From 32d7c02b96259d05f50a482c2b7e55d59a70294c Mon Sep 17 00:00:00 2001 From: Justin ! Date: Mon, 1 Dec 2025 15:42:24 -0500 Subject: [PATCH] nixpkgs: bump to 25.11 This bump nixpkgs input to 25.11 and fix the two warnings that were coming with the update: 1. `pkgs.system` => `pkgs.stdenv.hostPlatform.system` 2. `runCommandNoCC` => `runCommand` also: 1. remove cppnix 2.3 compat tests (cppnix 2.3 is officially dead now) 2. remove lowdown 1.3 compat tests (nixpkgs no longer carries it) Co-authored-by: Tom Hubrecht Change-Id: I78526b5d8992a6c63ecd7f0c7c1fa6346a6a6964 --- docker.nix | 2 +- flake.lock | 8 +- flake.nix | 47 ++------- maintainers/check-syscalls.nix | 4 +- perl/default.nix | 3 +- releng/local/default.nix | 2 +- tests/installer/default.nix | 2 +- tests/nixos/cgroups/default.nix | 5 +- tests/nixos/default.nix | 166 ++++++++++++++++---------------- tests/nixos/fetchurl.nix | 2 +- tests/nixos/nix-upgrade-nix.nix | 9 +- tests/nixos/s3-cache.nix | 7 +- 12 files changed, 115 insertions(+), 142 deletions(-) diff --git a/docker.nix b/docker.nix index 9171efc7e..c191157cc 100644 --- a/docker.nix +++ b/docker.nix @@ -381,7 +381,7 @@ image pkgs.buildPackages.runCommand "docker-image-tarball-${pkgs.nix.version}" { nativeBuildInputs = [ pkgs.buildPackages.bubblewrap ]; - meta.description = "Docker image tarball with Lix for ${pkgs.system}"; + meta.description = "Docker image tarball with Lix for ${pkgs.stdenv.hostPlatform.system}"; } '' mkdir -p $out/nix-support diff --git a/flake.lock b/flake.lock index 848ce9d57..b5060b61c 100644 --- a/flake.lock +++ b/flake.lock @@ -108,16 +108,16 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1757198069, - "narHash": "sha256-m3VUcOD4rTs8J7S+3dOjWMrAjw6RcITC3XYQ98zhEFs=", + "lastModified": 1765984163, + "narHash": "sha256-RNFlX1Dj0DuvXkbwtglNKFxYxhwh20m/oUN0Le54UXY=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "0747026fc57ecb9c28901c7f7a2b5dc40e8af43c", + "rev": "e5c822e4a0e21274ec0b53bdb5c73ac3c470c263", "type": "github" }, "original": { "owner": "NixOS", - "ref": "nixos-25.05-small", + "ref": "nixos-25.11-small", "repo": "nixpkgs", "type": "github" } diff --git a/flake.nix b/flake.nix index 59d910cd1..f14a90efa 100644 --- a/flake.nix +++ b/flake.nix @@ -2,7 +2,7 @@ description = "Lix: A modern, delicious implementation of the Nix package manager"; inputs = { - nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05-small"; + nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11-small"; nixpkgs-regression.url = "github:NixOS/nixpkgs/215d4d0fd80ca5163643b03a33fde804a29cc1e2"; # Required because Nix 2.18 is not in Nixpkgs ≥ 25.05 anymore. @@ -177,11 +177,6 @@ nixStable = prev.nix; nixVersions = prev.nixVersions // { - nix_2_3 = prev.nixVersions.nix_2_3.overrideAttrs (old: { - meta = old.meta // { - knownVulnerabilities = [ ]; - }; - }); # Nix 2.18 has been removed from Nixpkgs ≥ 25.05, so we need to reintroduce it ourselves for our tests. nix_2_18 = nix_2_18.outputs.packages.${currentStdenv.hostPlatform.system}.default; }; @@ -222,10 +217,7 @@ busybox-sandbox-shell = final.busybox-sandbox-shell or final.default-busybox-sandbox-shell; }; - lix-clang-tidy = final.callPackage ./subprojects/lix-clang-tidy { - # FIXME: To be removed when switching to nixos-25.11-small - llvmPackages = final.llvmPackages_20; - }; + lix-clang-tidy = final.callPackage ./subprojects/lix-clang-tidy { }; nix-eval-jobs = final.callPackage ./subprojects/nix-eval-jobs { stdenv = currentStdenv; @@ -249,23 +241,9 @@ # And same thing for our build-release-notes package. build-release-notes = final.nix.passthru.build-release-notes; - lowdown_1_3 = - # If the stable channel we are using ships lowdown >= 1.4, we need - # to swap this around, take the default lowdown from the stable - # channel and add an overridden one for the legacy version. - assert lib.versionOlder prev.lowdown.version "1.4.0"; + lowdown = + assert lib.versionAtLeast prev.lowdown.version "2.0.0"; prev.lowdown; - lowdown = prev.lowdown.overrideAttrs (prevAttrs: rec { - version = "2.0.2"; - src = final.fetchurl { - url = "https://kristaps.bsd.lv/lowdown/snapshots/lowdown-${version}.tar.gz"; - sha512 = "2a4d0rqh8gkw4ca3gkzddp0hjpmmw74cbks8k0inhh0vizmgbn188zdv6m1kgmr019b99g7insli8js3ci1ji7y4n5nk704bswf3z3i"; - }; - nativeBuildInputs = prevAttrs.nativeBuildInputs ++ [ final.buildPackages.bmake ]; - postInstall = lib.replaceStrings [ "lowdown.so.1" ] [ "lowdown.so.2" ] ( - prevAttrs.postInstall or "" - ); - }); capnproto = prev.capnproto.overrideAttrs (old: { patches = @@ -309,14 +287,6 @@ } ); - # Ensure support for lowdown < 1.4 doesn't regress - build-lowdown_1_3 = forAllSystems ( - system: - self.packages.${system}.nix.override { - lowdown = nixpkgsFor.${system}.native.lowdown_1_3; - } - ); - devShell = forAllSystems (system: { default = self.devShells.${system}.default; clang = self.devShells.${system}.native-clangStdenvPackages; @@ -441,8 +411,6 @@ pkgs.callPackage ./package.nix { # Required since we don't support gcc stdenv stdenv = pkgs.clangStdenv; - # FIXME: To be removed when switching to nixos-25.11-small - llvmPackages = pkgs.llvmPackages_20; versionSuffix = ""; lintInsteadOfBuild = true; } @@ -485,10 +453,10 @@ paths = [ testWithNix ] - # NOTE: nixpkgs 25.05 is being ... *creative*, and requires this dance to override + # NOTE: nixpkgs 25.11 is being ... *creative*, and requires this dance to override # the evaluator used for the test. it will break again in the future, don't worry. ++ lib.optionals pkgs.stdenv.isLinux [ - ((pkgs.callPackage "${nixpkgs}/ci/eval" { inherit nix; }).attrpathsSuperset { + ((pkgs.callPackage "${nixpkgs}/ci/eval" { inherit nix; } { }).attrpathsSuperset { evalSystem = system; }) ]; @@ -540,7 +508,6 @@ # devShells and packages already get checked by nix flake check, so # this is just jobs that are special - build-lowdown_1_3 = self.hydraJobs.build-lowdown_1_3.${system}; binaryTarball = self.hydraJobs.binaryTarball.${system}; perlBindings = self.hydraJobs.perlBindings.${system}; nix-eval-jobs = self.hydraJobs.nix-eval-jobs.${system}; @@ -607,7 +574,7 @@ # Use LLD in the dev shell by default for faster link times. useLld = stdenv.hostPlatform.isLinux; }; - pre-commit = self.hydraJobs.pre-commit.${pkgs.system} or { }; + pre-commit = self.hydraJobs.pre-commit.${pkgs.stdenv.hostPlatform.system} or { }; in pkgs.callPackage nix.mkDevShell { pre-commit-checks = pre-commit; diff --git a/maintainers/check-syscalls.nix b/maintainers/check-syscalls.nix index 1a3de5c6d..bc10ec045 100644 --- a/maintainers/check-syscalls.nix +++ b/maintainers/check-syscalls.nix @@ -1,11 +1,11 @@ { - runCommandNoCC, + runCommand, lib, libseccomp, writeShellScriptBin, }: let - syscalls-csv = runCommandNoCC "syscalls.csv" { } '' + syscalls-csv = runCommand "syscalls.csv" { } '' echo ${lib.escapeShellArg libseccomp.src} tar -xf ${lib.escapeShellArg libseccomp.src} --strip-components=2 ${libseccomp.name}/src/syscalls.csv mv syscalls.csv "$out" diff --git a/perl/default.nix b/perl/default.nix index dc0de1b2b..a7ed5e8de 100644 --- a/perl/default.nix +++ b/perl/default.nix @@ -46,8 +46,7 @@ perl.pkgs.toPerlModule ( perlPackages.DBDSQLite # for kj-async capnproto - ] - ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security; + ]; # Nixpkgs' Meson hook likes to set this to "plain". mesonBuildType = "debugoptimized"; diff --git a/releng/local/default.nix b/releng/local/default.nix index c5b279c0c..1442ac7bc 100644 --- a/releng/local/default.nix +++ b/releng/local/default.nix @@ -6,7 +6,7 @@ }: let releng = ./..; - this-garage = pkgs.garage_1_x; + this-garage = pkgs.garage_2; garage-ephemeral-key = pkgs.callPackage ../garage-ephemeral-key { inherit (pkgs.writers) writePython3Bin; }; diff --git a/tests/installer/default.nix b/tests/installer/default.nix index 6d3e19987..a4c3216fb 100644 --- a/tests/installer/default.nix +++ b/tests/installer/default.nix @@ -31,7 +31,7 @@ let }; mockChannel = pkgs: - pkgs.runCommandNoCC "mock-channel" {} '' + pkgs.runCommand "mock-channel" {} '' mkdir nixexprs mkdir -p $out/channel echo -n 'someContent' > nixexprs/someFile diff --git a/tests/nixos/cgroups/default.nix b/tests/nixos/cgroups/default.nix index 2696bd13c..ae94f9ac6 100644 --- a/tests/nixos/cgroups/default.nix +++ b/tests/nixos/cgroups/default.nix @@ -13,7 +13,10 @@ extra-experimental-features = nix-command auto-allocate-uids cgroups extra-system-features = uid-range ''; - nix.settings.use-cgroups = true; + nix.settings = { + download-attempts = 1; + use-cgroups = true; + }; nix.nixPath = [ "nixpkgs=${nixpkgs}" ]; }; }; diff --git a/tests/nixos/default.nix b/tests/nixos/default.nix index 30783e081..01acd260b 100644 --- a/tests/nixos/default.nix +++ b/tests/nixos/default.nix @@ -1,11 +1,17 @@ -{ self, lib, nixpkgs, nixpkgsFor }: +{ + self, + lib, + nixpkgs, + nixpkgsFor, +}: let nixos-lib = import (nixpkgs + "/nixos/lib") { }; # https://nixos.org/manual/nixos/unstable/index.html#sec-calling-nixos-tests - runNixOSTestFor = system: test: + runNixOSTestFor = + system: test: (nixos-lib.runTest { imports = [ test ]; hostPkgs = nixpkgsFor.${system}.native; @@ -23,21 +29,27 @@ let # allow running tests against older nix versions via `nix eval --apply` # Example: # nix build "$(nix eval --raw --impure .#hydraJobs.tests.fetch-git --apply 't: (t.forNix "2.19.2").drvPath')^*" - forNix = nixVersion: runNixOSTestFor system { - imports = [test]; - defaults.nixpkgs.overlays = [(curr: prev: { - nix = (builtins.getFlake "nix/${nixVersion}").packages.${system}.nix; - })]; - }; + forNix = + nixVersion: + runNixOSTestFor system { + imports = [ test ]; + defaults.nixpkgs.overlays = [ + (curr: prev: { + nix = (builtins.getFlake "nix/${nixVersion}").packages.${system}.nix; + }) + ]; + }; }; # Checks that a NixOS configuration does not contain any references to our # locally defined Nix version. - checkOverrideNixVersion = { pkgs, lib, ... }: { - # pkgs.nix: The new Nix in this repo - # We disallow it, to make sure we don't accidentally use it. - system.forbiddenDependenciesRegexes = [ (lib.strings.escapeRegex "nix-${pkgs.nix.version}") ]; - }; + checkOverrideNixVersion = + { pkgs, lib, ... }: + { + # pkgs.nix: The new Nix in this repo + # We disallow it, to make sure we don't accidentally use it. + system.forbiddenDependenciesRegexes = [ (lib.strings.escapeRegex "nix-${pkgs.nix.version}") ]; + }; in { @@ -51,61 +63,63 @@ in # Test our Nix as a client against remotes that are older - remoteBuilds_remote_2_3 = runNixOSTestFor "x86_64-linux" { - name = "remoteBuilds_remote_2_3"; - imports = [ ./remote-builds.nix ]; - builders.config = { lib, pkgs, ... }: { - imports = [ checkOverrideNixVersion ]; - nix.package = lib.mkForce