refactor: split flake.nix into muiltple files

I renamed SkipAutocrypt into DeprecatedSkipAutocrypt
instead of removing to make sure the letter is not reused.

deltachat-rpc-client/tests/test_securejoin.py

@@ -704,25 +704,3 @@ def test_withdraw_securejoin_qr(acfactory):
             and "Ignoring RequestWithAuth message because of invalid auth code." in event.msg
         ):
             break
-
-
-def test_qr_scan_updates_new_relay_address(acfactory):
-    alice, bob = acfactory.get_online_accounts(2)
-
-    bob_alice_chat = bob.secure_join(alice.get_qr_code())
-    alice.wait_for_securejoin_inviter_success()
-    bob.wait_for_securejoin_joiner_success()
-
-    for ac in [alice, bob]:
-        old_addr = ac.get_config("configured_addr")
-        ac.add_transport_from_qr(acfactory.get_account_qr())
-        ac.set_config("configured_addr", ac.list_transports()[1]["addr"])
-        ac.delete_transport(old_addr)
-
-    bob.secure_join(alice.get_qr_code())
-    alice.wait_for_securejoin_inviter_success()
-    bob.wait_for_securejoin_joiner_success()
-
-    bob_alice_chat.send_text("hi")
-    snapshot = alice.wait_for_incoming_msg().get_snapshot()
-    assert snapshot.text == "hi"

flake.nix

@@ -29,11 +29,7 @@
           rustc = fenixToolchain;
         };
         manifest = (pkgs.lib.importTOML ./Cargo.toml).package;
-        androidSdk = android.sdk.${system} (sdkPkgs:
-          builtins.attrValues {
-            inherit (sdkPkgs) ndk-27-2-12479018 cmdline-tools-latest;
-          });
-        androidNdkRoot = "${androidSdk}/share/android-sdk/ndk/27.2.12479018";
+        version = manifest.version;
 
         rustSrc = nix-filter.lib {
           root = ./.;
@@ -83,7 +79,7 @@
           naersk'.buildPackage {
             pname = packageName;
             cargoBuildOptions = x: x ++ [ "--package" packageName ];
-            version = manifest.version;
+            inherit version;
             src = pkgs.lib.cleanSource ./.;
             nativeBuildInputs = [
               pkgs.perl # Needed to build vendored OpenSSL.
@@ -91,221 +87,22 @@
             auditable = false; # Avoid cargo-auditable failures.
             doCheck = false; # Disable test as it requires network access.
           };
-        mkWin64RustPackage = packageName:
-          let
-            pkgsWin64 = pkgs.pkgsCross.mingwW64;
-            rustTarget = pkgsWin64.stdenv.hostPlatform.rust.rustcTarget;
-            toolchainWin = fenixPkgs.combine [
-              fenixPkgs.stable.rustc
-              fenixPkgs.stable.cargo
-              fenixPkgs.targets.${rustTarget}.stable.rust-std
-            ];
-            naerskWin = pkgs.callPackage naersk {
-              cargo = toolchainWin;
-              rustc = toolchainWin;
-            };
-          in
-          naerskWin.buildPackage rec {
-            pname = packageName;
-            cargoBuildOptions = x: x ++ [ "--package" packageName ];
-            version = manifest.version;
-            strictDeps = true;
-            src = pkgs.lib.cleanSource ./.;
-            nativeBuildInputs = [
-              pkgs.perl # Needed to build vendored OpenSSL.
-            ];
-            depsBuildBuild = [
-              pkgsWin64.stdenv.cc
-            ];
-            buildInputs = [
-              pkgsWin64.windows.pthreads
-            ];
-            auditable = false; # Avoid cargo-auditable failures.
-            doCheck = false; # Disable test as it requires network access.
 
-            CARGO_BUILD_TARGET = rustTarget;
-            TARGET_CC = "${pkgsWin64.stdenv.cc}/bin/${pkgsWin64.stdenv.cc.targetPrefix}cc";
-            CFLAGS_x86_64_pc_windows_gnu = "-I${pkgsWin64.windows.pthreads}/include";
-            CARGO_BUILD_RUSTFLAGS = [
-              "-C"
-              "linker=${TARGET_CC}"
-              "-L"
-              "native=${pkgsWin64.windows.pthreads}/lib"
-            ];
-
-            CC = "${pkgsWin64.stdenv.cc}/bin/${pkgsWin64.stdenv.cc.targetPrefix}cc";
-            LD = "${pkgsWin64.stdenv.cc}/bin/${pkgsWin64.stdenv.cc.targetPrefix}cc";
-          };
-
-        mkWin32RustPackage = packageName:
-          let
-            pkgsWin32 = pkgs.pkgsCross.mingw32;
-            rustTarget = pkgsWin32.stdenv.hostPlatform.rust.rustcTarget;
-            toolchainWin = fenixPkgs.combine [
-              fenixPkgs.stable.rustc
-              fenixPkgs.stable.cargo
-              fenixPkgs.targets.${rustTarget}.stable.rust-std
-            ];
-            naerskWin = pkgs.callPackage naersk {
-              cargo = toolchainWin;
-              rustc = toolchainWin;
-            };
-
-            # Get rid of MCF Gthread library.
-            # See <https://github.com/NixOS/nixpkgs/issues/156343>
-            # and <https://discourse.nixos.org/t/statically-linked-mingw-binaries/38395>
-            # for details.
-            #
-            # Use DWARF-2 instead of SJLJ for exception handling.
-            winCC = pkgsWin32.buildPackages.wrapCC (
-              (pkgsWin32.buildPackages.gcc-unwrapped.override
-                ({
-                  threadsCross = {
-                    model = "win32";
-                    package = null;
-                  };
-                })).overrideAttrs (oldAttr: {
-                configureFlags = oldAttr.configureFlags ++ [
-                  "--disable-sjlj-exceptions"
-                  "--with-dwarf2"
-                ];
-              })
-            );
-          in
-          naerskWin.buildPackage rec {
-            pname = packageName;
-            cargoBuildOptions = x: x ++ [ "--package" packageName ];
-            version = manifest.version;
-            strictDeps = true;
-            src = pkgs.lib.cleanSource ./.;
-            nativeBuildInputs = [
-              pkgs.perl # Needed to build vendored OpenSSL.
-              pkgs.nasm # aws-lc-sys requires it
-            ];
-            depsBuildBuild = [
-              winCC
-            ];
-            buildInputs = [
-              pkgsWin32.windows.pthreads
-            ];
-            auditable = false; # Avoid cargo-auditable failures.
-            doCheck = false; # Disable test as it requires network access.
-
-            CARGO_BUILD_TARGET = rustTarget;
-            TARGET_CC = "${winCC}/bin/${winCC.targetPrefix}cc";
-            CFLAGS_i686_pc_windows_gnu = "-I${pkgsWin32.windows.pthreads}/include";
-            CARGO_BUILD_RUSTFLAGS = [
-              "-C"
-              "linker=${TARGET_CC}"
-              "-L"
-              "native=${pkgsWin32.windows.pthreads}/lib"
-            ];
-
-            CC = "${winCC}/bin/${winCC.targetPrefix}cc";
-            LD = "${winCC}/bin/${winCC.targetPrefix}cc";
-          };
-
-        mkCrossRustPackage = arch: packageName:
-          let
-            crossTarget = arch2targets."${arch}";
-            pkgsCross = import nixpkgs {
-              system = system;
-              crossSystem.config = crossTarget;
-            };
-            rustTarget = pkgsCross.stdenv.hostPlatform.rust.rustcTarget;
-            toolchain = fenixPkgs.combine [
-              fenixPkgs.stable.rustc
-              fenixPkgs.stable.cargo
-              fenixPkgs.targets.${rustTarget}.stable.rust-std
-            ];
-            naersk-lib = pkgs.callPackage naersk {
-              cargo = toolchain;
-              rustc = toolchain;
-            };
-          in
-          naersk-lib.buildPackage rec {
-            pname = packageName;
-            cargoBuildOptions = x: x ++ [ "--package" packageName ];
-            version = manifest.version;
-            strictDeps = true;
-            src = rustSrc;
-            nativeBuildInputs = [
-              pkgs.perl # Needed to build vendored OpenSSL.
-            ];
-            auditable = false; # Avoid cargo-auditable failures.
-            doCheck = false; # Disable test as it requires network access.
-
-            CARGO_TARGET_X86_64_APPLE_DARWIN_RUSTFLAGS = "-Clink-args=-L${pkgsCross.libiconv}/lib";
-            CARGO_TARGET_AARCH64_APPLE_DARWIN_RUSTFLAGS = "-Clink-args=-L${pkgsCross.libiconv}/lib";
-
-            CARGO_BUILD_TARGET = rustTarget;
-            TARGET_CC = "${pkgsCross.stdenv.cc}/bin/${pkgsCross.stdenv.cc.targetPrefix}cc";
-            CARGO_BUILD_RUSTFLAGS = [
-              "-C"
-              "linker=${TARGET_CC}"
-            ];
-
-            CC = "${pkgsCross.stdenv.cc}/bin/${pkgsCross.stdenv.cc.targetPrefix}cc";
-            LD = "${pkgsCross.stdenv.cc}/bin/${pkgsCross.stdenv.cc.targetPrefix}cc";
-          };
-
-        androidAttrs = {
-          armeabi-v7a = {
-            cc = "armv7a-linux-androideabi21-clang";
-            rustTarget = "armv7-linux-androideabi";
-          };
-          arm64-v8a = {
-            cc = "aarch64-linux-android21-clang";
-            rustTarget = "aarch64-linux-android";
-          };
-          x86 = {
-            cc = "i686-linux-android21-clang";
-            rustTarget = "i686-linux-android";
-          };
-          x86_64 = {
-            cc = "x86_64-linux-android21-clang";
-            rustTarget = "x86_64-linux-android";
-          };
+        mkWin64RustPackage = pkgs.callPackage ./nix/win64-package.nix {
+          inherit naersk system fenixPkgs version;
         };
 
-        mkAndroidRustPackage = arch: packageName:
-          let
-            rustTarget = androidAttrs.${arch}.rustTarget;
-            toolchain = fenixPkgs.combine [
-              fenixPkgs.stable.rustc
-              fenixPkgs.stable.cargo
-              fenixPkgs.targets.${rustTarget}.stable.rust-std
-            ];
-            naersk-lib = pkgs.callPackage naersk {
-              cargo = toolchain;
-              rustc = toolchain;
-            };
-            targetToolchain = "${androidNdkRoot}/toolchains/llvm/prebuilt/linux-x86_64";
-            targetCcName = androidAttrs.${arch}.cc;
-            targetCc = "${targetToolchain}/bin/${targetCcName}";
-          in
-          naersk-lib.buildPackage rec {
-            pname = packageName;
-            cargoBuildOptions = x: x ++ [ "--package" packageName ];
-            version = manifest.version;
-            strictDeps = true;
-            src = rustSrc;
-            nativeBuildInputs = [
-              pkgs.perl # Needed to build vendored OpenSSL.
-            ];
-            auditable = false; # Avoid cargo-auditable failures.
-            doCheck = false; # Disable test as it requires network access.
+        mkWin32RustPackage = pkgs.callPackage ./nix/win32-package.nix {
+          inherit naersk system fenixPkgs version;
+        };
 
-            CARGO_BUILD_TARGET = rustTarget;
-            TARGET_CC = "${targetCc}";
-            CARGO_BUILD_RUSTFLAGS = [
-              "-C"
-              "linker=${TARGET_CC}"
-            ];
+        mkCrossRustPackage = pkgs.callPackage ./nix/cross-rust-package.nix {
+          inherit nixpkgs arch2targets naersk fenixPkgs system rustSrc version;
+        };
 
