Merge remote-tracking branch 'origin/2.28-maintenance' into mergify/bp/2.28-maintenance/pr-12869

doc/manual/rl-next/c-api-flake-init.md

@@ -1,20 +0,0 @@
----
-synopsis: C API `nix_flake_init_global` removed
-prs: 12759
-issues: 5638
----
-
-In order to improve the modularity of the code base, we are removing a use of global state, and therefore the `nix_flake_init_global` function.
-
-Instead, use `nix_flake_settings_add_to_eval_state_builder`. For example:
-
-```diff
--    nix_flake_init_global(ctx, settings);
--    HANDLE_ERROR(ctx);
--
-     nix_eval_state_builder * builder = nix_eval_state_builder_new(ctx, store);
-     HANDLE_ERROR(ctx);
- 
-+    nix_flake_settings_add_to_eval_state_builder(ctx, settings, builder);
-+    HANDLE_ERROR(ctx);
-```

doc/manual/source/SUMMARY.md.in

@@ -135,6 +135,7 @@
   - [Contributing](development/contributing.md)
 - [Releases](release-notes/index.md)
 {{#include ./SUMMARY-rl-next.md}}
+  - [Release 2.28 (2025-04-02)](release-notes/rl-2.28.md)
   - [Release 2.27 (2025-03-03)](release-notes/rl-2.27.md)
   - [Release 2.26 (2025-01-22)](release-notes/rl-2.26.md)
   - [Release 2.25 (2024-11-07)](release-notes/rl-2.25.md)

