🦝 NixOS 22.11 - Feature Freeze & Release Blockers

[mweinelt]

Hey everyone, we are Janne Heß & Martin Weinelt, the release managers for NixOS 22.11 🦝 ("Raccoon").

Today it's time to talk about the feature freeze for the upcoming release. We have two upcoming dates that we'd like to mention in that context:

• 2022-10-17 Updates to release critical packages are restricted
• 2022-10-31 Breaking changes in general are restricted, with the exception of desktop environments

The complete timeline can be found in the

• 🦝 NixOS 22.11 - Release schedule #193585.

So with two weeks to the first restrictions kicking in, we want to encourage all teams to check in now and mention possible roadblocks, so we get a good overview of what's ahead.

Blockers

Whether you were pinged or not, we encourage everyone to create issues for release blockers and add them to the 22.11 Blockers project.

Check-In

Please comment your status quo and possible issues as soon as possible. We'll check teams once they have checked in.

If you think some subsystem, person or team should be added to or removed from this list, update maintainers/team-list.nix in time before the next feature freeze announcement.

Desktop environments

• Cinnamon: @bobby285271 @mkg20001
• Enlightenment: @NixOS/enlightenment
• GNOME: @NixOS/gnome @bobby285271 @dasj19 @maxeaubrey
• MATE: @romildo @johannesloetzsch
• Lumina: @NixOS/lumina
• LXQt: @NixOS/lxqt
• Pantheon: @NixOS/pantheon
• Qt / KDE: @NixOS/qt-kde
• XFCE: @romildo

Platforms

• Darwin: @NixOS/darwin-maintainers
• Mobile: @NixOS/mobile-nixos

Languages

• BEAM: @NixOS/beam @minijackson
• C: @matthewbauer @Mic92
• Coq: @CohenCyril @Zimmi48 @siraben @vbgl
• Dhall: @Gabriella439 @ehmry
• Go: @c00w @kalbasit @Mic92 @zowoq
• Haskell: @NixOS/haskell
• lua: @NixOS/lua
• Perl: @stigtsp
• PHP: @NixOS/php
• Python: @FRidh @mweinelt @jonringer
• R: @bcdarwin @jbedo
• Ruby: @marsam
• Rust: @LnL7 @Mic92 @zowoq

Modules

• ACME: @m1cr0man @aanderse @andrew-d @arianvp @emilazy @flokli
• systemd: @NixOS/systemd

Internals

• Docs: @ryantm @pennae
• Marketing: @garbas @tomberek
• Nix/nix-cli ecosystem: @Profpatsch @edolstra @grahamc @nbp
• NixOS modules & internals: @Ericson2314 @infinisil @alyssais @roberth
• NixOS tests: @tfc

Finally

No issue is too big or too small, but let's remember that we are all working on the project voluntarily in our free time here, so let's focus on issues that can be realistically addressed in the remaining time before the release.

We thank everyone for their contribution!

[mweinelt]

(reserved)

[bobby285271]

• Cinnamon: We successfully landed 5.4 already so no blockers from my side. I do aware that mozjs78 removal is added as a blocker and cjs still uses it for language bindings, we will surely take action when update is possible.
• Pantheon: Also no blocking issues but GNOME 43 do affect this DE and we are trying to minimize the regression it brings.

[pennae]

in-tree module docs conversion from docbook to markdown has been mostly uneventful and should be (almost) entirely invisible to anyone who doesn't want to use it yet out-of-tree. not foreseeing any large/complicated problems there for the release.

not sure about the status of the rest of the docs.

[samueldr]

Not a blocker per se (Mobile NixOS still expects unstable outright), but it would be nice to have the help to bring the almost complete Plasma Mobile PR in

• qcoro: 0.4.0 -> 0.6.0 #185191 (to fix AArch64 builds)
• Plasma Mobile Gear 22.09 #193858
• qcoro: 0.4.0 -> 0.6.0 and AArch64 fix #196047

Main unsolved issue is that plasma phone dialer segfault, everything else has solutions written-up already. So reviewing

[Gabriella439]

No blockers for Dhall

[jbedo]

No blockers for R

[infinisil]

No blockers for NixOS modules & internals

[romildo]

No blockers for:

• Enlightenment
• MATE
• Lumina
• LXQt
• XFCE

[happysalada]

No blockers for beam languages

[sternenseemann]

(edit from @cdepillabout: this post is specifically for Haskell)

No blockers per se, since we've been lacking the time to do the bigger jobs we have in mind this release cycle. A couple things that would be nice to have are #194391 and #190536 which should be no trouble to get done in time.

Additionally I want to bring attention to #184041, even though we should not block on it (since I can't guarantee it gets done in time and it's backportable): It would help if M1 users could test it and a careful review of the patch is still needed as well.

---

Edit: Turns out we do have one blocker which is adapting to the libxcrypt change in a satisfactory way (#196378). Should be of no concern to staging though.

[nixos-discourse]

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/nix-macos-monthly/12330/33

[jonringer]

Python up-to-date for https://nixos.org/manual/nixpkgs/unstable/#id-1.5.8.29.7

[flokli]

No blockers on the systemd side. We're landing some small fixes and UX improvements, especially on the experimental systemd-in-initrd backend, but that's not release relevant.

