Project import generated by Copybara.

GitOrigin-RevId: c4a0efdd5a728e20791b8d8d2f26f90ac228ee8d

third_party/nixpkgs/.git-blame-ignore-revs

@@ -28,6 +28,9 @@
 # nixos/modules/rename: Sort alphabetically
 1f71224fe86605ef4cd23ed327b3da7882dad382
 
+# manual: fix typos
+feddd5e7f8c6f8167b48a077fa2a5394dc008999
+
 # nixos: fix module paths in rename.nix
 d08ede042b74b8199dc748323768227b88efcf7c
 

third_party/nixpkgs/.github/CODEOWNERS

@@ -252,9 +252,8 @@
 
 # Go
 /doc/languages-frameworks/go.section.md @kalbasit @Mic92 @zowoq
+/pkgs/build-support/go @kalbasit @Mic92 @zowoq
 /pkgs/development/compilers/go @kalbasit @Mic92 @zowoq
-/pkgs/development/go-modules   @kalbasit @Mic92 @zowoq
-/pkgs/development/go-packages  @kalbasit @Mic92 @zowoq
 
 # GNOME
 /pkgs/desktops/gnome                              @jtojnar

third_party/nixpkgs/.github/labeler.yml

@@ -40,9 +40,8 @@
 
 "6.topic: golang":
   - doc/languages-frameworks/go.section.md
+  - pkgs/build-support/go/**/*
   - pkgs/development/compilers/go/**/*
-  - pkgs/development/go-modules/**/*
-  - pkgs/development/go-packages/**/*
 
 "6.topic: haskell":
   - doc/languages-frameworks/haskell.section.md

third_party/nixpkgs/.github/workflows/update-terraform-providers.yml

@@ -39,7 +39,7 @@ jobs:
 
             Check that all providers build with:
             ```
-            @ofborg build terraform-full
+            @ofborg build terraform.full
             ```
           branch: terraform-providers-update
           delete-branch: false

third_party/nixpkgs/doc/builders/fetchers.chapter.md

@@ -1,12 +1,51 @@
 # Fetchers {#chap-pkgs-fetchers}
 
-When using Nix, you will frequently need to download source code and other files from the internet. For this purpose, Nix provides the [_fixed output derivation_](https://nixos.org/manual/nix/stable/#fixed-output-drvs) feature and Nixpkgs provides various functions that implement the actual fetching from various protocols and services.
+Building software with Nix often requires downloading source code and other files from the internet.
+`nixpkgs` provides *fetchers* for different protocols and services. Fetchers are functions that simplify downloading files.
 
 ## Caveats
 
-Because fixed output derivations are _identified_ by their hash, a common mistake is to update a fetcher's URL or a version parameter, without updating the hash. **This will cause the old contents to be used.** So remember to always invalidate the hash argument.
+Fetchers create [fixed output derivations](https://nixos.org/manual/nix/stable/#fixed-output-drvs) from downloaded files.
+Nix can reuse the downloaded files via the hash of the resulting derivation.
 
-For those who develop and maintain fetchers, a similar problem arises with changes to the implementation of a fetcher. These may cause a fixed output derivation to fail, but won't normally be caught by tests because the supposed output is already in the store or cache. For the purpose of testing, you can use a trick that is embodied by the [`invalidateFetcherByDrvHash`](#tester-invalidateFetcherByDrvHash) function. It uses the derivation `name` to create a unique output path per fetcher implementation, defeating the caching precisely where it would be harmful.
+The fact that the hash belongs to the Nix derivation output and not the file itself can lead to confusion.
+For example, consider the following fetcher:
+
+```nix
+fetchurl {
+  url = "http://www.example.org/hello-1.0.tar.gz";
+  sha256 = "0v6r3wwnsk5pdjr188nip3pjgn1jrn5pc5ajpcfy6had6b3v4dwm";
+};
+```
+
+A common mistake is to update a fetcher’s URL, or a version parameter, without updating the hash.
+
+```nix
+fetchurl {
+  url = "http://www.example.org/hello-1.1.tar.gz";
+  sha256 = "0v6r3wwnsk5pdjr188nip3pjgn1jrn5pc5ajpcfy6had6b3v4dwm";
+};
+```
+
+**This will reuse the old contents**.
+Remember to invalidate the hash argument, in this case by setting the `sha256` attribute to an empty string.
+
+```nix
+fetchurl {
+  url = "http://www.example.org/hello-1.1.tar.gz";
+  sha256 = "";
+};
+```
+
+Use the resulting error message to determine the correct hash.
+
+```
+error: hash mismatch in fixed-output derivation '/path/to/my.drv':
+         specified: sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
+            got:    sha256-RApQUm78dswhBLC/rfU9y0u6pSAzHceIJqgmetRD24E=
+```
+
+A similar problem arises while testing changes to a fetcher's implementation. If the output of the derivation already exists in the Nix store, test failures can go undetected. The [`invalidateFetcherByDrvHash`](#tester-invalidateFetcherByDrvHash) function helps prevent reusing cached derivations.
 
 ## `fetchurl` and `fetchzip` {#fetchurl}
 

third_party/nixpkgs/doc/builders/images/dockertools.section.md

@@ -321,3 +321,32 @@ buildImage {
 ```
 
 Creating base files like `/etc/passwd` or `/etc/login.defs` is necessary for shadow-utils to manipulate users and groups.
+
+## fakeNss {#ssec-pkgs-dockerTools-fakeNss}
+
+If your primary goal is providing a basic skeleton for user lookups to work,
+and/or a lesser privileged user, adding `pkgs.fakeNss` to
+the container image root might be the better choice than a custom script
+running `useradd` and friends.
+
+It provides a `/etc/passwd` and `/etc/group`, containing `root` and `nobody`
+users and groups.
+
+It also provides a `/etc/nsswitch.conf`, configuring NSS host resolution to
+first check `/etc/hosts`, before checking DNS, as the default in the absence of
+a config file (`dns [!UNAVAIL=return] files`) is quite unexpected.
+
+You can pair it with `binSh`, which provides `bin/sh` as a symlink
+to `bashInteractive` (as `/bin/sh` is configured as a shell).
+
+```nix
+buildImage {
+  name = "shadow-basic";
+
+  copyToRoot = pkgs.buildEnv {
+    name = "image-root";
+    paths = [ binSh pkgs.fakeNss ];
+    pathsToLink = [ "/bin" "/etc" "/var" ];
+  };
+}
+```

third_party/nixpkgs/doc/builders/packages/unfree.xml

@@ -1,13 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xml:id="unfree-software">
- <title>Unfree software</title>
-
- <para>
-  All users of Nixpkgs are free software users, and many users (and developers) of Nixpkgs want to limit and tightly control their exposure to unfree software. At the same time, many users need (or want) to run some specific pieces of proprietary software. Nixpkgs includes some expressions for unfree software packages. By default unfree software cannot be installed and doesn’t show up in searches. To allow installing unfree software in a single Nix invocation one can export <literal>NIXPKGS_ALLOW_UNFREE=1</literal>. For a persistent solution, users can set <literal>allowUnfree</literal> in the Nixpkgs configuration.
- </para>
-
- <para>
-  Fine-grained control is possible by defining <literal>allowUnfreePredicate</literal> function in config; it takes the <literal>mkDerivation</literal> parameter attrset and returns <literal>true</literal> for unfree packages that should be allowed.
- </para>
-</section>

third_party/nixpkgs/doc/contributing/coding-conventions.chapter.md

@@ -453,7 +453,7 @@ In the file `pkgs/top-level/all-packages.nix` you can find fetch helpers, these
   }
   ```
 
-  Find the value to put as `sha256` by running `nix run -f '<nixpkgs>' nix-prefetch-github -c nix-prefetch-github --rev 1f795f9f44607cc5bec70d1300150bfefcef2aae NixOS nix` or `nix-prefetch-url --unpack https://github.com/NixOS/nix/archive/1f795f9f44607cc5bec70d1300150bfefcef2aae.tar.gz`.
+Find the value to put as `sha256` by running `nix-shell -p nix-prefetch-github --run "nix-prefetch-github --rev 1f795f9f44607cc5bec70d1300150bfefcef2aae NixOS nix"`. 
 
 ## Obtaining source hash {#sec-source-hashes}
 

third_party/nixpkgs/doc/contributing/submitting-changes.chapter.md

@@ -167,24 +167,30 @@ Packages with automated tests are much more likely to be merged in a timely fash
 
 ### Tested compilation of all pkgs that depend on this change using `nixpkgs-review` {#submitting-changes-tested-compilation}
 
-If you are updating a package’s version, you can use nixpkgs-review to make sure all packages that depend on the updated package still compile correctly. The `nixpkgs-review` utility can look for and build all dependencies either based on uncommited changes with the `wip` option or specifying a github pull request number.
+If you are updating a package’s version, you can use `nixpkgs-review` to make sure all packages that depend on the updated package still compile correctly. The `nixpkgs-review` utility can look for and build all dependencies either based on uncommitted changes with the `wip` option or specifying a GitHub pull request number.
 
-review changes from pull request number 12345:
+Review changes from pull request number 12345:
 
 ```ShellSession
-nix run nixpkgs.nixpkgs-review -c nixpkgs-review pr 12345
+nix-shell -p nixpkgs-review --run "nixpkgs-review pr 12345"
 ```
 
-review uncommitted changes:
+Alternatively, with flakes (and analogously for the other commands below):
 
 ```ShellSession
-nix run nixpkgs.nixpkgs-review -c nixpkgs-review wip
+nix run nixpkgs#nixpkgs-review -- pr 12345
 ```
 
-review changes from last commit:
+Review uncommitted changes:
 
 ```ShellSession
-nix run nixpkgs.nixpkgs-review -c nixpkgs-review rev HEAD
+nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
+```
+
+Review changes from last commit:
+
+```ShellSession
+nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"
 ```
 
 ### Tested execution of all binary files (usually in `./result/bin/`) {#submitting-changes-tested-execution}

third_party/nixpkgs/doc/doc-support/parameters.xml

@@ -11,4 +11,5 @@
  <xsl:param name="toc.section.depth" select="0" />
  <xsl:param name="admon.style" select="''" />
  <xsl:param name="callout.graphics.extension" select="'.svg'" />
+ <xsl:param name="generate.consistent.ids" select="1" />
 </xsl:stylesheet>

third_party/nixpkgs/doc/languages-frameworks/dotnet.section.md

@@ -87,6 +87,7 @@ To package Dotnet applications, you can use `buildDotnetModule`. This has simila
 * `executables` is used to specify which executables get wrapped to `$out/bin`, relative to `$out/lib/$pname`. If this is unset, all executables generated will get installed. If you do not want to install any, set this to `[]`. This gets done in the `preFixup` phase.
 * `runtimeDeps` is used to wrap libraries into `LD_LIBRARY_PATH`. This is how dotnet usually handles runtime dependencies.
 * `buildType` is used to change the type of build. Possible values are `Release`, `Debug`, etc. By default, this is set to `Release`.
+* `selfContainedBuild` allows to enable the [self-contained](https://docs.microsoft.com/en-us/dotnet/core/deploying/#publish-self-contained) build flag. By default, it is set to false and generated applications have a dependency on the selected dotnet runtime. If enabled, the dotnet runtime is bundled into the executable and the built app has no dependency on Dotnet.
 * `dotnet-sdk` is useful in cases where you need to change what dotnet SDK is being used.
 * `dotnet-runtime` is useful in cases where you need to change what dotnet runtime is being used. This can be either a regular dotnet runtime, or an aspnetcore.
 * `dotnet-test-sdk` is useful in cases where unit tests expect a different dotnet SDK. By default, this is set to the `dotnet-sdk` attribute.

third_party/nixpkgs/doc/languages-frameworks/go.section.md

@@ -11,8 +11,8 @@ The function `buildGoModule` builds Go programs managed with Go modules. It buil
 
 In the following is an example expression using `buildGoModule`, the following arguments are of special significance to the function:
 
-- `vendorSha256`: is the hash of the output of the intermediate fetcher derivation. `vendorSha256` can also take `null` as an input. When `null` is used as a value, rather than fetching the dependencies and vendoring them, we use the vendoring included within the source repo. If you'd like to not have to update this field on dependency changes, run `go mod vendor` in your source repo and set `vendorSha256 = null;`
+- `vendorHash`: is the hash of the output of the intermediate fetcher derivation. `vendorHash` can also take `null` as an input. When `null` is used as a value, rather than fetching the dependencies and vendoring them, we use the vendoring included within the source repo. If you'd like to not have to update this field on dependency changes, run `go mod vendor` in your source repo and set `vendorHash = null;`
-- `proxyVendor`: Fetches (go mod download) and proxies the vendor directory. This is useful if your code depends on c code and go mod tidy does not include the needed sources to build or if any dependency has case-insensitive conflicts which will produce platform dependant `vendorSha256` checksums.
+- `proxyVendor`: Fetches (go mod download) and proxies the vendor directory. This is useful if your code depends on c code and go mod tidy does not include the needed sources to build or if any dependency has case-insensitive conflicts which will produce platform dependant `vendorHash` checksums.
 
 ```nix
 pet = buildGoModule rec {
@@ -26,7 +26,7 @@ pet = buildGoModule rec {
     sha256 = "0m2fzpqxk7hrbxsgqplkg7h2p7gv6s1miymv3gvw0cz039skag0s";
   };
 
-  vendorSha256 = "1879j77k96684wi554rkjxydrj8g3hpp0kvxz03sd8dmwr3lh83j";
+  vendorHash = "sha256-ciBIR+a1oaYH+H1PcC8cD8ncfJczk1IiJ8iYNM+R6aA=";
 
   meta = with lib; {
     description = "Simple command-line snippet manager, written in Go";

third_party/nixpkgs/doc/languages-frameworks/javascript.section.md

@@ -180,18 +180,27 @@ See `node2nix` [docs](https://github.com/svanderburg/node2nix) for more info.
 
 #### Preparation {#javascript-yarn2nix-preparation}
 
-You will need at least a yarn.lock and yarn.nix file.
+You will need at least a `yarn.lock` file. If upstream does not have one you need to generate it and reference it in your package definition.
 
-- Generate a yarn.lock in upstream if it is not already there.
+If the downloaded files contain the `package.json` and `yarn.lock` files they can be used like this:
-- `yarn2nix > yarn.nix` will generate the dependencies in a Nix format.
+
+```nix
+offlineCache = fetchYarnDeps {
+  yarnLock = src + "/yarn.lock";
+  sha256 = "....";
+};
+```
 
 #### mkYarnPackage {#javascript-yarn2nix-mkYarnPackage}
 
-This will by default try to generate a binary. For package only generating static assets (Svelte, Vue, React...), you will need to explicitly override the build step with your instructions. It's important to use the `--offline` flag. For example if you script is `"build": "something"` in package.json use:
+`mkYarnPackage` will by default try to generate a binary. For package only generating static assets (Svelte, Vue, React, WebPack, ...), you will need to explicitly override the build step with your instructions.
+
+It's important to use the `--offline` flag. For example if you script is `"build": "something"` in `package.json` use:
 
 ```nix
 buildPhase = ''
-  yarn build --offline
+  export HOME=$(mktemp -d)
+  yarn --offline build
 '';
 ```
 
@@ -201,15 +210,27 @@ The dist phase is also trying to build a binary, the only way to override it is
 distPhase = "true";
 ```
 
-The configure phase can sometimes fail because it tries to be too clever. One common override is:
+The configure phase can sometimes fail because it makes many assumptions which may not always apply. One common override is:
 
 ```nix
-configurePhase = "ln -s $node_modules node_modules";
+configurePhase = ''
+  ln -s $node_modules node_modules
+'';
+```
+
+or if you need a writeable node_modules directory:
+
+```nix
+configurePhase = ''
+  cp -r $node_modules node_modules
+  chmod +w node_modules
+'';
 ```
 
 #### mkYarnModules {#javascript-yarn2nix-mkYarnModules}
 
-This will generate a derivation including the node_modules. If you have to build a derivation for an integrated web framework (rails, phoenix..), this is probably the easiest way. [Plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/web-apps/plausible/default.nix#L39) offers a good example of how to do this.
+This will generate a derivation including the `node_modules` directory.
+If you have to build a derivation for an integrated web framework (rails, phoenix..), this is probably the easiest way.
 
 #### Overriding dependency behavior
 

third_party/nixpkgs/doc/languages-frameworks/maven.section.md

@@ -233,7 +233,8 @@ in stdenv.mkDerivation rec {
 
   src = builtins.fetchTarball
     "https://github.com/fzakaria/nixos-maven-example/archive/main.tar.gz";
-  buildInputs = [ maven makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ maven ];
 
   buildPhase = ''
     echo "Using repository ${repository}"
@@ -310,7 +311,8 @@ in stdenv.mkDerivation rec {
 
   src = builtins.fetchTarball
     "https://github.com/fzakaria/nixos-maven-example/archive/main.tar.gz";
-  buildInputs = [ maven makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ maven ];
 
   buildPhase = ''
     echo "Using repository ${repository}"

third_party/nixpkgs/doc/languages-frameworks/python.section.md

@@ -1664,6 +1664,26 @@ self: super: {
 }
 ```
 
+### How to override a Python package for all Python versions using extensions? {#how-to-override-a-python-package-for-all-python-versions-using-extensions}
+
+The following overlay overrides the call to `buildPythonPackage` for the
+`foo` package for all interpreters by appending a Python extension to the
+`pythonPackagesExtensions` list of extensions.
+
+```nix
+final: prev: {
+  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+    (
+      python-final: python-prev: {
+        foo = python-prev.foo.overridePythonAttrs (oldAttrs: {
+          ...
+        });
+      }
+    )
+  ];
+}
+```
+
 ### How to use Intel’s MKL with numpy and scipy? {#how-to-use-intels-mkl-with-numpy-and-scipy}
 
 MKL can be configured using an overlay. See the section "[Using overlays to

third_party/nixpkgs/doc/languages-frameworks/ruby.section.md

@@ -274,7 +274,7 @@ bundlerApp {
   gemdir = ./.;
   exes = [ "r10k" ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
     wrapProgram $out/bin/r10k --prefix PATH : ${lib.makeBinPath [ git gnutar gzip ]}

third_party/nixpkgs/doc/stdenv/cross-compilation.chapter.md

@@ -155,14 +155,14 @@ doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
 
 #### Package using Meson needs to run binaries for the host platform during build. {#cross-meson-runs-host-code}
 
-Add `mesonEmulatorHook` cross conditionally to `nativeBuildInputs`.
+Add `mesonEmulatorHook` to `nativeBuildInputs` conditionally on if the target binaries can be executed.
 
 e.g.
 
 ```
 nativeBuildInputs = [
   meson
-] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
   mesonEmulatorHook
 ];
 ```

third_party/nixpkgs/doc/stdenv/stdenv.chapter.md

@@ -317,7 +317,7 @@ The script will be usually run from the root of the Nixpkgs repository but you s
 
 For information about how to run the updates, execute `nix-shell maintainers/scripts/update.nix`.
 
-### Recursive attributes in `mkDerivation`
+### Recursive attributes in `mkDerivation` {#mkderivation-recursive-attributes}
 
 If you pass a function to `mkDerivation`, it will receive as its argument the final arguments, including the overrides when reinvoked via `overrideAttrs`. For example:
 
@@ -731,6 +731,10 @@ If set, files in `$out/sbin` are not moved to `$out/bin`. By default, they are.
 
 List of directories to search for libraries and executables from which *all* symbols should be stripped. By default, it’s empty. Stripping all symbols is risky, since it may remove not just debug symbols but also ELF information necessary for normal execution.
 
+##### `stripAllListTarget` {#var-stdenv-stripAllListTarget}
+
+Like `stripAllList`, but only applies to packages’ target platform. By default, it’s empty. Useful when supporting cross compilation.
+
 ##### `stripAllFlags` {#var-stdenv-stripAllFlags}
 
 Flags passed to the `strip` command applied to the files in the directories listed in `stripAllList`. Defaults to `-s` (i.e. `--strip-all`).
@@ -739,6 +743,10 @@ Flags passed to the `strip` command applied to the files in the directories list
 
 List of directories to search for libraries and executables from which only debugging-related symbols should be stripped. It defaults to `lib lib32 lib64 libexec bin sbin`.
 
+##### `stripDebugListTarget` {#var-stdenv-stripDebugListTarget}
+
+Like `stripDebugList`, but only applies to packages’ target platform. By default, it’s empty. Useful when supporting cross compilation.
+
 ##### `stripDebugFlags` {#var-stdenv-stripDebugFlags}
 
 Flags passed to the `strip` command applied to the files in the directories listed in `stripDebugList`. Defaults to `-S` (i.e. `--strip-debug`).
@@ -913,9 +921,9 @@ substitute ./foo.in ./foo.out \
     --subst-var someVar
 ```
 
-### `substituteInPlace` \<file\> \<subs\> {#fun-substituteInPlace}
+### `substituteInPlace` \<multiple files\> \<subs\> {#fun-substituteInPlace}
 
-Like `substitute`, but performs the substitutions in place on the file \<file\>.
+Like `substitute`, but performs the substitutions in place on the files passed.
 
