[pull] master from NixOS:master

.github/workflows/manual-nixpkgs.yml

@@ -29,4 +29,4 @@ jobs:
           name: nixpkgs-ci
           signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
       - name: Building Nixpkgs manual
-        run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true pkgs/top-level/release.nix -A manual
+        run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true pkgs/top-level/release.nix -A manual -A manual.tests

doc/default.nix

@@ -149,4 +149,26 @@ in pkgs.stdenv.mkDerivation {
     echo "doc manual $dest ${common.indexPath}" >> $out/nix-support/hydra-build-products
     echo "doc manual $dest nixpkgs-manual.epub" >> $out/nix-support/hydra-build-products
   '';
+
+  passthru.tests.manpage-urls = with pkgs; testers.invalidateFetcherByDrvHash
+    ({ name ? "manual_check-manpage-urls"
+     , script
+     , urlsFile
+     }: runCommand name {
+      nativeBuildInputs = [
+        cacert
+        (python3.withPackages (p: with p; [
+          aiohttp
+          rich
+          structlog
+        ]))
+      ];
+      outputHash = "sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=";  # Empty output
+    } ''
+      python3 ${script} ${urlsFile}
+      touch $out
+    '') {
+      script = ./tests/manpage-urls.py;
+      urlsFile = ./manpage-urls.json;
+    };
 }

doc/manpage-urls.json

@@ -1,5 +1,5 @@
 {
-  "gnunet.conf(5)": "https://docs.gnunet.org/users/configuration.html",
+  "gnunet.conf(5)": "https://docs.gnunet.org/latest/users/configuration.html",
   "mpd(1)": "https://mpd.readthedocs.io/en/latest/mpd.1.html",
   "mpd.conf(5)": "https://mpd.readthedocs.io/en/latest/mpd.conf.5.html",
   "nix.conf(5)": "https://nixos.org/manual/nix/stable/command-ref/conf-file.html",

doc/stdenv/stdenv.chapter.md

@@ -831,7 +831,7 @@ Note that shell arrays cannot be passed through environment variables, so you ca
 
 ##### `buildFlags` / `buildFlagsArray` {#var-stdenv-buildFlags}
 
-A list of strings passed as additional flags to `make`. Like `makeFlags` and `makeFlagsArray`, but only used by the build phase.
+A list of strings passed as additional flags to `make`. Like `makeFlags` and `makeFlagsArray`, but only used by the build phase. Any build targets should be specified as part of the `buildFlags`.
 
 ##### `preBuild` {#var-stdenv-preBuild}
 
@@ -872,7 +872,7 @@ If unset, use `check` if it exists, otherwise `test`; if neither is found, do no
 
 ##### `checkFlags` / `checkFlagsArray` {#var-stdenv-checkFlags}
 
-A list of strings passed as additional flags to `make`. Like `makeFlags` and `makeFlagsArray`, but only used by the check phase.
+A list of strings passed as additional flags to `make`. Like `makeFlags` and `makeFlagsArray`, but only used by the check phase. Unlike with `buildFlags`, the `checkTarget` is automatically added to the `make` invocation in addition to any `checkFlags` specified.
 
 ##### `checkInputs` {#var-stdenv-checkInputs}
 
@@ -914,7 +914,7 @@ installTargets = "install-bin install-doc";
 
 ##### `installFlags` / `installFlagsArray` {#var-stdenv-installFlags}
 
-A list of strings passed as additional flags to `make`. Like `makeFlags` and `makeFlagsArray`, but only used by the install phase.
+A list of strings passed as additional flags to `make`. Like `makeFlags` and `makeFlagsArray`, but only used by the install phase. Unlike with `buildFlags`, the `installTargets` are automatically added to the `make` invocation in addition to any `installFlags` specified.
 