[teto]

I've just created 1 PR to add the lua team to the list.
Not blocking per-se but nice to have:

• add some testing infra to lua lua: test the interpreter #177556 , having it in the next release will make some stuff easier to backport
• The way buildNeovimPlugin works right now is really confusing (it ignores the generated source) and this vimPlugins: make usage of luaPackages less confusing #190824 should fix it.

I am in charge of both and there should be no problem getting those finished for the release.

[m1cr0man]

No blockers in ACME. Some nice to have PRs are outstanding but ready to merge:

• Lego client update to 4.9.0 lego: 4.8.0 -> 4.9.0 #194302 which includes full support for CNAMEs.
• nixos/acme: Various fixes #191861 which resolves a random runtime increase during renewals and fixing HTTP-01 validation with the built-in web server.
• A small docs update nixos/doc: fix acme dns-01 example #190052 correcting the DIY DNS-01 example.

[marsam]

No blockers for:

• Node.js
• Ruby
• PostgreSQL.
  No blocking per-se, I plan to merge postgresql: remove 10.x #167047 and postgresql_15: init at beta 2 #185751 during this week

[etu]

As for @NixOS/php we have one thing we would like to complete before 22.11, it's not the end of the world if we don't manage (some of us have busy lives at the moment).

• So we will try to finish php: enable nts flags by default #194172 before the branching off. Otherwise I think we're good 🙂

[Mic92]

No blockers I am aware of for rust and C.

[jtojnar]

For GNOME, we want to merge the 43 upgrade #182618, which is ready on the GNOME side but may bring a lot of breakage to other package sets (as can be seen on Pantheon).

But we will also want to get in fixes from 43.1, which is due on Oct 22.

[sg2002]

Can someone decide if #195710 can be considered a blocker?

[vbgl]

Coq is in good shape, AFAICT.

[jtojnar]

• We will also want libxml2: 2.10.0 → 2.10.2 #195748, otherwise parsing HTML using DomDocument when running a script using mod_php on Apache creates an empty document: https://gitlab.gnome.org/GNOME/libxml2/-/issues/399

[jonringer]

I would like to see the RFC 121 PRs merged:

• Update nixos options from opengl to hardware.drivers
• Update addOpenGLRunpath -> addHardwareRunpath

The reason why these should be release blockers, is that we would like a longer transition period where the existing /run/opengl-driver/ and new /run/current-system/drivers paradigms both exist. So that when the old opengl-driver gets dropped it, users will be less likely to have issues around /run/current-system/drivers not existing.

In other words, people upgrading from 22.05 to 22.11 to 23.05 won't incur any breakages.

[mweinelt]

Breaking changes to the following packages are restricted as of today:

• binutils
• gcc
• glibc
• llvm
• systemd

https://nixos.github.io/release-wiki/Release-Critical-Packages.html

[vlinkz]

• calamares: fix errors and update modules #193041 and kpmcore: patch trustedprefixes #191822 are needed to fix some errors with the calamares installer. See NixOS Installer unable to find disk device #196335

[Mic92]

• I just found a crash in our acme service (lego), which looks like a release blocker to me: acme: add missing setrlimit call for lego #197702

[sternenseemann]

• Consider looking into home-manager is severly out of date / unmaintained in nixpkgs #197907.

[tfc]

NixOS tests: All good, there are no blockers.

[bryanasdev000]

• This maybe useful nixos/zfs: introduce option to control hibernation #171680 for a "better safe than sorry" approach around ZFS and hibernation. Feedback is welcome.

[Ericson2314]

• FreeBSD packages: Init at 13.1 #82131 I would like to land before 22.11. I think it is ready. CC @alyssais in case you want someone else to review it.

[mweinelt]

Can someone decide if #195710 can be considered a blocker?

I don't think it should be.

[flokli]

• I added systemd: 251.5 -> 251.7 #199618 to the board - there's some fixes in there that I'd like to see 22.11 shipped with if possible. We've mostly been backporting point releases to stable previously, 252 needs to wait until after the branchoff.

[vcunat]

• nix.settings.max-jobs defaults to auto which doesn't match nix's default #198668
  I'd like this issue and related ones to get more community feedback... and hopefully move to a somewhat better overall state, despite perhaps not fully satisfying everyone. And before 22.11, as the changes around the topic happened after 22.05.

[azahi]

• nixos/plasma: leave displayManager.setupCommands alone #199881 This is definitely not a blocker but it should fix a really annoying behavior for display managers.

[rnhmjoj]

Can someone decide if #195710 can be considered a blocker?

I don't think it should be.

Why? It's a pretty serious issue. See also #193646.

As I understand, OpenSSL has deprecated old ciphers and signatures that rely on SHA1 (which is insecure) and this obviously causes authentication failures with old APs and from vendors that haven't been updating their TLS in like forever.

It could leave people without internet connection or lock them out of their machine. It should at least be documented in the release notes as a backward incompatibility.

EDIT: Oops, I somehow mixed up #138435 with that one. The problem still stands, though.

[mweinelt]

The referenced issue is about i686-linux, not about openssl.