 ### `substituteAll` \<infile\> \<outfile\> {#fun-substituteAll}
 

third_party/nixpkgs/doc/using/configuration.chapter.md

@@ -77,6 +77,11 @@ The difference between a package being unsupported on some system and being brok
 
 ## Installing unfree packages {#sec-allow-unfree}
 
+All users of Nixpkgs are free software users, and many users (and developers) of Nixpkgs want to limit and tightly control their exposure to unfree software.
+At the same time, many users need (or want) to run some specific pieces of proprietary software.
+Nixpkgs includes some expressions for unfree software packages.
+By default unfree software cannot be installed and doesn’t show up in searches.
+
 There are several ways to tweak how Nix handles a package which has been marked as unfree.
 
 -   To temporarily allow all unfree packages, you can use an environment variable for a single invocation of the nix tools:

third_party/nixpkgs/flake.nix

@@ -20,13 +20,20 @@
         nixos = import ./nixos/lib { lib = final; };
 
         nixosSystem = args:
-          import ./nixos/lib/eval-config.nix (args // {
+          import ./nixos/lib/eval-config.nix (
-            modules = args.modules ++ [ {
+            args // {
-              system.nixos.versionSuffix =
+              modules = args.modules ++ [{
-                ".${final.substring 0 8 (self.lastModifiedDate or self.lastModified or "19700101")}.${self.shortRev or "dirty"}";
+                system.nixos.versionSuffix =
-              system.nixos.revision = final.mkIf (self ? rev) self.rev;
+                  ".${final.substring 0 8 (self.lastModifiedDate or self.lastModified or "19700101")}.${self.shortRev or "dirty"}";
-            } ];
+                system.nixos.revision = final.mkIf (self ? rev) self.rev;
-          });
+              }];
+            } // lib.optionalAttrs (! args?system) {
+              # Allow system to be set modularly in nixpkgs.system.
+              # We set it to null, to remove the "legacy" entrypoint's
+              # non-hermetic default.
+              system = null;
+            }
+          );
       });
 
       checks.x86_64-linux.tarball = jobs.tarball;

third_party/nixpkgs/lib/licenses.nix

@@ -520,6 +520,13 @@ in mkLicense lset) ({
     free = false;
   };
 
+  databricks-dbx = {
+    fullName = "DataBricks eXtensions aka dbx License";
+    url = "https://github.com/databrickslabs/dbx/blob/743b579a4ac44531f764c6e522dbe5a81a7dc0e4/LICENSE";
+    free = false;
+    redistributable = false;
+  };
+
   issl = {
     fullName = "Intel Simplified Software License";
     url = "https://software.intel.com/en-us/license/intel-simplified-software-license";

third_party/nixpkgs/lib/modules.nix

@@ -266,6 +266,15 @@ rec {
               turned off.
             '';
           };
+
+          _module.specialArgs = mkOption {
+            readOnly = true;
+            internal = true;
+            description = ''
+              Externally provided module arguments that can't be modified from
+              within a configuration, but can be used in module imports.
+            '';
+          };
         };
 
         config = {
@@ -273,6 +282,7 @@ rec {
             inherit extendModules;
             moduleType = type;
           };
+          _module.specialArgs = specialArgs;
         };
       };
 

third_party/nixpkgs/lib/options.nix

@@ -121,7 +121,7 @@ rec {
      Example:
        mkPackageOption pkgs "GHC" {
          default = [ "ghc" ];
-         example = "pkgs.haskell.package.ghc923.ghc.withPackages (hkgs: [ hkgs.primes ])";
+         example = "pkgs.haskell.packages.ghc924.ghc.withPackages (hkgs: [ hkgs.primes ])";
        }
        => { _type = "option"; default = «derivation /nix/store/jxx55cxsjrf8kyh3fp2ya17q99w7541r-ghc-8.10.7.drv»; defaultText = { ... }; description = "The GHC package to use."; example = { ... }; type = { ... }; }
   */

third_party/nixpkgs/lib/systems/default.nix

@@ -16,9 +16,6 @@ rec {
   */
   flakeExposed = import ./flake-systems.nix { };
 
-  # TODO(@sternenseemann): remove before 21.11
-  supported = throw "2022-05-23: Use lib.systems.flakeExposed instead of lib.systems.supported.hydra, as lib.systems.supported has been removed";
-
   # Elaborate a `localSystem` or `crossSystem` so that it contains everything
   # necessary.
   #

third_party/nixpkgs/lib/systems/inspect.nix

@@ -16,6 +16,7 @@ rec {
     isx86          = { cpu = { family = "x86"; }; };
     isAarch32      = { cpu = { family = "arm"; bits = 32; }; };
     isAarch64      = { cpu = { family = "arm"; bits = 64; }; };
+    isAarch        = { cpu = { family = "arm"; }; };
     isMips         = { cpu = { family = "mips"; }; };
     isMips32       = { cpu = { family = "mips"; bits = 32; }; };
     isMips64       = { cpu = { family = "mips"; bits = 64; }; };

third_party/nixpkgs/lib/systems/platforms.nix

@@ -483,8 +483,8 @@ rec {
   };
 
   # can execute on 32bit chip
-  gcc_mips32r2_o32 = { gcc = { arch = "mips32r2"; abi = "o32"; }; };
+  gcc_mips32r2_o32 = { gcc = { arch = "mips32r2"; abi =  "32"; }; };
-  gcc_mips32r6_o32 = { gcc = { arch = "mips32r6"; abi = "o32"; }; };
+  gcc_mips32r6_o32 = { gcc = { arch = "mips32r6"; abi =  "32"; }; };
   gcc_mips64r2_n32 = { gcc = { arch = "mips64r2"; abi = "n32"; }; };
   gcc_mips64r6_n32 = { gcc = { arch = "mips64r6"; abi = "n32"; }; };
   gcc_mips64r2_64  = { gcc = { arch = "mips64r2"; abi =  "64"; }; };

third_party/nixpkgs/lib/types.nix

@@ -55,6 +55,7 @@ let
     concatMapStringsSep
     concatStringsSep
     escapeNixString
+    hasInfix
     isCoercibleToString
     ;
   inherit (lib.trivial)
@@ -360,6 +361,11 @@ rec {
       deprecationMessage = "See https://github.com/NixOS/nixpkgs/pull/66346 for better alternative types.";
     };
 
+    passwdEntry = entryType: addCheck entryType (str: !(hasInfix ":" str || hasInfix "\n" str)) // {
+      name = "passwdEntry ${entryType.name}";
+      description = "${entryType.description}, not containing newlines or colons";
+    };
+
     attrs = mkOptionType {
       name = "attrs";
       description = "attribute set";

third_party/nixpkgs/maintainers/maintainer-list.nix

@@ -683,6 +683,13 @@
     githubId = 2626481;
     name = "Ambroz Bizjak";
   };
+  amesgen = {
+    email = "amesgen@amesgen.de";
+    github = "amesgen";
+    githubId = 15369874;
+    name = "Alexander Esgen";
+    matrix = "@amesgen:amesgen.de";
+  };
   ametrine = {
     name = "Matilde Ametrine";
     email = "matilde@diffyq.xyz";
@@ -845,6 +852,16 @@
     githubId = 11699655;
     name = "Stanislas Lange";
   };
+  AngryAnt = {
+    name = "Emil Johansen";
+    email = "git@eej.dk";
+    matrix = "@angryant:envs.net";
+    github = "AngryAnt";
+    githubId = 102513;
+    keys = [{
+      fingerprint = "B7B7 582E 564E 789B FCB8  71AB 0C6D FE2F B234 534A";
+    }];
+  };
   anhdle14 = {
     name = "Le Anh Duc";
     email = "anhdle14@icloud.com";
@@ -913,6 +930,15 @@
     name = "Anselm Schüler";
     matrix = "@schuelermine:matrix.org";
   };
+  anthonyroussel = {
+    email = "anthony@roussel.dev";
+    github = "anthonyroussel";
+    githubId = 220084;
+    name = "Anthony Roussel";
+    keys = [{
+      fingerprint = "472D 368A F107 F443 F3A5  C712 9DC4 987B 1A55 E75E";
+    }];
+  };
   antoinerg = {
     email = "roygobeil.antoine@gmail.com";
     github = "antoinerg";
@@ -1247,6 +1273,12 @@
     githubId = 1217745;
     name = "Aldwin Vlasblom";
   };
+  aveltras = {
+    email = "romain.viallard@outlook.fr";
+    github = "aveltras";
+    githubId = 790607;
+    name = "Romain Viallard";
+  };
   avery = {
     email = "averyl+nixos@protonmail.com";
     github = "AveryLychee";
@@ -2288,6 +2320,12 @@
     githubId = 811527;
     name = "Christopher Jefferson";
   };
+  chrispattison = {
+    email = "chpattison@gmail.com";
+    github = "ChrisPattison";
+    githubId = 641627;
+    name = "Chris Pattison";
+  };
   chrispickard = {
     email = "chrispickard9@gmail.com";
     github = "chrispickard";
@@ -2639,6 +2677,12 @@
       fingerprint = "8026 D24A A966 BF9C D3CD  CB3C 08FB 2BFC 470E 75B4";
     }];
   };
+  Crafter = {
+    email = "crafter@crafter.rocks";
+    github = "Craftzman7";
+    githubId = 70068692;
+    name = "Crafter";
+  };
   craigem = {
     email = "craige@mcwhirter.io";
     github = "craigem";
@@ -2808,6 +2852,15 @@
     githubId = 743057;
     name = "Danylo Hlynskyi";
   };
+  danc86 = {
+    name = "Dan Callaghan";
+    email = "djc@djc.id.au";
+    github = "danc86";
+    githubId = 398575;
+    keys = [{
+      fingerprint = "1C56 01F1 D70A B56F EABB  6BC0 26B5 AA2F DAF2 F30A";
+    }];
+  };
   dancek = {
     email = "hannu.hartikainen@gmail.com";
     github = "dancek";
@@ -2854,7 +2907,7 @@
   danth = {
     name = "Daniel Thwaites";
     email = "danthwaites30@btinternet.com";
-    matrix = "@danth:matrix.org";
+    matrix = "@danth:pwak.org";
     github = "danth";
     githubId = 28959268;
     keys = [{
@@ -3122,6 +3175,13 @@
     githubId = 1311761;
     name = "Didier J. Devroye";
   };
+  desttinghim = {
+    email = "opensource@louispearson.work";
+    matrix = "@desttinghim:matrix.org";
+    github = "desttinghim";
+    githubId = 10042482;
+    name = "Louis Pearson";
+  };
   devhell = {
     email = ''"^"@regexmail.net'';
     github = "devhell";
@@ -4356,6 +4416,21 @@
     githubId = 405105;
     name = "Dustin Frisch";
   };
+  foo-dogsquared = {
+    email = "foo.dogsquared@gmail.com";
+    github = "foo-dogsquared";
+    githubId = 34962634;
+    name = "Gabriel Arazas";
+  };
+  foolnotion = {
+    email = "bogdan.burlacu@pm.me";
+    github = "foolnotion";
+    githubId = 844222;
+    name = "Bogdan Burlacu";
+    keys = [{
+      fingerprint = "B722 6464 838F 8BDB 2BEA  C8C8 5B0E FDDF BA81 6105";
+    }];
+  };
   forkk = {
     email = "forkk@forkk.net";
     github = "Forkk";
@@ -5126,6 +5201,12 @@
     githubId = 3656888;
     name = "hhm";
   };
+  hhydraa = {
+    email = "hcurfman@keemail.me";
+    github = "hhydraa";
+    githubId = 58676303;
+    name = "hhydraa";
+  };
   higebu = {
     name = "Yuya Kusakabe";
     email = "yuya.kusakabe@gmail.com";
@@ -5180,6 +5261,16 @@
     githubId = 6074754;
     name = "Hlodver Sigurdsson";
   };
+  huantian = {
+    name = "David Li";
+    email = "davidtianli@gmail.com";
+    matrix = "@huantian:huantian.dev";
+    github = "huantianad";
+    githubId = 20760920;
+    keys = [{
+      fingerprint = "731A 7A05 AD8B 3AE5 956A  C227 4A03 18E0 4E55 5DE5";
+    }];
+  };
   hugoreeves = {
     email = "hugo@hugoreeves.com";
     github = "HugoReeves";
@@ -5268,6 +5359,12 @@
     githubId = 39689;
     name = "Hugo Tavares Reis";
   };
+  hufman = {
+    email = "hufman@gmail.com";
+    github = "hufman";
+    githubId = 1592375;
+    name = "Walter Huf";
+  };
   hugolgst = {
     email = "hugo.lageneste@pm.me";
     github = "hugolgst";
@@ -5412,10 +5509,10 @@
     githubId = 40234257;
     name = "ilkecan bozdogan";
   };
-  ihatethefrench =  {
+  not-my-segfault =  {
     email = "michal@tar.black";
     matrix = "@michal:tar.black";
-    github = "ihatethefrench";
+    github = "not-my-segfault";
     githubId = 30374463;
     name = "Michal S.";
   };
@@ -6289,6 +6386,12 @@
     github = "JoshuaFern";
     githubId = 4300747;
   };
+  joshvanl = {
+    email = " me@joshvanl.dev ";
+    github = "joshvanl";
+    githubId = 15893072;
+    name = "Josh van Leeuwen";
+  };
   jpas = {
     name = "Jarrod Pas";
     email = "jarrod@jarrodpas.com";
@@ -6343,13 +6446,6 @@
     githubId = 3267697;
     name = "Joshua Potter";
   };
-  jschievink = {
-    email = "jonasschievink@gmail.com";
-    matrix = "@jschievink:matrix.org";
-    github = "jonas-schievink";
-    githubId = 1786438;
-    name = "Jonas Schievink";
-  };
   jshcmpbll = {
     email = "me@joshuadcampbell.com";
     github = "jshcmpbll";
@@ -6641,6 +6737,15 @@
     githubId = 37185887;
     name = "Calvin Kim";
   };
+  keksbg = {
+    email = "keksbg@riseup.net";
+    name = "Stella";
+    github = "keksbg";
+    githubId = 10682187;
+    keys = [{
+      fingerprint = "AB42 1F18 5A19 A160 AD77  9885 3D6D CA5B 6F2C 2A7A";
+    }];
+  };
   keldu = {
     email = "mail@keldu.de";
     github = "keldu";
@@ -7241,6 +7346,13 @@
     githubId = 4158274;
     name = "Michiel Leenaars";
   };
+  logo = {
+    email = "logo4poop@protonmail.com";
+    matrix = "@logo4poop:matrix.org";
+    github = "logo4poop";
+    githubId = 24994565;
+    name = "Isaac Silverstein";
+  };
   lom = {
     email = "legendofmiracles@protonmail.com";
     matrix = "@legendofmiracles:matrix.org";
@@ -7415,6 +7527,16 @@
     githubId = 667272;
     name = "Lincoln Lee";
   };
+  linj = {
+    name = "Lin Jian";
+    email = "me@linj.tech";
+    matrix = "@me:linj.tech";
+    github = "jian-lin";
+    githubId = 75130626;
+    keys = [{
+      fingerprint = "80EE AAD8 43F9 3097 24B5  3D7E 27E9 7B91 E63A 7FF8";
+    }];
+  };
   linquize = {
     email = "linquize@yahoo.com.hk";
     github = "linquize";
@@ -7463,6 +7585,16 @@
     githubId = 22085373;
     name = "Luis Hebendanz";
   };
+  luizribeiro = {
+    email = "nixpkgs@l9o.dev";
+    matrix = "@luizribeiro:matrix.org";
+    name = "Luiz Ribeiro";
+    github = "luizribeiro";
+    githubId = 112069;
+    keys = [{
+      fingerprint = "97A0 AE5E 03F3 499B 7D7A  65C6 76A4 1432 37EF 5817";
+    }];
+  };
   lunarequest = {
     email = "nullarequest@vivlaid.net";
     github = "Lunarequest";
@@ -7991,6 +8123,12 @@
     githubId = 1711539;
     name = "matklad";
   };
+  matrss = {
+    name = "Matthias Riße";
+    email = "matthias.risze@t-online.de";
+    github = "matrss";
+    githubId = 9308656;
+  };
   matt-snider = {
     email = "matt.snider@protonmail.com";
     github = "matt-snider";
@@ -9406,6 +9544,12 @@
     githubId = 20391;
     name = "Nahum Shalman";
   };
+  nsnelson = {
+    email = "noah.snelson@protonmail.com";
+    github = "peeley";
+    githubId = 30942198;
+    name = "Noah Snelson";
+  };
   nthorne = {
     email = "notrupertthorne@gmail.com";
     github = "nthorne";
@@ -9493,6 +9637,15 @@
       fingerprint = "D5E4 A51D F8D2 55B9 FAC6  A9BB 2F96 07F0 9B36 0F2D";
     }];
   };
+  ocfox = {
+    email = "i@ocfox.me";
+    github = "ocfox";
+    githubId = 47410251;
+    name = "ocfox";
+    keys = [{
+      fingerprint = "939E F8A5 CED8 7F50 5BB5  B2D0 24BC 2738 5F70 234F";
+    }];
+  };
   odi = {
     email = "oliver.dunkl@gmail.com";
     github = "odi";
@@ -9541,6 +9694,12 @@
     githubId = 1237862;
     name = "Ollie Bunting";
   };
+  oluceps = {
+    email = "nixos@oluceps.uk";
+    github = "oluceps";
+    githubId = 35628088;
+    name = "oluceps";
+  };
   olynch = {
     email = "owen@olynch.me";
     github = "olynch";
@@ -9583,6 +9742,12 @@
     githubId = 757752;
     name = "Jonas Heinrich";
   };
+  onthestairs = {
+    email = "austinplatt@gmail.com";
+    github = "onthestairs";
+    githubId = 915970;
+    name = "Austin Platt";
+  };
   ony = {
     name = "Mykola Orliuk";
     email = "virkony@gmail.com";
@@ -9643,6 +9808,12 @@
     githubId = 25278;
     name = "Otavio Salvador";
   };
+  otini = {
+    name = "Olivier Nicole";
+    email = "olivier@chnik.fr";
+    github = "OlivierNicole";
+    githubId = 14031333;
+  };
   otwieracz = {
     email = "slawek@otwiera.cz";
     github = "otwieracz";
@@ -9750,18 +9921,24 @@
     githubId = 1788628;
     name = "pandaman";
   };
+  panicgh = {
+    email = "nbenes.gh@xandea.de";
+    github = "panicgh";
+    githubId = 79252025;
+    name = "Nicolas Benes";
+  };
   paperdigits = {
     email = "mica@silentumbrella.com";
     github = "paperdigits";
     githubId = 71795;
     name = "Mica Semrick";
   };
-  papojari = {
+  annaaurora = {
-    email = "papojari-git.ovoid@aleeas.com";
+    email = "anna@annaaurora.eu";
     matrix = "@papojari:artemislena.eu";
     github = "auroraanna";
     githubId = 81317317;
-    name = "papojari";
+    name = "Anna Aurora";
   };
   paraseba = {
     email = "paraseba@gmail.com";
@@ -9814,6 +9991,12 @@
       fingerprint = "196A BFEC 6A1D D1EC 7594  F8D1 F625 47D0 75E0 9767";
     }];
   };
+  patryk4815 = {
+    email = "patryk.sondej@gmail.com";
+    github = "patryk4815";
+    githubId = 3074260;
+    name = "Patryk Sondej";
+  };
   patternspandemic = {
     email = "patternspandemic@live.com";
     github = "patternspandemic";
@@ -10303,6 +10486,12 @@
       }
     ];
   };
+  ProducerMatt = {
+    name = "Matthew Pherigo";
+    email = "ProducerMatt42@gmail.com";
+    github = "ProducerMatt";
+    githubId = 58014742;
+  };
   Profpatsch = {
     email = "mail@profpatsch.de";
     github = "Profpatsch";
@@ -11279,6 +11468,12 @@
     githubId = 107703;
     name = "Samuel Rivas";
   };
+  samw = {
+    email = "sam@wlcx.cc";
+    github = "wlcx";
+    githubId = 3065381;
+    name = "Sam Willcocks";
+  };
   samyak = {
     name = "Samyak Sarnayak";
     email = "samyak201@gmail.com";
@@ -11962,15 +12157,6 @@
     githubId = 9720532;
     name = "Sergei K";
   };
-  sondr3 = {
-    email = "nilsen.sondre@gmail.com";
-    github = "sondr3";
-    githubId = 2280539;
-    name = "Sondre Nilsen";
-    keys = [{
-      fingerprint = "0EC3 FA89 EFBA B421 F82E  40B0 2567 6BCB FFAD 76B1";
-    }];
-  };
   sophrosyne = {
     email = "joshuaortiz@tutanota.com";
     github = "sophrosyne97";
@@ -12038,6 +12224,12 @@
     githubId = 36899624;
     name = "squalus";
   };
+  squarepear = {
+    email = "contact@jeffreyharmon.dev";
+    github = "SquarePear";
+    githubId = 16364318;
+    name = "Jeffrey Harmon";
+  };
   srapenne = {
     email = "solene@perso.pw";
     github = "rapenne-s";
@@ -12632,6 +12824,16 @@
     githubId = 886074;
     name = "Matthieu Coudron";
   };
+  teutat3s = {
+    email = "teutates@mailbox.org";
+    matrix = "@teutat3s:pub.solar";
+    github = "teutat3s";
+    githubId = 10206665;
+    name = "teutat3s";
+    keys = [{
+      fingerprint = "81A1 1C61 F413 8C84 9139  A4FA 18DA E600 A6BB E705";
+    }];
+  };
   tex = {
     email = "milan.svoboda@centrum.cz";
     github = "tex";
@@ -12983,6 +13185,12 @@
     githubId = 61303;
     name = "Tom Fitzhenry";
   };
+  tomhoule = {
+    email = "secondary+nixpkgs@tomhoule.com";
+    github = "tomhoule";
+    githubId = 13155277;
+    name = "Tom Houle";
+  };
   tomsmeets = {
     email = "tom.tsmeets@gmail.com";
     github = "TomSmeets";
@@ -14009,6 +14217,12 @@
     githubId = 5978566;
     name = "Yves-Stan Le Cornec";
   };
+  ylh = {
+    email = "nixpkgs@ylh.io";
+    github = "ylh";
+    githubId = 9125590;
+    name = "Yestin L. Harrison";
+  };
   ylwghst = {
     email = "ylwghst@onionmail.info";
     github = "ylwghst";
@@ -14714,4 +14928,22 @@
     github = "npatsakula";
     githubId = 23001619;
   };
+  dfithian = {
+    email = "daniel.m.fithian@gmail.com";
+    name = "Daniel Fithian";
+    github = "dfithian";
+    githubId = 8409320;
+  };
+  nikstur = {
+    email = "nikstur@outlook.com";
+    name = "nikstur";
+    github = "nikstur";
+    githubId = 61635709;
+  };
+  yisuidenghua = {
+    email = "bileiner@gmail.com";
+    name = "Milena Yisui";
+    github = "yisuidenghua";
+    githubId = 102890144;
+  };
 }

