jiebi/CodeConvo huggingface dataset:
Change:
, CVSSv3=4.3 (nixos-21.11) archivy is vulnerable to Cross-Site Request Forgery (CSRF) Scanned versions: nixos-21.11: . Cc

Discussion:
let defaultOverrides = [ (self: super: { <del> flask = super.flask.overridePythonAttrs (oldAttrs: rec { version = "1.1.2"; pname = "Flask"; </del> <ins> wtforms = super.wtforms.overridePythonAttrs (oldAttrs: rec { version = "2.3.1"; pname = "WTForms"; </ins> src = super.fetchPypi { inherit pname version; <del> sha256 = "sha256-Tvoa4tfJhlr0iYbeiuuFBL8yx/PW/ck1PTSyH0sScGA="; </del> <ins> sha256 = "sha256-hhoTs65SHWcA2sOydxlwvTVKY7pwQ+zDqCtSiFlqGXI="; </ins> }; <del> checkInputs = [ self.pytest ]; propagatedBuildInputs = with self; [ itsdangerous click werkzeug jinja2 ]; doCheck = false; }); }) (self: super: { flask_login = super.flask_login.overridePythonAttrs (oldAttrs: rec { pname = "Flask"; version = "0.5.0"; src = fetchPypi { inherit pname version; sha256 = "6d33aef15b5bcead780acc339464aae8a6e28f13c90d8b1cf9de8b549d1c0b4b"; }; </del> doCheck = false; }); })

py = python3.override { # Put packageOverrides at the start so they are applied after defaultOverrides <del> packageOverrides = lib.foldr lib.composeExtensions (self: super: { }) (defaultOverrides); </del> <ins> packageOverrides = lib.foldr lib.composeExtensions (self: super: { }) defaultOverrides; </ins> }; in

buildPythonApplication rec { pname = "archivy"; <del> version = "1.6.1"; </del> <ins> version = "1.7.1"; </ins> src = fetchPypi { inherit pname version; <del> sha256 = "sha256-nwpH3V6hkPC8G3df+0hTZqvIbvT1Z796uOI/iKnXS1w="; </del> <ins> sha256 = "sha256-UNGl5Dl/E3+uQ4HIxzHYliHF4lqD3GYdeoL+DtqUwCo="; </ins> }; # Relax some dependencies

--replace 'validators ==' 'validators >='  --replace 'tinydb ==' 'tinydb >='  --replace 'Flask_WTF == 0.14.3' 'Flask_WTF'  <del> --replace 'Werkzeug ==' 'Werkzeug >=' </del> <ins> --replace 'Flask ==' 'Flask >=' </ins> ''; propagatedBuildInputs = [

html2text python-dotenv python-frontmatter <ins> readability-lxml </ins> requests setuptools tinydb validators <del> werkzeug </del> wtforms ];

<ins> { lib , buildPythonPackage , fetchPypi , pytestCheckHook , chardet , cssselect , lxml }: buildPythonPackage rec { pname = "readability-lxml"; version = "0.8.1"; src = fetchPypi { inherit pname version; sha256 = "sha256-5R/qVrWQmq+IbTB9SOeeCWKTJVr6Vnt9CLypTSWxpOE="; }; propagatedBuildInputs = [ chardet cssselect lxml ]; postPatch = '' substituteInPlace setup.py --replace 'sys.platform == "darwin"' "False" ''; doCheck = false; meta = with lib; { description = "Fast python port of arc90's readability tool"; homepage = "https://github.com/buriy/python-readability"; license = licenses.apsl20; maintainers = with maintainers; [ siraben ]; }; } </ins>

re-assert = callPackage ../development/python-modules/re-assert { }; <ins> readability-lxml = callPackage ../development/python-modules/readability-lxml { }; </ins> readchar = callPackage ../development/python-modules/readchar { }; readlike = callPackage ../development/python-modules/readlike { };
Change:
, CVSSv3=5.9 (nixos-21.11, nixos-unstable) Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. To improve performance, the token is cached in memory in seaf-server. Upon receiving a token from sync client or SeaDrive client, the server checks whether the token exist in the cache. However, if the token exists in cache, the server doesn't check whether it's associated with the specific library in the URL. This vulnerability makes it possible to use any valid sync token to access data from any known library. Note that the attacker has to first find out the ID of a library which it has no access to. The library ID is a random UUID, which is not possible to be guessed. There are no workarounds for this issue. Scanned versions: nixos-21.11: ; nixos-unstable: . Cc Cc

Discussion:
{ stdenv, lib, fetchFromGitHub, pkg-config, python3, autoreconfHook , libuuid, sqlite, glib, libevent, libsearpc, openssl, fuse, libarchive, which <del> , vala, cmake, oniguruma }: </del> <ins> , vala, cmake, oniguruma, nixosTests }: </ins> let # seafile-server relies on a specific version of libevhtp.

