Merge master into staging-next

nixos/modules/hardware/hackrf.nix

@@ -12,6 +12,7 @@ in
       description = ''
         Enables hackrf udev rules and ensures 'plugdev' group exists.
         This is a prerequisite to using HackRF devices without being root, since HackRF USB descriptors will be owned by plugdev through udev.
+        Ensure your user is a member of the 'plugdev' group after enabling.
       '';
     };
   };

nixos/modules/programs/wayland/sway.nix

@@ -85,9 +85,10 @@ in
 
     extraPackages = lib.mkOption {
       type = with lib.types; listOf package;
-      default = with pkgs; [ swaylock swayidle foot dmenu wmenu ];
+      # Packages used in default config
+      default = with pkgs; [ brightnessctl foot grim pulseaudio swayidle swaylock wmenu ];
       defaultText = lib.literalExpression ''
-        with pkgs; [ swaylock swayidle foot dmenu wmenu ];
+        with pkgs; [ brightnessctl foot grim pulseaudio swayidle swaylock wmenu ];
       '';
       example = lib.literalExpression ''
         with pkgs; [ i3status i3status-rust termite rofi light ]

nixos/modules/programs/zsh/oh-my-zsh.nix

@@ -93,7 +93,7 @@ in
           default = "";
           description = ''
             Shell commands executed before the `oh-my-zsh` is loaded.
-            For example, to disable async git prompt write `zstyle ':omz:alpha:lib:git' async-prompt force` (more information https://github.com/ohmyzsh/ohmyzsh?tab=readme-ov-file#async-git-prompt)
+            For example, to disable async git prompt write `zstyle ':omz:alpha:lib:git' async-prompt no` (more information https://github.com/ohmyzsh/ohmyzsh?tab=readme-ov-file#async-git-prompt)
           '';
         };
       };

nixos/modules/services/continuous-integration/hydra/default.nix

@@ -330,12 +330,12 @@ in
 
           ln -sf ${hydraConf} ${baseDir}/hydra.conf
 
-          mkdir -m 0700 -p ${baseDir}/www
+          mkdir -m 0700 ${baseDir}/www || true
           chown hydra-www:hydra ${baseDir}/www
 
-          mkdir -m 0700 -p ${baseDir}/queue-runner
-          mkdir -m 0750 -p ${baseDir}/build-logs
-          mkdir -m 0750 -p ${baseDir}/runcommand-logs
+          mkdir -m 0700 ${baseDir}/queue-runner || true
+          mkdir -m 0750 ${baseDir}/build-logs || true
+          mkdir -m 0750 ${baseDir}/runcommand-logs || true
           chown hydra-queue-runner:hydra \
             ${baseDir}/queue-runner \
             ${baseDir}/build-logs \
@@ -362,8 +362,8 @@ in
 
           # Move legacy hydra-www roots.
           if [ -e /nix/var/nix/gcroots/per-user/hydra-www/hydra-roots ]; then
-            find /nix/var/nix/gcroots/per-user/hydra-www/hydra-roots/ -type f \
-              | xargs -r mv -f -t ${cfg.gcRootsDir}/
+            find /nix/var/nix/gcroots/per-user/hydra-www/hydra-roots/ -type f -print0 \
+              | xargs -0 -r mv -f -t ${cfg.gcRootsDir}/
             rmdir /nix/var/nix/gcroots/per-user/hydra-www/hydra-roots
           fi
 
@@ -520,7 +520,7 @@ in
             elif [[ $compression == zstd ]]; then
               compression="zstd --rm"
             fi
-            find ${baseDir}/build-logs -type f -name "*.drv" -mtime +3 -size +0c | xargs -r "$compression" --force --quiet
+            find ${baseDir}/build-logs -type f -name "*.drv" -mtime +3 -size +0c -print0 | xargs -0 -r "$compression" --force --quiet
           '';
         startAt = "Sun 01:45";
         serviceConfig.Slice = "system-hydra.slice";

nixos/modules/services/networking/murmur.nix

@@ -6,7 +6,7 @@ let
   cfg = config.services.murmur;
   forking = cfg.logFile != null;
   configFile = pkgs.writeText "murmurd.ini" ''
-    database=/var/lib/murmur/murmur.sqlite
+    database=${cfg.stateDir}/murmur.sqlite
     dbDriver=QSQLITE
 
     autobanAttempts=${toString cfg.autobanAttempts}
@@ -69,6 +69,32 @@ in
         '';
       };
 
+      user = mkOption {
+        type = types.str;
+        default = "murmur";
+        description = ''
+          The name of an existing user to use to run the service.
+          If not specified, the default user will be created.
+        '';
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "murmur";
+        description = ''
+          The name of an existing group to use to run the service.
+          If not specified, the default group will be created.
+        '';
+      };
+
+      stateDir = mkOption {
+        type = types.path;
+        default = "/var/lib/murmur";
+        description = ''
+          Directory to store data for the server.
+        '';
+      };
+
       autobanAttempts = mkOption {
         type = types.int;
         default = 10;
@@ -257,7 +283,7 @@ in
       environmentFile = mkOption {
         type = types.nullOr types.path;
         default = null;
-        example = "/var/lib/murmur/murmurd.env";
+        example = literalExpression ''"''${config.services.murmur.stateDir}/murmurd.env"'';
         description = ''
           Environment file as defined in {manpage}`systemd.exec(5)`.
 