third_party/nixpkgs/maintainers/scripts/haskell/hydra-report.hs

@@ -451,8 +451,8 @@ printBuildSummary
       showBuild (name, entry) = printJob id name (summaryBuilds entry, Text.pack (if summaryReverseDeps entry > 0 then " :arrow_heading_up: " <> show (summaryUnbrokenReverseDeps entry) <>" | "<> show (summaryReverseDeps entry) else ""))
       showMaintainedBuild (name, (table, maintainers)) = printJob id name (table, Text.intercalate " " (fmap ("@" <>) (toList maintainers)))
       tldr = case (errors, warnings) of
-               ([],[]) -> [":green_circle: **Ready to merge**"]
+               ([],[]) -> [":green_circle: **Ready to merge** (if there are no [evaluation errors](https://hydra.nixos.org/jobset/nixpkgs/haskell-updates))"]
-               ([],_) -> [":yellow_circle: **Potential issues**"]
+               ([],_) -> [":yellow_circle: **Potential issues** (and possibly [evaluation errors](https://hydra.nixos.org/jobset/nixpkgs/haskell-updates))"]
                _ -> [":red_circle: **Branch not mergeable**"]
       warnings =
          if' (Unfinished > maybe Success worstState maintainedJob) "`maintained` jobset failed." <>

third_party/nixpkgs/maintainers/scripts/luarocks-packages.csv

@@ -39,11 +39,13 @@ lua-cmsgpack,,,,,,
 lua-iconv,,,,,,
 lua-lsp,,,,,,
 lua-messagepack,,,,,,
+lua-protobuf,,,,,,lockejan
 lua-resty-http,,,,,,
 lua-resty-jwt,,,,,,
 lua-resty-openidc,,,,,,
 lua-resty-openssl,,,,,,
 lua-resty-session,,,,,,
+lua-subprocess,https://github.com/0x0ade/lua-subprocess,,,,lua5_1,scoder12
 lua-term,,,,,,
 lua-toml,,,,,,
 lua-zlib,,,,,,koral
@@ -70,6 +72,7 @@ luasql-sqlite3,,,,,,vyp
 luassert,,,,,,
 luasystem,,,,,,
 luaunbound,,,,,
+luaunit,,,,,,lockejan
 luautf8,,,,,,pstn
 luazip,,,,,,
 lua-yajl,,,,,,pstn
@@ -86,6 +89,7 @@ plenary.nvim,https://github.com/nvim-lua/plenary.nvim.git,,,,lua5_1,
 rapidjson,https://github.com/xpol/lua-rapidjson.git,,,,,
 readline,,,,,,
 say,https://github.com/Olivine-Labs/say.git,,,,,
+serpent,,,,,,lockejan
 sqlite,,,,,,
 std._debug,https://github.com/lua-stdlib/_debug.git,,,,,
 std.normalize,https://github.com/lua-stdlib/normalize.git,,,,,

third_party/nixpkgs/maintainers/team-list.nix

@@ -256,12 +256,8 @@ with lib.maintainers; {
   golang = {
     members = [
       c00w
-      cstrahan
-      Frostman
       kalbasit
       mic92
-      orivej
-      rvolosatovs
       zowoq
     ];
     scope = "Maintain Golang compilers.";

third_party/nixpkgs/nixos/doc/manual/configuration/gpu-accel.chapter.md

@@ -169,7 +169,7 @@ configuration, GPU devices have world-read/write permissions
 (`/dev/dri/renderD*`) or are tagged as `uaccess` (`/dev/dri/card*`). The
 access control lists of devices with the `uaccess` tag will be updated
 automatically when a user logs in through `systemd-logind`. For example,
-if the user *jane* is logged in, the access control list should look as
+if the user *alice* is logged in, the access control list should look as
 follows:
 
 ```ShellSession
@@ -178,7 +178,7 @@ $ getfacl /dev/dri/card0
 # owner: root
 # group: video
 user::rw-
-user:jane:rw-
+user:alice:rw-
 group::rw-
 mask::rw-
 other::---

third_party/nixpkgs/nixos/doc/manual/development/option-declarations.section.md

@@ -127,14 +127,14 @@ lib.mkOption {
 ```nix
 lib.mkPackageOption pkgs "GHC" {
   default = [ "ghc" ];
-  example = "pkgs.haskell.package.ghc923.ghc.withPackages (hkgs: [ hkgs.primes ])";
+  example = "pkgs.haskell.packages.ghc924.ghc.withPackages (hkgs: [ hkgs.primes ])";
 }
 # is like
 lib.mkOption {
   type = lib.types.package;
   default = pkgs.ghc;
   defaultText = lib.literalExpression "pkgs.ghc";
-  example = lib.literalExpression "pkgs.haskell.package.ghc923.ghc.withPackages (hkgs: [ hkgs.primes ])";
+  example = lib.literalExpression "pkgs.haskell.packages.ghc924.ghc.withPackages (hkgs: [ hkgs.primes ])";
   description = "The GHC package to use.";
 }
 ```

third_party/nixpkgs/nixos/doc/manual/development/writing-nixos-tests.section.md

@@ -347,7 +347,7 @@ import ./make-test-python.nix {
 
 ## Failing tests early {#ssec-failing-tests-early}
 
-To fail tests early when certain invariables are no longer met (instead of waiting for the build to time out), the decorator `polling_condition` is provided. For example, if we are testing a program `foo` that should not quit after being started, we might write the following:
+To fail tests early when certain invariants are no longer met (instead of waiting for the build to time out), the decorator `polling_condition` is provided. For example, if we are testing a program `foo` that should not quit after being started, we might write the following:
 
 ```py
 @polling_condition
@@ -369,29 +369,29 @@ with foo_running:
 :
     specifies how often the condition should be polled:
 
-    ```py
+```py
-    @polling_condition(seconds_interval=10)
+@polling_condition(seconds_interval=10)
-    def foo_running():
+def foo_running():
-        machine.succeed("pgrep -x foo")
+    machine.succeed("pgrep -x foo")
-    ```
+```
 
 `description`
 
 :
     is used in the log when the condition is checked. If this is not provided, the description is pulled from the docstring of the function. These two are therefore equivalent:
 
-    ```py
+```py
-    @polling_condition
+@polling_condition
-    def foo_running():
+def foo_running():
-        "check that foo is running"
+    "check that foo is running"
-        machine.succeed("pgrep -x foo")
+    machine.succeed("pgrep -x foo")
-    ```
+```
 
-    ```py
+```py
-    @polling_condition(description="check that foo is running")
+@polling_condition(description="check that foo is running")
-    def foo_running():
+def foo_running():
-        machine.succeed("pgrep -x foo")
+    machine.succeed("pgrep -x foo")
-    ```
+```
 
 ## Adding Python packages to the test script {#ssec-python-packages-in-test-script}
 

third_party/nixpkgs/nixos/doc/manual/from_md/configuration/gpu-accel.chapter.xml

@@ -194,7 +194,7 @@ environment.variables.VK_ICD_FILENAMES =
         devices with the <literal>uaccess</literal> tag will be updated
         automatically when a user logs in through
         <literal>systemd-logind</literal>. For example, if the user
-        <emphasis>jane</emphasis> is logged in, the access control list
+        <emphasis>alice</emphasis> is logged in, the access control list
         should look as follows:
       </para>
       <programlisting>
@@ -203,7 +203,7 @@ $ getfacl /dev/dri/card0
 # owner: root
 # group: video
 user::rw-
-user:jane:rw-
+user:alice:rw-
 group::rw-
 mask::rw-
 other::---

third_party/nixpkgs/nixos/doc/manual/from_md/development/option-declarations.section.xml

@@ -193,14 +193,14 @@ lib.mkOption {
         <programlisting language="bash">
 lib.mkPackageOption pkgs &quot;GHC&quot; {
   default = [ &quot;ghc&quot; ];
-  example = &quot;pkgs.haskell.package.ghc923.ghc.withPackages (hkgs: [ hkgs.primes ])&quot;;
+  example = &quot;pkgs.haskell.packages.ghc924.ghc.withPackages (hkgs: [ hkgs.primes ])&quot;;
 }
 # is like
 lib.mkOption {
   type = lib.types.package;
   default = pkgs.ghc;
   defaultText = lib.literalExpression &quot;pkgs.ghc&quot;;
-  example = lib.literalExpression &quot;pkgs.haskell.package.ghc923.ghc.withPackages (hkgs: [ hkgs.primes ])&quot;;
+  example = lib.literalExpression &quot;pkgs.haskell.packages.ghc924.ghc.withPackages (hkgs: [ hkgs.primes ])&quot;;
   description = &quot;The GHC package to use.&quot;;
 }
 </programlisting>

third_party/nixpkgs/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml

@@ -607,7 +607,7 @@ import ./make-test-python.nix {
   <section xml:id="ssec-failing-tests-early">
     <title>Failing tests early</title>
     <para>
-      To fail tests early when certain invariables are no longer met
+      To fail tests early when certain invariants are no longer met
       (instead of waiting for the build to time out), the decorator
       <literal>polling_condition</literal> is provided. For example, if
       we are testing a program <literal>foo</literal> that should not
@@ -635,12 +635,10 @@ with foo_running:
     <para>
       : specifies how often the condition should be polled:
     </para>
-    <programlisting>
+    <programlisting language="python">
-```py
 @polling_condition(seconds_interval=10)
 def foo_running():
     machine.succeed(&quot;pgrep -x foo&quot;)
-```
 </programlisting>
     <para>
       <literal>description</literal>
@@ -650,19 +648,16 @@ def foo_running():
       provided, the description is pulled from the docstring of the
       function. These two are therefore equivalent:
     </para>
-    <programlisting>
+    <programlisting language="python">
-```py
 @polling_condition
 def foo_running():
     &quot;check that foo is running&quot;
     machine.succeed(&quot;pgrep -x foo&quot;)
-```
+</programlisting>
-
+    <programlisting language="python">
-```py
 @polling_condition(description=&quot;check that foo is running&quot;)
 def foo_running():
     machine.succeed(&quot;pgrep -x foo&quot;)
-```
 </programlisting>
   </section>
   <section xml:id="ssec-python-packages-in-test-script">

third_party/nixpkgs/nixos/doc/manual/from_md/installation/building-nixos.chapter.xml

@@ -33,9 +33,14 @@
   </para>
   <section xml:id="sec-building-image-instructions">
     <title>Practical Instructions</title>
+    <para>
+      To build an ISO image for the channel
+      <literal>nixos-unstable</literal>:
+    </para>
     <programlisting>
 $ git clone https://github.com/NixOS/nixpkgs.git
 $ cd nixpkgs/nixos
+$ git switch nixos-unstable
 $ nix-build -A config.system.build.isoImage -I nixos-config=modules/installer/cd-dvd/installation-cd-minimal.nix default.nix
 </programlisting>
     <para>

third_party/nixpkgs/nixos/doc/manual/from_md/installation/installing.chapter.xml

@@ -426,7 +426,9 @@ OK
             </term>
             <listitem>
               <para>
-                You <emphasis>must</emphasis> set the option
+                You must select a boot-loader, either system-boot or
+                GRUB. The recommended option is systemd-boot: set the
+                option
                 <xref linkend="opt-boot.loader.systemd-boot.enable" />
                 to <literal>true</literal>.
                 <literal>nixos-generate-config</literal> should do this
@@ -440,6 +442,23 @@ OK
                 <link linkend="opt-boot.loader.systemd-boot.enable"><literal>boot.loader.systemd-boot</literal></link>
                 as well.
               </para>
+              <para>
+                If you want to use GRUB, set
+                <xref linkend="opt-boot.loader.grub.device" /> to
+                <literal>nodev</literal> and
+                <xref linkend="opt-boot.loader.grub.efiSupport" /> to
+                <literal>true</literal>.
+              </para>
+              <para>
+                With system-boot, you should not need any special
+                configuration to detect other installed systems. With
+                GRUB, set
+                <xref linkend="opt-boot.loader.grub.useOSProber" /> to
+                <literal>true</literal>, but this will only detect
+                windows partitions, not other linux distributions. If
+                you dual boot another linux distribution, use
+                system-boot instead.
+              </para>
             </listitem>
           </varlistentry>
         </variablelist>

third_party/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml

@@ -95,6 +95,11 @@
           PHP now defaults to PHP 8.1, updated from 8.0.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          Cinnamon has been updated to 5.4.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <literal>hardware.nvidia</literal> has a new option
@@ -119,6 +124,13 @@
           <link xlink:href="options.html#opt-virtualisation.appvm.enable">virtualisation.appvm</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://github.com/mozilla-services/syncstorage-rs">syncstorage-rs</link>,
+          a self-hostable sync server for Firefox. Available as
+          <link xlink:href="options.html#opt-services.firefox-syncserver.enable">services.firefox-syncserver</link>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <link xlink:href="https://dragonflydb.io/">dragonflydb</link>,
@@ -126,6 +138,14 @@
           <link linkend="opt-services.dragonflydb.enable">services.dragonflydb</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://hbase.apache.org/">HBase
+          cluster</link>, a distributed, scalable, big data store.
+          Available as
+          <link xlink:href="options.html#opt-services.hadoop.hbase.enable">services.hadoop.hbase</link>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <link xlink:href="https://github.com/leetronics/infnoise">infnoise</link>,
@@ -133,6 +153,14 @@
           <link xlink:href="options.html#opt-services.infnoise.enable">services.infnoise</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://github.com/jtroo/kanata">kanata</link>,
+          a tool to improve keyboard comfort and usability with advanced
+          customization. Available as
+          <link xlink:href="options.html#opt-services.kanata.enable">services.kanata</link>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <link xlink:href="https://github.com/aiberia/persistent-evdev">persistent-evdev</link>,
@@ -244,12 +272,26 @@
           with Google Chrome and the Google Cast extension.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>services.hbase</literal> has been renamed to
+          <literal>services.hbase-standalone</literal>. For production
+          HBase clusters, use <literal>services.hadoop.hbase</literal>
+          instead.
+        </para>
+      </listitem>
       <listitem>
         <para>
           PHP 7.4 is no longer supported due to upstream not supporting
           this version for the entire lifecycle of the 22.11 release.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>pkgs.cosign</literal> does not provide the
+          <literal>cosigned</literal> binary anymore.
+        </para>
+      </listitem>
       <listitem>
         <para>
           riak package removed along with
@@ -257,6 +299,20 @@
           maintainer to update the package.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          xow package removed along with the
+          <literal>hardware.xow</literal> module, due to the project
+          being deprecated in favor of <literal>xone</literal>, which is
+          available via the <literal>hardware.xone</literal> module.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          virtlyst package and <literal>services.virtlyst</literal>
+          module removed, due to lack of maintainers.
+        </para>
+      </listitem>
       <listitem>
         <para>
           The <literal>services.graphite.api</literal> and
@@ -267,6 +323,13 @@
           been removed due to lack of upstream maintenance.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The <literal>meta.mainProgram</literal> attribute of packages
+          in <literal>wineWowPackages</literal> now defaults to
+          <literal>&quot;wine64&quot;</literal>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           (Neo)Vim can not be configured with
@@ -336,6 +399,18 @@
           as coreboot’s fork is no longer available.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The udisks2 service, available at
+          <literal>services.udisks2.enable</literal>, is now disabled by
+          default. It will automatically be enabled through services and
+          desktop environments as needed. This also means that polkit
+          will now actually be disabled by default. The default for
+          <literal>security.polkit.enable</literal> was already flipped
+          in the previous release, but udisks2 being enabled by default
+          re-enabled it.
+        </para>
+      </listitem>
       <listitem>
         <para>
           Add udev rules for the Teensy family of microcontrollers.
@@ -350,6 +425,12 @@
           application tries to talk to the libsecret D-Bus API.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          There is a new module for AMD SEV CPU functionality, which
+          grants access to the hardware.
+        </para>
+      </listitem>
       <listitem>
         <para>
           There is a new module for the <literal>thunar</literal>

third_party/nixpkgs/nixos/doc/manual/installation/building-nixos.chapter.md

@@ -18,9 +18,12 @@ enforced values with `mkForce`.
 
 ## Practical Instructions {#sec-building-image-instructions}
 
+To build an ISO image for the channel `nixos-unstable`:
+
 ```ShellSession
 $ git clone https://github.com/NixOS/nixpkgs.git
 $ cd nixpkgs/nixos
+$ git switch nixos-unstable
 $ nix-build -A config.system.build.isoImage -I nixos-config=modules/installer/cd-dvd/installation-cd-minimal.nix default.nix
 ```
 

third_party/nixpkgs/nixos/doc/manual/installation/installing.chapter.md

@@ -303,7 +303,8 @@ Use the following commands:
 
     UEFI systems
 
-    :   You *must* set the option [](#opt-boot.loader.systemd-boot.enable)
+    :   You must select a boot-loader, either system-boot or GRUB. The recommended
+        option is systemd-boot: set the option [](#opt-boot.loader.systemd-boot.enable)
         to `true`. `nixos-generate-config` should do this automatically
         for new configurations when booted in UEFI mode.
 
@@ -312,6 +313,15 @@ Use the following commands:
         [`boot.loader.systemd-boot`](#opt-boot.loader.systemd-boot.enable)
         as well.
 
+    :   If you want to use GRUB, set [](#opt-boot.loader.grub.device) to `nodev` and
+        [](#opt-boot.loader.grub.efiSupport) to `true`.
+
+    :   With system-boot, you should not need any special configuration to detect
+        other installed systems. With GRUB, set [](#opt-boot.loader.grub.useOSProber)
+        to `true`, but this will only detect windows partitions, not other linux
+        distributions. If you dual boot another linux distribution, use system-boot
+        instead.
+
     If you need to configure networking for your machine the
     configuration options are described in [](#sec-networking). In
     particular, while wifi is supported on the installation image, it is

third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2211.section.md

@@ -46,6 +46,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - PHP now defaults to PHP 8.1, updated from 8.0.
 
+- Cinnamon has been updated to 5.4.
+
 - `hardware.nvidia` has a new option `open` that can be used to opt in the opensource version of NVIDIA kernel driver. Note that the driver's support for GeForce and Workstation GPUs is still alpha quality, see [NVIDIA Releases Open-Source GPU Kernel Modules](https://developer.nvidia.com/blog/nvidia-releases-open-source-gpu-kernel-modules/) for the official announcement.
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -53,11 +55,18 @@ In addition to numerous new and upgraded packages, this release has the followin
 ## New Services {#sec-release-22.11-new-services}
 
 - [appvm](https://github.com/jollheef/appvm), Nix based app VMs. Available as [virtualisation.appvm](options.html#opt-virtualisation.appvm.enable).
+- [syncstorage-rs](https://github.com/mozilla-services/syncstorage-rs), a self-hostable sync server for Firefox. Available as [services.firefox-syncserver](options.html#opt-services.firefox-syncserver.enable).
 
 - [dragonflydb](https://dragonflydb.io/), a modern replacement for Redis and Memcached. Available as [services.dragonflydb](#opt-services.dragonflydb.enable).
 
+- [HBase cluster](https://hbase.apache.org/), a distributed, scalable, big data store. Available as [services.hadoop.hbase](options.html#opt-services.hadoop.hbase.enable).
+
 - [infnoise](https://github.com/leetronics/infnoise), a hardware True Random Number Generator dongle.
   Available as [services.infnoise](options.html#opt-services.infnoise.enable).
+
+- [kanata](https://github.com/jtroo/kanata), a tool to improve keyboard comfort and usability with advanced customization.
+  Available as [services.kanata](options.html#opt-services.kanata.enable).
+
 - [persistent-evdev](https://github.com/aiberia/persistent-evdev), a daemon to add virtual proxy devices that mirror a physical input device but persist even if the underlying hardware is hot-plugged. Available as [services.persistent-evdev](#opt-services.persistent-evdev.enable).
 
 - [schleuder](https://schleuder.org/), a mailing list manager with PGP support. Enable using [services.schleuder](#opt-services.schleuder.enable).
@@ -94,16 +103,27 @@ In addition to numerous new and upgraded packages, this release has the followin
   as it requires `qt4`, which reached its end-of-life 2015 and will no longer be supported by nixpkgs.
   [According to Barco](https://www.barco.com/de/support/knowledge-base/4380-can-i-use-linux-os-with-clickshare-base-units) many of their base unit models can be used with Google Chrome and the Google Cast extension.
 
+- `services.hbase` has been renamed to `services.hbase-standalone`.
+  For production HBase clusters, use `services.hadoop.hbase` instead.
+
 - PHP 7.4 is no longer supported due to upstream not supporting this
   version for the entire lifecycle of the 22.11 release.
 
+- `pkgs.cosign` does not provide the `cosigned` binary anymore.
+
 - riak package removed along with `services.riak` module, due to lack of maintainer to update the package.
 
+- xow package removed along with the `hardware.xow` module, due to the project being deprecated in favor of `xone`,  which is available via the `hardware.xone` module.
+
+- virtlyst package and `services.virtlyst` module removed, due to lack of maintainers.
+
 - The `services.graphite.api` and `services.graphite.beacon` NixOS options, and
   the `python3.pkgs.graphite_api`, `python3.pkgs.graphite_beacon` and
   `python3.pkgs.influxgraph` packages, have been removed due to lack of upstream
   maintenance.
 
+- The `meta.mainProgram` attribute of packages in `wineWowPackages` now defaults to `"wine64"`.
+
 - (Neo)Vim can not be configured with `configure.pathogen` anymore to reduce maintainance burden.
 Use `configure.packages` instead.
 
@@ -126,10 +146,15 @@ Use `configure.packages` instead.
 
 - memtest86+ was updated from 5.00-coreboot-002 to 6.00-beta2. It is now the upstream version from https://www.memtest.org/, as coreboot's fork is no longer available.
 
+- The udisks2 service, available at `services.udisks2.enable`, is now disabled by default. It will automatically be enabled through services and desktop environments as needed.
+  This also means that polkit will now actually be disabled by default. The default for `security.polkit.enable` was already flipped in the previous release, but udisks2 being enabled by default re-enabled it.
+
 - Add udev rules for the Teensy family of microcontrollers.
 
 - The `pass-secret-service` package now includes systemd units from upstream, so adding it to the NixOS `services.dbus.packages` option will make it start automatically as a systemd user service when an application tries to talk to the libsecret D-Bus API.
 
+- There is a new module for AMD SEV CPU functionality, which grants access to the hardware.
+
 - There is a new module for the `thunar` program (the Xfce file manager), which depends on the `xfconf` dbus service, and also has a dbus service and a systemd unit. The option `services.xserver.desktopManager.xfce.thunarPlugins` has been renamed to `programs.thunar.plugins`, and in a future release it may be removed.
 
 - There is a new module for the `xfconf` program (the Xfce configuration storage system), which has a dbus service.

third_party/nixpkgs/nixos/lib/eval-config.nix

@@ -9,7 +9,9 @@
 # expressions are ever made modular at the top level) can just use
 # types.submodule instead of using eval-config.nix
 evalConfigArgs@
-{ # !!! system can be set modularly, would be nice to remove
+{ # !!! system can be set modularly, would be nice to remove,
+  #     however, removing or changing this default is too much
+  #     of a breaking change. To set it modularly, pass `null`.
   system ? builtins.currentSystem
 , # !!! is this argument needed any more? The pkgs argument can
   # be set modularly anyway.
@@ -48,7 +50,7 @@ let
       # this.  Since the latter defaults to the former, the former should
       # default to the argument. That way this new default could propagate all
       # they way through, but has the last priority behind everything else.
-      nixpkgs.system = lib.mkDefault system;
+      nixpkgs.system = lib.mkIf (system != null) (lib.mkDefault system);
 
       _module.args.pkgs = lib.mkIf (pkgs_ != null) (lib.mkForce pkgs_);
     };

third_party/nixpkgs/nixos/lib/make-options-doc/mergeJSON.py

@@ -3,6 +3,11 @@ import json
 import sys
 from typing import Any, Dict, List
 
+# for MD conversion
+import mistune
+import re
+from xml.sax.saxutils import escape, quoteattr
+
 JSON = Dict[str, Any]
 
 class Key:
@@ -41,135 +46,135 @@ def unpivot(options: Dict[Key, Option]) -> Dict[str, JSON]:
         result[opt.name] = opt.value
     return result
 
+admonitions = {
+    '.warning': 'warning',
+    '.important': 'important',
+    '.note': 'note'
+}
+class Renderer(mistune.renderers.BaseRenderer):
+    def _get_method(self, name):
+        try:
+            return super(Renderer, self)._get_method(name)
+        except AttributeError:
+            def not_supported(*args, **kwargs):
+                raise NotImplementedError("md node not supported yet", name, args, **kwargs)
+            return not_supported
+
+    def text(self, text):
+        return escape(text)
+    def paragraph(self, text):
+        return text + "\n\n"
+    def newline(self):
+        return "<literallayout>\n</literallayout>"
+    def codespan(self, text):
+        return f"<literal>{escape(text)}</literal>"
+    def block_code(self, text, info=None):
+        info = f" language={quoteattr(info)}" if info is not None else ""
+        return f"<programlisting{info}>\n{escape(text)}</programlisting>"
+    def link(self, link, text=None, title=None):
+        tag = "link"
+        if link[0:1] == '#':
+            if text == "":
+                tag = "xref"
+            attr = "linkend"
+            link = quoteattr(link[1:])
+        else:
+            # try to faithfully reproduce links that were of the form <link href="..."/>
+            # in docbook format
+            if text == link:
+                text = ""
+            attr = "xlink:href"
+            link = quoteattr(link)
+        return f"<{tag} {attr}={link}>{text}</{tag}>"
+    def list(self, text, ordered, level, start=None):
+        if ordered:
+            raise NotImplementedError("ordered lists not supported yet")
+        return f"<itemizedlist>\n{text}\n</itemizedlist>"
+    def list_item(self, text, level):
+        return f"<listitem><para>{text}</para></listitem>\n"
+    def block_text(self, text):
+        return text
+    def emphasis(self, text):
+        return f"<emphasis>{text}</emphasis>"
+    def strong(self, text):
+        return f"<emphasis role=\"strong\">{text}</emphasis>"
+    def admonition(self, text, kind):
+        if kind not in admonitions:
+            raise NotImplementedError(f"admonition {kind} not supported yet")
+        tag = admonitions[kind]
+        # we don't keep whitespace here because usually we'll contain only
+        # a single paragraph and the original docbook string is no longer
+        # available to restore the trailer.
+        return f"<{tag}><para>{text.rstrip()}</para></{tag}>"
+    def block_quote(self, text):
+        return f"<blockquote><para>{text}</para></blockquote>"
+    def command(self, text):
+        return f"<command>{escape(text)}</command>"
+    def option(self, text):
+        return f"<option>{escape(text)}</option>"
+    def file(self, text):
+        return f"<filename>{escape(text)}</filename>"
+    def manpage(self, page, section):
+        title = f"<refentrytitle>{escape(page)}</refentrytitle>"
+        vol = f"<manvolnum>{escape(section)}</manvolnum>"
+        return f"<citerefentry>{title}{vol}</citerefentry>"
+
+    def finalize(self, data):
+        return "".join(data)
+
+def p_command(md):
+    COMMAND_PATTERN = r'\{command\}`(.*?)`'
+    def parse(self, m, state):
+        return ('command', m.group(1))
+    md.inline.register_rule('command', COMMAND_PATTERN, parse)
+    md.inline.rules.append('command')
+
+def p_file(md):
+    FILE_PATTERN = r'\{file\}`(.*?)`'
+    def parse(self, m, state):
+        return ('file', m.group(1))
+    md.inline.register_rule('file', FILE_PATTERN, parse)
+    md.inline.rules.append('file')
+
+def p_option(md):
+    OPTION_PATTERN = r'\{option\}`(.*?)`'
+    def parse(self, m, state):
+        return ('option', m.group(1))
+    md.inline.register_rule('option', OPTION_PATTERN, parse)
+    md.inline.rules.append('option')
+
+def p_manpage(md):
+    MANPAGE_PATTERN = r'\{manpage\}`(.*?)\((.+?)\)`'
+    def parse(self, m, state):
+        return ('manpage', m.group(1), m.group(2))
+    md.inline.register_rule('manpage', MANPAGE_PATTERN, parse)
+    md.inline.rules.append('manpage')
+
+def p_admonition(md):
+    ADMONITION_PATTERN = re.compile(r'^::: \{([^\n]*?)\}\n(.*?)^:::\n', flags=re.MULTILINE|re.DOTALL)
+    def parse(self, m, state):
+        return {
+            'type': 'admonition',
+            'children': self.parse(m.group(2), state),
+            'params': [ m.group(1) ],
+        }
+    md.block.register_rule('admonition', ADMONITION_PATTERN, parse)
+    md.block.rules.append('admonition')
+
+md = mistune.create_markdown(renderer=Renderer(), plugins=[
+    p_command, p_file, p_option, p_manpage, p_admonition
+])
+
 # converts in-place!
 def convertMD(options: Dict[str, Any]) -> str:
-    import mistune
+    def convertString(path: str, text: str) -> str:
-    import re
+        try:
-    from xml.sax.saxutils import escape, quoteattr
+            rendered = md(text)
-
+            # keep trailing spaces so we can diff the generated XML to check for conversion bugs.
-    admonitions = {
+            return rendered.rstrip() + text[len(text.rstrip()):]
-        '.warning': 'warning',
+        except:
-        '.important': 'important',
+            print(f"error in {path}")
-        '.note': 'note'
+            raise
-    }
-    class Renderer(mistune.renderers.BaseRenderer):
-        def _get_method(self, name):
-            try:
-                return super(Renderer, self)._get_method(name)
-            except AttributeError:
-                def not_supported(*args, **kwargs):
-                    raise NotImplementedError("md node not supported yet", name, args, **kwargs)
-                return not_supported
-
-        def text(self, text):
-            return escape(text)
-        def paragraph(self, text):
-            return text + "\n\n"
-        def newline(self):
-            return "<literallayout>\n</literallayout>"
-        def codespan(self, text):
-            return f"<literal>{escape(text)}</literal>"
-        def block_code(self, text, info=None):
-            info = f" language={quoteattr(info)}" if info is not None else ""
-            return f"<programlisting{info}>\n{escape(text)}</programlisting>"
-        def link(self, link, text=None, title=None):
-            if link[0:1] == '#':
-                attr = "linkend"
-                link = quoteattr(link[1:])
-            else:
-                # try to faithfully reproduce links that were of the form <link href="..."/>
-                # in docbook format
-                if text == link:
-                    text = ""
-                attr = "xlink:href"
-                link = quoteattr(link)
-            return f"<link {attr}={link}>{text}</link>"
-        def list(self, text, ordered, level, start=None):
-            if ordered:
-                raise NotImplementedError("ordered lists not supported yet")
-            return f"<itemizedlist>\n{text}\n</itemizedlist>"
-        def list_item(self, text, level):
-            return f"<listitem><para>{text}</para></listitem>\n"
-        def block_text(self, text):
-            return text
-        def emphasis(self, text):
-            return f"<emphasis>{text}</emphasis>"
-        def strong(self, text):
-            return f"<emphasis role=\"strong\">{text}</emphasis>"
-        def admonition(self, text, kind):
-            if kind not in admonitions:
-                raise NotImplementedError(f"admonition {kind} not supported yet")
-            tag = admonitions[kind]
-            # we don't keep whitespace here because usually we'll contain only
-            # a single paragraph and the original docbook string is no longer
-            # available to restore the trailer.
-            return f"<{tag}><para>{text.rstrip()}</para></{tag}>"
-        def block_quote(self, text):
-            return f"<blockquote><para>{text}</para></blockquote>"
-        def command(self, text):
-            return f"<command>{escape(text)}</command>"
-        def option(self, text):
-            return f"<option>{escape(text)}</option>"
-        def file(self, text):
-            return f"<filename>{escape(text)}</filename>"
-        def manpage(self, page, section):
-            title = f"<refentrytitle>{escape(page)}</refentrytitle>"
-            vol = f"<manvolnum>{escape(section)}</manvolnum>"
-            return f"<citerefentry>{title}{vol}</citerefentry>"
-
-        def finalize(self, data):
-            return "".join(data)
-
-    plugins = []
-
-    COMMAND_PATTERN = r'\{command\}`(.*?)`'
-    def command(md):
-        def parse(self, m, state):
-            return ('command', m.group(1))
-        md.inline.register_rule('command', COMMAND_PATTERN, parse)
-        md.inline.rules.append('command')
-    plugins.append(command)
-
-    FILE_PATTERN = r'\{file\}`(.*?)`'
-    def file(md):
-        def parse(self, m, state):
-            return ('file', m.group(1))
-        md.inline.register_rule('file', FILE_PATTERN, parse)
-        md.inline.rules.append('file')
-    plugins.append(file)
-
-    OPTION_PATTERN = r'\{option\}`(.*?)`'
-    def option(md):
-        def parse(self, m, state):
-            return ('option', m.group(1))
-        md.inline.register_rule('option', OPTION_PATTERN, parse)
-        md.inline.rules.append('option')
-    plugins.append(option)
-
-    MANPAGE_PATTERN = r'\{manpage\}`(.*?)\((.+?)\)`'
-    def manpage(md):
-        def parse(self, m, state):
-            return ('manpage', m.group(1), m.group(2))
-        md.inline.register_rule('manpage', MANPAGE_PATTERN, parse)
-        md.inline.rules.append('manpage')
-    plugins.append(manpage)
-
-    ADMONITION_PATTERN = re.compile(r'^::: \{([^\n]*?)\}\n(.*?)^:::\n', flags=re.MULTILINE|re.DOTALL)
-    def admonition(md):
-        def parse(self, m, state):
-            return {
-                'type': 'admonition',
-                'children': self.parse(m.group(2), state),
-                'params': [ m.group(1) ],
-            }
-        md.block.register_rule('admonition', ADMONITION_PATTERN, parse)
-        md.block.rules.append('admonition')
-    plugins.append(admonition)
-
-    def convertString(text: str) -> str:
-        rendered = mistune.markdown(text, renderer=Renderer(), plugins=plugins)
-        # keep trailing spaces so we can diff the generated XML to check for conversion bugs.
-        return rendered.rstrip() + text[len(text.rstrip()):]
 
     def optionIs(option: Dict[str, Any], key: str, typ: str) -> bool:
         if key not in option: return False
@@ -179,12 +184,12 @@ def convertMD(options: Dict[str, Any]) -> str:
 
     for (name, option) in options.items():
         if optionIs(option, 'description', 'mdDoc'):
-            option['description'] = convertString(option['description']['text'])
+            option['description'] = convertString(name, option['description']['text'])
         if optionIs(option, 'example', 'literalMD'):
-            docbook = convertString(option['example']['text'])
+            docbook = convertString(name, option['example']['text'])
             option['example'] = { '_type': 'literalDocBook', 'text': docbook }
         if optionIs(option, 'default', 'literalMD'):
-            docbook = convertString(option['default']['text'])
+            docbook = convertString(name, option['default']['text'])
             option['default'] = { '_type': 'literalDocBook', 'text': docbook }
 
     return options

third_party/nixpkgs/nixos/lib/qemu-common.nix

@@ -18,7 +18,7 @@ rec {
     ];
 
   qemuSerialDevice = if pkgs.stdenv.hostPlatform.isx86 || pkgs.stdenv.hostPlatform.isRiscV then "ttyS0"
-        else if (with pkgs.stdenv.hostPlatform; isAarch32 || isAarch64 || isPower) then "ttyAMA0"
+        else if (with pkgs.stdenv.hostPlatform; isAarch || isPower) then "ttyAMA0"
         else throw "Unknown QEMU serial device for system '${pkgs.stdenv.hostPlatform.system}'";
 
   qemuBinary = qemuPkg: {

third_party/nixpkgs/nixos/lib/test-driver/test_driver/vlan.py

@@ -32,8 +32,12 @@ class VLan:
         rootlog.info("start vlan")
         pty_master, pty_slave = pty.openpty()
 
+        # The --hub is required for the scenario determined by
+        # nixos/tests/networking.nix vlan-ping.
+        # VLAN Tagged traffic (802.1Q) seams to be blocked if a vde_switch is
+        # used without the hub mode (flood packets to all ports).
         self.process = subprocess.Popen(
-            ["vde_switch", "-s", self.socket_dir, "--dirmode", "0700"],
+            ["vde_switch", "-s", self.socket_dir, "--dirmode", "0700", "--hub"],
             stdin=pty_slave,
             stdout=subprocess.PIPE,
             stderr=subprocess.PIPE,
@@ -50,7 +54,7 @@ class VLan:
         if not (self.socket_dir / "ctl").exists():
             rootlog.error("cannot start vde_switch")
 
-        rootlog.info(f"running vlan (pid {self.pid})")
+        rootlog.info(f"running vlan (pid {self.pid}; ctl {self.socket_dir})")
 
     def __del__(self) -> None:
         rootlog.info(f"kill vlan (pid {self.pid})")

third_party/nixpkgs/nixos/maintainers/scripts/lxd/lxd-image-inner.nix

@@ -55,7 +55,7 @@ with lib;
   # services.xserver.libinput.enable = true;
 
   # Define a user account. Don't forget to set a password with ‘passwd’.
-  # users.users.jane = {
+  # users.users.alice = {
   #   isNormalUser = true;
   #   extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
   # };

third_party/nixpkgs/nixos/modules/config/appstream.nix

@@ -6,9 +6,9 @@ with lib;
     appstream.enable = mkOption {
       type = types.bool;
       default = true;
-      description = ''
+      description = lib.mdDoc ''
         Whether to install files to support the
-        <link xlink:href="https://www.freedesktop.org/software/appstream/docs/index.html">AppStream metadata specification</link>.
+        [AppStream metadata specification](https://www.freedesktop.org/software/appstream/docs/index.html).
       '';
     };
   };

third_party/nixpkgs/nixos/modules/config/console.nix

@@ -58,7 +58,7 @@ in
       type = with types; either str path;
       default = "us";
       example = "fr";
-      description = ''
+      description = lib.mdDoc ''
         The keyboard mapping table for the virtual consoles.
       '';
     };
@@ -72,7 +72,7 @@ in
         "002b36" "cb4b16" "586e75" "657b83"
         "839496" "6c71c4" "93a1a1" "fdf6e3"
       ];
-      description = ''
+      description = lib.mdDoc ''
         The 16 colors palette used by the virtual consoles.
         Leave empty to use the default colors.
         Colors must be in hexadecimal format and listed in
@@ -84,7 +84,7 @@ in
     packages = mkOption {
       type = types.listOf types.package;
       default = [ ];
-      description = ''
+      description = lib.mdDoc ''
         List of additional packages that provide console fonts, keymaps and
         other resources for virtual consoles use.
       '';
@@ -93,7 +93,7 @@ in
     useXkbConfig = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         If set, configure the virtual console keymap from the xserver
         keyboard settings.
       '';
@@ -102,7 +102,7 @@ in
     earlySetup = mkOption {
       default = false;
       type = types.bool;
-      description = ''
+      description = lib.mdDoc ''
         Enable setting virtual console options as early as possible (in initrd).
       '';
     };
@@ -159,7 +159,11 @@ in
           "${config.boot.initrd.systemd.package}/lib/systemd/systemd-vconsole-setup"
           "${config.boot.initrd.systemd.package.kbd}/bin/setfont"
           "${config.boot.initrd.systemd.package.kbd}/bin/loadkeys"
-          "${config.boot.initrd.systemd.package.kbd.gzip}/bin/gzip" # keyboard layouts are compressed
+          "${config.boot.initrd.systemd.package.kbd.gzip}/bin/gzip" # Fonts and keyboard layouts are compressed
+        ] ++ optionals (hasPrefix builtins.storeDir cfg.font) [
+          "${cfg.font}"
+        ] ++ optionals (hasPrefix builtins.storeDir cfg.keyMap) [
+          "${cfg.keyMap}"
         ];
 
         systemd.services.reload-systemd-vconsole-setup =

third_party/nixpkgs/nixos/modules/config/fonts/fontconfig.nix

@@ -246,7 +246,7 @@ in
         enable = mkOption {
           type = types.bool;
           default = true;
-          description = ''
+          description = lib.mdDoc ''
             If enabled, a Fontconfig configuration file will be built
             pointing to a set of default fonts.  If you don't care about
             running X11 applications or any other program that uses
@@ -267,7 +267,7 @@ in
         antialias = mkOption {
           type = types.bool;
           default = true;
-          description = ''
+          description = lib.mdDoc ''
             Enable font antialiasing. At high resolution (> 200 DPI),
             antialiasing has no visible effect; users of such displays may want
             to disable this option.
@@ -277,9 +277,9 @@ in
         localConf = mkOption {
           type = types.lines;
           default = "";
-          description = ''
+          description = lib.mdDoc ''
             System-wide customization file contents, has higher priority than
-            <literal>defaultFonts</literal> settings.
+            `defaultFonts` settings.
           '';
         };
 
@@ -287,7 +287,7 @@ in
           monospace = mkOption {
             type = types.listOf types.str;
             default = ["DejaVu Sans Mono"];
-            description = ''
+            description = lib.mdDoc ''
               System-wide default monospace font(s). Multiple fonts may be
               listed in case multiple languages must be supported.
             '';
@@ -296,7 +296,7 @@ in
           sansSerif = mkOption {
             type = types.listOf types.str;
             default = ["DejaVu Sans"];
-            description = ''
+            description = lib.mdDoc ''
               System-wide default sans serif font(s). Multiple fonts may be
               listed in case multiple languages must be supported.
             '';
@@ -305,7 +305,7 @@ in
           serif = mkOption {
             type = types.listOf types.str;
             default = ["DejaVu Serif"];
-            description = ''
+            description = lib.mdDoc ''
               System-wide default serif font(s). Multiple fonts may be listed
               in case multiple languages must be supported.
             '';
@@ -314,7 +314,7 @@ in
           emoji = mkOption {
             type = types.listOf types.str;
             default = ["Noto Color Emoji"];
-            description = ''
+            description = lib.mdDoc ''
               System-wide default emoji font(s). Multiple fonts may be listed
               in case a font does not support all emoji.
 
