Merge branch 'NixOS:master' into termius

# step-cli: format package.nix with nixfmt (#331629)

fc7a83f8b62e90de5679e993d4d49ca014ea013d

# darwin.stdenv: format with nixfmt-rfc-style (#333962)

93c10ac9e561c6594d3baaeaff2341907390d9b8

  See [example usage](#using-pythonrelaxdepshook).

- `pythonRemoveBinBytecode` to remove bytecode from the `/bin` folder.

- `setuptoolsBuildHook` to build a wheel using `setuptools`.

- `setuptoolsCheckHook` to run tests with `python setup.py test`.

- `sphinxHook` to build documentation and manpages using Sphinx.

- `venvShellHook` to source a Python 3 `venv` at the `venvDir` location. A

  `venv` is created if it does not yet exist. `postVenvCreation` can be used to

Static libraries need to be compiled with `-fPIE` so that executables can link them in with the `-pie` linker option.

If the libraries lack `-fPIE`, you will get the error `recompile with -fPIE`.

#### `shadowstack` {#shadowstack}

Adds the `-fcf-protection=return` compiler option. This enables the Shadow Stack feature supported by some newer processors, which maintains a user-inaccessible copy of the program's stack containing only return-addresses. When returning from a function, the processor compares the return-address value on the two stacks and throws an error if they do not match, considering it a sign of corruption and possible tampering. This should significantly increase the difficulty of ROP attacks.

For the Shadow Stack to be enabled at runtime, all code linked into a process must be built with Shadow Stack enabled, so this is probably only useful to enable on a wide scale, so that all of a packages dependencies also have the feature enabled.

This is currently only supported on some newer Intel and AMD processors as part of the Intel CET set of features. However, the generated code should continue to work on older processors which will simply omit any of this checking.

This breaks some code that does advanced stack management or exception handling. If enabling this hardening flag it is important to test the result on a system that has known working and enabled CET support, so that any such breakage can be discovered.

#### `trivialautovarinit` {#trivialautovarinit}

Adds the `-ftrivial-auto-var-init=pattern` compiler option. This causes "trivially-initializable" uninitialized stack variables to be forcibly initialized with a nonzero value that is likely to cause a crash (and therefore be noticed). Uninitialized variables generally take on their values based on fragments of previous program state, and attackers can carefully manipulate that state to craft malicious initial values for these variables.

This flag adds the `-fstack-clash-protection` compiler option, which causes growth of a program's stack to access each successive page in order. This should force the guard page to be accessed and cause an attempt to "jump over" this guard page to crash.

#### `pacret` {#pacret}

This flag adds the `-mbranch-protection=pac-ret` compiler option on aarch64-linux targets. This uses ARM v8.3's Pointer Authentication feature to sign function return pointers before adding them to the stack. The pointer's authenticity is then validated before returning to its destination. This dramatically increases the difficulty of ROP exploitation techniques.

This may cause problems with code that does advanced stack manipulation, and debugging/stack-unwinding tools need to be pac-ret aware to work correctly when these features are in operation.

Pre-ARM v8.3 processors will ignore Pointer Authentication instructions, so code built with this flag will continue to work on older processors, though without any of the intended protections. If enabling this flag, it is recommended to ensure the resultant packages are tested against an ARM v8.3+ linux system with known-working Pointer Authentication support so that any breakage caused by this feature is actually detected.

[^footnote-stdenv-ignored-build-platform]: The build platform is ignored because it is a mere implementation detail of the package satisfying the dependency: As a general programming principle, dependencies are always *specified* as interfaces, not concrete implementation.

[^footnote-stdenv-native-dependencies-in-path]: Currently, this means for native builds all dependencies are put on the `PATH`. But in the future that may not be the case for sake of matching cross: the platforms would be assumed to be unique for native and cross builds alike, so only the `depsBuild*` and `nativeBuildInputs` would be added to the `PATH`.

[^footnote-stdenv-propagated-dependencies]: Nix itself already takes a package’s transitive dependencies into account, but this propagation ensures nixpkgs-specific infrastructure like [setup hooks](#ssec-setup-hooks) also are run as if it were a propagated dependency.

    githubId = 18467667;

    name = "Alexander Bantyev";

  };

  bananad3v = {

    email = "banana@banana.is-cool.dev";

    github = "BANanaD3V";

    githubId = 68944906;

    name = "Nikita";

  };

  bandresen = {

    email = "bandresen@gmail.com";

    github = "bennyandresen";

    githubId = 8081722;

    name = "Daniel Barter";

  };

  danielbritten = {

    email = "nixpkgs@danielb.space";

    github = "Coda-Coda";

    githubId = 5212453;

    name = "Daniel Britten";

  };

  danieldk = {

    email = "me@danieldk.eu";

    github = "danieldk";

    githubId = 265220;

    name = "David Leung";

  };

  diadatp = {

    email = "nixpkgs@diadatp.com";

    github = "diadatp";

    githubId = 4490283;

    name = "diadatp";

  };

  DianaOlympos = {

    github = "DianaOlympos";

    githubId = 15774340;

      { fingerprint = "MP2UpIRtJpbFFqyucP431H/FPCfn58UhEUTro4lXtRs"; }

    ];

  };

  geraldog = {

    email = "geraldogabriel@gmail.com";

    github = "geraldog";

    githubId = 14135816;

    name = "Geraldo Nascimento";

  };

  gerg-l = {

    email = "gregleyda@proton.me";

    github = "Gerg-L";

    githubId = 9636071;

    name = "Myrl Hex";

