Repository navigation
chore: update nix to 2.34.9 and NixOS to 26.05 - #43
Merged
Merged
Conversation
NixOS 25.05 is EOL. Nix 2.34 is the stable Nix in nixpkgs 26.05. The eMudhra cacert blocklist is kept: nixos-26.05 is still at NSS 3.126. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Packages are built from the stable release since #31, but pkg search and pkg install still looked packages up in the nixos-unstable index: listed versions could differ from the installed ones, and packages missing from the release were found, then failed to build. The index pattern also matches every index generation still served, so each package appeared once per generation (4-5 times), crowding the 20 search results. Collapse hits to one per package, taken from the newest generation, as older ones are no longer updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The command-not-found index came from nixos-unstable, while packages are built from the stable release. Take the channel from NIXOS_VERSION in src/lib.rs instead. The index file is named after its channel, so changing NIXOS_VERSION downloads the matching index: before, an existing src/assets/programs.sqlite was kept forever. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
NixOS 25.05 has been EOL since the start of 2026, so the base image packages have missed about 10 months of security updates.
Changes
NIXOS_VERSION: 25.05 → 26.05NIX_VERSION: 2.28.3 → 2.34.9 (the stable Nix in nixpkgs 26.05). Its installer tarball layout works withinstall_nix/find_nixas before.nix.confexample updated.pkg search/pkg installnow use the 26.05 search index. Before, they used nixos-unstable while packages are built from the stable release (since feat: use stable NixOS release (24.11) #31), so listed versions could differ from the installed ones. Results are also collapsed to one per package, taken from the newest index generation. Before,latest-*matched every generation still served (4-5), so each package showed up several times.NIXOS_VERSIONinsrc/lib.rs, instead of using nixos-unstable. The index file is named after its channel (src/assets/programs-26.05.sqlite), so bumpingNIXOS_VERSIONdownloads the matching index; before, an existingprograms.sqlitewas never refreshed.cacertblocklist from v0.2.4 stays: nixos-26.05 is still on NSS 3.126, which lacks the NSS 3.131.1 removals. Remove the blocklist once cacert ≥ 3.131.1 reaches the release branch.Testing (x86_64, local)
make base-image package=noagainst nixos-26.05: allBASE_PACKAGESbuild, no evaluation warnings.nix --versionandnix evalwork.ca-bundle.crt(nss-cacert-3.126) still has the 3 emSign roots marked rejected for serverAuth. curl inside the image rejectsdv-g3b-emudhra.we-have-a-problem.comanddv-g3b-aaa-emudhra.we-have-a-problem.comand reaches github.com / cache.nixos.org.pkgcycle in a dive session against an Alpine Docker container (driven with the command mode from feat: execute a command instead of an interactive shell #44):pkg search,pkg install iftop/ripgrep(built against nixos-26.05), tools available from/nix/.env/bin,pkg list,pkg remove iftop(ripgrep kept), base tools unaffected.pkg listreports ripgrep 15.1.0, matching the installedrg --version(it reported 15.2.0, from unstable, before); an unknown package name still fails cleanly.find_program, and sample lookups (rg→ ripgrep,tshark,bpftrace, …) resolve.Note: 26.05 itself is supported until about the end of December 2026, so plan for a 26.11 bump.