nixos-rebuild-ng: enable by default (#415640)

<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

- `nixos-rebuild-ng`, a full rewrite of `nixos-rebuild` in Python, is enabled by default from this release. You can disable it by setting [](#opt-system.rebuild.enableNg) to `false` in your configuration if you need, but please report any issues. It is expected that the next major version of NixOS (26.05) will remove the {option}`system.rebuild.enableNg` option.

- Secure boot support can now be enabled for the Limine bootloader through {option}`boot.loader.limine.secureBoot.enable`. Bootloader install script signs the bootloader, then kernels are hashed during system rebuild and written to a config. This allows Limine to boot only the kernels installed through NixOS system.

## New Modules {#sec-release-25.11-new-modules}

  };

  options.system.rebuild.enableNg = lib.mkEnableOption "" // {

    default = true;

    description = ''

      Whether to use ‘nixos-rebuild-ng’ in place of ‘nixos-rebuild’, the

      Python-based re-implementation of the original in Bash.

  config = {

    documentation.man.man-db.skipPackages = [ nixos-version ];

    warnings = lib.optional (!config.system.disableInstallerTools && !config.system.rebuild.enableNg) ''

      The Bash implementation of nixos-rebuild will be deprecated and removed in the 26.05 release of NixOS.

      Please migrate to the newer implementation by removing 'system.rebuild.enableNg = false' from your configuration.

      If you are unable to migrate due to any issues with the new implementation, please create an issue and tag the maintainers of 'nixos-rebuild-ng'.

    '';

    # These may be used in auxiliary scripts (ie not part of toplevel), so they are defined unconditionally.

    system.build = {

      inherit nixos-generate-config nixos-install;

  nixos-generate-config = runTest ./nixos-generate-config.nix;

  nixos-rebuild-install-bootloader = handleTestOn [

    "x86_64-linux"

  ] ./nixos-rebuild-install-bootloader.nix { };

  ] ./nixos-rebuild-install-bootloader.nix { withNg = false; };

  nixos-rebuild-install-bootloader-ng = handleTestOn [

    "x86_64-linux"

  ] ./nixos-rebuild-install-bootloader.nix { withNg = true; };

  currently depends on `jq` for JSON parsing, while Python has `json` in

  standard library

## Do's and Don'ts

- Do: be as much of a drop-in replacement as possible

- Do: fix obvious bugs

- Do: improvements that are non-breaking

- Don't: change logic in breaking ways even if this would be an improvement

## How to use

If you want to use `nixos-rebuild-ng` without replacing `nixos-rebuild`, add the

following to your NixOS configuration:

```nix

{ pkgs, ... }:

{

  environment.systemPackages = [ pkgs.nixos-rebuild-ng ];

}

```

And use `nixos-rebuild-ng` instead of `nixos-rebuild`.

If you want to completely replace `nixos-rebuild` with `nixos-rebuild-ng`, add

the following to your NixOS configuration:

```nix

{ ... }:

{

  system.rebuild.enableNg = true;

}

```

This will set `config.system.build.nixos-rebuild` to `nixos-rebuild-ng`, so

all tools that expect it in that location should work.

## Development

Run: