Merge fort-nix/nix-bitcoin#617: Update to NixOS 23.05

e658209d56 run-tests.sh: fix building tests for Nix ≥ 2.15 (Erik Arvstedt)
bb2e88cec2 fix python packages for nixos 23.05 (Erik Arvstedt)
e31cc686f2 run-tests: make compatible with new shellcheck version (Erik Arvstedt)
76dc7b92e1 examples/deploy-container.sh: add extra-container version check (Erik Arvstedt)
6c2d1108a4 update the required extra-container version for nixos 23.05 (Erik Arvstedt)
e2cce7daa8 update to nixos 23.05 (Erik Arvstedt)
55c64d8dff update nixpkgs (Erik Arvstedt)
bd77b89fea rtl, clightning-rest: update to nodejs 18 (Erik Arvstedt)

Pull request description:

ACKs for top commit:
  jonasnick:
    ACK e658209d56

Tree-SHA512: 5814f56e469ad384dfb81bc11f9ac256a35cd2647e7fd997b14f84927448fbb880b0b1cee3bdf5a2b926760b74aab291e901e67a0759d43ffaf705ff6b741b97

.cirrus.yml

@@ -9,7 +9,7 @@ task:
 
   container:
     # Defined in https://github.com/nix-community/docker-nixpkgs
-    image: nixpkgs/nix-flakes:nixos-22.11
+    image: nixpkgs/nix-flakes:nixos-23.05
 
   matrix:
     - name: modules_test

dev/topics/rtl.sh

@@ -30,7 +30,7 @@ runuser -u "$(logname)" -- xdg-open "http://$ip:3000"
 rtl_src=~/s/RTL
 git clone https://github.com/Ride-The-Lightning/RTL "$rtl_src"
 
-nix build -o /tmp/nix-bitcoin-dev/nodejs --inputs-from . nixpkgs#nodejs-16_x
+nix build -o /tmp/nix-bitcoin-dev/nodejs --inputs-from . nixpkgs#nodejs-18_x
 # Start a shell in a sandbox
 env --chdir "$rtl_src" nix-bitcoin-firejail --whitelist="$rtl_src" --whitelist=/tmp/nix-bitcoin-dev/nodejs
 PATH=/tmp/nix-bitcoin-dev/nodejs/bin:"$PATH"

examples/configuration.nix

@@ -265,7 +265,7 @@
 
   services.openssh = {
     enable = true;
-    passwordAuthentication = false;
+    settings.PasswordAuthentication = false;
   };
   users.users.root = {
     openssh.authorizedKeys.keys = [
@@ -292,7 +292,7 @@
   # this value at the release version of the first install of this system.
   # Before changing this value read the documentation for this option
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "22.11"; # Did you read the comment?
+  system.stateVersion = "23.05"; # Did you read the comment?
 
   # The nix-bitcoin release version that your config is compatible with.
   # When upgrading to a backwards-incompatible release, nix-bitcoin will display an

examples/deploy-container.sh

@@ -87,6 +87,7 @@ read -rd '' src <<EOF || true
   };
 }
 EOF
+. "${BASH_SOURCE[0]%/*}"/../test/lib/extra-container-check-version.sh
 extra-container shell -E "$src" "${runCmd[@]}"
 
 # The container is automatically deleted at exit

flake.lock

@@ -28,11 +28,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1687171271,
+        "lastModified": 1687709756,
-        "narHash": "sha256-BJlq+ozK2B1sJDQXS3tzJM5a+oVZmi1q0FlBK/Xqv7M=",
+        "narHash": "sha256-Y5wKlQSkgEK2weWdOu4J3riRd+kV/VCgHsqLNTTWQ/0=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "abfb11bd1aec8ced1c9bb9adfe68018230f4fb3c",
+        "rev": "dbabf0ca0c0c4bce6ea5eaf65af5cb694d2082c7",
         "type": "github"
       },
       "original": {
@@ -43,27 +43,27 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1687376262,
+        "lastModified": 1688764204,
-        "narHash": "sha256-xtenf0Nc6So/5uaQqe8u3GVoAs/YdMUFsysPUuK8w1s=",
+        "narHash": "sha256-FsvK+tIvelCI0tWwlMDKfiyb7P/KfxpGbXMrdCKiT8s=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7859e9c101fabbd62551b8f4260124a6e2f01a46",
+        "rev": "d8bb6c681cf86265fdcf3cc3119f757bbb085835",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-22.11",
+        "ref": "nixos-23.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1687518131,
+        "lastModified": 1688798537,
-        "narHash": "sha256-KirltRIc4SFfk8bTNudIqgKAALH5oqpW3PefmkfWK5M=",
+        "narHash": "sha256-+3QEnDgBiso8lgUJpMagn6xCujmarc6zCWfKYAd6nqU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3d8a93602bc54ece7a4e689d9aea1a574e2bbc24",
+        "rev": "842e90934a352f517d23963df3ec0474612e483c",
         "type": "github"
       },
       "original": {

