Merge master into haskell-updates

doc/languages-frameworks/javascript.section.md

@@ -161,6 +161,8 @@ git config --global url."https://github.com/".insteadOf git://github.com/
 
 `buildNpmPackage` allows you to package npm-based projects in Nixpkgs without the use of an auto-generated dependencies file (as used in [node2nix](#javascript-node2nix)). It works by utilizing npm's cache functionality -- creating a reproducible cache that contains the dependencies of a project, and pointing npm to it.
 
+Here's an example:
+
 ```nix
 { lib, buildNpmPackage, fetchFromGitHub }:
 
@@ -191,6 +193,8 @@ buildNpmPackage rec {
 }
 ```
 
+In the default `installPhase` set by `buildNpmPackage`, it uses `npm pack --json --dry-run` to decide what files to install in `$out/lib/node_modules/$name/`, where `$name` is the `name` string defined in the package's `package.json`. Additionally, the `bin` and `man` keys in the source's `package.json` are used to decide what binaries and manpages are supposed to be installed. If these are not defined, `npm pack` may miss some files, and no binaries will be produced.
+
 #### Arguments {#javascript-buildNpmPackage-arguments}
 
 * `npmDepsHash`: The output hash of the dependencies for this project. Can be calculated in advance with [`prefetch-npm-deps`](#javascript-buildNpmPackage-prefetch-npm-deps).
@@ -204,10 +208,11 @@ buildNpmPackage rec {
 * `npmBuildFlags`: Flags to pass to `npm run ${npmBuildScript}`.
 * `npmPackFlags`: Flags to pass to `npm pack`.
 * `npmPruneFlags`: Flags to pass to `npm prune`. Defaults to the value of `npmInstallFlags`.
+* `makeWrapperArgs`: Flags to pass to `makeWrapper`, added to executable calling the generated `.js` with `node` as an interpreter. These scripts are defined in `package.json`.
 
 #### prefetch-npm-deps {#javascript-buildNpmPackage-prefetch-npm-deps}
 
-`prefetch-npm-deps` can calculate the hash of the dependencies of an npm project ahead of time.
+`prefetch-npm-deps` is a Nixpkgs package that calculates the hash of the dependencies of an npm project ahead of time.
 
 ```console
 $ ls
@@ -217,6 +222,15 @@ $ prefetch-npm-deps package-lock.json
 sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 ```
 
+#### fetchNpmDeps {#javascript-buildNpmPackage-fetchNpmDeps}
+
+`fetchNpmDeps` is a Nix function that requires the following mandatory arguments:
+
+- `src`: A directory / tarball with `package-lock.json` file
+- `hash`: The output hash of the node dependencies defined in `package-lock.json`.
+
+It returns a derivation with all `package-lock.json` dependencies downloaded into `$out/`, usable as an npm cache.
+
 ### corepack {#javascript-corepack}
 
 This package puts the corepack wrappers for pnpm and yarn in your PATH, and they will honor the `packageManager` setting in the `package.json`.

maintainers/maintainer-list.nix

@@ -5836,10 +5836,14 @@
     githubId = 1618343;
   };
   foo-dogsquared = {
-    email = "foo.dogsquared@gmail.com";
+    email = "foodogsquared@foodogsquared.one";
     github = "foo-dogsquared";
     githubId = 34962634;
+    matrix = "@foodogsquared:matrix.org";
     name = "Gabriel Arazas";
+    keys = [{
+      fingerprint = "DDD7 D0BD 602E 564B AA04  FC35 1431 0D91 4115 2B92";
+    }];
   };
   fooker = {
     email = "fooker@lab.sh";
@@ -8039,6 +8043,12 @@
     githubId = 854319;
     name = "Matt McHenry";
   };
+  jerrysm64 = {
+    email = "jerry.starke@icloud.com";
+    github = "jerrysm64";
+    githubId = 42114389;
+    name = "Jerry Starke";
+  };
   jeschli = {
     email = "jeschli@gmail.com";
     github = "0mbi";
@@ -8542,6 +8552,12 @@
     github = "jorsn";
     githubId = 4646725;
   };
+  joscha = {
+    name = "Joscha Loos";
+    email = "j.loos@posteo.net";
+    github = "jooooscha";
+    githubId = 57965027;
+  };
   josephst = {
     name = "Joseph Stahl";
     email = "hello@josephstahl.com";

maintainers/scripts/all-tarballs.nix

@@ -12,5 +12,5 @@ import ../../pkgs/top-level/release.nix
     scrubJobs = false;
     # No need to evaluate on i686.
     supportedSystems = [ "x86_64-linux" ];
-    limitedSupportedSystems = [];
+    bootstrapConfigs = [];
   }

nixos/doc/manual/release-notes/rl-2311.section.md

@@ -114,7 +114,7 @@
 
 - `pass` now does not contain `password-store.el`.  Users should get `password-store.el` from Emacs lisp package set `emacs.pkgs.password-store`.
 
-- `services.knot` now supports `.settings` from RFC42.  The change is not 100% compatible with the previous `.extraConfig`.
+- `services.knot` now supports `.settings` from RFC42.  The previous `.extraConfig` still works the same, but it displays a warning now.
 
 - `mu` now does not install `mu4e` files by default.  Users should get `mu4e` from Emacs lisp package set `emacs.pkgs.mu4e`.
 

nixos/modules/services/matrix/synapse.md

@@ -31,7 +31,7 @@ let
   clientConfig."m.homeserver".base_url = baseUrl;
   serverConfig."m.server" = "${fqdn}:443";
   mkWellKnown = data: ''
-    add_header Content-Type application/json;
+    default_type application/json;
     add_header Access-Control-Allow-Origin *;
     return 200 '${builtins.toJSON data}';
   '';

nixos/modules/services/misc/gitea.nix

@@ -246,6 +246,13 @@ in
         description = lib.mdDoc "Path to a file containing the SMTP password.";
       };
 
+      metricsTokenFile = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "/var/lib/secrets/gitea/metrics_token";
+        description = lib.mdDoc "Path to a file containing the metrics authentication token.";
+      };
+
       settings = mkOption {
         default = {};
         description = lib.mdDoc ''
@@ -433,6 +440,10 @@ in
         PASSWD = "#mailerpass#";
       };
 
+      metrics = mkIf (cfg.metricsTokenFile != null) {
+        TOKEN = "#metricstoken#";
+      };
+
       oauth2 = {
         JWT_SECRET = "#oauth2jwtsecret#";
       };
@@ -559,6 +570,10 @@ in
             ${lib.optionalString (cfg.mailerPasswordFile != null) ''
               ${replaceSecretBin} '#mailerpass#' '${cfg.mailerPasswordFile}' '${runConfig}'
             ''}
+
+            ${lib.optionalString (cfg.metricsTokenFile != null) ''
+              ${replaceSecretBin} '#metricstoken#' '${cfg.metricsTokenFile}' '${runConfig}'
+            ''}
             chmod u-w '${runConfig}'
           }
           (umask 027; gitea_setup)

nixos/modules/services/networking/knot.nix

@@ -103,11 +103,15 @@ let
   in result;
 
   configFile = if cfg.settingsFile != null then
-    assert cfg.settings == {} && cfg.keyFiles == [];
+    # Note: with extraConfig, the 23.05 compat code did include keyFiles from settingsFile.
+    assert cfg.settings == {} && (cfg.keyFiles == [] || cfg.extraConfig != null);
     cfg.settingsFile
-  else pkgs.writeTextFile {
+  else
+    mkConfigFile yamlConfig;
+
+  mkConfigFile = configString: pkgs.writeTextFile {
     name = "knot.conf";
-    text = (concatMapStringsSep "\n" (file: "include: ${file}") cfg.keyFiles) + "\n" + yamlConfig;
+    text = (concatMapStringsSep "\n" (file: "include: ${file}") cfg.keyFiles) + "\n" + configString;
     # TODO: maybe we could do some checks even when private keys complicate this?
     checkPhase = lib.optionalString (cfg.keyFiles == []) ''
       ${cfg.package}/bin/knotc --config=$out conf-check
@@ -174,7 +178,7 @@ in {
         description = lib.mdDoc ''
           As alternative to ``settings``, you can provide whole configuration
           directly in the almost-YAML format of Knot DNS.
-          You might want to utilize ``writeTextFile`` for this.
+          You might want to utilize ``pkgs.writeText "knot.conf" "longConfigString"`` for this.
         '';
       };
 
@@ -189,9 +193,9 @@ in {
     };
   };
   imports = [
-    # Compatibility with NixOS 23.05.  At least partial, as it fails assert if used with keyFiles.
+    # Compatibility with NixOS 23.05.
     (mkChangedOptionModule [ "services" "knot" "extraConfig" ] [ "services" "knot" "settingsFile" ]
-      (config: pkgs.writeText "knot.conf" config.services.knot.extraConfig)
+      (config: mkConfigFile config.services.knot.extraConfig)
     )
   ];
 

nixos/modules/services/networking/syncthing.nix

@@ -100,13 +100,13 @@ let
       the Nix configured list of IDs
       */
       + lib.optionalString s.override ''
-        old_conf_${conf_type}_ids="$(curl -X GET ${s.baseAddress} | ${jq} --raw-output '.[].${s.GET_IdAttrName}')"
-        for id in ''${old_conf_${conf_type}_ids}; do
-          if echo ${lib.concatStringsSep " " s.new_conf_IDs} | grep -q $id; then
-            continue
-          else
-            curl -X DELETE ${s.baseAddress}/$id
-          fi
+        stale_${conf_type}_ids="$(curl -X GET ${s.baseAddress} | ${jq} \
+          --argjson new_ids ${lib.escapeShellArg (builtins.toJSON s.new_conf_IDs)} \
+          --raw-output \
+          '[.[].${s.GET_IdAttrName}] - $new_ids | .[]'
+        )"
+        for id in ''${stale_${conf_type}_ids}; do
+          curl -X DELETE ${s.baseAddress}/$id
         done
       ''
     ))

nixos/modules/virtualisation/azure-image.nix

@@ -16,6 +16,13 @@ in
         Size of disk image. Unit is MB.
       '';
     };
+    virtualisation.azureImage.contents = mkOption {
+      type = with types; listOf attrs;
+      default = [ ];
+      description = lib.mdDoc ''
+        Extra contents to add to the image.
+      '';
+    };
   };
   config = {
     system.build.azureImage = import ../../lib/make-disk-image.nix {
@@ -26,7 +33,7 @@ in
       '';
       configFile = ./azure-config-user.nix;
       format = "raw";
-      inherit (cfg) diskSize;
+      inherit (cfg) diskSize contents;
       inherit config lib pkgs;
     };
 

nixos/tests/gitea.nix

@@ -35,9 +35,11 @@ let
           enable = true;
           database = { inherit type; };
           package = giteaPackage;
+          metricsTokenFile = (pkgs.writeText "metrics_secret" "fakesecret").outPath;
           settings.service.DISABLE_REGISTRATION = true;
           settings."repository.signing".SIGNING_KEY = signingPrivateKeyId;
           settings.actions.ENABLED = true;
+          settings.metrics.ENABLED = true;
         };
         environment.systemPackages = [ giteaPackage pkgs.gnupg pkgs.jq ];
         services.openssh.enable = true;
@@ -143,6 +145,12 @@ let
           + '-H "Accept: application/json" | jq length)" = "1"'
       )
 
+      with subtest("Testing metrics endpoint"):
+          server.succeed('curl '
+                         + '-H "Authorization: Bearer fakesecret" '
+                         + 'http://localhost:3000/metrics '
+                         + '| grep gitea_accesses')
+
       with subtest("Testing runner registration"):
           server.succeed(
               "su -l gitea -c 'GITEA_WORK_DIR=/var/lib/gitea gitea actions generate-runner-token' | sed 's/^/TOKEN=/' | tee /var/lib/gitea/runner_token"

nixos/tests/syncthing-init.nix

@@ -1,7 +1,6 @@
 import ./make-test-python.nix ({ lib, pkgs, ... }: let
 
   testId = "7CFNTQM-IMTJBHJ-3UWRDIU-ZGQJFR6-VCXZ3NB-XUH3KZO-N52ITXR-LAIYUAU";
-  testName = "testDevice foo'bar";
 
 in {
   name = "syncthing-init";

pkgs/applications/audio/strawberry/default.nix

@@ -42,13 +42,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "strawberry";
-  version = "1.0.18";
+  version = "1.0.20";
 
   src = fetchFromGitHub {
     owner = "jonaski";
     repo = pname;
     rev = version;
-    hash = "sha256-vOay9xPSwgSYurFgL9f4OdBPzGJkV4t+7lJgeCeT0c4=";
+    hash = "sha256-/utd2uYoxPHQ4kQwA0tZW5HwmN90vXL23EiNFh3wXoE=";
   };
 
   # the big strawberry shown in the context menu is *very* much in your face, so use the grey version instead

pkgs/applications/blockchains/bitcoin-abc/default.nix

@@ -72,5 +72,6 @@ mkDerivation rec {
     license = licenses.mit;
     broken = stdenv.isDarwin;
     platforms = platforms.unix;
+    mainProgram = "bitcoin-cli";
   };
 }

pkgs/applications/blockchains/dcrd/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "dcrd";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "decred";
     repo = "dcrd";
     rev = "refs/tags/release-v${version}";
-    hash = "sha256-ZNBSIzx07zJrBxas7bHpZ8ZPDWJ4d7jumpKYj5Qmzlo=";
+    hash = "sha256-nSocqwXgJhvfbdElddbb1gGxoygmtVtK6DbiSuMxYew=";
   };
 
   patches = [
@@ -19,7 +19,7 @@ buildGoModule rec {
     })
   ];
 
-  vendorHash = "sha256-++IPB2IadXd1LC5r6f1a0UqsTG/McAf7KQAw8WKKoaE=";
+  vendorHash = "sha256-Napcfj1+KjQ21Jb/qpIzg2W/grzun2Pz5FV5yIBXoTo=";
 
   subPackages = [ "." "cmd/promptsecret" ];
 

pkgs/applications/blockchains/lndinit/default.nix

@@ -0,0 +1,28 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+buildGoModule rec {
+  pname = "lndinit";
+  version = "0.1.5-beta";
+
+  src = fetchFromGitHub {
+    owner = "lightninglabs";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-7ibjDIDKP1ASvCWiF03aLCR6RXqLxmdkR5UZoU3dneA=";
+  };
+
+  vendorHash = "sha256-2AHU5/XSDJAEvAg7LmGxCmrJ/oS84fNF3mXigKFDsb4=";
+
+  subPackages = ["."];
+
+  meta = with lib; {
+    description = "Wallet initializer utility for lnd";
+    homepage = "https://github.com/lightninglabs/lndinit";
+    mainProgram = pname;
+    license = licenses.mit;
