···

       
282
       
282
       
 
       
  "mysecret"` becomes `services.aria2.rpcSecretFile = "/path/to/secret_file"`

     

       
283
       
283
       
 
       
  where the file `secret_file` contains the string `mysecret`.

     

       
284
       
284
       
 
       


     

       
285
       
285
       
+
       
- The `system.forbiddenDependenciesRegex` option has been renamed to `system.forbiddenDependenciesRegexes` and now has the type of `listOf string` instead of `string` to accept multiple regexes.

     

       
286
       
286
       
+
       


     

       
285
       
287
       
 
       
- `openssh`, `openssh_hpn` and `openssh_gssapi` are now compiled without support for the DSA signature algorithm as it is being deprecated upstream. Users still relying on DSA keys should consider upgrading

     

       
286
       
288
       
 
       
  to another signature algorithm. However, for the time being it is possible to restore DSA key support using `override` to set `dsaKeysSupport = true`.

     

       
287
       
289
       
 
       


     

···

       
26
       
26
       
 
       


     

       
27
       
27
       
 
       
  # Check that the system does not contain a Nix store path that contains the

     

       
28
       
28
       
 
       
  # string "perl".

     

       
29
       
29
       
-
       
  system.forbiddenDependenciesRegex = "perl";

     

       
29
       
29
       
+
       
  system.forbiddenDependenciesRegexes = ["perl"];

     

       
30
       
30
       
 
       


     

       
31
       
31
       
 
       
}

     

···

       
5
       
5
       
 
       
}:

     

       
6
       
6
       
 
       
let

     

       
7
       
7
       
 
       
  node-forbiddenDependencies-fail = nixos ({ ... }: {

     

       
8
       
8
       
-
       
    system.forbiddenDependenciesRegex = "-dev$";

     

       
8
       
8
       
+
       
    system.forbiddenDependenciesRegexes = ["-dev$"];

     

       
9
       
9
       
 
       
    environment.etc."dev-dependency" = {

     

       
10
       
10
       
 
       
      text = "${expect.dev}";

     

       
11
       
11
       
 
       
    };

     
···

       
14
       
14
       
 
       
    boot.loader.grub.enable = false;

     

       
15
       
15
       
 
       
  });

     

       
16
       
16
       
 
       
  node-forbiddenDependencies-succeed = nixos ({ ... }: {

     

       
17
       
17
       
-
       
    system.forbiddenDependenciesRegex = "-dev$";

     

       
17
       
17
       
+
       
    system.forbiddenDependenciesRegexes = ["-dev$"];

     

       
18
       
18
       
 
       
    system.extraDependencies = [ expect.dev ];

     

       
19
       
19
       
 
       
    documentation.enable = false;

     

       
20
       
20
       
 
       
    fileSystems."/".device = "ignore-root-device";

     

···

       
86
       
86
       
 
       
    ../build.nix

     

       
87
       
87
       
 
       
    (mkRemovedOptionModule [ "nesting" "clone" ] "Use `specialisation.«name» = { inheritParentConfig = true; configuration = { ... }; }` instead.")

     

       
88
       
88
       
 
       
    (mkRemovedOptionModule [ "nesting" "children" ] "Use `specialisation.«name».configuration = { ... }` instead.")

     

       
89
       
89
       
+
       
    (mkRenamedOptionModule [ "system" "forbiddenDependenciesRegex" ] [ "system" "forbiddenDependenciesRegexes" ])

     

       
89
       
90
       
 
       
  ];

     

       
90
       
91
       
 
       


     

       
91
       
92
       
 
       
  options = {

     
···

       
160
       
161
       
 
       
      '';

     

       
161
       
162
       
 
       
    };

     

       
162
       
163
       
 
       


     

       
163
       
163
       
-
       
    system.forbiddenDependenciesRegex = mkOption {

     

       
164
       
164
       
-
       
      default = "";

     

       
165
       
165
       
-
       
      example = "-dev$";

     

       
166
       
166
       
-
       
      type = types.str;

     

       
164
       
164
       
+
       
    system.forbiddenDependenciesRegexes = mkOption {

     

       
165
       
165
       
+
       
      default = [];

     

       
166
       
166
       
+
       
      example = ["-dev$"];

     

       
167
       
167
       
+
       
      type = types.listOf types.str;

     

       
167
       
168
       
 
       
      description = ''

     

       
168
       
168
       
-
       
        A POSIX Extended Regular Expression that matches store paths that

     

       
169
       
169
       
+
       
        POSIX Extended Regular Expressions that match store paths that

     

       
169
       
170
       
 
       
        should not appear in the system closure, with the exception of {option}`system.extraDependencies`, which is not checked.

     

       
170
       
171
       
 
       
      '';

     

       
171
       
172
       
 
       
    };

     
···

       
289
       
290
       
 
       
            "$out/configuration.nix"

     

       
290
       
291
       
 
       
        '' +

     

       
291
       
292
       
 
       
      optionalString

     

       
292
       
292
       
-
       
        (config.system.forbiddenDependenciesRegex != "")

     

       
293
       
293
       
-
       
        ''

     

       
294
       
294
       
-
       
          if [[ $forbiddenDependenciesRegex != "" && -n $closureInfo ]]; then

     

       
295
       
295
       
-
       
            if forbiddenPaths="$(grep -E -- "$forbiddenDependenciesRegex" $closureInfo/store-paths)"; then

     

       
293
       
293
       
+
       
        (config.system.forbiddenDependenciesRegexes != []) (lib.concatStringsSep "\n" (map (regex: ''

     

       
294
       
294
       
+
       
          if [[ ${regex} != "" && -n $closureInfo ]]; then

     

       
295
       
295
       
+
       
            if forbiddenPaths="$(grep -E -- "${regex}" $closureInfo/store-paths)"; then

     

       
296
       
296
       
 
       
              echo -e "System closure $out contains the following disallowed paths:\n$forbiddenPaths"

     

       
297
       
297
       
 
       
              exit 1

     

       
298
       
298
       
 
       
            fi

     

       
299
       
299
       
 
       
          fi

     

       
300
       
300
       
-
       
        '';

     

       
300
       
300
       
+
       
        '') config.system.forbiddenDependenciesRegexes));

     

       
301
       
301
       
 
       


     

       
302
       
302
       
 
       
    system.systemBuilderArgs = {

     

       
303
       
303
       
 
       


     
···

       
319
       
319
       
 
       
      # option, as opposed to `system.extraDependencies`.

     

       
320
       
320
       
 
       
      passedChecks = concatStringsSep " " config.system.checks;

     

       
321
       
321
       
 
       
    }

     

       
322
       
322
       
-
       
    // lib.optionalAttrs (config.system.forbiddenDependenciesRegex != "") {

     

       
323
       
323
       
-
       
      inherit (config.system) forbiddenDependenciesRegex;

     

       
322
       
322
       
+
       
    // lib.optionalAttrs (config.system.forbiddenDependenciesRegexes != []) {

     

       
324
       
323
       
 
       
      closureInfo = pkgs.closureInfo { rootPaths = [

     

       
325
       
324
       
 
       
        # override to avoid  infinite recursion (and to allow using extraDependencies to add forbidden dependencies)

     

       
326
       
325
       
 
       
        (config.system.build.toplevel.overrideAttrs (_: { extraDependencies = []; closureInfo = null; }))