release: 2.91.2 "Dragon's Breath"

Release produced with releng/create_release.xsh Change-Id: Iaae75be51d51a553c29720e00f98565d314783bb
release: release notes for 2.91.2
2025-06-24 00:18:54 +02:00 · 2025-06-24 00:17:16 +02:00 · 2025-06-24 00:17:16 +02:00 · 2025-06-24 00:17:16 +02:00 · 2025-06-23 20:46:36 +00:00 · 2025-06-23 20:46:15 +00:00
2085 changed files with 49143 additions and 77062 deletions
@@ -16,12 +16,6 @@ Checks:
  - -bugprone-unchecked-optional-access
    # many warnings, seems like a questionable lint
  - -bugprone-branch-clone
-    # extremely noisy before clang 19: https://github.com/llvm/llvm-project/issues/93959
-  - -bugprone-multi-level-implicit-pointer-conversion
-    # we don't compile out our asserts
-  - -bugprone-assert-side-effect
-    # FIXME(jade): figure out if this warning is any good
-  - -bugprone-exception-escape
    # all thrown exceptions must derive from std::exception
  - hicpp-exception-baseclass
    # capturing async lambdas are dangerous
@@ -39,4 +33,3 @@ Checks:

 CheckOptions:
  bugprone-reserved-identifier.AllowedIdentifiers: '__asan_default_options'
-  bugprone-unused-return-value.AllowCastToVoid: true
@@ -29,11 +29,3 @@ trim_trailing_whitespace = false
 indent_style = space
 indent_size = 2
 max_line_length = 0
-
-[meson.build]
-indent_style = space
-indent_size = 2
-
-[*.json]
-indent_style = space
-indent_size = 4
@@ -2,7 +2,7 @@
 name: Missing or incorrect documentation
 about: Help us improve the reference manual
 title: ''
-labels: docs
+labels: documentation
 assignees: ''

 ---
@@ -19,10 +19,10 @@ assignees: ''

 <!-- make sure this issue is not redundant or obsolete -->

- [ ] checked [latest Lix manual] or its [source code]
+- [ ] checked [latest Lix manual] \([source]\)
 - [ ] checked [documentation issues] and [recent documentation changes] for possible duplicates

-[latest Lix manual]: https://docs.lix.systems/manual/lix/nightly
-[source code]: https://git.lix.systems/lix-project/lix/src/main/doc/manual/src
+[latest Nix manual]: https://docs.lix.systems/manual/lix/nightly
+[source]: https://git.lix.systems/lix-project/lix/src/main/doc/manual/src
 [documentation issues]: https://git.lix.systems/lix-project/lix/issues?labels=151&state=all
 [recent documentation changes]: https://gerrit.lix.systems/q/p:lix+path:%22%5Edoc/manual/.*%22
@@ -9,10 +9,6 @@ GTAGS
 # ccls
 /.ccls-cache

-# auto-generated compilation database
-compile_commands.json
-rust-project.json
-
 result
 result-*

@@ -33,11 +29,3 @@ buildtime.bin
 /.pre-commit-config.yaml
 /.nocontribmsg
 /release
-
-# Rust build files when using Cargo (not actually supported for building but it spews the files anyway)
-/target/
-
-# Python compiled files from the code generators and test suite
-*.pyc
-
-**/.idea
@@ -1,2 +0,0 @@
-Fiona Behrens <me@kloenk.dev>
-Fiona Behrens <me@kloenk.dev> <me@kloenk.de>
@@ -1,6 +0,0 @@
-[workspace]
-resolver = "2"
-members = ["lix/lix-doc"]
-
-[workspace.package]
-edition = "2021"
@@ -1,26 +0,0 @@
-# Docs
-per-file README.md=*
-per-file CONTRIBUTING.md=*
-
-# DevX
-per-file justfile=*
-per-file .envrc=*
-per-file .gitignore=*
-per-file .github=*
-per-file .mailmap=*
-
-# Build
-per-file meson.build=*
-per-file meson.options=*
-per-file flake.nix=*
-per-file flake.lock=*
-per-file *.nix=*
-per-file Cargo.lock=*
-per-file Cargo.toml=*
-per-file version.json=*
-
-# Code style
-per-file .clang-tidy=*
-per-file .clang-format=*
-per-file .editorconfig=*
-per-file treefmt.toml=*
@@ -17,13 +17,10 @@ For systems that **already have a Nix implementation installed**, such as NixOS

 ## Building And Developing

-See our [Hacking guide](https://git.lix.systems/lix-project/lix/src/branch/main/doc/manual/src/contributing/hacking.md) in our manual for instruction on how to set up a development environment and build Lix from source.
+See our [Hacking guide](https://git.lix.systems/lix-project/lix/src/branch/main/doc/manual/src/contributing/hacking.md) in our manual for instruction on how to to set up a development environment and build Lix from source.

 ## Additional Resources

- The Lix reference manual:
-  - [Stable](https://docs.lix.systems/manual/lix/stable/)
-  - [Nightly](https://docs.lix.systems/manual/lix/nightly/) (NOTE: [not automatically updated, yet](https://git.lix.systems/lix-project/lix/issues/742))
 - [Our wiki](https://wiki.lix.systems)
 - [Matrix - #space:lix.systems](https://matrix.to/#/#space:lix.systems)

@@ -1,4 +1,3 @@
 bench-*.json
 bench-*.md
-perf-*.json
 nixpkgs
@@ -1 +0,0 @@
-*
@@ -1,237 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i python3 -p python3 -p hyperfine -p "if stdenv.isLinux then linuxPackages.perf else null"
-
-import argparse
-import subprocess
-import os
-import json
-import tempfile
-import platform
-import shlex
-import textwrap
-import dataclasses
-
-flake_args = ["--extra-experimental-features", "nix-command flakes"]
-cases = {
-    "search": lambda build: [
-        f"{build}/bin/nix",
-        *flake_args,
-        "search",
-        "--no-eval-cache",
-        "github:nixos/nixpkgs/e1fa12d4f6c6fe19ccb59cac54b5b3f25e160870",
-        "hello",
-    ],
-    "rebuild": lambda build: [
-        f"{build}/bin/nix",
-        *flake_args,
-        "eval",
-        "--raw",
-        "--impure",
-        "--expr",
-        textwrap.dedent("""
-            (import <nixpkgs/nixos> {
-                configuration = ./bench/nixpkgs/nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-plasma6.nix;
-            }).config.system.build.toplevel
-        """).replace("\n", " "),
-    ],
-    "rebuild_lh": lambda build: [
-        "GC_INITIAL_HEAP_SIZE=10g",
-        *cases['rebuild'](build),
-    ],
-    "parse": lambda build: [
-        f"{build}/bin/nix",
-        *flake_args,
-        "eval",
-        "-f",
-        "bench/nixpkgs/pkgs/development/haskell-modules/hackage-packages.nix",
-    ],
-}
-
-arg_parser = argparse.ArgumentParser()
-# FIXME(jade, gilice): it is a reasonable use case to want to run a benchmark run
-# on just one build. However, since we are using hyperfine in comparison
-# mode, we would have to combine the JSON ourselves to support that, which
-# would probably be better done by writing a benchmarking script in
-# not-bash.
-arg_parser.add_argument(
-    'builds',
-    nargs='+',
-    help="At least two build directories to compare, containing bin/nix",
-)
-arg_parser.add_argument(
-    '--cases',
-    type=str,
-    help="A comma-separated list of cases you want to run. Defaults to running all",
-)
-arg_parser.add_argument(
-    '--mode',
-    nargs='+',
-    choices=[ "walltime", "memory" ] + [ "icount" ] if platform.system() == 'Linux' else [], # perf doesn't run on Darwin
-    default=[ "walltime" ],
-)
-arg_parser.add_argument(
-    '--daemon',
-    action='store_true',
-    help='Run a temporary daemon for the benchmark instead of using a local store directly',
-)
-args = arg_parser.parse_args()
-if len(args.builds) < 1:
-    raise ValueError("need at least one build directory to benchmark")
-
-benchmarks: list[str] = []
-if args.cases is None:
-    benchmarks = list(cases.keys())
-else:
-    for case in args.cases.split(","):
-        if case not in cases:
-            raise ValueError(f"no such case: {case}")
-        benchmarks.append(case)
-
-def make_full_command(build, case):
-    cmd = " ".join(map(shlex.quote, cases[case](build)))
-    if args.daemon:
-        return " ".join([
-            f"{build}/bin/nix --extra-experimental-features nix-command daemon &",
-            "trap 'kill %1' EXIT;",
-            f"NIX_REMOTE=daemon {cmd}",
-        ])
-    else:
-        return cmd
-
-def bench_walltime(env):
-    for case in benchmarks:
-        for build in args.builds:
-            subprocess.run([
-                "taskset", "-c", "2,3",
-                "chrt", "-f","50",
-                *[
-                    "hyperfine", "--warmup", "2", "--runs", "10",
-                    "--export-json", f"bench/bench-{case}-{build}.json",
-                    "--export-markdown", f"bench/bench-{case}-{build}.md",
-                    "--", make_full_command(build, case),
-                ],
-            ], env=env, check=True)
-
-    print("Benchmarks summary\n---\n")
-    for case in benchmarks:
-        results = []
-        for build in args.builds:
-            with open(f"bench/bench-{case}-{build}.json") as fd:
-                results.append(json.load(fd)["results"][0])
-        for result in results:
-            print(result["command"])
-            print("-" * min(80,len(result["command"])))
-            def attr_rounded(attr):
-                return f"{result[attr]:.3f}"
-            print("  mean:    ", attr_rounded("mean"), "±", attr_rounded("stddev"))
-            print("            user:",  attr_rounded("user"), "| system", attr_rounded("system"))
-            print("  median:  ", attr_rounded("median"))
-            print("  range:   ", attr_rounded("min") + "s.." + attr_rounded("max")+"s")
-            print("  relative:", f"{result["mean"]/results[0]["mean"]:.3f}")
-            print("\n")
-
-
-def bench_icount(env):
-    perf_results_for: dict[str, list[tuple[str, float]]] = {}
-    for case in benchmarks:
-        for build in args.builds:
-            # the perf stat -j output (incorrectly) localizes numbers, which will trip up the json parser.
-            env["LC_ALL"]="C"
-            case_command = make_full_command(build, case)
-            commandline = [
-                "perf", "stat", "-o", f"bench/perf-{case}.json", "-j",
-                "sh", "-c", case_command,
-            ]
-            print("running", case_command)
-            subprocess.run(commandline, env=env, check=True, stdout=subprocess.DEVNULL) # warmup run
-            subprocess.run(commandline, env=env, check=True, stdout=subprocess.DEVNULL)
-            perf_fd = open(f"bench/perf-{case}.json")
-            perf_data = [json.loads(x) for x in perf_fd.readlines()]
-            perf_fd.close()
-
-            instr = next(x for x in perf_data if x["event"] in ["instructions", "instructions:u"]) # an implementation of a find_first iterator
-            if case not in perf_results_for:
-                perf_results_for[case] = []
-            perf_results_for[case].append((case_command, float(instr["counter-value"])))
-
-    print("Benchmarks summary\n---\n")
-    for (case, entries) in perf_results_for.items():
-        for entry in entries:
-            cmd,instr = entry
-            print(cmd)
-            print("-" * min(80,len(cmd)))
-            print("  instructions:         ", int(instr))
-            print("  relative instructions:", int(instr)/perf_results_for[case][0][1])
-            print("\n")
-
-@dataclasses.dataclass
-class MemoryStatistics:
-    envBytes: int
-    listBytes: int
-    setBytes: int
-    valueBytes: int
-    heapBytes: int
-    heapSize: int
-
-def bench_memory(env):
-    path = "bench/bench-memory.json"
-    env = env | {
-        'NIX_SHOW_STATS': '1',
-        'NIX_SHOW_STATS_PATH': path,
-    }
-    results: dict[str, list[tuple[str, MemoryStatistics]]] = {}
-    for case in benchmarks:
-        for build in args.builds:
-            case_command = make_full_command(build, case)
-            commandline = [ "sh", "-c", case_command ]
-            print("running", case_command)
-            subprocess.run(commandline, env=env, check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-            with open(path) as fd:
-                stats = json.load(fd)
-            results.setdefault(case, []).append((case_command, MemoryStatistics(
-                envBytes=stats['envs']['bytes'],
-                listBytes=stats['list']['bytes'],
-                setBytes=stats['sets']['bytes'],
-                valueBytes=stats['values']['bytes'],
-                heapSize=stats['gc']['heapSize'],
-                heapBytes=stats['gc']['totalBytes'],
-            )))
-
-    print("Benchmarks summary\n---\n")
-    for (case, entries) in results.items():
-        for cmd, stats in entries:
-            print(cmd)
-            print("-" * min(80, len(cmd)))
-            print(f"  env bytes:    {stats.envBytes  :15d}   |  {(stats.envBytes / entries[0][1].envBytes)    :.3f}x")
-            print(f"  list bytes:   {stats.listBytes :15d}   |  {(stats.listBytes / entries[0][1].listBytes)  :.3f}x")
-            print(f"  set bytes:    {stats.setBytes  :15d}   |  {(stats.setBytes / entries[0][1].setBytes)    :.3f}x")
-            if not entries[0][1].valueBytes:
-                print(f"  value bytes:  {0:15d}")
-            else:
-                print(f"  value bytes:  {stats.valueBytes:15d}   |  {(stats.valueBytes / entries[0][1].valueBytes):.3f}x")
-            print(f"  heap alloc'd: {stats.heapBytes :15d}   |  {(stats.heapBytes / entries[0][1].heapBytes)  :.3f}x")
-            print(f"  heap size:    {stats.heapSize  :15d}   |  {(stats.heapSize / entries[0][1].heapSize)    :.3f}x")
-            print("\n")
-
-with tempfile.TemporaryDirectory() as tmp_dir:
-    subprocess.run([
-        "nix", "build",
-        "--extra-experimental-features", "nix-command flakes",
-        "--impure", "--expr",'(builtins.getFlake "git+file:.").inputs.nixpkgs.outPath',
-        "-o","bench/nixpkgs"
-    ], check=True)
-    subenv = os.environ.copy()
-    subenv["NIX_CONF_DIR"] = "/var/empty"
-    subenv["NIX_REMOTE"] = tmp_dir
-    subenv["NIX_PATH"] = ":".join([
-        "nixpkgs=bench/nixpkgs",
-    ])
-    subenv["NIX_DAEMON_SOCKET_PATH"] = f"{tmp_dir}/daemon"
-
-    for mode in args.mode:
-        if mode == "walltime":
-            bench_walltime(subenv)
-        elif mode == "memory":
-            bench_memory(subenv)
-        else:
-            bench_icount(subenv)
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+shopt -s inherit_errexit
+
+scriptdir=$(cd "$(dirname -- "$0")" ; pwd -P)
+cd "$scriptdir/.."
+
+if [[ $# -lt 2 ]]; then
+    # FIXME(jade): it is a reasonable use case to want to run a benchmark run
+    # on just one build. However, since we are using hyperfine in comparison
+    # mode, we would have to combine the JSON ourselves to support that, which
+    # would probably be better done by writing a benchmarking script in
+    # not-bash.
+    echo "Fewer than two result dirs given, nothing to compare!" >&2
+    echo "Pass some directories (with names indicating which alternative they are) with bin/nix in them" >&2
+    echo "Usage: ./bench/bench.sh result-1 result-2 [result-3...]" >&2
+    exit 1
+fi
+
+_exit=""
+trap "$_exit" EXIT
+
+# XXX: yes this is very silly. flakes~!!
+nix build --impure --expr '(builtins.getFlake "git+file:.").inputs.nixpkgs.outPath' -o bench/nixpkgs
+
+export NIX_REMOTE="$(mktemp -d)"
+_exit='rm -rfv "$NIX_REMOTE"; $_exit'
+export NIX_PATH="nixpkgs=bench/nixpkgs:nixos-config=bench/configuration.nix"
+
+builds=("$@")
+
+flake_args="--extra-experimental-features 'nix-command flakes'"
+
+hyperfineArgs=(
+    --parameter-list BUILD "$(IFS=,; echo "${builds[*]}")"
+    --warmup 2 --runs 10
+)
+
+declare -A cases
+cases=(
+    [search]="{BUILD}/bin/nix $flake_args search --no-eval-cache github:nixos/nixpkgs/e1fa12d4f6c6fe19ccb59cac54b5b3f25e160870 hello"
+    [rebuild]="{BUILD}/bin/nix $flake_args eval --raw --impure --expr 'with import <nixpkgs/nixos> {}; system'"
+    [rebuild-lh]="GC_INITIAL_HEAP_SIZE=10g {BUILD}/bin/nix eval $flake_args --raw --impure --expr 'with import <nixpkgs/nixos> {}; system'"
+    [parse]="{BUILD}/bin/nix $flake_args eval -f bench/nixpkgs/pkgs/development/haskell-modules/hackage-packages.nix"
+)
+
+benches=(
+    rebuild
+    rebuild-lh
+    search
+    parse
+)
+
+for k in "${benches[@]}"; do
+    taskset -c 2,3 \
+        chrt -f 50 \
+        hyperfine "${hyperfineArgs[@]}"  --export-json="bench/bench-${k}.json" --export-markdown="bench/bench-${k}.md" "${cases[$k]}"
+done
+
+echo "Benchmarks summary (from ./bench/summarize.jq bench/bench-*.json)"
+bench/summarize.jq bench/*.json
@@ -0,0 +1,325 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+{
+  boot = {
+    initrd = {
+      availableKernelModules = [
+        "xhci_pci"
+        "ahci"
+      ];
+      kernelModules = [ "dm-snapshot" ];
+      luks.devices = {
+        croot = {
+          device = "/dev/sdb";
+          allowDiscards = true;
+        };
+      };
+    };
+    kernelModules = [ "kvm-intel" ];
+    kernelPackages = pkgs.linuxPackages_latest;
+
+    loader = {
+      systemd-boot.enable = true;
+      efi.canTouchEfiVariables = true;
+    };
+  };
+
+  hardware = {
+    enableRedistributableFirmware = true;
+    cpu.intel.updateMicrocode = true;
+    opengl.driSupport32Bit = true;
+    opengl.extraPackages = with pkgs; [
+      vaapiIntel
+      intel-media-driver
+      intel-compute-runtime
+    ];
+  };
+
+  fileSystems = {
+    "/" = {
+      device = "/dev/sda2";
+      fsType = "xfs";
+      options = [ "noatime" ];
+    };
+
+    "/boot" = {
+      device = "/dev/sda1";
+      fsType = "vfat";
+    };
+
+    "/nas" = {
+      device = "nas:/";
+      fsType = "nfs4";
+      options = [
+        "ro"
+        "x-systemd.automount"
+      ];
+    };
+  };
+  swapDevices = [ { device = "/dev/swap"; } ];
+
+  networking = {
+    useDHCP = false;
+    hostName = "host";
+    wireless = {
+      enable = true;
+      interfaces = [ "eth1" ];
+    };
+    interfaces = {
+      eth0.useDHCP = true;
+      eth1.useDHCP = true;
+    };
+    wg-quick.interfaces = {
+      wg0 = {
+        address = [ "2001:db8::1" ];
+        privateKeyFile = "/etc/secrets/wg0.key";
+        peers = [
+          {
+            publicKey = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+            endpoint = "[2001:db8::2]:61021";
+            allowedIPs = [ "2001::db8:1::/64" ];
+          }
+        ];
+      };
+    };
+
+    firewall.allowedUDPPorts = [ 4567 ];
+  };
+
+  i18n = {
+    defaultLocale = "en_US.UTF-8";
+    inputMethod.enabled = "ibus";
+  };
+
+  services = {
+    xserver = {
+      enable = true;
+      layout = "us";
+      xkbVariant = "altgr-intl";
+      xkbOptions = "ctrl:nocaps";
+      libinput.enable = true;
+      wacom.enable = true;
+      videoDrivers = [ "modesetting" ];
+      modules = [ pkgs.xf86_input_wacom ];
+
+      displayManager.sx.enable = true;
+      windowManager.i3.enable = true;
+    };
+
+    udev.extraHwdb = ''
+      # not like this mattered at all
+      # we're not running udev from here
+    '';
+
+    udev.extraRules = ''
+      # ACTION=="add", SUBSYSTEM=="input", ...
+    '';
+  };
+
+  sound.enable = true;
+  hardware.pulseaudio = {
+    enable = true;
+    package = pkgs.pulseaudioFull;
+    daemon.config = {
+      lock-memory = "yes";
+      realtime-scheduling = "yes";
+      rlimit-rtprio = "-1";
+    };
+  };
+
+  programs = {
+    light.enable = true;
+    wireshark = {
+      enable = true;
+      package = pkgs.wireshark-qt;
+    };
+    gnupg.agent = {
+      enable = true;
+    };
+  };
+
+  fonts.packages = with pkgs; [
+    font-awesome
+    noto-fonts
+    noto-fonts-cjk
+    noto-fonts-emoji
+    noto-fonts-extra
+    dejavu_fonts
+    powerline-fonts
+    source-code-pro
+    cantarell-fonts
+  ];
+
+  users = {
+    mutableUsers = false;
+
+    users = {
+      user = {
+        isNormalUser = true;
+        group = "user";
+        extraGroups = [
+          "wheel"
+          "video"
+          "audio"
+          "dialout"
+          "users"
+          "kvm"
+          "wireshark"
+        ];
+        password = "unimportant";
+      };
+    };
+
+    groups = {
+      user = { };
+    };
+  };
+
+  security = {
+    pam.loginLimits = [
+      {
+        domain = "@audio";
+        item = "memlock";
+        type = "-";
+        value = "unlimited";
+      }
+      {
+        domain = "@audio";
+        item = "rtprio";
+        type = "-";
+        value = "99";
+      }
+      {
+        domain = "@audio";
+        item = "nofile";
+        type = "soft";
+        value = "99999";
+      }
+      {
+        domain = "@audio";
+        item = "nofile";
+        type = "hard";
+        value = "99999";
+      }
+    ];
+
+    sudo.extraRules = [
+      {
+        users = [ "user" ];
+        commands = [
+          {
+            command = "${pkgs.linuxPackages.cpupower}/bin/cpupower";
+            options = [ "NOPASSWD" ];
+          }
+        ];
+      }
+    ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    a2jmidid
+    age
+    ardour
+    bemenu
+    blender
+    breeze-icons
+    breeze-qt5
+    bubblewrap
+    calf
+    claws-mail
+    darktable
+    duperemove
+    emacs
+    feh
+    file
+    firefox
+    fluidsynth
+    gnome3.adwaita-icon-theme
+    gnuplot
+    graphviz
+    helm
+    i3status-rust
+    inkscape
+    jack2
+    jq
+    krita
+    ldns
+    libqalculate
+    libreoffice
+    man-pages
+    nheko
+    nix-diff
+    nix-index
+    nix-output-monitor
+    open-music-kontrollers.patchmatrix
+    pamixer
+    pavucontrol
+    pciutils
+    picom
+    pwgen
+    redshift
+    ripgrep
+    rlwrap
+    silver-searcher
+    soundfont-fluid
+    whois
+    wol
+    xclip
+    xdot
+    xdotool
+    xorg.xkbcomp
+    yt-dlp
+    zathura
+    borgbackup
+    linuxPackages.cpupower
+    mtr
+    kitty
+    xf86_input_wacom
+  ];
+
+  environment.pathsToLink = [ "/share/soundfonts" ];
+
+  systemd.user.services.run-python = {
+    after = [ "network-online.target" ];
+    script = ''
+      exec ${pkgs.python3}/bin/python
+    '';
+    serviceConfig = {
+      CapabilityBoundingSet = [ "" ];
+      KeyringMode = "private";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      PrivateDevices = true;
+      PrivateTmp = true;
+      PrivateUsers = true;
+      ProcSubset = "pid";
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "strict";
+      RestrictAddressFamilies = "AF_INET AF_INET6";
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~ @resources @privileged"
+      ];
+      UMask = "077";
+    };
+  };
+
+  system.stateVersion = "23.11";
+}
@@ -0,0 +1,22 @@
+#!/usr/bin/env -S jq -Mrf
+
+def round3:
+    . * 1000 | round | . / 1000
+    ;
+
+def stats($first):
+    [
+        "  mean:     \(.mean | round3)s ± \(.stddev | round3)s",
+        "            user: \(.user | round3)s | system: \(.system | round3)s",
+        "  median:   \(.median | round3)s",
+        "  range:    \(.min | round3)s ... \(.max | round3)s",
+        "  relative: \(.mean / $first.mean | round3)"
+    ]
+    | join("\n")
+    ;
+
+def fmt($first):
+    "\(.command)\n" + (. | stats($first))
+    ;
+
+[.results | .[0] as $first | .[] | fmt($first)] | join("\n\n") | (. + "\n\n---\n")
@@ -1 +0,0 @@
-*
@@ -1 +0,0 @@
-*
@@ -33,7 +33,32 @@ GENERATE_LATEX         = NO
 # spaces. See also FILE_PATTERNS and EXTENSION_MAPPING
 # Note: If this tag is empty the current directory is searched.

