glibc-libre and other restorations of functionality

Glibc-libre is your NixOS glibc, but with /etc/ld.so.conf and /etc/ld.so.cache enabled.^[1] Glibc-libre will also cache its own shared libraries, without any need to list them in /etc/ld.so.conf.

To get glibc-libre, place these scripts and the glibc-helper-files subdirectory in your Nix configuration directory (such as /etc/nixos). Make the scripts executable. You can run update-glibc-libre with a command like [source,sh]

./update-glibc-libre nixos-25.05

or

./update-glibc-libre -r 385bc60542f26c384d8fa17585e6447f1aa54fbf

This will create a subdirectory called glibc-libre, and a depth-one git repository at /var/tmp/glibc-libre/nixpkgs.

In the subdirectory there should be a copy of glibc package from the git repository. There should also be two Nix scripts. Import the libre-configuration.nix script with something like the following:

imports = [
  ./glibc-libre/libre-configuration.nix
];

You may also wish to edit and include the libre-etc-config.example.nix script, or use it as a guide.

Whether to edit /etc/ld.so.conf directly or from your Nix configuration, or to create it by some other means, is of course up to you.

Any of the glibc ldconfig executables on NixOS can be used, if you employ command line switches to say where /etc/ld.so.conf and /etc/ld.so.cache are. Glibc-libre, however, comes with a repaired ldconfig executable, which does not require command line switches. You will find it in any of the following places:

${pkgs.libre.bin}/bin/ldconfig
${pkgs.libre.bin}/bin/ldconfig-libre
${pkgs.libre.ldconfig}/bin/ldconfig
${pkgs.libre.ldconfig_libre}/bin/ldconfig-libre

NixOS has a way of putting an undesired executable ahead in your path, so persevere until you get it the way you want. Then become angry when it gets messed up again, but again fix it. Do not let Nixonian OS design stop you from fixing it.

If you created your /var/tmp/glibc-libre/nixpkgs repository with a command such as

./update-glibc-libre nixos-25.05

you can henceforth run simply

./update-glibc-libre

to bring your glibc-libre up to date.

---

So what are the other scripts?

They are for other NixOS packages you might wish to fix. The scripts for them are similar to those for glibc-libre, but I have not yet documented them as fully.

So far there are:

update-libxcrypt-static

To build a static libcrypt.a, otherwise the same as the dynamic libcrypt.so.

update-doas-that-does

To build a static doas executable that is itself setuid root, rather than wrapped. The static executable can be copied freely and put on removable media. The new package also removes a NixOS patch that introduces a serious bug in the ‘safepath’. To use update-doas-that-does, you must also use update-libxcrypt-static.

update-restoration-of-functionality

To run the scripts that are listed in the file restoration-of-functionality.

---

1. Almost the only thing necessary is not to apply a NixOS patch whose only purpose is to take caching away from you. Anyone can disable caching for themself with chmod a-x ldconfig, but that move is inadequate to impose the disability on everyone else.