staging-next 2026-06-23

doc/release-notes/rl-2611.section.md

@@ -100,3 +100,4 @@
 ### Additions and Improvements {#sec-nixpkgs-release-26.11-lib-additions-improvements}
 
 - Create the first release note entry in this section!
+

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -68,6 +68,8 @@
 
 - `security.polkit.settings` added for RFC42 style configuration of the polkitd daemon.
 
+- The `programs.fuse` module, which provides the `fusermount3` executable and the `/etc/fuse.conf` config file, is now opt-in. The obligation to enable it has been shifted to its various consumers (e.g. gvfs, flatpak, appimage, sshfs). This can break fuse consumers at runtime, that don't explicitly declare that dependency with a module, e.g the mounting functionality in various backup tools (borg, restic, rclone, ...).
+
 - `services.plausible` can now again seed an initial admin user declaratively via [`services.plausible.adminUser.email`](#opt-services.plausible.adminUser.email).
   This makes fully declarative deployments safer: Otherwise the user needed to either accept Plausible's unauthenticated "first launch" setup wizard, which lets anyone reaching the instance create the first admin account, or do more work (deploying with NixOS's default binding to `localhost` without exposing it publicly, going through the wizard, and then deploying Plausible exposed to the Internet).
   This option was previously removed with NixOS 25.05 due to an upstream Plausible change making declarative admin creation more difficult, but this change re-implements the admin creation directly.

nixos/lib/test-driver/src/test_driver/machine/__init__.py

@@ -1044,12 +1044,16 @@ def shell_ready(timeout_secs: int) -> bool:
             assert self.shell
 
             tic = time.time()
-            # TODO: do we want to bail after a set number of attempts?
-            while not shell_ready(timeout_secs=30):
+
+            for _ in range(10):
+                if shell_ready(timeout_secs=30):
+                    break
                 self.log("Guest root shell did not produce any data yet...")
                 self.log(
                     "  To debug, enter the VM and run 'systemctl status backdoor.service'."
                 )
+            else:
+                raise RuntimeError("Shell did not start in time")
 
             while True:
                 chunk = self.shell.recv(1024)
@@ -1587,7 +1591,7 @@ def _execute(
         # NOTE If the test calls switch-to-configuration (with a differently configured specialization)
         # this will use the /etc/profile of the new specialisation while `QemuMachine` nodes
         # will continue to use the original /etc/profile.
-        command = f"set -eo pipefail; source /etc/profile; set -u; {command}"
+        command = f"set -eo pipefail; USER=root HOME=/root source /etc/profile; set -u; {command}"
 
         cp = subprocess.run(
             [

nixos/lib/testing/network.nix

@@ -135,8 +135,13 @@ let
       );
       udevRules = map (
         interface:
-        # MAC Addresses for QEMU network devices are lowercase, and udev string comparison is case-sensitive.
-        ''SUBSYSTEM=="net",ACTION=="add",ATTR{address}=="${toLower (qemu-common.qemuNicMac interface.vlan config.virtualisation.test.nodeNumber)}",NAME="${interface.name}"''
+        lib.concatStringsSep ", " [
+          ''SUBSYSTEM=="net"''
+          ''ACTION=="add"''
+          # MAC Addresses for QEMU network devices are lowercase, and udev string comparison is case-sensitive.
+          ''ATTR{address}=="${toLower (qemu-common.qemuNicMac interface.vlan config.virtualisation.test.nodeNumber)}"''
+          ''NAME="${interface.name}"''
+        ]
       ) interfaces;
     in
     {

nixos/modules/config/sysctl.nix

@@ -74,7 +74,9 @@ in
           }
           (
             ''
+              set +e
               mmap_rnd_bits_max=$(grep "^CONFIG_ARCH_MMAP_RND_BITS_MAX=" $configfile | grep --only-matching "[0-9]*$")
+              set -e
               if [[ -z "$mmap_rnd_bits_max" ]]; then
                 echo "Unable to determine mmap_rnd_bits_max. Check your kernel configfile is valid."
                 exit 1
@@ -83,7 +85,9 @@ in
             ''
             # HAVE_ARCH_MMAP_RND_COMPAT_BITS is not defined on 32-bit architectures or LoongArch64
             + lib.optionalString (with pkgs.stdenv.hostPlatform; (!is32bit && !isLoongArch64)) ''
+              set +e
               mmap_rnd_compat_bits_max=$(grep "^CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=" $configfile | grep --only-matching "[0-9]*$")
+              set -e
               if [[ -z "$mmap_rnd_compat_bits_max" ]]; then
                 echo "Unable to determine mmap_rnd_compat_bits_max. Check your kernel configfile is valid."
                 exit 1

