diff --git a/default.nix b/default.nix
index 2cccff28d..6466507b7 100644
--- a/default.nix
+++ b/default.nix
@@ -1,10 +1,9 @@
-(import
-  (
-    let lock = builtins.fromJSON (builtins.readFile ./flake.lock); in
-    fetchTarball {
-      url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
-      sha256 = lock.nodes.flake-compat.locked.narHash;
-    }
-  )
-  { src = ./.; }
-).defaultNix
+(import (
+  let
+    lock = builtins.fromJSON (builtins.readFile ./flake.lock);
+  in
+  fetchTarball {
+    url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
+    sha256 = lock.nodes.flake-compat.locked.narHash;
+  }
+) { src = ./.; }).defaultNix
diff --git a/doc/manual/generate-builtins.nix b/doc/manual/generate-builtins.nix
index 37ed12a43..3649560f7 100644
--- a/doc/manual/generate-builtins.nix
+++ b/doc/manual/generate-builtins.nix
@@ -5,7 +5,15 @@ in
 
 builtinsInfo:
 let
-  showBuiltin = name: { doc, type ? null, args ? [ ], experimental-feature ? null, impure-only ? false }:
+  showBuiltin =
+    name:
+    {
+      doc,
+      type ? null,
+      args ? [ ],
+      experimental-feature ? null,
+      impure-only ? false,
+    }:
     let
       type' = optionalString (type != null) " (${type})";
 
diff --git a/doc/manual/generate-manpage.nix b/doc/manual/generate-manpage.nix
index 791bfd2c7..31e74e17d 100644
--- a/doc/manual/generate-manpage.nix
+++ b/doc/manual/generate-manpage.nix
@@ -32,7 +32,13 @@ let
 
   commandInfo = fromJSON commandDump;
 
-  showCommand = { command, details, filename, toplevel }:
+  showCommand =
+    {
+      command,
+      details,
+      filename,
+      toplevel,
+    }:
     let
 
       result = ''
@@ -56,26 +62,27 @@ let
         ${maybeOptions}
       '';
 
-      showSynopsis = command: args:
+      showSynopsis =
+        command: args:
         let
-          showArgument = arg: "*${arg.label}*" + optionalString (! arg ? arity) "...";
+          showArgument = arg: "*${arg.label}*" + optionalString (!arg ? arity) "...";
           arguments = concatStringsSep " " (map showArgument args);
-        in ''
+        in
+        ''
           `${command}` [*option*...] ${arguments}
         '';
 
-      maybeSubcommands = optionalString (details ? commands && details.commands != {})
-        ''
-          where *subcommand* is one of the following:
+      maybeSubcommands = optionalString (details ? commands && details.commands != { }) ''
+        where *subcommand* is one of the following:
 
-          ${subcommands}
-        '';
+        ${subcommands}
+      '';
 
-      subcommands = if length categories > 1
-        then listCategories
-        else listSubcommands details.commands;
+      subcommands = if length categories > 1 then listCategories else listSubcommands details.commands;
 
-      categories = sort (x: y: x.id < y.id) (unique (map (cmd: cmd.category) (attrValues details.commands)));
+      categories = sort (x: y: x.id < y.id) (
+        unique (map (cmd: cmd.category) (attrValues details.commands))
+      );
 
       listCategories = concatStrings (map showCategory categories);
 
@@ -99,38 +106,39 @@ let
 
             ${allStores}
           '';
-          index = replaceStrings
-            [ "@store-types@" "./local-store.md" "./local-daemon-store.md" ]
-            [ storesOverview "#local-store" "#local-daemon-store" ]
-            details.doc;
+          index =
+            replaceStrings
+              [ "@store-types@" "./local-store.md" "./local-daemon-store.md" ]
+              [ storesOverview "#local-store" "#local-daemon-store" ]
+              details.doc;
           storesOverview =
             let
-              showEntry = store:
-                "- [${store.name}](#${store.slug})";
+              showEntry = store: "- [${store.name}](#${store.slug})";
             in
             concatStringsSep "\n" (map showEntry storesList) + "\n";
           allStores = concatStringsSep "\n" (attrValues storePages);
-          storePages = listToAttrs
-            (map (s: { name = s.filename; value = s.page; }) storesList);
+          storePages = listToAttrs (
+            map (s: {
+              name = s.filename;
+              value = s.page;
+            }) storesList
+          );
           storesList = showStoreDocs {
             storeInfo = commandInfo.stores;
             inherit inlineHTML;
           };
-          hasInfix = infix: content:
+          hasInfix =
+            infix: content:
             builtins.stringLength content != builtins.stringLength (replaceStrings [ infix ] [ "" ] content);
         in
         optionalString (details ? doc) (
           # An alternate implementation with builtins.match stack overflowed on some systems.
-          if hasInfix "@store-types@" details.doc
-          then help-stores
-          else details.doc
+          if hasInfix "@store-types@" details.doc then help-stores else details.doc
         );
 
       maybeOptions =
         let
-          allVisibleOptions = filterAttrs
-            (_: o: ! o.hiddenCategory)
-            (details.flags // toplevel.flags);
+          allVisibleOptions = filterAttrs (_: o: !o.hiddenCategory) (details.flags // toplevel.flags);
         in
         optionalString (allVisibleOptions != { }) ''
           # Options
@@ -142,55 +150,73 @@ let
           > See [`man nix.conf`](@docroot@/command-ref/conf-file.md#command-line-flags) for overriding configuration settings with command line flags.
         '';
 
-      showOptions = inlineHTML: allOptions:
+      showOptions =
+        inlineHTML: allOptions:
         let
           showCategory = cat: opts: ''
             ${optionalString (cat != "") "## ${cat}"}
 
             ${concatStringsSep "\n" (attrValues (mapAttrs showOption opts))}
           '';
-          showOption = name: option:
+          showOption =
+            name: option:
             let
               result = trim ''
                 - ${item}
 
                   ${option.description}
               '';
-              item = if inlineHTML
-                then ''<span id="opt-${name}">[`--${name}`](#opt-${name})</span> ${shortName} ${labels}''
-                else "`--${name}` ${shortName} ${labels}";
-              shortName = optionalString
-                (option ? shortName)
-                ("/ `-${option.shortName}`");
-              labels = optionalString
-                (option ? labels)
-                (concatStringsSep " " (map (s: "*${s}*") option.labels));
-            in result;
-          categories = mapAttrs
-            # Convert each group from a list of key-value pairs back to an attrset
-            (_: listToAttrs)
-            (groupBy
-              (cmd: cmd.value.category)
-              (attrsToList allOptions));
-        in concatStrings (attrValues (mapAttrs showCategory categories));
-    in squash result;
+              item =
+                if inlineHTML then
+                  ''<span id="opt-${name}">[`--${name}`](#opt-${name})</span> ${shortName} ${labels}''
+                else
+                  "`--${name}` ${shortName} ${labels}";
+              shortName = optionalString (option ? shortName) ("/ `-${option.shortName}`");
+              labels = optionalString (option ? labels) (concatStringsSep " " (map (s: "*${s}*") option.labels));
+            in
+            result;
+          categories =
+            mapAttrs
+              # Convert each group from a list of key-value pairs back to an attrset
+              (_: listToAttrs)
+              (groupBy (cmd: cmd.value.category) (attrsToList allOptions));
+        in
+        concatStrings (attrValues (mapAttrs showCategory categories));
+    in
+    squash result;
 
   appendName = filename: name: (if filename == "nix" then "nix3" else filename) + "-" + name;
 
-  processCommand = { command, details, filename, toplevel }:
+  processCommand =
+    {
+      command,
+      details,
+      filename,
+      toplevel,
+    }:
     let
       cmd = {
         inherit command;
         name = filename + ".md";
-        value = showCommand { inherit command details filename toplevel; };
+        value = showCommand {
+          inherit
+            command
+            details
+            filename
+            toplevel
+            ;
+        };
       };
-      subcommand = subCmd: processCommand {
-        command = command + " " + subCmd;
-        details = details.commands.${subCmd};
-        filename = appendName filename subCmd;
-        inherit toplevel;
-      };
-    in [ cmd ] ++ concatMap subcommand (attrNames details.commands or {});
+      subcommand =
+        subCmd:
+        processCommand {
+          command = command + " " + subCmd;
+          details = details.commands.${subCmd};
+          filename = appendName filename subCmd;
+          inherit toplevel;
+        };
+    in
+    [ cmd ] ++ concatMap subcommand (attrNames details.commands or { });
 
   manpages = processCommand {
     command = "nix";
@@ -199,9 +225,11 @@ let
     toplevel = commandInfo.args;
   };
 
-  tableOfContents = let
-    showEntry = page:
-      "    - [${page.command}](command-ref/new-cli/${page.name})";
-    in concatStringsSep "\n" (map showEntry manpages) + "\n";
+  tableOfContents =
+    let
+      showEntry = page: "    - [${page.command}](command-ref/new-cli/${page.name})";
+    in
+    concatStringsSep "\n" (map showEntry manpages) + "\n";
 
-in (listToAttrs manpages) // { "SUMMARY.md" = tableOfContents; }
+in
+(listToAttrs manpages) // { "SUMMARY.md" = tableOfContents; }
diff --git a/doc/manual/generate-settings.nix b/doc/manual/generate-settings.nix
index 93a8e093e..35ae73e5d 100644
--- a/doc/manual/generate-settings.nix
+++ b/doc/manual/generate-settings.nix
@@ -1,67 +1,99 @@
 let
-  inherit (builtins) attrValues concatStringsSep isAttrs isBool mapAttrs;
-  inherit (import <nix/utils.nix>) concatStrings indent optionalString squash;
+  inherit (builtins)
+    attrValues
+    concatStringsSep
+    isAttrs
+    isBool
+    mapAttrs
+    ;
+  inherit (import <nix/utils.nix>)
+    concatStrings
+    indent
+    optionalString
+    squash
+    ;
 in
 
 # `inlineHTML` is a hack to accommodate inconsistent output from `lowdown`
-{ prefix, inlineHTML ? true }: settingsInfo:
+{
+  prefix,
+  inlineHTML ? true,
+}:
+settingsInfo:
 
 let
 
-  showSetting = prefix: setting: { description, documentDefault, defaultValue, aliases, value, experimentalFeature }:
+  showSetting =
+    prefix: setting:
+    {
+      description,
+      documentDefault,
+      defaultValue,
+      aliases,
+      value,
+      experimentalFeature,
+    }:
     let
       result = squash ''
-          - ${item}
+        - ${item}
 
-          ${indent "  " body}
-        '';
-      item = if inlineHTML
-        then ''<span id="${prefix}-${setting}">[`${setting}`](#${prefix}-${setting})</span>''
-        else "`${setting}`";
+        ${indent "  " body}
+      '';
+      item =
+        if inlineHTML then
+          ''<span id="${prefix}-${setting}">[`${setting}`](#${prefix}-${setting})</span>''
+        else
+          "`${setting}`";
       # separate body to cleanly handle indentation
       body = ''
-          ${experimentalFeatureNote}
+        ${experimentalFeatureNote}
 
-          ${description}
+        ${description}
 
-          **Default:** ${showDefault documentDefault defaultValue}
+        **Default:** ${showDefault documentDefault defaultValue}
 
-          ${showAliases aliases}
-        '';
+        ${showAliases aliases}
+      '';
 
       experimentalFeatureNote = optionalString (experimentalFeature != null) ''
-          > **Warning**
-          >
-          > This setting is part of an
-          > [experimental feature](@docroot@/development/experimental-features.md).
-          >
-          > To change this setting, make sure the
-          > [`${experimentalFeature}` experimental feature](@docroot@/development/experimental-features.md#xp-feature-${experimentalFeature})
-          > is enabled.
-          > For example, include the following in [`nix.conf`](@docroot@/command-ref/conf-file.md):
-          >
-          > ```
-          > extra-experimental-features = ${experimentalFeature}
-          > ${setting} = ...
-          > ```
-        '';
+        > **Warning**
+        >
+        > This setting is part of an
+        > [experimental feature](@docroot@/development/experimental-features.md).
+        >
+        > To change this setting, make sure the
+        > [`${experimentalFeature}` experimental feature](@docroot@/development/experimental-features.md#xp-feature-${experimentalFeature})
+        > is enabled.
+        > For example, include the following in [`nix.conf`](@docroot@/command-ref/conf-file.md):
+        >
+        > ```
+        > extra-experimental-features = ${experimentalFeature}
+        > ${setting} = ...
+        > ```
+      '';
 
-      showDefault = documentDefault: defaultValue:
+      showDefault =
+        documentDefault: defaultValue:
         if documentDefault then
           # a StringMap value type is specified as a string, but
           # this shows the value type. The empty stringmap is `null` in
           # JSON, but that converts to `{ }` here.
-          if defaultValue == "" || defaultValue == [] || isAttrs defaultValue
-            then "*empty*"
-            else if isBool defaultValue then
-              if defaultValue then "`true`" else "`false`"
-            else "`${toString defaultValue}`"
-        else "*machine-specific*";
+          if defaultValue == "" || defaultValue == [ ] || isAttrs defaultValue then
+            "*empty*"
+          else if isBool defaultValue then
+            if defaultValue then "`true`" else "`false`"
+          else
+            "`${toString defaultValue}`"
+        else
+          "*machine-specific*";
 
-      showAliases = aliases:
-          optionalString (aliases != [])
-            "**Deprecated alias:** ${(concatStringsSep ", " (map (s: "`${s}`") aliases))}";
+      showAliases =
+        aliases:
+        optionalString (aliases != [ ])
+          "**Deprecated alias:** ${(concatStringsSep ", " (map (s: "`${s}`") aliases))}";
 
-    in result;
+    in
+    result;
 
-in concatStrings (attrValues (mapAttrs (showSetting prefix) settingsInfo))
+in
+concatStrings (attrValues (mapAttrs (showSetting prefix) settingsInfo))
diff --git a/doc/manual/generate-store-info.nix b/doc/manual/generate-store-info.nix
index cc3704124..e8b7377da 100644
--- a/doc/manual/generate-store-info.nix
+++ b/doc/manual/generate-store-info.nix
@@ -1,6 +1,20 @@
 let
-  inherit (builtins) attrNames listToAttrs concatStringsSep readFile replaceStrings;
-  inherit (import <nix/utils.nix>) optionalString filterAttrs trim squash toLower unique indent;
+  inherit (builtins)
+    attrNames
+    listToAttrs
+    concatStringsSep
+    readFile
+    replaceStrings
+    ;
+  inherit (import <nix/utils.nix>)
+    optionalString
+    filterAttrs
+    trim
+    squash
+    toLower
+    unique
+    indent
+    ;
   showSettings = import <nix/generate-settings.nix>;
 in
 
@@ -14,7 +28,13 @@ in
 
 let
 
-  showStore = { name, slug }: { settings, doc, experimentalFeature }:
+  showStore =
+    { name, slug }:
+    {
+      settings,
+      doc,
+      experimentalFeature,
+    }:
     let
       result = squash ''
         # ${name}
@@ -25,7 +45,10 @@ let
 
         ## Settings
 
-        ${showSettings { prefix = "store-${slug}"; inherit inlineHTML; } settings}
+        ${showSettings {
+          prefix = "store-${slug}";
+          inherit inlineHTML;
+        } settings}
       '';
 
       experimentalFeatureNote = optionalString (experimentalFeature != null) ''
@@ -43,15 +66,15 @@ let
         > extra-experimental-features = ${experimentalFeature}
         > ```
       '';
-    in result;
+    in
+    result;
 
-  storesList = map
-    (name: rec {
-      inherit name;
-      slug = replaceStrings [ " " ] [ "-" ] (toLower name);
-      filename = "${slug}.md";
-      page = showStore { inherit name slug; } storeInfo.${name};
-    })
-    (attrNames storeInfo);
+  storesList = map (name: rec {
+    inherit name;
+    slug = replaceStrings [ " " ] [ "-" ] (toLower name);
+    filename = "${slug}.md";
+    page = showStore { inherit name slug; } storeInfo.${name};
+  }) (attrNames storeInfo);
 
-in storesList
+in
+storesList
diff --git a/doc/manual/generate-store-types.nix b/doc/manual/generate-store-types.nix
index 46179abc5..a03d3d621 100644
--- a/doc/manual/generate-store-types.nix
+++ b/doc/manual/generate-store-types.nix
@@ -1,5 +1,11 @@
 let
-  inherit (builtins) attrNames listToAttrs concatStringsSep readFile replaceStrings;
+  inherit (builtins)
+    attrNames
+    listToAttrs
+    concatStringsSep
+    readFile
+    replaceStrings
+    ;
   showSettings = import <nix/generate-settings.nix>;
   showStoreDocs = import <nix/generate-store-info.nix>;
 in
@@ -14,26 +20,28 @@ let
 
   index =
     let
-      showEntry = store:
-        "- [${store.name}](./${store.filename})";
+      showEntry = store: "- [${store.name}](./${store.filename})";
     in
     concatStringsSep "\n" (map showEntry storesList);
 
-  "index.md" = replaceStrings
-    [ "@store-types@" ] [ index ]
-    (readFile ./source/store/types/index.md.in);
+  "index.md" =
+    replaceStrings [ "@store-types@" ] [ index ]
+      (readFile ./source/store/types/index.md.in);
 
   tableOfContents =
     let
-      showEntry = store:
-        "    - [${store.name}](store/types/${store.filename})";
+      showEntry = store: "    - [${store.name}](store/types/${store.filename})";
     in
     concatStringsSep "\n" (map showEntry storesList) + "\n";
 
   "SUMMARY.md" = tableOfContents;
 
-  storePages = listToAttrs
-    (map (s: { name = s.filename; value = s.page; }) storesList);
+  storePages = listToAttrs (
+    map (s: {
+      name = s.filename;
+      value = s.page;
+    }) storesList
+  );
 
 in
 storePages // { inherit "index.md" "SUMMARY.md"; }
diff --git a/doc/manual/generate-xp-features-shortlist.nix b/doc/manual/generate-xp-features-shortlist.nix
index eb735ba5f..1520fc2f8 100644
--- a/doc/manual/generate-xp-features-shortlist.nix
+++ b/doc/manual/generate-xp-features-shortlist.nix
@@ -2,8 +2,8 @@ with builtins;
 with import <nix/utils.nix>;
 
 let
-  showExperimentalFeature = name: doc:
-    ''
-      - [`${name}`](@docroot@/development/experimental-features.md#xp-feature-${name})
-    '';
-in xps: indent "  " (concatStrings (attrValues (mapAttrs showExperimentalFeature xps)))
+  showExperimentalFeature = name: doc: ''
+    - [`${name}`](@docroot@/development/experimental-features.md#xp-feature-${name})
+  '';
+in
+xps: indent "  " (concatStrings (attrValues (mapAttrs showExperimentalFeature xps)))
diff --git a/doc/manual/generate-xp-features.nix b/doc/manual/generate-xp-features.nix
index 0eec0e1da..468d253ba 100644
--- a/doc/manual/generate-xp-features.nix
+++ b/doc/manual/generate-xp-features.nix
@@ -2,7 +2,8 @@ with builtins;
 with import <nix/utils.nix>;
 
 let
-  showExperimentalFeature = name: doc:
+  showExperimentalFeature =
+    name: doc:
     squash ''
       ## [`${name}`]{#xp-feature-${name}}
 
diff --git a/doc/manual/package.nix b/doc/manual/package.nix
index f8133f2e1..8f5d0dfe1 100644
--- a/doc/manual/package.nix
+++ b/doc/manual/package.nix
@@ -1,19 +1,20 @@
-{ lib
-, mkMesonDerivation
+{
+  lib,
+  mkMesonDerivation,
 
-, meson
-, ninja
-, lowdown-unsandboxed
-, mdbook
-, mdbook-linkcheck
-, jq
-, python3
-, rsync
-, nix-cli
+  meson,
+  ninja,
+  lowdown-unsandboxed,
+  mdbook,
+  mdbook-linkcheck,
+  jq,
+  python3,
+  rsync,
+  nix-cli,
 
-# Configuration Options
+  # Configuration Options
 
-, version
+  version,
 }:
 
 let
@@ -25,18 +26,22 @@ mkMesonDerivation (finalAttrs: {
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.difference
-    (fileset.unions [
-      ../../.version
-      # Too many different types of files to filter for now
-      ../../doc/manual
-      ./.
-    ])
-    # Do a blacklist instead
-    ../../doc/manual/package.nix;
+  fileset =
+    fileset.difference
+      (fileset.unions [
+        ../../.version
+        # Too many different types of files to filter for now
+        ../../doc/manual
+        ./.
+      ])
+      # Do a blacklist instead
+      ../../doc/manual/package.nix;
 
   # TODO the man pages should probably be separate
-  outputs = [ "out" "man" ];
+  outputs = [
+    "out"
+    "man"
+  ];
 
   # Hack for sake of the dev shell
   passthru.externalNativeBuildInputs = [
@@ -54,11 +59,10 @@ mkMesonDerivation (finalAttrs: {
     nix-cli
   ];
 
-  preConfigure =
-    ''
-      chmod u+w ./.version
-      echo ${finalAttrs.version} > ./.version
-    '';
+  preConfigure = ''
+    chmod u+w ./.version
+    echo ${finalAttrs.version} > ./.version
+  '';
 
   postInstall = ''
     mkdir -p ''$out/nix-support
diff --git a/doc/manual/utils.nix b/doc/manual/utils.nix
index 19ff49b64..db3a0e67a 100644
--- a/doc/manual/utils.nix
+++ b/doc/manual/utils.nix
@@ -11,10 +11,15 @@ rec {
 
   concatStrings = concatStringsSep "";
 
-  attrsToList = a:
-    map (name: { inherit name; value = a.${name}; }) (builtins.attrNames a);
+  attrsToList =
+    a:
+    map (name: {
+      inherit name;
+      value = a.${name};
+    }) (builtins.attrNames a);
 
-  replaceStringsRec = from: to: string:
+  replaceStringsRec =
+    from: to: string:
     # recursively replace occurrences of `from` with `to` within `string`
     # example:
     #     replaceStringRec "--" "-" "hello-----world"
@@ -22,16 +27,18 @@ rec {
     let
       replaced = replaceStrings [ from ] [ to ] string;
     in
-      if replaced == string then string else replaceStringsRec from to replaced;
+    if replaced == string then string else replaceStringsRec from to replaced;
 
   toLower = replaceStrings upperChars lowerChars;
 
   squash = replaceStringsRec "\n\n\n" "\n\n";
 
-  trim = string:
+  trim =
+    string:
     # trim trailing spaces and squash non-leading spaces
     let
-      trimLine = line:
+      trimLine =
+        line:
         let
           # separate leading spaces from the rest
           parts = split "(^ *)" line;
@@ -39,19 +46,30 @@ rec {
           rest = elemAt parts 2;
           # drop trailing spaces
           body = head (split " *$" rest);
-        in spaces + replaceStringsRec "  " " " body;
-    in concatStringsSep "\n" (map trimLine (splitLines string));
+        in
+        spaces + replaceStringsRec "  " " " body;
+    in
+    concatStringsSep "\n" (map trimLine (splitLines string));
 
   # FIXME: O(n^2)
-  unique = foldl' (acc: e: if elem e acc then acc else acc ++ [ e ]) [];
+  unique = foldl' (acc: e: if elem e acc then acc else acc ++ [ e ]) [ ];
 
   nameValuePair = name: value: { inherit name value; };
 
-  filterAttrs = pred: set:
-    listToAttrs (concatMap (name: let v = set.${name}; in if pred name v then [(nameValuePair name v)] else []) (attrNames set));
+  filterAttrs =
+    pred: set:
+    listToAttrs (
+      concatMap (
+        name:
+        let
+          v = set.${name};
+        in
+        if pred name v then [ (nameValuePair name v) ] else [ ]
+      ) (attrNames set)
+    );
 
   optionalString = cond: string: if cond then string else "";
 
-  indent = prefix: s:
-    concatStringsSep "\n" (map (x: if x == "" then x else "${prefix}${x}") (splitLines s));
+  indent =
+    prefix: s: concatStringsSep "\n" (map (x: if x == "" then x else "${prefix}${x}") (splitLines s));
 }
diff --git a/docker.nix b/docker.nix
index e2e9da728..d52c317d6 100644
--- a/docker.nix
+++ b/docker.nix
@@ -1,112 +1,113 @@
-{ pkgs ? import <nixpkgs> { }
-, lib ? pkgs.lib
-, name ? "nix"
-, tag ? "latest"
-, bundleNixpkgs ? true
-, channelName ? "nixpkgs"
-, channelURL ? "https://nixos.org/channels/nixpkgs-unstable"
-, extraPkgs ? []
-, maxLayers ? 100
-, nixConf ? {}
-, flake-registry ? null
-, uid ? 0
-, gid ? 0
-, uname ? "root"
-, gname ? "root"
+{
+  pkgs ? import <nixpkgs> { },
+  lib ? pkgs.lib,
+  name ? "nix",
+  tag ? "latest",
+  bundleNixpkgs ? true,
+  channelName ? "nixpkgs",
+  channelURL ? "https://nixos.org/channels/nixpkgs-unstable",
+  extraPkgs ? [ ],
+  maxLayers ? 100,
+  nixConf ? { },
+  flake-registry ? null,
+  uid ? 0,
+  gid ? 0,
+  uname ? "root",
+  gname ? "root",
 }:
 let
-  defaultPkgs = with pkgs; [
-    nix
-    bashInteractive
-    coreutils-full
-    gnutar
-    gzip
-    gnugrep
-    which
-    curl
-    less
-    wget
-    man
-    cacert.out
-    findutils
-    iana-etc
-    git
-    openssh
-  ] ++ extraPkgs;
+  defaultPkgs =
+    with pkgs;
+    [
+      nix
+      bashInteractive
+      coreutils-full
+      gnutar
+      gzip
+      gnugrep
+      which
+      curl
+      less
+      wget
+      man
+      cacert.out
+      findutils
+      iana-etc
+      git
+      openssh
+    ]
+    ++ extraPkgs;
 
-  users = {
+  users =
+    {
 
-    root = {
-      uid = 0;
-      shell = "${pkgs.bashInteractive}/bin/bash";
-      home = "/root";
-      gid = 0;
-      groups = [ "root" ];
-      description = "System administrator";
+      root = {
+        uid = 0;
+        shell = "${pkgs.bashInteractive}/bin/bash";
+        home = "/root";
+        gid = 0;
+        groups = [ "root" ];
+        description = "System administrator";
+      };
+
+      nobody = {
+        uid = 65534;
+        shell = "${pkgs.shadow}/bin/nologin";
+        home = "/var/empty";
+        gid = 65534;
+        groups = [ "nobody" ];
+        description = "Unprivileged account (don't use!)";
+      };
+
+    }
+    // lib.optionalAttrs (uid != 0) {
+      "${uname}" = {
+        uid = uid;
+        shell = "${pkgs.bashInteractive}/bin/bash";
+        home = "/home/${uname}";
+        gid = gid;
+        groups = [ "${gname}" ];
+        description = "Nix user";
+      };
+    }
+    // lib.listToAttrs (
+      map (n: {
+        name = "nixbld${toString n}";
+        value = {
+          uid = 30000 + n;
+          gid = 30000;
+          groups = [ "nixbld" ];
+          description = "Nix build user ${toString n}";
+        };
+      }) (lib.lists.range 1 32)
+    );
+
+  groups =
+    {
+      root.gid = 0;
+      nixbld.gid = 30000;
+      nobody.gid = 65534;
+    }
+    // lib.optionalAttrs (gid != 0) {
+      "${gname}".gid = gid;
     };
 
-    nobody = {
-      uid = 65534;
-      shell = "${pkgs.shadow}/bin/nologin";
-      home = "/var/empty";
-      gid = 65534;
-      groups = [ "nobody" ];
-      description = "Unprivileged account (don't use!)";
-    };
-
-  } // lib.optionalAttrs (uid != 0) {
-    "${uname}" = {
-      uid = uid;
-      shell = "${pkgs.bashInteractive}/bin/bash";
-      home = "/home/${uname}";
-      gid = gid;
-      groups = [ "${gname}" ];
-      description = "Nix user";
-    };
-  } // lib.listToAttrs (
-    map
-      (
-        n: {
-          name = "nixbld${toString n}";
-          value = {
-            uid = 30000 + n;
-            gid = 30000;
-            groups = [ "nixbld" ];
-            description = "Nix build user ${toString n}";
-          };
-        }
-      )
-      (lib.lists.range 1 32)
-  );
-
-  groups = {
-    root.gid = 0;
-    nixbld.gid = 30000;
-    nobody.gid = 65534;
-  } // lib.optionalAttrs (gid != 0) {
-    "${gname}".gid = gid;
-  };
-
   userToPasswd = (
     k:
-    { uid
-    , gid ? 65534
-    , home ? "/var/empty"
-    , description ? ""
-    , shell ? "/bin/false"
-    , groups ? [ ]
-    }: "${k}:x:${toString uid}:${toString gid}:${description}:${home}:${shell}"
-  );
-  passwdContents = (
-    lib.concatStringsSep "\n"
-      (lib.attrValues (lib.mapAttrs userToPasswd users))
+    {
+      uid,
+      gid ? 65534,
+      home ? "/var/empty",
+      description ? "",
+      shell ? "/bin/false",
+      groups ? [ ],
+    }:
+    "${k}:x:${toString uid}:${toString gid}:${description}:${home}:${shell}"
   );
+  passwdContents = (lib.concatStringsSep "\n" (lib.attrValues (lib.mapAttrs userToPasswd users)));
 
   userToShadow = k: { ... }: "${k}:!:1::::::";
-  shadowContents = (
-    lib.concatStringsSep "\n"
-      (lib.attrValues (lib.mapAttrs userToShadow users))
-  );
+  shadowContents = (lib.concatStringsSep "\n" (lib.attrValues (lib.mapAttrs userToShadow users)));
 
   # Map groups to members
   # {
@@ -116,42 +117,35 @@ let
     let
       # Create a flat list of user/group mappings
       mappings = (
-        builtins.foldl'
-          (
-            acc: user:
-              let
-                groups = users.${user}.groups or [ ];
-              in
-              acc ++ map
-                (group: {
-                  inherit user group;
-                })
-                groups
-          )
-          [ ]
-          (lib.attrNames users)
+        builtins.foldl' (
+          acc: user:
+          let
+            groups = users.${user}.groups or [ ];
+          in
+          acc
+          ++ map (group: {
+            inherit user group;
+          }) groups
+        ) [ ] (lib.attrNames users)
       );
     in
-    (
-      builtins.foldl'
-        (
-          acc: v: acc // {
-            ${v.group} = acc.${v.group} or [ ] ++ [ v.user ];
-          }
-        )
-        { }
-        mappings)
+    (builtins.foldl' (
+      acc: v:
+      acc
+      // {
+        ${v.group} = acc.${v.group} or [ ] ++ [ v.user ];
+      }
+    ) { } mappings)
   );
 
-  groupToGroup = k: { gid }:
+  groupToGroup =
+    k:
+    { gid }:
     let
       members = groupMemberMap.${k} or [ ];
     in
     "${k}:x:${toString gid}:${lib.concatStringsSep "," members}";
-  groupContents = (
-    lib.concatStringsSep "\n"
-      (lib.attrValues (lib.mapAttrs groupToGroup groups))
-  );
+  groupContents = (lib.concatStringsSep "\n" (lib.attrValues (lib.mapAttrs groupToGroup groups)));
 
   defaultNixConf = {
     sandbox = "false";
@@ -159,11 +153,17 @@ let
     trusted-public-keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
   };
 
-  nixConfContents = (lib.concatStringsSep "\n" (lib.mapAttrsFlatten (n: v:
-    let
-      vStr = if builtins.isList v then lib.concatStringsSep " " v else v;
-    in
-      "${n} = ${vStr}") (defaultNixConf // nixConf))) + "\n";
+  nixConfContents =
+    (lib.concatStringsSep "\n" (
+      lib.mapAttrsFlatten (
+        n: v:
+        let
+          vStr = if builtins.isList v then lib.concatStringsSep " " v else v;
+        in
+        "${n} = ${vStr}"
+      ) (defaultNixConf // nixConf)
+    ))
+    + "\n";
 
   userHome = if uid == 0 then "/root" else "/home/${uname}";
 
@@ -184,21 +184,29 @@ let
       manifest = pkgs.buildPackages.runCommand "manifest.nix" { } ''
         cat > $out <<EOF
         [
-        ${lib.concatStringsSep "\n" (builtins.map (drv: let
-          outputs = drv.outputsToInstall or [ "out" ];
-        in ''
-          {
-            ${lib.concatStringsSep "\n" (builtins.map (output: ''
-              ${output} = { outPath = "${lib.getOutput output drv}"; };
-            '') outputs)}
-            outputs = [ ${lib.concatStringsSep " " (builtins.map (x: "\"${x}\"") outputs)} ];
-            name = "${drv.name}";
-            outPath = "${drv}";
-            system = "${drv.system}";
-            type = "derivation";
-            meta = { };
-          }
-        '') defaultPkgs)}
+        ${lib.concatStringsSep "\n" (
+          builtins.map (
+            drv:
+            let
+              outputs = drv.outputsToInstall or [ "out" ];
+            in
+            ''
+              {
+                ${lib.concatStringsSep "\n" (
+                  builtins.map (output: ''
+                    ${output} = { outPath = "${lib.getOutput output drv}"; };
+                  '') outputs
+                )}
+                outputs = [ ${lib.concatStringsSep " " (builtins.map (x: "\"${x}\"") outputs)} ];
+                name = "${drv.name}";
+                outPath = "${drv}";
+                system = "${drv.system}";
+                type = "derivation";
+                meta = { };
+              }
+            ''
+          ) defaultPkgs
+        )}
         ]
         EOF
       '';
@@ -207,16 +215,22 @@ let
         cp -a ${rootEnv}/* $out/
         ln -s ${manifest} $out/manifest.nix
       '';
-      flake-registry-path = if (flake-registry == null) then
-        null
-      else if (builtins.readFileType (toString flake-registry)) == "directory" then
-        "${flake-registry}/flake-registry.json"
-      else
-        flake-registry;
+      flake-registry-path =
+        if (flake-registry == null) then
+          null
+        else if (builtins.readFileType (toString flake-registry)) == "directory" then
+          "${flake-registry}/flake-registry.json"
+        else
+          flake-registry;
     in
     pkgs.runCommand "base-system"
       {
-        inherit passwdContents groupContents shadowContents nixConfContents;
+        inherit
+          passwdContents
+          groupContents
+          shadowContents
+          nixConfContents
+          ;
         passAsFile = [
           "passwdContents"
           "groupContents"
@@ -225,67 +239,79 @@ let
         ];
         allowSubstitutes = false;
         preferLocalBuild = true;
-      } (''
-      env
-      set -x
-      mkdir -p $out/etc
+      }
+      (
+        ''
+          env
+          set -x
+          mkdir -p $out/etc
 
-      mkdir -p $out/etc/ssl/certs
-      ln -s /nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs
+          mkdir -p $out/etc/ssl/certs
+          ln -s /nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs
 
-      cat $passwdContentsPath > $out/etc/passwd
-      echo "" >> $out/etc/passwd
+          cat $passwdContentsPath > $out/etc/passwd
+          echo "" >> $out/etc/passwd
 
-      cat $groupContentsPath > $out/etc/group
-      echo "" >> $out/etc/group
+          cat $groupContentsPath > $out/etc/group
+          echo "" >> $out/etc/group
 
-      cat $shadowContentsPath > $out/etc/shadow
-      echo "" >> $out/etc/shadow
+          cat $shadowContentsPath > $out/etc/shadow
+          echo "" >> $out/etc/shadow
 
-      mkdir -p $out/usr
-      ln -s /nix/var/nix/profiles/share $out/usr/
+          mkdir -p $out/usr
+          ln -s /nix/var/nix/profiles/share $out/usr/
 
-      mkdir -p $out/nix/var/nix/gcroots
+          mkdir -p $out/nix/var/nix/gcroots
 
-      mkdir $out/tmp
+          mkdir $out/tmp
 
-      mkdir -p $out/var/tmp
+          mkdir -p $out/var/tmp
 
-      mkdir -p $out/etc/nix
-      cat $nixConfContentsPath > $out/etc/nix/nix.conf
+          mkdir -p $out/etc/nix
+          cat $nixConfContentsPath > $out/etc/nix/nix.conf
 
-      mkdir -p $out${userHome}
-      mkdir -p $out/nix/var/nix/profiles/per-user/${uname}
+          mkdir -p $out${userHome}
+          mkdir -p $out/nix/var/nix/profiles/per-user/${uname}
 
-      ln -s ${profile} $out/nix/var/nix/profiles/default-1-link
-      ln -s /nix/var/nix/profiles/default-1-link $out/nix/var/nix/profiles/default
-      ln -s /nix/var/nix/profiles/default $out${userHome}/.nix-profile
+          ln -s ${profile} $out/nix/var/nix/profiles/default-1-link
+          ln -s /nix/var/nix/profiles/default-1-link $out/nix/var/nix/profiles/default
+          ln -s /nix/var/nix/profiles/default $out${userHome}/.nix-profile
 
-      ln -s ${channel} $out/nix/var/nix/profiles/per-user/${uname}/channels-1-link
-      ln -s /nix/var/nix/profiles/per-user/${uname}/channels-1-link $out/nix/var/nix/profiles/per-user/${uname}/channels
+          ln -s ${channel} $out/nix/var/nix/profiles/per-user/${uname}/channels-1-link
+          ln -s /nix/var/nix/profiles/per-user/${uname}/channels-1-link $out/nix/var/nix/profiles/per-user/${uname}/channels
 
-      mkdir -p $out${userHome}/.nix-defexpr
-      ln -s /nix/var/nix/profiles/per-user/${uname}/channels $out${userHome}/.nix-defexpr/channels
-      echo "${channelURL} ${channelName}" > $out${userHome}/.nix-channels
+          mkdir -p $out${userHome}/.nix-defexpr
+          ln -s /nix/var/nix/profiles/per-user/${uname}/channels $out${userHome}/.nix-defexpr/channels
+          echo "${channelURL} ${channelName}" > $out${userHome}/.nix-channels
 
-      mkdir -p $out/bin $out/usr/bin
-      ln -s ${pkgs.coreutils}/bin/env $out/usr/bin/env
-      ln -s ${pkgs.bashInteractive}/bin/bash $out/bin/sh
+          mkdir -p $out/bin $out/usr/bin
+          ln -s ${pkgs.coreutils}/bin/env $out/usr/bin/env
+          ln -s ${pkgs.bashInteractive}/bin/bash $out/bin/sh
 
-    '' + (lib.optionalString (flake-registry-path != null) ''
-      nixCacheDir="${userHome}/.cache/nix"
-      mkdir -p $out$nixCacheDir
-      globalFlakeRegistryPath="$nixCacheDir/flake-registry.json"
-      ln -s ${flake-registry-path} $out$globalFlakeRegistryPath
-      mkdir -p $out/nix/var/nix/gcroots/auto
-      rootName=$(${pkgs.nix}/bin/nix --extra-experimental-features nix-command hash file --type sha1 --base32 <(echo -n $globalFlakeRegistryPath))
-      ln -s $globalFlakeRegistryPath $out/nix/var/nix/gcroots/auto/$rootName
-    ''));
+        ''
+        + (lib.optionalString (flake-registry-path != null) ''
+          nixCacheDir="${userHome}/.cache/nix"
+          mkdir -p $out$nixCacheDir
+          globalFlakeRegistryPath="$nixCacheDir/flake-registry.json"
+          ln -s ${flake-registry-path} $out$globalFlakeRegistryPath
+          mkdir -p $out/nix/var/nix/gcroots/auto
+          rootName=$(${pkgs.nix}/bin/nix --extra-experimental-features nix-command hash file --type sha1 --base32 <(echo -n $globalFlakeRegistryPath))
+          ln -s $globalFlakeRegistryPath $out/nix/var/nix/gcroots/auto/$rootName
+        '')
+      );
 
 in
 pkgs.dockerTools.buildLayeredImageWithNixDb {
 
-  inherit name tag maxLayers uid gid uname gname;
+  inherit
+    name
+    tag
+    maxLayers
+    uid
+    gid
+    uname
+    gname
+    ;
 
   contents = [ baseSystem ];
 
@@ -305,15 +331,19 @@ pkgs.dockerTools.buildLayeredImageWithNixDb {
     User = "${toString uid}:${toString gid}";
     Env = [
       "USER=${uname}"
-      "PATH=${lib.concatStringsSep ":" [
-        "${userHome}/.nix-profile/bin"
-        "/nix/var/nix/profiles/default/bin"
-        "/nix/var/nix/profiles/default/sbin"
-      ]}"
-      "MANPATH=${lib.concatStringsSep ":" [
-        "${userHome}/.nix-profile/share/man"
-        "/nix/var/nix/profiles/default/share/man"
-      ]}"
+      "PATH=${
+        lib.concatStringsSep ":" [
+          "${userHome}/.nix-profile/bin"
+          "/nix/var/nix/profiles/default/bin"
+          "/nix/var/nix/profiles/default/sbin"
+        ]
+      }"
+      "MANPATH=${
+        lib.concatStringsSep ":" [
+          "${userHome}/.nix-profile/share/man"
+          "/nix/var/nix/profiles/default/share/man"
+        ]
+      }"
       "SSL_CERT_FILE=/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
       "GIT_SSL_CAINFO=/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
       "NIX_SSL_CERT_FILE=/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"
diff --git a/flake.nix b/flake.nix
index d8a458c1f..eafb65353 100644
--- a/flake.nix
+++ b/flake.nix
@@ -5,7 +5,10 @@
 
   inputs.nixpkgs-regression.url = "github:NixOS/nixpkgs/215d4d0fd80ca5163643b03a33fde804a29cc1e2";
   inputs.nixpkgs-23-11.url = "github:NixOS/nixpkgs/a62e6edd6d5e1fa0329b8653c801147986f8d446";
-  inputs.flake-compat = { url = "github:edolstra/flake-compat"; flake = false; };
+  inputs.flake-compat = {
+    url = "github:edolstra/flake-compat";
+    flake = false;
+  };
 
   # dev tooling
   inputs.flake-parts.url = "github:hercules-ci/flake-parts";
@@ -18,8 +21,13 @@
   inputs.git-hooks-nix.inputs.flake-compat.follows = "";
   inputs.git-hooks-nix.inputs.gitignore.follows = "";
 
-  outputs = inputs@{ self, nixpkgs, nixpkgs-regression, ... }:
-
+  outputs =
+    inputs@{
+      self,
+      nixpkgs,
+      nixpkgs-regression,
+      ...
+    }:
 
     let
       inherit (nixpkgs) lib;
@@ -27,9 +35,15 @@
       officialRelease = true;
 
       linux32BitSystems = [ "i686-linux" ];
-      linux64BitSystems = [ "x86_64-linux" "aarch64-linux" ];
+      linux64BitSystems = [
+        "x86_64-linux"
+        "aarch64-linux"
+      ];
       linuxSystems = linux32BitSystems ++ linux64BitSystems;
-      darwinSystems = [ "x86_64-darwin" "aarch64-darwin" ];
+      darwinSystems = [
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
       systems = linuxSystems ++ darwinSystems;
 
       crossSystems = [
@@ -59,63 +73,77 @@
         (Provided that the names are unique.)
 
         See https://nixos.org/manual/nixpkgs/stable/index.html#function-library-lib.attrsets.concatMapAttrs
-       */
+      */
       flatMapAttrs = attrs: f: lib.concatMapAttrs f attrs;
 
       forAllSystems = lib.genAttrs systems;
 
       forAllCrossSystems = lib.genAttrs crossSystems;
 
-      forAllStdenvs = f:
-        lib.listToAttrs
-          (map
-            (stdenvName: {
-              name = "${stdenvName}Packages";
-              value = f stdenvName;
-            })
-            stdenvs);
-
+      forAllStdenvs =
+        f:
+        lib.listToAttrs (
+          map (stdenvName: {
+            name = "${stdenvName}Packages";
+            value = f stdenvName;
+          }) stdenvs
+        );
 
       # We don't apply flake-parts to the whole flake so that non-development attributes
       # load without fetching any development inputs.
       devFlake = inputs.flake-parts.lib.mkFlake { inherit inputs; } {
         imports = [ ./maintainers/flake-module.nix ];
         systems = lib.subtractLists crossSystems systems;
-        perSystem = { system, ... }: {
-          _module.args.pkgs = nixpkgsFor.${system}.native;
-        };
+        perSystem =
+          { system, ... }:
+          {
+            _module.args.pkgs = nixpkgsFor.${system}.native;
+          };
       };
 
       # Memoize nixpkgs for different platforms for efficiency.
-      nixpkgsFor = forAllSystems
-        (system: let
-          make-pkgs = crossSystem: stdenv: import nixpkgs {
-            localSystem = {
-              inherit system;
+      nixpkgsFor = forAllSystems (
+        system:
+        let
+          make-pkgs =
+            crossSystem: stdenv:
+            import nixpkgs {
+              localSystem = {
+                inherit system;
+              };
+              crossSystem =
+                if crossSystem == null then
+                  null
+                else
+                  {
+                    config = crossSystem;
+                  }
+                  // lib.optionalAttrs (crossSystem == "x86_64-unknown-freebsd13") {
+                    useLLVM = true;
+                  };
+              overlays = [
+                (overlayFor (p: p.${stdenv}))
+              ];
             };
-            crossSystem = if crossSystem == null then null else {
-              config = crossSystem;
-            } // lib.optionalAttrs (crossSystem == "x86_64-unknown-freebsd13") {
-              useLLVM = true;
-            };
-            overlays = [
-              (overlayFor (p: p.${stdenv}))
-            ];
-          };
           stdenvs = forAllStdenvs (make-pkgs null);
           native = stdenvs.stdenvPackages;
-        in {
+        in
+        {
           inherit stdenvs native;
           static = native.pkgsStatic;
           llvm = native.pkgsLLVM;
           cross = forAllCrossSystems (crossSystem: make-pkgs crossSystem "stdenv");
-        });
+        }
+      );
 
-      binaryTarball = nix: pkgs: pkgs.callPackage ./scripts/binary-tarball.nix {
-        inherit nix;
-      };
+      binaryTarball =
+        nix: pkgs:
+        pkgs.callPackage ./scripts/binary-tarball.nix {
+          inherit nix;
+        };
 
-      overlayFor = getStdenv: final: prev:
+      overlayFor =
+        getStdenv: final: prev:
         let
           stdenv = getStdenv final;
         in
@@ -162,12 +190,19 @@
           # See https://github.com/NixOS/nixpkgs/pull/214409
           # Remove when fixed in this flake's nixpkgs
           pre-commit =
-            if prev.stdenv.hostPlatform.system == "i686-linux"
-            then (prev.pre-commit.override (o: { dotnet-sdk = ""; })).overridePythonAttrs (o: { doCheck = false; })
-            else prev.pre-commit;
+            if prev.stdenv.hostPlatform.system == "i686-linux" then
+              (prev.pre-commit.override (o: {
+                dotnet-sdk = "";
+              })).overridePythonAttrs
+                (o: {
+                  doCheck = false;
+                })
+            else
+              prev.pre-commit;
         };
 
-    in {
+    in
+    {
       # A Nixpkgs overlay that overrides the 'nix' and
       # 'nix-perl-bindings' packages.
       overlays.default = overlayFor (p: p.stdenv);
@@ -186,53 +221,69 @@
           ;
       };
 
-      checks = forAllSystems (system: {
-        installerScriptForGHA = self.hydraJobs.installerScriptForGHA.${system};
-        installTests = self.hydraJobs.installTests.${system};
-        nixpkgsLibTests = self.hydraJobs.tests.nixpkgsLibTests.${system};
-        rl-next =
-          let pkgs = nixpkgsFor.${system}.native;
-          in pkgs.buildPackages.runCommand "test-rl-next-release-notes" { } ''
-          LANG=C.UTF-8 ${pkgs.changelog-d}/bin/changelog-d ${./doc/manual/rl-next} >$out
-        '';
-        repl-completion = nixpkgsFor.${system}.native.callPackage ./tests/repl-completion.nix { };
-      } // (lib.optionalAttrs (builtins.elem system linux64BitSystems)) {
-        dockerImage = self.hydraJobs.dockerImage.${system};
-      } // (lib.optionalAttrs (!(builtins.elem system linux32BitSystems))) {
-        # Some perl dependencies are broken on i686-linux.
-        # Since the support is only best-effort there, disable the perl
-        # bindings
-        perlBindings = self.hydraJobs.perlBindings.${system};
-      }
-      # Add "passthru" tests
-      // flatMapAttrs ({
-          "" = nixpkgsFor.${system}.native;
-        } // lib.optionalAttrs (! nixpkgsFor.${system}.native.stdenv.hostPlatform.isDarwin) {
-          # TODO: enable static builds for darwin, blocked on:
-          #       https://github.com/NixOS/nixpkgs/issues/320448
-          # TODO: disabled to speed up GHA CI.
-          #"static-" = nixpkgsFor.${system}.static;
-        })
-        (nixpkgsPrefix: nixpkgs:
-          flatMapAttrs nixpkgs.nixComponents
-            (pkgName: pkg:
-              flatMapAttrs pkg.tests or {}
-              (testName: test: {
-                "${nixpkgsPrefix}${pkgName}-${testName}" = test;
-              })
+      checks = forAllSystems (
+        system:
+        {
+          installerScriptForGHA = self.hydraJobs.installerScriptForGHA.${system};
+          installTests = self.hydraJobs.installTests.${system};
+          nixpkgsLibTests = self.hydraJobs.tests.nixpkgsLibTests.${system};
+          rl-next =
+            let
+              pkgs = nixpkgsFor.${system}.native;
+            in
+            pkgs.buildPackages.runCommand "test-rl-next-release-notes" { } ''
+              LANG=C.UTF-8 ${pkgs.changelog-d}/bin/changelog-d ${./doc/manual/rl-next} >$out
+            '';
+          repl-completion = nixpkgsFor.${system}.native.callPackage ./tests/repl-completion.nix { };
+        }
+        // (lib.optionalAttrs (builtins.elem system linux64BitSystems)) {
+          dockerImage = self.hydraJobs.dockerImage.${system};
+        }
+        // (lib.optionalAttrs (!(builtins.elem system linux32BitSystems))) {
+          # Some perl dependencies are broken on i686-linux.
+          # Since the support is only best-effort there, disable the perl
+          # bindings
+          perlBindings = self.hydraJobs.perlBindings.${system};
+        }
+        # Add "passthru" tests
+        //
+          flatMapAttrs
+            (
+              {
+                "" = nixpkgsFor.${system}.native;
+              }
+              // lib.optionalAttrs (!nixpkgsFor.${system}.native.stdenv.hostPlatform.isDarwin) {
+                # TODO: enable static builds for darwin, blocked on:
+                #       https://github.com/NixOS/nixpkgs/issues/320448
+                # TODO: disabled to speed up GHA CI.
+                #"static-" = nixpkgsFor.${system}.static;
+              }
             )
-          // lib.optionalAttrs (nixpkgs.stdenv.hostPlatform == nixpkgs.stdenv.buildPlatform) {
-            "${nixpkgsPrefix}nix-functional-tests" = nixpkgs.nixComponents.nix-functional-tests;
-          }
-        )
-      // devFlake.checks.${system} or {}
+            (
+              nixpkgsPrefix: nixpkgs:
+              flatMapAttrs nixpkgs.nixComponents (
+                pkgName: pkg:
+                flatMapAttrs pkg.tests or { } (
+                  testName: test: {
+                    "${nixpkgsPrefix}${pkgName}-${testName}" = test;
+                  }
+                )
+              )
+              // lib.optionalAttrs (nixpkgs.stdenv.hostPlatform == nixpkgs.stdenv.buildPlatform) {
+                "${nixpkgsPrefix}nix-functional-tests" = nixpkgs.nixComponents.nix-functional-tests;
+              }
+            )
+        // devFlake.checks.${system} or { }
       );
 
-      packages = forAllSystems (system:
-        { # Here we put attributes that map 1:1 into packages.<system>, ie
+      packages = forAllSystems (
+        system:
+        {
+          # Here we put attributes that map 1:1 into packages.<system>, ie
           # for which we don't apply the full build matrix such as cross or static.
           inherit (nixpkgsFor.${system}.native)
-            changelog-d;
+            changelog-d
+            ;
           default = self.packages.${system}.nix;
           installerScriptForGHA = self.hydraJobs.installerScriptForGHA.${system};
           binaryTarball = self.hydraJobs.binaryTarball.${system};
@@ -243,96 +294,143 @@
           nix-external-api-docs = nixpkgsFor.${system}.native.nixComponents.nix-external-api-docs;
         }
         # We need to flatten recursive attribute sets of derivations to pass `flake check`.
-        // flatMapAttrs
-          { # Components we'll iterate over in the upcoming lambda
-            "nix-util" = { };
-            "nix-util-c" = { };
-            "nix-util-test-support" = { };
-            "nix-util-tests" = { };
+        //
+          flatMapAttrs
+            {
+              # Components we'll iterate over in the upcoming lambda
+              "nix-util" = { };
+              "nix-util-c" = { };
+              "nix-util-test-support" = { };
+              "nix-util-tests" = { };
 
-            "nix-store" = { };
-            "nix-store-c" = { };
-            "nix-store-test-support" = { };
-            "nix-store-tests" = { };
+              "nix-store" = { };
+              "nix-store-c" = { };
+              "nix-store-test-support" = { };
+              "nix-store-tests" = { };
 
-            "nix-fetchers" = { };
-            "nix-fetchers-tests" = { };
+              "nix-fetchers" = { };
+              "nix-fetchers-tests" = { };
 
-            "nix-expr" = { };
-            "nix-expr-c" = { };
-            "nix-expr-test-support" = { };
-            "nix-expr-tests" = { };
+              "nix-expr" = { };
+              "nix-expr-c" = { };
+              "nix-expr-test-support" = { };
+              "nix-expr-tests" = { };
 
-            "nix-flake" = { };
-            "nix-flake-tests" = { };
+              "nix-flake" = { };
+              "nix-flake-tests" = { };
 
-            "nix-main" = { };
-            "nix-main-c" = { };
+              "nix-main" = { };
+              "nix-main-c" = { };
 
-            "nix-cmd" = { };
+              "nix-cmd" = { };
 
-            "nix-cli" = { };
+              "nix-cli" = { };
 
-            "nix-everything" = { };
+              "nix-everything" = { };
 
-            "nix-functional-tests" = { supportsCross = false; };
+              "nix-functional-tests" = {
+                supportsCross = false;
+              };
 
-            "nix-perl-bindings" = { supportsCross = false; };
-          }
-          (pkgName: { supportsCross ? true }: {
-              # These attributes go right into `packages.<system>`.
-              "${pkgName}" = nixpkgsFor.${system}.native.nixComponents.${pkgName};
-              "${pkgName}-static" = nixpkgsFor.${system}.static.nixComponents.${pkgName};
-              "${pkgName}-llvm" = nixpkgsFor.${system}.llvm.nixComponents.${pkgName};
+              "nix-perl-bindings" = {
+                supportsCross = false;
+              };
             }
-            // lib.optionalAttrs supportsCross (flatMapAttrs (lib.genAttrs crossSystems (_: { })) (crossSystem: {}: {
-              # These attributes go right into `packages.<system>`.
-              "${pkgName}-${crossSystem}" = nixpkgsFor.${system}.cross.${crossSystem}.nixComponents.${pkgName};
-            }))
-            // flatMapAttrs (lib.genAttrs stdenvs (_: { })) (stdenvName: {}: {
-              # These attributes go right into `packages.<system>`.
-              "${pkgName}-${stdenvName}" = nixpkgsFor.${system}.stdenvs."${stdenvName}Packages".nixComponents.${pkgName};
-            })
-          )
+            (
+              pkgName:
+              {
+                supportsCross ? true,
+              }:
+              {
+                # These attributes go right into `packages.<system>`.
+                "${pkgName}" = nixpkgsFor.${system}.native.nixComponents.${pkgName};
+                "${pkgName}-static" = nixpkgsFor.${system}.static.nixComponents.${pkgName};
+                "${pkgName}-llvm" = nixpkgsFor.${system}.llvm.nixComponents.${pkgName};
+              }
+              // lib.optionalAttrs supportsCross (
+                flatMapAttrs (lib.genAttrs crossSystems (_: { })) (
+                  crossSystem:
+                  { }:
+                  {
+                    # These attributes go right into `packages.<system>`.
+                    "${pkgName}-${crossSystem}" = nixpkgsFor.${system}.cross.${crossSystem}.nixComponents.${pkgName};
+                  }
+                )
+              )
+              // flatMapAttrs (lib.genAttrs stdenvs (_: { })) (
+                stdenvName:
+                { }:
+                {
+                  # These attributes go right into `packages.<system>`.
+                  "${pkgName}-${stdenvName}" =
+                    nixpkgsFor.${system}.stdenvs."${stdenvName}Packages".nixComponents.${pkgName};
+                }
+              )
+            )
         // lib.optionalAttrs (builtins.elem system linux64BitSystems) {
-        dockerImage =
-          let
-            pkgs = nixpkgsFor.${system}.native;
-            image = import ./docker.nix { inherit pkgs; tag = pkgs.nix.version; };
-          in
-          pkgs.runCommand
-            "docker-image-tarball-${pkgs.nix.version}"
-            { meta.description = "Docker image with Nix for ${system}"; }
-            ''
-              mkdir -p $out/nix-support
-              image=$out/image.tar.gz
-              ln -s ${image} $image
-              echo "file binary-dist $image" >> $out/nix-support/hydra-build-products
-            '';
-      });
+          dockerImage =
+            let
+              pkgs = nixpkgsFor.${system}.native;
+              image = import ./docker.nix {
+                inherit pkgs;
+                tag = pkgs.nix.version;
+              };
+            in
+            pkgs.runCommand "docker-image-tarball-${pkgs.nix.version}"
+              { meta.description = "Docker image with Nix for ${system}"; }
+              ''
+                mkdir -p $out/nix-support
+                image=$out/image.tar.gz
+                ln -s ${image} $image
+                echo "file binary-dist $image" >> $out/nix-support/hydra-build-products
+              '';
+        }
+      );
 
-      devShells = let
-        makeShell = import ./packaging/dev-shell.nix { inherit lib devFlake; };
-        prefixAttrs = prefix: lib.concatMapAttrs (k: v: { "${prefix}-${k}" = v; });
-      in
-        forAllSystems (system:
-          prefixAttrs "native" (forAllStdenvs (stdenvName: makeShell {
-            pkgs = nixpkgsFor.${system}.stdenvs."${stdenvName}Packages";
-          })) //
-          lib.optionalAttrs (!nixpkgsFor.${system}.native.stdenv.isDarwin) (
-            prefixAttrs "static" (forAllStdenvs (stdenvName: makeShell {
-              pkgs = nixpkgsFor.${system}.stdenvs."${stdenvName}Packages".pkgsStatic;
-            })) //
-            prefixAttrs "llvm" (forAllStdenvs (stdenvName: makeShell {
-              pkgs = nixpkgsFor.${system}.stdenvs."${stdenvName}Packages".pkgsLLVM;
-            })) //
-            prefixAttrs "cross" (forAllCrossSystems (crossSystem: makeShell {
-              pkgs = nixpkgsFor.${system}.cross.${crossSystem};
-            }))
-          ) //
-          {
+      devShells =
+        let
+          makeShell = import ./packaging/dev-shell.nix { inherit lib devFlake; };
+          prefixAttrs = prefix: lib.concatMapAttrs (k: v: { "${prefix}-${k}" = v; });
+        in
+        forAllSystems (
+          system:
+          prefixAttrs "native" (
+            forAllStdenvs (
+              stdenvName:
+              makeShell {
+                pkgs = nixpkgsFor.${system}.stdenvs."${stdenvName}Packages";
+              }
+            )
+          )
+          // lib.optionalAttrs (!nixpkgsFor.${system}.native.stdenv.isDarwin) (
+            prefixAttrs "static" (
+              forAllStdenvs (
+                stdenvName:
+                makeShell {
+                  pkgs = nixpkgsFor.${system}.stdenvs."${stdenvName}Packages".pkgsStatic;
+                }
+              )
+            )
+            // prefixAttrs "llvm" (
+              forAllStdenvs (
+                stdenvName:
+                makeShell {
+                  pkgs = nixpkgsFor.${system}.stdenvs."${stdenvName}Packages".pkgsLLVM;
+                }
+              )
+            )
+            // prefixAttrs "cross" (
+              forAllCrossSystems (
+                crossSystem:
+                makeShell {
+                  pkgs = nixpkgsFor.${system}.cross.${crossSystem};
+                }
+              )
+            )
+          )
+          // {
             default = self.devShells.${system}.native-stdenvPackages;
           }
         );
-  };
+    };
 }
diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index fcf370b71..9b2c6dcbf 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -1,669 +1,676 @@
-{ lib, getSystem, inputs, ... }:
+{
+  lib,
+  getSystem,
+  inputs,
+  ...
+}:
 
 {
   imports = [
     inputs.git-hooks-nix.flakeModule
   ];
 
-  perSystem = { config, pkgs, ... }: {
+  perSystem =
+    { config, pkgs, ... }:
+    {
 
-    # https://flake.parts/options/git-hooks-nix#options
-    pre-commit.settings = {
-      hooks = {
-        # Conflicts are usually found by other checks, but not those in docs,
-        # and potentially other places.
-        check-merge-conflicts.enable = true;
-        # built-in check-merge-conflicts seems ineffective against those produced by mergify backports
-        check-merge-conflicts-2 = {
-          enable = true;
-          entry = "${pkgs.writeScript "check-merge-conflicts" ''
-            #!${pkgs.runtimeShell}
-            conflicts=false
-            for file in "$@"; do
-              if grep --with-filename --line-number -E '^>>>>>>> ' -- "$file"; then
-                conflicts=true
+      # https://flake.parts/options/git-hooks-nix#options
+      pre-commit.settings = {
+        hooks = {
+          # Conflicts are usually found by other checks, but not those in docs,
+          # and potentially other places.
+          check-merge-conflicts.enable = true;
+          # built-in check-merge-conflicts seems ineffective against those produced by mergify backports
+          check-merge-conflicts-2 = {
+            enable = true;
+            entry = "${pkgs.writeScript "check-merge-conflicts" ''
+              #!${pkgs.runtimeShell}
+              conflicts=false
+              for file in "$@"; do
+                if grep --with-filename --line-number -E '^>>>>>>> ' -- "$file"; then
+                  conflicts=true
+                fi
+              done
+              if $conflicts; then
+                echo "ERROR: found merge/patch conflicts in files"
+                exit 1
               fi
-            done
-            if $conflicts; then
-              echo "ERROR: found merge/patch conflicts in files"
-              exit 1
-            fi
-            touch $out
-          ''}";
-        };
-        clang-format = {
-          enable = true;
-          # https://github.com/cachix/git-hooks.nix/pull/532
-          package = pkgs.llvmPackages_latest.clang-tools;
-          excludes = [
-            # We don't want to format test data
-            # ''tests/(?!nixos/).*\.nix''
-            ''^src/[^/]*-tests/data/.*$''
+              touch $out
+            ''}";
+          };
+          clang-format = {
+            enable = true;
+            # https://github.com/cachix/git-hooks.nix/pull/532
+            package = pkgs.llvmPackages_latest.clang-tools;
+            excludes = [
+              # We don't want to format test data
+              # ''tests/(?!nixos/).*\.nix''
+              ''^src/[^/]*-tests/data/.*$''
 
-            # Don't format vendored code
-            ''^doc/manual/redirects\.js$''
-            ''^doc/manual/theme/highlight\.js$''
+              # Don't format vendored code
+              ''^doc/manual/redirects\.js$''
+              ''^doc/manual/theme/highlight\.js$''
 