pkgs.nixVersions.nix_2_3; - }; - }; - - remoteBuilds_remote_2_18 = runNixOSTestFor "x86_64-linux" ({ lib, pkgs, ... }: { - name = "remoteBuilds_remote_2_18"; - imports = [ ./remote-builds.nix ]; - builders.config = { lib, pkgs, ... }: { - imports = [ checkOverrideNixVersion ]; - nix.package = lib.mkForce pkgs.nixVersions.nix_2_18; - }; - }); + remoteBuilds_remote_2_18 = runNixOSTestFor "x86_64-linux" ( + { lib, pkgs, ... }: + { + name = "remoteBuilds_remote_2_18"; + imports = [ ./remote-builds.nix ]; + builders.config = + { lib, pkgs, ... }: + { + imports = [ checkOverrideNixVersion ]; + nix.package = lib.mkForce pkgs.nixVersions.nix_2_18; + }; + } + ); # Let's ensure that reasonably popular shells are tested for remote building. - remoteBuildsNushell = runNixOSTestFor "x86_64-linux" ({ lib, pkgs, ... }: { - name = "remoteBuilds_nushell"; - imports = [ ./remote-builds.nix ]; - builders.config = { lib, pkgs, ... }: { - users.users.root.shell = pkgs.nushell; - }; - }); + remoteBuildsNushell = runNixOSTestFor "x86_64-linux" ( + { lib, pkgs, ... }: + { + name = "remoteBuilds_nushell"; + imports = [ ./remote-builds.nix ]; + builders.config = + { lib, pkgs, ... }: + { + users.users.root.shell = pkgs.nushell; + }; + } + ); - remoteBuildsBusybox = runNixOSTestFor "x86_64-linux" ({ lib, pkgs, ... }: { - name = "remoteBuilds_busybox"; - imports = [ ./remote-builds.nix ]; - builders.config = { lib, pkgs, ... }: { - users.users.root.shell = pkgs.busybox; - }; - }); + remoteBuildsBusybox = runNixOSTestFor "x86_64-linux" ( + { lib, pkgs, ... }: + { + name = "remoteBuilds_busybox"; + imports = [ ./remote-builds.nix ]; + builders.config = + { lib, pkgs, ... }: + { + users.users.root.shell = pkgs.busybox; + }; + } + ); # Test our Nix as a builder for clients that are older - remoteBuilds_local_2_3 = runNixOSTestFor "x86_64-linux" ({ lib, pkgs, ... }: { - name = "remoteBuilds_local_2_3"; - imports = [ ./remote-builds.nix ]; - nodes.client = { lib, pkgs, ... }: { - imports = [ checkOverrideNixVersion ]; - nix.package = lib.mkForce pkgs.nixVersions.nix_2_3; - }; - }); - - remoteBuilds_local_2_18 = runNixOSTestFor "x86_64-linux" ({ lib, pkgs, ... }: { - name = "remoteBuilds_local_2_18"; - imports = [ ./remote-builds.nix ]; - nodes.client = { lib, pkgs, ... }: { - imports = [ checkOverrideNixVersion ]; - nix.package = lib.mkForce pkgs.nixVersions.nix_2_18; - }; - }); + remoteBuilds_local_2_18 = runNixOSTestFor "x86_64-linux" ( + { lib, pkgs, ... }: + { + name = "remoteBuilds_local_2_18"; + imports = [ ./remote-builds.nix ]; + nodes.client = + { lib, pkgs, ... }: + { + imports = [ checkOverrideNixVersion ]; + nix.package = lib.mkForce pkgs.nixVersions.nix_2_18; + }; + } + ); # End remoteBuilds tests @@ -129,28 +143,16 @@ in remoteBuildsSshNg_remote_2_18 = runNixOSTestFor "x86_64-linux" { name = "remoteBuildsSshNg_remote_2_18"; imports = [ ./remote-builds-ssh-ng.nix ]; - builders.config = { lib, pkgs, ... }: { - imports = [ checkOverrideNixVersion ]; - nix.package = lib.mkForce pkgs.nixVersions.nix_2_18; - }; + builders.config = + { lib, pkgs, ... }: + { + imports = [ checkOverrideNixVersion ]; + nix.package = lib.mkForce pkgs.nixVersions.nix_2_18; + }; }; # Test our Nix as a builder for clients that are older - # FIXME: these tests don't work yet - /* - remoteBuildsSshNg_local_2_3 = runNixOSTestFor "x86_64-linux" ({ lib, pkgs, ... }: { - name = "remoteBuildsSshNg_local_2_3"; - imports = [ ./remote-builds-ssh-ng.nix ]; - nodes.client = { lib, pkgs, ... }: { - imports = [ checkOverrideNixVersion ]; - nix.package = lib.mkForce pkgs.nixVersions.nix_2_3; - }; - }); - - # TODO: (nixpkgs update) remoteBuildsSshNg_local_2_18 = ... - */ - nix-copy-closure = runNixOSTestFor "x86_64-linux" ./nix-copy-closure.nix; nix-copy = runNixOSTestFor "x86_64-linux" ./nix-copy.nix; @@ -169,9 +171,9 @@ in cgroups = runNixOSTestFor "x86_64-linux" ./cgroups; - setuid = lib.genAttrs - ["i686-linux" "x86_64-linux"] - (system: runNixOSTestFor system ./setuid/setuid.nix); + setuid = lib.genAttrs [ "i686-linux" "x86_64-linux" ] ( + system: runNixOSTestFor system ./setuid/setuid.nix + ); fetch-git = runNixOSTestFor "x86_64-linux" ./fetch-git; diff --git a/tests/nixos/fetchurl.nix b/tests/nixos/fetchurl.nix index 0212d9c74..12c3f46c7 100644 --- a/tests/nixos/fetchurl.nix +++ b/tests/nixos/fetchurl.nix @@ -76,7 +76,7 @@ in # Fetching from a server with an untrusted cert should fail. err = machine.fail("nix build --no-substitute --expr 'import { url = \"https://bad/index.html\"; hash = \"sha256-rsBwZF/lPuOzdjBZN2E08FjMM3JHyXit0Xi2zN+wAZ8=\"; }' 2>&1") print(err) - assert "SSL certificate problem: self-signed certificate" in err + assert "SSL certificate OpenSSL verify result: self-signed certificate" in err # Fetching from a server with a trusted cert should work via environment variable override. machine.succeed("NIX_SSL_CERT_FILE=/tmp/cafile.pem NIX_REMOTE=local nix build --no-substitute --expr 'import { url = \"https://bad/index.html\"; hash = \"sha256-rsBwZF/lPuOzdjBZN2E08FjMM3JHyXit0Xi2zN+wAZ8=\"; }'") diff --git a/tests/nixos/nix-upgrade-nix.nix b/tests/nixos/nix-upgrade-nix.nix index 01e641d81..3201fc7ef 100644 --- a/tests/nixos/nix-upgrade-nix.nix +++ b/tests/nixos/nix-upgrade-nix.nix @@ -8,10 +8,10 @@ let pkgs = config.nodes.machine.nixpkgs.pkgs; - lix = pkgs.nix; + lix = pkgs.lixPackageSets.stable.lix; lixVersion = lib.getVersion lix; - newNix = pkgs.nixVersions.latest; + newNix = pkgs.nix; newNixVersion = lib.getVersion newNix; in { @@ -25,6 +25,7 @@ in { nix.settings.experimental-features = [ "nix-command" "flakes" ]; services.getty.autologinUser = "root"; + nix.package = lix; }; }; @@ -35,7 +36,7 @@ in { machine.succeed("nix --version >&2") - # Use Lix to install CppNix into the default profile, overriding /run/current-system/sw/bin/nix + # Use Lix to install newNix into the default profile, overriding /run/current-system/sw/bin/nix machine.succeed("nix-env --install '${lib.getBin newNix}' --profile /nix/var/nix/profiles/default") # Make sure that correctly got inserted into our PATH. @@ -48,7 +49,7 @@ in { default_profile_version = machine.succeed("nix --version") assert "${newNixVersion}" in default_profile_version, f"${newNixVersion} not in {default_profile_version}" - # Now upgrade to Lix, and make sure that worked. + # Now upgrade to latest Lix, and make sure that worked. machine.succeed("${lib.getExe lix} upgrade-nix --debug --store-path ${lix} 2>&1") default_profile_version = machine.succeed("nix --version") print(default_profile_version) diff --git a/tests/nixos/s3-cache.nix b/tests/nixos/s3-cache.nix index a50ca0b61..f1c7322cf 100644 --- a/tests/nixos/s3-cache.nix +++ b/tests/nixos/s3-cache.nix @@ -29,9 +29,9 @@ in { ]; }; - nodes.s3 = { pkgs, ... }: { + nodes.s3 = { config, pkgs, ... }: { services.garage.enable = true; - services.garage.package = pkgs.garage_1_x; + services.garage.package = pkgs.garage_2; services.garage.settings = { replication_factor = 1; @@ -55,7 +55,8 @@ in { }; environment.systemPackages = [ - pkgs.garage_1_x + config.services.garage.package + pkgs.git pkgs.build-release-notes pkgs.jq