Merge pull request #13868 from NixOS/mergify/bp/2.28-maintenance/pr-13867

nix/develop: Fix misleading ignored error when run with --arg/--argstr (backport #13867)

.git-blame-ignore-revs

@@ -1,6 +1,6 @@
 # bulk initial re-formatting with clang-format
-e4f62e46088919428a68bd8014201dc8e379fed7 # !autorebase ./maintainers/format.sh --until-stable
-# meson re-formatting
-385e2c3542c707d95e3784f7f6d623f67e77ab61 # !autorebase ./maintainers/format.sh --until-stable
+a5264aa46eadb89c055b4d1442e814edb2d4414e # !autorebase ./maintainers/format.sh --until-stable
+# clang-format 18 -> clang-format 19
+945d9d7264b0dc7d0a8c8edf1cab34f38cd49a7f # !autorebase ./maintainers/format.sh --until-stable
 # nixfmt 1.0.0
-1d943f581908f35075a84a3d89c2eba3ff35067f # !autorebase ./maintainers/format.sh --until-stable
+448bbbe0fd1fbe09cb46a238fec25b220f172122 # !autorebase ./maintainers/format.sh --until-stable

.github/CODEOWNERS

@@ -11,7 +11,16 @@
 .github/CODEOWNERS @edolstra
 
 # Documentation of built-in functions
-src/libexpr/primops.cc @roberth
+src/libexpr/primops.cc @roberth @fricklerhandwerk
+
+# Documentation of settings
+src/libexpr/eval-settings.hh @fricklerhandwerk
+src/libstore/globals.hh @fricklerhandwerk
+
+# Documentation
+doc/manual @fricklerhandwerk
+maintainers/*.md @fricklerhandwerk
+src/**/*.md @fricklerhandwerk
 
 # Libstore layer
 /src/libstore @ericson2314

.github/ISSUE_TEMPLATE/bug_report.md

@@ -45,7 +45,7 @@ assignees: ''
 - [ ] checked [latest Nix manual] \([source])
 - [ ] checked [open bug issues and pull requests] for possible duplicates
 
-[latest Nix manual]: https://nix.dev/manual/nix/development/
+[latest Nix manual]: https://nixos.org/manual/nix/unstable/
 [source]: https://github.com/NixOS/nix/tree/master/doc/manual/source
 [open bug issues and pull requests]: https://github.com/NixOS/nix/labels/bug
 

.github/ISSUE_TEMPLATE/feature_request.md

@@ -30,7 +30,7 @@ assignees: ''
 - [ ] checked [latest Nix manual] \([source])
 - [ ] checked [open feature issues and pull requests] for possible duplicates
 
-[latest Nix manual]: https://nix.dev/manual/nix/development/
+[latest Nix manual]: https://nixos.org/manual/nix/unstable/
 [source]: https://github.com/NixOS/nix/tree/master/doc/manual/source
 [open feature issues and pull requests]: https://github.com/NixOS/nix/labels/feature
 

.github/ISSUE_TEMPLATE/installer.md

@@ -38,7 +38,7 @@ assignees: ''
 - [ ] checked [latest Nix manual] \([source])
 - [ ] checked [open installer issues and pull requests] for possible duplicates
 
-[latest Nix manual]: https://nix.dev/manual/nix/development/
+[latest Nix manual]: https://nixos.org/manual/nix/unstable/
 [source]: https://github.com/NixOS/nix/tree/master/doc/manual/source
 [open installer issues and pull requests]: https://github.com/NixOS/nix/labels/installer
 

.github/ISSUE_TEMPLATE/missing_documentation.md

@@ -22,7 +22,7 @@ assignees: ''
 - [ ] checked [latest Nix manual] \([source])
 - [ ] checked [open documentation issues and pull requests] for possible duplicates
 
-[latest Nix manual]: https://nix.dev/manual/nix/development/
+[latest Nix manual]: https://nixos.org/manual/nix/unstable/
 [source]: https://github.com/NixOS/nix/tree/master/doc/manual/source
 [open documentation issues and pull requests]: https://github.com/NixOS/nix/labels/documentation
 

.github/STALE-BOT.md

@@ -3,7 +3,7 @@
 - Thanks for your contribution!
 - To remove the stale label, just leave a new comment.
 - _How to find the right people to ping?_ → [`git blame`](https://git-scm.com/docs/git-blame) to the rescue! (or GitHub's history and blame buttons.)
-- You can always ask for help on [our Discourse Forum](https://discourse.nixos.org/) or on [Matrix - #users:nixos.org](https://matrix.to/#/#users:nixos.org).
+- You can always ask for help on [our Discourse Forum](https://discourse.nixos.org/) or on [Matrix - #nix:nixos.org](https://matrix.to/#/#nix:nixos.org).
 
 ## Suggestions for PRs
 

.github/actions/install-nix-action/action.yaml

@@ -9,7 +9,7 @@ inputs:
   install_url:
     description: "URL of the Nix installer"
     required: false
-    default: "https://releases.nixos.org/nix/nix-2.30.2/install"
+    default: "https://releases.nixos.org/nix/nix-2.29.1/install"
   github_token:
     description: "Github token"
     required: true

.github/workflows/ci.yml

@@ -2,15 +2,7 @@ name: "CI"
 
 on:
   pull_request:
-  merge_group:
   push:
-  workflow_dispatch:
-    inputs:
-      dogfood:
-        description: 'Use dogfood Nix build'
-        required: false
-        default: true
-        type: boolean
 
 permissions: read-all
 
@@ -18,12 +10,12 @@ jobs:
   eval:
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v4
       with:
         fetch-depth: 0
     - uses: ./.github/actions/install-nix-action
       with:
-        dogfood: ${{ github.event_name == 'workflow_dispatch' && inputs.dogfood || github.event_name != 'workflow_dispatch' }}
+        dogfood: false
         extra_nix_config:
           experimental-features = nix-command flakes
         github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -37,69 +29,36 @@ jobs:
           - scenario: on ubuntu
             runs-on: ubuntu-24.04
             os: linux
-            instrumented: false
-            primary: true
-            stdenv: stdenv
           - scenario: on macos
             runs-on: macos-14
             os: darwin
-            instrumented: false
-            primary: true
-            stdenv: stdenv
-          - scenario: on ubuntu (with sanitizers / coverage)
-            runs-on: ubuntu-24.04
-            os: linux
-            instrumented: true
-            primary: false
-            stdenv: clangStdenv
     name: tests ${{ matrix.scenario }}
     runs-on: ${{ matrix.runs-on }}
     timeout-minutes: 60
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v4
       with:
         fetch-depth: 0
     - uses: ./.github/actions/install-nix-action
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
-        dogfood: ${{ github.event_name == 'workflow_dispatch' && inputs.dogfood || github.event_name != 'workflow_dispatch' }}
+        dogfood: false
         # The sandbox would otherwise be disabled by default on Darwin
-        extra_nix_config: "sandbox = true"
+        extra_nix_config: |
+          sandbox = true
+          max-jobs = 1
     - uses: DeterminateSystems/magic-nix-cache-action@main
     # Since ubuntu 22.30, unprivileged usernamespaces are no longer allowed to map to the root user:
     # https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces
     - run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
       if: matrix.os == 'linux'
-    - name: Run component tests
-      run: |
-        nix build --file ci/gha/tests/wrapper.nix componentTests -L \
-          --arg withInstrumentation ${{ matrix.instrumented }} \
-          --argstr stdenv "${{ matrix.stdenv }}"
-    - name: Run flake checks and prepare the installer tarball
-      run: |
-        ci/gha/tests/build-checks
-        ci/gha/tests/prepare-installer-for-github-actions
-      if: ${{ matrix.primary }}
-    - name: Collect code coverage
-      run: |
-        nix build --file ci/gha/tests/wrapper.nix codeCoverage.coverageReports -L \
-          --arg withInstrumentation ${{ matrix.instrumented }} \
-          --argstr stdenv "${{ matrix.stdenv }}" \
-          --out-link coverage-reports
-        cat coverage-reports/index.txt >> $GITHUB_STEP_SUMMARY
-      if: ${{ matrix.instrumented }}
-    - name: Upload coverage reports
-      uses: actions/upload-artifact@v4
-      with:
-        name: coverage-reports
-        path: coverage-reports/
-      if: ${{ matrix.instrumented }}
+    - run: scripts/build-checks
+    - run: scripts/prepare-installer-for-github-actions
     - name: Upload installer tarball
       uses: actions/upload-artifact@v4
       with:
         name: installer-${{matrix.os}}
         path: out/*
-      if: ${{ matrix.primary }}
 
   installer_test:
     needs: [tests]
@@ -116,19 +75,19 @@ jobs:
     name: installer test ${{ matrix.scenario }}
     runs-on: ${{ matrix.runs-on }}
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v4
     - name: Download installer tarball
-      uses: actions/download-artifact@v5
+      uses: actions/download-artifact@v4
       with:
         name: installer-${{matrix.os}}
         path: out
-    - name: Looking up the installer tarball URL
-      id: installer-tarball-url
-      run: echo "installer-url=file://$GITHUB_WORKSPACE/out" >> "$GITHUB_OUTPUT"
-    - uses: cachix/install-nix-action@v31
+    - name: Serving installer
+      id: serving_installer
+      run: ./scripts/serve-installer-for-github-actions
+    - uses: cachix/install-nix-action@v30
       with:
-        install_url: ${{ format('{0}/install', steps.installer-tarball-url.outputs.installer-url) }}
-        install_options: ${{ format('--tarball-url-prefix {0}', steps.installer-tarball-url.outputs.installer-url) }}
+        install_url: 'http://localhost:8126/install'
+        install_options: "--tarball-url-prefix http://localhost:8126/"
     - run: sudo apt install fish zsh
       if: matrix.os == 'linux'
     - run: brew install fish
@@ -147,17 +106,17 @@ jobs:
   check_secrets:
     permissions:
       contents: none
-    name: Check presence of secrets
+    name: Check Docker secrets present for installer tests
     runs-on: ubuntu-24.04
     outputs:
       docker: ${{ steps.secret.outputs.docker }}
     steps:
-      - name: Check for DockerHub secrets
+      - name: Check for secrets
         id: secret
         env:
           _DOCKER_SECRETS: ${{ secrets.DOCKERHUB_USERNAME }}${{ secrets.DOCKERHUB_TOKEN }}
         run: |
-          echo "docker=${{ env._DOCKER_SECRETS != '' }}" >> $GITHUB_OUTPUT
+          echo "::set-output name=docker::${{ env._DOCKER_SECRETS != '' }}"
 
   docker_push_image:
     needs: [tests, vm_tests, check_secrets]
@@ -170,10 +129,16 @@ jobs:
       github.ref_name == 'master'
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v5
+    - name: Check for secrets
+      id: secret
+      env:
+        _DOCKER_SECRETS: ${{ secrets.DOCKERHUB_USERNAME }}${{ secrets.DOCKERHUB_TOKEN }}
+      run: |
+        echo "::set-output name=docker::${{ env._DOCKER_SECRETS != '' }}"
+    - uses: actions/checkout@v4
       with:
         fetch-depth: 0
-    - uses: cachix/install-nix-action@v31
+    - uses: cachix/install-nix-action@v30
       with:
         install_url: https://releases.nixos.org/nix/nix-2.20.3/install
     - uses: DeterminateSystems/magic-nix-cache-action@main
@@ -216,10 +181,10 @@ jobs:
   vm_tests:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v4
       - uses: ./.github/actions/install-nix-action
         with:
-          dogfood: ${{ github.event_name == 'workflow_dispatch' && inputs.dogfood || github.event_name != 'workflow_dispatch' }}
+          dogfood: false
           extra_nix_config:
             experimental-features = nix-command flakes
           github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -237,45 +202,22 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout nix
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
       - name: Checkout flake-regressions
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
         with:
           repository: NixOS/flake-regressions
           path: flake-regressions
       - name: Checkout flake-regressions-data
-        uses: actions/checkout@v5
+        uses: actions/checkout@v4
         with:
           repository: NixOS/flake-regressions-data
           path: flake-regressions/tests
       - uses: ./.github/actions/install-nix-action
         with:
-          dogfood: ${{ github.event_name == 'workflow_dispatch' && inputs.dogfood || github.event_name != 'workflow_dispatch' }}
+          dogfood: false
           extra_nix_config:
             experimental-features = nix-command flakes
           github_token: ${{ secrets.GITHUB_TOKEN }}
       - uses: DeterminateSystems/magic-nix-cache-action@main
       - run: nix build -L --out-link ./new-nix && PATH=$(pwd)/new-nix/bin:$PATH MAX_FLAKES=25 flake-regressions/eval-all.sh
-
-  profile_build:
-    needs: tests
-    runs-on: ubuntu-24.04
-    timeout-minutes: 60
-    if: >-
-      github.event_name == 'push' &&
-      github.ref_name == 'master'
-    steps:
-    - uses: actions/checkout@v5
-      with:
-        fetch-depth: 0
-    - uses: ./.github/actions/install-nix-action
-      with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
-        dogfood: ${{ github.event_name == 'workflow_dispatch' && inputs.dogfood || github.event_name != 'workflow_dispatch' }}
-        extra_nix_config: |
-          experimental-features = flakes nix-command ca-derivations impure-derivations
-          max-jobs = 1
-    - uses: DeterminateSystems/magic-nix-cache-action@main
-    - run: |
-        nix build -L --file ./ci/gha/profile-build buildTimeReport --out-link build-time-report.md
-        cat build-time-report.md >> $GITHUB_STEP_SUMMARY

.github/workflows/labels.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-24.04
     if: github.repository_owner == 'NixOS'
     steps:
-    - uses: actions/labeler@v6
+    - uses: actions/labeler@v5
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         sync-labels: false

.mergify.yml

@@ -128,47 +128,3 @@ pull_request_rules:
         labels:
           - automatic backport
           - merge-queue
-
-  - name: backport patches to 2.28
-    conditions:
-      - label=backport 2.28-maintenance
-    actions:
-      backport:
-        branches:
-          - "2.28-maintenance"
-        labels:
-          - automatic backport
-          - merge-queue
-
-  - name: backport patches to 2.29
-    conditions:
-      - label=backport 2.29-maintenance
-    actions:
-      backport:
-        branches:
-          - "2.29-maintenance"
-        labels:
-          - automatic backport
-          - merge-queue
-
-  - name: backport patches to 2.30
-    conditions:
-      - label=backport 2.30-maintenance
-    actions:
-      backport:
-        branches:
-          - "2.30-maintenance"
-        labels:
-          - automatic backport
-          - merge-queue
-
-  - name: backport patches to 2.31
-    conditions:
-      - label=backport 2.31-maintenance
-    actions:
-      backport:
-        branches:
-          - "2.31-maintenance"
-        labels:
-          - automatic backport
-          - merge-queue

.version

@@ -1 +1 @@
-2.32.0
+2.28.5

CONTRIBUTING.md

@@ -89,7 +89,7 @@ Check out the [security policy](https://github.com/NixOS/nix/security/policy).
 
 ## Making changes to the Nix manual
 
-The Nix reference manual is hosted on https://nix.dev/manual/nix.
+The Nix reference manual is hosted on https://nixos.org/manual/nix.
 The underlying source files are located in [`doc/manual/source`](./doc/manual/source).
 For small changes you can [use GitHub to edit these files](https://docs.github.com/en/repositories/working-with-files/managing-files/editing-files)
 For larger changes see the [Nix reference manual](https://nix.dev/manual/nix/development/development/contributing.html).

README.md

@@ -31,7 +31,7 @@ Today, a world-wide developer community contributes to Nix and the ecosystem tha
 - [Nixpkgs](https://github.com/NixOS/nixpkgs) is [the largest, most up-to-date free software repository in the world](https://repology.org/repositories/graphs)
 - [NixOS](https://github.com/NixOS/nixpkgs/tree/master/nixos) is a Linux distribution that can be configured fully declaratively
 - [Discourse](https://discourse.nixos.org/)
-- Matrix: [#users:nixos.org](https://matrix.to/#/#users:nixos.org) for user support and [#nix-dev:nixos.org](https://matrix.to/#/#nix-dev:nixos.org) for development
+- [Matrix](https://matrix.to/#/#nix:nixos.org)
 
 ## License
 

ci/gha/profile-build/default.nix

@@ -1,101 +0,0 @@
-{
-  nixFlake ? builtins.getFlake ("git+file://" + toString ../../..),
-  system ? builtins.currentSystem,
-  pkgs ? nixFlake.inputs.nixpkgs.legacyPackages.${system},
-}:
-
-let
-  inherit (pkgs) lib;
-
-  nixComponentsInstrumented =
-    (nixFlake.lib.makeComponents {
-      inherit pkgs;
-      getStdenv = p: p.clangStdenv;
-    }).overrideScope
-      (
-        _: _: {
-          mesonComponentOverrides = finalAttrs: prevAttrs: {
-            outputs = (prevAttrs.outputs or [ "out" ]) ++ [ "buildprofile" ];
-            nativeBuildInputs = [ pkgs.clangbuildanalyzer ] ++ prevAttrs.nativeBuildInputs or [ ];
-            __impure = true;
-
-            env = {
-              CFLAGS = "-ftime-trace";
-              CXXFLAGS = "-ftime-trace";
-            };
-
-            preBuild = ''
-              ClangBuildAnalyzer --start $PWD
-            '';
-
-            postBuild = ''
-              ClangBuildAnalyzer --stop $PWD $buildprofile
-            '';
-          };
-        }
-      );
-
-  componentsToProfile = {
-    "nix-util" = { };
-    "nix-util-c" = { };
-    "nix-util-test-support" = { };
-    "nix-util-tests" = { };
-    "nix-store" = { };
-    "nix-store-c" = { };
-    "nix-store-test-support" = { };
-    "nix-store-tests" = { };
-    "nix-fetchers" = { };
-    "nix-fetchers-c" = { };
-    "nix-fetchers-tests" = { };
-    "nix-expr" = { };
-    "nix-expr-c" = { };
-    "nix-expr-test-support" = { };
-    "nix-expr-tests" = { };
-    "nix-flake" = { };
-    "nix-flake-c" = { };
-    "nix-flake-tests" = { };
-    "nix-main" = { };
-    "nix-main-c" = { };
-    "nix-cmd" = { };
-    "nix-cli" = { };
-  };
-
-  componentDerivationsToProfile = builtins.intersectAttrs componentsToProfile nixComponentsInstrumented;
-  componentBuildProfiles = lib.mapAttrs (
-    n: v: lib.getOutput "buildprofile" v
-  ) componentDerivationsToProfile;
-
-  buildTimeReport =
-    pkgs.runCommand "build-time-report"
-      {
-        __impure = true;
-        __structuredAttrs = true;
-        nativeBuildInputs = [ pkgs.clangbuildanalyzer ];
-        inherit componentBuildProfiles;
-      }
-      ''
-        {
-          echo "# Build time performance profile for components:"
-          echo
-          echo "This reports the build profile collected via \`-ftime-trace\` for each component."
-          echo
-        } >> $out
-
-        for name in "''\${!componentBuildProfiles[@]}"; do
-          {
-            echo "<details><summary><strong>$name</strong></summary>"
-            echo
-            echo '````'
-            ClangBuildAnalyzer --analyze "''\${componentBuildProfiles[$name]}"
-            echo '````'
-            echo
-            echo "</details>"
-          } >> $out
-        done
-      '';
-in
-
-{
-  inherit buildTimeReport;
-  inherit componentDerivationsToProfile;
-}

ci/gha/tests/default.nix

@@ -1,229 +0,0 @@
-{
-  nixFlake ? builtins.getFlake ("git+file://" + toString ../../..),
-  system ? builtins.currentSystem,
-  pkgs ? nixFlake.inputs.nixpkgs.legacyPackages.${system},
-  nixComponents ? (
-    nixFlake.lib.makeComponents {
-      inherit pkgs;
-      inherit getStdenv;
-    }
-  ),
-  getStdenv ? p: p.stdenv,
-  componentTestsPrefix ? "",
-  withSanitizers ? false,
-  withCoverage ? false,
-  ...
-}:
-
-let
-  inherit (pkgs) lib;
-  hydraJobs = nixFlake.hydraJobs;
-  packages' = nixFlake.packages.${system};
-  stdenv = (getStdenv pkgs);
-
-  enableSanitizersLayer = finalAttrs: prevAttrs: {
-    mesonFlags =
-      (prevAttrs.mesonFlags or [ ])
-      ++ [
-        # Run all tests with UBSAN enabled. Running both with ubsan and
-        # without doesn't seem to have much immediate benefit for doubling
-        # the GHA CI workaround.
-        #
-        # TODO: Work toward enabling "address,undefined" if it seems feasible.
-        # This would maybe require dropping Boost coroutines and ignoring intentional
-        # memory leaks with detect_leaks=0.
-        (lib.mesonOption "b_sanitize" "undefined")
-      ]
-      ++ (lib.optionals stdenv.cc.isClang [
-        # https://www.github.com/mesonbuild/meson/issues/764
-        (lib.mesonBool "b_lundef" false)
-      ]);
-  };
-
-  collectCoverageLayer = finalAttrs: prevAttrs: {
-    env =
-      let
-        # https://clang.llvm.org/docs/SourceBasedCodeCoverage.html#the-code-coverage-workflow
-        coverageFlags = [
-          "-fprofile-instr-generate"
-          "-fcoverage-mapping"
-        ];
-      in
-      {
-        CFLAGS = toString coverageFlags;
-        CXXFLAGS = toString coverageFlags;
-      };
-
-    # Done in a pre-configure hook, because $NIX_BUILD_TOP needs to be substituted.
-    preConfigure = prevAttrs.preConfigure or "" + ''
-      mappingFlag=" -fcoverage-prefix-map=$NIX_BUILD_TOP/${finalAttrs.src.name}=${finalAttrs.src}"
-      CFLAGS+="$mappingFlag"
-      CXXFLAGS+="$mappingFlag"
-    '';
-  };
-
-  componentOverrides =
-    (lib.optional withSanitizers enableSanitizersLayer)
-    ++ (lib.optional withCoverage collectCoverageLayer);
-in
-
-rec {
-  nixComponentsInstrumented = nixComponents.overrideScope (
-    final: prev: {
-      nix-store-tests = prev.nix-store-tests.override { withBenchmarks = true; };
-
-      mesonComponentOverrides = lib.composeManyExtensions componentOverrides;
-    }
-  );
-
-  /**
-    Top-level tests for the flake outputs, as they would be built by hydra.
-    These tests generally can't be overridden to run with sanitizers.
-  */
-  topLevel = {
-    installerScriptForGHA = hydraJobs.installerScriptForGHA.${system};
-    installTests = hydraJobs.installTests.${system};
-    nixpkgsLibTests = hydraJobs.tests.nixpkgsLibTests.${system};
-    rl-next = pkgs.buildPackages.runCommand "test-rl-next-release-notes" { } ''
-      LANG=C.UTF-8 ${pkgs.changelog-d}/bin/changelog-d ${../../../doc/manual/rl-next} >$out
-    '';
-    repl-completion = pkgs.callPackage ../../../tests/repl-completion.nix { inherit (packages') nix; };
-
-    /**
-      Checks for our packaging expressions.
-      This shouldn't build anything significant; just check that things
-      (including derivations) are _set up_ correctly.
-    */
-    packaging-overriding =
-      let
-        nix = packages'.nix;
-      in
-      assert (nix.appendPatches [ pkgs.emptyFile ]).libs.nix-util.src.patches == [ pkgs.emptyFile ];
-      if pkgs.stdenv.buildPlatform.isDarwin then
-        lib.warn "packaging-overriding check currently disabled because of a permissions issue on macOS" pkgs.emptyFile
-      else
-        # If this fails, something might be wrong with how we've wired the scope,
-        # or something could be broken in Nixpkgs.
-        pkgs.testers.testEqualContents {
-          assertion = "trivial patch does not change source contents";
-          expected = "${../../..}";
-          actual =
-            # Same for all components; nix-util is an arbitrary pick
-            (nix.appendPatches [ pkgs.emptyFile ]).libs.nix-util.src;
-        };
-  };
-
-  componentTests =
-    (lib.concatMapAttrs (
-      pkgName: pkg:
-      lib.concatMapAttrs (testName: test: {
-        "${componentTestsPrefix}${pkgName}-${testName}" = test;
-      }) (pkg.tests or { })
-    ) nixComponentsInstrumented)
-    // lib.optionalAttrs (pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform) {
-      "${componentTestsPrefix}nix-functional-tests" = nixComponentsInstrumented.nix-functional-tests;
-    };
-
-  codeCoverage =
-    let
-      componentsTestsToProfile =
-        (builtins.mapAttrs (n: v: nixComponentsInstrumented.${n}.tests.run) {
-          "nix-util-tests" = { };
-          "nix-store-tests" = { };
-          "nix-fetchers-tests" = { };
-          "nix-expr-tests" = { };
-          "nix-flake-tests" = { };
-        })
-        // {
-          inherit (nixComponentsInstrumented) nix-functional-tests;
-        };
-
-      coverageProfileDrvs = lib.mapAttrs (
-        n: v:
-        v.overrideAttrs (
-          finalAttrs: prevAttrs: {
-            outputs = (prevAttrs.outputs or [ "out" ]) ++ [ "profraw" ];
-            env = {
-              LLVM_PROFILE_FILE = "${placeholder "profraw"}/%m";
-            };
-          }
-        )
-      ) componentsTestsToProfile;
-
-      coverageProfiles = lib.mapAttrsToList (n: v: lib.getOutput "profraw" v) coverageProfileDrvs;
-
-      mergedProfdata =
-        pkgs.runCommand "merged-profdata"
-          {
-            __structuredAttrs = true;
-            nativeBuildInputs = [ pkgs.llvmPackages.libllvm ];
-            inherit coverageProfiles;
-          }
-          ''
-            rawProfiles=()
-            for dir in "''\${coverageProfiles[@]}"; do
-              rawProfiles+=($dir/*)
-            done
-            llvm-profdata merge -sparse -output $out "''\${rawProfiles[@]}"
-          '';
-
-      coverageReports =
-        let
-          nixComponentDrvs = lib.filter (lib.isDerivation) (lib.attrValues nixComponentsInstrumented);
-        in
-        pkgs.runCommand "code-coverage-report"
-          {
-            nativeBuildInputs = [
-              pkgs.llvmPackages.libllvm
-              pkgs.jq
-            ];
-            __structuredAttrs = true;
-            nixComponents = nixComponentDrvs;
-          }
-          ''
-            # ${toString (lib.map (v: v.src) nixComponentDrvs)}
-
-            binaryFiles=()
-            for dir in "''\${nixComponents[@]}"; do
-              readarray -t filesInDir < <(find "$dir" -type f -executable)
-              binaryFiles+=("''\${filesInDir[@]}")
-            done
-
-            arguments=$(concatStringsSep " -object " binaryFiles)
-            llvm-cov show $arguments -instr-profile ${mergedProfdata} -output-dir $out -format=html
-
-            {
-              echo "# Code coverage summary (generated via \`llvm-cov\`):"
-              echo
-              echo '```'
-              llvm-cov report $arguments -instr-profile ${mergedProfdata} -format=text -use-color=false
-              echo '```'
-              echo
-            } >> $out/index.txt
-
-            llvm-cov export $arguments -instr-profile ${mergedProfdata} -format=text > $out/coverage.json
-
-            mkdir -p $out/nix-support
-
-            coverageTotals=$(jq ".data[0].totals" $out/coverage.json)
-
-            # Mostly inline from pkgs/build-support/setup-hooks/make-coverage-analysis-report.sh [1],
-            # which we can't use here, because we rely on LLVM's infra for source code coverage collection.
-            # [1]: https://github.com/NixOS/nixpkgs/blob/67bb48c4c8e327417d6d5aa7e538244b209e852b/pkgs/build-support/setup-hooks/make-coverage-analysis-report.sh#L16
-            declare -A metricsArray=(["lineCoverage"]="lines" ["functionCoverage"]="functions" ["branchCoverage"]="branches")
-
-            for metricName in "''\${!metricsArray[@]}"; do
-              key="''\${metricsArray[$metricName]}"
-              metric=$(echo "$coverageTotals" | jq ".$key.percent * 10 | round / 10")
-              echo "$metricName $metric %" >> $out/nix-support/hydra-metrics
-            done
-
-            echo "report coverage $out" >> $out/nix-support/hydra-build-products
-          '';
-    in
-    assert withCoverage;
-    assert stdenv.cc.isClang;
-    {
-      inherit coverageProfileDrvs mergedProfdata coverageReports;
-    };
-}

ci/gha/tests/wrapper.nix

@@ -1,16 +0,0 @@
-{
-  nixFlake ? builtins.getFlake ("git+file://" + toString ../../..),
-  system ? builtins.currentSystem,
-  pkgs ? nixFlake.inputs.nixpkgs.legacyPackages.${system},
-  stdenv ? "stdenv",
-  componentTestsPrefix ? "",
-  withInstrumentation ? false,
-}@args:
-import ./. (
-  args
-  // {
-    getStdenv = p: p.${stdenv};
-    withSanitizers = withInstrumentation;
-    withCoverage = withInstrumentation;
-  }
-)

doc/manual/generate-store-info.nix

@@ -33,7 +33,6 @@ let
     {
       settings,
       doc,
-      uri-schemes,
       experimentalFeature,
     }:
     let

doc/manual/meson.build

@@ -1,5 +1,4 @@
-project(
-  'nix-manual',
+project('nix-manual',
   version : files('.version'),
   meson_version : '>= 1.1',
   license : 'LGPL-2.1-or-later',
@@ -9,45 +8,43 @@ nix = find_program('nix', native : true)
 
 mdbook = find_program('mdbook', native : true)
 bash = find_program('bash', native : true)
-rsync = find_program('rsync', required : true, native : true)
 
 pymod = import('python')
 python = pymod.find_installation('python3')
 
 nix_env_for_docs = {
-  'HOME' : '/dummy',
-  'NIX_CONF_DIR' : '/dummy',
-  'NIX_SSL_CERT_FILE' : '/dummy/no-ca-bundle.crt',
-  'NIX_STATE_DIR' : '/dummy',
-  'NIX_CONFIG' : 'cores = 0',
+  'HOME': '/dummy',
+  'NIX_CONF_DIR': '/dummy',
+  'NIX_SSL_CERT_FILE': '/dummy/no-ca-bundle.crt',
+  'NIX_STATE_DIR': '/dummy',
+  'NIX_CONFIG': 'cores = 0',
 }
 
-nix_for_docs = [ nix, '--experimental-features', 'nix-command' ]
+nix_for_docs = [nix, '--experimental-features', 'nix-command']
 nix_eval_for_docs_common = nix_for_docs + [
   'eval',
-  '-I',
-  'nix=' + meson.current_source_dir(),
+  '-I', 'nix=' + meson.current_source_dir(),
   '--store', 'dummy://',
   '--impure',
 ]
 nix_eval_for_docs = nix_eval_for_docs_common + '--raw'
 
 conf_file_json = custom_target(
-  command : nix_for_docs + [ 'config', 'show', '--json' ],
+  command : nix_for_docs + ['config', 'show', '--json'],
   capture : true,
   output : 'conf-file.json',
   env : nix_env_for_docs,
 )
 
 language_json = custom_target(
-  command : [ nix, '__dump-language' ],
+  command: [nix, '__dump-language'],
   output : 'language.json',
   capture : true,
   env : nix_env_for_docs,
 )
 
 nix3_cli_json = custom_target(
-  command : [ nix, '__dump-cli' ],
+  command : [nix, '__dump-cli'],
   capture : true,
   output : 'nix.json',
   env : nix_env_for_docs,
@@ -81,14 +78,13 @@ manual = custom_target(
   'manual',
   command : [
     bash,
-    '-euo',
-    'pipefail',
+    '-euo', 'pipefail',
     '-c',
     '''
         @0@ @INPUT0@ @CURRENT_SOURCE_DIR@ > @DEPFILE@
         @0@ @INPUT1@ summary @2@ < @CURRENT_SOURCE_DIR@/source/SUMMARY.md.in > @2@/source/SUMMARY.md
         sed -e 's|@version@|@3@|g' < @INPUT2@ > @2@/book.toml
-        @4@ -r --include='*.md' @CURRENT_SOURCE_DIR@/ @2@/
+        rsync -r --include='*.md' @CURRENT_SOURCE_DIR@/ @2@/
         (cd @2@; RUST_LOG=warn @1@ build -d @2@ 3>&2 2>&1 1>&3) | { grep -Fv "because fragment resolution isn't implemented" || :; } 3>&2 2>&1 1>&3
         rm -rf @2@/manual
         mv @2@/html @2@/manual
@@ -98,7 +94,6 @@ manual = custom_target(
       mdbook.full_path(),
       meson.current_build_dir(),
       meson.project_version(),
-      rsync.full_path(),
     ),
   ],
   input : [
@@ -123,8 +118,8 @@ manual = custom_target(
   ],
   depfile : 'manual.d',
   env : {
-    'RUST_LOG' : 'info',
-    'MDBOOK_SUBSTITUTE_SEARCH' : meson.current_build_dir() / 'source',
+    'RUST_LOG': 'info',
+    'MDBOOK_SUBSTITUTE_SEARCH': meson.current_build_dir() / 'source',
   },
 )
 manual_html = manual[0]
@@ -136,8 +131,7 @@ install_subdir(
 )
 
 nix_nested_manpages = [
-  [
-    'nix-env',
+  [ 'nix-env',
     [
       'delete-generations',
       'install',
@@ -152,8 +146,7 @@ nix_nested_manpages = [
       'upgrade',
     ],
   ],
-  [
-    'nix-store',
+  [ 'nix-store',
     [
       'add-fixed',
       'add',
@@ -253,11 +246,11 @@ nix3_manpages = [
   'nix3-nar',
   'nix3-path-info',
   'nix3-print-dev-env',
-  'nix3-profile',
-  'nix3-profile-add',
   'nix3-profile-diff-closures',
   'nix3-profile-history',
+  'nix3-profile-install',
   'nix3-profile-list',
+  'nix3-profile',
   'nix3-profile-remove',
   'nix3-profile-rollback',
   'nix3-profile-upgrade',
@@ -288,6 +281,7 @@ nix3_manpages = [
   'nix3-store',
   'nix3-store-optimise',
   'nix3-store-path-from-hash-part',
+  'nix3-store-ping',
   'nix3-store-prefetch-file',
   'nix3-store-repair',
   'nix3-store-sign',

doc/manual/package.nix

@@ -11,8 +11,6 @@
   python3,
   rsync,
   nix-cli,
-  changelog-d,
-  officialRelease,
 
   # Configuration Options
 
@@ -55,13 +53,6 @@ mkMesonDerivation (finalAttrs: {
     jq
     python3
     rsync
-    changelog-d
-  ]
-  ++ lib.optionals (!officialRelease) [
-    # When not an official release, we likely have changelog entries that have
-    # yet to be rendered.
-    # When released, these are rendered into a committed file to save a dependency.
-    changelog-d
   ];
 
   nativeBuildInputs = finalAttrs.passthru.externalNativeBuildInputs ++ [

doc/manual/redirects.js

@@ -374,7 +374,6 @@ const redirects = {
   },
   "glossary.html": {
     "gloss-local-store": "store/types/local-store.html",
-    "package-attribute-set": "#package",
     "gloss-chroot-store": "store/types/local-store.html",
     "gloss-content-addressed-derivation": "#gloss-content-addressing-derivation",
   },

doc/manual/rl-next/c-api-recoverable-errors.md

@@ -1,23 +0,0 @@
----
-synopsis: "C API: Errors returned from your primops are not treated as recoverable by default"
-prs: [13930]
----
-
-Nix 2.32 by default remembers the error in the thunk that triggered it.
-
-Previously the following sequence of events worked:
-
-1. Have a thunk that invokes a primop that's defined through the C API
-2. The primop returns an error
-3. Force the thunk again
-4. The primop returns a value
-5. The thunk evaluated successfully
-
-**Resolution**
-
-C API consumers that rely on this must change their recoverable error calls:
-
-```diff
--nix_set_err_msg(context, NIX_ERR_*, msg);
-+nix_set_err_msg(context, NIX_ERR_RECOVERABLE, msg);
-```

doc/manual/rl-next/dropped-compat.md

@@ -1,6 +0,0 @@
----
-synopsis: "Removed support for daemons and clients older than Nix 2.0"
-prs: [13951]
----
-
-We have dropped support in the daemon worker protocol for daemons and clients that don't speak at least version 18 of the protocol. This first Nix release that supports this version is Nix 2.0, released in February 2018.

doc/manual/rl-next/outpath-and-sourceinfo-fixes.md

@@ -0,0 +1,17 @@
+---
+synopsis: Non-flake inputs now contain a `sourceInfo` attribute
+issues: 13164
+prs: 13170
+---
+
+Flakes have always a `sourceInfo` attribute which describes the source of the flake.
+The `sourceInfo.outPath` is often identical to the flake's `outPath`, however it can differ when the flake is located in a subdirectory of its source.
+
+Non-flake inputs (i.e. inputs with `flake = false`) can also be located at some path _within_ a wider source.
+This usually happens when defining a relative path input within the same source as the parent flake, e.g. `inputs.foo.url = ./some-file.nix`.
+Such relative inputs will now inherit their parent's `sourceInfo`.
+
+This also means it is now possible to use `?dir=subdir` on non-flake inputs.
+
+This iterates on the work done in 2.26 to improve relative path support ([#10089](https://github.com/NixOS/nix/pull/10089)),
+and resolves a regression introduced in 2.28 relating to nested relative path inputs ([#13164](https://github.com/NixOS/nix/issues/13164)).

doc/manual/rl-next/shorter-build-dir-names.md

@@ -1,6 +0,0 @@
----
-synopsis: "Temporary build directories no longer include derivation names"
-prs: [13839]
----
-
-Temporary build directories created during derivation builds no longer include the derivation name in their path to avoid build failures when the derivation name is too long. This change ensures predictable prefix lengths for build directories under `/nix/var/nix/builds`.

doc/manual/source/SUMMARY.md.in

@@ -33,7 +33,6 @@
   - [Data Types](language/types.md)
     - [String context](language/string-context.md)
   - [Syntax and semantics](language/syntax.md)
-    - [Evaluation](language/evaluation.md)
     - [Variables](language/variables.md)
     - [String literals](language/string-literals.md)
     - [Identifiers](language/identifiers.md)
@@ -57,7 +56,6 @@
   - [Tuning Cores and Jobs](advanced-topics/cores-vs-jobs.md)
   - [Verifying Build Reproducibility](advanced-topics/diff-hook.md)
   - [Using the `post-build-hook`](advanced-topics/post-build-hook.md)
-  - [Evaluation profiler](advanced-topics/eval-profiler.md)
 - [Command Reference](command-ref/index.md)
   - [Common Options](command-ref/opt-common.md)
   - [Common Environment Variables](command-ref/env-common.md)
@@ -128,7 +126,6 @@
 - [Development](development/index.md)
   - [Building](development/building.md)
   - [Testing](development/testing.md)
-  - [Benchmarking](development/benchmarking.md)
   - [Debugging](development/debugging.md)
   - [Documentation](development/documentation.md)
   - [CLI guideline](development/cli-guideline.md)
@@ -138,9 +135,6 @@
   - [Contributing](development/contributing.md)
 - [Releases](release-notes/index.md)
 {{#include ./SUMMARY-rl-next.md}}
-  - [Release 2.31 (2025-08-21)](release-notes/rl-2.31.md)
-  - [Release 2.30 (2025-07-07)](release-notes/rl-2.30.md)
-  - [Release 2.29 (2025-05-14)](release-notes/rl-2.29.md)
   - [Release 2.28 (2025-04-02)](release-notes/rl-2.28.md)
   - [Release 2.27 (2025-03-03)](release-notes/rl-2.27.md)
   - [Release 2.26 (2025-01-22)](release-notes/rl-2.26.md)

doc/manual/source/advanced-topics/eval-profiler.md

@@ -1,33 +0,0 @@
-# Using the `eval-profiler`
-
-Nix evaluator supports [evaluation](@docroot@/language/evaluation.md)
-[profiling](<https://en.wikipedia.org/wiki/Profiling_(computer_programming)>)
-compatible with `flamegraph.pl`. The profiler samples the nix
-function call stack at regular intervals. It can be enabled with the
-[`eval-profiler`](@docroot@/command-ref/conf-file.md#conf-eval-profiler)
-setting:
-
-```console
-$ nix-instantiate "<nixpkgs>" -A hello --eval-profiler flamegraph
-```
-
-Stack sampling frequency and the output file path can be configured with
-[`eval-profile-file`](@docroot@/command-ref/conf-file.md#conf-eval-profile-file)
-and [`eval-profiler-frequency`](@docroot@/command-ref/conf-file.md#conf-eval-profiler-frequency).
-By default the collected profile is saved to `nix.profile` file in the current working directory.
-
-The collected profile can be directly consumed by `flamegraph.pl`:
-
-```console
-$ flamegraph.pl nix.profile > flamegraph.svg
-```
-
-The line information in the profile contains the location of the [call
-site](https://en.wikipedia.org/wiki/Call_site) position and the name of the
-function being called (when available). For example:
-
-```
-/nix/store/x9wnkly3k1gkq580m90jjn32q9f05q2v-source/pkgs/top-level/default.nix:167:5:primop import
-```
-
-Here `import` primop is called at `/nix/store/x9wnkly3k1gkq580m90jjn32q9f05q2v-source/pkgs/top-level/default.nix:167:5`.

doc/manual/source/command-ref/env-common.md

@@ -75,7 +75,7 @@ Most Nix commands interpret the following environment variables:
 - <span id="env-NIX_CONF_DIR">[`NIX_CONF_DIR`](#env-NIX_CONF_DIR)</span>
 
   Overrides the location of the system Nix configuration directory
-  (default `sysconfdir/nix`, i.e. `/etc/nix` on most systems).
+  (default `prefix/etc/nix`).
 
 - <span id="env-NIX_CONFIG">[`NIX_CONFIG`](#env-NIX_CONFIG)</span>
 

doc/manual/source/command-ref/meson.build

@@ -1,12 +1,13 @@
 xp_features_json = custom_target(
-  command : [ nix, '__dump-xp-features' ],
+  command : [nix, '__dump-xp-features'],
   capture : true,
   output : 'xp-features.json',
 )
 
 experimental_features_shortlist_md = custom_target(
   command : nix_eval_for_docs + [
-    '--expr', 'import @INPUT0@ (builtins.fromJSON (builtins.readFile ./@INPUT1@))',
+    '--expr',
+    'import @INPUT0@ (builtins.fromJSON (builtins.readFile ./@INPUT1@))',
   ],
   input : [
     '../../generate-xp-features-shortlist.nix',
@@ -18,8 +19,14 @@ experimental_features_shortlist_md = custom_target(
 )
 
 nix3_cli_files = custom_target(
-  command : [ python.full_path(), '@INPUT0@', '@OUTPUT@', '--' ] + nix_eval_for_docs + [
-    '--expr', 'import @INPUT1@ true (builtins.readFile ./@INPUT2@)',
+  command : [
+    python.full_path(),
+    '@INPUT0@',
+    '@OUTPUT@',
+    '--'
+  ] + nix_eval_for_docs + [
+    '--expr',
+    'import @INPUT1@ true (builtins.readFile ./@INPUT2@)',
   ],
   input : [
     '../../remove_before_wrapper.py',
@@ -33,7 +40,8 @@ nix3_cli_files = custom_target(
 conf_file_md_body = custom_target(
   command : [
     nix_eval_for_docs,
-    '--expr', 'import @INPUT0@ { prefix = "conf"; } (builtins.fromJSON (builtins.readFile ./@INPUT1@))',
+    '--expr',
+    'import @INPUT0@ { prefix = "conf"; } (builtins.fromJSON (builtins.readFile ./@INPUT1@))',
   ],
   capture : true,
   input : [

doc/manual/source/command-ref/nix-shell.md

@@ -242,21 +242,16 @@ print(t)
 ```
 
 Similarly, the following is a Perl script that specifies that it
-requires Perl and the `HTML::TokeParser::Simple`, `LWP` and
-`LWP::Protocol::Https` packages:
+requires Perl and the `HTML::TokeParser::Simple` and `LWP` packages:
 
 ```perl
 #! /usr/bin/env nix-shell
-#! nix-shell -i perl 
-#! nix-shell --packages perl 
-#! nix-shell --packages perlPackages.HTMLTokeParserSimple 
-#! nix-shell --packages perlPackages.LWP
-#! nix-shell --packages perlPackages.LWPProtocolHttps
+#! nix-shell -i perl --packages perl perlPackages.HTMLTokeParserSimple perlPackages.LWP
 
 use HTML::TokeParser::Simple;
 
 # Fetch nixos.org and print all hrefs.
-my $p = HTML::TokeParser::Simple->new(url => 'https://nixos.org/');
+my $p = HTML::TokeParser::Simple->new(url => 'http://nixos.org/');
 
 while (my $token = $p->get_tag("a")) {
     my $href = $token->get_attr("href");
@@ -321,7 +316,7 @@ contains:
 ```nix
 with import <nixpkgs> {};
 
-runCommand "dummy" { buildInputs = [ python3 python3Packages.prettytable ]; } ""
+runCommand "dummy" { buildInputs = [ python pythonPackages.prettytable ]; } ""
 ```
 
 The script's file name is passed as the first argument to the interpreter specified by the `-i` flag.