-            # We haven't applied formatting to these files yet
-            ''^doc/manual/redirects\.js$''
-            ''^doc/manual/theme/highlight\.js$''
-            ''^precompiled-headers\.h$''
-            ''^src/build-remote/build-remote\.cc$''
-            ''^src/libcmd/built-path\.cc$''
-            ''^src/libcmd/built-path\.hh$''
-            ''^src/libcmd/common-eval-args\.cc$''
-            ''^src/libcmd/common-eval-args\.hh$''
-            ''^src/libcmd/editor-for\.cc$''
-            ''^src/libcmd/installable-attr-path\.cc$''
-            ''^src/libcmd/installable-attr-path\.hh$''
-            ''^src/libcmd/installable-derived-path\.cc$''
-            ''^src/libcmd/installable-derived-path\.hh$''
-            ''^src/libcmd/installable-flake\.cc$''
-            ''^src/libcmd/installable-flake\.hh$''
-            ''^src/libcmd/installable-value\.cc$''
-            ''^src/libcmd/installable-value\.hh$''
-            ''^src/libcmd/installables\.cc$''
-            ''^src/libcmd/installables\.hh$''
-            ''^src/libcmd/legacy\.hh$''
-            ''^src/libcmd/markdown\.cc$''
-            ''^src/libcmd/misc-store-flags\.cc$''
-            ''^src/libcmd/repl-interacter\.cc$''
-            ''^src/libcmd/repl-interacter\.hh$''
-            ''^src/libcmd/repl\.cc$''
-            ''^src/libcmd/repl\.hh$''
-            ''^src/libexpr-c/nix_api_expr\.cc$''
-            ''^src/libexpr-c/nix_api_external\.cc$''
-            ''^src/libexpr/attr-path\.cc$''
-            ''^src/libexpr/attr-path\.hh$''
-            ''^src/libexpr/attr-set\.cc$''
-            ''^src/libexpr/attr-set\.hh$''
-            ''^src/libexpr/eval-cache\.cc$''
-            ''^src/libexpr/eval-cache\.hh$''
-            ''^src/libexpr/eval-error\.cc$''
-            ''^src/libexpr/eval-inline\.hh$''
-            ''^src/libexpr/eval-settings\.cc$''
-            ''^src/libexpr/eval-settings\.hh$''
-            ''^src/libexpr/eval\.cc$''
-            ''^src/libexpr/eval\.hh$''
-            ''^src/libexpr/function-trace\.cc$''
-            ''^src/libexpr/gc-small-vector\.hh$''
-            ''^src/libexpr/get-drvs\.cc$''
-            ''^src/libexpr/get-drvs\.hh$''
-            ''^src/libexpr/json-to-value\.cc$''
-            ''^src/libexpr/nixexpr\.cc$''
-            ''^src/libexpr/nixexpr\.hh$''
-            ''^src/libexpr/parser-state\.hh$''
-            ''^src/libexpr/pos-table\.hh$''
-            ''^src/libexpr/primops\.cc$''
-            ''^src/libexpr/primops\.hh$''
-            ''^src/libexpr/primops/context\.cc$''
-            ''^src/libexpr/primops/fetchClosure\.cc$''
-            ''^src/libexpr/primops/fetchMercurial\.cc$''
-            ''^src/libexpr/primops/fetchTree\.cc$''
-            ''^src/libexpr/primops/fromTOML\.cc$''
-            ''^src/libexpr/print-ambiguous\.cc$''
-            ''^src/libexpr/print-ambiguous\.hh$''
-            ''^src/libexpr/print-options\.hh$''
-            ''^src/libexpr/print\.cc$''
-            ''^src/libexpr/print\.hh$''
-            ''^src/libexpr/search-path\.cc$''
-            ''^src/libexpr/symbol-table\.hh$''
-            ''^src/libexpr/value-to-json\.cc$''
-            ''^src/libexpr/value-to-json\.hh$''
-            ''^src/libexpr/value-to-xml\.cc$''
-            ''^src/libexpr/value-to-xml\.hh$''
-            ''^src/libexpr/value\.hh$''
-            ''^src/libexpr/value/context\.cc$''
-            ''^src/libexpr/value/context\.hh$''
-            ''^src/libfetchers/attrs\.cc$''
-            ''^src/libfetchers/cache\.cc$''
-            ''^src/libfetchers/cache\.hh$''
-            ''^src/libfetchers/fetch-settings\.cc$''
-            ''^src/libfetchers/fetch-settings\.hh$''
-            ''^src/libfetchers/fetch-to-store\.cc$''
-            ''^src/libfetchers/fetchers\.cc$''
-            ''^src/libfetchers/fetchers\.hh$''
-            ''^src/libfetchers/filtering-source-accessor\.cc$''
-            ''^src/libfetchers/filtering-source-accessor\.hh$''
-            ''^src/libfetchers/fs-source-accessor\.cc$''
-            ''^src/libfetchers/fs-source-accessor\.hh$''
-            ''^src/libfetchers/git-utils\.cc$''
-            ''^src/libfetchers/git-utils\.hh$''
-            ''^src/libfetchers/github\.cc$''
-            ''^src/libfetchers/indirect\.cc$''
-            ''^src/libfetchers/memory-source-accessor\.cc$''
-            ''^src/libfetchers/path\.cc$''
-            ''^src/libfetchers/registry\.cc$''
-            ''^src/libfetchers/registry\.hh$''
-            ''^src/libfetchers/tarball\.cc$''
-            ''^src/libfetchers/tarball\.hh$''
-            ''^src/libfetchers/git\.cc$''
-            ''^src/libfetchers/mercurial\.cc$''
-            ''^src/libflake/flake/config\.cc$''
-            ''^src/libflake/flake/flake\.cc$''
-            ''^src/libflake/flake/flake\.hh$''
-            ''^src/libflake/flake/flakeref\.cc$''
-            ''^src/libflake/flake/flakeref\.hh$''
-            ''^src/libflake/flake/lockfile\.cc$''
-            ''^src/libflake/flake/lockfile\.hh$''
-            ''^src/libflake/flake/url-name\.cc$''
-            ''^src/libmain/common-args\.cc$''
-            ''^src/libmain/common-args\.hh$''
-            ''^src/libmain/loggers\.cc$''
-            ''^src/libmain/loggers\.hh$''
-            ''^src/libmain/progress-bar\.cc$''
-            ''^src/libmain/shared\.cc$''
-            ''^src/libmain/shared\.hh$''
-            ''^src/libmain/unix/stack\.cc$''
-            ''^src/libstore/binary-cache-store\.cc$''
-            ''^src/libstore/binary-cache-store\.hh$''
-            ''^src/libstore/build-result\.hh$''
-            ''^src/libstore/builtins\.hh$''
-            ''^src/libstore/builtins/buildenv\.cc$''
-            ''^src/libstore/builtins/buildenv\.hh$''
-            ''^src/libstore/common-protocol-impl\.hh$''
-            ''^src/libstore/common-protocol\.cc$''
-            ''^src/libstore/common-protocol\.hh$''
-            ''^src/libstore/common-ssh-store-config\.hh$''
-            ''^src/libstore/content-address\.cc$''
-            ''^src/libstore/content-address\.hh$''
-            ''^src/libstore/daemon\.cc$''
-            ''^src/libstore/daemon\.hh$''
-            ''^src/libstore/derivations\.cc$''
-            ''^src/libstore/derivations\.hh$''
-            ''^src/libstore/derived-path-map\.cc$''
-            ''^src/libstore/derived-path-map\.hh$''
-            ''^src/libstore/derived-path\.cc$''
-            ''^src/libstore/derived-path\.hh$''
-            ''^src/libstore/downstream-placeholder\.cc$''
-            ''^src/libstore/downstream-placeholder\.hh$''
-            ''^src/libstore/dummy-store\.cc$''
-            ''^src/libstore/export-import\.cc$''
-            ''^src/libstore/filetransfer\.cc$''
-            ''^src/libstore/filetransfer\.hh$''
-            ''^src/libstore/gc-store\.hh$''
-            ''^src/libstore/globals\.cc$''
-            ''^src/libstore/globals\.hh$''
-            ''^src/libstore/http-binary-cache-store\.cc$''
-            ''^src/libstore/legacy-ssh-store\.cc$''
-            ''^src/libstore/legacy-ssh-store\.hh$''
-            ''^src/libstore/length-prefixed-protocol-helper\.hh$''
-            ''^src/libstore/linux/personality\.cc$''
-            ''^src/libstore/linux/personality\.hh$''
-            ''^src/libstore/local-binary-cache-store\.cc$''
-            ''^src/libstore/local-fs-store\.cc$''
-            ''^src/libstore/local-fs-store\.hh$''
-            ''^src/libstore/log-store\.cc$''
-            ''^src/libstore/log-store\.hh$''
-            ''^src/libstore/machines\.cc$''
-            ''^src/libstore/machines\.hh$''
-            ''^src/libstore/make-content-addressed\.cc$''
-            ''^src/libstore/make-content-addressed\.hh$''
-            ''^src/libstore/misc\.cc$''
-            ''^src/libstore/names\.cc$''
-            ''^src/libstore/names\.hh$''
-            ''^src/libstore/nar-accessor\.cc$''
-            ''^src/libstore/nar-accessor\.hh$''
-            ''^src/libstore/nar-info-disk-cache\.cc$''
-            ''^src/libstore/nar-info-disk-cache\.hh$''
-            ''^src/libstore/nar-info\.cc$''
-            ''^src/libstore/nar-info\.hh$''
-            ''^src/libstore/outputs-spec\.cc$''
-            ''^src/libstore/outputs-spec\.hh$''
-            ''^src/libstore/parsed-derivations\.cc$''
-            ''^src/libstore/path-info\.cc$''
-            ''^src/libstore/path-info\.hh$''
-            ''^src/libstore/path-references\.cc$''
-            ''^src/libstore/path-regex\.hh$''
-            ''^src/libstore/path-with-outputs\.cc$''
-            ''^src/libstore/path\.cc$''
-            ''^src/libstore/path\.hh$''
-            ''^src/libstore/pathlocks\.cc$''
-            ''^src/libstore/pathlocks\.hh$''
-            ''^src/libstore/profiles\.cc$''
-            ''^src/libstore/profiles\.hh$''
-            ''^src/libstore/realisation\.cc$''
-            ''^src/libstore/realisation\.hh$''
-            ''^src/libstore/remote-fs-accessor\.cc$''
-            ''^src/libstore/remote-fs-accessor\.hh$''
-            ''^src/libstore/remote-store-connection\.hh$''
-            ''^src/libstore/remote-store\.cc$''
-            ''^src/libstore/remote-store\.hh$''
-            ''^src/libstore/s3-binary-cache-store\.cc$''
-            ''^src/libstore/s3\.hh$''
-            ''^src/libstore/serve-protocol-impl\.cc$''
-            ''^src/libstore/serve-protocol-impl\.hh$''
-            ''^src/libstore/serve-protocol\.cc$''
-            ''^src/libstore/serve-protocol\.hh$''
-            ''^src/libstore/sqlite\.cc$''
-            ''^src/libstore/sqlite\.hh$''
-            ''^src/libstore/ssh-store\.cc$''
-            ''^src/libstore/ssh\.cc$''
-            ''^src/libstore/ssh\.hh$''
-            ''^src/libstore/store-api\.cc$''
-            ''^src/libstore/store-api\.hh$''
-            ''^src/libstore/store-dir-config\.hh$''
-            ''^src/libstore/build/derivation-goal\.cc$''
-            ''^src/libstore/build/derivation-goal\.hh$''
-            ''^src/libstore/build/drv-output-substitution-goal\.cc$''
-            ''^src/libstore/build/drv-output-substitution-goal\.hh$''
-            ''^src/libstore/build/entry-points\.cc$''
-            ''^src/libstore/build/goal\.cc$''
-            ''^src/libstore/build/goal\.hh$''
-            ''^src/libstore/unix/build/hook-instance\.cc$''
-            ''^src/libstore/unix/build/local-derivation-goal\.cc$''
-            ''^src/libstore/unix/build/local-derivation-goal\.hh$''
-            ''^src/libstore/build/substitution-goal\.cc$''
-            ''^src/libstore/build/substitution-goal\.hh$''
-            ''^src/libstore/build/worker\.cc$''
-            ''^src/libstore/build/worker\.hh$''
-            ''^src/libstore/builtins/fetchurl\.cc$''
-            ''^src/libstore/builtins/unpack-channel\.cc$''
-            ''^src/libstore/gc\.cc$''
-            ''^src/libstore/local-overlay-store\.cc$''
-            ''^src/libstore/local-overlay-store\.hh$''
-            ''^src/libstore/local-store\.cc$''
-            ''^src/libstore/local-store\.hh$''
-            ''^src/libstore/unix/user-lock\.cc$''
-            ''^src/libstore/unix/user-lock\.hh$''
-            ''^src/libstore/optimise-store\.cc$''
-            ''^src/libstore/unix/pathlocks\.cc$''
-            ''^src/libstore/posix-fs-canonicalise\.cc$''
-            ''^src/libstore/posix-fs-canonicalise\.hh$''
-            ''^src/libstore/uds-remote-store\.cc$''
-            ''^src/libstore/uds-remote-store\.hh$''
-            ''^src/libstore/windows/build\.cc$''
-            ''^src/libstore/worker-protocol-impl\.hh$''
-            ''^src/libstore/worker-protocol\.cc$''
-            ''^src/libstore/worker-protocol\.hh$''
-            ''^src/libutil-c/nix_api_util_internal\.h$''
-            ''^src/libutil/archive\.cc$''
-            ''^src/libutil/archive\.hh$''
-            ''^src/libutil/args\.cc$''
-            ''^src/libutil/args\.hh$''
-            ''^src/libutil/args/root\.hh$''
-            ''^src/libutil/callback\.hh$''
-            ''^src/libutil/canon-path\.cc$''
-            ''^src/libutil/canon-path\.hh$''
-            ''^src/libutil/chunked-vector\.hh$''
-            ''^src/libutil/closure\.hh$''
-            ''^src/libutil/comparator\.hh$''
-            ''^src/libutil/compute-levels\.cc$''
-            ''^src/libutil/config-impl\.hh$''
-            ''^src/libutil/config\.cc$''
-            ''^src/libutil/config\.hh$''
-            ''^src/libutil/current-process\.cc$''
-            ''^src/libutil/current-process\.hh$''
-            ''^src/libutil/english\.cc$''
-            ''^src/libutil/english\.hh$''
-            ''^src/libutil/error\.cc$''
-            ''^src/libutil/error\.hh$''
-            ''^src/libutil/exit\.hh$''
-            ''^src/libutil/experimental-features\.cc$''
-            ''^src/libutil/experimental-features\.hh$''
-            ''^src/libutil/file-content-address\.cc$''
-            ''^src/libutil/file-content-address\.hh$''
-            ''^src/libutil/file-descriptor\.cc$''
-            ''^src/libutil/file-descriptor\.hh$''
-            ''^src/libutil/file-path-impl\.hh$''
-            ''^src/libutil/file-path\.hh$''
-            ''^src/libutil/file-system\.cc$''
-            ''^src/libutil/file-system\.hh$''
-            ''^src/libutil/finally\.hh$''
-            ''^src/libutil/fmt\.hh$''
-            ''^src/libutil/fs-sink\.cc$''
-            ''^src/libutil/fs-sink\.hh$''
-            ''^src/libutil/git\.cc$''
-            ''^src/libutil/git\.hh$''
-            ''^src/libutil/hash\.cc$''
-            ''^src/libutil/hash\.hh$''
-            ''^src/libutil/hilite\.cc$''
-            ''^src/libutil/hilite\.hh$''
-            ''^src/libutil/source-accessor\.hh$''
-            ''^src/libutil/json-impls\.hh$''
-            ''^src/libutil/json-utils\.cc$''
-            ''^src/libutil/json-utils\.hh$''
-            ''^src/libutil/linux/cgroup\.cc$''
-            ''^src/libutil/linux/namespaces\.cc$''
-            ''^src/libutil/logging\.cc$''
-            ''^src/libutil/logging\.hh$''
-            ''^src/libutil/lru-cache\.hh$''
-            ''^src/libutil/memory-source-accessor\.cc$''
-            ''^src/libutil/memory-source-accessor\.hh$''
-            ''^src/libutil/pool\.hh$''
-            ''^src/libutil/position\.cc$''
-            ''^src/libutil/position\.hh$''
-            ''^src/libutil/posix-source-accessor\.cc$''
-            ''^src/libutil/posix-source-accessor\.hh$''
-            ''^src/libutil/processes\.hh$''
-            ''^src/libutil/ref\.hh$''
-            ''^src/libutil/references\.cc$''
-            ''^src/libutil/references\.hh$''
-            ''^src/libutil/regex-combinators\.hh$''
-            ''^src/libutil/serialise\.cc$''
-            ''^src/libutil/serialise\.hh$''
-            ''^src/libutil/signals\.hh$''
-            ''^src/libutil/signature/local-keys\.cc$''
-            ''^src/libutil/signature/local-keys\.hh$''
-            ''^src/libutil/signature/signer\.cc$''
-            ''^src/libutil/signature/signer\.hh$''
-            ''^src/libutil/source-accessor\.cc$''
-            ''^src/libutil/source-accessor\.hh$''
-            ''^src/libutil/source-path\.cc$''
-            ''^src/libutil/source-path\.hh$''
-            ''^src/libutil/split\.hh$''
-            ''^src/libutil/suggestions\.cc$''
-            ''^src/libutil/suggestions\.hh$''
-            ''^src/libutil/sync\.hh$''
-            ''^src/libutil/terminal\.cc$''
-            ''^src/libutil/terminal\.hh$''
-            ''^src/libutil/thread-pool\.cc$''
-            ''^src/libutil/thread-pool\.hh$''
-            ''^src/libutil/topo-sort\.hh$''
-            ''^src/libutil/types\.hh$''
-            ''^src/libutil/unix/file-descriptor\.cc$''
-            ''^src/libutil/unix/file-path\.cc$''
-            ''^src/libutil/unix/monitor-fd\.hh$''
-            ''^src/libutil/unix/processes\.cc$''
-            ''^src/libutil/unix/signals-impl\.hh$''
-            ''^src/libutil/unix/signals\.cc$''
-            ''^src/libutil/unix-domain-socket\.cc$''
-            ''^src/libutil/unix/users\.cc$''
-            ''^src/libutil/url-parts\.hh$''
-            ''^src/libutil/url\.cc$''
-            ''^src/libutil/url\.hh$''
-            ''^src/libutil/users\.cc$''
-            ''^src/libutil/users\.hh$''
-            ''^src/libutil/util\.cc$''
-            ''^src/libutil/util\.hh$''
-            ''^src/libutil/variant-wrapper\.hh$''
-            ''^src/libutil/widecharwidth/widechar_width\.h$'' # vendored source
-            ''^src/libutil/windows/file-descriptor\.cc$''
-            ''^src/libutil/windows/file-path\.cc$''
-            ''^src/libutil/windows/processes\.cc$''
-            ''^src/libutil/windows/users\.cc$''
-            ''^src/libutil/windows/windows-error\.cc$''
-            ''^src/libutil/windows/windows-error\.hh$''
-            ''^src/libutil/xml-writer\.cc$''
-            ''^src/libutil/xml-writer\.hh$''
-            ''^src/nix-build/nix-build\.cc$''
-            ''^src/nix-channel/nix-channel\.cc$''
-            ''^src/nix-collect-garbage/nix-collect-garbage\.cc$''
-            ''^src/nix-env/buildenv.nix$''
-            ''^src/nix-env/nix-env\.cc$''
-            ''^src/nix-env/user-env\.cc$''
-            ''^src/nix-env/user-env\.hh$''
-            ''^src/nix-instantiate/nix-instantiate\.cc$''
-            ''^src/nix-store/dotgraph\.cc$''
-            ''^src/nix-store/graphml\.cc$''
-            ''^src/nix-store/nix-store\.cc$''
-            ''^src/nix/add-to-store\.cc$''
-            ''^src/nix/app\.cc$''
-            ''^src/nix/build\.cc$''
-            ''^src/nix/bundle\.cc$''
-            ''^src/nix/cat\.cc$''
-            ''^src/nix/config-check\.cc$''
-            ''^src/nix/config\.cc$''
-            ''^src/nix/copy\.cc$''
-            ''^src/nix/derivation-add\.cc$''
-            ''^src/nix/derivation-show\.cc$''
-            ''^src/nix/derivation\.cc$''
-            ''^src/nix/develop\.cc$''
-            ''^src/nix/diff-closures\.cc$''
-            ''^src/nix/dump-path\.cc$''
-            ''^src/nix/edit\.cc$''
-            ''^src/nix/eval\.cc$''
-            ''^src/nix/flake\.cc$''
-            ''^src/nix/fmt\.cc$''
-            ''^src/nix/hash\.cc$''
-            ''^src/nix/log\.cc$''
-            ''^src/nix/ls\.cc$''
-            ''^src/nix/main\.cc$''
-            ''^src/nix/make-content-addressed\.cc$''
-            ''^src/nix/nar\.cc$''
-            ''^src/nix/optimise-store\.cc$''
-            ''^src/nix/path-from-hash-part\.cc$''
-            ''^src/nix/path-info\.cc$''
-            ''^src/nix/prefetch\.cc$''
-            ''^src/nix/profile\.cc$''
-            ''^src/nix/realisation\.cc$''
-            ''^src/nix/registry\.cc$''
-            ''^src/nix/repl\.cc$''
-            ''^src/nix/run\.cc$''
-            ''^src/nix/run\.hh$''
-            ''^src/nix/search\.cc$''
-            ''^src/nix/sigs\.cc$''
-            ''^src/nix/store-copy-log\.cc$''
-            ''^src/nix/store-delete\.cc$''
-            ''^src/nix/store-gc\.cc$''
-            ''^src/nix/store-info\.cc$''
-            ''^src/nix/store-repair\.cc$''
-            ''^src/nix/store\.cc$''
-            ''^src/nix/unix/daemon\.cc$''
-            ''^src/nix/upgrade-nix\.cc$''
-            ''^src/nix/verify\.cc$''
-            ''^src/nix/why-depends\.cc$''
+              # We haven't applied formatting to these files yet
+              ''^doc/manual/redirects\.js$''
+              ''^doc/manual/theme/highlight\.js$''
+              ''^precompiled-headers\.h$''
+              ''^src/build-remote/build-remote\.cc$''
+              ''^src/libcmd/built-path\.cc$''
+              ''^src/libcmd/built-path\.hh$''
+              ''^src/libcmd/common-eval-args\.cc$''
+              ''^src/libcmd/common-eval-args\.hh$''
+              ''^src/libcmd/editor-for\.cc$''
+              ''^src/libcmd/installable-attr-path\.cc$''
+              ''^src/libcmd/installable-attr-path\.hh$''
+              ''^src/libcmd/installable-derived-path\.cc$''
+              ''^src/libcmd/installable-derived-path\.hh$''
+              ''^src/libcmd/installable-flake\.cc$''
+              ''^src/libcmd/installable-flake\.hh$''
+              ''^src/libcmd/installable-value\.cc$''
+              ''^src/libcmd/installable-value\.hh$''
+              ''^src/libcmd/installables\.cc$''
+              ''^src/libcmd/installables\.hh$''
+              ''^src/libcmd/legacy\.hh$''
+              ''^src/libcmd/markdown\.cc$''
+              ''^src/libcmd/misc-store-flags\.cc$''
+              ''^src/libcmd/repl-interacter\.cc$''
+              ''^src/libcmd/repl-interacter\.hh$''
+              ''^src/libcmd/repl\.cc$''
+              ''^src/libcmd/repl\.hh$''
+              ''^src/libexpr-c/nix_api_expr\.cc$''
+              ''^src/libexpr-c/nix_api_external\.cc$''
+              ''^src/libexpr/attr-path\.cc$''
+              ''^src/libexpr/attr-path\.hh$''
+              ''^src/libexpr/attr-set\.cc$''
+              ''^src/libexpr/attr-set\.hh$''
+              ''^src/libexpr/eval-cache\.cc$''
+              ''^src/libexpr/eval-cache\.hh$''
+              ''^src/libexpr/eval-error\.cc$''
+              ''^src/libexpr/eval-inline\.hh$''
+              ''^src/libexpr/eval-settings\.cc$''
+              ''^src/libexpr/eval-settings\.hh$''
+              ''^src/libexpr/eval\.cc$''
+              ''^src/libexpr/eval\.hh$''
+              ''^src/libexpr/function-trace\.cc$''
+              ''^src/libexpr/gc-small-vector\.hh$''
+              ''^src/libexpr/get-drvs\.cc$''
+              ''^src/libexpr/get-drvs\.hh$''
+              ''^src/libexpr/json-to-value\.cc$''
+              ''^src/libexpr/nixexpr\.cc$''
+              ''^src/libexpr/nixexpr\.hh$''
+              ''^src/libexpr/parser-state\.hh$''
+              ''^src/libexpr/pos-table\.hh$''
+              ''^src/libexpr/primops\.cc$''
+              ''^src/libexpr/primops\.hh$''
+              ''^src/libexpr/primops/context\.cc$''
+              ''^src/libexpr/primops/fetchClosure\.cc$''
+              ''^src/libexpr/primops/fetchMercurial\.cc$''
+              ''^src/libexpr/primops/fetchTree\.cc$''
+              ''^src/libexpr/primops/fromTOML\.cc$''
+              ''^src/libexpr/print-ambiguous\.cc$''
+              ''^src/libexpr/print-ambiguous\.hh$''
+              ''^src/libexpr/print-options\.hh$''
+              ''^src/libexpr/print\.cc$''
+              ''^src/libexpr/print\.hh$''
+              ''^src/libexpr/search-path\.cc$''
+              ''^src/libexpr/symbol-table\.hh$''
+              ''^src/libexpr/value-to-json\.cc$''
+              ''^src/libexpr/value-to-json\.hh$''
+              ''^src/libexpr/value-to-xml\.cc$''
+              ''^src/libexpr/value-to-xml\.hh$''
+              ''^src/libexpr/value\.hh$''
+              ''^src/libexpr/value/context\.cc$''
+              ''^src/libexpr/value/context\.hh$''
+              ''^src/libfetchers/attrs\.cc$''
+              ''^src/libfetchers/cache\.cc$''
+              ''^src/libfetchers/cache\.hh$''
+              ''^src/libfetchers/fetch-settings\.cc$''
+              ''^src/libfetchers/fetch-settings\.hh$''
+              ''^src/libfetchers/fetch-to-store\.cc$''
+              ''^src/libfetchers/fetchers\.cc$''
+              ''^src/libfetchers/fetchers\.hh$''
+              ''^src/libfetchers/filtering-source-accessor\.cc$''
+              ''^src/libfetchers/filtering-source-accessor\.hh$''
+              ''^src/libfetchers/fs-source-accessor\.cc$''
+              ''^src/libfetchers/fs-source-accessor\.hh$''
+              ''^src/libfetchers/git-utils\.cc$''
+              ''^src/libfetchers/git-utils\.hh$''
+              ''^src/libfetchers/github\.cc$''
+              ''^src/libfetchers/indirect\.cc$''
+              ''^src/libfetchers/memory-source-accessor\.cc$''
+              ''^src/libfetchers/path\.cc$''
+              ''^src/libfetchers/registry\.cc$''
+              ''^src/libfetchers/registry\.hh$''
+              ''^src/libfetchers/tarball\.cc$''
+              ''^src/libfetchers/tarball\.hh$''
+              ''^src/libfetchers/git\.cc$''
+              ''^src/libfetchers/mercurial\.cc$''
+              ''^src/libflake/flake/config\.cc$''
+              ''^src/libflake/flake/flake\.cc$''
+              ''^src/libflake/flake/flake\.hh$''
+              ''^src/libflake/flake/flakeref\.cc$''
+              ''^src/libflake/flake/flakeref\.hh$''
+              ''^src/libflake/flake/lockfile\.cc$''
+              ''^src/libflake/flake/lockfile\.hh$''
+              ''^src/libflake/flake/url-name\.cc$''
+              ''^src/libmain/common-args\.cc$''
+              ''^src/libmain/common-args\.hh$''
+              ''^src/libmain/loggers\.cc$''
+              ''^src/libmain/loggers\.hh$''
+              ''^src/libmain/progress-bar\.cc$''
+              ''^src/libmain/shared\.cc$''
+              ''^src/libmain/shared\.hh$''
+              ''^src/libmain/unix/stack\.cc$''
+              ''^src/libstore/binary-cache-store\.cc$''
+              ''^src/libstore/binary-cache-store\.hh$''
+              ''^src/libstore/build-result\.hh$''
+              ''^src/libstore/builtins\.hh$''
+              ''^src/libstore/builtins/buildenv\.cc$''
+              ''^src/libstore/builtins/buildenv\.hh$''
+              ''^src/libstore/common-protocol-impl\.hh$''
+              ''^src/libstore/common-protocol\.cc$''
+              ''^src/libstore/common-protocol\.hh$''
+              ''^src/libstore/common-ssh-store-config\.hh$''
+              ''^src/libstore/content-address\.cc$''
+              ''^src/libstore/content-address\.hh$''
+              ''^src/libstore/daemon\.cc$''
+              ''^src/libstore/daemon\.hh$''
+              ''^src/libstore/derivations\.cc$''
+              ''^src/libstore/derivations\.hh$''
+              ''^src/libstore/derived-path-map\.cc$''
+              ''^src/libstore/derived-path-map\.hh$''
+              ''^src/libstore/derived-path\.cc$''
+              ''^src/libstore/derived-path\.hh$''
+              ''^src/libstore/downstream-placeholder\.cc$''
+              ''^src/libstore/downstream-placeholder\.hh$''
+              ''^src/libstore/dummy-store\.cc$''
+              ''^src/libstore/export-import\.cc$''
+              ''^src/libstore/filetransfer\.cc$''
+              ''^src/libstore/filetransfer\.hh$''
+              ''^src/libstore/gc-store\.hh$''
+              ''^src/libstore/globals\.cc$''
+              ''^src/libstore/globals\.hh$''
+              ''^src/libstore/http-binary-cache-store\.cc$''
+              ''^src/libstore/legacy-ssh-store\.cc$''
+              ''^src/libstore/legacy-ssh-store\.hh$''
+              ''^src/libstore/length-prefixed-protocol-helper\.hh$''
+              ''^src/libstore/linux/personality\.cc$''
+              ''^src/libstore/linux/personality\.hh$''
+              ''^src/libstore/local-binary-cache-store\.cc$''
+              ''^src/libstore/local-fs-store\.cc$''
+              ''^src/libstore/local-fs-store\.hh$''
+              ''^src/libstore/log-store\.cc$''
+              ''^src/libstore/log-store\.hh$''
+              ''^src/libstore/machines\.cc$''
+              ''^src/libstore/machines\.hh$''
+              ''^src/libstore/make-content-addressed\.cc$''
+              ''^src/libstore/make-content-addressed\.hh$''
+              ''^src/libstore/misc\.cc$''
+              ''^src/libstore/names\.cc$''
+              ''^src/libstore/names\.hh$''
+              ''^src/libstore/nar-accessor\.cc$''
+              ''^src/libstore/nar-accessor\.hh$''
+              ''^src/libstore/nar-info-disk-cache\.cc$''
+              ''^src/libstore/nar-info-disk-cache\.hh$''
+              ''^src/libstore/nar-info\.cc$''
+              ''^src/libstore/nar-info\.hh$''
+              ''^src/libstore/outputs-spec\.cc$''
+              ''^src/libstore/outputs-spec\.hh$''
+              ''^src/libstore/parsed-derivations\.cc$''
+              ''^src/libstore/path-info\.cc$''
+              ''^src/libstore/path-info\.hh$''
+              ''^src/libstore/path-references\.cc$''
+              ''^src/libstore/path-regex\.hh$''
+              ''^src/libstore/path-with-outputs\.cc$''
+              ''^src/libstore/path\.cc$''
+              ''^src/libstore/path\.hh$''
+              ''^src/libstore/pathlocks\.cc$''
+              ''^src/libstore/pathlocks\.hh$''
+              ''^src/libstore/profiles\.cc$''
+              ''^src/libstore/profiles\.hh$''
+              ''^src/libstore/realisation\.cc$''
+              ''^src/libstore/realisation\.hh$''
+              ''^src/libstore/remote-fs-accessor\.cc$''
+              ''^src/libstore/remote-fs-accessor\.hh$''
+              ''^src/libstore/remote-store-connection\.hh$''
+              ''^src/libstore/remote-store\.cc$''
+              ''^src/libstore/remote-store\.hh$''
+              ''^src/libstore/s3-binary-cache-store\.cc$''
+              ''^src/libstore/s3\.hh$''
+              ''^src/libstore/serve-protocol-impl\.cc$''
+              ''^src/libstore/serve-protocol-impl\.hh$''
+              ''^src/libstore/serve-protocol\.cc$''
+              ''^src/libstore/serve-protocol\.hh$''
+              ''^src/libstore/sqlite\.cc$''
+              ''^src/libstore/sqlite\.hh$''
+              ''^src/libstore/ssh-store\.cc$''
+              ''^src/libstore/ssh\.cc$''
+              ''^src/libstore/ssh\.hh$''
+              ''^src/libstore/store-api\.cc$''
+              ''^src/libstore/store-api\.hh$''
+              ''^src/libstore/store-dir-config\.hh$''
+              ''^src/libstore/build/derivation-goal\.cc$''
+              ''^src/libstore/build/derivation-goal\.hh$''
+              ''^src/libstore/build/drv-output-substitution-goal\.cc$''
+              ''^src/libstore/build/drv-output-substitution-goal\.hh$''
+              ''^src/libstore/build/entry-points\.cc$''
+              ''^src/libstore/build/goal\.cc$''
+              ''^src/libstore/build/goal\.hh$''
+              ''^src/libstore/unix/build/hook-instance\.cc$''
+              ''^src/libstore/unix/build/local-derivation-goal\.cc$''
+              ''^src/libstore/unix/build/local-derivation-goal\.hh$''
+              ''^src/libstore/build/substitution-goal\.cc$''
+              ''^src/libstore/build/substitution-goal\.hh$''
+              ''^src/libstore/build/worker\.cc$''
+              ''^src/libstore/build/worker\.hh$''
+              ''^src/libstore/builtins/fetchurl\.cc$''
+              ''^src/libstore/builtins/unpack-channel\.cc$''
+              ''^src/libstore/gc\.cc$''
+              ''^src/libstore/local-overlay-store\.cc$''
+              ''^src/libstore/local-overlay-store\.hh$''
+              ''^src/libstore/local-store\.cc$''
+              ''^src/libstore/local-store\.hh$''
+              ''^src/libstore/unix/user-lock\.cc$''
+              ''^src/libstore/unix/user-lock\.hh$''
+              ''^src/libstore/optimise-store\.cc$''
+              ''^src/libstore/unix/pathlocks\.cc$''
+              ''^src/libstore/posix-fs-canonicalise\.cc$''
+              ''^src/libstore/posix-fs-canonicalise\.hh$''
+              ''^src/libstore/uds-remote-store\.cc$''
+              ''^src/libstore/uds-remote-store\.hh$''
+              ''^src/libstore/windows/build\.cc$''
+              ''^src/libstore/worker-protocol-impl\.hh$''
+              ''^src/libstore/worker-protocol\.cc$''
+              ''^src/libstore/worker-protocol\.hh$''
+              ''^src/libutil-c/nix_api_util_internal\.h$''
+              ''^src/libutil/archive\.cc$''
+              ''^src/libutil/archive\.hh$''
+              ''^src/libutil/args\.cc$''
+              ''^src/libutil/args\.hh$''
+              ''^src/libutil/args/root\.hh$''
+              ''^src/libutil/callback\.hh$''
+              ''^src/libutil/canon-path\.cc$''
+              ''^src/libutil/canon-path\.hh$''
+              ''^src/libutil/chunked-vector\.hh$''
+              ''^src/libutil/closure\.hh$''
+              ''^src/libutil/comparator\.hh$''
+              ''^src/libutil/compute-levels\.cc$''
+              ''^src/libutil/config-impl\.hh$''
+              ''^src/libutil/config\.cc$''
+              ''^src/libutil/config\.hh$''
+              ''^src/libutil/current-process\.cc$''
+              ''^src/libutil/current-process\.hh$''
+              ''^src/libutil/english\.cc$''
+              ''^src/libutil/english\.hh$''
+              ''^src/libutil/error\.cc$''
+              ''^src/libutil/error\.hh$''
+              ''^src/libutil/exit\.hh$''
+              ''^src/libutil/experimental-features\.cc$''
+              ''^src/libutil/experimental-features\.hh$''
+              ''^src/libutil/file-content-address\.cc$''
+              ''^src/libutil/file-content-address\.hh$''
+              ''^src/libutil/file-descriptor\.cc$''
+              ''^src/libutil/file-descriptor\.hh$''
+              ''^src/libutil/file-path-impl\.hh$''
+              ''^src/libutil/file-path\.hh$''
+              ''^src/libutil/file-system\.cc$''
+              ''^src/libutil/file-system\.hh$''
+              ''^src/libutil/finally\.hh$''
+              ''^src/libutil/fmt\.hh$''
+              ''^src/libutil/fs-sink\.cc$''
+              ''^src/libutil/fs-sink\.hh$''
+              ''^src/libutil/git\.cc$''
+              ''^src/libutil/git\.hh$''
+              ''^src/libutil/hash\.cc$''
+              ''^src/libutil/hash\.hh$''
+              ''^src/libutil/hilite\.cc$''
+              ''^src/libutil/hilite\.hh$''
+              ''^src/libutil/source-accessor\.hh$''
+              ''^src/libutil/json-impls\.hh$''
+              ''^src/libutil/json-utils\.cc$''
+              ''^src/libutil/json-utils\.hh$''
+              ''^src/libutil/linux/cgroup\.cc$''
+              ''^src/libutil/linux/namespaces\.cc$''
+              ''^src/libutil/logging\.cc$''
+              ''^src/libutil/logging\.hh$''
+              ''^src/libutil/lru-cache\.hh$''
+              ''^src/libutil/memory-source-accessor\.cc$''
+              ''^src/libutil/memory-source-accessor\.hh$''
+              ''^src/libutil/pool\.hh$''
+              ''^src/libutil/position\.cc$''
+              ''^src/libutil/position\.hh$''
+              ''^src/libutil/posix-source-accessor\.cc$''
+              ''^src/libutil/posix-source-accessor\.hh$''
+              ''^src/libutil/processes\.hh$''
+              ''^src/libutil/ref\.hh$''
+              ''^src/libutil/references\.cc$''
+              ''^src/libutil/references\.hh$''
+              ''^src/libutil/regex-combinators\.hh$''
+              ''^src/libutil/serialise\.cc$''
+              ''^src/libutil/serialise\.hh$''
+              ''^src/libutil/signals\.hh$''
+              ''^src/libutil/signature/local-keys\.cc$''
+              ''^src/libutil/signature/local-keys\.hh$''
+              ''^src/libutil/signature/signer\.cc$''
+              ''^src/libutil/signature/signer\.hh$''
+              ''^src/libutil/source-accessor\.cc$''
+              ''^src/libutil/source-accessor\.hh$''
+              ''^src/libutil/source-path\.cc$''
+              ''^src/libutil/source-path\.hh$''
+              ''^src/libutil/split\.hh$''
+              ''^src/libutil/suggestions\.cc$''
+              ''^src/libutil/suggestions\.hh$''
+              ''^src/libutil/sync\.hh$''
+              ''^src/libutil/terminal\.cc$''
+              ''^src/libutil/terminal\.hh$''
+              ''^src/libutil/thread-pool\.cc$''
+              ''^src/libutil/thread-pool\.hh$''
+              ''^src/libutil/topo-sort\.hh$''
+              ''^src/libutil/types\.hh$''
+              ''^src/libutil/unix/file-descriptor\.cc$''
+              ''^src/libutil/unix/file-path\.cc$''
+              ''^src/libutil/unix/monitor-fd\.hh$''
+              ''^src/libutil/unix/processes\.cc$''
+              ''^src/libutil/unix/signals-impl\.hh$''
+              ''^src/libutil/unix/signals\.cc$''
+              ''^src/libutil/unix-domain-socket\.cc$''
+              ''^src/libutil/unix/users\.cc$''
+              ''^src/libutil/url-parts\.hh$''
+              ''^src/libutil/url\.cc$''
+              ''^src/libutil/url\.hh$''
+              ''^src/libutil/users\.cc$''
+              ''^src/libutil/users\.hh$''
+              ''^src/libutil/util\.cc$''
+              ''^src/libutil/util\.hh$''
+              ''^src/libutil/variant-wrapper\.hh$''
+              ''^src/libutil/widecharwidth/widechar_width\.h$'' # vendored source
+              ''^src/libutil/windows/file-descriptor\.cc$''
+              ''^src/libutil/windows/file-path\.cc$''
+              ''^src/libutil/windows/processes\.cc$''
+              ''^src/libutil/windows/users\.cc$''
+              ''^src/libutil/windows/windows-error\.cc$''
+              ''^src/libutil/windows/windows-error\.hh$''
+              ''^src/libutil/xml-writer\.cc$''
+              ''^src/libutil/xml-writer\.hh$''
+              ''^src/nix-build/nix-build\.cc$''
+              ''^src/nix-channel/nix-channel\.cc$''
+              ''^src/nix-collect-garbage/nix-collect-garbage\.cc$''
+              ''^src/nix-env/buildenv.nix$''
+              ''^src/nix-env/nix-env\.cc$''
+              ''^src/nix-env/user-env\.cc$''
+              ''^src/nix-env/user-env\.hh$''
+              ''^src/nix-instantiate/nix-instantiate\.cc$''
+              ''^src/nix-store/dotgraph\.cc$''
+              ''^src/nix-store/graphml\.cc$''
+              ''^src/nix-store/nix-store\.cc$''
+              ''^src/nix/add-to-store\.cc$''
+              ''^src/nix/app\.cc$''
+              ''^src/nix/build\.cc$''
+              ''^src/nix/bundle\.cc$''
+              ''^src/nix/cat\.cc$''
+              ''^src/nix/config-check\.cc$''
+              ''^src/nix/config\.cc$''
+              ''^src/nix/copy\.cc$''
+              ''^src/nix/derivation-add\.cc$''
+              ''^src/nix/derivation-show\.cc$''
+              ''^src/nix/derivation\.cc$''
+              ''^src/nix/develop\.cc$''
+              ''^src/nix/diff-closures\.cc$''
+              ''^src/nix/dump-path\.cc$''
+              ''^src/nix/edit\.cc$''
+              ''^src/nix/eval\.cc$''
+              ''^src/nix/flake\.cc$''
+              ''^src/nix/fmt\.cc$''
+              ''^src/nix/hash\.cc$''
+              ''^src/nix/log\.cc$''
+              ''^src/nix/ls\.cc$''
+              ''^src/nix/main\.cc$''
+              ''^src/nix/make-content-addressed\.cc$''
+              ''^src/nix/nar\.cc$''
+              ''^src/nix/optimise-store\.cc$''
+              ''^src/nix/path-from-hash-part\.cc$''
+              ''^src/nix/path-info\.cc$''
+              ''^src/nix/prefetch\.cc$''
+              ''^src/nix/profile\.cc$''
+              ''^src/nix/realisation\.cc$''
+              ''^src/nix/registry\.cc$''
+              ''^src/nix/repl\.cc$''
+              ''^src/nix/run\.cc$''
+              ''^src/nix/run\.hh$''
+              ''^src/nix/search\.cc$''
+              ''^src/nix/sigs\.cc$''
+              ''^src/nix/store-copy-log\.cc$''
+              ''^src/nix/store-delete\.cc$''
+              ''^src/nix/store-gc\.cc$''
+              ''^src/nix/store-info\.cc$''
+              ''^src/nix/store-repair\.cc$''
+              ''^src/nix/store\.cc$''
+              ''^src/nix/unix/daemon\.cc$''
+              ''^src/nix/upgrade-nix\.cc$''
+              ''^src/nix/verify\.cc$''
+              ''^src/nix/why-depends\.cc$''
 
-            ''^tests/functional/plugins/plugintest\.cc''
-            ''^tests/functional/test-libstoreconsumer/main\.cc''
-            ''^tests/nixos/ca-fd-leak/sender\.c''
-            ''^tests/nixos/ca-fd-leak/smuggler\.c''
-            ''^tests/nixos/user-sandboxing/attacker\.c''
-            ''^src/libexpr-test-support/tests/libexpr\.hh''
-            ''^src/libexpr-test-support/tests/value/context\.cc''
-            ''^src/libexpr-test-support/tests/value/context\.hh''
-            ''^src/libexpr-tests/derived-path\.cc''
-            ''^src/libexpr-tests/error_traces\.cc''
-            ''^src/libexpr-tests/eval\.cc''
-            ''^src/libexpr-tests/json\.cc''
-            ''^src/libexpr-tests/main\.cc''
-            ''^src/libexpr-tests/primops\.cc''
-            ''^src/libexpr-tests/search-path\.cc''
-            ''^src/libexpr-tests/trivial\.cc''
-            ''^src/libexpr-tests/value/context\.cc''
-            ''^src/libexpr-tests/value/print\.cc''
-            ''^src/libfetchers-tests/public-key\.cc''
-            ''^src/libflake-tests/flakeref\.cc''
-            ''^src/libflake-tests/url-name\.cc''
-            ''^src/libstore-test-support/tests/derived-path\.cc''
-            ''^src/libstore-test-support/tests/derived-path\.hh''
-            ''^src/libstore-test-support/tests/nix_api_store\.hh''
-            ''^src/libstore-test-support/tests/outputs-spec\.cc''
-            ''^src/libstore-test-support/tests/outputs-spec\.hh''
-            ''^src/libstore-test-support/tests/path\.cc''
-            ''^src/libstore-test-support/tests/path\.hh''
-            ''^src/libstore-test-support/tests/protocol\.hh''
-            ''^src/libstore-tests/common-protocol\.cc''
-            ''^src/libstore-tests/content-address\.cc''
-            ''^src/libstore-tests/derivation\.cc''
-            ''^src/libstore-tests/derived-path\.cc''
-            ''^src/libstore-tests/downstream-placeholder\.cc''
-            ''^src/libstore-tests/machines\.cc''
-            ''^src/libstore-tests/nar-info-disk-cache\.cc''
-            ''^src/libstore-tests/nar-info\.cc''
-            ''^src/libstore-tests/outputs-spec\.cc''
-            ''^src/libstore-tests/path-info\.cc''
-            ''^src/libstore-tests/path\.cc''
-            ''^src/libstore-tests/serve-protocol\.cc''
-            ''^src/libstore-tests/worker-protocol\.cc''
-            ''^src/libutil-test-support/tests/characterization\.hh''
-            ''^src/libutil-test-support/tests/hash\.cc''
-            ''^src/libutil-test-support/tests/hash\.hh''
-            ''^src/libutil-tests/args\.cc''
-            ''^src/libutil-tests/canon-path\.cc''
-            ''^src/libutil-tests/chunked-vector\.cc''
-            ''^src/libutil-tests/closure\.cc''
-            ''^src/libutil-tests/compression\.cc''
-            ''^src/libutil-tests/config\.cc''
-            ''^src/libutil-tests/file-content-address\.cc''
-            ''^src/libutil-tests/git\.cc''
-            ''^src/libutil-tests/hash\.cc''
-            ''^src/libutil-tests/hilite\.cc''
-            ''^src/libutil-tests/json-utils\.cc''
-            ''^src/libutil-tests/logging\.cc''
-            ''^src/libutil-tests/lru-cache\.cc''
-            ''^src/libutil-tests/pool\.cc''
-            ''^src/libutil-tests/references\.cc''
-            ''^src/libutil-tests/suggestions\.cc''
-            ''^src/libutil-tests/url\.cc''
-            ''^src/libutil-tests/xml-writer\.cc''
-          ];
+              ''^tests/functional/plugins/plugintest\.cc''
+              ''^tests/functional/test-libstoreconsumer/main\.cc''
+              ''^tests/nixos/ca-fd-leak/sender\.c''
+              ''^tests/nixos/ca-fd-leak/smuggler\.c''
+              ''^tests/nixos/user-sandboxing/attacker\.c''
+              ''^src/libexpr-test-support/tests/libexpr\.hh''
+              ''^src/libexpr-test-support/tests/value/context\.cc''
+              ''^src/libexpr-test-support/tests/value/context\.hh''
+              ''^src/libexpr-tests/derived-path\.cc''
+              ''^src/libexpr-tests/error_traces\.cc''
+              ''^src/libexpr-tests/eval\.cc''
+              ''^src/libexpr-tests/json\.cc''
+              ''^src/libexpr-tests/main\.cc''
+              ''^src/libexpr-tests/primops\.cc''
+              ''^src/libexpr-tests/search-path\.cc''
+              ''^src/libexpr-tests/trivial\.cc''
+              ''^src/libexpr-tests/value/context\.cc''
+              ''^src/libexpr-tests/value/print\.cc''
+              ''^src/libfetchers-tests/public-key\.cc''
+              ''^src/libflake-tests/flakeref\.cc''
+              ''^src/libflake-tests/url-name\.cc''
+              ''^src/libstore-test-support/tests/derived-path\.cc''
+              ''^src/libstore-test-support/tests/derived-path\.hh''
+              ''^src/libstore-test-support/tests/nix_api_store\.hh''
+              ''^src/libstore-test-support/tests/outputs-spec\.cc''
+              ''^src/libstore-test-support/tests/outputs-spec\.hh''
+              ''^src/libstore-test-support/tests/path\.cc''
+              ''^src/libstore-test-support/tests/path\.hh''
+              ''^src/libstore-test-support/tests/protocol\.hh''
+              ''^src/libstore-tests/common-protocol\.cc''
+              ''^src/libstore-tests/content-address\.cc''
+              ''^src/libstore-tests/derivation\.cc''
+              ''^src/libstore-tests/derived-path\.cc''
+              ''^src/libstore-tests/downstream-placeholder\.cc''
+              ''^src/libstore-tests/machines\.cc''
+              ''^src/libstore-tests/nar-info-disk-cache\.cc''
+              ''^src/libstore-tests/nar-info\.cc''
+              ''^src/libstore-tests/outputs-spec\.cc''
+              ''^src/libstore-tests/path-info\.cc''
+              ''^src/libstore-tests/path\.cc''
+              ''^src/libstore-tests/serve-protocol\.cc''
+              ''^src/libstore-tests/worker-protocol\.cc''
+              ''^src/libutil-test-support/tests/characterization\.hh''
+              ''^src/libutil-test-support/tests/hash\.cc''
+              ''^src/libutil-test-support/tests/hash\.hh''
+              ''^src/libutil-tests/args\.cc''
+              ''^src/libutil-tests/canon-path\.cc''
+              ''^src/libutil-tests/chunked-vector\.cc''
+              ''^src/libutil-tests/closure\.cc''
+              ''^src/libutil-tests/compression\.cc''
+              ''^src/libutil-tests/config\.cc''
+              ''^src/libutil-tests/file-content-address\.cc''
+              ''^src/libutil-tests/git\.cc''
+              ''^src/libutil-tests/hash\.cc''
+              ''^src/libutil-tests/hilite\.cc''
+              ''^src/libutil-tests/json-utils\.cc''
+              ''^src/libutil-tests/logging\.cc''
+              ''^src/libutil-tests/lru-cache\.cc''
+              ''^src/libutil-tests/pool\.cc''
+              ''^src/libutil-tests/references\.cc''
+              ''^src/libutil-tests/suggestions\.cc''
+              ''^src/libutil-tests/url\.cc''
+              ''^src/libutil-tests/xml-writer\.cc''
+            ];
+          };
+          shellcheck = {
+            enable = true;
+            excludes = [
+              # We haven't linted these files yet
+              ''^config/install-sh$''
+              ''^misc/bash/completion\.sh$''
+              ''^misc/fish/completion\.fish$''
+              ''^misc/zsh/completion\.zsh$''
+              ''^scripts/create-darwin-volume\.sh$''
+              ''^scripts/install-darwin-multi-user\.sh$''
+              ''^scripts/install-multi-user\.sh$''
+              ''^scripts/install-systemd-multi-user\.sh$''
+              ''^src/nix/get-env\.sh$''
+              ''^tests/functional/ca/build-dry\.sh$''
+              ''^tests/functional/ca/build-with-garbage-path\.sh$''
+              ''^tests/functional/ca/common\.sh$''
+              ''^tests/functional/ca/concurrent-builds\.sh$''
+              ''^tests/functional/ca/eval-store\.sh$''
+              ''^tests/functional/ca/gc\.sh$''
+              ''^tests/functional/ca/import-from-derivation\.sh$''
+              ''^tests/functional/ca/new-build-cmd\.sh$''
+              ''^tests/functional/ca/nix-shell\.sh$''
+              ''^tests/functional/ca/post-hook\.sh$''
+              ''^tests/functional/ca/recursive\.sh$''
+              ''^tests/functional/ca/repl\.sh$''
+              ''^tests/functional/ca/selfref-gc\.sh$''
+              ''^tests/functional/ca/why-depends\.sh$''
+              ''^tests/functional/characterisation-test-infra\.sh$''
+              ''^tests/functional/common/vars-and-functions\.sh$''
+              ''^tests/functional/completions\.sh$''
+              ''^tests/functional/compute-levels\.sh$''
+              ''^tests/functional/config\.sh$''
+              ''^tests/functional/db-migration\.sh$''
+              ''^tests/functional/debugger\.sh$''
+              ''^tests/functional/dependencies\.builder0\.sh$''
+              ''^tests/functional/dependencies\.sh$''
+              ''^tests/functional/dump-db\.sh$''
+              ''^tests/functional/dyn-drv/build-built-drv\.sh$''
+              ''^tests/functional/dyn-drv/common\.sh$''
+              ''^tests/functional/dyn-drv/dep-built-drv\.sh$''
+              ''^tests/functional/dyn-drv/eval-outputOf\.sh$''
+              ''^tests/functional/dyn-drv/old-daemon-error-hack\.sh$''
+              ''^tests/functional/dyn-drv/recursive-mod-json\.sh$''
+              ''^tests/functional/eval-store\.sh$''
+              ''^tests/functional/export-graph\.sh$''
+              ''^tests/functional/export\.sh$''
+              ''^tests/functional/extra-sandbox-profile\.sh$''
+              ''^tests/functional/fetchClosure\.sh$''
+              ''^tests/functional/fetchGit\.sh$''
+              ''^tests/functional/fetchGitRefs\.sh$''
+              ''^tests/functional/fetchGitSubmodules\.sh$''
+              ''^tests/functional/fetchGitVerification\.sh$''
+              ''^tests/functional/fetchMercurial\.sh$''
+              ''^tests/functional/fixed\.builder1\.sh$''
+              ''^tests/functional/fixed\.builder2\.sh$''
+              ''^tests/functional/fixed\.sh$''
+              ''^tests/functional/flakes/absolute-paths\.sh$''
+              ''^tests/functional/flakes/check\.sh$''
+              ''^tests/functional/flakes/config\.sh$''
+              ''^tests/functional/flakes/flakes\.sh$''
+              ''^tests/functional/flakes/follow-paths\.sh$''
+              ''^tests/functional/flakes/prefetch\.sh$''
+              ''^tests/functional/flakes/run\.sh$''
+              ''^tests/functional/flakes/show\.sh$''
+              ''^tests/functional/fmt\.sh$''
+              ''^tests/functional/fmt\.simple\.sh$''
+              ''^tests/functional/gc-auto\.sh$''
+              ''^tests/functional/gc-concurrent\.builder\.sh$''
+              ''^tests/functional/gc-concurrent\.sh$''
+              ''^tests/functional/gc-concurrent2\.builder\.sh$''
+              ''^tests/functional/gc-non-blocking\.sh$''
+              ''^tests/functional/git-hashing/common\.sh$''
+              ''^tests/functional/git-hashing/simple\.sh$''
+              ''^tests/functional/hash-convert\.sh$''
+              ''^tests/functional/impure-derivations\.sh$''
+              ''^tests/functional/impure-eval\.sh$''
+              ''^tests/functional/install-darwin\.sh$''
+              ''^tests/functional/legacy-ssh-store\.sh$''
+              ''^tests/functional/linux-sandbox\.sh$''
+              ''^tests/functional/local-overlay-store/add-lower-inner\.sh$''
+              ''^tests/functional/local-overlay-store/add-lower\.sh$''
+              ''^tests/functional/local-overlay-store/bad-uris\.sh$''
+              ''^tests/functional/local-overlay-store/build-inner\.sh$''
+              ''^tests/functional/local-overlay-store/build\.sh$''
+              ''^tests/functional/local-overlay-store/check-post-init-inner\.sh$''
+              ''^tests/functional/local-overlay-store/check-post-init\.sh$''
+              ''^tests/functional/local-overlay-store/common\.sh$''
+              ''^tests/functional/local-overlay-store/delete-duplicate-inner\.sh$''
+              ''^tests/functional/local-overlay-store/delete-duplicate\.sh$''
+              ''^tests/functional/local-overlay-store/delete-refs-inner\.sh$''
+              ''^tests/functional/local-overlay-store/delete-refs\.sh$''
+              ''^tests/functional/local-overlay-store/gc-inner\.sh$''
+              ''^tests/functional/local-overlay-store/gc\.sh$''
+              ''^tests/functional/local-overlay-store/optimise-inner\.sh$''
+              ''^tests/functional/local-overlay-store/optimise\.sh$''
+              ''^tests/functional/local-overlay-store/redundant-add-inner\.sh$''
+              ''^tests/functional/local-overlay-store/redundant-add\.sh$''
+              ''^tests/functional/local-overlay-store/remount\.sh$''
+              ''^tests/functional/local-overlay-store/stale-file-handle-inner\.sh$''
+              ''^tests/functional/local-overlay-store/stale-file-handle\.sh$''
+              ''^tests/functional/local-overlay-store/verify-inner\.sh$''
+              ''^tests/functional/local-overlay-store/verify\.sh$''
+              ''^tests/functional/logging\.sh$''
+              ''^tests/functional/misc\.sh$''
+              ''^tests/functional/multiple-outputs\.sh$''
+              ''^tests/functional/nested-sandboxing\.sh$''
+              ''^tests/functional/nested-sandboxing/command\.sh$''
+              ''^tests/functional/nix-build\.sh$''
+              ''^tests/functional/nix-channel\.sh$''
+              ''^tests/functional/nix-collect-garbage-d\.sh$''
+              ''^tests/functional/nix-copy-ssh-common\.sh$''
+              ''^tests/functional/nix-copy-ssh-ng\.sh$''
+              ''^tests/functional/nix-copy-ssh\.sh$''
+              ''^tests/functional/nix-daemon-untrusting\.sh$''
+              ''^tests/functional/nix-profile\.sh$''
+              ''^tests/functional/nix-shell\.sh$''
+              ''^tests/functional/nix_path\.sh$''
+              ''^tests/functional/optimise-store\.sh$''
+              ''^tests/functional/output-normalization\.sh$''
+              ''^tests/functional/parallel\.builder\.sh$''
+              ''^tests/functional/parallel\.sh$''
+              ''^tests/functional/pass-as-file\.sh$''
+              ''^tests/functional/path-from-hash-part\.sh$''
+              ''^tests/functional/path-info\.sh$''
+              ''^tests/functional/placeholders\.sh$''
+              ''^tests/functional/post-hook\.sh$''
+              ''^tests/functional/pure-eval\.sh$''
+              ''^tests/functional/push-to-store-old\.sh$''
+              ''^tests/functional/push-to-store\.sh$''
+              ''^tests/functional/read-only-store\.sh$''
+              ''^tests/functional/readfile-context\.sh$''
+              ''^tests/functional/recursive\.sh$''
+              ''^tests/functional/referrers\.sh$''
+              ''^tests/functional/remote-store\.sh$''
+              ''^tests/functional/repair\.sh$''
+              ''^tests/functional/restricted\.sh$''
+              ''^tests/functional/search\.sh$''
+              ''^tests/functional/secure-drv-outputs\.sh$''
+              ''^tests/functional/selfref-gc\.sh$''
+              ''^tests/functional/shell\.shebang\.sh$''
+              ''^tests/functional/simple\.builder\.sh$''
+              ''^tests/functional/supplementary-groups\.sh$''
+              ''^tests/functional/toString-path\.sh$''
+              ''^tests/functional/user-envs-migration\.sh$''
+              ''^tests/functional/user-envs-test-case\.sh$''
+              ''^tests/functional/user-envs\.builder\.sh$''
+              ''^tests/functional/user-envs\.sh$''
+              ''^tests/functional/why-depends\.sh$''
+              ''^src/libutil-tests/data/git/check-data\.sh$''
+            ];
+          };
+          # TODO: nixfmt, https://github.com/NixOS/nixfmt/issues/153
         };
-        shellcheck = {
-          enable = true;
-          excludes = [
-            # We haven't linted these files yet
-            ''^config/install-sh$''
-            ''^misc/bash/completion\.sh$''
-            ''^misc/fish/completion\.fish$''
-            ''^misc/zsh/completion\.zsh$''
-            ''^scripts/create-darwin-volume\.sh$''
-            ''^scripts/install-darwin-multi-user\.sh$''
-            ''^scripts/install-multi-user\.sh$''
-            ''^scripts/install-systemd-multi-user\.sh$''
-            ''^src/nix/get-env\.sh$''
-            ''^tests/functional/ca/build-dry\.sh$''
-            ''^tests/functional/ca/build-with-garbage-path\.sh$''
-            ''^tests/functional/ca/common\.sh$''
-            ''^tests/functional/ca/concurrent-builds\.sh$''
-            ''^tests/functional/ca/eval-store\.sh$''
-            ''^tests/functional/ca/gc\.sh$''
-            ''^tests/functional/ca/import-from-derivation\.sh$''
-            ''^tests/functional/ca/new-build-cmd\.sh$''
-            ''^tests/functional/ca/nix-shell\.sh$''
-            ''^tests/functional/ca/post-hook\.sh$''
-            ''^tests/functional/ca/recursive\.sh$''
-            ''^tests/functional/ca/repl\.sh$''
-            ''^tests/functional/ca/selfref-gc\.sh$''
-            ''^tests/functional/ca/why-depends\.sh$''
-            ''^tests/functional/characterisation-test-infra\.sh$''
-            ''^tests/functional/common/vars-and-functions\.sh$''
-            ''^tests/functional/completions\.sh$''
-            ''^tests/functional/compute-levels\.sh$''
-            ''^tests/functional/config\.sh$''
-            ''^tests/functional/db-migration\.sh$''
-            ''^tests/functional/debugger\.sh$''
-            ''^tests/functional/dependencies\.builder0\.sh$''
-            ''^tests/functional/dependencies\.sh$''
-            ''^tests/functional/dump-db\.sh$''
-            ''^tests/functional/dyn-drv/build-built-drv\.sh$''
-            ''^tests/functional/dyn-drv/common\.sh$''
-            ''^tests/functional/dyn-drv/dep-built-drv\.sh$''
-            ''^tests/functional/dyn-drv/eval-outputOf\.sh$''
-            ''^tests/functional/dyn-drv/old-daemon-error-hack\.sh$''
-            ''^tests/functional/dyn-drv/recursive-mod-json\.sh$''
-            ''^tests/functional/eval-store\.sh$''
-            ''^tests/functional/export-graph\.sh$''
-            ''^tests/functional/export\.sh$''
-            ''^tests/functional/extra-sandbox-profile\.sh$''
-            ''^tests/functional/fetchClosure\.sh$''
-            ''^tests/functional/fetchGit\.sh$''
-            ''^tests/functional/fetchGitRefs\.sh$''
-            ''^tests/functional/fetchGitSubmodules\.sh$''
-            ''^tests/functional/fetchGitVerification\.sh$''
-            ''^tests/functional/fetchMercurial\.sh$''
-            ''^tests/functional/fixed\.builder1\.sh$''
-            ''^tests/functional/fixed\.builder2\.sh$''
-            ''^tests/functional/fixed\.sh$''
-            ''^tests/functional/flakes/absolute-paths\.sh$''
-            ''^tests/functional/flakes/check\.sh$''
-            ''^tests/functional/flakes/config\.sh$''
-            ''^tests/functional/flakes/flakes\.sh$''
-            ''^tests/functional/flakes/follow-paths\.sh$''
-            ''^tests/functional/flakes/prefetch\.sh$''
-            ''^tests/functional/flakes/run\.sh$''
-            ''^tests/functional/flakes/show\.sh$''
-            ''^tests/functional/fmt\.sh$''
-            ''^tests/functional/fmt\.simple\.sh$''
-            ''^tests/functional/gc-auto\.sh$''
-            ''^tests/functional/gc-concurrent\.builder\.sh$''
-            ''^tests/functional/gc-concurrent\.sh$''
-            ''^tests/functional/gc-concurrent2\.builder\.sh$''
-            ''^tests/functional/gc-non-blocking\.sh$''
-            ''^tests/functional/git-hashing/common\.sh$''
-            ''^tests/functional/git-hashing/simple\.sh$''
-            ''^tests/functional/hash-convert\.sh$''
-            ''^tests/functional/impure-derivations\.sh$''
-            ''^tests/functional/impure-eval\.sh$''
-            ''^tests/functional/install-darwin\.sh$''
-            ''^tests/functional/legacy-ssh-store\.sh$''
-            ''^tests/functional/linux-sandbox\.sh$''
-            ''^tests/functional/local-overlay-store/add-lower-inner\.sh$''
-            ''^tests/functional/local-overlay-store/add-lower\.sh$''
-            ''^tests/functional/local-overlay-store/bad-uris\.sh$''
-            ''^tests/functional/local-overlay-store/build-inner\.sh$''
-            ''^tests/functional/local-overlay-store/build\.sh$''
-            ''^tests/functional/local-overlay-store/check-post-init-inner\.sh$''
-            ''^tests/functional/local-overlay-store/check-post-init\.sh$''
-            ''^tests/functional/local-overlay-store/common\.sh$''
-            ''^tests/functional/local-overlay-store/delete-duplicate-inner\.sh$''
-            ''^tests/functional/local-overlay-store/delete-duplicate\.sh$''
-            ''^tests/functional/local-overlay-store/delete-refs-inner\.sh$''
-            ''^tests/functional/local-overlay-store/delete-refs\.sh$''
-            ''^tests/functional/local-overlay-store/gc-inner\.sh$''
-            ''^tests/functional/local-overlay-store/gc\.sh$''
-            ''^tests/functional/local-overlay-store/optimise-inner\.sh$''
-            ''^tests/functional/local-overlay-store/optimise\.sh$''
-            ''^tests/functional/local-overlay-store/redundant-add-inner\.sh$''
-            ''^tests/functional/local-overlay-store/redundant-add\.sh$''
-            ''^tests/functional/local-overlay-store/remount\.sh$''
-            ''^tests/functional/local-overlay-store/stale-file-handle-inner\.sh$''
-            ''^tests/functional/local-overlay-store/stale-file-handle\.sh$''
-            ''^tests/functional/local-overlay-store/verify-inner\.sh$''
-            ''^tests/functional/local-overlay-store/verify\.sh$''
-            ''^tests/functional/logging\.sh$''
-            ''^tests/functional/misc\.sh$''
-            ''^tests/functional/multiple-outputs\.sh$''
-            ''^tests/functional/nested-sandboxing\.sh$''
-            ''^tests/functional/nested-sandboxing/command\.sh$''
-            ''^tests/functional/nix-build\.sh$''
-            ''^tests/functional/nix-channel\.sh$''
-            ''^tests/functional/nix-collect-garbage-d\.sh$''
-            ''^tests/functional/nix-copy-ssh-common\.sh$''
-            ''^tests/functional/nix-copy-ssh-ng\.sh$''
-            ''^tests/functional/nix-copy-ssh\.sh$''
-            ''^tests/functional/nix-daemon-untrusting\.sh$''
-            ''^tests/functional/nix-profile\.sh$''
-            ''^tests/functional/nix-shell\.sh$''
-            ''^tests/functional/nix_path\.sh$''
-            ''^tests/functional/optimise-store\.sh$''
-            ''^tests/functional/output-normalization\.sh$''
-            ''^tests/functional/parallel\.builder\.sh$''
-            ''^tests/functional/parallel\.sh$''
-            ''^tests/functional/pass-as-file\.sh$''
-            ''^tests/functional/path-from-hash-part\.sh$''
-            ''^tests/functional/path-info\.sh$''
-            ''^tests/functional/placeholders\.sh$''
-            ''^tests/functional/post-hook\.sh$''
-            ''^tests/functional/pure-eval\.sh$''
-            ''^tests/functional/push-to-store-old\.sh$''
-            ''^tests/functional/push-to-store\.sh$''
-            ''^tests/functional/read-only-store\.sh$''
-            ''^tests/functional/readfile-context\.sh$''
-            ''^tests/functional/recursive\.sh$''
-            ''^tests/functional/referrers\.sh$''
-            ''^tests/functional/remote-store\.sh$''
-            ''^tests/functional/repair\.sh$''
-            ''^tests/functional/restricted\.sh$''
-            ''^tests/functional/search\.sh$''
-            ''^tests/functional/secure-drv-outputs\.sh$''
-            ''^tests/functional/selfref-gc\.sh$''
-            ''^tests/functional/shell\.shebang\.sh$''
-            ''^tests/functional/simple\.builder\.sh$''
-            ''^tests/functional/supplementary-groups\.sh$''
-            ''^tests/functional/toString-path\.sh$''
-            ''^tests/functional/user-envs-migration\.sh$''
-            ''^tests/functional/user-envs-test-case\.sh$''
-            ''^tests/functional/user-envs\.builder\.sh$''
-            ''^tests/functional/user-envs\.sh$''
-            ''^tests/functional/why-depends\.sh$''
-            ''^src/libutil-tests/data/git/check-data\.sh$''
-          ];
-        };
-        # TODO: nixfmt, https://github.com/NixOS/nixfmt/issues/153
       };
     };
-  };
 
   # We'll be pulling from this in the main flake
   flake.getSystem = getSystem;
diff --git a/packaging/components.nix b/packaging/components.nix
index e1f661be8..d1bfe83bf 100644
--- a/packaging/components.nix
+++ b/packaging/components.nix
@@ -13,9 +13,11 @@ let
 
   versionSuffix = lib.optionalString (!officialRelease) "pre";
 
-  fineVersionSuffix = lib.optionalString
-    (!officialRelease)
-    "pre${builtins.substring 0 8 (src.lastModifiedDate or src.lastModified or "19700101")}_${src.shortRev or "dirty"}";
+  fineVersionSuffix =
+    lib.optionalString (!officialRelease)
+      "pre${
+        builtins.substring 0 8 (src.lastModifiedDate or src.lastModified or "19700101")
+      }_${src.shortRev or "dirty"}";
 
   fineVersion = baseVersion + fineVersionSuffix;
 in
@@ -54,7 +56,9 @@ in
 
   nix-cli = callPackage ../src/nix/package.nix { version = fineVersion; };
 
-  nix-functional-tests = callPackage ../src/nix-functional-tests/package.nix { version = fineVersion; };
+  nix-functional-tests = callPackage ../src/nix-functional-tests/package.nix {
+    version = fineVersion;
+  };
 
   nix-manual = callPackage ../doc/manual/package.nix { version = fineVersion; };
   nix-internal-api-docs = callPackage ../src/internal-api-docs/package.nix { version = fineVersion; };
diff --git a/packaging/dependencies.nix b/packaging/dependencies.nix
index acdbc9cfc..afbc31fc6 100644
--- a/packaging/dependencies.nix
+++ b/packaging/dependencies.nix
@@ -19,9 +19,7 @@ let
 
   root = ../.;
 
-  stdenv = if prevStdenv.isDarwin && prevStdenv.isx86_64
-    then darwinStdenv
-    else prevStdenv;
+  stdenv = if prevStdenv.isDarwin && prevStdenv.isx86_64 then darwinStdenv else prevStdenv;
 
   # Fix the following error with the default x86_64-darwin SDK:
   #
@@ -38,11 +36,14 @@ let
   # Indirection for Nixpkgs to override when package.nix files are vendored
   filesetToSource = lib.fileset.toSource;
 
-  /** Given a set of layers, create a mkDerivation-like function */
-  mkPackageBuilder = exts: userFn:
-    stdenv.mkDerivation (lib.extends (lib.composeManyExtensions exts) userFn);
+  /**
+    Given a set of layers, create a mkDerivation-like function
+  */
+  mkPackageBuilder =
+    exts: userFn: stdenv.mkDerivation (lib.extends (lib.composeManyExtensions exts) userFn);
 
-  localSourceLayer = finalAttrs: prevAttrs:
+  localSourceLayer =
+    finalAttrs: prevAttrs:
     let
       workDirPath =
         # Ideally we'd pick finalAttrs.workDir, but for now `mkDerivation` has
@@ -51,8 +52,13 @@ let
         prevAttrs.workDir;
 
       workDirSubpath = lib.path.removePrefix root workDirPath;
-      sources = assert prevAttrs.fileset._type == "fileset"; prevAttrs.fileset;
-      src = lib.fileset.toSource { fileset = sources; inherit root; };
+      sources =
+        assert prevAttrs.fileset._type == "fileset";
+        prevAttrs.fileset;
+      src = lib.fileset.toSource {
+        fileset = sources;
+        inherit root;
+      };
 
     in
     {
@@ -64,117 +70,129 @@ let
       workDir = null;
     };
 
-  mesonLayer = finalAttrs: prevAttrs:
-    {
-      # NOTE:
-      # As of https://github.com/NixOS/nixpkgs/blob/8baf8241cea0c7b30e0b8ae73474cb3de83c1a30/pkgs/by-name/me/meson/setup-hook.sh#L26,
-      # `mesonBuildType` defaults to `plain` if not specified. We want our Nix-built binaries to be optimized by default.
-      # More on build types here: https://mesonbuild.com/Builtin-options.html#details-for-buildtype.
-      mesonBuildType = "release";
-      # NOTE:
-      # Users who are debugging Nix builds are expected to set the environment variable `mesonBuildType`, per the
-      # guidance in https://github.com/NixOS/nix/blob/8a3fc27f1b63a08ac983ee46435a56cf49ebaf4a/doc/manual/source/development/debugging.md?plain=1#L10.
-      # For this reason, we don't want to refer to `finalAttrs.mesonBuildType` here, but rather use the environment variable.
-      preConfigure = prevAttrs.preConfigure or "" + lib.optionalString (
-        !stdenv.hostPlatform.isWindows
-        # build failure
-        && !stdenv.hostPlatform.isStatic
-        # LTO breaks exception handling on x86-64-darwin.
-        && stdenv.system != "x86_64-darwin"
-      ) ''
-        case "$mesonBuildType" in
-        release|minsize) appendToVar mesonFlags "-Db_lto=true"  ;;
-        *)               appendToVar mesonFlags "-Db_lto=false" ;;
-        esac
-      '';
-      nativeBuildInputs = [
-        pkgs.buildPackages.meson
-        pkgs.buildPackages.ninja
-      ] ++ prevAttrs.nativeBuildInputs or [];
-      mesonCheckFlags = prevAttrs.mesonCheckFlags or [] ++ [
-        "--print-errorlogs"
-      ];
-    };
+  mesonLayer = finalAttrs: prevAttrs: {
+    # NOTE:
+    # As of https://github.com/NixOS/nixpkgs/blob/8baf8241cea0c7b30e0b8ae73474cb3de83c1a30/pkgs/by-name/me/meson/setup-hook.sh#L26,
+    # `mesonBuildType` defaults to `plain` if not specified. We want our Nix-built binaries to be optimized by default.
+    # More on build types here: https://mesonbuild.com/Builtin-options.html#details-for-buildtype.
+    mesonBuildType = "release";
+    # NOTE:
+    # Users who are debugging Nix builds are expected to set the environment variable `mesonBuildType`, per the
+    # guidance in https://github.com/NixOS/nix/blob/8a3fc27f1b63a08ac983ee46435a56cf49ebaf4a/doc/manual/source/development/debugging.md?plain=1#L10.
+    # For this reason, we don't want to refer to `finalAttrs.mesonBuildType` here, but rather use the environment variable.
+    preConfigure =
+      prevAttrs.preConfigure or ""
+      +
+        lib.optionalString
+          (
+            !stdenv.hostPlatform.isWindows
+            # build failure
+            && !stdenv.hostPlatform.isStatic
+            # LTO breaks exception handling on x86-64-darwin.
+            && stdenv.system != "x86_64-darwin"
+          )
+          ''
+            case "$mesonBuildType" in
+            release|minsize) appendToVar mesonFlags "-Db_lto=true"  ;;
+            *)               appendToVar mesonFlags "-Db_lto=false" ;;
+            esac
+          '';
+    nativeBuildInputs = [
+      pkgs.buildPackages.meson
+      pkgs.buildPackages.ninja
+    ] ++ prevAttrs.nativeBuildInputs or [ ];
+    mesonCheckFlags = prevAttrs.mesonCheckFlags or [ ] ++ [
+      "--print-errorlogs"
+    ];
+  };
 
-  mesonBuildLayer = finalAttrs: prevAttrs:
-    {
-      nativeBuildInputs = prevAttrs.nativeBuildInputs or [] ++ [
-        pkgs.buildPackages.pkg-config
-      ];
-      separateDebugInfo = !stdenv.hostPlatform.isStatic;
-      hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
-      env = prevAttrs.env or {}
-        // lib.optionalAttrs
-          (stdenv.isLinux
-            && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")
-            && !(stdenv.hostPlatform.useLLVM or false))
-          { LDFLAGS = "-fuse-ld=gold"; };
-    };
+  mesonBuildLayer = finalAttrs: prevAttrs: {
+    nativeBuildInputs = prevAttrs.nativeBuildInputs or [ ] ++ [
+      pkgs.buildPackages.pkg-config
+    ];
+    separateDebugInfo = !stdenv.hostPlatform.isStatic;
+    hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+    env =
+      prevAttrs.env or { }
+      // lib.optionalAttrs (
+        stdenv.isLinux
+        && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")
+        && !(stdenv.hostPlatform.useLLVM or false)
+      ) { LDFLAGS = "-fuse-ld=gold"; };
+  };
 
-  mesonLibraryLayer = finalAttrs: prevAttrs:
-    {
-      outputs = prevAttrs.outputs or [ "out" ] ++ [ "dev" ];
-    };
+  mesonLibraryLayer = finalAttrs: prevAttrs: {
+    outputs = prevAttrs.outputs or [ "out" ] ++ [ "dev" ];
+  };
 
   # Work around weird `--as-needed` linker behavior with BSD, see
   # https://github.com/mesonbuild/meson/issues/3593
-  bsdNoLinkAsNeeded = finalAttrs: prevAttrs:
+  bsdNoLinkAsNeeded =
+    finalAttrs: prevAttrs:
     lib.optionalAttrs stdenv.hostPlatform.isBSD {
-      mesonFlags = [ (lib.mesonBool "b_asneeded" false) ] ++ prevAttrs.mesonFlags or [];
+      mesonFlags = [ (lib.mesonBool "b_asneeded" false) ] ++ prevAttrs.mesonFlags or [ ];
     };
 
-  miscGoodPractice = finalAttrs: prevAttrs:
-    {
-      strictDeps = prevAttrs.strictDeps or true;
-      enableParallelBuilding = true;
-    };
+  miscGoodPractice = finalAttrs: prevAttrs: {
+    strictDeps = prevAttrs.strictDeps or true;
+    enableParallelBuilding = true;
+  };
 in
 scope: {
   inherit stdenv;
 
-  aws-sdk-cpp = (pkgs.aws-sdk-cpp.override {
-    apis = [ "s3" "transfer" ];
-    customMemoryManagement = false;
-  }).overrideAttrs {
-    # only a stripped down version is built, which takes a lot less resources
-    # to build, so we don't need a "big-parallel" machine.
-    requiredSystemFeatures = [ ];
-  };
+  aws-sdk-cpp =
+    (pkgs.aws-sdk-cpp.override {
+      apis = [
+        "s3"
+        "transfer"
+      ];
+      customMemoryManagement = false;
+    }).overrideAttrs
+      {
+        # only a stripped down version is built, which takes a lot less resources
+        # to build, so we don't need a "big-parallel" machine.
+        requiredSystemFeatures = [ ];
+      };
 
   boehmgc = pkgs.boehmgc.override {
     enableLargeConfig = true;
   };
 
   # TODO Hack until https://github.com/NixOS/nixpkgs/issues/45462 is fixed.
-  boost = (pkgs.boost.override {
-    extraB2Args = [
-      "--with-container"
-      "--with-context"
-      "--with-coroutine"
-    ];
-  }).overrideAttrs (old: {
-    # Need to remove `--with-*` to use `--with-libraries=...`
-    buildPhase = lib.replaceStrings [ "--without-python" ] [ "" ] old.buildPhase;
-    installPhase = lib.replaceStrings [ "--without-python" ] [ "" ] old.installPhase;
-  });
+  boost =
+    (pkgs.boost.override {
+      extraB2Args = [
+        "--with-container"
+        "--with-context"
+        "--with-coroutine"
+      ];
+    }).overrideAttrs
+      (old: {
+        # Need to remove `--with-*` to use `--with-libraries=...`
+        buildPhase = lib.replaceStrings [ "--without-python" ] [ "" ] old.buildPhase;
+        installPhase = lib.replaceStrings [ "--without-python" ] [ "" ] old.installPhase;
+      });
 
   libgit2 = pkgs.libgit2.overrideAttrs (attrs: {
-    cmakeFlags = attrs.cmakeFlags or []
-      ++ [ "-DUSE_SSH=exec" ];
-    nativeBuildInputs = attrs.nativeBuildInputs or []
+    cmakeFlags = attrs.cmakeFlags or [ ] ++ [ "-DUSE_SSH=exec" ];
+    nativeBuildInputs =
+      attrs.nativeBuildInputs or [ ]
       # gitMinimal does not build on Windows. See packbuilder patch.
       ++ lib.optionals (!stdenv.hostPlatform.isWindows) [
         # Needed for `git apply`; see `prePatch`
         pkgs.buildPackages.gitMinimal
       ];
     # Only `git apply` can handle git binary patches
-    prePatch = attrs.prePatch or ""
+    prePatch =
+      attrs.prePatch or ""
       + lib.optionalString (!stdenv.hostPlatform.isWindows) ''
         patch() {
           git apply
         }
       '';
-    patches = attrs.patches or []
+    patches =
+      attrs.patches or [ ]
       ++ [
         ./patches/libgit2-mempack-thin-packfile.patch
       ]
@@ -188,27 +206,24 @@ scope: {
 
   inherit resolvePath filesetToSource;
 
-  mkMesonDerivation =
-    mkPackageBuilder [
-      miscGoodPractice
-      localSourceLayer
-      mesonLayer
-    ];
-  mkMesonExecutable =
-    mkPackageBuilder [
-      miscGoodPractice
-      bsdNoLinkAsNeeded
-      localSourceLayer
-      mesonLayer
-      mesonBuildLayer
-    ];
-  mkMesonLibrary =
-    mkPackageBuilder [
-      miscGoodPractice
-      bsdNoLinkAsNeeded
-      localSourceLayer
-      mesonLayer
-      mesonBuildLayer
-      mesonLibraryLayer
-    ];
+  mkMesonDerivation = mkPackageBuilder [
+    miscGoodPractice
+    localSourceLayer
+    mesonLayer
+  ];
+  mkMesonExecutable = mkPackageBuilder [
+    miscGoodPractice
+    bsdNoLinkAsNeeded
+    localSourceLayer
+    mesonLayer
+    mesonBuildLayer
+  ];
+  mkMesonLibrary = mkPackageBuilder [
+    miscGoodPractice
+    bsdNoLinkAsNeeded
+    localSourceLayer
+    mesonLayer
+    mesonBuildLayer
+    mesonLibraryLayer
+  ];
 }
diff --git a/packaging/dev-shell.nix b/packaging/dev-shell.nix
index 30ac518d5..1651a86be 100644
--- a/packaging/dev-shell.nix
+++ b/packaging/dev-shell.nix
@@ -2,127 +2,135 @@
 
 { pkgs }:
 
-pkgs.nixComponents.nix-util.overrideAttrs (attrs:
+pkgs.nixComponents.nix-util.overrideAttrs (
+  attrs:
 
-let
-  stdenv = pkgs.nixDependencies.stdenv;
-  buildCanExecuteHost = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
-  modular = devFlake.getSystem stdenv.buildPlatform.system;
-  transformFlag = prefix: flag:
-    assert builtins.isString flag;
-    let
-      rest = builtins.substring 2 (builtins.stringLength flag) flag;
-    in
+  let
+    stdenv = pkgs.nixDependencies.stdenv;
+    buildCanExecuteHost = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+    modular = devFlake.getSystem stdenv.buildPlatform.system;
+    transformFlag =
+      prefix: flag:
+      assert builtins.isString flag;
+      let
+        rest = builtins.substring 2 (builtins.stringLength flag) flag;
+      in
       "-D${prefix}:${rest}";
-  havePerl = stdenv.buildPlatform == stdenv.hostPlatform && stdenv.hostPlatform.isUnix;
-  ignoreCrossFile = flags: builtins.filter (flag: !(lib.strings.hasInfix "cross-file" flag)) flags;
-in {
-  pname = "shell-for-" + attrs.pname;
+    havePerl = stdenv.buildPlatform == stdenv.hostPlatform && stdenv.hostPlatform.isUnix;
+    ignoreCrossFile = flags: builtins.filter (flag: !(lib.strings.hasInfix "cross-file" flag)) flags;
+  in
+  {
+    pname = "shell-for-" + attrs.pname;
 
-  # Remove the version suffix to avoid unnecessary attempts to substitute in nix develop
-  version = lib.fileContents ../.version;
-  name = attrs.pname;
+    # Remove the version suffix to avoid unnecessary attempts to substitute in nix develop
+    version = lib.fileContents ../.version;
+    name = attrs.pname;
 
-  installFlags = "sysconfdir=$(out)/etc";
-  shellHook = ''
-    PATH=$prefix/bin:$PATH
-    unset PYTHONPATH
-    export MANPATH=$out/share/man:$MANPATH
+    installFlags = "sysconfdir=$(out)/etc";
+    shellHook = ''
+      PATH=$prefix/bin:$PATH
+      unset PYTHONPATH
+      export MANPATH=$out/share/man:$MANPATH
 
-    # Make bash completion work.
-    XDG_DATA_DIRS+=:$out/share
+      # Make bash completion work.
+      XDG_DATA_DIRS+=:$out/share
 
-    # Make the default phases do the right thing.
-    # FIXME: this wouldn't be needed if the ninja package set buildPhase() instead of $buildPhase.
-    # FIXME: mesonConfigurePhase shouldn't cd to the build directory. It would be better to pass '-C <dir>' to ninja.
+      # Make the default phases do the right thing.
+      # FIXME: this wouldn't be needed if the ninja package set buildPhase() instead of $buildPhase.
+      # FIXME: mesonConfigurePhase shouldn't cd to the build directory. It would be better to pass '-C <dir>' to ninja.
 
