nixos-rebuild: get Nix from channel

If our old Nix can’t evaluate the Nixpkgs channel, try the fallback
from the new channel /first/. That way we can upgrade Nix to a newer
version and support breaking changes to Nix (like seen in the upgrade
o Nix 2.0).

This change should be backported to older NixOS versions!

(cherry picked from commit 475c8aa018)

.github/CONTRIBUTING.md

@@ -23,7 +23,7 @@ under the terms of [COPYING](../COPYING), which is an MIT-like license.
   Examples:
 
   * nginx: init at 2.0.1
-  * firefox: 3.0 -> 3.1.1
+  * firefox: 54.0.1 -> 55.0
   * nixos/hydra: add bazBaz option
   
     Dual baz behavior is needed to do foo.

.github/PULL_REQUEST_TEMPLATE.md

@@ -5,10 +5,7 @@
 
 <!-- Please check what applies. Note that these are not hard requirements but merely serve as information for reviewers. -->
 
-- [ ] Tested using sandboxing
-  ([nix.useSandbox](http://nixos.org/nixos/manual/options.html#opt-nix.useSandbox) on NixOS,
-    or option `build-use-sandbox` in [`nix.conf`](http://nixos.org/nix/manual/#sec-conf-file)
-    on non-NixOS)
+- [ ] Tested using sandboxing ([nix.useSandbox](http://nixos.org/nixos/manual/options.html#opt-nix.useSandbox) on NixOS, or option `build-use-sandbox` in [`nix.conf`](http://nixos.org/nix/manual/#sec-conf-file) on non-NixOS)
 - Built on platform(s)
    - [ ] NixOS
    - [ ] macOS

.travis.yml

@@ -1,35 +0,0 @@
-language: nix
-sudo: true
-# 'sudo: false' == containers that start fast, but only get 4G ram;
-# 'sudo: true'  == VMs that start slow, but with 8G
-# ..as per:  https://docs.travis-ci.com/user/ci-environment/#Virtualization-environments
-# Nixpkgs PR tests OOM with 4G: https://github.com/NixOS/nixpkgs/issues/24200
-
-matrix:
-    include:
-        - os: linux
-          sudo: required
-          script:
-              - ./maintainers/scripts/travis-nox-review-pr.sh nixpkgs-verify nixpkgs-manual nixpkgs-tarball nixpkgs-unstable
-              - ./maintainers/scripts/travis-nox-review-pr.sh nixos-options nixos-manual
-          env:
-            - BUILD_TYPE="Test Nixpkgs evaluation & NixOS manual build"
-        - os: linux
-          sudo: required
-          dist: trusty
-          before_script:
-              - sudo mount -o remount,exec,size=2G,mode=755 /run/user
-          script: ./maintainers/scripts/travis-nox-review-pr.sh nox pr
-          env:
-            - BUILD_TYPE="Build affected packages (Linux)"
-        - os: osx
-          osx_image: xcode7.3
-          script: ./maintainers/scripts/travis-nox-review-pr.sh nox pr
-          env:
-            - BUILD_TYPE="Build affected packages (macOS)"
-env:
-    global:
-        - GITHUB_TOKEN=5edaaf1017f691ed34e7f80878f8f5fbd071603f
-
-notifications:
-    email: false

COPYING

@@ -1,4 +1,4 @@
-Copyright (c) 2003-2017 Eelco Dolstra and the Nixpkgs/NixOS contributors
+Copyright (c) 2003-2018 Eelco Dolstra and the Nixpkgs/NixOS contributors
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

README.md

@@ -13,12 +13,12 @@ build daemon as so-called channels. To get channel information via git, add
 ```
 
 For stability and maximum binary package support, it is recommended to maintain
-custom changes on top of one of the channels, e.g. `nixos-17.03` for the latest
+custom changes on top of one of the channels, e.g. `nixos-17.09` for the latest
 release and `nixos-unstable` for the latest successful build of master:
 
 ```
 % git remote update channels
-% git rebase channels/nixos-17.03
+% git rebase channels/nixos-17.09
 ```
 
 For pull-requests, please rebase onto nixpkgs `master`.
@@ -32,9 +32,9 @@ For pull-requests, please rebase onto nixpkgs `master`.
 * [Manual (NixOS)](https://nixos.org/nixos/manual/)
 * [Nix Wiki](https://nixos.org/wiki/) (deprecated, see milestone ["Move the Wiki!"](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+milestone%3A%22Move+the+wiki%21%22))
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for 17.03 release](https://hydra.nixos.org/jobset/nixos/release-17.03)
+* [Continuous package builds for 17.09 release](https://hydra.nixos.org/jobset/nixos/release-17.09)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for 17.03 release](https://hydra.nixos.org/job/nixos/release-17.03/tested#tabs-constituents)
+* [Tests for 17.09 release](https://hydra.nixos.org/job/nixos/release-17.09/tested#tabs-constituents)
 
 Communication:
 

doc/coding-conventions.xml

@@ -365,7 +365,7 @@ splitting up an existing category.</para>
   <varlistentry>
     <term>If it’s a (set of) <emphasis>tool(s)</emphasis>:</term>
     <listitem>
-      <para>(A tool is a relatively small program, especially one intented
+      <para>(A tool is a relatively small program, especially one intended
       to be used non-interactively.)</para>
       <variablelist>
         <varlistentry>
@@ -608,7 +608,7 @@ evaluate correctly.</para>
 </section>
 <section xml:id="sec-sources"><title>Fetching Sources</title>
   <para>There are multiple ways to fetch a package source in nixpkgs. The
-    general guidline is that you should package sources with a high degree of
+    general guideline is that you should package sources with a high degree of
     availability. Right now there is only one fetcher which has mirroring
     support and that is <literal>fetchurl</literal>. Note that you should also
     prefer protocols which have a corresponding proxy environment variable.
@@ -661,8 +661,6 @@ src = fetchFromGitHub {
 </section>
 
 <section xml:id="sec-patches"><title>Patches</title>
-  <para>Only patches that are unique to <literal>nixpkgs</literal> should be
-    included in <literal>nixpkgs</literal> source.</para>
   <para>Patches available online should be retrieved using
     <literal>fetchpatch</literal>.</para>
   <para>
@@ -676,5 +674,30 @@ patches = [
 ];
 </programlisting>
   </para>
+  <para>Otherwise, you can add a <literal>.patch</literal> file to the
+  <literal>nixpkgs</literal> repository. In the interest of keeping our
+  maintenance burden to a minimum, only patches that are unique
+  to <literal>nixpkgs</literal> should be added in this way.</para>
+<para><programlisting>
+patches = [ ./0001-changes.patch ];
+</programlisting></para>
+  <para>If you do need to do create this sort of patch file,
+  one way to do so is with git:
+  <orderedlist>
+    <listitem><para>Move to the root directory of the source code
+    you're patching.<screen>
+$ cd the/program/source</screen></para></listitem>
+    <listitem><para>If a git repository is not already present,
+    create one and stage all of the source files.<screen>
+$ git init
+$ git add .</screen></para></listitem>
+    <listitem><para>Edit some files to make whatever changes need
+    to be included in the patch.</para></listitem>
+    <listitem><para>Use git to create a diff, and pipe the output
+    to a patch file:<screen>
+$ git diff > nixpkgs/pkgs/the/package/0001-changes.patch</screen>
+    </para></listitem>
+  </orderedlist></para>
 </section>
+
 </chapter>

doc/configuration.xml

@@ -55,6 +55,10 @@ configuration file located at
 </programlisting>
 </para>
 
+<para>Note that we are not able to test or build unfree software on Hydra
+due to policy. Most unfree licenses prohibit us from either executing or
+distributing the software.</para>
+
 <section xml:id="sec-allow-broken">
   <title>Installing broken packages</title>
 

doc/introduction.md

@@ -48,6 +48,4 @@ The binaries are made available via a [binary cache](https://cache.nixos.org).
 
 The current Nix expressions of the channels are available in the
 [`nixpkgs-channels`](https://github.com/NixOS/nixpkgs-channels) repository,
-which has branches corresponding to the available channels. There is also the
-[Nixpkgs Monitor](http://monitor.nixos.org) which keeps track of updates
-and security vulnerabilities.
+which has branches corresponding to the available channels.

doc/languages-frameworks/python.md

@@ -134,7 +134,7 @@ with
 ```nix
 with import <nixpkgs> {};
 
