diff --git a/doc/languages-frameworks/haskell.section.md b/doc/languages-frameworks/haskell.section.md index d9246994676d5..f81c1b77d84ed 100644 --- a/doc/languages-frameworks/haskell.section.md +++ b/doc/languages-frameworks/haskell.section.md @@ -260,6 +260,14 @@ the same package with the `previousIntermediates` argument to support incremental builds. See [“Incremental builds”](#haskell-incremental-builds) for more information. Defaults to `false`. +`dontConvertCabalFileToUnix` +: By default, `haskellPackages.mkDerivation` converts the `.cabal` file of a +given package to Unix line endings. +This is intended to work around +[Hackage converting revised `.cabal` files to DOS line endings](https://github.com/haskell/hackage-server/issues/316) +which frequently causes patches to stop applying. +You can pass `true` to disable this behavior. + `enableLibraryProfiling` : Whether to enable [profiling][profiling] for libraries contained in the package. Enabled by default if supported. @@ -1249,8 +1257,8 @@ it does for the unstable branches. ### Why is topic X not covered in this section? Why is section Y missing? {#haskell-why-not-covered} We have been working on [moving the nixpkgs Haskell documentation back into the -nixpkgs manual](https://github.com/NixOS/nixpkgs/issues/121403). Since this -process has not been completed yet, you may find some topics missing here +nixpkgs manual](https://github.com/NixOS/nixpkgs/issues/121403). +Since this process has not been completed yet, you may find some topics missing here covered in the old [haskell4nix docs](https://haskell4nix.readthedocs.io/). If you feel any important topic is not documented at all, feel free to comment diff --git a/doc/redirects.json b/doc/redirects.json index f04c437298455..2570eec68018e 100644 --- a/doc/redirects.json +++ b/doc/redirects.json @@ -119,6 +119,12 @@ "inkscape-plugins": [ "index.html#inkscape-plugins" ], + "libcxxhardeningextensive": [ + "index.html#libcxxhardeningextensive" + ], + "libcxxhardeningfast": [ + "index.html#libcxxhardeningfast" + ], "julec-hook": [ "index.html#julec-hook" ], @@ -247,6 +253,9 @@ "sec-building-packages-with-llvm-using-clang-stdenv": [ "index.html#sec-building-packages-with-llvm-using-clang-stdenv" ], + "sec-darwin-availability-checks": [ + "index.html#sec-darwin-availability-checks" + ], "sec-darwin-libcxx-deployment-targets": [ "index.html#sec-darwin-libcxx-deployment-targets" ], @@ -1242,7 +1251,8 @@ "index.html#sec-purity-in-nixpkgs" ], "sec-hardening-in-nixpkgs": [ - "index.html#sec-hardening-in-nixpkgs" + "index.html#sec-hardening-in-nixpkgs", + "index.html#pie" ], "sec-hardening-flags-enabled-by-default": [ "index.html#sec-hardening-flags-enabled-by-default" @@ -1277,9 +1287,6 @@ "sec-hardening-flags-disabled-by-default": [ "index.html#sec-hardening-flags-disabled-by-default" ], - "pie": [ - "index.html#pie" - ], "shadowstack": [ "index.html#shadowstack" ], diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md index c36007dad49f3..2a9912f269fcb 100644 --- a/doc/release-notes/rl-2511.section.md +++ b/doc/release-notes/rl-2511.section.md @@ -12,6 +12,18 @@ - The default GHC version has been updated from 9.8 to 9.10. `haskellPackages` correspondingly uses Stackage LTS 24 (instead of LTS 23) as a baseline. +- **This release of Nixpkgs requires macOS Sonoma 14.0 or newer, as announced in the 25.05 release notes.** + The default SDK is now 14.4, but the minimum version is 14.0. + cc-wrapper will enforce that availability annotations are used or an appropriate deployment target is set. + See the Darwin platform notes for details. + +- **We expect to drop support for `x86_64-darwin` by Nixpkgs 26.11,** in light of Apple’s announcement that macOS 26 will be the final version to support Intel Macs. + When support is fully removed, we will no longer build packages for the platform or guarantee that it can build at all. + This may happen in stages, depending on our available build and maintenance resources and decisions made by projects we rely on. + + By the time of 26.11’s release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time. + We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028. + - Darwin has switched to using the system libc++. This was done for improved compatibility and to avoid ODR violations. If a newer C++ library feature is not available on the default deployment target, you will need to increase the deployment target. See the Darwin platform documentation for more details. @@ -49,6 +61,8 @@ - GHC 8.6, 8.10, 9.0, 9.2, and their package sets have been