staging-nixos merge for 2025-12-12 (#470224)

- NixOS now has initial support for the [**COSMIC DE**](https://system76.com/cosmic) which is currently at **Alpha 7**. COSMIC is a Rust-based Desktop Environment by System76, makers of Pop!_OS. You can use COSMIC by enabling the greeter (login manager) with [](#opt-services.displayManager.cosmic-greeter.enable), and the DE itself by enabling [](#opt-services.desktopManager.cosmic.enable). The support in NixOS/Nixpkgs is stable but still considered experimental because of the recent the addition. The COSMIC maintainers will be waiting for one more release of NixOS to determine if the experimental tag should be removed or not. Until then, please report any issues to the [COSMIC DE tracker in Nixpkgs](https://github.com/NixOS/nixpkgs/issues/259641) instead of upstream.

- `nixos-rebuild-ng`, a full rewrite of `nixos-rebuild` in Python, is available for testing. You can enable it by setting [](#opt-system.rebuild.enableNg) in your configuration (this will replace the old `nixos-rebuild`), or by adding `nixos-rebuild-ng` to your `environment.systemPackages` (in this case, it will live side-by-side with `nixos-rebuild` as `nixos-rebuild-ng`). It is expected that the next major version of NixOS (25.11) will enable `system.rebuild.enableNg` by default.

- `nixos-rebuild-ng`, a full rewrite of `nixos-rebuild` in Python, is available for testing. You can enable it by setting {option}`system.rebuild.enableNg` in your configuration (this will replace the old `nixos-rebuild`), or by adding `nixos-rebuild-ng` to your `environment.systemPackages` (in this case, it will live side-by-side with `nixos-rebuild` as `nixos-rebuild-ng`). It is expected that the next major version of NixOS (25.11) will enable `system.rebuild.enableNg` by default.

- A `nixos-rebuild build-image` sub-command has been added.

  It allows users to build platform-specific (disk) images from their NixOS configurations. `nixos-rebuild build-image` works similar to the popular [nix-community/nixos-generators](https://github.com/nix-community/nixos-generators) project. See new [section on image building in the NixOS manual](#sec-image-nixos-rebuild-build-image). It is also available for `nixos-rebuild-ng`.

- `networking.firewall` now has a `backend` option for choosing which backend to use.

- `nixos-rebuild-ng`, a full rewrite of `nixos-rebuild` in Python, is enabled by default from this release. You can disable it by setting [](#opt-system.rebuild.enableNg) to `false` in your configuration if you need, but please report any issues. It is expected that the next major version of NixOS (26.05) will remove the {option}`system.rebuild.enableNg` option.

- `nixos-rebuild-ng`, a full rewrite of `nixos-rebuild` in Python, is enabled by default from this release. You can disable it by setting {option}`system.rebuild.enableNg` to `false` in your configuration if you need, but please report any issues. It is expected that the next major version of NixOS (26.05) will remove the {option}`system.rebuild.enableNg` option.

- `rEFInd`, a graphical boot manager for UEFI systems, can now be used through [](#opt-boot.loader.refind.enable).

- Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now.

- The Bash implementation of the `nixos-rebuild` program is removed. All switchable systems now use the Python rewrite. Any prior usage of `system.rebuild.enableNg` must now be removed. If you have any outstanding issues with the new implementation, please open an issue on GitHub.

## Other Notable Changes {#sec-release-26.05-notable-changes}

<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

{

  lib,

  python3Packages,

  enableOCR ? false,

  qemu_pkg ? qemu_test,

  buildPythonApplication,

  colorama,

  coreutils,

  imagemagick_light,

  ipython,

  junit-xml,

  mypy,

  ptpython,

  python,

  ruff,

  remote-pdb,

  netpbm,

  nixosTests,

  qemu_pkg ? qemu_test,

  qemu_test,

  setuptools,

  socat,

  ruff,

  tesseract4,

  vde2,

  enableOCR ? false,

  extraPythonPackages ? (_: [ ]),

  nixosTests,

}:

python3Packages.buildPythonApplication {

buildPythonApplication {

  pname = "nixos-test-driver";

  version = "1.1";

  pyproject = true;

  src = ./src;

  build-system = with python3Packages; [

  build-system = [

    setuptools

  ];

  dependencies =

    with python3Packages;

    [

  dependencies = [

    colorama

    ipython

    junit-xml

    ptpython

      ipython

    remote-pdb

  ]

    ++ extraPythonPackages python3Packages;

  ++ extraPythonPackages python.pkgs;

  propagatedBuildInputs = [

    coreutils

  doCheck = true;

  nativeCheckInputs = with python3Packages; [

  nativeCheckInputs = [

    mypy

    ruff

  ];

  # Reifies and correctly wraps the python test driver for

  # the respective qemu version and with or without ocr support

  testDriver = hostPkgs.callPackage ../test-driver {

  testDriver = hostPkgs.python3Packages.callPackage ../test-driver {

    inherit (config) enableOCR extraPythonPackages;

    qemu_pkg = config.qemu.package;

    imagemagick_light = hostPkgs.imagemagick_light.override { inherit (hostPkgs) libtiff; };