Merge master into haskell-updates

doc/build-helpers/trivial-build-helpers.chapter.md

@@ -488,7 +488,7 @@ writeTextFile {
     echo "hi"
   '';
   executable = true;
-  destination = "bin/my-script"
+  destination = "bin/my-script";
 }
 ```
 
@@ -576,7 +576,7 @@ writeTextFile {
     echo "hi"
   '';
   executable = true;
-  destination = "bin/my-script"
+  destination = "bin/my-script";
 }
 ```
 

doc/languages-frameworks/rust.section.md

@@ -651,6 +651,66 @@ buildPythonPackage rec {
 }
 ```
 
+#### Rust package built with `meson` {#rust-package-built-with-meson}
+
+Some projects, especially GNOME applications, are built with the Meson Build System instead of calling Cargo directly. Using `rustPlatform.buildRustPackage` may successfully build the main program, but related files will be missing. Instead, you need to set up Cargo dependencies with `fetchCargoTarball` and `cargoSetupHook` and leave the rest to Meson. `rust` and `cargo` are still needed in `nativeBuildInputs` for Meson to use.
+
+```nix
+{ lib
+, stdenv
+, fetchFromGitLab
+, meson
+, ninja
+, pkg-config
+, rustPlatform
+, rustc
+, cargo
+, wrapGAppsHook4
+, blueprint-compiler
+, libadwaita
+, libsecret
+, tracker
+}:
+
+stdenv.mkDerivation rec {
+  pname = "health";
+  version = "0.95.0";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "World";
+    repo = "health";
+    rev = version;
+    hash = "sha256-PrNPprSS98yN8b8yw2G6hzTSaoE65VbsM3q7FVB4mds=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-8fa3fa+sFi5H+49B5sr2vYPkp9C9s6CcE0zv4xB8gww=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    rustPlatform.cargoSetupHook
+    rustc
+    cargo
+    wrapGAppsHook4
+    blueprint-compiler
+  ];
+
+  buildInputs = [
+    libadwaita
+    libsecret
+    tracker
+  ];
+
+  # ...
+}
+```
+
 ## `buildRustCrate`: Compiling Rust crates using Nix instead of Cargo {#compiling-rust-crates-using-nix-instead-of-cargo}
 
 ### Simple operation {#simple-operation}

lib/licenses.nix

@@ -392,6 +392,12 @@ in mkLicense lset) ({
     fullName = "Common Public Attribution License 1.0";
   };
 
+  commons-clause = {
+    fullName = "Commons Clause License";
+    url = "https://commonsclause.com/";
+    free = false;
+  };
+
   cpl10 = {
     spdxId = "CPL-1.0";
     fullName = "Common Public License 1.0";

lib/systems/default.nix

@@ -1,7 +1,25 @@
 { lib }:
-  let inherit (lib.attrsets) mapAttrs; in
 
-rec {
+let
+  inherit (lib)
+    any
+    filterAttrs
+    foldl
+    hasInfix
+    isFunction
+    isList
+    isString
+    mapAttrs
+    optional
+    optionalAttrs
+    optionalString
+    removeSuffix
+    replaceStrings
+    toUpper
+    ;
+
+  inherit (lib.strings) toJSON;
+
   doubles = import ./doubles.nix { inherit lib; };
   parse = import ./parse.nix { inherit lib; };
   inspect = import ./inspect.nix { inherit lib; };
@@ -24,7 +42,7 @@ rec {
     both arguments have been `elaborate`-d.
   */
   equals =
-    let removeFunctions = a: lib.filterAttrs (_: v: !builtins.isFunction v) a;
+    let removeFunctions = a: filterAttrs (_: v: !isFunction v) a;
     in a: b: removeFunctions a == removeFunctions b;
 
   /* List of all Nix system doubles the nixpkgs flake will expose the package set
@@ -41,7 +59,7 @@ rec {
   # clearly preferred, and to prevent cycles. A simpler fixed point where the RHS
   # always just used `final.*` would fail on both counts.
   elaborate = args': let
-    args = if lib.isString args' then { system = args'; }
+    args = if isString args' then { system = args'; }
            else args';
 
     # TODO: deprecate args.rustc in favour of args.rust after 23.05 is EOL.
@@ -96,7 +114,7 @@ rec {
         then "lib64"
         else "lib"
       else null;
-      extensions = lib.optionalAttrs final.hasSharedLibraries {
+      extensions = optionalAttrs final.hasSharedLibraries {
         sharedLibrary =
           if      final.isDarwin  then ".dylib"
           else if final.isWindows then ".dll"
@@ -134,9 +152,9 @@ rec {
          # uname -m
          processor =
            if final.isPower64
-           then "ppc64${lib.optionalString final.isLittleEndian "le"}"
+           then "ppc64${optionalString final.isLittleEndian "le"}"
            else if final.isPower
-           then "ppc${lib.optionalString final.isLittleEndian "le"}"
+           then "ppc${optionalString final.isLittleEndian "le"}"
            else if final.isMips64
            then "mips64"  # endianness is *not* included on mips64
            else final.parsed.cpu.name;
@@ -202,8 +220,8 @@ rec {
         else if final.isS390 && !final.isS390x then null
         else if final.isx86_64 then "x86_64"
         else if final.isx86 then "i386"
-        else if final.isMips64n32 then "mipsn32${lib.optionalString final.isLittleEndian "el"}"
-        else if final.isMips64 then "mips64${lib.optionalString final.isLittleEndian "el"}"
+        else if final.isMips64n32 then "mipsn32${optionalString final.isLittleEndian "el"}"
+        else if final.isMips64 then "mips64${optionalString final.isLittleEndian "el"}"
         else final.uname.processor;
 
       # Name used by UEFI for architectures.
@@ -259,7 +277,7 @@ rec {
           if pkgs.stdenv.hostPlatform.canExecute final
           then "${pkgs.runtimeShell} -c '\"$@\"' --"
           else if final.isWindows
-          then "${wine}/bin/wine${lib.optionalString (final.parsed.cpu.bits == 64) "64"}"
+          then "${wine}/bin/wine${optionalString (final.parsed.cpu.bits == 64) "64"}"
           else if final.isLinux && pkgs.stdenv.hostPlatform.isLinux && final.qemuArch != null
           then "${qemu-user}/bin/qemu-${final.qemuArch}"
           else if final.isWasi
@@ -310,10 +328,10 @@ rec {
                   let
                     f = args.rustc.platform.target-family;
                   in
-                    if builtins.isList f then f else [ f ]
+                    if isList f then f else [ f ]
                 )
-              else lib.optional final.isUnix "unix"
-                   ++ lib.optional final.isWindows "windows";
+              else optional final.isUnix "unix"
+                   ++ optional final.isWindows "windows";
 
             # https://doc.rust-lang.org/reference/conditional-compilation.html#target_vendor
             vendor = let
@@ -337,13 +355,13 @@ rec {
             vendor_ = final.rust.platform.vendor;
           # TODO: deprecate args.rustc in favour of args.rust after 23.05 is EOL.
           in args.rust.rustcTarget or args.rustc.config
-            or "${cpu_}-${vendor_}-${kernel.name}${lib.optionalString (abi.name != "unknown") "-${abi.name}"}";
+            or "${cpu_}-${vendor_}-${kernel.name}${optionalString (abi.name != "unknown") "-${abi.name}"}";
 
           # The name of the rust target if it is standard, or the json file
           # containing the custom target spec.
           rustcTargetSpec = rust.rustcTargetSpec or (
             /**/ if rust ? platform
-            then builtins.toFile (final.rust.rustcTarget + ".json") (builtins.toJSON rust.platform)
+            then builtins.toFile (final.rust.rustcTarget + ".json") (toJSON rust.platform)
             else final.rust.rustcTarget);
 
           # The name of the rust target if it is standard, or the
@@ -352,7 +370,7 @@ rec {
           #
           # This is the name used by Cargo for target subdirectories.
           cargoShortTarget =
-            lib.removeSuffix ".json" (baseNameOf "${final.rust.rustcTargetSpec}");
+            removeSuffix ".json" (baseNameOf "${final.rust.rustcTargetSpec}");
 
           # When used as part of an environment variable name, triples are
           # uppercased and have all hyphens replaced by underscores:
@@ -360,17 +378,17 @@ rec {
           # https://github.com/rust-lang/cargo/pull/9169
           # https://github.com/rust-lang/cargo/issues/8285#issuecomment-634202431
           cargoEnvVarTarget =
-            lib.strings.replaceStrings ["-"] ["_"]
-              (lib.strings.toUpper final.rust.cargoShortTarget);
+            replaceStrings ["-"] ["_"]
+              (toUpper final.rust.cargoShortTarget);
 
           # True if the target is no_std
           # https://github.com/rust-lang/rust/blob/2e44c17c12cec45b6a682b1e53a04ac5b5fcc9d2/src/bootstrap/config.rs#L415-L421
           isNoStdTarget =
-            builtins.any (t: lib.hasInfix t final.rust.rustcTarget) ["-none" "nvptx" "switch" "-uefi"];
+            any (t: hasInfix t final.rust.rustcTarget) ["-none" "nvptx" "switch" "-uefi"];
         };
       };
   in assert final.useAndroidPrebuilt -> final.isAndroid;
-     assert lib.foldl
+     assert foldl
        (pass: { assertion, message }:
          if assertion final
          then pass
@@ -378,4 +396,20 @@ rec {
        true
        (final.parsed.abi.assertions or []);
     final;
+
+in
+
+# Everything in this attrset is the public interface of the file.
+{
+  inherit
+    architectures
+    doubles
+    elaborate
+    equals
+    examples
+    flakeExposed
+    inspect
+    parse
+    platforms
+    ;
 }

lib/systems/inspect.nix

@@ -1,10 +1,31 @@
 { lib }:
-with import ./parse.nix { inherit lib; };
-with lib.attrsets;
-with lib.lists;
 
-let abis_ = abis; in
-let abis = lib.mapAttrs (_: abi: builtins.removeAttrs abi [ "assertions" ]) abis_; in
+let
+  inherit (lib)
+    any
+    attrValues
+    concatMap
+    filter
+    hasPrefix
+    isList
+    mapAttrs
+    matchAttrs
+    recursiveUpdateUntil
+    toList
+    ;
+
+  inherit (lib.strings) toJSON;
+
+  inherit (lib.systems.parse)
+    kernels
+    kernelFamilies
+    significantBytes
+    cpuTypes
+    execFormats
+    ;
+
+  abis = mapAttrs (_: abi: removeAttrs abi [ "assertions" ]) lib.systems.parse.abis;
+in
 
 rec {
   # these patterns are to be matched against {host,build,target}Platform.parsed
@@ -32,8 +53,8 @@ rec {
     isx86          = { cpu = { family = "x86"; }; };
     isAarch32      = { cpu = { family = "arm"; bits = 32; }; };
     isArmv7        = map ({ arch, ... }: { cpu = { inherit arch; }; })
-                       (lib.filter (cpu: lib.hasPrefix "armv7" cpu.arch or "")
-                         (lib.attrValues cpuTypes));
+                       (filter (cpu: hasPrefix "armv7" cpu.arch or "")
+                         (attrValues cpuTypes));
     isAarch64      = { cpu = { family = "arm"; bits = 64; }; };
     isAarch        = { cpu = { family = "arm"; }; };
     isMicroBlaze   = { cpu = { family = "microblaze"; }; };
@@ -111,19 +132,19 @@ rec {
     let
       # patterns can be either a list or a (bare) singleton; turn
       # them into singletons for uniform handling
-      pat1 = lib.toList pat1_;
-      pat2 = lib.toList pat2_;
+      pat1 = toList pat1_;
+      pat2 = toList pat2_;
     in
-      lib.concatMap (attr1:
+      concatMap (attr1:
         map (attr2:
-          lib.recursiveUpdateUntil
+          recursiveUpdateUntil
             (path: subattr1: subattr2:
               if (builtins.intersectAttrs subattr1 subattr2) == {} || subattr1 == subattr2
               then true
               else throw ''
                 pattern conflict at path ${toString path}:
-                  ${builtins.toJSON subattr1}
-                  ${builtins.toJSON subattr2}
+                  ${toJSON subattr1}
+                  ${toJSON subattr2}
                 '')
             attr1
             attr2
@@ -132,7 +153,7 @@ rec {
         pat1;
 
   matchAnyAttrs = patterns:
-    if builtins.isList patterns then attrs: any (pattern: matchAttrs pattern attrs) patterns
+    if isList patterns then attrs: any (pattern: matchAttrs pattern attrs) patterns
     else matchAttrs patterns;
 
   predicates = mapAttrs (_: matchAnyAttrs) patterns;

lib/systems/parse.nix

@@ -15,14 +15,45 @@
 # systems that overlap with existing ones and won't notice something amiss.
 #
 { lib }:
-with lib.lists;
-with lib.types;
-with lib.attrsets;
-with lib.strings;
-with (import ./inspect.nix { inherit lib; }).predicates;
 
 let
-  inherit (lib.options) mergeOneOption;
+  inherit (lib)
+    all
+    any
+    attrValues
+    elem
+    elemAt
+    hasPrefix
+    id
+    length
+    mapAttrs
+    mergeOneOption
+    optionalString
+    splitString
+    versionAtLeast
+    ;
+
+  inherit (lib.strings) match;
+
+  inherit (lib.systems.inspect.predicates)
+    isAarch32
+    isBigEndian
+    isDarwin
+    isLinux
+    isPower64
+    isWindows
+    ;
+
+  inherit (lib.types)
+    enum
+    float
+    isType
+    mkOptionType
+    number
+    setType
+    string
+    types
+    ;
 
   setTypes = type:
     mapAttrs (name: value:
@@ -33,10 +64,10 @@ let
   # regex `e?abi.*$` when determining the validity of a triple.  In
   # other words, `i386-linuxabichickenlips` is a valid triple.
   removeAbiSuffix = x:
-    let match = builtins.match "(.*)e?abi.*" x;
-    in if match==null
+    let found = match "(.*)e?abi.*" x;
+    in if found == null
        then x
-       else lib.elemAt match 0;
+       else elemAt found 0;
 
 in
 
@@ -76,7 +107,7 @@ rec {
 
   types.cpuType = enum (attrValues cpuTypes);
 
-  cpuTypes = with significantBytes; setTypes types.openCpuType {
+  cpuTypes = let inherit (significantBytes) bigEndian littleEndian; in setTypes types.openCpuType {
     arm      = { bits = 32; significantByte = littleEndian; family = "arm"; };
     armv5tel = { bits = 32; significantByte = littleEndian; family = "arm"; version = "5"; arch = "armv5t"; };
     armv6m   = { bits = 32; significantByte = littleEndian; family = "arm"; version = "6"; arch = "armv6-m"; };
@@ -166,7 +197,7 @@ rec {
   # Note: Since 22.11 the archs of a mode switching CPU are no longer considered
   # pairwise compatible. Mode switching implies that binaries built for A
   # and B respectively can't be executed at the same time.
-  isCompatible = a: b: with cpuTypes; lib.any lib.id [
+  isCompatible = with cpuTypes; a: b: any id [
     # x86
     (b == i386 && isCompatible a i486)
     (b == i486 && isCompatible a i586)
@@ -287,7 +318,10 @@ rec {
 
   types.kernel = enum (attrValues kernels);
 
-  kernels = with execFormats; with kernelFamilies; setTypes types.openKernel {
+  kernels = let
+    inherit (execFormats) elf pe wasm unknown macho;
+    inherit (kernelFamilies) bsd darwin;
+  in setTypes types.openKernel {
     # TODO(@Ericson2314): Don't want to mass-rebuild yet to keeping 'darwin' as
     # the normalized name for macOS.
     macos    = { execFormat = macho;   families = { inherit darwin; }; name = "darwin"; };
@@ -359,7 +393,7 @@ rec {
             The "gnu" ABI is ambiguous on 32-bit ARM. Use "gnueabi" or "gnueabihf" instead.
           '';
         }
-        { assertion = platform: with platform; !(isPower64 && isBigEndian);
+        { assertion = platform: !(platform.isPower64 && platform.isBigEndian);
           message = ''
             The "gnu" ABI is ambiguous on big-endian 64-bit PowerPC. Use "gnuabielfv2" or "gnuabielfv1" instead.
           '';
@@ -480,7 +514,7 @@ rec {
         /**/ if args ? abi       then getAbi args.abi
         else if isLinux parsed || isWindows parsed then
           if isAarch32 parsed then
-            if lib.versionAtLeast (parsed.cpu.version or "0") "6"
+            if versionAtLeast (parsed.cpu.version or "0") "6"
             then abis.gnueabihf
             else abis.gnueabi
           # Default ppc64 BE to ELFv2
@@ -491,7 +525,7 @@ rec {
 
   in mkSystem parsed;
 
-  mkSystemFromString = s: mkSystemFromSkeleton (mkSkeletonFromList (lib.splitString "-" s));
+  mkSystemFromString = s: mkSystemFromSkeleton (mkSkeletonFromList (splitString "-" s));
 
   kernelName = kernel:
     kernel.name + toString (kernel.version or "");
@@ -503,10 +537,10 @@ rec {
 
   tripleFromSystem = { cpu, vendor, kernel, abi, ... } @ sys: assert isSystem sys; let
     optExecFormat =
-      lib.optionalString (kernel.name == "netbsd" &&
+      optionalString (kernel.name == "netbsd" &&
                           gnuNetBSDDefaultExecFormat cpu != kernel.execFormat)
         kernel.execFormat.name;
-    optAbi = lib.optionalString (abi != abis.unknown) "-${abi.name}";
+    optAbi = optionalString (abi != abis.unknown) "-${abi.name}";
   in "${cpu.name}-${vendor.name}-${kernelName kernel}${optExecFormat}${optAbi}";
 
   ################################################################################

maintainers/maintainer-list.nix

@@ -2958,6 +2958,12 @@
     github = "bycEEE";
     githubId = 8891115;
     name = "Brian Choy";
+  };
+   ByteSudoer = {
+    email = "bytesudoer@gmail.com";
+    github = "bytesudoer";
+    githubId = 88513682;
+    name = "ByteSudoer";
   };
   bzizou = {
     email = "Bruno@bzizou.net";
@@ -8642,6 +8648,12 @@
     github = "j0xaf";
     githubId = 932697;
   };
+  j1nxie = {
+    email = "rylie@rylie.moe";
+    name = "Nguyen Pham Quoc An";
+    github = "j1nxie";
+    githubId = 52886388;
+  };
   j4m3s = {
     name = "James Landrein";
     email = "github@j4m3s.eu";
@@ -12550,6 +12562,15 @@
     githubId = 15093162;
     name = "Melanie B. Sigl";
   };
+  melvyn2 = {
+    email = "melvyn2@dnsense.pub";
+    github = "melvyn2";
+    githubId = 9157412;
+    name = "melvyn";
+    keys = [{
+      fingerprint = "232B 9F00 2153 CA86 849C  9224 25A2 B728 0CE3 AFF6";
+    }];
+  };
   mephistophiles = {
     email = "mussitantesmortem@gmail.com";
     name = "Maxim Zhukov";
@@ -16535,6 +16556,11 @@
     githubId = 61013287;
     name = "Ricardo Steijn";
   };
+  richar = {
+    github = "ri-char";
+    githubId = 17962023;
+    name = "richar";
+  };
   richardipsum = {
     email = "richardipsum@fastmail.co.uk";
     github = "richardipsum";
@@ -18782,6 +18808,16 @@
     githubId = 39732259;
     name = "Justus K";
   };
+  stv0g = {
+    name = "Steffen Vogel";
+    email = "post@steffenvogel.de";
+    matrix = "@stv0ge:matrix.org";
+    github = "stv0g";
+    githubId = 285829;
+    keys = [{
+      fingerprint = "09BE 3BAE 8D55 D4CD 8579  285A 9675 EAC3 4897 E6E2";
+    }];
+  };
   SubhrajyotiSen = {
     email = "subhrajyoti12@gmail.com";
     github = "SubhrajyotiSen";

nixos/doc/manual/release-notes/rl-2405.section.md

@@ -330,6 +330,9 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
   - The `erlang_node_short_name`, `erlang_node_name`, `port` and `options` configuration parameters are gone, and have been replaced with an `environment` parameter.
     Use the appropriate [environment variables](https://hexdocs.pm/livebook/readme.html#environment-variables) inside `environment` to configure the service instead.
 
+- The `crystal` package has been updated to 1.11.x, which has some breaking changes.
+  Refer to crystal's changelog for more information. ([v1.10](https://github.com/crystal-lang/crystal/blob/master/CHANGELOG.md#1100-2023-10-09), [v1.11](https://github.com/crystal-lang/crystal/blob/master/CHANGELOG.md#1110-2024-01-08))
+
 ## Other Notable Changes {#sec-release-24.05-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -450,6 +453,12 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - The module `services.github-runner` has been removed. To configure a single GitHub Actions Runner refer to `services.github-runners.*`. Note that this will trigger a new runner registration.
 
+- The `services.slskd` has been refactored to include more configuation options in
+  the freeform `services.slskd.settings` option, and some defaults (including listen ports)
+  have been changed to match the upstream defaults. Additionally, disk logging is now
+  disabled by default, and the log rotation timer has been removed.
+  The nginx virtualhost option is now of the `vhost-options` type.
+
 - The `btrbk` module now automatically selects and provides required compression
   program depending on the configured `stream_compress` option. Since this
   replaces the need for the `extraPackages` option, this option will be

nixos/modules/profiles/macos-builder.nix

@@ -145,6 +145,8 @@ in
         # This installCredentials script is written so that it's as easy as
         # possible for a user to audit before confirming the `sudo`
         installCredentials = hostPkgs.writeShellScript "install-credentials" ''
+          set -euo pipefail
+
           KEYS="''${1}"
           INSTALL=${hostPkgs.coreutils}/bin/install
           "''${INSTALL}" -g nixbld -m 600 "''${KEYS}/${user}_${keyType}" ${privateKey}
@@ -154,6 +156,9 @@ in
         hostPkgs = config.virtualisation.host.pkgs;
 
         script = hostPkgs.writeShellScriptBin "create-builder" (
+          ''
+            set -euo pipefail
+          '' +
           # When running as non-interactively as part of a DarwinConfiguration the working directory
           # must be set to a writeable directory.
         (if cfg.workingDirectory != "." then ''

nixos/modules/services/desktops/flatpak.nix

@@ -32,6 +32,8 @@ in {
 
     security.polkit.enable = true;
 
+    fonts.fontDir.enable = true;
+
     services.dbus.packages = [ pkgs.flatpak ];
 
     systemd.packages = [ pkgs.flatpak ];

nixos/modules/services/web-apps/slskd.nix

@@ -2,122 +2,250 @@
 
 let
   settingsFormat = pkgs.formats.yaml {};
+  defaultUser = "slskd";
 in {
   options.services.slskd = with lib; with types; {
     enable = mkEnableOption "enable slskd";
 
-    rotateLogs = mkEnableOption "enable an unit and timer that will rotate logs in /var/slskd/logs";
+    package = mkPackageOptionMD pkgs "slskd" { };
 
-    package = mkPackageOption pkgs "slskd" { };
+    user = mkOption {
+      type = types.str;
+      default = defaultUser;
+      description = "User account under which slskd runs.";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = defaultUser;
+      description = "Group under which slskd runs.";
+    };
+
+    domain = mkOption {
+      type = types.nullOr types.str;
+      description = ''
+        If non-null, enables an nginx reverse proxy virtual host at this FQDN,
+        at the path configurated with `services.slskd.web.url_base`.