removed. +- The `haskellPackages.mkDerivation` builder now converts packages' cabal files to Unix line endings before `patchPhase`. This behavior can be disabled using `dontConvertCabalFileToUnix`. + - `webkitgtk_4_0` has been removed because it depends on an unmaintained version of security-critical libsoup library (`libsoup_2`) and the support will be [dropped upstream soon](https://webkitgtk.org/2025/10/07/webkitgtk-soup2-deprecation.html). - Support for bootstrapping native GHC compilers on 32‐bit ARM and little‐endian 64‐bit PowerPC has been dropped. @@ -104,6 +118,8 @@ - `forgejo` main program has been renamed to `bin/forgejo` from the previous `bin/gitea`. +- the "pie" hardening flag has been removed. compilers are expected to enable PIE by default, as has been common practice since 2016 outside of nixpkgs. If a package needs "pie" disabled pass `-no-pie` in `CFLAGS`. It is unlikely this will be necessary in many cases; due to the prevalance of default PIE toolchains most packages incompatible with PIE already pass no-pie. + - `wayclip` now uses the `ext-data-control-v1` Wayland protocol instead of `wlr-data-control-unstable-v1`. - `cudaPackages.cudatoolkit-legacy-runfile` has been removed. @@ -154,6 +170,8 @@ - `meilisearch_1_11` has been removed, as it is no longer supported. +- `budgie-desktop` has been updated [10.9.4](https://github.com/BuddiesOfBudgie/budgie-desktop/releases/tag/v10.9.4). This changes `XDG_CURRENT_DESKTOP` from `Budgie:GNOME` to `Budgie` and contains ABI bumps for libpeas2 migration. + - Greetd and its original greeters (`tuigreet`, `gtkgreet`, `qtgreet`, `regreet`, `wlgreet`) were moved from `greetd` namespace to top level (`greetd.tuigreet` -> `tuigreet`, `greetd.greetd` -> `greetd`, etc). The original attrs are available for compatibility as passthrus of `greetd`, but will emit a warning. They will be removed in future releases. - `carla` no longer support `gtk2` override. @@ -217,9 +235,10 @@ - `podofo` has been updated from `0.9.8` to `1.0.0`. These releases are by nature very incompatible due to major API changes. The legacy versions can be found under `podofo_0_10` and `podofo_0_9`. Changelog: https://github.com/podofo/podofo/blob/1.0.0/CHANGELOG.md, API-Migration-Guide: https://github.com/podofo/podofo/blob/1.0.0/API-MIGRATION.md. -- NetBox was updated to `>= 4.3.0`. Have a look at the breaking changes - of the [4.3 release](https://github.com/netbox-community/netbox/releases/tag/v4.2.0), - make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_3;` in your configuration. +- NetBox was updated to `>= 4.4.0`. Have a look at the breaking changes + of the [4.3 release](https://github.com/netbox-community/netbox/releases/tag/v4.3.0) + and the [4.4 release](https://github.com/netbox-community/netbox/releases/tag/v4.4.0), + make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_4;` in your configuration. - `privatebin` has been updated to `2.0.0`. This release changes configuration defaults including switching the template and removing legacy features. See the [v2.0.0 changelog entry](https://github.com/PrivateBin/PrivateBin/releases/tag/2.0.0) for details on how to upgrade. @@ -277,6 +296,8 @@ - Added `gitConfig` and `gitConfigFile` option to the nixpkgs `config`, to allow for setting a default `gitConfigFile` for all `fetchgit` invocations. +- Added `npmRegistryOverrides` and `npmRegistryOverridesString` option to the nixpkgs `config`, to allow for setting a default `npmRegistryOverridesString` for all `fetchNpmDeps` invocations. + - The `dockerTools.streamLayeredImage` builder now uses a better algorithm for generating layered docker images, such that much more sharing is possible when the number of store paths exceeds the layer limit. It gives each of the largest store paths its own layer and adds dependencies to those layers when they aren't used elsewhere. - The systemd initrd will now respect `x-systemd.wants` and `x-systemd.requires` for reliably unlocking multi-disk bcachefs volumes. @@ -297,7 +318,7 @@ - `idris2` supports being instantiated with a package environment with `idris.withPackages (p: [ ])` -- New hardening flags, `strictflexarrays1` and `strictflexarrays3` were made available, corresponding to the gcc/clang options `-fstrict-flex-arrays=1` and `-fstrict-flex-arrays=3` respectively. +- New hardening flags `strictflexarrays1`, `strictflexarrays3`, `glibcxxassertions`, `libcxxhardeningfast` and `libcxxhardeningextensive` were made available. - `gramps` has been updated to 6.0.0 Upstream recommends [backing up your Family