NixOS · pennae · May 13, 2024 · Oct 24, 2023 · Oct 24, 2023 · Oct 24, 2023
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -67,6 +67,9 @@
 /nixos/lib/make-disk-image.nix                 @raitobezarius
 
 # Nix, the package manager
+# @raitobezarius is not "code owner", but is listed here to be notified of changes
+# pertaining to the Nix package manager.
+# i.e. no authority over those files.
 pkgs/tools/package-management/nix/                    @raitobezarius @ma27
 nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius @ma27
 

diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
@@ -1355,6 +1355,30 @@ name="/nix/store/9s9r019176g7cvn2nvcw41gsp862y6b4-coreutils-8.24"
 someVar=$(stripHash $name)
 ```
 
+### `runInJobServer` \<command\> \-\-\-\- \<defArgs\> \-\-\-\- \<args\> {#fun-runInJobServer}
-### `runInJobServer` \<command\> \-\-\-\- \<defArgs\> \-\-\-\- \<args\> {#fun-runInJobServer}
+### `runInJobserver` \<command\> \-\-\-\- \<defArgs\> \-\-\-\- \<args\> {#fun-runInJobserver}
-### `runInJobServer` \<command\> \-\-\-\- \<defArgs\> \-\-\-\- \<args\> {#fun-runInJobServer}
+### `runInJobserver` \<command\> \-\-\-\- \<defArgs\> \-\-\-\- \<args\> {#fun-runInJobserver}
+
+Helper function for running a command as a client of the global jobserver, if applicable.
+
+ - If a global jobserver is available, runs `<command> <args>` with a GNU Make compatible jobserver made
+   available in `MAKEFLAGS`. The client is automatically limited to `NIX_BUILD_CORES` tokens.
+ - If no global jobserver is available, runs `<command> <defArgs> <args>` instead.
+
+\<command\>, \<defArgs\> and \<args\> may be more than one shell word each, hence they are separated by
+`----`. \<command\> and \<defArgs\> may not contain `----`. Each set except \<command\> may be empty,
+but separators must always be given.
+
+**Note**:
+The global jobserver must be bound to `/build-support/jobserver` in the Nix sandbox to be found by this function.
+If the provided `/build-support/jobserver` is not a `nixos-jobserver` token file it will not be used.
+
+Example:
+
+```bash
+runInJobServer cargo build ---- \
+    -j $NIX_BUILD_CORES ---- \
+    ${cargoBuildFlags}
+```
+
 ### `wrapProgram` \<executable\> \<makeWrapperArgs\> {#fun-wrapProgram}
 
 Convenience function for `makeWrapper` that replaces `<executable>` with a wrapper that executes the original program. It takes all the same arguments as `makeWrapper`, except for `--inherit-argv0` (used by the `makeBinaryWrapper` implementation) and `--argv0` (used by both `makeWrapper` and `makeBinaryWrapper` wrapper implementations).

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
@@ -759,6 +759,7 @@
   ./services/misc/nitter.nix
   ./services/misc/nix-gc.nix
   ./services/misc/nix-optimise.nix
+  ./services/misc/nixos-jobserver.nix
   ./services/misc/nix-ssh-serve.nix
   ./services/misc/novacomd.nix
   ./services/misc/ntfy-sh.nix

diff --git a/nixos/modules/services/misc/nixos-jobserver.nix b/nixos/modules/services/misc/nixos-jobserver.nix
@@ -0,0 +1,78 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.nixos.jobserver;
+  tokenDir = "/run/nixos-jobserver";
+  tokenFile = "${tokenDir}/tokens";
+in
+{
+  options = {
+    nixos.jobserver = {
+      enable = mkEnableOption "the global NixOS jobserver";
+
+      owner = mkOption {
+        type = types.str;
+        default = "root";
+        description = ''
+          Owner of the jobserver token file.
+        '';
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "nixbld";
+        description = ''
+          Group of the jobserver token file.
+        '';
+      };
+
+      tokens = mkOption {
+        type = types.ints.unsigned;
+        default = 0;
+        description = ''
+          Number of tokens to provide via the jobserver. Uses the number of CPUs in the
+          system when set to 0.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    nix.sandboxPaths = [ "/build-support/jobserver=${tokenFile}?" ];
+
+    systemd.services.nixos-jobserver = {
+      wantedBy = [ "multi-user.target" ];
+
+      path = [ pkgs.nixos-jobserver pkgs.util-linux ];
+
+      preStart = ''
+        mkdir -p ${tokenDir}
+
+        umask 0777
+        touch ${tokenFile}
+      '';
+
+      script = ''
+        exec nixos-jobserver \
+          -t ${toString cfg.tokens} \
+          -u ${escapeShellArg cfg.owner} \
+          -g ${escapeShellArg cfg.group} \
+          ${tokenFile}
+      '';
+
+      # we explicitly *do not* kill the jobserver.