nixos/modules/profiles/bashless.nix

@@ -15,8 +15,6 @@
   environment.corePackages = lib.mkForce [ ];
   # Contains bash completions
   nix.enable = lib.mkDefault false;
-  # The fuse{,3} package contains a runtime dependency on bash.
-  programs.fuse.enable = lib.mkDefault false;
   documentation.man.man-db.enable = lib.mkDefault false;
   # autovt depends on bash
   console.enable = lib.mkDefault false;

nixos/modules/programs/appimage.nix

@@ -43,6 +43,8 @@ in
       }
     );
     environment.systemPackages = [ cfg.package ];
+
+    programs.fuse.enable = true;
   };
 
   meta.maintainers = with lib.maintainers; [

nixos/modules/programs/fuse.nix

@@ -12,9 +12,7 @@ in
   meta.maintainers = [ ];
 
   options.programs.fuse = {
-    enable = lib.mkEnableOption "fuse" // {
-      default = true;
-    };
+    enable = lib.mkEnableOption "fuse";
 
     mountMax = lib.mkOption {
       # In the C code it's an "int" (i.e. signed and at least 16 bit), but

nixos/modules/services/desktop-managers/plasma6.nix

@@ -274,6 +274,7 @@ in
 
     services.power-profiles-daemon.enable = mkDefault true;
     services.system-config-printer.enable = mkIf config.services.printing.enable (mkDefault true);
+    programs.fuse.enable = true;
     services.udisks2.enable = true;
     services.upower.enable = config.powerManagement.enable;
     services.libinput.enable = mkDefault true;

nixos/modules/services/desktops/flatpak.nix

@@ -40,6 +40,8 @@ in
       pkgs.fuse3
     ];
 
+    programs.fuse.enable = true;
+
     security.polkit.enable = true;
 
     fonts.fontDir.enable = true;

nixos/modules/services/desktops/gvfs.nix

@@ -40,6 +40,8 @@ in
 
     environment.systemPackages = [ cfg.package ];
 
+    programs.fuse.enable = true;
+
     services.dbus.packages = [ cfg.package ];
 
     systemd.packages = [ cfg.package ];

nixos/modules/services/monitoring/prometheus/exporters/bind.nix

@@ -17,7 +17,7 @@ in
       type = types.str;
       default = "http://localhost:8053/";
       description = ''
-        HTTP XML API address of an Bind server.
+        HTTP API address of a BIND server.
       '';
     };
     bindTimeout = mkOption {
@@ -29,13 +29,14 @@ in
     };
     bindVersion = mkOption {
       type = types.enum [
-        "xml.v2"
+        "json"
+        "xml"
         "xml.v3"
         "auto"
       ];
-      default = "auto";
+      default = "json";
       description = ''
-        BIND statistics version. Can be detected automatically.
+        BIND statistics version. Defaults to JSON.
       '';
     };
     bindGroups = mkOption {

nixos/modules/services/network-filesystems/kubo.nix

@@ -332,8 +332,9 @@ in
     boot.kernel.sysctl."net.core.rmem_max" = lib.mkDefault 7500000;
     boot.kernel.sysctl."net.core.wmem_max" = lib.mkDefault 7500000;
 
-    programs.fuse = lib.mkIf (cfg.autoMount && cfg.settings.Mounts.FuseAllowOther) {
-      userAllowOther = true;
+    programs.fuse = {
+      enable = lib.mkIf cfg.autoMount true;
+      userAllowOther = lib.mkIf cfg.settings.Mounts.fuseAllowOther true;
     };
 
     users.users = lib.mkIf (cfg.user == "ipfs") {

nixos/modules/system/boot/systemd/initrd.nix

@@ -124,6 +124,16 @@ let
   jobScripts = concatLists (
     mapAttrsToList (_: unit: unit.jobScripts or [ ]) (filterAttrs (_: v: v.enable) cfg.services)
   );
+  unitEnv = pkgs.buildEnv {
+    name = "initrd-unit-env";
+    paths = concatLists (
+      mapAttrsToList (_: unit: unit.path or [ ]) (filterAttrs (_: v: v.enable) cfg.services)
+    );
+    pathsToLink = [
+      "/bin"
+      "/sbin"
+    ];
+  };
 
   stage1Units = generateUnits {
     type = "initrd";
@@ -636,6 +646,7 @@ in
         "${pkgs.bashNonInteractive}/bin"
       ]
       ++ jobScripts
+      ++ [ unitEnv ]
       ++ map (c: removeAttrs c [ "text" ]) (builtins.attrValues cfg.contents)
       ++ lib.optional (pkgs.stdenv.hostPlatform.libc == "glibc") "${pkgs.glibc}/lib/libnss_files.so.2";
 