Trees](https://gramps-project.org/wiki/index.php/Gramps_6.0_Wiki_Manual_-_Manage_Family_Trees#Backing_up_a_Family_Tree) before upgrading. @@ -322,8 +343,6 @@ and beware that the migration may take several hours depending on your library size and state. The process must not be interrupted. -- A new hardening flag, `glibcxxassertions` was made available, corresponding to the glibc `_GLIBCXX_ASSERTIONS` option. - - `versionCheckHook`: Packages that previously relied solely on `pname` to locate the program used to version check, but have a differing `meta.mainProgram` entry, might now fail. @@ -340,6 +359,8 @@ - `nix-prefetch-git`: Added a `--no-add-path` argument to disable adding the path to the store; this is useful when working with a [read-only store](https://nix.dev/manual/nix/2.28/command-ref/new-cli/nix3-help-stores#store-experimental-local-overlay-store-read-only). +- `fetchNpmDeps`: Add `npmRegistryOverridesString` argument to pass NPM registry overrides to the fetcher. + - `sftpman` has been updated to version 2, a rewrite in Rust which is mostly backward compatible but does include some changes to the CLI. For more information, [check the project's README](https://github.com/spantaleev/sftpman-rs#is-sftpman-v2-compatible-with-sftpman-v1). diff --git a/doc/stdenv/platform-notes.chapter.md b/doc/stdenv/platform-notes.chapter.md index 06662bbc76fa5..99d7cf33fa486 100644 --- a/doc/stdenv/platform-notes.chapter.md +++ b/doc/stdenv/platform-notes.chapter.md @@ -47,6 +47,17 @@ See below for how to use a newer deployment target. For example, `std::print` depends on features that are only available on macOS 13.3 or newer. To make them available, set the deployment target to 13.3 using `darwinMinVersionHook`. +#### Package fails to build due to missing API availability checks {#sec-darwin-availability-checks} + +This is normally a bug in the package or a misconfigured deployment target. +* If it is using an API from a newer release (e.g., from macOS 26.0 while targeting macOS 14.0), it needs to use an availability check. + The code should be patched to use [`__builtin_available`](https://clang.llvm.org/docs/LanguageExtensions.html#objective-c-available). + Note that while the linked documentation is for Objective-C, it is applicable to C and C++ except that you use `__builtin_available` in place of `@available`. +* If the package intends to require the newer platform (i.e., it does not support running on older versions with reduced functionality), use `darwinMinVersionHook` to set the deployment target to the required version. + See below for how to use a newer deployment target. +* If the package actually handles this through some other mechanism (e.g., MoltenVK relies on the running platform’s MSL version), the error can be suppressed. + To suppress the error, add `-Wno-error=unguarded-availability` to `env.NIX_CFLAGS_COMPILE`. + #### Package requires a non-default SDK or fails to build due to missing frameworks or symbols {#sec-darwin-troubleshooting-using-sdks} In some cases, you may have to use a non-default SDK. @@ -106,13 +117,10 @@ The following is a list of Xcode versions, the SDK version in Nixpkgs, and the a Check your package’s documentation (platform support or installation instructions) to find which Xcode or SDK version to use. Generally, only the last SDK release for a major version is packaged. -| Xcode version | SDK version | Nixpkgs attribute | -|--------------------|--------------------|------------------------------| -| 12.0–12.5.1 | 11.3 | `apple-sdk_11` / `apple-sdk` | -| 13.0–13.4.1 | 12.3 | `apple-sdk_12` | -| 14.0–14.3.1 | 13.3 | `apple-sdk_13` | -| 15.0–15.4 | 14.4 | `apple-sdk_14` | -| 16.0 | 15.0 | `apple-sdk_15` | +| Xcode version | SDK version | Nixpkgs attribute | +|--------------------|--------------------|-------------------------------| +| 15.0–15.4 | 14.4 | `apple-sdk_14` / `apple-sdk` | +| 16.0 | 15.0 | `apple-sdk_15` | #### Darwin Default SDK versions {#sec-darwin-troubleshooting-darwin-defaults} diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md index 24536c35b2c3f..2a0b239740c05 100644 --- a/doc/stdenv/stdenv.chapter.md +++ b/doc/stdenv/stdenv.chapter.md @@ -1631,19 +1631,6 @@ The following flags are disabled by default and should be enabled with `hardenin This flag adds the `-fno-strict-aliasing` compiler option, which prevents the compiler from assuming code has been written strictly following the standard in regards to pointer aliasing and therefore performing optimizations that may be unsafe for code that has not followed these rules. -#### `pie` {#pie} - -This flag is disabled by default for normal `glibc` based NixOS package builds, but enabled by default for - - - `musl`-based package builds, except on Aarch64 and Aarch32, where there are issues. - - - Statically-linked for OpenBSD builds, where it appears to be required to get a working binary. - -Adds the `-fPIE` compiler and `-pie` linker options. Position Independent Executables are needed to take advantage of Address Space Layout Randomization, supported by modern kernel versions. While ASLR can already be enforced for data areas in the stack and heap (brk and mmap), the code areas must be compiled as position-independent. Shared libraries already do this with the `pic` flag, so they gain ASLR automatically, but binary .text regions need to be build with `pie` to gain ASLR. When this happens, ROP attacks are much harder since there are no static locations to bounce off of during a memory corruption attack. - -Static libraries need to be compiled with `-fPIE` so that executables can link them in with the `-pie` linker option. -If the libraries lack `-fPIE`, you will get the error `recompile with -fPIE`. - #### `strictflexarrays1` {#strictflexarrays1} This flag adds the `-fstrict-flex-arrays=1` compiler option, which reduces the cases the compiler treats as "flexible arrays" to those declared with length `[1]`, `[0]` or (the correct) `[]`. This increases the coverage of fortify checks, because such arrays declared as the trailing element of a structure can normally not have their intended length determined by the compiler. @@ -1688,6 +1675,18 @@ Adds the `-D_GLIBCXX_ASSERTIONS` compiler flag. This flag only has an effect on These checks may have an impact on performance in some cases. +#### `libcxxhardeningfast` {#libcxxhardeningfast} + +Adds the `-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_FAST` compiler flag. This flag only has an effect on libc++ targets, and when defined, enables a set of assertions that prevent undefined behavior caused by violating preconditions of the standard library. libc++ provides several hardening modes, and this "fast" mode contains a set of security-critical checks that can be done with relatively little overhead in constant time. + +Disabling `libcxxhardeningfast` implies disablement of checks from `libcxxhardeningextensive`. + +#### `libcxxhardeningextensive` {#libcxxhardeningextensive} + +Adds the `-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE` compiler flag. This flag only has an effect on libc++ targets, and when defined, enables a set of assertions that prevent undefined behavior caused by violating preconditions of the standard library. libc++ provides several hardening modes, and this "extensive" mode adds checks for undefined behavior that incur relatively little overhead but aren’t security-critical. The additional rigour impacts performance more than fast mode: benchmarking is recommended to determine if it is acceptable for a particular application. + +Enabling this flag implies enablement of checks from `libcxxhardeningfast`. Disabling this flag does not imply disablement of checks from `libcxxhardeningfast`. + #### `pacret` {#pacret} This flag adds the `-mbranch-protection=pac-ret` compiler option on aarch64-linux targets. This uses ARM v8.3's Pointer Authentication feature to sign function return pointers before adding them to the stack. The pointer's authenticity is then validated before returning to its destination. This dramatically increases the difficulty of ROP exploitation techniques. diff --git a/lib/systems/default.nix b/lib/systems/default.nix index 96bde04151ae5..cd1448d811fa3 100644 --- a/lib/systems/default.nix +++ b/lib/systems/default.nix @@ -360,8 +360,8 @@ let null; # The canonical name for this attribute is darwinSdkVersion, but some # platforms define the old name "sdkVer". - darwinSdkVersion = final.sdkVer or "11.3"; - darwinMinVersion = final.darwinSdkVersion; + darwinSdkVersion = final.sdkVer or "14.4"; + darwinMinVersion = "14.0"; darwinMinVersionVariable = if final.isMacOS then "MACOSX_DEPLOYMENT_TARGET" diff --git a/maintainers/scripts/haskell/update-stackage.sh b/maintainers/scripts/haskell/update-stackage.sh index 0889f7e1d9ed1..e049064c7564c 100755 --- a/maintainers/scripts/haskell/update-stackage.sh +++ b/maintainers/scripts/haskell/update-stackage.sh @@ -99,6 +99,11 @@ sed -r \ -e '/ Agda /d' \ -e '/ stack /d' \ -e '/ git-annex /d' \ + -e '/ hledger /d' \ + -e '/ hledger-iadd /d' \ + -e '/ hledger-lib /d' \ + -e '/ hledger-ui /d' \ + -e '/ hledger-web /d' \ < "${tmpfile_new}" >> $stackage_config # Explanations: # cabal2nix, distribution-nixpkgs, jailbreak-cabal, language-nix: These are our packages and we know what we are doing. diff --git a/maintainers/scripts/update.py b/maintainers/scripts/update.py index 10d197d5fe784..ca35f04d1285f 100644 --- a/maintainers/scripts/update.py +++ b/maintainers/scripts/update.py @@ -92,7 +92,15 @@ async def attr_instantiation_worker( ) -> tuple[Path, str]: async with semaphore: eprint(f"Instantiating {attr_path}…") - return (await nix_instantiate(attr_path), attr_path) + try: + return (await nix_instantiate(attr_path), attr_path) + except Exception as e: + # Failure should normally terminate the script but + # looks like Python is buggy so we need to do it ourselves. + eprint(f"Failed to instantiate {attr_path}") + if e.stderr: + eprint(e.stderr.decode("utf-8")) + sys.exit(1) async def requisites_worker( diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md index a1877303f482c..53bdbabb45c99 100644 --- a/nixos/doc/manual/release-notes/rl-2511.section.md +++ b/nixos/doc/manual/release-notes/rl-2511.section.md @@ -22,6 +22,16 @@ - COSMIC DE has been updated to the beta version, bringing it closer to its first stable release. This includes updates to its core components, applications, and overall stability. +- GNOME has been updated to version 49. + + - Removes X11 session support. Though you can still run X11 apps using XWayland. + - gnome-session’s custom service manager was removed in favour of using systemd. + - GDM now allows multiple seats, which is useful for e.g. remote logins. Though we currently [limit this to five greeter instances](https://github.com/NixOS/nixpkgs/issues/458058). + - `papers` document viewer is now installed by default, replacing `evince`. Though we still include `evince` transitively by `sushi` (quick previewer used by Files/Nautilus) You can disable either using [](#opt-environment.gnome.excludePackages) and restore `evince` with [](#opt-programs.evince.enable). + - `showtime` video player is now installed by default, replacing `totem`. You can disable it using [](#opt-environment.gnome.excludePackages) and restore `totem` with [](#opt-environment.systemPackages). + + Refer to the [GNOME release notes](https://release.gnome.org/49/) for more details. + ## New Modules {#sec-release-25.11-new-modules} diff --git a/nixos/modules/config/vte.nix b/nixos/modules/config/vte.nix index f7c639b627a02..75ac3bae4be37 100644 --- a/nixos/modules/config/vte.nix +++ b/nixos/modules/config/vte.nix @@ -9,7 +9,7 @@ let vteInitSnippet = '' # Show current working directory in VTE terminals window title. # Supports both bash and zsh, requires interactive shell. - . ${pkgs.vte.override { gtkVersion = null; }}/etc/profile.d/vte.sh + . ${pkgs.vte-gtk4}/etc/profile.d/vte.sh ''; in diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 79fb9e5885b29..4e385e1ac4853 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -569,6 +569,7 @@ ./services/desktops/gnome/gnome-online-miners.nix ./services/desktops/gnome/gnome-remote-desktop.nix ./services/desktops/gnome/gnome-settings-daemon.nix + ./services/desktops/gnome/gnome-software.nix ./services/desktops/gnome/gnome-user-share.nix ./services/desktops/gnome/localsearch.nix ./services/desktops/gnome/rygel.nix diff --git a/nixos/modules/services/accessibility/orca.nix b/nixos/modules/services/accessibility/orca.nix index 3fe205498bfe6..2ae7c4514edd9 100644 --- a/nixos/modules/services/accessibility/orca.nix +++ b/nixos/modules/services/accessibility/orca.nix @@ -20,9 +20,7 @@ in config = mkIf cfg.enable { environment.systemPackages = [ cfg.package ]; - systemd.services.display-manager = lib.mkIf config.services.displayManager.enable { - path = [ cfg.package ]; - }; + systemd.packages = [ cfg.package ]; services.speechd.enable = true; }; } diff --git a/nixos/modules/services/desktop-managers/gnome.nix b/nixos/modules/services/desktop-managers/gnome.nix index 91f4002e59d76..faa5085cc9e7a 100644 --- a/nixos/modules/services/desktop-managers/gnome.nix +++ b/nixos/modules/services/desktop-managers/gnome.nix @@ -232,7 +232,7 @@ in environment.gnome.excludePackages = mkOption { default = [ ]; - example = literalExpression "[ pkgs.totem ]"; + example = literalExpression "[ pkgs.showtime ]"; type = types.listOf types.package; description = "Which packages gnome should exclude from the default environment"; }; @@ -297,8 +297,12 @@ in systemd.packages = [ pkgs.gnome-flashback + pkgs.metacity + (pkgs.gnome-panel-with-modules.override { + panelModulePackages = cfg.flashback.panelModulePackages; + }) ] - ++ map pkgs.gnome-flashback.mkSystemdTargetForWm flashbackWms; + ++ map pkgs.gnome-flashback.mkSystemdTargetForWm cfg.flashback.customSessions; environment.systemPackages = [ pkgs.gnome-flashback @@ -311,9 +315,7 @@ in wm: pkgs.gnome-flashback.mkWmApplication { inherit (wm) wmName wmLabel wmCommand; } ) flashbackWms) # For /share/pkgs.gnome-session/sessions/gnome-flashback-${wmName}.session - ++ (map ( - wm: pkgs.gnome-flashback.mkGnomeSession { inherit (wm) wmName wmLabel enableGnomePanel; } - ) flashbackWms); + ++ (map (wm: pkgs.gnome-flashback.mkGnomeSession { inherit (wm) wmName wmLabel; }) flashbackWms); }) (lib.mkIf serviceCfg.core-os-services.enable { @@ -444,50 +446,49 @@ in # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-48/elements/core/meta-gnome-core-apps.bst (lib.mkIf serviceCfg.core-apps.enable { - environment.systemPackages = utils.removePackagesByName ( - [ - pkgs.baobab - pkgs.decibels - pkgs.epiphany - pkgs.gnome-text-editor - pkgs.gnome-calculator - pkgs.gnome-calendar - pkgs.gnome-characters - pkgs.gnome-clocks - pkgs.gnome-console - pkgs.gnome-contacts - pkgs.gnome-font-viewer - pkgs.gnome-logs - pkgs.gnome-maps - pkgs.gnome-music - pkgs.gnome-system-monitor - pkgs.gnome-weather - pkgs.loupe - pkgs.nautilus - pkgs.gnome-connections - pkgs.simple-scan - pkgs.snapshot - pkgs.totem - pkgs.yelp - ] - ++ lib.optionals config.services.flatpak.enable [ - # Since PackageKit Nix support is not there yet, - # only install gnome-software if flatpak is enabled. - pkgs.gnome-software - ] - ) config.environment.gnome.excludePackages; + environment.systemPackages = utils.removePackagesByName [ + pkgs.baobab + pkgs.decibels + pkgs.epiphany + pkgs.gnome-text-editor + pkgs.gnome-calculator + pkgs.gnome-calendar + pkgs.gnome-characters + pkgs.gnome-clocks + pkgs.gnome-console + pkgs.gnome-contacts + pkgs.gnome-font-viewer + pkgs.gnome-logs + pkgs.gnome-maps + pkgs.gnome-music + pkgs.gnome-system-monitor + pkgs.gnome-weather + pkgs.loupe + pkgs.nautilus + pkgs.papers + pkgs.gnome-connections + pkgs.showtime + pkgs.simple-scan + pkgs.snapshot + pkgs.yelp + ] config.environment.gnome.excludePackages; # Enable default program modules # Since some of these have a corresponding package, we only # enable that program module if the package hasn't been excluded # through `environment.gnome.excludePackages` - programs.evince.enable = notExcluded pkgs.evince; programs.file-roller.enable = notExcluded pkgs.file-roller; programs.geary.enable = notExcluded pkgs.geary; programs.gnome-disks.enable = notExcluded pkgs.gnome-disk-utility; programs.seahorse.enable = notExcluded pkgs.seahorse; services.gnome.sushi.enable = notExcluded pkgs.sushi; + # Since PackageKit Nix support is not there yet, + # only install gnome-software if flatpak is enabled. + services.gnome.gnome-software.enable = lib.mkIf config.services.flatpak.enable ( + notExcluded pkgs.gnome-software + ); + # VTE shell integration for gnome-console programs.bash.vteIntegration = mkDefault true; programs.zsh.vteIntegration = mkDefault true; diff --git a/nixos/modules/services/desktops/gnome/gnome-initial-setup.nix b/nixos/modules/services/desktops/gnome/gnome-initial-setup.nix index e0241f02b9699..3df01b59738d5 100644 --- a/nixos/modules/services/desktops/gnome/gnome-initial-setup.nix +++ b/nixos/modules/services/desktops/gnome/gnome-initial-setup.nix @@ -77,9 +77,11 @@ in ]; systemd.user.targets."gnome-session".wants = [ - "gnome-initial-setup-copy-worker.service" "gnome-initial-setup-first-login.service" - "gnome-welcome-tour.service" + ]; + + systemd.user.targets."graphical-session-pre".wants = [ + "gnome-initial-setup-copy-worker.service" ]; systemd.user.targets."gnome-session@gnome-initial-setup".wants = [ @@ -89,6 +91,11 @@ in programs.dconf.profiles.gnome-initial-setup.databases = [ "${pkgs.gnome-initial-setup}/share/gnome-initial-setup/initial-setup-dconf-defaults" ]; + + users = { + # TODO: switch to using provided gnome-initial-setup sysusers.d + groups.gnome-initial-setup = { }; + }; }; } diff --git a/nixos/modules/services/desktops/gnome/gnome-software.nix b/nixos/modules/services/desktops/gnome/gnome-software.nix new file mode 100644 index 0000000000000..ced2549a9e212 --- /dev/null +++ b/nixos/modules/services/desktops/gnome/gnome-software.nix @@ -0,0 +1,28 @@ +{ + config, + pkgs, + lib, + ... +}: + +{ + meta = { + maintainers = lib.teams.gnome.members; + }; + + options = { + services.gnome.gnome-software = { + enable = lib.mkEnableOption "GNOME Software, package manager for