Merge pull request #15262 from obsidiansystems/backport-15252-to-2.30-maintenance

[Backport 2.30-maintenance] upload-release: disable containerd image store to preserve gzip layer compression

.clang-format

@@ -8,7 +8,7 @@ BraceWrapping:
   AfterUnion: true
   SplitEmptyRecord: false
 PointerAlignment: Middle
-FixNamespaceComments: false
+FixNamespaceComments: true
 SortIncludes: Never
 #IndentPPDirectives: BeforeHash
 SpaceAfterCStyleCast: true
@@ -32,3 +32,4 @@ IndentPPDirectives: AfterHash
 PPIndentWidth: 2
 BinPackArguments: false
 BreakBeforeTernaryOperators: true
+SeparateDefinitionBlocks: Always

.git-blame-ignore-revs

@@ -0,0 +1,4 @@
+# bulk initial re-formatting with clang-format
+95d9c13716e0000f46f5279367fdecb5b4545923 # !autorebase ./maintainers/format.sh --until-stable
+# nixfmt 1.0.0
+7518fdc1f8f9468b3c3c310cbf4bfebb7d848692 # !autorebase ./maintainers/format.sh --until-stable

.github/actions/install-nix-action/action.yaml

@@ -0,0 +1,124 @@
+name: "Install Nix"
+description: "Helper action for installing Nix with support for dogfooding from master"
+inputs:
+  dogfood:
+    description: "Whether to use Nix installed from the latest artifact from master branch"
+    required: true # Be explicit about the fact that we are using unreleased artifacts
+  experimental-installer:
+    description: "Whether to use the experimental installer to install Nix"
+    default: false
+  experimental-installer-version:
+    description: "Version of the experimental installer to use. If `latest`, the newest artifact from the default branch is used."
+    # TODO: This should probably be pinned to a release after https://github.com/NixOS/experimental-nix-installer/pull/49 lands in one
+    default: "latest"
+  extra_nix_config:
+    description: "Gets appended to `/etc/nix/nix.conf` if passed."
+  install_url:
+    description: "URL of the Nix installer"
+    required: false
+    default: "https://releases.nixos.org/nix/nix-2.29.1/install"
+  tarball_url:
+    description: "URL of the Nix tarball to use with the experimental installer"
+    required: false
+  github_token:
+    description: "Github token"
+    required: true
+  use_cache:
+    description: "Whether to setup github actions cache (not implemented currently)"
+    default: false
+    required: false
+runs:
+  using: "composite"
+  steps:
+    - name: "Download nix install artifact from master"
+      shell: bash
+      id: download-nix-installer
+      if: inputs.dogfood == 'true'
+      run: |
+        RUN_ID=$(gh run list --repo "$DOGFOOD_REPO" --workflow ci.yml --branch master --status success --json databaseId --jq ".[0].databaseId")
+
+        if [ "$RUNNER_OS" == "Linux" ]; then
+          INSTALLER_ARTIFACT="installer-linux"
+        elif [ "$RUNNER_OS" == "macOS" ]; then
+          INSTALLER_ARTIFACT="installer-darwin"
+        else
+          echo "::error ::Unsupported RUNNER_OS: $RUNNER_OS"
+          exit 1
+        fi
+
+        INSTALLER_DOWNLOAD_DIR="$GITHUB_WORKSPACE/$INSTALLER_ARTIFACT"
+        mkdir -p "$INSTALLER_DOWNLOAD_DIR"
+
+        gh run download "$RUN_ID" --repo "$DOGFOOD_REPO" -n "$INSTALLER_ARTIFACT" -D "$INSTALLER_DOWNLOAD_DIR"
+        echo "installer-path=file://$INSTALLER_DOWNLOAD_DIR" >> "$GITHUB_OUTPUT"
+        TARBALL_PATH="$(find "$INSTALLER_DOWNLOAD_DIR" -name 'nix*.tar.xz' -print | head -n 1)"
+        echo "tarball-path=file://$TARBALL_PATH" >> "$GITHUB_OUTPUT"
+
+        echo "::notice ::Dogfooding Nix installer from master (https://github.com/$DOGFOOD_REPO/actions/runs/$RUN_ID)"
+      env:
+        GH_TOKEN: ${{ inputs.github_token }}
+        DOGFOOD_REPO: "NixOS/nix"
+    - name: "Gather system info for experimental installer"
+      shell: bash
+      if: ${{ inputs.experimental-installer == 'true' }}
+      run: |
+        echo "::notice Using experimental installer from $EXPERIMENTAL_INSTALLER_REPO (https://github.com/$EXPERIMENTAL_INSTALLER_REPO)"
+
+        if [ "$RUNNER_OS" == "Linux" ]; then
+          EXPERIMENTAL_INSTALLER_SYSTEM="linux"
+          echo "EXPERIMENTAL_INSTALLER_SYSTEM=$EXPERIMENTAL_INSTALLER_SYSTEM" >> "$GITHUB_ENV"
+        elif [ "$RUNNER_OS" == "macOS" ]; then
+          EXPERIMENTAL_INSTALLER_SYSTEM="darwin"
+          echo "EXPERIMENTAL_INSTALLER_SYSTEM=$EXPERIMENTAL_INSTALLER_SYSTEM" >> "$GITHUB_ENV"
+        else
+          echo "::error ::Unsupported RUNNER_OS: $RUNNER_OS"
+          exit 1
+        fi
+
+        if [ "$RUNNER_ARCH" == "X64" ]; then
+          EXPERIMENTAL_INSTALLER_ARCH=x86_64
+          echo "EXPERIMENTAL_INSTALLER_ARCH=$EXPERIMENTAL_INSTALLER_ARCH" >> "$GITHUB_ENV"
+        elif [ "$RUNNER_ARCH" == "ARM64" ]; then
+          EXPERIMENTAL_INSTALLER_ARCH=aarch64
+          echo "EXPERIMENTAL_INSTALLER_ARCH=$EXPERIMENTAL_INSTALLER_ARCH" >> "$GITHUB_ENV"
+        else
+          echo "::error ::Unsupported RUNNER_ARCH: $RUNNER_ARCH"
+          exit 1
+        fi
+
+        echo "EXPERIMENTAL_INSTALLER_ARTIFACT=nix-installer-$EXPERIMENTAL_INSTALLER_ARCH-$EXPERIMENTAL_INSTALLER_SYSTEM" >> "$GITHUB_ENV"
+      env:
+        EXPERIMENTAL_INSTALLER_REPO: "NixOS/experimental-nix-installer"
+    - name: "Download latest experimental installer"
+      shell: bash
+      id: download-latest-experimental-installer
+      if: ${{ inputs.experimental-installer == 'true' && inputs.experimental-installer-version == 'latest' }}
+      run: |
+        RUN_ID=$(gh run list --repo "$EXPERIMENTAL_INSTALLER_REPO" --workflow ci.yml --branch main --status success --json databaseId --jq ".[0].databaseId")
+
+        EXPERIMENTAL_INSTALLER_DOWNLOAD_DIR="$GITHUB_WORKSPACE/$EXPERIMENTAL_INSTALLER_ARTIFACT"
+        mkdir -p "$EXPERIMENTAL_INSTALLER_DOWNLOAD_DIR"
+
+        gh run download "$RUN_ID" --repo "$EXPERIMENTAL_INSTALLER_REPO" -n "$EXPERIMENTAL_INSTALLER_ARTIFACT" -D "$EXPERIMENTAL_INSTALLER_DOWNLOAD_DIR"
+        # Executable permissions are lost in artifacts
+        find $EXPERIMENTAL_INSTALLER_DOWNLOAD_DIR -type f -exec chmod +x {} +
+        echo "installer-path=$EXPERIMENTAL_INSTALLER_DOWNLOAD_DIR" >> "$GITHUB_OUTPUT"
+      env:
+        GH_TOKEN: ${{ inputs.github_token }}
+        EXPERIMENTAL_INSTALLER_REPO: "NixOS/experimental-nix-installer"
+    - uses: cachix/install-nix-action@c134e4c9e34bac6cab09cf239815f9339aaaf84e # v31.5.1
+      if: ${{ inputs.experimental-installer != 'true' }}
+      with:
+        # Ternary operator in GHA: https://www.github.com/actions/runner/issues/409#issuecomment-752775072
+        install_url: ${{ inputs.dogfood == 'true' && format('{0}/install', steps.download-nix-installer.outputs.installer-path) || inputs.install_url }}
+        install_options: ${{ inputs.dogfood == 'true' && format('--tarball-url-prefix {0}', steps.download-nix-installer.outputs.installer-path) || '' }}
+        extra_nix_config: ${{ inputs.extra_nix_config }}
+    - uses: DeterminateSystems/nix-installer-action@786fff0690178f1234e4e1fe9b536e94f5433196 # v20
+      if: ${{ inputs.experimental-installer == 'true' }}
+      with:
+        diagnostic-endpoint: ""
+        # TODO: It'd be nice to use `artifacts.nixos.org` for both of these, maybe through an `/experimental-installer/latest` endpoint? or `/commit/<hash>`?
+        local-root: ${{ inputs.experimental-installer-version == 'latest' && steps.download-latest-experimental-installer.outputs.installer-path || '' }}
+        source-url: ${{ inputs.experimental-installer-version != 'latest' && 'https://artifacts.nixos.org/experimental-installer/tag/${{ inputs.experimental-installer-version }}/${{ env.EXPERIMENTAL_INSTALLER_ARTIFACT }}' || '' }}
+        nix-package-url: ${{ inputs.dogfood == 'true' && steps.download-nix-installer.outputs.tarball-path || (inputs.tarball_url || '') }}
+        extra-conf: ${{ inputs.extra_nix_config }}

.github/workflows/ci.yml

@@ -13,8 +13,14 @@ jobs:
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0
-    - uses: cachix/install-nix-action@v31
-    - run: nix --experimental-features 'nix-command flakes' flake show --all-systems --json
+    - uses: ./.github/actions/install-nix-action
+      with:
+        dogfood: false
+        extra_nix_config:
+          experimental-features = nix-command flakes
+        github_token: ${{ secrets.GITHUB_TOKEN }}
+        use_cache: false
+    - run: nix flake show --all-systems --json
 
   tests:
     strategy:
@@ -34,13 +40,14 @@ jobs:
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0
-    - uses: cachix/install-nix-action@v31
+    - uses: ./.github/actions/install-nix-action
       with:
+        github_token: ${{ secrets.GITHUB_TOKEN }}
+        dogfood: false
         # The sandbox would otherwise be disabled by default on Darwin
         extra_nix_config: |
           sandbox = true
           max-jobs = 1
-    - uses: DeterminateSystems/magic-nix-cache-action@main
     # Since ubuntu 22.30, unprivileged usernamespaces are no longer allowed to map to the root user:
     # https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces
     - run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
@@ -92,90 +99,31 @@ jobs:
     - run: exec bash -c "nix-channel --add https://releases.nixos.org/nixos/unstable/nixos-23.05pre466020.60c1d71f2ba nixpkgs"
     - run: exec bash -c "nix-channel --update && nix-env -iA nixpkgs.hello && hello"
 
-  # Steps to test CI automation in your own fork.
-  # 1. Sign-up for https://hub.docker.com/
-  # 2. Store your dockerhub username as DOCKERHUB_USERNAME in "Repository secrets" of your fork repository settings (https://github.com/$githubuser/nix/settings/secrets/actions)
-  # 3. Create an access token in https://hub.docker.com/settings/security and store it as DOCKERHUB_TOKEN in "Repository secrets" of your fork
-  check_secrets:
-    permissions:
-      contents: none
-    name: Check Docker secrets present for installer tests
-    runs-on: ubuntu-24.04
-    outputs:
-      docker: ${{ steps.secret.outputs.docker }}
-    steps:
-      - name: Check for secrets
-        id: secret
-        env:
-          _DOCKER_SECRETS: ${{ secrets.DOCKERHUB_USERNAME }}${{ secrets.DOCKERHUB_TOKEN }}
-        run: |
-          echo "::set-output name=docker::${{ env._DOCKER_SECRETS != '' }}"
-
   docker_push_image:
-    needs: [tests, vm_tests, check_secrets]
+    name: Push docker image to DockerHub and GHCR
+    needs: [tests, vm_tests]
+    if: github.event_name == 'push' && github.ref_name == 'master'
+    uses: ./.github/workflows/docker-push.yml
+    with:
+      ref: ${{ github.sha }}
+      is_master: true
     permissions:
       contents: read
       packages: write
-    if: >-
-      needs.check_secrets.outputs.docker == 'true' &&
-      github.event_name == 'push' &&
-      github.ref_name == 'master'
-    runs-on: ubuntu-24.04
-    steps:
-    - name: Check for secrets
-      id: secret
-      env:
-        _DOCKER_SECRETS: ${{ secrets.DOCKERHUB_USERNAME }}${{ secrets.DOCKERHUB_TOKEN }}
-      run: |
-        echo "::set-output name=docker::${{ env._DOCKER_SECRETS != '' }}"
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-    - uses: cachix/install-nix-action@v31
-      with:
-        install_url: https://releases.nixos.org/nix/nix-2.20.3/install
-    - uses: DeterminateSystems/magic-nix-cache-action@main
-    - run: echo NIX_VERSION="$(nix --experimental-features 'nix-command flakes' eval .\#nix.version | tr -d \")" >> $GITHUB_ENV
-    - run: nix --experimental-features 'nix-command flakes' build .#dockerImage -L
-    - run: docker load -i ./result/image.tar.gz
-    - run: docker tag nix:$NIX_VERSION ${{ secrets.DOCKERHUB_USERNAME }}/nix:$NIX_VERSION
-    - run: docker tag nix:$NIX_VERSION ${{ secrets.DOCKERHUB_USERNAME }}/nix:master
-    # We'll deploy the newly built image to both Docker Hub and Github Container Registry.
-    #
-    # Push to Docker Hub first
-    - name: Login to Docker Hub
-      uses: docker/login-action@v3
-      with:
-        username: ${{ secrets.DOCKERHUB_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_TOKEN }}
-    - run: docker push ${{ secrets.DOCKERHUB_USERNAME }}/nix:$NIX_VERSION
-    - run: docker push ${{ secrets.DOCKERHUB_USERNAME }}/nix:master
-    # Push to GitHub Container Registry as well
-    - name: Login to GitHub Container Registry
-      uses: docker/login-action@v3
-      with:
-        registry: ghcr.io
-        username: ${{ github.actor }}
-        password: ${{ secrets.GITHUB_TOKEN }}
-    - name: Push image
-      run: |
-        IMAGE_ID=ghcr.io/${{ github.repository_owner }}/nix
-        # Change all uppercase to lowercase
-        IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
-
-        docker tag nix:$NIX_VERSION $IMAGE_ID:$NIX_VERSION
-        docker tag nix:$NIX_VERSION $IMAGE_ID:latest
-        docker push $IMAGE_ID:$NIX_VERSION
-        docker push $IMAGE_ID:latest
-        # deprecated 2024-02-24
-        docker tag nix:$NIX_VERSION $IMAGE_ID:master
-        docker push $IMAGE_ID:master
+    secrets:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
 
   vm_tests:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
-      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: ./.github/actions/install-nix-action
+        with:
+          dogfood: false
+          extra_nix_config:
+            experimental-features = nix-command flakes
+          github_token: ${{ secrets.GITHUB_TOKEN }}
       - uses: DeterminateSystems/magic-nix-cache-action@main
       - run: |
           nix build -L \
@@ -201,6 +149,10 @@ jobs:
         with:
           repository: NixOS/flake-regressions-data
           path: flake-regressions/tests
-      - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - uses: ./.github/actions/install-nix-action
+        with:
+          dogfood: false
+          extra_nix_config:
+            experimental-features = nix-command flakes
+          github_token: ${{ secrets.GITHUB_TOKEN }}
       - run: nix build -L --out-link ./new-nix && PATH=$(pwd)/new-nix/bin:$PATH MAX_FLAKES=25 flake-regressions/eval-all.sh

.github/workflows/docker-push.yml

@@ -0,0 +1,101 @@
+name: "Push Docker Image"
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        description: "Git ref to build the docker image from"
+        required: true
+        type: string
+      is_master:
+        description: "Whether run from master branch"
+        required: true
+        type: boolean
+    secrets:
+      DOCKERHUB_USERNAME:
+        required: true
+      DOCKERHUB_TOKEN:
+        required: true
+
+permissions: {}
+
+jobs:
+  # Steps to test CI automation in your own fork.
+  # 1. Sign-up for https://hub.docker.com/
+  # 2. Store your dockerhub username as DOCKERHUB_USERNAME in "Repository secrets" of your fork repository settings (https://github.com/$githubuser/nix/settings/secrets/actions)
+  # 3. Create an access token in https://hub.docker.com/settings/security and store it as DOCKERHUB_TOKEN in "Repository secrets" of your fork
+  check_secrets:
+    permissions:
+      contents: none
+    name: Check presence of secrets
+    runs-on: ubuntu-24.04
+    outputs:
+      docker: ${{ steps.secret.outputs.docker }}
+    steps:
+      - name: Check for DockerHub secrets
+        id: secret
+        env:
+          _DOCKER_SECRETS: ${{ secrets.DOCKERHUB_USERNAME }}${{ secrets.DOCKERHUB_TOKEN }}
+        run: |
+          echo "docker=${{ env._DOCKER_SECRETS != '' }}" >> $GITHUB_OUTPUT
+
+  push:
+    name: Push docker image to DockerHub and GHCR
+    needs: [check_secrets]
+    permissions:
+      contents: read
+      packages: write
+    if: needs.check_secrets.outputs.docker == 'true'
+    runs-on: ubuntu-24.04
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      with:
+        fetch-depth: 0
+        ref: ${{ inputs.ref }}
+    - uses: ./.github/actions/install-nix-action
+      with:
+        dogfood: false
+        extra_nix_config: |
+          experimental-features = flakes nix-command
+    - run: echo NIX_VERSION="$(nix eval .\#nix.version | tr -d \")" >> $GITHUB_ENV
+    - run: nix build .#dockerImage -L
+    - run: docker load -i ./result/image.tar.gz
+    # We'll deploy the newly built image to both Docker Hub and Github Container Registry.
+    #
+    # Push to Docker Hub first
+    - name: Login to Docker Hub
+      uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_TOKEN }}
+    - name: Push to Docker Hub
+      env:
+        IS_MASTER: ${{ inputs.is_master }}
+        DOCKERHUB_REPO: ${{ secrets.DOCKERHUB_USERNAME }}/nix
+      run: |
+        docker tag nix:$NIX_VERSION $DOCKERHUB_REPO:$NIX_VERSION
+        docker push $DOCKERHUB_REPO:$NIX_VERSION
+        if [ "$IS_MASTER" = "true" ]; then
+          docker tag nix:$NIX_VERSION $DOCKERHUB_REPO:master
+          docker push $DOCKERHUB_REPO:master
+        fi
+    # Push to GitHub Container Registry as well
+    - name: Login to GitHub Container Registry
+      uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    - name: Push to GHCR
+      env:
+        IS_MASTER: ${{ inputs.is_master }}
+      run: |
+        IMAGE_ID=ghcr.io/${{ github.repository_owner }}/nix
+        IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+
+        docker tag nix:$NIX_VERSION $IMAGE_ID:$NIX_VERSION
+        docker push $IMAGE_ID:$NIX_VERSION
+        if [ "$IS_MASTER" = "true" ]; then
+          docker tag nix:$NIX_VERSION $IMAGE_ID:master
+          docker push $IMAGE_ID:master
+        fi

.github/workflows/upload-release.yml

@@ -0,0 +1,80 @@
+name: Upload Release
+on:
+  workflow_dispatch:
+    inputs:
+      eval_id:
+        description: "Hydra evaluation ID"
+        required: true
+        type: number
+      is_latest:
+        description: "Mark as latest release"
+        required: false
+        type: boolean
+        default: false
+permissions:
+  contents: read
+  id-token: write
+  packages: write
+jobs:
+  release:
+    runs-on: ubuntu-24.04
+    environment: releases
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: ./.github/actions/install-nix-action
+        with:
+          dogfood: false # Use stable version
+          use_cache: false # Don't want any cache injection shenanigans
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+      - name: Set NIX_PATH from flake input
+        run: |
+          NIXPKGS_PATH=$(nix build --inputs-from .# nixpkgs#path --print-out-paths --no-link)
+          # Shebangs with perl have issues. Pin nixpkgs this way. nix shell should maybe
+          # get the same uberhack that nix-shell has to support it.
+          echo "NIX_PATH=nixpkgs=$NIXPKGS_PATH" >> "$GITHUB_ENV"
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
+        with:
+          role-to-assume: "arn:aws:iam::080433136561:role/nix-release"
+          role-session-name: nix-release-oidc-${{ github.run_id }}
+          aws-region: eu-west-1
+      - name: Disable containerd image store
+        run: |
+          # Docker 28+ defaults to the containerd image store, which
+          # pushes layers uncompressed instead of gzip. OCI clients
+          # that only support gzip (e.g. go-containerregistry) fail
+          # with "gzip: invalid header". Disabling the containerd
+          # snapshotter restores the classic storage driver, which
+          # preserves gzip-compressed layers through the
+          # `docker load` / `docker push` pipeline.
+          echo '{"features":{"containerd-snapshotter":false}}' | sudo tee /etc/docker/daemon.json > /dev/null
+          sudo systemctl restart docker
+      - name: Login to Docker Hub
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Upload release
+        run: |
+          ./maintainers/upload-release.pl \
+            ${{ inputs.eval_id }} \
+            --skip-git
+        env:
+          IS_LATEST: ${{ inputs.is_latest && '1' || '' }}
+      - name: Push to GHCR
+        run: |
+          DOCKER_OWNER="ghcr.io/$(echo '${{ github.repository_owner }}' | tr '[A-Z]' '[a-z]')/nix"
+          ./maintainers/upload-release.pl \
+            ${{ inputs.eval_id }} \
+            --skip-git \
+            --skip-s3 \
+            --docker-owner "$DOCKER_OWNER"
+        env:
+          IS_LATEST: ${{ inputs.is_latest && '1' || '' }}

.gitignore

@@ -47,3 +47,6 @@ result-*
 .DS_Store
 
 flake-regressions
+
+# direnv
+.direnv/

.mergify.yml

@@ -139,3 +139,14 @@ pull_request_rules:
         labels:
           - automatic backport
           - merge-queue
+
+  - name: backport patches to 2.29
+    conditions:
+      - label=backport 2.29-maintenance
+    actions:
+      backport:
+        branches:
+          - "2.29-maintenance"
+        labels:
+          - automatic backport
+          - merge-queue

.version

@@ -1 +1 @@
-2.29.0
+2.30.4

doc/manual/anchors.jq

@@ -24,8 +24,15 @@ def map_contents_recursively(transformer):
 def process_command:
     .[0] as $context |
     .[1] as $body |
-    $body + {
-        sections: $body.sections | map(map_contents_recursively(if $context.renderer == "html" then transform_anchors_html else transform_anchors_strip end)),
-    };
+    # mdbook 0.5.x uses 'items' instead of 'sections'
+    if $body.items then
+        $body + {
+            items: $body.items | map(map_contents_recursively(if $context.renderer == "html" then transform_anchors_html else transform_anchors_strip end)),
+        }
+    else
+        $body + {
+            sections: $body.sections | map(map_contents_recursively(if $context.renderer == "html" then transform_anchors_html else transform_anchors_strip end)),
+        }
+    end;
 
 process_command

doc/manual/book.toml.in

@@ -23,12 +23,3 @@ renderers = ["html"]
 command = "jq --from-file ./anchors.jq"
 
 [output.markdown]
-
-[output.linkcheck]
-# no Internet during the build (in the sandbox)
-follow-web-links = false
-
-# mdbook-linkcheck does not understand [foo]{#bar} style links, resulting in
-# excessive "Potential incomplete link" warnings. No other kind of warning was
-# produced at the time of writing.
-warning-policy = "ignore"

doc/manual/meson.build

@@ -246,11 +246,11 @@ nix3_manpages = [
   'nix3-nar',
   'nix3-path-info',
   'nix3-print-dev-env',
+  'nix3-profile',
+  'nix3-profile-add',
   'nix3-profile-diff-closures',
   'nix3-profile-history',
-  'nix3-profile-install',
   'nix3-profile-list',
-  'nix3-profile',
   'nix3-profile-remove',
   'nix3-profile-rollback',
   'nix3-profile-upgrade',

doc/manual/package.nix

@@ -6,7 +6,6 @@
   ninja,
   lowdown-unsandboxed,
   mdbook,
-  mdbook-linkcheck,
   jq,
   python3,
   rsync,
@@ -46,24 +45,22 @@ mkMesonDerivation (finalAttrs: {
   ];
 
   # Hack for sake of the dev shell
-  passthru.externalNativeBuildInputs =
-    [
-      meson
-      ninja
-      (lib.getBin lowdown-unsandboxed)
-      mdbook
-      mdbook-linkcheck
-      jq
-      python3
-      rsync
-      changelog-d
-    ]
-    ++ lib.optionals (!officialRelease) [
-      # When not an official release, we likely have changelog entries that have
-      # yet to be rendered.
-      # When released, these are rendered into a committed file to save a dependency.
-      changelog-d
-    ];
+  passthru.externalNativeBuildInputs = [
+    meson
+    ninja
+    (lib.getBin lowdown-unsandboxed)
+    mdbook
+    jq
+    python3
+    rsync
+    changelog-d
+  ]
+  ++ lib.optionals (!officialRelease) [
+    # When not an official release, we likely have changelog entries that have
+    # yet to be rendered.
+    # When released, these are rendered into a committed file to save a dependency.
+    changelog-d
+  ];
 
   nativeBuildInputs = finalAttrs.passthru.externalNativeBuildInputs ++ [
     nix-cli

doc/manual/rl-next/shorter-build-dir-names.md

@@ -0,0 +1,6 @@
+---
+synopsis: "Temporary build directories no longer include derivation names"
+prs: [13839]
+---
+
+Temporary build directories created during derivation builds no longer include the derivation name in their path to avoid build failures when the derivation name is too long. This change ensures predictable prefix lengths for build directories under `/nix/var/nix/builds`.

doc/manual/source/SUMMARY.md.in

@@ -57,6 +57,7 @@
   - [Tuning Cores and Jobs](advanced-topics/cores-vs-jobs.md)
   - [Verifying Build Reproducibility](advanced-topics/diff-hook.md)
   - [Using the `post-build-hook`](advanced-topics/post-build-hook.md)
+  - [Evaluation profiler](advanced-topics/eval-profiler.md)
 - [Command Reference](command-ref/index.md)
   - [Common Options](command-ref/opt-common.md)
   - [Common Environment Variables](command-ref/env-common.md)
@@ -136,6 +137,7 @@
   - [Contributing](development/contributing.md)
 - [Releases](release-notes/index.md)
 {{#include ./SUMMARY-rl-next.md}}
+  - [Release 2.30 (2025-07-07)](release-notes/rl-2.30.md)
   - [Release 2.29 (2025-05-14)](release-notes/rl-2.29.md)
   - [Release 2.28 (2025-04-02)](release-notes/rl-2.28.md)
   - [Release 2.27 (2025-03-03)](release-notes/rl-2.27.md)

doc/manual/source/advanced-topics/eval-profiler.md

@@ -0,0 +1,33 @@
+# Using the `eval-profiler`
+
+Nix evaluator supports [evaluation](@docroot@/language/evaluation.md)
+[profiling](<https://en.wikipedia.org/wiki/Profiling_(computer_programming)>)
+compatible with `flamegraph.pl`. The profiler samples the nix
+function call stack at regular intervals. It can be enabled with the
+[`eval-profiler`](@docroot@/command-ref/conf-file.md#conf-eval-profiler)
+setting:
+
+```console
+$ nix-instantiate "<nixpkgs>" -A hello --eval-profiler flamegraph
+```
+
+Stack sampling frequency and the output file path can be configured with
+[`eval-profile-file`](@docroot@/command-ref/conf-file.md#conf-eval-profile-file)
+and [`eval-profiler-frequency`](@docroot@/command-ref/conf-file.md#conf-eval-profiler-frequency).
+By default the collected profile is saved to `nix.profile` file in the current working directory.
+
+The collected profile can be directly consumed by `flamegraph.pl`:
+
+```console
+$ flamegraph.pl nix.profile > flamegraph.svg
+```
+
+The line information in the profile contains the location of the [call
+site](https://en.wikipedia.org/wiki/Call_site) position and the name of the
+function being called (when available). For example:
+
+```
+/nix/store/x9wnkly3k1gkq580m90jjn32q9f05q2v-source/pkgs/top-level/default.nix:167:5:primop import
+```
+
+Here `import` primop is called at `/nix/store/x9wnkly3k1gkq580m90jjn32q9f05q2v-source/pkgs/top-level/default.nix:167:5`.

doc/manual/source/command-ref/nix-channel.md

@@ -53,6 +53,11 @@ This command has the following operations:
   Download the Nix expressions of subscribed channels and create a new generation.
   Update all channels if none is specified, and only those included in *names* otherwise.
 
+  > **Note**
+  >
+  > Downloaded channel contents are cached.
+  > Use `--tarball-ttl` or the [`tarball-ttl` configuration option](@docroot@/command-ref/conf-file.md#conf-tarball-ttl) to change the validity period of cached downloads.
+
 - `--list-generations`
 
   Prints a list of all the current existing generations for the

doc/manual/source/development/building.md

@@ -215,14 +215,18 @@ nix build .#nix-everything-x86_64-w64-mingw32
 
 For historic reasons and backward-compatibility, some CPU and OS identifiers are translated as follows:
 
-| `config.guess`             | Nix                 |
-|----------------------------|---------------------|
-| `amd64`                    | `x86_64`            |
-| `i*86`                     | `i686`              |
-| `arm6`                     | `arm6l`             |
-| `arm7`                     | `arm7l`             |
-| `linux-gnu*`               | `linux`             |
-| `linux-musl*`              | `linux`             |
+| `host_machine.cpu_family()` | `host_machine.endian()` | Nix                 |
+|-----------------------------|-------------------------|---------------------|
+| `x86`                       |                         | `i686`              |
+| `arm`                       |                         | `host_machine.cpu()`|
+| `ppc`                       | `little`                | `powerpcle`         |
+| `ppc64`                     | `little`                | `powerpc64le`       |
+| `ppc`                       | `big`                   | `powerpc`           |
+| `ppc64`                     | `big`                   | `powerpc64`         |
+| `mips`                      | `little`                | `mipsel`            |
+| `mips64`                    | `little`                | `mips64el`          |
+| `mips`                      | `big`                   | `mips`              |
+| `mips64`                    | `big`                   | `mips64`            |
 
 ## Compilation environments
 

doc/manual/source/development/contributing.md

@@ -20,8 +20,9 @@ prs: 1238
 Here's one or more paragraphs that describe the change.
 
 - It's markdown
-- Add references to the manual using @docroot@
+- Add references to the manual using [links like this](@_at_docroot@/example.md)
 ```
+<!-- for the raw markdown readers: that means using @docroot@ -->
 
 Significant changes should add the following header, which moves them to the top.
 

doc/manual/source/glossary.md

@@ -31,9 +31,22 @@
 
   The industry term for storage and retrieval systems using [content addressing](#gloss-content-address). A Nix store also has [input addressing](#gloss-input-addressed-store-object), and metadata.
 
+- [derivation]{#gloss-derivation}
+
+  A derivation can be thought of as a [pure function](https://en.wikipedia.org/wiki/Pure_function) that produces new [store objects][store object] from existing store objects.
+
+  Derivations are implemented as [operating system processes that run in a sandbox](@docroot@/store/building.md#builder-execution).
+  This sandbox by default only allows reading from store objects specified as inputs, and only allows writing to designated [outputs][output] to be [captured as store objects](@docroot@/store/building.md#processing-outputs).
+
+  A derivation is typically specified as a [derivation expression] in the [Nix language], and [instantiated][instantiate] to a [store derivation].
+  There are multiple ways of obtaining store objects from store derivatons, collectively called [realisation][realise].
+
+  [derivation]: #gloss-derivation
+
 - [store derivation]{#gloss-store-derivation}
 
-  A single build task.
+  A [derivation] represented as a [store object].
+
   See [Store Derivation](@docroot@/store/derivation/index.md#store-derivation) for details.
 
   [store derivation]: #gloss-store-derivation
@@ -57,10 +70,7 @@
 
 - [derivation expression]{#gloss-derivation-expression}
 
-  A description of a [store derivation] in the Nix language.
-  The output(s) of a derivation are store objects.
-  Derivations are typically specified in Nix expressions using the [`derivation` primitive](./language/derivations.md).
-  These are translated into store layer *derivations* (implicitly by `nix-env` and `nix-build`, or explicitly by `nix-instantiate`).
+  A description of a [store derivation] using the [`derivation` primitive](./language/derivations.md) in the [Nix language].
 
   [derivation expression]: #gloss-derivation-expression
 

doc/manual/source/installation/installing-binary.md

@@ -25,7 +25,7 @@ This performs the default type of installation for your platform:
 
 We recommend the multi-user installation if it supports your platform and you can authenticate with `sudo`.
 
-The installer can configured with various command line arguments and environment variables.
+The installer can be configured with various command line arguments and environment variables.
 To show available command line flags:
 
 ```console

doc/manual/source/language/advanced-attributes.md

@@ -53,27 +53,17 @@ Derivations can declare some infrequently used optional attributes.
 
   - [`__structuredAttrs`]{#adv-attr-structuredAttrs}\
     If the special attribute `__structuredAttrs` is set to `true`, the other derivation
-    attributes are serialised into a file in JSON format. The environment variable
-    `NIX_ATTRS_JSON_FILE` points to the exact location of that file both in a build
-    and a [`nix-shell`](../command-ref/nix-shell.md). This obviates the need for
-    [`passAsFile`](#adv-attr-passAsFile) since JSON files have no size restrictions,
-    unlike process environments.
+    attributes are serialised into a file in JSON format.
 
-    It also makes it possible to tweak derivation settings in a structured way; see
-    [`outputChecks`](#adv-attr-outputChecks) for example.
+    This obviates the need for [`passAsFile`](#adv-attr-passAsFile) since JSON files have no size restrictions, unlike process environments.
+    It also makes it possible to tweak derivation settings in a structured way;
+    see [`outputChecks`](#adv-attr-outputChecks) for example.
 
-    As a convenience to Bash builders,
-    Nix writes a script that initialises shell variables
-    corresponding to all attributes that are representable in Bash. The
-    environment variable `NIX_ATTRS_SH_FILE` points to the exact
-    location of the script, both in a build and a
-    [`nix-shell`](../command-ref/nix-shell.md). This includes non-nested
-    (associative) arrays. For example, the attribute `hardening.format = true`
-    ends up as the Bash associative array element `${hardening[format]}`.
+    See the [corresponding section in the derivation page](@docroot@/store/derivation/index.md#structured-attrs) for further details.
 
     > **Warning**
     >
-    > If set to `true`, other advanced attributes such as [`allowedReferences`](#adv-attr-allowedReferences), [`allowedReferences`](#adv-attr-allowedReferences), [`allowedRequisites`](#adv-attr-allowedRequisites),
+    > If set to `true`, other advanced attributes such as [`allowedReferences`](#adv-attr-allowedReferences), [`allowedRequisites`](#adv-attr-allowedRequisites),
     [`disallowedReferences`](#adv-attr-disallowedReferences) and [`disallowedRequisites`](#adv-attr-disallowedRequisites), maxSize, and maxClosureSize.
     will have no effect.
 

doc/manual/source/language/index.md

@@ -1,6 +1,6 @@
 # Nix Language
 
-The Nix language is designed for conveniently creating and composing *derivations* – precise descriptions of how contents of existing files are used to derive new files.
+The Nix language is designed for conveniently creating and composing [derivations](@docroot@/glossary.md#gloss-derivation) – precise descriptions of how contents of existing files are used to derive new files.
 
 > **Tip**
 >

doc/manual/source/language/operators.md

@@ -196,7 +196,7 @@ All comparison operators are implemented in terms of `<`, and the following equi
 
 ## Logical implication
 
-Equivalent to `!`*b1* `||` *b2*.
+Equivalent to `!`*b1* `||` *b2*  (or `if` *b1* `then` *b2* `else true`)
 
 [Logical implication]: #logical-implication
 

doc/manual/source/language/syntax.md

@@ -225,8 +225,8 @@ passed in first , e.g.,
 
 ```nix
 let add = { __functor = self: x: x + self.x; };
-    inc = add // { x = 1; };
-in inc 1
+    inc = add // { x = 1; }; # inc is { x = 1; __functor = (...) }
+in inc 1 # equivalent of `add.__functor add 1` i.e. `1 + self.x`
 ```
 
 evaluates to `2`. This can be used to attach metadata to a function

doc/manual/source/protocols/json/derivation.md

@@ -91,3 +91,7 @@ is a JSON object with the following fields:
 
 * `env`:
   The environment passed to the `builder`.
+
+* `structuredAttrs`:
+  [Strucutured Attributes](@docroot@/store/derivation/index.md#structured-attrs), only defined if the derivation contains them.
+  Structured attributes are JSON, and thus embedded as-is.

doc/manual/source/release-notes/rl-2.24.md

@@ -269,7 +269,7 @@
   e.g. `--warn-large-path-threshold 100M`.
 
 
-# Contributors
+## Contributors
 
 This release was made possible by the following 43 contributors:
 

doc/manual/source/release-notes/rl-2.25.md

@@ -77,7 +77,7 @@
   `<nix/fetchurl.nix>` is also known as the builtin derivation builder `builtin:fetchurl`. It's not to be confused with the evaluation-time function `builtins.fetchurl`, which was not affected by this issue.
 
 
-# Contributors
+## Contributors
 
 This release was made possible by the following 58 contributors:
 

doc/manual/source/release-notes/rl-2.26.md

@@ -76,7 +76,7 @@
 
 - Evaluation caching now works for dirty Git workdirs [#11992](https://github.com/NixOS/nix/pull/11992)
 
-# Contributors
+## Contributors
 
 This release was made possible by the following 45 contributors:
 