doc/manual/source/development/benchmarking.md

@@ -1,187 +0,0 @@
-# Running Benchmarks
-
-This guide explains how to build and run performance benchmarks in the Nix codebase.
-
-## Overview
-
-Nix uses the [Google Benchmark](https://github.com/google/benchmark) framework for performance testing. Benchmarks help measure and track the performance of critical operations like derivation parsing.
-
-## Building Benchmarks
-
-Benchmarks are disabled by default and must be explicitly enabled during the build configuration. For accurate results, use a debug-optimized release build.
-
-### Development Environment Setup
-
-First, enter the development shell which includes the necessary dependencies:
-
-```bash
-nix develop .#native-ccacheStdenv
-```
-
-### Configure Build with Benchmarks
-
-From the project root, configure the build with benchmarks enabled and optimization:
-
-```bash
-cd build
-meson configure -Dbenchmarks=true -Dbuildtype=debugoptimized
-```
-
-The `debugoptimized` build type provides:
-- Compiler optimizations for realistic performance measurements
-- Debug symbols for profiling and analysis
-- Balance between performance and debuggability
-
-### Build the Benchmarks
-
-Build the project including benchmarks:
-
-```bash
-ninja
-```
-
-This will create benchmark executables in the build directory. Currently available:
-- `build/src/libstore-tests/nix-store-benchmarks` - Store-related performance benchmarks
-
-Additional benchmark executables will be created as more benchmarks are added to the codebase.
-
-## Running Benchmarks
-
-### Basic Usage
-
-Run benchmark executables directly. For example, to run store benchmarks:
-
-```bash
-./build/src/libstore-tests/nix-store-benchmarks
-```
-
-As more benchmark executables are added, run them similarly from their respective build directories.
-
-### Filtering Benchmarks
-
-Run specific benchmarks using regex patterns:
-
-```bash
-# Run only derivation parser benchmarks
-./build/src/libstore-tests/nix-store-benchmarks --benchmark_filter="derivation.*"
-
-# Run only benchmarks for hello.drv
-./build/src/libstore-tests/nix-store-benchmarks --benchmark_filter=".*hello.*"
-```
-
-### Output Formats
-
-Generate benchmark results in different formats:
-
-```bash
-# JSON output
-./build/src/libstore-tests/nix-store-benchmarks --benchmark_format=json > results.json
-
-# CSV output
-./build/src/libstore-tests/nix-store-benchmarks --benchmark_format=csv > results.csv
-```
-
-### Advanced Options
-
-```bash
-# Run benchmarks multiple times for better statistics
-./build/src/libstore-tests/nix-store-benchmarks --benchmark_repetitions=10
-
-# Set minimum benchmark time (useful for micro-benchmarks)
-./build/src/libstore-tests/nix-store-benchmarks --benchmark_min_time=2
-
-# Compare against baseline
-./build/src/libstore-tests/nix-store-benchmarks --benchmark_baseline=baseline.json
-
-# Display time in custom units
-./build/src/libstore-tests/nix-store-benchmarks --benchmark_time_unit=ms
-```
-
-## Writing New Benchmarks
-
-To add new benchmarks:
-
-1. Create a new `.cc` file in the appropriate `*-tests` directory
-2. Include the benchmark header:
-   ```cpp
-   #include <benchmark/benchmark.h>
-   ```
-
-3. Write benchmark functions:
-   ```cpp
-   static void BM_YourBenchmark(benchmark::State & state)
-   {
-       // Setup code here
-
-       for (auto _ : state) {
-           // Code to benchmark
-       }
-   }
-   BENCHMARK(BM_YourBenchmark);
-   ```
-
-4. Add the file to the corresponding `meson.build`:
-   ```meson
-   benchmarks_sources = files(
-       'your-benchmark.cc',
-       # existing benchmarks...
-   )
-   ```
-
-## Profiling with Benchmarks
-
-For deeper performance analysis, combine benchmarks with profiling tools:
-
-```bash
-# Using Linux perf
-perf record ./build/src/libstore-tests/nix-store-benchmarks
-perf report
-```
-
-### Using Valgrind Callgrind
-
-Valgrind's callgrind tool provides detailed profiling information that can be visualized with kcachegrind:
-
-```bash
-# Profile with callgrind
-valgrind --tool=callgrind ./build/src/libstore-tests/nix-store-benchmarks
-
-# Visualize the results with kcachegrind
-kcachegrind callgrind.out.*
-```
-
-This provides:
-- Function call graphs
-- Instruction-level profiling
-- Source code annotation
-- Interactive visualization of performance bottlenecks
-
-## Continuous Performance Testing
-
-```bash
-# Save baseline results
-./build/src/libstore-tests/nix-store-benchmarks --benchmark_format=json > baseline.json
-
-# Compare against baseline in CI
-./build/src/libstore-tests/nix-store-benchmarks --benchmark_baseline=baseline.json
-```
-
-## Troubleshooting
-
-### Benchmarks not building
-
-Ensure benchmarks are enabled:
-```bash
-meson configure build | grep benchmarks
-# Should show: benchmarks true
-```
-
-### Inconsistent results
-
-- Ensure your system is not under heavy load
-- Disable CPU frequency scaling for consistent results
-- Run benchmarks multiple times with `--benchmark_repetitions`
-
-## See Also
-
-- [Google Benchmark documentation](https://github.com/google/benchmark/blob/main/docs/user_guide.md)

doc/manual/source/development/building.md

@@ -34,7 +34,7 @@ $ nix-shell --attr devShells.x86_64-linux.native-clangStdenvPackages
 To build Nix itself in this shell:
 
 ```console
-[nix-shell]$ out="$(pwd)/outputs/out" dev=$out debug=$out mesonFlags+=" --prefix=${out}"
+[nix-shell]$ mesonFlags+=" --prefix=$(pwd)/outputs/out"
 [nix-shell]$ dontAddPrefix=1 configurePhase
 [nix-shell]$ buildPhase
 ```

doc/manual/source/development/meson.build

@@ -1,6 +1,7 @@
 experimental_feature_descriptions_md = custom_target(
   command : nix_eval_for_docs + [
-    '--expr', 'import @INPUT0@ (builtins.fromJSON (builtins.readFile @INPUT1@))',
+    '--expr',
+    'import @INPUT0@ (builtins.fromJSON (builtins.readFile @INPUT1@))',
   ],
   input : [
     '../../generate-xp-features.nix',

doc/manual/source/glossary.md

@@ -31,22 +31,9 @@
 
   The industry term for storage and retrieval systems using [content addressing](#gloss-content-address). A Nix store also has [input addressing](#gloss-input-addressed-store-object), and metadata.
 
-- [derivation]{#gloss-derivation}
-
-  A derivation can be thought of as a [pure function](https://en.wikipedia.org/wiki/Pure_function) that produces new [store objects][store object] from existing store objects.
-
-  Derivations are implemented as [operating system processes that run in a sandbox](@docroot@/store/building.md#builder-execution).
-  This sandbox by default only allows reading from store objects specified as inputs, and only allows writing to designated [outputs][output] to be [captured as store objects](@docroot@/store/building.md#processing-outputs).
-
-  A derivation is typically specified as a [derivation expression] in the [Nix language], and [instantiated][instantiate] to a [store derivation].
-  There are multiple ways of obtaining store objects from store derivatons, collectively called [realisation][realise].
-
-  [derivation]: #gloss-derivation
-
 - [store derivation]{#gloss-store-derivation}
 
-  A [derivation] represented as a [store object].
-
+  A single build task.
   See [Store Derivation](@docroot@/store/derivation/index.md#store-derivation) for details.
 
   [store derivation]: #gloss-store-derivation
@@ -70,7 +57,10 @@
 
 - [derivation expression]{#gloss-derivation-expression}
 
-  A description of a [store derivation] using the [`derivation` primitive](./language/derivations.md) in the [Nix language].
+  A description of a [store derivation] in the Nix language.
+  The output(s) of a derivation are store objects.
+  Derivations are typically specified in Nix expressions using the [`derivation` primitive](./language/derivations.md).
+  These are translated into store layer *derivations* (implicitly by `nix-env` and `nix-build`, or explicitly by `nix-instantiate`).
 
   [derivation expression]: #gloss-derivation-expression
 
@@ -88,8 +78,9 @@
 
   This can be achieved by:
   - Fetching a pre-built [store object] from a [substituter]
-  - [Building](@docroot@/store/building.md) the corresponding [store derivation]
+  - Running the [`builder`](@docroot@/language/derivations.md#attr-builder) executable as specified in the corresponding [store derivation]
   - Delegating to a [remote machine](@docroot@/command-ref/conf-file.md#conf-builders) and retrieving the outputs
+  <!-- TODO: link [running] to build process page, #8888 -->
 
   See [`nix-store --realise`](@docroot@/command-ref/nix-store/realise.md) for a detailed description of the algorithm.
 
@@ -233,7 +224,7 @@
 
   > **Example**
   >
-  > Building and deploying software using Nix entails writing Nix expressions to describe [packages][package] and compositions thereof.
+  > Building and deploying software using Nix entails writing Nix expressions as a high-level description of packages and compositions thereof.
 
 - [reference]{#gloss-reference}
 
@@ -363,17 +354,18 @@
 
 - [package]{#package}
 
-  A software package; files that belong together for a particular purpose, and metadata.
+  1. A software package; a collection of files and other data.
 
-  Nix represents files as [file system objects][file system object], and how they belong together is encoded as [references][reference] between [store objects][store object] that contain these file system objects.
+  2. A [package attribute set].
 
-  The [Nix language] allows denoting packages in terms of [attribute sets](@docroot@/language/types.md#attribute-set) containing:
-  - attributes that refer to the files of a package, typically in the form of [derivation outputs](#output),
-  - attributes with metadata, such as information about how the package is supposed to be used.
+- [package attribute set]{#package-attribute-set}
 
-  The exact shape of these attribute sets is up to convention.
+  An [attribute set](@docroot@/language/types.md#attribute-set) containing the attribute `type = "derivation";` (derivation for historical reasons), as well as other attributes, such as
+  - attributes that refer to the files of a [package], typically in the form of [derivation outputs](#output),
+  - attributes that declare something about how the package is supposed to be installed or used,
+  - other metadata or arbitrary attributes.
 
-  [package]: #package
+  [package attribute set]: #package-attribute-set
 
 - [string interpolation]{#gloss-string-interpolation}
 

doc/manual/source/installation/index.md

@@ -30,8 +30,6 @@ $ curl -L https://nixos.org/nix/install | sh -s -- --daemon
 
 > Single-user is not supported on Mac.
 
-> `warning: installing Nix as root is not supported by this script!`
-
 This installation has less requirements than the multi-user install, however it
 cannot offer equivalent sharing, isolation, or security.
 

doc/manual/source/installation/prerequisites-source.md

@@ -10,7 +10,7 @@
   - Bash Shell. The `./configure` script relies on bashisms, so Bash is
     required.
 
-  - A version of GCC or Clang that supports C++23.
+  - A version of GCC or Clang that supports C++20.
 
   - `pkg-config` to locate dependencies. If your distribution does not
     provide it, you can get it from

doc/manual/source/installation/uninstall.md

@@ -41,38 +41,6 @@ There may also be references to Nix in
 
 which you may remove.
 
-### FreeBSD
-
-1. Stop and remove the Nix daemon service:
-
-   ```console
-   sudo service nix-daemon stop
-   sudo rm -f /usr/local/etc/rc.d/nix-daemon
-   sudo sysrc -x nix_daemon_enable
-   ```
-
-2. Remove files created by Nix:
-
-   ```console
-   sudo rm -rf /etc/nix /usr/local/etc/profile.d/nix.sh /nix ~root/.nix-channels ~root/.nix-defexpr ~root/.nix-profile ~root/.cache/nix
-   ```
-
-3. Remove build users and their group:
-
-   ```console
-   for i in $(seq 1 32); do
-     sudo pw userdel nixbld$i
-   done
-   sudo pw groupdel nixbld
-   ```
-
-4. There may also be references to Nix in:
-   - `/usr/local/etc/bashrc`
-   - `/usr/local/etc/zshrc`
-   - Shell configuration files in users' home directories
-
-   which you may remove.
-
 ### macOS
 
 > **Updating to macOS 15 Sequoia**

doc/manual/source/introduction.md

@@ -1,8 +1,8 @@
 # Introduction
 
 Nix is a _purely functional package manager_.  This means that it
-treats packages like values in a purely functional programming language
-— packages are built by functions that don’t have
+treats packages like values in purely functional programming languages
+such as Haskell — they are built by functions that don’t have
 side-effects, and they never change after they have been built.  Nix
 stores packages in the _Nix store_, usually the directory
 `/nix/store`, where each package has its own unique subdirectory such

doc/manual/source/language/advanced-attributes.md

@@ -53,13 +53,23 @@ Derivations can declare some infrequently used optional attributes.
 
   - [`__structuredAttrs`]{#adv-attr-structuredAttrs}\
     If the special attribute `__structuredAttrs` is set to `true`, the other derivation
-    attributes are serialised into a file in JSON format.
+    attributes are serialised into a file in JSON format. The environment variable
+    `NIX_ATTRS_JSON_FILE` points to the exact location of that file both in a build
+    and a [`nix-shell`](../command-ref/nix-shell.md). This obviates the need for
+    [`passAsFile`](#adv-attr-passAsFile) since JSON files have no size restrictions,
+    unlike process environments.
 
-    This obviates the need for [`passAsFile`](#adv-attr-passAsFile) since JSON files have no size restrictions, unlike process environments.
-    It also makes it possible to tweak derivation settings in a structured way;
-    see [`outputChecks`](#adv-attr-outputChecks) for example.
+    It also makes it possible to tweak derivation settings in a structured way; see
+    [`outputChecks`](#adv-attr-outputChecks) for example.
 
-    See the [corresponding section in the derivation page](@docroot@/store/derivation/index.md#structured-attrs) for further details.
+    As a convenience to Bash builders,
+    Nix writes a script that initialises shell variables
+    corresponding to all attributes that are representable in Bash. The
+    environment variable `NIX_ATTRS_SH_FILE` points to the exact
+    location of the script, both in a build and a
+    [`nix-shell`](../command-ref/nix-shell.md). This includes non-nested
+    (associative) arrays. For example, the attribute `hardening.format = true`
+    ends up as the Bash associative array element `${hardening[format]}`.
 
     > **Warning**
     >
@@ -160,6 +170,7 @@ See the [corresponding section in the derivation output page](@docroot@/store/de
 ## Other output modifications
 
   - [`unsafeDiscardReferences`]{#adv-attr-unsafeDiscardReferences}\
+
     When using [structured attributes](#adv-attr-structuredAttrs), the
     attribute `unsafeDiscardReferences` is an attribute set with a boolean value for each output name.
     If set to `true`, it disables scanning the output for runtime dependencies.
@@ -194,6 +205,7 @@ See the [corresponding section in the derivation output page](@docroot@/store/de
     [`builder`]: ./derivations.md#attr-builder
 
 - [`requiredSystemFeatures`]{#adv-attr-requiredSystemFeatures}\
+
   If a derivation has the `requiredSystemFeatures` attribute, then Nix will only build it on a machine that has the corresponding features set in its [`system-features` configuration](@docroot@/command-ref/conf-file.md#conf-system-features).
 
   For example, setting

doc/manual/source/language/evaluation.md

@@ -1,77 +0,0 @@
-# Evaluation
-
-Evaluation is the process of turning a Nix expression into a [Nix value](types.md).
-
-This happens by a number of rules, such as:
-- Constructing values from literals. 
-  For example the number literal `1` is turned into the number value `1`.
-- Applying operators
-  For example the addition operator `+` is applied to two number values to produce a new number value.
-- Applying built-in functions
-  For example the expression `builtins.isInt 1` is evaluated to `true`.
-- Applying user-defined functions
-  For example the expression `(x: x + 1) 10` can[*](#laziness) be thought of rewriting `x` in the function body to the argument, `10 + 1`, which is then evaluated to `11`.
-
-These rules are applied as needed, driven by the specific use of the expression. For example, this can occur in the Nix command line interface or interactively with the [repl (read-eval-print loop)](@docroot@/command-ref/new-cli/nix3-repl.md), which is a useful tool when learning about evaluation.
-
-# Details
-
-## Values {#values}
-
-Nix values can be thought of as a subset of Nix expressions.
-For example, the expression `1 + 2` is not a value, because it can be reduced to `3`. The expression `3` is a value, because it cannot be reduced any further.
-
-Evaluation normally happens by applying rules to the "head" of the expression, which is the outermost part of the expression. The head of an expression like `[ 1 2 ]` is the list literal (`[ a1 a2 ]`), for `1 + 2` it is the addition operator (`+`), and for `f 1` it is the function application "operator" (` `).
-
-After applying all possible rules to the head until no rules can be applied, the expression is in "weak head normal form" (WHNF). This means that the outermost constructor of the expression is evaluated, but the inner values may or may not be. "Weak" only signifies that the expression may be a function. This is an historical or academic artifact, and Nix has no use for the non-weak "head normal form".
-
-## Laziness and thunks {#laziness}
-
-The Nix language implements _call by need_ (as opposed to _call by value_ or _call by reference_). <!-- No wikipedia link, which would be a huge distraction. --> Call by need is commonly known as laziness in functional programming, as it is a specific implementation of the concept where evaluation is deferred until the result is required, aiming to only evaluate the parts of an expression that are needed to produce the final result.
-
-Furthermore, the result of evaluation is preserved, in values, in `let` bindings, in function _parameters_, which behave a lot like `let` bindings, but with the notable exception of function _calls_. Results of function calls rely on being put into `let` bindings, etc to be reused. <!-- which would be prohibitively expensive and too strict, or we wouldn't have a cache key for the argument -->
-
-When discussing the process of evaluation in lower level terms, we may define values not as a subset of expressions, but separately, where each "value" is either a data constructor, a function or a _thunk_. A thunk is a delayed computation, represented by an expression reference and a "closure" &ndash; the values for the lexical scope around the delayed expression.
-
-As a user of the language, you generally don't have to think about thunks, as they are not part of the language semantics, but you may encounter them in the repl, in the [C API] or in discussions.
-
-## Strictness
-
-Instead of thinking about thunks, it is often more productive to think in terms of _strictness_.
-This term is used in functional programming to refer to the opposite of laziness, i.e. not just for something like error propagation. It refers to the need to evaluate certain expressions before evaluation can produce any result.
-
-Statements about strictness usually implicitly refer to weak head normal form.
-For example, we can say that the following function is strict in its argument:
-
-```nix
-x: isAttrs x || isFunction x
-```
-
-The above function must be strict in its argument `x` because determining its type requires evaluating `x` to at least some degree.
-
-The following function is not strict in its argument:
-
-```nix
-x: { isOk = isAttrs x || isFunction x; }
-```
-
-It is not strict, because it can return the attribute set before evaluating `x`.
-The attribute value for `isOk` _is_ strict in `x`.
-
-A function with a _set pattern_ is always strict in its argument, as a consequence of checking the argument's type and/or attribute names:
-
-```nix
-let f = { ... }: "ok";
-in f (throw "kablam")
-=> error: kablam
-```
-
-However, a set pattern does not add any strictness beyond WHNF of the attribute set argument.
-
-```nix
-let f = orig@{ x, ... }: "ok";
-in f { x = throw "error"; y = throw "error"; }
-=> "ok"
-```
-
-[C API]: @docroot@/c-api.md

doc/manual/source/language/index.md

@@ -1,6 +1,6 @@
 # Nix Language
 
-The Nix language is designed for conveniently creating and composing [derivations](@docroot@/glossary.md#gloss-derivation) – precise descriptions of how contents of existing files are used to derive new files.
+The Nix language is designed for conveniently creating and composing *derivations* – precise descriptions of how contents of existing files are used to derive new files.
 
 > **Tip**
 >
@@ -11,14 +11,7 @@ The language is:
 
 - *domain-specific*
 
-  The Nix language is purpose-built for working with text files.
-  Its most characteristic features are:
-
-  - [File system path primitives](@docroot@/language/types.md#type-path), for accessing source files
-  - [Indented strings](@docroot@/language/string-literals.md) and [string interpolation](@docroot@/language/string-interpolation.md), for creating file contents
-  - [Strings with contexts](@docroot@/language/string-context.md), for transparently linking files
-
-  It comes with [built-in functions](@docroot@/language/builtins.md) to integrate with the [Nix store](@docroot@/store/index.md), which manages files and enables [realising](@docroot@/glossary.md#gloss-realise) derivations declared in the Nix language.
+  It comes with [built-in functions](@docroot@/language/builtins.md) to integrate with the Nix store, which manages files and performs the derivations declared in the Nix language.
 
 - *declarative*
 

doc/manual/source/language/meson.build

@@ -1,13 +1,19 @@
 builtins_md = custom_target(
-  command : [ python.full_path(), '@INPUT0@', '@OUTPUT@', '--' ] + nix_eval_for_docs + [
-    '--expr', '(builtins.readFile @INPUT3@) + import @INPUT1@ (builtins.fromJSON (builtins.readFile ./@INPUT2@)) + (builtins.readFile @INPUT4@)',
+  command : [
+    python.full_path(),
+    '@INPUT0@',
+    '@OUTPUT@',
+    '--'
+  ] + nix_eval_for_docs + [
+    '--expr',
+    '(builtins.readFile @INPUT3@) + import @INPUT1@ (builtins.fromJSON (builtins.readFile ./@INPUT2@)) + (builtins.readFile @INPUT4@)',
   ],
   input : [
     '../../remove_before_wrapper.py',
     '../../generate-builtins.nix',
     language_json,
     'builtins-prefix.md',
-    'builtins-suffix.md',
+    'builtins-suffix.md'
   ],
   output : 'builtins.md',
   env : nix_env_for_docs,

doc/manual/source/language/string-context.md

@@ -13,8 +13,8 @@ The purpose of string contexts is to collect non-string values attached to strin
 [string concatenation](./operators.md#string-concatenation),
 [string interpolation](./string-interpolation.md),
 and similar operations.
-The idea is that a user can reference other files when creating text files through Nix expressions, without manually keeping track of the exact paths.
-Nix will ensure that the all referenced files are accessible – that all [store paths](@docroot@/glossary.md#gloss-store-path) are [valid](@docroot@/glossary.md#gloss-validity).
+The idea is that a user can combine together values to create a build instructions for derivations without manually keeping track of where they come from.
+Then the Nix language implicitly does that bookkeeping to efficiently obtain the closure of derivation inputs.
 
 > **Note**
 >

doc/manual/source/language/syntax.md

@@ -225,8 +225,8 @@ passed in first , e.g.,
 
 ```nix
 let add = { __functor = self: x: x + self.x; };
-    inc = add // { x = 1; }; # inc is { x = 1; __functor = (...) }
-in inc 1 # equivalent of `add.__functor add 1` i.e. `1 + self.x`
+    inc = add // { x = 1; };
+in inc 1
 ```
 
 evaluates to `2`. This can be used to attach metadata to a function

doc/manual/source/meson.build

@@ -1,8 +1,7 @@
 summary_rl_next = custom_target(
   command : [
     bash,
-    '-euo',
-    'pipefail',
+    '-euo', 'pipefail',
     '-c',
     '''
       if [ -e "@INPUT@" ]; then
@@ -13,6 +12,6 @@ summary_rl_next = custom_target(
   input : [
     rl_next_generated,
   ],
-  capture : true,
+  capture: true,
   output : 'SUMMARY-rl-next.md',
 )

doc/manual/source/package-management/garbage-collector-roots.md

@@ -12,7 +12,7 @@ $ ln -s /nix/store/d718ef...-foo /nix/var/nix/gcroots/bar
 That is, after this command, the garbage collector will not remove
 `/nix/store/d718ef...-foo` or any of its dependencies.
 
-Subdirectories of `prefix/nix/var/nix/gcroots` are searched
-recursively. Symlinks to store paths count as roots. Symlinks to
-non-store paths are ignored, unless the non-store path is itself a
-symlink to a store path.
+Subdirectories of `prefix/nix/var/nix/gcroots` are also searched for
+symlinks. Symlinks to non-store paths are followed and searched for
+roots, but symlinks to non-store paths *inside* the paths reached in
+that way are not followed to prevent infinite recursion.

doc/manual/source/protocols/json/derivation.md

@@ -91,7 +91,3 @@ is a JSON object with the following fields:
 
 * `env`:
   The environment passed to the `builder`.
-
-* `structuredAttrs`:
-  [Strucutured Attributes](@docroot@/store/derivation/index.md#structured-attrs), only defined if the derivation contains them.
-  Structured attributes are JSON, and thus embedded as-is.

doc/manual/source/protocols/nix-archive.md

@@ -24,7 +24,7 @@ nar-obj-inner
   | str("type"), str("directory") directory
   ;
 
-regular = [ str("executable") ], str("contents"), str(contents);
+regular = [ str("executable"), str("") ], str("contents"), str(contents);
 
 symlink = str("target"), str(target);
 

doc/manual/source/release-notes/rl-2.24.md

@@ -269,7 +269,7 @@
   e.g. `--warn-large-path-threshold 100M`.
 
 
-## Contributors
+# Contributors
 
 This release was made possible by the following 43 contributors:
 

doc/manual/source/release-notes/rl-2.25.md

@@ -77,7 +77,7 @@
   `<nix/fetchurl.nix>` is also known as the builtin derivation builder `builtin:fetchurl`. It's not to be confused with the evaluation-time function `builtins.fetchurl`, which was not affected by this issue.
 