@@ -331,7 +331,7 @@ in
           enable = mkOption {
             type = types.bool;
             default = true;
-            description = ''
+            description = lib.mdDoc ''
               Enable font hinting. Hinting aligns glyphs to pixel boundaries to
               improve rendering sharpness at low resolution. At high resolution
               (> 200 dpi) hinting will do nothing (at best); users of such
@@ -342,7 +342,7 @@ in
           autohint = mkOption {
             type = types.bool;
             default = false;
-            description = ''
+            description = lib.mdDoc ''
               Enable the autohinter in place of the default interpreter.
               The results are usually lower quality than correctly-hinted
               fonts, but better than unhinted fonts.
@@ -352,7 +352,7 @@ in
           style = mkOption {
             type = types.enum [ "hintnone" "hintslight" "hintmedium" "hintfull" ];
             default = "hintslight";
-            description = ''
+            description = lib.mdDoc ''
               Hintstyle is the amount of font reshaping done to line up
               to the grid.
 
@@ -367,10 +367,10 @@ in
         includeUserConf = mkOption {
           type = types.bool;
           default = true;
-          description = ''
+          description = lib.mdDoc ''
             Include the user configuration from
-            <filename>~/.config/fontconfig/fonts.conf</filename> or
+            {file}`~/.config/fontconfig/fonts.conf` or
-            <filename>~/.config/fontconfig/conf.d</filename>.
+            {file}`~/.config/fontconfig/conf.d`.
           '';
         };
 
@@ -379,26 +379,26 @@ in
           rgba = mkOption {
             default = "rgb";
             type = types.enum ["rgb" "bgr" "vrgb" "vbgr" "none"];
-            description = ''
+            description = lib.mdDoc ''
               Subpixel order. The overwhelming majority of displays are
-              <literal>rgb</literal> in their normal orientation. Select
+              `rgb` in their normal orientation. Select
-              <literal>vrgb</literal> for mounting such a display 90 degrees
+              `vrgb` for mounting such a display 90 degrees
-              clockwise from its normal orientation or <literal>vbgr</literal>
+              clockwise from its normal orientation or `vbgr`
               for mounting 90 degrees counter-clockwise. Select
-              <literal>bgr</literal> in the unlikely event of mounting 180
+              `bgr` in the unlikely event of mounting 180
               degrees from the normal orientation. Reverse these directions in
               the improbable event that the display's native subpixel order is
-              <literal>bgr</literal>.
+              `bgr`.
             '';
           };
 
           lcdfilter = mkOption {
             default = "default";
             type = types.enum ["none" "default" "light" "legacy"];
-            description = ''
+            description = lib.mdDoc ''
               FreeType LCD filter. At high resolution (> 200 DPI), LCD filtering
               has no visible effect; users of such displays may want to select
-              <literal>none</literal>.
+              `none`.
             '';
           };
 
@@ -407,7 +407,7 @@ in
         cache32Bit = mkOption {
           default = false;
           type = types.bool;
-          description = ''
+          description = lib.mdDoc ''
             Generate system fonts cache for 32-bit applications.
           '';
         };
@@ -415,8 +415,8 @@ in
         allowBitmaps = mkOption {
           type = types.bool;
           default = true;
-          description = ''
+          description = lib.mdDoc ''
-            Allow bitmap fonts. Set to <literal>false</literal> to ban all
+            Allow bitmap fonts. Set to `false` to ban all
             bitmap fonts.
           '';
         };
@@ -424,8 +424,8 @@ in
         allowType1 = mkOption {
           type = types.bool;
           default = false;
-          description = ''
+          description = lib.mdDoc ''
-            Allow Type-1 fonts. Default is <literal>false</literal> because of
+            Allow Type-1 fonts. Default is `false` because of
             poor rendering.
           '';
         };
@@ -433,7 +433,7 @@ in
         useEmbeddedBitmaps = mkOption {
           type = types.bool;
           default = false;
-          description = "Use embedded bitmaps in fonts like Calibri.";
+          description = lib.mdDoc "Use embedded bitmaps in fonts like Calibri.";
         };
 
       };

third_party/nixpkgs/nixos/modules/config/fonts/fontdir.nix

@@ -30,9 +30,9 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to create a directory with links to all fonts in
-          <filename>/run/current-system/sw/share/X11/fonts</filename>.
+          {file}`/run/current-system/sw/share/X11/fonts`.
         '';
       };
 
@@ -40,9 +40,9 @@ in
         type = types.bool;
         default = config.programs.xwayland.enable;
         defaultText = literalExpression "config.programs.xwayland.enable";
-        description = ''
+        description = lib.mdDoc ''
           Whether to decompress fonts in
-          <filename>/run/current-system/sw/share/X11/fonts</filename>.
+          {file}`/run/current-system/sw/share/X11/fonts`.
         '';
       };
 

third_party/nixpkgs/nixos/modules/config/fonts/fonts.nix

@@ -57,13 +57,13 @@ in
         type = types.listOf types.path;
         default = [];
         example = literalExpression "[ pkgs.dejavu_fonts ]";
-        description = "List of primary font paths.";
+        description = lib.mdDoc "List of primary font paths.";
       };
 
       enableDefaultFonts = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Enable a basic set of fonts providing several font styles
           and families and reasonable coverage of Unicode.
         '';

third_party/nixpkgs/nixos/modules/config/fonts/ghostscript.nix

@@ -11,7 +11,7 @@ with lib;
       enableGhostscriptFonts = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to add the fonts provided by Ghostscript (such as
           various URW fonts and the “Base-14” Postscript fonts) to the
           list of system fonts, making them available to X11

third_party/nixpkgs/nixos/modules/config/gnu.nix

@@ -5,7 +5,7 @@
     gnu = lib.mkOption {
       type = lib.types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         When enabled, GNU software is chosen by default whenever a there is
         a choice between GNU and non-GNU software (e.g., GNU lsh
         vs. OpenSSH).

third_party/nixpkgs/nixos/modules/config/gtk/gtk-icon-cache.nix

@@ -7,7 +7,7 @@ with lib;
       type = types.bool;
       default = config.services.xserver.enable;
       defaultText = literalExpression "config.services.xserver.enable";
-      description = ''
+      description = lib.mdDoc ''
         Whether to build icon theme caches for GTK applications.
       '';
     };

third_party/nixpkgs/nixos/modules/config/i18n.nix

@@ -21,7 +21,7 @@ with lib;
           }
         '';
         example = literalExpression "pkgs.glibcLocales";
-        description = ''
+        description = lib.mdDoc ''
           Customized pkg.glibcLocales package.
 
           Changing this option can disable handling of i18n.defaultLocale
@@ -33,7 +33,7 @@ with lib;
         type = types.str;
         default = "en_US.UTF-8";
         example = "nl_NL.UTF-8";
-        description = ''
+        description = lib.mdDoc ''
           The default locale.  It determines the language for program
           messages, the format for dates and times, sort order, and so on.
           It also determines the character set, such as UTF-8.
@@ -44,10 +44,10 @@ with lib;
         type = types.attrsOf types.str;
         default = {};
         example = { LC_MESSAGES = "en_US.UTF-8"; LC_TIME = "de_DE.UTF-8"; };
-        description = ''
+        description = lib.mdDoc ''
           A set of additional system-wide locale settings other than
-          <literal>LANG</literal> which can be configured with
+          `LANG` which can be configured with
-          <option>i18n.defaultLocale</option>.
+          {option}`i18n.defaultLocale`.
         '';
       };
 
@@ -57,6 +57,7 @@ with lib;
           (builtins.map (l: (replaceStrings [ "utf8" "utf-8" "UTF8" ] [ "UTF-8" "UTF-8" "UTF-8" ] l) + "/UTF-8") (
             [
               "C.UTF-8"
+              "en_US.UTF-8"
               config.i18n.defaultLocale
             ] ++ (attrValues (filterAttrs (n: v: n != "LANGUAGE") config.i18n.extraLocaleSettings))
           ));
@@ -70,12 +71,11 @@ with lib;
             ))
         '';
         example = ["en_US.UTF-8/UTF-8" "nl_NL.UTF-8/UTF-8" "nl_NL/ISO-8859-1"];
-        description = ''
+        description = lib.mdDoc ''
           List of locales that the system should support.  The value
-          <literal>"all"</literal> means that all locales supported by
+          `"all"` means that all locales supported by
           Glibc will be installed.  A full list of supported locales
-          can be found at <link
+          can be found at <https://sourceware.org/git/?p=glibc.git;a=blob;f=localedata/SUPPORTED>.
-          xlink:href="https://sourceware.org/git/?p=glibc.git;a=blob;f=localedata/SUPPORTED"/>.
         '';
       };
 

third_party/nixpkgs/nixos/modules/config/iproute2.nix

@@ -11,7 +11,7 @@ in
     rttablesExtraConfig = mkOption {
       type = types.lines;
       default = "";
-      description = ''
+      description = lib.mdDoc ''
         Verbatim lines to add to /etc/iproute2/rt_tables
       '';
     };

third_party/nixpkgs/nixos/modules/config/krb5/default.nix

@@ -85,9 +85,9 @@ in {
         default = pkgs.krb5Full;
         defaultText = literalExpression "pkgs.krb5Full";
         example = literalExpression "pkgs.heimdal";
-        description = ''
+        description = lib.mdDoc ''
           The Kerberos implementation that will be present in
-          <literal>environment.systemPackages</literal> after enabling this
+          `environment.systemPackages` after enabling this
           service.
         '';
       };
@@ -101,7 +101,7 @@ in {
             default_realm = "ATHENA.MIT.EDU";
           };
         '';
-        description = ''
+        description = lib.mdDoc ''
           Settings used by the Kerberos V5 library.
         '';
       };
@@ -121,7 +121,7 @@ in {
           };
         '';
         apply = attrs: filterEmbeddedMetadata attrs;
-        description = "Realm-specific contact information and settings.";
+        description = lib.mdDoc "Realm-specific contact information and settings.";
       };
 
       domain_realm = mkOption {
@@ -134,7 +134,7 @@ in {
           };
         '';
         apply = attrs: filterEmbeddedMetadata attrs;
-        description = ''
+        description = lib.mdDoc ''
           Map of server hostnames to Kerberos realms.
         '';
       };
@@ -153,7 +153,7 @@ in {
           };
         '';
         apply = attrs: filterEmbeddedMetadata attrs;
-        description = ''
+        description = lib.mdDoc ''
           Authentication paths for non-hierarchical cross-realm authentication.
         '';
       };
@@ -174,7 +174,7 @@ in {
           };
         '';
         apply = attrs: filterEmbeddedMetadata attrs;
-        description = ''
+        description = lib.mdDoc ''
           Settings used by some Kerberos V5 applications.
         '';
       };
@@ -190,7 +190,7 @@ in {
           };
         '';
         apply = attrs: filterEmbeddedMetadata attrs;
-        description = ''
+        description = lib.mdDoc ''
           Controls plugin module registration.
         '';
       };
@@ -235,14 +235,14 @@ in {
             admin_server = SYSLOG:NOTICE
             default      = SYSLOG:NOTICE
         '';
-        description = ''
+        description = lib.mdDoc ''
-          Verbatim <literal>krb5.conf</literal> configuration.  Note that this
+          Verbatim `krb5.conf` configuration.  Note that this
           is mutually exclusive with configuration via
-          <literal>libdefaults</literal>, <literal>realms</literal>,
+          `libdefaults`, `realms`,
-          <literal>domain_realm</literal>, <literal>capaths</literal>,
+          `domain_realm`, `capaths`,
-          <literal>appdefaults</literal>, <literal>plugins</literal> and
+          `appdefaults`, `plugins` and
-          <literal>extraConfig</literal> configuration options.  Consult
+          `extraConfig` configuration options.  Consult
-          <literal>man krb5.conf</literal> for documentation.
+          `man krb5.conf` for documentation.
         '';
       };
 
@@ -250,9 +250,9 @@ in {
         type = with types; nullOr str;
         default = null;
         example = "ATHENA.MIT.EDU";
-        description = ''
+        description = lib.mdDoc ''
           DEPRECATED, please use
-          <literal>krb5.libdefaults.default_realm</literal>.
+          `krb5.libdefaults.default_realm`.
         '';
       };
 
@@ -260,9 +260,9 @@ in {
         type = with types; nullOr str;
         default = null;
         example = "athena.mit.edu";
-        description = ''
+        description = lib.mdDoc ''
           DEPRECATED, please create a map of server hostnames to Kerberos realms
-          in <literal>krb5.domain_realm</literal>.
+          in `krb5.domain_realm`.
         '';
       };
 
@@ -270,9 +270,9 @@ in {
         type = with types; nullOr str;
         default = null;
         example = "kerberos.mit.edu";
-        description = ''
+        description = lib.mdDoc ''
-          DEPRECATED, please pass a <literal>kdc</literal> attribute to a realm
+          DEPRECATED, please pass a `kdc` attribute to a realm
-          in <literal>krb5.realms</literal>.
+          in `krb5.realms`.
         '';
       };
 
@@ -280,9 +280,9 @@ in {
         type = with types; nullOr str;
         default = null;
         example = "kerberos.mit.edu";
-        description = ''
+        description = lib.mdDoc ''
-          DEPRECATED, please pass an <literal>admin_server</literal> attribute
+          DEPRECATED, please pass an `admin_server` attribute
-          to a realm in <literal>krb5.realms</literal>.
+          to a realm in `krb5.realms`.
         '';
       };
     };

third_party/nixpkgs/nixos/modules/config/ldap.nix

@@ -64,34 +64,34 @@ in
       loginPam = mkOption {
         type = types.bool;
         default = true;
-        description = "Whether to include authentication against LDAP in login PAM.";
+        description = lib.mdDoc "Whether to include authentication against LDAP in login PAM.";
       };
 
       nsswitch = mkOption {
         type = types.bool;
         default = true;
-        description = "Whether to include lookup against LDAP in NSS.";
+        description = lib.mdDoc "Whether to include lookup against LDAP in NSS.";
       };
 
       server = mkOption {
         type = types.str;
         example = "ldap://ldap.example.org/";
-        description = "The URL of the LDAP server.";
+        description = lib.mdDoc "The URL of the LDAP server.";
       };
 
       base = mkOption {
         type = types.str;
         example = "dc=example,dc=org";
-        description = "The distinguished name of the search base.";
+        description = lib.mdDoc "The distinguished name of the search base.";
       };
 
       useTLS = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           If enabled, use TLS (encryption) over an LDAP (port 389)
           connection.  The alternative is to specify an LDAPS server (port
-          636) in <option>users.ldap.server</option> or to forego
+          636) in {option}`users.ldap.server` or to forego
           security.
         '';
       };
@@ -99,7 +99,7 @@ in
       timeLimit = mkOption {
         default = 0;
         type = types.int;
-        description = ''
+        description = lib.mdDoc ''
           Specifies the time limit (in seconds) to use when performing
           searches. A value of zero (0), which is the default, is to
           wait indefinitely for searches to be completed.
@@ -110,7 +110,7 @@ in
         enable = mkOption {
           type = types.bool;
           default = false;
-          description = ''
+          description = lib.mdDoc ''
             Whether to let the nslcd daemon (nss-pam-ldapd) handle the
             LDAP lookups for NSS and PAM. This can improve performance,
             and if you need to bind to the LDAP server with a password,
@@ -125,9 +125,9 @@ in
         extraConfig = mkOption {
           default =  "";
           type = types.lines;
-          description = ''
+          description = lib.mdDoc ''
             Extra configuration options that will be added verbatim at
-            the end of the nslcd configuration file (<literal>nslcd.conf(5)</literal>).
+            the end of the nslcd configuration file (`nslcd.conf(5)`).
           '' ;
         } ;
 
@@ -135,7 +135,7 @@ in
           default = "";
           example = "cn=admin,dc=example,dc=com";
           type = types.str;
-          description = ''
+          description = lib.mdDoc ''
             The distinguished name to use to bind to the LDAP server
             when the root user tries to modify a user's password.
           '';
@@ -145,7 +145,7 @@ in
           default = "";
           example = "/run/keys/nslcd.rootpwmodpw";
           type = types.str;
-          description = ''
+          description = lib.mdDoc ''
             The path to a file containing the credentials with which to bind to
             the LDAP server if the root user tries to change a user's password.
           '';
@@ -157,7 +157,7 @@ in
           default = "";
           example = "cn=admin,dc=example,dc=com";
           type = types.str;
-          description = ''
+          description = lib.mdDoc ''
             The distinguished name to bind to the LDAP server with. If this
             is not specified, an anonymous bind will be done.
           '';
@@ -166,7 +166,7 @@ in
         passwordFile = mkOption {
           default = "/etc/ldap/bind.password";
           type = types.str;
-          description = ''
+          description = lib.mdDoc ''
             The path to a file containing the credentials to use when binding
             to the LDAP server (if not binding anonymously).
           '';
@@ -175,10 +175,10 @@ in
         timeLimit = mkOption {
           default = 30;
           type = types.int;
-          description = ''
+          description = lib.mdDoc ''
             Specifies the time limit (in seconds) to use when connecting
             to the directory server. This is distinct from the time limit
-            specified in <option>users.ldap.timeLimit</option> and affects
+            specified in {option}`users.ldap.timeLimit` and affects
             the initial server connection only.
           '';
         };
@@ -205,12 +205,12 @@ in
       extraConfig = mkOption {
         default = "";
         type = types.lines;
-        description = ''
+        description = lib.mdDoc ''
           Extra configuration options that will be added verbatim at
-          the end of the ldap configuration file (<literal>ldap.conf(5)</literal>).
+          the end of the ldap configuration file (`ldap.conf(5)`).
-          If <option>users.ldap.daemon</option> is enabled, this
+          If {option}`users.ldap.daemon` is enabled, this
           configuration will not be used. In that case, use
-          <option>users.ldap.daemon.extraConfig</option> instead.
+          {option}`users.ldap.daemon.extraConfig` instead.
         '' ;
       };
 

third_party/nixpkgs/nixos/modules/config/locale.nix

@@ -22,9 +22,8 @@ in
         default = null;
         type = timezone;
         example = "America/New_York";
-        description = ''
+        description = lib.mdDoc ''
-          The time zone used when displaying times and dates. See <link
+          The time zone used when displaying times and dates. See <https://en.wikipedia.org/wiki/List_of_tz_database_time_zones>
-          xlink:href="https://en.wikipedia.org/wiki/List_of_tz_database_time_zones"/>
           for a comprehensive list of possible values for this setting.
 