flake.nix

@@ -5,7 +5,7 @@
   '';
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.05";
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
     flake-utils.url = "github:numtide/flake-utils";
     extra-container = {

pkgs/clightning-plugins/default.nix

@@ -42,7 +42,7 @@ let
       description = "Lightning node exporter for the prometheus timeseries server";
       extraPkgs = [ prometheus_client ];
       patchRequirements =
-        "--replace prometheus-client==0.6.0 prometheus-client==0.15.0"
+        "--replace prometheus-client==0.6.0 prometheus-client==0.16.0"
         + " --replace pyln-client~=0.9.3 pyln-client~=23.02";
     };
     rebalance = {
@@ -79,7 +79,7 @@ let
 
         # Check that requirements are met
         PYTHONPATH='${toString python}/${python.sitePackages}' \
-          ${pkgs.python3Packages.pip}/bin/pip install -r requirements.txt --no-cache --no-index
+          ${pkgs.python3Packages.pip}/bin/pip install -r requirements.txt --no-cache --no-index --break-system-packages
 
         chmod +x '${script}'
         patchShebangs '${script}'

pkgs/clightning-rest/default.nix

@@ -1,7 +1,7 @@
 { lib
 , stdenvNoCC
-, nodejs-16_x
+, nodejs-18_x
-, nodejs-slim-16_x
+, nodejs-slim-18_x
 , fetchNodeModules
 , fetchurl
 , makeWrapper
@@ -17,8 +17,8 @@ let self = stdenvNoCC.mkDerivation {
   };
 
   passthru = {
-    nodejs = nodejs-16_x;
+    nodejs = nodejs-18_x;
-    nodejsRuntime = nodejs-slim-16_x;
+    nodejsRuntime = nodejs-slim-18_x;
 
     nodeModules = fetchNodeModules {
       inherit (self) src nodejs;

pkgs/lib.nix

@@ -41,8 +41,12 @@ let self = {
     RestrictAddressFamilies = self.defaultHardening.RestrictAddressFamilies + " AF_NETLINK";
   };
 
-  # nodejs applications require memory write execute for JIT compilation
+  nodejs = {
-  nodejs = { MemoryDenyWriteExecute = false; };
+    # Required for JIT compilation
+    MemoryDenyWriteExecute = false;
+    # Required by nodejs >= 18
+    SystemCallFilter = self.defaultHardening.SystemCallFilter ++ [ "@pkey" ];
+  };
 
   # Allow takes precedence over Deny.
   allowLocalIPAddresses = {

pkgs/pinned.nix

@@ -2,19 +2,19 @@
 pkgs: pkgsUnstable:
 {
   inherit (pkgs)
-    lightning-pool
-    lndconnect;
-
-  inherit (pkgsUnstable)
-    btcpayserver
     charge-lnd
-    clightning
     electrs
     elementsd
     extra-container
     fulcrum
     hwi
+    lndconnect;
+
+  inherit (pkgsUnstable)
+    btcpayserver
+    clightning
     lightning-loop
+    lightning-pool
     nbxplorer;
 
   inherit pkgs pkgsUnstable;

pkgs/python-packages/default.nix

@@ -1,4 +1,15 @@
 nbPkgs: python3:
+let
+  # Ignore eval error:
+  # `OpenSSL 1.1 is reaching its end of life on 2023/09/11 and cannot
+  # be supported through the NixOS 23.05 release cycle.`
+  # TODO-EXTERNAL: consider removing when
+  # https://github.com/Simplexum/python-bitcointx/issues/76 and
+  # https://github.com/JoinMarket-Org/joinmarket-clientserver#1451 are resolved.
+  openssl_1_1 = python3.pkgs.pkgs.openssl_1_1.overrideAttrs (old: {
+    meta = builtins.removeAttrs old.meta [ "knownVulnerabilities" ];
+  });
+in
 rec {
   pyPkgsOverrides = self: super: let
     inherit (self) callPackage;
@@ -13,12 +24,15 @@ rec {
       pyln-bolt7 = clightningPkg ./pyln-bolt7;
       pylightning = clightningPkg ./pylightning;
 