-            CC = "${targetCc}";
-            LD = "${targetCc}";
-          };
+        mkAndroidRustPackage = pkgs.callPackage ./nix/android-package.nix {
+          inherit naersk fenixPkgs system rustSrc android version;
+        };
 
         mkAndroidPackages = arch:
           let
@@ -315,32 +112,7 @@
             "deltachat-rpc-server-${arch}-android" = rpc-server;
             "deltachat-repl-${arch}-android" = mkAndroidRustPackage arch "deltachat-repl";
             "deltachat-rpc-server-${arch}-android-wheel" =
-              pkgs.stdenv.mkDerivation {
-                pname = "deltachat-rpc-server-${arch}-android-wheel";
-                version = manifest.version;
-                src = nix-filter.lib {
-                  root = ./.;
-                  include = [
-                    "scripts/wheel-rpc-server.py"
-                    "deltachat-rpc-server/README.md"
-                    "LICENSE"
-                    "Cargo.toml"
-                  ];
-                };
-                nativeBuildInputs = [
-                  pkgs.python3
-                  pkgs.python3Packages.wheel
-                ];
-                buildInputs = [
-                  rpc-server
-                ];
-                buildPhase = ''
-                  mkdir tmp
-                  cp ${rpc-server}/bin/deltachat-rpc-server tmp/deltachat-rpc-server
-                  python3 scripts/wheel-rpc-server.py ${arch}-android tmp/deltachat-rpc-server
-                '';
-                installPhase = ''mkdir -p $out; cp -av deltachat_rpc_server-*.whl $out'';
-              };
+              mkWheel { inherit rpc-server; arch = "${arch}-android"; };
           };
 
         mkRustPackages = arch:
@@ -350,34 +122,10 @@
           {
             "deltachat-repl-${arch}" = mkCrossRustPackage arch "deltachat-repl";
             "deltachat-rpc-server-${arch}" = rpc-server;
-            "deltachat-rpc-server-${arch}-wheel" =
-              pkgs.stdenv.mkDerivation {
-                pname = "deltachat-rpc-server-${arch}-wheel";
-                version = manifest.version;
-                src = nix-filter.lib {
-                  root = ./.;
-                  include = [
-                    "scripts/wheel-rpc-server.py"
-                    "deltachat-rpc-server/README.md"
-                    "LICENSE"
-                    "Cargo.toml"
-                  ];
-                };
-                nativeBuildInputs = [
-                  pkgs.python3
-                  pkgs.python3Packages.wheel
-                ];
-                buildInputs = [
-                  rpc-server
-                ];
-                buildPhase = ''
-                  mkdir tmp
-                  cp ${rpc-server}/bin/deltachat-rpc-server tmp/deltachat-rpc-server
-                  python3 scripts/wheel-rpc-server.py ${arch} tmp/deltachat-rpc-server
-                '';
-                installPhase = ''mkdir -p $out; cp -av deltachat_rpc_server-*.whl $out'';
-              };
+            "deltachat-rpc-server-${arch}-wheel" = mkWheel { inherit rpc-server; arch = "${arch}"; };
           };
+
+        mkWheel = pkgs.callPackage ./nix/wheel.nix { inherit nix-filter version; root = ./.; };
       in
       {
         formatter = pkgs.nixpkgs-fmt;
@@ -401,116 +149,29 @@
             deltachat-repl-win64 = mkWin64RustPackage "deltachat-repl";
             deltachat-rpc-server-win64 = mkWin64RustPackage "deltachat-rpc-server";
             deltachat-rpc-server-win64-wheel =
-              pkgs.stdenv.mkDerivation {
-                pname = "deltachat-rpc-server-win64-wheel";
-                version = manifest.version;
-                src = nix-filter.lib {
-                  root = ./.;
-                  include = [
-                    "scripts/wheel-rpc-server.py"
-                    "deltachat-rpc-server/README.md"
-                    "LICENSE"
-                    "Cargo.toml"
-                  ];
-                };
-                nativeBuildInputs = [
-                  pkgs.python3
-                  pkgs.python3Packages.wheel
-                ];
-                buildInputs = [
-                  deltachat-rpc-server-win64
-                ];
-                buildPhase = ''
-                  mkdir tmp
-                  cp ${deltachat-rpc-server-win64}/bin/deltachat-rpc-server.exe tmp/deltachat-rpc-server.exe
-                  python3 scripts/wheel-rpc-server.py win64 tmp/deltachat-rpc-server.exe
-                '';
-                installPhase = ''mkdir -p $out; cp -av deltachat_rpc_server-*.whl $out'';
-              };
+              mkWheel { rpc-server = deltachat-rpc-server-win64; arch = "win64"; binaryName = "deltachat-rpc-server.exe"; };
 
             deltachat-repl-win32 = mkWin32RustPackage "deltachat-repl";
             deltachat-rpc-server-win32 = mkWin32RustPackage "deltachat-rpc-server";
             deltachat-rpc-server-win32-wheel =
-              pkgs.stdenv.mkDerivation {
-                pname = "deltachat-rpc-server-win32-wheel";
-                version = manifest.version;
-                src = nix-filter.lib {
-                  root = ./.;
-                  include = [
-                    "scripts/wheel-rpc-server.py"
-                    "deltachat-rpc-server/README.md"
-                    "LICENSE"
-                    "Cargo.toml"
-                  ];
-                };
-                nativeBuildInputs = [
-                  pkgs.python3
-                  pkgs.python3Packages.wheel
-                ];
-                buildInputs = [
-                  deltachat-rpc-server-win32
-                ];
-                buildPhase = ''
-                  mkdir tmp
-                  cp ${deltachat-rpc-server-win32}/bin/deltachat-rpc-server.exe tmp/deltachat-rpc-server.exe
-                  python3 scripts/wheel-rpc-server.py win32 tmp/deltachat-rpc-server.exe
-                '';
-                installPhase = ''mkdir -p $out; cp -av deltachat_rpc_server-*.whl $out'';
-              };
+              mkWheel
+                { rpc-server = deltachat-rpc-server-win32; arch = "win32"; binaryName = "deltachat-rpc-server.exe"; };
+
             # Run `nix build .#docs` to get C docs generated in `./result/`.
-            docs =
-              pkgs.stdenv.mkDerivation {
-                pname = "docs";
-                version = manifest.version;
-                src = pkgs.lib.cleanSource ./.;
-                nativeBuildInputs = [ pkgs.doxygen ];
-                buildPhase = ''scripts/run-doxygen.sh'';
-                installPhase = ''mkdir -p $out; cp -av deltachat-ffi/html deltachat-ffi/xml $out'';
-              };
+            docs = pkgs.callPackage ./nix/c-docs.nix { inherit version; };
 
