fix: rebase with develop

Author: Manuthor

nix/kms-server.nix

@@ -23,21 +23,29 @@ let
   #   - fips.darwin.sha256 | fips.linux.sha256 (fallback by OS)
   #   - fips.sha256                  (global fallback, typically Linux)
   # Same naming for non-fips.* files.
-  expectedHashFile = base: let
-    sys = pkgs.stdenv.hostPlatform.system;
-    dir = toString ./expected-hashes;
-    candidates = lib.filter (s: s != null) [
-      "${dir}/${base}.${sys}.sha256"
-      (if pkgs.stdenv.isDarwin then "${dir}/${base}.darwin.sha256" else null)
-      (if pkgs.stdenv.isLinux then "${dir}/${base}.linux.sha256" else null)
-    ];
-    firstExisting = lib.findFirst (p: builtins.pathExists (builtins.toPath p)) null candidates;
-    finalPath = if firstExisting != null then firstExisting else "${dir}/${base}.sha256";
-  in builtins.readFile (builtins.toPath finalPath);
+  expectedHashFile =
+    base:
+    let
+      sys = pkgs.stdenv.hostPlatform.system;
+      dir = toString ./expected-hashes;
+      candidates = lib.filter (s: s != null) [
+        "${dir}/${base}.${sys}.sha256"
+        (if pkgs.stdenv.isDarwin then "${dir}/${base}.darwin.sha256" else null)
+        (if pkgs.stdenv.isLinux then "${dir}/${base}.linux.sha256" else null)
+      ];
+      firstExisting = lib.findFirst (p: builtins.pathExists (builtins.toPath p)) null candidates;
+      finalPath = if firstExisting != null then firstExisting else "${dir}/${base}.sha256";
+    in
+    builtins.readFile (builtins.toPath finalPath);
 
   expectedHashFipsRaw = expectedHashFile "fips";
   expectedHashNonFipsRaw = expectedHashFile "non-fips";
-  sanitizeHash = s: let noWS = lib.replaceStrings ["\n" "\r" " " "\t"] ["" "" "" ""] s; in lib.strings.removeSuffix "\n" noWS;
+  sanitizeHash =
+    s:
+    let
+      noWS = lib.replaceStrings [ "\n" "\r" " " "\t" ] [ "" "" "" "" ] s;
+    in
+    lib.strings.removeSuffix "\n" noWS;
   expectedHashFips = sanitizeHash expectedHashFipsRaw;
   expectedHashNonFips = sanitizeHash expectedHashNonFipsRaw;
   expectedHash = if isFips then expectedHashFips else expectedHashNonFips;
@@ -162,14 +170,15 @@ rustPlatform.buildRustPackage rec {
   # - Single codegen unit for stable ordering
   # - Disable linker build-id which otherwise embeds a random-ish identifier
   # - Keep our dynamic linker override handled in buildPhase (per-arch)
-  RUSTFLAGS = lib.optionalString pkgs.stdenv.isLinux
-    (lib.concatStringsSep " " [
+  RUSTFLAGS = lib.optionalString pkgs.stdenv.isLinux (
+    lib.concatStringsSep " " [
       "-Cdebuginfo=0"
       "-Ccodegen-units=1"
       "-Cincremental=false"
       # "-Clto=off"
       "-C link-arg=-Wl,--build-id=none"
-    ]);
+    ]
+  );
 
   # Prevent Nix from injecting RPATHs to /nix/store into the resulting binary.
   # This ensures the packaged binary will not try to load glibc from the store