+      # bitstring 3.1.9, required by pyln-proto
+      bitstring = callPackage ./specific-versions/bitstring.nix {};
+
       # Packages only used by joinmarket
       bencoderpyx = callPackage ./bencoderpyx {};
       chromalog = callPackage ./chromalog {};
       python-bitcointx = callPackage ./python-bitcointx {
         inherit (nbPkgs) secp256k1;
-        openssl = super.pkgs.openssl_1_1;
+        openssl = openssl_1_1;
       };
       runes = callPackage ./runes {};
       sha256 = callPackage ./sha256 {};
@@ -39,7 +53,7 @@ rec {
 
       # cryptography 3.3.2, required by joinmarketdaemon
       cryptography = callPackage ./specific-versions/cryptography {
-        openssl = super.pkgs.openssl_1_1;
+        openssl = openssl_1_1;
         cryptography_vectors = callPackage ./specific-versions/cryptography/vectors.nix {};
       };
 
@@ -49,8 +63,8 @@ rec {
       # pyopenssl 21.0.0, required by joinmarketdaemon
       pyopenssl = callPackage ./specific-versions/pyopenssl.nix {};
 
-      # twisted 22.4.0, required by joinmarketbase
+      # txtorcon 22.0.0, required by joinmarketdaemon
-      twisted = callPackage ./specific-versions/twisted.nix {};
+      txtorcon = callPackage ./specific-versions/txtorcon.nix {};
     };
 
   nbPython3Packages = (python3.override {

pkgs/python-packages/jmbase/default.nix

@@ -6,6 +6,10 @@ buildPythonPackage rec {
 
   postUnpack = "sourceRoot=$sourceRoot/jmbase";
 
+  patchPhase = ''
+    sed -i 's|twisted==22.4.0|twisted==22.10.0|' setup.py
+  '';
+
   propagatedBuildInputs = [ future twisted service-identity chromalog txtorcon ];
 
   meta = with lib; {

pkgs/python-packages/jmclient/default.nix

@@ -14,7 +14,7 @@ buildPythonPackage rec {
     substituteInPlace setup.py \
       --replace "'klein==20.6.0'" "'klein>=20.6.0'"
     substituteInPlace setup.py \
-      --replace "'pyjwt==2.4.0'" "'pyjwt==2.5.0'"
+      --replace "'pyjwt==2.4.0'" "'pyjwt==2.6.0'"
   '';
 
   meta = with lib; {

pkgs/python-packages/pyln-proto/default.nix

@@ -29,6 +29,6 @@ buildPythonPackage rec {
   postUnpack = "sourceRoot=$sourceRoot/contrib/pyln-proto";
 
   postPatch = ''
-    sed -i 's|cryptography = "^36.0.1"|cryptography = "^38.0.0"|' pyproject.toml
+    sed -i 's|cryptography = "^36.0.1"|cryptography = "^40.0"|' pyproject.toml
   '';
 }

pkgs/python-packages/specific-versions/bitstring.nix

@@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, fetchpatch
+, unittestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "bitstring";
+  version = "3.1.9";
+
+  src = fetchFromGitHub {
+    owner = "scott-griffiths";
+    repo = pname;
+    rev = "bitstring-${version}";
+    sha256 = "0y2kcq58psvl038r6dhahhlhp1wjgr5zsms45wyz1naq6ri8x9qa";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "fix-running-unit-tests-using-unittest-hook.patch";
+      url = "https://github.com/scott-griffiths/bitstring/commit/e5ee3fd41cad2ea761f4450b13b0424ae7262331.patch";
+      hash = "sha256-+ZGywIfQQcYXJlYZBi402ONnysYm66G5zE4duJE40h8=";
+    })
+  ];
+
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "-s" "test" ];
+
+  pythonImportsCheck = [ "bitstring" ];
+
+  meta = with lib; {
+    description = "Module for binary data manipulation";
+    homepage = "https://github.com/scott-griffiths/bitstring";
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ bjornfor ];
+  };
+}

