staging-next-25.11 iteration 2 - 2025-12-27

nixos/modules/module-list.nix

@@ -255,6 +255,7 @@
   ./programs/less.nix
   ./programs/liboping.nix
   ./programs/light.nix
+  ./programs/lix.nix
   ./programs/localsend.nix
   ./programs/mdevctl.nix
   ./programs/mepo.nix

nixos/modules/programs/lix.nix

@@ -0,0 +1,128 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+
+  cfg = config.nix;
+
+  nixPackage = cfg.package.out;
+
+  commonNixDaemonConfig = {
+    path = [
+      nixPackage
+      config.programs.ssh.package
+    ];
+
+    environment =
+      cfg.envVars
+      // {
+        CURL_CA_BUNDLE = config.security.pki.caBundle;
+      }
+      // config.networking.proxy.envVars;
+
+    serviceConfig = {
+      CPUSchedulingPolicy = cfg.daemonCPUSchedPolicy;
+      IOSchedulingClass = cfg.daemonIOSchedClass;
+      IOSchedulingPriority = cfg.daemonIOSchedPriority;
+    };
+  };
+
+  makeNixBuildUser = nr: {
+    name = "nixbld${toString nr}";
+    value = {
+      description = "Lix build user ${toString nr}";
+      uid = builtins.add config.ids.uids.nixbld nr;
+      isSystemUser = true;
+      group = "nixbld";
+      extraGroups = [ "nixbld" ];
+    };
+  };
+
+  nixbldUsers = lib.listToAttrs (map makeNixBuildUser (lib.range 1 cfg.nrBuildUsers));
+
+in
+
+{
+  config = lib.mkIf (cfg.enable && nixPackage.pname == "lix") {
+    environment.systemPackages = [
+      nixPackage
+      pkgs.nix-info
+    ]
+    ++ lib.optional (config.programs.bash.completion.enable) pkgs.nix-bash-completions;
+
+    systemd.packages = [ nixPackage ];
+
+    systemd.tmpfiles.packages = [ nixPackage ];
+
+    systemd.sockets.nix-daemon.wantedBy = [ "sockets.target" ];
+
+    systemd.services."nix-daemon@" = lib.mkMerge [
+      commonNixDaemonConfig
+      {
+        # Do not kill connections serving established connections on upgrade.
+        restartIfChanged = false;
+      }
+    ];
+
+    systemd.services.nix-daemon = lib.mkMerge [
+      commonNixDaemonConfig
+      {
+        restartTriggers = [ config.environment.etc."nix/nix.conf".source ];
+
+        # `stopIfChanged = false` changes to switch behavior
+        # from   stop -> update units -> start
+        #   to   update units -> restart
+        #
+        # The `stopIfChanged` setting therefore controls a trade-off between a
+        # more predictable lifecycle, which runs the correct "version" of
+        # the `ExecStop` line, and on the other hand the availability of
+        # sockets during the switch, as the effectiveness of the stop operation
+        # depends on the socket being stopped as well.
+        #
+        # As `nix-daemon.service` does not make use of `ExecStop`, we prefer
+        # to keep the socket up and available. This is important for machines
+        # that run Nix-based services, such as automated build, test, and deploy
+        # services, that expect the daemon socket to be available at all times.
+        #
+        # Notably, the Nix client does not retry on failure to connect to the
+        # daemon socket, and the in-process RemoteStore instance will disable
+        # itself. This makes retries infeasible even for services that are
+        # aware of the issue. Failure to connect can affect not only new client
+        # processes, but also new RemoteStore instances in existing processes,
+        # as well as existing RemoteStore instances that have not saturated
+        # their connection pool.
+        #
+        # Also note that `stopIfChanged = true` does not kill existing
+        # connection handling daemons, as one might wish to happen before a
+        # breaking Nix upgrade (which is rare). The daemon forks that handle
+        # the individual connections split off into their own sessions, causing
+        # them not to be stopped by systemd.
+        # If a Nix upgrade does require all existing daemon processes to stop,
+        # nix-daemon must do so on its own accord, and only when the new version
+        # starts and detects that Nix's persistent state needs an upgrade.
+        stopIfChanged = false;
+
+      }
+    ];
+
+    # Set up the environment variables for running Nix.
+    environment.sessionVariables = cfg.envVars;
+
+    nix.nrBuildUsers = lib.mkDefault (
+      if cfg.settings.auto-allocate-uids or false then
+        0
+      else
+        lib.max 32 (if cfg.settings.max-jobs == "auto" then 0 else cfg.settings.max-jobs)
+    );
+
+    users.users = nixbldUsers;
+
+    services.displayManager.hiddenUsers = lib.attrNames nixbldUsers;
+
+    # Legacy configuration conversion.
+    nix.settings.sandbox-fallback = false;
+  };
+}

nixos/modules/services/system/nix-daemon.nix

@@ -16,10 +16,6 @@ let
 
   nixPackage = cfg.package.out;
 