 
-## Contributors
+# Contributors
 
 This release was made possible by the following 58 contributors:
 

doc/manual/source/release-notes/rl-2.26.md

@@ -76,7 +76,7 @@
 
 - Evaluation caching now works for dirty Git workdirs [#11992](https://github.com/NixOS/nix/pull/11992)
 
-## Contributors
+# Contributors
 
 This release was made possible by the following 45 contributors:
 

doc/manual/source/release-notes/rl-2.27.md

@@ -47,7 +47,7 @@
   blake3-34P4p+iZXcbbyB1i4uoF7eWCGcZHjmaRn6Y7QdynLwU=
   ```
 
-## Contributors
+# Contributors
 
 This release was made possible by the following 21 contributors:
 

doc/manual/source/release-notes/rl-2.28.md

@@ -82,7 +82,7 @@ This completes the infrastructure overhaul for the [RFC 132](https://github.com/
   Although this change is not as critical, we figured it would be good to do this API change at the same time, also.
   Also note that we try to keep the C API compatible, but we decided to break this function because it was young and likely not in widespread use yet. This frees up time to make important progress on the rest of the C API.
 
-## Contributors
+# Contributors
 
 This earlier-than-usual release was made possible by the following 16 contributors:
 

doc/manual/source/release-notes/rl-2.29.md

@@ -1,160 +0,0 @@
-# Release 2.29.0 (2025-05-14)
-
-After the special backport-based release of Nix 2.28 (timed to coincide with Nixpkgs 25.05), the release process is back to normal with 2.29.
-As such, we have slightly more weeks of work from `master` (since 2.28 was branched from 2.27) than usual.
-This fact is counterbalanced by the fact that most of those changes are bug fixes rather than larger new features.
-
-- Prettified JSON output on the terminal [#12555](https://github.com/NixOS/nix/issues/12555) [#12652](https://github.com/NixOS/nix/pull/12652)
-
-  This makes the output easier to read.
-
-  Scripts are mostly unaffected because for those, stdout will be a file or a pipe, not a terminal, and for those, the old single-line behavior applies.
-
-  `--json --pretty` can be passed to enable it even if the output is not a terminal.
-  If your script creates a pseudoterminal for Nix's stdout, you can pass `--no-pretty` to disable the new behavior.
-
-- Repl: improve continuation prompt for incomplete expressions [#12846](https://github.com/NixOS/nix/pull/12846)
-
-  Improved REPL user experience by updating the continuation prompt from invisible blank spaces to a visible `" > "`, enhancing clarity when entering multi-line expressions.
-
-- REPL `:load-flake` and `:reload` now work together [#8753](https://github.com/NixOS/nix/issues/8753) [#13180](https://github.com/NixOS/nix/pull/13180)
-
-  Previously, `:reload` only reloaded the files specified with `:load` (or on the command line).
-  Now, it also works with the flakes specified with `:load-flake` (or on the command line).
-  This makes it correctly reload everything that was previously loaded, regardless of what sort of thing (plain file or flake) each item is.
-
-- Increase retry delays on HTTP 429 Too Many Requests [#13052](https://github.com/NixOS/nix/pull/13052)
-
-  When downloading Nix, the retry delay was previously set to 0.25 seconds. It has now been increased to 1 minute to better handle transient CI errors, particularly on GitHub.
-
-- S3: opt-in the STSProfileCredentialsProvider [#12646](https://github.com/NixOS/nix/pull/12646)
-
-  Added support for STS-based authentication for S3-based binary caches, i.e. enabling seamless integration with `aws sso login`.
-
-- Reduce connect timeout for http substituter [#12876](https://github.com/NixOS/nix/pull/12876)
-
-  Previously, the Nix setting `connect-timeout` had no limit. It is now set to `5s`, offering a more practical default for users self-hosting binary caches, which may occasionally become unavailable, such as during updates.
-
-
-- C API: functions for locking and loading a flake [#10435](https://github.com/NixOS/nix/issues/10435) [#12877](https://github.com/NixOS/nix/pull/12877) [#13098](https://github.com/NixOS/nix/pull/13098)
-
-  This release adds functions to the C API for handling the loading of flakes. Previously, this had to be worked around by using `builtins.getFlake`.
-  C API consumers and language bindings now have access to basic locking functionality.
-
-  It does not expose the full locking API, so that the implementation can evolve more freely.
-  Locking is controlled with the functions, which cover the common use cases for consuming a flake:
-  - `nix_flake_lock_flags_set_mode_check`
-  - `nix_flake_lock_flags_set_mode_virtual`
-  - `nix_flake_lock_flags_set_mode_write_as_needed`
-  - `nix_flake_lock_flags_add_input_override`, which also enables `virtual`
-
-  This change also introduces the new `nix-fetchers-c` library, whose single purpose for now is to manage the (`nix.conf`) settings for the built-in fetchers.
-
-  More details can be found in the [C API documentation](@docroot@/c-api.md).
-
-- No longer copy flakes that are in the nix store [#10435](https://github.com/NixOS/nix/issues/10435) [#12877](https://github.com/NixOS/nix/pull/12877) [#13098](https://github.com/NixOS/nix/pull/13098)
-
-  Previously, we would duplicate entries like `path:/nix/store/*` back into the Nix store.
-  This was prominently visible for pinned system flake registry entries in NixOS, e.g., when running `nix run nixpkgs#hello`.
-
-- Consistently preserve error messages from cached evaluation [#12762](https://github.com/NixOS/nix/issues/12762) [#12809](https://github.com/NixOS/nix/pull/12809)
-
-  In one code path, we are not returning the errors cached from prior evaluation, but instead throwing generic errors stemming from the lack of value (due to the error).
-  These generic error messages were far less informative.
-  Now we consistently return the original error message.
-
-- Faster blake3 hashing [#12676](https://github.com/NixOS/nix/pull/12676)
-
-  The implementation for blake3 hashing is now multi-threaded and used memory-mapped IO.
-  Benchmark results can be found the [pull request](https://github.com/NixOS/nix/pull/12676).
-
-- Fix progress bar for S3 binary caches and make file transfers interruptible [#12877](https://github.com/NixOS/nix/issues/12877) [#13098](https://github.com/NixOS/nix/issues/13098) [#12538](https://github.com/NixOS/nix/pull/12538)
-
-  The progress bar now correctly display upload/download progress for S3 up/downloads. S3 uploads are now interruptible.
-
-- Add host attribute of github/gitlab flakerefs to URL serialization [#12580](https://github.com/NixOS/nix/pull/12580)
-
-  Resolved an issue where `github:` or `gitlab:` URLs lost their `host` attribute when written to a lockfile, resulting in invalid URLs.
-
-- Multiple signatures support in store urls [#12976](https://github.com/NixOS/nix/pull/12976)
-
-  Added support for a `secretKeyFiles` URI parameter in Nix store URIs, allowing multiple signing key files to be specified as a comma-separated list.
-  This enables signing paths with multiple keys. This helps with [RFC #149](https://github.com/NixOS/rfcs/pull/149) to enable binary cache key rotation in the NixOS infra.
-
-  Example usage:
-
-  ```bash
-  nix copy --to "file:///tmp/store?secret-keys=/tmp/key1,/tmp/key2" \
-    "$(nix build --print-out-paths nixpkgs#hello)"
-  ```
-
-- nix flake show now skips over import-from-derivation [#4265](https://github.com/NixOS/nix/issues/4265) [#12583](https://github.com/NixOS/nix/pull/12583)
-
-  Previously, if a flake contained outputs relying on [import from derivation](@docroot@/language/import-from-derivation.md) during evaluation, `nix flake show` would fail to display the rest of the flake. The updated behavior skips such outputs, allowing the rest of the flake to be shown.
-
-- Add `nix formatter build` and `nix formatter run` commands [#13063](https://github.com/NixOS/nix/pull/13063)
-
-  `nix formatter run` is an alias for `nix fmt`. Nothing new there.
-
-  `nix formatter build` is sort of like `nix build`: it builds, links, and prints a path to the formatter program:
-
-  ```
-  $ nix formatter build
-  /nix/store/cb9w44vkhk2x4adfxwgdkkf5gjmm856j-treefmt/bin/treefmt
-  ```
-
-  Note that unlike `nix build`, this prints the full path to the program, not just the store path (in the example above that would be `/nix/store/cb9w44vkhk2x4adfxwgdkkf5gjmm856j-treefmt`).
-
-- Amend OSC 8 escape stripping for xterm-style separator [#13109](https://github.com/NixOS/nix/pull/13109)
-
-  Improve terminal escape code filtering to understand a second type of hyperlink escape codes.
-  This in particular prevents parts of GCC 14's diagnostics from being improperly filtered away.
-
-
-## Contributors
-
-
-This release was made possible by the following 40 contributors:
-
-- Farid Zakaria [**(@fzakaria)**](https://github.com/fzakaria)
-- The Tumultuous Unicorn Of Darkness [**(@TheTumultuousUnicornOfDarkness)**](https://github.com/TheTumultuousUnicornOfDarkness)
-- Robert Hensing [**(@roberth)**](https://github.com/roberth)
-- Félix [**(@picnoir)**](https://github.com/picnoir)
-- Valentin Gagarin [**(@fricklerhandwerk)**](https://github.com/fricklerhandwerk)
-- Eelco Dolstra [**(@edolstra)**](https://github.com/edolstra)
-- Vincent Breitmoser [**(@Valodim)**](https://github.com/Valodim)
-- Brian McKenna [**(@puffnfresh)**](https://github.com/puffnfresh)
-- ulucs [**(@ulucs)**](https://github.com/ulucs)
-- John Ericson [**(@Ericson2314)**](https://github.com/Ericson2314)
-- Andrey Butirsky [**(@bam80)**](https://github.com/bam80)
-- Dean De Leo [**(@whatsthecraic)**](https://github.com/whatsthecraic)
-- Las Safin [**(@L-as)**](https://github.com/L-as)
-- Sergei Zimmerman [**(@xokdvium)**](https://github.com/xokdvium)
-- Shahar "Dawn" Or [**(@mightyiam)**](https://github.com/mightyiam)
-- Ryan Hendrickson [**(@rhendric)**](https://github.com/rhendric)
-- Rodney Lorrimar [**(@rvl)**](https://github.com/rvl)
-- Erik Nygren [**(@Kirens)**](https://github.com/Kirens)
-- Cole Helbling [**(@cole-h)**](https://github.com/cole-h)
-- Martin Fischer [**(@not-my-profile)**](https://github.com/not-my-profile)
-- Graham Christensen [**(@grahamc)**](https://github.com/grahamc)
-- Vit Gottwald [**(@VitGottwald)**](https://github.com/VitGottwald)
-- silvanshade [**(@silvanshade)**](https://github.com/silvanshade)
-- Illia Bobyr [**(@ilya-bobyr)**](https://github.com/ilya-bobyr)
-- Jeremy Fleischman [**(@jfly)**](https://github.com/jfly)
-- Ruby Rose [**(@oldshensheep)**](https://github.com/oldshensheep)
-- Sergei Trofimovich [**(@trofi)**](https://github.com/trofi)
-- Tim [**(@Jaculabilis)**](https://github.com/Jaculabilis)
-- Anthony Wang [**(@anthowan)**](https://github.com/anthowan)
-- Jörg Thalheim [**(@Mic92)**](https://github.com/Mic92)
-- Sandro [**(@SuperSandro2000)**](https://github.com/SuperSandro2000)
-- tomberek [**(@tomberek)**](https://github.com/tomberek)
-- Dmitry Bogatov [**(@KAction)**](https://github.com/KAction)
-- Sizhe Zhao [**(@Prince213)**](https://github.com/Prince213)
-- jade [**(@lf-)**](https://github.com/lf-)
-- Pierre-Etienne Meunier [**(@P-E-Meunier)**](https://github.com/P-E-Meunier)
-- Alexander Romanov [**(@ajlekcahdp4)**](https://github.com/ajlekcahdp4)
-- Domagoj Mišković [**(@allrealmsoflife)**](https://github.com/allrealmsoflife)
-- Thomas Miedema [**(@thomie)**](https://github.com/thomie)
-- Yannik Sander [**(@ysndr)**](https://github.com/ysndr)
-- Philipp Otterbein
-- Dmitry Bogatov

doc/manual/source/release-notes/rl-2.30.md

@@ -1,153 +0,0 @@
-# Release 2.30.0 (2025-07-07)
-
-## Backward-incompatible changes and deprecations
-
-- [`build-dir`] no longer defaults to `$TMPDIR`
-
-  The directory in which temporary build directories are created no longer defaults
-  to `TMPDIR` or `/tmp`, to avoid builders making their directories
-  world-accessible. This behavior allowed escaping the build sandbox and can
-  cause build impurities even when not used maliciously. We now default to `builds`
-  in `NIX_STATE_DIR` (which is `/nix/var/nix/builds` in the default configuration).
-
-- Deprecate manually making structured attrs using the `__json` attribute [#13220](https://github.com/NixOS/nix/pull/13220)
-
-  The proper way to create a derivation using [structured attrs] in the Nix language is by using `__structuredAttrs = true` with [`builtins.derivation`].
-  However, by exploiting how structured attrs are implementated, it has also been possible to create them by setting the `__json` environment variable to a serialized JSON string.
-  This sneaky alternative method is now deprecated, and may be disallowed in future versions of Nix.
-
-  [structured attrs]: @docroot@/language/advanced-attributes.md#adv-attr-structuredAttrs
-  [`builtins.derivation`]: @docroot@/language/builtins.html#builtins-derivation
-
-- Rename `nix profile install` to [`nix profile add`] [#13224](https://github.com/NixOS/nix/pull/13224)
-
-  The command `nix profile install` has been renamed to [`nix profile add`] (though the former is still available as an alias). This is because the verb "add" is a better antonym for the verb "remove" (i.e. `nix profile remove`). Nix also does not have install hooks or general behavior often associated with "installing".
-
-## Performance improvements
-
-This release has a number performance improvements, in particular:
-
-- Reduce the size of value from 24 to 16 bytes [#13407](https://github.com/NixOS/nix/pull/13407)
-
-  This shaves off a very significant amount of memory used for evaluation (~20% percent reduction in maximum heap size and ~17% in total bytes).
-
-## Features
-
-- Add [stack sampling evaluation profiler] [#13220](https://github.com/NixOS/nix/pull/13220)
-
-  The Nix evaluator now supports [stack sampling evaluation profiling](@docroot@/advanced-topics/eval-profiler.md) via the [`--eval-profiler flamegraph`] setting.
-  It outputs collapsed call stack information to the file specified by
-  [`--eval-profile-file`] (`nix.profile` by default) in a format directly consumable
-  by `flamegraph.pl` and compatible tools like [speedscope](https://speedscope.app/).
-  Sampling frequency can be configured via [`--eval-profiler-frequency`] (99 Hz by default).
-
-  Unlike the existing [`--trace-function-calls`], this profiler includes the name of the function
-  being called when it's available.
-
-- [`nix repl`] prints which variables were loaded [#11406](https://github.com/NixOS/nix/pull/11406)
-
-  Instead of `Added <n> variables` it now prints the first 10 variables that were added to the global scope.
-
-- `nix flake archive`: Add [`--no-check-sigs`] option [#13277](https://github.com/NixOS/nix/pull/13277)
-
-  This is useful when using [`nix flake archive`] with the destination set to a remote store.
-
-- Emit warnings for IFDs with [`trace-import-from-derivation`] option [#13279](https://github.com/NixOS/nix/pull/13279)
-
-  While we have the setting [`allow-import-from-derivation`] to deny import-from-derivation (IFD), sometimes users would like to observe IFDs during CI processes to gradually phase out the idiom. The new setting `trace-import-from-derivation`, when set, logs a simple warning to the console.
-
-- `json-log-path` setting [#13003](https://github.com/NixOS/nix/pull/13003)
-
-  New setting [`json-log-path`] that sends a copy of all Nix log messages (in JSON format) to a file or Unix domain socket.
-
-- Non-flake inputs now contain a `sourceInfo` attribute [#13164](https://github.com/NixOS/nix/issues/13164) [#13170](https://github.com/NixOS/nix/pull/13170)
-
-  Flakes have always had a `sourceInfo` attribute which describes the source of the flake.
-  The `sourceInfo.outPath` is often identical to the flake's `outPath`. However, it can differ when the flake is located in a subdirectory of its source.
-
-  Non-flake inputs (i.e. inputs with [`flake = false`]) can also be located at some path _within_ a wider source.
-  This usually happens when defining a relative path input within the same source as the parent flake, e.g. `inputs.foo.url = ./some-file.nix`.
-  Such relative inputs will now inherit their parent's `sourceInfo`.
-
-  This also means it is now possible to use `?dir=subdir` on non-flake inputs.
-
-  This iterates on the work done in 2.26 to improve relative path support ([#10089](https://github.com/NixOS/nix/pull/10089)),
-  and resolves a regression introduced in 2.28 relating to nested relative path inputs ([#13164](https://github.com/NixOS/nix/issues/13164)).
-
-## Miscellaneous changes
-
-- [`builtins.sort`] uses PeekSort [#12623](https://github.com/NixOS/nix/pull/12623)
-
-  Previously it used libstdc++'s `std::stable_sort()`. However, that implementation is not reliable if the user-supplied comparison function is not a strict weak ordering.
-
-- Revert incomplete closure mixed download and build feature [#77](https://github.com/NixOS/nix/issues/77) [#12628](https://github.com/NixOS/nix/issues/12628) [#13176](https://github.com/NixOS/nix/pull/13176)
-
-  Since Nix 1.3 ([commit `299141e`] in 2013) Nix has attempted to mix together upstream fresh builds and downstream substitutions when remote substuters contain an "incomplete closure" (have some store objects, but not the store objects they reference).
-  This feature is now removed.
-
-  In the worst case, removing this feature could cause more building downstream, but it should not cause outright failures, since this is not happening for opaque store objects that we don't know how to build if we decide not to substitute.
-  In practice, however, we doubt even more building is very likely to happen.
-  Remote stores that are missing dependencies in arbitrary ways (e.g. corruption) don't seem to be very common.
-
-  On the contrary, when remote stores fail to implement the [closure property](@docroot@/store/store-object.md#closure-property), it is usually an *intentional* choice on the part of the remote store, because it wishes to serve as an "overlay" store over another store, such as `https://cache.nixos.org`.
-  If an "incomplete closure" is encountered in that situation, the right fix is not to do some sort of "franken-building" as this feature implemented, but instead to make sure both substituters are enabled in the settings.
-
-  (In the future, we should make it easier for remote stores to indicate this to clients, to catch settings that won't work in general before a missing dependency is actually encountered.)
-
-## Contributors
-
-This release was made possible by the following 32 contributors:
-
-- Cole Helbling [**(@cole-h)**](https://github.com/cole-h)
-- Eelco Dolstra [**(@edolstra)**](https://github.com/edolstra)
-- Egor Konovalov [**(@egorkonovalov)**](https://github.com/egorkonovalov)
-- Farid Zakaria [**(@fzakaria)**](https://github.com/fzakaria)
-- Graham Christensen [**(@grahamc)**](https://github.com/grahamc)
-- gustavderdrache [**(@gustavderdrache)**](https://github.com/gustavderdrache)
-- Gwenn Le Bihan [**(@gwennlbh)**](https://github.com/gwennlbh)
-- h0nIg [**(@h0nIg)**](https://github.com/h0nIg)
-- Jade Masker [**(@donottellmetonottellyou)**](https://github.com/donottellmetonottellyou)
-- jayeshv [**(@jayeshv)**](https://github.com/jayeshv)
-- Jeremy Fleischman [**(@jfly)**](https://github.com/jfly)
-- John Ericson [**(@Ericson2314)**](https://github.com/Ericson2314)
-- Jonas Chevalier [**(@zimbatm)**](https://github.com/zimbatm)
-- Jörg Thalheim [**(@Mic92)**](https://github.com/Mic92)
-- kstrafe [**(@kstrafe)**](https://github.com/kstrafe)
-- Luc Perkins [**(@lucperkins)**](https://github.com/lucperkins)
-- Matt Sturgeon [**(@MattSturgeon)**](https://github.com/MattSturgeon)
-- Nikita Krasnov [**(@synalice)**](https://github.com/synalice)
-- Peder Bergebakken Sundt [**(@pbsds)**](https://github.com/pbsds)
-- pennae [**(@pennae)**](https://github.com/pennae)
-- Philipp Otterbein
-- Pol Dellaiera [**(@drupol)**](https://github.com/drupol)
-- PopeRigby [**(@poperigby)**](https://github.com/poperigby)
-- Raito Bezarius
-- Robert Hensing [**(@roberth)**](https://github.com/roberth)
-- Samuli Thomasson [**(@SimSaladin)**](https://github.com/SimSaladin)
-- Sergei Zimmerman [**(@xokdvium)**](https://github.com/xokdvium)
-- Seth Flynn [**(@getchoo)**](https://github.com/getchoo)
-- Stefan Boca [**(@stefanboca)**](https://github.com/stefanboca)
-- tomberek [**(@tomberek)**](https://github.com/tomberek)
-- Tristan Ross [**(@RossComputerGuy)**](https://github.com/RossComputerGuy)
-- Valentin Gagarin [**(@fricklerhandwerk)**](https://github.com/fricklerhandwerk)
-- Vladimír Čunát [**(@vcunat)**](https://github.com/vcunat)
-- Wolfgang Walther [**(@wolfgangwalther)**](https://github.com/wolfgangwalther)
-
-<!-- markdown links -->
-[stack sampling evaluation profiler]: @docroot@/advanced-topics/eval-profiler.md
-[`--eval-profiler`]: @docroot@/command-ref/conf-file.md#conf-eval-profiler
-[`--eval-profiler flamegraph`]: @docroot@/command-ref/conf-file.md#conf-eval-profiler
-[`--trace-function-calls`]: @docroot@/command-ref/conf-file.md#conf-trace-function-calls
-[`--eval-profile-file`]: @docroot@/command-ref/conf-file.md#conf-eval-profile-file
-[`--eval-profiler-frequency`]: @docroot@/command-ref/conf-file.md#conf-eval-profiler-frequency
-[`build-dir`]: @docroot@/command-ref/conf-file.md#conf-build-dir
-[`nix profile add`]: @docroot@/command-ref/new-cli/nix3-profile-add.md
-[`nix repl`]: @docroot@/command-ref/new-cli/nix3-repl.md
-[`nix flake archive`]: @docroot@/command-ref/new-cli/nix3-flake-archive.md
-[`json-log-path`]: @docroot@/command-ref/conf-file.md#conf-json-log-path
-[`trace-import-from-derivation`]: @docroot@/command-ref/conf-file.md#conf-trace-import-from-derivation
-[`allow-import-from-derivation`]: @docroot@/command-ref/conf-file.md#conf-allow-import-from-derivation
-[`builtins.sort`]: @docroot@/language/builtins.md#builtins-sort
-[`flake = false`]: @docroot@/command-ref/new-cli/nix3-flake.md?highlight=false#flake-inputs
-[`--no-check-sigs`]: @docroot@/command-ref/new-cli/nix3-flake-archive.md#opt-no-check-sigs
-[commit `299141e`]: https://github.com/NixOS/nix/commit/299141ecbd08bae17013226dbeae71e842b4fdd7

doc/manual/source/release-notes/rl-2.31.md

@@ -1,96 +0,0 @@
-# Release 2.31.0 (2025-08-21)
-
-- `build-cores = 0` now auto-detects CPU cores [#13402](https://github.com/NixOS/nix/pull/13402)
-
-  When `build-cores` is set to `0`, Nix now automatically detects the number of available CPU cores and passes this value via `NIX_BUILD_CORES`, instead of passing `0` directly. This matches the behavior when `build-cores` is unset. This prevents the builder from having to detect the number of cores.
-
-- Fix Git LFS SSH issues [#13337](https://github.com/NixOS/nix/issues/13337) [#13743](https://github.com/NixOS/nix/pull/13743)
-
-  Fixed some outstanding issues with Git LFS and SSH.
-
-  * Added support for `NIX_SSHOPTS`.
-  * Properly use the parsed port from URL.
-  * Better use of the response of `git-lfs-authenticate` to determine API endpoint when the API is not exposed on port 443.
-
-- Add support for `user@address:port` syntax in store URIs [#7044](https://github.com/NixOS/nix/issues/7044) [#3425](https://github.com/NixOS/nix/pull/3425)
-
-  It's now possible to specify the port used for SSH stores directly in the store URL in accordance with [RFC3986](https://datatracker.ietf.org/doc/html/rfc3986). Previously the only way to specify custom ports was via `ssh_config` or the `NIX_SSHOPTS` environment variable, because Nix incorrectly passed the port number together with the host name to the SSH executable.
-
-  This change affects [store references](@docroot@/store/types/index.md#store-url-format) passed via the `--store` and similar flags in CLI as well as in the configuration for [remote builders](@docroot@/command-ref/conf-file.md#conf-builders). For example, the following store URIs now work:
-
-  - `ssh://127.0.0.1:2222`
-  - `ssh://[b573:6a48:e224:840b:6007:6275:f8f7:ebf3]:22`
-  - `ssh-ng://[b573:6a48:e224:840b:6007:6275:f8f7:ebf3]:22`
-
-- Represent IPv6 RFC4007 ZoneId literals in conformance with RFC6874 [#13445](https://github.com/NixOS/nix/pull/13445)
-
