Merge remote-tracking branch 'origin/master' into progress-bar

This will make it easier to add more settings to the progress bar.

.clang-format

@@ -8,7 +8,7 @@ BraceWrapping:
   AfterUnion: true
   SplitEmptyRecord: false
 PointerAlignment: Middle
-FixNamespaceComments: true
+FixNamespaceComments: false
 SortIncludes: Never
 #IndentPPDirectives: BeforeHash
 SpaceAfterCStyleCast: true
@@ -32,4 +32,3 @@ IndentPPDirectives: AfterHash
 PPIndentWidth: 2
 BinPackArguments: false
 BreakBeforeTernaryOperators: true
-SeparateDefinitionBlocks: Always

.git-blame-ignore-revs

@@ -1,2 +0,0 @@
-# bulk initial re-formatting with clang-format
-95d9c13716e0000f46f5279367fdecb5b4545923 # !autorebase ./maintainers/format.sh --until-stable

.github/CODEOWNERS

@@ -11,7 +11,16 @@
 .github/CODEOWNERS @edolstra
 
 # Documentation of built-in functions
-src/libexpr/primops.cc @roberth
+src/libexpr/primops.cc @roberth @fricklerhandwerk
+
+# Documentation of settings
+src/libexpr/eval-settings.hh @fricklerhandwerk
+src/libstore/globals.hh @fricklerhandwerk
+
+# Documentation
+doc/manual @fricklerhandwerk
+maintainers/*.md @fricklerhandwerk
+src/**/*.md @fricklerhandwerk
 
 # Libstore layer
 /src/libstore @ericson2314

.github/STALE-BOT.md

@@ -3,7 +3,7 @@
 - Thanks for your contribution!
 - To remove the stale label, just leave a new comment.
 - _How to find the right people to ping?_ → [`git blame`](https://git-scm.com/docs/git-blame) to the rescue! (or GitHub's history and blame buttons.)
-- You can always ask for help on [our Discourse Forum](https://discourse.nixos.org/) or on [Matrix - #users:nixos.org](https://matrix.to/#/#users:nixos.org).
+- You can always ask for help on [our Discourse Forum](https://discourse.nixos.org/) or on [Matrix - #nix:nixos.org](https://matrix.to/#/#nix:nixos.org).
 
 ## Suggestions for PRs
 

.github/workflows/ci.yml

@@ -7,87 +7,121 @@ on:
 permissions: read-all
 
 jobs:
-  eval:
-    runs-on: ubuntu-24.04
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-    - uses: cachix/install-nix-action@v31
-      with:
-        install_url: "https://releases.nixos.org/nix/nix-2.29.1/install"
-    - run: nix --experimental-features 'nix-command flakes' flake show --all-systems --json
 
   tests:
+    needs: [check_secrets]
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - scenario: on ubuntu
-            runs-on: ubuntu-24.04
-            os: linux
-          - scenario: on macos
-            runs-on: macos-14
-            os: darwin
-    name: tests ${{ matrix.scenario }}
-    runs-on: ${{ matrix.runs-on }}
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
     timeout-minutes: 60
     steps:
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0
-    - uses: cachix/install-nix-action@v31
+    - uses: cachix/install-nix-action@v30
       with:
-        install_url: "https://releases.nixos.org/nix/nix-2.29.1/install"
         # The sandbox would otherwise be disabled by default on Darwin
         extra_nix_config: |
           sandbox = true
           max-jobs = 1
-    - uses: DeterminateSystems/magic-nix-cache-action@main
-    # Since ubuntu 22.30, unprivileged usernamespaces are no longer allowed to map to the root user:
-    # https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces
-    - run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-      if: matrix.os == 'linux'
-    - run: scripts/build-checks
-    - run: scripts/prepare-installer-for-github-actions
-    - name: Upload installer tarball
-      uses: actions/upload-artifact@v4
+    - run: echo CACHIX_NAME="$(echo $GITHUB_REPOSITORY-install-tests | tr "[A-Z]/" "[a-z]-")" >> $GITHUB_ENV
+    - uses: cachix/cachix-action@v15
+      if: needs.check_secrets.outputs.cachix == 'true'
       with:
-        name: installer-${{matrix.os}}
-        path: out/*
+        name: '${{ env.CACHIX_NAME }}'
+        signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
+        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+    - if: matrix.os == 'ubuntu-latest'
+      run: |
+        free -h
+        swapon --show
+        swap=$(swapon --show --noheadings | head -n 1 | awk '{print $1}')
+        echo "Found swap: $swap"
+        sudo swapoff $swap
+        # resize it (fallocate)
+        sudo fallocate -l 10G $swap
+        sudo mkswap $swap
+        sudo swapon $swap
+        free -h
+        (
+          while sleep 60; do
+            free -h
+          done
+        ) &
+    - run: nix --experimental-features 'nix-command flakes' flake check -L
+    - run: nix --experimental-features 'nix-command flakes' flake show --all-systems --json
+
+  # Steps to test CI automation in your own fork.
+  # Cachix:
+  # 1. Sign-up for https://www.cachix.org/
+  # 2. Create a cache for $githubuser-nix-install-tests
+  # 3. Create a cachix auth token and save it in https://github.com/$githubuser/nix/settings/secrets/actions in "Repository secrets" as CACHIX_AUTH_TOKEN
+  # Dockerhub:
+  # 1. Sign-up for https://hub.docker.com/
+  # 2. Store your dockerhub username as DOCKERHUB_USERNAME in "Repository secrets" of your fork repository settings (https://github.com/$githubuser/nix/settings/secrets/actions)
+  # 3. Create an access token in https://hub.docker.com/settings/security and store it as DOCKERHUB_TOKEN in "Repository secrets" of your fork
+  check_secrets:
+    permissions:
+      contents: none
+    name: Check Cachix and Docker secrets present for installer tests
+    runs-on: ubuntu-latest
+    outputs:
+      cachix: ${{ steps.secret.outputs.cachix }}
+      docker: ${{ steps.secret.outputs.docker }}
+    steps:
+      - name: Check for secrets
+        id: secret
+        env:
+          _CACHIX_SECRETS: ${{ secrets.CACHIX_SIGNING_KEY }}${{ secrets.CACHIX_AUTH_TOKEN }}
+          _DOCKER_SECRETS: ${{ secrets.DOCKERHUB_USERNAME }}${{ secrets.DOCKERHUB_TOKEN }}
+        run: |
+          echo "::set-output name=cachix::${{ env._CACHIX_SECRETS != '' }}"
+          echo "::set-output name=docker::${{ env._DOCKER_SECRETS != '' }}"
+
+  installer:
+    needs: [tests, check_secrets]
+    if: github.event_name == 'push' && needs.check_secrets.outputs.cachix == 'true'
+    runs-on: ubuntu-latest
+    outputs:
+      installerURL: ${{ steps.prepare-installer.outputs.installerURL }}
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - run: echo CACHIX_NAME="$(echo $GITHUB_REPOSITORY-install-tests | tr "[A-Z]/" "[a-z]-")" >> $GITHUB_ENV
+    - uses: cachix/install-nix-action@v30
+      with:
+        install_url: https://releases.nixos.org/nix/nix-2.20.3/install
+    - uses: cachix/cachix-action@v15
+      with:
+        name: '${{ env.CACHIX_NAME }}'
+        signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
+        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+        cachixArgs: '-v'
+    - id: prepare-installer
+      run: scripts/prepare-installer-for-github-actions
 
   installer_test:
-    needs: [tests]
+    needs: [installer, check_secrets]
+    if: github.event_name == 'push' && needs.check_secrets.outputs.cachix == 'true'
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - scenario: on ubuntu
-            runs-on: ubuntu-24.04
-            os: linux
-          - scenario: on macos
-            runs-on: macos-14
-            os: darwin
-    name: installer test ${{ matrix.scenario }}
-    runs-on: ${{ matrix.runs-on }}
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
     steps:
     - uses: actions/checkout@v4
-    - name: Download installer tarball
-      uses: actions/download-artifact@v4
+    - run: echo CACHIX_NAME="$(echo $GITHUB_REPOSITORY-install-tests | tr "[A-Z]/" "[a-z]-")" >> $GITHUB_ENV
+    - uses: cachix/install-nix-action@v30
       with:
-        name: installer-${{matrix.os}}
-        path: out
-    - name: Serving installer
-      id: serving_installer
-      run: ./scripts/serve-installer-for-github-actions
-    - uses: cachix/install-nix-action@v31
-      with:
-        install_url: 'http://localhost:8126/install'
-        install_options: "--tarball-url-prefix http://localhost:8126/"
+        install_url: '${{needs.installer.outputs.installerURL}}'
+        install_options: "--tarball-url-prefix https://${{ env.CACHIX_NAME }}.cachix.org/serve"
     - run: sudo apt install fish zsh
-      if: matrix.os == 'linux'
+      if: matrix.os == 'ubuntu-latest'
     - run: brew install fish
-      if: matrix.os == 'darwin'
+      if: matrix.os == 'macos-latest'
     - run: exec bash -c "nix-instantiate -E 'builtins.currentTime' --eval"
     - run: exec sh -c "nix-instantiate -E 'builtins.currentTime' --eval"
     - run: exec zsh -c "nix-instantiate -E 'builtins.currentTime' --eval"
@@ -95,50 +129,32 @@ jobs:
     - run: exec bash -c "nix-channel --add https://releases.nixos.org/nixos/unstable/nixos-23.05pre466020.60c1d71f2ba nixpkgs"
     - run: exec bash -c "nix-channel --update && nix-env -iA nixpkgs.hello && hello"
 
-  # Steps to test CI automation in your own fork.
-  # 1. Sign-up for https://hub.docker.com/
-  # 2. Store your dockerhub username as DOCKERHUB_USERNAME in "Repository secrets" of your fork repository settings (https://github.com/$githubuser/nix/settings/secrets/actions)
-  # 3. Create an access token in https://hub.docker.com/settings/security and store it as DOCKERHUB_TOKEN in "Repository secrets" of your fork
-  check_secrets:
-    permissions:
-      contents: none
-    name: Check Docker secrets present for installer tests
-    runs-on: ubuntu-24.04
-    outputs:
-      docker: ${{ steps.secret.outputs.docker }}
-    steps:
-      - name: Check for secrets
-        id: secret
-        env:
-          _DOCKER_SECRETS: ${{ secrets.DOCKERHUB_USERNAME }}${{ secrets.DOCKERHUB_TOKEN }}
-        run: |
-          echo "::set-output name=docker::${{ env._DOCKER_SECRETS != '' }}"
-
   docker_push_image:
-    needs: [tests, vm_tests, check_secrets]
+    needs: [check_secrets, tests, vm_tests]
     permissions:
       contents: read
       packages: write
     if: >-
-      needs.check_secrets.outputs.docker == 'true' &&
       github.event_name == 'push' &&
-      github.ref_name == 'master'
-    runs-on: ubuntu-24.04
+      github.ref_name == 'master' &&
+      needs.check_secrets.outputs.cachix == 'true' &&
+      needs.check_secrets.outputs.docker == 'true'
+    runs-on: ubuntu-latest
     steps:
-    - name: Check for secrets
-      id: secret
-      env:
-        _DOCKER_SECRETS: ${{ secrets.DOCKERHUB_USERNAME }}${{ secrets.DOCKERHUB_TOKEN }}
-      run: |
-        echo "::set-output name=docker::${{ env._DOCKER_SECRETS != '' }}"
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0
-    - uses: cachix/install-nix-action@v31
+    - uses: cachix/install-nix-action@v30
       with:
         install_url: https://releases.nixos.org/nix/nix-2.20.3/install
-    - uses: DeterminateSystems/magic-nix-cache-action@main
+    - run: echo CACHIX_NAME="$(echo $GITHUB_REPOSITORY-install-tests | tr "[A-Z]/" "[a-z]-")" >> $GITHUB_ENV
     - run: echo NIX_VERSION="$(nix --experimental-features 'nix-command flakes' eval .\#nix.version | tr -d \")" >> $GITHUB_ENV
+    - uses: cachix/cachix-action@v15
+      if: needs.check_secrets.outputs.cachix == 'true'
+      with:
+        name: '${{ env.CACHIX_NAME }}'
+        signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
+        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
     - run: nix --experimental-features 'nix-command flakes' build .#dockerImage -L
     - run: docker load -i ./result/image.tar.gz
     - run: docker tag nix:$NIX_VERSION ${{ secrets.DOCKERHUB_USERNAME }}/nix:$NIX_VERSION
@@ -175,7 +191,7 @@ jobs:
         docker push $IMAGE_ID:master
 
   vm_tests:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
       - uses: DeterminateSystems/nix-installer-action@main
@@ -190,7 +206,7 @@ jobs:
 
   flake_regressions:
     needs: vm_tests
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-22.04
     steps:
       - name: Checkout nix
         uses: actions/checkout@v4

.github/workflows/labels.yml

@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   labels:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
     - uses: actions/labeler@v5

.gitignore

@@ -1,12 +1,110 @@
+Makefile.config
+perl/Makefile.config
+
+# /
+/aclocal.m4
+/autom4te.cache
+/precompiled-headers.h.gch
+/config.*
+/configure
+/stamp-h1
+/svn-revision
+/libtool
+/config/config.*
 # Default meson build dir
 /build
 
+# /doc/manual/
+/doc/manual/*.1
+/doc/manual/*.5
+/doc/manual/*.8
+/doc/manual/generated/*
+/doc/manual/nix.json
+/doc/manual/conf-file.json
+/doc/manual/language.json
+/doc/manual/xp-features.json
+/doc/manual/source/SUMMARY.md
+/doc/manual/source/SUMMARY-rl-next.md
+/doc/manual/source/store/types/*
+!/doc/manual/source/store/types/index.md.in
+/doc/manual/source/command-ref/new-cli
+/doc/manual/source/command-ref/conf-file.md
+/doc/manual/source/command-ref/experimental-features-shortlist.md
+/doc/manual/source/contributing/experimental-feature-descriptions.md
+/doc/manual/source/language/builtins.md
+/doc/manual/source/language/builtin-constants.md
+/doc/manual/source/release-notes/rl-next.md
+
+# /scripts/
+/scripts/nix-profile.sh
+/scripts/nix-profile-daemon.sh
+/scripts/nix-profile.fish
+/scripts/nix-profile-daemon.fish
+
+# /src/libexpr/
+/src/libexpr/lexer-tab.cc
+/src/libexpr/lexer-tab.hh
+/src/libexpr/parser-tab.cc
+/src/libexpr/parser-tab.hh
+/src/libexpr/parser-tab.output
+/src/libexpr/nix.tbl
+/src/libexpr/tests
+/src/libexpr-tests/libnixexpr-tests
+
+# /src/libfetchers
+/src/libfetchers-tests/libnixfetchers-tests
+
+# /src/libflake
+/src/libflake-tests/libnixflake-tests
+
+# /src/libstore/
+*.gen.*
+/src/libstore/tests
+/src/libstore-tests/libnixstore-tests
+
+# /src/libutil/
+/src/libutil/tests
+/src/libutil-tests/libnixutil-tests
+
+/src/nix/nix
+
+/src/nix/generated-doc
+
+# /src/nix-env/
+/src/nix-env/nix-env
+
+# /src/nix-instantiate/
+/src/nix-instantiate/nix-instantiate
+
+# /src/nix-store/
+/src/nix-store/nix-store
+
+/src/nix-prefetch-url/nix-prefetch-url
+
+/src/nix-collect-garbage/nix-collect-garbage
+
+# /src/nix-channel/
+/src/nix-channel/nix-channel
+
+# /src/nix-build/
+/src/nix-build/nix-build
+
+/src/nix-copy-closure/nix-copy-closure
+
+/src/error-demo/error-demo
+
+/src/build-remote/build-remote
+
 # /tests/functional/
+/tests/functional/test-tmp
 /tests/functional/common/subst-vars.sh
+/tests/functional/result*
 /tests/functional/restricted-innocent
+/tests/functional/shell
+/tests/functional/shell.drv
+/tests/functional/repl-result-out
 /tests/functional/debugger-test-out
 /tests/functional/test-libstoreconsumer/test-libstoreconsumer
-/tests/functional/nix-shell
 
 # /tests/functional/lang/
 /tests/functional/lang/*.out
@@ -14,9 +112,27 @@
 /tests/functional/lang/*.err
 /tests/functional/lang/*.ast
 
-/outputs
+/perl/lib/Nix/Config.pm
+/perl/lib/Nix/Store.cc
 
+/misc/systemd/nix-daemon.service
+/misc/systemd/nix-daemon.socket
+/misc/systemd/nix-daemon.conf
+/misc/upstart/nix-daemon.conf
+
+outputs/
+
+*.a
+*.o
+*.o.tmp
+*.so
+*.dylib
+*.dll
+*.exe
+*.dep
 *~
+*.pc
+*.plist
 
 # GNU Global
 GPATH
@@ -31,6 +147,8 @@ GTAGS
 compile_commands.json
 *.compile_commands.json
 
+nix-rust/target
+
 result
 result-*
 
@@ -45,8 +163,3 @@ result-*
 
 # Mac OS
 .DS_Store
-
-flake-regressions
-
-# direnv
-.direnv/

.mergify.yml

@@ -2,11 +2,10 @@ queue_rules:
   - name: default
     # all required tests need to go here
     merge_conditions:
-      - check-success=tests on macos
-      - check-success=tests on ubuntu
-      - check-success=installer test on macos
-      - check-success=installer test on ubuntu
+      - check-success=tests (macos-latest)
+      - check-success=tests (ubuntu-latest)
       - check-success=vm_tests
+    merge_method: rebase
     batch_size: 5
 
 pull_request_rules:
@@ -27,7 +26,6 @@ pull_request_rules:
         branches:
           - 2.18-maintenance
         labels:
-          - automatic backport
           - merge-queue
 
   - name: backport patches to 2.19
@@ -38,7 +36,6 @@ pull_request_rules:
         branches:
           - 2.19-maintenance
         labels:
-          - automatic backport
           - merge-queue
 
   - name: backport patches to 2.20
@@ -49,7 +46,6 @@ pull_request_rules:
         branches:
           - 2.20-maintenance
         labels:
-          - automatic backport
           - merge-queue
 
   - name: backport patches to 2.21
@@ -60,7 +56,6 @@ pull_request_rules:
         branches:
           - 2.21-maintenance
         labels:
-          - automatic backport
           - merge-queue
 
   - name: backport patches to 2.22
@@ -71,7 +66,6 @@ pull_request_rules:
         branches:
           - 2.22-maintenance
         labels:
-          - automatic backport
           - merge-queue
 
   - name: backport patches to 2.23
@@ -82,7 +76,6 @@ pull_request_rules:
         branches:
           - 2.23-maintenance
         labels:
-          - automatic backport
           - merge-queue
 
   - name: backport patches to 2.24
@@ -93,7 +86,6 @@ pull_request_rules:
         branches:
           - "2.24-maintenance"
         labels:
-          - automatic backport
           - merge-queue
 
   - name: backport patches to 2.25
@@ -104,49 +96,4 @@ pull_request_rules:
         branches:
           - "2.25-maintenance"
         labels:
-          - automatic backport
-          - merge-queue
-
-  - name: backport patches to 2.26
-    conditions:
-      - label=backport 2.26-maintenance
-    actions:
-      backport:
-        branches:
-          - "2.26-maintenance"
-        labels:
-          - automatic backport
-          - merge-queue
-
-  - name: backport patches to 2.27
-    conditions:
-      - label=backport 2.27-maintenance
-    actions:
-      backport:
-        branches:
-          - "2.27-maintenance"
-        labels:
-          - automatic backport
-          - merge-queue
-
-  - name: backport patches to 2.28
-    conditions:
-      - label=backport 2.28-maintenance
-    actions:
-      backport:
-        branches:
-          - "2.28-maintenance"
-        labels:
-          - automatic backport
-          - merge-queue
-
-  - name: backport patches to 2.29
-    conditions:
-      - label=backport 2.29-maintenance
-    actions:
-      backport:
-        branches:
-          - "2.29-maintenance"
-        labels:
-          - automatic backport
           - merge-queue

.version

@@ -1 +1 @@
-2.30.2
+2.26.0

README.md

@@ -31,7 +31,7 @@ Today, a world-wide developer community contributes to Nix and the ecosystem tha
 - [Nixpkgs](https://github.com/NixOS/nixpkgs) is [the largest, most up-to-date free software repository in the world](https://repology.org/repositories/graphs)
 - [NixOS](https://github.com/NixOS/nixpkgs/tree/master/nixos) is a Linux distribution that can be configured fully declaratively
 - [Discourse](https://discourse.nixos.org/)
-- Matrix: [#users:nixos.org](https://matrix.to/#/#users:nixos.org) for user support and [#nix-dev:nixos.org](https://matrix.to/#/#nix-dev:nixos.org) for development
+- [Matrix](https://matrix.to/#/#nix:nixos.org)
 
 ## License
 

default.nix

@@ -1,9 +1,10 @@
-(import (
-  let
-    lock = builtins.fromJSON (builtins.readFile ./flake.lock);
-  in
-  fetchTarball {
-    url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
-    sha256 = lock.nodes.flake-compat.locked.narHash;
-  }
-) { src = ./.; }).defaultNix
+(import
+  (
+    let lock = builtins.fromJSON (builtins.readFile ./flake.lock); in
+    fetchTarball {
+      url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
+      sha256 = lock.nodes.flake-compat.locked.narHash;
+    }
+  )
+  { src = ./.; }
+).defaultNix

doc/manual/book.toml

@@ -1,5 +1,5 @@
 [book]
-title = "Nix @version@ Reference Manual"
+title = "Nix Reference Manual"
 src = "source"
 
 [output.html]

doc/manual/generate-builtins.nix

@@ -5,15 +5,7 @@ in
 
 builtinsInfo:
 let
-  showBuiltin =
-    name:
-    {
-      doc,
-      type ? null,
-      args ? [ ],
-      experimental-feature ? null,
-      impure-only ? false,
-    }:
+  showBuiltin = name: { doc, type ? null, args ? [ ], experimental-feature ? null, impure-only ? false }:
     let
       type' = optionalString (type != null) " (${type})";
 

doc/manual/generate-deps.py

@@ -14,7 +14,7 @@ import sys
 # literally. since the rules for these aren't even the same for
 # all three we will just fail when we encounter any of them (if
 # asserts are off for some reason the depfile will likely point
-# to nonexistent paths, making everything phony and thus fine.)
+# to nonexistant paths, making everything phony and thus fine.)
 for path in glob.glob(sys.argv[1] + '/**', recursive=True):
     assert '\\' not in path
     assert ' ' not in path

doc/manual/generate-manpage.nix

@@ -32,13 +32,7 @@ let
 
   commandInfo = fromJSON commandDump;
 
-  showCommand =
-    {
-      command,
-      details,
-      filename,
-      toplevel,
-    }:
+  showCommand = { command, details, filename, toplevel }:
     let
 
       result = ''
@@ -62,27 +56,26 @@ let
         ${maybeOptions}
       '';
 
-      showSynopsis =
-        command: args:
+      showSynopsis = command: args:
         let
-          showArgument = arg: "*${arg.label}*" + optionalString (!arg ? arity) "...";
+          showArgument = arg: "*${arg.label}*" + optionalString (! arg ? arity) "...";
           arguments = concatStringsSep " " (map showArgument args);
-        in
-        ''
+        in ''
           `${command}` [*option*...] ${arguments}
         '';
 
-      maybeSubcommands = optionalString (details ? commands && details.commands != { }) ''
-        where *subcommand* is one of the following:
+      maybeSubcommands = optionalString (details ? commands && details.commands != {})
+        ''
+          where *subcommand* is one of the following:
 
-        ${subcommands}
-      '';
+          ${subcommands}
+        '';
 
-      subcommands = if length categories > 1 then listCategories else listSubcommands details.commands;
+      subcommands = if length categories > 1
+        then listCategories
+        else listSubcommands details.commands;
 
-      categories = sort (x: y: x.id < y.id) (
-        unique (map (cmd: cmd.category) (attrValues details.commands))
-      );
+      categories = sort (x: y: x.id < y.id) (unique (map (cmd: cmd.category) (attrValues details.commands)));
 
       listCategories = concatStrings (map showCategory categories);
 
@@ -106,39 +99,38 @@ let
 
             ${allStores}
           '';
-          index =
-            replaceStrings
-              [ "@store-types@" "./local-store.md" "./local-daemon-store.md" ]
-              [ storesOverview "#local-store" "#local-daemon-store" ]
-              details.doc;
+          index = replaceStrings
+            [ "@store-types@" "./local-store.md" "./local-daemon-store.md" ]
+            [ storesOverview "#local-store" "#local-daemon-store" ]
+            details.doc;
           storesOverview =
             let
-              showEntry = store: "- [${store.name}](#${store.slug})";
+              showEntry = store:
+                "- [${store.name}](#${store.slug})";
             in
             concatStringsSep "\n" (map showEntry storesList) + "\n";
           allStores = concatStringsSep "\n" (attrValues storePages);
-          storePages = listToAttrs (
-            map (s: {
-              name = s.filename;
-              value = s.page;
-            }) storesList
-          );
+          storePages = listToAttrs
+            (map (s: { name = s.filename; value = s.page; }) storesList);
           storesList = showStoreDocs {
             storeInfo = commandInfo.stores;
             inherit inlineHTML;
           };
-          hasInfix =
-            infix: content:
+          hasInfix = infix: content:
             builtins.stringLength content != builtins.stringLength (replaceStrings [ infix ] [ "" ] content);
         in
         optionalString (details ? doc) (
           # An alternate implementation with builtins.match stack overflowed on some systems.
-          if hasInfix "@store-types@" details.doc then help-stores else details.doc
+          if hasInfix "@store-types@" details.doc
+          then help-stores
+          else details.doc
         );
 
       maybeOptions =
         let
-          allVisibleOptions = filterAttrs (_: o: !o.hiddenCategory) (details.flags // toplevel.flags);
+          allVisibleOptions = filterAttrs
+            (_: o: ! o.hiddenCategory)
+            (details.flags // toplevel.flags);
         in
         optionalString (allVisibleOptions != { }) ''
           # Options
@@ -150,73 +142,55 @@ let
           > See [`man nix.conf`](@docroot@/command-ref/conf-file.md#command-line-flags) for overriding configuration settings with command line flags.
         '';
 
-      showOptions =
-        inlineHTML: allOptions:
+      showOptions = inlineHTML: allOptions:
         let
           showCategory = cat: opts: ''
             ${optionalString (cat != "") "## ${cat}"}
 
             ${concatStringsSep "\n" (attrValues (mapAttrs showOption opts))}
           '';
-          showOption =
-            name: option:
+          showOption = name: option:
             let
               result = trim ''
                 - ${item}
 
                   ${option.description}
               '';
-              item =
-                if inlineHTML then
-                  ''<span id="opt-${name}">[`--${name}`](#opt-${name})</span> ${shortName} ${labels}''
-                else
-                  "`--${name}` ${shortName} ${labels}";
-              shortName = optionalString (option ? shortName) ("/ `-${option.shortName}`");
-              labels = optionalString (option ? labels) (concatStringsSep " " (map (s: "*${s}*") option.labels));
-            in
-            result;
-          categories =
-            mapAttrs
-              # Convert each group from a list of key-value pairs back to an attrset
-              (_: listToAttrs)
-              (groupBy (cmd: cmd.value.category) (attrsToList allOptions));
-        in
-        concatStrings (attrValues (mapAttrs showCategory categories));
-    in
-    squash result;
+              item = if inlineHTML
+                then ''<span id="opt-${name}">[`--${name}`](#opt-${name})</span> ${shortName} ${labels}''
+                else "`--${name}` ${shortName} ${labels}";
+              shortName = optionalString
+                (option ? shortName)
+                ("/ `-${option.shortName}`");
+              labels = optionalString
+                (option ? labels)
+                (concatStringsSep " " (map (s: "*${s}*") option.labels));
+            in result;
+          categories = mapAttrs
+            # Convert each group from a list of key-value pairs back to an attrset
+            (_: listToAttrs)
+            (groupBy
+              (cmd: cmd.value.category)
+              (attrsToList allOptions));
+        in concatStrings (attrValues (mapAttrs showCategory categories));
+    in squash result;
 
   appendName = filename: name: (if filename == "nix" then "nix3" else filename) + "-" + name;
 
-  processCommand =
-    {
-      command,
-      details,
-      filename,
-      toplevel,
-    }:
+  processCommand = { command, details, filename, toplevel }:
     let
       cmd = {
         inherit command;
         name = filename + ".md";
-        value = showCommand {
-          inherit
-            command
-            details
-            filename
-            toplevel
-            ;
-        };
+        value = showCommand { inherit command details filename toplevel; };
       };
-      subcommand =
-        subCmd:
-        processCommand {
-          command = command + " " + subCmd;
-          details = details.commands.${subCmd};
-          filename = appendName filename subCmd;
-          inherit toplevel;
-        };
-    in
-    [ cmd ] ++ concatMap subcommand (attrNames details.commands or { });
+      subcommand = subCmd: processCommand {
+        command = command + " " + subCmd;
+        details = details.commands.${subCmd};
+        filename = appendName filename subCmd;
+        inherit toplevel;
+      };
+    in [ cmd ] ++ concatMap subcommand (attrNames details.commands or {});
 
   manpages = processCommand {
     command = "nix";
@@ -225,11 +199,9 @@ let
     toplevel = commandInfo.args;
   };
 
-  tableOfContents =
-    let
-      showEntry = page: "    - [${page.command}](command-ref/new-cli/${page.name})";
-    in
-    concatStringsSep "\n" (map showEntry manpages) + "\n";
+  tableOfContents = let
+    showEntry = page:
+      "    - [${page.command}](command-ref/new-cli/${page.name})";
+    in concatStringsSep "\n" (map showEntry manpages) + "\n";
 
-in
-(listToAttrs manpages) // { "SUMMARY.md" = tableOfContents; }
+in (listToAttrs manpages) // { "SUMMARY.md" = tableOfContents; }

doc/manual/generate-settings.nix

@@ -1,99 +1,67 @@
 let
-  inherit (builtins)
-    attrValues
-    concatStringsSep
-    isAttrs
-    isBool
-    mapAttrs
-    ;
-  inherit (import <nix/utils.nix>)
-    concatStrings
-    indent
-    optionalString
-    squash
-    ;
+  inherit (builtins) attrValues concatStringsSep isAttrs isBool mapAttrs;
+  inherit (import <nix/utils.nix>) concatStrings indent optionalString squash;
 in
 
 # `inlineHTML` is a hack to accommodate inconsistent output from `lowdown`
-{
-  prefix,
-  inlineHTML ? true,
-}:
-settingsInfo:
+{ prefix, inlineHTML ? true }: settingsInfo:
 
 let
 
-  showSetting =
-    prefix: setting:
-    {
-      description,
-      documentDefault,
-      defaultValue,
-      aliases,
-      value,
-      experimentalFeature,
-    }:
+  showSetting = prefix: setting: { description, documentDefault, defaultValue, aliases, value, experimentalFeature }:
     let
       result = squash ''
-        - ${item}
+          - ${item}
 
-        ${indent "  " body}
-      '';
-      item =
-        if inlineHTML then
-          ''<span id="${prefix}-${setting}">[`${setting}`](#${prefix}-${setting})</span>''
-        else
-          "`${setting}`";
+          ${indent "  " body}
+        '';
+      item = if inlineHTML
+        then ''<span id="${prefix}-${setting}">[`${setting}`](#${prefix}-${setting})</span>''
+        else "`${setting}`";
       # separate body to cleanly handle indentation
       body = ''
-        ${experimentalFeatureNote}
+          ${experimentalFeatureNote}
 
-        ${description}
+          ${description}
 
-        **Default:** ${showDefault documentDefault defaultValue}
+          **Default:** ${showDefault documentDefault defaultValue}
 
-        ${showAliases aliases}
-      '';
+          ${showAliases aliases}
+        '';
 
       experimentalFeatureNote = optionalString (experimentalFeature != null) ''
-        > **Warning**
-        >
-        > This setting is part of an
-        > [experimental feature](@docroot@/development/experimental-features.md).
-        >
-        > To change this setting, make sure the
-        > [`${experimentalFeature}` experimental feature](@docroot@/development/experimental-features.md#xp-feature-${experimentalFeature})
-        > is enabled.
-        > For example, include the following in [`nix.conf`](@docroot@/command-ref/conf-file.md):
-        >
-        > ```
-        > extra-experimental-features = ${experimentalFeature}
-        > ${setting} = ...
-        > ```
-      '';
+          > **Warning**
+          >
+          > This setting is part of an
+          > [experimental feature](@docroot@/development/experimental-features.md).
+          >
+          > To change this setting, make sure the
+          > [`${experimentalFeature}` experimental feature](@docroot@/development/experimental-features.md#xp-feature-${experimentalFeature})
+          > is enabled.
+          > For example, include the following in [`nix.conf`](@docroot@/command-ref/conf-file.md):
+          >
+          > ```
+          > extra-experimental-features = ${experimentalFeature}
+          > ${setting} = ...
+          > ```
+        '';
 
-      showDefault =
-        documentDefault: defaultValue:
+      showDefault = documentDefault: defaultValue:
         if documentDefault then
           # a StringMap value type is specified as a string, but
           # this shows the value type. The empty stringmap is `null` in
           # JSON, but that converts to `{ }` here.
-          if defaultValue == "" || defaultValue == [ ] || isAttrs defaultValue then
-            "*empty*"
-          else if isBool defaultValue then
-            if defaultValue then "`true`" else "`false`"
-          else
-            "`${toString defaultValue}`"
-        else
-          "*machine-specific*";
+          if defaultValue == "" || defaultValue == [] || isAttrs defaultValue
+            then "*empty*"
+            else if isBool defaultValue then
+              if defaultValue then "`true`" else "`false`"
+            else "`${toString defaultValue}`"
+        else "*machine-specific*";
 
-      showAliases =
-        aliases:
-        optionalString (aliases != [ ])
-          "**Deprecated alias:** ${(concatStringsSep ", " (map (s: "`${s}`") aliases))}";
+      showAliases = aliases:
+          optionalString (aliases != [])
+            "**Deprecated alias:** ${(concatStringsSep ", " (map (s: "`${s}`") aliases))}";
 
-    in
-    result;
+    in result;
 
-in
-concatStrings (attrValues (mapAttrs (showSetting prefix) settingsInfo))
+in concatStrings (attrValues (mapAttrs (showSetting prefix) settingsInfo))

doc/manual/generate-store-info.nix

@@ -1,20 +1,6 @@
 let
-  inherit (builtins)
-    attrNames
-    listToAttrs
-    concatStringsSep
-    readFile
-    replaceStrings
-    ;
-  inherit (import <nix/utils.nix>)
-    optionalString
-    filterAttrs
-    trim
-    squash
-    toLower
-    unique
-    indent
-    ;
+  inherit (builtins) attrNames listToAttrs concatStringsSep readFile replaceStrings;
+  inherit (import <nix/utils.nix>) optionalString filterAttrs trim squash toLower unique indent;
   showSettings = import <nix/generate-settings.nix>;
 in
 
@@ -28,14 +14,7 @@ in
 
 let
 
-  showStore =
-    { name, slug }:
-    {
-      settings,
-      doc,
-      uri-schemes,
-      experimentalFeature,
-    }:
+  showStore = { name, slug }: { settings, doc, experimentalFeature }:
     let
       result = squash ''
         # ${name}
@@ -46,10 +25,7 @@ let
 
         ## Settings
 
-        ${showSettings {
-          prefix = "store-${slug}";
-          inherit inlineHTML;
-        } settings}
+        ${showSettings { prefix = "store-${slug}"; inherit inlineHTML; } settings}
       '';
 
       experimentalFeatureNote = optionalString (experimentalFeature != null) ''
@@ -67,15 +43,15 @@ let
         > extra-experimental-features = ${experimentalFeature}
         > ```
       '';
-    in
-    result;
+    in result;
 
-  storesList = map (name: rec {
-    inherit name;
-    slug = replaceStrings [ " " ] [ "-" ] (toLower name);
-    filename = "${slug}.md";
-    page = showStore { inherit name slug; } storeInfo.${name};
-  }) (attrNames storeInfo);
+  storesList = map
+    (name: rec {
+      inherit name;
+      slug = replaceStrings [ " " ] [ "-" ] (toLower name);
+      filename = "${slug}.md";
+      page = showStore { inherit name slug; } storeInfo.${name};
+    })
+    (attrNames storeInfo);
 
-in
-storesList
+in storesList

doc/manual/generate-store-types.nix

@@ -1,11 +1,5 @@
 let
-  inherit (builtins)
-    attrNames
-    listToAttrs
-    concatStringsSep
-    readFile
-    replaceStrings
-    ;
+  inherit (builtins) attrNames listToAttrs concatStringsSep readFile replaceStrings;
   showSettings = import <nix/generate-settings.nix>;
   showStoreDocs = import <nix/generate-store-info.nix>;
 in
@@ -20,28 +14,26 @@ let
 
   index =
     let
-      showEntry = store: "- [${store.name}](./${store.filename})";
+      showEntry = store:
+        "- [${store.name}](./${store.filename})";
     in
     concatStringsSep "\n" (map showEntry storesList);
 
-  "index.md" =
-    replaceStrings [ "@store-types@" ] [ index ]
-      (readFile ./source/store/types/index.md.in);
+  "index.md" = replaceStrings
+    [ "@store-types@" ] [ index ]
+    (readFile ./source/store/types/index.md.in);
 
   tableOfContents =
     let
-      showEntry = store: "    - [${store.name}](store/types/${store.filename})";
+      showEntry = store:
+        "    - [${store.name}](store/types/${store.filename})";
     in
     concatStringsSep "\n" (map showEntry storesList) + "\n";
 
   "SUMMARY.md" = tableOfContents;
 
-  storePages = listToAttrs (
-    map (s: {
-      name = s.filename;
-      value = s.page;
-    }) storesList
-  );
+  storePages = listToAttrs
+    (map (s: { name = s.filename; value = s.page; }) storesList);
 
 in
 storePages // { inherit "index.md" "SUMMARY.md"; }

doc/manual/generate-xp-features-shortlist.nix

@@ -2,8 +2,8 @@ with builtins;
 with import <nix/utils.nix>;
 
 let
-  showExperimentalFeature = name: doc: ''
-    - [`${name}`](@docroot@/development/experimental-features.md#xp-feature-${name})
-  '';
-in
-xps: indent "  " (concatStrings (attrValues (mapAttrs showExperimentalFeature xps)))
+  showExperimentalFeature = name: doc:
+    ''
+      - [`${name}`](@docroot@/development/experimental-features.md#xp-feature-${name})
+    '';
+in xps: indent "  " (concatStrings (attrValues (mapAttrs showExperimentalFeature xps)))

doc/manual/generate-xp-features.nix

@@ -2,8 +2,7 @@ with builtins;
 with import <nix/utils.nix>;
 
 let
-  showExperimentalFeature =
-    name: doc:
+  showExperimentalFeature = name: doc:
     squash ''
       ## [`${name}`]{#xp-feature-${name}}
 

doc/manual/meson.build

@@ -67,7 +67,7 @@ subdir('source/release-notes')
 subdir('source')
 
 # Hacky way to figure out if `nix` is an `ExternalProgram` or
-# `Executable`. Only the latter can occur in custom target input lists.
+# `Exectuable`. Only the latter can occur in custom target input lists.
 if nix.full_path().startswith(meson.build_root())
   nix_input = nix
 else
@@ -83,7 +83,6 @@ manual = custom_target(
     '''
         @0@ @INPUT0@ @CURRENT_SOURCE_DIR@ > @DEPFILE@
         @0@ @INPUT1@ summary @2@ < @CURRENT_SOURCE_DIR@/source/SUMMARY.md.in > @2@/source/SUMMARY.md
-        sed -e 's|@version@|@3@|g' < @INPUT2@ > @2@/book.toml
         rsync -r --include='*.md' @CURRENT_SOURCE_DIR@/ @2@/
         (cd @2@; RUST_LOG=warn @1@ build -d @2@ 3>&2 2>&1 1>&3) | { grep -Fv "because fragment resolution isn't implemented" || :; } 3>&2 2>&1 1>&3
         rm -rf @2@/manual
@@ -93,13 +92,12 @@ manual = custom_target(
       python.full_path(),
       mdbook.full_path(),
       meson.current_build_dir(),
-      meson.project_version(),
     ),
   ],
   input : [
     generate_manual_deps,
     'substitute.py',
-    'book.toml.in',
+    'book.toml',
     'anchors.jq',
     'custom.css',
     nix3_cli_files,
@@ -246,11 +244,11 @@ nix3_manpages = [
   'nix3-nar',
   'nix3-path-info',
   'nix3-print-dev-env',
-  'nix3-profile',
-  'nix3-profile-add',
   'nix3-profile-diff-closures',
   'nix3-profile-history',
+  'nix3-profile-install',
   'nix3-profile-list',
+  'nix3-profile',
   'nix3-profile-remove',
   'nix3-profile-rollback',
   'nix3-profile-upgrade',
@@ -281,6 +279,7 @@ nix3_manpages = [
   'nix3-store',
   'nix3-store-optimise',
   'nix3-store-path-from-hash-part',
+  'nix3-store-ping',
   'nix3-store-prefetch-file',
   'nix3-store-repair',
   'nix3-store-sign',

doc/manual/package.nix

@@ -1,22 +1,19 @@
-{
-  lib,
-  mkMesonDerivation,
+{ lib
+, mkMesonDerivation
 
-  meson,
-  ninja,
-  lowdown-unsandboxed,
-  mdbook,
-  mdbook-linkcheck,
-  jq,
-  python3,
-  rsync,
-  nix-cli,
-  changelog-d,
-  officialRelease,
+, meson
+, ninja
+, lowdown
+, mdbook
+, mdbook-linkcheck
+, jq
+, python3
+, rsync
+, nix-cli
 
-  # Configuration Options
+# Configuration Options
 
-  version,
+, version
 }:
 
 let
@@ -28,51 +25,40 @@ mkMesonDerivation (finalAttrs: {
   inherit version;
 
   workDir = ./.;
-  fileset =
-    fileset.difference
-      (fileset.unions [
-        ../../.version
-        # Too many different types of files to filter for now
-        ../../doc/manual
-        ./.
-      ])
-      # Do a blacklist instead
-      ../../doc/manual/package.nix;
+  fileset = fileset.difference
+    (fileset.unions [
+      ../../.version
+      # Too many different types of files to filter for now
+      ../../doc/manual
+      ./.
+    ])
+    # Do a blacklist instead
+    ../../doc/manual/package.nix;
 
   # TODO the man pages should probably be separate
-  outputs = [
-    "out"
-    "man"
-  ];
+  outputs = [ "out" "man" ];
 
   # Hack for sake of the dev shell
-  passthru.externalNativeBuildInputs =
-    [
-      meson
-      ninja
-      (lib.getBin lowdown-unsandboxed)
-      mdbook
-      mdbook-linkcheck
-      jq
-      python3
-      rsync
-      changelog-d
-    ]
-    ++ lib.optionals (!officialRelease) [
-      # When not an official release, we likely have changelog entries that have
-      # yet to be rendered.
-      # When released, these are rendered into a committed file to save a dependency.
-      changelog-d
-    ];
+  passthru.externalNativeBuildInputs = [
+    meson
+    ninja
+    (lib.getBin lowdown)
+    mdbook
+    mdbook-linkcheck
+    jq
+    python3
+    rsync
+  ];
 
   nativeBuildInputs = finalAttrs.passthru.externalNativeBuildInputs ++ [
     nix-cli
   ];
 
-  preConfigure = ''
-    chmod u+w ./.version
-    echo ${finalAttrs.version} > ./.version
-  '';
+  preConfigure =
+    ''
+      chmod u+w ./.version
+      echo ${finalAttrs.version} > ./.version
+    '';
 
   postInstall = ''
     mkdir -p ''$out/nix-support

doc/manual/redirects.js

@@ -346,9 +346,6 @@ const redirects = {
     "scoping-rules": "scoping.html",
     "string-literal": "string-literals.html",
   },
-  "language/derivations.md": {
-    "builder-execution": "store/drv/building.md#builder-execution",
-  },
   "installation/installing-binary.html": {
     "linux": "uninstall.html#linux",
     "macos": "uninstall.html#macos",
@@ -374,9 +371,7 @@ const redirects = {
   },
   "glossary.html": {
     "gloss-local-store": "store/types/local-store.html",
-    "package-attribute-set": "#package",
     "gloss-chroot-store": "store/types/local-store.html",
-    "gloss-content-addressed-derivation": "#gloss-content-addressing-derivation",
   },
 };
 

doc/manual/rl-next/nix-copy-flags.md

@@ -0,0 +1,18 @@
+---
+synopsis: "`nix copy` supports `--profile` and `--out-link`"
+prs: [11657]
+---
+
+The `nix copy` command now has flags `--profile` and `--out-link`, similar to `nix build`. `--profile` makes a profile point to the
+top-level store path, while `--out-link` create symlinks to the top-level store paths.
+
+For example, when updating the local NixOS system profile from a NixOS system closure on a remote machine, instead of
+```
+# nix copy --from ssh://server $path
+# nix build --profile /nix/var/nix/profiles/system $path
+```
+you can now do
+```
+# nix copy --from ssh://server --profile /nix/var/nix/profiles/system $path
+```
+The advantage is that this avoids a time window where *path* is not a garbage collector root, and so could be deleted by a concurrent `nix store gc` process.

doc/manual/source/SUMMARY.md.in

@@ -22,18 +22,12 @@
   - [Store Object](store/store-object.md)
     - [Content-Addressing Store Objects](store/store-object/content-address.md)
   - [Store Path](store/store-path.md)
-  - [Store Derivation and Deriving Path](store/derivation/index.md)
-    - [Derivation Outputs and Types of Derivations](store/derivation/outputs/index.md)
-      - [Content-addressing derivation outputs](store/derivation/outputs/content-address.md)
-      - [Input-addressing derivation outputs](store/derivation/outputs/input-address.md)
-  - [Building](store/building.md)
   - [Store Types](store/types/index.md)
 {{#include ./store/types/SUMMARY.md}}
 - [Nix Language](language/index.md)
   - [Data Types](language/types.md)
     - [String context](language/string-context.md)
   - [Syntax and semantics](language/syntax.md)
-    - [Evaluation](language/evaluation.md)
     - [Variables](language/variables.md)
     - [String literals](language/string-literals.md)
     - [Identifiers](language/identifiers.md)
@@ -57,7 +51,6 @@
   - [Tuning Cores and Jobs](advanced-topics/cores-vs-jobs.md)
   - [Verifying Build Reproducibility](advanced-topics/diff-hook.md)
   - [Using the `post-build-hook`](advanced-topics/post-build-hook.md)
-  - [Evaluation profiler](advanced-topics/eval-profiler.md)
 - [Command Reference](command-ref/index.md)
   - [Common Options](command-ref/opt-common.md)
   - [Common Environment Variables](command-ref/env-common.md)
@@ -137,11 +130,6 @@
   - [Contributing](development/contributing.md)
 - [Releases](release-notes/index.md)
 {{#include ./SUMMARY-rl-next.md}}
-  - [Release 2.30 (2025-07-07)](release-notes/rl-2.30.md)
-  - [Release 2.29 (2025-05-14)](release-notes/rl-2.29.md)
-  - [Release 2.28 (2025-04-02)](release-notes/rl-2.28.md)
-  - [Release 2.27 (2025-03-03)](release-notes/rl-2.27.md)
-  - [Release 2.26 (2025-01-22)](release-notes/rl-2.26.md)
   - [Release 2.25 (2024-11-07)](release-notes/rl-2.25.md)
   - [Release 2.24 (2024-07-31)](release-notes/rl-2.24.md)
   - [Release 2.23 (2024-06-03)](release-notes/rl-2.23.md)

doc/manual/source/advanced-topics/distributed-builds.md

@@ -20,14 +20,14 @@ For a local machine to forward a build to a remote machine, the remote machine m
 
 ## Testing
 
-To test connecting to a remote [Nix instance] (in this case `mac`), run:
+To test connecting to a remote Nix instance (in this case `mac`), run:
 
 ```console
 nix store info --store ssh://username@mac
 ```
 
 To specify an SSH identity file as part of the remote store URI add a
-query parameter, e.g.
+query paramater, e.g.
 
 ```console
 nix store info --store ssh://username@mac?ssh-key=/home/alice/my-key
@@ -106,5 +106,3 @@ file included in `builders` via the syntax `@/path/to/file`. For example,
 
 causes the list of machines in `/etc/nix/machines` to be included.
 (This is the default.)
-
-[Nix instance]: @docroot@/glossary.md#gloss-nix-instance

doc/manual/source/advanced-topics/eval-profiler.md

@@ -1,33 +0,0 @@
-# Using the `eval-profiler`
-
-Nix evaluator supports [evaluation](@docroot@/language/evaluation.md)
-[profiling](<https://en.wikipedia.org/wiki/Profiling_(computer_programming)>)
-compatible with `flamegraph.pl`. The profiler samples the nix
-function call stack at regular intervals. It can be enabled with the
-[`eval-profiler`](@docroot@/command-ref/conf-file.md#conf-eval-profiler)
-setting:
-
-```console
-$ nix-instantiate "<nixpkgs>" -A hello --eval-profiler flamegraph
-```
-
-Stack sampling frequency and the output file path can be configured with
-[`eval-profile-file`](@docroot@/command-ref/conf-file.md#conf-eval-profile-file)
-and [`eval-profiler-frequency`](@docroot@/command-ref/conf-file.md#conf-eval-profiler-frequency).
-By default the collected profile is saved to `nix.profile` file in the current working directory.
-
-The collected profile can be directly consumed by `flamegraph.pl`:
-
-```console
-$ flamegraph.pl nix.profile > flamegraph.svg
-```
-
-The line information in the profile contains the location of the [call
-site](https://en.wikipedia.org/wiki/Call_site) position and the name of the
-function being called (when available). For example:
-
-```
-/nix/store/x9wnkly3k1gkq580m90jjn32q9f05q2v-source/pkgs/top-level/default.nix:167:5:primop import
-```
-
-Here `import` primop is called at `/nix/store/x9wnkly3k1gkq580m90jjn32q9f05q2v-source/pkgs/top-level/default.nix:167:5`.

doc/manual/source/architecture/architecture.md

@@ -22,9 +22,9 @@ The following [concept map] shows its main components (rectangles), the objects
            |                   |
 +----------|-------------------|--------------------------------+
 | Nix      |                   V                                |
-|          |       +------------------------+                   |
-|          |       | command line interface |------.            |
-|          |       +------------------------+      |            |
+|          |      +-------------------------+                   |
+|          |      | commmand line interface |------.            |
+|          |      +-------------------------+      |            |
 |          |                   |                   |            |
 |    evaluated by            calls              manages         |
 |          |                   |                   |            |
@@ -69,7 +69,7 @@ It can also execute build plans to produce new data, which are made available to
 A build plan itself is a series of *build tasks*, together with their build inputs.
 
 > **Important**
-> A build task in Nix is called [store derivation](@docroot@/glossary.md#gloss-store-derivation).
+> A build task in Nix is called [derivation](@docroot@/glossary.md#gloss-derivation).
 
 Each build task has a special build input executed as *build instructions* in order to perform the build.
 The result of a build task can be input to another build task.

doc/manual/source/command-ref/nix-channel.md

@@ -53,11 +53,6 @@ This command has the following operations:
   Download the Nix expressions of subscribed channels and create a new generation.
   Update all channels if none is specified, and only those included in *names* otherwise.
 
-  > **Note**
-  >
-  > Downloaded channel contents are cached.
-  > Use `--tarball-ttl` or the [`tarball-ttl` configuration option](@docroot@/command-ref/conf-file.md#conf-tarball-ttl) to change the validity period of cached downloads.
-
 - `--list-generations`
 
   Prints a list of all the current existing generations for the

doc/manual/source/command-ref/nix-collect-garbage.md

@@ -62,15 +62,6 @@ These options are for deleting old [profiles] prior to deleting unreachable [sto
   This is the equivalent of invoking [`nix-env --delete-generations <period>`](@docroot@/command-ref/nix-env/delete-generations.md#generations-time) on each found profile.
   See the documentation of that command for additional information about the *period* argument.
 
-  - <span id="opt-max-freed">[`--max-freed`](#opt-max-freed)</span> *bytes*
-
-<!-- duplication from https://github.com/NixOS/nix/blob/442a2623e48357ff72c77bb11cf2cf06d94d2f90/doc/manual/source/command-ref/nix-store/gc.md?plain=1#L39-L44 -->
-
-  Keep deleting paths until at least *bytes* bytes have been deleted,
-  then stop. The argument *bytes* can be followed by the
-  multiplicative suffix `K`, `M`, `G` or `T`, denoting KiB, MiB, GiB
-  or TiB units.
-  
 {{#include ./opt-common.md}}
 
 {{#include ./env-common.md}}

doc/manual/source/command-ref/nix-copy-closure.md

@@ -84,7 +84,7 @@ When using public key authentication, you can avoid typing the passphrase with `
 > Copy GNU Hello from a remote machine using a known store path, and run it:
 >
 > ```shell-session
-> $ storePath="$(nix-instantiate --eval --raw '<nixpkgs>' -I nixpkgs=channel:nixpkgs-unstable -A hello.outPath)"
+> $ storePath="$(nix-instantiate --eval '<nixpkgs>' -I nixpkgs=channel:nixpkgs-unstable -A hello.outPath | tr -d '"')"
 > $ nix-copy-closure --from alice@itchy.example.org "$storePath"
 > $ "$storePath"/bin/hello
 > Hello, world!

doc/manual/source/command-ref/nix-env/delete-generations.md

@@ -27,7 +27,7 @@ This operation deletes the specified generations of the current profile.
   >
   > Older *and newer* generations will be deleted by this operation.
   >
-  > One might expect this to just delete older generations than the current one, but that is only true if the current generation is also the latest.
+  > One might expect this to just delete older generations than the curent one, but that is only true if the current generation is also the latest.
   > Because one can roll back to a previous generation, it is possible to have generations newer than the current one.
   > They will also be deleted.
 

doc/manual/source/command-ref/nix-env/install.md

@@ -11,7 +11,6 @@
   [`--from-profile` *path*]
   [`--preserve-installed` | `-P`]
   [`--remove-all` | `-r`]
-  [`--priority` *priority*]
 
 # Description
 
@@ -22,11 +21,11 @@ It is based on the current generation of the active [profile](@docroot@/command-
 
 The arguments *args* map to store paths in a number of possible ways:
 
-- By default, *args* is a set of names denoting derivations in the [default Nix expression].
+- By default, *args* is a set of [derivation] names denoting derivations in the [default Nix expression].
   These are [realised], and the resulting output paths are installed.
   Currently installed derivations with a name equal to the name of a derivation being added are removed unless the option `--preserve-installed` is specified.
 
-  [derivation expression]: @docroot@/glossary.md#gloss-derivation-expression
+  [derivation]: @docroot@/glossary.md#gloss-derivation
   [default Nix expression]: @docroot@/command-ref/files/default-nix-expression.md
   [realised]: @docroot@/glossary.md#gloss-realise
 
@@ -62,15 +61,11 @@ The arguments *args* map to store paths in a number of possible ways:
   The derivations returned by those function calls are installed.
   This allows derivations to be specified in an unambiguous way, which is necessary if there are multiple derivations with the same name.
 
-- If `--priority` *priority* is given, the priority of the derivations being installed is set to *priority*.
-  This can be used to override the priority of the derivations being installed.
-  This is useful if *args* are [store paths], which don't have any priority information.
+- If *args* are [store derivations](@docroot@/glossary.md#gloss-store-derivation), then these are [realised], and the resulting output paths are installed.
 
-- If *args* are [store paths] that point to [store derivations][store derivation], then those store derivations are [realised], and the resulting output paths are installed.
+- If *args* are [store paths] that are not store derivations, then these are [realised] and installed.
 
-- If *args* are [store paths] that do not point to store derivations, then these are [realised] and installed.
-
-- By default all [outputs](@docroot@/language/derivations.md#attr-outputs) are installed for each [store derivation].
+- By default all [outputs](@docroot@/language/derivations.md#attr-outputs) are installed for each [derivation].
   This can be overridden by adding a `meta.outputsToInstall` attribute on the derivation listing a subset of the output names.
 
   Example:
@@ -122,8 +117,6 @@ The arguments *args* map to store paths in a number of possible ways:
   manifest.nix
   ```
 
-[store derivation]: @docroot@/glossary.md#gloss-store-derivation
-
 # Options
 
 - `--prebuilt-only` / `-b`
@@ -242,3 +235,4 @@ channel:
 ```console
 $ nix-env --file https://github.com/NixOS/nixpkgs/archive/nixos-14.12.tar.gz --install --attr firefox
 ```
+

doc/manual/source/command-ref/nix-env/query.md

@@ -125,10 +125,7 @@ derivation is shown unless `--no-name` is specified.
 
   - `--drv-path`
 
-    Print the [store path] to the [store derivation].
-
-    [store path]: @docroot@/glossary.md#gloss-store-path
-    [store derivation]: @docroot@/glossary.md#gloss-derivation
+    Print the path of the [store derivation](@docroot@/glossary.md#gloss-store-derivation).
 
   - `--out-path`
 

doc/manual/source/command-ref/nix-hash.md

@@ -67,7 +67,7 @@ md5sum`.
 - `--type` *hashAlgo*
 
   Use the specified cryptographic hash algorithm, which can be one of
-  `blake3`, `md5`, `sha1`, `sha256`, and `sha512`.
+  `md5`, `sha1`, `sha256`, and `sha512`.
 
 - `--to-base16`
 

doc/manual/source/command-ref/nix-instantiate.md

@@ -5,7 +5,7 @@
 # Synopsis
 
 `nix-instantiate`
-  [`--parse` | `--eval` [`--strict`] [`--raw` | `--json` | `--xml`] ]
+  [`--parse` | `--eval` [`--strict`] [`--json`] [`--xml`] ]
   [`--read-write-mode`]
   [`--arg` *name* *value*]
   [{`--attr`| `-A`} *attrPath*]
@@ -42,8 +42,8 @@ standard input.
 - `--eval`
 
   Just parse and evaluate the input files, and print the resulting
-  values on standard output.
-  Store derivations are not serialized and written to the store, but instead just hashed and discarded.
+  values on standard output. No instantiation of store derivations
+  takes place.
 
   > **Warning**
   >
@@ -102,11 +102,6 @@ standard input.
   > This option can cause non-termination, because lazy data
   > structures can be infinitely large.
 
-- `--raw`
-
-  When used with `--eval`, the evaluation result must be a string,
-  which is printed verbatim, without quoting, escaping or trailing newline.
-
 - `--json`
 
   When used with `--eval`, print the resulting value as an JSON

doc/manual/source/command-ref/nix-prefetch-url.md

@@ -42,7 +42,7 @@ the path of the downloaded file in the Nix store is also printed.
 - `--type` *hashAlgo*
 
   Use the specified cryptographic hash algorithm,
-  which can be one of `blake3`, `md5`, `sha1`, `sha256`, and `sha512`.
+  which can be one of `md5`, `sha1`, `sha256`, and `sha512`.
   The default is `sha256`.
 
 - `--print-path`

doc/manual/source/command-ref/nix-shell.md

@@ -242,21 +242,16 @@ print(t)
 ```
 
 Similarly, the following is a Perl script that specifies that it
-requires Perl and the `HTML::TokeParser::Simple`, `LWP` and
-`LWP::Protocol::Https` packages:
+requires Perl and the `HTML::TokeParser::Simple` and `LWP` packages:
 
 ```perl
 #! /usr/bin/env nix-shell
-#! nix-shell -i perl 
-#! nix-shell --packages perl 
-#! nix-shell --packages perlPackages.HTMLTokeParserSimple 
-#! nix-shell --packages perlPackages.LWP
-#! nix-shell --packages perlPackages.LWPProtocolHttps
+#! nix-shell -i perl --packages perl perlPackages.HTMLTokeParserSimple perlPackages.LWP
 
 use HTML::TokeParser::Simple;
 
 # Fetch nixos.org and print all hrefs.
-my $p = HTML::TokeParser::Simple->new(url => 'https://nixos.org/');
+my $p = HTML::TokeParser::Simple->new(url => 'http://nixos.org/');
 
 while (my $token = $p->get_tag("a")) {
     my $href = $token->get_attr("href");
@@ -321,7 +316,7 @@ contains:
 ```nix
 with import <nixpkgs> {};
 
-runCommand "dummy" { buildInputs = [ python3 python3Packages.prettytable ]; } ""
+runCommand "dummy" { buildInputs = [ python pythonPackages.prettytable ]; } ""
 ```
 
 The script's file name is passed as the first argument to the interpreter specified by the `-i` flag.

doc/manual/source/command-ref/nix-store/add-fixed.md

@@ -21,9 +21,6 @@ This operation has the following options:
   Use recursive instead of flat hashing mode, used when adding
   directories to the store.
 
-  *paths* that refer to symlinks are not dereferenced, but added to the store
-  as symlinks with the same target.
-
 {{#include ./opt-common.md}}
 
 {{#include ../opt-common.md}}

doc/manual/source/command-ref/nix-store/add.md

@@ -11,9 +11,6 @@
 The operation `--add` adds the specified paths to the Nix store. It
 prints the resulting paths in the Nix store on standard output.
 
-*paths* that refer to symlinks are not dereferenced, but added to the store
-as symlinks with the same target.
-
 {{#include ./opt-common.md}}
 
 {{#include ../opt-common.md}}

doc/manual/source/command-ref/nix-store/query.md

@@ -45,19 +45,10 @@ symlink.
 
   [output paths]: @docroot@/glossary.md#gloss-output-path
 
-- `--references`
-
-  Prints the set of [references] of the store paths
-  *paths*, that is, their immediate dependencies. (For *all*
-  dependencies, use `--requisites`.)
-
-  [references]: @docroot@/glossary.md#gloss-reference
-
 - `--requisites` / `-R`
 
-  Prints out the set of [*requisites*][requisite] (better known as the [closure]) of the store path *paths*.
+  Prints out the [closure] of the store path *paths*.
 
-  [requisite]: @docroot@/glossary.md#gloss-requisite
   [closure]: @docroot@/glossary.md#gloss-closure
 
   This query has one option:
@@ -74,25 +65,29 @@ symlink.
   dependencies) is obtained by distributing the closure of a store
   derivation and specifying the option `--include-outputs`.
 
+- `--references`
+
+  Prints the set of [references] of the store paths
+  *paths*, that is, their immediate dependencies. (For *all*
+  dependencies, use `--requisites`.)
+
+  [references]: @docroot@/glossary.md#gloss-reference
+
 - `--referrers`
 
-  Prints the set of [*referrers*][referrer] of the store paths *paths*, that is,
+  Prints the set of *referrers* of the store paths *paths*, that is,
   the store paths currently existing in the Nix store that refer to
   one of *paths*. Note that contrary to the references, the set of
   referrers is not constant; it can change as store paths are added or
   removed.
 
-  [referrer]: @docroot@/glossary.md#gloss-referrer
-
 - `--referrers-closure`
 
   Prints the closure of the set of store paths *paths* under the
-  [referrers relation][referrer]; that is, all store paths that directly or
+  referrers relation; that is, all store paths that directly or
   indirectly refer to one of *paths*. These are all the path currently
   in the Nix store that are dependent on *paths*.
 
-  [referrer]: @docroot@/glossary.md#gloss-referrer
-
 - `--deriver` / `-d`
 
   Prints the [deriver] that was used to build the store paths *paths*. If

doc/manual/source/command-ref/nix-store/realise.md

@@ -15,7 +15,7 @@ Each of *paths* is processed as follows:
   1. If it is not [valid], substitute the store derivation file itself.
   2. Realise its [output paths]:
     - Try to fetch from [substituters] the [store objects] associated with the output paths in the store derivation's [closure].
-      - With [content-addressing derivations] (experimental):
+      - With [content-addressed derivations] (experimental):
         Determine the output paths to realise by querying content-addressed realisation entries in the [Nix database].
     - For any store paths that cannot be substituted, produce the required store objects:
       1. Realise all outputs of the derivation's dependencies
@@ -32,7 +32,7 @@ If no substitutes are available and no store derivation is given, realisation fa
 [store objects]: @docroot@/store/store-object.md
 [closure]: @docroot@/glossary.md#gloss-closure
 [substituters]: @docroot@/command-ref/conf-file.md#conf-substituters
-[content-addressing derivations]: @docroot@/development/experimental-features.md#xp-feature-ca-derivations
+[content-addressed derivations]: @docroot@/development/experimental-features.md#xp-feature-ca-derivations
 [Nix database]: @docroot@/glossary.md#gloss-nix-database
 
 The resulting paths are printed on standard output.

doc/manual/source/development/building.md

@@ -28,7 +28,7 @@ $ nix-shell --attr devShells.x86_64-linux.native-clangStdenvPackages
 
 > **Note**
 >
-> You can use `native-ccacheStdenv` to drastically improve rebuild time.
+> You can use `native-ccacheStdenvPackages` to drastically improve rebuild time.
 > By default, [ccache](https://ccache.dev) keeps artifacts in `~/.cache/ccache/`.
 
 To build Nix itself in this shell:
@@ -79,7 +79,7 @@ This shell also adds `./outputs/bin/nix` to your `$PATH` so you can run `nix` im
 To get a shell with one of the other [supported compilation environments](#compilation-environments):
 
 ```console
-$ nix develop .#native-clangStdenv
+$ nix develop .#native-clangStdenvPackages
 ```
 
 > **Note**
@@ -167,13 +167,11 @@ It is useful to perform multiple cross and native builds on the same source tree
 for example to ensure that better support for one platform doesn't break the build for another.
 Meson thankfully makes this very easy by confining all build products to the build directory --- one simple shares the source directory between multiple build directories, each of which contains the build for Nix to a different platform.
 
-Here's how to do that:
+Nixpkgs's `configurePhase` always chooses `build` in the current directory as the name and location of the build.
+This makes having multiple build directories slightly more inconvenient.
+The good news is that Meson/Ninja seem to cope well with relocating the build directory after it is created.
 
-1. Instruct Nixpkgs's infra where we want Meson to put its build directory
-
-   ```bash
-   mesonBuildDir=build-my-variant-name
-   ```
+Here's how to do that
 
 1. Configure as usual
 
@@ -181,12 +179,24 @@ Here's how to do that:
    configurePhase
    ```
 
+2. Rename the build directory
+
+   ```bash
+   cd .. # since `configurePhase` cd'd inside
+   mv build build-linux # or whatever name we want
+   cd build-linux
+   ```
+
 3. Build as usual
 
    ```bash
    buildPhase
    ```
 
+> **N.B.**
+> [`nixpkgs#335818`](https://github.com/NixOS/nixpkgs/issues/335818) tracks giving `mesonConfigurePhase` proper support for custom build directories.
+> When it is fixed, we can simplify these instructions and then remove this notice.
+
 ## System type
 
 Nix uses a string with the following format to identify the *system type* or *platform* it runs on:
@@ -195,25 +205,19 @@ Nix uses a string with the following format to identify the *system type* or *pl
 <cpu>-<os>[-<abi>]
 ```
 
-It is set when Nix is compiled for the given system, and based on the output of Meson's [`host_machine` information](https://mesonbuild.com/Reference-manual_builtin_host_machine.html)>
+It is set when Nix is compiled for the given system, and based on the output of [`config.guess`](https://github.com/nixos/nix/blob/master/config/config.guess) ([upstream](https://git.savannah.gnu.org/cgit/config.git/tree/config.guess)):
 
 ```
 <cpu>-<vendor>-<os>[<version>][-<abi>]
 ```
 
-When cross-compiling Nix with Meson for local development, you need to specify a [cross-file](https://mesonbuild.com/Cross-compilation.html) using the `--cross-file` option. Cross-files define the target architecture and toolchain. When cross-compiling Nix with Nix, Nixpkgs takes care of this for you.
-
-In the nix flake we also have some cross-compilation targets available:
+When Nix is built such that `./configure` is passed any of the `--host`, `--build`, `--target` options, the value is based on the output of [`config.sub`](https://github.com/nixos/nix/blob/master/config/config.sub) ([upstream](https://git.savannah.gnu.org/cgit/config.git/tree/config.sub)):
 
 ```
-nix build .#nix-everything-riscv64-unknown-linux-gnu
-nix build .#nix-everything-armv7l-unknown-linux-gnueabihf
-nix build .#nix-everything-armv7l-unknown-linux-gnueabihf
-nix build .#nix-everything-x86_64-unknown-freebsd
-nix build .#nix-everything-x86_64-w64-mingw32
+<cpu>-<vendor>[-<kernel>]-<os>
 ```
 
-For historic reasons and backward-compatibility, some CPU and OS identifiers are translated as follows:
+For historic reasons and backward-compatibility, some CPU and OS identifiers are translated from the GNU Autotools naming convention in [`configure.ac`](https://github.com/nixos/nix/blob/master/configure.ac) as follows:
 
 | `config.guess`             | Nix                 |
 |----------------------------|---------------------|
@@ -236,18 +240,18 @@ Nix can be compiled using multiple environments:
 To build with one of those environments, you can use
 
 ```console
-$ nix build .#nix-cli-ccacheStdenv
+$ nix build .#nix-ccacheStdenv
 ```
 
 for flake-enabled Nix, or
 
 ```console
-$ nix-build --attr nix-cli-ccacheStdenv
+$ nix-build --attr nix-ccacheStdenv
 ```
 
 for classic Nix.
 
-You can use any of the other supported environments in place of `nix-cli-ccacheStdenv`.
+You can use any of the other supported environments in place of `nix-ccacheStdenv`.
 
 ## Editor integration
 
@@ -257,8 +261,7 @@ See [supported compilation environments](#compilation-environments) and instruct
 To use the LSP with your editor, you will want a `compile_commands.json` file telling `clangd` how we are compiling the code.
 Meson's configure always produces this inside the build directory.
 
-Configure your editor to use the `clangd` from the `.#native-clangStdenv` shell.
-You can do that either by running it inside the development shell, or by using [nix-direnv](https://github.com/nix-community/nix-direnv) and [the appropriate editor plugin](https://github.com/direnv/direnv/wiki#editor-integration).
+Configure your editor to use the `clangd` from the `.#native-clangStdenvPackages` shell. You can do that either by running it inside the development shell, or by using [nix-direnv](https://github.com/nix-community/nix-direnv) and [the appropriate editor plugin](https://github.com/direnv/direnv/wiki#editor-integration).
 
 > **Note**
 >
@@ -274,8 +277,6 @@ You may run the formatters as a one-off using:
 ./maintainers/format.sh
 ```
 
-### Pre-commit hooks
-
 If you'd like to run the formatters before every commit, install the hooks:
 
 ```
@@ -290,30 +291,3 @@ If it fails, run `git add --patch` to approve the suggestions _and commit again_
 To refresh pre-commit hook's config file, do the following:
 1. Exit the development shell and start it again by running `nix develop`.
 2. If you also use the pre-commit hook, also run `pre-commit-hooks-install` again.
-
-### VSCode
-
-Insert the following json into your `.vscode/settings.json` file to configure `nixfmt`.
-This will be picked up by the _Format Document_ command, `"editor.formatOnSave"`, etc.
-
-```json
-{
-  "nix.formatterPath": "nixfmt",
-  "nix.serverSettings": {
-    "nixd": {
-      "formatting": {
-        "command": [
-          "nixfmt"
-        ],
-      },
-    },
-    "nil": {
-      "formatting": {
-        "command": [
-          "nixfmt"
-        ],
-      },
-    },
-  },
-}
-```

doc/manual/source/development/cli-guideline.md

@@ -170,9 +170,9 @@ sensitive.
 
 
 ```shell
-$ nix init --template=template#python
+$ nix init --template=template#pyton
 ------------------------------------------------------------------------
-  Error! Template `template#python` not found.
+  Error! Template `template#pyton` not found.
 ------------------------------------------------------------------------
 Initializing Nix project at `/path/to/here`.
       Select a template for you new project:

doc/manual/source/development/contributing.md

@@ -20,9 +20,8 @@ prs: 1238
 Here's one or more paragraphs that describe the change.
 
 - It's markdown
-- Add references to the manual using [links like this](@_at_docroot@/example.md)
+- Add references to the manual using @docroot@
 ```
-<!-- for the raw markdown readers: that means using @docroot@ -->
 
 Significant changes should add the following header, which moves them to the top.
 

doc/manual/source/development/debugging.md

@@ -2,8 +2,6 @@
 
 This section shows how to build and debug Nix with debug symbols enabled.
 
-Additionally, see [Testing Nix](./testing.md) for further instructions on how to debug Nix in the context of a unit test or functional test.
-
 ## Building Nix with Debug Symbols
 
 In the development shell, set the `mesonBuildType` environment variable to `debug` before configuring the build:
@@ -15,15 +13,6 @@ In the development shell, set the `mesonBuildType` environment variable to `debu
 Then, proceed to build Nix as described in [Building Nix](./building.md).
 This will build Nix with debug symbols, which are essential for effective debugging.
 
-It is also possible to build without debugging for faster build:
-
-```console
-[nix-shell]$ NIX_HARDENING_ENABLE=$(printLines $NIX_HARDENING_ENABLE | grep -v fortify)
-[nix-shell]$ export mesonBuildType=debug
-```
-
-(The first line is needed because `fortify` hardening requires at least some optimization.)
-
 ## Debugging the Nix Binary
 
 Obtain your preferred debugger within the development shell:

doc/manual/source/development/documentation.md

@@ -19,11 +19,10 @@ nix-build -E '(import ./.).packages.${builtins.currentSystem}.nix.doc'
 or
 
 ```console
-nix build .#nix-manual
+nix build .#nix^doc
 ```
 
-and open `./result/share/doc/nix/manual/index.html`.
-
+and open `./result-doc/share/doc/nix/manual/index.html`.
 
 To build the manual incrementally, [enter the development shell](./building.md) and run:
 

doc/manual/source/development/testing.md

@@ -30,7 +30,7 @@ The unit tests are defined using the [googletest] and [rapidcheck] frameworks.
 > src
 > ├── libexpr
 > │   ├── meson.build
-> │   ├── include/nix/expr/value/context.hh
+> │   ├── value/context.hh
 > │   ├── value/context.cc
 > │   …
 > │
@@ -46,12 +46,8 @@ The unit tests are defined using the [googletest] and [rapidcheck] frameworks.
 > │   │
 > │   ├── libexpr-test-support
 > │   │   ├── meson.build
-> │   │   ├── include/nix/expr
-> │   │   │   ├── meson.build
-> │   │   │   └── tests
-> │   │   │       ├── value/context.hh
-> │   │   │       …
 > │   │   └── tests
+> │   │       ├── value/context.hh
 > │   │       ├── value/context.cc
 > │   │       …
 > │   │
@@ -63,7 +59,7 @@ The unit tests are defined using the [googletest] and [rapidcheck] frameworks.
 > ```
 
 The tests for each Nix library (`libnixexpr`, `libnixstore`, etc..) live inside a directory `src/${library_name_without-nix}-test`.
-Given an interface (header) and implementation pair in the original library, say, `src/libexpr/include/nix/expr/value/context.hh` and `src/libexpr/value/context.cc`, we write tests for it in `src/libexpr-tests/value/context.cc`, and (possibly) declare/define additional interfaces for testing purposes in `src/libexpr-test-support/include/nix/expr/tests/value/context.hh` and `src/libexpr-test-support/tests/value/context.cc`.
+Given an interface (header) and implementation pair in the original library, say, `src/libexpr/value/context.{hh,cc}`, we write tests for it in `src/libexpr-tests/value/context.cc`, and (possibly) declare/define additional interfaces for testing purposes in `src/libexpr-test-support/tests/value/context.{hh,cc}`.
 
 Data for unit tests is stored in a `data` subdir of the directory for each unit test executable.
 For example, `libnixstore` code is in `src/libstore`, and its test data is in `src/libstore-tests/data`.
@@ -71,7 +67,7 @@ The path to the `src/${library_name_without-nix}-test/data` directory is passed
 Note that each executable only gets the data for its tests.
 
 The unit test libraries are in `src/${library_name_without-nix}-test-support`.
-All headers are in a `tests` subdirectory so they are included with `#include "nix/tests/"`.
+All headers are in a `tests` subdirectory so they are included with `#include "tests/"`.
 
 The use of all these separate directories for the unit tests might seem inconvenient, as for example the tests are not "right next to" the part of the code they are testing.
 But organizing the tests this way has one big benefit:
@@ -91,11 +87,7 @@ A environment variables that Google Test accepts are also worth knowing:
 
    This is used to avoid logging passing tests.
 
-3. [`GTEST_BREAK_ON_FAILURE`](https://google.github.io/googletest/advanced.html#turning-assertion-failures-into-break-points)
-
-   This is used to create a debugger breakpoint when an assertion failure occurs.
-
-Putting the first two together, one might run
+Putting the two together, one might run
 
 ```bash
 GTEST_BRIEF=1 GTEST_FILTER='ErrorTraceTest.*' meson test nix-expr-tests -v
@@ -103,22 +95,6 @@ GTEST_BRIEF=1 GTEST_FILTER='ErrorTraceTest.*' meson test nix-expr-tests -v
 
 for short but comprensive output.
 
-### Debugging tests
-
-For debugging, it is useful to combine the third option above with Meson's [`--gdb`](https://mesonbuild.com/Unit-tests.html#other-test-options) flag:
-
-```bash
-GTEST_BRIEF=1 GTEST_FILTER='Group.my-failing-test' meson test nix-expr-tests --gdb
-```
-
-This will:
-
-1. Run the unit test with GDB
-
-2. Run just `Group.my-failing-test`
-
-3. Stop the program when the test fails, allowing the user to then issue arbitrary commands to GDB.
-
 ### Characterisation testing { #characaterisation-testing-unit }
 
 See [functional characterisation testing](#characterisation-testing-functional) for a broader discussion of characterisation testing.
@@ -168,7 +144,7 @@ $ checkPhase
 
 Sometimes it is useful to group related tests so they can be easily run together without running the entire test suite.
 Each test group is in a subdirectory of `tests`.
-For example, `tests/functional/ca/meson.build` defines a `ca` test group for content-addressing derivation outputs.
+For example, `tests/functional/ca/meson.build` defines a `ca` test group for content-addressed derivation outputs.
 
 That test group can be run like this:
 
@@ -237,10 +213,10 @@ edit it like so:
  bar
 ```
 
-Then, running the test with [`--interactive`](https://mesonbuild.com/Unit-tests.html#other-test-options) will prevent Meson from hijacking the terminal so you can drop you into GDB once the script reaches that point:
+Then, running the test with `./mk/debug-test.sh` will drop you into GDB once the script reaches that point:
 
 ```shell-session
-$ meson test ${testName} --interactive
+$ ./mk/debug-test.sh tests/functional/${testName}.sh
 ...
 + gdb blash blub
 GNU gdb (GDB) 12.1
@@ -321,7 +297,7 @@ Creating a Cachix cache for your installer tests and adding its authorisation to
   - `armv7l-linux`
   - `x86_64-darwin`
 
-- The `installer_test` job (which runs on `ubuntu-24.04` and `macos-14`) will try to install Nix with the cached installer and run a trivial Nix command.
+- The `installer_test` job (which runs on `ubuntu-latest` and `macos-latest`) will try to install Nix with the cached installer and run a trivial Nix command.
 
 ### One-time setup
 

doc/manual/source/glossary.md

@@ -1,13 +1,5 @@
 # Glossary
 
-- [build system]{#gloss-build-system}
-
-  Generic term for software that facilitates the building of software by automating the invocation of compilers, linkers, and other tools.
-
-  Nix can be used as a generic build system.
-  It has no knowledge of any particular programming language or toolchain.
-  These details are specified in [derivation expressions](#gloss-derivation-expression).
-
 - [content address]{#gloss-content-address}
 
   A
@@ -21,62 +13,37 @@
 
     - [Content-Addressing File System Objects](@docroot@/store/file-system-object/content-address.md)
     - [Content-Addressing Store Objects](@docroot@/store/store-object/content-address.md)
-    - [content-addressing derivation](#gloss-content-addressing-derivation)
+    - [content-addressed derivation](#gloss-content-addressed-derivation)
 
   Software Heritage's writing on [*Intrinsic and Extrinsic identifiers*](https://www.softwareheritage.org/2020/07/09/intrinsic-vs-extrinsic-identifiers) is also a good introduction to the value of content-addressing over other referencing schemes.
 
   Besides content addressing, the Nix store also uses [input addressing](#gloss-input-addressed-store-object).
 
-- [content-addressed storage]{#gloss-content-addressed-store}
-
-  The industry term for storage and retrieval systems using [content addressing](#gloss-content-address). A Nix store also has [input addressing](#gloss-input-addressed-store-object), and metadata.
-
 - [derivation]{#gloss-derivation}
 
-  A derivation can be thought of as a [pure function](https://en.wikipedia.org/wiki/Pure_function) that produces new [store objects][store object] from existing store objects.
-
-  Derivations are implemented as [operating system processes that run in a sandbox](@docroot@/store/building.md#builder-execution).
-  This sandbox by default only allows reading from store objects specified as inputs, and only allows writing to designated [outputs][output] to be [captured as store objects](@docroot@/store/building.md#processing-outputs).
-
-  A derivation is typically specified as a [derivation expression] in the [Nix language], and [instantiated][instantiate] to a [store derivation].
-  There are multiple ways of obtaining store objects from store derivatons, collectively called [realisation][realise].
+  A description of a build task. The result of a derivation is a
+  store object. Derivations declared in Nix expressions are specified
+  using the [`derivation` primitive](./language/derivations.md). These are
+  translated into low-level *store derivations* (implicitly by
+  `nix-build`, or explicitly by `nix-instantiate`).
 
   [derivation]: #gloss-derivation
 
 - [store derivation]{#gloss-store-derivation}
 
-  A [derivation] represented as a [store object].
+  A [derivation] represented as a `.drv` file in the [store].
+  It has a [store path], like any [store object].
+  It is the [instantiated][instantiate] form of a derivation.
 
-  See [Store Derivation](@docroot@/store/derivation/index.md#store-derivation) for details.
+  Example: `/nix/store/g946hcz4c8mdvq2g8vxx42z51qb71rvp-git-2.38.1.drv`
+
+  See [`nix derivation show`](./command-ref/new-cli/nix3-derivation-show.md) (experimental) for displaying the contents of store derivations.
 
   [store derivation]: #gloss-store-derivation
 
-- [directed acyclic graph]{#gloss-directed-acyclic-graph}
-
-  A [directed acyclic graph](https://en.wikipedia.org/wiki/Directed_acyclic_graph) (DAG) is graph whose edges are given a direction ("a to b" is not the same edge as "b to a"), and for which no possible path (created by joining together edges) forms a cycle.
-
-  DAGs are very important to Nix.
-  In particular, the non-self-[references][reference] of [store object][store object] form a cycle.
-
-- [derivation path]{#gloss-derivation-path}
-
-  A [store path] which uniquely identifies a [store derivation].
-
-  See [Referencing Store Derivations](@docroot@/store/derivation/index.md#derivation-path) for details.
-
-  Not to be confused with [deriving path].
-
-  [derivation path]: #gloss-derivation-path
-
-- [derivation expression]{#gloss-derivation-expression}
-
-  A description of a [store derivation] using the [`derivation` primitive](./language/derivations.md) in the [Nix language].
-
-  [derivation expression]: #gloss-derivation-expression
-
 - [instantiate]{#gloss-instantiate}, instantiation
 
-  Translate a [derivation expression] into a [store derivation].
+  Save an evaluated [derivation] as a [store derivation] in the Nix [store].
 
   See [`nix-instantiate`](./command-ref/nix-instantiate.md), which produces a store derivation from a Nix expression that evaluates to a derivation.
 
@@ -88,8 +55,9 @@
 
   This can be achieved by:
   - Fetching a pre-built [store object] from a [substituter]
-  - [Building](@docroot@/store/building.md) the corresponding [store derivation]
+  - Running the [`builder`](@docroot@/language/derivations.md#attr-builder) executable as specified in the corresponding [derivation]
   - Delegating to a [remote machine](@docroot@/command-ref/conf-file.md#conf-builders) and retrieving the outputs
+  <!-- TODO: link [running] to build process page, #8888 -->
 
   See [`nix-store --realise`](@docroot@/command-ref/nix-store/realise.md) for a detailed description of the algorithm.
 
@@ -97,7 +65,7 @@
 
   [realise]: #gloss-realise
 
-- [content-addressing derivation]{#gloss-content-addressing-derivation}
+- [content-addressed derivation]{#gloss-content-addressed-derivation}
 
   A derivation which has the
   [`__contentAddressed`](./language/advanced-attributes.md#adv-attr-__contentAddressed)
@@ -105,7 +73,7 @@
 
 - [fixed-output derivation]{#gloss-fixed-output-derivation} (FOD)
 
-  A [store derivation] where a cryptographic hash of the [output] is determined in advance using the [`outputHash`](./language/advanced-attributes.md#adv-attr-outputHash) attribute, and where the [`builder`](@docroot@/language/derivations.md#attr-builder) executable has access to the network.
+  A [derivation] where a cryptographic hash of the [output] is determined in advance using the [`outputHash`](./language/advanced-attributes.md#adv-attr-outputHash) attribute, and where the [`builder`](@docroot@/language/derivations.md#attr-builder) executable has access to the network.
 
 - [store]{#gloss-store}
 
@@ -116,12 +84,6 @@
 
   [store]: #gloss-store
 
-- [Nix instance]{#gloss-nix-instance}
-  <!-- ambiguous -->
-  1. An installation of Nix, which includes the presence of a [store], and the Nix package manager which operates on that store.
-     A local Nix installation and a [remote builder](@docroot@/advanced-topics/distributed-builds.md) are two examples of Nix instances.
-  2. A running Nix process, such as the `nix` command.
-
 - [binary cache]{#gloss-binary-cache}
 
   A *binary cache* is a Nix store which uses a different format: its
@@ -168,17 +130,15 @@
 - [input-addressed store object]{#gloss-input-addressed-store-object}
 
   A store object produced by building a
-  non-[content-addressed](#gloss-content-addressing-derivation),
+  non-[content-addressed](#gloss-content-addressed-derivation),
   non-[fixed-output](#gloss-fixed-output-derivation)
   derivation.
 
-  See [input-addressing derivation outputs](store/derivation/outputs/input-address.md) for details.
-
 - [content-addressed store object]{#gloss-content-addressed-store-object}
 
   A [store object] which is [content-addressed](#gloss-content-address),
   i.e. whose [store path] is determined by its contents.
-  This includes derivations, the outputs of [content-addressing derivations](#gloss-content-addressing-derivation), and the outputs of [fixed-output derivations](#gloss-fixed-output-derivation).
+  This includes derivations, the outputs of [content-addressed derivations](#gloss-content-addressed-derivation), and the outputs of [fixed-output derivations](#gloss-fixed-output-derivation).
 
   See [Content-Addressing Store Objects](@docroot@/store/store-object/content-address.md) for details.
 
@@ -228,37 +188,35 @@
   >
   > The contents of a `.nix` file form a Nix expression.
 
-  Nix expressions specify [derivation expressions][derivation expression], which are [instantiated][instantiate] into the Nix store as [store derivations][store derivation].
+  Nix expressions specify [derivations][derivation], which are [instantiated][instantiate] into the Nix store as [store derivations][store derivation].
   These derivations can then be [realised][realise] to produce [outputs][output].
 
   > **Example**
   >
-  > Building and deploying software using Nix entails writing Nix expressions to describe [packages][package] and compositions thereof.
+  > Building and deploying software using Nix entails writing Nix expressions as a high-level description of packages and compositions thereof.
 
 - [reference]{#gloss-reference}
 
-  An edge from one [store object] to another.
+  A [store object] `O` is said to have a *reference* to a store object `P` if a [store path] to `P` appears in the contents of `O`.
 
-  See [References](@docroot@/store/store-object.md#references) for details.
+  Store objects can refer to both other store objects and themselves.
+  References from a store object to itself are called *self-references*.
+  References other than a self-reference must not form a cycle.
 
   [reference]: #gloss-reference
 
-  See [References](@docroot@/store/store-object.md#references) for details.
-
 - [reachable]{#gloss-reachable}
 
   A store path `Q` is reachable from another store path `P` if `Q`
   is in the *closure* of the *references* relation.
 
-  See [References](@docroot@/store/store-object.md#references) for details.
-
 - [closure]{#gloss-closure}
 
   The closure of a store path is the set of store paths that are
   directly or indirectly “reachable” from that store path; that is,
   it’s the closure of the path under the *references* relation. For
   a package, the closure of its derivation is equivalent to the
-  build-time dependencies, while the closure of its [output path] is
+  build-time dependencies, while the closure of its output path is
   equivalent to its runtime dependencies. For correct deployment it
   is necessary to deploy whole closures, since otherwise at runtime
   files could be missing. The command `nix-store --query --requisites ` prints out
@@ -268,31 +226,18 @@
   to a store object at path `Q`, then `Q` is in the closure of `P`. Further, if `Q`
   references `R` then `R` is also in the closure of `P`.
 
-  See [References](@docroot@/store/store-object.md#references) for details.
-
   [closure]: #gloss-closure
 
-- [requisite]{#gloss-requisite}
-
-  A store object [reachable] by a path (chain of references) from a given [store object].
-  The [closure] is the set of requisites.
-
-  See [References](@docroot@/store/store-object.md#references) for details.
-
-- [referrer]{#gloss-reference}
-
-  A reversed edge from one [store object] to another.
-
 - [output]{#gloss-output}
 
-  A [store object] produced by a [store derivation].
+  A [store object] produced by a [derivation].
   See [the `outputs` argument to the `derivation` function](@docroot@/language/derivations.md#attr-outputs) for details.
 
