@jnsgruk Ah, we can use the patches from src: https://github.com/NixOS/nixpkgs/commit/8dcab583aca7658b6c38c2c58b71228377c899b8
Security software engineer @ Edgeless Systems | #nixpkgs maintainer
#infosec #golang #Nix #NixOS #ReproducibleBuilds #ConfidentialComputing #Virtualization
@jnsgruk Ah, we can use the patches from src: https://github.com/NixOS/nixpkgs/commit/8dcab583aca7658b6c38c2c58b71228377c899b8
@jnsgruk Here you are: https://github.com/katexochen/nixpkgs/commit/9e0003e0ec40f1731a4094bb2bda80ced4532be6
Might be nicer to use fetchpatch/fetchurl for the patches, but I think you can figure the rest out based on this. :)
@jnsgruk Yes, I'm struggling with this part too.
@jnsgruk I'm taking a look. :) I think I'd try to just remove go.work{,.sum} and work around it.
Ever got confused with GitHub actions job matrix composition when using includes, excludes and multiple dimensions? I wrote a small thing to help with that: https://katexochen.github.io/github-matrix-parser/
You can paste your workflow in and it will show all the matrix combinations that are generated. It will also warn about underspecified elements in your job list.
I just build `nix-eval-and-diff`, a small wapper around nix-diff that simplifies comparing NixOS system configurations without deploying them!
You can see it here: https://forkspace.net/leona/nixfiles/-/blob/main/packages/nix-eval-and-diff/default.nix
Are you ready for the 2026 Nix/NixOS sprint season?
Ocean Sprint will happen in April on Lanzarote, registration is open until 20th January:
https://oceansprint.org/
A great opportunity to meet people from the community, hack and swim with great weather!
Already in February, the first Aurora Sprint will be happening in Reykjavik, Island:
https://aurorasprint.com/
The sprint focuses on Nix for embedded linux systems.
I wrote on the Tweag Blog on a topic that's near and dear to my heart:
Making container image builds faster in Bazel.
https://www.tweag.io/blog/2025-12-18-rules_img/
The schedule for the Nix and NixOS devroom at FOSDEM 2026 is out!
https://fosdem.org/2026/schedule/track/nix-and-nixos/
There will be 18 talks from 20 speakers, including 10 lightning talks. We’re particularly glad to give a platform to so many smaller community projects and experience reports, and we’re looking forward to a great community get-together!
Lanzaboote hit Version 1.0.0 https://github.com/nix-community/lanzaboote/blob/v1.0.0/CHANGELOG.md
@agowa338 There is a ready to use index you can download instead of indexing yourself: https://github.com/nix-community/nix-index-database
Report of the first NixOS Plumbers Summit in Berlin was published:
https://discourse.nixos.org/t/report-the-first-nixos-plumbers-summit-in-berlin/73027
Pretty cool initiative!
@katexochen nobody noticed firewalld module was added :capoo_121:
@aleksana sorry, I actually had that on my list, but didn't know how to fit it in. :blobeyes:
And finally, two new boot options:
boot.kernel.sysfs: Allows setting of Kernels sysfs attributes.
boot.initrd.nix-store-veritysetup: Enables nix-store-veritysetup, a systemd generator to unlock the Nix Store as a dm-verity protected block device.
I'm really interested to hear from you! What are your favorite new features in NixOS 25.11? Anything happened in the last release cycle that you are particularly excited about? Let me know!
🧵/end
NixOS display manager modules now strictly use tty1, where many of them previously used tty7. Options to configure display managers' VT have been dropped. A configuration with a display manager enabled will not start getty@tty1.service, even if the system is forced to boot into multi-user.target instead of graphical.target.
This cause some issues for me using greetd with tuigreet where the systemd logs would clutter the tuigreet screen. Luckily, an option services.greetd.useTextGreeter was added to fix this.
Speaking about rewrites: nixos-rebuild-ng, a full rewrite of nixos-rebuild in Python, is enabled by default from this release. For 25.11, you can still opt out by setting system.rebuild.enableNg = false;. For the next major version of NixOS (26.05), that opt-out toggle will be removed.
Looking at the NixOS changelog for 25.11, here are some notable changes:
The ongoing work on interpreter-less NixOS has made some great progress:
nixos-init was added, a Rust-based bashless initialization system for systemd initrd. It can be enable via system.nixos-init.enable = true;.
The Perl implementation of the switch-to-configuration program was removed, all switchable systems now use the Rust rewrite. If you used system.switch.enableNg before, you must remove it from your configuration.