Format Nix code with `nixfmt`

Change-Id: I61efeb666ff7481c05fcb247168290e86a250151

21 files changed, 1189 insertions, 904 deletions

diff --git a/default.nix b/default.nix
index 2cccff28d..6466507b7 100644
--- a/default.nix
+++ b/default.nix
@@ -1,10 +1,9 @@
-(import
-  (
-    let lock = builtins.fromJSON (builtins.readFile ./flake.lock); in
-    fetchTarball {
-      url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
-      sha256 = lock.nodes.flake-compat.locked.narHash;
-    }
-  )
-  { src = ./.; }
-).defaultNix
+(import (
+  let
+    lock = builtins.fromJSON (builtins.readFile ./flake.lock);
+  in
+  fetchTarball {
+    url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
+    sha256 = lock.nodes.flake-compat.locked.narHash;
+  }
+) { src = ./.; }).defaultNix
diff --git a/doc/manual/generate-builtin-constants.nix b/doc/manual/generate-builtin-constants.nix
index 8af80a02c..23ec2cb55 100644
--- a/doc/manual/generate-builtin-constants.nix
+++ b/doc/manual/generate-builtin-constants.nix
@@ -5,7 +5,13 @@ in
 
 builtinsInfo:
 let
-  showBuiltin = name: { doc, type, impure-only }:
+  showBuiltin =
+    name:
+    {
+      doc,
+      type,
+      impure-only,
+    }:
     let
       type' = optionalString (type != null) " (${type})";
 
diff --git a/doc/manual/generate-builtins.nix b/doc/manual/generate-builtins.nix
index 813a287f5..60cba266b 100644
--- a/doc/manual/generate-builtins.nix
+++ b/doc/manual/generate-builtins.nix
@@ -5,7 +5,14 @@ in
 
 builtinsInfo:
 let
-  showBuiltin = name: { doc, args, arity, experimental-feature }:
+  showBuiltin =
+    name:
+    {
+      doc,
+      args,
+      arity,
+      experimental-feature,
+    }:
     let
       experimentalNotice = optionalString (experimental-feature != null) ''
         This function is only available if the [${experimental-feature}](@docroot@/contributing/experimental-features.md#xp-feature-${experimental-feature}) experimental feature is enabled.
diff --git a/doc/manual/generate-manpage.nix b/doc/manual/generate-manpage.nix
index 972def69a..cabfdd0d8 100644
--- a/doc/manual/generate-manpage.nix
+++ b/doc/manual/generate-manpage.nix
@@ -1,8 +1,26 @@
 let
   inherit (builtins)
-    attrNames attrValues fromJSON listToAttrs mapAttrs
-    concatStringsSep concatMap length lessThan replaceStrings sort;
-  inherit (import ./utils.nix) concatStrings optionalString filterAttrs trim squash unique showSettings;
+    attrNames
+    attrValues
+    fromJSON
+    listToAttrs
+    mapAttrs
+    concatStringsSep
+    concatMap
+    length
+    lessThan
+    replaceStrings
+    sort
+    ;
+  inherit (import ./utils.nix)
+    concatStrings
+    optionalString
+    filterAttrs
+    trim
+    squash
+    unique
+    showSettings
+    ;
 in
 
 inlineHTML: commandDump:
@@ -11,7 +29,13 @@ let
 
   commandInfo = fromJSON commandDump;
 
-  showCommand = { command, details, filename, toplevel }:
+  showCommand =
+    {
+      command,
+      details,
+      filename,
+      toplevel,
+    }:
     let
 
       result = ''
@@ -35,26 +59,27 @@ let
         ${maybeOptions}
       '';
 
-      showSynopsis = command: args:
+      showSynopsis =
+        command: args:
         let
-          showArgument = arg: "*${arg.label}*" + optionalString (! arg ? arity) "...";
+          showArgument = arg: "*${arg.label}*" + optionalString (!arg ? arity) "...";
           arguments = concatStringsSep " " (map showArgument args);
-        in ''
-         `${command}` [*option*...] ${arguments}
+        in
+        ''
+          `${command}` [*option*...] ${arguments}
         '';
 
-      maybeSubcommands = optionalString (details ? commands && details.commands != {})
-         ''
-           where *subcommand* is one of the following:
+      maybeSubcommands = optionalString (details ? commands && details.commands != { }) ''
+        where *subcommand* is one of the following:
 
-           ${subcommands}
-         '';
+        ${subcommands}
+      '';
 
-      subcommands = if length categories > 1
-        then listCategories
-        else listSubcommands details.commands;
+      subcommands = if length categories > 1 then listCategories else listSubcommands details.commands;
 
-      categories = sort (x: y: x.id < y.id) (unique (map (cmd: cmd.category) (attrValues details.commands)));
+      categories = sort (x: y: x.id < y.id) (
+        unique (map (cmd: cmd.category) (attrValues details.commands))
+      );
 
       listCategories = concatStrings (map showCategory categories);
 
@@ -71,11 +96,11 @@ let
       '';
 
       # TODO: move this confusing special case out of here when implementing #8496
-      maybeStoreDocs = optionalString
-        (details ? doc)
-        (replaceStrings ["@stores@"] [storeDocs] details.doc);
+      maybeStoreDocs = optionalString (details ? doc) (
+        replaceStrings [ "@stores@" ] [ storeDocs ] details.doc
+      );
 
-      maybeOptions = optionalString (details.flags != {}) ''
+      maybeOptions = optionalString (details.flags != { }) ''
         # Options
 
         ${showOptions details.flags toplevel.flags}
@@ -85,51 +110,70 @@ let
         > See [`man nix.conf`](@docroot@/command-ref/conf-file.md#command-line-flags) for overriding configuration settings with command line flags.
       '';
 
-      showOptions = options: commonOptions:
+      showOptions =
+        options: commonOptions:
         let
           allOptions = options // commonOptions;
           showCategory = cat: ''
             ${optionalString (cat != "") "**${cat}:**"}
 
             ${listOptions (filterAttrs (n: v: v.category == cat) allOptions)}
-            '';
+          '';
           listOptions = opts: concatStringsSep "\n" (attrValues (mapAttrs showOption opts));
-          showOption = name: option:
+          showOption =
+            name: option:
             let
               result = trim ''
                 - ${item}
                   ${option.description}
               '';
-              item = if inlineHTML
-                then ''<span id="opt-${name}">[`--${name}`](#opt-${name})</span> ${shortName} ${labels}''
-                else "`--${name}` ${shortName} ${labels}";
-              shortName = optionalString
-                (option ? shortName)
-                ("/ `-${option.shortName}`");
-              labels = optionalString
-                (option ? labels)
-                (concatStringsSep " " (map (s: "*${s}*") option.labels));
-            in result;
+              item =
+                if inlineHTML then
+                  ''<span id="opt-${name}">[`--${name}`](#opt-${name})</span> ${shortName} ${labels}''
+                else
+                  "`--${name}` ${shortName} ${labels}";
+              shortName = optionalString (option ? shortName) ("/ `-${option.shortName}`");
+              labels = optionalString (option ? labels) (concatStringsSep " " (map (s: "*${s}*") option.labels));
+            in
+            result;
           categories = sort lessThan (unique (map (cmd: cmd.category) (attrValues allOptions)));
-        in concatStrings (map showCategory categories);
-    in squash result;
+        in
+        concatStrings (map showCategory categories);
+    in
+    squash result;
 
   appendName = filename: name: (if filename == "nix" then "nix3" else filename) + "-" + name;
 
-  processCommand = { command, details, filename, toplevel }:
+  processCommand =
+    {
+      command,
+      details,
+      filename,
+      toplevel,
+    }:
     let
       cmd = {
         inherit command;
         name = filename + ".md";
-        value = showCommand { inherit command details filename toplevel; };
-      };
-      subcommand = subCmd: processCommand {
-        command = command + " " + subCmd;
-        details = details.commands.${subCmd};
-        filename = appendName filename subCmd;
-        inherit toplevel;
+        value = showCommand {
+          inherit
+            command
+            details
+            filename
+            toplevel
+            ;
+        };
       };
-    in [ cmd ] ++ concatMap subcommand (attrNames details.commands or {});
+      subcommand =
+        subCmd:
+        processCommand {
+          command = command + " " + subCmd;
+          details = details.commands.${subCmd};
+          filename = appendName filename subCmd;
+          inherit toplevel;
+        };
+    in
+    [ cmd ] ++ concatMap subcommand (attrNames details.commands or { });
 
   manpages = processCommand {
     command = "nix";
@@ -138,14 +182,21 @@ let
     toplevel = commandInfo.args;
   };
 
-  tableOfContents = let
-    showEntry = page:
-      "    - [${page.command}](command-ref/new-cli/${page.name})";
-    in concatStringsSep "\n" (map showEntry manpages) + "\n";
+  tableOfContents =
+    let
+      showEntry = page: "    - [${page.command}](command-ref/new-cli/${page.name})";
+    in
+    concatStringsSep "\n" (map showEntry manpages) + "\n";
 
   storeDocs =
     let
-      showStore = name: { settings, doc, experimentalFeature }:
+      showStore =
+        name:
+        {
+          settings,
+          doc,
+          experimentalFeature,
+        }:
         let
           experimentalFeatureNote = optionalString (experimentalFeature != null) ''
             > **Warning**
@@ -161,7 +212,8 @@ let
             extra-experimental-features = ${experimentalFeature}
             ```
           '';
-        in ''
+        in
+        ''
           ## ${name}
 
           ${doc}
@@ -172,6 +224,7 @@ let
 
           ${showSettings { inherit inlineHTML; } settings}
         '';
-    in concatStrings (attrValues (mapAttrs showStore commandInfo.stores));
-
-in (listToAttrs manpages) // { "SUMMARY.md" = tableOfContents; }
+    in
+    concatStrings (attrValues (mapAttrs showStore commandInfo.stores));
+in
+(listToAttrs manpages) // { "SUMMARY.md" = tableOfContents; }
diff --git a/doc/manual/generate-xp-features-shortlist.nix b/doc/manual/generate-xp-features-shortlist.nix
index 30e211c96..ea8bf8d49 100644
--- a/doc/manual/generate-xp-features-shortlist.nix
+++ b/doc/manual/generate-xp-features-shortlist.nix
@@ -2,8 +2,8 @@ with builtins;
 with import ./utils.nix;
 
 let
-  showExperimentalFeature = name: doc:
-    ''
-      - [`${name}`](@docroot@/contributing/experimental-features.md#xp-feature-${name})
-    '';
-in xps: indent "  " (concatStrings (attrValues (mapAttrs showExperimentalFeature xps)))
+  showExperimentalFeature = name: doc: ''
+    - [`${name}`](@docroot@/contributing/experimental-features.md#xp-feature-${name})
+  '';
+in
+xps: indent "  " (concatStrings (attrValues (mapAttrs showExperimentalFeature xps)))
diff --git a/doc/manual/generate-xp-features.nix b/doc/manual/generate-xp-features.nix
index adb94355c..c56ddeea1 100644
--- a/doc/manual/generate-xp-features.nix
+++ b/doc/manual/generate-xp-features.nix
@@ -2,10 +2,12 @@ with builtins;
 with import ./utils.nix;
 
 let
-  showExperimentalFeature = name: doc:
+  showExperimentalFeature =
+    name: doc:
     squash ''
       ## [`${name}`]{#xp-feature-${name}}
 
       ${doc}
     '';
-in xps: (concatStringsSep "\n" (attrValues (mapAttrs showExperimentalFeature xps)))
+in
+xps: (concatStringsSep "\n" (attrValues (mapAttrs showExperimentalFeature xps)))
diff --git a/doc/manual/utils.nix b/doc/manual/utils.nix
index 193c1efc0..17e6378eb 100644
--- a/doc/manual/utils.nix
+++ b/doc/manual/utils.nix
@@ -5,10 +5,15 @@ rec {
 
   concatStrings = concatStringsSep "";
 
