nix: Bump npins and nixpkgs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.envrc

@@ -0,0 +1,3 @@
+# shellcheck shell=bash
+dotenv_if_exists
+use nix

.gitea/workflows/cache.yaml

@@ -0,0 +1,31 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/SchemaStore/schemastore/master/src/schemas/json/github-workflow.json
+name: Cache
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  build-and-push:
+    runs-on: nix
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Write niks3 auth token
+        run: |
+          umask 077
+          printf '%s' "${{ secrets.NIKS3_AUTH_TOKEN }}" > "$RUNNER_TEMP/niks3-auth-token"
+
+      - name: Build all packages
+        run: |
+          nix-build --no-out-link | tee "$RUNNER_TEMP/built-paths"
+
+      - name: Push to niks3 cache
+        env:
+          NIKS3_SERVER_URL: https://cache.ekman.oceanbox.io
+          NIKS3_AUTH_TOKEN_FILE: ${{ runner.temp }}/niks3-auth-token
+        run: |
+          niks3="$(nix --extra-experimental-features 'nix-command flakes' \
+            build --no-link --print-out-paths 'github:Mic92/niks3/v1.6.1#niks3')/bin/niks3"
+          xargs -r "$niks3" push < "$RUNNER_TEMP/built-paths"

.gitignore

@@ -6,3 +6,5 @@ result-*
 # Ignore automatically generated direnv output
 .direnv
 
+.env
+niks3-token

README.md

@@ -1,2 +1,98 @@
-# obx-pkgs
+# Oceanbox Nixpkgs
 
+`obx-pkgs` is the shared Oceanbox Nix overlay. It collects packages that we use
+across projects but that are either not in nixpkgs, are stuck on an outdated
+version, or need internal patches. Each project that consumes the overlay gets
+the same versions, the same fixes, and a single place to update them.
+
+## Usage
+
+### As an overlay on nixpkgs (recommended)
+
+With `npins`:
+
+```nix
+{
+  sources ? import ./npins,
+  pkgs ? import sources.nixpkgs {
+    overlays = [ (import "${sources.obx-pkgs}/overlay.nix") ];
+  },
+}:
+# pkgs.arcosparse, pkgs.openzl, pkgs.sphinx-shibuya-theme, ... are now available
+```
+
+With `flakes`:
+
+```nix
+{
+  inputs.obx-pkgs.url = "git+https://git.oceanbox.io/oceanbox/obx-pkgs";
+
+  outputs = { nixpkgs, obx-pkgs, ... }: {
+    legacyPackages.x86_64-linux = import nixpkgs {
+      system = "x86_64-linux";
+      overlays = [ obx-pkgs.overlays.default ];
+    };
+  };
+}
+```
+
+### As a standalone package set
+
+```nix
+let
+  obx = import sources.obx-pkgs { };
+in
+  [ obx.copernicusmarine obx.sz3 ]
+```
+
+Useful when you want one of our packages without modifying the rest
+of nixpkgs.
+
+## Adding a package
+
+```text
+by-name/
+  <package-name>/
+    default.nix
+```
+
+`default.nix` is a regular `callPackage` function, the same shape you would
+write for nixpkgs:
+
+```nix
+{ stdenv, fetchFromGitHub, ... }:
+stdenv.mkDerivation { ... }
+```
+
+Cross-references between our own packages work via the standard argument syntax
+name the dependency in the argument list (e.g. `arcosparse`) and the overlay's
+`self.callPackage` injects it.
+
+Once the directory exists it is picked up automatically
+
+## Development
+
+```text
+nix-shell
+```
+
+drops you into a shell with `npins`, `nix-init`, `nix-update`, and a
+pre-configured `treefmt`.
+
+Format the tree:
+
+```text
+treefmt
+```
+
+Update a pin:
+
+```text
+npins update nixpkgs
+```
+
+Bump a package version:
+
+```text
+nix-update -f . <package-name>
+```