-    cdToBuildDir() {
-        if [[ ! -e build.ninja ]]; then
-            cd build
-        fi
-    }
+      cdToBuildDir() {
+          if [[ ! -e build.ninja ]]; then
+              cd build
+          fi
+      }
 
-    configurePhase() {
-        mesonConfigurePhase
-    }
+      configurePhase() {
+          mesonConfigurePhase
+      }
 
-    buildPhase() {
-        cdToBuildDir
-        ninjaBuildPhase
-    }
+      buildPhase() {
+          cdToBuildDir
+          ninjaBuildPhase
+      }
 
-    checkPhase() {
-        cdToBuildDir
-        mesonCheckPhase
-    }
+      checkPhase() {
+          cdToBuildDir
+          mesonCheckPhase
+      }
 
-    installPhase() {
-        cdToBuildDir
-        ninjaInstallPhase
-    }
-  '';
+      installPhase() {
+          cdToBuildDir
+          ninjaInstallPhase
+      }
+    '';
 
-  # We use this shell with the local checkout, not unpackPhase.
-  src = null;
+    # We use this shell with the local checkout, not unpackPhase.
+    src = null;
 
-  env = {
-    # Needed for Meson to find Boost.
-    # https://github.com/NixOS/nixpkgs/issues/86131.
-    BOOST_INCLUDEDIR = "${lib.getDev pkgs.nixDependencies.boost}/include";
-    BOOST_LIBRARYDIR = "${lib.getLib pkgs.nixDependencies.boost}/lib";
-    # For `make format`, to work without installing pre-commit
-    _NIX_PRE_COMMIT_HOOKS_CONFIG =
-      "${(pkgs.formats.yaml { }).generate "pre-commit-config.yaml" modular.pre-commit.settings.rawConfig}";
-  };
+    env = {
+      # Needed for Meson to find Boost.
+      # https://github.com/NixOS/nixpkgs/issues/86131.
+      BOOST_INCLUDEDIR = "${lib.getDev pkgs.nixDependencies.boost}/include";
+      BOOST_LIBRARYDIR = "${lib.getLib pkgs.nixDependencies.boost}/lib";
+      # For `make format`, to work without installing pre-commit
+      _NIX_PRE_COMMIT_HOOKS_CONFIG = "${(pkgs.formats.yaml { }).generate "pre-commit-config.yaml"
+        modular.pre-commit.settings.rawConfig
+      }";
+    };
 
-  mesonFlags =
-    map (transformFlag "libutil") (ignoreCrossFile pkgs.nixComponents.nix-util.mesonFlags)
-    ++ map (transformFlag "libstore") (ignoreCrossFile pkgs.nixComponents.nix-store.mesonFlags)
-    ++ map (transformFlag "libfetchers") (ignoreCrossFile pkgs.nixComponents.nix-fetchers.mesonFlags)
-    ++ lib.optionals havePerl (map (transformFlag "perl") (ignoreCrossFile pkgs.nixComponents.nix-perl-bindings.mesonFlags))
-    ++ map (transformFlag "libexpr") (ignoreCrossFile pkgs.nixComponents.nix-expr.mesonFlags)
-    ++ map (transformFlag "libcmd") (ignoreCrossFile pkgs.nixComponents.nix-cmd.mesonFlags)
-    ;
+    mesonFlags =
+      map (transformFlag "libutil") (ignoreCrossFile pkgs.nixComponents.nix-util.mesonFlags)
+      ++ map (transformFlag "libstore") (ignoreCrossFile pkgs.nixComponents.nix-store.mesonFlags)
+      ++ map (transformFlag "libfetchers") (ignoreCrossFile pkgs.nixComponents.nix-fetchers.mesonFlags)
+      ++ lib.optionals havePerl (
+        map (transformFlag "perl") (ignoreCrossFile pkgs.nixComponents.nix-perl-bindings.mesonFlags)
+      )
+      ++ map (transformFlag "libexpr") (ignoreCrossFile pkgs.nixComponents.nix-expr.mesonFlags)
+      ++ map (transformFlag "libcmd") (ignoreCrossFile pkgs.nixComponents.nix-cmd.mesonFlags);
 
-  nativeBuildInputs = attrs.nativeBuildInputs or []
-    ++ pkgs.nixComponents.nix-util.nativeBuildInputs
-    ++ pkgs.nixComponents.nix-store.nativeBuildInputs
-    ++ pkgs.nixComponents.nix-fetchers.nativeBuildInputs
-    ++ pkgs.nixComponents.nix-expr.nativeBuildInputs
-    ++ lib.optionals havePerl pkgs.nixComponents.nix-perl-bindings.nativeBuildInputs
-    ++ lib.optionals buildCanExecuteHost pkgs.nixComponents.nix-manual.externalNativeBuildInputs
-    ++ pkgs.nixComponents.nix-internal-api-docs.nativeBuildInputs
-    ++ pkgs.nixComponents.nix-external-api-docs.nativeBuildInputs
-    ++ pkgs.nixComponents.nix-functional-tests.externalNativeBuildInputs
-    ++ lib.optional
-      (!buildCanExecuteHost
-         # Hack around https://github.com/nixos/nixpkgs/commit/bf7ad8cfbfa102a90463433e2c5027573b462479
-         && !(stdenv.hostPlatform.isWindows && stdenv.buildPlatform.isDarwin)
-         && stdenv.hostPlatform.emulatorAvailable pkgs.buildPackages
-         && lib.meta.availableOn stdenv.buildPlatform (stdenv.hostPlatform.emulator pkgs.buildPackages))
-      pkgs.buildPackages.mesonEmulatorHook
-    ++ [
-      pkgs.buildPackages.cmake
-      pkgs.buildPackages.shellcheck
-      pkgs.buildPackages.changelog-d
-      modular.pre-commit.settings.package
-      (pkgs.writeScriptBin "pre-commit-hooks-install"
-        modular.pre-commit.settings.installationScript)
-    ]
-    # TODO: Remove the darwin check once
-    # https://github.com/NixOS/nixpkgs/pull/291814 is available
-    ++ lib.optional (stdenv.cc.isClang && !stdenv.buildPlatform.isDarwin) pkgs.buildPackages.bear
-    ++ lib.optional (stdenv.cc.isClang && stdenv.hostPlatform == stdenv.buildPlatform) (lib.hiPrio pkgs.buildPackages.clang-tools);
+    nativeBuildInputs =
+      attrs.nativeBuildInputs or [ ]
+      ++ pkgs.nixComponents.nix-util.nativeBuildInputs
+      ++ pkgs.nixComponents.nix-store.nativeBuildInputs
+      ++ pkgs.nixComponents.nix-fetchers.nativeBuildInputs
+      ++ pkgs.nixComponents.nix-expr.nativeBuildInputs
+      ++ lib.optionals havePerl pkgs.nixComponents.nix-perl-bindings.nativeBuildInputs
+      ++ lib.optionals buildCanExecuteHost pkgs.nixComponents.nix-manual.externalNativeBuildInputs
+      ++ pkgs.nixComponents.nix-internal-api-docs.nativeBuildInputs
+      ++ pkgs.nixComponents.nix-external-api-docs.nativeBuildInputs
+      ++ pkgs.nixComponents.nix-functional-tests.externalNativeBuildInputs
+      ++ lib.optional (
+        !buildCanExecuteHost
+        # Hack around https://github.com/nixos/nixpkgs/commit/bf7ad8cfbfa102a90463433e2c5027573b462479
+        && !(stdenv.hostPlatform.isWindows && stdenv.buildPlatform.isDarwin)
+        && stdenv.hostPlatform.emulatorAvailable pkgs.buildPackages
+        && lib.meta.availableOn stdenv.buildPlatform (stdenv.hostPlatform.emulator pkgs.buildPackages)
+      ) pkgs.buildPackages.mesonEmulatorHook
+      ++ [
+        pkgs.buildPackages.cmake
+        pkgs.buildPackages.shellcheck
+        pkgs.buildPackages.changelog-d
+        modular.pre-commit.settings.package
+        (pkgs.writeScriptBin "pre-commit-hooks-install" modular.pre-commit.settings.installationScript)
+      ]
+      # TODO: Remove the darwin check once
+      # https://github.com/NixOS/nixpkgs/pull/291814 is available
+      ++ lib.optional (stdenv.cc.isClang && !stdenv.buildPlatform.isDarwin) pkgs.buildPackages.bear
+      ++ lib.optional (stdenv.cc.isClang && stdenv.hostPlatform == stdenv.buildPlatform) (
+        lib.hiPrio pkgs.buildPackages.clang-tools
+      );
 
-  buildInputs = attrs.buildInputs or []
-    ++ pkgs.nixComponents.nix-util.buildInputs
-    ++ pkgs.nixComponents.nix-store.buildInputs
-    ++ pkgs.nixComponents.nix-store-tests.externalBuildInputs
-    ++ pkgs.nixComponents.nix-fetchers.buildInputs
-    ++ pkgs.nixComponents.nix-expr.buildInputs
-    ++ pkgs.nixComponents.nix-expr.externalPropagatedBuildInputs
-    ++ pkgs.nixComponents.nix-cmd.buildInputs
-    ++ lib.optionals havePerl pkgs.nixComponents.nix-perl-bindings.externalBuildInputs
-    ++ lib.optional havePerl pkgs.perl
-    ;
-})
+    buildInputs =
+      attrs.buildInputs or [ ]
+      ++ pkgs.nixComponents.nix-util.buildInputs
+      ++ pkgs.nixComponents.nix-store.buildInputs
+      ++ pkgs.nixComponents.nix-store-tests.externalBuildInputs
+      ++ pkgs.nixComponents.nix-fetchers.buildInputs
+      ++ pkgs.nixComponents.nix-expr.buildInputs
+      ++ pkgs.nixComponents.nix-expr.externalPropagatedBuildInputs
+      ++ pkgs.nixComponents.nix-cmd.buildInputs
+      ++ lib.optionals havePerl pkgs.nixComponents.nix-perl-bindings.externalBuildInputs
+      ++ lib.optional havePerl pkgs.perl;
+  }
+)
diff --git a/packaging/everything.nix b/packaging/everything.nix
index 7ca878d8d..2b47c31bb 100644
--- a/packaging/everything.nix
+++ b/packaging/everything.nix
@@ -42,27 +42,31 @@
 }:
 
 let
-  libs = {
-    inherit
-      nix-util
-      nix-util-c
-      nix-store
-      nix-store-c
-      nix-fetchers
-      nix-expr
-      nix-expr-c
-      nix-flake
-      nix-flake-c
-      nix-main
-      nix-main-c
-      nix-cmd
-    ;
-  } // lib.optionalAttrs (!stdenv.hostPlatform.isStatic && stdenv.buildPlatform.canExecute stdenv.hostPlatform) {
-    # Currently fails in static build
-    inherit
-      nix-perl-bindings
-    ;
-  };
+  libs =
+    {
+      inherit
+        nix-util
+        nix-util-c
+        nix-store
+        nix-store-c
+        nix-fetchers
+        nix-expr
+        nix-expr-c
+        nix-flake
+        nix-flake-c
+        nix-main
+        nix-main-c
+        nix-cmd
+        ;
+    }
+    // lib.optionalAttrs
+      (!stdenv.hostPlatform.isStatic && stdenv.buildPlatform.canExecute stdenv.hostPlatform)
+      {
+        # Currently fails in static build
+        inherit
+          nix-perl-bindings
+          ;
+      };
 
   dev = stdenv.mkDerivation (finalAttrs: {
     name = "nix-${nix-cli.version}-dev";
@@ -77,10 +81,9 @@ let
     '';
     passthru = {
       tests = {
-        pkg-config =
-          testers.hasPkgConfigModules {
-            package = finalAttrs.finalPackage;
-          };
+        pkg-config = testers.hasPkgConfigModules {
+          package = finalAttrs.finalPackage;
+        };
       };
 
       # If we were to fully emulate output selection here, we'd confuse the Nix CLIs,
@@ -123,70 +126,84 @@ in
   ];
 
   meta.mainProgram = "nix";
-}).overrideAttrs (finalAttrs: prevAttrs: {
-  doCheck = true;
-  doInstallCheck = true;
+}).overrideAttrs
+  (
+    finalAttrs: prevAttrs: {
+      doCheck = true;
+      doInstallCheck = true;
 
-  checkInputs = [
-    # Make sure the unit tests have passed
-    nix-util-tests.tests.run
-    nix-store-tests.tests.run
-    nix-expr-tests.tests.run
-    nix-fetchers-tests.tests.run
-    nix-flake-tests.tests.run
+      checkInputs =
+        [
+          # Make sure the unit tests have passed
+          nix-util-tests.tests.run
+          nix-store-tests.tests.run
+          nix-expr-tests.tests.run
+          nix-fetchers-tests.tests.run
+          nix-flake-tests.tests.run
 
-    # Make sure the functional tests have passed
-    nix-functional-tests
+          # Make sure the functional tests have passed
+          nix-functional-tests
 
-    # dev bundle is ok
-    # (checkInputs must be empty paths??)
-    (runCommand "check-pkg-config" { checked = dev.tests.pkg-config; } "mkdir $out")
-  ] ++ lib.optionals (!stdenv.hostPlatform.isStatic && stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
-    # Perl currently fails in static build
-    # TODO: Split out tests into a separate derivation?
-    nix-perl-bindings
-  ];
-  passthru = prevAttrs.passthru // {
-    inherit (nix-cli) version;
+          # dev bundle is ok
+          # (checkInputs must be empty paths??)
+          (runCommand "check-pkg-config" { checked = dev.tests.pkg-config; } "mkdir $out")
+        ]
+        ++ lib.optionals
+          (!stdenv.hostPlatform.isStatic && stdenv.buildPlatform.canExecute stdenv.hostPlatform)
+          [
+            # Perl currently fails in static build
+            # TODO: Split out tests into a separate derivation?
+            nix-perl-bindings
+          ];
+      passthru = prevAttrs.passthru // {
+        inherit (nix-cli) version;
 
-    /**
-      These are the libraries that are part of the Nix project. They are used
-      by the Nix CLI and other tools.
+        /**
+          These are the libraries that are part of the Nix project. They are used
+          by the Nix CLI and other tools.
 
-      If you need to use these libraries in your project, we recommend to use
-      the `-c` C API libraries exclusively, if possible.
+          If you need to use these libraries in your project, we recommend to use
+          the `-c` C API libraries exclusively, if possible.
 
-      We also recommend that you build the complete package to ensure that the unit tests pass.
-      You could do this in CI, or by passing it in an unused environment variable. e.g in a `mkDerivation` call:
+          We also recommend that you build the complete package to ensure that the unit tests pass.
+          You could do this in CI, or by passing it in an unused environment variable. e.g in a `mkDerivation` call:
 
-      ```nix
-        buildInputs = [ nix.libs.nix-util-c nix.libs.nix-store-c ];
-        # Make sure the nix libs we use are ok
-        unusedInputsForTests = [ nix ];
-        disallowedReferences = nix.all;
-      ```
-     */
-    inherit libs;
+          ```nix
+            buildInputs = [ nix.libs.nix-util-c nix.libs.nix-store-c ];
+            # Make sure the nix libs we use are ok
+            unusedInputsForTests = [ nix ];
+            disallowedReferences = nix.all;
+          ```
+        */
+        inherit libs;
 
-    tests = prevAttrs.passthru.tests or {} // {
-      # TODO: create a proper fixpoint and:
-      # pkg-config =
-      #   testers.hasPkgConfigModules {
-      #     package = finalPackage;
-      #   };
-    };
+        tests = prevAttrs.passthru.tests or { } // {
+          # TODO: create a proper fixpoint and:
+          # pkg-config =
+          #   testers.hasPkgConfigModules {
+          #     package = finalPackage;
+          #   };
+        };
 
-    /**
-      A derivation referencing the `dev` outputs of the Nix libraries.
-     */
-    inherit dev;
-    inherit devdoc;
-    doc = nix-manual;
-    outputs = [ "out" "dev" "devdoc" "doc" ];
-    all = lib.attrValues (lib.genAttrs finalAttrs.passthru.outputs (outName: finalAttrs.finalPackage.${outName}));
-  };
-  meta = prevAttrs.meta // {
-    description = "The Nix package manager";
-    pkgConfigModules = dev.meta.pkgConfigModules;
-  };
-})
+        /**
+          A derivation referencing the `dev` outputs of the Nix libraries.
+        */
+        inherit dev;
+        inherit devdoc;
+        doc = nix-manual;
+        outputs = [
+          "out"
+          "dev"
+          "devdoc"
+          "doc"
+        ];
+        all = lib.attrValues (
+          lib.genAttrs finalAttrs.passthru.outputs (outName: finalAttrs.finalPackage.${outName})
+        );
+      };
+      meta = prevAttrs.meta // {
+        description = "The Nix package manager";
+        pkgConfigModules = dev.meta.pkgConfigModules;
+      };
+    }
+  )
diff --git a/packaging/hydra.nix b/packaging/hydra.nix
index 5b1e47559..764898515 100644
--- a/packaging/hydra.nix
+++ b/packaging/hydra.nix
@@ -1,22 +1,25 @@
-{ inputs
-, binaryTarball
-, forAllCrossSystems
-, forAllSystems
-, lib
-, linux64BitSystems
-, nixpkgsFor
-, self
-, officialRelease
+{
+  inputs,
+  binaryTarball,
+  forAllCrossSystems,
+  forAllSystems,
+  lib,
+  linux64BitSystems,
+  nixpkgsFor,
+  self,
+  officialRelease,
 }:
 let
   inherit (inputs) nixpkgs nixpkgs-regression;
 
-  installScriptFor = tarballs:
+  installScriptFor =
+    tarballs:
     nixpkgsFor.x86_64-linux.native.callPackage ../scripts/installer.nix {
       inherit tarballs;
     };
 
-  testNixVersions = pkgs: daemon:
+  testNixVersions =
+    pkgs: daemon:
     pkgs.nixComponents.nix-functional-tests.override {
       pname = "nix-daemon-compat-tests";
       version = "${pkgs.nix.version}-with-daemon-${daemon.version}";
@@ -54,44 +57,70 @@ let
 in
 {
   # Binary package for various platforms.
-  build = forAllPackages (pkgName:
-    forAllSystems (system: nixpkgsFor.${system}.native.nixComponents.${pkgName}));
+  build = forAllPackages (
+    pkgName: forAllSystems (system: nixpkgsFor.${system}.native.nixComponents.${pkgName})
+  );
 
-  shellInputs = removeAttrs
-    (forAllSystems (system: self.devShells.${system}.default.inputDerivation))
-    [ "i686-linux" ];
+  shellInputs = removeAttrs (forAllSystems (
+    system: self.devShells.${system}.default.inputDerivation
+  )) [ "i686-linux" ];
 
-  buildStatic = forAllPackages (pkgName:
-    lib.genAttrs linux64BitSystems (system: nixpkgsFor.${system}.static.nixComponents.${pkgName}));
+  buildStatic = forAllPackages (
+    pkgName:
+    lib.genAttrs linux64BitSystems (system: nixpkgsFor.${system}.static.nixComponents.${pkgName})
+  );
 
-  buildCross = forAllPackages (pkgName:
+  buildCross = forAllPackages (
+    pkgName:
     # Hack to avoid non-evaling package
-    (if pkgName == "nix-functional-tests" then lib.flip builtins.removeAttrs ["x86_64-w64-mingw32"] else lib.id)
-    (forAllCrossSystems (crossSystem:
-      lib.genAttrs [ "x86_64-linux" ] (system: nixpkgsFor.${system}.cross.${crossSystem}.nixComponents.${pkgName}))));
+    (
+      if pkgName == "nix-functional-tests" then
+        lib.flip builtins.removeAttrs [ "x86_64-w64-mingw32" ]
+      else
+        lib.id
+    )
+      (
+        forAllCrossSystems (
+          crossSystem:
+          lib.genAttrs [ "x86_64-linux" ] (
+            system: nixpkgsFor.${system}.cross.${crossSystem}.nixComponents.${pkgName}
+          )
+        )
+      )
+  );
 
-  buildNoGc = let
-    components = forAllSystems (system:
-      nixpkgsFor.${system}.native.nixComponents.overrideScope (self: super: {
-        nix-expr = super.nix-expr.override { enableGC = false; };
-      })
-    );
-  in forAllPackages (pkgName: forAllSystems (system: components.${system}.${pkgName}));
+  buildNoGc =
+    let
+      components = forAllSystems (
+        system:
+        nixpkgsFor.${system}.native.nixComponents.overrideScope (
+          self: super: {
+            nix-expr = super.nix-expr.override { enableGC = false; };
+          }
+        )
+      );
+    in
+    forAllPackages (pkgName: forAllSystems (system: components.${system}.${pkgName}));
 
   buildNoTests = forAllSystems (system: nixpkgsFor.${system}.native.nixComponents.nix-cli);
 
   # Toggles some settings for better coverage. Windows needs these
   # library combinations, and Debian build Nix with GNU readline too.
-  buildReadlineNoMarkdown = let
-    components = forAllSystems (system:
-      nixpkgsFor.${system}.native.nixComponents.overrideScope (self: super: {
-        nix-cmd = super.nix-cmd.override {
-          enableMarkdown = false;
-          readlineFlavor = "readline";
-        };
-      })
-    );
-  in forAllPackages (pkgName: forAllSystems (system: components.${system}.${pkgName}));
+  buildReadlineNoMarkdown =
+    let
+      components = forAllSystems (
+        system:
+        nixpkgsFor.${system}.native.nixComponents.overrideScope (
+          self: super: {
+            nix-cmd = super.nix-cmd.override {
+              enableMarkdown = false;
+              readlineFlavor = "readline";
+            };
+          }
+        )
+      );
+    in
+    forAllPackages (pkgName: forAllSystems (system: components.${system}.${pkgName}));
 
   # Perl bindings for various platforms.
   perlBindings = forAllSystems (system: nixpkgsFor.${system}.native.nixComponents.nix-perl-bindings);
@@ -99,13 +128,18 @@ in
   # Binary tarball for various platforms, containing a Nix store
   # with the closure of 'nix' package, and the second half of
   # the installation script.
-  binaryTarball = forAllSystems (system: binaryTarball nixpkgsFor.${system}.native.nix nixpkgsFor.${system}.native);
+  binaryTarball = forAllSystems (
+    system: binaryTarball nixpkgsFor.${system}.native.nix nixpkgsFor.${system}.native
+  );
 
-  binaryTarballCross = lib.genAttrs [ "x86_64-linux" ] (system:
-    forAllCrossSystems (crossSystem:
-      binaryTarball
-        nixpkgsFor.${system}.cross.${crossSystem}.nix
-        nixpkgsFor.${system}.cross.${crossSystem}));
+  binaryTarballCross = lib.genAttrs [ "x86_64-linux" ] (
+    system:
+    forAllCrossSystems (
+      crossSystem:
+      binaryTarball nixpkgsFor.${system}.cross.${crossSystem}.nix
+        nixpkgsFor.${system}.cross.${crossSystem}
+    )
+  );
 
   # The first half of the installation script. This is uploaded
   # to https://nixos.org/nix/install. It downloads the binary
@@ -124,9 +158,12 @@ in
     self.hydraJobs.binaryTarballCross."x86_64-linux"."riscv64-unknown-linux-gnu"
   ];
 
-  installerScriptForGHA = forAllSystems (system: nixpkgsFor.${system}.native.callPackage ../scripts/installer.nix {
-    tarballs = [ self.hydraJobs.binaryTarball.${system} ];
-  });
+  installerScriptForGHA = forAllSystems (
+    system:
+    nixpkgsFor.${system}.native.callPackage ../scripts/installer.nix {
+      tarballs = [ self.hydraJobs.binaryTarball.${system} ];
+    }
+  );
 
   # docker image with Nix inside
   dockerImage = lib.genAttrs linux64BitSystems (system: self.packages.${system}.dockerImage);
@@ -147,16 +184,24 @@ in
   external-api-docs = nixpkgsFor.x86_64-linux.native.nixComponents.nix-external-api-docs;
 
   # System tests.
-  tests = import ../tests/nixos { inherit lib nixpkgs nixpkgsFor self; } // {
+  tests =
+    import ../tests/nixos {
+      inherit
+        lib
+        nixpkgs
+        nixpkgsFor
+        self
+        ;
+    }
+    // {
 
-    # Make sure that nix-env still produces the exact same result
-    # on a particular version of Nixpkgs.
-    evalNixpkgs =
-      let
-        inherit (nixpkgsFor.x86_64-linux.native) runCommand nix;
-      in
-      runCommand "eval-nixos" { buildInputs = [ nix ]; }
-        ''
+      # Make sure that nix-env still produces the exact same result
+      # on a particular version of Nixpkgs.
+      evalNixpkgs =
+        let
+          inherit (nixpkgsFor.x86_64-linux.native) runCommand nix;
+        in
+        runCommand "eval-nixos" { buildInputs = [ nix ]; } ''
           type -p nix-env
           # Note: we're filtering out nixos-install-tools because https://github.com/NixOS/nixpkgs/pull/153594#issuecomment-1020530593.
           (
@@ -167,36 +212,36 @@ in
           mkdir $out
         '';
 
-    nixpkgsLibTests =
-      forAllSystems (system:
-        import (nixpkgs + "/lib/tests/test-with-nix.nix")
-          {
-            lib = nixpkgsFor.${system}.native.lib;
-            nix = self.packages.${system}.nix-cli;
-            pkgs = nixpkgsFor.${system}.native;
-          }
+      nixpkgsLibTests = forAllSystems (
+        system:
+        import (nixpkgs + "/lib/tests/test-with-nix.nix") {
+          lib = nixpkgsFor.${system}.native.lib;
+          nix = self.packages.${system}.nix-cli;
+          pkgs = nixpkgsFor.${system}.native;
+        }
       );
-  };
+    };
 
   metrics.nixpkgs = import "${nixpkgs-regression}/pkgs/top-level/metrics.nix" {
     pkgs = nixpkgsFor.x86_64-linux.native;
     nixpkgs = nixpkgs-regression;
   };
 
-  installTests = forAllSystems (system:
-    let pkgs = nixpkgsFor.${system}.native; in
-    pkgs.runCommand "install-tests"
-      {
-        againstSelf = testNixVersions pkgs pkgs.nix;
-        againstCurrentLatest =
-          # FIXME: temporarily disable this on macOS because of #3605.
-          if system == "x86_64-linux"
-          then testNixVersions pkgs pkgs.nixVersions.latest
-          else null;
-        # Disabled because the latest stable version doesn't handle
-        # `NIX_DAEMON_SOCKET_PATH` which is required for the tests to work
-        # againstLatestStable = testNixVersions pkgs pkgs.nixStable;
-      } "touch $out");
+  installTests = forAllSystems (
+    system:
+    let
+      pkgs = nixpkgsFor.${system}.native;
+    in
+    pkgs.runCommand "install-tests" {
+      againstSelf = testNixVersions pkgs pkgs.nix;
+      againstCurrentLatest =
+        # FIXME: temporarily disable this on macOS because of #3605.
+        if system == "x86_64-linux" then testNixVersions pkgs pkgs.nixVersions.latest else null;
+      # Disabled because the latest stable version doesn't handle
+      # `NIX_DAEMON_SOCKET_PATH` which is required for the tests to work
+      # againstLatestStable = testNixVersions pkgs pkgs.nixStable;
+    } "touch $out"
+  );
 
   installerTests = import ../tests/installer {
     binaryTarballs = self.hydraJobs.binaryTarball;
diff --git a/scripts/binary-tarball.nix b/scripts/binary-tarball.nix
index 9de90b7fb..580e3859f 100644
--- a/scripts/binary-tarball.nix
+++ b/scripts/binary-tarball.nix
@@ -1,14 +1,18 @@
-{ runCommand
-, system
-, buildPackages
-, cacert
-, nix
+{
+  runCommand,
+  system,
+  buildPackages,
+  cacert,
+  nix,
 }:
 
 let
 
   installerClosureInfo = buildPackages.closureInfo {
-    rootPaths = [ nix cacert ];
+    rootPaths = [
+      nix
+      cacert
+    ];
   };
 
   inherit (nix) version;
diff --git a/scripts/installer.nix b/scripts/installer.nix
index cc7759c2c..e171f36f9 100644
--- a/scripts/installer.nix
+++ b/scripts/installer.nix
@@ -1,36 +1,42 @@
-{ lib
-, runCommand
-, nix
-, tarballs
+{
+  lib,
+  runCommand,
+  nix,
+  tarballs,
 }:
 
-runCommand "installer-script" {
-  buildInputs = [ nix ];
-} ''
-  mkdir -p $out/nix-support
-
-  # Converts /nix/store/50p3qk8k...-nix-2.4pre20201102_550e11f/bin/nix to 50p3qk8k.../bin/nix.
-  tarballPath() {
-    # Remove the store prefix
-    local path=''${1#${builtins.storeDir}/}
-    # Get the path relative to the derivation root
-    local rest=''${path#*/}
-    # Get the derivation hash
-    local drvHash=''${path%%-*}
-    echo "$drvHash/$rest"
+runCommand "installer-script"
+  {
+    buildInputs = [ nix ];
   }
+  ''
+    mkdir -p $out/nix-support
 
-  substitute ${./install.in} $out/install \
-    ${lib.concatMapStrings
-      (tarball: let
-          inherit (tarball.stdenv.hostPlatform) system;
-        in '' \
-        --replace '@tarballHash_${system}@' $(nix --experimental-features nix-command hash-file --base16 --type sha256 ${tarball}/*.tar.xz) \
-        --replace '@tarballPath_${system}@' $(tarballPath ${tarball}/*.tar.xz) \
-        ''
-      )
-      tarballs
-    } --replace '@nixVersion@' ${nix.version}
+    # Converts /nix/store/50p3qk8k...-nix-2.4pre20201102_550e11f/bin/nix to 50p3qk8k.../bin/nix.
+    tarballPath() {
+      # Remove the store prefix
+      local path=''${1#${builtins.storeDir}/}
+      # Get the path relative to the derivation root
+      local rest=''${path#*/}
+      # Get the derivation hash
+      local drvHash=''${path%%-*}
+      echo "$drvHash/$rest"
+    }
 
-  echo "file installer $out/install" >> $out/nix-support/hydra-build-products
-''
+    substitute ${./install.in} $out/install \
+      ${
+        lib.concatMapStrings (
+          tarball:
+          let
+            inherit (tarball.stdenv.hostPlatform) system;
+          in
+          ''
+            \
+                   --replace '@tarballHash_${system}@' $(nix --experimental-features nix-command hash-file --base16 --type sha256 ${tarball}/*.tar.xz) \
+                   --replace '@tarballPath_${system}@' $(tarballPath ${tarball}/*.tar.xz) \
+          ''
+        ) tarballs
+      } --replace '@nixVersion@' ${nix.version}
+
+    echo "file installer $out/install" >> $out/nix-support/hydra-build-products
+  ''
diff --git a/src/external-api-docs/package.nix b/src/external-api-docs/package.nix
index 57c5138cf..b194e16d4 100644
--- a/src/external-api-docs/package.nix
+++ b/src/external-api-docs/package.nix
@@ -1,11 +1,12 @@
-{ lib
-, mkMesonDerivation
+{
+  lib,
+  mkMesonDerivation,
 
-, doxygen
+  doxygen,
 
-# Configuration Options
+  # Configuration Options
 
-, version
+  version,
 }:
 
 let
@@ -39,11 +40,10 @@ mkMesonDerivation (finalAttrs: {
     doxygen
   ];
 
-  preConfigure =
-    ''
-      chmod u+w ./.version
-      echo ${finalAttrs.version} > ./.version
-    '';
+  preConfigure = ''
+    chmod u+w ./.version
+    echo ${finalAttrs.version} > ./.version
+  '';
 
   postInstall = ''
     mkdir -p ''${!outputDoc}/nix-support
diff --git a/src/internal-api-docs/package.nix b/src/internal-api-docs/package.nix
index 993a257a6..6c4f354ae 100644
--- a/src/internal-api-docs/package.nix
+++ b/src/internal-api-docs/package.nix
@@ -1,11 +1,12 @@
-{ lib
-, mkMesonDerivation
+{
+  lib,
+  mkMesonDerivation,
 
-, doxygen
+  doxygen,
 
-# Configuration Options
+  # Configuration Options
 
-, version
+  version,
 }:
 
 let
@@ -17,27 +18,28 @@ mkMesonDerivation (finalAttrs: {
   inherit version;
 
   workDir = ./.;
-  fileset = let
-    cpp = fileset.fileFilter (file: file.hasExt "cc" || file.hasExt "hh");
-  in fileset.unions [
-    ./.version
-    ../../.version
-    ./meson.build
-    ./doxygen.cfg.in
-    # Source is not compiled, but still must be available for Doxygen
-    # to gather comments.
-    (cpp ../.)
-  ];
+  fileset =
+    let
+      cpp = fileset.fileFilter (file: file.hasExt "cc" || file.hasExt "hh");
+    in
+    fileset.unions [
+      ./.version
+      ../../.version
+      ./meson.build
+      ./doxygen.cfg.in
+      # Source is not compiled, but still must be available for Doxygen
+      # to gather comments.
+      (cpp ../.)
+    ];
 
   nativeBuildInputs = [
     doxygen
   ];
 
-  preConfigure =
-    ''
-      chmod u+w ./.version
-      echo ${finalAttrs.version} > ./.version
-    '';
+  preConfigure = ''
+    chmod u+w ./.version
+    echo ${finalAttrs.version} > ./.version
+  '';
 
   postInstall = ''
     mkdir -p ''${!outputDoc}/nix-support
diff --git a/src/libcmd/package.nix b/src/libcmd/package.nix
index 5cafb4dc1..d155d9f1e 100644
--- a/src/libcmd/package.nix
+++ b/src/libcmd/package.nix
@@ -1,32 +1,33 @@
-{ lib
-, stdenv
-, mkMesonLibrary
+{
+  lib,
+  stdenv,
+  mkMesonLibrary,
 
-, nix-util
-, nix-store
-, nix-fetchers
-, nix-expr
-, nix-flake
-, nix-main
-, editline
-, readline
-, lowdown
-, nlohmann_json
+  nix-util,
+  nix-store,
+  nix-fetchers,
+  nix-expr,
+  nix-flake,
+  nix-main,
+  editline,
+  readline,
+  lowdown,
+  nlohmann_json,
 
-# Configuration Options
+  # Configuration Options
 
-, version
+  version,
 
-# Whether to enable Markdown rendering in the Nix binary.
-, enableMarkdown ? !stdenv.hostPlatform.isWindows
+  # Whether to enable Markdown rendering in the Nix binary.
+  enableMarkdown ? !stdenv.hostPlatform.isWindows,
 
-# Which interactive line editor library to use for Nix's repl.
-#
-# Currently supported choices are:
-#
-# - editline (default)
-# - readline
-, readlineFlavor ? if stdenv.hostPlatform.isWindows then "readline" else "editline"
+  # Which interactive line editor library to use for Nix's repl.
+  #
+  # Currently supported choices are:
+  #
+  # - editline (default)
+  # - readline
+  readlineFlavor ? if stdenv.hostPlatform.isWindows then "readline" else "editline",
 }:
 
 let
diff --git a/src/libexpr-c/package.nix b/src/libexpr-c/package.nix
index 5047f3e2e..ad1ea371c 100644
--- a/src/libexpr-c/package.nix
+++ b/src/libexpr-c/package.nix
@@ -1,12 +1,13 @@
-{ lib
-, mkMesonLibrary
+{
+  lib,
+  mkMesonLibrary,
 
-, nix-store-c
-, nix-expr
+  nix-store-c,
+  nix-expr,
 
-# Configuration Options
+  # Configuration Options
 
-, version
+  version,
 }:
 
 let
diff --git a/src/libexpr-test-support/package.nix b/src/libexpr-test-support/package.nix
index 48118fa0c..5628d606a 100644
--- a/src/libexpr-test-support/package.nix
+++ b/src/libexpr-test-support/package.nix
@@ -1,15 +1,16 @@
-{ lib
-, mkMesonLibrary
+{
+  lib,
+  mkMesonLibrary,
 
-, nix-store-test-support
-, nix-expr
-, nix-expr-c
+  nix-store-test-support,
+  nix-expr,
+  nix-expr-c,
 
-, rapidcheck
+  rapidcheck,
 
-# Configuration Options
+  # Configuration Options
 
-, version
+  version,
 }:
 
 let
diff --git a/src/libexpr-tests/package.nix b/src/libexpr-tests/package.nix
index a4a3bb0e7..bb5acb7c8 100644
--- a/src/libexpr-tests/package.nix
+++ b/src/libexpr-tests/package.nix
@@ -1,20 +1,21 @@
-{ lib
-, buildPackages
-, stdenv
-, mkMesonExecutable
+{
+  lib,
+  buildPackages,
+  stdenv,
+  mkMesonExecutable,
 
-, nix-expr
-, nix-expr-c
-, nix-expr-test-support
+  nix-expr,
+  nix-expr-c,
+  nix-expr-test-support,
 
-, rapidcheck
-, gtest
-, runCommand
+  rapidcheck,
+  gtest,
+  runCommand,
 
-# Configuration Options
+  # Configuration Options
 
-, version
-, resolvePath
+  version,
+  resolvePath,
 }:
 
 let
@@ -58,16 +59,22 @@ mkMesonExecutable (finalAttrs: {
 
   passthru = {
     tests = {
-      run = runCommand "${finalAttrs.pname}-run" {
-        meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
-      } (lib.optionalString stdenv.hostPlatform.isWindows ''
-        export HOME="$PWD/home-dir"
-        mkdir -p "$HOME"
-      '' + ''
-        export _NIX_TEST_UNIT_DATA=${resolvePath ./data}
-        ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
-        touch $out
-      '');
+      run =
+        runCommand "${finalAttrs.pname}-run"
+          {
+            meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
+          }
+          (
+            lib.optionalString stdenv.hostPlatform.isWindows ''
+              export HOME="$PWD/home-dir"
+              mkdir -p "$HOME"
+            ''
+            + ''
+              export _NIX_TEST_UNIT_DATA=${resolvePath ./data}
+              ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
+              touch $out
+            ''
+          );
     };
   };
 
diff --git a/src/libexpr/call-flake.nix b/src/libexpr/call-flake.nix
index 964ba2521..9b38644bb 100644
--- a/src/libexpr/call-flake.nix
+++ b/src/libexpr/call-flake.nix
@@ -20,77 +20,77 @@ let
   # Resolve a input spec into a node name. An input spec is
   # either a node name, or a 'follows' path from the root
   # node.
-  resolveInput = inputSpec:
-    if builtins.isList inputSpec
-    then getInputByPath lockFile.root inputSpec
-    else inputSpec;
+  resolveInput =
+    inputSpec: if builtins.isList inputSpec then getInputByPath lockFile.root inputSpec else inputSpec;
 
   # Follow an input path (e.g. ["dwarffs" "nixpkgs"]) from the
   # root node, returning the final node.
-  getInputByPath = nodeName: path:
-    if path == []
-    then nodeName
+  getInputByPath =
+    nodeName: path:
+    if path == [ ] then
+      nodeName
     else
       getInputByPath
         # Since this could be a 'follows' input, call resolveInput.
         (resolveInput lockFile.nodes.${nodeName}.inputs.${builtins.head path})
         (builtins.tail path);
 
-  allNodes =
-    builtins.mapAttrs
-      (key: node:
-        let
+  allNodes = builtins.mapAttrs (
+    key: node:
+    let
 
-          parentNode = allNodes.${getInputByPath lockFile.root node.parent};
+      parentNode = allNodes.${getInputByPath lockFile.root node.parent};
 
-          sourceInfo =
-            if overrides ? ${key}
-            then
-              overrides.${key}.sourceInfo
-            else if node.locked.type == "path" && builtins.substring 0 1 node.locked.path != "/"
-            then
-              parentNode.sourceInfo // {
-                outPath = parentNode.outPath + ("/" + node.locked.path);
-              }
-            else
-              # FIXME: remove obsolete node.info.
-              # Note: lock file entries are always final.
-              fetchTreeFinal (node.info or {} // removeAttrs node.locked ["dir"]);
+      sourceInfo =
+        if overrides ? ${key} then
+          overrides.${key}.sourceInfo
+        else if node.locked.type == "path" && builtins.substring 0 1 node.locked.path != "/" then
+          parentNode.sourceInfo
+          // {
+            outPath = parentNode.outPath + ("/" + node.locked.path);
+          }
+        else
+          # FIXME: remove obsolete node.info.
+          # Note: lock file entries are always final.
+          fetchTreeFinal (node.info or { } // removeAttrs node.locked [ "dir" ]);
 
-          subdir = overrides.${key}.dir or node.locked.dir or "";
+      subdir = overrides.${key}.dir or node.locked.dir or "";
 
-          outPath = sourceInfo + ((if subdir == "" then "" else "/") + subdir);
+      outPath = sourceInfo + ((if subdir == "" then "" else "/") + subdir);
 
-          flake = import (outPath + "/flake.nix");
+      flake = import (outPath + "/flake.nix");
 
-          inputs = builtins.mapAttrs
-            (inputName: inputSpec: allNodes.${resolveInput inputSpec})
-            (node.inputs or {});
+      inputs = builtins.mapAttrs (inputName: inputSpec: allNodes.${resolveInput inputSpec}) (
+        node.inputs or { }
+      );
 
-          outputs = flake.outputs (inputs // { self = result; });
+      outputs = flake.outputs (inputs // { self = result; });
 
-          result =
-            outputs
-            # We add the sourceInfo attribute for its metadata, as they are
-            # relevant metadata for the flake. However, the outPath of the
-            # sourceInfo does not necessarily match the outPath of the flake,
-            # as the flake may be in a subdirectory of a source.
-            # This is shadowed in the next //
-            // sourceInfo
-            // {
-              # This shadows the sourceInfo.outPath
-              inherit outPath;
+      result =
+        outputs
+        # We add the sourceInfo attribute for its metadata, as they are
+        # relevant metadata for the flake. However, the outPath of the
+        # sourceInfo does not necessarily match the outPath of the flake,
+        # as the flake may be in a subdirectory of a source.
+        # This is shadowed in the next //
+        // sourceInfo
+        // {
+          # This shadows the sourceInfo.outPath
+          inherit outPath;
 
-              inherit inputs; inherit outputs; inherit sourceInfo; _type = "flake";
-            };
+          inherit inputs;
+          inherit outputs;
+          inherit sourceInfo;
+          _type = "flake";
+        };
 
-        in
-          if node.flake or true then
-            assert builtins.isFunction flake.outputs;
-            result
-          else
-            sourceInfo
-      )
-      lockFile.nodes;
+    in
+    if node.flake or true then
+      assert builtins.isFunction flake.outputs;
+      result
+    else
+      sourceInfo
+  ) lockFile.nodes;
 
-in allNodes.${lockFile.root}
+in
+allNodes.${lockFile.root}
diff --git a/src/libexpr/fetchurl.nix b/src/libexpr/fetchurl.nix
index 85a01d161..72b3b00df 100644
--- a/src/libexpr/fetchurl.nix
+++ b/src/libexpr/fetchurl.nix
@@ -1,40 +1,72 @@
-{ system ? "" # obsolete
-, url
-, hash ? "" # an SRI hash
+{
+  system ? "", # obsolete
+  url,
+  hash ? "", # an SRI hash
 
-# Legacy hash specification
-, md5 ? "", sha1 ? "", sha256 ? "", sha512 ? ""
-, outputHash ?
-    if hash != "" then hash else if sha512 != "" then sha512 else if sha1 != "" then sha1 else if md5 != "" then md5 else sha256
-, outputHashAlgo ?
-    if hash != "" then "" else if sha512 != "" then "sha512" else if sha1 != "" then "sha1" else if md5 != "" then "md5" else "sha256"
+  # Legacy hash specification
+  md5 ? "",
+  sha1 ? "",
+  sha256 ? "",
+  sha512 ? "",
+  outputHash ?
+    if hash != "" then
+      hash
+    else if sha512 != "" then
+      sha512
+    else if sha1 != "" then
+      sha1
+    else if md5 != "" then
+      md5
+    else
+      sha256,
+  outputHashAlgo ?
+    if hash != "" then
+      ""
+    else if sha512 != "" then
+      "sha512"
+    else if sha1 != "" then
+      "sha1"
+    else if md5 != "" then
+      "md5"
+    else
+      "sha256",
 
-, executable ? false
-, unpack ? false
-, name ? baseNameOf (toString url)
-, impure ? false
+  executable ? false,
+  unpack ? false,
+  name ? baseNameOf (toString url),
+  impure ? false,
 }:
 
-derivation ({
-  builder = "builtin:fetchurl";
+derivation (
+  {
+    builder = "builtin:fetchurl";
 
-  # New-style output content requirements.
-  outputHashMode = if unpack || executable then "recursive" else "flat";
+    # New-style output content requirements.
+    outputHashMode = if unpack || executable then "recursive" else "flat";
 
-  inherit name url executable unpack;
+    inherit
+      name
+      url
+      executable
+      unpack
+      ;
 
-  system = "builtin";
+    system = "builtin";
 
-  # No need to double the amount of network traffic
-  preferLocalBuild = true;
+    # No need to double the amount of network traffic
+    preferLocalBuild = true;
 
-  # This attribute does nothing; it's here to avoid changing evaluation results.
-  impureEnvVars = [
-    "http_proxy" "https_proxy" "ftp_proxy" "all_proxy" "no_proxy"
-  ];
+    # This attribute does nothing; it's here to avoid changing evaluation results.
+    impureEnvVars = [
+      "http_proxy"
+      "https_proxy"
+      "ftp_proxy"
+      "all_proxy"
+      "no_proxy"
+    ];
 
-  # To make "nix-prefetch-url" work.
-  urls = [ url ];
-} // (if impure
-      then { __impure = true; }
-      else { inherit outputHashAlgo outputHash; }))
+    # To make "nix-prefetch-url" work.
+    urls = [ url ];
+  }
+  // (if impure then { __impure = true; } else { inherit outputHashAlgo outputHash; })
+)
diff --git a/src/libexpr/imported-drv-to-derivation.nix b/src/libexpr/imported-drv-to-derivation.nix
index eab8b050e..e2cf7fd26 100644
--- a/src/libexpr/imported-drv-to-derivation.nix
+++ b/src/libexpr/imported-drv-to-derivation.nix
@@ -1,21 +1,27 @@
-attrs @ { drvPath, outputs, name, ... }:
+attrs@{
+  drvPath,
+  outputs,
+  name,
+  ...
+}:
 
 let
 
-  commonAttrs = (builtins.listToAttrs outputsList) //
-    { all = map (x: x.value) outputsList;
-      inherit drvPath name;
-      type = "derivation";
-    };
+  commonAttrs = (builtins.listToAttrs outputsList) // {
+    all = map (x: x.value) outputsList;
+    inherit drvPath name;
+    type = "derivation";
+  };
 
-  outputToAttrListElement = outputName:
-    { name = outputName;
-      value = commonAttrs // {
-        outPath = builtins.getAttr outputName attrs;
-        inherit outputName;
-      };
+  outputToAttrListElement = outputName: {
+    name = outputName;
+    value = commonAttrs // {
+      outPath = builtins.getAttr outputName attrs;
+      inherit outputName;
     };
-    
+  };
+
   outputsList = map outputToAttrListElement outputs;
-    
-in (builtins.head outputsList).value
+
+in
+(builtins.head outputsList).value
diff --git a/src/libexpr/package.nix b/src/libexpr/package.nix
index 3d5b78e35..afd01c384 100644
--- a/src/libexpr/package.nix
+++ b/src/libexpr/package.nix
@@ -1,33 +1,34 @@
-{ lib
-, stdenv
-, mkMesonLibrary
+{
+  lib,
+  stdenv,
+  mkMesonLibrary,
 
-, bison
-, flex
-, cmake # for resolving toml11 dep
+  bison,
+  flex,
+  cmake, # for resolving toml11 dep
 
-, nix-util
-, nix-store
-, nix-fetchers
-, boost
-, boehmgc
-, nlohmann_json
-, toml11
+  nix-util,
+  nix-store,
+  nix-fetchers,
+  boost,
+  boehmgc,
+  nlohmann_json,
+  toml11,
 
-# Configuration Options
+  # Configuration Options
 
-, version
+  version,
 
-# Whether to use garbage collection for the Nix language evaluator.
-#
-# If it is disabled, we just leak memory, but this is not as bad as it
-# sounds so long as evaluation just takes places within short-lived
-# processes. (When the process exits, the memory is reclaimed; it is
-# only leaked *within* the process.)
-#
-# Temporarily disabled on Windows because the `GC_throw_bad_alloc`
-# symbol is missing during linking.
-, enableGC ? !stdenv.hostPlatform.isWindows
+  # Whether to use garbage collection for the Nix language evaluator.
+  #
+  # If it is disabled, we just leak memory, but this is not as bad as it
+  # sounds so long as evaluation just takes places within short-lived
+  # processes. (When the process exits, the memory is reclaimed; it is
+  # only leaked *within* the process.)
+  #
+  # Temporarily disabled on Windows because the `GC_throw_bad_alloc`
+  # symbol is missing during linking.
+  enableGC ? !stdenv.hostPlatform.isWindows,
 }:
 
 let
@@ -51,10 +52,7 @@ mkMesonLibrary (finalAttrs: {
     (fileset.fileFilter (file: file.hasExt "hh") ./.)
     ./lexer.l
     ./parser.y
-    (fileset.difference
-      (fileset.fileFilter (file: file.hasExt "nix") ./.)
-      ./package.nix
-    )
+    (fileset.difference (fileset.fileFilter (file: file.hasExt "nix") ./.) ./package.nix)
   ];
 
   nativeBuildInputs = [
diff --git a/src/libexpr/primops/derivation.nix b/src/libexpr/primops/derivation.nix
index f329ff71e..dbb8c2186 100644
--- a/src/libexpr/primops/derivation.nix
+++ b/src/libexpr/primops/derivation.nix
@@ -26,27 +26,34 @@
   Note that `derivation` is very bare-bones, and provides almost no commands during the build.
   Most likely, you'll want to use functions like `stdenv.mkDerivation` in Nixpkgs to set up a basic environment.
 */
-drvAttrs @ { outputs ? [ "out" ], ... }:
+drvAttrs@{
+  outputs ? [ "out" ],
+  ...
+}:
 
 let
 
   strict = derivationStrict drvAttrs;
 
-  commonAttrs = drvAttrs // (builtins.listToAttrs outputsList) //
-    { all = map (x: x.value) outputsList;
+  commonAttrs =
+    drvAttrs
+    // (builtins.listToAttrs outputsList)
+    // {
+      all = map (x: x.value) outputsList;
       inherit drvAttrs;
     };
 
-  outputToAttrListElement = outputName:
-    { name = outputName;
-      value = commonAttrs // {
-        outPath = builtins.getAttr outputName strict;
-        drvPath = strict.drvPath;
-        type = "derivation";
-        inherit outputName;
-      };
+  outputToAttrListElement = outputName: {
+    name = outputName;
+    value = commonAttrs // {
+      outPath = builtins.getAttr outputName strict;
+      drvPath = strict.drvPath;
+      type = "derivation";
+      inherit outputName;
     };
+  };
 
   outputsList = map outputToAttrListElement outputs;
 
-in (builtins.head outputsList).value
+in
+(builtins.head outputsList).value
diff --git a/src/libfetchers-tests/package.nix b/src/libfetchers-tests/package.nix
index 5336672a2..f2680e9b3 100644
--- a/src/libfetchers-tests/package.nix
+++ b/src/libfetchers-tests/package.nix
@@ -1,19 +1,20 @@
-{ lib
-, buildPackages
-, stdenv
-, mkMesonExecutable
+{
+  lib,
+  buildPackages,
+  stdenv,
+  mkMesonExecutable,
 
-, nix-fetchers
-, nix-store-test-support
+  nix-fetchers,
+  nix-store-test-support,
 
-, rapidcheck
-, gtest
-, runCommand
+  rapidcheck,
+  gtest,
+  runCommand,
 
-# Configuration Options
+  # Configuration Options
 
-, version
-, resolvePath
+  version,
+  resolvePath,
 }:
 
 let
@@ -56,16 +57,22 @@ mkMesonExecutable (finalAttrs: {
 
   passthru = {
     tests = {
-      run = runCommand "${finalAttrs.pname}-run" {
-        meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
-      } (lib.optionalString stdenv.hostPlatform.isWindows ''
-        export HOME="$PWD/home-dir"
-        mkdir -p "$HOME"
-      '' + ''
-        export _NIX_TEST_UNIT_DATA=${resolvePath ./data}
-        ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
-        touch $out
-      '');
+      run =
+        runCommand "${finalAttrs.pname}-run"
+          {
+            meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
+          }
+          (
+            lib.optionalString stdenv.hostPlatform.isWindows ''
+              export HOME="$PWD/home-dir"
+              mkdir -p "$HOME"
+            ''
+            + ''
+              export _NIX_TEST_UNIT_DATA=${resolvePath ./data}
+              ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
+              touch $out
+            ''
+          );
     };
   };
 
diff --git a/src/libfetchers/package.nix b/src/libfetchers/package.nix
index d4ca18555..b0aecd049 100644
--- a/src/libfetchers/package.nix
+++ b/src/libfetchers/package.nix
@@ -1,14 +1,15 @@
-{ lib
-, mkMesonLibrary
+{
+  lib,
+  mkMesonLibrary,
 
-, nix-util
-, nix-store
-, nlohmann_json
-, libgit2
+  nix-util,
+  nix-store,
+  nlohmann_json,
+  libgit2,
 
-# Configuration Options
+  # Configuration Options
 
-, version
+  version,
 }:
 
 let
diff --git a/src/libflake-c/package.nix b/src/libflake-c/package.nix
index dcd6c4966..f0615a427 100644
--- a/src/libflake-c/package.nix
+++ b/src/libflake-c/package.nix
@@ -1,13 +1,14 @@
-{ lib
-, mkMesonLibrary
+{
+  lib,
+  mkMesonLibrary,
 
-, nix-store-c
-, nix-expr-c
-, nix-flake
+  nix-store-c,
+  nix-expr-c,
+  nix-flake,
 
-# Configuration Options
+  # Configuration Options
 
-, version
+  version,
 }:
 
 let
diff --git a/src/libflake-tests/package.nix b/src/libflake-tests/package.nix
index 51b68ad58..f9d9b0bc0 100644
--- a/src/libflake-tests/package.nix
+++ b/src/libflake-tests/package.nix
@@ -1,20 +1,21 @@
-{ lib
-, buildPackages
-, stdenv
-, mkMesonExecutable
+{
+  lib,
+  buildPackages,
+  stdenv,
+  mkMesonExecutable,
 
-, nix-flake
-, nix-flake-c
-, nix-expr-test-support
+  nix-flake,
+  nix-flake-c,
+  nix-expr-test-support,
 
-, rapidcheck
-, gtest
-, runCommand
+  rapidcheck,
+  gtest,
+  runCommand,
 
-# Configuration Options
+  # Configuration Options
 
-, version
-, resolvePath
+  version,
+  resolvePath,
 }:
 
 let
@@ -58,17 +59,23 @@ mkMesonExecutable (finalAttrs: {
 
   passthru = {
     tests = {
-      run = runCommand "${finalAttrs.pname}-run" {
-        meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
-      } (lib.optionalString stdenv.hostPlatform.isWindows ''
-        export HOME="$PWD/home-dir"
-        mkdir -p "$HOME"
-      '' + ''
-        export _NIX_TEST_UNIT_DATA=${resolvePath ./data}
-        export NIX_CONFIG="extra-experimental-features = flakes"
-        ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
-        touch $out
-      '');
+      run =
+        runCommand "${finalAttrs.pname}-run"
+          {
+            meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
+          }
+          (
+            lib.optionalString stdenv.hostPlatform.isWindows ''
+              export HOME="$PWD/home-dir"
+              mkdir -p "$HOME"
+            ''
+            + ''
+              export _NIX_TEST_UNIT_DATA=${resolvePath ./data}
+              export NIX_CONFIG="extra-experimental-features = flakes"
+              ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
+              touch $out
+            ''
+          );
     };
   };
 
diff --git a/src/libflake/package.nix b/src/libflake/package.nix
index 3fc96a20e..ebd38e140 100644
--- a/src/libflake/package.nix
+++ b/src/libflake/package.nix
@@ -1,15 +1,16 @@
-{ lib
-, mkMesonLibrary
+{
+  lib,
+  mkMesonLibrary,
 
-, nix-util
-, nix-store
-, nix-fetchers
-, nix-expr
-, nlohmann_json
+  nix-util,
+  nix-store,
+  nix-fetchers,
+  nix-expr,
+  nlohmann_json,
 
-# Configuration Options
+  # Configuration Options
 
-, version
+  version,
 }:
 
 let
diff --git a/src/libmain-c/package.nix b/src/libmain-c/package.nix
index b96901bb4..cf710e03b 100644
--- a/src/libmain-c/package.nix
+++ b/src/libmain-c/package.nix
@@ -1,14 +1,15 @@
-{ lib
-, mkMesonLibrary
+{
+  lib,
+  mkMesonLibrary,
 
-, nix-util-c
-, nix-store
-, nix-store-c
-, nix-main
+  nix-util-c,
+  nix-store,
+  nix-store-c,
+  nix-main,
 
-# Configuration Options
+  # Configuration Options
 
-, version
+  version,
 }:
 
 let
diff --git a/src/libmain/package.nix b/src/libmain/package.nix
index 9a5b9e8c2..046b505df 100644
--- a/src/libmain/package.nix
+++ b/src/libmain/package.nix
@@ -1,14 +1,15 @@
-{ lib
-, mkMesonLibrary
+{
+  lib,
+  mkMesonLibrary,
 
-, openssl
+  openssl,
 
-, nix-util
-, nix-store
+  nix-util,
+  nix-store,
 
-# Configuration Options
+  # Configuration Options
 
-, version
+  version,
 }:
 
 let
diff --git a/src/libstore-c/package.nix b/src/libstore-c/package.nix
index c2413c389..89abeaab8 100644
--- a/src/libstore-c/package.nix
+++ b/src/libstore-c/package.nix
@@ -1,12 +1,13 @@
-{ lib
-, mkMesonLibrary
+{
+  lib,
+  mkMesonLibrary,
 
-, nix-util-c
-, nix-store
+  nix-util-c,
+  nix-store,
 
-# Configuration Options
+  # Configuration Options
 
-, version
+  version,
 }:
 
 let
diff --git a/src/libstore-test-support/package.nix b/src/libstore-test-support/package.nix
index 5d3f41b3e..7cc29795c 100644
--- a/src/libstore-test-support/package.nix
+++ b/src/libstore-test-support/package.nix
@@ -1,15 +1,16 @@
-{ lib
-, mkMesonLibrary
+{
+  lib,
+  mkMesonLibrary,
 
-, nix-util-test-support
-, nix-store
-, nix-store-c
+  nix-util-test-support,
+  nix-store,
+  nix-store-c,
 
-, rapidcheck
+  rapidcheck,
 
-# Configuration Options
+  # Configuration Options
 
-, version
+  version,
 }:
 
 let
diff --git a/src/libstore-tests/package.nix b/src/libstore-tests/package.nix
index 3acf4e25c..670386c4a 100644
--- a/src/libstore-tests/package.nix
+++ b/src/libstore-tests/package.nix
@@ -1,21 +1,22 @@
-{ lib
-, buildPackages
-, stdenv
-, mkMesonExecutable
+{
+  lib,
+  buildPackages,
+  stdenv,
+  mkMesonExecutable,
 
-, nix-store
-, nix-store-c
-, nix-store-test-support
-, sqlite
+  nix-store,
+  nix-store-c,
+  nix-store-test-support,
+  sqlite,
 
-, rapidcheck
-, gtest
-, runCommand
+  rapidcheck,
+  gtest,
+  runCommand,
 
-# Configuration Options
+  # Configuration Options
 
-, version
-, filesetToSource
+  version,
+  filesetToSource,
 }:
 
 let
@@ -64,26 +65,33 @@ mkMesonExecutable (finalAttrs: {
 
   passthru = {
     tests = {
-      run = let
-        # Some data is shared with the functional tests: they create it,
-        # we consume it.
-        data = filesetToSource {
-          root = ../..;
-          fileset = lib.fileset.unions [
-            ./data
-            ../../tests/functional/derivation
-          ];
-        };
-      in runCommand "${finalAttrs.pname}-run" {
-        meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
-      } (lib.optionalString stdenv.hostPlatform.isWindows ''
-        export HOME="$PWD/home-dir"
-        mkdir -p "$HOME"
-      '' + ''
-        export _NIX_TEST_UNIT_DATA=${data + "/src/libstore-tests/data"}
-        ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
-        touch $out
-      '');
+      run =
+        let
+          # Some data is shared with the functional tests: they create it,
+          # we consume it.
+          data = filesetToSource {
+            root = ../..;
+            fileset = lib.fileset.unions [
+              ./data
+              ../../tests/functional/derivation
+            ];
+          };
+        in
+        runCommand "${finalAttrs.pname}-run"
+          {
+            meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
+          }
+          (
+            lib.optionalString stdenv.hostPlatform.isWindows ''
+              export HOME="$PWD/home-dir"
+              mkdir -p "$HOME"
+            ''
+            + ''
+              export _NIX_TEST_UNIT_DATA=${data + "/src/libstore-tests/data"}
+              ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
+              touch $out
+            ''
+          );
     };
   };
 
diff --git a/src/libstore/package.nix b/src/libstore/package.nix
index 4fbaea4ac..c982b44f0 100644
--- a/src/libstore/package.nix
+++ b/src/libstore/package.nix
@@ -1,25 +1,26 @@
-{ lib
-, stdenv
-, mkMesonLibrary
+{
+  lib,
+  stdenv,
+  mkMesonLibrary,
 
-, unixtools
-, darwin
+  unixtools,
+  darwin,
 
-, nix-util
-, boost
-, curl
-, aws-sdk-cpp
-, libseccomp
-, nlohmann_json
-, sqlite
+  nix-util,
+  boost,
+  curl,
+  aws-sdk-cpp,
+  libseccomp,
+  nlohmann_json,
+  sqlite,
 
-, busybox-sandbox-shell ? null
+  busybox-sandbox-shell ? null,
 
-# Configuration Options
+  # Configuration Options
 
-, version
+  version,
 
-, embeddedSandboxShell ? stdenv.hostPlatform.isStatic
+  embeddedSandboxShell ? stdenv.hostPlatform.isStatic,
 }:
 
 let
@@ -48,19 +49,20 @@ mkMesonLibrary (finalAttrs: {
     (fileset.fileFilter (file: file.hasExt "sql") ./.)
   ];
 
-  nativeBuildInputs =
-    lib.optional embeddedSandboxShell unixtools.hexdump;
+  nativeBuildInputs = lib.optional embeddedSandboxShell unixtools.hexdump;
 
-  buildInputs = [
-    boost
-    curl
-    sqlite
-  ] ++ lib.optional stdenv.hostPlatform.isLinux libseccomp
+  buildInputs =
+    [
+      boost
+      curl
+      sqlite
+    ]
+    ++ lib.optional stdenv.hostPlatform.isLinux libseccomp
     # There have been issues building these dependencies
     ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.libs.sandbox
-    ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin))
-      aws-sdk-cpp
-  ;
+    ++ lib.optional (
+      stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin)
+    ) aws-sdk-cpp;
 
   propagatedBuildInputs = [
     nix-util
@@ -75,12 +77,14 @@ mkMesonLibrary (finalAttrs: {
       echo ${version} > ../../.version
     '';
 
-  mesonFlags = [
-    (lib.mesonEnable "seccomp-sandboxing" stdenv.hostPlatform.isLinux)
-    (lib.mesonBool "embedded-sandbox-shell" embeddedSandboxShell)
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    (lib.mesonOption "sandbox-shell" "${busybox-sandbox-shell}/bin/busybox")
-  ];
+  mesonFlags =
+    [
+      (lib.mesonEnable "seccomp-sandboxing" stdenv.hostPlatform.isLinux)
+      (lib.mesonBool "embedded-sandbox-shell" embeddedSandboxShell)
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      (lib.mesonOption "sandbox-shell" "${busybox-sandbox-shell}/bin/busybox")
+    ];
 
   env = {
     # Needed for Meson to find Boost.
diff --git a/src/libutil-c/package.nix b/src/libutil-c/package.nix
index f80e0b7f0..72f57d6f9 100644
--- a/src/libutil-c/package.nix
+++ b/src/libutil-c/package.nix
@@ -1,11 +1,12 @@
-{ lib
-, mkMesonLibrary
+{
+  lib,
+  mkMesonLibrary,
 
-, nix-util
+  nix-util,
 
-# Configuration Options
+  # Configuration Options
 
-, version
+  version,
 }:
 
 let
diff --git a/src/libutil-test-support/package.nix b/src/libutil-test-support/package.nix
index a8a239717..33cd5217d 100644
--- a/src/libutil-test-support/package.nix
+++ b/src/libutil-test-support/package.nix
@@ -1,14 +1,15 @@
-{ lib
-, mkMesonLibrary
+{
+  lib,
+  mkMesonLibrary,
 
-, nix-util
-, nix-util-c
+  nix-util,
+  nix-util-c,
 
-, rapidcheck
+  rapidcheck,
 
-# Configuration Options
+  # Configuration Options
 
-, version
+  version,
 }:
 
 let
diff --git a/src/libutil-tests/package.nix b/src/libutil-tests/package.nix
index 28769e115..d89c54453 100644
--- a/src/libutil-tests/package.nix
+++ b/src/libutil-tests/package.nix
@@ -1,19 +1,20 @@
-{ lib
-, buildPackages
-, stdenv
-, mkMesonExecutable
+{
+  lib,
+  buildPackages,
+  stdenv,
+  mkMesonExecutable,
 
-, nix-util
-, nix-util-c
-, nix-util-test-support
+  nix-util,
+  nix-util-c,
+  nix-util-test-support,
 
-, rapidcheck
-, gtest
-, runCommand
+  rapidcheck,
+  gtest,
+  runCommand,
 
-# Configuration Options
+  # Configuration Options
 
-, version
+  version,
 }:
 
 let
@@ -57,16 +58,22 @@ mkMesonExecutable (finalAttrs: {
 
   passthru = {
     tests = {
-      run = runCommand "${finalAttrs.pname}-run" {
-        meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
-      } (lib.optionalString stdenv.hostPlatform.isWindows ''
-        export HOME="$PWD/home-dir"
-        mkdir -p "$HOME"
-      '' + ''
-        export _NIX_TEST_UNIT_DATA=${./data}
-        ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
-        touch $out
-      '');
+      run =
+        runCommand "${finalAttrs.pname}-run"
+          {
+            meta.broken = !stdenv.hostPlatform.emulatorAvailable buildPackages;
+          }
+          (
+            lib.optionalString stdenv.hostPlatform.isWindows ''
+              export HOME="$PWD/home-dir"
+              mkdir -p "$HOME"
+            ''
+            + ''
+              export _NIX_TEST_UNIT_DATA=${./data}
+              ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe finalAttrs.finalPackage}
+              touch $out
+            ''
+          );
     };
   };
 
diff --git a/src/libutil/package.nix b/src/libutil/package.nix
index 679872a75..586119a6e 100644
--- a/src/libutil/package.nix
+++ b/src/libutil/package.nix
@@ -1,18 +1,19 @@
-{ lib
-, stdenv
-, mkMesonLibrary
+{
+  lib,
+  stdenv,
+  mkMesonLibrary,
 
-, boost
-, brotli
-, libarchive
-, libcpuid
-, libsodium
-, nlohmann_json
-, openssl
+  boost,
+  brotli,
+  libarchive,
+  libcpuid,
+  libsodium,
+  nlohmann_json,
+  openssl,
 
-# Configuration Options
+  # Configuration Options
 
-, version
+  version,
 }:
 
 let
@@ -43,8 +44,7 @@ mkMesonLibrary (finalAttrs: {
     brotli
     libsodium
     openssl
-  ] ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid
-  ;
+  ] ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid;
 
   propagatedBuildInputs = [
     boost
diff --git a/src/nix-channel/unpack-channel.nix b/src/nix-channel/unpack-channel.nix
index 10515bc8b..84e324a4d 100644
--- a/src/nix-channel/unpack-channel.nix
+++ b/src/nix-channel/unpack-channel.nix
@@ -1,4 +1,8 @@
-{ name, channelName, src }:
+{
+  name,
+  channelName,
+  src,
+}:
 
 derivation {
   builder = "builtin:unpack-channel";
diff --git a/src/nix-env/buildenv.nix b/src/nix-env/buildenv.nix
index 0bac4c44b..c8955a94e 100644
--- a/src/nix-env/buildenv.nix
+++ b/src/nix-env/buildenv.nix
@@ -8,13 +8,15 @@ derivation {
   inherit manifest;
 
   # !!! grmbl, need structured data for passing this in a clean way.
-  derivations =
-    map (d:
-      [ (d.meta.active or "true")
-        (d.meta.priority or 5)
-        (builtins.length d.outputs)
-      ] ++ map (output: builtins.getAttr output d) d.outputs)
-      derivations;
+  derivations = map (
+    d:
+    [
+      (d.meta.active or "true")
+      (d.meta.priority or 5)
+      (builtins.length d.outputs)
+    ]
+    ++ map (output: builtins.getAttr output d) d.outputs
+  ) derivations;
 
   # Building user environments remotely just causes huge amounts of
   # network traffic, so don't do that.
diff --git a/src/nix/package.nix b/src/nix/package.nix
index 171621af9..89c52c3bb 100644
--- a/src/nix/package.nix
+++ b/src/nix/package.nix
@@ -1,14 +1,15 @@
-{ lib
-, mkMesonExecutable
+{
+  lib,
+  mkMesonExecutable,
 
-, nix-store
-, nix-expr
-, nix-main
-, nix-cmd
+  nix-store,
+  nix-expr,
+  nix-main,
+  nix-cmd,
 
-# Configuration Options
+  # Configuration Options
 
-, version
+  version,
 }:
 
 let
@@ -20,64 +21,67 @@ mkMesonExecutable (finalAttrs: {
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions ([
-    ../../nix-meson-build-support
-    ./nix-meson-build-support
-    ../../.version
-    ./.version
-    ./meson.build
-    ./meson.options
-
-    # Symbolic links to other dirs
-    ## exes
-    ./build-remote
-    ./doc
-    ./nix-build
-    ./nix-channel
-    ./nix-collect-garbage
-    ./nix-copy-closure
-    ./nix-env
-    ./nix-instantiate
-    ./nix-store
-    ## dirs
-    ./scripts
-    ../../scripts
-    ./misc
-    ../../misc
-
-    # Doc nix files for --help
-    ../../doc/manual/generate-manpage.nix
-    ../../doc/manual/utils.nix
-    ../../doc/manual/generate-settings.nix
-    ../../doc/manual/generate-store-info.nix
-
-    # Other files to be included as string literals
-    ../nix-channel/unpack-channel.nix
-    ../nix-env/buildenv.nix
-    ./get-env.sh
-    ./help-stores.md
-    ../../doc/manual/source/store/types/index.md.in
-    ./profiles.md
-    ../../doc/manual/source/command-ref/files/profiles.md
-
-    # Files
-  ] ++ lib.concatMap
-    (dir: [
-      (fileset.fileFilter (file: file.hasExt "cc") dir)
-      (fileset.fileFilter (file: file.hasExt "hh") dir)
-      (fileset.fileFilter (file: file.hasExt "md") dir)
-    ])
+  fileset = fileset.unions (
     [
-      ./.
-      ../build-remote
-      ../nix-build
-      ../nix-channel
-      ../nix-collect-garbage
-      ../nix-copy-closure
-      ../nix-env
-      ../nix-instantiate
-      ../nix-store
+      ../../nix-meson-build-support
+      ./nix-meson-build-support
+      ../../.version
+      ./.version
+      ./meson.build
+      ./meson.options
+
+      # Symbolic links to other dirs
+      ## exes
+      ./build-remote
+      ./doc
+      ./nix-build
+      ./nix-channel
+      ./nix-collect-garbage
+      ./nix-copy-closure
+      ./nix-env
+      ./nix-instantiate
+      ./nix-store
+      ## dirs
+      ./scripts
+      ../../scripts
+      ./misc
+      ../../misc
+
+      # Doc nix files for --help
+      ../../doc/manual/generate-manpage.nix
+      ../../doc/manual/utils.nix
+      ../../doc/manual/generate-settings.nix
+      ../../doc/manual/generate-store-info.nix
+
+      # Other files to be included as string literals
+      ../nix-channel/unpack-channel.nix
+      ../nix-env/buildenv.nix
+      ./get-env.sh
+      ./help-stores.md
+      ../../doc/manual/source/store/types/index.md.in
+      ./profiles.md
+      ../../doc/manual/source/command-ref/files/profiles.md
+
+      # Files
     ]
+    ++
+      lib.concatMap
+        (dir: [
+          (fileset.fileFilter (file: file.hasExt "cc") dir)
+          (fileset.fileFilter (file: file.hasExt "hh") dir)
+          (fileset.fileFilter (file: file.hasExt "md") dir)
+        ])
+        [
+          ./.
+          ../build-remote
+          ../nix-build
+          ../nix-channel
+          ../nix-collect-garbage
+          ../nix-copy-closure
+          ../nix-env
+          ../nix-instantiate
+          ../nix-store
+        ]
   );
 
   buildInputs = [
diff --git a/src/perl/package.nix b/src/perl/package.nix
index 5ee0df13c..d95d13aa9 100644
--- a/src/perl/package.nix
+++ b/src/perl/package.nix
@@ -1,76 +1,82 @@
-{ lib
-, stdenv
-, mkMesonDerivation
-, pkg-config
-, perl
-, perlPackages
-, nix-store
-, version
-, curl
-, bzip2
-, libsodium
+{
+  lib,
+  stdenv,
+  mkMesonDerivation,
+  pkg-config,
+  perl,
+  perlPackages,
+  nix-store,
+  version,
+  curl,
+  bzip2,
+  libsodium,
 }:
 
 let
   inherit (lib) fileset;
 in
 
-perl.pkgs.toPerlModule (mkMesonDerivation (finalAttrs: {
-  pname = "nix-perl";
-  inherit version;
+perl.pkgs.toPerlModule (
+  mkMesonDerivation (finalAttrs: {
+    pname = "nix-perl";
+    inherit version;
 
-  workDir = ./.;
-  fileset = fileset.unions ([
-    ./.version
-    ../../.version
-    ./MANIFEST
-    ./lib
-    ./meson.build
-    ./meson.options
-  ] ++ lib.optionals finalAttrs.doCheck [
-    ./.yath.rc.in
-    ./t
-  ]);
+    workDir = ./.;
+    fileset = fileset.unions (
+      [
+        ./.version
+        ../../.version
+        ./MANIFEST
+        ./lib
+        ./meson.build
+        ./meson.options
+      ]
+      ++ lib.optionals finalAttrs.doCheck [
+        ./.yath.rc.in
+        ./t
+      ]
+    );
 
-  nativeBuildInputs = [
-    pkg-config
-    perl
-    curl
-  ];
+    nativeBuildInputs = [
+      pkg-config
+      perl
+      curl
+    ];
 
-  buildInputs = [
-    nix-store
-  ] ++ finalAttrs.passthru.externalBuildInputs;
+    buildInputs = [
+      nix-store
+    ] ++ finalAttrs.passthru.externalBuildInputs;
 
-  # Hack for sake of the dev shell
-  passthru.externalBuildInputs = [
-    bzip2
-    libsodium
-  ];
+    # Hack for sake of the dev shell
+    passthru.externalBuildInputs = [
+      bzip2
+      libsodium
+    ];
 
-  # `perlPackages.Test2Harness` is marked broken for Darwin
-  doCheck = !stdenv.isDarwin;
+    # `perlPackages.Test2Harness` is marked broken for Darwin
+    doCheck = !stdenv.isDarwin;
 
-  nativeCheckInputs = [
-    perlPackages.Test2Harness
-  ];
+    nativeCheckInputs = [
+      perlPackages.Test2Harness
+    ];
 
-  preConfigure =
-    # "Inline" .version so its not a symlink, and includes the suffix
-    ''
-      chmod u+w .version
-      echo ${finalAttrs.version} > .version
-    '';
+    preConfigure =
+      # "Inline" .version so its not a symlink, and includes the suffix
+      ''
+        chmod u+w .version
+        echo ${finalAttrs.version} > .version
+      '';
 
-  mesonFlags = [
-    (lib.mesonOption "dbi_path" "${perlPackages.DBI}/${perl.libPrefix}")
-    (lib.mesonOption "dbd_sqlite_path" "${perlPackages.DBDSQLite}/${perl.libPrefix}")
-    (lib.mesonEnable "tests" finalAttrs.doCheck)
-  ];
+    mesonFlags = [
+      (lib.mesonOption "dbi_path" "${perlPackages.DBI}/${perl.libPrefix}")
+      (lib.mesonOption "dbd_sqlite_path" "${perlPackages.DBDSQLite}/${perl.libPrefix}")
+      (lib.mesonEnable "tests" finalAttrs.doCheck)
+    ];
 