pkgs/python-packages/specific-versions/cryptography/default.nix

@@ -50,7 +50,8 @@ buildPythonPackage rec {
 
   checkInputs = [
     cryptography_vectors
-    hypothesis
+    # Work around `error: infinite recursion encountered`
+    (hypothesis.override { enableDocumentation = false; })
     iso8601
     pretend
     pytest
@@ -58,7 +59,7 @@ buildPythonPackage rec {
   ];
 
   checkPhase = ''
-    py.test --disable-pytest-warnings tests
+    ${pytest}/bin/py.test --disable-pytest-warnings tests
   '';
 
   # IOKit's dependencies are inconsistent between OSX versions, so this is the best we

pkgs/python-packages/specific-versions/twisted.nix

@@ -1,173 +0,0 @@
-{ lib
-, stdenv
-, buildPythonPackage
-, pythonOlder
-, fetchPypi
-, python
-, appdirs
-, attrs
-, automat
-, bcrypt
-, constantly
-, contextvars
-, cryptography
-, git
-, glibcLocales
-, h2
-, hyperlink
-, idna
-, incremental
-, priority
-, pyasn1
-, pyhamcrest
-, pynacl
-, pyopenssl
-, pyserial
-, service-identity
-, setuptools
-, typing-extensions
-, zope_interface
-
-  # for passthru.tests
-, cassandra-driver
-, klein
-, magic-wormhole
-, scrapy
-, treq
-, txaio
-, txamqp
-, txrequests
-, txtorcon
-, thrift
-, nixosTests
-}:
-
-buildPythonPackage rec {
-  pname = "twisted";
-  version = "22.4.0";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.6";
-
-  src = fetchPypi {
-    pname = "Twisted";
-    inherit version;
-    extension = "tar.gz";
-    sha256 = "sha256-oEeZD1ffrh4L0rffJSbU8W3NyEN3TcEIt4xS8qXxNoA=";
-  };
-
-  __darwinAllowLocalNetworking = true;
-
-  propagatedBuildInputs = [
-    attrs
-    automat
-    constantly
-    hyperlink
-    incremental
-    setuptools
-    typing-extensions
-    zope_interface
-  ];
-
-  postPatch = ''
-    echo 'ListingTests.test_localeIndependent.skip = "Timezone issue"'>> src/twisted/conch/test/test_cftp.py
-    echo 'ListingTests.test_newFile.skip = "Timezone issue"'>> src/twisted/conch/test/test_cftp.py
-    echo 'ListingTests.test_newSingleDigitDayOfMonth.skip = "Timezone issue"'>> src/twisted/conch/test/test_cftp.py
-    echo 'ListingTests.test_oldFile.skip = "Timezone issue"'>> src/twisted/conch/test/test_cftp.py
-    echo 'ListingTests.test_oldSingleDigitDayOfMonth.skip = "Timezone issue"'>> src/twisted/conch/test/test_cftp.py
-
-    echo 'PTYProcessTestsBuilder_AsyncioSelectorReactorTests.test_openFileDescriptors.skip = "invalid syntax"'>> src/twisted/internet/test/test_process.py
-    echo 'PTYProcessTestsBuilder_SelectReactorTests.test_openFileDescriptors.skip = "invalid syntax"'>> src/twisted/internet/test/test_process.py
-
-    echo 'UNIXTestsBuilder_AsyncioSelectorReactorTests.test_sendFileDescriptorTriggersPauseProducing.skip = "sendFileDescriptor producer was not paused"'>> src/twisted/internet/test/test_unix.py
-    echo 'UNIXTestsBuilder_SelectReactorTests.test_sendFileDescriptorTriggersPauseProducing.skip = "sendFileDescriptor producer was not paused"'>> src/twisted/internet/test/test_unix.py
-
-    echo 'FileObserverTests.test_getTimezoneOffsetEastOfUTC.skip = "mktime argument out of range"'>> src/twisted/test/test_log.py
-    echo 'FileObserverTests.test_getTimezoneOffsetWestOfUTC.skip = "mktime argument out of range"'>> src/twisted/test/test_log.py
-    echo 'FileObserverTests.test_getTimezoneOffsetWithoutDaylightSavingTime.skip = "tuple differs, values not"'>> src/twisted/test/test_log.py
-
-    echo 'MulticastTests.test_joinLeave.skip = "No such device"'>> src/twisted/test/test_udp.py
-    echo 'MulticastTests.test_loopback.skip = "No such device"'>> src/twisted/test/test_udp.py
-    echo 'MulticastTests.test_multicast.skip = "Reactor was unclean"'>> src/twisted/test/test_udp.py
