nix: update mkosi to v25.3 (#3726)

* nix: update mkosi to v25.3

* bazel: 7.4.1 -> 7.6.0

.bazelversion

@@ -1 +1 @@
-7.4.1
+7.6.0

MODULE.bazel.lock

@@ -1,5 +1,5 @@
 {
-  "lockFileVersion": 11,
+  "lockFileVersion": 13,
   "registryFileHashes": {
     "https://bcr.bazel.build/bazel_registry.json": "8a28e4aff06ee60aed2a8c281907fb8bcbf3b753c91fb5a5c57da3215d5b3497",
     "https://bcr.bazel.build/modules/abseil-cpp/20210324.2/MODULE.bazel": "7cd0312e064fde87c8d1cd79ba06c876bd23630c83466e9500321be55c96ace2",
@@ -565,7 +565,7 @@
     },
     "@@rules_python~//python/extensions:pip.bzl%pip": {
       "general": {
-        "bzlTransitiveDigest": "oxG8ogxHEbtSCgVhCDBRrjiTlucxn15T4guZ4/etTgo=",
+        "bzlTransitiveDigest": "t2sNZ+esCBM7KBCD9MlBA5Y3Yk5SQj8V+JMUGkiANSM=",
         "usagesDigest": "lABgNFDx2B8eu1/8FW60KMkCqsChEDxlIL/ERa0nIFc=",
         "recordedFileInputs": {
           "@@rules_python~//tools/publish/requirements_linux.txt": "d576e0d8542df61396a9b38deeaa183c24135ed5e8e73bb9622f298f2671811e",
@@ -3352,7 +3352,13 @@
             }
           }
         },
-        "recordedRepoMappingEntries": []
+        "recordedRepoMappingEntries": [
+          [
+            "rules_python~",
+            "platforms",
+            "platforms"
+          ]
+        ]
       }
     }
   }

flake.lock

@@ -20,11 +20,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1743689281,
-        "narHash": "sha256-y7Hg5lwWhEOgflEHRfzSH96BOt26LaYfrYWzZ+VoVdg=",
+        "lastModified": 1743938762,
+        "narHash": "sha256-UgFYn8sGv9B8PoFpUfCa43CjMZBl1x/ShQhRDHBFQdI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2bfc080955153be0be56724be6fa5477b4eefabb",
+        "rev": "74a40410369a1c35ee09b8a1abee6f4acbedc059",
         "type": "github"
       },
       "original": {

flake.nix

@@ -19,6 +19,33 @@
     flake-utils.lib.eachDefaultSystem (
       system:
       let
+        overlay = final: prev: {
+          rpm = prev.rpm.overrideAttrs (old: {
+            nativeBuildInputs = old.nativeBuildInputs ++ [ prev.makeWrapper ];
+            postFixup = ''
+              wrapProgram $out/lib/rpm/sysusers.sh \
+                --set PATH ${
+                  prev.lib.makeBinPath (
+                    with prev;
+                    [
+                      coreutils
+                      findutils
+                      su.out
+                      gnugrep
+                    ]
+                  )
+                }
+            '';
+          });
+
+          # dnf5 assumes a TTY with a very small width by default, truncating its output instead of line-wrapping
+          # it. Force it to use more VT columns to avoid this, and make debugging errors easier.
+          dnf5-stub = prev.writeScriptBin "dnf5" ''
+            #!/usr/bin/env bash
+            FORCE_COLUMNS=200 ${final.dnf5}/bin/dnf5 $@
+          '';
+        };
+
         pkgs = import nixpkgs {
           inherit system;
           config.allowUnfree = true;
@@ -26,18 +53,19 @@
           overlays = [
             (_final: prev: (import ./nix/packages { inherit (prev) lib callPackage; }))
             (_final: prev: { lib = prev.lib // (import ./nix/lib { inherit (prev) lib callPackage; }); })
+            overlay
           ];
         };
 
         callPackage = pkgs.callPackage;
 
         mkosiDev = (
-          pkgs.mkosi.overrideAttrs (oldAttrs: {
-            propagatedBuildInputs =
-              oldAttrs.propagatedBuildInputs
-              ++ (with pkgs; [
+          pkgs.mkosi.override {
+            extraDeps = (
+              with pkgs;
+              [
                 # package management
-                dnf5
+                dnf5-stub
                 rpm
                 createrepo_c
 
@@ -55,8 +83,9 @@
                 # utils
                 gnused # sed
                 gnugrep # grep
-              ]);
-          })
+              ]
+            );
+          }
         );
       in
       {