From bd77b89fea6cd876921ea97843609c0290c6abeb Mon Sep 17 00:00:00 2001
From: Erik Arvstedt <erik.arvstedt@gmail.com>
Date: Sat, 8 Jul 2023 15:32:58 +0200
Subject: [PATCH 1/8] rtl, clightning-rest: update to nodejs 18

16 is no longer supported by NixOS 23.05.
18 is the latest LTS version.
---
 dev/topics/rtl.sh                | 2 +-
 pkgs/clightning-rest/default.nix | 8 ++++----
 pkgs/lib.nix                     | 8 ++++++--
 pkgs/rtl/default.nix             | 8 ++++----
 4 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/dev/topics/rtl.sh b/dev/topics/rtl.sh
index ae68c91..cc9c390 100644
--- a/dev/topics/rtl.sh
+++ b/dev/topics/rtl.sh
@@ -30,7 +30,7 @@ runuser -u "$(logname)" -- xdg-open "http://$ip:3000"
 rtl_src=~/s/RTL
 git clone https://github.com/Ride-The-Lightning/RTL "$rtl_src"
 
-nix build -o /tmp/nix-bitcoin-dev/nodejs --inputs-from . nixpkgs#nodejs-16_x
+nix build -o /tmp/nix-bitcoin-dev/nodejs --inputs-from . nixpkgs#nodejs-18_x
 # Start a shell in a sandbox
 env --chdir "$rtl_src" nix-bitcoin-firejail --whitelist="$rtl_src" --whitelist=/tmp/nix-bitcoin-dev/nodejs
 PATH=/tmp/nix-bitcoin-dev/nodejs/bin:"$PATH"
diff --git a/pkgs/clightning-rest/default.nix b/pkgs/clightning-rest/default.nix
index 4688663..16706a3 100644
--- a/pkgs/clightning-rest/default.nix
+++ b/pkgs/clightning-rest/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenvNoCC
-, nodejs-16_x
-, nodejs-slim-16_x
+, nodejs-18_x
+, nodejs-slim-18_x
 , fetchNodeModules
 , fetchurl
 , makeWrapper
@@ -17,8 +17,8 @@ let self = stdenvNoCC.mkDerivation {
   };
 
   passthru = {
-    nodejs = nodejs-16_x;
-    nodejsRuntime = nodejs-slim-16_x;
+    nodejs = nodejs-18_x;
+    nodejsRuntime = nodejs-slim-18_x;
 
     nodeModules = fetchNodeModules {
       inherit (self) src nodejs;
diff --git a/pkgs/lib.nix b/pkgs/lib.nix
index ab6b23e..522740e 100644
--- a/pkgs/lib.nix
+++ b/pkgs/lib.nix
@@ -41,8 +41,12 @@ let self = {
     RestrictAddressFamilies = self.defaultHardening.RestrictAddressFamilies + " AF_NETLINK";
   };
 
-  # nodejs applications require memory write execute for JIT compilation
-  nodejs = { MemoryDenyWriteExecute = false; };
+  nodejs = {
+    # Required for JIT compilation
+    MemoryDenyWriteExecute = false;
+    # Required by nodejs >= 18
+    SystemCallFilter = self.defaultHardening.SystemCallFilter ++ [ "@pkey" ];
+  };
 
   # Allow takes precedence over Deny.
   allowLocalIPAddresses = {
diff --git a/pkgs/rtl/default.nix b/pkgs/rtl/default.nix
index 22c0691..9c4847a 100644
--- a/pkgs/rtl/default.nix
+++ b/pkgs/rtl/default.nix
@@ -1,7 +1,7 @@
 { lib
 , stdenvNoCC
-, nodejs-16_x
-, nodejs-slim-16_x
+, nodejs-18_x
+, nodejs-slim-18_x
 , fetchNodeModules
 , fetchpatch
 , fetchurl
@@ -18,8 +18,8 @@ let self = stdenvNoCC.mkDerivation {
   };
 
   passthru = {
-    nodejs = nodejs-16_x;
-    nodejsRuntime = nodejs-slim-16_x;
+    nodejs = nodejs-18_x;
+    nodejsRuntime = nodejs-slim-18_x;
 
     nodeModules = fetchNodeModules {
       inherit (self) src nodejs;

From 55c64d8dffbe107708d741a76565d1e7fb40a7ec Mon Sep 17 00:00:00 2001
From: Erik Arvstedt <erik.arvstedt@gmail.com>
Date: Sat, 8 Jul 2023 15:32:59 +0200
Subject: [PATCH 2/8] update nixpkgs