}; in stdenv.mkDerivation rec { pname = "seafile-server"; <del> version = "8.0.7"; </del> <ins> version = "8.0.8"; </ins> src = fetchFromGitHub { owner = "haiwen"; repo = "seafile-server"; <del> rev = "27dac89bb3a81c5acc3f764ce92134eb357ea64b"; sha256 = "1h2hxvv0l5m9nbkdyjpznb7ddk8hb8hhwj8b2lx6aqbvp8gll9q7"; </del> <ins> rev = "807867afb7a86f526a6584278914ce9f3f51d1da"; sha256 = "1nq6dw4xzifbyhxn7yn5398q2sip1p1xwqz6xbis4nzgx4jldd4g"; </ins> }; nativeBuildInputs = [ autoreconfHook pkg-config ];

cp -r scripts/sql $out/share/seafile ''; <ins> passthru.tests = { inherit (nixosTests) seafile; }; </ins> meta = with lib; { description = "File syncing and sharing software with file encryption and group sharing, emphasis on reliability and high performance"; homepage = "https://github.com/haiwen/seafile-server";
Change:
The update to libgit2 in broke compilation of the version of libgit2-glib, and thus gitg. Try to build it from . NixOS on

Discussion:
# Autogenerated by maintainers/scripts/gnome.sh update fetchurl: { <del> name = "gitg-3.18.0"; </del> <ins> name = "gitg-3.20.0"; </ins> src = fetchurl { <del> url = mirror://gnome/sources/gitg/3.18/gitg-3.18.0.tar.xz; sha256 = "fa4b7b9c492f13f5f1d864af1281ea377ac8c7619c856e05f533b18989edf421"; </del> <ins> url = mirror://gnome/sources/gitg/3.20/gitg-3.20.0.tar.xz; sha256 = "1f09f61208349d003f228e51dc9709bd3426960f5585c0e38197bd02b51f3346"; </ins> }; }

# Autogenerated by maintainers/scripts/gnome.sh update fetchurl: { <del> name = "libgit2-glib-0.23.6"; </del> <ins> name = "libgit2-glib-0.24.0"; </ins> src = fetchurl { <del> url = mirror://gnome/sources/libgit2-glib/0.23/libgit2-glib-0.23.6.tar.xz; sha256 = "5c8d6b5cb81ab64b96cb0c52ef37463b6d8998a40ce77a08eda9db66fb781144"; </del> <ins> url = mirror://gnome/sources/libgit2-glib/0.24/libgit2-glib-0.24.0.tar.xz; sha256 = "d616c268821c28ff8dc1a6419dbf8555fa48e31dc6509c10f5151be7690f4845"; </ins> }; }
Change:
ttfautohint throws lots of c++ errors when building on macos This is on a 2021 M1 Max Macbook Pro Steps to reproduce the behavior: this nix-shell ++ errors will occur: It should not error Please run and paste the result.
Coincidentally, I've just filed
This does seem to fix it thankfully. Unfortunately until it is merged this means I'll have to build iosevka from source, which seems to take an age even on a powerful computer.
It looks like hasn't built for a while on darwin Hydra: because the build is too quiet. Perhaps, would work for you?

Discussion:
configureFlags = [ ''--with-qt=${if enableGUI then "${qtbase}/lib" else "no"}'' ]; <ins> # workaround https://github.com/NixOS/nixpkgs/issues/155458 preBuild = lib.optionalString stdenv.cc.isClang '' rm version ''; </ins> enableParallelBuilding = true; dontWrapQtApps = true;
Change:
Project description OpenSupaplex is a 1:1 reimplementation of the original game Supaplex in C and SDL, with just a few changes to make it easy to use with game controllers, and also easy to port to any platform. Metadata homepage URL: source URL: license: gpl3 platforms: linux, windows, macos
I've created a PR which adds it, see . Would you mind testing that?
Works for me.