+      '';
+      example = "slskd.example.com";
+    };
 
     nginx = mkOption {
-      description = lib.mdDoc "options for nginx";
-      example = {
-        enable = true;
-        domain = "example.com";
-        contextPath = "/slskd";
-      };
-      type = submodule ({name, config, ...}: {
-        options = {
-          enable = mkEnableOption "enable nginx as a reverse proxy";
-
-          domainName = mkOption {
-            type = str;
-            description = "Domain you want to use";
-          };
-          contextPath = mkOption {
-            type = types.path;
-            default = "/";
-            description = lib.mdDoc ''
-              The context path, i.e., the last part of the slskd
-              URL. Typically '/' or '/slskd'. Default '/'
-            '';
-          };
-        };
-      });
+      type = types.submodule (import ../web-servers/nginx/vhost-options.nix { inherit config lib; });
+      default = {};
+      example = lib.literalExpression ''
+        {
+          enableACME = true;
+          forceHttps = true;
+        }
+      '';
+      description = ''
+        This option customizes the nginx virtual host set up for slskd.
+      '';
     };
 
     environmentFile = mkOption {
       type = path;
       description = ''
-        Path to a file containing secrets.
-        It must at least contain the variable `SLSKD_SLSK_PASSWORD`
+        Path to the environment file sourced on startup.
+        It must at least contain the variables `SLSKD_SLSK_USERNAME` and `SLSKD_SLSK_PASSWORD`.
+        Web interface credentials should also be set here in `SLSKD_USERNAME` and `SLSKD_PASSWORD`.
+        Other, optional credentials like SOCKS5 with `SLSKD_SLSK_PROXY_USERNAME` and `SLSKD_SLSK_PROXY_PASSWORD`
+        should all reside here instead of in the world-readable nix store.
+        Variables are documented at https://github.com/slskd/slskd/blob/master/docs/config.md
       '';
     };
 
     openFirewall = mkOption {
       type = bool;
-      description = ''
-        Whether to open the firewall for services.slskd.settings.listen_port";
-      '';
+      description = "Whether to open the firewall for the soulseek network listen port (not the web interface port).";
       default = false;
     };
 
     settings = mkOption {
-      description = lib.mdDoc ''
-        Configuration for slskd, see
-        [available options](https://github.com/slskd/slskd/blob/master/docs/config.md)
-        `APP_DIR` is set to /var/lib/slskd, where default download & incomplete directories,
-        log and databases will be created.
+      description = ''
+        Application configuration for slskd. See
+        [documentation](https://github.com/slskd/slskd/blob/master/docs/config.md).
       '';
       default = {};
       type = submodule {
         freeformType = settingsFormat.type;
         options = {
+          remote_file_management = mkEnableOption "modification of share contents through the web ui";
 
-          soulseek = {
-            username = mkOption {
-              type = str;
-              description = "Username on the Soulseek Network";
+          flags = {
+            force_share_scan = mkOption {
+              type = bool;
+              description = "Force a rescan of shares on every startup.";
             };
-            listen_port = mkOption {
-              type = port;
-              description = "Port to use for communication on the Soulseek Network";
-              default = 50000;
-            };
-          };
-
-          web = {
-            port = mkOption {
-              type = port;
-              default = 5001;
-              description = "The HTTP listen port";
-            };
-            url_base = mkOption {
-              type = path;
-              default = config.services.slskd.nginx.contextPath;
-              defaultText = "config.services.slskd.nginx.contextPath";
-              description = lib.mdDoc ''
-                The context path, i.e., the last part of the slskd URL
-              '';
-            };
-          };
-
-          shares = {
-            directories = mkOption {
-              type = listOf str;
-              description = lib.mdDoc ''
-                Paths to your shared directories. See
-                [documentation](https://github.com/slskd/slskd/blob/master/docs/config.md#directories)
-                for advanced usage
-              '';
+            no_version_check = mkOption {
+              type = bool;
+              default = true;
+              visible = false;
+              description = "Don't perform a version check on startup.";
             };
           };
 
           directories = {
             incomplete = mkOption {
               type = nullOr path;
-              description = "Directory where downloading files are stored";
-              defaultText = "<APP_DIR>/incomplete";
+              description = "Directory where incomplete downloading files are stored.";
+              defaultText = "/var/lib/slskd/incomplete";
               default = null;
             };
             downloads = mkOption {
               type = nullOr path;
-              description = "Directory where downloaded files are stored";
-              defaultText = "<APP_DIR>/downloads";
+              description = "Directory where downloaded files are stored.";
+              defaultText = "/var/lib/slskd/downloads";
               default = null;
             };
           };
+
+          shares = {
+            directories = mkOption {
+              type = listOf str;
+              description = ''
+                Paths to shared directories. See
+                [documentation](https://github.com/slskd/slskd/blob/master/docs/config.md#directories)
+                for advanced usage.
+              '';
+              example = lib.literalExpression ''[ "/home/John/Music" "!/home/John/Music/Recordings" "[Music Drive]/mnt" ]'';
+            };
+            filters = mkOption {
+              type = listOf str;
+              example = lib.literalExpression ''[ "\.ini$" "Thumbs.db$" "\.DS_Store$" ]'';
+              description = "Regular expressions of files to exclude from sharing.";
+            };
+          };
+
+          rooms = mkOption {
+            type = listOf str;
+            description = "Chat rooms to join on startup.";
+          };
+
+          soulseek = {
+            description = mkOption {
+              type = str;
+              description = "The user description for the Soulseek network.";
+              defaultText = "A slskd user. https://github.com/slskd/slskd";
+            };
+            listen_port = mkOption {
+              type = port;
+              description = "The port on which to listen for incoming connections.";
+              default = 50300;
+            };
+          };
+
+          global = {
+            # TODO speed units
+            upload = {
+              slots = mkOption {
+                type = ints.unsigned;
+                description = "Limit of the number of concurrent upload slots.";
+              };
+              speed_limit = mkOption {
+                type = ints.unsigned;
+                description = "Total upload speed limit.";
+              };
+            };
+            download = {
+              slots = mkOption {
+                type = ints.unsigned;
+                description = "Limit of the number of concurrent download slots.";
+              };
+              speed_limit = mkOption {
+                type = ints.unsigned;
+                description = "Total upload download limit";
+              };
+            };
+          };
+
+          filters.search.request = mkOption {
+            type = listOf str;
+            example = lib.literalExpression ''[ "^.{1,2}$" ]'';
+            description = "Incoming search requests which match this filter are ignored.";
+          };
+
+          web = {
+            port = mkOption {
+              type = port;
+              default = 5030;
+              description = "The HTTP listen port.";
+            };
+            url_base = mkOption {
+              type = path;
+              default = "/";
+              description = "The base path in the url for web requests.";
+            };
+            # Users should use a reverse proxy instead for https
+            https.disabled = mkOption {
+              type = bool;
+              default = true;
+              description = "Disable the built-in HTTPS server";
+            };
+          };
+
+          retention = {
+            transfers = {
+              upload = {
+                succeeded = mkOption {
+                  type = ints.unsigned;
+                  description = "Lifespan of succeeded upload tasks.";
+                  defaultText = "(indefinite)";
+                };
+                errored = mkOption {
+                  type = ints.unsigned;
+                  description = "Lifespan of errored upload tasks.";
+                  defaultText = "(indefinite)";
+                };
+                cancelled = mkOption {
+                  type = ints.unsigned;
+                  description = "Lifespan of cancelled upload tasks.";
+                  defaultText = "(indefinite)";
+                };
+              };
+              download = {
+                succeeded = mkOption {
+                  type = ints.unsigned;
+                  description = "Lifespan of succeeded download tasks.";
+                  defaultText = "(indefinite)";
+                };
+                errored = mkOption {
+                  type = ints.unsigned;
+                  description = "Lifespan of errored download tasks.";
+                  defaultText = "(indefinite)";
+                };
+                cancelled = mkOption {
+                  type = ints.unsigned;
+                  description = "Lifespan of cancelled download tasks.";
+                  defaultText = "(indefinite)";
+                };
+              };
+            };
+            files = {
+              complete = mkOption {
+                type = ints.unsigned;
+                description = "Lifespan of completely downloaded files in minutes.";
+                example = 20160;
+                defaultText = "(indefinite)";
+              };
+              incomplete = mkOption {
+                type = ints.unsigned;
+                description = "Lifespan of incomplete downloading files in minutes.";
+                defaultText = "(indefinite)";
+              };
+            };
+          };
+
+          logger = {
+            # Disable by default, journald already retains as needed
+            disk = mkOption {
+              type = bool;
+              description = "Whether to log to the application directory.";
+              default = false;
+              visible = false;
+            };
+          };
         };
       };
     };
@@ -126,38 +254,25 @@ in {
   config = let
     cfg = config.services.slskd;
 
-    confWithoutNullValues = (lib.filterAttrs (key: value: value != null) cfg.settings);
+    confWithoutNullValues = (lib.filterAttrsRecursive (key: value: (builtins.tryEval value).success && value != null) cfg.settings);
 
     configurationYaml = settingsFormat.generate "slskd.yml" confWithoutNullValues;
 
   in lib.mkIf cfg.enable {
 
-    users = {
-      users.slskd = {
+    # Force off, configuration file is in nix store and is immutable
+    services.slskd.settings.remote_configuration = lib.mkForce false;
+
+    users.users = lib.optionalAttrs (cfg.user == defaultUser) {
+      "${defaultUser}" = {
+        group = cfg.group;
         isSystemUser = true;
-        group = "slskd";
-      };
-      groups.slskd = {};
-    };
-
-    # Reverse proxy configuration
-    services.nginx.enable = true;
-    services.nginx.virtualHosts."${cfg.nginx.domainName}" = {
-      forceSSL = true;
-      enableACME = true;
-      locations = {
-        "${cfg.nginx.contextPath}" = {
-          proxyPass = "http://localhost:${toString cfg.settings.web.port}";
-          proxyWebsockets = true;
-        };
       };
     };
 
-    # Hide state & logs
-    systemd.tmpfiles.rules = [
-      "d /var/lib/slskd/data 0750 slskd slskd - -"
-      "d /var/lib/slskd/logs 0750 slskd slskd - -"
-    ];
+    users.groups = lib.optionalAttrs (cfg.group == defaultUser) {
+      "${defaultUser}" = {};
+    };
 
     systemd.services.slskd = {
       description = "A modern client-server application for the Soulseek file sharing network";
@@ -165,12 +280,16 @@ in {
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         Type = "simple";
-        User = "slskd";
+        User = cfg.user;
+        Group = cfg.group;
         EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
-        StateDirectory = "slskd";
+        StateDirectory = "slskd";  # Creates /var/lib/slskd and manages permissions
         ExecStart = "${cfg.package}/bin/slskd --app-dir /var/lib/slskd --config ${configurationYaml}";
         Restart = "on-failure";
         ReadOnlyPaths = map (d: builtins.elemAt (builtins.split "[^/]*(/.+)" d) 1) cfg.settings.shares.directories;
+        ReadWritePaths =
+          (lib.optional (cfg.settings.directories.incomplete != null) cfg.settings.directories.incomplete) ++
+          (lib.optional (cfg.settings.directories.downloads != null) cfg.settings.directories.downloads);
         LockPersonality = true;
         NoNewPrivileges = true;
         PrivateDevices = true;
@@ -194,18 +313,21 @@ in {
 
     networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.settings.soulseek.listen_port;
 
-    systemd.services.slskd-rotatelogs = lib.mkIf cfg.rotateLogs {
-      description = "Rotate slskd logs";
-      serviceConfig = {
-        Type = "oneshot";
-        User = "slskd";
-        ExecStart = [
-          "${pkgs.findutils}/bin/find /var/lib/slskd/logs/ -type f -mtime +10 -delete"
-          "${pkgs.findutils}/bin/find /var/lib/slskd/logs/ -type f -mtime +1  -exec ${pkgs.gzip}/bin/gzip -q {} ';'"
-        ];
-      };
-      startAt = "daily";
+    services.nginx = lib.mkIf (cfg.domain != null) {
+      enable = lib.mkDefault true;
+      virtualHosts."${cfg.domain}" = lib.mkMerge [
+        cfg.nginx
+        {
+          locations."${cfg.settings.web.url_base}" = {
+            proxyPass = "http://127.0.0.1:${toString cfg.settings.web.port}";
+            proxyWebsockets = true;
+          };
+        }
+      ];
     };
+  };
 
+  meta = {
+    maintainers = with lib.maintainers; [ ppom melvyn2 ];
   };
 }

nixos/modules/tasks/filesystems/envfs.nix

@@ -7,6 +7,7 @@ let
       device = "none";
       fsType = "envfs";
       options = [
+        "bind-mount=/bin"
         "fallback-path=${pkgs.runCommand "fallback-path" {} (''
           mkdir -p $out
           ln -s ${config.environment.usrbinenv} $out/env
@@ -15,6 +16,9 @@ let
         "nofail"
       ];
     };
+    # We need to bind-mount /bin to /usr/bin, because otherwise upgrading
+    # from envfs < 1.0.5 will cause having the old envs with no /bin bind mount.
+    # Systemd is smart enough to not mount /bin if it's already mounted.
     "/bin" = {
       device = "/usr/bin";
       fsType = "none";

nixos/modules/virtualisation/incus.nix

@@ -1,8 +1,80 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.virtualisation.incus;
   preseedFormat = pkgs.formats.yaml { };
+
+  serverBinPath = ''${pkgs.qemu_kvm}/libexec:${
+    lib.makeBinPath (
+      with pkgs;
+      [
+        cfg.package
+
+        acl
+        attr
+        bash
+        btrfs-progs
+        cdrkit
+        coreutils
+        criu
+        dnsmasq
+        e2fsprogs
+        findutils
+        getent
+        gnugrep
+        gnused
+        gnutar
+        gptfdisk
+        gzip
+        iproute2
+        iptables
+        kmod
+        lvm2
+        minio
+        nftables
+        qemu_kvm
+        qemu-utils
+        rsync
+        squashfsTools
+        systemd
+        thin-provisioning-tools
+        util-linux
+        virtiofsd
+        xz
+
+        (writeShellScriptBin "apparmor_parser" ''
+          exec '${apparmor-parser}/bin/apparmor_parser' -I '${apparmor-profiles}/etc/apparmor.d' "$@"
+        '')
+      ]
+      ++ lib.optionals config.boot.zfs.enabled [
+        config.boot.zfs.package
+        "${config.boot.zfs.package}/lib/udev"
+      ]
+      ++ lib.optionals config.virtualisation.vswitch.enable [ config.virtualisation.vswitch.package ]
+    )
+  }'';
+
+  # https://github.com/lxc/incus/blob/cff35a29ee3d7a2af1f937cbb6cf23776941854b/internal/server/instance/drivers/driver_qemu.go#L123
+  ovmf-prefix = if pkgs.stdenv.hostPlatform.isAarch64 then "AAVMF" else "OVMF";
+  ovmf = pkgs.linkFarm "incus-ovmf" [
+    {
+      name = "OVMF_CODE.4MB.fd";
+      path = "${pkgs.OVMFFull.fd}/FV/${ovmf-prefix}_CODE.fd";
+    }
+    {
+      name = "OVMF_VARS.4MB.fd";
+      path = "${pkgs.OVMFFull.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+    {
+      name = "OVMF_VARS.4MB.ms.fd";
+      path = "${pkgs.OVMFFull.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+  ];
 in
 {
   meta = {
@@ -11,26 +83,29 @@ in
 
   options = {
     virtualisation.incus = {
-      enable = lib.mkEnableOption (lib.mdDoc ''
+      enable = lib.mkEnableOption ''
         incusd, a daemon that manages containers and virtual machines.
 
         Users in the "incus-admin" group can interact with
         the daemon (e.g. to start or stop containers) using the
         {command}`incus` command line tool, among others.
-      '');
+      '';
 
       package = lib.mkPackageOption pkgs "incus" { };
 
       lxcPackage = lib.mkPackageOption pkgs "lxc" { };
 
+      clientPackage = lib.mkPackageOption pkgs [
+        "incus"
+        "client"
+      ] { };
+
       preseed = lib.mkOption {
-        type = lib.types.nullOr (
-          lib.types.submodule { freeformType = preseedFormat.type; }
-        );
+        type = lib.types.nullOr (lib.types.submodule { freeformType = preseedFormat.type; });
 
         default = null;
 
-        description = lib.mdDoc ''
+        description = ''
           Configuration for Incus preseed, see
           <https://linuxcontainers.org/incus/docs/main/howto/initialize/#non-interactive-configuration>
           for supported values.
@@ -80,18 +155,16 @@ in
         };
       };
 
-      socketActivation = lib.mkEnableOption (
-        lib.mdDoc ''
-          socket-activation for starting incus.service. Enabling this option
-          will stop incus.service from starting automatically on boot.
-        ''
-      );
+      socketActivation = lib.mkEnableOption (''
+        socket-activation for starting incus.service. Enabling this option
+        will stop incus.service from starting automatically on boot.
+      '');
 
       startTimeout = lib.mkOption {
         type = lib.types.ints.unsigned;
         default = 600;
         apply = toString;
-        description = lib.mdDoc ''
+        description = ''
           Time to wait (in seconds) for incusd to become ready to process requests.
           If incusd does not reply within the configured time, `incus.service` will be
           considered failed and systemd will attempt to restart it.