@@ -289,14 +315,14 @@ in
   };
 
   config = mkIf cfg.enable {
-    users.users.murmur = {
+    users.users.murmur = mkIf (cfg.user == "murmur") {
       description     = "Murmur Service user";
-      home            = "/var/lib/murmur";
+      home            = cfg.stateDir;
       createHome      = true;
       uid             = config.ids.uids.murmur;
-      group           = "murmur";
+      group           = cfg.group;
     };
-    users.groups.murmur = {
+    users.groups.murmur = mkIf (cfg.group == "murmur") {
       gid             = config.ids.gids.murmur;
     };
 
@@ -324,8 +350,8 @@ in
         Restart = "always";
         RuntimeDirectory = "murmur";
         RuntimeDirectoryMode = "0700";
-        User = "murmur";
-        Group = "murmur";
+        User = cfg.user;
+        Group = cfg.group;
 
         # service hardening
         AmbientCapabilities = "CAP_NET_BIND_SERVICE";
@@ -362,7 +388,7 @@ in
           "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
           "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
         <busconfig>
-          <policy user="murmur">
+          <policy user="${cfg.user}">
             <allow own="net.sourceforge.mumble.murmur"/>
           </policy>
 
@@ -387,9 +413,9 @@ in
 
         r ${config.environment.etc."os-release".source},
         r ${config.environment.etc."lsb-release".source},
-        owner rwk /var/lib/murmur/murmur.sqlite,
-        owner rw /var/lib/murmur/murmur.sqlite-journal,
-        owner r /var/lib/murmur/,
+        owner rwk ${cfg.stateDir}/murmur.sqlite,
+        owner rw ${cfg.stateDir}/murmur.sqlite-journal,
+        owner r ${cfg.stateDir}/,
         r /run/murmur/murmurd.pid,
         r /run/murmur/murmurd.ini,
         r ${configFile},

nixos/modules/tasks/filesystems/zfs.nix

@@ -57,6 +57,7 @@ let
   # latter case it makes one last attempt at importing, allowing the system to
   # (eventually) boot even with a degraded pool.
   importLib = {zpoolCmd, awkCmd, cfgZfs}: ''
+    # shellcheck disable=SC2013
     for o in $(cat /proc/cmdline); do
       case $o in
         zfs_force|zfs_force=1|zfs_force=y)
@@ -80,6 +81,7 @@ let
     }
     poolImport() {
       pool="$1"
+      # shellcheck disable=SC2086
       "${zpoolCmd}" import -d "${cfgZfs.devNodes}" -N $ZFS_FORCE "$pool"
     }
   '';
@@ -146,7 +148,7 @@ let
         if ! poolImported "${pool}"; then
           echo -n "importing ZFS pool \"${pool}\"..."
           # Loop across the import until it succeeds, because the devices needed may not be discovered yet.
-          for trial in `seq 1 60`; do
+          for _ in $(seq 1 60); do
             poolReady "${pool}" && poolImport "${pool}" && break
             sleep 1
           done
@@ -157,7 +159,7 @@ let
 
 
           ${lib.optionalString keyLocations.hasKeys ''
-            ${keyLocations.command} | while IFS=$'\t' read ds kl ks; do
+            ${keyLocations.command} | while IFS=$'\t' read -r ds kl ks; do
               {
               if [[ "$ks" != unavailable ]]; then
                 continue
@@ -613,7 +615,7 @@ in
             echo -n "importing root ZFS pool \"${pool}\"..."
             # Loop across the import until it succeeds, because the devices needed may not be discovered yet.
             if ! poolImported "${pool}"; then
-              for trial in `seq 1 60`; do
+              for _ in $(seq 1 60); do
                 poolReady "${pool}" > /dev/null && msg="$(poolImport "${pool}" 2>&1)" && break
                 sleep 1
                 echo -n .
@@ -865,6 +867,7 @@ in
           Type = "simple";
         };
         script = ''
+          # shellcheck disable=SC2046
           ${cfgZfs.package}/bin/zpool scrub -w ${
             if cfgScrub.pools != [] then
               (lib.concatStringsSep " " cfgScrub.pools)