 ##### `preInstall` {#var-stdenv-preInstall}
 

doc/tests/manpage-urls.py

@@ -0,0 +1,109 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i "python3 -I" -p "python3.withPackages(p: with p; [ aiohttp rich structlog ])"
+
+from argparse import ArgumentParser, Namespace
+from collections import defaultdict
+from collections.abc import Mapping, Sequence
+from enum import IntEnum
+from http import HTTPStatus
+from pathlib import Path
+from typing import Optional
+import asyncio, json, logging
+
+import aiohttp, structlog
+from structlog.contextvars import bound_contextvars as log_context
+
+
+LogLevel = IntEnum('LogLevel', {
+    lvl: getattr(logging, lvl)
+    for lvl in ('DEBUG', 'INFO', 'WARNING', 'ERROR', 'CRITICAL')
+})
+LogLevel.__str__ = lambda self: self.name
+
+
+EXPECTED_STATUS=frozenset((
+    HTTPStatus.OK, HTTPStatus.FOUND,
+    HTTPStatus.NOT_FOUND,
+))
+
+async def check(session: aiohttp.ClientSession, manpage: str, url: str) -> HTTPStatus:
+    with log_context(manpage=manpage, url=url):
+        logger.debug("Checking")
+        async with session.head(url) as resp:
+            st = HTTPStatus(resp.status)
+            match st:
+                case HTTPStatus.OK | HTTPStatus.FOUND:
+                    logger.debug("OK!")
+                case HTTPStatus.NOT_FOUND:
+                    logger.error("Broken link!")
+                case _ if st < 400:
+                    logger.info("Unexpected code", status=st)
+                case _ if 400 <= st < 600:
+                    logger.warn("Unexpected error", status=st)
+
+            return st
+
+async def main(urls_path: Path) -> Mapping[HTTPStatus, int]:
+    logger.info(f"Parsing {urls_path}")
+    with urls_path.open() as urls_file:
+        urls = json.load(urls_file)
+
+    count: defaultdict[HTTPStatus, int] = defaultdict(lambda: 0)
+
+    logger.info(f"Checking URLs from {urls_path}")
+    async with aiohttp.ClientSession() as session:
+        for status in asyncio.as_completed([
+            check(session, manpage, url)
+            for manpage, url in urls.items()
+        ]):
+            count[await status]+=1
+
+    ok = count[HTTPStatus.OK] + count[HTTPStatus.FOUND]
+    broken = count[HTTPStatus.NOT_FOUND]
+    unknown = sum(c for st, c in count.items() if st not in EXPECTED_STATUS)
+    logger.info(f"Done: {broken} broken links, "
+                f"{ok} correct links, and {unknown} unexpected status")
+
+    return count
+
+
+def parse_args(args: Optional[Sequence[str]] = None) -> Namespace:
+    parser = ArgumentParser(
+        prog = 'check-manpage-urls',
+        description = 'Check the validity of the manpage URLs linked in the nixpkgs manual',
+    )
+    parser.add_argument(
+        '-l', '--log-level',
+        default = os.getenv('LOG_LEVEL', 'INFO'),
+        type = lambda s: LogLevel[s],
+        choices = list(LogLevel),
+    )
+    parser.add_argument(
+        'file',
+        type = Path,
+        nargs = '?',
+    )
+
+    return parser.parse_args(args)
+
+
+if __name__ == "__main__":
+    import os, sys
+
+    args = parse_args()
+
+    structlog.configure(
+        wrapper_class=structlog.make_filtering_bound_logger(args.log_level),
+    )
+    logger = structlog.getLogger("check-manpage-urls.py")
+
+    urls_path = args.file
+    if urls_path is None:
+        REPO_ROOT = Path(__file__).parent.parent.parent.parent
+        logger.info(f"Assuming we are in a nixpkgs repo rooted at {REPO_ROOT}")
+
+        urls_path = REPO_ROOT / 'doc' / 'manpage-urls.json'
+
+    count = asyncio.run(main(urls_path))
+
+    sys.exit(0 if count[HTTPStatus.NOT_FOUND] == 0 else 1)