@@ -99,9 +172,12 @@ in
       };
 
       ui = {
-        enable = lib.mkEnableOption (lib.mdDoc "(experimental) Incus UI");
+        enable = lib.mkEnableOption "(experimental) Incus UI";
 
-        package = lib.mkPackageOption pkgs [ "incus" "ui" ] { };
+        package = lib.mkPackageOption pkgs [
+          "incus"
+          "ui"
+        ] { };
       };
     };
   };
@@ -109,7 +185,12 @@ in
   config = lib.mkIf cfg.enable {
     assertions = [
       {
-        assertion = !(config.networking.firewall.enable && !config.networking.nftables.enable && config.virtualisation.incus.enable);
+        assertion =
+          !(
+            config.networking.firewall.enable
+            && !config.networking.nftables.enable
+            && config.virtualisation.incus.enable
+          );
         message = "Incus on NixOS is unsupported using iptables. Set `networking.nftables.enable = true;`";
       }
     ];
@@ -137,7 +218,12 @@ in
       "vhost_vsock"
     ] ++ lib.optionals (!config.networking.nftables.enable) [ "iptable_mangle" ];
 
-    environment.systemPackages = [ cfg.package ];
+    environment.systemPackages = [
+      cfg.clientPackage
+
+      # gui console support
+      pkgs.spice-gtk
+    ];
 
     # Note: the following options are also declared in virtualisation.lxc, but
     # the latter can't be simply enabled to reuse the formers, because it
@@ -164,32 +250,24 @@ in
         "network-online.target"
         "lxcfs.service"
         "incus.socket"
-      ]
-        ++ lib.optional config.virtualisation.vswitch.enable "ovs-vswitchd.service";
+      ] ++ lib.optionals config.virtualisation.vswitch.enable [ "ovs-vswitchd.service" ];
 
       requires = [
         "lxcfs.service"
         "incus.socket"
-      ]
-        ++ lib.optional config.virtualisation.vswitch.enable "ovs-vswitchd.service";
+      ] ++ lib.optionals config.virtualisation.vswitch.enable [ "ovs-vswitchd.service" ];
 
-      wants = [
-        "network-online.target"
+      wants = [ "network-online.target" ];
+
+      environment = lib.mkMerge [
+        {
+          INCUS_LXC_TEMPLATE_CONFIG = "${pkgs.lxcfs}/share/lxc/config";
+          INCUS_OVMF_PATH = ovmf;
+          PATH = lib.mkForce serverBinPath;
+        }
+        (lib.mkIf (cfg.ui.enable) { "INCUS_UI" = cfg.ui.package; })
       ];
 
-      path = lib.optionals config.boot.zfs.enabled [
-        config.boot.zfs.package
-        "${config.boot.zfs.package}/lib/udev"
-      ]
-        ++ lib.optional config.virtualisation.vswitch.enable config.virtualisation.vswitch.package;
-
-      environment = lib.mkMerge [ {
-        # Override Path to the LXC template configuration directory
-        INCUS_LXC_TEMPLATE_CONFIG = "${pkgs.lxcfs}/share/lxc/config";
-      } (lib.mkIf (cfg.ui.enable) {
-        "INCUS_UI" = cfg.ui.package;
-      }) ];
-
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/incusd --group incus-admin";
         ExecStartPost = "${cfg.package}/bin/incusd waitready --timeout=${cfg.startTimeout}";
@@ -222,15 +300,13 @@ in
     systemd.services.incus-preseed = lib.mkIf (cfg.preseed != null) {
       description = "Incus initialization with preseed file";
 
-      wantedBy = ["incus.service"];
-      after = ["incus.service"];
-      bindsTo = ["incus.service"];
-      partOf = ["incus.service"];
+      wantedBy = [ "incus.service" ];
+      after = [ "incus.service" ];
+      bindsTo = [ "incus.service" ];
+      partOf = [ "incus.service" ];
 
       script = ''
-        ${cfg.package}/bin/incus admin init --preseed <${
-          preseedFormat.generate "incus-preseed.yaml" cfg.preseed
-        }
+        ${cfg.package}/bin/incus admin init --preseed <${preseedFormat.generate "incus-preseed.yaml" cfg.preseed}
       '';
 
       serviceConfig = {

nixos/tests/all-tests.nix

@@ -309,6 +309,7 @@ in {
   firefox-devedition = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-devedition; };
   firefox-esr    = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-esr; }; # used in `tested` job
   firefox-esr-115 = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-esr-115; };
+  firefoxpwa = handleTest ./firefoxpwa.nix {};
   firejail = handleTest ./firejail.nix {};
   firewall = handleTest ./firewall.nix { nftables = false; };
   firewall-nftables = handleTest ./firewall.nix { nftables = true; };

nixos/tests/firefoxpwa.nix

@@ -0,0 +1,36 @@
+import ./make-test-python.nix ({ lib, ... }:
+
+{
+  name = "firefoxpwa";
+  meta.maintainers = with lib.maintainers; [ camillemndn ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ./common/x11.nix ];
+      environment.systemPackages = with pkgs; [ firefoxpwa jq ];
+
+      programs.firefox = {
+        enable = true;
+        nativeMessagingHosts.packages = [ pkgs.firefoxpwa ];
+      };
+
+      services.jellyfin.enable = true;
+    };
+
+  enableOCR = true;
+
+  testScript = ''
+    machine.start()
+
+    with subtest("Install a progressive web app"):
+        machine.wait_for_unit("jellyfin.service")
+        machine.wait_for_open_port(8096)
+        machine.succeed("firefoxpwa site install http://localhost:8096/web/manifest.json >&2")
+
+    with subtest("Launch the progressive web app"):
+        machine.succeed("firefoxpwa site launch $(jq -r < ~/.local/share/firefoxpwa/config.json '.sites | keys[0]') >&2")
+        machine.wait_for_window("Jellyfin")
+        machine.wait_for_text("Jellyfin")
+  '';
+})

nixos/tests/incus/container.nix

@@ -1,20 +1,21 @@
-import ../make-test-python.nix ({ pkgs, lib, extra ? {}, ... } :
+import ../make-test-python.nix ({ pkgs, lib, extra ? {}, name ? "incus-container", ... } :
 
 let
   releases = import ../../release.nix {
-    configuration = {
-      # Building documentation makes the test unnecessarily take a longer time:
-      documentation.enable = lib.mkForce false;
+    configuration = lib.recursiveUpdate {
+        # Building documentation makes the test unnecessarily take a longer time:
+        documentation.enable = lib.mkForce false;
 
-      boot.kernel.sysctl."net.ipv4.ip_forward" = "1";
-    } // extra;
+        boot.kernel.sysctl."net.ipv4.ip_forward" = "1";
+    }
+    extra;
   };
 
   container-image-metadata = releases.lxdContainerMeta.${pkgs.stdenv.hostPlatform.system};
   container-image-rootfs = releases.lxdContainerImage.${pkgs.stdenv.hostPlatform.system};
 in
 {
-  name = "incus-container";
+  inherit name;
 
   meta = {
     maintainers = lib.teams.lxc.members;

nixos/tests/incus/default.nix

@@ -5,16 +5,22 @@
   handleTestOn,
 }:
 {
-  container-old-init = import ./container.nix { inherit system pkgs; };
-  container-new-init = import ./container.nix { inherit system pkgs; extra = {
-    # Enable new systemd init
-    boot.initrd.systemd.enable = true;
-  }; };
+  container-legacy-init = import ./container.nix {
+    name = "container-legacy-init";
+    inherit system pkgs;
+  };
+  container-systemd-init = import ./container.nix {
+    name = "container-systemd-init";
+    inherit system pkgs;
+    extra = {
+      boot.initrd.systemd.enable = true;
+    };
+  };
   lxd-to-incus = import ./lxd-to-incus.nix { inherit system pkgs; };
   openvswitch = import ./openvswitch.nix { inherit system pkgs; };
   preseed = import ./preseed.nix { inherit system pkgs; };
   socket-activated = import ./socket-activated.nix { inherit system pkgs; };
   storage = import ./storage.nix { inherit system pkgs; };
-  ui = import ./ui.nix {inherit system pkgs;};
+  ui = import ./ui.nix { inherit system pkgs; };
   virtual-machine = handleTestOn [ "x86_64-linux" ] ./virtual-machine.nix { inherit system pkgs; };
 }

nixos/tests/incus/lxd-to-incus.nix

@@ -95,7 +95,7 @@ import ../make-test-python.nix (
       machine.wait_for_unit("incus.service")
 
       with machine.nested("run migration"):
-          machine.succeed("lxd-to-incus --yes")
+          machine.succeed("${pkgs.incus}/bin/lxd-to-incus --yes")
 
       with machine.nested("verify resources migrated to incus"):
           machine.succeed("incus config show container")

nixos/tests/k3s/multi-node.nix

@@ -128,9 +128,7 @@ import ../make-test-python.nix ({ pkgs, lib, k3s, ... }:
       };
     };
 
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ euank ];
-    };
+    meta.maintainers = k3s.meta.maintainers;
 
     testScript = ''
       machines = [server, server2, agent]

nixos/tests/k3s/single-node.nix

@@ -25,9 +25,7 @@ import ../make-test-python.nix ({ pkgs, lib, k3s, ... }:
   in
   {
     name = "${k3s.name}-single-node";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ euank ];
-    };
+    meta.maintainers = k3s.meta.maintainers;
 
     nodes.machine = { pkgs, ... }: {
       environment.systemPackages = with pkgs; [ k3s gzip ];

nixos/tests/nix-ld.nix

@@ -1,17 +1,39 @@
-import ./make-test-python.nix ({ lib, pkgs, ...} :
+{ system ? builtins.currentSystem,
+  config ? {},
+  pkgs ? import ../.. { inherit system config; }
+}:
+let
+  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
+  shared =
+    { config, pkgs, ... }:
+    {
+      programs.nix-ld.enable = true;
+      environment.systemPackages = [
+        (pkgs.runCommand "patched-hello" { } ''
+          install -D -m755 ${pkgs.hello}/bin/hello $out/bin/hello
+          patchelf $out/bin/hello --set-interpreter $(cat ${config.programs.nix-ld.package}/nix-support/ldpath)
+        '')
+      ];
+    };
+in
 {
-  name = "nix-ld";
-  nodes.machine = { pkgs, ... }: {
-    programs.nix-ld.enable = true;
-    environment.systemPackages = [
-      (pkgs.runCommand "patched-hello" {} ''
-        install -D -m755 ${pkgs.hello}/bin/hello $out/bin/hello
-        patchelf $out/bin/hello --set-interpreter $(cat ${pkgs.nix-ld}/nix-support/ldpath)
-      '')
-    ];
+  nix-ld = makeTest {
+    name = "nix-ld";
+    nodes.machine = shared;
+    testScript = ''
+      start_all()
+      machine.succeed("hello")
+    '';
   };
-  testScript = ''
-    start_all()
-    machine.succeed("hello")
- '';
-})
+  nix-ld-rs = makeTest {
+    name = "nix-ld-rs";
+    nodes.machine = {
+      imports = [ shared ];
+      programs.nix-ld.package = pkgs.nix-ld-rs;
+    };
+    testScript = ''
+      start_all()
+      machine.succeed("hello")
+    '';
+  };
+}

nixos/tests/tracee.nix

@@ -1,7 +1,13 @@
-import ./make-test-python.nix ({ pkgs, ... }: {
+import ./make-test-python.nix ({ pkgs, ... }: rec {
   name = "tracee-integration";
   meta.maintainers = pkgs.tracee.meta.maintainers;
 
+  passthru.hello-world-builder = pkgs: pkgs.dockerTools.buildImage {
+    name = "hello-world";
+    tag = "latest";
+    config.Cmd = [ "${pkgs.hello}/bin/hello" ];
+  };
+
   nodes = {
     machine = { config, pkgs, ... }: {
       # EventFilters/trace_only_events_from_new_containers and
@@ -12,57 +18,48 @@ import ./make-test-python.nix ({ pkgs, ... }: {
       environment.systemPackages = with pkgs; [
         # required by Test_EventFilters/trace_events_from_ls_and_which_binary_in_separate_scopes
         which
-        # build the go integration tests as a binary
-        (tracee.overrideAttrs (oa: {
-          pname = oa.pname + "-integration";
-          postPatch = oa.postPatch or "" + ''
-            # prepare tester.sh (which will be embedded in the test binary)
-            patchShebangs tests/integration/tester.sh
-
-            # fix the test to look at nixos paths for running programs
-            substituteInPlace tests/integration/integration_test.go \
-              --replace "bin=/usr/bin/" "comm=" \
-              --replace "binary=/usr/bin/" "comm=" \
-              --replace "/usr/bin/dockerd" "dockerd" \
-              --replace "/usr/bin" "/run/current-system/sw/bin"
-          '';
-          nativeBuildInputs = oa.nativeBuildInputs or [ ] ++ [ makeWrapper ];
-          buildPhase = ''
-            runHook preBuild
-            # just build the static lib we need for the go test binary
-            make $makeFlags ''${enableParallelBuilding:+-j$NIX_BUILD_CORES} bpf-core ./dist/btfhub
-
-            # then compile the tests to be ran later
-            CGO_LDFLAGS="$(pkg-config --libs libbpf)" go test -tags core,ebpf,integration -p 1 -c -o $GOPATH/tracee-integration ./tests/integration/...
-            runHook postBuild
-          '';
-          doCheck = false;
-          outputs = [ "out" ];
-          installPhase = ''
-            mkdir -p $out/bin
-            mv $GOPATH/tracee-integration $out/bin/
-          '';
-          doInstallCheck = false;
-
-          meta = oa.meta // {
-            outputsToInstall = [];
-          };
-        }))
+        # the go integration tests as a binary
+        tracee.passthru.tests.integration-test-cli
       ];
     };
   };
 
-  testScript = ''
-    machine.wait_for_unit("docker.service")
+  testScript =
+    let
+      skippedTests = [
+        # these comm tests for some reason do not resolve.
+        # something about the test is different as it works fine if I replicate
+        # the policies and run tracee myself but doesn't work in the integration
+        # test either with the automatic run or running the commands by hand
+        # while it's searching.
+        "Test_EventFilters/comm:_event:_args:_trace_event_set_in_a_specific_policy_with_args_from_ls_command"
+        "Test_EventFilters/comm:_event:_trace_events_set_in_two_specific_policies_from_ls_and_uname_commands"
 
-    with subtest("run integration tests"):
-      # EventFilters/trace_only_events_from_new_containers also requires a container called "alpine"
-      machine.succeed('tar c -C ${pkgs.pkgsStatic.busybox} . | docker import - alpine --change "ENTRYPOINT [\"sleep\"]"')
+        # worked at some point, seems to be flakey
+        "Test_EventFilters/pid:_event:_args:_trace_event_sched_switch_with_args_from_pid_0"
+      ];
+    in
+    ''
+      with subtest("prepare for integration tests"):
+        machine.wait_for_unit("docker.service")
+        machine.succeed('which bash')
 
-      # Test_EventFilters/trace_event_set_in_a_specific_scope expects to be in a dir that includes "integration"
-      print(machine.succeed(
-        'mkdir /tmp/integration',
-        'cd /tmp/integration && tracee-integration -test.v'
-      ))
-  '';
+        # EventFilters/trace_only_events_from_new_containers also requires a container called "hello-world"
+        machine.succeed('docker load < ${passthru.hello-world-builder pkgs}')
+
+        # exec= needs fully resolved paths
+        machine.succeed(
+          'mkdir /tmp/testdir',
+          'cp $(which who) /tmp/testdir/who',
+          'cp $(which uname) /tmp/testdir/uname',
+        )
+
+      with subtest("run integration tests"):
+        # Test_EventFilters/trace_event_set_in_a_specific_scope expects to be in a dir that includes "integration"
+        # tests must be ran with 1 process
+        print(machine.succeed(
+          'mkdir /tmp/integration',
+          'cd /tmp/integration && export PATH="/tmp/testdir:$PATH" && integration.test -test.v -test.parallel 1 -test.skip="^${builtins.concatStringsSep "$|^" skippedTests}$"'
+        ))
+    '';
 })

pkgs/applications/audio/geonkick/default.nix

@@ -1,22 +1,23 @@
 { lib, stdenv, fetchFromGitLab, cmake, pkg-config, libsndfile, rapidjson
-, libjack2, lv2, libX11, cairo }:
+, libjack2, lv2, libX11, cairo, openssl }:
 
 stdenv.mkDerivation rec {
   pname = "geonkick";
-  version = "2.9.1";
+  version = "3.3.1";
 
   src = fetchFromGitLab {
-    owner = "iurie-sw";
+    owner = "Geonkick-Synthesizer";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-XSqcj8+X6QMBnIusPB9VNrgcbdiWhNMOYeFyKklGmO8=";
+    sha256 = "sha256-fsDoqQqZsoeQa66dxb8JC2ywUFmBf6b2J+/ixWZTzfU=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
 
-  buildInputs = [ libsndfile rapidjson libjack2 lv2 libX11 cairo ];
+  buildInputs = [ libsndfile rapidjson libjack2 lv2 libX11 cairo openssl ];
 
-  # https://github.com/iurie-sw/geonkick/issues/120
+  # Without this, the lv2 ends up in
+  # /nix/store/$HASH/nix/store/$HASH/lib/lv2
   cmakeFlags = [
     "-DCMAKE_INSTALL_LIBDIR=lib"
   ];

pkgs/applications/audio/tidal-hifi/default.nix

@@ -36,11 +36,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tidal-hifi";
-  version = "5.9.0";
+  version = "5.10.0";
 
   src = fetchurl {
     url = "https://github.com/Mastermindzh/tidal-hifi/releases/download/${finalAttrs.version}/tidal-hifi_${finalAttrs.version}_amd64.deb";
-    sha256 = "sha256-t79GNCqY99JfCT+4wO3CTtLXFdKQudMw4pZNiJzOufo=";
+    sha256 = "sha256-+sRXpRAtbLpQlyJUhbc1Cuzh6aV8HRvYH/ja9sfvKoA=";
   };
 
   nativeBuildInputs = [ autoPatchelfHook dpkg makeWrapper ];

pkgs/applications/audio/waylyrics/Cargo.lock

@@ -126,6 +126,12 @@ version = "0.21.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
 
+[[package]]
+name = "base64"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9475866fec1451be56a3c2400fd081ff546538961565ccb5b7142cbd22bc7a51"
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -431,17 +437,6 @@ dependencies = [
  "powerfmt",
 ]
 
-[[package]]
-name = "derivative"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcc3dd5e9e9c0b295d6e1e4d811fb6f157d5ffd784b8d202fc62eac8035a770b"
-dependencies = [
- "proc-macro2",
- "quote 1.0.35",
- "syn 1.0.109",
-]
-
 [[package]]
 name = "derive_is_enum_variant"
 version = "0.1.1"
@@ -964,9 +959,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.3.24"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb2c4422095b67ee78da96fbb51a4cc413b3b25883c7717ff7ca1ab31022c9c9"
+checksum = "51ee2dd2e4f378392eeff5d51618cd9a63166a2513846bbc55f21cfacd9199d4"
 dependencies = [
  "bytes",
  "fnv",
@@ -1034,9 +1029,9 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "http"
-version = "0.2.11"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8947b1a6fad4393052c7ba1f4cd97bed3e953a95c79c92ad9b051a04611d9fbb"
+checksum = "21b9ddb458710bc376481b842f5da65cdf31522de232c1ca8146abce2a358258"
 dependencies = [
  "bytes",
  "fnv",
@@ -1045,12 +1040,24 @@ dependencies = [
 
 [[package]]
 name = "http-body"
-version = "0.4.6"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
+checksum = "1cac85db508abc24a2e48553ba12a996e87244a0395ce011e62b37158745d643"
 dependencies = [
  "bytes",
  "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0475f8b2ac86659c21b64320d5d653f9efe42acd2a4e560073ec61a155a34f1d"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
  "pin-project-lite",
 ]
 
@@ -1060,47 +1067,60 @@ version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
 
-[[package]]
-name = "httpdate"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
-
 [[package]]
 name = "hyper"
-version = "0.14.28"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf96e135eb83a2a8ddf766e426a841d8ddd7449d5f00d34ea02b41d2f19eef80"
+checksum = "186548d73ac615b32a73aafe38fb4f56c0d340e110e5a200bcadbaf2e199263a"
 dependencies = [
  "bytes",
  "futures-channel",
- "futures-core",
  "futures-util",
  "h2",
  "http",
  "http-body",
  "httparse",
- "httpdate",
  "itoa",
  "pin-project-lite",
- "socket2",
+ "smallvec",
  "tokio",
- "tower-service",
- "tracing",
  "want",
 ]
 
 [[package]]
 name = "hyper-tls"
-version = "0.5.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
+checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
 dependencies = [
  "bytes",
+ "http-body-util",
  "hyper",
+ "hyper-util",
  "native-tls",
  "tokio",
  "tokio-native-tls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca38ef113da30126bbff9cd1705f9273e15d45498615d138b0c20279ac7a76aa"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower",
+ "tower-service",
+ "tracing",
 ]
 
 [[package]]
@@ -1328,9 +1348,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "0.8.10"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f3d0b296e374a4e6f3c7b0a1f5a51d748a0d34c85e7dc48fc3fa9a87657fe09"
+checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
 dependencies = [
  "libc",
  "wasi",
@@ -1371,9 +1391,9 @@ dependencies = [
 [[package]]
 name = "ncmapi"
 version = "0.1.13"
-source = "git+https://github.com/waylyrics/ncmapi-rs.git?rev=51b4d121#51b4d121235823e8040feb3a9c9052da0559fe75"
+source = "git+https://github.com/waylyrics/ncmapi-rs.git?rev=590f280#590f280458e1826df0af0f0f624c2222448a7dee"
 dependencies = [
- "base64",
+ "base64 0.22.0",
  "cookie 0.18.0",
  "hex",
  "openssl",
@@ -1638,6 +1658,26 @@ dependencies = [
  "siphasher",
 ]
 
+[[package]]
+name = "pin-project"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6bf43b791c5b9e34c3d182969b4abb522f9343702850a2e57f460d00d09b4b3"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.35",
+ "syn 2.0.50",
+]
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.13"
@@ -1871,11 +1911,11 @@ dependencies = [
 
 [[package]]
 name = "reqwest"
-version = "0.11.24"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6920094eb85afde5e4a138be3f2de8bbdf28000f0029e72c45025a56b042251"
+checksum = "58b48d98d932f4ee75e541614d32a7f44c889b72bd9c2e04d95edd135989df88"
 dependencies = [
- "base64",
+ "base64 0.21.7",
  "bytes",
  "cookie 0.17.0",
  "cookie_store",
@@ -1885,8 +1925,10 @@ dependencies = [
  "h2",
  "http",
  "http-body",
+ "http-body-util",
  "hyper",
  "hyper-tls",
+ "hyper-util",
  "ipnet",
  "js-sys",
  "log",
@@ -2000,7 +2042,7 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
 dependencies = [
- "base64",
+ "base64 0.21.7",
 ]
 
 [[package]]
@@ -2535,6 +2577,28 @@ dependencies = [
  "winnow 0.6.2",
 ]
 
+[[package]]
+name = "tower"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8fa9be0de6cf49e536ce1851f987bd21a43b771b09473c3549a6c853db37c1c"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project",
+ "pin-project-lite",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c20c8dbed6283a09604c3e69b4b7eeb54e298b8a600d4d5ecb5ad39de609f1d0"
+
 [[package]]
 name = "tower-service"
 version = "0.3.2"
@@ -2547,6 +2611,7 @@ version = "0.1.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
 dependencies = [
+ "log",
  "pin-project-lite",
  "tracing-attributes",
  "tracing-core",
@@ -2788,14 +2853,13 @@ checksum = "4f186bd2dcf04330886ce82d6f33dd75a7bfcf69ecf5763b89fcde53b6ac9838"
 
 [[package]]
 name = "waylyrics"
-version = "0.2.12"
+version = "0.2.13"
 dependencies = [
  "anyhow",
  "async-channel",
  "async-trait",
  "dbus",
  "dbus-dummy",
- "derivative",
  "documented",
  "gettext-rs",
  "glib-macros",

pkgs/applications/audio/waylyrics/default.nix

@@ -9,19 +9,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "waylyrics";
-  version = "0.2.12";
+  version = "0.2.13";
 
   src = fetchFromGitHub {
     owner = "poly000";
     repo = "waylyrics";
     rev = "v${version}";
-    hash = "sha256-sUhFT3Vq/IjbMir7/AVCU8FyfmoNiZsn2zkqdJkOMFo=";
+    hash = "sha256-522NdpGj0oh2SbWa4GFCFpqNFRhqQxfZ1ZRuS9jUj7Y=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "ncmapi-0.1.13" = "sha256-NxgF1TV+3hK5oE/DfJnWyc+XmPX3U1UeD+xTkcvDzIA=";
+      "ncmapi-0.1.13" = "sha256-qu89qf4IPM14V+oE4QQr/SsXSTx3vQbyfzD+Pihcd3E=";
       "qqmusic-rs-0.1.0" = "sha256-woLsO0n+m3EBUI+PRLio7iLp0UPQSliWK0djCSZEaZc=";
     };
   };
@@ -51,6 +51,14 @@ rustPlatform.buildRustPackage rec {
     # Install icons
     install -d $out/share/icons
     cp -vr res/icons/hicolor $out/share/icons/hicolor
+    # Install translations
+    pushd locales
+    for po in $(find . -type f -name '*.po')
+    do
+      install -d $(dirname "$out/share/locale/$po")
+      msgfmt -o $out/share/locale/''${po%.po}.mo $po
+    done
+    popd
   '';
 
   meta = with lib; {

pkgs/applications/blockchains/trezor-suite/default.nix

@@ -53,6 +53,9 @@ appimageTools.wrapType2 rec {
   '';
 
   meta = with lib; {
+    # trezor-suite fails to detect a connected hardware wallet
+    # ref: https://github.com/NixOS/nixpkgs/issues/281975
+    broken = true;
     description = "Trezor Suite - Desktop App for managing crypto";
     homepage = "https://suite.trezor.io";
     changelog = "https://github.com/trezor/trezor-suite/releases/tag/v${version}";

pkgs/applications/editors/gedit/default.nix

@@ -4,6 +4,7 @@
 , mesonEmulatorHook
 , fetchurl
 , python3
+, python3Packages
 , pkg-config
 , gtk3
 , gtk-mac-integration
@@ -53,6 +54,7 @@ stdenv.mkDerivation rec {
     perl
     pkg-config
     python3
+    python3Packages.wrapPython
     vala
     wrapGAppsHook
     gtk-doc
@@ -85,6 +87,16 @@ stdenv.mkDerivation rec {
   # Reliably fails to generate gedit-file-browser-enum-types.h in time
   enableParallelBuilding = false;
 
+  pythonPath = with python3Packages; [
+    # https://github.com/NixOS/nixpkgs/issues/298716
+    pycairo
+  ];
+
+  postFixup = ''
+    buildPythonPath "$pythonPath"
+    patchPythonScript $out/lib/gedit/plugins/snippets/document.py
+  '';
+
   passthru = {
     updateScript = gnome.updateScript {
       packageName = "gedit";

pkgs/applications/editors/xedit/default.nix

@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation rec {
   pname = "xedit";
-  version = "1.2.3";
+  version = "1.2.4";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "xorg/app";
     repo = "xedit";
     rev = "${pname}-${version}";
-    sha256 = "sha256-WF+4avzRRL0+OA3KxzK7JwmArkPu9fEl+728R6ouXmg=";
+    sha256 = "sha256-0vP+aR8QBXAqbULOLEs7QXsehk18BJ405qoelrcepwE=";
   };
 
   # ./lisp/mathimp.c:493:10: error: implicitly declaring library function 'finite' with type 'int (double)'

pkgs/applications/file-managers/clifm/default.nix

@@ -1,22 +1,36 @@
-{ stdenv, lib, fetchFromGitHub, libcap, acl, file, readline, python3 }:
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  libcap,
+  acl,
+  file,
+  readline,
+  python3,
+}:
 
 stdenv.mkDerivation rec {
   pname = "clifm";
-  version = "1.17";
+  version = "1.18";
 
   src = fetchFromGitHub {
     owner = "leo-arch";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-plJ2iKloRGtBSa1upSo675bMj6qczR6TQ043UQboxQE=";
+    hash = "sha256-tgCGZCLCWcF7ktXqDHjoUkeVqxg6QVOkZb7pbk3nA+U=";
   };
 
-  buildInputs = [ libcap acl file readline python3];
+  buildInputs = [
+    libcap
+    acl
+    file
+    readline
+    python3
+  ];
 
   makeFlags = [
-    "DESTDIR=${placeholder "out"}"
-    "DATADIR=/share"
-    "PREFIX=/"
+    "PREFIX=${placeholder "out"}"
+    "DATADIR=${placeholder "out"}/share"
   ];
 
   enableParallelBuilding = true;

pkgs/applications/graphics/graphicsmagick/compat.nix

@@ -1,37 +0,0 @@
-{ lib, stdenv, graphicsmagick }:
-
-stdenv.mkDerivation {
-  pname = "graphicsmagick-imagemagick-compat";
-  inherit (graphicsmagick) version;
-
-  dontUnpack = true;
-  buildPhase = "true";
-
-  utils = [
-    "composite"
-    "conjure"
-    "convert"
-    "identify"
-    "mogrify"
-    "montage"
-    "animate"
-    "display"
-    "import"
-  ];
-
-  # TODO: symlink libraries?