-INPUT                  = @INPUT_PATHS@
+# FIXME Make this list more maintainable somehow. We could maybe generate this
+# in the Makefile, but we would need to change how `.in` files are preprocessed
+# so they can expand variables despite configure variables.
+
+INPUT                  = \
+  src/libcmd \
+  src/libexpr \
+  src/libexpr/flake \
+  tests/unit/libexpr \
+  tests/unit/libexpr/value \
+  tests/unit/libexpr/test \
+  tests/unit/libexpr/test/value \
+  src/libexpr/value \
+  src/libfetchers \
+  src/libmain \
+  src/libstore \
+  src/libstore/build \
+  src/libstore/builtins \
+  tests/unit/libstore \
+  tests/unit/libstore/test \
+  src/libutil \
+  tests/unit/libutil \
+  tests/unit/libutil/test \
+  src/nix \
+  src/nix-env \
+  src/nix-store

 # If the MACRO_EXPANSION tag is set to YES, doxygen will expand all macro names
 # in the source code. If set to NO, only conditional compilation will be
@@ -72,15 +97,3 @@ EXPAND_AS_DEFINED      = \
  DECLARE_WORKER_SERIALISER \
  DECLARE_SERVE_SERIALISER \
  LENGTH_PREFIXED_PROTO_HELPER
-
-# The STRIP_FROM_PATH tag can be used to strip a user-defined part of the path.
-# Stripping is only done if one of the specified strings matches the left-hand
-# part of the path. The tag can be used to show relative paths in the file list.
-# If left blank the directory from which doxygen is run is used as the path to
-# strip.
-#
-# Note that you can specify absolute paths here, but also relative paths, which
-# will be relative from the directory where doxygen is started.
-# This tag requires that the tag FULL_PATH_NAMES is set to YES.
-
-STRIP_FROM_PATH        = "@PROJECT_SOURCE_ROOT@"
@@ -1,35 +1,3 @@
-internal_api_sources = [
-  'lix/libcmd',
-  'lix/libexpr',
-  'lix/libexpr/flake',
-  'tests/unit/libexpr',
-  'tests/unit/libexpr/value',
-  'tests/unit/libexpr/test',
-  'tests/unit/libexpr/test/value',
-  'lix/libexpr/value',
-  'lix/libfetchers',
-  'lix/libmain',
-  'lix/libstore',
-  'lix/libstore/build',
-  'lix/libstore/builtins',
-  'tests/unit/libstore',
-  'tests/unit/libstore/test',
-  'lix/libutil',
-  'tests/unit/libutil',
-  'tests/unit/libutil/test',
-  'lix/nix',
-  'lix/nix-env',
-  'lix/nix-store',
-]
-
-# We feed Doxygen absolute paths so it can be invoked from any working directory.
-internal_api_sources_absolute = []
-foreach src : internal_api_sources
-  internal_api_sources_absolute += '"' + (meson.project_source_root() / src) + '"'
-endforeach
-
-internal_api_sources_oneline = ' \\\n  '.join(internal_api_sources_absolute)
-
 doxygen_cfg = configure_file(
  input : 'doxygen.cfg.in',
  output : 'doxygen.cfg',
@@ -37,16 +5,22 @@ doxygen_cfg = configure_file(
    'PACKAGE_VERSION': meson.project_version(),
    'RAPIDCHECK_HEADERS': rapidcheck_meson.get_variable('includedir'),
    'docdir' : meson.current_build_dir(),
-    'INPUT_PATHS' : internal_api_sources_oneline,
-    'PROJECT_SOURCE_ROOT' : meson.project_source_root(),
  },
 )

 internal_api_docs = custom_target(
  'internal-api-docs',
  command : [
-    doxygen.full_path(),
-    '@INPUT0@',
+    bash,
+    # Meson can you please just give us a `workdir` argument to custom targets...
+    '-c',
+    # We have to prefix the doxygen_cfg path with the project build root
+    # because of the cd in front.
+    'cd @0@ && @1@ @2@/@INPUT0@'.format(
+      meson.project_source_root(),
+      doxygen.full_path(),
+      meson.project_build_root(),
+    ),
  ],
  input : [
    doxygen_cfg,
@@ -7,8 +7,9 @@ create-missing = false
 [output.html]
 additional-css = ["custom.css"]
 additional-js = ["redirects.js"]
-# Jumps directly into a new Gerrit CL editing the file in question.
-edit-url-template = "https://gerrit.lix.systems/admin/repos/edit/repo/lix/branch/main/file/doc/manual/{path}"
+# Using our GitHub mirror enables easier typo fixes since there is no easy way
+# to just submit a Gerrit CL by the web for trivial stuff.
+edit-url-template = "https://github.com/lix-project/lix/tree/main/doc/manual/{path}"
 git-repository-url = "https://git.lix.systems/lix-project/lix"
 # Folding by default would prevent things like "Ctrl+F for nix-env" from working
 # trivially, but the user should be able to fold if they want to.
@@ -12,10 +12,6 @@
  forgejo: rbt
  github: 9999years

-9p4:
-  display_name: Ersei Saggi
-  github: 9p4
-
 Artturin:
  github: Artturin

@@ -40,23 +36,10 @@ alois31:
  forgejo: alois31
  github: alois31

-andrewhamon:
-  display_name: Andrew Hamon
-  github: andrewhamon
-
 artemist:
  display_name: Artemis Tosini
  forgejo: artemist

-bb010g:
-  display_name: Dusk Banks
-  forgejo: bb010g
-  github: bb010g
-
-blitz:
-  display_name: Julian Stecklina
-  github: blitz
-
 cole-h:
  display_name: Cole Helbling
  github: cole-h
@@ -66,29 +49,14 @@ delan:
  forgejo: delan
  github: delan

-delroth:
-  github: delroth
-
-detroyejr:
-  display_name: Jonathan De Troye
-  github: detroyejr
-
 edolstra:
  display_name: Eelco Dolstra
  github: edolstra

-emilazy:
-  display_name: Emily
-  forgejo: emilazy
-  github: emilazy
-
 ericson:
  display_name: John Ericson
  github: ericson2314

-gilice:
-  forgejo: gilice
-
 goldstein:
  display_name: goldstein
  forgejo: goldstein
@@ -102,13 +70,6 @@ horrors:
 iFreilicht:
  github: iFreilicht

-ian-h-chamberlain:
-  forgejo: ian-h-chamberlain
-  github: ian-h-chamberlain
-
-infinisil:
-  github: infinisil
-
 isabelroses:
  forgejo: isabelroses
  github: isabelroses
@@ -117,42 +78,13 @@ jade:
  forgejo: jade
  github: lf-

-just1602:
-  forgejo: just1602
-
-kasimeka:
-  display_name: ورد
-  forgejo: janw4ld
-  github: kasimeka
-
-kfears:
-  display_name: KFears
-  forgejo: kfearsoff
-  github: kfearsoff
-
-kiara:
-  github: KiaraGrouwstra
-
 kjeremy:
  github: kjeremy

 kloenk:
-  display_name: Fiona Behrens
  forgejo: kloenk
  github: kloenk

-lheckemann:
-  forgejo: lheckemann
-  github: lheckemann
-
-lily:
-  forgejo: lilyinstarlight
-  github: lilyinstarlight
-
-lilyball:
-  forgejo: lilyball
-  github: lilyball
-
 lovesegfault:
  github: lovesegfault

@@ -163,51 +95,24 @@ ma27:
 matthewbauer:
  github: matthewbauer

-mic92:
-  github: mic92
-
 midnightveil:
  display_name: julia
  forgejo: midnightveil
  github: midnightveil

-nan-git:
-  display_name: NaN-git
-  github: NaN-git
-
 ncfavier:
  github: ncfavier

-not-my-profile:
-  display_name: Martin Fischer
-  github: not-my-profile
-
-p-e-meunier:
-  display_name: Pierre-Etienne Meunier
-  github: P-E-Meunier
-
-pamplemousse:
-  display_name: Xavier Maso
-  github: pamplemousse
-
 piegames:
  display_name: piegames
  forgejo: piegames
  github: piegamesde

-poliorcetics:
-  display_name: Poliorcetics
-  github: poliorcetics
-
 puck:
  display_name: puck
  forgejo: puck
  github: puckipedia

-quantenzitrone:
-  display_name: Zitrone
-  forgejo: quantenzitrone
-
 quantumjump:
  display_name: Quantum Jump
  github: QuantumBJump
@@ -224,18 +129,6 @@ roberth:
  display_name: Robert Hensing
  github: roberth

-seppel3210:
-  github: Seppel3210
-
-teofilc:
-  forgejo: teofilc
-  github: TeofilC
-
-thubrecht:
-  display_name: Tom Hubrecht
-  forgejo: tom-hubrecht
-  github: Tom-Hubrecht
-
 thufschmitt:
  display_name: Théophane Hufschmitt
  github: thufschmitt
@@ -248,31 +141,9 @@ valentin:
  display_name: Valentin Gagarin
  github: fricklerhandwerk

-vigress8:
-  display_name: Vigress
-  forgejo: vigress8
-  github: vigress8
-
-vlinkz:
-  display_name: Victor Fuentes
-  forgejo: vlinkz
-  github: vlinkz
-
 winter:
  forgejo: winter
  github: winterqt

