chore: update nix to 2.34.9 and NixOS to 26.05

.gitignore

@@ -1,4 +1,4 @@
 /target
 /nix
 base.*
-src/assets/programs.*
+src/assets/programs*

Makefile

@@ -51,14 +51,19 @@ endif
 
 cargo_build = cargo build --profile $(cargo_profile) --target $(cargo_target)
 
-# programs index
-nix_channel ?= unstable
+# programs index, from the NixOS release packages are built from
+nixos_version := $(shell sed -n 's/^pub(crate) const NIXOS_VERSION: &str = "\(.*\)";$$/\1/p' src/lib.rs)
+ifeq ($(nixos_version),)
+  $(error could not read NIXOS_VERSION from src/lib.rs)
+endif
+nix_channel ?= $(nixos_version)
 nix_channels_url = https://nixos.org/channels/nixos-$(nix_channel)
-dl_prog_index = curl -sL -o - $(nix_channels_url)/nixexprs.tar.xz
+dl_prog_index = curl -sfL -o - $(nix_channels_url)/nixexprs.tar.xz
 
 assets = src/assets
-prog_index_sqlite = $(assets)/programs.sqlite
-unpack_prog_index = tar xJ -C $(assets) --strip-components=1 --wildcards '*/programs.sqlite'
+# channel in the name: changing it downloads the matching index
+prog_index_sqlite = $(assets)/programs-$(nix_channel).sqlite
+unpack_prog_index = tar xJO --wildcards '*/programs.sqlite'
 
 prog_index_csv = src/assets/programs.csv
 
@@ -95,7 +100,8 @@ $(pkg_bin): $(prog_index_csv)
 $(prog_index_sqlite):
 	@echo "* Downloading $@"
 	@mkdir -p $(assets)
-	@$(dl_prog_index) | $(unpack_prog_index)
+	@$(dl_prog_index) | $(unpack_prog_index) > $@.tmp
+	@mv $@.tmp $@
 
 $(prog_index_csv): $(prog_index_sqlite)
 	@echo "* Converting $< to $@"

README.md

@@ -167,7 +167,7 @@ echo "access-tokens = github.com=${GITHUB_TOKEN}" >> ~/.local/state/dive/base-im
 The file will then look like this:
 ```
 experimental-features = nix-command flakes
-extra-nix-path = nixpkgs=github:nixos/nixpkgs/nixos-25.05
+extra-nix-path = nixpkgs=github:nixos/nixpkgs/nixos-26.05
 build-users-group =
 sandbox = false
 access-tokens = github.com=...

src/lib.rs

@@ -14,8 +14,8 @@ mod embedded_image;
 
 mod pid_file;
 
-pub(crate) const NIX_VERSION: &str = "2.28.3";
-pub(crate) const NIXOS_VERSION: &str = "25.05";
+pub(crate) const NIX_VERSION: &str = "2.34.9";
+pub(crate) const NIXOS_VERSION: &str = "26.05";
 
 pub(crate) const CACHE_HOME: &str = "/nix/.cache";
 pub(crate) const CONFIG_HOME: &str = "/nix/.config";
@@ -30,7 +30,7 @@ pub(crate) const SSL_CERTS: &str = "/nix/.base/etc/ssl/certs/ca-bundle.crt";
 /// CA roots distrusted in the base image's `cacert` (NSS labels).
 ///
 /// NSS 3.131.1 removed these after the eMudhra intermediate CA compromise
-/// (October 2026), but nixos-25.05 is frozen at NSS 3.117.
+/// (October 2026), but nixos-26.05 is still at NSS 3.126.
 pub(crate) const CACERT_BLOCKLIST: &[&str] = &[
     "emSign ECC Root CA - G3",
     "emSign Root CA - C1",

src/nixpkgs.rs

@@ -7,13 +7,18 @@ use std::{
 };
 
 use anyhow::{Context, Result};
+use const_format::formatcp;
 use serde::{self, Deserialize, Serialize};
 use serde_json::json;
 
 use crate::nixos;
 
-const NIXOS_SEARCH_URL: &str =
-    "https://search.nixos.org/backend/latest-*-nixos-unstable/_search";
+/// Matches every index generation still served for the NixOS release
+/// the packages are built from (see `collapse_newest()`).
+const NIXOS_SEARCH_URL: &str = formatcp!(
+    "https://search.nixos.org/backend/latest-*-nixos-{}/_search",
+    crate::NIXOS_VERSION
+);
 
 const NIXOS_SEARCH_USER: &str = "aWVSALXpZv";
 const NIXOS_SEARCH_PASS: &str = "X8gPHnzL52wFEekuxsfQ9cSh";
@@ -32,6 +37,36 @@ struct ESHits {
 struct Hit {
     #[serde(rename = "_source")]
     package: Package,
+    inner_hits: Option<InnerHits>,
+}
+
+#[derive(Serialize, Deserialize)]
+struct InnerHits {
+    newest: ESResponse,
+}
+
+impl Hit {
+    /// Package from the newest index generation, if collapsed
+    fn newest_package(self) -> Package {
+        self.inner_hits
+            .and_then(|i| i.newest.hits.hits.into_iter().next())
+            .map_or(self.package, |h| h.package)
+    }
+}
+
+/// Collapse search results to one hit per package.
+///
+/// `NIXOS_SEARCH_URL` matches several index generations, and the older ones
+/// are not updated anymore: take each package from the newest one.
+fn collapse_newest() -> serde_json::Value {
+    json!({
+      "field": "package_attr_name",
+      "inner_hits": {
+        "name": "newest",
+        "size": 1,
+        "sort": [{ "_index": "desc" }]
+      }
+    })
 }
 
 #[derive(
@@ -146,6 +181,7 @@ fn query_payload<'a, I: IntoIterator<Item = &'a String>>(
           "package_pversion": "desc"
         }
       ],
+      "collapse": collapse_newest(),
       "query": {
         "bool": {
           "filter": [
@@ -192,8 +228,12 @@ fn pkg_search(query: serde_json::Value) -> Result<Packages> {
         .body_mut()
         .read_json::<ESResponse>()?;
 
-    let pkgs: Vec<Package> =
-        response.hits.hits.into_iter().map(|h| h.package).collect();
+    let pkgs: Vec<Package> = response
+        .hits
+        .hits
+        .into_iter()
+        .map(Hit::newest_package)
+        .collect();
 
     Ok(pkgs)
 }
@@ -211,6 +251,7 @@ pub fn find_package(name: &str) -> Result<Option<Package>> {
           "query": format!("package_attr_name:\"{}\"", name)
         }
       },
+      "collapse": collapse_newest(),
       "size": 1,
       "from": 0,
       "sort": []