-python35.withPackages (ps: [ps.numpy ps.toolz])
+(python35.withPackages (ps: [ps.numpy ps.toolz])).env
 ```
 Executing `nix-shell` gives you again a Nix shell from which you can run Python.
 
@@ -530,7 +530,6 @@ Based on the packages defined in `pkgs/top-level/python-packages.nix` an
 attribute set is created for each available Python interpreter. The available
 sets are
 
-* `pkgs.python26Packages`
 * `pkgs.python27Packages`
 * `pkgs.python34Packages`
 * `pkgs.python35Packages`
@@ -540,7 +539,7 @@ sets are
 and the aliases
 
 * `pkgs.python2Packages` pointing to `pkgs.python27Packages`
-* `pkgs.python3Packages` pointing to `pkgs.python35Packages`
+* `pkgs.python3Packages` pointing to `pkgs.python36Packages`
 * `pkgs.pythonPackages` pointing to `pkgs.python2Packages`
 
 #### `buildPythonPackage` function
@@ -590,7 +589,7 @@ By default tests are run because `doCheck = true`. Test dependencies, like
 e.g. the test runner, should be added to `buildInputs`.
 
 By default `meta.platforms` is set to the same value
-as the interpreter unless overriden otherwise.
+as the interpreter unless overridden otherwise.
 
 ##### `buildPythonPackage` parameters
 
@@ -774,6 +773,34 @@ The `buildPythonPackage` function sets `DETERMINISTIC_BUILD=1` and
 Both are also exported in `nix-shell`.
 
 
+### Automatic tests
+
+It is recommended to test packages as part of the build process.
+Source distributions (`sdist`) often include test files, but not always.
+
+By default the command `python setup.py test` is run as part of the
+`checkPhase`, but often it is necessary to pass a custom `checkPhase`. An
+example of such a situation is when `py.test` is used.
+
+#### Common issues
+
+- Non-working tests can often be deselected. By default `buildPythonPackage` runs `python setup.py test`.
+  Most python modules follows the standard test protocol where the pytest runner can be used instead.
+  `py.test` supports a `-k` parameter to ignore test methods or classes: 
+  
+  ```nix
+  buildPythonPackage {
+    # ...
+    # assumes the tests are located in tests
+    checkInputs = [ pytest ];
+    checkPhase = ''
+      py.test -k 'not function_name and not other_function' tests
+    '';
+  }
+  ```
+- Unicode issues can typically be fixed by including `glibcLocales` in `buildInputs` and exporting `LC_ALL=en_US.utf-8`.
+- Tests that attempt to access `$HOME` can be fixed by using the following work-around before running tests (e.g. `preCheck`): `export HOME=$(mktemp -d)`
+
 ## FAQ
 
 ### How to solve circular dependencies?
@@ -985,8 +1012,9 @@ rec {
 
 Following rules are desired to be respected:
 
-* Python libraries are supposed to be called from `python-packages.nix` and packaged with `buildPythonPackage`. The expression of a library should be in `pkgs/development/python-modules/<name>/default.nix`. Libraries in `pkgs/top-level/python-packages.nix` are sorted quasi-alphabetically to avoid merge conflicts.
+* Python libraries are called from `python-packages.nix` and packaged with `buildPythonPackage`. The expression of a library should be in `pkgs/development/python-modules/<name>/default.nix`. Libraries in `pkgs/top-level/python-packages.nix` are sorted quasi-alphabetically to avoid merge conflicts.
 * Python applications live outside of `python-packages.nix` and are packaged with `buildPythonApplication`.
 * Make sure libraries build for all Python interpreters.
 * By default we enable tests. Make sure the tests are found and, in the case of libraries, are passing for all interpreters. If certain tests fail they can be disabled individually. Try to avoid disabling the tests altogether. In any case, when you disable tests, leave a comment explaining why.
-* Commit names of Python libraries should include `pythonPackages`, for example `pythonPackages.numpy: 1.11 -> 1.12`.
+* Commit names of Python libraries should reflect that they are Python libraries, so write for example `pythonPackages.numpy: 1.11 -> 1.12`.
+

doc/languages-frameworks/rust.md

@@ -17,7 +17,7 @@ into the `environment.systemPackages` or bring them into scope with
 `nix-shell -p rustStable.rustc -p rustStable.cargo`.
 
 There are also `rustBeta` and `rustNightly` package sets available.
-These are not updated very regulary. For daily builds use either rustup from
+These are not updated very regularly. For daily builds use either rustup from
 nixpkgs or use the [Rust nightlies overlay](#using-the-rust-nightlies-overlay).
 
 ## Packaging Rust applications

doc/meta.xml

@@ -201,8 +201,8 @@ meta.platforms = stdenv.lib.platforms.linux;
 </programlisting>
 
     Attribute Set <varname>stdenv.lib.platforms</varname> in
-    <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/lib/platforms.nix">
-    <filename>nixpkgs/lib/platforms.nix</filename></link> defines various common
+    <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/lib/systems/platforms.nix">
+    <filename>nixpkgs/lib/systems/platforms.nix</filename></link> defines various common
     lists of platforms types.
     </para></listitem>
   </varlistentry>

doc/package-notes.xml

@@ -101,7 +101,7 @@ modulesTree = [kernel]
 $ nix-env -i ncurses
 $ export NIX_CFLAGS_LINK=-lncurses
 $ make menuconfig ARCH=<replaceable>arch</replaceable></screen>
-          
+
           </para>
         </listitem>
 
@@ -111,9 +111,9 @@ $ make menuconfig ARCH=<replaceable>arch</replaceable></screen>
         </listitem>
 
       </orderedlist>
-    
+
     </para>
-    
+
   </listitem>
 
   <listitem>
@@ -409,24 +409,24 @@ it. Place the resulting <filename>package.nix</filename> file into
 <title>Steam in Nix</title>
 
 <para>
-  Steam is distributed as a <filename>.deb</filename> file, for now only 
-  as an i686 package (the amd64 package only has documentation). 
-  When unpacked, it has a script called <filename>steam</filename> that 
+  Steam is distributed as a <filename>.deb</filename> file, for now only
+  as an i686 package (the amd64 package only has documentation).
+  When unpacked, it has a script called <filename>steam</filename> that
   in ubuntu (their target distro) would go to <filename>/usr/bin
-  </filename>. When run for the first time, this script copies some 
-  files to the user's home, which include another script that is the 
-  ultimate responsible for launching the steam binary, which is also 
+  </filename>. When run for the first time, this script copies some
+  files to the user's home, which include another script that is the
+  ultimate responsible for launching the steam binary, which is also
   in $HOME.
 </para>
 <para>
   Nix problems and constraints:
 <itemizedlist>
-  <listitem><para>We don't have <filename>/bin/bash</filename> and many 
+  <listitem><para>We don't have <filename>/bin/bash</filename> and many
   scripts point there. Similarly for <filename>/usr/bin/python</filename>
   .</para></listitem>
   <listitem><para>We don't have the dynamic loader in <filename>/lib
   </filename>.</para></listitem>
-  <listitem><para>The <filename>steam.sh</filename> script in $HOME can 
+  <listitem><para>The <filename>steam.sh</filename> script in $HOME can
   not be patched, as it is checked and rewritten by steam.</para></listitem>
   <listitem><para>The steam binary cannot be patched, it's also checked.</para></listitem>
 </itemizedlist>
@@ -446,10 +446,10 @@ it. Place the resulting <filename>package.nix</filename> file into
 <title>How to play</title>
 
 <para>
-  For 64-bit systems it's important to have 
-  <programlisting>hardware.opengl.driSupport32Bit = true;</programlisting> 
-  in your <filename>/etc/nixos/configuration.nix</filename>. You'll also need 
-  <programlisting>hardware.pulseaudio.support32Bit = true;</programlisting> 
+  For 64-bit systems it's important to have
+  <programlisting>hardware.opengl.driSupport32Bit = true;</programlisting>
+  in your <filename>/etc/nixos/configuration.nix</filename>. You'll also need
+  <programlisting>hardware.pulseaudio.support32Bit = true;</programlisting>
   if you are using PulseAudio - this will enable 32bit ALSA apps integration.
   To use the Steam controller, you need to add
   <programlisting>services.udev.extraRules = ''
@@ -470,31 +470,25 @@ it. Place the resulting <filename>package.nix</filename> file into
 
   <varlistentry>
     <term>Steam fails to start. What do I do?</term>
-    <listitem><para>Try to run 
+    <listitem><para>Try to run
     <programlisting>strace steam</programlisting>
     to see what is causing steam to fail.</para></listitem>
   </varlistentry>
 
   <varlistentry>
-  <term>Using the FOSS Radeon drivers</term>
-  <listitem><itemizedlist><listitem><para>
-  The open source radeon drivers need a newer libc++ than is provided 
-  by the default runtime, which leads to a crash on launch. Use
-  <programlisting>environment.systemPackages = [(pkgs.steam.override { newStdcpp = true; })];</programlisting>
-  in your config if you get an error like
-  <programlisting>
-libGL error: unable to load driver: radeonsi_dri.so
-libGL error: driver pointer missing
-libGL error: failed to load driver: radeonsi
-libGL error: unable to load driver: swrast_dri.so
-libGL error: failed to load driver: swrast</programlisting></para></listitem>
-  <listitem><para>
-  Steam ships statically linked with a version of libcrypto that
-  conflics with the one dynamically loaded by radeonsi_dri.so.
-  If you get the error
-  <programlisting>steam.sh: line 713: 7842 Segmentation fault (core dumped)</programlisting>
-  have a look at <link xlink:href="https://github.com/NixOS/nixpkgs/pull/20269">this pull request</link>.
-  </para></listitem>
+  <term>Using the FOSS Radeon or nouveau (nvidia) drivers</term>
+  <listitem><itemizedlist>
+    <listitem><para>The <literal>newStdcpp</literal> parameter
+    was removed since NixOS 17.09 and should not be needed anymore.
+    </para></listitem>
+
+    <listitem><para>
+    Steam ships statically linked with a version of libcrypto that
+    conflics with the one dynamically loaded by radeonsi_dri.so.
+    If you get the error
+    <programlisting>steam.sh: line 713: 7842 Segmentation fault (core dumped)</programlisting>
+    have a look at <link xlink:href="https://github.com/NixOS/nixpkgs/pull/20269">this pull request</link>.
+    </para></listitem>
 
   </itemizedlist></listitem></varlistentry>
 
@@ -504,7 +498,7 @@ libGL error: failed to load driver: swrast</programlisting></para></listitem>
   <listitem><para>
   There is no java in steam chrootenv by default. If you get a message like
   <programlisting>/home/foo/.local/share/Steam/SteamApps/common/towns/towns.sh: line 1: java: command not found</programlisting>
-  You need to add  
+  You need to add
   <programlisting> steam.override { withJava = true; };</programlisting>
   to your configuration.
   </para></listitem>
@@ -519,14 +513,14 @@ libGL error: failed to load driver: swrast</programlisting></para></listitem>
 
 <title>steam-run</title>
 <para>
-The FHS-compatible chroot used for steam can also be used to run 
+The FHS-compatible chroot used for steam can also be used to run
 other linux games that expect a FHS environment.
-To do it, add 
+To do it, add
 <programlisting>pkgs.(steam.override {
           nativeOnly = true;
           newStdcpp = true;
         }).run</programlisting>
-to your configuration, rebuild, and run the game with 
+to your configuration, rebuild, and run the game with
 <programlisting>steam-run ./foo</programlisting>
 </para>
 

doc/stdenv.xml

@@ -230,7 +230,8 @@ genericBuild
     <listitem><para>
       Like <varname>nativeBuildInputs</varname>, but these dependencies are <emphasis>propagated</emphasis>:
       that is, the dependencies listed here are added to the <varname>nativeBuildInputs</varname> of any package that uses <emphasis>this</emphasis> package as a dependency.
-      So if package Y has <literal>propagatedBuildInputs = [X]</literal>, and package Z has <literal>buildInputs = [Y]</literal>, then package X will appear in Z’s build environment automatically.
+      So if package Y has <literal>propagatedNativeBuildInputs = [X]</literal>, and package Z has <literal>nativeBuildInputs = [Y]</literal>,
+      then package X will appear in Z’s build environment automatically.
     </para></listitem>
   </varlistentry>
 
@@ -697,8 +698,14 @@ nothing.</para>
     <listitem><para>A list of strings passed as additional flags to
     <command>make</command>.  These flags are also used by the default
     install and check phase.  For setting make flags specific to the
-    build phase, use <varname>buildFlags</varname> (see
-    below).</para></listitem>
+    build phase, use <varname>buildFlags</varname> (see below).
+
+<programlisting>
+makeFlags = [ "PREFIX=$(out)" ];
+</programlisting>
+
+    <note><para>The flags are quoted in bash, but environment variables can
+    be specified by using the make syntax.</para></note></para></listitem>
   </varlistentry>
 
   <varlistentry>
@@ -1474,6 +1481,20 @@ someVar=$(stripHash $name)
     disabled or patched to work with PaX.</para></listitem>
   </varlistentry>
 
+  <varlistentry>
+    <term>autoPatchelfHook</term>
+    <listitem><para>This is a special setup hook which helps in packaging
+    proprietary software in that it automatically tries to find missing shared
+    library dependencies of ELF files. All packages within the
+    <envar>runtimeDependencies</envar> environment variable are unconditionally
+    added to executables, which is useful for programs that use
+    <citerefentry>
+      <refentrytitle>dlopen</refentrytitle>
+      <manvolnum>3</manvolnum>
+    </citerefentry>
+    to load libraries at runtime.</para></listitem>
+  </varlistentry>
+
 </variablelist>
 
 </para>

doc/submitting-changes.xml

@@ -61,7 +61,7 @@ $ git checkout -b 'fix/pkg-name-update'
 <listitem>
 <para>Format the commit in a following way:</para>
 <programlisting>
-(pkg-name | service-name): (from -> to | init at version | refactor | etc)
+(pkg-name | nixos/&lt;module>): (from -> to | init at version | refactor | etc)
 Additional information.
 </programlisting>
 
@@ -78,19 +78,19 @@ Additional information.
 
 <listitem>
 <para>
-<command>firefox: 3.0 -> 3.1.1</command>
+<command>firefox: 54.0.1 -> 55.0</command>
 </para>
 </listitem>
 
 <listitem>
 <para>
-<command>hydra service: add bazBaz option</command>
+<command>nixos/hydra: add bazBaz option</command>
 </para>
 </listitem>
 
 <listitem>
 <para>
-<command>nginx service: refactor config generation</command>
+<command>nixos/nginx: refactor config generation</command>
 </para>
 </listitem>
 </itemizedlist>
@@ -196,7 +196,7 @@ Additional information.
 
 <itemizedlist>
 <listitem>
-<para>Write the title in format <command>(pkg-name | service): improvement</command>.
+<para>Write the title in format <command>(pkg-name | nixos/&lt;module>): improvement</command>.
 
 <itemizedlist>
 <listitem>

lib/attrsets.nix

@@ -1,11 +1,11 @@
+{ lib }:
 # Operations on attribute sets.
 
 let
   inherit (builtins) head tail length;
-  inherit (import ./trivial.nix) and or;
-  inherit (import ./default.nix) fold;
-  inherit (import ./strings.nix) concatStringsSep;
-  inherit (import ./lists.nix) concatMap concatLists all deepSeqList;
+  inherit (lib.trivial) and or;
+  inherit (lib.strings) concatStringsSep;
+  inherit (lib.lists) fold concatMap concatLists all deepSeqList;
 in
 
 rec {

lib/customisation.nix

@@ -1,6 +1,6 @@
+{ lib }:
 let
 
-  lib = import ./default.nix;
   inherit (builtins) attrNames isFunction;
 
 in

lib/debug.nix

@@ -1,4 +1,6 @@
-let lib = import ./default.nix;
+{ lib }:
+
+let
 
 inherit (builtins) trace attrNamesToStr isAttrs isFunction isList isInt
         isString isBool head substring attrNames;

lib/default.nix

@@ -5,58 +5,127 @@
  */
 let
 
-  # often used, or depending on very little
-  trivial = import ./trivial.nix;
-  fixedPoints = import ./fixed-points.nix;
+  callLibs = file: import file { inherit lib; };
 
-  # datatypes
-  attrsets = import ./attrsets.nix;
-  lists = import ./lists.nix;
-  strings = import ./strings.nix;
-  stringsWithDeps = import ./strings-with-deps.nix;
+  lib = rec {
 
-  # packaging
-  customisation = import ./customisation.nix;
-  maintainers = import ./maintainers.nix;
-  meta = import ./meta.nix;
-  sources = import ./sources.nix;
+    # often used, or depending on very little
+    trivial = callLibs ./trivial.nix;
+    fixedPoints = callLibs ./fixed-points.nix;
 
-  # module system
-  modules = import ./modules.nix;
-  options = import ./options.nix;
-  types = import ./types.nix;
+    # datatypes
+    attrsets = callLibs ./attrsets.nix;
+    lists = callLibs ./lists.nix;
+    strings = callLibs ./strings.nix;
+    stringsWithDeps = callLibs ./strings-with-deps.nix;
 
-  # constants
-  licenses = import ./licenses.nix;
-  systems = import ./systems;
+    # packaging
+    customisation = callLibs ./customisation.nix;
+    maintainers = callLibs ./maintainers.nix;
+    meta = callLibs ./meta.nix;
+    sources = callLibs ./sources.nix;
 
-  # misc
-  debug = import ./debug.nix;
-  generators = import ./generators.nix;
-  misc = import ./deprecated.nix;
 
-  # domain-specific
-  sandbox = import ./sandbox.nix;
-  fetchers = import ./fetchers.nix;
+    # module system
+    modules = callLibs ./modules.nix;
+    options = callLibs ./options.nix;
+    types = callLibs ./types.nix;
 
-  # Eval-time filesystem handling
-  filesystem = import ./filesystem.nix;
+    # constants
+    licenses = callLibs ./licenses.nix;
+    systems = callLibs ./systems;
 
-in
-  { inherit trivial fixedPoints
-            attrsets lists strings stringsWithDeps
-            customisation maintainers meta sources
-            modules options types
-            licenses systems
-            debug generators misc
-            sandbox fetchers filesystem;
+    # misc
+    debug = callLibs ./debug.nix;
+
+    generators = callLibs ./generators.nix;
+    misc = callLibs ./deprecated.nix;
+    # domain-specific
+    sandbox = callLibs ./sandbox.nix;
+    fetchers = callLibs ./fetchers.nix;
+
+    # Eval-time filesystem handling
+    filesystem = callLibs ./filesystem.nix;
 
     # back-compat aliases
     platforms = systems.doubles;
-  }
-  # !!! don't include everything at top-level; perhaps only the most
-  # commonly used functions.
-  // trivial // fixedPoints
-  // lists // strings // stringsWithDeps // attrsets // sources
-  // options // types // meta // debug // misc // modules
-  // customisation
+
+    inherit (builtins) add addErrorContext attrNames
+      concatLists deepSeq elem elemAt filter genericClosure genList
+      getAttr hasAttr head isAttrs isBool isFunction isInt isList
+      isString length lessThan listToAttrs pathExists readFile
+      replaceStrings seq stringLength sub substring tail;
+    inherit (trivial) id const concat or and boolToString mergeAttrs
+      flip mapNullable inNixShell min max importJSON warn info
+      nixpkgsVersion mod;
+
+    inherit (fixedPoints) fix fix' extends composeExtensions
+      makeExtensible makeExtensibleWithCustomName;
+    inherit (attrsets) attrByPath hasAttrByPath setAttrByPath
+      getAttrFromPath attrVals attrValues catAttrs filterAttrs
+      filterAttrsRecursive foldAttrs collect nameValuePair mapAttrs
+      mapAttrs' mapAttrsToList mapAttrsRecursive mapAttrsRecursiveCond
+      genAttrs isDerivation toDerivation optionalAttrs
+      zipAttrsWithNames zipAttrsWith zipAttrs recursiveUpdateUntil
+      recursiveUpdate matchAttrs overrideExisting getOutput getBin
+      getLib getDev chooseDevOutputs zipWithNames zip;
+    inherit (lists) singleton foldr fold foldl foldl' imap0 imap1
+      concatMap flatten remove findSingle findFirst any all count
+      optional optionals toList range partition zipListsWith zipLists
+      reverseList listDfs toposort sort take drop sublist last init
+      crossLists unique intersectLists subtractLists
+      mutuallyExclusive;
+    inherit (strings) concatStrings concatMapStrings concatImapStrings
+      intersperse concatStringsSep concatMapStringsSep
+      concatImapStringsSep makeSearchPath makeSearchPathOutput
+      makeLibraryPath makeBinPath makePerlPath optionalString
+      hasPrefix hasSuffix stringToCharacters stringAsChars escape
+      escapeShellArg escapeShellArgs replaceChars lowerChars upperChars
+      toLower toUpper addContextFrom splitString removePrefix
+      removeSuffix versionOlder versionAtLeast getVersion nameFromURL
+      enableFeature fixedWidthString fixedWidthNumber isStorePath
+      toInt readPathsFromFile fileContents;
+    inherit (stringsWithDeps) textClosureList textClosureMap
+      noDepEntry fullDepEntry packEntry stringAfter;
+    inherit (customisation) overrideDerivation makeOverridable
+      callPackageWith callPackagesWith addPassthru hydraJob makeScope;
+    inherit (meta) addMetaAttrs dontDistribute setName updateName
+      appendToName mapDerivationAttrset lowPrio lowPrioSet hiPrio
+      hiPrioSet;
+    inherit (sources) pathType pathIsDirectory cleanSourceFilter