-            libdeltachat =
-              let
-                rustPlatform = (pkgs.makeRustPlatform {
-                  cargo = fenixToolchain;
-                  rustc = fenixToolchain;
-                });
-              in
-              pkgs.stdenv.mkDerivation {
-                pname = "libdeltachat";
-                version = manifest.version;
-                src = rustSrc;
-                cargoDeps = pkgs.rustPlatform.importCargoLock cargoLock;
+            libdeltachat = pkgs.callPackage ./nix/libdeltachat.nix {
+              inherit fenixToolchain rustSrc cargoLock fenixPkgs version;
+            };
 
-                nativeBuildInputs = [
-                  pkgs.perl # Needed to build vendored OpenSSL.
-                  pkgs.cmake
-                  rustPlatform.cargoSetupHook
-                  fenixPkgs.stable.rustc
-                  fenixPkgs.stable.cargo
-                ];
-
-                postInstall = ''
-                  substituteInPlace $out/include/deltachat.h \
-                    --replace __FILE__ '"${placeholder "out"}/include/deltachat.h"'
-                '';
-              };
-
-            deltachat-rpc-client =
-              pkgs.python3Packages.buildPythonPackage {
-                pname = "deltachat-rpc-client";
-                version = manifest.version;
-                src = pkgs.lib.cleanSource ./deltachat-rpc-client;
-                format = "pyproject";
-                propagatedBuildInputs = [
-                  pkgs.python3Packages.setuptools
-                  pkgs.python3Packages.imap-tools
-                ];
-              };
+            deltachat-rpc-client = pkgs.callPackage ./nix/deltachat-rpc-client.nix {
+              inherit version;
+            };
 
             deltachat-python =
               pkgs.python3Packages.buildPythonPackage {
                 pname = "deltachat-python";
-                version = manifest.version;
+                inherit version;
                 src = pkgs.lib.cleanSource ./python;
                 format = "pyproject";
                 buildInputs = [
@@ -528,51 +189,12 @@
                   pkgs.python3Packages.requests
                 ];
               };
-            python-docs =
-              pkgs.stdenv.mkDerivation {
-                pname = "docs";
-                version = manifest.version;
-                src = pkgs.lib.cleanSource ./.;
-                buildInputs = [
-                  deltachat-python
-                  deltachat-rpc-client
-                  pkgs.python3Packages.breathe
-                  pkgs.python3Packages.sphinx-rtd-theme
-                ];
-                nativeBuildInputs = [ pkgs.sphinx ];
-                buildPhase = ''sphinx-build -b html -a python/doc/ dist/html'';
-                installPhase = ''mkdir -p $out; cp -av dist/html $out'';
-              };
-          };
-
-        devShells.default =
-          let
-            pkgs = import nixpkgs {
-              system = system;
-              overlays = [ fenix.overlays.default ];
+            python-docs = pkgs.callPackage ./nix/python-docs.nix {
+              inherit deltachat-python deltachat-rpc-client version;
             };
-          in
-          pkgs.mkShell {
-
-            buildInputs = with pkgs; [
-              (fenix.packages.${system}.complete.withComponents [
-                "cargo"
-                "clippy"
-                "rust-src"
-                "rustc"
-                "rustfmt"
-              ])
-              cargo-deny
-              rust-analyzer-nightly
-              cargo-nextest
-              perl # needed to build vendored OpenSSL
-              git-cliff
-              (python3.withPackages (pypkgs: with pypkgs; [
-                tox
-              ]))
-              nodejs
-            ];
           };
+
+        devShells.default = import ./nix/shell.nix { inherit nixpkgs fenix system; };
       }
     );
 }

nix/android-package.nix

@@ -0,0 +1,63 @@
+{ pkgs, naersk, fenixPkgs, system, version, rustSrc, android }:
+arch: packageName:
+let
+  androidSdk = android.sdk.${system} (sdkPkgs:
+    builtins.attrValues {
+      inherit (sdkPkgs) ndk-27-2-12479018 cmdline-tools-latest;
+    });
+  androidNdkRoot = "${androidSdk}/share/android-sdk/ndk/27.2.12479018";
+  androidAttrs = {
+    armeabi-v7a = {
+      cc = "armv7a-linux-androideabi21-clang";
+      rustTarget = "armv7-linux-androideabi";
+    };
+    arm64-v8a = {
+      cc = "aarch64-linux-android21-clang";
+      rustTarget = "aarch64-linux-android";
+    };
+    x86 = {
+      cc = "i686-linux-android21-clang";
+      rustTarget = "i686-linux-android";
+    };
+    x86_64 = {
+      cc = "x86_64-linux-android21-clang";
+      rustTarget = "x86_64-linux-android";
+    };
+  };
+
+  rustTarget = androidAttrs.${arch}.rustTarget;
+  toolchain = fenixPkgs.combine [
+    fenixPkgs.stable.rustc
+    fenixPkgs.stable.cargo
+    fenixPkgs.targets.${rustTarget}.stable.rust-std
+  ];
+  naersk-lib = pkgs.callPackage naersk {
+    cargo = toolchain;
+    rustc = toolchain;
+  };
+  targetToolchain = "${androidNdkRoot}/toolchains/llvm/prebuilt/linux-x86_64";
+  targetCcName = androidAttrs.${arch}.cc;
+  targetCc = "${targetToolchain}/bin/${targetCcName}";
+in
+naersk-lib.buildPackage {
+  pname = packageName;
+  cargoBuildOptions = x: x ++ [ "--package" packageName ];
+  inherit version;
+  strictDeps = true;
+  src = rustSrc;
+  nativeBuildInputs = [
+    pkgs.perl # Needed to build vendored OpenSSL.
+  ];
+  auditable = false; # Avoid cargo-auditable failures.
+  doCheck = false; # Disable test as it requires network access.
+
+  CARGO_BUILD_TARGET = rustTarget;
+  TARGET_CC = "${targetCc}";
+  CARGO_BUILD_RUSTFLAGS = [
+    "-C"
+    "linker=${targetCc}"
+  ];
+
+  CC = "${targetCc}";
+  LD = "${targetCc}";
+}