-  mesonCheckFlags = [
-    "--print-errorlogs"
-  ];
+    mesonCheckFlags = [
+      "--print-errorlogs"
+    ];
 
-  strictDeps = false;
-}))
+    strictDeps = false;
+  })
+)
diff --git a/tests/functional/big-derivation-attr.nix b/tests/functional/big-derivation-attr.nix
index 35c1187f6..d370486d6 100644
--- a/tests/functional/big-derivation-attr.nix
+++ b/tests/functional/big-derivation-attr.nix
@@ -1,6 +1,25 @@
 let
   sixteenBytes = "0123456789abcdef";
-  times16 = s: builtins.concatStringsSep "" [s s s s s s s s s s s s s s s s];
+  times16 =
+    s:
+    builtins.concatStringsSep "" [
+      s
+      s
+      s
+      s
+      s
+      s
+      s
+      s
+      s
+      s
+      s
+      s
+      s
+      s
+      s
+      s
+    ];
   exp = n: x: if n == 1 then x else times16 (exp (n - 1) x);
   sixteenMegabyte = exp 6 sixteenBytes;
 in
diff --git a/tests/functional/build-hook-ca-fixed.nix b/tests/functional/build-hook-ca-fixed.nix
index 0ce6d9b12..3d2643c13 100644
--- a/tests/functional/build-hook-ca-fixed.nix
+++ b/tests/functional/build-hook-ca-fixed.nix
@@ -4,24 +4,39 @@ with import ./config.nix;
 
 let
 
-  mkDerivation = args:
-    derivation ({
-      inherit system;
-      builder = busybox;
-      args = ["sh" "-e" args.builder or (builtins.toFile "builder-${args.name}.sh" ''
-        if [ -e "$NIX_ATTRS_SH_FILE" ]; then source $NIX_ATTRS_SH_FILE; fi;
-        eval "$buildCommand"
-      '')];
-      outputHashMode = "recursive";
-      outputHashAlgo = "sha256";
-    } // removeAttrs args ["builder" "meta" "passthru"])
-    // { meta = args.meta or {}; passthru = args.passthru or {}; };
+  mkDerivation =
+    args:
+    derivation (
+      {
+        inherit system;
+        builder = busybox;
+        args = [
+          "sh"
+          "-e"
+          args.builder or (builtins.toFile "builder-${args.name}.sh" ''
+            if [ -e "$NIX_ATTRS_SH_FILE" ]; then source $NIX_ATTRS_SH_FILE; fi;
+            eval "$buildCommand"
+          '')
+        ];
+        outputHashMode = "recursive";
+        outputHashAlgo = "sha256";
+      }
+      // removeAttrs args [
+        "builder"
+        "meta"
+        "passthru"
+      ]
+    )
+    // {
+      meta = args.meta or { };
+      passthru = args.passthru or { };
+    };
 
   input1 = mkDerivation {
     shell = busybox;
     name = "build-remote-input-1";
     buildCommand = "echo hi-input1; echo FOO > $out";
-    requiredSystemFeatures = ["foo"];
+    requiredSystemFeatures = [ "foo" ];
     outputHash = "sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc=";
   };
 
@@ -29,7 +44,7 @@ let
     shell = busybox;
     name = "build-remote-input-2";
     buildCommand = "echo hi; echo BAR > $out";
-    requiredSystemFeatures = ["bar"];
+    requiredSystemFeatures = [ "bar" ];
     outputHash = "sha256-XArauVH91AVwP9hBBQNlkX9ccuPpSYx9o0zeIHb6e+Q=";
   };
 
@@ -41,21 +56,20 @@ let
       read x < ${input2}
       echo $x BAZ > $out
     '';
-    requiredSystemFeatures = ["baz"];
+    requiredSystemFeatures = [ "baz" ];
     outputHash = "sha256-daKAcPp/+BYMQsVi/YYMlCKoNAxCNDsaivwSHgQqD2s=";
   };
 
 in
 
-  mkDerivation {
-    shell = busybox;
-    name = "build-remote";
-    passthru = { inherit input1 input2 input3; };
-    buildCommand =
-      ''
-        read x < ${input1}
-        read y < ${input3}
-        echo "$x $y" > $out
-      '';
-    outputHash = "sha256-5SxbkUw6xe2l9TE1uwCvTtTDysD1vhRor38OtDF0LqQ=";
-  }
+mkDerivation {
+  shell = busybox;
+  name = "build-remote";
+  passthru = { inherit input1 input2 input3; };
+  buildCommand = ''
+    read x < ${input1}
+    read y < ${input3}
+    echo "$x $y" > $out
+  '';
+  outputHash = "sha256-5SxbkUw6xe2l9TE1uwCvTtTDysD1vhRor38OtDF0LqQ=";
+}
diff --git a/tests/functional/build-hook.nix b/tests/functional/build-hook.nix
index 99a13aee4..45a2a84d6 100644
--- a/tests/functional/build-hook.nix
+++ b/tests/functional/build-hook.nix
@@ -1,39 +1,61 @@
-{ busybox, contentAddressed ? false }:
+{
+  busybox,
+  contentAddressed ? false,
+}:
 
 with import ./config.nix;
 
 let
 
-  caArgs = if contentAddressed then {
-      outputHashMode = "recursive";
-      outputHashAlgo = "sha256";
-      __contentAddressed = true;
-    } else {};
+  caArgs =
+    if contentAddressed then
+      {
+        outputHashMode = "recursive";
+        outputHashAlgo = "sha256";
+        __contentAddressed = true;
+      }
+    else
+      { };
 
-  mkDerivation = args:
-    derivation ({
-      inherit system;
-      builder = busybox;
-      args = ["sh" "-e" args.builder or (builtins.toFile "builder-${args.name}.sh" ''
-        if [ -e "$NIX_ATTRS_SH_FILE" ]; then source $NIX_ATTRS_SH_FILE; fi;
-        eval "$buildCommand"
-      '')];
-    } // removeAttrs args ["builder" "meta" "passthru"]
-    // caArgs)
-    // { meta = args.meta or {}; passthru = args.passthru or {}; };
+  mkDerivation =
+    args:
+    derivation (
+      {
+        inherit system;
+        builder = busybox;
+        args = [
+          "sh"
+          "-e"
+          args.builder or (builtins.toFile "builder-${args.name}.sh" ''
+            if [ -e "$NIX_ATTRS_SH_FILE" ]; then source $NIX_ATTRS_SH_FILE; fi;
+            eval "$buildCommand"
+          '')
+        ];
+      }
+      // removeAttrs args [
+        "builder"
+        "meta"
+        "passthru"
+      ]
+      // caArgs
+    )
+    // {
+      meta = args.meta or { };
+      passthru = args.passthru or { };
+    };
 
   input1 = mkDerivation {
     shell = busybox;
     name = "build-remote-input-1";
     buildCommand = "echo hi-input1; echo FOO > $out";
-    requiredSystemFeatures = ["foo"];
+    requiredSystemFeatures = [ "foo" ];
   };
 
   input2 = mkDerivation {
     shell = busybox;
     name = "build-remote-input-2";
     buildCommand = "echo hi; echo BAR > $out";
-    requiredSystemFeatures = ["bar"];
+    requiredSystemFeatures = [ "bar" ];
   };
 
   input3 = mkDerivation {
@@ -44,19 +66,18 @@ let
       read x < ${input2}
       echo $x BAZ > $out
     '';
-    requiredSystemFeatures = ["baz"];
+    requiredSystemFeatures = [ "baz" ];
   };
 
 in
 
-  mkDerivation {
-    shell = busybox;
-    name = "build-remote";
-    passthru = { inherit input1 input2 input3; };
-    buildCommand =
-      ''
-        read x < ${input1}
-        read y < ${input3}
-        echo "$x $y" > $out
-      '';
-  }
+mkDerivation {
+  shell = busybox;
+  name = "build-remote";
+  passthru = { inherit input1 input2 input3; };
+  buildCommand = ''
+    read x < ${input1}
+    read y < ${input3}
+    echo "$x $y" > $out
+  '';
+}
diff --git a/tests/functional/ca-shell.nix b/tests/functional/ca-shell.nix
index 36e1d1526..69ce6b6f1 100644
--- a/tests/functional/ca-shell.nix
+++ b/tests/functional/ca-shell.nix
@@ -1 +1,5 @@
-{ inNixShell ? false, ... }@args: import ./shell.nix (args // { contentAddressed = true; })
+{
+  inNixShell ? false,
+  ...
+}@args:
+import ./shell.nix (args // { contentAddressed = true; })
diff --git a/tests/functional/ca/content-addressed.nix b/tests/functional/ca/content-addressed.nix
index 2559c562f..6ed9c185b 100644
--- a/tests/functional/ca/content-addressed.nix
+++ b/tests/functional/ca/content-addressed.nix
@@ -1,13 +1,21 @@
 with import ./config.nix;
 
-let mkCADerivation = args: mkDerivation ({
-    __contentAddressed = true;
-    outputHashMode = "recursive";
-    outputHashAlgo = "sha256";
-} // args);
+let
+  mkCADerivation =
+    args:
+    mkDerivation (
+      {
+        __contentAddressed = true;
+        outputHashMode = "recursive";
+        outputHashAlgo = "sha256";
+      }
+      // args
+    );
 in
 
-{ seed ? 0 }:
+{
+  seed ? 0,
+}:
 # A simple content-addressed derivation.
 # The derivation can be arbitrarily modified by passing a different `seed`,
 # but the output will always be the same
@@ -23,7 +31,11 @@ rec {
   };
   rootCA = mkCADerivation {
     name = "rootCA";
-    outputs = [ "out" "dev" "foo" ];
+    outputs = [
+      "out"
+      "dev"
+      "foo"
+    ];
     buildCommand = ''
       echo "building a CA derivation"
       echo "The seed is ${toString seed}"
diff --git a/tests/functional/ca/flake.nix b/tests/functional/ca/flake.nix
index 332c92a67..28a27c4b3 100644
--- a/tests/functional/ca/flake.nix
+++ b/tests/functional/ca/flake.nix
@@ -1,3 +1,3 @@
 {
-  outputs = { self }: import ./content-addressed.nix {};
+  outputs = { self }: import ./content-addressed.nix { };
 }
diff --git a/tests/functional/ca/nondeterministic.nix b/tests/functional/ca/nondeterministic.nix
index d6d099a3e..2af26f0ac 100644
--- a/tests/functional/ca/nondeterministic.nix
+++ b/tests/functional/ca/nondeterministic.nix
@@ -1,10 +1,16 @@
 with import ./config.nix;
 
-let mkCADerivation = args: mkDerivation ({
-    __contentAddressed = true;
-    outputHashMode = "recursive";
-    outputHashAlgo = "sha256";
-} // args);
+let
+  mkCADerivation =
+    args:
+    mkDerivation (
+      {
+        __contentAddressed = true;
+        outputHashMode = "recursive";
+        outputHashAlgo = "sha256";
+      }
+      // args
+    );
 in
 
 rec {
@@ -15,13 +21,15 @@ rec {
       echo $(date) > $out/current-time
     '';
   };
-  dep = seed: mkCADerivation {
-    name = "dep";
-    inherit seed;
-    buildCommand = ''
-      echo ${currentTime} > $out
-    '';
-  };
+  dep =
+    seed:
+    mkCADerivation {
+      name = "dep";
+      inherit seed;
+      buildCommand = ''
+        echo ${currentTime} > $out
+      '';
+    };
   dep1 = dep 1;
   dep2 = dep 2;
   toplevel = mkCADerivation {
@@ -32,4 +40,3 @@ rec {
     '';
   };
 }
-
diff --git a/tests/functional/ca/racy.nix b/tests/functional/ca/racy.nix
index 555a15484..cbc0e1643 100644
--- a/tests/functional/ca/racy.nix
+++ b/tests/functional/ca/racy.nix
@@ -1,7 +1,6 @@
 # A derivation that would certainly fail if several builders tried to
 # build it at once.
 
-
 with import ./config.nix;
 
 mkDerivation {
diff --git a/tests/functional/check-refs.nix b/tests/functional/check-refs.nix
index 89690e456..471d95753 100644
--- a/tests/functional/check-refs.nix
+++ b/tests/functional/check-refs.nix
@@ -2,11 +2,16 @@ with import ./config.nix;
 
 rec {
 
-  dep = import ./dependencies.nix {};
+  dep = import ./dependencies.nix { };
 
-  makeTest = nr: args: mkDerivation ({
-    name = "check-refs-" + toString nr;
-  } // args);
+  makeTest =
+    nr: args:
+    mkDerivation (
+      {
+        name = "check-refs-" + toString nr;
+      }
+      // args
+    );
 
   src = builtins.toFile "aux-ref" "bla bla";
 
@@ -22,31 +27,31 @@ rec {
 
   test3 = makeTest 3 {
     builder = builtins.toFile "builder.sh" "mkdir $out; ln -s $dep $out/link";
-    allowedReferences = [];
+    allowedReferences = [ ];
     inherit dep;
   };
 
   test4 = makeTest 4 {
     builder = builtins.toFile "builder.sh" "mkdir $out; ln -s $dep $out/link";
-    allowedReferences = [dep];
+    allowedReferences = [ dep ];
     inherit dep;
   };
 
   test5 = makeTest 5 {
     builder = builtins.toFile "builder.sh" "mkdir $out";
-    allowedReferences = [];
+    allowedReferences = [ ];
     inherit dep;
   };
 
   test6 = makeTest 6 {
     builder = builtins.toFile "builder.sh" "mkdir $out; ln -s $out $out/link";
-    allowedReferences = [];
+    allowedReferences = [ ];
     inherit dep;
   };
 
   test7 = makeTest 7 {
     builder = builtins.toFile "builder.sh" "mkdir $out; ln -s $out $out/link";
-    allowedReferences = ["out"];
+    allowedReferences = [ "out" ];
     inherit dep;
   };
 
@@ -58,19 +63,19 @@ rec {
   test9 = makeTest 9 {
     builder = builtins.toFile "builder.sh" "mkdir $out; ln -s $dep $out/link";
     inherit dep;
-    disallowedReferences = [dep];
+    disallowedReferences = [ dep ];
   };
 
   test10 = makeTest 10 {
     builder = builtins.toFile "builder.sh" "mkdir $out; echo $test5; ln -s $dep $out/link";
     inherit dep test5;
-    disallowedReferences = [test5];
+    disallowedReferences = [ test5 ];
   };
 
   test11 = makeTest 11 {
     __structuredAttrs = true;
     unsafeDiscardReferences.out = true;
-    outputChecks.out.allowedReferences = [];
+    outputChecks.out.allowedReferences = [ ];
     buildCommand = ''echo ${dep} > "''${outputs[out]}"'';
   };
 
diff --git a/tests/functional/check-reqs.nix b/tests/functional/check-reqs.nix
index 41436cb48..3cca76184 100644
--- a/tests/functional/check-reqs.nix
+++ b/tests/functional/check-reqs.nix
@@ -22,36 +22,48 @@ rec {
     '';
   };
 
-  makeTest = nr: allowreqs: mkDerivation {
-    name = "check-reqs-" + toString nr;
-    inherit deps;
-    builder = builtins.toFile "builder.sh" ''
-      mkdir $out
-      ln -s $deps $out/depdir1
-    '';
-    allowedRequisites = allowreqs;
-  };
+  makeTest =
+    nr: allowreqs:
+    mkDerivation {
+      name = "check-reqs-" + toString nr;
+      inherit deps;
+      builder = builtins.toFile "builder.sh" ''
+        mkdir $out
+        ln -s $deps $out/depdir1
+      '';
+      allowedRequisites = allowreqs;
+    };
 
   # When specifying all the requisites, the build succeeds.
-  test1 = makeTest 1 [ dep1 dep2 deps ];
+  test1 = makeTest 1 [
+    dep1
+    dep2
+    deps
+  ];
 
   # But missing anything it fails.
-  test2 = makeTest 2 [ dep2 deps ];
-  test3 = makeTest 3 [ dep1 deps ];
+  test2 = makeTest 2 [
+    dep2
+    deps
+  ];
+  test3 = makeTest 3 [
+    dep1
+    deps
+  ];
   test4 = makeTest 4 [ deps ];
-  test5 = makeTest 5 [];
+  test5 = makeTest 5 [ ];
 
   test6 = mkDerivation {
     name = "check-reqs";
     inherit deps;
     builder = builtins.toFile "builder.sh" "mkdir $out; ln -s $deps $out/depdir1";
-    disallowedRequisites = [dep1];
+    disallowedRequisites = [ dep1 ];
   };
 
   test7 = mkDerivation {
     name = "check-reqs";
     inherit deps;
     builder = builtins.toFile "builder.sh" "mkdir $out; ln -s $deps $out/depdir1";
-    disallowedRequisites = [test1];
+    disallowedRequisites = [ test1 ];
   };
 }
diff --git a/tests/functional/check.nix b/tests/functional/check.nix
index ddab8eea9..d83c28ca2 100644
--- a/tests/functional/check.nix
+++ b/tests/functional/check.nix
@@ -1,4 +1,6 @@
-{checkBuildId ? 0}:
+{
+  checkBuildId ? 0,
+}:
 
 with import ./config.nix;
 
@@ -6,41 +8,38 @@ with import ./config.nix;
   nondeterministic = mkDerivation {
     inherit checkBuildId;
     name = "nondeterministic";
-    buildCommand =
-      ''
-        mkdir $out
-        date +%s.%N > $out/date
-        echo "CHECK_TMPDIR=$TMPDIR"
-        echo "checkBuildId=$checkBuildId"
-        echo "$checkBuildId" > $TMPDIR/checkBuildId
-      '';
+    buildCommand = ''
+      mkdir $out
+      date +%s.%N > $out/date
+      echo "CHECK_TMPDIR=$TMPDIR"
+      echo "checkBuildId=$checkBuildId"
+      echo "$checkBuildId" > $TMPDIR/checkBuildId
+    '';
   };
 
   deterministic = mkDerivation {
     inherit checkBuildId;
     name = "deterministic";
-    buildCommand =
-      ''
-        mkdir $out
-        echo date > $out/date
-        echo "CHECK_TMPDIR=$TMPDIR"
-        echo "checkBuildId=$checkBuildId"
-        echo "$checkBuildId" > $TMPDIR/checkBuildId
-      '';
+    buildCommand = ''
+      mkdir $out
+      echo date > $out/date
+      echo "CHECK_TMPDIR=$TMPDIR"
+      echo "checkBuildId=$checkBuildId"
+      echo "$checkBuildId" > $TMPDIR/checkBuildId
+    '';
   };
 
   failed = mkDerivation {
     inherit checkBuildId;
     name = "failed";
-    buildCommand =
-      ''
-        mkdir $out
-        echo date > $out/date
-        echo "CHECK_TMPDIR=$TMPDIR"
-        echo "checkBuildId=$checkBuildId"
-        echo "$checkBuildId" > $TMPDIR/checkBuildId
-        false
-      '';
+    buildCommand = ''
+      mkdir $out
+      echo date > $out/date
+      echo "CHECK_TMPDIR=$TMPDIR"
+      echo "checkBuildId=$checkBuildId"
+      echo "$checkBuildId" > $TMPDIR/checkBuildId
+      false
+    '';
   };
 
   hashmismatch = import <nix/fetchurl.nix> {
diff --git a/tests/functional/dependencies.nix b/tests/functional/dependencies.nix
index 4ff29227f..570ea7431 100644
--- a/tests/functional/dependencies.nix
+++ b/tests/functional/dependencies.nix
@@ -1,4 +1,6 @@
-{ hashInvalidator ? "" }:
+{
+  hashInvalidator ? "",
+}:
 with import ./config.nix;
 
 let
diff --git a/tests/functional/derivation/advanced-attributes-defaults.nix b/tests/functional/derivation/advanced-attributes-defaults.nix
index 51a8d0e7e..d466003b0 100644
--- a/tests/functional/derivation/advanced-attributes-defaults.nix
+++ b/tests/functional/derivation/advanced-attributes-defaults.nix
@@ -2,5 +2,8 @@ derivation {
   name = "advanced-attributes-defaults";
   system = "my-system";
   builder = "/bin/bash";
-  args = [ "-c" "echo hello > $out" ];
+  args = [
+    "-c"
+    "echo hello > $out"
+  ];
 }
diff --git a/tests/functional/derivation/advanced-attributes-structured-attrs-defaults.nix b/tests/functional/derivation/advanced-attributes-structured-attrs-defaults.nix
index 0c13a7691..3c6ad4900 100644
--- a/tests/functional/derivation/advanced-attributes-structured-attrs-defaults.nix
+++ b/tests/functional/derivation/advanced-attributes-structured-attrs-defaults.nix
@@ -2,7 +2,13 @@ derivation {
   name = "advanced-attributes-structured-attrs-defaults";
   system = "my-system";
   builder = "/bin/bash";
-  args = [ "-c" "echo hello > $out" ];
-  outputs = [ "out" "dev" ];
+  args = [
+    "-c"
+    "echo hello > $out"
+  ];
+  outputs = [
+    "out"
+    "dev"
+  ];
   __structuredAttrs = true;
 }
diff --git a/tests/functional/derivation/advanced-attributes-structured-attrs.nix b/tests/functional/derivation/advanced-attributes-structured-attrs.nix
index 0044b65fd..4c596be45 100644
--- a/tests/functional/derivation/advanced-attributes-structured-attrs.nix
+++ b/tests/functional/derivation/advanced-attributes-structured-attrs.nix
@@ -4,42 +4,58 @@ let
     inherit system;
     name = "foo";
     builder = "/bin/bash";
-    args = ["-c" "echo foo > $out"];
+    args = [
+      "-c"
+      "echo foo > $out"
+    ];
   };
   bar = derivation {
     inherit system;
     name = "bar";
     builder = "/bin/bash";
-    args = ["-c" "echo bar > $out"];
+    args = [
+      "-c"
+      "echo bar > $out"
+    ];
   };
 in
 derivation {
   inherit system;
   name = "advanced-attributes-structured-attrs";
   builder = "/bin/bash";
-  args = [ "-c" "echo hello > $out" ];
+  args = [
+    "-c"
+    "echo hello > $out"
+  ];
   __sandboxProfile = "sandcastle";
   __noChroot = true;
-  __impureHostDeps = ["/usr/bin/ditto"];
-  impureEnvVars = ["UNICORN"];
+  __impureHostDeps = [ "/usr/bin/ditto" ];
+  impureEnvVars = [ "UNICORN" ];
   __darwinAllowLocalNetworking = true;
-  outputs = [ "out" "bin" "dev" ];
+  outputs = [
+    "out"
+    "bin"
+    "dev"
+  ];
   __structuredAttrs = true;
   outputChecks = {
     out = {
-      allowedReferences = [foo];
-      allowedRequisites = [foo];
+      allowedReferences = [ foo ];
+      allowedRequisites = [ foo ];
     };
     bin = {
-      disallowedReferences = [bar];
-      disallowedRequisites = [bar];
+      disallowedReferences = [ bar ];
+      disallowedRequisites = [ bar ];
     };
     dev = {
       maxSize = 789;
       maxClosureSize = 5909;
     };
   };
-  requiredSystemFeatures = ["rainbow" "uid-range"];
+  requiredSystemFeatures = [
+    "rainbow"
+    "uid-range"
+  ];
   preferLocalBuild = true;
   allowSubstitutes = false;
 }
diff --git a/tests/functional/derivation/advanced-attributes.nix b/tests/functional/derivation/advanced-attributes.nix
index ff680c567..7f365ce65 100644
--- a/tests/functional/derivation/advanced-attributes.nix
+++ b/tests/functional/derivation/advanced-attributes.nix
@@ -4,30 +4,42 @@ let
     inherit system;
     name = "foo";
     builder = "/bin/bash";
-    args = ["-c" "echo foo > $out"];
+    args = [
+      "-c"
+      "echo foo > $out"
+    ];
   };
   bar = derivation {
     inherit system;
     name = "bar";
     builder = "/bin/bash";
-    args = ["-c" "echo bar > $out"];
+    args = [
+      "-c"
+      "echo bar > $out"
+    ];
   };
 in
 derivation {
   inherit system;
   name = "advanced-attributes";
   builder = "/bin/bash";
-  args = [ "-c" "echo hello > $out" ];
+  args = [
+    "-c"
+    "echo hello > $out"
+  ];
   __sandboxProfile = "sandcastle";
   __noChroot = true;
-  __impureHostDeps = ["/usr/bin/ditto"];
-  impureEnvVars = ["UNICORN"];
+  __impureHostDeps = [ "/usr/bin/ditto" ];
+  impureEnvVars = [ "UNICORN" ];
   __darwinAllowLocalNetworking = true;
-  allowedReferences = [foo];
-  allowedRequisites = [foo];
-  disallowedReferences = [bar];
-  disallowedRequisites = [bar];
-  requiredSystemFeatures = ["rainbow" "uid-range"];
+  allowedReferences = [ foo ];
+  allowedRequisites = [ foo ];
+  disallowedReferences = [ bar ];
+  disallowedRequisites = [ bar ];
+  requiredSystemFeatures = [
+    "rainbow"
+    "uid-range"
+  ];
   preferLocalBuild = true;
   allowSubstitutes = false;
 }
diff --git a/tests/functional/dyn-drv/recursive-mod-json.nix b/tests/functional/dyn-drv/recursive-mod-json.nix
index c6a24ca4f..2d46e4e2e 100644
--- a/tests/functional/dyn-drv/recursive-mod-json.nix
+++ b/tests/functional/dyn-drv/recursive-mod-json.nix
@@ -1,6 +1,8 @@
 with import ./config.nix;
 
-let innerName = "foo"; in
+let
+  innerName = "foo";
+in
 
 mkDerivation rec {
   name = "${innerName}.drv";
diff --git a/tests/functional/export-graph.nix b/tests/functional/export-graph.nix
index 64fe36bd1..5078eec83 100644
--- a/tests/functional/export-graph.nix
+++ b/tests/functional/export-graph.nix
@@ -2,28 +2,33 @@ with import ./config.nix;
 
 rec {
 
-  printRefs =
-    ''
-      echo $exportReferencesGraph
-      while read path; do
-          read drv
-          read nrRefs
-          echo "$path has $nrRefs references"
-          echo "$path" >> $out
-          for ((n = 0; n < $nrRefs; n++)); do read ref; echo "ref $ref"; test -e "$ref"; done
-      done < refs
-    '';
+  printRefs = ''
+    echo $exportReferencesGraph
+    while read path; do
+        read drv
+        read nrRefs
+        echo "$path has $nrRefs references"
+        echo "$path" >> $out
+        for ((n = 0; n < $nrRefs; n++)); do read ref; echo "ref $ref"; test -e "$ref"; done
+    done < refs
+  '';
 
   foo."bar.runtimeGraph" = mkDerivation {
     name = "dependencies";
     builder = builtins.toFile "build-graph-builder" "${printRefs}";
-    exportReferencesGraph = ["refs" (import ./dependencies.nix {})];
+    exportReferencesGraph = [
+      "refs"
+      (import ./dependencies.nix { })
+    ];
   };
 
   foo."bar.buildGraph" = mkDerivation {
     name = "dependencies";
     builder = builtins.toFile "build-graph-builder" "${printRefs}";
-    exportReferencesGraph = ["refs" (import ./dependencies.nix {}).drvPath];
+    exportReferencesGraph = [
+      "refs"
+      (import ./dependencies.nix { }).drvPath
+    ];
   };
 
 }
diff --git a/tests/functional/failing.nix b/tests/functional/failing.nix
index d25e2d6b6..8abae1856 100644
--- a/tests/functional/failing.nix
+++ b/tests/functional/failing.nix
@@ -2,16 +2,29 @@
 with import ./config.nix;
 let
 
-  mkDerivation = args:
-    derivation ({
-      inherit system;
-      builder = busybox;
-      args = ["sh" "-e" args.builder or (builtins.toFile "builder-${args.name}.sh" ''
-        if [ -e "$NIX_ATTRS_SH_FILE" ]; then source $NIX_ATTRS_SH_FILE; fi;
-        eval "$buildCommand"
-      '')];
-    } // removeAttrs args ["builder" "meta"])
-    // { meta = args.meta or {}; };
+  mkDerivation =
+    args:
+    derivation (
+      {
+        inherit system;
+        builder = busybox;
+        args = [
+          "sh"
+          "-e"
+          args.builder or (builtins.toFile "builder-${args.name}.sh" ''
+            if [ -e "$NIX_ATTRS_SH_FILE" ]; then source $NIX_ATTRS_SH_FILE; fi;
+            eval "$buildCommand"
+          '')
+        ];
+      }
+      // removeAttrs args [
+        "builder"
+        "meta"
+      ]
+    )
+    // {
+      meta = args.meta or { };
+    };
 in
 {
 
diff --git a/tests/functional/filter-source.nix b/tests/functional/filter-source.nix
index 907163639..7bad263f8 100644
--- a/tests/functional/filter-source.nix
+++ b/tests/functional/filter-source.nix
@@ -4,9 +4,12 @@ mkDerivation {
   name = "filter";
   builder = builtins.toFile "builder" "ln -s $input $out";
   input =
-    let filter = path: type:
-      type != "symlink"
-      && baseNameOf path != "foo"
-      && !((import ./lang/lib.nix).hasSuffix ".bak" (baseNameOf path));
-    in builtins.filterSource filter ((builtins.getEnv "TEST_ROOT") + "/filterin");
+    let
+      filter =
+        path: type:
+        type != "symlink"
+        && baseNameOf path != "foo"
+        && !((import ./lang/lib.nix).hasSuffix ".bak" (baseNameOf path));
+    in
+    builtins.filterSource filter ((builtins.getEnv "TEST_ROOT") + "/filterin");
 }
diff --git a/tests/functional/fixed.nix b/tests/functional/fixed.nix
index a920a2167..4097a6374 100644
--- a/tests/functional/fixed.nix
+++ b/tests/functional/fixed.nix
@@ -2,15 +2,20 @@ with import ./config.nix;
 
 rec {
 
-  f2 = dummy: builder: mode: algo: hash: mkDerivation {
-    name = "fixed";
-    inherit builder;
-    outputHashMode = mode;
-    outputHashAlgo = algo;
-    outputHash = hash;
-    inherit dummy;
-    impureEnvVars = ["IMPURE_VAR1" "IMPURE_VAR2"];
-  };
+  f2 =
+    dummy: builder: mode: algo: hash:
+    mkDerivation {
+      name = "fixed";
+      inherit builder;
+      outputHashMode = mode;
+      outputHashAlgo = algo;
+      outputHash = hash;
+      inherit dummy;
+      impureEnvVars = [
+        "IMPURE_VAR1"
+        "IMPURE_VAR2"
+      ];
+    };
 
   f = f2 "";
 
@@ -37,7 +42,8 @@ rec {
   ];
 
   sameAsAdd =
-    f ./fixed.builder2.sh "recursive" "sha256" "1ixr6yd3297ciyp9im522dfxpqbkhcw0pylkb2aab915278fqaik";
+    f ./fixed.builder2.sh "recursive" "sha256"
+      "1ixr6yd3297ciyp9im522dfxpqbkhcw0pylkb2aab915278fqaik";
 
   bad = [
     (f ./fixed.builder1.sh "flat" "md5" "0ddd8be4b179a529afa5f2ffae4b9858")
diff --git a/tests/functional/fod-failing.nix b/tests/functional/fod-failing.nix
index 37c04fe12..0de676c15 100644
--- a/tests/functional/fod-failing.nix
+++ b/tests/functional/fod-failing.nix
@@ -2,38 +2,34 @@ with import ./config.nix;
 rec {
   x1 = mkDerivation {
     name = "x1";
-    builder = builtins.toFile "builder.sh"
-      ''
-        echo $name > $out
-      '';
+    builder = builtins.toFile "builder.sh" ''
+      echo $name > $out
+    '';
     outputHashMode = "recursive";
     outputHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
   };
   x2 = mkDerivation {
     name = "x2";
-    builder = builtins.toFile "builder.sh"
-      ''
-        echo $name > $out
-      '';
+    builder = builtins.toFile "builder.sh" ''
+      echo $name > $out
+    '';
     outputHashMode = "recursive";
     outputHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
   };
   x3 = mkDerivation {
     name = "x3";
-    builder = builtins.toFile "builder.sh"
-      ''
-        echo $name > $out
-      '';
+    builder = builtins.toFile "builder.sh" ''
+      echo $name > $out
+    '';
     outputHashMode = "recursive";
     outputHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
   };
   x4 = mkDerivation {
     name = "x4";
     inherit x2 x3;
-    builder = builtins.toFile "builder.sh"
-      ''
-        echo $x2 $x3
-        exit 1
-      '';
+    builder = builtins.toFile "builder.sh" ''
+      echo $x2 $x3
+      exit 1
+    '';
   };
 }
diff --git a/tests/functional/gc-concurrent.nix b/tests/functional/gc-concurrent.nix
index 0aba1f983..d7483d88f 100644
--- a/tests/functional/gc-concurrent.nix
+++ b/tests/functional/gc-concurrent.nix
@@ -1,6 +1,8 @@
 with import ./config.nix;
 
-{ lockFifo ? null }:
+{
+  lockFifo ? null,
+}:
 
 rec {
 
diff --git a/tests/functional/hash-check.nix b/tests/functional/hash-check.nix
index 4a8e9b8a8..7a48a620b 100644
--- a/tests/functional/hash-check.nix
+++ b/tests/functional/hash-check.nix
@@ -4,14 +4,22 @@ let {
     name = "dependencies-input-1";
     system = "i086-msdos";
     builder = "/bar/sh";
-    args = ["-e" "-x" ./dummy];
+    args = [
+      "-e"
+      "-x"
+      ./dummy
+    ];
   };
 
   input2 = derivation {
     name = "dependencies-input-2";
     system = "i086-msdos";
     builder = "/bar/sh";
-    args = ["-e" "-x" ./dummy];
+    args = [
+      "-e"
+      "-x"
+      ./dummy
+    ];
     outputHashMode = "recursive";
     outputHashAlgo = "md5";
     outputHash = "ffffffffffffffffffffffffffffffff";
@@ -21,9 +29,13 @@ let {
     name = "dependencies";
     system = "i086-msdos";
     builder = "/bar/sh";
-    args = ["-e" "-x" (./dummy  + "/FOOBAR/../.")];
+    args = [
+      "-e"
+      "-x"
+      (./dummy + "/FOOBAR/../.")
+    ];
     input1 = input1 + "/.";
     inherit input2;
   };
 
-}
\ No newline at end of file
+}
diff --git a/tests/functional/hermetic.nix b/tests/functional/hermetic.nix
index d1dccdff3..a50714664 100644
--- a/tests/functional/hermetic.nix
+++ b/tests/functional/hermetic.nix
@@ -1,31 +1,51 @@
-{ busybox
-, seed
-# If we want the final derivation output to have references to its
-# dependencies. Some tests need/want this, other don't.
-, withFinalRefs ? false
+{
+  busybox,
+  seed,
+  # If we want the final derivation output to have references to its
+  # dependencies. Some tests need/want this, other don't.
+  withFinalRefs ? false,
 }:
 
 with import ./config.nix;
 
 let
   contentAddressedByDefault = builtins.getEnv "NIX_TESTS_CA_BY_DEFAULT" == "1";
-  caArgs = if contentAddressedByDefault then {
-    __contentAddressed = true;
-    outputHashMode = "recursive";
-    outputHashAlgo = "sha256";
-  } else {};
+  caArgs =
+    if contentAddressedByDefault then
+      {
+        __contentAddressed = true;
+        outputHashMode = "recursive";
+        outputHashAlgo = "sha256";
+      }
+    else
+      { };
 
-  mkDerivation = args:
-    derivation ({
-      inherit system;
-      builder = busybox;
-      args = ["sh" "-e" args.builder or (builtins.toFile "builder-${args.name}.sh" ''
-        if [ -e "$NIX_ATTRS_SH_FILE" ]; then source $NIX_ATTRS_SH_FILE; fi;
-        eval "$buildCommand"
-      '')];
-    } // removeAttrs args ["builder" "meta" "passthru"]
-    // caArgs)
-    // { meta = args.meta or {}; passthru = args.passthru or {}; };
+  mkDerivation =
+    args:
+    derivation (
+      {
+        inherit system;
+        builder = busybox;
+        args = [
+          "sh"
+          "-e"
+          args.builder or (builtins.toFile "builder-${args.name}.sh" ''
+            if [ -e "$NIX_ATTRS_SH_FILE" ]; then source $NIX_ATTRS_SH_FILE; fi;
+            eval "$buildCommand"
+          '')
+        ];
+      }
+      // removeAttrs args [
+        "builder"
+        "meta"
+        "passthru"
+      ]
+      // caArgs
+    )
+    // {
+      meta = args.meta or { };
+      passthru = args.passthru or { };
+    };
 
   input1 = mkDerivation {
     shell = busybox;
@@ -51,14 +71,15 @@ let
 
 in
 
-  mkDerivation {
-    shell = busybox;
-    name = "hermetic";
-    passthru = { inherit input1 input2 input3; };
-    buildCommand =
-      ''
-        read x < ${input1}
-        read y < ${input3}
-        echo ${if (builtins.trace withFinalRefs withFinalRefs) then "${input1} ${input3}" else ""} "$x $y" > $out
-      '';
-  }
+mkDerivation {
+  shell = busybox;
+  name = "hermetic";
+  passthru = { inherit input1 input2 input3; };
+  buildCommand = ''
+    read x < ${input1}
+    read y < ${input3}
+    echo ${
+      if (builtins.trace withFinalRefs withFinalRefs) then "${input1} ${input3}" else ""
+    } "$x $y" > $out
+  '';
+}
diff --git a/tests/functional/ifd.nix b/tests/functional/ifd.nix
index d0b9b54ad..b8c04f72c 100644
--- a/tests/functional/ifd.nix
+++ b/tests/functional/ifd.nix
@@ -1,10 +1,8 @@
 with import ./config.nix;
-import (
-  mkDerivation {
-    name = "foo";
-    bla = import ./dependencies.nix {};
-    buildCommand = "
+import (mkDerivation {
+  name = "foo";
+  bla = import ./dependencies.nix { };
+  buildCommand = "
       echo \\\"hi\\\" > $out
     ";
-  }
-)
+})
diff --git a/tests/functional/import-from-derivation.nix b/tests/functional/import-from-derivation.nix
index 770dd86cf..600f448a6 100644
--- a/tests/functional/import-from-derivation.nix
+++ b/tests/functional/import-from-derivation.nix
@@ -3,10 +3,9 @@ with import <config>;
 rec {
   bar = mkDerivation {
     name = "bar";
-    builder = builtins.toFile "builder.sh"
-      ''
-        echo 'builtins.add 123 456' > $out
-      '';
+    builder = builtins.toFile "builder.sh" ''
+      echo 'builtins.add 123 456' > $out
+    '';
   };
 
   value =
@@ -16,19 +15,17 @@ rec {
 
   result = mkDerivation {
     name = "foo";
-    builder = builtins.toFile "builder.sh"
-      ''
-        echo -n FOO${toString value} > $out
-      '';
+    builder = builtins.toFile "builder.sh" ''
+      echo -n FOO${toString value} > $out
+    '';
   };
 
   addPath = mkDerivation {
     name = "add-path";
     src = builtins.filterSource (path: type: true) result;
-    builder = builtins.toFile "builder.sh"
-      ''
-        echo -n BLA$(cat $src) > $out
-      '';
+    builder = builtins.toFile "builder.sh" ''
+      echo -n BLA$(cat $src) > $out
+    '';
   };
 
   step1 = mkDerivation {
diff --git a/tests/functional/impure-derivations.nix b/tests/functional/impure-derivations.nix
index 98547e6c1..806f20577 100644
--- a/tests/functional/impure-derivations.nix
+++ b/tests/functional/impure-derivations.nix
@@ -4,60 +4,58 @@ rec {
 
   impure = mkDerivation {
     name = "impure";
-    outputs = [ "out" "stuff" ];
-    buildCommand =
-      ''
-        echo impure
-        x=$(< $TEST_ROOT/counter)
-        mkdir $out $stuff
-        echo $x > $out/n
-        ln -s $out/n $stuff/bla
-        printf $((x + 1)) > $TEST_ROOT/counter
-      '';
+    outputs = [
+      "out"
+      "stuff"
+    ];
+    buildCommand = ''
+      echo impure
+      x=$(< $TEST_ROOT/counter)
+      mkdir $out $stuff
+      echo $x > $out/n
+      ln -s $out/n $stuff/bla
+      printf $((x + 1)) > $TEST_ROOT/counter
+    '';
     __impure = true;
     impureEnvVars = [ "TEST_ROOT" ];
   };
 
   impureOnImpure = mkDerivation {
     name = "impure-on-impure";
-    buildCommand =
-      ''
-        echo impure-on-impure
-        x=$(< ${impure}/n)
-        mkdir $out
-        printf X$x > $out/n
-        ln -s ${impure.stuff} $out/symlink
-        ln -s $out $out/self
-      '';
+    buildCommand = ''
+      echo impure-on-impure
+      x=$(< ${impure}/n)
+      mkdir $out
+      printf X$x > $out/n
+      ln -s ${impure.stuff} $out/symlink
+      ln -s $out $out/self
+    '';
     __impure = true;
   };
 
   # This is not allowed.
   inputAddressed = mkDerivation {
     name = "input-addressed";
-    buildCommand =
-      ''
-        cat ${impure} > $out
-      '';
+    buildCommand = ''
+      cat ${impure} > $out
+    '';
   };
 
   contentAddressed = mkDerivation {
     name = "content-addressed";
-    buildCommand =
-      ''
-        echo content-addressed
-        x=$(< ${impureOnImpure}/n)
-        printf ''${x:0:1} > $out
-      '';
+    buildCommand = ''
+      echo content-addressed
+      x=$(< ${impureOnImpure}/n)
+      printf ''${x:0:1} > $out
+    '';
     outputHashMode = "recursive";
     outputHash = "sha256-eBYxcgkuWuiqs4cKNgKwkb3vY/HR0vVsJnqe8itJGcQ=";
   };
 
   inputAddressedAfterCA = mkDerivation {
     name = "input-addressed-after-ca";
-    buildCommand =
-      ''
-        cat ${contentAddressed} > $out
-      '';
+    buildCommand = ''
+      cat ${contentAddressed} > $out
+    '';
   };
 }
diff --git a/tests/functional/lang-gc/issue-11141-gc-coroutine-test.nix b/tests/functional/lang-gc/issue-11141-gc-coroutine-test.nix
index 4f311af75..6dae5c155 100644
--- a/tests/functional/lang-gc/issue-11141-gc-coroutine-test.nix
+++ b/tests/functional/lang-gc/issue-11141-gc-coroutine-test.nix
@@ -1,4 +1,3 @@
-
 # Run:
 # GC_INITIAL_HEAP_SIZE=$[1024 * 1024] NIX_SHOW_STATS=1 nix eval -f gc-coroutine-test.nix  -vvvv
 
@@ -11,55 +10,56 @@ let
   # Generate a tree of numbers, n deep, such that the numbers add up to (1 + salt) * 10^n.
   # The salting makes the numbers all different, increasing the likelihood of catching
   # any memory corruptions that might be caused by the GC or otherwise.
-  garbage = salt: n:
-    if n == 0
-    then [(1 + salt)]
-    else [
-      (garbage (10 * salt + 1) (n - 1))
-      (garbage (10 * salt - 1) (n - 1))
-      (garbage (10 * salt + 2) (n - 1))
-      (garbage (10 * salt - 2) (n - 1))
-      (garbage (10 * salt + 3) (n - 1))
-      (garbage (10 * salt - 3) (n - 1))
-      (garbage (10 * salt + 4) (n - 1))
-      (garbage (10 * salt - 4) (n - 1))
-      (garbage (10 * salt + 5) (n - 1))
-      (garbage (10 * salt - 5) (n - 1))
-    ];
+  garbage =
+    salt: n:
+    if n == 0 then
+      [ (1 + salt) ]
+    else
+      [
+        (garbage (10 * salt + 1) (n - 1))
+        (garbage (10 * salt - 1) (n - 1))
+        (garbage (10 * salt + 2) (n - 1))
+        (garbage (10 * salt - 2) (n - 1))
+        (garbage (10 * salt + 3) (n - 1))
+        (garbage (10 * salt - 3) (n - 1))
+        (garbage (10 * salt + 4) (n - 1))
+        (garbage (10 * salt - 4) (n - 1))
+        (garbage (10 * salt + 5) (n - 1))
+        (garbage (10 * salt - 5) (n - 1))
+      ];
 
-  pow = base: n:
-    if n == 0
-    then 1
-    else base * (pow base (n - 1));
+  pow = base: n: if n == 0 then 1 else base * (pow base (n - 1));
 
-  sumNestedLists = l:
-    if isList l
-    then foldl' (a: b: a + sumNestedLists b) 0 l
-    else l;
+  sumNestedLists = l: if isList l then foldl' (a: b: a + sumNestedLists b) 0 l else l;
 
 in
-  assert sumNestedLists (garbage 0 3) == pow 10 3;
-  assert sumNestedLists (garbage 0 6) == pow 10 6;
-  builtins.foldl'
-    (a: b:
-      assert
-        "${
-          builtins.path {
-            path = ./src;
-            filter = path: type:
-              # We're not doing common subexpression elimination, so this reallocates
-              # the fairly big tree over and over, producing a lot of garbage during
-              # source filtering, whose filter runs in a coroutine.
-              assert sumNestedLists (garbage 0 3) == pow 10 3;
-              true;
-          }
-        }"
-          == "${./src}";
+assert sumNestedLists (garbage 0 3) == pow 10 3;
+assert sumNestedLists (garbage 0 6) == pow 10 6;
+builtins.foldl'
+  (
+    a: b:
+    assert
+      "${builtins.path {
+        path = ./src;
+        filter =
+          path: type:
+          # We're not doing common subexpression elimination, so this reallocates
+          # the fairly big tree over and over, producing a lot of garbage during
+          # source filtering, whose filter runs in a coroutine.
+          assert sumNestedLists (garbage 0 3) == pow 10 3;
+          true;
+      }}" == "${./src}";
 
-      # These asserts don't seem necessary, as the lambda value get corrupted first
-      assert a.okay;
-      assert b.okay;
-      { okay = true; }
-    )
+    # These asserts don't seem necessary, as the lambda value get corrupted first
+    assert a.okay;
+    assert b.okay;
+    {
+      okay = true;
+    }
+  )
+  { okay = true; }
+  [
     { okay = true; }
-    [ { okay = true; } { okay = true; } { okay = true; } ]
+    { okay = true; }
+    { okay = true; }
+  ]
diff --git a/tests/functional/lang/eval-fail-addDrvOutputDependencies-multi-elem-context.nix b/tests/functional/lang/eval-fail-addDrvOutputDependencies-multi-elem-context.nix
index dbde264df..a1c3461cf 100644
--- a/tests/functional/lang/eval-fail-addDrvOutputDependencies-multi-elem-context.nix
+++ b/tests/functional/lang/eval-fail-addDrvOutputDependencies-multi-elem-context.nix
@@ -3,16 +3,23 @@ let
     name = "fail";
     builder = "/bin/false";
     system = "x86_64-linux";
-    outputs = [ "out" "foo" ];
+    outputs = [
+      "out"
+      "foo"
+    ];
   };
 
   drv1 = derivation {
     name = "fail-2";
     builder = "/bin/false";
     system = "x86_64-linux";
-    outputs = [ "out" "foo" ];
+    outputs = [
+      "out"
+      "foo"
+    ];
   };
 
   combo-path = "${drv0.drvPath}${drv1.drvPath}";
 
-in builtins.addDrvOutputDependencies combo-path
+in
+builtins.addDrvOutputDependencies combo-path
diff --git a/tests/functional/lang/eval-fail-addDrvOutputDependencies-wrong-element-kind.nix b/tests/functional/lang/eval-fail-addDrvOutputDependencies-wrong-element-kind.nix
index e379e1d95..6aab61c40 100644
--- a/tests/functional/lang/eval-fail-addDrvOutputDependencies-wrong-element-kind.nix
+++ b/tests/functional/lang/eval-fail-addDrvOutputDependencies-wrong-element-kind.nix
@@ -3,7 +3,11 @@ let
     name = "fail";
     builder = "/bin/false";
     system = "x86_64-linux";
-    outputs = [ "out" "foo" ];
+    outputs = [
+      "out"
+      "foo"
+    ];
   };
 
-in builtins.addDrvOutputDependencies drv.outPath
+in
+builtins.addDrvOutputDependencies drv.outPath
diff --git a/tests/functional/lang/eval-fail-addErrorContext-example.nix b/tests/functional/lang/eval-fail-addErrorContext-example.nix
index 996b24688..96a9cef84 100644
--- a/tests/functional/lang/eval-fail-addErrorContext-example.nix
+++ b/tests/functional/lang/eval-fail-addErrorContext-example.nix
@@ -1,9 +1,9 @@
 let
-  countDown = n:
-    if n == 0
-    then throw "kaboom"
+  countDown =
+    n:
+    if n == 0 then
+      throw "kaboom"
     else
-      builtins.addErrorContext
-        "while counting down; n = ${toString n}"
-        ("x" + countDown (n - 1));
-in countDown 10
+      builtins.addErrorContext "while counting down; n = ${toString n}" ("x" + countDown (n - 1));
+in
+countDown 10
diff --git a/tests/functional/lang/eval-fail-assert-equal-attrs-names-2.nix b/tests/functional/lang/eval-fail-assert-equal-attrs-names-2.nix
index 8e7ac9cf2..4bce26456 100644
--- a/tests/functional/lang/eval-fail-assert-equal-attrs-names-2.nix
+++ b/tests/functional/lang/eval-fail-assert-equal-attrs-names-2.nix
@@ -1,2 +1,8 @@
-assert { a = true; } == { a = true; b = true; };
+assert
+  {
+    a = true;
+  } == {
+    a = true;
+    b = true;
+  };
 throw "unreachable"
diff --git a/tests/functional/lang/eval-fail-assert-equal-attrs-names.nix b/tests/functional/lang/eval-fail-assert-equal-attrs-names.nix
index e2f53a85a..f9956999f 100644
--- a/tests/functional/lang/eval-fail-assert-equal-attrs-names.nix
+++ b/tests/functional/lang/eval-fail-assert-equal-attrs-names.nix
@@ -1,2 +1,8 @@
-assert { a = true; b = true; } == { a = true; };
+assert
+  {
+    a = true;
+    b = true;
+  } == {
+    a = true;
+  };
 throw "unreachable"
diff --git a/tests/functional/lang/eval-fail-assert-equal-derivations-extra.nix b/tests/functional/lang/eval-fail-assert-equal-derivations-extra.nix
index fd8bc3f26..14a782a77 100644
--- a/tests/functional/lang/eval-fail-assert-equal-derivations-extra.nix
+++ b/tests/functional/lang/eval-fail-assert-equal-derivations-extra.nix
@@ -1,5 +1,14 @@
 assert
-  { foo = { type = "derivation"; outPath = "/nix/store/0"; }; }
-  ==
-  { foo = { type = "derivation"; outPath = "/nix/store/1"; devious = true; }; };
-throw "unreachable"
\ No newline at end of file
+  {
+    foo = {
+      type = "derivation";
+      outPath = "/nix/store/0";
+    };
+  } == {
+    foo = {
+      type = "derivation";
+      outPath = "/nix/store/1";
+      devious = true;
+    };
+  };
+throw "unreachable"
diff --git a/tests/functional/lang/eval-fail-assert-equal-derivations.nix b/tests/functional/lang/eval-fail-assert-equal-derivations.nix
index c648eae37..0f6748c58 100644
--- a/tests/functional/lang/eval-fail-assert-equal-derivations.nix
+++ b/tests/functional/lang/eval-fail-assert-equal-derivations.nix
@@ -1,5 +1,15 @@
 assert
-  { foo = { type = "derivation"; outPath = "/nix/store/0"; ignored = abort "not ignored"; }; }
-  ==
-  { foo = { type = "derivation"; outPath = "/nix/store/1"; ignored = abort "not ignored"; }; };
-throw "unreachable"
\ No newline at end of file
+  {
+    foo = {
+      type = "derivation";
+      outPath = "/nix/store/0";
+      ignored = abort "not ignored";
+    };
+  } == {
+    foo = {
+      type = "derivation";
+      outPath = "/nix/store/1";
+      ignored = abort "not ignored";
+    };
+  };
+throw "unreachable"
diff --git a/tests/functional/lang/eval-fail-assert-equal-function-direct.nix b/tests/functional/lang/eval-fail-assert-equal-function-direct.nix
index 68e5e3908..cd15c4a36 100644
--- a/tests/functional/lang/eval-fail-assert-equal-function-direct.nix
+++ b/tests/functional/lang/eval-fail-assert-equal-function-direct.nix
@@ -1,7 +1,4 @@
 # Note: functions in nested structures, e.g. attributes, may be optimized away by pointer identity optimization.
 # This only compares a direct comparison and makes no claims about functions in nested structures.
-assert
-  (x: x)
-  ==
-  (x: x);
-abort "unreachable"
\ No newline at end of file
+assert (x: x) == (x: x);
+abort "unreachable"
diff --git a/tests/functional/lang/eval-fail-assert-equal-list-length.nix b/tests/functional/lang/eval-fail-assert-equal-list-length.nix
index 6d40f4d8e..bd74ccccd 100644
--- a/tests/functional/lang/eval-fail-assert-equal-list-length.nix
+++ b/tests/functional/lang/eval-fail-assert-equal-list-length.nix
@@ -1,2 +1,6 @@
-assert [ 1 0 ] == [ 10 ];
-throw "unreachable"
\ No newline at end of file
+assert
+  [
+    1
+    0
+  ] == [ 10 ];
+throw "unreachable"
diff --git a/tests/functional/lang/eval-fail-assert-equal-paths.nix b/tests/functional/lang/eval-fail-assert-equal-paths.nix
index ef0b67024..647e891b8 100644
--- a/tests/functional/lang/eval-fail-assert-equal-paths.nix
+++ b/tests/functional/lang/eval-fail-assert-equal-paths.nix
@@ -1,2 +1,2 @@
 assert ./foo == ./bar;
-throw "unreachable"
\ No newline at end of file
+throw "unreachable"
diff --git a/tests/functional/lang/eval-fail-assert-nested-bool.nix b/tests/functional/lang/eval-fail-assert-nested-bool.nix
index 228576983..c75fe0610 100644
--- a/tests/functional/lang/eval-fail-assert-nested-bool.nix
+++ b/tests/functional/lang/eval-fail-assert-nested-bool.nix
@@ -1,6 +1,3 @@
-assert
-  { a.b = [ { c.d = true; } ]; }
-  ==
-  { a.b = [ { c.d = false; } ]; };
+assert { a.b = [ { c.d = true; } ]; } == { a.b = [ { c.d = false; } ]; };
 
-abort "unreachable"
\ No newline at end of file
+abort "unreachable"
diff --git a/tests/functional/lang/eval-fail-assert.nix b/tests/functional/lang/eval-fail-assert.nix
index 3b7a1e8bf..7cb775045 100644
--- a/tests/functional/lang/eval-fail-assert.nix
+++ b/tests/functional/lang/eval-fail-assert.nix
@@ -1,5 +1,8 @@
 let {
-  x = arg: assert arg == "y"; 123;
+  x =
+    arg:
+    assert arg == "y";
+    123;
 
   body = x "x";
-}
\ No newline at end of file
+}
diff --git a/tests/functional/lang/eval-fail-attr-name-type.nix b/tests/functional/lang/eval-fail-attr-name-type.nix
index a0e76004a..fb6ccdd41 100644
--- a/tests/functional/lang/eval-fail-attr-name-type.nix
+++ b/tests/functional/lang/eval-fail-attr-name-type.nix
@@ -1,7 +1,7 @@
 let
   attrs = {
-    puppy.doggy = {};
+    puppy.doggy = { };
   };
   key = 1;
 in
-  attrs.puppy.${key}
+attrs.puppy.${key}
diff --git a/tests/functional/lang/eval-fail-attrset-merge-drops-later-rec.nix b/tests/functional/lang/eval-fail-attrset-merge-drops-later-rec.nix
index fdb314b91..b6b56bf7d 100644
--- a/tests/functional/lang/eval-fail-attrset-merge-drops-later-rec.nix
+++ b/tests/functional/lang/eval-fail-attrset-merge-drops-later-rec.nix
@@ -1 +1,8 @@
-{ a.b = 1; a = rec { c = d + 2; d = 3; }; }.c
+{
+  a.b = 1;
+  a = rec {
+    c = d + 2;
+    d = 3;
+  };
+}
+.c
diff --git a/tests/functional/lang/eval-fail-bad-string-interpolation-4.nix b/tests/functional/lang/eval-fail-bad-string-interpolation-4.nix
index 457b5f06a..e8349bbdf 100644
--- a/tests/functional/lang/eval-fail-bad-string-interpolation-4.nix
+++ b/tests/functional/lang/eval-fail-bad-string-interpolation-4.nix
@@ -1,6 +1,16 @@
 let
   # Basically a "billion laughs" attack, but toned down to simulated `pkgs`.
-  ha = x: y: { a = x y; b = x y; c = x y; d = x y; e = x y; f = x y; g = x y; h = x y; j = x y; };
+  ha = x: y: {
+    a = x y;
+    b = x y;
+    c = x y;
+    d = x y;
+    e = x y;
+    f = x y;
+    g = x y;
+    h = x y;
+    j = x y;
+  };
   has = ha (ha (ha (ha (x: x)))) "ha";
   # A large structure that has already been evaluated.
   pkgs = builtins.deepSeq has has;
diff --git a/tests/functional/lang/eval-fail-dup-dynamic-attrs.nix b/tests/functional/lang/eval-fail-dup-dynamic-attrs.nix
index 7ea17f6c8..93cceefa4 100644
--- a/tests/functional/lang/eval-fail-dup-dynamic-attrs.nix
+++ b/tests/functional/lang/eval-fail-dup-dynamic-attrs.nix
@@ -1,4 +1,8 @@
 {
-  set = { "${"" + "b"}" = 1; };
-  set = { "${"b" + ""}" = 2; };
+  set = {
+    "${"" + "b"}" = 1;
+  };
+  set = {
+    "${"b" + ""}" = 2;
+  };
 }
diff --git a/tests/functional/lang/eval-fail-duplicate-traces.nix b/tests/functional/lang/eval-fail-duplicate-traces.nix
index 17ce374ec..90526f6d4 100644
--- a/tests/functional/lang/eval-fail-duplicate-traces.nix
+++ b/tests/functional/lang/eval-fail-duplicate-traces.nix
@@ -1,9 +1,6 @@
 # Check that we only omit duplicate stack traces when there's a bunch of them.
 # Here, there's only a couple duplicate entries, so we output them all.
 let
-  throwAfter = n:
-    if n > 0
-    then throwAfter (n - 1)
-    else throw "Uh oh!";
+  throwAfter = n: if n > 0 then throwAfter (n - 1) else throw "Uh oh!";
 in
-  throwAfter 2
+throwAfter 2
diff --git a/tests/functional/lang/eval-fail-fetchurl-baseName-attrs-name.nix b/tests/functional/lang/eval-fail-fetchurl-baseName-attrs-name.nix
index 583805539..dcaf7202b 100644
--- a/tests/functional/lang/eval-fail-fetchurl-baseName-attrs-name.nix
+++ b/tests/functional/lang/eval-fail-fetchurl-baseName-attrs-name.nix
@@ -1 +1,4 @@
-builtins.fetchurl { url = "https://example.com/foo.tar.gz"; name = "~wobble~"; }
+builtins.fetchurl {
+  url = "https://example.com/foo.tar.gz";
+  name = "~wobble~";
+}
diff --git a/tests/functional/lang/eval-fail-flake-ref-to-string-negative-integer.nix b/tests/functional/lang/eval-fail-flake-ref-to-string-negative-integer.nix
index e0208eb25..9cc9ef629 100644
--- a/tests/functional/lang/eval-fail-flake-ref-to-string-negative-integer.nix
+++ b/tests/functional/lang/eval-fail-flake-ref-to-string-negative-integer.nix
@@ -1,7 +1,12 @@
-let n = -1; in builtins.seq n (builtins.flakeRefToString {
-  type  = "github";
-  owner = "NixOS";
-  repo  = n;
-  ref   = "23.05";
-  dir   = "lib";
-})
+let
+  n = -1;
+in
+builtins.seq n (
+  builtins.flakeRefToString {
+    type = "github";
+    owner = "NixOS";
+    repo = n;
+    ref = "23.05";
+    dir = "lib";
+  }
+)
diff --git a/tests/functional/lang/eval-fail-foldlStrict-strict-op-application.nix b/tests/functional/lang/eval-fail-foldlStrict-strict-op-application.nix
index 1620cc76e..f85486d44 100644
--- a/tests/functional/lang/eval-fail-foldlStrict-strict-op-application.nix
+++ b/tests/functional/lang/eval-fail-foldlStrict-strict-op-application.nix
@@ -1,5 +1,5 @@
 # Tests that the result of applying op is forced even if the value is never used
-builtins.foldl'
-  (_: f: f null)
-  null
-  [ (_: throw "Not the final value, but is still forced!") (_: 23) ]
+builtins.foldl' (_: f: f null) null [
+  (_: throw "Not the final value, but is still forced!")
+  (_: 23)
+]
diff --git a/tests/functional/lang/eval-fail-hashfile-missing.nix b/tests/functional/lang/eval-fail-hashfile-missing.nix
index ce098b823..0f2872b71 100644
--- a/tests/functional/lang/eval-fail-hashfile-missing.nix
+++ b/tests/functional/lang/eval-fail-hashfile-missing.nix
@@ -1,5 +1,16 @@
 let
-  paths = [ ./this-file-is-definitely-not-there-7392097 "/and/neither/is/this/37293620" ];
+  paths = [
+    ./this-file-is-definitely-not-there-7392097
+    "/and/neither/is/this/37293620"
+  ];
 in
-  toString (builtins.concatLists (map (hash: map (builtins.hashFile hash) paths) ["md5" "sha1" "sha256" "sha512"]))
-
+toString (
+  builtins.concatLists (
+    map (hash: map (builtins.hashFile hash) paths) [
+      "md5"
+      "sha1"
+      "sha256"
+      "sha512"
+    ]
+  )
+)
diff --git a/tests/functional/lang/eval-fail-list.nix b/tests/functional/lang/eval-fail-list.nix
index fa749f2f7..14eb4efa9 100644
--- a/tests/functional/lang/eval-fail-list.nix
+++ b/tests/functional/lang/eval-fail-list.nix
@@ -1 +1 @@
-8++1
+8 ++ 1
diff --git a/tests/functional/lang/eval-fail-missing-arg.nix b/tests/functional/lang/eval-fail-missing-arg.nix
index c4be9797c..9037aa40a 100644
--- a/tests/functional/lang/eval-fail-missing-arg.nix
+++ b/tests/functional/lang/eval-fail-missing-arg.nix
@@ -1 +1,12 @@
-({x, y, z}: x + y + z) {x = "foo"; z = "bar";}
+(
+  {
+    x,
+    y,
+    z,
+  }:
+  x + y + z
+)
+  {
+    x = "foo";
+    z = "bar";
+  }
diff --git a/tests/functional/lang/eval-fail-mutual-recursion.nix b/tests/functional/lang/eval-fail-mutual-recursion.nix
index d090d3158..421e464dd 100644
--- a/tests/functional/lang/eval-fail-mutual-recursion.nix
+++ b/tests/functional/lang/eval-fail-mutual-recursion.nix
@@ -19,18 +19,22 @@
 # - a few frames of A (skip the rest)
 # - a few frames of B (skip the rest, _and_ skip the remaining frames of A)
 let
-  throwAfterB = recurse: n:
-    if n > 0
-    then throwAfterB recurse (n - 1)
-    else if recurse
-    then throwAfterA false 10
-    else throw "Uh oh!";
+  throwAfterB =
+    recurse: n:
+    if n > 0 then
+      throwAfterB recurse (n - 1)
+    else if recurse then
+      throwAfterA false 10
+    else
+      throw "Uh oh!";
 
-  throwAfterA = recurse: n:
-    if n > 0
-    then throwAfterA recurse (n - 1)
-    else if recurse
-    then throwAfterB true 10
-    else throw "Uh oh!";
+  throwAfterA =
+    recurse: n:
+    if n > 0 then
+      throwAfterA recurse (n - 1)
+    else if recurse then
+      throwAfterB true 10
+    else
+      throw "Uh oh!";
 in
-  throwAfterA true 10
+throwAfterA true 10
diff --git a/tests/functional/lang/eval-fail-nested-list-items.nix b/tests/functional/lang/eval-fail-nested-list-items.nix
index af45b1dd4..d0aa1b5d3 100644
--- a/tests/functional/lang/eval-fail-nested-list-items.nix
+++ b/tests/functional/lang/eval-fail-nested-list-items.nix
@@ -8,4 +8,27 @@
 #
 #        error: cannot coerce a list to a string: [ [ 1 2 3 4 5 6 7 8 ] [ 1 «4294967290 items elided» ] ]
 
-"" + (let v = [ [ 1 2 3 4 5 6 7 8 ] [1 2 3 4]]; in builtins.deepSeq v v)
+""
++ (
+  let
+    v = [
+      [
+        1
+        2
+        3
+        4
+        5
+        6
+        7
+        8
+      ]
+      [
+        1
+        2
+        3
+        4
+      ]
+    ];
+  in
+  builtins.deepSeq v v
+)
diff --git a/tests/functional/lang/eval-fail-not-throws.nix b/tests/functional/lang/eval-fail-not-throws.nix
index a74ce4ebe..2e024738b 100644
--- a/tests/functional/lang/eval-fail-not-throws.nix
+++ b/tests/functional/lang/eval-fail-not-throws.nix
@@ -1 +1 @@
-! (throw "uh oh!")
+!(throw "uh oh!")
diff --git a/tests/functional/lang/eval-fail-overflowing-add.nix b/tests/functional/lang/eval-fail-overflowing-add.nix
index 24258fc20..9e1e8aa75 100644
--- a/tests/functional/lang/eval-fail-overflowing-add.nix
+++ b/tests/functional/lang/eval-fail-overflowing-add.nix
@@ -1,4 +1,5 @@
 let
   a = 9223372036854775807;
   b = 1;
-in a + b
+in
+a + b
diff --git a/tests/functional/lang/eval-fail-overflowing-div.nix b/tests/functional/lang/eval-fail-overflowing-div.nix
index 44fbe9d7e..e21b0b2e5 100644
--- a/tests/functional/lang/eval-fail-overflowing-div.nix
+++ b/tests/functional/lang/eval-fail-overflowing-div.nix
@@ -4,4 +4,5 @@ let
   # of range
   intMin = -9223372036854775807 - 1;
   b = -1;
-in builtins.seq intMin (builtins.seq b (intMin / b))
+in
+builtins.seq intMin (builtins.seq b (intMin / b))
diff --git a/tests/functional/lang/eval-fail-overflowing-mul.nix b/tests/functional/lang/eval-fail-overflowing-mul.nix
index 6081d9c7b..95b1375bb 100644
--- a/tests/functional/lang/eval-fail-overflowing-mul.nix
+++ b/tests/functional/lang/eval-fail-overflowing-mul.nix
@@ -1,3 +1,4 @@
 let
   a = 4294967297;
-in a * a * a
+in
+a * a * a
diff --git a/tests/functional/lang/eval-fail-overflowing-sub.nix b/tests/functional/lang/eval-fail-overflowing-sub.nix
index 229b8c6d2..4f0203a6d 100644
--- a/tests/functional/lang/eval-fail-overflowing-sub.nix
+++ b/tests/functional/lang/eval-fail-overflowing-sub.nix
@@ -1,4 +1,5 @@
 let
   a = -9223372036854775807;
   b = 2;
-in a - b
+in
+a - b
diff --git a/tests/functional/lang/eval-fail-recursion.nix b/tests/functional/lang/eval-fail-recursion.nix
index 075b5ed06..88718a6e5 100644
--- a/tests/functional/lang/eval-fail-recursion.nix
+++ b/tests/functional/lang/eval-fail-recursion.nix
@@ -1 +1,4 @@
-let a = {} // a; in a.foo
+let
+  a = { } // a;
+in
+a.foo
diff --git a/tests/functional/lang/eval-fail-remove.nix b/tests/functional/lang/eval-fail-remove.nix
index 539e0eb0a..9de066abe 100644
--- a/tests/functional/lang/eval-fail-remove.nix
+++ b/tests/functional/lang/eval-fail-remove.nix
@@ -1,5 +1,8 @@
 let {
-  attrs = {x = 123; y = 456;};
+  attrs = {
+    x = 123;
+    y = 456;
+  };
 
-  body = (removeAttrs attrs ["x"]).x;
-}
\ No newline at end of file
+  body = (removeAttrs attrs [ "x" ]).x;
+}
diff --git a/tests/functional/lang/eval-fail-scope-5.nix b/tests/functional/lang/eval-fail-scope-5.nix
index f89a65a99..ef6f1bb64 100644
--- a/tests/functional/lang/eval-fail-scope-5.nix
+++ b/tests/functional/lang/eval-fail-scope-5.nix
@@ -3,8 +3,13 @@ let {
   x = "a";
   y = "b";
 
-  f = {x ? y, y ? x}: x + y;
+  f =
+    {
+      x ? y,
+      y ? x,
+    }:
+    x + y;
 
-  body = f {};
+  body = f { };
 
 }
diff --git a/tests/functional/lang/eval-fail-undeclared-arg.nix b/tests/functional/lang/eval-fail-undeclared-arg.nix
index cafdf1636..aca4511bb 100644
--- a/tests/functional/lang/eval-fail-undeclared-arg.nix
+++ b/tests/functional/lang/eval-fail-undeclared-arg.nix
@@ -1 +1,5 @@
-({x, z}: x + z) {x = "foo"; y = "bla"; z = "bar";}
+({ x, z }: x + z) {
+  x = "foo";
+  y = "bla";
+  z = "bar";
+}
diff --git a/tests/functional/lang/eval-fail-using-set-as-attr-name.nix b/tests/functional/lang/eval-fail-using-set-as-attr-name.nix
index 48e071a41..96390e35f 100644
--- a/tests/functional/lang/eval-fail-using-set-as-attr-name.nix
+++ b/tests/functional/lang/eval-fail-using-set-as-attr-name.nix
@@ -1,5 +1,7 @@
 let
-  attr = {foo = "bar";};
-  key = {};
+  attr = {
+    foo = "bar";
+  };
+  key = { };
 in
-  attr.${key}
+attr.${key}
diff --git a/tests/functional/lang/eval-okay-any-all.nix b/tests/functional/lang/eval-okay-any-all.nix
index a3f26ea2a..643d36cb7 100644
--- a/tests/functional/lang/eval-okay-any-all.nix
+++ b/tests/functional/lang/eval-okay-any-all.nix
@@ -1,11 +1,34 @@
 with builtins;
 
-[ (any (x: x == 1) [])
-  (any (x: x == 1) [2 3 4])
-  (any (x: x == 1) [1 2 3 4])
-  (any (x: x == 1) [4 3 2 1])
-  (all (x: x == 1) [])
-  (all (x: x == 1) [1])
-  (all (x: x == 1) [1 2 3])
-  (all (x: x == 1) [1 1 1])
+[
+  (any (x: x == 1) [ ])
+  (any (x: x == 1) [
+    2
+    3
+    4
+  ])
+  (any (x: x == 1) [
+    1
+    2
+    3
+    4
+  ])
+  (any (x: x == 1) [
+    4
+    3
+    2
+    1
+  ])
+  (all (x: x == 1) [ ])
+  (all (x: x == 1) [ 1 ])
+  (all (x: x == 1) [
+    1
+    2
+    3
+  ])
+  (all (x: x == 1) [
+    1
+    1
+    1
+  ])
 ]
diff --git a/tests/functional/lang/eval-okay-arithmetic.nix b/tests/functional/lang/eval-okay-arithmetic.nix
index 7e9e6a0b6..8160b4d84 100644
--- a/tests/functional/lang/eval-okay-arithmetic.nix
+++ b/tests/functional/lang/eval-okay-arithmetic.nix
@@ -2,58 +2,59 @@ with import ./lib.nix;
 
 let {
 
-  /* Supposedly tail recursive version:
+  /*
+    Supposedly tail recursive version:
 
-  range_ = accum: first: last:
-    if first == last then ([first] ++ accum)
-    else range_ ([first] ++ accum) (builtins.add first 1) last;
+    range_ = accum: first: last:
+      if first == last then ([first] ++ accum)
+      else range_ ([first] ++ accum) (builtins.add first 1) last;
 
-  range = range_ [];
+    range = range_ [];
   */
 
   x = 12;
 
   err = abort "urgh";
 
-  body = sum
-    [ (sum (range 1 50))
-      (123 + 456)
-      (0 + -10 + -(-11) + -x)
-      (10 - 7 - -2)
-      (10 - (6 - -1))
-      (10 - 1 + 2)
-      (3 * 4 * 5)
-      (56088 / 123 / 2)
-      (3 + 4 * const 5 0 - 6 / id 2)
+  body = sum [
+    (sum (range 1 50))
+    (123 + 456)
+    (0 + -10 + -(-11) + -x)
+    (10 - 7 - -2)
+    (10 - (6 - -1))
+    (10 - 1 + 2)
+    (3 * 4 * 5)
+    (56088 / 123 / 2)
+    (3 + 4 * const 5 0 - 6 / id 2)
 
-      (builtins.bitAnd 12 10) # 0b1100 & 0b1010 =  8
-      (builtins.bitOr  12 10) # 0b1100 | 0b1010 = 14
-      (builtins.bitXor 12 10) # 0b1100 ^ 0b1010 =  6
+    (builtins.bitAnd 12 10) # 0b1100 & 0b1010 =  8
+    (builtins.bitOr 12 10) # 0b1100 | 0b1010 = 14
+    (builtins.bitXor 12 10) # 0b1100 ^ 0b1010 =  6
 
-      (if 3 < 7 then 1 else err)
-      (if 7 < 3 then err else 1)
-      (if 3 < 3 then err else 1)
+    (if 3 < 7 then 1 else err)
+    (if 7 < 3 then err else 1)
+    (if 3 < 3 then err else 1)
 
-      (if 3 <= 7 then 1 else err)
-      (if 7 <= 3 then err else 1)
-      (if 3 <= 3 then 1 else err)
+    (if 3 <= 7 then 1 else err)
+    (if 7 <= 3 then err else 1)
+    (if 3 <= 3 then 1 else err)
 
-      (if 3 > 7 then err else 1)
-      (if 7 > 3 then 1 else err)
-      (if 3 > 3 then err else 1)
+    (if 3 > 7 then err else 1)
+    (if 7 > 3 then 1 else err)
+    (if 3 > 3 then err else 1)
 
-      (if 3 >= 7 then err else 1)
-      (if 7 >= 3 then 1 else err)
-      (if 3 >= 3 then 1 else err)
+    (if 3 >= 7 then err else 1)
+    (if 7 >= 3 then 1 else err)
+    (if 3 >= 3 then 1 else err)
 
-      (if 2 > 1 == 1 < 2 then 1 else err)
-      (if 1 + 2 * 3 >= 7 then 1 else err)
-      (if 1 + 2 * 3 < 7 then err else 1)
+    (if 2 > 1 == 1 < 2 then 1 else err)
+    (if 1 + 2 * 3 >= 7 then 1 else err)
+    (if 1 + 2 * 3 < 7 then err else 1)
 