maintainers/maintainer-list.nix

@@ -4240,6 +4240,12 @@
       fingerprint = "B26F 9AD8 DA20 3392 EF87  C61A BB99 9F83 D9A1 9A36";
     }];
   };
+  dblsaiko = {
+    email = "me@dblsaiko.net";
+    github = "2xsaiko";
+    githubId = 3987560;
+    name = "Marco Rebhan";
+  };
   dbohdan = {
     email = "dbohdan@dbohdan.com";
     github = "dbohdan";
@@ -6773,6 +6779,10 @@
     githubId = 1447245;
     name = "Robin Gloster";
   };
+  gm6k = {
+    email = "nix@quidecco.pl";
+    name = "Isidor Zeuner";
+  };
   gmemstr = {
     email = "git@gmem.ca";
     github = "gmemstr";
@@ -9041,6 +9051,12 @@
     githubId = 752510;
     name = "Martin Potier";
   };
+  jpts = {
+    email = "james+nixpkgs@cleverley-prance.uk";
+    github = "jpts";
+    githubId = 5352661;
+    name = "James Cleverley-Prance";
+  };
   jqqqqqqqqqq = {
     email = "jqqqqqqqqqq@gmail.com";
     github = "jqqqqqqqqqq";
@@ -15960,6 +15976,15 @@
     github = "rumpelsepp";
     githubId = 1961699;
   };
+  running-grass = {
+    name = "Leo Liu";
+    email = "467195537@qq.com";
+    github = "running-grass";
+    githubId = 17241154;
+    keys = [{
+      fingerprint = "5156 0FAB FF32 83EC BC8C  EA13 9344 3660 9397 0138";
+    }];
+  };
   rushmorem = {
     email = "rushmore@webenchanter.com";
     github = "rushmorem";
@@ -16968,6 +16993,12 @@
     githubId = 8017899;
     name = "Sivaram Balakrishnan";
   };
+  sixstring982 = {
+    email = "sixstring982@gmail.com";
+    github = "sixstring982";
+    githubId = 1328977;
+    name = "Trent Small";
+  };
   sjagoe = {
     email = "simon@simonjagoe.com";
     github = "sjagoe";

nixos/modules/programs/ssh.nix

@@ -8,14 +8,12 @@ let
 
   cfg  = config.programs.ssh;
 
-  askPassword = cfg.askPassword;
-
   askPasswordWrapper = pkgs.writeScript "ssh-askpass-wrapper"
     ''
       #! ${pkgs.runtimeShell} -e
       export DISPLAY="$(systemctl --user show-environment | ${pkgs.gnused}/bin/sed 's/^DISPLAY=\(.*\)/\1/; t; d')"
       export WAYLAND_DISPLAY="$(systemctl --user show-environment | ${pkgs.gnused}/bin/sed 's/^WAYLAND_DISPLAY=\(.*\)/\1/; t; d')"
-      exec ${askPassword} "$@"
+      exec ${cfg.askPassword} "$@"
     '';
 
   knownHosts = attrValues cfg.knownHosts;
@@ -52,10 +50,11 @@ in
       };
 
       forwardX11 = mkOption {
-        type = types.bool;
+        type = with lib.types; nullOr bool;
         default = false;
         description = lib.mdDoc ''
           Whether to request X11 forwarding on outgoing connections by default.
+          If set to null, the option is not set at all.
           This is useful for running graphical programs on the remote machine and have them display to your local X11 server.
           Historically, this value has depended on the value used by the local sshd daemon, but there really isn't a relation between the two.
           Note: there are some security risks to forwarding an X11 connection.
@@ -274,10 +273,10 @@ in
   config = {
 
     programs.ssh.setXAuthLocation =
-      mkDefault (config.services.xserver.enable || config.programs.ssh.forwardX11 || config.services.openssh.settings.X11Forwarding);
+      mkDefault (config.services.xserver.enable || config.programs.ssh.forwardX11 == true || config.services.openssh.settings.X11Forwarding);
 
     assertions =
-      [ { assertion = cfg.forwardX11 -> cfg.setXAuthLocation;
+      [ { assertion = cfg.forwardX11 == true -> cfg.setXAuthLocation;
           message = "cannot enable X11 forwarding without setting XAuth location";
         }
       ] ++ flip mapAttrsToList cfg.knownHosts (name: data: {
@@ -298,11 +297,8 @@ in
         AddressFamily ${if config.networking.enableIPv6 then "any" else "inet"}
         GlobalKnownHostsFile ${concatStringsSep " " knownHostsFiles}
 