+    maintainers = with maintainers; [aldoborrero];
+  };
+}

pkgs/applications/editors/bluefish/default.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchurl
-, intltool
 , wrapGAppsHook
 , pkg-config
 , gtk
@@ -14,14 +13,14 @@
 
 stdenv.mkDerivation rec {
   pname = "bluefish";
-  version = "2.2.12";
+  version = "2.2.14";
 
   src = fetchurl {
     url = "mirror://sourceforge/bluefish/bluefish-${version}.tar.bz2";
-    sha256 = "0slyjx4b4l612505q02crk00pjg9d5wi8gm5gxvcs0f6l9dr1y8d";
+    sha256 = "sha256-IszfnOTlyWIQY+bPfXOr+wc2q3pyvOCG0Gxc9e4SXt4=";
   };
 
-  nativeBuildInputs = [ intltool pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
   buildInputs = [
     gnome.adwaita-icon-theme
     gtk

pkgs/applications/editors/vscode/extensions/default.nix

@@ -343,11 +343,16 @@ let
         mktplcRef = {
           name = "vscode-neovim";
           publisher = "asvetliakov";
-          version = "0.0.97";
-          sha256 = "sha256-rNGW8WB3jBSjThiB0j4/ORKMRAaxFiMiBfaa+dbGu/w=";
+          version = "0.8.2";
+          sha256 = "0kw9asv91s37ql61blbb8pr7wb6c2ba1klchal53chp6ib55v5kn";
         };
         meta = {
+          changelog = "https://marketplace.visualstudio.com/items/asvetliakov.vscode-neovim/changelog";
+          description = "Vim-mode for VS Code using embedded Neovim";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=asvetliakov.vscode-neovim";
           license = lib.licenses.mit;
+          homepage = "https://github.com/vscode-neovim/vscode-neovim";
+          maintainers = [ lib.maintainers.mikaelfangel ];
         };
       };
 
@@ -896,8 +901,8 @@ let
         mktplcRef = {
           name = "vscode-markdownlint";
           publisher = "DavidAnson";
-          version = "0.51.0";
-          sha256 = "sha256-Xtr8cqcPrcrKpJBxQcY1j9Gl4CC6U3ZazS4bdBtdzUk=";
+          version = "0.52.0";
+          sha256 = "sha256-Y8qkcNEvJ/yzT8PDeErRzKGxYBNKKfbNNsJVaFDeIV4=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DavidAnson.vscode-markdownlint/changelog";
@@ -1400,8 +1405,8 @@ let
         mktplcRef = {
           name = "vscode-firefox-debug";
           publisher = "firefox-devtools";
-          version = "2.9.8";
-          sha256 = "sha256-MCL562FPgEfhUM1KH5LMl7BblbjIkQ4UEwB67RlO5Mk=";
+          version = "2.9.10";
+          sha256 = "sha256-xuvlE8L/qjOn8Qhkv9sutn/xRbwC9V/IIfEr4Ixm1vA=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/firefox-devtools.vscode-firefox-debug/changelog";
@@ -3507,6 +3512,22 @@ let
         };
       };
 
+      uiua-lang.uiua-vscode = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "uiua-vscode";
+          publisher = "uiua-lang";
+          version = "0.0.15";
+          sha256 = "sha256-q+hSssxOIfeRUw2z9nMiCmH8cAF+GPTvlmc1jl/L4uU=";
+        };
+        meta = {
+          description = "VSCode language extension for Uiua";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=uiua-lang.uiua-vscode";
+          homepage = "https://github.com/uiua-lang/uiua-vscode";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.wackbyte ];
+        };
+      };
+
       unifiedjs.vscode-mdx = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "vscode-mdx";

pkgs/applications/emulators/wine/sources.nix

@@ -116,8 +116,8 @@ in rec {
 
   staging = fetchFromGitHub rec {
     # https://github.com/wine-staging/wine-staging/releases
-    inherit (unstable) version;
-    hash = "sha256-8uxXyt3zu+LuFJbTQD+bv+Zmnzb18Dhlo3ign1lFT2s=";
+    version = "8.17.1";
+    hash = "sha256-h36NDFYsI0y8TG41IH10IdF4QEuBkBewQ3knZ9iwDpg=";
     owner = "wine-staging";
     repo = "wine-staging";
     rev = "v${version}";

pkgs/applications/emulators/wine/staging.nix

@@ -5,7 +5,7 @@ with callPackage ./util.nix {};
 let patch = (callPackage ./sources.nix {}).staging;
     build-inputs = pkgNames: extra:
       (mkBuildInputs wineUnstable.pkgArches pkgNames) ++ extra;
-in assert lib.getVersion wineUnstable == patch.version;
+in assert lib.versions.majorMinor wineUnstable.version == lib.versions.majorMinor patch.version;
 
 (lib.overrideDerivation wineUnstable (self: {
   buildInputs = build-inputs [ "perl" "util-linux" "autoconf" "gitMinimal" ] self.buildInputs;

pkgs/applications/graphics/f3d/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "f3d";
-  version = "2.1.0";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "f3d-app";
     repo = "f3d";
     rev = "refs/tags/v${version}";
-    hash = "sha256-2LDHIeKgLUS2ujJUx2ZerXmZYB9rrT3PYvrtzV4vcHM=";
+    hash = "sha256-3Pg8uvrUGPKPmsn24q5HPMg9dgvukAXBgSVTW0NiCME=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/graphics/photoqt/default.nix

@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation rec {
   pname = "photoqt";
-  version = "3.3";
+  version = "3.4";
 
   src = fetchurl {
     url = "https://photoqt.org/pkgs/photoqt-${version}.tar.gz";
-    hash = "sha256-AD+Uww/tmXRiAkmeuHBBollE6Y9L7c+fB882ALVtSXQ=";
+    hash = "sha256-kVf9+zI9rtEMmS0N4qrN673T/1fnqfcV3hQPnMXMLas=";
   };
 
   # error: no member named 'setlocale' in namespace 'std'; did you mean simply 'setlocale'?

pkgs/applications/misc/passky-desktop/default.nix

@@ -1,59 +1,70 @@
-{ lib, stdenv, fetchurl, appimageTools, undmg }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, electron_22
+, makeWrapper
+, makeDesktopItem
+, copyDesktopItems
+}:
 
-let
+stdenv.mkDerivation rec {
   pname = "passky-desktop";
-  version = "7.1.0";
+  version = "8.1.1";
 
-  srcs = {
-    x86_64-linux = fetchurl {
-      url = "https://github.com/Rabbit-Company/Passky-Desktop/releases/download/v${version}/Passky-${version}.AppImage";
-      sha256 = "1xnhrmmm018mmyzjq05mhbf673f0n81fh1k3kbfarbgk2kbwpq6y";
-    };
-    x86_64-darwin = fetchurl {
-      url = "https://github.com/Rabbit-Company/Passky-Desktop/releases/download/v${version}/Passky-${version}.dmg";
-      sha256 = "0mm7hk4v7zvpjdqyw3nhk33x72j0gh3f59bx3q18azlm4dr61r2d";
-    };
+  src = fetchFromGitHub {
+    owner = "Rabbit-Company";
+    repo = "Passky-Desktop";
+    rev = "refs/tags/v${version}";
+    sha256 = "1ma8s1bngjdzclcc4m5pcmavk38sidaskmz7dgfnv84y35si18dr";
   };
-  src = srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
-  appimageContents = appimageTools.extract { inherit pname version src; };
+  nativeBuildInputs = [ makeWrapper copyDesktopItems ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/passky
+    cp -r "." "$out/share/passky/electron"
+
+    local resolution
+    for icon in $out/share/passky/electron/images/icons/icon*.png; do
+      resolution=''${icon%".png"}
+      resolution=''${resolution##*/icon-}
+      mkdir -p "$out/share/icons/hicolor/''${resolution}/apps"
+      ln -s "$icon" "$out/share/icons/hicolor/''${resolution}/apps/passky.png"
+    done
+
+    mkdir "$out/share/applications"
+    makeWrapper ${electron_22}/bin/electron "$out/bin/passky" \
+      --add-flags "$out/share/passky/electron/" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (
+      makeDesktopItem {
+        name = "Passky";
+        type = "Application";
+        desktopName = "passky";
+        comment = "Simple, modern, open source and secure password manager.";
+        icon = "passky";
+        exec = "passky %U";
+        categories = [ "Utility" ];
+        startupWMClass = "Passky";
+      }
+    )
+  ];
+
   meta = with lib; {
+    description = "A simple, modern, lightweight, open source and secure password manager";
     homepage = "https://passky.org";
     downloadPage = "https://github.com/Rabbit-Company/Passky-Desktop/releases";
+    changelog = "https://github.com/Rabbit-Company/Passky-Desktop/releases/tag/v${version}";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ akkesm ];
-    platforms = builtins.attrNames srcs;
+    mainProgram = "passky";
+    platforms = platforms.unix;
   };
-
-  linux = appimageTools.wrapType2 {
-    inherit pname version src meta;
-
-    extraInstallCommands = ''
-      mv $out/bin/${pname}-${version} $out/bin/${pname}
-
-      install -D ${appimageContents}/passky.desktop \
-        $out/share/applications/${pname}.desktop
-
-      substituteInPlace $out/share/applications/${pname}.desktop \
-        --replace 'Exec=AppRun' 'Exec=${pname}'
-
-      cp -r ${appimageContents}/usr/share/icons $out/share
-    '';
-  };
-
-  darwin = stdenv.mkDerivation {
-    inherit pname version src meta;
-
-    nativeBuildInputs = [ undmg ];
-
-    sourceRoot = ".";
-
-    installPhase = ''
-      mkdir -p $out/Applications
-      cp -r *.app $out/Applications
-    '';
-  };
-in
-if stdenv.isDarwin
-  then darwin
-  else linux
+}

pkgs/applications/misc/tui-journal/default.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tui-journal";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "AmmarAbouZor";
     repo = "tui-journal";
     rev = "v${version}";
-    hash = "sha256-ASozznbqtQc9bIzxbL94t2CHY2/PeXfR1DKfhTmsX74=";
+    hash = "sha256-UK9Pq+QNEk+AeG5/ohyCiL+lSpENQfiR/Qm0nQGJGrg=";
   };
 
-  cargoHash = "sha256-H+j/i0Gfk7O2TLdw5FYHOrLy/jfMSF4cpzMtQ2XJn2M=";
+  cargoHash = "sha256-TpNnb3usDkNlcejlSkXb5R1fgVlKNYBFAWi1fEn9uzI=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/misc/workrave/default.nix

@@ -35,14 +35,14 @@
 
 stdenv.mkDerivation rec {
   pname = "workrave";
-  version = "1.10.51.1";
+  version = "1.10.52";
 
   src = fetchFromGitHub {
     repo = "workrave";
     owner = "rcaelers";
     rev = with lib;
       "v" + concatStringsSep "_" (splitVersion version);
-    sha256 = "sha256-rx3k4U5igRYxzuVke+x926K1Pso32iGob4Ccp0jdKds=";
+    sha256 = "sha256-U39zr8XGIDbyY480bla2yTaRQLP3wMrL8RLWjlTa5uY=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/browsers/lagrange/default.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lagrange";
-  version = "1.16.7";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "skyjake";
     repo = "lagrange";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-d9QmFXDDeYDR1KFtOyQKfaYvex8TFDiYJUrKEp7H5K8=";
+    hash = "sha256-UoyCsmZKpRkO4bQt6RwRAceu3+JPD8I8qSf9/uU5Vm4=";
   };
 
   nativeBuildInputs = [ cmake pkg-config zip ];

pkgs/applications/networking/clash-verge/default.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "clash-verge";
-  version = "1.3.5";
+  version = "1.3.7";
 
   src = fetchurl {
     url = "https://github.com/zzzgydi/clash-verge/releases/download/v${version}/clash-verge_${version}_amd64.deb";
-    hash = "sha256-dMlJ7f1wpaiJrK5Xwx+e1tsWkGG9gJUyiIjhvVCWEJQ=";
+    hash = "sha256-+RYfGLa4d5JkLWnlYfhjCOSREVJ4ad/R36eSiNj3GIA=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/cluster/calico/default.nix

@@ -2,16 +2,16 @@
 
 builtins.mapAttrs (pname: { doCheck ? true, mainProgram ? pname, subPackages }: buildGoModule rec {
   inherit pname;
-  version = "3.26.1";
+  version = "3.26.3";
 
   src = fetchFromGitHub {
     owner = "projectcalico";
     repo = "calico";
     rev = "v${version}";
-    hash = "sha256-QSebSc4V8DFSKufSB6M4YSuwDJ9rn/6IR6Fr38F8BBQ=";
+    hash = "sha256-KbtQ5oMZ1ygYwbaKpyAKTprPZ6+ikDbGLafwOShVd6w=";
   };
 
-  vendorHash = "sha256-SuV7OEt0ZlVt0i8L5rgQd0HJn63XuDHi7+pe+bq+6Yw=";
+  vendorHash = "sha256-1PBdDpc/cvI5uN6/msxXoMXbx7Osgq12W1VqtZ7XtGE=";
 
   inherit doCheck subPackages;
 

pkgs/applications/networking/cluster/cilium/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cilium-cli";
-  version = "0.15.8";
+  version = "0.15.10";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-iIE4jqvlkgf8+IrP0t+o0bZwlB5v61HzbyQy6ExAobE=";
+    hash = "sha256-iIv4xOqggbMDvscnaaz0QXjeScJ4SzOP0fvfshq+vyE=";
   };
 
   vendorHash = null;

pkgs/applications/networking/cluster/cmctl/default.nix

@@ -8,18 +8,18 @@
 
 buildGoModule rec {
   pname = "cmctl";
-  version = "1.13.0";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "cert-manager";
     repo = "cert-manager";
     rev = "v${version}";
-    hash = "sha256-o51CIwZeBq3XrNvu6n6dVCsmXH2pU7l3igw61KjI0cw=";
+    hash = "sha256-l0D7uVoYTwiVI+b8yYpsJk/eAG5XYidR9CaQ595aTjw=";
   };
 
   sourceRoot = "${src.name}/cmd/ctl";
 
-  vendorHash = "sha256-szDFQ5zxZ4IUMaIe/eyQAouomR6kpQXn/LZ3MEBbx0Y=";
+  vendorHash = "sha256-3Ws2ObyBVYog7oVqHeEgIeWeRQpV1Z+Clilp8wI/PUA=";
 
   ldflags = [
     "-s"

pkgs/applications/networking/cluster/linkerd/default.nix

@@ -2,7 +2,7 @@
 
 (callPackage ./generic.nix { }) {
   channel = "stable";
-  version = "2.14.0";
-  sha256 = "0j4qzmfhi286vsngf1j3s8zhk7xj2saqr27clmjy7ypjszlz5rvm";
-  vendorHash = "sha256-HxxekAipoWNxcLUSOSwUOXlrWMODw7gS8fcyTD3CMYE=";
+  version = "2.14.1";
+  sha256 = "1fxwy8c1zcjwnv055czn9ixalpvq710k0m82633n73a0ixnlmjbv";
+  vendorHash = "sha256-hOuvIndyGGvNWYmzE0rho/Y30/ilCzeBtL5GEvl9QqU=";
 }

pkgs/applications/networking/cluster/rke2/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "rke2";
-  version = "1.27.5+rke2r1";
+  version = "1.28.2+rke2r1";
 
   src = fetchFromGitHub {
     owner = "rancher";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-LKVz/oKt3WDf84KEEj4dRyjkRWZIWbOnEgG03EHvfGQ=";
+    hash = "sha256-PkBnM6mKE90e8VZ3QHYp2mM4RgD9u1gNjFea3RaPGy0=";
   };
 
-  vendorHash = "sha256-Ck3/sMvCLoXKtOIhn0uE8hHdTlPFjIT04l3zoZQNKPs=";
+  vendorHash = "sha256-aW8en8KJsPITKT4fIyhhtLiYdk+98iL14wQXG4HsM3U=";
 
   postPatch = ''
     # Patch the build scripts so they work in the Nix build environment.

pkgs/applications/networking/cluster/terragrunt/default.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.51.7";
+  version = "0.52.0";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-CZKY4/XQsWWlp6Xgv292LstahueJ9iFhxjB//RxlQOo=";
+    hash = "sha256-7Qd3Eat133pRthoYZzL9UYmL/cqgCRRWKGuZj9kqfFo=";
   };
 
   vendorHash = "sha256-NSrZVLQ3Qbnp94qCV7NbrEav/7LCRbTov+B2vzbuvdM=";

pkgs/applications/networking/cluster/tfupdate/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tfupdate";
-  version = "0.7.2";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "minamijoyo";
     repo = "tfupdate";
     rev = "v${version}";
-    sha256 = "sha256-ii37Au/2jjGdQjc2LnBPkyNNBMbD5XPPo7i3krF33W0=";
+    sha256 = "sha256-HyDWye7xL0g5vDoGl8FYFXfuMKU4rxAlFawQ5ynqkmc=";
   };
 
-  vendorHash = "sha256-gtAenM1URr2wFfe2/zCIyNvG7echjIxSxG1hX2vq16g=";
+  vendorHash = "sha256-oPqAH+i9ryb1Ps1yCkxoPgMmf4RNtFBCeE94vZAEnuo=";
 
   # Tests start http servers which need to bind to local addresses:
   # panic: httptest: failed to listen on a port: listen tcp6 [::1]:0: bind: operation not permitted

pkgs/applications/networking/instant-messengers/armcord/default.nix

@@ -39,7 +39,7 @@
 
 stdenv.mkDerivation rec {
   pname = "armcord";
-  version = "3.2.4";
+  version = "3.2.4-libwebp";
 
   src =
     let
@@ -47,12 +47,12 @@ stdenv.mkDerivation rec {
     in
       {
         x86_64-linux = fetchurl {
-          url = "${base}/v${version}/ArmCord_${version}_amd64.deb";
-          hash = "sha256-IUHcDHIJeGx7QKjxl3fUFHqUfs1JdIFxesvDXt3mVw0=";
+          url = "${base}/v${version}/ArmCord_${builtins.head (lib.splitString "-" version)}_amd64.deb";
+          hash = "sha256-WeHgai9vTaN04zMdAXmhemKroKH+kwHuOr/E85mfurE=";
         };
         aarch64-linux = fetchurl {
-          url = "${base}/v${version}/ArmCord_${version}_arm64.deb";
-          hash = "sha256-TWVlEjakdRyZmOuBq9HLO+R7y5jmgstFtyEHjf8nxxM=";
+          url = "${base}/v${version}/ArmCord_${builtins.head (lib.splitString "-" version)}_arm64.deb";
+          hash = "sha256-4/vGdWXv8wrbF/EhMK6kJPjta0EOGH6C3kUyM0OTB8M=";
         };
       }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
@@ -138,6 +138,5 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ ludovicopiero wrmilling ];
     platforms = [ "x86_64-linux" "aarch64-linux" ];
     mainProgram = "armcord";
-    knownVulnerabilities = [ "CVE-2023-4863" ];
   };
 }

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -1,14 +1,14 @@
 { branch ? "stable", callPackage, fetchurl, lib, stdenv }:
 let
   versions = if stdenv.isLinux then {
-    stable = "0.0.30";
-    ptb = "0.0.48";
-    canary = "0.0.169";
+    stable = "0.0.31";
+    ptb = "0.0.49";
+    canary = "0.0.170";
     development = "0.0.234";
   } else {
-    stable = "0.0.278";
-    ptb = "0.0.79";
-    canary = "0.0.314";
+    stable = "0.0.280";
+    ptb = "0.0.80";
+    canary = "0.0.315";
     development = "0.0.8797";
   };
   version = versions.${branch};
@@ -16,15 +16,15 @@ let
     x86_64-linux = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-eCfF7zC9JM/y14ovSJxMIvLY+IGv0Jvzn7MVgueltNs=";
+        hash = "sha256-toWwiMsEFsGaOYaPZziSmZtpzxGd9m+2MtxTrJwqFbw=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-Vea9Jm9qeU+bSFUGkAtd+3Goe6JvfT3KYX/Kt5UjFWc=";
+        hash = "sha256-o8cDoBe6A0wBjVLjp4JXrv3QsG7TZ/Kj4+T5lj6WHdY=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-32eKiQ9EncEZNL6MlK8lKqo0ZoRQKOpADx62bDQ6tvQ=";
+        hash = "sha256-Lw+qLAAwyoDBKDPOBA9HR79gcnqwTshFq6GMpFS0tXA=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
@@ -34,15 +34,15 @@ let
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-c60p8RX5Rv8tx6io65XbqyzJJKaCVDeL5NtwMLNIX5M=";
+        hash = "sha256-SUbpzd8RIf+e+so/dXZh5OkjCvWRC+EyqgeIg4u32Hg=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-HI4+ABFQtRBL7a3koCehJgn8WxJW86sCyuZE70n1AHk=";
+        hash = "sha256-IvrCjiZ5Oa616+U8C2ihg8THj7ePV2A8+82wUWqWoPY=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-SbCEao9Nh3cqCRD7FsHoKMVdy8T1y5tZAAGWHE6bSz0=";
+        hash = "sha256-m43SijSBxcAvYAlSFpQKIFILUm4AgSQ5F4XyQJyftts=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";

pkgs/applications/networking/remote/wayvnc/default.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wayvnc";
-  version = "0.6.2";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "any1";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-yNWTTjlmMCMTed1SiRep3iUxchQya1GnTVoub1cpR14=";
+    sha256 = "sha256-hmlzv1WaT+KucR7RGPC3bKcIdTxPOvK2s17nDucdu7c=";
   };
 
   strictDeps = true;

pkgs/applications/radio/uhd/3.5.nix

@@ -1,160 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, fetchFromGitHub
-, cmake
-, pkg-config
-# See https://files.ettus.com/manual_archive/v3.15.0.0/html/page_build_guide.html for dependencies explanations
-, boost
-, enableLibuhd_C_api ? true
-# requires numpy
-, enableLibuhd_Python_api ? false
-, python3
-, enableExamples ? false
-, enableUtils ? false
-, enableLiberio ? false
-, liberio
-, libusb1
-, enableDpdk ? false
-, dpdk
-# Devices
-, enableOctoClock ? true
-, enableMpmd ? true
-, enableB100 ? true
-, enableB200 ? true
-, enableUsrp1 ? true
-, enableUsrp2 ? true
-, enableX300 ? true
-, enableN230 ? true
-, enableN300 ? true
-, enableN320 ? true
-, enableE300 ? true
-, enableE320 ? true
-}:
-
-let
-  onOffBool = b: if b then "ON" else "OFF";
-  inherit (lib) optionals;
-in
-
-stdenv.mkDerivation rec {
-  pname = "uhd";
-  # UHD seems to use three different version number styles: x.y.z, xxx_yyy_zzz
-  # and xxx.yyy.zzz. Hrmpf... style keeps changing
-  version = "3.15.0.0";
-
-  src = fetchFromGitHub {
-    owner = "EttusResearch";
-    repo = "uhd";
-    rev = "v${version}";
-    sha256 = "0jknln88a69fh244670nb7qrflbyv0vvdxfddb5g8ncpb6hcg8qf";
-  };
-  # Firmware images are downloaded (pre-built) from the respective release on Github
-  uhdImagesSrc = fetchurl {
-    url = "https://github.com/EttusResearch/uhd/releases/download/v${version}/uhd-images_${version}.tar.xz";
-    sha256 = "1fir1a13ac07mqhm4sr34cixiqj2difxq0870qv1wr7a7cbfw6vp";
-  };
-
-  cmakeFlags = [
-    "-DENABLE_LIBUHD=ON"
-    "-DENABLE_USB=ON"
-    "-DENABLE_TESTS=ON" # This installs tests as well so we delete them via postPhases
-    "-DENABLE_EXAMPLES=${onOffBool enableExamples}"
-    "-DENABLE_UTILS=${onOffBool enableUtils}"
-    "-DENABLE_LIBUHD_C_API=${onOffBool enableLibuhd_C_api}"
-    "-DENABLE_LIBUHD_PYTHON_API=${onOffBool enableLibuhd_Python_api}"
-    "-DENABLE_LIBERIO=${onOffBool enableLiberio}"
-    "-DENABLE_DPDK=${onOffBool enableDpdk}"
-    # Devices
-    "-DENABLE_OCTOCLOCK=${onOffBool enableOctoClock}"
-    "-DENABLE_MPMD=${onOffBool enableMpmd}"
-    "-DENABLE_B100=${onOffBool enableB100}"
-    "-DENABLE_B200=${onOffBool enableB200}"
-    "-DENABLE_USRP1=${onOffBool enableUsrp1}"
-    "-DENABLE_USRP2=${onOffBool enableUsrp2}"
-    "-DENABLE_X300=${onOffBool enableX300}"
-    "-DENABLE_N230=${onOffBool enableN230}"
-    "-DENABLE_N300=${onOffBool enableN300}"
-    "-DENABLE_N320=${onOffBool enableN320}"
-    "-DENABLE_E300=${onOffBool enableE300}"
-    "-DENABLE_E320=${onOffBool enableE320}"
-  ]
-    # TODO: Check if this still needed
-    # ABI differences GCC 7.1
-    # /nix/store/wd6r25miqbk9ia53pp669gn4wrg9n9cj-gcc-7.3.0/include/c++/7.3.0/bits/vector.tcc:394:7: note: parameter passing for argument of type 'std::vector<uhd::range_t>::iterator {aka __gnu_cxx::__normal_iterator<uhd::range_t*, std::vector<uhd::range_t> >}' changed in GCC 7.1
-    ++ [ (lib.optionalString stdenv.isAarch32 "-DCMAKE_CXX_FLAGS=-Wno-psabi") ]
-  ;
-
-  # Python + mako are always required for the build itself but not necessary for runtime.
-  pythonEnv = python3.withPackages (ps: with ps; [ mako ]
-    ++ optionals (enableLibuhd_Python_api) [ numpy setuptools ]
-    ++ optionals (enableUtils) [ requests six ]
-  );
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-  ]
-    # If both enableLibuhd_Python_api and enableUtils are off, we don't need
-    # pythonEnv in buildInputs as it's a 'build' dependency and not a runtime
-    # dependency
-    ++ optionals (!enableLibuhd_Python_api && !enableUtils) [ pythonEnv ]
-  ;
-  buildInputs = [
-    boost
-    libusb1
-  ]
-    # However, if enableLibuhd_Python_api *or* enableUtils is on, we need
-    # pythonEnv for runtime as well. The utilities' runtime dependencies are
-    # handled at the environment
-    ++ optionals (enableLibuhd_Python_api || enableUtils) [ pythonEnv ]
-    ++ optionals (enableLiberio) [ liberio ]
-    ++ optionals (enableDpdk) [ dpdk ]
-  ;
-
-  doCheck = true;
-
-  # Build only the host software
-  preConfigure = "cd host";
-  # TODO: Check if this still needed, perhaps relevant:
-  # https://files.ettus.com/manual_archive/v3.15.0.0/html/page_build_guide.html#build_instructions_unix_arm
-  patches = if stdenv.isAarch32 then ./neon.patch else null;
-
-  postPhases = [ "installFirmware" "removeInstalledTests" ]
-    ++ optionals (enableUtils) [ "moveUdevRules" ]
-  ;
-
-  # UHD expects images in `$CMAKE_INSTALL_PREFIX/share/uhd/images`
-  installFirmware = ''
-    mkdir -p "$out/share/uhd/images"
-    tar --strip-components=1 -xvf "${uhdImagesSrc}" -C "$out/share/uhd/images"
-  '';
-
-  # -DENABLE_TESTS=ON installs the tests, we don't need them in the output
-  removeInstalledTests = ''
-    rm -r $out/lib/uhd/tests
-  '';
-
-  # Moves the udev rules to the standard location, needed only if utils are
-  # enabled
-  moveUdevRules = ''
-    mkdir -p $out/lib/udev/rules.d
-    mv $out/lib/uhd/utils/uhd-usrp.rules $out/lib/udev/rules.d/
-  '';
-
-  meta = with lib; {
-    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
-    description = "USRP Hardware Driver (for Software Defined Radio)";
-    longDescription = ''
-      The USRP Hardware Driver (UHD) software is the hardware driver for all
-      USRP (Universal Software Radio Peripheral) devices.
-
-      USRP devices are designed and sold by Ettus Research, LLC and its parent
-      company, National Instruments.
-    '';
-    homepage = "https://uhd.ettus.com/";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ bjornfor fpletz tomberek ];
-  };
-}

pkgs/applications/radio/uhd/default.nix

@@ -8,13 +8,19 @@
 , boost
 , ncurses
 , enableCApi ? true
-# requires numpy
+# Although we handle the Python API's dependencies in pythonEnvArg, this
+# feature is currently disabled as upstream attempts to run `python setup.py
+# install` by itself, and it fails because the Python's environment's prefix is
+# not a writable directly. Adding support for this feature would require using
+# python's pypa/build nad pypa/install hooks directly, and currently it is hard
+# to do that because it all happens after a long buildPhase of the C API.
 , enablePythonApi ? false
 , python3
 , buildPackages
 , enableExamples ? false
-, enableUtils ? false
+, enableUtils ? true
 , libusb1
+# Disable dpdk for now due to compilation issues.
