From bde29b84f75459ac43482e03d0fd2b38e76fcb50 Mon Sep 17 00:00:00 2001 From: Jonas Nick Date: Thu, 18 Dec 2025 08:38:21 +0000 Subject: [PATCH 01/11] Update nixpkgs electrs: 0.10.10 -> 0.11.0 --- flake.lock | 12 +++++------ test/nixos-search/flake.lock | 42 +++++++++++++++++++++++++++--------- 2 files changed, 38 insertions(+), 16 deletions(-) diff --git a/flake.lock b/flake.lock index 147a257..2513cb2 100644 --- a/flake.lock +++ b/flake.lock @@ -44,11 +44,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1763622513, - "narHash": "sha256-1jQnuyu82FpiSxowrF/iFK6Toh9BYprfDqfs4BB+19M=", + "lastModified": 1765687488, + "narHash": "sha256-7YAJ6xgBAQ/Nr+7MI13Tui1ULflgAdKh63m1tfYV7+M=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "c58bc7f5459328e4afac201c5c4feb7c818d604b", + "rev": "d02bcc33948ca19b0aaa0213fe987ceec1f4ebe1", "type": "github" }, "original": { @@ -60,11 +60,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1763618868, - "narHash": "sha256-v5afmLjn/uyD9EQuPBn7nZuaZVV9r+JerayK/4wvdWA=", + "lastModified": 1765934234, + "narHash": "sha256-pJjWUzNnjbIAMIc5gRFUuKCDQ9S1cuh3b2hKgA7Mc4A=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "a8d610af3f1a5fb71e23e08434d8d61a466fc942", + "rev": "af84f9d270d404c17699522fab95bbf928a2d92f", "type": "github" }, "original": { diff --git a/test/nixos-search/flake.lock b/test/nixos-search/flake.lock index 941ebfc..99b5717 100644 --- a/test/nixos-search/flake.lock +++ b/test/nixos-search/flake.lock @@ -21,11 +21,11 @@ "nixos-infra": { "flake": false, "locked": { - "lastModified": 1760816325, - "narHash": "sha256-XG4d9wXQ4HytME1my2U0VRlo2G66ZOY3wwofFhqi1/c=", + "lastModified": 1765537842, + "narHash": "sha256-D9RwESJPSBFlHMO3JZ4XCqCqHgXgmdAxWEZCEq9WCKo=", "owner": "NixOS", "repo": "infra", - "rev": "85a21b518d7dae68cb8309d7eb93ecf064764c04", + "rev": "3283c22b7969a15f5a36ea4abbe727076af9764a", "type": "github" }, "original": { @@ -40,14 +40,15 @@ "nixos-infra": "nixos-infra", "nixpkgs": "nixpkgs", "nixpkgs-npmlock2nix": "nixpkgs-npmlock2nix", - "npmlock2nix": "npmlock2nix" + "npmlock2nix": "npmlock2nix", + "treefmt-nix": "treefmt-nix" }, "locked": { - "lastModified": 1760963929, - "narHash": "sha256-dc1E/3ia5ii9IIc6/cSfUE40lYuDzpDDTDt5FYddtRg=", + "lastModified": 1765809401, + "narHash": "sha256-VVbEUA73SkLs97ZJQ9r187lFgIXwielDeuiGv0/R/X0=", "owner": "nixos", "repo": "nixos-search", - "rev": "7144dd7a84eda607b015cac7375ad7d82b98984d", + "rev": "2781499c548c1ad7450efe9a57d97b9e467b4f1b", "type": "github" }, "original": { @@ -58,11 +59,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1760524057, - "narHash": "sha256-EVAqOteLBFmd7pKkb0+FIUyzTF61VKi7YmvP1tw4nEw=", + "lastModified": 1765472234, + "narHash": "sha256-9VvC20PJPsleGMewwcWYKGzDIyjckEz8uWmT0vCDYK0=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "544961dfcce86422ba200ed9a0b00dd4b1486ec5", + "rev": "2fbfb1d73d239d2402a8fe03963e37aab15abe8b", "type": "github" }, "original": { @@ -121,6 +122,27 @@ "repo": "default", "type": "github" } + }, + "treefmt-nix": { + "inputs": { + "nixpkgs": [ + "nixos-search", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1762938485, + "narHash": "sha256-AlEObg0syDl+Spi4LsZIBrjw+snSVU4T8MOeuZJUJjM=", + "owner": "numtide", + "repo": "treefmt-nix", + "rev": "5b4ee75aeefd1e2d5a1cc43cf6ba65eba75e83e4", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "treefmt-nix", + "type": "github" + } } }, "root": "root", From 2a59766cb178206fc0ad0b110f61dfcdd8e93962 Mon Sep 17 00:00:00 2001 From: Jonas Nick Date: Fri, 19 Dec 2025 19:12:03 +0000 Subject: [PATCH 02/11] flake-info: fix patch after upstream reformatting `add_arg_pair` call was changed to multi-line format. --- test/nixos-search/flake.nix | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/test/nixos-search/flake.nix b/test/nixos-search/flake.nix index a4e816f..87dc39d 100644 --- a/test/nixos-search/flake.nix +++ b/test/nixos-search/flake.nix @@ -17,8 +17,13 @@ # This allows running flake-info in an offline environment (./flake-info-sandboxed.sh). flake-info = nixos-search.packages.