Nixpkgs core team update 2026-01-22

Announcements Nixpkgs Core Team
1

After our last update and a break over the holidays, we have met with GitHub again and have good news:

  • We now have fully sponsored free GitHub Enterprise Cloud for the NixOS organization! :tada:

    This is something that has been talked about for the past few years, and greatly increases the limits on GitHub Actions and PR reviewers, while unlocking a lot of new functionality for fineā€grained permissions and audit log APIs.

  • GitHub have diagnosed and fixed the primary remaining cause of replication issues. Apparently, our diligent r-ryantm bot was causing replication issues because the API to open PRs did not automatically sync Git objects from a fork to the shared Nixpkgs fork network repository. This was something that affected repositories all over GitHub, and has now been fixed on their backend.

    GitHub confirmed that they consider the scalability issues resolved and we donā€™t have any more scheduled calls with them, although we will keep the point of contact available and they will get in touch if anything comes up. We also have the merge conflict label job running again.

  • Weā€™re looking at creating a formal team around package provenance and SBOMs. This team would be delegated authority and responsibility to work on a design and implementation to improve Nixpkgs security and assist vulnerability tracking without unduly burdening maintainers, impacting performance, or letting tricky dependencies like those hidden inside fixedā€output derivations fall through the cracks. Weā€™ve already reached out to some prospective candidates, but invite anyone else interested in working on this upstream in Nixpkgs to reach out.

  • Following on from our decision about closed teams, we have finished working with existing teams to reorganize maintenance around topics rather than affiliation and updated the maintainer documentation to match.

Thanks again to @infinisil for diligent noteā€taking during the GitHub calls, and as always, feel free to get in touch with us.

62 Likes
2

It looks like the first effect of upgrading to GitHub Enterprise has been a marketing email sent to every org member telling them about pull requests :sweat_smile:

Very sorry about that, and Iā€™ve reached out to GitHub to try and make sure it wonā€™t happen again.

32 Likes
3

Oh this is why Iā€™m suddenly subscribed to all kinds of bullshit marketing mailing lists from GitHub? Lol I thought I clicked something by accident. Can we make sure we bulk unsubscribe everyone somehow? I unsubscribed myself now but would be nice to not spam people with marketing

5 Likes
4

Good work!

I donā€™t like that this deepens our integration and thus reliance on Github, but canā€™t deny that right now this is progress.

3 Likes
5

We donā€™t have much of a choice, unfortunately.

If itā€™s not GitHub, itā€™s going to be someone else weā€™ll have to rely on.

6

Wow this is awesome
Iā€™d like to volunteer to help on the package provenance and SBOMs.
@qyliss How can I do it?