 , enableDpdk ? false
 , dpdk
 # Devices
@@ -144,6 +150,10 @@ stdenv.mkDerivation (finalAttrs: {
     mv $out/lib/uhd/utils/uhd-usrp.rules $out/lib/udev/rules.d/
   '';
 
+  disallowedReferences = optionals (!enablePythonApi && !enableUtils) [
+    python3
+  ];
+
   meta = with lib; {
     description = "USRP Hardware Driver (for Software Defined Radio)";
     longDescription = ''

pkgs/applications/terminal-emulators/rio/default.nix

@@ -103,5 +103,6 @@ rustPlatform.buildRustPackage rec {
     maintainers = with lib.maintainers; [ otavio oluceps ];
     platforms = lib.platforms.unix;
     changelog = "https://github.com/raphamorim/rio/blob/v${version}/CHANGELOG.md";
+    mainProgram = "rio";
   };
 }

pkgs/applications/version-management/git-mit/default.nix

@@ -10,7 +10,7 @@
 }:
 
 let
-  version = "5.12.155";
+  version = "5.12.156";
 in
 rustPlatform.buildRustPackage {
   pname = "git-mit";
@@ -20,10 +20,10 @@ rustPlatform.buildRustPackage {
     owner = "PurpleBooth";
     repo = "git-mit";
     rev = "v${version}";
-    hash = "sha256-Hz/FGPnrY3EqlVuSks82UO6/7uHGEgnGgTddFKnj3AQ=";
+    hash = "sha256-AY+1zJsH4KgMiOfGDuNGxn5XmmYrWARapqiEZhckako=";
   };
 
-  cargoHash = "sha256-SiYj05OMUWn0hpJeMLEz846QQLTJuv4dtiSG/ow2yHI=";
+  cargoHash = "sha256-Rz0bgSlvekay5c/TYCu8FJUN3xnXjVFMa0wcUB72nw8=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/applications/video/bilibili/default.nix

@@ -7,10 +7,10 @@
 
 stdenv.mkDerivation rec {
   pname = "bilibili";
-  version = "1.12.0-2";
+  version = "1.12.1-2";
   src = fetchurl {
     url = "https://github.com/msojocs/bilibili-linux/releases/download/v${version}/io.github.msojocs.bilibili_${version}_amd64.deb";
-    hash = "sha256-LnTRznIUXU7h0SyOCfVjfqhNv2OCRujNoM1PtGUVJeU=";
+    hash = "sha256-vYoVHVT/Deooxq/0WVzPebR68N9KBJfgLU30lJPB89M=";
   };
 
   unpackPhase = ''

pkgs/applications/video/filebot/default.nix

@@ -10,11 +10,11 @@ let
   };
 in stdenv.mkDerivation (finalAttrs: {
   pname = "filebot";
-  version = "5.0.3";
+  version = "5.1.1";
 
   src = fetchurl {
-    url = "https://web.archive.org/web/20230418205553/https://get.filebot.net/filebot/FileBot_${finalAttrs.version}/FileBot_${finalAttrs.version}-portable.tar.xz";
-    hash = "sha256-8FTmR+ztR2ugPcgHvfwyh9yfxPiUJdeAVvjjl5cQCy0=";
+    url = "https://web.archive.org/web/20230917142929/https://get.filebot.net/filebot/FileBot_${finalAttrs.version}/FileBot_${finalAttrs.version}-portable.tar.xz";
+    hash = "sha256-BCsZBRtT2Ka7WZw7WFnagwoJwIO1L3qpFk/6nlGdpmQ=";
   };
 
   unpackPhase = "tar xvf $src";

pkgs/applications/virtualization/colima/default.nix

@@ -17,13 +17,13 @@
 
 buildGoModule rec {
   pname = "colima";
-  version = "0.5.5";
+  version = "0.5.6";
 
   src = fetchFromGitHub {
     owner = "abiosoft";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-i+JveX9cXF+2Po5NFM8HTmwcSJJ/iSPrlwbA/7aNhc0=";
+    sha256 = "sha256-1Tvh1K/jdJoCHeDO1ckbd793UqB6pn4Qvts3vk8PFTM=";
     # We need the git revision
     leaveDotGit = true;
     postFetch = ''
@@ -35,7 +35,7 @@ buildGoModule rec {
   nativeBuildInputs = [ installShellFiles makeWrapper ]
     ++ lib.optionals stdenv.isDarwin [ darwin.DarwinTools ];
 
-  vendorHash = "sha256-lsTvzGFoC3Brnr1Q0Hl0ZqEDfcTeQ8vWGe+xylTyvts=";
+  vendorHash = "sha256-IQKfv+bwDQMuDytfYvirBfrmGexj3LGnIQjoJv1NEoU=";
 
   # disable flaky Test_extractZones
   # https://hydra.nixos.org/build/212378003/log

pkgs/applications/virtualization/ecs-agent/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "amazon-ecs-agent";
-  version = "1.75.3";
+  version = "1.76.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aws";
     repo = pname;
-    hash = "sha256-30KDmbT46K5/jE2aSFkX2TZZvWDtzudazTyqFiyLTds=";
+    hash = "sha256-Ex+vYbOdD/AyCMgYF0xBKSxEM3lhBSRR80bx35t6tSA=";
   };
 
   vendorHash = null;

pkgs/applications/window-managers/weston/default.nix

@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchurl
+{ lib, stdenv, fetchurl, fetchpatch2
 , meson, ninja, pkg-config, python3, wayland-scanner
-, cairo, dbus, libdrm, libevdev, libinput, libxkbcommon, mesa, seatd, wayland
+, cairo, libdrm, libevdev, libinput, libxkbcommon, mesa, seatd, wayland
 , wayland-protocols, xcbutilcursor
 
 , demoSupport ? true
@@ -26,6 +26,16 @@ stdenv.mkDerivation rec {
     hash = "sha256-62hqfPAJkqI7F/GS/KmohzE+ksNG7jXYV1GWmD1la0o=";
   };
 
+  patches = [
+    # ci, backend-vnc: update to Neat VNC 0.7.0
+    # part of https://gitlab.freedesktop.org/wayland/weston/-/merge_requests/1051
+    (fetchpatch2 {
+      url = "https://gitlab.freedesktop.org/wayland/weston/-/commit/8895b15f3dfc555a869e310ff6e16ff5dced1336.patch";
+      hash = "sha256-PGAmQhzG8gZcYRaZwhKPlgzfbILIXGAHLSd9dCHAP1A=";
+      excludes = [ ".gitlab-ci.yml" ];
+    })
+  ];
+
   depsBuildBuild = [ pkg-config ];
   nativeBuildInputs = [ meson ninja pkg-config python3 wayland-scanner ];
   buildInputs = [

pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh

@@ -16,9 +16,19 @@ npmInstallHook() {
         cp "${npmWorkspace-.}/$file" "$dest"
     done < <(@jq@ --raw-output '.[0].files | map(.path) | join("\n")' <<< "$(npm pack --json --dry-run ${npmWorkspace+--workspace=$npmWorkspace} $npmPackFlags "${npmPackFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}")")
 
+    # Based on code from Python's buildPythonPackage wrap.sh script, for
+    # supporting both the case when makeWrapperArgs is an array and a
+    # IFS-separated string.
+    #
+    # TODO: remove the string branch when __structuredAttrs are used.
+    if [[ "${makeWrapperArgs+defined}" == "defined" && "$(declare -p makeWrapperArgs)" =~ ^'declare -a makeWrapperArgs=' ]]; then
+        local -a user_args=("${makeWrapperArgs[@]}")
+    else
+        local -a user_args="(${makeWrapperArgs:-})"
+    fi
     while IFS=" " read -ra bin; do
         mkdir -p "$out/bin"
-        makeWrapper @hostNode@ "$out/bin/${bin[0]}" --add-flags "$packageOut/${bin[1]}"
+        makeWrapper @hostNode@ "$out/bin/${bin[0]}" --add-flags "$packageOut/${bin[1]}" "${user_args[@]}"
     done < <(@jq@ --raw-output '(.bin | type) as $typ | if $typ == "string" then
         .name + " " + .bin
         elif $typ == "object" then .bin | to_entries | map(.key + " " + .value) | join("\n")

pkgs/build-support/rust/build-rust-crate/default.nix

@@ -353,6 +353,10 @@ crate_: lib.makeOverridable
           extraRustcOpts buildTests codegenUnits;
       };
       dontStrip = !release;
+
+      # We need to preserve metadata in .rlib, which might get stripped on macOS. See https://github.com/NixOS/nixpkgs/issues/218712
+      stripExclude = [ "*.rlib" ];
+
       installPhase = installCrate crateName metadata buildTests;
 
       # depending on the test setting we are either producing something with bins

pkgs/by-name/bi/bitmagnet/package.nix

@@ -0,0 +1,31 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "bitmagnet";
+  version = "0.0.6";
+
+  src = fetchFromGitHub {
+    owner = "bitmagnet-io";
+    repo = "bitmagnet";
+    rev = "v${version}";
+    hash = "sha256-+KAIHg8M2CM+GRRv+htmev8MFe/Y1sJ8p+um/c7kI7c=";
+  };
+
+  vendorHash = "sha256-ydiZ3KMEiVkmdzhHjYYLJ7wuiKmwlMEn4OWrKSOnaSo=";
+
+  ldflags = [ "-s" "-w" ];
+
+  meta = {
+    description = "A self-hosted BitTorrent indexer, DHT crawler, and torrent search engine";
+    longDescription = ''
+      A self-hosted BitTorrent indexer, DHT crawler, content classifier and torrent search engine with web UI, GraphQL API and Servarr stack integration.
+    '';
+    homepage = "https://bitmagnet.io/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ eclairevoyant ];
+    mainProgram = "bitmagnet";
+  };
+}

pkgs/by-name/dx/dxvk_1/package.nix

@@ -0,0 +1,57 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, glslang
+, meson
+, ninja
+, windows
+, pkgsBuildHost
+, enableMoltenVKCompat ? false
+}:
+
+let
+  isCross = stdenv.hostPlatform != stdenv.targetPlatform;
+in
+stdenv.mkDerivation (finalAttrs:  {
+  pname = "dxvk";
+  version = "1.10.3";
+
+  src = fetchFromGitHub {
+    owner = "doitsujin";
+    repo = "dxvk";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-T93ZylxzJGprrP+j6axZwl2d3hJowMCUOKNjIyNzkmE=";
+  };
+
+  # These patches are required when using DXVK with Wine on Darwin.
+  patches = lib.optionals enableMoltenVKCompat [
+    # Patch DXVK to work with MoltenVK even though it doesn’t support some required features.
+    # Some games work poorly (particularly Unreal Engine 4 games), but others work pretty well.
+    ./darwin-dxvk-compat.patch
+    # Use synchronization primitives from the C++ standard library to avoid deadlocks on Darwin.
+    # See: https://www.reddit.com/r/macgaming/comments/t8liua/comment/hzsuce9/
+    ./darwin-thread-primitives.patch
+  ];
+
+  nativeBuildInputs = [ glslang meson ninja ];
+  buildInputs = [ windows.pthreads ];
+
+  mesonFlags =
+    let
+      arch = if stdenv.is32bit then "32" else "64";
+    in
+    [
+      "--buildtype" "release"
+      "--prefix" "${placeholder "out"}"
+    ]
+    ++ lib.optionals isCross [ "--cross-file" "build-win${arch}.txt" ];
+
+  meta = {
+    description = "A Vulkan-based translation layer for Direct3D 9/10/11";
+    homepage = "https://github.com/doitsujin/dxvk";
+    changelog = "https://github.com/doitsujin/dxvk/releases";
+    maintainers = [ lib.maintainers.reckenrode ];
+    license = lib.licenses.zlib;
+    platforms = lib.platforms.windows;
+  };
+})

pkgs/by-name/dx/dxvk_2/package.nix

@@ -0,0 +1,77 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkgsBuildHost
+, glslang
+, meson
+, ninja
+, windows
+, spirv-headers
+, vulkan-headers
+, SDL2
+, glfw
+, gitUpdater
+, sdl2Support ? true
+, glfwSupport ? false
+}:
+
+# SDL2 and GLFW support are mutually exclusive.
+assert !sdl2Support || !glfwSupport;
+
+let
+  isCross = stdenv.hostPlatform != stdenv.targetPlatform;
+  isWindows = stdenv.hostPlatform.uname.system == "Windows";
+in
+stdenv.mkDerivation (finalAttrs:  {
+  pname = "dxvk";
+  version = "2.3";
+
+  src = fetchFromGitHub {
+    owner = "doitsujin";
+    repo = "dxvk";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-RU+B0XfphD5HHW/vSzqHLUaGS3E31d5sOLp3lMmrCB8=";
+    fetchSubmodules = true; # Needed for the DirectX headers and libdisplay-info
+  };
+
+  postPatch = ''
+    substituteInPlace "subprojects/libdisplay-info/tool/gen-search-table.py" \
+      --replace "/usr/bin/env python3" "${lib.getBin pkgsBuildHost.python3}/bin/python3"
+  '';
+
+  nativeBuildInputs = [ glslang meson ninja ];
+  buildInputs = [ spirv-headers vulkan-headers ]
+    ++ lib.optionals (!isWindows && sdl2Support) [ SDL2 ]
+    ++ lib.optionals (!isWindows && glfwSupport) [ glfw ]
+    ++ lib.optionals isWindows [ windows.pthreads ];
+
+  # Build with the Vulkan SDK in nixpkgs.
+  preConfigure = ''
+    rm -rf include/spirv/include include/vulkan/include
+    mkdir -p include/spirv/include include/vulkan/include
+  '';
+
+  mesonFlags =
+    let
+      arch = if stdenv.is32bit then "32" else "64";
+    in
+    [
+      "--buildtype" "release"
+      "--prefix" "${placeholder "out"}"
+    ]
+    ++ lib.optionals isCross [ "--cross-file" "build-win${arch}.txt" ]
+    ++ lib.optional glfwSupport "-Ddxvk_native_wsi=glfw";
+
+  doCheck = !isCross;
+
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  meta = {
+    description = "A Vulkan-based translation layer for Direct3D 9/10/11";
+    homepage = "https://github.com/doitsujin/dxvk";
+    changelog = "https://github.com/doitsujin/dxvk/releases";
+    maintainers = [ lib.maintainers.reckenrode ];
+    license = lib.licenses.zlib;
+    platforms = lib.platforms.windows ++ lib.platforms.linux;
+  };
+})

pkgs/by-name/ec/ecc/package.nix

@@ -0,0 +1,124 @@
+{ lib
+, makeWrapper
+, fetchFromGitHub
+, rustPackages
+, pkg-config
+, elfutils
+, zlib
+}:
+let
+  inherit (rustPackages.rustc) llvmPackages;
+  inherit (rustPackages) rustPlatform;
+  bpftool = llvmPackages.stdenv.mkDerivation {
+    pname = "bpftool";
+    version = "unstable-2023-03-11";
+
+    # this fork specialized for some functions
+    # and has eventually been embedded into the ecc binary
+    src = fetchFromGitHub {
+      owner = "eunomia-bpf";
+      repo = "bpftool";
+      rev = "05940344f5db18d0cb1bc1c42e628f132bc93123";
+      hash = "sha256-g2gjixfuGwVnFlqCMGLWVPbtKOSpQI+vZwIZciXFPTc=";
+      fetchSubmodules = true;
+    };
+
+    buildInputs = [
+      llvmPackages.libllvm
+      elfutils
+      zlib
+    ];
+
+    buildPhase = ''
+      make -C src
+    '';
+
+    installPhase = ''
+      # We don't use the default `make install` because we are looking to create a
+      # directory structure compatible with `build.rs` of `ecc`.
