flake.nix: upgrade to nixos-23.11

This also bypasses the Objective-C fork safety during tests.

Change-Id: I92bf9f911e8a1fbd32eae13255f9a9dabde40b21

1 files changed, 13 insertions, 12 deletions

diff --git a/flake.nix b/flake.nix
index 3e5e83b3e..76e8ecf9a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,7 +1,7 @@
 {
   description = "The purely functional package manager";
 
-  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.05-small";
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.11-small";
   inputs.nixpkgs-regression.url = "github:NixOS/nixpkgs/215d4d0fd80ca5163643b03a33fde804a29cc1e2";
   inputs.flake-compat = { url = "github:edolstra/flake-compat"; flake = false; };
 
@@ -9,6 +9,7 @@
 
     let
       inherit (nixpkgs) lib;
+      inherit (lib) fileset;
 
       officialRelease = true;
 
@@ -47,14 +48,6 @@
             })
             stdenvs);
 
-      # Experimental fileset library: https://github.com/NixOS/nixpkgs/pull/222981
-      # Not an "idiomatic" flake input because:
-      #  - Propagation to dependent locks: https://github.com/NixOS/nix/issues/7730
-      #  - Subflake would download redundant and huge parent flake
-      #  - No git tree hash support: https://github.com/NixOS/nix/issues/6044
-      inherit (import (builtins.fetchTarball { url = "https://github.com/NixOS/nix/archive/1bdcd7fc8a6a40b2e805bad759b36e64e911036b.tar.gz"; sha256 = "sha256:14ljlpdsp4x7h1fkhbmc4bd3vsqnx8zdql4h3037wh09ad6a0893"; }))
-        fileset;
-
       baseFiles =
         # .gitignore has already been processed, so any changes in it are irrelevant
         # at this point. It is not represented verbatim for test purposes because
@@ -84,7 +77,7 @@
 
       nixSrc = fileset.toSource {
         root = ./.;
-        fileset = fileset.intersect baseFiles (fileset.unions [
+        fileset = fileset.intersection baseFiles (fileset.unions [
           configureFiles
           topLevelBuildFiles
           ./boehmgc-coroutine-sp-fallback.diff
@@ -114,6 +107,8 @@
             overlays = [
               (overlayFor (p: p.${stdenv}))
             ];
+
+            config.permittedInsecurePackages = [ "nix-2.13.6" ];
           };
           stdenvs = forAllStdenvs (make-pkgs null);
           native = stdenvs.stdenvPackages;
@@ -284,7 +279,7 @@
 
         src = fileset.toSource {
           root = ./.;
-          fileset = fileset.intersect baseFiles (fileset.unions [
+          fileset = fileset.intersection baseFiles (fileset.unions [
             configureFiles
             topLevelBuildFiles
             functionalTestFiles
@@ -309,7 +304,9 @@
           mkdir -p $out
         '';
 
-        installCheckPhase = ''
+        installCheckPhase = (optionalString pkgs.stdenv.hostPlatform.isDarwin ''
+          export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES
+        '') + ''
           mkdir -p src/nix-channel
           make installcheck -j$NIX_BUILD_CORES -l$NIX_BUILD_CORES
         '';
@@ -476,6 +473,10 @@
             installCheckFlags = "sysconfdir=$(out)/etc";
             installCheckTarget = "installcheck"; # work around buggy detection in stdenv
 
+            preInstallCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+              export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES
+            '';
+
             separateDebugInfo = !currentStdenv.hostPlatform.isStatic;
 
             strictDeps = true;