staging-next 2025-01-27

ci/OWNERS

@@ -245,6 +245,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /maintainers/scripts/kde @K900 @NickCao @SuperSandro2000 @ttuegel
 
 # PostgreSQL and related stuff
+/pkgs/by-name/ps/psqlodbc @NixOS/postgres
 /pkgs/servers/sql/postgresql @NixOS/postgres
 /pkgs/development/tools/rust/cargo-pgrx @NixOS/postgres
 /nixos/modules/services/databases/postgresql.md @NixOS/postgres

doc/languages-frameworks/python.section.md

@@ -183,7 +183,15 @@ following are specific to `buildPythonPackage`:
   [`makeWrapper`](#fun-makeWrapper) set `PATH` and `PYTHONPATH` environment variables before calling
   the binary. Additional arguments here can allow a developer to set environment
   variables which will be available when the binary is run. For example,
-  `makeWrapperArgs = ["--set FOO BAR" "--set BAZ QUX"]`.
+  `makeWrapperArgs = ["--set" "FOO" "BAR" "--set" "BAZ" "QUX"]`.
+
+  ::: {.note}
+  When `__structuredAttrs = false`, the attribute `makeWrapperArgs` is passed as a space-separated string to the build script. Developers should use `prependToVar` or `appendToVar` to add arguments to it in build phases, or use `__structuredAttrs = true` to ensure that `makeWrapperArgs` is passed as a Bash array.
+
+  For compatibility purposes,
+  when `makeWrapperArgs` shell variable is specified as a space-separated string (instead of a Bash array) in the build script, the string content is Bash-expanded before concatenated into the `wrapProgram` command. Still, developers should not rely on such behaviours, but use `__structuredAttrs = true` to specify flags containing spaces (e.g. `makeWrapperArgs = [ "--set" "GREETING" "Hello, world!" ]`), or use -pre and -post phases to specify flags with Bash-expansions (e.g. `preFixup = ''makeWrapperArgs+=(--prefix PATH : "$SOME_PATH")`'').
+  :::
+
 * `namePrefix`: Prepends text to `${name}` parameter. In case of libraries, this
   defaults to `"python3.8-"` for Python 3.8, etc., and in case of applications to `""`.
 * `pypaBuildFlags ? []`: A list of strings. Arguments to be passed to `python -m build --wheel`.
@@ -1273,7 +1281,7 @@ Using the example above, the analogous `pytestCheckHook` usage would be:
   ];
 
   # requires additional data
-  pytestFlagsArray = [
+  pytestFlags = [
     "tests/"
     "--ignore=tests/integration"
   ];
@@ -1433,7 +1441,7 @@ automatically add `pythonRelaxDepsHook` if either `pythonRelaxDeps` or
     unittestCheckHook
   ];
 
-  unittestFlagsArray = [
+  unittestFlags = [
     "-s" "tests" "-v"
   ];
 }
@@ -2002,7 +2010,7 @@ Occasionally packages don't make use of a common test framework, which may then
 
 * Non-working tests can often be deselected. Most Python modules
   do follow the standard test protocol where the pytest runner can be used.
-  `pytest` supports the `-k` and `--ignore` parameters to ignore test
+  `pytest` supports the `-k` and `--ignore-glob` parameters to ignore test
   methods or classes as well as whole files. For `pytestCheckHook` these are
   conveniently exposed as `disabledTests` and `disabledTestPaths` respectively.
 
@@ -2019,11 +2027,17 @@ Occasionally packages don't make use of a common test framework, which may then
     ];
 
