NixOS 17.03: Backward Incompatibilities and Other Notable Changes (Continued)

- `local_recipient_maps` is not set to empty value by Postfix service. It's an insecure default as stated by Postfix documentation. Those who want to retain this setting need to set it via `services.postfix.extraConfig`. - Iputils no longer provide ping6 and traceroute6. The functionality of these tools has been integrated into ping and traceroute respectively. To enforce an address family the new flags `-4` and `-6` have been added. One notable incompatibility is that specifying an interface (for link-local IPv6 for instance) is no longer done with the `-I` flag, but by encoding the interface into the address (`ping fe80::1%eth0`). - The socket handling of the `services.rmilter` module has been fixed and refactored. As rmilter doesn't support binding to more than one socket, the options `bindUnixSockets` and `bindInetSockets` have been replaced by `services.rmilter.bindSocket.*`. The default is still a unix socket in `/run/rmilter/rmilter.sock`. Refer to the options documentation for more information. - The `fetch*` functions no longer support md5, please use sha256 instead. - The dnscrypt-proxy module interface has been streamlined around the `extraArgs` option. Where possible, legacy option declarations are mapped to `extraArgs` but will emit warnings. The `resolverList` has been outright removed: to use an unlisted resolver, use the `customResolver` option. - torbrowser now stores local state under `~/.local/share/tor-browser` by default. Any browser profile data from the old location, `~/.torbrowser4`, must be migrated manually. - The ihaskell, monetdb, offlineimap and sitecopy services have been removed. ## Other Notable Changes {#sec-release-17.03-notable-changes} - Module type system have a new extensible option types feature that allow to extend certain types, such as enum, through multiple option declarations of the same option across multiple modules. - `jre` now defaults to GTK UI by default. This improves visual consistency and makes Java follow system font style, improving the situation on HighDPI displays. This has a cost of increased closure size; for server and other headless workloads it's recommended to use `jre_headless`. - Python 2.6 interpreter and package set have been removed. - The Python 2.7 interpreter does not use modules anymore. Instead, all CPython interpreters now include the whole standard library except for \`tkinter\`, which is available in the Python package set. - Python 2.7, 3.5 and 3.6 are now built deterministically and 3.4 mostly. Minor modifications had to be made to the interpreters in order to generate deterministic bytecode. This has security implications and is relevant for those using Python in a `nix-shell`. See the Nixpkgs manual for details. - The Python package sets now use a fixed-point combinator and the sets are available as attributes of the interpreters. - The Python function `buildPythonPackage` has been improved and can be used to build from Setuptools source, Flit source, and precompiled Wheels. - When adding new or updating current Python libraries, the expressions should be put in separate files in `pkgs/development/python-modules` and called from `python-packages.nix`. - The dnscrypt-proxy service supports synchronizing the list of public resolvers without working DNS resolution. This fixes issues caused by the resolver list becoming outdated. It also improves the viability of DNSCrypt only configurations. - Containers using bridged networking no longer lose their connection after changes to the host networking. - ZFS supports pool auto scrubbing. - The bind DNS utilities (e.g. dig) have been split into their own output and are now also available in `pkgs.dnsutils` and it is no longer necessary to pull in all of `bind` to use them. - Per-user configuration was moved from `~/.nixpkgs` to `~/.config/nixpkgs`. The former is still valid for `config.nix` for backwards compatibility.

This section continues detailing backward incompatibilities in NixOS 17.03, covering changes to Postfix's local_recipient_maps, the removal of ping6 and traceroute6 from iputils, the socket handling changes in the services.rmilter module, the deprecation of md5 in fetch* functions in favor of sha256, the streamlined dnscrypt-proxy module interface, and the changed location for torbrowser's local state. It then highlights other notable changes, including extensible option types in the module system, the default GTK UI for jre, the removal of Python 2.6, changes to Python interpreters and package sets, improvements to the buildPythonPackage function, the location for Python libraries, improvements to the dnscrypt-proxy service, connection stability for containers using bridged networking, ZFS pool auto scrubbing support, the separation of bind DNS utilities, and the relocation of per-user configuration.