   [output]: #gloss-output
 
 - [output path]{#gloss-output-path}
 
-  The [store path] to the [output] of a [store derivation].
+  The [store path] to the [output] of a [derivation].
 
   [output path]: #gloss-output-path
 
@@ -301,11 +246,14 @@
 
 - [deriving path]{#gloss-deriving-path}
 
-  Deriving paths are a way to refer to [store objects][store object] that might not yet be [realised][realise].
+  Deriving paths are a way to refer to [store objects][store object] that ar not yet [realised][realise].
+  This is necessary because, in general and particularly for [content-addressed derivations][content-addressed derivation], the [output path] of an [output] is not known in advance.
+  There are two forms:
 
-  See [Deriving Path](./store/derivation/index.md#deriving-path) for details.
+  - *constant*: just a [store path]
+    It can be made [valid][validity] by copying it into the store: from the evaluator, command line interface or another store.
 
-  Not to be confused with [derivation path].
+  - *output*: a pair of a [store path] to a [derivation] and an [output] name.
 
 - [deriver]{#gloss-deriver}
 
@@ -353,7 +301,7 @@
 
   See [Nix Archive](store/file-system-object/content-address.html#serial-nix-archive) for details.
 
-- [`∅`]{#gloss-empty-set}
+- [`∅`]{#gloss-emtpy-set}
 
   The empty set symbol. In the context of profile history, this denotes a package is not present in a particular version of the profile.
 
@@ -363,17 +311,18 @@
 
 - [package]{#package}
 
-  A software package; files that belong together for a particular purpose, and metadata.
+  1. A software package; a collection of files and other data.
 
-  Nix represents files as [file system objects][file system object], and how they belong together is encoded as [references][reference] between [store objects][store object] that contain these file system objects.
+  2. A [package attribute set].
 
-  The [Nix language] allows denoting packages in terms of [attribute sets](@docroot@/language/types.md#attribute-set) containing:
-  - attributes that refer to the files of a package, typically in the form of [derivation outputs](#output),
-  - attributes with metadata, such as information about how the package is supposed to be used.
+- [package attribute set]{#package-attribute-set}
 
-  The exact shape of these attribute sets is up to convention.
+  An [attribute set](@docroot@/language/types.md#attribute-set) containing the attribute `type = "derivation";` (derivation for historical reasons), as well as other attributes, such as
+  - attributes that refer to the files of a [package], typically in the form of [derivation outputs](#output),
+  - attributes that declare something about how the package is supposed to be installed or used,
+  - other metadata or arbitrary attributes.
 
-  [package]: #package
+  [package attribute set]: #package-attribute-set
 
 - [string interpolation]{#gloss-string-interpolation}
 

doc/manual/source/installation/index.md

@@ -30,8 +30,6 @@ $ curl -L https://nixos.org/nix/install | sh -s -- --daemon
 
 > Single-user is not supported on Mac.
 
-> `warning: installing Nix as root is not supported by this script!`
-
 This installation has less requirements than the multi-user install, however it
 cannot offer equivalent sharing, isolation, or security.
 

doc/manual/source/installation/installing-binary.md

@@ -25,7 +25,7 @@ This performs the default type of installation for your platform:
 
 We recommend the multi-user installation if it supports your platform and you can authenticate with `sudo`.
 
-The installer can be configured with various command line arguments and environment variables.
+The installer can configured with various command line arguments and environment variables.
 To show available command line flags:
 
 ```console

doc/manual/source/installation/uninstall.md

@@ -160,6 +160,6 @@ which you may remove.
 To remove a [single-user installation](./installing-binary.md#single-user-installation) of Nix, run:
 
 ```console
-rm -rf /nix ~/.nix-channels ~/.nix-defexpr ~/.nix-profile
+$ rm -rf /nix ~/.nix-channels ~/.nix-defexpr ~/.nix-profile
 ```
 You might also want to manually remove references to Nix from your `~/.profile`.

doc/manual/source/introduction.md

@@ -1,8 +1,8 @@
 # Introduction
 
 Nix is a _purely functional package manager_.  This means that it
-treats packages like values in a purely functional programming language
-— packages are built by functions that don’t have
+treats packages like values in purely functional programming languages
+such as Haskell — they are built by functions that don’t have
 side-effects, and they never change after they have been built.  Nix
 stores packages in the _Nix store_, usually the directory
 `/nix/store`, where each package has its own unique subdirectory such

doc/manual/source/language/advanced-attributes.md

@@ -2,75 +2,6 @@
 
 Derivations can declare some infrequently used optional attributes.
 
-## Inputs
-
-  - [`exportReferencesGraph`]{#adv-attr-exportReferencesGraph}\
-    This attribute allows builders access to the references graph of
-    their inputs. The attribute is a list of inputs in the Nix store
-    whose references graph the builder needs to know. The value of
-    this attribute should be a list of pairs `[ name1 path1 name2
-    path2 ...  ]`. The references graph of each *pathN* will be stored
-    in a text file *nameN* in the temporary build directory. The text
-    files have the format used by `nix-store --register-validity`
-    (with the deriver fields left empty). For example, when the
-    following derivation is built:
-
-    ```nix
-    derivation {
-      ...
-      exportReferencesGraph = [ "libfoo-graph" libfoo ];
-    };
-    ```
-
-    the references graph of `libfoo` is placed in the file
-    `libfoo-graph` in the temporary build directory.
-
-    `exportReferencesGraph` is useful for builders that want to do
-    something with the closure of a store path. Examples include the
-    builders in NixOS that generate the initial ramdisk for booting
-    Linux (a `cpio` archive containing the closure of the boot script)
-    and the ISO-9660 image for the installation CD (which is populated
-    with a Nix store containing the closure of a bootable NixOS
-    configuration).
-
-  - [`passAsFile`]{#adv-attr-passAsFile}\
-    A list of names of attributes that should be passed via files rather
-    than environment variables. For example, if you have
-
-    ```nix
-    passAsFile = ["big"];
-    big = "a very long string";
-    ```
-
-    then when the builder runs, the environment variable `bigPath`
-    will contain the absolute path to a temporary file containing `a
-    very long string`. That is, for any attribute *x* listed in
-    `passAsFile`, Nix will pass an environment variable `xPath`
-    holding the path of the file containing the value of attribute
-    *x*. This is useful when you need to pass large strings to a
-    builder, since most operating systems impose a limit on the size
-    of the environment (typically, a few hundred kilobyte).
-
-  - [`__structuredAttrs`]{#adv-attr-structuredAttrs}\
-    If the special attribute `__structuredAttrs` is set to `true`, the other derivation
-    attributes are serialised into a file in JSON format.
-
-    This obviates the need for [`passAsFile`](#adv-attr-passAsFile) since JSON files have no size restrictions, unlike process environments.
-    It also makes it possible to tweak derivation settings in a structured way;
-    see [`outputChecks`](#adv-attr-outputChecks) for example.
-
-    See the [corresponding section in the derivation page](@docroot@/store/derivation/index.md#structured-attrs) for further details.
-
-    > **Warning**
-    >
-    > If set to `true`, other advanced attributes such as [`allowedReferences`](#adv-attr-allowedReferences), [`allowedRequisites`](#adv-attr-allowedRequisites),
-    [`disallowedReferences`](#adv-attr-disallowedReferences) and [`disallowedRequisites`](#adv-attr-disallowedRequisites), maxSize, and maxClosureSize.
-    will have no effect.
-
-## Output checks
-
-See the [corresponding section in the derivation output page](@docroot@/store/derivation/outputs/index.md).
-
   - [`allowedReferences`]{#adv-attr-allowedReferences}\
     The optional attribute `allowedReferences` specifies a list of legal
     references (dependencies) of the output of the builder. For example,
@@ -124,6 +55,259 @@ See the [corresponding section in the derivation output page](@docroot@/store/de
     dependency on `foobar` or any other derivation depending recursively
     on `foobar`.
 
+  - [`exportReferencesGraph`]{#adv-attr-exportReferencesGraph}\
+    This attribute allows builders access to the references graph of
+    their inputs. The attribute is a list of inputs in the Nix store
+    whose references graph the builder needs to know. The value of
+    this attribute should be a list of pairs `[ name1 path1 name2
+    path2 ...  ]`. The references graph of each *pathN* will be stored
+    in a text file *nameN* in the temporary build directory. The text
+    files have the format used by `nix-store --register-validity`
+    (with the deriver fields left empty). For example, when the
+    following derivation is built:
+
+    ```nix
+    derivation {
+      ...
+      exportReferencesGraph = [ "libfoo-graph" libfoo ];
+    };
+    ```
+
+    the references graph of `libfoo` is placed in the file
+    `libfoo-graph` in the temporary build directory.
+
+    `exportReferencesGraph` is useful for builders that want to do
+    something with the closure of a store path. Examples include the
+    builders in NixOS that generate the initial ramdisk for booting
+    Linux (a `cpio` archive containing the closure of the boot script)
+    and the ISO-9660 image for the installation CD (which is populated
+    with a Nix store containing the closure of a bootable NixOS
+    configuration).
+
+  - [`impureEnvVars`]{#adv-attr-impureEnvVars}\
+    This attribute allows you to specify a list of environment variables
+    that should be passed from the environment of the calling user to
+    the builder. Usually, the environment is cleared completely when the
+    builder is executed, but with this attribute you can allow specific
+    environment variables to be passed unmodified. For example,
+    `fetchurl` in Nixpkgs has the line
+
+    ```nix
+    impureEnvVars = [ "http_proxy" "https_proxy" ... ];
+    ```
+
+    to make it use the proxy server configuration specified by the user
+    in the environment variables `http_proxy` and friends.
+
+    This attribute is only allowed in *fixed-output derivations* (see
+    below), where impurities such as these are okay since (the hash
+    of) the output is known in advance. It is ignored for all other
+    derivations.
+
+    > **Warning**
+    >
+    > `impureEnvVars` implementation takes environment variables from
+    > the current builder process. When a daemon is building its
+    > environmental variables are used. Without the daemon, the
+    > environmental variables come from the environment of the
+    > `nix-build`.
+
+    If the [`configurable-impure-env` experimental
+    feature](@docroot@/development/experimental-features.md#xp-feature-configurable-impure-env)
+    is enabled, these environment variables can also be controlled
+    through the
+    [`impure-env`](@docroot@/command-ref/conf-file.md#conf-impure-env)
+    configuration setting.
+
+  - [`outputHash`]{#adv-attr-outputHash}; [`outputHashAlgo`]{#adv-attr-outputHashAlgo}; [`outputHashMode`]{#adv-attr-outputHashMode}\
+    These attributes declare that the derivation is a so-called *fixed-output derivation* (FOD), which means that a cryptographic hash of the output is already known in advance.
+
+    As opposed to regular derivations, the [`builder`] executable of a fixed-output derivation has access to the network.
+    Nix computes a cryptographic hash of its output and compares that to the hash declared with these attributes.
+    If there is a mismatch, the derivation fails.
+
+    The rationale for fixed-output derivations is derivations such as
+    those produced by the `fetchurl` function. This function downloads a
+    file from a given URL. To ensure that the downloaded file has not
+    been modified, the caller must also specify a cryptographic hash of
+    the file. For example,
+
+    ```nix
+    fetchurl {
+      url = "http://ftp.gnu.org/pub/gnu/hello/hello-2.1.1.tar.gz";
+      sha256 = "1md7jsfd8pa45z73bz1kszpp01yw6x5ljkjk2hx7wl800any6465";
+    }
+    ```
+
+    It sometimes happens that the URL of the file changes, e.g., because
+    servers are reorganised or no longer available. We then must update
+    the call to `fetchurl`, e.g.,
+
+    ```nix
+    fetchurl {
+      url = "ftp://ftp.nluug.nl/pub/gnu/hello/hello-2.1.1.tar.gz";
+      sha256 = "1md7jsfd8pa45z73bz1kszpp01yw6x5ljkjk2hx7wl800any6465";
+    }
+    ```
+
+    If a `fetchurl` derivation was treated like a normal derivation, the
+    output paths of the derivation and *all derivations depending on it*
+    would change. For instance, if we were to change the URL of the
+    Glibc source distribution in Nixpkgs (a package on which almost all
+    other packages depend) massive rebuilds would be needed. This is
+    unfortunate for a change which we know cannot have a real effect as
+    it propagates upwards through the dependency graph.
+
+    For fixed-output derivations, on the other hand, the name of the
+    output path only depends on the `outputHash*` and `name` attributes,
+    while all other attributes are ignored for the purpose of computing
+    the output path. (The `name` attribute is included because it is
+    part of the path.)
+
+    As an example, here is the (simplified) Nix expression for
+    `fetchurl`:
+
+    ```nix
+    { stdenv, curl }: # The curl program is used for downloading.
+
+    { url, sha256 }:
+
+    stdenv.mkDerivation {
+      name = baseNameOf (toString url);
+      builder = ./builder.sh;
+      buildInputs = [ curl ];
+
+      # This is a fixed-output derivation; the output must be a regular
+      # file with SHA256 hash sha256.
+      outputHashMode = "flat";
+      outputHashAlgo = "sha256";
+      outputHash = sha256;
+
+      inherit url;
+    }
+    ```
+
+    The `outputHash` attribute must be a string containing the hash in either hexadecimal or "nix32" encoding, or following the format for integrity metadata as defined by [SRI](https://www.w3.org/TR/SRI/).
+    The "nix32" encoding is an adaptation of base-32 encoding.
+    The [`convertHash`](@docroot@/language/builtins.md#builtins-convertHash) function shows how to convert between different encodings, and the [`nix-hash` command](../command-ref/nix-hash.md) has information about obtaining the hash for some contents, as well as converting to and from encodings.
+
+    The `outputHashAlgo` attribute specifies the hash algorithm used to compute the hash.
+    It can currently be `"sha1"`, `"sha256"`, `"sha512"`, or `null`.
+    `outputHashAlgo` can only be `null` when `outputHash` follows the SRI format.
+
+    The `outputHashMode` attribute determines how the hash is computed.
+    It must be one of the following values:
+
+      - [`"flat"`](@docroot@/store/store-object/content-address.md#method-flat)
+
+        This is the default.
+
+      - [`"recursive"` or `"nar"`](@docroot@/store/store-object/content-address.md#method-nix-archive)
+
+        > **Compatibility**
+        >
+        > `"recursive"` is the traditional way of indicating this,
+        > and is supported since 2005 (virtually the entire history of Nix).
+        > `"nar"` is more clear, and consistent with other parts of Nix (such as the CLI),
+        > however support for it is only added in Nix version 2.21.
+
+      - [`"text"`](@docroot@/store/store-object/content-address.md#method-text)
+
+        > **Warning**
+        >
+        > The use of this method for derivation outputs is part of the [`dynamic-derivations`][xp-feature-dynamic-derivations] experimental feature.
+
+      - [`"git"`](@docroot@/store/store-object/content-address.md#method-git)
+
+        > **Warning**
+        >
+        > This method is part of the [`git-hashing`][xp-feature-git-hashing] experimental feature.
+
+  - [`__contentAddressed`]{#adv-attr-__contentAddressed}
+
+    > **Warning**
+    > This attribute is part of an [experimental feature](@docroot@/development/experimental-features.md).
+    >
+    > To use this attribute, you must enable the
+    > [`ca-derivations`][xp-feature-ca-derivations] experimental feature.
+    > For example, in [nix.conf](../command-ref/conf-file.md) you could add:
+    >
+    > ```
+    > extra-experimental-features = ca-derivations
+    > ```
+
+    If this attribute is set to `true`, then the derivation
+    outputs will be stored in a content-addressed location rather than the
+    traditional input-addressed one.
+
+    Setting this attribute also requires setting
+    [`outputHashMode`](#adv-attr-outputHashMode)
+    and
+    [`outputHashAlgo`](#adv-attr-outputHashAlgo)
+    like for *fixed-output derivations* (see above).
+
+    It also implicitly requires that the machine to build the derivation must have the `ca-derivations` [system feature](@docroot@/command-ref/conf-file.md#conf-system-features).
+
+  - [`passAsFile`]{#adv-attr-passAsFile}\
+    A list of names of attributes that should be passed via files rather
+    than environment variables. For example, if you have
+
+    ```nix
+    passAsFile = ["big"];
+    big = "a very long string";
+    ```
+
+    then when the builder runs, the environment variable `bigPath`
+    will contain the absolute path to a temporary file containing `a
+    very long string`. That is, for any attribute *x* listed in
+    `passAsFile`, Nix will pass an environment variable `xPath`
+    holding the path of the file containing the value of attribute
+    *x*. This is useful when you need to pass large strings to a
+    builder, since most operating systems impose a limit on the size
+    of the environment (typically, a few hundred kilobyte).
+
+  - [`preferLocalBuild`]{#adv-attr-preferLocalBuild}\
+    If this attribute is set to `true` and [distributed building is enabled](@docroot@/command-ref/conf-file.md#conf-builders), then, if possible, the derivation will be built locally instead of being forwarded to a remote machine.
+    This is useful for derivations that are cheapest to build locally.
+
+  - [`allowSubstitutes`]{#adv-attr-allowSubstitutes}\
+    If this attribute is set to `false`, then Nix will always build this derivation (locally or remotely); it will not try to substitute its outputs.
+    This is useful for derivations that are cheaper to build than to substitute.
+
+    This attribute can be ignored by setting [`always-allow-substitutes`](@docroot@/command-ref/conf-file.md#conf-always-allow-substitutes) to `true`.
+
+    > **Note**
+    >
+    > If set to `false`, the [`builder`] should be able to run on the system type specified in the [`system` attribute](./derivations.md#attr-system), since the derivation cannot be substituted.
+
+    [`builder`]: ./derivations.md#attr-builder
+
+  - [`__structuredAttrs`]{#adv-attr-structuredAttrs}\
+    If the special attribute `__structuredAttrs` is set to `true`, the other derivation
+    attributes are serialised into a file in JSON format. The environment variable
+    `NIX_ATTRS_JSON_FILE` points to the exact location of that file both in a build
+    and a [`nix-shell`](../command-ref/nix-shell.md). This obviates the need for
+    [`passAsFile`](#adv-attr-passAsFile) since JSON files have no size restrictions,
+    unlike process environments.
+
+    It also makes it possible to tweak derivation settings in a structured way; see
+    [`outputChecks`](#adv-attr-outputChecks) for example.
+
+    As a convenience to Bash builders,
+    Nix writes a script that initialises shell variables
+    corresponding to all attributes that are representable in Bash. The
+    environment variable `NIX_ATTRS_SH_FILE` points to the exact
+    location of the script, both in a build and a
+    [`nix-shell`](../command-ref/nix-shell.md). This includes non-nested
+    (associative) arrays. For example, the attribute `hardening.format = true`
+    ends up as the Bash associative array element `${hardening[format]}`.
+
+    > **Warning**
+    >
+    > If set to `true`, other advanced attributes such as [`allowedReferences`](#adv-attr-allowedReferences), [`allowedReferences`](#adv-attr-allowedReferences), [`allowedRequisites`](#adv-attr-allowedRequisites),
+    [`disallowedReferences`](#adv-attr-disallowedReferences) and [`disallowedRequisites`](#adv-attr-disallowedRequisites), maxSize, and maxClosureSize.
+    will have no effect.
+
   - [`outputChecks`]{#adv-attr-outputChecks}\
     When using [structured attributes](#adv-attr-structuredAttrs), the `outputChecks`
     attribute allows defining checks per-output.
@@ -157,8 +341,6 @@ See the [corresponding section in the derivation output page](@docroot@/store/de
     };
     ```
 
-## Other output modifications
-
   - [`unsafeDiscardReferences`]{#adv-attr-unsafeDiscardReferences}\
 
     When using [structured attributes](#adv-attr-structuredAttrs), the
@@ -176,24 +358,6 @@ See the [corresponding section in the derivation output page](@docroot@/store/de
     their own embedded Nix store: hashes found inside such an image refer
     to the embedded store and not to the host's Nix store.
 
-## Build scheduling
-
-  - [`preferLocalBuild`]{#adv-attr-preferLocalBuild}\
-    If this attribute is set to `true` and [distributed building is enabled](@docroot@/command-ref/conf-file.md#conf-builders), then, if possible, the derivation will be built locally instead of being forwarded to a remote machine.
-    This is useful for derivations that are cheapest to build locally.
-
-  - [`allowSubstitutes`]{#adv-attr-allowSubstitutes}\
-    If this attribute is set to `false`, then Nix will always build this derivation (locally or remotely); it will not try to substitute its outputs.
-    This is useful for derivations that are cheaper to build than to substitute.
-
-    This attribute can be ignored by setting [`always-allow-substitutes`](@docroot@/command-ref/conf-file.md#conf-always-allow-substitutes) to `true`.
-
-    > **Note**
-    >
-    > If set to `false`, the [`builder`] should be able to run on the system type specified in the [`system` attribute](./derivations.md#attr-system), since the derivation cannot be substituted.
-
-    [`builder`]: ./derivations.md#attr-builder
-
 - [`requiredSystemFeatures`]{#adv-attr-requiredSystemFeatures}\
 
   If a derivation has the `requiredSystemFeatures` attribute, then Nix will only build it on a machine that has the corresponding features set in its [`system-features` configuration](@docroot@/command-ref/conf-file.md#conf-system-features).
@@ -206,171 +370,6 @@ See the [corresponding section in the derivation output page](@docroot@/store/de
 
   ensures that the derivation can only be built on a machine with the `kvm` feature.
 
-# Impure builder configuration
-
-  - [`impureEnvVars`]{#adv-attr-impureEnvVars}\
-    This attribute allows you to specify a list of environment variables
-    that should be passed from the environment of the calling user to
-    the builder. Usually, the environment is cleared completely when the
-    builder is executed, but with this attribute you can allow specific
-    environment variables to be passed unmodified. For example,
-    `fetchurl` in Nixpkgs has the line
-
-    ```nix
-    impureEnvVars = [ "http_proxy" "https_proxy" ... ];
-    ```
-
-    to make it use the proxy server configuration specified by the user
-    in the environment variables `http_proxy` and friends.
-
-    This attribute is only allowed in [fixed-output derivations][fixed-output derivation],
-    where impurities such as these are okay since (the hash
-    of) the output is known in advance. It is ignored for all other
-    derivations.
-
-    > **Warning**
-    >
-    > `impureEnvVars` implementation takes environment variables from
-    > the current builder process. When a daemon is building its
-    > environmental variables are used. Without the daemon, the
-    > environmental variables come from the environment of the
-    > `nix-build`.
-
-    If the [`configurable-impure-env` experimental
-    feature](@docroot@/development/experimental-features.md#xp-feature-configurable-impure-env)
-    is enabled, these environment variables can also be controlled
-    through the
-    [`impure-env`](@docroot@/command-ref/conf-file.md#conf-impure-env)
-    configuration setting.
-
-## Setting the derivation type
-
-As discussed in [Derivation Outputs and Types of Derivations](@docroot@/store/derivation/outputs/index.md), there are multiples kinds of derivations / kinds of derivation outputs.
-The choice of the following attributes determines which kind of derivation we are making.
-
-- [`__contentAddressed`]
-
-- [`outputHash`]
-
-- [`outputHashAlgo`]
-
-- [`outputHashMode`]
-
-The three types of derivations are chosen based on the following combinations of these attributes.
-All other combinations are invalid.
-
-- [Input-addressing derivations](@docroot@/store/derivation/outputs/input-address.md)
-
-  This is the default for `builtins.derivation`.
-  Nix only currently supports one kind of input-addressing, so no other information is needed.
-
-  `__contentAddressed = false;` may also be included, but is not needed, and will trigger the experimental feature check.
-
-- [Fixed-output derivations][fixed-output derivation]
-
-  All of [`outputHash`], [`outputHashAlgo`], and [`outputHashMode`].
-
-  <!--
-
-  `__contentAddressed` is ignored, because fixed-output derivations always content-address their outputs, by definition.
-
-  **TODO CHECK**
-
-  -->
-
-- [(Floating) content-addressing derivations](@docroot@/store/derivation/outputs/content-address.md)
-
-  Both [`outputHashAlgo`] and [`outputHashMode`], `__contentAddressed = true;`, and *not* `outputHash`.
-
-  If an output hash was given, then the derivation output would be "fixed" not "floating".
-
-Here is more information on the `output*` attributes, and what values they may be set to:
-
-  - [`outputHashMode`]{#adv-attr-outputHashMode}
-
-    This specifies how the files of a content-addressing derivation output are digested to produce a content address.
-
-    This works in conjunction with [`outputHashAlgo`](#adv-attr-outputHashAlgo).
-    Specifying one without the other is an error (unless [`outputHash` is also specified and includes its own hash algorithm as described below).
-
-    The `outputHashMode` attribute determines how the hash is computed.
-    It must be one of the following values:
-
-      - [`"flat"`](@docroot@/store/store-object/content-address.md#method-flat)
-
-        This is the default.
-
-      - [`"recursive"` or `"nar"`](@docroot@/store/store-object/content-address.md#method-nix-archive)
-
-        > **Compatibility**
-        >
-        > `"recursive"` is the traditional way of indicating this,
-        > and is supported since 2005 (virtually the entire history of Nix).
-        > `"nar"` is more clear, and consistent with other parts of Nix (such as the CLI),
-        > however support for it is only added in Nix version 2.21.
-
-      - [`"text"`](@docroot@/store/store-object/content-address.md#method-text)
-
-        > **Warning**
-        >
-        > The use of this method for derivation outputs is part of the [`dynamic-derivations`][xp-feature-dynamic-derivations] experimental feature.
-
-      - [`"git"`](@docroot@/store/store-object/content-address.md#method-git)
-
-        > **Warning**
-        >
-        > This method is part of the [`git-hashing`][xp-feature-git-hashing] experimental feature.
-
-    See [content-addressing store objects](@docroot@/store/store-object/content-address.md) for more information about the process this flag controls.
-
-  - [`outputHashAlgo`]{#adv-attr-outputHashAlgo}
-
-    This specifies the hash algorithm used to digest the [file system object] data of a content-addressing derivation output.
-
-    This works in conjunction with [`outputHashMode`](#adv-attr-outputHashAlgo).
-    Specifying one without the other is an error (unless `outputHash` is also specified and includes its own hash algorithm as described below).
-
-    The `outputHashAlgo` attribute specifies the hash algorithm used to compute the hash.
-    It can currently be `"blake3"`, `"sha1"`, `"sha256"`, `"sha512"`, or `null`.
-
-    `outputHashAlgo` can only be `null` when `outputHash` follows the SRI format, because in that case the choice of hash algorithm is determined by `outputHash`.
-
-  - [`outputHash`]{#adv-attr-outputHashAlgo}; [`outputHash`]{#adv-attr-outputHashMode}
-
-    This will specify the output hash of the single output of a [fixed-output derivation].
-
-    The `outputHash` attribute must be a string containing the hash in either hexadecimal or "nix32" encoding, or following the format for integrity metadata as defined by [SRI](https://www.w3.org/TR/SRI/).
-    The "nix32" encoding is an adaptation of base-32 encoding.
-
-    > **Note**
-    >
-    > The [`convertHash`](@docroot@/language/builtins.md#builtins-convertHash) function shows how to convert between different encodings.
-    > The [`nix-hash` command](../command-ref/nix-hash.md) has information about obtaining the hash for some contents, as well as converting to and from encodings.
-
-  - [`__contentAddressed`]{#adv-attr-__contentAddressed}
-
-    > **Warning**
-    >
-    > This attribute is part of an [experimental feature](@docroot@/development/experimental-features.md).
-    >
-    > To use this attribute, you must enable the
-    > [`ca-derivations`][xp-feature-ca-derivations] experimental feature.
-    > For example, in [nix.conf](../command-ref/conf-file.md) you could add:
-    >
-    > ```
-    > extra-experimental-features = ca-derivations
-    > ```
-
-    This is a boolean with a default of `false`.
-    It determines whether the derivation is floating content-addressing.
-
-[`__contentAddressed`]: #adv-attr-__contentAddressed
-[`outputHash`]: #adv-attr-outputHash
-[`outputHashAlgo`]: #adv-attr-outputHashAlgo
-[`outputHashMode`]: #adv-attr-outputHashMode
-
-[fixed-output derivation]: @docroot@/glossary.md#gloss-fixed-output-derivation
-[file system object]: @docroot@/store/file-system-object.md
-[store object]: @docroot@/store/store-object.md
+[xp-feature-ca-derivations]: @docroot@/development/experimental-features.md#xp-feature-ca-derivations
 [xp-feature-dynamic-derivations]: @docroot@/development/experimental-features.md#xp-feature-dynamic-derivations
 [xp-feature-git-hashing]: @docroot@/development/experimental-features.md#xp-feature-git-hashing

doc/manual/source/language/derivations.md

@@ -1,10 +1,9 @@
 # Derivations
 
-The most important built-in function is `derivation`, which is used to describe a single store-layer [store derivation].
-Consult the [store chapter](@docroot@/store/derivation/index.md) for what a store derivation is;
-this section just concerns how to create one from the Nix language.
+The most important built-in function is `derivation`, which is used to describe a single derivation:
+a specification for running an executable on precisely defined input files to repeatably produce output files at uniquely determined file system paths.
 
-This builtin function takes as input an attribute set, the attributes of which specify the inputs to the process.
+It takes as input an attribute set, the attributes of which specify the inputs to the process.
 It outputs an attribute set, and produces a [store derivation] as a side effect of evaluation.
 
 [store derivation]: @docroot@/glossary.md#gloss-store-derivation
@@ -16,7 +15,7 @@ It outputs an attribute set, and produces a [store derivation] as a side effect
 - [`name`]{#attr-name} ([String](@docroot@/language/types.md#type-string))
 
   A symbolic name for the derivation.
-  See [derivation outputs](@docroot@/store/derivation/index.md#outputs) for what this is affects.
+  It is added to the [store path] of the corresponding [store derivation] as well as to its [output paths](@docroot@/glossary.md#gloss-output-path).
 
   [store path]: @docroot@/store/store-path.md
 
@@ -29,12 +28,17 @@ It outputs an attribute set, and produces a [store derivation] as a side effect
   > }
   > ```
   >
-  > The derivation's path will be `/nix/store/<hash>-hello.drv`.
+  > The store derivation's path will be `/nix/store/<hash>-hello.drv`.
   > The [output](#attr-outputs) paths will be of the form `/nix/store/<hash>-hello[-<output>]`
 
 - [`system`]{#attr-system} ([String](@docroot@/language/types.md#type-string))
 
-  See [system](@docroot@/store/derivation/index.md#system).
+  The system type on which the [`builder`](#attr-builder) executable is meant to be run.
+
+  A necessary condition for Nix to build derivations locally is that the `system` attribute matches the current [`system` configuration option].
+  It can automatically [build on other platforms](@docroot@/language/derivations.md#attr-builder) by forwarding build requests to other machines.
+
+  [`system` configuration option]: @docroot@/command-ref/conf-file.md#conf-system
 
   > **Example**
   >
@@ -64,7 +68,7 @@ It outputs an attribute set, and produces a [store derivation] as a side effect
 
 - [`builder`]{#attr-builder} ([Path](@docroot@/language/types.md#type-path) | [String](@docroot@/language/types.md#type-string))
 
-  See [builder](@docroot@/store/derivation/index.md#builder).
+  Path to an executable that will perform the build.
 
   > **Example**
   >
@@ -113,7 +117,7 @@ It outputs an attribute set, and produces a [store derivation] as a side effect
 
   Default: `[ ]`
 
-  See [args](@docroot@/store/derivation/index.md#args).
+  Command-line arguments to be passed to the [`builder`](#attr-builder) executable.
 
   > **Example**
   >
@@ -235,3 +239,77 @@ It outputs an attribute set, and produces a [store derivation] as a side effect
       passed as an empty string.
 
 <!-- FIXME: add a section on output attributes -->
+
+## Builder execution
+
+The [`builder`](#attr-builder) is executed as follows:
+
+- A temporary directory is created under the directory specified by
+  `TMPDIR` (default `/tmp`) where the build will take place. The
+  current directory is changed to this directory.
+
+- The environment is cleared and set to the derivation attributes, as
+  specified above.
+
+- In addition, the following variables are set:
+
+  - `NIX_BUILD_TOP` contains the path of the temporary directory for
+    this build.
+
+  - Also, `TMPDIR`, `TEMPDIR`, `TMP`, `TEMP` are set to point to the
+    temporary directory. This is to prevent the builder from
+    accidentally writing temporary files anywhere else. Doing so
+    might cause interference by other processes.
+
+  - `PATH` is set to `/path-not-set` to prevent shells from
+    initialising it to their built-in default value.
+
+  - `HOME` is set to `/homeless-shelter` to prevent programs from
+    using `/etc/passwd` or the like to find the user's home
+    directory, which could cause impurity. Usually, when `HOME` is
+    set, it is used as the location of the home directory, even if
+    it points to a non-existent path.
+
+  - `NIX_STORE` is set to the path of the top-level Nix store
+    directory (typically, `/nix/store`).
+
+  - `NIX_ATTRS_JSON_FILE` & `NIX_ATTRS_SH_FILE` if `__structuredAttrs`
+    is set to `true` for the derivation. A detailed explanation of this
+    behavior can be found in the
+    [section about structured attrs](./advanced-attributes.md#adv-attr-structuredAttrs).
+
+  - For each output declared in `outputs`, the corresponding
+    environment variable is set to point to the intended path in the
+    Nix store for that output. Each output path is a concatenation
+    of the cryptographic hash of all build inputs, the `name`
+    attribute and the output name. (The output name is omitted if
+    it’s `out`.)
+
+- If an output path already exists, it is removed. Also, locks are
+  acquired to prevent multiple Nix instances from performing the same
+  build at the same time.
+
+- A log of the combined standard output and error is written to
+  `/nix/var/log/nix`.
+
+- The builder is executed with the arguments specified by the
+  attribute `args`. If it exits with exit code 0, it is considered to
+  have succeeded.
+
+- The temporary directory is removed (unless the `-K` option was
+  specified).
+
+- If the build was successful, Nix scans each output path for
+  references to input paths by looking for the hash parts of the input
+  paths. Since these are potential runtime dependencies, Nix registers
+  them as dependencies of the output paths.
+
+- After the build, Nix sets the last-modified timestamp on all files
+  in the build result to 1 (00:00:01 1/1/1970 UTC), sets the group to
+  the default group, and sets the mode of the file to 0444 or 0555
+  (i.e., read-only, with execute permission enabled if the file was
+  originally executable). Note that possible `setuid` and `setgid`
+  bits are cleared. Setuid and setgid programs are not currently
+  supported by Nix. This is because the Nix archives used in
+  deployment have no concept of ownership information, and because it
+  makes the build result dependent on the user performing the build.

doc/manual/source/language/evaluation.md

@@ -1,77 +0,0 @@
-# Evaluation
-
-Evaluation is the process of turning a Nix expression into a [Nix value](types.md).
-
-This happens by a number of rules, such as:
-- Constructing values from literals. 
-  For example the number literal `1` is turned into the number value `1`.
-- Applying operators
-  For example the addition operator `+` is applied to two number values to produce a new number value.
-- Applying built-in functions
-  For example the expression `builtins.isInt 1` is evaluated to `true`.
-- Applying user-defined functions
-  For example the expression `(x: x + 1) 10` can[*](#laziness) be thought of rewriting `x` in the function body to the argument, `10 + 1`, which is then evaluated to `11`.
-
-These rules are applied as needed, driven by the specific use of the expression. For example, this can occur in the Nix command line interface or interactively with the [repl (read-eval-print loop)](@docroot@/command-ref/new-cli/nix3-repl.md), which is a useful tool when learning about evaluation.
-
-# Details
-
-## Values {#values}
-
-Nix values can be thought of as a subset of Nix expressions.
-For example, the expression `1 + 2` is not a value, because it can be reduced to `3`. The expression `3` is a value, because it cannot be reduced any further.
-
-Evaluation normally happens by applying rules to the "head" of the expression, which is the outermost part of the expression. The head of an expression like `[ 1 2 ]` is the list literal (`[ a1 a2 ]`), for `1 + 2` it is the addition operator (`+`), and for `f 1` it is the function application "operator" (` `).
-
-After applying all possible rules to the head until no rules can be applied, the expression is in "weak head normal form" (WHNF). This means that the outermost constructor of the expression is evaluated, but the inner values may or may not be. "Weak" only signifies that the expression may be a function. This is an historical or academic artifact, and Nix has no use for the non-weak "head normal form".
-
-## Laziness and thunks {#laziness}
-
-The Nix language implements _call by need_ (as opposed to _call by value_ or _call by reference_). <!-- No wikipedia link, which would be a huge distraction. --> Call by need is commonly known as laziness in functional programming, as it is a specific implementation of the concept where evaluation is deferred until the result is required, aiming to only evaluate the parts of an expression that are needed to produce the final result.
-
-Furthermore, the result of evaluation is preserved, in values, in `let` bindings, in function _parameters_, which behave a lot like `let` bindings, but with the notable exception of function _calls_. Results of function calls rely on being put into `let` bindings, etc to be reused. <!-- which would be prohibitively expensive and too strict, or we wouldn't have a cache key for the argument -->
-
-When discussing the process of evaluation in lower level terms, we may define values not as a subset of expressions, but separately, where each "value" is either a data constructor, a function or a _thunk_. A thunk is a delayed computation, represented by an expression reference and a "closure" &ndash; the values for the lexical scope around the delayed expression.
-
-As a user of the language, you generally don't have to think about thunks, as they are not part of the language semantics, but you may encounter them in the repl, in the [C API] or in discussions.
-
-## Strictness
-
-Instead of thinking about thunks, it is often more productive to think in terms of _strictness_.
-This term is used in functional programming to refer to the opposite of laziness, i.e. not just for something like error propagation. It refers to the need to evaluate certain expressions before evaluation can produce any result.
-
-Statements about strictness usually implicitly refer to weak head normal form.
-For example, we can say that the following function is strict in its argument:
-
-```nix
-x: isAttrs x || isFunction x
-```
-
-The above function must be strict in its argument `x` because determining its type requires evaluating `x` to at least some degree.
-
-The following function is not strict in its argument:
-
-```nix
-x: { isOk = isAttrs x || isFunction x; }
-```
-
-It is not strict, because it can return the attribute set before evaluating `x`.
-The attribute value for `isOk` _is_ strict in `x`.
-
-A function with a _set pattern_ is always strict in its argument, as a consequence of checking the argument's type and/or attribute names:
-
-```nix
-let f = { ... }: "ok";
-in f (throw "kablam")
-=> error: kablam
-```
-
-However, a set pattern does not add any strictness beyond WHNF of the attribute set argument.
-
-```nix
-let f = orig@{ x, ... }: "ok";
-in f { x = throw "error"; y = throw "error"; }
-=> "ok"
-```
-
-[C API]: @docroot@/c-api.md

doc/manual/source/language/import-from-derivation.md

@@ -71,9 +71,8 @@ Boxes are data structures, arrow labels are transformations.
 |       evaluate       |             |                        |
 |          |           |             |                        |
 |          V           |             |                        |
-|    .------------.    |             |                        |
-|    | derivation |    |             |  .------------------.  |
-|    | expression |----|-instantiate-|->| store derivation |  |
+|    .------------.    |             |  .------------------.  |
+|    | derivation |----|-instantiate-|->| store derivation |  |
 |    '------------'    |             |  '------------------'  |
 |                      |             |           |            |
 |                      |             |        realise         |

doc/manual/source/language/index.md

@@ -1,6 +1,6 @@
 # Nix Language
 
-The Nix language is designed for conveniently creating and composing [derivations](@docroot@/glossary.md#gloss-derivation) – precise descriptions of how contents of existing files are used to derive new files.
+The Nix language is designed for conveniently creating and composing *derivations* – precise descriptions of how contents of existing files are used to derive new files.
 
 > **Tip**
 >
@@ -11,14 +11,7 @@ The language is:
 
 - *domain-specific*
 
-  The Nix language is purpose-built for working with text files.
-  Its most characteristic features are:
-
-  - [File system path primitives](@docroot@/language/types.md#type-path), for accessing source files
-  - [Indented strings](@docroot@/language/string-literals.md) and [string interpolation](@docroot@/language/string-interpolation.md), for creating file contents
-  - [Strings with contexts](@docroot@/language/string-context.md), for transparently linking files
-
-  It comes with [built-in functions](@docroot@/language/builtins.md) to integrate with the [Nix store](@docroot@/store/index.md), which manages files and enables [realising](@docroot@/glossary.md#gloss-realise) derivations declared in the Nix language.
+  It comes with [built-in functions](@docroot@/language/builtins.md) to integrate with the Nix store, which manages files and performs the derivations declared in the Nix language.
 
 - *declarative*
 

doc/manual/source/language/operators.md

@@ -196,7 +196,7 @@ All comparison operators are implemented in terms of `<`, and the following equi
 
 ## Logical implication
 
-Equivalent to `!`*b1* `||` *b2*  (or `if` *b1* `then` *b2* `else true`)
+Equivalent to `!`*b1* `||` *b2*.
 
 [Logical implication]: #logical-implication
 

doc/manual/source/language/string-context.md

@@ -13,8 +13,8 @@ The purpose of string contexts is to collect non-string values attached to strin
 [string concatenation](./operators.md#string-concatenation),
 [string interpolation](./string-interpolation.md),
 and similar operations.
-The idea is that a user can reference other files when creating text files through Nix expressions, without manually keeping track of the exact paths.
-Nix will ensure that the all referenced files are accessible – that all [store paths](@docroot@/glossary.md#gloss-store-path) are [valid](@docroot@/glossary.md#gloss-validity).
+The idea is that a user can combine together values to create a build instructions for derivations without manually keeping track of where they come from.
+Then the Nix language implicitly does that bookkeeping to efficiently obtain the closure of derivation inputs.
 
 > **Note**
 >
@@ -115,7 +115,7 @@ It creates an [attribute set] representing the string context, which can be insp
 
 ## Clearing string contexts
 
-[`builtins.unsafeDiscardStringContext`](./builtins.md#builtins-unsafeDiscardStringContext) will make a copy of a string, but with an empty string context.
+[`buitins.unsafeDiscardStringContext`](./builtins.md#builtins-unsafeDiscardStringContext) will make a copy of a string, but with an empty string context.
 The returned string can be used in more ways, e.g. by operators that require the string context to be empty.
 The requirement to explicitly discard the string context in such use cases helps ensure that string context elements are not lost by mistake.
 The "unsafe" marker is only there to remind that Nix normally guarantees that dependencies are tracked, whereas the returned string has lost them.

doc/manual/source/language/string-interpolation.md

@@ -22,9 +22,9 @@ Rather than writing
 "--with-freetype2-library=" + freetype + "/lib"
 ```
 
-(where `freetype` is a [derivation expression]), you can instead write
+(where `freetype` is a [derivation]), you can instead write
 
-[derivation expression]: @docroot@/glossary.md#gloss-derivation-expression
+[derivation]: @docroot@/glossary.md#gloss-derivation
 
 ```nix
 "--with-freetype2-library=${freetype}/lib"
@@ -148,7 +148,7 @@ An expression that is interpolated must evaluate to one of the following:
   - `__toString` must be a function that takes the attribute set itself and returns a string
   - `outPath` must be a string
 
-  This includes [derivation expressions](./derivations.md) or [flake inputs](@docroot@/command-ref/new-cli/nix3-flake.md#flake-inputs) (experimental).
+  This includes [derivations](./derivations.md) or [flake inputs](@docroot@/command-ref/new-cli/nix3-flake.md#flake-inputs) (experimental).
 
 A string interpolates to itself.
 

doc/manual/source/language/syntax.md

@@ -225,8 +225,8 @@ passed in first , e.g.,
 
 ```nix
 let add = { __functor = self: x: x + self.x; };
-    inc = add // { x = 1; }; # inc is { x = 1; __functor = (...) }
-in inc 1 # equivalent of `add.__functor add 1` i.e. `1 + self.x`
+    inc = add // { x = 1; };
+in inc 1
 ```
 
 evaluates to `2`. This can be used to attach metadata to a function
@@ -443,7 +443,7 @@ three kinds of patterns:
     This works on any set that contains at least the three named
     attributes.
 
-  - It is possible to provide *default values* for attributes, in
+    It is possible to provide *default values* for attributes, in
     which case they are allowed to be missing. A default value is
     specified by writing `name ?  e`, where *e* is an arbitrary
     expression. For example,
@@ -503,45 +503,6 @@ three kinds of patterns:
     > [ 23 {} ]
     > ```
 
-  - All bindings introduced by the function are in scope in the entire function expression; not just in the body.
-    It can therefore be used in default values.
-
-    > **Example**
-    >
-    > A parameter (`x`), is used in the default value for another parameter (`y`):
-    >
-    > ```nix
-    > let
-    >   f = { x, y ? [x] }: { inherit y; };
-    > in
-    >   f { x = 3; }
-    > ```
-    >
-    > This evaluates to:
-    >
-    > ```nix
-    > {
-    >   y = [ 3 ];
-    > }
-    > ```
-
-    > **Example**
-    >
-    > The binding of an `@` pattern, `args`, is used in the default value for a parameter, `x`:
-    >
-    > ```nix
-    > let
-    >   f = args@{ x ? args.a, ... }: x;
-    > in
-    >   f { a = 1; }
-    > ```
-    >
-    > This evaluates to:
-    >
-    > ```nix
-    > 1
-    > ```
-
 Note that functions do not have names. If you want to give them a name,
 you can bind them to an attribute, e.g.,
 

doc/manual/source/protocols/derivation-aterm.md

@@ -1,8 +1,6 @@
 # Derivation "ATerm" file format
 
-For historical reasons, [store derivations][store derivation] are stored on-disk in [ATerm](https://homepages.cwi.nl/~daybuild/daily-books/technology/aterm-guide/aterm-guide.html) format.
-
-## The ATerm format used
+For historical reasons, [derivations](@docroot@/glossary.md#gloss-store-derivation) are stored on-disk in [ATerm](https://homepages.cwi.nl/~daybuild/daily-books/technology/aterm-guide/aterm-guide.html) format.
 
 Derivations are serialised in one of the following formats:
 
@@ -19,20 +17,3 @@ Derivations are serialised in one of the following formats:
   The only `version-string`s that are in use today are for [experimental features](@docroot@/development/experimental-features.md):
 
   - `"xp-dyn-drv"` for the [`dynamic-derivations`](@docroot@/development/experimental-features.md#xp-feature-dynamic-derivations) experimental feature.
-
-## Use for encoding to store object
-
-When derivation is encoded to a [store object] we make the following choices:
-
-- The store path name is the derivation name with `.drv` suffixed at the end
-
-  Indeed, the ATerm format above does *not* contain the name of the derivation, on the assumption that a store path will also be provided out-of-band.
-
-- The derivation is content-addressed using the ["Text" method] of content-addressing derivations
-
-Currently we always encode derivations to store object using the ATerm format (and the previous two choices),
-but we reserve the option to encode new sorts of derivations differently in the future.
-
-[store derivation]: @docroot@/glossary.md#gloss-store-derivation
-[store object]: @docroot@/glossary.md#gloss-store-object
-["Text" method]: @docroot@/store/store-object/content-address.md#method-text

doc/manual/source/protocols/json/derivation.md

@@ -24,7 +24,7 @@ is a JSON object with the following fields:
 
 
   * `method`:
-    For an output which will be [content addressed], a string representing the [method](@docroot@/store/store-object/content-address.md) of content addressing that is chosen.
+    For an output which will be [content addresed], a string representing the [method](@docroot@/store/store-object/content-address.md) of content addressing that is chosen.
     Valid method strings are:
 
     - [`flat`](@docroot@/store/store-object/content-address.md#method-flat)
@@ -35,10 +35,9 @@ is a JSON object with the following fields:
     Otherwise, `null`.
 
   * `hashAlgo`:
-    For an output which will be [content addressed], the name of the hash algorithm used.
+    For an output which will be [content addresed], the name of the hash algorithm used.
     Valid algorithm strings are:
 
-    - `blake3`
     - `md5`
     - `sha1`
     - `sha256`
@@ -91,7 +90,3 @@ is a JSON object with the following fields:
 
 * `env`:
   The environment passed to the `builder`.
-
-* `structuredAttrs`:
-  [Strucutured Attributes](@docroot@/store/derivation/index.md#structured-attrs), only defined if the derivation contains them.
-  Structured attributes are JSON, and thus embedded as-is.

doc/manual/source/protocols/json/store-object-info.md

@@ -41,10 +41,10 @@ In other words, the same store object residing in different store could have dif
 
 * `deriver`:
 
-  If known, the path to the [store derivation] from which this store object was produced.
+  If known, the path to the [derivation] from which this store object was produced.
   Otherwise `null`.
 
-  [store derivation]: @docroot@/glossary.md#gloss-store-derivation
+  [derivation]: @docroot@/glossary.md#gloss-store-derivation
 
 * `registrationTime` (optional):
 

doc/manual/source/protocols/store-path.md

@@ -7,7 +7,7 @@ The format of this specification is close to [Extended Backus–Naur form](https
 Regular users do *not* need to know this information --- store paths can be treated as black boxes computed from the properties of the store objects they refer to.
 But for those interested in exactly how Nix works, e.g. if they are reimplementing it, this information can be useful.
 
-[store path]: @docroot@/store/store-path.md
+[store path](@docroot@/store/store-path.md)
 
 ## Store path proper
 
@@ -20,17 +20,14 @@ where
 
 - `store-dir` = the [store directory](@docroot@/store/store-path.md#store-directory)
 
-- `digest` = base-32 representation of the compressed to 160 bits [SHA-256] hash of `fingerprint`
+- `digest` = base-32 representation of the first 160 bits of a [SHA-256] hash of `fingerprint`
 
-For the definition of the hash compression algorithm, please refer to the section 5.1 of
-the [Nix thesis](https://edolstra.github.io/pubs/phd-thesis.pdf), which also defines the
-specifics of base-32 encoding. Note that base-32 encoding processes the hash bytestring from
-the end, while base-16 processes in from the beginning.
+  This the hash part of the store name
 
 ## Fingerprint
 
 - ```ebnf
-  fingerprint = type ":sha256:" inner-digest ":" store ":" name
+  fingerprint = type ":" sha256 ":" inner-digest ":" store ":" name
   ```
 
   Note that it includes the location of the store as well as the name to make sure that changes to either of those are reflected in the hash
@@ -56,7 +53,7 @@ the end, while base-16 processes in from the beginning.
     method of content addressing store objects,
     if the hash algorithm is [SHA-256].
     Just like in the "Text" case, we can have the store objects referenced by their paths.
-    Additionally, we can have an optional `:self` label to denote self-reference.
+    Additionally, we can have an optional `:self` label to denote self reference.
 
   - ```ebnf
     | "output:" id
@@ -73,8 +70,7 @@ the end, while base-16 processes in from the beginning.
     `id` is the name of the output (usually, "out").
     For content-addressed store objects, `id`, is always "out".
 