-  Prior versions of Nix since [#4646](https://github.com/NixOS/nix/pull/4646) accepted [IPv6 scoped addresses](https://datatracker.ietf.org/doc/html/rfc4007) in URIs like [store references](@docroot@/store/types/index.md#store-url-format) in the textual representation with a literal percent character: `[fe80::1%18]`. This was ambiguous, because the the percent literal `%` is reserved by [RFC3986](https://datatracker.ietf.org/doc/html/rfc3986), since it's used to indicate percent encoding. Nix now requires that the percent `%` symbol is percent-encoded as `%25`. This implements [RFC6874](https://datatracker.ietf.org/doc/html/rfc6874), which defines the representation of zone identifiers in URIs. The example from above now has to be specified as `[fe80::1%2518]`.
-
-- Use WAL mode for SQLite cache databases [#13800](https://github.com/NixOS/nix/pull/13800)
-
-  Previously, Nix used SQLite's "truncate" mode for caches. However, this could cause a Nix process to block if another process was updating the cache. This was a problem for the flake evaluation cache in particular, since it uses long-running transactions. Thus, concurrent Nix commands operating on the same flake could be blocked for an unbounded amount of time. WAL mode avoids this problem.
-
-  This change required updating the versions of the SQLite caches. For instance, `eval-cache-v5.sqlite` is now `eval-cache-v6.sqlite`.
-
-- Enable parallel marking in bdwgc [#13708](https://github.com/NixOS/nix/pull/13708)
-
-  Previously marking was done by only one thread, which takes a long time if the heap gets big. Enabling parallel marking speeds up evaluation a lot, for example (on a Ryzen 9 5900X 12-Core):
-
-  * `nix search nixpkgs` from 24.3s to 18.9s.
-  * Evaluating the `NixOS/nix/2.21.2` flake regression test from 86.1s to 71.2s.
-
-- New command `nix flake prefetch-inputs` [#13565](https://github.com/NixOS/nix/pull/13565)
-
-  This command fetches all inputs of a flake in parallel. This can be a lot faster than the serialized on-demand fetching during regular flake evaluation. The downside is that it may fetch inputs that aren't normally used.
-
-- Add `warn-short-path-literals` setting [#13489](https://github.com/NixOS/nix/pull/13489)
-
-  This setting, when enabled, causes Nix to emit warnings when encountering relative path literals that don't start with `.` or `/`, for instance suggesting that `foo/bar` should be rewritten to `./foo/bar`.
-
-- When updating a lock, respect the input's lock file [#13437](https://github.com/NixOS/nix/pull/13437)
-
-  For example, if a flake has a lock for `a` and `a/b`, and we change the flakeref for `a`, previously Nix would fetch the latest version of `b` rather than using the lock for `b` from `a`.
-
-- Implement support for Git hashing with SHA-256 [#13543](https://github.com/NixOS/nix/pull/13543)
-
-  The experimental support for [Git-hashing](@docroot@/development/experimental-features.md#xp-feature-git-hashing) store objects now also includes support for SHA-256, not just SHA-1, in line with upstream Git.
-
-## Contributors
-
-This release was made possible by the following 34 contributors:
-
-- John Soo [**(@jsoo1)**](https://github.com/jsoo1)
-- Alan Urmancheev [**(@alurm)**](https://github.com/alurm)
-- Manse [**(@PedroManse)**](https://github.com/PedroManse)
-- Pol Dellaiera [**(@drupol)**](https://github.com/drupol)
-- DavHau [**(@DavHau)**](https://github.com/DavHau)
-- Leandro Emmanuel Reina Kiperman [**(@kip93)**](https://github.com/kip93)
-- h0nIg [**(@h0nIg)**](https://github.com/h0nIg)
-- Philip Taron [**(@philiptaron)**](https://github.com/philiptaron)
-- Eelco Dolstra [**(@edolstra)**](https://github.com/edolstra)
-- Connor Baker [**(@ConnorBaker)**](https://github.com/ConnorBaker)
-- kenji [**(@a-kenji)**](https://github.com/a-kenji)
-- Oleksandr Knyshuk [**(@k1gen)**](https://github.com/k1gen)
-- Maciej Krüger [**(@mkg20001)**](https://github.com/mkg20001)
-- Justin Bailey [**(@jgbailey-well)**](https://github.com/jgbailey-well)
-- Emily [**(@emilazy)**](https://github.com/emilazy)
-- Volker Diels-Grabsch [**(@vog)**](https://github.com/vog)
-- gustavderdrache [**(@gustavderdrache)**](https://github.com/gustavderdrache)
-- Elliot Cameron [**(@de11n)**](https://github.com/de11n)
-- Alexander V. Nikolaev [**(@avnik)**](https://github.com/avnik)
-- tomberek [**(@tomberek)**](https://github.com/tomberek)
-- Matthew Kenigsberg [**(@mkenigs)**](https://github.com/mkenigs)
-- Sergei Zimmerman [**(@xokdvium)**](https://github.com/xokdvium)
-- Cosima Neidahl [**(@OPNA2608)**](https://github.com/OPNA2608)
-- John Ericson [**(@Ericson2314)**](https://github.com/Ericson2314)
-- m4dc4p [**(@m4dc4p)**](https://github.com/m4dc4p)
-- Graham Christensen [**(@grahamc)**](https://github.com/grahamc)
-- Jason Yundt [**(@Jayman2000)**](https://github.com/Jayman2000)
-- Jens Petersen [**(@juhp)**](https://github.com/juhp)
-- the-sun-will-rise-tomorrow [**(@the-sun-will-rise-tomorrow)**](https://github.com/the-sun-will-rise-tomorrow)
-- Farid Zakaria [**(@fzakaria)**](https://github.com/fzakaria)
-- AGawas [**(@aln730)**](https://github.com/aln730)
-- Robert Hensing [**(@roberth)**](https://github.com/roberth)
-- Dmitry Bogatov [**(@KAction)**](https://github.com/KAction)
-- Jörg Thalheim [**(@Mic92)**](https://github.com/Mic92)
-- Philipp Otterbein

doc/manual/source/release-notes/rl-2.8.md

@@ -48,6 +48,6 @@
 
 * `nix run` is now stricter in what it accepts: members of the `apps`
   flake output are now required to be apps (as defined in [the
-  manual](https://nix.dev/manual/nix/stable/command-ref/new-cli/nix3-run.html#apps)),
+  manual](https://nixos.org/manual/nix/stable/command-ref/new-cli/nix3-run.html#apps)),
   and members of `packages` or `legacyPackages` must be derivations
   (not apps).

doc/manual/source/store/derivation/index.md

@@ -9,7 +9,7 @@ This is where Nix distinguishes itself.
 
 ## Store Derivation {#store-derivation}
 
-A derivation is a specification for running an executable on precisely defined input to produce one or more [store objects][store object].
+A derivation is a specification for running an executable on precisely defined input to produce on more [store objects][store object].
 These store objects are known as the derivation's *outputs*.
 
 Derivations are *built*, in which case the process is spawned according to the spec, and when it exits, required to leave behind files which will (after post-processing) become the outputs of the derivation.
@@ -138,17 +138,6 @@ See [Wikipedia](https://en.wikipedia.org/wiki/Argv) for details.
 
 Environment variables which will be passed to the [builder](#builder) executable.
 
-#### Structured Attributes {#structured-attrs}
-
-Nix also has special support for embedding JSON in the derivations.
-
-The environment variable `NIX_ATTRS_JSON_FILE` points to the exact location of that file both in a build and a [`nix-shell`](@docroot@/command-ref/nix-shell.md).
-
-As a convenience to Bash builders, Nix writes a script that initialises shell variables corresponding to all attributes that are representable in Bash.
-The environment variable `NIX_ATTRS_SH_FILE` points to the exact location of the script, both in a build and a [`nix-shell`](@docroot@/command-ref/nix-shell.md).
-This includes non-nested (associative) arrays.
-For example, the attribute `hardening.format = true` ends up as the Bash associative array element `${hardening[format]}`.
-
 ### Placeholders
 
 Placeholders are opaque values used within the [process creation fields] to [store objects] for which we don't yet know [store path]s.

doc/manual/source/store/meson.build

@@ -1,6 +1,12 @@
 types_dir = custom_target(
-  command : [ python.full_path(), '@INPUT0@', '@OUTPUT@', '--' ] + nix_eval_for_docs + [
-    '--expr', 'import @INPUT1@ (builtins.fromJSON (builtins.readFile ./@INPUT2@)).stores',
+  command : [
+    python.full_path(),
+    '@INPUT0@',
+    '@OUTPUT@',
+    '--'
+  ] + nix_eval_for_docs + [
+    '--expr',
+    'import @INPUT1@ (builtins.fromJSON (builtins.readFile ./@INPUT2@)).stores',
   ],
   input : [
     '../../remove_before_wrapper.py',

doc/manual/source/store/store-object.md

@@ -18,19 +18,19 @@ In particular, the edge corresponding to a reference is from the store object th
 References other than a self-reference must not form a cycle.
 The graph of references excluding self-references thus forms a [directed acyclic graph].
 
-[directed acyclic graph]: @docroot@/glossary.md#gloss-directed-acyclic-graph
+[directed acyclic graph]: @docroot@/glossary.md#gloss-directed acyclic graph
 
 We can take the [transitive closure] of the references graph, which any pair of store objects have an edge not if there is a single reference from the first to the second, but a path of one or more references from the first to the second.
 The *requisites* of a store object are all store objects reachable by paths of references which start with given store object's references.
 
 [transitive closure]: https://en.wikipedia.org/wiki/Transitive_closure
 
-We can also take the [transpose graph] of the references graph, where we reverse the orientation of all edges.
+We can also take the [transpose graph] ofthe references graph, where we reverse the orientation of all edges.
 The *referrers* of a store object are the store objects that reference it.
 
 [transpose graph]: https://en.wikipedia.org/wiki/Transpose_graph
 
-One can also combine both concepts: taking the transitive closure of the transposed references graph.
+One can also combine both concepts: taking the transitive closure of the tranposed references graph.
 The *referrers closure* of a store object are the store objects that can reach the given store object via paths of references.
 
 > **Note**

docker.nix

@@ -1,78 +1,48 @@
 {
-  # Core dependencies
   pkgs ? import <nixpkgs> { },
   lib ? pkgs.lib,
-  dockerTools ? pkgs.dockerTools,
-  runCommand ? pkgs.runCommand,
-  buildPackages ? pkgs.buildPackages,
-  # Image configuration
   name ? "nix",
   tag ? "latest",
   bundleNixpkgs ? true,
   channelName ? "nixpkgs",
   channelURL ? "https://nixos.org/channels/nixpkgs-unstable",
   extraPkgs ? [ ],
-  maxLayers ? 70,
+  maxLayers ? 100,
   nixConf ? { },
   flake-registry ? null,
   uid ? 0,
   gid ? 0,
   uname ? "root",
   gname ? "root",
-  Labels ? {
-    "org.opencontainers.image.title" = "Nix";
-    "org.opencontainers.image.source" = "https://github.com/NixOS/nix";
-    "org.opencontainers.image.vendor" = "Nix project";
-    "org.opencontainers.image.version" = nix.version;
-    "org.opencontainers.image.description" = "Nix container image";
-  },
-  Cmd ? [ (lib.getExe bashInteractive) ],
-  # Default Packages
-  nix ? pkgs.nix,
-  bashInteractive ? pkgs.bashInteractive,
-  coreutils-full ? pkgs.coreutils-full,
-  gnutar ? pkgs.gnutar,
-  gzip ? pkgs.gzip,
-  gnugrep ? pkgs.gnugrep,
-  which ? pkgs.which,
-  curl ? pkgs.curl,
-  less ? pkgs.less,
-  wget ? pkgs.wget,
-  man ? pkgs.man,
-  cacert ? pkgs.cacert,
-  findutils ? pkgs.findutils,
-  iana-etc ? pkgs.iana-etc,
-  gitMinimal ? pkgs.gitMinimal,
-  openssh ? pkgs.openssh,
-  # Other dependencies
-  shadow ? pkgs.shadow,
 }:
 let
-  defaultPkgs = [
-    nix
-    bashInteractive
-    coreutils-full
-    gnutar
-    gzip
-    gnugrep
-    which
-    curl
-    less
-    wget
-    man
-    cacert.out
-    findutils
-    iana-etc
-    gitMinimal
-    openssh
-  ]
-  ++ extraPkgs;
+  defaultPkgs =
+    with pkgs;
+    [
+      nix
+      bashInteractive
+      coreutils-full
+      gnutar
+      gzip
+      gnugrep
+      which
+      curl
+      less
+      wget
+      man
+      cacert.out
+      findutils
+      iana-etc
+      git
+      openssh
+    ]
+    ++ extraPkgs;
 
   users = {
 
     root = {
       uid = 0;
-      shell = lib.getExe bashInteractive;
+      shell = "${pkgs.bashInteractive}/bin/bash";
       home = "/root";
       gid = 0;
       groups = [ "root" ];
@@ -81,7 +51,7 @@ let
 
     nobody = {
       uid = 65534;
-      shell = lib.getExe' shadow "nologin";
+      shell = "${pkgs.shadow}/bin/nologin";
       home = "/var/empty";
       gid = 65534;
       groups = [ "nobody" ];
@@ -92,7 +62,7 @@ let
   // lib.optionalAttrs (uid != 0) {
     "${uname}" = {
       uid = uid;
-      shell = lib.getExe bashInteractive;
+      shell = "${pkgs.bashInteractive}/bin/bash";
       home = "/home/${uname}";
       gid = gid;
       groups = [ "${gname}" ];
@@ -175,29 +145,30 @@ let
     "${k}:x:${toString gid}:${lib.concatStringsSep "," members}";
   groupContents = (lib.concatStringsSep "\n" (lib.attrValues (lib.mapAttrs groupToGroup groups)));
 
-  toConf =
-    with pkgs.lib.generators;
-    toKeyValue {
-      mkKeyValue = mkKeyValueDefault {
-        mkValueString = v: if lib.isList v then lib.concatStringsSep " " v else mkValueStringDefault { } v;
-      } " = ";
-    };
+  defaultNixConf = {
+    sandbox = "false";
+    build-users-group = "nixbld";
+    trusted-public-keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
+  };
 
-  nixConfContents = toConf (
-    {
-      sandbox = false;
-      build-users-group = "nixbld";
-      trusted-public-keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
-    }
-    // nixConf
-  );
+  nixConfContents =
+    (lib.concatStringsSep "\n" (
+      lib.mapAttrsToList (
+        n: v:
+        let
+          vStr = if builtins.isList v then lib.concatStringsSep " " v else v;
+        in
+        "${n} = ${vStr}"
+      ) (defaultNixConf // nixConf)
+    ))
+    + "\n";
 
   userHome = if uid == 0 then "/root" else "/home/${uname}";
 
   baseSystem =
     let
       nixpkgs = pkgs.path;
-      channel = runCommand "channel-nixos" { inherit bundleNixpkgs; } ''
+      channel = pkgs.runCommand "channel-nixos" { inherit bundleNixpkgs; } ''
         mkdir $out
         if [ "$bundleNixpkgs" ]; then
           ln -s ${
@@ -209,8 +180,11 @@ let
           echo "[]" > $out/manifest.nix
         fi
       '';
-      # doc/manual/source/command-ref/files/manifest.nix.md
-      manifest = buildPackages.runCommand "manifest.nix" { } ''
+      rootEnv = pkgs.buildPackages.buildEnv {
+        name = "root-profile-env";
+        paths = defaultPkgs;
+      };
+      manifest = pkgs.buildPackages.runCommand "manifest.nix" { } ''
         cat > $out <<EOF
         [
         ${lib.concatStringsSep "\n" (
@@ -239,15 +213,11 @@ let
         ]
         EOF
       '';
-      profile = buildPackages.buildEnv {
-        name = "root-profile-env";
-        paths = defaultPkgs;
-
-        postBuild = ''
-          mv $out/manifest $out/manifest.nix
-        '';
-        inherit manifest;
-      };
+      profile = pkgs.buildPackages.runCommand "user-environment" { } ''
+        mkdir $out
+        cp -a ${rootEnv}/* $out/
+        ln -s ${manifest} $out/manifest.nix
+      '';
       flake-registry-path =
         if (flake-registry == null) then
           null
@@ -256,7 +226,7 @@ let
         else
           flake-registry;
     in
-    runCommand "base-system"
+    pkgs.runCommand "base-system"
       {
         inherit
           passwdContents
@@ -279,12 +249,8 @@ let
           set -x
           mkdir -p $out/etc
 
-          # may get replaced by pkgs.dockerTools.caCertificates
           mkdir -p $out/etc/ssl/certs
-          # Old NixOS compatibility.
           ln -s /nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs
-          # NixOS canonical location
-          ln -s /nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs/ca-certificates.crt
 
           cat $passwdContentsPath > $out/etc/passwd
           echo "" >> $out/etc/passwd
@@ -310,24 +276,19 @@ let
           mkdir -p $out${userHome}
           mkdir -p $out/nix/var/nix/profiles/per-user/${uname}
 
-          # see doc/manual/source/command-ref/files/profiles.md
           ln -s ${profile} $out/nix/var/nix/profiles/default-1-link
           ln -s /nix/var/nix/profiles/default-1-link $out/nix/var/nix/profiles/default
-          ln -s /nix/var/nix/profiles/default $out${userHome}/.nix-profile
 
-          # see doc/manual/source/command-ref/files/channels.md
           ln -s ${channel} $out/nix/var/nix/profiles/per-user/${uname}/channels-1-link
           ln -s /nix/var/nix/profiles/per-user/${uname}/channels-1-link $out/nix/var/nix/profiles/per-user/${uname}/channels
 
-          # see doc/manual/source/command-ref/files/default-nix-expression.md
           mkdir -p $out${userHome}/.nix-defexpr
           ln -s /nix/var/nix/profiles/per-user/${uname}/channels $out${userHome}/.nix-defexpr/channels
           echo "${channelURL} ${channelName}" > $out${userHome}/.nix-channels
 
-          # may get replaced by pkgs.dockerTools.binSh & pkgs.dockerTools.usrBinEnv
           mkdir -p $out/bin $out/usr/bin
-          ln -s ${lib.getExe' coreutils-full "env"} $out/usr/bin/env
-          ln -s ${lib.getExe bashInteractive} $out/bin/sh
+          ln -s ${pkgs.coreutils}/bin/env $out/usr/bin/env
+          ln -s ${pkgs.bashInteractive}/bin/bash $out/bin/sh
 
         ''
         + (lib.optionalString (flake-registry-path != null) ''
@@ -336,13 +297,13 @@ let
           globalFlakeRegistryPath="$nixCacheDir/flake-registry.json"
           ln -s ${flake-registry-path} $out$globalFlakeRegistryPath
           mkdir -p $out/nix/var/nix/gcroots/auto
-          rootName=$(${lib.getExe' nix "nix"} --extra-experimental-features nix-command hash file --type sha1 --base32 <(echo -n $globalFlakeRegistryPath))
+          rootName=$(${pkgs.nix}/bin/nix --extra-experimental-features nix-command hash file --type sha1 --base32 <(echo -n $globalFlakeRegistryPath))
           ln -s $globalFlakeRegistryPath $out/nix/var/nix/gcroots/auto/$rootName
         '')
       );
 
 in
-dockerTools.buildLayeredImageWithNixDb {
+pkgs.dockerTools.buildLayeredImageWithNixDb {
 
   inherit
     name
@@ -368,7 +329,7 @@ dockerTools.buildLayeredImageWithNixDb {
   '';
 
   config = {
-    inherit Cmd Labels;
+    Cmd = [ (lib.getExe pkgs.bashInteractive) ];
     User = "${toString uid}:${toString gid}";
     Env = [
       "USER=${uname}"

flake.nix

@@ -32,7 +32,7 @@
     let
       inherit (nixpkgs) lib;
 
-      officialRelease = false;
+      officialRelease = true;
 
       linux32BitSystems = [ "i686-linux" ];
       linux64BitSystems = [
@@ -131,107 +131,31 @@
         }
       );
 
-      /**
-        Produce the `nixComponents` and `nixDependencies` package sets (scopes) for
-        a given `pkgs` and `getStdenv`.
-      */
-      packageSetsFor =
+      overlayFor =
+        getStdenv: final: prev:
         let
-          /**
-            Removes a prefix from the attribute names of a set of splices.
-            This is a completely uninteresting and exists for compatibility only.
-
-            Example:
-            ```nix
-            renameSplicesFrom "pkgs" { pkgsBuildBuild = ...; ... }
-            => { buildBuild = ...; ... }
-            ```
-          */
-          renameSplicesFrom = prefix: x: {
-            buildBuild = x."${prefix}BuildBuild";
-            buildHost = x."${prefix}BuildHost";
-            buildTarget = x."${prefix}BuildTarget";
-            hostHost = x."${prefix}HostHost";
-            hostTarget = x."${prefix}HostTarget";
-            targetTarget = x."${prefix}TargetTarget";
-          };
-
-          /**
-            Adds a prefix to the attribute names of a set of splices.
-            This is a completely uninteresting and exists for compatibility only.
-
-            Example:
-            ```nix
-            renameSplicesTo "self" { buildBuild = ...; ... }
-            => { selfBuildBuild = ...; ... }
-            ```
-          */
-          renameSplicesTo = prefix: x: {
-            "${prefix}BuildBuild" = x.buildBuild;
-            "${prefix}BuildHost" = x.buildHost;
-            "${prefix}BuildTarget" = x.buildTarget;
-            "${prefix}HostHost" = x.hostHost;
-            "${prefix}HostTarget" = x.hostTarget;
-            "${prefix}TargetTarget" = x.targetTarget;
-          };
-
-          /**
-            Takes a function `f` and returns a function that applies `f` pointwise to each splice.
-
-            Example:
-            ```nix
-            mapSplices (x: x * 10) { buildBuild = 1; buildHost = 2; ... }
-            => { buildBuild = 10; buildHost = 20; ... }
-            ```
-          */
-          mapSplices =
-            f:
-            {
-              buildBuild,
-              buildHost,
-              buildTarget,
-              hostHost,
-              hostTarget,
-              targetTarget,
-            }:
-            {
-              buildBuild = f buildBuild;
-              buildHost = f buildHost;
-              buildTarget = f buildTarget;
-              hostHost = f hostHost;
-              hostTarget = f hostTarget;
-              targetTarget = f targetTarget;
-            };
-
+          stdenv = getStdenv final;
         in
-        args@{
-          pkgs,
-          getStdenv ? pkgs: pkgs.stdenv,
-        }:
-        let
-          nixComponentsSplices = mapSplices (
-            pkgs': (packageSetsFor (args // { pkgs = pkgs'; })).nixComponents
-          ) (renameSplicesFrom "pkgs" pkgs);
-          nixDependenciesSplices = mapSplices (
-            pkgs': (packageSetsFor (args // { pkgs = pkgs'; })).nixDependencies
-          ) (renameSplicesFrom "pkgs" pkgs);
+        {
+          nixStable = prev.nix;
 
           # A new scope, so that we can use `callPackage` to inject our own interdependencies
           # without "polluting" the top level "`pkgs`" attrset.
           # This also has the benefit of providing us with a distinct set of packages
           # we can iterate over.
-          nixComponents =
+          # The `2` suffix is here because otherwise it interferes with `nixVersions.latest`, which is used in daemon compat tests.
+          nixComponents2 =
             lib.makeScopeWithSplicing'
               {
-                inherit (pkgs) splicePackages;
-                inherit (nixDependencies) newScope;
+                inherit (final) splicePackages;
+                inherit (final.nixDependencies2) newScope;
               }
               {
-                otherSplices = renameSplicesTo "self" nixComponentsSplices;
+                otherSplices = final.generateSplicesForMkScope "nixComponents2";
                 f = import ./packaging/components.nix {
-                  inherit (pkgs) lib;
+                  inherit (final) lib;
                   inherit officialRelease;
-                  inherit pkgs;
+                  pkgs = final;
                   src = self;
                   maintainers = [ ];
                 };
@@ -239,71 +163,42 @@
 
           # The dependencies are in their own scope, so that they don't have to be
           # in Nixpkgs top level `pkgs` or `nixComponents2`.
-          nixDependencies =
+          # The `2` suffix is here because otherwise it interferes with `nixVersions.latest`, which is used in daemon compat tests.
+          nixDependencies2 =
             lib.makeScopeWithSplicing'
               {
-                inherit (pkgs) splicePackages;
-                inherit (pkgs) newScope; # layered directly on pkgs, unlike nixComponents2 above
+                inherit (final) splicePackages;
+                inherit (final) newScope; # layered directly on pkgs, unlike nixComponents2 above
               }
               {
-                otherSplices = renameSplicesTo "self" nixDependenciesSplices;
+                otherSplices = final.generateSplicesForMkScope "nixDependencies2";
                 f = import ./packaging/dependencies.nix {
-                  inherit inputs pkgs;
-                  stdenv = getStdenv pkgs;
+                  inherit inputs stdenv;
+                  pkgs = final;
                 };
               };
 
-          # If the package set is largely empty, we should(?) return empty sets
-          # This is what most package sets in Nixpkgs do. Otherwise, we get
-          # an error message that indicates that some stdenv attribute is missing,
-          # and indeed it will be missing, as seemingly `pkgsTargetTarget` is
-          # very incomplete.
-          fixup = lib.mapAttrs (k: v: if !(pkgs ? nix) then { } else v);
-        in
-        fixup {
-          inherit nixDependencies;
-          inherit nixComponents;
-        };
-