  };

  mzacho = {

    email = "nixpkgs@martinzacho.net";

    github = "mzacho";

    githubId = 16916972;

    name = "Martin Zacho";

  };

  n00b0ss = {

    email = "nixpkgs@n00b0ss.de";

    github = "n00b0ss";

    githubId = 43863;

    name = "Philip Taron";

  };

  philipwilk = {

    name = "Philip Wilk";

    email = "p.wilk@student.reading.ac.uk";

    github = "philipwilk";

    githubId = 50517631;

  };

  philtaken = {

    email = "philipp.herzog@protonmail.com";

    github = "philtaken";

    githubId = 6457015;

    name = "Taha Gharib";

  };

  taha-yassine = {

    email = "taha.yssne@gmail.com";

    github = "taha-yassine";

    githubId = 40228615;

    name = "Taha Yassine";

  };

  taikx4 = {

    email = "taikx4@taikx4szlaj2rsdupcwabg35inbny4jk322ngeb7qwbbhd5i55nf5yyd.onion";

    github = "taikx4";

  This also allows configuring runtime settings of AMDVLK and enabling experimental features.

- The `moonlight-qt` package ([Moonlight game streaming](https://moonlight-stream.org/)) now has HDR support on Linux systems.

- PostgreSQL now defaults to major version 16.

- `authelia` has been upgraded to version 4.38. This version brings several features and improvements which are detailed in the [release blog post](https://www.authelia.com/blog/4.38-release-notes/).

  This release also deprecates some configuration keys, which are likely to be removed in future version 5.0, but they are still supported and expected to be working in the current version.

- `hardware.display` is a new module implementing workarounds for misbehaving monitors

  through setting up custom EDID files and forcing kernel/framebuffer modes.

- NixOS now has support for *automatic boot assessment* (see [here](https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT/)) for detailed description of the feature) for `systemd-boot` users. Available as [boot.loader.systemd-boot.bootCounting](#opt-boot.loader.systemd-boot.bootCounting.enable).

- A new display-manager `services.displayManager.ly` was added.

  It is a tui based replacement of sddm and lightdm for window manager users.

  Users can use it by `services.displayManager.ly.enable` and config it by

## New Services {#sec-release-24.11-new-services}

- [TaskChampion Sync-Server](https://github.com/GothenburgBitFactory/taskchampion-sync-server), a [Taskwariror 3](https://taskwarrior.org/docs/upgrade-3/) sync server, replacing Taskwarrior 2's sync server named [`taskserver`](https://github.com/GothenburgBitFactory/taskserver).

- [FlareSolverr](https://github.com/FlareSolverr/FlareSolverr), proxy server to bypass Cloudflare protection. Available as [services.flaresolverr](#opt-services.flaresolverr.enable) service.

- [Goatcounter](https://www.goatcounter.com/), Easy web analytics. No tracking of personal data. Available as [services.goatcounter](options.html#opt-services.goatcocunter.enable).

- [Rathole](https://github.com/rapiz1/rathole), a lightweight and high-performance reverse proxy for NAT traversal. Available as [services.rathole](#opt-services.rathole.enable).

- [Proton Mail bridge](https://proton.me/mail/bridge), a desktop application that runs in the background, encrypting and decrypting messages as they enter and leave your computer. It lets you add your Proton Mail account to your favorite email client via IMAP/SMTP by creating a local email server on your computer.

## Backward Incompatibilities {#sec-release-24.11-incompatibilities}

- `transmission` package has been aliased with a `trace` warning to `transmission_3`. Since [Transmission 4 has been released last year](https://github.com/transmission/transmission/releases/tag/4.0.0), and Transmission 3 will eventually go away, it was decided perform this warning alias to make people aware of the new version. The `services.transmission.package` defaults to `transmission_3` as well because the upgrade can cause data loss in certain specific usage patterns (examples: [#5153](https://github.com/transmission/transmission/issues/5153), [#6796](https://github.com/transmission/transmission/issues/6796)). Please make sure to back up to your data directory per your usage:

- The `stackclashprotection` hardening flag has been added, though disabled by default.

- The `pacret` hardening flag has been added, though disabled by default.

- `cargoSha256` in `rustPlatform.buildRustPackage` has been deprecated in favor

  of `cargoHash` which supports SRI hashes. See

  [buildRustPackage: Compiling Rust applications with Cargo](https://nixos.org/manual/nixpkgs/unstable/#compiling-rust-applications-with-cargo)

  The derivation now installs "impl" headers selectively instead of by a wildcard.

  Use `imgui.src` if you just want to access the unpacked sources.

- Unprivileged access to the kernel syslog via `dmesg` is now restricted by default. Users wanting to keep an

  unrestricted access to it can set `boot.kernel.sysctl."kernel.dmesg_restrict" = false`.

- The `i18n.inputMethod` module introduces two new properties:

  `enable` and `type`, for declaring whether to enable an alternative input method and defining which input method respectfully. The options available in `type` are the same as the existing `enabled` option. `enabled` is now deprecated, and will be removed in a future release.

  - Nemo is now built with gtk-layer-shell support, note that for now it will be expected to see nemo-desktop

    listed as a regular entry in Cinnamon Wayland session's window list applet.

- The `shadowstack` hardening flag has been added, though disabled by default.

- `restic` module now has an option for inhibiting system sleep while backups are running, defaulting to off (not inhibiting sleep), available as [`services.restic.backups.<name>.inhibitsSleep`](#opt-services.restic.backups._name_.inhibitsSleep).

- Support for *runner registration tokens* has been [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/380872)