-xanderio:
-  github: xanderio
-
-xokdvium:
-  github: xokdvium
-
-yorickvp:
-  github: yorickvp
-
 yshui:
  github: yshui
-
-zimbatm:
-  github: zimbatm
@@ -0,0 +1,37 @@
+let
+  inherit (builtins) concatStringsSep attrValues mapAttrs;
+  inherit (import ./utils.nix) optionalString squash;
+in
+
+builtinsInfo:
+let
+  showBuiltin =
+    name:
+    {
+      doc,
+      type,
+      impure-only,
+    }:
+    let
+      type' = optionalString (type != null) " (${type})";
+
+      impureNotice = optionalString impure-only ''
+        > **Note**
+        >
+        > Not available in [pure evaluation mode](@docroot@/command-ref/conf-file.md#conf-pure-eval).
+      '';
+    in
+    squash ''
+      <dt id="builtins-${name}">
+        <a href="#builtins-${name}"><code>${name}</code></a>${type'}
+      </dt>
+      <dd>
+
+      ${doc}
+
+      ${impureNotice}
+
+      </dd>
+    '';
+in
+concatStringsSep "\n" (attrValues (mapAttrs showBuiltin builtinsInfo))
@@ -0,0 +1,35 @@
+let
+  inherit (builtins) concatStringsSep attrValues mapAttrs;
+  inherit (import ./utils.nix) optionalString squash;
+in
+
+builtinsInfo:
+let
+  showBuiltin =
+    name:
+    {
+      doc,
+      args,
+      arity,
+      experimental-feature,
+    }:
+    let
+      experimentalNotice = optionalString (experimental-feature != null) ''
+        This function is only available if the [${experimental-feature}](@docroot@/contributing/experimental-features.md#xp-feature-${experimental-feature}) experimental feature is enabled.
+      '';
+    in
+    squash ''
+      <dt id="builtins-${name}">
+        <a href="#builtins-${name}"><code>${name} ${listArgs args}</code></a>
+      </dt>
+      <dd>
+
+      ${doc}
+
+      ${experimentalNotice}
+
+      </dd>
+    '';
+  listArgs = args: concatStringsSep " " (map (s: "<var>${s}</var>") args);
+in
+concatStringsSep "\n" (attrValues (mapAttrs showBuiltin builtinsInfo))
@@ -1,134 +1,26 @@
-with builtins;
-
 let
-  splitLines = s: filter (x: !isList x) (split "\n" s);
-
-  concatStrings = concatStringsSep "";
-
-  replaceStringsRec =
-    from: to: string:
-    # recursively replace occurrences of `from` with `to` within `string`
-    # example:
-    #     replaceStringRec "--" "-" "hello-----world"
-    #     => "hello-world"
-    let
-      replaced = replaceStrings [ from ] [ to ] string;
-    in
-    if replaced == string then string else replaceStringsRec from to replaced;
-
-  squash = replaceStringsRec "\n\n\n" "\n\n";
-
-  trim =
-    string:
-    # trim trailing spaces and squash non-leading spaces
-    let
-      trimLine =
-        line:
-        let
-          # separate leading spaces from the rest
-          parts = split "(^ *)" line;
-          spaces = head (elemAt parts 1);
-          rest = elemAt parts 2;
-          # drop trailing spaces
-          body = head (split " *$" rest);
-        in
-        spaces + replaceStringsRec "  " " " body;
-    in
-    concatStringsSep "\n" (map trimLine (splitLines string));
-
-  # FIXME: O(n^2)
-  unique = foldl' (acc: e: if elem e acc then acc else acc ++ [ e ]) [ ];
-
-  nameValuePair = name: value: { inherit name value; };
-
-  filterAttrs =
-    pred: set:
-    listToAttrs (
-      concatMap (
-        name:
-        let
-          v = set.${name};
-        in
-        if pred name v then [ (nameValuePair name v) ] else [ ]
-      ) (attrNames set)
-    );
-
-  optionalString = cond: string: if cond then string else "";
-
-  showSetting =
-    { inlineHTML }:
-    name:
-    {
-      description,
-      documentDefault,
-      defaultValue,
-      aliases,
-      value,
-      experimentalFeature,
-    }:
-    let
-      result = squash ''
-        - ${
-          if inlineHTML then ''<span id="conf-${name}">[`${name}`](#conf-${name})</span>'' else ''`${name}`''
-        }
-
-        ${indent "  " body}
-      '';
-
-      experimentalFeatureNote = optionalString (experimentalFeature != null) ''
-        > **Warning**
-        > This setting is part of an
-        > [experimental feature](@docroot@/contributing/experimental-features.md).
-
-        To change this setting, you need to make sure the corresponding experimental feature,
-        [`${experimentalFeature}`](@docroot@/contributing/experimental-features.md#xp-feature-${experimentalFeature}),
-        is enabled.
-        For example, include the following in [`nix.conf`](#):
-
-        ```
-        extra-experimental-features = ${experimentalFeature}
-        ${name} = ...
-        ```
-      '';
-
-      # separate body to cleanly handle indentation
-      body = ''
-        ${description}
-
-        ${experimentalFeatureNote}
-
-        **Default:** ${showDefault documentDefault defaultValue}
-
-        ${showAliases aliases}
-      '';
-
-      showDefault =
-        documentDefault: defaultValue:
-        if documentDefault then
-          # a StringMap value type is specified as a string, but
-          # this shows the value type. The empty stringmap is `null` in
-          # JSON, but that converts to `{ }` here.
-          if defaultValue == "" || defaultValue == [ ] || isAttrs defaultValue then
-            "*empty*"
-          else if isBool defaultValue then
-            if defaultValue then "`true`" else "`false`"
-          else
-            "`${toString defaultValue}`"
-        else
-          "*machine-specific*";
-
-      showAliases =
-        aliases:
-        optionalString (aliases != [ ])
-          "**Deprecated alias:** ${(concatStringsSep ", " (map (s: "`${s}`") aliases))}";
-    in
-    result;
-
-  indent =
-    prefix: s: concatStringsSep "\n" (map (x: if x == "" then x else "${prefix}${x}") (splitLines s));
-
-  showSettings =
-    args: settingsInfo: concatStrings (attrValues (mapAttrs (showSetting args) settingsInfo));
+  inherit (builtins)
+    attrNames
+    attrValues
+    fromJSON
+    listToAttrs
+    mapAttrs
+    concatStringsSep
+    concatMap
+    length
+    lessThan
+    replaceStrings
+    sort
+    ;
+  inherit (import ./utils.nix)
+    concatStrings
+    optionalString
+    filterAttrs
+    trim
+    squash
+    unique
+    showSettings
+    ;
 in

 inlineHTML: commandDump:
@@ -225,7 +117,7 @@ let
          showCategory = cat: ''
            ${optionalString (cat != "") "**${cat}:**"}

-            ${listOptions (filterAttrs (n: v: v.category == cat && !v.hidden) allOptions)}
+            ${listOptions (filterAttrs (n: v: v.category == cat) allOptions)}
          '';
          listOptions = opts: concatStringsSep "\n" (attrValues (mapAttrs showOption opts));
          showOption =
@@ -0,0 +1,9 @@
+with builtins;
+with import ./utils.nix;
+
+let
+  showExperimentalFeature = name: doc: ''
+    - [`${name}`](@docroot@/contributing/experimental-features.md#xp-feature-${name})
+  '';
+in
+xps: indent "  " (concatStrings (attrValues (mapAttrs showExperimentalFeature xps)))
@@ -0,0 +1,13 @@
+with builtins;
+with import ./utils.nix;
+
+let
+  showExperimentalFeature =
+    name: doc:
+    squash ''
+      ## [`${name}`]{#xp-feature-${name}}
+
+      ${doc}
+    '';
+in
+xps: (concatStringsSep "\n" (attrValues (mapAttrs showExperimentalFeature xps)))
@@ -1,7 +1,6 @@
 nix_env_for_docs = {
  'HOME': '/dummy',
  'NIX_CONF_DIR': '/dummy',
-  'XDG_CONFIG_HOME': '/dummy',
  'NIX_SSL_CERT_FILE': '/dummy/no-ca-bundle.crt',
  'NIX_STATE_DIR': '/dummy',
  'NIX_CONFIG': 'cores = 0',
@@ -16,21 +15,67 @@ nix_eval_for_docs_common = nix_for_docs + [
 ]
 nix_eval_for_docs = nix_eval_for_docs_common + '--raw'

+conf_file_json = custom_target(
+  command : nix_for_docs + [ 'show-config', '--json' ],
+  capture : true,
+  output : 'conf-file.json',
+  env : nix_env_for_docs,
+)
+
+nix_conf_file_md_body = custom_target(
+  command : nix_eval_for_docs + [
+    '--expr',
+    '(import @INPUT0@).showSettings { inlineHTML = true; } (builtins.fromJSON (builtins.readFile @INPUT1@))',
+  ],
+  capture : true,
+  input : [
+    'utils.nix',
+    conf_file_json,
+  ],
+  output : 'conf-file.md.body',
+  env : nix_env_for_docs,
+)
+
+nix_conf_file_md = custom_target(
+  command : [ 'cat', '@INPUT@' ],
+  capture : true,
+  input : [
+    'src/command-ref/conf-file.md',
+    nix_conf_file_md_body,
+  ],
+  output : 'conf-file.md',
+)
+
+nix_exp_features_json = custom_target(
+  command : [ nix, '__dump-xp-features' ],
+  capture : true,
+  output : 'xp-features.json',
+)
+
+language_json = custom_target(
+  command: [nix, '__dump-language'],
+  output : 'language.json',
+  capture : true,
+  env : nix_env_for_docs,
+)
+
 nix3_cli_json = custom_target(
  command : [ nix, '__dump-cli' ],
  capture : true,
  output : 'nix.json',
  env : nix_env_for_docs,
-  # FIXME: put the actual lib targets in here? meson have introspection challenge 2024 though.
-  build_always_stale : true,
 )

 generate_manual_deps = files(
  'generate-deps.py',
 )

-# Generates new-cli pages  and conf-file.md.
+# Generates builtins.md and builtin-constants.md.
+subdir('src/language')
+# Generates new-cli pages, experimental-features-shortlist.md, and conf-file.md.
 subdir('src/command-ref')
+# Generates experimental-feature-descriptions.md.
+subdir('src/contributing')
 # Generates rl-next-generated.md.
 subdir('src/release-notes')

@@ -61,8 +106,6 @@ manual = custom_target(
    nix3_cli_files,
    experimental_features_shortlist_md,
    experimental_feature_descriptions_md,
-    deprecated_features_shortlist_md,
-    deprecated_feature_descriptions_md,
    conf_file_md,
    builtins_md,
    builtin_constants_md,
@@ -73,19 +116,20 @@ manual = custom_target(
    'manual',
    'markdown',
  ],
-  install : true,
-  install_dir : [
-    datadir / 'doc/nix',
-    false,
-  ],
  depfile : 'manual.d',
  env : {
    'RUST_LOG': 'info',
    'MDBOOK_SUBSTITUTE_SEARCH': meson.current_build_dir() / 'src',
  },
 )
+manual_html = manual[0]
 manual_md = manual[1]

+install_subdir(
+  manual_html.full_path(),
+  install_dir : datadir / 'doc/nix',
+)
+
 nix_nested_manpages = [
  [ 'nix-env',
    [
@@ -1,16 +0,0 @@
---
-synopsis: First argument to `--arg`/`--argstr` must be a valid Nix identifier
-issues: [fj#496]
-category: "Breaking Changes"
-credits: [ma27]
---
-
-The first argument to `--arg`/`--argstr` must be a valid Nix identifier, i.e.
-`nix-build --arg config.allowUnfree true` is now rejected.
-
-This is because that invocation is a false friend since it doesn't set
-`{ config = { allowUnfree = true; }; }`, but `{ "config.allowUnfree" = true; }`.
-
-The idea is to change the behavior to the latter in the long-term. For that,
-non-identifiers started giving a warning since 2.92 and are now rejected to give people
-who depend on that a chance to notice and potentially weigh in on the discussion.
@@ -1,20 +0,0 @@
---
-synopsis: "Improved susbtituter query speed"
-issues: []
-cls: []
-category: Improvements
-credits: [horrors]
---
-
-The code used to query substituters for derivations has been rewritten slightly
-to take advantage of our asynchronous runtime. Such queries run for every build
-that could download from substituters and processes every derivation that isn't
-yet present on the local system. Previously Lix would use `http-connections` to
-limit query concurrency, even for modern caches that support HTTP/2 and have no
-limit on how many queries can be run concurrently on one single connection. Lix
-no longer does this, resulting in approximately 60% reduction in query time for
-medium-sized closures (e.g. NixOS system closures) during testing, although the
-exact number depends greatly on local network latency and generally improves as
-latency increases. Unlike previously setting `http-connections` to `1` or other
-low values no longer brings a massive penalty in query performance if the cache
-in use by the querying system supports HTTP/2 (as e.g. `cache.nixos.org` does).
@@ -1,12 +0,0 @@
---
-synopsis: "`build-dir` no longer defaults to `temp-dir`"
-cls: [3453]
-category: "Fixes"
-credits: [horrors]
---
-
-The directory in which temporary build directories are created no longer defaults
-to the value of the `temp-dir` setting to avoid builders making their directories
-world-accessible. This behavior has been used to escape the build sandbox and can
-cause build impurities even when not used maliciously. We now default to `builds`
-in `NIX_STATE_DIR` (which is `/nix/var/nix/builds` in the default configuration).
@@ -1,60 +0,0 @@
---
-synopsis: "Global certificate authorities are copied inside the builder's environment"
-issues: [gh#12698, fj#885]
-cls: [3765]
-category: Fixes
-credits: [raito, emilazy]
---
-
-Previously, CA certificates were only installed at
-`/etc/ssl/certs/ca-certificates.crt` for sandboxed builds on Linux.
-
-This setup was insufficient in light of recent changes in `nixpkgs`, which now
-enforce HTTPS usage for `fetchurl`, even for fixed-output derivations, to
-mitigate confidentiality risks such as `netrc` or credentials leakage.
-`nixpkgs` still make use of a special package called `cacerts` which contains a
-copy of the CA certificates maintained by Nixpkgs and added as a reference for
-TLS-enabled fetchers.
-
-As a result, having a consistent and trusted certificate authority in all
-builder environments is becoming more essential.
-
-On `nix-darwin`, the `NIX_SSL_CERT_FILE` environment variable is always
-explicitly defined, but it is ignored by the sandbox setup.
-
-Simultaneously, Nix evaluates and propagates impure environment variables via
-`lib.proxyImpureEnvVars`, meaning that if `NIX_SSL_CERT_FILE` is set (which
-influences the default value for `ssl-cert-file`), it will be forwarded
-unchanged into the builder environment.
-
-However, on Linux, Nix also *copies* the CA file into the sandbox, creating a
-discrepancy between the value of `NIX_SSL_CERT_FILE` and the actual trusted
-certificate path used during the build.
-
-This divergence caused confusion and was partially addressed by attempts to
-whitelist the CA path in the Darwin sandbox (see cl/2906), but that approach
-involved a non-trivial path canonicalization step and is not as general as this one.
-
-To address this properly, we now emit a warning and override
-`NIX_SSL_CERT_FILE` inside the builder, explicitly pointing it to the CA file
-copied into the sandbox.
-
-This eliminates ambiguity between `NIX_SSL_CERT_FILE`
-and `ssl-cert-file`, ensuring consistent trust anchors across platforms.
-
-This warning might become a hard error as we figure out what to do regarding
-`lib.proxyImpureEnvVars` in nixpkgs.
-
-The behavior has been verified across sandboxed and unsandboxed builds on both
-Linux and Darwin.
-
-As a consequence of this change, approximately 500 KB of CA certificate data is
-now unconditionally copied into the build directory for fixed-output
-derivations.
-
-While this ensures consistent trust verification without having to restart the
-daemon after system upgrades, it may introduce a slight overhead in build
-performance. At present, no optimizations have been implemented to avoid this
-copy, but if this overhead proves noticeable in your workflows, please open an
-issue so we can evaluate and possibly implement different strategies to render
-trust anchors visible.
@@ -1,69 +0,0 @@
---
-synopsis: New cgroup delegation model
-issues: [fj#537, fj#77]
-cls: [3230]
-category: "Breaking Changes"
-credits: [raito, horrors, lheckemann]
---
-
-Builds using cgroups (i.e. `use-cgroups = true` and the experimental feature
-`cgroups`) now always delegate a cgroup tree to the sandbox.
-
-Compared to the original C++ Nix project, our delegation includes the
-`subtree_control` file as well, which means that the sandbox can disable
-certain controllers in its own cgroup tree.
-
-This is a breaking change because this requires the Nix daemon to run with an
-already delegated cgroup tree by the service manager.
-
-## How to setup the cgroup tree with systemd?
-
-systemd offers knobs to perform the required setup using:
-
-```
-[Service]
-Delegate=yes
-DelegateSubtree=supervisor
-```
-
-These directives are now included in our systemd packaging.
-
-## What about using Nix as root without connecting to the daemon?
-
-Builds run as `root` without connecting to the daemon relying on the cgroup
-feature are now broken, i.e.
-
-```console
-# nix-build --use-cgroups --sandbox ... # will not work
-```
-
-Consider doing instead:
-
-```console
-# systemd-run --same-dir --wait -p Delegate=yes -p DelegateSubgroup=supervisor nix-build --use-cgroups ...
-```
-
-If you need to disable cgroups temporarily, remember that you can do
-`NIX_CONF='include /etc/nix/nix.conf\nuse-cgroups = false' nix-build ...` or
-`nix-build --no-use-cgroups ...`.
-
-## What about other service managers than systemd?
-
-systemd has a [documentation](https://systemd.io/CGROUP_DELEGATION/) on how to
-handle cgroup delegation from service management perspective.
-
-If your service manager adheres to systemd semantics, e.g. writing an extended
-attribute `user.delegate=1` on the delegated cgroup tree directory and moving
-the `nix-daemon` process inside a cgroup tree to respect the inner process
-rule, then, the feature will work as well.
-
-## Why is the cgroup feature still experimental?
-
-While the cgroup feature unlocks many use cases, its behavior and integration (e.g. user experience), especially at scale on build farms or in multi-tenant environments, are not yet fully matured. There’s also potential for deeper systemd integration (e.g. using slices and scopes) that has not been fully explored.
-
-To avoid locking in an unstable interface, we’re keeping the experimental flag until we have validated the feature across a broader range of scenarios, including but not limited to:
-
-* Nix as root
-* Hydra-style build farms
-* Forgejo CI runners
-* Shared remote builders
@@ -1,16 +0,0 @@
---
-synopsis: Deprecation of CA derivations, dynamic derivations, and impure derivations
-issues: [fj#815]
-cls: []
-significance: significant
-category: Miscellany
-credits: []
---
-
-Content-addressed derivations are now deprecated and slated for removal in Lix 2.94.
-We're doing this because the CA derivation system has been a known cause of problems
-and inconsistencies, is unmaintained, habitually makes improving the store code very
-difficult (or blocks such improvements outright), and is beset by a number of design
-flaws that in our opinion cannot be fixed without a full reimplementation from zero.
-Dynamic derivations and impure derivations are built on the CA derivation framework,
-and owing to this they too are deprecated and slated for removal in another release.
@@ -1,25 +0,0 @@
---
-synopsis: "Hitting Control-C twice always terminates Lix"
-cls: [3574]
-issues: []
-category: "Improvements"
-credits: [horrors]
---
-
-Hitting Control-C or sending `SIGINT` to Lix now prints an informational message
-if it is still running after on second, the second Control-C/`SIGINT` terminates
-Lix immediately without waiting for any shutdown code to finish running. Lix did
-not treat the second such event differently from first in the past; this made it
-impossible to easily terminate running Lix processes that got stuck in e.g. very
-expensive Nixlang code that never interacted with the store. We now terminate as
-soon as the user hits Control-C again without waiting any more, to much the same
-effect as putting Lix into the background and killing it immediately afterwards.
-
-This means you can now more conveniently break out of stuck Nixlang evaluations:
-```
-❯ nix-instantiate --eval --expr 'let f = n: if n == 0 then 0 else f (n - 1) + f (n - 1); in f 32'
-^CStill shutting down. Press ^C again to abort all operations immediately.
-^C
-
-❌130 ❯
-```
@@ -1,12 +0,0 @@
---
-synopsis: "libstore: exponential backoff for downloads"
-issues: [lix#932]
-cls: [3856]
-category: Fixes
-credits: [ma27]
---
-
-The connection timeout when downloading from e.g. a binary cache is exponentially
-increased per failure. The option `connect-timeout` is now an alias to `max-connect-timeout`
-which is the maximum value for a timeout. The start value is controlled
-by `initial-connect-timeout` which is `5` by default.
@@ -1,9 +0,0 @@
---
-synopsis: Fix develop shells for derivations with escape codes
-issues: [fj#991]
-cls: [4154, 4155]
-category: Fixes
-credits: [Qyriad]
---
-
-ASCII control characters (including `\e`, used for ANSI escape codes) in derivation variables are now correctly escaped for `nix develop` and `nix print-dev-env`, instead of erroring.
@@ -1,13 +0,0 @@
---
-synopsis: "nix-store --delete: always remove obsolete hardlinks"
-issues: []
-cls: [3188]
-category: Fixes
-credits: [lheckemann]
---
-
-Deleting specific paths using `nix-store --delete` or `nix store
-delete` previously did not delete hard links created by `nix-store
--optimise` even if they became obsolete, unless _all_ of the given
-paths were deleted successfully. Now, hard links are always cleaned
-up, even if some of the given paths could not be deleted.
@@ -1,24 +0,0 @@
---
-synopsis: "Report GC statistics correctly"
-issues: []
-cls: [3188]
-category: Fixes
-credits: [lheckemann]
---
-
-Deleting specific paths using `nix-store --delete` or `nix store delete` previously did
-not report statistics correctly when some of the paths could not be deleted, even if
-others were deleted:
-
-```
-$ nix store delete /nix/store/9bwryidal9q3g91cjm6xschfn4ikd82q-hello-2.12.1 --delete-closure -v
-finding garbage collector roots...
-deleting '/nix/store/9bwryidal9q3g91cjm6xschfn4ikd82q-hello-2.12.1'
-0 store paths deleted, 0.00 MiB freed
-error: Cannot delete some of the given paths because they are still alive. Paths not deleted:
-         k9bxzr1l92r5y6mihrkbpbr3fmc8qszx-libidn2-2.3.8
-         mbx9ii53lzjlrsnlrfmzpwm33ynljwdn-libunistring-1.3
-         rf8hcy6bldxdqc0g6q1dcka1vh47x69s-xgcc-14.2.1.20250322-libgcc
-         vbrdc5wgzn0w1zdp10xd2favkjn5fk7y-glibc-2.40-66
-       To find out why, use nix-store --query --roots and nix-store --query --referrers.
-```
@@ -1,16 +0,0 @@
---
-synopsis: Add `inputs.self.submodules` flake attribute
-issues: [fj#942]
-cls: [3839]
-category: Features
-credits: [edolstra, kasimeka]
---
-
-A port of <https://github.com/NixOS/nix/pull/12421> to Lix, which:
-
- adds a general `inputs.self` flake attribute that retroactively applies
-  configurations to a flake after it's been fetched, then triggers a refetch of
-  the flake with the new config.
- implements `inputs.self.submodules` that allows a flake to declare its need
-  for submodules, which are then fetched automatically with no need to pass
-  `?submodules=1` anywhere.
@@ -1,16 +0,0 @@
---
-synopsis: Add hyperlinks in attr set printing
-issues: []
-cls: [3790]
-category: Features
-credits: [jade]
---
-
-The attribute set printer, such as is seen in `nix repl` or in type errors, now prints hyperlinks on each attribute name to its definition site if it is known.
-
-Example: all of the attributes shown here are hyperlinks to the exact definition site of the attribute in question:
-
-```
-$ nix eval -f '<nixpkgs>' lib.licenses.mit
-{ deprecated = false; free = true; fullName = "MIT License"; redistributable = true; shortName = "mit"; spdxId = "MIT"; url = "https://spdx.org/licenses/MIT.html"; }
-```
@@ -1,24 +0,0 @@
---
-synopsis: Repl debugger uses `--ignore-try` by default
-issues: [lix#666]
-cls: [3488]
-category: Breaking Changes
-credits: [jade]
---
-Previously, using the debugger meant that exceptions thrown in `builtins.tryEval` would trigger the debugger.
-
-However, this caught nixpkgs initialization code, which is unhelpful in the majority of cases, so we changed the default.
-
-To get the old behaviour, use `--no-ignore-try`.
-
-```
-$ nix repl --debugger --expr 'with import <nixpkgs> {}; pkgs.hello'
-Lix 2.94.0-dev-pre20250625-9a59106
-Type :? for help.
-error: file 'nixpkgs-overlays' was not found in the Nix search path (add it using $NIX_PATH or -I)
-
-This exception occurred in a 'tryEval' call. Use --ignore-try to skip these.
-
-Added 13 variables.
-nix-repl>
-```
@@ -1,25 +0,0 @@
---
-synopsis: "Fallback to safe temp dir when build-dir is unwritable"
-issues: [fj#876]
-cls: [3501]
-category: "Fixes"
-credits: ["raito", "horrors"]
---
-
-Non-daemon builds started failing with a permission error after introducing the `build-dir` option:
-
-```
-$ nix build --store ~/scratch nixpkgs#hello --rebuild
-error: creating directory '/nix/var/nix/builds/nix-build-hello-2.12.2.drv-0': Permission denied
-```
-
-This happens because:
-
-1. These builds are not run via the daemon, which owns `/nix/var/nix/builds`.
-2. The user lacks permissions for that path.
-
-We considered making `build-dir` a store-level option and defaulting it to `<chroot-root>/nix/var/nix/builds` for chroot stores, but opted instead for a fallback: if the default fails, Nix now creates a safe build directory under `/tmp`.
-
-To avoid CVE-2025-52991, the fallback uses an extra path component between `/tmp` and the build dir.
-
-**Note**: this fallback clutters `/tmp` with build directories that are not cleaned up. To prevent this, explicitly set `build-dir` to a path managed by Lix, even for local workloads.
@@ -1,47 +0,0 @@
---
-synopsis: Experimental integer coercion in interpolated strings
-issues: []
-cls: [3198]
-category: "Features"
-credits: [raito, delroth, horrors, winter]
---
-
-Ever tried interpolating a port number in Lix and ended up with something like this?
-
-```nix
-"http://${config.network.host}:${builtins.toString config.network.port}/"
-```
-
-You're not alone. Thousands of Lix users suffer every day from excessive `builtins.toString` syndrome. It’s 2025, and we still have to cast integers to use them in strings.
-
-To address this, Lix introduces the **`coerce-integers`** experimental feature. When enabled, interpolated integers within `"${...}"` are automatically coerced to strings. This allows writing:
-
-```nix
-"http://${config.network.host}:${config.network.port}/"
-```
-
-without additional conversion.
-
-To enable the feature, you need to add `coerce-integers` to your set of experimental features.
-
-### Stabilization criteria
-
-The `coerce-integers` feature is experimental and limited strictly to string interpolation (`"${...}"`). Before stabilization, the following must hold:
-
-1. **Interpolation-only**
-   Coercion must not occur outside interpolation. Expressions like `"" + 42` must continue to fail.
-
-2. **Expectation that no explicit cast are being observed**
-   Cases observing explicit coercion (e.g., via `tryEval` gadget or similar) are expected not to be load-bearing in actual production code.
-
-### Timeline for stabilization
-
-If the feature proves safe and is widely adopted across typical usage (e.g., actual configurations in the wild turning on the flag, non-trivial out-of-tree projects using it), the experimental flag will be removed **after six months of active use or two Lix releases**, whichever is longer.
-
-This avoids locking the feature in experimental status indefinitely, as happened with Flakes, while allowing time for validation and ecosystem integration.
-
-### What about coercing floats or more?
-
-Coercion beyond integers -- such as for floats or other types -- is **not planned**, even under an experimental flag. Questions like "what is the canonical string representation of a float?" involve subtle and context-dependent trade-offs. Without a robust and principled mechanism to define and audit such behavior, introducing broader coercion risks setting unintended and hard-to-reverse precedents. The scope of `coerce-integers` is intentionally narrow and will remain so.
-
-In terms of outlook, a proposal like https://git.lix.systems/lix-project/lix/issues/835 could pave the way for a better solution.
@@ -1,16 +0,0 @@
---
-synopsis: Parse overflowing JSON number literals as floating‐point
-issues: []
-cls: [3919]
-category: "Fixes"
-credits: [emilazy]
---
-
-Previously, `builtins.fromJSON "-9223372036854775809"` would
-return a floating‐point number, while `builtins.fromJSON
-"9223372036854775808"` would cause an evaluation error. This was
-introduced with the banning of integer overflow in Lix 2.91; previously