-        ${optionalString cfg.setXAuthLocation ''
-          XAuthLocation ${pkgs.xorg.xauth}/bin/xauth
-        ''}
-
-        ForwardX11 ${if cfg.forwardX11 then "yes" else "no"}
+        ${optionalString cfg.setXAuthLocation "XAuthLocation ${pkgs.xorg.xauth}/bin/xauth"}
+        ${lib.optionalString (cfg.forwardX11 != null) "ForwardX11 ${if cfg.forwardX11 then "yes" else "no"}"}
 
         ${optionalString (cfg.pubkeyAcceptedKeyTypes != []) "PubkeyAcceptedKeyTypes ${concatStringsSep "," cfg.pubkeyAcceptedKeyTypes}"}
         ${optionalString (cfg.hostKeyAlgorithms != []) "HostKeyAlgorithms ${concatStringsSep "," cfg.hostKeyAlgorithms}"}
@@ -344,7 +340,7 @@ in
         fi
       '';
 
-    environment.variables.SSH_ASKPASS = optionalString cfg.enableAskPassword askPassword;
+    environment.variables.SSH_ASKPASS = optionalString cfg.enableAskPassword cfg.askPassword;
 
   };
 }

nixos/modules/services/home-automation/home-assistant.nix

@@ -468,8 +468,8 @@ in {
           mkdir -p "${cfg.configDir}/custom_components"
 
           # remove components symlinked in from below the /nix/store
-          components="$(find "${cfg.configDir}/custom_components" -maxdepth 1 -type l)"
-          for component in "$components"; do
+          readarray -d "" components < <(find "${cfg.configDir}/custom_components" -maxdepth 1 -type l -print0)
+          for component in "''${components[@]}"; do
             if [[ "$(readlink "$component")" =~ ^${escapeShellArg builtins.storeDir} ]]; then
               rm "$component"
             fi

nixos/modules/services/misc/gitea.nix

@@ -234,6 +234,13 @@ in
         description = lib.mdDoc "Path to the git repositories.";
       };
 
+      camoHmacKeyFile = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "/var/lib/secrets/gitea/camoHmacKey";
+        description = lib.mdDoc "Path to a file containing the camo HMAC key.";
+      };
+
       mailerPasswordFile = mkOption {
         type = types.nullOr types.str;
         default = null;
@@ -429,6 +436,10 @@ in
         LFS_JWT_SECRET = "#lfsjwtsecret#";
       };
 
+      camo = mkIf (cfg.camoHmacKeyFile != null) {
+        HMAC_KEY = "#hmackey#";
+      };
+
       session = {
         COOKIE_NAME = lib.mkDefault "session";
       };
@@ -570,6 +581,10 @@ in
               ${replaceSecretBin} '#lfsjwtsecret#' '${lfsJwtSecret}' '${runConfig}'
             ''}
 
+            ${lib.optionalString (cfg.camoHmacKeyFile != null) ''
+              ${replaceSecretBin} '#hmackey#' '${cfg.camoHmacKeyFile}' '${runConfig}'
+            ''}
+
             ${lib.optionalString (cfg.mailerPasswordFile != null) ''
               ${replaceSecretBin} '#mailerpass#' '${cfg.mailerPasswordFile}' '${runConfig}'
             ''}

nixos/modules/services/monitoring/prometheus/exporters/nginx.nix

@@ -43,14 +43,14 @@ in
     };
   };
   serviceOpts = mkMerge ([{
+    environment.CONST_LABELS = concatStringsSep "," cfg.constLabels;
     serviceConfig = {
       ExecStart = ''
         ${pkgs.prometheus-nginx-exporter}/bin/nginx-prometheus-exporter \
           --nginx.scrape-uri='${cfg.scrapeUri}' \
-          --nginx.ssl-verify=${boolToString cfg.sslVerify} \
+          --${lib.optionalString (!cfg.sslVerify) "no-"}nginx.ssl-verify \
           --web.listen-address=${cfg.listenAddress}:${toString cfg.port} \
           --web.telemetry-path=${cfg.telemetryPath} \
-          --prometheus.const-labels=${concatStringsSep "," cfg.constLabels} \
           ${concatStringsSep " \\\n  " cfg.extraFlags}
       '';
     };