-- `inner-digest` = base-16 representation of a SHA-256 hash of `inner-fingerprint`.
-  The base-16 encoding uses lower-cased hex digits.
+- `inner-digest` = base-16 representation of a SHA-256 hash of `inner-fingerprint`
 
 ## Inner fingerprint
 
@@ -86,7 +82,7 @@ the end, while base-16 processes in from the beginning.
 
   - if `type` = `"source:" ...`:
 
-    the [Nix Archive (NAR)] serialization of the [file system object](@docroot@/store/file-system-object.md) of the store object.
+    the hash of the [Nix Archive (NAR)] serialization of the [file system object](@docroot@/store/file-system-object.md) of the store object.
 
   - if `type` = `"output:" id`:
 

doc/manual/source/protocols/tarball-fetcher.md

@@ -46,7 +46,7 @@ defined as the timestamp of the newest file inside the tarball.
 This protocol is supported by Gitea since v1.22.1 and by Forgejo since v7.0.4/v8.0.0 and can be used with the following flake URL schema:
 
 ```
-https://<domain name>/<owner>/<repo>/archive/<reference or revision>.tar.gz
+https://<domain name>/<owner>/<repo>/archive/<reference or revison>.tar.gz
 ```
 
 > **Example**

doc/manual/source/release-notes/rl-0.8.md

@@ -39,29 +39,29 @@ Nix 0.8 has the following improvements:
     notion of “closure store expressions” is gone (and so is the notion
     of “successors”); the file system references of a store path are now
     just stored in the database.
-
+    
     For instance, given any store path, you can query its closure:
-
+    
         $ nix-store -qR $(which firefox)
         ... lots of paths ...
-
+    
     Also, Nix now remembers for each store path the derivation that
     built it (the “deriver”):
-
+    
         $ nix-store -qR $(which firefox)
         /nix/store/4b0jx7vq80l9aqcnkszxhymsf1ffa5jd-firefox-1.0.1.drv
-
+    
     So to see the build-time dependencies, you can do
-
+    
         $ nix-store -qR $(nix-store -qd $(which firefox))
-
+    
     or, in a nicer format:
-
+    
         $ nix-store -q --tree $(nix-store -qd $(which firefox))
-
+    
     File system references are also stored in reverse. For instance, you
     can query all paths that directly or indirectly use a certain Glibc:
-
+    
         $ nix-store -q --referrers-closure \
             /nix/store/8lz9yc6zgmc0vlqmn2ipcpkjlmbi51vv-glibc-2.3.4
 
@@ -92,28 +92,28 @@ Nix 0.8 has the following improvements:
   - `nix-channel` has new operations `--list` and `--remove`.
 
   - New ways of installing components into user environments:
-
+    
       - Copy from another user environment:
-
+        
             $ nix-env -i --from-profile .../other-profile firefox
-
+    
       - Install a store derivation directly (bypassing the Nix
         expression language entirely):
-
+        
             $ nix-env -i /nix/store/z58v41v21xd3...-aterm-2.3.1.drv
-
+        
         (This is used to implement `nix-install-package`, which is
         therefore immune to evolution in the Nix expression language.)
-
+    
       - Install an already built store path directly:
-
+        
             $ nix-env -i /nix/store/hsyj5pbn0d9i...-aterm-2.3.1
-
+    
       - Install the result of a Nix expression specified as a
         command-line argument:
-
+        
             $ nix-env -f .../i686-linux.nix -i -E 'x: x.firefoxWrapper'
-
+        
         The difference with the normal installation mode is that `-E`
         does not use the `name` attributes of derivations. Therefore,
         this can be used to disambiguate multiple derivations with the
@@ -127,7 +127,7 @@ Nix 0.8 has the following improvements:
   - Implemented a concurrent garbage collector. It is now always safe to
     run the garbage collector, even if other Nix operations are
     happening simultaneously.
-
+    
     However, there can still be GC races if you use `nix-instantiate`
     and `nix-store
                     --realise` directly to build things. To prevent races, use the
@@ -147,13 +147,13 @@ Nix 0.8 has the following improvements:
 
   - The behaviour of the garbage collector can be changed globally by
     setting options in `/nix/etc/nix/nix.conf`.
-
+    
       - `gc-keep-derivations` specifies whether deriver links should be
         followed when searching for live paths.
-
+    
       - `gc-keep-outputs` specifies whether outputs of derivations
         should be followed when searching for live paths.
-
+    
       - `env-keep-derivations` specifies whether user environments
         should store the paths of derivations when they are added (thus
         keeping the derivations alive).

doc/manual/source/release-notes/rl-2.0.md

@@ -8,13 +8,13 @@ The following incompatible changes have been made:
     It has been superseded by the binary cache substituter mechanism
     since several years. As a result, the following programs have been
     removed:
-
+    
       - `nix-pull`
-
+    
       - `nix-generate-patches`
-
+    
       - `bsdiff`
-
+    
       - `bspatch`
 
   - The “copy from other stores” substituter mechanism
@@ -58,26 +58,26 @@ This release has the following new features:
     `nix-build`, `nix-shell -p`, `nix-env -qa`, `nix-instantiate
     --eval`, `nix-push` and `nix-copy-closure`. It has the following
     major features:
-
+    
       - Unlike the legacy commands, it has a consistent way to refer to
         packages and package-like arguments (like store paths). For
         example, the following commands all copy the GNU Hello package
         to a remote machine:
-
+        
             nix copy --to ssh://machine nixpkgs.hello
-
+        
             nix copy --to ssh://machine /nix/store/0i2jd68mp5g6h2sa5k9c85rb80sn8hi9-hello-2.10
-
+        
             nix copy --to ssh://machine '(with import <nixpkgs> {}; hello)'
-
+        
         By contrast, `nix-copy-closure` only accepted store paths as
         arguments.
-
+    
       - It is self-documenting: `--help` shows all available
         command-line arguments. If `--help` is given after a subcommand,
         it shows examples for that subcommand. `nix
                                                                         --help-config` shows all configuration options.
-
+    
       - It is much less verbose. By default, it displays a single-line
         progress indicator that shows how many packages are left to be
         built or downloaded, and (if there are running builds) the most
@@ -85,7 +85,7 @@ This release has the following new features:
         last few lines of builder output. The full build log can be
         retrieved using `nix
                                                                         log`.
-
+    
       - It
         [provides](https://github.com/NixOS/nix/commit/b8283773bd64d7da6859ed520ee19867742a03ba)
         all `nix.conf` configuration options as command line flags. For
@@ -93,122 +93,122 @@ This release has the following new features:
                                                                         http-connections 100` you can write `--http-connections 100`.
         Boolean options can be written as `--foo` or `--no-foo` (e.g.
         `--no-auto-optimise-store`).
-
+    
       - Many subcommands have a `--json` flag to write results to stdout
         in JSON format.
-
+    
     > **Warning**
-    >
+    > 
     > Please note that the `nix` command is a work in progress and the
     > interface is subject to change.
-
+    
     It provides the following high-level (“porcelain”) subcommands:
-
+    
       - `nix build` is a replacement for `nix-build`.
-
+    
       - `nix run` executes a command in an environment in which the
         specified packages are available. It is (roughly) a replacement
         for `nix-shell
                                                                         -p`. Unlike that command, it does not execute the command in a
         shell, and has a flag (`-c`) that specifies the unquoted command
         line to be executed.
-
+        
         It is particularly useful in conjunction with chroot stores,
         allowing Linux users who do not have permission to install Nix
         in `/nix/store` to still use binary substitutes that assume
         `/nix/store`. For example,
-
+        
             nix run --store ~/my-nix nixpkgs.hello -c hello --greeting 'Hi everybody!'
-
+        
         downloads (or if not substitutes are available, builds) the GNU
         Hello package into `~/my-nix/nix/store`, then runs `hello` in a
         mount namespace where `~/my-nix/nix/store` is mounted onto
         `/nix/store`.
-
+    
       - `nix search` replaces `nix-env
                                                                         -qa`. It searches the available packages for occurrences of a
         search string in the attribute name, package name or
         description. Unlike `nix-env -qa`, it has a cache to speed up
         subsequent searches.
-
+    
       - `nix copy` copies paths between arbitrary Nix stores,
         generalising `nix-copy-closure` and `nix-push`.
-
+    
       - `nix repl` replaces the external program `nix-repl`. It provides
         an interactive environment for evaluating and building Nix
         expressions. Note that it uses `linenoise-ng` instead of GNU
         Readline.
-
+    
       - `nix upgrade-nix` upgrades Nix to the latest stable version.
         This requires that Nix is installed in a profile. (Thus it won’t
         work on NixOS, or if it’s installed outside of the Nix store.)
-
+    
       - `nix verify` checks whether store paths are unmodified and/or
         “trusted” (see below). It replaces `nix-store --verify` and
         `nix-store
                                                                         --verify-path`.
-
+    
       - `nix log` shows the build log of a package or path. If the
         build log is not available locally, it will try to obtain it
         from the configured substituters (such as
         [cache.nixos.org](https://cache.nixos.org/), which now
         provides build logs).
-
+    
       - `nix edit` opens the source code of a package in your editor.
-
+    
       - `nix eval` replaces `nix-instantiate --eval`.
-
+    
       - `nix
                                                                         why-depends` shows why one store path has another in its
         closure. This is primarily useful to finding the causes of
         closure bloat. For example,
-
+        
             nix why-depends nixpkgs.vlc nixpkgs.libdrm.dev
-
+        
         shows a chain of files and fragments of file contents that cause
         the VLC package to have the “dev” output of `libdrm` in its
         closure — an undesirable situation.
-
+    
       - `nix path-info` shows information about store paths, replacing
         `nix-store -q`. A useful feature is the option `--closure-size`
         (`-S`). For example, the following command show the closure
         sizes of every path in the current NixOS system closure, sorted
         by size:
-
+        
             nix path-info -rS /run/current-system | sort -nk2
-
+    
       - `nix optimise-store` replaces `nix-store --optimise`. The main
         difference is that it has a progress indicator.
-
+    
     A number of low-level (“plumbing”) commands are also available:
-
+    
       - `nix ls-store` and `nix
                                                                         ls-nar` list the contents of a store path or NAR file. The
         former is primarily useful in conjunction with remote stores,
         e.g.
-
+        
             nix ls-store --store https://cache.nixos.org/ -lR /nix/store/0i2jd68mp5g6h2sa5k9c85rb80sn8hi9-hello-2.10
-
+        
         lists the contents of path in a binary cache.
-
+    
       - `nix cat-store` and `nix
                                                                         cat-nar` allow extracting a file from a store path or NAR file.
-
+    
       - `nix dump-path` writes the contents of a store path to stdout in
         NAR format. This replaces `nix-store --dump`.
-
+    
       - `nix
                                                                         show-derivation` displays a store derivation in JSON format.
         This is an alternative to `pp-aterm`.
-
+    
       - `nix
                                                                         add-to-store` replaces `nix-store
                                                                         --add`.
-
+    
       - `nix sign-paths` signs store paths.
-
+    
       - `nix copy-sigs` copies signatures from one store to another.
-
+    
       - `nix show-config` shows all configuration options and their
         current values.
 
@@ -224,11 +224,11 @@ This release has the following new features:
     `nix-copy-closure`, `nix-push` and substitution are all instances
     of the general notion of copying paths between different kinds of
     Nix stores.
-
+    
     Stores are specified using an URI-like syntax, e.g.
     <https://cache.nixos.org/> or <ssh://machine>. The following store
     types are supported:
-
+    
       - `LocalStore` (stori URI `local` or an absolute path) and the
         misnamed `RemoteStore` (`daemon`) provide access to a local Nix
         store, the latter via the Nix daemon. You can use `auto` or the
@@ -236,63 +236,63 @@ This release has the following new features:
         whether you have write permission to the Nix store. It is no
         longer necessary to set the `NIX_REMOTE` environment variable to
         use the Nix daemon.
-
+        
         As noted above, `LocalStore` now supports chroot builds,
         allowing the “physical” location of the Nix store (e.g.
         `/home/alice/nix/store`) to differ from its “logical” location
         (typically `/nix/store`). This allows non-root users to use Nix
         while still getting the benefits from prebuilt binaries from
         [cache.nixos.org](https://cache.nixos.org/).
-
+    
       - `BinaryCacheStore` is the abstract superclass of all binary
         cache stores. It supports writing build logs and NAR content
         listings in JSON format.
-
+    
       - `HttpBinaryCacheStore` (`http://`, `https://`) supports binary
         caches via HTTP or HTTPS. If the server supports `PUT` requests,
         it supports uploading store paths via commands such as `nix
                                                                         copy`.
-
+    
       - `LocalBinaryCacheStore` (`file://`) supports binary caches in
         the local filesystem.
-
+    
       - `S3BinaryCacheStore` (`s3://`) supports binary caches stored in
         Amazon S3, if enabled at compile time.
-
+    
       - `LegacySSHStore` (`ssh://`) is used to implement remote builds
         and `nix-copy-closure`.
-
+    
       - `SSHStore` (`ssh-ng://`) supports arbitrary Nix operations on a
         remote machine via the same protocol used by `nix-daemon`.
 
   - Security has been improved in various ways:
-
+    
       - Nix now stores signatures for local store paths. When paths are
         copied between stores (e.g., copied from a binary cache to a
         local store), signatures are propagated.
-
+        
         Locally-built paths are signed automatically using the secret
         keys specified by the `secret-key-files` store option.
         Secret/public key pairs can be generated using `nix-store
                                                                         --generate-binary-cache-key`.
-
+        
         In addition, locally-built store paths are marked as “ultimately
         trusted”, but this bit is not propagated when paths are copied
         between stores.
-
+    
       - Content-addressable store paths no longer require signatures —
         they can be imported into a store by unprivileged users even if
         they lack signatures.
-
+    
       - The command `nix verify` checks whether the specified paths are
         trusted, i.e., have a certain number of trusted signatures, are
         ultimately trusted, or are content-addressed.
-
+    
       - Substitutions from binary caches
         [now](https://github.com/NixOS/nix/commit/ecbc3fedd3d5bdc5a0e1a0a51b29062f2874ac8b)
         require signatures by default. This was already the case on
         NixOS.
-
+    
       - In Linux sandbox builds, we
         [now](https://github.com/NixOS/nix/commit/eba840c8a13b465ace90172ff76a0db2899ab11b)
         use `/build` instead of `/tmp` as the temporary build directory.
@@ -309,7 +309,7 @@ This release has the following new features:
     hash or commit hash is specified. For example, calls to
     `builtins.fetchGit` are only allowed if a `rev` attribute is
     specified.
-
+    
     The goal of this feature is to enable true reproducibility and
     traceability of builds (including NixOS system configurations) at
     the evaluation level. For example, in the future, `nixos-rebuild`
@@ -367,21 +367,21 @@ This release has the following new features:
     log will be shown if a build fails.
 
   - Networking has been improved:
-
+    
       - HTTP/2 is now supported. This makes binary cache lookups [much
         more
         efficient](https://github.com/NixOS/nix/commit/90ad02bf626b885a5dd8967894e2eafc953bdf92).
-
+    
       - We now retry downloads on many HTTP errors, making binary caches
         substituters more resilient to temporary failures.
-
+    
       - HTTP credentials can now be configured via the standard `netrc`
         mechanism.
-
+    
       - If S3 support is enabled at compile time, <s3://> URIs are
         [supported](https://github.com/NixOS/nix/commit/9ff9c3f2f80ba4108e9c945bbfda2c64735f987b)
         in all places where Nix allows URIs.
-
+    
       - Brotli compression is now supported. In particular,
         [cache.nixos.org](https://cache.nixos.org/) build logs are now compressed
         using Brotli.
@@ -431,9 +431,9 @@ The Nix language has the following new features:
   - Derivation attributes can now reference the outputs of the
     derivation using the `placeholder` builtin function. For example,
     the attribute
-
+    
         configureFlags = "--prefix=${placeholder "out"} --includedir=${placeholder "dev"}";
-
+    
     will cause the `configureFlags` environment variable to contain the
     actual store paths corresponding to the `out` and `dev` outputs.
 
@@ -444,7 +444,7 @@ The following builtin functions are new or extended:
     Nixpkgs, which fetches at build time and cannot be used to fetch Nix
     expressions during evaluation. A typical use case is to import
     external NixOS modules from your configuration, e.g.
-
+    
         imports = [ (builtins.fetchGit https://github.com/edolstra/dwarffs + "/module.nix") ];
 
   - Similarly, `builtins.fetchMercurial` allows you to fetch Mercurial
@@ -485,7 +485,7 @@ The Nix build environment has the following changes:
     builder via the file `.attrs.json` in the builder’s temporary
     directory. This obviates the need for `passAsFile` since JSON files
     have no size restrictions, unlike process environments.
-
+    
     [As a convenience to Bash
     builders](https://github.com/NixOS/nix/commit/2d5b1b24bf70a498e4c0b378704cfdb6471cc699),
     Nix writes a script named `.attrs.sh` to the builder’s directory

doc/manual/source/release-notes/rl-2.19.md

@@ -31,7 +31,7 @@
     - To operate on a flake outside the current directory, you must now pass `--flake path/to/flake`.
 
   - The flake-specific flags `--recreate-lock-file` and `--update-input` have been removed from all commands operating on installables.
-    They are superseded by `nix flake update`.
+    They are superceded by `nix flake update`.
 
 - Commit signature verification for the [`builtins.fetchGit`](@docroot@/language/builtins.md#builtins-fetchGit) is added as the new [`verified-fetches` experimental feature](@docroot@/development/experimental-features.md#xp-feature-verified-fetches).
 

doc/manual/source/release-notes/rl-2.23.md

@@ -15,7 +15,7 @@
 - Modify `nix derivation {add,show}` JSON format [#9866](https://github.com/NixOS/nix/issues/9866) [#10722](https://github.com/NixOS/nix/pull/10722)
 
   The JSON format for derivations has been slightly revised to better conform to our [JSON guidelines](@docroot@/development/cli-guideline.md#returning-future-proof-json).
-  In particular, the hash algorithm and content addressing method of content-addressed derivation outputs are now separated into two fields `hashAlgo` and `method`,
+  In particular, the hash algorithm and content addressing method of content-addresed derivation outputs are now separated into two fields `hashAlgo` and `method`,
   rather than one field with an arcane `:`-separated format.
 
   This JSON format is only used by the experimental `nix derivation` family of commands, at this time.

doc/manual/source/release-notes/rl-2.24.md

@@ -173,7 +173,7 @@
   **Deprecation**: Use `nix32` instead of `base32` as `toHashFormat`
 
   For the builtin `convertHash`, the `toHashFormat` parameter now accepts the same hash formats as the `--to`/`--from`
-  parameters of the `nix hash convert` command: `"base16"`, `"nix32"`, `"base64"`, and `"sri"`. The former `"base32"` value
+  parameters of the `nix hash conert` command: `"base16"`, `"nix32"`, `"base64"`, and `"sri"`. The former `"base32"` value
   remains as a deprecated alias for `"nix32"`. Please convert your code from:
 