           If null, the timezone will default to UTC and can be set imperatively
@@ -35,7 +34,7 @@ in
       hardwareClockInLocalTime = mkOption {
         default = false;
         type = types.bool;
-        description = "If set, keep the hardware clock in local time instead of UTC.";
+        description = lib.mdDoc "If set, keep the hardware clock in local time instead of UTC.";
       };
 
     };
@@ -44,18 +43,18 @@ in
 
       latitude = mkOption {
         type = types.float;
-        description = ''
+        description = lib.mdDoc ''
           Your current latitude, between
-          <literal>-90.0</literal> and <literal>90.0</literal>. Must be provided
+          `-90.0` and `90.0`. Must be provided
           along with longitude.
         '';
       };
 
       longitude = mkOption {
         type = types.float;
-        description = ''
+        description = lib.mdDoc ''
           Your current longitude, between
-          between <literal>-180.0</literal> and <literal>180.0</literal>. Must be
+          between `-180.0` and `180.0`. Must be
           provided along with latitude.
         '';
       };
@@ -63,9 +62,9 @@ in
       provider = mkOption {
         type = types.enum [ "manual" "geoclue2" ];
         default = "manual";
-        description = ''
+        description = lib.mdDoc ''
           The location provider to use for determining your location. If set to
-          <literal>manual</literal> you must also provide latitude/longitude.
+          `manual` you must also provide latitude/longitude.
         '';
       };
 

third_party/nixpkgs/nixos/modules/config/networking.nix

@@ -28,7 +28,7 @@ in
           "192.168.0.2" = [ "fileserver.local" "nameserver.local" ];
         };
       '';
-      description = ''
+      description = lib.mdDoc ''
         Locally defined maps of hostnames to IP addresses.
       '';
     };
@@ -37,8 +37,8 @@ in
       type = types.listOf types.path;
       defaultText = literalDocBook "Hosts from <option>networking.hosts</option> and <option>networking.extraHosts</option>";
       example = literalExpression ''[ "''${pkgs.my-blocklist-package}/share/my-blocklist/hosts" ]'';
-      description = ''
+      description = lib.mdDoc ''
-        Files that should be concatenated together to form <filename>/etc/hosts</filename>.
+        Files that should be concatenated together to form {file}`/etc/hosts`.
       '';
     };
 
@@ -46,9 +46,9 @@ in
       type = types.lines;
       default = "";
       example = "192.168.0.1 lanlocalhost";
-      description = ''
+      description = lib.mdDoc ''
-        Additional verbatim entries to be appended to <filename>/etc/hosts</filename>.
+        Additional verbatim entries to be appended to {file}`/etc/hosts`.
-        For adding hosts from derivation results, use <option>networking.hostFiles</option> instead.
+        For adding hosts from derivation results, use {option}`networking.hostFiles` instead.
       '';
     };
 
@@ -60,7 +60,7 @@ in
         "3.nixos.pool.ntp.org"
       ];
       type = types.listOf types.str;
-      description = ''
+      description = lib.mdDoc ''
         The set of NTP servers from which to synchronise.
       '';
     };
@@ -70,7 +70,7 @@ in
       default = lib.mkOption {
         type = types.nullOr types.str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           This option specifies the default value for httpProxy, httpsProxy, ftpProxy and rsyncProxy.
         '';
         example = "http://127.0.0.1:3128";
@@ -80,7 +80,7 @@ in
         type = types.nullOr types.str;
         default = cfg.proxy.default;
         defaultText = literalExpression "config.${opt.proxy.default}";
-        description = ''
+        description = lib.mdDoc ''
           This option specifies the http_proxy environment variable.
         '';
         example = "http://127.0.0.1:3128";
@@ -90,7 +90,7 @@ in
         type = types.nullOr types.str;
         default = cfg.proxy.default;
         defaultText = literalExpression "config.${opt.proxy.default}";
-        description = ''
+        description = lib.mdDoc ''
           This option specifies the https_proxy environment variable.
         '';
         example = "http://127.0.0.1:3128";
@@ -100,7 +100,7 @@ in
         type = types.nullOr types.str;
         default = cfg.proxy.default;
         defaultText = literalExpression "config.${opt.proxy.default}";
-        description = ''
+        description = lib.mdDoc ''
           This option specifies the ftp_proxy environment variable.
         '';
         example = "http://127.0.0.1:3128";
@@ -110,7 +110,7 @@ in
         type = types.nullOr types.str;
         default = cfg.proxy.default;
         defaultText = literalExpression "config.${opt.proxy.default}";
-        description = ''
+        description = lib.mdDoc ''
           This option specifies the rsync_proxy environment variable.
         '';
         example = "http://127.0.0.1:3128";
@@ -120,7 +120,7 @@ in
         type = types.nullOr types.str;
         default = cfg.proxy.default;
         defaultText = literalExpression "config.${opt.proxy.default}";
-        description = ''
+        description = lib.mdDoc ''
           This option specifies the all_proxy environment variable.
         '';
         example = "http://127.0.0.1:3128";
@@ -129,7 +129,7 @@ in
       noProxy = lib.mkOption {
         type = types.nullOr types.str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           This option specifies the no_proxy environment variable.
           If a default proxy is used and noProxy is null,
           then noProxy will be set to 127.0.0.1,localhost.

third_party/nixpkgs/nixos/modules/config/no-x-libs.nix

@@ -10,7 +10,7 @@ with lib;
     environment.noXlibs = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Switch off the options in the default configuration that
         require X11 libraries. This includes client-side font
         configuration and SSH forwarding of X11 authentication

third_party/nixpkgs/nixos/modules/config/nsswitch.nix

@@ -13,10 +13,10 @@ with lib;
       type = types.listOf types.path;
       internal = true;
       default = [];
-      description = ''
+      description = lib.mdDoc ''
         Search path for NSS (Name Service Switch) modules.  This allows
         several DNS resolution methods to be specified via
-        <filename>/etc/nsswitch.conf</filename>.
+        {file}`/etc/nsswitch.conf`.
       '';
       apply = list:
         {
@@ -28,8 +28,8 @@ with lib;
     system.nssDatabases = {
       passwd = mkOption {
         type = types.listOf types.str;
-        description = ''
+        description = lib.mdDoc ''
-          List of passwd entries to configure in <filename>/etc/nsswitch.conf</filename>.
+          List of passwd entries to configure in {file}`/etc/nsswitch.conf`.
 
           Note that "files" is always prepended while "systemd" is appended if nscd is enabled.
 
@@ -40,8 +40,8 @@ with lib;
 
       group = mkOption {
         type = types.listOf types.str;
-        description = ''
+        description = lib.mdDoc ''
-          List of group entries to configure in <filename>/etc/nsswitch.conf</filename>.
+          List of group entries to configure in {file}`/etc/nsswitch.conf`.
 
           Note that "files" is always prepended while "systemd" is appended if nscd is enabled.
 
@@ -52,8 +52,8 @@ with lib;
 
       shadow = mkOption {
         type = types.listOf types.str;
-        description = ''
+        description = lib.mdDoc ''
-          List of shadow entries to configure in <filename>/etc/nsswitch.conf</filename>.
+          List of shadow entries to configure in {file}`/etc/nsswitch.conf`.
 
           Note that "files" is always prepended.
 
@@ -64,8 +64,8 @@ with lib;
 
       hosts = mkOption {
         type = types.listOf types.str;
-        description = ''
+        description = lib.mdDoc ''
-          List of hosts entries to configure in <filename>/etc/nsswitch.conf</filename>.
+          List of hosts entries to configure in {file}`/etc/nsswitch.conf`.
 
           Note that "files" is always prepended, and "dns" and "myhostname" are always appended.
 
@@ -76,8 +76,8 @@ with lib;
 
       services = mkOption {
         type = types.listOf types.str;
-        description = ''
+        description = lib.mdDoc ''
-          List of services entries to configure in <filename>/etc/nsswitch.conf</filename>.
+          List of services entries to configure in {file}`/etc/nsswitch.conf`.
 
           Note that "files" is always prepended.
 

third_party/nixpkgs/nixos/modules/config/power-management.nix

@@ -20,7 +20,7 @@ in
         type = types.bool;
         default = true;
         description =
-          ''
+          lib.mdDoc ''
             Whether to enable power management.  This includes support
             for suspend-to-RAM and powersave features on laptops.
           '';
@@ -29,7 +29,7 @@ in
       resumeCommands = mkOption {
         type = types.lines;
         default = "";
-        description = "Commands executed after the system resumes from suspend-to-RAM.";
+        description = lib.mdDoc "Commands executed after the system resumes from suspend-to-RAM.";
       };
 
       powerUpCommands = mkOption {
@@ -39,7 +39,7 @@ in
           "''${pkgs.hdparm}/sbin/hdparm -B 255 /dev/sda"
         '';
         description =
-          ''
+          lib.mdDoc ''
             Commands executed when the machine powers up.  That is,
             they're executed both when the system first boots and when
             it resumes from suspend or hibernation.
@@ -53,7 +53,7 @@ in
           "''${pkgs.hdparm}/sbin/hdparm -B 255 /dev/sda"
         '';
         description =
-          ''
+          lib.mdDoc ''
             Commands executed when the machine powers down.  That is,
             they're executed both when the system shuts down and when
             it goes to suspend or hibernation.

third_party/nixpkgs/nixos/modules/config/pulseaudio.nix

@@ -89,7 +89,7 @@ in {
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to enable the PulseAudio sound server.
         '';
       };
@@ -97,7 +97,7 @@ in {
       systemWide = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           If false, a PulseAudio server is launched automatically for
           each user that tries to use the sound system. The server runs
           with user privileges. If true, one system-wide PulseAudio
@@ -112,7 +112,7 @@ in {
       support32Bit = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to include the 32-bit pulseaudio libraries in the system or not.
           This is only useful on 64-bit systems and currently limited to x86_64-linux.
         '';
@@ -120,7 +120,7 @@ in {
 
       configFile = mkOption {
         type = types.nullOr types.path;
-        description = ''
+        description = lib.mdDoc ''
           The path to the default configuration options the PulseAudio server
           should use. By default, the "default.pa" configuration
           from the PulseAudio distribution is used.
@@ -130,8 +130,8 @@ in {
       extraConfig = mkOption {
         type = types.lines;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
-          Literal string to append to <literal>configFile</literal>
+          Literal string to append to `configFile`
           and the config file generated by the pulseaudio module.
         '';
       };
@@ -139,7 +139,7 @@ in {
       extraClientConf = mkOption {
         type = types.lines;
         default = "";
-        description = ''
+        description = lib.mdDoc ''
           Extra configuration appended to pulse/client.conf file.
         '';
       };
@@ -151,10 +151,10 @@ in {
                   else pkgs.pulseaudio;
         defaultText = literalExpression "pkgs.pulseaudio";
         example = literalExpression "pkgs.pulseaudioFull";
-        description = ''
+        description = lib.mdDoc ''
           The PulseAudio derivation to use.  This can be used to enable
           features (such as JACK support, Bluetooth) via the
-          <literal>pulseaudioFull</literal> package.
+          `pulseaudioFull` package.
         '';
       };
 
@@ -162,7 +162,7 @@ in {
         type = types.listOf types.package;
         default = [];
         example = literalExpression "[ pkgs.pulseaudio-modules-bt ]";
-        description = ''
+        description = lib.mdDoc ''
           Extra pulseaudio modules to use. This is intended for out-of-tree
           pulseaudio modules like extra bluetooth codecs.
 
@@ -174,7 +174,7 @@ in {
         logLevel = mkOption {
           type = types.str;
           default = "notice";
-          description = ''
+          description = lib.mdDoc ''
             The log level that the system-wide pulseaudio daemon should use,
             if activated.
           '';
@@ -183,7 +183,7 @@ in {
         config = mkOption {
           type = types.attrsOf types.unspecified;
           default = {};
-          description = "Config of the pulse daemon. See <literal>man pulse-daemon.conf</literal>.";
+          description = lib.mdDoc "Config of the pulse daemon. See `man pulse-daemon.conf`.";
           example = literalExpression ''{ realtime-scheduling = "yes"; }'';
         };
       };
@@ -205,7 +205,7 @@ in {
             type = types.listOf types.str;
             default = [];
             example = literalExpression ''[ "127.0.0.1" "192.168.1.0/24" ]'';
-            description = ''
+            description = lib.mdDoc ''
               A list of IP subnets that are allowed to stream to the server.
             '';
           };

third_party/nixpkgs/nixos/modules/config/qt5.nix

@@ -45,41 +45,17 @@ in
           ["lxqt" "lxqt-qtplugin"]
           ["libsForQt5" "plasma-integration"]
         ];
-        description = ''
+        description = lib.mdDoc ''
-          Selects the platform theme to use for Qt5 applications.</para>
+          Selects the platform theme to use for Qt5 applications.
-          <para>The options are
+
-          <variablelist>
+          The options are
-            <varlistentry>
+          - `gtk`: Use GTK theme with [qtstyleplugins](https://github.com/qt/qtstyleplugins)
-              <term><literal>gtk</literal></term>
+          - `gnome`: Use GNOME theme with [qgnomeplatform](https://github.com/FedoraQt/QGnomePlatform)
-              <listitem><para>Use GTK theme with
+          - `lxqt`: Use LXQt style set using the [lxqt-config-appearance](https://github.com/lxqt/lxqt-config)
-                <link xlink:href="https://github.com/qt/qtstyleplugins">qtstyleplugins</link>
+             application.
-              </para></listitem>
+          - `qt5ct`: Use Qt style set using the [qt5ct](https://sourceforge.net/projects/qt5ct/)
-            </varlistentry>
+             application.
-            <varlistentry>
+          - `kde`: Use Qt settings from Plasma.
-              <term><literal>gnome</literal></term>
-              <listitem><para>Use GNOME theme with
-                <link xlink:href="https://github.com/FedoraQt/QGnomePlatform">qgnomeplatform</link>
-              </para></listitem>
-            </varlistentry>
-            <varlistentry>
-              <term><literal>lxqt</literal></term>
-              <listitem><para>Use LXQt style set using the
-                <link xlink:href="https://github.com/lxqt/lxqt-config">lxqt-config-appearance</link>
-                application.
-              </para></listitem>
-            </varlistentry>
-            <varlistentry>
-              <term><literal>qt5ct</literal></term>
-              <listitem><para>Use Qt style set using the
-                <link xlink:href="https://sourceforge.net/projects/qt5ct/">qt5ct</link>
-                application.
-              </para></listitem>
-            </varlistentry>
-            <varlistentry>
-              <term><literal>kde</literal></term>
-              <listitem><para>Use Qt settings from Plasma.</para></listitem>
-            </varlistentry>
-          </variablelist>
         '';
       };
 
@@ -97,27 +73,14 @@ in
           "adwaita-qt"
           ["libsForQt5" "qtstyleplugins"]
         ];
-        description = ''
+        description = lib.mdDoc ''
-          Selects the style to use for Qt5 applications.</para>
+          Selects the style to use for Qt5 applications.
-          <para>The options are
+
-          <variablelist>
+          The options are
-            <varlistentry>
+          - `adwaita`, `adwaita-dark`: Use Adwaita Qt style with
-              <term><literal>adwaita</literal></term>
+            [adwaita](https://github.com/FedoraQt/adwaita-qt)
-              <term><literal>adwaita-dark</literal></term>
+          - `cleanlooks`, `gtk2`, `motif`, `plastique`: Use styles from
-              <listitem><para>Use Adwaita Qt style with
+            [qtstyleplugins](https://github.com/qt/qtstyleplugins)
-                <link xlink:href="https://github.com/FedoraQt/adwaita-qt">adwaita</link>
-              </para></listitem>
-            </varlistentry>
-            <varlistentry>
-              <term><literal>cleanlooks</literal></term>
-              <term><literal>gtk2</literal></term>
-              <term><literal>motif</literal></term>
-              <term><literal>plastique</literal></term>
-              <listitem><para>Use styles from
-                <link xlink:href="https://github.com/qt/qtstyleplugins">qtstyleplugins</link>
-              </para></listitem>
-            </varlistentry>
-          </variablelist>
         '';
       };
     };

third_party/nixpkgs/nixos/modules/config/resolvconf.nix

@@ -49,7 +49,7 @@ in
         type = types.bool;
         default = !(config.environment.etc ? "resolv.conf");
         defaultText = literalExpression ''!(config.environment.etc ? "resolv.conf")'';
-        description = ''
+        description = lib.mdDoc ''
           Whether DNS configuration is managed by resolvconf.
         '';
       };
@@ -58,9 +58,9 @@ in
         type = types.package;
         default = pkgs.openresolv;
         defaultText = literalExpression "pkgs.openresolv";
-        description = ''
+        description = lib.mdDoc ''
-          The package that provides the system-wide resolvconf command. Defaults to <literal>openresolv</literal>
+          The package that provides the system-wide resolvconf command. Defaults to `openresolv`
-          if this module is enabled. Otherwise, can be used by other modules (for example <option>services.resolved</option>) to
+          if this module is enabled. Otherwise, can be used by other modules (for example {option}`services.resolved`) to
           provide a compatibility layer.
 
           This option generally shouldn't be set by the user.
@@ -70,7 +70,7 @@ in
       dnsSingleRequest = lib.mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Recent versions of glibc will issue both ipv4 (A) and ipv6 (AAAA)
           address queries at the same time, from the same port. Sometimes upstream
           routers will systemically drop the ipv4 queries. The symptom of this problem is
@@ -83,9 +83,9 @@ in
       dnsExtensionMechanism = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
-          Enable the <code>edns0</code> option in <filename>resolv.conf</filename>. With
+          Enable the `edns0` option in {file}`resolv.conf`. With
-          that option set, <code>glibc</code> supports use of the extension mechanisms for
+          that option set, `glibc` supports use of the extension mechanisms for
           DNS (EDNS) specified in RFC 2671. The most popular user of that feature is DNSSEC,
           which does not work without it.
         '';
@@ -95,8 +95,8 @@ in
         type = types.lines;
         default = "";
         example = "libc=NO";
-        description = ''
+        description = lib.mdDoc ''
-          Extra configuration to append to <filename>resolvconf.conf</filename>.
+          Extra configuration to append to {file}`resolvconf.conf`.
         '';
       };
 
@@ -104,15 +104,15 @@ in
         type = types.listOf types.str;
         default = [];
         example = [ "ndots:1" "rotate" ];
-        description = ''
+        description = lib.mdDoc ''
-          Set the options in <filename>/etc/resolv.conf</filename>.
+          Set the options in {file}`/etc/resolv.conf`.
         '';
       };
 
       useLocalResolver = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Use local DNS server for resolving.
         '';
       };

third_party/nixpkgs/nixos/modules/config/shells-environment.nix

@@ -35,7 +35,7 @@ in
     environment.variables = mkOption {
       default = {};
       example = { EDITOR = "nvim"; VISUAL = "nvim"; };
-      description = ''
+      description = lib.mdDoc ''
         A set of environment variables used in the global environment.
         These variables will be set on shell initialisation (e.g. in /etc/profile).
         The value of each variable can be either a string or a list of
@@ -48,7 +48,7 @@ in
 
     environment.profiles = mkOption {
       default = [];
-      description = ''
+      description = lib.mdDoc ''
         A list of profiles used to setup the global environment.
       '';
       type = types.listOf types.str;
@@ -57,10 +57,10 @@ in
     environment.profileRelativeEnvVars = mkOption {
       type = types.attrsOf (types.listOf types.str);
       example = { PATH = [ "/bin" ]; MANPATH = [ "/man" "/share/man" ]; };
-      description = ''
+      description = lib.mdDoc ''
         Attribute set of environment variable.  Each attribute maps to a list
         of relative paths.  Each relative path is appended to the each profile
-        of <option>environment.profiles</option> to form the content of the
+        of {option}`environment.profiles` to form the content of the
         corresponding environment variable.
       '';
     };
@@ -68,7 +68,7 @@ in
     # !!! isn't there a better way?
     environment.extraInit = mkOption {
       default = "";
-      description = ''
+      description = lib.mdDoc ''
         Shell script code called during global environment initialisation
         after all variables and profileVariables have been set.
         This code is assumed to be shell-independent, which means you should
@@ -79,7 +79,7 @@ in
 
     environment.shellInit = mkOption {
       default = "";
-      description = ''
+      description = lib.mdDoc ''
         Shell script code called during shell initialisation.
         This code is assumed to be shell-independent, which means you should
         stick to pure sh without sh word split.
@@ -89,7 +89,7 @@ in
 
     environment.loginShellInit = mkOption {
       default = "";
-      description = ''
+      description = lib.mdDoc ''
         Shell script code called during login shell initialisation.
         This code is assumed to be shell-independent, which means you should
         stick to pure sh without sh word split.
@@ -99,7 +99,7 @@ in
 
     environment.interactiveShellInit = mkOption {
       default = "";
-      description = ''
+      description = lib.mdDoc ''
         Shell script code called during interactive shell initialisation.
         This code is assumed to be shell-independent, which means you should
         stick to pure sh without sh word split.
@@ -109,17 +109,17 @@ in
 
     environment.shellAliases = mkOption {
       example = { l = null; ll = "ls -l"; };
-      description = ''
+      description = lib.mdDoc ''
         An attribute set that maps aliases (the top level attribute names in
         this option) to command strings or directly to build outputs. The
         aliases are added to all users' shells.
-        Aliases mapped to <code>null</code> are ignored.
+        Aliases mapped to `null` are ignored.
       '';
       type = with types; attrsOf (nullOr (either str path));
     };
 
     environment.homeBinInPath = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         Include ~/bin/ in $PATH.
       '';
       default = false;
@@ -127,7 +127,7 @@ in
     };
 
     environment.localBinInPath = mkOption {
-      description = ''
+      description = lib.mdDoc ''
         Add ~/.local/bin/ to $PATH
       '';
       default = false;
@@ -151,9 +151,9 @@ in
     environment.shells = mkOption {
       default = [];
       example = literalExpression "[ pkgs.bashInteractive pkgs.zsh ]";
-      description = ''
+      description = lib.mdDoc ''
         A list of permissible login shells for user accounts.
-        No need to mention <literal>/bin/sh</literal>
+        No need to mention `/bin/sh`
         here, it is placed into this list implicitly.
       '';
       type = types.listOf (types.either types.shellPackage types.path);

third_party/nixpkgs/nixos/modules/config/swap.nix

@@ -14,7 +14,7 @@ let
       enable = mkOption {
         default = false;
         type = types.bool;
-        description = ''
+        description = lib.mdDoc ''
           Encrypt swap device with a random key. This way you won't have a persistent swap device.
 