+      # doing so would cause all running builds to fail.
+      # instead we want to make the jobserver unavailable to new builds, but allow
+      # running builds to finish and the jobserver to exit once they're all done.
+      # systemd *does not* want to allow this kind of thing, so we instruct it to
+      # only kill the wrapper script. with the token file unmounted the jobserver
+      # process will exit once all builds have finished.
+      preStop = ''
+        umount ${tokenFile}
+      '';
+      serviceConfig.KillMode = "process";
+    };
+  };
+}
diff --git a/pkgs/applications/audio/pyradio/default.nix b/pkgs/applications/audio/pyradio/default.nix
@@ -6,13 +6,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pyradio";
-  version = "0.9.3.6";
+  version = "0.9.3.7";
 
   src = fetchFromGitHub {
     owner = "coderholic";
     repo = "pyradio";
     rev = "refs/tags/${version}";
-    hash = "sha256-As4xjwJtEKlnFuBigC7nN0kAPe0+99rE9KZ0F6i7qIQ=";
+    hash = "sha256-NwDVytD6nIM++ixGmLh02FIE+hLKHBwwD3aEAXVZn7I=";
   };
 
   nativeBuildInputs = [

diff --git a/pkgs/applications/audio/tidal-hifi/default.nix b/pkgs/applications/audio/tidal-hifi/default.nix
@@ -36,11 +36,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tidal-hifi";
-  version = "5.12.0";
+  version = "5.13.0";
 
   src = fetchurl {
     url = "https://github.com/Mastermindzh/tidal-hifi/releases/download/${finalAttrs.version}/tidal-hifi_${finalAttrs.version}_amd64.deb";
-    sha256 = "sha256-DwUKoDaXA99ILxlyay5dRL/ewnzyqSSR6fxPxkr8X34=";
+    sha256 = "sha256-d7JAvpZKdhG9BzCdfwyPlmXcqE49heVLskusaB0uOhg=";
   };
 
   nativeBuildInputs = [ autoPatchelfHook dpkg makeWrapper ];

diff --git a/pkgs/applications/graphics/komikku/default.nix b/pkgs/applications/graphics/komikku/default.nix
@@ -19,7 +19,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "komikku";
-  version = "1.46.0";
+  version = "1.47.0";
 
   format = "other";
 
@@ -28,7 +28,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "valos";
     repo = "Komikku";
     rev = "v${version}";
-    hash = "sha256-0yobGclfZzv0S0HtqeTr4vzK5d6PTQNWMszP0B4k770=";
+    hash = "sha256-ZYQjH3NUPeq5XgCZ6L78lJpgbK69ZMf2AzztbCgbYBo=";
   };
 
   nativeBuildInputs = [

diff --git a/pkgs/applications/misc/1password/default.nix b/pkgs/applications/misc/1password/default.nix
@@ -12,12 +12,12 @@ let
     if extension == "zip" then fetchzip args else fetchurl args;
 
   pname = "1password-cli";
-  version = "2.28.0";
+  version = "2.29.0";
   sources = rec {
-    aarch64-linux = fetch "linux_arm64" "sha256-rF0HWKLdLDmT5nXqZyn+nwd3DZxkP76Jm+xofvA1dpU=" "zip";
-    i686-linux = fetch "linux_386" "sha256-b9OPsZJTGoAeedj/dv88lkX2Q4p9HG585mWyl7ZfDz4=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-5ZiMQaQLYUR9BZroyG0o+M79cR4GQb6rDyVmIcTZh3o=" "zip";
-    aarch64-darwin = fetch "apple_universal" "sha256-5VmogWqCYMdrg9dyRt4lurPmSRdUUHt4LT3lkOEKdEI=" "pkg";
+    aarch64-linux = fetch "linux_arm64" "sha256-sBbdkoacGI/gawM4YH+BBCLDhC2B+cE4iKVGHBhwkic=" "zip";
+    i686-linux = fetch "linux_386" "sha256-TTd5juT0Aqp1+OfunXcuk0KbL6HIHQV31+1Q1e0GYMY=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-Bb6fNoeNxlbDfwt7Jr8BaKCmFUwSdsLQdVoCmQCNmLA=" "zip";