doc/manual/source/release-notes/rl-2.27.md

@@ -47,7 +47,7 @@
   blake3-34P4p+iZXcbbyB1i4uoF7eWCGcZHjmaRn6Y7QdynLwU=
   ```
 
-# Contributors
+## Contributors
 
 This release was made possible by the following 21 contributors:
 

doc/manual/source/release-notes/rl-2.28.md

@@ -82,7 +82,7 @@ This completes the infrastructure overhaul for the [RFC 132](https://github.com/
   Although this change is not as critical, we figured it would be good to do this API change at the same time, also.
   Also note that we try to keep the C API compatible, but we decided to break this function because it was young and likely not in widespread use yet. This frees up time to make important progress on the rest of the C API.
 
-# Contributors
+## Contributors
 
 This earlier-than-usual release was made possible by the following 16 contributors:
 

doc/manual/source/release-notes/rl-2.29.md

@@ -111,7 +111,7 @@ This fact is counterbalanced by the fact that most of those changes are bug fixe
   This in particular prevents parts of GCC 14's diagnostics from being improperly filtered away.
 
 
-# Contributors
+## Contributors
 
 
 This release was made possible by the following 40 contributors:

doc/manual/source/release-notes/rl-2.30.md

@@ -0,0 +1,153 @@
+# Release 2.30.0 (2025-07-07)
+
+## Backward-incompatible changes and deprecations
+
+- [`build-dir`] no longer defaults to `$TMPDIR`
+
+  The directory in which temporary build directories are created no longer defaults
+  to `TMPDIR` or `/tmp`, to avoid builders making their directories
+  world-accessible. This behavior allowed escaping the build sandbox and can
+  cause build impurities even when not used maliciously. We now default to `builds`
+  in `NIX_STATE_DIR` (which is `/nix/var/nix/builds` in the default configuration).
+
+- Deprecate manually making structured attrs using the `__json` attribute [#13220](https://github.com/NixOS/nix/pull/13220)
+
+  The proper way to create a derivation using [structured attrs] in the Nix language is by using `__structuredAttrs = true` with [`builtins.derivation`].
+  However, by exploiting how structured attrs are implementated, it has also been possible to create them by setting the `__json` environment variable to a serialized JSON string.
+  This sneaky alternative method is now deprecated, and may be disallowed in future versions of Nix.
+
+  [structured attrs]: @docroot@/language/advanced-attributes.md#adv-attr-structuredAttrs
+  [`builtins.derivation`]: @docroot@/language/builtins.html#builtins-derivation
+
+- Rename `nix profile install` to [`nix profile add`] [#13224](https://github.com/NixOS/nix/pull/13224)
+
+  The command `nix profile install` has been renamed to [`nix profile add`] (though the former is still available as an alias). This is because the verb "add" is a better antonym for the verb "remove" (i.e. `nix profile remove`). Nix also does not have install hooks or general behavior often associated with "installing".
+
+## Performance improvements
+
+This release has a number performance improvements, in particular:
+
+- Reduce the size of value from 24 to 16 bytes [#13407](https://github.com/NixOS/nix/pull/13407)
+
+  This shaves off a very significant amount of memory used for evaluation (~20% percent reduction in maximum heap size and ~17% in total bytes).
+
+## Features
+
+- Add [stack sampling evaluation profiler] [#13220](https://github.com/NixOS/nix/pull/13220)
+
+  The Nix evaluator now supports [stack sampling evaluation profiling](@docroot@/advanced-topics/eval-profiler.md) via the [`--eval-profiler flamegraph`] setting.
+  It outputs collapsed call stack information to the file specified by
+  [`--eval-profile-file`] (`nix.profile` by default) in a format directly consumable
+  by `flamegraph.pl` and compatible tools like [speedscope](https://speedscope.app/).
+  Sampling frequency can be configured via [`--eval-profiler-frequency`] (99 Hz by default).
+
+  Unlike the existing [`--trace-function-calls`], this profiler includes the name of the function
+  being called when it's available.
+
+- [`nix repl`] prints which variables were loaded [#11406](https://github.com/NixOS/nix/pull/11406)
+
+  Instead of `Added <n> variables` it now prints the first 10 variables that were added to the global scope.
+
+- `nix flake archive`: Add [`--no-check-sigs`] option [#13277](https://github.com/NixOS/nix/pull/13277)
+
+  This is useful when using [`nix flake archive`] with the destination set to a remote store.
+
+- Emit warnings for IFDs with [`trace-import-from-derivation`] option [#13279](https://github.com/NixOS/nix/pull/13279)
+
+  While we have the setting [`allow-import-from-derivation`] to deny import-from-derivation (IFD), sometimes users would like to observe IFDs during CI processes to gradually phase out the idiom. The new setting `trace-import-from-derivation`, when set, logs a simple warning to the console.
+
+- `json-log-path` setting [#13003](https://github.com/NixOS/nix/pull/13003)
+
+  New setting [`json-log-path`] that sends a copy of all Nix log messages (in JSON format) to a file or Unix domain socket.
+
+- Non-flake inputs now contain a `sourceInfo` attribute [#13164](https://github.com/NixOS/nix/issues/13164) [#13170](https://github.com/NixOS/nix/pull/13170)
+
+  Flakes have always had a `sourceInfo` attribute which describes the source of the flake.
+  The `sourceInfo.outPath` is often identical to the flake's `outPath`. However, it can differ when the flake is located in a subdirectory of its source.
+
+  Non-flake inputs (i.e. inputs with [`flake = false`]) can also be located at some path _within_ a wider source.
+  This usually happens when defining a relative path input within the same source as the parent flake, e.g. `inputs.foo.url = ./some-file.nix`.
+  Such relative inputs will now inherit their parent's `sourceInfo`.
+
+  This also means it is now possible to use `?dir=subdir` on non-flake inputs.
+
+  This iterates on the work done in 2.26 to improve relative path support ([#10089](https://github.com/NixOS/nix/pull/10089)),
+  and resolves a regression introduced in 2.28 relating to nested relative path inputs ([#13164](https://github.com/NixOS/nix/issues/13164)).
+
+## Miscellaneous changes
+
+- [`builtins.sort`] uses PeekSort [#12623](https://github.com/NixOS/nix/pull/12623)
+
+  Previously it used libstdc++'s `std::stable_sort()`. However, that implementation is not reliable if the user-supplied comparison function is not a strict weak ordering.
+
+- Revert incomplete closure mixed download and build feature [#77](https://github.com/NixOS/nix/issues/77) [#12628](https://github.com/NixOS/nix/issues/12628) [#13176](https://github.com/NixOS/nix/pull/13176)
+
+  Since Nix 1.3 ([commit `299141e`] in 2013) Nix has attempted to mix together upstream fresh builds and downstream substitutions when remote substuters contain an "incomplete closure" (have some store objects, but not the store objects they reference).
+  This feature is now removed.
+
+  In the worst case, removing this feature could cause more building downstream, but it should not cause outright failures, since this is not happening for opaque store objects that we don't know how to build if we decide not to substitute.
+  In practice, however, we doubt even more building is very likely to happen.
+  Remote stores that are missing dependencies in arbitrary ways (e.g. corruption) don't seem to be very common.
+
+  On the contrary, when remote stores fail to implement the [closure property](@docroot@/store/store-object.md#closure-property), it is usually an *intentional* choice on the part of the remote store, because it wishes to serve as an "overlay" store over another store, such as `https://cache.nixos.org`.
+  If an "incomplete closure" is encountered in that situation, the right fix is not to do some sort of "franken-building" as this feature implemented, but instead to make sure both substituters are enabled in the settings.
+
+  (In the future, we should make it easier for remote stores to indicate this to clients, to catch settings that won't work in general before a missing dependency is actually encountered.)
+
+## Contributors
+
+This release was made possible by the following 32 contributors:
+
+- Cole Helbling [**(@cole-h)**](https://github.com/cole-h)
+- Eelco Dolstra [**(@edolstra)**](https://github.com/edolstra)
+- Egor Konovalov [**(@egorkonovalov)**](https://github.com/egorkonovalov)
+- Farid Zakaria [**(@fzakaria)**](https://github.com/fzakaria)
+- Graham Christensen [**(@grahamc)**](https://github.com/grahamc)
+- gustavderdrache [**(@gustavderdrache)**](https://github.com/gustavderdrache)
+- Gwenn Le Bihan [**(@gwennlbh)**](https://github.com/gwennlbh)
+- h0nIg [**(@h0nIg)**](https://github.com/h0nIg)
+- Jade Masker [**(@donottellmetonottellyou)**](https://github.com/donottellmetonottellyou)
+- jayeshv [**(@jayeshv)**](https://github.com/jayeshv)
+- Jeremy Fleischman [**(@jfly)**](https://github.com/jfly)
+- John Ericson [**(@Ericson2314)**](https://github.com/Ericson2314)
+- Jonas Chevalier [**(@zimbatm)**](https://github.com/zimbatm)
+- Jörg Thalheim [**(@Mic92)**](https://github.com/Mic92)
+- kstrafe [**(@kstrafe)**](https://github.com/kstrafe)
+- Luc Perkins [**(@lucperkins)**](https://github.com/lucperkins)
+- Matt Sturgeon [**(@MattSturgeon)**](https://github.com/MattSturgeon)
+- Nikita Krasnov [**(@synalice)**](https://github.com/synalice)
+- Peder Bergebakken Sundt [**(@pbsds)**](https://github.com/pbsds)
+- pennae [**(@pennae)**](https://github.com/pennae)
+- Philipp Otterbein
+- Pol Dellaiera [**(@drupol)**](https://github.com/drupol)
+- PopeRigby [**(@poperigby)**](https://github.com/poperigby)
+- Raito Bezarius
+- Robert Hensing [**(@roberth)**](https://github.com/roberth)
+- Samuli Thomasson [**(@SimSaladin)**](https://github.com/SimSaladin)
+- Sergei Zimmerman [**(@xokdvium)**](https://github.com/xokdvium)
+- Seth Flynn [**(@getchoo)**](https://github.com/getchoo)
+- Stefan Boca [**(@stefanboca)**](https://github.com/stefanboca)
+- tomberek [**(@tomberek)**](https://github.com/tomberek)
+- Tristan Ross [**(@RossComputerGuy)**](https://github.com/RossComputerGuy)
+- Valentin Gagarin [**(@fricklerhandwerk)**](https://github.com/fricklerhandwerk)
+- Vladimír Čunát [**(@vcunat)**](https://github.com/vcunat)
+- Wolfgang Walther [**(@wolfgangwalther)**](https://github.com/wolfgangwalther)
+
+<!-- markdown links -->
+[stack sampling evaluation profiler]: @docroot@/advanced-topics/eval-profiler.md
+[`--eval-profiler`]: @docroot@/command-ref/conf-file.md#conf-eval-profiler
+[`--eval-profiler flamegraph`]: @docroot@/command-ref/conf-file.md#conf-eval-profiler
+[`--trace-function-calls`]: @docroot@/command-ref/conf-file.md#conf-trace-function-calls
+[`--eval-profile-file`]: @docroot@/command-ref/conf-file.md#conf-eval-profile-file
+[`--eval-profiler-frequency`]: @docroot@/command-ref/conf-file.md#conf-eval-profiler-frequency
+[`build-dir`]: @docroot@/command-ref/conf-file.md#conf-build-dir
+[`nix profile add`]: @docroot@/command-ref/new-cli/nix3-profile-add.md
+[`nix repl`]: @docroot@/command-ref/new-cli/nix3-repl.md
+[`nix flake archive`]: @docroot@/command-ref/new-cli/nix3-flake-archive.md
+[`json-log-path`]: @docroot@/command-ref/conf-file.md#conf-json-log-path
+[`trace-import-from-derivation`]: @docroot@/command-ref/conf-file.md#conf-trace-import-from-derivation
+[`allow-import-from-derivation`]: @docroot@/command-ref/conf-file.md#conf-allow-import-from-derivation
+[`builtins.sort`]: @docroot@/language/builtins.md#builtins-sort
+[`flake = false`]: @docroot@/command-ref/new-cli/nix3-flake.md?highlight=false#flake-inputs
+[`--no-check-sigs`]: @docroot@/command-ref/new-cli/nix3-flake-archive.md#opt-no-check-sigs
+[commit `299141e`]: https://github.com/NixOS/nix/commit/299141ecbd08bae17013226dbeae71e842b4fdd7

doc/manual/source/store/building.md

@@ -12,10 +12,11 @@
 
 The [`builder`](./derivation/index.md#builder) is executed as follows:
 
-- A temporary directory is created under the directory specified by
-  `TMPDIR` (default `/tmp`) where the build will take place. The
+- A temporary directory is created where the build will take place. The
   current directory is changed to this directory.
 
+  See the per-store [`build-dir`](@docroot@/store/types/local-store.md#store-local-store-build-dir) setting for more information.
+
 - The environment is cleared and set to the derivation attributes, as
   specified above.
 

doc/manual/source/store/derivation/index.md

@@ -138,6 +138,17 @@ See [Wikipedia](https://en.wikipedia.org/wiki/Argv) for details.
 
 Environment variables which will be passed to the [builder](#builder) executable.
 
+#### Structured Attributes {#structured-attrs}
+
+Nix also has special support for embedding JSON in the derivations.
+
+The environment variable `NIX_ATTRS_JSON_FILE` points to the exact location of that file both in a build and a [`nix-shell`](@docroot@/command-ref/nix-shell.md).
+
+As a convenience to Bash builders, Nix writes a script that initialises shell variables corresponding to all attributes that are representable in Bash.
+The environment variable `NIX_ATTRS_SH_FILE` points to the exact location of the script, both in a build and a [`nix-shell`](@docroot@/command-ref/nix-shell.md).
+This includes non-nested (associative) arrays.
+For example, the attribute `hardening.format = true` ends up as the Bash associative array element `${hardening[format]}`.
+
 ### Placeholders
 
 Placeholders are opaque values used within the [process creation fields] to [store objects] for which we don't yet know [store path]s.
@@ -162,7 +173,7 @@ There are two types of placeholder, corresponding to the two cases where this pr
 
 > **Explanation**
 >
-> In general, we need to realise [realise] a [store object] in order to be sure to have a store object for it.
+> In general, we need to [realise] a [store object] in order to be sure to have a store object for it.
 > But for these two cases this is either impossible or impractical:
 >
 > - In the output case this is impossible:
@@ -189,7 +200,7 @@ This ensures that there is a canonical [store path] used to refer to the derivat
 > **Note**
 >
 > Currently, the canonical encoding for every derivation is the "ATerm" format,
-> but this is subject to change for types derivations which are not yet stable.
+> but this is subject to change for the types of derivations which are not yet stable.
 
 Regardless of the format used, when serializing a derivation to a store object, that store object will be content-addressed.
 
@@ -282,7 +293,7 @@ type DerivingPath = ConstantPath | OutputPath;
 
 Under this extended model, `DerivingPath`s are thus inductively built up from a root `ConstantPath`, wrapped with zero or more outer `OutputPath`s.
 
-### Encoding {#deriving-path-encoding}
+### Encoding {#deriving-path-encoding-higher-order}
 
 The encoding is adjusted in the natural way, encoding the `drv` field recursively using the same deriving path encoding.
 The result of this is that it is possible to have a chain of `^<output-name>` at the end of the final string, as opposed to just a single one.

doc/manual/source/store/derivation/outputs/content-address.md

@@ -23,7 +23,7 @@ The output spec for an output with a fixed content addresses additionally contai
 > **Design note**
 >
 > In principle, the output spec could also specify the references the store object should have, since the references and file system objects are equally parts of a content-addressed store object proper that contribute to its content-addressed.
-> However, at this time, the references are not not done because all fixed content-addressed outputs are required to have no references (including no self-reference).
+> However, at this time, the references are not done because all fixed content-addressed outputs are required to have no references (including no self-reference).
 >
 > Also in principle, rather than specifying the references and file system object data with separate hashes, a single hash that constraints both could be used.
 > This could be done with the final store path's digest, or better yet, the hash that will become the store path's digest before it is truncated.
@@ -116,7 +116,7 @@ Because the derivation output is not fixed (just like with [input addressing]),
 > (The "environment", in this case, consists of attributes such as the Operating System Nix runs atop, along with the operating-system-specific privileges that Nix has been granted.
 > Because of how conventional operating systems like macos, Linux, etc. work, granting builders *fewer* privileges may ironically require that Nix be run with *more* privileges.)
 
-That said, derivations producing floating content-addressed outputs may declare their builders as impure (like the builders of derivations producing producing fixed outputs).
+That said, derivations producing floating content-addressed outputs may declare their builders as impure (like the builders of derivations producing fixed outputs).
 This is provisionally supported as part of the [`impure-derivations`][xp-feature-impure-derivations] experimental feature.
 
 ### Compatibility negotiation
@@ -144,7 +144,7 @@ A *deterministic* content-addressing derivation should produce outputs with the
   The choice of provisional store path can be thought of as an impurity, since it is an arbitrary choice.
 
   If provisional outputs paths are deterministically chosen, we are in the first branch of part (1).
-  The builder the data it produces based on it in arbitrary ways, but this gets us closer to to [input addressing].
+  The builder the data it produces based on it in arbitrary ways, but this gets us closer to [input addressing].
   Deterministically choosing the provisional path may be considered "complete sandboxing" by removing an impurity, but this is unsatisfactory
 
   <!--

doc/manual/source/store/derivation/outputs/index.md

@@ -83,7 +83,7 @@ The rules for this are fairly concise:
 
   - A content-addressing derivation may be pure or impure
 
-   - If it is impure, it may be be fixed (typical), or it may be floating if the additional [`impure-derivations`][xp-feature-impure-derivations] experimental feature is enabled.
+   - If it is impure, it may be fixed (typical), or it may be floating if the additional [`impure-derivations`][xp-feature-impure-derivations] experimental feature is enabled.
 
    - If it is pure, it must be floating.
 

doc/manual/source/store/store-object.md

@@ -18,14 +18,14 @@ In particular, the edge corresponding to a reference is from the store object th
 References other than a self-reference must not form a cycle.
 The graph of references excluding self-references thus forms a [directed acyclic graph].
 
-[directed acyclic graph]: @docroot@/glossary.md#gloss-directed acyclic graph
+[directed acyclic graph]: @docroot@/glossary.md#gloss-directed-acyclic-graph
 
 We can take the [transitive closure] of the references graph, which any pair of store objects have an edge not if there is a single reference from the first to the second, but a path of one or more references from the first to the second.
 The *requisites* of a store object are all store objects reachable by paths of references which start with given store object's references.
 
 [transitive closure]: https://en.wikipedia.org/wiki/Transitive_closure
 
-We can also take the [transpose graph] ofthe references graph, where we reverse the orientation of all edges.
+We can also take the [transpose graph] of the references graph, where we reverse the orientation of all edges.
 The *referrers* of a store object are the store objects that reference it.
 
 [transpose graph]: https://en.wikipedia.org/wiki/Transpose_graph

doc/manual/substitute.py

@@ -41,6 +41,10 @@ def recursive_replace(data: dict[str, t.Any], book_root: Path, search_path: Path
             return data | dict(
                 sections = [recursive_replace(section, book_root, search_path) for section in sections],
             )
+        case {'items': items}:
+            return data | dict(
+                items = [recursive_replace(item, book_root, search_path) for item in items],
+            )
         case {'Chapter': chapter}:
             path_to_chapter = Path(chapter['path'])
             chapter_content = chapter['content']
@@ -57,6 +61,9 @@ def recursive_replace(data: dict[str, t.Any], book_root: Path, search_path: Path
                     ).replace(
                         '@docroot@',
                         ("../" * len(path_to_chapter.parent.parts) or "./")[:-1]
+                    ).replace(
+                        '@_at_',
+                        '@'
                     ),
                     sub_items = [
                         recursive_replace(sub_item, book_root, search_path)

docker.nix

@@ -1,6 +1,11 @@
 {
-  pkgs ? import <nixpkgs> { },
-  lib ? pkgs.lib,
+  # Core dependencies
+  pkgs,
+  lib,
+  dockerTools,
+  runCommand,
+  buildPackages,
+  # Image configuration
   name ? "nix",
   tag ? "latest",
   bundleNixpkgs ? true,
@@ -14,84 +19,107 @@
   gid ? 0,
   uname ? "root",
   gname ? "root",
+  Labels ? {
+    "org.opencontainers.image.title" = "Nix";
+    "org.opencontainers.image.source" = "https://github.com/NixOS/nix";
+    "org.opencontainers.image.vendor" = "Nix project";
+    "org.opencontainers.image.version" = nix.version;
+    "org.opencontainers.image.description" = "Nix container image";
+  },
+  Cmd ? [ (lib.getExe bashInteractive) ],
+  # Default Packages
+  nix,
+  bashInteractive,
+  coreutils-full,
+  gnutar,
+  gzip,
+  gnugrep,
+  which,
+  curl,
+  less,
+  wget,
+  man,
+  cacert,
+  findutils,
+  iana-etc,
+  gitMinimal,
+  openssh,
+  # Other dependencies
+  shadow,
 }:
 let
-  defaultPkgs =
-    with pkgs;
-    [
-      nix
-      bashInteractive
-      coreutils-full
-      gnutar
-      gzip
-      gnugrep
-      which
-      curl
-      less
-      wget
-      man
-      cacert.out
-      findutils
-      iana-etc
-      git
-      openssh
-    ]
-    ++ extraPkgs;
+  defaultPkgs = [
+    nix
+    bashInteractive
+    coreutils-full
+    gnutar
+    gzip
+    gnugrep
+    which
+    curl
+    less
+    wget
+    man
+    cacert.out
+    findutils
+    iana-etc
+    gitMinimal
+    openssh
+  ]
+  ++ extraPkgs;
 
-  users =
-    {
+  users = {
 
-      root = {
-        uid = 0;
-        shell = "${pkgs.bashInteractive}/bin/bash";
-        home = "/root";
-        gid = 0;
-        groups = [ "root" ];
-        description = "System administrator";
-      };
-
-      nobody = {
-        uid = 65534;
-        shell = "${pkgs.shadow}/bin/nologin";
-        home = "/var/empty";
-        gid = 65534;
-        groups = [ "nobody" ];
-        description = "Unprivileged account (don't use!)";
-      };
-
-    }
-    // lib.optionalAttrs (uid != 0) {
-      "${uname}" = {
-        uid = uid;
-        shell = "${pkgs.bashInteractive}/bin/bash";
-        home = "/home/${uname}";
-        gid = gid;
-        groups = [ "${gname}" ];
-        description = "Nix user";
-      };
-    }
-    // lib.listToAttrs (
-      map (n: {
-        name = "nixbld${toString n}";
-        value = {
-          uid = 30000 + n;
-          gid = 30000;
-          groups = [ "nixbld" ];
-          description = "Nix build user ${toString n}";
-        };
-      }) (lib.lists.range 1 32)
-    );
-
-  groups =
-    {
-      root.gid = 0;
-      nixbld.gid = 30000;
-      nobody.gid = 65534;
-    }
-    // lib.optionalAttrs (gid != 0) {
-      "${gname}".gid = gid;
+    root = {
+      uid = 0;
+      shell = lib.getExe bashInteractive;
+      home = "/root";
+      gid = 0;
+      groups = [ "root" ];
+      description = "System administrator";
     };
 
+    nobody = {
+      uid = 65534;
+      shell = lib.getExe' shadow "nologin";
+      home = "/var/empty";
+      gid = 65534;
+      groups = [ "nobody" ];
+      description = "Unprivileged account (don't use!)";
+    };
+
+  }
+  // lib.optionalAttrs (uid != 0) {
+    "${uname}" = {
+      uid = uid;
+      shell = lib.getExe bashInteractive;
+      home = "/home/${uname}";
+      gid = gid;
+      groups = [ "${gname}" ];
+      description = "Nix user";
+    };
+  }
+  // lib.listToAttrs (
+    map (n: {
+      name = "nixbld${toString n}";
+      value = {
+        uid = 30000 + n;
+        gid = 30000;
+        groups = [ "nixbld" ];
+        description = "Nix build user ${toString n}";
+      };
+    }) (lib.lists.range 1 32)
+  );
+
+  groups = {
+    root.gid = 0;
+    nixbld.gid = 30000;
+    nobody.gid = 65534;
+  }
+  // lib.optionalAttrs (gid != 0) {
+    "${gname}".gid = gid;
+  };
+
   userToPasswd = (
     k:
     {
@@ -147,41 +175,42 @@ let
     "${k}:x:${toString gid}:${lib.concatStringsSep "," members}";
   groupContents = (lib.concatStringsSep "\n" (lib.attrValues (lib.mapAttrs groupToGroup groups)));
 
-  defaultNixConf = {
-    sandbox = "false";
-    build-users-group = "nixbld";
-    trusted-public-keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
-  };
+  toConf =
+    with pkgs.lib.generators;
+    toKeyValue {
+      mkKeyValue = mkKeyValueDefault {
+        mkValueString = v: if lib.isList v then lib.concatStringsSep " " v else mkValueStringDefault { } v;
+      } " = ";
+    };
 
-  nixConfContents =
-    (lib.concatStringsSep "\n" (
-      lib.mapAttrsFlatten (
-        n: v:
-        let
-          vStr = if builtins.isList v then lib.concatStringsSep " " v else v;
-        in
-        "${n} = ${vStr}"
-      ) (defaultNixConf // nixConf)
-    ))
-    + "\n";
+  nixConfContents = toConf (
+    {
+      sandbox = false;
+      build-users-group = "nixbld";
+      trusted-public-keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
+    }
+    // nixConf
+  );
 
   userHome = if uid == 0 then "/root" else "/home/${uname}";
 
   baseSystem =
     let
       nixpkgs = pkgs.path;
-      channel = pkgs.runCommand "channel-nixos" { inherit bundleNixpkgs; } ''
+      channel = runCommand "channel-nixos" { inherit bundleNixpkgs; } ''
         mkdir $out
         if [ "$bundleNixpkgs" ]; then
-          ln -s ${nixpkgs} $out/nixpkgs
+          ln -s ${
+            builtins.path {
+              path = nixpkgs;
+              name = "source";
+            }
+          } $out/nixpkgs
           echo "[]" > $out/manifest.nix
         fi
       '';
-      rootEnv = pkgs.buildPackages.buildEnv {
-        name = "root-profile-env";
-        paths = defaultPkgs;
-      };
-      manifest = pkgs.buildPackages.runCommand "manifest.nix" { } ''
+      # doc/manual/source/command-ref/files/manifest.nix.md
+      manifest = buildPackages.runCommand "manifest.nix" { } ''
         cat > $out <<EOF
         [
         ${lib.concatStringsSep "\n" (
@@ -210,11 +239,15 @@ let
         ]
         EOF
       '';
-      profile = pkgs.buildPackages.runCommand "user-environment" { } ''
-        mkdir $out
-        cp -a ${rootEnv}/* $out/
-        ln -s ${manifest} $out/manifest.nix
-      '';
+      profile = buildPackages.buildEnv {
+        name = "root-profile-env";
+        paths = defaultPkgs;
+
+        postBuild = ''
+          mv $out/manifest $out/manifest.nix
+        '';
+        inherit manifest;
+      };
       flake-registry-path =
         if (flake-registry == null) then
           null
@@ -223,7 +256,7 @@ let
         else
           flake-registry;
     in
-    pkgs.runCommand "base-system"
+    runCommand "base-system"
       {
         inherit
           passwdContents
@@ -246,6 +279,7 @@ let
           set -x
           mkdir -p $out/etc
 
+          # may get replaced by pkgs.dockerTools.caCertificates
           mkdir -p $out/etc/ssl/certs
           ln -s /nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs
 
@@ -273,20 +307,24 @@ let
           mkdir -p $out${userHome}
           mkdir -p $out/nix/var/nix/profiles/per-user/${uname}
 
+          # see doc/manual/source/command-ref/files/profiles.md
           ln -s ${profile} $out/nix/var/nix/profiles/default-1-link
           ln -s /nix/var/nix/profiles/default-1-link $out/nix/var/nix/profiles/default
           ln -s /nix/var/nix/profiles/default $out${userHome}/.nix-profile
 
+          # see doc/manual/source/command-ref/files/channels.md
           ln -s ${channel} $out/nix/var/nix/profiles/per-user/${uname}/channels-1-link
           ln -s /nix/var/nix/profiles/per-user/${uname}/channels-1-link $out/nix/var/nix/profiles/per-user/${uname}/channels
 
+          # see doc/manual/source/command-ref/files/default-nix-expression.md
           mkdir -p $out${userHome}/.nix-defexpr
           ln -s /nix/var/nix/profiles/per-user/${uname}/channels $out${userHome}/.nix-defexpr/channels
           echo "${channelURL} ${channelName}" > $out${userHome}/.nix-channels
 
+          # may get replaced by pkgs.dockerTools.binSh & pkgs.dockerTools.usrBinEnv
           mkdir -p $out/bin $out/usr/bin
-          ln -s ${pkgs.coreutils}/bin/env $out/usr/bin/env
-          ln -s ${pkgs.bashInteractive}/bin/bash $out/bin/sh
+          ln -s ${lib.getExe' coreutils-full "env"} $out/usr/bin/env
+          ln -s ${lib.getExe bashInteractive} $out/bin/sh
 
         ''
         + (lib.optionalString (flake-registry-path != null) ''
@@ -295,13 +333,13 @@ let
           globalFlakeRegistryPath="$nixCacheDir/flake-registry.json"
           ln -s ${flake-registry-path} $out$globalFlakeRegistryPath
           mkdir -p $out/nix/var/nix/gcroots/auto
-          rootName=$(${pkgs.nix}/bin/nix --extra-experimental-features nix-command hash file --type sha1 --base32 <(echo -n $globalFlakeRegistryPath))
+          rootName=$(${lib.getExe' nix "nix"} --extra-experimental-features nix-command hash file --type sha1 --base32 <(echo -n $globalFlakeRegistryPath))
           ln -s $globalFlakeRegistryPath $out/nix/var/nix/gcroots/auto/$rootName
         '')
       );
 
 in
-pkgs.dockerTools.buildLayeredImageWithNixDb {
+dockerTools.buildLayeredImageWithNixDb {
 
   inherit
     name
@@ -327,7 +365,7 @@ pkgs.dockerTools.buildLayeredImageWithNixDb {
   '';
 
   config = {
-    Cmd = [ "${userHome}/.nix-profile/bin/bash" ];
+    inherit Cmd Labels;
     User = "${toString uid}:${toString gid}";
     Env = [
       "USER=${uname}"

flake.lock

@@ -63,16 +63,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1746141548,
-        "narHash": "sha256-IgBWhX7A2oJmZFIrpRuMnw5RAufVnfvOgHWgIdds+hc=",
+        "lastModified": 1756178832,
+        "narHash": "sha256-O2CIn7HjZwEGqBrwu9EU76zlmA5dbmna7jL1XUmAId8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f02fddb8acef29a8b32f10a335d44828d7825b78",
+        "rev": "d98ce345cdab58477ca61855540999c86577d19d",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixos-25.05-small",
         "repo": "nixpkgs",
         "type": "github"
       }

flake.nix

@@ -1,7 +1,7 @@
 {
   description = "The purely functional package manager";
 
-  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05-small";
 
   inputs.nixpkgs-regression.url = "github:NixOS/nixpkgs/215d4d0fd80ca5163643b03a33fde804a29cc1e2";
   inputs.nixpkgs-23-11.url = "github:NixOS/nixpkgs/a62e6edd6d5e1fa0329b8653c801147986f8d446";
@@ -32,7 +32,7 @@
     let
       inherit (nixpkgs) lib;
 
-      officialRelease = false;
+      officialRelease = true;
 
       linux32BitSystems = [ "i686-linux" ];
       linux64BitSystems = [
@@ -179,19 +179,6 @@
               };
 
           nix = final.nixComponents2.nix-cli;
-
-          # See https://github.com/NixOS/nixpkgs/pull/214409
-          # Remove when fixed in this flake's nixpkgs
-          pre-commit =
-            if prev.stdenv.hostPlatform.system == "i686-linux" then
-              (prev.pre-commit.override (o: {
-                dotnet-sdk = "";
-              })).overridePythonAttrs
-                (o: {
-                  doCheck = false;
-                })
-            else
-              prev.pre-commit;
         };
 
     in
@@ -233,28 +220,24 @@
             This shouldn't build anything significant; just check that things
             (including derivations) are _set up_ correctly.
           */
-          # Disabled due to a bug in `testEqualContents` (see
-          # https://github.com/NixOS/nix/issues/12690).
-          /*
-            packaging-overriding =
-              let
-                pkgs = nixpkgsFor.${system}.native;
-                nix = self.packages.${system}.nix;
-              in
-              assert (nix.appendPatches [ pkgs.emptyFile ]).libs.nix-util.src.patches == [ pkgs.emptyFile ];
-              if pkgs.stdenv.buildPlatform.isDarwin then
-                lib.warn "packaging-overriding check currently disabled because of a permissions issue on macOS" pkgs.emptyFile
-              else
-                # If this fails, something might be wrong with how we've wired the scope,
-                # or something could be broken in Nixpkgs.
-                pkgs.testers.testEqualContents {
-                  assertion = "trivial patch does not change source contents";
-                  expected = "${./.}";
-                  actual =
-                    # Same for all components; nix-util is an arbitrary pick
-                    (nix.appendPatches [ pkgs.emptyFile ]).libs.nix-util.src;
-                };
-          */
+          packaging-overriding =
+            let
+              pkgs = nixpkgsFor.${system}.native;
+              nix = self.packages.${system}.nix;
+            in
+            assert (nix.appendPatches [ pkgs.emptyFile ]).libs.nix-util.src.patches == [ pkgs.emptyFile ];
+            if pkgs.stdenv.buildPlatform.isDarwin then
+              lib.warn "packaging-overriding check currently disabled because of a permissions issue on macOS" pkgs.emptyFile
+            else
+              # If this fails, something might be wrong with how we've wired the scope,
+              # or something could be broken in Nixpkgs.
+              pkgs.testers.testEqualContents {
+                assertion = "trivial patch does not change source contents";
+                expected = "${./.}";
+                actual =
+                  # Same for all components; nix-util is an arbitrary pick
+                  (nix.appendPatches [ pkgs.emptyFile ]).libs.nix-util.src;
+              };
         }
         // (lib.optionalAttrs (builtins.elem system linux64BitSystems)) {
           dockerImage = self.hydraJobs.dockerImage.${system};
@@ -421,8 +404,7 @@
           dockerImage =
             let
               pkgs = nixpkgsFor.${system}.native;
-              image = import ./docker.nix {
-                inherit pkgs;
+              image = pkgs.callPackage ./docker.nix {
                 tag = pkgs.nix.version;
               };