           WARNING: Don't try to hibernate when you have at least one swap partition with
@@ -31,7 +31,7 @@ let
         default = "aes-xts-plain64";
         example = "serpent-xts-plain64";
         type = types.str;
-        description = ''
+        description = lib.mdDoc ''
           Use specified cipher for randomEncryption.
 
           Hint: Run "cryptsetup benchmark" to see which one is fastest on your machine.
@@ -42,7 +42,7 @@ let
         default = "/dev/urandom";
         example = "/dev/random";
         type = types.str;
-        description = ''
+        description = lib.mdDoc ''
           Define the source of randomness to obtain a random key for encryption.
         '';
       };
@@ -50,7 +50,7 @@ let
       allowDiscards = mkOption {
         default = false;
         type = types.bool;
-        description = ''
+        description = lib.mdDoc ''
           Whether to allow TRIM requests to the underlying device. This option
           has security implications; please read the LUKS documentation before
           activating it.
@@ -67,7 +67,7 @@ let
       device = mkOption {
         example = "/dev/sda3";
         type = types.str;
-        description = "Path of the device or swap file.";
+        description = lib.mdDoc "Path of the device or swap file.";
       };
 
       label = mkOption {
@@ -82,7 +82,7 @@ let
         default = null;
         example = 2048;
         type = types.nullOr types.int;
-        description = ''
+        description = lib.mdDoc ''
           If this option is set, ‘device’ is interpreted as the
           path of a swapfile that will be created automatically
           with the indicated size (in megabytes).
@@ -93,7 +93,7 @@ let
         default = null;
         example = 2048;
         type = types.nullOr types.int;
-        description = ''
+        description = lib.mdDoc ''
           Specify the priority of the swap device. Priority is a value between 0 and 32767.
           Higher numbers indicate higher priority.
           null lets the kernel choose a priority, which will show up as a negative value.
@@ -108,7 +108,7 @@ let
           source = "/dev/random";
         };
         type = types.coercedTo types.bool randomEncryptionCoerce (types.submodule randomEncryptionOpts);
-        description = ''
+        description = lib.mdDoc ''
           Encrypt swap device with a random key. This way you won't have a persistent swap device.
 
           HINT: run "cryptsetup benchmark" to test cipher performance on your machine.
@@ -127,7 +127,7 @@ let
         default = null;
         example = "once";
         type = types.nullOr (types.enum ["once" "pages" "both" ]);
-        description = ''
+        description = lib.mdDoc ''
           Specify the discard policy for the swap device. If "once", then the
           whole swap space is discarded at swapon invocation. If "pages",
           asynchronous discard on freed pages is performed, before returning to
@@ -140,7 +140,7 @@ let
         default = [ "defaults" ];
         example = [ "nofail" ];
         type = types.listOf types.nonEmptyStr;
-        description = ''
+        description = lib.mdDoc ''
           Options used to mount the swap.
         '';
       };
@@ -181,13 +181,13 @@ in
         { device = "/var/swapfile"; }
         { label = "bigswap"; }
       ];
-      description = ''
+      description = lib.mdDoc ''
         The swap devices and swap files.  These must have been
-        initialised using <command>mkswap</command>.  Each element
+        initialised using {command}`mkswap`.  Each element
         should be an attribute set specifying either the path of the
-        swap device or file (<literal>device</literal>) or the label
+        swap device or file (`device`) or the label
-        of the swap device (<literal>label</literal>, see
+        of the swap device (`label`, see
-        <command>mkswap -L</command>).  Using a label is
+        {command}`mkswap -L`).  Using a label is
         recommended.
       '';
 

third_party/nixpkgs/nixos/modules/config/system-environment.nix

@@ -16,7 +16,7 @@ in
 
     environment.sessionVariables = mkOption {
       default = {};
-      description = ''
+      description = lib.mdDoc ''
         A set of environment variables used in the global environment.
         These variables will be set by PAM early in the login process.
 
@@ -25,12 +25,12 @@ in
         colon characters.
 
         Note, due to limitations in the PAM format values may not
-        contain the <literal>"</literal> character.
+        contain the `"` character.
 
         Also, these variables are merged into
-        <xref linkend="opt-environment.variables"/> and it is
+        [](#opt-environment.variables) and it is
         therefore not possible to use PAM style variables such as
-        <code>@{HOME}</code>.
+        `@{HOME}`.
       '';
       type = with types; attrsOf (either str (listOf str));
       apply = mapAttrs (n: v: if isList v then concatStringsSep ":" v else v);
@@ -58,7 +58,7 @@ in
         Also, these variables are merged into
         <xref linkend="opt-environment.profileRelativeEnvVars"/> and it is
         therefore not possible to use PAM style variables such as
-        <code>@{HOME}</code>.
+        <literal>@{HOME}</literal>.
       '';
     };
 

third_party/nixpkgs/nixos/modules/config/system-path.nix

@@ -64,14 +64,14 @@ in
         type = types.listOf types.package;
         default = [];
         example = literalExpression "[ pkgs.firefox pkgs.thunderbird ]";
-        description = ''
+        description = lib.mdDoc ''
           The set of packages that appear in
           /run/current-system/sw.  These packages are
           automatically available to all users, and are
           automatically updated every time you rebuild the system
           configuration.  (The latter is the main difference with
           installing them in the default profile,
-          <filename>/nix/var/nix/profiles/default</filename>.
+          {file}`/nix/var/nix/profiles/default`.
         '';
       };
 
@@ -109,20 +109,20 @@ in
         # to work.
         default = [];
         example = ["/"];
-        description = "List of directories to be symlinked in <filename>/run/current-system/sw</filename>.";
+        description = lib.mdDoc "List of directories to be symlinked in {file}`/run/current-system/sw`.";
       };
 
       extraOutputsToInstall = mkOption {
         type = types.listOf types.str;
         default = [ ];
         example = [ "doc" "info" "devdoc" ];
-        description = "List of additional package outputs to be symlinked into <filename>/run/current-system/sw</filename>.";
+        description = lib.mdDoc "List of additional package outputs to be symlinked into {file}`/run/current-system/sw`.";
       };
 
       extraSetup = mkOption {
         type = types.lines;
         default = "";
-        description = "Shell fragments to be run after the system environment has been created. This should only be used for things that need to modify the internals of the environment, e.g. generating MIME caches. The environment being built can be accessed at $out.";
+        description = lib.mdDoc "Shell fragments to be run after the system environment has been created. This should only be used for things that need to modify the internals of the environment, e.g. generating MIME caches. The environment being built can be accessed at $out.";
       };
 
     };

third_party/nixpkgs/nixos/modules/config/terminfo.nix

@@ -9,7 +9,7 @@ with lib;
   options.environment.enableAllTerminfo = with lib; mkOption {
     default = false;
     type = types.bool;
-    description = ''
+    description = lib.mdDoc ''
       Whether to install all terminfo outputs
     '';
   };

third_party/nixpkgs/nixos/modules/config/unix-odbc-drivers.nix

@@ -20,10 +20,10 @@ in {
       type = types.listOf types.package;
       default = [];
       example = literalExpression "with pkgs.unixODBCDrivers; [ sqlite psql ]";
-      description = ''
+      description = lib.mdDoc ''
         Specifies Unix ODBC drivers to be registered in
-        <filename>/etc/odbcinst.ini</filename>.  You may also want to
+        {file}`/etc/odbcinst.ini`.  You may also want to
-        add <literal>pkgs.unixODBC</literal> to the system path to get
+        add `pkgs.unixODBC` to the system path to get
         a command line client to connect to ODBC databases.
       '';
     };

third_party/nixpkgs/nixos/modules/config/users-groups.nix

@@ -6,12 +6,6 @@ let
   ids = config.ids;
   cfg = config.users;
 
-  isPasswdCompatible = str: !(hasInfix ":" str || hasInfix "\n" str);
-  passwdEntry = type: lib.types.addCheck type isPasswdCompatible // {
-    name = "passwdEntry ${type.name}";
-    description = "${type.description}, not containing newlines or colons";
-  };
-
   # Check whether a password hash will allow login.
   allowsLogin = hash:
     hash == "" # login without password
@@ -60,29 +54,29 @@ let
     options = {
 
       name = mkOption {
-        type = passwdEntry types.str;
+        type = types.passwdEntry types.str;
         apply = x: assert (builtins.stringLength x < 32 || abort "Username '${x}' is longer than 31 characters which is not allowed!"); x;
-        description = ''
+        description = lib.mdDoc ''
           The name of the user account. If undefined, the name of the
           attribute set will be used.
         '';
       };
 
       description = mkOption {
-        type = passwdEntry types.str;
+        type = types.passwdEntry types.str;
         default = "";
         example = "Alice Q. User";
-        description = ''
+        description = lib.mdDoc ''
           A short description of the user account, typically the
           user's full name.  This is actually the “GECOS” or “comment”
-          field in <filename>/etc/passwd</filename>.
+          field in {file}`/etc/passwd`.
         '';
       };
 
       uid = mkOption {
         type = with types; nullOr int;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           The account UID. If the UID is null, a free UID is picked on
           activation.
         '';
@@ -91,32 +85,32 @@ let
       isSystemUser = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Indicates if the user is a system user or not. This option
-          only has an effect if <option>uid</option> is
+          only has an effect if {option}`uid` is
-          <option>null</option>, in which case it determines whether
+          {option}`null`, in which case it determines whether
           the user's UID is allocated in the range for system users
           (below 500) or in the range for normal users (starting at
           1000).
-          Exactly one of <literal>isNormalUser</literal> and
+          Exactly one of `isNormalUser` and
-          <literal>isSystemUser</literal> must be true.
+          `isSystemUser` must be true.
         '';
       };
 
       isNormalUser = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Indicates whether this is an account for a “real” user. This
-          automatically sets <option>group</option> to
+          automatically sets {option}`group` to
-          <literal>users</literal>, <option>createHome</option> to
+          `users`, {option}`createHome` to
-          <literal>true</literal>, <option>home</option> to
+          `true`, {option}`home` to
-          <filename>/home/<replaceable>username</replaceable></filename>,
+          {file}`/home/«username»`,
-          <option>useDefaultShell</option> to <literal>true</literal>,
+          {option}`useDefaultShell` to `true`,
-          and <option>isSystemUser</option> to
+          and {option}`isSystemUser` to
-          <literal>false</literal>.
+          `false`.
-          Exactly one of <literal>isNormalUser</literal> and
+          Exactly one of `isNormalUser` and
-          <literal>isSystemUser</literal> must be true.
+          `isSystemUser` must be true.
         '';
       };
 
@@ -124,31 +118,31 @@ let
         type = types.str;
         apply = x: assert (builtins.stringLength x < 32 || abort "Group name '${x}' is longer than 31 characters which is not allowed!"); x;
         default = "";
-        description = "The user's primary group.";
+        description = lib.mdDoc "The user's primary group.";
       };
 
       extraGroups = mkOption {
         type = types.listOf types.str;
         default = [];
-        description = "The user's auxiliary groups.";
+        description = lib.mdDoc "The user's auxiliary groups.";
       };
 
       home = mkOption {
-        type = passwdEntry types.path;
+        type = types.passwdEntry types.path;
         default = "/var/empty";
-        description = "The user's home directory.";
+        description = lib.mdDoc "The user's home directory.";
       };
 
       homeMode = mkOption {
         type = types.strMatching "[0-7]{1,5}";
         default = "700";
-        description = "The user's home directory mode in numeric format. See chmod(1). The mode is only applied if <option>users.users.&lt;name&gt;.createHome</option> is true.";
+        description = lib.mdDoc "The user's home directory mode in numeric format. See chmod(1). The mode is only applied if {option}`users.users.<name>.createHome` is true.";
       };
 
       cryptHomeLuks = mkOption {
         type = with types; nullOr str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Path to encrypted luks device that contains
           the user's home directory.
         '';
@@ -157,28 +151,27 @@ let
       pamMount = mkOption {
         type = with types; attrsOf str;
         default = {};
-        description = ''
+        description = lib.mdDoc ''
           Attributes for user's entry in
-          <filename>pam_mount.conf.xml</filename>.
+          {file}`pam_mount.conf.xml`.
-          Useful attributes might include <code>path</code>,
+          Useful attributes might include `path`,
-          <code>options</code>, <code>fstype</code>, and <code>server</code>.
+          `options`, `fstype`, and `server`.
-          See <link
+          See <http://pam-mount.sourceforge.net/pam_mount.conf.5.html>
-          xlink:href="http://pam-mount.sourceforge.net/pam_mount.conf.5.html" />
           for more information.
         '';
       };
 
       shell = mkOption {
-        type = types.nullOr (types.either types.shellPackage (passwdEntry types.path));
+        type = types.nullOr (types.either types.shellPackage (types.passwdEntry types.path));
         default = pkgs.shadow;
         defaultText = literalExpression "pkgs.shadow";
         example = literalExpression "pkgs.bashInteractive";
-        description = ''
+        description = lib.mdDoc ''
           The path to the user's shell. Can use shell derivations,
-          like <literal>pkgs.bashInteractive</literal>. Don’t
+          like `pkgs.bashInteractive`. Don’t
           forget to enable your shell in
-          <literal>programs</literal> if necessary,
+          `programs` if necessary,
-          like <code>programs.zsh.enable = true;</code>.
+          like `programs.zsh.enable = true;`.
         '';
       };
 
@@ -189,10 +182,10 @@ let
           { startUid = 1000; count = 1; }
           { startUid = 100001; count = 65534; }
         ];
-        description = ''
+        description = lib.mdDoc ''
           Subordinate user ids that user is allowed to use.
-          They are set into <filename>/etc/subuid</filename> and are used
+          They are set into {file}`/etc/subuid` and are used
-          by <literal>newuidmap</literal> for user namespaces.
+          by `newuidmap` for user namespaces.
         '';
       };
 
@@ -203,10 +196,10 @@ let
           { startGid = 100; count = 1; }
           { startGid = 1001; count = 999; }
         ];
-        description = ''
+        description = lib.mdDoc ''
           Subordinate group ids that user is allowed to use.
-          They are set into <filename>/etc/subgid</filename> and are used
+          They are set into {file}`/etc/subgid` and are used
-          by <literal>newgidmap</literal> for user namespaces.
+          by `newgidmap` for user namespaces.
         '';
       };
 
@@ -214,7 +207,7 @@ let
         type = types.bool;
         default = false;
         example = true;
-        description = ''
+        description = lib.mdDoc ''
           Automatically allocate subordinate user and group ids for this user.
           Allocated range is currently always of size 65536.
         '';
@@ -223,7 +216,7 @@ let
       createHome = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Whether to create the home directory and ensure ownership as well as
           permissions to match the user.
         '';
@@ -232,9 +225,9 @@ let
       useDefaultShell = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           If true, the user's shell will be set to
-          <option>users.defaultUserShell</option>.
+          {option}`users.defaultUserShell`.
         '';
       };
 
@@ -290,13 +283,13 @@ let
       initialPassword = mkOption {
         type = with types; nullOr str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Specifies the initial password for the user, i.e. the
           password assigned if the user does not already exist. If
-          <option>users.mutableUsers</option> is true, the password
+          {option}`users.mutableUsers` is true, the password
           can be changed subsequently using the
-          <command>passwd</command> command. Otherwise, it's
+          {command}`passwd` command. Otherwise, it's
-          equivalent to setting the <option>password</option>
+          equivalent to setting the {option}`password`
           option. The same caveat applies: the password specified here
           is world-readable in the Nix store, so it should only be
           used for guest accounts or passwords that will be changed
@@ -308,9 +301,9 @@ let
         type = types.listOf types.package;
         default = [];
         example = literalExpression "[ pkgs.firefox pkgs.thunderbird ]";
-        description = ''
+        description = lib.mdDoc ''
           The set of packages that should be made available to the user.
-          This is in contrast to <option>environment.systemPackages</option>,
+          This is in contrast to {option}`environment.systemPackages`,
           which adds packages to all users.
         '';
       };
@@ -349,8 +342,8 @@ let
     options = {
 
       name = mkOption {
-        type = passwdEntry types.str;
+        type = types.passwdEntry types.str;
-        description = ''
+        description = lib.mdDoc ''
           The name of the group. If undefined, the name of the attribute set
           will be used.
         '';
@@ -359,7 +352,7 @@ let
       gid = mkOption {
         type = with types; nullOr int;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           The group GID. If the GID is null, a free GID is picked on
           activation.
         '';
@@ -368,9 +361,9 @@ let
       members = mkOption {
         type = with types; listOf (passwdEntry str);
         default = [];
-        description = ''
+        description = lib.mdDoc ''
           The user names of the group members, added to the
-          <literal>/etc/group</literal> file.
+          `/etc/group` file.
         '';
       };
 
@@ -390,7 +383,7 @@ let
     options = {
       startUid = mkOption {
         type = types.int;
-        description = ''
+        description = lib.mdDoc ''
           Start of the range of subordinate user ids that user is
           allowed to use.
         '';
@@ -398,7 +391,7 @@ let
       count = mkOption {
         type = types.int;
         default = 1;
-        description = "Count of subordinate user ids";
+        description = lib.mdDoc "Count of subordinate user ids";
       };
     };
   };
@@ -407,7 +400,7 @@ let
     options = {
       startGid = mkOption {
         type = types.int;
-        description = ''
+        description = lib.mdDoc ''
           Start of the range of subordinate group ids that user is
           allowed to use.
         '';
@@ -415,7 +408,7 @@ let
       count = mkOption {
         type = types.int;
         default = 1;
-        description = "Count of subordinate group ids";
+        description = lib.mdDoc "Count of subordinate group ids";
       };
     };
   };
@@ -490,7 +483,7 @@ in {
     users.enforceIdUniqueness = mkOption {
       type = types.bool;
       default = true;
-      description = ''
+      description = lib.mdDoc ''
         Whether to require that no two users/groups share the same uid/gid.
       '';
     };
@@ -509,7 +502,7 @@ in {
           shell = "/bin/sh";
         };
       };
-      description = ''
+      description = lib.mdDoc ''
         Additional user accounts to be created automatically by the system.
         This can also be used to set options for root.
       '';
@@ -522,7 +515,7 @@ in {
           hackers = { };
         };
       type = with types; attrsOf (submodule groupOpts);
-      description = ''
+      description = lib.mdDoc ''
         Additional groups to be created automatically by the system.
       '';
     };
@@ -531,8 +524,8 @@ in {
     users.allowNoPasswordLogin = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
-        Disable checking that at least the <literal>root</literal> user or a user in the <literal>wheel</literal> group can log in using
+        Disable checking that at least the `root` user or a user in the `wheel` group can log in using
         a password or an SSH key.
 
