flake.lock: update

configs/hw/signed-kmods.nix

@@ -0,0 +1,59 @@
+# Out-of-tree kernel modules installed through the kernel's modules_install,
+# imported (not as a module) by the hardware configs that load them.
+#
+# Since NixOS/nixpkgs#571181 the kernel signs modules deterministically and
+# the module aggregator (pkgs/os-specific/linux/kmod/aggregator.nix) expects
+# a <module>.ko.cer next to every out-of-tree module. modules_install writes
+# it; these packages' own installPhase copies the bare .ko, so the system
+# build fails with "cat: ...ko.cer: No such file or directory".
+#
+# Drop each entry once nixpkgs installs it that way:
+# - acpi_call: NixOS/nixpkgs#575394
+# - framework-laptop-kmod: NixOS/nixpkgs#575818 (merged)
+# - tp_smapi: no upstream fix yet
+{ lib, kernelPackages }:
+let
+  inherit (kernelPackages) kernel kernelModuleMakeFlags;
+  modulesInstallFlags = dir: [
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+    "INSTALL_MOD_DIR=${dir}"
+    "DEPMOD=true"
+  ];
+in
+{
+  # As in NixOS/nixpkgs#575394: its Makefile's install target runs
+  # modules_install.
+  acpi_call = kernelPackages.acpi_call.overrideAttrs (old: {
+    makeFlags = old.makeFlags ++ modulesInstallFlags "misc";
+    installPhase = null;
+    postInstall = ''
+      install -D -m755 examples/turn_off_gpu.sh $out/bin/test_discrete_video_off.sh
+    '';
+  });
+
+  # As in NixOS/nixpkgs#575818.
+  framework-laptop-kmod = kernelPackages.framework-laptop-kmod.overrideAttrs (old: {
+    makeFlags = old.makeFlags ++ modulesInstallFlags "extra";
+    installPhase = null;
+    installTargets = [ "modules_install" ];
+  });
+
+  # Same place as before. hdaps.ko keeps its old file name hdapsd.ko:
+  # modprobe goes by file name, so it doesn't shadow the in-tree hdaps
+  # driver.
+  tp_smapi = kernelPackages.tp_smapi.overrideAttrs {
+    installPhase = ''
+      runHook preInstall
+
+      make -C ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build M="$PWD" \
+        ${lib.escapeShellArgs (kernelModuleMakeFlags ++ modulesInstallFlags "kernel/drivers/firmware")} \
+        modules_install
+      cd $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/firmware
+      for f in hdaps.ko*; do
+        mv "$f" "hdapsd''${f#hdaps}"
+      done
+
+      runHook postInstall
+    '';
+  };
+}

configs/hw/x220.nix

@@ -4,6 +4,12 @@
   pkgs,
   ...
 }:
+let
+  kmods = import ./signed-kmods.nix {
+    inherit lib;
+    inherit (config.boot) kernelPackages;
+  };
+in
 {
   # Hardware configuration from krebs/stockholm x220.nix, with updated package names
   networking.wireless.enable = lib.mkDefault true;
@@ -30,8 +36,8 @@
       "usb_storage"
     ];
     extraModulePackages = [
-      config.boot.kernelPackages.tp_smapi
-      config.boot.kernelPackages.acpi_call
+      kmods.tp_smapi
+      kmods.acpi_call
     ];
     kernelModules = [
       "kvm-intel"

configs/monitoring/agent.nix

@@ -5,6 +5,7 @@
   config,
   lib,
   pkgs,
+  self,
   ...
 }:
 let
@@ -67,6 +68,7 @@ in
   config.services.vector = {
     enable = true;
     journaldAccess = true;
+    package = self.packages.${pkgs.stdenv.hostPlatform.system}.vector;
     settings = {
       data_dir = "/var/lib/vector";
 