by-name/fable_4_24/default.nix

@@ -0,0 +1,7 @@
+{ buildDotnetGlobalTool }:
+buildDotnetGlobalTool {
+  pname = "fable";
+  version = "4.24.0";
+  nugetHash = "sha256-ERewWqfEyyZKpHFFALpMGJT0fDWywBYY5buU/wTZZTg=";
+  meta.mainProgram = "fable";
+}

by-name/fable_4_29/default.nix

@@ -0,0 +1,7 @@
+{ buildDotnetGlobalTool }:
+buildDotnetGlobalTool {
+  pname = "fable";
+  version = "4.29.0";
+  nugetHash = "sha256-Eed1bb9heteWOWmv6NnXPzXbf3t218K/eHufwgtRuzI=";
+  meta.mainProgram = "fable";
+}

by-name/fsharp-analyzers_0_35/default.nix

@@ -0,0 +1,7 @@
+{ buildDotnetGlobalTool }:
+buildDotnetGlobalTool {
+  pname = "fsharp-analyzers";
+  version = "0.35.0";
+  nugetHash = "sha256-GxQR3Fq28cb+akNbzRTav9nhMtayN/0g2d1G6Ml+ck4=";
+  meta.mainProgram = "fsharp-analyzers";
+}

by-name/sphinx-last-updated-by-git/default.nix

@@ -46,5 +46,7 @@ python3Packages.buildPythonPackage {
 
     "test_repo_shallow"
     "test_repo_shallow_without_warning"
+
+    "test_exclude_patterns_deps_dates" # broken at this rev: exclude pattern on deps doesn't fall back correctly
   ];
 }

by-name/sz3/default.nix

@@ -24,14 +24,13 @@ stdenv.mkDerivation {
     pkg-config
   ];
 
-  buildInputs =
-    [
-      zstd
-      gsl
-    ]
-    ++ lib.optionals stdenv.cc.isClang [
-      llvmPackages.openmp
-    ];
+  buildInputs = [
+    zstd
+    gsl
+  ]
+  ++ lib.optionals stdenv.cc.isClang [
+    llvmPackages.openmp
+  ];
 
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"

default.nix

@@ -18,7 +18,7 @@ let
 
   mkPackages =
     fun: dir:
-    builtins.map (name: {
+    map (name: {
       inherit name;
       value = fun (dir + "/${name}") { };
     }) (listDirs dir);

npins/default.nix

@@ -65,7 +65,9 @@ let
         if pkgs == null then
           {
             inherit (builtins) fetchTarball fetchurl;
-            # For some fucking reason, fetchGit has a different signature than the other builtin fetchers …
+            # Frustratingly, due to flakes and `fetchTree`, `fetchGit`
+            # has a different signature than the other builtin
+            # fetchers
             fetchGit = args: (builtins.fetchGit args).outPath;
           }
         else
@@ -95,7 +97,6 @@ let
               };
           };
 
-      # Dispatch to the correct code path based on the type
       path =
         if spec.type == "Git" then
           mkGitSource fetchers spec
@@ -105,8 +106,8 @@ let
           mkPyPiSource fetchers spec
         else if spec.type == "Channel" then
           mkChannelSource fetchers spec
-        else if spec.type == "Tarball" then
-          mkTarballSource fetchers spec
+        else if spec.type == "Url" || spec.type == "MutableUrl" then
+          mkUrlSource fetchers spec
         else if spec.type == "Container" then
           mkContainerSource pkgs spec
         else
@@ -192,16 +193,20 @@ let
       sha256 = hash;
     };
 
-  mkTarballSource =
-    { fetchTarball, ... }:
+  mkUrlSource =
     {
-      url,
-      locked_url ? url,
-      hash,
+      fetchTarball,
+      fetchurl,
       ...
     }:
-    fetchTarball {
-      url = locked_url;
+    {
+      url,
+      hash,
+      unpack,
+      ...
+    }:
+    (if unpack then fetchTarball else fetchurl) {
+      inherit url;
       sha256 = hash;
     };
 