+      cleanSource sourceByRegex sourceFilesBySuffices
+      commitIdFromGitRepo;
+    inherit (modules) evalModules closeModules unifyModuleSyntax
+      applyIfFunction unpackSubmodule packSubmodule mergeModules
+      mergeModules' mergeOptionDecls evalOptionValue mergeDefinitions
+      pushDownProperties dischargeProperties filterOverrides
+      sortProperties fixupOptionType mkIf mkAssert mkMerge mkOverride
+      mkOptionDefault mkDefault mkForce mkVMOverride mkStrict
+      mkFixStrictness mkOrder mkBefore mkAfter mkAliasDefinitions
+      mkAliasAndWrapDefinitions fixMergeModules mkRemovedOptionModule
+      mkRenamedOptionModule mkMergedOptionModule mkChangedOptionModule
+      mkAliasOptionModule doRename filterModules;
+    inherit (options) isOption mkEnableOption mkSinkUndeclaredOptions
+      mergeDefaultOption mergeOneOption mergeEqualOption getValues
+      getFiles optionAttrSetToDocList optionAttrSetToDocList'
+      scrubOptionValue literalExample showOption showFiles
+      unknownModule mkOption;
+    inherit (types) isType setType defaultTypeMerge defaultFunctor
+      isOptionType mkOptionType;
+    inherit (debug) addErrorContextToAttrs traceIf traceVal
+      traceXMLVal traceXMLValMarked traceSeq traceSeqN traceValSeq
+      traceValSeqN traceShowVal traceShowValMarked
+      showVal traceCall traceCall2 traceCall3 traceValIfNot runTests
+      testAllTrue strict traceCallXml attrNamesToStr;
+    inherit (misc) maybeEnv defaultMergeArg defaultMerge foldArgs
+      defaultOverridableDelayableArgs composedArgsAndFun
+      maybeAttrNullable maybeAttr ifEnable checkFlag getValue
+      checkReqs uniqList uniqListExt condConcat lazyGenericClosure
+      innerModifySumArgs modifySumArgs innerClosePropagation
+      closePropagation mapAttrsFlatten nvs setAttr setAttrMerge
+      mergeAttrsWithFunc mergeAttrsConcatenateValues
+      mergeAttrsNoOverride mergeAttrByFunc mergeAttrsByFuncDefaults
+      mergeAttrsByFuncDefaultsClean mergeAttrBy
+      prepareDerivationArgs nixType imap overridableDelayableArgs;
+  };
+in lib

lib/deprecated.nix

@@ -1,11 +1,12 @@
-let lib = import ./default.nix;
+{ lib }:
+let
     inherit (builtins) isFunction head tail isList isAttrs isInt attrNames;
 
 in
 
-with import ./lists.nix;
-with import ./attrsets.nix;
-with import ./strings.nix;
+with lib.lists;
+with lib.attrsets;
+with lib.strings;
 
 rec {
 

lib/fetchers.nix

@@ -1,4 +1,5 @@
 # snippets that can be shared by multiple fetchers (pkgs/build-support)
+{ lib }:
 {
 
   proxyImpureEnvVars = [

lib/filesystem.nix

@@ -1,3 +1,4 @@
+{ lib }:
 { # haskellPathsInDir : Path -> Map String Path
   # A map of all haskell packages defined in the given path,
   # identified by having a cabal file with the same name as the

lib/fixed-points.nix

@@ -1,3 +1,4 @@
+{ ... }:
 rec {
   # Compute the fixed point of the given function `f`, which is usually an
   # attribute set that expects its final, non-recursive representation as an

lib/generators.nix

@@ -7,10 +7,11 @@
  * Tests can be found in ./tests.nix
  * Documentation in the manual, #sec-generators
  */
-with import ./trivial.nix;
+{ lib }:
+with (lib).trivial;
 let
-  libStr = import ./strings.nix;
-  libAttr = import ./attrsets.nix;
+  libStr = lib.strings;
+  libAttr = lib.attrsets;
 
   flipMapAttrs = flip libAttr.mapAttrs;
 in

lib/licenses.nix

@@ -1,7 +1,6 @@
+{ lib }:
 let
 
-  lib = import ./default.nix;
-
   spdx = lic: lic // {
     url = "http://spdx.org/licenses/${lic.spdxId}";
   };
@@ -175,6 +174,12 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
     fullName = "DOC License";
   };
 
+  eapl = {
+    fullName = "EPSON AVASYS PUBLIC LICENSE";
+    url = http://avasys.jp/hp/menu000000700/hpg000000603.htm;
+    free = false;
+  };
+
   efl10 = spdx {
     spdxId = "EFL-1.0";
     fullName = "Eiffel Forum License v1.0";
@@ -190,6 +195,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
     fullName = "Eclipse Public License 1.0";
   };
 
+  epl20 = spdx {
+    spdxId = "EPL-2.0";
+    fullName = "Eclipse Public License 2.0";
+  };
+
   epson = {
     fullName = "Seiko Epson Corporation Software License Agreement for Linux";
     url = https://download.ebz.epson.net/dsc/du/02/eula/global/LINUX_EN.html;
@@ -198,7 +208,7 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
 
   eupl11 = spdx {
     spdxId = "EUPL-1.1";
-    fullname = "European Union Public License 1.1";
+    fullName = "European Union Public License 1.1";
   };
 
   fdl12 = spdx {
@@ -211,6 +221,12 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
     fullName = "GNU Free Documentation License v1.3";
   };
 
+  ffsl = {
+    fullName = "Floodgap Free Software License";
+    url = http://www.floodgap.com/software/ffsl/license.html;
+    free = false;
+  };
+
   free = {
     fullName = "Unspecified free software license";
   };
@@ -271,6 +287,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
     url = https://fedoraproject.org/wiki/Licensing/GPL_Classpath_Exception;
   };
 
+  hpnd = spdx {
+    spdxId = "HPND";
+    fullName = "Historic Permission Notice and Disclaimer";
+  };
+
   # Intel's license, seems free
   iasl = {
     fullName = "iASL";
@@ -282,9 +303,10 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
     fullName = "Independent JPEG Group License";
   };
 
-  inria = {
-    fullName  = "INRIA Non-Commercial License Agreement";
+  inria-compcert = {
+    fullName  = "INRIA Non-Commercial License Agreement for the CompCert verified compiler";
     url       = "http://compcert.inria.fr/doc/LICENSE";
+    free      = false;
   };
 
   ipa = spdx {
@@ -363,7 +385,7 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
   };
 
   miros = {
-    fullname = "MirOS License";
+    fullName = "MirOS License";
     url = https://opensource.org/licenses/MirOS;
   };
 
@@ -408,7 +430,7 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec {
     url = "https://raw.githubusercontent.com/raboof/notion/master/LICENSE";
     fullName = "Notion modified LGPL";
   };
-  
+
   ofl = spdx {
     spdxId = "OFL-1.1";
     fullName = "SIL Open Font License 1.1";

lib/lists.nix

@@ -1,6 +1,6 @@
 # General list operations.
-
-with import ./trivial.nix;
+{ lib }:
+with lib.trivial;
 
 rec {
 

lib/maintainers.nix

@@ -1,3 +1,4 @@
+{ ...}:
 /* List of NixOS maintainers. The format is:
 
     handle = "Real Name <address@example.org>";
@@ -40,6 +41,7 @@
   amorsillo = "Andrew Morsillo <andrew.morsillo@gmail.com>";
   AndersonTorres = "Anderson Torres <torres.anderson.85@gmail.com>";
   anderspapitto = "Anders Papitto <anderspapitto@gmail.com>";
+  andir = "Andreas Rammhold <andreas@rammhold.de>";
   andres = "Andres Loeh <ksnixos@andres-loeh.de>";
   andrewrk = "Andrew Kelley <superjoe30@gmail.com>";
   andsild = "Anders Sildnes <andsild@gmail.com>";
@@ -109,6 +111,7 @@
   christopherpoole = "Christopher Mark Poole <mail@christopherpoole.net>";
   ciil = "Simon Lackerbauer <simon@lackerbauer.com>";
   ckampka = "Christian Kampka <christian@kampka.net>";
+  ckauhaus = "Christian Kauhaus <christian@kauhaus.de>";
   cko = "Christine Koppelt <christine.koppelt@gmail.com>";
   cleverca22 = "Michael Bishop <cleverca22@gmail.com>";
   cmcdragonkai = "Roger Qiu <roger.qiu@matrix.ai>";
@@ -166,7 +169,7 @@
   dtzWill = "Will Dietz <nix@wdtz.org>";
   dywedir = "Vladyslav M. <dywedir@protonmail.ch>";
   e-user = "Alexander Kahl <nixos@sodosopa.io>";
-  ebzzry = "Rommel Martinez <ebzzry@gmail.com>";
+  ebzzry = "Rommel Martinez <ebzzry@ebzzry.io>";
   edanaher = "Evan Danaher <nixos@edanaher.net>";
   edef = "edef <edef@edef.eu>";
   ederoyd46 = "Matthew Brown <matt@ederoyd.co.uk>";
@@ -189,12 +192,14 @@
   erikryb = "Erik Rybakken <erik.rybakken@math.ntnu.no>";
   ertes = "Ertugrul Söylemez <esz@posteo.de>";
   ethercrow = "Dmitry Ivanov <ethercrow@gmail.com>";
+  etu = "Elis Hirwing <elis@hirwing.se>";
   exi = "Reno Reckling <nixos@reckling.org>";
   exlevan = "Alexey Levan <exlevan@gmail.com>";
   expipiplus1 = "Joe Hermaszewski <nix@monoid.al>";
   fadenb = "Tristan Helmich <tristan.helmich+nixos@gmail.com>";
   fare = "Francois-Rene Rideau <fahree@gmail.com>";
   falsifian = "James Cook <james.cook@utoronto.ca>";
+  flokli = "Florian Klink <flokli@flokli.de>";
   florianjacob = "Florian Jacob <projects+nixos@florianjacob.de>";
   flosse = "Markus Kohlhase <mail@markus-kohlhase.de>";
   fluffynukeit = "Daniel Austin <dan@fluffynukeit.com>";
@@ -211,6 +216,7 @@
   fuuzetsu = "Mateusz Kowalczyk <fuuzetsu@fuuzetsu.co.uk>";
   fuzzy-id = "Thomas Bach <hacking+nixos@babibo.de>";
   fxfactorial = "Edgar Aroutiounian <edgar.factorial@gmail.com>";
+  gabesoft = "Gabriel Adomnicai <gabesoft@gmail.com>";
   gal_bolle = "Florent Becker <florent.becker@ens-lyon.org>";
   garbas = "Rok Garbas <rok@garbas.si>";
   garrison = "Jim Garrison <jim@garrison.cc>";
@@ -235,10 +241,12 @@
   guillaumekoenig = "Guillaume Koenig <guillaume.edward.koenig@gmail.com>";
   guyonvarch = "Joris Guyonvarch <joris@guyonvarch.me>";
   hakuch = "Jesse Haber-Kucharsky <hakuch@gmail.com>";
+  hamhut1066 = "Hamish Hutchings <github@hamhut1066.com>";
   havvy = "Ryan Scheel <ryan.havvy@gmail.com>";
   hbunke = "Hendrik Bunke <bunke.hendrik@gmail.com>";
   hce = "Hans-Christian Esperer <hc@hcesperer.org>";
   hectorj = "Hector Jusforgues <hector.jusforgues+nixos@gmail.com>";
+  hedning = "Tor Hedin Brønner <torhedinbronner@gmail.com>";
   heel = "Sergii Paryzhskyi <parizhskiy@gmail.com>";
   henrytill = "Henry Till <henrytill@gmail.com>";
   hhm = "hhm <heehooman+nixpkgs@gmail.com>";
@@ -251,6 +259,7 @@
   igsha = "Igor Sharonov <igor.sharonov@gmail.com>";
   ikervagyok = "Balázs Lengyel <ikervagyok@gmail.com>";
   infinisil = "Silvan Mosberger <infinisil@icloud.com>";
+  ironpinguin = "Michele Catalano <michele@catalano.de>";
   ivan-tkatchev = "Ivan Tkatchev <tkatchev@gmail.com>";
   j-keck = "Jürgen Keck <jhyphenkeck@gmail.com>";
   jagajaga = "Arseniy Seroka <ars.seroka@gmail.com>";
@@ -281,9 +290,10 @@
   johnramsden = "John Ramsden <johnramsden@riseup.net>";
   joko = "Ioannis Koutras <ioannis.koutras@gmail.com>";
   jonafato = "Jon Banafato <jon@jonafato.com>";
-  jpbernardy = "Jean-Philippe Bernardy <jeanphilippe.bernardy@gmail.com>";
+  joncojonathan = "Jonathan Haddock <joncojonathan@gmail.com>";
   jpierre03 = "Jean-Pierre PRUNARET <nix@prunetwork.fr>";
   jpotier = "Martin Potier <jpo.contributes.to.nixos@marvid.fr>";
+  jyp = "Jean-Philippe Bernardy <jeanphilippe.bernardy@gmail.com>";
   jraygauthier = "Raymond Gauthier <jraygauthier@gmail.com>";
   jtojnar = "Jan Tojnar <jtojnar@gmail.com>";
   juliendehos = "Julien Dehos <dehos@lisic.univ-littoral.fr>";
@@ -301,7 +311,7 @@
   kiloreux = "Kiloreux Emperex <kiloreux@gmail.com>";
   kkallio = "Karn Kallio <tierpluspluslists@gmail.com>";
   knedlsepp = "Josef Kemetmüller <josef.kemetmueller@gmail.com>";
-  konimex = "Muhammad Herdiansyah <herdiansyah@openmailbox.org>";
+  konimex = "Muhammad Herdiansyah <herdiansyah@netc.eu>";
   koral = "Koral <koral@mailoo.org>";
   kovirobi = "Kovacsics Robert <kovirobi@gmail.com>";
   kragniz = "Louis Taylor <louis@kragniz.eu>";
@@ -363,6 +373,7 @@
   meditans = "Carlo Nucera <meditans@gmail.com>";
   meisternu = "Matt Miemiec <meister@krutt.org>";
   metabar = "Celine Mercier <softs@metabarcoding.org>";
+  mgdelacroix = "Miguel de la Cruz <mgdelacroix@gmail.com>";
   mguentner = "Maximilian Güntner <code@klandest.in>";
   mic92 = "Jörg Thalheim <joerg@thalheim.io>";
   michaelpj = "Michael Peyton Jones <michaelpj@gmail.com>";
@@ -381,6 +392,7 @@
   mog = "Matthew O'Gorman <mog-lists@rldn.net>";
   montag451 = "montag451 <montag451@laposte.net>";
   moosingin3space = "Nathan Moos <moosingin3space@gmail.com>";
+  moredread = "André-Patrick Bubel <code@apb.name>";
   moretea = "Maarten Hoogendoorn <maarten@moretea.nl>";
   mornfall = "Petr Ročkai <me@mornfall.net>";
   MostAwesomeDude = "Corbin Simpson <cds@corbinsimpson.com>";
@@ -490,6 +502,7 @@
   renzo = "Renzo Carbonara <renzocarbonara@gmail.com>";
   retrry = "Tadas Barzdžius <retrry@gmail.com>";
   rht = "rht <rhtbot@protonmail.com>";
+  richardipsum = "Richard Ipsum <richardipsum@fastmail.co.uk>";
   rick68 = "Wei-Ming Yang <rick68@gmail.com>";
   rickynils = "Rickard Nilsson <rickynils@gmail.com>";
   ris = "Robert Scott <code@humanleg.org.uk>";
@@ -572,7 +585,9 @@
   taku0 = "Takuo Yonezawa <mxxouy6x3m_github@tatapa.org>";
   tari = "Peter Marheine <peter@taricorp.net>";
   tavyc = "Octavian Cerna <octavian.cerna@gmail.com>";
+  ltavard = "Laure Tavard <laure.tavard@univ-grenoble-alpes.fr>";
   teh = "Tom Hunger <tehunger@gmail.com>";
+  teto = "Matthieu Coudron <mcoudron@hotmail.com>";
   telotortium = "Robert Irelan <rirelan@gmail.com>";
   thall = "Niclas Thall <niclas.thall@gmail.com>";
   thammers = "Tobias Hammerschmidt <jawr@gmx.de>";
@@ -631,6 +646,7 @@
   wjlroe = "William Roe <willroe@gmail.com>";
   wkennington = "William A. Kennington III <william@wkennington.com>";
   wmertens = "Wout Mertens <Wout.Mertens@gmail.com>";
+  woffs = "Frank Doepper <github@woffs.de>";
   womfoo = "Kranium Gikos Mendoza <kranium@gikos.net>";
   wscott = "Wayne Scott <wsc9tt@gmail.com>";
   wyvie = "Elijah Rum <elijahrum@gmail.com>";
@@ -638,8 +654,11 @@
   xvapx = "Marti Serra <marti.serra.coscollano@gmail.com>";
   xwvvvvwx = "David Terry <davidterry@posteo.de>";
   yarr = "Dmitry V. <savraz@gmail.com>";
+  yegortimoshenko = "Yegor Timoshenko <yegortimoshenko@gmail.com>";
+  ylwghst = "Burim Augustin Berisa <ylwghst@onionmail.info>";
   yochai = "Yochai <yochai@titat.info>";
   yorickvp = "Yorick van Pelt <yorickvanpelt@gmail.com>";
+  ysndr = "Yannik Sander <me@ysndr.de>";
   yuriaisaka = "Yuri Aisaka <yuri.aisaka+nix@gmail.com>";
   yurrriq = "Eric Bailey <eric@ericb.me>";
   z77z = "Marco Maggesi <maggesi@math.unifi.it>";
@@ -654,4 +673,5 @@
   zoomulator = "Kim Simmons <zoomulator@gmail.com>";
   zraexy = "David Mell <zraexy@gmail.com>";
   zx2c4 = "Jason A. Donenfeld <Jason@zx2c4.com>";
+  zzamboni = "Diego Zamboni <diego@zzamboni.org>";
 }

lib/meta.nix

@@ -1,8 +1,7 @@
 /* Some functions for manipulating meta attributes, as well as the
    name attribute. */
 
-let lib = import ./default.nix;
-in
+{ lib }:
 
 rec {
 

lib/modules.nix

@@ -1,10 +1,12 @@
-with import ./lists.nix;
-with import ./strings.nix;
-with import ./trivial.nix;
-with import ./attrsets.nix;
-with import ./options.nix;
-with import ./debug.nix;
-with import ./types.nix;
+{ lib }:
+
+with lib.lists;
+with lib.strings;
+with lib.trivial;
+with lib.attrsets;
+with lib.options;
+with lib.debug;
+with lib.types;
 
 rec {
 

lib/options.nix

@@ -1,11 +1,10 @@
 # Nixpkgs/NixOS option handling.
+{ lib }:
 
-let lib = import ./default.nix; in
-
-with import ./trivial.nix;
-with import ./lists.nix;
-with import ./attrsets.nix;
-with import ./strings.nix;
+with lib.trivial;
+with lib.lists;
+with lib.attrsets;
+with lib.strings;
 
 rec {
 

lib/sandbox.nix

@@ -1,4 +1,5 @@
-with import ./strings.nix;
+{ lib }:
+with lib.strings;
 
 /* Helpers for creating lisp S-exprs for the Apple sandbox
 

lib/sources.nix

@@ -1,6 +1,5 @@
 # Functions for copying sources to the Nix store.
-
-let lib = import ./default.nix; in
+{ lib }:
 
 rec {
 
@@ -15,9 +14,10 @@ rec {
   cleanSourceFilter = name: type: let baseName = baseNameOf (toString name); in ! (
     # Filter out Subversion and CVS directories.
     (type == "directory" && (baseName == ".git" || baseName == ".svn" || baseName == "CVS" || baseName == ".hg")) ||
-    # Filter out backup files.
+    # Filter out editor backup / swap files.
     lib.hasSuffix "~" baseName ||
-    builtins.match "^.*\.sw[a-z]$" baseName != null ||
+    builtins.match "^\\.sw[a-z]$" baseName != null ||
+    builtins.match "^\\..*\\.sw[a-z]$" baseName != null ||
 
     # Filter out generates files.
     lib.hasSuffix ".o" baseName ||

lib/strings-with-deps.nix

@@ -1,3 +1,4 @@
+{ lib }:
 /*
 Usage:
 
@@ -40,9 +41,9 @@ Usage:
   [1] maybe this behaviour should be removed to keep things simple (?)
 */
 
-with import ./lists.nix;
-with import ./attrsets.nix;
-with import ./strings.nix;
+with lib.lists;
+with lib.attrsets;
+with lib.strings;
 
 rec {
 

lib/strings.nix

@@ -1,6 +1,6 @@
 /* String manipulation functions. */
-
-let lib = import ./default.nix;
+{ lib }:
+let
 
 inherit (builtins) length;
 
@@ -219,6 +219,14 @@ rec {
   */
   escapeShellArgs = concatMapStringsSep " " escapeShellArg;
 
+  /* Turn a string into a Nix expression representing that string
+
+     Example:
+       escapeNixString "hello\${}\n"
+       => "\"hello\\\${}\\n\""
+  */
+  escapeNixString = s: escape ["$"] (builtins.toJSON s);
+
   /* Obsolete - use replaceStrings instead. */
   replaceChars = builtins.replaceStrings or (
     del: new: s:

lib/systems/default.nix

@@ -1,11 +1,12 @@
-let inherit (import ../attrsets.nix) mapAttrs; in
+{ lib }:
+  let inherit (lib.attrsets) mapAttrs; in
 
 rec {
-  doubles = import ./doubles.nix;
-  parse = import ./parse.nix;
-  inspect = import ./inspect.nix;
-  platforms = import ./platforms.nix;
-  examples = import ./examples.nix;
+  doubles = import ./doubles.nix { inherit lib; };
+  parse = import ./parse.nix { inherit lib; };
+  inspect = import ./inspect.nix { inherit lib; };
+  platforms = import ./platforms.nix { inherit lib; };
+  examples = import ./examples.nix { inherit lib; };
 
   # Elaborate a `localSystem` or `crossSystem` so that it contains everything
   # necessary.
@@ -28,6 +29,15 @@ rec {
         else if final.isLinux  then "glibc"
         # TODO(@Ericson2314) think more about other operating systems
         else                        "native/impure";
+      extensions = {
+        sharedLibrary =
+          /**/ if final.isDarwin  then ".dylib"
+          else if final.isWindows then ".dll"
+          else                         ".so";
+        executable =
+          /**/ if final.isWindows then ".exe"
+          else                         "";
+      };
     } // mapAttrs (n: v: v final.parsed) inspect.predicates
       // args;
   in final;

lib/systems/doubles.nix

@@ -1,8 +1,9 @@
+{ lib }:
 let
-  lists = import ../lists.nix;
-  parse = import ./parse.nix;
-  inherit (import ./inspect.nix) predicates;
-  inherit (import ../attrsets.nix) matchAttrs;
+  inherit (lib) lists;
+  parse = import ./parse.nix { inherit lib; };
+  inherit (import ./inspect.nix { inherit lib; }) predicates;
+  inherit (lib.attrsets) matchAttrs;
 
   all = [
     "aarch64-linux"

lib/systems/examples.nix

@@ -1,8 +1,8 @@
 # These can be passed to nixpkgs as either the `localSystem` or
 # `crossSystem`. They are put here for user convenience, but also used by cross
 # tests and linux cross stdenv building, so handle with care!
-
-let platforms = import ./platforms.nix; in
+{ lib }:
+let platforms = import ./platforms.nix { inherit lib; }; in
 
 rec {
   #

lib/systems/inspect.nix

@@ -1,6 +1,7 @@
-with import ./parse.nix;
-with import ../attrsets.nix;
-with import ../lists.nix;
+{ lib }:
+with import ./parse.nix { inherit lib; };
+with lib.attrsets;
+with lib.lists;
 
 rec {
   patterns = rec {

lib/systems/parse.nix

@@ -4,14 +4,13 @@
 # http://llvm.org/docs/doxygen/html/Triple_8cpp_source.html especially
 # Triple::normalize. Parsing should essentially act as a more conservative
 # version of that last function.
-
-with import ../lists.nix;
-with import ../types.nix;
-with import ../attrsets.nix;
-with (import ./inspect.nix).predicates;
+{ lib }:
+with lib.lists;
+with lib.types;
+with lib.attrsets;
+with (import ./inspect.nix { inherit lib; }).predicates;
 
 let
-  lib = import ../default.nix;
   setTypesAssert = type: pred:
     mapAttrs (name: value:
       assert pred value;

lib/systems/platforms.nix

@@ -1,3 +1,4 @@
+{ lib }:
 rec {
   pcBase = {
     name = "pc";

lib/trivial.nix

@@ -1,3 +1,4 @@
+{ lib }:
 rec {
 
   /* The identity function
@@ -55,7 +56,7 @@ rec {
     isInt add sub lessThan
     seq deepSeq genericClosure;
 
-  inherit (import ./strings.nix) fileContents;
+  inherit (lib.strings) fileContents;
 
   # Return the Nixpkgs version number.
   nixpkgsVersion =

lib/types.nix

@@ -1,15 +1,16 @@
 # Definitions related to run-time type checking.  Used in particular
 # to type-check NixOS configurations.
+{ lib }:
+with lib.lists;
+with lib.attrsets;
+with lib.options;
+with lib.trivial;
+with lib.strings;
+let
 
-with import ./lists.nix;
-with import ./attrsets.nix;
-with import ./options.nix;
-with import ./trivial.nix;
-with import ./strings.nix;
-let inherit (import ./modules.nix) mergeDefinitions filterOverrides; in
-
+  inherit (lib.modules) mergeDefinitions filterOverrides;
+  outer_types =
 rec {
-
   isType = type: x: (x._type or "") == type;
 
   setType = typeName: value: value // {
@@ -95,7 +96,6 @@ rec {
   # When adding new types don't forget to document them in
   # nixos/doc/manual/development/option-types.xml!
   types = rec {
-
     unspecified = mkOptionType {
       name = "unspecified";
     };
@@ -121,6 +121,13 @@ rec {
       merge = mergeOneOption;
     };
 