-the latter would result in C++ undefined behaviour. These cases are
-now treated consistently with JSON’s model of a single numeric type,
-and JSON number literals that do not fit in a Nix‐language integer
-will be parsed as floating‐point numbers.
@@ -1,13 +0,0 @@
---
-synopsis: "`--keep-failed` chowns the build directory to the user that request the build"
-issues: []
-cls: []
-category: Improvements
-credits: [horrors]
---
-
-Running a build with `--keep-failed` now chowns the temporary directory from the
-builder user and group to the user that request the build if the build came from
-a local user connected to the daemon. This makes inspecting failed derivations a
-lot easier. On Linux the build directory made visible to the user will not be in
-the same path as it was in the sandbox and continuing builds will usually break.
@@ -1,11 +0,0 @@
---
-synopsis: Fix handling of OSC codes in terminal output
-issues: [fj#160]
-cls: [3143]
-category: Fixes
-credits: [lilyball]
---
-
-OSC codes in terminal output are now handled correctly, where OSC 8 (hyperlink) is preserved any
-time color codes are allowed and all other OSC codes are stripped out. This applies not only to
-output from build commands but also to rendered documentation in the REPL.
@@ -1,14 +0,0 @@
---
-synopsis: Better debuggability on fixed-output hash mismatches
-issues: []
-cls: []
-category: Improvements
-credits: [lheckemann]
---
-
-Fixed-output derivation hash mismatch error messages will now include the path that was
-produced unexpectedly, and this path will be registered as valid even if `--check`
-(`nix-store`, `nix-build`) or `--rebuild` (`nix build`) was passed. This makes comparing
-the expected path with the obtained path easier, and is useful for debugging when
-upstreams modify previously-published releases or when changes in fixed-output
-derivations' dependencies affect their output unexpectedly.
@@ -1,10 +0,0 @@
---
-synopsis: "nix-eval-jobs: support `--no-instantiate` flag"
-issues: [fj#987]
-category: Features
-credits: [mic92,ma27]
---
-
-`nix-eval-jobs` now supports a flag called `--no-instantiate`. With this enabled,
-no write operations on the eval store are performed. That means, only evaluation is
-performed, but derivations (and their gcroots) aren't created.
@@ -1,29 +0,0 @@
---
-synopsis: "Fix nix develop for derivations that rejects dependencies with structured attrs"
-issues: [fj#997]
-cls: [4182]
-category: Fixes
-credits: [raito]
---
-
-For the sake of concision, we refer to `disallowedReferences` in what follows,
-but all output checks were equally fixed:
-`{dis,}allowed{References,Requisites}`.
-
-Derivations can define *output checks* to reject unwanted dependencies, such as
-interpreters like `bash` or compilers like `gcc`. This can be done in two ways:
-
-* **Legacy style**: `disallowedReferences = [ ... ]` in the environment.
-* **Structured attrs**: `outputChecks.<output>.disallowedReferences = [ ... ]`,
-  typically used in `__json`.
-
-Only the structured form supports derivations with multiple outputs.
-
-`nix develop` internally rewrites derivations to create development shells. It
-relied on the legacy `disallowedReferences`, and failed to honor the structured
-variant. This led to broken shells in cases where `bashInteractive` was
-explicitly disallowed using structured output checks, e.g. `nix develop
-nixpkgs#systemd` after the "bash-less NixOS" changes.
-
-This fix teaches `nix develop` to respect structured output checks, restoring
-support for such derivations.
@@ -1,12 +0,0 @@
---
-synopsis: "Add --raw flag to `nix-instantiate --eval` for unescaped output"
-issues: []
-prs: [gh#12119]
-cls: [2886]
-category: Improvements
-credits: [not-my-profile, infinisil, raito]
---
-
-The `nix-instantiate --eval` command now supports a `--raw` flag. When used,
-the result must be coercible to a string (as with `${...}`) and is printed
-verbatim, without quotes or escaping.
@@ -1,12 +0,0 @@
---
-synopsis: Allow `nix store ls` to read nar listings from binary cache stores.
-issues: []
-cls: [3225]
-category: Improvements
-credits: [vlinkz]
---
-
-The `nix store ls` command now supports reading `.ls` nar listings from binary cache stores.
-If a listing is detected for the store path being queried, the nar is no longer downloaded.
-These nar listings are available in binary cache stores where the `write-nar-listing` option is
-enabled, such as cache.nixos.org.
@@ -1,10 +0,0 @@
---
-synopsis: "nix-eval-jobs: retain NIX_PATH"
-issues: []
-cls: [3859]
-category: Fixes
-credits: [ma27,mic92]
---
-
-`nix-eval-jobs` doesn't clear the `NIX_PATH` from the environment anymore. This matches the behavior
-of [upstream version `2.30`](https://github.com/nix-community/nix-eval-jobs/releases/tag/v2.30.0).
@@ -1,25 +0,0 @@
---
-synopsis: "show tree with references that lead to an output cycle"
-issues: [fj#551]
-category: Improvements
-credits: [ma27]
---
-
-When Lix determines a cyclic dependency between several outputs of a derivation,
-it now displays which files in which outputs lead to an output cycle:
-
-```
-error: cycle detected in build of '/nix/store/gc5h2whz3rylpf34n99nswvqgkjkigmy-demo.drv' in the references of output 'bar' from output 'foo'.
-
-       Shown below are the files inside the outputs leading to the cycle:
-       /nix/store/3lrgm74j85nzpnkz127rkwbx3fz5320q-demo-bar
-       └───lib/libfoo: …stuffbefore /nix/store/h680k7k53rjl9p15g6h7kpym33250w0y-demo-baz andafter.…
-           → /nix/store/h680k7k53rjl9p15g6h7kpym33250w0y-demo-baz
-           └───share/snenskek: …???? /nix/store/dm24c76p9y2mrvmwgpmi64rryw6x5qmm-demo-foo ....…
-               → /nix/store/dm24c76p9y2mrvmwgpmi64rryw6x5qmm-demo-foo
-               └───bin/alarm: …textexttext/nix/store/3lrgm74j85nzpnkz127rkwbx3fz5320q-demo-bar abcabcabc.…
-                   → /nix/store/3lrgm74j85nzpnkz127rkwbx3fz5320q-demo-bar
-```
-
-Please note that showing the files and its contents while displaying the cycles only works
-on Linux.
@@ -1,20 +0,0 @@
---
-synopsis: "Fixed output derivations can be run using `pasta` network isolation"
-cls: [3452]
-issues: [fj#285]
-category: "Breaking Changes"
-credits: [horrors, puck]
---
-
-Fixed output derivations traditionally run in the host network namespace.
-On Linux this allows such derivations to communicate with other sandboxes
-or the host using the abstract Unix domains socket namespace; this hasn't
-been unproblematic in the past and has been used in two distinct exploits
-to break out of the sandbox. For this reason fixed output derivations can
-now run in a network namespace (provided by [`pasta`]), restricted to TCP
-and UDP communication with the rest of the world. When enabled this could
-be a breaking change and we classify it as such, even though we don't yet
-enable or require such isolation by default. We may enforce this in later
-releases of Lix once we have sufficient confidence that breakage is rare.
-
-[`pasta`]: https://passt.top/
@@ -1,21 +0,0 @@
---
-synopsis: Remove reliance on Bash for remote stores via SSH
-issues: [fj#830, fj#805, fj#304]
-cls: [3159]
-category: "Fixes"
-credits: [raito]
---
-
-The pre-flight `echo started` handshake -- added years ago to catch race conditions -- has been removed.
-
-After removal of connection sharing in Lix 2.93, it required a Bash-compatible shell and a standard `echo`, so it failed on:
-
-  * builders protected by `ForceCommand` wrappers (e.g. `nix-remote-build`),
-  * BusyBox / initrd images with no Bash,
-  * hosts using non-POSIX shells such as Nushell.
-
-The race the probe once addressed was tied to SSH connection-sharing -- since connection-sharing code has already been removed, the probe is now pointless.
-
-Real connection or protocol errors are now left to SSH/Nix to report directly.
-
-This is technically a breaking change if you had scripts that relied on the literal "started" which needs to be updated to rely on other signals, e.g., exit codes.
@@ -1,20 +0,0 @@
---
-synopsis: Remove support for daemon protocols before 2.18
-issues: [fj#510]
-cls: [3249]
-significance: significant
-category: "Breaking Changes"
-credits: [horrors]
---
-
-Support for daemon wire protocols belonging to Nix 2.17 or older have been
-removed. This impacts clients connecting to the local daemon socket or any
-remote builder configured using the `ssh-ng` protocol. Builders configured
-with the `ssh` protocol are still accessible from clients such as Nix 2.3.
-Additionally Lix will not be able to connect to an old daemon locally, and
-remote build connections to old daemons is likewise limited to `ssh` urls.
-
-We have decided to take this step because the old protocols are very badly
-tested (if at all), maintenance overhead is high, and a number of problems
-with their design makes it infeasible to remain backwards compatible while
-we move Lix to a more modern RPC mechanism with better versioning support.
@@ -1,14 +0,0 @@
---
-synopsis: "`nix eval --write-to` has been removed"
-cls: [4045]
-issues: [fj#974, fj#227]
-category: "Breaking Changes"
-credits: [horrors]
---
-
-`nix eval --write-to` has been removed since it was underspecified, not widely
-useful, and prone to security-sensitive misbehaviors. The feature was added in
-Nix 2.4 purely for internal use in the build system. According to our research
-it hasn't found any use outside of some distribution packaging scripts. Please
-use structured outputs formats (such as JSON) instead as they have better type
-fidelity, don't conflate attributes with paths, and are useful to other tools.
@@ -1,17 +0,0 @@
---
-synopsis: Remove impure derivations and dynamic derivations
-issues: [fj#815]
-cls: [3210]
-significance: significant
-category: "Breaking Changes"
-credits: [horrors]
---
-
-The `impure-derivations` and `dynamic-derivations` experimental feature have
-been removed.
-
-New impure or dynamic derivations cannot be created from this point forward, and
-any such pre-existing store derivations canot be read or built any more.
-Derivation outputs created by building such a derivation are still valid
-until garbage collected; existing store derivations can only be garbage
-collected.
@@ -1,17 +0,0 @@
---
-synopsis: Remove the `parse-toml-timestamps` experimental feature
-category: "Breaking Changes"
-credits: [emilazy]
---
-
-The `parse-toml-timestamps` experimental feature has been removed.
-
-This feature used in‐band signalling to mark timestamps, making it
-impossible to unambiguously parse TOML documents. It also exposed
-implementation‐defined behaviour in the TOML specification that
-changed in the toml11 parser library.
-
-Any interface for parsing TOML timestamps suitable for future
-stabilization would necessarily involve breaking changes, and there
-is no evidence this experimental feature is being relied upon in the
-wild, so it has been removed.
@@ -1,20 +0,0 @@
---
-synopsis: "repl-overlays now work in the debugger for flakes"
-issues: [fj#777]
-cls: [3398]
-category: Fixes
-credits: [jade]
---
-Due to a bug, it was previously not possible to use the debugger on flakes with repl-overlays, or with pure evaluation in general:
-
-```
-$ nix repl --pure-eval
-Lix 2.94.0-dev-pre20250617-87d99da
-Type :? for help.
-Loading 'repl-overlays'...
-error: access to absolute path '/Users/jade/.config/nix/repl.nix' is forbidden in pure eval mode (use '--impure' to override)
-```
-
-This is now fixed.
-The contents of the repl-overlays file itself (i.e. most typically the top level lambda in it) will be evaluated in impure mode.
-It may be necessary to use `builtins.seq` to force the impure operations to happen first if one wants to do impure operations inside a repl-overlays file in pure evaluation mode.
@@ -1,19 +0,0 @@
---
-synopsis: "`disallowedRequisites` now reports chains of disallowed requisites"
-issues: [fj#334,fj#626,gh#10877]
-category: Improvements
-credits: [ma27,roberth]
---
-
-When a build fails because of [`disallowedRequisites`](@docroot@/language/advanced-attributes.md#adv-attr-disallowedRequisites), the error message now includes the chain of references that led to the failure. This makes it easier to see in which derivations the chain can be broken, to resolve the problem.
-
-Example:
-
-```
-$ nix-build -A hello
-error: output '/nix/store/0b7k85gg5r28gb54px9nq7iv5986mns9-hello-2.12.2' is not allowed to refer to the following paths:
-       /nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-glibc-2.40-66
-       Shown below are chains that lead to the forbidden path(s).
-       /nix/store/0b7k85gg5r28gb54px9nq7iv5986mns9-hello-2.12.2
-       └───/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-glibc-2.40-66
-```
@@ -1,17 +0,0 @@
---
-synopsis: "libstore/binary-cache-store: don't cache narinfo on nix copy, remove negative entry"
-issues: []
-cls: [3789]
-category: Fixes
-credits: [ma27]
---
-
-When using e.g. [Snix's nar-bridge](https://snix.dev/docs/components/overview/#nar-bridge) via
-an `http`-store, Lix would create cache entries with a wrong URL to the NAR when uploading
-a store-path.
-
-This caused hard build failures for Hydra.
-
-Lix doesn't create these entries on upload anymore. Instead, it only removes negative cache entries.
-The cache entry for a narinfo is now created the first time, Lix queries the cache
-for the previously uploaded store-path again.
@@ -1,10 +0,0 @@
---
-synopsis: "Lix libraries can now be linked statically"
-issues: [fj#789]
-cls: [3775, 3778]
-category: Fixes
-credits: [alois31]
---
-Previously the pkg-config files distributed with Lix were only suitable for dynamic linkage, causing "undefined reference to…" linker errors when trying to link statically.
-Private dependency information has now been added to make static linkage work as expected without user intervention.
-In addition, relevant static libraries are now prelinked to avoid strange failures due to missing static initializers.
@@ -1,34 +0,0 @@
---
-synopsis: Symbols reuses once-allocated Value to reduce garbage collected allocations
-issues: []
-cls: [3308, 3300, 3314, 3310, 3312, 3313]
-category: Improvements
-credits: [raito, horrors, thubrecht, xokdvium, nan-git]
---
-
-In the Lix evaluator, **symbols** represent immutable strings, like those used
-for attribute names.
-
-In evaluator design, such strings are typically [**interned**](https://en.wikipedia.org/wiki/String_interning), stored uniquely
-to save memory, and Lix inherits this approach from the original C++ codebase.
-
-However, some builtins, like `builtins.attrNames`, must return a `Value` type
-that can represent any Nix value (strings, integers, lists, etc.).
-
-Before this change, these builtins would create lists of `Value` objects by
-allocating them through the garbage collector, copying the symbol’s string
-content each time.
-
-This allocation is unnecessary if the interned symbols themselves also hold a
-`Value` representation allocated outside the garbage collector, since these
-live for the full duration of evaluation.
-
-As a result, this reduces the number of allocations, leading to:
-
-* A significant drop in maximum [resident set memory](https://en.wikipedia.org/wiki/Resident_set_size) (RSS), with some large-scale
-  tests showing up to 11% (about 500 MiB) savings in large colmena deployments.
-* A slight decrease in CPU usage during Nix evaluations.
-
-This change is inspired by https://github.com/NixOS/nix/pull/13258 but the approach is different.
-
-**Note** : [`xokdvium`](https://github.com/xokdvium) is the rightful author of https://gerrit.lix.systems/c/lix/+/3300 and the credit was missed on our end during the development process. We are deeply sorry for this mistake.
@@ -1,14 +0,0 @@
---
-synopsis: Reject overflowing TOML integer literals
-issues: []
-cls: [3916]
-category: "Breaking Changes"
-credits: [emilazy]
---
-
-The toml11 library used by Lix was updated. The new
-version aligns with the [TOML v1.0.0 specification’s
-requirement](https://toml.io/en/v1.0.0#integer) to reject integer
-literals that cannot be losslessly parsed. This means that code like
-`builtins.fromTOML "v=0x8000000000000000"` will now produce an error
-rather than silently saturating the integer result.
@@ -1,15 +0,0 @@
---
-synopsis: uid-range depends on cgroups
-issues: []
-cls: [3230]
-category: "Breaking Changes"
-credits: [raito, horrors]
---
-
-`uid-range` builds now depends on `cgroups`, an experimental feature.
-
-`uid-range` builds already depended upon `auto-allocate-uids`, another experimental feature.
-
-The rationale for doing so is that `uid-range` provides a sandbox with many
-UIDs, this is useful for re-mapping them into a nested namespace, e.g. a
-container.
@@ -1,10 +0,0 @@
---
-synopsis: add description to zsh completions
-issues: [fj#910]
-cls: [3632]
-category: "Fixes"
-credits: [matthewbauer]
---
-
-Emit descriptions when completing args in zsh completions. This uses the descriptions we already
-provided in NIX\_GET\_COMPLETIONS.
@@ -20,6 +20,7 @@
  - [Basic Package Management](package-management/basic-package-mgmt.md)
  - [Profiles](package-management/profiles.md)
  - [Garbage Collection](package-management/garbage-collection.md)
+    - [Garbage Collector Roots](package-management/garbage-collector-roots.md)
  - [Sharing Packages Between Machines](package-management/sharing-packages.md)
    - [Serving a Nix store via HTTP](package-management/binary-cache-substituter.md)
    - [Copying Closures via SSH](package-management/copy-closure.md)
@@ -191,14 +192,11 @@
  - [Hacking](contributing/hacking.md)
  - [Testing](contributing/testing.md)
  - [Experimental Features](contributing/experimental-features.md)
-  - [Deprecated Features](contributing/deprecated-features.md)
  - [CLI guideline](contributing/cli-guideline.md)
  - [C++ style guide](contributing/cxx.md)
 - [Release Notes](release-notes/release-notes.md)
  - [Upcoming release](release-notes/rl-next.md)
    <!-- RELENG-AUTO-INSERTION-MARKER (see releng/release_notes.py) -->
-  - [Lix 2.93 (2025-05-09)](release-notes/rl-2.93.md)
-  - [Lix 2.92 (2025-01-18)](release-notes/rl-2.92.md)
  - [Lix 2.91 (2024-08-12)](release-notes/rl-2.91.md)
  - [Lix 2.90 (2024-07-10)](release-notes/rl-2.90.md)
  - [Nix 2.18 (2023-09-20)](release-notes/rl-2.18.md)
@@ -75,9 +75,7 @@ by spaces. Only the first element is required. To leave a field at its
 default, set it to `-`.