   ```nix
@@ -269,7 +269,7 @@
   e.g. `--warn-large-path-threshold 100M`.
 
 
-## Contributors
+# Contributors
 
 This release was made possible by the following 43 contributors:
 

doc/manual/source/release-notes/rl-2.25.md

@@ -77,7 +77,7 @@
   `<nix/fetchurl.nix>` is also known as the builtin derivation builder `builtin:fetchurl`. It's not to be confused with the evaluation-time function `builtins.fetchurl`, which was not affected by this issue.
 
 
-## Contributors
+# Contributors
 
 This release was made possible by the following 58 contributors:
 

doc/manual/source/release-notes/rl-2.26.md

@@ -1,128 +0,0 @@
-# Release 2.26.0 (2025-01-22)
-
-- Support for relative path inputs [#10089](https://github.com/NixOS/nix/pull/10089)
-
-  Flakes can now refer to other flakes in the same repository using relative paths, e.g.
-  ```nix
-  inputs.foo.url = "path:./foo";
-  ```
-  uses the flake in the `foo` subdirectory of the referring flake. For more information, see the documentation on [the `path` flake input type](@docroot@/command-ref/new-cli/nix3-flake.md#path-fetcher).
-
-  This feature required a change to the lock file format. Previous Nix versions will not be able to use lock files that have locks for relative path inputs in them.
-
-- Flake lock file generation now ignores local registries [#12019](https://github.com/NixOS/nix/pull/12019)
-
-  When resolving indirect flake references like `nixpkgs` in `flake.nix` files, Nix will no longer use the system and user flake registries. It will only use the global flake registry and overrides given on the command line via `--override-flake`.
-
-  This avoids accidents where users have local registry overrides that map `nixpkgs` to a `path:` flake in the local file system, which then end up in committed lock files pushed to other users.
-
-  In the future, we may remove the use of the registry during lock file generation altogether. It's better to explicitly specify the URL of a flake input. For example, instead of
-  ```nix
-  {
-    outputs = { self, nixpkgs }: { ... };
-  }
-  ```
-  write
-  ```nix
-  {
-    inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
-    outputs = { self, nixpkgs }: { ... };
-  }
-  ```
-
-- `nix copy` supports `--profile` and `--out-link` [#11657](https://github.com/NixOS/nix/pull/11657)
-
-  The `nix copy` command now has flags `--profile` and `--out-link`, similar to `nix build`. `--profile` makes a profile point to the
-  top-level store path, while `--out-link` create symlinks to the top-level store paths.
-
-  For example, when updating the local NixOS system profile from a NixOS system closure on a remote machine, instead of
-  ```
-  # nix copy --from ssh://server $path
-  # nix build --profile /nix/var/nix/profiles/system $path
-  ```
-  you can now do
-  ```
-  # nix copy --from ssh://server --profile /nix/var/nix/profiles/system $path
-  ```
-  The advantage is that this avoids a time window where *path* is not a garbage collector root, and so could be deleted by a concurrent `nix store gc` process.
-
-- `nix-instantiate --eval` now supports `--raw` [#12119](https://github.com/NixOS/nix/pull/12119)
-
-  The `nix-instantiate --eval` command now supports a `--raw` flag, when used
-  the evaluation result must be a string, which is printed verbatim without
-  quotation marks or escaping.
-
-- Improved `NIX_SSHOPTS` parsing for better SSH option handling [#5181](https://github.com/NixOS/nix/issues/5181) [#12020](https://github.com/NixOS/nix/pull/12020)
-
-  The parsing of the `NIX_SSHOPTS` environment variable has been improved to handle spaces and quotes correctly.
-  Previously, incorrectly split SSH options could cause failures in commands like `nix-copy-closure`,
-  especially when using complex SSH invocations such as `-o ProxyCommand="ssh -W %h:%p ..."`.
-
-  This change introduces a `shellSplitString` function to ensure
-  that `NIX_SSHOPTS` is parsed in a manner consistent with shell
-  behavior, addressing common parsing errors.
-
-  For example, the following now works as expected:
-
-  ```bash
-  export NIX_SSHOPTS='-o ProxyCommand="ssh -W %h:%p ..."'
-  ```
-
-  This update improves the reliability of SSH-related operations using `NIX_SSHOPTS` across Nix CLIs.
-
-- Nix is now built using Meson
-
-  As proposed in [RFC 132](https://github.com/NixOS/rfcs/pull/132), Nix's build system now uses Meson/Ninja. The old Make-based build system has been removed.
-
-- Evaluation caching now works for dirty Git workdirs [#11992](https://github.com/NixOS/nix/pull/11992)
-
-## Contributors
-
-This release was made possible by the following 45 contributors:
-
-- Anatoli Babenia [**(@abitrolly)**](https://github.com/abitrolly)
-- Domagoj Mišković [**(@allrealmsoflife)**](https://github.com/allrealmsoflife)
-- Yaroslav Bolyukin [**(@CertainLach)**](https://github.com/CertainLach)
-- bryango [**(@bryango)**](https://github.com/bryango)
-- tomberek [**(@tomberek)**](https://github.com/tomberek)
-- Matej Urbas [**(@mupdt)**](https://github.com/mupdt)
-- elikoga [**(@elikoga)**](https://github.com/elikoga)
-- wh0 [**(@wh0)**](https://github.com/wh0)
-- Félix [**(@picnoir)**](https://github.com/picnoir)
-- Valentin Gagarin [**(@fricklerhandwerk)**](https://github.com/fricklerhandwerk)
-- Gavin John [**(@Pandapip1)**](https://github.com/Pandapip1)
-- Travis A. Everett [**(@abathur)**](https://github.com/abathur)
-- Vladimir Panteleev [**(@CyberShadow)**](https://github.com/CyberShadow)
-- Ilja [**(@suruaku)**](https://github.com/suruaku)
-- Jason Yundt [**(@Jayman2000)**](https://github.com/Jayman2000)
-- Mike Kusold [**(@kusold)**](https://github.com/kusold)
-- Andy Hamon [**(@andrewhamon)**](https://github.com/andrewhamon)
-- Brian McKenna [**(@puffnfresh)**](https://github.com/puffnfresh)
-- Greg Curtis [**(@gcurtis)**](https://github.com/gcurtis)
-- Andrew Poelstra [**(@apoelstra)**](https://github.com/apoelstra)
-- Linus Heckemann [**(@lheckemann)**](https://github.com/lheckemann)
-- Tristan Ross [**(@RossComputerGuy)**](https://github.com/RossComputerGuy)
-- Dominique Martinet [**(@martinetd)**](https://github.com/martinetd)
-- h0nIg [**(@h0nIg)**](https://github.com/h0nIg)
-- Eelco Dolstra [**(@edolstra)**](https://github.com/edolstra)
-- Shahar "Dawn" Or [**(@mightyiam)**](https://github.com/mightyiam)
-- NAHO [**(@trueNAHO)**](https://github.com/trueNAHO)
-- Ryan Hendrickson [**(@rhendric)**](https://github.com/rhendric)
-- the-sun-will-rise-tomorrow [**(@the-sun-will-rise-tomorrow)**](https://github.com/the-sun-will-rise-tomorrow)
-- Connor Baker [**(@ConnorBaker)**](https://github.com/ConnorBaker)
-- Cole Helbling [**(@cole-h)**](https://github.com/cole-h)
-- Jack Wilsdon [**(@jackwilsdon)**](https://github.com/jackwilsdon)
-- ‮rekcäH nitraM‮ [**(@dwt)**](https://github.com/dwt)
-- Martin Fischer [**(@not-my-profile)**](https://github.com/not-my-profile)
-- John Ericson [**(@Ericson2314)**](https://github.com/Ericson2314)
-- Graham Christensen [**(@grahamc)**](https://github.com/grahamc)
-- Sergei Zimmerman [**(@xokdvium)**](https://github.com/xokdvium)
-- Siddarth Kumar [**(@siddarthkay)**](https://github.com/siddarthkay)
-- Sergei Trofimovich [**(@trofi)**](https://github.com/trofi)
-- Robert Hensing [**(@roberth)**](https://github.com/roberth)
-- Mutsuha Asada [**(@momeemt)**](https://github.com/momeemt)
-- Parker Jones [**(@knotapun)**](https://github.com/knotapun)
-- Jörg Thalheim [**(@Mic92)**](https://github.com/Mic92)
-- dbdr [**(@dbdr)**](https://github.com/dbdr)
-- myclevorname [**(@myclevorname)**](https://github.com/myclevorname)
-- Philipp Otterbein

doc/manual/source/release-notes/rl-2.27.md

@@ -1,75 +0,0 @@
-# Release 2.27.0 (2025-03-03)
-
-- `inputs.self.submodules` flake attribute [#12421](https://github.com/NixOS/nix/pull/12421)
-
-  Flakes in Git repositories can now declare that they need Git submodules to be enabled:
-  ```
-  {
-    inputs.self.submodules = true;
-  }
-  ```
-  Thus, it's no longer needed for the caller of the flake to pass `submodules = true`.
-
-- Git LFS support [#10153](https://github.com/NixOS/nix/pull/10153) [#12468](https://github.com/NixOS/nix/pull/12468)
-
-  The Git fetcher now supports Large File Storage (LFS). This can be enabled by passing the attribute `lfs = true` to the fetcher, e.g.
-  ```console
-  nix flake prefetch 'git+ssh://git@github.com/Apress/repo-with-large-file-storage.git?lfs=1'
-  ```
-
-  A flake can also declare that it requires LFS to be enabled:
-  ```
-  {
-    inputs.self.lfs = true;
-  }
-  ```
-
-  Author: [**@b-camacho**](https://github.com/b-camacho), [**@kip93**](https://github.com/kip93)
-
-- Handle the case where a chroot store is used and some inputs are in the "host" `/nix/store` [#12512](https://github.com/NixOS/nix/pull/12512)
-
-  The evaluator now presents a "union" filesystem view of the `/nix/store` in the host and the chroot.
-
-  This change also removes some hacks that broke `builtins.{path,filterSource}` in chroot stores [#11503](https://github.com/NixOS/nix/issues/11503).
-
-- `nix flake prefetch` now has a `--out-link` option [#12443](https://github.com/NixOS/nix/pull/12443)
-
-- Set `FD_CLOEXEC` on sockets created by curl [#12439](https://github.com/NixOS/nix/pull/12439)
-
-  Curl created sockets without setting `FD_CLOEXEC`/`SOCK_CLOEXEC`. This could previously cause connections to remain open forever when using commands like `nix shell`. This change sets the `FD_CLOEXEC` flag using a `CURLOPT_SOCKOPTFUNCTION` callback.
-
-- Add BLAKE3 hash algorithm [#12379](https://github.com/NixOS/nix/pull/12379)
-
-  Nix now supports the BLAKE3 hash algorithm as an experimental feature (`blake3-hashes`):
-
-  ```console
-  # nix hash file ./file --type blake3 --extra-experimental-features blake3-hashes
-  blake3-34P4p+iZXcbbyB1i4uoF7eWCGcZHjmaRn6Y7QdynLwU=
-  ```
-
-## Contributors
-
-This release was made possible by the following 21 contributors:
-
-- Aiden Fox Ivey [**(@aidenfoxivey)**](https://github.com/aidenfoxivey)
-- Ben Millwood [**(@bmillwood)**](https://github.com/bmillwood)
-- Brian Camacho [**(@b-camacho)**](https://github.com/b-camacho)
-- Brian McKenna [**(@puffnfresh)**](https://github.com/puffnfresh)
-- Eelco Dolstra [**(@edolstra)**](https://github.com/edolstra)
-- Fabian Möller [**(@B4dM4n)**](https://github.com/B4dM4n)
-- Illia Bobyr [**(@ilya-bobyr)**](https://github.com/ilya-bobyr)
-- Ivan Trubach [**(@tie)**](https://github.com/tie)
-- John Ericson [**(@Ericson2314)**](https://github.com/Ericson2314)
-- Jörg Thalheim [**(@Mic92)**](https://github.com/Mic92)
-- Leandro Emmanuel Reina Kiperman [**(@kip93)**](https://github.com/kip93)
-- MaxHearnden [**(@MaxHearnden)**](https://github.com/MaxHearnden)
-- Philipp Otterbein
-- Robert Hensing [**(@roberth)**](https://github.com/roberth)
-- Sandro [**(@SuperSandro2000)**](https://github.com/SuperSandro2000)
-- Sergei Zimmerman [**(@xokdvium)**](https://github.com/xokdvium)
-- Silvan Mosberger [**(@infinisil)**](https://github.com/infinisil)
-- Someone [**(@SomeoneSerge)**](https://github.com/SomeoneSerge)
-- Steve Walker [**(@stevalkr)**](https://github.com/stevalkr)
-- bcamacho2 [**(@bcamacho2)**](https://github.com/bcamacho2)
-- silvanshade [**(@silvanshade)**](https://github.com/silvanshade)
-- tomberek [**(@tomberek)**](https://github.com/tomberek)

doc/manual/source/release-notes/rl-2.28.md

@@ -1,105 +0,0 @@
-# Release 2.28.0 (2025-04-02)
-
-This is an atypical release, and for almost all intents and purposes, it is just a continuation of 2.27; not a feature release.
-
-We had originally set the goal of making 2.27 the Nixpkgs default for NixOS 25.05, but dependents that link to Nix need certain _interface breaking_ changes in the C++ headers. This is not something we should do in a patch release, so this is why we branched 2.28 right off 2.27 instead of `master`.
-
-This completes the infrastructure overhaul for the [RFC 132](https://github.com/NixOS/rfcs/blob/master/rfcs/0132-meson-builds-nix.md) switchover to meson as our build system.
-
-## Major changes
-
-- Unstable C++ API reworked
-  [#12836](https://github.com/NixOS/nix/pull/12836)
-  [#12798](https://github.com/NixOS/nix/pull/12798)
-  [#12773](https://github.com/NixOS/nix/pull/12773)
-
-  Now the C++ interface confirms to common conventions much better than before:
-
-  - All headers are expected to be included with the initial `nix/`, e.g. as `#include "nix/....hh"` (what Nix's headers now do) or `#include <nix/....hh>` (what downstream projects may choose to do).
-    Likewise, the pkg-config files have `-I${includedir}` not `-I${includedir}/nix` or similar.
-
-    Including without the `nix/` like before sometimes worked because of how for `#include` C pre-process checks the directory containing the current file, not just the lookup path, but this was not reliable.
-
-  - All configuration headers are included explicitly by the (regular) headers that need them.
-    There is no more need to pass `-include` to force additional files to be included.
-
-  - The public, installed configuration headers no longer contain implementation-specific details that are not relevant to the API.
-    The vast majority of definitions that were previously in there are now moved to new headers that are not installed, but used during Nix's own compilation only.
-    The remaining macro definitions are renamed to have `NIX_` as a prefix.
-
-  - The name of the Nix component the header comes from
-    (e.g. `util`, `store`, `expr`, `flake`, etc.)
-    is now part of the path to the header, coming after `nix` and before the header name
-    (or rest of the header path, if it is already in a directory).
-
-  Here is a contrived diff showing a few of these changes at once:
-
-  ```diff
-  @@ @@
-  -#include "derived-path.hh"
-  +#include "nix/store/derived-path.hh"
-  @@ @@
-  +// Would include for the variables used before. But when other headers
-  +// need these variables. those will include these config themselves.
-  +#include "nix/store/config.hh"
-  +#include "nix/expr/config.hh"
-  @@ @@
-  -#include "config.hh"
-  +// Additionally renamed to distinguish from components' config headers.
-  +#include "nix/util/configuration.hh"
-  @@ @@
-  -#if HAVE_ACL_SUPPORT
-  +#if NIX_SUPPORT_ACL
-  @@ @@
-  -#if HAVE_BOEHMGC
-  +#if NIX_USE_BOEHMGC
-  @@ @@
-   #endif
-   #endif
-  @@ @@
-  -const char *s = "hi from " SYSTEM;
-  +const char *s = "hi from " NIX_LOCAL_SYSTEM;
-  ```
-
-- C API `nix_flake_init_global` removed [#5638](https://github.com/NixOS/nix/issues/5638) [#12759](https://github.com/NixOS/nix/pull/12759)
-
-  In order to improve the modularity of the code base, we are removing a use of global state, and therefore the `nix_flake_init_global` function.
-
-  Instead, use `nix_flake_settings_add_to_eval_state_builder`.
-  For example:
-
-  ```diff
-  -    nix_flake_init_global(ctx, settings);
-  -    HANDLE_ERROR(ctx);
-  -
-       nix_eval_state_builder * builder = nix_eval_state_builder_new(ctx, store);
-       HANDLE_ERROR(ctx);
-
-  +    nix_flake_settings_add_to_eval_state_builder(ctx, settings, builder);
-  +    HANDLE_ERROR(ctx);
-  ```
-
-  Although this change is not as critical, we figured it would be good to do this API change at the same time, also.
-  Also note that we try to keep the C API compatible, but we decided to break this function because it was young and likely not in widespread use yet. This frees up time to make important progress on the rest of the C API.
-
-## Contributors
-
-This earlier-than-usual release was made possible by the following 16 contributors:
-
-- Farid Zakaria [**(@fzakaria)**](https://github.com/fzakaria)
-- Jörg Thalheim [**(@Mic92)**](https://github.com/Mic92)
-- Eelco Dolstra [**(@edolstra)**](https://github.com/edolstra)
-- Graham Christensen [**(@grahamc)**](https://github.com/grahamc)
-- Thomas Miedema [**(@thomie)**](https://github.com/thomie)
-- Brian McKenna [**(@puffnfresh)**](https://github.com/puffnfresh)
-- Sergei Trofimovich [**(@trofi)**](https://github.com/trofi)
-- Dmitry Bogatov [**(@KAction)**](https://github.com/KAction)
-- Erik Nygren [**(@Kirens)**](https://github.com/Kirens)
-- John Ericson [**(@Ericson2314)**](https://github.com/Ericson2314)
-- Sergei Zimmerman [**(@xokdvium)**](https://github.com/xokdvium)
-- Ruby Rose [**(@oldshensheep)**](https://github.com/oldshensheep)
-- Robert Hensing [**(@roberth)**](https://github.com/roberth)
-- jade [**(@lf-)**](https://github.com/lf-)
-- Félix [**(@picnoir)**](https://github.com/picnoir)
-- Valentin Gagarin [**(@fricklerhandwerk)**](https://github.com/fricklerhandwerk)
-- Dmitry Bogatov

doc/manual/source/release-notes/rl-2.29.md

@@ -1,160 +0,0 @@
-# Release 2.29.0 (2025-05-14)
-
-After the special backport-based release of Nix 2.28 (timed to coincide with Nixpkgs 25.05), the release process is back to normal with 2.29.
-As such, we have slightly more weeks of work from `master` (since 2.28 was branched from 2.27) than usual.
-This fact is counterbalanced by the fact that most of those changes are bug fixes rather than larger new features.
-
-- Prettified JSON output on the terminal [#12555](https://github.com/NixOS/nix/issues/12555) [#12652](https://github.com/NixOS/nix/pull/12652)
-
-  This makes the output easier to read.
-
-  Scripts are mostly unaffected because for those, stdout will be a file or a pipe, not a terminal, and for those, the old single-line behavior applies.
-
-  `--json --pretty` can be passed to enable it even if the output is not a terminal.
-  If your script creates a pseudoterminal for Nix's stdout, you can pass `--no-pretty` to disable the new behavior.
-
-- Repl: improve continuation prompt for incomplete expressions [#12846](https://github.com/NixOS/nix/pull/12846)
-
-  Improved REPL user experience by updating the continuation prompt from invisible blank spaces to a visible `" > "`, enhancing clarity when entering multi-line expressions.
-
-- REPL `:load-flake` and `:reload` now work together [#8753](https://github.com/NixOS/nix/issues/8753) [#13180](https://github.com/NixOS/nix/pull/13180)
-
-  Previously, `:reload` only reloaded the files specified with `:load` (or on the command line).
-  Now, it also works with the flakes specified with `:load-flake` (or on the command line).
-  This makes it correctly reload everything that was previously loaded, regardless of what sort of thing (plain file or flake) each item is.
-
-- Increase retry delays on HTTP 429 Too Many Requests [#13052](https://github.com/NixOS/nix/pull/13052)
-
-  When downloading Nix, the retry delay was previously set to 0.25 seconds. It has now been increased to 1 minute to better handle transient CI errors, particularly on GitHub.
-
-- S3: opt-in the STSProfileCredentialsProvider [#12646](https://github.com/NixOS/nix/pull/12646)
-
-  Added support for STS-based authentication for S3-based binary caches, i.e. enabling seamless integration with `aws sso login`.
-
-- Reduce connect timeout for http substituter [#12876](https://github.com/NixOS/nix/pull/12876)
-
-  Previously, the Nix setting `connect-timeout` had no limit. It is now set to `5s`, offering a more practical default for users self-hosting binary caches, which may occasionally become unavailable, such as during updates.
-
-
-- C API: functions for locking and loading a flake [#10435](https://github.com/NixOS/nix/issues/10435) [#12877](https://github.com/NixOS/nix/pull/12877) [#13098](https://github.com/NixOS/nix/pull/13098)
-
-  This release adds functions to the C API for handling the loading of flakes. Previously, this had to be worked around by using `builtins.getFlake`.
-  C API consumers and language bindings now have access to basic locking functionality.
-
-  It does not expose the full locking API, so that the implementation can evolve more freely.
-  Locking is controlled with the functions, which cover the common use cases for consuming a flake:
-  - `nix_flake_lock_flags_set_mode_check`
-  - `nix_flake_lock_flags_set_mode_virtual`
-  - `nix_flake_lock_flags_set_mode_write_as_needed`
-  - `nix_flake_lock_flags_add_input_override`, which also enables `virtual`
-
-  This change also introduces the new `nix-fetchers-c` library, whose single purpose for now is to manage the (`nix.conf`) settings for the built-in fetchers.
-
-  More details can be found in the [C API documentation](@docroot@/c-api.md).
-
-- No longer copy flakes that are in the nix store [#10435](https://github.com/NixOS/nix/issues/10435) [#12877](https://github.com/NixOS/nix/pull/12877) [#13098](https://github.com/NixOS/nix/pull/13098)
-
-  Previously, we would duplicate entries like `path:/nix/store/*` back into the Nix store.
-  This was prominently visible for pinned system flake registry entries in NixOS, e.g., when running `nix run nixpkgs#hello`.
-
-- Consistently preserve error messages from cached evaluation [#12762](https://github.com/NixOS/nix/issues/12762) [#12809](https://github.com/NixOS/nix/pull/12809)
-
-  In one code path, we are not returning the errors cached from prior evaluation, but instead throwing generic errors stemming from the lack of value (due to the error).
-  These generic error messages were far less informative.
-  Now we consistently return the original error message.
-
-- Faster blake3 hashing [#12676](https://github.com/NixOS/nix/pull/12676)
-
-  The implementation for blake3 hashing is now multi-threaded and used memory-mapped IO.
-  Benchmark results can be found the [pull request](https://github.com/NixOS/nix/pull/12676).
-
-- Fix progress bar for S3 binary caches and make file transfers interruptible [#12877](https://github.com/NixOS/nix/issues/12877) [#13098](https://github.com/NixOS/nix/issues/13098) [#12538](https://github.com/NixOS/nix/pull/12538)
-
-  The progress bar now correctly display upload/download progress for S3 up/downloads. S3 uploads are now interruptible.
-
-- Add host attribute of github/gitlab flakerefs to URL serialization [#12580](https://github.com/NixOS/nix/pull/12580)
-
-  Resolved an issue where `github:` or `gitlab:` URLs lost their `host` attribute when written to a lockfile, resulting in invalid URLs.
-
-- Multiple signatures support in store urls [#12976](https://github.com/NixOS/nix/pull/12976)
-
-  Added support for a `secretKeyFiles` URI parameter in Nix store URIs, allowing multiple signing key files to be specified as a comma-separated list.
-  This enables signing paths with multiple keys. This helps with [RFC #149](https://github.com/NixOS/rfcs/pull/149) to enable binary cache key rotation in the NixOS infra.
-
-  Example usage:
-
-  ```bash
-  nix copy --to "file:///tmp/store?secret-keys=/tmp/key1,/tmp/key2" \
-    "$(nix build --print-out-paths nixpkgs#hello)"
-  ```
-
-- nix flake show now skips over import-from-derivation [#4265](https://github.com/NixOS/nix/issues/4265) [#12583](https://github.com/NixOS/nix/pull/12583)
-
-  Previously, if a flake contained outputs relying on [import from derivation](@docroot@/language/import-from-derivation.md) during evaluation, `nix flake show` would fail to display the rest of the flake. The updated behavior skips such outputs, allowing the rest of the flake to be shown.
-
-- Add `nix formatter build` and `nix formatter run` commands [#13063](https://github.com/NixOS/nix/pull/13063)
-
-  `nix formatter run` is an alias for `nix fmt`. Nothing new there.
-
-  `nix formatter build` is sort of like `nix build`: it builds, links, and prints a path to the formatter program:
-
-  ```
-  $ nix formatter build
-  /nix/store/cb9w44vkhk2x4adfxwgdkkf5gjmm856j-treefmt/bin/treefmt
-  ```
-
-  Note that unlike `nix build`, this prints the full path to the program, not just the store path (in the example above that would be `/nix/store/cb9w44vkhk2x4adfxwgdkkf5gjmm856j-treefmt`).
-
-- Amend OSC 8 escape stripping for xterm-style separator [#13109](https://github.com/NixOS/nix/pull/13109)
-
-  Improve terminal escape code filtering to understand a second type of hyperlink escape codes.
-  This in particular prevents parts of GCC 14's diagnostics from being improperly filtered away.
-
-
-## Contributors
-
-
-This release was made possible by the following 40 contributors:
-
-- Farid Zakaria [**(@fzakaria)**](https://github.com/fzakaria)
-- The Tumultuous Unicorn Of Darkness [**(@TheTumultuousUnicornOfDarkness)**](https://github.com/TheTumultuousUnicornOfDarkness)
-- Robert Hensing [**(@roberth)**](https://github.com/roberth)
-- Félix [**(@picnoir)**](https://github.com/picnoir)
-- Valentin Gagarin [**(@fricklerhandwerk)**](https://github.com/fricklerhandwerk)
-- Eelco Dolstra [**(@edolstra)**](https://github.com/edolstra)
-- Vincent Breitmoser [**(@Valodim)**](https://github.com/Valodim)
-- Brian McKenna [**(@puffnfresh)**](https://github.com/puffnfresh)
-- ulucs [**(@ulucs)**](https://github.com/ulucs)
-- John Ericson [**(@Ericson2314)**](https://github.com/Ericson2314)
-- Andrey Butirsky [**(@bam80)**](https://github.com/bam80)
-- Dean De Leo [**(@whatsthecraic)**](https://github.com/whatsthecraic)
-- Las Safin [**(@L-as)**](https://github.com/L-as)
-- Sergei Zimmerman [**(@xokdvium)**](https://github.com/xokdvium)
-- Shahar "Dawn" Or [**(@mightyiam)**](https://github.com/mightyiam)
-- Ryan Hendrickson [**(@rhendric)**](https://github.com/rhendric)
-- Rodney Lorrimar [**(@rvl)**](https://github.com/rvl)
-- Erik Nygren [**(@Kirens)**](https://github.com/Kirens)
-- Cole Helbling [**(@cole-h)**](https://github.com/cole-h)
-- Martin Fischer [**(@not-my-profile)**](https://github.com/not-my-profile)
-- Graham Christensen [**(@grahamc)**](https://github.com/grahamc)
-- Vit Gottwald [**(@VitGottwald)**](https://github.com/VitGottwald)
-- silvanshade [**(@silvanshade)**](https://github.com/silvanshade)
-- Illia Bobyr [**(@ilya-bobyr)**](https://github.com/ilya-bobyr)
-- Jeremy Fleischman [**(@jfly)**](https://github.com/jfly)
-- Ruby Rose [**(@oldshensheep)**](https://github.com/oldshensheep)
-- Sergei Trofimovich [**(@trofi)**](https://github.com/trofi)
-- Tim [**(@Jaculabilis)**](https://github.com/Jaculabilis)
-- Anthony Wang [**(@anthowan)**](https://github.com/anthowan)
-- Jörg Thalheim [**(@Mic92)**](https://github.com/Mic92)
-- Sandro [**(@SuperSandro2000)**](https://github.com/SuperSandro2000)
-- tomberek [**(@tomberek)**](https://github.com/tomberek)
-- Dmitry Bogatov [**(@KAction)**](https://github.com/KAction)
-- Sizhe Zhao [**(@Prince213)**](https://github.com/Prince213)
-- jade [**(@lf-)**](https://github.com/lf-)
-- Pierre-Etienne Meunier [**(@P-E-Meunier)**](https://github.com/P-E-Meunier)
-- Alexander Romanov [**(@ajlekcahdp4)**](https://github.com/ajlekcahdp4)
-- Domagoj Mišković [**(@allrealmsoflife)**](https://github.com/allrealmsoflife)
-- Thomas Miedema [**(@thomie)**](https://github.com/thomie)
-- Yannik Sander [**(@ysndr)**](https://github.com/ysndr)
-- Philipp Otterbein
-- Dmitry Bogatov

doc/manual/source/release-notes/rl-2.30.md

@@ -1,153 +0,0 @@
-# Release 2.30.0 (2025-07-07)
-
-## Backward-incompatible changes and deprecations
-
-- [`build-dir`] no longer defaults to `$TMPDIR`
-
-  The directory in which temporary build directories are created no longer defaults
-  to `TMPDIR` or `/tmp`, to avoid builders making their directories
-  world-accessible. This behavior allowed escaping the build sandbox and can
-  cause build impurities even when not used maliciously. We now default to `builds`
-  in `NIX_STATE_DIR` (which is `/nix/var/nix/builds` in the default configuration).
-
-- Deprecate manually making structured attrs using the `__json` attribute [#13220](https://github.com/NixOS/nix/pull/13220)
-
-  The proper way to create a derivation using [structured attrs] in the Nix language is by using `__structuredAttrs = true` with [`builtins.derivation`].
-  However, by exploiting how structured attrs are implementated, it has also been possible to create them by setting the `__json` environment variable to a serialized JSON string.
-  This sneaky alternative method is now deprecated, and may be disallowed in future versions of Nix.
-
-  [structured attrs]: @docroot@/language/advanced-attributes.md#adv-attr-structuredAttrs
-  [`builtins.derivation`]: @docroot@/language/builtins.html#builtins-derivation
-
-- Rename `nix profile install` to [`nix profile add`] [#13224](https://github.com/NixOS/nix/pull/13224)
-
-  The command `nix profile install` has been renamed to [`nix profile add`] (though the former is still available as an alias). This is because the verb "add" is a better antonym for the verb "remove" (i.e. `nix profile remove`). Nix also does not have install hooks or general behavior often associated with "installing".
-
-## Performance improvements
-
-This release has a number performance improvements, in particular:
-
-- Reduce the size of value from 24 to 16 bytes [#13407](https://github.com/NixOS/nix/pull/13407)
-
-  This shaves off a very significant amount of memory used for evaluation (~20% percent reduction in maximum heap size and ~17% in total bytes).
-
-## Features
-
-- Add [stack sampling evaluation profiler] [#13220](https://github.com/NixOS/nix/pull/13220)
-
-  The Nix evaluator now supports [stack sampling evaluation profiling](@docroot@/advanced-topics/eval-profiler.md) via the [`--eval-profiler flamegraph`] setting.
-  It outputs collapsed call stack information to the file specified by
-  [`--eval-profile-file`] (`nix.profile` by default) in a format directly consumable
-  by `flamegraph.pl` and compatible tools like [speedscope](https://speedscope.app/).
-  Sampling frequency can be configured via [`--eval-profiler-frequency`] (99 Hz by default).
-
-  Unlike the existing [`--trace-function-calls`], this profiler includes the name of the function
-  being called when it's available.
-
-- [`nix repl`] prints which variables were loaded [#11406](https://github.com/NixOS/nix/pull/11406)
-
-  Instead of `Added <n> variables` it now prints the first 10 variables that were added to the global scope.
-
-- `nix flake archive`: Add [`--no-check-sigs`] option [#13277](https://github.com/NixOS/nix/pull/13277)
-
-  This is useful when using [`nix flake archive`] with the destination set to a remote store.
-
-- Emit warnings for IFDs with [`trace-import-from-derivation`] option [#13279](https://github.com/NixOS/nix/pull/13279)
-
-  While we have the setting [`allow-import-from-derivation`] to deny import-from-derivation (IFD), sometimes users would like to observe IFDs during CI processes to gradually phase out the idiom. The new setting `trace-import-from-derivation`, when set, logs a simple warning to the console.
-
-- `json-log-path` setting [#13003](https://github.com/NixOS/nix/pull/13003)
-
-  New setting [`json-log-path`] that sends a copy of all Nix log messages (in JSON format) to a file or Unix domain socket.
-
-- Non-flake inputs now contain a `sourceInfo` attribute [#13164](https://github.com/NixOS/nix/issues/13164) [#13170](https://github.com/NixOS/nix/pull/13170)
-
-  Flakes have always had a `sourceInfo` attribute which describes the source of the flake.
-  The `sourceInfo.outPath` is often identical to the flake's `outPath`. However, it can differ when the flake is located in a subdirectory of its source.
-
-  Non-flake inputs (i.e. inputs with [`flake = false`]) can also be located at some path _within_ a wider source.
-  This usually happens when defining a relative path input within the same source as the parent flake, e.g. `inputs.foo.url = ./some-file.nix`.
-  Such relative inputs will now inherit their parent's `sourceInfo`.
-
-  This also means it is now possible to use `?dir=subdir` on non-flake inputs.
-
-  This iterates on the work done in 2.26 to improve relative path support ([#10089](https://github.com/NixOS/nix/pull/10089)),
-  and resolves a regression introduced in 2.28 relating to nested relative path inputs ([#13164](https://github.com/NixOS/nix/issues/13164)).
-
-## Miscellaneous changes
-
-- [`builtins.sort`] uses PeekSort [#12623](https://github.com/NixOS/nix/pull/12623)
-
-  Previously it used libstdc++'s `std::stable_sort()`. However, that implementation is not reliable if the user-supplied comparison function is not a strict weak ordering.
-
-- Revert incomplete closure mixed download and build feature [#77](https://github.com/NixOS/nix/issues/77) [#12628](https://github.com/NixOS/nix/issues/12628) [#13176](https://github.com/NixOS/nix/pull/13176)
-
-  Since Nix 1.3 ([commit `299141e`] in 2013) Nix has attempted to mix together upstream fresh builds and downstream substitutions when remote substuters contain an "incomplete closure" (have some store objects, but not the store objects they reference).
-  This feature is now removed.
-
-  In the worst case, removing this feature could cause more building downstream, but it should not cause outright failures, since this is not happening for opaque store objects that we don't know how to build if we decide not to substitute.
-  In practice, however, we doubt even more building is very likely to happen.
-  Remote stores that are missing dependencies in arbitrary ways (e.g. corruption) don't seem to be very common.
-
-  On the contrary, when remote stores fail to implement the [closure property](@docroot@/store/store-object.md#closure-property), it is usually an *intentional* choice on the part of the remote store, because it wishes to serve as an "overlay" store over another store, such as `https://cache.nixos.org`.
-  If an "incomplete closure" is encountered in that situation, the right fix is not to do some sort of "franken-building" as this feature implemented, but instead to make sure both substituters are enabled in the settings.
-
-  (In the future, we should make it easier for remote stores to indicate this to clients, to catch settings that won't work in general before a missing dependency is actually encountered.)
-
-## Contributors
-
-This release was made possible by the following 32 contributors:
-
-- Cole Helbling [**(@cole-h)**](https://github.com/cole-h)
-- Eelco Dolstra [**(@edolstra)**](https://github.com/edolstra)
-- Egor Konovalov [**(@egorkonovalov)**](https://github.com/egorkonovalov)
-- Farid Zakaria [**(@fzakaria)**](https://github.com/fzakaria)
-- Graham Christensen [**(@grahamc)**](https://github.com/grahamc)
-- gustavderdrache [**(@gustavderdrache)**](https://github.com/gustavderdrache)
-- Gwenn Le Bihan [**(@gwennlbh)**](https://github.com/gwennlbh)
-- h0nIg [**(@h0nIg)**](https://github.com/h0nIg)
-- Jade Masker [**(@donottellmetonottellyou)**](https://github.com/donottellmetonottellyou)
-- jayeshv [**(@jayeshv)**](https://github.com/jayeshv)
-- Jeremy Fleischman [**(@jfly)**](https://github.com/jfly)
-- John Ericson [**(@Ericson2314)**](https://github.com/Ericson2314)
-- Jonas Chevalier [**(@zimbatm)**](https://github.com/zimbatm)
-- Jörg Thalheim [**(@Mic92)**](https://github.com/Mic92)
-- kstrafe [**(@kstrafe)**](https://github.com/kstrafe)
-- Luc Perkins [**(@lucperkins)**](https://github.com/lucperkins)
-- Matt Sturgeon [**(@MattSturgeon)**](https://github.com/MattSturgeon)
-- Nikita Krasnov [**(@synalice)**](https://github.com/synalice)
-- Peder Bergebakken Sundt [**(@pbsds)**](https://github.com/pbsds)
-- pennae [**(@pennae)**](https://github.com/pennae)
-- Philipp Otterbein
-- Pol Dellaiera [**(@drupol)**](https://github.com/drupol)
-- PopeRigby [**(@poperigby)**](https://github.com/poperigby)
-- Raito Bezarius
-- Robert Hensing [**(@roberth)**](https://github.com/roberth)
-- Samuli Thomasson [**(@SimSaladin)**](https://github.com/SimSaladin)
-- Sergei Zimmerman [**(@xokdvium)**](https://github.com/xokdvium)
-- Seth Flynn [**(@getchoo)**](https://github.com/getchoo)
-- Stefan Boca [**(@stefanboca)**](https://github.com/stefanboca)
-- tomberek [**(@tomberek)**](https://github.com/tomberek)
-- Tristan Ross [**(@RossComputerGuy)**](https://github.com/RossComputerGuy)
-- Valentin Gagarin [**(@fricklerhandwerk)**](https://github.com/fricklerhandwerk)
-- Vladimír Čunát [**(@vcunat)**](https://github.com/vcunat)
-- Wolfgang Walther [**(@wolfgangwalther)**](https://github.com/wolfgangwalther)
-
-<!-- markdown links -->
-[stack sampling evaluation profiler]: @docroot@/advanced-topics/eval-profiler.md
-[`--eval-profiler`]: @docroot@/command-ref/conf-file.md#conf-eval-profiler
-[`--eval-profiler flamegraph`]: @docroot@/command-ref/conf-file.md#conf-eval-profiler
-[`--trace-function-calls`]: @docroot@/command-ref/conf-file.md#conf-trace-function-calls
-[`--eval-profile-file`]: @docroot@/command-ref/conf-file.md#conf-eval-profile-file
-[`--eval-profiler-frequency`]: @docroot@/command-ref/conf-file.md#conf-eval-profiler-frequency
-[`build-dir`]: @docroot@/command-ref/conf-file.md#conf-build-dir
-[`nix profile add`]: @docroot@/command-ref/new-cli/nix3-profile-add.md
-[`nix repl`]: @docroot@/command-ref/new-cli/nix3-repl.md
-[`nix flake archive`]: @docroot@/command-ref/new-cli/nix3-flake-archive.md
-[`json-log-path`]: @docroot@/command-ref/conf-file.md#conf-json-log-path
-[`trace-import-from-derivation`]: @docroot@/command-ref/conf-file.md#conf-trace-import-from-derivation
-[`allow-import-from-derivation`]: @docroot@/command-ref/conf-file.md#conf-allow-import-from-derivation
-[`builtins.sort`]: @docroot@/language/builtins.md#builtins-sort
-[`flake = false`]: @docroot@/command-ref/new-cli/nix3-flake.md?highlight=false#flake-inputs
-[`--no-check-sigs`]: @docroot@/command-ref/new-cli/nix3-flake-archive.md#opt-no-check-sigs
-[commit `299141e`]: https://github.com/NixOS/nix/commit/299141ecbd08bae17013226dbeae71e842b4fdd7

doc/manual/source/release-notes/rl-2.6.md

@@ -13,7 +13,7 @@
 * New command `nix store copy-log` to copy build logs from one store
   to another.
 * The `commit-lockfile-summary` option can be set to a non-empty
-  string to override the commit summary used when committing an updated
+  string to override the commit summary used when commiting an updated
   lockfile.  This may be used in conjunction with the `nixConfig`
   attribute in `flake.nix` to better conform to repository
   conventions.

doc/manual/source/store/building.md

@@ -1,100 +0,0 @@
-# Building
-
-## Normalizing derivation inputs
-
-- Each input must be [realised] prior to building the derivation in question.
-
-[realised]: @docroot@/glossary.md#gloss-realise
-
-- Once this is done, the derivation is *normalized*, replacing each input deriving path with its store path, which we now know from realising the input.
-
-## Builder Execution
-
-The [`builder`](./derivation/index.md#builder) is executed as follows:
-
-- A temporary directory is created under the directory specified by
-  `TMPDIR` (default `/tmp`) where the build will take place. The
-  current directory is changed to this directory.
-
-- The environment is cleared and set to the derivation attributes, as
-  specified above.
-
-- In addition, the following variables are set:
-
-  - `NIX_BUILD_TOP` contains the path of the temporary directory for
-    this build.
-
-  - Also, `TMPDIR`, `TEMPDIR`, `TMP`, `TEMP` are set to point to the
-    temporary directory. This is to prevent the builder from
-    accidentally writing temporary files anywhere else. Doing so
-    might cause interference by other processes.
-
-  - `PATH` is set to `/path-not-set` to prevent shells from
-    initialising it to their built-in default value.
-
-  - `HOME` is set to `/homeless-shelter` to prevent programs from
-    using `/etc/passwd` or the like to find the user's home
-    directory, which could cause impurity. Usually, when `HOME` is
-    set, it is used as the location of the home directory, even if
-    it points to a non-existent path.
-
-  - `NIX_STORE` is set to the path of the top-level Nix store
-    directory (typically, `/nix/store`).
-
-  - `NIX_ATTRS_JSON_FILE` & `NIX_ATTRS_SH_FILE` if `__structuredAttrs`
-    is set to `true` for the derivation. A detailed explanation of this
-    behavior can be found in the
-    [section about structured attrs](@docroot@/language/advanced-attributes.md#adv-attr-structuredAttrs).
-
-  - For each output declared in `outputs`, the corresponding
-    environment variable is set to point to the intended path in the
-    Nix store for that output. Each output path is a concatenation
-    of the cryptographic hash of all build inputs, the `name`
-    attribute and the output name. (The output name is omitted if
-    it’s `out`.)
-
-- If an output path already exists, it is removed. Also, locks are
-  acquired to prevent multiple [Nix instances][Nix instance] from performing the same
-  build at the same time.
-
-- A log of the combined standard output and error is written to
-  `/nix/var/log/nix`.
-
-- The builder is executed with the arguments specified by the
-  attribute `args`. If it exits with exit code 0, it is considered to
-  have succeeded.
-
-- The temporary directory is removed (unless the `-K` option was
-  specified).
-
-## Processing outputs
-
-If the builder exited successfully, the following steps happen in order to turn the output directories left behind by the builder into proper store objects:
-
-- **Normalize the file permissions**
-
-  Nix sets the last-modified timestamp on all files
-  in the build result to 1 (00:00:01 1/1/1970 UTC), sets the group to
-  the default group, and sets the mode of the file to 0444 or 0555
-  (i.e., read-only, with execute permission enabled if the file was
-  originally executable). Any possible `setuid` and `setgid`
-  bits are cleared.
-
-  > **Note**
-  >
-  > Setuid and setgid programs are not currently supported by Nix.
-  > This is because the Nix archives used in deployment have no concept of ownership information,
-  > and because it makes the build result dependent on the user performing the build.
-
-- **Calculate the references**
-
-  Nix scans each output path for
-  references to input paths by looking for the hash parts of the input
-  paths. Since these are potential runtime dependencies, Nix registers
-  them as dependencies of the output paths.
-
-  Nix also scans for references to other outputs' paths in the same way, because outputs are allowed to refer to each other.
-  If the outputs' references to each other form a cycle, this is an error, because the references of store objects much be acyclic.
-
-
-[Nix instance]: @docroot@/glossary.md#gloss-nix-instance

doc/manual/source/store/derivation/index.md

@@ -1,313 +0,0 @@
-# Store Derivation and Deriving Path
-
-Besides functioning as a [content-addressed store], the Nix store layer works as a [build system].
-Other systems (like Git or IPFS) also store and transfer immutable data, but they don't concern themselves with *how* that data was created.
-
-This is where Nix distinguishes itself.
-*Derivations* represent individual build steps, and *deriving paths* are needed to refer to the *outputs* of those build steps before they are built.
-<!-- The two concepts need to be introduced together because, as described below, each depends on the other. -->
-
-## Store Derivation {#store-derivation}
-
-A derivation is a specification for running an executable on precisely defined input to produce on more [store objects][store object].
-These store objects are known as the derivation's *outputs*.
-
-Derivations are *built*, in which case the process is spawned according to the spec, and when it exits, required to leave behind files which will (after post-processing) become the outputs of the derivation.
-This process is described in detail in [Building](@docroot@/store/building.md).
-
-<!--
-Some of these things are described directly below, but we envision with more material the exposition will probably want to migrate to separate pages benough this.
-See outputs spec for an example of this one that migrated to its own page.
--->
-
-A derivation consists of:
-
- - A name
-
- - An [inputs specification][inputs], a set of [deriving paths][deriving path]
-
- - An [outputs specification][outputs], specifying which outputs should be produced, and various metadata about them.
-
- - The ["system" type][system] (e.g. `x86_64-linux`) where the executable is to run.
-
- - The [process creation fields]: to spawn the arbitrary process which will perform the build step.
-
-[store derivation]: #store-derivation
-[inputs]: #inputs
-[input]: #inputs
-[outputs]: ./outputs/index.md
-[output]: ./outputs/index.md
-[process creation fields]: #process-creation-fields
-[builder]: #builder
-[args]: #args
-[env]: #env
-[system]: #system
-[content-addressed store]: @docroot@/glossary.md#gloss-content-addressed-store
-[build system]: @docroot@/glossary.md#gloss-build-system
-
-### Referencing derivations {#derivation-path}
-
-Derivations are always referred to by the [store path] of the store object they are encoded to.
-See the [encoding section](#derivation-encoding) for more details on how this encoding works, and thus what exactly what store path we would end up with for a given derivation.
-
-The store path of the store object which encodes a derivation is often called a *derivation path* for brevity.
-
-## Deriving path {#deriving-path}
-
-Deriving paths are a way to refer to [store objects][store object] that may or may not yet be [realised][realise].
-There are two forms:
-
-- [*constant*]{#deriving-path-constant}: just a [store path].
-  It can be made [valid][validity] by copying it into the store: from the evaluator, command line interface or another store.
-
-- [*output*]{#deriving-path-output}: a pair of a [store path] to a [store derivation] and an [output] name.
-
-In pseudo code:
-
-```typescript
-type OutputName = String;
-
-type ConstantPath = {
-  path: StorePath;
-};
-
-type OutputPath = {
-  drvPath: StorePath;
-  output: OutputName;
-};
-
-type DerivingPath = ConstantPath | OutputPath;
-```
-
-Deriving paths are necessary because, in general and particularly for [content-addressing derivations][content-addressing derivation], the [store path] of an [output] is not known in advance.
-We can use an output deriving path to refer to such an output, instead of the store path which we do not yet know.
-
-[deriving path]: #deriving-path
-[validity]: @docroot@/glossary.md#gloss-validity
-
-## Parts of a derivation
-
-A derivation is constructed from the parts documented in the following subsections.
-
-### Inputs {#inputs}
-
-The inputs are a set of [deriving paths][deriving path], referring to all store objects needed in order to perform this build step.
-
-The [process creation fields] will presumably include many [store paths][store path]:
-
- - The path to the executable normally starts with a store path
- - The arguments and environment variables likely contain many other store paths.
-
-But rather than somehow scanning all the other fields for inputs, Nix requires that all inputs be explicitly collected in the inputs field. It is instead the responsibility of the creator of a derivation (e.g. the evaluator) to ensure that every store object referenced in another field (e.g. referenced by store path) is included in this inputs field.
-
-### System {#system}
-
-The system type on which the [`builder`](#attr-builder) executable is meant to be run.
-
-A necessary condition for Nix to schedule a given derivation on some [Nix instance] is for the "system" of that derivation to match that instance's [`system` configuration option] or [`extra-platforms` configuration option].
-
-By putting the `system` in each derivation, Nix allows *heterogenous* build plans, where not all steps can be run on the same machine or same sort of machine.
-Nix can schedule builds such that it automatically builds on other platforms by [forwarding build requests](@docroot@/advanced-topics/distributed-builds.md) to other Nix instances.
-
-[`system` configuration option]: @docroot@/command-ref/conf-file.md#conf-system
-[`extra-platforms` configuration option]: @docroot@/command-ref/conf-file.md#conf-extra-platforms
-
-[content-addressing derivation]: @docroot@/glossary.md#gloss-content-addressing-derivation
-[realise]: @docroot@/glossary.md#gloss-realise
-[store object]: @docroot@/store/store-object.md
-[store path]: @docroot@/store/store-path.md
-
-### Process creation fields {#process-creation-fields}
-
-These are the three fields which describe how to spawn the process which (along with any of its own child processes) will perform the build.
-You may note that this has everything needed for an `execve` system call.
-
-#### Builder {#builder}
-
-This is the path to an executable that will perform the build and produce the [outputs].
-
-#### Arguments {#args}
-
-Command-line arguments to be passed to the [`builder`](#builder) executable.
-
-Note that these are the arguments after the first argument.
-The first argument passed to the `builder` will be the value of `builder`, as per the usual convention on Unix.
-See [Wikipedia](https://en.wikipedia.org/wiki/Argv) for details.
-
-#### Environment Variables {#env}
-
-Environment variables which will be passed to the [builder](#builder) executable.
-
-#### Structured Attributes {#structured-attrs}
-
-Nix also has special support for embedding JSON in the derivations.
-
-The environment variable `NIX_ATTRS_JSON_FILE` points to the exact location of that file both in a build and a [`nix-shell`](@docroot@/command-ref/nix-shell.md).
-
-As a convenience to Bash builders, Nix writes a script that initialises shell variables corresponding to all attributes that are representable in Bash.