             in

maintainers/data/release-credits-email-to-handle.json

@@ -166,5 +166,24 @@
     "the-tumultuous-unicorn-of-darkness@gmx.com": "TheTumultuousUnicornOfDarkness",
     "dev@rodney.id.au": "rvl",
     "pe@pijul.org": "P-E-Meunier",
-    "yannik@floxdev.com": "ysndr"
+    "yannik@floxdev.com": "ysndr",
+    "73017521+egorkonovalov@users.noreply.github.com": "egorkonovalov",
+    "raito@lix.systems": null,
+    "nikita.nikita.krasnov@gmail.com": "synalice",
+    "lucperkins@gmail.com": "lucperkins",
+    "vladimir.cunat@nic.cz": "vcunat",
+    "walther@technowledgy.de": "wolfgangwalther",
+    "jayesh.mail@gmail.com": "jayeshv",
+    "samuli.thomasson@pm.me": "SimSaladin",
+    "kevin@stravers.net": "kstrafe",
+    "poperigby@mailbox.org": "poperigby",
+    "cole.helbling@determinate.systems": "cole-h",
+    "donottellmetonottellyou@gmail.com": "donottellmetonottellyou",
+    "getchoo@tuta.io": "getchoo",
+    "alex.ford@determinate.systems": "gustavderdrache",
+    "stefan.r.boca@gmail.com": "stefanboca",
+    "gwenn.lebihan7@gmail.com": "gwennlbh",
+    "hey@ewen.works": "gwennlbh",
+    "matt@sturgeon.me.uk": "MattSturgeon",
+    "pbsds@hotmail.com": "pbsds"
 }

maintainers/data/release-credits-handle-to-name.json

@@ -146,5 +146,21 @@
     "ajlekcahdp4": "Alexander Romanov",
     "Valodim": "Vincent Breitmoser",
     "rvl": "Rodney Lorrimar",
-    "whatsthecraic": "Dean De Leo"
+    "whatsthecraic": "Dean De Leo",
+    "gwennlbh": "Gwenn Le Bihan",
+    "donottellmetonottellyou": "Jade Masker",
+    "kstrafe": null,
+    "synalice": "Nikita Krasnov",
+    "poperigby": "PopeRigby",
+    "MattSturgeon": "Matt Sturgeon",
+    "lucperkins": "Luc Perkins",
+    "gustavderdrache": null,
+    "SimSaladin": "Samuli Thomasson",
+    "getchoo": "Seth Flynn",
+    "stefanboca": "Stefan Boca",
+    "wolfgangwalther": "Wolfgang Walther",
+    "pbsds": "Peder Bergebakken Sundt",
+    "egorkonovalov": "Egor Konovalov",
+    "jayeshv": "jayeshv",
+    "vcunat": "Vladim\u00edr \u010cun\u00e1t"
 }

maintainers/flake-module.nix

@@ -37,6 +37,118 @@
               fi
             ''}";
           };
+          meson-format = {
+            enable = true;
+            files = "(meson.build|meson.options)$";
+            entry = "${pkgs.writeScript "format-meson" ''
+              #!${pkgs.runtimeShell}
+              for file in "$@"; do
+                ${lib.getExe pkgs.meson} format -ic ${../meson.format} "$file"
+              done
+            ''}";
+            excludes = [
+              # We haven't applied formatting to these files yet
+              ''^doc/manual/meson.build$''
+              ''^doc/manual/source/command-ref/meson.build$''
+              ''^doc/manual/source/development/meson.build$''
+              ''^doc/manual/source/language/meson.build$''
+              ''^doc/manual/source/meson.build$''
+              ''^doc/manual/source/release-notes/meson.build$''
+              ''^doc/manual/source/store/meson.build$''
+              ''^misc/bash/meson.build$''
+              ''^misc/fish/meson.build$''
+              ''^misc/launchd/meson.build$''
+              ''^misc/meson.build$''
+              ''^misc/systemd/meson.build$''
+              ''^misc/zsh/meson.build$''
+              ''^nix-meson-build-support/$''
+              ''^nix-meson-build-support/big-objs/meson.build$''
+              ''^nix-meson-build-support/common/meson.build$''
+              ''^nix-meson-build-support/deps-lists/meson.build$''
+              ''^nix-meson-build-support/export/meson.build$''
+              ''^nix-meson-build-support/export-all-symbols/meson.build$''
+              ''^nix-meson-build-support/generate-header/meson.build$''
+              ''^nix-meson-build-support/libatomic/meson.build$''
+              ''^nix-meson-build-support/subprojects/meson.build$''
+              ''^scripts/meson.build$''
+              ''^src/external-api-docs/meson.build$''
+              ''^src/internal-api-docs/meson.build$''
+              ''^src/libcmd/include/nix/cmd/meson.build$''
+              ''^src/libcmd/meson.build$''
+              ''^src/libcmd/nix-meson-build-support$''
+              ''^src/libexpr/include/nix/expr/meson.build$''
+              ''^src/libexpr/meson.build$''
+              ''^src/libexpr/nix-meson-build-support$''
+              ''^src/libexpr-c/meson.build$''
+              ''^src/libexpr-c/nix-meson-build-support$''
+              ''^src/libexpr-test-support/meson.build$''
+              ''^src/libexpr-test-support/nix-meson-build-support$''
+              ''^src/libexpr-tests/meson.build$''
+              ''^src/libexpr-tests/nix-meson-build-support$''
+              ''^src/libfetchers/include/nix/fetchers/meson.build$''
+              ''^src/libfetchers/meson.build$''
+              ''^src/libfetchers/nix-meson-build-support$''
+              ''^src/libfetchers-c/meson.build$''
+              ''^src/libfetchers-c/nix-meson-build-support$''
+              ''^src/libfetchers-tests/meson.build$''
+              ''^src/libfetchers-tests/nix-meson-build-support$''
+              ''^src/libflake/include/nix/flake/meson.build$''
+              ''^src/libflake/meson.build$''
+              ''^src/libflake/nix-meson-build-support$''
+              ''^src/libflake-c/meson.build$''
+              ''^src/libflake-c/nix-meson-build-support$''
+              ''^src/libflake-tests/meson.build$''
+              ''^src/libflake-tests/nix-meson-build-support$''
+              ''^src/libmain/include/nix/main/meson.build$''
+              ''^src/libmain/meson.build$''
+              ''^src/libmain/nix-meson-build-support$''
+              ''^src/libmain-c/meson.build$''
+              ''^src/libmain-c/nix-meson-build-support$''
+              ''^src/libstore/include/nix/store/meson.build$''
+              ''^src/libstore/meson.build$''
+              ''^src/libstore/nix-meson-build-support$''
+              ''^src/libstore/unix/include/nix/store/meson.build$''
+              ''^src/libstore/unix/meson.build$''
+              ''^src/libstore/windows/meson.build$''
+              ''^src/libstore-c/meson.build$''
+              ''^src/libstore-c/nix-meson-build-support$''
+              ''^src/libstore-test-support/include/nix/store/tests/meson.build$''
+              ''^src/libstore-test-support/meson.build$''
+              ''^src/libstore-test-support/nix-meson-build-support$''
+              ''^src/libstore-tests/meson.build$''
+              ''^src/libstore-tests/nix-meson-build-support$''
+              ''^src/libutil/meson.build$''
+              ''^src/libutil/nix-meson-build-support$''
+              ''^src/libutil/unix/include/nix/util/meson.build$''
+              ''^src/libutil/unix/meson.build$''
+              ''^src/libutil/windows/meson.build$''
+              ''^src/libutil-c/meson.build$''
+              ''^src/libutil-c/nix-meson-build-support$''
+              ''^src/libutil-test-support/include/nix/util/tests/meson.build$''
+              ''^src/libutil-test-support/meson.build$''
+              ''^src/libutil-test-support/nix-meson-build-support$''
+              ''^src/libutil-tests/meson.build$''
+              ''^src/libutil-tests/nix-meson-build-support$''
+              ''^src/nix/meson.build$''
+              ''^src/nix/nix-meson-build-support$''
+              ''^src/perl/lib/Nix/meson.build$''
+              ''^src/perl/meson.build$''
+              ''^tests/functional/ca/meson.build$''
+              ''^tests/functional/common/meson.build$''
+              ''^tests/functional/dyn-drv/meson.build$''
+              ''^tests/functional/flakes/meson.build$''
+              ''^tests/functional/git-hashing/meson.build$''
+              ''^tests/functional/local-overlay-store/meson.build$''
+              ''^tests/functional/meson.build$''
+              ''^src/libcmd/meson.options$''
+              ''^src/libexpr/meson.options$''
+              ''^src/libstore/meson.options$''
+              ''^src/libutil/meson.options$''
+              ''^src/libutil-c/meson.options$''
+              ''^src/nix/meson.options$''
+              ''^src/perl/meson.options$''
+            ];
+          };
           nixfmt-rfc-style = {
             enable = true;
             excludes = [
@@ -77,467 +189,6 @@
               # Don't format vendored code
               ''^doc/manual/redirects\.js$''
               ''^doc/manual/theme/highlight\.js$''
-
-              # We haven't applied formatting to these files yet
-              ''^doc/manual/redirects\.js$''
-              ''^doc/manual/theme/highlight\.js$''
-              ''^precompiled-headers\.h$''
-              ''^src/build-remote/build-remote\.cc$''
-              ''^src/libcmd/built-path\.cc$''
-              ''^src/libcmd/include/nix/cmd/built-path\.hh$''
-              ''^src/libcmd/common-eval-args\.cc$''
-              ''^src/libcmd/include/nix/cmd/common-eval-args\.hh$''
-              ''^src/libcmd/editor-for\.cc$''
-              ''^src/libcmd/installable-attr-path\.cc$''
-              ''^src/libcmd/include/nix/cmd/installable-attr-path\.hh$''
-              ''^src/libcmd/installable-derived-path\.cc$''
-              ''^src/libcmd/include/nix/cmd/installable-derived-path\.hh$''
-              ''^src/libcmd/installable-flake\.cc$''
-              ''^src/libcmd/include/nix/cmd/installable-flake\.hh$''
-              ''^src/libcmd/installable-value\.cc$''
-              ''^src/libcmd/include/nix/cmd/installable-value\.hh$''
-              ''^src/libcmd/installables\.cc$''
-              ''^src/libcmd/include/nix/cmd/installables\.hh$''
-              ''^src/libcmd/include/nix/cmd/legacy\.hh$''
-              ''^src/libcmd/markdown\.cc$''
-              ''^src/libcmd/misc-store-flags\.cc$''
-              ''^src/libcmd/repl-interacter\.cc$''
-              ''^src/libcmd/include/nix/cmd/repl-interacter\.hh$''
-              ''^src/libcmd/repl\.cc$''
-              ''^src/libcmd/include/nix/cmd/repl\.hh$''
-              ''^src/libexpr-c/nix_api_expr\.cc$''
-              ''^src/libexpr-c/nix_api_external\.cc$''
-              ''^src/libexpr/attr-path\.cc$''
-              ''^src/libexpr/include/nix/expr/attr-path\.hh$''
-              ''^src/libexpr/attr-set\.cc$''
-              ''^src/libexpr/include/nix/expr/attr-set\.hh$''
-              ''^src/libexpr/eval-cache\.cc$''
-              ''^src/libexpr/include/nix/expr/eval-cache\.hh$''
-              ''^src/libexpr/eval-error\.cc$''
-              ''^src/libexpr/include/nix/expr/eval-inline\.hh$''
-              ''^src/libexpr/eval-settings\.cc$''
-              ''^src/libexpr/include/nix/expr/eval-settings\.hh$''
-              ''^src/libexpr/eval\.cc$''
-              ''^src/libexpr/include/nix/expr/eval\.hh$''
-              ''^src/libexpr/function-trace\.cc$''
-              ''^src/libexpr/include/nix/expr/gc-small-vector\.hh$''
-              ''^src/libexpr/get-drvs\.cc$''
-              ''^src/libexpr/include/nix/expr/get-drvs\.hh$''
-              ''^src/libexpr/json-to-value\.cc$''
-              ''^src/libexpr/nixexpr\.cc$''
-              ''^src/libexpr/include/nix/expr/nixexpr\.hh$''
-              ''^src/libexpr/include/nix/expr/parser-state\.hh$''
-              ''^src/libexpr/primops\.cc$''
-              ''^src/libexpr/include/nix/expr/primops\.hh$''
-              ''^src/libexpr/primops/context\.cc$''
-              ''^src/libexpr/primops/fetchClosure\.cc$''
-              ''^src/libexpr/primops/fetchMercurial\.cc$''
-              ''^src/libexpr/primops/fetchTree\.cc$''
-              ''^src/libexpr/primops/fromTOML\.cc$''
-              ''^src/libexpr/print-ambiguous\.cc$''
-              ''^src/libexpr/include/nix/expr/print-ambiguous\.hh$''
-              ''^src/libexpr/include/nix/expr/print-options\.hh$''
-              ''^src/libexpr/print\.cc$''
-              ''^src/libexpr/include/nix/expr/print\.hh$''
-              ''^src/libexpr/search-path\.cc$''
-              ''^src/libexpr/include/nix/expr/symbol-table\.hh$''
-              ''^src/libexpr/value-to-json\.cc$''
-              ''^src/libexpr/include/nix/expr/value-to-json\.hh$''
-              ''^src/libexpr/value-to-xml\.cc$''
-              ''^src/libexpr/include/nix/expr/value-to-xml\.hh$''
-              ''^src/libexpr/include/nix/expr/value\.hh$''
-              ''^src/libexpr/value/context\.cc$''
-              ''^src/libexpr/include/nix/expr/value/context\.hh$''
-              ''^src/libfetchers/attrs\.cc$''
-              ''^src/libfetchers/cache\.cc$''
-              ''^src/libfetchers/include/nix/fetchers/cache\.hh$''
-              ''^src/libfetchers/fetch-settings\.cc$''
-              ''^src/libfetchers/include/nix/fetchers/fetch-settings\.hh$''
-              ''^src/libfetchers/fetch-to-store\.cc$''
-              ''^src/libfetchers/fetchers\.cc$''
-              ''^src/libfetchers/include/nix/fetchers/fetchers\.hh$''
-              ''^src/libfetchers/filtering-source-accessor\.cc$''
-              ''^src/libfetchers/include/nix/fetchers/filtering-source-accessor\.hh$''
-              ''^src/libfetchers/fs-source-accessor\.cc$''
-              ''^src/libfetchers/include/nix/fs-source-accessor\.hh$''
-              ''^src/libfetchers/git-utils\.cc$''
-              ''^src/libfetchers/include/nix/fetchers/git-utils\.hh$''
-              ''^src/libfetchers/github\.cc$''
-              ''^src/libfetchers/indirect\.cc$''
-              ''^src/libfetchers/memory-source-accessor\.cc$''
-              ''^src/libfetchers/path\.cc$''
-              ''^src/libfetchers/registry\.cc$''
-              ''^src/libfetchers/include/nix/fetchers/registry\.hh$''
-              ''^src/libfetchers/tarball\.cc$''
-              ''^src/libfetchers/include/nix/fetchers/tarball\.hh$''
-              ''^src/libfetchers/git\.cc$''
-              ''^src/libfetchers/mercurial\.cc$''
-              ''^src/libflake/config\.cc$''
-              ''^src/libflake/flake\.cc$''
-              ''^src/libflake/include/nix/flake/flake\.hh$''
-              ''^src/libflake/flakeref\.cc$''
-              ''^src/libflake/include/nix/flake/flakeref\.hh$''
-              ''^src/libflake/lockfile\.cc$''
-              ''^src/libflake/include/nix/flake/lockfile\.hh$''
-              ''^src/libflake/url-name\.cc$''
-              ''^src/libmain/common-args\.cc$''
-              ''^src/libmain/include/nix/main/common-args\.hh$''
-              ''^src/libmain/loggers\.cc$''
-              ''^src/libmain/include/nix/main/loggers\.hh$''
-              ''^src/libmain/progress-bar\.cc$''
-              ''^src/libmain/shared\.cc$''
-              ''^src/libmain/include/nix/main/shared\.hh$''
-              ''^src/libmain/unix/stack\.cc$''
-              ''^src/libstore/binary-cache-store\.cc$''
-              ''^src/libstore/include/nix/store/binary-cache-store\.hh$''
-              ''^src/libstore/include/nix/store/build-result\.hh$''
-              ''^src/libstore/include/nix/store/builtins\.hh$''
-              ''^src/libstore/builtins/buildenv\.cc$''
-              ''^src/libstore/include/nix/store/builtins/buildenv\.hh$''
-              ''^src/libstore/include/nix/store/common-protocol-impl\.hh$''
-              ''^src/libstore/common-protocol\.cc$''
-              ''^src/libstore/include/nix/store/common-protocol\.hh$''
-              ''^src/libstore/include/nix/store/common-ssh-store-config\.hh$''
-              ''^src/libstore/content-address\.cc$''
-              ''^src/libstore/include/nix/store/content-address\.hh$''
-              ''^src/libstore/daemon\.cc$''
-              ''^src/libstore/include/nix/store/daemon\.hh$''
-              ''^src/libstore/derivations\.cc$''
-              ''^src/libstore/include/nix/store/derivations\.hh$''
-              ''^src/libstore/derived-path-map\.cc$''
-              ''^src/libstore/include/nix/store/derived-path-map\.hh$''
-              ''^src/libstore/derived-path\.cc$''
-              ''^src/libstore/include/nix/store/derived-path\.hh$''
-              ''^src/libstore/downstream-placeholder\.cc$''
-              ''^src/libstore/include/nix/store/downstream-placeholder\.hh$''
-              ''^src/libstore/dummy-store\.cc$''
-              ''^src/libstore/export-import\.cc$''
-              ''^src/libstore/filetransfer\.cc$''
-              ''^src/libstore/include/nix/store/filetransfer\.hh$''
-              ''^src/libstore/include/nix/store/gc-store\.hh$''
-              ''^src/libstore/globals\.cc$''
-              ''^src/libstore/include/nix/store/globals\.hh$''
-              ''^src/libstore/http-binary-cache-store\.cc$''
-              ''^src/libstore/legacy-ssh-store\.cc$''
-              ''^src/libstore/include/nix/store/legacy-ssh-store\.hh$''
-              ''^src/libstore/include/nix/store/length-prefixed-protocol-helper\.hh$''
-              ''^src/libstore/linux/personality\.cc$''
-              ''^src/libstore/linux/include/nix/store/personality\.hh$''
-              ''^src/libstore/local-binary-cache-store\.cc$''
-              ''^src/libstore/local-fs-store\.cc$''
-              ''^src/libstore/include/nix/store/local-fs-store\.hh$''
-              ''^src/libstore/log-store\.cc$''
-              ''^src/libstore/include/nix/store/log-store\.hh$''
-              ''^src/libstore/machines\.cc$''
-              ''^src/libstore/include/nix/store/machines\.hh$''
-              ''^src/libstore/make-content-addressed\.cc$''
-              ''^src/libstore/include/nix/store/make-content-addressed\.hh$''
-              ''^src/libstore/misc\.cc$''
-              ''^src/libstore/names\.cc$''
-              ''^src/libstore/include/nix/store/names\.hh$''
-              ''^src/libstore/nar-accessor\.cc$''
-              ''^src/libstore/include/nix/store/nar-accessor\.hh$''
-              ''^src/libstore/nar-info-disk-cache\.cc$''
-              ''^src/libstore/include/nix/store/nar-info-disk-cache\.hh$''
-              ''^src/libstore/nar-info\.cc$''
-              ''^src/libstore/include/nix/store/nar-info\.hh$''
-              ''^src/libstore/outputs-spec\.cc$''
-              ''^src/libstore/include/nix/store/outputs-spec\.hh$''
-              ''^src/libstore/parsed-derivations\.cc$''
-              ''^src/libstore/path-info\.cc$''
-              ''^src/libstore/include/nix/store/path-info\.hh$''
-              ''^src/libstore/path-references\.cc$''
-              ''^src/libstore/include/nix/store/path-regex\.hh$''
-              ''^src/libstore/path-with-outputs\.cc$''
-              ''^src/libstore/path\.cc$''
-              ''^src/libstore/include/nix/store/path\.hh$''
-              ''^src/libstore/pathlocks\.cc$''
-              ''^src/libstore/include/nix/store/pathlocks\.hh$''
-              ''^src/libstore/profiles\.cc$''
-              ''^src/libstore/include/nix/store/profiles\.hh$''
-              ''^src/libstore/realisation\.cc$''
-              ''^src/libstore/include/nix/store/realisation\.hh$''
-              ''^src/libstore/remote-fs-accessor\.cc$''
-              ''^src/libstore/include/nix/store/remote-fs-accessor\.hh$''
-              ''^src/libstore/include/nix/store/remote-store-connection\.hh$''
-              ''^src/libstore/remote-store\.cc$''
-              ''^src/libstore/include/nix/store/remote-store\.hh$''
-              ''^src/libstore/s3-binary-cache-store\.cc$''
-              ''^src/libstore/include/nix/store/s3\.hh$''
-              ''^src/libstore/serve-protocol-impl\.cc$''
-              ''^src/libstore/include/nix/store/serve-protocol-impl\.hh$''
-              ''^src/libstore/serve-protocol\.cc$''
-              ''^src/libstore/include/nix/store/serve-protocol\.hh$''
-              ''^src/libstore/sqlite\.cc$''
-              ''^src/libstore/include/nix/store/sqlite\.hh$''
-              ''^src/libstore/ssh-store\.cc$''
-              ''^src/libstore/ssh\.cc$''
-              ''^src/libstore/include/nix/store/ssh\.hh$''
-              ''^src/libstore/store-api\.cc$''
-              ''^src/libstore/include/nix/store/store-api\.hh$''
-              ''^src/libstore/include/nix/store/store-dir-config\.hh$''
-              ''^src/libstore/build/derivation-goal\.cc$''
-              ''^src/libstore/include/nix/store/build/derivation-goal\.hh$''
-              ''^src/libstore/build/drv-output-substitution-goal\.cc$''
-              ''^src/libstore/include/nix/store/build/drv-output-substitution-goal\.hh$''
-              ''^src/libstore/build/entry-points\.cc$''
-              ''^src/libstore/build/goal\.cc$''
-              ''^src/libstore/include/nix/store/build/goal\.hh$''
-              ''^src/libstore/unix/build/hook-instance\.cc$''
-              ''^src/libstore/unix/build/derivation-builder\.cc$''
-              ''^src/libstore/unix/include/nix/store/build/derivation-builder\.hh$''
-              ''^src/libstore/build/substitution-goal\.cc$''
-              ''^src/libstore/include/nix/store/build/substitution-goal\.hh$''
-              ''^src/libstore/build/worker\.cc$''
-              ''^src/libstore/include/nix/store/build/worker\.hh$''
-              ''^src/libstore/builtins/fetchurl\.cc$''
-              ''^src/libstore/builtins/unpack-channel\.cc$''
-              ''^src/libstore/gc\.cc$''
-              ''^src/libstore/local-overlay-store\.cc$''
-              ''^src/libstore/include/nix/store/local-overlay-store\.hh$''
-              ''^src/libstore/local-store\.cc$''
-              ''^src/libstore/include/nix/store/local-store\.hh$''
-              ''^src/libstore/unix/user-lock\.cc$''
-              ''^src/libstore/unix/include/nix/store/user-lock\.hh$''
-              ''^src/libstore/optimise-store\.cc$''
-              ''^src/libstore/unix/pathlocks\.cc$''
-              ''^src/libstore/posix-fs-canonicalise\.cc$''
-              ''^src/libstore/include/nix/store/posix-fs-canonicalise\.hh$''
-              ''^src/libstore/uds-remote-store\.cc$''
-              ''^src/libstore/include/nix/store/uds-remote-store\.hh$''
-              ''^src/libstore/windows/build\.cc$''
-              ''^src/libstore/include/nix/store/worker-protocol-impl\.hh$''
-              ''^src/libstore/worker-protocol\.cc$''
-              ''^src/libstore/include/nix/store/worker-protocol\.hh$''
-              ''^src/libutil-c/nix_api_util_internal\.h$''
-              ''^src/libutil/archive\.cc$''
-              ''^src/libutil/include/nix/util/archive\.hh$''
-              ''^src/libutil/args\.cc$''
-              ''^src/libutil/include/nix/util/args\.hh$''
-              ''^src/libutil/include/nix/util/args/root\.hh$''
-              ''^src/libutil/include/nix/util/callback\.hh$''
-              ''^src/libutil/canon-path\.cc$''
-              ''^src/libutil/include/nix/util/canon-path\.hh$''
-              ''^src/libutil/include/nix/util/chunked-vector\.hh$''
-              ''^src/libutil/include/nix/util/closure\.hh$''
-              ''^src/libutil/include/nix/util/comparator\.hh$''
-              ''^src/libutil/compute-levels\.cc$''
-              ''^src/libutil/include/nix/util/config-impl\.hh$''
-              ''^src/libutil/configuration\.cc$''
-              ''^src/libutil/include/nix/util/configuration\.hh$''
-              ''^src/libutil/current-process\.cc$''
-              ''^src/libutil/include/nix/util/current-process\.hh$''
-              ''^src/libutil/english\.cc$''
-              ''^src/libutil/include/nix/util/english\.hh$''
-              ''^src/libutil/error\.cc$''
-              ''^src/libutil/include/nix/util/error\.hh$''
-              ''^src/libutil/include/nix/util/exit\.hh$''
-              ''^src/libutil/experimental-features\.cc$''
-              ''^src/libutil/include/nix/util/experimental-features\.hh$''
-              ''^src/libutil/file-content-address\.cc$''
-              ''^src/libutil/include/nix/util/file-content-address\.hh$''
-              ''^src/libutil/file-descriptor\.cc$''
-              ''^src/libutil/include/nix/util/file-descriptor\.hh$''
-              ''^src/libutil/include/nix/util/file-path-impl\.hh$''
-              ''^src/libutil/include/nix/util/file-path\.hh$''
-              ''^src/libutil/file-system\.cc$''
-              ''^src/libutil/include/nix/util/file-system\.hh$''
-              ''^src/libutil/include/nix/util/finally\.hh$''
-              ''^src/libutil/include/nix/util/fmt\.hh$''
-              ''^src/libutil/fs-sink\.cc$''
-              ''^src/libutil/include/nix/util/fs-sink\.hh$''
-              ''^src/libutil/git\.cc$''
-              ''^src/libutil/include/nix/util/git\.hh$''
-              ''^src/libutil/hash\.cc$''
-              ''^src/libutil/include/nix/util/hash\.hh$''
-              ''^src/libutil/hilite\.cc$''
-              ''^src/libutil/include/nix/util/hilite\.hh$''
-              ''^src/libutil/source-accessor\.hh$''
-              ''^src/libutil/include/nix/util/json-impls\.hh$''
-              ''^src/libutil/json-utils\.cc$''
-              ''^src/libutil/include/nix/util/json-utils\.hh$''
-              ''^src/libutil/linux/cgroup\.cc$''
-              ''^src/libutil/linux/namespaces\.cc$''
-              ''^src/libutil/logging\.cc$''
-              ''^src/libutil/include/nix/util/logging\.hh$''
-              ''^src/libutil/memory-source-accessor\.cc$''
-              ''^src/libutil/include/nix/util/memory-source-accessor\.hh$''
-              ''^src/libutil/include/nix/util/pool\.hh$''
-              ''^src/libutil/position\.cc$''
-              ''^src/libutil/include/nix/util/position\.hh$''
-              ''^src/libutil/posix-source-accessor\.cc$''
-              ''^src/libutil/include/nix/util/posix-source-accessor\.hh$''
-              ''^src/libutil/include/nix/util/processes\.hh$''
-              ''^src/libutil/include/nix/util/ref\.hh$''
-              ''^src/libutil/references\.cc$''
-              ''^src/libutil/include/nix/util/references\.hh$''
-              ''^src/libutil/regex-combinators\.hh$''
-              ''^src/libutil/serialise\.cc$''
-              ''^src/libutil/include/nix/util/serialise\.hh$''
-              ''^src/libutil/include/nix/util/signals\.hh$''
-              ''^src/libutil/signature/local-keys\.cc$''
-              ''^src/libutil/include/nix/util/signature/local-keys\.hh$''
-              ''^src/libutil/signature/signer\.cc$''
-              ''^src/libutil/include/nix/util/signature/signer\.hh$''
-              ''^src/libutil/source-accessor\.cc$''
-              ''^src/libutil/include/nix/util/source-accessor\.hh$''
-              ''^src/libutil/source-path\.cc$''
-              ''^src/libutil/include/nix/util/source-path\.hh$''
-              ''^src/libutil/include/nix/util/split\.hh$''
-              ''^src/libutil/suggestions\.cc$''
-              ''^src/libutil/include/nix/util/suggestions\.hh$''
-              ''^src/libutil/include/nix/util/sync\.hh$''
-              ''^src/libutil/terminal\.cc$''
-              ''^src/libutil/include/nix/util/terminal\.hh$''
-              ''^src/libutil/thread-pool\.cc$''
-              ''^src/libutil/include/nix/util/thread-pool\.hh$''
-              ''^src/libutil/include/nix/util/topo-sort\.hh$''
-              ''^src/libutil/include/nix/util/types\.hh$''
-              ''^src/libutil/unix/file-descriptor\.cc$''
-              ''^src/libutil/unix/file-path\.cc$''
-              ''^src/libutil/unix/processes\.cc$''
-              ''^src/libutil/unix/include/nix/util/signals-impl\.hh$''
-              ''^src/libutil/unix/signals\.cc$''
-              ''^src/libutil/unix-domain-socket\.cc$''
-              ''^src/libutil/unix/users\.cc$''
-              ''^src/libutil/include/nix/util/url-parts\.hh$''
-              ''^src/libutil/url\.cc$''
-              ''^src/libutil/include/nix/util/url\.hh$''
-              ''^src/libutil/users\.cc$''
-              ''^src/libutil/include/nix/util/users\.hh$''
-              ''^src/libutil/util\.cc$''
-              ''^src/libutil/include/nix/util/util\.hh$''
-              ''^src/libutil/include/nix/util/variant-wrapper\.hh$''
-              ''^src/libutil/widecharwidth/widechar_width\.h$'' # vendored source
-              ''^src/libutil/windows/file-descriptor\.cc$''
-              ''^src/libutil/windows/file-path\.cc$''
-              ''^src/libutil/windows/processes\.cc$''
-              ''^src/libutil/windows/users\.cc$''
-              ''^src/libutil/windows/windows-error\.cc$''
-              ''^src/libutil/windows/include/nix/util/windows-error\.hh$''
-              ''^src/libutil/xml-writer\.cc$''
-              ''^src/libutil/include/nix/util/xml-writer\.hh$''
-              ''^src/nix-build/nix-build\.cc$''
-              ''^src/nix-channel/nix-channel\.cc$''
-              ''^src/nix-collect-garbage/nix-collect-garbage\.cc$''
-              ''^src/nix-env/buildenv.nix$''
-              ''^src/nix-env/nix-env\.cc$''
-              ''^src/nix-env/user-env\.cc$''
-              ''^src/nix-env/user-env\.hh$''
-              ''^src/nix-instantiate/nix-instantiate\.cc$''
-              ''^src/nix-store/dotgraph\.cc$''
-              ''^src/nix-store/graphml\.cc$''
-              ''^src/nix-store/nix-store\.cc$''
-              ''^src/nix/add-to-store\.cc$''
-              ''^src/nix/app\.cc$''
-              ''^src/nix/build\.cc$''
-              ''^src/nix/bundle\.cc$''
-              ''^src/nix/cat\.cc$''
-              ''^src/nix/config-check\.cc$''
-              ''^src/nix/config\.cc$''
-              ''^src/nix/copy\.cc$''
-              ''^src/nix/derivation-add\.cc$''
-              ''^src/nix/derivation-show\.cc$''
-              ''^src/nix/derivation\.cc$''
-              ''^src/nix/develop\.cc$''
-              ''^src/nix/diff-closures\.cc$''
-              ''^src/nix/dump-path\.cc$''
-              ''^src/nix/edit\.cc$''
-              ''^src/nix/eval\.cc$''
-              ''^src/nix/flake\.cc$''
-              ''^src/nix/fmt\.cc$''
-              ''^src/nix/hash\.cc$''
-              ''^src/nix/log\.cc$''
-              ''^src/nix/ls\.cc$''
-              ''^src/nix/main\.cc$''
-              ''^src/nix/make-content-addressed\.cc$''
-              ''^src/nix/nar\.cc$''
-              ''^src/nix/optimise-store\.cc$''
-              ''^src/nix/path-from-hash-part\.cc$''
-              ''^src/nix/path-info\.cc$''
-              ''^src/nix/prefetch\.cc$''
-              ''^src/nix/profile\.cc$''
-              ''^src/nix/realisation\.cc$''
-              ''^src/nix/registry\.cc$''
-              ''^src/nix/repl\.cc$''
-              ''^src/nix/run\.cc$''
-              ''^src/nix/run\.hh$''
-              ''^src/nix/search\.cc$''
-              ''^src/nix/sigs\.cc$''
-              ''^src/nix/store-copy-log\.cc$''
-              ''^src/nix/store-delete\.cc$''
-              ''^src/nix/store-gc\.cc$''
-              ''^src/nix/store-info\.cc$''
-              ''^src/nix/store-repair\.cc$''
-              ''^src/nix/store\.cc$''
-              ''^src/nix/unix/daemon\.cc$''
-              ''^src/nix/upgrade-nix\.cc$''
-              ''^src/nix/verify\.cc$''
-              ''^src/nix/why-depends\.cc$''
-
-              ''^tests/functional/plugins/plugintest\.cc''
-              ''^tests/functional/test-libstoreconsumer/main\.cc''
-              ''^tests/nixos/ca-fd-leak/sender\.c''
-              ''^tests/nixos/ca-fd-leak/smuggler\.c''
-              ''^tests/nixos/user-sandboxing/attacker\.c''
-              ''^src/libexpr-test-support/include/nix/expr/tests/libexpr\.hh''
-              ''^src/libexpr-test-support/tests/value/context\.cc''
-              ''^src/libexpr-test-support/include/nix/expr/tests/value/context\.hh''
-              ''^src/libexpr-tests/derived-path\.cc''
-              ''^src/libexpr-tests/error_traces\.cc''
-              ''^src/libexpr-tests/eval\.cc''
-              ''^src/libexpr-tests/json\.cc''
-              ''^src/libexpr-tests/main\.cc''
-              ''^src/libexpr-tests/primops\.cc''
-              ''^src/libexpr-tests/search-path\.cc''
-              ''^src/libexpr-tests/trivial\.cc''
-              ''^src/libexpr-tests/value/context\.cc''
-              ''^src/libexpr-tests/value/print\.cc''
-              ''^src/libfetchers-tests/public-key\.cc''
-              ''^src/libflake-tests/flakeref\.cc''
-              ''^src/libflake-tests/url-name\.cc''
-              ''^src/libstore-test-support/tests/derived-path\.cc''
-              ''^src/libstore-test-support/include/nix/store/tests/derived-path\.hh''
-              ''^src/libstore-test-support/include/nix/store/tests/nix_api_store\.hh''
-              ''^src/libstore-test-support/tests/outputs-spec\.cc''
-              ''^src/libstore-test-support/include/nix/store/tests/outputs-spec\.hh''
-              ''^src/libstore-test-support/path\.cc''
-              ''^src/libstore-test-support/include/nix/store/tests/path\.hh''
-              ''^src/libstore-test-support/include/nix/store/tests/protocol\.hh''
-              ''^src/libstore-tests/common-protocol\.cc''
-              ''^src/libstore-tests/content-address\.cc''
-              ''^src/libstore-tests/derivation\.cc''
-              ''^src/libstore-tests/derived-path\.cc''
-              ''^src/libstore-tests/downstream-placeholder\.cc''
-              ''^src/libstore-tests/machines\.cc''
-              ''^src/libstore-tests/nar-info-disk-cache\.cc''
-              ''^src/libstore-tests/nar-info\.cc''
-              ''^src/libstore-tests/outputs-spec\.cc''
-              ''^src/libstore-tests/path-info\.cc''
-              ''^src/libstore-tests/path\.cc''
-              ''^src/libstore-tests/serve-protocol\.cc''
-              ''^src/libstore-tests/worker-protocol\.cc''
-              ''^src/libutil-test-support/include/nix/util/tests/characterization\.hh''
-              ''^src/libutil-test-support/hash\.cc''
-              ''^src/libutil-test-support/include/nix/util/tests/hash\.hh''
-              ''^src/libutil-tests/args\.cc''
-              ''^src/libutil-tests/canon-path\.cc''
-              ''^src/libutil-tests/chunked-vector\.cc''
-              ''^src/libutil-tests/closure\.cc''
-              ''^src/libutil-tests/compression\.cc''
-              ''^src/libutil-tests/config\.cc''
-              ''^src/libutil-tests/file-content-address\.cc''
-              ''^src/libutil-tests/git\.cc''
-              ''^src/libutil-tests/hash\.cc''
-              ''^src/libutil-tests/hilite\.cc''
-              ''^src/libutil-tests/json-utils\.cc''
-              ''^src/libutil-tests/logging\.cc''
-              ''^src/libutil-tests/lru-cache\.cc''
-              ''^src/libutil-tests/pool\.cc''
-              ''^src/libutil-tests/references\.cc''
-              ''^src/libutil-tests/suggestions\.cc''
-              ''^src/libutil-tests/url\.cc''
-              ''^src/libutil-tests/xml-writer\.cc''
             ];
           };
           shellcheck = {

