From 4772e31296d43c40b7f8744e49fba953635d9332 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Mon, 3 Aug 2026 19:24:44 +0000 Subject: [PATCH] flake: bump nixpkgs + sops-nix (2026-08-03) nixpkgs: 50ab793 -> 531670d (nixos-26.05, was nixos-24.11 EOL) sops-nix: 77c423a -> f140661 (master, buildGo125Module now builds on 26.05) 3-release channel jump (24.11 -> 25.05 -> 25.11 -> 26.05) to match the orchestrator host and get CVE patches. 24.11 was EOL (2025-06-30). Notable 26.05 changes reviewed: systemd Stage 1 boot (default, no config change needed), dbus-broker default, bash nixos-rebuild removed (Python rewrite mandatory; git present on host), MySQL 8.0 removed (not used as a NixOS module). No system.rebuild/fileSystems/boot.initrd options in the host config, so no config edits required. --- flake.lock | 16 ++++++++-------- flake.nix | 16 ++++++++++------ 2 files changed, 18 insertions(+), 14 deletions(-) diff --git a/flake.lock b/flake.lock index 143b18c..97bd3a4 100644 --- a/flake.lock +++ b/flake.lock @@ -2,17 +2,17 @@ "nodes": { "nixpkgs": { "locked": { - "lastModified": 1751274312, - "narHash": "sha256-/bVBlRpECLVzjV19t5KMdMFWSwKLtb5RyXdjz3LJT+g=", + "lastModified": 1785734586, + "narHash": "sha256-ODZkEK9Gy50yg6h98u7KkitZ3oc/uuTFK00bh1CRdNA=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674", + "rev": "531670d871c0e29724a02f3cbcac170adc65b58c", "type": "github" }, "original": { "owner": "NixOS", "repo": "nixpkgs", - "rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674", + "rev": "531670d871c0e29724a02f3cbcac170adc65b58c", "type": "github" } }, @@ -29,17 +29,17 @@ ] }, "locked": { - "lastModified": 1750119275, - "narHash": "sha256-Rr7Pooz9zQbhdVxux16h7URa6mA80Pb/G07T4lHvh0M=", + "lastModified": 1783174389, + "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=", "owner": "Mic92", "repo": "sops-nix", - "rev": "77c423a03b9b2b79709ea2cb63336312e78b72e2", + "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9", "type": "github" }, "original": { "owner": "Mic92", "repo": "sops-nix", - "rev": "77c423a03b9b2b79709ea2cb63336312e78b72e2", + "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9", "type": "github" } } diff --git a/flake.nix b/flake.nix index 48ffb7a..39fb727 100644 --- a/flake.nix +++ b/flake.nix @@ -2,13 +2,17 @@ description = "cc-ci — Co-op Cloud recipe CI server (NixOS)"; inputs = { - # Pinned to the exact revision cc-ci already runs, so the first rebuild from - # this repo is a true no-op-then-base (M0). Bump deliberately, not drift. - nixpkgs.url = "github:NixOS/nixpkgs/50ab793786d9de88ee30ec4e4c24fb4236fc2674"; + # Pinned to the nixos-26.05 channel tip (2026-08-03). Matches the orchestrator host's + # channel so both boxes share a nixpkgs and CVEs get patched. Bump deliberately, not drift. + # Previous pin: 50ab793 (nixos-24.11, 2025-06-30) — 24.11 was EOL; this is a 3-release jump + # (24.11 -> 25.05 -> 25.11 -> 26.05). Notable 26.05 changes: systemd Stage 1 boot by default, + # dbus-broker default, bash nixos-rebuild removed (Python rewrite mandatory), MySQL 8.0 removed. + nixpkgs.url = "github:NixOS/nixpkgs/531670d871c0e29724a02f3cbcac170adc65b58c"; - # Pinned to a commit that still uses plain `buildGoModule` — sops-nix master moved to - # `buildGo125Module` (Go 1.25), which our pinned nixpkgs 24.11 (2025-06-30) does not have. - sops-nix.url = "github:Mic92/sops-nix/77c423a03b9b2b79709ea2cb63336312e78b72e2"; + # sops-nix master (buildGo125Module / Go 1.25), which builds against nixpkgs 26.05. + # Previous pin (77c423a) held back to plain buildGoModule for nixpkgs 24.11 compat — no + # longer needed on 26.05. + sops-nix.url = "github:Mic92/sops-nix/f1406619a3884cd5c47992a70b8b35c9c0fcb4c9"; sops-nix.inputs.nixpkgs.follows = "nixpkgs"; };