-  attrsToList = a:
-    map (name: { inherit name; value = a.${name}; }) (builtins.attrNames a);
-
-  replaceStringsRec = from: to: string:
+  attrsToList =
+    a:
+    map (name: {
+      inherit name;
+      value = a.${name};
+    }) (builtins.attrNames a);
+
+  replaceStringsRec =
+    from: to: string:
     # recursively replace occurrences of `from` with `to` within `string`
     # example:
     #     replaceStringRec "--" "-" "hello-----world"
@@ -16,14 +21,16 @@ rec {
     let
       replaced = replaceStrings [ from ] [ to ] string;
     in
-      if replaced == string then string else replaceStringsRec from to replaced;
+    if replaced == string then string else replaceStringsRec from to replaced;
 
   squash = replaceStringsRec "\n\n\n" "\n\n";
 
-  trim = string:
+  trim =
+    string:
     # trim trailing spaces and squash non-leading spaces
     let
-      trimLine = line:
+      trimLine =
+        line:
         let
           # separate leading spaces from the rest
           parts = split "(^ *)" line;
@@ -31,76 +38,102 @@ rec {
           rest = elemAt parts 2;
           # drop trailing spaces
           body = head (split " *$" rest);
-        in spaces + replaceStringsRec "  " " " body;
-    in concatStringsSep "\n" (map trimLine (splitLines string));
+        in
+        spaces + replaceStringsRec "  " " " body;
+    in
+    concatStringsSep "\n" (map trimLine (splitLines string));
 
   # FIXME: O(n^2)
-  unique = foldl' (acc: e: if elem e acc then acc else acc ++ [ e ]) [];
+  unique = foldl' (acc: e: if elem e acc then acc else acc ++ [ e ]) [ ];
 
   nameValuePair = name: value: { inherit name value; };
 
-  filterAttrs = pred: set:
-    listToAttrs (concatMap (name: let v = set.${name}; in if pred name v then [(nameValuePair name v)] else []) (attrNames set));
+  filterAttrs =
+    pred: set:
+    listToAttrs (
+      concatMap (
+        name:
+        let
+          v = set.${name};
+        in
+        if pred name v then [ (nameValuePair name v) ] else [ ]
+      ) (attrNames set)
+    );
 
   optionalString = cond: string: if cond then string else "";
 
-  showSetting = { inlineHTML }: name: { description, documentDefault, defaultValue, aliases, value, experimentalFeature }:
+  showSetting =
+    { inlineHTML }:
+    name:
+    {
+      description,
+      documentDefault,
+      defaultValue,
+      aliases,
+      value,
+      experimentalFeature,
+    }:
     let
       result = squash ''
-          - ${if inlineHTML
-              then ''<span id="conf-${name}">[`${name}`](#conf-${name})</span>''
-              else ''`${name}`''}
+        - ${
+          if inlineHTML then ''<span id="conf-${name}">[`${name}`](#conf-${name})</span>'' else ''`${name}`''
+        }
 
-          ${indent "  " body}
-        '';
+        ${indent "  " body}
+      '';
 
       experimentalFeatureNote = optionalString (experimentalFeature != null) ''
-          > **Warning**
-          > This setting is part of an
-          > [experimental feature](@docroot@/contributing/experimental-features.md).
+        > **Warning**
+        > This setting is part of an
+        > [experimental feature](@docroot@/contributing/experimental-features.md).
 
-          To change this setting, you need to make sure the corresponding experimental feature,
-          [`${experimentalFeature}`](@docroot@/contributing/experimental-features.md#xp-feature-${experimentalFeature}),
-          is enabled.
-          For example, include the following in [`nix.conf`](#):
+        To change this setting, you need to make sure the corresponding experimental feature,
+        [`${experimentalFeature}`](@docroot@/contributing/experimental-features.md#xp-feature-${experimentalFeature}),
+        is enabled.
+        For example, include the following in [`nix.conf`](#):
 
-          ```
-          extra-experimental-features = ${experimentalFeature}
-          ${name} = ...
-          ```
-        '';
+        ```
+        extra-experimental-features = ${experimentalFeature}
+        ${name} = ...
+        ```
+      '';
 
       # separate body to cleanly handle indentation
       body = ''
-          ${description}
+        ${description}
 
-          ${experimentalFeatureNote}
+        ${experimentalFeatureNote}
 
-          **Default:** ${showDefault documentDefault defaultValue}
+        **Default:** ${showDefault documentDefault defaultValue}
 
-          ${showAliases aliases}
-        '';
+        ${showAliases aliases}
+      '';
 
-      showDefault = documentDefault: defaultValue:
+      showDefault =
+        documentDefault: defaultValue:
         if documentDefault then
           # a StringMap value type is specified as a string, but
           # this shows the value type. The empty stringmap is `null` in
           # JSON, but that converts to `{ }` here.
-          if defaultValue == "" || defaultValue == [] || isAttrs defaultValue
-            then "*empty*"
-            else if isBool defaultValue then
-              if defaultValue then "`true`" else "`false`"
-            else "`${toString defaultValue}`"
-        else "*machine-specific*";
-
-      showAliases = aliases:
-          optionalString (aliases != [])
-            "**Deprecated alias:** ${(concatStringsSep ", " (map (s: "`${s}`") aliases))}";
-
-    in result;
+          if defaultValue == "" || defaultValue == [ ] || isAttrs defaultValue then
+            "*empty*"
+          else if isBool defaultValue then
+            if defaultValue then "`true`" else "`false`"
+          else
+            "`${toString defaultValue}`"
+        else
+          "*machine-specific*";
+
+      showAliases =
+        aliases:
+        optionalString (aliases != [ ])
+          "**Deprecated alias:** ${(concatStringsSep ", " (map (s: "`${s}`") aliases))}";
+    in
+    result;
 
-  indent = prefix: s:
-    concatStringsSep "\n" (map (x: if x == "" then x else "${prefix}${x}") (splitLines s));
+  indent =
+    prefix: s: concatStringsSep "\n" (map (x: if x == "" then x else "${prefix}${x}") (splitLines s));
 
-  showSettings = args: settingsInfo: concatStrings (attrValues (mapAttrs (showSetting args) settingsInfo));
+  showSettings =
+    args: settingsInfo: concatStrings (attrValues (mapAttrs (showSetting args) settingsInfo));
 }
diff --git a/docker.nix b/docker.nix
index bd16b71cd..2d57cd548 100644
--- a/docker.nix
+++ b/docker.nix
@@ -1,70 +1,71 @@
-{ pkgs ? import <nixpkgs> { }
-, lib ? pkgs.lib
-, name ? "nix"
-, tag ? "latest"
-, bundleNixpkgs ? true
-, channelName ? "nixpkgs"
-, channelURL ? "https://nixos.org/channels/nixpkgs-unstable"
-, extraPkgs ? []
-, maxLayers ? 100
-, nixConf ? {}
-, flake-registry ? null
+{
+  pkgs ? import <nixpkgs> { },
+  lib ? pkgs.lib,
+  name ? "nix",
+  tag ? "latest",
+  bundleNixpkgs ? true,
+  channelName ? "nixpkgs",
+  channelURL ? "https://nixos.org/channels/nixpkgs-unstable",
+  extraPkgs ? [ ],
+  maxLayers ? 100,
+  nixConf ? { },
+  flake-registry ? null,
 }:
 let
-  defaultPkgs = with pkgs; [
-    nix
-    bashInteractive
-    coreutils-full
-    gnutar
-    gzip
-    gnugrep
-    which
-    curl
-    less
-    wget
-    man
-    cacert.out
-    findutils
-    iana-etc
-    git
-    openssh
-  ] ++ extraPkgs;
-
-  users = {
-
-    root = {
-      uid = 0;
-      shell = "${pkgs.bashInteractive}/bin/bash";
-      home = "/root";
-      gid = 0;
-      groups = [ "root" ];
-      description = "System administrator";
-    };
-
-    nobody = {
-      uid = 65534;
-      shell = "${pkgs.shadow}/bin/nologin";
-      home = "/var/empty";
-      gid = 65534;
-      groups = [ "nobody" ];
-      description = "Unprivileged account (don't use!)";
-    };
+  defaultPkgs =
+    with pkgs;
+    [
+      nix
+      bashInteractive
+      coreutils-full
+      gnutar
+      gzip
+      gnugrep
+      which
+      curl
+      less
+      wget
+      man
+      cacert.out
+      findutils
+      iana-etc
+      git
+      openssh
+    ]
+    ++ extraPkgs;
+
+  users =
+    {
+
+      root = {
+        uid = 0;
+        shell = "${pkgs.bashInteractive}/bin/bash";
+        home = "/root";
+        gid = 0;
+        groups = [ "root" ];
+        description = "System administrator";
+      };
 
-  } // lib.listToAttrs (
-    map
-      (
-        n: {
-          name = "nixbld${toString n}";
-          value = {
-            uid = 30000 + n;
-            gid = 30000;
-            groups = [ "nixbld" ];
-            description = "Nix build user ${toString n}";
-          };
-        }
-      )
-      (lib.lists.range 1 32)
-  );
+      nobody = {
+        uid = 65534;
+        shell = "${pkgs.shadow}/bin/nologin";
+        home = "/var/empty";
+        gid = 65534;
+        groups = [ "nobody" ];
+        description = "Unprivileged account (don't use!)";
+      };
+    }
+    // lib.listToAttrs (
+      map (n: {
+        name = "nixbld${toString n}";
+        value = {
+          uid = 30000 + n;
+          gid = 30000;
+          groups = [ "nixbld" ];
+          description = "Nix build user ${toString n}";
+        };
+      }) (lib.lists.range 1 32)
+    );
 
   groups = {
     root.gid = 0;
@@ -74,24 +75,20 @@ let
 
   userToPasswd = (
     k:
-    { uid
-    , gid ? 65534
-    , home ? "/var/empty"
-    , description ? ""
-    , shell ? "/bin/false"
-    , groups ? [ ]
-    }: "${k}:x:${toString uid}:${toString gid}:${description}:${home}:${shell}"
-  );
-  passwdContents = (
-    lib.concatStringsSep "\n"
-      (lib.attrValues (lib.mapAttrs userToPasswd users))
+    {
+      uid,
+      gid ? 65534,
+      home ? "/var/empty",
+      description ? "",
+      shell ? "/bin/false",
+      groups ? [ ],
+    }:
+    "${k}:x:${toString uid}:${toString gid}:${description}:${home}:${shell}"
   );
+  passwdContents = (lib.concatStringsSep "\n" (lib.attrValues (lib.mapAttrs userToPasswd users)));
 
   userToShadow = k: { ... }: "${k}:!:1::::::";
-  shadowContents = (
-    lib.concatStringsSep "\n"
-      (lib.attrValues (lib.mapAttrs userToShadow users))
-  );
+  shadowContents = (lib.concatStringsSep "\n" (lib.attrValues (lib.mapAttrs userToShadow users)));
 
   # Map groups to members
   # {
@@ -101,42 +98,28 @@ let
     let
       # Create a flat list of user/group mappings
       mappings = (
-        builtins.foldl'
-          (
-            acc: user:
-              let
-                groups = users.${user}.groups or [ ];
-              in
-              acc ++ map
-                (group: {
-                  inherit user group;
-                })
-                groups
-          )
-          [ ]
-          (lib.attrNames users)
+        builtins.foldl' (
+          acc: user:
+          let
+            groups = users.${user}.groups or [ ];
+          in
+          acc ++ map (group: { inherit user group; }) groups
+        ) [ ] (lib.attrNames users)
       );
     in
-    (
-      builtins.foldl'
-        (
-          acc: v: acc // {
-            ${v.group} = acc.${v.group} or [ ] ++ [ v.user ];
-          }
-        )
-        { }
-        mappings)
+    (builtins.foldl' (
+      acc: v: acc // { ${v.group} = acc.${v.group} or [ ] ++ [ v.user ]; }
+    ) { } mappings)
   );
 