-      # Not integer, but so what.
-      (if "aa" < "ab" then 1 else err)
-      (if "aa" < "aa" then err else 1)
-      (if "foo" < "foobar" then 1 else err)
-    ];
+    # Not integer, but so what.
+    (if "aa" < "ab" then 1 else err)
+    (if "aa" < "aa" then err else 1)
+    (if "foo" < "foobar" then 1 else err)
+  ];
 
 }
diff --git a/tests/functional/lang/eval-okay-attrnames.nix b/tests/functional/lang/eval-okay-attrnames.nix
index e5b26e9f2..085e78084 100644
--- a/tests/functional/lang/eval-okay-attrnames.nix
+++ b/tests/functional/lang/eval-okay-attrnames.nix
@@ -2,10 +2,21 @@ with import ./lib.nix;
 
 let
 
-  attrs = {y = "y"; x = "x"; foo = "foo";} // rec {x = "newx"; bar = x;};
+  attrs =
+    {
+      y = "y";
+      x = "x";
+      foo = "foo";
+    }
+    // rec {
+      x = "newx";
+      bar = x;
+    };
 
   names = builtins.attrNames attrs;
 
   values = map (name: builtins.getAttr name attrs) names;
 
-in assert values == builtins.attrValues attrs; concat values
+in
+assert values == builtins.attrValues attrs;
+concat values
diff --git a/tests/functional/lang/eval-okay-attrs.nix b/tests/functional/lang/eval-okay-attrs.nix
index 810b31a5d..787b9a933 100644
--- a/tests/functional/lang/eval-okay-attrs.nix
+++ b/tests/functional/lang/eval-okay-attrs.nix
@@ -1,5 +1,20 @@
 let {
-  as = { x = 123; y = 456; } // { z = 789; } // { z = 987; };
+  as =
+    {
+      x = 123;
+      y = 456;
+    }
+    // {
+      z = 789;
+    }
+    // {
+      z = 987;
+    };
 
-  body = if as ? a then as.a else assert as ? z; as.z;
+  body =
+    if as ? a then
+      as.a
+    else
+      assert as ? z;
+      as.z;
 }
diff --git a/tests/functional/lang/eval-okay-attrs2.nix b/tests/functional/lang/eval-okay-attrs2.nix
index 9e06b83ac..0896f9cf1 100644
--- a/tests/functional/lang/eval-okay-attrs2.nix
+++ b/tests/functional/lang/eval-okay-attrs2.nix
@@ -1,10 +1,23 @@
 let {
-  as = { x = 123; y = 456; } // { z = 789; } // { z = 987; };
+  as =
+    {
+      x = 123;
+      y = 456;
+    }
+    // {
+      z = 789;
+    }
+    // {
+      z = 987;
+    };
 
   A = "a";
   Z = "z";
 
-  body = if builtins.hasAttr A as
-         then builtins.getAttr A as
-         else assert builtins.hasAttr Z as; builtins.getAttr Z as;
+  body =
+    if builtins.hasAttr A as then
+      builtins.getAttr A as
+    else
+      assert builtins.hasAttr Z as;
+      builtins.getAttr Z as;
 }
diff --git a/tests/functional/lang/eval-okay-attrs3.nix b/tests/functional/lang/eval-okay-attrs3.nix
index f29de11fe..cab345337 100644
--- a/tests/functional/lang/eval-okay-attrs3.nix
+++ b/tests/functional/lang/eval-okay-attrs3.nix
@@ -1,22 +1,22 @@
 let
 
-  config = 
-    {
-      services.sshd.enable = true;
-      services.sshd.port = 22;
-      services.httpd.port = 80;
-      hostName = "itchy";
-      a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z = "x";
-      foo = {
-        a = "a";
-        b.c = "c";
-      };
+  config = {
+    services.sshd.enable = true;
+    services.sshd.port = 22;
+    services.httpd.port = 80;
+    hostName = "itchy";
+    a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z = "x";
+    foo = {
+      a = "a";
+      b.c = "c";
     };
+  };
 
 in
-  if config.services.sshd.enable
-  then "foo ${toString config.services.sshd.port} ${toString config.services.httpd.port} ${config.hostName}"
-       + "${config.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z}"
-       + "${config.foo.a}"
-       + "${config.foo.b.c}"
-  else "bar"
+if config.services.sshd.enable then
+  "foo ${toString config.services.sshd.port} ${toString config.services.httpd.port} ${config.hostName}"
+  + "${config.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z}"
+  + "${config.foo.a}"
+  + "${config.foo.b.c}"
+else
+  "bar"
diff --git a/tests/functional/lang/eval-okay-attrs4.nix b/tests/functional/lang/eval-okay-attrs4.nix
index 43ec81210..3e43e4bae 100644
--- a/tests/functional/lang/eval-okay-attrs4.nix
+++ b/tests/functional/lang/eval-okay-attrs4.nix
@@ -1,7 +1,20 @@
 let
 
-  as = { x.y.z = 123; a.b.c = 456; };
+  as = {
+    x.y.z = 123;
+    a.b.c = 456;
+  };
 
   bs = null;
 
-in [ (as ? x) (as ? y) (as ? x.y.z) (as ? x.y.z.a) (as ? x.y.a) (as ? a.b.c) (bs ? x) (bs ? x.y.z) ]
+in
+[
+  (as ? x)
+  (as ? y)
+  (as ? x.y.z)
+  (as ? x.y.z.a)
+  (as ? x.y.a)
+  (as ? a.b.c)
+  (bs ? x)
+  (bs ? x.y.z)
+]
diff --git a/tests/functional/lang/eval-okay-attrs6.nix b/tests/functional/lang/eval-okay-attrs6.nix
index 2e5c85483..76c94af78 100644
--- a/tests/functional/lang/eval-okay-attrs6.nix
+++ b/tests/functional/lang/eval-okay-attrs6.nix
@@ -1,4 +1,6 @@
 rec {
   "${"foo"}" = "bar";
-   __overrides = { bar = "qux"; };
+  __overrides = {
+    bar = "qux";
+  };
 }
diff --git a/tests/functional/lang/eval-okay-autoargs.nix b/tests/functional/lang/eval-okay-autoargs.nix
index 815f51b1d..bc82c569b 100644
--- a/tests/functional/lang/eval-okay-autoargs.nix
+++ b/tests/functional/lang/eval-okay-autoargs.nix
@@ -4,12 +4,17 @@ let
 
 in
 
-{ xyzzy2 ? xyzzy # mutually recursive args
-, xyzzy ? "blaat" # will be overridden by --argstr
-, fb ? foobar
-, lib # will be set by --arg
+{
+  xyzzy2 ? xyzzy, # mutually recursive args
+  xyzzy ? "blaat", # will be overridden by --argstr
+  fb ? foobar,
+  lib, # will be set by --arg
 }:
 
 {
-  result = lib.concat [xyzzy xyzzy2 fb];
+  result = lib.concat [
+    xyzzy
+    xyzzy2
+    fb
+  ];
 }
diff --git a/tests/functional/lang/eval-okay-builtins-add.nix b/tests/functional/lang/eval-okay-builtins-add.nix
index c84181622..f678f640f 100644
--- a/tests/functional/lang/eval-okay-builtins-add.nix
+++ b/tests/functional/lang/eval-okay-builtins-add.nix
@@ -1,8 +1,8 @@
 [
-(builtins.add 2 3)
-(builtins.add 2 2)
-(builtins.typeOf (builtins.add 2  2))
-("t" + "t")
-(builtins.typeOf (builtins.add 2.0 2))
-(builtins.add 2.0 2)
+  (builtins.add 2 3)
+  (builtins.add 2 2)
+  (builtins.typeOf (builtins.add 2 2))
+  ("t" + "t")
+  (builtins.typeOf (builtins.add 2.0 2))
+  (builtins.add 2.0 2)
 ]
diff --git a/tests/functional/lang/eval-okay-builtins.nix b/tests/functional/lang/eval-okay-builtins.nix
index e9d65e88a..be4114116 100644
--- a/tests/functional/lang/eval-okay-builtins.nix
+++ b/tests/functional/lang/eval-okay-builtins.nix
@@ -8,5 +8,5 @@ let {
   y = if builtins ? fnord then builtins.fnord "foo" else "";
 
   body = x + y;
-  
+
 }
diff --git a/tests/functional/lang/eval-okay-callable-attrs.nix b/tests/functional/lang/eval-okay-callable-attrs.nix
index 310a030df..a4c1ace36 100644
--- a/tests/functional/lang/eval-okay-callable-attrs.nix
+++ b/tests/functional/lang/eval-okay-callable-attrs.nix
@@ -1 +1,10 @@
-({ __functor = self: x: self.foo && x; foo = false; } // { foo = true; }) true
+(
+  {
+    __functor = self: x: self.foo && x;
+    foo = false;
+  }
+  // {
+    foo = true;
+  }
+)
+  true
diff --git a/tests/functional/lang/eval-okay-catattrs.nix b/tests/functional/lang/eval-okay-catattrs.nix
index 2c3dc10da..7ec4ba7ae 100644
--- a/tests/functional/lang/eval-okay-catattrs.nix
+++ b/tests/functional/lang/eval-okay-catattrs.nix
@@ -1 +1,5 @@
-builtins.catAttrs "a" [ { a = 1; } { b = 0; } { a = 2; } ]
+builtins.catAttrs "a" [
+  { a = 1; }
+  { b = 0; }
+  { a = 2; }
+]
diff --git a/tests/functional/lang/eval-okay-closure.nix b/tests/functional/lang/eval-okay-closure.nix
index cccd4dc35..67c53d089 100644
--- a/tests/functional/lang/eval-okay-closure.nix
+++ b/tests/functional/lang/eval-okay-closure.nix
@@ -1,13 +1,25 @@
 let
 
   closure = builtins.genericClosure {
-    startSet = [{key = 80;}];
-    operator = {key, foo ? false}:
-      if builtins.lessThan key 0
-      then []
-      else [{key = builtins.sub key 9;} {key = builtins.sub key 13; foo = true;}];
+    startSet = [ { key = 80; } ];
+    operator =
+      {
+        key,
+        foo ? false,
+      }:
+      if builtins.lessThan key 0 then
+        [ ]
+      else
+        [
+          { key = builtins.sub key 9; }
+          {
+            key = builtins.sub key 13;
+            foo = true;
+          }
+        ];
   };
 
   sort = (import ./lib.nix).sortBy (a: b: builtins.lessThan a.key b.key);
 
-in sort closure
+in
+sort closure
diff --git a/tests/functional/lang/eval-okay-concat.nix b/tests/functional/lang/eval-okay-concat.nix
index d158a9bf0..ce754ca00 100644
--- a/tests/functional/lang/eval-okay-concat.nix
+++ b/tests/functional/lang/eval-okay-concat.nix
@@ -1 +1,15 @@
-[1 2 3] ++ [4 5 6] ++ [7 8 9]
+[
+  1
+  2
+  3
+]
+++ [
+  4
+  5
+  6
+]
+++ [
+  7
+  8
+  9
+]
diff --git a/tests/functional/lang/eval-okay-concatmap.nix b/tests/functional/lang/eval-okay-concatmap.nix
index 97da5d37a..14b546131 100644
--- a/tests/functional/lang/eval-okay-concatmap.nix
+++ b/tests/functional/lang/eval-okay-concatmap.nix
@@ -1,5 +1,9 @@
 with import ./lib.nix;
 
-[ (builtins.concatMap (x: if x / 2 * 2 == x then [] else [ x ]) (range 0 10))
-  (builtins.concatMap (x: [x] ++ ["z"]) ["a" "b"])
+[
+  (builtins.concatMap (x: if x / 2 * 2 == x then [ ] else [ x ]) (range 0 10))
+  (builtins.concatMap (x: [ x ] ++ [ "z" ]) [
+    "a"
+    "b"
+  ])
 ]
diff --git a/tests/functional/lang/eval-okay-concatstringssep.nix b/tests/functional/lang/eval-okay-concatstringssep.nix
index adc4c41bd..2270d11b4 100644
--- a/tests/functional/lang/eval-okay-concatstringssep.nix
+++ b/tests/functional/lang/eval-okay-concatstringssep.nix
@@ -1,8 +1,17 @@
 with builtins;
 
-[ (concatStringsSep "" [])
-  (concatStringsSep "" ["foo" "bar" "xyzzy"])
-  (concatStringsSep ", " ["foo" "bar" "xyzzy"])
-  (concatStringsSep ", " ["foo"])
-  (concatStringsSep ", " [])
+[
+  (concatStringsSep "" [ ])
+  (concatStringsSep "" [
+    "foo"
+    "bar"
+    "xyzzy"
+  ])
+  (concatStringsSep ", " [
+    "foo"
+    "bar"
+    "xyzzy"
+  ])
+  (concatStringsSep ", " [ "foo" ])
+  (concatStringsSep ", " [ ])
 ]
diff --git a/tests/functional/lang/eval-okay-context-introspection.nix b/tests/functional/lang/eval-okay-context-introspection.nix
index 8886cf32e..5ed994719 100644
--- a/tests/functional/lang/eval-okay-context-introspection.nix
+++ b/tests/functional/lang/eval-okay-context-introspection.nix
@@ -3,7 +3,10 @@ let
     name = "fail";
     builder = "/bin/false";
     system = "x86_64-linux";
-    outputs = [ "out" "foo" ];
+    outputs = [
+      "out"
+      "foo"
+    ];
   };
 
   path = "${./eval-okay-context-introspection.nix}";
@@ -13,7 +16,10 @@ let
       path = true;
     };
     "${builtins.unsafeDiscardStringContext drv.drvPath}" = {
-      outputs = [ "foo" "out" ];
+      outputs = [
+        "foo"
+        "out"
+      ];
       allOutputs = true;
     };
   };
@@ -21,25 +27,22 @@ let
   combo-path = "${path}${drv.outPath}${drv.foo.outPath}${drv.drvPath}";
   legit-context = builtins.getContext combo-path;
 
-  reconstructed-path = builtins.appendContext
-    (builtins.unsafeDiscardStringContext combo-path)
-    desired-context;
+  reconstructed-path = builtins.appendContext (builtins.unsafeDiscardStringContext combo-path) desired-context;
 
   # Eta rule for strings with context.
-  etaRule = str:
-    str == builtins.appendContext
-      (builtins.unsafeDiscardStringContext str)
-      (builtins.getContext str);
+  etaRule =
+    str:
+    str == builtins.appendContext (builtins.unsafeDiscardStringContext str) (builtins.getContext str);
 
   # Only holds true if string context contains both a `DrvDeep` and
   # `Opaque` element.
-  almostEtaRule = str:
-    str == builtins.addDrvOutputDependencies
-      (builtins.unsafeDiscardOutputDependency str);
+  almostEtaRule =
+    str: str == builtins.addDrvOutputDependencies (builtins.unsafeDiscardOutputDependency str);
 
-  addDrvOutputDependencies_idempotent = str:
-    builtins.addDrvOutputDependencies str ==
-    builtins.addDrvOutputDependencies (builtins.addDrvOutputDependencies str);
+  addDrvOutputDependencies_idempotent =
+    str:
+    builtins.addDrvOutputDependencies str
+    == builtins.addDrvOutputDependencies (builtins.addDrvOutputDependencies str);
 
   rules = str: [
     (etaRule str)
@@ -47,12 +50,14 @@ let
     (addDrvOutputDependencies_idempotent str)
   ];
 
-in [
+in
+[
   (legit-context == desired-context)
   (reconstructed-path == combo-path)
   (etaRule "foo")
   (etaRule drv.foo.outPath)
-] ++ builtins.concatMap rules [
+]
+++ builtins.concatMap rules [
   drv.drvPath
   (builtins.addDrvOutputDependencies drv.drvPath)
   (builtins.unsafeDiscardOutputDependency drv.drvPath)
diff --git a/tests/functional/lang/eval-okay-context.nix b/tests/functional/lang/eval-okay-context.nix
index 7b9531cfe..102bc2259 100644
--- a/tests/functional/lang/eval-okay-context.nix
+++ b/tests/functional/lang/eval-okay-context.nix
@@ -1,6 +1,7 @@
-let s = "foo ${builtins.substring 33 100 (baseNameOf "${./eval-okay-context.nix}")} bar";
+let
+  s = "foo ${builtins.substring 33 100 (baseNameOf "${./eval-okay-context.nix}")} bar";
 in
-  if s != "foo eval-okay-context.nix bar"
-  then abort "context not discarded"
-  else builtins.unsafeDiscardStringContext s
-
+if s != "foo eval-okay-context.nix bar" then
+  abort "context not discarded"
+else
+  builtins.unsafeDiscardStringContext s
diff --git a/tests/functional/lang/eval-okay-convertHash.nix b/tests/functional/lang/eval-okay-convertHash.nix
index a0191ee8d..6d5074fea 100644
--- a/tests/functional/lang/eval-okay-convertHash.nix
+++ b/tests/functional/lang/eval-okay-convertHash.nix
@@ -1,33 +1,131 @@
 let
-  hashAlgos = [ "md5" "md5" "md5" "sha1" "sha1" "sha1" "sha256" "sha256" "sha256" "sha512" "sha512" "sha512" ];
+  hashAlgos = [
+    "md5"
+    "md5"
+    "md5"
+    "sha1"
+    "sha1"
+    "sha1"
+    "sha256"
+    "sha256"
+    "sha256"
+    "sha512"
+    "sha512"
+    "sha512"
+  ];
   hashesBase16 = import ./eval-okay-hashstring.exp;
-  map2 = f: { fsts, snds }: if fsts == [ ] then [ ] else [ (f (builtins.head fsts) (builtins.head snds)) ] ++ map2 f { fsts = builtins.tail fsts; snds = builtins.tail snds; };
-  map2' = f: fsts: snds: map2 f { inherit fsts snds; };
+  map2 =
+    f:
+    { fsts, snds }:
+    if fsts == [ ] then
+      [ ]
+    else
+      [ (f (builtins.head fsts) (builtins.head snds)) ]
+      ++ map2 f {
+        fsts = builtins.tail fsts;
+        snds = builtins.tail snds;
+      };
+  map2' =
+    f: fsts: snds:
+    map2 f { inherit fsts snds; };
   getOutputHashes = hashes: {
-    hashesBase16 = map2' (hashAlgo: hash: builtins.convertHash { inherit hash hashAlgo; toHashFormat = "base16";}) hashAlgos hashes;
-    hashesNix32 = map2' (hashAlgo: hash: builtins.convertHash { inherit hash hashAlgo; toHashFormat = "nix32";}) hashAlgos hashes;
-    hashesBase32 = map2' (hashAlgo: hash: builtins.convertHash { inherit hash hashAlgo; toHashFormat = "base32";}) hashAlgos hashes;
-    hashesBase64 = map2' (hashAlgo: hash: builtins.convertHash { inherit hash hashAlgo; toHashFormat = "base64";}) hashAlgos hashes;
-    hashesSRI    = map2' (hashAlgo: hash: builtins.convertHash { inherit hash hashAlgo; toHashFormat = "sri"   ;}) hashAlgos hashes;
+    hashesBase16 = map2' (
+      hashAlgo: hash:
+      builtins.convertHash {
+        inherit hash hashAlgo;
+        toHashFormat = "base16";
+      }
+    ) hashAlgos hashes;
+    hashesNix32 = map2' (
+      hashAlgo: hash:
+      builtins.convertHash {
+        inherit hash hashAlgo;
+        toHashFormat = "nix32";
+      }
+    ) hashAlgos hashes;
+    hashesBase32 = map2' (
+      hashAlgo: hash:
+      builtins.convertHash {
+        inherit hash hashAlgo;
+        toHashFormat = "base32";
+      }
+    ) hashAlgos hashes;
+    hashesBase64 = map2' (
+      hashAlgo: hash:
+      builtins.convertHash {
+        inherit hash hashAlgo;
+        toHashFormat = "base64";
+      }
+    ) hashAlgos hashes;
+    hashesSRI = map2' (
+      hashAlgo: hash:
+      builtins.convertHash {
+        inherit hash hashAlgo;
+        toHashFormat = "sri";
+      }
+    ) hashAlgos hashes;
   };
   getOutputHashesColon = hashes: {
-    hashesBase16 = map2' (hashAlgo: hashBody: builtins.convertHash { hash = hashAlgo + ":" + hashBody; toHashFormat = "base16";}) hashAlgos hashes;
-    hashesNix32 = map2' (hashAlgo: hashBody: builtins.convertHash { hash = hashAlgo + ":" + hashBody; toHashFormat = "nix32";}) hashAlgos hashes;
-    hashesBase32 = map2' (hashAlgo: hashBody: builtins.convertHash { hash = hashAlgo + ":" + hashBody; toHashFormat = "base32";}) hashAlgos hashes;
-    hashesBase64 = map2' (hashAlgo: hashBody: builtins.convertHash { hash = hashAlgo + ":" + hashBody; toHashFormat = "base64";}) hashAlgos hashes;
-    hashesSRI    = map2' (hashAlgo: hashBody: builtins.convertHash { hash = hashAlgo + ":" + hashBody; toHashFormat = "sri"   ;}) hashAlgos hashes;
+    hashesBase16 = map2' (
+      hashAlgo: hashBody:
+      builtins.convertHash {
+        hash = hashAlgo + ":" + hashBody;
+        toHashFormat = "base16";
+      }
+    ) hashAlgos hashes;
+    hashesNix32 = map2' (
+      hashAlgo: hashBody:
+      builtins.convertHash {
+        hash = hashAlgo + ":" + hashBody;
+        toHashFormat = "nix32";
+      }
+    ) hashAlgos hashes;
+    hashesBase32 = map2' (
+      hashAlgo: hashBody:
+      builtins.convertHash {
+        hash = hashAlgo + ":" + hashBody;
+        toHashFormat = "base32";
+      }
+    ) hashAlgos hashes;
+    hashesBase64 = map2' (
+      hashAlgo: hashBody:
+      builtins.convertHash {
+        hash = hashAlgo + ":" + hashBody;
+        toHashFormat = "base64";
+      }
+    ) hashAlgos hashes;
+    hashesSRI = map2' (
+      hashAlgo: hashBody:
+      builtins.convertHash {
+        hash = hashAlgo + ":" + hashBody;
+        toHashFormat = "sri";
+      }
+    ) hashAlgos hashes;
   };
   outputHashes = getOutputHashes hashesBase16;
 in
 # map2'`
-assert map2' (s1: s2: s1 + s2) [ "a" "b" ] [ "c" "d" ] == [ "ac" "bd" ];
+assert
+  map2' (s1: s2: s1 + s2) [ "a" "b" ] [ "c" "d" ] == [
+    "ac"
+    "bd"
+  ];
 # hashesBase16
 assert outputHashes.hashesBase16 == hashesBase16;
 # standard SRI hashes
-assert outputHashes.hashesSRI == (map2' (hashAlgo: hashBody: hashAlgo + "-" + hashBody) hashAlgos outputHashes.hashesBase64);
+assert
+  outputHashes.hashesSRI
+  == (map2' (hashAlgo: hashBody: hashAlgo + "-" + hashBody) hashAlgos outputHashes.hashesBase64);
 # without prefix
 assert builtins.all (x: getOutputHashes x == outputHashes) (builtins.attrValues outputHashes);
 # colon-separated.
 # Note that colon prefix must not be applied to the standard SRI. e.g. "sha256:sha256-..." is illegal.
-assert builtins.all (x: getOutputHashesColon x == outputHashes) (with outputHashes; [ hashesBase16 hashesBase32 hashesBase64 ]);
+assert builtins.all (x: getOutputHashesColon x == outputHashes) (
+  with outputHashes;
+  [
+    hashesBase16
+    hashesBase32
+    hashesBase64
+  ]
+);
 outputHashes
diff --git a/tests/functional/lang/eval-okay-deepseq.nix b/tests/functional/lang/eval-okay-deepseq.nix
index 53aa4b1dc..f9aa5f720 100644
--- a/tests/functional/lang/eval-okay-deepseq.nix
+++ b/tests/functional/lang/eval-okay-deepseq.nix
@@ -1 +1,9 @@
-builtins.deepSeq (let as = { x = 123; y = as; }; in as) 456
+builtins.deepSeq (
+  let
+    as = {
+      x = 123;
+      y = as;
+    };
+  in
+  as
+) 456
diff --git a/tests/functional/lang/eval-okay-delayed-with-inherit.nix b/tests/functional/lang/eval-okay-delayed-with-inherit.nix
index 84b388c27..10ce7df13 100644
--- a/tests/functional/lang/eval-okay-delayed-with-inherit.nix
+++ b/tests/functional/lang/eval-okay-delayed-with-inherit.nix
@@ -4,7 +4,10 @@ let
       name = "a";
       system = builtins.currentSystem;
       builder = "/bin/sh";
-      args = [ "-c" "touch $out" ];
+      args = [
+        "-c"
+        "touch $out"
+      ];
       inherit b;
     };
 
@@ -16,9 +19,13 @@ let
       name = "b-overridden";
       system = builtins.currentSystem;
       builder = "/bin/sh";
-      args = [ "-c" "touch $out" ];
+      args = [
+        "-c"
+        "touch $out"
+      ];
     };
   };
 
   pkgs = pkgs_ // (packageOverrides pkgs_);
-in pkgs.a.b.name
+in
+pkgs.a.b.name
diff --git a/tests/functional/lang/eval-okay-delayed-with.nix b/tests/functional/lang/eval-okay-delayed-with.nix
index 3fb023e1c..52ec24e12 100644
--- a/tests/functional/lang/eval-okay-delayed-with.nix
+++ b/tests/functional/lang/eval-okay-delayed-with.nix
@@ -5,7 +5,10 @@ let
       name = "a";
       system = builtins.currentSystem;
       builder = "/bin/sh";
-      args = [ "-c" "touch $out" ];
+      args = [
+        "-c"
+        "touch $out"
+      ];
       inherit b;
     };
 
@@ -13,17 +16,22 @@ let
       name = "b";
       system = builtins.currentSystem;
       builder = "/bin/sh";
-      args = [ "-c" "touch $out" ];
+      args = [
+        "-c"
+        "touch $out"
+      ];
       inherit a;
     };
 
     c = b;
   };
 
-  packageOverrides = pkgs: with pkgs; {
-    b = derivation (b.drvAttrs // { name = "${b.name}-overridden"; });
-  };
+  packageOverrides =
+    pkgs: with pkgs; {
+      b = derivation (b.drvAttrs // { name = "${b.name}-overridden"; });
+    };
 
   pkgs = pkgs_ // (packageOverrides pkgs_);
 
-in "${pkgs.a.b.name} ${pkgs.c.name} ${pkgs.b.a.name}"
+in
+"${pkgs.a.b.name} ${pkgs.c.name} ${pkgs.b.a.name}"
diff --git a/tests/functional/lang/eval-okay-dynamic-attrs-2.nix b/tests/functional/lang/eval-okay-dynamic-attrs-2.nix
index 6d57bf854..95fe79e25 100644
--- a/tests/functional/lang/eval-okay-dynamic-attrs-2.nix
+++ b/tests/functional/lang/eval-okay-dynamic-attrs-2.nix
@@ -1 +1,5 @@
-{ a."${"b"}" = true; a."${"c"}" = false; }.a.b
+{
+  a."${"b"}" = true;
+  a."${"c"}" = false;
+}
+.a.b
diff --git a/tests/functional/lang/eval-okay-dynamic-attrs-bare.nix b/tests/functional/lang/eval-okay-dynamic-attrs-bare.nix
index 0dbe15e63..a612bf69d 100644
--- a/tests/functional/lang/eval-okay-dynamic-attrs-bare.nix
+++ b/tests/functional/lang/eval-okay-dynamic-attrs-bare.nix
@@ -2,7 +2,8 @@ let
   aString = "a";
 
   bString = "b";
-in {
+in
+{
   hasAttrs = { a.b = null; } ? ${aString}.b;
 
   selectAttrs = { a.b = true; }.a.${bString};
@@ -11,7 +12,17 @@ in {
 
   binds = { ${aString}."${bString}c" = true; }.a.bc;
 
-  recBinds = rec { ${bString} = a; a = true; }.b;
+  recBinds =
+    rec {
+      ${bString} = a;
+      a = true;
+    }
+    .b;
 
-  multiAttrs = { ${aString} = true; ${bString} = false; }.a;
+  multiAttrs =
+    {
+      ${aString} = true;
+      ${bString} = false;
+    }
+    .a;
 }
diff --git a/tests/functional/lang/eval-okay-dynamic-attrs.nix b/tests/functional/lang/eval-okay-dynamic-attrs.nix
index ee02ac7e6..f46e26b99 100644
--- a/tests/functional/lang/eval-okay-dynamic-attrs.nix
+++ b/tests/functional/lang/eval-okay-dynamic-attrs.nix
@@ -2,7 +2,8 @@ let
   aString = "a";
 
   bString = "b";
-in {
+in
+{
   hasAttrs = { a.b = null; } ? "${aString}".b;
 
   selectAttrs = { a.b = true; }.a."${bString}";
@@ -11,7 +12,17 @@ in {
 
   binds = { "${aString}"."${bString}c" = true; }.a.bc;
 
-  recBinds = rec { "${bString}" = a; a = true; }.b;
+  recBinds =
+    rec {
+      "${bString}" = a;
+      a = true;
+    }
+    .b;
 
-  multiAttrs = { "${aString}" = true; "${bString}" = false; }.a;
+  multiAttrs =
+    {
+      "${aString}" = true;
+      "${bString}" = false;
+    }
+    .a;
 }
diff --git a/tests/functional/lang/eval-okay-elem.nix b/tests/functional/lang/eval-okay-elem.nix
index 71ea7a4ed..004111dcc 100644
--- a/tests/functional/lang/eval-okay-elem.nix
+++ b/tests/functional/lang/eval-okay-elem.nix
@@ -1,6 +1,11 @@
 with import ./lib.nix;
 
-let xs = range 10 40; in
-
-[ (builtins.elem 23 xs) (builtins.elem 42 xs) (builtins.elemAt xs 20) ]
+let
+  xs = range 10 40;
+in
 
+[
+  (builtins.elem 23 xs)
+  (builtins.elem 42 xs)
+  (builtins.elemAt xs 20)
+]
diff --git a/tests/functional/lang/eval-okay-empty-args.nix b/tests/functional/lang/eval-okay-empty-args.nix
index 78c133afd..9466749f6 100644
--- a/tests/functional/lang/eval-okay-empty-args.nix
+++ b/tests/functional/lang/eval-okay-empty-args.nix
@@ -1 +1,4 @@
-({}: {x,y,}: "${x}${y}") {} {x = "a"; y = "b";}
+({ }: { x, y }: "${x}${y}") { } {
+  x = "a";
+  y = "b";
+}
diff --git a/tests/functional/lang/eval-okay-eq-derivations.nix b/tests/functional/lang/eval-okay-eq-derivations.nix
index d526cb4a2..ac802f433 100644
--- a/tests/functional/lang/eval-okay-eq-derivations.nix
+++ b/tests/functional/lang/eval-okay-eq-derivations.nix
@@ -1,10 +1,40 @@
 let
 
-  drvA1 = derivation { name = "a"; builder = "/foo"; system = "i686-linux"; };
-  drvA2 = derivation { name = "a"; builder = "/foo"; system = "i686-linux"; };
-  drvA3 = derivation { name = "a"; builder = "/foo"; system = "i686-linux"; } // { dummy = 1; };
-  
-  drvC1 = derivation { name = "c"; builder = "/foo"; system = "i686-linux"; };
-  drvC2 = derivation { name = "c"; builder = "/bar"; system = "i686-linux"; };
+  drvA1 = derivation {
+    name = "a";
+    builder = "/foo";
+    system = "i686-linux";
+  };
+  drvA2 = derivation {
+    name = "a";
+    builder = "/foo";
+    system = "i686-linux";
+  };
+  drvA3 =
+    derivation {
+      name = "a";
+      builder = "/foo";
+      system = "i686-linux";
+    }
+    // {
+      dummy = 1;
+    };
 
-in [ (drvA1 == drvA1) (drvA1 == drvA2) (drvA1 == drvA3) (drvC1 == drvC2) ]
+  drvC1 = derivation {
+    name = "c";
+    builder = "/foo";
+    system = "i686-linux";
+  };
+  drvC2 = derivation {
+    name = "c";
+    builder = "/bar";
+    system = "i686-linux";
+  };
+
+in
+[
+  (drvA1 == drvA1)
+  (drvA1 == drvA2)
+  (drvA1 == drvA3)
+  (drvC1 == drvC2)
+]
diff --git a/tests/functional/lang/eval-okay-eq.nix b/tests/functional/lang/eval-okay-eq.nix
index 73d200b38..21cb08790 100644
--- a/tests/functional/lang/eval-okay-eq.nix
+++ b/tests/functional/lang/eval-okay-eq.nix
@@ -1,3 +1,13 @@
-["foobar" (rec {x = 1; y = x;})]
-==
-[("foo" + "bar") ({x = 1; y = 1;})]
+[
+  "foobar"
+  (rec {
+    x = 1;
+    y = x;
+  })
+] == [
+  ("foo" + "bar")
+  ({
+    x = 1;
+    y = 1;
+  })
+]
diff --git a/tests/functional/lang/eval-okay-filter.nix b/tests/functional/lang/eval-okay-filter.nix
index 85109b0d0..ef4e490c0 100644
--- a/tests/functional/lang/eval-okay-filter.nix
+++ b/tests/functional/lang/eval-okay-filter.nix
@@ -1,5 +1,8 @@
 with import ./lib.nix;
 
-builtins.filter
-  (x: x / 2 * 2 == x)
-  (builtins.concatLists [ (range 0 10) (range 100 110) ])
+builtins.filter (x: x / 2 * 2 == x) (
+  builtins.concatLists [
+    (range 0 10)
+    (range 100 110)
+  ]
+)
diff --git a/tests/functional/lang/eval-okay-flake-ref-to-string.nix b/tests/functional/lang/eval-okay-flake-ref-to-string.nix
index dbb4e5b2a..f477ba52c 100644
--- a/tests/functional/lang/eval-okay-flake-ref-to-string.nix
+++ b/tests/functional/lang/eval-okay-flake-ref-to-string.nix
@@ -1,7 +1,7 @@
 builtins.flakeRefToString {
-  type  = "github";
+  type = "github";
   owner = "NixOS";
-  repo  = "nixpkgs";
-  ref   = "23.05";
-  dir   = "lib";
+  repo = "nixpkgs";
+  ref = "23.05";
+  dir = "lib";
 }
diff --git a/tests/functional/lang/eval-okay-flatten.nix b/tests/functional/lang/eval-okay-flatten.nix
index fe911e968..ade74c8e8 100644
--- a/tests/functional/lang/eval-okay-flatten.nix
+++ b/tests/functional/lang/eval-okay-flatten.nix
@@ -2,7 +2,19 @@ with import ./lib.nix;
 
 let {
 
-  l = ["1" "2" ["3" ["4"] ["5" "6"]] "7"];
+  l = [
+    "1"
+    "2"
+    [
+      "3"
+      [ "4" ]
+      [
+        "5"
+        "6"
+      ]
+    ]
+    "7"
+  ];
 
   body = concat (flatten l);
 }
diff --git a/tests/functional/lang/eval-okay-floor-ceil.nix b/tests/functional/lang/eval-okay-floor-ceil.nix
index d76a0d86e..06f1a13d2 100644
--- a/tests/functional/lang/eval-okay-floor-ceil.nix
+++ b/tests/functional/lang/eval-okay-floor-ceil.nix
@@ -6,4 +6,11 @@ let
   n3 = builtins.floor 23;
   n4 = builtins.ceil 23;
 in
-  builtins.concatStringsSep ";" (map toString [ n1 n2 n3 n4 ])
+builtins.concatStringsSep ";" (
+  map toString [
+    n1
+    n2
+    n3
+    n4
+  ]
+)
diff --git a/tests/functional/lang/eval-okay-foldlStrict-lazy-elements.nix b/tests/functional/lang/eval-okay-foldlStrict-lazy-elements.nix
index c666e07f3..49751c759 100644
--- a/tests/functional/lang/eval-okay-foldlStrict-lazy-elements.nix
+++ b/tests/functional/lang/eval-okay-foldlStrict-lazy-elements.nix
@@ -1,9 +1,6 @@
 # Tests that the rhs argument of op is not forced unconditionally
 let
-  lst = builtins.foldl'
-    (acc: x: acc ++ [ x ])
-    [ ]
-    [ 42 (throw "this shouldn't be evaluated") ];
+  lst = builtins.foldl' (acc: x: acc ++ [ x ]) [ ] [ 42 (throw "this shouldn't be evaluated") ];
 in
 
 builtins.head lst
diff --git a/tests/functional/lang/eval-okay-foldlStrict-lazy-initial-accumulator.nix b/tests/functional/lang/eval-okay-foldlStrict-lazy-initial-accumulator.nix
index abcd5366a..9cf0ef32c 100644
--- a/tests/functional/lang/eval-okay-foldlStrict-lazy-initial-accumulator.nix
+++ b/tests/functional/lang/eval-okay-foldlStrict-lazy-initial-accumulator.nix
@@ -1,6 +1,6 @@
 # Checks that the nul value for the accumulator is not forced unconditionally.
 # Some languages provide a foldl' that is strict in this argument, but Nix does not.
-builtins.foldl'
-  (_: x: x)
-  (throw "This is never forced")
-  [ "but the results of applying op are" 42 ]
+builtins.foldl' (_: x: x) (throw "This is never forced") [
+  "but the results of applying op are"
+  42
+]
diff --git a/tests/functional/lang/eval-okay-fromjson-escapes.nix b/tests/functional/lang/eval-okay-fromjson-escapes.nix
index f00713507..6330e9c86 100644
--- a/tests/functional/lang/eval-okay-fromjson-escapes.nix
+++ b/tests/functional/lang/eval-okay-fromjson-escapes.nix
@@ -1,3 +1,4 @@
 # This string contains all supported escapes in a JSON string, per json.org
 # \b and \f are not supported by Nix
-builtins.fromJSON ''"quote \" reverse solidus \\ solidus \/ backspace \b formfeed \f newline \n carriage return \r horizontal tab \t 1 char unicode encoded backspace \u0008 1 char unicode encoded e with accent \u00e9 2 char unicode encoded s with caron \u0161 3 char unicode encoded rightwards arrow \u2192"''
+builtins.fromJSON
+  ''"quote \" reverse solidus \\ solidus \/ backspace \b formfeed \f newline \n carriage return \r horizontal tab \t 1 char unicode encoded backspace \u0008 1 char unicode encoded e with accent \u00e9 2 char unicode encoded s with caron \u0161 3 char unicode encoded rightwards arrow \u2192"''
diff --git a/tests/functional/lang/eval-okay-fromjson.nix b/tests/functional/lang/eval-okay-fromjson.nix
index 4c526b9ae..0e8a2351f 100644
--- a/tests/functional/lang/eval-okay-fromjson.nix
+++ b/tests/functional/lang/eval-okay-fromjson.nix
@@ -1,41 +1,55 @@
-builtins.fromJSON
-  ''
-    {
-      "Video": {
-          "Title":  "The Penguin Chronicles",
-          "Width":  1920,
-          "Height": 1080,
-          "EmbeddedData": [3.14159, 23493,null, true  ,false, -10],
-          "Thumb": {
-              "Url":    "http://www.example.com/video/5678931",
-              "Width":  200,
-              "Height": 250
-          },
-          "Animated" : false,
-          "IDs": [116, 943, 234, 38793, true  ,false,null, -100],
-          "Escapes": "\"\\\/\t\n\r\t",
-          "Subtitle" : false,
-          "Latitude":  37.7668,
-          "Longitude": -122.3959
-        }
-    }
-  ''
-==
-  { Video =
-    { Title = "The Penguin Chronicles";
-      Width = 1920;
-      Height = 1080;
-      EmbeddedData = [ 3.14159 23493 null true false (0-10) ];
-      Thumb =
-        { Url = "http://www.example.com/video/5678931";
-          Width = 200;
-          Height = 250;
-        };
-      Animated = false;
-      IDs = [ 116 943 234 38793 true false null (0-100) ];
-      Escapes = "\"\\\/\t\n\r\t";  # supported in JSON but not Nix: \b\f
-      Subtitle = false;
-      Latitude = 37.7668;
-      Longitude = -122.3959;
-    };
+builtins.fromJSON ''
+  {
+    "Video": {
+        "Title":  "The Penguin Chronicles",
+        "Width":  1920,
+        "Height": 1080,
+        "EmbeddedData": [3.14159, 23493,null, true  ,false, -10],
+        "Thumb": {
+            "Url":    "http://www.example.com/video/5678931",
+            "Width":  200,
+            "Height": 250
+        },
+        "Animated" : false,
+        "IDs": [116, 943, 234, 38793, true  ,false,null, -100],
+        "Escapes": "\"\\\/\t\n\r\t",
+        "Subtitle" : false,
+        "Latitude":  37.7668,
+        "Longitude": -122.3959
+      }
   }
+'' == {
+  Video = {
+    Title = "The Penguin Chronicles";
+    Width = 1920;
+    Height = 1080;
+    EmbeddedData = [
+      3.14159
+      23493
+      null
+      true
+      false
+      (0 - 10)
+    ];
+    Thumb = {
+      Url = "http://www.example.com/video/5678931";
+      Width = 200;
+      Height = 250;
+    };
+    Animated = false;
+    IDs = [
+      116
+      943
+      234
+      38793
+      true
+      false
+      null
+      (0 - 100)
+    ];
+    Escapes = "\"\\\/\t\n\r\t"; # supported in JSON but not Nix: \b\f
+    Subtitle = false;
+    Latitude = 37.7668;
+    Longitude = -122.3959;
+  };
+}
diff --git a/tests/functional/lang/eval-okay-functionargs.nix b/tests/functional/lang/eval-okay-functionargs.nix
index 68dca62ee..7c11f19c2 100644
--- a/tests/functional/lang/eval-okay-functionargs.nix
+++ b/tests/functional/lang/eval-okay-functionargs.nix
@@ -1,29 +1,74 @@
 let
 
-  stdenvFun = { }: { name = "stdenv"; };
-  stdenv2Fun = { }: { name = "stdenv2"; };
-  fetchurlFun = { stdenv }: assert stdenv.name == "stdenv"; { name = "fetchurl"; };
-  atermFun = { stdenv, fetchurl }: { name = "aterm-${stdenv.name}"; };
-  aterm2Fun = { stdenv, fetchurl }: { name = "aterm2-${stdenv.name}"; };
-  nixFun = { stdenv, fetchurl, aterm }: { name = "nix-${stdenv.name}-${aterm.name}"; };
-  
+  stdenvFun =
+    { }:
+    {
+      name = "stdenv";
+    };
+  stdenv2Fun =
+    { }:
+    {
+      name = "stdenv2";
+    };
+  fetchurlFun =
+    { stdenv }:
+    assert stdenv.name == "stdenv";
+    {
+      name = "fetchurl";
+    };
+  atermFun =
+    { stdenv, fetchurl }:
+    {
+      name = "aterm-${stdenv.name}";
+    };
+  aterm2Fun =
+    { stdenv, fetchurl }:
+    {
+      name = "aterm2-${stdenv.name}";
+    };
+  nixFun =
+    {
+      stdenv,
+      fetchurl,
+      aterm,
+    }:
+    {
+      name = "nix-${stdenv.name}-${aterm.name}";
+    };
+
   mplayerFun =
-    { stdenv, fetchurl, enableX11 ? false, xorg ? null, enableFoo ? true, foo ? null  }:
+    {
+      stdenv,
+      fetchurl,
+      enableX11 ? false,
+      xorg ? null,
+      enableFoo ? true,
+      foo ? null,
+    }:
     assert stdenv.name == "stdenv2";
     assert enableX11 -> xorg.libXv.name == "libXv";
     assert enableFoo -> foo != null;
-    { name = "mplayer-${stdenv.name}.${xorg.libXv.name}-${xorg.libX11.name}"; };
+    {
+      name = "mplayer-${stdenv.name}.${xorg.libXv.name}-${xorg.libX11.name}";
+    };
 
-  makeOverridable = f: origArgs: f origArgs //
-    { override = newArgs:
+  makeOverridable =
+    f: origArgs:
+    f origArgs
+    // {
+      override =
+        newArgs:
         makeOverridable f (origArgs // (if builtins.isFunction newArgs then newArgs origArgs else newArgs));
     };
-    
-  callPackage_ = pkgs: f: args:
+
+  callPackage_ =
+    pkgs: f: args:
     makeOverridable f ((builtins.intersectAttrs (builtins.functionArgs f) pkgs) // args);
 
   allPackages =
-    { overrides ? (pkgs: pkgsPrev: { }) }:
+    {
+      overrides ? (pkgs: pkgsPrev: { }),
+    }:
     let
       callPackage = callPackage_ pkgs;
       pkgs = pkgsStd // (overrides pkgs pkgsStd);
@@ -34,18 +79,40 @@ let
         fetchurl = callPackage fetchurlFun { };
         aterm = callPackage atermFun { };
         xorg = callPackage xorgFun { };
-        mplayer = callPackage mplayerFun { stdenv = pkgs.stdenv2; enableFoo = false; };
+        mplayer = callPackage mplayerFun {
+          stdenv = pkgs.stdenv2;
+          enableFoo = false;
+        };
         nix = callPackage nixFun { };
       };
-    in pkgs;
+    in
+    pkgs;
+
+  libX11Fun =
+    { stdenv, fetchurl }:
+    {
+      name = "libX11";
+    };
+  libX11_2Fun =
+    { stdenv, fetchurl }:
+    {
+      name = "libX11_2";
+    };
+  libXvFun =
+    {
+      stdenv,
+      fetchurl,
+      libX11,
+    }:
+    {
+      name = "libXv";
+    };
 
-  libX11Fun = { stdenv, fetchurl }: { name = "libX11"; };
-  libX11_2Fun = { stdenv, fetchurl }: { name = "libX11_2"; };
-  libXvFun = { stdenv, fetchurl, libX11 }: { name = "libXv"; };
-  
   xorgFun =
     { pkgs }:
-    let callPackage = callPackage_ (pkgs // pkgs.xorg); in
+    let
+      callPackage = callPackage_ (pkgs // pkgs.xorg);
+    in
     {
       libX11 = callPackage libX11Fun { };
       libXv = callPackage libXvFun { };
@@ -56,25 +123,28 @@ in
 let
 
   pkgs = allPackages { };
-  
+
   pkgs2 = allPackages {
     overrides = pkgs: pkgsPrev: {
       stdenv = pkgs.stdenv2;
       nix = pkgsPrev.nix.override { aterm = aterm2Fun { inherit (pkgs) stdenv fetchurl; }; };
-      xorg = pkgsPrev.xorg // { libX11 = libX11_2Fun { inherit (pkgs) stdenv fetchurl; }; };
+      xorg = pkgsPrev.xorg // {
+        libX11 = libX11_2Fun { inherit (pkgs) stdenv fetchurl; };
+      };
     };
   };
-  
+
 in
 
-  [ pkgs.stdenv.name
-    pkgs.fetchurl.name
-    pkgs.aterm.name
-    pkgs2.aterm.name
-    pkgs.xorg.libX11.name
-    pkgs.xorg.libXv.name
-    pkgs.mplayer.name
-    pkgs2.mplayer.name
-    pkgs.nix.name
-    pkgs2.nix.name
-  ]
+[
+  pkgs.stdenv.name
+  pkgs.fetchurl.name
+  pkgs.aterm.name
+  pkgs2.aterm.name
+  pkgs.xorg.libX11.name
+  pkgs.xorg.libXv.name
+  pkgs.mplayer.name
+  pkgs2.mplayer.name
+  pkgs.nix.name
+  pkgs2.nix.name
+]
diff --git a/tests/functional/lang/eval-okay-getattrpos-functionargs.nix b/tests/functional/lang/eval-okay-getattrpos-functionargs.nix
index 11d6bb0e3..9692911cf 100644
--- a/tests/functional/lang/eval-okay-getattrpos-functionargs.nix
+++ b/tests/functional/lang/eval-okay-getattrpos-functionargs.nix
@@ -1,4 +1,8 @@
 let
-  fun = { foo }: {};
+  fun = { foo }: { };
   pos = builtins.unsafeGetAttrPos "foo" (builtins.functionArgs fun);
-in { inherit (pos) column line; file = baseNameOf pos.file; }
+in
+{
+  inherit (pos) column line;
+  file = baseNameOf pos.file;
+}
diff --git a/tests/functional/lang/eval-okay-getattrpos.nix b/tests/functional/lang/eval-okay-getattrpos.nix
index ca6b07961..25bc57444 100644
--- a/tests/functional/lang/eval-okay-getattrpos.nix
+++ b/tests/functional/lang/eval-okay-getattrpos.nix
@@ -3,4 +3,8 @@ let
     foo = "bar";
   };
   pos = builtins.unsafeGetAttrPos "foo" as;
-in { inherit (pos) column line; file = baseNameOf pos.file; }
+in
+{
+  inherit (pos) column line;
+  file = baseNameOf pos.file;
+}
diff --git a/tests/functional/lang/eval-okay-groupBy.nix b/tests/functional/lang/eval-okay-groupBy.nix
index 862d89dbd..f4de5444a 100644
--- a/tests/functional/lang/eval-okay-groupBy.nix
+++ b/tests/functional/lang/eval-okay-groupBy.nix
@@ -1,5 +1,5 @@
 with import ./lib.nix;
 
-builtins.groupBy (n:
-  builtins.substring 0 1 (builtins.hashString "sha256" (toString n))
-) (range 0 31)
+builtins.groupBy (n: builtins.substring 0 1 (builtins.hashString "sha256" (toString n))) (
+  range 0 31
+)
diff --git a/tests/functional/lang/eval-okay-hashfile.nix b/tests/functional/lang/eval-okay-hashfile.nix
index aff5a1856..aeaf09f43 100644
--- a/tests/functional/lang/eval-okay-hashfile.nix
+++ b/tests/functional/lang/eval-okay-hashfile.nix
@@ -1,4 +1,14 @@
 let
-  paths = [ ./data ./binary-data ];
+  paths = [
+    ./data
+    ./binary-data
+  ];
 in
-  builtins.concatLists (map (hash: map (builtins.hashFile hash) paths) ["md5" "sha1" "sha256" "sha512"])
+builtins.concatLists (
+  map (hash: map (builtins.hashFile hash) paths) [
+    "md5"
+    "sha1"
+    "sha256"
+    "sha512"
+  ]
+)
diff --git a/tests/functional/lang/eval-okay-hashstring.nix b/tests/functional/lang/eval-okay-hashstring.nix
index b0f62b245..c760b0043 100644
--- a/tests/functional/lang/eval-okay-hashstring.nix
+++ b/tests/functional/lang/eval-okay-hashstring.nix
@@ -1,4 +1,15 @@
 let
-  strings = [ "" "text 1" "text 2" ];
+  strings = [
+    ""
+    "text 1"
+    "text 2"
+  ];
 in
-  builtins.concatLists (map (hash: map (builtins.hashString hash) strings) ["md5" "sha1" "sha256" "sha512"])
+builtins.concatLists (
+  map (hash: map (builtins.hashString hash) strings) [
+    "md5"
+    "sha1"
+    "sha256"
+    "sha512"
+  ]
+)
diff --git a/tests/functional/lang/eval-okay-if.nix b/tests/functional/lang/eval-okay-if.nix
index 23e4c74d5..66b9d15b8 100644
--- a/tests/functional/lang/eval-okay-if.nix
+++ b/tests/functional/lang/eval-okay-if.nix
@@ -1 +1,6 @@
-if "foo" != "f" + "oo" then 1 else if false then 2 else 3
+if "foo" != "f" + "oo" then
+  1
+else if false then
+  2
+else
+  3
diff --git a/tests/functional/lang/eval-okay-import.nix b/tests/functional/lang/eval-okay-import.nix
index 0b18d9413..484dccac0 100644
--- a/tests/functional/lang/eval-okay-import.nix
+++ b/tests/functional/lang/eval-okay-import.nix
@@ -8,4 +8,5 @@ let
     builtins = builtins // overrides;
   } // import ./lib.nix;
 
-in scopedImport overrides ./imported.nix
+in
+scopedImport overrides ./imported.nix
diff --git a/tests/functional/lang/eval-okay-inherit-attr-pos.nix b/tests/functional/lang/eval-okay-inherit-attr-pos.nix
index 017ab1d36..c162d1196 100644
--- a/tests/functional/lang/eval-okay-inherit-attr-pos.nix
+++ b/tests/functional/lang/eval-okay-inherit-attr-pos.nix
@@ -4,9 +4,9 @@ let
   y = { inherit d x; };
   z = { inherit (y) d x; };
 in
-  [
-    (builtins.unsafeGetAttrPos "d" y)
-    (builtins.unsafeGetAttrPos "x" y)
-    (builtins.unsafeGetAttrPos "d" z)
-    (builtins.unsafeGetAttrPos "x" z)
-  ]
+[
+  (builtins.unsafeGetAttrPos "d" y)
+  (builtins.unsafeGetAttrPos "x" y)
+  (builtins.unsafeGetAttrPos "d" z)
+  (builtins.unsafeGetAttrPos "x" z)
+]
diff --git a/tests/functional/lang/eval-okay-inherit-from.nix b/tests/functional/lang/eval-okay-inherit-from.nix
index b72a1c639..1a0980aaf 100644
--- a/tests/functional/lang/eval-okay-inherit-from.nix
+++ b/tests/functional/lang/eval-okay-inherit-from.nix
@@ -1,5 +1,12 @@
 let
-  inherit (builtins.trace "used" { a = 1; b = 2; }) a b;
+  inherit
+    (builtins.trace "used" {
+      a = 1;
+      b = 2;
+    })
+    a
+    b
+    ;
   x.c = 3;
   y.d = 4;
 
@@ -13,4 +20,14 @@ let
     };
   };
 in
-  [ a b rec { x.c = []; inherit (x) c; inherit (y) d; __overrides.y.d = []; } merged ]
+[
+  a
+  b
+  rec {
+    x.c = [ ];
+    inherit (x) c;
+    inherit (y) d;
+    __overrides.y.d = [ ];
+  }
+  merged
+]
diff --git a/tests/functional/lang/eval-okay-intersectAttrs.nix b/tests/functional/lang/eval-okay-intersectAttrs.nix
index 39d49938c..bf4d58a99 100644
--- a/tests/functional/lang/eval-okay-intersectAttrs.nix
+++ b/tests/functional/lang/eval-okay-intersectAttrs.nix
@@ -1,6 +1,6 @@
 let
-  alphabet =
-  { a = "a";
+  alphabet = {
+    a = "a";
     b = "b";
     c = "c";
     d = "d";
@@ -28,23 +28,46 @@ let
     z = "z";
   };
   foo = {
-    inherit (alphabet) f o b a r z q u x;
+    inherit (alphabet)
+      f
+      o
+      b
+      a
+      r
+      z
+      q
+      u
+      x
+      ;
     aa = throw "aa";
   };
   alphabetFail = builtins.mapAttrs throw alphabet;
 in
-[ (builtins.intersectAttrs { a = abort "l1"; } { b = abort "r1"; })
+[
+  (builtins.intersectAttrs { a = abort "l1"; } { b = abort "r1"; })
   (builtins.intersectAttrs { a = abort "l2"; } { a = 1; })
   (builtins.intersectAttrs alphabetFail { a = 1; })
-  (builtins.intersectAttrs  { a = abort "laa"; } alphabet)
+  (builtins.intersectAttrs { a = abort "laa"; } alphabet)
   (builtins.intersectAttrs alphabetFail { m = 1; })
-  (builtins.intersectAttrs  { m = abort "lam"; } alphabet)
+  (builtins.intersectAttrs { m = abort "lam"; } alphabet)
   (builtins.intersectAttrs alphabetFail { n = 1; })
-  (builtins.intersectAttrs  { n = abort "lan"; } alphabet)
-  (builtins.intersectAttrs alphabetFail { n = 1; p = 2; })
-  (builtins.intersectAttrs  { n = abort "lan2"; p = abort "lap"; } alphabet)
-  (builtins.intersectAttrs alphabetFail { n = 1; p = 2; })
-  (builtins.intersectAttrs  { n = abort "lan2"; p = abort "lap"; } alphabet)
+  (builtins.intersectAttrs { n = abort "lan"; } alphabet)
+  (builtins.intersectAttrs alphabetFail {
+    n = 1;
+    p = 2;
+  })
+  (builtins.intersectAttrs {
+    n = abort "lan2";
+    p = abort "lap";
+  } alphabet)
+  (builtins.intersectAttrs alphabetFail {
+    n = 1;
+    p = 2;
+  })
+  (builtins.intersectAttrs {
+    n = abort "lan2";
+    p = abort "lap";
+  } alphabet)
   (builtins.intersectAttrs alphabetFail alphabet)
   (builtins.intersectAttrs alphabet foo == builtins.intersectAttrs foo alphabet)
 ]
diff --git a/tests/functional/lang/eval-okay-list.nix b/tests/functional/lang/eval-okay-list.nix
index d433bcf90..b5045a753 100644
--- a/tests/functional/lang/eval-okay-list.nix
+++ b/tests/functional/lang/eval-okay-list.nix
@@ -2,6 +2,11 @@ with import ./lib.nix;
 
 let {
 
-  body = concat ["foo" "bar" "bla" "test"];
-    
-}
\ No newline at end of file
+  body = concat [
+    "foo"
+    "bar"
+    "bla"
+    "test"
+  ];
+
+}
diff --git a/tests/functional/lang/eval-okay-listtoattrs.nix b/tests/functional/lang/eval-okay-listtoattrs.nix
index 4186e029b..1de9d6d62 100644
--- a/tests/functional/lang/eval-okay-listtoattrs.nix
+++ b/tests/functional/lang/eval-okay-listtoattrs.nix
@@ -1,11 +1,24 @@
 # this test shows how to use listToAttrs and that evaluation is still lazy (throw isn't called)
 with import ./lib.nix;
 
-let 
-  asi = name: value : { inherit name value; };
-  list = [ ( asi "a" "A" ) ( asi "b" "B" ) ];
+let
+  asi = name: value: { inherit name value; };
+  list = [
+    (asi "a" "A")
+    (asi "b" "B")
+  ];
   a = builtins.listToAttrs list;
-  b = builtins.listToAttrs ( list ++ list );
-  r = builtins.listToAttrs [ (asi "result" [ a b ]) ( asi "throw" (throw "this should not be thrown")) ];
-  x = builtins.listToAttrs [ (asi "foo" "bar") (asi "foo" "bla") ];
-in concat (map (x: x.a) r.result) + x.foo
+  b = builtins.listToAttrs (list ++ list);
+  r = builtins.listToAttrs [
+    (asi "result" [
+      a
+      b
+    ])
+    (asi "throw" (throw "this should not be thrown"))
+  ];
+  x = builtins.listToAttrs [
+    (asi "foo" "bar")
+    (asi "foo" "bla")
+  ];
+in
+concat (map (x: x.a) r.result) + x.foo
diff --git a/tests/functional/lang/eval-okay-logic.nix b/tests/functional/lang/eval-okay-logic.nix
index fbb127944..55cd2fc00 100644
--- a/tests/functional/lang/eval-okay-logic.nix
+++ b/tests/functional/lang/eval-okay-logic.nix
@@ -1 +1,2 @@
-assert !false && (true || false) -> true; 1
+assert !false && (true || false) -> true;
+1
diff --git a/tests/functional/lang/eval-okay-map.nix b/tests/functional/lang/eval-okay-map.nix
index a76c1d811..22059f37a 100644
--- a/tests/functional/lang/eval-okay-map.nix
+++ b/tests/functional/lang/eval-okay-map.nix
@@ -1,3 +1,9 @@
 with import ./lib.nix;
 
-concat (map (x: x + "bar") [ "foo" "bla" "xyzzy" ])
\ No newline at end of file
+concat (
+  map (x: x + "bar") [
+    "foo"
+    "bla"
+    "xyzzy"
+  ]
+)
diff --git a/tests/functional/lang/eval-okay-mapattrs.nix b/tests/functional/lang/eval-okay-mapattrs.nix
index f075b6275..c1182d13d 100644
--- a/tests/functional/lang/eval-okay-mapattrs.nix
+++ b/tests/functional/lang/eval-okay-mapattrs.nix
@@ -1,3 +1,6 @@
 with import ./lib.nix;
 
-builtins.mapAttrs (name: value: name + "-" + value) { x = "foo"; y = "bar"; }
+builtins.mapAttrs (name: value: name + "-" + value) {
+  x = "foo";
+  y = "bar";
+}
diff --git a/tests/functional/lang/eval-okay-merge-dynamic-attrs.nix b/tests/functional/lang/eval-okay-merge-dynamic-attrs.nix
index f459a554f..8ee8e503a 100644
--- a/tests/functional/lang/eval-okay-merge-dynamic-attrs.nix
+++ b/tests/functional/lang/eval-okay-merge-dynamic-attrs.nix
@@ -1,9 +1,17 @@
 {
-  set1 = { a = 1; };
-  set1 = { "${"b" + ""}" = 2; };
+  set1 = {
+    a = 1;
+  };
+  set1 = {
+    "${"b" + ""}" = 2;
+  };
 
-  set2 = { "${"b" + ""}" = 2; };
-  set2 = { a = 1; };
+  set2 = {
+    "${"b" + ""}" = 2;
+  };
+  set2 = {
+    a = 1;
+  };
 
   set3.a = 1;
   set3."${"b" + ""}" = 2;
diff --git a/tests/functional/lang/eval-okay-nested-with.nix b/tests/functional/lang/eval-okay-nested-with.nix
index ba9d79aa7..ee069eaa1 100644
--- a/tests/functional/lang/eval-okay-nested-with.nix
+++ b/tests/functional/lang/eval-okay-nested-with.nix
@@ -1,3 +1 @@
-with { x = 1; };
-with { x = 2; };
-x
+with { x = 1; }; with { x = 2; }; x
diff --git a/tests/functional/lang/eval-okay-new-let.nix b/tests/functional/lang/eval-okay-new-let.nix
index 738123141..1a938ce71 100644
--- a/tests/functional/lang/eval-okay-new-let.nix
+++ b/tests/functional/lang/eval-okay-new-let.nix
@@ -1,14 +1,16 @@
 let
 
-  f = z: 
+  f =
+    z:
 
     let
       x = "foo";
       y = "bar";
       body = 1; # compat test
     in
-      z + x + y;
+    z + x + y;
 
   arg = "xyzzy";
 
-in f arg
+in
+f arg
diff --git a/tests/functional/lang/eval-okay-null-dynamic-attrs.nix b/tests/functional/lang/eval-okay-null-dynamic-attrs.nix
index b060c0bc9..76286b622 100644
--- a/tests/functional/lang/eval-okay-null-dynamic-attrs.nix
+++ b/tests/functional/lang/eval-okay-null-dynamic-attrs.nix
@@ -1 +1 @@
-{ ${null} = true; } == {}
+{ ${null} = true; } == { }
diff --git a/tests/functional/lang/eval-okay-overrides.nix b/tests/functional/lang/eval-okay-overrides.nix
index 719bdc9c0..1c0d5d7c2 100644
--- a/tests/functional/lang/eval-okay-overrides.nix
+++ b/tests/functional/lang/eval-okay-overrides.nix
@@ -1,8 +1,12 @@
 let
 
-  overrides = { a = 2; b = 3; };
+  overrides = {
+    a = 2;
+    b = 3;
+  };
 
-in (rec {
+in
+(rec {
   __overrides = overrides;
   x = a;
   a = 1;
diff --git a/tests/functional/lang/eval-okay-parse-flake-ref.nix b/tests/functional/lang/eval-okay-parse-flake-ref.nix
index db4ed2742..404c5df08 100644
--- a/tests/functional/lang/eval-okay-parse-flake-ref.nix
+++ b/tests/functional/lang/eval-okay-parse-flake-ref.nix
@@ -1 +1 @@
-  builtins.parseFlakeRef "github:NixOS/nixpkgs/23.05?dir=lib"
+builtins.parseFlakeRef "github:NixOS/nixpkgs/23.05?dir=lib"
diff --git a/tests/functional/lang/eval-okay-partition.nix b/tests/functional/lang/eval-okay-partition.nix
index 846d2ce49..b9566edf9 100644
--- a/tests/functional/lang/eval-okay-partition.nix
+++ b/tests/functional/lang/eval-okay-partition.nix
@@ -1,5 +1,8 @@
 with import ./lib.nix;
 
-builtins.partition
-  (x: x / 2 * 2 == x)
-  (builtins.concatLists [ (range 0 10) (range 100 110) ])
+builtins.partition (x: x / 2 * 2 == x) (
+  builtins.concatLists [
+    (range 0 10)
+    (range 100 110)
+  ]
+)
diff --git a/tests/functional/lang/eval-okay-path.nix b/tests/functional/lang/eval-okay-path.nix
index 599b33541..b8b48aae1 100644
--- a/tests/functional/lang/eval-okay-path.nix
+++ b/tests/functional/lang/eval-okay-path.nix
@@ -1,15 +1,15 @@
 [
-  (builtins.path
-    { path = ./.;
-      filter = path: _: baseNameOf path == "data";
-      recursive = true;
-      sha256 = "1yhm3gwvg5a41yylymgblsclk95fs6jy72w0wv925mmidlhcq4sw";
-      name = "output";
-    })
-  (builtins.path
-    { path = ./data;
-      recursive = false;
-      sha256 = "0k4lwj58f2w5yh92ilrwy9917pycipbrdrr13vbb3yd02j09vfxm";
-      name = "output";
-    })
+  (builtins.path {
+    path = ./.;
+    filter = path: _: baseNameOf path == "data";
+    recursive = true;
+    sha256 = "1yhm3gwvg5a41yylymgblsclk95fs6jy72w0wv925mmidlhcq4sw";
+    name = "output";
+  })
+  (builtins.path {
+    path = ./data;
+    recursive = false;
+    sha256 = "0k4lwj58f2w5yh92ilrwy9917pycipbrdrr13vbb3yd02j09vfxm";
+    name = "output";
+  })
 ]
diff --git a/tests/functional/lang/eval-okay-patterns.nix b/tests/functional/lang/eval-okay-patterns.nix
index 96fd25a01..b92b232d2 100644
--- a/tests/functional/lang/eval-okay-patterns.nix
+++ b/tests/functional/lang/eval-okay-patterns.nix
@@ -1,16 +1,59 @@
 let
 
-  f = args@{x, y, z}: x + args.y + z;
+  f =
+    args@{
+      x,
+      y,
+      z,
+    }:
+    x + args.y + z;
 
-  g = {x, y, z}@args: f args;
+  g =
+    {
+      x,
+      y,
+      z,
+    }@args:
+    f args;
 
-  h = {x ? "d", y ? x, z ? args.x}@args: x + y + z;
+  h =
+    {
+      x ? "d",
+      y ? x,
+      z ? args.x,
+    }@args:
+    x + y + z;
 
-  j = {x, y, z, ...}: x + y + z;
+  j =
+    {
+      x,
+      y,
+      z,
+      ...
+    }:
+    x + y + z;
 
 in
-  f {x = "a"; y = "b"; z = "c";} +
-  g {x = "x"; y = "y"; z = "z";} +
-  h {x = "D";} +
-  h {x = "D"; y = "E"; z = "F";} +
-  j {x = "i"; y = "j"; z = "k"; bla = "bla"; foo = "bar";}
+f {
+  x = "a";
+  y = "b";
+  z = "c";
+}
++ g {
+  x = "x";
+  y = "y";
+  z = "z";
+}
++ h { x = "D"; }
++ h {
+  x = "D";
+  y = "E";
+  z = "F";
+}
++ j {
+  x = "i";
+  y = "j";
+  z = "k";
+  bla = "bla";
+  foo = "bar";
+}
diff --git a/tests/functional/lang/eval-okay-print.nix b/tests/functional/lang/eval-okay-print.nix
index d36ba4da3..1ad465602 100644
--- a/tests/functional/lang/eval-okay-print.nix
+++ b/tests/functional/lang/eval-okay-print.nix
@@ -1 +1,15 @@
-with builtins; trace [(1+1)] [ null toString (deepSeq "x") (a: a) (let x=[x]; in x) ]
+with builtins;
+trace
+  [ (1 + 1) ]
+  [
+    null
+    toString
+    (deepSeq "x")
+    (a: a)
+    (
+      let
+        x = [ x ];
+      in
+      x
+    )
+  ]
diff --git a/tests/functional/lang/eval-okay-readFileType.nix b/tests/functional/lang/eval-okay-readFileType.nix
index 174fb6c3a..79beb9a6e 100644
--- a/tests/functional/lang/eval-okay-readFileType.nix
+++ b/tests/functional/lang/eval-okay-readFileType.nix
@@ -1,6 +1,6 @@
 {
-  bar    = builtins.readFileType ./readDir/bar;
-  foo    = builtins.readFileType ./readDir/foo;
+  bar = builtins.readFileType ./readDir/bar;
+  foo = builtins.readFileType ./readDir/foo;
   linked = builtins.readFileType ./readDir/linked;
-  ldir   = builtins.readFileType ./readDir/ldir;
+  ldir = builtins.readFileType ./readDir/ldir;
 }
diff --git a/tests/functional/lang/eval-okay-redefine-builtin.nix b/tests/functional/lang/eval-okay-redefine-builtin.nix
index df9fc3f37..ec95ffa93 100644
--- a/tests/functional/lang/eval-okay-redefine-builtin.nix
+++ b/tests/functional/lang/eval-okay-redefine-builtin.nix
@@ -1,3 +1,4 @@
 let
   throw = abort "Error!";
-in (builtins.tryEval <foobaz>).success
+in
+(builtins.tryEval <foobaz>).success
diff --git a/tests/functional/lang/eval-okay-regex-match.nix b/tests/functional/lang/eval-okay-regex-match.nix
index 273e25907..54b995996 100644
--- a/tests/functional/lang/eval-okay-regex-match.nix
+++ b/tests/functional/lang/eval-okay-regex-match.nix
@@ -8,22 +8,34 @@ let
 
 in
 
-assert  matches "foobar" "foobar";
-assert  matches "fo*" "f";
+assert matches "foobar" "foobar";
+assert matches "fo*" "f";
 assert !matches "fo+" "f";
-assert  matches "fo*" "fo";
-assert  matches "fo*" "foo";
-assert  matches "fo+" "foo";
-assert  matches "fo{1,2}" "foo";
+assert matches "fo*" "fo";
+assert matches "fo*" "foo";
+assert matches "fo+" "foo";
+assert matches "fo{1,2}" "foo";
 assert !matches "fo{1,2}" "fooo";
 assert !matches "fo*" "foobar";
-assert  matches "[[:space:]]+([^[:space:]]+)[[:space:]]+" "  foo   ";
+assert matches "[[:space:]]+([^[:space:]]+)[[:space:]]+" "  foo   ";
 assert !matches "[[:space:]]+([[:upper:]]+)[[:space:]]+" "  foo   ";
 
 assert match "(.*)\\.nix" "foobar.nix" == [ "foobar" ];
 assert match "[[:space:]]+([[:upper:]]+)[[:space:]]+" "  FOO   " == [ "FOO" ];
 
-assert splitFN "/path/to/foobar.nix" == [ "/path/to/" "/path/to" "foobar" "nix" ];
-assert splitFN "foobar.cc" == [ null null "foobar" "cc" ];
+assert
+  splitFN "/path/to/foobar.nix" == [
+    "/path/to/"
+    "/path/to"
+    "foobar"
+    "nix"
+  ];
+assert
+  splitFN "foobar.cc" == [
+    null
+    null
+    "foobar"
+    "cc"
+  ];
 
 true
diff --git a/tests/functional/lang/eval-okay-regex-split.nix b/tests/functional/lang/eval-okay-regex-split.nix
index 0073e0577..8ab3e60cb 100644
--- a/tests/functional/lang/eval-okay-regex-split.nix
+++ b/tests/functional/lang/eval-okay-regex-split.nix
@@ -1,48 +1,197 @@
 with builtins;
 
 # Non capturing regex returns empty lists
-assert  split "foobar" "foobar"  == ["" [] ""];
-assert  split "fo*" "f"          == ["" [] ""];
-assert  split "fo+" "f"          == ["f"];
-assert  split "fo*" "fo"         == ["" [] ""];
-assert  split "fo*" "foo"        == ["" [] ""];
-assert  split "fo+" "foo"        == ["" [] ""];
-assert  split "fo{1,2}" "foo"    == ["" [] ""];
-assert  split "fo{1,2}" "fooo"   == ["" [] "o"];
-assert  split "fo*" "foobar"     == ["" [] "bar"];
+assert
+  split "foobar" "foobar" == [
+    ""
+    [ ]
+    ""
+  ];
+assert
+  split "fo*" "f" == [
+    ""
+    [ ]
+    ""
+  ];
+assert split "fo+" "f" == [ "f" ];
+assert
+  split "fo*" "fo" == [
+    ""
+    [ ]
+    ""
+  ];
+assert
+  split "fo*" "foo" == [
+    ""
+    [ ]
+    ""
+  ];
+assert
+  split "fo+" "foo" == [
+    ""
+    [ ]
+    ""
+  ];
+assert
+  split "fo{1,2}" "foo" == [
+    ""
+    [ ]
+    ""
+  ];
+assert
+  split "fo{1,2}" "fooo" == [
+    ""
+    [ ]
+    "o"
+  ];
+assert
+  split "fo*" "foobar" == [
+    ""
+    [ ]
+    "bar"
+  ];
 
 # Capturing regex returns a list of sub-matches
-assert  split "(fo*)" "f"        == ["" ["f"] ""];
-assert  split "(fo+)" "f"        == ["f"];
-assert  split "(fo*)" "fo"       == ["" ["fo"] ""];
-assert  split "(f)(o*)" "f"      == ["" ["f" ""] ""];
-assert  split "(f)(o*)" "foo"    == ["" ["f" "oo"] ""];
-assert  split "(fo+)" "foo"      == ["" ["foo"] ""];
-assert  split "(fo{1,2})" "foo"  == ["" ["foo"] ""];
-assert  split "(fo{1,2})" "fooo" == ["" ["foo"] "o"];
-assert  split "(fo*)" "foobar"   == ["" ["foo"] "bar"];
+assert
+  split "(fo*)" "f" == [
+    ""
+    [ "f" ]
+    ""
+  ];
+assert split "(fo+)" "f" == [ "f" ];
+assert
+  split "(fo*)" "fo" == [
+    ""
+    [ "fo" ]
+    ""
+  ];
+assert
+  split "(f)(o*)" "f" == [
+    ""
+    [
+      "f"
+      ""
+    ]
+    ""
+  ];
+assert
+  split "(f)(o*)" "foo" == [
+    ""
+    [
+      "f"
+      "oo"
+    ]
+    ""
+  ];
+assert
+  split "(fo+)" "foo" == [
+    ""
+    [ "foo" ]
+    ""
+  ];
+assert
+  split "(fo{1,2})" "foo" == [
+    ""
+    [ "foo" ]
+    ""
+  ];
+assert
+  split "(fo{1,2})" "fooo" == [
+    ""
+    [ "foo" ]
+    "o"
+  ];
+assert
+  split "(fo*)" "foobar" == [
+    ""
+    [ "foo" ]
+    "bar"
+  ];
 
 # Matches are greedy.
-assert  split "(o+)" "oooofoooo" == ["" ["oooo"] "f" ["oooo"] ""];
+assert
+  split "(o+)" "oooofoooo" == [
+    ""
+    [ "oooo" ]
+    "f"
+    [ "oooo" ]
+    ""
+  ];
 
 # Matches multiple times.
-assert  split "(b)" "foobarbaz"  == ["foo" ["b"] "ar" ["b"] "az"];
+assert
+  split "(b)" "foobarbaz" == [
+    "foo"
+    [ "b" ]
+    "ar"
+    [ "b" ]
+    "az"
+  ];
 
