staging-nixos merge for 2025-10-20 (#453748)

- Due to [deprecation of gnome-session X11 support](https://blogs.gnome.org/alatiera/2025/06/08/the-x11-session-removal/), `services.desktopManager.pantheon` now defaults to pantheon-wayland session. The X11 session has been removed, see [this issue](https://github.com/elementary/session-settings/issues/91) for details.

- `bcachefs` file systems will now use the out-of-tree module for supported kernels. The in-tree module is unmaintained and users are strongly recommended to switch to kernels that support the out-of-tree module.

- `bcachefs` file systems will now use the out-of-tree module for supported kernels. The in-tree module has been removed, and users will need to switch to kernels that support the out-of-tree module.

- `services.filesender` and the package `filesender` have been removed because they depend on `simplesamlphp`.

{

  boot.kernelPackages = pkgs.linuxPackages_latest;

  boot.supportedFilesystems.zfs = false;

  boot.supportedFilesystems.bcachefs = true;

  environment.etc."nixos-generate-config.conf".text = ''

    [Defaults]

    Kernel=latest

          }

        ];

        warnings = lib.mkIf cfg.modulePackage.meta.broken [

          ''

            Using unmaintained in-tree bcachefs kernel module. This

            will be removed in 26.05. Please use a kernel supported

            by the out-of-tree module package.

          ''

        ];

        # Bcachefs upstream recommends using the latest kernel

        boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_latest;

        system.fsPackages = [ cfg.package ];

        services.udev.packages = [ cfg.package ];

        boot.extraModulePackages = lib.optionals (!cfg.modulePackage.meta.broken) [

          cfg.modulePackage

        ];

        boot.extraModulePackages = [ cfg.modulePackage ];

        systemd = {

          packages = [ cfg.package ];

diff --git c/CMakeLists.txt w/CMakeLists.txt

index 01a42fb..1a9a505 100644

--- c/CMakeLists.txt

+++ w/CMakeLists.txt

@@ -515,9 +515,9 @@ if(ENABLE_LIBRESSL_INSTALL)

 	if(NOT MSVC)

 		# Create pkgconfig files.

 		set(prefix      ${CMAKE_INSTALL_PREFIX})

-		set(exec_prefix \${prefix})

-		set(libdir      \${exec_prefix}/${CMAKE_INSTALL_LIBDIR})

-		set(includedir  \${prefix}/include)

+		set(exec_prefix ${CMAKE_INSTALL_FULL_BINDIR})

+		set(libdir      ${CMAKE_INSTALL_FULL_LIBDIR})

+		set(includedir  ${CMAKE_INSTALL_FULL_INCLUDEDIR})

 		if(PLATFORM_LIBS)

 			string(REGEX REPLACE ";" " -l" PLATFORM_LDADD ";${PLATFORM_LIBS}")

 		endif()

        # .note.GNU-stack section, and if that section is missing from any object,

        # the linker will make the stack executable.

        "-DCMAKE_C_FLAGS=-DHAVE_GNU_STACK"

        # libressl will append this to the regular prefix for libdir

        "-DCMAKE_INSTALL_LIBDIR=lib"

        "-DTLS_DEFAULT_CA_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt"

      ]

      ++ lib.optional buildShared "-DBUILD_SHARED_LIBS=ON";

      # removing ./configure pre-config.

      preConfigure = ''

        rm configure

        substituteInPlace CMakeLists.txt \

          --replace-fail 'exec_prefix \''${prefix}' "exec_prefix ${placeholder "bin"}" \

          --replace-fail 'libdir      \''${exec_prefix}' 'libdir \''${prefix}'

      '';

      inherit patches;

        moveToOutput "share/man/man1/nc.1.gz" "$nc"

      '';

      meta = with lib; {

      meta = {

        description = "Free TLS/SSL implementation";

        homepage = "https://www.libressl.org";

        license = with licenses; [

        license = with lib.licenses; [

          publicDomain

          bsdOriginal

          bsd0

          isc

          openssl

        ];

        platforms = platforms.all;

        maintainers = with maintainers; [

        platforms = lib.platforms.all;

        maintainers = with lib.maintainers; [

          thoughtpolice

          fpletz

        ];

        ];

      };

    };

  # https://github.com/libressl/portable/pull/1206

  common-cmake-install-full-dirs-patch = fetchpatch {

    url = "https://github.com/libressl/portable/commit/a15ea0710398eaeed3be53cf643e80a1e80c981d.patch";

    hash = "sha256-Mlf4SrGCCqALQicbGtmVGdkdfcE8DEGYkOuVyG2CozM=";

  };

in

{

  libressl_3_9 = generic {

        url = "https://github.com/libressl/portable/commit/e6c7de3f03c51fbdcf5ad88bf12fe9e128521f0d.patch";

        hash = "sha256-LJy3fjbnc9h5DG3/+8bLECwJeBpPxy3hU8sPuhovmcw=";

      })

      # common-cmake-install-full-dirs-patch doesn't apply for this version, so

      # this is a manual backport

      ./cmake-install-full-dirs.3.9.patch

    ];

  };

        '';

        hash = "sha256-dEdtmHHiR7twAqgebXv1Owle/KYCak71NhDCp0PdseU=";

      })

      common-cmake-install-full-dirs-patch

    ];

  };

        }

      } include/arch/loongarch64/opensslconf.h

    '';

    patches = [

      common-cmake-install-full-dirs-patch

    ];

  };

  libressl_4_2 = generic {

    version = "4.2.0";

    hash = "sha256-D326RNfLjfjVPyz78ZVSVLwSjgCJWV8aui+s+u6ECLI=";

    patches = [

      common-cmake-install-full-dirs-patch

    ];

  };

}