More string fixes

lib/generators.nix

@@ -606,12 +606,12 @@ in rec {
 
   in
   # TODO: As discussed in #356502, deprecated functionality should be removed sometime after 25.11.
-  lib.warnIf (!escape && lib.oldestSupportedReleaseIsAtLeast 2505) "Using `lib.generators.toPlist` without `escape = true` is deprecated"
-  ''<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-${expr "" v}
-</plist>'';
+  lib.warnIf (!escape && lib.oldestSupportedReleaseIsAtLeast 2505) "Using `lib.generators.toPlist` without `escape = true` is deprecated" ''
+  <?xml version="1.0" encoding="UTF-8"?>
+  <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+  <plist version="1.0">
+  ${expr "" v}
+  </plist>'';
 
   /**
     Translate a simple Nix expression to Dhall notation.

lib/lists.nix

@@ -1748,8 +1748,8 @@ rec {
     ```
     :::
   */
-  crossLists = warn
-    ''lib.crossLists is deprecated, use lib.mapCartesianProduct instead.
+  crossLists = warn ''
+    lib.crossLists is deprecated, use lib.mapCartesianProduct instead.
 
     For example, the following function call:
 

lib/meta.nix

@@ -475,7 +475,7 @@ rec {
       "lib.meta.getExe': The first argument is of type ${typeOf x}, but it should be a derivation instead.";
     assert assertMsg (isString y)
       "lib.meta.getExe': The second argument is of type ${typeOf y}, but it should be a string instead.";
-    assert assertMsg (match ".*\/.*" y == null)
+    assert assertMsg (match ".*/.*" y == null)
       "lib.meta.getExe': The second argument \"${y}\" is a nested path with a \"/\" character, but it should just be the name of the executable instead.";
     "${getBin x}/bin/${y}";
 }

lib/options.nix

@@ -426,7 +426,7 @@ rec {
     # If the part is a named placeholder of the form "<...>" don't escape it.
     # It may cause misleading escaping if somebody uses literally "<...>" in their option names.
     # This is the trade-off to allow for placeholders in option names.
-    isNamedPlaceholder = builtins.match "\<(.*)\>";
+    isNamedPlaceholder = builtins.match "<(.*)>";
     escapeOptionPart = part:
       if part == "*" || isNamedPlaceholder part != null
         then part

lib/tests/modules/strMatching-merge.nix

@@ -3,12 +3,12 @@
   imports = [
     {
       options.sm = lib.mkOption {
-        type = lib.types.strMatching "\(.*\)";
+        type = lib.types.strMatching "\\(.*\\)";
       };
     }
     {
       options.sm = lib.mkOption {
-        type = lib.types.strMatching "\(.*\)";
+        type = lib.types.strMatching "\\(.*\\)";
       };
     }
   ];

nixos/modules/hardware/video/nvidia.nix

@@ -17,7 +17,7 @@ let
   offloadCfg = pCfg.offload;
   reverseSyncCfg = pCfg.reverseSync;
   primeEnabled = syncCfg.enable || reverseSyncCfg.enable || offloadCfg.enable;
-  busIDType = lib.types.strMatching "([[:print:]]+[\:\@][0-9]{1,3}\:[0-9]{1,2}\:[0-9])?";
+  busIDType = lib.types.strMatching "([[:print:]]+[\\:\\@][0-9]{1,3}\\:[0-9]{1,2}\\:[0-9])?";
   ibtSupport = useOpenModules || (nvidia_x11.ibtSupport or false);
   settingsFormat = pkgs.formats.keyValue { };
 in

nixos/modules/hardware/wooting.nix

@@ -1,6 +1,7 @@
 { config, lib, pkgs, ... }:
 {
-  options.hardware.wooting.enable = lib.mkEnableOption ''support for Wooting keyboards.
+  options.hardware.wooting.enable = lib.mkEnableOption ''
+    support for Wooting keyboards.
     Note that users must be in the "input" group for udev rules to apply'';
 
   config = lib.mkIf config.hardware.wooting.enable {

nixos/modules/misc/version.nix

@@ -24,7 +24,7 @@ let
     ;
 
   needsEscaping = s: null != builtins.match "[a-zA-Z0-9]+" s;
-  escapeIfNecessary = s: if needsEscaping s then s else ''"${lib.escape [ "\$" "\"" "\\" "\`" ] s}"'';
+  escapeIfNecessary = s: if needsEscaping s then s else ''"${lib.escape [ "$" "\"" "\\" "`" ] s}"'';
   attrsToText =
     attrs:
     concatStringsSep "\n" (mapAttrsToList (n: v: ''${n}=${escapeIfNecessary (toString v)}'') attrs)