     disabledTestPaths = [
-      "this/file.py"
+      "path/to/performance.py"
+      "path/to/connect-*.py"
     ];
   }
   ```
 
+  ::: {.note}
+  If the test path to disable contains characters like `*`, `?`, `[`, and `]`,
+  quote them with square brackets (`[*]`, `[?]`, `[[]`, and `[]]`) to match literally.
+  :::
+
 * Tests that attempt to access `$HOME` can be fixed by using the following
   work-around before running tests (e.g. `preCheck`): `export HOME=$(mktemp -d)`
 * Compiling with Cython causes tests to fail with a `ModuleNotLoadedError`.

doc/stdenv/stdenv.chapter.md

@@ -1371,6 +1371,20 @@ This setup hook moves any systemd user units installed in the `lib/` subdirector
 
 This hook only runs when compiling for Linux.
 
+### `no-broken-symlinks.sh` {#no-broken-symlinks.sh}
+
+This setup hook checks for, reports, and (by default) fails builds when "broken" symlinks are found. A symlink is considered "broken" if it's dangling (the target doesn't exist) or reflexive (it refers to itself).
+
+This hook can be disabled by setting `dontCheckForBrokenSymlinks`.
+
+::: {.note}
+The hook only considers symlinks with targets inside the Nix store.
+:::
+
+::: {.note}
+The check for reflexivity is direct and does not account for transitivity, so this hook will not prevent cycles in symlinks.
+:::
+
 ### `set-source-date-epoch-to-latest.sh` {#set-source-date-epoch-to-latest.sh}
 
 This sets `SOURCE_DATE_EPOCH` to the modification time of the most recent file.

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -24,6 +24,8 @@
 
 - The default Elixir version has been updated to 1.18.
 
+- `buildPythonPackage`, `buildPythonApplication` and the Python building setup hooks now support both `__structuredAttrs = true` and `__structuredAttrs = false`.
+
 - `services.dex` now restarts upon changes to the `.environmentFile` or entries in `.settings.staticClients[].secretFile` when the entry is a `path` type.
 
 - `nixos-rebuild-ng`, a full rewrite of `nixos-rebuild` in Python, is available for testing. You can enable it by setting [system.rebuild.enableNg](options.html#opt-system.rebuild.enableNg) in your configuration (this will replace the old `nixos-rebuild`), or by adding `nixos-rebuild-ng` to your `environment.systemPackages` (in this case, it will live side-by-side with `nixos-rebuild` as `nixos-rebuild-ng`). It is expected that the next major version of NixOS (25.11) will enable `system.rebuild.enableNg` by default.
@@ -170,6 +172,16 @@
   instead of the python tester launcher. You can still refer to the python
   launcher via `python3Packages.toPythonApplication python3Packages.playwright`
 
+- The representation of the flags attributes as shell/environment variables for most Python building setup hooks are now the same as `stdenv.mkDerivation` and other build helpers -- they are space-separated environment variables when `__structuredAttrs = false` and Bash arrays when `__structuredAttrs = true`, and are concatenated to the command without Bash-evaluation. The following behaviour changes are introduced during the conversion:
+
+  - The following flags are no longer Bash-expanded before concatenated to the command:
+    - `disabledTests` and `disabledTestPaths` for `pytestCheckHook`. (`disabledTestPaths` used to be expanded twice before concatenation.)
+    - `setupPyBuildFlags` and `setupPyGlobalFlags` for `setuptoolsBuildHook`.
