21.11 Feature Freeze

[nrdxp]

It's that time again!

Let's clarify any blocking concerns for the 21.11 Release, which will be cut on the 26th of November.

Nix/nix-cli ecosystem: @edolstra @grahamc @nbp @Profpatsch Mobile: @samueldr Nixos Modules / internals : @Infinisil @Ericson2314 @alyssais
Nixos tests: @tfc Marketing: @garbas Docs: @ryantm Release: @tomberek

C: @matthewbauer Coq: @CohenCyril @gares @siraben @vbgl @Zimmi48 Emacs: @adisbladis Vim/Neovim: @jonringer @softinio @teto Erlang: @gleber @NixOS/beam Go: @kalbasit @Mic92 @zowoq Haskell: @NixOS/haskell @cdepillabout @sternenseemann @maralorn @expipiplus1 Python: @FRidh @jonringer
Perl: @stigtsp Php: @NixOS/php @aanderse @etu @globin @ma27 @talyz Ruby: @marsam Rust: @zowoq @Mic92 @andir @LnL7 Dhall: @Gabriel439 @ehmry R: @jbedo @bcdarwin

Darwin: @NixOS/darwin-maintainers @toonn

Bazel: @mboes Blockchains @mmahut @RaghavSood Podman: @NixOS/podman DockerTools: @roberth @utdemir Gnome: @jtojnar @NixOS/gnome Qt / KDE: @ttuegel @NixOS/qt-kde Cinnamon: @mkg20001 Pantheon: @NixOS/pantheon Postgres: @thoughtpolice

Everyone else: @NixOS/nixpkgs-committers @NixOS/release-engineers

No issue is too big or small, but let's remember that we are all working on donated time here, so let's triage those issues that can be realistically addressed by release time. Thanks everyone!

[Uthar]

It would be cool to include JDK 17 in the new NixOS (https://github.com/NixOS/nixpkgs/issues/137956), there's some work already started

[Gabriella439]

No pending changes for Dhall

[symphorien]

enableDebugging is broken: https://github.com/NixOS/nixpkgs/issues/136756. But I just checked, it's not documented, so maybe there are not so many users out there.

[samueldr]

Not blocking per se, but TODO: U-Boot 2021.10 upgrade, once upstream releases it in the next few days/weeks. #140552

I don't think there's really anything else on my end.

It would be nice to get the Plasma Mobile PRs in, but not a blocker either.

[pasqui23]

Now that we have https://github.com/NixOS/nixpkgs/issues/118650 fixed I think we can land Plasma wayland by 21.11

[jonringer]

It would be cool to include JDK 17 in the new NixOS (#137956), there's some work already started

adding new packages can happen at any time, and can be backported at any time

[ryantm]

No blockers from docs that I know of. We've made progress, but unfortunately, I do not think we'll be vanquishing DocBook by this release.

[happysalada]

Nothing that I can think of on the erlang/elixir/beam side.

[bobby285271]

No blockers from @NixOS/pantheon as Pantheon 6 update has been merged. We will try to backport the upcoming non-breaking change to 21.11 just as worldofpeace used to.

[jbedo]

No blockers for R.

[etu]

No blockers for PHP.

[vcunat]

Plug: perhaps we could decide on some approach around ZFS and new-kernel images? https://github.com/NixOS/nixpkgs/pull/59863 (There's no perfect solution, I'm afraid.)

[rnhmjoj]

I would love to see https://github.com/NixOS/nixpkgs/pull/136777 completed for this release. There's been no progress lately, but I think there's still enough time to finish it before the freeze.

[sternenseemann]

From an LLVM-ish perspective, I'd love to get #138289 in which resolves #138013.

#139333 would also be great, it contains a refactor to the current man infrastructure and allows using mandoc as the default man page viewer. Edit: Don't feel comfortable merging something this late, 22.05 is also fine.

[mweinelt]

From the Python perspective I would want to finally get rid of python2. We have been keeping it alive for NixOps 1.7, but I was assured that it would be dropped in time for 21.11.