${system}.flake-info.overrideAttrs (old: { postPatch = (old.postPatch or "") + '' - substituteInPlace src/commands/nix_flake_attrs.rs --replace-fail \ - 'command.add_arg_pair("-I", "nixpkgs=https://github.com/NixOS/nixpkgs/archive/refs/heads/nixpkgs-unstable.tar.gz");' "" + file=src/commands/nix_flake_attrs.rs + old_size=$(stat -c%s "$file") + sed -zi 's|command.add_arg_pair([ \n]*"-I",[ \n]*"nixpkgs=https://github.com/NixOS/nixpkgs/archive/refs/heads/nixpkgs-unstable.tar.gz",[ \n]*);||' "$file" + if (($(stat -c%s "$file") == $old_size)); then + echo "String substitution failed" + exit 1 + fi ''; }); }); From 4303550ce3e466fae1b28d305e83cd8075d22dc4 Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Mon, 22 Dec 2025 16:27:02 +0100 Subject: [PATCH 03/11] update to NixOS 25.11 --- dev/README.md | 2 +- examples/configuration.nix | 2 +- examples/container/flake.nix | 2 +- examples/flakes/flake.nix | 2 +- flake.lock | 14 +++++++------- flake.nix | 2 +- pkgs/pinned.nix | 17 +++++++++-------- 7 files changed, 21 insertions(+), 20 deletions(-) diff --git a/dev/README.md b/dev/README.md index ff6c038..23ede16 100644 --- a/dev/README.md +++ b/dev/README.md @@ -97,5 +97,5 @@ It's easiest to use an existing service as a template: Most other services use packages that are already included in nixpkgs. ## Switching to a new NixOS release -- Run command `update-flake.sh 25.05` +- Run command `update-flake.sh 25.11` - Treewide: check if any `TODO-EXTERNAL` comments can be resolved diff --git a/examples/configuration.nix b/examples/configuration.nix index 125beaa..c942de9 100644 --- a/examples/configuration.nix +++ b/examples/configuration.nix @@ -324,7 +324,7 @@ # this value at the release version of the first install of this system. # Before changing this value read the documentation for this option # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). - system.stateVersion = "25.05"; # Did you read the comment? + system.stateVersion = "25.11"; # Did you read the comment? # The nix-bitcoin release version that your config is compatible with. # When upgrading to a backwards-incompatible release, nix-bitcoin will display an diff --git a/examples/container/flake.nix b/examples/container/flake.nix index 9401c14..137f2d4 100644 --- a/examples/container/flake.nix +++ b/examples/container/flake.nix @@ -12,7 +12,7 @@ inputs = { nix-bitcoin.url = "github:fort-nix/nix-bitcoin/release"; # You can also use a version branch to track a specific NixOS release - # nix-bitcoin.url = "github:fort-nix/nix-bitcoin/nixos-25.05"; + # nix-bitcoin.url = "github:fort-nix/nix-bitcoin/nixos-25.11"; nixpkgs.follows = "nix-bitcoin/nixpkgs"; nixpkgs-unstable.follows = "nix-bitcoin/nixpkgs-unstable"; diff --git a/examples/flakes/flake.nix b/examples/flakes/flake.nix index dce09b7..33dbb4b 100644 --- a/examples/flakes/flake.nix +++ b/examples/flakes/flake.nix @@ -10,7 +10,7 @@ inputs.nix-bitcoin.url = "github:fort-nix/nix-bitcoin/release"; # You can also use a version branch to track a specific NixOS release - # inputs.nix-bitcoin.url = "github:fort-nix/nix-bitcoin/nixos-25.05"; + # inputs.nix-bitcoin.url = "github:fort-nix/nix-bitcoin/nixos-25.11"; inputs.nixpkgs.follows = "nix-bitcoin/nixpkgs"; inputs.nixpkgs-unstable.follows = "nix-bitcoin/nixpkgs-unstable"; diff --git a/flake.lock b/flake.lock index 2513cb2..4e3c6ba 100644 --- a/flake.lock +++ b/flake.lock @@ -44,27 +44,27 @@ }, "nixpkgs": { "locked": { - "lastModified": 