nix/c-docs.nix

@@ -0,0 +1,9 @@
+{ pkgs, version }:
+pkgs.stdenv.mkDerivation {
+  pname = "docs";
+  inherit version;
+  src = pkgs.lib.cleanSource ../.;
+  nativeBuildInputs = [ pkgs.doxygen ];
+  buildPhase = ''scripts/run-doxygen.sh'';
+  installPhase = ''mkdir -p $out; cp -av deltachat-ffi/html deltachat-ffi/xml $out'';
+}

nix/cross-rust-package.nix

@@ -0,0 +1,45 @@
+{ pkgs, nixpkgs, arch2targets, naersk, fenixPkgs, system, rustSrc, version }:
+arch: packageName:
+let
+  crossTarget = arch2targets."${arch}";
+  pkgsCross = import nixpkgs {
+    system = system;
+    crossSystem.config = crossTarget;
+  };
+  rustTarget = pkgsCross.stdenv.hostPlatform.rust.rustcTarget;
+  toolchain = fenixPkgs.combine [
+    fenixPkgs.stable.rustc
+    fenixPkgs.stable.cargo
+    fenixPkgs.targets.${rustTarget}.stable.rust-std
+  ];
+  naersk-lib = pkgs.callPackage naersk {
+    cargo = toolchain;
+    rustc = toolchain;
+  };
+  targetCc = "${pkgsCross.stdenv.cc}/bin/${pkgsCross.stdenv.cc.targetPrefix}cc";
+in
+naersk-lib.buildPackage {
+  pname = packageName;
+  cargoBuildOptions = x: x ++ [ "--package" packageName ];
+  inherit version;
+  strictDeps = true;
+  src = rustSrc;
+  nativeBuildInputs = [
+    pkgs.perl # Needed to build vendored OpenSSL.
+  ];
+  auditable = false; # Avoid cargo-auditable failures.
+  doCheck = false; # Disable test as it requires network access.
+
+  CARGO_TARGET_X86_64_APPLE_DARWIN_RUSTFLAGS = "-Clink-args=-L${pkgsCross.libiconv}/lib";
+  CARGO_TARGET_AARCH64_APPLE_DARWIN_RUSTFLAGS = "-Clink-args=-L${pkgsCross.libiconv}/lib";
+
+  CARGO_BUILD_TARGET = rustTarget;
+  TARGET_CC = "${targetCc}";
+  CARGO_BUILD_RUSTFLAGS = [
+    "-C"
+    "linker=${targetCc}"
+  ];
+
+  CC = "${targetCc}";
+  LD = "${targetCc}";
+}

nix/deltachat-rpc-client.nix

@@ -0,0 +1,11 @@
+{ pkgs, version }:
+pkgs.python3Packages.buildPythonPackage {
+  pname = "deltachat-rpc-client";
+  inherit version;
+  src = pkgs.lib.cleanSource ../deltachat-rpc-client;
+  format = "pyproject";
+  propagatedBuildInputs = [
+    pkgs.python3Packages.setuptools
+    pkgs.python3Packages.imap-tools
+  ];
+}

nix/libdeltachat.nix

@@ -0,0 +1,26 @@
+{ pkgs, fenixToolchain, rustSrc, cargoLock, fenixPkgs, version }:
+let
+  rustPlatform = (pkgs.makeRustPlatform {
+    cargo = fenixToolchain;
+    rustc = fenixToolchain;
+  });
+in
+pkgs.stdenv.mkDerivation {
+  pname = "libdeltachat";
+  inherit version;
+  src = rustSrc;
+  cargoDeps = pkgs.rustPlatform.importCargoLock cargoLock;
+
+  nativeBuildInputs = [
+    pkgs.perl # Needed to build vendored OpenSSL.
+    pkgs.cmake
+    rustPlatform.cargoSetupHook
+    fenixPkgs.stable.rustc
+    fenixPkgs.stable.cargo
+  ];
+
+  postInstall = ''
+    substituteInPlace $out/include/deltachat.h \
+      --replace __FILE__ '"${placeholder "out"}/include/deltachat.h"'
+  '';
+}

nix/python-docs.nix

@@ -0,0 +1,15 @@
+{ pkgs, version, deltachat-python, deltachat-rpc-client }:
+pkgs.stdenv.mkDerivation {
+  pname = "docs";
+  inherit version;
+  src = pkgs.lib.cleanSource ../.;
+  buildInputs = [
+    deltachat-python
+    deltachat-rpc-client
+    pkgs.python3Packages.breathe
+    pkgs.python3Packages.sphinx-rtd-theme
+  ];
+  nativeBuildInputs = [ pkgs.sphinx ];
+  buildPhase = ''sphinx-build -b html -a python/doc/ dist/html'';
+  installPhase = ''mkdir -p $out; cp -av dist/html $out'';
+}

nix/shell.nix

@@ -0,0 +1,27 @@
+{ nixpkgs, fenix, system }:
+let
+  pkgs = import nixpkgs {
+    inherit system;
+    overlays = [ fenix.overlays.default ];
+  };
+in
+pkgs.mkShell {
+  buildInputs = with pkgs; [
+    (fenix.packages.${system}.complete.withComponents [
+      "cargo"
+      "clippy"
+      "rust-src"
+      "rustc"
+      "rustfmt"
+    ])
+    cargo-deny
+    rust-analyzer-nightly
+    cargo-nextest
+    perl # needed to build vendored OpenSSL
+    git-cliff
+    (python3.withPackages (pypkgs: [
+      pypkgs.tox
+    ]))
+    nodejs
+  ];
+}