-      overlayFor =
-        getStdenv: final: prev:
-        let
-          packageSets = packageSetsFor {
-            inherit getStdenv;
-            pkgs = final;
-          };
-        in
-        {
-          nixStable = prev.nix;
-
-          # The `2` suffix is here because otherwise it interferes with `nixVersions.latest`, which is used in daemon compat tests.
-          nixComponents2 = packageSets.nixComponents;
-
-          # The dependencies are in their own scope, so that they don't have to be
-          # in Nixpkgs top level `pkgs` or `nixComponents2`.
-          # The `2` suffix is here because otherwise it interferes with `nixVersions.latest`, which is used in daemon compat tests.
-          nixDependencies2 = packageSets.nixDependencies;
-
           nix = final.nixComponents2.nix-cli;
+
+          # See https://github.com/NixOS/nixpkgs/pull/214409
+          # Remove when fixed in this flake's nixpkgs
+          pre-commit =
+            if prev.stdenv.hostPlatform.system == "i686-linux" then
+              (prev.pre-commit.override (o: {
+                dotnet-sdk = "";
+              })).overridePythonAttrs
+                (o: {
+                  doCheck = false;
+                })
+            else
+              prev.pre-commit;
         };
 
     in
     {
-      overlays.internal = overlayFor (p: p.stdenv);
-
-      /**
-        A Nixpkgs overlay that sets `nix` to something like `packages.<system>.nix-everything`,
-        except dependencies aren't taken from (flake) `nix.inputs.nixpkgs`, but from the Nixpkgs packages
-        where the overlay is used.
-      */
-      overlays.default =
-        final: prev:
-        let
-          packageSets = packageSetsFor { pkgs = final; };
-        in
-        {
-          nix = packageSets.nixComponents.nix-everything;
-        };
+      # A Nixpkgs overlay that overrides the 'nix' and
+      # 'nix-perl-bindings' packages.
+      overlays.default = overlayFor (p: p.stdenv);
 
       hydraJobs = import ./packaging/hydra.nix {
         inherit
@@ -320,11 +215,47 @@
 
       checks = forAllSystems (
         system:
-        (import ./ci/gha/tests {
-          inherit system;
-          pkgs = nixpkgsFor.${system}.native;
-          nixFlake = self;
-        }).topLevel
+        {
+          installerScriptForGHA = self.hydraJobs.installerScriptForGHA.${system};
+          installTests = self.hydraJobs.installTests.${system};
+          nixpkgsLibTests = self.hydraJobs.tests.nixpkgsLibTests.${system};
+          rl-next =
+            let
+              pkgs = nixpkgsFor.${system}.native;
+            in
+            pkgs.buildPackages.runCommand "test-rl-next-release-notes" { } ''
+              LANG=C.UTF-8 ${pkgs.changelog-d}/bin/changelog-d ${./doc/manual/rl-next} >$out
+            '';
+          repl-completion = nixpkgsFor.${system}.native.callPackage ./tests/repl-completion.nix { };
+
+          /**
+            Checks for our packaging expressions.
+            This shouldn't build anything significant; just check that things
+            (including derivations) are _set up_ correctly.
+          */
+          # Disabled due to a bug in `testEqualContents` (see
+          # https://github.com/NixOS/nix/issues/12690).
+          /*
+            packaging-overriding =
+              let
+                pkgs = nixpkgsFor.${system}.native;
+                nix = self.packages.${system}.nix;
+              in
+              assert (nix.appendPatches [ pkgs.emptyFile ]).libs.nix-util.src.patches == [ pkgs.emptyFile ];
+              if pkgs.stdenv.buildPlatform.isDarwin then
+                lib.warn "packaging-overriding check currently disabled because of a permissions issue on macOS" pkgs.emptyFile
+              else
+                # If this fails, something might be wrong with how we've wired the scope,
+                # or something could be broken in Nixpkgs.
+                pkgs.testers.testEqualContents {
+                  assertion = "trivial patch does not change source contents";
+                  expected = "${./.}";
+                  actual =
+                    # Same for all components; nix-util is an arbitrary pick
+                    (nix.appendPatches [ pkgs.emptyFile ]).libs.nix-util.src;
+                };
+          */
+        }
         // (lib.optionalAttrs (builtins.elem system linux64BitSystems)) {
           dockerImage = self.hydraJobs.dockerImage.${system};
         }
@@ -337,20 +268,58 @@
         # Add "passthru" tests
         //
           flatMapAttrs
-            {
-              "" = {
-                pkgs = nixpkgsFor.${system}.native;
-              };
-            }
             (
-              nixpkgsPrefix: args:
-              (import ./ci/gha/tests (
-                args
-                // {
-                  nixFlake = self;
-                  componentTestsPrefix = nixpkgsPrefix;
-                }
-              )).componentTests
+              {
+                # Run all tests with UBSAN enabled. Running both with ubsan and
+                # without doesn't seem to have much immediate benefit for doubling
+                # the GHA CI workaround.
+                #
+                # TODO: Work toward enabling "address,undefined" if it seems feasible.
+                # This would maybe require dropping Boost coroutines and ignoring intentional
+                # memory leaks with detect_leaks=0.
+                "" = rec {
+                  nixpkgs = nixpkgsFor.${system}.native;
+                  nixComponents = nixpkgs.nixComponents2.overrideScope (
+                    nixCompFinal: nixCompPrev: {
+                      mesonComponentOverrides = _finalAttrs: prevAttrs: {
+                        mesonFlags =
+                          (prevAttrs.mesonFlags or [ ])
+                          # TODO: Macos builds instrumented with ubsan take very long
+                          # to run functional tests.
+                          ++ lib.optionals (!nixpkgs.stdenv.hostPlatform.isDarwin) [
+                            (lib.mesonOption "b_sanitize" "undefined")
+                          ];
+                      };
+                    }
+                  );
+                };
+              }
+              // lib.optionalAttrs (!nixpkgsFor.${system}.native.stdenv.hostPlatform.isDarwin) {
+                # TODO: enable static builds for darwin, blocked on:
+                #       https://github.com/NixOS/nixpkgs/issues/320448
+                # TODO: disabled to speed up GHA CI.
+                # "static-" = {
+                #   nixpkgs = nixpkgsFor.${system}.native.pkgsStatic;
+                # };
+              }
+            )
+            (
+              nixpkgsPrefix:
+              {
+                nixpkgs,
+                nixComponents ? nixpkgs.nixComponents2,
+              }:
+              flatMapAttrs nixComponents (
+                pkgName: pkg:
+                flatMapAttrs pkg.tests or { } (
+                  testName: test: {
+                    "${nixpkgsPrefix}${pkgName}-${testName}" = test;
+                  }
+                )
+              )
+              // lib.optionalAttrs (nixpkgs.stdenv.hostPlatform == nixpkgs.stdenv.buildPlatform) {
+                "${nixpkgsPrefix}nix-functional-tests" = nixComponents.nix-functional-tests;
+              }
             )
         // devFlake.checks.${system} or { }
       );
@@ -388,7 +357,6 @@
               "nix-store-tests" = { };
 
               "nix-fetchers" = { };
-              "nix-fetchers-c" = { };
               "nix-fetchers-tests" = { };
 
               "nix-expr" = { };
@@ -397,7 +365,6 @@
               "nix-expr-tests" = { };
 
               "nix-flake" = { };
-              "nix-flake-c" = { };
               "nix-flake-tests" = { };
 
               "nix-main" = { };
@@ -452,7 +419,8 @@
           dockerImage =
             let
               pkgs = nixpkgsFor.${system}.native;
-              image = pkgs.callPackage ./docker.nix {
+              image = import ./docker.nix {
+                inherit pkgs;
                 tag = pkgs.nix.version;
               };
             in
@@ -513,53 +481,5 @@
             default = self.devShells.${system}.native;
           }
         );
-
-      lib = {
-        /**
-          Creates a package set for a given Nixpkgs instance and stdenv.
-
-          # Inputs
-
-          - `pkgs`: The Nixpkgs instance to use.
-
-          - `getStdenv`: _Optional_ A function that takes a package set and returns the stdenv to use.
-            This needs to be a function in order to support cross compilation - the `pkgs` passed to `getStdenv` can be `pkgsBuildHost` or any other variation needed.
-
-          # Outputs
-
-          The return value is a fresh Nixpkgs scope containing all the packages that are defined in the Nix repository,
-          as well as some internals and parameters, which may be subject to change.
-
-          # Example
-
-          ```console
-          nix repl> :lf NixOS/nix
-          nix-repl> ps = lib.makeComponents { pkgs = import inputs.nixpkgs { crossSystem = "riscv64-linux"; }; }
-          nix-repl> ps
-          {
-            appendPatches = «lambda appendPatches @ ...»;
-            callPackage = «lambda callPackageWith @ ...»;
-            overrideAllMesonComponents = «lambda overrideSource @ ...»;
-            overrideSource = «lambda overrideSource @ ...»;
-            # ...
-            nix-everything
-            # ...
-            nix-store
-            nix-store-c
-            # ...
-          }
-          ```
-        */
-        makeComponents =
-          {
-            pkgs,
-            getStdenv ? pkgs: pkgs.stdenv,
-          }:
-
-          let
-            packageSets = packageSetsFor { inherit getStdenv pkgs; };
-          in
-          packageSets.nixComponents;
-      };
     };
 }

maintainers/README.md

@@ -37,7 +37,7 @@ The team is on Github as [@NixOS/nix-team](https://github.com/orgs/NixOS/teams/n
 
 The team meets twice a week (times are denoted in the [Europe/Amsterdam](https://en.m.wikipedia.org/wiki/Time_in_the_Netherlands) time zone):
 
-- Discussion meeting: Wednesday 21:00-22:00 Europe/Amsterdam see [calendar](https://calendar.google.com/calendar/u/0/embed?src=b9o52fobqjak8oq8lfkhg3t0qg@group.calendar.google.com).
+- Discussion meeting: [Wednesday 21:00-22:00 Europe/Amsterdam](https://www.google.com/calendar/event?eid=ZG5rZzNyajRjajducGV2NGY5aGkzYWIwdnJfMjAyNDA1MDhUMTkwMDAwWiBiOW81MmZvYnFqYWs4b3E4bGZraGczdDBxZ0Bn)
 
   1. Triage issues and pull requests from the [No Status](#no-status) column (30 min)
   2. Discuss issues and pull requests from the [To discuss](#to-discuss) column (30 min).
@@ -46,7 +46,7 @@ The team meets twice a week (times are denoted in the [Europe/Amsterdam](https:/
        - mark it as draft if it is blocked on the contributor
        - escalate it back to the team by moving it to To discuss, and leaving a comment as to why the issue needs to be discussed again.
 
-- Work meeting: Mondays 18:00-20:00 Europe/Amsterdam; see [calendar](https://calendar.google.com/calendar/u/0/embed?src=b9o52fobqjak8oq8lfkhg3t0qg@group.calendar.google.com).
+- Work meeting: [Mondays 14:00-16:00 Europe/Amsterdam](https://www.google.com/calendar/event?eid=Ym52NDdzYnRic2NzcDcybjZiNDhpNzhpa3NfMjAyNDA1MTNUMTIwMDAwWiBiOW81MmZvYnFqYWs4b3E4bGZraGczdDBxZ0Bn)
 
   1. Code review on pull requests from [In review](#in-review).
   2. Other chores and tasks.

maintainers/data/release-credits-email-to-handle.json

@@ -152,56 +152,5 @@
     "kaction@disroot.org": "KAction",
     "serenity@kaction.cc": null,
     "dev@erik.work": "Kirens",
-    "felix@alternativebit.fr": "picnoir",
-    "butirsky@gmail.com": "bam80",
-    "look@my.amazin.horse": "Valodim",
-    "jeremyfleischman@gmail.com": "jfly",
-    "vit.gottwald@gmail.com": "VitGottwald",
-    "a@unnamed.website": "anthowan",
-    "hello@whatsthecraic.net": "whatsthecraic",
-    "alex.rom23@mail.ru": "ajlekcahdp4",
-    "domagoj@tuta.com": "allrealmsoflife",
-    "uluc.sengil@gmail.com": "ulucs",
-    "prc.zhao@outlook.com": "Prince213",
-    "the-tumultuous-unicorn-of-darkness@gmx.com": "TheTumultuousUnicornOfDarkness",
-    "dev@rodney.id.au": "rvl",
-    "pe@pijul.org": "P-E-Meunier",
-    "yannik@floxdev.com": "ysndr",
-    "73017521+egorkonovalov@users.noreply.github.com": "egorkonovalov",
-    "raito@lix.systems": null,
-    "nikita.nikita.krasnov@gmail.com": "synalice",
-    "lucperkins@gmail.com": "lucperkins",
-    "vladimir.cunat@nic.cz": "vcunat",
-    "walther@technowledgy.de": "wolfgangwalther",
-    "jayesh.mail@gmail.com": "jayeshv",
-    "samuli.thomasson@pm.me": "SimSaladin",
-    "kevin@stravers.net": "kstrafe",
-    "poperigby@mailbox.org": "poperigby",
-    "cole.helbling@determinate.systems": "cole-h",
-    "donottellmetonottellyou@gmail.com": "donottellmetonottellyou",
-    "getchoo@tuta.io": "getchoo",
-    "alex.ford@determinate.systems": "gustavderdrache",
-    "stefan.r.boca@gmail.com": "stefanboca",
-    "gwenn.lebihan7@gmail.com": "gwennlbh",
-    "hey@ewen.works": "gwennlbh",
-    "matt@sturgeon.me.uk": "MattSturgeon",
-    "pbsds@hotmail.com": "pbsds",
-    "sergei@zimmerman.foo": "xokdvium",
-    "v@njh.eu": "vog",
-    "pedro.manse@dmk3.com.br": "PedroManse",
-    "arnavgawas707@gmail.com": "aln730",
-    "mkg20001@gmail.com": "mkg20001",
-    "avn@avnik.info": "avnik",
-    "olk@disr.it": "k1gen",
-    "108410815+alurm@users.noreply.github.com": "alurm",
-    "kaction.cc@gmail.com": "KAction",
-    "juhpetersen@gmail.com": "juhp",
-    "opna2608@protonmail.com": "OPNA2608",
-    "jgbailey@gmail.com": "m4dc4p",
-    "justin.bailey@well.co": "jgbailey-well",
-    "130508846+de11n@users.noreply.github.com": "de11n",
-    "ConnorBaker01@Gmail.com": "ConnorBaker",
-    "jsoo1@asu.edu": "jsoo1",
-    "hsngrmpf+github@gmail.com": "DavHau",
-    "matthew@floxdev.com": "mkenigs"
+    "felix@alternativebit.fr": "picnoir"
 }

maintainers/data/release-credits-handle-to-name.json

@@ -133,49 +133,5 @@
     "oldshensheep": "Ruby Rose",
     "KAction": "Dmitry Bogatov",
     "thomie": "Thomas Miedema",
-    "Kirens": "Erik Nygren",
-    "Prince213": "Sizhe Zhao",
-    "anthowan": "Anthony Wang",
-    "jfly": "Jeremy Fleischman",
-    "VitGottwald": "Vit Gottwald",
-    "bam80": "Andrey Butirsky",
-    "ulucs": null,
-    "P-E-Meunier": "Pierre-Etienne Meunier",
-    "ysndr": "Yannik Sander",
-    "TheTumultuousUnicornOfDarkness": "The Tumultuous Unicorn Of Darkness",
-    "ajlekcahdp4": "Alexander Romanov",
-    "Valodim": "Vincent Breitmoser",
-    "rvl": "Rodney Lorrimar",
-    "whatsthecraic": "Dean De Leo",
-    "gwennlbh": "Gwenn Le Bihan",
-    "donottellmetonottellyou": "Jade Masker",
-    "kstrafe": null,
-    "synalice": "Nikita Krasnov",
-    "poperigby": "PopeRigby",
-    "MattSturgeon": "Matt Sturgeon",
-    "lucperkins": "Luc Perkins",
-    "gustavderdrache": null,
-    "SimSaladin": "Samuli Thomasson",
-    "getchoo": "Seth Flynn",
-    "stefanboca": "Stefan Boca",
-    "wolfgangwalther": "Wolfgang Walther",
-    "pbsds": "Peder Bergebakken Sundt",
-    "egorkonovalov": "Egor Konovalov",
-    "jayeshv": "jayeshv",
-    "vcunat": "Vladim\u00edr \u010cun\u00e1t",
-    "mkenigs": "Matthew Kenigsberg",
-    "alurm": "Alan Urmancheev",
-    "jgbailey-well": "Justin Bailey",
-    "k1gen": "Oleksandr Knyshuk",
-    "juhp": "Jens Petersen",
-    "de11n": "Elliot Cameron",
-    "jsoo1": "John Soo",
-    "m4dc4p": null,
-    "PedroManse": "Manse",
-    "OPNA2608": "Cosima Neidahl",
-    "mkg20001": "Maciej Kr\u00fcger",
-    "avnik": "Alexander V. Nikolaev",
-    "DavHau": null,
-    "aln730": "AGawas",
-    "vog": "Volker Diels-Grabsch"
+    "Kirens": "Erik Nygren"
 }

maintainers/flake-module.nix

@@ -37,29 +37,6 @@
               fi
             ''}";
           };
-          meson-format =
-            let
-              meson = pkgs.meson.overrideAttrs {
-                doCheck = false;
-                doInstallCheck = false;
-                patches = [
-                  (pkgs.fetchpatch {
-                    url = "https://github.com/mesonbuild/meson/commit/38d29b4dd19698d5cad7b599add2a69b243fd88a.patch";
-                    hash = "sha256-PgPBvGtCISKn1qQQhzBW5XfknUe91i5XGGBcaUK4yeE=";
-                  })
-                ];
-              };
-            in
-            {
-              enable = true;
-              files = "(meson.build|meson.options)$";
-              entry = "${pkgs.writeScript "format-meson" ''
-                #!${pkgs.runtimeShell}
-                for file in "$@"; do
-                  ${lib.getExe meson} format -ic ${../meson.format} "$file"
-                done
-              ''}";
-            };
           nixfmt-rfc-style = {
             enable = true;
             excludes = [
@@ -166,13 +143,15 @@
               ''^tests/functional/flakes/prefetch\.sh$''
               ''^tests/functional/flakes/run\.sh$''
               ''^tests/functional/flakes/show\.sh$''
-              ''^tests/functional/formatter\.sh$''
-              ''^tests/functional/formatter\.simple\.sh$''
+              ''^tests/functional/fmt\.sh$''
+              ''^tests/functional/fmt\.simple\.sh$''
               ''^tests/functional/gc-auto\.sh$''
               ''^tests/functional/gc-concurrent\.builder\.sh$''
               ''^tests/functional/gc-concurrent\.sh$''
               ''^tests/functional/gc-concurrent2\.builder\.sh$''
               ''^tests/functional/gc-non-blocking\.sh$''
+              ''^tests/functional/git-hashing/common\.sh$''
+              ''^tests/functional/git-hashing/simple\.sh$''
               ''^tests/functional/hash-convert\.sh$''
               ''^tests/functional/impure-derivations\.sh$''
               ''^tests/functional/impure-eval\.sh$''
@@ -248,6 +227,7 @@
               ''^tests/functional/user-envs\.builder\.sh$''
               ''^tests/functional/user-envs\.sh$''
               ''^tests/functional/why-depends\.sh$''
+              ''^src/libutil-tests/data/git/check-data\.sh$''
             ];
           };
         };

maintainers/link-headers

@@ -0,0 +1,83 @@
+#!/usr/bin/env python3
+
+# This script must be run from the root of the Nix repository.
+#
+# For include path hygiene, we need to put headers in a separate
+# directory than sources. But during development, it is nice to paths
+# that are similar for headers and source files, e.g.
+# `foo/bar/baz.{cc,hh}`, e.g. for less typing when opening one file, and
+# then opening the other file.
+#
+# This script symlinks the headers next to the source files to
+# facilitate such a development workflows. It also updates
+# `.git/info/exclude` so that the symlinks are not accidentally committed
+# by mistake.
+
+from pathlib import Path
+import subprocess
+import os
+
+
+def main() -> None:
+    # Path to the source directory
+    GIT_TOPLEVEL = Path(
+        subprocess.run(
+            ["git", "rev-parse", "--show-toplevel"],
+            text=True,
+            stdout=subprocess.PIPE,
+            check=True,
+        ).stdout.strip()
+    )
+
+    # Get header files from git
+    result = subprocess.run(
+        ["git", "-C", str(GIT_TOPLEVEL), "ls-files", "*/include/nix/**.hh"],
+        text=True,
+        stdout=subprocess.PIPE,
+        check=True,
+    )
+    header_files = result.stdout.strip().split("\n")
+    header_files.sort()
+
+    links = []
+    for file_str in header_files:
+        project_str, header_str = file_str.split("/include/nix/", 1)
+        project = Path(project_str)
+        header = Path(header_str)
+
+        # Reconstruct the full path (relative to SRC_DIR) to the header file.
+        file = project / "include" / "nix" / header
+
+        # The symlink should be created at "project/header", i.e. next to the project's sources.
+        link = project / header
+
+        # Compute a relative path from the symlink's parent directory to the actual header file.
+        relative_source = os.path.relpath(
+            GIT_TOPLEVEL / file, GIT_TOPLEVEL / link.parent
+        )
+
+        # Create the symbolic link.
+        full_link_path = GIT_TOPLEVEL / link
+        full_link_path.parent.mkdir(parents=True, exist_ok=True)
+        if full_link_path.is_symlink():
+            full_link_path.unlink()
+        full_link_path.symlink_to(relative_source)
+        links.append(link)
+
+    # Generate .gitignore file
+    gitignore_path = GIT_TOPLEVEL / ".git" / "info" / "exclude"
+    gitignore_path.parent.mkdir(parents=True, exist_ok=True)
+    with gitignore_path.open("w") as gitignore:
+        gitignore.write("# DO NOT EDIT! Autogenerated\n")
+        gitignore.write(
+            "# Symlinks for headers to be next to sources for development\n"
+        )
+        gitignore.write('# Run "maintainers/link-headers" to regenerate\n\n')
+        gitignore.write('# Run "maintainers/link-headers" to regenerate\n\n')
+
+        for link in links:
+            gitignore.write(f"/{link}\n")
+
+
+if __name__ == "__main__":
+    main()

maintainers/onboarding.md

@@ -3,9 +3,5 @@
 
 - https://github.com/NixOS/nixos-homepage/
 - https://github.com/orgs/NixOS/teams/nix-team
-- Matrix rooms
-  - [private] Nix maintainer team
-  - Nix ∪ Lix devs (also private)
-  - any open security issues if present and needed
-
+- Matrix room
 - Team member should subscribe to notifications for the [Nix development category on Discourse](https://discourse.nixos.org/c/dev/nix/50)

maintainers/release-notes

@@ -157,7 +157,7 @@ section_title="Release $version_full ($DATE)"
 
   if ! $IS_PATCH; then
     echo
-    echo "## Contributors"
+    echo "# Contributors"
     echo
     VERSION=$version_full ./maintainers/release-credits
   fi

maintainers/release-notes-todo

@@ -1,58 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-# debug:
-# set -x
-
-START_REF="${1}"
-END_REF="${2:-upstream/master}"
-
-# Get the merge base
-MERGE_BASE=$(git merge-base "$START_REF" "$END_REF")
-unset START_REF
-
-# Get date range
-START_DATE=$(git show -s --format=%cI "$MERGE_BASE")
-END_DATE=$(git show -s --format=%cI "$END_REF")
-
-echo "Checking PRs merged between $START_DATE and $END_DATE" >&2
-
-# Get all commits between merge base and HEAD
-COMMITS=$(git rev-list "$MERGE_BASE..$END_REF")
-
-# Convert to set for fast lookup
-declare -A commit_set
-for commit in $COMMITS; do
-    commit_set["$commit"]=1
-done
-
-# Get the current changelog
-LOG_DONE="$(changelog-d doc/manual/rl-next)"
-is_done(){
-    local nr="$1"
-    echo "$LOG_DONE" | grep -E "^- .*/pull/$nr)"
-}
-
-# Query merged PRs in date range
-gh pr list \
-    --repo NixOS/nix \
-    --state merged \
-    --limit 1000 \
-    --json number,title,author,mergeCommit \
-    --search "merged:$START_DATE..$END_DATE" | \
-jq -r '.[] | [.number, .mergeCommit.oid, .title, .author.login] | @tsv' | \
-while IFS=$'\t' read -r pr_num merge_commit _title author; do
-    # Check if this PR's merge commit is in our branch
-    if [[ -n "${commit_set[$merge_commit]:-}" ]]; then
-        # Full detail, not suitable for comment due to mass ping and duplicate title
-        # echo "- #$pr_num $_title (@$author)"
-        echo "- #$pr_num ($author)"
-        if is_done "$pr_num"
-        then
-            echo "  - [x] has note"
-        else
-            echo "  - [ ] has note"
-        fi
-        echo "  - [ ] skip"
-    fi
-done

maintainers/release-process.md

@@ -24,18 +24,11 @@ release:
 * In a checkout of the Nix repo, make sure you're on `master` and run
   `git pull`.
 
-* Compile a release notes to-do list by running
-
-  ```console
-  $ ./maintainers/release-notes-todo PREV_RELEASE HEAD
-  ```
-
 * Compile the release notes by running
 
   ```console
   $ export VERSION=X.YY
   $ git checkout -b release-notes
-  $ export GITHUB_TOKEN=...
   $ ./maintainers/release-notes
   ```
 
@@ -46,6 +39,10 @@ release:
 * Proof-read / edit / rearrange the release notes if needed. Breaking changes
   and highlights should go to the top.
 
+* Run `maintainers/release-credits` to make sure the credits script works
+  and produces a sensible output. Some emails might not automatically map to
+  a GitHub handle.
+
 * Push.
 
   ```console
@@ -133,8 +130,6 @@ release:
 