 # Split large strings containing newlines. null are inserted when a
 # pattern within the current did not match anything.
-assert  split "[[:space:]]+|([',.!?])" ''
-  Nix Rocks!
-  That's why I use it.
-''  == [
-  "Nix" [ null ] "Rocks" ["!"] "" [ null ]
-  "That" ["'"] "s" [ null ] "why" [ null ] "I" [ null ] "use" [ null ] "it" ["."] "" [ null ]
-  ""
-];
+assert
+  split "[[:space:]]+|([',.!?])" ''
+    Nix Rocks!
+    That's why I use it.
+  '' == [
+    "Nix"
+    [ null ]
+    "Rocks"
+    [ "!" ]
+    ""
+    [ null ]
+    "That"
+    [ "'" ]
+    "s"
+    [ null ]
+    "why"
+    [ null ]
+    "I"
+    [ null ]
+    "use"
+    [ null ]
+    "it"
+    [ "." ]
+    ""
+    [ null ]
+    ""
+  ];
 
 # Documentation examples
-assert  split  "(a)b" "abc"      == [ "" [ "a" ] "c" ];
-assert  split  "([ac])" "abc"    == [ "" [ "a" ] "b" [ "c" ] "" ];
-assert  split  "(a)|(c)" "abc"   == [ "" [ "a" null ] "b" [ null "c" ] "" ];
-assert  split  "([[:upper:]]+)" "  FOO   " == [ "  " [ "FOO" ] "   " ];
+assert
+  split "(a)b" "abc" == [
+    ""
+    [ "a" ]
+    "c"
+  ];
+assert
+  split "([ac])" "abc" == [
+    ""
+    [ "a" ]
+    "b"
+    [ "c" ]
+    ""
+  ];
+assert
+  split "(a)|(c)" "abc" == [
+    ""
+    [
+      "a"
+      null
+    ]
+    "b"
+    [
+      null
+      "c"
+    ]
+    ""
+  ];
+assert
+  split "([[:upper:]]+)" "  FOO   " == [
+    "  "
+    [ "FOO" ]
+    "   "
+  ];
 
 true
diff --git a/tests/functional/lang/eval-okay-regression-20220125.nix b/tests/functional/lang/eval-okay-regression-20220125.nix
index 485502373..1c4b8e09f 100644
--- a/tests/functional/lang/eval-okay-regression-20220125.nix
+++ b/tests/functional/lang/eval-okay-regression-20220125.nix
@@ -1,2 +1 @@
 ((__curPosFoo: __curPosFoo) 1) + ((__curPosBar: __curPosBar) 2)
-
diff --git a/tests/functional/lang/eval-okay-regrettable-rec-attrset-merge.nix b/tests/functional/lang/eval-okay-regrettable-rec-attrset-merge.nix
index 8df6a2ad8..e92ae8125 100644
--- a/tests/functional/lang/eval-okay-regrettable-rec-attrset-merge.nix
+++ b/tests/functional/lang/eval-okay-regrettable-rec-attrset-merge.nix
@@ -1,3 +1,10 @@
 # This is for backwards compatibility, not because we like it.
 # See https://github.com/NixOS/nix/issues/9020.
-{ a = rec { b = c + 1; d = 2; }; a.c = d + 3; }.a.b
+{
+  a = rec {
+    b = c + 1;
+    d = 2;
+  };
+  a.c = d + 3;
+}
+.a.b
diff --git a/tests/functional/lang/eval-okay-remove.nix b/tests/functional/lang/eval-okay-remove.nix
index 4ad5ba897..a7ee3a071 100644
--- a/tests/functional/lang/eval-okay-remove.nix
+++ b/tests/functional/lang/eval-okay-remove.nix
@@ -1,5 +1,8 @@
 let {
-  attrs = {x = 123; y = 456;};
+  attrs = {
+    x = 123;
+    y = 456;
+  };
 
-  body = (removeAttrs attrs ["x"]).y;
-}
\ No newline at end of file
+  body = (removeAttrs attrs [ "x" ]).y;
+}
diff --git a/tests/functional/lang/eval-okay-repeated-empty-attrs.nix b/tests/functional/lang/eval-okay-repeated-empty-attrs.nix
index 030a3b85c..0749e21a5 100644
--- a/tests/functional/lang/eval-okay-repeated-empty-attrs.nix
+++ b/tests/functional/lang/eval-okay-repeated-empty-attrs.nix
@@ -1,2 +1,5 @@
 # Tests that empty attribute sets are not printed as `«repeated»`.
-[ {} {} ]
+[
+  { }
+  { }
+]
diff --git a/tests/functional/lang/eval-okay-repeated-empty-list.nix b/tests/functional/lang/eval-okay-repeated-empty-list.nix
index 376c51be8..7e24fe81b 100644
--- a/tests/functional/lang/eval-okay-repeated-empty-list.nix
+++ b/tests/functional/lang/eval-okay-repeated-empty-list.nix
@@ -1 +1,4 @@
-[ [] [] ]
+[
+  [ ]
+  [ ]
+]
diff --git a/tests/functional/lang/eval-okay-replacestrings.nix b/tests/functional/lang/eval-okay-replacestrings.nix
index a803e6519..81a932a1d 100644
--- a/tests/functional/lang/eval-okay-replacestrings.nix
+++ b/tests/functional/lang/eval-okay-replacestrings.nix
@@ -1,12 +1,13 @@
 with builtins;
 
-[ (replaceStrings ["o"] ["a"] "foobar")
-  (replaceStrings ["o"] [""] "foobar")
-  (replaceStrings ["oo"] ["u"] "foobar")
-  (replaceStrings ["oo" "a"] ["a" "oo"] "foobar")
-  (replaceStrings ["oo" "oo"] ["u" "i"] "foobar")
-  (replaceStrings [""] ["X"] "abc")
-  (replaceStrings [""] ["X"] "")
-  (replaceStrings ["-"] ["_"] "a-b")
-  (replaceStrings ["oo" "XX"] ["u" (throw "unreachable")] "foobar")
+[
+  (replaceStrings [ "o" ] [ "a" ] "foobar")
+  (replaceStrings [ "o" ] [ "" ] "foobar")
+  (replaceStrings [ "oo" ] [ "u" ] "foobar")
+  (replaceStrings [ "oo" "a" ] [ "a" "oo" ] "foobar")
+  (replaceStrings [ "oo" "oo" ] [ "u" "i" ] "foobar")
+  (replaceStrings [ "" ] [ "X" ] "abc")
+  (replaceStrings [ "" ] [ "X" ] "")
+  (replaceStrings [ "-" ] [ "_" ] "a-b")
+  (replaceStrings [ "oo" "XX" ] [ "u" (throw "unreachable") ] "foobar")
 ]
diff --git a/tests/functional/lang/eval-okay-scope-1.nix b/tests/functional/lang/eval-okay-scope-1.nix
index fa38a7174..b7bbcc432 100644
--- a/tests/functional/lang/eval-okay-scope-1.nix
+++ b/tests/functional/lang/eval-okay-scope-1.nix
@@ -1,6 +1,13 @@
-(({x}: x:
+(
+  (
+    { x }:
+    x:
 
-  { x = 1;
-    y = x;
-  }
-) {x = 2;} 3).y
+    {
+      x = 1;
+      y = x;
+    }
+  )
+  { x = 2; }
+  3
+).y
diff --git a/tests/functional/lang/eval-okay-scope-2.nix b/tests/functional/lang/eval-okay-scope-2.nix
index eb8b02bc4..54f7ec3b2 100644
--- a/tests/functional/lang/eval-okay-scope-2.nix
+++ b/tests/functional/lang/eval-okay-scope-2.nix
@@ -1,6 +1,12 @@
-((x: {x}:
-  rec {
-    x = 1;
-    y = x;
-  }
-) 2 {x = 3;}).y
+(
+  (
+    x:
+    { x }:
+    rec {
+      x = 1;
+      y = x;
+    }
+  )
+  2
+  { x = 3; }
+).y
diff --git a/tests/functional/lang/eval-okay-scope-3.nix b/tests/functional/lang/eval-okay-scope-3.nix
index 10d6bc04d..6a77583b7 100644
--- a/tests/functional/lang/eval-okay-scope-3.nix
+++ b/tests/functional/lang/eval-okay-scope-3.nix
@@ -1,6 +1,13 @@
-((x: as: {x}:
-  rec {
-    inherit (as) x;
-    y = x;
-  }
-) 2 {x = 4;} {x = 3;}).y
+(
+  (
+    x: as:
+    { x }:
+    rec {
+      inherit (as) x;
+      y = x;
+    }
+  )
+  2
+  { x = 4; }
+  { x = 3; }
+).y
diff --git a/tests/functional/lang/eval-okay-scope-4.nix b/tests/functional/lang/eval-okay-scope-4.nix
index dc8243bc8..ccae8564c 100644
--- a/tests/functional/lang/eval-okay-scope-4.nix
+++ b/tests/functional/lang/eval-okay-scope-4.nix
@@ -3,8 +3,13 @@ let {
   x = "a";
   y = "b";
 
-  f = {x ? y, y ? x}: x + y;
+  f =
+    {
+      x ? y,
+      y ? x,
+    }:
+    x + y;
 
-  body = f {x = "c";} + f {y = "d";};
+  body = f { x = "c"; } + f { y = "d"; };
 
 }
diff --git a/tests/functional/lang/eval-okay-scope-6.nix b/tests/functional/lang/eval-okay-scope-6.nix
index 0995d4e7e..be2cc31a1 100644
--- a/tests/functional/lang/eval-okay-scope-6.nix
+++ b/tests/functional/lang/eval-okay-scope-6.nix
@@ -1,7 +1,12 @@
 let {
 
-  f = {x ? y, y ? x}: x + y;
+  f =
+    {
+      x ? y,
+      y ? x,
+    }:
+    x + y;
 
-  body = f {x = "c";} + f {y = "d";};
+  body = f { x = "c"; } + f { y = "d"; };
 
 }
diff --git a/tests/functional/lang/eval-okay-scope-7.nix b/tests/functional/lang/eval-okay-scope-7.nix
index 4da02968f..91f22f553 100644
--- a/tests/functional/lang/eval-okay-scope-7.nix
+++ b/tests/functional/lang/eval-okay-scope-7.nix
@@ -3,4 +3,5 @@ rec {
   x = {
     y = 1;
   };
-}.y
+}
+.y
diff --git a/tests/functional/lang/eval-okay-search-path.nix b/tests/functional/lang/eval-okay-search-path.nix
index 6fe33decc..702e1b64c 100644
--- a/tests/functional/lang/eval-okay-search-path.nix
+++ b/tests/functional/lang/eval-okay-search-path.nix
@@ -6,5 +6,16 @@ assert isFunction (import <nix/fetchurl.nix>);
 assert length __nixPath == 5;
 assert length (filter (x: baseNameOf x.path == "dir4") __nixPath) == 1;
 
-import <a.nix> + import <b.nix> + import <c.nix> + import <dir5/c.nix>
-  + (let __nixPath = [ { path = ./dir2; } { path = ./dir1; } ]; in import <a.nix>)
+import <a.nix>
++ import <b.nix>
++ import <c.nix>
++ import <dir5/c.nix>
++ (
+  let
+    __nixPath = [
+      { path = ./dir2; }
+      { path = ./dir1; }
+    ];
+  in
+  import <a.nix>
+)
diff --git a/tests/functional/lang/eval-okay-sort.nix b/tests/functional/lang/eval-okay-sort.nix
index 50aa78e40..412bda4a0 100644
--- a/tests/functional/lang/eval-okay-sort.nix
+++ b/tests/functional/lang/eval-okay-sort.nix
@@ -1,20 +1,64 @@
 with builtins;
 
-[ (sort lessThan [ 483 249 526 147 42 77 ])
-  (sort (x: y: y < x) [ 483 249 526 147 42 77 ])
-  (sort lessThan [ "foo" "bar" "xyzzy" "fnord" ])
-  (sort (x: y: x.key < y.key)
-    [ { key = 1; value = "foo"; } { key = 2; value = "bar"; } { key = 1; value = "fnord"; } ])
+[
   (sort lessThan [
-    [ 1 6 ]
+    483
+    249
+    526
+    147
+    42
+    77
+  ])
+  (sort (x: y: y < x) [
+    483
+    249
+    526
+    147
+    42
+    77
+  ])
+  (sort lessThan [
+    "foo"
+    "bar"
+    "xyzzy"
+    "fnord"
+  ])
+  (sort (x: y: x.key < y.key) [
+    {
+      key = 1;
+      value = "foo";
+    }
+    {
+      key = 2;
+      value = "bar";
+    }
+    {
+      key = 1;
+      value = "fnord";
+    }
+  ])
+  (sort lessThan [
+    [
+      1
+      6
+    ]
     [ ]
-    [ 2 3 ]
+    [
+      2
+      3
+    ]
     [ 3 ]
-    [ 1 5 ]
+    [
+      1
+      5
+    ]
     [ 2 ]
     [ 1 ]
     [ ]
-    [ 1 4 ]
+    [
+      1
+      4
+    ]
     [ 3 ]
   ])
 ]
diff --git a/tests/functional/lang/eval-okay-string.nix b/tests/functional/lang/eval-okay-string.nix
index 47cc989ad..d3b743fdb 100644
--- a/tests/functional/lang/eval-okay-string.nix
+++ b/tests/functional/lang/eval-okay-string.nix
@@ -1,12 +1,13 @@
-"foo" + "bar"
-  + toString (/a/b + /c/d)
-  + toString (/foo/bar + "/../xyzzy/." + "/foo.txt")
-  + ("/../foo" + toString /x/y)
-  + "escape: \"quote\" \n \\"
-  + "end
+"foo"
++ "bar"
++ toString (/a/b + /c/d)
++ toString (/foo/bar + "/../xyzzy/." + "/foo.txt")
++ ("/../foo" + toString /x/y)
++ "escape: \"quote\" \n \\"
++ "end
 of
 line"
-  + "foo${if true then "b${"a" + "r"}" else "xyzzy"}blaat"
-  + "foo$bar"
-  + "$\"$\""
-  + "$"
++ "foo${if true then "b${"a" + "r"}" else "xyzzy"}blaat"
++ "foo$bar"
++ "$\"$\""
++ "$"
diff --git a/tests/functional/lang/eval-okay-strings-as-attrs-names.nix b/tests/functional/lang/eval-okay-strings-as-attrs-names.nix
index 5e40928db..158dc8e75 100644
--- a/tests/functional/lang/eval-okay-strings-as-attrs-names.nix
+++ b/tests/functional/lang/eval-okay-strings-as-attrs-names.nix
@@ -14,7 +14,5 @@ let
   # variable.
   "foo bar" = 1;
 
-in t1 == "test"
-   && t2 == "caseok"
-   && t3 == true
-   && t4 == ["key 1"]
+in
+t1 == "test" && t2 == "caseok" && t3 == true && t4 == [ "key 1" ]
diff --git a/tests/functional/lang/eval-okay-substring-context.nix b/tests/functional/lang/eval-okay-substring-context.nix
index d0ef70d4e..9e9d3a1aa 100644
--- a/tests/functional/lang/eval-okay-substring-context.nix
+++ b/tests/functional/lang/eval-okay-substring-context.nix
@@ -2,10 +2,15 @@ with builtins;
 
 let
 
-  s = "${builtins.derivation { name = "test"; builder = "/bin/sh"; system = "x86_64-linux"; }}";
+  s = "${builtins.derivation {
+    name = "test";
+    builder = "/bin/sh";
+    system = "x86_64-linux";
+  }}";
 
 in
 
-if getContext s == getContext "${substring 0 0 s + unsafeDiscardStringContext s}"
-then "okay"
-else throw "empty substring should preserve context"
+if getContext s == getContext "${substring 0 0 s + unsafeDiscardStringContext s}" then
+  "okay"
+else
+  throw "empty substring should preserve context"
diff --git a/tests/functional/lang/eval-okay-tail-call-1.nix b/tests/functional/lang/eval-okay-tail-call-1.nix
index a3962ce3f..d3ec0c9ad 100644
--- a/tests/functional/lang/eval-okay-tail-call-1.nix
+++ b/tests/functional/lang/eval-okay-tail-call-1.nix
@@ -1,3 +1,4 @@
 let
   f = n: if n == 100000 then n else f (n + 1);
-in f 0
+in
+f 0
diff --git a/tests/functional/lang/eval-okay-tojson.nix b/tests/functional/lang/eval-okay-tojson.nix
index ce67943be..863c07663 100644
--- a/tests/functional/lang/eval-okay-tojson.nix
+++ b/tests/functional/lang/eval-okay-tojson.nix
@@ -1,13 +1,26 @@
-builtins.toJSON
-  { a = 123;
-    b = -456;
-    c = "foo";
-    d = "foo\n\"bar\"";
-    e = true;
-    f = false;
-    g = [ 1 2 3 ];
-    h = [ "a" [ "b" { "foo\nbar" = {}; } ] ];
-    i = 1 + 2;
-    j = 1.44;
-    k = { __toString = self: self.a; a = "foo"; };
-  }
+builtins.toJSON {
+  a = 123;
+  b = -456;
+  c = "foo";
+  d = "foo\n\"bar\"";
+  e = true;
+  f = false;
+  g = [
+    1
+    2
+    3
+  ];
+  h = [
+    "a"
+    [
+      "b"
+      { "foo\nbar" = { }; }
+    ]
+  ];
+  i = 1 + 2;
+  j = 1.44;
+  k = {
+    __toString = self: self.a;
+    a = "foo";
+  };
+}
diff --git a/tests/functional/lang/eval-okay-toxml2.nix b/tests/functional/lang/eval-okay-toxml2.nix
index ff1791b30..0d5989a50 100644
--- a/tests/functional/lang/eval-okay-toxml2.nix
+++ b/tests/functional/lang/eval-okay-toxml2.nix
@@ -1 +1,8 @@
-builtins.toXML [("a" + "b") 10 (rec {x = "x"; y = x;})]
+builtins.toXML [
+  ("a" + "b")
+  10
+  (rec {
+    x = "x";
+    y = x;
+  })
+]
diff --git a/tests/functional/lang/eval-okay-tryeval.nix b/tests/functional/lang/eval-okay-tryeval.nix
index 629bc440a..22b23d883 100644
--- a/tests/functional/lang/eval-okay-tryeval.nix
+++ b/tests/functional/lang/eval-okay-tryeval.nix
@@ -1,5 +1,8 @@
 {
   x = builtins.tryEval "x";
-  y = builtins.tryEval (assert false; "y");
+  y = builtins.tryEval (
+    assert false;
+    "y"
+  );
   z = builtins.tryEval (throw "bla");
 }
diff --git a/tests/functional/lang/eval-okay-types.nix b/tests/functional/lang/eval-okay-types.nix
index 9b58be5d1..0814489ed 100644
--- a/tests/functional/lang/eval-okay-types.nix
+++ b/tests/functional/lang/eval-okay-types.nix
@@ -1,6 +1,7 @@
 with builtins;
 
-[ (isNull null)
+[
+  (isNull null)
   (isNull (x: x))
   (isFunction (x: x))
   (isFunction "fnord")
@@ -29,7 +30,11 @@ with builtins;
   (typeOf "xyzzy")
   (typeOf null)
   (typeOf { x = 456; })
-  (typeOf [ 1 2 3 ])
+  (typeOf [
+    1
+    2
+    3
+  ])
   (typeOf (x: x))
   (typeOf ((x: y: x) 1))
   (typeOf map)
diff --git a/tests/functional/lang/eval-okay-versions.nix b/tests/functional/lang/eval-okay-versions.nix
index e9111f5f4..3456015e5 100644
--- a/tests/functional/lang/eval-okay-versions.nix
+++ b/tests/functional/lang/eval-okay-versions.nix
@@ -10,10 +10,13 @@ let
   lt = builtins.sub 0 1;
   gt = 1;
 
-  versionTest = v1: v2: expected:
-    let d1 = builtins.compareVersions v1 v2;
-        d2 = builtins.compareVersions v2 v1;
-    in d1 == builtins.sub 0 d2 && d1 == expected;
+  versionTest =
+    v1: v2: expected:
+    let
+      d1 = builtins.compareVersions v1 v2;
+      d2 = builtins.compareVersions v2 v1;
+    in
+    d1 == builtins.sub 0 d2 && d1 == expected;
 
   tests = [
     ((builtins.parseDrvName name1).name == "hello")
@@ -40,4 +43,5 @@ let
     (versionTest "2.3pre1" "2.3q" lt)
   ];
 
-in (import ./lib.nix).and tests
+in
+(import ./lib.nix).and tests
diff --git a/tests/functional/lang/eval-okay-xml.nix b/tests/functional/lang/eval-okay-xml.nix
index 9ee9f8a0b..9785c66ef 100644
--- a/tests/functional/lang/eval-okay-xml.nix
+++ b/tests/functional/lang/eval-okay-xml.nix
@@ -10,12 +10,31 @@ rec {
 
   c = "foo" + "bar";
 
-  f = {z, x, y}: if y then x else z;
+  f =
+    {
+      z,
+      x,
+      y,
+    }:
+    if y then x else z;
 
   id = x: x;
 
-  at = args@{x, y, z}: x;
+  at =
+    args@{
+      x,
+      y,
+      z,
+    }:
+    x;
 
-  ellipsis = {x, y, z, ...}: x;
+  ellipsis =
+    {
+      x,
+      y,
+      z,
+      ...
+    }:
+    x;
 
 }
diff --git a/tests/functional/lang/eval-okay-zipAttrsWith.nix b/tests/functional/lang/eval-okay-zipAttrsWith.nix
index 877d4e5fa..20f689111 100644
--- a/tests/functional/lang/eval-okay-zipAttrsWith.nix
+++ b/tests/functional/lang/eval-okay-zipAttrsWith.nix
@@ -3,7 +3,6 @@ with import ./lib.nix;
 let
   str = builtins.hashString "sha256" "test";
 in
-builtins.zipAttrsWith
-  (n: v: { inherit n v; })
-  (map (n: { ${builtins.substring n 1 str} = n; })
-    (range 0 31))
+builtins.zipAttrsWith (n: v: { inherit n v; }) (
+  map (n: { ${builtins.substring n 1 str} = n; }) (range 0 31)
+)
diff --git a/tests/functional/lang/lib.nix b/tests/functional/lang/lib.nix
index 028a53831..126128abe 100644
--- a/tests/functional/lang/lib.nix
+++ b/tests/functional/lang/lib.nix
@@ -2,60 +2,76 @@ with builtins;
 
 rec {
 
-  fold = op: nul: list:
-    if list == []
-    then nul
-    else op (head list) (fold op nul (tail list));
+  fold =
+    op: nul: list:
+    if list == [ ] then nul else op (head list) (fold op nul (tail list));
 
-  concat =
-    fold (x: y: x + y) "";
+  concat = fold (x: y: x + y) "";
 
   and = fold (x: y: x && y) true;
 
-  flatten = x:
-    if isList x
-    then fold (x: y: (flatten x) ++ y) [] x
-    else [x];
+  flatten = x: if isList x then fold (x: y: (flatten x) ++ y) [ ] x else [ x ];
 
   sum = foldl' (x: y: add x y) 0;
 
-  hasSuffix = ext: fileName:
-    let lenFileName = stringLength fileName;
-        lenExt = stringLength ext;
-    in !(lessThan lenFileName lenExt) &&
-       substring (sub lenFileName lenExt) lenFileName fileName == ext;
+  hasSuffix =
+    ext: fileName:
+    let
+      lenFileName = stringLength fileName;
+      lenExt = stringLength ext;
+    in
+    !(lessThan lenFileName lenExt) && substring (sub lenFileName lenExt) lenFileName fileName == ext;
 
   # Split a list at the given position.
-  splitAt = pos: list:
-    if pos == 0 then {first = []; second = list;} else
-    if list == [] then {first = []; second = [];} else
-    let res = splitAt (sub pos 1) (tail list);
-    in {first = [(head list)] ++ res.first; second = res.second;};
+  splitAt =
+    pos: list:
+    if pos == 0 then
+      {
+        first = [ ];
+        second = list;
+      }
+    else if list == [ ] then
+      {
+        first = [ ];
+        second = [ ];
+      }
+    else
+      let
+        res = splitAt (sub pos 1) (tail list);
+      in
+      {
+        first = [ (head list) ] ++ res.first;
+        second = res.second;
+      };
 
   # Stable merge sort.
-  sortBy = comp: list:
-    if lessThan 1 (length list)
-    then
+  sortBy =
+    comp: list:
+    if lessThan 1 (length list) then
       let
         split = splitAt (div (length list) 2) list;
         first = sortBy comp split.first;
         second = sortBy comp split.second;
-      in mergeLists comp first second
-    else list;
+      in
+      mergeLists comp first second
+    else
+      list;
 
-  mergeLists = comp: list1: list2:
-    if list1 == [] then list2 else
-    if list2 == [] then list1 else
-    if comp (head list2) (head list1) then [(head list2)] ++ mergeLists comp list1 (tail list2) else
-    [(head list1)] ++ mergeLists comp (tail list1) list2;
+  mergeLists =
+    comp: list1: list2:
+    if list1 == [ ] then
+      list2
+    else if list2 == [ ] then
+      list1
+    else if comp (head list2) (head list1) then
+      [ (head list2) ] ++ mergeLists comp list1 (tail list2)
+    else
+      [ (head list1) ] ++ mergeLists comp (tail list1) list2;
 
   id = x: x;
 
   const = x: y: x;
 
-  range = first: last:
-    if first > last
-      then []
-      else genList (n: first + n) (last - first + 1);
+  range = first: last: if first > last then [ ] else genList (n: first + n) (last - first + 1);
 
 }
diff --git a/tests/functional/linux-sandbox-cert-test.nix b/tests/functional/linux-sandbox-cert-test.nix
index 2fc083ea9..82989c64f 100644
--- a/tests/functional/linux-sandbox-cert-test.nix
+++ b/tests/functional/linux-sandbox-cert-test.nix
@@ -22,9 +22,12 @@ mkDerivation (
       # derivations being cached, and do not want to compute the right hash.
       false;
     '';
-  } // {
-    fixed-output = { outputHash = "sha256:0000000000000000000000000000000000000000000000000000000000000000"; };
+  }
+  // {
+    fixed-output = {
+      outputHash = "sha256:0000000000000000000000000000000000000000000000000000000000000000";
+    };
     normal = { };
-  }.${mode}
+  }
+  .${mode}
 )
-
diff --git a/tests/functional/multiple-outputs.nix b/tests/functional/multiple-outputs.nix
index 6ba7c523d..2c9243097 100644
--- a/tests/functional/multiple-outputs.nix
+++ b/tests/functional/multiple-outputs.nix
@@ -5,94 +5,111 @@ rec {
   # Want to ensure that "out" doesn't get a suffix on it's path.
   nameCheck = mkDerivation {
     name = "multiple-outputs-a";
-    outputs = [ "out" "dev" ];
-    builder = builtins.toFile "builder.sh"
-      ''
-        mkdir $first $second
-        test -z $all
-        echo "first" > $first/file
-        echo "second" > $second/file
-        ln -s $first $second/link
-      '';
+    outputs = [
+      "out"
+      "dev"
+    ];
+    builder = builtins.toFile "builder.sh" ''
+      mkdir $first $second
+      test -z $all
+      echo "first" > $first/file
+      echo "second" > $second/file
+      ln -s $first $second/link
+    '';
     helloString = "Hello, world!";
   };
 
   a = mkDerivation {
     name = "multiple-outputs-a";
-    outputs = [ "first" "second" ];
-    builder = builtins.toFile "builder.sh"
-      ''
-        mkdir $first $second
-        test -z $all
-        echo "first" > $first/file
-        echo "second" > $second/file
-        ln -s $first $second/link
-      '';
+    outputs = [
+      "first"
+      "second"
+    ];
+    builder = builtins.toFile "builder.sh" ''
+      mkdir $first $second
+      test -z $all
+      echo "first" > $first/file
+      echo "second" > $second/file
+      ln -s $first $second/link
+    '';
     helloString = "Hello, world!";
   };
 
   use-a = mkDerivation {
     name = "use-a";
     inherit (a) first second;
-    builder = builtins.toFile "builder.sh"
-      ''
-        cat $first/file $second/file >$out
-      '';
+    builder = builtins.toFile "builder.sh" ''
+      cat $first/file $second/file >$out
+    '';
   };
 
   b = mkDerivation {
-    defaultOutput = assert a.second.helloString == "Hello, world!"; a;
-    firstOutput = assert a.outputName == "first"; a.first.first;
-    secondOutput = assert a.second.outputName == "second"; a.second.first.first.second.second.first.second;
+    defaultOutput =
+      assert a.second.helloString == "Hello, world!";
+      a;
+    firstOutput =
+      assert a.outputName == "first";
+      a.first.first;
+    secondOutput =
+      assert a.second.outputName == "second";
+      a.second.first.first.second.second.first.second;
     allOutputs = a.all;
     name = "multiple-outputs-b";
-    builder = builtins.toFile "builder.sh"
-      ''
-        mkdir $out
-        test "$firstOutput $secondOutput" = "$allOutputs"
-        test "$defaultOutput" = "$firstOutput"
-        test "$(cat $firstOutput/file)" = "first"
-        test "$(cat $secondOutput/file)" = "second"
-        echo "success" > $out/file
-      '';
+    builder = builtins.toFile "builder.sh" ''
+      mkdir $out
+      test "$firstOutput $secondOutput" = "$allOutputs"
+      test "$defaultOutput" = "$firstOutput"
+      test "$(cat $firstOutput/file)" = "first"
+      test "$(cat $secondOutput/file)" = "second"
+      echo "success" > $out/file
+    '';
   };
 
   c = mkDerivation {
     name = "multiple-outputs-c";
     drv = b.drvPath;
-    builder = builtins.toFile "builder.sh"
-      ''
-        mkdir $out
-        ln -s $drv $out/drv
-      '';
+    builder = builtins.toFile "builder.sh" ''
+      mkdir $out
+      ln -s $drv $out/drv
+    '';
   };
 
   d = mkDerivation {
     name = "multiple-outputs-d";
     drv = builtins.unsafeDiscardOutputDependency b.drvPath;
-    builder = builtins.toFile "builder.sh"
-      ''
-        mkdir $out
-        echo $drv > $out/drv
-      '';
+    builder = builtins.toFile "builder.sh" ''
+      mkdir $out
+      echo $drv > $out/drv
+    '';
   };
 
-  cyclic = (mkDerivation {
-    name = "cyclic-outputs";
-    outputs = [ "a" "b" "c" ];
-    builder = builtins.toFile "builder.sh"
-      ''
+  cyclic =
+    (mkDerivation {
+      name = "cyclic-outputs";
+      outputs = [
+        "a"
+        "b"
+        "c"
+      ];
+      builder = builtins.toFile "builder.sh" ''
         mkdir $a $b $c
         echo $a > $b/foo
         echo $b > $c/bar
         echo $c > $a/baz
       '';
-  }).a;
+    }).a;
 
   e = mkDerivation {
     name = "multiple-outputs-e";
-    outputs = [ "a_a" "b" "c" ];
-    meta.outputsToInstall = [ "a_a" "b" ];
+    outputs = [
+      "a_a"
+      "b"
+      "c"
+    ];
+    meta.outputsToInstall = [
+      "a_a"
+      "b"
+    ];
     buildCommand = "mkdir $a_a $b $c";
   };
 
@@ -104,33 +121,37 @@ rec {
 
   independent = mkDerivation {
     name = "multiple-outputs-independent";
-    outputs = [ "first" "second" ];
-    builder = builtins.toFile "builder.sh"
-      ''
-        mkdir $first $second
-        test -z $all
-        echo "first" > $first/file
-        echo "second" > $second/file
-      '';
+    outputs = [
+      "first"
+      "second"
+    ];
+    builder = builtins.toFile "builder.sh" ''
+      mkdir $first $second
+      test -z $all
+      echo "first" > $first/file
+      echo "second" > $second/file
+    '';
   };
 
   use-independent = mkDerivation {
     name = "use-independent";
     inherit (a) first second;
-    builder = builtins.toFile "builder.sh"
-      ''
-        cat $first/file $second/file >$out
-      '';
+    builder = builtins.toFile "builder.sh" ''
+      cat $first/file $second/file >$out
+    '';
   };
 
   invalid-output-name-1 = mkDerivation {
     name = "invalid-output-name-1";
-    outputs = [ "out/"];
+    outputs = [ "out/" ];
   };
 
   invalid-output-name-2 = mkDerivation {
     name = "invalid-output-name-2";
-    outputs = [ "x" "foo$"];
+    outputs = [
+      "x"
+      "foo$"
+    ];
   };
 
 }
diff --git a/tests/functional/nar-access.nix b/tests/functional/nar-access.nix
index 9948abe59..b1e88189a 100644
--- a/tests/functional/nar-access.nix
+++ b/tests/functional/nar-access.nix
@@ -1,23 +1,22 @@
 with import ./config.nix;
 
 rec {
-    a = mkDerivation {
-        name = "nar-index-a";
-        builder = builtins.toFile "builder.sh"
-      ''
-        mkdir $out
-        mkdir $out/foo
-        touch $out/foo-x
-        touch $out/foo/bar
-        touch $out/foo/baz
-        touch $out/qux
-        mkdir $out/zyx
+  a = mkDerivation {
+    name = "nar-index-a";
+    builder = builtins.toFile "builder.sh" ''
+              mkdir $out
+              mkdir $out/foo
+              touch $out/foo-x
+              touch $out/foo/bar
+              touch $out/foo/baz
+              touch $out/qux
+              mkdir $out/zyx
 
-        cat >$out/foo/data <<EOF
-        lasjdöaxnasd
-asdom 12398
-ä"§Æẞ¢«»”alsd
-EOF
-      '';
-    };
+              cat >$out/foo/data <<EOF
+              lasjdöaxnasd
+      asdom 12398
+      ä"§Æẞ¢«»”alsd
+      EOF
+    '';
+  };
 }
diff --git a/tests/functional/nested-sandboxing/runner.nix b/tests/functional/nested-sandboxing/runner.nix
index 48ad512b3..d0d441a82 100644
--- a/tests/functional/nested-sandboxing/runner.nix
+++ b/tests/functional/nested-sandboxing/runner.nix
@@ -6,25 +6,32 @@ mkDerivation {
   name = "nested-sandboxing";
   busybox = builtins.getEnv "busybox";
   EXTRA_SANDBOX = builtins.getEnv "EXTRA_SANDBOX";
-  buildCommand = ''
-    set -x
-    set -eu -o pipefail
-  '' + (if altitude == 0 then ''
-    echo Deep enough! > $out
-  '' else ''
-    cp -r ${../common} ./common
-    cp ${../common.sh} ./common.sh
-    cp ${../config.nix} ./config.nix
-    cp -r ${./.} ./nested-sandboxing
+  buildCommand =
+    ''
+      set -x
+      set -eu -o pipefail
+    ''
+    + (
+      if altitude == 0 then
+        ''
+          echo Deep enough! > $out
+        ''
+      else
+        ''
+          cp -r ${../common} ./common
+          cp ${../common.sh} ./common.sh
+          cp ${../config.nix} ./config.nix
+          cp -r ${./.} ./nested-sandboxing
 
-    export PATH=${builtins.getEnv "NIX_BIN_DIR"}:$PATH
+          export PATH=${builtins.getEnv "NIX_BIN_DIR"}:$PATH
 
-    export _NIX_TEST_SOURCE_DIR=$PWD
-    export _NIX_TEST_BUILD_DIR=$PWD
+          export _NIX_TEST_SOURCE_DIR=$PWD
+          export _NIX_TEST_BUILD_DIR=$PWD
 
-    source common.sh
-    source ./nested-sandboxing/command.sh
+          source common.sh
+          source ./nested-sandboxing/command.sh
 
-    runNixBuild ${storeFun} ${toString altitude} >> $out
-  '');
+          runNixBuild ${storeFun} ${toString altitude} >> $out
+        ''
+    );
 }
diff --git a/tests/functional/package.nix b/tests/functional/package.nix
index d1582b05d..74c034196 100644
--- a/tests/functional/package.nix
+++ b/tests/functional/package.nix
@@ -1,103 +1,110 @@
-{ lib
-, stdenv
-, mkMesonDerivation
+{
+  lib,
+  stdenv,
+  mkMesonDerivation,
 
-, meson
-, ninja
-, pkg-config
+  meson,
+  ninja,
+  pkg-config,
 
-, jq
-, git
-, mercurial
-, util-linux
+  jq,
+  git,
+  mercurial,
+  util-linux,
 
-, nix-store
-, nix-expr
-, nix-cli
+  nix-store,
+  nix-expr,
+  nix-cli,
 
-, busybox-sandbox-shell ? null
+  busybox-sandbox-shell ? null,
 
-# Configuration Options
+  # Configuration Options
 
-, pname ? "nix-functional-tests"
-, version
+  pname ? "nix-functional-tests",
+  version,
 
-# For running the functional tests against a different pre-built Nix.
-, test-daemon ? null
+  # For running the functional tests against a different pre-built Nix.
+  test-daemon ? null,
 }:
 
 let
   inherit (lib) fileset;
 in
 
-mkMesonDerivation (finalAttrs: {
-  inherit pname version;
+mkMesonDerivation (
+  finalAttrs:
+  {
+    inherit pname version;
 
-  workDir = ./.;
-  fileset = fileset.unions [
-    ../../scripts/nix-profile.sh.in
-    ../../.version
-    ../../tests/functional
-    ./.
-  ];
+    workDir = ./.;
+    fileset = fileset.unions [
+      ../../scripts/nix-profile.sh.in
+      ../../.version
+      ../../tests/functional
+      ./.
+    ];
 
-  # Hack for sake of the dev shell
-  passthru.externalNativeBuildInputs = [
-    meson
-    ninja
-    pkg-config
+    # Hack for sake of the dev shell
+    passthru.externalNativeBuildInputs =
+      [
+        meson
+        ninja
+        pkg-config
 
-    jq
-    git
-    mercurial
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    # For various sandboxing tests that needs a statically-linked shell,
-    # etc.
-    busybox-sandbox-shell
-    # For Overlay FS tests need `mount`, `umount`, and `unshare`.
-    # For `script` command (ensuring a TTY)
-    # TODO use `unixtools` to be precise over which executables instead?
-    util-linux
-  ];
+        jq
+        git
+        mercurial
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isLinux [
+        # For various sandboxing tests that needs a statically-linked shell,
+        # etc.
+        busybox-sandbox-shell
+        # For Overlay FS tests need `mount`, `umount`, and `unshare`.
+        # For `script` command (ensuring a TTY)
+        # TODO use `unixtools` to be precise over which executables instead?
+        util-linux
+      ];
 
-  nativeBuildInputs = finalAttrs.passthru.externalNativeBuildInputs ++ [
-    nix-cli
-  ];
+    nativeBuildInputs = finalAttrs.passthru.externalNativeBuildInputs ++ [
+      nix-cli
+    ];
 
-  buildInputs = [
-    nix-store
-    nix-expr
-  ];
+    buildInputs = [
+      nix-store
+      nix-expr
+    ];
 
-  preConfigure =
-    # "Inline" .version so it's not a symlink, and includes the suffix.
-    # Do the meson utils, without modification.
-    ''
-      chmod u+w ./.version
-      echo ${version} > ../../../.version
-    ''
-    # TEMP hack for Meson before make is gone, where
-    # `src/nix-functional-tests` is during the transition a symlink and
-    # not the actual directory directory.
-    + ''
-      cd $(readlink -e $PWD)
-      echo $PWD | grep tests/functional
+    preConfigure =
+      # "Inline" .version so it's not a symlink, and includes the suffix.
+      # Do the meson utils, without modification.
+      ''
+        chmod u+w ./.version
+        echo ${version} > ../../../.version
+      ''
+      # TEMP hack for Meson before make is gone, where
+      # `src/nix-functional-tests` is during the transition a symlink and
+      # not the actual directory directory.
+      + ''
+        cd $(readlink -e $PWD)
+        echo $PWD | grep tests/functional
+      '';
+
+    mesonCheckFlags = [
+      "--print-errorlogs"
+    ];
+
+    doCheck = true;
+
+    installPhase = ''
+      mkdir $out
     '';
 
-  mesonCheckFlags = [
-    "--print-errorlogs"
-  ];
+    meta = {
+      platforms = lib.platforms.unix;
+    };
 
-  doCheck = true;
-
-  installPhase = ''
-    mkdir $out
-  '';
-
-  meta = {
-    platforms = lib.platforms.unix;
-  };
-
-} // lib.optionalAttrs (test-daemon != null) {
-  NIX_DAEMON_PACKAGE = test-daemon;
-})
+  }
+  // lib.optionalAttrs (test-daemon != null) {
+    NIX_DAEMON_PACKAGE = test-daemon;
+  }
+)
diff --git a/tests/functional/parallel.nix b/tests/functional/parallel.nix
index 23f142059..0adfe7d8e 100644
--- a/tests/functional/parallel.nix
+++ b/tests/functional/parallel.nix
@@ -1,19 +1,33 @@
-{sleepTime ? 3}:
+{
+  sleepTime ? 3,
+}:
 
 with import ./config.nix;
 
 let
 
-  mkDrv = text: inputs: mkDerivation {
-    name = "parallel";
-    builder = ./parallel.builder.sh;
-    inherit text inputs shared sleepTime;
-  };
+  mkDrv =
+    text: inputs:
+    mkDerivation {
+      name = "parallel";
+      builder = ./parallel.builder.sh;
+      inherit
+        text
+        inputs
+        shared
+        sleepTime
+        ;
+    };
 
-  a = mkDrv "a" [];
-  b = mkDrv "b" [a];
-  c = mkDrv "c" [a];
-  d = mkDrv "d" [a];
-  e = mkDrv "e" [b c d];
+  a = mkDrv "a" [ ];
+  b = mkDrv "b" [ a ];
+  c = mkDrv "c" [ a ];
+  d = mkDrv "d" [ a ];
+  e = mkDrv "e" [
+    b
+    c
+    d
+  ];
 
-in e
+in
+e
diff --git a/tests/functional/path.nix b/tests/functional/path.nix
index 883c3c41b..b554765e8 100644
--- a/tests/functional/path.nix
+++ b/tests/functional/path.nix
@@ -3,12 +3,12 @@ with import ./config.nix;
 mkDerivation {
   name = "filter";
   builder = builtins.toFile "builder" "ln -s $input $out";
-  input =
-    builtins.path {
-      path = ((builtins.getEnv "TEST_ROOT") + "/filterin");
-      filter = path: type:
-           type != "symlink"
-        && baseNameOf path != "foo"
-        && !((import ./lang/lib.nix).hasSuffix ".bak" (baseNameOf path));
-    };
+  input = builtins.path {
+    path = ((builtins.getEnv "TEST_ROOT") + "/filterin");
+    filter =
+      path: type:
+      type != "symlink"
+      && baseNameOf path != "foo"
+      && !((import ./lang/lib.nix).hasSuffix ".bak" (baseNameOf path));
+  };
 }
diff --git a/tests/functional/readfile-context.nix b/tests/functional/readfile-context.nix
index 54cd1afd9..d9880ca32 100644
--- a/tests/functional/readfile-context.nix
+++ b/tests/functional/readfile-context.nix
@@ -25,4 +25,5 @@ let
     input = builtins.readFile (dependent + "/file1");
   };
 
-in readDependent
+in
+readDependent
diff --git a/tests/functional/recursive.nix b/tests/functional/recursive.nix
index fe438f0ba..be9e55da3 100644
--- a/tests/functional/recursive.nix
+++ b/tests/functional/recursive.nix
@@ -1,4 +1,6 @@
-let config_nix = /. + "${builtins.getEnv "_NIX_TEST_BUILD_DIR"}/config.nix"; in
+let
+  config_nix = /. + "${builtins.getEnv "_NIX_TEST_BUILD_DIR"}/config.nix";
+in
 with import config_nix;
 
 mkDerivation rec {
@@ -15,7 +17,9 @@ mkDerivation rec {
 
   buildCommand = ''
     mkdir $out
-    opts="--experimental-features nix-command ${if (NIX_TESTS_CA_BY_DEFAULT == "1") then "--extra-experimental-features ca-derivations" else ""}"
+    opts="--experimental-features nix-command ${
+      if (NIX_TESTS_CA_BY_DEFAULT == "1") then "--extra-experimental-features ca-derivations" else ""
+    }"
 
     PATH=${builtins.getEnv "NIX_BIN_DIR"}:$PATH
 
diff --git a/tests/functional/repl/doc-comment-function.nix b/tests/functional/repl/doc-comment-function.nix
index cdd241347..a85d4a99f 100644
--- a/tests/functional/repl/doc-comment-function.nix
+++ b/tests/functional/repl/doc-comment-function.nix
@@ -1,3 +1,4 @@
-/** A doc comment for a file that only contains a function */
-{ ... }:
-{ }
+/**
+  A doc comment for a file that only contains a function
+*/
+{ ... }: { }
diff --git a/tests/functional/repl/doc-comments.nix b/tests/functional/repl/doc-comments.nix
index e91ee0b51..a7a285d48 100644
--- a/tests/functional/repl/doc-comments.nix
+++ b/tests/functional/repl/doc-comments.nix
@@ -6,55 +6,106 @@
     multiply 2 3
     => 6
     ```
-   */
+  */
   multiply = x: y: x * y;
 
-  /**👈 precisely this wide 👉*/
+  /**
+    👈 precisely this wide 👉
+  */
   measurement = x: x;
 
-  floatedIn = /** This also works. */
+  floatedIn =
+    /**
+      This also works.
+    */
     x: y: x;
 
-  compact=/**boom*/x: x;
-
-  # https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md#ambiguous-placement
-  /** Ignore!!! */
-  unambiguous = 
-    /** Very close */
+  compact =
+    /**
+      boom
+    */
     x: x;
 
-  /** Firmly rigid. */
+  # https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md#ambiguous-placement
+  /**
+    Ignore!!!
+  */
+  unambiguous =
+    /**
+      Very close
+    */
+    x: x;
+
+  /**
+    Firmly rigid.
+  */
   constant = true;
 
-  /** Immovably fixed. */
+  /**
+    Immovably fixed.
+  */
   lib.version = "9000";
 
-  /** Unchangeably constant. */
+  /**
+    Unchangeably constant.
+  */
   lib.attr.empty = { };
 
   lib.attr.undocumented = { };
 
-  nonStrict = /** My syntax is not strict, but I'm strict anyway. */ x: x;
-  strict = /** I don't have to be strict, but I am anyway. */ { ... }: null;
+  nonStrict =
+    /**
+      My syntax is not strict, but I'm strict anyway.
+    */
+    x: x;
+  strict =
+    /**
+      I don't have to be strict, but I am anyway.
+    */
+    { ... }: null;
   # Note that pre and post are the same here. I just had to name them somehow.
-  strictPre = /** Here's one way to do this */ a@{ ... }: a;
-  strictPost = /** Here's another way to do this */ { ... }@a: a;
+  strictPre =
+    /**
+      Here's one way to do this
+    */
+    a@{ ... }: a;
+  strictPost =
+    /**
+      Here's another way to do this
+    */
+    { ... }@a: a;
 
   # TODO
 
-  /** You won't see this. */
+  /**
+    You won't see this.
+  */
   curriedArgs =
-    /** A documented function. */
+    /**
+      A documented function.
+    */
     x:
-    /** The function returned by applying once */
+    /**
+      The function returned by applying once
+    */
     y:
-    /** A function body performing summation of two items */
+    /**
+      A function body performing summation of two items
+    */
     x + y;
 
-  /** Documented formals (but you won't see this comment) */
+  /**
+    Documented formals (but you won't see this comment)
+  */
   documentedFormals =
-    /** Finds x */
-    { /** The x attribute */
-      x
-    }: x;
+    /**
+      Finds x
+    */
+    {
+      /**
+        The x attribute
+      */
+      x,
+    }:
+    x;
 }
diff --git a/tests/functional/repl/doc-functor.nix b/tests/functional/repl/doc-functor.nix
index f526f453f..8a663886c 100644
--- a/tests/functional/repl/doc-functor.nix
+++ b/tests/functional/repl/doc-functor.nix
@@ -25,14 +25,14 @@ rec {
   makeOverridable = f: {
     /**
       This is a function that can be overridden.
-     */
+    */
     __functor = self: f;
     override = throw "not implemented";
   };
 
   /**
     Compute x^2
-   */
+  */
   square = x: x * x;
 
   helper = makeOverridable square;
@@ -41,8 +41,14 @@ rec {
   makeVeryOverridable = f: {
     /**
       This is a function that can be overridden.
-     */
-    __functor = self: arg: f arg // { override = throw "not implemented"; overrideAttrs = throw "not implemented"; };
+    */
+    __functor =
+      self: arg:
+      f arg
+      // {
+        override = throw "not implemented";
+        overrideAttrs = throw "not implemented";
+      };
     override = throw "not implemented";
   };
 
@@ -64,7 +70,6 @@ rec {
   */
   helper3 = makeVeryOverridable (x: x * x * x);
 
-
   # ------
 
   # getDoc traverses a potentially infinite structure in case of __functor, so
@@ -73,7 +78,7 @@ rec {
   recursive = {
     /**
       This looks bad, but the docs are ok because of the eta expansion.
-     */
+    */
     __functor = self: x: self x;
   };
 
@@ -81,21 +86,23 @@ rec {
     /**
       Docs probably won't work in this case, because the "partial" application
       of self results in an infinite recursion.
-     */
+    */
     __functor = self: self.__functor self;
   };
 
-  diverging = let
-    /**
-      Docs probably won't work in this case, because the "partial" application
-      of self results in an diverging computation that causes a stack overflow.
-      It's not an infinite recursion because each call is different.
-      This must be handled by the documentation retrieval logic, as it
-      reimplements the __functor invocation to be partial.
-     */
-    f = x: {
-      __functor = self: (f (x + 1));
-    };
-  in f null;
+  diverging =
+    let
+      /**
+        Docs probably won't work in this case, because the "partial" application
+        of self results in an diverging computation that causes a stack overflow.
+        It's not an infinite recursion because each call is different.
+        This must be handled by the documentation retrieval logic, as it
+        reimplements the __functor invocation to be partial.
+      */
+      f = x: {
+        __functor = self: (f (x + 1));
+      };
+    in
+    f null;
 
 }
diff --git a/tests/functional/secure-drv-outputs.nix b/tests/functional/secure-drv-outputs.nix
index b4ac8ff53..169c3c587 100644
--- a/tests/functional/secure-drv-outputs.nix
+++ b/tests/functional/secure-drv-outputs.nix
@@ -4,20 +4,18 @@ with import ./config.nix;
 
   good = mkDerivation {
     name = "good";
-    builder = builtins.toFile "builder"
-      ''
-        mkdir $out
-        echo > $out/good
-      '';
+    builder = builtins.toFile "builder" ''
+      mkdir $out
+      echo > $out/good
+    '';
   };
 
   bad = mkDerivation {
     name = "good";
-    builder = builtins.toFile "builder"
-      ''
-        mkdir $out
-        echo > $out/bad
-      '';
+    builder = builtins.toFile "builder" ''
+      mkdir $out
+      echo > $out/bad
+    '';
   };
 
 }
diff --git a/tests/functional/shell-hello.nix b/tests/functional/shell-hello.nix
index c920d7cb4..470798dd9 100644
--- a/tests/functional/shell-hello.nix
+++ b/tests/functional/shell-hello.nix
@@ -3,57 +3,56 @@ with import ./config.nix;
 rec {
   hello = mkDerivation {
     name = "hello";
-    outputs = [ "out" "dev" ];
+    outputs = [
+      "out"
+      "dev"
+    ];
     meta.outputsToInstall = [ "out" ];
-    buildCommand =
-      ''
-        mkdir -p $out/bin $dev/bin
+    buildCommand = ''
+      mkdir -p $out/bin $dev/bin
 
-        cat > $out/bin/hello <<EOF
-        #! ${shell}
-        who=\$1
-        echo "Hello \''${who:-World} from $out/bin/hello"
-        EOF
-        chmod +x $out/bin/hello
+      cat > $out/bin/hello <<EOF
+      #! ${shell}
+      who=\$1
+      echo "Hello \''${who:-World} from $out/bin/hello"
+      EOF
+      chmod +x $out/bin/hello
 
-        cat > $dev/bin/hello2 <<EOF
-        #! ${shell}
-        echo "Hello2"
-        EOF
-        chmod +x $dev/bin/hello2
-      '';
+      cat > $dev/bin/hello2 <<EOF
+      #! ${shell}
+      echo "Hello2"
+      EOF
+      chmod +x $dev/bin/hello2
+    '';
   };
 
   hello-symlink = mkDerivation {
     name = "hello-symlink";
-    buildCommand =
-      ''
-        ln -s ${hello} $out
-      '';
+    buildCommand = ''
+      ln -s ${hello} $out
+    '';
   };
 
   forbidden-symlink = mkDerivation {
     name = "forbidden-symlink";
-    buildCommand =
-      ''
-        ln -s /tmp/foo/bar $out
-      '';
+    buildCommand = ''
+      ln -s /tmp/foo/bar $out
+    '';
   };
 
   salve-mundi = mkDerivation {
     name = "salve-mundi";
     outputs = [ "out" ];
     meta.outputsToInstall = [ "out" ];
-    buildCommand =
-      ''
-        mkdir -p $out/bin
+    buildCommand = ''
+      mkdir -p $out/bin
 
-        cat > $out/bin/hello <<EOF
-        #! ${shell}
-        echo "Salve Mundi from $out/bin/hello"
-        EOF
-        chmod +x $out/bin/hello
-      '';
+      cat > $out/bin/hello <<EOF
+      #! ${shell}
+      echo "Salve Mundi from $out/bin/hello"
+      EOF
+      chmod +x $out/bin/hello
+    '';
   };
 
   # execs env from PATH, so that we can probe the environment
@@ -61,20 +60,19 @@ rec {
   env = mkDerivation {
     name = "env";
     outputs = [ "out" ];
-    buildCommand =
-      ''
-        mkdir -p $out/bin
+    buildCommand = ''
+      mkdir -p $out/bin
 
-        cat > $out/bin/env <<EOF
-        #! ${shell}
-        if [ $# -ne 0 ]; then
-          echo "env: Unexpected arguments ($#): $@" 1>&2
-          exit 1
-        fi
-        exec env
-        EOF
-        chmod +x $out/bin/env
-      '';
+      cat > $out/bin/env <<EOF
+      #! ${shell}
+      if [ $# -ne 0 ]; then
+        echo "env: Unexpected arguments ($#): $@" 1>&2
+        exit 1
+      fi
+      exec env
+      EOF
+      chmod +x $out/bin/env
+    '';
   };
 
 }
diff --git a/tests/functional/shell.nix b/tests/functional/shell.nix
index 4b1a0623a..5e9f48818 100644
--- a/tests/functional/shell.nix
+++ b/tests/functional/shell.nix
@@ -1,102 +1,130 @@
-{ inNixShell ? false, contentAddressed ? false, fooContents ? "foo" }:
+{
+  inNixShell ? false,
+  contentAddressed ? false,
+  fooContents ? "foo",
+}:
 
-let cfg = import ./config.nix; in
+let
+  cfg = import ./config.nix;
+in
 with cfg;
 
 let
   mkDerivation =
     if contentAddressed then
-      args: cfg.mkDerivation ({
-        __contentAddressed = true;
-        outputHashMode = "recursive";
-        outputHashAlgo = "sha256";
-      } // args)
-    else cfg.mkDerivation;
+      args:
+      cfg.mkDerivation (
+        {
+          __contentAddressed = true;
+          outputHashMode = "recursive";
+          outputHashAlgo = "sha256";
+        }
+        // args
+      )
+    else
+      cfg.mkDerivation;
 in
 
-let pkgs = rec {
-  setupSh = builtins.toFile "setup" ''
-    export VAR_FROM_STDENV_SETUP=foo
-    for pkg in $buildInputs; do
-      export PATH=$PATH:$pkg/bin
-    done
+let
+  pkgs = rec {
+    setupSh = builtins.toFile "setup" ''
+      export VAR_FROM_STDENV_SETUP=foo
+      for pkg in $buildInputs; do
+        export PATH=$PATH:$pkg/bin
+      done
 
-    declare -a arr1=(1 2 "3 4" 5)
-    declare -a arr2=(x $'\n' $'x\ny')
-    fun() {
-      echo blabla
-    }
-    runHook() {
-      eval "''${!1}"
-    }
-  '';
-
-  stdenv = mkDerivation {
-    name = "stdenv";
-    buildCommand = ''
-      mkdir -p $out
-      ln -s ${setupSh} $out/setup
+      declare -a arr1=(1 2 "3 4" 5)
+      declare -a arr2=(x $'\n' $'x\ny')
+      fun() {
+        echo blabla
+      }
+      runHook() {
+        eval "''${!1}"
+      }
     '';
-  } // { inherit mkDerivation; };
 
-  shellDrv = mkDerivation {
-    name = "shellDrv";
-    builder = "/does/not/exist";
-    VAR_FROM_NIX = "bar";
-    ASCII_PERCENT = "%";
-    ASCII_AT = "@";
-    TEST_inNixShell = if inNixShell then "true" else "false";
-    FOO = fooContents;
-    inherit stdenv;
-    outputs = ["dev" "out"];
-  } // {
-    shellHook = abort "Ignore non-drv shellHook attr";
-  };
+    stdenv =
+      mkDerivation {
+        name = "stdenv";
+        buildCommand = ''
+          mkdir -p $out
+          ln -s ${setupSh} $out/setup
+        '';
+      }
+      // {
+        inherit mkDerivation;
+      };
 
-  # https://github.com/NixOS/nix/issues/5431
-  # See nix-shell.sh
-  polo = mkDerivation {
-    name = "polo";
-    inherit stdenv;
-    shellHook = ''
-      echo Polo
+    shellDrv =
+      mkDerivation {
+        name = "shellDrv";
+        builder = "/does/not/exist";
+        VAR_FROM_NIX = "bar";
+        ASCII_PERCENT = "%";
+        ASCII_AT = "@";
+        TEST_inNixShell = if inNixShell then "true" else "false";
+        FOO = fooContents;
+        inherit stdenv;
+        outputs = [
+          "dev"
+          "out"
+        ];
+      }
+      // {
+        shellHook = abort "Ignore non-drv shellHook attr";
+      };
+
+    # https://github.com/NixOS/nix/issues/5431
+    # See nix-shell.sh
+    polo = mkDerivation {
+      name = "polo";
+      inherit stdenv;
+      shellHook = ''
+        echo Polo
+      '';
+    };
+
+    # Used by nix-shell -p
+    runCommand =
+      name: args: buildCommand:
+      mkDerivation (
+        args
+        // {
+          inherit name buildCommand stdenv;
+        }
+      );
+
+    foo = runCommand "foo" { } ''
+      mkdir -p $out/bin
+      echo 'echo ${fooContents}' > $out/bin/foo
+      chmod a+rx $out/bin/foo
+      ln -s ${shell} $out/bin/bash
     '';
+
+    bar = runCommand "bar" { } ''
+      mkdir -p $out/bin
+      echo 'echo bar' > $out/bin/bar
+      chmod a+rx $out/bin/bar
+    '';
+
+    bash = shell;
+    bashInteractive = runCommand "bash" { } ''
+      mkdir -p $out/bin
+      ln -s ${shell} $out/bin/bash
+    '';
+
+    # ruby "interpreter" that outputs "$@"
+    ruby = runCommand "ruby" { } ''
+      mkdir -p $out/bin
+      echo 'printf %s "$*"' > $out/bin/ruby
+      chmod a+rx $out/bin/ruby
+    '';
+
+    inherit (cfg) shell;
+
+    callPackage = f: args: f (pkgs // args);
+
+    inherit pkgs;
   };
-
-  # Used by nix-shell -p
-  runCommand = name: args: buildCommand: mkDerivation (args // {
-    inherit name buildCommand stdenv;
-  });
-
-  foo = runCommand "foo" {} ''
-    mkdir -p $out/bin
-    echo 'echo ${fooContents}' > $out/bin/foo
-    chmod a+rx $out/bin/foo
-    ln -s ${shell} $out/bin/bash
-  '';
-
-  bar = runCommand "bar" {} ''
-    mkdir -p $out/bin
-    echo 'echo bar' > $out/bin/bar
-    chmod a+rx $out/bin/bar
-  '';
-
-  bash = shell;
-  bashInteractive = runCommand "bash" {} ''
-    mkdir -p $out/bin
-    ln -s ${shell} $out/bin/bash
-  '';
-
-  # ruby "interpreter" that outputs "$@"
-  ruby = runCommand "ruby" {} ''
-    mkdir -p $out/bin
-    echo 'printf %s "$*"' > $out/bin/ruby
-    chmod a+rx $out/bin/ruby
-  '';
-
-  inherit (cfg) shell;
-
-  callPackage = f: args: f (pkgs // args);
-
-  inherit pkgs;
-}; in pkgs
+in
+pkgs
diff --git a/tests/functional/simple-failing.nix b/tests/functional/simple-failing.nix
index d176c9c51..6cf29ae38 100644
--- a/tests/functional/simple-failing.nix
+++ b/tests/functional/simple-failing.nix
@@ -2,11 +2,10 @@ with import ./config.nix;
 
 mkDerivation {
   name = "simple-failing";
-  builder = builtins.toFile "builder.sh"
-    ''
-      echo "This should fail"
-      exit 1
-    '';
+  builder = builtins.toFile "builder.sh" ''
+    echo "This should fail"
+    exit 1
+  '';
   PATH = "";
   goodPath = path;
 }
diff --git a/tests/functional/structured-attrs-shell.nix b/tests/functional/structured-attrs-shell.nix
index 57c1e6bd2..a819e39cd 100644
--- a/tests/functional/structured-attrs-shell.nix
+++ b/tests/functional/structured-attrs-shell.nix
@@ -12,8 +12,15 @@ mkDerivation {
   name = "structured2";
   __structuredAttrs = true;
   inherit stdenv;
-  outputs = [ "out" "dev" ];
-  my.list = [ "a" "b" "c" ];
+  outputs = [
+    "out"
+    "dev"
+  ];
+  my.list = [
+    "a"
+    "b"
+    "c"
+  ];
   exportReferencesGraph.refs = [ dep ];
   buildCommand = ''
     touch ''${outputs[out]}; touch ''${outputs[dev]}
diff --git a/tests/functional/structured-attrs.nix b/tests/functional/structured-attrs.nix
index e93139a44..4e1984517 100644
--- a/tests/functional/structured-attrs.nix
+++ b/tests/functional/structured-attrs.nix
@@ -16,7 +16,10 @@ mkDerivation {
 
   __structuredAttrs = true;
 
-  outputs = [ "out" "dev" ];
+  outputs = [
+    "out"
+    "dev"
+  ];
 
   buildCommand = ''
     set -x
@@ -43,12 +46,24 @@ mkDerivation {
     [[ $json =~ '"references":[]' ]]
   '';
 
-  buildInputs = [ "a" "b" "c" 123 "'" "\"" null ];
+  buildInputs = [
+    "a"
+    "b"
+    "c"
+    123
+    "'"
+    "\""
+    null
+  ];
 
   hardening.format = true;
   hardening.fortify = false;
 
-  outer.inner = [ 1 2 3 ];
+  outer.inner = [
+    1
+    2
+    3
+  ];
 
   int = 123456789;
 
diff --git a/tests/functional/undefined-variable.nix b/tests/functional/undefined-variable.nix
index 579985497..8e88dd8fe 100644
--- a/tests/functional/undefined-variable.nix
+++ b/tests/functional/undefined-variable.nix
@@ -1 +1,4 @@
-let f = builtins.toFile "test-file.nix" "asd"; in import f
+let
+  f = builtins.toFile "test-file.nix" "asd";
+in
+import f
diff --git a/tests/functional/user-envs.nix b/tests/functional/user-envs.nix
index 46f8b51dd..cc63812c4 100644
--- a/tests/functional/user-envs.nix
+++ b/tests/functional/user-envs.nix
@@ -1,5 +1,6 @@
 # Some dummy arguments...
-{ foo ? "foo"
+{
+  foo ? "foo",
 }:
 
 with import ./config.nix;
@@ -8,27 +9,41 @@ assert foo == "foo";
 
 let
 
-  platforms = let x = "foobar"; in [ x x ];
+  platforms =
+    let
+      x = "foobar";
+    in
+    [
+      x
+      x
+    ];
 
-  makeDrv = name: progName: (mkDerivation {
-    name = assert progName != "fail"; name;
-    inherit progName system;
-    builder = ./user-envs.builder.sh;
-  } // {
-    meta = {
-      description = "A silly test package with some \${escaped anti-quotation} in it";
-      inherit platforms;
-    };
-  });
+  makeDrv =
+    name: progName:
+    (
+      mkDerivation {
+        name =
+          assert progName != "fail";
+          name;
+        inherit progName system;
+        builder = ./user-envs.builder.sh;
+      }
+      // {
+        meta = {
+          description = "A silly test package with some \${escaped anti-quotation} in it";
+          inherit platforms;
+        };
+      }
+    );
 
 in
 
-  [
-    (makeDrv "foo-1.0" "foo")
-    (makeDrv "foo-2.0pre1" "foo")
-    (makeDrv "bar-0.1" "bar")
-    (makeDrv "foo-2.0" "foo")
-    (makeDrv "bar-0.1.1" "bar")
-    (makeDrv "foo-0.1" "foo" // { meta.priority = 10; })
-    (makeDrv "fail-0.1" "fail")
-  ]
+[
+  (makeDrv "foo-1.0" "foo")
+  (makeDrv "foo-2.0pre1" "foo")
+  (makeDrv "bar-0.1" "bar")
+  (makeDrv "foo-2.0" "foo")
+  (makeDrv "bar-0.1.1" "bar")
+  (makeDrv "foo-0.1" "foo" // { meta.priority = 10; })
+  (makeDrv "fail-0.1" "fail")
+]
diff --git a/tests/installer/default.nix b/tests/installer/default.nix
index 4aed6eae4..d48537dd0 100644
--- a/tests/installer/default.nix
+++ b/tests/installer/default.nix
@@ -1,5 +1,6 @@
-{ binaryTarballs
-, nixpkgsFor
+{
+  binaryTarballs,
+  nixpkgsFor,
 }:
 
 let
@@ -41,8 +42,9 @@ let
     };
   };
 
-  mockChannel = pkgs:
-    pkgs.runCommandNoCC "mock-channel" {} ''
+  mockChannel =
+    pkgs:
+    pkgs.runCommandNoCC "mock-channel" { } ''
       mkdir nixexprs
       mkdir -p $out/channel
       echo -n 'someContent' > nixexprs/someFile
@@ -54,14 +56,14 @@ let
   images = {
 
     /*
-    "ubuntu-14-04" = {
-      image = import <nix/fetchurl.nix> {
-        url = "https://app.vagrantup.com/ubuntu/boxes/trusty64/versions/20190514.0.0/providers/virtualbox.box";
-        hash = "sha256-iUUXyRY8iW7DGirb0zwGgf1fRbLA7wimTJKgP7l/OQ8=";
+      "ubuntu-14-04" = {
+        image = import <nix/fetchurl.nix> {
+          url = "https://app.vagrantup.com/ubuntu/boxes/trusty64/versions/20190514.0.0/providers/virtualbox.box";
+          hash = "sha256-iUUXyRY8iW7DGirb0zwGgf1fRbLA7wimTJKgP7l/OQ8=";
+        };
+        rootDisk = "box-disk1.vmdk";
+        system = "x86_64-linux";
       };
-      rootDisk = "box-disk1.vmdk";
-      system = "x86_64-linux";
-    };
     */
 
     "ubuntu-16-04" = {
@@ -95,14 +97,14 @@ let
     # Currently fails with 'error while loading shared libraries:
     # libsodium.so.23: cannot stat shared object: Invalid argument'.
     /*
-    "rhel-6" = {
-      image = import <nix/fetchurl.nix> {
-        url = "https://app.vagrantup.com/generic/boxes/rhel6/versions/4.1.12/providers/libvirt.box";
-        hash = "sha256-QwzbvRoRRGqUCQptM7X/InRWFSP2sqwRt2HaaO6zBGM=";
+      "rhel-6" = {
+        image = import <nix/fetchurl.nix> {
+          url = "https://app.vagrantup.com/generic/boxes/rhel6/versions/4.1.12/providers/libvirt.box";
+          hash = "sha256-QwzbvRoRRGqUCQptM7X/InRWFSP2sqwRt2HaaO6zBGM=";
+        };
+        rootDisk = "box.img";
+        system = "x86_64-linux";
       };
-      rootDisk = "box.img";
-      system = "x86_64-linux";
-    };
     */
 
     "rhel-7" = {
@@ -137,12 +139,18 @@ let
 
   };
 
-  makeTest = imageName: testName:
-    let image = images.${imageName}; in
+  makeTest =
+    imageName: testName:
+    let
+      image = images.${imageName};
+    in
     with nixpkgsFor.${image.system}.native;
-    runCommand
-      "installer-test-${imageName}-${testName}"
-      { buildInputs = [ qemu_kvm openssh ];
+    runCommand "installer-test-${imageName}-${testName}"
+      {
+        buildInputs = [
+          qemu_kvm
+          openssh
+        ];
         image = image.image;
         postBoot = image.postBoot or "";
         installScript = installScripts.${testName}.script;
@@ -247,9 +255,6 @@ let
 
 in
 
-builtins.mapAttrs (imageName: image:
-  { ${image.system} = builtins.mapAttrs (testName: test:
-      makeTest imageName testName
-    ) installScripts;
-  }
-) images
+builtins.mapAttrs (imageName: image: {
+  ${image.system} = builtins.mapAttrs (testName: test: makeTest imageName testName) installScripts;
+}) images
diff --git a/tests/nixos/authorization.nix b/tests/nixos/authorization.nix
index fdeae06ed..6540e9fa3 100644
--- a/tests/nixos/authorization.nix
+++ b/tests/nixos/authorization.nix
@@ -4,8 +4,11 @@
   nodes.machine = {
     virtualisation.writableStore = true;
     # TODO add a test without allowed-users setting. allowed-users is uncommon among NixOS users.
-    nix.settings.allowed-users = ["alice" "bob"];
-    nix.settings.trusted-users = ["alice"];
+    nix.settings.allowed-users = [
+      "alice"
+      "bob"
+    ];
+    nix.settings.trusted-users = [ "alice" ];
 
     users.users.alice.isNormalUser = true;
     users.users.bob.isNormalUser = true;
@@ -15,80 +18,80 @@
   };
 
   testScript =
-  let
-    pathFour = "/nix/store/20xfy868aiic0r0flgzq4n5dq1yvmxkn-four";
-  in
-  ''
-    machine.wait_for_unit("multi-user.target")
-    machine.succeed("""
-      exec 1>&2
-      echo kSELDhobKaF8/VdxIxdP7EQe+Q > one
-      diff $(nix store add-file one) one
-    """)
-    machine.succeed("""
-      su --login alice -c '
-        set -x
-        cd ~
-        echo ehHtmfuULXYyBV6NBk6QUi8iE0 > two
-        ls
-        diff $(echo $(nix store add-file two)) two' 1>&2
-    """)
-    machine.succeed("""
-      su --login bob -c '
-        set -x
-        cd ~
-        echo 0Jw8RNp7cK0W2AdNbcquofcOVk > three
-        diff $(nix store add-file three) three
-      ' 1>&2
-    """)
-
-    # We're going to check that a path is not created
-    machine.succeed("""
-      ! [[ -e ${pathFour} ]]
-    """)
-    machine.succeed("""
-      su --login mallory -c '
-        set -x
-        cd ~
-        echo 5mgtDj0ohrWkT50TLR0f4tIIxY > four;
-        (! nix store add-file four 2>&1) | grep -F "cannot open connection to remote store"
-        (! nix store add-file four 2>&1) | grep -F "Connection reset by peer"
-        ! [[ -e ${pathFour} ]]
-      ' 1>&2
-    """)
-
-    # Check that the file _can_ be added, and matches the expected path we were checking
-    machine.succeed("""
-      exec 1>&2
-      echo 5mgtDj0ohrWkT50TLR0f4tIIxY > four
-      four="$(nix store add-file four)"
-      diff $four four
-      diff <(echo $four) <(echo ${pathFour})
-    """)
-
-    machine.succeed("""
-      su --login alice -c 'nix-store --verify --repair'
-    """)
-
-    machine.succeed("""
-      set -x
-      su --login bob -c '(! nix-store --verify --repair 2>&1)' | tee diag 1>&2
-      grep -F "you are not privileged to repair paths" diag
-    """)
-
-    machine.succeed("""
-        set -x
-        su --login mallory -c '
-          nix-store --generate-binary-cache-key cache1.example.org sk1 pk1
-          (! nix store sign --key-file sk1 ${pathFour} 2>&1)' | tee diag 1>&2
-        grep -F "cannot open connection to remote store 'daemon'" diag
-    """)
-
-    machine.succeed("""
+    let
+      pathFour = "/nix/store/20xfy868aiic0r0flgzq4n5dq1yvmxkn-four";
+    in
+    ''
+      machine.wait_for_unit("multi-user.target")
+      machine.succeed("""
+        exec 1>&2
+        echo kSELDhobKaF8/VdxIxdP7EQe+Q > one
+        diff $(nix store add-file one) one
+      """)
+      machine.succeed("""
+        su --login alice -c '
+          set -x
+          cd ~
+          echo ehHtmfuULXYyBV6NBk6QUi8iE0 > two
+          ls
+          diff $(echo $(nix store add-file two)) two' 1>&2
+      """)
+      machine.succeed("""
         su --login bob -c '
-          nix-store --generate-binary-cache-key cache1.example.org sk1 pk1
-          nix store sign --key-file sk1 ${pathFour}
-        '
-    """)
-  '';
+          set -x
+          cd ~
+          echo 0Jw8RNp7cK0W2AdNbcquofcOVk > three
+          diff $(nix store add-file three) three
+        ' 1>&2
+      """)
+
+      # We're going to check that a path is not created
+      machine.succeed("""
+        ! [[ -e ${pathFour} ]]
+      """)
+      machine.succeed("""
+        su --login mallory -c '
+          set -x
+          cd ~
+          echo 5mgtDj0ohrWkT50TLR0f4tIIxY > four;
+          (! nix store add-file four 2>&1) | grep -F "cannot open connection to remote store"
+          (! nix store add-file four 2>&1) | grep -F "Connection reset by peer"
+          ! [[ -e ${pathFour} ]]
+        ' 1>&2
+      """)
+
+      # Check that the file _can_ be added, and matches the expected path we were checking
+      machine.succeed("""
+        exec 1>&2
+        echo 5mgtDj0ohrWkT50TLR0f4tIIxY > four
+        four="$(nix store add-file four)"
+        diff $four four
+        diff <(echo $four) <(echo ${pathFour})
+      """)
+
+      machine.succeed("""
+        su --login alice -c 'nix-store --verify --repair'
+      """)
+
+      machine.succeed("""
+        set -x
+        su --login bob -c '(! nix-store --verify --repair 2>&1)' | tee diag 1>&2
+        grep -F "you are not privileged to repair paths" diag
+      """)
+
+      machine.succeed("""
+          set -x
+          su --login mallory -c '
+            nix-store --generate-binary-cache-key cache1.example.org sk1 pk1
+            (! nix store sign --key-file sk1 ${pathFour} 2>&1)' | tee diag 1>&2
+          grep -F "cannot open connection to remote store 'daemon'" diag
+      """)
+
+      machine.succeed("""
+          su --login bob -c '
+            nix-store --generate-binary-cache-key cache1.example.org sk1 pk1
+            nix store sign --key-file sk1 ${pathFour}
+          '
+      """)
+    '';
 }
diff --git a/tests/nixos/ca-fd-leak/default.nix b/tests/nixos/ca-fd-leak/default.nix
index a6ae72adc..902aacdc6 100644
--- a/tests/nixos/ca-fd-leak/default.nix
+++ b/tests/nixos/ca-fd-leak/default.nix
@@ -27,12 +27,15 @@ let
   # domain socket.
   # Compiled statically so that we can easily send it to the VM and use it
   # inside the build sandbox.
-  sender = pkgs.runCommandWith {
-    name = "sender";
-    stdenv = pkgs.pkgsStatic.stdenv;
-  } ''
-    $CC -static -o $out ${./sender.c}
-  '';
+  sender =
+    pkgs.runCommandWith
+      {
+        name = "sender";
+        stdenv = pkgs.pkgsStatic.stdenv;
+      }
+      ''
+        $CC -static -o $out ${./sender.c}
+      '';
 