doc/manual/source/release-notes/rl-2.28.md

@@ -0,0 +1,105 @@
+# Release 2.28.0 (2025-04-02)
+
+This is an atypical release, and for almost all intents and purposes, it is just a continuation of 2.27; not a feature release.
+
+We had originally set the goal of making 2.27 the Nixpkgs default for NixOS 25.05, but dependents that link to Nix need certain _interface breaking_ changes in the C++ headers. This is not something we should do in a patch release, so this is why we branched 2.28 right off 2.27 instead of `master`.
+
+This completes the infrastructure overhaul for the [RFC 132](https://github.com/NixOS/rfcs/blob/master/rfcs/0132-meson-builds-nix.md) switchover to meson as our build system.
+
+## Major changes
+
+- Unstable C++ API reworked
+  [#12836](https://github.com/NixOS/nix/pull/12836)
+  [#12798](https://github.com/NixOS/nix/pull/12798)
+  [#12773](https://github.com/NixOS/nix/pull/12773)
+
+  Now the C++ interface confirms to common conventions much better than before:
+
+  - All headers are expected to be included with the initial `nix/`, e.g. as `#include "nix/....hh"` (what Nix's headers now do) or `#include <nix/....hh>` (what downstream projects may choose to do).
+    Likewise, the pkg-config files have `-I${includedir}` not `-I${includedir}/nix` or similar.
+
+    Including without the `nix/` like before sometimes worked because of how for `#include` C pre-process checks the directory containing the current file, not just the lookup path, but this was not reliable.
+
+  - All configuration headers are included explicitly by the (regular) headers that need them.
+    There is no more need to pass `-include` to force additional files to be included.
+
+  - The public, installed configuration headers no longer contain implementation-specific details that are not relevant to the API.
+    The vast majority of definitions that were previously in there are now moved to new headers that are not installed, but used during Nix's own compilation only.
+    The remaining macro definitions are renamed to have `NIX_` as a prefix.
+
+  - The name of the Nix component the header comes from
+    (e.g. `util`, `store`, `expr`, `flake`, etc.)
+    is now part of the path to the header, coming after `nix` and before the header name
+    (or rest of the header path, if it is already in a directory).
+
+  Here is a contrived diff showing a few of these changes at once:
+
+  ```diff
+  @@ @@
+  -#include "derived-path.hh"
+  +#include "nix/store/derived-path.hh"
+  @@ @@
+  +// Would include for the variables used before. But when other headers
+  +// need these variables. those will include these config themselves.
+  +#include "nix/store/config.hh"
+  +#include "nix/expr/config.hh"
+  @@ @@
+  -#include "config.hh"
+  +// Additionally renamed to distinguish from components' config headers.
+  +#include "nix/util/configuration.hh"
+  @@ @@
+  -#if HAVE_ACL_SUPPORT
+  +#if NIX_SUPPORT_ACL
+  @@ @@
+  -#if HAVE_BOEHMGC
+  +#if NIX_USE_BOEHMGC
+  @@ @@
+   #endif
+   #endif
+  @@ @@
+  -const char *s = "hi from " SYSTEM;
+  +const char *s = "hi from " NIX_LOCAL_SYSTEM;
+  ```
+
+- C API `nix_flake_init_global` removed [#5638](https://github.com/NixOS/nix/issues/5638) [#12759](https://github.com/NixOS/nix/pull/12759)
+
+  In order to improve the modularity of the code base, we are removing a use of global state, and therefore the `nix_flake_init_global` function.
+
+  Instead, use `nix_flake_settings_add_to_eval_state_builder`.
+  For example:
+
+  ```diff
+  -    nix_flake_init_global(ctx, settings);
+  -    HANDLE_ERROR(ctx);
+  -
+       nix_eval_state_builder * builder = nix_eval_state_builder_new(ctx, store);
+       HANDLE_ERROR(ctx);
+
+  +    nix_flake_settings_add_to_eval_state_builder(ctx, settings, builder);
+  +    HANDLE_ERROR(ctx);
+  ```
+
+  Although this change is not as critical, we figured it would be good to do this API change at the same time, also.
+  Also note that we try to keep the C API compatible, but we decided to break this function because it was young and likely not in widespread use yet. This frees up time to make important progress on the rest of the C API.
+
+# Contributors
+
+This earlier-than-usual release was made possible by the following 16 contributors:
+
+- Farid Zakaria [**(@fzakaria)**](https://github.com/fzakaria)
+- Jörg Thalheim [**(@Mic92)**](https://github.com/Mic92)
+- Eelco Dolstra [**(@edolstra)**](https://github.com/edolstra)
+- Graham Christensen [**(@grahamc)**](https://github.com/grahamc)
+- Thomas Miedema [**(@thomie)**](https://github.com/thomie)
+- Brian McKenna [**(@puffnfresh)**](https://github.com/puffnfresh)
+- Sergei Trofimovich [**(@trofi)**](https://github.com/trofi)
+- Dmitry Bogatov [**(@KAction)**](https://github.com/KAction)
+- Erik Nygren [**(@Kirens)**](https://github.com/Kirens)
+- John Ericson [**(@Ericson2314)**](https://github.com/Ericson2314)
+- Sergei Zimmerman [**(@xokdvium)**](https://github.com/xokdvium)
+- Ruby Rose [**(@oldshensheep)**](https://github.com/oldshensheep)
+- Robert Hensing [**(@roberth)**](https://github.com/roberth)
+- jade [**(@lf-)**](https://github.com/lf-)
+- Félix [**(@picnoir)**](https://github.com/picnoir)
+- Valentin Gagarin [**(@fricklerhandwerk)**](https://github.com/fricklerhandwerk)
+- Dmitry Bogatov

flake.nix

@@ -156,13 +156,7 @@
                   inherit officialRelease;
                   pkgs = final;
                   src = self;
-                  maintainers = with lib.maintainers; [
+                  maintainers = [ ];
-                    edolstra
-                    Ericson2314
-                    Mic92
-                    roberth
-                    tomberek
-                  ];
                 };
               };
 