-  installPhase = ''
-    mkdir -p "$out"/bin
-    mkdir -p "$out"/share/man/man1
-    for util in ''${utils[@]}; do
-      ln -s ${graphicsmagick}/bin/gm "$out/bin/$util"
-      ln -s ${graphicsmagick}/share/man/man1/gm.1.gz "$out/share/man/man1/$util.1.gz"
-    done
-  '';
-
-  meta = {
-    description = "ImageMagick interface for GraphicsMagick";
-    license = lib.licenses.free;
-    platforms = lib.platforms.all;
-  };
-}

pkgs/applications/graphics/graphicsmagick/default.nix

@@ -1,67 +0,0 @@
-{ lib, stdenv, fetchurl, bzip2, freetype, graphviz, ghostscript
-, libjpeg, libpng, libtiff, libxml2, zlib, libtool, xz, libX11
-, libwebp, quantumdepth ? 8, fixDarwinDylibNames, nukeReferences
-, coreutils
-, runCommand
-, graphicsmagick  # for passthru.tests
-}:
-
-stdenv.mkDerivation rec {
-  pname = "graphicsmagick";
-  version = "1.3.42";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/graphicsmagick/GraphicsMagick-${version}.tar.xz";
-    sha256 = "sha256-SE/M/Ssvr2wrqRUUaezlByvLkbpO1z517T2ORsdZ1Vc=";
-  };
-
-  patches = [
-    ./disable-popen.patch
-  ];
-
-  configureFlags = [
-    # specify delegates explicitly otherwise `gm` will invoke the build
-    # coreutils for filetypes it doesn't natively support.
-    "MVDelegate=${lib.getExe' coreutils "mv"}"
-    "--enable-shared"
-    "--with-frozenpaths"
-    "--with-quantum-depth=${toString quantumdepth}"
-    "--with-gslib=yes"
-  ];
-
-  buildInputs =
-    [ bzip2 freetype ghostscript graphviz libjpeg libpng libtiff libX11 libxml2
-      zlib libtool libwebp
-    ];
-
-  nativeBuildInputs = [ xz nukeReferences ]
-  ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
-
-  # Remove CFLAGS from the binaries to avoid closure bloat.
-  # In the past we have had -dev packages in the closure of the binaries soley due to the string references.
-  postConfigure = ''
-    nuke-refs -e $out ./magick/magick_config.h
-  '';
-
-  postInstall = ''
-    sed -i 's/-ltiff.*'\'/\'/ $out/bin/*
-  '';
-
-  passthru = {
-    tests = {
-      issue-157920 = runCommand "issue-157920-regression-test" {
-        buildInputs = [ graphicsmagick ];
-      } ''
-        gm convert ${graphviz}/share/doc/graphviz/neatoguide.pdf jpg:$out
-      '';
-    };
-  };
-
-  meta = {
-    homepage = "http://www.graphicsmagick.org";
-    description = "Swiss army knife of image processing";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.all;
-    mainProgram = "gm";
-  };
-}

pkgs/applications/graphics/graphicsmagick/disable-popen.patch

@@ -1,12 +0,0 @@
-http://permalink.gmane.org/gmane.comp.security.oss.general/19669
-
---- a/magick/blob.c Sat Nov 07 14:49:16 2015 -0600
-+++ b/magick/blob.c Sun May 29 14:12:57 2016 -0500
-@@ -68,6 +68,7 @@
- */
- #define DefaultBlobQuantum  65541
- 
-+#undef HAVE_POPEN
- 
- /*
-   Enum declarations.

pkgs/applications/misc/gramps/check-locale-hasattr-textdomain.patch

@@ -0,0 +1,19 @@
+diff --git a/gramps/gen/utils/grampslocale.py b/gramps/gen/utils/grampslocale.py
+index f25030e..59c1c90 100644
+--- a/gramps/gen/utils/grampslocale.py
++++ b/gramps/gen/utils/grampslocale.py
+@@ -370,8 +370,12 @@ class GrampsLocale:
+                 )
+             else:
+                 # bug12278, _build_popup_ui() under linux and macOS
+-                locale.textdomain(self.localedomain)
+-                locale.bindtextdomain(self.localedomain, self.localedir)
++                if hasattr(locale, 'textdomain'):
++                    locale.textdomain(self.localedomain)
++                    locale.bindtextdomain(self.localedomain, self.localedir)
++                else:
++                    gettext.textdomain(self.localedomain)
++                    gettext.bindtextdomain(self.localedomain, self.localedir)
+ 
+         self.rtl_locale = False
+         if self.language[0] in _RTL_LOCALES:

pkgs/applications/misc/gramps/default.nix

@@ -1,5 +1,4 @@
 { lib
-, fetchpatch
 , fetchFromGitHub
 , gtk3
 , pythonPackages
@@ -10,8 +9,8 @@
 , gobject-introspection
 , wrapGAppsHook
 , gettext
-, # Optional packages:
-  enableOSM ? true
+  # Optional packages:
+, enableOSM ? true
 , osm-gps-map
 , glib-networking
 , enableGraphviz ? true
@@ -21,13 +20,29 @@
 }:
 
 let
-  inherit (pythonPackages) python buildPythonApplication;
+  inherit (pythonPackages) buildPythonApplication pythonOlder;
 in
 buildPythonApplication rec {
-  version = "5.1.6";
+  version = "5.2.0";
   pname = "gramps";
   pyproject = true;
 
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "gramps-project";
+    repo = "gramps";
+    rev = "v${version}";
+    hash = "sha256-8iQcaWLiBegVjcV16TfZbp8/4N/9f5pEl7mdV78CeEY=";
+  };
+
+  patches = [
+    # textdomain doesn't exist as a property on locale when running on Darwin
+    ./check-locale-hasattr-textdomain.patch
+    # disables the startup warning about bad GTK installation
+    ./disable-gtk-warning-dialog.patch
+  ];
+
   nativeBuildInputs = [
     wrapGAppsHook
     intltool
@@ -38,6 +53,7 @@ buildPythonApplication rec {
 
   nativeCheckInputs = [
     glibcLocales
+    pythonPackages.unittestCheckHook
     pythonPackages.jsonschema
     pythonPackages.mock
     pythonPackages.lxml
@@ -52,55 +68,25 @@ buildPythonApplication rec {
     ++ lib.optional enableGhostscript ghostscript
   ;
 
-  src = fetchFromGitHub {
-    owner = "gramps-project";
-    repo = "gramps";
-    rev = "v${version}";
-    hash = "sha256-BerkDXdFYfZ3rV5AeMo/uk53IN2U5z4GFs757Ar26v0=";
-  };
-
-  pythonPath = with pythonPackages; [
+  propagatedBuildInputs = with pythonPackages; [
     bsddb3
     pyicu
     pygobject3
     pycairo
   ];
 
-  patches = [
-    # fix for running tests with a temporary home - remove next release
-    # https://gramps-project.org/bugs/view.php?id=12577
-    (fetchpatch {
-      url = "https://github.com/gramps-project/gramps/commit/1e95d8a6b5193d655d8caec1e6ab13628ad123db.patch";
-      hash = "sha256-2riWB13Yl+tk9+Tuo0YDLoxY2Rc0xrJKfb+ZU7Puzxk=";
-    })
-  ];
-
-  # Same installPhase as in buildPythonApplication but without --old-and-unmanageble
-  # install flag.
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p "$out/${python.sitePackages}"
-
-    export PYTHONPATH="$out/${python.sitePackages}:$PYTHONPATH"
-
-    ${python}/bin/${python.executable} setup.py install \
-      --install-lib=$out/${python.sitePackages} \
-      --prefix="$out"
-
-    eapth="$out/${python.sitePackages}/easy-install.pth"
-    if [ -e "$eapth" ]; then
-        # move colliding easy_install.pth to specifically named one
-        mv "$eapth" $(dirname "$eapth")/${pname}-${version}.pth
-    fi
-
-    rm -f "$out/${python.sitePackages}"/site.py*
-
-    runHook postInstall
-  '';
 
   preCheck = ''
-    export HOME=$TMPDIR
+    export HOME=$(mktemp -d)
+    mkdir .git # Make gramps think that it's not in an installed state
+  '';
+
+  dontWrapGApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=(
+      "''${gappsWrapperArgs[@]}"
+    )
   '';
 
   # https://github.com/NixOS/nixpkgs/issues/149812
@@ -111,8 +97,8 @@ buildPythonApplication rec {
     description = "Genealogy software";
     mainProgram = "gramps";
     homepage = "https://gramps-project.org";
-    maintainers = with maintainers; [ jk pinpox ];
-    changelog = "https://github.com/gramps-project/gramps/blob/v${version}/ChangeLog";
+    maintainers = with maintainers; [ jk pinpox tomasajt ];
+    changelog = "https://github.com/gramps-project/gramps/blob/${src.rev}/ChangeLog";
     longDescription = ''
       Every person has their own story but they are also part of a collective
       family history. Gramps gives you the ability to record the many details of

pkgs/applications/misc/gramps/disable-gtk-warning-dialog.patch

@@ -0,0 +1,14 @@
+diff --git a/gramps/gui/grampsgui.py b/gramps/gui/grampsgui.py
+index 0c0d4c3..522f65a 100644
+--- a/gramps/gui/grampsgui.py
++++ b/gramps/gui/grampsgui.py
+@@ -573,9 +573,6 @@ class Gramps:
+         dbstate = DbState()
+         self._vm = ViewManager(app, dbstate, config.get("interface.view-categories"))
+ 
+-        if lin() and glocale.lang != "C" and not gettext.find(GTK_GETTEXT_DOMAIN):
+-            _display_gtk_gettext_message(parent=self._vm.window)
+-
+         _display_translator_message(parent=self._vm.window)
+ 
+         self._vm.init_interface()

pkgs/applications/misc/nwg-displays/default.nix

@@ -14,13 +14,13 @@
 
 python310Packages.buildPythonApplication rec {
   pname = "nwg-displays";
-  version = "0.3.14";
+  version = "0.3.16";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-displays";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jSL+ig1mNJrnHli8B+BqvEG8jcC0gnxzbukiYgt3nP0=";
+    hash = "sha256-rnaBYDGEsc8oGw4yZ60NQFbNf+L0tmHYDYf+UDoDmSI=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/browsers/firefox/wrapper.nix

@@ -67,7 +67,7 @@ let
       deprecatedNativeMessagingHost = option: pkg:
         if (cfg.${option} or false)
           then
-            lib.warn "The cfg.${option} argument for `firefox.override` is deprecated, please add `pkgs.${pkg.pname}` to `nativeMessagingHosts.packages` instead"
+            lib.warn "The cfg.${option} argument for `firefox.override` is deprecated, please add `pkgs.${pkg.pname}` to `nativeMessagingHosts` instead"
             [pkg]
           else [];
 

pkgs/applications/networking/cluster/civo/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "civo";
-  version = "1.0.76";
+  version = "1.0.77";
 
   src = fetchFromGitHub {
     owner  = "civo";
     repo   = "cli";
     rev    = "v${version}";
-    sha256 = "sha256-Bk0YfW9KDliaJIqpVxCXTy7EiGGJPZTXcn6SFEmywRE=";
+    sha256 = "sha256-W9CJAFLGarDG/Y8g2Whoh4v9hxqb8txuLfAkooW8PNM=";
   };
 
-  vendorHash = "sha256-22n+ks1D65Gk2acCMHxgj19VHDf4B23ivqHfo3J45j0=";
+  vendorHash = "sha256-Uh2/4qdJQfqQdjXbOBkUVv2nF1AN+QRKRI0+yta+G5Q=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/networking/cluster/glooctl/default.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.16.8";
+  version = "1.16.9";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-M8ZNDt+sO8ZtVM1PyISOsFwXrD6q9ACPG0T99bqwk1c=";
+    hash = "sha256-9zGtMfVZL+VIpEw2D5n4LzyTYNLCJFKf7Q++QiUKPxA=";
   };
 
   vendorHash = "sha256-UyzqKpF2WBj25Bm4MtkF6yjl87A61vGsteBNCjJV178=";

pkgs/applications/networking/cluster/k3s/builder.nix

@@ -83,7 +83,7 @@ let
     description = "A lightweight Kubernetes distribution";
     license = licenses.asl20;
     homepage = "https://k3s.io";
-    maintainers = with maintainers; [ euank mic92 yajo ];
+    maintainers = with maintainers; [ euank mic92 superherointj yajo ];
     platforms = platforms.linux;
 
     # resolves collisions with other installations of kubectl, crictl, ctr

pkgs/applications/networking/cluster/vcluster/default.nix

@@ -2,27 +2,27 @@
 
 buildGoModule rec {
   pname = "vcluster";
-  version = "0.19.4";
+  version = "0.19.5";
 
   src = fetchFromGitHub {
     owner = "loft-sh";
     repo = "vcluster";
     rev = "v${version}";
-    hash = "sha256-fzHaB+EeS8Gr1EVlxAZzKDYgv3Jij4LwmYaXN4tjYBg=";
+    hash = "sha256-V+Y2LekBYlKZU53BsYCW6ADSMJOxkwSK9hbFGXBaa9o=";
   };
 
   vendorHash = null;
 
   subPackages = [ "cmd/vclusterctl" ];
 
-  nativeBuildInputs = [ installShellFiles ];
-
   ldflags = [
     "-s" "-w"
     "-X main.version=${version}"
     "-X main.goVersion=${lib.getVersion go}"
   ];
 
+  nativeBuildInputs = [ installShellFiles ];
+
   # Test is disabled because e2e tests expect k8s.
   doCheck = false;
 
@@ -48,10 +48,10 @@ buildGoModule rec {
   meta = {
     changelog = "https://github.com/loft-sh/vcluster/releases/tag/v${version}";
     description = "Create fully functional virtual Kubernetes clusters";
-    mainProgram = "vcluster";
     downloadPage = "https://github.com/loft-sh/vcluster";
     homepage = "https://www.vcluster.com/";
     license = lib.licenses.asl20;
+    mainProgram = "vcluster";
     maintainers = with lib.maintainers; [ berryp peterromfeldhk qjoly superherointj ];
   };
 }

pkgs/applications/networking/instant-messengers/beeper/default.nix

@@ -11,11 +11,11 @@
 }:
 let
   pname = "beeper";
-  version = "3.100.26";
+  version = "3.101.24";
   name = "${pname}-${version}";
   src = fetchurl {
-    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.100.26-build-240314pjsp57xom-x86_64.AppImage";
-    hash = "sha256-KYjB7ZfjoVf6UoXQvmtAqtD23JNQGqboNzXekAiJF7k=";
+    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.101.24-build-240322frr3t3orv-x86_64.AppImage";
+    hash = "sha256-yfkWvPYQhI8cfXfmmyi2LoSro1jxJRWy9phycv5TUL8=";
   };
   appimage = appimageTools.wrapType2 {
     inherit version pname src;

pkgs/applications/networking/instant-messengers/qq/default.nix

@@ -19,7 +19,7 @@
 , vips
 , at-spi2-core
 , autoPatchelfHook
-, wrapGAppsHook
+, makeWrapper
 }:
 
 let
@@ -43,7 +43,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     autoPatchelfHook
-    wrapGAppsHook
+    makeWrapper
     dpkg
   ];
 

pkgs/applications/networking/instant-messengers/zulip/default.nix

@@ -5,11 +5,11 @@
 
 let
   pname = "zulip";
-  version = "5.10.5";
+  version = "5.11.0";
 
   src = fetchurl {
     url = "https://github.com/zulip/zulip-desktop/releases/download/v${version}/Zulip-${version}-x86_64.AppImage";
-    hash = "sha256-dWTczjE6QAW26bGTIeFTuXl1JwYr3Ma+8Ab6MjeDr78=";
+    hash = "sha256-snxeMgcLFMYDEsog7Xqeybw8GkU4kPqHMds1174bPd0=";
     name="${pname}-${version}.AppImage";
   };
 
@@ -20,7 +20,7 @@ let
 in appimageTools.wrapType2 {
   inherit pname version src;
 
-  runScript = "appimage-exec.sh -w ${appimageContents} -- \${NIXOS_OZONE_WL:+\${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}";
+  runScript = "appimage-exec.sh -w ${appimageContents} -- \${NIXOS_OZONE_WL:+\${WAYLAND_DISPLAY:+--ozone-platform-hint=auto}}";
 
   extraInstallCommands = ''
     mv "$out/bin/${pname}-${version}" "$out/bin/${pname}"

pkgs/applications/networking/irc/thelounge/default.nix

@@ -4,7 +4,7 @@
 , fetchYarnDeps
 , nodejs
 , yarn
-, fixup_yarn_lock
+, prefetch-yarn-deps
 , python3
 , npmHooks
 , darwin
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-MM6SgVT7Pjdu96A4eWRucEzT7uNPxBqUDgHKl8mH2C0=";
   };
 
-  nativeBuildInputs = [ nodejs yarn fixup_yarn_lock python3 npmHooks.npmInstallHook ] ++ lib.optional stdenv.isDarwin darwin.cctools;
+  nativeBuildInputs = [ nodejs yarn prefetch-yarn-deps python3 npmHooks.npmInstallHook ] ++ lib.optional stdenv.isDarwin darwin.cctools;
   buildInputs = [ sqlite ];
 
   configurePhase = ''
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     export HOME="$PWD"
 
-    fixup_yarn_lock yarn.lock
+    fixup-yarn-lock yarn.lock
     yarn config --offline set yarn-offline-mirror ${finalAttrs.offlineCache}
     yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
     patchShebangs node_modules

pkgs/applications/networking/nextcloud-client/default.nix

@@ -26,7 +26,7 @@
 
 stdenv.mkDerivation rec {
   pname = "nextcloud-client";
-  version = "3.12.1";
+  version = "3.12.2";
 
   outputs = [ "out" "dev" ];
 
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     owner = "nextcloud";
     repo = "desktop";
     rev = "v${version}";
-    hash = "sha256-WGmabfOuEs9WRq1Ta7ZiZQuscoEdxhaFhuppE7MpZfk=";
+    hash = "sha256-qVb0omSWzwkbqdtYXy8VWYyCM0CDCAW9L78pli9TbO4=";
   };
 
   patches = [

pkgs/applications/networking/onionshare/default.nix

@@ -29,12 +29,12 @@
 }:
 
 let
-  version = "2.6.1";
+  version = "2.6.2";
   src = fetchFromGitHub {
     owner = "onionshare";
     repo = "onionshare";
     rev = "v${version}";
-    sha256 = "sha256-LR3Ao4Q8kEDwrFV+gYdMSEeYF4hDtEa1rJgvRRrJMwc=";
+    hash = "sha256-J8Hdriy8eWpHuMCI87a9a/zCR6xafM3A/Tkyom0Ktko=";
   };
   meta = with lib; {
     description = "Securely and anonymously send and receive files";

pkgs/applications/networking/trayscale/default.nix

@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "trayscale";
-  version = "0.10.4";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "DeedleFake";
     repo = "trayscale";
     rev = "v${version}";
-    hash = "sha256-/31QKCyMeEdpP59B+iXS5hL9W5sWz7R/I2nxBtj+0s4=";
+    hash = "sha256-qSrt94hEJosdvs2N6rbcJLpjqvMPkY20dIKV3jtjFlg=";
   };
 
-  vendorHash = "sha256-xYBiO6Zm32Do19I/cm4T6fubXY++Bhkn+RNAmKzM5cY=";
+  vendorHash = "sha256-eIakjEYfVp2wfXu0oqBmd5hJZTp0xgYKNNbtpRBnT2w=";
 
   subPackages = [ "cmd/trayscale" ];
 

pkgs/applications/networking/xpipe/default.nix

@@ -33,14 +33,14 @@ let
   }.${system} or throwSystem;
 
   hash = {
-    x86_64-linux = "sha256-L76UTgy1tGxj5KVXefz2uj2M/sse2n0byqRtW/wvwz8=";
+    x86_64-linux = "sha256-GcFds6PCEuvZ7oIfWMEkRIWMWU/jmCsj4zCkMe3+QM0=";
   }.${system} or throwSystem;
 
   displayname = "XPipe";
 
 in stdenvNoCC.mkDerivation rec {
   pname = "xpipe";
-  version = "8.4";
+  version = "8.5";
 
   src = fetchzip {
     url = "https://github.com/xpipe-io/xpipe/releases/download/${version}/xpipe-portable-linux-${arch}.tar.gz";

pkgs/applications/radio/qlog/default.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qlog";
-  version = "0.33.1";
+  version = "0.34.0";
 
   src = fetchFromGitHub {
     owner = "foldynl";
     repo = "QLog";
     rev = "v${version}";
-    hash = "sha256-stPzkCLcjzQT0n1NRGT7YN625RPYhJ9FuMkjtFZwtbA=";
+    hash = "sha256-zPIGqVfpd7Gkm3Ify+AwiCSWQ67ybv9BmuolSu9WzHM=";
     fetchSubmodules = true;
   };
 

pkgs/applications/science/biology/messer-slim/default.nix

@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, cmake, gcc, gcc-unwrapped }:
 
 stdenv.mkDerivation rec {
-  version = "4.1";
+  version = "4.2";
   pname = "messer-slim";
 
   src = fetchFromGitHub {
     owner = "MesserLab";
     repo = "SLiM";
     rev = "v${version}";
-    sha256 = "sha256-mb6xcu28QYAFm2906lRNY0zciQBKSGcz3q/cvOEh/VE=";
+    sha256 = "sha256-PDIaOMA1QHrJC5xVW+Mzx8ja/YvZBMKvV88MjSoSpfM=";
   };
 
   nativeBuildInputs = [ cmake gcc gcc-unwrapped ];

pkgs/applications/science/electronics/dataexplorer/default.nix

@@ -1,26 +1,32 @@
 { lib
 , stdenv
 , fetchurl
-, jdk
 , ant
+, jdk
 , makeWrapper
+, strip-nondeterminism
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "dataexplorer";
   version = "3.8.5";
 
   src = fetchurl {
-    url = "mirror://savannah/dataexplorer/dataexplorer-${version}-src.tar.gz";
-    sha256 = "sha256-b68xIZNbzHdPyZwLngcnjcoBtI6AeTdrblz/qx/HbGQ=";
+    url = "mirror://savannah/dataexplorer/dataexplorer-${finalAttrs.version}-src.tar.gz";
+    hash = "sha256-b68xIZNbzHdPyZwLngcnjcoBtI6AeTdrblz/qx/HbGQ=";
   };
 
-  nativeBuildInputs = [ ant makeWrapper ];
-
-  buildInputs = [ jdk ];
+  nativeBuildInputs = [
+    ant
+    jdk
+    makeWrapper
+    strip-nondeterminism
+  ];
 
   buildPhase = ''
+    runHook preBuild
     ant -f build/build.xml dist
+    runHook postBuild
   '';
 
   doCheck = false;
@@ -30,6 +36,8 @@ stdenv.mkDerivation rec {
   #'';
 
   installPhase = ''
+    runHook preInstall
+
     ant -Dprefix=$out/share/ -f build/build.xml install
 
     # The sources contain a wrapper script in $out/share/DataExplorer/DataExplorer
@@ -49,6 +57,14 @@ stdenv.mkDerivation rec {
       $out/etc/udev/rules.d/50-Junsi-iCharger-USB.rules
     install -Dvm644 build/misc/GNU_LINUX_SKYRC_UDEV_RULE/50-SkyRC-Charger.rules \
       $out/etc/udev/rules.d/50-SkyRC-Charger.rules
+
+    runHook postInstall
+  '';
+
+  # manually call strip-nondeterminism because using stripJavaArchivesHook takes
+  # too long to strip bundled jars
+  postFixup = ''
+    strip-nondeterminism --type jar $out/share/DataExplorer/{DataExplorer.jar,devices/*.jar}
   '';
 
   meta = with lib; {
@@ -63,4 +79,4 @@ stdenv.mkDerivation rec {
       binaryBytecode    # contains thirdparty jar files, e.g. javax.json, org.glassfish.json
     ];
   };
-}
+})

pkgs/applications/terminal-emulators/alacritty/default.nix

@@ -49,16 +49,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "alacritty";
-  version = "0.13.1";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "alacritty";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Nn/G7SkRuHXRSRgNjlmdX1G07sp7FPx8UyAn63Nivfg=";
+    hash = "sha256-MrlzAZWLgfwIoTdxY+fjWbrv7tygAjnxXebiEgwOM9A=";
   };
 
-  cargoHash = "sha256-vCoKaDd0mQRF6NNfK679FhEXuAdn/1o3F1gTfT8NK+0=";
+  cargoHash = "sha256-7HPTELRlmyjj7CXNbgqrzxW548BgbxybWi+tT3rOCX0=";
 
   nativeBuildInputs = [
     cmake

pkgs/applications/version-management/gerrit/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gerrit";
-  version = "3.9.1";
+  version = "3.9.2";
 
   src = fetchurl {
     url = "https://gerrit-releases.storage.googleapis.com/gerrit-${version}.war";
-    hash = "sha256-WQjzkykKtrXfkNSWcM9GWy8LPMwxJpSbnWjpmslP0HA=";
+    hash = "sha256-KsuuwFKdpXHDVAZZ2JiX781mgqDQyyEILo4lmNn+8YE=";
   };
 
   buildCommand = ''

pkgs/applications/video/dra-cla/default.nix

@@ -8,18 +8,19 @@
 , mpv
 , aria2
 , ffmpeg
+, fzf
 , openssl
 }:
 
 stdenvNoCC.mkDerivation {
   pname = "dra-cla";
-  version = "unstable-2023-10-10";
+  version = "unstable-2024-02-07";
 
   src = fetchFromGitHub {
     owner = "CoolnsX";
     repo = "dra-cla";
-    rev = "12e9557fb8dfdff7350e0102a625170bb69acf01";
-    hash = "sha256-cGY/FRV2BAS4fzJqIfD7FlIPIS0fCIIBenQYjB2dEsc=";
+    rev = "cf8a90c0c68338404e8a1434af0a6e65fc5d0a08";
+    hash = "sha256-3cz1VeDM0NHdYMiCDVnIq6Y/7rFSijhNrnxC36Yixxc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -30,7 +31,7 @@ stdenvNoCC.mkDerivation {
     install -Dm755 dra-cla $out/bin/dra-cla
 
     wrapProgram $out/bin/dra-cla \
-      --prefix PATH : ${lib.makeBinPath [ gnugrep gnused curl mpv aria2 ffmpeg openssl ]}
+      --prefix PATH : ${lib.makeBinPath [ gnugrep gnused curl mpv aria2 ffmpeg fzf openssl ]}
 
     runHook postInstall
   '';

pkgs/applications/video/handbrake/default.nix