@adisbladis @jonringer @FRidh

[marsam]

No blockers for Ruby For PostgreSQL I think we may want to drop 9.6 because has reached EOL

[rnhmjoj]

From the Python perspective I would want to finally get rid of python2. We have been keeping it alive for NixOps 1.7, but I was assured that it would be dropped in time for 21.11.

I would love to do that, but I don't think it's possible: there are still many applications (not libraries or python modules) that depends on it either at runtime or for the build system (like chromium).

[vcunat]

I suspect for build systems it might be OK-ish for a couple more years.

[Mic92]

I am not aware of any go or rust changes that need to go in.

[Mic92]

From the Python perspective I would want to finally get rid of python2. We have been keeping it alive for NixOps 1.7, but I was assured that it would be dropped in time for 21.11.

@adisbladis @jonringer @FRidh

At this point both nixopsUnstable and nixops are broken.

[Ma27]

Regarding the Linux kernel: I think it might be good to discuss how to proceed with hardened kernels in the future (see https://github.com/NixOS/nixpkgs/issues/140281)

[mweinelt]

At this point both nixopsUnstable and nixops are broken.

NixopsUnstable builds for me, fix for NixOps 1.7 https://github.com/NixOS/nixpkgs/pull/140363 is currently in staging.

[Mic92]

At this point both nixopsUnstable and nixops are broken.

NixopsUnstable builds for me, fix for NixOps 1.7 #140363.

It builds but it is unusable: https://github.com/nix-community/infra/pull/123

[nixos-discourse]

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/lets-have-a-great-21-11-release-cycle/15262/5

[hmenke]

sof-firmware update: https://github.com/NixOS/nixpkgs/pull/140742

[hmenke]

@vcunat

Plug: perhaps we could decide on some approach around ZFS and new-kernel images? #59863 (There's no perfect solution, I'm afraid.)

There is just no solution at all. We can only hope that upstream starts moving faster to support stable kernels in a timely manner. Since #126980 there is an option to query the ZFS package for the latest supported kernel. If users prefer running linuxPackages_latest they can always set allowBroken = true to compile against an unsupported kernel anyway. (Unfortunately nixpkgs doesn't have an allowBrokenPredicate so you have to allow all broken packages at once)

[cab404]

That would be nice if someone looked at #133625

[stigtsp]

A bulk update of perlPackages from CPAN is overdue and should imho be in for 21.11. An update was started a while back in #112386 but not completed. Help on getting this done is very much appreciated.

[vcunat]

@hmenke: the problem is with what ISOs we create (on Hydra); users themselves do have various options. (There's long thread in that PR.)

[samueldr]

@hmenke: the problem is with what ISOs we create (on Hydra); users themselves do have various options. (There's long thread in that PR.)

It's almost more of a NixOS organization issue, than a Nixpkgs issue, since it involves the website and channel update scripts more than Nixpkgs itself proper.

[KamilaBorowska]

From the Python perspective I would want to finally get rid of python2. We have been keeping it alive for NixOps 1.7, but I was assured that it would be dropped in time for 21.11.

I'm not sure how practical that is for 21.11, but I think we could actually mark Python 2 as insecure for 22.05. The biggest issue is Chromium, but I believe it should be possible to build Chromium with Python 3 instead of Python 2 (that said, i didn't actually test that because well, it's Chromium). At least https://github.com/chromium/chromium/blob/master/docs/python3_migration.md suggests that it's possible to build Chromium with Python 3.

[deliciouslytyped]

@symphorien I would prefer enableDebugging to work in a release.

[domenkozar]

@toonn is going to spend double hours to get #101229 in

[vcunat]

That will be tough with x86_64-darwin being slow on Hydra as it is now.

[r-burns]

That will be tough with x86_64-darwin being slow on Hydra as it is now.

Do you know more about the situation here? I opened this https://github.com/NixOS/nixos-org-configurations/issues/182 but it's probably relevant to point out here as well. The slowdown is extending into trunk and delaying channel updates so at this point it may affect even non-darwin release progress.

[vcunat]

I don't know anything really.

[primeos]

I'm not sure how practical that is for 21.11, but I think we could actually mark Python 2 as insecure for 22.05.

+1 for that :)

The biggest issue is Chromium, but I believe it should be possible to build Chromium with Python 3 instead of Python 2 (that said, i didn't actually test that because well, it's Chromium). At least https://github.com/chromium/chromium/blob/master/docs/python3_migration.md suggests that it's possible to build Chromium with Python 3.

Yes, it should be possible to build Chromium without Python 2 but it likely requires some additional changes/patches (might already be available from other Linux distros). I recently started working on this: #141027. Unfortunately, I currently lack time and the long iteration cycles don't help but I hope to get it working within a few weeks (help is of course welcome). So hopefully Chromium should be no blocker, at least not for long (and we should be able to use hacks to mark Python 2 as insecure but still allow it for important builds were it is only required during build time).

[Ma27]

Regarding the Linux kernel: I think it might be good to discuss how to proceed with hardened kernels in the future (see #140281)

Filed #141100. I think that this should be part of 21.11 to make sure users of hardened kernels have less issues. Because of that, I took the liberty to add it to the 21.11 milestone, I hope that's OK :)

[zakame]

A bulk update of perlPackages from CPAN is overdue and should imho be in for 21.11. An update was started a while back in #112386 but not completed. Help on getting this done is very much appreciated.

Will :muscle: up for this in this coming weekend :pray:

[nrdxp]

I took the liberty to add it to the 21.11 milestone, I hope that's OK :)

Absolutely! I made the project board so everyone could throw what they feel is relevant there. By all means, if anyone else wants to throw something on the board in addition to this thread, feel free.

[pranaysashank]

This is a small one line patch https://github.com/NixOS/nixpkgs/pull/138555 can someone get this in? Not sure, if this is the right issue for these kinds of stuff.

[jonringer]

Absolutely! I made the project board so everyone could throw what they feel is relevant there. By all means, if anyone else wants to throw something on the board in addition to this thread, feel free.

If it gets added to the project, the work should be feasible to merge before the branch-off date. Or the issue should be so pressing that it should warrant delaying the release.

[fabianhjr]

There is a blocking issue regarding binutils, there are 4 CVEs affecting binutils 2.35.1 ( https://repology.org/project/binutils/cves?version=2.35.1):

• https://nvd.nist.gov/vuln/detail/CVE-2020-35448 (Low)
• https://nvd.nist.gov/vuln/detail/CVE-2021-3487 (Medium)
• https://nvd.nist.gov/vuln/detail/CVE-2021-20284 (Medium)
• https://nvd.nist.gov/vuln/detail/CVE-2021-20294 (High)

As per conversations on binutils: 2.35.1 -> 2.37 (#134917) there is some non-trivial work required to update binutils to 2.37 however there is some conversation of the need to either patch or update. An intermediary step could be to update binutils: 2.35.1 -> 2.35.2 since only 1 of the medium previous CVEs apply to that version and it should be easier to do before the freeze for 21.11.

[sorpaas]

Wonder if we can get https://github.com/NixOS/nixpkgs/pull/139354 in. That's really useful for Nvidia users who want to use Wayland.

[risicle]

Mentioned this elsewhere, but would be nice to get #139545 merged and move most applications beyond libressl 3.2 reducing the amount of patching we might have to do.

[fabianhjr]

142012

[teto]

this is ready to be merged, I just dont want to merge it myself: accept a string in meta.broken https://github.com/NixOS/nixpkgs/pull/140325

[happysalada]

Hi, this might not be the right place, but I just thought I would mention it. The darwin machines are completely stuck at the moment, and there doesn't seem to be any progress on the situation. The channel is about 2 weeks old now and the machines are still blocked. At what point does this start affecting the release schedule ? (the channel can't be moved forward without darwin right ?) If this isn't the right place, I'm happy to take the conversation elsewhere. To be clear, I'm interested in helping. I've seen several times this was mentioned in the chat, but it kind of slipped away. I think this is starting to get important enough to start being talked about in the open.

[domenkozar]

See also https://github.com/NixOS/nixos-org-configurations/issues/182

The few who have access aren't responding, maybe release managers could step up to resolve this?

[nrdxp]

I would be happy to help and I've already got some Nix Mac builder experience from my day job. @tomberek also mentioned he'd be happy to help on matrix.

So I guess we just need access and we can try to coordinate an effort here :crossed_fingers: