Paul Meyer

Security software engineer @ Edgeless Systems | #nixpkgs maintainer
#infosec #golang #Nix #NixOS #ReproducibleBuilds #ConfidentialComputing #Virtualization

2026-01-07

@jnsgruk Here you are: github.com/katexochen/nixpkgs/

Might be nicer to use fetchpatch/fetchurl for the patches, but I think you can figure the rest out based on this. :)

2026-01-07

@jnsgruk Yes, I'm struggling with this part too.

2026-01-07

@jnsgruk I'm taking a look. :) I think I'd try to just remove go.work{,.sum} and work around it.

2025-12-23

Ever got confused with GitHub actions job matrix composition when using includes, excludes and multiple dimensions? I wrote a small thing to help with that: katexochen.github.io/github-ma

You can paste your workflow in and it will show all the matrix combinations that are generated. It will also warn about underspecified elements in your job list.

#GitHub #actions #CI #CICD #github_actions

Paul Meyer boosted:
2025-12-23

I just build `nix-eval-and-diff`, a small wapper around nix-diff that simplifies comparing NixOS system configurations without deploying them!

You can see it here: forkspace.net/leona/nixfiles/-

One file in the system configuration of moka. I commented out 3 lines of the prometheus node-exporter configurationA screenshot of the "nix-eval-and-diff moka" command. You can see a nix-diff output where in red the now commented out line is highlighted.
2025-12-22

Are you ready for the 2026 Nix/NixOS sprint season?

Ocean Sprint will happen in April on Lanzarote, registration is open until 20th January:
oceansprint.org/
A great opportunity to meet people from the community, hack and swim with great weather!

Already in February, the first Aurora Sprint will be happening in Reykjavik, Island:
aurorasprint.com/
The sprint focuses on Nix for embedded linux systems.

#Nix #NixOS

Paul Meyer boosted:
malte :yayblob:malte@chaos.social
2025-12-19

I wrote on the Tweag Blog on a topic that's near and dear to my heart:
Making container image builds faster in Bazel.
tweag.io/blog/2025-12-18-rules

2025-12-16

The schedule for the Nix and NixOS devroom at FOSDEM 2026 is out!

fosdem.org/2026/schedule/track

There will be 18 talks from 20 speakers, including 10 lightning talks. We’re particularly glad to give a platform to so many smaller community projects and experience reports, and we’re looking forward to a great community get-together!

#Nix #NixOS #FOSDEM #FOSDEM2026

Paul Meyer boosted:
Juan C Nunojuancnuno
2025-12-11
2025-12-10

@agowa338 There is a ready to use index you can download instead of indexing yourself: github.com/nix-community/nix-i

2025-12-08

Report of the first NixOS Plumbers Summit in Berlin was published:
discourse.nixos.org/t/report-t

Pretty cool initiative!

#NixOS #nixpkgs

Paul Meyer boosted:
aIeksana :blobhaj_melty_crush:aleksana@bcom.moe
2025-12-02

@katexochen nobody noticed firewalld module was added :capoo_121:

2025-12-02

@aleksana sorry, I actually had that on my list, but didn't know how to fit it in. :blobeyes:

2025-12-01

And finally, two new boot options:

boot.kernel.sysfs: Allows setting of Kernels sysfs attributes.

boot.initrd.nix-store-veritysetup: Enables nix-store-veritysetup, a systemd generator to unlock the Nix Store as a dm-verity protected block device.

I'm really interested to hear from you! What are your favorite new features in NixOS 25.11? Anything happened in the last release cycle that you are particularly excited about? Let me know!

🧵/end

#NixOS #nixpkgs

2025-12-01

NixOS display manager modules now strictly use tty1, where many of them previously used tty7. Options to configure display managers' VT have been dropped. A configuration with a display manager enabled will not start getty@tty1.service, even if the system is forced to boot into multi-user.target instead of graphical.target.

This cause some issues for me using greetd with tuigreet where the systemd logs would clutter the tuigreet screen. Luckily, an option services.greetd.useTextGreeter was added to fix this.

#NixOS #nixpkgs

2025-12-01

Speaking about rewrites: nixos-rebuild-ng, a full rewrite of nixos-rebuild in Python, is enabled by default from this release. For 25.11, you can still opt out by setting system.rebuild.enableNg = false;. For the next major version of NixOS (26.05), that opt-out toggle will be removed.

#NixOS #nixpkgs

2025-12-01

Looking at the NixOS changelog for 25.11, here are some notable changes:

The ongoing work on interpreter-less NixOS has made some great progress:

nixos-init was added, a Rust-based bashless initialization system for systemd initrd. It can be enable via system.nixos-init.enable = true;.

The Perl implementation of the switch-to-configuration program was removed, all switchable systems now use the Rust rewrite. If you used system.switch.enableNg before, you must remove it from your configuration.

#NixOS #nixpkgs

2025-12-01

The format attribute on buildPythonPackage/buildPythonApplication is now mandatory.
Previously the default format used setuptools and called setup.py from the source tree. The modern alternative is to configure pyproject = true with build-system = [ setuptools ].

#NixOS #nixpkgs

Client Info

Server: https://mastodon.social
Version: 2025.07
Repository: https://github.com/cyevgeniy/lmst