Discussion:
<ins> { lib , stdenv , fetchFromGitHub , fetchurl , makeDesktopItem , copyDesktopItems , testVersion , opensupaplex , SDL2 , SDL2_mixer }: let # Doesn't seem to be included in tagged releases, but does exist on master. icon = fetchurl { url = "https://raw.githubusercontent.com/sergiou87/open-supaplex/b102548699cf16910b59559f689ecfad88d2a7d2/open-supaplex.svg"; sha256 = "sha256-nKeSBUGjSulbEP7xxc6smsfCRjyc/xsLykH0o3Rq5wo="; }; in stdenv.mkDerivation rec { pname = "opensupaplex"; version = "7.1.2"; src = fetchFromGitHub { owner = "sergiou87"; repo = "open-supaplex"; rev = "v${version}"; sha256 = "sha256-hP8dJlLXE5J/oxPhRkrrBl1Y5e9MYbJKi8OApFM3+GU="; }; nativeBuildInputs = [ SDL2 # For "sdl2-config" copyDesktopItems ]; buildInputs = [ SDL2_mixer ]; enableParallelBuilding = true; NIX_CFLAGS_COMPILE = [ "-DFILE_DATA_PATH=${placeholder "out"}/lib/opensupaplex" "-DFILE_FHS_XDG_DIRS" ]; preBuild = '' # Makefile is located in this directory pushd linux ''; postBuild = '' popd ''; installPhase = '' runHook preInstall mkdir -p $out/{bin,lib,share/icons/hicolor/scalable/apps} install -D ./linux/opensupaplex $out/bin/opensupaplex cp -R ./resources $out/lib/opensupaplex cp ${icon} $out/share/icons/hicolor/scalable/apps/open-supaplex.svg runHook postInstall ''; passthru.tests.version = testVersion { package = opensupaplex; command = "opensupaplex --help"; version = "v${version}"; }; desktopItems = [(makeDesktopItem { name = "opensupaplex"; exec = meta.mainProgram; icon = "open-supaplex"; desktopName = "OpenSupaplex"; comment = meta.description; categories = "Application;Game;"; })]; meta = with lib; { description = "A decompilation of Supaplex in C and SDL"; homepage = "https://github.com/sergiou87/open-supaplex"; changelog = "https://github.com/sergiou87/open-supaplex/blob/master/changelog/v${version}.txt"; license = licenses.gpl3Only; maintainers = [ maintainers.ivar ]; platforms = platforms.linux; # Many more are supported upstream, but only linux is tested. mainProgram = "opensupaplex"; }; } </ins>

opensubdiv = callPackage ../development/libraries/opensubdiv { }; <ins> opensupaplex = callPackage ../games/opensupaplex { }; </ins> open-wbo = callPackage ../applications/science/logic/open-wbo {}; openwsman = callPackage ../development/libraries/openwsman {};
Change:
when using: the resulting service is having multiple errors and does not work like intended: Steps to reproduce the behavior: No errors and the applications works adding: <!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. --
I am having the same issue. I have tried using the fix and it seems to work for me.
Prowlarr is (still) broken.
the recent breakage may be due to a different issue, see
I had some issue with prowlarr at one point, and this solved it: Might be the same problem, as I vaguely remember something about SSL, and this seemed to help (without needing to make prowlarr run under a "proper", non-dynamic user). dotnet seems to not like being unset (which I assume is what happens when running under ). Not sure why this does not happen with other *arr-s.
This is a good fix. It should be to the NixOS module.
Is this still an issue on current 22.11/nixos-unstable? I am willing to contribute the fix to the module, however: what I remember, I was never able to reproduce this consistently (prowlarr would fail on my server, but work on my personal workstation) 's a NixOS test for prowlarr and it passes, so it doesn't help us verify that the issue would be fixed by this.
It definitely does happen on nixos-unstable, though indeed inconsistently - I only this issue after my server's last monthly upgrade, though Prowlarr had been running just fine for months!
Got it. Feel free to create a PR, should be easy enough to add this to NixOS module. You should be able to test it with your server as well. Else, I'll do it sometime in the coming days hopefully :slightlysmilingface:
I reinstalled my machine and it worked perfectly. Not sure if this is still a valid issue.
still getting this issue
Got this issue after upgrading(haven't upgraded in a while).
Could you confirm that the option suggested in fixes your problems? If so, I will make a PR to include it in the module. Sorry I kind of forgot about this issue, since I've applied this fix in my configuration and did not encounter the problem afterwards.
Yes, including that line fixed the issues.
This is super hard to test, because it seems non deterministic. Please look additionally at:
On my phone rn so I can't test it, but does starting it before "network-" make it deterministically fail, by chance?