maintainers/format.sh

@@ -1,11 +1,16 @@
 #!/usr/bin/env bash
 
 if ! type -p pre-commit &>/dev/null; then
-  echo "format.sh: pre-commit not found. Please use \`nix develop\`.";
+  echo "format.sh: pre-commit not found. Please use \`nix develop -c ./maintainers/format.sh\`.";
   exit 1;
 fi;
 if test -z "$_NIX_PRE_COMMIT_HOOKS_CONFIG"; then
-  echo "format.sh: _NIX_PRE_COMMIT_HOOKS_CONFIG not set. Please use \`nix develop\`.";
+  echo "format.sh: _NIX_PRE_COMMIT_HOOKS_CONFIG not set. Please use \`nix develop -c ./maintainers/format.sh\`.";
   exit 1;
 fi;
-pre-commit run --config "$_NIX_PRE_COMMIT_HOOKS_CONFIG" --all-files
+
+while ! pre-commit run --config "$_NIX_PRE_COMMIT_HOOKS_CONFIG" --all-files; do
+    if [ "${1:-}" != "--until-stable" ]; then
+        exit 1
+    fi
+done

maintainers/keys/158A6F530EA202E5F651611314FAEA63448E1DF9.asc

@@ -0,0 +1,110 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGPtMiwBEAC0sFZW2QW/OaDjKm5zGRpDvHXDsMIUtlHfoi5ce8pocC63W05o
+FSXbUZjZ1VfYO8lT8DFANCzTkiXYaZx0cPRG2pVY4AOQZDNFt5XrAyvw496XCAIM
+DTYGFLjCqgjPt9RUFEy4MyHPJTEpB0x3rXgT4ILNu9vsj9Q0vttps7SpbZ3Ldq5H
+o/BBbLW77q/vNjpYzCbBIXF7ycUGpnNv9Go/WuiDnrBMcyxh+8kjjIHB5cxZSnjJ
+DUv681+m83v+gLZQGX/jexQrrf5JpS0X9qEnhGLrNUDhtyv5ud3Je4EfamkjLVVC
+RlNLofgflOCsl/tP80i+K7S1QdKhUALxuJ6H0prYUflGBDxDyC8XYuJ62TT0OUpa
+vJvgwVlCq8/jq+ykYQXlbuBVOzi5wAuI4l3+HqreSQYPSiwe+6N590Zbafdv1fvN
+WFtZKCTGMqfyaaAnppioH9/+NWkI2AQxaYVasYM/JEYvY9pJgA7alh51jHW4JglP
+ErypKfBKPKJID0QENqYoa3bDDCihuNWhgQf9dxzPlj2ckd35Zb6w4DfuSmtjaa9D
+o0jZVY1JbFuxBqP09+saVPrxLHgmPxjcdzPGQQtAqdO2vyJXNEGLFMoVEZPNaLo3
+QmcIJnT7oSck+4vGfOYtWUHXQynu/Tnwsv2XkA/uyw8HNe+RRMqv/apnzQARAQAB
+tCdTZXJnZWkgWmltbWVybWFuIDxzZXJnZWlAemltbWVybWFuLmZvbz6JAlEEEwEK
+ADsCGwEFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AWIQQVim9TDqIC5fZRYRMU+upj
+RI4d+QUCaUbsaAIZAQAKCRAU+upjRI4d+VdDD/492HRaJ/8V7R7VUzkafmb2Hb28
+SLf7oiB8Uq9I7SukiDEaIT1fUhquYWQ9KWpPRNR1TX6ApXnIeuJRMGFoDVIRnmnr
+cKnYYXfqqc81VxIyKvaumB7KWbS7G4Nbor8AH1ouOOOMMS50OTJOWQA4A26inIuG
+n+7L8MeS5aT+3uNKDoTKsidC47vnaxNMcke1taPfbfo7vn69PsRCM/g9/7TQYU8b
+6xp+pM9Ao9nJneRk2YCpsGYRrWTpaik0DFKnfpPKJM/yunhtGLF2IYAp3l1mvHPK
+nnzo92zjpQuZwazEIK+23V1vRT4IjM2BewbJPAzf2/UuxEjjgNQm0tOtH2JhFNeB
+VM0BVrGxWrrwrsmv6lWghTtBc6zRWyHrj/rpjtVQNmeKYrHWJeXwVz1rqgGPmB2N
+k0MZD1UjHHhEs1Cntn7yLmxTPztRJCtR+euRu81Uo2NAvrMJ4xsDjaM0LeLTnzjV
+9AsPjD188dOFyz7VExZum4+XaaEJ41FIPLEqU3U0GAa6stEy0ylSlIN4x9aiXXVW
+xfzHHchS5jK6QAjuZxN8t01GRactNylINRf7uoTECFZTtXNqfeuk0HQxBH0LuKVE
+0PxJbcNI4mVWw1KgTJ8PUVC1IXP3sEpqPdJOYiRXgnpcS26fWOBu0aQ4mhxiaJhr
+/zBfrkLEqp20TdNDZLkCDQRj7TM1ARAAt73xO24curnHTTgXkkVMMRzcMLx3Mb1a
+2FuddxC5hzTpEpw01L91UBrXVJEg9K2KAwP5CtCLgPCqXr47Tm7krvHxWwBksgY/
+6aHRsoPQfCFUZHc0aiO+C4NCzR+aEeGKn66Oc1Hq9oUTpDgiBWhsuEPiyA1OSGF0
+4L0jeTCqfm68kWp4PIK9yuugkdDsoyj6TonuMsb3V5ctHLqop9KH+eHSkUTPo+Lk
++bxaeAOJ1UfbohgbRbrYKAfsaghhOMDH3R1w2pvtUJz+sDbuQsiPFTqbxsXDTFws
+H4N/AQCYnnvOhqEek2sOEZ19bJXt5UrAr10mX4PGmAkWqE1JWBxpOKG3BXSGOTu1
+3dFhQfPMK+PmvUrs0kcWQr53K/aRUdKKhIfTcMfkqYTGPK5HclHph24WjXj3QFFA
+SjksQTdm6486ZmLZK4CTbAFOPfTF/aWg8gu9v4ihdq6lqHNNXxv2xBAChcd59H7p
+D5zy9z8SpwWR9V5JDmlF6HWIIau1c6lSsQq1xHvYM8EuPe03vJvor+2u/cn5zYF1
+5ZxAuPI2i5vtavg1s8ZGAAogJ9dVcP36LdJfL9quXWvmovkd//qHIepBB+l/zQio
+ZRDZlIcfV3Xycaqsb5OqHGARHE0097koipMt5y/iXlqG4Ruue6Idb8bW96EKpaWj
+kKy/iNfQfQMAEQEAAYkEcgQYAQoAJgIbAhYhBBWKb1MOogLl9lFhExT66mNEjh35
+BQJpRuz3BQkJHCDCAkDBdCAEGQEKAB0WIQRK3hK0WyJ4BicGpcmpsLVXymMjJQUC
+Y+0zNQAKCRCpsLVXymMjJbdSD/9+f1FOOeGDAJI6Duo5fsWnf4xJJdtQtDbz6d2A
+SeDapxeJ3zWfKBD0wu5sISEa0uiWsYSmLtsa2SqVAKHlEaMGRR+tkBMPQ+rvgI4c
+62YjGTgm+IPd+NFIn+ixFU1hpinTh+KhUEoeOwWCvKs9nZfSG9vkienfiG0bBxo2
+zrvBzXA50x5hbUL+ghKu/AVfN9qZDwh30O4KZTwk4g4cM9SeaQa4YvHYIS3IEhDZ
+hGybwrrqV9cs92ln4IJw9WCy9QReBNrdeFgC4+3ziUp1QsG3RvqrtuMttwBVC1Z3
+bj5QjLLOREhhodfvk98t9yVkragObb4rGrLo1mWuF0c4mJGvXwnrqhCMvzv4M+0T
+Zdrmw6YpGkGOaOPghVuwoTtqSAkl+zFWIJS89jidvkYG3EqKAkgLKog/TQReCq13
+HWrF8cMck+Rf2K8k26q/RNZaA9ZUKjLExzz8lsWmd2C7rvkGLrlxnzxz0gGyNR3Q
+KK74vcPhqeABt2GSkHtEXZFFA9IVVzwlRWK3e0S+mVQnZVjNL+cBPn3/hZHMLesB
+CucyYZv+DxvT+JkYXBkGSw4s3hpABqGym7gdPUIa0q4rbBFG6xP5sLLBG4yru8vV
+2dyCMmFqRuxpT49uNfyQ6Vj+dobN6qHnP/9NwfzOixXYBHXR6LBqb/M+iCiJaaIn
+uiRLHwkQFPrqY0SOHfkQpA//W51vj8meuz7snRO+vZFcjLneFFzqfh1Jdz8IqDpO
+CkI5pBJmi8e0oSe6r68MkahiQLlYPwm7d+sjHvJhPWipNKWq/uwCgBs+Ac1lpPXR
+MwLbrZukcLMYlLmb2MrCKmjcMt0BZsZKBNYL3a3X9nHgwXdeqFYS4WQDMCCc09lz
+9YqfdoEsqRO4qN7D0hFqnwjOzb34ixZ6UO8a8ekY9QKxAgWc9fJWGMg6Pjdg4qsK
+nqymOIAdGVOJdoRM46wKGVBvbsF2gNfQU4XyzgJo5vHGFwJm6EoSnODlL5e2wsQh
+uN1oqBt/8ef/plloMEqVBweUBATqSqjRF6IhhYJvWVuQHQL1p1vnV9FebiVj34ir
+Z8ID+o0AnTJcclbUcDwannGJ0cuDcPhk/v/ahVuoMERCi12qnMBo5B/e6Omyh1yB
+4pbf4GATGGQipDQG75eC/kP2GQEqJP5WYN0Ar8Le/AA/2xyL7upW0yIByyXCwGEb
+JRwEgU3+bPyu58bFt8Pftit6J7rA3oBVVMOPrYH5eZwRaj5m2RptwKGL6BfHnhNv
+ZqmCq9EBGX6L1NI0xHMjEFfXJ8jU01XdfG8nCqkwqsHwslXLhqjJphfHcx89YwbV
+/15GCuURAv1cKe/7277sOhcvP/QpQqSWgvYExHw8PeFJcTYtF2NrRgNwcQsWS1Rj
+gXa5Ag0EY+0zcAEQANC5N6kSfezuucAgi+X3BD+MT37mxQyvICSggEJf1LDSmy0+
+bnvD7setL8CP9etTA2fcVNYKI1oboMyhoCnsRP2jDdv1iXOI/hZg4wSb/D1yUkae
+fUpxv3Wuci2QKavH2MfraDD7BFMbsQeMcHtn4Rk216T6jndZHnzT1Ih7iX0XeQPb
+li5fojOiZssgWAVT4HPXFCJB6lI35Hjp35oRYwrtMmu5INinZ79n9h1igGtt1ItZ
+b7rQKNd772Jxcn4UU71ovORSL/xT5i5sxZ+evQOxkpqUAokMOFaoHcOXLmA1NsFv
+yryXHK4Ioq9ap2jKlLTWkJWjua9JZ4AmKhbvT8X4ELxIKSCAdJKAWP8ZHbXNu5MD
+aznyzZQLxSO7uFvu356De75mI5iohZNj5wB5Wju71pBiorTKVj4+iJ4e+xVIzFdG
+hFC0DehNcl2t9w/y8qHwIQ1yUAjXHLXq0/2jsVeH6bU5q/MsgvUP1jcFe0eyOpxy
+CDvyFdzZFbI57TnB/fvcZTRZ5ewXMFpH8gzuoFzAjUAP95UjYKgaGdrNPNIy28Ii
+4zhvdghei2+n9jgiMfcGQg8lyfH5yF0vWWWynX0KcJsRwEZoL2EauVdwq4PcYOoU
+pQFhpcreCjD4LdZ4yRU4InbhcUogXjrQ9Dz01TbPmQD5b5iso21bCEFBXrhzABEB
+AAGJAjwEGAEKACYCGwwWIQQVim9TDqIC5fZRYRMU+upjRI4d+QUCaUbs9wUJCRwg
+hwAKCRAU+upjRI4d+X/XD/sH5xvHPfTJq52v8weFmB52up+DzqG2lyhGdoUQ1Muw
+dRDLTLXLJrFdfpoOo7/j4Scr0rdc7/dpCn0DLcPuCoPxu+SkjEnVehFmZrGSv7Ga
+x9dHr3DBh42fdlX/U/EnDuyosY0JU1gNF2/6FIA+bTTOFE3RxfN906RjslYQDjMZ
+UAlSeLYHOZofdltI0YIr32vrxgdWQGZXPxU4XusDUc0z163OO+TGg7iUNWFZP5Qj
+ubM7e0YbDX0NPIshk8us99YJmrWnhaix1/W5ryO3DXiGaQ7XFi9u7QofRqvRIctg
+QXavdepkzJow9V9qpMECAJePIuICq7rm+xy+njjbuF436W7390bfVBwRr+FPADsl
+jgQP4KvY5rykss30kheom8wNEbveWkhH5oTfH9b7O4KXJfpfJzrlgOWp2BD9JL8t
+/M4HvFXTr2a75H/QbHK5OFrZeGATuv9OTxv7EZvnrPXU+DYTFldpu7TrNNqKCoj3
+ZyXmc3Hhg5kskDhfHJppaeOayuhMOpT3ud1MFzROY5SLVIH8rBR12KUgsCUYQcGs
+Iy0+0QvEGkjb4cAH1NK3VlbqVNsy1RmqRt2B28R2ueewDfTOoqkzt4MmzLqTdnAx
+mTqmHmkEKhEf3K4MRNUPO2yieUg2COk5l6x9HhAnoxxeOZrTmcMsPY/UViG2HEPm
+ybkCDQRj7TRDARAA9DZuKdfKq4Bs2+NwxC0aplljWOl8VIsEVg+Q8agD7/HU6/b6
+Dry0njtWybn2x6Axf/nUdeOC01Fi1lmht/fpj6mRkgAvd/V6P10xnsUoykPSDSTh
+P25MFFGW3JAA82bwdJ4AJpEQvTZG2nTb3237vlBiI1qHQrac8GYkju2O4UfySRN6
+7cyi7bMf2pjWBBOEhaNy4b6CMDsb32P/N5J7sTE/TXgrS+u4ITIgjzSrkUkh5Z+B
+8QVRa7xPIDZJdvZWTEXWu5fgRPZvxbr154GIkWJkFzlDoB1UcO56/uzRUuKhEV6o
+HW3LMUuWdPMjpHpq8hrL0G2rDniJFUtbDFzHdZK1LUU3T2BJM8rjI3D/euph+IDT
+27vl5qo72zCYE/iKzx4FMLZcQvx1kUAxkPX8l+dzZEwKeRIIpFDxQvatRtl+z0bM
+jbkpDb+Yjv66sC4dYRpgTTGX6rok0PWHR3IxDNzyf2j8zQ4LFJ+rVBM1GjGSt6mG
+j9TeL8CVeiSp4SuJ7I/FJVPHsKb50m+BDzeB31qTydNqh2kKr0DVAUa+TUsCr7e0
+OYr8WE2adJcRXIW0qw50xXF+W7/05GqSCVD0dpeOUdBTQTsSkQmM3/0hcj9aVo9e
+UDCM9RF0WRqiDAoHzJFfg+ztamkQI5HO6CklC4Ok22qrHRf6HDNYSuT6QFkAEQEA
+AYkCPQQYAQoAJwMbIAQWIQQVim9TDqIC5fZRYRMU+upjRI4d+QUCaUbs9wUJCRwf
+tAAKCRAU+upjRI4d+Y+cD/9yllG6uo934pcHNsVppZBfREFwSc8ywlbosCuSVpay
+PjSqgrWwDrnqrsk0F2kUdC6rR3BIcXbn+lA9KqylH+cCXAJCkh8EDq6TlQ7Lt5EV
+w1U0MAMXOyxPwDymQ/BO+iDyjXWkRRYgbF5XiFhCfGeuKyhkhACisAgNZ1uA1P5k
+0SJYc14YfEhQkB46Y20SpfVHRsQ46FyNB6GHbmTmfoO8La8VTh++7GBdh85HfvkG
+VNQ3wpi5oXsOLN9+MJOezc0XsW2LQsKQj1/J7QKzGh+lxN5cemsA5aqPzh8dyxeT
+0lYRFp4AHkimqGUomVpRkbegMIPxXqOE+ZAmsddErw0UtmrKxcmMptOJwNgYzEgu
+++2vtqerL/NYp+wsdcWaBjCz2F3NiwHgNli7NSB/FPwucZZ5gN5C4SnmeFzrGdHg
+Oy+tQUN6ayQKljHeBO7CjMlsFNo/dcVrEMa1ShxBMqlj/6ivoEhktLz0Nru4FwNU
+xE5SJYDYfpjD7Ws8y4LoXgWXjFHrMO6N9GzqLN/e8LT7I+w4ps2MrgJ8QSrelmQ3
+rjkxp3uWp5v2lqy4rLfpi9iB6zIAeoN2eU1yOM9joxOYMxKYaYeYyP1Mm90wFol8
+LcTSaN+tVniPddBiL6zvsGBEMbCR9XN3EQ+mErbuw5ovWBOCrr+dvN3FxvD11y4J
+7w==
+=mXYP
+-----END PGP PUBLIC KEY BLOCK-----

maintainers/keys/B541D55301270E0BCF15CA5D8170B4726D7198DE.asc

@@ -0,0 +1,51 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQENBFZu2zwBCADfatenjH3cvhlU6AeInvp4R0JmPBG942aghFj1Qh57smRcO5Bv
+y9mqrX3UDdmVvu58V3k1k9/GzPnAG1t+c7ohdymv/AMuNY4pE2sfxx7bX+mncTHX
+5wthipn8kTNm4WjREjCJM1Bm5sozzEZetED3+0/dWlnHl8b38evnLsD+WbSrDPVp
+o6M6Eg9IfMwTfcXzdmLmSnGolBWDQ9i1a0x0r3o+sDW5UTnr7jVP+zILcnOZ1Ewl
+Rn9OJ4Qg3ULM7WTMDYpKH4BO7RLR3aJgmsFAHp17vgUnzzFBZ10MCS3UOyUNoyph
+xo3belf7Q9nrHcSNbqSeQuBnW/vafAZUreAlABEBAAG0IkVlbGNvIERvbHN0cmEg
+PGVkb2xzdHJhQGdtYWlsLmNvbT6JATwEEwEIACYCGyMHCwkIBwMCAQYVCAIJCgsE
+FgIDAQIeAQIXgAUCVm7etAIZAQAKCRCBcLRybXGY3q51B/96qt41tmcDSzrj/UTl
+O6rErfW5zFvVsJTZ95Duwu87t/DVhw5lKBQcjALqVddufw1nMzyN/tSOMVDW8xe4
+wMEdcU4+QAMzNX80enuyinsw1glxfLcK0+VbTvqNIfw0sG3MjPqNs6cK2VRfMHK4
+paJjytBVICszNX9TfjLyIpKKoSSo1vqnT47LDZ5GIMy7l9Cs2sO/rqQHSPcR79yz
+8m8tbHpDDEMZmJeklckKP2QoiqnHiIvlisDxLclYnUmNaPdaN/f++qZz5Yqvu1n+
+sNUBA5eLaZH64Uy2SwtABxO3JPJ8nQ2+SFZ7ocFm4Gcdv4aM+Ura9S6fvM91tEJp
+yAQOiQE5BBMBCAAjBQJWbts8AhsjBwsJCAcDAgEGFQgCCQoLBBYCAwECHgECF4AA
+CgkQgXC0cm1xmN6sIAgAielxO8zJREqEkA2xudg/o4e9ZlNZ3X1NvY8OzJH/qlB2
+SmwKqwifhtbC1K0uavXA7eaxdtd2zrI+Yq7IooUyv7juMjHTZhLcFbR5iVkQ4Mfp
+JmeHXJ/ChYKxD5mMj/C3WbCZ91oCSNZ6Iyi5fvQj/691OC4q+y/2NEUcOI8D8cw8
+XKHbKtceFYc+nZmdOv3ZZrNTSN/kszGViNNLKgnpPdDVPtLp+vjXtbmitiFG2HL/
+WfbJ+3Gh2Yr1Vy3O9dWKH++e1AmIv7WWqmUjRFVpqC/wr7/BLaScWT8WKF5vkshU
+gq8Ez1/cuizsgs3wQIZWgXKQK5njvwnbKg+Zmh/uGbQmRWVsY28gRG9sc3RyYSA8
+ZWVsY28uZG9sc3RyYUB0d2VhZy5pbz6JAU4EEwEIADgWIQS1QdVTAScOC88Vyl2B
+cLRybXGY3gUCXELt4gIbIwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRCBcLRy
+bXGY3ujFCADfS5D1xHU8KH6TpqgssSggYVq62Wwn/Ga+4XPPetM+ajcXagyH6SwB
+mxlHICcnv9xC93ryiTI10P1ADJl+aBsI66wEdHBU+ty4RTDy4JZNUPtmRCk9LhSc
+mtUO3ry/wtWkRLdJxP49hg7BbQvWoU0M6WODp7SJjPKPWNX64mzHBeOuy+DqGCbM
+lpGNCvW8ahU/ewbm7+xwWmzqLDoWzXjHsdF4QdzMVM/vkAgWEP4y0wEqFASzIYaR
+GNEkBWU4OQVq5Bdm9+wWWAgsbM0FJAQl0GDqnz4QxWzxxCAAXdbh9F5ffafWYsA9
+bise4ZQLkvYo6iUnrcFm4dtZbT8iL3gptCtFZWxjbyBEb2xzdHJhIDxlZWxjby5k
+b2xzdHJhQGxvZ2ljYmxveC5jb20+iQE5BBMBCAAjBQJWbt6nAhsjBwsJCAcDAgEG
+FQgCCQoLBBYCAwECHgECF4AACgkQgXC0cm1xmN4b/wf8DApMV/jSPEpibekrUPQu
+Ye3Z8cxBQuRm/nOPowtPEH/ShAevrCdRiob2nuEZWNoqZ2e5/+6ud07Hs9bslvco
+cDv1jeY1dof1idxfKhH3kfSpuD2XJhuzQBxBqOrIlCS/rdnW+Y9wOGD7+bs9QpcA
+IyAeQGLLkfggAxaGYQ2Aev8pS7i3a/+lOWbFhcTe02I49KemCOJqBorG5FfILLNr
+DjO3EoutNGpuz6rZvc/BlymphWBoAdUmxgoObr7NYWgw9pI8WeE6C7bbSOO7p5aQ
+spWXU7Hm17DkzsVDpaJlyClllqK+DdKza5oWlBMe/P02jD3Y+0P/2rCCyQQwmH3D
+RbkBDQRWbts8AQgA0g556xc08dH5YNEjbCwEt1j+XoRnV4+GfbSJIXOl9joIgzRC
+4IaijvL8+4biWvX7HiybfvBKto0XB1AWLZRC3jWKX5p74I77UAcrD+VQ/roWQqlJ
+BKbiQMlRYEsj/5Xnf72G90IP4DAFKvNl+rLChe+jUySA91BCtrYoP75Sw1BE9Cyz
+xEtm4WUzKAJdXI+ZTBttA2Nbqy+GSuzBs7fSKDwREJaZmVrosvmns+pQVG4WPWf4
+0l4mPguDQmZ9wSWZvBDkpG7AgHYDRYRGkMbAGsVfc6cScN2VsSTa6cbeeAEowKxM
+qx9RbY3WOq6aKAm0qDvow1nl7WwXwe8K0wQxfQARAQABiQEfBBgBCAAJBQJWbts8
+AhsMAAoJEIFwtHJtcZjeuAAH/0YNz2Qe1IAEO5oqEZNFOccL4KxVPrBhWUen83/b
+C6PjOnOqv6q5ztAcms88WIKxBlfzIfq+dzJcbKVS/H7TEXgcaC+7EYW8sJVEsipN
+BtEZ3LQNJ5coDjm7WZygniah1lfXNuiritAXduK5FWNNndqGArEaeZ8Shzdo/Uyi
+b9lOsBIL6xc2ZcnX5f+rTu02LCEtEb0FwCycZLEWYf8hG4k8uttIOZOC+CLk/k8d
+kBmPikMwUVTTV0CdT1cemQKdTaoAaK+kurF6FYXwcnjhRlHrisSt/tVMEwTw4LUM
+3MYf6qfjjvE4HlDwZal8th7ccoQp/flfJIuRv85xCcKK+PI=
+=u5cX
+-----END PGP PUBLIC KEY BLOCK-----

maintainers/keys/README.md

@@ -0,0 +1,13 @@
+# Maintainer GPG Keys
+
+Release tags are signed by members of the [Nix maintainer team](https://nixos.org/community/teams/nix/) as part of the [release process](../release-process.md). This directory contains the public GPG keys used for signing.
+
+## Keys
+
+- **Eelco Dolstra**
+  GPG Fingerprint: `B541 D553 0127 0E0B CF15 CA5D 8170 B472 6D71 98DE`
+
+- **Sergei Zimmerman**
+  GPG Fingerprint: [`158A 6F53 0EA2 02E5 F651 6113 14FA EA63 448E 1DF9`](https://keys.openpgp.org/vks/v1/by-fingerprint/158A6F530EA202E5F651611314FAEA63448E1DF9)
+
+<!-- TODO: Add keys for other Nix team members -->

maintainers/release-notes

@@ -157,7 +157,7 @@ section_title="Release $version_full ($DATE)"
 
   if ! $IS_PATCH; then
     echo
-    echo "# Contributors"
+    echo "## Contributors"
     echo
     VERSION=$version_full ./maintainers/release-credits
   fi

maintainers/release-process.md

@@ -5,11 +5,11 @@
 The release process is intended to create the following for each
 release:
 
-* A Git tag
+* A signed Git tag (public keys in `maintainers/keys/`)
 
 * Binary tarballs in https://releases.nixos.org/?prefix=nix/
 
-* Docker images
+* Docker images (arm64 and amd64 variants, uploaded to DockerHub and GHCR)
 
 * Closures in https://cache.nixos.org
 
@@ -101,21 +101,17 @@ release:
   evaluation ID (e.g. `1780832` in
   `https://hydra.nixos.org/eval/1780832`).
 
-* Tag the release and upload the release artifacts to
-  [`releases.nixos.org`](https://releases.nixos.org/) and [Docker Hub](https://hub.docker.com/):
+* Tag the release:
 
   ```console
-  $ IS_LATEST=1 ./maintainers/upload-release.pl <EVAL-ID>
+  $ IS_LATEST=1 ./maintainers/upload-release.pl --skip-docker --skip-s3 --project-root $PWD <EVAL-ID>
   ```
 
   Note: `IS_LATEST=1` causes the `latest-release` branch to be
   force-updated. This is used by the `nixos.org` website to get the
   [latest Nix manual](https://nixos.org/manual/nixpkgs/unstable/).
 
-  TODO: This script requires the right AWS credentials. Document.
-
-  TODO: This script currently requires a
-  `/home/eelco/Dev/nix-pristine`.
+* Trigger the [`upload-release.yml` workflow](https://github.com/NixOS/nix/actions/workflows/upload-release.yml) via `workflow_dispatch` trigger. At the top click `Run workflow` -> select the current release branch from `Use workflow from` -> fill in `Hydra evaluation ID` with `<EVAL-ID>` value from previous steps -> click `Run workflow`. Wait for the run to be approved by `NixOS/nix-team` (or bypass checks if warranted). Wait for the workflow to succeed.
 
   TODO: trigger nixos.org netlify: https://docs.netlify.com/configure-builds/build-hooks/
 
@@ -180,16 +176,18 @@ release:
 * Wait for the desired evaluation of the maintenance jobset to finish
   building.
 
-* Run
+* Tag the release
 
   ```console
-  $ IS_LATEST=1 ./maintainers/upload-release.pl <EVAL-ID>
+  $ IS_LATEST=1 ./maintainers/upload-release.pl --skip-docker --skip-s3 --project-root $PWD <EVAL-ID>
   ```
 
   Omit `IS_LATEST=1` when creating a point release that is not on the
   most recent stable branch. This prevents `nixos.org` to going back
   to an older release.
 
+* Trigger the [`upload-release.yml` workflow](https://github.com/NixOS/nix/actions/workflows/upload-release.yml) via `workflow_dispatch` trigger. At the top click `Run workflow` -> select the current release branch from `Use workflow from` -> fill in `Hydra evaluation ID` with `<EVAL-ID>` value from previous steps -> click `Run workflow`. Wait for the run to be approved by `NixOS/nix-team` (or bypass checks if warranted). Wait for the workflow to succeed.
+
 * Bump the version number of the release branch as above (e.g. to
   `2.12.2`).
 

maintainers/upload-release.pl

@@ -1,7 +1,8 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i perl -p perl perlPackages.LWPUserAgent perlPackages.LWPProtocolHttps perlPackages.FileSlurp perlPackages.NetAmazonS3 gnupg1
+#! nix-shell -i perl -p awscli2 perl perlPackages.LWPUserAgent perlPackages.LWPProtocolHttps perlPackages.FileSlurp perlPackages.NetAmazonS3 perlPackages.GetoptLongDescriptive gnupg1
 
 use strict;
+use Getopt::Long::Descriptive;
 use Data::Dumper;
 use File::Basename;
 use File::Path;
@@ -13,7 +14,30 @@ use Net::Amazon::S3;
 
 delete $ENV{'shell'}; # shut up a LWP::UserAgent.pm warning
 
-my $evalId = $ARGV[0] or die "Usage: $0 EVAL-ID\n";
+my ($opt, $usage) = describe_options(
+    '%c %o <eval-id>',
+    [ 'skip-docker',      'Skip Docker image upload' ],
+    [ 'skip-git',         'Skip Git tagging' ],
+    [ 'skip-s3',          'Skip S3 upload' ],
+    [ 'docker-owner=s',   'Docker image owner', { default => 'nixos/nix' } ],
+    [ 'project-root=s',   'Pristine git repository path' ],
+    [ 's3-endpoint=s',    'Custom S3 endpoint' ],
+    [ 's3-host=s',        'S3 host', { default => 's3-eu-west-1.amazonaws.com' } ],
+    [],
+    [ 'help|h',           'Show this help message', { shortcircuit => 1 } ],
+    [],
+    [ 'Environment variables:' ],
+    [ 'AWS_ACCESS_KEY_ID' ],
+    [ 'AWS_SECRET_ACCESS_KEY' ],
+    [ 'AWS_SESSION_TOKEN   For OIDC' ],
+    [ 'IS_LATEST           Set to "1" to mark as latest release' ],
+);
+
+print($usage->text), exit if $opt->help;
+
+my $evalId = $ARGV[0] or do { print STDERR $usage->text; exit 1 };
+
+die "--project-root is required unless --skip-git is specified\n" unless $opt->skip_git || $opt->project_root;
 
 my $releasesBucketName = "nix-releases";
 my $channelsBucketName = "nix-channels";
@@ -62,25 +86,38 @@ File::Path::make_path($narCache);
 my $binaryCache = "https://cache.nixos.org/?local-nar-cache=$narCache";
 
 # S3 setup.
-my $aws_access_key_id = $ENV{'AWS_ACCESS_KEY_ID'} or die "No AWS_ACCESS_KEY_ID given.";
-my $aws_secret_access_key = $ENV{'AWS_SECRET_ACCESS_KEY'} or die "No AWS_SECRET_ACCESS_KEY given.";
+my $aws_access_key_id = $ENV{'AWS_ACCESS_KEY_ID'};
+my $aws_secret_access_key = $ENV{'AWS_SECRET_ACCESS_KEY'};
+my $aws_session_token = $ENV{'AWS_SESSION_TOKEN'};
 
-my $s3 = Net::Amazon::S3->new(
-    { aws_access_key_id     => $aws_access_key_id,
-      aws_secret_access_key => $aws_secret_access_key,
-      retry                 => 1,
-      host                  => "s3-eu-west-1.amazonaws.com",
-    });
+my ($s3, $releasesBucket, $s3_channels, $channelsBucket);
 
-my $releasesBucket = $s3->bucket($releasesBucketName) or die;
+unless ($opt->skip_s3) {
+    $aws_access_key_id or die "No AWS_ACCESS_KEY_ID given.";
+    $aws_secret_access_key or die "No AWS_SECRET_ACCESS_KEY given.";
 
-my $s3_us = Net::Amazon::S3->new(
-    { aws_access_key_id     => $aws_access_key_id,
-      aws_secret_access_key => $aws_secret_access_key,
-      retry                 => 1,
-    });
+    $s3 = Net::Amazon::S3->new(
+        { aws_access_key_id     => $aws_access_key_id,
+          aws_secret_access_key => $aws_secret_access_key,
+          $aws_session_token ? (aws_session_token => $aws_session_token) : (),
+          retry                 => 1,
+          host                  => $opt->s3_host,
+          secure                => ($opt->s3_endpoint && $opt->s3_endpoint =~ /^http:/) ? 0 : 1,
+        });
 
-my $channelsBucket = $s3_us->bucket($channelsBucketName) or die;
+    $releasesBucket = $s3->bucket($releasesBucketName) or die;
+
+    $s3_channels = Net::Amazon::S3->new(
+        { aws_access_key_id     => $aws_access_key_id,
+          aws_secret_access_key => $aws_secret_access_key,
+          $aws_session_token ? (aws_session_token => $aws_session_token) : (),
+          retry                 => 1,
+          $opt->s3_endpoint ? (host => $opt->s3_host) : (),
+          $opt->s3_endpoint ? (secure => ($opt->s3_endpoint =~ /^http:/) ? 0 : 1) : (),
+        });
+
+    $channelsBucket = $s3_channels->bucket($channelsBucketName) or die;
+}
 
 sub getStorePath {
     my ($jobName, $output) = @_;
@@ -115,11 +152,12 @@ sub copyManual {
         File::Path::remove_tree("$tmpDir/manual.tmp", {safe => 1});
     }
 
-    system("aws s3 sync '$tmpDir/manual' s3://$releasesBucketName/$releaseDir/manual") == 0
+    my $awsEndpoint = $opt->s3_endpoint ? "--endpoint-url " . $opt->s3_endpoint : "";
+    system("aws $awsEndpoint s3 sync '$tmpDir/manual' s3://$releasesBucketName/$releaseDir/manual") == 0
         or die "syncing manual to S3\n";
 }
 
-copyManual;
+copyManual unless $opt->skip_s3;
 
 sub downloadFile {
     my ($jobName, $productNr, $dstName) = @_;
@@ -158,30 +196,12 @@ sub downloadFile {
     return $sha256_expected;
 }
 
-downloadFile("binaryTarball.i686-linux", "1");
-downloadFile("binaryTarball.x86_64-linux", "1");
-downloadFile("binaryTarball.aarch64-linux", "1");
-downloadFile("binaryTarball.x86_64-darwin", "1");
-downloadFile("binaryTarball.aarch64-darwin", "1");
-eval {
-    downloadFile("binaryTarballCross.x86_64-linux.armv6l-unknown-linux-gnueabihf", "1");
-};
-warn "$@" if $@;
-eval {
-    downloadFile("binaryTarballCross.x86_64-linux.armv7l-unknown-linux-gnueabihf", "1");
-};
-warn "$@" if $@;
-eval {
-    downloadFile("binaryTarballCross.x86_64-linux.riscv64-unknown-linux-gnu", "1");
-};
-warn "$@" if $@;
-downloadFile("installerScript", "1");
-
-# Upload docker images to dockerhub.
+# Upload docker images.
 my $dockerManifest = "";
 my $dockerManifestLatest = "";
 my $haveDocker = 0;
 
+unless ($opt->skip_docker) {
 for my $platforms (["x86_64-linux", "amd64"], ["aarch64-linux", "arm64"]) {
     my $system = $platforms->[0];
     my $dockerPlatform = $platforms->[1];
@@ -195,8 +215,8 @@ for my $platforms (["x86_64-linux", "amd64"], ["aarch64-linux", "arm64"]) {
     print STDERR "loading docker image for $dockerPlatform...\n";
     system("docker load -i $tmpDir/$fn") == 0 or die;
 
-    my $tag = "nixos/nix:$version-$dockerPlatform";
-    my $latestTag = "nixos/nix:latest-$dockerPlatform";
+    my $tag = $opt->docker_owner . ":$version-$dockerPlatform";
+    my $latestTag = $opt->docker_owner . ":latest-$dockerPlatform";
 
     print STDERR "tagging $version docker image for $dockerPlatform...\n";
     system("docker tag nix:$version $tag") == 0 or die;
@@ -219,68 +239,94 @@ for my $platforms (["x86_64-linux", "amd64"], ["aarch64-linux", "arm64"]) {
 }
 
 if ($haveDocker) {
+    my $dockerOwner = $opt->docker_owner;
     print STDERR "creating multi-platform docker manifest...\n";
-    system("docker manifest rm nixos/nix:$version");
-    system("docker manifest create nixos/nix:$version $dockerManifest") == 0 or die;
+    system("docker manifest rm $dockerOwner:$version");
+    system("docker manifest create $dockerOwner:$version $dockerManifest") == 0 or die;
     if ($isLatest) {
         print STDERR "creating latest multi-platform docker manifest...\n";
-        system("docker manifest rm nixos/nix:latest");
-        system("docker manifest create nixos/nix:latest $dockerManifestLatest") == 0 or die;
+        system("docker manifest rm $dockerOwner:latest");
+        system("docker manifest create $dockerOwner:latest $dockerManifestLatest") == 0 or die;
     }
 
     print STDERR "pushing multi-platform docker manifest...\n";
-    system("docker manifest push nixos/nix:$version") == 0 or die;
+    system("docker manifest push $dockerOwner:$version") == 0 or die;
 
     if ($isLatest) {
         print STDERR "pushing latest multi-platform docker manifest...\n";
-        system("docker manifest push nixos/nix:latest") == 0 or die;
+        system("docker manifest push $dockerOwner:latest") == 0 or die;
     }
 }
+}
 
-# Upload nix-fallback-paths.nix.
-write_file("$tmpDir/fallback-paths.nix",
-    "{\n" .
-    "  x86_64-linux = \"" . getStorePath("build.nix-everything.x86_64-linux") . "\";\n" .
-    "  i686-linux = \"" . getStorePath("build.nix-everything.i686-linux") . "\";\n" .
-    "  aarch64-linux = \"" . getStorePath("build.nix-everything.aarch64-linux") . "\";\n" .
-    "  riscv64-linux = \"" . getStorePath("buildCross.nix-everything.riscv64-unknown-linux-gnu.x86_64-linux") . "\";\n" .
-    "  x86_64-darwin = \"" . getStorePath("build.nix-everything.x86_64-darwin") . "\";\n" .
-    "  aarch64-darwin = \"" . getStorePath("build.nix-everything.aarch64-darwin") . "\";\n" .
-    "}\n");
 
 # Upload release files to S3.
-for my $fn (glob "$tmpDir/*") {
-    my $name = basename($fn);
-    next if $name eq "manual";
-    my $dstKey = "$releaseDir/" . $name;
-    unless (defined $releasesBucket->head_key($dstKey)) {
-        print STDERR "uploading $fn to s3://$releasesBucketName/$dstKey...\n";
+unless ($opt->skip_s3) {
+    downloadFile("binaryTarball.i686-linux", "1");
+    downloadFile("binaryTarball.x86_64-linux", "1");
+    downloadFile("binaryTarball.aarch64-linux", "1");
+    downloadFile("binaryTarball.x86_64-darwin", "1");
+    downloadFile("binaryTarball.aarch64-darwin", "1");
+    eval {
+        downloadFile("binaryTarballCross.x86_64-linux.armv6l-unknown-linux-gnueabihf", "1");
+    };
+    warn "$@" if $@;
+    eval {
+        downloadFile("binaryTarballCross.x86_64-linux.armv7l-unknown-linux-gnueabihf", "1");
+    };
+    warn "$@" if $@;
+    eval {
+        downloadFile("binaryTarballCross.x86_64-linux.riscv64-unknown-linux-gnu", "1");
+    };
+    warn "$@" if $@;
+    downloadFile("installerScript", "1");
 
-        my $configuration = ();
-        $configuration->{content_type} = "application/octet-stream";
+    # Upload nix-fallback-paths.nix.
+    write_file("$tmpDir/fallback-paths.nix",
+        "{\n" .
+        "  x86_64-linux = \"" . getStorePath("build.nix-everything.x86_64-linux") . "\";\n" .
+        "  i686-linux = \"" . getStorePath("build.nix-everything.i686-linux") . "\";\n" .
+        "  aarch64-linux = \"" . getStorePath("build.nix-everything.aarch64-linux") . "\";\n" .
+        "  riscv64-linux = \"" . getStorePath("buildCross.nix-everything.riscv64-unknown-linux-gnu.x86_64-linux") . "\";\n" .
+        "  x86_64-darwin = \"" . getStorePath("build.nix-everything.x86_64-darwin") . "\";\n" .
+        "  aarch64-darwin = \"" . getStorePath("build.nix-everything.aarch64-darwin") . "\";\n" .
+        "}\n");
 
-        if ($fn =~ /.sha256|install|\.nix$/) {
-            $configuration->{content_type} = "text/plain";
+    for my $fn (glob "$tmpDir/*") {
+        my $name = basename($fn);
+        next if $name eq "manual";
+        my $dstKey = "$releaseDir/" . $name;
+        unless (defined $releasesBucket->head_key($dstKey)) {
+            print STDERR "uploading $fn to s3://$releasesBucketName/$dstKey...\n";
+
+            my $configuration = ();
+            $configuration->{content_type} = "application/octet-stream";
+
+            if ($fn =~ /.sha256|install|\.nix$/) {
+                $configuration->{content_type} = "text/plain";
+            }
+
+            $releasesBucket->add_key_filename($dstKey, $fn, $configuration)
+                or die $releasesBucket->err . ": " . $releasesBucket->errstr;
         }
-
-        $releasesBucket->add_key_filename($dstKey, $fn, $configuration)
-            or die $releasesBucket->err . ": " . $releasesBucket->errstr;
     }
+
+    # Update the "latest" symlink.
+    $channelsBucket->add_key(
+        "nix-latest/install", "",
+        { "x-amz-website-redirect-location" => "https://releases.nixos.org/$releaseDir/install" })
+        or die $channelsBucket->err . ": " . $channelsBucket->errstr
+        if $isLatest;
 }
 
-# Update the "latest" symlink.
-$channelsBucket->add_key(
-    "nix-latest/install", "",
-    { "x-amz-website-redirect-location" => "https://releases.nixos.org/$releaseDir/install" })
-    or die $channelsBucket->err . ": " . $channelsBucket->errstr
-    if $isLatest;
-
 # Tag the release in Git.
-chdir("/home/eelco/Dev/nix-pristine") or die;
-system("git remote update origin") == 0 or die;
-system("git tag --force --sign $version $nixRev -m 'Tagging release $version'") == 0 or die;
-system("git push --tags") == 0 or die;
-system("git push --force-with-lease origin $nixRev:refs/heads/latest-release") == 0 or die if $isLatest;
+unless ($opt->skip_git) {
+    chdir($opt->project_root) or die "Cannot chdir to " . $opt->project_root . ": $!";
+    system("git remote update origin") == 0 or die;
+    system("git tag --force --sign $version $nixRev -m 'Tagging release $version'") == 0 or die;
+    system("git push origin refs/tags/$version") == 0 or die;
+    system("git push --force-with-lease origin $nixRev:refs/heads/latest-release") == 0 or die if $isLatest;
+}
 
 File::Path::remove_tree($narCache, {safe => 1});
 File::Path::remove_tree($tmpDir, {safe => 1});

meson.build

@@ -1,13 +1,16 @@
 # This is just a stub project to include all the others as subprojects
 # for development shell purposes
 
-project('nix-dev-shell', 'cpp',
+project(
+  'nix-dev-shell',
+  'cpp',
   version : files('.version'),
   subproject_dir : 'src',
   default_options : [
     'localstatedir=/nix/var',
+    # hack for trailing newline
   ],
-  meson_version : '>= 1.1'
+  meson_version : '>= 1.1',
 )
 
 # Internal Libraries

meson.format

@@ -0,0 +1,7 @@
+indent_by = '  '
+space_array = true
+kwargs_force_multiline = false
+wide_colon = true
+group_arg_value = true
+indent_before_comments = ' '
+use_editor_config = true

meson.options

@@ -1,13 +1,22 @@
 # vim: filetype=meson
 
-option('doc-gen', type : 'boolean', value : false,
+option(
+  'doc-gen',
+  type : 'boolean',
+  value : false,
   description : 'Generate documentation',
 )
 
-option('unit-tests', type : 'boolean', value : true,
+option(
+  'unit-tests',
+  type : 'boolean',
+  value : true,
   description : 'Build unit tests',
 )
 
-option('bindings', type : 'boolean', value : true,
+option(
+  'bindings',
+  type : 'boolean',
+  value : true,
   description : 'Build language bindings (e.g. Perl)',
 )

misc/systemd/nix-daemon.conf.in

@@ -1 +1,2 @@
-d @localstatedir@/nix/daemon-socket 0755 root root - -
+d @localstatedir@/nix/daemon-socket 0755 root root -  -
+d @localstatedir@/nix/builds        0755 root root 7d -

nix-meson-build-support/default-system-cpu/meson.build

@@ -0,0 +1,19 @@
+# This attempts to translate meson cpu_family and cpu_name specified via
+# --cross-file [1] into a nix *system double*. Nixpkgs mostly respects ([2]) the
+# conventions outlined in [1].
+#
+# [1]: https://mesonbuild.com/Reference-tables.html#cpu-families
+# [2]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/build-support/lib/meson.nix
+
+nix_system_cpu = {'ppc64' : 'powerpc64', 'ppc' : 'powerpc', 'x86' : 'i686'}.get(
+  host_machine.cpu_family(),
+  host_machine.cpu_family(),
+)
+
+if (host_machine.cpu_family() in [ 'ppc64', 'ppc' ]) and host_machine.endian() == 'little'
+  nix_system_cpu += 'le'
+elif host_machine.cpu_family() in [ 'mips64', 'mips' ] and host_machine.endian() == 'little'
+  nix_system_cpu += 'el'
+elif host_machine.cpu_family() == 'arm'
+  nix_system_cpu = host_machine.cpu()
+endif

nix-meson-build-support/export/meson.build

@@ -11,12 +11,18 @@ endforeach
 requires_public += deps_public
 
 extra_pkg_config_variables = get_variable('extra_pkg_config_variables', {})
+
+extra_cflags = []
+if not meson.project_name().endswith('-c')
+    extra_cflags += ['-std=c++2a']
+endif
+
 import('pkgconfig').generate(
   this_library,
   filebase : meson.project_name(),
   name : 'Nix',
   description : 'Nix Package Manager',
-  extra_cflags : ['-std=c++2a'],
+  extra_cflags : extra_cflags,
   requires : requires_public,
   requires_private : requires_private,
   libraries_private : libraries_private,

nix-meson-build-support/windows-version/meson.build

@@ -2,5 +2,5 @@ if host_machine.system() == 'windows'
   # https://learn.microsoft.com/en-us/cpp/porting/modifying-winver-and-win32-winnt?view=msvc-170
   # #define _WIN32_WINNT_WIN8 0x0602
   # We currently don't use any API which requires higher than this.
-  add_project_arguments([ '-D_WIN32_WINNT=0x0602' ], language: 'cpp')
+  add_project_arguments([ '-D_WIN32_WINNT=0x0602' ], language : 'cpp')
 endif

packaging/components.nix

@@ -54,12 +54,12 @@ let
     preConfigure =
       prevAttrs.preConfigure or ""
       +
-        # Update the repo-global .version file.
-        # Symlink ./.version points there, but by default only workDir is writable.
-        ''
-          chmod u+w ./.version
-          echo ${finalAttrs.version} > ./.version
-        '';
+      # Update the repo-global .version file.
+      # Symlink ./.version points there, but by default only workDir is writable.
+      ''
+        chmod u+w ./.version
+        echo ${finalAttrs.version} > ./.version
+      '';
   };
 
   localSourceLayer =
@@ -148,7 +148,8 @@ let
     nativeBuildInputs = [
       meson
       ninja
-    ] ++ prevAttrs.nativeBuildInputs or [ ];
+    ]
+    ++ prevAttrs.nativeBuildInputs or [ ];
     mesonCheckFlags = prevAttrs.mesonCheckFlags or [ ] ++ [
       "--print-errorlogs"
     ];
@@ -166,6 +167,17 @@ let
     outputs = prevAttrs.outputs or [ "out" ] ++ [ "dev" ];
   };
 
+  fixupStaticLayer = finalAttrs: prevAttrs: {
+    postFixup =
+      prevAttrs.postFixup or ""
+      + lib.optionalString (stdenv.hostPlatform.isStatic) ''
+        # HACK: Otherwise the result will have the entire buildInputs closure
+        # injected by the pkgsStatic stdenv
+        # <https://github.com/NixOS/nixpkgs/issues/83667>
+        rm -f $out/nix-support/propagated-build-inputs
+      '';
+  };
+
   # Work around weird `--as-needed` linker behavior with BSD, see
   # https://github.com/mesonbuild/meson/issues/3593
   bsdNoLinkAsNeeded =
@@ -301,6 +313,7 @@ in
     scope.sourceLayer
     setVersionLayer
     mesonLayer
+    fixupStaticLayer
     scope.mesonComponentOverrides
   ];
   mkMesonExecutable = mkPackageBuilder [
@@ -310,6 +323,7 @@ in
     setVersionLayer
     mesonLayer
     mesonBuildLayer
+    fixupStaticLayer
     scope.mesonComponentOverrides
   ];
   mkMesonLibrary = mkPackageBuilder [
@@ -320,6 +334,7 @@ in
     setVersionLayer
     mesonBuildLayer
     mesonLibraryLayer
+    fixupStaticLayer
     scope.mesonComponentOverrides
   ];
 

packaging/dependencies.nix

@@ -63,6 +63,7 @@ scope: {
         "--with-coroutine"
         "--with-iostreams"
       ];
+      enableIcu = false;
     }).overrideAttrs
       (old: {
         # Need to remove `--with-*` to use `--with-libraries=...`

packaging/dev-shell.nix

@@ -71,17 +71,16 @@ pkgs.nixComponents2.nix-util.overrideAttrs (
     # We use this shell with the local checkout, not unpackPhase.
     src = null;
 
-    env =
-      {
-        # For `make format`, to work without installing pre-commit
-        _NIX_PRE_COMMIT_HOOKS_CONFIG = "${(pkgs.formats.yaml { }).generate "pre-commit-config.yaml"
-          modular.pre-commit.settings.rawConfig
-        }";
-      }
-      // lib.optionalAttrs stdenv.hostPlatform.isLinux {
-        CC_LD = "mold";
-        CXX_LD = "mold";
-      };
+    env = {
+      # For `make format`, to work without installing pre-commit
+      _NIX_PRE_COMMIT_HOOKS_CONFIG = "${(pkgs.formats.yaml { }).generate "pre-commit-config.yaml"
+        modular.pre-commit.settings.rawConfig
+      }";
+    }
+    // lib.optionalAttrs stdenv.hostPlatform.isLinux {
+      CC_LD = "mold";
+      CXX_LD = "mold";
+    };
 
     mesonFlags =
       map (transformFlag "libutil") (ignoreCrossFile pkgs.nixComponents2.nix-util.mesonFlags)
@@ -113,15 +112,13 @@ pkgs.nixComponents2.nix-util.overrideAttrs (
       ) pkgs.buildPackages.mesonEmulatorHook
       ++ [
         pkgs.buildPackages.cmake
+        pkgs.buildPackages.gnused
         pkgs.buildPackages.shellcheck
         pkgs.buildPackages.changelog-d