nix/wheel.nix

@@ -0,0 +1,28 @@
+{ pkgs, nix-filter, version, root }:
+{ rpc-server, arch, binaryName ? "deltachat-rpc-server" }:
+pkgs.stdenv.mkDerivation {
+  pname = "deltachat-rpc-server-${arch}-wheel";
+  inherit version;
+  src = nix-filter.lib {
+    inherit root;
+    include = [
+      "scripts/wheel-rpc-server.py"
+      "deltachat-rpc-server/README.md"
+      "LICENSE"
+      "Cargo.toml"
+    ];
+  };
+  nativeBuildInputs = [
+    pkgs.python3
+    pkgs.python3Packages.wheel
+  ];
+  buildInputs = [
+    rpc-server
+  ];
+  buildPhase = ''
+    mkdir tmp
+    cp ${rpc-server}/bin/${binaryName} tmp/${binaryName}
+    python3 scripts/wheel-rpc-server.py ${arch} tmp/${binaryName}
+  '';
+  installPhase = ''mkdir -p $out; cp -av deltachat_rpc_server-*.whl $out'';
+}

nix/win32-package.nix

@@ -0,0 +1,69 @@
+{ pkgs, naersk, fenixPkgs, system, version }:
+packageName:
+let
+  pkgsWin32 = pkgs.pkgsCross.mingw32;
+  rustTarget = pkgsWin32.stdenv.hostPlatform.rust.rustcTarget;
+  toolchainWin = fenixPkgs.combine [
+    fenixPkgs.stable.rustc
+    fenixPkgs.stable.cargo
+    fenixPkgs.targets.${rustTarget}.stable.rust-std
+  ];
+  naerskWin = pkgs.callPackage naersk {
+    cargo = toolchainWin;
+    rustc = toolchainWin;
+  };
+
+  # Get rid of MCF Gthread library.
+  # See <https://github.com/NixOS/nixpkgs/issues/156343>
+  # and <https://discourse.nixos.org/t/statically-linked-mingw-binaries/38395>
+  # for details.
+  #
+  # Use DWARF-2 instead of SJLJ for exception handling.
+  winCC = pkgsWin32.buildPackages.wrapCC (
+    (pkgsWin32.buildPackages.gcc-unwrapped.override
+      ({
+        threadsCross = {
+          model = "win32";
+          package = null;
+        };
+      })).overrideAttrs (oldAttr: {
+      configureFlags = oldAttr.configureFlags ++ [
+        "--disable-sjlj-exceptions"
+        "--with-dwarf2"
+      ];
+    })
+  );
+  targetCc = "${winCC}/bin/${winCC.targetPrefix}cc";
+in
+naerskWin.buildPackage {
+  pname = packageName;
+  cargoBuildOptions = x: x ++ [ "--package" packageName ];
+  inherit version;
+  strictDeps = true;
+  src = pkgs.lib.cleanSource ../.;
+  nativeBuildInputs = [
+    pkgs.perl # Needed to build vendored OpenSSL.
+    pkgs.nasm # aws-lc-sys requires it
+  ];
+  depsBuildBuild = [
+    winCC
+  ];
+  buildInputs = [
+    pkgsWin32.windows.pthreads
+  ];
+  auditable = false; # Avoid cargo-auditable failures.
+  doCheck = false; # Disable test as it requires network access.
+
+  CARGO_BUILD_TARGET = rustTarget;
+  TARGET_CC = "${targetCc}";
+  CFLAGS_i686_pc_windows_gnu = "-I${pkgsWin32.windows.pthreads}/include";
+  CARGO_BUILD_RUSTFLAGS = [
+    "-C"
+    "linker=${targetCc}"
+    "-L"
+    "native=${pkgsWin32.windows.pthreads}/lib"
+  ];
+
+  CC = "${targetCc}";
+  LD = "${targetCc}";
+}

nix/win64-package.nix

@@ -0,0 +1,47 @@
+{ pkgs, naersk, fenixPkgs, system, version }:
+packageName:
+let
+  pkgsWin64 = pkgs.pkgsCross.mingwW64;
+  rustTarget = pkgsWin64.stdenv.hostPlatform.rust.rustcTarget;
+  toolchainWin = fenixPkgs.combine [
+    fenixPkgs.stable.rustc
+    fenixPkgs.stable.cargo
+    fenixPkgs.targets.${rustTarget}.stable.rust-std
+  ];
+  naerskWin = pkgs.callPackage naersk {
+    cargo = toolchainWin;
+    rustc = toolchainWin;
+  };
+  targetCc = "${pkgsWin64.stdenv.cc}/bin/${pkgsWin64.stdenv.cc.targetPrefix}cc";
+in
+naerskWin.buildPackage {
+  pname = packageName;
+  cargoBuildOptions = x: x ++ [ "--package" packageName ];
+  inherit version;
+  strictDeps = true;
+  src = pkgs.lib.cleanSource ../.;
+  nativeBuildInputs = [
+    pkgs.perl # Needed to build vendored OpenSSL.
+  ];
+  depsBuildBuild = [
+    pkgsWin64.stdenv.cc
+  ];
+  buildInputs = [
+    pkgsWin64.windows.pthreads
+  ];
+  auditable = false; # Avoid cargo-auditable failures.
+  doCheck = false; # Disable test as it requires network access.
+
+  CARGO_BUILD_TARGET = rustTarget;
+  TARGET_CC = "${targetCc}";
+  CFLAGS_x86_64_pc_windows_gnu = "-I${pkgsWin64.windows.pthreads}/include";
+  CARGO_BUILD_RUSTFLAGS = [
+    "-C"
+    "linker=${targetCc}"
+    "-L"
+    "native=${pkgsWin64.windows.pthreads}/lib"
+  ];
+
+  CC = "${targetCc}";
+  LD = "${targetCc}";
+}