+
+  - `pytestFlags` and `unittestFlags` replace `pytestFlagsArray` and `unittestFlagsArray` and become the new and conforming interface.
+
+  - `pytestFlagsArray` and `unittestFlagsArray` are kept for compatibility purposes. They continue to be Bash-expanded before concatenated. This compatibility layer will be removed in future releases.
+
 - `strawberry` has been updated to 1.2, which drops support for the VLC backend and Qt 5. The `strawberry-qt5` package
   and `withGstreamer`/`withVlc` override options have been removed due to this.
 

nixos/tests/postgresql/anonymizer.nix

@@ -109,7 +109,7 @@ let
 in
 lib.recurseIntoAttrs (
   lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
-    lib.filterAttrs (_: p: !p.pkgs.anonymizer.meta.broken) pkgs.postgresqlVersions
+    lib.filterAttrs (_: p: p ? pkgs && !p.pkgs.anonymizer.meta.broken) pkgs.postgresqlVersions
   )
   // {
     passthru.override = p: makeTestFor p;

nixos/tests/postgresql/pgjwt.nix

@@ -50,7 +50,7 @@ let
 in
 lib.recurseIntoAttrs (
   lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
-    lib.filterAttrs (_: p: !p.pkgs.pgjwt.meta.broken) pkgs.postgresqlVersions
+    lib.filterAttrs (_: p: p ? pkgs && !p.pkgs.pgjwt.meta.broken) pkgs.postgresqlVersions
   )
   // {
     passthru.override = p: makeTestFor p;

nixos/tests/postgresql/pgvecto-rs.nix

@@ -74,7 +74,7 @@ let
 in
 lib.recurseIntoAttrs (
   lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
-    lib.filterAttrs (_: p: !p.pkgs.pgvecto-rs.meta.broken) pkgs.postgresqlVersions
+    lib.filterAttrs (_: p: p ? pkgs && !p.pkgs.pgvecto-rs.meta.broken) pkgs.postgresqlVersions
   )
   // {
     passthru.override = p: makeTestFor p;

nixos/tests/postgresql/postgresql-tls-client-cert.nix

@@ -129,7 +129,9 @@ let
     };
 in
 lib.recurseIntoAttrs (
-  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) pkgs.postgresqlVersions
+  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
+    lib.filterAttrs (_: p: p ? pkgs) pkgs.postgresqlVersions
+  )
   // {
     passthru.override = p: makeTestFor p;
   }

nixos/tests/postgresql/postgresql-wal-receiver.nix

@@ -109,7 +109,9 @@ let
     };
 in
 lib.recurseIntoAttrs (
-  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) pkgs.postgresqlVersions
+  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
+    lib.filterAttrs (_: p: p ? pkgs) pkgs.postgresqlVersions
+  )
   // {
     passthru.override = p: makeTestFor p;
   }

nixos/tests/postgresql/postgresql.nix

@@ -263,7 +263,9 @@ let
     };
 in
 lib.recurseIntoAttrs (
-  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) pkgs.postgresqlVersions
+  lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
+    lib.filterAttrs (_: p: p ? pkgs) pkgs.postgresqlVersions
+  )
   // {
     passthru.override = p: makeTestFor p;
   }

nixos/tests/postgresql/timescaledb.nix

@@ -93,7 +93,7 @@ in
 #   NIXPKGS_ALLOW_UNFREE=1 nix-build -A nixosTests.postgresql.timescaledb
 lib.dontRecurseIntoAttrs (
   lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
-    lib.filterAttrs (_: p: !p.pkgs.timescaledb.meta.broken) pkgs.postgresqlVersions
+    lib.filterAttrs (_: p: p ? pkgs && !p.pkgs.timescaledb.meta.broken) pkgs.postgresqlVersions
   )
   // {
     passthru.override = p: makeTestFor p;

nixos/tests/postgresql/tsja.nix

@@ -43,7 +43,7 @@ let
 in