clightning: 23.05.1 -> 23.05.2
lightning-pool: 0.5.3-alpha -> 0.6.4-beta
---
 flake.lock                   | 18 +++++++++---------
 pkgs/pinned.nix              |  2 +-
 test/nixos-search/flake.lock | 12 ++++++------
 3 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/flake.lock b/flake.lock
index 3a2c75c..4c7eb5d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -28,11 +28,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1687171271,
-        "narHash": "sha256-BJlq+ozK2B1sJDQXS3tzJM5a+oVZmi1q0FlBK/Xqv7M=",
+        "lastModified": 1687709756,
+        "narHash": "sha256-Y5wKlQSkgEK2weWdOu4J3riRd+kV/VCgHsqLNTTWQ/0=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "abfb11bd1aec8ced1c9bb9adfe68018230f4fb3c",
+        "rev": "dbabf0ca0c0c4bce6ea5eaf65af5cb694d2082c7",
         "type": "github"
       },
       "original": {
@@ -43,11 +43,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1687376262,
-        "narHash": "sha256-xtenf0Nc6So/5uaQqe8u3GVoAs/YdMUFsysPUuK8w1s=",
+        "lastModified": 1688392541,
+        "narHash": "sha256-lHrKvEkCPTUO+7tPfjIcb7Trk6k31rz18vkyqmkeJfY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "7859e9c101fabbd62551b8f4260124a6e2f01a46",
+        "rev": "ea4c80b39be4c09702b0cb3b42eab59e2ba4f24b",
         "type": "github"
       },
       "original": {
@@ -59,11 +59,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1687518131,
-        "narHash": "sha256-KirltRIc4SFfk8bTNudIqgKAALH5oqpW3PefmkfWK5M=",
+        "lastModified": 1688798537,
+        "narHash": "sha256-+3QEnDgBiso8lgUJpMagn6xCujmarc6zCWfKYAd6nqU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3d8a93602bc54ece7a4e689d9aea1a574e2bbc24",
+        "rev": "842e90934a352f517d23963df3ec0474612e483c",
         "type": "github"
       },
       "original": {
diff --git a/pkgs/pinned.nix b/pkgs/pinned.nix
index a8a4fee..1974dc3 100644
--- a/pkgs/pinned.nix
+++ b/pkgs/pinned.nix
@@ -2,7 +2,6 @@
 pkgs: pkgsUnstable:
 {
   inherit (pkgs)
-    lightning-pool
     lndconnect;
 
   inherit (pkgsUnstable)
@@ -15,6 +14,7 @@ pkgs: pkgsUnstable:
     fulcrum
     hwi
     lightning-loop
+    lightning-pool
     nbxplorer;
 
   inherit pkgs pkgsUnstable;
diff --git a/test/nixos-search/flake.lock b/test/nixos-search/flake.lock
index 4b7d534..91ced1c 100644
--- a/test/nixos-search/flake.lock
+++ b/test/nixos-search/flake.lock
@@ -18,11 +18,11 @@
     "nixos-org-configurations": {
       "flake": false,
       "locked": {
-        "lastModified": 1685568558,
-        "narHash": "sha256-KYYnHfhp8Zc0Hu6ZGuZUe2EKvtyIF6Q34yb14kGoz8c=",
+        "lastModified": 1688381214,
+        "narHash": "sha256-0g/rZUiXIk1H6D6Oa1VcK41REeIRGSdVDPAFVqZKf1E=",
         "owner": "NixOS",
         "repo": "nixos-org-configurations",
-        "rev": "acc635f7453b76ac1b7bdf164a3f22e5267ff329",
+        "rev": "083c137b7ae19a1a8d6822fea7ca30aeeda72ac8",
         "type": "github"
       },
       "original": {
@@ -39,11 +39,11 @@
         "npmlock2nix": "npmlock2nix"
       },
       "locked": {
-        "lastModified": 1687164217,
-        "narHash": "sha256-e1PcI2Zf6IKQZuH77CvEgAKjXj3URPWJ67Tups40UOI=",
+        "lastModified": 1688414580,
+        "narHash": "sha256-U7ngzJ0ErKTxrjG5Okym9PLxnmjoeDIZZe0dfhv8ER4=",
         "owner": "nixos",
         "repo": "nixos-search",
-        "rev": "b5acb880d160a478e8d3ad42aee8806979171135",
+        "rev": "1128c8fb69d4a8557baeee13053e7792339554f9",
         "type": "github"
       },
       "original": {

From e2cce7daa8bea1671f95256dd1e2fbe17636332b Mon Sep 17 00:00:00 2001
From: Erik Arvstedt <erik.arvstedt@gmail.com>
Date: Sat, 8 Jul 2023 15:33:00 +0200
Subject: [PATCH 3/8] update to nixos 23.05

---
 .cirrus.yml                     |  2 +-
 examples/configuration.nix      |  4 ++--
 flake.lock                      |  8 ++++----
 flake.nix                       |  2 +-
 pkgs/pinned.nix                 | 10 +++++-----
 test/clightning-replication.nix |  2 +-
 test/lib/make-test.nix          |  2 +-
 test/tests.nix                  |  5 ++++-
 8 files changed, 19 insertions(+), 16 deletions(-)

diff --git a/.cirrus.yml b/.cirrus.yml
index fbbf47e..918c891 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -9,7 +9,7 @@ task:
 
   container:
     # Defined in https://github.com/nix-community/docker-nixpkgs
-    image: nixpkgs/nix-flakes:nixos-22.11
+    image: nixpkgs/nix-flakes:nixos-23.05
 
   matrix:
     - name: modules_test
diff --git a/examples/configuration.nix b/examples/configuration.nix
index 1f9651d..5db7bb9 100644
--- a/examples/configuration.nix
+++ b/examples/configuration.nix
@@ -265,7 +265,7 @@
 
   services.openssh = {
     enable = true;
-    passwordAuthentication = false;
+    settings.PasswordAuthentication = false;
   };
   users.users.root = {
     openssh.authorizedKeys.keys = [
@@ -292,7 +292,7 @@
   # this value at the release version of the first install of this system.
   # Before changing this value read the documentation for this option
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "22.11"; # Did you read the comment?
+  system.stateVersion = "23.05"; # Did you read the comment?
 