 1.  The URI of the remote store in the format
-    `ssh://[username@]hostname[?port=<port>]`, e.g. `ssh://nix@mac` or `ssh://mac`.
-    If the ssh server is not listening on port 22 (e.g. port 1337 in this case)
-    the URI would be `ssh://nix@mac?port=1337`
+    `ssh://[username@]hostname`, e.g. `ssh://nix@mac` or `ssh://mac`.
    For backward compatibility, `ssh://` may be omitted. The hostname
    may be an alias defined in your `~/.ssh/config`.

@@ -22,9 +22,9 @@ The following [concept map] shows its main components (rectangles), the objects
           |                   |
 +----------|-------------------|--------------------------------+
 | Nix impl.|                   V                                |
-| (Lix)    |       +------------------------+                   |
-|          |       | command line interface |------.            |
-|          |       +------------------------+      |            |
+| (Lix)    |      +-------------------------+                   |
+|          |      | commmand line interface |------.            |
+|          |      +-------------------------+      |            |
 |          |                   |                   |            |
 |    evaluated by            calls              manages         |
 |          |                   |                   |            |
@@ -34,15 +34,9 @@ keep-outputs = true       # Nice for developers
 keep-derivations = true   # Idem
 ```

-Other files can be included with a line like `include <path>`.
+Other files can be included with a line like `include <path>`, where `<path>` is interpreted relative to the current configuration file.
 A missing file is an error unless `!include` is used instead.

-Paths in `include`s and option values are interpreted relative to the current configuration file.
-In user configuration files, paths starting with `~/` are tilde expanded (by replacing the tilde by the value of `$HOME`).
-
-Only user configuration files (like `$XDG_CONFIG_HOME/nix/nix.conf` or the files listed in `$NIX_USER_CONF_FILES`) can use tilde paths relative to your home directory.
-Configuration listed in the `$NIX_CONFIG` environment variable may not use relative paths.
-
 A configuration setting usually overrides any previous value.
 However, for settings that take a list of items, you can prefix the name of the setting by `extra-` to *append* to the previous value.

@@ -1,12 +0,0 @@
-<!--
-  File-ish argument syntax summary.
-  This file gets included into pages like nix-build.md and nix-instantiate.md, and each individual page that includes
-  this also links to nix-build.md for the full explanation.
-->
- A normal filesystem path, like `/home/meow/nixfiles/default.nix`
-  - Or a directory, like `/home/meow/nixfiles`, equivalent to above
- A single lookup path, like `<nixpkgs>` or `<nixos>`
- A URL to a tarball, like `https://github.com/NixOS/nixpkgs/archive/refs/heads/release-23.11.tar.gz`
- A [flakeref](@docroot@/command-ref/new-cli/nix3-flake.md#flake-references), introduced by the prefix `flake:`, like `flake:git+https://git.lix.systems/lix-project/lix`
- A *nixpkgs* channel tarball name, introduced by the prefix `channel:`, like `channel:nixos-unstable`.
-  - This uses a hard-coded URL pattern and is *not* related to the subscribed channels managed by the [nix-channel](@docroot@/command-ref/nix-channel.md) command.
@@ -1,3 +1,23 @@
+xp_features_json = custom_target(
+  command : [nix, '__dump-xp-features'],
+  capture : true,
+  output : 'xp-features.json',
+)
+
+experimental_features_shortlist_md = custom_target(
+  command : nix_eval_for_docs + [
+    '--expr',
+    'import @INPUT0@ (builtins.fromJSON (builtins.readFile @INPUT1@))',
+  ],
+  input : [
+    '../../generate-xp-features-shortlist.nix',
+    xp_features_json,
+  ],
+  capture : true,
+  output : 'experimental-features-shortlist.md',
+  env : nix_env_for_docs,
+)
+
 # Intermediate step for manpage generation.
 # This splorks the output of generate-manpage.nix as JSON,
 # which gets written as a directory tree below.
@@ -31,23 +51,16 @@ nix3_cli_files = custom_target(

 conf_file_md = custom_target(
  command : [
-    python.full_path(),
-    '@SOURCE_ROOT@/lix/code-generation/build_settings.py',
-    '--kernel', host_machine.system(),
-    '--docs', '@OUTPUT@',
-    '--experimental-features', '@SOURCE_ROOT@/lix/libutil/experimental-features',
-    '@INPUT@',
+    nix_eval_for_docs,
+    '--expr',
+    '(import @INPUT0@).showSettings { inlineHTML = true; } (builtins.fromJSON (builtins.readFile @INPUT1@))',
  ],
+  capture : true,
  input : [
-    libexpr_setting_definitions,
-    libfetchers_setting_definitions,
-    file_transfer_setting_definitions,
-    libstore_setting_definitions,
-    archive_setting_definitions,
-    feature_setting_definitions,
-    logging_setting_definitions,
-    daemon_setting_definitions,
-    develop_settings_definitions,
+    '../../utils.nix',
+    conf_file_json,
+    experimental_features_shortlist_md,
  ],
  output : 'conf-file.md',
+  env : nix_env_for_docs,
 )
@@ -4,7 +4,7 @@

 # Synopsis

-`nix-build` [*fileish…*]
+`nix-build` [*paths…*]
  [`--arg` *name* *value*]
  [`--argstr` *name* *value*]
  [{`--attr` | `-A`} *attrPath*]
@@ -20,55 +20,19 @@ For documentation on the latter, run `nix build --help` or see `man nix3-build`.
 # Description

 The `nix-build` command builds the derivations described by the Nix
-expressions in each *fileish*. If the build succeeds, it places a symlink to
+expressions in *paths*. If the build succeeds, it places a symlink to
 the result in the current directory. The symlink is called `result`. If
 there are multiple Nix expressions, or the Nix expressions evaluate to
 multiple derivations, multiple sequentially numbered symlinks are
 created (`result`, `result-2`, and so on).

-If no *fileish* is specified, then `nix-build` will use `default.nix` in
+If no *paths* are specified, then `nix-build` will use `default.nix` in
 the current directory, if it exists.

-## Fileish Syntax
-
-A given *fileish* may take one of a few different forms, the first being a simple filesystem path, e.g. `nix-build /tmp/some-file.nix`.
-Like the [import builtin](../language/builtins.md#builtins-import) specifying a directory is equivalent to specifying `default.nix` within that directory.
-It may also be a [search path](./env-common.md#env-NIX_PATH) (also known as a lookup path) like `<nixpkgs>`, which is convenient to use with `--attr`/`-A`:
-
-```console
-$ nix-build '<nixpkgs>' -A firefox
-```
-
-(Note the quotation marks around `<nixpkgs>`, which will be necessary in most Unix shells.)
-
-If a *fileish* starts with `http://` or `https://`, it is interpreted as the URL of a tarball which will be fetched and unpacked.
-Lix will then `import` the unpacked directory, so these tarballs must include at least a single top-level directory with a file called `default.nix`
-For example, you could build from a specific version of Nixpkgs with something like:
-
-```console
-$ nix-build "https://github.com/NixOS/nixpkgs/archive/refs/heads/release-23.11.tar.gz" -A firefox
-```
-
-If a path starts with `flake:`, the rest of the argument is interpreted as a [flakeref](./new-cli/nix3-flake.md#flake-references) (see `nix flake --help` or `man nix3-flake`), which requires the "flakes" experimental feature to be enabled.
-Lix will fetch the flake, and then `import` its unpacked directory, so the flake must include a file called `default.nix`.
-For example, the flake analogues to the above `nix-build` commands are:
-
-```console
-$ nix-build flake:nixpkgs -A firefox
-$ nix-build flake:github:NixOS/nixpkgs/release-23.11 -A firefox
-```
-
-Finally, for legacy reasons, if a path starts with `channel:`, the rest of the argument is interpreted as the name of a *nixpkgs* channel tarball to fetch from `https://nixos.org/channels/$CHANNEL_NAME/nixexprs.tar.xz`.
-This is a **hard coded URL** pattern and is *not* related to the subscribed channels managed by the [nix-channel](./nix-channel.md) command.
-
-> **Note**: any of the special syntaxes may always be disambiguated by prefixing the path.
-> For example: a file in the current directory literally called `<nixpkgs>` can be addressed as `./<nixpkgs>`, to escape the special interpretation.
-
-In summary, a path argument may be one of:
-
-{{#include ./fileish-summary.md}}
-
-## Notes
+If an element of *paths* starts with `http://` or `https://`, it is
+interpreted as the URL of a tarball that will be downloaded and unpacked
+to a temporary location. The tarball must include a single top-level
+directory containing at least a file named `default.nix`.

 `nix-build` is essentially a wrapper around
 [`nix-instantiate`](nix-instantiate.md) (to translate a high-level Nix
@@ -14,7 +14,7 @@ The moving parts of channels are:
 - The official channels listed at <https://nixos.org/channels>
 - The user-specific list of [subscribed channels](#subscribed-channels)
 - The [downloaded channel contents](#channels)
- The [Nix expression search path](@docroot@/command-ref/conf-file.md#conf-nix-path), set with the [`-I` option](#opt-I) or the [`NIX_PATH` environment variable](#env-NIX_PATH)
+- The [Nix expression search path](@docroot@/command-ref/conf-file.md#conf-nix-path), set with the [`-I` option](#opt-i) or the [`NIX_PATH` environment variable](#env-NIX_PATH)

 > **Note**
 >
@@ -36,7 +36,7 @@ Instead, it looks in a few locations, and acts on all profiles it finds there:
   >
   > Not stable; subject to change
   >
-   > Do not rely on this functionality; it just exists for migration purposes and may change in the future.
+   > Do not rely on this functionality; it just exists for migration purposes and is may change in the future.
   > These deprecated paths remain a private implementation detail of Lix.

   <!-- FIXME(Qyriad): this is inconsistent with https://git.lix.systems/lix-project/lix/issues/215, needs updating when that happens -->
@@ -8,7 +8,7 @@
  [`--option` *name* *value*]
  [`--arg` *name* *value*]
  [`--argstr` *name* *value*]
-  [{`--file` | `-f`} *fileish*]
+  [{`--file` | `-f`} *path*]
  [{`--profile` | `-p`} *path*]
  [`--system-filter` *system*]
  [`--dry-run`]
@@ -26,7 +26,7 @@ This operation deletes the specified generations of the current profile.
  >
  > Older *and newer* generations will be deleted by this operation.
  >
-  > One might expect this to just delete older generations than the current one, but that is only true if the current generation is also the latest.
+  > One might expect this to just delete older generations than the curent one, but that is only true if the current generation is also the latest.
  > Because one can roll back to a previous generation, it is possible to have generations newer than the current one.
  > They will also be deleted.

@@ -11,7 +11,6 @@
  [`--from-profile` *path*]
  [`--preserve-installed` | `-P`]
  [`--remove-all` | `-r`]
-  [`--priority` *priority*]

 # Description

@@ -60,11 +59,6 @@ a number of possible ways:
    unambiguous way, which is necessary if there are multiple
    derivations with the same name.

-  - If `--priority` *priority* is given, the priority of the derivations being
-    installed is set to *priority*. This can be used to override the priority of
-    the derivations being installed. This is useful if *args* are store paths,
-    which don't have any priority information.
-
  - If *args* are [store derivations](@docroot@/glossary.md#gloss-store-derivation), then these are
    [realised](@docroot@/command-ref/nix-store/realise.md), and the resulting output paths
    are installed.
@@ -148,8 +142,8 @@ To copy the store path with symbolic name `gcc` from another profile:
 $ nix-env --install --from-profile /nix/var/nix/profiles/foo gcc
 ```

-To install a specific [store derivation](@docroot@/glossary.md#gloss-store-derivation)
-(typically created by `nix-instantiate`):
+To install a specific [store derivation] (typically created by
+`nix-instantiate`):

 ```console
 $ nix-env --install /nix/store/fibjb1bfbpm5mrsxc4mh2d8n37sxh91i-gcc-3.4.3.drv
@@ -2,16 +2,16 @@

 The following options are allowed for all `nix-env` operations, but may not always have an effect.

-  - `--file` / `-f` *fileish*\
+  - `--file` / `-f` *path*\
    Specifies the Nix expression (designated below as the *active Nix
    expression*) used by the `--install`, `--upgrade`, and `--query
    --available` operations to obtain derivations. The default is
    `~/.nix-defexpr`.

-    *fileish* is interpreted the same as with [nix-build](../nix-build.md#fileish-syntax).
-    See that section for complete details (`nix-build --help`), but in summary, a path argument may be one of:
-
-    {{#include ../fileish-summary.md}}
+    If the argument starts with `http://` or `https://`, it is
+    interpreted as the URL of a tarball that will be downloaded and
+    unpacked to a temporary location. The tarball must include a single
+    top-level directory containing at least a file named `default.nix`.

  - `--profile` / `-p` *path*\
    Specifies the profile to be used by those operations that operate on
@@ -22,7 +22,7 @@ left untouched; this is not an error. It is also not an error if an
 element of *args* matches no installed derivations.

 For a description of how *args* is mapped to a set of store paths, see
-[`--install`](install.md). If *args* describes multiple
+[`--install`](#operation---install). If *args* describes multiple
 store paths with the same symbolic name, only the one with the highest
 version is installed.

@@ -5,13 +5,13 @@
 # Synopsis

 `nix-instantiate`
-  [`--parse` | `--eval` [`--strict`] [`--raw`] [`--json`] [`--xml`] ]
+  [`--parse` | `--eval` [`--strict`] [`--json`] [`--xml`] ]
  [`--read-write-mode`]
  [`--arg` *name* *value*]
  [{`--attr`| `-A`} *attrPath*]
  [`--add-root` *path*]
  [`--expr` | `-E`]
-  *fileish…*
+  *files…*

 `nix-instantiate` `--find-file` *files…*

@@ -25,11 +25,8 @@ of the resulting store derivations are printed on standard output.

 [store derivation]: ../glossary.md#gloss-store-derivation

-If *fileish* is the character `-`, then a Nix expression will be read from standard input.
-Otherwise, each *fileish* is interpreted the same as with [nix-build](./nix-build.md#fileish-syntax).
-See that section for complete details (`nix-build --help`), but in summary, a path argument may be one of:
-
-{{#include ./fileish-summary.md}}
+If *files* is the character `-`, then a Nix expression will be read from
+standard input.

 # Options

@@ -38,14 +35,7 @@ See that section for complete details (`nix-build --help`), but in summary, a pa

  - `--parse`\
    Just parse the input files, and print their abstract syntax trees on
-    standard output. The output format of the AST depends on the current
-    internal representation and may change in the future.
-
-    Tooling can use the stderr and exit code of `--parse` to check any
-    Nix code for correctness, but should not rely on stdout without careful
-    versioning. Note that `--parse` also checks for unbound variables.
-    In cases where this is undesired, `with {};` can be prepended
-    to the program to transform all such parse errors into eval errors.
+    standard output as a Nix expression.

  - `--eval`\
    Just parse and evaluate the input files, and print the resulting
@@ -107,27 +97,15 @@ See that section for complete details (`nix-build --help`), but in summary, a pa
    > This option can cause non-termination, because lazy data
    > structures can be infinitely large.

-  - `--raw`\
-    When used with `--eval`, the result must be coercible to a string, i.e.,
-    something that can be converted using `${...}`.
-
-    Integers will always generate an error when output via `--raw`, regardless of
-    [`coerce-integers`](../contributing/experimental-features.md#xp-feature-coerce-integers) being enabled, to avoid ambiguity.
-
-    The output is printed exactly as-is, with no quotes, escaping, or trailing
-    newline.
-
  - `--json`\
    When used with `--eval`, print the resulting value as an JSON
-    representation of the resulting value rather than as a Nix expression.
-
-    The conversion behaviour, if `--strict` is passed, is the same as
-    [`builtins.toJSON`](../language/builtins.md#builtins-toJSON).
+    representation of the abstract syntax tree rather than as a Nix expression.

  - `--xml`\
    When used with `--eval`, print the resulting value as an XML
-    representation of the resulting value rather than as a Nix expression.
-    The schema is the same as that used by [`builtins.toXML`](../language/builtins.md#builtins-toXML).
+    representation of the abstract syntax tree rather than as a Nix expression.
+    The schema is the same as that used by the [`toXML`
+    built-in](../language/builtins.md).

  - `--read-write-mode`\
    When used with `--eval`, perform evaluation in read/write mode so
@@ -33,9 +33,10 @@ the environment of a derivation for development.
 If *path* is not given, `nix-shell` defaults to `shell.nix` if it
 exists, and `default.nix` otherwise.

-If *path* is given it is interpreted like a [*fileish* argument to nix-build](./nix-build.md#fileish-syntax):
-
-{{#include ./fileish-summary.md}}
+If *path* starts with `http://` or `https://`, it is interpreted as the
+URL of a tarball that will be downloaded and unpacked to a temporary
+location. The tarball must include a single top-level directory
+containing at least a file named `default.nix`.

 If the derivation defines the variable `shellHook`, it will be run
 after `$stdenv/setup` has been sourced. Since this hook is not executed
@@ -4,7 +4,7 @@

 # Synopsis

-`nix-store` `--delete` [`--ignore-liveness`] [`--skip-live`] [`--delete-closure`] *paths…*
+`nix-store` `--delete` [`--ignore-liveness`] *paths…*

 # Description

@@ -18,13 +18,6 @@ With the option `--ignore-liveness`, reachability from the roots is
 ignored. However, the path still won’t be deleted if there are other
 paths in the store that refer to it (i.e., depend on it).

-This operation will raise an error if any of the paths are still live
-and `--ignore-liveness` is not passed. Passing `--skip-live` will
-prevent this from being considered an error.
-
-The option `--delete-closure` will also attempt to delete any paths
-that are in the given path's dependency closure.
-
 {{#include ./opt-common.md}}

 {{#include ../opt-common.md}}
@@ -93,12 +93,9 @@ symlink.
    [deriver]: ../../glossary.md#gloss-deriver

  - `--valid-derivers`\
-    Prints the set of all [derivers](../../glossary.md#gloss-deriver) that can be
-    used to build the store paths *paths*.
-    This differs from `--deriver`, which prints the deriver that actually
-    produced *paths*.
-    No deriver may be returned if is not present in the store,
-    eg, if *paths* were substituted from a binary cache.
+    Prints a set of derivation files (`.drv`) which are supposed produce
+    said paths when realized. Might print nothing, for example for source paths
+    or paths subsituted from a binary cache.

  - `--graph`\
    Prints the references graph of the store paths *paths* in the format
@@ -15,6 +15,7 @@ Each of *paths* is processed as follows:
  1. If it is not [valid], substitute the store derivation file itself.
  2. Realise its [output paths]:
    - Try to fetch from [substituters] the [store objects] associated with the output paths in the store derivation's [closure].
+      - With [content-addressed derivations] (experimental): Determine the output paths to realise by querying content-addressed realisation entries in the [Nix database].
    - For any store paths that cannot be substituted, produce the required store objects. This involves first realising all outputs of the derivation's dependencies and then running the derivation's [`builder`](@docroot@/language/derivations.md#attr-builder) executable. <!-- TODO: Link to build process page #8888 -->
 - Otherwise, and if the path is not already valid: Try to fetch the associated [store objects] in the path's [closure] from [substituters].

@@ -27,6 +28,7 @@ If no substitutes are available and no store derivation is given, realisation fa
 [store objects]: @docroot@/glossary.md#gloss-store-object
 [closure]: @docroot@/glossary.md#gloss-closure
 [substituters]: @docroot@/command-ref/conf-file.md#conf-substituters
+[content-addressed derivations]: @docroot@/contributing/experimental-features.md#xp-feature-ca-derivations
 [Nix database]: @docroot@/glossary.md#gloss-nix-database

 The resulting paths are printed on standard output.
@@ -85,7 +85,7 @@ Most commands in Lix accept the following command-line options:

  - `multiline-with-logs`

-    Display the raw logs, with a progress bar and activities each in a new line at the bottom.
+    Displayes the raw logs, with a progress bar and activities each in a new line at the bottom.


 - <span id="opt-no-build-output">[`--no-build-output`](#opt-no-build-output)</span> / `-Q`
@@ -661,8 +661,8 @@ Verbosity levels are:

 The default level that the command starts is `ERROR`. The simplest way to
 increase the verbosity by stacking `-v` option (eg: `-vvv == level 3 == INFO`).
-Use `--quiet` to decrease verbosity by one level.
-There is one shortcut, `--debug` to run in `DEBUG` verbosity level.
+There are also two shortcuts, `--debug` to run in `DEBUG` verbosity level and
+`--quiet` to run in `ERROR` verbosity level.

 ----------

@@ -1,37 +0,0 @@
-This section describes the notion of *deprecated features*, and how it fits into the big picture of the development of Lix.
-
-# What are deprecated features?
-
-Deprecated features are disabled by default, with the intent to eventually remove them.
-Users must explicitly enable them to keep using them, by toggling the associated [deprecated feature flags](@docroot@/command-ref/conf-file.md#conf-deprecated-features).
-This allows backwards compatibility and a graceful transition away from undesired features.
-
-# Which features can be deprecated?
-
-Undesired features should be soft-deprecated by yielding a warning when used for a significant amount of time before the can be deprecated.
-Legacy obsolete feature with little to no usage may go through this process faster.
-Deprecated features should have a migration path to a preferred alternative.
-
-# Lifecycle of a deprecated feature
-
-This description is not normative, but a feature removal may roughly happen like this:
-
-1. Add a warning when the feature is being used.
-2. Disable the feature by default, putting it behind a deprecated feature flag.
-  - If disabling the feature started out as an opt-in experimental feature, turn that experimental flag into a no-op or remove it entirely.
-    For example, `--extra-experimental-features=no-url-literals` becomes `--extra-deprecated-features=url-literals`.
-3. Decide on a time frame for how long that feature will still be supported for backwards compatibility, and clearly communicate that in the error messages.
-  - Sometimes, automatic migration to alternatives is possible, and such should be provided if possible
-  - At least one NixOS release cycle should be the minimum
-4. Finally remove the feature entirely, only keeping the error message for those still using it.
-
-# Relation to language versioning
-
-Obviously, removing anything breaks backwards compatibility.
-In an ideal world, we'd have SemVer controls over the language and its features, cleanly allowing us to make breaking changes.
-See https://wiki.lix.systems/books/lix-contributors/page/language-versioning and [RFC 137](https://github.com/nixos/rfcs/pull/137) for efforts on that.
-However, we do not live in such an ideal world, and currently this goal is so far away, that "just disable it with some back-compat for a couple of years" is the most realistic solution, especially for comparatively minor changes.
-
-# Currently available deprecated features
-
-{{#include @generated@/../../../lix/libutil/deprecated-feature-descriptions.md}}
@@ -99,4 +99,4 @@ This means that experimental features and RFCs are orthogonal mechanisms, and ca

 # Currently available experimental features

-{{#include @generated@/../../../lix/libutil/experimental-feature-descriptions.md}}
+{{#include @generated@/contributing/experimental-feature-descriptions.md}}
@@ -11,19 +11,7 @@ The following instructions assume you already have some version of Nix or Lix in

 [installation instructions]: ../installation/installation.md

-A typical development flow for simple changes in Lix looks like:
- [Set up and build Lix](#building)
- For large changes, check in regarding design and possibly create an RFD issue on Forgejo
- Make the changes in your editor
- [Send the changes to Gerrit](#sending-to-gerrit)
- Once you have the number for the CL from Gerrit to put in the changelog, [write a changelog entry](#release-notes) and amend it into the commit
- Update the Gerrit change by submitting it with the same command as the first time
- Request and receive a code review
- Address feedback from the review
- Amend commits, send to Gerrit again
- Submit the approved change
-
-## Building Lix in a development shell {#building}
+## Building Lix in a development shell

 ### Setting up the development shell

@@ -51,28 +39,17 @@ $ nix-shell -A native-clangStdenvPackages

 ### Building from the development shell

-Run a clean build and test with `just clean setup build install test`.
-
-You can also run the unit tests and integration tests separately:
+You can build and test Lix with just:

 ```bash
-$ just setup build test-unit
-$ just install test-integration
+$ just setup
+$ just build
+$ just test --suite=check
+$ just install
+$ just test --suite=installcheck
 ```

-Many justfile aliases have a `-custom` variant which pass extra arguments to `meson`.
-For example, to work on both Lix and nix-eval-jobs you can run:
-
-```
-$ just setup-custom -Dnix-eval-jobs=enabled
-$ # or
-$ mesonFlags=-Dnix-eval-jobs=enabled just setup
-```
-
-Note that only targets which don't accept extra arguments can be used when
-running multiple targets at once; `just setup build` is fine, but `just
-setup-custom build` is an error. The `test` target is usually the last one to
-run, so it always accepts extra arguments.
+(Check and installcheck may both be done after install, allowing you to omit the --suite argument entirely, but this is the order package.nix runs them in.)

 You can also build Lix manually:

@@ -125,14 +102,14 @@ $ meson compile -C build nixexpr
 All targets may be addressed as their output, relative to the build directory, e.g.:

 ```bash
-$ meson compile -C build lix/libexpr/liblixexpr.so
+$ meson compile -C build src/libexpr/liblixexpr.so
 ```

 But Meson does not consider intermediate files like object files targets.
 To build a specific object file, use Ninja directly and specify the output file relative to the build directory:

 ```bash
-$ ninja -C build lix/libexpr/liblixexpr.so.p/nixexpr.cc.o
+$ ninja -C build src/libexpr/liblixexpr.so.p/nixexpr.cc.o
 ```

 To inspect the canonical source of truth on what the state of the buildsystem configuration is, use:
@@ -141,36 +118,7 @@ To inspect the canonical source of truth on what the state of the buildsystem co
 $ meson introspect
 ```

-## Sending changes to Gerrit for review {#sending-to-gerrit}
-
-We use Gerrit for all our code review in Lix.
-Our instance is at <https://gerrit.lix.systems>.
-
-There's much more information about how to use Gerrit in the [wiki section on Gerrit][wiki-gerrit] including how to use Jujutsu, how to use the UI and more.
-The Snix project also has some Gerrit information [in their contributing docs][snix-gerrit].
-
-[wiki-gerrit]: https://wiki.lix.systems/books/lix-contributors/chapter/gerrit
-[snix-gerrit]: https://snix.dev/docs/guides/contributing/
-
-The gist is that once you have your SSH key and git remote set up, you can send commits for review with:
-
-```
-$ git remote set-url origin ssh://YOURUSERNAME@gerrit.lix.systems:2022/lix
-$ git push origin HEAD:refs/for/main
-```
-
-Then, you can request a review via the "Reply" button on the web UI.
-If you click "Suggest Owners", it will try to suggest the maintainers of the area of the code change to send review requests to.
-Requesting reviews from multiple people is normal.
-
-We do our best to respond to directly sent reviews in a few days, so feel free to request another reviewer or ask on Matrix if you've not got a response for a while.
-Keep in mind that Lix is a volunteer project and we have limited bandwidth, so some changes aren't feasible to shepherd through; please check in on Matrix at design time when doing large changes.
-
-Once you get a `Code-Review+2` vote on your change, it's rebased on `main` and CI marks it `Verified+1`, you're able (and usually expected, so you can have a second chance to check it over) to hit the Submit button to merge it.
-If the change appears as "Rebase Required", you need to rebase it on `main` locally or via the Gerrit UI and wait for `Verified+1` before the Submit button is made active
-The `Code-Review+2` from before will stick around through trivial rebases so no need to re-request review for a mere rebase.
-
-## Building Lix with `nix`
+## Building Lix outside of development shells

 To build a release version of Lix for the current operating system and CPU architecture:

@@ -193,7 +141,6 @@ Lix can be built for various platforms, as specified in [`flake.nix`]:

 - `x86_64-linux`
 - `x86_64-darwin`
- `x86_64-freebsd`
 - `i686-linux`
 - `aarch64-linux`
 - `aarch64-darwin`
@@ -270,7 +217,7 @@ Lix uses a string with the following format to identify the *system type* or *pl

 It is set when Lix is compiled for the given system, and determined by [Meson's `host_machine.cpu_family()` and `host_machine.system()` values](https://mesonbuild.com/Reference-manual_builtin_host_machine.html).

-For historic reasons and backward-compatibility, some CPU and OS identifiers are translated from the GNU Autotools naming convention in [`meson.build`](https://git.lix.systems/lix-project/lix/src/branch/main/meson.build) as follows:
+For historic reasons and backward-compatibility, some CPU and OS identifiers are translated from the GNU Autotools naming convention in [`meson.build`](https://git.lix.systems/lix-project/lix/blob/main/meson.build) as follows:

 | `host_machine.cpu_family()`             | Nix                 |
 |----------------------------|---------------------|
@@ -297,13 +244,13 @@ To build with one of those environments, you can use
 $ nix build .#nix-ccacheStdenv
 ```

-for <a id="nix-with-flakes">flake-enabled Nix</a>, or
+for flake-enabled Nix, or

 ```console
 $ nix-build --attr nix-ccacheStdenv
 ```

-for <a id="classic-nix">classic Nix</a>.
+for classic Nix.

 You can use any of the other supported environments in place of `nix-ccacheStdenv`.

@@ -327,10 +274,10 @@ Configure your editor to use the `clangd` from the shell, either by running it i
 > Some other editors (e.g. Emacs, Vim) need a plugin to support LSP servers in general (e.g. [lsp-mode](https://github.com/emacs-lsp/lsp-mode) for Emacs and [vim-lsp](https://github.com/prabirshrestha/vim-lsp) for vim).
 > Editor-specific setup is typically opinionated, so we will not cover it here in more detail.

-# Manual and documentation
-
-## Building the manual
+### Checking links in the manual

+The build checks for broken internal links.
+This happens late in the process, so `nix build` is not suitable for iterating.
 To build the manual incrementally, run:

 ```console
@@ -342,20 +289,15 @@ meson compile -C build manual
 [`mdbook-linkcheck`]: https://github.com/Michael-F-Bryan/mdbook-linkcheck
 [URI fragments]: https://en.wikipedia.org/wiki/URI_fragment

-The built manual is in `build/doc/manual/manual/index.html`.
+#### `@docroot@` variable

-The build checks for broken internal links.
-This happens late in the process, so `nix build` is not suitable for iterating and it's recommended to use the `meson` command above instead.
+`@docroot@` provides a base path for links that occur in reusable snippets or other documentation that doesn't have a base path of its own.

-### `@\docroot\@` variable
+If a broken link occurs in a snippet that was inserted into multiple generated files in different directories, use `@docroot@` to reference the `doc/manual/src` directory.

-`@\docroot\@` provides a base path for links that occur in reusable snippets or other documentation that doesn't have a base path of its own.
-
-If a broken link occurs in a snippet that was inserted into multiple generated files in different directories, use `@\docroot\@` to reference the `doc/manual/src` directory.
-
-If the `@\docroot\@` literal appears in an error message from the `mdbook-linkcheck` tool, the `@\docroot\@` replacement needs to be applied to the generated source file that mentions it.
-See existing `@\docroot\@` logic in `doc/manual/substitute.py`.
-Regular markdown files used for the manual have a base path of their own and they can use relative paths instead of `@\docroot\@`.
+If the `@docroot@` literal appears in an error message from the `mdbook-linkcheck` tool, the `@docroot@` replacement needs to be applied to the generated source file that mentions it.
+See existing `@docroot@` logic in the [Makefile].
+Regular markdown files used for the manual have a base path of their own and they can use relative paths instead of `@docroot@`.

 ## API documentation

@@ -387,7 +329,7 @@ You can build it yourself:

 Metrics about the change in line/function coverage over time will be available in the future (FIXME(lix-hydra)).

-## Add a release note {#release-notes}
+## Add a release note

 `doc/manual/rl-next` contains release notes entries for all unreleased changes.

@@ -456,77 +398,4 @@ The following properties are supported:
 ### Build process

 Releases have a precomputed `rl-MAJOR.MINOR.md`, and no `rl-next.md`.
-Development releases have a generated `rl-next.md`.
-
-# Adding experimental or deprecated features, global settings, or builtins
-
-Experimental and deprecated features, global settings, and builtins are generally referenced both in the code and in the documentation.
-To prevent duplication or divergence, they are defined in data files, and a script generates the necessary glue.
-The data file format is similar to the release notes: it consists of a YAML metadata header, followed by the documentation in Markdown format.
-
-## Experimental or deprecated features
-
-Experimental and deprecated features support the following metadata properties:
-* `name` (required): user-facing name of the feature, to be used in `nix.conf` options and on the command line.
-  This should also be the stem of the file name (with extension `md`).
-* `internalName` (required): identifier used to refer to the feature inside the C++ code.
-
-Experimental feature data files should live in `lix/libutil/experimental-features`, and deprecated features in `lix/libutil/deprecated-features`.
-They must be listed in the `experimental_feature_definitions` or `deprecated_feature_definitions` lists in `lix/libutil/meson.build` respectively to be considered by the build system.
-
-## Global settings
-
-Global settings support the following metadata properties:
-* `name` (required): user-facing name of the setting, to be used as key in `nix.conf` and in the `--option` command line argument.
-* `internalName` (required): identifier used to refer to the setting inside the C++ code.
-* `platforms` (optional): a list specifying the platforms on which this setting is available.
-  If not specified, it is available on all platforms.
-  Valid platform names are `darwin`, `linux`.
-* `type` (optional): C++ type of the setting value.
-  This specifies the setting object type as `Setting<T>`; if more control is required, use `settingType` instead.
-* `settingType` (required if `type` is not specified): C++ type of the setting object.
-* `default` (optional): default value of the setting.
-  `null`, truth values, integers, strings and lists are supported as long as the correct YAML type is used, `type` is not taken into account).
-  Other types, machine-dependent values or non-standard representations must be handled using `defaultExpr` and `defaultText` instead.
-* `defaultExpr` (required if `default` is not specified): a string containing the C++ expression representing the default value.
-* `defaultText` (required if `default` is not specified): a string containing the Markdown expression representing the default value in the documentation.
-  Literal values are conventionally surrounded by backticks, and a system-dependent value is signaled by `*machine-specific*`.
-* `aliases` (optional): a list of secondary user-facing names under which the setting is available.
-  Defaults to empty if not specified.
-* `experimentalFeature` (optional): the user-facing name of the experimental feature which needs to be enabled to change the setting.
-  If not specified, no experimental feature is required.
-* `deprecated` (optional): whether the setting is deprecated and shown as such in the documentation for `nix.conf`.
-  Defaults to false if not specified.
-
-Settings are not collected in a single place in the source tree, so an appropriate place needs to be found for the setting to live.
-Look for related setting definition files under second-level subdirectories of `lix` whose name includes `settings`.
-Then add the new file there, and don't forget to register it in the appropriate `meson.build` file.
-
-## Builtin functions
-
-The following metadata properties are supported for builtin functions:
-* `name` (required): the language-facing name (as a member of the `builtins` attribute set) of the function.
-* `implementation` (optional): a C++ expression specifying the implementation of the builtin.
-  It must be a function of signature `void(EvalState &, PosIdx, Value * *, Value &)`.
-  If not specified, defaults to `prim_${name}`.
-* `renameInGlobalScope` (optional): whether the definition should be "hidden" in the global scope by prefixing its name with two underscores.
-  If not specified, defaults to `true`.
-* `args` (required): list containing the names of the arguments, as shown in the documentation.
-  All arguments must be listed here since the function arity is derived as the length of this list.
-* `experimental_feature` (optional): the user-facing name of the experimental feature which needs to be enabled for the builtin function to be available.
-  If not specified, no experimental feature is required.
-
-New builtin function definition files must be added to `lix/libexpr/builtins` and registered in the `builtin_definitions` list in `lix/libexpr/meson.build`.
-
-## Builtin constants
-The following metadata properties are supported for builtin constants:
-* `name` (required): the language-facing name (as a member of the `builtins` attribute set) of the constant.
-* `type` (required): the Nix language type of the constant; the C++ type is automatically derived.
-* `constructorArgs` (optional): list of strings containing C++ expressions passed as arguments to the appropriate `Value` constructor.
-  If the value computation is more complex, `implementation` can be used instead.
-* `implementation` (required if `constructorArgs` is not specified): string containing a C++ expressing computing the value of the constant.
-* `impure` (optional): whether the constant is considered impure.
-  Impure constants are not available when pure evaluation mode is activated.
-  Defaults to `false` when not specified.
-
-New builtin constant definition files must be added to `lix/libexpr/builtin-constants` and registered in the `builtin_constant_definitions` list in `lix/libexpr/meson.build`.
+Set `buildUnreleasedNotes = true;` in `flake.nix` to build the release notes on the fly.
@@ -0,0 +1,15 @@
+# Intermediate step for experimental-feature-descriptions.md.
+# This splorks the output of generate-xp-features.nix as JSON,
+# which gets written as a directory tree below.
+experimental_feature_descriptions_md = custom_target(
+  command : nix_eval_for_docs + [
+    '--expr',
+    'import @INPUT0@ (builtins.fromJSON (builtins.readFile @INPUT1@))',
+  ],
+  input : [
+    '../../generate-xp-features.nix',
+    xp_features_json,
+  ],
+  capture : true,
+  output : 'experimental-feature-descriptions.md',
+)
@@ -13,7 +13,7 @@ The unit tests are defined using the [googletest] and [rapidcheck] frameworks.
 >
 > ```
 > …
-> ├── lix
+> ├── src
 > │   ├── libexpr
 > │   │   ├── …
 > │   │   ├── value
@@ -46,10 +46,10 @@ The unit tests are defined using the [googletest] and [rapidcheck] frameworks.
 > …       …   …   …   …   …
 > ```

-The unit tests for each Lix library (`liblixexpr`, `liblixstore`, etc..) live inside a directory `lix/${library_shortname}/tests` within the directory for the library (`lix/${library_shortname}`).
+The unit tests for each Lix library (`liblixexpr`, `liblixstore`, etc..) live inside a directory `src/${library_shortname}/tests` within the directory for the library (`src/${library_shortname}`).

 The data is in `tests/unit/LIBNAME/data/LIBNAME`, with one subdir per library, with the same name as where the code goes.
-For example, `liblixstore` code is in `lix/libstore`, and its test data is in `tests/unit/libstore/data/libstore`.
+For example, `liblixstore` code is in `src/libstore`, and its test data is in `tests/unit/libstore/data/libstore`.
 The path to the unit test data directory is passed to the unit test executable with the environment variable `_NIX_TEST_UNIT_DATA`.