+    strMatching = pattern: mkOptionType {
+      name = "strMatching ${escapeNixString pattern}";
+      description = "string matching the pattern ${pattern}";
+      check = x: str.check x && builtins.match pattern x != null;
+      inherit (str) merge;
+    };
+
     # Merge multiple definitions by concatenating them (with the given
     # separator between the values).
     separatedString = sep: mkOptionType rec {
@@ -291,7 +298,7 @@ rec {
     submodule = opts:
       let
         opts' = toList opts;
-        inherit (import ./modules.nix) evalModules;
+        inherit (lib.modules) evalModules;
       in
       mkOptionType rec {
         name = "submodule";
@@ -395,5 +402,6 @@ rec {
     addCheck = elemType: check: elemType // { check = x: elemType.check x && check x; };
 
   };
+};
 
-}
+in outer_types // outer_types.types

maintainers/scripts/copy-tarballs.pl

@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i perl -p perl perlPackages.NetAmazonS3 perlPackages.FileSlurp nixUnstable
+#! nix-shell -i perl -p perl perlPackages.NetAmazonS3 perlPackages.FileSlurp nixUnstable nixUnstable.perl-bindings
 
 # This command uploads tarballs to tarballs.nixos.org, the
 # content-addressed cache used by fetchurl as a fallback for when
@@ -59,6 +59,7 @@ my $s3 = Net::Amazon::S3->new(
     { aws_access_key_id     => $aws_access_key_id,
       aws_secret_access_key => $aws_secret_access_key,
       retry                 => 1,
+      host                  => "s3-eu-west-1.amazonaws.com",
     });
 
 my $bucket = $s3->bucket("nixpkgs-tarballs") or die;

maintainers/scripts/gnome.sh

@@ -9,17 +9,15 @@ GNOME_FTP=ftp.gnome.org/pub/GNOME/sources
 NO_GNOME_MAJOR="ghex gtkhtml gdm"
 
 usage() {
-  echo "Usage: $0 gnome_dir <show project>|<update project>|<update-all> [major.minor]" >&2
-  echo "gnome_dir is for example pkgs/desktops/gnome-3/3.18" >&2
+  echo "Usage: $0 <show project>|<update project>|<update-all> [major.minor]" >&2
   exit 0
 }
 
-if [ "$#" -lt 2 ]; then
+if [ "$#" -lt 1 ]; then
   usage
 fi
 
-GNOME_TOP=$1
-shift
+GNOME_TOP=pkgs/desktops/gnome-3
 
 action=$1
 

maintainers/scripts/hydra-eval-failures.py

@@ -13,10 +13,8 @@ from pyquery import PyQuery as pq
 
 
 maintainers_json = subprocess.check_output([
-    'nix-instantiate',
-    'lib/maintainers.nix',
-    '--eval',
-    '--json'])
+    'nix-instantiate', '-E', 'import ./lib/maintainers.nix {}', '--eval', '--json'
+])
 maintainers = json.loads(maintainers_json)
 MAINTAINERS = {v: k for k, v in maintainers.iteritems()}
 
@@ -51,8 +49,8 @@ def get_maintainers(attr_name):
 @click.command()
 @click.option(
     '--jobset',
-    default="nixos/release-17.03",
-    help='Hydra project like nixos/release-17.03')
+    default="nixos/release-17.09",
+    help='Hydra project like nixos/release-17.09')
 def cli(jobset):
     """
     Given a Hydra project, inspect latest evaluation

maintainers/scripts/travis-nox-review-pr.sh

@@ -1,82 +0,0 @@
-#! /usr/bin/env bash
-set -e
-
-while test -n "$1"; do
-
-    # tell Travis to use folding
-    echo -en "travis_fold:start:$1\r"
-
-    case $1 in
-
-        nixpkgs-verify)
-            echo "=== Verifying that nixpkgs evaluates..."
-
-            nix-env --file $TRAVIS_BUILD_DIR --query --available --json > /dev/null
-            ;;
-
-        nixos-options)
-            echo "=== Checking NixOS options"
-
-            nix-build $TRAVIS_BUILD_DIR/nixos/release.nix --attr options --show-trace
-            ;;
-
-        nixos-manual)
-            echo "=== Checking NixOS manuals"
-
-            nix-build $TRAVIS_BUILD_DIR/nixos/release.nix --attr manual --show-trace
-            ;;
-
-        nixpkgs-manual)
-            echo "=== Checking nixpkgs manuals"
-
-            nix-build $TRAVIS_BUILD_DIR/pkgs/top-level/release.nix --attr manual --show-trace
-            ;;
-
-        nixpkgs-tarball)
-            echo "=== Checking nixpkgs tarball creation"
-
-            nix-build $TRAVIS_BUILD_DIR/pkgs/top-level/release.nix --attr tarball --show-trace
-            ;;
-
-        nixpkgs-unstable)
-            echo "=== Checking nixpkgs unstable job"
-
-            nix-instantiate $TRAVIS_BUILD_DIR/pkgs/top-level/release.nix --attr unstable --show-trace
-            ;;
-
-        nixpkgs-lint)
-            echo "=== Checking nixpkgs lint"
-
-            nix-shell --packages nixpkgs-lint --run "nixpkgs-lint -f $TRAVIS_BUILD_DIR"
-            ;;
-
-        nox)
-            echo "=== Fetching Nox from binary cache"
-
-            # build nox (+ a basic nix-shell env) silently so it's not in the log
-            nix-shell -p nox stdenv --command true
-            ;;
-
-        pr)
-            if [ "$TRAVIS_PULL_REQUEST" == "false" ]; then
-                echo "=== No pull request found"
-            else
-                echo "=== Building pull request #$TRAVIS_PULL_REQUEST"
-
-                token=""
-                if [ -n "$GITHUB_TOKEN" ]; then
-                    token="--token $GITHUB_TOKEN"
-                fi
-
-                nix-shell --packages nox --run "nox-review pr --slug $TRAVIS_REPO_SLUG $token $TRAVIS_PULL_REQUEST"
-            fi
-            ;;
-
-        *)
-            echo "Skipping unknown option $1"
-            ;;
-    esac
-
-    echo -en "travis_fold:end:$1\r"
-    shift
-done

nixos/doc/manual/administration/declarative-containers.xml

@@ -16,7 +16,7 @@ containers.database =
   { config =
       { config, pkgs, ... }:
       { services.postgresql.enable = true;
-        services.postgresql.package = pkgs.postgresql92;
+        services.postgresql.package = pkgs.postgresql96;
       };
   };
 </programlisting>

nixos/doc/manual/configuration/summary.xml

@@ -113,7 +113,8 @@ manual</link> for the rest.</para>
       </row>
       <row>
         <entry><literal>assert 1 + 1 == 2; "yes!"</literal></entry>
-        <entry>Assertion check (evaluates to <literal>"yes!"</literal>)</entry>
+        <entry>Assertion check (evaluates to <literal>"yes!"</literal>). See <xref
+    linkend="sec-assertions"/> for using assertions in modules</entry>
       </row>
       <row>
         <entry><literal>let x = "foo"; y = "bar"; in x + y</literal></entry>

nixos/doc/manual/development/assertions.xml

@@ -0,0 +1,80 @@
+<section xmlns="http://docbook.org/ns/docbook"
+        xmlns:xlink="http://www.w3.org/1999/xlink"
+        xmlns:xi="http://www.w3.org/2001/XInclude"
+        version="5.0"
+        xml:id="sec-assertions">
+
+<title>Warnings and Assertions</title>
+
+<para>
+  When configuration problems are detectable in a module, it is a good
+  idea to write an assertion or warning. Doing so provides clear
+  feedback to the user and prevents errors after the build.
+</para>
+
+<para>
+  Although Nix has the <literal>abort</literal> and
+  <literal>builtins.trace</literal> <link xlink:href="https://nixos.org/nix/manual/#ssec-builtins">functions</link> to perform such tasks,
+  they are not ideally suited for NixOS modules. Instead of these
+  functions, you can declare your warnings and assertions using the
+  NixOS module system.
+</para>
+
+<section>
+
+<title>Warnings</title>
+
+<para>
+  This is an example of using <literal>warnings</literal>.
+</para>
+
+<programlisting>
+<![CDATA[
+{ config, lib, ... }:
+{
+  config = lib.mkIf config.services.foo.enable {
+    warnings =
+      if config.services.foo.bar
+      then [ ''You have enabled the bar feature of the foo service.
+               This is known to cause some specific problems in certain situations.
+               '' ]
+      else [];
+  }
+}
+]]>
+</programlisting>
+
+</section>
+
+<section>
+
+<title>Assertions</title>
+
+
+<para>
+  This example, extracted from the
+  <link xlink:href="https://github.com/NixOS/nixpkgs/blob/release-17.09/nixos/modules/services/logging/syslogd.nix">
+    <literal>syslogd</literal> module
+  </link> shows how to use <literal>assertions</literal>. Since there
+  can only be one active syslog daemon at a time, an assertion is useful to
+  prevent such a broken system from being built.
+</para>
+
+<programlisting>
+<![CDATA[
+{ config, lib, ... }:
+{
+  config = lib.mkIf config.services.syslogd.enable {
+    assertions =
+      [ { assertion = !config.services.rsyslogd.enable;
+          message = "rsyslogd conflicts with syslogd";
+        }
+      ];
+  }
+}
+]]>
+</programlisting>
+
+</section>
+
+</section>

nixos/doc/manual/development/option-declarations.xml

@@ -137,8 +137,8 @@ services.xserver.displayManager.enable = mkOption {
 };</screen></example>
 
 <example xml:id='ex-option-declaration-eot-backend-sddm'><title>Extending
-    <literal>services.foo.backend</literal> in the <literal>sddm</literal>
-    module</title>
+    <literal>services.xserver.displayManager.enable</literal> in the 
+    <literal>sddm</literal> module</title>
 <screen>
 services.xserver.displayManager.enable = mkOption {
   type = with types; nullOr (enum [ "sddm" ]);

nixos/doc/manual/development/option-types.xml

@@ -62,6 +62,12 @@
     <listitem><para>A string. Multiple definitions are concatenated with a 
         collon <literal>":"</literal>.</para></listitem>
   </varlistentry>
+  <varlistentry>
+    <term><varname>types.strMatching</varname></term>
+    <listitem><para>A string matching a specific regular expression. Multiple
+    definitions cannot be merged.  The regular expression is processed using
+    <literal>builtins.match</literal>.</para></listitem>
+  </varlistentry>
 </variablelist>
 
  </section>
@@ -157,27 +163,26 @@
 
 <section xml:id='section-option-types-submodule'><title>Submodule</title>
 
-  <para>Submodule is a very powerful type that defines a set of sub-options that 
-    are handled like a separate module.
-    It is especially interesting when used with composed types like 
-    <literal>attrsOf</literal> or <literal>listOf</literal>.</para>
+  <para><literal>submodule</literal> is a very powerful type that defines a set
+    of sub-options that are handled like a separate module.</para>
 
-  <para>The submodule type take a parameter <replaceable>o</replaceable>, that 
-    should be a set, or a function returning a set with an 
-    <literal>options</literal> key defining the sub-options.
-    The option set can be defined directly (<xref linkend='ex-submodule-direct' 
-      />) or as reference (<xref linkend='ex-submodule-reference' />).</para>
+  <para>It takes a parameter <replaceable>o</replaceable>, that should be a set,
+    or a function returning a set with an <literal>options</literal> key
+    defining the sub-options.
+    Submodule option definitions are type-checked accordingly to the
+    <literal>options</literal> declarations.
+    Of course, you can nest submodule option definitons for even higher
+    modularity.</para>
 
-  <para>Submodule option definitions are type-checked accordingly to the options 
-    declarations. It is possible to declare submodule options inside a submodule 
-    sub-options for even higher modularity.</para>
+  <para>The option set can be defined directly
+    (<xref linkend='ex-submodule-direct' />) or as reference
+    (<xref linkend='ex-submodule-reference' />).</para>
 
 <example xml:id='ex-submodule-direct'><title>Directly defined submodule</title>
 <screen>
 options.mod = mkOption {
-  name = "mod";
   description = "submodule example";
-  type = with types; listOf (submodule {
+  type = with types; submodule {
     options = {
       foo = mkOption {
         type = int;
@@ -186,10 +191,10 @@ options.mod = mkOption {
         type = str;
       };
     };
-  });
+  };
 };</screen></example>
 
-<example xml:id='ex-submodule-reference'><title>Submodule defined as a 
+<example xml:id='ex-submodule-reference'><title>Submodule defined as a
     reference</title>
 <screen>
 let
@@ -206,16 +211,20 @@ let
 in
 options.mod = mkOption {
   description = "submodule example";
-  type = with types; listOf (submodule modOptions);
+  type = with types; submodule modOptions;
 };</screen></example>
 
-<section><title>Composed with <literal>listOf</literal></title>
-
-  <para>When composed with <literal>listOf</literal>, submodule allows multiple 
-    definitions of the submodule option set.</para>
+  <para>The <literal>submodule</literal> type is especially interesting when
+    used with composed types like <literal>attrsOf</literal> or
+    <literal>listOf</literal>.
+    When composed with <literal>listOf</literal>
+    (<xref linkend='ex-submodule-listof-declaration' />),
+    <literal>submodule</literal> allows multiple definitions of the submodule
+    option set (<xref linkend='ex-submodule-listof-definition' />).</para>
+    
 
 <example xml:id='ex-submodule-listof-declaration'><title>Declaration of a list 
-    of submodules</title>
+    nof submodules</title>
 <screen>
 options.mod = mkOption {
   description = "submodule example";
@@ -239,13 +248,11 @@ config.mod = [
   { foo = 2; bar = "two"; }
 ];</screen></example>
 
-</section>
-
-
-<section><title>Composed with <literal>attrsOf</literal></title>
-
-  <para>When composed with <literal>attrsOf</literal>, submodule allows multiple 
-    named definitions of the submodule option set.</para>
+  <para>When composed with <literal>attrsOf</literal>
+    (<xref linkend='ex-submodule-attrsof-declaration' />),
+    <literal>submodule</literal> allows multiple named definitions of the
+    submodule option set (<xref linkend='ex-submodule-attrsof-definition' />).
+  </para>
 
 <example xml:id='ex-submodule-attrsof-declaration'><title>Declaration of 
     attribute sets of submodules</title>
@@ -270,7 +277,6 @@ options.mod = mkOption {
 config.mod.one = { foo = 1; bar = "one"; };
 config.mod.two = { foo = 2; bar = "two"; };</screen></example>
 
-</section>
 </section>
 
 <section><title>Extending types</title>

nixos/doc/manual/development/releases.xml

@@ -161,6 +161,11 @@
           </link>
         </para>
       </listitem>
+      <listitem>
+        <para>
+          Set a release date in the release notes.
+        </para>
+      </listitem>
       <listitem>
         <para>
           Change <literal>stableBranch</literal> to true and wait for channel to update.
@@ -195,7 +200,7 @@
       </listitem>
       <listitem>
         <para>
-          Send an email to nix-dev to announce the release with above information. Best to check how previous email was formulated
+          Send an email to nix-devel to announce the release with above information. Best to check how previous email was formulated
           to see what needs to be included.
         </para>
       </listitem>
@@ -223,27 +228,27 @@
       <tbody>
         <row>
           <entry>
-            2016-07-25
+            2018-01-31
           </entry>
           <entry>
-            Send email to nix-dev about upcoming branch-off
+            Send email to nix-devel about upcoming branch-off
           </entry>
         </row>
         <row>
           <entry>
-            2016-09-01
+            2018-02-28
           </entry>
           <entry>
-            <literal>release-16.09</literal> branch and corresponding jobsets are created,
+            <literal>release-18.03</literal> branch and corresponding jobsets are created,
             change freeze
           </entry>
         </row>
         <row>
           <entry>
-            2016-09-30
+            2018-03-29
           </entry>
           <entry>
-            NixOS 16.09 released
+            NixOS 18.03 released
           </entry>
         </row>
       </tbody>

nixos/doc/manual/development/writing-modules.xml

@@ -178,6 +178,7 @@ in {
 <xi:include href="option-declarations.xml" />
 <xi:include href="option-types.xml" />
 <xi:include href="option-def.xml" />
+<xi:include href="assertions.xml" />
 <xi:include href="meta-attributes.xml" />
 <xi:include href="replace-modules.xml" />
 

nixos/doc/manual/installation/installing-usb.xml

@@ -31,7 +31,7 @@ ISO, copy its contents verbatim to your drive, then either:
     <para>Edit <filename>loader/entries/nixos-livecd.conf</filename> on the drive
     and change the <literal>root=</literal> field in the <literal>options</literal>
     line to point to your drive (see the documentation on <literal>root=</literal>
-    in <link xlink:href="https://www.kernel.org/doc/Documentation/kernel-parameters.txt">
+    in <link xlink:href="https://www.kernel.org/doc/Documentation/admin-guide/kernel-parameters.txt">
     the kernel documentation</link> for more details).</para>
   </listitem>
   <listitem>

nixos/doc/manual/release-notes/rl-1609.xml

@@ -176,7 +176,7 @@ following incompatible changes:</para>
   streamlined.  Desktop users should be able to simply set
   <programlisting>security.grsecurity.enable = true</programlisting> to get
   a reasonably secure system without having to sacrifice too much
-  functionality.  See <xref linkend="sec-grsecurity" /> for documentation
+  functionality.
   </para></listitem>
 
   <listitem><para>Special filesystems, like <literal>/proc</literal>,

nixos/doc/manual/release-notes/rl-1709.xml

@@ -4,7 +4,15 @@
          version="5.0"
          xml:id="sec-release-17.09">
 
-<title>Release 17.09 (“Hummingbird”, 2017/09/??)</title>
+<title>Release 17.09 (“Hummingbird”, 2017/09/29)</title>
+
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-17.09-highlights">
+
+<title>Highlights</title>
 
 <para>In addition to numerous new and upgraded packages, this release
 has the following highlights: </para>
@@ -12,7 +20,8 @@ has the following highlights: </para>
 <itemizedlist>
   <listitem>
     <para>
-      The GNOME version is now 3.24.
+      The GNOME version is now 3.24. KDE Plasma was upgraded to 5.10,
+      KDE Applications to 17.08.1 and KDE Frameworks to 5.37.
     </para>
   </listitem>
   <listitem>
@@ -45,16 +54,130 @@ has the following highlights: </para>
       even though <literal>HDMI-0</literal> is the first head in the list.
     </para>
   </listitem>
+  <listitem>
+    <para>
+      The handling of SSL in the <literal>services.nginx</literal> module has
+      been cleaned up, renaming the misnamed <literal>enableSSL</literal> to
+      <literal>onlySSL</literal> which reflects its original intention. This
+      is not to be used with the already existing <literal>forceSSL</literal>
+      which creates a second non-SSL virtual host redirecting to the SSL
+      virtual host. This by chance had worked earlier due to specific
+      implementation details. In case you had specified both please remove
+      the <literal>enableSSL</literal> option to keep the previous behaviour.
+    </para>
+    <para>
+      Another <literal>addSSL</literal> option has been introduced to configure
+      both a non-SSL virtual host and an SSL virtual host with the same
+      configuration.
+    </para>
+    <para>
+      Options to configure <literal>resolver</literal> options and
+      <literal>upstream</literal> blocks have been introduced. See their information
+      for further details.
+    </para>
+    <para>
+      The <literal>port</literal> option has been replaced by a more generic
+      <literal>listen</literal> option which makes it possible to specify
+      multiple addresses, ports and SSL configs dependant on the new SSL
+      handling mentioned above.
+    </para>
+  </listitem>
 </itemizedlist>
 
+</section>
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-17.09-new-services">
+
+<title>New Services</title>
+
 <para>The following new services were added since the last release:</para>
 
 <itemizedlist>
-  <listitem>
-    <para></para>
-  </listitem>
+  <listitem><para><literal>config/fonts/fontconfig-penultimate.nix</literal></para></listitem>
+  <listitem><para><literal>config/fonts/fontconfig-ultimate.nix</literal></para></listitem>
+  <listitem><para><literal>config/terminfo.nix</literal></para></listitem>
+  <listitem><para><literal>hardware/sensor/iio.nix</literal></para></listitem>
+  <listitem><para><literal>hardware/nitrokey.nix</literal></para></listitem>
+  <listitem><para><literal>hardware/raid/hpsa.nix</literal></para></listitem>
+  <listitem><para><literal>programs/browserpass.nix</literal></para></listitem>
+  <listitem><para><literal>programs/gnupg.nix</literal></para></listitem>
+  <listitem><para><literal>programs/qt5ct.nix</literal></para></listitem>
+  <listitem><para><literal>programs/slock.nix</literal></para></listitem>
+  <listitem><para><literal>programs/thefuck.nix</literal></para></listitem>
+  <listitem><para><literal>security/auditd.nix</literal></para></listitem>
+  <listitem><para><literal>security/lock-kernel-modules.nix</literal></para></listitem>
+  <listitem><para><literal>service-managers/docker.nix</literal></para></listitem>
+  <listitem><para><literal>service-managers/trivial.nix</literal></para></listitem>
+  <listitem><para><literal>services/admin/salt/master.nix</literal></para></listitem>
+  <listitem><para><literal>services/admin/salt/minion.nix</literal></para></listitem>
+  <listitem><para><literal>services/audio/slimserver.nix</literal></para></listitem>