1765687488, - "narHash": "sha256-7YAJ6xgBAQ/Nr+7MI13Tui1ULflgAdKh63m1tfYV7+M=", + "lastModified": 1766201043, + "narHash": "sha256-eplAP+rorKKd0gNjV3rA6+0WMzb1X1i16F5m5pASnjA=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "d02bcc33948ca19b0aaa0213fe987ceec1f4ebe1", + "rev": "b3aad468604d3e488d627c0b43984eb60e75e782", "type": "github" }, "original": { "owner": "NixOS", - "ref": "nixos-25.05", + "ref": "nixos-25.11", "repo": "nixpkgs", "type": "github" } }, "nixpkgs-unstable": { "locked": { - "lastModified": 1765934234, - "narHash": "sha256-pJjWUzNnjbIAMIc5gRFUuKCDQ9S1cuh3b2hKgA7Mc4A=", + "lastModified": 1766314097, + "narHash": "sha256-laJftWbghBehazn/zxVJ8NdENVgjccsWAdAqKXhErrM=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "af84f9d270d404c17699522fab95bbf928a2d92f", + "rev": "306ea70f9eb0fb4e040f8540e2deab32ed7e2055", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index 7077d50..873c239 100644 --- a/flake.nix +++ b/flake.nix @@ -5,7 +5,7 @@ ''; inputs = { - nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05"; + nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11"; nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable"; flake-utils.url = "github:numtide/flake-utils"; extra-container = { diff --git a/pkgs/pinned.nix b/pkgs/pinned.nix index dd6a95d..3a9ff66 100644 --- a/pkgs/pinned.nix +++ b/pkgs/pinned.nix @@ -2,13 +2,6 @@ pkgs: pkgsUnstable: { inherit (pkgs) - elementsd - extra-container - fulcrum - lightning-pool - lndconnect; - - inherit (pkgsUnstable) bitcoin bitcoind bitcoind-knots @@ -17,8 +10,16 @@ pkgs: pkgsUnstable: clboss clightning electrs + elementsd + extra-container + fulcrum lightning-loop - lnd; + lightning-pool + lnd + lndconnect; + + inherit (pkgsUnstable) + ; inherit pkgs pkgsUnstable; } From 54651163ba9939e6882a8fa9e35857a6562f2ad0 Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Mon, 22 Dec 2025 16:27:03 +0100 Subject: [PATCH 04/11] treewide: fix eval warnings for NixOS 25.11 --- flake.nix | 2 +- modules/charge-lnd.nix | 2 +- modules/lndconnect.nix | 2 +- modules/netns-isolation.nix | 2 +- pkgs/default.nix | 4 ++-- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/flake.nix b/flake.nix index 873c239..be56541 100644 --- a/flake.nix +++ b/flake.nix @@ -73,7 +73,7 @@ nix-bitcoin.pkgs = if config.nix-bitcoin.useVersionLockedPkgs then (self.lib.mkNbPkgs { inherit (config.nixpkgs) system; }).modulesPkgs - else (self.lib.mkNbPkgs { inherit (pkgs) system; inherit pkgs; }).modulesPkgs; + else (self.lib.mkNbPkgs { inherit (pkgs.stdenv.hostPlatform) system; inherit pkgs; }).modulesPkgs; }; }; diff --git a/modules/charge-lnd.nix b/modules/charge-lnd.nix index 5e6991b..d9053c9 100644 --- a/modules/charge-lnd.nix +++ b/modules/charge-lnd.nix @@ -75,7 +75,7 @@ let group = user; dataDir = "/var/lib/charge-lnd"; configFile = builtins.toFile "charge-lnd.config" cfg.policies; - checkedConfig = pkgs.runCommandNoCC "charge-lnd-checked.config" { } '' + checkedConfig = pkgs.runCommand "charge-lnd-checked.config" { } '' ${config.nix-bitcoin.pkgs.charge-lnd}/bin/charge-lnd --check --config ${configFile} cp ${configFile} $out ''; diff --git a/modules/lndconnect.nix b/modules/lndconnect.nix index 0bd370a..df5494c 100644 --- a/modules/lndconnect.nix +++ b/modules/lndconnect.nix @@ -124,7 +124,7 @@ let # TODO-EXTERNAL: # lndconnect requires a --configfile argument, although it's unused # https://github.com/LN-Zap/lndconnect/issues/25 - pkgs.hiPrio (pkgs.writeScriptBin name '' + lib.hiPrio (pkgs.writeScriptBin name '' ${shebang} url=$( ${getExe config.nix-bitcoin.pkgs.lndconnect} --url \ diff --git a/modules/netns-isolation.nix b/modules/netns-isolation.nix index 9357503..683331b 100644 --- a/modules/netns-isolation.nix +++ b/modules/netns-isolation.nix @@ -157,7 +157,7 @@ in { veth = "nb-veth-${toString v.id}"; peer = "nb-veth-br-${toString v.id}"; inherit (v) netnsName; - nsenter = "${pkgs.utillinux}/bin/nsenter"; + nsenter = "${pkgs.util-linux}/bin/nsenter"; allowedNetnsAddresses = map (available: netns.