-    echo 'MulticastTests.test_multiListen.skip = "No such device"'>> src/twisted/test/test_udp.py
-
-    echo 'DomishExpatStreamTests.test_namespaceWithWhitespace.skip = "syntax error: line 1, column 0"'>> src/twisted/words/test/test_domish.py
-
-    # not packaged
-    substituteInPlace src/twisted/test/test_failure.py \
-      --replace "from cython_test_exception_raiser import raiser  # type: ignore[import]" "raiser = None"
-  '' + lib.optionalString stdenv.isLinux ''
-    echo 'PTYProcessTestsBuilder_EPollReactorTests.test_openFileDescriptors.skip = "invalid syntax"'>> src/twisted/internet/test/test_process.py
-    echo 'PTYProcessTestsBuilder_PollReactorTests.test_openFileDescriptors.skip = "invalid syntax"'>> src/twisted/internet/test/test_process.py
-    echo 'UNIXTestsBuilder_EPollReactorTests.test_sendFileDescriptorTriggersPauseProducing.skip = "sendFileDescriptor producer was not paused"'>> src/twisted/internet/test/test_unix.py
-    echo 'UNIXTestsBuilder_PollReactorTests.test_sendFileDescriptorTriggersPauseProducing.skip = "sendFileDescriptor producer was not paused"'>> src/twisted/internet/test/test_unix.py
-
-    # Patch t.p._inotify to point to libc. Without this,
-    # twisted.python.runtime.platform.supportsINotify() == False
-    substituteInPlace src/twisted/python/_inotify.py --replace \
-      "ctypes.util.find_library(\"c\")" "'${stdenv.cc.libc}/lib/libc.so.6'"
-  '' + lib.optionalString (stdenv.isAarch64 && stdenv.isDarwin) ''
-    echo 'AbortConnectionTests_AsyncioSelectorReactorTests.test_fullWriteBufferAfterByteExchange.skip = "Timeout after 120 seconds"' >> src/twisted/internet/test/test_tcp.py
-    echo 'AbortConnectionTests_AsyncioSelectorReactorTests.test_resumeProducingAbort.skip = "Timeout after 120 seconds"' >> src/twisted/internet/test/test_tcp.py
-  '';
-
-  # Generate Twisted's plug-in cache. Twisted users must do it as well. See
-  # http://twistedmatrix.com/documents/current/core/howto/plugin.html#auto3
-  # and http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=477103 for details.
-  postFixup = ''
-    $out/bin/twistd --help > /dev/null
-  '';
-
-  checkInputs = [
-    git
-    glibcLocales
-    pyhamcrest
-  ]
-  ++ passthru.optional-dependencies.conch
-  # not supported on aarch64-darwin: https://github.com/pyca/pyopenssl/issues/873
-  ++ lib.optionals (!(stdenv.isDarwin && stdenv.isAarch64)) passthru.optional-dependencies.tls;
-
-  checkPhase = ''
-    export SOURCE_DATE_EPOCH=315532800
-    export PATH=$out/bin:$PATH
-    # race conditions when running in paralell
-    ${python.interpreter} -m twisted.trial twisted
-  '';
-
-  passthru = {
-    optional-dependencies = rec {
-      conch = [ appdirs bcrypt cryptography pyasn1 ];
-      conch_nacl = conch ++ [ pynacl ];
-      contextvars = lib.optionals (pythonOlder "3.7") [ contextvars ];
-      http2 = [ h2 priority ];
-      serial = [ pyserial ];
-      tls = [ idna pyopenssl service-identity ];
-    };
-
-    tests = {
-      inherit
-        cassandra-driver
-        klein
-        magic-wormhole
-        scrapy
-        treq
-        txaio
-        txamqp
-        txrequests
-        txtorcon
-        thrift;
-      inherit (nixosTests) buildbot matrix-synapse;
-    };
-  };
-
-  meta = with lib; {
-    homepage = "https://github.com/twisted/twisted";
-    description = "Twisted, an event-driven networking engine written in Python";
-    longDescription = ''
-      Twisted is an event-driven networking engine written in Python
-      and licensed under the MIT license.
-    '';
-    license = licenses.mit;
-    maintainers = with maintainers; [ SuperSandro2000 ];
-  };
-}

