     githubId = 71959829;
     name = "Cleeyv";
   };
+  clemjvdm = {
+    email = "[email protected]";
+    github = "clemjvdm";
+    githubId = 131002498;
+    name = "clement";
+  };
   clerie = {
     email = "[email protected]";
     github = "clerie";
@@ -13629,6 +13640,12 @@
     githubId = 7910815;
     name = "Alex McGrath";
   };
+  lyn = {
+    name = "Lyn";
+    matrix = "@lynatic:catgirl.cloud";
+    github = "lynatic1337";
+    githubId = 39234676;
+  };
   lyndeno = {
     name = "Lyndon Sanche";
     email = "[email protected]";
@@ -18541,8 +18558,8 @@
   };
   pwnwriter = {
     name = "Nabeen Tiwaree";
-    email = "hey@pwnwriter.xyz";
-    keys = [ { fingerprint = "B681 763F 9B5B DF27 9A13  9E0C 0544 A89B C519 20AA"; } ];
+    email = "hi@pwnwriter.me";
+    keys = [ { fingerprint = "C153 DE7C 0A0D 432E F033  2B0B A524 11EC 5582 DE3A"; } ];
     github = "pwnwriter";
     githubId = 90331517;
   };
@@ -20349,6 +20366,11 @@
     githubId = 3958212;
     name = "Tom Sorlie";
   };
+  scd31 = {
+    name = "scd31";
+    github = "scd31";
+    githubId = 57571338;
+  };
   schinmai-akamai = {
     email = "[email protected]";
     github = "tchinmai7";
@@ -25027,6 +25049,12 @@
     githubId = 58453832;
     keys = [ { fingerprint = "FD0A C425 9EF5 4084 F99F 9B47 2ACC 9749 7C68 FAD4"; } ];
   };
+  yechielw = {
+    name = "yechielw";
+    email = "[email protected]";
+    github = "yechielw";
+    githubId = 41305372;
+  };
   yelite = {
     name = "Lite Ye";
     email = "[email protected]";

maintainers/scripts/nixpkgs-lint.nix

@@ -28,10 +28,10 @@ stdenv.mkDerivation {
     wrapProgram $out/bin/nixpkgs-lint --set PERL5LIB $PERL5LIB
   '';
 
-  meta = with lib; {
-    maintainers = [ maintainers.eelco ];
+  meta = {
+    maintainers = [ lib.maintainers.eelco ];
     description = "A utility for Nixpkgs contributors to check Nixpkgs for common errors";
     mainProgram = "nixpkgs-lint";
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
   };
 }

nixos/doc/manual/development/settings-options.section.md

@@ -343,6 +343,12 @@ have a predefined type and string generator already declared under
     and returning a set with TOML-specific attributes `type` and
     `generate` as specified [below](#pkgs-formats-result).
 
+`pkgs.formats.cdn` { }
+
+:   A function taking an empty attribute set (for future extensibility)
+    and returning a set with [CDN](https://github.com/dzikoysk/cdn)-specific
+    attributes `type` and `generate` as specified [below](#pkgs-formats-result).
+
 `pkgs.formats.elixirConf { elixir ? pkgs.elixir }`
 
 :   A function taking an attribute set with values

nixos/doc/manual/redirects.json

@@ -875,6 +875,12 @@
   "module-services-networking-dnsmasq-references": [
     "index.html#module-services-networking-dnsmasq-references"
   ],
+  "module-service-doh-server": [
+    "index.html#module-service-doh-server"
+  ],
+  "module-service-doh-server-quick-start": [
+    "index.html#module-service-doh-server-quick-start"
+  ],
   "module-services-samba": [
     "index.html#module-services-samba"
   ],

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -53,6 +53,8 @@
 
 - [networking.modemmanager](options.html#opt-networking.modemmanager) has been split out of [networking.networkmanager](options.html#opt-networking.networkmanager). NetworkManager still enables ModemManager by default, but options exist now to run NetworkManager without ModemManager.
 
+- [doh-server](https://github.com/m13253/dns-over-https), a high performance DNS over HTTPS server. Available as [services.doh-server](options.html#opt-services.doh-server.enable).
+
 - [ncps](https://github.com/kalbasit/ncps), a Nix binary cache proxy service implemented in Go using [go-nix](https://github.com/nix-community/go-nix). Available as [services.ncps](options.html#opt-services.ncps.enable).
 
