Use fetchurl for amd-uprof

Enable parallelBuilding in jemalloc
Make bsc users trusted in nix-portable
2026-03-09 12:32:05 +01:00 · 2026-03-09 12:32:04 +01:00 · 2026-03-09 12:32:04 +01:00 · 2026-03-09 12:32:04 +01:00 · 2026-03-09 12:32:04 +01:00 · 2026-03-09 12:32:04 +01:00
63 changed files with 160 additions and 464 deletions
--- a/keys.nix
+++ b/keys.nix
@@ -22,9 +22,8 @@ rec {
    storage    = [ bay lake2 ];
    monitor    = [ hut ];
    login      = [ apex ];
-    services   = [ tent ];

-    system     = storage ++ monitor ++ login ++ services;
+    system     = storage ++ monitor ++ login;
    safe       = system ++ compute;
    all        = safe ++ playground;
  };
--- a/m/apex/nfs.nix
+++ b/m/apex/nfs.nix
@@ -7,7 +7,7 @@
    mountdPort = 4002;
    statdPort = 4000;
    exports = ''
-      /home 10.0.40.0/21(rw,async,no_subtree_check,no_root_squash)
+      /home 10.0.40.0/24(rw,async,no_subtree_check,no_root_squash)
      /home 10.106.0.0/24(rw,async,no_subtree_check,no_root_squash)
    '';
  };
@@ -15,19 +15,19 @@
    # Check with `rpcinfo -p`
    extraCommands = ''
      # Accept NFS traffic from compute nodes but not from the outside
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 111   -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 2049  -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 4000  -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 4001  -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 4002  -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 20048 -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 111   -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 2049  -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 4000  -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 4001  -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 4002  -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 20048 -j nixos-fw-accept
      # Same but UDP
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 111   -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 2049  -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 4000  -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 4001  -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 4002  -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 20048 -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 111   -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 2049  -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 4000  -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 4001  -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 4002  -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 20048 -j nixos-fw-accept

      # Accept NFS traffic from wg0
      iptables -A nixos-fw -p tcp -i wg0 -s 10.106.0.0/24 --dport 111   -j nixos-fw-accept
--- a/m/bay/configuration.nix
+++ b/m/bay/configuration.nix
@@ -35,7 +35,7 @@
        # Accept monitoring requests from hut
        iptables -A nixos-fw -p tcp -s hut -m multiport --dport 9283,9002 -j nixos-fw-accept
        # Accept all Ceph traffic from the local network
-        iptables -A nixos-fw -p tcp -s 10.0.40.0/21 -m multiport --dport 3300,6789,6800:7568 -j nixos-fw-accept
+        iptables -A nixos-fw -p tcp -s 10.0.40.0/24 -m multiport --dport 3300,6789,6800:7568 -j nixos-fw-accept
      '';
    };
  };
--- a/m/common/base/users.nix
+++ b/m/common/base/users.nix
@@ -134,7 +134,7 @@
        home = "/home/Computational/varcila";
        description = "Vincent Arcila";
        group = "Computational";
-        hosts = [ "apex" "hut" "tent" "fox" "owl1" "owl2" ];
+        hosts = [ "apex" "hut" "tent" "fox" ];
        hashedPassword = "$6$oB0Tcn99DcM4Ch$Vn1A0ulLTn/8B2oFPi9wWl/NOsJzaFAWjqekwcuC9sMC7cgxEVb.Nk5XSzQ2xzYcNe5MLtmzkVYnRS1CqP39Y0";
        openssh.authorizedKeys.keys = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKGt0ESYxekBiHJQowmKpfdouw0hVm3N7tUMtAaeLejK vincent@varch"
--- a/m/hut/gitlab-runner.nix
+++ b/m/hut/gitlab-runner.nix
@@ -51,7 +51,6 @@
          "/nix/store:/nix/store:ro"
          "/nix/var/nix/db:/nix/var/nix/db:ro"
          "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
-          "/var/run/postgresql/:/var/run/postgresql/"
        ];
        dockerExtraHosts = [
          # Required to pass the proxy via hut
@@ -61,8 +60,6 @@
        registrationFlags = [
          # Increase build log length to 64 MiB
          "--output-limit 65536"
-          # Allow the runner to be used in multiple projects
-          "--locked=false"
        ];
        preBuildScript = pkgs.writeScript "setup-container" ''
          mkdir -p -m 0755 /nix/var/log/nix/drvs
--- a/m/hut/ssh-robot-probes.nix
+++ b/m/hut/ssh-robot-probes.nix
@@ -6,12 +6,6 @@ let
      chmod +x $out
    ''
  ;
-  sblame-probe-script = pkgs.runCommand "sblame-probe.sh" { }
-    ''
-      cp ${./sblame-probe.sh} $out;
-      chmod +x $out
-    ''
-  ;
 in
 {
  # Use a new user to handle the SSH keys
@@ -34,17 +28,4 @@ in
      Group = "ssh-robot";
    };
  };
-
-  systemd.services.sblame-probe = {
-    description = "Daemon to report SLURM statistics via SSH";
-    path = [ pkgs.openssh pkgs.netcat ];
-    after = [ "network.target" ];
-    wantedBy = [ "default.target" ];
-    serviceConfig = {
-      Type = "simple";
-      ExecStart = "${pkgs.socat}/bin/socat TCP4-LISTEN:9967,fork EXEC:${sblame-probe-script}";
-      User = "ssh-robot";
-      Group = "ssh-robot";
-    };
-  };
 }
--- a/m/hut/monitoring.nix
+++ b/m/hut/monitoring.nix
@@ -5,7 +5,7 @@
    ../module/slurm-exporter.nix
    ../module/meteocat-exporter.nix
    ../module/upc-qaire-exporter.nix
-    ./ssh-robot-probes.nix
+    ./gpfs-probe.nix
    ../module/nix-daemon-exporter.nix
  ];

@@ -111,7 +111,6 @@
            "127.0.0.1:${toString config.services.prometheus.exporters.smartctl.port}"
            "127.0.0.1:9341" # Slurm exporter
            "127.0.0.1:9966" # GPFS custom exporter
-            "127.0.0.1:9967" # SLURM custom exporter
            "127.0.0.1:9999" # Nix-daemon custom exporter
            "127.0.0.1:9929" # Meteocat custom exporter
            "127.0.0.1:9928" # UPC Qaire custom exporter
--- a/m/hut/ompss2-timer.nix
+++ b/m/hut/ompss2-timer.nix
@@ -29,7 +29,6 @@
    closing = pkgs.writeText "closing.txt"
    ''
      Subject: OmpSs-2 release enters closing period
-      To: star@bsc.es

      Hi,

@@ -43,7 +42,6 @@
    freeze = pkgs.writeText "freeze.txt"
    ''
      Subject: OmpSs-2 release enters freeze period
-      To: star@bsc.es

      Hi,

@@ -57,7 +55,6 @@
    release = pkgs.writeText "release.txt"
    ''
      Subject: OmpSs-2 release now
-      To: star@bsc.es

      Hi,

@@ -72,7 +69,7 @@
        script = ''
          set -eu
          set -o pipefail
-          cat ${mail} | ${config.security.wrapperDir}/sendmail -t star@bsc.es
+          cat ${mail} | ${config.security.wrapperDir}/sendmail star@bsc.es
        '';
        serviceConfig = {
          Type = "oneshot";
--- a/m/hut/postgresql.nix
+++ b/m/hut/postgresql.nix
@@ -8,14 +8,12 @@
      { name = "anavarro"; ensureClauses.superuser = true; }
      { name = "rarias";   ensureClauses.superuser = true; }
      { name = "grafana"; }
-      { name = "gitlab-runner"; }
    ];
    authentication = ''
-      #type  database     DBuser         auth-method
-      local  perftestsdb  rarias         trust
-      local  perftestsdb  anavarro       trust
-      local  perftestsdb  grafana        trust
-      local  perftestsdb  gitlab-runner  trust
+      #type  database     DBuser    auth-method
+      local  perftestsdb  rarias    trust
+      local  perftestsdb  anavarro  trust
+      local  perftestsdb  grafana   trust
    '';
  };
 }
--- a/m/hut/sblame-probe.sh
+++ b/m/hut/sblame-probe.sh
@@ -1,8 +0,0 @@
-#!/bin/sh
-
-cat <<EOF
-HTTP/1.1 200 OK
-Content-Type: text/plain; version=0.0.4; charset=utf-8; escaping=values
-
-EOF
-ssh bsc015557@glogin2.bsc.es "timeout 3 command sblame -E"
--- a/m/lake2/configuration.nix
+++ b/m/lake2/configuration.nix
@@ -57,7 +57,7 @@
        # Accept monitoring requests from hut
        iptables -A nixos-fw -p tcp -s hut --dport 9002 -j nixos-fw-accept
        # Accept all Ceph traffic from the local network
-        iptables -A nixos-fw -p tcp -s 10.0.40.0/21 -m multiport --dport 3300,6789,6800:7568 -j nixos-fw-accept
+        iptables -A nixos-fw -p tcp -s 10.0.40.0/24 -m multiport --dport 3300,6789,6800:7568 -j nixos-fw-accept
      '';
    };
  };
--- a/m/tent/configuration.nix
+++ b/m/tent/configuration.nix
@@ -17,7 +17,6 @@
    ../module/vpn-dac.nix
    ../module/hut-substituter.nix
    ../module/tc1-board.nix
-    ../module/ceph.nix
  ];