 lib.recurseIntoAttrs (
   lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
-    lib.filterAttrs (_: p: !p.pkgs.tsja.meta.broken) pkgs.postgresqlVersions
+    lib.filterAttrs (_: p: p ? pkgs && !p.pkgs.tsja.meta.broken) pkgs.postgresqlVersions
   )
   // {
     passthru.override = p: makeTestFor p;

nixos/tests/postgresql/wal2json.nix

@@ -45,7 +45,7 @@ let
 in
 lib.recurseIntoAttrs (
   lib.concatMapAttrs (n: p: { ${n} = makeTestFor p; }) (
-    lib.filterAttrs (_: p: !p.pkgs.wal2json.meta.broken) pkgs.postgresqlVersions
+    lib.filterAttrs (_: p: p ? pkgs && !p.pkgs.wal2json.meta.broken) pkgs.postgresqlVersions
   )
   // {
     passthru.override = p: makeTestFor p;

pkgs/applications/audio/ladspa-plugins/default.nix

@@ -36,6 +36,8 @@ stdenv.mkDerivation rec {
     perlPackages.perl
     perlPackages.XMLParser
     pkg-config
+    perlPackages.perl
+    perlPackages.XMLParser
   ];
   buildInputs = [
     fftw

pkgs/applications/audio/listenbrainz-mpd/default.nix

@@ -26,7 +26,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-QBc0avci232UIxzTKlS0pjL7cCuvwAFgw6dSwdtYAtU=";
   };
 
-  cargoHash = "sha256-jnDS9tIJ387A2P9oUSYB3tXrXjwwVmQ26erIIlHBkao=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-NQXXR6b1XZDihVoRNFJLXtMNjlzOIzkc4rthwx0A7AE=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/audio/lpd8editor/default.nix

@@ -2,7 +2,7 @@
   lib,
   qt5,
   stdenv,
-  git,
+  gitMinimal,
   fetchFromGitHub,
   cmake,
   alsa-lib,
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     cmake
-    git
+    gitMinimal
     qt5.wrapQtAppsHook
   ];
 

pkgs/applications/audio/minidsp/default.nix

@@ -19,7 +19,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-8bKP9/byVRKj1P1MP3ZVg8yw0WaNB0BcqarCti7B8CA=";
   };
 
-  cargoHash = "sha256-GUrYEFpTo83lKuDyENaVN3VhnZ2Y/igtsbEY7kNa1os=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-JIm0XcgqXGPXlkQ1rhG5D38bQkQT9K44F71ZaCT2g8o=";
 
   cargoBuildFlags = [ "-p minidsp -p minidsp-daemon" ];
 

pkgs/applications/audio/muso/default.nix

@@ -35,7 +35,8 @@ rustPlatform.buildRustPackage rec {
     cp share/* $out/share/muso/
   '';
 
-  cargoHash = "sha256-+UVUejKCfjC6zdW315wmu7f3A5GmnoQ3rIk8SK6LIRI=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-L0ZQoz9J5Hxg98puk1RbKuybLboIoOsy5qqGnvEPi1U=";
 
   meta = with lib; {
     broken = stdenv.hostPlatform.isDarwin;

pkgs/applications/audio/parrot/default.nix

@@ -24,7 +24,8 @@ rustPlatform.buildRustPackage {
     hash = "sha256-3YTXIKj1iqCB+tN7/0v1DAaMM6aJiSxBYHO98uK8KFo=";
   };
 
-  cargoHash = "sha256-3G7NwSZaiocjgfdtmJVWfMZOHCNhC08NgolPa9AvPfE=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-be/gGKCd8/VgcjzhyMKDl5TzAuavm1rPNYBm8RLTP90=";
 
   nativeBuildInputs = [
     cmake

pkgs/applications/blockchains/electrs/default.nix

@@ -21,7 +21,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-Xo7aqP4tIh/kYthPucscxnl+ZtVioEja4TTFdH0Q350=";
   };
 
-  cargoHash = "sha256-T98nbf6j7hLRoCa38rN5KDYHqnGmAcVt9edwQ3cduKY=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-wDEtVsgkddGv89tTy96wYzNWVicn34Gxi+YAo7yAfQA=";
 
   # needed for librocksdb-sys
   nativeBuildInputs = [ rustPlatform.bindgenHook ];

pkgs/applications/blockchains/lighthouse/default.nix

@@ -7,7 +7,7 @@
 , nix-update-script
 , openssl
 , pkg-config
-, postgresql
+, libpq
 , protobuf
 , rustPlatform
 , rust-jemalloc-sys