@@ -211,16 +216,22 @@ let
       image_name,
       image_tag,
       image_digest,
+      hash,
       ...
-    }:
+    }@args:
     if pkgs == null then
       builtins.throw "container sources require passing in a Nixpkgs value: https://github.com/andir/npins/blob/master/README.md#using-the-nixpkgs-fetchers"
     else
-      pkgs.dockerTools.pullImage {
-        imageName = image_name;
-        imageDigest = image_digest;
-        finalImageTag = image_tag;
-      };
+      pkgs.dockerTools.pullImage (
+        {
+          imageName = image_name;
+          imageDigest = image_digest;
+          finalImageTag = image_tag;
+          hash = hash;
+        }
+        // (if args.arch or null != null then { arch = args.arch; } else { })
+      );
+
 in
 mkFunctor (
   {
@@ -231,7 +242,7 @@ mkFunctor (
       if builtins.isPath input then
         # while `readFile` will throw an error anyways if the path doesn't exist,
         # we still need to check beforehand because *our* error can be caught but not the one from the builtin
-        # *piegames sighs*
+        # See: <https://git.lix.systems/lix-project/lix/issues/1098>
         if builtins.pathExists input then
           builtins.fromJSON (builtins.readFile input)
         else
@@ -242,7 +253,7 @@ mkFunctor (
         throw "Unsupported input type ${builtins.typeOf input}, must be a path or an attrset";
     version = data.version;
   in
-  if version == 7 then
+  if version == 8 then
     builtins.mapAttrs (name: spec: mkFunctor (mkSource name spec)) data.pins
   else
     throw "Unsupported format version ${toString version} in sources.json. Try running `npins upgrade`"

npins/sources.json

@@ -3,9 +3,23 @@
     "nixpkgs": {
       "type": "Channel",
       "name": "nixos-unstable",
-      "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre1004030.64c08a7ca051/nixexprs.tar.xz",
-      "hash": "sha256-NpH8iEQ5JHv/BtUuzTEXUMDxPLetCDzIv4OxL8H7Kps="
+      "artifact": "nixexprs.tar.xz",
+      "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1014179.9ae611a455b9/nixexprs.tar.xz",
+      "hash": "sha256-d34lhgOet4IqYMnCxbIvwFBMOyTV6PT4TyNEOP0/ZhU="
+    },
+    "treefmt-nix": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "numtide",
+        "repo": "treefmt-nix"
+      },
+      "branch": "main",
+      "submodules": false,
+      "revision": "db947814a175b7ca6ded66e21383d938df01c227",
+      "url": "https://github.com/numtide/treefmt-nix/archive/db947814a175b7ca6ded66e21383d938df01c227.tar.gz",
+      "hash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM="
     }
   },
-  "version": 7
+  "version": 8
 }

shell.nix

@@ -2,12 +2,15 @@
   sources ? import ./npins,
   pkgs ? import sources.nixpkgs { },
 }:
-
+let
+  treefmt = pkgs.callPackage ./tools/treefmt.nix { inherit sources; };
+in
 pkgs.mkShellNoCC {
   packages = [
     pkgs.npins
+    pkgs.niks3
     pkgs.nix-init
-    pkgs.nixfmt-rfc-style
     pkgs.nix-update
+    treefmt
   ];
 }

tools/treefmt.nix

@@ -0,0 +1,22 @@
+{ pkgs, sources, ... }:
+let
+  treefmt-nix = import sources.treefmt-nix;
+in
+treefmt-nix.mkWrapper pkgs {
+  projectRootFile = ".git/config";
+  programs = {
+    nixfmt.enable = true;
+    deadnix.enable = true;
+    statix = {
+      enable = true;
+      disabled-lints = [
+        "manual_inherit_from"
+        "repeated_keys"
+      ];
+    };
+    shellcheck.enable = true;
+  };
+  settings.global.excludes = [
+    "npins/default.nix"
+  ];
+}