         modular.pre-commit.settings.package
         (pkgs.writeScriptBin "pre-commit-hooks-install" modular.pre-commit.settings.installationScript)
         pkgs.buildPackages.nixfmt-rfc-style
       ]
-      # TODO: Remove the darwin check once
-      # https://github.com/NixOS/nixpkgs/pull/291814 is available
-      ++ lib.optional (stdenv.cc.isClang && !stdenv.buildPlatform.isDarwin) pkgs.buildPackages.bear
       ++ lib.optional (stdenv.cc.isClang && stdenv.hostPlatform == stdenv.buildPlatform) (
         lib.hiPrio pkgs.buildPackages.clang-tools
       )

packaging/everything.nix

@@ -47,25 +47,25 @@
 }:
 
 let
-  libs =
-    {
-      inherit
-        nix-util
-        nix-util-c
-        nix-store
-        nix-store-c
-        nix-fetchers
-        nix-fetchers-c
-        nix-expr
-        nix-expr-c
-        nix-flake
-        nix-flake-c
-        nix-main
-        nix-main-c
-        nix-cmd
-        ;
-    }
-    // lib.optionalAttrs
+  libs = {
+    inherit
+      nix-util
+      nix-util-c
+      nix-store
+      nix-store-c
+      nix-fetchers
+      nix-fetchers-c
+      nix-expr
+      nix-expr-c
+      nix-flake
+      nix-flake-c
+      nix-main
+      nix-main-c
+      nix-cmd
+      ;
+  }
+  //
+    lib.optionalAttrs
       (!stdenv.hostPlatform.isStatic && stdenv.buildPlatform.canExecute stdenv.hostPlatform)
       {
         # Currently fails in static build
@@ -127,20 +127,19 @@ stdenv.mkDerivation (finalAttrs: {
   */
   dontFixup = true;
 
-  checkInputs =
-    [
-      # Make sure the unit tests have passed
-      nix-util-tests.tests.run
-      nix-store-tests.tests.run
-      nix-expr-tests.tests.run
-      nix-fetchers-tests.tests.run
-      nix-flake-tests.tests.run
+  checkInputs = [
+    # Make sure the unit tests have passed
+    nix-util-tests.tests.run
+    nix-store-tests.tests.run
+    nix-expr-tests.tests.run
+    nix-fetchers-tests.tests.run
+    nix-flake-tests.tests.run
 
-      # Make sure the functional tests have passed
-      nix-functional-tests
-    ]
-    ++ lib.optionals
-      (!stdenv.hostPlatform.isStatic && stdenv.buildPlatform.canExecute stdenv.hostPlatform)
+    # Make sure the functional tests have passed
+    nix-functional-tests
+  ]
+  ++
+    lib.optionals (!stdenv.hostPlatform.isStatic && stdenv.buildPlatform.canExecute stdenv.hostPlatform)
       [
         # Perl currently fails in static build
         # TODO: Split out tests into a separate derivation?

precompiled-headers.h

@@ -1,63 +0,0 @@
-#include <algorithm>
-#include <array>
-#include <atomic>
-#include <cassert>
-#include <cctype>
-#include <chrono>
-#include <climits>
-#include <cmath>
-#include <condition_variable>
-#include <cstddef>
-#include <cstdint>
-#include <cstdio>
-#include <cstdlib>
-#include <cstring>
-#include <exception>
-#include <functional>
-#include <future>
-#include <iostream>
-#include <limits>
-#include <list>
-#include <locale>
-#include <map>
-#include <memory>
-#include <mutex>
-#include <numeric>
-#include <optional>
-#include <queue>
-#include <random>
-#include <regex>
-#include <set>
-#include <sstream>
-#include <stack>
-#include <stdexcept>
-#include <string>
-#include <thread>
-#include <unordered_map>
-#include <unordered_set>
-#include <vector>
-
-#include <boost/format.hpp>
-
-#include <dirent.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <signal.h>
-#include <sys/stat.h>
-#include <sys/time.h>
-#include <sys/types.h>
-#include <unistd.h>
-
-#ifndef _WIN32
-# include <grp.h>
-# include <netdb.h>
-# include <pwd.h>
-# include <sys/resource.h>
-# include <sys/select.h>
-# include <sys/socket.h>
-# include <sys/utsname.h>
-# include <sys/wait.h>
-# include <termios.h>
-#endif
-
-#include <nlohmann/json.hpp>

scripts/install-multi-user.sh

@@ -834,8 +834,13 @@ install_from_extracted_nix() {
     (
         cd "$EXTRACTED_NIX_PATH"
 
-        _sudo "to copy the basic Nix files to the new store at $NIX_ROOT/store" \
-              cp -RPp ./store/* "$NIX_ROOT/store/"
+        if is_os_darwin; then
+            _sudo "to copy the basic Nix files to the new store at $NIX_ROOT/store" \
+                  cp -RPp ./store/* "$NIX_ROOT/store/"
+        else
+            _sudo "to copy the basic Nix files to the new store at $NIX_ROOT/store" \
+                  cp -RP --preserve=ownership,timestamps ./store/* "$NIX_ROOT/store/"
+        fi
 
         _sudo "to make the new store non-writable at $NIX_ROOT/store" \
               chmod -R ugo-w "$NIX_ROOT/store/"

scripts/install-nix-from-tarball.sh

@@ -167,7 +167,11 @@ for i in $(cd "$self/store" >/dev/null && echo ./*); do
         rm -rf "$i_tmp"
     fi
     if ! [ -e "$dest/store/$i" ]; then
-        cp -RPp "$self/store/$i" "$i_tmp"
+        if [ "$(uname -s)" = "Darwin" ]; then
+            cp -RPp "$self/store/$i" "$i_tmp"
+        else
+            cp -RP --preserve=ownership,timestamps "$self/store/$i" "$i_tmp"
+        fi
         chmod -R a-w "$i_tmp"
         chmod +w "$i_tmp"
         mv "$i_tmp" "$dest/store/$i"

scripts/nix-profile-daemon.fish.in

@@ -1,17 +1,16 @@
 # Only execute this file once per shell.
-if test -z "$HOME" || \
-    test -n "$__ETC_PROFILE_NIX_SOURCED"
+if test -z "$HOME" || test -n "$__ETC_PROFILE_NIX_SOURCED"
     exit
 end
 
-set --global __ETC_PROFILE_NIX_SOURCED 1
+set --global --export __ETC_PROFILE_NIX_SOURCED 1
 
 # Local helpers
 
 function add_path --argument-names new_path
     if type -q fish_add_path
         # fish 3.2.0 or newer
-	fish_add_path --prepend --global $new_path
+        fish_add_path --prepend --global $new_path
     else
         # older versions of fish
         if not contains $new_path $fish_user_paths
@@ -24,7 +23,33 @@ end
 
 # Set up the per-user profile.
 
-set --local NIX_LINK $HOME/.nix-profile
+set --local NIX_LINK "$HOME/.nix-profile"
+set --local NIX_LINK_NEW
+if test -n "$XDG_STATE_HOME"
+    set NIX_LINK_NEW "$XDG_STATE_HOME/nix/profile"
+else
+    set NIX_LINK_NEW "$HOME/.local/state/nix/profile"
+end
+if test -e "$NIX_LINK_NEW"
+    if test -t 2; and test -e "$NIX_LINK"
+        set --local warning "\033[1;35mwarning:\033[0m "
+        printf "$warning Both %s and legacy %s exist; using the former.\n" "$NIX_LINK_NEW" "$NIX_LINK" 1>&2
+
+        if test (realpath "$NIX_LINK") = (realpath "$NIX_LINK_NEW")
+            printf "         Since the profiles match, you can safely delete either of them.\n" 1>&2
+        else
+            # This should be an exceptionally rare occasion: the only way to get it would be to
+            # 1. Update to newer Nix;
+            # 2. Remove .nix-profile;
+            # 3. Set the $NIX_LINK_NEW to something other than the default user profile;
+            # 4. Roll back to older Nix.
+            # If someone did all that, they can probably figure out how to migrate the profile.
+            printf "$warning Profiles do not match. You should manually migrate from %s to %s.\n" "$NIX_LINK" "$NIX_LINK_NEW" 1>&2
+        end
+    end
+
+    set NIX_LINK "$NIX_LINK_NEW"
+end
 
 # Set up environment.
 # This part should be kept in sync with nixpkgs:nixos/modules/programs/environment.nix

scripts/nix-profile.fish.in

@@ -1,17 +1,16 @@
 # Only execute this file once per shell.
-if test -z "$HOME" || \
-    test -n "$__ETC_PROFILE_NIX_SOURCED"
+if test -z "$HOME" || test -n "$__ETC_PROFILE_NIX_SOURCED"
     exit
 end
 
-set --global __ETC_PROFILE_NIX_SOURCED 1
+set --global --export __ETC_PROFILE_NIX_SOURCED 1
 
 # Local helpers
 
 function add_path --argument-names new_path
     if type -q fish_add_path
         # fish 3.2.0 or newer
-	fish_add_path --prepend --global $new_path
+        fish_add_path --prepend --global $new_path
     else
         # older versions of fish
         if not contains $new_path $fish_user_paths
@@ -24,7 +23,38 @@ end
 
 # Set up the per-user profile.
 
-set --local NIX_LINK $HOME/.nix-profile
+set --local NIX_LINK
+if test -n "$NIX_STATE_HOME"
+    set NIX_LINK "$NIX_STATE_HOME/.nix-profile"
+else
+    set NIX_LINK "$HOME/.nix-profile"
+    set --local NIX_LINK_NEW
+    if test -n "$XDG_STATE_HOME"
+        set NIX_LINK_NEW "$XDG_STATE_HOME/nix/profile"
+    else
+        set NIX_LINK_NEW "$HOME/.local/state/nix/profile"
+    end
+    if test -e "$NIX_LINK_NEW"
+        if test -t 2; and test -e "$NIX_LINK"
+            set --local warning "\033[1;35mwarning:\033[0m "
+            printf "$warning Both %s and legacy %s exist; using the former.\n" "$NIX_LINK_NEW" "$NIX_LINK" 1>&2
+
+            if test (realpath "$NIX_LINK") = (realpath "$NIX_LINK_NEW")
+                printf "         Since the profiles match, you can safely delete either of them.\n" 1>&2
+            else
+                # This should be an exceptionally rare occasion: the only way to get it would be to
+                # 1. Update to newer Nix;
+                # 2. Remove .nix-profile;
+                # 3. Set the $NIX_LINK_NEW to something other than the default user profile;
+                # 4. Roll back to older Nix.
+                # If someone did all that, they can probably figure out how to migrate the profile.
+                printf "$warning Profiles do not match. You should manually migrate from %s to %s.\n" "$NIX_LINK" "$NIX_LINK_NEW" 1>&2
+            end
+        end
+
+        set NIX_LINK "$NIX_LINK_NEW"
+    end
+end
 
 # Set up environment.
 # This part should be kept in sync with nixpkgs:nixos/modules/programs/environment.nix

src/build-remote/build-remote.cc

@@ -6,7 +6,7 @@
 #include <tuple>
 #include <iomanip>
 #ifdef __APPLE__
-#include <sys/time.h>
+#  include <sys/time.h>
 #endif
 
 #include "nix/store/machines.hh"
@@ -26,8 +26,7 @@
 using namespace nix;
 using std::cin;
 
-static void handleAlarm(int sig) {
-}
+static void handleAlarm(int sig) {}
 
 std::string escapeUri(std::string uri)
 {
@@ -42,13 +41,15 @@ static AutoCloseFD openSlotLock(const Machine & m, uint64_t slot)
     return openLockFile(fmt("%s/%s-%d", currentLoad, escapeUri(m.storeUri.render()), slot), true);
 }
 
-static bool allSupportedLocally(Store & store, const StringSet& requiredFeatures) {
+static bool allSupportedLocally(Store & store, const StringSet & requiredFeatures)
+{
     for (auto & feature : requiredFeatures)
-        if (!store.config.systemFeatures.get().count(feature)) return false;
+        if (!store.config.systemFeatures.get().count(feature))
+            return false;
     return true;
 }
 
-static int main_build_remote(int argc, char * * argv)
+static int main_build_remote(int argc, char ** argv)
 {
     {
         logger = makeJSONLogger(getStandardError());
@@ -85,7 +86,7 @@ static int main_build_remote(int argc, char * * argv)
            that gets cleared on reboot, but it wouldn't work on macOS. */
         auto currentLoadName = "/current-load";
         if (auto localStore = store.dynamic_pointer_cast<LocalFSStore>())
-            currentLoad = std::string { localStore->config.stateDir } + currentLoadName;
+            currentLoad = std::string{localStore->config.stateDir} + currentLoadName;
         else
             currentLoad = settings.nixStateDir + currentLoadName;
 
@@ -107,8 +108,11 @@ static int main_build_remote(int argc, char * * argv)
 
             try {
                 auto s = readString(source);
-                if (s != "try") return 0;
-            } catch (EndOfFile &) { return 0; }
+                if (s != "try")
+                    return 0;
+            } catch (EndOfFile &) {
+                return 0;
+            }
 
             auto amWilling = readInt(source);
             auto neededSystem = readString(source);
@@ -117,10 +121,10 @@ static int main_build_remote(int argc, char * * argv)
 
             /* It would be possible to build locally after some builds clear out,
                so don't show the warning now: */
-            bool couldBuildLocally = maxBuildJobs > 0
-                 &&  (  neededSystem == settings.thisSystem
-                     || settings.extraPlatforms.get().count(neededSystem) > 0)
-                 &&  allSupportedLocally(*store, requiredFeatures);
+            bool couldBuildLocally =
+                maxBuildJobs > 0
+                && (neededSystem == settings.thisSystem || settings.extraPlatforms.get().count(neededSystem) > 0)
+                && allSupportedLocally(*store, requiredFeatures);
             /* It's possible to build this locally right now: */
             bool canBuildLocally = amWilling && couldBuildLocally;
 
@@ -139,11 +143,8 @@ static int main_build_remote(int argc, char * * argv)
                 for (auto & m : machines) {
                     debug("considering building on remote machine '%s'", m.storeUri.render());
 
-                    if (m.enabled &&
-                        m.systemSupported(neededSystem) &&
-                        m.allSupported(requiredFeatures) &&
-                        m.mandatoryMet(requiredFeatures))
-                    {
+                    if (m.enabled && m.systemSupported(neededSystem) && m.allSupported(requiredFeatures)
+                        && m.mandatoryMet(requiredFeatures)) {
                         rightType = true;
                         AutoCloseFD free;
                         uint64_t load = 0;
@@ -185,8 +186,7 @@ static int main_build_remote(int argc, char * * argv)
                 if (!bestSlotLock) {
                     if (rightType && !canBuildLocally)
                         std::cerr << "# postpone\n";
-                    else
-                    {
+                    else {
                         // build the hint template.
                         std::string errorText =
                             "Failed to find a machine for remote build!\n"
@@ -205,16 +205,11 @@ static int main_build_remote(int argc, char * * argv)
                             drvstr = "<unknown>";
 
                         auto error = HintFmt::fromFormatString(errorText);
-                        error
-                            % drvstr
-                            % neededSystem
-                            % concatStringsSep<StringSet>(", ", requiredFeatures)
+                        error % drvstr % neededSystem % concatStringsSep<StringSet>(", ", requiredFeatures)
                             % machines.size();
 
                         for (auto & m : machines)
-                            error
-                                % concatStringsSep<StringSet>(", ", m.systemTypes)
-                                % m.maxJobs
+                            error % concatStringsSep<StringSet>(", ", m.systemTypes) % m.maxJobs
                                 % concatStringsSep<StringSet>(", ", m.supportedFeatures)
                                 % concatStringsSep<StringSet>(", ", m.mandatoryFeatures);
 
@@ -242,9 +237,7 @@ static int main_build_remote(int argc, char * * argv)
                     sshStore->connect();
                 } catch (std::exception & e) {
                     auto msg = chomp(drainFD(5, false));
-                    printError("cannot build on '%s': %s%s",
-                        storeUri, e.what(),
-                        msg.empty() ? "" : ": " + msg);
+                    printError("cannot build on '%s': %s%s", storeUri, e.what(), msg.empty() ? "" : ": " + msg);
                     bestMachine->enabled = false;
                     continue;
                 }
@@ -253,7 +246,7 @@ static int main_build_remote(int argc, char * * argv)
             }
         }
 
-connected:
+    connected:
         close(5);
 
         assert(sshStore);
@@ -265,13 +258,14 @@ connected:
 
         AutoCloseFD uploadLock;
         {
-            auto setUpdateLock = [&](auto && fileName){
+            auto setUpdateLock = [&](auto && fileName) {
                 uploadLock = openLockFile(currentLoad + "/" + escapeUri(fileName) + ".upload-lock", true);
             };
             try {
                 setUpdateLock(storeUri);
             } catch (SysError & e) {
-                if (e.errNo != ENAMETOOLONG) throw;
+                if (e.errNo != ENAMETOOLONG)
+                    throw;
                 // Try again hashing the store URL so we have a shorter path
                 auto h = hashString(HashAlgorithm::MD5, storeUri);
                 setUpdateLock(h.to_string(HashFormat::Base64, false));
@@ -315,7 +309,7 @@ connected:
         //
         // This condition mirrors that: that code enforces the "rules" outlined there;
         // we do the best we can given those "rules".
-        if (trustedOrLegacy || drv.type().isCA())  {
+        if (trustedOrLegacy || drv.type().isCA()) {
             // Hijack the inputs paths of the derivation to include all
             // the paths that come from the `inputDrvs` set. We don’t do
             // that for the derivations whose `inputDrvs` is empty
@@ -329,29 +323,35 @@ connected:
                 drv.inputSrcs = store->parseStorePathSet(inputs);
             optResult = sshStore->buildDerivation(*drvPath, (const BasicDerivation &) drv);
             auto & result = *optResult;
-            if (!result.success())
-                throw Error("build of '%s' on '%s' failed: %s", store->printStorePath(*drvPath), storeUri, result.errorMsg);
-        } else {
-            copyClosure(*store, *sshStore, StorePathSet {*drvPath}, NoRepair, NoCheckSigs, substitute);
-            auto res = sshStore->buildPathsWithResults({
-                DerivedPath::Built {
-                    .drvPath = makeConstantStorePathRef(*drvPath),
-                    .outputs = OutputsSpec::All {},
+            if (!result.success()) {
+                if (settings.keepFailed) {
+                    warn(
+                        "The failed build directory was kept on the remote builder due to `--keep-failed`.%s",
+                        (settings.thisSystem == drv.platform || settings.extraPlatforms.get().count(drv.platform) > 0)
+                            ? " You can re-run the command with `--builders ''` to disable remote building for this invocation."
+                            : "");
                 }
-            });
+                throw Error(
+                    "build of '%s' on '%s' failed: %s", store->printStorePath(*drvPath), storeUri, result.errorMsg);
+            }
+        } else {
+            copyClosure(*store, *sshStore, StorePathSet{*drvPath}, NoRepair, NoCheckSigs, substitute);
+            auto res = sshStore->buildPathsWithResults({DerivedPath::Built{
+                .drvPath = makeConstantStorePathRef(*drvPath),
+                .outputs = OutputsSpec::All{},
+            }});
             // One path to build should produce exactly one build result
             assert(res.size() == 1);
             optResult = std::move(res[0]);
         }
 
-
         auto outputHashes = staticOutputHashes(*store, drv);
         std::set<Realisation> missingRealisations;
         StorePathSet missingPaths;
         if (experimentalFeatureSettings.isEnabled(Xp::CaDerivations) && !drv.type().hasKnownOutputPaths()) {
             for (auto & outputName : wantedOutputs) {
                 auto thisOutputHash = outputHashes.at(outputName);
-                auto thisOutputId = DrvOutput{ thisOutputHash, outputName };
+                auto thisOutputId = DrvOutput{thisOutputHash, outputName};
                 if (!store->queryRealisation(thisOutputId)) {
                     debug("missing output %s", outputName);
                     assert(optResult);

src/libcmd/built-path.cc

@@ -10,23 +10,13 @@
 namespace nix {
 
 // Custom implementation to avoid `ref` ptr equality
-GENERATE_CMP_EXT(
-    ,
-    std::strong_ordering,
-    SingleBuiltPathBuilt,
-    *me->drvPath,
-    me->output);
+GENERATE_CMP_EXT(, std::strong_ordering, SingleBuiltPathBuilt, *me->drvPath, me->output);
 
 // Custom implementation to avoid `ref` ptr equality
 
 // TODO no `GENERATE_CMP_EXT` because no `std::set::operator<=>` on
 // Darwin, per header.
-GENERATE_EQUAL(
-    ,
-    BuiltPathBuilt ::,
-    BuiltPathBuilt,
-    *me->drvPath,
-    me->outputs);
+GENERATE_EQUAL(, BuiltPathBuilt ::, BuiltPathBuilt, *me->drvPath, me->outputs);
 
 StorePath SingleBuiltPath::outPath() const
 {
@@ -34,8 +24,8 @@ StorePath SingleBuiltPath::outPath() const
         overloaded{
             [](const SingleBuiltPath::Opaque & p) { return p.path; },
             [](const SingleBuiltPath::Built & b) { return b.output.second; },
-        }, raw()
-    );
+        },
+        raw());
 }
 
 StorePathSet BuiltPath::outPaths() const
@@ -49,13 +39,13 @@ StorePathSet BuiltPath::outPaths() const
                     res.insert(path);
                 return res;
             },
-        }, raw()
-    );
+        },
+        raw());
 }
 
 SingleDerivedPath::Built SingleBuiltPath::Built::discardOutputPath() const
 {
-    return SingleDerivedPath::Built {
+    return SingleDerivedPath::Built{
         .drvPath = make_ref<SingleDerivedPath>(drvPath->discardOutputPath()),
         .output = output.first,
     };
@@ -65,14 +55,10 @@ SingleDerivedPath SingleBuiltPath::discardOutputPath() const
 {
     return std::visit(
         overloaded{
-            [](const SingleBuiltPath::Opaque & p) -> SingleDerivedPath {
-                return p;
-            },
-            [](const SingleBuiltPath::Built & b) -> SingleDerivedPath {
-                return b.discardOutputPath();
-            },
-        }, raw()
-    );
+            [](const SingleBuiltPath::Opaque & p) -> SingleDerivedPath { return p; },
+            [](const SingleBuiltPath::Built & b) -> SingleDerivedPath { return b.discardOutputPath(); },
+        },
+        raw());
 }
 
 nlohmann::json BuiltPath::Built::toJSON(const StoreDirConfig & store) const
@@ -97,16 +83,12 @@ nlohmann::json SingleBuiltPath::Built::toJSON(const StoreDirConfig & store) cons
 
 nlohmann::json SingleBuiltPath::toJSON(const StoreDirConfig & store) const
 {
-    return std::visit([&](const auto & buildable) {
-        return buildable.toJSON(store);
-    }, raw());
+    return std::visit([&](const auto & buildable) { return buildable.toJSON(store); }, raw());
 }
 
 nlohmann::json BuiltPath::toJSON(const StoreDirConfig & store) const
 {
-    return std::visit([&](const auto & buildable) {
-        return buildable.toJSON(store);
-    }, raw());
+    return std::visit([&](const auto & buildable) { return buildable.toJSON(store); }, raw());
 }
 
 RealisedPath::Set BuiltPath::toRealisedPaths(Store & store) const
@@ -116,20 +98,18 @@ RealisedPath::Set BuiltPath::toRealisedPaths(Store & store) const
         overloaded{
             [&](const BuiltPath::Opaque & p) { res.insert(p.path); },
             [&](const BuiltPath::Built & p) {
-                auto drvHashes =
-                    staticOutputHashes(store, store.readDerivation(p.drvPath->outPath()));
-                for (auto& [outputName, outputPath] : p.outputs) {
-                    if (experimentalFeatureSettings.isEnabled(
-                                Xp::CaDerivations)) {
+                auto drvHashes = staticOutputHashes(store, store.readDerivation(p.drvPath->outPath()));
+                for (auto & [outputName, outputPath] : p.outputs) {
+                    if (experimentalFeatureSettings.isEnabled(Xp::CaDerivations)) {
                         auto drvOutput = get(drvHashes, outputName);
                         if (!drvOutput)
                             throw Error(
                                 "the derivation '%s' has unrealised output '%s' (derived-path.cc/toRealisedPaths)",
-                                store.printStorePath(p.drvPath->outPath()), outputName);
-                        auto thisRealisation = store.queryRealisation(
-                            DrvOutput{*drvOutput, outputName});
-                        assert(thisRealisation);  // We’ve built it, so we must
-                                                  // have the realisation
+                                store.printStorePath(p.drvPath->outPath()),
+                                outputName);
+                        auto thisRealisation = store.queryRealisation(DrvOutput{*drvOutput, outputName});
+                        assert(thisRealisation); // We’ve built it, so we must
+                                                 // have the realisation
                         res.insert(*thisRealisation);
                     } else {
                         res.insert(outputPath);
@@ -141,4 +121,4 @@ RealisedPath::Set BuiltPath::toRealisedPaths(Store & store) const
     return res;
 }
 
-}
+} // namespace nix

src/libcmd/command-installable-value.cc

@@ -8,4 +8,4 @@ void InstallableValueCommand::run(ref<Store> store, ref<Installable> installable
     run(store, installableValue);
 }
 
-}
+} // namespace nix

src/libcmd/command.cc

@@ -402,4 +402,4 @@ void MixOutLinkBase::createOutLinksMaybe(const std::vector<BuiltPathWithResult>
             createOutLinks(outLink, toBuiltPaths(buildables), *store2);
 }
 
-}
+} // namespace nix

src/libcmd/common-eval-args.cc

@@ -18,12 +18,11 @@
 
 namespace nix {
 
-
 fetchers::Settings fetchSettings;
 
 static GlobalConfig::Register rFetchSettings(&fetchSettings);
 
-EvalSettings evalSettings {
+EvalSettings evalSettings{
     settings.readOnlyMode,
     {
         {
@@ -31,10 +30,15 @@ EvalSettings evalSettings {
             [](EvalState & state, std::string_view rest) {
                 experimentalFeatureSettings.require(Xp::Flakes);
                 // FIXME `parseFlakeRef` should take a `std::string_view`.
-                auto flakeRef = parseFlakeRef(fetchSettings, std::string { rest }, {}, true, false);
+                auto flakeRef = parseFlakeRef(fetchSettings, std::string{rest}, {}, true, false);
                 debug("fetching flake search path element '%s''", rest);
                 auto [accessor, lockedRef] = flakeRef.resolve(state.store).lazyFetch(state.store);
-                auto storePath = nix::fetchToStore(*state.store, SourcePath(accessor), FetchMode::Copy, lockedRef.input.getName());
+                auto storePath = nix::fetchToStore(
+                    state.fetchSettings,
+                    *state.store,
+                    SourcePath(accessor),
+                    FetchMode::Copy,
+                    lockedRef.input.getName());
                 state.allowPath(storePath);
                 return state.storePath(storePath);
             },
@@ -44,17 +48,14 @@ EvalSettings evalSettings {
 
 static GlobalConfig::Register rEvalSettings(&evalSettings);
 
-
 flake::Settings flakeSettings;
 
 static GlobalConfig::Register rFlakeSettings(&flakeSettings);
 
-
-CompatibilitySettings compatibilitySettings {};
+CompatibilitySettings compatibilitySettings{};
 
 static GlobalConfig::Register rCompatibilitySettings(&compatibilitySettings);
 
-
 MixEvalArgs::MixEvalArgs()
 {
     addFlag({
@@ -62,7 +63,9 @@ MixEvalArgs::MixEvalArgs()
         .description = "Pass the value *expr* as the argument *name* to Nix functions.",
         .category = category,
         .labels = {"name", "expr"},
-        .handler = {[&](std::string name, std::string expr) { autoArgs.insert_or_assign(name, AutoArg{AutoArgExpr{expr}}); }},
+        .handler = {[&](std::string name, std::string expr) {
+            autoArgs.insert_or_assign(name, AutoArg{AutoArgExpr{expr}});
+        }},
     });
 
     addFlag({
@@ -70,7 +73,9 @@ MixEvalArgs::MixEvalArgs()
         .description = "Pass the string *string* as the argument *name* to Nix functions.",
         .category = category,
         .labels = {"name", "string"},
-        .handler = {[&](std::string name, std::string s) { autoArgs.insert_or_assign(name, AutoArg{AutoArgString{s}}); }},
+        .handler = {[&](std::string name, std::string s) {
+            autoArgs.insert_or_assign(name, AutoArg{AutoArgString{s}});
+        }},
     });
 
     addFlag({
@@ -78,7 +83,9 @@ MixEvalArgs::MixEvalArgs()
         .description = "Pass the contents of file *path* as the argument *name* to Nix functions.",
         .category = category,
         .labels = {"name", "path"},
-        .handler = {[&](std::string name, std::string path) { autoArgs.insert_or_assign(name, AutoArg{AutoArgFile{path}}); }},
+        .handler = {[&](std::string name, std::string path) {
+            autoArgs.insert_or_assign(name, AutoArg{AutoArgFile{path}});
+        }},
         .completer = completePath,
     });
 
@@ -102,18 +109,14 @@ MixEvalArgs::MixEvalArgs()
   )",
         .category = category,
         .labels = {"path"},
-        .handler = {[&](std::string s) {
-            lookupPath.elements.emplace_back(LookupPath::Elem::parse(s));
-        }},
+        .handler = {[&](std::string s) { lookupPath.elements.emplace_back(LookupPath::Elem::parse(s)); }},
     });
 
     addFlag({
         .longName = "impure",
         .description = "Allow access to mutable paths and repositories.",
         .category = category,
-        .handler = {[&]() {
-            evalSettings.pureEval = false;
-        }},
+        .handler = {[&]() { evalSettings.pureEval = false; }},
     });
 
     addFlag({
@@ -125,7 +128,8 @@ MixEvalArgs::MixEvalArgs()
             auto from = parseFlakeRef(fetchSettings, _from, std::filesystem::current_path().string());
             auto to = parseFlakeRef(fetchSettings, _to, std::filesystem::current_path().string());
             fetchers::Attrs extraAttrs;
-            if (to.subdir != "") extraAttrs["dir"] = to.subdir;
+            if (to.subdir != "")
+                extraAttrs["dir"] = to.subdir;
             fetchers::overrideRegistry(from.input, to.input, extraAttrs);
         }},
         .completer = {[&](AddCompletions & completions, size_t, std::string_view prefix) {
@@ -136,7 +140,7 @@ MixEvalArgs::MixEvalArgs()
     addFlag({
         .longName = "eval-store",
         .description =
-          R"(
+            R"(
             The [URL of the Nix store](@docroot@/store/types/index.md#store-url-format)
             to use for evaluation, i.e. to store derivations (`.drv` files) and inputs referenced by them.
           )",
@@ -151,20 +155,21 @@ Bindings * MixEvalArgs::getAutoArgs(EvalState & state)
     auto res = state.buildBindings(autoArgs.size());
     for (auto & [name, arg] : autoArgs) {
         auto v = state.allocValue();
-        std::visit(overloaded {
-            [&](const AutoArgExpr & arg) {
-                state.mkThunk_(*v, state.parseExprFromString(arg.expr, compatibilitySettings.nixShellShebangArgumentsRelativeToScript ? state.rootPath(absPath(getCommandBaseDir())) : state.rootPath(".")));
-            },
-            [&](const AutoArgString & arg) {
-                v->mkString(arg.s);
-            },
-            [&](const AutoArgFile & arg) {
-                v->mkString(readFile(arg.path.string()));
-            },
-            [&](const AutoArgStdin & arg) {
-                v->mkString(readFile(STDIN_FILENO));
-            }
-        }, arg);
+        std::visit(
+            overloaded{
+                [&](const AutoArgExpr & arg) {
+                    state.mkThunk_(
+                        *v,
+                        state.parseExprFromString(
+                            arg.expr,
+                            compatibilitySettings.nixShellShebangArgumentsRelativeToScript
+                                ? state.rootPath(absPath(getCommandBaseDir()))
+                                : state.rootPath(".")));
+                },
+                [&](const AutoArgString & arg) { v->mkString(arg.s); },
+                [&](const AutoArgFile & arg) { v->mkString(readFile(arg.path.string())); },
+                [&](const AutoArgStdin & arg) { v->mkString(readFile(STDIN_FILENO)); }},
+            arg);
         res.insert(state.symbols.create(name), v);
     }
     return res.finish();
@@ -173,11 +178,8 @@ Bindings * MixEvalArgs::getAutoArgs(EvalState & state)
 SourcePath lookupFileArg(EvalState & state, std::string_view s, const Path * baseDir)
 {
     if (EvalSettings::isPseudoUrl(s)) {
-        auto accessor = fetchers::downloadTarball(
-            state.store,
-            state.fetchSettings,
-            EvalSettings::resolvePseudoUrl(s));
-        auto storePath = fetchToStore(*state.store, SourcePath(accessor), FetchMode::Copy);
+        auto accessor = fetchers::downloadTarball(state.store, state.fetchSettings, EvalSettings::resolvePseudoUrl(s));
+        auto storePath = fetchToStore(state.fetchSettings, *state.store, SourcePath(accessor), FetchMode::Copy);
         return state.storePath(storePath);
     }
 
@@ -185,7 +187,8 @@ SourcePath lookupFileArg(EvalState & state, std::string_view s, const Path * bas
         experimentalFeatureSettings.require(Xp::Flakes);
         auto flakeRef = parseFlakeRef(fetchSettings, std::string(s.substr(6)), {}, true, false);
         auto [accessor, lockedRef] = flakeRef.resolve(state.store).lazyFetch(state.store);
-        auto storePath = nix::fetchToStore(*state.store, SourcePath(accessor), FetchMode::Copy, lockedRef.input.getName());
+        auto storePath = nix::fetchToStore(
+            state.fetchSettings, *state.store, SourcePath(accessor), FetchMode::Copy, lockedRef.input.getName());
         state.allowPath(storePath);
         return state.storePath(storePath);
     }
@@ -199,4 +202,4 @@ SourcePath lookupFileArg(EvalState & state, std::string_view s, const Path * bas
         return state.rootPath(baseDir ? absPath(s, *baseDir) : absPath(s));
 }
 
-}
+} // namespace nix

src/libcmd/editor-for.cc

@@ -11,14 +11,12 @@ Strings editorFor(const SourcePath & file, uint32_t line)
         throw Error("cannot open '%s' in an editor because it has no physical path", file);
     auto editor = getEnv("EDITOR").value_or("cat");
     auto args = tokenizeString<Strings>(editor);
-    if (line > 0 && (
-        editor.find("emacs") != std::string::npos ||
-        editor.find("nano") != std::string::npos ||
-        editor.find("vim") != std::string::npos ||
-        editor.find("kak") != std::string::npos))
+    if (line > 0
+        && (editor.find("emacs") != std::string::npos || editor.find("nano") != std::string::npos
+            || editor.find("vim") != std::string::npos || editor.find("kak") != std::string::npos))
         args.push_back(fmt("+%d", line));
     args.push_back(path->string());
     return args;
 }
 
-}
+} // namespace nix

src/libcmd/include/nix/cmd/built-path.hh

@@ -8,7 +8,8 @@ namespace nix {
 
 struct SingleBuiltPath;
 
-struct SingleBuiltPathBuilt {
+struct SingleBuiltPathBuilt
+{
     ref<SingleBuiltPath> drvPath;
     std::pair<std::string, StorePath> output;
 
@@ -18,26 +19,25 @@ struct SingleBuiltPathBuilt {
     static SingleBuiltPathBuilt parse(const StoreDirConfig & store, std::string_view, std::string_view);