@@ -763,13 +774,22 @@ in
           ];
         };
         serviceConfig.Type = "oneshot";
+        serviceConfig.EnvironmentFile = "-/etc/switch-root.conf";
         description = "NixOS Activation";
 
         script = # bash
           ''
             set -uo pipefail
             export PATH="/bin:${cfg.package.util-linux}/bin"
 
+            # A non-NixOS closure (e.g. init=/bin/sh) has no prepare-root;
+            # initrd-find-nixos-closure records this as a non-empty NEW_INIT.
+            # Skip activation and let initrd-switch-root hand over to it directly.
+            if [ -n "''${NEW_INIT:-}" ]; then
+              echo "$NEW_INIT is not a NixOS system - not activating"
+              exit 0
+            fi
+
             closure="$(realpath /nixos-closure)"
 
             # Initialize the system

nixos/modules/system/etc/etc-activation.nix

@@ -71,6 +71,10 @@
               RequiresMountsFor = [
                 "/sysroot/nix/store"
               ];
+              # find-etc only creates this symlink for a NixOS init. For a
+              # non-NixOS init= (e.g. init=/bin/sh) it is absent, so skip the
+              # mount instead of failing the whole initrd.
+              ConditionPathExists = "/etc-metadata-image";
             };
             requires = [
               config.boot.initrd.systemd.services.initrd-find-etc.name
@@ -123,6 +127,8 @@
                 "/run/nixos-etc-metadata"
               ];
               DefaultDependencies = false;
+              # Skip for a non-NixOS init=, see the metadata mount above.
+              ConditionPathExists = "/etc-basedir";
             };
           }
         ];
@@ -140,6 +146,8 @@
                   # before the overlay is mounted.
                   "/run/nixos-etc-metadata"
                 ];
+                # Skip for a non-NixOS init=, see the metadata mount above.
+                ConditionPathExists = "/etc-metadata-image";
               };
               serviceConfig = {
                 Type = "oneshot";

nixos/modules/tasks/filesystems/sshfs.nix

@@ -10,6 +10,8 @@
     lib.mkIf
       (config.boot.supportedFilesystems.sshfs or config.boot.supportedFilesystems."fuse.sshfs" or false)
       {
+        programs.fuse.enable = true;
+
         system.fsPackages = [ pkgs.sshfs ];
       };
 }

nixos/tests/all-tests.nix

@@ -1646,6 +1646,7 @@ in
     "i686-linux"
   ] ./initrd-network-openvpn { systemdStage1 = true; };
   systemd-initrd-networkd-ssh = runTest ./systemd-initrd-networkd-ssh.nix;
+  systemd-initrd-non-nixos = runTest ./systemd-initrd-non-nixos.nix;
   systemd-initrd-shutdown = runTest {
     imports = [ ./systemd-shutdown.nix ];
     _module.args.systemdStage1 = true;

nixos/tests/gocryptfs.nix

@@ -13,6 +13,8 @@
         pkgs.openssl
       ];
 
+      programs.fuse.enable = true;
+
       specialisation.fstab-test.configuration = {
         # This can't be fileSytems, as the qemu machinery doesn't honor it.
         virtualisation.fileSystems."/plain" = {

nixos/tests/prometheus-exporters.nix

@@ -111,7 +111,7 @@ let
           wait_for_unit("prometheus-bind-exporter.service")
           wait_for_open_port(9119)
           succeed(
-              "curl -sSf http://localhost:9119/metrics | grep 'bind_query_recursions_total 0'"
+              "curl -sSf http://localhost:9119/metrics | grep 'bind_up 1'"
           )
         '';
       };

nixos/tests/simple-container.nix

@@ -1,11 +1,16 @@
 {
   name = "simple-container";
 
-  containers.machine = { };
+  containers = {
+    machine = { pkgs, ... }: {
+      users.users.root.packages = [ pkgs.hello ];
+    };
+    noprofile = { };
+  };
 
   testScript = ''
     start_all()
-    machine.wait_for_unit("multi-user.target")
-    machine.shutdown()
+    machine.succeed("hello")
+    noprofile.fail("hello")
   '';
 }