lon: update agenix

564595d0ad4be7277e07fa63b5a991b3c645655d
→ 4835b1dc898959d8547a871ef484930675cb47f1

Last 50 commits:
  344f985 dev: remove i686 support; simplify flake
  097aa18 contrib: add direct tests for agenix
  17090d1 Merge pull request #163 from ryantm/rtm-2-21-recursive-nix
  08dc506 Revert "contrib: add direct tests for agenix "
  d0d4ad5 Merge pull request #231 from ryantm/revert-163-rtm-2-21-recursive-nix
  9bc80dc Merge pull request #229 from ryantm/rtm-12-20-flake
  5c1198a feat: switch from rage to age
  eb3b5cf update nixpkgs
  bd86c06 fix doc build
  58017c0 update inputs
  b6aa618 test removing installer
  23d4d5d maybe this fixes darwin checks?
  6ce42cc Fix CI for darwin
  457669d Merge pull request #230 from ryantm/rtm-12-20-age
  bc24f2e Revert "Revert "contrib: add direct tests for agenix ""
  a23aa27 dev: reland add direct tests for agenix
  417caa8 Merge pull request #232 from ryantm/rtm-12-23-test
  1746e4f agenix: fix installCheckPhase with Nix 2.3
  1f62cef fix: update docs for 5c1198a
  8cb01a0 Merge pull request #244 from kraem/fix/rage_to_age_docs
  3fd98a2 doc: fix wrong ssh-keyscan usage
  1381a75 Merge pull request #254 from oluceps/fix-doc
  2c1d1fb fix: allow for newlines in keys
  24a7ea3 Merge pull request #256 from spectre256/main
  07479c2 update link to nixos wiki (#258)
  63a57d8 Fix typo
  8d37c5b Merge pull request #259 from hansemschnokeloch/patch-1
  08ed896 fix: always treat link destinations as files to ensure error when destination is a directory.
  c2fc076 Merge pull request #241 from sternenseemann/nix-2.3-install-check
  3a56735 Merge pull request #187 from oddlama/main
  760751b README: Add warning about HNDL and PQS in theat model
  de96bd9 Merge pull request #265 from Kreyren/patch-1
  40012e5 Remove import for NixOS/HM modules
  3f1dae0 Merge pull request #277 from fzakaria/import-module-remove
  e341399 age-home: Use curly-brackets for XDG_RUNTIME_DIR
  f6291c5 Merge pull request #280 from Kreyren/patch-3
  cce0ff4 fix: bad age.identityPaths default value on darwin
  302ab0c fix: bump to macOS-15 in CI
  989ade2 feat: dynamically determine architecture in ci
  96b7e4f contrib: improve readability of age.identityPaths default value
  4d0d81e fix: bad indentation in ci
  e600439 Merge pull request #307 from codgician/fix-darwin-module
  cccd5af docs: add home-manager module documentation
  58c5544 fix: use replaceVars instead of substituteAll
  96e078c Merge pull request #324 from K900/replace-vars
  af991e8 Separate flags from positional args with `--`
  72f7f68 Merge pull request #327 from n8henrie/leading-hyphen-filename
  8a4516a Merge pull request #318 from bcl1713/main
  bd33a9b doc: strip trailing whitespace
  6697e8b Merge pull request #328 from ryantm/doc-strip-whitespace

.forgejo/workflows/eval-nodes.yaml

@@ -7,6 +7,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: Jaccess01
+        NIX_SHOW_STATS: 1
       name: Eval Jaccess01
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -26,6 +27,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: Jaccess04
+        NIX_SHOW_STATS: 1
       name: Eval Jaccess04
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -45,6 +47,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: ap01
+        NIX_SHOW_STATS: 1
       name: Eval ap01
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -64,6 +67,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: bridge01
+        NIX_SHOW_STATS: 1
       name: Eval bridge01
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -83,6 +87,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: build01
+        NIX_SHOW_STATS: 1
       name: Eval build01
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -102,6 +107,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: cof02
+        NIX_SHOW_STATS: 1
       name: Eval cof02
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -121,6 +127,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: compute01
+        NIX_SHOW_STATS: 1
       name: Eval compute01
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -140,6 +147,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: geo01
+        NIX_SHOW_STATS: 1
       name: Eval geo01
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -159,6 +167,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: geo02
+        NIX_SHOW_STATS: 1
       name: Eval geo02
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -178,6 +187,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: hypervisor01
+        NIX_SHOW_STATS: 1
       name: Eval hypervisor01
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -197,6 +207,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: hypervisor02
+        NIX_SHOW_STATS: 1
       name: Eval hypervisor02
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -216,6 +227,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: hypervisor03
+        NIX_SHOW_STATS: 1
       name: Eval hypervisor03
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -235,6 +247,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: iso
+        NIX_SHOW_STATS: 1
       name: Eval iso
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -254,6 +267,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: krz01
+        NIX_SHOW_STATS: 1
       name: Eval krz01
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -273,6 +287,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: lab-router01
+        NIX_SHOW_STATS: 1
       name: Eval lab-router01
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -292,6 +307,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: netcore01
+        NIX_SHOW_STATS: 1
       name: Eval netcore01
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -311,6 +327,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: netcore02
+        NIX_SHOW_STATS: 1
       name: Eval netcore02
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -330,6 +347,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: rescue01
+        NIX_SHOW_STATS: 1
       name: Eval rescue01
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -349,6 +367,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: storage01
+        NIX_SHOW_STATS: 1
       name: Eval storage01
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -368,6 +387,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: tower01
+        NIX_SHOW_STATS: 1
       name: Eval tower01
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -387,6 +407,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: vault01
+        NIX_SHOW_STATS: 1
       name: Eval vault01
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -406,6 +427,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: web01
+        NIX_SHOW_STATS: 1
       name: Eval web01
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -425,6 +447,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: web02
+        NIX_SHOW_STATS: 1
       name: Eval web02
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -444,6 +467,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: web03
+        NIX_SHOW_STATS: 1
       name: Eval web03
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"
@@ -463,6 +487,7 @@ jobs:
     - uses: actions/checkout@v3
     - env:
         BUILD_NODE: zulip01
+        NIX_SHOW_STATS: 1
       name: Eval zulip01
       run: "nix-shell -A eval-nodes --run 'set -o pipefail\nset -o nounset\nset -o
         errexit\nDRV=$(instantiate-node)\necho \"DRV=$DRV\" >> $GITHUB_ENV\n'"

