chore: Update nix version and bazel from 7 to 8.

Author: iphydf

.github/workflows/docker.yml

@@ -249,7 +249,7 @@ jobs:
       matrix:
         arch: [arm64, x86_64]
         macos: ["10.15", "12.0"]
-    runs-on: ${{ matrix.arch == 'arm64' && 'macos-14' || 'macos-13' }}
+    runs-on: ${{ matrix.arch == 'arm64' && 'macos-14' || 'macos-15-intel' }}
     permissions:
       contents: write
     steps:

bazel/Dockerfile

@@ -1,4 +1,4 @@
-FROM ghcr.io/toktok/bazel:wwv31rfsrkzy6lhra7d7apd2w8vh9zph AS base
+FROM ghcr.io/toktok/bazel:913b05c1lqrbd4ac130l6zvzy1bzhc7f AS base
 # Build the base image in a single layer instead of 100 as done by arion.
 FROM scratch
 # hadolint ignore=DL3022
@@ -7,8 +7,8 @@ COPY --from=base / /
 CMD ["/usr/sbin/init"]
 
 # We need to know where our bash is, because we haven't set up /bin/sh yet.
-ENV NIXOS_VERSION="a81bbdfb658428a45c69a42aa73d4bd18127c467"
-SHELL ["/nix/store/f33kh08pa7pmy4kvsmsibda46sh46s66-bash-interactive-5.2p37/bin/bash", "-o", "pipefail", "-c"]
+ENV NIXOS_VERSION="3a7affa77a5a539afa1c7859e2c31abdb1aeadf3"
+SHELL ["/nix/store/35yc81pz0q5yba14lxhn5r3jx5yg6c3l-bash-interactive-5.3p3/bin/bash", "-o", "pipefail", "-c"]
 
 # Run activation script (init knows where it is).
 RUN /usr/sbin/init || true

bazel/arion-compose.nix

@@ -19,7 +19,7 @@ in
           services.openssh.enable = true;
           services.nscd.enable = false;
 
-          system.stateVersion = "24.11";
+          system.stateVersion = "25.11";
           system.nssModules = lib.mkForce [ ];
 
           systemd.sockets.nix-daemon.enable = true;
@@ -31,12 +31,13 @@ in
           };
 
           environment.systemPackages = [
-            pkgs.bazel_7
+            pkgs.bazel_8
             pkgs.bazel-remote
             pkgs.coreutils
             pkgs.git
             # Needed because coursier (for Kotlin) requires that java is in $PATH.
             pkgs.jdk21_headless
+            pkgs.python311
           ];
 
           security.sudo.wheelNeedsPassword = false;

bazel/arion-pkgs.nix

@@ -1,7 +1,7 @@
 let
   nixpkgs = builtins.fetchTarball {
-    url = "https://github.com/NixOS/nixpkgs/archive/a81bbdfb658428a45c69a42aa73d4bd18127c467.tar.gz";
-    sha256 = "sha256:0vzjqdi39n7l43lzz2w6fv8p112iyj752x68gmjxw2y10cgk0352";
+    url = "https://github.com/NixOS/nixpkgs/archive/3a7affa77a5a539afa1c7859e2c31abdb1aeadf3.tar.gz";
+    sha256 = "sha256:0bzpgy08ym73g6z9wk3pmsbygv0kq46s6dfc7jwmrh3s5iwngrdf";
   };
 in
 (import nixpkgs { system = "x86_64-linux"; }).pkgs

bazel/build.sh

@@ -8,7 +8,7 @@ if ! which nix-shell; then
   sh install.sh --no-daemon --no-channel-add --yes
   rm install.sh
   . "$HOME/.nix-profile/etc/profile.d/nix.sh"
-  nix-channel --add https://github.com/NixOS/nixpkgs/archive/a81bbdfb658428a45c69a42aa73d4bd18127c467.tar.gz nixpkgs
+  nix-channel --add https://github.com/NixOS/nixpkgs/archive/3a7affa77a5a539afa1c7859e2c31abdb1aeadf3.tar.gz nixpkgs
   nix-channel --update
 fi
 

qtox/download/common.sh

@@ -25,7 +25,7 @@ check_sha256() {
 download_file() {
   # Curl command wrapper to download a file to the CWD
   local URL="$1"
-  curl -L --connect-timeout 10 -O "$URL"
+  curl -L -k --connect-timeout 10 -O "$URL"
 }
 
 download_verify_extract_tarball() {

qtox/download/download_mpfr.sh

@@ -7,7 +7,7 @@
 set -euo pipefail
 
 MPFR_VERSION=4.2.1
-MPFR_HASH=116715552bd966c85b417c424db1bbdf639f53836eb361549d1f8d6ded5cb4c6
+MPFR_HASH=ed8a128e1446e7cca92add1681a6431ba8c1a3250048c6c72648c1bafbe3e8d3
 
 source "$(dirname "$(realpath "$0")")/common.sh"