@@ -177,7 +171,7 @@
               {
                 otherSplices = final.generateSplicesForMkScope "nixDependencies";
                 f = import ./packaging/dependencies.nix {
-                  inherit inputs stdenv;
+                  inherit stdenv;
                   pkgs = final;
                 };
               };

maintainers/data/release-credits-email-to-handle.json

@@ -145,5 +145,12 @@
     "thebenmachine+git@gmail.com": "bmillwood",
     "leandro@kip93.net": "kip93",
     "hello@briancamacho.me": "b-camacho",
-    "bcamacho@anduril.com": "bcamacho2"
+    "bcamacho@anduril.com": "bcamacho2",
+    "oldshensheep@gmail.com": "oldshensheep",
+    "thomasmiedema@gmail.com": "thomie",
+    "xokdvium@proton.me": "xokdvium",
+    "kaction@disroot.org": "KAction",
+    "serenity@kaction.cc": null,
+    "dev@erik.work": "Kirens",
+    "felix@alternativebit.fr": "picnoir"
 }

maintainers/data/release-credits-handle-to-name.json

@@ -129,5 +129,9 @@
     "SomeoneSerge": "Someone",
     "b-camacho": "Brian Camacho",
     "MaxHearnden": null,
-    "kip93": "Leandro Emmanuel Reina Kiperman"
+    "kip93": "Leandro Emmanuel Reina Kiperman",
+    "oldshensheep": "Ruby Rose",
+    "KAction": "Dmitry Bogatov",
+    "thomie": "Thomas Miedema",
+    "Kirens": "Erik Nygren"
 }

maintainers/release-credits

@@ -109,15 +109,15 @@ for sample in samples:
     s = samples[sample]
     email = s["email"]
     if not email in email_to_handle_cache.values:
-        print(f"Querying GitHub API for {s['hash']}, to get handle for {s['email']}")
+        print(f"Querying GitHub API for {s['hash']}, to get handle for {s['email']}", file=sys.stderr)
         ghc = get_github_commit(samples[sample])
         gha = ghc["author"]
         if gha and gha["login"]:
             handle = gha["login"]
-            print(f"Handle: {handle}")
+            print(f"Handle: {handle}", file=sys.stderr)
             email_to_handle_cache.values[email] = handle
         else:
-            print(f"Found no handle for {s['email']}")
+            print(f"Found no handle for {s['email']}", file=sys.stderr)
             email_to_handle_cache.values[email] = None
     handle = email_to_handle_cache.values[email]
     if handle is not None:

packaging/dependencies.nix

@@ -1,33 +1,14 @@
 # These overrides are applied to the dependencies of the Nix components.
 
 {
-  # Flake inputs; used for sources
-  inputs,
-
   # The raw Nixpkgs, not affected by this scope
   pkgs,
 
   stdenv,
 }:
 
-let
-  prevStdenv = stdenv;
-in
-
 let
   inherit (pkgs) lib;
-
-  stdenv = if prevStdenv.isDarwin && prevStdenv.isx86_64 then darwinStdenv else prevStdenv;
-
-  # Fix the following error with the default x86_64-darwin SDK:
-  #
-  #     error: aligned allocation function of type 'void *(std::size_t, std::align_val_t)' is only available on macOS 10.13 or newer
-  #
-  # Despite the use of the 10.13 deployment target here, the aligned
-  # allocation function Clang uses with this setting actually works
-  # all the way back to 10.6.
-  darwinStdenv = pkgs.overrideSDK prevStdenv { darwinMinVersion = "10.13"; };
-
 in
 scope: {
   inherit stdenv;
@@ -65,39 +46,37 @@ scope: {
         installPhase = lib.replaceStrings [ "--without-python" ] [ "" ] old.installPhase;
       });
 