-The environment variable `NIX_ATTRS_SH_FILE` points to the exact location of the script, both in a build and a [`nix-shell`](@docroot@/command-ref/nix-shell.md).
-This includes non-nested (associative) arrays.
-For example, the attribute `hardening.format = true` ends up as the Bash associative array element `${hardening[format]}`.
-
-### Placeholders
-
-Placeholders are opaque values used within the [process creation fields] to [store objects] for which we don't yet know [store path]s.
-They are strings in the form `/<hash>` that are embedded anywhere within the strings of those fields, and we are [considering](https://github.com/NixOS/nix/issues/12361) to add store-path-like placeholders.
-
-> **Note**
->
-> Output Deriving Path exist to solve the same problem as placeholders --- that is, referring to store objects for which we don't yet know a store path.
-> They also have a string syntax with `^`, [described in the encoding section](#deriving-path-encoding).
-> We could use that syntax instead of `/<hash>` for placeholders, but its human-legibility would cause problems.
-
-There are two types of placeholder, corresponding to the two cases where this problem arises:
-
-- [Output placeholder]{#output-placeholder}:
-
-  This is a placeholder for a derivation's own output.
-
-- [Input placeholder]{#input-placeholder}:
-
-  This is a placeholder to a derivation's non-constant [input],
-  i.e. an input that is an [output derived path].
-
-> **Explanation**
->
-> In general, we need to [realise] a [store object] in order to be sure to have a store object for it.
-> But for these two cases this is either impossible or impractical:
->
-> - In the output case this is impossible:
->
->   We cannot build the output until we have a correct derivation, and we cannot have a correct derivation (without using placeholders) until we have the output path.
->
-> - In the input case this is impractical:
->
->   If we always build a dependency first, and then refer to its output by store path, we would lose the ability for a derivation graph to describe an entire build plan consisting of multiple build steps.
-
-## Encoding
-
-### Derivation {#derivation-encoding}
-
-There are two formats, documented separately:
-
-- The legacy ["ATerm" format](@docroot@/protocols/derivation-aterm.md)
-
-- The experimental, currently under development and changing [JSON format](@docroot@/protocols/json/derivation.md)
-
-Every derivation has a canonical choice of encoding used to serialize it to a store object.
-This ensures that there is a canonical [store path] used to refer to the derivation, as described in [Referencing derivations](#derivation-path).
-
-> **Note**
->
-> Currently, the canonical encoding for every derivation is the "ATerm" format,
-> but this is subject to change for the types of derivations which are not yet stable.
-
-Regardless of the format used, when serializing a derivation to a store object, that store object will be content-addressed.
-
-In the common case, the inputs to store objects are either:
-
- - [constant deriving paths](#deriving-path-constant) for content-addressed source objects, which are "initial inputs" rather than the outputs of some other derivation
-
- - the outputs of other derivations
-
-If those other derivations *also* abide by this common case (and likewise for transitive inputs), then the entire closure of the serialized derivation will be content-addressed.
-
-### Deriving Path {#deriving-path-encoding}
-
-- *constant*
-
-  Constant deriving paths are encoded simply as the underlying store path is.
-  Thus, we see that every encoded store path is also a valid encoded (constant) deriving path.
-
-- *output*
-
-  Output deriving paths are encoded by
-
-  - encoding of a store path referring to a derivation
-
-  - a `^` separator (or `!` in some legacy contexts)
-
-  - the name of an output of the previously referred derivation
-
-  > **Example**
-  >
-  > ```
-  > /nix/store/lxrn8v5aamkikg6agxwdqd1jz7746wz4-firefox-98.0.2.drv^out
-  > ```
-  >
-  > This parses like so:
-  >
-  > ```
-  > /nix/store/lxrn8v5aamkikg6agxwdqd1jz7746wz4-firefox-98.0.2.drv^out
-  > |------------------------------------------------------------| |-|
-  > store path (usual encoding)                                    output name
-  >                                                           |--|
-  >                                                           note the ".drv"
-  > ```
-
-## Extending the model to be higher-order
-
-**Experimental feature**: [`dynamic-derivations`](@docroot@/development/experimental-features.md#xp-feature-dynamic-derivations)
-
-So far, we have used store paths to refer to derivations.
-That works because we've implicitly assumed that all derivations are created *statically* --- created by some mechanism out of band, and then manually inserted into the store.
-But what if derivations could also be created dynamically within Nix?
-In other words, what if derivations could be the outputs of other derivations?
-
-> **Note**
->
-> In the parlance of "Build Systems à la carte", we are generalizing the Nix store layer to be a "Monadic" instead of "Applicative" build system.
-
-How should we refer to such derivations?
-A deriving path works, the same as how we refer to other derivation outputs.
-But what about a dynamic derivations output?
-(i.e. how do we refer to the output of a derivation, which is itself an output of a derivation?)
-For that we need to generalize the definition of deriving path, replacing the store path used to refer to the derivation with a nested deriving path:
-
-```diff
- type OutputPath = {
--  drvPath: StorePath;
-+  drvPath: DerivingPath;
-   output: OutputName;
- };
-```
-
-Now, the `drvPath` field of `OutputPath` is itself a `DerivingPath` instead of a `StorePath`.
-
-With that change, here is updated definition:
-
-```typescript
-type OutputName = String;
-
-type ConstantPath = {
-  path: StorePath;
-};
-
-type OutputPath = {
-  drvPath: DerivingPath;
-  output: OutputName;
-};
-
-type DerivingPath = ConstantPath | OutputPath;
-```
-
-Under this extended model, `DerivingPath`s are thus inductively built up from a root `ConstantPath`, wrapped with zero or more outer `OutputPath`s.
-
-### Encoding {#deriving-path-encoding-higher-order}
-
-The encoding is adjusted in the natural way, encoding the `drv` field recursively using the same deriving path encoding.
-The result of this is that it is possible to have a chain of `^<output-name>` at the end of the final string, as opposed to just a single one.
-
-> **Example**
->
-> ```
-> /nix/store/lxrn8v5aamkikg6agxwdqd1jz7746wz4-firefox-98.0.2.drv^foo.drv^bar.drv^out
-> |----------------------------------------------------------------------------| |-|
-> inner deriving path (usual encoding)                                           output name
-> |--------------------------------------------------------------------| |-----|
-> even more inner deriving path (usual encoding)                         output name
-> |------------------------------------------------------------| |-----|
-> innermost constant store path (usual encoding)                 output name
-> ```
-
-[Nix instance]: @docroot@/glossary.md#gloss-nix-instance

doc/manual/source/store/derivation/outputs/content-address.md

@@ -1,192 +0,0 @@
-# Content-addressing derivation outputs
-
-The content-addressing of an output only depends on that store object itself, not any other information external (such has how it was made, when it was made, etc.).
-As a consequence, a store object will be content-addressed the same way regardless of whether it was manually inserted into the store, outputted by some derivation, or outputted by a some other derivation.
-
-The output spec for a content-addressed output must contains the following field:
-
-- *method*: how the data of the store object is digested into a content address
-
-The possible choices of *method* are described in the [section on content-addressing store objects](@docroot@/store/store-object/content-address.md).
-Given the method, the output's name (computed from the derivation name and output spec mapping as described above), and the data of the store object, the output's store path will be computed as described in that section.
-
-## Fixed-output content-addressing {#fixed}
-
-In this case the content address of the *fixed* in advanced by the derivation itself.
-In other words, when the derivation has finished [building](@docroot@/store/building.md), and the provisional output' content-address is computed as part of the process to turn it into a *bona fide* store object, the calculated content address must much that given in the derivation, or the build of that derivation will be deemed a failure.
-
-The output spec for an output with a fixed content addresses additionally contains:
-
-- *hash*, the hash expected from digesting the store object's file system objects.
-  This hash may be of a freely-chosen hash algorithm (that Nix supports)
-
-> **Design note**
->
-> In principle, the output spec could also specify the references the store object should have, since the references and file system objects are equally parts of a content-addressed store object proper that contribute to its content-addressed.
-> However, at this time, the references are not done because all fixed content-addressed outputs are required to have no references (including no self-reference).
->
-> Also in principle, rather than specifying the references and file system object data with separate hashes, a single hash that constraints both could be used.
-> This could be done with the final store path's digest, or better yet, the hash that will become the store path's digest before it is truncated.
->
-> These possible future extensions are included to elucidate the core property of fixed-output content addressing --- that all parts of the output must be cryptographically fixed with one or more hashes --- separate from the particulars of the currently-supported store object content-addressing schemes.
-
-### Design rationale
-
-What is the purpose of fixing an output's content address in advanced?
-In abstract terms, the answer is carefully controlled impurity.
-Unlike a regular derivation, the [builder] executable of a derivation that produced fixed outputs has access to the network.
-The outputs' guaranteed content-addresses are supposed to mitigate the risk of the builder being given these capabilities;
-regardless of what the builder does *during* the build, it cannot influence downstream builds in unanticipated ways because all information it passed downstream flows through the outputs whose content-addresses are fixed.
-
-[builder]: @docroot@/store/derivation/index.md#builder
-
-In concrete terms, the purpose of this feature is fetching fixed input data like source code from the network.
-For example, consider a family of "fetch URL" derivations.
-These derivations download files from given URL.
-To ensure that the downloaded file has not been modified, each derivation must also specify a cryptographic hash of the file.
-For example,
-
-```jsonc
-{
-  "outputs: {
-    "out": {
-      "method": "nar",
-      "hashAlgo": "sha256",
-      "hash: "1md7jsfd8pa45z73bz1kszpp01yw6x5ljkjk2hx7wl800any6465",
-    },
-  },
-  "env": {
-    "url": "http://ftp.gnu.org/pub/gnu/hello/hello-2.1.1.tar.gz"
-    // ...
-  },
-  // ...
-}
-```
-
-It sometimes happens that the URL of the file changes,
-e.g., because servers are reorganised or no longer available.
-In these cases, we then must update the call to `fetchurl`, e.g.,
-
-```diff
-   "env": {
--    "url": "http://ftp.gnu.org/pub/gnu/hello/hello-2.1.1.tar.gz"
-+    "url": "ftp://ftp.nluug.nl/pub/gnu/hello/hello-2.1.1.tar.gz"
-     // ...
-   },
-```
-
-If a `fetchurl` derivation's outputs were [input-addressed][input addressing], the output paths of the derivation and of *all derivations depending on it* would change.
-For instance, if we were to change the URL of the Glibc source distribution in Nixpkgs (a package on which almost all other packages depend on Linux) massive rebuilds would be needed.
-This is unfortunate for a change which we know cannot have a real effect as it propagates upwards through the dependency graph.
-
-For content-addressed outputs (fixed or floating), on the other hand, the outputs' store path only depends on the derivation's name, data, and the `method` of the outputs' specs.
-The rest of the derivation is ignored for the purpose of computing the output path.
-
-> **History Note**
->
-> Fixed content-addressing is especially important both today and historically as the *only* form of content-addressing that is stabilized.
-> This is why the rationale above contrasts it with [input addressing].
-
-## (Floating) Content-Addressing {#floating}
-
-> **Warning**
-> This is part of an [experimental feature](@docroot@/development/experimental-features.md).
->
-> To use this type of output addressing, you must enable the
-> [`ca-derivations`][xp-feature-ca-derivations] experimental feature.
-> For example, in [nix.conf](@docroot@/command-ref/conf-file.md) you could add:
->
-> ```
-> extra-experimental-features = ca-derivations
-> ```
-
-With this experimemental feature enabled, derivation outputs can also be content-addressed *without* fixing in the output spec what the outputs' content address must be.
-
-### Purity
-
-Because the derivation output is not fixed (just like with [input addressing]), the [builder] is not given any impure capabilities [^purity].
-
-> **Configuration note**
->
-> Strictly speaking, the extent to which sandboxing and deprivilaging is possible varies with the environment Nix is running in.
-> Nix's configuration settings indicate what level of sandboxing is required or enabled.
-> Builds of derivations will fail if they request an absence of sandboxing which is not allowed.
-> Builds of derivations will also fail if the level of sandboxing specified in the configure exceeds what is possible in the given environment.
->
-> (The "environment", in this case, consists of attributes such as the Operating System Nix runs atop, along with the operating-system-specific privileges that Nix has been granted.
-> Because of how conventional operating systems like macos, Linux, etc. work, granting builders *fewer* privileges may ironically require that Nix be run with *more* privileges.)
-
-That said, derivations producing floating content-addressed outputs may declare their builders as impure (like the builders of derivations producing fixed outputs).
-This is provisionally supported as part of the [`impure-derivations`][xp-feature-impure-derivations] experimental feature.
-
-### Compatibility negotiation
-
-Any derivation producing a floating content-addressed output implicitly requires the `ca-derivations` [system feature](@docroot@/command-ref/conf-file.md#conf-system-features).
-This prevents scheduling the building of the derivation on a machine without the experimental feature enabled.
-Even once the experimental feature is stabilized, this is still useful in order to be allow using remote builder running odler versions of Nix, or alternative implementations that do not support floating content addressing.
-
-### Determinism
-
-In the earlier [discussion of how self-references are handled when content-addressing store objects](@docroot@/store/store-object/content-address.html#self-references), it was pointed out that methods of producing store objects ought to be deterministic regardless of the choice of provisional store path.
-For store objects produced by manually inserting into the store to create a store object, the "method of production" is an informally concept --- formally, Nix has no idea where the store object came from, and content-addressing is crucial in order to ensure that the derivation is *intrinsically* tamper-proof.
-But for store objects produced by derivation, the "method is quite formal" --- the whole point of derivations is to be a formal notion of building, after all.
-In this case, we can elevate this informal property to a formal one.
-
-A *deterministic* content-addressing derivation should produce outputs with the same content addresses:
-
-1. Every time the builder is run
-
-  This is because either the builder is completely sandboxed, or because all any remaining impurities that leak inside the build sandbox are ignored by the builder and do not influence its behavior.
-
-2. Regardless of the choice of any provisional outputs paths
-
-  Provisional store paths must be chosen for any output that has a self-reference.
-  The choice of provisional store path can be thought of as an impurity, since it is an arbitrary choice.
-
-  If provisional outputs paths are deterministically chosen, we are in the first branch of part (1).
-  The builder the data it produces based on it in arbitrary ways, but this gets us closer to [input addressing].
-  Deterministically choosing the provisional path may be considered "complete sandboxing" by removing an impurity, but this is unsatisfactory
-
-  <!--
-
-  TODO
-  (Both these points will be expanded-upon below.)
-
-  -->
-
-  If provisional outputs paths are randomly chosen, we are in the second branch of part (1).
-  The builder *must* not let the random input affect the final outputs it produces, and multiple builds may be performed and the compared in order to ensure that this is in fact the case.
-
-### Floating versus Fixed
-
-While the distinction between content- and input-addressing is one of *mechanism*, the distinction between fixed and floating content addressing is more one of *policy*.
-A fixed output that passes its content address check is just like a floating output.
-It is only in the potential for that check to fail that they are different.
-
-> **Design Note**
->
-> In a future world where floating content-addressing is also stable, we in principle no longer need separate [fixed](#fixed) content-addressing.
-> Instead, we could always use floating content-addressing, and separately assert the precise value content address of a given store object to be used as an input (of another derivation).
-> A stand-alone assertion object of this sort is not yet implemented, but its possible creation is tracked in [Issue #11955](https://github.com/NixOS/nix/issues/11955).
->
-> In the current version of Nix, fixed outputs which fail their hash check are still registered as valid store objects, just not registered as outputs of the derivation which produced them.
-> This is an optimization that means if the wrong output hash is specified in a derivation, and then the derivation is recreated with the right output hash, derivation does not need to be rebuilt --- avoiding downloading potentially large amounts of data twice.
-> This optimisation prefigures the design above:
-> If the output hash assertion was removed outside the derivation itself, Nix could additionally not only register that outputted store object like today, but could also make note that derivation did in fact successfully download some data.
-For example, for the "fetch URL" example above, making such a note is tantamount to recording what data is available at the time of download at the given URL.
-> It would only be when Nix subsequently tries to build something with that (refining our example) downloaded source code that Nix would be forced to check the output hash assertion, preventing it from e.g. building compromised malware.
->
-> Recapping, Nix would
->
-> 1. successfully download data
-> 2. insert that data into the store
-> 3. associate (presumably with some sort of expiration policy) the downloaded data with the derivation that downloaded it
->
-> But only use the downloaded store object in subsequent derivations that depended upon the assertion if the assertion passed.
->
-> This possible future extension is included to illustrate this distinction:
-
-[input addressing]: ./input-address.md
-[xp-feature-ca-derivations]: @docroot@/development/experimental-features.md#xp-feature-ca-derivations
-[xp-feature-git-hashing]: @docroot@/development/experimental-features.md#xp-feature-git-hashing
-[xp-feature-impure-derivations]: @docroot@/development/experimental-features.md#xp-feature-impure-derivations

doc/manual/source/store/derivation/outputs/index.md

@@ -1,97 +0,0 @@
-# Derivation Outputs and Types of Derivations
-
-As stated on the [main pages on derivations](../index.md#store-derivation),
-a derivation produces [store objects](@docroot@/store/store-object.md), which are known as the *outputs* of the derivation.
-Indeed, the entire point of derivations is to produce these outputs, and to reliably and reproducibly produce these derivations each time the derivation is run.
-
-One of the parts of a derivation is its *outputs specification*, which specifies certain information about the outputs the derivation produces when run.
-The outputs specification is a map, from names to specifications for individual outputs.
-
-## Output Names {#outputs}
-
-Output names can be any string which is also a valid [store path](@docroot@/store/store-path.md) name.
-The name mapped to each output specification is not actually the name of the output.
-In the general case, the output store object has name `derivationName + "-" + outputSpecName`, not any other metadata about it.
-However, an output spec named "out" describes and output store object whose name is just the derivation name.
-
-> **Example**
->
-> A derivation is named `hello`, and has two outputs, `out`, and `dev`
->
-> - The derivation's path will be: `/nix/store/<hash>-hello.drv`.
->
-> - The store path of `out` will be: `/nix/store/<hash>-hello`.
->
-> - The store path of `dev` will be: `/nix/store/<hash>-hello-dev`.
-
-The outputs are the derivations are the [store objects](@docroot@/store/store-object.md) it is obligated to produce.
-
-> **Note**
->
-> The formal terminology here is somewhat at odds with everyday communication in the Nix community today.
-> "output" in casual usage tends to refer to either to the actual output store object, or the notional output spec, depending on context.
->
-> For example "hello's `dev` output" means the store object referred to by the store path `/nix/store/<hash>-hello-dev`.
-> It is unusual to call this the "`hello-dev` output", even though `hello-dev` is the actual name of that store object.
-
-## Types of output addressing
-
-The main information contained in an output specification is how the derivation output is addressed.
-In particular, the specification decides:
-
-- whether the output is [content-addressed](./content-address.md) or [input-addressed](./input-address.md)
-
-- if the content is content-addressed, how is it content addressed
-
-- if the content is content-addressed, [what is its content address](./content-address.md#fixed-content-addressing) (and thus what is its [store path])
-
-## Types of derivations
-
-The sections on each type of derivation output addressing ended up discussing other attributes of the derivation besides its outputs, such as purity, scheduling, determinism, etc.
-This is no concidence; for the type of a derivation is in fact one-for-one with the type of its outputs:
-
-- A derivation that produces *xyz-addressed* outputs is an *xyz-addressing* derivations.
-
-The rules for this are fairly concise:
-
-- All the outputs must be of the same type / use the same addressing
-
-  - The derivation must have at least one output
-
-  - Additionally, if the outputs are fixed content-addressed, there must be exactly one output, whose specification is mapped from the name `out`.
-    (The name `out` is special, according to the rules described above.
-    Having only one output and calling its specification `out` means the single output is effectively anonymous; the store path just has the derivation name.)
-
-    (This is an arbitrary restriction that could be lifted.)
-
-- The output is either *fixed* or *floating*, indicating whether the store path is known prior to building it.
-
-  - With fixed content-addressing it is fixed.
-
-    > A *fixed content-addressing* derivation is also called a *fixed-output derivation*, since that is the only currently-implemented form of fixed-output addressing
-
-  - With floating content-addressing or input-addressing it is floating.
-
-  > Thus, historically with Nix, with no experimental features enabled, *all* outputs are fixed.
-
-- The derivation may be *pure* or *impure*, indicating what read access to the outside world the [builder](../index.md#builder) has.
-
-  - An input-addressing derivation *must* be pure.
-
-    > If it is impure, we would have a large problem, because an input-addressed derivation always produces outputs with the same paths.
-
-
-  - A content-addressing derivation may be pure or impure
-
-   - If it is impure, it may be fixed (typical), or it may be floating if the additional [`impure-derivations`][xp-feature-impure-derivations] experimental feature is enabled.
-
-   - If it is pure, it must be floating.
-
-   - Pure, fixed content-addressing derivations are not supported
-
-     > There is no use for this forth combination.
-     > The sole purpose of an output's store path being fixed is to support the derivation being impure.
-
-[xp-feature-ca-derivations]: @docroot@/development/experimental-features.md#xp-feature-ca-derivations
-[xp-feature-git-hashing]: @docroot@/development/experimental-features.md#xp-feature-git-hashing
-[xp-feature-impure-derivations]: @docroot@/development/experimental-features.md#xp-feature-impure-derivations

doc/manual/source/store/derivation/outputs/input-address.md

@@ -1,31 +0,0 @@
-# Input-addressing derivation outputs
-
-[input addressing]: #input-addressing
-
-"Input addressing" means the address the store object by the *way it was made* rather than *what it is*.
-That is to say, an input-addressed output's store path is a function not of the output itself, but of the derivation that produced it.
-Even if two store paths have the same contents, if they are produced in different ways, and one is input-addressed, then they will have different store paths, and thus guaranteed to not be the same store object.
-
-<!---
-
-### Modulo fixed-output derivations
-
-**TODO hash derivation modulo.**
-
-So how do we compute the hash part of the output path of a derivation?
-This is done by the function `hashDrv`, shown in Figure 5.10.
-It distinguishes between two cases.
-If the derivation is a fixed-output derivation, then it computes a hash over just the `outputHash` attributes.
-
-If the derivation is not a fixed-output derivation, we replace each element in the derivation’s inputDrvs with the result of a call to `hashDrv` for that element.
-(The derivation at each store path in `inputDrvs` is converted from its on-disk ATerm representation back to a `StoreDrv` by the function `parseDrv`.) In essence, `hashDrv` partitions store derivations into equivalence classes, and for hashing purpose it replaces each store path in a derivation graph with its equivalence class.
-
-The recursion in Figure 5.10 is inefficient:
-it will call itself once for each path by which a subderivation can be reached, i.e., `O(V k)` times for a derivation graph with `V` derivations and with out-degree of at most `k`.
-In the actual implementation, memoisation is used to reduce this to `O(V + E)` complexity for a graph with E edges.
-
--->
-
-[xp-feature-ca-derivations]: @docroot@/development/experimental-features.md#xp-feature-ca-derivations
-[xp-feature-git-hashing]: @docroot@/development/experimental-features.md#xp-feature-git-hashing
-[xp-feature-impure-derivations]: @docroot@/development/experimental-features.md#xp-feature-impure-derivations

doc/manual/source/store/file-system-object/content-address.md

@@ -46,7 +46,7 @@ be many different serialisations.
 For these reasons, Nix has its very own archive format—the Nix Archive (NAR) format,
 which is carefully designed to avoid the problems described above.
 
-The exact specification of the Nix Archive format is in [specified here](../../protocols/nix-archive.md).
+The exact specification of the Nix Archive format is in `protocols/nix-archive.md`
 
 ## Content addressing File System Objects beyond a single serialisation pass
 
@@ -80,7 +80,6 @@ Thus, Git can encode some, but not all of Nix's "File System Objects", and this
 
 In the future, we may support a Git-like hash for such file system objects, or we may adopt another Merkle DAG format which is capable of representing all Nix file system objects.
 
-
 [file system object]: ../file-system-object.md
 [store object]: ../store-object.md
 [xp-feature-git-hashing]: @docroot@/development/experimental-features.md#xp-feature-git-hashing

doc/manual/source/store/store-object.md

@@ -4,64 +4,7 @@ A Nix store is a collection of *store objects* with *references* between them.
 A store object consists of
 
   - A [file system object](./file-system-object.md) as data
-
-  - A set of [store paths](./store-path.md) as references to store objects
-
-### References
-
-Store objects can refer to both other store objects and themselves.
-References from a store object to itself are called *self-references*.
-
-Store objects and their references form a directed graph, where the store objects are the vertices, and the references are the edges.
-In particular, the edge corresponding to a reference is from the store object that contains the reference, and to the store object that the store path (which is the reference) refers to.
-
-References other than a self-reference must not form a cycle.
-The graph of references excluding self-references thus forms a [directed acyclic graph].
-
-[directed acyclic graph]: @docroot@/glossary.md#gloss-directed-acyclic-graph
-
-We can take the [transitive closure] of the references graph, which any pair of store objects have an edge not if there is a single reference from the first to the second, but a path of one or more references from the first to the second.
-The *requisites* of a store object are all store objects reachable by paths of references which start with given store object's references.
-
-[transitive closure]: https://en.wikipedia.org/wiki/Transitive_closure
-
-We can also take the [transpose graph] of the references graph, where we reverse the orientation of all edges.
-The *referrers* of a store object are the store objects that reference it.
-
-[transpose graph]: https://en.wikipedia.org/wiki/Transpose_graph
-
-One can also combine both concepts: taking the transitive closure of the transposed references graph.
-The *referrers closure* of a store object are the store objects that can reach the given store object via paths of references.
-
-> **Note**
->
-> Care must be taken to distinguish between the intrinsic and extrinsic properties of store objects.
-> We can create graphs from the store objects in a store, but the contents of the store is not, in general fixed, and may instead change over time.
->
-> - The references of a store object --- the set of store paths called the references --- is a field of a store object, and thus intrinsic by definition.
-    Regardless of what store contains the store object in question, and what else that store may or may not contain, the references are the same.
->
-> - The requisites of a store object are almost intrinsic --- some store paths due not precisely refer to a unique single store object.
-> Exactly what store object is being referenced, and what in turn *its* references are, depends on the store in question.
->   Different stores that disagree.
->
-> - The referrers of a store object are completely extrinsic, and depends solely on the store which contains that store object, not the store object itself.
->   Other store objects which refer to the store object in question may be added or removed from the store.
-
-### Immutability
+  - A set of [store paths](./store-path.md) as references to other store objects
 
 Store objects are [immutable](https://en.wikipedia.org/wiki/Immutable_object):
-Once created, they do not change nor can any store object they reference be changed.
-
-> **Note**
->
-> Stores which support atomically deleting multiple store objects allow more flexibility while still upholding this property.
-
-### Closure property
-
-A store can only contain a store object if it also contains all the store objects it refers to.
-
-> **Note**
->
-> The "closure property" isn't meant to prohibit, for example, [lazy loading](https://en.wikipedia.org/wiki/Lazy_loading) of store objects.
-> However, the "closure property" and immutability in conjunction imply that any such lazy loading ought to be deterministic.
+Once created, they do not change until they are deleted.

doc/manual/source/store/store-object/content-address.md

@@ -24,17 +24,13 @@ For the full specification of the algorithms involved, see the [specification of
 
 ### File System Objects
 
-With all currently-supported store object content-addressing methods, the file system object is always [content-addressed][fso-ca] first, and then that hash is incorporated into content address computation for the store object.
+With all currently supported store object content addressing methods, the file system object is always [content-addressed][fso-ca] first, and then that hash is incorporated into content address computation for the store object.
 
 ### References
 
-#### References to other store objects
-
 With all currently supported store object content addressing methods,
 other objects are referred to by their regular (string-encoded-) [store paths][Store Path].
 
-#### Self-references
-
 Self-references however cannot be referred to by their path, because we are in the midst of describing how to compute that path!
 
 > The alternative would require finding as hash function fixed point, i.e. the solution to an equation in the form
@@ -44,28 +40,7 @@ Self-references however cannot be referred to by their path, because we are in t
 > which is computationally infeasible.
 > As far as we know, this is equivalent to finding a hash collision.
 
-Instead we have a "has self-reference" boolean, which ends up affecting the digest:
-In all currently-supported store object content-addressing methods, when hashing the file system object data, any occurrence of store object's own store path in the digested data is replaced with a [sentinel value](https://en.wikipedia.org/wiki/Sentinel_value).
-The hashes of these modified input streams are used instead.
-
-When validating the content address of a store object after the fact, the above process works as written.
-However, when first creating the store object we don't know the store object's store path, as explained just above.
-We therefore, strictly speaking, do not know what value we will be replacing with the sentinel value in the inputs to hash functions.
-What instead happens is that the provisional store object --- the data from which we wish to create a store object --- is paired with a provisional "scratch" store path (that presumably was chosen when the data was created).
-That provisional store path is instead what is replaced with the sentinel value, rather than the final store object which we do not yet know.
-
-> **Design note**
->
-> It is an informal property of content-addressed store objects that the choice of provisional store path should not matter.
-> In other words, if a provisional store object is prepared in the same way except for the choice of provision store path, the provisional data need not be identical.
-> But, after the sentinel value is substituted in place of each provisional store object's provision store path, the final so-normalized data *should* be identical.
->
-> If, conversely, the data after this normalization process is still different, we'll compute a different content-address.
-> The method of preparing the provisional self-referenced data has *failed* to be deterministic in the sense of not *leaking* the choice of provisional store path --- a choice which is supposed to be arbitrary --- into the final store object.
->
-> This property is informal because at this stage, we are just described store objects, which have no formal notion of their origin.
-> Without such a formal notion, there is nothing to formally accuse of being insufficiently deterministic.
-> Where we cover [derivations](@docroot@/store/derivation/index.md), we will have a chance to make this a formal property, not of content-addressed store objects themselves, but of derivations that *produce* content-addressed store objects.
+Instead we just have a "has self reference" boolean, which will end up affecting the digest.
 
 ### Name and Store Directory
 
@@ -88,7 +63,7 @@ References are not supported: store objects with flat hashing *and* references c
 
 This also uses the corresponding [Flat](../file-system-object/content-address.md#serial-flat) method of file system object content addressing.
 
-References to other store objects are supported, but self-references are not.
+References to other store objects are supported, but self references are not.
 
 This is the only store-object content-addressing method that is not named identically with a corresponding file system object method.
 It is somewhat obscure, mainly used for "drv files"
@@ -99,7 +74,7 @@ Prefer another method if possible.
 
 This uses the corresponding [Nix Archive](../file-system-object/content-address.md#serial-nix-archive) method of file system object content addressing.
 
-References (to other store objects and self-references alike) are supported so long as the hash algorithm is SHA-256, but not (neither kind) otherwise.
+References (to other store objects and self references alike) are supported so long as the hash algorithm is SHA-256, but not (neither kind) otherwise.
 
 ### Git { #method-git }
 

doc/manual/substitute.py

@@ -57,9 +57,6 @@ def recursive_replace(data: dict[str, t.Any], book_root: Path, search_path: Path
                     ).replace(
                         '@docroot@',
                         ("../" * len(path_to_chapter.parent.parts) or "./")[:-1]
-                    ).replace(
-                        '@_at_',
-                        '@'
                     ),
                     sub_items = [
                         recursive_replace(sub_item, book_root, search_path)

doc/manual/utils.nix

@@ -11,15 +11,10 @@ rec {
 
   concatStrings = concatStringsSep "";
 
-  attrsToList =
-    a:
-    map (name: {
-      inherit name;
-      value = a.${name};
-    }) (builtins.attrNames a);
+  attrsToList = a:
+    map (name: { inherit name; value = a.${name}; }) (builtins.attrNames a);
 
-  replaceStringsRec =
-    from: to: string:
+  replaceStringsRec = from: to: string:
     # recursively replace occurrences of `from` with `to` within `string`
     # example:
     #     replaceStringRec "--" "-" "hello-----world"
@@ -27,18 +22,16 @@ rec {
     let
       replaced = replaceStrings [ from ] [ to ] string;
     in
-    if replaced == string then string else replaceStringsRec from to replaced;
+      if replaced == string then string else replaceStringsRec from to replaced;
 
   toLower = replaceStrings upperChars lowerChars;
 
   squash = replaceStringsRec "\n\n\n" "\n\n";
 
-  trim =
-    string:
+  trim = string:
     # trim trailing spaces and squash non-leading spaces
     let
-      trimLine =
-        line:
+      trimLine = line:
         let
           # separate leading spaces from the rest
           parts = split "(^ *)" line;
@@ -46,30 +39,19 @@ rec {
           rest = elemAt parts 2;
           # drop trailing spaces
           body = head (split " *$" rest);
-        in
-        spaces + replaceStringsRec "  " " " body;
-    in
-    concatStringsSep "\n" (map trimLine (splitLines string));
+        in spaces + replaceStringsRec "  " " " body;
+    in concatStringsSep "\n" (map trimLine (splitLines string));
 
   # FIXME: O(n^2)
-  unique = foldl' (acc: e: if elem e acc then acc else acc ++ [ e ]) [ ];
+  unique = foldl' (acc: e: if elem e acc then acc else acc ++ [ e ]) [];
 
   nameValuePair = name: value: { inherit name value; };
 
-  filterAttrs =
-    pred: set:
-    listToAttrs (
-      concatMap (
-        name:
-        let
-          v = set.${name};
-        in
-        if pred name v then [ (nameValuePair name v) ] else [ ]
-      ) (attrNames set)
-    );
+  filterAttrs = pred: set:
+    listToAttrs (concatMap (name: let v = set.${name}; in if pred name v then [(nameValuePair name v)] else []) (attrNames set));
 
   optionalString = cond: string: if cond then string else "";
 
-  indent =
-    prefix: s: concatStringsSep "\n" (map (x: if x == "" then x else "${prefix}${x}") (splitLines s));
+  indent = prefix: s:
+    concatStringsSep "\n" (map (x: if x == "" then x else "${prefix}${x}") (splitLines s));
 }

docker.nix

@@ -1,54 +1,21 @@
-{
-  # Core dependencies
-  pkgs,
-  lib,
-  dockerTools,
-  runCommand,
-  buildPackages,
-  # Image configuration
-  name ? "nix",
-  tag ? "latest",
-  bundleNixpkgs ? true,
-  channelName ? "nixpkgs",
-  channelURL ? "https://nixos.org/channels/nixpkgs-unstable",
-  extraPkgs ? [ ],
-  maxLayers ? 70,
-  nixConf ? { },
-  flake-registry ? null,
-  uid ? 0,
-  gid ? 0,
-  uname ? "root",
-  gname ? "root",
-  Labels ? {
-    "org.opencontainers.image.title" = "Nix";
-    "org.opencontainers.image.source" = "https://github.com/NixOS/nix";
-    "org.opencontainers.image.vendor" = "Nix project";
-    "org.opencontainers.image.version" = nix.version;
-    "org.opencontainers.image.description" = "Nix container image";
-  },
-  Cmd ? [ (lib.getExe bashInteractive) ],
-  # Default Packages
-  nix,
-  bashInteractive,
-  coreutils-full,
-  gnutar,
-  gzip,
-  gnugrep,
-  which,
-  curl,
-  less,
-  wget,
-  man,
-  cacert,
-  findutils,
-  iana-etc,
-  gitMinimal,
-  openssh,
-  # Other dependencies
-  shadow,
+{ pkgs ? import <nixpkgs> { }
+, lib ? pkgs.lib
+, name ? "nix"
+, tag ? "latest"
+, bundleNixpkgs ? true
+, channelName ? "nixpkgs"
+, channelURL ? "https://nixos.org/channels/nixpkgs-unstable"
+, extraPkgs ? []
+, maxLayers ? 100
+, nixConf ? {}
+, flake-registry ? null
+, uid ? 0
+, gid ? 0
+, uname ? "root"
+, gname ? "root"
 }:
 let
-  defaultPkgs = [
+  defaultPkgs = with pkgs; [
     nix
     bashInteractive
     coreutils-full
@@ -63,80 +30,83 @@ let
     cacert.out
     findutils
     iana-etc
-    gitMinimal
+    git
     openssh
   ] ++ extraPkgs;
 
-  users =
-    {
+  users = {
 
-      root = {
-        uid = 0;
-        shell = lib.getExe bashInteractive;
-        home = "/root";
-        gid = 0;
-        groups = [ "root" ];
-        description = "System administrator";
-      };
-
-      nobody = {
-        uid = 65534;
-        shell = lib.getExe' shadow "nologin";
-        home = "/var/empty";
-        gid = 65534;
-        groups = [ "nobody" ];
-        description = "Unprivileged account (don't use!)";
-      };
-
-    }
-    // lib.optionalAttrs (uid != 0) {
-      "${uname}" = {
-        uid = uid;
-        shell = lib.getExe bashInteractive;
-        home = "/home/${uname}";
-        gid = gid;
-        groups = [ "${gname}" ];
-        description = "Nix user";
-      };
-    }
-    // lib.listToAttrs (
-      map (n: {
-        name = "nixbld${toString n}";
-        value = {
-          uid = 30000 + n;
-          gid = 30000;
-          groups = [ "nixbld" ];
-          description = "Nix build user ${toString n}";
-        };
-      }) (lib.lists.range 1 32)
-    );
-
-  groups =
-    {
-      root.gid = 0;
-      nixbld.gid = 30000;
-      nobody.gid = 65534;
-    }
-    // lib.optionalAttrs (gid != 0) {
-      "${gname}".gid = gid;
+    root = {
+      uid = 0;
+      shell = "${pkgs.bashInteractive}/bin/bash";
+      home = "/root";
+      gid = 0;
+      groups = [ "root" ];
+      description = "System administrator";
     };
 
+    nobody = {
+      uid = 65534;
+      shell = "${pkgs.shadow}/bin/nologin";
+      home = "/var/empty";
+      gid = 65534;
+      groups = [ "nobody" ];
+      description = "Unprivileged account (don't use!)";
+    };
+
+  } // lib.optionalAttrs (uid != 0) {
+    "${uname}" = {
+      uid = uid;
+      shell = "${pkgs.bashInteractive}/bin/bash";
+      home = "/home/${uname}";
+      gid = gid;
+      groups = [ "${gname}" ];
+      description = "Nix user";
+    };
+  } // lib.listToAttrs (
+    map
+      (
+        n: {
+          name = "nixbld${toString n}";
+          value = {
+            uid = 30000 + n;
+            gid = 30000;
+            groups = [ "nixbld" ];
+            description = "Nix build user ${toString n}";
+          };
+        }
+      )
+      (lib.lists.range 1 32)
+  );
+
+  groups = {
+    root.gid = 0;
+    nixbld.gid = 30000;
+    nobody.gid = 65534;
+  } // lib.optionalAttrs (gid != 0) {
+    "${gname}".gid = gid;
+  };
+
   userToPasswd = (
     k:
-    {
-      uid,
-      gid ? 65534,
-      home ? "/var/empty",
-      description ? "",
-      shell ? "/bin/false",
-      groups ? [ ],
-    }:
-    "${k}:x:${toString uid}:${toString gid}:${description}:${home}:${shell}"
+    { uid
+    , gid ? 65534
+    , home ? "/var/empty"
+    , description ? ""
+    , shell ? "/bin/false"
+    , groups ? [ ]
+    }: "${k}:x:${toString uid}:${toString gid}:${description}:${home}:${shell}"
+  );
+  passwdContents = (
+    lib.concatStringsSep "\n"
+      (lib.attrValues (lib.mapAttrs userToPasswd users))
   );
-  passwdContents = (lib.concatStringsSep "\n" (lib.attrValues (lib.mapAttrs userToPasswd users)));
 
   userToShadow = k: { ... }: "${k}:!:1::::::";
-  shadowContents = (lib.concatStringsSep "\n" (lib.attrValues (lib.mapAttrs userToShadow users)));
+  shadowContents = (
+    lib.concatStringsSep "\n"
+      (lib.attrValues (lib.mapAttrs userToShadow users))
+  );
 
   # Map groups to members
   # {
@@ -146,125 +116,107 @@ let
     let
       # Create a flat list of user/group mappings
       mappings = (
-        builtins.foldl' (
-          acc: user:
-          let
-            groups = users.${user}.groups or [ ];
-          in
-          acc
-          ++ map (group: {
-            inherit user group;
-          }) groups
-        ) [ ] (lib.attrNames users)
+        builtins.foldl'
+          (
+            acc: user:
+              let
+                groups = users.${user}.groups or [ ];
+              in
+              acc ++ map
+                (group: {
+                  inherit user group;
+                })
+                groups
+          )
+          [ ]
+          (lib.attrNames users)
       );
     in
-    (builtins.foldl' (
-      acc: v:
-      acc
-      // {
-        ${v.group} = acc.${v.group} or [ ] ++ [ v.user ];
-      }
-    ) { } mappings)
+    (
+      builtins.foldl'
+        (
+          acc: v: acc // {
+            ${v.group} = acc.${v.group} or [ ] ++ [ v.user ];
+          }
+        )
+        { }
+        mappings)
   );
 
-  groupToGroup =
-    k:
-    { gid }:
+  groupToGroup = k: { gid }:
     let
       members = groupMemberMap.${k} or [ ];
     in
     "${k}:x:${toString gid}:${lib.concatStringsSep "," members}";
-  groupContents = (lib.concatStringsSep "\n" (lib.attrValues (lib.mapAttrs groupToGroup groups)));
-
-  toConf =
-    with pkgs.lib.generators;
-    toKeyValue {
-      mkKeyValue = mkKeyValueDefault {
-        mkValueString = v: if lib.isList v then lib.concatStringsSep " " v else mkValueStringDefault { } v;
-      } " = ";
-    };
-
-  nixConfContents = toConf (
-    {
-      sandbox = false;
-      build-users-group = "nixbld";
-      trusted-public-keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
-    }
-    // nixConf
+  groupContents = (
+    lib.concatStringsSep "\n"
+      (lib.attrValues (lib.mapAttrs groupToGroup groups))
   );
 
+  defaultNixConf = {
+    sandbox = "false";
+    build-users-group = "nixbld";
+    trusted-public-keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
+  };
+
+  nixConfContents = (lib.concatStringsSep "\n" (lib.mapAttrsFlatten (n: v:
+    let
+      vStr = if builtins.isList v then lib.concatStringsSep " " v else v;
+    in
+      "${n} = ${vStr}") (defaultNixConf // nixConf))) + "\n";
+
   userHome = if uid == 0 then "/root" else "/home/${uname}";
 
   baseSystem =
     let
       nixpkgs = pkgs.path;
-      channel = runCommand "channel-nixos" { inherit bundleNixpkgs; } ''
+      channel = pkgs.runCommand "channel-nixos" { inherit bundleNixpkgs; } ''
         mkdir $out
         if [ "$bundleNixpkgs" ]; then
-          ln -s ${
-            builtins.path {
-              path = nixpkgs;
-              name = "source";
-            }
-          } $out/nixpkgs
+          ln -s ${nixpkgs} $out/nixpkgs
           echo "[]" > $out/manifest.nix
         fi
       '';
-      # doc/manual/source/command-ref/files/manifest.nix.md
-      manifest = buildPackages.runCommand "manifest.nix" { } ''
+      rootEnv = pkgs.buildPackages.buildEnv {
+        name = "root-profile-env";
+        paths = defaultPkgs;
+      };
+      manifest = pkgs.buildPackages.runCommand "manifest.nix" { } ''
         cat > $out <<EOF
         [
-        ${lib.concatStringsSep "\n" (
-          builtins.map (
-            drv:
-            let
-              outputs = drv.outputsToInstall or [ "out" ];
-            in
-            ''
-              {
-                ${lib.concatStringsSep "\n" (
-                  builtins.map (output: ''
-                    ${output} = { outPath = "${lib.getOutput output drv}"; };
-                  '') outputs
-                )}
-                outputs = [ ${lib.concatStringsSep " " (builtins.map (x: "\"${x}\"") outputs)} ];
-                name = "${drv.name}";
-                outPath = "${drv}";
-                system = "${drv.system}";
-                type = "derivation";
-                meta = { };
-              }
-            ''
-          ) defaultPkgs
-        )}
+        ${lib.concatStringsSep "\n" (builtins.map (drv: let
+          outputs = drv.outputsToInstall or [ "out" ];
+        in ''
+          {
+            ${lib.concatStringsSep "\n" (builtins.map (output: ''
+              ${output} = { outPath = "${lib.getOutput output drv}"; };
+            '') outputs)}
+            outputs = [ ${lib.concatStringsSep " " (builtins.map (x: "\"${x}\"") outputs)} ];
+            name = "${drv.name}";
+            outPath = "${drv}";
+            system = "${drv.system}";
+            type = "derivation";
+            meta = { };
+          }
+        '') defaultPkgs)}
         ]
         EOF
       '';
-      profile = buildPackages.buildEnv {
-        name = "root-profile-env";
-        paths = defaultPkgs;
-
-        postBuild = ''
-          mv $out/manifest $out/manifest.nix
-        '';
-        inherit manifest;
-      };
-      flake-registry-path =
-        if (flake-registry == null) then
-          null
-        else if (builtins.readFileType (toString flake-registry)) == "directory" then
-          "${flake-registry}/flake-registry.json"
-        else
-          flake-registry;
+      profile = pkgs.buildPackages.runCommand "user-environment" { } ''
+        mkdir $out
+        cp -a ${rootEnv}/* $out/
+        ln -s ${manifest} $out/manifest.nix
+      '';
+      flake-registry-path = if (flake-registry == null) then
+        null
+      else if (builtins.readFileType (toString flake-registry)) == "directory" then
+        "${flake-registry}/flake-registry.json"
+      else
+        flake-registry;
     in
-    runCommand "base-system"
+    pkgs.runCommand "base-system"
       {
-        inherit
-          passwdContents
-          groupContents
-          shadowContents
-          nixConfContents
-          ;
+        inherit passwdContents groupContents shadowContents nixConfContents;
         passAsFile = [
           "passwdContents"
           "groupContents"
@@ -273,83 +225,67 @@ let
         ];
         allowSubstitutes = false;
         preferLocalBuild = true;
-      }
-      (
-        ''
-          env
-          set -x
-          mkdir -p $out/etc
+      } (''
+      env
+      set -x
+      mkdir -p $out/etc
 
-          # may get replaced by pkgs.dockerTools.caCertificates
-          mkdir -p $out/etc/ssl/certs
-          ln -s /nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs
+      mkdir -p $out/etc/ssl/certs
+      ln -s /nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs
 
-          cat $passwdContentsPath > $out/etc/passwd
-          echo "" >> $out/etc/passwd
+      cat $passwdContentsPath > $out/etc/passwd
+      echo "" >> $out/etc/passwd
 
-          cat $groupContentsPath > $out/etc/group
-          echo "" >> $out/etc/group
+      cat $groupContentsPath > $out/etc/group
+      echo "" >> $out/etc/group
 
-          cat $shadowContentsPath > $out/etc/shadow
-          echo "" >> $out/etc/shadow
+      cat $shadowContentsPath > $out/etc/shadow
+      echo "" >> $out/etc/shadow
 
-          mkdir -p $out/usr
-          ln -s /nix/var/nix/profiles/share $out/usr/
+      mkdir -p $out/usr
+      ln -s /nix/var/nix/profiles/share $out/usr/
 
-          mkdir -p $out/nix/var/nix/gcroots
+      mkdir -p $out/nix/var/nix/gcroots
 
-          mkdir $out/tmp
+      mkdir $out/tmp
 
-          mkdir -p $out/var/tmp
+      mkdir -p $out/var/tmp
 
-          mkdir -p $out/etc/nix
-          cat $nixConfContentsPath > $out/etc/nix/nix.conf
+      mkdir -p $out/etc/nix
+      cat $nixConfContentsPath > $out/etc/nix/nix.conf
 
-          mkdir -p $out${userHome}
-          mkdir -p $out/nix/var/nix/profiles/per-user/${uname}
+      mkdir -p $out${userHome}
+      mkdir -p $out/nix/var/nix/profiles/per-user/${uname}
 
-          # see doc/manual/source/command-ref/files/profiles.md
-          ln -s ${profile} $out/nix/var/nix/profiles/default-1-link
-          ln -s /nix/var/nix/profiles/default-1-link $out/nix/var/nix/profiles/default
+      ln -s ${profile} $out/nix/var/nix/profiles/default-1-link
+      ln -s /nix/var/nix/profiles/default-1-link $out/nix/var/nix/profiles/default
+      ln -s /nix/var/nix/profiles/default $out${userHome}/.nix-profile
 
-          # see doc/manual/source/command-ref/files/channels.md
-          ln -s ${channel} $out/nix/var/nix/profiles/per-user/${uname}/channels-1-link
-          ln -s /nix/var/nix/profiles/per-user/${uname}/channels-1-link $out/nix/var/nix/profiles/per-user/${uname}/channels
+      ln -s ${channel} $out/nix/var/nix/profiles/per-user/${uname}/channels-1-link
+      ln -s /nix/var/nix/profiles/per-user/${uname}/channels-1-link $out/nix/var/nix/profiles/per-user/${uname}/channels
 
-          # see doc/manual/source/command-ref/files/default-nix-expression.md
-          mkdir -p $out${userHome}/.nix-defexpr
-          ln -s /nix/var/nix/profiles/per-user/${uname}/channels $out${userHome}/.nix-defexpr/channels
-          echo "${channelURL} ${channelName}" > $out${userHome}/.nix-channels
+      mkdir -p $out${userHome}/.nix-defexpr
+      ln -s /nix/var/nix/profiles/per-user/${uname}/channels $out${userHome}/.nix-defexpr/channels
+      echo "${channelURL} ${channelName}" > $out${userHome}/.nix-channels
 
-          # may get replaced by pkgs.dockerTools.binSh & pkgs.dockerTools.usrBinEnv
-          mkdir -p $out/bin $out/usr/bin
-          ln -s ${lib.getExe' coreutils-full "env"} $out/usr/bin/env
-          ln -s ${lib.getExe bashInteractive} $out/bin/sh
+      mkdir -p $out/bin $out/usr/bin
+      ln -s ${pkgs.coreutils}/bin/env $out/usr/bin/env
+      ln -s ${pkgs.bashInteractive}/bin/bash $out/bin/sh
 
-        ''
-        + (lib.optionalString (flake-registry-path != null) ''
-          nixCacheDir="${userHome}/.cache/nix"
-          mkdir -p $out$nixCacheDir
-          globalFlakeRegistryPath="$nixCacheDir/flake-registry.json"
-          ln -s ${flake-registry-path} $out$globalFlakeRegistryPath
-          mkdir -p $out/nix/var/nix/gcroots/auto
-          rootName=$(${lib.getExe' nix "nix"} --extra-experimental-features nix-command hash file --type sha1 --base32 <(echo -n $globalFlakeRegistryPath))
-          ln -s $globalFlakeRegistryPath $out/nix/var/nix/gcroots/auto/$rootName
-        '')
-      );
+    '' + (lib.optionalString (flake-registry-path != null) ''
+      nixCacheDir="${userHome}/.cache/nix"
+      mkdir -p $out$nixCacheDir
+      globalFlakeRegistryPath="$nixCacheDir/flake-registry.json"
+      ln -s ${flake-registry-path} $out$globalFlakeRegistryPath
+      mkdir -p $out/nix/var/nix/gcroots/auto
+      rootName=$(${pkgs.nix}/bin/nix --extra-experimental-features nix-command hash file --type sha1 --base32 <(echo -n $globalFlakeRegistryPath))
+      ln -s $globalFlakeRegistryPath $out/nix/var/nix/gcroots/auto/$rootName
+    ''));
 
 in
-dockerTools.buildLayeredImageWithNixDb {
+pkgs.dockerTools.buildLayeredImageWithNixDb {
 
-  inherit
-    name
-    tag
-    maxLayers
-    uid
-    gid
-    uname
-    gname
-    ;
+  inherit name tag maxLayers uid gid uname gname;
 
   contents = [ baseSystem ];
 
@@ -365,23 +301,19 @@ dockerTools.buildLayeredImageWithNixDb {
   '';
 
   config = {
-    inherit Cmd Labels;
+    Cmd = [ "${userHome}/.nix-profile/bin/bash" ];
     User = "${toString uid}:${toString gid}";
     Env = [
       "USER=${uname}"
-      "PATH=${
-        lib.concatStringsSep ":" [
-          "${userHome}/.nix-profile/bin"
-          "/nix/var/nix/profiles/default/bin"
-          "/nix/var/nix/profiles/default/sbin"
-        ]
-      }"
-      "MANPATH=${
-        lib.concatStringsSep ":" [
-          "${userHome}/.nix-profile/share/man"
-          "/nix/var/nix/profiles/default/share/man"
-        ]
-      }"
+      "PATH=${lib.concatStringsSep ":" [
+        "${userHome}/.nix-profile/bin"
+        "/nix/var/nix/profiles/default/bin"
+        "/nix/var/nix/profiles/default/sbin"
+      ]}"
+      "MANPATH=${lib.concatStringsSep ":" [
+        "${userHome}/.nix-profile/share/man"
+        "/nix/var/nix/profiles/default/share/man"
+      ]}"
       "SSL_CERT_FILE=/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
       "GIT_SSL_CAINFO=/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
       "NIX_SSL_CERT_FILE=/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"

flake.lock

@@ -3,11 +3,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1733328505,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
         "type": "github"
       },
       "original": {
@@ -23,11 +23,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1733312601,
-        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "lastModified": 1719994518,
+        "narHash": "sha256-pQMhCCHyQGRzdfAkdJ4cIWiw+JNuWsTX7f0ZYSyz0VY=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "rev": "9227223f6d922fee3c7b190b2cc238a99527bbb7",
         "type": "github"
       },
       "original": {
@@ -48,11 +48,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1734279981,
-        "narHash": "sha256-NdaCraHPp8iYMWzdXAt5Nv6sA3MUzlCiGiR586TCwo0=",
+        "lastModified": 1721042469,
+        "narHash": "sha256-6FPUl7HVtvRHCCBQne7Ylp4p+dpP3P/OYuzjztZ4s70=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "aa9f40c906904ebd83da78e7f328cd8aeaeae785",
+        "rev": "f451c19376071a90d8c58ab1a953c6e9840527fd",
         "type": "github"
       },
       "original": {
@@ -61,18 +61,35 @@
         "type": "github"
       }
     },
+    "libgit2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1715853528,
+        "narHash": "sha256-J2rCxTecyLbbDdsyBWn9w7r3pbKRMkI9E7RvRgAqBdY=",
+        "owner": "libgit2",
+        "repo": "libgit2",
+        "rev": "36f7e21ad757a3dacc58cf7944329da6bc1d6e96",
+        "type": "github"
+      },
+      "original": {
+        "owner": "libgit2",
+        "ref": "v1.8.1",
+        "repo": "libgit2",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1747179050,
-        "narHash": "sha256-qhFMmDkeJX9KJwr5H32f1r7Prs7XbQWtO0h3V0a0rFY=",
+        "lastModified": 1723688146,
+        "narHash": "sha256-sqLwJcHYeWLOeP/XoLwAtYjr01TISlkOfz+NG82pbdg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "adaa24fbf46737f3f1b5497bf64bae750f82942e",
+        "rev": "c3d4ac725177c030b1e289015989da2ad9d56af0",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixos-24.05",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -114,6 +131,7 @@
         "flake-compat": "flake-compat",
         "flake-parts": "flake-parts",
         "git-hooks-nix": "git-hooks-nix",
+        "libgit2": "libgit2",
         "nixpkgs": "nixpkgs",
         "nixpkgs-23-11": "nixpkgs-23-11",
         "nixpkgs-regression": "nixpkgs-regression"

flake.nix

@@ -1,14 +1,11 @@
 {
   description = "The purely functional package manager";
 
-  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
   inputs.nixpkgs-regression.url = "github:NixOS/nixpkgs/215d4d0fd80ca5163643b03a33fde804a29cc1e2";
   inputs.nixpkgs-23-11.url = "github:NixOS/nixpkgs/a62e6edd6d5e1fa0329b8653c801147986f8d446";
-  inputs.flake-compat = {
-    url = "github:edolstra/flake-compat";
-    flake = false;
-  };
+  inputs.flake-compat = { url = "github:edolstra/flake-compat"; flake = false; };
+  inputs.libgit2 = { url = "github:libgit2/libgit2/v1.8.1"; flake = false; };
 
   # dev tooling
   inputs.flake-parts.url = "github:hercules-ci/flake-parts";
@@ -21,37 +18,25 @@
   inputs.git-hooks-nix.inputs.flake-compat.follows = "";
   inputs.git-hooks-nix.inputs.gitignore.follows = "";
 
-  outputs =
-    inputs@{
-      self,
-      nixpkgs,
-      nixpkgs-regression,
-      ...
-    }:
+  outputs = inputs@{ self, nixpkgs, nixpkgs-regression, libgit2, ... }:
+
 
     let
       inherit (nixpkgs) lib;
 
-      officialRelease = true;
+      officialRelease = false;
 
       linux32BitSystems = [ "i686-linux" ];
-      linux64BitSystems = [
-        "x86_64-linux"
-        "aarch64-linux"
-      ];
+      linux64BitSystems = [ "x86_64-linux" "aarch64-linux" ];
       linuxSystems = linux32BitSystems ++ linux64BitSystems;
-      darwinSystems = [
-        "x86_64-darwin"
-        "aarch64-darwin"
-      ];
+      darwinSystems = [ "x86_64-darwin" "aarch64-darwin" ];
       systems = linuxSystems ++ darwinSystems;
 
       crossSystems = [
         "armv6l-unknown-linux-gnueabihf"
         "armv7l-unknown-linux-gnueabihf"
         "riscv64-unknown-linux-gnu"
-        # Disabled because of https://github.com/NixOS/nixpkgs/issues/344423
-        # "x86_64-unknown-netbsd"
+        "x86_64-unknown-netbsd"
         "x86_64-unknown-freebsd"
         "x86_64-w64-mingw32"
       ];
@@ -73,66 +58,62 @@
         (Provided that the names are unique.)
 
         See https://nixos.org/manual/nixpkgs/stable/index.html#function-library-lib.attrsets.concatMapAttrs
-      */
+       */
       flatMapAttrs = attrs: f: lib.concatMapAttrs f attrs;
 
       forAllSystems = lib.genAttrs systems;
 
       forAllCrossSystems = lib.genAttrs crossSystems;
 
-      forAllStdenvs = lib.genAttrs stdenvs;
+      forAllStdenvs = f:
+        lib.listToAttrs
+          (map
+            (stdenvName: {
+              name = "${stdenvName}Packages";
+              value = f stdenvName;
+            })
+            stdenvs);
+
 
       # We don't apply flake-parts to the whole flake so that non-development attributes
       # load without fetching any development inputs.
       devFlake = inputs.flake-parts.lib.mkFlake { inherit inputs; } {
         imports = [ ./maintainers/flake-module.nix ];
         systems = lib.subtractLists crossSystems systems;
-        perSystem =
-          { system, ... }:
-          {
-            _module.args.pkgs = nixpkgsFor.${system}.native;
-          };
+        perSystem = { system, ... }: {
+          _module.args.pkgs = nixpkgsFor.${system}.native;
+        };
       };
 
       # Memoize nixpkgs for different platforms for efficiency.
-      nixpkgsFor = forAllSystems (
-        system:
-        let
-          make-pkgs =
-            crossSystem:
-            forAllStdenvs (
-              stdenv:
-              import nixpkgs {
-                localSystem = {
-                  inherit system;
-                };
-                crossSystem =
-                  if crossSystem == null then
-                    null
-                  else
-                    {
-                      config = crossSystem;
-                    }
-                    // lib.optionalAttrs (crossSystem == "x86_64-unknown-freebsd13") {
-                      useLLVM = true;
-                    };
-                overlays = [
-                  (overlayFor (pkgs: pkgs.${stdenv}))
-                ];
-              }
-            );
-        in
-        rec {
-          nativeForStdenv = make-pkgs null;
-          crossForStdenv = forAllCrossSystems make-pkgs;
-          # Alias for convenience
-          native = nativeForStdenv.stdenv;
-          cross = forAllCrossSystems (crossSystem: crossForStdenv.${crossSystem}.stdenv);
-        }
-      );
+      nixpkgsFor = forAllSystems
+        (system: let
+          make-pkgs = crossSystem: stdenv: import nixpkgs {
+            localSystem = {
+              inherit system;
+            };
+            crossSystem = if crossSystem == null then null else {
+              config = crossSystem;
+            } // lib.optionalAttrs (crossSystem == "x86_64-unknown-freebsd13") {
+              useLLVM = true;
+            };
+            overlays = [
+              (overlayFor (p: p.${stdenv}))
+            ];
+          };
+          stdenvs = forAllStdenvs (make-pkgs null);
+          native = stdenvs.stdenvPackages;
+        in {
+          inherit stdenvs native;
+          static = native.pkgsStatic;
+          cross = forAllCrossSystems (crossSystem: make-pkgs crossSystem "stdenv");
+        });
 
-      overlayFor =
-        getStdenv: final: prev:
+      binaryTarball = nix: pkgs: pkgs.callPackage ./scripts/binary-tarball.nix {
+        inherit nix;
+      };
+
+      overlayFor = getStdenv: final: prev:
         let
           stdenv = getStdenv final;
         in
@@ -143,46 +124,49 @@
           # without "polluting" the top level "`pkgs`" attrset.
           # This also has the benefit of providing us with a distinct set of packages
           # we can iterate over.
-          # The `2` suffix is here because otherwise it interferes with `nixVersions.latest`, which is used in daemon compat tests.
-          nixComponents2 =
+          nixComponents =
             lib.makeScopeWithSplicing'
               {
                 inherit (final) splicePackages;
-                inherit (final.nixDependencies2) newScope;
+                inherit (final.nixDependencies) newScope;
               }
               {
-                otherSplices = final.generateSplicesForMkScope "nixComponents2";
+                otherSplices = final.generateSplicesForMkScope "nixComponents";
                 f = import ./packaging/components.nix {
                   inherit (final) lib;
                   inherit officialRelease;
-                  pkgs = final;
                   src = self;
-                  maintainers = [ ];
                 };
               };
 
           # The dependencies are in their own scope, so that they don't have to be
-          # in Nixpkgs top level `pkgs` or `nixComponents2`.
-          # The `2` suffix is here because otherwise it interferes with `nixVersions.latest`, which is used in daemon compat tests.
-          nixDependencies2 =
+          # in Nixpkgs top level `pkgs` or `nixComponents`.
+          nixDependencies =
             lib.makeScopeWithSplicing'
               {
                 inherit (final) splicePackages;
-                inherit (final) newScope; # layered directly on pkgs, unlike nixComponents2 above
+                inherit (final) newScope; # layered directly on pkgs, unlike nixComponents above
               }
               {
-                otherSplices = final.generateSplicesForMkScope "nixDependencies2";
+                otherSplices = final.generateSplicesForMkScope "nixDependencies";
                 f = import ./packaging/dependencies.nix {
                   inherit inputs stdenv;
                   pkgs = final;
                 };
               };
 
-          nix = final.nixComponents2.nix-cli;
+          nix = final.nixComponents.nix-cli;
+
+          # See https://github.com/NixOS/nixpkgs/pull/214409
+          # Remove when fixed in this flake's nixpkgs
+          pre-commit =
+            if prev.stdenv.hostPlatform.system == "i686-linux"
+            then (prev.pre-commit.override (o: { dotnet-sdk = ""; })).overridePythonAttrs (o: { doCheck = false; })
+            else prev.pre-commit;
+
         };
 
-    in
-    {
+    in {
       # A Nixpkgs overlay that overrides the 'nix' and
       # 'nix-perl-bindings' packages.
       overlays.default = overlayFor (p: p.stdenv);
@@ -190,6 +174,7 @@
       hydraJobs = import ./packaging/hydra.nix {
         inherit
           inputs
+          binaryTarball
           forAllCrossSystems
           forAllSystems
           lib
@@ -200,270 +185,151 @@
           ;
       };
 
-      checks = forAllSystems (
-        system:
-        {
-          installerScriptForGHA = self.hydraJobs.installerScriptForGHA.${system};
-          installTests = self.hydraJobs.installTests.${system};
-          nixpkgsLibTests = self.hydraJobs.tests.nixpkgsLibTests.${system};
-          rl-next =
-            let
-              pkgs = nixpkgsFor.${system}.native;
-            in
-            pkgs.buildPackages.runCommand "test-rl-next-release-notes" { } ''
-              LANG=C.UTF-8 ${pkgs.changelog-d}/bin/changelog-d ${./doc/manual/rl-next} >$out
-            '';
-          repl-completion = nixpkgsFor.${system}.native.callPackage ./tests/repl-completion.nix { };
+      checks = forAllSystems (system: {
+        binaryTarball = self.hydraJobs.binaryTarball.${system};
+        installTests = self.hydraJobs.installTests.${system};
+        nixpkgsLibTests = self.hydraJobs.tests.nixpkgsLibTests.${system};
+        rl-next =
+          let pkgs = nixpkgsFor.${system}.native;
+          in pkgs.buildPackages.runCommand "test-rl-next-release-notes" { } ''
+          LANG=C.UTF-8 ${pkgs.changelog-d}/bin/changelog-d ${./doc/manual/rl-next} >$out
+        '';
+        repl-completion = nixpkgsFor.${system}.native.callPackage ./tests/repl-completion.nix { };
+      } // (lib.optionalAttrs (builtins.elem system linux64BitSystems)) {
+        dockerImage = self.hydraJobs.dockerImage.${system};
+      } // (lib.optionalAttrs (!(builtins.elem system linux32BitSystems))) {
+        # Some perl dependencies are broken on i686-linux.
+        # Since the support is only best-effort there, disable the perl
+        # bindings
 
-          /**
-            Checks for our packaging expressions.
-            This shouldn't build anything significant; just check that things
-            (including derivations) are _set up_ correctly.
-          */
-          packaging-overriding =
-            let
-              pkgs = nixpkgsFor.${system}.native;
-              nix = self.packages.${system}.nix;
-            in
-            assert (nix.appendPatches [ pkgs.emptyFile ]).libs.nix-util.src.patches == [ pkgs.emptyFile ];
-            if pkgs.stdenv.buildPlatform.isDarwin then
-              lib.warn "packaging-overriding check currently disabled because of a permissions issue on macOS" pkgs.emptyFile
-            else
-              # If this fails, something might be wrong with how we've wired the scope,
-              # or something could be broken in Nixpkgs.
-              pkgs.testers.testEqualContents {
-                assertion = "trivial patch does not change source contents";
-                expected = "${./.}";
-                actual =
-                  # Same for all components; nix-util is an arbitrary pick
-                  (nix.appendPatches [ pkgs.emptyFile ]).libs.nix-util.src;
-              };
-        }
-        // (lib.optionalAttrs (builtins.elem system linux64BitSystems)) {
-          dockerImage = self.hydraJobs.dockerImage.${system};
-        }
-        // (lib.optionalAttrs (!(builtins.elem system linux32BitSystems))) {
-          # Some perl dependencies are broken on i686-linux.
-          # Since the support is only best-effort there, disable the perl
-          # bindings
-          perlBindings = self.hydraJobs.perlBindings.${system};
-        }
-        # Add "passthru" tests
-        //
-          flatMapAttrs
-            (
-              {
-                # Run all tests with UBSAN enabled. Running both with ubsan and
-                # without doesn't seem to have much immediate benefit for doubling
-                # the GHA CI workaround.
-                #
-                # TODO: Work toward enabling "address,undefined" if it seems feasible.
-                # This would maybe require dropping Boost coroutines and ignoring intentional
-                # memory leaks with detect_leaks=0.
-                "" = rec {
-                  nixpkgs = nixpkgsFor.${system}.native;
-                  nixComponents = nixpkgs.nixComponents2.overrideScope (
-                    nixCompFinal: nixCompPrev: {
-                      mesonComponentOverrides = _finalAttrs: prevAttrs: {
-                        mesonFlags =
-                          (prevAttrs.mesonFlags or [ ])
-                          # TODO: Macos builds instrumented with ubsan take very long
-                          # to run functional tests.
-                          ++ lib.optionals (!nixpkgs.stdenv.hostPlatform.isDarwin) [
-                            (lib.mesonOption "b_sanitize" "undefined")
-                          ];
-                      };
-                    }
-                  );
-                };
-              }
-              // lib.optionalAttrs (!nixpkgsFor.${system}.native.stdenv.hostPlatform.isDarwin) {
-                # TODO: enable static builds for darwin, blocked on:
-                #       https://github.com/NixOS/nixpkgs/issues/320448
-                # TODO: disabled to speed up GHA CI.
-                # "static-" = {
-                #   nixpkgs = nixpkgsFor.${system}.native.pkgsStatic;
-                # };
-              }
+        # Temporarily disabled because GitHub Actions OOM issues. Once
+        # the old build system is gone and we are back to one build
+        # system, we should reenable this.
+        #perlBindings = self.hydraJobs.perlBindings.${system};
+      }
+      # Add "passthru" tests
+      // flatMapAttrs ({
+          "" = nixpkgsFor.${system}.native;
+        } // lib.optionalAttrs (! nixpkgsFor.${system}.native.stdenv.hostPlatform.isDarwin) {
+          # TODO: enable static builds for darwin, blocked on:
+          #       https://github.com/NixOS/nixpkgs/issues/320448
+          # TODO: disabled to speed up GHA CI.
+          #"static-" = nixpkgsFor.${system}.static;
+        })
+        (nixpkgsPrefix: nixpkgs:
+          flatMapAttrs nixpkgs.nixComponents
+            (pkgName: pkg:
+              flatMapAttrs pkg.tests or {}
+              (testName: test: {
+                "${nixpkgsPrefix}${pkgName}-${testName}" = test;
+              })
             )
-            (
-              nixpkgsPrefix:
-              {
-                nixpkgs,
-                nixComponents ? nixpkgs.nixComponents2,
-              }:
-              flatMapAttrs nixComponents (
-                pkgName: pkg:
-                flatMapAttrs pkg.tests or { } (
-                  testName: test: {
-                    "${nixpkgsPrefix}${pkgName}-${testName}" = test;
-                  }
-                )
-              )
-              // lib.optionalAttrs (nixpkgs.stdenv.hostPlatform == nixpkgs.stdenv.buildPlatform) {
-                "${nixpkgsPrefix}nix-functional-tests" = nixComponents.nix-functional-tests;
-              }
-            )
-        // devFlake.checks.${system} or { }
+          // lib.optionalAttrs (nixpkgs.stdenv.hostPlatform == nixpkgs.stdenv.buildPlatform) {
+            "${nixpkgsPrefix}nix-functional-tests" = nixpkgs.nixComponents.nix-functional-tests;
+          }
+        )
+      // devFlake.checks.${system} or {}
       );
 
-      packages = forAllSystems (
-        system:
-        {
-          # Here we put attributes that map 1:1 into packages.<system>, ie
+      packages = forAllSystems (system:
+        { # Here we put attributes that map 1:1 into packages.<system>, ie
           # for which we don't apply the full build matrix such as cross or static.
           inherit (nixpkgsFor.${system}.native)
-            changelog-d
-            ;
+            changelog-d;
           default = self.packages.${system}.nix;
-          installerScriptForGHA = self.hydraJobs.installerScriptForGHA.${system};
-          binaryTarball = self.hydraJobs.binaryTarball.${system};
           # TODO probably should be `nix-cli`
           nix = self.packages.${system}.nix-everything;
-          nix-manual = nixpkgsFor.${system}.native.nixComponents2.nix-manual;
-          nix-internal-api-docs = nixpkgsFor.${system}.native.nixComponents2.nix-internal-api-docs;
-          nix-external-api-docs = nixpkgsFor.${system}.native.nixComponents2.nix-external-api-docs;
+          nix-manual = nixpkgsFor.${system}.native.nixComponents.nix-manual;
+          nix-internal-api-docs = nixpkgsFor.${system}.native.nixComponents.nix-internal-api-docs;
+          nix-external-api-docs = nixpkgsFor.${system}.native.nixComponents.nix-external-api-docs;
         }
         # We need to flatten recursive attribute sets of derivations to pass `flake check`.
-        //
-          flatMapAttrs
-            {
-              # Components we'll iterate over in the upcoming lambda
-              "nix-util" = { };
-              "nix-util-c" = { };
-              "nix-util-test-support" = { };
-              "nix-util-tests" = { };
+        // flatMapAttrs
+          { # Components we'll iterate over in the upcoming lambda
+            "nix-util" = { };
+            "nix-util-c" = { };
+            "nix-util-test-support" = { };
+            "nix-util-tests" = { };
 
-              "nix-store" = { };
-              "nix-store-c" = { };
-              "nix-store-test-support" = { };
-              "nix-store-tests" = { };
+            "nix-store" = { };
+            "nix-store-c" = { };
+            "nix-store-test-support" = { };
+            "nix-store-tests" = { };
 
-              "nix-fetchers" = { };
-              "nix-fetchers-c" = { };
-              "nix-fetchers-tests" = { };
+            "nix-fetchers" = { };
+            "nix-fetchers-tests" = { };
 
-              "nix-expr" = { };
-              "nix-expr-c" = { };
-              "nix-expr-test-support" = { };
-              "nix-expr-tests" = { };
+            "nix-expr" = { };
+            "nix-expr-c" = { };
+            "nix-expr-test-support" = { };
+            "nix-expr-tests" = { };
 
-              "nix-flake" = { };
-              "nix-flake-c" = { };
-              "nix-flake-tests" = { };
+            "nix-flake" = { };
+            "nix-flake-tests" = { };
 
-              "nix-main" = { };
-              "nix-main-c" = { };
+            "nix-main" = { };
+            "nix-main-c" = { };
 
-              "nix-cmd" = { };
+            "nix-cmd" = { };
 
-              "nix-cli" = { };
+            "nix-cli" = { };
 
-              "nix-everything" = { };
+            "nix-everything" = { };
 
-              "nix-functional-tests" = {
-                supportsCross = false;
-              };
+            "nix-functional-tests" = { supportsCross = false; };
 
-              "nix-perl-bindings" = {
-                supportsCross = false;
-              };
+            "nix-perl-bindings" = { supportsCross = false; };
+          }
+          (pkgName: { supportsCross ? true }: {
+              # These attributes go right into `packages.<system>`.
+              "${pkgName}" = nixpkgsFor.${system}.native.nixComponents.${pkgName};
+              "${pkgName}-static" = nixpkgsFor.${system}.static.nixComponents.${pkgName};
             }
-            (
-              pkgName:
-              {
-                supportsCross ? true,
-              }:
-              {
-                # These attributes go right into `packages.<system>`.
-                "${pkgName}" = nixpkgsFor.${system}.native.nixComponents2.${pkgName};
-                "${pkgName}-static" = nixpkgsFor.${system}.native.pkgsStatic.nixComponents2.${pkgName};
-                "${pkgName}-llvm" = nixpkgsFor.${system}.native.pkgsLLVM.nixComponents2.${pkgName};
-              }
-              // lib.optionalAttrs supportsCross (
-                flatMapAttrs (lib.genAttrs crossSystems (_: { })) (
-                  crossSystem:
-                  { }:
-                  {
-                    # These attributes go right into `packages.<system>`.
-                    "${pkgName}-${crossSystem}" = nixpkgsFor.${system}.cross.${crossSystem}.nixComponents2.${pkgName};
-                  }
-                )
-              )
-              // flatMapAttrs (lib.genAttrs stdenvs (_: { })) (
-                stdenvName:
-                { }:
-                {
-                  # These attributes go right into `packages.<system>`.
-                  "${pkgName}-${stdenvName}" =
-                    nixpkgsFor.${system}.nativeForStdenv.${stdenvName}.nixComponents2.${pkgName};
-                }
-              )
-            )
+            // lib.optionalAttrs supportsCross (flatMapAttrs (lib.genAttrs crossSystems (_: { })) (crossSystem: {}: {
+              # These attributes go right into `packages.<system>`.
+              "${pkgName}-${crossSystem}" = nixpkgsFor.${system}.cross.${crossSystem}.nixComponents.${pkgName};
+            }))
+            // flatMapAttrs (lib.genAttrs stdenvs (_: { })) (stdenvName: {}: {
+              # These attributes go right into `packages.<system>`.
+              "${pkgName}-${stdenvName}" = nixpkgsFor.${system}.stdenvs."${stdenvName}Packages".nixComponents.${pkgName};
+            })
+          )
         // lib.optionalAttrs (builtins.elem system linux64BitSystems) {
-          dockerImage =
-            let
-              pkgs = nixpkgsFor.${system}.native;
-              image = pkgs.callPackage ./docker.nix {
-                tag = pkgs.nix.version;
-              };
-            in
-            pkgs.runCommand "docker-image-tarball-${pkgs.nix.version}"
-              { meta.description = "Docker image with Nix for ${system}"; }
-              ''
-                mkdir -p $out/nix-support
-                image=$out/image.tar.gz
-                ln -s ${image} $image
-                echo "file binary-dist $image" >> $out/nix-support/hydra-build-products
-              '';
-        }
-      );
+        dockerImage =
+          let
+            pkgs = nixpkgsFor.${system}.native;
+            image = import ./docker.nix { inherit pkgs; tag = pkgs.nix.version; };
+          in
+          pkgs.runCommand
+            "docker-image-tarball-${pkgs.nix.version}"
+            { meta.description = "Docker image with Nix for ${system}"; }
+            ''
+              mkdir -p $out/nix-support
+              image=$out/image.tar.gz
+              ln -s ${image} $image
+              echo "file binary-dist $image" >> $out/nix-support/hydra-build-products
+            '';
+      });
 
-      devShells =
-        let
-          makeShell = import ./packaging/dev-shell.nix { inherit lib devFlake; };
-          prefixAttrs = prefix: lib.concatMapAttrs (k: v: { "${prefix}-${k}" = v; });
-        in
-        forAllSystems (
-          system:
-          prefixAttrs "native" (
-            forAllStdenvs (
-              stdenvName:
-              makeShell {
-                pkgs = nixpkgsFor.${system}.nativeForStdenv.${stdenvName};
-              }
-            )
-          )
-          // lib.optionalAttrs (!nixpkgsFor.${system}.native.stdenv.isDarwin) (
-            prefixAttrs "static" (
-              forAllStdenvs (
-                stdenvName:
-                makeShell {
-                  pkgs = nixpkgsFor.${system}.nativeForStdenv.${stdenvName}.pkgsStatic;
-                }
-              )
-            )
-            // prefixAttrs "llvm" (
-              forAllStdenvs (
-                stdenvName:
-                makeShell {
-                  pkgs = nixpkgsFor.${system}.nativeForStdenv.${stdenvName}.pkgsLLVM;
-                }
-              )
-            )
-            // prefixAttrs "cross" (
-              forAllCrossSystems (
-                crossSystem:
-                makeShell {
-                  pkgs = nixpkgsFor.${system}.cross.${crossSystem};
-                }
-              )
-            )
-          )
-          // {
-            native = self.devShells.${system}.native-stdenv;
-            default = self.devShells.${system}.native;
+      devShells = let
+        makeShell = import ./packaging/dev-shell.nix { inherit lib devFlake; };
+        prefixAttrs = prefix: lib.concatMapAttrs (k: v: { "${prefix}-${k}" = v; });
+      in
+        forAllSystems (system:
+          prefixAttrs "native" (forAllStdenvs (stdenvName: makeShell {
+            pkgs = nixpkgsFor.${system}.stdenvs."${stdenvName}Packages";
+          })) //
+          lib.optionalAttrs (!nixpkgsFor.${system}.native.stdenv.isDarwin) (
+            prefixAttrs "static" (forAllStdenvs (stdenvName: makeShell {
+              pkgs = nixpkgsFor.${system}.stdenvs."${stdenvName}Packages".pkgsStatic;
+            })) //
+            prefixAttrs "cross" (forAllCrossSystems (crossSystem: makeShell {
+              pkgs = nixpkgsFor.${system}.cross.${crossSystem};
+            }))
+          ) //
+          {
+            default = self.devShells.${system}.native-stdenvPackages;
           }
         );
-    };
+  };
 }

m4/gcc_bug_80431.m4

@@ -0,0 +1,66 @@
+# Ensure that this bug is not present in the C++ toolchain we are using.
+#
+# URL for bug: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80431
+#
+# The test program is from that issue, with only a slight modification
+# to set an exit status instead of printing strings.
+AC_DEFUN([ENSURE_NO_GCC_BUG_80431],
+[
+  AC_MSG_CHECKING([that GCC bug 80431 is fixed])
+  AC_LANG_PUSH(C++)
+  AC_RUN_IFELSE(
+    [AC_LANG_PROGRAM(
+      [[
+        #include <cstdio>
+
+        static bool a = true;
+        static bool b = true;
+
+        struct Options { };
+
+        struct Option
+        {
+            Option(Options * options)
+            {
+                a = false;
+            }
+
+            ~Option()
+            {
+                b = false;
+            }
+        };
+
+        struct MyOptions : Options { };
+
+        struct MyOptions2 : virtual MyOptions
+        {
+            Option foo{this};
+        };
+      ]],
+      [[
+        {
+            MyOptions2 opts;
+        }
+        return (a << 1) | b;
+      ]])],
+    [status_80431=0],
+    [status_80431=$?],
+    [status_80431=''])
+  AC_LANG_POP(C++)
+  AS_CASE([$status_80431],
+    [''],[
+      AC_MSG_RESULT(cannot check because cross compiling)
+      AC_MSG_NOTICE(assume we are bug free)
+    ],
+    [0],[
+      AC_MSG_RESULT(yes)
+    ],
+    [2],[
+      AC_MSG_RESULT(no)
+      AC_MSG_ERROR(Cannot build Nix with C++ compiler with this bug)
+    ],
+    [
+      AC_MSG_RESULT(unexpected result $status_80431: not expected failure with bug, ignoring)
+    ])
+])

maintainers/README.md

@@ -37,7 +37,7 @@ The team is on Github as [@NixOS/nix-team](https://github.com/orgs/NixOS/teams/n
 
 The team meets twice a week (times are denoted in the [Europe/Amsterdam](https://en.m.wikipedia.org/wiki/Time_in_the_Netherlands) time zone):
 
-- Discussion meeting: Wednesday 21:00-22:00 Europe/Amsterdam see [calendar](https://calendar.google.com/calendar/u/0/embed?src=b9o52fobqjak8oq8lfkhg3t0qg@group.calendar.google.com).
+- Discussion meeting: [Wednesday 21:00-22:00 Europe/Amsterdam](https://www.google.com/calendar/event?eid=ZG5rZzNyajRjajducGV2NGY5aGkzYWIwdnJfMjAyNDA1MDhUMTkwMDAwWiBiOW81MmZvYnFqYWs4b3E4bGZraGczdDBxZ0Bn)
 
   1. Triage issues and pull requests from the [No Status](#no-status) column (30 min)
   2. Discuss issues and pull requests from the [To discuss](#to-discuss) column (30 min).
@@ -46,7 +46,7 @@ The team meets twice a week (times are denoted in the [Europe/Amsterdam](https:/
        - mark it as draft if it is blocked on the contributor
        - escalate it back to the team by moving it to To discuss, and leaving a comment as to why the issue needs to be discussed again.
 
-- Work meeting: Mondays 14:00-16:00 Europe/Amsterdam see [calendar](https://calendar.google.com/calendar/u/0/embed?src=b9o52fobqjak8oq8lfkhg3t0qg@group.calendar.google.com).
+- Work meeting: [Mondays 14:00-16:00 Europe/Amsterdam](https://www.google.com/calendar/event?eid=Ym52NDdzYnRic2NzcDcybjZiNDhpNzhpa3NfMjAyNDA1MTNUMTIwMDAwWiBiOW81MmZvYnFqYWs4b3E4bGZraGczdDBxZ0Bn)
 
   1. Code review on pull requests from [In review](#in-review).
   2. Other chores and tasks.

maintainers/data/release-credits-email-to-handle.json

@@ -98,92 +98,5 @@
     "aks.kenji@protonmail.com": "a-kenji",
     "54070204+0x5a4@users.noreply.github.com": "0x5a4",
     "brian@bmcgee.ie": "brianmcgee",
-    "squalus@squalus.net": "squalus",
-    "kusold@users.noreply.github.com": "kusold",
-    "37929162+mergify[bot]@users.noreply.github.com": "mergify[bot]",
-    "ilja@mailbox.org": "suruaku",
-    "and.ham95@gmail.com": "andrewhamon",
-    "andy.hamon@discordapp.com": "andrewhamon",
-    "siddarthkay@gmail.com": "siddarthkay",
-    "apoelstra@wpsoftware.net": "apoelstra",
-    "asmadeus@codewreck.org": "martinetd",
-    "tristan.ross@midstall.com": "RossComputerGuy",
-    "bryanlais@gmail.com": "bryango",
-    "157494086+allrealmsoflife@users.noreply.github.com": "allrealmsoflife",
-    "ConnorBaker01@gmail.com": "ConnorBaker",
-    "me@momee.mt": "momeemt",
-    "martin@push-f.com": "not-my-profile",
-    "90870942+trueNAHO@users.noreply.github.com": "trueNAHO",
-    "49885263+knotapun@users.noreply.github.com": "knotapun",
-    "iam@lach.pw": "CertainLach",
-    "elikowa@gmail.com": "elikoga",
-    "greg.curtis@jetpack.io": "gcurtis",
-    "git@sphalerite.org": "lheckemann",
-    "mightyiampresence@gmail.com": "mightyiam",
-    "spamfaenger@gmx.de": "dwt",
-    "graham@grahamc.com": "grahamc",
-    "wh0@users.noreply.github.com": "wh0",
-    "25388474+mupdt@users.noreply.github.com": "mupdt",
-    "anatoli@rainforce.org": "abitrolly",
-    "h0nIg@users.noreply.github.com": "h0nIg",
-    "CyberShadow@users.noreply.github.com": "CyberShadow",
-    "gavinnjohn@gmail.com": "Pandapip1",
-    "picnoir@alternativebit.fr": "picnoir",
-    "140354451+myclevorname@users.noreply.github.com": "myclevorname",
-    "bonniot@gmail.com": "dbdr",
-    "jack@wilsdon.me": "jackwilsdon",
-    "143541718+WxNzEMof@users.noreply.github.com": "the-sun-will-rise-tomorrow",
-    "fabianm88@gmail.com": "B4dM4n",
-    "silvan.mosberger@moduscreate.com": "infinisil",
-    "leandro.reina@ororatech.com": "kip93",
-    "else@someonex.net": "SomeoneSerge",
-    "aiden@aidenfoxivey.com": "aidenfoxivey",
-    "maxoscarhearnden@gmail.com": "MaxHearnden",
-    "silvanshade@users.noreply.github.com": "silvanshade",
-    "illia.bobyr@gmail.com": "ilya-bobyr",
-    "65963536+etherswangel@users.noreply.github.com": "stevalkr",
-    "thebenmachine+git@gmail.com": "bmillwood",
-    "leandro@kip93.net": "kip93",
-    "hello@briancamacho.me": "b-camacho",
-    "bcamacho@anduril.com": "bcamacho2",
-    "oldshensheep@gmail.com": "oldshensheep",
-    "thomasmiedema@gmail.com": "thomie",
-    "xokdvium@proton.me": "xokdvium",
-    "kaction@disroot.org": "KAction",
-    "serenity@kaction.cc": null,
-    "dev@erik.work": "Kirens",
-    "felix@alternativebit.fr": "picnoir",
-    "butirsky@gmail.com": "bam80",
-    "look@my.amazin.horse": "Valodim",
-    "jeremyfleischman@gmail.com": "jfly",
-    "vit.gottwald@gmail.com": "VitGottwald",
-    "a@unnamed.website": "anthowan",
-    "hello@whatsthecraic.net": "whatsthecraic",
-    "alex.rom23@mail.ru": "ajlekcahdp4",
-    "domagoj@tuta.com": "allrealmsoflife",
-    "uluc.sengil@gmail.com": "ulucs",
-    "prc.zhao@outlook.com": "Prince213",
-    "the-tumultuous-unicorn-of-darkness@gmx.com": "TheTumultuousUnicornOfDarkness",
-    "dev@rodney.id.au": "rvl",
-    "pe@pijul.org": "P-E-Meunier",
-    "yannik@floxdev.com": "ysndr",
-    "73017521+egorkonovalov@users.noreply.github.com": "egorkonovalov",
-    "raito@lix.systems": null,
-    "nikita.nikita.krasnov@gmail.com": "synalice",
-    "lucperkins@gmail.com": "lucperkins",
-    "vladimir.cunat@nic.cz": "vcunat",
-    "walther@technowledgy.de": "wolfgangwalther",
-    "jayesh.mail@gmail.com": "jayeshv",
-    "samuli.thomasson@pm.me": "SimSaladin",
-    "kevin@stravers.net": "kstrafe",
-    "poperigby@mailbox.org": "poperigby",
-    "cole.helbling@determinate.systems": "cole-h",
-    "donottellmetonottellyou@gmail.com": "donottellmetonottellyou",
-    "getchoo@tuta.io": "getchoo",
-    "alex.ford@determinate.systems": "gustavderdrache",
-    "stefan.r.boca@gmail.com": "stefanboca",
-    "gwenn.lebihan7@gmail.com": "gwennlbh",
-    "hey@ewen.works": "gwennlbh",
-    "matt@sturgeon.me.uk": "MattSturgeon",
-    "pbsds@hotmail.com": "pbsds"
+    "squalus@squalus.net": "squalus"
 }

maintainers/data/release-credits-handle-to-name.json

@@ -86,81 +86,5 @@
     "Aleksanaa": "Aleksana",
     "YorikSar": "Yuriy Taraday",
     "kjeremy": "Jeremy Kolb",
-    "artemist": "Artemis Tosini",
-    "the-sun-will-rise-tomorrow": null,
-    "gcurtis": "Greg Curtis",
-    "ConnorBaker": "Connor Baker",
-    "abitrolly": "Anatoli Babenia",
-    "allrealmsoflife": "Domagoj Mi\u0161kovi\u0107",
-    "andrewhamon": "Andy Hamon",
-    "picnoir": "F\u00e9lix",
-    "dbdr": null,
-    "suruaku": "Ilja",
-    "jackwilsdon": "Jack Wilsdon",
-    "mergify[bot]": null,
-    "kusold": "Mike Kusold",
-    "lheckemann": "Linus Heckemann",
-    "h0nIg": null,
-    "grahamc": "Graham Christensen",
-    "not-my-profile": "Martin Fischer",
-    "CyberShadow": "Vladimir Panteleev",
-    "Pandapip1": "Gavin John",
-    "RossComputerGuy": "Tristan Ross",
-    "elikoga": null,
-    "martinetd": "Dominique Martinet",
-    "knotapun": "Parker Jones",
-    "mightyiam": "Shahar \"Dawn\" Or",
-    "siddarthkay": "Siddarth Kumar",
-    "apoelstra": "Andrew Poelstra",
-    "myclevorname": null,
-    "CertainLach": "Yaroslav Bolyukin",
-    "trueNAHO": "NAHO",
-    "wh0": null,
-    "mupdt": "Matej Urbas",
-    "momeemt": "Mutsuha Asada",
-    "dwt": "\u202erekc\u00e4H nitraM\u202e",
-    "aidenfoxivey": "Aiden Fox Ivey",
-    "ilya-bobyr": "Illia Bobyr",
-    "B4dM4n": "Fabian M\u00f6ller",
-    "silvanshade": null,
-    "bcamacho2": null,
-    "bmillwood": "Ben Millwood",
-    "stevalkr": "Steve Walker",
-    "SomeoneSerge": "Someone",
-    "b-camacho": "Brian Camacho",
-    "MaxHearnden": null,
-    "kip93": "Leandro Emmanuel Reina Kiperman",
-    "oldshensheep": "Ruby Rose",
-    "KAction": "Dmitry Bogatov",
-    "thomie": "Thomas Miedema",
-    "Kirens": "Erik Nygren",
-    "Prince213": "Sizhe Zhao",
-    "anthowan": "Anthony Wang",
-    "jfly": "Jeremy Fleischman",
-    "VitGottwald": "Vit Gottwald",
-    "bam80": "Andrey Butirsky",
-    "ulucs": null,
-    "P-E-Meunier": "Pierre-Etienne Meunier",
-    "ysndr": "Yannik Sander",
-    "TheTumultuousUnicornOfDarkness": "The Tumultuous Unicorn Of Darkness",
-    "ajlekcahdp4": "Alexander Romanov",
-    "Valodim": "Vincent Breitmoser",
-    "rvl": "Rodney Lorrimar",
-    "whatsthecraic": "Dean De Leo",
-    "gwennlbh": "Gwenn Le Bihan",
-    "donottellmetonottellyou": "Jade Masker",
-    "kstrafe": null,
-    "synalice": "Nikita Krasnov",
-    "poperigby": "PopeRigby",
-    "MattSturgeon": "Matt Sturgeon",
-    "lucperkins": "Luc Perkins",
-    "gustavderdrache": null,
-    "SimSaladin": "Samuli Thomasson",
-    "getchoo": "Seth Flynn",
-    "stefanboca": "Stefan Boca",
-    "wolfgangwalther": "Wolfgang Walther",
-    "pbsds": "Peder Bergebakken Sundt",
-    "egorkonovalov": "Egor Konovalov",
-    "jayeshv": "jayeshv",
-    "vcunat": "Vladim\u00edr \u010cun\u00e1t"
+    "artemist": "Artemis Tosini"
 }

maintainers/flake-module.nix

@@ -1,350 +1,645 @@
-{
-  lib,
-  getSystem,
-  inputs,
-  ...
-}:
+{ lib, getSystem, inputs, ... }:
 
 {
   imports = [
     inputs.git-hooks-nix.flakeModule
   ];
 
-  perSystem =
-    { config, pkgs, ... }:
-    {
+  perSystem = { config, pkgs, ... }: {
 
-      # https://flake.parts/options/git-hooks-nix#options
-      pre-commit.settings = {
-        hooks = {
-          # Conflicts are usually found by other checks, but not those in docs,
-          # and potentially other places.
-          check-merge-conflicts.enable = true;
-          # built-in check-merge-conflicts seems ineffective against those produced by mergify backports
-          check-merge-conflicts-2 = {
-            enable = true;
-            entry = "${pkgs.writeScript "check-merge-conflicts" ''
-              #!${pkgs.runtimeShell}
-              conflicts=false
-              for file in "$@"; do
-                if grep --with-filename --line-number -E '^>>>>>>> ' -- "$file"; then
-                  conflicts=true
-                fi
-              done
-              if $conflicts; then
-                echo "ERROR: found merge/patch conflicts in files"
-                exit 1
-              fi
-            ''}";
-          };
-          meson-format = {
-            enable = true;
-            files = "(meson.build|meson.options)$";
-            entry = "${pkgs.writeScript "format-meson" ''
-              #!${pkgs.runtimeShell}
-              for file in "$@"; do
-                ${lib.getExe pkgs.meson} format -ic ${../meson.format} "$file"
-              done
-            ''}";
-            excludes = [
-              # We haven't applied formatting to these files yet
-              ''^doc/manual/meson.build$''
-              ''^doc/manual/source/command-ref/meson.build$''
-              ''^doc/manual/source/development/meson.build$''
-              ''^doc/manual/source/language/meson.build$''
-              ''^doc/manual/source/meson.build$''
-              ''^doc/manual/source/release-notes/meson.build$''
-              ''^doc/manual/source/store/meson.build$''
-              ''^misc/bash/meson.build$''
-              ''^misc/fish/meson.build$''
-              ''^misc/launchd/meson.build$''
-              ''^misc/meson.build$''
-              ''^misc/systemd/meson.build$''