 - [Conduwuit](https://conduwuit.puppyirl.gay/), a federated chat server implementing the Matrix protocol, forked from Conduit. Available as [services.conduwuit](#opt-services.conduwuit.enable).
@@ -154,6 +156,10 @@
   access or want to access home directory via `killHook`, hardening setting can
   be changed via, e.g. `systemd.services.earlyoom.serviceConfig.ProtectSystem`.
 
+  `services.earlyoom.extraArgs` is now shell-escaped for each element without
+  word-breaking. So you want to write `extraArgs = [ "--prefer" "spaced pat" ]`
+  rather than previous `extraArgs = [ "--prefer 'spaced pat'" ]`.
+
 - `nodePackages.vls` has been deprecated, as the upstream consumer of it, vetur, has been deprecated by upstream. Upstream suggests migrating to Volar for Vue LSP tooling instead.
 
 - `nodePackages.create-react-native-app` has been removed, as it is deprecated. Upstream suggests using a framework for React Native apps instead.
@@ -336,6 +342,9 @@
 
 - `bind.cacheNetworks` now only controls access for recursive queries, where it previously controlled access for all queries.
 
+- The paperless module now has an option for regular automatic export of
+  documents data using the integrated document exporter.
+
 - Caddy can now be built with plugins by using `caddy.withPlugins`, a `passthru` function that accepts an attribute set as a parameter. The `plugins` argument represents a list of Caddy plugins, with each Caddy plugin being a versioned module. The `hash` argument represents the `vendorHash` of the resulting Caddy source code with the plugins added.
 
   Example:

nixos/lib/test-driver/src/test_driver/__init__.py

@@ -145,7 +145,7 @@ def main() -> None:
             tic = time.time()
             driver.run_tests()
             toc = time.time()
-            logger.info(f"test script finished in {(toc-tic):.2f}s")
+            logger.info(f"test script finished in {(toc - tic):.2f}s")
 
 
 def generate_driver_symbols() -> None:

nixos/lib/test-driver/src/test_driver/machine.py

@@ -702,8 +702,7 @@ def wait_for_qmp_event(
 
     def get_tty_text(self, tty: str) -> str:
         status, output = self.execute(
-            f"fold -w$(stty -F /dev/tty{tty} size | "
-            f"awk '{{print $2}}') /dev/vcs{tty}"
+            f"fold -w$(stty -F /dev/tty{tty} size | awk '{{print $2}}') /dev/vcs{tty}"
         )
         return output
 

nixos/modules/hardware/video/nvidia.nix

@@ -17,7 +17,7 @@ let
   offloadCfg = pCfg.offload;
   reverseSyncCfg = pCfg.reverseSync;
   primeEnabled = syncCfg.enable || reverseSyncCfg.enable || offloadCfg.enable;
-  busIDType = lib.types.strMatching "([[:print:]]+[\:\@][0-9]{1,3}\:[0-9]{1,2}\:[0-9])?";
+  busIDType = lib.types.strMatching "([[:print:]]+[:@][0-9]{1,3}:[0-9]{1,2}:[0-9])?";
   ibtSupport = useOpenModules || (nvidia_x11.ibtSupport or false);
   settingsFormat = pkgs.formats.keyValue { };
 in

nixos/modules/installer/cd-dvd/iso-image.nix

@@ -870,6 +870,7 @@ in
     # Create the ISO image.
     image.extension = if config.isoImage.compressImage then "iso.zst" else "iso";
     image.filePath = "iso/${config.image.fileName}";
+    image.baseName = "nixos${lib.optionalString (config.isoImage.edition != "") "-${config.isoImage.edition}" }-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}";
     system.build.image = config.system.build.isoImage;
     system.build.isoImage = pkgs.callPackage ../../../lib/make-iso9660-image.nix ({
       inherit (config.isoImage) compressImage volumeID contents;

nixos/modules/misc/version.nix

@@ -24,7 +24,7 @@ let
     ;
 
   needsEscaping = s: null != builtins.match "[a-zA-Z0-9]+" s;
-  escapeIfNecessary = s: if needsEscaping s then s else ''"${lib.escape [ "\$" "\"" "\\" "\`" ] s}"'';
+  escapeIfNecessary = s: if needsEscaping s then s else ''"${lib.escape [ "$" "\"" "\\" "`" ] s}"'';
   attrsToText =
     attrs:
     concatStringsSep "\n" (mapAttrsToList (n: v: ''${n}=${escapeIfNecessary (toString v)}'') attrs)