@@ -26,7 +26,7 @@
 , numactl
 , writeText
   # Processing, video codecs, containers
-, ffmpeg_5-full
+, ffmpeg-full
 , nv-codec-headers
 , libogg
 , x264
@@ -69,6 +69,10 @@
   # for now we disable GTK GUI support on Darwin. (It may be possible to remove
   # this restriction later.)
 , useGtk ? !stdenv.isDarwin
+, bzip2
+, desktop-file-utils
+, meson
+, ninja
 , wrapGAppsHook
 , intltool
 , glib
@@ -86,64 +90,70 @@
 }:
 
 let
-  version = "1.6.1";
+  version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "HandBrake";
     repo = "HandBrake";
     rev = version;
-    sha256 = "sha256-0MJ1inMNA6s8l2S0wnpM2c7FxOoOHxs9u4E/rgKfjJo=";
+    hash = "sha256-4Q//UU/CPgWvhtpROfNPLzBvZlB02hbFe9Z9FA7mX04=";
   };
 
   # Handbrake maintains a set of ffmpeg patches. In particular, these
   # patches are required for subtitle timing to work correctly. See:
   # https://github.com/HandBrake/HandBrake/issues/4029
-  ffmpeg-version = "5.1.2";
-  ffmpeg-hb = ffmpeg_5-full.overrideAttrs (old: {
+  # base ffmpeg version is specified in:
+  # https://github.com/HandBrake/HandBrake/blob/master/contrib/ffmpeg/module.defs
+  ffmpeg-version = "6.1";
+  ffmpeg-hb = ffmpeg-full.overrideAttrs (old: {
     version = ffmpeg-version;
     src = fetchurl {
       url = "https://www.ffmpeg.org/releases/ffmpeg-${ffmpeg-version}.tar.bz2";
-      hash = "sha256-OaC8yNmFSfFsVwYkZ4JGpqxzbAZs69tAn5UC6RWyLys=";
+      hash = "sha256-632j3n3TzkiplGq0R6c0a9EaOoXm77jyws5jfn9UdhE=";
     };
-    patches = old.patches or [ ] ++ [
-      "${src}/contrib/ffmpeg/A01-qsv-libavfilter-qsvvpp-change-the-output-frame-s-width-a.patch"
-      "${src}/contrib/ffmpeg/A02-qsv-configure-ensure-enable-libmfx-uses-libmfx-1.x.patch"
-      "${src}/contrib/ffmpeg/A03-qsv-configure-fix-the-check-for-MFX_CODEC_VP9.patch"
-      "${src}/contrib/ffmpeg/A04-qsv-remove-mfx-prefix-from-mfx-headers.patch"
-      "${src}/contrib/ffmpeg/A05-qsv-load-user-plugin-for-MFX_VERSION-2.0.patch"
-      "${src}/contrib/ffmpeg/A06-qsv-build-audio-related-code-when-MFX_VERSION-2.0.patch"
-      "${src}/contrib/ffmpeg/A07-qsvenc-support-multi-frame-encode-when-MFX_VERSION-2.patch"
-      "${src}/contrib/ffmpeg/A08-qsvenc-support-MFX_RATECONTROL_LA_EXT-when-MFX_VERSI.patch"
-      "${src}/contrib/ffmpeg/A09-qsv-support-OPAQUE-memory-when-MFX_VERSION-2.0.patch"
-      "${src}/contrib/ffmpeg/A10-qsv-configure-add-enable-libvpl-option.patch"
-      "${src}/contrib/ffmpeg/A11-qsv-use-a-new-method-to-create-mfx-session-when-usin.patch"
-      "${src}/contrib/ffmpeg/A12-qsv-fix-decode-10bit-hdr.patch"
-      "${src}/contrib/ffmpeg/A13-mov-read-name-track-tag-written-by-movenc.patch"
-      "${src}/contrib/ffmpeg/A14-movenc-write-3gpp-track-titl-tag.patch"
-      "${src}/contrib/ffmpeg/A15-mov-read-3gpp-udta-tags.patch"
-      "${src}/contrib/ffmpeg/A16-movenc-write-3gpp-track-names-tags-for-all-available.patch"
-      "${src}/contrib/ffmpeg/A17-FFmpeg-devel-amfenc-Add-support-for-pict_type-field.patch"
-      "${src}/contrib/ffmpeg/A18-dvdsubdec-fix-processing-of-partial-packets.patch"
-      "${src}/contrib/ffmpeg/A19-ccaption_dec-return-number-of-bytes-used.patch"
-      "${src}/contrib/ffmpeg/A20-dvdsubdec-return-number-of-bytes-used.patch"
-      "${src}/contrib/ffmpeg/A21-dvdsubdec-use-pts-of-initial-packet.patch"
-      "${src}/contrib/ffmpeg/A22-matroskaenc-aac-extradata-updated.patch"
-      "${src}/contrib/ffmpeg/A23-ccaption_dec-fix-pts-in-real_time-mode.patch"
-      "${src}/contrib/ffmpeg/A24-fix-eac3-dowmix.patch"
-      "${src}/contrib/ffmpeg/A25-enable-truehd-pass.patch"
-      "${src}/contrib/ffmpeg/A26-Update-the-min-version-to-1.4.23.0-for-AMF-SDK.patch"
-      "${src}/contrib/ffmpeg/A27-avcodec-amfenc-Fixes-the-color-information-in-the-ou.patch"
-      "${src}/contrib/ffmpeg/A28-avcodec-amfenc-HDR-metadata.patch"
-      # This patch is not applying since ffmpeg 5.1.1, probably it was backported by upstream
-      # "${src}/contrib/ffmpeg/A30-svt-av1-backports.patch"
-      (fetchpatch {
-        name = "vulkan-remove-extensions.patch";
-        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff_plain/eb0455d64690";
-        hash = "sha256-qvLrb7b+9/bel8A2lZuSmBiJtHXsABw0Lvgn1ggnmCU=";
-      })
+    patches = (old.patches or [ ]) ++ [
+      "${src}/contrib/ffmpeg/A01-mov-read-name-track-tag-written-by-movenc.patch"
+      "${src}/contrib/ffmpeg/A02-movenc-write-3gpp-track-titl-tag.patch"
+      "${src}/contrib/ffmpeg/A03-mov-read-3gpp-udta-tags.patch"
+      "${src}/contrib/ffmpeg/A04-movenc-write-3gpp-track-names-tags-for-all-available.patch"
+      "${src}/contrib/ffmpeg/A05-dvdsubdec-fix-processing-of-partial-packets.patch"
+      "${src}/contrib/ffmpeg/A06-dvdsubdec-return-number-of-bytes-used.patch"
+      "${src}/contrib/ffmpeg/A07-dvdsubdec-use-pts-of-initial-packet.patch"
+      "${src}/contrib/ffmpeg/A08-ccaption_dec-fix-pts-in-real_time-mode.patch"
+      "${src}/contrib/ffmpeg/A09-matroskaenc-aac-extradata-updated.patch"
+      "${src}/contrib/ffmpeg/A10-amfenc-Add-support-for-pict_type-field.patch"
+      "${src}/contrib/ffmpeg/A11-amfenc-Fixes-the-color-information-in-the-ou.patch"
+      "${src}/contrib/ffmpeg/A12-amfenc-HDR-metadata.patch"
+      "${src}/contrib/ffmpeg/A13-libavcodec-amfenc-Fix-issue-with-missing-headers-in-.patch"
+      "${src}/contrib/ffmpeg/A14-avcodec-add-ambient-viewing-environment-packet-side-.patch"
+      "${src}/contrib/ffmpeg/A15-avformat-mov-add-support-for-amve-ambient-viewing-en.patch"
+      "${src}/contrib/ffmpeg/A16-videotoolbox-dec-h264.patch"
+
+      # patch to fix <https://github.com/HandBrake/HandBrake/issues/5011>
+      # commented out because it causes ffmpeg's filter-pixdesc-p010le test to fail.
+      # "${src}/contrib/ffmpeg/A17-libswscale-fix-yuv420p-to-p01xle-color-conversion-bu.patch"
+
+      "${src}/contrib/ffmpeg/A18-qsv-fix-decode-10bit-hdr.patch"
+      "${src}/contrib/ffmpeg/A19-ffbuild-common-use-gzip-n-flag-for-cuda.patch"
     ];
   });
 
+  x265-hb = x265.overrideAttrs (old: {
+    # nixpkgs' x265 sourceRoot is x265-.../source whereas handbrake's x265 patches
+    # are written with respect to the parent directory instead of that source directory.
+    # patches which don't cleanly apply are commented out.
+    postPatch = (old.postPatch or "") + ''
+      pushd ..
+      # patch -p1 < ${src}/contrib/x265/A00-crosscompile-fix.patch
+      patch -p1 < ${src}/contrib/x265/A01-threads-priority.patch
+      patch -p1 < ${src}/contrib/x265/A02-threads-pool-adjustments.patch
+      patch -p1 < ${src}/contrib/x265/A03-sei-length-crash-fix.patch
+      patch -p1 < ${src}/contrib/x265/A04-ambient-viewing-enviroment-sei.patch
+      # patch -p1 < ${src}/contrib/x265/A05-memory-leaks.patch
+      popd
+    '';
+  });
+
   versionFile = writeText "version.txt" ''
     BRANCH=${versions.majorMinor version}.x
     DATE=1970-01-01 00:00:01 +0000
@@ -189,6 +199,17 @@ let
       # Use the Nix-provided libxml2 instead of the system-provided one.
       substituteInPlace libhb/module.defs \
         --replace /usr/include/libxml2 ${libxml2.dev}/include/libxml2
+    '' + optionalString useGtk ''
+      substituteInPlace gtk/module.rules \
+        --replace-fail '$(MESON.exe)' 'meson' \
+        --replace-fail '$(NINJA.exe)' 'ninja' \
+      # Force using nixpkgs dependencies
+      substituteInPlace gtk/meson.build \
+        --replace-fail "cc.find_library('bz2', dirs: hb_libdirs)" "cc.find_library('bz2')" \
+        --replace-fail "cc.find_library('mp3lame', dirs: hb_libdirs)" "cc.find_library('mp3lame')" \
+        --replace-fail \
+          "hb_incdirs = include_directories(hb_dir / 'libhb', hb_dir / 'contrib/include')" \
+          "hb_incdirs = include_directories(hb_dir / 'libhb')" \
     '';
 
     nativeBuildInputs = [
@@ -199,7 +220,7 @@ let
       pkg-config
       python3
     ]
-    ++ optionals useGtk [ intltool wrapGAppsHook ];
+    ++ optionals useGtk [ desktop-file-utils intltool meson ninja wrapGAppsHook ];
 
     buildInputs = [
       a52dec
@@ -228,12 +249,13 @@ let
       speex
       svt-av1
       x264
-      x265
+      x265-hb
       xz
       zimg
     ]
     ++ optional (!stdenv.isDarwin) numactl
     ++ optionals useGtk [
+      bzip2
       dbus-glib
       glib
       gst_all_1.gst-plugins-base
@@ -254,7 +276,6 @@ let
     configureFlags = [
       "--disable-df-fetch"
       "--disable-df-verify"
-      "--disable-gtk-update-checks"
     ]
     ++ optional (!useGtk) "--disable-gtk"
     ++ optional useFdk "--enable-fdk-aac"
@@ -264,10 +285,19 @@ let
     # NOTE: 2018-12-27: Check NixOS HandBrake test if changing
     NIX_LDFLAGS = [ "-lx265" ];
 
+    # meson/ninja are used only for the subprojects, not the toplevel
+    dontUseMesonConfigure = true;
+    dontUseMesonInstall = true;
+    dontUseNinjaBuild = true;
+    dontUseNinjaInstall = true;
+
     makeFlags = [ "--directory=build" ];
 
-    passthru.tests = {
-      basic-conversion =
+    passthru = {
+      # for convenience
+      inherit ffmpeg-hb x265-hb;
+
+      tests.basic-conversion =
         let
           # Big Buck Bunny example, licensed under CC Attribution 3.0.
           testMkv = fetchurl {
@@ -283,7 +313,8 @@ let
           HandBrakeCLI -i ${testMkv} -o test.mkv -e x264 -q 20 -B 160
           test -e test.mkv
         '';
-      version = testers.testVersion { package = self; command = "HandBrakeCLI --version"; };
+
+      tests.version = testers.testVersion { package = self; command = "HandBrakeCLI --version"; };
     };
 
     meta = with lib; {
@@ -300,7 +331,7 @@ let
       license = licenses.gpl2Only;
       maintainers = with maintainers; [ Anton-Latukha wmertens ];
       platforms = with platforms; unix;
-      broken = stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "10.13";
+      broken = stdenv.isDarwin;  # https://github.com/NixOS/nixpkgs/pull/297984#issuecomment-2016503434
     };
   };
 in

pkgs/applications/video/kodi/addons/trakt/default.nix

@@ -2,11 +2,11 @@
 buildKodiAddon rec {
   pname = "trakt";
   namespace = "script.trakt";
-  version = "3.5.0";
+  version = "3.6.1";
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/nexus/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-OyU6S5r/y3vqW6Wg6OP0+Zn4YchBy8x1i++hzCQHyx0=";
+    sha256 = "sha256-ZlBucYYRA1cL5c0H1jhXeKE1itReZe2gAJYFFxuUebo=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/obs-studio/plugins/obs-source-clone.nix

@@ -5,22 +5,22 @@
 , obs-studio
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "obs-source-clone";
-  version = "0.1.4";
+  version = "0.1.4-unstable-2024-02-19";
 
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-source-clone";
-    rev = version;
-    sha256 = "sha256-E2pHJO3cdOXmSlTVGsz4tncm9fMaa8Rhsq9YZDNidjs=";
+    rev = "d1524d5d932d6841a1fbd6061cc4a0033fb615b7";
+    hash = "sha256-W9IIIGQdreI2FQGii5NUB5tVHcqsiYAKTutOHEPCyms=";
   };
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ obs-studio ];
 
   cmakeFlags = [
-    "-DBUILD_OUT_OF_TREE=On"
+    (lib.cmakeBool "BUILD_OUT_OF_TREE" true)
   ];
 
   postInstall = ''
@@ -32,6 +32,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/exeldro/obs-source-clone";
     maintainers = with maintainers; [ flexiondotorg ];
     license = licenses.gpl2Plus;
-    platforms = [ "x86_64-linux" "i686-linux" ];
+    platforms = platforms.linux;
   };
 }

pkgs/applications/virtualization/docker/default.nix

@@ -12,7 +12,7 @@ rec {
       # package dependencies
       , stdenv, fetchFromGitHub, fetchpatch, buildGoPackage
       , makeWrapper, installShellFiles, pkg-config, glibc
-      , go-md2man, go, containerd, runc, docker-proxy, tini, libtool
+      , go-md2man, go, containerd, runc, tini, libtool
       , sqlite, iproute2, docker-buildx, docker-compose, docker-sbom
       , iptables, e2fsprogs, xz, util-linux, xfsprogs, git
       , procps, rootlesskit, slirp4netns, fuse-overlayfs, nixosTests
@@ -137,6 +137,7 @@ rec {
       installPhase = ''
         cd ./go/src/${goPackagePath}
         install -Dm755 ./bundles/dynbinary-daemon/dockerd $out/libexec/docker/dockerd
+        install -Dm755 ./bundles/dynbinary-daemon/docker-proxy $out/libexec/docker/docker-proxy
 
         makeWrapper $out/libexec/docker/dockerd $out/bin/dockerd \
           --prefix PATH : "$out/libexec/docker:$extraPath"
@@ -144,7 +145,6 @@ rec {
         ln -s ${docker-containerd}/bin/containerd $out/libexec/docker/containerd
         ln -s ${docker-containerd}/bin/containerd-shim $out/libexec/docker/containerd-shim
         ln -s ${docker-runc}/bin/runc $out/libexec/docker/runc
-        ln -s ${docker-proxy}/bin/docker-proxy $out/libexec/docker/docker-proxy
         ln -s ${docker-tini}/bin/tini-static $out/libexec/docker/docker-init
 
         # systemd
@@ -172,7 +172,7 @@ rec {
   buildGoPackage (lib.optionalAttrs (!clientOnly) {
     # allow overrides of docker components
     # TODO: move packages out of the let...in into top-level to allow proper overrides
-    inherit docker-runc docker-containerd docker-proxy docker-tini moby;
+    inherit docker-runc docker-containerd docker-tini moby;
   } // rec {
     pname = "docker";
     inherit version;

pkgs/applications/virtualization/docker/proxy.nix

@@ -1,28 +0,0 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
-
-buildGoPackage rec {
-  pname = "docker-proxy";
-  version = "unstable-2020-12-15";
-
-  src = fetchFromGitHub {
-    owner = "docker";
-    repo = "libnetwork";
-    rev = "fa125a3512ee0f6187721c88582bf8c4378bd4d7";
-    sha256 = "1r47y0gww3j7fas4kgiqbhrz5fazsx1c6sxnccdfhj8fzik77s9y";
-  };
-
-  goPackagePath = "github.com/docker/libnetwork";
-
-  installPhase = ''
-    install -m755 -D ./go/bin/proxy $out/bin/docker-proxy
-  '';
-
-  meta = with lib; {
-    description = "Docker proxy binary to forward traffic between host and containers";
-    mainProgram = "docker-proxy";
-    license = licenses.asl20;
-    homepage = "https://github.com/docker/libnetwork";
-    maintainers = with maintainers; [vdemeester];
-    platforms = platforms.linux;
-  };
-}

pkgs/applications/virtualization/virtualbox/default.nix

@@ -116,11 +116,11 @@ in stdenv.mkDerivation {
      # we don't take any chances and only apply it if people actually want to use KVM support.
   ++ optional enableKvm (fetchpatch
     (let
-      patchVersion = "20240226";
+      patchVersion = "20240325";
     in {
       name = "virtualbox-${version}-kvm-dev-${patchVersion}.patch";
-      url = "https://github.com/cyberus-technology/virtualbox-kvm/releases/download/dev-${patchVersion}/virtualbox-${version}-kvm-dev-${patchVersion}.patch";
-      hash = "sha256-3YT1ZN/TwoNWNb2eqOcPF8GTrVGfOPaPb8vpGoPNISY=";
+      url = "https://github.com/cyberus-technology/virtualbox-kvm/releases/download/dev-${patchVersion}/kvm-backend-${version}-dev-${patchVersion}.patch";
+      hash = "sha256-D1ua8X5Iyw/I89PtskiGdnGr4NhdFtI93ThltiOcu8w=";
     }))
   ++ [
     ./qt-dependency-paths.patch
@@ -281,7 +281,7 @@ in stdenv.mkDerivation {
     ];
     license = licenses.gpl2;
     homepage = "https://www.virtualbox.org/";
-    maintainers = with maintainers; [ sander friedrichaltheide ];
+    maintainers = with maintainers; [ sander friedrichaltheide blitz ];
     platforms = [ "x86_64-linux" ];
     mainProgram = "VirtualBox";
   };

pkgs/build-support/build-fhsenv-bubblewrap/default.nix

@@ -123,6 +123,8 @@ let
     ro_mounts=()
     symlinks=()
     etc_ignored=()
+
+    # loop through all entries of root in the fhs environment, except its /etc.
     for i in ${fhsenv}/*; do
       path="/''${i##*/}"
       if [[ $path == '/etc' ]]; then
@@ -136,6 +138,7 @@ let
       fi
     done
 
+    # loop through the entries of /etc in the fhs environment.
     if [[ -d ${fhsenv}/etc ]]; then
       for i in ${fhsenv}/etc/*; do
         path="/''${i##*/}"
@@ -144,7 +147,11 @@ let
         if [[ $path == '/fonts' || $path == '/ssl' ]]; then
           continue
         fi
-        ro_mounts+=(--ro-bind "$i" "/etc$path")
+        if [[ -L $i ]]; then
+          symlinks+=(--symlink "$i" "/etc$path")
+        else
+          ro_mounts+=(--ro-bind "$i" "/etc$path")
+        fi
         etc_ignored+=("/etc$path")
       done
     fi
@@ -156,6 +163,7 @@ let
       ro_mounts+=(--ro-bind /etc /.host-etc)
     fi
 
+    # link selected etc entries from the actual root
     for i in ${lib.escapeShellArgs etcBindEntries}; do
       if [[ "''${etc_ignored[@]}" =~ "$i" ]]; then
         continue

pkgs/by-name/af/affine/package.nix

@@ -0,0 +1,68 @@
+{ lib
+, writeText
+, fetchurl
+, stdenvNoCC
+, copyDesktopItems
+, makeDesktopItem
+, makeWrapper
+, unzip
+, bash
+, electron
+, commandLineArgs ? ""
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: let
+  icon = fetchurl {
+    url = "https://raw.githubusercontent.com/toeverything/AFFiNE/v${finalAttrs.version}/packages/frontend/core/public/favicon-192.png";
+    hash = "sha256-smZ5W7fy3TK3bvjwV4i71j2lVmKSZcyhMhcWfPxNnN4=";
+  };
+in {
+  pname = "affine";
+  version = "0.13.1";
+  src = fetchurl {
+    url = "https://github.com/toeverything/AFFiNE/releases/download/v${finalAttrs.version}/affine-${finalAttrs.version}-stable-linux-x64.zip";
+    hash = "sha256-2Du5g/I82iTr8Bwb+qkLzyfbk1OrOlXqx6FHImVoAoE=";
+  };
+  nativeBuildInputs = [
+    copyDesktopItems
+    makeWrapper
+    unzip
+  ];
+  postInstall = ''
+    mkdir -p $out/lib
+    cp -r ./resources/* -t $out/lib/
+    cp LICENSE* $out/
+    install -Dm644 ${icon} $out/share/pixmaps/affine.png
+    makeWrapper "${electron}/bin/electron" $out/bin/affine \
+      --inherit-argv0 \
+      --add-flags $out/lib/app.asar \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags ${lib.escapeShellArg commandLineArgs}
+  '';
+  desktopItems = [
+    (makeDesktopItem {
+      name = "affine";
+      desktopName = "AFFiNE";
+      exec = "affine %U";
+      terminal = false;
+      icon = "affine";
+      startupWMClass = "affine";
+      categories = ["Utility"];
+    })
+  ];
+  meta = with lib; {
+    description = "A workspace with fully merged docs, whiteboards and databases";
+    longDescription = ''
+      AFFiNE is an open-source, all-in-one workspace and an operating
+      system for all the building blocks that assemble your knowledge
+      base and much more -- wiki, knowledge management, presentation
+      and digital assets
+    '';
+    homepage = "https://affine.pro/";
+    downloadPage = "https://affine.pro/download";
+    license = licenses.mit;
+    maintainers = with maintainers; [richar];
+    mainProgram = "affine";
+    platforms = ["x86_64-linux"];
+  };
+})

pkgs/by-name/at/atari800/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "atari800";
-  version = "5.1.0";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "atari800";
     repo = "atari800";
     rev = "ATARI800_${lib.replaceStrings ["."] ["_"] finalAttrs.version}";
-    hash = "sha256-OZj0x9+M3jkiXUWgB93JTQzi4OUSBCZ3KtniwcZeVB0=";
+    hash = "sha256-D66YRRTqdoV9TqDFonJ9XNpfP52AicuYgdiW27RCIuQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/at/atlauncher/package.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "atlauncher";
-  version = "3.4.35.4";
+  version = "3.4.35.9";
 
   src = fetchurl {
     url = "https://github.com/ATLauncher/ATLauncher/releases/download/v${finalAttrs.version}/ATLauncher-${finalAttrs.version}.jar";
-    hash = "sha256-M8ygN70yizJM6VEffBh/lH/DneKAzQ5UFzc3g51dja0=";
+    hash = "sha256-Y2MGhzq4IbtjEG+CER+FWU8CY+hn5ehjMOcP02zIsR4=";
   };
 
   env.ICON = fetchurl {

pkgs/by-name/au/autosuspend/package.nix

@@ -1,31 +1,13 @@
 { lib
+, dbus
 , fetchFromGitHub
 , fetchPypi
 , python3
 }:
 
-let
-  python = python3.override {
-    packageOverrides = self: super: {
-      # autosuspend is incompatible with tzlocal v5
-      # See https://github.com/regebro/tzlocal#api-change
-      tzlocal = super.tzlocal.overridePythonAttrs (prev: rec {
-        version = "4.3.1";
-        src = fetchPypi {
-          inherit (prev) pname;
-          inherit version;
-          hash = "sha256-7jLvjCCAPBmpbtNmrd09SnKe9jCctcc1mgzC7ut/pGo=";
-        };
-        propagatedBuildInputs = with self; [
-          pytz-deprecation-shim
-        ];
-      });
-    };
-  };
-in
-python.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "autosuspend";
-  version = "6.0.0";
+  version = "6.1.1";
 
   disabled = python3.pythonOlder "3.8";
 
@@ -33,15 +15,15 @@ python.pkgs.buildPythonApplication rec {
     owner = "languitar";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-gS8NNks4GaIGl7cEqWSP53I4/tIV4LypkmZ5vNOjspY=";
+    hash = "sha256-LGU/yhwuc6BuctCibm0AaRheQkuSIgEVXzcWQHCJ/8Y=";
   };
 
   postPatch = ''
     substituteInPlace setup.cfg \
-      --replace '--cov-config=setup.cfg' ""
+      --replace-fail '--cov-config=setup.cfg' ""
   '';
 
-  propagatedBuildInputs = with python.pkgs; [
+  dependencies = with python3.pkgs; [
     dbus-python
     icalendar
     jsonpath-ng
@@ -56,7 +38,8 @@ python.pkgs.buildPythonApplication rec {
     tzlocal
   ];
 
-  nativeCheckInputs = with python.pkgs; [
+  nativeCheckInputs = with python3.pkgs; [
+    dbus
     freezegun
     pytest-datadir
     pytest-httpserver

pkgs/by-name/ba/backgroundremover/package.nix

@@ -0,0 +1,92 @@
+{ python3
+, lib
+, runCommand
+, fetchFromGitHub
+, fetchurl
+}:
+
+let
+  p = python3.pkgs;
+  self = p.buildPythonApplication rec {
+    pname = "backgroundremover";
+    version = "0.2.6";
+    pyproject = true;
+
+    src = fetchFromGitHub {
+      owner = "nadermx";
+      repo = "backgroundremover";
+      rev = "v${version}";
+      hash = "sha256-dDOo7NPwvdfV+ae2oMUytCGC+2HF6xUI7dyKk2we23w=";
+    };
+
+    models = runCommand "background-remover-models" {} ''
+      mkdir $out
+      cat ${src}/models/u2a{a,b,c,d} > $out/u2net.pth
+      cat ${src}/models/u2ha{a,b,c,d} > $out/u2net_human_seg.pth
+      cp ${src}/models/u2netp.pth $out
+    '';
+
+    postPatch = ''
+      substituteInPlace backgroundremover/bg.py backgroundremover/u2net/detect.py \
+        --replace 'os.path.expanduser(os.path.join("~", ".u2net", model_name + ".pth"))' "os.path.join(\"$models\", model_name + \".pth\")"
+    '';
+
+    nativeBuildInputs = [ p.setuptools p.wheel ];
+
+    propagatedBuildInputs = [
+      p.certifi
+      p.charset-normalizer
+      p.ffmpeg-python
+      p.filelock
+      p.filetype
+      p.hsh
+      p.idna
+      p.more-itertools
+      p.moviepy
+      p.numpy
+      p.pillow
+      p.pymatting
+      p.pysocks
+      p.requests
+      p.scikit-image
+      p.scipy
+      p.six
+      p.torch
+      p.torchvision
+      p.tqdm
+      p.urllib3
+      p.waitress
+    ];
+
+    pythonImportsCheck = [ "backgroundremover" ];
+
+    passthru = {
+      inherit models;
+      tests = {
+        image = let
+          # random no copyright car image from the internet
+          demoImage = fetchurl {
+            url = "https://pics.craiyon.com/2023-07-16/38653769ac3b4e068181cb5ab1e542a1.webp";
+            hash = "sha256-Kvd06eZdibgDbabVVe0+cNTeS1rDnMXIZZpPlHIlfBo=";
+          };
+        in runCommand "backgroundremover-image-test.png" {
+          buildInputs = [ self ];
+        } ''
+          export NUMBA_CACHE_DIR=$(mktemp -d)
+          backgroundremover -i ${demoImage} -o $out
+        '';
+      };
+    };
+
+    doCheck = false; # no tests
+
+    meta = with lib; {
+      mainProgram = "backgroundremover";
+      description = "Command line tool to remove background from image and video, made by nadermx to power";
+      homepage = "https://BackgroundRemoverAI.com";
+      downloadPage = "https://github.com/nadermx/backgroundremover/releases";
+      license = licenses.mit;
+      maintainers = [ maintainers.lucasew ];
+    };
+  };
+in self

pkgs/by-name/ba/backgroundremover/test-script.py

@@ -0,0 +1,20 @@
+from argparse import ArgumentParser
+from pathlib import Path
+
+import backgroundremover.utilities as utilities
+from backgroundremover import bg
+
+parser = ArgumentParser()
+
+parser.add_argument('input', type=Path)
+parser.add_argument('output', type=Path)
+
+args = parser.parse_args()
+
+input_bytes = args.input.read_bytes()
+
+output_bytes = bg.remove(
+  input_bytes,
+)
+
+args.output.write_bytes(output_bytes)

pkgs/by-name/bi/bibata-cursors/package.nix

@@ -0,0 +1,58 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, fetchzip
+, clickgen
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "bibata-cursors";
+  version = "2.0.6";
+
+  src = fetchFromGitHub {
+    owner = "ful1e5";
+    repo = "Bibata_Cursor";
+    rev = "v${version}";
+    hash = "sha256-iLBgQ0reg8HzUQMUcZboMYJxqpKXks5vJVZMHirK48k=";
+  };
+
+  bitmaps = fetchzip {
+    url = "https://github.com/ful1e5/Bibata_Cursor/releases/download/v${version}/bitmaps.zip";
+    hash = "sha256-8ujkyqby5sPcnscIPkay1gvd/1CH4R9yMJs1nH/mx8M=";
+  };
+
+  nativeBuildInputs = [
+    clickgen
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    ctgen build.toml -p x11 -d $bitmaps/Bibata-Modern-Amber -n 'Bibata-Modern-Amber' -c 'Yellowish and rounded edge bibata cursors.'
+    ctgen build.toml -p x11 -d $bitmaps/Bibata-Modern-Classic -n 'Bibata-Modern-Classic' -c 'Black and rounded edge Bibata cursors.'
+    ctgen build.toml -p x11 -d $bitmaps/Bibata-Modern-Ice -n 'Bibata-Modern-Ice' -c 'White and rounded edge Bibata cursors.'
+
+    ctgen build.toml -p x11 -d $bitmaps/Bibata-Original-Amber -n 'Bibata-Original-Amber' -c 'Yellowish and sharp edge Bibata cursors.'
+    ctgen build.toml -p x11 -d $bitmaps/Bibata-Original-Classic -n 'Bibata-Original-Classic' -c 'Black and sharp edge Bibata cursors.'
+    ctgen build.toml -p x11 -d $bitmaps/Bibata-Original-Ice -n 'Bibata-Original-Ice' -c 'White and sharp edge Bibata cursors.'
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -dm 0755 $out/share/icons
+    cp -rf themes/* $out/share/icons/
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Material Based Cursor Theme";
+    homepage = "https://github.com/ful1e5/Bibata_Cursor";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ rawkode AdsonCicilioti ];
+  };
+}

pkgs/by-name/br/bruno/package.nix

@@ -16,6 +16,7 @@
 , npm-lockfile-fix
 , overrideSDK
 , darwin
+, fetchpatch
 }:
 
 let
@@ -24,23 +25,31 @@ let
     buildNpmPackage.override {
       stdenv = if stdenv.isDarwin then overrideSDK stdenv "11.0" else stdenv;
     };
+  # update package-lock to fix build errors. this will be resolved in the
+  # next patch version of Bruno at which point the patch can be removed entirely.
+  # upstream PR: https://github.com/usebruno/bruno/pull/1894
+  brunoLockfilePatch_1_12_2 = fetchpatch {
+    url = "https://github.com/usebruno/bruno/pull/1894/commits/e3bab23446623315ee674283285a86e210778fe7.patch";
+    hash = "sha256-8rYBvgu9ZLXjb9AFyk4yMBVjcyFPmlNi66YEaQGQaKw=";
+  };
 in
 buildNpmPackage' rec {
   pname = "bruno";
-  version = "1.11.0";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "usebruno";
     repo = "bruno";
     rev = "v${version}";
-    hash = "sha256-Urskhzs00OEucoR17NDXNtnrcXk9h75E806Re0HvYyw=";
+    hash = "sha256-C/WeEloUGF0PEfeanm6lHe/MgpcF+g/ZY2tnqXFl9LA=";
 
     postFetch = ''
+      patch -d $out <${brunoLockfilePatch_1_12_2}
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json
     '';
   };
 
-  npmDepsHash = "sha256-48xzx7dTalceXzjFBHIkkUS83pqP/OQ0L2tnMESpHII=";
+  npmDepsHash = "sha256-Zt5cVB1S86iPYKOUj7FwyR97lwmnFz6sZ+S3Ms/b9+o=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   nativeBuildInputs = [

pkgs/by-name/de/decker/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "decker";
-  version = "1.39";
+  version = "1.41";
 
   src = fetchFromGitHub {
     owner = "JohnEarnest";
     repo = "Decker";
     rev = "v${version}";
-    hash = "sha256-77x+LT+oTDtK4jszL3A9MAv9Hakovz47yFaiu8kFtTg=";
+    hash = "sha256-AnWFAa96/lO5to7mVzHGkyzJ8U+2A9u9N1w91vHDsFo=";
   };
 
   buildInputs = [

pkgs/by-name/de/delfin/package.nix

@@ -21,20 +21,20 @@
 
 stdenv.mkDerivation rec {
   pname = "delfin";
-  version = "0.4.0";
+  version = "0.4.2";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "avery42";
     repo = "delfin";
     rev = "v${version}";
-    hash = "sha256-QwxdNPLL7PBokq5WaPylD4bBmXmJWyEQsWKN7DM2utk=";
+    hash = "sha256-7GHwwwFibmwBcrlC2zSpEUZ2dca14wZFU6PJWjincPQ=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-ElB9TbfmYn/A1Y3+oQ752zHqkC+f2RJPxfGXH0m5C/E=";
+    hash = "sha256-zlecw6230AC/+y537iEhJU+BgWRs2WCFP0AIcxchZBA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/de/devenv/package.nix

@@ -1,14 +1,18 @@
-{ stdenv
-, lib
-, openssl
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeWrapper
+, rustPlatform
+, testers
+
+, cachix
 , darwin
 , libgit2
-, makeWrapper
 , nix
+, openssl
 , pkg-config
-, rustPlatform
-, cachix
-, fetchFromGitHub
+
+, devenv  # required to run version test
 }:
 
 let
@@ -25,7 +29,7 @@ let
     doInstallCheck = false;
   });
 
-  version = "1.0.1";
+  version = "1.0.2";
 in rustPlatform.buildRustPackage {
   pname = "devenv";
   inherit version;
@@ -34,12 +38,10 @@ in rustPlatform.buildRustPackage {
     owner = "cachix";
     repo = "devenv";
     rev = "v${version}";
-    hash = "sha256-9LnGe0KWqXj18IV+A1panzXQuTamrH/QcasaqnuqiE0=";
+    hash = "sha256-JCxjmWr2+75KMPOoVybNZhy9zhhrg9BAKA8D+J6MNBc=";
   };
 
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-  };
+  cargoHash = "sha256-FGB8p9ClGokYDrV0b47PnjeSlOv7p+IgThNajve3yms=";
 
   nativeBuildInputs = [ makeWrapper pkg-config ];
 
@@ -51,6 +53,13 @@ in rustPlatform.buildRustPackage {
     wrapProgram $out/bin/devenv --set DEVENV_NIX ${devenv_nix} --prefix PATH ":" "$out/bin:${cachix}/bin"
   '';
 
+  passthru.tests = {
+    version = testers.testVersion {
+      package = devenv;
+      command = "export XDG_DATA_HOME=$PWD; devenv version";
+    };
+  };
+
   meta = {
     changelog = "https://github.com/cachix/devenv/releases/tag/v${version}";
     description = "Fast, Declarative, Reproducible, and Composable Developer Environments";

pkgs/by-name/di/disko/package.nix

@@ -9,12 +9,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   name = "disko";
-  version = "1.4.1";
+  version = "1.5.0";
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "disko";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-HeWFrRuHpnAiPmIr26OKl2g142HuGerwoO/XtW53pcI=";
+    hash = "sha256-5DUNQl9BSmLxgGLbF05G7hi/UTk9DyZq8AuEszhQA7Q=";
   };
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ bash ];

pkgs/by-name/ep/epub-thumbnailer/package.nix

@@ -0,0 +1,40 @@
+{ lib
+, python3
+, fetchFromGitHub
+, unstableGitUpdater
+}:
+
+python3.pkgs.buildPythonApplication {
+  pname = "epub-thumbnailer";
+  version = "0-unstable-2024-03-16";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "marianosimone";
+    repo = "epub-thumbnailer";
+    rev = "035c31e9269bcb30dcc20fed31b6dc54e9bfed63";
+    hash = "sha256-G/CeYmr+wgJidbavfvIuCbRLJGQzoxAnpo3t4YFJq0c=";
+  };
+
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pillow
+  ];
+
+  postInstall = ''
+    mv $out/bin/epub-thumbnailer.py $out/bin/epub-thumbnailer
+  '';
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = with lib; {
+    description = "Script to extract the cover of an epub book and create a thumbnail for it";
+    homepage = "https://github.com/marianosimone/epub-thumbnailer";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ GaetanLepage ];
+    mainProgram = "epub-thumbnailer";
+  };
+}

pkgs/by-name/fi/firefoxpwa/package.nix

@@ -0,0 +1,133 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, makeWrapper
+, pkg-config
+, installShellFiles
+, firefox-unwrapped
+, openssl
+, stdenv
+, udev
+, libva
+, mesa
+, libnotify
+, xorg
+, cups
+, pciutils
+, libcanberra-gtk3
+, extraLibs ? [ ]
+, nixosTests
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "firefoxpwa";
+  version = "2.11.1";
+
+  src = fetchFromGitHub {
+    owner = "filips123";
+    repo = "PWAsForFirefox";
+    rev = "v${version}";
+    hash = "sha256-ZD/bTziVmHtQVKejzj+fUXVazCm2PaulS2NZjTribSk=";
+  };
+
+  sourceRoot = "${src.name}/native";
+  buildFeatures = [ "immutable-runtime" ];
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "mime-0.4.0-a.0" = "sha256-LjM7LH6rL3moCKxVsA+RUL9lfnvY31IrqHa9pDIAZNE=";
+      "web_app_manifest-0.0.0" = "sha256-G+kRN8AEmAY1TxykhLmgoX8TG8y2lrv7SCRJlNy0QzA=";
+    };
+  };
+
+  preConfigure = ''
+    sed -i 's;version = "0.0.0";version = "${version}";' Cargo.toml
+    sed -zi 's;name = "firefoxpwa"\nversion = "0.0.0";name = "firefoxpwa"\nversion = "${version}";' Cargo.lock
+    sed -i $'s;DISTRIBUTION_VERSION = \'0.0.0\';DISTRIBUTION_VERSION = \'${version}\';' userchrome/profile/chrome/pwa/chrome.jsm
+  '';
+
+  nativeBuildInputs = [ makeWrapper pkg-config installShellFiles ];
+  buildInputs = [ openssl ];
+
+  FFPWA_EXECUTABLES = ""; # .desktop entries generated without any store path references
+  FFPWA_SYSDATA = "${placeholder "out"}/share/firefoxpwa";
+  completions = "target/${stdenv.targetPlatform.config}/release/completions";
+
+  gtk_modules = map (x: x + x.gtkModule) [ libcanberra-gtk3 ];
+  libs = let libs = lib.optionals stdenv.isLinux [ udev libva mesa libnotify xorg.libXScrnSaver cups pciutils ] ++ gtk_modules ++ extraLibs; in lib.makeLibraryPath libs + ":" + lib.makeSearchPathOutput "lib" "lib64" libs;
+
+  postInstall = ''
+    # Runtime
+    mkdir -p $out/share/firefoxpwa
+    cp -Lr ${firefox-unwrapped}/lib/firefox $out/share/firefoxpwa/runtime
+    chmod -R +w $out/share/firefoxpwa
+
+    # UserChrome
+    cp -r userchrome $out/share/firefoxpwa
+
+    # Runtime patching
+    FFPWA_USERDATA=$out/share/firefoxpwa $out/bin/firefoxpwa runtime patch
+
+    # Manifest
+    sed -i "s!/usr/libexec!$out/bin!" manifests/linux.json
+    install -Dm644 manifests/linux.json $out/lib/mozilla/native-messaging-hosts/firefoxpwa.json
+
+    installShellCompletion --cmd firefoxpwa \
+      --bash $completions/firefoxpwa.bash \
+      --fish $completions/firefoxpwa.fish \
+      --zsh $completions/_firefoxpwa
+
+    # AppStream Metadata
+    install -Dm644 packages/appstream/si.filips.FirefoxPWA.metainfo.xml $out/share/metainfo/si.filips.FirefoxPWA.metainfo.xml
+    install -Dm644 packages/appstream/si.filips.FirefoxPWA.svg $out/share/icons/hicolor/scalable/apps/si.filips.FirefoxPWA.svg
+
+    wrapProgram $out/bin/firefoxpwa \
+      --prefix FFPWA_SYSDATA : "$out/share/firefoxpwa" \
+      --prefix LD_LIBRARY_PATH : "$libs" \
+      --suffix-each GTK_PATH : "$gtk_modules"
+
+    wrapProgram $out/bin/firefoxpwa-connector \
+      --prefix FFPWA_SYSDATA : "$out/share/firefoxpwa" \
+      --prefix LD_LIBRARY_PATH : "$libs" \
+      --suffix-each GTK_PATH : "$gtk_modules"
+  '';
+
+  passthru.tests.firefoxpwa = nixosTests.firefoxpwa;
+
+  meta = with lib; {
+    description = "A tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)";
+    longDescription = ''
+      Progressive Web Apps (PWAs) are web apps that use web APIs and features along
+      with progressive enhancement strategy to bring a native app-like user experience
+      to cross-platform web applications. Although Firefox supports many of Progressive
+      Web App APIs, it does not support functionality to install them as a standalone
+      system app with an app-like experience.