lon.lock

@@ -135,20 +135,20 @@
       "type": "Git",
       "fetchType": "git",
       "branch": "main",
-      "revision": "d169c092fc28838a253be136d17fe7de1292c728",
+      "revision": "ee0655240270480d7f6063dcf12ec47f04d2ded6",
       "url": "https://git.lix.systems/lix-project/lix.git",
-      "hash": "sha256-gsPA3AAGi3pucRpzJbhWWyyOBv2/2OjAjU/SlcSE8Vc=",
+      "hash": "sha256-DDhns3NS6L5OlYR0mSX03I5D7uGLyyd3MZegd1wTCyc=",
-      "lastModified": 1743274305,
+      "lastModified": 1749682763,
       "submodules": false
     },
     "lix-module": {
       "type": "Git",
       "fetchType": "git",
       "branch": "main",
-      "revision": "fa69ae26cc32dda178117b46487c2165c0e08316",
+      "revision": "3c23c6ae2aecc1f76ae7993efe1a78b5316f0700",
       "url": "https://git.lix.systems/lix-project/nixos-module.git",
-      "hash": "sha256-MB/b/xcDKqaVBxJIIxwb81r8ZiGLeKEcqokATRRroo8=",
+      "hash": "sha256-7EICjbmG6lApWKhFtwvZovdcdORY1CEe6/K7JwtpYfs=",
-      "lastModified": 1742945498,
+      "lastModified": 1747667424,
       "submodules": false
     },
     "lon": {
@@ -195,10 +195,10 @@
       "type": "Git",
       "fetchType": "git",
       "branch": "dgnum",
-      "revision": "0cdf222c07b9cbd49857ae046fb41ae9f651cc3f",
+      "revision": "44ccf96bd73c1bbbbcc849cb0f2e0d1f5f75f934",
       "url": "https://git.hubrecht.ovh/hubrecht/nix-modules",
-      "hash": "sha256-VHlkJny+t1AhZ61JOeyYM1rLa4cPEoEt/5+vqAqAJgA=",
+      "hash": "sha256-mkrCWowrCje3/TuAG0eAJplrtlz1hYmusSFn93/Ccok=",
-      "lastModified": 1746016692,
+      "lastModified": 1749629064,
       "submodules": false
     },
     "nix-pkgs": {
@@ -227,8 +227,8 @@
       "owner": "NixOS",
       "repo": "nixpkgs",
       "branch": "nixos-24.05",
-      "revision": "b134951a4c9f",
+      "revision": "b134951a4c9f3c995fd7be05f3243f8ecd65d798",
-      "url": "https://github.com/NixOS/nixpkgs/archive/b134951a4c9f.tar.gz",
+      "url": "https://github.com/NixOS/nixpkgs/archive/b134951a4c9f3c995fd7be05f3243f8ecd65d798.tar.gz",
       "hash": "sha256-OnSAY7XDSx7CtDoqNh8jwVwh4xNL/2HaJxGjryLWzX8="
     },
     "nixos-24.11": {

machines/nixos/build01/nix-builder.nix

@@ -69,7 +69,6 @@
           # "ca-derivations" this feature is really extremely broken.
           "cgroups"
           "fetch-closure"
-          "impure-derivations"
         ];
       };
     };

patches/default.nix

@@ -18,7 +18,6 @@ with {
 
   lix = [
     (local ./lix/01-disable-installChecks.patch)
-    (local ./lix/02-fetchGit-locked.patch)
   ];
 