+      mkdir -p $out/src/libbpf
+      # some headers are required
+      cp -r src/libbpf/include $out/src/libbpf
+      cp src/bpftool $out/src
+    '';
+  };
+
+  vmlinux-headers = fetchFromGitHub {
+    owner = "eunomia-bpf";
+    repo = "vmlinux";
+    rev = "933f83becb45f5586ed5fd089e60d382aeefb409";
+    hash = "sha256-CVEmKkzdFNLKCbcbeSIoM5QjYVLQglpz6gy7+ZFPgCY=";
+  };
+
+in
+rustPlatform.buildRustPackage rec {
+  pname = "ecc";
+  version = "1.0.11";
+
+  src = fetchFromGitHub {
+    owner = "eunomia-bpf";
+    repo = "eunomia-bpf";
+    rev = "v${version}";
+    hash = "sha256-UiwS+osyC3gtbQH0bWNsx1p3xYr993/FAZ5d5NKnaBM=";
+  };
+
+  sourceRoot = "${src.name}/compiler/cmd";
+
+  cargoHash = "sha256-j2HPSmU/JARfw2mE1IiXFT/dcdxxnp+agC2DN0Kc5nw=";
+
+  nativeBuildInputs = [
+    pkg-config
+    makeWrapper
+    rustPlatform.bindgenHook
+  ];
+
+  buildInputs = [
+    elfutils
+    zlib
+  ];
+
+  CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER = "gcc";
+
+  preBuild = ''
+    # `SANDBOX` defined by upstream to disable build-time network access
+    export SANDBOX=1
+    # specify dependencies' location
+    export VMLINUX_DIR=${vmlinux-headers}
+    export BPFTOOL_DIR=${bpftool}
+  '';
+
+  preCheck = ''
+    export HOME=$NIX_BUILD_TOP
+  '';
+
+  checkFlags = [
+    # requires network access
+    "--skip=bpf_compiler::tests::test_generate_custom_btf"
+
+    # FIXME: requires dynamic link `libclang` or clang binary which are not found in check env
+    "--skip=bpf_compiler::tests::test_compile_bpf"
+    "--skip=bpf_compiler::tests::test_export_multi_and_pack"
+    "--skip=document_parser::test::test_parse_empty"
+    "--skip=document_parser::test::test_parse_maps"
+    "--skip=document_parser::test::test_parse_progss"
+    "--skip=document_parser::test::test_parse_variables"
+  ];
+
+  passthru = {
+    inherit bpftool;
+  };
+
+  postFixup = ''
+    wrapProgram $out/bin/ecc-rs \
+      --prefix LIBCLANG_PATH : ${llvmPackages.libclang.lib}/lib \
+      --prefix PATH : ${lib.makeBinPath (with llvmPackages; [clang bintools-unwrapped])}
+  '';
+
+  meta = with lib; {
+    homepage = "https://eunomia.dev";
+    description = "the eBPF compile toolchain for eunomia-bpf";
+    maintainers = with maintainers; [ oluceps ];
+    platforms = platforms.linux;
+    license = licenses.mit;
+  };
+}

pkgs/by-name/ek/eksctl/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.160.0";
+  version = "0.161.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    hash = "sha256-fhsv4iiUO69TenK4MIGfQcVCBeYkKBcAEVZJPoNAixk=";
+    hash = "sha256-hlHwzZ0U3G6IGJjeHZPlO2+thJ1UKxHhRb28EQ39pZk=";
   };
 
-  vendorHash = "sha256-LiRzPJ7DBV0gsE9pJQ18l2grgk2WLkD8i83Fvr9asMM=";
+  vendorHash = "sha256-9rT2zkgwxDQlxTWF1zHpYOOI7uK5Q/GYFWIrKgP2GaQ=";
 
   doCheck = false;
 

pkgs/by-name/ez/eza/package.nix

@@ -17,16 +17,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "eza";
-  version = "0.14.0";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     rev = "v${version}";
-    hash = "sha256-T/3JUjeBw5r1E0hnMRWbMsuqKKHSVSC12HIgOAU0Gi4=";
+    hash = "sha256-6Hb+Zt9brnmxVXVUPhJa6yh8fccrD56UXoCw/wZGowI=";
   };
 
-  cargoHash = "sha256-Wao9J684kSZT/StCNtBDJCdx9tiWTlU+WxCYHD6oeqw=";
+  cargoHash = "sha256-01LuDse7bbq8jT7q8P9ncyQUqCAXR9pK6GmsaDUNYck=";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
   buildInputs = [ zlib ]

pkgs/by-name/gb/gbar/package.nix

@@ -0,0 +1,58 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, cmake
+, pkg-config
+, libdbusmenu-gtk3
+, gtk-layer-shell
+, stb
+, wayland-protocols
+, wayland-scanner
+, bluez
+, gtk3
+, libpulseaudio
+, wayland
+}:
+
+stdenv.mkDerivation {
+  pname = "gbar";
+  version = "unstable-2023-09-21";
+
+  src = fetchFromGitHub {
+    owner = "scorpion-26";
+    repo = "gBar";
+    rev = "96485f408efe411f281fa27dceb6d86399ec7804";
+    hash = "sha256-4zPvo0JBQOV1qn2X2iI8/JWYEQjFf9sDEICIWSCeaWk=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    wayland
+    wayland-protocols
+    wayland-scanner
+    bluez
+    gtk3
+    gtk-layer-shell
+    libpulseaudio
+    stb
+    libdbusmenu-gtk3
+  ];
+
+  meta = with lib; {
+    description = "Blazingly fast status bar written with GTK";
+    homepage = "https://github.com/scorpion-26/gBar";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ocfox ];
+    mainProgram = "gBar";
+    platforms = platforms.linux;
+  };
+}

pkgs/by-name/po/poethepoet/package.nix

@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "poethepoet";
-  version = "0.24.0";
+  version = "0.24.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nat-n";
     repo = "poethepoet";
     rev = "v${version}";
-    hash = "sha256-fW457R8DvkHdgNcPatEf1nJNjMYTmliiRHrYyAAoZuo=";
+    hash = "sha256-cIIMwQF0jqGQhNyX2qDBeKZlUNvdC6sBTv5LCxk8MMQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/se/searxng/package.nix

@@ -3,15 +3,15 @@
 , fetchFromGitHub
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.toPythonModule (python3.pkgs.buildPythonApplication rec {
   pname = "searxng";
-  version = "unstable-2023-07-19";
+  version = "unstable-2023-10-01";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = "a446dea1bb492eac417de9a900fae7cdf94aeec0";
-    sha256 = "sha256-iZDaKCkDlp3O3IixWdXVykNRIxas+irG0dWAOU4wycI=";
+    rev = "d56b31d67473e0970bc457469b0cbec2e35f8b10";
+    hash = "sha256-/lMjL2dl7UVYRjafFKmV3XsIH6QehUWCozCuBuxFgpQ=";
   };
 
   postPatch = ''
@@ -73,6 +73,6 @@ python3.pkgs.buildPythonApplication rec {
     homepage = "https://github.com/searxng/searxng";
     description = "A fork of Searx, a privacy-respecting, hackable metasearch engine";
     license = licenses.agpl3Plus;
-    maintainers = with maintainers; [ SuperSandro2000 ];
+    maintainers = with maintainers; [ SuperSandro2000 _999eagle ];
   };
-}
+})

pkgs/by-name/ui/uiua/package.nix

@@ -6,20 +6,24 @@
 , audioSupport ? true
 , darwin
 , alsa-lib
+
+# passthru.tests.run
+, runCommand
+, uiua
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "uiua";
-  version = "0.0.16";
+  version = "0.0.17";
 
   src = fetchFromGitHub {
     owner = "uiua-lang";
     repo = "uiua";
     rev = "refs/tags/${version}";
-    hash = "sha256-CMuCl4idoO5qIpXdkXBbglsZQBWVT8w9azbn2rRxviA=";
+    hash = "sha256-vZo3JKvvlL//4P+EqcsDXyamAMnCBARSF/H6OJTayF4=";
   };
 
-  cargoHash = "sha256-BLP9OGTnksM9NscfhtVWxE0/CqZgkqqlIMgRclCzEzs=";
+  cargoHash = "sha256-AkBcvFz7mrYUNTokcfoSXwWpw7SupI0+52GL4QXUu24=";
 
   nativeBuildInputs = lib.optionals stdenv.isDarwin [
     rustPlatform.bindgenHook
@@ -37,6 +41,12 @@ rustPlatform.buildRustPackage rec {
 
   buildFeatures = lib.optional audioSupport "audio";
 
+  passthru.tests.run = runCommand "uiua-test-run" {nativeBuildInputs = [uiua];} ''
+    uiua init;
+    diff -U3 --color=auto <(uiua run main.ua) <(echo '"Hello, World!"')
+    touch $out;
+  '';
+
   meta = with lib; {
     description = "A stack-oriented array programming language with a focus on simplicity, beauty, and tacit code";
     longDescription = ''

pkgs/data/fonts/iosevka/bin.nix

@@ -11,7 +11,7 @@ let
     (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
   pname = "${name}-bin";
-  version = "27.0.1";
+  version = "27.1.0";
 
   src = fetchurl {
     url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";

pkgs/data/fonts/iosevka/default.nix

@@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;
 
 buildNpmPackage rec {
   pname = if set != null then "iosevka-${set}" else "iosevka";
-  version = "27.1.0";
+  version = "27.2.0";
 
   src = fetchFromGitHub {
     owner = "be5invis";
     repo = "iosevka";
     rev = "v${version}";
-    hash = "sha256-KXF+ePMEwEUh0fs0cOELRmxOp9hHibDLfRdbffLcZDs=";
+    hash = "sha256-jRUwXnsYzM4BH+tEM6xuoB3/MFqbnR0deT3Slgkemvs=";
   };
 
-  npmDepsHash = "sha256-NfR7OUVguMZVmeumf8oRaQK28G42zy6p6K+Hx4e1Kgw=";
+  npmDepsHash = "sha256-6ikjJScy6iL8lZ9eE2JBz7+egRCNli4XC9hnEalX408=";
 
   nativeBuildInputs = [
     remarshal

pkgs/data/fonts/iosevka/variants.nix

@@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "131bxglkns15zan0xzk8k781458ig34jijzp0k27wdpw8dgblykh";
-  iosevka-aile = "0xyxjj3kr0sb8s40kl1lyzmkd18w2m4qnarfbrssxcbafgs6hd3f";
-  iosevka-curly = "0vgmynf2d2b0vxvksgsiss02was60zb7bavrffddh3fklrarkil8";
-  iosevka-curly-slab = "1gg95wccw82v7xdgibajmf312lw1c8bdpk3jl1vvp4xmig06gnfs";
-  iosevka-etoile = "1k928f9mj1fyjwxmn5iddb0p067mji408va96hcm7wy396gmh40j";
-  iosevka-slab = "06kl8y0jpbirdpx7ga09icdsjp9x3hm1552h5sq4wgy8m2prlvja";
-  iosevka-ss01 = "18dywa48mhfzaf3y4vq8509fk9sff1w7ddda6ldglvba15qj56q8";
-  iosevka-ss02 = "0f1iqbvdrdvlk6z0mykm1f095jljni9xkbkc5pnxz5ahv6lxmx6g";
-  iosevka-ss03 = "0bd50by3zlbph859g2fw5ly4lv8ywv4x1qmf1ja5ay02g5b41ail";
-  iosevka-ss04 = "0gxfma9fl6q49i6ymk84a7pz4r4wnik0ixccx478i2pdbbmyvads";
-  iosevka-ss05 = "0ms52v7y5sj579hghj8gc9rl736lpymslpbs3lfkx5p26kxwk3ny";
-  iosevka-ss06 = "0qky2yplvfln3nhclbfzdl6hn0pyjra43by8pwqzx43ai87sz4rl";
-  iosevka-ss07 = "17d0m773plnd3v8sj5j9sb5mb9qnqjnii43r0md8f0iwa3icp406";
-  iosevka-ss08 = "1rx7jv8hhy55gajx4y2741zbrl212qgx7lslgd8y924gxspkfaxq";
-  iosevka-ss09 = "1mz4sc7qn3nmq7l7cm3lh0i1pysqzns8pmqa9a7l6c8llzk8n9xa";
-  iosevka-ss10 = "1z5wa5ja205z3zyw1jdw9l59fzvfw1bifvqn9qxlnbjrkrn5kdsf";
-  iosevka-ss11 = "1lhw4ynk3wxp7bl4w2hg4vydj4y64nhi5cxn8mvamv9j7qqjyfdm";
-  iosevka-ss12 = "1gya74qfzql3y2j820yihy5hhm9hqf7ip7qnv9mhdymwzpc5swb2";
-  iosevka-ss13 = "0rr3nwwwvwh9q6fpkzxlxxw21gp8zsd611kx9m5igb6yx6wmm9z7";