Discussion:
ExecStart = "${lib.getExe cfg.package} -nobrowser -data=/var/lib/prowlarr"; Restart = "on-failure"; }; <ins> environment.HOME = "/var/empty"; </ins> }; networking.firewall = mkIf cfg.openFirewall {
Change:
The nixos test for nextcloud fails on master (release-21.11 is fine, though). Steps to reproduce the behavior: The test runs through. Please run and paste the result.

Discussion:
services.mysql = { enable = true; <del> bind = "127.0.0.1"; </del> <ins> settings.mysqld = { bind-address = "127.0.0.1"; # FIXME(@Ma27) Nextcloud isn't compatible with mariadb 10.6, # this is a workaround. # See https://help.nextcloud.com/t/update-to-next-cloud-21-0-2-has-get-an-error/117028/22 innodb_read_only_compressed = 0; }; </ins> package = pkgs.mariadb; <del> # FIXME(@Ma27) Nextcloud isn't compatible with mariadb 10.6, # this is a workaround. # See https://help.nextcloud.com/t/update-to-next-cloud-21-0-2-has-get-an-error/117028/22 extraOptions = '' innodb_read_only_compressed=0 ''; </del> initialScript = pkgs.writeText "mysql-init" '' CREATE USER 'nextcloud'@'localhost' IDENTIFIED BY 'hunter2'; CREATE DATABASE IF NOT EXISTS nextcloud;
Change:
in secret management was redone for bookstack. Now I can't place a mail password as secret. It's also appended with : Please run and paste the result.
Oh, sorry about that. I can't see any obvious culprit in the code and I really don't know where came from. Can you paste the service script as it's been rendered? Can you paste a configuration that reproduces this?
Oh, I suppose this could happen if the mail password file path is a superset of the app key file path. Is that the case?
I've submitted a fix for you to test: . I hope it solves this issue.

Discussion:
else if isString v then v else if true  == v then "true" else if false == v then "false" <del> else if isSecret v then v._secret </del> <ins> else if isSecret v then hashString "sha256" v._secret </ins> else throw "unsupported type ${typeOf v}: ${(lib.generators.toPretty {}) v}"; }; }; secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.config); mkSecretReplacement = file: '' <del> replace-secret ${escapeShellArgs [ file file "${cfg.dataDir}/.env" ]} </del> <ins> replace-secret ${escapeShellArgs [ (builtins.hashString "sha256" file) file "${cfg.dataDir}/.env" ]} </ins> ''; secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths; filteredConfig = lib.converge (lib.filterAttrsRecursive (_: v: ! elem v [ {} null ])) cfg.config;
Change:
gnupg worked fine on 2.2.x; pinned nixpkgs-unstable to on my flake. Steps to reproduce the behavior: gnupg from current nixpkgs-unstable, e.g rev & the usual it break: When signing something, you should get pinentry asking you to insert the smartcard - re-plugging has no effect. & signing work etc. If applicable, add screenshots to help explain your problem. <details<summarygpg 2.3.x --version output</summary</details<details<summarygpg 2.2.x --version output</summary</details<!-- Please @ people who are in the list of the offending package or module. If in doubt, check for whoever last touched something. -- Please run and paste the result.
Adding to fixes smart card support.
Had to do this too. For anyone else finding this:
your fix worked for me. Thank you.
it seems that this has been fixed by . Feel free to reopen if not.
FYI issue was actually not about that error message (and its . However,  provided a fix for described smartcard support. I am still unsure why builtin CCID driver fails to handle smartcards now. This issue should stay open for further investigation.
Sorry for the misunderstanding.
This is still an issue for me with gpg 2.3.3. The line in workaround does work for me to get working, but it breaks commands (eg, ). I this snippet to remove the file and reload before invocations and put it back after. If there's more contents in it will not get recreated, so be wary of that if this snippet is used. It feels very hacky but I couldn't find a better way to get both and working at the same time.
You're probably missing udev rules or whatever the mac equivalent is. I covered this and provided lots of various working/non-working configurations, with/without "disable-ccid" when I did the gpg23 PR.
See: .
I'm facing this problem with gpg 2.3.7 on Darwin, and in doesn't fix it. After downgrading to 2.3.6 it works again (only with though). On 2.3.7, with the card does light up when I run , but then I get: Without , the card doesn't even light up (and output is the same).
I don't think this new issue is related to . I'm on Linux and works without issues (I don't have ), however when upgrading to it is broken. I don't get any errors/warnings when running . But the card is not properly recognized: 2.3.6 2.3.7 Edit, link other related issue:
This is the upstream bug in GPG:

Discussion:
"--with-ksba-prefix=${libksba.dev}" "--with-npth-prefix=${npth}" ] ++ lib.optional guiSupport "--with-pinentry-pgm=${pinentry}/${pinentryBinaryPath}" <del> ++ lib.optional withTpm2Tss "--with-tss=intel"; </del> <ins> ++ lib.optional withTpm2Tss "--with-tss=intel" ++ lib.optional stdenv.isDarwin "--disable-ccid-driver"; </ins> postInstall = if enableMinimal then '' rm -r $out/{libexec,sbin,share}
Change:
I tried running in a Drupal website. It returned the following error: This seems to have changed since PHP 7.4, and php73 has been dropped from nixpkgs due to the lack of upstream maintenance. It seems our in nixpkgs also is heavily outdated. We might want to switch to Drush 8, which still is supported and should work with D6, D7, D8, according to their docs.

Discussion:
stdenv.mkDerivation rec { pname = "drush"; <del> version = "6.1.0"; </del> <ins> version = "8.4.10"; </ins> <del> meta = with lib; { description = "Command-line shell and Unix scripting interface for Drupal"; homepage    = "https://github.com/drush-ops/drush"; license     = licenses.gpl2; maintainers = with maintainers; [ lovek323 ]; platforms   = platforms.all; </del> <ins> src = fetchurl { url = "https://github.com/drush-ops/drush/releases/download/${version}/drush.phar"; sha256 = "sha256-yXSoTDFLsjDiYkRfrIxv2WTVdHzgxZRvtn3Pht5XF4k="; </ins> }; <del> src = fetchFromGitHub { owner = "drush-ops"; repo  = pname; rev = version; sha256 = "sha256-0nf/m+xJmfHsFLuordiMp8UyrGGXuS70+zFHkIxLWhU="; }; consoleTable = fetchurl { url    = "http://download.pear.php.net/package/Console_Table-1.1.3.tgz"; sha256 = "07gbjd7m1fj5dmavr0z20vkqwx1cz2522sj9022p257jifj1yl76"; }; </del> <ins> dontUnpack = true; </ins> nativeBuildInputs = [ makeWrapper ]; installPhase = '' <del> # install libraries cd lib tar -xf ${consoleTable} cd .. mkdir -p "$out" cp -r . "$out/src" mkdir "$out/bin" wrapProgram "$out/src/drush" --prefix PATH : "${lib.makeBinPath [ which php bash coreutils ncurses ]}" ln -s "$out/src/drush" "$out/bin/drush" </del> <ins> mkdir -p $out/bin install -D $src $out/libexec/drush/drush.phar makeWrapper ${php}/bin/php $out/bin/drush  --add-flags "$out/libexec/drush/drush.phar"  --prefix PATH : "${lib.makeBinPath [ which php bash coreutils ncurses ]}" </ins> ''; <ins> meta = with lib; { description = "Command-line shell and Unix scripting interface for Drupal"; homepage = "https://github.com/drush-ops/drush"; license = licenses.gpl2; maintainers = with maintainers; [ lovek323 ]; platforms = platforms.all; }; </ins> }
Change:
Project description CrowdSec - the open-source and participative IPS able to analyze visitor behavior & provide an adapted response to all kinds of attacks. It also leverages the crowd power to generate a global CTI database to protect the user network. Metadata homepage URL: source URL: license: mit platforms: linux
I am head of community at CrowdSec. Feel free to get in touch if you need any assistance in creating packages for NixOS.
Fantastic! Thank you
No problem. Feel free to join our to ask for help from our community.
working on this
Hey any news on this ? I'd be interested in helping to package it as well or trying/testing the draft PR, but I don't know what's the current status (I've read your draft PR and it seems it was going okay, but you needed to add a NixOS module and some agents/bouncers?)