nixos/modules/services/backup/borgbackup.nix

@@ -106,7 +106,7 @@ let
       path =  [
         config.services.borgbackup.package pkgs.openssh
       ];
-      script = "exec " + lib.optionalString cfg.inhibitsSleep ''\
+      script = "exec " + lib.optionalString cfg.inhibitsSleep ''
         ${pkgs.systemd}/bin/systemd-inhibit \
             --who="borgbackup" \
             --what="sleep" \
@@ -183,7 +183,7 @@ let
       mode != "none" -> passCommand != null || passphrase != null;
     message =
       "passCommand or passphrase has to be specified because"
-      + '' borgbackup.jobs.${name}.encryption != "none"'';
+      + " borgbackup.jobs.${name}.encryption != \"none\"";
   };
 
   mkRepoService = name: cfg:

nixos/modules/services/cluster/kubernetes/apiserver.nix

@@ -320,7 +320,8 @@ in
           after = [ "network.target" ];
           serviceConfig = {
             Slice = "kubernetes.slice";
-            ExecStart = ''${top.package}/bin/kube-apiserver \
+            ExecStart = ''
+              ${top.package}/bin/kube-apiserver \
               --allow-privileged=${lib.boolToString cfg.allowPrivileged} \
               --authorization-mode=${lib.concatStringsSep "," cfg.authorizationMode} \
                 ${lib.optionalString (lib.elem "ABAC" cfg.authorizationMode)

nixos/modules/services/cluster/kubernetes/proxy.nix

@@ -65,7 +65,8 @@ in
       path = with pkgs; [ iptables conntrack-tools ];
       serviceConfig = {
         Slice = "kubernetes.slice";
-        ExecStart = ''${top.package}/bin/kube-proxy \
+        ExecStart = ''
+          ${top.package}/bin/kube-proxy \
           --bind-address=${cfg.bindAddress} \
           ${optionalString (top.clusterCidr!=null)
             "--cluster-cidr=${top.clusterCidr}"} \

nixos/modules/services/databases/redis.nix

@@ -211,7 +211,8 @@ in {
             masterAuth = lib.mkOption {
               type = with types; nullOr str;
               default = null;
-              description = ''If the master is password protected (using the requirePass configuration)
+              description = ''
+              If the master is password protected (using the requirePass configuration)
               it is possible to tell the slave to authenticate before starting the replication synchronization
               process, otherwise the master will refuse the slave request.
               (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)'';

nixos/modules/services/desktops/pipewire/wireplumber.nix

@@ -61,7 +61,8 @@ in
         # in sections.
         type = attrsOf (attrsOf json.type);
         default = { };
-        example = literalExpression ''{
+        example = literalExpression ''
+        {
           "log-level-debug" = {
             "context.properties" = {
               # Output Debug log messages as opposed to only the default level (Notice)
@@ -88,7 +89,8 @@ in
               }
             ];
           };
-        }'';
+        }
+        '';
         description = ''
           Additional configuration for the WirePlumber daemon when run in
           single-instance mode (the default in nixpkgs and currently the only
@@ -166,7 +168,8 @@ in
       configPackages = mkOption {
         type = listOf package;
         default = [ ];
-        example = literalExpression ''[
+        example = literalExpression ''
+        [
           (pkgs.writeTextDir "share/wireplumber/wireplumber.conf.d/10-bluez.conf" '''
             monitor.bluez.properties = {
               bluez5.roles = [ a2dp_sink a2dp_source bap_sink bap_source hsp_hs hsp_ag hfp_hf hfp_ag ]
@@ -175,7 +178,8 @@ in
               bluez5.hfphsp-backend = "native"
             }
           ''')
-        ]'';
+        ]
+        '';
         description = ''
           List of packages that provide WirePlumber configuration, in the form of
           `share/wireplumber/*/*.conf` files.

nixos/modules/services/mail/dovecot.nix

@@ -93,7 +93,7 @@ let
   # The idea is to match everything that looks like `$term =`
   # but not `# $term something something`
   # or `# $term = some value` because those are comments.
-  configContainsSetting = lines: term: (match "^[^#]*\b${term}\b.*=" lines) != null;
+  configContainsSetting = lines: term: (match "^[^#]*\\b${term}\\b.*=" lines) != null;
 
   warnAboutExtraConfigCollisions = map mkExtraConfigCollisionWarning (
     filter (configContainsSetting cfg.extraConfig) automaticallySetPluginSettings

