Merge master into staging-next

If set to `true`, the standard environment will enable debug information in C/C++ builds. After installation, the debug information will be separated from the executables and stored in the output named `debug`. (This output is enabled automatically; you don’t need to set the `outputs` attribute explicitly.) To be precise, the debug information is stored in `debug/lib/debug/.build-id/XX/YYYY…`, where \<XXYYYY…\> is the \<build ID\> of the binary — a SHA-1 hash of the contents of the binary. Debuggers like GDB use the build ID to look up the separated debug information.

For example, with GDB, you can add

:::{.example #ex-gdb-debug-symbols-socat}

# Enable debug symbols for use with GDB

To make GDB find debug information for the `socat` package and its dependencies, you can use the following `shell.nix`:

```nix

let

  pkgs = import ./. {

    config = {};

    overlays = [

      (final: prev: {

        ncurses = prev.ncurses.overrideAttrs { separateDebugInfo = true; };

        readline = prev.readline.overrideAttrs { separateDebugInfo = true; };

      })

    ];

  };

  myDebugInfoDirs = pkgs.symlinkJoin {

    name = "myDebugInfoDirs";

    paths = with pkgs; [

      glibc.debug

      ncurses.debug

      openssl.debug

      readline.debug

    ];

  };

in

  pkgs.mkShell {

    NIX_DEBUG_INFO_DIRS = "${pkgs.lib.getLib myDebugInfoDirs}/lib/debug";

    packages = [

      pkgs.gdb

      pkgs.socat

    ];

    shellHook = ''

      ${pkgs.lib.getBin pkgs.gdb}/bin/gdb ${pkgs.lib.getBin pkgs.socat}/bin/socat

    '';

  }

```

set debug-file-directory ~/.nix-profile/lib/debug

```

to `~/.gdbinit`. GDB will then be able to find debug information installed via `nix-env -i`.

This setup works as follows:

- Add [`overlays`](#chap-overlays) to the package set, since debug symbols are disabled for `ncurses` and `readline` by default.

- Create a derivation to combine all required debug symbols under one path with [`symlinkJoin`](#trivial-builder-symlinkJoin).

- Set the environment variable `NIX_DEBUG_INFO_DIRS` in the shell. Nixpkgs patches `gdb` to use it for looking up debug symbols.

- Run `gdb` on the `socat` binary on shell startup in the [`shellHook`](#sec-pkgs-mkShell). Here we use [`lib.getBin`](#function-library-lib.attrsets.getBin) to ensure that the correct derivation output is selected rather than the default one.

:::

### The installCheck phase {#ssec-installCheck-phase}

- PHP now defaults to PHP 8.2, updated from 8.1.

- GraalVM has been updated to the latest version, and this brings significant changes. Upstream don't release multiple versions targeting different JVMs anymore, so now we only have one GraalVM derivation (`graalvm-ce`). While at first glance the version may seem a downgrade (22.3.1 -> 21.0.0), the major version is now following the JVM it targets (so this latest version targets JVM 21). Also some products like `llvm-installable-svm` and `native-image-svm` were incorporate to the main GraalVM derivation, so they're included by default.

- GraalPy (`graalCEPackages.graalpy`), TruffleRuby (`graalCEPackages.truffleruby`), GraalJS (`graalCEPackages.graaljs`) and GraalNodeJS (`grallCEPackages.graalnodejs`) are now indepedent from the main GraalVM derivation.

- The ISC DHCP package and corresponding module have been removed, because they are end of life upstream. See https://www.isc.org/blogs/isc-dhcp-eol/ for details and switch to a different DHCP implementation like kea or dnsmasq.

- `prometheus-unbound-exporter` has been replaced by the Let's Encrypt maintained version, since the previous version was archived. This requires some changes to the module configuration, most notable `controlInterface` needs migration

            while True:

                chunk = self.shell.recv(1024)

                # No need to print empty strings, it means we are waiting.

                if len(chunk) == 0:

                    continue

                self.log(f"Guest shell says: {chunk!r}")

                # NOTE: for this to work, nothing must be printed after this line!

                if b"Spawning backdoor root shell..." in chunk:

            { command = "${pkgs.coreutils}/bin/mkdir"; options = [ "NOPASSWD" ]; }

            { command = "${pkgs.coreutils}/bin/readlink"; options = [ "NOPASSWD" ]; }

            # for ssh, they are not the same than the one hard coded in ${pkgs.btrbk}

            { command = "/run/current-system/bin/btrfs"; options = [ "NOPASSWD" ]; }

            { command = "/run/current-system/sw/bin/btrfs"; options = [ "NOPASSWD" ]; }

            { command = "/run/current-system/sw/bin/mkdir"; options = [ "NOPASSWD" ]; }

            { command = "/run/current-system/sw/bin/readlink"; options = [ "NOPASSWD" ]; }

            ];

            (doasCmdNoPass "${pkgs.coreutils}/bin/mkdir")

            (doasCmdNoPass "${pkgs.coreutils}/bin/readlink")

            # for ssh, they are not the same than the one hard coded in ${pkgs.btrbk}

            (doasCmdNoPass "/run/current-system/bin/btrfs")

            (doasCmdNoPass "/run/current-system/sw/bin/btrfs")

            (doasCmdNoPass "/run/current-system/sw/bin/mkdir")

            (doasCmdNoPass "/run/current-system/sw/bin/readlink")

  cfg = config.services.xmr-stak;

  pkg = pkgs.xmr-stak.override {

    inherit (cfg) openclSupport cudaSupport;

    inherit (cfg) openclSupport;

  };

in

    services.xmr-stak = {

      enable = mkEnableOption (lib.mdDoc "xmr-stak miner");

      openclSupport = mkEnableOption (lib.mdDoc "support for OpenCL (AMD/ATI graphics cards)");

      cudaSupport = mkEnableOption (lib.mdDoc "support for CUDA (NVidia graphics cards)");

      extraArgs = mkOption {

        type = types.listOf types.str;

      wantedBy = [ "multi-user.target" ];

      bindsTo = [ "network-online.target" ];

      after = [ "network-online.target" ];

      environment = mkIf cfg.cudaSupport {

        LD_LIBRARY_PATH = "${pkgs.linuxPackages_latest.nvidia_x11}/lib";

      };

      preStart = concatStrings (flip mapAttrsToList cfg.configFiles (fn: content: ''

        ln -sf '${pkgs.writeText "xmr-stak-${fn}" content}' '${fn}'

      ''));

      serviceConfig = let rootRequired = cfg.openclSupport || cfg.cudaSupport; in {

      serviceConfig = let rootRequired = cfg.openclSupport; in {

        ExecStart = "${pkg}/bin/xmr-stak ${concatStringsSep " " cfg.extraArgs}";

        # xmr-stak generates cpu and/or gpu configuration files

        WorkingDirectory = "/tmp";