   Commit and push this to the maintenance branch.
 
-* Create a backport label.
-
 * Bump the version of `master`:
 
   ```console
@@ -142,7 +137,6 @@ release:
   $ git pull
   $ NEW_VERSION=2.13.0
   $ echo $NEW_VERSION > .version
-  $ ... edit .mergify.yml to add the previous version ...
   $ git checkout -b bump-$NEW_VERSION
   $ git commit -a -m 'Bump version'
   $ git push --set-upstream origin bump-$NEW_VERSION
@@ -150,6 +144,10 @@ release:
 
   Make a pull request and auto-merge it.
 
+* Create a backport label.
+
+* Add the new backport label to `.mergify.yml`.
+
 * Post an [announcement on Discourse](https://discourse.nixos.org/c/announcements/8), including the contents of
   `rl-$VERSION.md`.
 

meson.build

@@ -1,15 +1,12 @@
 # This is just a stub project to include all the others as subprojects
 # for development shell purposes
 
-project(
-  'nix-dev-shell',
-  'cpp',
+project('nix-dev-shell', 'cpp',
   version : files('.version'),
   subproject_dir : 'src',
   default_options : [
     'localstatedir=/nix/var',
-  ],
-  meson_version : '>= 1.1',
+  ]
 )
 
 # Internal Libraries
@@ -36,7 +33,6 @@ endif
 # External C wrapper libraries
 subproject('libutil-c')
 subproject('libstore-c')
-subproject('libfetchers-c')
 subproject('libexpr-c')
 subproject('libflake-c')
 subproject('libmain-c')

meson.format

@@ -1,7 +0,0 @@
-indent_by = '  '
-space_array = true
-kwargs_force_multiline = false
-wide_colon = true
-group_arg_value = true
-indent_before_comments = ' '
-use_editor_config = true

meson.options

@@ -1,29 +1,13 @@
 # vim: filetype=meson
 
-option(
-  'doc-gen',
-  type : 'boolean',
-  value : false,
+option('doc-gen', type : 'boolean', value : false,
   description : 'Generate documentation',
 )
 
-option(
-  'unit-tests',
-  type : 'boolean',
-  value : true,
+option('unit-tests', type : 'boolean', value : true,
   description : 'Build unit tests',
 )
 
-option(
-  'bindings',
-  type : 'boolean',
-  value : true,
+option('bindings', type : 'boolean', value : true,
   description : 'Build language bindings (e.g. Perl)',
 )
-
-option(
-  'benchmarks',
-  type : 'boolean',
-  value : false,
-  description : 'Build benchmarks (requires gbenchmark)',
-)

misc/freebsd/meson.build

@@ -1,10 +0,0 @@
-configure_file(
-  input : 'nix-daemon.in',
-  output : 'nix-daemon',
-  install : true,
-  install_dir : get_option('prefix') / 'etc/rc.d',
-  install_mode : 'rwxr-xr-x',
-  configuration : {
-    'bindir' : bindir,
-  },
-)

misc/freebsd/nix-daemon.in

@@ -1,49 +0,0 @@
-#!/bin/sh
-#
-# PROVIDE: nix_daemon
-# REQUIRE: DAEMON
-# KEYWORD: shutdown
-#
-# Add the following lines to /etc/rc.conf to enable nix-daemon:
-#
-# nix_daemon_enable="YES"
-#
-
-# shellcheck source=/dev/null
-. /etc/rc.subr
-
-name="nix_daemon"
-# shellcheck disable=SC2034
-rcvar="nix_daemon_enable"
-
-load_rc_config $name
-
-: "${nix_daemon_enable:=NO}"
-
-command="@bindir@/nix-daemon"
-command_args=""
-pidfile="/var/run/nix-daemon.pid"
-
-# shellcheck disable=SC2034
-start_cmd="${name}_start"
-# shellcheck disable=SC2034
-stop_cmd="${name}_stop"
-
-nix_daemon_start() {
-    echo "Starting ${name}."
-    # command_args is intentionally unquoted to allow multiple arguments
-    # shellcheck disable=SC2086
-    /usr/sbin/daemon -c -f -p "${pidfile}" "${command}" ${command_args}
-}
-
-nix_daemon_stop() {
-    if [ -f "${pidfile}" ]; then
-        echo "Stopping ${name}."
-        kill -TERM "$(cat "${pidfile}")"
-        rm -f "${pidfile}"
-    else
-        echo "${name} is not running."
-    fi
-}
-
-run_rc_command "$1"

misc/launchd/meson.build

@@ -9,5 +9,5 @@ configure_file(
     # 'storedir' : store_dir,
     # 'localstatedir' : localstatedir,
     # 'bindir' : bindir,
-},
+  },
 )

misc/meson.build

@@ -9,7 +9,3 @@ endif
 if host_machine.system() == 'darwin'
   subdir('launchd')
 endif
-
-if host_machine.system() == 'freebsd'
-  subdir('freebsd')
-endif

misc/systemd/nix-daemon.conf.in

@@ -1,2 +1 @@
-d @localstatedir@/nix/daemon-socket 0755 root root -  -
-d @localstatedir@/nix/builds        0755 root root 7d -
+d @localstatedir@/nix/daemon-socket 0755 root root - -

nix-meson-build-support/big-objs/meson.build

@@ -2,5 +2,5 @@ if host_machine.system() == 'windows'
   # libexpr's primops creates a large object
   # Without the following flag, we'll get errors when cross-compiling to mingw32:
   # Fatal error: can't write 66 bytes to section .text of src/libexpr/libnixexpr.dll.p/primops.cc.obj: 'file too big'
-  add_project_arguments([ '-Wa,-mbig-obj' ], language : 'cpp')
+  add_project_arguments([ '-Wa,-mbig-obj' ], language: 'cpp')
 endif

nix-meson-build-support/common/meson.build

@@ -12,31 +12,8 @@ add_project_arguments(
   '-Werror=switch-enum',
   '-Werror=undef',
   '-Werror=unused-result',
-  '-Werror=sign-compare',
   '-Wignored-qualifiers',
   '-Wimplicit-fallthrough',
   '-Wno-deprecated-declarations',
   language : 'cpp',
 )
-
-# GCC doesn't benefit much from precompiled headers.
-do_pch = cxx.get_id() == 'clang'
-
-# This is a clang-only option for improving build times.
-# It forces the instantiation of templates in the PCH itself and
-# not every translation unit it's included in.
-# It's available starting from clang 11, which is old enough to not
-# bother checking the version.
-# This feature helps in particular with the expensive nlohmann::json template
-# instantiations in libutil and libstore.
-if cxx.get_id() == 'clang'
-  add_project_arguments('-fpch-instantiate-templates', language : 'cpp')
-endif
-
-# Clang gets grumpy about missing libasan symbols if -shared-libasan is not
-# passed when building shared libs, at least on Linux
-if cxx.get_id() == 'clang' and ('address' in get_option('b_sanitize') or 'undefined' in get_option(
-  'b_sanitize',
-))
-  add_project_link_arguments('-shared-libasan', language : 'cpp')
-endif

nix-meson-build-support/deps-lists/meson.build

@@ -6,7 +6,7 @@
 # *interface*.
 #
 # See `man pkg-config` for some details.
-deps_private = []
+deps_private = [ ]
 
 # These are public dependencies with pkg-config files. Public is the
 # opposite of private: these dependencies are used in installed header
@@ -23,14 +23,14 @@ deps_private = []
 # N.B. For distributions that care about "ABI" stability and not just
 # "API" stability, the private dependencies also matter as they can
 # potentially affect the public ABI.
-deps_public = []
+deps_public = [ ]
 
 # These are subproject deps (type == "internal"). They are other
 # packages in `/src` in this repo. The private vs public distinction is
 # the same as above.
-deps_private_subproject = []
-deps_public_subproject = []
+deps_private_subproject = [ ]
+deps_public_subproject = [ ]
 
 # These are dependencencies without pkg-config files. Ideally they are
 # just private, but they may also be public (e.g. boost).
-deps_other = []
+deps_other = [ ]

nix-meson-build-support/export-all-symbols/meson.build

@@ -5,7 +5,7 @@ if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
   # and not detail with this yet.
   #
   # TODO do not do this, and instead do fine-grained export annotations.
-  linker_export_flags = [ '-Wl,--export-all-symbols' ]
+  linker_export_flags = ['-Wl,--export-all-symbols']
 else
   linker_export_flags = []
 endif

nix-meson-build-support/export/meson.build

@@ -1,12 +1,12 @@
 requires_private = []
 foreach dep : deps_private_subproject
-  requires_private += dep.name()
+  requires_private  += dep.name()
 endforeach
 requires_private += deps_private
 
-requires_public = []
+requires_public  = []
 foreach dep : deps_public_subproject
-  requires_public += dep.name()
+  requires_public  += dep.name()
 endforeach
 requires_public += deps_public
 
@@ -14,7 +14,7 @@ extra_pkg_config_variables = get_variable('extra_pkg_config_variables', {})
 
 extra_cflags = []
 if not meson.project_name().endswith('-c')
-  extra_cflags += [ '-std=c++23' ]
+    extra_cflags += ['-std=c++2a']
 endif
 
 import('pkgconfig').generate(
@@ -29,13 +29,10 @@ import('pkgconfig').generate(
   variables : extra_pkg_config_variables,
 )
 
-meson.override_dependency(
-  meson.project_name(),
-  declare_dependency(
-    include_directories : include_dirs,
-    link_with : this_library,
-    compile_args : [ '-std=c++23' ],
-    dependencies : deps_public_subproject + deps_public,
-    variables : extra_pkg_config_variables,
-  ),
-)
+meson.override_dependency(meson.project_name(), declare_dependency(
+  include_directories : include_dirs,
+  link_with : this_library,
+  compile_args : ['-std=c++2a'],
+  dependencies : deps_public_subproject + deps_public,
+  variables : extra_pkg_config_variables,
+))

nix-meson-build-support/generate-header/meson.build

@@ -1,12 +1,7 @@
-bash = find_program('bash', native : true)
+bash = find_program('bash', native: true)
 
 gen_header = generator(
   bash,
-  arguments : [
-    '-c',
-    '{ echo \'R"__NIX_STR(\' && cat @INPUT@ && echo \')__NIX_STR"\'; } > "$1"',
-    '_ignored_argv0',
-    '@OUTPUT@',
-  ],
+  arguments : [ '-c', '{ echo \'R"__NIX_STR(\' && cat @INPUT@ && echo \')__NIX_STR"\'; } > "$1"', '_ignored_argv0', '@OUTPUT@' ],
   output : '@PLAINNAME@.gen.hh',
 )

nix-meson-build-support/windows-version/meson.build

@@ -2,5 +2,5 @@ if host_machine.system() == 'windows'
   # https://learn.microsoft.com/en-us/cpp/porting/modifying-winver-and-win32-winnt?view=msvc-170
   # #define _WIN32_WINNT_WIN8 0x0602
   # We currently don't use any API which requires higher than this.
-  add_project_arguments([ '-D_WIN32_WINNT=0x0602' ], language : 'cpp')
+  add_project_arguments([ '-D_WIN32_WINNT=0x0602' ], language: 'cpp')
 endif

packaging/binary-tarball.nix

@@ -37,9 +37,6 @@ runCommand "nix-binary-tarball-${version}" env ''
   substitute ${../scripts/install-systemd-multi-user.sh} $TMPDIR/install-systemd-multi-user.sh \
     --subst-var-by nix ${nix} \
     --subst-var-by cacert ${cacert}
-  substitute ${../scripts/install-freebsd-multi-user.sh} $TMPDIR/install-freebsd-multi-user.sh \
-    --subst-var-by nix ${nix} \
-    --subst-var-by cacert ${cacert}
   substitute ${../scripts/install-multi-user.sh} $TMPDIR/install-multi-user \
     --subst-var-by nix ${nix} \
     --subst-var-by cacert ${cacert}
@@ -51,7 +48,6 @@ runCommand "nix-binary-tarball-${version}" env ''
     shellcheck $TMPDIR/create-darwin-volume.sh
     shellcheck $TMPDIR/install-darwin-multi-user.sh
     shellcheck $TMPDIR/install-systemd-multi-user.sh
-    shellcheck $TMPDIR/install-freebsd-multi-user.sh
 
     # SC1091: Don't panic about not being able to source
     #         /etc/profile
@@ -68,7 +64,6 @@ runCommand "nix-binary-tarball-${version}" env ''
   chmod +x $TMPDIR/create-darwin-volume.sh
   chmod +x $TMPDIR/install-darwin-multi-user.sh
   chmod +x $TMPDIR/install-systemd-multi-user.sh
-  chmod +x $TMPDIR/install-freebsd-multi-user.sh
   chmod +x $TMPDIR/install-multi-user
   dir=nix-${version}-${system}
   fn=$out/$dir.tar.xz
@@ -87,7 +82,6 @@ runCommand "nix-binary-tarball-${version}" env ''
     $TMPDIR/create-darwin-volume.sh \
     $TMPDIR/install-darwin-multi-user.sh \
     $TMPDIR/install-systemd-multi-user.sh \
-    $TMPDIR/install-freebsd-multi-user.sh \
     $TMPDIR/install-multi-user \
     $TMPDIR/reginfo \
     $(cat ${installerClosureInfo}/store-paths)

packaging/components.nix

@@ -161,6 +161,13 @@ let
     ];
     separateDebugInfo = !stdenv.hostPlatform.isStatic;
     hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+    env =
+      prevAttrs.env or { }
+      // lib.optionalAttrs (
+        stdenv.isLinux
+        && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")
+        && !(stdenv.hostPlatform.useLLVM or false)
+      ) { LDFLAGS = "-fuse-ld=gold"; };
   };
 
   mesonLibraryLayer = finalAttrs: prevAttrs: {
@@ -223,7 +230,6 @@ in
 {
   version = baseVersion + versionSuffix;
   inherit versionSuffix;
-  inherit officialRelease;
   inherit maintainers;
 
   inherit filesetToSource;
@@ -349,7 +355,6 @@ in
   nix-store-tests = callPackage ../src/libstore-tests/package.nix { };
 
   nix-fetchers = callPackage ../src/libfetchers/package.nix { };
-  nix-fetchers-c = callPackage ../src/libfetchers-c/package.nix { };
   nix-fetchers-tests = callPackage ../src/libfetchers-tests/package.nix { };
 
   nix-expr = callPackage ../src/libexpr/package.nix { };
@@ -366,33 +371,18 @@ in
 
   nix-cmd = callPackage ../src/libcmd/package.nix { };
 
-  /**
-    The Nix command line interface. Note that this does not include its tests, whereas `nix-everything` does.
-  */
   nix-cli = callPackage ../src/nix/package.nix { version = fineVersion; };
 
   nix-functional-tests = callPackage ../tests/functional/package.nix {
     version = fineVersion;
   };
 
-  /**
-    The manual as would be published on https://nix.dev/reference/nix-manual
-  */
   nix-manual = callPackage ../doc/manual/package.nix { version = fineVersion; };
-  /**
-    Doxygen pages for C++ code
-  */
   nix-internal-api-docs = callPackage ../src/internal-api-docs/package.nix { version = fineVersion; };
-  /**
-    Doxygen pages for the public C API
-  */
   nix-external-api-docs = callPackage ../src/external-api-docs/package.nix { version = fineVersion; };
 
   nix-perl-bindings = callPackage ../src/perl/package.nix { };
 
-  /**
-    Combined package that has the CLI, libraries, and (assuming non-cross, no overrides) it requires that all tests succeed.
-  */
   nix-everything = callPackage ../packaging/everything.nix { } // {
     # Note: no `passthru.overrideAllMesonComponents` etc
     #       This would propagate into `nix.overrideAttrs f`, but then discard

packaging/dependencies.nix

@@ -38,7 +38,6 @@ scope: {
   aws-sdk-cpp =
     (pkgs.aws-sdk-cpp.override {
       apis = [
-        "identity-management"
         "s3"
         "transfer"
       ];
@@ -50,40 +49,8 @@ scope: {
         requiredSystemFeatures = [ ];
       };
 
-  boehmgc =
-    (pkgs.boehmgc.override {
-      enableLargeConfig = true;
-    }).overrideAttrs
-      (attrs: {
-        # Increase the initial mark stack size to avoid stack
-        # overflows, since these inhibit parallel marking (see
-        # GC_mark_some()). To check whether the mark stack is too
-        # small, run Nix with GC_PRINT_STATS=1 and look for messages
-        # such as `Mark stack overflow`, `No room to copy back mark
-        # stack`, and `Grew mark stack to ... frames`.
-        NIX_CFLAGS_COMPILE = "-DINITIAL_MARK_STACK_SIZE=1048576";
-      });
-
-  lowdown = pkgs.lowdown.overrideAttrs (prevAttrs: rec {
-    version = "2.0.2";
-    src = pkgs.fetchurl {
-      url = "https://kristaps.bsd.lv/lowdown/snapshots/lowdown-${version}.tar.gz";
-      hash = "sha512-cfzhuF4EnGmLJf5EGSIbWqJItY3npbRSALm+GarZ7SMU7Hr1xw0gtBFMpOdi5PBar4TgtvbnG4oRPh+COINGlA==";
-    };
-    nativeBuildInputs = prevAttrs.nativeBuildInputs ++ [ pkgs.buildPackages.bmake ];
-    postInstall =
-      lib.replaceStrings [ "lowdown.so.1" "lowdown.1.dylib" ] [ "lowdown.so.2" "lowdown.2.dylib" ]
-        prevAttrs.postInstall;
-  });
-
-  toml11 = pkgs.toml11.overrideAttrs rec {
-    version = "4.4.0";
-    src = pkgs.fetchFromGitHub {
-      owner = "ToruNiina";
-      repo = "toml11";
-      tag = "v${version}";
-      hash = "sha256-sgWKYxNT22nw376ttGsTdg0AMzOwp8QH3E8mx0BZJTQ=";
-    };
+  boehmgc = pkgs.boehmgc.override {
+    enableLargeConfig = true;
   };
 
   # TODO Hack until https://github.com/NixOS/nixpkgs/issues/45462 is fixed.
@@ -93,10 +60,7 @@ scope: {
         "--with-container"
         "--with-context"
         "--with-coroutine"
-        "--with-iostreams"
-        "--with-url"
       ];
-      enableIcu = false;
     }).overrideAttrs
       (old: {
         # Need to remove `--with-*` to use `--with-libraries=...`

packaging/dev-shell.nix

@@ -76,10 +76,6 @@ pkgs.nixComponents2.nix-util.overrideAttrs (
       _NIX_PRE_COMMIT_HOOKS_CONFIG = "${(pkgs.formats.yaml { }).generate "pre-commit-config.yaml"
         modular.pre-commit.settings.rawConfig
       }";
-    }
-    // lib.optionalAttrs stdenv.hostPlatform.isLinux {
-      CC_LD = "mold";
-      CXX_LD = "mold";
     };
 
     mesonFlags =
@@ -118,25 +114,21 @@ pkgs.nixComponents2.nix-util.overrideAttrs (
         modular.pre-commit.settings.package
         (pkgs.writeScriptBin "pre-commit-hooks-install" modular.pre-commit.settings.installationScript)
         pkgs.buildPackages.nixfmt-rfc-style
-        pkgs.buildPackages.gdb
       ]
       ++ lib.optional (stdenv.cc.isClang && stdenv.hostPlatform == stdenv.buildPlatform) (
         lib.hiPrio pkgs.buildPackages.clang-tools
-      )
-      ++ lib.optional stdenv.hostPlatform.isLinux pkgs.buildPackages.mold-wrapped;
+      );
 
-    buildInputs = [
-      pkgs.gbenchmark
-    ]
-    ++ attrs.buildInputs or [ ]
-    ++ pkgs.nixComponents2.nix-util.buildInputs
-    ++ pkgs.nixComponents2.nix-store.buildInputs
-    ++ pkgs.nixComponents2.nix-store-tests.externalBuildInputs
-    ++ pkgs.nixComponents2.nix-fetchers.buildInputs
-    ++ pkgs.nixComponents2.nix-expr.buildInputs
-    ++ pkgs.nixComponents2.nix-expr.externalPropagatedBuildInputs
-    ++ pkgs.nixComponents2.nix-cmd.buildInputs
-    ++ lib.optionals havePerl pkgs.nixComponents2.nix-perl-bindings.externalBuildInputs
-    ++ lib.optional havePerl pkgs.perl;
+    buildInputs =
+      attrs.buildInputs or [ ]
+      ++ pkgs.nixComponents2.nix-util.buildInputs
+      ++ pkgs.nixComponents2.nix-store.buildInputs
+      ++ pkgs.nixComponents2.nix-store-tests.externalBuildInputs
+      ++ pkgs.nixComponents2.nix-fetchers.buildInputs