   # The nix-bitcoin release version that your config is compatible with.
   # When upgrading to a backwards-incompatible release, nix-bitcoin will display an
diff --git a/flake.lock b/flake.lock
index 4c7eb5d..b0a1f29 100644
--- a/flake.lock
+++ b/flake.lock
@@ -43,16 +43,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1688392541,
-        "narHash": "sha256-lHrKvEkCPTUO+7tPfjIcb7Trk6k31rz18vkyqmkeJfY=",
+        "lastModified": 1688764204,
+        "narHash": "sha256-FsvK+tIvelCI0tWwlMDKfiyb7P/KfxpGbXMrdCKiT8s=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ea4c80b39be4c09702b0cb3b42eab59e2ba4f24b",
+        "rev": "d8bb6c681cf86265fdcf3cc3119f757bbb085835",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-22.11",
+        "ref": "nixos-23.05",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 0c260e6..391f2c1 100644
--- a/flake.nix
+++ b/flake.nix
@@ -5,7 +5,7 @@
   '';
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.05";
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
     flake-utils.url = "github:numtide/flake-utils";
     extra-container = {
diff --git a/pkgs/pinned.nix b/pkgs/pinned.nix
index 1974dc3..aeb8ac0 100644
--- a/pkgs/pinned.nix
+++ b/pkgs/pinned.nix
@@ -2,17 +2,17 @@
 pkgs: pkgsUnstable:
 {
   inherit (pkgs)
-    lndconnect;
-
-  inherit (pkgsUnstable)
-    btcpayserver
     charge-lnd
-    clightning
     electrs
     elementsd
     extra-container
     fulcrum
     hwi
+    lndconnect;
+
+  inherit (pkgsUnstable)
+    btcpayserver
+    clightning
     lightning-loop
     lightning-pool
     nbxplorer;
diff --git a/test/clightning-replication.nix b/test/clightning-replication.nix
index a55277e..002fcb9 100644
--- a/test/clightning-replication.nix
+++ b/test/clightning-replication.nix
@@ -101,7 +101,7 @@ makeTestVM {
 
   testScript =  { nodes, ... }: let
     systems = builtins.concatStringsSep ", "
-      (mapAttrsToList (name: node: ''"${name}": "${node.config.system.build.toplevel}"'') nodes);
+      (mapAttrsToList (name: node: ''"${name}": "${node.system.build.toplevel}"'') nodes);
   in ''
     systems = { ${systems} }
 
diff --git a/test/lib/make-test.nix b/test/lib/make-test.nix
index 7ac85b2..16e2192 100644
--- a/test/lib/make-test.nix
+++ b/test/lib/make-test.nix
@@ -23,7 +23,7 @@ let
     };
 
     testScript = nodes: let
-      cfg = nodes.nodes.machine.config;
+      cfg = nodes.nodes.machine;
       data = {
         data = cfg.test.data;
         tests = cfg.tests;
diff --git a/test/tests.nix b/test/tests.nix
index f231570..601e57a 100644
--- a/test/tests.nix
+++ b/test/tests.nix
@@ -390,7 +390,10 @@ in {
             config
           ];
           # Share the same pkgs instance among tests
-          nixpkgs.pkgs = pkgs.lib.mkDefault pkgs;
+          # Set priority slightly higher (i.e. to a slightly lower number) than `mkDefault`,
+          # so that this module can be used with function `pkgs.nixos`, which already
+          # sets `nixpkgs.pkgs` with prio `mkDefault`.
+          nixpkgs.pkgs = lib.mkOverride 900 pkgs;
         };
       };
 

From 6c2d1108a477e3788f6407216e04e6711ef33007 Mon Sep 17 00:00:00 2001
From: Erik Arvstedt <erik.arvstedt@gmail.com>
Date: Sat, 8 Jul 2023 15:33:01 +0200
Subject: [PATCH 4/8] update the required extra-container version for nixos
 23.05

---
 test/lib/make-container.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/test/lib/make-container.sh b/test/lib/make-container.sh
index b500b59..ff80cee 100755
--- a/test/lib/make-container.sh
+++ b/test/lib/make-container.sh
@@ -72,9 +72,9 @@ while [[ $# -gt 0 ]]; do
 done
 
 containerBin=$(type -P extra-container) || true
-if [[ ! ($containerBin && $(realpath "$containerBin") == *extra-container-0.11*) ]]; then
+if [[ ! ($containerBin && $(realpath "$containerBin") == *extra-container-0.12*) ]]; then
     echo
-    echo "Building extra-container. Skip this step by adding extra-container 0.11 to PATH."
+    echo "Building extra-container. Skip this step by adding extra-container 0.12 to PATH."
     nix build --out-link /tmp/extra-container "$scriptDir"/..#extra-container
     # When this script is run as root, e.g. when run in an extra-container shell,
     # chown the gcroot symlink to the regular (login) user so that the symlink can be

