From d9b371fe3936c66e9f74f693263f33176c40a38e Mon Sep 17 00:00:00 2001 From: "Julien DAUPHANT (DINUM)" Date: Mon, 31 Aug 2026 12:12:08 +0200 Subject: [PATCH 1/4] fix: Add git as a runtime input for upgrade script (#251) --- modules/updates/permissionless-upgrade.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modules/updates/permissionless-upgrade.nix b/modules/updates/permissionless-upgrade.nix index f30bf8bc..44165afa 100644 --- a/modules/updates/permissionless-upgrade.nix +++ b/modules/updates/permissionless-upgrade.nix @@ -210,6 +210,8 @@ let upgradeScript = pkgs.writeShellApplication { name = "upgrade"; + runtimeInputs = [ pkgs.git ]; + text = '' # Ensure the script runs as root if [ "$(id -u)" -ne 0 ]; then From 9952f04941fd0ac92a071d0f674bea429b3f0b8a Mon Sep 17 00:00:00 2001 From: Pamplemousse Date: Mon, 31 Aug 2026 16:21:44 +0200 Subject: [PATCH 2/4] Improve documentation a little bit (#242) * doc: Add high level description * doc: Add references to ecosystem documentation --- docs/manual/book.toml | 3 ++- docs/manual/src/SUMMARY.md | 4 ++++ docs/manual/src/about/securix.md | 4 +++- docs/manual/src/external/links.md | 14 ++++++++++++++ 4 files changed, 23 insertions(+), 2 deletions(-) create mode 100644 docs/manual/src/external/links.md diff --git a/docs/manual/book.toml b/docs/manual/book.toml index 17076642..a6c74475 100644 --- a/docs/manual/book.toml +++ b/docs/manual/book.toml @@ -1,9 +1,10 @@ # SPDX-FileCopyrightText: 2026 Ryan Lahfa +# SPDX-FileContributor: 2026 Xavier Maso # # SPDX-License-Identifier: CC-BY-SA-4.0 [book] -authors = ["Ryan Lahfa"] +authors = ["Ryan Lahfa", "Xavier Maso"] language = "en" src = "src" title = "Sécurix" diff --git a/docs/manual/src/SUMMARY.md b/docs/manual/src/SUMMARY.md index f4aff2eb..54fe88fe 100644 --- a/docs/manual/src/SUMMARY.md +++ b/docs/manual/src/SUMMARY.md @@ -44,3 +44,7 @@ SPDX-License-Identifier: CC-BY-SA-4.0 - [Secure Boot]() - [ANSSI compliance]() - [Security key user logins]() + +# External references + +- [Resources](./external/links.md) diff --git a/docs/manual/src/about/securix.md b/docs/manual/src/about/securix.md index e7a43614..63d072f1 100644 --- a/docs/manual/src/about/securix.md +++ b/docs/manual/src/about/securix.md @@ -1,9 +1,11 @@ # What is Sécurix? - +An operating system developped at [DINUM](https://www.numerique.gouv.fr/), primarily for internal use, for building workstation environments that are declarative, reproducible, and secure by default. +Based on [`NixOS`](https://nixos.org/), it allows to write configuration as code for defining users, programs, services, configurations, and more. diff --git a/docs/manual/src/external/links.md b/docs/manual/src/external/links.md new file mode 100644 index 00000000..305a47dc --- /dev/null +++ b/docs/manual/src/external/links.md @@ -0,0 +1,14 @@ + + +# Resources + +- [nix.dev](https://nix.dev/) a good starting point into the `Nix`/`Lix` and `NixOS` ecosystem +- Manuals + - [`Nixos`](https://nixos.org/manual/nixos/stable/), and particularly the [module development section](https://nixos.org/manual/nixos/stable/#sec-writing-modules) + - [`Nix`](https://nix.dev/manual/nix/2.34/)/[`Lix`](https://docs.lix.systems/manual/lix/stable/) for commands and some implementation details + - [`nixpkgs`](https://nixos.org/manual/nixpkgs/stable/) regarding