-  iosevka-ss14 = "0p7wha20va30834z2y55s89g00z19587bbv7z6id64lvdwyki3fk";
-  iosevka-ss15 = "1bq707bkp5zyhjwdzadv9aaf8xnnxlzrqircgm56xbdc6j1y3zj2";
-  iosevka-ss16 = "03pb7hr5ncvlsmg48xasycsmcqwwy831xq7f747pzn0pvfbpzbcm";
-  iosevka-ss17 = "1scbnvd6wj9cm6ahxw5qa4cnq6ld118kmlzmd73fqram3l9m3w06";
-  iosevka-ss18 = "0xq9cypwdpg13s7swvhhiazkw8fpsf85c8salbg4wp8j1lq6lcrm";
-  sgr-iosevka = "1ha7n2liqkxlwiaz5r1zxv5ivchiyqrlahwd7w90w1z5sqwzmy3p";
-  sgr-iosevka-aile = "0cp9nj3z9kc3fax1z0zrv3x725pl2m5w7sfz0idpfaiwa0593n10";
-  sgr-iosevka-curly = "1lygvbjrg8lzbrqx7yznpc89r37farkk00dxnwjvc2v8r9796lv5";
-  sgr-iosevka-curly-slab = "0cz3wsldvsqyq3lxm579zimch118pr5cbvgyq6x4437nykk0jm9c";
-  sgr-iosevka-etoile = "0zxnpk0i8qkk8cq49sb2c6lr08j1y3pdj2560qcs7l64q4fzzr1v";
-  sgr-iosevka-fixed = "08ha4khxz8pskj051hjv3rvzlg6ry3gxwlc2q1ajf2j4viyw8245";
-  sgr-iosevka-fixed-curly = "1v4isscbgc6qya41znfnglply9rj7q6rmvn260r4rbj2hx99j5wy";
-  sgr-iosevka-fixed-curly-slab = "0smw0anc9rljarr4c4szvyjbd0ajj7pl001pi69cjpx0xb8zrcsz";
-  sgr-iosevka-fixed-slab = "0iffpdk35dkvczarn4y778k23rdicl0yr613w3z3alx1sajg02q4";
-  sgr-iosevka-fixed-ss01 = "056xmr3688lhpvbn2sqii1p8py6smkpar6jl5bls529cmd8zcfwi";
-  sgr-iosevka-fixed-ss02 = "0qrirgskr8xmcrbi3xvskb29xlq4sxhr67grin5m957nckqi257f";
-  sgr-iosevka-fixed-ss03 = "12hxqax5b02iswpwmfv1kp08gdcxjijsl3a6fwl2gm2ciwvhc4mj";
-  sgr-iosevka-fixed-ss04 = "0xlgxsrirkrwy0rrgiib5ahsqv9kcnfckcb02gkdn4w3bhlkydbr";
-  sgr-iosevka-fixed-ss05 = "1v2a97kw5zpw8q46v59jsmm7y4s4b1ksfk3kjnm92c8vbysmkm1z";
-  sgr-iosevka-fixed-ss06 = "1z3xb2jvgjg58kjipsvjkcc5pfsqs4pd86hvkjfbng2jjl0lvcjl";
-  sgr-iosevka-fixed-ss07 = "1g2fzzylj0g4bz9zrf9mj42h0wrwg27zdq0njgj78wp4fspmllrl";
-  sgr-iosevka-fixed-ss08 = "0qb8x8rxyq13yrv62hw7vx8bvl4nwdzdharxf6c34njsg0nafnw0";
-  sgr-iosevka-fixed-ss09 = "07dhlnh3ismw8ixdnw73xam0jji6kha5h10cqjl3jbqxlghdm873";
-  sgr-iosevka-fixed-ss10 = "0gas1ms88cd5fqajqa89vn87pnqlpy2kry418arwy9c3h5fpdw70";
-  sgr-iosevka-fixed-ss11 = "15zpzv45m5fc7vb2apz6jywc0ip0ykxzb16qdj8qf8j4rq0ajyw0";
-  sgr-iosevka-fixed-ss12 = "00pj11pkhkv72223mv0bhdj0qqv13ywc0gmdkfnmd9cbl0ml1yk8";
-  sgr-iosevka-fixed-ss13 = "1c6qffagjn3qy87gszh0cfm2xz3bnyz8gf4aqbpxyjg55abd1jx0";
-  sgr-iosevka-fixed-ss14 = "1pixg3sjaqc7m1nxcs5alczkk3axhscbgl3x599d5by02z7m1pxq";
-  sgr-iosevka-fixed-ss15 = "0x0k5i3pd4dhbkpb427lmayrvj6bbbr3gp262asckhcsq093wh7c";
-  sgr-iosevka-fixed-ss16 = "0rgv1cl5261bfhx50bkhz8276jbshzf8sz421nmz4qpmxzdalk1p";
-  sgr-iosevka-fixed-ss17 = "1g1w7zirrl9gjky8nbgbh9qjdq03r6sdh9hxcli1wz5qv09zwmh0";
-  sgr-iosevka-fixed-ss18 = "1igfnc9gl5wa06qaw3pisq4ppvd5nwzlh2f34r3xrzmiak9ljwlc";
-  sgr-iosevka-slab = "17mpfvcf4wa2kql8024pdmdf23qm17ch9cr6s1a2pgwf0hn2b3nh";
-  sgr-iosevka-ss01 = "14chhyysy66z01jq9j3d40765sz4d0v3ivzf319clv82q80gkm92";
-  sgr-iosevka-ss02 = "1c8wdcz0f8c9jdc0nyia60m785pblvcd62ag4d329dli8fp0c4kg";
-  sgr-iosevka-ss03 = "1jhl0pcwmvwkify2fdv5ml6l26106xnphxrqn11wsvg4dln3afjl";
-  sgr-iosevka-ss04 = "1wj5nbdnb3n5vfc3y41cwbqqxnhd7p2b55qd05ij85b5a9cgsflj";
-  sgr-iosevka-ss05 = "0zw7ryr7mf7c1njfin66yycg4lalrdvhdd4ycf031qj07v5py5cn";
-  sgr-iosevka-ss06 = "1ka2l4mk0ahn4alnlhyspifg2qnm7cb3ydmndy3q249aidp58bzs";
-  sgr-iosevka-ss07 = "085ghsjwysvzqpksj95x91yz0fyzc5pfj9lhpa8li0x2wjba2jsh";
-  sgr-iosevka-ss08 = "0054z74wk3wbaj3nqnkp7h6fj0zqggnhi21wwfpq52knk8ffc00s";
-  sgr-iosevka-ss09 = "0rbmhq7qix0v4ff8x9j6cgxnjfp80ck2gfww8a7k3nld9z4dn6v8";
-  sgr-iosevka-ss10 = "1ckaiqw677fi195ah496zhhs678bc4xzh31hhwsmvp92y7mfy5na";
-  sgr-iosevka-ss11 = "0zqv2qmvp07j430vbym6552zqky04dx2bnn66r40ndjsz96g8081";
-  sgr-iosevka-ss12 = "10srsjb10qwhm9hgzm56aq58wgy3r9nrcyrvj7jq1q32s5r7jv16";
-  sgr-iosevka-ss13 = "1aaikjri6xkhg6585r6079c41iqhdr94nlismk0zcdygy3ln6vbx";
-  sgr-iosevka-ss14 = "01p421bprrsrddc0f8yxgfg0db8gxs7zgass4p8smainq3zym7v7";
-  sgr-iosevka-ss15 = "0fping8ssj32rsacj7b8a13l0jcmmhznx0phv28x76hkcwagh674";
-  sgr-iosevka-ss16 = "1nzk6hf689v7s81qi1nb7vdg2xvd7v2gv2id9xgdjbfmf3bld10j";
-  sgr-iosevka-ss17 = "01cr9bw4cfyw7i4fim1xdcj5qn2l1dzccnakbqndycmnx4k1134v";
-  sgr-iosevka-ss18 = "10i5qv9ans24mjymq9jh7i3ygdkjvr38y0xc44sn7fb5l72miz1l";
-  sgr-iosevka-term = "02qaa9g0q1d66ha5391xm2vh24hr1vjqw6h6j05a9z2a0y712j71";
-  sgr-iosevka-term-curly = "1xjv9n7dimrsn0dcz9jz6p810bdx7bhcrwnh6m5mvxcf7bpj8341";
-  sgr-iosevka-term-curly-slab = "0sbj3s6ig6410092lsls7mq7h98cipmnabd1fcqxn6dszvhqq6q9";
-  sgr-iosevka-term-slab = "101m8cgjr6s8c42xas2dqyzbl44ab0y1s4cx1rqr8bgr5zxp3jsc";
-  sgr-iosevka-term-ss01 = "0b0i2gs1cv45b5ki8lgiclrly1sg2kh3r82gqbsh4scijv3md9m1";
-  sgr-iosevka-term-ss02 = "0vsldgiscl74jmj55mzqg5zz5pbg6f2fqksfyfyjdps5f584dqq7";
-  sgr-iosevka-term-ss03 = "10czljsmga2nvjix9lca84p271hx2i612984b2hbcz8cip4v2my6";
-  sgr-iosevka-term-ss04 = "06fwjgkqmhngnsljklxz2ab9dpr4sqhn8pxrkhhqka4r5srpn454";
-  sgr-iosevka-term-ss05 = "0lk1k89kjr7ld3bh8pcc8gagjgxv90bwgsgjmn7gqq7nj0kknh4j";
-  sgr-iosevka-term-ss06 = "1apfrkfxq8xbc8hry7x5l8bx87zv13asyw03hirrvzvqrl6q76lw";
-  sgr-iosevka-term-ss07 = "05rvnm17f7qgy4zq3chp12dqvdxwvfv7rld7axccyikqh3b63kn8";
-  sgr-iosevka-term-ss08 = "1y0n2dl6vknvpxhn5d2zsnjj2vgpd9saqs0kmvlbd7lpjsz8d7i0";
-  sgr-iosevka-term-ss09 = "0qkn7syk2wrk14nhwnkbbavsi518pi7qzppiq56y5z1l119dwhrg";
-  sgr-iosevka-term-ss10 = "04b78kk5mggb5xdpigkbkgvcl9q5v41mpx466isqwgxa3p6bp2b4";
-  sgr-iosevka-term-ss11 = "01wsf0qbybnw3bg7iy6yigamg31dhvl6k1gb8jsg4ylllpy7aip3";
-  sgr-iosevka-term-ss12 = "079sbibpsa3xvp8v0pdcacfpck4s01xkczbrbzpnrwiha4b5dqj4";
-  sgr-iosevka-term-ss13 = "1py76ly8wppb0q05mhv91q2x7slidwbbycm86q225yx8hgl0wjdi";
-  sgr-iosevka-term-ss14 = "0sq49yvl03w56dzxpzvfr18bah964g93fg42n31q5bbybmgykd8j";
-  sgr-iosevka-term-ss15 = "0x8kksl8k7zj0hh0fjlqmc5g2jwzdl8ylx6ljzdhfs6y9kdgf04r";
-  sgr-iosevka-term-ss16 = "1kh0m87j4nghgpixh213zs8b626yy5vbmjd4ng17jvvdj98faxzn";
-  sgr-iosevka-term-ss17 = "14rwlw0y8fv7ykyvxhpdhzycmi3j0zx3zrsvph61mnsk33p05vb9";
-  sgr-iosevka-term-ss18 = "19m3f6sgn8ivdhy7nagym6c0nwfd9yyqjdn6q6lxd8hp751jzlf9";
+  iosevka = "1myr4w5k8fffyhm1h83vdp81zwxj9k6lcx78h3hw7wy1bgqlm3zs";
+  iosevka-aile = "15zyvl999agk28wjzh618x51h2vxdnifc757dwyx1pd734r9wi6g";
+  iosevka-curly = "196df0dd7k5rvslm4392jkfr8yxrs73i68nyacy85wf55k5g6m1y";
+  iosevka-curly-slab = "06xb4ziaq23qby6prglrn03nb9w3w52jqb15y4j8h4ybmgagvkmy";
+  iosevka-etoile = "1sbcdl0vg9d8cfq6wlb70kzl8bx9xj3bbm4rn3cig1b59z0w8ym1";
+  iosevka-slab = "0bpm891vg85lxqb8cwcmcp4rm2f1wrad5dkb03m1qq1c0b6b6jjf";
+  iosevka-ss01 = "0qwgy6wm3vxkv9vaj2wbxaaxc2ckxqng7kiay50lc9xcchv80x35";
+  iosevka-ss02 = "035yv4spyzbl4a93f8y6pr3aicw60f45haszzfkh779mj5h1dkj6";
+  iosevka-ss03 = "1ai3si44x62wkdyc6vc3wkg8p8j3xkyqnjnggck0cnhvbivwbhsl";
+  iosevka-ss04 = "1gyarinnnqz0a1aqigr70msvylf0dzpjbh7bp507iww8y03fzz15";
+  iosevka-ss05 = "04qrc22jx2j991xbfslfgs2h6mv4glmc54v1f6rsvjyi7skdxxxv";
+  iosevka-ss06 = "0mpi34sw1k06h24a7xrywhr998ch6sdvzb94jnlh18aq63nib6jc";
+  iosevka-ss07 = "0s79kv0dpj4ahci8zrrlnbyn46x2b9jq6gs1ji9xwfcll5bd3mbr";
+  iosevka-ss08 = "0l8y6f6m27msarhm10x11zg7fmcb04s5iby25q7bz4w6yd1c6wgl";
+  iosevka-ss09 = "093mv3d4al8clrdhdnklxygrx6gr2x7ha8qgwqm4460ma5b730ip";
+  iosevka-ss10 = "117ym1mr85y2pf8gnpfanysy8f5na1rvjpjarjzmngxagnq2afjc";
+  iosevka-ss11 = "1fmsqaf7ipl47c1h6b95fj28lq00qj1p6m1y4jnkrz00sxaxc127";
+  iosevka-ss12 = "1k79gdknyh6l3nyw77qznn9mlpr2i4zbjg9hl3pl0xarx3fzpmzj";
+  iosevka-ss13 = "1v8bgmlba3ccdhp53xmhv88zdw2pd14n0dxm7nac3mazd2z5m3yv";
+  iosevka-ss14 = "0h4ig5fjfgqn790pvnnc1zb07hd2dfn2353ripx9mdrzxaj0vnld";
+  iosevka-ss15 = "1l0p1k31xmqz460ra822ji3q120h607fjbbq93kr7xmliw0asw0d";
+  iosevka-ss16 = "1ywasxgnc8lw032799b6r0sx2csld3h5w1kjy72ck5ca1xfwq63n";
+  iosevka-ss17 = "11c23zrdf4i7vzgl82jnizxq2w9lilq66wv8pay61fyab5sw1m6f";
+  iosevka-ss18 = "0v3nccwcaqmcbkdrdpa3304jlz9vffwwny4gd6mq2rph66x2bmc3";
+  sgr-iosevka = "0ypw8nv1p7xp4y8ydgrj4h82y1rlnwd13q99p2sy5jar8wz9p4p5";
+  sgr-iosevka-aile = "1iycylvc59nkxddclwyj3kxfz34akrim2gibazbl9rp1m3slfpfs";
+  sgr-iosevka-curly = "107av6c3kisivx8b2xk3v9by0nhgc81ksg2fv90r6844q5w7fg3h";
+  sgr-iosevka-curly-slab = "18wvn3vgr1vdpd576c8hx0f7r9zgrcl9n4mpm3ghnrlnsy0gix10";
+  sgr-iosevka-etoile = "1d8hxi9v6svbzg6bbadwdg5883yx9vq0yidck9mq5ip20wcvj8ih";
+  sgr-iosevka-fixed = "01q7myzgagsi7d7ylm3iqq2wxcfci0dvz3ls9rwsj4pmnsslp9nm";
+  sgr-iosevka-fixed-curly = "147zn65ijx3j3fbbxhnf6byzr9p5p07nig9jdf5lgc9d7w0cp1am";
+  sgr-iosevka-fixed-curly-slab = "1gi9yinsa82cfsr9b1ik6jxwil46gg9zq98s2wbhq8kh7cs42zxd";
+  sgr-iosevka-fixed-slab = "1922l2g045icrrlyjm1w64kl9jvjlgb9100v7pc67q297943gzr7";
+  sgr-iosevka-fixed-ss01 = "1a0wgyvjqgwnd3q08w80g5zy0ll0i9dip7vkk5r1jjszbp479603";
+  sgr-iosevka-fixed-ss02 = "0nm8jcblzrx6s8kpp9bpza1np174rvm2n4d36mqyw8si4pc849vl";
+  sgr-iosevka-fixed-ss03 = "1c47427rg61751knpywyzfd4vgvsd8xjwhj0fc0qk33cdpz1cr3d";
+  sgr-iosevka-fixed-ss04 = "0g1yrgqzs5d3l7w45rjnmkfs31i8rmrw4fxpfi07i2hcnywaqgkh";
+  sgr-iosevka-fixed-ss05 = "1s9h0v552y7llxshph1kvj7kq7iav4qdf1cvjnjlryng02vdcs5v";
+  sgr-iosevka-fixed-ss06 = "1wj72dy96l23cb3qqqgki77pn50ik0jbqs1hwnppg8srqyamhqhn";
+  sgr-iosevka-fixed-ss07 = "16vl6amnrg8dwhy5snw5iwq7r0nil2v2v4jzd1wdddl6hccvhrdk";
+  sgr-iosevka-fixed-ss08 = "193wclg9v843s9x5vzpajr16icqbbrg8rlkfx2ihzh9aa1g55bv3";
+  sgr-iosevka-fixed-ss09 = "1pvkapfl7h33lfn3izi3lqgfhjp3rbf16m2y6ya45k0km7hgz8bq";
+  sgr-iosevka-fixed-ss10 = "13fymx8hq2v62r9vsj3zj2sn6ggxl8mv2r97qs6gmvgsd43fxsig";
+  sgr-iosevka-fixed-ss11 = "03qcpd8ivky9nymqdgxwgd7dcls1dcx06cd13sh3xr15l7vdb9d4";
+  sgr-iosevka-fixed-ss12 = "1vph7ih2wk22156zpy26yqpc9gk013n618kkm2an9304b8wd7cih";
+  sgr-iosevka-fixed-ss13 = "01f0d2r8wn1487xxsdk7ad5am81061vs9dhjs49h30jwmpd00mvp";