src/contact.rs

@@ -1026,9 +1026,7 @@ impl Contact {
                             || row_authname.is_empty());
 
                     row_id = id;
-                    let qr_with_fingerprint = !fingerprint.is_empty()
-                        && origin == Origin::UnhandledSecurejoinQrScan;
-                    if (origin >= row_origin || qr_with_fingerprint) && addr != row_addr {
+                    if origin >= row_origin && addr != row_addr {
                         update_addr = true;
                     }
                     if update_name || update_authname || update_addr || origin > row_origin {

src/e2ee.rs

@@ -97,18 +97,6 @@ impl EncryptHelper {
     }
 }
 
-/// Ensures a private key exists for the configured user.
-///
-/// Normally the private key is generated when the first message is
-/// sent but in a few locations there are no such guarantees,
-/// e.g. when exporting keys, and calling this function ensures a
-/// private key will be present.
-// TODO, remove this once deltachat::key::Key no longer exists.
-pub async fn ensure_secret_key_exists(context: &Context) -> Result<()> {
-    load_self_public_key(context).await?;
-    Ok(())
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -118,23 +106,7 @@ mod tests {
     use crate::message::Message;
     use crate::mimeparser::SystemMessage;
     use crate::receive_imf::receive_imf;
-    use crate::test_utils::{TestContext, TestContextManager};
-
-    mod ensure_secret_key_exists {
-        use super::*;
-
-        #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-        async fn test_prexisting() {
-            let t = TestContext::new_alice().await;
-            assert!(ensure_secret_key_exists(&t).await.is_ok());
-        }
-
-        #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-        async fn test_not_configured() {
-            let t = TestContext::new().await;
-            assert!(ensure_secret_key_exists(&t).await.is_err());
-        }
-    }
+    use crate::test_utils::TestContextManager;
 
     #[test]
     fn test_mailmime_parse() {

src/imex.rs

@@ -17,7 +17,6 @@ use crate::blob::BlobDirContents;
 use crate::chat::delete_and_reset_all_device_msgs;
 use crate::config::Config;
 use crate::context::Context;
-use crate::e2ee;
 use crate::events::EventType;
 use crate::key::{self, DcKey, SignedSecretKey};
 use crate::log::{LogExt, warn};
@@ -170,7 +169,7 @@ async fn imex_inner(
 
     if what == ImexMode::ExportBackup || what == ImexMode::ExportSelfKeys {
         // before we export anything, make sure the private key exists
-        e2ee::ensure_secret_key_exists(context)
+        key::ensure_secret_key_exists(context)
             .await
             .context("Cannot create private key or private key not available")?;
 

src/imex/transfer.rs

@@ -38,15 +38,16 @@ use tokio::fs;
 use tokio::task::JoinHandle;
 use tokio_util::sync::CancellationToken;
 
+use crate::EventType;
 use crate::chat::add_device_msg;
 use crate::context::Context;
 use crate::imex::BlobDirContents;
+use crate::key;
 use crate::log::warn;
 use crate::message::Message;
 use crate::qr::Qr;
 use crate::stock_str::backup_transfer_msg_body;
 use crate::tools::{TempPathGuard, create_id, time};
-use crate::{EventType, e2ee};
 
 use super::{DBFILE_BACKUP_NAME, export_backup_stream, export_database, import_backup_stream};
 
@@ -112,7 +113,7 @@ impl BackupProvider {
             .context("Context dir not found")?;
 
         // before we export, make sure the private key exists
-        e2ee::ensure_secret_key_exists(context)
+        key::ensure_secret_key_exists(context)
             .await
             .context("Cannot create private key or private key not available")?;
 

src/key.rs

@@ -320,6 +320,17 @@ pub(crate) async fn load_self_public_key(context: &Context) -> Result<SignedPubl
     }
 }
 
+/// Ensures a private key exists for the configured user.
+///
+/// Normally the private key is generated when the first message is
+/// sent but in a few locations there are no such guarantees,
+/// e.g. when exporting keys, and calling this function ensures a
+/// private key will be present.
+pub async fn ensure_secret_key_exists(context: &Context) -> Result<()> {
+    load_self_public_key(context).await?;
+    Ok(())
+}
+
 /// Returns our own public keyring.
 ///
 /// No keys are generated and at most one key is returned.
@@ -898,4 +909,20 @@ i8pcjGO+IZffvyZJVRWfVooBJmWWbPB1pueo3tx8w3+fcuzpxz+RLFKaPyqXO+dD
             "0102 0408 1020 4080 FF01\n0204 0810 2040 80FF 1314"
         );
     }
+
+    mod ensure_secret_key_exists {
+        use super::*;
+
+        #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+        async fn test_prexisting() {
+            let t = TestContext::new_alice().await;
+            assert!(ensure_secret_key_exists(&t).await.is_ok());
+        }
+
+        #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+        async fn test_not_configured() {
+            let t = TestContext::new().await;
+            assert!(ensure_secret_key_exists(&t).await.is_err());
+        }
+    }
 }

src/mimefactory.rs

@@ -271,7 +271,9 @@ impl MimeFactory {
 
             let public_key = SignedPublicKey::from_slice(&public_key_bytes)?;
 
-            recipients.extend(relay_addrs(&public_key, &addr));
+            let relays =
+                addresses_from_public_key(&public_key).unwrap_or_else(|| vec![addr.clone()]);
+            recipients.extend(relays);
             to.push((authname, addr.clone()));
 
             encryption_pubkeys = Some(vec![(addr, public_key)]);
@@ -351,7 +353,7 @@ impl MimeFactory {
                             };
                             if add_timestamp >= remove_timestamp {
                                 let relays = if let Some(public_key) = public_key_opt {
-                                    let addrs = relay_addrs(&public_key, &addr);
+                                    let addrs = addresses_from_public_key(&public_key);
                                     keys.push((addr.clone(), public_key));
                                     addrs
                                 } else if id != ContactId::SELF && !should_encrypt_symmetrically(&msg, &chat) {
@@ -359,10 +361,10 @@ impl MimeFactory {
                                     if is_encrypted {
                                         warn!(context, "Missing key for {addr}");
                                     }
-                                    vec![addr.clone()]
+                                    None
                                 } else {
-                                    vec![addr.clone()]
-                                };
+                                    None
+                                }.unwrap_or_else(|| vec![addr.clone()]);
 