   # Okay, so we have a file descriptor shipped out of the FOD now. But the
   # Nix store is read-only, right? .. Well, yeah. But this file descriptor
@@ -47,44 +50,57 @@ in
   name = "ca-fd-leak";
 
   nodes.machine =
-    { config, lib, pkgs, ... }:
-    { virtualisation.writableStore = true;
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      virtualisation.writableStore = true;
       nix.settings.substituters = lib.mkForce [ ];
-      virtualisation.additionalPaths = [ pkgs.busybox-sandbox-shell sender smuggler pkgs.socat ];
+      virtualisation.additionalPaths = [
+        pkgs.busybox-sandbox-shell
+        sender
+        smuggler
+        pkgs.socat
+      ];
     };
 
-  testScript = { nodes }: ''
-    start_all()
+  testScript =
+    { nodes }:
+    ''
+      start_all()
 
-    machine.succeed("echo hello")
-    # Start the smuggler server
-    machine.succeed("${smuggler}/bin/smuggler ${socketName} >&2 &")
+      machine.succeed("echo hello")
+      # Start the smuggler server
+      machine.succeed("${smuggler}/bin/smuggler ${socketName} >&2 &")
 
-    # Build the smuggled derivation.
-    # This will connect to the smuggler server and send it the file descriptor
-    machine.succeed(r"""
-      nix-build -E '
-        builtins.derivation {
-          name = "smuggled";
-          system = builtins.currentSystem;
-          # look ma, no tricks!
-          outputHashMode = "flat";
-          outputHashAlgo = "sha256";
-          outputHash = builtins.hashString "sha256" "hello, world\n";
-          builder = "${pkgs.busybox-sandbox-shell}/bin/sh";
-          args = [ "-c" "echo \"hello, world\" > $out; ''${${sender}} ${socketName}" ];
-      }'
-    """.strip())
+      # Build the smuggled derivation.
+      # This will connect to the smuggler server and send it the file descriptor
+      machine.succeed(r"""
+        nix-build -E '
+          builtins.derivation {
+            name = "smuggled";
+            system = builtins.currentSystem;
+            # look ma, no tricks!
+            outputHashMode = "flat";
+            outputHashAlgo = "sha256";
+            outputHash = builtins.hashString "sha256" "hello, world\n";
+            builder = "${pkgs.busybox-sandbox-shell}/bin/sh";
+            args = [ "-c" "echo \"hello, world\" > $out; ''${${sender}} ${socketName}" ];
+        }'
+      """.strip())
 
 
-    # Tell the smuggler server that we're done
-    machine.execute("echo done | ${pkgs.socat}/bin/socat - ABSTRACT-CONNECT:${socketName}")
+      # Tell the smuggler server that we're done
+      machine.execute("echo done | ${pkgs.socat}/bin/socat - ABSTRACT-CONNECT:${socketName}")
 
-    # Check that the file was not modified
-    machine.succeed(r"""
-      cat ./result
-      test "$(cat ./result)" = "hello, world"
-    """.strip())
-  '';
+      # Check that the file was not modified
+      machine.succeed(r"""
+        cat ./result
+        test "$(cat ./result)" = "hello, world"
+      """.strip())
+    '';
 
 }
diff --git a/tests/nixos/cgroups/default.nix b/tests/nixos/cgroups/default.nix
index b8febbf4b..a6b4bca8c 100644
--- a/tests/nixos/cgroups/default.nix
+++ b/tests/nixos/cgroups/default.nix
@@ -3,38 +3,39 @@
 {
   name = "cgroups";
 
-  nodes =
-    {
-      host =
-        { config, pkgs, ... }:
-        { virtualisation.additionalPaths = [ pkgs.stdenvNoCC ];
-          nix.extraOptions =
-            ''
-              extra-experimental-features = nix-command auto-allocate-uids cgroups
-              extra-system-features = uid-range
-            '';
-          nix.settings.use-cgroups = true;
-          nix.nixPath = [ "nixpkgs=${nixpkgs}" ];
-        };
-    };
+  nodes = {
+    host =
+      { config, pkgs, ... }:
+      {
+        virtualisation.additionalPaths = [ pkgs.stdenvNoCC ];
+        nix.extraOptions = ''
+          extra-experimental-features = nix-command auto-allocate-uids cgroups
+          extra-system-features = uid-range
+        '';
+        nix.settings.use-cgroups = true;
+        nix.nixPath = [ "nixpkgs=${nixpkgs}" ];
+      };
+  };
 
-  testScript = { nodes }: ''
-    start_all()
+  testScript =
+    { nodes }:
+    ''
+      start_all()
 
-    host.wait_for_unit("multi-user.target")
+      host.wait_for_unit("multi-user.target")
 
-    # Start build in background
-    host.execute("NIX_REMOTE=daemon nix build --auto-allocate-uids --file ${./hang.nix} >&2 &")
-    service = "/sys/fs/cgroup/system.slice/nix-daemon.service"
+      # Start build in background
+      host.execute("NIX_REMOTE=daemon nix build --auto-allocate-uids --file ${./hang.nix} >&2 &")
+      service = "/sys/fs/cgroup/system.slice/nix-daemon.service"
 
-    # Wait for cgroups to be created
-    host.succeed(f"until [ -e {service}/nix-daemon ]; do sleep 1; done", timeout=30)
-    host.succeed(f"until [ -e {service}/nix-build-uid-* ]; do sleep 1; done", timeout=30)
+      # Wait for cgroups to be created
+      host.succeed(f"until [ -e {service}/nix-daemon ]; do sleep 1; done", timeout=30)
+      host.succeed(f"until [ -e {service}/nix-build-uid-* ]; do sleep 1; done", timeout=30)
 
-    # Check that there aren't processes where there shouldn't be, and that there are where there should be
-    host.succeed(f'[ -z "$(cat {service}/cgroup.procs)" ]')
-    host.succeed(f'[ -n "$(cat {service}/nix-daemon/cgroup.procs)" ]')
-    host.succeed(f'[ -n "$(cat {service}/nix-build-uid-*/cgroup.procs)" ]')
-  '';
+      # Check that there aren't processes where there shouldn't be, and that there are where there should be
+      host.succeed(f'[ -z "$(cat {service}/cgroup.procs)" ]')
+      host.succeed(f'[ -n "$(cat {service}/nix-daemon/cgroup.procs)" ]')
+      host.succeed(f'[ -n "$(cat {service}/nix-build-uid-*/cgroup.procs)" ]')
+    '';
 
 }
diff --git a/tests/nixos/cgroups/hang.nix b/tests/nixos/cgroups/hang.nix
index cefe2d031..d7b337b0c 100644
--- a/tests/nixos/cgroups/hang.nix
+++ b/tests/nixos/cgroups/hang.nix
@@ -1,9 +1,10 @@
 { }:
 
-with import <nixpkgs> {};
+with import <nixpkgs> { };
 
 runCommand "hang"
-  { requiredSystemFeatures = "uid-range";
+  {
+    requiredSystemFeatures = "uid-range";
   }
   ''
     sleep infinity
diff --git a/tests/nixos/chroot-store.nix b/tests/nixos/chroot-store.nix
index 4b167fc38..f89a20bc4 100644
--- a/tests/nixos/chroot-store.nix
+++ b/tests/nixos/chroot-store.nix
@@ -1,31 +1,45 @@
-{ lib, config, nixpkgs, ... }:
+{
+  lib,
+  config,
+  nixpkgs,
+  ...
+}:
 
 let
   pkgs = config.nodes.machine.nixpkgs.pkgs;
   pkgA = pkgs.hello;
   pkgB = pkgs.cowsay;
-in {
+in
+{
   name = "chroot-store";
 
-  nodes =
-    { machine =
-        { config, lib, pkgs, ... }:
-        { virtualisation.writableStore = true;
-          virtualisation.additionalPaths = [ pkgA ];
-          environment.systemPackages = [ pkgB ];
-          nix.extraOptions = "experimental-features = nix-command";
-        };
-    };
+  nodes = {
+    machine =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
+        virtualisation.writableStore = true;
+        virtualisation.additionalPaths = [ pkgA ];
+        environment.systemPackages = [ pkgB ];
+        nix.extraOptions = "experimental-features = nix-command";
+      };
+  };
 
-  testScript = { nodes }: ''
-    # fmt: off
-    start_all()
+  testScript =
+    { nodes }:
+    ''
+      # fmt: off
+      start_all()
 
-    machine.succeed("nix copy --no-check-sigs --to /tmp/nix ${pkgA}")
+      machine.succeed("nix copy --no-check-sigs --to /tmp/nix ${pkgA}")
 
-    machine.succeed("nix shell --store /tmp/nix ${pkgA} --command hello >&2")
+      machine.succeed("nix shell --store /tmp/nix ${pkgA} --command hello >&2")
 
-    # Test that /nix/store is available via an overlayfs mount.
-    machine.succeed("nix shell --store /tmp/nix ${pkgA} --command cowsay foo >&2")
-  '';
+      # Test that /nix/store is available via an overlayfs mount.
+      machine.succeed("nix shell --store /tmp/nix ${pkgA} --command cowsay foo >&2")
+    '';
 }
diff --git a/tests/nixos/containers/containers.nix b/tests/nixos/containers/containers.nix
index 6773f5628..b590dc849 100644
--- a/tests/nixos/containers/containers.nix
+++ b/tests/nixos/containers/containers.nix
@@ -4,60 +4,67 @@
 {
   name = "containers";
 
-  nodes =
-    {
-      host =
-        { config, lib, pkgs, nodes, ... }:
-        { virtualisation.writableStore = true;
-          virtualisation.diskSize = 2048;
-          virtualisation.additionalPaths =
-            [ pkgs.stdenvNoCC
-              (import ./systemd-nspawn.nix { inherit nixpkgs; }).toplevel
-            ];
-          virtualisation.memorySize = 4096;
-          nix.settings.substituters = lib.mkForce [ ];
-          nix.extraOptions =
-            ''
-              extra-experimental-features = nix-command auto-allocate-uids cgroups
-              extra-system-features = uid-range
-            '';
-          nix.nixPath = [ "nixpkgs=${nixpkgs}" ];
-        };
-    };
+  nodes = {
+    host =
+      {
+        config,
+        lib,
+        pkgs,
+        nodes,
+        ...
+      }:
+      {
+        virtualisation.writableStore = true;
+        virtualisation.diskSize = 2048;
+        virtualisation.additionalPaths = [
+          pkgs.stdenvNoCC
+          (import ./systemd-nspawn.nix { inherit nixpkgs; }).toplevel
+        ];
+        virtualisation.memorySize = 4096;
+        nix.settings.substituters = lib.mkForce [ ];
+        nix.extraOptions = ''
+          extra-experimental-features = nix-command auto-allocate-uids cgroups
+          extra-system-features = uid-range
+        '';
+        nix.nixPath = [ "nixpkgs=${nixpkgs}" ];
+      };
+  };
 
-  testScript = { nodes }: ''
-    start_all()
+  testScript =
+    { nodes }:
+    ''
+      start_all()
 
-    host.succeed("nix --version >&2")
+      host.succeed("nix --version >&2")
 
-    # Test that 'id' gives the expected result in various configurations.
+      # Test that 'id' gives the expected result in various configurations.
 
-    # Existing UIDs, sandbox.
-    host.succeed("nix build --no-auto-allocate-uids --sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-1")
-    host.succeed("[[ $(cat ./result) = 'uid=1000(nixbld) gid=100(nixbld) groups=100(nixbld)' ]]")
+      # Existing UIDs, sandbox.
+      host.succeed("nix build --no-auto-allocate-uids --sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-1")
+      host.succeed("[[ $(cat ./result) = 'uid=1000(nixbld) gid=100(nixbld) groups=100(nixbld)' ]]")
 
-    # Existing UIDs, no sandbox.
-    host.succeed("nix build --no-auto-allocate-uids --no-sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-2")
-    host.succeed("[[ $(cat ./result) = 'uid=30001(nixbld1) gid=30000(nixbld) groups=30000(nixbld)' ]]")
+      # Existing UIDs, no sandbox.
+      host.succeed("nix build --no-auto-allocate-uids --no-sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-2")
+      host.succeed("[[ $(cat ./result) = 'uid=30001(nixbld1) gid=30000(nixbld) groups=30000(nixbld)' ]]")
 
-    # Auto-allocated UIDs, sandbox.
-    host.succeed("nix build --auto-allocate-uids --sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-3")
-    host.succeed("[[ $(cat ./result) = 'uid=1000(nixbld) gid=100(nixbld) groups=100(nixbld)' ]]")
+      # Auto-allocated UIDs, sandbox.
+      host.succeed("nix build --auto-allocate-uids --sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-3")
+      host.succeed("[[ $(cat ./result) = 'uid=1000(nixbld) gid=100(nixbld) groups=100(nixbld)' ]]")
 
-    # Auto-allocated UIDs, no sandbox.
-    host.succeed("nix build --auto-allocate-uids --no-sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-4")
-    host.succeed("[[ $(cat ./result) = 'uid=872415232 gid=30000(nixbld) groups=30000(nixbld)' ]]")
+      # Auto-allocated UIDs, no sandbox.
+      host.succeed("nix build --auto-allocate-uids --no-sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-4")
+      host.succeed("[[ $(cat ./result) = 'uid=872415232 gid=30000(nixbld) groups=30000(nixbld)' ]]")
 
-    # Auto-allocated UIDs, UID range, sandbox.
-    host.succeed("nix build --auto-allocate-uids --sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-5 --arg uidRange true")
-    host.succeed("[[ $(cat ./result) = 'uid=0(root) gid=0(root) groups=0(root)' ]]")
+      # Auto-allocated UIDs, UID range, sandbox.
+      host.succeed("nix build --auto-allocate-uids --sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-5 --arg uidRange true")
+      host.succeed("[[ $(cat ./result) = 'uid=0(root) gid=0(root) groups=0(root)' ]]")
 
-    # Auto-allocated UIDs, UID range, no sandbox.
-    host.fail("nix build --auto-allocate-uids --no-sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-6 --arg uidRange true")
+      # Auto-allocated UIDs, UID range, no sandbox.
+      host.fail("nix build --auto-allocate-uids --no-sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-6 --arg uidRange true")
 
-    # Run systemd-nspawn in a Nix build.
-    host.succeed("nix build --auto-allocate-uids --sandbox -L --offline --impure --file ${./systemd-nspawn.nix} --argstr nixpkgs ${nixpkgs}")
-    host.succeed("[[ $(cat ./result/msg) = 'Hello World' ]]")
-  '';
+      # Run systemd-nspawn in a Nix build.
+      host.succeed("nix build --auto-allocate-uids --sandbox -L --offline --impure --file ${./systemd-nspawn.nix} --argstr nixpkgs ${nixpkgs}")
+      host.succeed("[[ $(cat ./result/msg) = 'Hello World' ]]")
+    '';
 
 }
diff --git a/tests/nixos/containers/id-test.nix b/tests/nixos/containers/id-test.nix
index 8eb9d38f9..2139327ad 100644
--- a/tests/nixos/containers/id-test.nix
+++ b/tests/nixos/containers/id-test.nix
@@ -1,8 +1,10 @@
-{ name, uidRange ? false }:
+{
+  name,
+  uidRange ? false,
+}:
 
-with import <nixpkgs> {};
+with import <nixpkgs> { };
 
-runCommand name
-  { requiredSystemFeatures = if uidRange then ["uid-range"] else [];
-  }
-  "id; id > $out"
+runCommand name {
+  requiredSystemFeatures = if uidRange then [ "uid-range" ] else [ ];
+} "id; id > $out"
diff --git a/tests/nixos/containers/systemd-nspawn.nix b/tests/nixos/containers/systemd-nspawn.nix
index 1dad4ebd7..4516f4e13 100644
--- a/tests/nixos/containers/systemd-nspawn.nix
+++ b/tests/nixos/containers/systemd-nspawn.nix
@@ -2,7 +2,8 @@
 
 let
 
-  machine = { config, pkgs, ... }:
+  machine =
+    { config, pkgs, ... }:
     {
       system.stateVersion = "22.05";
       boot.isContainer = true;
@@ -31,10 +32,12 @@ let
       };
     };
 
-  cfg = (import (nixpkgs + "/nixos/lib/eval-config.nix") {
-    modules = [ machine ];
-    system = "x86_64-linux";
-  });
+  cfg = (
+    import (nixpkgs + "/nixos/lib/eval-config.nix") {
+      modules = [ machine ];
+      system = "x86_64-linux";
+    }
+  );
 
   config = cfg.config;
 
@@ -43,7 +46,8 @@ in
 with cfg._module.args.pkgs;
 
 runCommand "test"
-  { buildInputs = [ config.system.path ];
+  {
+    buildInputs = [ config.system.path ];
     requiredSystemFeatures = [ "uid-range" ];
     toplevel = config.system.build.toplevel;
   }
diff --git a/tests/nixos/default.nix b/tests/nixos/default.nix
index 8e0cb1b22..ca72034ec 100644
--- a/tests/nixos/default.nix
+++ b/tests/nixos/default.nix
@@ -1,17 +1,26 @@
-{ lib, nixpkgs, nixpkgsFor, self }:
+{
+  lib,
+  nixpkgs,
+  nixpkgsFor,
+  self,
+}:
 
 let
 
   nixos-lib = import (nixpkgs + "/nixos/lib") { };
 
-  noTests = pkg: pkg.overrideAttrs (
-            finalAttrs: prevAttrs: {
-              doCheck = false;
-              doInstallCheck = false;
-            });
+  noTests =
+    pkg:
+    pkg.overrideAttrs (
+      finalAttrs: prevAttrs: {
+        doCheck = false;
+        doInstallCheck = false;
+      }
+    );
 
   # https://nixos.org/manual/nixos/unstable/index.html#sec-calling-nixos-tests
-  runNixOSTestFor = system: test:
+  runNixOSTestFor =
+    system: test:
     (nixos-lib.runTest {
       imports = [
         test
@@ -36,44 +45,61 @@ let
       # allow running tests against older nix versions via `nix eval --apply`
       # Example:
       #   nix build "$(nix eval --raw --impure .#hydraJobs.tests.fetch-git --apply 't: (t.forNix "2.19.2").drvPath')^*"
-      forNix = nixVersion: runNixOSTestFor system {
-        imports = [test];
-        defaults.nixpkgs.overlays = [(curr: prev: {
-          nix = let
-            packages = (builtins.getFlake "nix/${nixVersion}").packages.${system};
-          in packages.nix-cli or packages.nix;
-        })];
-      };
+      forNix =
+        nixVersion:
+        runNixOSTestFor system {
+          imports = [ test ];
+          defaults.nixpkgs.overlays = [
+            (curr: prev: {
+              nix =
+                let
+                  packages = (builtins.getFlake "nix/${nixVersion}").packages.${system};
+                in
+                packages.nix-cli or packages.nix;
+            })
+          ];
+        };
     };
 
   # Checks that a NixOS configuration does not contain any references to our
   # locally defined Nix version.
-  checkOverrideNixVersion = { pkgs, lib, ... }: {
-    # pkgs.nix: The new Nix in this repo
-    # We disallow it, to make sure we don't accidentally use it.
-    system.forbiddenDependenciesRegexes = [
-      (lib.strings.escapeRegex "nix-${pkgs.nix.version}")
-    ];
-  };
+  checkOverrideNixVersion =
+    { pkgs, lib, ... }:
+    {
+      # pkgs.nix: The new Nix in this repo
+      # We disallow it, to make sure we don't accidentally use it.
+      system.forbiddenDependenciesRegexes = [
+        (lib.strings.escapeRegex "nix-${pkgs.nix.version}")
+      ];
+    };
 
-  otherNixes.nix_2_3.setNixPackage = { lib, pkgs, ... }: {
-    imports = [ checkOverrideNixVersion ];
-    nix.package = lib.mkForce pkgs.nixVersions.nix_2_3;
-  };
+  otherNixes.nix_2_3.setNixPackage =
+    { lib, pkgs, ... }:
+    {
+      imports = [ checkOverrideNixVersion ];
+      nix.package = lib.mkForce pkgs.nixVersions.nix_2_3;
+    };
 
-  otherNixes.nix_2_13.setNixPackage = { lib, pkgs, ... }: {
-    imports = [ checkOverrideNixVersion ];
-    nix.package = lib.mkForce (
-      self.inputs.nixpkgs-23-11.legacyPackages.${pkgs.stdenv.hostPlatform.system}.nixVersions.nix_2_13.overrideAttrs (o: {
-        meta = o.meta // { knownVulnerabilities = []; };
-      })
-    );
-  };
+  otherNixes.nix_2_13.setNixPackage =
+    { lib, pkgs, ... }:
+    {
+      imports = [ checkOverrideNixVersion ];
+      nix.package = lib.mkForce (
+        self.inputs.nixpkgs-23-11.legacyPackages.${pkgs.stdenv.hostPlatform.system}.nixVersions.nix_2_13.overrideAttrs
+          (o: {
+            meta = o.meta // {
+              knownVulnerabilities = [ ];
+            };
+          })
+      );
+    };
 
-  otherNixes.nix_2_18.setNixPackage = { lib, pkgs, ... }: {
-    imports = [ checkOverrideNixVersion ];
-    nix.package = lib.mkForce pkgs.nixVersions.nix_2_18;
-  };
+  otherNixes.nix_2_18.setNixPackage =
+    { lib, pkgs, ... }:
+    {
+      imports = [ checkOverrideNixVersion ];
+      nix.package = lib.mkForce pkgs.nixVersions.nix_2_18;
+    };
 
 in
 
@@ -86,30 +112,37 @@ in
 
 }
 // lib.concatMapAttrs (
-  nixVersion: { setNixPackage, ... }:
+  nixVersion:
+  { setNixPackage, ... }:
   {
     "remoteBuilds_remote_${nixVersion}" = runNixOSTestFor "x86_64-linux" {
       name = "remoteBuilds_remote_${nixVersion}";
       imports = [ ./remote-builds.nix ];
-      builders.config = { lib, pkgs, ... }: {
-        imports = [ setNixPackage ];
-      };
+      builders.config =
+        { lib, pkgs, ... }:
+        {
+          imports = [ setNixPackage ];
+        };
     };
 
     "remoteBuilds_local_${nixVersion}" = runNixOSTestFor "x86_64-linux" {
       name = "remoteBuilds_local_${nixVersion}";
       imports = [ ./remote-builds.nix ];
-      nodes.client = { lib, pkgs, ... }: {
-        imports = [ setNixPackage ];
-      };
+      nodes.client =
+        { lib, pkgs, ... }:
+        {
+          imports = [ setNixPackage ];
+        };
     };
 
     "remoteBuildsSshNg_remote_${nixVersion}" = runNixOSTestFor "x86_64-linux" {
       name = "remoteBuildsSshNg_remote_${nixVersion}";
       imports = [ ./remote-builds-ssh-ng.nix ];
-      builders.config = { lib, pkgs, ... }: {
-        imports = [ setNixPackage ];
-      };
+      builders.config =
+        { lib, pkgs, ... }:
+        {
+          imports = [ setNixPackage ];
+        };
     };
 
     # FIXME: these tests don't work yet
@@ -143,9 +176,7 @@ in
 
   containers = runNixOSTestFor "x86_64-linux" ./containers/containers.nix;
 
-  setuid = lib.genAttrs
-    ["x86_64-linux"]
-    (system: runNixOSTestFor system ./setuid.nix);
+  setuid = lib.genAttrs [ "x86_64-linux" ] (system: runNixOSTestFor system ./setuid.nix);
 
   fetch-git = runNixOSTestFor "x86_64-linux" ./fetch-git;
 
diff --git a/tests/nixos/fetch-git/default.nix b/tests/nixos/fetch-git/default.nix
index 1d6bcb637..329fb463e 100644
--- a/tests/nixos/fetch-git/default.nix
+++ b/tests/nixos/fetch-git/default.nix
@@ -7,26 +7,27 @@
   ];
 
   /*
-  Test cases
+    Test cases
 
-  Test cases are automatically imported from ./test-cases/{name}
+    Test cases are automatically imported from ./test-cases/{name}
 
-  The following is set up automatically for each test case:
-    - a repo with the {name} is created on the gitea server
-    - a repo with the {name} is created on the client
-    - the client repo is configured to push to the server repo
+    The following is set up automatically for each test case:
+      - a repo with the {name} is created on the gitea server
+      - a repo with the {name} is created on the client
+      - the client repo is configured to push to the server repo
 
-  Python variables:
-    - repo.path: the path to the directory of the client repo
-    - repo.git: the git command with the client repo as the working directory
-    - repo.remote: the url to the server repo
+    Python variables:
+      - repo.path: the path to the directory of the client repo
+      - repo.git: the git command with the client repo as the working directory
+      - repo.remote: the url to the server repo
   */
-  testCases =
-    map
-    (testCaseName: {...}: {
+  testCases = map (
+    testCaseName:
+    { ... }:
+    {
       imports = [ (./test-cases + "/${testCaseName}") ];
       # ensures tests are named like their directories they are defined in
       name = testCaseName;
-    })
-    (lib.attrNames (builtins.readDir ./test-cases));
+    }
+  ) (lib.attrNames (builtins.readDir ./test-cases));
 }
diff --git a/tests/nixos/fetch-git/test-cases/http-auth/default.nix b/tests/nixos/fetch-git/test-cases/http-auth/default.nix
index d483d54fb..7ad9a8914 100644
--- a/tests/nixos/fetch-git/test-cases/http-auth/default.nix
+++ b/tests/nixos/fetch-git/test-cases/http-auth/default.nix
@@ -5,7 +5,8 @@
   script = ''
     # add a file to the repo
     client.succeed(f"""
-      echo ${config.name /* to make the git tree and store path unique */} > {repo.path}/test-case \
+      echo ${config.name # to make the git tree and store path unique
+      } > {repo.path}/test-case \
       && echo lutyabrook > {repo.path}/new-york-state \
       && {repo.git} add test-case new-york-state \
       && {repo.git} commit -m 'commit1'
diff --git a/tests/nixos/fetch-git/test-cases/http-simple/default.nix b/tests/nixos/fetch-git/test-cases/http-simple/default.nix
index dcab8067e..51b3882b5 100644
--- a/tests/nixos/fetch-git/test-cases/http-simple/default.nix
+++ b/tests/nixos/fetch-git/test-cases/http-simple/default.nix
@@ -4,7 +4,8 @@
   script = ''
     # add a file to the repo
     client.succeed(f"""
-      echo ${config.name /* to make the git tree and store path unique */} > {repo.path}/test-case \
+      echo ${config.name # to make the git tree and store path unique
+      } > {repo.path}/test-case \
       && echo chiang-mai > {repo.path}/thailand \
       && {repo.git} add test-case thailand \
       && {repo.git} commit -m 'commit1'
diff --git a/tests/nixos/fetch-git/test-cases/ssh-simple/default.nix b/tests/nixos/fetch-git/test-cases/ssh-simple/default.nix
index f5fba1698..89285d00e 100644
--- a/tests/nixos/fetch-git/test-cases/ssh-simple/default.nix
+++ b/tests/nixos/fetch-git/test-cases/ssh-simple/default.nix
@@ -4,7 +4,8 @@
   script = ''
     # add a file to the repo
     client.succeed(f"""
-      echo ${config.name /* to make the git tree and store path unique */} > {repo.path}/test-case \
+      echo ${config.name # to make the git tree and store path unique
+      } > {repo.path}/test-case \
       && echo chiang-mai > {repo.path}/thailand \
       && {repo.git} add test-case thailand \
       && {repo.git} commit -m 'commit1'
diff --git a/tests/nixos/fetch-git/testsupport/gitea-repo.nix b/tests/nixos/fetch-git/testsupport/gitea-repo.nix
index e9f4adcc1..c8244207f 100644
--- a/tests/nixos/fetch-git/testsupport/gitea-repo.nix
+++ b/tests/nixos/fetch-git/testsupport/gitea-repo.nix
@@ -8,25 +8,27 @@ let
 
   boolPyLiteral = b: if b then "True" else "False";
 
-  testCaseExtension = { config, ... }: {
-    options = {
-      repo.enable = mkOption {
-        type = types.bool;
-        default = true;
-        description = "Whether to provide a repo variable - automatic repo creation.";
+  testCaseExtension =
+    { config, ... }:
+    {
+      options = {
+        repo.enable = mkOption {
+          type = types.bool;
+          default = true;
+          description = "Whether to provide a repo variable - automatic repo creation.";
+        };
+        repo.private = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Whether the repo should be private.";
+        };
       };
-      repo.private = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Whether the repo should be private.";
+      config = mkIf config.repo.enable {
+        setupScript = ''
+          repo = Repo("${config.name}", private=${boolPyLiteral config.repo.private})
+        '';
       };
     };
-    config = mkIf config.repo.enable {
-      setupScript = ''
-        repo = Repo("${config.name}", private=${boolPyLiteral config.repo.private})
-      '';
-    };
-  };
 in
 {
   options = {
diff --git a/tests/nixos/fetch-git/testsupport/gitea.nix b/tests/nixos/fetch-git/testsupport/gitea.nix
index cf87bb466..9409acff7 100644
--- a/tests/nixos/fetch-git/testsupport/gitea.nix
+++ b/tests/nixos/fetch-git/testsupport/gitea.nix
@@ -1,4 +1,11 @@
-{ lib, nixpkgs, system, pkgs, ... }: let
+{
+  lib,
+  nixpkgs,
+  system,
+  pkgs,
+  ...
+}:
+let
   clientPrivateKey = pkgs.writeText "id_ed25519" ''
     -----BEGIN OPENSSH PRIVATE KEY-----
     b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
@@ -9,41 +16,52 @@
     -----END OPENSSH PRIVATE KEY-----
   '';
 
-  clientPublicKey =
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFt5a8eH8BYZYjoQhzXGVKKHJe1pw1D0p7O2Vb9VTLzB";
+  clientPublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFt5a8eH8BYZYjoQhzXGVKKHJe1pw1D0p7O2Vb9VTLzB";
 
-in {
+in
+{
   imports = [
     ../testsupport/setup.nix
     ../testsupport/gitea-repo.nix
   ];
   nodes = {
-    gitea = { pkgs, ... }: {
-      services.gitea.enable = true;
-      services.gitea.settings.service.DISABLE_REGISTRATION = true;
-      services.gitea.settings.log.LEVEL = "Info";
-      services.gitea.settings.database.LOG_SQL = false;
-      services.openssh.enable = true;
-      networking.firewall.allowedTCPPorts = [ 3000 ];
-      environment.systemPackages = [ pkgs.git pkgs.gitea ];
-
-      users.users.root.openssh.authorizedKeys.keys = [clientPublicKey];
-
-      # TODO: remove this after updating to nixos-23.11
-      nixpkgs.pkgs = lib.mkForce (import nixpkgs {
-        inherit system;
-        config.permittedInsecurePackages = [
-          "gitea-1.19.4"
+    gitea =
+      { pkgs, ... }:
+      {
+        services.gitea.enable = true;
+        services.gitea.settings.service.DISABLE_REGISTRATION = true;
+        services.gitea.settings.log.LEVEL = "Info";
+        services.gitea.settings.database.LOG_SQL = false;
+        services.openssh.enable = true;
+        networking.firewall.allowedTCPPorts = [ 3000 ];
+        environment.systemPackages = [
+          pkgs.git
+          pkgs.gitea
         ];
-      });
-    };
-    client = { pkgs, ... }: {
-      environment.systemPackages = [ pkgs.git ];
-    };
-  };
-  defaults = { pkgs, ... }: {
-    environment.systemPackages = [ pkgs.jq ];
+
+        users.users.root.openssh.authorizedKeys.keys = [ clientPublicKey ];
+
+        # TODO: remove this after updating to nixos-23.11
+        nixpkgs.pkgs = lib.mkForce (
+          import nixpkgs {
+            inherit system;
+            config.permittedInsecurePackages = [
+              "gitea-1.19.4"
+            ];
+          }
+        );
+      };
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.git ];
+      };
   };
+  defaults =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.jq ];
+    };
 
   setupScript = ''
     import shlex
diff --git a/tests/nixos/fetch-git/testsupport/setup.nix b/tests/nixos/fetch-git/testsupport/setup.nix
index a81d5614b..c13386c72 100644
--- a/tests/nixos/fetch-git/testsupport/setup.nix
+++ b/tests/nixos/fetch-git/testsupport/setup.nix
@@ -1,11 +1,16 @@
-{ lib, config, extendModules, ... }:
+{
+  lib,
+  config,
+  extendModules,
+  ...
+}:
 let
   inherit (lib)
     mkOption
     types
     ;
 
-  indent = lib.replaceStrings ["\n"] ["\n    "];
+  indent = lib.replaceStrings [ "\n" ] [ "\n    " ];
 
   execTestCase = testCase: ''
 
@@ -35,37 +40,39 @@ in
       description = ''
         The test cases. See `testScript`.
       '';
-      type = types.listOf (types.submodule {
-        options.name = mkOption {
-          type = types.str;
-          description = ''
-            The name of the test case.
+      type = types.listOf (
+        types.submodule {
+          options.name = mkOption {
+            type = types.str;
+            description = ''
+              The name of the test case.
 
-            A repository with that name will be set up on the gitea server and locally.
-          '';
-        };
-        options.description = mkOption {
-          type = types.str;
-          description = ''
-            A description of the test case.
-          '';
-        };
-        options.setupScript = mkOption {
-          type = types.lines;
-          description = ''
-            Python code that runs before the test case.
-          '';
-          default = "";
-        };
-        options.script = mkOption {
-          type = types.lines;
-          description = ''
-            Python code that runs the test.
+              A repository with that name will be set up on the gitea server and locally.
+            '';
+          };
+          options.description = mkOption {
+            type = types.str;
+            description = ''
+              A description of the test case.
+            '';
+          };
+          options.setupScript = mkOption {
+            type = types.lines;
+            description = ''
+              Python code that runs before the test case.
+            '';
+            default = "";
+          };
+          options.script = mkOption {
+            type = types.lines;
+            description = ''
+              Python code that runs the test.
 
-            Variables defined by the global `setupScript`, as well as `testCases.*.setupScript` will be available here.
-          '';
-        };
-      });
+              Variables defined by the global `setupScript`, as well as `testCases.*.setupScript` will be available here.
+            '';
+          };
+        }
+      );
     };
   };
 
@@ -74,10 +81,12 @@ in
       environment.variables = {
         _NIX_FORCE_HTTP = "1";
       };
-      nix.settings.experimental-features = ["nix-command" "flakes"];
+      nix.settings.experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
     };
-    setupScript = ''
-    '';
+    setupScript = '''';
     testScript = ''
       start_all();
 
diff --git a/tests/nixos/fetchurl.nix b/tests/nixos/fetchurl.nix
index bfae8deec..e8663debb 100644
--- a/tests/nixos/fetchurl.nix
+++ b/tests/nixos/fetchurl.nix
@@ -5,16 +5,20 @@
 
 let
 
-  makeTlsCert = name: pkgs.runCommand name {
-    nativeBuildInputs = with pkgs; [ openssl ];
-  } ''
-    mkdir -p $out
-    openssl req -x509 \
-      -subj '/CN=${name}/' -days 49710 \
-      -addext 'subjectAltName = DNS:${name}' \
-      -keyout "$out/key.pem" -newkey ed25519 \
-      -out "$out/cert.pem" -noenc
-  '';
+  makeTlsCert =
+    name:
+    pkgs.runCommand name
+      {
+        nativeBuildInputs = with pkgs; [ openssl ];
+      }
+      ''
+        mkdir -p $out
+        openssl req -x509 \
+          -subj '/CN=${name}/' -days 49710 \
+          -addext 'subjectAltName = DNS:${name}' \
+          -keyout "$out/key.pem" -newkey ed25519 \
+          -out "$out/cert.pem" -noenc
+      '';
 
   goodCert = makeTlsCert "good";
   badCert = makeTlsCert "bad";
@@ -25,39 +29,44 @@ in
   name = "fetchurl";
 
   nodes = {
-    machine = { pkgs, ... }: {
-      services.nginx = {
-        enable = true;
+    machine =
+      { pkgs, ... }:
+      {
+        services.nginx = {
+          enable = true;
 
-        virtualHosts."good" = {
-          addSSL = true;
-          sslCertificate = "${goodCert}/cert.pem";
-          sslCertificateKey = "${goodCert}/key.pem";
-          root = pkgs.runCommand "nginx-root" {} ''
-            mkdir "$out"
-            echo 'hello world' > "$out/index.html"
-          '';
+          virtualHosts."good" = {
+            addSSL = true;
+            sslCertificate = "${goodCert}/cert.pem";
+            sslCertificateKey = "${goodCert}/key.pem";
+            root = pkgs.runCommand "nginx-root" { } ''
+              mkdir "$out"
+              echo 'hello world' > "$out/index.html"
+            '';
+          };
+
+          virtualHosts."bad" = {
+            addSSL = true;
+            sslCertificate = "${badCert}/cert.pem";
+            sslCertificateKey = "${badCert}/key.pem";
+            root = pkgs.runCommand "nginx-root" { } ''
+              mkdir "$out"
+              echo 'foobar' > "$out/index.html"
+            '';
+          };
         };
 
-        virtualHosts."bad" = {
-          addSSL = true;
-          sslCertificate = "${badCert}/cert.pem";
-          sslCertificateKey = "${badCert}/key.pem";
-          root = pkgs.runCommand "nginx-root" {} ''
-            mkdir "$out"
-            echo 'foobar' > "$out/index.html"
-          '';
-        };
+        security.pki.certificateFiles = [ "${goodCert}/cert.pem" ];
+
+        networking.hosts."127.0.0.1" = [
+          "good"
+          "bad"
+        ];
+
+        virtualisation.writableStore = true;
+
+        nix.settings.experimental-features = "nix-command";
       };
-
-      security.pki.certificateFiles = [ "${goodCert}/cert.pem" ];
-
-      networking.hosts."127.0.0.1" = [ "good" "bad" ];
-
-      virtualisation.writableStore = true;
-
-      nix.settings.experimental-features = "nix-command";
-    };
   };
 
   testScript = ''
diff --git a/tests/nixos/fsync.nix b/tests/nixos/fsync.nix
index 99ac2b25d..e215e5b3c 100644
--- a/tests/nixos/fsync.nix
+++ b/tests/nixos/fsync.nix
@@ -1,4 +1,10 @@
-{ lib, config, nixpkgs, pkgs, ... }:
+{
+  lib,
+  config,
+  nixpkgs,
+  pkgs,
+  ...
+}:
 
 let
   pkg1 = pkgs.go;
@@ -8,32 +14,44 @@ in
   name = "fsync";
 
   nodes.machine =
-    { config, lib, pkgs, ... }:
-    { virtualisation.emptyDiskImages = [ 1024 ];
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      virtualisation.emptyDiskImages = [ 1024 ];
       environment.systemPackages = [ pkg1 ];
       nix.settings.experimental-features = [ "nix-command" ];
       nix.settings.fsync-store-paths = true;
       nix.settings.require-sigs = false;
-      boot.supportedFilesystems = [ "ext4" "btrfs" "xfs" ];
+      boot.supportedFilesystems = [
+        "ext4"
+        "btrfs"
+        "xfs"
+      ];
     };
 
-  testScript = { nodes }: ''
-    # fmt: off
-    for fs in ("ext4", "btrfs", "xfs"):
-      machine.succeed("mkfs.{} {} /dev/vdb".format(fs, "-F" if fs == "ext4" else "-f"))
-      machine.succeed("mkdir -p /mnt")
-      machine.succeed("mount /dev/vdb /mnt")
-      machine.succeed("sync")
-      machine.succeed("nix copy --offline ${pkg1} --to /mnt")
-      machine.crash()
+  testScript =
+    { nodes }:
+    ''
+      # fmt: off
+      for fs in ("ext4", "btrfs", "xfs"):
+        machine.succeed("mkfs.{} {} /dev/vdb".format(fs, "-F" if fs == "ext4" else "-f"))
+        machine.succeed("mkdir -p /mnt")
+        machine.succeed("mount /dev/vdb /mnt")
+        machine.succeed("sync")
+        machine.succeed("nix copy --offline ${pkg1} --to /mnt")
+        machine.crash()
 
-      machine.start()
-      machine.wait_for_unit("multi-user.target")
-      machine.succeed("mkdir -p /mnt")
-      machine.succeed("mount /dev/vdb /mnt")
-      machine.succeed("nix path-info --offline --store /mnt ${pkg1}")
-      machine.succeed("nix store verify --all --store /mnt --no-trust")
+        machine.start()
+        machine.wait_for_unit("multi-user.target")
+        machine.succeed("mkdir -p /mnt")
+        machine.succeed("mount /dev/vdb /mnt")
+        machine.succeed("nix path-info --offline --store /mnt ${pkg1}")
+        machine.succeed("nix store verify --all --store /mnt --no-trust")
 
-      machine.succeed("umount /dev/vdb")
-  '';
+        machine.succeed("umount /dev/vdb")
+    '';
 }
diff --git a/tests/nixos/functional/as-trusted-user.nix b/tests/nixos/functional/as-trusted-user.nix
index d6f825697..25c1b399c 100644
--- a/tests/nixos/functional/as-trusted-user.nix
+++ b/tests/nixos/functional/as-trusted-user.nix
@@ -4,7 +4,9 @@
   imports = [ ./common.nix ];
 
   nodes.machine = {
-    users.users.alice = { isNormalUser = true; };
+    users.users.alice = {
+      isNormalUser = true;
+    };
     nix.settings.trusted-users = [ "alice" ];
   };
 
@@ -15,4 +17,4 @@
       su --login --command "run-test-suite" alice >&2
     """)
   '';
-}
\ No newline at end of file
+}
diff --git a/tests/nixos/functional/as-user.nix b/tests/nixos/functional/as-user.nix
index 1443f6e6c..b93c8d798 100644
--- a/tests/nixos/functional/as-user.nix
+++ b/tests/nixos/functional/as-user.nix
@@ -4,7 +4,9 @@
   imports = [ ./common.nix ];
 
   nodes.machine = {
-    users.users.alice = { isNormalUser = true; };
+    users.users.alice = {
+      isNormalUser = true;
+    };
   };
 
   testScript = ''
diff --git a/tests/nixos/functional/common.nix b/tests/nixos/functional/common.nix
index 561271ba0..f3cab4725 100644
--- a/tests/nixos/functional/common.nix
+++ b/tests/nixos/functional/common.nix
@@ -2,9 +2,11 @@
 
 let
   # FIXME (roberth) reference issue
-  inputDerivation = pkg: (pkg.overrideAttrs (o: {
-    disallowedReferences = [ ];
-  })).inputDerivation;
+  inputDerivation =
+    pkg:
+    (pkg.overrideAttrs (o: {
+      disallowedReferences = [ ];
+    })).inputDerivation;
 
 in
 {
@@ -12,59 +14,63 @@ in
   # we skip it to save time.
   skipTypeCheck = true;
 
-  nodes.machine = { config, pkgs, ... }: {
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
 
-    virtualisation.writableStore = true;
-    system.extraDependencies = [
-      (inputDerivation config.nix.package)
-    ];
+      virtualisation.writableStore = true;
+      system.extraDependencies = [
+        (inputDerivation config.nix.package)
+      ];
 
-    nix.settings.substituters = lib.mkForce [];
+      nix.settings.substituters = lib.mkForce [ ];
 
-    environment.systemPackages = let
-      run-test-suite = pkgs.writeShellApplication {
-        name = "run-test-suite";
-        runtimeInputs = [
-          pkgs.meson
-          pkgs.ninja
-          pkgs.jq
+      environment.systemPackages =
+        let
+          run-test-suite = pkgs.writeShellApplication {
+            name = "run-test-suite";
+            runtimeInputs = [
+              pkgs.meson
+              pkgs.ninja
+              pkgs.jq
+              pkgs.git
+
+              # Want to avoid `/run/current-system/sw/bin/bash` because we
+              # want a store path. Likewise for coreutils.
+              pkgs.bash
+              pkgs.coreutils
+            ];
+            text = ''
+              set -x
+
+              cat /proc/sys/fs/file-max
+              ulimit -Hn
+              ulimit -Sn
+
+              cd ~
+
+              cp -r ${pkgs.nixComponents.nix-functional-tests.src} nix
+              chmod -R +w nix
+
+              chmod u+w nix/.version
+              echo ${pkgs.nixComponents.version} > nix/.version
+
+              export isTestOnNixOS=1
+
+              export NIX_REMOTE_=daemon
+              export NIX_REMOTE=daemon
+
+              export NIX_STORE=${builtins.storeDir}
+
+              meson setup nix/tests/functional build
+              cd build
+              meson test -j1 --print-errorlogs
+            '';
+          };
+        in
+        [
+          run-test-suite
           pkgs.git
-
-          # Want to avoid `/run/current-system/sw/bin/bash` because we
-          # want a store path. Likewise for coreutils.
-          pkgs.bash
-          pkgs.coreutils
         ];
-        text = ''
-          set -x
-
-          cat /proc/sys/fs/file-max
-          ulimit -Hn
-          ulimit -Sn
-
-          cd ~
-
-          cp -r ${pkgs.nixComponents.nix-functional-tests.src} nix
-          chmod -R +w nix
-
-          chmod u+w nix/.version
-          echo ${pkgs.nixComponents.version} > nix/.version
-
-          export isTestOnNixOS=1
-
-          export NIX_REMOTE_=daemon
-          export NIX_REMOTE=daemon
-
-          export NIX_STORE=${builtins.storeDir}
-
-          meson setup nix/tests/functional build
-          cd build
-          meson test -j1 --print-errorlogs
-        '';
-      };
-    in [
-      run-test-suite
-      pkgs.git
-    ];
-  };
+    };
 }
diff --git a/tests/nixos/functional/symlinked-home.nix b/tests/nixos/functional/symlinked-home.nix
index 57c45d5d5..900543d0c 100644
--- a/tests/nixos/functional/symlinked-home.nix
+++ b/tests/nixos/functional/symlinked-home.nix
@@ -16,7 +16,9 @@
   imports = [ ./common.nix ];
 
   nodes.machine = {
-    users.users.alice = { isNormalUser = true; };
+    users.users.alice = {
+      isNormalUser = true;
+    };
   };
 
   testScript = ''
diff --git a/tests/nixos/git-submodules.nix b/tests/nixos/git-submodules.nix
index a82ddf418..5b1d9ed5f 100644
--- a/tests/nixos/git-submodules.nix
+++ b/tests/nixos/git-submodules.nix
@@ -6,68 +6,74 @@
   config = {
     name = lib.mkDefault "git-submodules";
 
-    nodes =
-      {
-        remote =
-          { config, pkgs, ... }:
-          {
-            services.openssh.enable = true;
-            environment.systemPackages = [ pkgs.git ];
-          };
+    nodes = {
+      remote =
+        { config, pkgs, ... }:
+        {
+          services.openssh.enable = true;
+          environment.systemPackages = [ pkgs.git ];
+        };
 
-        client =
-          { config, lib, pkgs, ... }:
-          {
-            programs.ssh.extraConfig = "ConnectTimeout 30";
-            environment.systemPackages = [ pkgs.git ];
-            nix.extraOptions = "experimental-features = nix-command flakes";
-          };
-      };
+      client =
+        {
+          config,
+          lib,
+          pkgs,
+          ...
+        }:
+        {
+          programs.ssh.extraConfig = "ConnectTimeout 30";
+          environment.systemPackages = [ pkgs.git ];
+          nix.extraOptions = "experimental-features = nix-command flakes";
+        };
+    };
 
-    testScript = { nodes }: ''
-      # fmt: off
-      import subprocess
+    testScript =
+      { nodes }:
+      ''
+        # fmt: off
+        import subprocess
 
-      start_all()
+        start_all()
 
-      # Create an SSH key on the client.
-      subprocess.run([
-        "${hostPkgs.openssh}/bin/ssh-keygen", "-t", "ed25519", "-f", "key", "-N", ""
-      ], capture_output=True, check=True)
-      client.succeed("mkdir -p -m 700 /root/.ssh")
-      client.copy_from_host("key", "/root/.ssh/id_ed25519")
-      client.succeed("chmod 600 /root/.ssh/id_ed25519")
+        # Create an SSH key on the client.
+        subprocess.run([
+          "${hostPkgs.openssh}/bin/ssh-keygen", "-t", "ed25519", "-f", "key", "-N", ""
+        ], capture_output=True, check=True)
+        client.succeed("mkdir -p -m 700 /root/.ssh")
+        client.copy_from_host("key", "/root/.ssh/id_ed25519")
+        client.succeed("chmod 600 /root/.ssh/id_ed25519")
 
-      # Install the SSH key on the builders.
-      client.wait_for_unit("network-online.target")
+        # Install the SSH key on the builders.
+        client.wait_for_unit("network-online.target")
 
-      remote.succeed("mkdir -p -m 700 /root/.ssh")
-      remote.copy_from_host("key.pub", "/root/.ssh/authorized_keys")
-      remote.wait_for_unit("sshd")
-      remote.wait_for_unit("multi-user.target")
-      remote.wait_for_unit("network-online.target")
-      client.wait_for_unit("network-online.target")
-      client.succeed(f"ssh -o StrictHostKeyChecking=no {remote.name} 'echo hello world'")
+        remote.succeed("mkdir -p -m 700 /root/.ssh")
+        remote.copy_from_host("key.pub", "/root/.ssh/authorized_keys")
+        remote.wait_for_unit("sshd")
+        remote.wait_for_unit("multi-user.target")
+        remote.wait_for_unit("network-online.target")
+        client.wait_for_unit("network-online.target")
+        client.succeed(f"ssh -o StrictHostKeyChecking=no {remote.name} 'echo hello world'")
 
-      remote.succeed("""
-        git init bar
-        git -C bar config user.email foobar@example.com
-        git -C bar config user.name Foobar
-        echo test >> bar/content
-        git -C bar add content
-        git -C bar commit -m 'Initial commit'
-      """)
+        remote.succeed("""
+          git init bar
+          git -C bar config user.email foobar@example.com
+          git -C bar config user.name Foobar
+          echo test >> bar/content
+          git -C bar add content
+          git -C bar commit -m 'Initial commit'
+        """)
 
-      client.succeed(f"""
-        git init foo
-        git -C foo config user.email foobar@example.com
-        git -C foo config user.name Foobar
-        git -C foo submodule add root@{remote.name}:/tmp/bar sub
-        git -C foo add sub
-        git -C foo commit -m 'Add submodule'
-      """)
+        client.succeed(f"""
+          git init foo
+          git -C foo config user.email foobar@example.com
+          git -C foo config user.name Foobar
+          git -C foo submodule add root@{remote.name}:/tmp/bar sub
+          git -C foo add sub
+          git -C foo commit -m 'Add submodule'
+        """)
 
-      client.succeed("nix --flake-registry \"\" flake prefetch 'git+file:///tmp/foo?submodules=1&ref=master'")
-    '';
+        client.succeed("nix --flake-registry \"\" flake prefetch 'git+file:///tmp/foo?submodules=1&ref=master'")
+      '';
   };
 }
diff --git a/tests/nixos/github-flakes.nix b/tests/nixos/github-flakes.nix
index 69d1df410..dcba464a3 100644
--- a/tests/nixos/github-flakes.nix
+++ b/tests/nixos/github-flakes.nix
@@ -1,21 +1,25 @@
-{ lib, config, nixpkgs, ... }:
+{
+  lib,
+  config,
+  nixpkgs,
+  ...
+}:
 let
   pkgs = config.nodes.client.nixpkgs.pkgs;
 
   # Generate a fake root CA and a fake api.github.com / github.com / channels.nixos.org certificate.
-  cert = pkgs.runCommand "cert" { nativeBuildInputs = [ pkgs.openssl ]; }
-    ''
-      mkdir -p $out
+  cert = pkgs.runCommand "cert" { nativeBuildInputs = [ pkgs.openssl ]; } ''
+    mkdir -p $out
 
-      openssl genrsa -out ca.key 2048
-      openssl req -new -x509 -days 36500 -key ca.key \
-        -subj "/C=NL/ST=Denial/L=Springfield/O=Dis/CN=Root CA" -out $out/ca.crt
+    openssl genrsa -out ca.key 2048
+    openssl req -new -x509 -days 36500 -key ca.key \
+      -subj "/C=NL/ST=Denial/L=Springfield/O=Dis/CN=Root CA" -out $out/ca.crt
 
-      openssl req -newkey rsa:2048 -nodes -keyout $out/server.key \
-        -subj "/C=CN/ST=Denial/L=Springfield/O=Dis/CN=github.com" -out server.csr
-      openssl x509 -req -extfile <(printf "subjectAltName=DNS:api.github.com,DNS:github.com,DNS:channels.nixos.org") \
-        -days 36500 -in server.csr -CA $out/ca.crt -CAkey ca.key -CAcreateserial -out $out/server.crt
-    '';
+    openssl req -newkey rsa:2048 -nodes -keyout $out/server.key \
+      -subj "/C=CN/ST=Denial/L=Springfield/O=Dis/CN=github.com" -out server.csr
+    openssl x509 -req -extfile <(printf "subjectAltName=DNS:api.github.com,DNS:github.com,DNS:channels.nixos.org") \
+      -days 36500 -in server.csr -CA $out/ca.crt -CAkey ca.key -CAcreateserial -out $out/server.crt
+  '';
 
   registry = pkgs.writeTextFile {
     name = "registry";
@@ -53,168 +57,190 @@ let
 
   private-flake-rev = "9f1dd0df5b54a7dc75b618034482ed42ce34383d";
 
-  private-flake-api = pkgs.runCommand "private-flake" {}
-    ''
-      mkdir -p $out/{commits,tarball}
+  private-flake-api = pkgs.runCommand "private-flake" { } ''
+    mkdir -p $out/{commits,tarball}
 
-      # Setup https://docs.github.com/en/rest/commits/commits#get-a-commit
-      echo '{"sha": "${private-flake-rev}", "commit": {"tree": {"sha": "ffffffffffffffffffffffffffffffffffffffff"}}}' > $out/commits/HEAD
+    # Setup https://docs.github.com/en/rest/commits/commits#get-a-commit
+    echo '{"sha": "${private-flake-rev}", "commit": {"tree": {"sha": "ffffffffffffffffffffffffffffffffffffffff"}}}' > $out/commits/HEAD
 
-      # Setup tarball download via API
-      dir=private-flake
-      mkdir $dir
-      echo '{ outputs = {...}: {}; }' > $dir/flake.nix
-      tar cfz $out/tarball/${private-flake-rev} $dir --hard-dereference
-    '';
+    # Setup tarball download via API
+    dir=private-flake
+    mkdir $dir
+    echo '{ outputs = {...}: {}; }' > $dir/flake.nix
+    tar cfz $out/tarball/${private-flake-rev} $dir --hard-dereference
+  '';
 
-  nixpkgs-api = pkgs.runCommand "nixpkgs-flake" {}
-    ''
-      mkdir -p $out/commits
+  nixpkgs-api = pkgs.runCommand "nixpkgs-flake" { } ''
+    mkdir -p $out/commits
 
-      # Setup https://docs.github.com/en/rest/commits/commits#get-a-commit
-      echo '{"sha": "${nixpkgs.rev}", "commit": {"tree": {"sha": "ffffffffffffffffffffffffffffffffffffffff"}}}' > $out/commits/HEAD
-    '';
+    # Setup https://docs.github.com/en/rest/commits/commits#get-a-commit
+    echo '{"sha": "${nixpkgs.rev}", "commit": {"tree": {"sha": "ffffffffffffffffffffffffffffffffffffffff"}}}' > $out/commits/HEAD
+  '';
 
-  archive = pkgs.runCommand "nixpkgs-flake" {}
-    ''
-      mkdir -p $out/archive
+  archive = pkgs.runCommand "nixpkgs-flake" { } ''
+    mkdir -p $out/archive
 
-      dir=NixOS-nixpkgs-${nixpkgs.shortRev}
-      cp -prd ${nixpkgs} $dir
-      # Set the correct timestamp in the tarball.
-      find $dir -print0 | xargs -0 touch -h -t ${builtins.substring 0 12 nixpkgs.lastModifiedDate}.${builtins.substring 12 2 nixpkgs.lastModifiedDate} --
-      tar cfz $out/archive/${nixpkgs.rev}.tar.gz $dir --hard-dereference
-    '';
+    dir=NixOS-nixpkgs-${nixpkgs.shortRev}
+    cp -prd ${nixpkgs} $dir
+    # Set the correct timestamp in the tarball.
+    find $dir -print0 | xargs -0 touch -h -t ${builtins.substring 0 12 nixpkgs.lastModifiedDate}.${
+      builtins.substring 12 2 nixpkgs.lastModifiedDate
+    } --
+    tar cfz $out/archive/${nixpkgs.rev}.tar.gz $dir --hard-dereference
+  '';
 in
 
 {
   name = "github-flakes";
 
-  nodes =
-    {
-      github =
-        { config, pkgs, ... }:
-        { networking.firewall.allowedTCPPorts = [ 80 443 ];
+  nodes = {
+    github =
+      { config, pkgs, ... }:
+      {
+        networking.firewall.allowedTCPPorts = [
+          80
+          443
+        ];
 
-          services.httpd.enable = true;
-          services.httpd.adminAddr = "foo@example.org";
-          services.httpd.extraConfig = ''
-            ErrorLog syslog:local6
-          '';
-          services.httpd.virtualHosts."channels.nixos.org" =
-            { forceSSL = true;
-              sslServerKey = "${cert}/server.key";
-              sslServerCert = "${cert}/server.crt";
-              servedDirs =
-                [ { urlPath = "/";
-                    dir = registry;
-                  }
-                ];
-            };
-          services.httpd.virtualHosts."api.github.com" =
-            { forceSSL = true;
-              sslServerKey = "${cert}/server.key";
-              sslServerCert = "${cert}/server.crt";
-              servedDirs =
-                [ { urlPath = "/repos/NixOS/nixpkgs";
-                    dir = nixpkgs-api;
-                  }
-                  { urlPath = "/repos/fancy-enterprise/private-flake";
-                    dir = private-flake-api;
-                  }
-                ];
-            };
-          services.httpd.virtualHosts."github.com" =
-            { forceSSL = true;
-              sslServerKey = "${cert}/server.key";
-              sslServerCert = "${cert}/server.crt";
-              servedDirs =
-                [ { urlPath = "/NixOS/nixpkgs";
-                    dir = archive;
-                  }
-                ];
-            };
+        services.httpd.enable = true;
+        services.httpd.adminAddr = "foo@example.org";
+        services.httpd.extraConfig = ''
+          ErrorLog syslog:local6
+        '';
+        services.httpd.virtualHosts."channels.nixos.org" = {
+          forceSSL = true;
+          sslServerKey = "${cert}/server.key";
+          sslServerCert = "${cert}/server.crt";
+          servedDirs = [
+            {
+              urlPath = "/";
+              dir = registry;
+            }
+          ];
         };
-
-      client =
-        { config, lib, pkgs, nodes, ... }:
-        { virtualisation.writableStore = true;
-          virtualisation.diskSize = 2048;
-          virtualisation.additionalPaths = [ pkgs.hello pkgs.fuse ];
-          virtualisation.memorySize = 4096;
-          nix.settings.substituters = lib.mkForce [ ];
-          nix.extraOptions = "experimental-features = nix-command flakes";
-          networking.hosts.${(builtins.head nodes.github.networking.interfaces.eth1.ipv4.addresses).address} =
-            [ "channels.nixos.org" "api.github.com" "github.com" ];
-          security.pki.certificateFiles = [ "${cert}/ca.crt" ];
+        services.httpd.virtualHosts."api.github.com" = {
+          forceSSL = true;
+          sslServerKey = "${cert}/server.key";
+          sslServerCert = "${cert}/server.crt";
+          servedDirs = [
+            {
+              urlPath = "/repos/NixOS/nixpkgs";
+              dir = nixpkgs-api;
+            }
+            {
+              urlPath = "/repos/fancy-enterprise/private-flake";
+              dir = private-flake-api;
+            }
+          ];
         };
-    };
+        services.httpd.virtualHosts."github.com" = {
+          forceSSL = true;
+          sslServerKey = "${cert}/server.key";
+          sslServerCert = "${cert}/server.crt";
+          servedDirs = [
+            {
+              urlPath = "/NixOS/nixpkgs";
+              dir = archive;
+            }
+          ];
+        };
+      };
 
-  testScript = { nodes }: ''
-    # fmt: off
-    import json
-    import time
+    client =
+      {
+        config,
+        lib,
+        pkgs,
+        nodes,
+        ...
+      }:
+      {
+        virtualisation.writableStore = true;
+        virtualisation.diskSize = 2048;
+        virtualisation.additionalPaths = [
+          pkgs.hello
+          pkgs.fuse
+        ];
+        virtualisation.memorySize = 4096;
+        nix.settings.substituters = lib.mkForce [ ];
+        nix.extraOptions = "experimental-features = nix-command flakes";
+        networking.hosts.${(builtins.head nodes.github.networking.interfaces.eth1.ipv4.addresses).address} =
+          [
+            "channels.nixos.org"
+            "api.github.com"
+            "github.com"
+          ];
+        security.pki.certificateFiles = [ "${cert}/ca.crt" ];
+      };
+  };
 
-    start_all()
+  testScript =
+    { nodes }:
+    ''
+      # fmt: off
+      import json
+      import time
 
-    def cat_log():
-         github.succeed("cat /var/log/httpd/*.log >&2")
+      start_all()
 
-    github.wait_for_unit("httpd.service")
-    github.wait_for_unit("network-online.target")
+      def cat_log():
+           github.succeed("cat /var/log/httpd/*.log >&2")
 
-    client.wait_for_unit("network-online.target")
-    client.succeed("curl -v https://github.com/ >&2")
-    out = client.succeed("nix registry list")
-    print(out)
-    assert "github:NixOS/nixpkgs" in out, "nixpkgs flake not found"
-    assert "github:fancy-enterprise/private-flake" in out, "private flake not found"
-    cat_log()
+      github.wait_for_unit("httpd.service")
+      github.wait_for_unit("network-online.target")
 
-    # If no github access token is provided, nix should use the public archive url...
-    out = client.succeed("nix flake metadata nixpkgs --json")
-    print(out)
-    info = json.loads(out)
-    assert info["revision"] == "${nixpkgs.rev}", f"revision mismatch: {info['revision']} != ${nixpkgs.rev}"
-    cat_log()
+      client.wait_for_unit("network-online.target")
+      client.succeed("curl -v https://github.com/ >&2")
+      out = client.succeed("nix registry list")
+      print(out)
+      assert "github:NixOS/nixpkgs" in out, "nixpkgs flake not found"
+      assert "github:fancy-enterprise/private-flake" in out, "private flake not found"
+      cat_log()
 
-    # ... otherwise it should use the API
-    out = client.succeed("nix flake metadata private-flake --json --access-tokens github.com=ghp_000000000000000000000000000000000000 --tarball-ttl 0")
-    print(out)
-    info = json.loads(out)
-    assert info["revision"] == "${private-flake-rev}", f"revision mismatch: {info['revision']} != ${private-flake-rev}"
-    assert info["fingerprint"]
-    cat_log()
+      # If no github access token is provided, nix should use the public archive url...
+      out = client.succeed("nix flake metadata nixpkgs --json")
+      print(out)
+      info = json.loads(out)
+      assert info["revision"] == "${nixpkgs.rev}", f"revision mismatch: {info['revision']} != ${nixpkgs.rev}"
+      cat_log()
 
-    # Fetching with the resolved URL should produce the same result.
-    info2 = json.loads(client.succeed(f"nix flake metadata {info['url']} --json --access-tokens github.com=ghp_000000000000000000000000000000000000 --tarball-ttl 0"))
-    print(info["fingerprint"], info2["fingerprint"])
-    assert info["fingerprint"] == info2["fingerprint"], "fingerprint mismatch"
+      # ... otherwise it should use the API
+      out = client.succeed("nix flake metadata private-flake --json --access-tokens github.com=ghp_000000000000000000000000000000000000 --tarball-ttl 0")
+      print(out)
+      info = json.loads(out)
+      assert info["revision"] == "${private-flake-rev}", f"revision mismatch: {info['revision']} != ${private-flake-rev}"
+      assert info["fingerprint"]
+      cat_log()
 
-    client.succeed("nix registry pin nixpkgs")
-    client.succeed("nix flake metadata nixpkgs --tarball-ttl 0 >&2")
+      # Fetching with the resolved URL should produce the same result.
+      info2 = json.loads(client.succeed(f"nix flake metadata {info['url']} --json --access-tokens github.com=ghp_000000000000000000000000000000000000 --tarball-ttl 0"))
+      print(info["fingerprint"], info2["fingerprint"])
+      assert info["fingerprint"] == info2["fingerprint"], "fingerprint mismatch"
 
-    # Test fetchTree on a github URL.
-    hash = client.succeed(f"nix eval --no-trust-tarballs-from-git-forges --raw --expr '(fetchTree {info['url']}).narHash'")
-    assert hash == info['locked']['narHash']
+      client.succeed("nix registry pin nixpkgs")
+      client.succeed("nix flake metadata nixpkgs --tarball-ttl 0 >&2")
 
-    # Fetching without a narHash should succeed if trust-github is set and fail otherwise.
-    client.succeed(f"nix eval --raw --expr 'builtins.fetchTree github:github:fancy-enterprise/private-flake/{info['revision']}'")
-    out = client.fail(f"nix eval --no-trust-tarballs-from-git-forges --raw --expr 'builtins.fetchTree github:github:fancy-enterprise/private-flake/{info['revision']}' 2>&1")
-    assert "will not fetch unlocked input" in out, "--no-trust-tarballs-from-git-forges did not fail with the expected error"
+      # Test fetchTree on a github URL.
+      hash = client.succeed(f"nix eval --no-trust-tarballs-from-git-forges --raw --expr '(fetchTree {info['url']}).narHash'")
+      assert hash == info['locked']['narHash']
 
-    # Shut down the web server. The flake should be cached on the client.
-    github.succeed("systemctl stop httpd.service")
+      # Fetching without a narHash should succeed if trust-github is set and fail otherwise.
+      client.succeed(f"nix eval --raw --expr 'builtins.fetchTree github:github:fancy-enterprise/private-flake/{info['revision']}'")
+      out = client.fail(f"nix eval --no-trust-tarballs-from-git-forges --raw --expr 'builtins.fetchTree github:github:fancy-enterprise/private-flake/{info['revision']}' 2>&1")
+      assert "will not fetch unlocked input" in out, "--no-trust-tarballs-from-git-forges did not fail with the expected error"
 
-    info = json.loads(client.succeed("nix flake metadata nixpkgs --json"))
-    date = time.strftime("%Y%m%d%H%M%S", time.gmtime(info['lastModified']))
-    assert date == "${nixpkgs.lastModifiedDate}", "time mismatch"
+      # Shut down the web server. The flake should be cached on the client.
+      github.succeed("systemctl stop httpd.service")
 
-    client.succeed("nix build nixpkgs#hello")
+      info = json.loads(client.succeed("nix flake metadata nixpkgs --json"))
+      date = time.strftime("%Y%m%d%H%M%S", time.gmtime(info['lastModified']))
+      assert date == "${nixpkgs.lastModifiedDate}", "time mismatch"
 
-    # The build shouldn't fail even with --tarball-ttl 0 (the server
-    # being down should not be a fatal error).
-    client.succeed("nix build nixpkgs#fuse --tarball-ttl 0")
-  '';
+      client.succeed("nix build nixpkgs#hello")
+
+      # The build shouldn't fail even with --tarball-ttl 0 (the server
+      # being down should not be a fatal error).
+      client.succeed("nix build nixpkgs#fuse --tarball-ttl 0")
+    '';
 
 }
diff --git a/tests/nixos/gzip-content-encoding.nix b/tests/nixos/gzip-content-encoding.nix
index a5a0033fd..22d196c61 100644
--- a/tests/nixos/gzip-content-encoding.nix
+++ b/tests/nixos/gzip-content-encoding.nix
@@ -30,42 +30,45 @@ in
 {
   name = "gzip-content-encoding";
 
-  nodes =
-    { machine =
+  nodes = {
+    machine =
       { config, pkgs, ... }:
-      { networking.firewall.allowedTCPPorts = [ 80 ];
+      {
+        networking.firewall.allowedTCPPorts = [ 80 ];
 
         services.nginx.enable = true;
-        services.nginx.virtualHosts."localhost" =
-          { root = "${ztdCompressedFile}/share/";
-            # Make sure that nginx really tries to compress the
-            # file on the fly with no regard to size/mime.
-            # http://nginx.org/en/docs/http/ngx_http_gzip_module.html
-            extraConfig = ''
-              gzip on;
-              gzip_types *;
-              gzip_proxied any;
-              gzip_min_length 0;
-            '';
-          };
+        services.nginx.virtualHosts."localhost" = {
+          root = "${ztdCompressedFile}/share/";
+          # Make sure that nginx really tries to compress the
+          # file on the fly with no regard to size/mime.
+          # http://nginx.org/en/docs/http/ngx_http_gzip_module.html
+          extraConfig = ''
+            gzip on;
+            gzip_types *;
+            gzip_proxied any;
+            gzip_min_length 0;
+          '';
+        };
         virtualisation.writableStore = true;
         virtualisation.additionalPaths = with pkgs; [ file ];
         nix.settings.substituters = lib.mkForce [ ];
       };
-    };
+  };
 
   # Check that when nix-prefetch-url is used with a zst tarball it does not get decompressed.
-  testScript = { nodes }: ''
-    # fmt: off
-    start_all()
+  testScript =
+    { nodes }:
+    ''
+      # fmt: off
+      start_all()
 
-    machine.wait_for_unit("nginx.service")
-    machine.succeed("""
-      # Make sure that the file is properly compressed as the test would be meaningless otherwise
-      curl --compressed -v http://localhost/archive |& tr -s ' ' |& grep --ignore-case 'content-encoding: gzip'
-      archive_path=$(nix-prefetch-url http://localhost/archive --print-path | tail -n1)
-      [[ $(${fileCmd} --brief --mime-type $archive_path) == "application/zstd" ]]
-      tar --zstd -xf $archive_path
-    """)
-  '';
+      machine.wait_for_unit("nginx.service")
+      machine.succeed("""
+        # Make sure that the file is properly compressed as the test would be meaningless otherwise
+        curl --compressed -v http://localhost/archive |& tr -s ' ' |& grep --ignore-case 'content-encoding: gzip'
+        archive_path=$(nix-prefetch-url http://localhost/archive --print-path | tail -n1)
+        [[ $(${fileCmd} --brief --mime-type $archive_path) == "application/zstd" ]]
+        tar --zstd -xf $archive_path
+      """)
+    '';
 }
diff --git a/tests/nixos/nix-copy-closure.nix b/tests/nixos/nix-copy-closure.nix
index 44324e989..b6ec856e0 100644
--- a/tests/nixos/nix-copy-closure.nix
+++ b/tests/nixos/nix-copy-closure.nix
@@ -1,6 +1,11 @@
 # Test ‘nix-copy-closure’.
 