From 76dc7b92e16fabcf1d94b94a25b7537c57966556 Mon Sep 17 00:00:00 2001
From: Erik Arvstedt <erik.arvstedt@gmail.com>
Date: Sat, 8 Jul 2023 15:33:02 +0200
Subject: [PATCH 5/8] examples/deploy-container.sh: add extra-container version
 check

It now uses the same version check as
make-container.sh (which is called by run-tests.sh)
---
 examples/deploy-container.sh              |  1 +
 test/lib/extra-container-check-version.sh | 13 +++++++++++++
 test/lib/make-container.sh                | 14 +-------------
 3 files changed, 15 insertions(+), 13 deletions(-)
 create mode 100644 test/lib/extra-container-check-version.sh

diff --git a/examples/deploy-container.sh b/examples/deploy-container.sh
index e02c09a..9ec0bc1 100755
--- a/examples/deploy-container.sh
+++ b/examples/deploy-container.sh
@@ -87,6 +87,7 @@ read -rd '' src <<EOF || true
   };
 }
 EOF
+. "${BASH_SOURCE[0]%/*}"/../test/lib/extra-container-check-version.sh
 extra-container shell -E "$src" "${runCmd[@]}"
 
 # The container is automatically deleted at exit
diff --git a/test/lib/extra-container-check-version.sh b/test/lib/extra-container-check-version.sh
new file mode 100644
index 0000000..1daf42e
--- /dev/null
+++ b/test/lib/extra-container-check-version.sh
@@ -0,0 +1,13 @@
+containerBin=$(type -P extra-container) || true
+if [[ ! ($containerBin && $(realpath "$containerBin") == *extra-container-0.12*) ]]; then
+    echo
+    echo "Building extra-container. Skip this step by adding extra-container 0.12 to PATH."
+    nix build --out-link /tmp/extra-container "${BASH_SOURCE[0]%/*}"/../..#extra-container
+    # When this script is run as root, e.g. when run in an extra-container shell,
+    # chown the gcroot symlink to the regular (login) user so that the symlink can be
+    # overwritten when this script is run without root.
+    if [[ $EUID == 0 ]]; then
+        chown "$(logname):" --no-dereference /tmp/extra-container
+    fi
+    export PATH="/tmp/extra-container/bin${PATH:+:}$PATH"
+fi
diff --git a/test/lib/make-container.sh b/test/lib/make-container.sh
index ff80cee..80ec599 100755
--- a/test/lib/make-container.sh
+++ b/test/lib/make-container.sh
@@ -71,18 +71,6 @@ while [[ $# -gt 0 ]]; do
     esac
 done
 
-containerBin=$(type -P extra-container) || true
-if [[ ! ($containerBin && $(realpath "$containerBin") == *extra-container-0.12*) ]]; then
-    echo
-    echo "Building extra-container. Skip this step by adding extra-container 0.12 to PATH."
-    nix build --out-link /tmp/extra-container "$scriptDir"/..#extra-container
-    # When this script is run as root, e.g. when run in an extra-container shell,
-    # chown the gcroot symlink to the regular (login) user so that the symlink can be
-    # overwritten when this script is run without root.
-    if [[ $EUID == 0 ]]; then
-        chown "$(logname):" --no-dereference /tmp/extra-container
-    fi
-    export PATH="/tmp/extra-container/bin${PATH:+:}$PATH"
-fi
+. "${BASH_SOURCE[0]%/*}"/extra-container-check-version.sh
 
 exec "$container"/bin/container "$containerCommand" "$@"

From e31cc686f2f0cac360f2c5894538f66969453c4e Mon Sep 17 00:00:00 2001
From: Erik Arvstedt <erik.arvstedt@gmail.com>
Date: Sat, 8 Jul 2023 15:33:03 +0200
Subject: [PATCH 6/8] run-tests: make compatible with new shellcheck version

---
 test/run-tests.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/run-tests.sh b/test/run-tests.sh
index 778d3aa..d26c111 100755
--- a/test/run-tests.sh
+++ b/test/run-tests.sh
@@ -320,7 +320,7 @@ if [[ $# -gt 0 && $1 != -* ]]; then
     if [[ $command == eval ]]; then
         command=evalTest
     fi
-    : ${scenario:=default}
+    : "${scenario:=default}"
 elif [[ $scenario ]]; then
     command=buildTest
 else

From bb2e88cec27a6b5ebfd8de5d60730c13709e4045 Mon Sep 17 00:00:00 2001
From: Erik Arvstedt <erik.arvstedt@gmail.com>
Date: Sat, 8 Jul 2023 15:33:04 +0200
Subject: [PATCH 7/8] fix python packages for nixos 23.05

---
 pkgs/clightning-plugins/default.nix           |   4 +-
 pkgs/python-packages/default.nix              |  22 ++-
 pkgs/python-packages/jmbase/default.nix       |   4 +
 pkgs/python-packages/jmclient/default.nix     |   2 +-
 pkgs/python-packages/pyln-proto/default.nix   |   2 +-
 .../specific-versions/bitstring.nix           |  40 ++++
 .../cryptography/default.nix                  |   5 +-
 .../specific-versions/twisted.nix             | 173 ------------------
 .../specific-versions/txtorcon.nix            |  48 +++++
 9 files changed, 117 insertions(+), 183 deletions(-)
 create mode 100644 pkgs/python-packages/specific-versions/bitstring.nix
 delete mode 100644 pkgs/python-packages/specific-versions/twisted.nix
 create mode 100644 pkgs/python-packages/specific-versions/txtorcon.nix

diff --git a/pkgs/clightning-plugins/default.nix b/pkgs/clightning-plugins/default.nix
index 739a83c..eb9a98b 100644
--- a/pkgs/clightning-plugins/default.nix
+++ b/pkgs/clightning-plugins/default.nix
@@ -42,7 +42,7 @@ let
       description = "Lightning node exporter for the prometheus timeseries server";
       extraPkgs = [ prometheus_client ];
       patchRequirements =
-        "--replace prometheus-client==0.6.0 prometheus-client==0.15.0"
+        "--replace prometheus-client==0.6.0 prometheus-client==0.16.0"
         + " --replace pyln-client~=0.9.3 pyln-client~=23.02";
     };
     rebalance = {
@@ -79,7 +79,7 @@ let
 
         # Check that requirements are met
         PYTHONPATH='${toString python}/${python.sitePackages}' \
-          ${pkgs.python3Packages.pip}/bin/pip install -r requirements.txt --no-cache --no-index
+          ${pkgs.python3Packages.pip}/bin/pip install -r requirements.txt --no-cache --no-index --break-system-packages
 
         chmod +x '${script}'
         patchShebangs '${script}'
diff --git a/pkgs/python-packages/default.nix b/pkgs/python-packages/default.nix
index c0f0296..d079f4f 100644
--- a/pkgs/python-packages/default.nix
+++ b/pkgs/python-packages/default.nix
@@ -1,4 +1,15 @@
 nbPkgs: python3:
+let
+  # Ignore eval error:
+  # `OpenSSL 1.1 is reaching its end of life on 2023/09/11 and cannot
+  # be supported through the NixOS 23.05 release cycle.`
+  # TODO-EXTERNAL: consider removing when
+  # https://github.com/Simplexum/python-bitcointx/issues/76 and
+  # https://github.com/JoinMarket-Org/joinmarket-clientserver#1451 are resolved.
+  openssl_1_1 = python3.pkgs.pkgs.openssl_1_1.overrideAttrs (old: {
+    meta = builtins.removeAttrs old.meta [ "knownVulnerabilities" ];
+  });
+in
 rec {
   pyPkgsOverrides = self: super: let
     inherit (self) callPackage;
@@ -13,12 +24,15 @@ rec {
       pyln-bolt7 = clightningPkg ./pyln-bolt7;
       pylightning = clightningPkg ./pylightning;
 
+      # bitstring 3.1.9, required by pyln-proto
+      bitstring = callPackage ./specific-versions/bitstring.nix {};
+
       # Packages only used by joinmarket
       bencoderpyx = callPackage ./bencoderpyx {};
       chromalog = callPackage ./chromalog {};
       python-bitcointx = callPackage ./python-bitcointx {
         inherit (nbPkgs) secp256k1;
-        openssl = super.pkgs.openssl_1_1;
+        openssl = openssl_1_1;
       };
       runes = callPackage ./runes {};
       sha256 = callPackage ./sha256 {};
@@ -39,7 +53,7 @@ rec {
 
       # cryptography 3.3.2, required by joinmarketdaemon
       cryptography = callPackage ./specific-versions/cryptography {
-        openssl = super.pkgs.openssl_1_1;
+        openssl = openssl_1_1;
         cryptography_vectors = callPackage ./specific-versions/cryptography/vectors.nix {};
       };
 
@@ -49,8 +63,8 @@ rec {
       # pyopenssl 21.0.0, required by joinmarketdaemon
       pyopenssl = callPackage ./specific-versions/pyopenssl.nix {};
 
-      # twisted 22.4.0, required by joinmarketbase
-      twisted = callPackage ./specific-versions/twisted.nix {};
+      # txtorcon 22.0.0, required by joinmarketdaemon
+      txtorcon = callPackage ./specific-versions/txtorcon.nix {};
     };
 
   nbPython3Packages = (python3.override {
diff --git a/pkgs/python-packages/jmbase/default.nix b/pkgs/python-packages/jmbase/default.nix
index 63d7dfb..6af339f 100644
--- a/pkgs/python-packages/jmbase/default.nix
+++ b/pkgs/python-packages/jmbase/default.nix
@@ -6,6 +6,10 @@ buildPythonPackage rec {
 
   postUnpack = "sourceRoot=$sourceRoot/jmbase";
 
+  patchPhase = ''
+    sed -i 's|twisted==22.4.0|twisted==22.10.0|' setup.py
+  '';
+
   propagatedBuildInputs = [ future twisted service-identity chromalog txtorcon ];
 
   meta = with lib; {
diff --git a/pkgs/python-packages/jmclient/default.nix b/pkgs/python-packages/jmclient/default.nix
index 165d7c4..0202361 100644
--- a/pkgs/python-packages/jmclient/default.nix
+++ b/pkgs/python-packages/jmclient/default.nix
@@ -14,7 +14,7 @@ buildPythonPackage rec {
     substituteInPlace setup.py \
       --replace "'klein==20.6.0'" "'klein>=20.6.0'"
     substituteInPlace setup.py \
-      --replace "'pyjwt==2.4.0'" "'pyjwt==2.5.0'"
+      --replace "'pyjwt==2.4.0'" "'pyjwt==2.6.0'"
   '';
 
   meta = with lib; {
diff --git a/pkgs/python-packages/pyln-proto/default.nix b/pkgs/python-packages/pyln-proto/default.nix
index 4dc21a9..bfeac82 100644
--- a/pkgs/python-packages/pyln-proto/default.nix
+++ b/pkgs/python-packages/pyln-proto/default.nix
@@ -29,6 +29,6 @@ buildPythonPackage rec {
   postUnpack = "sourceRoot=$sourceRoot/contrib/pyln-proto";
 
   postPatch = ''
-    sed -i 's|cryptography = "^36.0.1"|cryptography = "^38.0.0"|' pyproject.toml
+    sed -i 's|cryptography = "^36.0.1"|cryptography = "^40.0"|' pyproject.toml
   '';
 }
diff --git a/pkgs/python-packages/specific-versions/bitstring.nix b/pkgs/python-packages/specific-versions/bitstring.nix
new file mode 100644
index 0000000..c67b707
--- /dev/null
+++ b/pkgs/python-packages/specific-versions/bitstring.nix
@@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, fetchpatch
+, unittestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "bitstring";
+  version = "3.1.9";
+
+  src = fetchFromGitHub {
+    owner = "scott-griffiths";
+    repo = pname;
+    rev = "bitstring-${version}";
+    sha256 = "0y2kcq58psvl038r6dhahhlhp1wjgr5zsms45wyz1naq6ri8x9qa";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "fix-running-unit-tests-using-unittest-hook.patch";
+      url = "https://github.com/scott-griffiths/bitstring/commit/e5ee3fd41cad2ea761f4450b13b0424ae7262331.patch";
+      hash = "sha256-+ZGywIfQQcYXJlYZBi402ONnysYm66G5zE4duJE40h8=";
+    })
+  ];
+
+  checkInputs = [ unittestCheckHook ];
+
+  unittestFlagsArray = [ "-s" "test" ];
+
+  pythonImportsCheck = [ "bitstring" ];
+
+  meta = with lib; {
+    description = "Module for binary data manipulation";
+    homepage = "https://github.com/scott-griffiths/bitstring";
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ bjornfor ];
+  };
+}
diff --git a/pkgs/python-packages/specific-versions/cryptography/default.nix b/pkgs/python-packages/specific-versions/cryptography/default.nix
index a852fcd..b47550c 100644
--- a/pkgs/python-packages/specific-versions/cryptography/default.nix
+++ b/pkgs/python-packages/specific-versions/cryptography/default.nix
@@ -50,7 +50,8 @@ buildPythonPackage rec {
 
   checkInputs = [
     cryptography_vectors
-    hypothesis
+    # Work around `error: infinite recursion encountered`
+    (hypothesis.override { enableDocumentation = false; })
     iso8601
     pretend
     pytest
@@ -58,7 +59,7 @@ buildPythonPackage rec {
   ];
 
   checkPhase = ''
-    py.test --disable-pytest-warnings tests
+    ${pytest}/bin/py.test --disable-pytest-warnings tests
   '';
 