  # Select the this using the ID to avoid mismatches
@@ -65,13 +64,6 @@
    fsType = "ext4";
  };

-  # Mount the NFS home
-  fileSystems."/nfs/home" = {
-    device = "10.106.0.30:/home";
-    fsType = "nfs";
-    options = [ "nfsvers=3" "rsize=1024" "wsize=1024" "cto" "nofail" ];
-  };
-
  # Make a /vault/$USER directory for each user.
  systemd.services.create-vault-dirs = let
    # Take only normal users in tent
--- a/m/tent/gitea.nix
+++ b/m/tent/gitea.nix
@@ -1,7 +1,4 @@
 { config, lib, ... }:
-let
-  cfg = config.services.gitea;
-in
 {
  services.gitea = {
    enable = true;
@@ -29,52 +26,6 @@ in
        SENDMAIL_ARGS = "--";
      };
    };
-
-    dump = {
-      enable = false; # Do not enable NixOS module, use our custom systemd script below
-      backupDir = "/vault/backup/gitea";
-    };
-  };
-
-  systemd.services.gitea-backup = let
-    exe = lib.getExe cfg.package;
-  in {
-    description = "Gitea daily backup";
-    after = [ "gitea.service" ];
-    path = [ cfg.package ];
-
-    environment = {
-      USER = cfg.user;
-      HOME = cfg.stateDir;
-      GITEA_WORK_DIR = cfg.stateDir;
-      GITEA_CUSTOM = cfg.customDir;
-    };
-
-    serviceConfig = {
-      Type = "oneshot";
-      User = cfg.user;
-      WorkingDirectory = cfg.dump.backupDir;
-    };
-
-    script = ''
-      name="gitea-dump-$(date +%a).${cfg.dump.type}"
-      ${exe} dump --type ${cfg.dump.type} --file - >"$name.tmp"
-      mv "$name.tmp" "$name"
-      cp "$name" "/ceph/backup/gitea/$name"
-    '';
-  };
-
-  # Create also the /ceph directories if needed
-  systemd.tmpfiles.rules = [
-    "d /ceph/backup/gitea/ 0750 ${cfg.user} ${cfg.group} - -"
-    "z /ceph/backup/gitea/ 0750 ${cfg.user} ${cfg.group} - -"
-  ];
-
-  systemd.timers.gitea-backup = {
-    description = "Update timer for gitea-backup";
-    partOf = [ "gitea-backup.service" ];
-    wantedBy = [ "timers.target" ];
-    timerConfig.OnCalendar = cfg.dump.interval;
  };

  # Allow gitea user to send mail
--- a/overlay.nix
+++ b/overlay.nix
@@ -39,7 +39,15 @@ let
    nanos6Debug = final.nanos6.override { enableDebug = true; };
    nixtools = callPackage ./pkgs/nixtools/default.nix { };
    nixgen = callPackage ./pkgs/nixgen/default.nix { };
-    nix-portable = callPackage ./pkgs/nix-portable/default.nix { };
+    nix-portable = callPackage ./pkgs/nix-portable/default.nix {
+      busybox = final.pkgsStatic.busybox;
+      bwrap = final.pkgsStatic.bubblewrap;
+      gnutar = final.pkgsStatic.gnutar;
+      perl = final.pkgsBuildBuild.perl;
+      xz = final.pkgsStatic.xz;
+      zstd = final.pkgsStatic.zstd;
+      bashInteractive = final.pkgsStatic.bashInteractive;
+    };
    nix-wrap = callPackage ./pkgs/nix-wrap/default.nix { };
    nodes = callPackage ./pkgs/nodes/default.nix { };
    nosv = callPackage ./pkgs/nosv/default.nix { };
@@ -48,7 +56,6 @@ let
    osumb = callPackage ./pkgs/osu/default.nix { };
    ovni = callPackage ./pkgs/ovni/default.nix { };
    ovniGit = final.ovni.override { useGit = true; };
-    papi = callPackage ./pkgs/papi/default.nix { papi = prev.papi; };
    paraverKernel = callPackage ./pkgs/paraver/kernel.nix { };
    prometheus-slurm-exporter = prev.callPackage ./pkgs/slurm-exporter/default.nix { };
    #pscom = callPackage ./pkgs/parastation/pscom.nix { }; # Unmaintaned
--- a/pkgs/amd-uprof/default.nix
+++ b/pkgs/amd-uprof/default.nix
@@ -26,7 +26,7 @@ let
  # NOTE: Remember to update the radare2 patch below if AMDuProfPcm changes.
  src = fetchurl {
    url = "https://download.amd.com/developer/eula/uprof/uprof-5-1/${tarball}";
-    sha256 = "sha256-j9gxcBcIg6Zhc5FglUXf/VV9bKSo+PAKeootbN7ggYk=";
+    sha256 = "sha256-jAmsw/xmctJ2r7BKyuA+9exLgZbu3cvrYtyRUUTt8sM=";
    curlOptsList = [
      "-H" "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.0"
      "-H" "'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'"
@@ -34,6 +34,10 @@ let
      "-H" "Accept-Encoding: gzip, deflate, br, zstd"
      "-H" "Referer: https://www.amd.com/"
    ];
+    downloadToTemp = true;
+    postFetch = ''
+      cat "$downloadedFile" | tr '\r' '\n' > "$out"
+    '';
  };

 in
@@ -41,7 +45,6 @@ in
    pname = "AMD-uProf";
    inherit src version;
    dontStrip = true;
-    strictDeps = true;
    phases = [ "installPhase" "fixupPhase" ];
    nativeBuildInputs = [ autoPatchelfHook radare2 ];
    buildInputs = [
--- a/pkgs/amd-uprof/driver.nix
+++ b/pkgs/amd-uprof/driver.nix
@@ -18,7 +18,6 @@ in stdenv.mkDerivation {
    set +x
  '';
  hardeningDisable = [ "pic" "format" ];
-  strictDeps = true;
  nativeBuildInputs = kernel.moduleBuildDependencies;
  patches = [ ./makefile.patch ./hrtimer.patch ./remove-wr-rdmsrq.patch ];
  makeFlags = [
--- a/pkgs/bench6/default.nix
+++ b/pkgs/bench6/default.nix
@@ -59,7 +59,6 @@ stdenv.mkDerivation rec {
  ];
  hardeningDisable = [ "all" ];
  dontStrip = true;
-  strictDeps = true;

  meta = {
    homepage = "https://gitlab.pm.bsc.es/rarias/bench6";
--- a/pkgs/bigotes/default.nix
+++ b/pkgs/bigotes/default.nix
@@ -16,8 +16,6 @@ stdenv.mkDerivation {
  };
  nativeBuildInputs = [ cmake ];

-  strictDeps = true;
-
  meta = {
    homepage = "https://github.com/rodarima/bigotes";
    description = "Versatile benchmark tool";
--- a/pkgs/cudainfo/default.nix
+++ b/pkgs/cudainfo/default.nix
@@ -10,13 +10,10 @@
 stdenv.mkDerivation (finalAttrs: {
  name = "cudainfo";
  src = ./.;
-  strictDeps = true;
-  nativeBuildInputs = [
-    cudatoolkit # Required for nvcc
-    autoAddDriverRunpath
-  ];
  buildInputs = [
+    cudatoolkit # Required for nvcc
    (lib.getOutput "static" cudaPackages.cuda_cudart) # Required for -lcudart_static
+    autoAddDriverRunpath
  ];
  installPhase = ''
    mkdir -p $out/bin
@@ -26,7 +23,6 @@ stdenv.mkDerivation (finalAttrs: {
    name = "cudainfo-test";
    requiredSystemFeatures = [ "cuda" ];
    dontBuild = true;
-    strictDeps = true;
    nativeCheckInputs = [
      finalAttrs.finalPackage # The cudainfo package from above
      strace # When it fails, it will show the trace
--- a/pkgs/extrae/default.nix
+++ b/pkgs/extrae/default.nix
@@ -20,7 +20,7 @@
 #, python3Packages
 , installShellFiles
 , symlinkJoin
-, enablePapi ? true
+, enablePapi ? stdenv.hostPlatform == stdenv.buildPlatform # Disabled when cross-compiling
 }:

 let
--- a/pkgs/gpi-2/default.nix
+++ b/pkgs/gpi-2/default.nix
@@ -33,7 +33,6 @@ stdenv.mkDerivation rec {
  };

  enableParallelBuilding = true;
-  strictDeps = true;

  patches = [ ./rdma-core.patch ./max-mem.patch ];