         WARNING: enabling this can lock you out of your system. Enable this only if you know what are you doing.

third_party/nixpkgs/nixos/modules/config/vte.nix

@@ -25,7 +25,7 @@ in
     programs.bash.vteIntegration = mkOption {
       default = false;
       type = types.bool;
-      description = ''
+      description = lib.mdDoc ''
         Whether to enable Bash integration for VTE terminals.
         This allows it to preserve the current directory of the shell
         across terminals.
@@ -35,7 +35,7 @@ in
     programs.zsh.vteIntegration = mkOption {
       default = false;
       type = types.bool;
-      description = ''
+      description = lib.mdDoc ''
         Whether to enable Zsh integration for VTE terminals.
         This allows it to preserve the current directory of the shell
         across terminals.

third_party/nixpkgs/nixos/modules/config/xdg/autostart.nix

@@ -10,9 +10,9 @@ with lib;
     xdg.autostart.enable = mkOption {
       type = types.bool;
       default = true;
-      description = ''
+      description = lib.mdDoc ''
         Whether to install files to support the
-        <link xlink:href="https://specifications.freedesktop.org/autostart-spec/autostart-spec-latest.html">XDG Autostart specification</link>.
+        [XDG Autostart specification](https://specifications.freedesktop.org/autostart-spec/autostart-spec-latest.html).
       '';
     };
   };

third_party/nixpkgs/nixos/modules/config/xdg/icons.nix

@@ -10,9 +10,9 @@ with lib;
     xdg.icons.enable = mkOption {
       type = types.bool;
       default = true;
-      description = ''
+      description = lib.mdDoc ''
         Whether to install files to support the
-        <link xlink:href="https://specifications.freedesktop.org/icon-theme-spec/icon-theme-spec-latest.html">XDG Icon Theme specification</link>.
+        [XDG Icon Theme specification](https://specifications.freedesktop.org/icon-theme-spec/icon-theme-spec-latest.html).
       '';
     };
   };

third_party/nixpkgs/nixos/modules/config/xdg/menus.nix

@@ -10,9 +10,9 @@ with lib;
     xdg.menus.enable = mkOption {
       type = types.bool;
       default = true;
-      description = ''
+      description = lib.mdDoc ''
         Whether to install files to support the
-        <link xlink:href="https://specifications.freedesktop.org/menu-spec/menu-spec-latest.html">XDG Desktop Menu specification</link>.
+        [XDG Desktop Menu specification](https://specifications.freedesktop.org/menu-spec/menu-spec-latest.html).
       '';
     };
   };

third_party/nixpkgs/nixos/modules/config/xdg/mime.nix

@@ -18,10 +18,10 @@ in
     xdg.mime.enable = mkOption {
       type = types.bool;
       default = true;
-      description = ''
+      description = lib.mdDoc ''
         Whether to install files to support the
-        <link xlink:href="https://specifications.freedesktop.org/shared-mime-info-spec/shared-mime-info-spec-latest.html">XDG Shared MIME-info specification</link> and the
+        [XDG Shared MIME-info specification](https://specifications.freedesktop.org/shared-mime-info-spec/shared-mime-info-spec-latest.html) and the
-        <link xlink:href="https://specifications.freedesktop.org/mime-apps-spec/mime-apps-spec-latest.html">XDG MIME Applications specification</link>.
+        [XDG MIME Applications specification](https://specifications.freedesktop.org/mime-apps-spec/mime-apps-spec-latest.html).
       '';
     };
 
@@ -32,10 +32,10 @@ in
         "application/pdf" = "firefox.desktop";
         "text/xml" = [ "nvim.desktop" "codium.desktop" ];
       };
-      description = ''
+      description = lib.mdDoc ''
         Adds associations between mimetypes and applications. See the
-        <link xlink:href="https://specifications.freedesktop.org/mime-apps-spec/mime-apps-spec-latest.html#associations">
+        [
-        specifications</link> for more information.
+        specifications](https://specifications.freedesktop.org/mime-apps-spec/mime-apps-spec-latest.html#associations) for more information.
       '';
     };
 
@@ -46,10 +46,10 @@ in
         "application/pdf" = "firefox.desktop";
         "image/png" = [ "sxiv.desktop" "gimp.desktop" ];
       };
-      description = ''
+      description = lib.mdDoc ''
         Sets the default applications for given mimetypes. See the
-        <link xlink:href="https://specifications.freedesktop.org/mime-apps-spec/mime-apps-spec-latest.html#default">
+        [
-        specifications</link> for more information.
+        specifications](https://specifications.freedesktop.org/mime-apps-spec/mime-apps-spec-latest.html#default) for more information.
       '';
     };
 
@@ -60,10 +60,10 @@ in
         "audio/mp3" = [ "mpv.desktop" "umpv.desktop" ];
         "inode/directory" = "codium.desktop";
       };
-      description = ''
+      description = lib.mdDoc ''
         Removes associations between mimetypes and applications. See the
-        <link xlink:href="https://specifications.freedesktop.org/mime-apps-spec/mime-apps-spec-latest.html#associations">
+        [
-        specifications</link> for more information.
+        specifications](https://specifications.freedesktop.org/mime-apps-spec/mime-apps-spec-latest.html#associations) for more information.
       '';
     };
   };

third_party/nixpkgs/nixos/modules/config/xdg/portal.nix

@@ -33,7 +33,7 @@ in
 
   options.xdg.portal = {
     enable =
-      mkEnableOption "<link xlink:href='https://github.com/flatpak/xdg-desktop-portal'>xdg desktop integration</link>" // {
+      mkEnableOption ''<link xlink:href="https://github.com/flatpak/xdg-desktop-portal">xdg desktop integration</link>'' // {
         default = false;
       };
 

third_party/nixpkgs/nixos/modules/config/xdg/sounds.nix

@@ -10,9 +10,9 @@ with lib;
     xdg.sounds.enable = mkOption {
       type = types.bool;
       default = true;
-      description = ''
+      description = lib.mdDoc ''
         Whether to install files to support the
-        <link xlink:href="https://www.freedesktop.org/wiki/Specifications/sound-theme-spec/">XDG Sound Theme specification</link>.
+        [XDG Sound Theme specification](https://www.freedesktop.org/wiki/Specifications/sound-theme-spec/).
       '';
     };
   };

third_party/nixpkgs/nixos/modules/config/zram.nix

@@ -40,21 +40,21 @@ in
       enable = mkOption {
         default = false;
         type = types.bool;
-        description = ''
+        description = lib.mdDoc ''
           Enable in-memory compressed devices and swap space provided by the zram
           kernel module.
-          See <link xlink:href="https://www.kernel.org/doc/Documentation/blockdev/zram.txt">
+          See [
             https://www.kernel.org/doc/Documentation/blockdev/zram.txt
-          </link>.
+          ](https://www.kernel.org/doc/Documentation/blockdev/zram.txt).
         '';
       };
 
       numDevices = mkOption {
         default = 1;
         type = types.int;
-        description = ''
+        description = lib.mdDoc ''
           Number of zram devices to create. See also
-          <literal>zramSwap.swapDevices</literal>
+          `zramSwap.swapDevices`
         '';
       };
 
@@ -62,20 +62,20 @@ in
         default = null;
         example = 1;
         type = with types; nullOr int;
-        description = ''
+        description = lib.mdDoc ''
           Number of zram devices to be used as swap. Must be
-          <literal>&lt;= zramSwap.numDevices</literal>.
+          `<= zramSwap.numDevices`.
-          Default is same as <literal>zramSwap.numDevices</literal>, recommended is 1.
+          Default is same as `zramSwap.numDevices`, recommended is 1.
         '';
       };
 
       memoryPercent = mkOption {
         default = 50;
         type = types.int;
-        description = ''
+        description = lib.mdDoc ''
           Maximum amount of memory that can be used by the zram swap devices
           (as a percentage of your total memory). Defaults to 1/2 of your total
-          RAM. Run <literal>zramctl</literal> to check how good memory is
+          RAM. Run `zramctl` to check how good memory is
           compressed.
         '';
       };
@@ -83,7 +83,7 @@ in
       memoryMax = mkOption {
         default = null;
         type = with types; nullOr int;
-        description = ''
+        description = lib.mdDoc ''
           Maximum total amount of memory (in bytes) that can be used by the zram
           swap devices.
         '';
@@ -92,7 +92,7 @@ in
       priority = mkOption {
         default = 5;
         type = types.int;
-        description = ''
+        description = lib.mdDoc ''
           Priority of the zram swap devices. It should be a number higher than
           the priority of your disk-based swap devices (so that the system will
           fill the zram swap devices before falling back to disk swap).

third_party/nixpkgs/nixos/modules/hardware/acpilight.nix

@@ -10,7 +10,7 @@ in
       enable = mkOption {
         default = false;
         type = types.bool;
-        description = ''
+        description = lib.mdDoc ''
           Enable acpilight.
           This will allow brightness control via xbacklight from users in the video group
         '';

third_party/nixpkgs/nixos/modules/hardware/all-firmware.nix

@@ -21,7 +21,7 @@ in {
     hardware.enableAllFirmware = mkOption {
       default = false;
       type = types.bool;
-      description = ''
+      description = lib.mdDoc ''
         Turn on this option if you want to enable all the firmware.
       '';
     };
@@ -30,7 +30,7 @@ in {
       default = config.hardware.enableAllFirmware;
       defaultText = lib.literalExpression "config.hardware.enableAllFirmware";
       type = types.bool;
-      description = ''
+      description = lib.mdDoc ''
         Turn on this option if you want to enable all the firmware with a license allowing redistribution.
       '';
     };
@@ -38,7 +38,7 @@ in {
     hardware.wirelessRegulatoryDatabase = mkOption {
       default = false;
       type = types.bool;
-      description = ''
+      description = lib.mdDoc ''
         Load the wireless regulatory database at boot.
       '';
     };
@@ -62,7 +62,7 @@ in {
         alsa-firmware
         sof-firmware
         libreelec-dvb-firmware
-      ] ++ optional (pkgs.stdenv.hostPlatform.isAarch32 || pkgs.stdenv.hostPlatform.isAarch64) raspberrypiWirelessFirmware
+      ] ++ optional pkgs.stdenv.hostPlatform.isAarch raspberrypiWirelessFirmware
         ++ optionals (versionOlder config.boot.kernelPackages.kernel.version "4.13") [
         rtl8723bs-firmware
       ] ++ optionals (versionOlder config.boot.kernelPackages.kernel.version "5.16") [

third_party/nixpkgs/nixos/modules/hardware/bladeRF.nix

@@ -12,7 +12,7 @@ in
     enable = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Enables udev rules for BladeRF devices. By default grants access
         to users in the "bladerf" group. You may want to install the
         libbladeRF package.

third_party/nixpkgs/nixos/modules/hardware/ckb-next.nix

@@ -19,7 +19,7 @@ in
         type = types.nullOr types.int;
         default = null;
         example = 100;
-        description = ''
+        description = lib.mdDoc ''
           Limit access to the ckb daemon to a particular group.
         '';
       };
@@ -28,7 +28,7 @@ in
         type = types.package;
         default = pkgs.ckb-next;
         defaultText = literalExpression "pkgs.ckb-next";
-        description = ''
+        description = lib.mdDoc ''
           The package implementing the Corsair keyboard/mouse driver.
         '';
       };

third_party/nixpkgs/nixos/modules/hardware/cpu/amd-microcode.nix

@@ -11,7 +11,7 @@ with lib;
     hardware.cpu.amd.updateMicrocode = mkOption {
       default = false;
       type = types.bool;
-      description = ''
+      description = lib.mdDoc ''
         Update the CPU microcode for AMD processors.
       '';
     };

third_party/nixpkgs/nixos/modules/hardware/cpu/amd-sev.nix

@@ -0,0 +1,51 @@
+{ config, lib, ... }:
+with lib;
+let
+  cfg = config.hardware.cpu.amd.sev;
+  defaultGroup = "sev";
+in
+  with lib; {
+    options.hardware.cpu.amd.sev = {
+      enable = mkEnableOption "access to the AMD SEV device";
+      user = mkOption {
+        description = "Owner to assign to the SEV device.";
+        type = types.str;
+        default = "root";
+      };
+      group = mkOption {
+        description = "Group to assign to the SEV device.";
+        type = types.str;
+        default = defaultGroup;
+      };
+      mode = mkOption {
+        description = "Mode to set for the SEV device.";
+        type = types.str;
+        default = "0660";
+      };
+    };
+
+    config = mkIf cfg.enable {
+      assertions = [
+        {
+          assertion = hasAttr cfg.user config.users.users;
+          message = "Given user does not exist";
+        }
+        {
+          assertion = (cfg.group == defaultGroup) || (hasAttr cfg.group config.users.groups);
+          message = "Given group does not exist";
+        }
+      ];
+
+      boot.extraModprobeConfig = ''
+        options kvm_amd sev=1
+      '';
+
+      users.groups = optionalAttrs (cfg.group == defaultGroup) {
+        "${cfg.group}" = {};
+      };
+
+      services.udev.extraRules = with cfg; ''
+        KERNEL=="sev", OWNER="${user}", GROUP="${group}", MODE="${mode}"
+      '';
+    };
+  }

third_party/nixpkgs/nixos/modules/hardware/cpu/intel-microcode.nix

@@ -11,7 +11,7 @@ with lib;
     hardware.cpu.intel.updateMicrocode = mkOption {
       default = false;
       type = types.bool;
-      description = ''
+      description = lib.mdDoc ''
         Update the CPU microcode for Intel processors.
       '';
     };

third_party/nixpkgs/nixos/modules/hardware/cpu/intel-sgx.nix

@@ -6,13 +6,13 @@ let
 in
 {
   options.hardware.cpu.intel.sgx.enableDcapCompat = mkOption {
-    description = ''
+    description = lib.mdDoc ''
       Whether to enable backward compatibility for SGX software build for the
       out-of-tree Intel SGX DCAP driver.
 
-      Creates symbolic links for the SGX devices <literal>/dev/sgx_enclave</literal>
+      Creates symbolic links for the SGX devices `/dev/sgx_enclave`
-      and <literal>/dev/sgx_provision</literal> to make them available as
+      and `/dev/sgx_provision` to make them available as
-      <literal>/dev/sgx/enclave</literal>  and <literal>/dev/sgx/provision</literal>,
+      `/dev/sgx/enclave`  and `/dev/sgx/provision`,
       respectively.
     '';
     type = types.bool;
@@ -22,17 +22,17 @@ in
   options.hardware.cpu.intel.sgx.provision = {
     enable = mkEnableOption "access to the Intel SGX provisioning device";
     user = mkOption {
-      description = "Owner to assign to the SGX provisioning device.";
+      description = lib.mdDoc "Owner to assign to the SGX provisioning device.";
       type = types.str;
       default = "root";
     };
     group = mkOption {
-      description = "Group to assign to the SGX provisioning device.";
+      description = lib.mdDoc "Group to assign to the SGX provisioning device.";
       type = types.str;
       default = defaultPrvGroup;
     };
     mode = mkOption {
-      description = "Mode to set for the SGX provisioning device.";
+      description = lib.mdDoc "Mode to set for the SGX provisioning device.";
       type = types.str;
       default = "0660";
     };

third_party/nixpkgs/nixos/modules/hardware/device-tree.nix

@@ -9,14 +9,14 @@ let
     options = {
       name = mkOption {
         type = types.str;
-        description = ''
+        description = lib.mdDoc ''
           Name of this overlay
         '';
       };
 
       dtsFile = mkOption {
         type = types.nullOr types.path;
-        description = ''
+        description = lib.mdDoc ''
           Path to .dts overlay file, overlay is applied to
           each .dtb file matching "compatible" of the overlay.
         '';
@@ -27,7 +27,7 @@ let
       dtsText = mkOption {
         type = types.nullOr types.str;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Literal DTS contents, overlay is applied to
           each .dtb file matching "compatible" of the overlay.
         '';
@@ -49,7 +49,7 @@ let
       dtboFile = mkOption {
         type = types.nullOr types.path;
         default = null;
-        description = ''
+        description = lib.mdDoc ''
           Path to .dtbo compiled overlay file.
         '';
       };
@@ -115,7 +115,7 @@ in
         enable = mkOption {
           default = pkgs.stdenv.hostPlatform.linux-kernel.DTB or false;
           type = types.bool;
-          description = ''
+          description = lib.mdDoc ''
             Build device tree files. These are used to describe the
             non-discoverable hardware of a system.
           '';
@@ -126,7 +126,7 @@ in
           defaultText = literalExpression "config.boot.kernelPackages.kernel";
           example = literalExpression "pkgs.linux_latest";
           type = types.path;
-          description = ''
+          description = lib.mdDoc ''
             Kernel package containing the base device-tree (.dtb) to boot. Uses
             device trees bundled with the Linux kernel by default.
           '';
@@ -136,7 +136,7 @@ in
           default = null;
           example = "some-dtb.dtb";
           type = types.nullOr types.str;
-          description = ''
+          description = lib.mdDoc ''
             The name of an explicit dtb to be loaded, relative to the dtb base.
             Useful in extlinux scenarios if the bootloader doesn't pick the
             right .dtb file from FDTDIR.
@@ -147,7 +147,7 @@ in
           type = types.nullOr types.str;
           default = null;
           example = "*rpi*.dtb";
-          description = ''
+          description = lib.mdDoc ''
             Only include .dtb files matching glob expression.
           '';
         };
@@ -167,7 +167,7 @@ in
             name = baseNameOf path;
             dtboFile = path;
           }) overlayType);
-          description = ''
+          description = lib.mdDoc ''
             List of overlays to apply to base device-tree (.dtb) files.
           '';
         };

third_party/nixpkgs/nixos/modules/hardware/digitalbitbox.nix

@@ -11,7 +11,7 @@ in
     enable = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Enables udev rules for Digital Bitbox devices.
       '';
     };
@@ -20,7 +20,7 @@ in
       type = types.package;
       default = pkgs.digitalbitbox;
       defaultText = literalExpression "pkgs.digitalbitbox";
-      description = "The Digital Bitbox package to use. This can be used to install a package with udev rules that differ from the defaults.";
+      description = lib.mdDoc "The Digital Bitbox package to use. This can be used to install a package with udev rules that differ from the defaults.";
     };
   };
 

third_party/nixpkgs/nixos/modules/hardware/hackrf.nix

@@ -9,7 +9,7 @@ in
     enable = lib.mkOption {
       type = lib.types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Enables hackrf udev rules and ensures 'plugdev' group exists.
         This is a prerequisite to using HackRF devices without being root, since HackRF USB descriptors will be owned by plugdev through udev.
       '';

third_party/nixpkgs/nixos/modules/hardware/i2c.nix

@@ -17,7 +17,7 @@ in
     group = mkOption {
       type = types.str;
       default = "i2c";
-      description = ''
+      description = lib.mdDoc ''
         Grant access to i2c devices (/dev/i2c-*) to users in this group.
       '';
     };

third_party/nixpkgs/nixos/modules/hardware/keyboard/zsa.nix

@@ -9,7 +9,7 @@ in
     enable = mkOption {
       type = types.bool;
       default = false;
-      description = ''
+      description = lib.mdDoc ''
         Enables udev rules for keyboards from ZSA like the ErgoDox EZ, Planck EZ and Moonlander Mark I.
         You need it when you want to flash a new configuration on the keyboard
         or use their live training in the browser.

third_party/nixpkgs/nixos/modules/hardware/ksm.nix

@@ -15,9 +15,9 @@ in {
     sleep = mkOption {
       type = types.nullOr types.int;
       default = null;
-      description = ''
+      description = lib.mdDoc ''
         How many milliseconds ksmd should sleep between scans.
-        Setting it to <literal>null</literal> uses the kernel's default time.
+        Setting it to `null` uses the kernel's default time.
       '';
     };
   };

third_party/nixpkgs/nixos/modules/hardware/logitech.nix

@@ -24,7 +24,7 @@ in
       startWhenNeeded = mkOption {
         type = types.bool;
         default = true;
-        description = ''
+        description = lib.mdDoc ''
           Only run the service when an actual supported device is plugged.
         '';
       };
@@ -32,10 +32,9 @@ in
       devices = mkOption {
         type = types.listOf types.str;
         default = [ "0a07" "c222" "c225" "c227" "c251" ];
-        description = ''
+        description = lib.mdDoc ''
           List of USB device ids supported by g15daemon.
-          </para>
+
-          <para>
           You most likely do not need to change this.
         '';
       };
@@ -47,7 +46,7 @@ in
       enableGraphical = mkOption {
         type = types.bool;
         default = false;
-        description = "Enable graphical support applications.";
+        description = lib.mdDoc "Enable graphical support applications.";
       };
     };
   };

third_party/nixpkgs/nixos/modules/hardware/mcelog.nix

@@ -10,7 +10,7 @@ with lib;
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           Enable the Machine Check Exception logger.
         '';
       };

third_party/nixpkgs/nixos/modules/hardware/network/ath-user-regd.nix

@@ -14,7 +14,7 @@ in
   options.networking.wireless.athUserRegulatoryDomain = mkOption {
     default = false;
     type = types.bool;
-    description = ''
+    description = lib.mdDoc ''
       If enabled, sets the ATH_USER_REGD kernel config switch to true to
       disable the enforcement of EEPROM regulatory restrictions for ath
       drivers. Requires at least Linux ${linuxKernelMinVersion}.