   # IOKit's dependencies are inconsistent between OSX versions, so this is the best we
diff --git a/pkgs/python-packages/specific-versions/twisted.nix b/pkgs/python-packages/specific-versions/twisted.nix
deleted file mode 100644
index 6689a2c..0000000
--- a/pkgs/python-packages/specific-versions/twisted.nix
+++ /dev/null
@@ -1,173 +0,0 @@
-{ lib
-, stdenv
-, buildPythonPackage
-, pythonOlder
-, fetchPypi
-, python
-, appdirs
-, attrs
-, automat
-, bcrypt
-, constantly
-, contextvars
-, cryptography
-, git
-, glibcLocales
-, h2
-, hyperlink
-, idna
-, incremental
-, priority
-, pyasn1
-, pyhamcrest
-, pynacl
-, pyopenssl
-, pyserial
-, service-identity
-, setuptools
-, typing-extensions
-, zope_interface
-
-  # for passthru.tests
-, cassandra-driver
-, klein
-, magic-wormhole
-, scrapy
-, treq
-, txaio
-, txamqp
-, txrequests
-, txtorcon
-, thrift
-, nixosTests
-}:
-
-buildPythonPackage rec {
-  pname = "twisted";
-  version = "22.4.0";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.6";
-
-  src = fetchPypi {
-    pname = "Twisted";
-    inherit version;
-    extension = "tar.gz";
-    sha256 = "sha256-oEeZD1ffrh4L0rffJSbU8W3NyEN3TcEIt4xS8qXxNoA=";
-  };
-
-  __darwinAllowLocalNetworking = true;
-
-  propagatedBuildInputs = [
-    attrs
-    automat
-    constantly
-    hyperlink
-    incremental
-    setuptools
-    typing-extensions
-    zope_interface
-  ];
-
-  postPatch = ''
-    echo 'ListingTests.test_localeIndependent.skip = "Timezone issue"'>> src/twisted/conch/test/test_cftp.py
-    echo 'ListingTests.test_newFile.skip = "Timezone issue"'>> src/twisted/conch/test/test_cftp.py
-    echo 'ListingTests.test_newSingleDigitDayOfMonth.skip = "Timezone issue"'>> src/twisted/conch/test/test_cftp.py
-    echo 'ListingTests.test_oldFile.skip = "Timezone issue"'>> src/twisted/conch/test/test_cftp.py
-    echo 'ListingTests.test_oldSingleDigitDayOfMonth.skip = "Timezone issue"'>> src/twisted/conch/test/test_cftp.py
-
-    echo 'PTYProcessTestsBuilder_AsyncioSelectorReactorTests.test_openFileDescriptors.skip = "invalid syntax"'>> src/twisted/internet/test/test_process.py
-    echo 'PTYProcessTestsBuilder_SelectReactorTests.test_openFileDescriptors.skip = "invalid syntax"'>> src/twisted/internet/test/test_process.py
-
-    echo 'UNIXTestsBuilder_AsyncioSelectorReactorTests.test_sendFileDescriptorTriggersPauseProducing.skip = "sendFileDescriptor producer was not paused"'>> src/twisted/internet/test/test_unix.py
-    echo 'UNIXTestsBuilder_SelectReactorTests.test_sendFileDescriptorTriggersPauseProducing.skip = "sendFileDescriptor producer was not paused"'>> src/twisted/internet/test/test_unix.py
-
-    echo 'FileObserverTests.test_getTimezoneOffsetEastOfUTC.skip = "mktime argument out of range"'>> src/twisted/test/test_log.py
-    echo 'FileObserverTests.test_getTimezoneOffsetWestOfUTC.skip = "mktime argument out of range"'>> src/twisted/test/test_log.py
-    echo 'FileObserverTests.test_getTimezoneOffsetWithoutDaylightSavingTime.skip = "tuple differs, values not"'>> src/twisted/test/test_log.py
-
-    echo 'MulticastTests.test_joinLeave.skip = "No such device"'>> src/twisted/test/test_udp.py
-    echo 'MulticastTests.test_loopback.skip = "No such device"'>> src/twisted/test/test_udp.py
-    echo 'MulticastTests.test_multicast.skip = "Reactor was unclean"'>> src/twisted/test/test_udp.py
-    echo 'MulticastTests.test_multiListen.skip = "No such device"'>> src/twisted/test/test_udp.py
-
-    echo 'DomishExpatStreamTests.test_namespaceWithWhitespace.skip = "syntax error: line 1, column 0"'>> src/twisted/words/test/test_domish.py
-
-    # not packaged
-    substituteInPlace src/twisted/test/test_failure.py \
-      --replace "from cython_test_exception_raiser import raiser  # type: ignore[import]" "raiser = None"
-  '' + lib.optionalString stdenv.isLinux ''
-    echo 'PTYProcessTestsBuilder_EPollReactorTests.test_openFileDescriptors.skip = "invalid syntax"'>> src/twisted/internet/test/test_process.py
-    echo 'PTYProcessTestsBuilder_PollReactorTests.test_openFileDescriptors.skip = "invalid syntax"'>> src/twisted/internet/test/test_process.py
-    echo 'UNIXTestsBuilder_EPollReactorTests.test_sendFileDescriptorTriggersPauseProducing.skip = "sendFileDescriptor producer was not paused"'>> src/twisted/internet/test/test_unix.py
-    echo 'UNIXTestsBuilder_PollReactorTests.test_sendFileDescriptorTriggersPauseProducing.skip = "sendFileDescriptor producer was not paused"'>> src/twisted/internet/test/test_unix.py
-
-    # Patch t.p._inotify to point to libc. Without this,
-    # twisted.python.runtime.platform.supportsINotify() == False
-    substituteInPlace src/twisted/python/_inotify.py --replace \
-      "ctypes.util.find_library(\"c\")" "'${stdenv.cc.libc}/lib/libc.so.6'"
-  '' + lib.optionalString (stdenv.isAarch64 && stdenv.isDarwin) ''
-    echo 'AbortConnectionTests_AsyncioSelectorReactorTests.test_fullWriteBufferAfterByteExchange.skip = "Timeout after 120 seconds"' >> src/twisted/internet/test/test_tcp.py
-    echo 'AbortConnectionTests_AsyncioSelectorReactorTests.test_resumeProducingAbort.skip = "Timeout after 120 seconds"' >> src/twisted/internet/test/test_tcp.py
-  '';
-
-  # Generate Twisted's plug-in cache. Twisted users must do it as well. See
-  # http://twistedmatrix.com/documents/current/core/howto/plugin.html#auto3
-  # and http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=477103 for details.
-  postFixup = ''
-    $out/bin/twistd --help > /dev/null
-  '';
-
-  checkInputs = [
-    git
-    glibcLocales
-    pyhamcrest
-  ]
-  ++ passthru.optional-dependencies.conch
-  # not supported on aarch64-darwin: https://github.com/pyca/pyopenssl/issues/873
-  ++ lib.optionals (!(stdenv.isDarwin && stdenv.isAarch64)) passthru.optional-dependencies.tls;
-
-  checkPhase = ''
-    export SOURCE_DATE_EPOCH=315532800
-    export PATH=$out/bin:$PATH
-    # race conditions when running in paralell
-    ${python.interpreter} -m twisted.trial twisted
-  '';
-
-  passthru = {
-    optional-dependencies = rec {
-      conch = [ appdirs bcrypt cryptography pyasn1 ];
-      conch_nacl = conch ++ [ pynacl ];
-      contextvars = lib.optionals (pythonOlder "3.7") [ contextvars ];
-      http2 = [ h2 priority ];
-      serial = [ pyserial ];
-      tls = [ idna pyopenssl service-identity ];
-    };
-
-    tests = {
-      inherit
-        cassandra-driver
-        klein
-        magic-wormhole
-        scrapy
-        treq
-        txaio
-        txamqp
-        txrequests
-        txtorcon
-        thrift;
-      inherit (nixosTests) buildbot matrix-synapse;
-    };
-  };
-
-  meta = with lib; {
-    homepage = "https://github.com/twisted/twisted";
-    description = "Twisted, an event-driven networking engine written in Python";
-    longDescription = ''
-      Twisted is an event-driven networking engine written in Python
-      and licensed under the MIT license.
-    '';
-    license = licenses.mit;
-    maintainers = with maintainers; [ SuperSandro2000 ];
-  };
-}
diff --git a/pkgs/python-packages/specific-versions/txtorcon.nix b/pkgs/python-packages/specific-versions/txtorcon.nix
new file mode 100644
index 0000000..8538534
--- /dev/null
+++ b/pkgs/python-packages/specific-versions/txtorcon.nix
@@ -0,0 +1,48 @@
+{ lib
+, stdenv
+, python
+, buildPythonPackage
+, pythonOlder
+, fetchPypi
+, cryptography
+, incremental
+, twisted
+, automat
+, zope_interface
+, idna
+, pyopenssl
+, service-identity
+, pytestCheckHook
+, mock
+, lsof
+, GeoIP
+}:
+
+buildPythonPackage rec {
+  pname = "txtorcon";
+  version = "22.0.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-iaG2XjKks2nWfmwWY4f7xGjMXQUidEjSOaXn6XGKoFM=";
+  };
+
+  propagatedBuildInputs = [
+    cryptography
+    incremental
+    twisted
+    automat
+    zope_interface
+  ] ++ twisted.optional-dependencies.tls;
+
+  nativeCheckInputs = [ pytestCheckHook mock lsof GeoIP ];
+
+  doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
+
+  meta = {
+    description = "Twisted-based Tor controller client, with state-tracking and configuration abstractions";
+    homepage = "https://github.com/meejah/txtorcon";
+    maintainers = with lib.maintainers; [ jluttine exarkun ];
+    license = lib.licenses.mit;
+  };
+}