+  sgr-iosevka-fixed-ss14 = "05b9lk47dbnflycbpc1j0jzhwv4lp2f1yw367fpqkcqcfcnxs228";
+  sgr-iosevka-fixed-ss15 = "0k4ackysj8xi19akc3x8y1d9pbbvd176ypdf8w1gaj1fwqkz5832";
+  sgr-iosevka-fixed-ss16 = "0zymvh0d8457rdds6l69azrn8i9va89c4jqf608bsssgmy3l0y9s";
+  sgr-iosevka-fixed-ss17 = "0v9zx2kzkmqkc1s3x3f7sk4yqifd2bavpvc3561zijj63v9skg6m";
+  sgr-iosevka-fixed-ss18 = "0phm4nnl7pv9hvcz17xywypblg5zillg3qc46bfjrq16jssb9qpc";
+  sgr-iosevka-slab = "1z28ziqdnq8mvnnnrn0pwc7rb9fk56pkr9vv7p3l22baxwanh3jf";
+  sgr-iosevka-ss01 = "1g7nw05kyfsv51nkhhzxlw3g7qj8vqbp51rzp8mxwcv99vccw4ka";
+  sgr-iosevka-ss02 = "08gqr21xw3x1p1c14g498wa5zrxr1hhg5m4fg2xvd1ivxayd49zd";
+  sgr-iosevka-ss03 = "1rhj048lwcxqvz26r6adrixz5rajwpvbfkylyfb7pcr66l3n94dw";
+  sgr-iosevka-ss04 = "0sz49v8zzxhzh2ydpnmfr7ppqahggmxyvnx9mg6875071xppmh04";
+  sgr-iosevka-ss05 = "1p0m3gibykrhawvn00hs9lkdjdh1c539mly9jw1zpn48arphg43q";
+  sgr-iosevka-ss06 = "0d2jl1wfwh1w568s2m093vc3x5yfkl1sa9qwjsplwpw1wvsaa158";
+  sgr-iosevka-ss07 = "0f5kwq4714xb90hh435vn34ls8qp1j88lzh3ywj3cpjxzp9bba6h";
+  sgr-iosevka-ss08 = "1rd290bgymfsmkpvrifbx3nyf3b2gds2z7m2wx4a98zx5hpp6ls8";
+  sgr-iosevka-ss09 = "12g5caxxhnkqxmdm7ijv6ygsmfj0ddng3s7p8k3wi1af68834py9";
+  sgr-iosevka-ss10 = "1naj802hd06jm8zmfkx6cf6dkmi01pkrqmapfbnwk1pfkbvmrbmr";
+  sgr-iosevka-ss11 = "1cqa1n1axzskbb0s4vwz803lwzpzqzpz7ysfdmxgyv1pga42i5n9";
+  sgr-iosevka-ss12 = "02zmbivyys7r0iv53gqbsabdljcngls1603cf5f7z8shzdblrl6w";
+  sgr-iosevka-ss13 = "0jq656hbsviwx8amw3s5wrzpnwybm1cspkgm9xd98f4ml6gr56xc";
+  sgr-iosevka-ss14 = "031kfakyczs4ih53ahm18py63y3qjfiqp4qsvzhnp1clniymhr7m";
+  sgr-iosevka-ss15 = "04vafylka6wyjjrvgzslq80ixci8g2d12mfb1ybbxgvxwjg4pzik";
+  sgr-iosevka-ss16 = "1vcgip8hccw8xkzjfc84vvm4n44f7idxq8xrh5p8ib22gc06xywz";
+  sgr-iosevka-ss17 = "023ia9bhdzkhc0alaxfbfpa8yf8bvknx8lh1423m1c5mi39w7syp";
+  sgr-iosevka-ss18 = "1gdv9pnzgjx8c2sr5sab8cvgjzffw175m7kkf3naiak3i75c7jwy";
+  sgr-iosevka-term = "14w59fhcixj2c5vqf6f4wc9sqw3mmkyk1ccbnp9xjax78s244m1l";
+  sgr-iosevka-term-curly = "0z72k13gsz9ml2xjiy43jz9vi95xkhmjwsxsdzh20vcwlqq66g37";
+  sgr-iosevka-term-curly-slab = "0v4h0q4bgdz6xq1b2vw1hsr9gva0fb75aw7b1pbglb3rq6fyp4vg";
+  sgr-iosevka-term-slab = "06mipknr1458h3y5bz0dp054q04w2r8s4cal6k5ycszay6dczdxi";
+  sgr-iosevka-term-ss01 = "1b0qihkhws3lwzqfax980cz7y9ffffpd6haq18cvrgr75ncg5gjq";
+  sgr-iosevka-term-ss02 = "122q689n4wkl0xf1gshq3zg1dwnphc9aa2ywm3dfj6mp490hdqcf";
+  sgr-iosevka-term-ss03 = "0i79mdn2k2c5j1pi1f0mklwljavlk0wqm31haxfy9ijavzjlqcm4";
+  sgr-iosevka-term-ss04 = "0i27l711cjgraxqak3j6qb7ybh3yxzg3mrd62ffyi75wxllmzl6m";
+  sgr-iosevka-term-ss05 = "03h94k8lbxn2xxb8zcc4h30rgqhxiwxib59r56bl9hkjwi1gdlf9";
+  sgr-iosevka-term-ss06 = "0370xwf0iylarvib1k8pvxbkxkipjjp8gwc3nwc7dww95gb3aivy";
+  sgr-iosevka-term-ss07 = "1l8jwchfw1pllyq1lnifbv7pj51c20g20bx8lgz5x15d5f8ncwc3";
+  sgr-iosevka-term-ss08 = "1nz0l8krcwmd0236gb2w5z9kx1br8c909dw81aw9lhn085q654rm";
+  sgr-iosevka-term-ss09 = "0f0ag0zlrgiiwr3xhl9zm1vh83zrcxvkdc8blrxxcy4sphayl2c2";
+  sgr-iosevka-term-ss10 = "0dc6vjrsq8waq0s3f4rdqvlflvr6i3k7hgwx1lqs4kim3ia31naz";
+  sgr-iosevka-term-ss11 = "0yiq6v327xplrdfhfhk16xybk47514708dccsrs7cc4dczbcxpyb";
+  sgr-iosevka-term-ss12 = "0xf6psll8fzdyq5m6zw2b7iva2vfvc79hlkwbdm4gx513brq2d8b";
+  sgr-iosevka-term-ss13 = "15xbid484nvjlha5lhjajybzx590yskbf0639xmkpfsjm3nvkslj";
+  sgr-iosevka-term-ss14 = "1z6471b6c9j19i1cvnsvjsqiaskbff5ifijvqlc01y3xxqv8d7hq";
+  sgr-iosevka-term-ss15 = "00frjympyfawylvf377r16flsx3kgg3qgsixrl82f1p4m4jrg83j";
+  sgr-iosevka-term-ss16 = "0wrjcawdkdnxhgapzgfzyhsjv6qz524cykb8j8b1dl146ii7ni6j";
+  sgr-iosevka-term-ss17 = "1b06givsr24hv3710faszlvn40cbvc04n4yx2f9yga2xzmibr8rk";
+  sgr-iosevka-term-ss18 = "0lqkayq0am28rc7433b965zzqjimcd68vhwy5m8p4ayrkfz0hbm8";
 }

pkgs/development/compilers/openjdk/21.nix

@@ -0,0 +1,188 @@
+{ stdenv, lib, fetchurl, fetchpatch, fetchFromGitHub, bash, pkg-config, autoconf, cpio
+, file, which, unzip, zip, perl, cups, freetype, alsa-lib, libjpeg, giflib
+, libpng, zlib, lcms2, libX11, libICE, libXrender, libXext, libXt, libXtst
+, libXi, libXinerama, libXcursor, libXrandr, fontconfig, openjdk21-bootstrap
+, ensureNewerSourcesForZipFilesHook
+, setJavaClassPath
+# TODO(@sternenseemann): gtk3 fails to evaluate in pkgsCross.ghcjs.buildPackages
+# which should be fixable, this is a no-rebuild workaround for GHC.
+, headless ? stdenv.targetPlatform.isGhcjs
+, enableJavaFX ? false, openjfx
+, enableGnome2 ? true, gtk3, gnome_vfs, glib, GConf
+}:
+
+let
+  version = {
+    feature = "21";
+    interim = "";
+    build = "35";
+  };
+
+  # when building a headless jdk, also bootstrap it with a headless jdk
+  openjdk-bootstrap = openjdk21-bootstrap.override { gtkSupport = !headless; };
+
+  openjdk = stdenv.mkDerivation {
+    pname = "openjdk" + lib.optionalString headless "-headless";
+    version = "${version.feature}${version.interim}+${version.build}";
+
+    src = fetchFromGitHub {
+      owner = "openjdk";
+      repo = "jdk${version.feature}u";
+      rev = "jdk-${version.feature}${version.interim}+${version.build}";
+      hash = "sha256-fA8nRWBuTL87S8mwapmNfCPPQoI2aKHjbHJ6PDN3khs=";
+    };
+
+    nativeBuildInputs = [ pkg-config autoconf unzip ensureNewerSourcesForZipFilesHook ];
+    buildInputs = [
+      cpio file which zip perl zlib cups freetype alsa-lib libjpeg giflib
+      libpng zlib lcms2 libX11 libICE libXrender libXext libXtst libXt libXtst
+      libXi libXinerama libXcursor libXrandr fontconfig openjdk-bootstrap
+    ] ++ lib.optionals (!headless && enableGnome2) [
+      gtk3 gnome_vfs GConf glib
+    ];
+
+    patches = [
+      ./fix-java-home-jdk21.patch
+      ./read-truststore-from-env-jdk10.patch
+      ./currency-date-range-jdk10.patch
+      ./increase-javadoc-heap-jdk13.patch
+      ./ignore-LegalNoticeFilePlugin-jdk18.patch
+
+      # -Wformat etc. are stricter in newer gccs, per
+      # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79677
+      # so grab the work-around from
+      # https://src.fedoraproject.org/rpms/java-openjdk/pull-request/24
+      (fetchurl {
+        url = "https://src.fedoraproject.org/rpms/java-openjdk/raw/06c001c7d87f2e9fe4fedeef2d993bcd5d7afa2a/f/rh1673833-remove_removal_of_wformat_during_test_compilation.patch";
+        sha256 = "082lmc30x64x583vqq00c8y0wqih3y4r0mp1c4bqq36l22qv6b6r";
+      })
+
+      # Fix build for gnumake-4.4.1:
+      #   https://github.com/openjdk/jdk/pull/12992
+      (fetchpatch {
+        name = "gnumake-4.4.1";
+        url = "https://github.com/openjdk/jdk/commit/9341d135b855cc208d48e47d30cd90aafa354c36.patch";
+        hash = "sha256-Qcm3ZmGCOYLZcskNjj7DYR85R4v07vYvvavrVOYL8vg=";
+      })
+    ] ++ lib.optionals (!headless && enableGnome2) [
+      ./swing-use-gtk-jdk13.patch
+    ];
+
+    postPatch = ''
+      chmod +x configure
+      patchShebangs --build configure
+    '';
+
+    # JDK's build system attempts to specifically detect
+    # and special-case WSL, and we don't want it to do that,
+    # so pass the correct platform names explicitly
+    configurePlatforms = ["build" "host"];
+
+    configureFlags = [
+      "--with-boot-jdk=${openjdk-bootstrap.home}"
+      "--with-version-build=${version.build}"
+      "--with-version-opt=nixos"
+      "--with-version-pre="
+      "--enable-unlimited-crypto"
+      "--with-native-debug-symbols=internal"
+      "--with-libjpeg=system"
+      "--with-giflib=system"
+      "--with-libpng=system"
+      "--with-zlib=system"
+      "--with-lcms=system"
+      "--with-stdc++lib=dynamic"
+    ] ++ lib.optional stdenv.isx86_64 "--with-jvm-features=zgc"
+      ++ lib.optional headless "--enable-headless-only"
+      ++ lib.optional (!headless && enableJavaFX) "--with-import-modules=${openjfx}";
+
+    separateDebugInfo = true;
+
+    env.NIX_CFLAGS_COMPILE = "-Wno-error";
+
+    NIX_LDFLAGS = toString (lib.optionals (!headless) [
+      "-lfontconfig" "-lcups" "-lXinerama" "-lXrandr" "-lmagic"
+    ] ++ lib.optionals (!headless && enableGnome2) [
+      "-lgtk-3" "-lgio-2.0" "-lgnomevfs-2" "-lgconf-2"
+    ]);
+
+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
+    buildFlags = [ "images" ];
+
+    installPhase = ''
+      mkdir -p $out/lib
+
+      mv build/*/images/jdk $out/lib/openjdk
+
+      # Remove some broken manpages.
+      rm -rf $out/lib/openjdk/man/ja*
+
+      # Mirror some stuff in top-level.
+      mkdir -p $out/share
+      ln -s $out/lib/openjdk/include $out/include
+      ln -s $out/lib/openjdk/man $out/share/man
+
+      # IDEs use the provided src.zip to navigate the Java codebase (https://github.com/NixOS/nixpkgs/pull/95081)
+      ln -s $out/lib/openjdk/lib/src.zip $out/lib/src.zip
+
+      # jni.h expects jni_md.h to be in the header search path.
+      ln -s $out/include/linux/*_md.h $out/include/
+
+      # Remove crap from the installation.
+      rm -rf $out/lib/openjdk/demo
+      ${lib.optionalString headless ''
+        rm $out/lib/openjdk/lib/{libjsound,libfontmanager}.so
+      ''}
+
+      ln -s $out/lib/openjdk/bin $out/bin
+    '';
+
+    preFixup = ''
+      # Propagate the setJavaClassPath setup hook so that any package
+      # that depends on the JDK has $CLASSPATH set up properly.
+      mkdir -p $out/nix-support
+      #TODO or printWords?  cf https://github.com/NixOS/nixpkgs/pull/27427#issuecomment-317293040
+      echo -n "${setJavaClassPath}" > $out/nix-support/propagated-build-inputs
+
+      # Set JAVA_HOME automatically.