--- a/pkgs/intel-oneapi/2023.nix
+++ b/pkgs/intel-oneapi/2023.nix
@@ -128,7 +128,6 @@ let

    phases = [ "installPhase" "fixupPhase" ];
    dontStrip = true;
-    strictDeps = true;
    installPhase = ''
      mkdir -p $out/{bin,etc,lib,include}
      mkdir -p $out/share/man
@@ -180,7 +179,6 @@ let
    ];
    phases = [ "installPhase" "fixupPhase" ];
    dontStrip = true;
-    strictDeps = true;

    autoPatchelfIgnoreMissingDeps = [ "libhwloc.so.5" ];

@@ -224,7 +222,6 @@ let
    ];
    phases = [ "installPhase" "fixupPhase" ];
    dontStrip = true;
-    strictDeps = true;

    autoPatchelfIgnoreMissingDeps = [ "libsycl.so.6" ];

@@ -292,7 +289,6 @@ let
    phases = [ "installPhase" "fixupPhase" ];

    dontStrip = true;
-    strictDeps = true;

    installPhase = ''
      mkdir -p $out/{bin,lib,include}
@@ -381,7 +377,6 @@ let
    phases = [ "installPhase" "fixupPhase" ];

    dontStrip = true;
-    strictDeps = true;

    installPhase = ''
      mkdir -p $out/{bin,lib}
--- a/pkgs/llvm-ompss2/clang.nix
+++ b/pkgs/llvm-ompss2/clang.nix
@@ -3,7 +3,6 @@
 , lib
 , fetchFromGitHub
 , cmake
-, ninja
 , bash
 , python3
 , perl
@@ -49,7 +48,6 @@ in stdenv.mkDerivation {
  inherit (source) src version;

  enableParallelBuilding = true;
-  strictDeps = true;

  passthru = {
    CC = "clang";
@@ -64,7 +62,6 @@ in stdenv.mkDerivation {
  nativeBuildInputs = [
    bash
    cmake
-    ninja
    elfutils
    llvmPackages_latest.lld
    pkg-config
--- a/pkgs/llvm-ompss2/openmp.nix
+++ b/pkgs/llvm-ompss2/openmp.nix
@@ -39,9 +39,7 @@ stdenv.mkDerivation rec {
    perl
    pkg-config
    python3
-  ];
-
-  buildInputs = lib.optionals enableNosv [
+  ] ++ lib.optionals enableNosv [
    nosv
  ] ++ lib.optionals enableOvni [
    ovni
@@ -56,7 +54,6 @@ stdenv.mkDerivation rec {
  dontStrip = enableDebug;

  separateDebugInfo = true;
-  strictDeps = true;

  cmakeFlags = [
    "-DLIBOMP_OMPD_SUPPORT=OFF"
@@ -74,28 +71,6 @@ stdenv.mkDerivation rec {
    rm -f $out/libllvmrt/libomp.*
  '';

-  doInstallCheck = true;
-  # There are not cmake flags to force nOS-V, it enables it when found through
-  # pkg-config. If enableNosv is set, but we fail to find it at build time,
-  # the build will succeed but won't use nOS-V (libompv won't be created).
-  # This is a sanity check to ensure that after install we have the proper
-  # files.
-  installCheckPhase =
-    if enableNosv then
-      ''
-        test -f $out/lib/libompv.so
-        test -f $out/libllvmrt/libompv.so
-        test ! -f $out/lib/libomp.so
-        test ! -f $out/libllvmrt/libomp.so
-      ''
-    else
-      ''
-        test -f $out/lib/libomp.so
-        test -f $out/libllvmrt/libomp.so
-        test ! -f $out/lib/libompv.so
-        test ! -f $out/libllvmrt/libompv.so
-      '';
-
  passthru = {
    inherit nosv;
  };
--- a/pkgs/lmbench/default.nix
+++ b/pkgs/lmbench/default.nix
@@ -27,7 +27,6 @@ stdenv.mkDerivation rec {
  hardeningDisable = [ "all" ];

  enableParallelBuilding = false;
-  strictDeps = true;

  preBuild = ''
    makeFlagsArray+=(
--- a/pkgs/meteocat-exporter/default.nix
+++ b/pkgs/meteocat-exporter/default.nix
@@ -9,7 +9,6 @@ python3Packages.buildPythonApplication {
  src = ./.;

  doCheck = false;
-  strictDeps = true;

  build-system = with python3Packages; [
    setuptools
--- a/pkgs/mpich/default.nix
+++ b/pkgs/mpich/default.nix
@@ -53,7 +53,6 @@ in mpich.overrideAttrs (old: {
  '';

  hardeningDisable = [ "all" ];
-  strictDeps = true;

  meta = old.meta // {
    maintainers = old.meta.maintainers ++ (with lib.maintainers.bsc; [ rarias ]);
--- a/pkgs/nanos6/default.nix
+++ b/pkgs/nanos6/default.nix
@@ -16,7 +16,7 @@
 , jemallocNanos6 ? null
 , cachelineBytes ? 64
 , enableGlibcxxDebug ? false
-, enablePapi ? true
+, enablePapi ? stdenv.hostPlatform == stdenv.buildPlatform # Disabled when cross-compiling
 , useGit ? false
 , gitUrl ? "ssh://git@bscpm04.bsc.es/nanos6/nanos6"
 , gitBranch ? "master"
@@ -80,8 +80,7 @@ in
      (optional enableGlibcxxDebug "CXXFLAGS=-D_GLIBCXX_DEBUG") ++
      # Most nanos6 api symbols are resolved at runtime, so prefer
      # ifunc by default
-      (optional isCross "--with-symbol-resolution=ifunc") ++
-      (optional enablePapi "--with-papi=${papi}");
+      (optional isCross "--with-symbol-resolution=ifunc");

    postConfigure = lib.optionalString (!enableDebug) ''
      # Disable debug
@@ -96,14 +95,16 @@ in
    dontStrip = enableDebug;
    separateDebugInfo = true;

-    strictDeps = true;
-
    nativeBuildInputs = [
      autoconf
      automake
      libtool
      pkg-config
-    ];
+
+      # TODO: papi_version is needed for configure:
+      # ./configure: line 27378: papi_version: command not found
+      # This probably breaks cross-compilation
+    ] ++ lib.optionals enablePapi [ papi ];

    buildInputs = [
      boost
--- a/pkgs/nix-portable/default.nix
+++ b/pkgs/nix-portable/default.nix
@@ -1,6 +1,8 @@
 with builtins;
 {
+  bwrap,
  nix,
+  proot,
  unzip,
  zip,
  unixtools,
@@ -15,25 +17,23 @@ with builtins;
    "bashInteractive"
  ],

+  busybox,
  cacert ? pkgs.cacert,
  compression ? "zstd -19 -T0",
+  gnutar ? pkgs.pkgsStatic.gnutar,
  lib ? pkgs.lib,
+  perl ? pkgs.perl,
  pkgs ? import <nixpkgs> {},
+  xz ? pkgs.pkgsStatic.xz,
+  zstd ? pkgs.pkgsStatic.zstd,
+  nixStatic,
  # hardcode executable to run. Useful when creating a bundle.
  bundledPackage ? null,
-
-  nixStatic,
-  busyboxStatic ? pkgs.pkgsStatic.busybox,
-  bwrapStatic ? pkgs.pkgsStatic.bubblewrap,
-  zstdStatic ? pkgs.pkgsStatic.zstd,
-
-  perlBuildBuild ? pkgs.pkgsBuildBuild.perl,
+  ...
 }@inp:
 with lib;
 let

-  perl = perlBuildBuild;
-
  pname =
    if bundledPackage == null
    then "nix-portable"
@@ -100,18 +100,19 @@ let
    export PATH="${out}/bin:\$PATH"
  '';

-  caBundleZstd = pkgs.runCommand "cacerts" {} "cat ${cacert}/etc/ssl/certs/ca-bundle.crt | ${zstd}/bin/zstd -19 > $out";
+  caBundleZstd = pkgs.runCommand "cacerts" {} "cat ${cacert}/etc/ssl/certs/ca-bundle.crt | ${inp.zstd}/bin/zstd -19 > $out";

-  bwrap = packStaticBin "${bwrapStatic}/bin/bwrap";
+  bwrap = packStaticBin "${inp.bwrap}/bin/bwrap";
  nixStatic = packStaticBin "${inp.nixStatic}/bin/nix";
-  zstd = packStaticBin "${zstdStatic}/bin/zstd";
+  proot = packStaticBin "${inp.proot}/bin/proot";
+  zstd = packStaticBin "${inp.zstd}/bin/zstd";