+
+      This project creates a custom modified Firefox runtime to allow websites to be
+      installed as standalone apps and provides a console tool and browser extension
+      to install, manage and use them.
+
+      This package contains only the native part of the PWAsForFirefox project. You
+      should also install the browser extension if you haven't already. You can download
+      it from the [Firefox Add-ons](https://addons.mozilla.org/firefox/addon/pwas-for-firefox/)
+      website.
+
+      To install the package on NixOS, you need to add the following options:
+
+      ```
+      programs.firefox.nativeMessagingHosts.packages = [ pkgs.firefoxpwa ];
+      environment.systemPackages = [ pkgs.firefoxpwa ];
+      ```
+
+      As it needs to be both in the `PATH` and in the `nativeMessagingHosts` to make it
+      possible for the extension to detect and use it.
+    '';
+    homepage = "https://pwasforfirefox.filips.si/";
+    changelog = "https://github.com/filips123/PWAsForFirefox/releases/tag/v${version}";
+    license = licenses.mpl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ camillemndn pasqui23 ];
+    mainProgram = "firefoxpwa";
+  };
+}

pkgs/by-name/fo/forbidden/package.nix

@@ -0,0 +1,51 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "forbidden";
+  version = "10.8";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ivan-sincek";
+    repo = "forbidden";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-jitmgN+We6m5CTgRc1NYwZkg5GYvD6ZlJ8FKtTa+rAY=";
+  };
+
+  pythonRemoveDeps = [
+    # https://github.com/ivan-sincek/forbidden/pull/3
+    "argparse"
+  ];
+
+  build-system = with python3.pkgs; [
+    pythonRelaxDepsHook
+    setuptools
+  ];
+
+  dependencies = with python3.pkgs; [
+    colorama
+    datetime
+    pycurl
+    pyjwt
+    regex
+    requests
+    tabulate
+    termcolor
+  ];
+
+  pythonImportsCheck = [
+    "forbidden"
+  ];
+
+  meta = with lib; {
+    description = "Tool to bypass 4xx HTTP response status code";
+    homepage = "https://github.com/ivan-sincek/forbidden";
+    changelog = "https://github.com/ivan-sincek/forbidden/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "forbidden";
+  };
+}

pkgs/by-name/fr/frankenphp/package.nix

@@ -26,13 +26,13 @@ let
   pieBuild = stdenv.hostPlatform.isMusl;
 in buildGoModule rec {
   pname = "frankenphp";
-  version = "1.1.0";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "dunglas";
     repo = "frankenphp";
     rev = "v${version}";
-    hash = "sha256-tQ35GZuw7Ag1YfmOUarVY45yk4yugNLJetEV4m2w3GE=";
+    hash = "sha256-r6BMlcjvRbVnBHsfRhJyMiyZzH2Z+FLOYz6ik4I8p+A=";
   };
 
   sourceRoot = "${src.name}/caddy";
@@ -40,7 +40,7 @@ in buildGoModule rec {
   # frankenphp requires C code that would be removed with `go mod tidy`
   # https://github.com/golang/go/issues/26366
   proxyVendor = true;
-  vendorHash = "sha256-sv3IcNj1rjolgF0HZZnJ3dLV9+QeRw3ItRguz6Un9CY=";
+  vendorHash = "sha256-gxBD2KPkWtAM0MsaQ9Ed4QDjJCg1uJQpXvnCOnAsZTw=";
 
   buildInputs = [ phpUnwrapped brotli ] ++ phpUnwrapped.buildInputs;
   nativeBuildInputs = [ makeBinaryWrapper ] ++ lib.optionals stdenv.isDarwin [ pkg-config darwin.cctools darwin.autoSignDarwinBinariesHook ];

pkgs/by-name/ga/gat/package.nix

@@ -0,0 +1,34 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "gat";
+  version = "0.17.0";
+
+  src = fetchFromGitHub {
+    owner = "koki-develop";
+    repo = "gat";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-aQ7EEB+yJ78vT/LskYsnUya6rIID1AvdaUWzr1oWV3k=";
+  };
+
+  vendorHash = "sha256-q6g3pXWKIWanGPxOxsKUEuP8Hcc31GCm64RbOAhQTfE=";
+
+  CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/koki-develop/gat/cmd.version=v${version}"
+  ];
+
+  meta = with lib; {
+    description = "Cat alternative written in Go";
+    license = licenses.mit;
+    homepage = "https://github.com/koki-develop/gat";
+    maintainers = with maintainers; [ themaxmur ];
+    mainProgram = "gat";
+  };
+}

pkgs/by-name/gn/gnucap/package.nix

@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
 
         propagatedBuildInputs = selectedPlugins;
 
-        phases = [ "installPhase" "fixupPhase" ];
+        dontUnpack = true;
 
         installPhase = ''
           mkdir -p $out/bin

pkgs/by-name/gr/graphicsmagick/imagemagick-compat.nix

@@ -0,0 +1,48 @@
+{ lib
+, graphicsmagick
+, stdenvNoCC
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "graphicsmagick-imagemagick-compat";
+  inherit (graphicsmagick) version;
+
+  outputs = [ "out" "man" ];
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  # TODO: symlink libraries?
+  installPhase = let
+    utilities = [
+      "animate"
+      "composite"
+      "conjure"
+      "convert"
+      "display"
+      "identify"
+      "import"
+      "mogrify"
+      "montage"
+    ];
+    linkUtilityBin = utility: ''
+      ln -s ${lib.getExe graphicsmagick} "$out/bin/${utility}"
+    '';
+    linkUtilityMan = utility: ''
+      ln -s ${lib.getMan graphicsmagick}/share/man/man1/gm.1.gz "$man/share/man/man1/${utility}.1.gz"
+    '';
+  in ''
+    runHook preInstall
+
+    mkdir -p "$out"/bin
+    ${lib.concatStringsSep "\n" (map linkUtilityBin utilities)}
+    mkdir -p "$man"/share/man/man1
+    ${lib.concatStringsSep "\n" (map linkUtilityMan utilities)}
+
+    runHook postInstall
+  '';
+
+  meta = graphicsmagick.meta // {
+    description = "A repack of GraphicsMagick that provides compatibility with ImageMagick interfaces";
+  };
+}

pkgs/by-name/gr/graphicsmagick/package.nix

@@ -0,0 +1,105 @@
+{ lib
+, bzip2
+, callPackage
+, coreutils
+, fetchurl
+, fixDarwinDylibNames
+, freetype
+, ghostscript
+, graphviz
+, libX11
+, libjpeg
+, libpng
+, libtiff
+, libtool
+, libwebp
+, libxml2
+, nukeReferences
+, quantumdepth ? 8
+, runCommand
+, stdenv
+, xz
+, zlib
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "graphicsmagick";
+  version = "1.3.43";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/graphicsmagick/GraphicsMagick-${finalAttrs.version}.tar.xz";
+    hash = "sha256-K4hYBzLNfkCdniLGEWI4vvSuBvzaEUUb8z0ln5y/OZ8=";
+  };
+
+  outputs = [ "out" "man" ];
+
+  buildInputs = [
+    bzip2
+    freetype
+    ghostscript
+    graphviz
+    libX11
+    libjpeg
+    libpng
+    libtiff
+    libtool
+    libwebp
+    libxml2
+    zlib
+  ];
+
+  nativeBuildInputs = [
+    nukeReferences
+    xz
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ];
+
+  configureFlags = [
+    # specify delegates explicitly otherwise `gm` will invoke the build
+    # coreutils for filetypes it doesn't natively support.
+    "MVDelegate=${lib.getExe' coreutils "mv"}"
+    (lib.enableFeature true "shared")
+    (lib.withFeature true "frozenpaths")
+    (lib.withFeatureAs true "quantum-depth" (toString quantumdepth))
+    (lib.withFeatureAs true "gslib" "yes")
+  ];
+
+  # Remove CFLAGS from the binaries to avoid closure bloat.
+  # In the past we have had -dev packages in the closure of the binaries soley
+  # due to the string references.
+  postConfigure = ''
+    nuke-refs -e $out ./magick/magick_config.h
+  '';
+
+  postInstall = ''
+    sed -i 's/-ltiff.*'\'/\'/ $out/bin/*
+  '';
+
+  passthru = {
+    imagemagick-compat = callPackage ./imagemagick-compat.nix {
+      graphicsmagick = finalAttrs.finalPackage;
+    };
+    tests = {
+      issue-157920 = runCommand "issue-157920-regression-test" {
+        buildInputs = [ finalAttrs.finalPackage ];
+      } ''
+        gm convert ${graphviz}/share/doc/graphviz/neatoguide.pdf jpg:$out
+      '';
+    };
+  };
+
+  meta = {
+    homepage = "http://www.graphicsmagick.org";
+    description = "Swiss army knife of image processing";
+    longDescription = ''
+      GraphicsMagick is the swiss army knife of image processing, providing a
+      robust and efficient collection of tools and libraries which support
+      reading, writing, and manipulating an image in over 92 major formats
+      including important formats like DPX, GIF, JPEG, JPEG-2000, JXL, PNG, PDF,
+      PNM, TIFF, and WebP.
+    '';
+    license = with lib.licenses; [ mit ];
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    mainProgram = "gm";
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/hy/hyprcursor/package.nix

@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprcursor";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprcursor";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-m5I69a5t+xXxNMQrFuzKgPR6nrFiWDEDnEqlVwTy4C4=";
+    hash = "sha256-e6+fu30inlTIdflotS6l7qYusslKMNkhZVNLn9ZSogg=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/in/incus/529.patch

@@ -0,0 +1,29 @@
+From 32a4beecbf8098fdbb15ef5f36088956922630f7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stgraber@stgraber.org>
+Date: Fri, 23 Feb 2024 18:47:15 -0500
+Subject: [PATCH] incusd/device/disk: Fix incorrect block volume usage
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
+---
+ internal/server/device/disk.go | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/internal/server/device/disk.go b/internal/server/device/disk.go
+index 0d19e21139..4f9a3e7c1b 100644
+--- a/internal/server/device/disk.go
++++ b/internal/server/device/disk.go
+@@ -339,6 +339,11 @@ func (d *disk) validateConfig(instConf instance.ConfigReader) error {
+ 				var usedBy []string
+ 
+ 				err = storagePools.VolumeUsedByInstanceDevices(d.state, d.pool.Name(), storageProjectName, &dbVolume.StorageVolume, true, func(inst db.InstanceArgs, project api.Project, usedByDevices []string) error {
++					// Don't count the current instance.
++					if d.inst != nil && d.inst.Project().Name == inst.Project && d.inst.Name() == inst.Name {
++						return nil
++					}
++
+ 					usedBy = append(usedBy, inst.Name)
+ 
+ 					return nil

pkgs/by-name/in/incus/client.nix

@@ -1,28 +1,28 @@
 {
   lts ? false,
+  meta,
+  patches,
+  src,
+  vendorHash,
+  version,
 
   lib,
   buildGoModule,
-  fetchpatch,
-  fetchFromGitHub,
   installShellFiles,
 }:
 let
-  releaseFile = if lts then ./lts.nix else ./latest.nix;
-  inherit (import releaseFile { inherit fetchpatch; }) version hash vendorHash;
+  pname = "incus${lib.optionalString lts "-lts"}-client";
 in
 
-buildGoModule rec {
-  pname = "incus-client";
-
-  inherit vendorHash version;
-
-  src = fetchFromGitHub {
-    owner = "lxc";
-    repo = "incus";
-    rev = "refs/tags/v${version}";
-    inherit hash;
-  };
+buildGoModule {
+  inherit
+    meta
+    patches
+    pname
+    src
+    vendorHash
+    version
+    ;
 
   CGO_ENABLED = 0;
 
@@ -41,14 +41,4 @@ buildGoModule rec {
 
   # don't run the full incus test suite
   doCheck = false;
-
-  meta = {
-    description = "Powerful system container and virtual machine manager";
-    homepage = "https://linuxcontainers.org/incus";
-    changelog = "https://github.com/lxc/incus/releases/tag/v${version}";
-    license = lib.licenses.asl20;
-    maintainers = lib.teams.lxc.members;
-    platforms = lib.platforms.unix;
-    mainProgram = "incus";
-  };
 }

pkgs/by-name/in/incus/generic.nix

@@ -1,10 +1,18 @@
 {
+  hash,
   lts ? false,
+  patches,
+  updateScriptArgs ? "",
+  vendorHash,
+  version,
+}:
 
+{
+  callPackage,
   lib,
   buildGoModule,
-  fetchpatch,
   fetchFromGitHub,
+  writeScript,
   writeShellScript,
   acl,
   cowsql,
@@ -19,31 +27,28 @@
 }:
 
 let
-  releaseFile = if lts then ./lts.nix else ./latest.nix;
-  inherit (import releaseFile { inherit fetchpatch; })
-    version
-    hash
-    patches
-    vendorHash
-    ;
-  name = "incus${lib.optionalString lts "-lts"}";
+  pname = "incus${lib.optionalString lts "-lts"}";
 in
 
-buildGoModule {
-  pname = "${name}-unwrapped";
-
-  inherit patches vendorHash version;
+buildGoModule rec {
+  inherit
+    patches
+    pname
+    vendorHash
+    version
+    ;
 
   src = fetchFromGitHub {
     owner = "lxc";
     repo = "incus";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     inherit hash;
   };
 
+  # replace with env var > 0.6 https://github.com/lxc/incus/pull/610
   postPatch = ''
     substituteInPlace internal/usbid/load.go \
-      --replace "/usr/share/misc/usb.ids" "${hwdata}/share/hwdata/usb.ids"
+      --replace-fail "/usr/share/misc/usb.ids" "${hwdata}/share/hwdata/usb.ids"
   '';
 
   excludedPackages = [
@@ -107,12 +112,23 @@ buildGoModule {
   '';
 
   passthru = {
-    tests.incus = nixosTests.incus;
+    client = callPackage ./client.nix {
+      inherit
+        lts
+        meta
+        patches
+        src
+        vendorHash
+        version
+        ;
+    };
 
-    updateScript = writeShellScript "update-incus" ''
-      nix-update ${name}.unwrapped -vr 'v(.*)' --override-filename pkgs/by-name/in/incus/${
-        if lts then "lts" else "latest"
-      }.nix
+    tests = nixosTests.incus;
+
+    ui = callPackage ./ui.nix { };
+
+    updateScript = writeScript "ovs-update.nu" ''
+      ${./update.nu} ${updateScriptArgs}
     '';
   };
 
@@ -123,5 +139,6 @@ buildGoModule {
     license = lib.licenses.asl20;
     maintainers = lib.teams.lxc.members;
     platforms = lib.platforms.linux;
+    mainProgram = "incus";
   };
 }

pkgs/by-name/in/incus/latest.nix

@@ -1,12 +0,0 @@
-{ fetchpatch }:
-{
-  hash = "sha256-tGuAS0lZvoYb+TvmCklQ8TADZhbm4w/lhdI0ycS4/0o=";
-  version = "0.6.0";
-  vendorHash = "sha256-+WmgLOEBJ/7GF596iiTgyTPxn8l+hE6RVqjLKfCi5rs=";
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/lxc/incus/pull/529.patch";
-      hash = "sha256-2aaPrzW/LVJidWeom0rqYOGpT2gvuV1yHLJN/TwQ1fk=";
-    })
-  ];
-}

pkgs/by-name/in/incus/lts.nix

@@ -1,3 +1,3 @@
 # this release doesn't exist yet, but satisfay the by-name checks
 # will be added as incus-lts in all-packages.nix once ready
-_: { }
+import ./generic.nix { }

pkgs/by-name/in/incus/package.nix

@@ -1,157 +1,9 @@
-{
-  lts ? false,
-
-  lib,
-  callPackage,
-  linkFarm,
-  makeWrapper,
-  stdenv,
-  symlinkJoin,
-  writeShellScriptBin,
-  acl,
-  apparmor-parser,
-  apparmor-profiles,
-  attr,
-  bash,
-  btrfs-progs,
-  cdrkit,
-  criu,
-  dnsmasq,
-  e2fsprogs,
-  getent,
-  gnutar,
-  gptfdisk,
-  gzip,
-  iproute2,
-  iptables,
-  kmod,
-  lvm2,
-  minio,
-  nftables,
-  OVMF,
-  qemu_kvm,
-  qemu-utils,
-  rsync,
-  spice-gtk,
-  squashfsTools,
-  thin-provisioning-tools,
-  util-linux,
-  virtiofsd,
-  xz,
-}:
-let
-  unwrapped = callPackage ./unwrapped.nix { inherit lts; };
-  client = callPackage ./client.nix { inherit lts; };
-  name = "incus${lib.optionalString lts "-lts"}";
-
-  binPath = lib.makeBinPath [
-    acl
-    attr
-    bash
-    btrfs-progs
-    cdrkit
-    criu
-    dnsmasq
-    e2fsprogs
-    getent
-    gnutar
-    gptfdisk
-    gzip
-    iproute2
-    iptables
-    kmod
-    lvm2
-    minio
-    nftables
-    qemu_kvm
-    qemu-utils
-    rsync
-    squashfsTools
-    thin-provisioning-tools
-    util-linux
-    virtiofsd
-    xz
-
-    (writeShellScriptBin "apparmor_parser" ''
-      exec '${apparmor-parser}/bin/apparmor_parser' -I '${apparmor-profiles}/etc/apparmor.d' "$@"
-    '')
+import ./generic.nix {
+  hash = "sha256-tGuAS0lZvoYb+TvmCklQ8TADZhbm4w/lhdI0ycS4/0o=";
+  version = "0.6.0";
+  vendorHash = "sha256-+WmgLOEBJ/7GF596iiTgyTPxn8l+hE6RVqjLKfCi5rs=";
+  patches = [
+    # fix storage bug, fixed in > 0.6
+    ./529.patch
   ];
-
-  clientBinPath = [ spice-gtk ];
-
-  ovmf-2mb = OVMF.override {
-    secureBoot = true;
-    fdSize2MB = true;
-  };
-
-  ovmf-4mb = OVMF.override {
-    secureBoot = true;
-    fdSize4MB = true;
-  };
-
-  ovmf-prefix = if stdenv.hostPlatform.isAarch64 then "AAVMF" else "OVMF";
-
-  # mimic ovmf from https://github.com/canonical/incus-pkg-snap/blob/3abebe1dfeb20f9b7729556960c7e9fe6ad5e17c/snapcraft.yaml#L378
-  # also found in /snap/incus/current/share/qemu/ on a snap install
-  ovmf = linkFarm "incus-ovmf" [
-    {
-      name = "OVMF_CODE.2MB.fd";
-      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_CODE.fd";
-    }
-    {
-      name = "OVMF_CODE.4MB.fd";
-      path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_CODE.fd";
-    }
-    {
-      name = "OVMF_CODE.fd";
-      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_CODE.fd";
-    }
-
-    {
-      name = "OVMF_VARS.2MB.fd";
-      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
-    {
-      name = "OVMF_VARS.2MB.ms.fd";
-      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
-    {
-      name = "OVMF_VARS.4MB.fd";
-      path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
-    {
-      name = "OVMF_VARS.4MB.ms.fd";
-      path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
-    {
-      name = "OVMF_VARS.fd";
-      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
-    {
-      name = "OVMF_VARS.ms.fd";
-      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
-  ];
-in
-symlinkJoin {
-  name = "${name}-${unwrapped.version}";
-
-  paths = [ unwrapped ];
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  postBuild = ''
-    wrapProgram $out/bin/incusd --prefix PATH : ${lib.escapeShellArg binPath}:${qemu_kvm}/libexec:$out/bin --set INCUS_OVMF_PATH ${ovmf}
-
-    wrapProgram $out/bin/incus --prefix PATH : ${lib.makeBinPath clientBinPath}
-  '';
-
-  passthru = {
-    inherit client unwrapped;
-    ui = callPackage ./ui.nix {};
-
-    inherit (unwrapped) tests;
-  };
-
-  inherit (unwrapped) meta pname version;
 }

pkgs/by-name/in/incus/update.nu

@@ -0,0 +1,22 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i nu -p nushell common-updater-scripts gnused
+
+def main [--lts = false, --regex: string] {
+  let attr = $"incus(if $lts {"-lts"})"
+  let file = $"(pwd)/pkgs/by-name/in/incus/(if $lts { "lts" } else { "package" }).nix"
+
+  let tags = list-git-tags --url=https://github.com/lxc/incus | lines | sort --natural | str replace v ''
+  let latest_tag = if $regex == null { $tags } else { $tags | find --regex $regex } | last
+  let current_version = nix eval --raw -f default.nix $"($attr).version" | str trim
+
+  if $latest_tag != $current_version {
+    update-source-version $attr $latest_tag $"--file=($file)"
+
+    let oldVendorHash = nix-instantiate . --eval --strict -A $"($attr).goModules.drvAttrs.outputHash" --json | from json
+    let vendorHash = do { nix-build -A $"($attr).goModules" } | complete | get stderr | lines | str trim | find --regex 'got:[[:space:]]*sha256' | split row ' ' | last
+    open $file | str replace $oldVendorHash $vendorHash | save --force $file
+
+  }
+
+  {"lts?": $lts, before: $current_version, after: $latest_tag}
+}

pkgs/by-name/in/insync/package.nix

@@ -1,22 +1,27 @@
 { lib
 , writeShellScript
-, buildFHSEnvBubblewrap
+, buildFHSEnv
 , stdenvNoCC
 , fetchurl
 , autoPatchelfHook
 , dpkg
 , nss
+, cacert
+, alsa-lib
 , libvorbis
 , libdrm
 , libGL
 , wayland
 , xkeyboard_config
 , libthai
+, libsForQt5
 }:
 
 let
   pname = "insync";
-  version = "3.8.6.50504";
+  # Find a binary from https://www.insynchq.com/downloads/linux#ubuntu.
