staging-next 2025-11-14

nixos/modules/security/apparmor/includes.nix

@@ -19,7 +19,7 @@ let
           mode ? "r",
           trail ? "",
         }:
-        lib.optionalString (hasAttr path etc) "${mode} ${config.environment.etc.${path}.source}${trail},";
+        lib.optionalString (hasAttr path etc) "${config.environment.etc.${path}.source}${trail} ${mode},";
     in
     if isAttrs arg then go arg else go { path = arg; };
 in
@@ -93,19 +93,19 @@ in
     ];
     "abstractions/base" = ''
       include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/base"
-      r ${pkgs.stdenv.cc.libc}/share/locale/**,
-      r ${pkgs.stdenv.cc.libc}/share/locale.alias,
-      r ${config.i18n.glibcLocales}/lib/locale/locale-archive,
+      ${pkgs.stdenv.cc.libc}/share/locale/** r,
+      ${pkgs.stdenv.cc.libc}/share/locale.alias r,
+      ${config.i18n.glibcLocales}/lib/locale/locale-archive r,
       ${etcRule "localtime"}
-      r ${pkgs.tzdata}/share/zoneinfo/**,
-      r ${pkgs.stdenv.cc.libc}/share/i18n/**,
+      ${pkgs.tzdata}/share/zoneinfo/** r,
+      ${pkgs.stdenv.cc.libc}/share/i18n/** r,
     '';
     "abstractions/bash" = ''
       include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/bash"
 
       # bash inspects filesystems at startup
       # and /etc/mtab is linked to /proc/mounts
-      r @{PROC}/mounts,
+      @{PROC}/mounts r,
 
       # system-wide bash configuration
     ''
@@ -296,8 +296,8 @@ in
       # looking up users by name or id, groups by name or id, hosts by name
       # or IP, etc. These operations may be performed through files, dns,
       # NIS, NIS+, LDAP, hesiod, wins, etc. Allow them all here.
-      mr ${getLib pkgs.nss}/lib/libnss_*.so*,
-      mr ${getLib pkgs.nss}/lib64/libnss_*.so*,
+      ${getLib pkgs.nss}/lib/libnss_*.so* mr,
+      ${getLib pkgs.nss}/lib64/libnss_*.so* mr,
     ''
     + lib.concatMapStringsSep "\n" etcRule [
       "group"
@@ -463,11 +463,11 @@ in
       include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/ssl_certs"
 
       # For the NixOS module: security.acme
-      r /var/lib/acme/*/cert.pem,
-      r /var/lib/acme/*/chain.pem,
-      r /var/lib/acme/*/fullchain.pem,
+      /var/lib/acme/*/cert.pem r,
+      /var/lib/acme/*/chain.pem r,
+      /var/lib/acme/*/fullchain.pem r,
 
-      r /etc/pki/tls/certs/,
+      /etc/pki/tls/certs/ r,
 
     ''
     + lib.concatMapStringsSep "\n" etcRule [
@@ -510,8 +510,8 @@ in
     ];
     "abstractions/ssl_keys" = ''
       # security.acme NixOS module
-      r /var/lib/acme/*/full.pem,
-      r /var/lib/acme/*/key.pem,
+      /var/lib/acme/*/full.pem r,
+      /var/lib/acme/*/key.pem r,
     '';
     "abstractions/vulkan" = ''
       include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/vulkan"

nixos/modules/services/networking/murmur.nix

@@ -401,40 +401,40 @@ in
     ];
 
     security.apparmor.policies."bin.mumble-server".profile = ''
+      abi <abi/4.0>,
       include <tunables/global>
 
-      ${cfg.package}/bin/{mumble-server,.mumble-server-wrapped} {
+      profile ${cfg.package}/bin/{mumble-server,.mumble-server-wrapped} {
         include <abstractions/base>
         include <abstractions/nameservice>
         include <abstractions/ssl_certs>
         include "${pkgs.apparmorRulesFromClosure { name = "mumble-server"; } cfg.package}"
-        pix ${cfg.package}/bin/.mumble-server-wrapped,
-
-        r ${config.environment.etc."os-release".source},
-        r ${config.environment.etc."lsb-release".source},
-        owner rwk ${cfg.stateDir}/murmur.sqlite,
-        owner rw ${cfg.stateDir}/murmur.sqlite-journal,
-        owner r ${cfg.stateDir}/,
-        r /run/murmur/murmurd.pid,
-        r /run/murmur/murmurd.ini,
-        r ${configFile},
-    ''
-    + lib.optionalString cfg.logToFile ''
-      rw /var/log/murmur/murmurd.log,
-    ''
-    + lib.optionalString (cfg.sslCert != null) ''
-      r ${cfg.sslCert},
-    ''
-    + lib.optionalString (cfg.sslKey != null) ''
-      r ${cfg.sslKey},
-    ''
-    + lib.optionalString (cfg.sslCa != null) ''
-      r ${cfg.sslCa},
-    ''
-    + lib.optionalString (cfg.dbus != null) ''
-      dbus bus=${cfg.dbus}
-    ''
-    + ''
+        ${cfg.package}/bin/.mumble-server-wrapped pix,
+
+        ${config.environment.etc."os-release".source} r,
+        ${config.environment.etc."lsb-release".source} r,
+        owner ${cfg.stateDir}/murmur.sqlite rwk,
+        owner ${cfg.stateDir}/murmur.sqlite-journal rw,
+        owner ${cfg.stateDir}/ r,
+        /run/murmur/murmurd.pid r,
+        /run/murmur/murmurd.ini r,
+        ${configFile} r,
+        ${lib.optionalString cfg.logToFile ''
+          /var/log/murmur/murmurd.log rw,
+        ''}
+        ${lib.optionalString (cfg.sslCert != null) ''
+          ${cfg.sslCert} r,
+        ''}
+        ${lib.optionalString (cfg.sslKey != null) ''
+          ${cfg.sslKey} r,
+        ''}
+        ${lib.optionalString (cfg.sslCa != null) ''
+          ${cfg.sslCa} r,
+        ''}
+        ${lib.optionalString (cfg.dbus != null) ''
+          dbus bus=${cfg.dbus},
+        ''}
+        include if exists <local/bin.mumble-server>
       }
     '';
   };

nixos/modules/services/torrent/transmission.nix

@@ -585,23 +585,23 @@ in
       include "${cfg.package.apparmor}/bin.transmission-daemon"
     '';
     security.apparmor.includes."local/bin.transmission-daemon" = ''
-      r ${config.systemd.services.transmission.environment.CURL_CA_BUNDLE},
+      ${config.systemd.services.transmission.environment.CURL_CA_BUNDLE} r,
 
-      owner rw ${cfg.home}/${settingsDir}/**,
-      rw ${cfg.settings.download-dir}/**,
+      owner ${cfg.home}/${settingsDir}/** rw,
+      ${cfg.settings.download-dir}/** rw,
       ${optionalString cfg.settings.incomplete-dir-enabled ''
-        rw ${cfg.settings.incomplete-dir}/**,
+        ${cfg.settings.incomplete-dir}/** rw,
       ''}
       ${optionalString cfg.settings.watch-dir-enabled ''
-        r${optionalString cfg.settings.trash-original-torrent-files "w"} ${cfg.settings.watch-dir}/**,
+        ${cfg.settings.watch-dir}/** r${optionalString cfg.settings.trash-original-torrent-files "w"},
       ''}
       profile dirs {
-        rw ${cfg.settings.download-dir}/**,
+        ${cfg.settings.download-dir}/** rw,
         ${optionalString cfg.settings.incomplete-dir-enabled ''
-          rw ${cfg.settings.incomplete-dir}/**,
+          ${cfg.settings.incomplete-dir}/** rw,
         ''}
         ${optionalString cfg.settings.watch-dir-enabled ''
-          r${optionalString cfg.settings.trash-original-torrent-files "w"} ${cfg.settings.watch-dir}/**,
+          ${cfg.settings.watch-dir}/** r${optionalString cfg.settings.trash-original-torrent-files "w"},
         ''}
       }
 
@@ -612,12 +612,12 @@ in
           # any existing profile for script-torrent-done-filename
           # FIXME: to be tested as I'm not sure it works well with NoNewPrivileges=
           # https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorStacking#seccomp-and-no_new_privs
-          px ${cfg.settings.script-torrent-done-filename} -> &@{dirs},
+          ${cfg.settings.script-torrent-done-filename} px -> &@{dirs},
         ''
       }
 
