- `git push --tags` is too dangerous (pushes all your tags)

Build-tested the changes packages.

May be more that can be cleaned up.

setup.sh adds a bunch of variables that only it needs. To avoid
polluting environments, we should unset these as soon as we are done
with them.

Openvswitch was upgraded to the latest
stable version (currenty 2.12.0). This remove ovs-monitor-ipsec
commands.

LTS version is still available using
`config.virtualisation.vswitch.package = pkgs.openvswitch-lts`
it has been upgraded to 2.5.6.

This commit is a split from the original PR #35127.

Semi-automatic update generated by
https://github.com/ryantm/nixpkgs-update tools. This update was made
based on information from
https://repology.org/metapackage/phonon-qt5/versions

It's been a very long time, so I think a merge will be better than
a rebase.  There was only one simple conflict.

https://www.sudo.ws/stable.html#1.8.29

Build tweak: fix build failure when attempting to check that
the "existing" sudoers file on $out/etc/sudoers parses clean--
this update changed precondition for this test to check if
DESTDIR is non-empty instead of previous behavior
"does the file exist".

Explicitly handle `dont*` and friends not being defined.

Same justification as previous commit.

Go beyond the obvious setup hooks now, with a bit of sed, with a skipped case:

 - cc-wrapper's `dontlink`, because it already is handled.

Also, in nix files escaping was manually added.

EMP

If these aren't defined, the stdenv defaults are used in the `*Phase`
case, or no extra phases are done, in the `*Phases` case.

For the case of blkfront drives, there appears to be no difference
between /dev/sda1 and /dev/xvda: the drive always appears as the
kernel device /dev/xvda.

For the case of nvme drives, the root device typically appears as
/dev/nvme0n1.  Amazon provides the 'ec2-utils' package for their first
party linux ("Amazon Linux"), which configures udev to create symlinks
from the provided name to the nvme device name. This name is
communicated through nvme "Identify Controller" response, which can be
inspected with:

  nvme id-ctrl --raw-binary /dev/nvme0n1 | cut -c3073-3104 | hexdump -C

On Amazon Linux, where the device is attached as "/dev/xvda", this
creates:

- /dev/xvda  -> nvme0n1
- /dev/xvda1 -> nvme0n1p1

On NixOS where the device is attach as "/dev/sda1", this creates:

- /dev/sda1  -> nvme0n1
- /dev/sda11 -> nvme0n1p1

This is odd, but not inherently a problem.

NixOS unconditionally configures grub to install to `/dev/xvda`, which
fails on an instance using nvme storage. With the root device name set
to xvda, both blkfront and nvme drives are accessible as /dev/xvda,
either directly or by symlink.

Before, we very carefully unapplied and reapplied `set -u` so the rest
of Nixpkgs could continue to not fail on undefined variables. Let's rip
off the band-aid.

Basically a flavour of gnugpg, which solely containts `bin/gnupg`.

Adding `systemd-importd` to the build, so that `machinectl`s `import-.*`
may actually do anything. Currently they fail with

```
Failed to transfer image: The name org.freedesktop.import1 was not provided by any .service files
```
as `systemd-importd` is not built. Also registers the regarding dbus
api and service in the systemd module.

My earlier sed missed this because it already had `{..}`.

This adds a test downloading an nspawn container via http, and ensures
sha256sum verification and gpg signature verification work.

Fixes #72330

Upstream MR: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/merge_requests/323

I noticed while strace-ing that Git was trying to open
/etc//gitconfig.  Not a big deal, but it is definitely more correct
without the trailing slash.

git: drop extraneous sysconfdir trailing slash

Instead of assign the libinput options to touchpad devices only, it
should be appied by any device using libinput.
Due to the fact that `40-libinput.conf` already defines libinput as
driver for any detected input device, we can use `MatchDriver` to appy
options.

I don't want to just rebase this away because the original commit is
also in #72074.

treewide: `set -u` everywhere

sudo: 1.8.28 -> 1.8.29

systemd: add systemd-importd