+  <listitem><para><literal>services/cluster/kubernetes/default.nix</literal></para></listitem>
+  <listitem><para><literal>services/cluster/kubernetes/dns.nix</literal></para></listitem>
+  <listitem><para><literal>services/cluster/kubernetes/dashboard.nix</literal></para></listitem>
+  <listitem><para><literal>services/continuous-integration/hail.nix</literal></para></listitem>
+  <listitem><para><literal>services/databases/clickhouse.nix</literal></para></listitem>
+  <listitem><para><literal>services/databases/postage.nix</literal></para></listitem>
+  <listitem><para><literal>services/desktops/gnome3/gnome-disks.nix</literal></para></listitem>
+  <listitem><para><literal>services/desktops/gnome3/gpaste.nix</literal></para></listitem>
+  <listitem><para><literal>services/logging/SystemdJournal2Gelf.nix</literal></para></listitem>
+  <listitem><para><literal>services/logging/heartbeat.nix</literal></para></listitem>
+  <listitem><para><literal>services/logging/journalwatch.nix</literal></para></listitem>
+  <listitem><para><literal>services/logging/syslogd.nix</literal></para></listitem>
+  <listitem><para><literal>services/mail/mailhog.nix</literal></para></listitem>
+  <listitem><para><literal>services/mail/nullmailer.nix</literal></para></listitem>
+  <listitem><para><literal>services/misc/airsonic.nix</literal></para></listitem>
+  <listitem><para><literal>services/misc/autorandr.nix</literal></para></listitem>
+  <listitem><para><literal>services/misc/exhibitor.nix</literal></para></listitem>
+  <listitem><para><literal>services/misc/fstrim.nix</literal></para></listitem>
+  <listitem><para><literal>services/misc/gollum.nix</literal></para></listitem>
+  <listitem><para><literal>services/misc/irkerd.nix</literal></para></listitem>
+  <listitem><para><literal>services/misc/jackett.nix</literal></para></listitem>
+  <listitem><para><literal>services/misc/radarr.nix</literal></para></listitem>
+  <listitem><para><literal>services/misc/snapper.nix</literal></para></listitem>
+  <listitem><para><literal>services/monitoring/osquery.nix</literal></para></listitem>
+  <listitem><para><literal>services/monitoring/prometheus/collectd-exporter.nix</literal></para></listitem>
+  <listitem><para><literal>services/monitoring/prometheus/fritzbox-exporter.nix</literal></para></listitem>
+  <listitem><para><literal>services/network-filesystems/kbfs.nix</literal></para></listitem>
+  <listitem><para><literal>services/networking/dnscache.nix</literal></para></listitem>
+  <listitem><para><literal>services/networking/fireqos.nix</literal></para></listitem>
+  <listitem><para><literal>services/networking/iwd.nix</literal></para></listitem>
+  <listitem><para><literal>services/networking/keepalived/default.nix</literal></para></listitem>
+  <listitem><para><literal>services/networking/keybase.nix</literal></para></listitem>
+  <listitem><para><literal>services/networking/lldpd.nix</literal></para></listitem>
+  <listitem><para><literal>services/networking/matterbridge.nix</literal></para></listitem>
+  <listitem><para><literal>services/networking/squid.nix</literal></para></listitem>
+  <listitem><para><literal>services/networking/tinydns.nix</literal></para></listitem>
+  <listitem><para><literal>services/networking/xrdp.nix</literal></para></listitem>
+  <listitem><para><literal>services/security/shibboleth-sp.nix</literal></para></listitem>
+  <listitem><para><literal>services/security/sks.nix</literal></para></listitem>
+  <listitem><para><literal>services/security/sshguard.nix</literal></para></listitem>
+  <listitem><para><literal>services/security/torify.nix</literal></para></listitem>
+  <listitem><para><literal>services/security/usbguard.nix</literal></para></listitem>
+  <listitem><para><literal>services/security/vault.nix</literal></para></listitem>
+  <listitem><para><literal>services/system/earlyoom.nix</literal></para></listitem>
+  <listitem><para><literal>services/system/saslauthd.nix</literal></para></listitem>
+  <listitem><para><literal>services/web-apps/nexus.nix</literal></para></listitem>
+  <listitem><para><literal>services/web-apps/pgpkeyserver-lite.nix</literal></para></listitem>
+  <listitem><para><literal>services/web-apps/piwik.nix</literal></para></listitem>
+  <listitem><para><literal>services/web-servers/lighttpd/collectd.nix</literal></para></listitem>
+  <listitem><para><literal>services/web-servers/minio.nix</literal></para></listitem>
+  <listitem><para><literal>services/x11/display-managers/xpra.nix</literal></para></listitem>
+  <listitem><para><literal>services/x11/xautolock.nix</literal></para></listitem>
+  <listitem><para><literal>tasks/filesystems/bcachefs.nix</literal></para></listitem>
+  <listitem><para><literal>tasks/powertop.nix</literal></para></listitem>
 </itemizedlist>
 
+</section>
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-17.09-incompatibilities">
+
+<title>Backward Incompatibilities</title>
 
 <para>When upgrading from a previous release, please be aware of the
 following incompatible changes:</para>
@@ -62,10 +185,97 @@ following incompatible changes:</para>
 <itemizedlist>
   <listitem>
     <para>
-      <literal>aiccu</literal> package was removed. This is due to SixXS
+        <emphasis role="strong">
+            In an Qemu-based virtualization environment, the network interface
+            names changed from i.e. <literal>enp0s3</literal> to
+            <literal>ens3</literal>.
+        </emphasis>
+    </para>
+    <para>
+        This is due to a kernel configuration change. The new naming
+        is consistent with those of other Linux distributions with
+        systemd. See
+        <link xlink:href="https://github.com/NixOS/nixpkgs/issues/29197">#29197</link>
+        for more information.
+    </para>
+    <para>
+        A machine is affected if the <literal>virt-what</literal> tool
+        either returns <literal>qemu</literal> or
+        <literal>kvm</literal> <emphasis>and</emphasis> has
+        interface names used in any part of its NixOS configuration,
+        in particular if a static network configuration with
+        <literal>networking.interfaces</literal> is used.
+    </para>
+    <para>
+        Before rebooting affected machines, please ensure:
+        <itemizedlist>
+          <listitem>
+            <para>
+              Change the interface names in your NixOS configuration.
+              The first interface will be called <literal>ens3</literal>,
+              the second one <literal>ens8</literal> and starting from there
+              incremented by 1.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              After changing the interface names, rebuild your system with
+              <literal>nixos-rebuild boot</literal> to activate the new
+              configuration after a reboot. If you switch to the new
+              configuration right away you might lose network connectivity!
+              If using <literal>nixops</literal>, deploy with
+              <literal>nixops deploy --force-reboot</literal>.
+            </para>
+          </listitem>
+        </itemizedlist>
+    </para>
+  </listitem>
+  <listitem>
+    <para>
+      The following changes apply if the <literal>stateVersion</literal> is changed to 17.09 or higher.
+      For <literal>stateVersion = "17.03"</literal> or lower the old behavior is preserved.
+    </para>
+    <itemizedlist>
+      <listitem>
+        <para>
+          The <literal>postgres</literal> default version was changed from 9.5 to 9.6.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>postgres</literal> superuser name has changed from <literal>root</literal> to <literal>postgres</literal> to more closely follow what other Linux distributions are doing.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>postgres</literal> default <literal>dataDir</literal> has changed from <literal>/var/db/postgres</literal> to <literal>/var/lib/postgresql/$psqlSchema</literal> where $psqlSchema is 9.6 for example.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          The <literal>mysql</literal> default <literal>dataDir</literal> has changed from <literal>/var/mysql</literal> to <literal>/var/lib/mysql</literal>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Radicale's default package has changed from 1.x to 2.x. Instructions to migrate can be found <link xlink:href="http://radicale.org/1to2/"> here </link>. It is also possible to use the newer version by setting the <literal>package</literal> to <literal>radicale2</literal>, which is done automatically when <literal>stateVersion</literal> is 17.09 or higher. The <literal>extraArgs</literal> option has been added to allow passing the data migration arguments specified in the instructions; see the <filename xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/radicale.nix">radicale.nix</filename> NixOS test for an example migration.
+        </para>
+      </listitem>
+    </itemizedlist>
+  </listitem>
+  <listitem>
+    <para>
+      The <literal>aiccu</literal> package was removed. This is due to SixXS
       <link xlink:href="https://www.sixxs.net/main/"> sunsetting</link> its IPv6 tunnel.
     </para>
   </listitem>
+  <listitem>
+    <para>
+      The <literal>fanctl</literal> package and <literal>fan</literal> module
+      have been removed due to the developers not upstreaming their iproute2
+      patches and lagging with compatibility to recent iproute2 versions.
+    </para>
+  </listitem>
   <listitem>
     <para>
       Top-level <literal>idea</literal> package collection was renamed.
@@ -81,7 +291,7 @@ following incompatible changes:</para>
   </listitem>
   <listitem>
     <para>
-      The ipfs package now doesn't ignore the <literal>dataDir</literal> option anymore. If you've ever set this option to anything other than the default you'll have to either unset it (so the default gets used) or migrate the old data manually with
+      The <literal>ipfs</literal> service now doesn't ignore the <literal>dataDir</literal> option anymore. If you've ever set this option to anything other than the default you'll have to either unset it (so the default gets used) or migrate the old data manually with
 <programlisting>
 dataDir=&lt;valueOfDataDir&gt;
 mv /var/lib/ipfs/.ipfs/* $dataDir
@@ -89,32 +299,11 @@ rmdir /var/lib/ipfs/.ipfs
 </programlisting>
     </para>
   </listitem>
-  <listitem>
-    <para>
-      The following changes apply if the <literal>stateVersion</literal> is changed to 17.09 or higher.
-      For <literal>stateVersion = "17.03</literal> or lower the old behavior is preserved.
-    </para>
-    <para>
-      The <literal>postgres</literal> default version was changed from 9.5 to 9.6.
-    </para>
-    <para>
-      The <literal>postgres</literal> superuser name has changed from <literal>root</literal> to <literal>postgres</literal> to more closely follow what other Linux distributions are doing.
-    </para>
-    <para>
-      The <literal>postgres</literal> default <literal>dataDir</literal> has changed from <literal>/var/db/postgres</literal> to <literal>/var/lib/postgresql/$psqlSchema</literal> where $psqlSchema is 9.6 for example.
-    </para>
-    <para>
-      The <literal>mysql</literal> default <literal>dataDir</literal> has changed from <literal>/var/mysql</literal> to <literal>/var/lib/mysql</literal>.
-    </para>
-    <para>
-      Radicale's default package has changed from 1.x to 2.x. Instructions to migrate can be found <link xlink:href="http://radicale.org/1to2/"> here </link>. It is also possible to use the newer version by setting the <literal>package</literal> to <literal>radicale2</literal>, which is done automatically when <literal>stateVersion</literal> is 17.09 or higher.
-    </para>
-  </listitem>
   <listitem>
     <para>
       The <literal>caddy</literal> service was previously using an extra
-      <literal>.caddy</literal> in the data directory specified with the
-      <literal>dataDir</literal> option. The contents of the
+      <literal>.caddy</literal> directory in the data directory specified
+      with the <literal>dataDir</literal> option. The contents of the
       <literal>.caddy</literal> directory are now expected to be in the
       <literal>dataDir</literal>.
     </para>
@@ -176,9 +365,139 @@ rmdir /var/lib/ipfs/.ipfs
       removed. The system support had been broken for several years.
     </para>
   </listitem>
+  <listitem>
+    <para>
+      Touchpad support should now be enabled through
+      <literal>libinput</literal> as <literal>synaptics</literal> is
+      now deprecated. See the option
+      <literal>services.xserver.libinput.enable</literal>.
+    </para>
+  </listitem>
+  <listitem>
+    <para>
+      grsecurity/PaX support has been dropped, following upstream's
+      decision to cease free support.  See
+      <link xlink:href="https://grsecurity.net/passing_the_baton.php">
+      upstream's announcement</link> for more information.
+      No complete replacement for grsecurity/PaX is available presently.
+    </para>
+  </listitem>
+  <listitem>
+    <para>
+      <literal>services.mysql</literal> now has declarative
+      configuration of databases and users with the <literal>ensureDatabases</literal> and
+      <literal>ensureUsers</literal> options.
+    </para>
+
+    <para>
+      These options will never delete existing databases and users,
+      especially not when the value of the options are changed.
+    </para>
+
+    <para>
+      The MySQL users will be identified using
+      <link xlink:href="https://mariadb.com/kb/en/library/authentication-plugin-unix-socket/">
+        Unix socket authentication</link>. This authenticates the
+        Unix user with the same name only, and that without the need
+        for a password.
+    </para>
+
+    <para>
+      If you have previously created a MySQL <literal>root</literal>
+      user <emphasis>with a password</emphasis>, you will need to add
+      <literal>root</literal> user for unix socket authentication
+      before using the new options. This can be done by running the
+      following SQL script:
+
+<programlisting language="sql">
+CREATE USER 'root'@'%' IDENTIFIED BY '';
+GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' WITH GRANT OPTION;
+FLUSH PRIVILEGES;
+
+-- Optionally, delete the password-authenticated user:
+-- DROP USER 'root'@'localhost';
+</programlisting>
+    </para>
+  </listitem>
+  <listitem>
+    <para>
+      <literal>sha256</literal> argument value of
+      <literal>dockerTools.pullImage</literal> expression must be
+      updated since the mechanism to download the image has been
+      changed. Skopeo is now used to pull the image instead of the
+      Docker daemon.
+    </para>
+  </listitem>
+  <listitem>
+    <para>
+      <literal>services.mysqlBackup</literal> now works by default
+      without any user setup, including for users other than
+      <literal>mysql</literal>.
+    </para>
+
+    <para>
+      By default, the <literal>mysql</literal> user is no longer the
+      user which performs the backup. Instead a system account
+      <literal>mysqlbackup</literal> is used.
+    </para>
+
+    <para>
+      The <literal>mysqlBackup</literal> service is also now using
+      systemd timers instead of <literal>cron</literal>.
+    </para>
+
+    <para>
+      Therefore, the <literal>services.mysqlBackup.period</literal>
+      option no longer exists, and has been replaced with
+      <literal>services.mysqlBackup.calendar</literal>, which is in
+      the format of <link
+      xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.time.html#Calendar%20Events">systemd.time(7)</link>.
+    </para>
+
+    <para>
+      If you expect to be sent an e-mail when the backup fails,
+      consider using a script which monitors the systemd journal for
+      errors. Regretfully, at present there is no built-in
+      functionality for this.
+    </para>
+
+    <para>
+      You can check that backups still work by running
+      <command>systemctl start mysql-backup</command> then
+      <command>systemctl status mysql-backup</command>.
+    </para>
+  </listitem>
+
+  <listitem>
+    <para>
+      Templated systemd services e.g <literal>container@name</literal> are
+      now handled currectly when switching to a new configuration, resulting
+      in them being reloaded.
+    </para>
+  </listitem>
+
+  <listitem>
+    <para>Steam: the <literal>newStdcpp</literal> parameter
+    was removed and should not be needed anymore.</para>
+  </listitem>
+
+  <listitem>
+    <para>
+      Redis has been updated to version 4 which mandates a cluster
+      mass-restart, due to changes in the network handling, in order
+      to ensure compatibility with networks NATing traffic.
+    </para>
+  </listitem>
 </itemizedlist>
 
-<para>Other notable improvements:</para>
+</section>
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-17.09-notable-changes">
+
+<title>Other Notable Changes</title>
 
 <itemizedlist>
 
@@ -223,13 +542,78 @@ rmdir /var/lib/ipfs/.ipfs
       Nixpkgs overlays may now be specified with a file as well as a directory. The
       value of <literal>&lt;nixpkgs-overlays></literal> may be a file, and
       <filename>~/.config/nixpkgs/overlays.nix</filename> can be used instead of the
-      <filename>~/.config/nixpkgs/overalys</filename> directory.
+      <filename>~/.config/nixpkgs/overlays</filename> directory.
     </para>
     <para>
       See the overlays chapter of the Nixpkgs manual for more details.
     </para>
   </listitem>
+  <listitem>
+    <para>
+      Definitions for <filename>/etc/hosts</filename> can now be specified
+      declaratively with <literal>networking.hosts</literal>.
+    </para>
+  </listitem>
+  <listitem>
+    <para>
+      Two new options have been added to the installer loader, in addition
+      to the default having changed. The kernel log verbosity has been lowered
+      to the upstream default for the default options, in order to not spam
+      the console when e.g. joining a network.
+    </para>
+    <para>
+      This therefore leads to adding a new <literal>debug</literal> option
+      to set the log level to the previous verbose mode, to make debugging
+      easier, but still accessible easily.
+    </para>
+    <para>
+      Additionally a <literal>copytoram</literal> option has been added,
+      which makes it possible to remove the install medium after booting.
+      This allows tethering from your phone after booting from it.
+    </para>
+  </listitem>
+  <listitem>
+    <para>
+      <literal>services.gitlab-runner.configOptions</literal> has been added
+      to specify the configuration of gitlab-runners declaratively.
+    </para>
+  </listitem>
+  <listitem>
+    <para>
+      <literal>services.jenkins.plugins</literal> has been added
+      to install plugins easily, this can be generated with jenkinsPlugins2nix.
+    </para>
+  </listitem>
+  <listitem>
+    <para>
+      <literal>services.postfix.config</literal> has been added
+      to specify the main.cf with NixOS options. Additionally other options
+      have been added to the postfix module and has been improved further.
+    </para>
+  </listitem>
+  <listitem>
+    <para>
+      The GitLab package and module have been updated to the latest 10.0
+      release.
+    </para>
+  </listitem>
+  <listitem>
+    <para>
+      The <literal>systemd-boot</literal> boot loader now lists the NixOS
+      version, kernel version and build date of all bootable generations.
+    </para>
+  </listitem>
+  <listitem>
+    <para>
+      The dnscrypt-proxy service now defaults to using a random upstream resolver,
+      selected from the list of public non-logging resolvers with DNSSEC support.
+      Existing configurations can be migrated to this mode of operation by
+      omitting the <option>services.dnscrypt-proxy.resolverName</option> option
+      or setting it to <literal>"random"</literal>.
+    </para>
+  </listitem>
 
 </itemizedlist>
 
 </section>
+</section>

nixos/lib/make-disk-image.nix

@@ -33,7 +33,8 @@
 
 , name ? "nixos-disk-image"
 
-, format ? "raw"
+, # Disk image format, one of qcow2, vpc, raw.
+  format ? "raw"
 }:
 
 with lib;
@@ -45,7 +46,7 @@ let
     raw   = "img";
   };
 
-  nixpkgs = lib.cleanSource pkgs.path;
+  nixpkgs = cleanSource pkgs.path;
 
   channelSources = pkgs.runCommand "nixos-${config.system.nixosVersion}" {} ''
     mkdir -p $out
@@ -73,7 +74,7 @@ let
   targets = map (x: x.target) contents;
 
   prepareImage = ''
-    export PATH=${pkgs.lib.makeSearchPathOutput "bin" "bin" prepareImageInputs}
+    export PATH=${makeSearchPathOutput "bin" "bin" prepareImageInputs}
 
     mkdir $out
     diskImage=nixos.raw
@@ -87,7 +88,7 @@ let
     ''}
 
     mkfs.${fsType} -F -L nixos -E offset=$offset $diskImage
-  
+
     root="$PWD/root"
     mkdir -p $root
 
@@ -123,6 +124,9 @@ let
     # TODO: Nix really likes to chown things it creates to its current user...
     fakeroot nixos-prepare-root $root ${channelSources} ${config.system.build.toplevel} closure
 