       ${optionalString (cfg.webHome != null) ''
-        r ${cfg.webHome}/**,
+        ${cfg.webHome}/** r,
       ''}
     '';
   };

nixos/modules/services/web-apps/miniflux.nix

@@ -207,15 +207,18 @@ in
     environment.systemPackages = [ cfg.package ];
 
     security.apparmor.policies."bin.miniflux".profile = ''
+      abi <abi/4.0>,
       include <tunables/global>
-      ${cfg.package}/bin/miniflux {
+
+      profile ${cfg.package}/bin/miniflux {
         include <abstractions/base>
         include <abstractions/nameservice>
         include <abstractions/ssl_certs>
         include <abstractions/golang>
         include "${pkgs.apparmorRulesFromClosure { name = "miniflux"; } cfg.package}"
-        r ${cfg.package}/bin/miniflux,
-        rw /run/miniflux/**,
+        ${cfg.package}/bin/miniflux r,
+        /run/miniflux/** rw,
+        include if exists <local/bin.miniflux>
       }
     '';
   };

nixos/tests/systemd-shutdown.nix

@@ -27,7 +27,7 @@ in
     # automatically and that 'systemd-shutdown' runs our script.
     machine.wait_for_unit("multi-user.target")
     # .shutdown() would wait for the machine to power off
-    machine.succeed("systemctl poweroff")
+    machine.execute("systemctl poweroff", check_return=False)
     # Message printed by systemd-shutdown
     machine.wait_for_console_text("Unmounting '/oldroot'")
     machine.wait_for_console_text("${msg}")

pkgs/applications/networking/p2p/transmission/4.nix

@@ -175,21 +175,22 @@ stdenv.mkDerivation (finalAttrs: {
   postInstall = ''
     mkdir $apparmor
     cat >$apparmor/bin.transmission-daemon <<EOF
+    abi <abi/4.0>,
     include <tunables/global>
-    $out/bin/transmission-daemon {
+    profile $out/bin/transmission-daemon {
       include <abstractions/base>
       include <abstractions/nameservice>
       include <abstractions/ssl_certs>
       include "${apparmorRules}"
-      r @{PROC}/sys/kernel/random/uuid,
-      r @{PROC}/sys/vm/overcommit_memory,
-      r @{PROC}/@{pid}/environ,
-      r @{PROC}/@{pid}/mounts,
-      rwk /tmp/tr_session_id_*,
+      @{PROC}/sys/kernel/random/uuid r,
+      @{PROC}/sys/vm/overcommit_memory r,
+      @{PROC}/@{pid}/environ r,
+      @{PROC}/@{pid}/mounts r,
+      /tmp/tr_session_id_* rwk,
 
-      r $out/share/transmission/public_html/**,
+      $out/share/transmission/public_html/** r,
 
-      include <local/bin.transmission-daemon>
+      include if exists <local/bin.transmission-daemon>
     }
     EOF
     install -Dm0444 -t $out/share/icons ../qt/icons/transmission.svg

pkgs/build-support/rust/build-rust-crate/test/default.nix

@@ -774,6 +774,7 @@ rec {
           # On Darwin, the debug symbols are in a separate directory.
           "./bin/test_binary1.dSYM/Contents/Info.plist"
           "./bin/test_binary1.dSYM/Contents/Resources/DWARF/test_binary1"
+          "./bin/test_binary1.dSYM/Contents/Resources/Relocations/${stdenv.hostPlatform.rust.platform.arch}/test_binary1.yml"
         ];
       };
 

pkgs/build-support/rust/build-rust-package/default.nix

@@ -15,6 +15,16 @@
   windows,
 }:
 
+let
+  interpolateString =
+    s:
+    if lib.isList s then
+      lib.concatMapStringsSep " " (s: "${s}") (lib.filter (s: s != null) s)
+    else if s == null then
+      ""
+    else
+      "${s}";
+in
 lib.extendMkDerivation {
   constructDrv = stdenv.mkDerivation;
 