pkgs/python-packages/specific-versions/txtorcon.nix

@@ -0,0 +1,48 @@
+{ lib
+, stdenv
+, python
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, cryptography
+, incremental
+, twisted
+, automat
+, zope_interface
+, idna
+, pyopenssl
+, service-identity
+, pytestCheckHook
+, mock
+, lsof
+, GeoIP
+}:
+
+buildPythonPackage rec {
+  pname = "txtorcon";
+  version = "22.0.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-iaG2XjKks2nWfmwWY4f7xGjMXQUidEjSOaXn6XGKoFM=";
+  };
+
+  propagatedBuildInputs = [
+    cryptography
+    incremental
+    twisted
+    automat
+    zope_interface
+  ] ++ twisted.optional-dependencies.tls;
+
+  nativeCheckInputs = [ pytestCheckHook mock lsof GeoIP ];
+
+  doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
+
+  meta = {
+    description = "Twisted-based Tor controller client, with state-tracking and configuration abstractions";
+    homepage = "https://github.com/meejah/txtorcon";
+    maintainers = with lib.maintainers; [ jluttine exarkun ];
+    license = lib.licenses.mit;
+  };
+}

pkgs/rtl/default.nix

@@ -1,7 +1,7 @@
 { lib
 , stdenvNoCC
-, nodejs-16_x
+, nodejs-18_x
-, nodejs-slim-16_x
+, nodejs-slim-18_x
 , fetchNodeModules
 , fetchpatch
 , fetchurl
@@ -18,8 +18,8 @@ let self = stdenvNoCC.mkDerivation {
   };
 
   passthru = {
-    nodejs = nodejs-16_x;
+    nodejs = nodejs-18_x;
-    nodejsRuntime = nodejs-slim-16_x;
+    nodejsRuntime = nodejs-slim-18_x;
 
     nodeModules = fetchNodeModules {
       inherit (self) src nodejs;

test/clightning-replication.nix

@@ -101,7 +101,7 @@ makeTestVM {
 
   testScript =  { nodes, ... }: let
     systems = builtins.concatStringsSep ", "
-      (mapAttrsToList (name: node: ''"${name}": "${node.config.system.build.toplevel}"'') nodes);
+      (mapAttrsToList (name: node: ''"${name}": "${node.system.build.toplevel}"'') nodes);
   in ''
     systems = { ${systems} }
 

test/lib/extra-container-check-version.sh

@@ -0,0 +1,13 @@
+containerBin=$(type -P extra-container) || true
+if [[ ! ($containerBin && $(realpath "$containerBin") == *extra-container-0.12*) ]]; then
+    echo
+    echo "Building extra-container. Skip this step by adding extra-container 0.12 to PATH."
+    nix build --out-link /tmp/extra-container "${BASH_SOURCE[0]%/*}"/../..#extra-container
+    # When this script is run as root, e.g. when run in an extra-container shell,
+    # chown the gcroot symlink to the regular (login) user so that the symlink can be
+    # overwritten when this script is run without root.
+    if [[ $EUID == 0 ]]; then
+        chown "$(logname):" --no-dereference /tmp/extra-container
+    fi
+    export PATH="/tmp/extra-container/bin${PATH:+:}$PATH"
+fi

test/lib/make-container.sh

@@ -71,18 +71,6 @@ while [[ $# -gt 0 ]]; do
     esac
 done
 
-containerBin=$(type -P extra-container) || true
+. "${BASH_SOURCE[0]%/*}"/extra-container-check-version.sh
-if [[ ! ($containerBin && $(realpath "$containerBin") == *extra-container-0.11*) ]]; then
-    echo
-    echo "Building extra-container. Skip this step by adding extra-container 0.11 to PATH."
-    nix build --out-link /tmp/extra-container "$scriptDir"/..#extra-container
-    # When this script is run as root, e.g. when run in an extra-container shell,
-    # chown the gcroot symlink to the regular (login) user so that the symlink can be
-    # overwritten when this script is run without root.
-    if [[ $EUID == 0 ]]; then
-        chown "$(logname):" --no-dereference /tmp/extra-container
-    fi
-    export PATH="/tmp/extra-container/bin${PATH:+:}$PATH"
-fi
 