${available}.address) v.availableNetns; allowedAddresses = concatStringsSep "," ([ "127.0.0.1,${bridgeIp},${v.address}" ] ++ allowedNetnsAddresses); diff --git a/pkgs/default.nix b/pkgs/default.nix index 4ba0acb..a2e8859 100644 --- a/pkgs/default.nix +++ b/pkgs/default.nix @@ -4,14 +4,14 @@ in # Set default values for use without flakes { pkgs ? import { config = {}; overlays = []; } , pkgsUnstable ? import nixpkgsPinned.nixpkgs-unstable { - inherit (pkgs.stdenv) system; + inherit (pkgs.stdenv.hostPlatform) system; config = {}; overlays = []; } }: let self = { clightning-rest = pkgs.callPackage ./clightning-rest { inherit (self) fetchNodeModules; }; - clightning-plugins = pkgs.recurseIntoAttrs (import ./clightning-plugins pkgs self.nbPython3Packages); + clightning-plugins = pkgs.lib.recurseIntoAttrs (import ./clightning-plugins pkgs self.nbPython3Packages); clnrest = pkgs.callPackage ./clnrest { inherit (self.pinned) clightning; }; joinmarket = pkgs.callPackage ./joinmarket { inherit (self) nbPython3PackagesJoinmarket; }; lndinit = pkgs.callPackage ./lndinit { }; From 974f29b5168cc74a4b21d1268550b2c9ea4a03fb Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Mon, 22 Dec 2025 16:27:04 +0100 Subject: [PATCH 05/11] python-packages: minor fixes for NixOS 25.11 --- pkgs/liquid-swap/default.nix | 1 + pkgs/python-packages/bencoderpyx/default.nix | 1 + pkgs/python-packages/chromalog/default.nix | 1 + pkgs/python-packages/joinmarket/default.nix | 4 ++-- pkgs/python-packages/python-bitcointx/default.nix | 1 + pkgs/python-packages/specific-versions/autobahn.nix | 5 +++-- pkgs/python-packages/txzmq/default.nix | 2 +- 7 files changed, 10 insertions(+), 5 deletions(-) diff --git a/pkgs/liquid-swap/default.nix b/pkgs/liquid-swap/default.nix index 103e892..f1fa022 100644 --- a/pkgs/liquid-swap/default.nix +++ b/pkgs/liquid-swap/default.nix @@ -3,6 +3,7 @@ buildPythonPackage rec { pname = "liquid-swap"; version = "0.0.2"; + format = "setuptools"; propagatedBuildInputs = [ click ]; diff --git a/pkgs/python-packages/bencoderpyx/default.nix b/pkgs/python-packages/bencoderpyx/default.nix index d71dc31..68dc67d 100644 --- a/pkgs/python-packages/bencoderpyx/default.nix +++ b/pkgs/python-packages/bencoderpyx/default.nix @@ -3,6 +3,7 @@ buildPythonPackage rec { pname = "bencoder.pyx"; version = "3.0.1"; + format = "setuptools"; src = fetchurl { url = "https://github.com/whtsky/bencoder.pyx/archive/9a47768f3ceba9df9e6fbaa7c445f59960889009.tar.gz"; diff --git a/pkgs/python-packages/chromalog/default.nix b/pkgs/python-packages/chromalog/default.nix index 80739f6..1522a42 100644 --- a/pkgs/python-packages/chromalog/default.nix +++ b/pkgs/python-packages/chromalog/default.nix @@ -2,6 +2,7 @@ buildPythonPackage rec { pname = "chromalog"; version = "1.0.5"; + format = "setuptools"; src = fetchFromGitHub { owner = "freelan-developers"; diff --git a/pkgs/python-packages/joinmarket/default.nix b/pkgs/python-packages/joinmarket/default.nix index 4721017..1a318fd 100644 --- a/pkgs/python-packages/joinmarket/default.nix +++ b/pkgs/python-packages/joinmarket/default.nix @@ -13,7 +13,7 @@ , twisted , txtorcon , python-bitcointx -, argon2_cffi +, argon2-cffi , autobahn , bencoderpyx , klein @@ -48,7 +48,7 @@ buildPythonPackage rec { python-bitcointx # jmclient - argon2_cffi + argon2-cffi autobahn bencoderpyx klein diff --git a/pkgs/python-packages/python-bitcointx/default.nix b/pkgs/python-packages/python-bitcointx/default.nix index 7f42ef2..8f407c0 100644 --- a/pkgs/python-packages/python-bitcointx/default.nix +++ b/pkgs/python-packages/python-bitcointx/default.nix @@ -3,6 +3,7 @@ buildPythonPackage rec { pname = "python-bitcointx"; version = "1.1.5"; + format = "setuptools"; src = fetchFromGitHub { owner = "Simplexum"; diff --git a/pkgs/python-packages/specific-versions/autobahn.nix b/pkgs/python-packages/specific-versions/autobahn.nix index 0b2e106..e880605 100644 --- a/pkgs/python-packages/specific-versions/autobahn.nix +++ b/pkgs/python-packages/specific-versions/autobahn.nix @@ -2,19 +2,20 @@ # but without Python 2 support { lib, buildPythonPackage, fetchPypi, - six, txaio, twisted, zope_interface, cffi, + six, txaio, twisted, zope-interface, cffi, mock, pytest, cryptography, pynacl }: buildPythonPackage rec { pname = "autobahn"; version = "20.12.3"; + format = "setuptools"; src = fetchPypi { inherit pname version; sha256 = "15b8zm7jalwisfwc08szxy3bh2bnn0hd41dbsnswi0lqwbh962j1"; }; - propagatedBuildInputs = [ six txaio twisted zope_interface cffi cryptography pynacl ]; + propagatedBuildInputs = [ six txaio twisted zope-interface cffi cryptography pynacl ]; checkInputs = [ mock pytest ]; checkPhase = '' diff --git a/pkgs/python-packages/txzmq/default.nix b/pkgs/python-packages/txzmq/default.nix index b3799aa..920e552 100644 --- a/pkgs/python-packages/txzmq/default.nix +++ b/pkgs/python-packages/txzmq/default.nix @@ -9,6 +9,7 @@ buildPythonPackage rec { pname = "txzmq"; version = "0.8.2"; + format = "setuptools"; src = fetchPypi { pname = "txZMQ"; @@ -18,7 +19,6 @@ buildPythonPackage rec { propagatedBuildInputs = [ pyzmq - setuptools twisted ]; From 9eca5294bbb01103ab13df1700d715cd067b4f6a Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Mon, 22 Dec 2025 16:27:05 +0100 Subject: [PATCH 06/11] pyln-proto: fix for NixOS 25.11 coincurve 21 has no breaking changes: https://github.com/ofek/coincurve/releases/tag/v21.0.0 --- pkgs/python-packages/pyln-proto/default.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/python-packages/pyln-proto/default.nix b/pkgs/python-packages/pyln-proto/default.nix index 9a7352b..b35b2e9 100644 --- a/pkgs/python-packages/pyln-proto/default.nix +++ b/pkgs/python-packages/pyln-proto/default.nix @@ -16,6 +16,11 @@ buildPythonPackage rec { inherit (clightning) src; + postPatch = '' + substituteInPlace pyproject.toml \ + --replace-fail 'coincurve==20.0.0' 'coincurve==21.0.0' + ''; + nativeBuildInputs = [ hatchling ]; propagatedBuildInputs = [ From 4ba311c42542a5be3a648c1de18456c83f89d9af Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Mon, 22 Dec 2025 16:27:06 +0100 Subject: [PATCH 07/11] trezor: fix for NixOS 25.11 --- pkgs/python-packages/default.nix | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/pkgs/python-packages/default.nix b/pkgs/python-packages/default.nix index 40266cd..310b173 100644 --- a/pkgs/python-packages/default.nix +++ b/pkgs/python-packages/default.nix @@ -49,6 +49,14 @@ rec { }).pkgs; in { hwi = with python3PackagesWithUnlockedEcdsa; toPythonApplication hwi; - inherit (python3PackagesWithUnlockedEcdsa) trezor; + + # trezor 0.13.10 supports click 8.2.x. + # The version spec `click>=8,<8.3` has been copied from trezor 0.20.0-dev. + trezor = python3PackagesWithUnlockedEcdsa.trezor.overridePythonAttrs (_: { + postPatch = '' + substituteInPlace requirements.txt \ + --replace-fail 'click>=7,<8.2' 'click>=8,<8.3' + ''; + }); }; } From 3b9406a4d27077e8ac8ee8c7f66b7a29b1a305a9 Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Mon, 22 Dec 2025 16:27:07 +0100 Subject: [PATCH 08/11] joinmarket: fix for NixOS 25.11 Temporarily add nixpkgs-25.05 for joinmarket (see code comment). --- flake.lock | 17 +++++++++++++++++ flake.nix | 8 ++++++-- helper/update-flake.nix | 4 ++-- pkgs/default.nix | 7 ++++++- pkgs/joinmarket/default.nix | 4 ++-- pkgs/nixpkgs-pinned.nix | 1 + pkgs/pinned.nix | 4 ++-- pkgs/python-packages/default.nix | 21 +++++++++++++++------ 8 files changed, 51 insertions(+), 15 deletions(-) diff --git a/flake.lock b/flake.lock index 4e3c6ba..036efc5 100644 --- a/flake.lock +++ b/flake.lock @@ -58,6 +58,22 @@ "type": "github" } }, + "nixpkgs-25_05": { + "locked": { + "lastModified": 1766014764, + "narHash": "sha256-+73VffE5GP5fvbib6Hs1Su6LehG+9UV1Kzs90T2gBLA=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "2b0d2b456e4e8452cf1c16d00118d145f31160f9", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-25.05", + "repo": "nixpkgs", + "type": "github" + } + }, "nixpkgs-unstable": { "locked": { "lastModified": 1766314097, @@ -79,6 +95,7 @@ "extra-container": "extra-container", "flake-utils": "flake-utils", "nixpkgs": "nixpkgs", + "nixpkgs-25_05": "nixpkgs-25_05", "nixpkgs-unstable": "nixpkgs-unstable" } }, diff --git a/flake.nix b/flake.nix index be56541..f33fdf8 100644 --- a/flake.nix +++ b/flake.nix @@ -7,6 +7,7 @@ inputs = { nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11"; nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable"; + nixpkgs-25_05.url = "github:NixOS/nixpkgs/nixos-25.05"; flake-utils.url = "github:numtide/flake-utils"; extra-container = { url = "github:erikarvstedt/extra-container/0.13"; @@ -15,7 +16,7 @@ }; }; - outputs = { self, nixpkgs, nixpkgs-unstable, flake-utils, ... }: + outputs = { self, nixpkgs, nixpkgs-unstable, nixpkgs-25_05, flake-utils, ... }: let supportedSystems = [ "x86_64-linux" @@ -33,8 +34,9 @@ system , pkgs ? nixpkgs.legacyPackages.${system} , pkgsUnstable ? nixpkgs-unstable.legacyPackages.${system} + , pkgs-25_05 ? nixpkgs-25_05.legacyPackages.${system} }: - import ./pkgs { inherit pkgs pkgsUnstable; }; + import ./pkgs { inherit pkgs pkgsUnstable pkgs-25_05; }; test = { inherit (test) scenarios; @@ -95,6 +97,8 @@ "nixops19_09" "pinned" "generate-secrets" + "nbPython3Packages" + "nbPython3PackagesJoinmarket" ]) // { inherit (import ./examples/qemu-vm/minimal-vm.nix self pkgs system) # A simple demo VM. diff --git a/helper/update-flake.nix b/helper/update-flake.nix index 2bc592e..e5fa20d 100644 --- a/helper/update-flake.nix +++ b/helper/update-flake.nix @@ -64,7 +64,7 @@ in rec { toLines = pkgs: builtins.concatStringsSep "\n " (builtins.attrNames pkgs); in '' # This file is generated by ../helper/update-flake.nix - pkgs: pkgsUnstable: + pkgs: pkgsUnstable: pkgs-25_05: { inherit (pkgs) ${toLines versions.stable}; @@ -72,7 +72,7 @@ in rec { inherit (pkgsUnstable) ${toLines versions.unstable}; - inherit pkgs pkgsUnstable; + inherit pkgs pkgsUnstable pkgs-25_05; } ''; } diff --git a/pkgs/default.nix b/pkgs/default.nix index a2e8859..74e89ce 100644 --- a/pkgs/default.nix +++ b/pkgs/default.nix @@ -8,6 +8,11 @@ in config = {}; overlays = []; } +, pkgs-25_05 ? import nixpkgsPinned.nixpkgs-25_05 { + inherit (pkgs.stdenv.hostPlatform) system; + config = {}; + overlays = []; + } }: let self = { clightning-rest = pkgs.callPackage ./clightning-rest { inherit (self) fetchNodeModules; }; @@ -43,7 +48,7 @@ let self = { generate-secrets = import ./generate-secrets-deprecated.nix; nixops19_09 = pkgs.callPackage ./nixops { }; - pinned = import ./pinned.nix pkgs pkgsUnstable; + pinned = import ./pinned.nix pkgs pkgsUnstable pkgs-25_05; modulesPkgs = self // self.pinned; }; in self diff --git a/pkgs/joinmarket/default.nix b/pkgs/joinmarket/default.nix index 5c9a0e5..05e2555 100644 --- a/pkgs/joinmarket/default.nix +++ b/pkgs/joinmarket/default.nix @@ -1,4 +1,4 @@ -{ stdenv, lib, fetchFromGitHub, python3, nbPython3PackagesJoinmarket }: +{ stdenv, lib, fetchFromGitHub, nbPython3PackagesJoinmarket }: let # Note: @@ -18,7 +18,7 @@ let matplotlib # for ob-watcher ]; - pythonEnv = python3.withPackages (_: runtimePackages); + pythonEnv = nbPython3PackagesJoinmarket.python.withPackages (_: runtimePackages); in stdenv.mkDerivation { pname = "joinmarket"; diff --git a/pkgs/nixpkgs-pinned.nix b/pkgs/nixpkgs-pinned.nix index 41b0983..d5a865f 100644 --- a/pkgs/nixpkgs-pinned.nix +++ b/pkgs/nixpkgs-pinned.nix @@ -17,4 +17,5 @@ in { nixpkgs = fetch lockedInputs.nixpkgs; nixpkgs-unstable = fetch lockedInputs.nixpkgs-unstable; + nixpkgs-25_05 = fetch lockedInputs.nixpkgs-25_05; } diff --git a/pkgs/pinned.nix b/pkgs/pinned.nix index 3a9ff66..fb96187 100644 --- a/pkgs/pinned.nix +++ b/pkgs/pinned.nix @@ -1,5 +1,5 @@ # This file is generated by ../helper/update-flake.nix -pkgs: pkgsUnstable: +pkgs: pkgsUnstable: pkgs-25_05: { inherit (pkgs) bitcoin @@ -21,5 +21,5 @@ pkgs: pkgsUnstable: inherit (pkgsUnstable) ; - inherit pkgs pkgsUnstable; + inherit pkgs pkgsUnstable pkgs-25_05; } diff --git a/pkgs/python-packages/default.nix b/pkgs/python-packages/default.nix index 310b173..78de859 100644 --- a/pkgs/python-packages/default.nix +++ b/pkgs/python-packages/default.nix @@ -21,18 +21,27 @@ rec { sha256 = callPackage ./sha256 {}; joinmarket = callPackage ./joinmarket { inherit (nbPkgs.joinmarket) version src; }; - - ## Specific versions of packages that already exist in nixpkgs - - # autobahn 20.12.3, required by joinmarketclient - autobahn = callPackage ./specific-versions/autobahn.nix {}; }; nbPython3Packages = (python3.override { packageOverrides = pyPkgsOverrides; }).pkgs; - nbPython3PackagesJoinmarket = nbPython3Packages; + # joinmarket requires cython 3.0 via pkg bencoder.pyx. + # The python pkgs from nixpkgs-25.11 default to cython 3.1. + # Downgrading to 3.0 causes mass rebuilds, so we use python pkgs from nixpkgs-25.05 for joinmarket. + # The nixpkgs-25.05 dependency will be removed with the next joinmarket update. + # https://github.com/JoinMarket-Org/joinmarket-clientserver/issues/1787 + nbPython3PackagesJoinmarket = + (nbPkgs.pinned.pkgs-25_05.python3.override { + packageOverrides = self: super: + (pyPkgsOverrides self super) // { + ## Specific versions of packages that already exist in nixpkgs + + # autobahn 20.12.3, required by joinmarketclient + autobahn = self.callPackage ./specific-versions/autobahn.nix {}; + }; + }).pkgs; # Re-enable pkgs `hwi`, `trezor` that are unaffected by `CVE-2024-23342` because # they don't use python pkg `ecdsa` for signing. From 7b215e6ca1d65e07b434aa387fd5b27517b58a8b Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Mon, 22 Dec 2025 16:27:08 +0100 Subject: [PATCH 09/11] extra-container: 0.13 -> 0.14 Adds support for NixOS 25.11 --- flake.lock | 8 ++++---- flake.nix | 2 +- test/lib/extra-container-check-version.sh | 4 ++-- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/flake.lock b/flake.lock index 036efc5..cc5a919 100644 --- a/flake.lock +++ b/flake.lock @@ -10,16 +10,16 @@ ] }, "locked": { - "lastModified": 1734005403, - "narHash": "sha256-vgh3TqfkFdnPxREBedw4MQehIDc3N8YyxBOB45n+AvU=", + "lastModified": 1766155727, + "narHash": "sha256-XGp4HHH6D6ZKiO5RnMzqYJYnZB538EnEflvlTsOKpvo=", "owner": "erikarvstedt", "repo": "extra-container", - "rev": "f4de6c329b306a9d3a9798a30e060c166f781baa", + "rev": "b450bdb24fca1076973c852d87bcb49b8eb5fd49", "type": "github" }, "original": { "owner": "erikarvstedt", - "ref": "0.13", + "ref": "0.14", "repo": "extra-container", "type": "github" } diff --git a/flake.nix b/flake.nix index f33fdf8..f43ce7e 100644 --- a/flake.nix +++ b/flake.nix @@ -10,7 +10,7 @@ nixpkgs-25_05.url = "github:NixOS/nixpkgs/nixos-25.05"; flake-utils.url = "github:numtide/flake-utils"; extra-container = { - url = "github:erikarvstedt/extra-container/0.13"; + url = "github:erikarvstedt/extra-container/0.14"; inputs.nixpkgs.follows = "nixpkgs"; inputs.flake-utils.follows = "flake-utils"; }; diff --git a/test/lib/extra-container-check-version.sh b/test/lib/extra-container-check-version.sh index a78a0bd..3017859 100644 --- a/test/lib/extra-container-check-version.sh +++ b/test/lib/extra-container-check-version.sh @@ -1,7 +1,7 @@ containerBin=$(type -P extra-container) || true -if [[ ! ($containerBin && $(realpath "$containerBin") == *extra-container-0.13*) ]]; then +if [[ ! ($containerBin && $(realpath "$containerBin") == *extra-container-0.14*) ]]; then echo - echo "Building extra-container. Skip this step by adding extra-container 0.13 to PATH." + echo "Building extra-container. Skip this step by adding extra-container 0.14 to PATH." nix build --out-link /tmp/extra-container "${BASH_SOURCE[0]%/*}"/../..#extra-container # When this script is run as root, e.g. when run in an extra-container shell, # chown the gcroot symlink to the regular (login) user so that the symlink can be From 53104f55f97b23b885eb0948b618caeb04d66a1a Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Mon, 22 Dec 2025 16:27:09 +0100 Subject: [PATCH 10/11] btcpayserver: update postgresql setup to NixOS 25.11 --- modules/btcpayserver.nix | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/modules/btcpayserver.nix b/modules/btcpayserver.nix index a84b5a5..0249bf8 100644 --- a/modules/btcpayserver.nix +++ b/modules/btcpayserver.nix @@ -135,14 +135,17 @@ in { }; services.postgresql = { enable = true; - ensureDatabases = [ "btcpaydb" "nbxplorer" ]; + ensureDatabases = [ + "btcpaydb" # This name is kept for backwards compatibility + "nbxplorer" + ]; ensureUsers = [ { name = cfg.btcpayserver.user; } { name = cfg.nbxplorer.user; } ]; }; - systemd.services.postgresql.postStart = lib.mkAfter '' - $PSQL -tAc ' + systemd.services.postgresql-setup.postStart = '' + psql -tAc ' ALTER DATABASE "btcpaydb" OWNER TO "${cfg.btcpayserver.user}"; ALTER DATABASE "nbxplorer" OWNER TO "${cfg.nbxplorer.user}"; ' @@ -171,7 +174,7 @@ in { ''; in rec { wantedBy = [ "multi-user.target" ]; - requires = [ "postgresql.service" ]; + requires = [ "postgresql.target" ]; wants = [ "bitcoind.service" ] ++ optional cfg.btcpayserver.lbtc "liquidd.service"; after = requires ++ wants ++ [ "nix-bitcoin-secrets.target" ]; preStart = '' @@ -226,7 +229,7 @@ in { ''); in rec { wantedBy = [ "multi-user.target" ]; - requires = [ "postgresql.service" ]; + requires = [ "postgresql.target" ]; wants = [ "nbxplorer.service" ] ++ optional (cfg.btcpayserver.lightningBackend != null) "${cfg.btcpayserver.lightningBackend}.service"; after = requires ++ wants; From 72e220d998723d448164efda8e7741041a5c9fd6 Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Mon, 22 Dec 2025 16:27:10 +0100 Subject: [PATCH 11/11] containers: use native systemd FUSE support Since version 257 (NixOS 25.05), systemd-nspawn automatically creates a /dev/fuse node in the container when the host's FUSE node is accessible to the nspawn process: https://github.com/systemd/systemd/pull/34067 --- test/lib/make-test.nix | 4 ---- 1 file changed, 4 deletions(-) diff --git a/test/lib/make-test.nix b/test/lib/make-test.nix index 16e2192..e710227 100644 --- a/test/lib/make-test.nix +++ b/test/lib/make-test.nix @@ -68,15 +68,11 @@ let # Enable FUSE inside the container when clightning replication # is enabled. - # TODO-EXTERNAL: Remove this when - # https://github.com/systemd/systemd/issues/17607 - # has been resolved. This will also improve security. ( let s = config.config.services; in lib.mkIf (s ? clightning && s.clightning.enable && s.clightning.replication.enable) { - bindMounts."/dev/fuse" = { hostPath = "/dev/fuse"; }; allowedDevices = [ { node = "/dev/fuse"; modifier = "rw"; } ]; } )