+    # fakeroot seems to always give the owner write permissions, which we do not want
+    find $root/nix/store -mindepth 1 -maxdepth 1 -type f -o -type d | xargs chmod -R a-w
+
     echo "copying staging root to image..."
     cptofs ${pkgs.lib.optionalString partitioned "-P 1"} -t ${fsType} -i $diskImage $root/* /
   '';

nixos/lib/make-squashfs.nix

@@ -19,6 +19,33 @@ stdenv.mkDerivation {
       # Add the closures of the top-level store objects.
       storePaths=$(perl ${pathsFromGraph} closure-*)
 
+      # If a Hydra slave happens to have store paths with bad permissions/mtime,
+      # abort now so that they don't end up in ISO images in the channel.
+      # https://github.com/NixOS/nixpkgs/issues/32242
+      hasBadPaths=""
+      for path in $storePaths; do
+        if [ -h "$path" ]; then
+          continue
+        fi
+
+        mtime=$(stat -c %Y "$path")
+        mode=$(stat -c %a "$path")
+
+        if [ "$mtime" != 1 ]; then
+          echo "Store path '$path' has an invalid mtime."
+          hasBadPaths=1
+        fi
+        if [ "$mode" != 444 ] && [ "$mode" != 555 ]; then
+          echo "Store path '$path' has invalid permissions."
+          hasBadPaths=1
+        fi
+      done
+
+      if [ -n "$hasBadPaths" ]; then
+        echo "You have bad paths in your store, please fix them."
+        exit 1
+      fi
+
       # Also include a manifest of the closures in a format suitable
       # for nix-store --load-db.
       printRegistration=1 perl ${pathsFromGraph} closure-* > nix-path-registration

nixos/lib/test-driver/Machine.pm

@@ -372,6 +372,17 @@ sub getUnitInfo {
     return $info;
 }
 
+# Fail if the given systemd unit is not in the "active" state.
+sub requireActiveUnit {
+    my ($self, $unit) = @_;
+    $self->nest("checking if unit ‘$unit’ has reached state 'active'", sub {
+        my $info = $self->getUnitInfo($unit);
+        my $state = $info->{ActiveState};
+        if ($state ne "active") {
+            die "Expected unit ‘$unit’ to to be in state 'active' but it is in state ‘$state’\n";
+        };
+    });
+}
 
 # Wait for a systemd unit to reach the "active" state.
 sub waitForUnit {

nixos/maintainers/option-usages.nix

@@ -77,7 +77,6 @@ let
   excludedOptions = [
     "boot.systemd.services"
     "systemd.services"
-    "environment.gnome3.packageSet"
     "kde.extraPackages"
   ];
   excludeOptions = list:

nixos/maintainers/scripts/ec2/amazon-image.nix

@@ -8,6 +8,11 @@ in {
 
   imports = [ ../../../modules/virtualisation/amazon-image.nix ];
 
+  # Required to provide good EBS experience,
+  # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nvme-ebs-volumes.html#timeout-nvme-ebs-volumes
+  # TODO change value to 4294967295 when kernel is updated to 4.15 or later
+  config.boot.kernelParams = [ "nvme_core.io_timeout=255" ];
+
   options.amazonImage = {
     contents = mkOption {
       example = literalExample ''

nixos/maintainers/scripts/ec2/create-amis.sh

@@ -17,8 +17,8 @@ mkdir -p $stateDir
 rm -f ec2-amis.nix
 
 types="hvm"
-stores="ebs s3"
-regions="eu-west-1 eu-west-2 eu-central-1 us-east-1 us-east-2 us-west-1 us-west-2 ca-central-1 ap-southeast-1 ap-southeast-2 ap-northeast-1 ap-northeast-2 sa-east-1 ap-south-1"
+stores="ebs"
+regions="eu-west-1 eu-west-2 eu-west-3 eu-central-1 us-east-1 us-east-2 us-west-1 us-west-2 ca-central-1 ap-southeast-1 ap-southeast-2 ap-northeast-1 ap-northeast-2 sa-east-1 ap-south-1"
 
 for type in $types; do
     link=$stateDir/$type

nixos/maintainers/scripts/openstack/nova-image.nix

@@ -1,3 +1,5 @@
+# nix-build '<nixpkgs/nixos>' -A config.system.build.novaImage --arg configuration "{ imports = [ ./nixos/maintainers/scripts/openstack/nova-image.nix ]; }"
+
 { config, lib, pkgs, ... }:
 
 with lib;

nixos/modules/config/debug-info.nix

@@ -30,14 +30,15 @@ with lib;
   };
 
 
-  config = {
+  config = mkIf config.environment.enableDebugInfo {
 
     # FIXME: currently disabled because /lib is already in
     # environment.pathsToLink, and we can't have both.
     #environment.pathsToLink = [ "/lib/debug/.build-id" ];
 
-    environment.extraOutputsToInstall =
-      optional config.environment.enableDebugInfo "debug";
+    environment.extraOutputsToInstall = [ "debug" ];
+
+    environment.variables.NIX_DEBUG_INFO_DIRS = [ "/run/current-system/sw/lib/debug" ];
 
   };
 

nixos/modules/config/fonts/fontconfig-ultimate.nix

@@ -53,7 +53,7 @@ in
           };
 
           substitutions = mkOption {
-            type = types.nullOr (types.enum ["free" "combi" "ms"]);
+            type = types.enum ["free" "combi" "ms" "none"];
             default = "free";
             description = ''
               Font substitutions to replace common Type 1 fonts with nicer

nixos/modules/config/i18n.nix

@@ -43,7 +43,7 @@ with lib;
           <literal>"all"</literal> means that all locales supported by
           Glibc will be installed.  A full list of supported locales
           can be found at <link
-          xlink:href="http://sourceware.org/cgi-bin/cvsweb.cgi/libc/localedata/SUPPORTED?cvsroot=glibc"/>.
+          xlink:href="https://sourceware.org/git/?p=glibc.git;a=blob;f=localedata/SUPPORTED"/>.
         '';
       };
 

nixos/modules/config/nsswitch.nix

@@ -18,7 +18,7 @@ let
 
   hostArray = [ "files" ]
     ++ optionals mymachines [ "mymachines" ]
-    ++ optionals nssmdns [ "mdns_minimal [!UNAVAIL=return]" ]
+    ++ optionals nssmdns [ "mdns_minimal [NOTFOUND=return]" ]
     ++ optionals nsswins [ "wins" ]
     ++ optionals resolved ["resolve [!UNAVAIL=return]"]
     ++ [ "dns" ]

nixos/modules/config/system-path.nix

@@ -31,6 +31,7 @@ let
       pkgs.nano
       pkgs.ncurses
       pkgs.netcat
+      pkgs.nix-info
       config.programs.ssh.package
       pkgs.perl
       pkgs.procps

nixos/modules/hardware/video/nvidia.nix

@@ -40,6 +40,12 @@ in
 {
 
   config = mkIf enabled {
+    assertions = [
+      {
+        assertion = config.services.xserver.displayManager.gdm.wayland;
+        message = "NVidia drivers don't support wayland";
+      }
+    ];
 
     services.xserver.drivers = singleton
       { name = "nvidia"; modules = [ nvidia_x11.bin ]; libPath = [ nvidia_x11 ]; };
@@ -62,11 +68,16 @@ in
     boot.extraModulePackages = [ nvidia_x11.bin ];
 
     # nvidia-uvm is required by CUDA applications.
-    boot.kernelModules = [ "nvidia-uvm" ];
+    boot.kernelModules = [ "nvidia-uvm" ] ++
+      lib.optionals config.services.xserver.enable [ "nvidia" "nvidia_modeset" "nvidia_drm" ];
+
 
     # Create /dev/nvidia-uvm when the nvidia-uvm module is loaded.
     services.udev.extraRules =
       ''
+        KERNEL=="nvidia", RUN+="${pkgs.stdenv.shell} -c 'mknod -m 666 /dev/nvidiactl c $(grep nvidia-frontend /proc/devices | cut -d \  -f 1) 255'"
+        KERNEL=="nvidia_modeset", RUN+="${pkgs.stdenv.shell} -c 'mknod -m 666 /dev/nvidia-modeset c $(grep nvidia-frontend /proc/devices | cut -d \  -f 1) 254'"
+        KERNEL=="card*", SUBSYSTEM=="drm", DRIVERS=="nvidia", RUN+="${pkgs.stdenv.shell} -c 'mknod -m 666 /dev/nvidia%n c $(grep nvidia-frontend /proc/devices | cut -d \  -f 1) %n'"
         KERNEL=="nvidia_uvm", RUN+="${pkgs.stdenv.shell} -c 'mknod -m 666 /dev/nvidia-uvm c $(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 0'"
       '';
 

nixos/modules/installer/cd-dvd/iso-image.nix

@@ -46,17 +46,24 @@ let
 
     # A variant to boot with 'nomodeset'
     LABEL boot-nomodeset
-    MENU LABEL NixOS ${config.system.nixosVersion}${config.isoImage.appendToMenuLabel} (with nomodeset)
+    MENU LABEL NixOS ${config.system.nixosVersion}${config.isoImage.appendToMenuLabel} (nomodeset)
     LINUX /boot/bzImage
     APPEND init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} nomodeset
     INITRD /boot/initrd
 
     # A variant to boot with 'copytoram'
     LABEL boot-copytoram
-    MENU LABEL NixOS ${config.system.nixosVersion}${config.isoImage.appendToMenuLabel} (with copytoram)
+    MENU LABEL NixOS ${config.system.nixosVersion}${config.isoImage.appendToMenuLabel} (copytoram)
     LINUX /boot/bzImage
     APPEND init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} copytoram
     INITRD /boot/initrd
+
+    # A variant to boot with verbose logging to the console
+    LABEL boot-nomodeset
+    MENU LABEL NixOS ${config.system.nixosVersion}${config.isoImage.appendToMenuLabel} (debug)
+    LINUX /boot/bzImage
+    APPEND init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} loglevel=7
+    INITRD /boot/initrd
   '';
 
   isolinuxMemtest86Entry = ''
@@ -74,25 +81,43 @@ let
     cp -v ${pkgs.systemd}/lib/systemd/boot/efi/systemd-boot${targetArch}.efi $out/EFI/boot/boot${targetArch}.efi
     mkdir -p $out/loader/entries
 
-    echo "title NixOS Live CD" > $out/loader/entries/nixos-livecd.conf
-    echo "linux /boot/bzImage" >> $out/loader/entries/nixos-livecd.conf
-    echo "initrd /boot/initrd" >> $out/loader/entries/nixos-livecd.conf
-    echo "options init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams}" >> $out/loader/entries/nixos-livecd.conf
+    cat << EOF > $out/loader/entries/nixos-iso.conf
+    title NixOS ${config.system.nixosVersion}${config.isoImage.appendToMenuLabel}
+    linux /boot/bzImage
+    initrd /boot/initrd
+    options init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams}
+    EOF
 
     # A variant to boot with 'nomodeset'
-    echo "title NixOS Live CD (with nomodeset)" > $out/loader/entries/nixos-livecd-nomodeset.conf
-    echo "linux /boot/bzImage" >> $out/loader/entries/nixos-livecd-nomodeset.conf
-    echo "initrd /boot/initrd" >> $out/loader/entries/nixos-livecd-nomodeset.conf
-    echo "options init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} nomodeset" >> $out/loader/entries/nixos-livecd-nomodeset.conf
+    cat << EOF > $out/loader/entries/nixos-iso-nomodeset.conf
+    title NixOS ${config.system.nixosVersion}${config.isoImage.appendToMenuLabel}
+    version nomodeset
+    linux /boot/bzImage
+    initrd /boot/initrd
+    options init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} nomodeset
+    EOF
 
     # A variant to boot with 'copytoram'
-    echo "title NixOS Live CD (with copytoram)" > $out/loader/entries/nixos-livecd-copytoram.conf
-    echo "linux /boot/bzImage" >> $out/loader/entries/nixos-livecd-copytoram.conf
-    echo "initrd /boot/initrd" >> $out/loader/entries/nixos-livecd-copytoram.conf
-    echo "options init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} copytoram" >> $out/loader/entries/nixos-livecd-copytoram.conf
+    cat << EOF > $out/loader/entries/nixos-iso-copytoram.conf
+    title NixOS ${config.system.nixosVersion}${config.isoImage.appendToMenuLabel}
+    version copytoram
+    linux /boot/bzImage
+    initrd /boot/initrd
+    options init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} copytoram
+    EOF
 
-    echo "default nixos-livecd" > $out/loader/loader.conf
-    echo "timeout ${builtins.toString config.boot.loader.timeout}" >> $out/loader/loader.conf
+    # A variant to boot with verbose logging to the console
+    cat << EOF > $out/loader/entries/nixos-iso-debug.conf
+    title NixOS ${config.system.nixosVersion}${config.isoImage.appendToMenuLabel} (debug)
+    linux /boot/bzImage
+    initrd /boot/initrd
+    options init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams} loglevel=7
+    EOF
+
+    cat << EOF > $out/loader/loader.conf
+    default nixos-iso
+    timeout ${builtins.toString config.boot.loader.timeout}
+    EOF
   '';
 
   efiImg = pkgs.runCommand "efi-image_eltorito" { buildInputs = [ pkgs.mtools pkgs.libfaketime ]; }
@@ -336,6 +361,9 @@ in
         { source = config.isoImage.splashImage;
           target = "/isolinux/background.png";
         }
+        { source = pkgs.writeText "version" config.system.nixosVersion;
+          target = "/version.txt";
+        }
       ] ++ optionals config.isoImage.makeEfiBootable [
         { source = efiImg;
           target = "/boot/efi.img";

nixos/modules/installer/cd-dvd/sd-image-aarch64.nix

@@ -27,7 +27,8 @@ in
   boot.loader.generic-extlinux-compatible.enable = true;
 
   boot.kernelPackages = pkgs.linuxPackages_latest;
-  boot.kernelParams = ["console=ttyS0,115200n8" "console=tty0"];
+  # Increase the amount of CMA to ensure the virtual console on the RPi3 works.
+  boot.kernelParams = ["cma=32M" "console=ttyS0,115200n8" "console=tty0"];
   boot.consoleLogLevel = 7;
 
   # FIXME: this probably should be in installation-device.nix

nixos/modules/installer/tools/nix-fallback-paths.nix

@@ -1,5 +1,6 @@
 {
-  x86_64-linux = "/nix/store/avwiw7hb1qckag864sc6ixfxr8qmf94w-nix-1.11.13";
-  i686-linux = "/nix/store/8wv3ms0afw95hzsz4lxzv0nj4w3614z9-nix-1.11.13";
-  x86_64-darwin = "/nix/store/z21lvakv1l7lhasmv5fvaz8mlzxia8k9-nix-1.11.13";
+  x86_64-linux = "/nix/store/gy4yv67gv3j6in0lalw37j353zdmfcwm-nix-1.11.16";
+  i686-linux = "/nix/store/ifmyq5ryfxhhrzh62hiq65xyz1fwffga-nix-1.11.16";
+  aarch64-linux = "/nix/store/y9mfv3sx75mbfibf1zna1kq9v98fk2nb-nix-1.11.16";
+  x86_64-darwin = "/nix/store/hwpp7kia2f0in5ns2hiw41q38k30jpj2-nix-1.11.16";
 }

nixos/modules/installer/tools/nixos-generate-config.pl

@@ -8,6 +8,7 @@ use File::Basename;
 use File::Slurp;
 use File::stat;
 
+umask(0022);
 
 sub uniq {
     my %seen;
@@ -583,9 +584,15 @@ $bootLoaderConfig
   # List packages installed in system profile. To search by name, run:
   # \$ nix-env -qaP | grep wget
   # environment.systemPackages = with pkgs; [
-  #   wget
+  #   wget vim
   # ];
 
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.bash.enableCompletion = true;
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = { enable = true; enableSSHSupport = true; };
+
   # List services that you want to enable:
 
   # Enable the OpenSSH daemon.
@@ -605,6 +612,9 @@ $bootLoaderConfig
   # services.xserver.layout = "us";
   # services.xserver.xkbOptions = "eurosign:e";
 
+  # Enable touchpad support.
+  # services.xserver.libinput.enable = true;
+
   # Enable the KDE Desktop Environment.
   # services.xserver.displayManager.sddm.enable = true;
   # services.xserver.desktopManager.plasma5.enable = true;
@@ -615,8 +625,11 @@ $bootLoaderConfig
   #   uid = 1000;
   # };
 
-  # The NixOS release to be compatible with for stateful data such as databases.
-  system.stateVersion = "${\(qw(@nixosRelease@))}";
+  # This value determines the NixOS release with which your system is to be
+  # compatible, in order to avoid breaking some software such as database
+  # servers. You should change this only after NixOS release notes say you
+  # should.
+  system.stateVersion = "${\(qw(@nixosRelease@))}"; # Did you read the comment?
 
 }
 EOF

nixos/modules/installer/tools/nixos-install.sh

@@ -102,16 +102,44 @@ fi
 extraBuildFlags+=(--option "build-users-group" "$buildUsersGroup")
 
 # Inherit binary caches from the host
-# TODO: will this still work with Nix 1.12 now that it has no perl? Probably not... 
+# TODO: will this still work with Nix 1.12 now that it has no perl? Probably not...
 binary_caches="$(@perl@/bin/perl -I @nix@/lib/perl5/site_perl/*/* -e 'use Nix::Config; Nix::Config::readConfig; print $Nix::Config::config{"binary-caches"};')"
 extraBuildFlags+=(--option "binary-caches" "$binary_caches")
 
-nixpkgs="$(readlink -f "$(nix-instantiate --find-file nixpkgs)")"
-export NIX_PATH="nixpkgs=$nixpkgs:nixos-config=$mountPoint/$NIXOS_CONFIG"
+# We only need nixpkgs in the path if we don't already have a system closure to install
+if [[ -z "$closure" ]]; then
+    nixpkgs="$(readlink -f "$(nix-instantiate --find-file nixpkgs)")"
+    export NIX_PATH="nixpkgs=$nixpkgs:nixos-config=$mountPoint/$NIXOS_CONFIG"
+fi
 unset NIXOS_CONFIG
 
-# TODO: do I need to set NIX_SUBSTITUTERS here or is the --option binary-caches above enough?
+# These get created in nixos-prepare-root as well, but we want to make sure they're here in case we're
+# running with --chroot. TODO: --chroot should just be split into a separate tool.
+mkdir -m 0755 -p "$mountPoint/dev" "$mountPoint/proc" "$mountPoint/sys"
 
+# Set up some bind mounts we'll want regardless of chroot or not
+mount --rbind /dev "$mountPoint/dev"
+mount --rbind /proc "$mountPoint/proc"
+mount --rbind /sys "$mountPoint/sys"
+
+# If we asked for a chroot, that means we're not actually installing anything (yeah I was confused too)
+# and we just want to run a command in the context of a $mountPoint that we're assuming has already been
+# set up by a previous nixos-install invocation. In that case we set up some remaining bind mounts and
+# exec the requested command, skipping the rest of the installation procedure.
+if [ -n "$runChroot" ]; then
+    mount -t tmpfs -o "mode=0755" none $mountPoint/run
+    rm -rf $mountPoint/var/run
+    ln -s /run $mountPoint/var/run
+    for f in /etc/resolv.conf /etc/hosts; do rm -f $mountPoint/$f; [ -f "$f" ] && cp -Lf $f $mountPoint/etc/; done
+    for f in /etc/passwd /etc/group;      do touch $mountPoint/$f; [ -f "$f" ] && mount --rbind -o ro $f $mountPoint/$f; done
+
+    if ! [ -L $mountPoint/nix/var/nix/profiles/system ]; then
+        echo "$0: installation not finished; cannot chroot into installation directory"
+        exit 1
+    fi
+    ln -s /nix/var/nix/profiles/system $mountPoint/run/current-system
+    exec chroot $mountPoint "${chrootCommand[@]}"
+fi
 
 # A place to drop temporary closures
 trap "rm -rf $tmpdir" EXIT
@@ -123,6 +151,9 @@ function closure() {
 }
 
 system_closure="$tmpdir/system.closure"
+# Use a FIFO for piping nix-store --export into nix-store --import, saving disk
+# I/O and space. nix-store --import is run by nixos-prepare-root.
+mkfifo $system_closure
 
 if [ -z "$closure" ]; then
     expr="(import <nixpkgs/nixos> {}).system"
@@ -132,7 +163,9 @@ else
     system_root=$closure
     # Create a temporary file ending in .closure (so nixos-prepare-root knows to --import it) to transport the store closure
     # to the filesytem we're preparing. Also delete it on exit!
-    nix-store --export $(nix-store -qR $closure) > $system_closure
+    # Run in background to avoid blocking while trying to write to the FIFO
+    # $system_closure refers to
+    nix-store --export $(nix-store -qR $closure) > $system_closure &
 fi
 
 channel_root="$(nix-env -p /nix/var/nix/profiles/per-user/root/channels -q nixos --no-name --out-path 2>/dev/null || echo -n "")"
@@ -145,9 +178,7 @@ nix-store --export $channel_root > $channel_closure
 # nixos-prepare-root doesn't currently do anything with file ownership, so we set it up here instead
 chown @root_uid@:@nixbld_gid@ $mountPoint/nix/store
 
-mount --rbind /dev $mountPoint/dev
-mount --rbind /proc $mountPoint/proc
-mount --rbind /sys $mountPoint/sys
+
 
 # Grub needs an mtab.
 ln -sfn /proc/mounts $mountPoint/etc/mtab

nixos/modules/installer/tools/nixos-rebuild.sh

@@ -260,6 +260,14 @@ if [ -n "$rollback" -o "$action" = dry-build ]; then
     buildNix=
 fi
 
+nixSystem() {
+    machine="$(uname -m)"
+    if [[ "$machine" =~ i.86 ]]; then
+        machine=i686
+    fi
+    echo $machine-linux
+}
+
 prebuiltNix() {
     machine="$1"
     if [ "$machine" = x86_64 ]; then
@@ -279,7 +287,9 @@ if [ -n "$buildNix" ]; then
     nixDrv=
     if ! nixDrv="$(nix-instantiate '<nixpkgs/nixos>' --add-root $tmpDir/nix.drv --indirect -A config.nix.package.out "${extraBuildFlags[@]}")"; then
         if ! nixDrv="$(nix-instantiate '<nixpkgs>' --add-root $tmpDir/nix.drv --indirect -A nix "${extraBuildFlags[@]}")"; then
-            nixStorePath="$(prebuiltNix "$(uname -m)")"
+            if ! nixStorePath="$(nix-instantiate --eval '<nixpkgs/nixos/modules/installer/tools/nix-fallback-paths.nix>' -A $(nixSystem) | sed -e 's/^"//' -e 's/"$//')"; then
+                nixStorePath="$(prebuiltNix "$(uname -m)")"
+            fi
             if ! nix-store -r $nixStorePath --add-root $tmpDir/nix --indirect \
                 --option extra-binary-caches https://cache.nixos.org/; then
                 echo "warning: don't know how to get latest Nix" >&2

nixos/modules/misc/ids.nix

@@ -254,7 +254,6 @@
       hydra-queue-runner = 235;
       hydra-www = 236;
       syncthing = 237;
-      mfi = 238;
       caddy = 239;
       taskd = 240;
       factorio = 241;
@@ -297,6 +296,7 @@
       clickhouse = 278;
       rslsync = 279;
       minio = 280;
+      kanboard = 281;
 
       # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
 
@@ -427,7 +427,7 @@
       teamspeak = 124;
       influxdb = 125;
       nsd = 126;
-      #gitolite = 127; # unused
+      gitolite = 127;
       znc = 128;
       polipo = 129;
       mopidy = 130;
@@ -522,7 +522,6 @@
       octoprint = 230;
       radicale = 234;
       syncthing = 237;
-      #mfi = 238; # unused
       caddy = 239;
       taskd = 240;
       factorio = 241;
@@ -563,6 +562,7 @@
       clickhouse = 278;
       rslsync = 279;
       minio = 280;
+      kanboard = 281;
 
       # When adding a gid, make sure it doesn't match an existing
       # uid. Users and groups with the same name should have equal

nixos/modules/misc/locate.nix

@@ -97,7 +97,7 @@ in {