Discussion:
<ins> { lib, buildGoModule, fetchFromGitHub, installShellFiles }: buildGoModule rec { pname = "crowdsec"; version = "1.4.2"; src = fetchFromGitHub { owner = "crowdsecurity"; repo = pname; rev = "v${version}"; hash = "sha256-hL3+hTOuwcbxiVZeq9oZjfKI1TJJt64g+74NolA3Drc="; }; vendorHash = "sha256-FPsoufB9UDgBDIE3yUq4doBse3qgjP19ussYnMAxntk="; nativeBuildInputs = [ installShellFiles ]; subPackages = [ "cmd/crowdsec" "cmd/crowdsec-cli" ]; ldflags = [ "-s" "-w" "-X github.com/crowdsecurity/crowdsec/pkg/cwversion.Version=v${version}" "-X github.com/crowdsecurity/crowdsec/pkg/cwversion.BuildDate=1970-01-01_00:00:00" ]; postBuild = "mv $GOPATH/bin/{crowdsec-cli,cscli}"; postInstall = '' mkdir -p $out/share/crowdsec cp -r ./config $out/share/crowdsec/ installShellCompletion --cmd cscli  --bash <($out/bin/cscli completion bash)  --fish <($out/bin/cscli completion fish)  --zsh <($out/bin/cscli completion zsh) ''; meta = with lib; { homepage = "https://crowdsec.net/"; changelog = "https://github.com/crowdsecurity/crowdsec/releases/tag/v${version}"; description = "CrowdSec is a free, open-source and collaborative IPS"; longDescription = '' CrowdSec is a free, modern & collaborative behavior detection engine, coupled with a global IP reputation network. It stacks on fail2ban's philosophy but is IPV6 compatible and 60x faster (Go vs Python), uses Grok patterns to parse logs and YAML scenario to identify behaviors. CrowdSec is engineered for modern Cloud/Containers/VM based infrastructures (by decoupling detection and remediation). Once detected you can remedy threats with various bouncers (firewall block, nginx http 403, Captchas, etc.) while the aggressive IP can be sent to CrowdSec for curation before being shared among all users to further improve everyone's security. ''; license = licenses.mit; maintainers = with maintainers; [ jk urandom ]; }; } </ins>

crossplane = with python3Packages; toPythonApplication crossplane; <ins> crowdsec = callPackage ../tools/security/crowdsec { }; </ins> crunch = callPackage ../tools/security/crunch { }; crudini = callPackage ../tools/misc/crudini { };
Change:
After updating from to , my config no longer builds: Those two modules appear to by enabled by the of the I am importing but weirdly, neither of those seem to have changed: Run
Bisecting points to cc
Maybe this should be ?
This is great! Those were always in conflict, but one of them won, by luck of the order. You really don't want to have anything important depend on that, so I'm glad this was caught, although I wish the experience of catching it would be nicer. That line does feel like a default.
Hold on, it seems to be the other way around. That line should be a instead, to disable boot loader stuff for containers.
It's kind of the wrong way around, -ing stuff you don't need and then disabling it, but it's the best we can do without RFC22 / Minimal module list. I've opened and to work towards those goals with minimal impact on regular NixOS.
I would assume VPSAdminOS wants the boot loader even for containers if they are explicitly enabling the init scripts. cc
I don't fully understand all these changes, but yes, I would say that (and ) is needed when NixOS is in a container. I mean a container run e.g. by LXC, which is what we do on vpsAdminOS. We don't know what is inside the container and depend on it having . I think on would work.
I thought of the wrong kind of container. lgtm.
Opened

Discussion:
services.openssh.startWhenNeeded = mkDefault true; # Shut up warnings about not having a boot loader. <del> system.build.installBootLoader = "${pkgs.coreutils}/bin/true"; </del> <ins> system.build.installBootLoader = lib.mkDefault "${pkgs.coreutils}/bin/true"; </ins> # Not supported in systemd-nspawn containers. security.audit.enable = false;