  # the default nix store contents to extract when first used
  storeTar = maketar ([ cacert nix nixpkgsSrc ] ++ lib.optional (bundledPackage != null) bundledPackage);


  # The runtime script which unpacks the necessary files to $HOME/.nix-portable
-  # and then executes nix via bwrap
+  # and then executes nix via proot or bwrap
  # Some shell expressions will be evaluated at build time and some at run time.
  # Variables/expressions escaped via `\$` will be evaluated at run time
  runtimeScript = ''
@@ -126,6 +127,17 @@ let
      trap "declare -p > \''${TMPDIR:-/tmp}/np_env" EXIT
    fi

+    # there seem to be less issues with proot when disabling seccomp
+    # though on android it is needed
+    if [ -n "\$TERMUX_VERSION" ]; then
+      unset LD_PRELOAD
+      NP_RUNTIME=\''${NP_RUNTIME:-proot}
+      export PROOT_TMP_DIR="\$TMPDIR/proot"
+      mkdir -p "\$PROOT_TMP_DIR"
+    else
+      export PROOT_NO_SECCOMP=\''${PROOT_NO_SECCOMP:-1}
+    fi
+
    set -e
    if [ -n "\$NP_DEBUG" ] && [ "\$NP_DEBUG" -ge 2 ]; then
      set -x
@@ -230,9 +242,9 @@ let
      # install busybox
      mkdir -p \$dir/busybox/bin
      (base64 -d> "\$dir/busybox/bin/busybox" && chmod +x "\$dir/busybox/bin/busybox") << END
-    $(cat ${busyboxStatic}/bin/busybox | base64)
+    $(cat ${busybox}/bin/busybox | base64)
    END
-      busyBins="${toString (attrNames (filterAttrs (d: type: type == "symlink") (readDir "${busyboxStatic}/bin")))}"
+      busyBins="${toString (attrNames (filterAttrs (d: type: type == "symlink") (readDir "${inp.busybox}/bin")))}"
      for bin in \$busyBins; do
        [ ! -e "\$dir/busybox/bin/\$bin" ] && ln -s busybox "\$dir/busybox/bin/\$bin"
      done
@@ -242,6 +254,7 @@ let

      # install other binaries
      ${installBin zstd "zstd"}
+      ${installBin proot "proot"}
      ${installBin bwrap "bwrap"}
      ${installBin nixStatic "nix"}

@@ -255,9 +268,6 @@ let
    export SHELL="${pkgs.bashInteractive.out}/bin/bash"
    export PS1="\n\[\033[1;32m\][\[\e]0;\u@\h: \w\a\]\u@\h:\w]\$\[\033[0m\] "

-    # unset bash function aliases
-    unset -f which ml module
-
    ### setup SSL
    # find ssl certs or use from nixpkgs
    debug "figuring out ssl certs"
@@ -332,6 +342,7 @@ let
        fi
      done

+      toBind="\$toBind \$dir/busybox/bin /bin"
      # provide /bin/sh via the shipped busybox
      toBind="\$toBind \$dir/busybox/bin/busybox /bin/sh"
      toBind="\$toBind \$dir/busybox/bin/busybox /usr/bin/env"
@@ -377,6 +388,9 @@ let
    debug "bwrap executable: \$NP_BWRAP"
    [ -z "\$NP_NIX" ] && NP_NIX=\$dir/bin/nix
    debug "nix executable: \$NP_NIX"
+    [ -z "\$NP_PROOT" ] && NP_PROOT=\$(PATH="\$PATH_OLD:\$PATH" which proot 2>/dev/null) || true
+    [ -z "\$NP_PROOT" ] && NP_PROOT=\$dir/bin/proot
+    debug "proot executable: \$NP_PROOT"
    debug "testing all available runtimes..."
    if [ -z "\$NP_RUNTIME" ]; then
      # read last automatic selected runtime from disk
@@ -434,8 +448,14 @@ let
        # --bind \$dir/busybox/bin/busybox /bin/sh\\
    else
      # proot
-      echo Unsupported runtime: $NP_RUNTIME
-      exit 1
+      collectBinds
+      makeBindArgs -b ":" \$toBind \$sslBind
+      run="\$NP_PROOT \$PROOT_ARGS\\
+        -r \$dir/emptyroot\\
+        -b /dev:/dev\\
+        -b \$dir/nix:/nix\\
+        \$binds"
+        # -b \$dir/busybox/bin/busybox:/bin/sh\\
    fi
    debug "base command will be: \$run"

@@ -557,8 +577,8 @@ let


    ### set PATH
-    export PATH="\$dir/busybox/bin"
-    export PATH="\$PATH:\$store${lib.removePrefix "/nix/store" nix}/bin"
+    # restore original PATH and append busybox
+    export PATH="\$PATH_OLD:\$dir/busybox/bin"

    ### install programs via nix
    ${concatMapStringsSep "\n" installDynamic bootstrapPrograms}
@@ -622,6 +642,7 @@ let
    zip="${zip}/bin/zip -0"
    $zip $out/bin/nix-portable.zip ${bwrap}/bin/bwrap
    $zip $out/bin/nix-portable.zip ${nixStatic}/bin/nix
+    $zip $out/bin/nix-portable.zip ${proot}/bin/proot
    $zip $out/bin/nix-portable.zip ${zstd}/bin/zstd
    $zip $out/bin/nix-portable.zip ${storeTar}/tar
    $zip $out/bin/nix-portable.zip ${caBundleZstd}
@@ -645,6 +666,6 @@ let
 in
 nixPortable.overrideAttrs (prev: {
  passthru = (prev.passthru or {}) // {
-    inherit bwrap;
+    inherit bwrap proot;
  };
 })
--- a/pkgs/nixgen/default.nix
+++ b/pkgs/nixgen/default.nix
@@ -8,7 +8,6 @@ stdenv.mkDerivation {
  version = "0.0.1";
  src = ./nixgen;
  dontUnpack = true;
-  strictDeps = true;
  phases = [ "installPhase" ];
  installPhase = ''
    mkdir -p $out/bin
--- a/pkgs/nixtools/default.nix
+++ b/pkgs/nixtools/default.nix
@@ -16,7 +16,6 @@ stdenv.mkDerivation rec {
  makeFlags = [ "DESTDIR=$(out)" ];
  preBuild = "env";
  dontPatchShebangs = true;
-  strictDeps = true;

  meta = {
    homepage = "https://gitlab.pm.bsc.es/rarias/nixtools";
--- a/pkgs/nodes/default.nix
+++ b/pkgs/nodes/default.nix
@@ -48,7 +48,6 @@ in
    enableParallelBuilding = true;
    dontStrip = true;
    separateDebugInfo = true;
-    strictDeps = true;

    configureFlags = [
      "--with-nosv=${nosv}"
--- a/pkgs/nosv/default.nix
+++ b/pkgs/nosv/default.nix
@@ -7,7 +7,7 @@
 , numactl
 , hwloc
 , papi
-, enablePapi ? true
+, enablePapi ? stdenv.hostPlatform == stdenv.buildPlatform # Disabled when cross-compiling
 , cacheline ? 64 # bits
 , ovni ? null
 , useGit ? false
@@ -40,17 +40,16 @@ let

  source = if (useGit) then git else release;
 in
-  stdenv.mkDerivation {
+  stdenv.mkDerivation rec {
    pname = "nosv";
    inherit (source) src version;
    hardeningDisable = [ "all" ];
    dontStrip = true;
    separateDebugInfo = true;
-    strictDeps = true;
    configureFlags = [
      "--with-ovni=${ovni}"
      "CACHELINE_WIDTH=${toString cacheline}"
-    ] ++ lib.optionals enablePapi [ "--with-papi=${papi}" ];
+    ];
    nativeBuildInputs = [
      autoreconfHook
      pkg-config
@@ -60,7 +59,6 @@ in
      hwloc
      ovni
    ] ++ lib.optionals enablePapi [ papi ];
-    patches = [ ./fix-papi.patch ];