From e658209d568573a5811c1696de9cffafc099d045 Mon Sep 17 00:00:00 2001
From: Erik Arvstedt <erik.arvstedt@gmail.com>
Date: Wed, 19 Jul 2023 11:37:47 +0200
Subject: [PATCH 8/8] =?UTF-8?q?run-tests.sh:=20fix=20building=20tests=20fo?=
 =?UTF-8?q?r=20Nix=20=E2=89=A5=202.15?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 test/run-tests.sh | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/test/run-tests.sh b/test/run-tests.sh
index d26c111..5a69daf 100755
--- a/test/run-tests.sh
+++ b/test/run-tests.sh
@@ -232,6 +232,8 @@ nixInstantiate() {
 
 nixBuild() {
     local outLinkName=$1
+    local drv=$2
+    shift
     shift
     args=(--print-out-paths -L)
     if [[ $outLinkPrefix ]]; then
@@ -239,7 +241,25 @@ nixBuild() {
     else
         args+=(--no-link)
     fi
-    nix build "${args[@]}" "$@"
+    if isNixVersionGreaterEqual_2_15; then
+        # This syntax is supported by Nix ≥ 2.13
+        drv="$(realpath "$drv")^*"
+    fi
+    nix build "$drv" "${args[@]}" "$@"
+}
+
+isNixGE_2_15=undefined
+isNixVersionGreaterEqual_2_15() {
+    if [[ $isNixGE_2_15 == undefined ]]; then
+        isNixGE_2_15=
+        if {
+            echo '2.15'
+            nix --version | awk '{print $NF}'
+        } | sort -C -V; then
+            isNixGE_2_15=1
+        fi
+    fi
+    [[ $isNixGE_2_15 ]]
 }
 
 flake() {