-              ''^misc/zsh/meson.build$''
-              ''^nix-meson-build-support/$''
-              ''^nix-meson-build-support/big-objs/meson.build$''
-              ''^nix-meson-build-support/common/meson.build$''
-              ''^nix-meson-build-support/deps-lists/meson.build$''
-              ''^nix-meson-build-support/export/meson.build$''
-              ''^nix-meson-build-support/export-all-symbols/meson.build$''
-              ''^nix-meson-build-support/generate-header/meson.build$''
-              ''^nix-meson-build-support/libatomic/meson.build$''
-              ''^nix-meson-build-support/subprojects/meson.build$''
-              ''^scripts/meson.build$''
-              ''^src/external-api-docs/meson.build$''
-              ''^src/internal-api-docs/meson.build$''
-              ''^src/libcmd/include/nix/cmd/meson.build$''
-              ''^src/libcmd/meson.build$''
-              ''^src/libcmd/nix-meson-build-support$''
-              ''^src/libexpr/include/nix/expr/meson.build$''
-              ''^src/libexpr/meson.build$''
-              ''^src/libexpr/nix-meson-build-support$''
-              ''^src/libexpr-c/meson.build$''
-              ''^src/libexpr-c/nix-meson-build-support$''
-              ''^src/libexpr-test-support/meson.build$''
-              ''^src/libexpr-test-support/nix-meson-build-support$''
-              ''^src/libexpr-tests/meson.build$''
-              ''^src/libexpr-tests/nix-meson-build-support$''
-              ''^src/libfetchers/include/nix/fetchers/meson.build$''
-              ''^src/libfetchers/meson.build$''
-              ''^src/libfetchers/nix-meson-build-support$''
-              ''^src/libfetchers-c/meson.build$''
-              ''^src/libfetchers-c/nix-meson-build-support$''
-              ''^src/libfetchers-tests/meson.build$''
-              ''^src/libfetchers-tests/nix-meson-build-support$''
-              ''^src/libflake/include/nix/flake/meson.build$''
-              ''^src/libflake/meson.build$''
-              ''^src/libflake/nix-meson-build-support$''
-              ''^src/libflake-c/meson.build$''
-              ''^src/libflake-c/nix-meson-build-support$''
-              ''^src/libflake-tests/meson.build$''
-              ''^src/libflake-tests/nix-meson-build-support$''
-              ''^src/libmain/include/nix/main/meson.build$''
-              ''^src/libmain/meson.build$''
-              ''^src/libmain/nix-meson-build-support$''
-              ''^src/libmain-c/meson.build$''
-              ''^src/libmain-c/nix-meson-build-support$''
-              ''^src/libstore/include/nix/store/meson.build$''
-              ''^src/libstore/meson.build$''
-              ''^src/libstore/nix-meson-build-support$''
-              ''^src/libstore/unix/include/nix/store/meson.build$''
-              ''^src/libstore/unix/meson.build$''
-              ''^src/libstore/windows/meson.build$''
-              ''^src/libstore-c/meson.build$''
-              ''^src/libstore-c/nix-meson-build-support$''
-              ''^src/libstore-test-support/include/nix/store/tests/meson.build$''
-              ''^src/libstore-test-support/meson.build$''
-              ''^src/libstore-test-support/nix-meson-build-support$''
-              ''^src/libstore-tests/meson.build$''
-              ''^src/libstore-tests/nix-meson-build-support$''
-              ''^src/libutil/meson.build$''
-              ''^src/libutil/nix-meson-build-support$''
-              ''^src/libutil/unix/include/nix/util/meson.build$''
-              ''^src/libutil/unix/meson.build$''
-              ''^src/libutil/windows/meson.build$''
-              ''^src/libutil-c/meson.build$''
-              ''^src/libutil-c/nix-meson-build-support$''
-              ''^src/libutil-test-support/include/nix/util/tests/meson.build$''
-              ''^src/libutil-test-support/meson.build$''
-              ''^src/libutil-test-support/nix-meson-build-support$''
-              ''^src/libutil-tests/meson.build$''
-              ''^src/libutil-tests/nix-meson-build-support$''
-              ''^src/nix/meson.build$''
-              ''^src/nix/nix-meson-build-support$''
-              ''^src/perl/lib/Nix/meson.build$''
-              ''^src/perl/meson.build$''
-              ''^tests/functional/ca/meson.build$''
-              ''^tests/functional/common/meson.build$''
-              ''^tests/functional/dyn-drv/meson.build$''
-              ''^tests/functional/flakes/meson.build$''
-              ''^tests/functional/git-hashing/meson.build$''
-              ''^tests/functional/local-overlay-store/meson.build$''
-              ''^tests/functional/meson.build$''
-              ''^src/libcmd/meson.options$''
-              ''^src/libexpr/meson.options$''
-              ''^src/libstore/meson.options$''
-              ''^src/libutil/meson.options$''
-              ''^src/libutil-c/meson.options$''
-              ''^src/nix/meson.options$''
-              ''^src/perl/meson.options$''
-            ];
-          };
-          nixfmt-rfc-style = {
-            enable = true;
-            excludes = [
-              # Invalid
-              ''^tests/functional/lang/parse-.*\.nix$''
+    # https://flake.parts/options/git-hooks-nix#options
+    pre-commit.settings = {
+      hooks = {
+        clang-format = {
+          enable = true;
+          excludes = [
+            # We don't want to format test data
+            # ''tests/(?!nixos/).*\.nix''
+            ''^src/[^/]*-tests/data/.*$''
 
-              # Formatting-sensitive
-              ''^tests/functional/lang/eval-okay-curpos\.nix$''
-              ''^tests/functional/lang/.*comment.*\.nix$''
-              ''^tests/functional/lang/.*newline.*\.nix$''
-              ''^tests/functional/lang/.*eol.*\.nix$''
+            # Don't format vendored code
+            ''^doc/manual/redirects\.js$''
+            ''^doc/manual/theme/highlight\.js$''
 
-              # Syntax tests
-              ''^tests/functional/shell.shebang\.nix$''
-              ''^tests/functional/lang/eval-okay-ind-string\.nix$''
+            # We haven't applied formatting to these files yet
+            ''^doc/manual/redirects\.js$''
+            ''^doc/manual/theme/highlight\.js$''
+            ''^precompiled-headers\.h$''
+            ''^src/build-remote/build-remote\.cc$''
+            ''^src/libcmd/built-path\.cc$''
+            ''^src/libcmd/built-path\.hh$''
+            ''^src/libcmd/common-eval-args\.cc$''
+            ''^src/libcmd/common-eval-args\.hh$''
+            ''^src/libcmd/editor-for\.cc$''
+            ''^src/libcmd/installable-attr-path\.cc$''
+            ''^src/libcmd/installable-attr-path\.hh$''
+            ''^src/libcmd/installable-derived-path\.cc$''
+            ''^src/libcmd/installable-derived-path\.hh$''
+            ''^src/libcmd/installable-flake\.cc$''
+            ''^src/libcmd/installable-flake\.hh$''
+            ''^src/libcmd/installable-value\.cc$''
+            ''^src/libcmd/installable-value\.hh$''
+            ''^src/libcmd/installables\.cc$''
+            ''^src/libcmd/installables\.hh$''
+            ''^src/libcmd/legacy\.hh$''
+            ''^src/libcmd/markdown\.cc$''
+            ''^src/libcmd/misc-store-flags\.cc$''
+            ''^src/libcmd/repl-interacter\.cc$''
+            ''^src/libcmd/repl-interacter\.hh$''
+            ''^src/libcmd/repl\.cc$''
+            ''^src/libcmd/repl\.hh$''
+            ''^src/libexpr-c/nix_api_expr\.cc$''
+            ''^src/libexpr-c/nix_api_external\.cc$''
+            ''^src/libexpr/attr-path\.cc$''
+            ''^src/libexpr/attr-path\.hh$''
+            ''^src/libexpr/attr-set\.cc$''
+            ''^src/libexpr/attr-set\.hh$''
+            ''^src/libexpr/eval-cache\.cc$''
+            ''^src/libexpr/eval-cache\.hh$''
+            ''^src/libexpr/eval-error\.cc$''
+            ''^src/libexpr/eval-inline\.hh$''
+            ''^src/libexpr/eval-settings\.cc$''
+            ''^src/libexpr/eval-settings\.hh$''
+            ''^src/libexpr/eval\.cc$''
+            ''^src/libexpr/eval\.hh$''
+            ''^src/libexpr/function-trace\.cc$''
+            ''^src/libexpr/gc-small-vector\.hh$''
+            ''^src/libexpr/get-drvs\.cc$''
+            ''^src/libexpr/get-drvs\.hh$''
+            ''^src/libexpr/json-to-value\.cc$''
+            ''^src/libexpr/nixexpr\.cc$''
+            ''^src/libexpr/nixexpr\.hh$''
+            ''^src/libexpr/parser-state\.hh$''
+            ''^src/libexpr/pos-table\.hh$''
+            ''^src/libexpr/primops\.cc$''
+            ''^src/libexpr/primops\.hh$''
+            ''^src/libexpr/primops/context\.cc$''
+            ''^src/libexpr/primops/fetchClosure\.cc$''
+            ''^src/libexpr/primops/fetchMercurial\.cc$''
+            ''^src/libexpr/primops/fetchTree\.cc$''
+            ''^src/libexpr/primops/fromTOML\.cc$''
+            ''^src/libexpr/print-ambiguous\.cc$''
+            ''^src/libexpr/print-ambiguous\.hh$''
+            ''^src/libexpr/print-options\.hh$''
+            ''^src/libexpr/print\.cc$''
+            ''^src/libexpr/print\.hh$''
+            ''^src/libexpr/search-path\.cc$''
+            ''^src/libexpr/symbol-table\.hh$''
+            ''^src/libexpr/value-to-json\.cc$''
+            ''^src/libexpr/value-to-json\.hh$''
+            ''^src/libexpr/value-to-xml\.cc$''
+            ''^src/libexpr/value-to-xml\.hh$''
+            ''^src/libexpr/value\.hh$''
+            ''^src/libexpr/value/context\.cc$''
+            ''^src/libexpr/value/context\.hh$''
+            ''^src/libfetchers/attrs\.cc$''
+            ''^src/libfetchers/cache\.cc$''
+            ''^src/libfetchers/cache\.hh$''
+            ''^src/libfetchers/fetch-settings\.cc$''
+            ''^src/libfetchers/fetch-settings\.hh$''
+            ''^src/libfetchers/fetch-to-store\.cc$''
+            ''^src/libfetchers/fetchers\.cc$''
+            ''^src/libfetchers/fetchers\.hh$''
+            ''^src/libfetchers/filtering-source-accessor\.cc$''
+            ''^src/libfetchers/filtering-source-accessor\.hh$''
+            ''^src/libfetchers/fs-source-accessor\.cc$''
+            ''^src/libfetchers/fs-source-accessor\.hh$''
+            ''^src/libfetchers/git-utils\.cc$''
+            ''^src/libfetchers/git-utils\.hh$''
+            ''^src/libfetchers/github\.cc$''
+            ''^src/libfetchers/indirect\.cc$''
+            ''^src/libfetchers/memory-source-accessor\.cc$''
+            ''^src/libfetchers/path\.cc$''
+            ''^src/libfetchers/registry\.cc$''
+            ''^src/libfetchers/registry\.hh$''
+            ''^src/libfetchers/tarball\.cc$''
+            ''^src/libfetchers/tarball\.hh$''
+            ''^src/libfetchers/git\.cc$''
+            ''^src/libfetchers/mercurial\.cc$''
+            ''^src/libflake/flake/config\.cc$''
+            ''^src/libflake/flake/flake\.cc$''
+            ''^src/libflake/flake/flake\.hh$''
+            ''^src/libflake/flake/flakeref\.cc$''
+            ''^src/libflake/flake/flakeref\.hh$''
+            ''^src/libflake/flake/lockfile\.cc$''
+            ''^src/libflake/flake/lockfile\.hh$''
+            ''^src/libflake/flake/url-name\.cc$''
+            ''^src/libmain/common-args\.cc$''
+            ''^src/libmain/common-args\.hh$''
+            ''^src/libmain/loggers\.cc$''
+            ''^src/libmain/loggers\.hh$''
+            ''^src/libmain/progress-bar\.cc$''
+            ''^src/libmain/shared\.cc$''
+            ''^src/libmain/shared\.hh$''
+            ''^src/libmain/unix/stack\.cc$''
+            ''^src/libstore/binary-cache-store\.cc$''
+            ''^src/libstore/binary-cache-store\.hh$''
+            ''^src/libstore/build-result\.hh$''
+            ''^src/libstore/builtins\.hh$''
+            ''^src/libstore/builtins/buildenv\.cc$''
+            ''^src/libstore/builtins/buildenv\.hh$''
+            ''^src/libstore/common-protocol-impl\.hh$''
+            ''^src/libstore/common-protocol\.cc$''
+            ''^src/libstore/common-protocol\.hh$''
+            ''^src/libstore/common-ssh-store-config\.hh$''
+            ''^src/libstore/content-address\.cc$''
+            ''^src/libstore/content-address\.hh$''
+            ''^src/libstore/daemon\.cc$''
+            ''^src/libstore/daemon\.hh$''
+            ''^src/libstore/derivations\.cc$''
+            ''^src/libstore/derivations\.hh$''
+            ''^src/libstore/derived-path-map\.cc$''
+            ''^src/libstore/derived-path-map\.hh$''
+            ''^src/libstore/derived-path\.cc$''
+            ''^src/libstore/derived-path\.hh$''
+            ''^src/libstore/downstream-placeholder\.cc$''
+            ''^src/libstore/downstream-placeholder\.hh$''
+            ''^src/libstore/dummy-store\.cc$''
+            ''^src/libstore/export-import\.cc$''
+            ''^src/libstore/filetransfer\.cc$''
+            ''^src/libstore/filetransfer\.hh$''
+            ''^src/libstore/gc-store\.hh$''
+            ''^src/libstore/globals\.cc$''
+            ''^src/libstore/globals\.hh$''
+            ''^src/libstore/http-binary-cache-store\.cc$''
+            ''^src/libstore/legacy-ssh-store\.cc$''
+            ''^src/libstore/legacy-ssh-store\.hh$''
+            ''^src/libstore/length-prefixed-protocol-helper\.hh$''
+            ''^src/libstore/linux/personality\.cc$''
+            ''^src/libstore/linux/personality\.hh$''
+            ''^src/libstore/local-binary-cache-store\.cc$''
+            ''^src/libstore/local-fs-store\.cc$''
+            ''^src/libstore/local-fs-store\.hh$''
+            ''^src/libstore/log-store\.cc$''
+            ''^src/libstore/log-store\.hh$''
+            ''^src/libstore/machines\.cc$''
+            ''^src/libstore/machines\.hh$''
+            ''^src/libstore/make-content-addressed\.cc$''
+            ''^src/libstore/make-content-addressed\.hh$''
+            ''^src/libstore/misc\.cc$''
+            ''^src/libstore/names\.cc$''
+            ''^src/libstore/names\.hh$''
+            ''^src/libstore/nar-accessor\.cc$''
+            ''^src/libstore/nar-accessor\.hh$''
+            ''^src/libstore/nar-info-disk-cache\.cc$''
+            ''^src/libstore/nar-info-disk-cache\.hh$''
+            ''^src/libstore/nar-info\.cc$''
+            ''^src/libstore/nar-info\.hh$''
+            ''^src/libstore/outputs-spec\.cc$''
+            ''^src/libstore/outputs-spec\.hh$''
+            ''^src/libstore/parsed-derivations\.cc$''
+            ''^src/libstore/path-info\.cc$''
+            ''^src/libstore/path-info\.hh$''
+            ''^src/libstore/path-references\.cc$''
+            ''^src/libstore/path-regex\.hh$''
+            ''^src/libstore/path-with-outputs\.cc$''
+            ''^src/libstore/path\.cc$''
+            ''^src/libstore/path\.hh$''
+            ''^src/libstore/pathlocks\.cc$''
+            ''^src/libstore/pathlocks\.hh$''
+            ''^src/libstore/profiles\.cc$''
+            ''^src/libstore/profiles\.hh$''
+            ''^src/libstore/realisation\.cc$''
+            ''^src/libstore/realisation\.hh$''
+            ''^src/libstore/remote-fs-accessor\.cc$''
+            ''^src/libstore/remote-fs-accessor\.hh$''
+            ''^src/libstore/remote-store-connection\.hh$''
+            ''^src/libstore/remote-store\.cc$''
+            ''^src/libstore/remote-store\.hh$''
+            ''^src/libstore/s3-binary-cache-store\.cc$''
+            ''^src/libstore/s3\.hh$''
+            ''^src/libstore/serve-protocol-impl\.cc$''
+            ''^src/libstore/serve-protocol-impl\.hh$''
+            ''^src/libstore/serve-protocol\.cc$''
+            ''^src/libstore/serve-protocol\.hh$''
+            ''^src/libstore/sqlite\.cc$''
+            ''^src/libstore/sqlite\.hh$''
+            ''^src/libstore/ssh-store\.cc$''
+            ''^src/libstore/ssh\.cc$''
+            ''^src/libstore/ssh\.hh$''
+            ''^src/libstore/store-api\.cc$''
+            ''^src/libstore/store-api\.hh$''
+            ''^src/libstore/store-dir-config\.hh$''
+            ''^src/libstore/build/derivation-goal\.cc$''
+            ''^src/libstore/build/derivation-goal\.hh$''
+            ''^src/libstore/build/drv-output-substitution-goal\.cc$''
+            ''^src/libstore/build/drv-output-substitution-goal\.hh$''
+            ''^src/libstore/build/entry-points\.cc$''
+            ''^src/libstore/build/goal\.cc$''
+            ''^src/libstore/build/goal\.hh$''
+            ''^src/libstore/unix/build/hook-instance\.cc$''
+            ''^src/libstore/unix/build/local-derivation-goal\.cc$''
+            ''^src/libstore/unix/build/local-derivation-goal\.hh$''
+            ''^src/libstore/build/substitution-goal\.cc$''
+            ''^src/libstore/build/substitution-goal\.hh$''
+            ''^src/libstore/build/worker\.cc$''
+            ''^src/libstore/build/worker\.hh$''
+            ''^src/libstore/builtins/fetchurl\.cc$''
+            ''^src/libstore/builtins/unpack-channel\.cc$''
+            ''^src/libstore/gc\.cc$''
+            ''^src/libstore/local-overlay-store\.cc$''
+            ''^src/libstore/local-overlay-store\.hh$''
+            ''^src/libstore/local-store\.cc$''
+            ''^src/libstore/local-store\.hh$''
+            ''^src/libstore/unix/user-lock\.cc$''
+            ''^src/libstore/unix/user-lock\.hh$''
+            ''^src/libstore/optimise-store\.cc$''
+            ''^src/libstore/unix/pathlocks\.cc$''
+            ''^src/libstore/posix-fs-canonicalise\.cc$''
+            ''^src/libstore/posix-fs-canonicalise\.hh$''
+            ''^src/libstore/uds-remote-store\.cc$''
+            ''^src/libstore/uds-remote-store\.hh$''
+            ''^src/libstore/windows/build\.cc$''
+            ''^src/libstore/worker-protocol-impl\.hh$''
+            ''^src/libstore/worker-protocol\.cc$''
+            ''^src/libstore/worker-protocol\.hh$''
+            ''^src/libutil-c/nix_api_util_internal\.h$''
+            ''^src/libutil/archive\.cc$''
+            ''^src/libutil/archive\.hh$''
+            ''^src/libutil/args\.cc$''
+            ''^src/libutil/args\.hh$''
+            ''^src/libutil/args/root\.hh$''
+            ''^src/libutil/callback\.hh$''
+            ''^src/libutil/canon-path\.cc$''
+            ''^src/libutil/canon-path\.hh$''
+            ''^src/libutil/chunked-vector\.hh$''
+            ''^src/libutil/closure\.hh$''
+            ''^src/libutil/comparator\.hh$''
+            ''^src/libutil/compute-levels\.cc$''
+            ''^src/libutil/config-impl\.hh$''
+            ''^src/libutil/config\.cc$''
+            ''^src/libutil/config\.hh$''
+            ''^src/libutil/current-process\.cc$''
+            ''^src/libutil/current-process\.hh$''
+            ''^src/libutil/english\.cc$''
+            ''^src/libutil/english\.hh$''
+            ''^src/libutil/error\.cc$''
+            ''^src/libutil/error\.hh$''
+            ''^src/libutil/exit\.hh$''
+            ''^src/libutil/experimental-features\.cc$''
+            ''^src/libutil/experimental-features\.hh$''
+            ''^src/libutil/file-content-address\.cc$''
+            ''^src/libutil/file-content-address\.hh$''
+            ''^src/libutil/file-descriptor\.cc$''
+            ''^src/libutil/file-descriptor\.hh$''
+            ''^src/libutil/file-path-impl\.hh$''
+            ''^src/libutil/file-path\.hh$''
+            ''^src/libutil/file-system\.cc$''
+            ''^src/libutil/file-system\.hh$''
+            ''^src/libutil/finally\.hh$''
+            ''^src/libutil/fmt\.hh$''
+            ''^src/libutil/fs-sink\.cc$''
+            ''^src/libutil/fs-sink\.hh$''
+            ''^src/libutil/git\.cc$''
+            ''^src/libutil/git\.hh$''
+            ''^src/libutil/hash\.cc$''
+            ''^src/libutil/hash\.hh$''
+            ''^src/libutil/hilite\.cc$''
+            ''^src/libutil/hilite\.hh$''
+            ''^src/libutil/source-accessor\.hh$''
+            ''^src/libutil/json-impls\.hh$''
+            ''^src/libutil/json-utils\.cc$''
+            ''^src/libutil/json-utils\.hh$''
+            ''^src/libutil/linux/cgroup\.cc$''
+            ''^src/libutil/linux/namespaces\.cc$''
+            ''^src/libutil/logging\.cc$''
+            ''^src/libutil/logging\.hh$''
+            ''^src/libutil/lru-cache\.hh$''
+            ''^src/libutil/memory-source-accessor\.cc$''
+            ''^src/libutil/memory-source-accessor\.hh$''
+            ''^src/libutil/pool\.hh$''
+            ''^src/libutil/position\.cc$''
+            ''^src/libutil/position\.hh$''
+            ''^src/libutil/posix-source-accessor\.cc$''
+            ''^src/libutil/posix-source-accessor\.hh$''
+            ''^src/libutil/processes\.hh$''
+            ''^src/libutil/ref\.hh$''
+            ''^src/libutil/references\.cc$''
+            ''^src/libutil/references\.hh$''
+            ''^src/libutil/regex-combinators\.hh$''
+            ''^src/libutil/serialise\.cc$''
+            ''^src/libutil/serialise\.hh$''
+            ''^src/libutil/signals\.hh$''
+            ''^src/libutil/signature/local-keys\.cc$''
+            ''^src/libutil/signature/local-keys\.hh$''
+            ''^src/libutil/signature/signer\.cc$''
+            ''^src/libutil/signature/signer\.hh$''
+            ''^src/libutil/source-accessor\.cc$''
+            ''^src/libutil/source-accessor\.hh$''
+            ''^src/libutil/source-path\.cc$''
+            ''^src/libutil/source-path\.hh$''
+            ''^src/libutil/split\.hh$''
+            ''^src/libutil/suggestions\.cc$''
+            ''^src/libutil/suggestions\.hh$''
+            ''^src/libutil/sync\.hh$''
+            ''^src/libutil/terminal\.cc$''
+            ''^src/libutil/terminal\.hh$''
+            ''^src/libutil/thread-pool\.cc$''
+            ''^src/libutil/thread-pool\.hh$''
+            ''^src/libutil/topo-sort\.hh$''
+            ''^src/libutil/types\.hh$''
+            ''^src/libutil/unix/file-descriptor\.cc$''
+            ''^src/libutil/unix/file-path\.cc$''
+            ''^src/libutil/unix/monitor-fd\.hh$''
+            ''^src/libutil/unix/processes\.cc$''
+            ''^src/libutil/unix/signals-impl\.hh$''
+            ''^src/libutil/unix/signals\.cc$''
+            ''^src/libutil/unix-domain-socket\.cc$''
+            ''^src/libutil/unix/users\.cc$''
+            ''^src/libutil/url-parts\.hh$''
+            ''^src/libutil/url\.cc$''
+            ''^src/libutil/url\.hh$''
+            ''^src/libutil/users\.cc$''
+            ''^src/libutil/users\.hh$''
+            ''^src/libutil/util\.cc$''
+            ''^src/libutil/util\.hh$''
+            ''^src/libutil/variant-wrapper\.hh$''
+            ''^src/libutil/windows/file-descriptor\.cc$''
+            ''^src/libutil/windows/file-path\.cc$''
+            ''^src/libutil/windows/processes\.cc$''
+            ''^src/libutil/windows/users\.cc$''
+            ''^src/libutil/windows/windows-error\.cc$''
+            ''^src/libutil/windows/windows-error\.hh$''
+            ''^src/libutil/xml-writer\.cc$''
+            ''^src/libutil/xml-writer\.hh$''
+            ''^src/nix-build/nix-build\.cc$''
+            ''^src/nix-channel/nix-channel\.cc$''
+            ''^src/nix-collect-garbage/nix-collect-garbage\.cc$''
+            ''^src/nix-env/buildenv.nix$''
+            ''^src/nix-env/nix-env\.cc$''
+            ''^src/nix-env/user-env\.cc$''
+            ''^src/nix-env/user-env\.hh$''
+            ''^src/nix-instantiate/nix-instantiate\.cc$''
+            ''^src/nix-store/dotgraph\.cc$''
+            ''^src/nix-store/graphml\.cc$''
+            ''^src/nix-store/nix-store\.cc$''
+            ''^src/nix/add-to-store\.cc$''
+            ''^src/nix/app\.cc$''
+            ''^src/nix/build\.cc$''
+            ''^src/nix/bundle\.cc$''
+            ''^src/nix/cat\.cc$''
+            ''^src/nix/config-check\.cc$''
+            ''^src/nix/config\.cc$''
+            ''^src/nix/copy\.cc$''
+            ''^src/nix/derivation-add\.cc$''
+            ''^src/nix/derivation-show\.cc$''
+            ''^src/nix/derivation\.cc$''
+            ''^src/nix/develop\.cc$''
+            ''^src/nix/diff-closures\.cc$''
+            ''^src/nix/dump-path\.cc$''
+            ''^src/nix/edit\.cc$''
+            ''^src/nix/eval\.cc$''
+            ''^src/nix/flake\.cc$''
+            ''^src/nix/fmt\.cc$''
+            ''^src/nix/hash\.cc$''
+            ''^src/nix/log\.cc$''
+            ''^src/nix/ls\.cc$''
+            ''^src/nix/main\.cc$''
+            ''^src/nix/make-content-addressed\.cc$''
+            ''^src/nix/nar\.cc$''
+            ''^src/nix/optimise-store\.cc$''
+            ''^src/nix/path-from-hash-part\.cc$''
+            ''^src/nix/path-info\.cc$''
+            ''^src/nix/prefetch\.cc$''
+            ''^src/nix/profile\.cc$''
+            ''^src/nix/realisation\.cc$''
+            ''^src/nix/registry\.cc$''
+            ''^src/nix/repl\.cc$''
+            ''^src/nix/run\.cc$''
+            ''^src/nix/run\.hh$''
+            ''^src/nix/search\.cc$''
+            ''^src/nix/sigs\.cc$''
+            ''^src/nix/store-copy-log\.cc$''
+            ''^src/nix/store-delete\.cc$''
+            ''^src/nix/store-gc\.cc$''
+            ''^src/nix/store-info\.cc$''
+            ''^src/nix/store-repair\.cc$''
+            ''^src/nix/store\.cc$''
+            ''^src/nix/unix/daemon\.cc$''
+            ''^src/nix/upgrade-nix\.cc$''
+            ''^src/nix/verify\.cc$''
+            ''^src/nix/why-depends\.cc$''
 
-              # Not supported by nixfmt
-              ''^tests/functional/lang/eval-okay-deprecate-cursed-or\.nix$''
-              ''^tests/functional/lang/eval-okay-attrs5\.nix$''
-
-              # More syntax tests
-              # These tests, or parts of them, should have been parse-* test cases.
-              ''^tests/functional/lang/eval-fail-eol-2\.nix$''
-              ''^tests/functional/lang/eval-fail-path-slash\.nix$''
-              ''^tests/functional/lang/eval-fail-toJSON-non-utf-8\.nix$''
-              ''^tests/functional/lang/eval-fail-set\.nix$''
-            ];
-          };
-          clang-format = {
-            enable = true;
-            # https://github.com/cachix/git-hooks.nix/pull/532
-            package = pkgs.llvmPackages_latest.clang-tools;
-            excludes = [
-              # We don't want to format test data
-              # ''tests/(?!nixos/).*\.nix''
-              ''^src/[^/]*-tests/data/.*$''
-
-              # Don't format vendored code
-              ''^doc/manual/redirects\.js$''
-              ''^doc/manual/theme/highlight\.js$''
-            ];
-          };
-          shellcheck = {
-            enable = true;
-            excludes = [
-              # We haven't linted these files yet
-              ''^config/install-sh$''
-              ''^misc/bash/completion\.sh$''
-              ''^misc/fish/completion\.fish$''
-              ''^misc/zsh/completion\.zsh$''
-              ''^scripts/create-darwin-volume\.sh$''
-              ''^scripts/install-darwin-multi-user\.sh$''
-              ''^scripts/install-multi-user\.sh$''
-              ''^scripts/install-systemd-multi-user\.sh$''
-              ''^src/nix/get-env\.sh$''
-              ''^tests/functional/ca/build-dry\.sh$''
-              ''^tests/functional/ca/build-with-garbage-path\.sh$''
-              ''^tests/functional/ca/common\.sh$''
-              ''^tests/functional/ca/concurrent-builds\.sh$''
-              ''^tests/functional/ca/eval-store\.sh$''
-              ''^tests/functional/ca/gc\.sh$''
-              ''^tests/functional/ca/import-from-derivation\.sh$''
-              ''^tests/functional/ca/new-build-cmd\.sh$''
-              ''^tests/functional/ca/nix-shell\.sh$''
-              ''^tests/functional/ca/post-hook\.sh$''
-              ''^tests/functional/ca/recursive\.sh$''
-              ''^tests/functional/ca/repl\.sh$''
-              ''^tests/functional/ca/selfref-gc\.sh$''
-              ''^tests/functional/ca/why-depends\.sh$''
-              ''^tests/functional/characterisation-test-infra\.sh$''
-              ''^tests/functional/common/vars-and-functions\.sh$''
-              ''^tests/functional/completions\.sh$''
-              ''^tests/functional/compute-levels\.sh$''
-              ''^tests/functional/config\.sh$''
-              ''^tests/functional/db-migration\.sh$''
-              ''^tests/functional/debugger\.sh$''
-              ''^tests/functional/dependencies\.builder0\.sh$''
-              ''^tests/functional/dependencies\.sh$''
-              ''^tests/functional/dump-db\.sh$''
-              ''^tests/functional/dyn-drv/build-built-drv\.sh$''
-              ''^tests/functional/dyn-drv/common\.sh$''
-              ''^tests/functional/dyn-drv/dep-built-drv\.sh$''
-              ''^tests/functional/dyn-drv/eval-outputOf\.sh$''
-              ''^tests/functional/dyn-drv/old-daemon-error-hack\.sh$''
-              ''^tests/functional/dyn-drv/recursive-mod-json\.sh$''
-              ''^tests/functional/eval-store\.sh$''
-              ''^tests/functional/export-graph\.sh$''
-              ''^tests/functional/export\.sh$''
-              ''^tests/functional/extra-sandbox-profile\.sh$''
-              ''^tests/functional/fetchClosure\.sh$''
-              ''^tests/functional/fetchGit\.sh$''
-              ''^tests/functional/fetchGitRefs\.sh$''
-              ''^tests/functional/fetchGitSubmodules\.sh$''
-              ''^tests/functional/fetchGitVerification\.sh$''
-              ''^tests/functional/fetchMercurial\.sh$''
-              ''^tests/functional/fixed\.builder1\.sh$''
-              ''^tests/functional/fixed\.builder2\.sh$''
-              ''^tests/functional/fixed\.sh$''
-              ''^tests/functional/flakes/absolute-paths\.sh$''
-              ''^tests/functional/flakes/check\.sh$''
-              ''^tests/functional/flakes/config\.sh$''
-              ''^tests/functional/flakes/flakes\.sh$''
-              ''^tests/functional/flakes/follow-paths\.sh$''
-              ''^tests/functional/flakes/prefetch\.sh$''
-              ''^tests/functional/flakes/run\.sh$''
-              ''^tests/functional/flakes/show\.sh$''
-              ''^tests/functional/formatter\.sh$''
-              ''^tests/functional/formatter\.simple\.sh$''
-              ''^tests/functional/gc-auto\.sh$''
-              ''^tests/functional/gc-concurrent\.builder\.sh$''
-              ''^tests/functional/gc-concurrent\.sh$''
-              ''^tests/functional/gc-concurrent2\.builder\.sh$''
-              ''^tests/functional/gc-non-blocking\.sh$''
-              ''^tests/functional/git-hashing/common\.sh$''
-              ''^tests/functional/git-hashing/simple\.sh$''
-              ''^tests/functional/hash-convert\.sh$''
-              ''^tests/functional/impure-derivations\.sh$''
-              ''^tests/functional/impure-eval\.sh$''
-              ''^tests/functional/install-darwin\.sh$''
-              ''^tests/functional/legacy-ssh-store\.sh$''
-              ''^tests/functional/linux-sandbox\.sh$''
-              ''^tests/functional/local-overlay-store/add-lower-inner\.sh$''
-              ''^tests/functional/local-overlay-store/add-lower\.sh$''
-              ''^tests/functional/local-overlay-store/bad-uris\.sh$''
-              ''^tests/functional/local-overlay-store/build-inner\.sh$''
-              ''^tests/functional/local-overlay-store/build\.sh$''
-              ''^tests/functional/local-overlay-store/check-post-init-inner\.sh$''
-              ''^tests/functional/local-overlay-store/check-post-init\.sh$''
-              ''^tests/functional/local-overlay-store/common\.sh$''
-              ''^tests/functional/local-overlay-store/delete-duplicate-inner\.sh$''
-              ''^tests/functional/local-overlay-store/delete-duplicate\.sh$''
-              ''^tests/functional/local-overlay-store/delete-refs-inner\.sh$''
-              ''^tests/functional/local-overlay-store/delete-refs\.sh$''
-              ''^tests/functional/local-overlay-store/gc-inner\.sh$''
-              ''^tests/functional/local-overlay-store/gc\.sh$''
-              ''^tests/functional/local-overlay-store/optimise-inner\.sh$''
-              ''^tests/functional/local-overlay-store/optimise\.sh$''
-              ''^tests/functional/local-overlay-store/redundant-add-inner\.sh$''
-              ''^tests/functional/local-overlay-store/redundant-add\.sh$''
-              ''^tests/functional/local-overlay-store/remount\.sh$''
-              ''^tests/functional/local-overlay-store/stale-file-handle-inner\.sh$''
-              ''^tests/functional/local-overlay-store/stale-file-handle\.sh$''
-              ''^tests/functional/local-overlay-store/verify-inner\.sh$''
-              ''^tests/functional/local-overlay-store/verify\.sh$''
-              ''^tests/functional/logging\.sh$''
-              ''^tests/functional/misc\.sh$''
-              ''^tests/functional/multiple-outputs\.sh$''
-              ''^tests/functional/nested-sandboxing\.sh$''
-              ''^tests/functional/nested-sandboxing/command\.sh$''
-              ''^tests/functional/nix-build\.sh$''
-              ''^tests/functional/nix-channel\.sh$''
-              ''^tests/functional/nix-collect-garbage-d\.sh$''
-              ''^tests/functional/nix-copy-ssh-common\.sh$''
-              ''^tests/functional/nix-copy-ssh-ng\.sh$''
-              ''^tests/functional/nix-copy-ssh\.sh$''
-              ''^tests/functional/nix-daemon-untrusting\.sh$''
-              ''^tests/functional/nix-profile\.sh$''
-              ''^tests/functional/nix-shell\.sh$''
-              ''^tests/functional/nix_path\.sh$''
-              ''^tests/functional/optimise-store\.sh$''
-              ''^tests/functional/output-normalization\.sh$''
-              ''^tests/functional/parallel\.builder\.sh$''
-              ''^tests/functional/parallel\.sh$''
-              ''^tests/functional/pass-as-file\.sh$''
-              ''^tests/functional/path-from-hash-part\.sh$''
-              ''^tests/functional/path-info\.sh$''
-              ''^tests/functional/placeholders\.sh$''
-              ''^tests/functional/post-hook\.sh$''
-              ''^tests/functional/pure-eval\.sh$''
-              ''^tests/functional/push-to-store-old\.sh$''
-              ''^tests/functional/push-to-store\.sh$''
-              ''^tests/functional/read-only-store\.sh$''
-              ''^tests/functional/readfile-context\.sh$''
-              ''^tests/functional/recursive\.sh$''
-              ''^tests/functional/referrers\.sh$''
-              ''^tests/functional/remote-store\.sh$''
-              ''^tests/functional/repair\.sh$''
-              ''^tests/functional/restricted\.sh$''
-              ''^tests/functional/search\.sh$''
-              ''^tests/functional/secure-drv-outputs\.sh$''
-              ''^tests/functional/selfref-gc\.sh$''
-              ''^tests/functional/shell\.shebang\.sh$''
-              ''^tests/functional/simple\.builder\.sh$''
-              ''^tests/functional/supplementary-groups\.sh$''
-              ''^tests/functional/toString-path\.sh$''
-              ''^tests/functional/user-envs-migration\.sh$''
-              ''^tests/functional/user-envs-test-case\.sh$''
-              ''^tests/functional/user-envs\.builder\.sh$''
-              ''^tests/functional/user-envs\.sh$''
-              ''^tests/functional/why-depends\.sh$''
-              ''^src/libutil-tests/data/git/check-data\.sh$''
-            ];
-          };
+            ''^tests/functional/plugins/plugintest\.cc''
+            ''^tests/functional/test-libstoreconsumer/main\.cc''
+            ''^tests/nixos/ca-fd-leak/sender\.c''
+            ''^tests/nixos/ca-fd-leak/smuggler\.c''
+            ''^tests/nixos/user-sandboxing/attacker\.c''
+            ''^src/libexpr-test-support/tests/libexpr\.hh''
+            ''^src/libexpr-test-support/tests/value/context\.cc''
+            ''^src/libexpr-test-support/tests/value/context\.hh''
+            ''^src/libexpr-tests/derived-path\.cc''
+            ''^src/libexpr-tests/error_traces\.cc''
+            ''^src/libexpr-tests/eval\.cc''
+            ''^src/libexpr-tests/json\.cc''
+            ''^src/libexpr-tests/main\.cc''
+            ''^src/libexpr-tests/primops\.cc''
+            ''^src/libexpr-tests/search-path\.cc''
+            ''^src/libexpr-tests/trivial\.cc''
+            ''^src/libexpr-tests/value/context\.cc''
+            ''^src/libexpr-tests/value/print\.cc''
+            ''^src/libfetchers-tests/public-key\.cc''
+            ''^src/libflake-tests/flakeref\.cc''
+            ''^src/libflake-tests/url-name\.cc''
+            ''^src/libstore-test-support/tests/derived-path\.cc''
+            ''^src/libstore-test-support/tests/derived-path\.hh''
+            ''^src/libstore-test-support/tests/nix_api_store\.hh''
+            ''^src/libstore-test-support/tests/outputs-spec\.cc''
+            ''^src/libstore-test-support/tests/outputs-spec\.hh''
+            ''^src/libstore-test-support/tests/path\.cc''
+            ''^src/libstore-test-support/tests/path\.hh''
+            ''^src/libstore-test-support/tests/protocol\.hh''
+            ''^src/libstore-tests/common-protocol\.cc''
+            ''^src/libstore-tests/content-address\.cc''
+            ''^src/libstore-tests/derivation\.cc''
+            ''^src/libstore-tests/derived-path\.cc''
+            ''^src/libstore-tests/downstream-placeholder\.cc''
+            ''^src/libstore-tests/machines\.cc''
+            ''^src/libstore-tests/nar-info-disk-cache\.cc''
+            ''^src/libstore-tests/nar-info\.cc''
+            ''^src/libstore-tests/outputs-spec\.cc''
+            ''^src/libstore-tests/path-info\.cc''
+            ''^src/libstore-tests/path\.cc''
+            ''^src/libstore-tests/serve-protocol\.cc''
+            ''^src/libstore-tests/worker-protocol\.cc''
+            ''^src/libutil-test-support/tests/characterization\.hh''
+            ''^src/libutil-test-support/tests/hash\.cc''
+            ''^src/libutil-test-support/tests/hash\.hh''
+            ''^src/libutil-tests/args\.cc''
+            ''^src/libutil-tests/canon-path\.cc''
+            ''^src/libutil-tests/chunked-vector\.cc''
+            ''^src/libutil-tests/closure\.cc''
+            ''^src/libutil-tests/compression\.cc''
+            ''^src/libutil-tests/config\.cc''
+            ''^src/libutil-tests/file-content-address\.cc''
+            ''^src/libutil-tests/git\.cc''
+            ''^src/libutil-tests/hash\.cc''
+            ''^src/libutil-tests/hilite\.cc''
+            ''^src/libutil-tests/json-utils\.cc''
+            ''^src/libutil-tests/logging\.cc''
+            ''^src/libutil-tests/lru-cache\.cc''
+            ''^src/libutil-tests/pool\.cc''
+            ''^src/libutil-tests/references\.cc''
+            ''^src/libutil-tests/suggestions\.cc''
+            ''^src/libutil-tests/url\.cc''
+            ''^src/libutil-tests/xml-writer\.cc''
+          ];
         };
+        shellcheck = {
+          enable = true;
+          excludes = [
+            # We haven't linted these files yet
+            ''^config/install-sh$''
+            ''^misc/bash/completion\.sh$''
+            ''^misc/fish/completion\.fish$''
+            ''^misc/zsh/completion\.zsh$''
+            ''^scripts/create-darwin-volume\.sh$''
+            ''^scripts/install-darwin-multi-user\.sh$''
+            ''^scripts/install-multi-user\.sh$''
+            ''^scripts/install-systemd-multi-user\.sh$''
+            ''^src/nix/get-env\.sh$''
+            ''^tests/functional/ca/build-dry\.sh$''
+            ''^tests/functional/ca/build-with-garbage-path\.sh$''
+            ''^tests/functional/ca/common\.sh$''
+            ''^tests/functional/ca/concurrent-builds\.sh$''
+            ''^tests/functional/ca/eval-store\.sh$''
+            ''^tests/functional/ca/gc\.sh$''
+            ''^tests/functional/ca/import-from-derivation\.sh$''
+            ''^tests/functional/ca/new-build-cmd\.sh$''
+            ''^tests/functional/ca/nix-shell\.sh$''
+            ''^tests/functional/ca/post-hook\.sh$''
+            ''^tests/functional/ca/recursive\.sh$''
+            ''^tests/functional/ca/repl\.sh$''
+            ''^tests/functional/ca/selfref-gc\.sh$''
+            ''^tests/functional/ca/why-depends\.sh$''
+            ''^tests/functional/characterisation-test-infra\.sh$''
+            ''^tests/functional/common/vars-and-functions\.sh$''
+            ''^tests/functional/completions\.sh$''
+            ''^tests/functional/compute-levels\.sh$''
+            ''^tests/functional/config\.sh$''
+            ''^tests/functional/db-migration\.sh$''
+            ''^tests/functional/debugger\.sh$''
+            ''^tests/functional/dependencies\.builder0\.sh$''
+            ''^tests/functional/dependencies\.sh$''
+            ''^tests/functional/dump-db\.sh$''
+            ''^tests/functional/dyn-drv/build-built-drv\.sh$''
+            ''^tests/functional/dyn-drv/common\.sh$''
+            ''^tests/functional/dyn-drv/dep-built-drv\.sh$''
+            ''^tests/functional/dyn-drv/eval-outputOf\.sh$''
+            ''^tests/functional/dyn-drv/old-daemon-error-hack\.sh$''
+            ''^tests/functional/dyn-drv/recursive-mod-json\.sh$''
+            ''^tests/functional/eval-store\.sh$''
+            ''^tests/functional/export-graph\.sh$''
+            ''^tests/functional/export\.sh$''
+            ''^tests/functional/extra-sandbox-profile\.sh$''
+            ''^tests/functional/fetchClosure\.sh$''
+            ''^tests/functional/fetchGit\.sh$''
+            ''^tests/functional/fetchGitRefs\.sh$''
+            ''^tests/functional/fetchGitSubmodules\.sh$''
+            ''^tests/functional/fetchGitVerification\.sh$''
+            ''^tests/functional/fetchMercurial\.sh$''
+            ''^tests/functional/fixed\.builder1\.sh$''
+            ''^tests/functional/fixed\.builder2\.sh$''
+            ''^tests/functional/fixed\.sh$''
+            ''^tests/functional/flakes/absolute-paths\.sh$''
+            ''^tests/functional/flakes/check\.sh$''
+            ''^tests/functional/flakes/config\.sh$''
+            ''^tests/functional/flakes/flakes\.sh$''
+            ''^tests/functional/flakes/follow-paths\.sh$''
+            ''^tests/functional/flakes/prefetch\.sh$''
+            ''^tests/functional/flakes/run\.sh$''
+            ''^tests/functional/flakes/show\.sh$''
+            ''^tests/functional/fmt\.sh$''
+            ''^tests/functional/fmt\.simple\.sh$''
+            ''^tests/functional/gc-auto\.sh$''
+            ''^tests/functional/gc-concurrent\.builder\.sh$''
+            ''^tests/functional/gc-concurrent\.sh$''
+            ''^tests/functional/gc-concurrent2\.builder\.sh$''
+            ''^tests/functional/gc-non-blocking\.sh$''
+            ''^tests/functional/git-hashing/common\.sh$''
+            ''^tests/functional/git-hashing/simple\.sh$''
+            ''^tests/functional/hash-convert\.sh$''
+            ''^tests/functional/impure-derivations\.sh$''
+            ''^tests/functional/impure-eval\.sh$''
+            ''^tests/functional/install-darwin\.sh$''
+            ''^tests/functional/legacy-ssh-store\.sh$''
+            ''^tests/functional/linux-sandbox\.sh$''
+            ''^tests/functional/local-overlay-store/add-lower-inner\.sh$''
+            ''^tests/functional/local-overlay-store/add-lower\.sh$''
+            ''^tests/functional/local-overlay-store/bad-uris\.sh$''
+            ''^tests/functional/local-overlay-store/build-inner\.sh$''
+            ''^tests/functional/local-overlay-store/build\.sh$''
+            ''^tests/functional/local-overlay-store/check-post-init-inner\.sh$''
+            ''^tests/functional/local-overlay-store/check-post-init\.sh$''
+            ''^tests/functional/local-overlay-store/common\.sh$''
+            ''^tests/functional/local-overlay-store/delete-duplicate-inner\.sh$''
+            ''^tests/functional/local-overlay-store/delete-duplicate\.sh$''
+            ''^tests/functional/local-overlay-store/delete-refs-inner\.sh$''
+            ''^tests/functional/local-overlay-store/delete-refs\.sh$''
+            ''^tests/functional/local-overlay-store/gc-inner\.sh$''
+            ''^tests/functional/local-overlay-store/gc\.sh$''
+            ''^tests/functional/local-overlay-store/optimise-inner\.sh$''
+            ''^tests/functional/local-overlay-store/optimise\.sh$''
+            ''^tests/functional/local-overlay-store/redundant-add-inner\.sh$''
+            ''^tests/functional/local-overlay-store/redundant-add\.sh$''
+            ''^tests/functional/local-overlay-store/remount\.sh$''
+            ''^tests/functional/local-overlay-store/stale-file-handle-inner\.sh$''
+            ''^tests/functional/local-overlay-store/stale-file-handle\.sh$''
+            ''^tests/functional/local-overlay-store/verify-inner\.sh$''
+            ''^tests/functional/local-overlay-store/verify\.sh$''
+            ''^tests/functional/logging\.sh$''
+            ''^tests/functional/misc\.sh$''
+            ''^tests/functional/multiple-outputs\.sh$''
+            ''^tests/functional/nested-sandboxing\.sh$''
+            ''^tests/functional/nested-sandboxing/command\.sh$''
+            ''^tests/functional/nix-build\.sh$''
+            ''^tests/functional/nix-channel\.sh$''
+            ''^tests/functional/nix-collect-garbage-d\.sh$''
+            ''^tests/functional/nix-copy-ssh-common\.sh$''
+            ''^tests/functional/nix-copy-ssh-ng\.sh$''
+            ''^tests/functional/nix-copy-ssh\.sh$''
+            ''^tests/functional/nix-daemon-untrusting\.sh$''
+            ''^tests/functional/nix-profile\.sh$''
+            ''^tests/functional/nix-shell\.sh$''
+            ''^tests/functional/nix_path\.sh$''
+            ''^tests/functional/optimise-store\.sh$''
+            ''^tests/functional/output-normalization\.sh$''
+            ''^tests/functional/parallel\.builder\.sh$''
+            ''^tests/functional/parallel\.sh$''
+            ''^tests/functional/pass-as-file\.sh$''
+            ''^tests/functional/path-from-hash-part\.sh$''
+            ''^tests/functional/path-info\.sh$''
+            ''^tests/functional/placeholders\.sh$''
+            ''^tests/functional/post-hook\.sh$''
+            ''^tests/functional/pure-eval\.sh$''
+            ''^tests/functional/push-to-store-old\.sh$''
+            ''^tests/functional/push-to-store\.sh$''
+            ''^tests/functional/read-only-store\.sh$''
+            ''^tests/functional/readfile-context\.sh$''
+            ''^tests/functional/recursive\.sh$''
+            ''^tests/functional/referrers\.sh$''
+            ''^tests/functional/remote-store\.sh$''
+            ''^tests/functional/repair\.sh$''
+            ''^tests/functional/restricted\.sh$''
+            ''^tests/functional/search\.sh$''
+            ''^tests/functional/secure-drv-outputs\.sh$''
+            ''^tests/functional/selfref-gc\.sh$''
+            ''^tests/functional/shell\.shebang\.sh$''
+            ''^tests/functional/simple\.builder\.sh$''
+            ''^tests/functional/supplementary-groups\.sh$''
+            ''^tests/functional/toString-path\.sh$''
+            ''^tests/functional/user-envs-migration\.sh$''
+            ''^tests/functional/user-envs-test-case\.sh$''
+            ''^tests/functional/user-envs\.builder\.sh$''
+            ''^tests/functional/user-envs\.sh$''
+            ''^tests/functional/why-depends\.sh$''
+            ''^src/libutil-tests/data/git/check-data\.sh$''
+          ];
+        };
+        # TODO: nixfmt, https://github.com/NixOS/nixfmt/issues/153
       };
     };
+  };
 
   # We'll be pulling from this in the main flake
   flake.getSystem = getSystem;

maintainers/format.sh

@@ -1,16 +1,11 @@
 #!/usr/bin/env bash
 
 if ! type -p pre-commit &>/dev/null; then
-  echo "format.sh: pre-commit not found. Please use \`nix develop -c ./maintainers/format.sh\`.";
+  echo "format.sh: pre-commit not found. Please use \`nix develop\`.";
   exit 1;
 fi;
 if test -z "$_NIX_PRE_COMMIT_HOOKS_CONFIG"; then
-  echo "format.sh: _NIX_PRE_COMMIT_HOOKS_CONFIG not set. Please use \`nix develop -c ./maintainers/format.sh\`.";
+  echo "format.sh: _NIX_PRE_COMMIT_HOOKS_CONFIG not set. Please use \`nix develop\`.";
   exit 1;
 fi;
-
-while ! pre-commit run --config "$_NIX_PRE_COMMIT_HOOKS_CONFIG" --all-files; do
-    if [ "${1:-}" != "--until-stable" ]; then
-        exit 1
-    fi
-done
+pre-commit run --config "$_NIX_PRE_COMMIT_HOOKS_CONFIG" --all-files

maintainers/release-credits

@@ -109,15 +109,15 @@ for sample in samples:
     s = samples[sample]
     email = s["email"]
     if not email in email_to_handle_cache.values:
-        print(f"Querying GitHub API for {s['hash']}, to get handle for {s['email']}", file=sys.stderr)
+        print(f"Querying GitHub API for {s['hash']}, to get handle for {s['email']}")
         ghc = get_github_commit(samples[sample])
         gha = ghc["author"]
         if gha and gha["login"]:
             handle = gha["login"]
-            print(f"Handle: {handle}", file=sys.stderr)
+            print(f"Handle: {handle}")
             email_to_handle_cache.values[email] = handle
         else:
-            print(f"Found no handle for {s['email']}", file=sys.stderr)
+            print(f"Found no handle for {s['email']}")
             email_to_handle_cache.values[email] = None
     handle = email_to_handle_cache.values[email]
     if handle is not None:

maintainers/release-notes

@@ -2,8 +2,6 @@
 # vim: set filetype=bash:
 #!nix shell .#changelog-d --command bash
 
-set -euo pipefail
-
 # --- CONFIGURATION ---
 
 # This does double duty for
@@ -157,7 +155,7 @@ section_title="Release $version_full ($DATE)"
 
   if ! $IS_PATCH; then
     echo
-    echo "## Contributors"
+    echo "# Contributors"
     echo
     VERSION=$version_full ./maintainers/release-credits
   fi