   lon = [

patches/lix/02-fetchGit-locked.patch

@@ -1,86 +0,0 @@
-diff --git i/lix/libexpr/primops/fetchTree.cc w/lix/libexpr/primops/fetchTree.cc
-index 93b08ecc9..6d04ce24b 100644
---- i/lix/libexpr/primops/fetchTree.cc
-+++ w/lix/libexpr/primops/fetchTree.cc
-@@ -168,6 +168,11 @@ static void fetchTree(
-                     "attribute 'name' isn’t supported in call to 'fetchTree'"
-                 ).atPos(pos).debugThrow();
- 
-+        // HACK: When using `fetchGit`, locking with only the hash should happen
-+        //       as we don't care about flake hallucinations about `lastModified`
-+        if (type == "git" && attrs.contains("narHash"))
-+            attrs["type"] = "git-locked";
-+
-         input = fetchers::Input::fromAttrs(std::move(attrs));
-     } else {
-         auto url = state.coerceToString(pos, *args[0], context,
-diff --git i/lix/libfetchers/builtin-fetchers.hh w/lix/libfetchers/builtin-fetchers.hh
-index d3be7f7f2..d1389b8ba 100644
---- i/lix/libfetchers/builtin-fetchers.hh
-+++ w/lix/libfetchers/builtin-fetchers.hh
-@@ -10,6 +10,7 @@ std::unique_ptr<InputScheme> makePathInputScheme();
- std::unique_ptr<InputScheme> makeFileInputScheme();
- std::unique_ptr<InputScheme> makeTarballInputScheme();
- std::unique_ptr<InputScheme> makeGitInputScheme();
-+std::unique_ptr<InputScheme> makeGitLockedInputScheme();
- std::unique_ptr<InputScheme> makeMercurialInputScheme();
- std::unique_ptr<InputScheme> makeGitHubInputScheme();
- std::unique_ptr<InputScheme> makeGitLabInputScheme();
-diff --git i/lix/libfetchers/fetchers.cc w/lix/libfetchers/fetchers.cc
-index 0dc9f5e0c..91cd9332d 100644
---- i/lix/libfetchers/fetchers.cc
-+++ w/lix/libfetchers/fetchers.cc
-@@ -22,6 +22,7 @@ void initLibFetchers()
-     registerInputScheme(makeTarballInputScheme());
-     registerInputScheme(makeFileInputScheme());
-     registerInputScheme(makeGitInputScheme());
-+    registerInputScheme(makeGitLockedInputScheme());
-     registerInputScheme(makeMercurialInputScheme());
-     registerInputScheme(makeGitHubInputScheme());
-     registerInputScheme(makeGitLabInputScheme());
-diff --git i/lix/libfetchers/git.cc w/lix/libfetchers/git.cc
-index 21fa1904d..f9573eacd 100644
---- i/lix/libfetchers/git.cc
-+++ w/lix/libfetchers/git.cc
-@@ -812,4 +812,40 @@ std::unique_ptr<InputScheme> makeGitInputScheme()
-     return std::make_unique<GitInputScheme>();
- }
- 
-+struct GitLockedInputScheme : GitInputScheme {
-+
-+    std::optional<Input> inputFromAttrs(const Attrs & attrs) const override
-+    {
-+        if (maybeGetStrAttr(attrs, "type") != "git-locked") return {};
-+
-+        for (auto & [name, value] : attrs)
-+            if (name != "type" && name != "url" && name != "ref" && name != "rev" && name != "shallow" && name != "submodules" && name != "lastModified" && name != "revCount" && name != "narHash" && name != "allRefs" && name != "name" && name != "dirtyRev" && name != "dirtyShortRev")
-+                throw Error("unsupported Git input attribute '%s'", name);
-+
-+        parseURL(getStrAttr(attrs, "url"));
-+        maybeGetBoolAttr(attrs, "shallow");
-+        maybeGetBoolAttr(attrs, "submodules");
-+        maybeGetBoolAttr(attrs, "allRefs");
-+
-+        if (auto ref = maybeGetStrAttr(attrs, "ref")) {
-+            if (std::regex_search(*ref, badGitRefRegex))
-+                throw BadURL("invalid Git branch/tag name '%s'", *ref);
-+        }
-+
-+        Input input;
-+        input.attrs = attrs;
-+        return input;
-+    }
-+
-+    bool hasAllInfo(const Input & input) const override {
-+        return true;
-+    }
-+
-+};
-+
-+std::unique_ptr<InputScheme> makeGitLockedInputScheme()
-+{
-+    return std::make_unique<GitLockedInputScheme>();
-+}
-+
- }
- 

workflows/eval-nodes.nix

@@ -30,7 +30,10 @@ in
           '';
           shell = "eval-nodes";
         };
-        env.BUILD_NODE = node;
+        env = {
+          BUILD_NODE = node;
+          NIX_SHOW_STATS = 1;
+        };
       }
       {
         name = "Build ${node}";