pkgs/applications/audio/pavucontrol/default.nix

@@ -7,7 +7,7 @@
   libpulseaudio,
   gtkmm4,
   libsigcxx,
-  # Since version 6.0, libcanberra is optional
+  # Since version 6.1, libcanberra is optional
   withLibcanberra ? true,
   libcanberra-gtk3,
   json-glib,
@@ -20,14 +20,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pavucontrol";
-  version = "6.0";
+  version = "6.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "pulseaudio";
     repo = "pavucontrol";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-nxzFvD/KUevIJOw9jgcr0Hfvg7KiSOmTBfKN3jLu3Cg=";
+    hash = "sha256-cru4I+LljYKIpIr7gSolnuLuUIXgc8l+JUmPrme4+YA=";
   };
 
   buildInputs = [

pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix

@@ -6,28 +6,28 @@
 }:
 
 let
-  version = "0.12.1";
+  version = "0.12.2";
 
   sources = {
     "x86_64-linux" = {
       arch = "linux-x64";
       url = "https://download.visualjj.com/visualjj-linux-x64-${version}.vsix";
-      hash = "sha256-Tf26s4YDyjYUrVdKu9aYMMntirZyNRgnETMzO/EfFCA=";
+      hash = "sha256-42xUp1HDnu1YZwXYgBhqshNzA0sx7VZLZzSaQypZb1M=";
     };
     "x86_64-darwin" = {
       arch = "darwin-x64";
       url = "https://download.visualjj.com/visualjj-darwin-x64-${version}.vsix";
-      hash = "sha256-2u92qFaRIirCrvtuxeqVqt6zWEobS1f5SX26SGZF4xE=";
+      hash = "sha256-RFxhGKQpQnMbwuYfHQolFRJxI61hzog2A44x7W39yKw=";
     };
     "aarch64-linux" = {
       arch = "linux-arm64";
       url = "https://download.visualjj.com/visualjj-linux-arm64-${version}.vsix";
-      hash = "sha256-+NUdF/KIWhLXOGtUgmNI9JF+L+f/4o064gznpLiORVM=";
+      hash = "sha256-KHeg2wAe1aynwAbQh5Do/rCbk2bqLZ3iIrYpDFRIw/E=";
     };
     "aarch64-darwin" = {
       arch = "darwin-arm64";
       url = "https://download.visualjj.com/visualjj-darwin-arm64-${version}.vsix";
-      hash = "sha256-GVEOTgfSKc0YXZUF4WGl/56Jd4ucaeDm9nB+267BQoM=";
+      hash = "sha256-3y/MhxDgQBnbQ2OYLYFcl7488sKE7iVO4YhUhmQyCIM=";
     };
   };
 in

pkgs/applications/emulators/retroarch/cores.nix

@@ -8,7 +8,7 @@
 , curl
 , fetchFromGitHub
 , fetchpatch
-, ffmpeg
+, ffmpeg_6
 , fluidsynth
 , fmt
 , freetype
@@ -318,7 +318,7 @@ in
 
   citra = mkLibretroCore rec {
     core = "citra";
-    extraBuildInputs = [ libGLU libGL boost ffmpeg nasm ];
+    extraBuildInputs = [ libGLU libGL boost ffmpeg_6 nasm ];
     makefile = "Makefile";
     makeFlags = [
       "HAVE_FFMPEG_STATIC=0"

pkgs/applications/misc/pdfstudio/default.nix

@@ -80,4 +80,18 @@ in
     ];
     jdk = jdk17;
   };
+
+  pdfstudio2024 = callPackage ./common.nix rec {
+    inherit desktopName longDescription pname program year;
+    version = "${year}.0.0";
+    src = fetchurl {
+      url = "https://download.qoppa.com/pdfstudio/v${year}/PDFStudio_v${dot2dash version}_linux64.deb";
+      sha256 = "sha256-9TMSKtBE0+T7wRnBgtUjRr/JUmCaYdyD/7y0ML37wCM=";
+    };
+    extraBuildInputs = [
+      (lib.getLib stdenv.cc.cc)  # for libstdc++.so.6 and libgomp.so.1
+    ];
+    jdk = jdk17;
+  };
+
 }.${pname}

pkgs/applications/networking/libcoap/default.nix

@@ -4,13 +4,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "libcoap";
-  version = "4.3.4a";
+  version = "4.3.5";
   src = fetchFromGitHub {
     repo = "libcoap";
     owner = "obgm";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-SzuXFn4rihZIHxKSH5waC5362mhsOtBdRatIGI6nv4I=";
+    hash = "sha256-QNrsR6VarZ2favvTZ9pMhVafwF2fOjYLKcyNqZyUl6s=";
   };
   nativeBuildInputs = [
     automake