     nlohmann::json toJSON(const StoreDirConfig & store) const;
 
-    bool operator ==(const SingleBuiltPathBuilt &) const noexcept;
-    std::strong_ordering operator <=>(const SingleBuiltPathBuilt &) const noexcept;
+    bool operator==(const SingleBuiltPathBuilt &) const noexcept;
+    std::strong_ordering operator<=>(const SingleBuiltPathBuilt &) const noexcept;
 };
 
-using _SingleBuiltPathRaw = std::variant<
-    DerivedPathOpaque,
-    SingleBuiltPathBuilt
->;
+using _SingleBuiltPathRaw = std::variant<DerivedPathOpaque, SingleBuiltPathBuilt>;
 
-struct SingleBuiltPath : _SingleBuiltPathRaw {
+struct SingleBuiltPath : _SingleBuiltPathRaw
+{
     using Raw = _SingleBuiltPathRaw;
     using Raw::Raw;
 
     using Opaque = DerivedPathOpaque;
     using Built = SingleBuiltPathBuilt;
 
-    bool operator == (const SingleBuiltPath &) const = default;
-    auto operator <=> (const SingleBuiltPath &) const = default;
+    bool operator==(const SingleBuiltPath &) const = default;
+    auto operator<=>(const SingleBuiltPath &) const = default;
 
-    inline const Raw & raw() const {
+    inline const Raw & raw() const
+    {
         return static_cast<const Raw &>(*this);
     }
 
@@ -51,7 +51,7 @@ struct SingleBuiltPath : _SingleBuiltPathRaw {
 
 static inline ref<SingleBuiltPath> staticDrv(StorePath drvPath)
 {
-    return make_ref<SingleBuiltPath>(SingleBuiltPath::Opaque { drvPath });
+    return make_ref<SingleBuiltPath>(SingleBuiltPath::Opaque{drvPath});
 }
 
 /**
@@ -59,40 +59,41 @@ static inline ref<SingleBuiltPath> staticDrv(StorePath drvPath)
  *
  * See 'BuiltPath' for more an explanation.
  */
-struct BuiltPathBuilt {
+struct BuiltPathBuilt
+{
     ref<SingleBuiltPath> drvPath;
     std::map<std::string, StorePath> outputs;
 
-    bool operator == (const BuiltPathBuilt &) const noexcept;
+    bool operator==(const BuiltPathBuilt &) const noexcept;
     // TODO libc++ 16 (used by darwin) missing `std::map::operator <=>`, can't do yet.
-    //std::strong_ordering operator <=> (const BuiltPathBuilt &) const noexcept;
+    // std::strong_ordering operator <=> (const BuiltPathBuilt &) const noexcept;
 
     std::string to_string(const StoreDirConfig & store) const;
     static BuiltPathBuilt parse(const StoreDirConfig & store, std::string_view, std::string_view);
     nlohmann::json toJSON(const StoreDirConfig & store) const;
 };
 
-using _BuiltPathRaw = std::variant<
-    DerivedPath::Opaque,
-    BuiltPathBuilt
->;
+using _BuiltPathRaw = std::variant<DerivedPath::Opaque, BuiltPathBuilt>;
 
 /**
  * A built path. Similar to a DerivedPath, but enriched with the corresponding
  * output path(s).
  */
-struct BuiltPath : _BuiltPathRaw {
+struct BuiltPath : _BuiltPathRaw
+{
     using Raw = _BuiltPathRaw;
     using Raw::Raw;
 
     using Opaque = DerivedPathOpaque;
     using Built = BuiltPathBuilt;
 
-    bool operator == (const BuiltPath &) const = default;
-    // TODO libc++ 16 (used by darwin) missing `std::map::operator <=>`, can't do yet.
-    //auto operator <=> (const BuiltPath &) const = default;
+    bool operator==(const BuiltPath &) const = default;
 
-    inline const Raw & raw() const {
+    // TODO libc++ 16 (used by darwin) missing `std::map::operator <=>`, can't do yet.
+    // auto operator <=> (const BuiltPath &) const = default;
+
+    inline const Raw & raw() const
+    {
         return static_cast<const Raw &>(*this);
     }
 
@@ -104,4 +105,4 @@ struct BuiltPath : _BuiltPathRaw {
 
 typedef std::vector<BuiltPath> BuiltPaths;
 
-}
+} // namespace nix

src/libcmd/include/nix/cmd/command-installable-value.hh

@@ -20,4 +20,4 @@ struct InstallableValueCommand : InstallableCommand
     void run(ref<Store> store, ref<Installable> installable) override;
 };
 
-}
+} // namespace nix

src/libcmd/include/nix/cmd/command.hh

@@ -336,7 +336,7 @@ struct MixEnvironment : virtual Args
 
     StringSet keepVars;
     StringSet unsetVars;
-    std::map<std::string, std::string> setVars;
+    StringMap setVars;
     bool ignoreEnvironment;
 
     MixEnvironment();

src/libcmd/include/nix/cmd/common-eval-args.hh

@@ -5,6 +5,7 @@
 #include "nix/util/canon-path.hh"
 #include "nix/main/common-args.hh"
 #include "nix/expr/search-path.hh"
+#include "nix/expr/eval-settings.hh"
 
 #include <filesystem>
 
@@ -12,28 +13,30 @@ namespace nix {
 
 class Store;
 
-namespace fetchers { struct Settings; }
+namespace fetchers {
+struct Settings;
+}
 
 class EvalState;
-struct EvalSettings;
 struct CompatibilitySettings;
 class Bindings;
-struct SourcePath;
 
-namespace flake { struct Settings; }
+namespace flake {
+struct Settings;
+}
 
 /**
- * @todo Get rid of global setttings variables
+ * @todo Get rid of global settings variables
  */
 extern fetchers::Settings fetchSettings;
 
 /**
- * @todo Get rid of global setttings variables
+ * @todo Get rid of global settings variables
  */
 extern EvalSettings evalSettings;
 
 /**
- * @todo Get rid of global setttings variables
+ * @todo Get rid of global settings variables
  */
 extern flake::Settings flakeSettings;
 
@@ -55,10 +58,23 @@ struct MixEvalArgs : virtual Args, virtual MixRepair
     std::optional<std::string> evalStoreUrl;
 
 private:
-    struct AutoArgExpr { std::string expr; };
-    struct AutoArgString { std::string s; };
-    struct AutoArgFile { std::filesystem::path path; };
-    struct AutoArgStdin { };
+    struct AutoArgExpr
+    {
+        std::string expr;
+    };
+
+    struct AutoArgString
+    {
+        std::string s;
+    };
+
+    struct AutoArgFile
+    {
+        std::filesystem::path path;
+    };
+
+    struct AutoArgStdin
+    {};
 
     using AutoArg = std::variant<AutoArgExpr, AutoArgString, AutoArgFile, AutoArgStdin>;
 
@@ -70,4 +86,4 @@ private:
  */
 SourcePath lookupFileArg(EvalState & state, std::string_view s, const Path * baseDir = nullptr);
 
-}
+} // namespace nix

src/libcmd/include/nix/cmd/compatibility-settings.hh

@@ -33,4 +33,4 @@ struct CompatibilitySettings : public Config
     )"};
 };
 
-};
+}; // namespace nix

src/libcmd/include/nix/cmd/editor-for.hh

@@ -12,4 +12,4 @@ namespace nix {
  */
 Strings editorFor(const SourcePath & file, uint32_t line);
 
-}
+} // namespace nix

src/libcmd/include/nix/cmd/installable-attr-path.hh

@@ -39,7 +39,10 @@ class InstallableAttrPath : public InstallableValue
         const std::string & attrPath,
         ExtendedOutputsSpec extendedOutputsSpec);
 
-    std::string what() const override { return attrPath; };
+    std::string what() const override
+    {
+        return attrPath;
+    };
 
     std::pair<Value *, PosIdx> toValue(EvalState & state) override;
 
@@ -55,4 +58,4 @@ public:
         ExtendedOutputsSpec extendedOutputsSpec);
 };
 
-}
+} // namespace nix

src/libcmd/include/nix/cmd/installable-derived-path.hh

@@ -11,8 +11,10 @@ struct InstallableDerivedPath : Installable
     DerivedPath derivedPath;
 
     InstallableDerivedPath(ref<Store> store, DerivedPath && derivedPath)
-        : store(store), derivedPath(std::move(derivedPath))
-    { }
+        : store(store)
+        , derivedPath(std::move(derivedPath))
+    {
+    }
 
     std::string what() const override;
 
@@ -20,10 +22,8 @@ struct InstallableDerivedPath : Installable
 
     std::optional<StorePath> getStorePath() override;
 
-    static InstallableDerivedPath parse(
-        ref<Store> store,
-        std::string_view prefix,
-        ExtendedOutputsSpec extendedOutputsSpec);
+    static InstallableDerivedPath
+    parse(ref<Store> store, std::string_view prefix, ExtendedOutputsSpec extendedOutputsSpec);
 };
 
-}
+} // namespace nix

src/libcmd/include/nix/cmd/installable-flake.hh

@@ -18,7 +18,8 @@ struct ExtraPathInfoFlake : ExtraPathInfoValue
     /**
      * Extra struct to get around C++ designated initializer limitations
      */
-    struct Flake {
+    struct Flake
+    {
         FlakeRef originalRef;
         FlakeRef lockedRef;
     };
@@ -26,8 +27,10 @@ struct ExtraPathInfoFlake : ExtraPathInfoValue
     Flake flake;
 
     ExtraPathInfoFlake(Value && v, Flake && f)
-        : ExtraPathInfoValue(std::move(v)), flake(std::move(f))
-    { }
+        : ExtraPathInfoValue(std::move(v))
+        , flake(std::move(f))
+    {
+    }
 };
 
 struct InstallableFlake : InstallableValue
@@ -49,7 +52,10 @@ struct InstallableFlake : InstallableValue
         Strings prefixes,
         const flake::LockFlags & lockFlags);
 
-    std::string what() const override { return flakeRef.to_string() + "#" + *attrPaths.begin(); }
+    std::string what() const override
+    {
+        return flakeRef.to_string() + "#" + *attrPaths.begin();
+    }
 
     std::vector<std::string> getActualAttrPaths();
 
@@ -61,8 +67,7 @@ struct InstallableFlake : InstallableValue
      * Get a cursor to every attrpath in getActualAttrPaths() that
      * exists. However if none exists, throw an exception.
      */
-    std::vector<ref<eval_cache::AttrCursor>>
-    getCursors(EvalState & state) override;
+    std::vector<ref<eval_cache::AttrCursor>> getCursors(EvalState & state) override;
 
     std::shared_ptr<flake::LockedFlake> getLockedFlake() const;
 
@@ -79,11 +84,9 @@ struct InstallableFlake : InstallableValue
  */
 static inline FlakeRef defaultNixpkgsFlakeRef()
 {
-    return FlakeRef::fromAttrs(fetchSettings, {{"type","indirect"}, {"id", "nixpkgs"}});
+    return FlakeRef::fromAttrs(fetchSettings, {{"type", "indirect"}, {"id", "nixpkgs"}});
 }
 
-ref<eval_cache::EvalCache> openEvalCache(
-    EvalState & state,
-    std::shared_ptr<flake::LockedFlake> lockedFlake);
+ref<eval_cache::EvalCache> openEvalCache(EvalState & state, std::shared_ptr<flake::LockedFlake> lockedFlake);
 
-}
+} // namespace nix

src/libcmd/include/nix/cmd/installable-value.hh

@@ -9,7 +9,10 @@ namespace nix {
 struct PackageInfo;
 struct SourceExprCommand;
 
-namespace eval_cache { class EvalCache; class AttrCursor; }
+namespace eval_cache {
+class EvalCache;
+class AttrCursor;
+} // namespace eval_cache
 
 struct App
 {
@@ -37,7 +40,8 @@ struct ExtraPathInfoValue : ExtraPathInfo
     /**
      * Extra struct to get around C++ designated initializer limitations
      */
-    struct Value {
+    struct Value
+    {
         /**
          * An optional priority for use with "build envs". See Package
          */
@@ -61,7 +65,8 @@ struct ExtraPathInfoValue : ExtraPathInfo
 
     ExtraPathInfoValue(Value && v)
         : value(std::move(v))
-    { }
+    {
+    }
 
     virtual ~ExtraPathInfoValue() = default;
 };
@@ -74,9 +79,12 @@ struct InstallableValue : Installable
 {
     ref<EvalState> state;
 
-    InstallableValue(ref<EvalState> state) : state(state) {}
+    InstallableValue(ref<EvalState> state)
+        : state(state)
+    {
+    }
 
-    virtual ~InstallableValue() { }
+    virtual ~InstallableValue() {}
 
     virtual std::pair<Value *, PosIdx> toValue(EvalState & state) = 0;
 
@@ -85,15 +93,13 @@ struct InstallableValue : Installable
      * However if none exists, throw exception instead of returning
      * empty vector.
      */
-    virtual std::vector<ref<eval_cache::AttrCursor>>
-    getCursors(EvalState & state);
+    virtual std::vector<ref<eval_cache::AttrCursor>> getCursors(EvalState & state);
 
     /**
      * Get the first and most preferred cursor this Installable could
      * refer to, or throw an exception if none exists.
      */
-    virtual ref<eval_cache::AttrCursor>
-    getCursor(EvalState & state);
+    virtual ref<eval_cache::AttrCursor> getCursor(EvalState & state);
 
     UnresolvedApp toApp(EvalState & state);
 
@@ -116,7 +122,8 @@ protected:
      * @result A derived path (with empty info, for now) if the value
      * matched the above criteria.
      */
-    std::optional<DerivedPathWithInfo> trySinglePathToDerivedPaths(Value & v, const PosIdx pos, std::string_view errorCtx);
+    std::optional<DerivedPathWithInfo>
+    trySinglePathToDerivedPaths(Value & v, const PosIdx pos, std::string_view errorCtx);
 };
 
-}
+} // namespace nix

src/libcmd/include/nix/cmd/installables.hh

@@ -112,7 +112,7 @@ typedef std::vector<ref<Installable>> Installables;
  */
 struct Installable
 {
-    virtual ~Installable() { }
+    virtual ~Installable() {}
 
     /**
      * What Installable is this?
@@ -168,37 +168,19 @@ struct Installable
         BuildMode bMode = bmNormal);
 
     static std::set<StorePath> toStorePathSet(
-        ref<Store> evalStore,
-        ref<Store> store,
-        Realise mode,
-        OperateOn operateOn,
-        const Installables & installables);
+        ref<Store> evalStore, ref<Store> store, Realise mode, OperateOn operateOn, const Installables & installables);
 
     static std::vector<StorePath> toStorePaths(
-        ref<Store> evalStore,
-        ref<Store> store,
-        Realise mode,
-        OperateOn operateOn,
-        const Installables & installables);
+        ref<Store> evalStore, ref<Store> store, Realise mode, OperateOn operateOn, const Installables & installables);
 
     static StorePath toStorePath(
-        ref<Store> evalStore,
-        ref<Store> store,
-        Realise mode,
-        OperateOn operateOn,
-        ref<Installable> installable);
+        ref<Store> evalStore, ref<Store> store, Realise mode, OperateOn operateOn, ref<Installable> installable);
 
-    static std::set<StorePath> toDerivations(
-        ref<Store> store,
-        const Installables & installables,
-        bool useDeriver = false);
+    static std::set<StorePath>
+    toDerivations(ref<Store> store, const Installables & installables, bool useDeriver = false);
 
     static BuiltPaths toBuiltPaths(
-        ref<Store> evalStore,
-        ref<Store> store,
-        Realise mode,
-        OperateOn operateOn,
-        const Installables & installables);
+        ref<Store> evalStore, ref<Store> store, Realise mode, OperateOn operateOn, const Installables & installables);
 };
 
-}
+} // namespace nix

src/libcmd/include/nix/cmd/legacy.hh

@@ -7,13 +7,14 @@
 
 namespace nix {
 
-typedef std::function<void(int, char * *)> MainFunction;
+typedef std::function<void(int, char **)> MainFunction;
 
 struct RegisterLegacyCommand
 {
     typedef std::map<std::string, MainFunction> Commands;
 
-    static Commands & commands() {
+    static Commands & commands()
+    {
         static Commands commands;
         return commands;
     }
@@ -24,4 +25,4 @@ struct RegisterLegacyCommand
     }
 };
 
-}
+} // namespace nix

src/libcmd/include/nix/cmd/markdown.hh

@@ -14,4 +14,4 @@ namespace nix {
  */
 std::string renderMarkdownToTerminal(std::string_view markdown);
 
-}
+} // namespace nix

src/libcmd/include/nix/cmd/misc-store-flags.hh

@@ -4,18 +4,22 @@
 namespace nix::flag {
 
 Args::Flag hashAlgo(std::string && longName, HashAlgorithm * ha);
+
 static inline Args::Flag hashAlgo(HashAlgorithm * ha)
 {
     return hashAlgo("hash-algo", ha);
 }
+
 Args::Flag hashAlgoOpt(std::string && longName, std::optional<HashAlgorithm> * oha);
 Args::Flag hashFormatWithDefault(std::string && longName, HashFormat * hf);
 Args::Flag hashFormatOpt(std::string && longName, std::optional<HashFormat> * ohf);
+
 static inline Args::Flag hashAlgoOpt(std::optional<HashAlgorithm> * oha)
 {
     return hashAlgoOpt("hash-algo", oha);
 }
+
 Args::Flag fileIngestionMethod(FileIngestionMethod * method);
 Args::Flag contentAddressMethod(ContentAddressMethod * method);
 
-}
+} // namespace nix::flag

src/libcmd/include/nix/cmd/network-proxy.hh

@@ -19,4 +19,4 @@ extern const StringSet networkProxyVariables;
  */
 bool haveNetworkProxyConnection();
 
-}
+} // namespace nix

src/libcmd/include/nix/cmd/repl-interacter.hh

@@ -11,10 +11,11 @@ namespace nix {
 namespace detail {
 /** Provides the completion hooks for the repl, without exposing its complete
  * internals. */
-struct ReplCompleterMixin {
+struct ReplCompleterMixin
+{
     virtual StringSet completePrefix(const std::string & prefix) = 0;
 };
-};
+}; // namespace detail
 
 enum class ReplPromptType {
     ReplPrompt,
@@ -29,7 +30,7 @@ public:
     virtual Guard init(detail::ReplCompleterMixin * repl) = 0;
     /** Returns a boolean of whether the interacter got EOF */
     virtual bool getLine(std::string & input, ReplPromptType promptType) = 0;
-    virtual ~ReplInteracter(){};
+    virtual ~ReplInteracter() {};
 };
 
 class ReadlineLikeInteracter : public virtual ReplInteracter
@@ -40,9 +41,10 @@ public:
         : historyFile(historyFile)
     {
     }
+
     virtual Guard init(detail::ReplCompleterMixin * repl) override;
     virtual bool getLine(std::string & input, ReplPromptType promptType) override;
     virtual ~ReadlineLikeInteracter() override;
 };
 
-};
+}; // namespace nix

src/libcmd/include/nix/cmd/repl.hh

@@ -12,12 +12,12 @@ struct AbstractNixRepl
 
     AbstractNixRepl(ref<EvalState> state)
         : state(state)
-    { }
+    {
+    }
 
-    virtual ~AbstractNixRepl()
-    { }
+    virtual ~AbstractNixRepl() {}
 
-    typedef std::vector<std::pair<Value*,std::string>> AnnotatedValues;
+    typedef std::vector<std::pair<Value *, std::string>> AnnotatedValues;
 
     using RunNix = void(Path program, const Strings & args, const std::optional<std::string> & input);
 
@@ -33,13 +33,11 @@ struct AbstractNixRepl
         std::function<AnnotatedValues()> getValues,
         RunNix * runNix = nullptr);
 
-    static ReplExitStatus runSimple(
-        ref<EvalState> evalState,
-        const ValMap & extraEnv);
+    static ReplExitStatus runSimple(ref<EvalState> evalState, const ValMap & extraEnv);
 
     virtual void initEnv() = 0;
 
     virtual ReplExitStatus mainLoop() = 0;
 };
 
-}
+} // namespace nix

src/libcmd/installable-attr-path.cc

@@ -35,7 +35,8 @@ InstallableAttrPath::InstallableAttrPath(
     , v(allocRootValue(v))
     , attrPath(attrPath)
     , extendedOutputsSpec(std::move(extendedOutputsSpec))
-{ }
+{
+}
 
 std::pair<Value *, PosIdx> InstallableAttrPath::toValue(EvalState & state)
 {
@@ -48,12 +49,9 @@ DerivedPathsWithInfo InstallableAttrPath::toDerivedPaths()
 {
     auto [v, pos] = toValue(*state);
 
-    if (std::optional derivedPathWithInfo = trySinglePathToDerivedPaths(
-        *v,
-        pos,
-        fmt("while evaluating the attribute '%s'", attrPath)))
-    {
-        return { *derivedPathWithInfo };
+    if (std::optional derivedPathWithInfo =
+            trySinglePathToDerivedPaths(*v, pos, fmt("while evaluating the attribute '%s'", attrPath))) {
+        return {*derivedPathWithInfo};
     }
 
     Bindings & autoArgs = *cmd.getAutoArgs(*state);
@@ -70,19 +68,19 @@ DerivedPathsWithInfo InstallableAttrPath::toDerivedPaths()
         if (!drvPath)
             throw Error("'%s' is not a derivation", what());
 
-        auto newOutputs = std::visit(overloaded {
-            [&](const ExtendedOutputsSpec::Default & d) -> OutputsSpec {
-                StringSet outputsToInstall;
-                for (auto & output : packageInfo.queryOutputs(false, true))
-                    outputsToInstall.insert(output.first);
-                if (outputsToInstall.empty())
-                    outputsToInstall.insert("out");
-                return OutputsSpec::Names { std::move(outputsToInstall) };
+        auto newOutputs = std::visit(
+            overloaded{
+                [&](const ExtendedOutputsSpec::Default & d) -> OutputsSpec {
+                    StringSet outputsToInstall;
+                    for (auto & output : packageInfo.queryOutputs(false, true))
+                        outputsToInstall.insert(output.first);
+                    if (outputsToInstall.empty())
+                        outputsToInstall.insert("out");
+                    return OutputsSpec::Names{std::move(outputsToInstall)};
+                },
+                [&](const ExtendedOutputsSpec::Explicit & e) -> OutputsSpec { return e; },
             },
-            [&](const ExtendedOutputsSpec::Explicit & e) -> OutputsSpec {
-                return e;
-            },
-        }, extendedOutputsSpec.raw);
+            extendedOutputsSpec.raw);
 
         auto [iter, didInsert] = byDrvPath.emplace(*drvPath, newOutputs);
 
@@ -93,11 +91,12 @@ DerivedPathsWithInfo InstallableAttrPath::toDerivedPaths()
     DerivedPathsWithInfo res;
     for (auto & [drvPath, outputs] : byDrvPath)
         res.push_back({
-            .path = DerivedPath::Built {
-                .drvPath = makeConstantStorePathRef(drvPath),
-                .outputs = outputs,
-            },
-            .info = make_ref<ExtraPathInfoValue>(ExtraPathInfoValue::Value {
+            .path =
+                DerivedPath::Built{
+                    .drvPath = makeConstantStorePathRef(drvPath),
+                    .outputs = outputs,
+                },
+            .info = make_ref<ExtraPathInfoValue>(ExtraPathInfoValue::Value{
                 .extendedOutputsSpec = outputs,
                 /* FIXME: reconsider backwards compatibility above
                    so we can fill in this info. */
@@ -115,10 +114,12 @@ InstallableAttrPath InstallableAttrPath::parse(
     ExtendedOutputsSpec extendedOutputsSpec)
 {
     return {
-        state, cmd, v,
-        prefix == "." ? "" : std::string { prefix },
+        state,
+        cmd,
+        v,
+        prefix == "." ? "" : std::string{prefix},
         std::move(extendedOutputsSpec),
     };
 }
 
-}
+} // namespace nix

src/libcmd/installable-derived-path.cc

@@ -21,35 +21,35 @@ std::optional<StorePath> InstallableDerivedPath::getStorePath()
     return derivedPath.getBaseStorePath();
 }
 
-InstallableDerivedPath InstallableDerivedPath::parse(
-    ref<Store> store,
-    std::string_view prefix,
-    ExtendedOutputsSpec extendedOutputsSpec)
+InstallableDerivedPath
+InstallableDerivedPath::parse(ref<Store> store, std::string_view prefix, ExtendedOutputsSpec extendedOutputsSpec)
 {
-    auto derivedPath = std::visit(overloaded {
-        // If the user did not use ^, we treat the output more
-        // liberally: we accept a symlink chain or an actual
-        // store path.
-        [&](const ExtendedOutputsSpec::Default &) -> DerivedPath {
-            auto storePath = store->followLinksToStorePath(prefix);
-            return DerivedPath::Opaque {
-                .path = std::move(storePath),
-            };
+    auto derivedPath = std::visit(
+        overloaded{
+            // If the user did not use ^, we treat the output more
+            // liberally: we accept a symlink chain or an actual
+            // store path.
+            [&](const ExtendedOutputsSpec::Default &) -> DerivedPath {
+                auto storePath = store->followLinksToStorePath(prefix);
+                return DerivedPath::Opaque{
+                    .path = std::move(storePath),
+                };
+            },
+            // If the user did use ^, we just do exactly what is written.
+            [&](const ExtendedOutputsSpec::Explicit & outputSpec) -> DerivedPath {
+                auto drv = make_ref<SingleDerivedPath>(SingleDerivedPath::parse(*store, prefix));
+                drvRequireExperiment(*drv);
+                return DerivedPath::Built{
+                    .drvPath = std::move(drv),
+                    .outputs = outputSpec,
+                };
+            },
         },
-        // If the user did use ^, we just do exactly what is written.
-        [&](const ExtendedOutputsSpec::Explicit & outputSpec) -> DerivedPath {
-            auto drv = make_ref<SingleDerivedPath>(SingleDerivedPath::parse(*store, prefix));
-            drvRequireExperiment(*drv);
-            return DerivedPath::Built {
-                .drvPath = std::move(drv),
-                .outputs = outputSpec,
-            };
-        },
-    }, extendedOutputsSpec.raw);
-    return InstallableDerivedPath {
+        extendedOutputsSpec.raw);
+    return InstallableDerivedPath{
         store,
         std::move(derivedPath),
     };
 }
 
-}
+} // namespace nix

src/libcmd/installable-flake.cc

@@ -28,8 +28,8 @@ namespace nix {
 std::vector<std::string> InstallableFlake::getActualAttrPaths()
 {
     std::vector<std::string> res;
-    if (attrPaths.size() == 1 && attrPaths.front().starts_with(".")){
-        attrPaths.front().erase(0,1);
+    if (attrPaths.size() == 1 && attrPaths.front().starts_with(".")) {
+        attrPaths.front().erase(0, 1);
         res.push_back(attrPaths.front());
         return res;
     }
@@ -47,8 +47,11 @@ static std::string showAttrPaths(const std::vector<std::string> & paths)
 {
     std::string s;
     for (const auto & [n, i] : enumerate(paths)) {
-        if (n > 0) s += n + 1 == paths.size() ? " or " : ", ";
-        s += '\''; s += i; s += '\'';
+        if (n > 0)
+            s += n + 1 == paths.size() ? " or " : ", ";
+        s += '\'';
+        s += i;
+        s += '\'';
     }
     return s;
 }
@@ -62,12 +65,12 @@ InstallableFlake::InstallableFlake(
     Strings attrPaths,
     Strings prefixes,
     const flake::LockFlags & lockFlags)
-    : InstallableValue(state),
-      flakeRef(flakeRef),
-      attrPaths(fragment == "" ? attrPaths : Strings{(std::string) fragment}),
-      prefixes(fragment == "" ? Strings{} : prefixes),
-      extendedOutputsSpec(std::move(extendedOutputsSpec)),
-      lockFlags(lockFlags)
+    : InstallableValue(state)
+    , flakeRef(flakeRef)
+    , attrPaths(fragment == "" ? attrPaths : Strings{(std::string) fragment})
+    , prefixes(fragment == "" ? Strings{} : prefixes)
+    , extendedOutputsSpec(std::move(extendedOutputsSpec))
+    , lockFlags(lockFlags)
 {
     if (cmd && cmd->getAutoArgs(*state)->size())
         throw UsageError("'--arg' and '--argstr' are incompatible with flakes");
@@ -87,18 +90,14 @@ DerivedPathsWithInfo InstallableFlake::toDerivedPaths()
         auto v = attr->forceValue();
 
         if (std::optional derivedPathWithInfo = trySinglePathToDerivedPaths(
-            v,
-            noPos,
-            fmt("while evaluating the flake output attribute '%s'", attrPath)))
-        {
-            return { *derivedPathWithInfo };
+                v, noPos, fmt("while evaluating the flake output attribute '%s'", attrPath))) {
+            return {*derivedPathWithInfo};
         } else {
             throw Error(
                 "expected flake output attribute '%s' to be a derivation or path but found %s: %s",
                 attrPath,
                 showType(v),
-                ValuePrinter(*this->state, v, errorPrintOptions)
-            );
+                ValuePrinter(*this->state, v, errorPrintOptions));
         }
     }
 
@@ -113,39 +112,40 @@ DerivedPathsWithInfo InstallableFlake::toDerivedPaths()
     }
 
     return {{
-        .path = DerivedPath::Built {
-            .drvPath = makeConstantStorePathRef(std::move(drvPath)),
-            .outputs = std::visit(overloaded {
-                [&](const ExtendedOutputsSpec::Default & d) -> OutputsSpec {
-                    StringSet outputsToInstall;
-                    if (auto aOutputSpecified = attr->maybeGetAttr(state->sOutputSpecified)) {
-                        if (aOutputSpecified->getBool()) {
-                            if (auto aOutputName = attr->maybeGetAttr("outputName"))
-                                outputsToInstall = { aOutputName->getString() };
-                        }
-                    } else if (auto aMeta = attr->maybeGetAttr(state->sMeta)) {
-                        if (auto aOutputsToInstall = aMeta->maybeGetAttr("outputsToInstall"))
-                            for (auto & s : aOutputsToInstall->getListOfStrings())
-                                outputsToInstall.insert(s);
-                    }
+        .path =
+            DerivedPath::Built{
+                .drvPath = makeConstantStorePathRef(std::move(drvPath)),
+                .outputs = std::visit(
+                    overloaded{
+                        [&](const ExtendedOutputsSpec::Default & d) -> OutputsSpec {
+                            StringSet outputsToInstall;
+                            if (auto aOutputSpecified = attr->maybeGetAttr(state->sOutputSpecified)) {
+                                if (aOutputSpecified->getBool()) {
+                                    if (auto aOutputName = attr->maybeGetAttr("outputName"))
+                                        outputsToInstall = {aOutputName->getString()};
+                                }
+                            } else if (auto aMeta = attr->maybeGetAttr(state->sMeta)) {
+                                if (auto aOutputsToInstall = aMeta->maybeGetAttr("outputsToInstall"))
+                                    for (auto & s : aOutputsToInstall->getListOfStrings())
+                                        outputsToInstall.insert(s);
+                            }
 
-                    if (outputsToInstall.empty())
-                        outputsToInstall.insert("out");
+                            if (outputsToInstall.empty())
+                                outputsToInstall.insert("out");
 
-                    return OutputsSpec::Names { std::move(outputsToInstall) };
-                },
-                [&](const ExtendedOutputsSpec::Explicit & e) -> OutputsSpec {
-                    return e;
-                },
-            }, extendedOutputsSpec.raw),
-        },
+                            return OutputsSpec::Names{std::move(outputsToInstall)};
+                        },
+                        [&](const ExtendedOutputsSpec::Explicit & e) -> OutputsSpec { return e; },
+                    },
+                    extendedOutputsSpec.raw),
+            },
         .info = make_ref<ExtraPathInfoFlake>(
-            ExtraPathInfoValue::Value {
+            ExtraPathInfoValue::Value{
                 .priority = priority,
                 .attrPath = attrPath,
                 .extendedOutputsSpec = extendedOutputsSpec,
             },
-            ExtraPathInfoFlake::Flake {
+            ExtraPathInfoFlake::Flake{
                 .originalRef = flakeRef,
                 .lockedRef = getLockedFlake()->flake.lockedRef,
             }),
@@ -157,8 +157,7 @@ std::pair<Value *, PosIdx> InstallableFlake::toValue(EvalState & state)
     return {&getCursor(state)->forceValue(), noPos};
 }
 
-std::vector<ref<eval_cache::AttrCursor>>
-InstallableFlake::getCursors(EvalState & state)
+std::vector<ref<eval_cache::AttrCursor>> InstallableFlake::getCursors(EvalState & state)
 {
     auto evalCache = openEvalCache(state, getLockedFlake());
 
@@ -181,11 +180,7 @@ InstallableFlake::getCursors(EvalState & state)
     }
 
     if (res.size() == 0)
-        throw Error(
-            suggestions,
-            "flake '%s' does not provide attribute %s",
-            flakeRef,
-            showAttrPaths(attrPaths));
+        throw Error(suggestions, "flake '%s' does not provide attribute %s", flakeRef, showAttrPaths(attrPaths));
 
     return res;
 }
@@ -196,8 +191,8 @@ std::shared_ptr<flake::LockedFlake> InstallableFlake::getLockedFlake() const
         flake::LockFlags lockFlagsApplyConfig = lockFlags;
         // FIXME why this side effect?
         lockFlagsApplyConfig.applyNixConfig = true;
-        _lockedFlake = std::make_shared<flake::LockedFlake>(lockFlake(
-            flakeSettings, *state, flakeRef, lockFlagsApplyConfig));
+        _lockedFlake =
+            std::make_shared<flake::LockedFlake>(lockFlake(flakeSettings, *state, flakeRef, lockFlagsApplyConfig));
     }
     return _lockedFlake;
 }
@@ -216,4 +211,4 @@ FlakeRef InstallableFlake::nixpkgsFlakeRef() const
     return defaultNixpkgsFlakeRef();
 }
 
-}
+} // namespace nix

src/libcmd/installable-value.cc

@@ -4,17 +4,14 @@
 
 namespace nix {
 
-std::vector<ref<eval_cache::AttrCursor>>
-InstallableValue::getCursors(EvalState & state)
+std::vector<ref<eval_cache::AttrCursor>> InstallableValue::getCursors(EvalState & state)
 {
     auto evalCache =
-        std::make_shared<nix::eval_cache::EvalCache>(std::nullopt, state,
-            [&]() { return toValue(state).first; });
+        std::make_shared<nix::eval_cache::EvalCache>(std::nullopt, state, [&]() { return toValue(state).first; });
     return {evalCache->getRoot()};
 }
 
-ref<eval_cache::AttrCursor>
-InstallableValue::getCursor(EvalState & state)
+ref<eval_cache::AttrCursor> InstallableValue::getCursor(EvalState & state)
 {
     /* Although getCursors should return at least one element, in case it doesn't,
        bound check to avoid an undefined behavior for vector[0] */
@@ -39,30 +36,32 @@ ref<InstallableValue> InstallableValue::require(ref<Installable> installable)
     auto castedInstallable = installable.dynamic_pointer_cast<InstallableValue>();
     if (!castedInstallable)
         throw nonValueInstallable(*installable);
-    return ref { castedInstallable };
+    return ref{castedInstallable};
 }
 
-std::optional<DerivedPathWithInfo> InstallableValue::trySinglePathToDerivedPaths(Value & v, const PosIdx pos, std::string_view errorCtx)
+std::optional<DerivedPathWithInfo>
+InstallableValue::trySinglePathToDerivedPaths(Value & v, const PosIdx pos, std::string_view errorCtx)
 {
     if (v.type() == nPath) {
-        auto storePath = fetchToStore(*state->store, v.path(), FetchMode::Copy);
+        auto storePath = fetchToStore(state->fetchSettings, *state->store, v.path(), FetchMode::Copy);
         return {{
-            .path = DerivedPath::Opaque {
-                .path = std::move(storePath),
-            },
+            .path =
+                DerivedPath::Opaque{
+                    .path = std::move(storePath),
+                },
             .info = make_ref<ExtraPathInfo>(),
         }};
     }
 
     else if (v.type() == nString) {
         return {{
-            .path = DerivedPath::fromSingle(
-                state->coerceToSingleDerivedPath(pos, v, errorCtx)),
+            .path = DerivedPath::fromSingle(state->coerceToSingleDerivedPath(pos, v, errorCtx)),
             .info = make_ref<ExtraPathInfo>(),
         }};
     }
 
-    else return std::nullopt;
+    else
+        return std::nullopt;
 }
 
-}
+} // namespace nix

src/libcmd/installables.cc

@@ -61,7 +61,8 @@ MixFlakeOptions::MixFlakeOptions()
         .category = category,
         .handler = {[&]() {
             lockFlags.recreateLockFile = true;
-            warn("'--recreate-lock-file' is deprecated and will be removed in a future version; use 'nix flake update' instead.");
+            warn(
+                "'--recreate-lock-file' is deprecated and will be removed in a future version; use 'nix flake update' instead.");
         }},
     });
 
@@ -158,9 +159,7 @@ MixFlakeOptions::MixFlakeOptions()
         .description = "Write the given lock file instead of `flake.lock` within the top-level flake.",
         .category = category,
         .labels = {"flake-lock-path"},
-        .handler = {[&](std::string lockFilePath) {