nixos/modules/services/misc/gitlab.nix

@@ -1080,12 +1080,13 @@ in {
     warnings = [
       (mkIf
         (cfg.registry.enable && versionAtLeast (getVersion cfg.packages.gitlab) "16.0.0" && cfg.registry.package == pkgs.docker-distribution)
-        ''Support for container registries other than gitlab-container-registry has ended since GitLab 16.0.0 and is scheduled for removal in a future release.
+        ''
+          Support for container registries other than gitlab-container-registry has ended since GitLab 16.0.0 and is scheduled for removal in a future release.
           Please back up your data and migrate to the gitlab-container-registry package.''
       )
       (mkIf
-        (versionAtLeast (getVersion cfg.packages.gitlab) "16.2.0" && versionOlder (getVersion cfg.packages.gitlab) "16.5.0")
-        ''GitLab instances created or updated between versions [15.11.0, 15.11.2] have an incorrect database schema.
+        (versionAtLeast (getVersion cfg.packages.gitlab) "16.2.0" && versionOlder (getVersion cfg.packages.gitlab) "16.5.0") ''
+        GitLab instances created or updated between versions [15.11.0, 15.11.2] have an incorrect database schema.
         Check the upstream documentation for a workaround: https://docs.gitlab.com/ee/update/versions/gitlab_16_changes.html#undefined-column-error-upgrading-to-162-or-later''
       )
     ];

nixos/modules/services/misc/snapper.nix

@@ -36,7 +36,7 @@ let
   };
 
   intOrNumberOrRange = lib.types.either lib.types.ints.unsigned (
-    lib.types.strMatching "[[:digit:]]+(\-[[:digit:]]+)?"
+    lib.types.strMatching "[[:digit:]]+(\\-[[:digit:]]+)?"
     // {
       description = "string containing either a number or a range";
       descriptionClass = "conjunction";

nixos/modules/services/monitoring/prometheus/exporters/smokeping.nix

@@ -13,7 +13,7 @@ let
     name = "goDuration";
     description = "Go duration (https://golang.org/pkg/time/#ParseDuration)";
     check =
-      x: types.str.check x && builtins.match "(-?[0-9]+(\.[0-9]+)?(ns|us|µs|ms|s|m|h))+" x != null;
+      x: types.str.check x && builtins.match "(-?[0-9]+(\\.[0-9]+)?(ns|us|µs|ms|s|m|h))+" x != null;
     inherit (types.str) merge;
   };
 in

nixos/modules/services/network-filesystems/ceph.nix

@@ -42,8 +42,9 @@ let
       StateDirectory = stateDirectory;
       User = "ceph";
       Group = if daemonType == "osd" then "disk" else "ceph";
-      ExecStart = ''${ceph.out}/bin/${if daemonType == "rgw" then "radosgw" else "ceph-${daemonType}"} \
-                    -f --cluster ${clusterName} --id ${daemonId}'';
+      ExecStart = ''
+        ${ceph.out}/bin/${if daemonType == "rgw" then "radosgw" else "ceph-${daemonType}"} \
+        -f --cluster ${clusterName} --id ${daemonId}'';
     } // lib.optionalAttrs (daemonType == "osd") {
       ExecStartPre = "${ceph.lib}/libexec/ceph/ceph-osd-prestart.sh --id ${daemonId} --cluster ${clusterName}";
       RestartSec = "20s";

nixos/modules/services/networking/lxd-image-server.nix

@@ -105,19 +105,19 @@ in
             };
 
             # Serve json files with content type header application/json
-            "~ \.json$" = {
+            "~ \\.json$" = {
               extraConfig = ''
                 add_header Content-Type application/json;
               '';
             };
 
-            "~ \.tar.xz$" = {
+            "~ \\.tar.xz$" = {
               extraConfig = ''
                 add_header Content-Type application/octet-stream;
               '';
             };
 
-            "~ \.tar.gz$" = {
+            "~ \\.tar.gz$" = {
               extraConfig = ''
                 add_header Content-Type application/octet-stream;
               '';

nixos/modules/services/networking/smokeping.nix

@@ -119,7 +119,8 @@ in
               MAX  0.5 144   7200
               MIN  0.5 144   7200
         '';
-        description = ''Configure the ping frequency and retention of the rrd files.
+        description = ''
+          Configure the ping frequency and retention of the rrd files.
           Once set, changing the interval will require deletion or migration of all
           the collected data.'';
       };

nixos/modules/services/networking/tinyproxy.nix

@@ -33,14 +33,16 @@ in
       settings = mkOption {
         description = "Configuration for [tinyproxy](https://tinyproxy.github.io/).";
         default = { };
-        example = literalExpression ''{
+        example = literalExpression ''
+        {
           Port 8888;
           Listen 127.0.0.1;
           Timeout 600;
           Allow 127.0.0.1;
           Anonymous = ['"Host"' '"Authorization"'];
           ReversePath = '"/example/" "http://www.example.com/"';
-        }'';
+        }
+        '';
         type = types.submodule ({name, ...}: {
           freeformType = settingsFormat.type;
           options = {