 ### Running tests
@@ -345,7 +345,7 @@ rg '(?:[^A-Za-z]|^)(_[A-Z][^-\[ }/:");$(]+)' -r '$1' --no-filename --only-matchi
 rg '\$\{?([A-Z][^-\[ }/:");]+)' -r '$1' --no-filename --only-matching tests | sort -u > vars.txt
 ```

-I grepped `lix/` for `get[eE]nv\("` to find the mentions in Lix code.
+I grepped `src/` for `get[eE]nv\("` to find the mentions in Lix code.

 ### Used by Lix testing support code

@@ -361,8 +361,8 @@ I grepped `lix/` for `get[eE]nv\("` to find the mentions in Lix code.

 - `_NIX_FORCE_HTTP` - Forces file URIs to be treated as remote ones.

-  Used by `lix/libfetchers/git.cc`, `lix/libstore/http-binary-cache-store.cc`,
-  `lix/libstore/local-binary-cache-store.cc`. Seems to be for forcing Git
+  Used by `src/libfetchers/git.cc`, `src/libstore/http-binary-cache-store.cc`,
+  `src/libstore/local-binary-cache-store.cc`. Seems to be for forcing Git
  clones of `git+file://` URLs, making the HTTP binary
  cache store accept `file://` URLs (presumably passing them to curl?), and
  unknown reasons for the local binary cache.
@@ -374,7 +374,7 @@ I grepped `lix/` for `get[eE]nv\("` to find the mentions in Lix code.
  `structuredAttrs` documentation.
 - `NIX_BIN_DIR`, `NIX_STORE_DIR` (or its inconsistently-used old alias `NIX_STORE`), `NIX_DATA_DIR`,
  `NIX_LOG_DIR`, `NIX_LOG_DIR`, `NIX_STATE_DIR`, `NIX_CONF_DIR` -
-  Overrides compile-time configuration of various locations used by Lix. See `lix/libstore/globals.cc`.
+  Overrides compile-time configuration of various locations used by Lix. See `src/libstore/globals.cc`.

  **Expected value**: a directory
 - `NIX_DAEMON_SOCKET_PATH` (optional) - Overrides the daemon socket path from `$NIX_STATE_DIR/daemon-socket/socket`.
@@ -449,6 +449,9 @@ I grepped `lix/` for `get[eE]nv\("` to find the mentions in Lix code.
 - `NIX_CLIENT_PACKAGE` - Runs the test suite against an alternate Nix client with the current daemon.

  **Expected value**: something like `/nix/store/...-nix-2.18.2`
+- `NIX_TESTS_CA_BY_DEFAULT` - Pass `__contentAddressed`, `outputHashMode` and `outputHashAlgo` to builds of some input-addressed derivations in the test suite.
+
+  **Expected value**: 1
 - `TEST_DATA` - Not an environment variable! This is used in repl characterization tests to refer to `tests/functional/repl_characterization/data`.
  More specifically, that path is replaced with the string `$TEST_DATA` in output for reproducibility.
 - `TEST_HOME` (output) - Set to the temporary directory that is set as `$HOME` inside the tests, underneath `$TEST_ROOT`.
@@ -41,6 +41,12 @@

  [realise]: #gloss-realise

+- [content-addressed derivation]{#gloss-content-addressed-derivation}
+
+  A derivation which has the
+  [`__contentAddressed`](./language/advanced-attributes.md#adv-attr-__contentAddressed)
+  attribute set to `true`.
+
 - [fixed-output derivation]{#gloss-fixed-output-derivation}

  A derivation which includes the
@@ -95,7 +101,7 @@

  See [File System Object](@docroot@/architecture/file-system-object.md) for details.

-  [file system object]: #gloss-store-path
+  [file system object]: #gloss-file-system-object

 - [store object]{#gloss-store-object}

@@ -108,13 +114,14 @@
 - [input-addressed store object]{#gloss-input-addressed-store-object}

  A store object produced by building a
+  non-[content-addressed](#gloss-content-addressed-derivation),
  non-[fixed-output](#gloss-fixed-output-derivation)
  derivation.

 - [output-addressed store object]{#gloss-output-addressed-store-object}

  A [store object] whose [store path] is determined by its contents.
-  This includes derivations and the outputs of [fixed-output derivations](#gloss-fixed-output-derivation).
+  This includes derivations, the outputs of [content-addressed derivations](#gloss-content-addressed-derivation), and the outputs of [fixed-output derivations](#gloss-fixed-output-derivation).

 - [substitute]{#gloss-substitute}

@@ -242,7 +249,7 @@
  links.  NARs are generated and unpacked using `nix-store --dump`
  and `nix-store --restore`.

- [`∅`]{#gloss-empty-set}
+- [`∅`]{#gloss-emtpy-set}

  The empty set symbol. In the context of profile history, this denotes a package is not present in a particular version of the profile.

@@ -1,6 +1,6 @@
 # Installing a Binary Distribution

-See <https://lix.systems/install/> for more details.
+See https://lix.systems/install/ for more details.

 <!--

@@ -36,10 +36,7 @@ All users of the Lix daemon may do the following to bring things into the Nix st
    - Input-addressed, so they are run in the sandbox with no network access, with the following exceptions:

      - The (poorly named, since it is not *just* about chroot) property `__noChroot` is set on the derivation and `sandbox` is set to `relaxed`.
-      - On macOS, the derivation property `__darwinAllowLocalNetworking` allows network access to localhost from input-addressed derivations regardless of the `sandbox` setting value.
-        This property exists with such semantics because macOS has no network namespace equivalent to isolate individual processes' localhost networking.
-      - On macOS, the derivation property `__sandboxProfile` accepts extra sandbox profile S-expressions, allowing derivations to bypass arbitrary parts of the sandbox without altogether disabling it.
-        This is only permitted when `sandbox` is set to `relaxed`.
+      - On macOS, the derivation property `__darwinAllowLocalNetworking` allows network access to localhost from input-addressed derivations regardless of the `sandbox` setting value. This property exists with such semantics because macOS has no network namespace equivalent to isolate individual processes' localhost networking.
    - Output-addressed, so they are run with network access but their result must match an expected hash.

  Trusted users may set any setting, including `sandbox = false`, so the sandbox state can be different at runtime from what is described in `nix.conf` for builds invoked with such settings.
@@ -54,6 +54,11 @@ The most current alternative to this section is to read `package.nix` and see wh
    obtained from the its repository
    <https://github.com/troglobit/editline>.

+  - The `libsodium` library for verifying cryptographic signatures
+    of contents fetched from binary caches.
+    It can be obtained from the official web site
+    <https://libsodium.org>.
+
  - Recent versions of Bison and Flex to build the parser. (This is
    because Nix needs GLR support in Bison and reentrancy support in
    Flex.) For Bison, you need version 2.6, which can be obtained from
@@ -148,7 +148,7 @@ paths) are set.

 For example, the following command gets all dependencies of the
 Pan newsreader, as described by [its
-Nix expression](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/pa/pan/package.nix):
+Nix expression](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/networking/newsreaders/pan/default.nix):

 ```console
 $ nix-shell '<nixpkgs>' --attr pan
@@ -209,8 +209,15 @@ Derivations can declare some infrequently used optional attributes.

  - [`__contentAddressed`]{#adv-attr-__contentAddressed}
    > **Warning**
-    > This attribute is part of a removed [experimental feature](@docroot@/contributing/experimental-features.md).
-    > Setting this flag *will* cause eval errors.
+    > This attribute is part of an [experimental feature](@docroot@/contributing/experimental-features.md).
+    >
+    > To use this attribute, you must enable the
+    > [`ca-derivations`](@docroot@/contributing/experimental-features.md#xp-feature-ca-derivations) experimental feature.
+    > For example, in [nix.conf](../command-ref/conf-file.md) you could add:
+    >
+    > ```
+    > extra-experimental-features = ca-derivations
+    > ```

    If this attribute is set to `true`, then the derivation
    outputs will be stored in a content-addressed location rather than the
@@ -254,7 +261,7 @@ Derivations can declare some infrequently used optional attributes.
    useful for very trivial derivations (such as `writeText` in Nixpkgs)
    that are cheaper to build than to substitute from a binary cache.

-    You may disable the effects of this attribute by enabling the
+    You may disable the effects of this attibute by enabling the
    `always-allow-substitutes` configuration option in Lix.

    > **Note**
@@ -302,6 +309,8 @@ Derivations can declare some infrequently used optional attributes.

    - `maxSize` defines the maximum size of the resulting [store object](../glossary.md#gloss-store-object).
    - `maxClosureSize` defines the maximum size of the output's closure.
+    - `ignoreSelfRefs` controls whether self-references should be considered when
+      checking for allowed references/requisites.

    Example:

@@ -4,7 +4,7 @@ These constants are built into the Nix language evaluator:

 <dl>

-{{#include @generated@/../../../lix/libexpr/builtin-constants.md}}
+{{#include @generated@/language/builtin-constants.md}}

 </dl>

@@ -15,6 +15,6 @@ For convenience, some built-ins can be accessed directly:
  <dd><p><var>derivation</var> is described in
         <a href="derivations.md">its own section</a>.</p></dd>

-{{#include @generated@/../../../lix/libexpr/builtins.md}}
+{{#include @generated@/language/builtins.md}}

 </dl>
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Raito Bezarius	600aff6dec	release: 2.91.2 "Dragon's Breath" Release produced with releng/create_release.xsh Change-Id: Iaae75be51d51a553c29720e00f98565d314783bb	2025-06-24 00:18:54 +02:00
Raito Bezarius	de67cf2666	release: release notes for 2.91.2 Release created with releng/create_release.xsh Change-Id: Idf78ea5315a8e6c3f44085605f2b2884754783ea	2025-06-24 00:17:16 +02:00
Raito Bezarius	013df0ae74	version: 2.91.1 -> 2.91.2 Fixes CVE-2025-46415, CVE-2025-46416, CVE-2025-52991, CVE-2025-52992, and CVE-2025-52993. Change-Id: Ie1d97a4e1569bf3b601753665b20cdeb5427e5ca Signed-off-by: Raito Bezarius <raito@lix.systems>	2025-06-24 00:17:16 +02:00
Raito Bezarius	875bf80541	flake: bump `nix2container` skopeo had a patch that doesn't apply anymore. That's unfortunate. We force bump nix2container to resume releng building. Change-Id: Ic04d962bd444fd5619de6e0842d3535f8bd1b296 Signed-off-by: Raito Bezarius <raito@lix.systems>	2025-06-24 00:17:16 +02:00
Raito Bezariusandeldritch horrors	3401d234f8	libstore/build: automatic clean up of unsuccessfully built scratch outputs When a build fails, its scratch output paths are not cleaned up. Until recently, this was deemed not a problem but as part of the effort to harden the Nix builds and protect these paths against being part of a staged attack (race conditions, etc.), we automatically cleanup after failed builds. Change-Id: I58481b1cc83826298b9d80d37fecf81f117ccb09 Signed-off-by: Raito Bezarius <raito@lix.systems>	2025-06-23 20:46:36 +00:00
eldritch horrors	a53f28aa80	libstore: don't default build-dir to temp-dir if a build directory is accessible to other users it is possible to smuggle data in and out of build directories. usually this ins only a build purity problem, but in combination with other issues it can be used to break out of a build sandbox. to prevent this we default to using a subdirectory of nixStateDir (which is more restrictive). Change-Id: Iacfc9b50534de158618c815f9fb99d7dae1be4d0	2025-06-23 20:46:15 +00:00
eldritch horrorsandPuck Meerburg	f58b74cb5b	libstore: use pasta for FODs if available This allows using a userspace program, pasta, to handle comms between the build sandbox, and the outside world; allowing for full isolation including the network namespace, closing the "fixed-output derivation talks to the host over an abstract domain socket" hole for good. Co-Authored-By: Puck Meerburg <puck@puckipedia.com> Change-Id: Ifd499b7dbb3784600a6e842fede65fc031ff9f15	2025-06-23 20:45:08 +00:00
eldritch horrorsandRaito Bezarius	3ba1c8dab8	libutil: add capability support to runProgram2 launching pasta to not run as root will ambient require capabilities. Change-Id: I1dd2506a1fa3944a9d9062123ef8a74903c597ea	2025-06-23 16:44:49 +02:00
eldritch horrorsandRaito Bezarius	395661e833	libutil: add generic redirections runProgram2 explicit stderr redirection makes mergeStderrToStdout unnecessary also. Change-Id: I63de929e6dc53f6c5ceb2d43c2ce288bfc04d872	2025-06-23 16:44:49 +02:00
eldritch horrorsandRaito Bezarius	b92ac2da34	libutil: make RunningProgram more useful make it moveable, make it killable, and add a stdout fd accessor. Change-Id: I2387cbe8ac67b899a322cd6c7d306ef9ea7abcd0	2025-06-23 16:44:49 +02:00
Raito Bezarius	255704a98c	libutil: ensure that `_deletePath` does NOT use absolute paths with dirfds When calling `_deletePath` with a parent file descriptor, `openat` is made effective by using relative paths to the directory file descriptor. To avoid the problem, the signature is changed to resist misuse with an assert in the prologue of the function. Change-Id: I6b3fc766bad2afe54dc27d47d1df3873e188de96 Signed-off-by: Raito Bezarius <raito@lix.systems>	2025-06-23 16:44:49 +02:00
Raito Bezarius	a6dcd6bae0	libstore: ensure that `passAsFile` is created in the original temp dir This ensures that `passAsFile` data is created inside the expected temporary build directory by `openat()` from the parent directory file descriptor. This avoids a TOCTOU which is part of the attack chain of CVE-????. Change-Id: Ie5273446c4a19403088d0389ae8e3f473af8879a Signed-off-by: Raito Bezarius <raito@lix.systems>	2025-06-23 16:44:44 +02:00
Raito Bezarius	bda2f174e4	libutil: writeFile variant for file descriptors `writeFile` lose its `sync` boolean flag to make things simpler. A new `writeFileAndSync` function is created and all call sites are converted to it. Change-Id: Ib871a5283a9c047db1e4fe48a241506e4aab9192 Signed-off-by: Raito Bezarius <raito@lix.systems>	2025-06-19 19:57:58 +02:00
Raito Bezarius	36327a3b2d	libstore: chown to builder variant for file descriptors We use it immediately for the build temporary directory. Change-Id: I180193c63a2b98721f5fb8e542c4e39c099bb947 Signed-off-by: Raito Bezarius <raito@lix.systems>	2025-06-19 19:57:58 +02:00
Raito Bezarius	d61d1c16e5	libstore: open build directory as a dirfd as well We now keep around a proper AutoCloseFD around the temporary directory which we plan to use for openat operations and avoiding the build directory being swapped out while we are doing something else. Change-Id: I18d387b0f123ebf2d20c6405cd47ebadc5505f2a Signed-off-by: Raito Bezarius <raito@lix.systems>	2025-06-19 19:57:58 +02:00
Raito Bezarius	0848a16cce	libutil: guess or invent a path from file descriptors This is useful for certain error recovery paths (no pun intended) that does not thread through the original path name. Change-Id: I2d800740cb4f9912e64c923120d3f977c58ccb7e Signed-off-by: Raito Bezarius <raito@lix.systems>	2025-06-19 19:57:58 +02:00
Jade Lovelace	0d5520594e	release: merge release 2.91.1 back to mainline This merge commit returns to the previous state prior to the release but leaves the tag in the branch history. Release created with releng/create_release.xsh Change-Id: I29e738732bdd3cc8c9d1e3a5a3e5aa83dfec2a6f	2024-10-18 17:39:22 -07:00
Jade Lovelace	2667fb70c1	release: 2.91.1 "Dragon's Breath" Release produced with releng/create_release.xsh Change-Id: Ib97d34a3bd4771242f6f719322c56651ee3e54e7	2024-10-18 17:39:21 -07:00
Jade Lovelace	eccb26dd44	release: release notes for 2.91.1 Release created with releng/create_release.xsh Change-Id: Ib705d64321bbb120e7859ee2a6d2cbe12b34e3fd	2024-10-18 17:38:23 -07:00
Jade Lovelace	dcdeefd9c2	[backport 2.91] fix: macOS build broken by fatal lowdown CLI sandbox setup This failed due to https://github.com/NixOS/nixpkgs/pull/346945, which makes a second lowdown-unsandboxed that works in nix builds, and the regular lowdown has executables that fail closed when the sandbox setup fails. The actual failure here is only visible on nixos-unstable at the moment, not 24.05, but this commit should fix it up for all versions. Fixes: https://git.lix.systems/lix-project/lix/issues/547 Change-Id: I50c0ecb59518ef01a7c0181114c1b4c5a7c6b78b (cherry picked from commit `a020f5f6cb`)	2024-10-17 21:18:20 +00:00
Jade Lovelace	4422a649e6	update version in prep for 2.91.1 release Change-Id: If8865912041cd099f7cfc27e72e0e2299e48fe53	2024-09-26 14:44:23 -07:00
Puck MeerburgandJade Lovelace	c89ceb1669	Fix passing custom CA files into the builtin:fetchurl sandbox Without this, verifying TLS certificates would fail on macOS, as well as any system that doesn't have a certificate file at /etc/ssl/certs/ca-certificates.crt, which includes e.g. Fedora. (cherry picked from commit `37b22dae04`) Change-Id: Iaa2e0e9db3747645b5482c82e3e0e4e8f229f5f9	2024-09-26 14:44:23 -07:00
Eelco DolstraandJade Lovelace	0f099ae619	[security] builtin:fetchurl: Enable TLS verification This is better for privacy and to avoid leaking netrc credentials in a MITM attack, but also the assumption that we check the hash no longer holds in some cases (in particular for impure derivations). Partially reverts https://github.com/NixOS/nix/commit/5db358d4d78aea7204a8f22c5bf2a309267ee038. upstream commits: (cherry picked from commit c04bc17a5a0fdcb725a11ef6541f94730112e7b6) (cherry picked from commit f2f47fa725fc87bfb536de171a2ea81f2789c9fb) (cherry picked from commit 7b39cd631e0d3c3d238015c6f450c59bbc9cbc5b) lix main: (cherry picked from commit `c1631b0a39`) Upstream-PR: https://github.com/NixOS/nix/pull/11585 Change-Id: Ia973420f6098113da05a594d48394ce1fe41fbb9	2024-09-26 14:44:23 -07:00
Yureka	ed51a172c6	libutil: fix conditional for close_range availability This check is wrong and would cause the close_range() function being called even when it's not available Change-Id: Ide65b36830e705fe772196c37349873353622761 (cherry picked from commit `df49d37b71`)	2024-08-20 09:09:57 +02:00
Artemis TosiniandJade Lovelace	ca2b514e20	meson: Don't use `target_machine` The target_machine variable is meant for the target of cross compilers. We are not a cross compiler, so instead reuse our host_machine based checks. Fixes Linux→FreeBSD cross, since Meson can't figure out `target_machine.kernel()` in that case. Fixes: https://git.lix.systems/lix-project/lix/issues/469 Change-Id: Ia46a64c8d507c3b08987a1de1eda171ff5e50df4	2024-08-16 23:56:57 -07:00