+  version = "3.8.7.50516";
+  ubuntu-dist = "mantic_amd64";
   meta = with lib; {
     platforms = ["x86_64-linux"];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
@@ -35,7 +40,6 @@ let
      Known bug(s):
 
      1) Currently the system try icon does not render correctly.
-     2) libqtvirtualkeyboardplugin does not have necessary Qt library shipped from vendor.
     '';
     mainProgram = "insync";
   };
@@ -45,22 +49,27 @@ let
     inherit version meta;
 
     src = fetchurl {
-      # Find a binary from https://www.insynchq.com/downloads/linux#ubuntu.
-      url = "https://cdn.insynchq.com/builds/linux/insync_${version}-lunar_amd64.deb";
-      sha256 = "sha256-BxTFtQ1rAsOuhKnH5vsl3zkM7WOd+vjA4LKZGxl4jk0=";
+      url = "https://cdn.insynchq.com/builds/linux/insync_${version}-${ubuntu-dist}.deb";
+      sha256 = "sha256-U7BcgghbdR7r9WiZpEOka+BzXwnxrzL6p4imGESuB/k=";
     };
 
+    nativeBuildInputs = [
+      dpkg
+      autoPatchelfHook
+      libsForQt5.qt5.wrapQtAppsHook
+    ];
+
     buildInputs = [
       nss
+      alsa-lib
       libvorbis
       libdrm
       libGL
       wayland
       libthai
+      libsForQt5.qt5.qtvirtualkeyboard
     ];
 
-    nativeBuildInputs = [ autoPatchelfHook dpkg ];
-
     unpackPhase = ''
       dpkg-deb --fsys-tarfile $src | tar -x --no-same-permissions --no-same-owner
     '';
@@ -71,15 +80,6 @@ let
       mkdir -p $out
       cp -R usr/* $out/
 
-      # use system glibc
-      rm $out/lib/insync/{libgcc_s.so.1,libstdc++.so.6}
-
-      # remove badly packaged plugins
-      rm $out/lib/insync/PySide2/plugins/platforminputcontexts/libqtvirtualkeyboardplugin.so
-
-      # remove the unused vendor wrapper
-      rm $out/bin/insync
-
       runHook postInstall
     '';
 
@@ -87,29 +87,25 @@ let
     dontStrip = true;
   };
 
-in buildFHSEnvBubblewrap {
+in buildFHSEnv {
   name = pname;
   inherit meta;
 
   targetPkgs = pkgs: with pkgs; [
-    insync-pkg
     libudev0-shim
+    insync-pkg
   ];
 
-  runScript = writeShellScript "insync-wrapper.sh" ''
-    # QT_STYLE_OVERRIDE was used to suppress a QT warning, it should have no actual effect for this binary.
-    echo Unsetting QT_STYLE_OVERRIDE=$QT_STYLE_OVERRIDE
-    echo Unsetting QT_QPA_PLATFORMTHEME=$QT_QPA_PLATFORMTHEME
-    unset QT_STYLE_OVERRIDE
-    unset QPA_PLATFORMTHEME
+  extraInstallCommands = ''
+    cp -rsHf "${insync-pkg}"/share $out
+  '';
 
+  runScript = writeShellScript "insync-wrapper.sh" ''
     # xkb configuration needed: https://github.com/NixOS/nixpkgs/issues/236365
     export XKB_CONFIG_ROOT=${xkeyboard_config}/share/X11/xkb/
-    echo XKB_CONFIG_ROOT=$XKB_CONFIG_ROOT
 
-    # For debuging:
+    # For debugging:
     # export QT_DEBUG_PLUGINS=1
-    # find -L /usr/share -name "*insync*"
 
     exec /usr/lib/insync/insync "$@"
     '';
@@ -121,6 +117,6 @@ in buildFHSEnvBubblewrap {
   unshareNet    = false;
   unshareUts    = false;
   unshareCgroup = false;
-  # Since "insync start" command starts a daemon, this daemon should die with it.
-  dieWithParent = false;
+
+  dieWithParent = true;
 }

pkgs/by-name/ko/kor/package.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kor";
-  version = "0.3.6";
+  version = "0.3.7";
 
   src = fetchFromGitHub {
     owner = "yonahd";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Q2VUc91ecBRr/m9DGYWwuSsH2prB+EKmBoQrekgPvTE=";
+    hash = "sha256-wjq4IkF3agmculIH+WfBAGd0ciJBX9aj4EsmUvje9Aw=";
   };
 
-  vendorHash = "sha256-DRbwM6fKTIlefD0rUmNLlUXrK+t3vNCl4rxHF7m8W10=";
+  vendorHash = "sha256-UN3Zf8eo6kMNNzkGsnqyDVMgE2QXRn4wg+XULu/uBGE=";
 
   preCheck = ''
     HOME=$(mktemp -d)

pkgs/by-name/li/lib60870/package.nix

@@ -0,0 +1,35 @@
+{ cmake
+, lib
+, stdenv
+, fetchFromGitHub
+, gitUpdater
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "lib60870";
+  version = "2.3.2";
+
+  src = fetchFromGitHub {
+    owner = "mz-automation";
+    repo = "lib60870";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-9o+gWQbpCJb+UZzPNmzGqpWD0QbGjg41is/f1POUEQs=";
+  };
+
+  separateDebugInfo = true;
+
+  nativeBuildInputs = [ cmake ];
+
+  preConfigure = "cd lib60870-C";
+
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "v";
+  };
+
+  meta = with lib; {
+    description = "Implementation of the IEC 60870-5-101/104 protocol";
+    homepage = "https://libiec61850.com/";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ stv0g ];
+    platforms = [ "x86_64-linux" ];
+  };
+})

pkgs/by-name/li/libation/deps.nix

@@ -4,7 +4,7 @@
 { fetchNuGet }: [
   (fetchNuGet { pname = "AAXClean"; version = "1.1.2"; sha256 = "0hxn1giq99rcd6z43ar79awlzyv0mnxpvmarsl2ypi52d3dizf01"; })
   (fetchNuGet { pname = "AAXClean.Codecs"; version = "1.1.3"; sha256 = "0hqj9hslscl110h2mr7mf0lb0s7dczx73mplkpgx1gpshyfg5xj8"; })
-  (fetchNuGet { pname = "AudibleApi"; version = "9.0.0.1"; sha256 = "1j6bigvvldg4m82vb7ry8y06sh3a0q4mdshlsrppq6bivwsalazc"; })
+  (fetchNuGet { pname = "AudibleApi"; version = "9.1.0.1"; sha256 = "131ibkglq5x72lfblbk4d50mmah8iwhws30va8v7qazaxy5rdbm3"; })
   (fetchNuGet { pname = "Avalonia"; version = "11.0.5"; sha256 = "1l8vpw7dmkgll197i42r98ikkl0g08469wkl1kxkcv8f0allgah6"; })
   (fetchNuGet { pname = "Avalonia.Angle.Windows.Natives"; version = "2.1.0.2023020321"; sha256 = "1az4s1g22ipak9a3xfh55z2h3rm6lpqh7svbpw6ag4ysrgsjjsjd"; })
   (fetchNuGet { pname = "Avalonia.BuildServices"; version = "0.0.29"; sha256 = "05mm7f0jssih3gbzqfgjnfq5cnqa85ihsg0z1897ciihv8qd3waq"; })
@@ -24,7 +24,7 @@
   (fetchNuGet { pname = "Avalonia.X11"; version = "11.0.5"; sha256 = "1bixdr5yzd9spyjc4n2kf1bwg52q3p5akj9xsr25xp310j3kgyxf"; })
   (fetchNuGet { pname = "BouncyCastle.Cryptography"; version = "2.2.1"; sha256 = "13fx7cg5hmk2y33438wjz0c74c0lvbmh8fa33gwldldmf72mwcr8"; })
   (fetchNuGet { pname = "CommandLineParser"; version = "2.9.1"; sha256 = "1sldkj8lakggn4hnyabjj1fppqh50fkdrr1k99d4gswpbk5kv582"; })
-  (fetchNuGet { pname = "CsvHelper"; version = "30.0.1"; sha256 = "0v01s672zcrd3fjwzh14dihbal3apzyg3dc80k05a90ljk8yh9wl"; })
+  (fetchNuGet { pname = "CsvHelper"; version = "31.0.2"; sha256 = "14x5a81yc3psz5lsafknafbbs19kd05s80lpnyrr225q0w7vfqlk"; })
   (fetchNuGet { pname = "Dinah.Core"; version = "8.0.0.1"; sha256 = "1kfnc7bfs6bmy41rvnybhpfwrd2p4rjgg8jzzajk7v7smci1m04d"; })
   (fetchNuGet { pname = "Dinah.EntityFrameworkCore"; version = "8.0.0.1"; sha256 = "1125s6lypmk447d6pba6kn5r82c552l6ck54a7mgaa9n2448lcn5"; })
   (fetchNuGet { pname = "DynamicData"; version = "7.9.5"; sha256 = "1m9qx8g6na5ka6kd9vhg8gjmxrnkzb6v5cl5yqp1kdjsw4rcwy6x"; })
@@ -51,15 +51,19 @@
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.Scripting.Common"; version = "3.8.0"; sha256 = "0hjgxcsj5zy27lqk0986m59n5dbplx2vjjla2lsvg4bwg8qa7bpk"; })
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.Workspaces.Common"; version = "4.5.0"; sha256 = "1wjwsrnn5frahqciwaxsgalv80fs6xhqy6kcqy7hcsh7jrfc1kjq"; })
   (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.3.0"; sha256 = "0gw297dgkh0al1zxvgvncqs0j15lsna9l1wpqas4rflmys440xvb"; })
-  (fetchNuGet { pname = "Microsoft.Data.Sqlite.Core"; version = "8.0.0"; sha256 = "05qjnzk1fxybks92y93487l3mj5nghjcwiy360xjgk3jykz3rv39"; })
+  (fetchNuGet { pname = "Microsoft.Data.Sqlite.Core"; version = "8.0.2"; sha256 = "1p8fnnkgcvqnszp2ym4cn9ysa3c409yqnq3nrpnwldz6zi42jdgz"; })
   (fetchNuGet { pname = "Microsoft.EntityFrameworkCore"; version = "8.0.0"; sha256 = "1xhmax0xrvw4lyz1868f1sr3nbrcv3ckr5qnf61c8q9bwj06b9v7"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore"; version = "8.0.2"; sha256 = "09qdjvb2prlhkb08nzdjabwj43wrsc4b83spmig2qj65jp10pgiw"; })
   (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Abstractions"; version = "8.0.0"; sha256 = "019r991228nxv1fibsxg5z81rr7ydgy77c9v7yvlx35kfppxq4s3"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Abstractions"; version = "8.0.2"; sha256 = "10qsmgh2fbrkikvahgyfs9kvvq7jd648nz169gv9fh92k8rz01ww"; })
   (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Analyzers"; version = "8.0.0"; sha256 = "1vcbad0pzkx5wadnd5inglx56x0yybdlxgknbhifdga0bx76j9sa"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Design"; version = "8.0.0"; sha256 = "0pa1v87q4hzphv0h020adw7hn84803lrrxylk8h57j93axm5kmm0"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Analyzers"; version = "8.0.2"; sha256 = "1j7jvza125nfjzlnyk1kc4w7qqlw1imp47f1zrxfxvwdy51nfsik"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Design"; version = "8.0.2"; sha256 = "1i9qyamizqha69x4pcmdr8rjy8pmdmnjcbb3xmlb7jwwzrzjvjhj"; })
   (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Relational"; version = "8.0.0"; sha256 = "0ngsxk717si11g4a01ah2np8gp8b3k09y23229anr9jrhykr1bw1"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite"; version = "8.0.0"; sha256 = "156v8xr5xk9b7a9ncxjpv30hp0nfgbb0plzd3709sa8g0a7dvi53"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite.Core"; version = "8.0.0"; sha256 = "0jg524cr8j779av1whwk120xajymb8086abn5wzdb4fyrc0ivf8l"; })
-  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Tools"; version = "8.0.0"; sha256 = "1qm8qscp4g4y4mg5z9i9zp4b17wlhndh4isy78ajw9891yp3cxll"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Relational"; version = "8.0.2"; sha256 = "1qnb33mqnhbx8r0sn2kj32idv7yzrgnapkh39is8m1qhfp6gmaih"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite"; version = "8.0.2"; sha256 = "0jj4pgmapab646k57587w8byzsdknfpwjqw93m91q5h0carqax6j"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Sqlite.Core"; version = "8.0.2"; sha256 = "1wvp7r8nxfj5wlba8qkyfspz5gcj4d8d946s39qifdbasnfa0sv9"; })
+  (fetchNuGet { pname = "Microsoft.EntityFrameworkCore.Tools"; version = "8.0.2"; sha256 = "086n9n8hqssmxlyx8449r9pd4jj1pw55d6w9qli3ii1355l0cmr4"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Caching.Abstractions"; version = "8.0.0"; sha256 = "04m6ywsf9731z24nfd14z0ah8xl06619ba7mkdb4vg8h5jpllsn4"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Caching.Memory"; version = "8.0.0"; sha256 = "0bv8ihd5i2gwr97qljwf56h8mdwspmlw0zs64qyk608fb3ciwi25"; })
   (fetchNuGet { pname = "Microsoft.Extensions.Configuration"; version = "8.0.0"; sha256 = "080kab87qgq2kh0ijry5kfdiq9afyzb8s0k3jqi5zbbi540yq4zl"; })
@@ -88,10 +92,10 @@
   (fetchNuGet { pname = "NAudio.Core"; version = "2.2.1"; sha256 = "0ivki33p5mcm7iigya22llgk0p6m4j99sbfmcc38ir1hzpdlaikr"; })
   (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.3"; sha256 = "0xrwysmrn4midrjal8g2hr1bbg38iyisl0svamb11arqws4w2bw7"; })
   (fetchNuGet { pname = "NPOI"; version = "2.6.2"; sha256 = "19jc9fzbwgs8hydvgbn9qnkncifx9lz0qgrq4jfqv9q1yynh27q2"; })
-  (fetchNuGet { pname = "Octokit"; version = "9.1.0"; sha256 = "02qd23zsr8pffkznb7znq1n2bz9x8y3b6kcz0xp9z98wqxpb9y2k"; })
+  (fetchNuGet { pname = "Octokit"; version = "10.0.0"; sha256 = "19crbmzkqx8bbl6a55n2b9k4ljyml0h6nq78nayz1vl2ji2f0r23"; })
   (fetchNuGet { pname = "Pluralize.NET"; version = "1.0.2"; sha256 = "0187adfnl288v7izgwx1iskgi024nm4l83s898x6pg2j79h8gxdv"; })
-  (fetchNuGet { pname = "Polly"; version = "8.2.0"; sha256 = "0gxdi4sf60vpxsb258v592ykkq9a3dq2awayp99yy9djys8bglks"; })
-  (fetchNuGet { pname = "Polly.Core"; version = "8.2.0"; sha256 = "00b4jbyiyslqvswy4j2lfw0rl0gq8m4v5fj2asb96i6l224bs7d3"; })
+  (fetchNuGet { pname = "Polly"; version = "8.3.0"; sha256 = "1pmh6iwkzgbxn62k1g1agwzgqdbq8g0yj5wslyxknpri6pyx9y5c"; })
+  (fetchNuGet { pname = "Polly.Core"; version = "8.3.0"; sha256 = "16bkagvrpfr58lfmzyxic1dzmxxbi0vkgd8jfyfbaa6nscadf8xb"; })
   (fetchNuGet { pname = "ReactiveUI"; version = "18.3.1"; sha256 = "1lxkc8yk9glj0w9n5vry2dnwwvh8152ad2c5bivk8aciq64zidyn"; })
   (fetchNuGet { pname = "runtime.any.System.Collections"; version = "4.3.0"; sha256 = "0bv5qgm6vr47ynxqbnkc7i797fdi8gbjjxii173syrx14nmrkwg0"; })
   (fetchNuGet { pname = "runtime.any.System.Globalization"; version = "4.3.0"; sha256 = "1daqf33hssad94lamzg01y49xwndy2q97i2lrb7mgn28656qia1x"; })
@@ -123,7 +127,6 @@
   (fetchNuGet { pname = "runtime.win.System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "16fbn4bcynad1ygdq0yk1wmckvs8jvrrf104xa5dc2hlc8y3x58f"; })
   (fetchNuGet { pname = "runtime.win.System.Runtime.Extensions"; version = "4.3.0"; sha256 = "1700famsxndccfbcdz9q14qb20p49lax67mqwpgy4gx3vja1yczr"; })
   (fetchNuGet { pname = "Serilog"; version = "2.10.0"; sha256 = "08bih205i632ywryn3zxkhb15dwgyaxbhmm1z3b5nmby9fb25k7v"; })
-  (fetchNuGet { pname = "Serilog"; version = "2.12.0"; sha256 = "0lqxpc96qcjkv9pr1rln7mi4y7n7jdi4vb36c2fv3845w1vswgr4"; })
   (fetchNuGet { pname = "Serilog"; version = "2.8.0"; sha256 = "0fnrs05yjnni06mbax7ig74wiiqjyyhrxmr1hrhlpwcmc40zs4ih"; })
   (fetchNuGet { pname = "Serilog"; version = "3.1.0"; sha256 = "1fd3hwhsicjmav56ff6d8x6lmalggy52kvw2mb85hz13w2kw086l"; })
   (fetchNuGet { pname = "Serilog"; version = "3.1.1"; sha256 = "0ck51ndmaqflsri7yyw5792z42wsp91038rx2i6vg7z4r35vfvig"; })
@@ -131,7 +134,7 @@
   (fetchNuGet { pname = "Serilog.Settings.Configuration"; version = "8.0.0"; sha256 = "0245gvndwbj4nbp8q09vp7w4i9iddxr0vzda2c3ja5afz1zgs395"; })
   (fetchNuGet { pname = "Serilog.Sinks.Console"; version = "5.0.0"; sha256 = "0qk5b9vfgzx00a1c2rnih2p3jlcc88vdi9ar5cpwv1jb09x6brah"; })
   (fetchNuGet { pname = "Serilog.Sinks.File"; version = "5.0.0"; sha256 = "097rngmgcrdfy7jy8j7dq3xaq2qky8ijwg0ws6bfv5lx0f3vvb0q"; })
-  (fetchNuGet { pname = "Serilog.Sinks.ZipFile"; version = "1.0.1"; sha256 = "18swb04gk0hxwcbc4gndkpl8jgj643f8fga3w26sjkx6r2nhg35q"; })
+  (fetchNuGet { pname = "Serilog.Sinks.ZipFile"; version = "3.1.1"; sha256 = "0m7a8ygfwx90n86qmkpfdgn4wvi94vwxi6m9mhx8gy25wsw1g2jv"; })
   (fetchNuGet { pname = "SharpZipLib"; version = "1.3.3"; sha256 = "1gij11wfj1mqm10631cjpnhzw882bnzx699jzwhdqakxm1610q8x"; })
   (fetchNuGet { pname = "SixLabors.Fonts"; version = "1.0.0"; sha256 = "1lsc789fqsnh3jx5w0g5k2n1wlww58zyzrcf5rs3wx2fjrqi084k"; })
   (fetchNuGet { pname = "SixLabors.ImageSharp"; version = "2.1.4"; sha256 = "0rbv3a20ar73vy6mnj10s245lpninvjz7rhrmqz9vxq42k6g8diy"; })

pkgs/by-name/li/libation/package.nix

@@ -19,13 +19,13 @@
 
 buildDotnetModule rec {
   pname = "libation";
-  version = "11.3.1";
+  version = "11.3.6";
 
   src = fetchFromGitHub {
     owner = "rmcrackan";
     repo = "Libation";
     rev = "v${version}";
-    hash = "sha256-oTqV1pmjjxzLdvEIUmg3cRFhnPG69yHMbSd9ZBv+XVE=";
+    hash = "sha256-LH8p14oMjqo648h0TYClutPx19v5cWa9ffUlxuPWX5o=";
   };
 
   sourceRoot = "${src.name}/Source";

pkgs/by-name/li/libhttpserver/package.nix

@@ -0,0 +1,46 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, autoconf
+, automake
+, libtool
+, gnutls
+, libmicrohttpd
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libhttpserver";
+  version = "0.19.0";
+
+  src = fetchFromGitHub {
+    owner = "etr";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-Pc3Fvd8D4Ymp7dG9YgU58mDceOqNfhWE1JtnpVaNx/Y=";
+  };
+
+  nativeBuildInputs = [ autoconf automake libtool ];
+
+  buildInputs = [ gnutls libmicrohttpd ];
+
+  enableParallelBuilding = true;
+
+  postPatch = ''
+    patchShebangs ./bootstrap
+  '';
+
+  preConfigure = ''
+    ./bootstrap
+  '';
+
+  configureFlags = [ "--enable-same-directory-build" ];
+
+  meta = with lib; {
+    description = "C++ library for creating an embedded Rest HTTP server (and more)";
+    homepage = "https://github.com/etr/libhttpserver";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ pongo1231 ];
+    platforms = platforms.unix;
+    broken = stdenv.isDarwin; # configure: error: cannot find required auxiliary files: ltmain.sh
+  };
+}

pkgs/by-name/li/libiec61850/package.nix

@@ -0,0 +1,33 @@
+{ cmake
+, lib
+, stdenv
+, fetchFromGitHub
+, gitUpdater
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libiec61850";
+  version = "1.5.3";
+
+  src = fetchFromGitHub {
+    owner = "mz-automation";
+    repo = "libiec61850";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-SwJjjSapNaVOH5g46MiS9BkzI0fKm/P1xYug3OX5XbA=";
+  };
+
+  separateDebugInfo = true;
+
+  nativeBuildInputs = [ cmake ];
+
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "v";
+  };
+
+  meta = with lib; {
+    description = "Open-source library for the IEC 61850 protocols";
+    homepage = "https://libiec61850.com/";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ stv0g ];
+    platforms = [ "x86_64-linux" ];
+  };
+})

pkgs/by-name/li/libisoburn/package.nix

@@ -1,12 +1,16 @@
 { lib
-, stdenv
-, fetchFromGitea
 , acl
 , attr
 , autoreconfHook
+, bzip2
+, fetchFromGitea
 , libburn
+, libcdio
+, libiconv
 , libisofs
 , pkg-config
+, readline
+, stdenv
 , zlib
 }:
 
@@ -28,13 +32,19 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    attr
+    bzip2
+    libcdio
+    libiconv
+    readline
     zlib
     libburn
     libisofs
+  ] ++ lib.optionals stdenv.isLinux [
+    acl
+    attr
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = lib.optionals stdenv.isLinux [
     acl
   ];