         Whether not to index bind mounts
       '';
     };
-    
+
   };
 
   config = mkIf cfg.enable {
@@ -125,13 +125,16 @@ in {
     warnings = optional (isMLocate && cfg.localuser != null) "mlocate does not support searching as user other than root"
             ++ optional (isFindutils && cfg.pruneNames != []) "findutils locate does not support pruning by directory component"
             ++ optional (isFindutils && cfg.pruneBindMounts) "findutils locate does not support skipping bind mounts";
-  
+
+    # directory creation needs to be separated from main service
+    # because ReadWritePaths fails when the directory doesn't already exist
+    systemd.tmpfiles.rules = [ "d ${dirOf cfg.output} 0755 root root -" ];
+
     systemd.services.update-locatedb =
       { description = "Update Locate Database";
         path = mkIf (!isMLocate) [ pkgs.su ];
         script =
           ''
-            mkdir -m 0755 -p ${dirOf cfg.output}
             exec ${cfg.locate}/bin/updatedb \
               ${optionalString (cfg.localuser != null && ! isMLocate) ''--localuser=${cfg.localuser}''} \
               --output=${toString cfg.output} ${concatStringsSep " " cfg.extraFlags}
@@ -147,8 +150,13 @@ in {
         serviceConfig.PrivateTmp = "yes";
         serviceConfig.PrivateNetwork = "yes";
         serviceConfig.NoNewPrivileges = "yes";
-        serviceConfig.ReadOnlyDirectories = "/";
-        serviceConfig.ReadWriteDirectories = dirOf cfg.output;
+        serviceConfig.ReadOnlyPaths = "/";
+        # Use dirOf cfg.output because mlocate creates temporary files next to
+        # the actual database. We could specify and create them as well,
+        # but that would make this quite brittle when they change something.
+        # NOTE: If /var/cache does not exist, this leads to the misleading error message:
+        # update-locatedb.service: Failed at step NAMESPACE spawning …/update-locatedb-start: No such file or directory
+        serviceConfig.ReadWritePaths = dirOf cfg.output;
       };
 
     systemd.timers.update-locatedb =

nixos/modules/misc/version.nix

@@ -78,7 +78,7 @@ in
     defaultChannel = mkOption {
       internal = true;
       type = types.str;
-      default = https://nixos.org/channels/nixos-unstable;
+      default = https://nixos.org/channels/nixos-17.09;
       description = "Default NixOS channel to which the root user is subscribed.";
     };
 

nixos/modules/module-list.nix

@@ -73,6 +73,7 @@
   ./programs/adb.nix
   ./programs/atop.nix
   ./programs/bash/bash.nix
+  ./programs/bcc.nix
   ./programs/blcr.nix
   ./programs/browserpass.nix
   ./programs/cdemu.nix
@@ -101,6 +102,7 @@
   ./programs/spacefm.nix
   ./programs/ssh.nix
   ./programs/ssmtp.nix
+  ./programs/sysdig.nix
   ./programs/thefuck.nix
   ./programs/tmux.nix
   ./programs/venus.nix
@@ -121,7 +123,6 @@
   ./security/chromium-suid-sandbox.nix
   ./security/dhparams.nix
   ./security/duosec.nix
-  ./security/grsecurity.nix
   ./security/hidepid.nix
   ./security/lock-kernel-modules.nix
   ./security/oath.nix
@@ -157,7 +158,9 @@
   ./services/backup/tarsnap.nix
   ./services/backup/znapzend.nix
   ./services/cluster/fleet.nix
-  ./services/cluster/kubernetes.nix
+  ./services/cluster/kubernetes/default.nix
+  ./services/cluster/kubernetes/dns.nix
+  ./services/cluster/kubernetes/dashboard.nix
   ./services/cluster/panamax.nix
   ./services/computing/boinc/client.nix
   ./services/computing/torque/server.nix
@@ -188,6 +191,7 @@
   ./services/databases/openldap.nix
   ./services/databases/opentsdb.nix
   ./services/databases/postage.nix
+  ./services/databases/pgmanage.nix
   ./services/databases/postgresql.nix
   ./services/databases/redis.nix
   ./services/databases/riak.nix
@@ -205,6 +209,7 @@
   ./services/desktops/gnome3/gnome-online-miners.nix
   ./services/desktops/gnome3/gnome-terminal-server.nix
   ./services/desktops/gnome3/gnome-user-share.nix
+  ./services/desktops/gnome3/gpaste.nix
   ./services/desktops/gnome3/gvfs.nix
   ./services/desktops/gnome3/seahorse.nix
   ./services/desktops/gnome3/sushi.nix
@@ -231,6 +236,7 @@
   ./services/hardware/pcscd.nix
   ./services/hardware/pommed.nix
   ./services/hardware/sane.nix
+  ./services/hardware/sane_extra_backends/brscan4.nix
   ./services/hardware/tcsd.nix
   ./services/hardware/tlp.nix
   ./services/hardware/thinkfan.nix
@@ -300,6 +306,7 @@
   ./services/misc/gitlab.nix
   ./services/misc/gitolite.nix
   ./services/misc/gogs.nix
+  ./services/misc/gollum.nix
   ./services/misc/gpsd.nix
   #./services/misc/ihaskell.nix
   ./services/misc/irkerd.nix
@@ -341,6 +348,7 @@
   ./services/misc/synergy.nix
   ./services/misc/taskserver
   ./services/misc/uhub.nix
+  ./services/misc/xmr-stak.nix
   ./services/misc/zookeeper.nix
   ./services/monitoring/apcupsd.nix
   ./services/monitoring/arbtt.nix
@@ -362,6 +370,7 @@
   ./services/monitoring/prometheus/default.nix
   ./services/monitoring/prometheus/alertmanager.nix
   ./services/monitoring/prometheus/blackbox-exporter.nix
+  ./services/monitoring/prometheus/collectd-exporter.nix
   ./services/monitoring/prometheus/fritzbox-exporter.nix
   ./services/monitoring/prometheus/json-exporter.nix
   ./services/monitoring/prometheus/nginx-exporter.nix
@@ -403,6 +412,7 @@
   ./services/networking/asterisk.nix
   ./services/networking/atftpd.nix
   ./services/networking/avahi-daemon.nix
+  ./services/networking/babeld.nix
   ./services/networking/bind.nix
   ./services/networking/autossh.nix
   ./services/networking/bird.nix
@@ -419,15 +429,16 @@
   ./services/networking/ddclient.nix
   ./services/networking/dhcpcd.nix
   ./services/networking/dhcpd.nix
+  ./services/networking/dnscache.nix
   ./services/networking/dnschain.nix
   ./services/networking/dnscrypt-proxy.nix
   ./services/networking/dnscrypt-wrapper.nix
   ./services/networking/dnsmasq.nix
   ./services/networking/ejabberd.nix
-  ./services/networking/fan.nix
   ./services/networking/fakeroute.nix
   ./services/networking/ferm.nix
   ./services/networking/firefox/sync-server.nix
+  ./services/networking/fireqos.nix
   ./services/networking/firewall.nix
   ./services/networking/flannel.nix
   ./services/networking/flashpolicyd.nix
@@ -457,7 +468,7 @@
   ./services/networking/lldpd.nix
   ./services/networking/logmein-hamachi.nix
   ./services/networking/mailpile.nix
-  ./services/networking/mfi.nix
+  ./services/networking/matterbridge.nix
   ./services/networking/mjpg-streamer.nix
   ./services/networking/minidlna.nix
   ./services/networking/miniupnpd.nix
@@ -508,6 +519,7 @@
   ./services/networking/smokeping.nix
   ./services/networking/softether.nix
   ./services/networking/spiped.nix
+  ./services/networking/squid.nix
   ./services/networking/sslh.nix
   ./services/networking/ssh/lshd.nix
   ./services/networking/ssh/sshd.nix
@@ -518,6 +530,7 @@
   ./services/networking/tcpcrypt.nix
   ./services/networking/teamspeak3.nix
   ./services/networking/tinc.nix
+  ./services/networking/tinydns.nix
   ./services/networking/tftpd.nix
   ./services/networking/tox-bootstrapd.nix
   ./services/networking/toxvpn.nix
@@ -569,6 +582,7 @@
   ./services/system/cloud-init.nix
   ./services/system/dbus.nix
   ./services/system/earlyoom.nix
+  ./services/system/localtime.nix
   ./services/system/kerberos.nix
   ./services/system/nscd.nix
   ./services/system/saslauthd.nix
@@ -587,6 +601,7 @@
   ./services/web-apps/frab.nix
   ./services/web-apps/mattermost.nix
   ./services/web-apps/nixbot.nix
+  ./services/web-apps/nexus.nix
   ./services/web-apps/pgpkeyserver-lite.nix
   ./services/web-apps/piwik.nix
   ./services/web-apps/pump.io.nix
@@ -607,6 +622,7 @@
   ./services/web-servers/phpfpm/default.nix
   ./services/web-servers/shellinabox.nix
   ./services/web-servers/tomcat.nix
+  ./services/web-servers/traefik.nix
   ./services/web-servers/uwsgi.nix
   ./services/web-servers/varnish/default.nix
   ./services/web-servers/winstone.nix
@@ -679,6 +695,7 @@
   ./tasks/cpu-freq.nix
   ./tasks/encrypted-devices.nix
   ./tasks/filesystems.nix
+  ./tasks/filesystems/bcachefs.nix
   ./tasks/filesystems/btrfs.nix
   ./tasks/filesystems/cifs.nix
   ./tasks/filesystems/exfat.nix

nixos/modules/profiles/base.nix

@@ -20,6 +20,7 @@
 
     # Some networking tools.
     pkgs.fuse
+    pkgs.fuse3
     pkgs.sshfs-fuse
     pkgs.socat
     pkgs.screen

nixos/modules/profiles/graphical.nix

@@ -8,7 +8,7 @@
     enable = true;
     displayManager.sddm.enable = true;
     desktopManager.plasma5.enable = true;
-    synaptics.enable = true; # for touchpad support on many laptops
+    libinput.enable = true; # for touchpad support on many laptops
   };
 
   environment.systemPackages = [ pkgs.glxinfo ];

nixos/modules/profiles/hardened.nix

@@ -25,6 +25,13 @@ with lib;
     "nohibernate"
   ];
 
+  boot.blacklistedKernelModules = [
+    # Obscure network protocols
+    "ax25"
+    "netrom"
+    "rose"
+  ];
+
   # Restrict ptrace() usage to processes with a pre-defined relationship
   # (e.g., parent/child)
   boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkOverride 500 1;
@@ -65,4 +72,14 @@ with lib;
   # Note: mmap_rnd_compat_bits may not exist on 64bit.
   boot.kernel.sysctl."vm.mmap_rnd_bits" = mkDefault 32;
   boot.kernel.sysctl."vm.mmap_rnd_compat_bits" = mkDefault 16;
+
+  # Allowing users to mmap() memory starting at virtual address 0 can turn a
+  # NULL dereference bug in the kernel into code execution with elevated
+  # privilege.  Mitigate by enforcing a minimum base addr beyond the NULL memory
+  # space.  This breaks applications that require mapping the 0 page, such as
+  # dosemu or running 16bit applications under wine.  It also breaks older
+  # versions of qemu.
+  #
+  # The value is taken from the KSPP recommendations (Debian uses 4096).
+  boot.kernel.sysctl."vm.mmap_min_addr" = mkDefault 65536;
 }

nixos/modules/profiles/installation-device.nix

@@ -77,7 +77,6 @@ with lib;
     # Show all debug messages from the kernel but don't log refused packets
     # because we have the firewall enabled. This makes installs from the
     # console less cumbersome if the machine has a public IP.
-    boot.consoleLogLevel = mkDefault 7;
     networking.firewall.logRefusedConnections = mkDefault false;
 
     environment.systemPackages = [ pkgs.vim ];

nixos/modules/programs/bcc.nix

@@ -0,0 +1,9 @@
+{ config, lib, pkgs, ... }:
+{
+  options.programs.bcc.enable = lib.mkEnableOption "bcc";
+
+  config = lib.mkIf config.programs.bcc.enable {
+    environment.systemPackages = [ config.boot.kernelPackages.bcc ];
+    boot.extraModulePackages = [ config.boot.kernelPackages.bcc ];
+  };
+}

nixos/modules/programs/command-not-found/command-not-found.nix

@@ -25,7 +25,14 @@ in
 {
   options.programs.command-not-found = {
 
-    enable = mkEnableOption "command-not-found hook for interactive shell";
+    enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Whether interactive shells should show which Nix package (if
+        any) provides a missing command.
+      '';
+    };
 
     dbPath = mkOption {
       default = "/nix/var/nix/profiles/per-user/root/channels/nixos/programs.sqlite" ;

nixos/modules/programs/mtr.nix

@@ -19,8 +19,9 @@ in {
   };
 
   config = mkIf cfg.enable {
-    security.wrappers.mtr = {
-      source = "${pkgs.mtr}/bin/mtr";
+    environment.systemPackages = with pkgs; [ mtr ];
+    security.wrappers.mtr-packet = {
+      source = "${pkgs.mtr}/bin/mtr-packet";
       capabilities = "cap_net_raw+p";
     };
   };

nixos/modules/programs/ssh.nix

@@ -148,11 +148,11 @@ in
           [
             {
               hostNames = [ "myhost" "myhost.mydomain.com" "10.10.1.4" ];
-              publicKeyFile = "./pubkeys/myhost_ssh_host_dsa_key.pub";
+              publicKeyFile = ./pubkeys/myhost_ssh_host_dsa_key.pub;
             }
             {
               hostNames = [ "myhost2" ];
-              publicKeyFile = "./pubkeys/myhost2_ssh_host_dsa_key.pub";
+              publicKeyFile = ./pubkeys/myhost2_ssh_host_dsa_key.pub;
             }
           ]
         '';

nixos/modules/programs/sysdig.nix

@@ -0,0 +1,14 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.sysdig;
+in {
+  options.programs.sysdig.enable = mkEnableOption "sysdig";
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.sysdig ];
+    boot.extraModulePackages = [ config.boot.kernelPackages.sysdig ];
+  };
+}

nixos/modules/programs/xonsh.nix

@@ -21,7 +21,7 @@ in
       enable = mkOption {
         default = false;
         description = ''
-          Whether to configure xnosh as an interactive shell.
+          Whether to configure xonsh as an interactive shell.
         '';
         type = types.bool;
       };

nixos/modules/rename.nix

@@ -108,6 +108,9 @@ with lib;
 
     (mkAliasOptionModule [ "environment" "checkConfigurationOptions" ] [ "_module" "check" ])
 
+    # opendkim
+    (mkRenamedOptionModule [ "services" "opendkim" "keyFile" ] [ "services" "opendkim" "keyPath" ])
+
     # XBMC
     (mkRenamedOptionModule [ "services" "xserver" "windowManager" "xbmc" ] [ "services" "xserver" "desktopManager" "kodi" ])
     (mkRenamedOptionModule [ "services" "xserver" "desktopManager" "xbmc" ] [ "services" "xserver" "desktopManager" "kodi" ])
@@ -124,26 +127,6 @@ with lib;
     (mkRenamedOptionModule [ "services" "iodined" "extraConfig" ] [ "services" "iodine" "server" "extraConfig" ])
     (mkRemovedOptionModule [ "services" "iodined" "client" ] "")
 
-    # Grsecurity
-    (mkRemovedOptionModule [ "security" "grsecurity" "kernelPatch" ] "")
-    (mkRemovedOptionModule [ "security" "grsecurity" "config" "mode" ] "")
-    (mkRemovedOptionModule [ "security" "grsecurity" "config" "priority" ] "")
-    (mkRemovedOptionModule [ "security" "grsecurity" "config" "system" ] "")
-    (mkRemovedOptionModule [ "security" "grsecurity" "config" "virtualisationConfig" ] "")
-    (mkRemovedOptionModule [ "security" "grsecurity" "config" "hardwareVirtualisation" ] "")
-    (mkRemovedOptionModule [ "security" "grsecurity" "config" "virtualisationSoftware" ] "")
-    (mkRemovedOptionModule [ "security" "grsecurity" "config" "sysctl" ] "")
-    (mkRemovedOptionModule [ "security" "grsecurity" "config" "denyChrootChmod" ] "")
-    (mkRemovedOptionModule [ "security" "grsecurity" "config" "denyChrootCaps" ] "")
-    (mkRemovedOptionModule [ "security" "grsecurity" "config" "denyUSB" ] "")
-    (mkRemovedOptionModule [ "security" "grsecurity" "config" "restrictProc" ] "")
-    (mkRemovedOptionModule [ "security" "grsecurity" "config" "restrictProcWithGroup" ] "")
-    (mkRemovedOptionModule [ "security" "grsecurity" "config" "unrestrictProcGid" ] "")
-    (mkRemovedOptionModule [ "security" "grsecurity" "config" "disableRBAC" ] "")
-    (mkRemovedOptionModule [ "security" "grsecurity" "config" "disableSimultConnect" ] "")
-    (mkRemovedOptionModule [ "security" "grsecurity" "config" "verboseVersion" ] "")
-    (mkRemovedOptionModule [ "security" "grsecurity" "config" "kernelExtraConfig" ] "")
-
     # Unity3D
     (mkRenamedOptionModule [ "programs" "unity3d" "enable" ] [ "security" "chromiumSuidSandbox" "enable" ])
 
@@ -212,7 +195,6 @@ with lib;
       "Set the option `services.xserver.displayManager.sddm.package' instead.")
     (mkRemovedOptionModule [ "fonts" "fontconfig" "forceAutohint" ] "")
     (mkRemovedOptionModule [ "fonts" "fontconfig" "renderMonoTTFAsBitmap" ] "")
-    (mkRemovedOptionModule [ "boot" "zfs" "enableUnstable" ] "0.7.0 is now the default")
 
     # ZSH
     (mkRenamedOptionModule [ "programs" "zsh" "enableSyntaxHighlighting" ] [ "programs" "zsh" "syntaxHighlighting" "enable" ])

nixos/modules/security/acme.xml

@@ -89,8 +89,5 @@ services.nginx = {
   };
 }
 </programlisting>
-
-<para>At the moment you still have to restart Nginx after the ACME
-certs arrive.</para>
 </section>
 </chapter>

nixos/modules/security/chromium-suid-sandbox.nix

@@ -19,9 +19,6 @@ in
 
       Also, if the URL chrome://sandbox tells you that "You are not adequately
       sandboxed!", turning this on might resolve the issue.
-
-      Finally, if you have <option>security.grsecurity</option> enabled and you
-      use Chromium, you probably need this.
     '';
   };
 

nixos/modules/security/grsecurity.nix

@@ -1,169 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-with lib;
-
-let
-  cfg = config.security.grsecurity;
-  grsecLockPath = "/proc/sys/kernel/grsecurity/grsec_lock";
-
-  # Ascertain whether NixOS container support is required
-  containerSupportRequired =
-    config.boot.enableContainers && config.containers != {};
-in
-
-{
-  meta = {
-    maintainers = with maintainers; [ ];
-    doc = ./grsecurity.xml;
-  };
-
-  options.security.grsecurity = {
-
-    enable = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Enable grsecurity/PaX.
-      '';
-    };
-
-    lockTunables = mkOption {
-      type = types.bool;
-      default = true;
-      description = ''
-        Whether to automatically lock grsecurity tunables
-        (<option>boot.kernel.sysctl."kernel.grsecurity.*"</option>).  Disable
-        this to allow runtime configuration of grsecurity features.  Activate
-        the <literal>grsec-lock</literal> service unit to prevent further
-        configuration until the next reboot.
-      '';
-    };
-
-    disableEfiRuntimeServices = mkOption {
-      type = types.bool;
-      default = true;
-      description = ''
-        Whether to disable access to EFI runtime services.  Enabling EFI runtime
-        services creates a venue for code injection attacks on the kernel and
-        should be disabled if at all possible.  Changing this option enters into
-        effect upon reboot.
-      '';
-    };
-
-  };
-
-  config = mkIf cfg.enable {
-
-    boot.kernelPackages = mkForce pkgs.linuxPackages_grsec_nixos;
-
-    boot.kernelParams = [ "grsec_sysfs_restrict=0" ]
-      ++ optional cfg.disableEfiRuntimeServices "noefi";
-
-    nixpkgs.config.grsecurity = true;
-
-    # Install PaX related utillities into the system profile.
-    environment.systemPackages = with pkgs; [ gradm paxctl pax-utils ];
-
-    # Install rules for the grsec device node
-    services.udev.packages = [ pkgs.gradm ];
-
-    # This service unit is responsible for locking the grsecurity tunables.  The
-    # unit is always defined, but only activated on bootup if lockTunables is
-    # toggled.  When lockTunables is toggled, failure to activate the unit will
-    # enter emergency mode.  The intent is to make it difficult to silently
-    # enter multi-user mode without having locked the tunables.  Some effort is
-    # made to ensure that starting the unit is an idempotent operation.
-    systemd.services.grsec-lock = {
-      description = "Lock grsecurity tunables";
-
-      wantedBy = optional cfg.lockTunables "multi-user.target";
-
-      wants = [ "local-fs.target" "systemd-sysctl.service" ];
-      after = [ "local-fs.target" "systemd-sysctl.service" ];
-      conflicts = [ "shutdown.target" ];
-
-      restartIfChanged = false;
-
-      script = ''
-        if ${pkgs.gnugrep}/bin/grep -Fq 0 ${grsecLockPath} ; then
-          echo -n 1 > ${grsecLockPath}
-        fi
-      '';
-
-      unitConfig = {
-        ConditionPathIsReadWrite = grsecLockPath;
-        DefaultDependencies = false;
-      } // optionalAttrs cfg.lockTunables {
-        OnFailure = "emergency.target";
-      };
-
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-      };
-    };
-
-    # Configure system tunables
-    boot.kernel.sysctl = {
-      # Read-only under grsecurity
-      "kernel.kptr_restrict" = mkForce null;
-
-      # All grsec tunables default to off, those not enabled below are
-      # *disabled*.  We use mkDefault to allow expert users to override
-      # our choices, but use mkForce where tunables would outright
-      # conflict with other settings.
-
-      # Enable all chroot restrictions by default (overwritten as
-      # necessary below)
-      "kernel.grsecurity.chroot_caps" = mkDefault 1;
-      "kernel.grsecurity.chroot_deny_bad_rename" = mkDefault 1;
-      "kernel.grsecurity.chroot_deny_chmod" = mkDefault 1;
-      "kernel.grsecurity.chroot_deny_chroot" = mkDefault 1;
-      "kernel.grsecurity.chroot_deny_fchdir" = mkDefault 1;
-      "kernel.grsecurity.chroot_deny_mknod" = mkDefault 1;
-      "kernel.grsecurity.chroot_deny_mount" = mkDefault 1;
-      "kernel.grsecurity.chroot_deny_pivot" = mkDefault 1;
-      "kernel.grsecurity.chroot_deny_shmat" = mkDefault 1;
-      "kernel.grsecurity.chroot_deny_sysctl" = mkDefault 1;
-      "kernel.grsecurity.chroot_deny_unix" = mkDefault 1;
-      "kernel.grsecurity.chroot_enforce_chdir" = mkDefault 1;
-      "kernel.grsecurity.chroot_findtask" = mkDefault 1;
-      "kernel.grsecurity.chroot_restrict_nice" = mkDefault 1;
-
-      # Enable various grsec protections
-      "kernel.grsecurity.consistent_setxid" = mkDefault 1;
-      "kernel.grsecurity.deter_bruteforce" = mkDefault 1;
-      "kernel.grsecurity.fifo_restrictions" = mkDefault 1;
-      "kernel.grsecurity.harden_ipc" = mkDefault 1;