-  # nixVersion is an attribute which defines the implementation version.
-  # This is useful for Nix implementations which don't follow Nix's versioning.
-  isNixAtLeast = lib.versionAtLeast (nixPackage.nixVersion or (lib.getVersion nixPackage));
-
   makeNixBuildUser = nr: {
     name = "nixbld${toString nr}";
     value = {
@@ -187,7 +183,7 @@ in
 
   ###### implementation
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf (cfg.enable && nixPackage.pname != "lix") {
     environment.systemPackages = [
       nixPackage
       pkgs.nix-info
@@ -196,26 +192,15 @@ in
 
     systemd.packages = [ nixPackage ];
 
-    systemd.tmpfiles = lib.mkMerge [
-      (lib.mkIf (isNixAtLeast "2.8") {
-        packages = [ nixPackage ];
-      })
-      (lib.mkIf (!isNixAtLeast "2.8") {
-        rules = [
-          "d /nix/var/nix/daemon-socket 0755 root root - -"
-        ];
-      })
-    ];
+    systemd.tmpfiles.packages = [ nixPackage ];
 
     systemd.sockets.nix-daemon.wantedBy = [ "sockets.target" ];
 
     systemd.services.nix-daemon = {
       path = [
         nixPackage
-        pkgs.util-linux
         config.programs.ssh.package
-      ]
-      ++ lib.optionals cfg.distributedBuilds [ pkgs.gzip ];
+      ];
 
       environment =
         cfg.envVars
@@ -224,15 +209,10 @@ in
         }
         // config.networking.proxy.envVars;
 
-      unitConfig.RequiresMountsFor = "/nix/store";
-
       serviceConfig = {
         CPUSchedulingPolicy = cfg.daemonCPUSchedPolicy;
         IOSchedulingClass = cfg.daemonIOSchedClass;
         IOSchedulingPriority = cfg.daemonIOSchedPriority;
-        LimitNOFILE = 1048576;
-        Delegate = "yes";
-        DelegateSubgroup = "supervisor";
       };
 
       restartTriggers = [ config.environment.etc."nix/nix.conf".source ];
@@ -287,10 +267,7 @@ in
     services.displayManager.hiddenUsers = lib.attrNames nixbldUsers;
 
     # Legacy configuration conversion.
-    nix.settings = lib.mkMerge [
-      (lib.mkIf (isNixAtLeast "2.3pre") { sandbox-fallback = false; })
-    ];
-
+    nix.settings.sandbox-fallback = false;
   };
 
 }

pkgs/applications/graphics/ImageMagick/default.nix

@@ -85,13 +85,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-9";
+  version = "7.1.2-10";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-bXVVnjJhtmcbczZI9rsy2JQ3p2oYX5g5vp3YdsQkdrE=";
+    hash = "sha256-96lhd0B4yV2s/zVazKrqAcDZvn+yIiXxp8fqyKSfxLc=";
   };
 
   outputs = [

pkgs/applications/video/jellyfin-media-player/default.nix → pkgs/applications/video/jellyfin-desktop/default.nix

@@ -4,64 +4,82 @@
   stdenv,
   cmake,
   ninja,
+  python3,
   wrapQtAppsHook,
   qtbase,
   qtdeclarative,
   qtwebchannel,
   qtwebengine,
+  mpv-unwrapped,
   mpvqt,
   libcec,
   SDL2,
   libXrandr,
+  cacert,
+  nix-update-script,
 }:
 stdenv.mkDerivation rec {
-  pname = "jellyfin-media-player";
+  pname = "jellyfin-desktop";
   version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
-    repo = "jellyfin-media-player";
+    repo = "jellyfin-desktop";
     rev = "v${version}";
-    hash = "sha256-tdjmOeuC3LFEIDSH8X9LG/myvE1FoxwR1zpDQRyaTkQ=";
+    hash = "sha256-ITlYOrMS6COx9kDRSBi4wM6mzL/Q2G5X9GbABwDIOe4=";
+    fetchSubmodules = true;
   };
+  patches = [
+    ./non-fatal-unique-app.patch
+  ];
 
   nativeBuildInputs = [
     cmake
     ninja
     wrapQtAppsHook
-  ];
+  ]
+  ++ lib.optional stdenv.hostPlatform.isDarwin python3;
 
   buildInputs = [
     qtbase
     qtdeclarative
     qtwebchannel
     qtwebengine
-
-    mpvqt
+    mpv-unwrapped
 