 exec "$container"/bin/container "$containerCommand" "$@"

test/lib/make-test.nix

@@ -23,7 +23,7 @@ let
     };
 
     testScript = nodes: let
-      cfg = nodes.nodes.machine.config;
+      cfg = nodes.nodes.machine;
       data = {
         data = cfg.test.data;
         tests = cfg.tests;

test/nixos-search/flake.lock

@@ -18,11 +18,11 @@
     "nixos-org-configurations": {
       "flake": false,
       "locked": {
-        "lastModified": 1685568558,
+        "lastModified": 1688381214,
-        "narHash": "sha256-KYYnHfhp8Zc0Hu6ZGuZUe2EKvtyIF6Q34yb14kGoz8c=",
+        "narHash": "sha256-0g/rZUiXIk1H6D6Oa1VcK41REeIRGSdVDPAFVqZKf1E=",
         "owner": "NixOS",
         "repo": "nixos-org-configurations",
-        "rev": "acc635f7453b76ac1b7bdf164a3f22e5267ff329",
+        "rev": "083c137b7ae19a1a8d6822fea7ca30aeeda72ac8",
         "type": "github"
       },
       "original": {
@@ -39,11 +39,11 @@
         "npmlock2nix": "npmlock2nix"
       },
       "locked": {
-        "lastModified": 1687164217,
+        "lastModified": 1688414580,
-        "narHash": "sha256-e1PcI2Zf6IKQZuH77CvEgAKjXj3URPWJ67Tups40UOI=",
+        "narHash": "sha256-U7ngzJ0ErKTxrjG5Okym9PLxnmjoeDIZZe0dfhv8ER4=",
         "owner": "nixos",
         "repo": "nixos-search",
-        "rev": "b5acb880d160a478e8d3ad42aee8806979171135",
+        "rev": "1128c8fb69d4a8557baeee13053e7792339554f9",
         "type": "github"
       },
       "original": {

test/run-tests.sh

@@ -232,6 +232,8 @@ nixInstantiate() {
 
 nixBuild() {
     local outLinkName=$1
+    local drv=$2
+    shift
     shift
     args=(--print-out-paths -L)
     if [[ $outLinkPrefix ]]; then
@@ -239,7 +241,25 @@ nixBuild() {
     else
         args+=(--no-link)
     fi
-    nix build "${args[@]}" "$@"
+    if isNixVersionGreaterEqual_2_15; then
+        # This syntax is supported by Nix ≥ 2.13
+        drv="$(realpath "$drv")^*"
+    fi
+    nix build "$drv" "${args[@]}" "$@"
+}
+
+isNixGE_2_15=undefined
+isNixVersionGreaterEqual_2_15() {
+    if [[ $isNixGE_2_15 == undefined ]]; then
+        isNixGE_2_15=
+        if {
+            echo '2.15'
+            nix --version | awk '{print $NF}'
+        } | sort -C -V; then
+            isNixGE_2_15=1
+        fi
+    fi
+    [[ $isNixGE_2_15 ]]
 }
 
 flake() {
@@ -320,7 +340,7 @@ if [[ $# -gt 0 && $1 != -* ]]; then
     if [[ $command == eval ]]; then
         command=evalTest
     fi
-    : ${scenario:=default}
+    : "${scenario:=default}"
 elif [[ $scenario ]]; then
     command=buildTest
 else

test/tests.nix

@@ -390,7 +390,10 @@ in {
             config
           ];
           # Share the same pkgs instance among tests
-          nixpkgs.pkgs = pkgs.lib.mkDefault pkgs;
+          # Set priority slightly higher (i.e. to a slightly lower number) than `mkDefault`,
+          # so that this module can be used with function `pkgs.nixos`, which already
+          # sets `nixpkgs.pkgs` with prio `mkDefault`.
+          nixpkgs.pkgs = lib.mkOverride 900 pkgs;
         };
       };