GNOME"; + }; + }; + + config = lib.mkIf config.services.gnome.gnome-software.enable { + environment.systemPackages = [ + pkgs.gnome-software + ]; + + systemd.packages = [ + pkgs.gnome-software + ]; + }; +} diff --git a/nixos/modules/services/display-managers/gdm.nix b/nixos/modules/services/display-managers/gdm.nix index bdf1822c48162..cd8a168c73478 100644 --- a/nixos/modules/services/display-managers/gdm.nix +++ b/nixos/modules/services/display-managers/gdm.nix @@ -183,10 +183,44 @@ in name = "gdm"; uid = config.ids.uids.gdm; group = "gdm"; - home = "/run/gdm"; description = "GDM user"; }; + users.users.gdm-greeter = { + isSystemUser = true; + uid = 60578; + group = "gdm"; + home = "/run/gdm"; + }; + + users.users.gdm-greeter-1 = { + isSystemUser = true; + uid = 60579; + group = "gdm"; + home = "/run/gdm-1"; + }; + + users.users.gdm-greeter-2 = { + isSystemUser = true; + uid = 60580; + group = "gdm"; + home = "/run/gdm-2"; + }; + + users.users.gdm-greeter-3 = { + isSystemUser = true; + uid = 60581; + group = "gdm"; + home = "/run/gdm-3"; + }; + + users.users.gdm-greeter-4 = { + isSystemUser = true; + uid = 60582; + group = "gdm"; + home = "/run/gdm-4"; + }; + users.groups.gdm.gid = config.ids.gids.gdm; # GDM needs different xserverArgs, presumable because using wayland by default. @@ -348,15 +382,15 @@ in # GDM LFS PAM modules, adapted somehow to NixOS security.pam.services = { gdm-launch-environment.text = '' - auth required pam_succeed_if.so audit quiet_success user = gdm + auth required pam_succeed_if.so audit quiet_success user ingroup gdm auth optional pam_permit.so - account required pam_succeed_if.so audit quiet_success user = gdm + account required pam_succeed_if.so audit quiet_success user ingroup gdm account sufficient pam_unix.so password required pam_deny.so - session required pam_succeed_if.so audit quiet_success user = gdm + session required pam_succeed_if.so audit quiet_success user ingroup gdm session required pam_env.so conffile=/etc/pam/environment readenv=0 session optional ${config.systemd.package}/lib/security/pam_systemd.so session optional pam_keyinit.so force revoke diff --git a/nixos/modules/services/web-apps/netbox.nix b/nixos/modules/services/web-apps/netbox.nix index c61f217b4b68a..440c0e89a389f 100644 --- a/nixos/modules/services/web-apps/netbox.nix +++ b/nixos/modules/services/web-apps/netbox.nix @@ -109,10 +109,10 @@ in package = lib.mkOption { type = lib.types.package; default = - if lib.versionAtLeast config.system.stateVersion "25.11" then pkgs.netbox_4_3 else pkgs.netbox_4_2; + if lib.versionAtLeast config.system.stateVersion "25.11" then pkgs.netbox_4_4 else pkgs.netbox_4_2; defaultText = lib.literalExpression '' if lib.versionAtLeast config.system.stateVersion "25.11" - then pkgs.netbox_4_3 + then pkgs.netbox_4_4 else pkgs.netbox_4_2; ''; description = '' diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index ce0b086ccaf7b..a7ef6ac7faa7e 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -1019,6 +1019,7 @@ in netbox-upgrade = runTest ./web-apps/netbox-upgrade.nix; netbox_4_2 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_2; }; netbox_4_3 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_3; }; + netbox_4_4 = handleTest ./web-apps/netbox/default.nix { netbox = pkgs.netbox_4_4; }; netdata = runTest ./netdata.nix; networking.networkd = handleTest ./networking/networkd-and-scripted.nix { networkd = true; }; networking.networkmanager = handleTest ./networking/networkmanager.nix { }; diff --git a/nixos/tests/budgie.nix b/nixos/tests/budgie.nix index b003e1c652403..6fbf13ca9111c 100644 --- a/nixos/tests/budgie.nix +++ b/nixos/tests/budgie.nix @@ -42,13 +42,7 @@ in '' with subtest("Wait for login"): - # wait_for_x() checks graphical-session.target, which is expected to be - # inactive on Budgie before Budgie manages user session with systemd. - # https://github.com/BuddiesOfBudgie/budgie-desktop/blob/39e9f0895c978f76/src/session/budgie-desktop.in#L16 - # - # Previously this was unconditionally touched by xsessionWrapper but was - # changed in #233981 (we have Budgie:GNOME in XDG_CURRENT_DESKTOP). - # machine.wait_for_x() + machine.wait_for_x() machine.wait_until_succeeds('journalctl -t budgie-session-binary --grep "Entering running state"') machine.wait_for_file("${user.home}/.Xauthority") machine.succeed("xauth merge ${user.home}/.Xauthority") @@ -58,8 +52,9 @@ machine.succeed("getfacl -p /dev/dri/card0 | grep -q ${user.name}") with subtest("Check if Budgie session components actually start"): - for i in ["budgie-daemon", "budgie-panel", "budgie-wm", "budgie-desktop-view", "gsd-media-keys"]: - machine.wait_until_succeeds(f"pgrep -f {i}") + for i in ["budgie-daemon", "budgie-panel", "budgie-wm", "bsd-media-keys", "gsd-xsettings"]: + machine.wait_until_succeeds(f"pgrep {i}") + machine.wait_until_succeeds("pgrep -xf /run/current-system/sw/bin/org.buddiesofbudgie.budgie-desktop-view") # We don't check xwininfo for budgie-wm. # See https://github.com/NixOS/nixpkgs/pull/216737#discussion_r1155312754 machine.wait_for_window("budgie-daemon") @@ -67,7 +62,7 @@ with subtest("Check if various environment variables are set"): cmd = "xargs --null --max-args=1 echo < /proc/$(pgrep -xf /run/current-system/sw/bin/budgie-wm)/environ" - machine.succeed(f"{cmd} | grep 'XDG_CURRENT_DESKTOP' | grep 'Budgie:GNOME'") + machine.succeed(f"{cmd} | grep 'XDG_CURRENT_DESKTOP' | grep 'Budgie'") machine.succeed(f"{cmd} | grep 'BUDGIE_PLUGIN_DATADIR' | grep '${pkgs.budgie-desktop-with-plugins.pname}'") # From the nixos/budgie module machine.succeed(f"{cmd} | grep 'SSH_AUTH_SOCK' | grep 'gcr'") diff --git a/nixos/tests/gnome-flashback.nix b/nixos/tests/gnome-flashback.nix index 46cb6402bbb11..4f2c889eba887 100644 --- a/nixos/tests/gnome-flashback.nix +++ b/nixos/tests/gnome-flashback.nix @@ -26,8 +26,17 @@ services.desktopManager.gnome.enable = true; services.desktopManager.gnome.debug = true; - services.desktopManager.gnome.flashback.enableMetacity = true; - services.displayManager.defaultSession = "gnome-flashback-metacity"; + + services.desktopManager.gnome.flashback.customSessions = [ + { + # Intentionally a different name to test mkSystemdTargetForWm. + wmName = "metacitytest"; + wmLabel = "Metacity"; + wmCommand = "${pkgs.metacity}/bin/metacity"; + enableGnomePanel = true; + } + ]; + services.displayManager.defaultSession = "gnome-flashback-metacitytest"; }; testScript = @@ -40,7 +49,7 @@ '' with subtest("Login to GNOME Flashback with GDM"): machine.wait_for_x() - machine.wait_until_succeeds('journalctl -t gnome-session-binary --grep "Entering running state"') + machine.wait_until_succeeds('journalctl -t gnome-session-service --grep "Entering running state"') # Wait for alice to be logged in" machine.wait_for_unit("default.target", "${user.name}") machine.wait_for_file("${xauthority}") diff --git a/nixos/tests/login.nix b/nixos/tests/login.nix index ab80b8aaabf02..bd0d3b7bc0058 100644 --- a/nixos/tests/login.nix +++ b/nixos/tests/login.nix @@ -48,13 +48,12 @@ machine.wait_for_file("/home/alice/done") with subtest("Systemd gives and removes device ownership as needed"): - # Change back to /dev/snd/timer after systemd-258.1 - machine.succeed("getfacl /dev/dri/card0 | grep -q alice") + machine.succeed("getfacl /dev/snd/timer | grep -q alice") machine.send_key("alt-f1") machine.wait_until_succeeds("[ $(fgconsole) = 1 ]") - machine.fail("getfacl /dev/dri/card0 | grep -q alice") + machine.fail("getfacl /dev/snd/timer | grep -q alice") machine.succeed("chvt 2") - machine.wait_until_succeeds("getfacl /dev/dri/card0 | grep -q alice") + machine.wait_until_succeeds("getfacl /dev/snd/timer | grep -q alice") with subtest("Virtual console logout"): machine.send_chars("exit\n") diff --git a/nixos/tests/pantheon.nix b/nixos/tests/pantheon.nix index 3e24bff88527b..5ba36442274b3 100644 --- a/nixos/tests/pantheon.nix +++ b/nixos/tests/pantheon.nix @@ -66,7 +66,7 @@ with subtest("Login with elementary-greeter"): machine.send_chars("${user.password}\n") - machine.wait_until_succeeds('journalctl -t gnome-session-binary --grep "Entering running state"') + machine.wait_until_succeeds('journalctl -t gnome-session-service --grep "Entering running state"') with subtest("Wait for wayland server"): machine.wait_for_file("/run/user/${toString user.uid}/wayland-0") diff --git a/nixos/tests/web-apps/netbox-upgrade.nix b/nixos/tests/web-apps/netbox-upgrade.nix index 29b553829dcbc..5b60e8939ccbf 100644 --- a/nixos/tests/web-apps/netbox-upgrade.nix +++ b/nixos/tests/web-apps/netbox-upgrade.nix @@ -1,7 +1,7 @@ { lib, pkgs, ... }: let - oldNetbox = "netbox_4_2"; - newNetbox = "netbox_4_3"; + oldNetbox = "netbox_4_3"; + newNetbox = "netbox_4_4"; apiVersion = version: diff --git a/nixos/tests/web-apps/netbox/testScript.py b/nixos/tests/web-apps/netbox/testScript.py index 7d0f9bff10c7c..f6c2c9821e121 100644 --- a/nixos/tests/web-apps/netbox/testScript.py +++ b/nixos/tests/web-apps/netbox/testScript.py @@ -61,7 +61,7 @@ def compare(a: str, b: str): return 0 with subtest("Home screen loads"): - machine.succeed( + machine.wait_until_succeeds( "curl -sSfL http://[::1]:8001 | grep '