    meta = {
      homepage = "https://gitlab.bsc.es/nos-v/nos-v";
--- a/pkgs/nosv/fix-papi.patch
+++ b/pkgs/nosv/fix-papi.patch
@@ -1,136 +0,0 @@
-Commit ID: c09633f172ce4075e0a05a33f6dcbe8e03e1202a
-Change ID: onmwypnnrysktutwsvotqovzponvwrxs
-Bookmarks: fix/papi fix/papi@git fix/papi@origin
-Author   : Aleix Boné <aleix.boneribo@bsc.es> (2025-12-10 11:14:14)
-Committer: Aleix Boné <aleix.boneribo@bsc.es> (2025-12-12 12:56:48)
-
-    Improve PAPI m4 module for cross compilation
-
-diff --git a/m4/papi.m4 b/m4/papi.m4
-index de90584870..8398f856f5 100644
--- a/m4/papi.m4
-+++ b/m4/papi.m4
-@@ -1,6 +1,6 @@
- #	This file is part of Nanos6 and is licensed under the terms contained in the COPYING file.
- #
-#	Copyright (C) 2021-2022 Barcelona Supercomputing Center (BSC)
-+#	Copyright (C) 2021-2025 Barcelona Supercomputing Center (BSC)
- 
- AC_DEFUN([AC_CHECK_PAPI],
- 	[
-@@ -8,34 +8,38 @@
- 			[papi],
- 			[AS_HELP_STRING([--with-papi=prefix], [specify the installation prefix of PAPI])],
- 			[ ac_cv_use_papi_prefix=$withval ],
-			[ ac_cv_use_papi_prefix="" ]
-+			[ ac_cv_use_papi_prefix="check" ]
- 		)
- 
- 		if test x"${ac_cv_use_papi_prefix}" = x"no"; then
- 			AC_MSG_CHECKING([the PAPI installation prefix])
- 			AC_MSG_RESULT([${ac_cv_use_papi_prefix}])
- 			ac_use_papi=no
-		elif test x"${ac_cv_use_papi_prefix}" != x"" ; then
-			AC_MSG_CHECKING([the PAPI installation prefix])
-			AC_MSG_RESULT([${ac_cv_use_papi_prefix}])
-			papi_LIBS="-L${ac_cv_use_papi_prefix}/lib -lpapi -Wl,-rpath,${ac_cv_use_papi_prefix}/lib"
-			papi_CFLAGS="-I$ac_cv_use_papi_prefix/include"
-			ac_use_papi=yes
-		else
-+		elif test x"${ac_cv_use_papi_prefix}" = x""; then
-+			AC_MSG_RESULT([invalid prefix])
-+			AC_MSG_ERROR([papi prefix specified but empty])
-+		elif test x"${ac_cv_use_papi_prefix}" = x"yes" -o x"${ac_cv_use_papi_prefix}" = x"check"; then
- 			PKG_CHECK_MODULES(
- 				[papi],
-				[papi],
-+				[papi >= 5.6.0],
- 				[
- 					AC_MSG_CHECKING([the PAPI installation prefix])
- 					AC_MSG_RESULT([retrieved from pkg-config])
- 					papi_CFLAGS="${papi_CFLAGS}"
- 					ac_use_papi=yes
-+					ac_papi_version_correct=yes
- 				], [
- 					AC_MSG_CHECKING([the PAPI installation prefix])
- 					AC_MSG_RESULT([not available])
- 					ac_use_papi=no
- 				]
- 			)
-+		else
-+			AC_MSG_CHECKING([the PAPI installation prefix])
-+			AC_MSG_RESULT([${ac_cv_use_papi_prefix}])
-+			papi_LIBS="-L${ac_cv_use_papi_prefix}/lib -lpapi -Wl,-rpath,${ac_cv_use_papi_prefix}/lib"
-+			papi_CFLAGS="-I$ac_cv_use_papi_prefix/include"
-+			ac_use_papi=yes
- 		fi
- 
- 		if test x"${ac_use_papi}" = x"yes" ; then
-@@ -53,10 +57,10 @@
- 					ac_use_papi=yes
- 				],
- 				[
-					if test x"${ac_cv_use_papi_prefix}" != x"" ; then
-						AC_MSG_ERROR([PAPI cannot be found.])
-+					if test x"${ac_cv_use_papi_prefix}" = x"yes" ; then
-+						AC_MSG_ERROR([PAPI >= 5.6.0 cannot be found.])
- 					else
-						AC_MSG_WARN([PAPI cannot be found.])
-+						AC_MSG_WARN([PAPI >= 5.6.0 not available.])
- 					fi
- 					ac_use_papi=no
- 				]
-@@ -64,30 +68,38 @@
- 
- 			CFLAGS="${ac_save_CFLAGS}"
- 			LIBS="${ac_save_LIBS}"
-+		elif test x"${ac_cv_use_papi_prefix}" = x"yes" ; then
-+			AC_MSG_ERROR([PAPI >= 5.6.0 cannot be found.])
- 		fi
- 
-		if test x"${ac_use_papi}" = x"yes" ; then
-			if test x"${ac_cv_use_papi_prefix}" != x"" ; then
-+		if test x"${ac_use_papi}" = x"yes" -a x"${ac_papi_version_correct}" != x"yes" ; then
-+			if test x"${ac_cv_use_papi_prefix}" != x"yes" -a x"${ac_cv_use_papi_prefix}" != x"check" ; then
- 				papiBinary=${ac_cv_use_papi_prefix}/bin/papi_version
- 			else
- 				papiBinary=papi_version
- 			fi
-			papiVersion=`$papiBinary | sed 's/[[^0-9.]]*\([[0-9.]]*\).*/\1/'`
- 
-			AX_COMPARE_VERSION(
-				[[${papiVersion}]],
-				[[ge]],
-				[[5.6.0]],
-				[[ac_papi_version_correct=yes]],
-				[[ac_papi_version_correct=no]]
-			)
- 
-			if test x"${ac_papi_version_correct}" != x"yes" ; then
-				AC_MSG_ERROR([PAPI version must be >= 5.6.0.])
-				ac_use_papi=no
-+			if test x"$cross_compiling" = x"yes" ; then
-+				AC_MSG_WARN([Cross-compiling detected, skipping PAPI version check])
- 			else
-				AC_MSG_CHECKING([if the PAPI version >= 5.6.0.])
-				AC_MSG_RESULT([${ac_papi_version_correct}])
-+				papiVersion=`$papiBinary | sed 's/[[^0-9.]]*\([[0-9.]]*\).*/\1/'`
-+
-+				AX_COMPARE_VERSION(
-+					[[${papiVersion}]],
-+					[[ge]],
-+					[[5.6.0]],
-+					[[ac_papi_version_correct=yes]],
-+					[[ac_papi_version_correct=no]]
-+				)
-+
-+				if test x"${ac_papi_version_correct}" != x"yes" ; then
-+					AC_MSG_ERROR([PAPI version must be >= 5.6.0.])
-+					ac_use_papi=no
-+				else
-+					AC_MSG_CHECKING([if the PAPI version >= 5.6.0.])
-+					AC_MSG_RESULT([${ac_papi_version_correct}])
-+				fi
- 			fi
- 		fi
- 
--- a/pkgs/osu/default.nix
+++ b/pkgs/osu/default.nix
@@ -24,7 +24,6 @@ stdenv.mkDerivation rec {

  doCheck = true;
  enableParallelBuilding = true;
-  strictDeps = true;
  nativeBuildInputs = [ mpiAll ];
  buildInputs = [ mpiAll ];
  hardeningDisable = [ "all" ];
--- a/pkgs/ovni/default.nix
+++ b/pkgs/ovni/default.nix
@@ -40,7 +40,6 @@ in
    inherit (source) src version;
    dontStrip = true;
    separateDebugInfo = true;
-    strictDeps = true;
    postPatch = ''
      patchShebangs --build test/
    '';
--- a/pkgs/papi/default.nix
+++ b/pkgs/papi/default.nix
@@ -1,29 +0,0 @@
-{
-  stdenv,
-  papi,
-}:
-
-if stdenv.hostPlatform == stdenv.buildPlatform then
-  papi
-else
-  papi.overrideAttrs (old: {
-    configureFlags = (old.configureFlags or [ ]) ++ [
-      # Only perf-events works when cross compiling, since for the rest, papi's
-      # configure.in uses `test -f` which is not allowed when cross-compiling.
-      # FIXME: patch configure.in to skip the faulty checks when cross-compiling
-      "--disable-perf-event-uncore"
-      "--with-sysdetect=no"
-
-      # Flags below are adapted from "cross compile sample" in papi's
-      # src/configure.in. (--host is already set by nix). Verified to
-      # cross-compile in both riscv64 and aarch64-multiplatform targets.
-      "--with-ffsll"
-      "--with-tls=__thread"
-      "--with-virtualtimer=clock_thread_cputime_id"
-      "--with-walltimer=clock_realtime"
-      "--with-perf-events"
-      "--with-CPU=${stdenv.hostPlatform.uname.processor}"
-      "--with-arch=${stdenv.hostPlatform.uname.processor}"
-    ];
-    patches = (old.patches or [ ]) ++ [ ./fix-ar-cross.patch ];
-  })
--- a/pkgs/papi/fix-ar-cross.patch
+++ b/pkgs/papi/fix-ar-cross.patch
@@ -1,19 +0,0 @@
-diff --git a/sde_lib/Makefile b/sde_lib/Makefile
-index 8518f92..90a9953 100644
--- a/sde_lib/Makefile
-+++ b/sde_lib/Makefile
-@@ -1,4 +1,5 @@
- CC ?= gcc
-+AR ?= ar
- SDE_INC = -I. -I..
- SDE_LD = -ldl -pthread
- CFLAGS += -Wextra -Wall -O2
-@@ -18,7 +19,7 @@ dynamic: $(DOBJS)
- 	rm -f *_d.o
- 
- static: $(SOBJS)
-	ar rs libsde.a $(SOBJS)
-+	$(AR) rs libsde.a $(SOBJS)
- 	rm -f *_s.o
- 
- clean:
--- a/pkgs/paraver/default.nix
+++ b/pkgs/paraver/default.nix
@@ -47,7 +47,6 @@ stdenv.mkDerivation rec {