                                 if !recipients_contain_addr(&to, &addr) {
                                     if id != ContactId::SELF {
@@ -391,7 +393,7 @@ impl MimeFactory {
                                     if let Some(email_to_remove) = email_to_remove
                                         && email_to_remove == addr {
                                             let relays = if let Some(public_key) = public_key_opt {
-                                                let addrs = relay_addrs(&public_key, &addr);
+                                                let addrs = addresses_from_public_key(&public_key);
                                                 keys.push((addr.clone(), public_key));
                                                 addrs
                                             } else if id != ContactId::SELF && !should_encrypt_symmetrically(&msg, &chat)  {
@@ -399,10 +401,10 @@ impl MimeFactory {
                                                 if is_encrypted {
                                                     warn!(context, "Missing key for {addr}");
                                                 }
-                                                vec![addr.clone()]
+                                                None
                                             } else {
-                                                vec![addr.clone()]
-                                            };
+                                                None
+                                            }.unwrap_or_else(|| vec![addr.clone()]);
 
                                             // This is a "member removed" message,
                                             // we need to notify removed member
@@ -616,9 +618,7 @@ impl MimeFactory {
 
     fn should_skip_autocrypt(&self) -> bool {
         match &self.loaded {
-            Loaded::Message { msg, .. } => {
-                msg.param.get_bool(Param::SkipAutocrypt).unwrap_or_default()
-            }
+            Loaded::Message { .. } => false,
             Loaded::Mdn { .. } => true,
         }
     }
@@ -2201,14 +2201,6 @@ async fn build_avatar_file(context: &Context, path: &str) -> Result<String> {
     Ok(encoded_body)
 }
 
-fn relay_addrs(public_key: &SignedPublicKey, addr: &str) -> Vec<String> {
-    let mut addrs = addresses_from_public_key(public_key).unwrap_or_default();
-    if !addrs.iter().any(|r| r == addr) {
-        addrs.push(addr.to_string());
-    }
-    addrs
-}
-
 fn recipients_contain_addr(recipients: &[(String, String)], addr: &str) -> bool {
     let addr_lc = addr.to_lowercase();
     recipients

src/param.rs

@@ -64,7 +64,8 @@ pub enum Param {
     ForcePlaintext = b'u',
 
     /// For Messages: do not include Autocrypt header.
-    SkipAutocrypt = b'o',
+    /// Deprecated on 2026-06-20
+    DeprecatedSkipAutocrypt = b'o',
 
     /// For Messages
     WantsMdn = b'r',

src/securejoin.rs

@@ -14,9 +14,9 @@ use crate::constants::{
 use crate::contact::mark_contact_id_as_verified;
 use crate::contact::{Contact, ContactId, Origin};
 use crate::context::Context;
-use crate::e2ee::ensure_secret_key_exists;
 use crate::events::EventType;
 use crate::headerdef::HeaderDef;
+use crate::key;
 use crate::key::{DcKey, Fingerprint, load_self_public_key, self_fingerprint};
 use crate::log::LogExt as _;
 use crate::log::warn;
@@ -92,7 +92,7 @@ pub async fn get_securejoin_qr(context: &Context, chat: Option<ChatId>) -> Resul
     ====   Step 1 in "Setup verified contact" protocol   ====
     =======================================================*/
 
-    ensure_secret_key_exists(context).await.ok();
+    key::ensure_secret_key_exists(context).await.ok();
 
     let chat = match chat {
         Some(id) => {

src/test_utils.rs

@@ -232,9 +232,7 @@ impl TestContextManager {
 
         test_context.set_primary_self_addr(new_addr).await.unwrap();
         // ensure_secret_key_exists() is called during configure
-        crate::e2ee::ensure_secret_key_exists(test_context)
-            .await
-            .unwrap();
+        key::ensure_secret_key_exists(test_context).await.unwrap();
 
         assert_eq!(
             test_context.get_primary_self_addr().await.unwrap(),

src/tests/verified_chats.rs

@@ -6,7 +6,9 @@ use crate::chat::{self, Chat, add_contact_to_chat, remove_contact_from_chat, sen
 use crate::config::Config;
 use crate::constants::Chattype;
 use crate::contact::{Contact, ContactId};
+use crate::key;
 use crate::key::self_fingerprint;
+use crate::message;
 use crate::message::{Message, Viewtype};
 use crate::mimefactory::MimeFactory;
 use crate::mimeparser::SystemMessage;
@@ -18,7 +20,6 @@ use crate::test_utils::{
     E2EE_INFO_MSGS, TestContext, TestContextManager, get_chat_msg, mark_as_verified,
 };
 use crate::tools::SystemTime;
-use crate::{e2ee, message};
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn test_verified_oneonone_chat_not_broken_by_classical() {
@@ -126,7 +127,7 @@ async fn test_create_verified_oneonone_chat() -> Result<()> {
 
     let fiona_new = tcm.unconfigured().await;
     fiona_new.configure_addr("fiona@example.net").await;
-    e2ee::ensure_secret_key_exists(&fiona_new).await?;
+    key::ensure_secret_key_exists(&fiona_new).await?;
 
     tcm.send_recv(&fiona_new, &alice, "I have a new device")
         .await;
@@ -428,7 +429,7 @@ async fn test_verify_then_verify_again() -> Result<()> {
     drop(bob);
     let bob_new = tcm.unconfigured().await;
     bob_new.configure_addr("bob@example.net").await;
-    e2ee::ensure_secret_key_exists(&bob_new).await?;
+    key::ensure_secret_key_exists(&bob_new).await?;
 
     tcm.execute_securejoin(&bob_new, &alice).await;
     assert_verified(&alice, &bob_new).await;