-      "kernel.grsecurity.harden_ptrace" = mkDefault 1;
-      "kernel.grsecurity.harden_tty" = mkDefault 1;
-      "kernel.grsecurity.ip_blackhole" = mkDefault 1;
-      "kernel.grsecurity.linking_restrictions" = mkDefault 1;
-      "kernel.grsecurity.ptrace_readexec" = mkDefault 1;
-
-      # Enable auditing
-      "kernel.grsecurity.audit_ptrace" = mkDefault 1;
-      "kernel.grsecurity.forkfail_logging" = mkDefault 1;
-      "kernel.grsecurity.rwxmap_logging" = mkDefault 1;
-      "kernel.grsecurity.signal_logging" = mkDefault 1;
-      "kernel.grsecurity.timechange_logging" = mkDefault 1;
-    } // optionalAttrs config.nix.useSandbox {
-      # chroot(2) restrictions that conflict with sandboxed Nix builds
-      "kernel.grsecurity.chroot_caps" = mkForce 0;
-      "kernel.grsecurity.chroot_deny_chmod" = mkForce 0;
-      "kernel.grsecurity.chroot_deny_chroot" = mkForce 0;
-      "kernel.grsecurity.chroot_deny_mount" = mkForce 0;
-      "kernel.grsecurity.chroot_deny_pivot" = mkForce 0;
-    } // optionalAttrs containerSupportRequired {
-      # chroot(2) restrictions that conflict with NixOS lightweight containers
-      "kernel.grsecurity.chroot_caps" = mkForce 0;
-      "kernel.grsecurity.chroot_deny_chmod" = mkForce 0;
-      "kernel.grsecurity.chroot_deny_mount" = mkForce 0;
-      "kernel.grsecurity.chroot_restrict_nice" = mkForce 0;
-      # Disable privileged IO by default, unless X is enabled
-    } // optionalAttrs (!config.services.xserver.enable) {
-      "kernel.grsecurity.disable_priv_io" = mkDefault 1;
-    };
-
-  };
-}

nixos/modules/security/grsecurity.xml

@@ -1,385 +0,0 @@
-<chapter xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-grsecurity">
-
-  <title>Grsecurity/PaX</title>
-
-  <para>
-    Grsecurity/PaX is a set of patches against the Linux kernel that
-    implements an extensive suite of
-    <link xlink:href="https://grsecurity.net/features.php">features</link>
-    designed to increase the difficulty of exploiting kernel and
-    application bugs.
-  </para>
-
-  <para>
-    The NixOS grsecurity/PaX module is designed with casual users in mind and is
-    intended to be compatible with normal desktop usage, without
-    <emphasis>unnecessarily</emphasis> compromising security.  The
-    following sections describe the configuration and administration of
-    a grsecurity/PaX enabled NixOS system.  For more comprehensive
-    coverage, please refer to the
-    <link xlink:href="https://en.wikibooks.org/wiki/Grsecurity">grsecurity wikibook</link>
-    and the
-    <link xlink:href="https://wiki.archlinux.org/index.php/Grsecurity">Arch
-    Linux wiki page on grsecurity</link>.
-
-    <warning><para>Upstream has ceased free support for grsecurity/PaX.  See
-    <link xlink:href="https://grsecurity.net/passing_the_baton.php">
-    the announcement</link> for more information.  Consequently, NixOS
-    support for grsecurity/PaX also must cease.  Enabling this module will
-    result in a build error.</para></warning>
-    <note><para>We standardise on a desktop oriented configuration primarily due
-    to lack of resources.  The grsecurity/PaX configuration state space is huge
-    and each configuration requires quite a bit of testing to ensure that the
-    resulting packages work as advertised.  Defining additional package sets
-    would likely result in a large number of functionally broken packages, to
-    nobody's benefit.</para></note>
-  </para>
-
-  <sect1 xml:id="sec-grsec-enable"><title>Enabling grsecurity/PaX</title>
-
-  <para>
-    To make use of grsecurity/PaX on NixOS, add the following to your
-    <filename>configuration.nix</filename>:
-    <programlisting>
-      security.grsecurity.enable = true;
-    </programlisting>
-    followed by
-    <programlisting>
-      # nixos-rebuild boot
-      # reboot
-    </programlisting>
-    <note><para>
-      Enabling the grsecurity module overrides
-      <option>boot.kernelPackages</option>, to reduce the risk of
-      misconfiguration.  <xref linkend="sec-grsec-custom-kernel" />
-      describes how to use a custom kernel package set.
-    </para></note>
-
-    For most users, further configuration should be unnecessary.  All users
-    are encouraged to look over <xref linkend="sec-grsec-security" /> before
-    using the system, however.  If you experience problems, please refer to
-    <xref linkend="sec-grsec-issues" />.
-  </para>
-
-  <para>
-    Once booted into the new system, you can optionally use
-    <command>paxtest</command> to exercise various PaX features:
-    <screen><![CDATA[
-    # nix-shell -p paxtest --command 'paxtest blackhat'
-    Executable anonymous mapping             : Killed
-    Executable bss                           : Killed
-    # ... remaining output truncated for brevity
-    ]]></screen>
-  </para>
-
-  </sect1>
-
-  <sect1 xml:id="sec-grsec-declarative-tuning"><title>Declarative tuning</title>
-
-  <para>
-    The default configuration mode is strictly declarative.  Some features
-    simply cannot be changed at all after boot, while others are locked once the
-    system is up and running.  Moreover, changes to the configuration enter
-    into effect only upon booting into the new system.
-  </para>
-
-  <para>
-    The NixOS module exposes a limited number of options for tuning the behavior
-    of grsecurity/PaX.  These are options thought to be of particular interest
-    to most users.  For experts, further tuning is possible via
-    <option>boot.kernelParams</option> (see
-    <xref linkend="sec-grsec-kernel-params" />) and
-    <option>boot.kernel.sysctl."kernel.grsecurity.*"</option> (the wikibook
-    contains an <link xlink:href="https://en.wikibooks.org/wiki/Grsecurity/Appendix/Sysctl_Options">
-    exhaustive listing of grsecurity sysctl tunables</link>).
-  </para>
-
-  </sect1>
-
-  <sect1 xml:id="sec-grsec-manual-tuning"><title>Manual tuning</title>
-
-  <para>
-    To permit manual tuning of grsecurity runtime parameters, set:
-    <programlisting>
-      security.grsecurity.lockTunables = false;
-    </programlisting>
-    Once booted into this system, grsecurity features that have a corresponding
-    sysctl tunable can be changed without rebooting, either by switching into
-    a new system profile or via the <command>sysctl</command> utility.
-  </para>
-
-  <para>
-    To lock all grsecurity tunables until the next boot, do:
-    <screen>
-      # systemctl start grsec-lock
-    </screen>
-  </para>
-
-  </sect1>
-
-  <sect1 xml:id="sec-grsec-security"><title>Security considerations</title>
-
-  <para>
-    The NixOS kernel is built using upstream's recommended settings for a
-    desktop deployment that generally favours security over performance.  This
-    section details deviations from upstream's recommendations that may
-    compromise security.
-
-    <warning><para>There may be additional problems not covered here!</para>
-    </warning>
-  </para>
-
-  <itemizedlist>
-
-    <listitem><para>
-      The following hardening features are disabled in the NixOS kernel:
-      <itemizedlist>
-        <listitem><para>Kernel symbol hiding: rendered useless by redistributing
-        kernel objects.</para></listitem>
-
-        <listitem><para>Randomization of kernel structures: rendered useless by
-        redistributing kernel objects.</para></listitem>
-
-        <listitem><para>TCP simultaneous OPEN connection is permitted: breaking
-        strict TCP conformance is inappropriate for a general purpose kernel.
-        The trade-off is that an attacker may be able to deny outgoing
-        connections if they are able to guess the source port allocated by your
-        OS for that connection <emphasis>and</emphasis> also manage to initiate
-        a TCP simultaneous OPEN on that port before the connection is actually
-        established.</para></listitem>
-
-        <listitem><para>Trusted path execution: a desirable feature, but
-        requires some more work to operate smoothly on NixOS.</para></listitem>
-      </itemizedlist>
-    </para></listitem>
-
-    <listitem><para>
-      The NixOS module conditionally weakens <command>chroot</command>
-      restrictions to accommodate NixOS lightweight containers and sandboxed Nix
-      builds.  This can be problematic if the deployment also runs privileged
-      network facing processes that <emphasis>rely</emphasis> on
-      <command>chroot</command> for isolation.
-    </para></listitem>
-
-    <listitem><para>
-      The NixOS kernel is patched to allow usermode helpers from anywhere in the
-      Nix store.  A usermode helper is an executable called by the kernel in
-      certain circumstances, e.g., <command>modprobe</command>.  Vanilla
-      grsecurity only allows usermode helpers from paths typically owned by the
-      super user.  The NixOS kernel allows an attacker to inject malicious code
-      into the Nix store which could then be executed by the kernel as a
-      usermode helper.
-    </para></listitem>
-
-    <listitem><para>
-      The following features are disabled because they overlap with
-      vanilla kernel mechanisms:
-
-      <itemizedlist>
-        <listitem><para><filename class="directory">/proc</filename> hardening:
-        use <option>security.hideProcessInformation</option> instead.  This
-        trades weaker protection for greater compatibility.
-        </para></listitem>
-
-        <listitem><para><command>dmesg</command> restrictions:
-        use <option>boot.kernel.sysctl."kernel.dmesg_restrict"</option> instead
-        </para></listitem>
-      </itemizedlist>
-    </para></listitem>
-
-  </itemizedlist>
-
-  </sect1>
-
-  <sect1 xml:id="sec-grsec-custom-kernel"><title>Using a custom grsecurity/PaX kernel</title>
-
-  <para>
-    The NixOS kernel is likely to be either too permissive or too restrictive
-    for many deployment scenarios.  In addition to producing a kernel more
-    suitable for a particular deployment, a custom kernel may improve security
-    by depriving an attacker the ability to study the kernel object code, adding
-    yet more guesswork to successfully carry out certain exploits.
-  </para>
-
-  <para>
-    To build a custom kernel using upstream's recommended settings for server
-    deployments, while still using the NixOS module:
-    <programlisting>
-      nixpkgs.config.packageOverrides = super: {
-        linux_grsec_nixos = super.linux_grsec_nixos.override {
-          extraConfig = ''
-            GRKERNSEC_CONFIG_AUTO y
-            GRKERNSEC_CONFIG_SERVER y
-            GRKERNSEC_CONFIG_SECURITY y
-          '';
-        };
-      };
-    </programlisting>
-  </para>
-
-  <para>
-    The grsecurity/PaX wikibook provides an exhaustive listing of
-    <link xlink:href="https://en.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity_and_PaX_Configuration_Options">kernel configuration options</link>.
-  </para>
-
-  <para>
-    The NixOS module makes several assumptions about the kernel and so
-    may be incompatible with your customised kernel. Currently, the only way
-    to work around these incompatibilities is to eschew the NixOS
-    module.
-  </para>
-
-  <para>
-    If not using the NixOS module, a custom grsecurity package set can
-    be specified inline instead, as in
-    <programlisting>
-      boot.kernelPackages =
-        let
-          kernel = pkgs.linux_grsec_nixos.override {
-            extraConfig = /* as above */;
-          };
-          self = pkgs.linuxPackagesFor kernel self;
-        in self;
-    </programlisting>
-  </para>
-
-  </sect1>
-
-  <sect1 xml:id="sec-grsec-pax-flags"><title>Per-executable PaX flags</title>
-
-  <para>
-    Manual tuning of per-file PaX flags for executables in the Nix store is
-    impossible on a properly configured system.  If a package in Nixpkgs fails
-    due to PaX, that is a bug in the package recipe and should be reported to
-    the maintainer (including relevant <command>dmesg</command> output).
-  </para>
-
-  <para>
-    For executables installed outside of the Nix store, PaX flags can be set
-    using the <command>paxctl</command> utility:
-    <programlisting>
-      paxctl -czem <replaceable>foo</replaceable>
-    </programlisting>
-
-    <warning>
-      <para><command>paxctl</command> overwrites files in-place.</para>
-    </warning>
-
-    Equivalently, on file systems that support extended attributes:
-    <programlisting>
-      setfattr -n user.pax.flags -v em <replaceable>foo</replaceable>
-    </programlisting>
-
-    <!-- TODO: PaX flags via RBAC policy -->
-  </para>
-
-  </sect1>
-
-  <sect1 xml:id="sec-grsec-issues"><title>Issues and work-arounds</title>
-
-  <itemizedlist>
-    <listitem><para>User namespaces require <literal>CAP_SYS_ADMIN</literal>:
-    consequently, unprivileged namespaces are unsupported. Applications that
-    rely on namespaces for sandboxing must use a privileged helper. For chromium
-    there is <option>security.chromiumSuidSandbox.enable</option>.</para></listitem>
-
-    <listitem><para>Access to EFI runtime services is disabled by default:
-    this plugs a potential code injection attack vector; use
-    <option>security.grsecurity.disableEfiRuntimeServices</option> to override
-    this behavior.</para></listitem>
-
-    <listitem><para>User initiated autoloading of modules (e.g., when
-    using fuse or loop devices) is disallowed; either load requisite modules
-    as root or add them to <option>boot.kernelModules</option>.</para></listitem>
-
-    <listitem><para>Virtualization: KVM is the preferred virtualization
-    solution. Xen, Virtualbox, and VMWare are
-    <emphasis>unsupported</emphasis> and most likely require a custom kernel.
-    </para></listitem>
-
-    <listitem><para>
-      Attaching <command>gdb</command> to a running process is disallowed by
-      default: unprivileged users can only ptrace processes that are children of
-      the ptracing process.  To relax this restriction, set
-      <programlisting>
-        boot.kernel.sysctl."kernel.grsecurity.harden_ptrace" = 0;
-      </programlisting>
-    </para></listitem>
-
-    <listitem><para>
-      Overflows in boot critical code (e.g., the root filesystem module) can
-      render the system unbootable.  Work around by setting
-      <programlisting>
-        boot.kernelParams = [ "pax_size_overflow_report_only" ];
-      </programlisting>
-    </para></listitem>
-
-    <listitem><para>
-      The <citerefentry><refentrytitle>modify_ldt
-      </refentrytitle><manvolnum>2</manvolnum></citerefentry> syscall is disabled
-      by default.  This restriction can interfere with programs designed to run
-      legacy 16-bit or segmented 32-bit code.  To support applications that rely
-      on this syscall, set
-      <programlisting>
-        boot.kernel.sysctl."kernel.modify_ldt" = 1;
-      </programlisting>
-    </para></listitem>
-
-    <listitem><para>
-      The gitlab service (<xref linkend="module-services-gitlab" />)
-      requires a variant of the <literal>ruby</literal> interpreter
-      built without `mprotect()` hardening, as in
-      <programlisting>
-        services.gitlab.packages.gitlab = pkgs.gitlab.override {
-          ruby = pkgs.ruby.overrideAttrs (attrs: {
-            postFixup = "paxmark m $out/bin/ruby";
-          });
-        };
-      </programlisting>
-    </para></listitem>
-
-  </itemizedlist>
-
-  </sect1>
-
-  <sect1 xml:id="sec-grsec-kernel-params"><title>Grsecurity/PaX kernel parameters</title>
-
-  <para>
-    The NixOS kernel supports the following kernel command line parameters:
-    <itemizedlist>
-      <listitem><para>
-        <literal>pax_nouderef</literal>: disable UDEREF (separate kernel and
-        user address spaces).
-      </para></listitem>
-
-      <listitem><para>
-        <literal>pax_weakuderef</literal>: enable a faster but
-        weaker variant of UDEREF on 64-bit processors with PCID support
-        (check <code>grep pcid /proc/cpuinfo</code>).
-      </para></listitem>
-
-      <listitem><para>
-        <literal>pax_sanitize_slab={off|fast|full}</literal>: control kernel
-        slab object sanitization. Defaults to <literal>fast</literal>
-      </para></listitem>
-
-      <listitem><para>
-        <literal>pax_size_overflow_report_only</literal>: log size overflow
-        violations but leave the violating task running
-      </para></listitem>
-
-      <listitem><para>
-        <literal>grsec_sysfs_restrict=[0|1]</literal>: toggle sysfs
-        restrictions. The NixOS module sets this to <literal>0</literal>
-        for systemd compatibility
-      </para></listitem>
-    </itemizedlist>
-  </para>
-
-  </sect1>
-
-</chapter>

nixos/modules/security/lock-kernel-modules.nix

@@ -17,19 +17,27 @@ with lib;
   };
 
   config = mkIf config.security.lockKernelModules {
+    boot.kernelModules = concatMap (x:
+      if x.device != null
+        then
+          if x.fsType == "vfat"
+            then [ "vfat" "nls-cp437" "nls-iso8859-1" ]
+            else [ x.fsType ]
+        else []) config.system.build.fileSystems;
+
     systemd.services.disable-kernel-module-loading = rec {
       description = "Disable kernel module loading";
 
       wantedBy = [ config.systemd.defaultUnit ];
-      after = [ "systemd-udev-settle.service" "firewall.service" "systemd-modules-load.service" ] ++ wantedBy;
 
-      script = "echo -n 1 > /proc/sys/kernel/modules_disabled";
+      after = [ "systemd-udev-settle.service" "firewall.service" "systemd-modules-load.service" ] ++ wantedBy;
 
       unitConfig.ConditionPathIsReadWrite = "/proc/sys/kernel";
 
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
+        ExecStart = "/bin/sh -c 'echo -n 1 >/proc/sys/kernel/modules_disabled'";
       };
     };
   };

nixos/modules/security/pam.nix

@@ -41,7 +41,7 @@ let
         type = types.bool;
         description = ''
           If set, users listed in
-          <filename>~/.yubico/u2f_keys</filename> are able to log in
+          <filename>~/.config/Yubico/u2f_keys</filename> are able to log in
           with the associated U2F key.
         '';
       };

nixos/modules/security/pam_usb.nix

@@ -22,7 +22,7 @@ in
         description = ''
           Enable USB login for all login systems that support it.  For
           more information, visit <link
-          xlink:href="http://pamusb.org/doc/quickstart#setting_up" />.
+          xlink:href="https://github.com/aluzzardi/pam_usb/wiki/Getting-Started#setting-up-devices-and-users" />.
         '';
       };
 

nixos/modules/security/sudo.nix

@@ -31,8 +31,8 @@ in
       default = true;
       description =
         ''
-          Whether users of the <code>wheel</code> group can execute
-          commands as super user without entering a password.
+          Whether users of the <code>wheel</code> group must
+          provide a password to run commands as super user via <command>sudo</command>.
         '';
       };
 

nixos/modules/security/wrappers/default.nix

@@ -155,7 +155,10 @@ in
   ###### implementation
   config = {
 
-    security.wrappers.fusermount.source = "${pkgs.fuse}/bin/fusermount";
+    security.wrappers = {
+      fusermount.source = "${pkgs.fuse}/bin/fusermount";
+      fusermount3.source = "${pkgs.fuse3}/bin/fusermount3";
+    };
 
     boot.specialFileSystems.${parentWrapperDir} = {
       fsType = "tmpfs";

nixos/modules/services/amqp/rabbitmq.nix

@@ -105,7 +105,8 @@ in {
         RABBITMQ_MNESIA_BASE = "${cfg.dataDir}/mnesia";
         RABBITMQ_NODE_IP_ADDRESS = cfg.listenAddress;
         RABBITMQ_NODE_PORT = toString cfg.port;
-        RABBITMQ_SERVER_START_ARGS = "-rabbit error_logger tty -rabbit sasl_error_logger false";
+        RABBITMQ_LOGS = "-";
+        RABBITMQ_SASL_LOGS = "-";
         RABBITMQ_PID_FILE = "${cfg.dataDir}/pid";
         SYS_PREFIX = "";
         RABBITMQ_ENABLED_PLUGINS_FILE = pkgs.writeText "enabled_plugins" ''
@@ -128,7 +129,7 @@ in {
       preStart = ''
         ${optionalString (cfg.cookie != "") ''
             echo -n ${cfg.cookie} > ${cfg.dataDir}/.erlang.cookie
-            chmod 400 ${cfg.dataDir}/.erlang.cookie
+            chmod 600 ${cfg.dataDir}/.erlang.cookie
         ''}
       '';
     };

nixos/modules/services/audio/mopidy.nix

@@ -4,17 +4,22 @@ with pkgs;
 with lib;
 
 let
-
   uid = config.ids.uids.mopidy;
   gid = config.ids.gids.mopidy;
   cfg = config.services.mopidy;
 
   mopidyConf = writeText "mopidy.conf" cfg.configuration;
 
-  mopidyEnv = python.buildEnv.override {
-    extraLibs = [ mopidy ] ++ cfg.extensionPackages;
+  mopidyEnv = buildEnv {
+    name = "mopidy-with-extensions-${mopidy.version}";
+    paths = closePropagation cfg.extensionPackages;
+    pathsToLink = [ "/${python.sitePackages}" ];
+    buildInputs = [ makeWrapper ];
+    postBuild = ''
+      makeWrapper ${mopidy}/bin/mopidy $out/bin/mopidy \
+        --prefix PYTHONPATH : $out/${python.sitePackages}
+    '';
   };
-
 in {
 
   options = {
@@ -61,7 +66,6 @@ in {
 
   };
 
-
   ###### implementation
 
   config = mkIf cfg.enable {