+      ++ pkgs.nixComponents2.nix-expr.buildInputs
+      ++ pkgs.nixComponents2.nix-expr.externalPropagatedBuildInputs
+      ++ pkgs.nixComponents2.nix-cmd.buildInputs
+      ++ lib.optionals havePerl pkgs.nixComponents2.nix-perl-bindings.externalBuildInputs
+      ++ lib.optional havePerl pkgs.perl;
   }
 )

packaging/everything.nix

@@ -15,7 +15,6 @@
   nix-store-tests,
 
   nix-fetchers,
-  nix-fetchers-c,
   nix-fetchers-tests,
 
   nix-expr,
@@ -54,7 +53,6 @@ let
       nix-store
       nix-store-c
       nix-fetchers
-      nix-fetchers-c
       nix-expr
       nix-expr-c
       nix-flake
@@ -231,7 +229,6 @@ stdenv.mkDerivation (finalAttrs: {
       "nix-expr"
       "nix-expr-c"
       "nix-fetchers"
-      "nix-fetchers-c"
       "nix-flake"
       "nix-flake-c"
       "nix-main"

packaging/hydra.nix

@@ -48,7 +48,6 @@ let
         "nix-store-test-support"
         "nix-store-tests"
         "nix-fetchers"
-        "nix-fetchers-c"
         "nix-fetchers-tests"
         "nix-expr"
         "nix-expr-c"
@@ -223,17 +222,10 @@ in
   dockerImage = lib.genAttrs linux64BitSystems (system: self.packages.${system}.dockerImage);
 
   # # Line coverage analysis.
-  coverage =
-    (import ./../ci/gha/tests rec {
-      withCoverage = true;
-      pkgs = nixpkgsFor.x86_64-linux.nativeForStdenv.clangStdenv;
-      nixComponents = pkgs.nixComponents2;
-      nixFlake = null;
-      getStdenv = p: p.clangStdenv;
-    }).codeCoverage.coverageReports.overrideAttrs
-      {
-        name = "nix-coverage"; # For historical consistency
-      };
+  # coverage = nixpkgsFor.x86_64-linux.native.nix.override {
+  #   pname = "nix-coverage";
+  #   withCoverageChecks = true;
+  # };
 
   # Nix's manual
   manual = nixpkgsFor.x86_64-linux.native.nixComponents2.nix-manual;
@@ -247,9 +239,7 @@ in
   # System tests.
   tests =
     import ../tests/nixos {
-      inherit lib nixpkgs;
-      pkgs = nixpkgsFor.x86_64-linux.native;
-      nixComponents = nixpkgsFor.x86_64-linux.native.nixComponents2;
+      inherit lib nixpkgs nixpkgsFor;
       inherit (self.inputs) nixpkgs-23-11;
     }
     // {

precompiled-headers.h

@@ -0,0 +1,63 @@
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <cassert>
+#include <cctype>
+#include <chrono>
+#include <climits>
+#include <cmath>
+#include <condition_variable>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <exception>
+#include <functional>
+#include <future>
+#include <iostream>
+#include <limits>
+#include <list>
+#include <locale>
+#include <map>
+#include <memory>
+#include <mutex>
+#include <numeric>
+#include <optional>
+#include <queue>
+#include <random>
+#include <regex>
+#include <set>
+#include <sstream>
+#include <stack>
+#include <stdexcept>
+#include <string>
+#include <thread>
+#include <unordered_map>
+#include <unordered_set>
+#include <vector>
+
+#include <boost/format.hpp>
+
+#include <dirent.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <signal.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#ifndef _WIN32
+#  include <grp.h>
+#  include <netdb.h>
+#  include <pwd.h>
+#  include <sys/resource.h>
+#  include <sys/select.h>
+#  include <sys/socket.h>
+#  include <sys/utsname.h>
+#  include <sys/wait.h>
+#  include <termios.h>
+#endif
+
+#include <nlohmann/json.hpp>

scripts/install-freebsd-multi-user.sh

@@ -1,173 +0,0 @@
-#!/usr/bin/env bash
-
-set -eu
-set -o pipefail
-
-# System specific settings
-# FreeBSD typically uses UIDs from 1001+ for regular users,
-# so we'll use a range that's unlikely to conflict
-export NIX_FIRST_BUILD_UID="${NIX_FIRST_BUILD_UID:-30001}"
-export NIX_BUILD_GROUP_ID="${NIX_BUILD_GROUP_ID:-30000}"
-export NIX_BUILD_USER_NAME_TEMPLATE="nixbld%d"
-
-# FreeBSD service paths
-readonly SERVICE_SRC=/etc/rc.d/nix-daemon
-readonly SERVICE_DEST=/usr/local/etc/rc.d/nix-daemon
-
-poly_cure_artifacts() {
-    :
-}
-
-poly_service_installed_check() {
-    if [ -f "$SERVICE_DEST" ]; then
-        return 0
-    else
-        return 1
-    fi
-}
-
-poly_service_uninstall_directions() {
-    cat <<EOF
-$1. Delete the rc.d service
-
-  sudo service nix-daemon stop
-  sudo rm -f $SERVICE_DEST
-  sudo sysrc -x nix_daemon_enable
-
-EOF
-}
-
-poly_service_setup_note() {
-    cat <<EOF
- - link the nix-daemon rc.d service to $SERVICE_DEST
-
-EOF
-}
-
-poly_extra_try_me_commands() {
-    cat <<EOF
-  $ sudo service nix-daemon start
-EOF
-}
-
-poly_configure_nix_daemon_service() {
-    task "Setting up the nix-daemon rc.d service"
-
-    # Ensure the rc.d directory exists
-    _sudo "to create the rc.d directory" \
-          mkdir -p /usr/local/etc/rc.d
-
-    # Link the pre-installed rc.d script
-    _sudo "to set up the nix-daemon service" \
-          ln -sfn "/nix/var/nix/profiles/default$SERVICE_SRC" "$SERVICE_DEST"
-
-    _sudo "to enable the nix-daemon service" \
-          sysrc nix_daemon_enable=YES
-
-    _sudo "to start the nix-daemon" \
-          service nix-daemon start
-}
-
-poly_group_exists() {
-    pw group show "$1" > /dev/null 2>&1
-}
-
-poly_group_id_get() {
-    pw group show "$1" | cut -d: -f3
-}
-
-poly_create_build_group() {
-    _sudo "Create the Nix build group, $NIX_BUILD_GROUP_NAME" \
-          pw groupadd -n "$NIX_BUILD_GROUP_NAME" -g "$NIX_BUILD_GROUP_ID" >&2
-}
-
-poly_user_exists() {
-    pw user show "$1" > /dev/null 2>&1
-}
-
-poly_user_id_get() {
-    pw user show "$1" | cut -d: -f3
-}
-
-poly_user_hidden_get() {
-    # FreeBSD doesn't have a concept of hidden users like macOS
-    echo "0"
-}
-
-poly_user_hidden_set() {
-    # No-op on FreeBSD
-    true
-}
-
-poly_user_home_get() {
-    pw user show "$1" | cut -d: -f9
-}
-
-poly_user_home_set() {
-    _sudo "in order to give $1 a safe home directory" \
-          pw usermod -n "$1" -d "$2"
-}
-
-poly_user_note_get() {
-    pw user show "$1" | cut -d: -f8
-}
-
-poly_user_note_set() {
-    _sudo "in order to give $1 a useful comment" \
-          pw usermod -n "$1" -c "$2"
-}
-
-poly_user_shell_get() {
-    pw user show "$1" | cut -d: -f10
-}
-
-poly_user_shell_set() {
-    _sudo "in order to prevent $1 from logging in" \
-          pw usermod -n "$1" -s "$2"
-}
-
-poly_user_in_group_check() {
-    groups "$1" 2>/dev/null | grep -q "\<$2\>"
-}
-
-poly_user_in_group_set() {
-    _sudo "Add $1 to the $2 group" \
-          pw groupmod -n "$2" -m "$1"
-}
-
-poly_user_primary_group_get() {
-    pw user show "$1" | cut -d: -f4
-}
-
-poly_user_primary_group_set() {
-    _sudo "to let the nix daemon use this user for builds" \
-          pw usermod -n "$1" -g "$2"
-}
-
-poly_create_build_user() {
-    username=$1
-    uid=$2
-    builder_num=$3
-
-    _sudo "Creating the Nix build user, $username" \
-          pw useradd \
-          -n "$username" \
-          -u "$uid" \
-          -g "$NIX_BUILD_GROUP_NAME" \
-          -G "$NIX_BUILD_GROUP_NAME" \
-          -d /var/empty \
-          -s /sbin/nologin \
-          -c "Nix build user $builder_num"
-}
-
-poly_prepare_to_install() {
-    # FreeBSD-specific preparation steps
-    :
-}
-
-poly_configure_default_profile_targets() {
-    # FreeBSD-specific profile locations
-    # FreeBSD uses /usr/local/etc for third-party shell configurations
-    # Include both profile (for login shells) and bashrc (for interactive shells)
-    echo "/usr/local/etc/profile /usr/local/etc/bashrc /usr/local/etc/profile.d/nix.sh /usr/local/etc/zshrc"
-}

scripts/install-multi-user.sh

@@ -33,8 +33,7 @@ readonly NIX_BUILD_GROUP_NAME="nixbld"
 readonly NIX_ROOT="/nix"
 readonly NIX_EXTRA_CONF=${NIX_EXTRA_CONF:-}
 
-# PROFILE_TARGETS will be set later after OS-specific scripts are loaded
-PROFILE_TARGETS=()
+readonly PROFILE_TARGETS=("/etc/bashrc" "/etc/profile.d/nix.sh" "/etc/zshrc" "/etc/bash.bashrc" "/etc/zsh/zshrc")
 readonly PROFILE_BACKUP_SUFFIX=".backup-before-nix"
 readonly PROFILE_NIX_FILE="$NIX_ROOT/var/nix/profiles/default/etc/profile.d/nix-daemon.sh"
 
@@ -100,14 +99,6 @@ is_os_darwin() {
     fi
 }
 
-is_os_freebsd() {
-    if [ "$(uname -s)" = "FreeBSD" ]; then
-        return 0
-    else
-        return 1
-    fi
-}
-
 contact_us() {
     echo "You can open an issue at"
     echo "https://github.com/NixOS/nix/issues/new?labels=installer&template=installer.md"
@@ -507,10 +498,6 @@ You have aborted the installation.
 EOF
         fi
     fi
-
-    if is_os_freebsd; then
-        ok "Detected FreeBSD, will set up rc.d service for nix-daemon"
-    fi
 }
 
 setup_report() {
@@ -847,13 +834,8 @@ install_from_extracted_nix() {
     (
         cd "$EXTRACTED_NIX_PATH"
 
-        if is_os_darwin || is_os_freebsd; then
-            _sudo "to copy the basic Nix files to the new store at $NIX_ROOT/store" \
-                  cp -RPp ./store/* "$NIX_ROOT/store/"
-        else
-            _sudo "to copy the basic Nix files to the new store at $NIX_ROOT/store" \
-                  cp -RP --preserve=ownership,timestamps ./store/* "$NIX_ROOT/store/"
-        fi
+        _sudo "to copy the basic Nix files to the new store at $NIX_ROOT/store" \
+              cp -RPp ./store/* "$NIX_ROOT/store/"
 
         _sudo "to make the new store non-writable at $NIX_ROOT/store" \
               chmod -R ugo-w "$NIX_ROOT/store/"
@@ -1002,22 +984,11 @@ main() {
         # shellcheck source=./install-systemd-multi-user.sh
         . "$EXTRACTED_NIX_PATH/install-systemd-multi-user.sh" # most of this works on non-systemd distros also
         check_required_system_specific_settings "install-systemd-multi-user.sh"
-    elif is_os_freebsd; then
-        # shellcheck source=./install-freebsd-multi-user.sh
-        . "$EXTRACTED_NIX_PATH/install-freebsd-multi-user.sh"
-        check_required_system_specific_settings "install-freebsd-multi-user.sh"
     else
         failure "Sorry, I don't know what to do on $(uname)"
     fi
 
 
-    # Set profile targets after OS-specific scripts are loaded
-    if command -v poly_configure_default_profile_targets > /dev/null 2>&1; then
-        PROFILE_TARGETS=($(poly_configure_default_profile_targets))
-    else
-        PROFILE_TARGETS=("/etc/bashrc" "/etc/profile.d/nix.sh" "/etc/zshrc" "/etc/bash.bashrc" "/etc/zsh/zshrc")
-    fi
-
     welcome_to_nix
 
     if ! is_root; then

scripts/install-nix-from-tarball.sh

@@ -26,10 +26,8 @@ if [ -z "$HOME" ]; then
     exit 1
 fi
 
-OS="$(uname -s)"
-
 # macOS support for 10.12.6 or higher
-if [ "$OS" = "Darwin" ]; then
+if [ "$(uname -s)" = "Darwin" ]; then
     IFS='.' read -r macos_major macos_minor macos_patch << EOF
 $(sw_vers -productVersion)
 EOF
@@ -41,11 +39,11 @@ EOF
 fi
 
 # Determine if we could use the multi-user installer or not
-if [ "$OS" = "Linux" ] || [ "$OS" = "FreeBSD" ]; then
-    echo "Note: a multi-user installation is possible. See https://nix.dev/manual/nix/stable/installation/installing-binary.html#multi-user-installation" >&2
+if [ "$(uname -s)" = "Linux" ]; then
+    echo "Note: a multi-user installation is possible. See https://nixos.org/manual/nix/stable/installation/installing-binary.html#multi-user-installation" >&2
 fi
 
-case "$OS" in
+case "$(uname -s)" in
     "Darwin")
         INSTALL_MODE=daemon;;
     *)
@@ -62,7 +60,7 @@ while [ $# -gt 0 ]; do
             ACTION=install
             ;;
         --no-daemon)
-            if [ "$OS" = "Darwin" ]; then
+            if [ "$(uname -s)" = "Darwin" ]; then
                 printf '\e[1;31mError: --no-daemon installs are no-longer supported on Darwin/macOS!\e[0m\n' >&2
                 exit 1
             fi
@@ -98,7 +96,7 @@ while [ $# -gt 0 ]; do
                 echo "              providing multi-user support and better isolation for local builds."
                 echo "              Both for security and reproducibility, this method is recommended if"
                 echo "              supported on your platform."
-                echo "              See https://nix.dev/manual/nix/stable/installation/installing-binary.html#multi-user-installation"
+                echo "              See https://nixos.org/manual/nix/stable/installation/installing-binary.html#multi-user-installation"
                 echo ""
                 echo " --no-daemon: Simple, single-user installation that does not require root and is"
                 echo "              trivial to uninstall."
@@ -125,13 +123,6 @@ while [ $# -gt 0 ]; do
 done
 
 if [ "$INSTALL_MODE" = "daemon" ]; then
-    # Check for bash on systems that don't have it by default
-    if [ "$OS" = "FreeBSD" ] && ! command -v bash >/dev/null 2>&1; then
-        printf '\e[1;31mError: bash is required for multi-user installation but was not found.\e[0m\n' >&2
-        printf 'Please install bash first:\n' >&2
-        printf '  pkg install bash\n' >&2
-        exit 1
-    fi
     printf '\e[1;31mSwitching to the Multi-user Installer\e[0m\n'
     exec "$self/install-multi-user" $ACTION
     exit 0
@@ -153,7 +144,7 @@ if ! [ -e "$dest" ]; then
 fi
 
 if ! [ -w "$dest" ]; then
-    echo "$0: directory $dest exists, but is not writable by you. This could indicate that another user has already performed a single-user installation of Nix on this system. If you wish to enable multi-user support see https://nix.dev/manual/nix/stable/installation/multi-user.html. If you wish to continue with a single-user install for $USER please run 'chown -R $USER $dest' as root." >&2
+    echo "$0: directory $dest exists, but is not writable by you. This could indicate that another user has already performed a single-user installation of Nix on this system. If you wish to enable multi-user support see https://nixos.org/manual/nix/stable/installation/multi-user.html. If you wish to continue with a single-user install for $USER please run 'chown -R $USER $dest' as root." >&2
     exit 1
 fi
 
@@ -176,11 +167,7 @@ for i in $(cd "$self/store" >/dev/null && echo ./*); do
         rm -rf "$i_tmp"
     fi
     if ! [ -e "$dest/store/$i" ]; then
-        if [ "$OS" = "Darwin" ] || [ "$OS" = "FreeBSD" ]; then
-            cp -RPp "$self/store/$i" "$i_tmp"
-        else
-            cp -RP --preserve=ownership,timestamps "$self/store/$i" "$i_tmp"
-        fi
+        cp -RPp "$self/store/$i" "$i_tmp"
         chmod -R a-w "$i_tmp"
         chmod +w "$i_tmp"
         mv "$i_tmp" "$dest/store/$i"

scripts/meson.build

@@ -2,19 +2,19 @@ configure_file(
   input : 'nix-profile.sh.in',
   output : 'nix-profile.sh',
   configuration : {
-    'localstatedir' : localstatedir,
-  },
+    'localstatedir': localstatedir,
+  }
 )
 
 foreach rc : [ '.sh', '.fish', '-daemon.sh', '-daemon.fish' ]
   configure_file(
-    input : 'nix-profile' + rc + '.in',
+    input : 'nix-profile' + rc  + '.in',
     output : 'nix' + rc,
     install : true,
     install_dir : get_option('profile-dir'),
     install_mode : 'rw-r--r--',
     configuration : {
-      'localstatedir' : localstatedir,
+      'localstatedir': localstatedir,
     },
   )
 endforeach

scripts/nix-profile-daemon.fish.in

@@ -1,16 +1,17 @@
 # Only execute this file once per shell.
-if test -z "$HOME" || test -n "$__ETC_PROFILE_NIX_SOURCED"
+if test -z "$HOME" || \
+    test -n "$__ETC_PROFILE_NIX_SOURCED"
     exit
 end
 
-set --global --export __ETC_PROFILE_NIX_SOURCED 1
+set --global __ETC_PROFILE_NIX_SOURCED 1
 
 # Local helpers
 
 function add_path --argument-names new_path
     if type -q fish_add_path
         # fish 3.2.0 or newer
-        fish_add_path --prepend --global $new_path
+	fish_add_path --prepend --global $new_path
     else
         # older versions of fish
         if not contains $new_path $fish_user_paths
@@ -87,13 +88,6 @@ else
     end
 end
 
-# Only use MANPATH if it is already set. In general `man` will just simply
-# pick up `.nix-profile/share/man` because is it close to `.nix-profile/bin`
-# which is in the $PATH. For more info, run `manpath -d`.
-if set --query MANPATH
-    set --export --prepend --path MANPATH "$NIX_LINK/share/man"
-end
-
 add_path "@localstatedir@/nix/profiles/default/bin"
 add_path "$NIX_LINK/bin"
 

scripts/nix-profile.fish.in

@@ -1,16 +1,17 @@
 # Only execute this file once per shell.
-if test -z "$HOME" || test -n "$__ETC_PROFILE_NIX_SOURCED"
+if test -z "$HOME" || test -z "$USER" || \
+    test -n "$__ETC_PROFILE_NIX_SOURCED"
     exit
 end
 
-set --global --export __ETC_PROFILE_NIX_SOURCED 1
+set --global __ETC_PROFILE_NIX_SOURCED 1
 
 # Local helpers
 
 function add_path --argument-names new_path
     if type -q fish_add_path
         # fish 3.2.0 or newer
-        fish_add_path --prepend --global $new_path
+	fish_add_path --prepend --global $new_path
     else
         # older versions of fish
         if not contains $new_path $fish_user_paths
@@ -83,13 +84,6 @@ else if test -e "$NIX_LINK/etc/ssl/certs/ca-bundle.crt" # fall back to cacert in
     set --export NIX_SSL_CERT_FILE "$NIX_LINK/etc/ssl/certs/ca-bundle.crt"
 else if test -e "$NIX_LINK/etc/ca-bundle.crt" # old cacert in Nix profile
     set --export NIX_SSL_CERT_FILE "$NIX_LINK/etc/ca-bundle.crt"
-else
-    # Fall back to what is in the nix profiles, favouring whatever is defined last.
-    for i in (string split ' ' $NIX_PROFILES)
-        if test -e "$i/etc/ssl/certs/ca-bundle.crt"
-            set --export NIX_SSL_CERT_FILE "$i/etc/ssl/certs/ca-bundle.crt"
-        end
-    end
 end
 
 # Only use MANPATH if it is already set. In general `man` will just simply
@@ -99,7 +93,6 @@ if set --query MANPATH
     set --export --prepend --path MANPATH "$NIX_LINK/share/man"
 end
 
-add_path "@localstatedir@/nix/profiles/default/bin"
 add_path "$NIX_LINK/bin"
 
 # Cleanup