-{ lib, config, nixpkgs, ... }:
+{
+  lib,
+  config,
+  nixpkgs,
+  ...
+}:
 
 let
   pkgs = config.nodes.client.nixpkgs.pkgs;
@@ -10,74 +15,90 @@ let
   pkgC = pkgs.hello;
   pkgD = pkgs.tmux;
 
-in {
+in
+{
   name = "nix-copy-closure";
 
-  nodes =
-    { client =
-        { config, lib, pkgs, ... }:
-        { virtualisation.writableStore = true;
-          virtualisation.additionalPaths = [ pkgA pkgD.drvPath ];
-          nix.settings.substituters = lib.mkForce [ ];
-        };
+  nodes = {
+    client =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
+        virtualisation.writableStore = true;
+        virtualisation.additionalPaths = [
+          pkgA
+          pkgD.drvPath
+        ];
+        nix.settings.substituters = lib.mkForce [ ];
+      };
 
-      server =
-        { config, pkgs, ... }:
-        { services.openssh.enable = true;
-          virtualisation.writableStore = true;
-          virtualisation.additionalPaths = [ pkgB pkgC ];
-        };
-    };
+    server =
+      { config, pkgs, ... }:
+      {
+        services.openssh.enable = true;
+        virtualisation.writableStore = true;
+        virtualisation.additionalPaths = [
+          pkgB
+          pkgC
+        ];
+      };
+  };
 
-  testScript = { nodes }: ''
-    # fmt: off
-    import subprocess
+  testScript =
+    { nodes }:
+    ''
+      # fmt: off
+      import subprocess
 
-    start_all()
+      start_all()
 
-    # Create an SSH key on the client.
-    subprocess.run([
-      "${pkgs.openssh}/bin/ssh-keygen", "-t", "ed25519", "-f", "key", "-N", ""
-    ], capture_output=True, check=True)
+      # Create an SSH key on the client.
+      subprocess.run([
+        "${pkgs.openssh}/bin/ssh-keygen", "-t", "ed25519", "-f", "key", "-N", ""
+      ], capture_output=True, check=True)
 
-    client.succeed("mkdir -m 700 /root/.ssh")
-    client.copy_from_host("key", "/root/.ssh/id_ed25519")
-    client.succeed("chmod 600 /root/.ssh/id_ed25519")
+      client.succeed("mkdir -m 700 /root/.ssh")
+      client.copy_from_host("key", "/root/.ssh/id_ed25519")
+      client.succeed("chmod 600 /root/.ssh/id_ed25519")
 
-    # Install the SSH key on the server.
-    server.succeed("mkdir -m 700 /root/.ssh")
-    server.copy_from_host("key.pub", "/root/.ssh/authorized_keys")
-    server.wait_for_unit("sshd")
-    server.wait_for_unit("multi-user.target")
-    server.wait_for_unit("network-online.target")
+      # Install the SSH key on the server.
+      server.succeed("mkdir -m 700 /root/.ssh")
+      server.copy_from_host("key.pub", "/root/.ssh/authorized_keys")
+      server.wait_for_unit("sshd")
+      server.wait_for_unit("multi-user.target")
+      server.wait_for_unit("network-online.target")
 
-    client.wait_for_unit("network-online.target")
-    client.succeed(f"ssh -o StrictHostKeyChecking=no {server.name} 'echo hello world'")
+      client.wait_for_unit("network-online.target")
+      client.succeed(f"ssh -o StrictHostKeyChecking=no {server.name} 'echo hello world'")
 
-    # Copy the closure of package A from the client to the server.
-    server.fail("nix-store --check-validity ${pkgA}")
-    client.succeed("nix-copy-closure --to server --gzip ${pkgA} >&2")
-    server.succeed("nix-store --check-validity ${pkgA}")
+      # Copy the closure of package A from the client to the server.
+      server.fail("nix-store --check-validity ${pkgA}")
+      client.succeed("nix-copy-closure --to server --gzip ${pkgA} >&2")
+      server.succeed("nix-store --check-validity ${pkgA}")
 
-    # Copy the closure of package B from the server to the client.
-    client.fail("nix-store --check-validity ${pkgB}")
-    client.succeed("nix-copy-closure --from server --gzip ${pkgB} >&2")
-    client.succeed("nix-store --check-validity ${pkgB}")
+      # Copy the closure of package B from the server to the client.
+      client.fail("nix-store --check-validity ${pkgB}")
+      client.succeed("nix-copy-closure --from server --gzip ${pkgB} >&2")
+      client.succeed("nix-store --check-validity ${pkgB}")
 
-    # Copy the closure of package C via the SSH substituter.
-    client.fail("nix-store -r ${pkgC}")
+      # Copy the closure of package C via the SSH substituter.
+      client.fail("nix-store -r ${pkgC}")
 
-    # Copy the derivation of package D's derivation from the client to the server.
-    server.fail("nix-store --check-validity ${pkgD.drvPath}")
-    client.succeed("nix-copy-closure --to server --gzip ${pkgD.drvPath} >&2")
-    server.succeed("nix-store --check-validity ${pkgD.drvPath}")
+      # Copy the derivation of package D's derivation from the client to the server.
+      server.fail("nix-store --check-validity ${pkgD.drvPath}")
+      client.succeed("nix-copy-closure --to server --gzip ${pkgD.drvPath} >&2")
+      server.succeed("nix-store --check-validity ${pkgD.drvPath}")
 
-    # FIXME
-    # client.succeed(
-    #   "nix-store --option use-ssh-substituter true"
-    #   " --option ssh-substituter-hosts root\@server"
-    #   " -r ${pkgC} >&2"
-    # )
-    # client.succeed("nix-store --check-validity ${pkgC}")
-  '';
+      # FIXME
+      # client.succeed(
+      #   "nix-store --option use-ssh-substituter true"
+      #   " --option ssh-substituter-hosts root\@server"
+      #   " -r ${pkgC} >&2"
+      # )
+      # client.succeed("nix-store --check-validity ${pkgC}")
+    '';
 }
diff --git a/tests/nixos/nix-copy.nix b/tests/nixos/nix-copy.nix
index a6a04b52c..3565e83e7 100644
--- a/tests/nixos/nix-copy.nix
+++ b/tests/nixos/nix-copy.nix
@@ -2,7 +2,13 @@
 # Run interactively with:
 # rm key key.pub; nix run .#hydraJobs.tests.nix-copy.driverInteractive
 
-{ lib, config, nixpkgs, hostPkgs, ... }:
+{
+  lib,
+  config,
+  nixpkgs,
+  hostPkgs,
+  ...
+}:
 
 let
   pkgs = config.nodes.client.nixpkgs.pkgs;
@@ -12,101 +18,117 @@ let
   pkgC = pkgs.hello;
   pkgD = pkgs.tmux;
 
-in {
+in
+{
   name = "nix-copy";
 
   enableOCR = true;
 
-  nodes =
-    { client =
-        { config, lib, pkgs, ... }:
-        { virtualisation.writableStore = true;
-          virtualisation.additionalPaths = [ pkgA pkgD.drvPath ];
-          nix.settings.substituters = lib.mkForce [ ];
-          nix.settings.experimental-features = [ "nix-command" ];
-          services.getty.autologinUser = "root";
-          programs.ssh.extraConfig = ''
-            Host *
-                ControlMaster auto
-                ControlPath ~/.ssh/master-%h:%r@%n:%p
-                ControlPersist 15m
-          '';
-        };
+  nodes = {
+    client =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
+        virtualisation.writableStore = true;
+        virtualisation.additionalPaths = [
+          pkgA
+          pkgD.drvPath
+        ];
+        nix.settings.substituters = lib.mkForce [ ];
+        nix.settings.experimental-features = [ "nix-command" ];
+        services.getty.autologinUser = "root";
+        programs.ssh.extraConfig = ''
+          Host *
+              ControlMaster auto
+              ControlPath ~/.ssh/master-%h:%r@%n:%p
+              ControlPersist 15m
+        '';
+      };
 
-      server =
-        { config, pkgs, ... }:
-        { services.openssh.enable = true;
-          services.openssh.settings.PermitRootLogin = "yes";
-          users.users.root.hashedPasswordFile = null;
-          users.users.root.password = "foobar";
-          virtualisation.writableStore = true;
-          virtualisation.additionalPaths = [ pkgB pkgC ];
-        };
-    };
+    server =
+      { config, pkgs, ... }:
+      {
+        services.openssh.enable = true;
+        services.openssh.settings.PermitRootLogin = "yes";
+        users.users.root.hashedPasswordFile = null;
+        users.users.root.password = "foobar";
+        virtualisation.writableStore = true;
+        virtualisation.additionalPaths = [
+          pkgB
+          pkgC
+        ];
+      };
+  };
 
-  testScript = { nodes }: ''
-    # fmt: off
-    import subprocess
+  testScript =
+    { nodes }:
+    ''
+      # fmt: off
+      import subprocess
 
-    # Create an SSH key on the client.
-    subprocess.run([
-      "${pkgs.openssh}/bin/ssh-keygen", "-t", "ed25519", "-f", "key", "-N", ""
-    ], capture_output=True, check=True)
+      # Create an SSH key on the client.
+      subprocess.run([
+        "${pkgs.openssh}/bin/ssh-keygen", "-t", "ed25519", "-f", "key", "-N", ""
+      ], capture_output=True, check=True)
 
-    start_all()
+      start_all()
 
-    server.wait_for_unit("sshd")
-    server.wait_for_unit("multi-user.target")
-    server.wait_for_unit("network-online.target")
+      server.wait_for_unit("sshd")
+      server.wait_for_unit("multi-user.target")
+      server.wait_for_unit("network-online.target")
 
-    client.wait_for_unit("network-online.target")
-    client.wait_for_unit("getty@tty1.service")
-    # Either the prompt: ]#
-    # or an OCR misreading of it: 1#
-    client.wait_for_text("[]1]#")
+      client.wait_for_unit("network-online.target")
+      client.wait_for_unit("getty@tty1.service")
+      # Either the prompt: ]#
+      # or an OCR misreading of it: 1#
+      client.wait_for_text("[]1]#")
 
-    # Copy the closure of package A from the client to the server using password authentication,
-    # and check that all prompts are visible
-    server.fail("nix-store --check-validity ${pkgA}")
-    client.send_chars("nix copy --to ssh://server ${pkgA} >&2; echo -n do; echo ne\n")
-    client.wait_for_text("continue connecting")
-    client.send_chars("yes\n")
-    client.wait_for_text("Password:")
-    client.send_chars("foobar\n")
-    client.wait_for_text("done")
-    server.succeed("nix-store --check-validity ${pkgA}")
+      # Copy the closure of package A from the client to the server using password authentication,
+      # and check that all prompts are visible
+      server.fail("nix-store --check-validity ${pkgA}")
+      client.send_chars("nix copy --to ssh://server ${pkgA} >&2; echo -n do; echo ne\n")
+      client.wait_for_text("continue connecting")
+      client.send_chars("yes\n")
+      client.wait_for_text("Password:")
+      client.send_chars("foobar\n")
+      client.wait_for_text("done")
+      server.succeed("nix-store --check-validity ${pkgA}")
 
-    # Check that ControlMaster is working
-    client.send_chars("nix copy --to ssh://server ${pkgA} >&2; echo done\n")
-    client.wait_for_text("done")
+      # Check that ControlMaster is working
+      client.send_chars("nix copy --to ssh://server ${pkgA} >&2; echo done\n")
+      client.wait_for_text("done")
 
-    client.copy_from_host("key", "/root/.ssh/id_ed25519")
-    client.succeed("chmod 600 /root/.ssh/id_ed25519")
+      client.copy_from_host("key", "/root/.ssh/id_ed25519")
+      client.succeed("chmod 600 /root/.ssh/id_ed25519")
 
-    # Install the SSH key on the server.
-    server.copy_from_host("key.pub", "/root/.ssh/authorized_keys")
-    server.succeed("systemctl restart sshd")
-    client.succeed(f"ssh -o StrictHostKeyChecking=no {server.name} 'echo hello world'")
-    client.succeed(f"ssh -O check {server.name}")
-    client.succeed(f"ssh -O exit {server.name}")
-    client.fail(f"ssh -O check {server.name}")
+      # Install the SSH key on the server.
+      server.copy_from_host("key.pub", "/root/.ssh/authorized_keys")
+      server.succeed("systemctl restart sshd")
+      client.succeed(f"ssh -o StrictHostKeyChecking=no {server.name} 'echo hello world'")
+      client.succeed(f"ssh -O check {server.name}")
+      client.succeed(f"ssh -O exit {server.name}")
+      client.fail(f"ssh -O check {server.name}")
 
-    # Check that an explicit master will work
-    client.succeed(f"ssh -MNfS /tmp/master {server.name}")
-    client.succeed(f"ssh -S /tmp/master -O check {server.name}")
-    client.succeed("NIX_SSHOPTS='-oControlPath=/tmp/master' nix copy --to ssh://server ${pkgA} >&2")
-    client.succeed(f"ssh -S /tmp/master -O exit {server.name}")
+      # Check that an explicit master will work
+      client.succeed(f"ssh -MNfS /tmp/master {server.name}")
+      client.succeed(f"ssh -S /tmp/master -O check {server.name}")
+      client.succeed("NIX_SSHOPTS='-oControlPath=/tmp/master' nix copy --to ssh://server ${pkgA} >&2")
+      client.succeed(f"ssh -S /tmp/master -O exit {server.name}")
 
-    # Copy the closure of package B from the server to the client, using ssh-ng.
-    client.fail("nix-store --check-validity ${pkgB}")
-    # Shouldn't download untrusted paths by default
-    client.fail("nix copy --from ssh-ng://server ${pkgB} >&2")
-    client.succeed("nix copy --no-check-sigs --from ssh-ng://server ${pkgB} >&2")
-    client.succeed("nix-store --check-validity ${pkgB}")
+      # Copy the closure of package B from the server to the client, using ssh-ng.
+      client.fail("nix-store --check-validity ${pkgB}")
+      # Shouldn't download untrusted paths by default
+      client.fail("nix copy --from ssh-ng://server ${pkgB} >&2")
+      client.succeed("nix copy --no-check-sigs --from ssh-ng://server ${pkgB} >&2")
+      client.succeed("nix-store --check-validity ${pkgB}")
 
-    # Copy the derivation of package D's derivation from the client to the server.
-    server.fail("nix-store --check-validity ${pkgD.drvPath}")
-    client.succeed("nix copy --derivation --to ssh://server ${pkgD.drvPath} >&2")
-    server.succeed("nix-store --check-validity ${pkgD.drvPath}")
-  '';
+      # Copy the derivation of package D's derivation from the client to the server.
+      server.fail("nix-store --check-validity ${pkgD.drvPath}")
+      client.succeed("nix copy --derivation --to ssh://server ${pkgD.drvPath} >&2")
+      server.succeed("nix-store --check-validity ${pkgD.drvPath}")
+    '';
 }
diff --git a/tests/nixos/nix-docker.nix b/tests/nixos/nix-docker.nix
index 00b04482c..bd77b25c8 100644
--- a/tests/nixos/nix-docker.nix
+++ b/tests/nixos/nix-docker.nix
@@ -1,6 +1,12 @@
 # Test the container built by ../../docker.nix.
 
-{ lib, config, nixpkgs, hostPkgs, ... }:
+{
+  lib,
+  config,
+  nixpkgs,
+  hostPkgs,
+  ...
+}:
 
 let
   pkgs = config.nodes.machine.nixpkgs.pkgs;
@@ -19,36 +25,54 @@ let
 
   containerTestScript = ./nix-docker-test.sh;
 
-in {
+in
+{
   name = "nix-docker";
 
-  nodes =
-    { machine =
-        { config, lib, pkgs, ... }:
-        { virtualisation.diskSize = 4096;
-        };
-      cache =
-        { config, lib, pkgs, ... }:
-        { virtualisation.additionalPaths = [ pkgs.stdenv pkgs.hello ];
-          services.harmonia.enable = true;
-          networking.firewall.allowedTCPPorts = [ 5000 ];
-        };
-    };
+  nodes = {
+    machine =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
+        virtualisation.diskSize = 4096;
+      };
+    cache =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
+        virtualisation.additionalPaths = [
+          pkgs.stdenv
+          pkgs.hello
+        ];
+        services.harmonia.enable = true;
+        networking.firewall.allowedTCPPorts = [ 5000 ];
+      };
+  };
 
-  testScript = { nodes }: ''
-    cache.wait_for_unit("harmonia.service")
-    cache.wait_for_unit("network-online.target")
+  testScript =
+    { nodes }:
+    ''
+      cache.wait_for_unit("harmonia.service")
+      cache.wait_for_unit("network-online.target")
 
-    machine.succeed("mkdir -p /etc/containers")
-    machine.succeed("""echo '{"default":[{"type":"insecureAcceptAnything"}]}' > /etc/containers/policy.json""")
+      machine.succeed("mkdir -p /etc/containers")
+      machine.succeed("""echo '{"default":[{"type":"insecureAcceptAnything"}]}' > /etc/containers/policy.json""")
 
-    machine.succeed("${pkgs.podman}/bin/podman load -i ${nixImage}")
-    machine.succeed("${pkgs.podman}/bin/podman run --rm nix nix --version")
-    machine.succeed("${pkgs.podman}/bin/podman run --rm -i nix < ${containerTestScript}")
+      machine.succeed("${pkgs.podman}/bin/podman load -i ${nixImage}")
+      machine.succeed("${pkgs.podman}/bin/podman run --rm nix nix --version")
+      machine.succeed("${pkgs.podman}/bin/podman run --rm -i nix < ${containerTestScript}")
 
-    machine.succeed("${pkgs.podman}/bin/podman load -i ${nixUserImage}")
-    machine.succeed("${pkgs.podman}/bin/podman run --rm nix-user nix --version")
-    machine.succeed("${pkgs.podman}/bin/podman run --rm -i nix-user < ${containerTestScript}")
-    machine.succeed("[[ $(${pkgs.podman}/bin/podman run --rm nix-user stat -c %u /nix/store) = 1000 ]]")
-  '';
+      machine.succeed("${pkgs.podman}/bin/podman load -i ${nixUserImage}")
+      machine.succeed("${pkgs.podman}/bin/podman run --rm nix-user nix --version")
+      machine.succeed("${pkgs.podman}/bin/podman run --rm -i nix-user < ${containerTestScript}")
+      machine.succeed("[[ $(${pkgs.podman}/bin/podman run --rm nix-user stat -c %u /nix/store) = 1000 ]]")
+    '';
 }
diff --git a/tests/nixos/nss-preload.nix b/tests/nixos/nss-preload.nix
index b7e704f39..29cd5e6a2 100644
--- a/tests/nixos/nss-preload.nix
+++ b/tests/nixos/nss-preload.nix
@@ -1,4 +1,9 @@
-{ lib, config, nixpkgs, ... }:
+{
+  lib,
+  config,
+  nixpkgs,
+  ...
+}:
 
 let
 
@@ -44,81 +49,119 @@ in
   name = "nss-preload";
 
   nodes = {
-    http_dns = { lib, pkgs, config, ... }: {
-      networking.firewall.enable = false;
-      networking.interfaces.eth1.ipv6.addresses = lib.mkForce [
-        { address = "fd21::1"; prefixLength = 64; }
-      ];
-      networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
-        { address = "192.168.0.1"; prefixLength = 24; }
-      ];
+    http_dns =
+      {
+        lib,
+        pkgs,
+        config,
+        ...
+      }:
+      {
+        networking.firewall.enable = false;
+        networking.interfaces.eth1.ipv6.addresses = lib.mkForce [
+          {
+            address = "fd21::1";
+            prefixLength = 64;
+          }
+        ];
+        networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+          {
+            address = "192.168.0.1";
+            prefixLength = 24;
+          }
+        ];
 
-      services.unbound = {
-        enable = true;
-        enableRootTrustAnchor = false;
-        settings = {
-          server = {
-            interface = [ "192.168.0.1" "fd21::1" "::1" "127.0.0.1" ];
-            access-control = [ "192.168.0.0/24 allow" "fd21::/64 allow" "::1 allow" "127.0.0.0/8 allow" ];
-            local-data = [
-              ''"example.com. IN A 192.168.0.1"''
-              ''"example.com. IN AAAA fd21::1"''
-              ''"tarballs.nixos.org. IN A 192.168.0.1"''
-              ''"tarballs.nixos.org. IN AAAA fd21::1"''
-            ];
+        services.unbound = {
+          enable = true;
+          enableRootTrustAnchor = false;
+          settings = {
+            server = {
+              interface = [
+                "192.168.0.1"
+                "fd21::1"
+                "::1"
+                "127.0.0.1"
+              ];
+              access-control = [
+                "192.168.0.0/24 allow"
+                "fd21::/64 allow"
+                "::1 allow"
+                "127.0.0.0/8 allow"
+              ];
+              local-data = [
+                ''"example.com. IN A 192.168.0.1"''
+                ''"example.com. IN AAAA fd21::1"''
+                ''"tarballs.nixos.org. IN A 192.168.0.1"''
+                ''"tarballs.nixos.org. IN AAAA fd21::1"''
+              ];
+            };
+          };
+        };
+
+        services.nginx = {
+          enable = true;
+          virtualHosts."example.com" = {
+            root = pkgs.runCommand "testdir" { } ''
+              mkdir "$out"
+              echo hello world > "$out/index.html"
+            '';
           };
         };
       };
 
-      services.nginx = {
-        enable = true;
-        virtualHosts."example.com" = {
-          root = pkgs.runCommand "testdir" {} ''
-            mkdir "$out"
-            echo hello world > "$out/index.html"
-          '';
-        };
-      };
-    };
-
     # client consumes a remote resolver
-    client = { lib, nodes, pkgs, ... }: {
-      networking.useDHCP = false;
-      networking.nameservers = [
-        (lib.head nodes.http_dns.networking.interfaces.eth1.ipv6.addresses).address
-        (lib.head nodes.http_dns.networking.interfaces.eth1.ipv4.addresses).address
-      ];
-      networking.interfaces.eth1.ipv6.addresses = [
-        { address = "fd21::10"; prefixLength = 64; }
-      ];
-      networking.interfaces.eth1.ipv4.addresses = [
-        { address = "192.168.0.10"; prefixLength = 24; }
-      ];
+    client =
+      {
+        lib,
+        nodes,
+        pkgs,
+        ...
+      }:
+      {
+        networking.useDHCP = false;
+        networking.nameservers = [
+          (lib.head nodes.http_dns.networking.interfaces.eth1.ipv6.addresses).address
+          (lib.head nodes.http_dns.networking.interfaces.eth1.ipv4.addresses).address
+        ];
+        networking.interfaces.eth1.ipv6.addresses = [
+          {
+            address = "fd21::10";
+            prefixLength = 64;
+          }
+        ];
+        networking.interfaces.eth1.ipv4.addresses = [
+          {
+            address = "192.168.0.10";
+            prefixLength = 24;
+          }
+        ];
 
-      nix.settings.extra-sandbox-paths = lib.mkForce [];
-      nix.settings.substituters = lib.mkForce [];
-      nix.settings.sandbox = lib.mkForce true;
-    };
+        nix.settings.extra-sandbox-paths = lib.mkForce [ ];
+        nix.settings.substituters = lib.mkForce [ ];
+        nix.settings.sandbox = lib.mkForce true;
+      };
   };
 
-  testScript = { nodes, ... }: ''
-    http_dns.wait_for_unit("network-online.target")
-    http_dns.wait_for_unit("nginx")
-    http_dns.wait_for_open_port(80)
-    http_dns.wait_for_unit("unbound")
-    http_dns.wait_for_open_port(53)
+  testScript =
+    { nodes, ... }:
+    ''
+      http_dns.wait_for_unit("network-online.target")
+      http_dns.wait_for_unit("nginx")
+      http_dns.wait_for_open_port(80)
+      http_dns.wait_for_unit("unbound")
+      http_dns.wait_for_open_port(53)
 
-    client.start()
-    client.wait_for_unit('multi-user.target')
-    client.wait_for_unit('network-online.target')
+      client.start()
+      client.wait_for_unit('multi-user.target')
+      client.wait_for_unit('network-online.target')
 
-    with subtest("can fetch data from a remote server outside sandbox"):
-        client.succeed("nix --version >&2")
-        client.succeed("curl -vvv http://example.com/index.html >&2")
+      with subtest("can fetch data from a remote server outside sandbox"):
+          client.succeed("nix --version >&2")
+          client.succeed("curl -vvv http://example.com/index.html >&2")
 
-    with subtest("nix-build can lookup dns and fetch data"):
-        client.succeed("""
-          nix-build ${nix-fetch} >&2
-          """)
-  '';
+      with subtest("nix-build can lookup dns and fetch data"):
+          client.succeed("""
+            nix-build ${nix-fetch} >&2
+            """)
+    '';
 }
diff --git a/tests/nixos/remote-builds-ssh-ng.nix b/tests/nixos/remote-builds-ssh-ng.nix
index 3562d2d2f..726522029 100644
--- a/tests/nixos/remote-builds-ssh-ng.nix
+++ b/tests/nixos/remote-builds-ssh-ng.nix
@@ -1,11 +1,17 @@
-test@{ config, lib, hostPkgs, ... }:
+test@{
+  config,
+  lib,
+  hostPkgs,
+  ...
+}:
 
 let
   pkgs = config.nodes.client.nixpkgs.pkgs;
 
   # Trivial Nix expression to build remotely.
-  expr = config: nr: pkgs.writeText "expr.nix"
-    ''
+  expr =
+    config: nr:
+    pkgs.writeText "expr.nix" ''
       let utils = builtins.storePath ${config.system.build.extraUtils}; in
       derivation {
         name = "hello-${toString nr}";
@@ -41,87 +47,94 @@ in
   config = {
     name = lib.mkDefault "remote-builds-ssh-ng";
 
-    nodes =
-      {
-        builder =
-          { config, pkgs, ... }:
-          {
-            imports = [ test.config.builders.config ];
-            services.openssh.enable = true;
-            virtualisation.writableStore = true;
-            nix.settings.sandbox = true;
-            nix.settings.substituters = lib.mkForce [ ];
-          };
+    nodes = {
+      builder =
+        { config, pkgs, ... }:
+        {
+          imports = [ test.config.builders.config ];
+          services.openssh.enable = true;
+          virtualisation.writableStore = true;
+          nix.settings.sandbox = true;
+          nix.settings.substituters = lib.mkForce [ ];
+        };
 
-        client =
-          { config, lib, pkgs, ... }:
-          {
-            nix.settings.max-jobs = 0; # force remote building
-            nix.distributedBuilds = true;
-            nix.buildMachines =
-              [{
-                hostName = "builder";
-                sshUser = "root";
-                sshKey = "/root/.ssh/id_ed25519";
-                system = "i686-linux";
-                maxJobs = 1;
-                protocol = "ssh-ng";
-              }];
-            virtualisation.writableStore = true;
-            virtualisation.additionalPaths = [ config.system.build.extraUtils ];
-            nix.settings.substituters = lib.mkForce [ ];
-            programs.ssh.extraConfig = "ConnectTimeout 30";
-          };
-      };
+      client =
+        {
+          config,
+          lib,
+          pkgs,
+          ...
+        }:
+        {
+          nix.settings.max-jobs = 0; # force remote building
+          nix.distributedBuilds = true;
+          nix.buildMachines = [
+            {
+              hostName = "builder";
+              sshUser = "root";
+              sshKey = "/root/.ssh/id_ed25519";
+              system = "i686-linux";
+              maxJobs = 1;
+              protocol = "ssh-ng";
+            }
+          ];
+          virtualisation.writableStore = true;
+          virtualisation.additionalPaths = [ config.system.build.extraUtils ];
+          nix.settings.substituters = lib.mkForce [ ];
+          programs.ssh.extraConfig = "ConnectTimeout 30";
+        };
+    };
 
-    testScript = { nodes }: ''
-      # fmt: off
-      import subprocess
+    testScript =
+      { nodes }:
+      ''
+        # fmt: off
+        import subprocess
 
-      start_all()
+        start_all()
 
-      # Create an SSH key on the client.
-      subprocess.run([
-        "${hostPkgs.openssh}/bin/ssh-keygen", "-t", "ed25519", "-f", "key", "-N", ""
-      ], capture_output=True, check=True)
-      client.succeed("mkdir -p -m 700 /root/.ssh")
-      client.copy_from_host("key", "/root/.ssh/id_ed25519")
-      client.succeed("chmod 600 /root/.ssh/id_ed25519")
+        # Create an SSH key on the client.
+        subprocess.run([
+          "${hostPkgs.openssh}/bin/ssh-keygen", "-t", "ed25519", "-f", "key", "-N", ""
+        ], capture_output=True, check=True)
+        client.succeed("mkdir -p -m 700 /root/.ssh")
+        client.copy_from_host("key", "/root/.ssh/id_ed25519")
+        client.succeed("chmod 600 /root/.ssh/id_ed25519")
 
-      # Install the SSH key on the builder.
-      client.wait_for_unit("network-online.target")
-      builder.succeed("mkdir -p -m 700 /root/.ssh")
-      builder.copy_from_host("key.pub", "/root/.ssh/authorized_keys")
-      builder.wait_for_unit("sshd")
-      builder.wait_for_unit("multi-user.target")
-      builder.wait_for_unit("network-online.target")
+        # Install the SSH key on the builder.
+        client.wait_for_unit("network-online.target")
+        builder.succeed("mkdir -p -m 700 /root/.ssh")
+        builder.copy_from_host("key.pub", "/root/.ssh/authorized_keys")
+        builder.wait_for_unit("sshd")
+        builder.wait_for_unit("multi-user.target")
+        builder.wait_for_unit("network-online.target")
 
-      client.succeed(f"ssh -o StrictHostKeyChecking=no {builder.name} 'echo hello world'")
+        client.succeed(f"ssh -o StrictHostKeyChecking=no {builder.name} 'echo hello world'")
 
-      # Perform a build
-      out = client.succeed("nix-build ${expr nodes.client 1} 2> build-output")
+        # Perform a build
+        out = client.succeed("nix-build ${expr nodes.client 1} 2> build-output")
 
-      # Verify that the build was done on the builder
-      builder.succeed(f"test -e {out.strip()}")
+        # Verify that the build was done on the builder
+        builder.succeed(f"test -e {out.strip()}")
 
-      # Print the build log, prefix the log lines to avoid nix intercepting lines starting with @nix
-      buildOutput = client.succeed("sed -e 's/^/build-output:/' build-output")
-      print(buildOutput)
+        # Print the build log, prefix the log lines to avoid nix intercepting lines starting with @nix
+        buildOutput = client.succeed("sed -e 's/^/build-output:/' build-output")
+        print(buildOutput)
 
-      # Make sure that we get the expected build output
-      client.succeed("grep -qF Hello build-output")
+        # Make sure that we get the expected build output
+        client.succeed("grep -qF Hello build-output")
 
-      # We don't want phase reporting in the build output
-      client.fail("grep -qF '@nix' build-output")
+        # We don't want phase reporting in the build output
+        client.fail("grep -qF '@nix' build-output")
 
-      # Get the log file
-      client.succeed(f"nix-store --read-log {out.strip()} > log-output")
-      # Prefix the log lines to avoid nix intercepting lines starting with @nix
-      logOutput = client.succeed("sed -e 's/^/log-file:/' log-output")
-      print(logOutput)
+        # Get the log file
+        client.succeed(f"nix-store --read-log {out.strip()} > log-output")
+        # Prefix the log lines to avoid nix intercepting lines starting with @nix
+        logOutput = client.succeed("sed -e 's/^/log-file:/' log-output")
+        print(logOutput)
 
-      # Check that we get phase reporting in the log file
-      client.succeed("grep -q '@nix {\"action\":\"setPhase\",\"phase\":\"buildPhase\"}' log-output")
-    '';
+        # Check that we get phase reporting in the log file
+        client.succeed("grep -q '@nix {\"action\":\"setPhase\",\"phase\":\"buildPhase\"}' log-output")
+      '';
   };
 }
diff --git a/tests/nixos/remote-builds.nix b/tests/nixos/remote-builds.nix
index 4fca4b938..3251984db 100644
--- a/tests/nixos/remote-builds.nix
+++ b/tests/nixos/remote-builds.nix
@@ -1,6 +1,11 @@
 # Test Nix's remote build feature.
 
-test@{ config, lib, hostPkgs, ... }:
+test@{
+  config,
+  lib,
+  hostPkgs,
+  ...
+}:
 
 let
   pkgs = config.nodes.client.nixpkgs.pkgs;
@@ -21,8 +26,9 @@ let
     };
 
   # Trivial Nix expression to build remotely.
-  expr = config: nr: pkgs.writeText "expr.nix"
-    ''
+  expr =
+    config: nr:
+    pkgs.writeText "expr.nix" ''
       let utils = builtins.storePath ${config.system.build.extraUtils}; in
       derivation {
         name = "hello-${toString nr}";
@@ -52,107 +58,112 @@ in
   config = {
     name = lib.mkDefault "remote-builds";
 
-    nodes =
-      {
-        builder1 = builder;
-        builder2 = builder;
+    nodes = {
+      builder1 = builder;
+      builder2 = builder;
 
-        client =
-          { config, lib, pkgs, ... }:
-          {
-            nix.settings.max-jobs = 0; # force remote building
-            nix.distributedBuilds = true;
-            nix.buildMachines =
-              [
-                {
-                  hostName = "builder1";
-                  sshUser = "root";
-                  sshKey = "/root/.ssh/id_ed25519";
-                  system = "i686-linux";
-                  maxJobs = 1;
-                }
-                {
-                  hostName = "builder2";
-                  sshUser = "root";
-                  sshKey = "/root/.ssh/id_ed25519";
-                  system = "i686-linux";
-                  maxJobs = 1;
-                }
-              ];
-            virtualisation.writableStore = true;
-            virtualisation.additionalPaths = [ config.system.build.extraUtils ];
-            nix.settings.substituters = lib.mkForce [ ];
-            programs.ssh.extraConfig = "ConnectTimeout 30";
-            environment.systemPackages = [
-              # `bad-shell` is used to make sure Nix works in an environment with a misbehaving shell.
-              #
-              # More realistically, a bad shell would still run the command ("echo started")
-              # but considering that our solution is to avoid this shell (set via $SHELL), we
-              # don't need to bother with a more functional mock shell.
-              (pkgs.writeScriptBin "bad-shell" ''
-                #!${pkgs.runtimeShell}
-                echo "Hello, I am a broken shell"
-              '')
-            ];
-          };
-      };
+      client =
+        {
+          config,
+          lib,
+          pkgs,
+          ...
+        }:
+        {
+          nix.settings.max-jobs = 0; # force remote building
+          nix.distributedBuilds = true;
+          nix.buildMachines = [
+            {
+              hostName = "builder1";
+              sshUser = "root";
+              sshKey = "/root/.ssh/id_ed25519";
+              system = "i686-linux";
+              maxJobs = 1;
+            }
+            {
+              hostName = "builder2";
+              sshUser = "root";
+              sshKey = "/root/.ssh/id_ed25519";
+              system = "i686-linux";
+              maxJobs = 1;
+            }
+          ];
+          virtualisation.writableStore = true;
+          virtualisation.additionalPaths = [ config.system.build.extraUtils ];
+          nix.settings.substituters = lib.mkForce [ ];
+          programs.ssh.extraConfig = "ConnectTimeout 30";
+          environment.systemPackages = [
+            # `bad-shell` is used to make sure Nix works in an environment with a misbehaving shell.
+            #
+            # More realistically, a bad shell would still run the command ("echo started")
+            # but considering that our solution is to avoid this shell (set via $SHELL), we
+            # don't need to bother with a more functional mock shell.
+            (pkgs.writeScriptBin "bad-shell" ''
+              #!${pkgs.runtimeShell}
+              echo "Hello, I am a broken shell"
+            '')
+          ];
+        };
+    };
 
-    testScript = { nodes }: ''
-      # fmt: off
-      import subprocess
+    testScript =
+      { nodes }:
+      ''
+        # fmt: off
+        import subprocess
 
-      start_all()
+        start_all()
 
-      # Create an SSH key on the client.
-      subprocess.run([
-        "${hostPkgs.openssh}/bin/ssh-keygen", "-t", "ed25519", "-f", "key", "-N", ""
-      ], capture_output=True, check=True)
-      client.succeed("mkdir -p -m 700 /root/.ssh")
-      client.copy_from_host("key", "/root/.ssh/id_ed25519")
-      client.succeed("chmod 600 /root/.ssh/id_ed25519")
+        # Create an SSH key on the client.
+        subprocess.run([
+          "${hostPkgs.openssh}/bin/ssh-keygen", "-t", "ed25519", "-f", "key", "-N", ""
+        ], capture_output=True, check=True)
+        client.succeed("mkdir -p -m 700 /root/.ssh")
+        client.copy_from_host("key", "/root/.ssh/id_ed25519")
+        client.succeed("chmod 600 /root/.ssh/id_ed25519")
 
-      # Install the SSH key on the builders.
-      client.wait_for_unit("network-online.target")
-      for builder in [builder1, builder2]:
-        builder.succeed("mkdir -p -m 700 /root/.ssh")
-        builder.copy_from_host("key.pub", "/root/.ssh/authorized_keys")
-        builder.wait_for_unit("sshd")
-        builder.wait_for_unit("network-online.target")
-        # Make sure the builder can handle our login correctly
-        builder.wait_for_unit("multi-user.target")
-        # Make sure there's no funny business on the client either
-        # (should not be necessary, but we have reason to be careful)
-        client.wait_for_unit("multi-user.target")
-        client.succeed(f"""
-          ssh -o StrictHostKeyChecking=no {builder.name} \
-            'echo hello world on $(hostname)' >&2
-        """)
+        # Install the SSH key on the builders.
+        client.wait_for_unit("network-online.target")
+        for builder in [builder1, builder2]:
+          builder.succeed("mkdir -p -m 700 /root/.ssh")
+          builder.copy_from_host("key.pub", "/root/.ssh/authorized_keys")
+          builder.wait_for_unit("sshd")
+          builder.wait_for_unit("network-online.target")
+          # Make sure the builder can handle our login correctly
+          builder.wait_for_unit("multi-user.target")
+          # Make sure there's no funny business on the client either
+          # (should not be necessary, but we have reason to be careful)
+          client.wait_for_unit("multi-user.target")
+          client.succeed(f"""
+            ssh -o StrictHostKeyChecking=no {builder.name} \
+              'echo hello world on $(hostname)' >&2
+          """)
 
-      ${lib.optionalString supportsBadShell ''
-      # Check that SSH uses SHELL for LocalCommand, as expected, and check that
-      # our test setup here is working. The next test will use this bad SHELL.
-      client.succeed(f"SHELL=$(which bad-shell) ssh -oLocalCommand='true' -oPermitLocalCommand=yes {builder1.name} 'echo hello world' | grep -F 'Hello, I am a broken shell'")
-      ''}
+        ${lib.optionalString supportsBadShell ''
+          # Check that SSH uses SHELL for LocalCommand, as expected, and check that
+          # our test setup here is working. The next test will use this bad SHELL.
+          client.succeed(f"SHELL=$(which bad-shell) ssh -oLocalCommand='true' -oPermitLocalCommand=yes {builder1.name} 'echo hello world' | grep -F 'Hello, I am a broken shell'")
+        ''}
 
-      # Perform a build and check that it was performed on the builder.
-      out = client.succeed(
-        "${lib.optionalString supportsBadShell "SHELL=$(which bad-shell)"} nix-build ${expr nodes.client 1} 2> build-output",
-        "grep -q Hello build-output"
-      )
-      builder1.succeed(f"test -e {out}")
+        # Perform a build and check that it was performed on the builder.
+        out = client.succeed(
+          "${lib.optionalString supportsBadShell "SHELL=$(which bad-shell)"} nix-build ${expr nodes.client 1} 2> build-output",
+          "grep -q Hello build-output"
+        )
+        builder1.succeed(f"test -e {out}")
 
-      # And a parallel build.
-      paths = client.succeed(r'nix-store -r $(nix-instantiate ${expr nodes.client 2})\!out $(nix-instantiate ${expr nodes.client 3})\!out')
-      out1, out2 = paths.split()
-      builder1.succeed(f"test -e {out1} -o -e {out2}")
-      builder2.succeed(f"test -e {out1} -o -e {out2}")
+        # And a parallel build.
+        paths = client.succeed(r'nix-store -r $(nix-instantiate ${expr nodes.client 2})\!out $(nix-instantiate ${expr nodes.client 3})\!out')
+        out1, out2 = paths.split()
+        builder1.succeed(f"test -e {out1} -o -e {out2}")
+        builder2.succeed(f"test -e {out1} -o -e {out2}")
 
-      # And a failing build.
-      client.fail("nix-build ${expr nodes.client 5}")
+        # And a failing build.
+        client.fail("nix-build ${expr nodes.client 5}")
 
-      # Test whether the build hook automatically skips unavailable builders.
-      builder1.block()
-      client.succeed("nix-build ${expr nodes.client 4}")
-    '';
+        # Test whether the build hook automatically skips unavailable builders.
+        builder1.block()
+        client.succeed("nix-build ${expr nodes.client 4}")
+      '';
   };
 }
diff --git a/tests/nixos/s3-binary-cache-store.nix b/tests/nixos/s3-binary-cache-store.nix
index f8659b830..8e4808660 100644
--- a/tests/nixos/s3-binary-cache-store.nix
+++ b/tests/nixos/s3-binary-cache-store.nix
@@ -1,4 +1,9 @@
-{ lib, config, nixpkgs, ... }:
+{
+  lib,
+  config,
+  nixpkgs,
+  ...
+}:
 
 let
   pkgs = config.nodes.client.nixpkgs.pkgs;
@@ -12,71 +17,81 @@ let
   storeUrl = "s3://my-cache?endpoint=http://server:9000&region=eu-west-1";
   objectThatDoesNotExist = "s3://my-cache/foo-that-does-not-exist?endpoint=http://server:9000&region=eu-west-1";
 
-in {
+in
+{
   name = "s3-binary-cache-store";
 
-  nodes =
-    { server =
-        { config, lib, pkgs, ... }:
-        { virtualisation.writableStore = true;
-          virtualisation.additionalPaths = [ pkgA ];
-          environment.systemPackages = [ pkgs.minio-client ];
-          nix.extraOptions = ''
-            experimental-features = nix-command
-            substituters =
-          '';
-          services.minio = {
-            enable = true;
-            region = "eu-west-1";
-            rootCredentialsFile = pkgs.writeText "minio-credentials-full" ''
-              MINIO_ROOT_USER=${accessKey}
-              MINIO_ROOT_PASSWORD=${secretKey}
-            '';
-          };
-          networking.firewall.allowedTCPPorts = [ 9000 ];
-        };
-
-      client =
-        { config, pkgs, ... }:
-        { virtualisation.writableStore = true;
-          nix.extraOptions = ''
-            experimental-features = nix-command
-            substituters =
+  nodes = {
+    server =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
+        virtualisation.writableStore = true;
+        virtualisation.additionalPaths = [ pkgA ];
+        environment.systemPackages = [ pkgs.minio-client ];
+        nix.extraOptions = ''
+          experimental-features = nix-command
+          substituters =
+        '';
+        services.minio = {
+          enable = true;
+          region = "eu-west-1";
+          rootCredentialsFile = pkgs.writeText "minio-credentials-full" ''
+            MINIO_ROOT_USER=${accessKey}
+            MINIO_ROOT_PASSWORD=${secretKey}
           '';
         };
-    };
+        networking.firewall.allowedTCPPorts = [ 9000 ];
+      };
 
-  testScript = { nodes }: ''
-    # fmt: off
-    start_all()
+    client =
+      { config, pkgs, ... }:
+      {
+        virtualisation.writableStore = true;
+        nix.extraOptions = ''
+          experimental-features = nix-command
+          substituters =
+        '';
+      };
+  };
 
-    # Create a binary cache.
-    server.wait_for_unit("minio")
-    server.wait_for_unit("network-online.target")
+  testScript =
+    { nodes }:
+    ''
+      # fmt: off
+      start_all()
 
-    server.succeed("mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4")
-    server.succeed("mc mb minio/my-cache")
+      # Create a binary cache.
+      server.wait_for_unit("minio")
+      server.wait_for_unit("network-online.target")
 
-    server.succeed("${env} nix copy --to '${storeUrl}' ${pkgA}")
+      server.succeed("mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4")
+      server.succeed("mc mb minio/my-cache")
 
-    client.wait_for_unit("network-online.target")
+      server.succeed("${env} nix copy --to '${storeUrl}' ${pkgA}")
 
-    # Test fetchurl on s3:// URLs while we're at it.
-    client.succeed("${env} nix eval --impure --expr 'builtins.fetchurl { name = \"foo\"; url = \"s3://my-cache/nix-cache-info?endpoint=http://server:9000&region=eu-west-1\"; }'")
+      client.wait_for_unit("network-online.target")
 
-    # Test that the format string in the error message is properly setup and won't display `%s` instead of the failed URI
-    msg = client.fail("${env} nix eval --impure --expr 'builtins.fetchurl { name = \"foo\"; url = \"${objectThatDoesNotExist}\"; }' 2>&1")
-    if "S3 object '${objectThatDoesNotExist}' does not exist" not in msg:
-      print(msg) # So that you can see the message that was improperly formatted
-      raise Exception("Error message formatting didn't work")
+      # Test fetchurl on s3:// URLs while we're at it.
+      client.succeed("${env} nix eval --impure --expr 'builtins.fetchurl { name = \"foo\"; url = \"s3://my-cache/nix-cache-info?endpoint=http://server:9000&region=eu-west-1\"; }'")
 
-    # Copy a package from the binary cache.
-    client.fail("nix path-info ${pkgA}")
+      # Test that the format string in the error message is properly setup and won't display `%s` instead of the failed URI
+      msg = client.fail("${env} nix eval --impure --expr 'builtins.fetchurl { name = \"foo\"; url = \"${objectThatDoesNotExist}\"; }' 2>&1")
+      if "S3 object '${objectThatDoesNotExist}' does not exist" not in msg:
+        print(msg) # So that you can see the message that was improperly formatted
+        raise Exception("Error message formatting didn't work")
 
-    client.succeed("${env} nix store info --store '${storeUrl}' >&2")
+      # Copy a package from the binary cache.
+      client.fail("nix path-info ${pkgA}")
 
-    client.succeed("${env} nix copy --no-check-sigs --from '${storeUrl}' ${pkgA}")
+      client.succeed("${env} nix store info --store '${storeUrl}' >&2")
 
-    client.succeed("nix path-info ${pkgA}")
-  '';
+      client.succeed("${env} nix copy --no-check-sigs --from '${storeUrl}' ${pkgA}")
+
+      client.succeed("nix path-info ${pkgA}")
+    '';
 }
diff --git a/tests/nixos/setuid.nix b/tests/nixos/setuid.nix
index 2b66320dd..dc368e383 100644
--- a/tests/nixos/setuid.nix
+++ b/tests/nixos/setuid.nix
@@ -1,6 +1,11 @@
 # Verify that Linux builds cannot create setuid or setgid binaries.
 
-{ lib, config, nixpkgs, ... }:
+{
+  lib,
+  config,
+  nixpkgs,
+  ...
+}:
 
 let
   pkgs = config.nodes.machine.nixpkgs.pkgs;
@@ -10,116 +15,127 @@ in
   name = "setuid";
 
   nodes.machine =
-    { config, lib, pkgs, ... }:
-    { virtualisation.writableStore = true;
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      virtualisation.writableStore = true;
       nix.settings.substituters = lib.mkForce [ ];
       nix.nixPath = [ "nixpkgs=${lib.cleanSource pkgs.path}" ];
-      virtualisation.additionalPaths = [ pkgs.stdenvNoCC pkgs.pkgsi686Linux.stdenvNoCC ];
+      virtualisation.additionalPaths = [
+        pkgs.stdenvNoCC
+        pkgs.pkgsi686Linux.stdenvNoCC
+      ];
     };
 
-  testScript = { nodes }: ''
-    # fmt: off
-    start_all()
+  testScript =
+    { nodes }:
+    ''
+      # fmt: off
+      start_all()
 
-    # Copying to /tmp should succeed.
-    machine.succeed(r"""
-    nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" {} "
-      mkdir -p $out
-      cp ${pkgs.coreutils}/bin/id /tmp/id
-    ")'
-    """.strip())
+      # Copying to /tmp should succeed.
+      machine.succeed(r"""
+      nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" {} "
+        mkdir -p $out
+        cp ${pkgs.coreutils}/bin/id /tmp/id
+      ")'
+      """.strip())
 
-    machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
+      machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
 
-    machine.succeed("rm /tmp/id")
+      machine.succeed("rm /tmp/id")
 
-    # Creating a setuid binary should fail.
-    machine.fail(r"""
-    nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" {} "
-      mkdir -p $out
-      cp ${pkgs.coreutils}/bin/id /tmp/id
-      chmod 4755 /tmp/id
-    ")'
-    """.strip())
+      # Creating a setuid binary should fail.
+      machine.fail(r"""
+      nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" {} "
+        mkdir -p $out
+        cp ${pkgs.coreutils}/bin/id /tmp/id
+        chmod 4755 /tmp/id
+      ")'
+      """.strip())
 
-    machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
+      machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
 
-    machine.succeed("rm /tmp/id")
+      machine.succeed("rm /tmp/id")
 
-    # Creating a setgid binary should fail.
-    machine.fail(r"""
-    nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" {} "
-      mkdir -p $out
-      cp ${pkgs.coreutils}/bin/id /tmp/id
-      chmod 2755 /tmp/id
-    ")'
-    """.strip())
+      # Creating a setgid binary should fail.
+      machine.fail(r"""
+      nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" {} "
+        mkdir -p $out
+        cp ${pkgs.coreutils}/bin/id /tmp/id
+        chmod 2755 /tmp/id
+      ")'
+      """.strip())
 
-    machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
+      machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
 
-    machine.succeed("rm /tmp/id")
+      machine.succeed("rm /tmp/id")
 
-    # The checks should also work on 32-bit binaries.
-    machine.fail(r"""
-    nix-build --no-sandbox -E '(with import <nixpkgs> { system = "i686-linux"; }; runCommand "foo" {} "
-      mkdir -p $out
-      cp ${pkgs.coreutils}/bin/id /tmp/id
-      chmod 2755 /tmp/id
-    ")'
-    """.strip())
+      # The checks should also work on 32-bit binaries.
+      machine.fail(r"""
+      nix-build --no-sandbox -E '(with import <nixpkgs> { system = "i686-linux"; }; runCommand "foo" {} "
+        mkdir -p $out
+        cp ${pkgs.coreutils}/bin/id /tmp/id
+        chmod 2755 /tmp/id
+      ")'
+      """.strip())
 
-    machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
+      machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
 
-    machine.succeed("rm /tmp/id")
+      machine.succeed("rm /tmp/id")
 
-    # The tests above use fchmodat(). Test chmod() as well.
-    machine.succeed(r"""
-    nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" { buildInputs = [ perl ]; } "
-      mkdir -p $out
-      cp ${pkgs.coreutils}/bin/id /tmp/id
-      perl -e \"chmod 0666, qw(/tmp/id) or die\"
-    ")'
-    """.strip())
+      # The tests above use fchmodat(). Test chmod() as well.
+      machine.succeed(r"""
+      nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" { buildInputs = [ perl ]; } "
+        mkdir -p $out
+        cp ${pkgs.coreutils}/bin/id /tmp/id
+        perl -e \"chmod 0666, qw(/tmp/id) or die\"
+      ")'
+      """.strip())
 
-    machine.succeed('[[ $(stat -c %a /tmp/id) = 666 ]]')
+      machine.succeed('[[ $(stat -c %a /tmp/id) = 666 ]]')
 
-    machine.succeed("rm /tmp/id")
+      machine.succeed("rm /tmp/id")
 
-    machine.fail(r"""
-    nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" { buildInputs = [ perl ]; } "
-      mkdir -p $out
-      cp ${pkgs.coreutils}/bin/id /tmp/id
-      perl -e \"chmod 04755, qw(/tmp/id) or die\"
-    ")'
-    """.strip())
+      machine.fail(r"""
+      nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" { buildInputs = [ perl ]; } "
+        mkdir -p $out
+        cp ${pkgs.coreutils}/bin/id /tmp/id
+        perl -e \"chmod 04755, qw(/tmp/id) or die\"
+      ")'
+      """.strip())
 
-    machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
+      machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
 
-    machine.succeed("rm /tmp/id")
+      machine.succeed("rm /tmp/id")
 
-    # And test fchmod().
-    machine.succeed(r"""
-    nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" { buildInputs = [ perl ]; } "
-      mkdir -p $out
-      cp ${pkgs.coreutils}/bin/id /tmp/id
-      perl -e \"my \\\$x; open \\\$x, qw(/tmp/id); chmod 01750, \\\$x or die\"
-    ")'
-    """.strip())
+      # And test fchmod().
+      machine.succeed(r"""
+      nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" { buildInputs = [ perl ]; } "
+        mkdir -p $out
+        cp ${pkgs.coreutils}/bin/id /tmp/id
+        perl -e \"my \\\$x; open \\\$x, qw(/tmp/id); chmod 01750, \\\$x or die\"
+      ")'
+      """.strip())
 
-    machine.succeed('[[ $(stat -c %a /tmp/id) = 1750 ]]')
+      machine.succeed('[[ $(stat -c %a /tmp/id) = 1750 ]]')
 
-    machine.succeed("rm /tmp/id")
+      machine.succeed("rm /tmp/id")
 
-    machine.fail(r"""
-    nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" { buildInputs = [ perl ]; } "
-      mkdir -p $out
-      cp ${pkgs.coreutils}/bin/id /tmp/id
-      perl -e \"my \\\$x; open \\\$x, qw(/tmp/id); chmod 04777, \\\$x or die\"
-    ")'
-    """.strip())
+      machine.fail(r"""
+      nix-build --no-sandbox -E '(with import <nixpkgs> {}; runCommand "foo" { buildInputs = [ perl ]; } "
+        mkdir -p $out
+        cp ${pkgs.coreutils}/bin/id /tmp/id
+        perl -e \"my \\\$x; open \\\$x, qw(/tmp/id); chmod 04777, \\\$x or die\"
+      ")'
+      """.strip())
 
-    machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
+      machine.succeed('[[ $(stat -c %a /tmp/id) = 555 ]]')
 
-    machine.succeed("rm /tmp/id")
-  '';
+      machine.succeed("rm /tmp/id")
+    '';
 }
diff --git a/tests/nixos/sourcehut-flakes.nix b/tests/nixos/sourcehut-flakes.nix
index 2f469457a..bb26b7ebb 100644
--- a/tests/nixos/sourcehut-flakes.nix
+++ b/tests/nixos/sourcehut-flakes.nix
@@ -1,22 +1,27 @@
-{ lib, config, hostPkgs, nixpkgs, ... }:
+{
+  lib,
+  config,
+  hostPkgs,
+  nixpkgs,
+  ...
+}:
 
 let
   pkgs = config.nodes.sourcehut.nixpkgs.pkgs;
 
   # Generate a fake root CA and a fake git.sr.ht certificate.
-  cert = pkgs.runCommand "cert" { buildInputs = [ pkgs.openssl ]; }
-    ''
-      mkdir -p $out
+  cert = pkgs.runCommand "cert" { buildInputs = [ pkgs.openssl ]; } ''
+    mkdir -p $out
 
-      openssl genrsa -out ca.key 2048
-      openssl req -new -x509 -days 36500 -key ca.key \
-        -subj "/C=NL/ST=Denial/L=Springfield/O=Dis/CN=Root CA" -out $out/ca.crt
+    openssl genrsa -out ca.key 2048
+    openssl req -new -x509 -days 36500 -key ca.key \
+      -subj "/C=NL/ST=Denial/L=Springfield/O=Dis/CN=Root CA" -out $out/ca.crt
 
-      openssl req -newkey rsa:2048 -nodes -keyout $out/server.key \
-        -subj "/C=CN/ST=Denial/L=Springfield/O=Dis/CN=git.sr.ht" -out server.csr
-      openssl x509 -req -extfile <(printf "subjectAltName=DNS:git.sr.ht") \
-        -days 36500 -in server.csr -CA $out/ca.crt -CAkey ca.key -CAcreateserial -out $out/server.crt
-    '';
+    openssl req -newkey rsa:2048 -nodes -keyout $out/server.key \
+      -subj "/C=CN/ST=Denial/L=Springfield/O=Dis/CN=git.sr.ht" -out server.csr
+    openssl x509 -req -extfile <(printf "subjectAltName=DNS:git.sr.ht") \
+      -days 36500 -in server.csr -CA $out/ca.crt -CAkey ca.key -CAcreateserial -out $out/server.crt
+  '';
 
   registry = pkgs.writeTextFile {
     name = "registry";
@@ -41,80 +46,92 @@ let
     destination = "/flake-registry.json";
   };
 
-  nixpkgs-repo = pkgs.runCommand "nixpkgs-flake" { }
-    ''
-      dir=NixOS-nixpkgs-${nixpkgs.shortRev}
-      cp -prd ${nixpkgs} $dir
+  nixpkgs-repo = pkgs.runCommand "nixpkgs-flake" { } ''
+    dir=NixOS-nixpkgs-${nixpkgs.shortRev}
+    cp -prd ${nixpkgs} $dir
 
-      # Set the correct timestamp in the tarball.
-      find $dir -print0 | xargs -0 touch -h -t ${builtins.substring 0 12 nixpkgs.lastModifiedDate}.${builtins.substring 12 2 nixpkgs.lastModifiedDate} --
+    # Set the correct timestamp in the tarball.
+    find $dir -print0 | xargs -0 touch -h -t ${builtins.substring 0 12 nixpkgs.lastModifiedDate}.${
+      builtins.substring 12 2 nixpkgs.lastModifiedDate
+    } --
 
-      mkdir -p $out/archive
-      tar cfz $out/archive/${nixpkgs.rev}.tar.gz $dir --hard-dereference
+    mkdir -p $out/archive
+    tar cfz $out/archive/${nixpkgs.rev}.tar.gz $dir --hard-dereference
 
-      echo 'ref: refs/heads/master' > $out/HEAD
+    echo 'ref: refs/heads/master' > $out/HEAD
 
-      mkdir -p $out/info
-      echo -e '${nixpkgs.rev}\trefs/heads/master\n${nixpkgs.rev}\trefs/tags/foo-bar' > $out/info/refs
-    '';
+    mkdir -p $out/info
+    echo -e '${nixpkgs.rev}\trefs/heads/master\n${nixpkgs.rev}\trefs/tags/foo-bar' > $out/info/refs
+  '';
 
 in
 
-  {
-    name = "sourcehut-flakes";
+{
+  name = "sourcehut-flakes";
 
-    nodes =
+  nodes = {
+    # Impersonate git.sr.ht
+    sourcehut =
+      { config, pkgs, ... }:
       {
-        # Impersonate git.sr.ht
-        sourcehut =
-          { config, pkgs, ... }:
-          {
-            networking.firewall.allowedTCPPorts = [ 80 443 ];
+        networking.firewall.allowedTCPPorts = [
+          80
+          443
+        ];
 
-            services.httpd.enable = true;
-            services.httpd.adminAddr = "foo@example.org";
-            services.httpd.extraConfig = ''
-              ErrorLog syslog:local6
-            '';
-            services.httpd.virtualHosts."git.sr.ht" =
-              {
-                forceSSL = true;
-                sslServerKey = "${cert}/server.key";
-                sslServerCert = "${cert}/server.crt";
-                servedDirs =
-                  [
-                    {
-                      urlPath = "/~NixOS/nixpkgs";
-                      dir = nixpkgs-repo;
-                    }
-                    {
-                      urlPath = "/~NixOS/flake-registry/blob/master";
-                      dir = registry;
-                    }
-                  ];
-              };
-          };
-
-        client =
-          { config, lib, pkgs, nodes, ... }:
-          {
-            virtualisation.writableStore = true;
-            virtualisation.diskSize = 2048;
-            virtualisation.additionalPaths = [ pkgs.hello pkgs.fuse ];
-            virtualisation.memorySize = 4096;
-            nix.settings.substituters = lib.mkForce [ ];
-            nix.extraOptions = ''
-              experimental-features = nix-command flakes
-              flake-registry = https://git.sr.ht/~NixOS/flake-registry/blob/master/flake-registry.json
-            '';
-            environment.systemPackages = [ pkgs.jq ];
-            networking.hosts.${(builtins.head nodes.sourcehut.networking.interfaces.eth1.ipv4.addresses).address} =
-              [ "git.sr.ht" ];
-            security.pki.certificateFiles = [ "${cert}/ca.crt" ];
-          };
+        services.httpd.enable = true;
+        services.httpd.adminAddr = "foo@example.org";
+        services.httpd.extraConfig = ''
+          ErrorLog syslog:local6
+        '';
+        services.httpd.virtualHosts."git.sr.ht" = {
+          forceSSL = true;
+          sslServerKey = "${cert}/server.key";
+          sslServerCert = "${cert}/server.crt";
+          servedDirs = [
+            {
+              urlPath = "/~NixOS/nixpkgs";
+              dir = nixpkgs-repo;
+            }
+            {
+              urlPath = "/~NixOS/flake-registry/blob/master";
+              dir = registry;
+            }
+          ];
+        };
       };
 
-    testScript = { nodes }: ''
+    client =
+      {
+        config,
+        lib,
+        pkgs,
+        nodes,
+        ...
+      }:
+      {
+        virtualisation.writableStore = true;
+        virtualisation.diskSize = 2048;
+        virtualisation.additionalPaths = [
+          pkgs.hello
+          pkgs.fuse
+        ];
+        virtualisation.memorySize = 4096;
+        nix.settings.substituters = lib.mkForce [ ];
+        nix.extraOptions = ''
+          experimental-features = nix-command flakes
+          flake-registry = https://git.sr.ht/~NixOS/flake-registry/blob/master/flake-registry.json
+        '';
+        environment.systemPackages = [ pkgs.jq ];
+        networking.hosts.${(builtins.head nodes.sourcehut.networking.interfaces.eth1.ipv4.addresses).address} =
+          [ "git.sr.ht" ];
+        security.pki.certificateFiles = [ "${cert}/ca.crt" ];
+      };
+  };
+
+  testScript =
+    { nodes }:
+    ''
       # fmt: off
       import json
       import time
diff --git a/tests/nixos/tarball-flakes.nix b/tests/nixos/tarball-flakes.nix
index 84cf377ec..7b3638b64 100644
--- a/tests/nixos/tarball-flakes.nix
+++ b/tests/nixos/tarball-flakes.nix
@@ -1,94 +1,106 @@
-{ lib, config, nixpkgs, ... }:
+{
+  lib,
+  config,
+  nixpkgs,
+  ...
+}:
 
 let
   pkgs = config.nodes.machine.nixpkgs.pkgs;
 
-  root = pkgs.runCommand "nixpkgs-flake" {}
-    ''
-      mkdir -p $out/{stable,tags}
+  root = pkgs.runCommand "nixpkgs-flake" { } ''
+    mkdir -p $out/{stable,tags}
 
-      set -x
-      dir=nixpkgs-${nixpkgs.shortRev}
-      cp -prd ${nixpkgs} $dir
-      # Set the correct timestamp in the tarball.
-      find $dir -print0 | xargs -0 touch -h -t ${builtins.substring 0 12 nixpkgs.lastModifiedDate}.${builtins.substring 12 2 nixpkgs.lastModifiedDate} --
-      tar cfz $out/stable/${nixpkgs.rev}.tar.gz $dir --hard-dereference
+    set -x
+    dir=nixpkgs-${nixpkgs.shortRev}
+    cp -prd ${nixpkgs} $dir
+    # Set the correct timestamp in the tarball.
+    find $dir -print0 | xargs -0 touch -h -t ${builtins.substring 0 12 nixpkgs.lastModifiedDate}.${
+      builtins.substring 12 2 nixpkgs.lastModifiedDate
+    } --
+    tar cfz $out/stable/${nixpkgs.rev}.tar.gz $dir --hard-dereference
 
-      # Set the "Link" header on the redirect but not the final response to
-      # simulate an S3-like serving environment where the final host cannot set
-      # arbitrary headers.
-      cat >$out/tags/.htaccess <<EOF
-      Redirect "/tags/latest.tar.gz" "/stable/${nixpkgs.rev}.tar.gz"
-      Header always set Link "<http://localhost/stable/${nixpkgs.rev}.tar.gz?rev=${nixpkgs.rev}&revCount=1234>; rel=\"immutable\""
-      EOF
-    '';
+    # Set the "Link" header on the redirect but not the final response to
+    # simulate an S3-like serving environment where the final host cannot set
+    # arbitrary headers.
+    cat >$out/tags/.htaccess <<EOF
+    Redirect "/tags/latest.tar.gz" "/stable/${nixpkgs.rev}.tar.gz"
+    Header always set Link "<http://localhost/stable/${nixpkgs.rev}.tar.gz?rev=${nixpkgs.rev}&revCount=1234>; rel=\"immutable\""
+    EOF
+  '';
 in
 
 {
   name = "tarball-flakes";
 
-  nodes =
-    {
-      machine =
-        { config, pkgs, ... }:
-        { networking.firewall.allowedTCPPorts = [ 80 ];
+  nodes = {
+    machine =
+      { config, pkgs, ... }:
+      {
+        networking.firewall.allowedTCPPorts = [ 80 ];
 
-          services.httpd.enable = true;
-          services.httpd.adminAddr = "foo@example.org";
-          services.httpd.extraConfig = ''
-            ErrorLog syslog:local6
-          '';
-          services.httpd.virtualHosts."localhost" =
-            { servedDirs =
-                [ { urlPath = "/";
-                    dir = root;
-                  }
-                ];
-            };
-
-          virtualisation.writableStore = true;
-          virtualisation.diskSize = 2048;
-          virtualisation.additionalPaths = [ pkgs.hello pkgs.fuse ];
-          virtualisation.memorySize = 4096;
-          nix.settings.substituters = lib.mkForce [ ];
-          nix.extraOptions = "experimental-features = nix-command flakes";
+        services.httpd.enable = true;
+        services.httpd.adminAddr = "foo@example.org";
+        services.httpd.extraConfig = ''
+          ErrorLog syslog:local6
+        '';
+        services.httpd.virtualHosts."localhost" = {
+          servedDirs = [
+            {
+              urlPath = "/";
+              dir = root;
+            }
+          ];
         };
-    };
 
-  testScript = { nodes }: ''
-    # fmt: off
-    import json
+        virtualisation.writableStore = true;
+        virtualisation.diskSize = 2048;
+        virtualisation.additionalPaths = [
+          pkgs.hello
+          pkgs.fuse
+        ];
+        virtualisation.memorySize = 4096;
+        nix.settings.substituters = lib.mkForce [ ];
+        nix.extraOptions = "experimental-features = nix-command flakes";
+      };
+  };
 
-    start_all()
+  testScript =
+    { nodes }:
+    ''
+      # fmt: off
+      import json
 
-    machine.wait_for_unit("httpd.service")
+      start_all()
 
-    out = machine.succeed("nix flake metadata --json http://localhost/tags/latest.tar.gz")
-    print(out)
-    info = json.loads(out)
+      machine.wait_for_unit("httpd.service")
 
-    # Check that we got redirected to the immutable URL.
-    assert info["locked"]["url"] == "http://localhost/stable/${nixpkgs.rev}.tar.gz"
+      out = machine.succeed("nix flake metadata --json http://localhost/tags/latest.tar.gz")
+      print(out)
+      info = json.loads(out)
 
-    # Check that we got a fingerprint for caching.
-    assert info["fingerprint"]
+      # Check that we got redirected to the immutable URL.
+      assert info["locked"]["url"] == "http://localhost/stable/${nixpkgs.rev}.tar.gz"
 
-    # Check that we got the rev and revCount attributes.
-    assert info["revision"] == "${nixpkgs.rev}"
-    assert info["revCount"] == 1234
+      # Check that we got a fingerprint for caching.
+      assert info["fingerprint"]
 
-    # Check that a 0-byte HTTP 304 "Not modified" result works.
-    machine.succeed("nix flake metadata --refresh --json http://localhost/tags/latest.tar.gz")
+      # Check that we got the rev and revCount attributes.
+      assert info["revision"] == "${nixpkgs.rev}"
+      assert info["revCount"] == 1234
 
-    # Check that fetching with rev/revCount/narHash succeeds.
-    machine.succeed("nix flake metadata --json http://localhost/tags/latest.tar.gz?rev=" + info["revision"])
-    machine.succeed("nix flake metadata --json http://localhost/tags/latest.tar.gz?revCount=" + str(info["revCount"]))
-    machine.succeed("nix flake metadata --json http://localhost/tags/latest.tar.gz?narHash=" + info["locked"]["narHash"])
+      # Check that a 0-byte HTTP 304 "Not modified" result works.
+      machine.succeed("nix flake metadata --refresh --json http://localhost/tags/latest.tar.gz")
 
-    # Check that fetching fails if we provide incorrect attributes.
-    machine.fail("nix flake metadata --json http://localhost/tags/latest.tar.gz?rev=493300eb13ae6fb387fbd47bf54a85915acc31c0")
-    machine.fail("nix flake metadata --json http://localhost/tags/latest.tar.gz?revCount=789")
-    machine.fail("nix flake metadata --json http://localhost/tags/latest.tar.gz?narHash=sha256-tbudgBSg+bHWHiHnlteNzN8TUvI80ygS9IULh4rklEw=")
-  '';
+      # Check that fetching with rev/revCount/narHash succeeds.
+      machine.succeed("nix flake metadata --json http://localhost/tags/latest.tar.gz?rev=" + info["revision"])
+      machine.succeed("nix flake metadata --json http://localhost/tags/latest.tar.gz?revCount=" + str(info["revCount"]))
+      machine.succeed("nix flake metadata --json http://localhost/tags/latest.tar.gz?narHash=" + info["locked"]["narHash"])
+
+      # Check that fetching fails if we provide incorrect attributes.
+      machine.fail("nix flake metadata --json http://localhost/tags/latest.tar.gz?rev=493300eb13ae6fb387fbd47bf54a85915acc31c0")
+      machine.fail("nix flake metadata --json http://localhost/tags/latest.tar.gz?revCount=789")
+      machine.fail("nix flake metadata --json http://localhost/tags/latest.tar.gz?narHash=sha256-tbudgBSg+bHWHiHnlteNzN8TUvI80ygS9IULh4rklEw=")
+    '';
 
 }
diff --git a/tests/nixos/user-sandboxing/default.nix b/tests/nixos/user-sandboxing/default.nix
index 8a16f44e8..028efd17f 100644
--- a/tests/nixos/user-sandboxing/default.nix
+++ b/tests/nixos/user-sandboxing/default.nix
@@ -3,12 +3,15 @@
 let
   pkgs = config.nodes.machine.nixpkgs.pkgs;
 
-  attacker = pkgs.runCommandWith {
-    name = "attacker";
-    stdenv = pkgs.pkgsStatic.stdenv;
-  } ''
-    $CC -static -o $out ${./attacker.c}
-  '';
+  attacker =
+    pkgs.runCommandWith
+      {
+        name = "attacker";
+        stdenv = pkgs.pkgsStatic.stdenv;
+      }
+      ''
+        $CC -static -o $out ${./attacker.c}
+      '';
 
   try-open-build-dir = pkgs.writeScript "try-open-build-dir" ''
     export PATH=${pkgs.coreutils}/bin:$PATH
@@ -55,75 +58,88 @@ in
   name = "sandbox-setuid-leak";
 
   nodes.machine =
-    { config, lib, pkgs, ... }:
-    { virtualisation.writableStore = true;
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      virtualisation.writableStore = true;
       nix.settings.substituters = lib.mkForce [ ];
       nix.nrBuildUsers = 1;
-      virtualisation.additionalPaths = [ pkgs.busybox-sandbox-shell attacker try-open-build-dir create-hello-world pkgs.socat ];
+      virtualisation.additionalPaths = [
+        pkgs.busybox-sandbox-shell
+        attacker
+        try-open-build-dir
+        create-hello-world
+        pkgs.socat
+      ];
       boot.kernelPackages = pkgs.linuxPackages_latest;
       users.users.alice = {
         isNormalUser = true;
       };
     };
 
-  testScript = { nodes }: ''
-    start_all()
+  testScript =
+    { nodes }:
+    ''
+      start_all()
 
-    with subtest("A builder can't give access to its build directory"):
-        # Make sure that a builder can't change the permissions on its build
-        # directory to the point of opening it up to external users
+      with subtest("A builder can't give access to its build directory"):
+          # Make sure that a builder can't change the permissions on its build
+          # directory to the point of opening it up to external users
 
-        # A derivation whose builder tries to make its build directory as open
-        # as possible and wait for someone to hijack it
-        machine.succeed(r"""
-          nix-build -v -E '
-            builtins.derivation {
-              name = "open-build-dir";
-              system = builtins.currentSystem;
-              builder = "${pkgs.busybox-sandbox-shell}/bin/sh";
-              args = [ (builtins.storePath "${try-open-build-dir}") ];
-          }' >&2 &
-        """.strip())
+          # A derivation whose builder tries to make its build directory as open
+          # as possible and wait for someone to hijack it
+          machine.succeed(r"""
+            nix-build -v -E '
+              builtins.derivation {
+                name = "open-build-dir";
+                system = builtins.currentSystem;
+                builder = "${pkgs.busybox-sandbox-shell}/bin/sh";
+                args = [ (builtins.storePath "${try-open-build-dir}") ];
+            }' >&2 &
+          """.strip())
 
-        # Wait for the build to be ready
-        # This is OK because it runs as root, so we can access everything
-        machine.wait_for_file("/tmp/nix-build-open-build-dir.drv-0/build/syncPoint")
+          # Wait for the build to be ready
+          # This is OK because it runs as root, so we can access everything
+          machine.wait_for_file("/tmp/nix-build-open-build-dir.drv-0/build/syncPoint")
 
-        # But Alice shouldn't be able to access the build directory
-        machine.fail("su alice -c 'ls /tmp/nix-build-open-build-dir.drv-0/build'")
-        machine.fail("su alice -c 'touch /tmp/nix-build-open-build-dir.drv-0/build/bar'")
-        machine.fail("su alice -c 'cat /tmp/nix-build-open-build-dir.drv-0/build/foo'")
+          # But Alice shouldn't be able to access the build directory
+          machine.fail("su alice -c 'ls /tmp/nix-build-open-build-dir.drv-0/build'")
+          machine.fail("su alice -c 'touch /tmp/nix-build-open-build-dir.drv-0/build/bar'")
+          machine.fail("su alice -c 'cat /tmp/nix-build-open-build-dir.drv-0/build/foo'")
 
-        # Tell the user to finish the build
-        machine.succeed("echo foo > /tmp/nix-build-open-build-dir.drv-0/build/syncPoint")
+          # Tell the user to finish the build
+          machine.succeed("echo foo > /tmp/nix-build-open-build-dir.drv-0/build/syncPoint")
 
-    with subtest("Being able to execute stuff as the build user doesn't give access to the build dir"):
-        machine.succeed(r"""
-          nix-build -E '
-            builtins.derivation {
-              name = "innocent";
-              system = builtins.currentSystem;
-              builder = "${pkgs.busybox-sandbox-shell}/bin/sh";
-              args = [ (builtins.storePath "${create-hello-world}") ];
-          }' >&2 &
-        """.strip())
-        machine.wait_for_file("/tmp/nix-build-innocent.drv-0/build/syncPoint")
+      with subtest("Being able to execute stuff as the build user doesn't give access to the build dir"):
+          machine.succeed(r"""
+            nix-build -E '
+              builtins.derivation {
+                name = "innocent";
+                system = builtins.currentSystem;
+                builder = "${pkgs.busybox-sandbox-shell}/bin/sh";
+                args = [ (builtins.storePath "${create-hello-world}") ];
+            }' >&2 &
+          """.strip())
+          machine.wait_for_file("/tmp/nix-build-innocent.drv-0/build/syncPoint")
 
-        # The build ran as `nixbld1` (which is the only build user on the
-        # machine), but a process running as `nixbld1` outside the sandbox
-        # shouldn't be able to touch the build directory regardless
-        machine.fail("su nixbld1 --shell ${pkgs.busybox-sandbox-shell}/bin/sh -c 'ls /tmp/nix-build-innocent.drv-0/build'")
-        machine.fail("su nixbld1 --shell ${pkgs.busybox-sandbox-shell}/bin/sh -c 'echo pwned > /tmp/nix-build-innocent.drv-0/build/result'")
+          # The build ran as `nixbld1` (which is the only build user on the
+          # machine), but a process running as `nixbld1` outside the sandbox
+          # shouldn't be able to touch the build directory regardless
+          machine.fail("su nixbld1 --shell ${pkgs.busybox-sandbox-shell}/bin/sh -c 'ls /tmp/nix-build-innocent.drv-0/build'")
+          machine.fail("su nixbld1 --shell ${pkgs.busybox-sandbox-shell}/bin/sh -c 'echo pwned > /tmp/nix-build-innocent.drv-0/build/result'")
 
-        # Finish the build
-        machine.succeed("echo foo > /tmp/nix-build-innocent.drv-0/build/syncPoint")
+          # Finish the build
+          machine.succeed("echo foo > /tmp/nix-build-innocent.drv-0/build/syncPoint")
 
-        # Check that the build was not affected
-        machine.succeed(r"""
-          cat ./result
-          test "$(cat ./result)" = "hello, world"
-        """.strip())
-  '';
+          # Check that the build was not affected
+          machine.succeed(r"""
+            cat ./result
+            test "$(cat ./result)" = "hello, world"
+          """.strip())
+    '';
 
 }
-
diff --git a/tests/repl-completion.nix b/tests/repl-completion.nix
index 3ba198a98..07406e969 100644
--- a/tests/repl-completion.nix
+++ b/tests/repl-completion.nix
@@ -1,40 +1,45 @@
-{ runCommand, nix, expect }:
+{
+  runCommand,
+  nix,
+  expect,
+}:
 
 # We only use expect when necessary, e.g. for testing tab completion in nix repl.
 # See also tests/functional/repl.sh
 
-runCommand "repl-completion" {
-  nativeBuildInputs = [
-    expect
-    nix
-  ];
-  expectScript = ''
-    # Regression https://github.com/NixOS/nix/pull/10778
-    spawn nix repl --offline --extra-experimental-features nix-command
-    expect "nix-repl>"
-    send "foo = import ./does-not-exist.nix\n"
-    expect "nix-repl>"
-    send "foo.\t"
-    expect {
-      "nix-repl>" {
-        puts "Got another prompt. Good."
+runCommand "repl-completion"
+  {
+    nativeBuildInputs = [
+      expect
+      nix
+    ];
+    expectScript = ''
+      # Regression https://github.com/NixOS/nix/pull/10778
+      spawn nix repl --offline --extra-experimental-features nix-command
+      expect "nix-repl>"
+      send "foo = import ./does-not-exist.nix\n"
+      expect "nix-repl>"
+      send "foo.\t"
+      expect {
+        "nix-repl>" {
+          puts "Got another prompt. Good."
+        }
+        eof {
+          puts "Got EOF. Bad."
+          exit 1
+        }
       }
-      eof {
-        puts "Got EOF. Bad."
-        exit 1
-      }
-    }
-    exit 0
-  '';
-  passAsFile = [ "expectScript" ];
-}
-''
-  export NIX_STORE=$TMPDIR/store
-  export NIX_STATE_DIR=$TMPDIR/state
-  export HOME=$TMPDIR/home
-  mkdir $HOME
+      exit 0
+    '';
+    passAsFile = [ "expectScript" ];
+  }
+  ''
+    export NIX_STORE=$TMPDIR/store
+    export NIX_STATE_DIR=$TMPDIR/state
+    export HOME=$TMPDIR/home
+    mkdir $HOME
 
-  nix-store --init
-  expect $expectScriptPath
-  touch $out
-''
\ No newline at end of file
+    nix-store --init
+    expect $expectScriptPath
+    touch $out
+  ''