  dontStrip = true;
  enableParallelBuilding = true;
-  strictDeps = true;

  preConfigure = ''
    export CFLAGS="-O3"
--- a/pkgs/paraver/kernel.nix
+++ b/pkgs/paraver/kernel.nix
@@ -34,7 +34,6 @@ stdenv.mkDerivation rec {
  enableParallelBuilding = true;

  dontStrip = true;
-  strictDeps = true;

  preConfigure = ''
    export CFLAGS="-O3 -DPARALLEL_ENABLED"
--- a/pkgs/slurm-exporter/default.nix
+++ b/pkgs/slurm-exporter/default.nix
@@ -13,7 +13,6 @@ buildGoModule rec {

  vendorHash = "sha256-A1dd9T9SIEHDCiVT2UwV6T02BSLh9ej6LC/2l54hgwI=";
  doCheck = false;
-  strictDeps = true;

  meta = with lib; {
    description = "Prometheus SLURM Exporter";
--- a/pkgs/sonar/default.nix
+++ b/pkgs/sonar/default.nix
@@ -18,7 +18,6 @@ stdenv.mkDerivation rec {
  };
  hardeningDisable = [ "all" ];
  dontStrip = true;
-  strictDeps = true;
  configureFlags = [ "--with-ovni=${ovni}" ];

  nativeBuildInputs = [
--- a/pkgs/tagaspi/default.nix
+++ b/pkgs/tagaspi/default.nix
@@ -17,7 +17,6 @@ stdenv.mkDerivation rec {
  pname = "tagaspi";
  enableParallelBuilding = true;
  separateDebugInfo = true;
-  strictDeps = true;

  version = "2.0";
  src = fetchFromGitHub {
--- a/pkgs/tampi/default.nix
+++ b/pkgs/tampi/default.nix
@@ -45,7 +45,6 @@ in stdenv.mkDerivation {
  inherit (source) src version;
  enableParallelBuilding = true;
  separateDebugInfo = true;
-  strictDeps = true;

  nativeBuildInputs = [
    autoconf
--- a/pkgs/upc-qaire-exporter/default.nix
+++ b/pkgs/upc-qaire-exporter/default.nix
@@ -9,7 +9,6 @@ python3Packages.buildPythonApplication {
  src = ./.;

  doCheck = false;
-  strictDeps = true;