     # input sources
     libcec
     SDL2
 
     # frame rate switching
     libXrandr
-  ];
+    cacert
+  ]
+  ++ lib.optional (!stdenv.hostPlatform.isDarwin) mpvqt;
 
   cmakeFlags = [
     "-DCHECK_FOR_UPDATES=OFF"
-    "-DUSE_STATIC_MPVQT=OFF"
     # workaround for Qt cmake weirdness
     "-DQT_DISABLE_NO_DEFAULT_PATH_IN_QT_PACKAGES=ON"
+  ]
+  ++ lib.optional stdenv.hostPlatform.isDarwin "-DUSE_STATIC_MPVQT=ON"
+  ++ lib.optional (!stdenv.hostPlatform.isDarwin) "-DUSE_STATIC_MPVQT=OFF";
+
+  qtWrapperArgs = [
+    "--set QT_STYLE_OVERRIDE Fusion"
+    "--set NIX_SSL_CERT_FILE ${cacert}/etc/ssl/certs/ca-bundle.crt"
   ];
 
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir -p $out/bin $out/Applications
-    mv "$out/Jellyfin Media Player.app" $out/Applications
-    ln -s "$out/Applications/Jellyfin Media Player.app/Contents/MacOS/Jellyfin Media Player" $out/bin/jellyfinmediaplayer
+    mv "$out/Jellyfin Desktop.app" $out/Applications
+    ln -s "$out/Applications/Jellyfin Desktop.app/Contents/MacOS/Jellyfin Desktop" $out/bin/jellyfindesktop
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
-    homepage = "https://github.com/jellyfin/jellyfin-media-player";
+    homepage = "https://github.com/jellyfin/jellyfin-desktop";
     description = "Jellyfin Desktop Client";
     license = with lib.licenses; [
       gpl2Only
@@ -78,6 +96,6 @@ stdenv.mkDerivation rec {
       kranzes
       paumr
     ];
-    mainProgram = "jellyfinmediaplayer";
+    mainProgram = "jellyfin-desktop";
   };
 }

pkgs/applications/video/jellyfin-desktop/non-fatal-unique-app.patch

@@ -0,0 +1,19 @@
+--- a/src/shared/UniqueApplication.h
++++ b/src/shared/UniqueApplication.h
+@@ -6,6 +6,7 @@
+ #define KONVERGO_UNIQUEAPPLICATION_H
+
+ #include <QObject>
++#include <QDebug>
+ #include "Paths.h"
+ #include "LocalJsonServer.h"
+ #include "LocalJsonClient.h"
+@@ -35,7 +36,7 @@
+     });
+
+     if (!m_server->listen())
+-      throw FatalException("Failed to listen to uniqueApp socket: " + m_server->errorString());
++      qWarning() << "Failed to listen to uniqueApp socket: " << m_server->errorString();
+   }
+
+   bool ensureUnique()

pkgs/applications/virtualization/qemu/force-uid0-on-9p.patch

@@ -9,7 +9,7 @@ index 45e9a1f9b0..494ee00c66 100644
 +static int is_in_store_path(const char *path)
 +{
 +    static char *store_path = NULL;
-+    int store_path_len = -1;
++    static ssize_t store_path_len = -1;
 +
 +    if (store_path_len == -1) {
 +        if ((store_path = getenv("NIX_STORE")) != NULL)
@@ -19,7 +19,7 @@ index 45e9a1f9b0..494ee00c66 100644
 +    }
 +
 +    if (store_path_len > 0)
-+        return strncmp(path, store_path, strlen(store_path)) == 0;
++        return strncmp(path, store_path, store_path_len) == 0;
 +    return 0;
 +}
 +

pkgs/by-name/ap/apple-sdk/common/plists.nix

@@ -16,7 +16,6 @@ let
       STRIP_PNG_TEXT = "NO";
     };
     Description = if stdenvNoCC.hostPlatform.isMacOS then "macOS" else "iOS";
-    FamilyDisplayName = Description;
     FamilyIdentifier = lib.toLower xcodePlatform;
     FamilyName = Description;
     Identifier = CFBundleIdentifier;

pkgs/by-name/cr/cryptsetup/package.nix

@@ -25,7 +25,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cryptsetup";
-  version = "2.8.1";
+  version = "2.8.3";
 
   outputs = [
     "bin"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     url =
       "mirror://kernel/linux/utils/cryptsetup/v${lib.versions.majorMinor finalAttrs.version}/"
       + "cryptsetup-${finalAttrs.version}.tar.xz";
-    hash = "sha256-LDN563ZZfcq1CRFEmwE+JpfEv/zHFtu/DZsOj7u0b7Q=";
+    hash = "sha256-SoojuLnRoyUEUuQKzq1EIaA+RaOJVK0FlWNPQmaqgA8=";
   };
 
   patches = [