nixos/modules/services/networking/wg-quick.nix

@@ -194,7 +194,8 @@ let
       allowedIPs = mkOption {
         example = [ "10.192.122.3/32" "10.192.124.1/24" ];
         type = with types; listOf str;
-        description = ''List of IP (v4 or v6) addresses with CIDR masks from
+        description = ''
+        List of IP (v4 or v6) addresses with CIDR masks from
         which this peer is allowed to send incoming traffic and to which
         outgoing traffic for this peer is directed. The catch-all 0.0.0.0/0 may
         be specified for matching all IPv4 addresses, and ::/0 may be specified
@@ -205,15 +206,17 @@ let
         default = null;
         example = "demo.wireguard.io:12913";
         type = with types; nullOr str;
-        description = ''Endpoint IP or hostname of the peer, followed by a colon,
+        description = ''
+        Endpoint IP or hostname of the peer, followed by a colon,
         and then a port number of the peer.'';
       };
 
       persistentKeepalive = mkOption {
         default = null;
         type = with types; nullOr int;
         example = 25;
-        description = ''This is optional and is by default off, because most
+        description = ''
+        This is optional and is by default off, because most
         users will not need it. It represents, in seconds, between 1 and 65535
         inclusive, how often to send an authenticated empty packet to the peer,
         for the purpose of keeping a stateful firewall or NAT mapping valid

nixos/modules/services/networking/wireguard.nix

@@ -127,7 +127,8 @@ let
         default = null;
         type = with types; nullOr str;
         example = "container";
-        description = ''The pre-existing network namespace in which the
+        description = ''
+        The pre-existing network namespace in which the
         WireGuard interface is created, and which retains the socket even if the
         interface is moved via {option}`interfaceNamespace`. When
         `null`, the interface is created in the init namespace.
@@ -139,7 +140,8 @@ let
         default = null;
         type = with types; nullOr str;
         example = "init";
-        description = ''The pre-existing network namespace the WireGuard
+        description = ''
+        The pre-existing network namespace the WireGuard
         interface is moved to. The special value `init` means
         the init namespace. When `null`, the interface is not
         moved.
@@ -262,7 +264,8 @@ let
       allowedIPs = mkOption {
         example = [ "10.192.122.3/32" "10.192.124.1/24" ];
         type = with types; listOf str;
-        description = ''List of IP (v4 or v6) addresses with CIDR masks from
+        description = ''
+        List of IP (v4 or v6) addresses with CIDR masks from
         which this peer is allowed to send incoming traffic and to which
         outgoing traffic for this peer is directed. The catch-all 0.0.0.0/0 may
         be specified for matching all IPv4 addresses, and ::/0 may be specified
@@ -328,7 +331,8 @@ let
         default = null;
         type = with types; nullOr int;
         example = 25;
-        description = ''This is optional and is by default off, because most
+        description = ''
+        This is optional and is by default off, because most
         users will not need it. It represents, in seconds, between 1 and 65535
         inclusive, how often to send an authenticated empty packet to the peer,
         for the purpose of keeping a stateful firewall or NAT mapping valid

nixos/modules/services/security/certmgr.nix

@@ -126,7 +126,7 @@ in
               service = mkOption {
                 type = nullOr str;
                 default = null;
-                description = "The service on which to perform \<action\> after fetching.";
+                description = "The service on which to perform \\<action\\> after fetching.";
               };
 
               action = mkOption {

nixos/modules/services/video/frigate.nix

@@ -403,7 +403,7 @@ in
               }
             '';
           };
-          "~* /api/.*\.(jpg|jpeg|png|webp|gif)$" = {
+          "~* /api/.*\\.(jpg|jpeg|png|webp|gif)$" = {
             proxyPass = "http://frigate-api";
             recommendedProxySettings = true;
             extraConfig = nginxAuthRequest + nginxProxySettings + ''

nixos/modules/services/web-apps/agorakit.nix

@@ -367,10 +367,10 @@ in
               index = "index.php";
               tryFiles = "$uri $uri/ /index.php?$query_string";
             };
-            "~ \.php$".extraConfig = ''
+            "~ \\.php$".extraConfig = ''
               fastcgi_pass unix:${config.services.phpfpm.pools."agorakit".socket};
             '';
-            "~ \.(js|css|gif|png|ico|jpg|jpeg)$" = {
+            "~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
               extraConfig = "expires 365d;";
             };
           };

nixos/modules/services/web-apps/castopod.nix

@@ -328,7 +328,7 @@ in
           '';
         };
 
-        locations."~ \.php$" = {
+        locations."~ \\.php$" = {
           fastcgiParams = {
             SERVER_NAME = "$host";
           };