-  groupToGroup = k: { gid }:
+  groupToGroup =
+    k:
+    { gid }:
     let
       members = groupMemberMap.${k} or [ ];
     in
     "${k}:x:${toString gid}:${lib.concatStringsSep "," members}";
-  groupContents = (
-    lib.concatStringsSep "\n"
-      (lib.attrValues (lib.mapAttrs groupToGroup groups))
-  );
+  groupContents = (lib.concatStringsSep "\n" (lib.attrValues (lib.mapAttrs groupToGroup groups)));
 
   defaultNixConf = {
     sandbox = "false";
@@ -144,11 +127,17 @@ let
     trusted-public-keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
   };
 
-  nixConfContents = (lib.concatStringsSep "\n" (lib.mapAttrsFlatten (n: v:
-    let
-      vStr = if builtins.isList v then lib.concatStringsSep " " v else v;
-    in
-      "${n} = ${vStr}") (defaultNixConf // nixConf))) + "\n";
+  nixConfContents =
+    (lib.concatStringsSep "\n" (
+      lib.mapAttrsFlatten (
+        n: v:
+        let
+          vStr = if builtins.isList v then lib.concatStringsSep " " v else v;
+        in
+        "${n} = ${vStr}"
+      ) (defaultNixConf // nixConf)
+    ))
+    + "\n";
 
   baseSystem =
     let
@@ -167,21 +156,31 @@ let
       manifest = pkgs.buildPackages.runCommand "manifest.nix" { } ''
         cat > $out <<EOF
         [
-        ${lib.concatStringsSep "\n" (builtins.map (drv: let
-          outputs = drv.outputsToInstall or [ "out" ];
-        in ''
-          {
-            ${lib.concatStringsSep "\n" (builtins.map (output: ''
-              ${output} = { outPath = "${lib.getOutput output drv}"; };
-            '') outputs)}
-            outputs = [ ${lib.concatStringsSep " " (builtins.map (x: "\"${x}\"") outputs)} ];
-            name = "${drv.name}";
-            outPath = "${drv}";
-            system = "${drv.system}";
-            type = "derivation";
-            meta = { };
-          }
-        '') defaultPkgs)}
+        ${lib.concatStringsSep "\n" (
+          builtins.map (
+            drv:
+            let
+              outputs = drv.outputsToInstall or [ "out" ];
+            in
+            ''
+              {
+                ${
+                  lib.concatStringsSep "\n" (
+                    builtins.map (output: ''
+                      ${output} = { outPath = "${lib.getOutput output drv}"; };
+                    '') outputs
+                  )
+                }
+                outputs = [ ${lib.concatStringsSep " " (builtins.map (x: "\"${x}\"") outputs)} ];
+                name = "${drv.name}";
+                outPath = "${drv}";
+                system = "${drv.system}";
+                type = "derivation";
+                meta = { };
+              }
+            ''
+          ) defaultPkgs
+        )}
         ]
         EOF
       '';
@@ -190,16 +189,22 @@ let
         cp -a ${rootEnv}/* $out/
         ln -s ${manifest} $out/manifest.nix
       '';
-      flake-registry-path = if (flake-registry == null) then
-        null
-      else if (builtins.readFileType (toString flake-registry)) == "directory" then
-        "${flake-registry}/flake-registry.json"
-      else
-        flake-registry;
+      flake-registry-path =
+        if (flake-registry == null) then
+          null
+        else if (builtins.readFileType (toString flake-registry)) == "directory" then
+          "${flake-registry}/flake-registry.json"
+        else
+          flake-registry;
     in
     pkgs.runCommand "base-system"
       {
-        inherit passwdContents groupContents shadowContents nixConfContents;
+        inherit
+          passwdContents
+          groupContents
+          shadowContents
+          nixConfContents
+          ;
         passAsFile = [
           "passwdContents"
           "groupContents"
@@ -208,63 +213,66 @@ let
         ];
         allowSubstitutes = false;
         preferLocalBuild = true;
-      } (''
-      env
-      set -x
-      mkdir -p $out/etc
-
-      mkdir -p $out/etc/ssl/certs
-      ln -s /nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs
+      }
+      (
+        ''
+          env
+          set -x
+          mkdir -p $out/etc
 
-      cat $passwdContentsPath > $out/etc/passwd
-      echo "" >> $out/etc/passwd
+          mkdir -p $out/etc/ssl/certs
+          ln -s /nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs
 
-      cat $groupContentsPath > $out/etc/group
-      echo "" >> $out/etc/group
+          cat $passwdContentsPath > $out/etc/passwd
+          echo "" >> $out/etc/passwd
 
-      cat $shadowContentsPath > $out/etc/shadow
-      echo "" >> $out/etc/shadow
+          cat $groupContentsPath > $out/etc/group
+          echo "" >> $out/etc/group
 
-      mkdir -p $out/usr
-      ln -s /nix/var/nix/profiles/share $out/usr/
+          cat $shadowContentsPath > $out/etc/shadow
+          echo "" >> $out/etc/shadow
 
-      mkdir -p $out/nix/var/nix/gcroots
+          mkdir -p $out/usr
+          ln -s /nix/var/nix/profiles/share $out/usr/
 
-      mkdir $out/tmp
+          mkdir -p $out/nix/var/nix/gcroots
 
-      mkdir -p $out/var/tmp
+          mkdir $out/tmp
 
-      mkdir -p $out/etc/nix
-      cat $nixConfContentsPath > $out/etc/nix/nix.conf
+          mkdir -p $out/var/tmp
 
-      mkdir -p $out/root
-      mkdir -p $out/nix/var/nix/profiles/per-user/root
+          mkdir -p $out/etc/nix
+          cat $nixConfContentsPath > $out/etc/nix/nix.conf
 
-      ln -s ${profile} $out/nix/var/nix/profiles/default-1-link
-      ln -s $out/nix/var/nix/profiles/default-1-link $out/nix/var/nix/profiles/default
-      ln -s /nix/var/nix/profiles/default $out/root/.nix-profile
+          mkdir -p $out/root
+          mkdir -p $out/nix/var/nix/profiles/per-user/root
 
-      ln -s ${channel} $out/nix/var/nix/profiles/per-user/root/channels-1-link
-      ln -s $out/nix/var/nix/profiles/per-user/root/channels-1-link $out/nix/var/nix/profiles/per-user/root/channels
+          ln -s ${profile} $out/nix/var/nix/profiles/default-1-link
+          ln -s $out/nix/var/nix/profiles/default-1-link $out/nix/var/nix/profiles/default
+          ln -s /nix/var/nix/profiles/default $out/root/.nix-profile
 
-      mkdir -p $out/root/.nix-defexpr
-      ln -s $out/nix/var/nix/profiles/per-user/root/channels $out/root/.nix-defexpr/channels
-      echo "${channelURL} ${channelName}" > $out/root/.nix-channels
+          ln -s ${channel} $out/nix/var/nix/profiles/per-user/root/channels-1-link
+          ln -s $out/nix/var/nix/profiles/per-user/root/channels-1-link $out/nix/var/nix/profiles/per-user/root/channels
 
-      mkdir -p $out/bin $out/usr/bin
-      ln -s ${pkgs.coreutils}/bin/env $out/usr/bin/env
-      ln -s ${pkgs.bashInteractive}/bin/bash $out/bin/sh
+          mkdir -p $out/root/.nix-defexpr
+          ln -s $out/nix/var/nix/profiles/per-user/root/channels $out/root/.nix-defexpr/channels
+          echo "${channelURL} ${channelName}" > $out/root/.nix-channels
 
-    '' + (lib.optionalString (flake-registry-path != null) ''
-      nixCacheDir="/root/.cache/nix"
-      mkdir -p $out$nixCacheDir
-      globalFlakeRegistryPath="$nixCacheDir/flake-registry.json"
-      ln -s ${flake-registry-path} $out$globalFlakeRegistryPath
-      mkdir -p $out/nix/var/nix/gcroots/auto
-      rootName=$(${pkgs.nix}/bin/nix --extra-experimental-features nix-command hash file --type sha1 --base32 <(echo -n $globalFlakeRegistryPath))
-      ln -s $globalFlakeRegistryPath $out/nix/var/nix/gcroots/auto/$rootName
-    ''));
+          mkdir -p $out/bin $out/usr/bin
+          ln -s ${pkgs.coreutils}/bin/env $out/usr/bin/env
+          ln -s ${pkgs.bashInteractive}/bin/bash $out/bin/sh
 
+        ''
+        + (lib.optionalString (flake-registry-path != null) ''
+          nixCacheDir="/root/.cache/nix"
+          mkdir -p $out$nixCacheDir
+          globalFlakeRegistryPath="$nixCacheDir/flake-registry.json"
+          ln -s ${flake-registry-path} $out$globalFlakeRegistryPath
+          mkdir -p $out/nix/var/nix/gcroots/auto
+          rootName=$(${pkgs.nix}/bin/nix --extra-experimental-features nix-command hash file --type sha1 --base32 <(echo -n $globalFlakeRegistryPath))
+          ln -s $globalFlakeRegistryPath $out/nix/var/nix/gcroots/auto/$rootName
+        '')
+      );
 in
 pkgs.dockerTools.buildLayeredImageWithNixDb {
 
@@ -285,20 +293,23 @@ pkgs.dockerTools.buildLayeredImageWithNixDb {
     Cmd = [ "/root/.nix-profile/bin/bash" ];
     Env = [
       "USER=root"
-      "PATH=${lib.concatStringsSep ":" [
-        "/root/.nix-profile/bin"
-        "/nix/var/nix/profiles/default/bin"
-        "/nix/var/nix/profiles/default/sbin"
-      ]}"
-      "MANPATH=${lib.concatStringsSep ":" [
-        "/root/.nix-profile/share/man"
-        "/nix/var/nix/profiles/default/share/man"
-      ]}"
+      "PATH=${
+        lib.concatStringsSep ":" [
+          "/root/.nix-profile/bin"
+          "/nix/var/nix/profiles/default/bin"
+          "/nix/var/nix/profiles/default/sbin"
+        ]
+      }"
+      "MANPATH=${
+        lib.concatStringsSep ":" [
+          "/root/.nix-profile/share/man"
+          "/nix/var/nix/profiles/default/share/man"
+        ]
+      }"
       "SSL_CERT_FILE=/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
       "GIT_SSL_CAINFO=/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
       "NIX_SSL_CERT_FILE=/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
       "NIX_PATH=/nix/var/nix/profiles/per-user/root/channels:/root/.nix-defexpr/channels"
     ];
   };
-
 }
diff --git a/flake.nix b/flake.nix
index 77e34fa7f..0e52695f3 100644
--- a/flake.nix
+++ b/flake.nix
@@ -12,10 +12,20 @@
         nixpkgs-stable.follows = "nixpkgs";
       };
     };
-    flake-compat = { url = "github:edolstra/flake-compat"; flake = false; };
+    flake-compat = {
+      url = "github:edolstra/flake-compat";
+      flake = false;
+    };
   };
 
-  outputs = { self, nixpkgs, nixpkgs-regression, pre-commit-hooks, flake-compat }:
+  outputs =
+    {
+      self,
+      nixpkgs,
+      nixpkgs-regression,
+      pre-commit-hooks,
+      flake-compat,
+    }:
 
     let
       inherit (nixpkgs) lib;
@@ -27,73 +37,98 @@
 
       version = lib.fileContents ./.version + versionSuffix;
       versionSuffix =
-        if officialRelease
-        then ""
-        else "pre${builtins.substring 0 8 (self.lastModifiedDate or self.lastModified or "19700101")}_${self.shortRev or "dirty"}";
+        if officialRelease then
+          ""
+        else
+          "pre${
+            builtins.substring 0 8 (self.lastModifiedDate or self.lastModified or "19700101")
+          }_${self.shortRev or "dirty"}";
 
       linux32BitSystems = [ "i686-linux" ];
-      linux64BitSystems = [ "x86_64-linux" "aarch64-linux" ];
+      linux64BitSystems = [
+        "x86_64-linux"
+        "aarch64-linux"
+      ];
       linuxSystems = linux32BitSystems ++ linux64BitSystems;
-      darwinSystems = [ "x86_64-darwin" "aarch64-darwin" ];
+      darwinSystems = [
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
       systems = linuxSystems ++ darwinSystems;
 
       crossSystems = [
-        "armv6l-linux" "armv7l-linux"
-        "x86_64-freebsd13" "x86_64-netbsd"
+        "armv6l-linux"
+        "armv7l-linux"
+        "x86_64-freebsd13"
+        "x86_64-netbsd"
       ];
 
-      stdenvs = [ "gccStdenv" "clangStdenv" "stdenv" "libcxxStdenv" "ccacheStdenv" ];
+      stdenvs = [
+        "gccStdenv"
+        "clangStdenv"
+        "stdenv"
+        "libcxxStdenv"
+        "ccacheStdenv"
+      ];
 
       forAllSystems = lib.genAttrs systems;
 
       forAllCrossSystems = lib.genAttrs crossSystems;
 
-      forAllStdenvs = f:
-        lib.listToAttrs
-          (map
-            (stdenvName: {
-              name = "${stdenvName}Packages";
-              value = f stdenvName;
-            })
-            stdenvs);
+      forAllStdenvs =
+        f:
+        lib.listToAttrs (
+          map (stdenvName: {
+            name = "${stdenvName}Packages";
+            value = f stdenvName;
+          }) stdenvs
+        );
 
       # Memoize nixpkgs for different platforms for efficiency.
-      nixpkgsFor = forAllSystems
-        (system: let
-          make-pkgs = crossSystem: stdenv: import nixpkgs {
-            localSystem = {
-              inherit system;
-            };
-            crossSystem = if crossSystem == null then null else {
-              system = crossSystem;
-            } // lib.optionalAttrs (crossSystem == "x86_64-freebsd13") {
-              useLLVM = true;
+      nixpkgsFor = forAllSystems (
+        system:
+        let
+          make-pkgs =
+            crossSystem: stdenv:
+            import nixpkgs {
+              localSystem = {
+                inherit system;
+              };
+              crossSystem =
+                if crossSystem == null then
+                  null
+                else
+                  {
+                    system = crossSystem;
+                  }
+                  // lib.optionalAttrs (crossSystem == "x86_64-freebsd13") { useLLVM = true; };
+              overlays = [
+                (overlayFor (p: p.${stdenv}))
+                (final: prev: { nixfmt = final.callPackage ./nix-support/nixfmt.nix { }; })
+              ];
+
+              config.permittedInsecurePackages = [ "nix-2.13.6" ];
             };
-            overlays = [
-              (overlayFor (p: p.${stdenv}))
-              (final: prev: {
-                nixfmt = final.callPackage ./nix-support/nixfmt.nix {};
-              })
-            ];
-
-            config.permittedInsecurePackages = [ "nix-2.13.6" ];
-          };
           stdenvs = forAllStdenvs (make-pkgs null);
           native = stdenvs.stdenvPackages;
-        in {
+        in
+        {
           inherit stdenvs native;
           static = native.pkgsStatic;
           cross = forAllCrossSystems (crossSystem: make-pkgs crossSystem "stdenv");
-        });
+        }
+      );
 
-      binaryTarball = nix: pkgs:
+      binaryTarball =
+        nix: pkgs:
         let
           inherit (pkgs) buildPackages;
           installerClosureInfo = buildPackages.closureInfo { rootPaths = [ nix ]; };
         in
 
         buildPackages.runCommand "nix-binary-tarball-${version}"
-          { #nativeBuildInputs = lib.optional (system != "aarch64-linux") shellcheck;
+          {
+            #nativeBuildInputs = lib.optional (system != "aarch64-linux") shellcheck;
             meta.description = "Distribution-independent Nix bootstrap binaries for ${pkgs.system}";
           }
           ''
@@ -114,17 +149,18 @@
               $(cat ${installerClosureInfo}/store-paths)
           '';
 
-      overlayFor = getStdenv: final: prev:
+      overlayFor =
+        getStdenv: final: prev:
         let
           currentStdenv = getStdenv final;
-        in {
+        in
+        {
           nixStable = prev.nix;
 
           # Forward from the previous stage as we don’t want it to pick the lowdown override
           nixUnstable = prev.nixUnstable;
 
-          build-release-notes =
-            final.buildPackages.callPackage ./maintainers/build-release-notes.nix { };
+          build-release-notes = final.buildPackages.callPackage ./maintainers/build-release-notes.nix { };
           clangbuildanalyzer = final.buildPackages.callPackage ./misc/clangbuildanalyzer.nix { };
 
           default-busybox-sandbox-shell = final.busybox.override {
@@ -161,8 +197,8 @@
           # for consumers of this flake.
           boehmgc-nix = final.nix.boehmgc-nix;
         };
-
-    in {
+    in
+    {
       # A Nixpkgs overlay that overrides the 'nix' and
       # 'nix.perl-bindings' packages.
       overlays.default = overlayFor (p: p.stdenv);
@@ -172,58 +208,67 @@
         # Binary package for various platforms.
         build = forAllSystems (system: self.packages.${system}.nix);
 
-        rl-next = forAllSystems (system:
+        rl-next = forAllSystems (
+          system:
           let
-            rl-next-check = name: dir:
-              let pkgs = nixpkgsFor.${system}.native;
-              in pkgs.buildPackages.runCommand "test-${name}-release-notes" { } ''
-              LANG=C.UTF-8 ${lib.getExe pkgs.build-release-notes} ${dir} >$out
-            '';
+            rl-next-check =
+              name: dir:
+              let
+                pkgs = nixpkgsFor.${system}.native;
+              in
+              pkgs.buildPackages.runCommand "test-${name}-release-notes" { } ''
+                LANG=C.UTF-8 ${lib.getExe pkgs.build-release-notes} ${dir} >$out
+              '';
           in
-            {
-              user = rl-next-check "rl-next" ./doc/manual/rl-next;
-              dev = rl-next-check "rl-next-dev" ./doc/manual/rl-next-dev;
-            });
+          {
+            user = rl-next-check "rl-next" ./doc/manual/rl-next;
+            dev = rl-next-check "rl-next-dev" ./doc/manual/rl-next-dev;
+          }
+        );
 
         # FIXME(Qyriad): remove this when the migration to Meson has been completed.
         # NOTE: mesonBuildClang depends on mesonBuild depends on build to avoid OOMs
         # on aarch64 builders caused by too many parallel compiler/linker processes.
-        mesonBuild = forAllSystems (system:
-          (self.packages.${system}.nix.override {
-            buildWithMeson = true;
-          }).overrideAttrs (prev: {
+        mesonBuild = forAllSystems (
+          system:
+          (self.packages.${system}.nix.override { buildWithMeson = true; }).overrideAttrs (prev: {
             buildInputs = prev.buildInputs ++ [ self.packages.${system}.nix ];
-          }));
-        mesonBuildClang = forAllSystems (system:
-          (nixpkgsFor.${system}.stdenvs.clangStdenvPackages.nix.override {
-              buildWithMeson = true;
-          }).overrideAttrs (prev: {
-            buildInputs = prev.buildInputs ++ [ self.hydraJobs.mesonBuild.${system} ];
           })
         );
+        mesonBuildClang = forAllSystems (
+          system:
+          (nixpkgsFor.${system}.stdenvs.clangStdenvPackages.nix.override { buildWithMeson = true; })
+          .overrideAttrs
+            (prev: {
+              buildInputs = prev.buildInputs ++ [ self.hydraJobs.mesonBuild.${system} ];
+            })
+        );
 
         # Perl bindings for various platforms.
         perlBindings = forAllSystems (system: nixpkgsFor.${system}.native.nix.perl-bindings);
 
         # Binary tarball for various platforms, containing a Nix store
         # with the closure of 'nix' package.
-        binaryTarball = forAllSystems (system: binaryTarball nixpkgsFor.${system}.native.nix nixpkgsFor.${system}.native);
+        binaryTarball = forAllSystems (
+          system: binaryTarball nixpkgsFor.${system}.native.nix nixpkgsFor.${system}.native
+        );
 
         # docker image with Nix inside
         dockerImage = lib.genAttrs linux64BitSystems (system: self.packages.${system}.dockerImage);
 
         # API docs for Nix's unstable internal C++ interfaces.
-        internal-api-docs = let
-          nixpkgs = nixpkgsFor.x86_64-linux.native;
-          inherit (nixpkgs) pkgs;
-
-          nix = pkgs.callPackage ./package.nix {
-            inherit versionSuffix officialRelease buildUnreleasedNotes;
-            inherit (pkgs) build-release-notes;
-            internalApiDocs = true;
-            busybox-sandbox-shell = pkgs.busybox-sandbox-shell;
-          };
-        in
+        internal-api-docs =
+          let
+            nixpkgs = nixpkgsFor.x86_64-linux.native;
+            inherit (nixpkgs) pkgs;
+
+            nix = pkgs.callPackage ./package.nix {
+              inherit versionSuffix officialRelease buildUnreleasedNotes;
+              inherit (pkgs) build-release-notes;
+              internalApiDocs = true;
+              busybox-sandbox-shell = pkgs.busybox-sandbox-shell;
+            };
+          in
           nix.overrideAttrs (prev: {
             # This Hydra job is just for the internal API docs.
             # We don't need the build artifacts here.
@@ -239,195 +284,237 @@
           # on a particular version of Nixpkgs.
           evalNixpkgs =
             with nixpkgsFor.x86_64-linux.native;
-            runCommand "eval-nixos" { buildInputs = [ nix ]; }
-              ''
-                type -p nix-env
-                # Note: we're filtering out nixos-install-tools because https://github.com/NixOS/nixpkgs/pull/153594#issuecomment-1020530593.
-                time nix-env --store dummy:// -f ${nixpkgs-regression} -qaP --drv-path | sort | grep -v nixos-install-tools > packages
-                [[ $(sha1sum < packages | cut -c1-40) = 402242fca90874112b34718b8199d844e8b03d12 ]]
-                mkdir $out
-              '';
+            runCommand "eval-nixos" { buildInputs = [ nix ]; } ''
+              type -p nix-env
+              # Note: we're filtering out nixos-install-tools because https://github.com/NixOS/nixpkgs/pull/153594#issuecomment-1020530593.
+              time nix-env --store dummy:// -f ${nixpkgs-regression} -qaP --drv-path | sort | grep -v nixos-install-tools > packages
+              [[ $(sha1sum < packages | cut -c1-40) = 402242fca90874112b34718b8199d844e8b03d12 ]]
+              mkdir $out
+            '';
 
-          nixpkgsLibTests =
-            forAllSystems (system:
-              import (nixpkgs + "/lib/tests/release.nix")
-                { pkgs = nixpkgsFor.${system}.native;
-                  nixVersions = [ self.packages.${system}.nix ];
-                }
-            );
+          nixpkgsLibTests = forAllSystems (
+            system:
+            import (nixpkgs + "/lib/tests/release.nix") {
+              pkgs = nixpkgsFor.${system}.native;
+              nixVersions = [ self.packages.${system}.nix ];
+            }
+          );
         };
 
-        pre-commit = builtins.mapAttrs (system: pre-commit-lib: pre-commit-lib.run {
-          src = self;
-          hooks = {
-            no-commit-to-branch = {
-              enable = true;
-              settings.branch = ["main"];
-            };
-            check-case-conflicts.enable = true;
-            check-executables-have-shebangs = {
-              enable = true;
-              stages = [ "commit" ];
-            };
-            check-shebang-scripts-are-executable = {
-              enable = true;
-              stages = [ "commit" ];
-            };
-            check-symlinks = {
-              enable = true;
-              excludes = [ "^tests/functional/lang/symlink-resolution/broken$" ];
-            };
-            check-merge-conflicts.enable = true;
-            end-of-file-fixer = {
-              enable = true;
-              excludes = [
-                "\\.drv$"
-                "^tests/functional/lang/"
-              ];
-            };
-            mixed-line-endings = {
-              enable = true;
-              excludes = [ "^tests/functional/lang/" ];
-            };
-            # TODO: Once the test suite is nicer, clean up and start
-            # enforcing trailing whitespace on tests that don't explicitly
-            # check for it.
-            trim-trailing-whitespace = {
-              enable = true;
-              stages = [ "commit" ];
-              excludes = [ "^tests/functional/lang/" ];
-            };
-            treefmt = {
-              enable = true;
-              settings.formatters =
-                let
-                  pkgs = nixpkgsFor.${system}.native;
-                in
-                [ pkgs.nixfmt ];
+        pre-commit = builtins.mapAttrs (
+          system: pre-commit-lib:
+          pre-commit-lib.run {
+            src = self;
+            hooks = {
+              no-commit-to-branch = {
+                enable = true;
+                settings.branch = [ "main" ];
+              };
+              check-case-conflicts.enable = true;
+              check-executables-have-shebangs = {
+                enable = true;
+                stages = [ "commit" ];
+              };
+              check-shebang-scripts-are-executable = {
+                enable = true;
+                stages = [ "commit" ];
+              };
+              check-symlinks = {
+                enable = true;
+                excludes = [ "^tests/functional/lang/symlink-resolution/broken$" ];
+              };
+              check-merge-conflicts.enable = true;
+              end-of-file-fixer = {
+                enable = true;
+                excludes = [
+                  "\\.drv$"
+                  "^tests/functional/lang/"
+                ];
+              };
+              mixed-line-endings = {
+                enable = true;
+                excludes = [ "^tests/functional/lang/" ];
+              };
+              # TODO: Once the test suite is nicer, clean up and start
+              # enforcing trailing whitespace on tests that don't explicitly
+              # check for it.
+              trim-trailing-whitespace = {
+                enable = true;
+                stages = [ "commit" ];
+                excludes = [ "^tests/functional/lang/" ];
+              };
+              treefmt = {
+                enable = true;
+                settings.formatters =
+                  let
+                    pkgs = nixpkgsFor.${system}.native;
+                  in
+                  [ pkgs.nixfmt ];
+              };
             };
-          };
-        }) pre-commit-hooks.lib;
+          }
+        ) pre-commit-hooks.lib;
       };
 
       # NOTE *do not* add fresh derivations to checks, always add them to
       # hydraJobs first (so CI will pick them up) and only link them here
-      checks = forAllSystems (system: {
-        # FIXME(Qyriad): remove this when the migration to Meson has been completed.
-        mesonBuild = self.hydraJobs.mesonBuild.${system};
-        mesonBuildClang = self.hydraJobs.mesonBuildClang.${system};
-        binaryTarball = self.hydraJobs.binaryTarball.${system};
-        perlBindings = self.hydraJobs.perlBindings.${system};
-        nixpkgsLibTests = self.hydraJobs.tests.nixpkgsLibTests.${system};
-        rl-next = self.hydraJobs.rl-next.${system}.user;
-        rl-next-dev = self.hydraJobs.rl-next.${system}.dev;
-        pre-commit = self.hydraJobs.pre-commit.${system};
-      } // (lib.optionalAttrs (builtins.elem system linux64BitSystems)) {
-        dockerImage = self.hydraJobs.dockerImage.${system};
-      });
-
-      packages = forAllSystems (system: rec {
-        inherit (nixpkgsFor.${system}.native) nix;
-        default = nix;
-      } // (lib.optionalAttrs (builtins.elem system linux64BitSystems) {
-        nix-static = nixpkgsFor.${system}.static.nix;
-        dockerImage =
-          let
-            pkgs = nixpkgsFor.${system}.native;
-            image = import ./docker.nix { inherit pkgs; tag = version; };
-          in
-          pkgs.runCommand
-            "docker-image-tarball-${version}"
-            { meta.description = "Docker image with Nix for ${system}"; }
-            ''
-              mkdir -p $out/nix-support
-              image=$out/image.tar.gz
-              ln -s ${image} $image
-              echo "file binary-dist $image" >> $out/nix-support/hydra-build-products
-            '';
-      } // builtins.listToAttrs (map
-          (crossSystem: {
-            name = "nix-${crossSystem}";
-            value = nixpkgsFor.${system}.cross.${crossSystem}.nix;
-          })
-          crossSystems)
-        // builtins.listToAttrs (map
-          (stdenvName: {
-            name = "nix-${stdenvName}";
-            value = nixpkgsFor.${system}.stdenvs."${stdenvName}Packages".nix;
-          })
-          stdenvs)));
-
-      devShells = let
-        makeShell = pkgs: stdenv:
-          let
-            nix = pkgs.callPackage ./package.nix {
-              inherit stdenv versionSuffix;
-              busybox-sandbox-shell = pkgs.busybox-sandbox-shell or pkgs.default-busybox-sandbox;
-              forDevShell = true;
-            };
-            pre-commit = self.hydraJobs.pre-commit.${pkgs.system} or {};
-          in
+      checks = forAllSystems (
+        system:
+        {
+          # FIXME(Qyriad): remove this when the migration to Meson has been completed.
+          mesonBuild = self.hydraJobs.mesonBuild.${system};
+          mesonBuildClang = self.hydraJobs.mesonBuildClang.${system};
+          binaryTarball = self.hydraJobs.binaryTarball.${system};
+          perlBindings = self.hydraJobs.perlBindings.${system};
+          nixpkgsLibTests = self.hydraJobs.tests.nixpkgsLibTests.${system};
+          rl-next = self.hydraJobs.rl-next.${system}.user;
+          rl-next-dev = self.hydraJobs.rl-next.${system}.dev;
+          pre-commit = self.hydraJobs.pre-commit.${system};
+        }
+        // (lib.optionalAttrs (builtins.elem system linux64BitSystems)) {
+          dockerImage = self.hydraJobs.dockerImage.${system};
+        }
+      );
+
+      packages = forAllSystems (
+        system:
+        rec {
+          inherit (nixpkgsFor.${system}.native) nix;
+          default = nix;
+        }
+        // (
+          lib.optionalAttrs (builtins.elem system linux64BitSystems) {
+            nix-static = nixpkgsFor.${system}.static.nix;
+            dockerImage =
+              let
+                pkgs = nixpkgsFor.${system}.native;
+                image = import ./docker.nix {
+                  inherit pkgs;
+                  tag = version;
+                };
+              in
+              pkgs.runCommand "docker-image-tarball-${version}"
+                { meta.description = "Docker image with Nix for ${system}"; }
+                ''
+                  mkdir -p $out/nix-support
+                  image=$out/image.tar.gz
+                  ln -s ${image} $image
+                  echo "file binary-dist $image" >> $out/nix-support/hydra-build-products
+                '';
+          }
+          // builtins.listToAttrs (
+            map (crossSystem: {
+              name = "nix-${crossSystem}";
+              value = nixpkgsFor.${system}.cross.${crossSystem}.nix;
+            }) crossSystems
+          )
+          // builtins.listToAttrs (
+            map (stdenvName: {
+              name = "nix-${stdenvName}";
+              value = nixpkgsFor.${system}.stdenvs."${stdenvName}Packages".nix;
+            }) stdenvs
+          )
+        )
+      );
+
+      devShells =
+        let
+          makeShell =
+            pkgs: stdenv:
+            let
+              nix = pkgs.callPackage ./package.nix {
+                inherit stdenv versionSuffix;
+                busybox-sandbox-shell = pkgs.busybox-sandbox-shell or pkgs.default-busybox-sandbox;
+                forDevShell = true;
+              };
+              pre-commit = self.hydraJobs.pre-commit.${pkgs.system} or { };
+            in
             (nix.override {
               buildUnreleasedNotes = true;
               officialRelease = false;
-            }).overrideAttrs (prev: {
-              # Required for clang-tidy checks
-              buildInputs = prev.buildInputs
-                ++ [ pkgs.just pkgs.nixfmt ]
-                ++ lib.optional (pre-commit ? enabledPackages) pre-commit.enabledPackages
-                ++ lib.optionals (stdenv.cc.isClang) [ pkgs.llvmPackages.llvm pkgs.llvmPackages.clang-unwrapped.dev ];
-              nativeBuildInputs = prev.nativeBuildInputs
-                ++ lib.optional (stdenv.cc.isClang && !stdenv.buildPlatform.isDarwin) pkgs.buildPackages.bear
-                # Required for clang-tidy checks
-                ++ lib.optionals (stdenv.cc.isClang) [ pkgs.buildPackages.cmake pkgs.buildPackages.ninja pkgs.buildPackages.llvmPackages.llvm.dev ]
-                ++ lib.optional
-                  (stdenv.cc.isClang && stdenv.hostPlatform == stdenv.buildPlatform)
-                  # for some reason that seems accidental and was changed in
-                  # NixOS 24.05-pre, clang-tools is pinned to LLVM 14 when
-                  # default LLVM is newer.
-                  (pkgs.buildPackages.clang-tools.override { inherit (pkgs.buildPackages) llvmPackages; })
-                ++ [
-                  # FIXME(Qyriad): remove once the migration to Meson is complete.
-                  pkgs.buildPackages.meson
-                  pkgs.buildPackages.ninja
-                  pkgs.buildPackages.cmake
-
-                  pkgs.buildPackages.clangbuildanalyzer
-                ];
-
-              src = null;
-
-              installFlags = "sysconfdir=$(out)/etc";
-              strictDeps = false;
-
-              shellHook = ''
-                PATH=$prefix/bin:$PATH
-                unset PYTHONPATH
-                export MANPATH=$out/share/man:$MANPATH
-
-                # Make bash completion work.
-                XDG_DATA_DIRS+=:$out/share
-
-                ${lib.optionalString (pre-commit ? shellHook) pre-commit.shellHook}
-              '';
-            } // lib.optionalAttrs (stdenv.buildPlatform.isLinux && pkgs.glibcLocales != null) {
-              # Required to make non-NixOS Linux not complain about missing locale files during configure in a dev shell
-              LOCALE_ARCHIVE = "${lib.getLib pkgs.glibcLocales}/lib/locale/locale-archive";
-            });
+            }).overrideAttrs
+              (
+                prev:
+                {
+                  # Required for clang-tidy checks
+                  buildInputs =
+                    prev.buildInputs
+                    ++ [
+                      pkgs.just
+                      pkgs.nixfmt
+                    ]
+                    ++ lib.optional (pre-commit ? enabledPackages) pre-commit.enabledPackages
+                    ++ lib.optionals (stdenv.cc.isClang) [
+                      pkgs.llvmPackages.llvm
+                      pkgs.llvmPackages.clang-unwrapped.dev
+                    ];
+                  nativeBuildInputs =
+                    prev.nativeBuildInputs
+                    ++ lib.optional (stdenv.cc.isClang && !stdenv.buildPlatform.isDarwin) pkgs.buildPackages.bear
+                    # Required for clang-tidy checks
+                    ++ lib.optionals (stdenv.cc.isClang) [
+                      pkgs.buildPackages.cmake
+                      pkgs.buildPackages.ninja
+                      pkgs.buildPackages.llvmPackages.llvm.dev
+                    ]
+                    ++
+                      lib.optional (stdenv.cc.isClang && stdenv.hostPlatform == stdenv.buildPlatform)
+                        # for some reason that seems accidental and was changed in
+                        # NixOS 24.05-pre, clang-tools is pinned to LLVM 14 when
+                        # default LLVM is newer.
+                        (pkgs.buildPackages.clang-tools.override { inherit (pkgs.buildPackages) llvmPackages; })
+                    ++ [
+                      # FIXME(Qyriad): remove once the migration to Meson is complete.
+                      pkgs.buildPackages.meson
+                      pkgs.buildPackages.ninja
+                      pkgs.buildPackages.cmake
+
+                      pkgs.buildPackages.clangbuildanalyzer
+                    ];
+
+                  src = null;
+
+                  installFlags = "sysconfdir=$(out)/etc";
+                  strictDeps = false;
+
+                  shellHook = ''
+                    PATH=$prefix/bin:$PATH
+                    unset PYTHONPATH
+                    export MANPATH=$out/share/man:$MANPATH
+
+                    # Make bash completion work.
+                    XDG_DATA_DIRS+=:$out/share
+
+                    ${lib.optionalString (pre-commit ? shellHook) pre-commit.shellHook}
+                  '';
+                }
+                // lib.optionalAttrs (stdenv.buildPlatform.isLinux && pkgs.glibcLocales != null) {
+                  # Required to make non-NixOS Linux not complain about missing locale files during configure in a dev shell
+                  LOCALE_ARCHIVE = "${lib.getLib pkgs.glibcLocales}/lib/locale/locale-archive";
+                }
+              );
         in
-        forAllSystems (system:
+        forAllSystems (
+          system:
           let
-            makeShells = prefix: pkgs:
-              lib.mapAttrs'
-              (k: v: lib.nameValuePair "${prefix}-${k}" v)
-              (forAllStdenvs (stdenvName: makeShell pkgs pkgs.${stdenvName}));
+            makeShells =
+              prefix: pkgs:
+              lib.mapAttrs' (k: v: lib.nameValuePair "${prefix}-${k}" v) (
+                forAllStdenvs (stdenvName: makeShell pkgs pkgs.${stdenvName})
+              );
           in
-            (makeShells "native" nixpkgsFor.${system}.native) //
-            (makeShells "static" nixpkgsFor.${system}.static) //
-            (forAllCrossSystems (crossSystem: let pkgs = nixpkgsFor.${system}.cross.${crossSystem}; in makeShell pkgs pkgs.stdenv)) //
-            {
-              default = self.devShells.${system}.native-stdenvPackages;
-            }
+          (makeShells "native" nixpkgsFor.${system}.native)
+          // (makeShells "static" nixpkgsFor.${system}.static)
+          // (forAllCrossSystems (
+            crossSystem:
+            let
+              pkgs = nixpkgsFor.${system}.cross.${crossSystem};
+            in
+            makeShell pkgs pkgs.stdenv
+          ))
+          // {
+            default = self.devShells.${system}.native-stdenvPackages;
+          }
         );
-  };
+    };
 }
diff --git a/lix-doc/package.nix b/lix-doc/package.nix
index 86ab7501e..d3896e726 100644
--- a/lix-doc/package.nix
+++ b/lix-doc/package.nix
@@ -1,7 +1,4 @@
-{
-  rustPlatform,
-  lib
-}:
+{ rustPlatform, lib }:
 
 rustPlatform.buildRustPackage {
   name = "lix-doc";
diff --git a/maintainers/build-release-notes.nix b/maintainers/build-release-notes.nix
index 9462e33d7..1acbe87f1 100644
--- a/maintainers/build-release-notes.nix
+++ b/maintainers/build-release-notes.nix
@@ -1,4 +1,8 @@
-{ lib, python3, writeShellScriptBin }:
+{
+  lib,
+  python3,
+  writeShellScriptBin,
+}:
 
 writeShellScriptBin "build-release-notes" ''
   exec ${lib.getExe (python3.withPackages (p: [ p.python-frontmatter ]))} \
diff --git a/misc/clangbuildanalyzer.nix b/misc/clangbuildanalyzer.nix
index a317e5144..cee8a0d77 100644
--- a/misc/clangbuildanalyzer.nix
+++ b/misc/clangbuildanalyzer.nix
@@ -1,6 +1,11 @@
 # Upstreaming here, can be deleted once it's upstreamed:
 # https://github.com/NixOS/nixpkgs/pull/297102
-{ stdenv, lib, cmake, fetchFromGitHub }:
+{
+  stdenv,
+  lib,
+  cmake,
+  fetchFromGitHub,
+}:
 stdenv.mkDerivation (finalAttrs: {
   pname = "clangbuildanalyzer";
   version = "1.5.0";
@@ -12,9 +17,7 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-kmgdk634zM0W0OoRoP/RzepArSipa5bNqdVgdZO9gxo=";
   };
 
-  nativeBuildInputs = [
-    cmake
-  ];
+  nativeBuildInputs = [ cmake ];
 
   meta = {
     description = "Tool for analyzing Clang's -ftrace-time files";
diff --git a/package.nix b/package.nix
index d096b5c73..e1d3cfcd5 100644
--- a/package.nix
+++ b/package.nix
@@ -69,9 +69,7 @@
   __forDefaults ? {
     canRunInstalled = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
-    boehmgc-nix = (boehmgc.override {
-      enableLargeConfig = true;
-    }).overrideAttrs {
+    boehmgc-nix = (boehmgc.override { enableLargeConfig = true; }).overrideAttrs {
       patches = [
         # We do *not* include prev.patches (which doesn't exist in normal pkgs.boehmgc anyway)
         # because if the caller of this package passed a patched boehm as `boehmgc` instead of
@@ -85,20 +83,22 @@
 
     lix-doc = pkgs.callPackage ./lix-doc/package.nix { };
   },
-}: let
+}:
+let
   inherit (__forDefaults) canRunInstalled;
   inherit (lib) fileset;
 
   version = lib.fileContents ./.version + versionSuffix;
 
   aws-sdk-cpp-nix = aws-sdk-cpp.override {
-    apis = [ "s3" "transfer" ];
+    apis = [
+      "s3"
+      "transfer"
+    ];
     customMemoryManagement = false;
   };
 
-  testConfigureFlags = [
-    "RAPIDCHECK_HEADERS=${lib.getDev rapidcheck}/extras/gtest/include"
-  ];
+  testConfigureFlags = [ "RAPIDCHECK_HEADERS=${lib.getDev rapidcheck}/extras/gtest/include" ];
 
   # The internal API docs need these for the build, but if we're not building
   # Nix itself, then these don't need to be propagated.
@@ -120,48 +120,60 @@
     ./README.md
   ];
 
-  topLevelBuildFiles = fileset.unions ([
-    ./local.mk
-    ./Makefile
-    ./Makefile.config.in
-    ./mk
-  ] ++ lib.optionals buildWithMeson [
-    ./meson.build
-    ./meson.options
-    ./meson
-    ./scripts/meson.build
-  ]);
-
- functionalTestFiles = fileset.unions [
+  topLevelBuildFiles = fileset.unions (
+    [
+      ./local.mk
+      ./Makefile
+      ./Makefile.config.in
+      ./mk
+    ]
+    ++ lib.optionals buildWithMeson [
+      ./meson.build
+      ./meson.options
+      ./meson
+      ./scripts/meson.build
+    ]
+  );
+
+  functionalTestFiles = fileset.unions [
     ./tests/functional
     ./tests/unit
     (fileset.fileFilter (f: lib.strings.hasPrefix "nix-profile" f.name) ./scripts)
- ];
-
-in stdenv.mkDerivation (finalAttrs: {
+  ];
+in
+stdenv.mkDerivation (finalAttrs: {
   inherit pname version;
 
   src = fileset.toSource {
     root = ./.;
-    fileset = fileset.intersection baseFiles (fileset.unions ([
-      configureFiles
-      topLevelBuildFiles
-      functionalTestFiles
-    ] ++ lib.optionals (!finalAttrs.dontBuild || internalApiDocs) [
-      ./boehmgc-coroutine-sp-fallback.diff
-      ./doc
-      ./misc
-      ./precompiled-headers.h
-      ./src
-      ./COPYING
-      ./scripts/local.mk
-    ]));
+    fileset = fileset.intersection baseFiles (
+      fileset.unions (
+        [
+          configureFiles
+          topLevelBuildFiles
+          functionalTestFiles
+        ]
+        ++ lib.optionals (!finalAttrs.dontBuild || internalApiDocs) [
+          ./boehmgc-coroutine-sp-fallback.diff
+          ./doc
+          ./misc
+          ./precompiled-headers.h
+          ./src
+          ./COPYING
+          ./scripts/local.mk
+        ]
+      )
+    );
   };
 
   VERSION_SUFFIX = versionSuffix;
 
-  outputs = [ "out" ]
-    ++ lib.optionals (!finalAttrs.dontBuild) [ "dev" "doc" ];
+  outputs =
+    [ "out" ]
+    ++ lib.optionals (!finalAttrs.dontBuild) [
+      "dev"
+      "doc"
+    ];
 
   dontBuild = false;
 
@@ -173,53 +185,61 @@ in stdenv.mkDerivation (finalAttrs: {
   # We only include CMake so that Meson can locate toml11, which only ships CMake dependency metadata.
   dontUseCmakeConfigure = true;
 
-  nativeBuildInputs = [
-    bison
-    flex
-    python3
-  ] ++ [
-    (lib.getBin lowdown)
-    mdbook
-    mdbook-linkcheck
-    autoconf-archive
-  ] ++ lib.optional (!buildWithMeson) autoreconfHook ++ [
-    pkg-config
-
-    # Tests
-    git
-    mercurial
-    jq
-    lsof
-  ] ++ lib.optional stdenv.hostPlatform.isLinux util-linuxMinimal
+  nativeBuildInputs =
+    [
+      bison
+      flex
+      python3
+    ]
+    ++ [
+      (lib.getBin lowdown)
+      mdbook
+      mdbook-linkcheck
+      autoconf-archive
+    ]
+    ++ lib.optional (!buildWithMeson) autoreconfHook
+    ++ [
+      pkg-config
+
+      # Tests
+      git
+      mercurial
+      jq
+      lsof
+    ]
+    ++ lib.optional stdenv.hostPlatform.isLinux util-linuxMinimal
     ++ lib.optional (!officialRelease && buildUnreleasedNotes) build-release-notes
     ++ lib.optional internalApiDocs doxygen
     ++ lib.optionals buildWithMeson [
       meson
       ninja
       cmake
-  ];
+    ];
 
-  buildInputs = [
-    curl
-    bzip2
-    xz
-    brotli
-    editline
-    openssl
-    sqlite
-    libarchive
-    boost
-    lowdown
-    libsodium
-    toml11
-    lix-doc
-  ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ libseccomp busybox-sandbox-shell ]
+  buildInputs =
+    [
+      curl
+      bzip2
+      xz
+      brotli
+      editline
+      openssl
+      sqlite
+      libarchive
+      boost
+      lowdown
+      libsodium
+      toml11
+      lix-doc
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      libseccomp
+      busybox-sandbox-shell
+    ]
     ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid
     # There have been issues building these dependencies
     ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) aws-sdk-cpp-nix
-    ++ lib.optionals (finalAttrs.dontBuild) maybePropagatedInputs
-  ;
+    ++ lib.optionals (finalAttrs.dontBuild) maybePropagatedInputs;
 
   checkInputs = [
     gtest
@@ -228,9 +248,7 @@ in stdenv.mkDerivation (finalAttrs: {
 
   propagatedBuildInputs = lib.optionals (!finalAttrs.dontBuild) maybePropagatedInputs;
 
-  disallowedReferences = [
-    boost
-  ];
+  disallowedReferences = [ boost ];
 
   # Needed for Meson to find Boost.
   # https://github.com/NixOS/nixpkgs/issues/86131.
@@ -239,46 +257,47 @@ in stdenv.mkDerivation (finalAttrs: {
     BOOST_LIBRARYDIR = "${lib.getLib boost}/lib";
   };
 
-  preConfigure = lib.optionalString (!finalAttrs.dontBuild && !stdenv.hostPlatform.isStatic) ''
-    # Copy libboost_context so we don't get all of Boost in our closure.
-    # https://github.com/NixOS/nixpkgs/issues/45462
-    mkdir -p $out/lib
-    cp -pd ${boost}/lib/{libboost_context*,libboost_thread*,libboost_system*} $out/lib
-    rm -f $out/lib/*.a
-  '' + lib.optionalString (!finalAttrs.dontBuild && stdenv.hostPlatform.isLinux) ''
-    chmod u+w $out/lib/*.so.*
-    patchelf --set-rpath $out/lib:${stdenv.cc.cc.lib}/lib $out/lib/libboost_thread.so.*
-  '' + lib.optionalString (!finalAttrs.dontBuild && stdenv.hostPlatform.isDarwin) ''
-    for LIB in $out/lib/*.dylib; do
-      chmod u+w $LIB
-      install_name_tool -id $LIB $LIB
-      install_name_tool -delete_rpath ${boost}/lib/ $LIB || true
-    done
-    install_name_tool -change ${boost}/lib/libboost_system.dylib $out/lib/libboost_system.dylib $out/lib/libboost_thread.dylib
-  '' + ''
-    # Workaround https://github.com/NixOS/nixpkgs/issues/294890.
-    if [[ -n "''${doCheck:-}" ]]; then
-      appendToVar configureFlags "--enable-tests"
-    else
-      appendToVar configureFlags "--disable-tests"
-    fi
-  '';
-
-  configureFlags = [
-    "--with-boost=${boost}/lib"
-  ] ++ lib.optionals stdenv.isLinux [
-    "--with-sandbox-shell=${busybox-sandbox-shell}/bin/busybox"
-  ] ++ lib.optionals (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) [
-    "LDFLAGS=-fuse-ld=gold"
-  ]
+  preConfigure =
+    lib.optionalString (!finalAttrs.dontBuild && !stdenv.hostPlatform.isStatic) ''
+      # Copy libboost_context so we don't get all of Boost in our closure.
+      # https://github.com/NixOS/nixpkgs/issues/45462
+      mkdir -p $out/lib
+      cp -pd ${boost}/lib/{libboost_context*,libboost_thread*,libboost_system*} $out/lib
+      rm -f $out/lib/*.a
+    ''
+    + lib.optionalString (!finalAttrs.dontBuild && stdenv.hostPlatform.isLinux) ''
+      chmod u+w $out/lib/*.so.*
+      patchelf --set-rpath $out/lib:${stdenv.cc.cc.lib}/lib $out/lib/libboost_thread.so.*
+    ''
+    + lib.optionalString (!finalAttrs.dontBuild && stdenv.hostPlatform.isDarwin) ''
+      for LIB in $out/lib/*.dylib; do
+        chmod u+w $LIB
+        install_name_tool -id $LIB $LIB
+        install_name_tool -delete_rpath ${boost}/lib/ $LIB || true
+      done
+      install_name_tool -change ${boost}/lib/libboost_system.dylib $out/lib/libboost_system.dylib $out/lib/libboost_thread.dylib
+    ''
+    + ''
+      # Workaround https://github.com/NixOS/nixpkgs/issues/294890.
+      if [[ -n "''${doCheck:-}" ]]; then
+        appendToVar configureFlags "--enable-tests"
+      else
+        appendToVar configureFlags "--disable-tests"
+      fi
+    '';
+
+  configureFlags =
+    [ "--with-boost=${boost}/lib" ]
+    ++ lib.optionals stdenv.isLinux [ "--with-sandbox-shell=${busybox-sandbox-shell}/bin/busybox" ]
+    ++ lib.optionals (
+      stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")
+    ) [ "LDFLAGS=-fuse-ld=gold" ]
     ++ lib.optional stdenv.hostPlatform.isStatic "--enable-embedded-sandbox-shell"
     ++ lib.optionals (finalAttrs.doCheck || internalApiDocs) testConfigureFlags
     ++ lib.optional (!canRunInstalled) "--disable-doc-gen"
     ++ [ (lib.enableFeature internalApiDocs "internal-api-docs") ]
     ++ lib.optional (!forDevShell) "--sysconfdir=/etc"
-    ++ [
-      "TOML11_HEADERS=${lib.getDev toml11}/include"
-    ];
+    ++ [ "TOML11_HEADERS=${lib.getDev toml11}/include" ];
 
   mesonBuildType = lib.optional (buildWithMeson || forDevShell) "debugoptimized";
 
@@ -290,37 +309,37 @@ in stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  mesonCheckFlags = lib.optionals (buildWithMeson || forDevShell) [
-    "--suite=check"
-  ];
+  mesonCheckFlags = lib.optionals (buildWithMeson || forDevShell) [ "--suite=check" ];
 
   installFlags = "sysconfdir=$(out)/etc";
 
-  postInstall = lib.optionalString (!finalAttrs.dontBuild) ''
-    mkdir -p $doc/nix-support
-    echo "doc manual $doc/share/doc/nix/manual" >> $doc/nix-support/hydra-build-products
-  '' + lib.optionalString stdenv.hostPlatform.isStatic ''
-    mkdir -p $out/nix-support
-    echo "file binary-dist $out/bin/nix" >> $out/nix-support/hydra-build-products
-  '' + lib.optionalString stdenv.isDarwin ''
-    for lib in libnixutil.dylib libnixexpr.dylib; do
-      install_name_tool \
-        -change "${lib.getLib boost}/lib/libboost_context.dylib" \
-        "$out/lib/libboost_context.dylib" \
-        "$out/lib/$lib"
-    done
-  '' + lib.optionalString internalApiDocs ''
-    mkdir -p $out/nix-support
-    echo "doc internal-api-docs $out/share/doc/nix/internal-api/html" >> "$out/nix-support/hydra-build-products"
-  '';
+  postInstall =
+    lib.optionalString (!finalAttrs.dontBuild) ''
+      mkdir -p $doc/nix-support
+      echo "doc manual $doc/share/doc/nix/manual" >> $doc/nix-support/hydra-build-products
+    ''
+    + lib.optionalString stdenv.hostPlatform.isStatic ''
+      mkdir -p $out/nix-support
+      echo "file binary-dist $out/bin/nix" >> $out/nix-support/hydra-build-products
+    ''
+    + lib.optionalString stdenv.isDarwin ''
+      for lib in libnixutil.dylib libnixexpr.dylib; do
+        install_name_tool \
+          -change "${lib.getLib boost}/lib/libboost_context.dylib" \
+          "$out/lib/libboost_context.dylib" \
+          "$out/lib/$lib"
+      done
+    ''
+    + lib.optionalString internalApiDocs ''
+      mkdir -p $out/nix-support
+      echo "doc internal-api-docs $out/share/doc/nix/internal-api/html" >> "$out/nix-support/hydra-build-products"
+    '';
 
   doInstallCheck = finalAttrs.doCheck;
   installCheckFlags = "sysconfdir=$(out)/etc";
   installCheckTarget = "installcheck"; # work around buggy detection in stdenv
 
-  mesonInstallCheckFlags = [
-    "--suite=installcheck"
-  ];
+  mesonInstallCheckFlags = [ "--suite=installcheck" ];
 
   preInstallCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
     export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES
@@ -338,14 +357,11 @@ in stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   # strictoverflow is disabled because we trap on signed overflow instead
-  hardeningDisable = [ "strictoverflow" ]
-    ++ lib.optional stdenv.hostPlatform.isStatic "pie";
+  hardeningDisable = [ "strictoverflow" ] ++ lib.optional stdenv.hostPlatform.isStatic "pie";
 
   meta.platforms = lib.platforms.unix;
 
-  passthru.perl-bindings = pkgs.callPackage ./perl {
-    inherit fileset stdenv buildWithMeson;
-  };
+  passthru.perl-bindings = pkgs.callPackage ./perl { inherit fileset stdenv buildWithMeson; };
 
   # Export the patched version of boehmgc.
   # flake.nix exports that into its overlay.
diff --git a/perl/default.nix b/perl/default.nix
index 53666716e..af700eabe 100644
--- a/perl/default.nix
+++ b/perl/default.nix
@@ -1,63 +1,80 @@
-{ lib, fileset
-, stdenv
-, perl, perlPackages
-, autoconf-archive, autoreconfHook, pkg-config
-, nix, curl, bzip2, xz, boost, libsodium, darwin
-, meson
-, ninja
-, buildWithMeson ? false,
+{
+  lib,
+  fileset,
+  stdenv,
+  perl,
+  perlPackages,
+  autoconf-archive,
+  autoreconfHook,
+  pkg-config,
+  nix,
+  curl,
+  bzip2,
+  xz,
+  boost,
+  libsodium,
+  darwin,
+  meson,
+  ninja,
+  buildWithMeson ? false,
 }:
 
-perl.pkgs.toPerlModule (stdenv.mkDerivation {
-  name = "nix-perl-${nix.version}";
+perl.pkgs.toPerlModule (
+  stdenv.mkDerivation {
+    name = "nix-perl-${nix.version}";
 
-  src = fileset.toSource {
-    root = ../.;
-    fileset = fileset.unions ([
-      ../.version
-      ./lib
-    ] ++ lib.optionals (!buildWithMeson) [
-      # FIXME(Qyriad): What the hell is this?
-      # What is it used for and do we still need it?
-      ./MANIFEST
-      ../m4
-      ../mk
-      ./Makefile
-      ./Makefile.config.in
-      ./configure.ac
-      ./local.mk
-    ] ++ lib.optionals buildWithMeson [
-      ./meson.build
-    ]);
-  };
+    src = fileset.toSource {
+      root = ../.;
+      fileset = fileset.unions (
+        [
+          ../.version
+          ./lib
+        ]
+        ++ lib.optionals (!buildWithMeson) [
+          # FIXME(Qyriad): What the hell is this?
+          # What is it used for and do we still need it?
+          ./MANIFEST
+          ../m4
+          ../mk
+          ./Makefile
+          ./Makefile.config.in
+          ./configure.ac
+          ./local.mk
+        ]
+        ++ lib.optionals buildWithMeson [ ./meson.build ]
+      );
+    };
 
-  nativeBuildInputs = [
-    pkg-config
-  ] ++ lib.optionals (!buildWithMeson) [
-    autoconf-archive
-    autoreconfHook
-  ] ++ lib.optionals buildWithMeson [
-    meson
-    ninja
-  ];
+    nativeBuildInputs =
+      [ pkg-config ]
+      ++ lib.optionals (!buildWithMeson) [
+        autoconf-archive
+        autoreconfHook
+      ]
+      ++ lib.optionals buildWithMeson [
+        meson
+        ninja
+      ];
 
-  buildInputs =
-    [ nix
-      curl
-      bzip2
-      xz
-      perl
-      boost
-      perlPackages.DBI
-      perlPackages.DBDSQLite
-    ]
-    ++ lib.optional (stdenv.isLinux || stdenv.isDarwin) libsodium
-    ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
+    buildInputs =
+      [
+        nix
+        curl
+        bzip2
+        xz
+        perl
+        boost
+        perlPackages.DBI
+        perlPackages.DBDSQLite
+      ]
+      ++ lib.optional (stdenv.isLinux || stdenv.isDarwin) libsodium
+      ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
 
-  # Nixpkgs' Meson hook likes to set this to "plain".
-  mesonBuildType = "debugoptimized";
+    # Nixpkgs' Meson hook likes to set this to "plain".
+    mesonBuildType = "debugoptimized";
 
-  enableParallelBuilding = true;
+    enableParallelBuilding = true;
 
-  postUnpack = "sourceRoot=$sourceRoot/perl";
-})
+    postUnpack = "sourceRoot=$sourceRoot/perl";
+  }
+)
diff --git a/src/libexpr/fetchurl.nix b/src/libexpr/fetchurl.nix
index 9d1b61d7f..50007c738 100644
--- a/src/libexpr/fetchurl.nix
+++ b/src/libexpr/fetchurl.nix
@@ -1,43 +1,75 @@
-{ system ? "" # obsolete
-, url
-, hash ? "" # an SRI hash
-
-# Legacy hash specification
-, md5 ? "", sha1 ? "", sha256 ? "", sha512 ? ""
-, outputHash ?
-    if hash != "" then hash else if sha512 != "" then sha512 else if sha1 != "" then sha1 else if md5 != "" then md5 else sha256
-, outputHashAlgo ?
-    if hash != "" then "" else if sha512 != "" then "sha512" else if sha1 != "" then "sha1" else if md5 != "" then "md5" else "sha256"
-
-, executable ? false
-, unpack ? false
-, name ? baseNameOf (toString url)
-, impure ? false
+{
+  system ? "", # obsolete
+  url,
+  hash ? "", # an SRI hash
+
+  # Legacy hash specification
+  md5 ? "",
+  sha1 ? "",
+  sha256 ? "",
+  sha512 ? "",
+  outputHash ?
+    if hash != "" then
+      hash
+    else if sha512 != "" then
+      sha512
+    else if sha1 != "" then
+      sha1
+    else if md5 != "" then
+      md5
+    else
+      sha256,
+  outputHashAlgo ?
+    if hash != "" then
+      ""
+    else if sha512 != "" then
+      "sha512"
+    else if sha1 != "" then
+      "sha1"
+    else if md5 != "" then
+      "md5"
+    else
+      "sha256",
+
+  executable ? false,
+  unpack ? false,
+  name ? baseNameOf (toString url),
+  impure ? false,
 }:
 
-derivation ({
-  builder = "builtin:fetchurl";
+derivation (
+  {
+    builder = "builtin:fetchurl";
 
-  # New-style output content requirements.
-  outputHashMode = if unpack || executable then "recursive" else "flat";
+    # New-style output content requirements.
+    outputHashMode = if unpack || executable then "recursive" else "flat";
 
-  inherit name url executable unpack;
+    inherit
+      name
+      url
+      executable
+      unpack
+      ;
 
-  system = "builtin";
+    system = "builtin";
 
-  # No need to double the amount of network traffic
-  preferLocalBuild = true;
+    # No need to double the amount of network traffic
+    preferLocalBuild = true;
 
-  impureEnvVars = [
-    # We borrow these environment variables from the caller to allow
-    # easy proxy configuration.  This is impure, but a fixed-output
-    # derivation like fetchurl is allowed to do so since its result is
-    # by definition pure.
-    "http_proxy" "https_proxy" "ftp_proxy" "all_proxy" "no_proxy"
-  ];
+    impureEnvVars = [
+      # We borrow these environment variables from the caller to allow
+      # easy proxy configuration.  This is impure, but a fixed-output
+      # derivation like fetchurl is allowed to do so since its result is
+      # by definition pure.
+      "http_proxy"
+      "https_proxy"
+      "ftp_proxy"
+      "all_proxy"
+      "no_proxy"
+    ];
 
-  # To make "nix-prefetch-url" work.
-  urls = [ url ];
-} // (if impure
-      then { __impure = true; }
-      else { inherit outputHashAlgo outputHash; }))
+    # To make "nix-prefetch-url" work.
+    urls = [ url ];
+  }
+  // (if impure then { __impure = true; } else { inherit outputHashAlgo outputHash; })
+)
diff --git a/src/libexpr/flake/call-flake.nix b/src/libexpr/flake/call-flake.nix
index 4beb0b0fe..58b4a5542 100644
--- a/src/libexpr/flake/call-flake.nix
+++ b/src/libexpr/flake/call-flake.nix
@@ -4,69 +4,69 @@ let
 
   lockFile = builtins.fromJSON lockFileStr;
 
-  allNodes =
-    builtins.mapAttrs
-      (key: node:
-        let
+  allNodes = builtins.mapAttrs (
+    key: node:
+    let
 
-          sourceInfo =
-            if key == lockFile.root
-            then rootSrc
-            else fetchTree (node.info or {} // removeAttrs node.locked ["dir"]);
+      sourceInfo =
+        if key == lockFile.root then
+          rootSrc
+        else
+          fetchTree (node.info or { } // removeAttrs node.locked [ "dir" ]);
 
-          subdir = if key == lockFile.root then rootSubdir else node.locked.dir or "";
+      subdir = if key == lockFile.root then rootSubdir else node.locked.dir or "";
 
-          outPath = sourceInfo + ((if subdir == "" then "" else "/") + subdir);
+      outPath = sourceInfo + ((if subdir == "" then "" else "/") + subdir);
 
-          flake = import (outPath + "/flake.nix");
+      flake = import (outPath + "/flake.nix");
 
-          inputs = builtins.mapAttrs
-            (inputName: inputSpec: allNodes.${resolveInput inputSpec})
-            (node.inputs or {});
+      inputs = builtins.mapAttrs (inputName: inputSpec: allNodes.${resolveInput inputSpec}) (
+        node.inputs or { }
+      );
 
-          # Resolve a input spec into a node name. An input spec is
-          # either a node name, or a 'follows' path from the root
-          # node.
-          resolveInput = inputSpec:
-              if builtins.isList inputSpec
-              then getInputByPath lockFile.root inputSpec
-              else inputSpec;
+      # Resolve a input spec into a node name. An input spec is
+      # either a node name, or a 'follows' path from the root
+      # node.
+      resolveInput =
+        inputSpec: if builtins.isList inputSpec then getInputByPath lockFile.root inputSpec else inputSpec;
 
-          # Follow an input path (e.g. ["dwarffs" "nixpkgs"]) from the
-          # root node, returning the final node.
-          getInputByPath = nodeName: path:
-            if path == []
-            then nodeName
-            else
-              getInputByPath
-                # Since this could be a 'follows' input, call resolveInput.
-                (resolveInput lockFile.nodes.${nodeName}.inputs.${builtins.head path})
-                (builtins.tail path);
+      # Follow an input path (e.g. ["dwarffs" "nixpkgs"]) from the
+      # root node, returning the final node.
+      getInputByPath =
+        nodeName: path:
+        if path == [ ] then
+          nodeName
+        else
+          getInputByPath
+            # Since this could be a 'follows' input, call resolveInput.
+            (resolveInput lockFile.nodes.${nodeName}.inputs.${builtins.head path})
+            (builtins.tail path);
 
-          outputs = flake.outputs (inputs // { self = result; });
+      outputs = flake.outputs (inputs // { self = result; });
 
-          result =
-            outputs
-            # We add the sourceInfo attribute for its metadata, as they are
-            # relevant metadata for the flake. However, the outPath of the
-            # sourceInfo does not necessarily match the outPath of the flake,
-            # as the flake may be in a subdirectory of a source.
-            # This is shadowed in the next //
-            // sourceInfo
-            // {
-              # This shadows the sourceInfo.outPath
-              inherit outPath;
+      result =
+        outputs
+        # We add the sourceInfo attribute for its metadata, as they are
+        # relevant metadata for the flake. However, the outPath of the
+        # sourceInfo does not necessarily match the outPath of the flake,
+        # as the flake may be in a subdirectory of a source.
+        # This is shadowed in the next //
+        // sourceInfo
+        // {
+          # This shadows the sourceInfo.outPath
+          inherit outPath;
 
-              inherit inputs; inherit outputs; inherit sourceInfo; _type = "flake";
-            };
-
-        in
-          if node.flake or true then
-            assert builtins.isFunction flake.outputs;
-            result
-          else
-            sourceInfo
-      )
-      lockFile.nodes;
-
-in allNodes.${lockFile.root}
+          inherit inputs;
+          inherit outputs;
+          inherit sourceInfo;
+          _type = "flake";
+        };
+    in
+    if node.flake or true then
+      assert builtins.isFunction flake.outputs;
+      result
+    else
+      sourceInfo
+  ) lockFile.nodes;
+in
+allNodes.${lockFile.root}
diff --git a/src/libexpr/imported-drv-to-derivation.nix b/src/libexpr/imported-drv-to-derivation.nix
index 9467e6a22..50864563e 100644
--- a/src/libexpr/imported-drv-to-derivation.nix
+++ b/src/libexpr/imported-drv-to-derivation.nix
@@ -1,21 +1,26 @@
-attrs @ { drvPath, outputs, name, ... }:
+attrs@{
+  drvPath,
+  outputs,
+  name,
+  ...
+}:
 
 let
 
-  commonAttrs = (builtins.listToAttrs outputsList) //
-    { all = map (x: x.value) outputsList;
-      inherit drvPath name;
-      type = "derivation";
-    };
+  commonAttrs = (builtins.listToAttrs outputsList) // {
+    all = map (x: x.value) outputsList;
+    inherit drvPath name;
+    type = "derivation";
+  };
 
-  outputToAttrListElement = outputName:
-    { name = outputName;
-      value = commonAttrs // {
-        outPath = builtins.getAttr outputName attrs;
-        inherit outputName;
-      };
+  outputToAttrListElement = outputName: {
+    name = outputName;
+    value = commonAttrs // {
+      outPath = builtins.getAttr outputName attrs;
+      inherit outputName;
     };
+  };
 
   outputsList = map outputToAttrListElement outputs;
-
-in (builtins.head outputsList).value
+in
+(builtins.head outputsList).value
diff --git a/src/libexpr/primops/derivation.nix b/src/libexpr/primops/derivation.nix
index c0fbe8082..674408c6d 100644
--- a/src/libexpr/primops/derivation.nix
+++ b/src/libexpr/primops/derivation.nix
@@ -1,27 +1,35 @@
-/* This is the implementation of the ‘derivation’ builtin function.
-   It's actually a wrapper around the ‘derivationStrict’ primop. */
+/*
+  This is the implementation of the ‘derivation’ builtin function.
+  It's actually a wrapper around the ‘derivationStrict’ primop.
+*/
 
-drvAttrs @ { outputs ? [ "out" ], ... }:
+drvAttrs@{
+  outputs ? [ "out" ],
+  ...
+}:
 
 let
 
   strict = derivationStrict drvAttrs;
 
-  commonAttrs = drvAttrs // (builtins.listToAttrs outputsList) //
-    { all = map (x: x.value) outputsList;
+  commonAttrs =
+    drvAttrs
+    // (builtins.listToAttrs outputsList)
+    // {
+      all = map (x: x.value) outputsList;
       inherit drvAttrs;
     };
 
-  outputToAttrListElement = outputName:
-    { name = outputName;
-      value = commonAttrs // {
-        outPath = builtins.getAttr outputName strict;
-        drvPath = strict.drvPath;
-        type = "derivation";
-        inherit outputName;
-      };
+  outputToAttrListElement = outputName: {
+    name = outputName;
+    value = commonAttrs // {
+      outPath = builtins.getAttr outputName strict;
+      drvPath = strict.drvPath;
+      type = "derivation";
+      inherit outputName;
     };
+  };
 
   outputsList = map outputToAttrListElement outputs;
-
-in (builtins.head outputsList).value
+in
+(builtins.head outputsList).value
diff --git a/src/nix-channel/unpack-channel.nix b/src/nix-channel/unpack-channel.nix
index 10515bc8b..84e324a4d 100644
--- a/src/nix-channel/unpack-channel.nix
+++ b/src/nix-channel/unpack-channel.nix
@@ -1,4 +1,8 @@
-{ name, channelName, src }:
+{
+  name,
+  channelName,
+  src,
+}:
 
 derivation {
   builder = "builtin:unpack-channel";
diff --git a/src/nix-env/buildenv.nix b/src/nix-env/buildenv.nix
index 0bac4c44b..c8955a94e 100644
--- a/src/nix-env/buildenv.nix
+++ b/src/nix-env/buildenv.nix
@@ -8,13 +8,15 @@ derivation {
   inherit manifest;
 
   # !!! grmbl, need structured data for passing this in a clean way.
-  derivations =
-    map (d:
-      [ (d.meta.active or "true")
-        (d.meta.priority or 5)
-        (builtins.length d.outputs)
-      ] ++ map (output: builtins.getAttr output d) d.outputs)
-      derivations;
+  derivations = map (
+    d:
+    [
+      (d.meta.active or "true")
+      (d.meta.priority or 5)
+      (builtins.length d.outputs)
+    ]
+    ++ map (output: builtins.getAttr output d) d.outputs
+  ) derivations;
 
   # Building user environments remotely just causes huge amounts of
   # network traffic, so don't do that.
diff --git a/treefmt.toml b/treefmt.toml
index ff7d972be..0d8323d6e 100644
--- a/treefmt.toml
+++ b/treefmt.toml
@@ -1,5 +1,4 @@
-[formatter]
-# [formatter.nix]
-# command = "nixfmt"
-# includes = ["*.nix"]
-# excludes = ["tests/**"]
+[formatter.nix]
+command = "nixfmt"
+includes = ["*.nix"]
+excludes = ["tests/**"]