@@ -130,7 +130,7 @@ rustPlatform.buildRustPackage rec {
   ];
 
   nativeCheckInputs = [
-    postgresql
+    libpq
   ];
 
   passthru = {

pkgs/applications/blockchains/snarkos/default.nix

@@ -19,7 +19,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-+z9dgg5HdR+Gomug03gI1zdCU6t4SBHkl1Pxoq69wrc=";
   };
 
-  cargoHash = "sha256-qW/ZV4JqpNqqh8BYc+/d5g8junwhdZ38NhHclx+k/0M=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-riUOxmuXDP5+BPSPu5+cLBP43bZxAqvVG/k5kvThSAs=";
 
   # buildAndTestSubdir = "cli";
 

pkgs/applications/blockchains/teos/default.nix

@@ -32,7 +32,8 @@ in
     pname = "teos";
     inherit version src;
 
-    cargoHash = "sha256-U0imKEPszlBOaS6xEd3kfzy/w2SYe3EY/E1e0L+ViDk=";
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-lod5I94T4wGwXEDtvh2AyaDYM0byCfaSBP8emKV7+3M=";
 
     buildAndTestSubdir = "teos";
 
@@ -58,7 +59,8 @@ in
     pname = "teos-watchtower-plugin";
     inherit version src;
 
-    cargoHash = "sha256-3ke1qTFw/4I5dPLuPjIGp1n2C/eRfPB7A6ErMFfwUzE=";
+    useFetchCargoVendor = true;
+    cargoHash = "sha256-lod5I94T4wGwXEDtvh2AyaDYM0byCfaSBP8emKV7+3M=";
 
     buildAndTestSubdir = "watchtower-plugin";
 

pkgs/applications/blockchains/zcash/default.nix

@@ -7,7 +7,7 @@
   cxx-rs,
   db62,
   fetchFromGitHub,
-  git,
+  gitMinimal,
   hexdump,
   lib,
   libevent,
@@ -42,13 +42,14 @@ rustPlatform.buildRustPackage.override { inherit stdenv; } rec {
       --replace "linker = \"aarch64-linux-gnu-gcc\"" ""
   '';
 
-  cargoHash = "sha256-Mz8mr/RDcOfwJvXhY19rZmWHP8mUeEf9GYD+3JAPNOw=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-VBqasLpxqI4kr73Mr7OVuwb2OIhUwnY9CTyZZOyEElU=";
 
   nativeBuildInputs = [
     autoreconfHook
     cargo
     cxx-rs
-    git
+    gitMinimal
     hexdump
     makeWrapper
     pkg-config

pkgs/applications/display-managers/greetd/default.nix

@@ -18,7 +18,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-jgvYnjt7j4uubpBxrYM3YiUfF1PWuHAN1kwnv6Y+bMg=";
   };
 
-  cargoHash = "sha256-M52Kj14X+vMPKeGwi5pbEuh3F9/a3eVjhsbZI06Jkzs=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-JwTLZawY9+M09IDbMPoNUcNrnW1C2OVlEVn1n7ol6dY=";
 
   nativeBuildInputs = [
     scdoc

pkgs/applications/display-managers/greetd/regreet.nix

@@ -21,7 +21,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-f8Xvno5QqmWz4SUiFYDvs8lFU1ZaqQ8gpTaVzWxW4T8=";
   };
 
-  cargoHash = "sha256-XdJbghHT2NR+pWAsgayz748C8yw/Rv86lNfvjABwJws=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-abCQ3RsnZ/a1DbjQFOiA7Xs7bbqSJxwNps8yV6Q4FIw=";
 
   buildFeatures = [ "gtk4_8" ];
 

pkgs/applications/display-managers/greetd/tuigreet.nix

@@ -17,7 +17,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-e0YtpakEaaWdgu+bMr2VFoUc6+SUMFk4hYtSyk5aApY=";
   };
 
-  cargoHash = "sha256-RkJjAmZ++4nc/lLh8g0LxGq2DjZGxQEjFOl8Yzx116A=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-w6ZOqpwogKoN4oqqI1gFqY8xAnfvhEBVaL8/6JXpKXs=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/applications/display-managers/greetd/wlgreet.nix

@@ -19,7 +19,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-TQTHFBOTxtSuzrAG4cjZ9oirl80xc0rPdYeLJ0t39DQ=";
   };
 
-  cargoHash = "sha256-+YGhfEq2RltPq5oLLh1h+vGphDpoGZNVdvzko3P1iUQ=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-ITo9qvcT5aOybWLV7kn9BZbux6uxx1RwRGWCGQYdZ2I=";
 
   nativeBuildInputs = [ autoPatchelfHook ];
   buildInputs = [ gcc-unwrapped ];