-  libgit2 = pkgs.libgit2.overrideAttrs (
+  libgit2 =
-    attrs:
+    if lib.versionAtLeast pkgs.libgit2.version "1.9.0" then
-    {
+      pkgs.libgit2
-      cmakeFlags = attrs.cmakeFlags or [ ] ++ [ "-DUSE_SSH=exec" ];
+    else
-    }
+      pkgs.libgit2.overrideAttrs (attrs: {
-    # libgit2: Nixpkgs 24.11 has < 1.9.0, which needs our patches
+        # libgit2: Nixpkgs 24.11 has < 1.9.0, which needs our patches
-    // lib.optionalAttrs (!lib.versionAtLeast pkgs.libgit2.version "1.9.0") {
+        nativeBuildInputs =
-      nativeBuildInputs =
+          attrs.nativeBuildInputs or [ ]
-        attrs.nativeBuildInputs or [ ]
+          # gitMinimal does not build on Windows. See packbuilder patch.
-        # gitMinimal does not build on Windows. See packbuilder patch.
+          ++ lib.optionals (!stdenv.hostPlatform.isWindows) [
-        ++ lib.optionals (!stdenv.hostPlatform.isWindows) [
+            # Needed for `git apply`; see `prePatch`
-          # Needed for `git apply`; see `prePatch`
+            pkgs.buildPackages.gitMinimal
-          pkgs.buildPackages.gitMinimal
+          ];
-        ];
+        # Only `git apply` can handle git binary patches
-      # Only `git apply` can handle git binary patches
+        prePatch =
-      prePatch =
+          attrs.prePatch or ""
-        attrs.prePatch or ""
+          + lib.optionalString (!stdenv.hostPlatform.isWindows) ''
-        + lib.optionalString (!stdenv.hostPlatform.isWindows) ''
+            patch() {
-          patch() {
+              git apply
-            git apply
+            }
-          }
+          '';
-        '';
+        patches =
-      patches =
+          attrs.patches or [ ]
-        attrs.patches or [ ]
+          ++ [
-        ++ [
+            ./patches/libgit2-mempack-thin-packfile.patch
-          ./patches/libgit2-mempack-thin-packfile.patch
+          ]
-        ]
+          # gitMinimal does not build on Windows, but fortunately this patch only
-        # gitMinimal does not build on Windows, but fortunately this patch only
+          # impacts interruptibility
-        # impacts interruptibility
+          ++ lib.optionals (!stdenv.hostPlatform.isWindows) [
-        ++ lib.optionals (!stdenv.hostPlatform.isWindows) [
+            # binary patch; see `prePatch`
-          # binary patch; see `prePatch`
+            ./patches/libgit2-packbuilder-callback-interruptible.patch
-          ./patches/libgit2-packbuilder-callback-interruptible.patch
+          ];
-        ];
+      });
-    }
-  );
 }

src/libfetchers/git.cc

@@ -532,14 +532,20 @@ struct GitInputScheme : InputScheme
         return *head;
     }
 
-    static MakeNotAllowedError makeNotAllowedError(std::string url)
+    static MakeNotAllowedError makeNotAllowedError(std::filesystem::path repoPath)
     {
-        return [url{std::move(url)}](const CanonPath & path) -> RestrictedPathError
+        return [repoPath{std::move(repoPath)}](const CanonPath & path) -> RestrictedPathError {
-        {
+            if (nix::pathExists(repoPath / path.rel()))
-            if (nix::pathExists(path.abs()))
+                return RestrictedPathError(
-                return RestrictedPathError("access to path '%s' is forbidden because it is not under Git control; maybe you should 'git add' it to the repository '%s'?", path, url);
+                    "Path '%1%' in the repository %2% is not tracked by Git.\n"
+                    "\n"
+                    "To make it visible to Nix, run:\n"
+                    "\n"
+                    "git -C %2% add \"%1%\"",
+                    path.rel(),
+                    repoPath);
             else
-                return RestrictedPathError("path '%s' does not exist in Git repository '%s'", path, url);
+                return RestrictedPathError("Path '%s' does not exist in Git repository %s.", path.rel(), repoPath);
         };
     }
 
@@ -747,7 +753,7 @@ struct GitInputScheme : InputScheme
         ref<SourceAccessor> accessor =
             repo->getAccessor(repoInfo.workdirInfo,
                 exportIgnore,
-                makeNotAllowedError(repoInfo.locationToArg()));
+                makeNotAllowedError(repoPath));
 
         /* If the repo has submodules, return a mounted input accessor
            consisting of the accessor for the top-level repo and the