@@ -23,6 +33,7 @@ lib.extendMkDerivation {
     "cargoUpdateHook"
     "cargoLock"
     "useFetchCargoVendor"
+    "RUSTFLAGS"
   ];
 
   extendDrvArgs =
@@ -77,11 +88,19 @@ lib.extendMkDerivation {
     assert lib.warnIf (args ? useFetchCargoVendor)
       "buildRustPackage: `useFetchCargoVendor` is non‐optional and enabled by default as of 25.05, remove it"
       true;
+    {
+      env = {
+        PKG_CONFIG_ALLOW_CROSS = if stdenv.buildPlatform != stdenv.hostPlatform then 1 else 0;
+        RUST_LOG = logLevel;
+        RUSTFLAGS =
+          lib.optionalString (
+            stdenv.hostPlatform.isDarwin && buildType == "debug"
+          ) "-C split-debuginfo=packed "
+          # Workaround the existing RUSTFLAGS specified as a list.
+          + interpolateString (args.RUSTFLAGS or "");
+      }
+      // args.env or { };
 
-    lib.optionalAttrs (stdenv.hostPlatform.isDarwin && buildType == "debug") {
-      RUSTFLAGS = "-C split-debuginfo=packed " + (args.RUSTFLAGS or "");
-    }
-    // {
       cargoDeps =
         if cargoVendorDir != null then
           null
@@ -143,15 +162,6 @@ lib.extendMkDerivation {
 
       patches = cargoPatches ++ patches;
 
-      PKG_CONFIG_ALLOW_CROSS = if stdenv.buildPlatform != stdenv.hostPlatform then 1 else 0;
-
-      postUnpack = ''
-        eval "$cargoDepsHook"
-
-        export RUST_LOG=${logLevel}
-      ''
-      + (args.postUnpack or "");
-
       configurePhase =
         args.configurePhase or ''
           runHook preConfigure

pkgs/build-support/rust/hooks/cargo-setup-hook.sh

@@ -1,6 +1,8 @@
 cargoSetupPostUnpackHook() {
     echo "Executing cargoSetupPostUnpackHook"
 
+    eval "${cargoDepsHook-}"
+
     # Some cargo builds include build hooks that modify their own vendor
     # dependencies. This copies the vendor directory into the build tree and makes
     # it writable. If we're using a tarball, the unpackFile hook already handles

pkgs/by-name/at/at-spi2-core/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   meson,
   ninja,
   pkg-config,
@@ -29,7 +28,7 @@
 
 stdenv.mkDerivation rec {
   pname = "at-spi2-core";
-  version = "2.58.0";
+  version = "2.58.1";
 
   outputs = [
     "out"
@@ -39,18 +38,9 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/at-spi2-core/${lib.versions.majorMinor version}/at-spi2-core-${version}.tar.xz";
-    hash = "sha256-390zANong6IZaf+t4oiYF/t8GQak75JJfrpllps9q1o=";
+    hash = "sha256-fzdKajjNcP9LMsnToDEL+oBNlG/tTJ5pp9SfrNy5Xpw=";
   };
 
-  # TODO apply unconditionally on rebuild
-  patches = lib.optionals stdenv.isDarwin [
-    (fetchpatch {
-      name = "timersub.patch";
-      url = "https://github.com/GNOME/at-spi2-core/commit/02108ea1b96db0189b2d4a9eceb843e1f13b7bdf.diff";
-      hash = "sha256-pVBhawfRnJoXmovl9CAmzh+YWJkbvlOVrCs8XanjP00=";
-    })
-  ];
-
   nativeBuildInputs = [
     glib
     meson

pkgs/by-name/bl/bluez-headers/package.nix

@@ -10,22 +10,22 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bluez-headers";
-  version = "5.83";
+  version = "5.84";
 
   # This package has the source, because of the emulatorAvailable check in the
   # bluez function args, that causes an infinite recursion with Python on cross
   # builds.
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/bluez-${finalAttrs.version}.tar.xz";
-    hash = "sha256-EIUi2QnSIFgTmb/sk9qrYgNVOc7vPdo+eZcHhcY70kw=";
+    hash = "sha256-W6c9Aw97AAh9Z4ALDjIWAa7A+JKCfHLlosg5DYyIaxE=";
   };
 
   dontConfigure = true;
   dontBuild = true;
 
   installPhase = ''
-    mkdir -p $out/include/bluetooth
-    cp -v lib/*.h "$out/include/bluetooth/"
+    mkdir -p $out/include/
+    cp -rv lib/* "$out/include/"
   '';
 
   meta = {