  build-system = with python3Packages; [
    setuptools
--- a/secrets/ceph-user.age
+++ b/secrets/ceph-user.age
@@ -1,29 +1,25 @@
 age-encryption.org/v1
-> ssh-ed25519 AY8zKw Crgof1PMHzv3jBw8VeJAst6FKSoyqPFdANFpf79CAgo
-7fagE5BmlWdTsdY/i3RbExu1KBcjW1LQXbYwu6chxlk
-> ssh-ed25519 sgAamA tGRCaK8mjvz65YziXjRcjMOHIRoyGNJFzBEEbivXPDo
-YLzE5a3J81r+gzkfZIeh9gS+mXzMooC82tBbZ+C3C8o
-> ssh-ed25519 HY2yRg +vhO1/vdGPM1JnZRsvVnViFWaFWUZ7MIqvWdePivkxA
-2K+JdN82DTeGh9QwZBTaghg8C5BCLoEsOgTCM64PU28
-> ssh-ed25519 fw2Xhg NHDn0dq32I/AVdUZlpzBX6retlEYEUipde7A9R90qW4
-SJO78ooqEwfHlBRW+YCzgSQJb1JHNo8jz37t3qvLClE
-> ssh-ed25519 G5LX5w d4HfLzI2623artkR2FIfRJgr5yb2BKZJUWqPnwOWDCk
-Kh50QESJZSjaJPyp3xroHGn0fD5pPNEYgKkDdqxGpjs
-> ssh-ed25519 tcumPQ wQyOKtT15Qezs3cyv5/xxIPVD7Jyk6N6ZLkfxxBHLTo
-rKlRBjJdfDVT6U8211+ssFF8yY9yRs1u3GhCSvsw2oE
-> ssh-ed25519 JJ1LWg 98tF1MdA244xNny4w3RnMFuubf4WcuQaZf2bN2Uq8Qc
-MA1Xh1H9vHisVYdqkxNeBkngtn8cYuT2eSimvooIXYo
-> ssh-ed25519 cDBabA imJ0rXLQETELP7yo3sArhqA9nJwY+S6gkC7tA7CJsQA
-pKMHW/KDAoEj5ZD64VKekg6et9hlS2PKSgDw3eB3eu8
-> ssh-ed25519 WY7yGw +2g5021/02HvLxLqq42ynr6qKgOKJ3J5GgB1a1bmFXg
-fYvj52R6bM6ngPOZ2lwVezTJnx+8LJBbdnaapKKbyd0
-> ssh-ed25519 cK5kHw fLZ6yF3NggJ724rjYqhs5ZZh1xUExuK+ITAyqONluzk
-NS9OMX70XEHrbPQnmC4KB/eoiHChIb8DwDLYJiwOLUU
-> ssh-ed25519 CAWG4Q tVduE/wMzdfS+DjNbU3Q4blNhL/A63IehNSZGJkJjD0
-jEBB5zG+gLA/88YF+KqWQsNH7lfCsWNvAkrgfbescFs
-> ssh-ed25519 xA739A ZhFvev77I+YOl1YSHKn2ZcEvGoLjWOILufjd4q/k8HM
-YXEtHHtjPQlgZW60zHgHm7CLI6vYiRo+AM8QERL9tCg
-> ssh-ed25519 MSF3dg 9DvLNheBU1vlfW2zNNxBrGnJ6k4P5ox7s+OGKlgRdyQ
-wseHfLGHz0huNi5sZsNOfeNkm6Kjjx0SZ8lK4/oXtUQ
--- bnJE+14onuSla0XmckD4z/wChWGZh6exbkcbyhcmNYU
-<EFBFBD><EFBFBD>t<>N猈<><10>U<EFBFBD>w▮i2<69><32>-<2D>iV'(<1E>IF<49><46>	S<><53>xs/s<><73>	<09><>NDm<44>Q<EFBFBD><51><EFBFBD>o<EFBFBD><6F><EFBFBD><EFBFBD>wZv<7F><76>.\
+-> ssh-ed25519 AY8zKw /gmhFOFqOs8IobAImvQVKeM5Y6k0FpuR61/Cu5drVVI
+g9FXJg2oIoien0zJ70FWHwSTM8SBwbpS188S3Swj7EM
+-> ssh-ed25519 sgAamA opPjlWPhSiI0Rd5l7kd204S5FXFLcQcQftyKb7MDmnU
+3XrRDVnglCP+vBwvfd1rP5gHttsGDHyXwbf10a8/kKY
+-> ssh-ed25519 HY2yRg QKZbubM76C3tobPoyCFDRclA9Pzb2fC7s4WOoIgdORc
+K5kckU0KhQFTE6SikJXFJgM41Tco5+VqOsaG0qLrY1Q
+-> ssh-ed25519 fw2Xhg +ohqts8dLFjvdHxrGHcOGxU0dm+V3N//giljHkobpDM
+jR/UzGrfS9lrJ/VeolKLxfzeJAf2fIB2pdIn/6ukqNk
+-> ssh-ed25519 tcumPQ 3DPkDPIQQSVtXSLzIRETsIyXQ0k1o18Evn6vf+l/6R8
+bLXF62OmJjnOT1vvgq3+AcOKKSG5NonrK5EqCVc0Mwo
+-> ssh-ed25519 JJ1LWg 2Wefc7eLolMU5InEmCNTq21Mf71mI0a2N1HgDrlHvy4
+qXFW9CQBnrzubZ0mzS0Io2WGRrwGBkmeYndBTcZn/fM
+-> ssh-ed25519 cDBabA oiH36AoIt/fFFYgnoxtH7OoetP+2/wjtn8qo3RJDSHc
+qKmkxy1aZGP4ZwC0iH7n7hiJ0+rFQYvjQb5O1a1Z0r4
+-> ssh-ed25519 cK5kHw bX3RtO5StMejUYWAaA37fjHA5nO7Xs1vWDQk3yOjs2o
+Egxmcf8FKAd+E5hMLmhV1yQsCo5rJyUazf1szOvpTAM
+-> ssh-ed25519 CAWG4Q oKqqRDJH0w8lsoQBQk0w8PO+z5gFNmSaGBUSumvDp1I
+m1zWp9MfViAmtpbJhqOHraIokDaPKb0DvvO4vAGCTWI
+-> ssh-ed25519 xA739A G26kPOz6sbFATs+KAr7gbDvji13eA1smFusQAOJXMwA
+Sppvz7A103kZoNxoGsd6eXeCvVh7mBE2MRwLFj9O1dY
+-> ssh-ed25519 MSF3dg 55ekNcp+inbUd+GQ/VZ7BoBASaJ8YDqF74CVXy1PUxQ
+aTHLLAbzQPWWld/OT3BKebc6FcmsqMTaWCPBGm1UHic
+--- mVkAMnI9XQhS3fMiFuuXP/yLR9wEG9+Rr8pA4Uc0avY
+<04>DU <20><>s<EFBFBD><73><EFBFBD><EFBFBD>j<EFBFBD><6A>M<EFBFBD><4D>$<24>[<5B>M<EFBFBD><4D><EFBFBD><03>[_<>K7s<37>ju<>v<EFBFBD>D<EFBFBD>4<EFBFBD>g<EFBFBD><67>܄3<>Gn<47><6E><EFBFBD> ɽ<>P<EFBFBD>7~rZs<><73>
--- a/secrets/gitea-runner-token.age
+++ b/secrets/gitea-runner-token.age
--- a/secrets/gitlab-bsc-docker-token.age
+++ b/secrets/gitlab-bsc-docker-token.age
--- a/secrets/gitlab-runner-docker-token.age
+++ b/secrets/gitlab-runner-docker-token.age
@@ -1,13 +1,13 @@
 age-encryption.org/v1
-> ssh-ed25519 HY2yRg eHM55QsHK1ca9b5nP3EoVUZYu0w2d4B5tkilNK0j/lw
-6Na6lkMe0fOd7+vNP1fLIaVEQDUw5m65Wh8jUH1I6C0
-> ssh-ed25519 cK5kHw 0ekhoBYwF7OSWwn4P5f/J4gXb9UHJAWGKV0yI7HCzzE
-2Q+Tt5jXAB9ip9jf1z+jeM4FSiqd1w5DNtbqtacuOcM
-> ssh-ed25519 CAWG4Q Jmw4v9efOFXHjjNky96q/d6vGBP5dNM4wK9zoGrwOh8
-u5I17wcIq8/2ARWckDXsYckhfX0jWE4AEm5mip/KHws
-> ssh-ed25519 xA739A 10pPeC2YG9DJzaQlt7p+fGo27VDiL2dN6JmvY2npcUw
-4aRV8DekYeL9HagGWgOSjlYnPKmYdKZH8Aw4lRdm+r8
-> ssh-ed25519 MSF3dg hDwIE3Su6cN3sq2E5v/oy6vTNfxTT1ZPts85//gIhwY
-aoiaGjQYJB1ededhIuVBCKDRLIOVThWz1pSTvg65J3Y
--- OYPAGb5U/nwLOIV5VchSvxhChjNnwzbEgU9glSkWCl4
-<EFBFBD>=<EFBFBD><EFBFBD><EFBFBD>c<EFBFBD>WȟJSaІ&<26><1F>ቧ)E<><0B> C<><43>J~u<>c<63><7F>2<EFBFBD><32>v<EFBFBD><76><EFBFBD><03><>s<EFBFBD><73><EFBFBD>vf<76><10><>X7(<28>~<7E><1A>=XCi;<3B>״<EFBFBD>\ߢ<><DFA2><EFBFBD>ܣ<EFBFBD><10><><07>ɳCe<43>D;;X*<2A>3<EFBFBD>i<EFBFBD><69>r<EFBFBD>Em<45><6D><
+-> ssh-ed25519 HY2yRg U2KQWviZIVNemm9e8h7H+eOzoYNxXgLLS3hsZLMAuGk
+6n5dH1McNzk3rscP4v2pqZYDWtUFMd15rZsEd/mqIFM
+-> ssh-ed25519 cK5kHw Ebrj/cpz1cFWAYAV9OxgyyH85OEMUnfUIV66p7jaoFY
+6J7hWqODtS/fIF4BpxhxbrxZq5vbolvbLqRKqazT02M
+-> ssh-ed25519 CAWG4Q mXqoQH9ycHF7u0y8mazCgynHxNLxTnrmQHke+2a5QCc
+mq6PdSF+KOqthuXwzTCsOQsi5KG0z1wHUck+bSTyOBY
+-> ssh-ed25519 xA739A TADeswueqDEroZWLjMw3RDNwVQ2xRD+JUMVZENovn0M
+KFlnSjVFbjc+ZsbY8Ed7edC5B01TJGzd/dSryiLArPc
+-> ssh-ed25519 MSF3dg Pq+ZD8AqJGDHDbd4PO1ngNFST8+6C2ghZkO/knKzzEc
+wyiL/u38hdQMokmfTsBrY7CtYwc+31FG4EDaqVEn31U
+--- 1z4cOipayh0zYkvasEVEvGreajegE/dqBV7b6E7aFh0
+<EFBFBD><EFBFBD><EFBFBD><EFBFBD>R<EFBFBD>@<40>/i<>I'<27><><EFBFBD>Nx<4E>r"<1D>`<1E>O<EFBFBD><4F><EFBFBD>y<><79>8<EFBFBD><38> \/<2F><>I<19><17>D<EFBFBD>`<60>ߓ<EFBFBD><DF93><EFBFBD><1E><04>uy<75><79><EFBFBD>:9Lt<4C><1D><><EFBFBD>؋<EFBFBD><D88B><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>AU<41><55><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>`<60>;<3B>q8<71>GLU#<23>i<EFBFBD>y<EFBFBD><79>i<03>ڜ
--- a/secrets/gitlab-runner-shell-token.age
+++ b/secrets/gitlab-runner-shell-token.age
--- a/secrets/ipmi.yml.age
+++ b/secrets/ipmi.yml.age
--- a/secrets/jungle-robot-password.age
+++ b/secrets/jungle-robot-password.age
--- a/secrets/munge-key.age
+++ b/secrets/munge-key.age
--- a/secrets/nix-serve.age
+++ b/secrets/nix-serve.age
--- a/secrets/tent-gitlab-runner-bsc-docker-token.age
+++ b/secrets/tent-gitlab-runner-bsc-docker-token.age
--- a/secrets/tent-gitlab-runner-pm-docker-token.age
+++ b/secrets/tent-gitlab-runner-pm-docker-token.age
--- a/secrets/tent-gitlab-runner-pm-shell-token.age
+++ b/secrets/tent-gitlab-runner-pm-shell-token.age
--- a/secrets/vpn-dac-client-key.age
+++ b/secrets/vpn-dac-client-key.age
--- a/secrets/vpn-dac-login.age
+++ b/secrets/vpn-dac-login.age
@@ -1,13 +1,14 @@
 age-encryption.org/v1
-> ssh-ed25519 G5LX5w /9lcJOXC9CN02+XLswUaJ0H7jU6Xhjd8Xg4+KY0l1Vc
-fCLzsLc9zrocM8SHOKyZwt6eUEr8r1WLug9RLi63KU0
-> ssh-ed25519 cK5kHw 1qza6h2NRSs4g8LYdFU7E+Dn1CgdtCU7DPdYInP1GwM
-/6uk7pTFkNTRTI7nA+x4y4CyOBVQVXX2lnpOg3ktPe4
-> ssh-ed25519 CAWG4Q o+vyzcejSaNVYPSGzzOdzaqPByZ6zA1uaJf4KOg+wQA
-wfZmWrDSfRV8C+Hu+SeZDcomf/qigBqxuQK77SfnuEo
-> ssh-ed25519 xA739A +rBsOC+IBE3lmc/pfrziftLIqMSyaGMsggRjC5Pqwl0
-xa7ulLz2+YC3g2hu7e9XhRYDIUb2sriaaigJRYF2oB8
-> ssh-ed25519 MSF3dg TK6PmKjjQt8ni0mJLCt7P41lUsgimlj3o5Q6n3N+DE4
-ne+s3ctcg8cBjY06LY2lrW7wcxomvKHxu6MlirEA8Kg
--- eorg2ckkUZ1Ogi4iTTg2MoiVBwl1F0RCmH2D8N1d1So
-<EFBFBD><EFBFBD><EFBFBD>8<1C><><EFBFBD><EFBFBD><EFBFBD><12>i<17>$]K<>J=2Z<1D><>ӼF<D3BC>][<14><><EFBFBD>8<EFBFBD><38>ޤ<12>	<09>=<3D><>LD/<2F>gz
+-> ssh-ed25519 G5LX5w SRJhNenoQXbT1FgX3TMPnVH5P6oe2eHot+M1YsEjsEk
+hfTSLgKi98Eh7JK5o7x2POpTEtQlQCpEa3keUFYCuME
+-> ssh-ed25519 cK5kHw z5TwWJTkvx7HztjXHJW/aCOtOfPrQaLP0gyIT7rXcyU
+b4NCpHfasgvkLLr+6LcWUl60p59aSNnfp3bl2OFYXo0
+-> ssh-ed25519 CAWG4Q 4VpS1/OnFe8nxcQbRTKNhjsh/ZQ5cbhSMXwK/jjQ+3o
+WF9wvOkqVml4UcEzyzeumKuUwCwwr2zvKLMg+PCB8nk
+-> ssh-ed25519 xA739A 67FhuJ070jBVMt/xbKHWhfri6iIm0FyaFvzQabsvFBM
+1G5/913dDv/r/6p1x/c5YiUnZzrX/LvIj33KW+PN0KU
+-> ssh-ed25519 MSF3dg Bj/yB4N2wkyHCHC22tcjjJAA4ebSamN0Z4UVX3ZnryI
+6D/ZgTs+j+MGDAbPU5zyK0i9zN6tQy68IcOnQZ27mYg
+--- 169erk3ICSYLs4FPEuXCn7QlekWhsmSn0Lr+/R14I5Q
+<EFBFBD><EFBFBD><EFBFBD><EFBFBD><05>ҽ3<D2BD>s<EFBFBD>
+w<EFBFBD><EFBFBD>4D<EFBFBD><EFBFBD>b.<2E><><EFBFBD>"|<7C><><EFBFBD>)"<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;<3B>.<2E>ɫ7)<29>LeC<05>=S؟
--- a/secrets/wg-apex.age
+++ b/secrets/wg-apex.age
--- a/secrets/wg-fox.age
+++ b/secrets/wg-fox.age
@@ -1,13 +1,14 @@
 age-encryption.org/v1
-> ssh-ed25519 cDBabA So/Tqwdwd7G0PbE4RwH2qDrNcdqTkhFjF4IJrLKKpkM
-MEA5dzlUeFXm3pa+ndxrcE0ZWdO00Xf98+Q8U9LZ+cQ
-> ssh-ed25519 cK5kHw sCHD/hHBOfMBUQXkLG3MBPNC4ebLOXW37OlF/C8FEjU
-4TFbKoy23Ic2vteXZ02fMrFxyb4NxyWaSo5I8dn48mI
-> ssh-ed25519 CAWG4Q KYGPAXTx8H5cBC3YIBxi5B7OeF15C9rEIPFCcG0vEDw
-9LC2Zvp1Oiau1/hfPf+nJknl6BUSr+lzTn6TozZNxJg
-> ssh-ed25519 xA739A hpvNBHPgYRtUx0HyUAdCW8s7QTmGyPXwzRHb8qYoeG0
-QkUZINY7Fr7HpyY6lbIMcP+hGO3oCmLL6N+yDN4weyk
-> ssh-ed25519 MSF3dg P9TmEfXS+hyxsbVKja58UWAFpad0ZS3LhwrMkLnSNAY
-hiHuh7HhoYwHi2KFbCczXJoF3On9eqjD1Wsp9Q1NW/w
--- SN3peoDvjXuD/Q4DdebQFam1CE22NyGZlMmnKyCTuX8
-s<0F><><14><>&׳֦<D7B3><D6A6><EFBFBD><EFBFBD>}<7D>#In0&<26><1F>{<7B>1<EFBFBD><31>.
+-> ssh-ed25519 cDBabA heyW9/cxgwFX9IexQIXjAQDWGQPNcMXcArQp2Rxsqx4
+o9MQ7EH8PDDjsJdpH9F3Xq2zUoaDAJQlfFmYucSFs6Y
+-> ssh-ed25519 cK5kHw Sza4pos7K3qW3omEeyidI/jszJNf9smemSZnUJfCIww
+D6vazXki7hIYraIuSiGPS+FPbkFUwHhHWDf52OhEIMg
+-> ssh-ed25519 CAWG4Q YexIHueOIMmIN8JIDyNUOKBkyz/k18HqV3hTXh48KlM
+xh8UJzzWT6ByN+Dpn4JrMNsjGC/uc/v6LynwjBDz9NQ
+-> ssh-ed25519 xA739A KySG3TXdqfCMUkVEDGa74B0op745s3XGYxFLyAXSQAc
+5EI/yb5ctW9Qu18bHm3/sK97kwGcKzzmWvPSCWm89XA
+-> ssh-ed25519 MSF3dg MNxnNj0fHmri8ophexXPNjRUBUWrzcuk5S1mucxUMTE
+GVFWXtISEU8ZmlwL4nh4weAgfGrt2GHX0DTzbpS6zg8
+--- UdrqkYG2ZApAuwdZeNhC50NP2rkD/Ol6y8nJa4RHx7Y
+<EFBFBD>ܻ<EFBFBD>m(<28><><EFBFBD>><3E>H<48>Y87<><37>G<0F>+*<12><><EFBFBD><EFBFBD>9V<>.<2E><><EFBFBD><EFBFBD><03><><EFBFBD>p<EFBFBD>Oo<4F>=+哇<>P0<50><30>{<7B>)<29><17><><EFBFBD><EFBFBD>><3E>z3P^
+u
--- a/secrets/wg-raccoon.age
+++ b/secrets/wg-raccoon.age
--- a/test/compilers/clang-openmp-ld.nix
+++ b/test/compilers/clang-openmp-ld.nix
@@ -23,6 +23,9 @@ in stdenv.mkDerivation {
  dontUnpack = true;
  dontConfigure = true;