configs/orca/server.nix

@@ -33,7 +33,7 @@ in
     ];
     packages = [
       orca
-      self.packages.${pkgs.system}.omp
+      pkgs.omp
       # GitHub issues/PRs in the work item lists.
       pkgs.gh
     ];

configs/services/radio/tts.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, self, ... }:
 let
   model = pkgs.runCommand "model" { } ''
     mkdir -p $out
@@ -31,7 +31,7 @@ let
       fi
       filename=$(printf '%04d' $offset).wav
       echo "$line" |
-        ${pkgs.piper-tts}/bin/piper \
+        ${self.packages.${pkgs.stdenv.hostPlatform.system}.piper-tts}/bin/piper \
           --model ${model}/model.onnx \
           -s "$SPEAKER" \
           -f "$OUTPUT"/"$filename" >/dev/null

machines/barnacle/configuration.nix

@@ -26,7 +26,7 @@
     self.packages.${pkgs.system}.s
 
     self.packages.${pkgs.system}.secretive
-    self.packages.${pkgs.system}.omp
+    pkgs.omp
     self.packages.${pkgs.system}.browser-mcp
 
     # zsh dependencies

machines/coaxmetal/hermes.nix

@@ -36,7 +36,7 @@ let
   # Contract: hermes writes the reply text to $1 and expects audio at $2.
   hermes-tts = pkgs.writeShellApplication {
     name = "hermes-tts";
-    runtimeInputs = [ pkgs.piper-tts ];
+    runtimeInputs = [ self.packages.${pkgs.stdenv.hostPlatform.system}.piper-tts ];
     text = ''
       piper --model ${piperVoice}/model.onnx --output-file "$2" < "$1"
     '';

machines/daedalus/config.nix

@@ -1,4 +1,5 @@
 {
+  self,
   lib,
   pkgs,
   ...
@@ -43,7 +44,7 @@
         chromium
         networkmanagerapplet
         libreoffice
-        audacity
+        self.packages.${pkgs.stdenv.hostPlatform.system}.audacity
         zathura
         wine
         vlc

machines/daedalus/physical.nix

@@ -1,4 +1,10 @@
-{ config, ... }:
+{ config, lib, ... }:
+let
+  kmods = import ../../configs/hw/signed-kmods.nix {
+    inherit lib;
+    inherit (config.boot) kernelPackages;
+  };
+in
 {
   imports = [
     ./config.nix
@@ -48,8 +54,8 @@
       "usb_storage"
     ];
     extraModulePackages = [
-      config.boot.kernelPackages.tp_smapi
-      config.boot.kernelPackages.acpi_call
+      kmods.tp_smapi
+      kmods.acpi_call
     ];
     kernelModules = [
       "acpi_call"

machines/ignavia/physical.nix

@@ -1,5 +1,7 @@
 {
   self,
+  config,
+  lib,
   modulesPath,
   pkgs,
   ...
@@ -41,8 +43,23 @@
 
   hardware.graphics.enable = true;
   hardware.acpilight.enable = true;
-  # DDC/CI: expose /dev/i2c-* so ddcutil can drive external monitor brightness
-  boot.kernelModules = [ "i2c-dev" ];
+  boot.kernelModules = [
+    # DDC/CI: expose /dev/i2c-* so ddcutil can drive external monitor brightness
+    "i2c-dev"
+    # what hardware.framework.enableKmod loads, see below
+    "cros_ec"
+    "cros_ec_lpcs"
+  ];
+
+  # nixos-hardware's framework-laptop-kmod lacks the module certificate the
+  # module aggregator needs, see configs/hw/signed-kmods.nix.
+  hardware.framework.enableKmod = false;
+  boot.extraModulePackages = [
+    (import ../../configs/hw/signed-kmods.nix {
+      inherit lib;
+      inherit (config.boot) kernelPackages;
+    }).framework-laptop-kmod
+  ];
 
   # Use latest kernel for better Strix Point GPU support. The MT7925 BT init
   # regression fix (e3ac0d9f1a20) landed upstream in 7.0.10.