update nixpkgs

Author: DavHau

.github/workflows/nix-portable.yml

@@ -22,7 +22,7 @@ jobs:
           # Nix Flakes doesn't work on shallow clones
           fetch-depth: 0
 
-    - uses: cachix/install-nix-action@V27
+    - uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15  # v31.9.0
       with:
         extra_nix_config: |
           experimental-features = nix-command flakes
@@ -53,7 +53,7 @@ jobs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
       - uses: actions/checkout@v4
-      - uses: cachix/install-nix-action@v30
+      - uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15  # v31.9.0
       - id: set-matrix
         name: Generate Nix Matrix
         run: |
@@ -71,7 +71,7 @@ jobs:
       matrix: ${{fromJSON(needs.nix-matrix.outputs.matrix)}}
     steps:
       - uses: actions/checkout@v4
-      - uses: cachix/install-nix-action@v30
+      - uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15  # v31.9.0
         with:
           extra_nix_config: |
             experimental-features = nix-command flakes impure-derivations ca-derivations
@@ -100,7 +100,7 @@ jobs:
           # Nix Flakes doesn't work on shallow clones
           fetch-depth: 0
 
-    - uses: cachix/install-nix-action@V27
+    - uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15  # v31.9.0
       with:
         extra_nix_config: |
           experimental-features = nix-command flakes

.github/workflows/update-flake-lock.yml

@@ -11,7 +11,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Install Nix
-        uses: cachix/install-nix-action@V27
+        uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15  # v31.9.0
       # `bors merge` will automerge if tests succeed
       # Requires this github to be installed: https://app.bors.tech/
       - name: Update flake.lock

.mergify.yml

@@ -2,9 +2,8 @@ queue_rules:
   - name: default
 defaults:
   actions:
-    queue:
-      allow_merging_configuration_change: true
-      method: rebase
+  queue_rule:
+    merge_method: rebase
 pull_request_rules:
   - name: merge using the merge queue
     conditions:

default.nix

@@ -10,7 +10,7 @@ with builtins;
   buildPackages,
   upx,
 
-  busybox ? pkgs.pkgsStatic.busybox,
+  busybox,
   cacert ? pkgs.cacert,
   compression ? "zstd -19 -T0",
   gnutar ? pkgs.pkgsStatic.gnutar,
@@ -19,7 +19,7 @@ with builtins;
   pkgs ? import <nixpkgs> {},
   xz ? pkgs.pkgsStatic.xz,
   zstd ? pkgs.pkgsStatic.zstd,
-  nixStatic ? pkgs.pkgsStatic.nix,
+  nixStatic,
   # hardcode executable to run. Useful when creating a bundle.
   bundledPackage ? null,
   ...
@@ -42,15 +42,18 @@ let
   git = pkgs."${gitAttribute}";
 
   maketar = targets:
+    let
+      closureInfo = buildPackages.closureInfo { rootPaths = targets; };
+    in
     stdenv.mkDerivation {
       name = "nix-portable-store-tarball";
       nativeBuildInputs = [ perl zstd ];
       exportReferencesGraph = map (x: [("closure-" + baseNameOf x) x]) targets;
       buildCommand = ''
-        storePaths=$(perl ${buildPackages.pathsFromGraph} ./closure-*)
+        storePaths=$(cat ${closureInfo}/store-paths)
         mkdir $out
         echo $storePaths > $out/index
-        cp -r ${buildPackages.closureInfo { rootPaths = targets; }} $out/closureInfo
+        cp -r ${closureInfo} $out/closureInfo
 
         tar -cf - \
           --owner=0 --group=0 --mode=u+rw,uga+r \

flake.lock

@@ -49,8 +49,8 @@ stdenv.mkDerivation (finalAttrs: {
 
     qemu-img create -b $rootDisk -F "$image_type" -f qcow2 ./disk.qcow2
 
-    cp ${pkgs.callPackage ./qemu-efi.nix {}} ./QEMU_EFI.img
-    chmod +w ./QEMU_EFI.img
+    cp ${pkgsBuildBuild.qemu}/share/qemu/edk2-aarch64-code.fd QEMU_EFI.fd
+    chmod +w QEMU_EFI.fd
 
     extra_qemu_opts="${image.extraQemuOpts or ""}"
 
@@ -67,7 +67,8 @@ stdenv.mkDerivation (finalAttrs: {
       -drive id=disk1,file=./disk.qcow2,if=virtio \
       -netdev user,id=net0,hostfwd=tcp::$port-:22 -device virtio-net-pci,netdev=net0 \
       ${lib.optionalString (system == "aarch64-linux")
-        "-cpu cortex-a53 -machine virt -drive if=pflash,format=raw,file=./QEMU_EFI.img"} \
+        "-cpu cortex-a53 -machine virt -pflash ./QEMU_EFI.fd"
+      } \
       $extra_qemu_opts &
     qemu_pid=$!
     trap "kill $qemu_pid" EXIT
@@ -79,7 +80,7 @@ stdenv.mkDerivation (finalAttrs: {
     chmod 0400 ./vagrant_insecure_key
 
     export HOME=$(realpath .)
-    ssh_opts="-o StrictHostKeyChecking=no -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa -i ./vagrant_insecure_key"
+    ssh_opts="-o StrictHostKeyChecking=no -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa -o ControlPath=none -i ./vagrant_insecure_key"
     ssh="ssh -p $port -q $ssh_opts vagrant@localhost"
     echo "ssh command: $ssh"
     sshRoot="ssh -p $port -q $ssh_opts root@localhost"

testing/qemu-efi.nix

@@ -52,11 +52,15 @@ let
 
   images.aarch64-linux = {
     nixos = {
-      image = (toString (nixos {
-        imports = [
-          ./nixos-iso.nix
-        ];
-      }).config.system.build.isoImage) + "/iso/nixos.iso";
+      image =
+        let
+          nixosSystem = (nixos {
+            imports = [
+              ./nixos-iso.nix
+            ];
+          });
+        in
+          (toString nixosSystem.config.system.build.isoImage) + "/iso/${nixosSystem.config.system.build.isoImage.isoName}";
       system = "aarch64-linux";
       dontUnpack = true;
       disabledRuntimes = ["proot"];
@@ -115,11 +119,15 @@ let
 
   images.x86_64-linux = {
     nixos = {
-      image = (toString (nixos {
-        imports = [
-          ./nixos-iso.nix
-        ];
-      }).config.system.build.isoImage) + "/iso/nixos.iso";
+      image =
+        let
+          nixosSystem = (nixos {
+            imports = [
+              ./nixos-iso.nix
+            ];
+          });
+        in
+          (toString nixosSystem.config.system.build.isoImage) + "/iso/${nixosSystem.config.system.build.isoImage.isoName}";
       system = "x86_64-linux";
       rootDisk = "nixos.qcow2";
       dontUnpack = true;