+  # nOS-V requires access to /sys/devices to request NUMA information
+  requiredSystemFeatures = [ "sys-devices" ];
+
  buildInputs = [ openmp ];

  buildPhase = ''
Author	SHA1	Message	Date
Aleix Boné	dcdbcc5afa	Use fetchurl for amd-uprof	2026-03-09 12:32:05 +01:00
Aleix Boné	8cf6101ffe	Enable parallelBuilding in jemalloc	2026-03-09 12:32:04 +01:00
Aleix Boné	1216a5b93c	Make bsc users trusted in nix-portable	2026-03-09 12:32:04 +01:00
Aleix Boné	9678247cbb	Add sys-devices feature to nix-portable nix.conf	2026-03-09 12:32:04 +01:00
Aleix Boné	3ff503fa6e	Add meta with license to nix-portable	2026-03-09 12:32:04 +01:00
Aleix Boné	143c0d1b39	Bind /usr/bin/env in nix-portable	2026-03-09 12:32:04 +01:00
Aleix Boné	85f49b17ac	Add jungle cache to nix-portable nix.conf	2026-03-09 12:32:04 +01:00
Aleix Boné	8df96f3cf6	Use nix bwrap in nix-portable	2026-03-09 12:32:04 +01:00
Aleix Boné	a4757a0050	Remove nix-portable tmpbin feature It will not work without the host /lib64/ld	2026-03-09 12:32:03 +01:00
Aleix Boné	29a531b906	Add bashInteractive in nix-portable bwrap	2026-03-09 12:32:03 +01:00
Aleix Boné	5f0aeed3c0	Install netcat, ssh and git in nix-portable These are needed by nix in order to properly download and build stuff. busybox's netcat does not work since it doesn't support -X.	2026-03-06 17:31:11 +01:00
Aleix Boné	951cd9bc11	Bind to busybox to /bin/sh in nix-portable	2026-03-06 17:31:11 +01:00
Aleix Boné	75c02153a3	Remove sgid from .nix-portable and set group This should prevent issues when putting it under /gpfs/{projects,scratch} that have sgid and group=nobody.	2026-03-06 17:31:10 +01:00
Aleix Boné	e14225a447	Restrict paths added to bwrap in nix-portable	2026-03-06 17:31:10 +01:00
Aleix Boné	24a35583af	Bind proc using --proc in nix-portable	2026-03-06 17:31:10 +01:00
Aleix Boné	35df90594e	Fix nix-portable pkgStatic symlink handling	2026-03-06 17:31:10 +01:00
Aleix Boné	57077e0276	Add nix-portable repo: https://github.com/DavHau/nix-portable rev: 91122e3d94ba51d7d83fe990fa81d3de0968fb32	2026-03-06 17:31:10 +01:00
Aleix Boné	30bd998114	Re-enable nix-wrap libcap is no longer broken upstream	2026-03-06 17:31:10 +01:00