writing expressions for building packages +- [the **official** wiki](https://wiki.nixos.org) has some interesting tips in niche topics, but of very mixed quality and up-to-date-ness From 2624026b76cde77bc8568408272597071d2b09b7 Mon Sep 17 00:00:00 2001 From: Titouan Heyrendt Date: Thu, 27 Aug 2026 18:24:06 +0200 Subject: [PATCH 3/4] tests/tools: set inventoryId so the hostname matches the QEMU node name --- tests/tools.nix | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/tests/tools.nix b/tests/tools.nix index ab25b346..e1a6fa11 100644 --- a/tests/tools.nix +++ b/tests/tools.nix @@ -8,6 +8,7 @@ let { name, serialNumber, + inventoryId, extraSecurixConfig, }: { @@ -21,7 +22,7 @@ let self = { mainDisk = "/dev/nvme0n1"; machine = { - inherit serialNumber; + inherit serialNumber inventoryId; hardwareSKU = "x280"; }; }; @@ -34,6 +35,7 @@ let terminal-with-tools = libSecurix.mkTerminal (terminalWith { name = "tools"; serialNumber = "000000"; + inventoryId = 0; extraSecurixConfig = { tools.enable = true; }; @@ -41,22 +43,23 @@ let terminal-without-tools = libSecurix.mkTerminal (terminalWith { name = "tools"; serialNumber = "000001"; + inventoryId = 1; extraSecurixConfig = { }; }); in pkgs.testers.nixosTest { name = "tools"; nodes = { - securix-unbranded-000000 = { + securix-unbranded-0 = { imports = terminal-with-tools.modules; }; - securix-unbranded-000001 = { + securix-unbranded-1 = { imports = terminal-without-tools.modules; }; }; testScript = '' - securix_with_tools = securix_unbranded_000000 - securix_without_tools = securix_unbranded_000001 + securix_with_tools = securix_unbranded_0 + securix_without_tools = securix_unbranded_1 securix_with_tools.wait_for_unit("default.target") securix_without_tools.wait_for_unit("default.target") From fe028dcf61cf23e24e814b647954dce976720cb2 Mon Sep 17 00:00:00 2001 From: T2an Date: Mon, 31 Aug 2026 21:45:16 +0200 Subject: [PATCH 4/4] tests/tools: exercise both branches of machineIdentifier terminal-without-tools no longer sets inventoryId, so it falls back to the hash-of-serialNumber path in modules/self.nix instead of the inventoryId path already covered by terminal-with-tools. The node name is derived with the same hash function so it stays in sync if that logic changes. --- tests/tools.nix | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/tests/tools.nix b/tests/tools.nix index e1a6fa11..f5bb6f38 100644 --- a/tests/tools.nix +++ b/tests/tools.nix @@ -8,7 +8,7 @@ let { name, serialNumber, - inventoryId, + inventoryId ? null, extraSecurixConfig, }: { @@ -43,7 +43,6 @@ let terminal-without-tools = libSecurix.mkTerminal (terminalWith { name = "tools"; serialNumber = "000001"; - inventoryId = 1; extraSecurixConfig = { }; }); in @@ -53,13 +52,13 @@ pkgs.testers.nixosTest { securix-unbranded-0 = { imports = terminal-with-tools.modules; }; - securix-unbranded-1 = { + "securix-unbranded-${builtins.substring 0 12 (builtins.hashString "sha256" "000001")}" = { imports = terminal-without-tools.modules; }; }; testScript = '' securix_with_tools = securix_unbranded_0 - securix_without_tools = securix_unbranded_1 + securix_without_tools = securix_unbranded_${builtins.substring 0 12 (builtins.hashString "sha256" "000001")} securix_with_tools.wait_for_unit("default.target") securix_without_tools.wait_for_unit("default.target")