+    aarch64-darwin = fetch "apple_universal" "sha256-/ryklZnGhrgJggDIa8HmuDsHAXkdrWeXKCQGGVwUAAo=" "pkg";
     x86_64-darwin = aarch64-darwin;
   };
   platforms = builtins.attrNames sources;

diff --git a/pkgs/applications/misc/gum/default.nix b/pkgs/applications/misc/gum/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gum";
-  version = "0.14.0";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-TpLaZ/935S57K60NdgJXVY+YQEedralZMoQHWRgkH+A=";
+    hash = "sha256-rQSSbDHMSWJDSxn/SNNMaOrdZJUhQPnZutmpY9828t0=";
   };
 
-  vendorHash = "sha256-UgpOHZ/CEnGsmUTyNrhh+qDmKEplr18b/OrO2qcIhF4=";
+  vendorHash = "sha256-pkQ8UvWLIWH8gXux/dd0HLdiz7RDrmFJ8SX63Q+nNyw=";
 
   nativeBuildInputs = [
     installShellFiles

diff --git a/pkgs/applications/misc/oxker/default.nix b/pkgs/applications/misc/oxker/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oxker";
-  version = "0.6.3";
+  version = "0.6.4";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-L03r4PHCu+jsUC5vVSG77SR2ak/AsuVAhTd7P1WibAk=";
+    sha256 = "sha256-dBehxqr/UCXIQDMrGFN6ID+v0NYi50JTHuML3su2O0A=";
   };
 
-  cargoHash = "sha256-5UxbZZdVioy1OZCbE6qESGKVnVT6TS4VHzsKlQ8XP2c=";
+  cargoHash = "sha256-wI7yqRvaszBP4OtlWbWIZ9RLf5y7dx2KufYLaK+PWps=";
 
   meta = with lib; {
     description = "A simple tui to view & control docker containers";

diff --git a/pkgs/applications/misc/uni/default.nix b/pkgs/applications/misc/uni/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "uni";
-  version = "2.6.0";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "arp242";
     repo = "uni";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Ij/jUbXl3GkeNZmGJ82i++6VkOW46YFI9m83otY6M7Q=";
+    hash = "sha256-ociPkuRtpBS+x1zSVNYk8oqAsJZGv31/TUUUlBOYhJA=";
   };
 
-  vendorHash = "sha256-88SSrGvZSs6Opi3IKSNNqptuOWMmtTQ4ZDR7ViuGugk=";
+  vendorHash = "sha256-/PvBn2RRYuVpjnrIL1xAcVqAKZuIV2KTSyVtBW1kqj4=";
 
   ldflags = [
     "-s"

diff --git a/pkgs/applications/networking/blocky/default.nix b/pkgs/applications/networking/blocky/default.nix
@@ -6,20 +6,20 @@
 
 buildGoModule rec {
   pname = "blocky";
-  version = "0.23";
+  version = "0.24";
 
   src = fetchFromGitHub {
     owner = "0xERR0R";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-IB5vi+nFXbV94YFtY2eMKTgzUgX8q8i8soSrso2zaD4=";
+    hash = "sha256-K+Zdb6l2WUhxVm/gi9U2vVR69bxr2ntLyIrkwTuc0Do=";
   };
 
   # needs network connection and fails at
   # https://github.com/0xERR0R/blocky/blob/development/resolver/upstream_resolver_test.go
   doCheck = false;
 
-  vendorHash = "sha256-h1CkvI7M1kt2Ix3D8+gDl97CFElV+0/9Eram1burOaM=";
+  vendorHash = "sha256-I4UXTynulsRuu9U8tsLbPQO1MMPfUC5dAZE420sW1sU=";
 
   ldflags = [ "-s" "-w" "-X github.com/0xERR0R/blocky/util.Version=${version}" ];
 

diff --git a/pkgs/applications/networking/browsers/floorp/default.nix b/pkgs/applications/networking/browsers/floorp/default.nix
@@ -7,7 +7,7 @@
 
 ((buildMozillaMach rec {
   pname = "floorp";
-  packageVersion = "11.13.2";
+  packageVersion = "11.13.3";
   applicationName = "Floorp";
   binaryName = "floorp";
   branding = "browser/branding/official";
@@ -22,7 +22,7 @@
     repo = "Floorp";
     fetchSubmodules = true;
     rev = "v${packageVersion}";
-    hash = "sha256-sFtGtxk3vdR5JoZb1yiITybIfGmOYzKLb9NtbhWjBt8=";
+    hash = "sha256-9EDTVckSqv/nyDi4qjMd54I69WiqM8v6om7zQLT+pQc=";
   };
 
   extraConfigureFlags = [

diff --git a/pkgs/applications/networking/cluster/atlantis/default.nix b/pkgs/applications/networking/cluster/atlantis/default.nix
@@ -2,20 +2,20 @@
 
 buildGoModule rec {
   pname = "atlantis";
-  version = "0.27.3";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "runatlantis";
     repo = "atlantis";
     rev = "v${version}";
-    hash = "sha256-BC4WSyKnDM9RhM+2iU9dBZLbtxDM/UoMmIDTP6DB3no=";
+    hash = "sha256-ROve0R2k65CChu1nlkObvipxi66TA2XTTRmQ8qpJLO8=";
   };
   ldflags = [
     "-X=main.version=${version}"
     "-X=main.date=1970-01-01T00:00:00Z"
   ];
 
-  vendorHash = "sha256-6Di8XLX1rOjVnIA+5kQB59aZ3qRmkjciWD0+GD9Lpzw=";
+  vendorHash = "sha256-eYS7dO9BCnn9p1HgDOt4vliPYLsR0TaNwSpUoMO6eAk=";
 
   subPackages = [ "." ];
 

diff --git a/pkgs/applications/networking/cluster/kubecm/default.nix b/pkgs/applications/networking/cluster/kubecm/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubecm";
-  version = "0.28.0";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "sunny0826";
     repo = "kubecm";
     rev = "v${version}";
-    hash = "sha256-v2frNvJUvDjPhV1RCR3DHk04kYEqP6hMXeA4j3cWlss=";
+    hash = "sha256-zspAtLomgdIymP3xj3VG2rAhMJAquJCNWRdAM5wPcLg=";
   };
 
-  vendorHash = "sha256-uM9/rqu5WOXK6bqxhtmje+Zd9dtdv3qwt+Xr0SJHjPs=";
+  vendorHash = "sha256-eWKGmVkvMP/vN03pWiShPzZN0vSkhneSK48S4AVBdkM=";
   ldflags = [ "-s" "-w" "-X github.com/sunny0826/kubecm/version.Version=${version}"];
 
   doCheck = false;

diff --git a/pkgs/applications/networking/cluster/kubeseal/default.nix b/pkgs/applications/networking/cluster/kubeseal/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubeseal";
-  version = "0.26.2";
+  version = "0.26.3";
 
   src = fetchFromGitHub {
     owner = "bitnami-labs";
     repo = "sealed-secrets";
     rev = "v${version}";
-    sha256 = "sha256-96yaWHRfEHjXYZ9Hsh9bXk5O5viSOYhmwJ18JCbtv2U=";
+    sha256 = "sha256-2MU1/znfp2LfojfgFPovgcJbZLtqY+6O7YKZNhPIT8k=";
   };
 
-  vendorHash = "sha256-91GKy7tNKSOiJmpArgp56RXegYP7sdGpaRAxS9xwTXA=";
+  vendorHash = "sha256-B50+G29ze1jPBTlFA0nvMfh25t4Xb3YCxEkPkjxKMj0=";
 
   subPackages = [ "cmd/kubeseal" ];
 

diff --git a/pkgs/applications/networking/cluster/kyverno/default.nix b/pkgs/applications/networking/cluster/kyverno/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kyverno";
-  version = "1.12.1";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "kyverno";
     repo = "kyverno";
     rev = "v${version}";
-    hash = "sha256-2x5xLh+v1/RXG3h93Ff49pT9NwHWNx4tubnmCf0SAdY=";
+    hash = "sha256-gR/gpoldtwW0bVjWr5xwbfcKb6VJ43otWnSFrcYerII=";
   };
 
   ldflags = [
@@ -18,7 +18,7 @@ buildGoModule rec {
     "-X github.com/kyverno/kyverno/pkg/version.BuildTime=1970-01-01_00:00:00"
   ];
 
-  vendorHash = "sha256-5tBHmHfBHTsAVDk3i0z2R2amTfOvWHJutTNW2ofGZuQ=";
+  vendorHash = "sha256-sSsLs3EedStYlMYKFXIMdNHtrG8ijyu9+2MCYjjzZR4=";
 
   subPackages = [ "cmd/cli/kubectl-kyverno" ];