-            lockFlags.outputLockFilePath = lockFilePath;
-        }},
+        .handler = {[&](std::string lockFilePath) { lockFlags.outputLockFilePath = lockFilePath; }},
         .completer = completePath,
     });
 
@@ -175,12 +174,12 @@ MixFlakeOptions::MixFlakeOptions()
                 flakeSettings,
                 *evalState,
                 parseFlakeRef(fetchSettings, flakeRef, absPath(getCommandBaseDir())),
-                { .writeLockFile = false });
+                {.writeLockFile = false});
             for (auto & [inputName, input] : flake.lockFile.root->inputs) {
                 auto input2 = flake.lockFile.findInput({inputName}); // resolve 'follows' nodes
                 if (auto input3 = std::dynamic_pointer_cast<const flake::LockedNode>(input2)) {
                     overrideRegistry(
-                        fetchers::Input::fromAttrs(fetchSettings, {{"type","indirect"}, {"id", inputName}}),
+                        fetchers::Input::fromAttrs(fetchSettings, {{"type", "indirect"}, {"id", inputName}}),
                         input3->lockedRef.input,
                         {});
                 }
@@ -199,7 +198,7 @@ SourceExprCommand::SourceExprCommand()
         .shortName = 'f',
         .description =
             "Interpret [*installables*](@docroot@/command-ref/new-cli/nix.md#installables) as attribute paths relative to the Nix expression stored in *file*. "
-            "If *file* is the character -, then a Nix expression will be read from standard input. "
+            "If *file* is the character -, then a Nix expression is read from standard input. "
             "Implies `--impure`.",
         .category = installablesCategory,
         .labels = {"file"},
@@ -209,7 +208,8 @@ SourceExprCommand::SourceExprCommand()
 
     addFlag({
         .longName = "expr",
-        .description = "Interpret [*installables*](@docroot@/command-ref/new-cli/nix.md#installables) as attribute paths relative to the Nix expression *expr*.",
+        .description =
+            "Interpret [*installables*](@docroot@/command-ref/new-cli/nix.md#installables) as attribute paths relative to the Nix expression *expr*.",
         .category = installablesCategory,
         .labels = {"expr"},
         .handler = {&expr},
@@ -220,32 +220,26 @@ MixReadOnlyOption::MixReadOnlyOption()
 {
     addFlag({
         .longName = "read-only",
-        .description =
-            "Do not instantiate each evaluated derivation. "
-            "This improves performance, but can cause errors when accessing "
-            "store paths of derivations during evaluation.",
+        .description = "Do not instantiate each evaluated derivation. "
+                       "This improves performance, but can cause errors when accessing "
+                       "store paths of derivations during evaluation.",
         .handler = {&settings.readOnlyMode, true},
     });
 }
 
 Strings SourceExprCommand::getDefaultFlakeAttrPaths()
 {
-    return {
-        "packages." + settings.thisSystem.get() + ".default",
-        "defaultPackage." + settings.thisSystem.get()
-    };
+    return {"packages." + settings.thisSystem.get() + ".default", "defaultPackage." + settings.thisSystem.get()};
 }
 
 Strings SourceExprCommand::getDefaultFlakeAttrPathPrefixes()
 {
-    return {
-        // As a convenience, look for the attribute in
-        // 'outputs.packages'.
-        "packages." + settings.thisSystem.get() + ".",
-        // As a temporary hack until Nixpkgs is properly converted
-        // to provide a clean 'packages' set, look in 'legacyPackages'.
-        "legacyPackages." + settings.thisSystem.get() + "."
-    };
+    return {// As a convenience, look for the attribute in
+            // 'outputs.packages'.
+            "packages." + settings.thisSystem.get() + ".",
+            // As a temporary hack until Nixpkgs is properly converted
+            // to provide a clean 'packages' set, look in 'legacyPackages'.
+            "legacyPackages." + settings.thisSystem.get() + "."};
 }
 
 Args::CompleterClosure SourceExprCommand::getCompleteInstallable()
@@ -263,10 +257,7 @@ void SourceExprCommand::completeInstallable(AddCompletions & completions, std::s
 
             evalSettings.pureEval = false;
             auto state = getEvalState();
-            auto e =
-                state->parseExprFromFile(
-                    resolveExprPath(
-                        lookupFileArg(*state, *file)));
+            auto e = state->parseExprFromFile(resolveExprPath(lookupFileArg(*state, *file)));
 
             Value root;
             state->eval(e, root);
@@ -285,7 +276,7 @@ void SourceExprCommand::completeInstallable(AddCompletions & completions, std::s
             }
 
             auto [v, pos] = findAlongAttrPath(*state, prefix_, *autoArgs, root);
-            Value &v1(*v);
+            Value & v1(*v);
             state->forceValue(v1, pos);
             Value v2;
             state->autoCallFunction(*autoArgs, v1, v2);
@@ -310,7 +301,7 @@ void SourceExprCommand::completeInstallable(AddCompletions & completions, std::s
                 getDefaultFlakeAttrPaths(),
                 prefix);
         }
-    } catch (EvalError&) {
+    } catch (EvalError &) {
         // Don't want eval errors to mess-up with the completion engine, so let's just swallow them
     }
 }
@@ -334,22 +325,23 @@ void completeFlakeRefWithFragment(
 
             auto fragment = prefix.substr(hash + 1);
             std::string prefixRoot = "";
-            if (fragment.starts_with(".")){
+            if (fragment.starts_with(".")) {
                 fragment = fragment.substr(1);
                 prefixRoot = ".";
             }
             auto flakeRefS = std::string(prefix.substr(0, hash));
 
             // TODO: ideally this would use the command base directory instead of assuming ".".
-            auto flakeRef = parseFlakeRef(fetchSettings, expandTilde(flakeRefS), std::filesystem::current_path().string());
+            auto flakeRef =
+                parseFlakeRef(fetchSettings, expandTilde(flakeRefS), std::filesystem::current_path().string());
 
-            auto evalCache = openEvalCache(*evalState,
-                std::make_shared<flake::LockedFlake>(lockFlake(
-                    flakeSettings, *evalState, flakeRef, lockFlags)));
+            auto evalCache = openEvalCache(
+                *evalState,
+                std::make_shared<flake::LockedFlake>(lockFlake(flakeSettings, *evalState, flakeRef, lockFlags)));
 
             auto root = evalCache->getRoot();
 
-            if (prefixRoot == "."){
+            if (prefixRoot == ".") {
                 attrPathPrefixes.clear();
             }
             /* Complete 'fragment' relative to all the
@@ -369,7 +361,8 @@ void completeFlakeRefWithFragment(
                 }
 
                 auto attr = root->findAlongAttrPath(attrPath);
-                if (!attr) continue;
+                if (!attr)
+                    continue;
 
                 for (auto & attr2 : (*attr)->getAttrs()) {
                     if (hasPrefix(evalState->symbols[attr2], lastAttr)) {
@@ -377,7 +370,9 @@ void completeFlakeRefWithFragment(
                         /* Strip the attrpath prefix. */
                         attrPath2.erase(attrPath2.begin(), attrPath2.begin() + attrPathPrefix.size());
                         // FIXME: handle names with dots
-                        completions.add(flakeRefS + "#" + prefixRoot + concatStringsSep(".", evalState->symbols.resolve(attrPath2)));
+                        completions.add(
+                            flakeRefS + "#" + prefixRoot
+                            + concatStringsSep(".", evalState->symbols.resolve(attrPath2)));
                     }
                 }
             }
@@ -387,7 +382,8 @@ void completeFlakeRefWithFragment(
             if (fragment.empty()) {
                 for (auto & attrPath : defaultFlakeAttrPaths) {
                     auto attr = root->findAlongAttrPath(parseAttrPath(*evalState, attrPath));
-                    if (!attr) continue;
+                    if (!attr)
+                        continue;
                     completions.add(flakeRefS + "#" + prefixRoot);
                 }
             }
@@ -427,14 +423,12 @@ DerivedPathWithInfo Installable::toDerivedPath()
 {
     auto buildables = toDerivedPaths();
     if (buildables.size() != 1)
-        throw Error("installable '%s' evaluates to %d derivations, where only one is expected", what(), buildables.size());
+        throw Error(
+            "installable '%s' evaluates to %d derivations, where only one is expected", what(), buildables.size());
     return std::move(buildables[0]);
 }
 
-static StorePath getDeriver(
-    ref<Store> store,
-    const Installable & i,
-    const StorePath & drvPath)
+static StorePath getDeriver(ref<Store> store, const Installable & i, const StorePath & drvPath)
 {
     auto derivers = store->queryValidDerivers(drvPath);
     if (derivers.empty())
@@ -443,35 +437,35 @@ static StorePath getDeriver(
     return *derivers.begin();
 }
 
-ref<eval_cache::EvalCache> openEvalCache(
-    EvalState & state,
-    std::shared_ptr<flake::LockedFlake> lockedFlake)
+ref<eval_cache::EvalCache> openEvalCache(EvalState & state, std::shared_ptr<flake::LockedFlake> lockedFlake)
 {
     auto fingerprint = evalSettings.useEvalCache && evalSettings.pureEval
-        ? lockedFlake->getFingerprint(state.store, state.fetchSettings)
-        : std::nullopt;
-    auto rootLoader = [&state, lockedFlake]()
-        {
-            /* For testing whether the evaluation cache is
-               complete. */
-            if (getEnv("NIX_ALLOW_EVAL").value_or("1") == "0")
-                throw Error("not everything is cached, but evaluation is not allowed");
+                           ? lockedFlake->getFingerprint(state.store, state.fetchSettings)
+                           : std::nullopt;
+    auto rootLoader = [&state, lockedFlake]() {
+        /* For testing whether the evaluation cache is
+           complete. */
+        if (getEnv("NIX_ALLOW_EVAL").value_or("1") == "0")
+            throw Error("not everything is cached, but evaluation is not allowed");
 
-            auto vFlake = state.allocValue();
-            flake::callFlake(state, *lockedFlake, *vFlake);
+        auto vFlake = state.allocValue();
+        flake::callFlake(state, *lockedFlake, *vFlake);
 
-            state.forceAttrs(*vFlake, noPos, "while parsing cached flake data");
+        state.forceAttrs(*vFlake, noPos, "while parsing cached flake data");
 
-            auto aOutputs = vFlake->attrs()->get(state.symbols.create("outputs"));
-            assert(aOutputs);
+        auto aOutputs = vFlake->attrs()->get(state.symbols.create("outputs"));
+        assert(aOutputs);
 
-            return aOutputs->value;
-        };
+        return aOutputs->value;
+    };
 
     if (fingerprint) {
         auto search = state.evalCaches.find(fingerprint.value());
         if (search == state.evalCaches.end()) {
-            search = state.evalCaches.emplace(fingerprint.value(), make_ref<nix::eval_cache::EvalCache>(fingerprint, state, rootLoader)).first;
+            search =
+                state.evalCaches
+                    .emplace(fingerprint.value(), make_ref<nix::eval_cache::EvalCache>(fingerprint, state, rootLoader))
+                    .first;
         }
         return search->second;
     } else {
@@ -479,8 +473,7 @@ ref<eval_cache::EvalCache> openEvalCache(
     }
 }
 
-Installables SourceExprCommand::parseInstallables(
-    ref<Store> store, std::vector<std::string> ss)
+Installables SourceExprCommand::parseInstallables(ref<Store> store, std::vector<std::string> ss)
 {
     Installables result;
 
@@ -501,12 +494,10 @@ Installables SourceExprCommand::parseInstallables(
         if (file == "-") {
             auto e = state->parseStdin();
             state->eval(e, *vFile);
-        }
-        else if (file) {
+        } else if (file) {
             auto dir = absPath(getCommandBaseDir());
             state->evalFile(lookupFileArg(*state, *file, &dir), *vFile);
-        }
-        else {
+        } else {
             Path dir = absPath(getCommandBaseDir());
             auto e = state->parseExprFromString(*expr, state->rootPath(dir));
             state->eval(e, *vFile);
@@ -515,9 +506,8 @@ Installables SourceExprCommand::parseInstallables(
         for (auto & s : ss) {
             auto [prefix, extendedOutputsSpec] = ExtendedOutputsSpec::parse(s);
             result.push_back(
-                make_ref<InstallableAttrPath>(
-                    InstallableAttrPath::parse(
-                        state, *this, vFile, std::move(prefix), std::move(extendedOutputsSpec))));
+                make_ref<InstallableAttrPath>(InstallableAttrPath::parse(
+                    state, *this, vFile, std::move(prefix), std::move(extendedOutputsSpec))));
         }
 
     } else {
@@ -532,8 +522,9 @@ Installables SourceExprCommand::parseInstallables(
 
             if (prefix.find('/') != std::string::npos) {
                 try {
-                    result.push_back(make_ref<InstallableDerivedPath>(
-                        InstallableDerivedPath::parse(store, prefix, extendedOutputsSpec.raw)));
+                    result.push_back(
+                        make_ref<InstallableDerivedPath>(
+                            InstallableDerivedPath::parse(store, prefix, extendedOutputsSpec.raw)));
                     continue;
                 } catch (BadStorePath &) {
                 } catch (...) {
@@ -543,9 +534,10 @@ Installables SourceExprCommand::parseInstallables(
             }
 
             try {
-                auto [flakeRef, fragment] = parseFlakeRefWithFragment(
-                    fetchSettings, std::string { prefix }, absPath(getCommandBaseDir()));
-                result.push_back(make_ref<InstallableFlake>(
+                auto [flakeRef, fragment] =
+                    parseFlakeRefWithFragment(fetchSettings, std::string{prefix}, absPath(getCommandBaseDir()));
+                result.push_back(
+                    make_ref<InstallableFlake>(
                         this,
                         getEvalState(),
                         std::move(flakeRef),
@@ -566,8 +558,7 @@ Installables SourceExprCommand::parseInstallables(
     return result;
 }
 
-ref<Installable> SourceExprCommand::parseInstallable(
-    ref<Store> store, const std::string & installable)
+ref<Installable> SourceExprCommand::parseInstallable(ref<Store> store, const std::string & installable)
 {
     auto installables = parseInstallables(store, {installable});
     assert(installables.size() == 1);
@@ -578,20 +569,18 @@ static SingleBuiltPath getBuiltPath(ref<Store> evalStore, ref<Store> store, cons
 {
     return std::visit(
         overloaded{
-            [&](const SingleDerivedPath::Opaque & bo) -> SingleBuiltPath {
-                return SingleBuiltPath::Opaque { bo.path };
-            },
+            [&](const SingleDerivedPath::Opaque & bo) -> SingleBuiltPath { return SingleBuiltPath::Opaque{bo.path}; },
             [&](const SingleDerivedPath::Built & bfd) -> SingleBuiltPath {
                 auto drvPath = getBuiltPath(evalStore, store, *bfd.drvPath);
                 // Resolving this instead of `bfd` will yield the same result, but avoid duplicative work.
-                SingleDerivedPath::Built truncatedBfd {
+                SingleDerivedPath::Built truncatedBfd{
                     .drvPath = makeConstantStorePathRef(drvPath.outPath()),
                     .output = bfd.output,
                 };
                 auto outputPath = resolveDerivedPath(*store, truncatedBfd, &*evalStore);
-                return SingleBuiltPath::Built {
+                return SingleBuiltPath::Built{
                     .drvPath = make_ref<SingleBuiltPath>(std::move(drvPath)),
-                    .output = { bfd.output, outputPath },
+                    .output = {bfd.output, outputPath},
                 };
             },
         },
@@ -599,11 +588,7 @@ static SingleBuiltPath getBuiltPath(ref<Store> evalStore, ref<Store> store, cons
 }
 
 std::vector<BuiltPathWithResult> Installable::build(
-    ref<Store> evalStore,
-    ref<Store> store,
-    Realise mode,
-    const Installables & installables,
-    BuildMode bMode)
+    ref<Store> evalStore, ref<Store> store, Realise mode, const Installables & installables, BuildMode bMode)
 {
     std::vector<BuiltPathWithResult> res;
     for (auto & [_, builtPathWithResult] : build2(evalStore, store, mode, installables, bMode))
@@ -611,9 +596,7 @@ std::vector<BuiltPathWithResult> Installable::build(
     return res;
 }
 
-static void throwBuildErrors(
-    std::vector<KeyedBuildResult> & buildResults,
-    const Store & store)
+static void throwBuildErrors(std::vector<KeyedBuildResult> & buildResults, const Store & store)
 {
     std::vector<KeyedBuildResult> failed;
     for (auto & buildResult : buildResults) {
@@ -630,10 +613,11 @@ static void throwBuildErrors(
             StringSet failedPaths;
             for (; failedResult != failed.end(); failedResult++) {
                 if (!failedResult->errorMsg.empty()) {
-                    logError(ErrorInfo{
-                        .level = lvlError,
-                        .msg = failedResult->errorMsg,
-                    });
+                    logError(
+                        ErrorInfo{
+                            .level = lvlError,
+                            .msg = failedResult->errorMsg,
+                        });
                 }
                 failedPaths.insert(failedResult->path.to_string(store));
             }
@@ -643,11 +627,7 @@ static void throwBuildErrors(
 }
 
 std::vector<std::pair<ref<Installable>, BuiltPathWithResult>> Installable::build2(
-    ref<Store> evalStore,
-    ref<Store> store,
-    Realise mode,
-    const Installables & installables,
-    BuildMode bMode)
+    ref<Store> evalStore, ref<Store> store, Realise mode, const Installables & installables, BuildMode bMode)
 {
     if (mode == Realise::Nothing)
         settings.readOnlyMode = true;
@@ -678,22 +658,25 @@ std::vector<std::pair<ref<Installable>, BuiltPathWithResult>> Installable::build
 
         for (auto & path : pathsToBuild) {
             for (auto & aux : backmap[path]) {
-                std::visit(overloaded {
-                    [&](const DerivedPath::Built & bfd) {
-                        auto outputs = resolveDerivedPath(*store, bfd, &*evalStore);
-                        res.push_back({aux.installable, {
-                            .path = BuiltPath::Built {
-                                .drvPath = make_ref<SingleBuiltPath>(getBuiltPath(evalStore, store, *bfd.drvPath)),
-                                .outputs = outputs,
-                             },
-                            .info = aux.info}});
+                std::visit(
+                    overloaded{
+                        [&](const DerivedPath::Built & bfd) {
+                            auto outputs = resolveDerivedPath(*store, bfd, &*evalStore);
+                            res.push_back(
+                                {aux.installable,
+                                 {.path =
+                                      BuiltPath::Built{
+                                          .drvPath =
+                                              make_ref<SingleBuiltPath>(getBuiltPath(evalStore, store, *bfd.drvPath)),
+                                          .outputs = outputs,
+                                      },
+                                  .info = aux.info}});
+                        },
+                        [&](const DerivedPath::Opaque & bo) {
+                            res.push_back({aux.installable, {.path = BuiltPath::Opaque{bo.path}, .info = aux.info}});
+                        },
                     },
-                    [&](const DerivedPath::Opaque & bo) {
-                        res.push_back({aux.installable, {
-                            .path = BuiltPath::Opaque { bo.path },
-                            .info = aux.info}});
-                    },
-                }, path.raw());
+                    path.raw());
             }
         }
 
@@ -707,26 +690,30 @@ std::vector<std::pair<ref<Installable>, BuiltPathWithResult>> Installable::build
         throwBuildErrors(buildResults, *store);
         for (auto & buildResult : buildResults) {
             for (auto & aux : backmap[buildResult.path]) {
-                std::visit(overloaded {
-                    [&](const DerivedPath::Built & bfd) {
-                        std::map<std::string, StorePath> outputs;
-                        for (auto & [outputName, realisation] : buildResult.builtOutputs)
-                            outputs.emplace(outputName, realisation.outPath);
-                        res.push_back({aux.installable, {
-                            .path = BuiltPath::Built {
-                                .drvPath = make_ref<SingleBuiltPath>(getBuiltPath(evalStore, store, *bfd.drvPath)),
-                                .outputs = outputs,
-                            },
-                            .info = aux.info,
-                            .result = buildResult}});
+                std::visit(
+                    overloaded{
+                        [&](const DerivedPath::Built & bfd) {
+                            std::map<std::string, StorePath> outputs;
+                            for (auto & [outputName, realisation] : buildResult.builtOutputs)
+                                outputs.emplace(outputName, realisation.outPath);
+                            res.push_back(
+                                {aux.installable,
+                                 {.path =
+                                      BuiltPath::Built{
+                                          .drvPath =
+                                              make_ref<SingleBuiltPath>(getBuiltPath(evalStore, store, *bfd.drvPath)),
+                                          .outputs = outputs,
+                                      },
+                                  .info = aux.info,
+                                  .result = buildResult}});
+                        },
+                        [&](const DerivedPath::Opaque & bo) {
+                            res.push_back(
+                                {aux.installable,
+                                 {.path = BuiltPath::Opaque{bo.path}, .info = aux.info, .result = buildResult}});
+                        },
                     },
-                    [&](const DerivedPath::Opaque & bo) {
-                        res.push_back({aux.installable, {
-                            .path = BuiltPath::Opaque { bo.path },
-                            .info = aux.info,
-                            .result = buildResult}});
-                    },
-                }, buildResult.path.raw());
+                    buildResult.path.raw());
             }
         }
 
@@ -741,11 +728,7 @@ std::vector<std::pair<ref<Installable>, BuiltPathWithResult>> Installable::build
 }
 
 BuiltPaths Installable::toBuiltPaths(
-    ref<Store> evalStore,
-    ref<Store> store,
-    Realise mode,
-    OperateOn operateOn,
-    const Installables & installables)
+    ref<Store> evalStore, ref<Store> store, Realise mode, OperateOn operateOn, const Installables & installables)
 {
     if (operateOn == OperateOn::Output) {
         BuiltPaths res;
@@ -764,10 +747,7 @@ BuiltPaths Installable::toBuiltPaths(
 }
 
 StorePathSet Installable::toStorePathSet(
-    ref<Store> evalStore,
-    ref<Store> store,
-    Realise mode, OperateOn operateOn,
-    const Installables & installables)
+    ref<Store> evalStore, ref<Store> store, Realise mode, OperateOn operateOn, const Installables & installables)
 {
     StorePathSet outPaths;
     for (auto & path : toBuiltPaths(evalStore, store, mode, operateOn, installables)) {
@@ -778,10 +758,7 @@ StorePathSet Installable::toStorePathSet(
 }
 
 StorePaths Installable::toStorePaths(
-    ref<Store> evalStore,
-    ref<Store> store,
-    Realise mode, OperateOn operateOn,
-    const Installables & installables)
+    ref<Store> evalStore, ref<Store> store, Realise mode, OperateOn operateOn, const Installables & installables)
 {
     StorePaths outPaths;
     for (auto & path : toBuiltPaths(evalStore, store, mode, operateOn, installables)) {
@@ -792,10 +769,7 @@ StorePaths Installable::toStorePaths(
 }
 
 StorePath Installable::toStorePath(
-    ref<Store> evalStore,
-    ref<Store> store,
-    Realise mode, OperateOn operateOn,
-    ref<Installable> installable)
+    ref<Store> evalStore, ref<Store> store, Realise mode, OperateOn operateOn, ref<Installable> installable)
 {
     auto paths = toStorePathSet(evalStore, store, mode, operateOn, {installable});
 
@@ -805,28 +779,23 @@ StorePath Installable::toStorePath(
     return *paths.begin();
 }
 
-StorePathSet Installable::toDerivations(
-    ref<Store> store,
-    const Installables & installables,
-    bool useDeriver)
+StorePathSet Installable::toDerivations(ref<Store> store, const Installables & installables, bool useDeriver)
 {
     StorePathSet drvPaths;
 
     for (const auto & i : installables)
         for (const auto & b : i->toDerivedPaths())
-            std::visit(overloaded {
-                [&](const DerivedPath::Opaque & bo) {
-                    drvPaths.insert(
-                        bo.path.isDerivation()
-                            ? bo.path
-                        : useDeriver
-                            ? getDeriver(store, *i, bo.path)
-                        : throw Error("argument '%s' did not evaluate to a derivation", i->what()));
+            std::visit(
+                overloaded{
+                    [&](const DerivedPath::Opaque & bo) {
+                        drvPaths.insert(
+                            bo.path.isDerivation() ? bo.path
+                            : useDeriver           ? getDeriver(store, *i, bo.path)
+                                         : throw Error("argument '%s' did not evaluate to a derivation", i->what()));
+                    },
+                    [&](const DerivedPath::Built & bfd) { drvPaths.insert(resolveDerivedPath(*store, *bfd.drvPath)); },
                 },
-                [&](const DerivedPath::Built & bfd) {
-                    drvPaths.insert(resolveDerivedPath(*store, *bfd.drvPath));
-                },
-            }, b.path.raw());
+                b.path.raw());
 
     return drvPaths;
 }
@@ -849,7 +818,7 @@ RawInstallablesCommand::RawInstallablesCommand()
 void RawInstallablesCommand::applyDefaultInstallables(std::vector<std::string> & rawInstallables)
 {
     if (rawInstallables.empty()) {
-        // FIXME: commands like "nix profile install" should not have a
+        // FIXME: commands like "nix profile add" should not have a
         // default, probably.
         rawInstallables.push_back(".");
     }
@@ -861,10 +830,7 @@ std::vector<FlakeRef> RawInstallablesCommand::getFlakeRefsForCompletion()
     std::vector<FlakeRef> res;
     res.reserve(rawInstallables.size());
     for (const auto & i : rawInstallables)
-        res.push_back(parseFlakeRefWithFragment(
-            fetchSettings,
-            expandTilde(i),
-            absPath(getCommandBaseDir())).first);
+        res.push_back(parseFlakeRefWithFragment(fetchSettings, expandTilde(i), absPath(getCommandBaseDir())).first);
     return res;
 }
 
@@ -883,12 +849,7 @@ void RawInstallablesCommand::run(ref<Store> store)
 
 std::vector<FlakeRef> InstallableCommand::getFlakeRefsForCompletion()
 {
-    return {
-        parseFlakeRefWithFragment(
-            fetchSettings,
-            expandTilde(_installable),
-            absPath(getCommandBaseDir())).first
-    };
+    return {parseFlakeRefWithFragment(fetchSettings, expandTilde(_installable), absPath(getCommandBaseDir())).first};
 }
 
 void InstallablesCommand::run(ref<Store> store, std::vector<std::string> && rawInstallables)
@@ -928,4 +889,4 @@ BuiltPaths toBuiltPaths(const std::vector<BuiltPathWithResult> & builtPathsWithR
     return res;
 }
 
-}
+} // namespace nix

src/libcmd/markdown.cc

@@ -18,25 +18,24 @@ static std::string doRenderMarkdownToTerminal(std::string_view markdown)
 {
     int windowWidth = getWindowSize().second;
 
-#if HAVE_LOWDOWN_1_4
-    struct lowdown_opts_term opts_term {
+#  if HAVE_LOWDOWN_1_4
+    struct lowdown_opts_term opts_term{
         .cols = (size_t) std::max(windowWidth - 5, 60),
         .hmargin = 0,
         .vmargin = 0,
     };
-#endif
-    struct lowdown_opts opts
-    {
+#  endif
+    struct lowdown_opts opts{
         .type = LOWDOWN_TERM,
-#if HAVE_LOWDOWN_1_4
+#  if HAVE_LOWDOWN_1_4
         .term = opts_term,
-#endif
+#  endif
         .maxdepth = 20,
-#if !HAVE_LOWDOWN_1_4
+#  if !HAVE_LOWDOWN_1_4
         .cols = (size_t) std::max(windowWidth - 5, 60),
         .hmargin = 0,
         .vmargin = 0,
-#endif
+#  endif
         .feat = LOWDOWN_COMMONMARK | LOWDOWN_FENCED | LOWDOWN_DEFLIST | LOWDOWN_TABLES,
         .oflags = LOWDOWN_TERM_NOLINK,
     };

src/libcmd/misc-store-flags.cc

@@ -1,7 +1,6 @@
 #include "nix/cmd/misc-store-flags.hh"
 
-namespace nix::flag
-{
+namespace nix::flag {
 
 static void hashFormatCompleter(AddCompletions & completions, size_t index, std::string_view prefix)
 {
@@ -15,27 +14,23 @@ static void hashFormatCompleter(AddCompletions & completions, size_t index, std:
 Args::Flag hashFormatWithDefault(std::string && longName, HashFormat * hf)
 {
     assert(*hf == nix::HashFormat::SRI);
-    return Args::Flag {
-            .longName = std::move(longName),
-            .description = "Hash format (`base16`, `nix32`, `base64`, `sri`). Default: `sri`.",
-            .labels = {"hash-format"},
-            .handler = {[hf](std::string s) {
-                *hf = parseHashFormat(s);
-            }},
-            .completer = hashFormatCompleter,
+    return Args::Flag{
+        .longName = std::move(longName),
+        .description = "Hash format (`base16`, `nix32`, `base64`, `sri`). Default: `sri`.",
+        .labels = {"hash-format"},
+        .handler = {[hf](std::string s) { *hf = parseHashFormat(s); }},
+        .completer = hashFormatCompleter,
     };
 }
 
 Args::Flag hashFormatOpt(std::string && longName, std::optional<HashFormat> * ohf)
 {
-    return Args::Flag {
-            .longName = std::move(longName),
-            .description = "Hash format (`base16`, `nix32`, `base64`, `sri`).",
-            .labels = {"hash-format"},
-            .handler = {[ohf](std::string s) {
-                *ohf = std::optional<HashFormat>{parseHashFormat(s)};
-            }},
-            .completer = hashFormatCompleter,
+    return Args::Flag{
+        .longName = std::move(longName),
+        .description = "Hash format (`base16`, `nix32`, `base64`, `sri`).",
+        .labels = {"hash-format"},
+        .handler = {[ohf](std::string s) { *ohf = std::optional<HashFormat>{parseHashFormat(s)}; }},
+        .completer = hashFormatCompleter,
     };
 }
 
@@ -48,34 +43,31 @@ static void hashAlgoCompleter(AddCompletions & completions, size_t index, std::s
 
 Args::Flag hashAlgo(std::string && longName, HashAlgorithm * ha)
 {
-    return Args::Flag {
-            .longName = std::move(longName),
-            .description = "Hash algorithm (`blake3`, `md5`, `sha1`, `sha256`, or `sha512`).",
-            .labels = {"hash-algo"},
-            .handler = {[ha](std::string s) {
-                *ha = parseHashAlgo(s);
-            }},
-            .completer = hashAlgoCompleter,
+    return Args::Flag{
+        .longName = std::move(longName),
+        .description = "Hash algorithm (`blake3`, `md5`, `sha1`, `sha256`, or `sha512`).",
+        .labels = {"hash-algo"},
+        .handler = {[ha](std::string s) { *ha = parseHashAlgo(s); }},
+        .completer = hashAlgoCompleter,
     };
 }
 
 Args::Flag hashAlgoOpt(std::string && longName, std::optional<HashAlgorithm> * oha)
 {
-    return Args::Flag {
-            .longName = std::move(longName),
-            .description = "Hash algorithm (`blake3`, `md5`, `sha1`, `sha256`, or `sha512`). Can be omitted for SRI hashes.",
-            .labels = {"hash-algo"},
-            .handler = {[oha](std::string s) {
-                *oha = std::optional<HashAlgorithm>{parseHashAlgo(s)};
-            }},
-            .completer = hashAlgoCompleter,
+    return Args::Flag{
+        .longName = std::move(longName),
+        .description =
+            "Hash algorithm (`blake3`, `md5`, `sha1`, `sha256`, or `sha512`). Can be omitted for SRI hashes.",
+        .labels = {"hash-algo"},
+        .handler = {[oha](std::string s) { *oha = std::optional<HashAlgorithm>{parseHashAlgo(s)}; }},
+        .completer = hashAlgoCompleter,
     };
 }
 
 Args::Flag fileIngestionMethod(FileIngestionMethod * method)
 {
-    return Args::Flag {
-        .longName  = "mode",
+    return Args::Flag{
+        .longName = "mode",
         // FIXME indentation carefully made for context, this is messed up.
         .description = R"(
     How to compute the hash of the input.
@@ -92,16 +84,14 @@ Args::Flag fileIngestionMethod(FileIngestionMethod * method)
       it to the hash function.
         )",
         .labels = {"file-ingestion-method"},
-        .handler = {[method](std::string s) {
-            *method = parseFileIngestionMethod(s);
-        }},
+        .handler = {[method](std::string s) { *method = parseFileIngestionMethod(s); }},
     };
 }
 
 Args::Flag contentAddressMethod(ContentAddressMethod * method)
 {
-    return Args::Flag {
-        .longName  = "mode",
+    return Args::Flag{
+        .longName = "mode",
         // FIXME indentation carefully made for context, this is messed up.
         .description = R"(
     How to compute the content-address of the store object.
@@ -126,10 +116,8 @@ Args::Flag contentAddressMethod(ContentAddressMethod * method)
       for regular usage prefer `nar` and `flat`.
         )",
         .labels = {"content-address-method"},
-        .handler = {[method](std::string s) {
-            *method = ContentAddressMethod::parse(s);
-        }},
+        .handler = {[method](std::string s) { *method = ContentAddressMethod::parse(s); }},
     };
 }
 
-}
+} // namespace nix::flag

src/libcmd/network-proxy.cc

@@ -47,4 +47,4 @@ bool haveNetworkProxyConnection()
     return false;
 }
 
-}
+} // namespace nix

src/libcmd/package.nix

@@ -53,7 +53,8 @@ mkMesonLibrary (finalAttrs: {
 
   buildInputs = [
     ({ inherit editline readline; }.${readlineFlavor})
-  ] ++ lib.optional enableMarkdown lowdown;
+  ]
+  ++ lib.optional enableMarkdown lowdown;
 
   propagatedBuildInputs = [
     nix-util