+      mkdir -p $out/nix-support
+      cat <<EOF > $out/nix-support/setup-hook
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out/lib/openjdk; fi
+      EOF
+    '';
+
+    postFixup = ''
+      # Build the set of output library directories to rpath against
+      LIBDIRS=""
+      for output in $(getAllOutputNames); do
+        if [ "$output" = debug ]; then continue; fi
+        LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort -u | tr '\n' ':'):$LIBDIRS"
+      done
+      # Add the local library paths to remove dependencies on the bootstrap
+      for output in $(getAllOutputNames); do
+        if [ "$output" = debug ]; then continue; fi
+        OUTPUTDIR=$(eval echo \$$output)
+        BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
+        echo "$BINLIBS" | while read i; do
+          patchelf --set-rpath "$LIBDIRS:$(patchelf --print-rpath "$i")" "$i" || true
+          patchelf --shrink-rpath "$i" || true
+        done
+      done
+    '';
+
+    disallowedReferences = [ openjdk-bootstrap ];
+
+    pos = builtins.unsafeGetAttrPos "feature" version;
+    meta = import ./meta.nix lib version.feature;
+
+    passthru = {
+      architecture = "";
+      home = "${openjdk}/lib/openjdk";
+      inherit gtk3;
+    };
+  };
+in openjdk

pkgs/development/compilers/openjdk/darwin/11.nix

@@ -1,92 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, unzip
-, setJavaClassPath
-, enableJavaFX ? false
-}:
-let
-  # Details from https://www.azul.com/downloads/?version=java-11-lts&os=macos&package=jdk
-  # Note that the latest build may differ by platform
-  dist = {
-    x86_64-darwin = {
-      arch = "x64";
-      zuluVersion = "11.66.15";
-      jdkVersion = "11.0.20";
-      hash =
-        if enableJavaFX then "sha256-pVgCJkgYTlFeL7nkkMWLeJ/J8ELhgvWb7gzf3erZP7Y="
-        else "sha256-vKqxHP5Yb651g8bZ0xHGQ4Q1T7JjjrmgEuykw/Gh2f0=";
-    };
-
-    aarch64-darwin = {
-      arch = "aarch64";
-      zuluVersion = "11.66.15";
-      jdkVersion = "11.0.20";
-      hash =
-        if enableJavaFX then "sha256-VoZo34SCUU+HHnTl6iLe0QBC+4VDkPP14N98oqSg9EQ="
-        else "sha256-djK8Kfikt9SSuT87x1p7YWMIlNuF0TZFYDWrKiTTiIU=";
-    };
-  }."${stdenv.hostPlatform.system}";
-
-  jce-policies = fetchurl {
-    url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
-  };
-
-  javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
-
-  jdk = stdenv.mkDerivation rec {
-    pname = "zulu${dist.zuluVersion}-${javaPackage}";
-    version = dist.jdkVersion;
-
-    src = fetchurl {
-      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) hash;
-      curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
-    };
-
-    nativeBuildInputs = [ unzip ];
-
-    installPhase = ''
-      mkdir -p $out
-      mv * $out
-
-      unzip ${jce-policies}
-      mv -f ZuluJCEPolicies/*.jar $out/lib/security/
-
-      # jni.h expects jni_md.h to be in the header search path.
-      ln -s $out/include/darwin/*_md.h $out/include/
-
-      if [ -f $out/LICENSE ]; then
-        install -D $out/LICENSE $out/share/zulu/LICENSE
-        rm $out/LICENSE
-      fi
-    '';
-
-    preFixup = ''
-      # Propagate the setJavaClassPath setup hook from the JDK so that
-      # any package that depends on the JDK has $CLASSPATH set up
-      # properly.
-      mkdir -p $out/nix-support
-      printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs
-
-      # Set JAVA_HOME automatically.
-      cat <<EOF >> $out/nix-support/setup-hook
-      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
-      EOF
-    '';
-
-    # fixupPhase is moving the man to share/man which breaks it because it's a
-    # relative symlink.
-    postFixup = ''
-      ln -nsf ../zulu-11.jdk/Contents/Home/man $out/share/man
-    '';
-
-    passthru = {
-      home = jdk;
-    };
-
-    meta = import ./meta.nix lib version;
-  };
-in
-jdk

pkgs/development/compilers/openjdk/darwin/16.nix

@@ -1,92 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, unzip
-, setJavaClassPath
-, enableJavaFX ? false
-}:
-let
-  # Details from https://www.azul.com/downloads/?version=java-16-sts&os=macos&package=jdk
-  # Note that the latest build may differ by platform
-  dist = {
-    x86_64-darwin = {
-      arch = "x64";
-      zuluVersion = "16.32.15";
-      jdkVersion = "16.0.2";
-      hash =
-        if enableJavaFX then "sha256-6URaSBNHQWLauO//kCuKXb4Z7AqyshWnoeJEyVRKgaY="
-        else "sha256-NXgBj/KixTknaCYbo3B+rOo11NImH5CDUIU0LhTCtMo=";
-    };
-
-    aarch64-darwin = {
-      arch = "aarch64";
-      zuluVersion = "16.32.15";
-      jdkVersion = "16.0.2";
-      hash =
-        if enableJavaFX then "sha256-QuyhIAxUY3Vv1adGihW+LIsXtpDX2taCmFsMFj9o5vs="
-        else "sha256-3bUfDcLLyahLeURFAgLAVapBZHvqtam8GHbWTA6MQog=";
-    };
-  }."${stdenv.hostPlatform.system}";
-
-  jce-policies = fetchurl {
-    url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
-  };
-
-  javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
-
-  jdk = stdenv.mkDerivation rec {
-    pname = "zulu${dist.zuluVersion}-${javaPackage}";
-    version = dist.jdkVersion;
-
-    src = fetchurl {
-      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) hash;
-      curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
-    };
-
-    nativeBuildInputs = [ unzip ];
-
-    installPhase = ''
-      mkdir -p $out
-      mv * $out
-
-      unzip ${jce-policies}
-      mv -f ZuluJCEPolicies/*.jar $out/lib/security/
-
-      # jni.h expects jni_md.h to be in the header search path.
-      ln -s $out/include/darwin/*_md.h $out/include/
-
-      if [ -f $out/LICENSE ]; then
-        install -D $out/LICENSE $out/share/zulu/LICENSE
-        rm $out/LICENSE
-      fi
-    '';
-
-    preFixup = ''
-      # Propagate the setJavaClassPath setup hook from the JDK so that
-      # any package that depends on the JDK has $CLASSPATH set up
-      # properly.
-      mkdir -p $out/nix-support
-      printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs
-
-      # Set JAVA_HOME automatically.
-      cat <<EOF >> $out/nix-support/setup-hook
-      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
-      EOF
-    '';
-
-    # fixupPhase is moving the man to share/man which breaks it because it's a
-    # relative symlink.
-    postFixup = ''
-      ln -nsf ../zulu-${lib.versions.major version}.jdk/Contents/Home/man $out/share/man
-    '';
-
-    passthru = {
-      home = jdk;
-    };
-
-    meta = import ./meta.nix lib version;
-  };
-in
-jdk

pkgs/development/compilers/openjdk/darwin/17.nix

@@ -1,92 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, unzip
-, setJavaClassPath
-, enableJavaFX ? false
-}:
-let
-  # Details from https://www.azul.com/downloads/?version=java-17-lts&os=macos&package=jdk
-  # Note that the latest build may differ by platform
-  dist = {
-    x86_64-darwin = {
-      arch = "x64";
-      zuluVersion = "17.44.53";
-      jdkVersion = "17.0.8.1";
-      hash =
-        if enableJavaFX then "sha256-9U0XYZRA+LZTQ7eHrT5SWhgcxv43ajC9n9Tj3qPPLWA="
-        else "sha256-ZART6K/o/+D7Tc60U1+1DbnCg8ZGZe67C6aLGeZfSx8=";
-    };
-
-    aarch64-darwin = {
-      arch = "aarch64";
-      zuluVersion = "17.44.53";
-      jdkVersion = "17.0.8.1";
-      hash =
-        if enableJavaFX then "sha256-udYW3nOADclWqVcVtS9dgjSY0w6xf2nsBpLzPmQCYlI="
-        else "sha256-MUsEVo7Arps2ugPJy9Qq3J4SZfdGeJI7GSl9ZuuE3Mo=";
-    };
-  }."${stdenv.hostPlatform.system}";
-
-  jce-policies = fetchurl {
-    url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
-  };
-
-  javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
-
-  jdk = stdenv.mkDerivation rec {
-    pname = "zulu${dist.zuluVersion}-${javaPackage}";
-    version = dist.jdkVersion;
-
-    src = fetchurl {
-      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) hash;
-      curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
-    };
-
-    nativeBuildInputs = [ unzip ];
-
-    installPhase = ''
-      mkdir -p $out
-      mv * $out
-
-      unzip ${jce-policies}
-      mv -f ZuluJCEPolicies/*.jar $out/lib/security/
-
-      # jni.h expects jni_md.h to be in the header search path.
-      ln -s $out/include/darwin/*_md.h $out/include/
-
-      if [ -f $out/LICENSE ]; then
-        install -D $out/LICENSE $out/share/zulu/LICENSE
-        rm $out/LICENSE
-      fi
-    '';
-
-    preFixup = ''
-      # Propagate the setJavaClassPath setup hook from the JDK so that
-      # any package that depends on the JDK has $CLASSPATH set up
-      # properly.
-      mkdir -p $out/nix-support
-      printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs
-
-      # Set JAVA_HOME automatically.
-      cat <<EOF >> $out/nix-support/setup-hook
-      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
-      EOF
-    '';
-
-    # fixupPhase is moving the man to share/man which breaks it because it's a
-    # relative symlink.
-    postFixup = ''
-      ln -nsf ../zulu-${lib.versions.major version}.jdk/Contents/Home/man $out/share/man
-    '';
-
-    passthru = {
-      home = jdk;
-    };
-
-    meta = import ./meta.nix lib version;
-  };
-in
-jdk

pkgs/development/compilers/openjdk/darwin/18.nix

@@ -1,92 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, unzip
-, setJavaClassPath
-, enableJavaFX ? false
-}:
-let
-  # Details from https://www.azul.com/downloads/?version=java-18-sts&os=macos&package=jdk
-  # Note that the latest build may differ by platform
-  dist = {
-    x86_64-darwin = {
-      arch = "x64";
-      zuluVersion = "18.32.13";
-      jdkVersion = "18.0.2.1";
-      hash =
-        if enableJavaFX then "sha256-ZVZ1gbpJwxTduq2PPOCKqbSl+shq2NTFgqG++OXvFcg="
-        else "sha256-uHPcyOgxUdTgzmIVRp/awtwve9zSt+1TZNef7DUuoRg=";
-    };
-
-    aarch64-darwin = {
-      arch = "aarch64";
-      zuluVersion = "18.32.13";
-      jdkVersion = "18.0.2.1";
-      hash =
-        if enableJavaFX then "sha256-tNx0a1u9iamcN9VFOJ3eqDEA6C204dtIBJZvuAH2Vjk="
-        else "sha256-jAZDgxtWMq/74yKAxA69oOU0C9nXvKG5MjmZLsK04iM=";
-    };
-  }."${stdenv.hostPlatform.system}";
-
-  jce-policies = fetchurl {
-    url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
-  };
-
-  javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
-
-  jdk = stdenv.mkDerivation rec {
-    pname = "zulu${dist.zuluVersion}-${javaPackage}";
-    version = dist.jdkVersion;
-
-    src = fetchurl {
-      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) hash;
-      curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
-    };
-
-    nativeBuildInputs = [ unzip ];
-
-    installPhase = ''
-      mkdir -p $out
-      mv * $out
-
-      unzip ${jce-policies}
-      mv -f ZuluJCEPolicies/*.jar $out/lib/security/
-
-      # jni.h expects jni_md.h to be in the header search path.
-      ln -s $out/include/darwin/*_md.h $out/include/
-
-      if [ -f $out/LICENSE ]; then
-        install -D $out/LICENSE $out/share/zulu/LICENSE
-        rm $out/LICENSE
-      fi
-    '';
-
-    preFixup = ''
-      # Propagate the setJavaClassPath setup hook from the JDK so that
-      # any package that depends on the JDK has $CLASSPATH set up
-      # properly.
-      mkdir -p $out/nix-support
-      printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs
-
-      # Set JAVA_HOME automatically.
-      cat <<EOF >> $out/nix-support/setup-hook
-      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
-      EOF
-    '';
-
-    # fixupPhase is moving the man to share/man which breaks it because it's a
-    # relative symlink.
-    postFixup = ''
-      ln -nsf ../zulu-${lib.versions.major version}.jdk/Contents/Home/man $out/share/man
-    '';
-
-    passthru = {
-      home = jdk;
-    };
-
-    meta = import ./meta.nix lib version;
-  };
-in
-jdk

pkgs/development/compilers/openjdk/darwin/19.nix

@@ -1,92 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, unzip
-, setJavaClassPath
-, enableJavaFX ? false
-}:
-let
-  # Details from https://www.azul.com/downloads/?version=java-19-sts&os=macos&package=jdk
-  # Note that the latest build may differ by platform
-  dist = {
-    x86_64-darwin = {
-      arch = "x64";
-      zuluVersion = if enableJavaFX then "19.32.15" else "19.32.13";
-      jdkVersion = "19.0.2";
-      hash =
-        if enableJavaFX then "sha256-AwLcIId0gH5D6DUU8CgJ3qnKVQm28LXYirBeXBHwPYE="
-        else "sha256-KARXWumsY+OcqpEOV2EL9SsPni1nGSipjRji/Mn2KsE=";
-    };
-
-    aarch64-darwin = {
-      arch = "aarch64";
-      zuluVersion = if enableJavaFX then "19.32.15" else "19.32.13";
-      jdkVersion = "19.0.2";
-      hash =
-        if enableJavaFX then "sha256-/R2rrcBr64qPGEtvhruXBhPwnvurt/hiR1ICzZAdYxE="
-        else "sha256-F30FjZaLL756X/Xs6xjNwW9jds4pEATxoxOeeLL7Y5E=";
-    };
-  }."${stdenv.hostPlatform.system}";
-
-  jce-policies = fetchurl {
-    url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
-  };
-
-  javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
-
-  jdk = stdenv.mkDerivation rec {
-    pname = "zulu${dist.zuluVersion}-${javaPackage}";
-    version = dist.jdkVersion;
-
-    src = fetchurl {
-      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) hash;
-      curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
-    };
-
-    nativeBuildInputs = [ unzip ];
-
-    installPhase = ''
-      mkdir -p $out
-      mv * $out
-
-      unzip ${jce-policies}
-      mv -f ZuluJCEPolicies/*.jar $out/lib/security/
-
-      # jni.h expects jni_md.h to be in the header search path.
-      ln -s $out/include/darwin/*_md.h $out/include/
-
-      if [ -f $out/LICENSE ]; then
-        install -D $out/LICENSE $out/share/zulu/LICENSE
-        rm $out/LICENSE
-      fi
-    '';
-
-    preFixup = ''
-      # Propagate the setJavaClassPath setup hook from the JDK so that
-      # any package that depends on the JDK has $CLASSPATH set up
-      # properly.
-      mkdir -p $out/nix-support
-      printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs
-
-      # Set JAVA_HOME automatically.
-      cat <<EOF >> $out/nix-support/setup-hook
-      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
-      EOF
-    '';
-
-    # fixupPhase is moving the man to share/man which breaks it because it's a
-    # relative symlink.
-    postFixup = ''
-      ln -nsf ../zulu-${lib.versions.major version}.jdk/Contents/Home/man $out/share/man
-    '';
-
-    passthru = {
-      home = jdk;
-    };
-
-    meta = import ./meta.nix lib version;
-  };
-in
-jdk

pkgs/development/compilers/openjdk/darwin/20.nix

@@ -1,92 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, unzip
-, setJavaClassPath
-, enableJavaFX ? false
-}:
-let
-  # Details from https://www.azul.com/downloads/?version=java-19-sts&os=macos&package=jdk
-  # Note that the latest build may differ by platform
-  dist = {
-    x86_64-darwin = {
-      arch = "x64";
-      zuluVersion = "20.32.11";
-      jdkVersion = "20.0.2";
-      hash =
-        if enableJavaFX then "sha256-hyxQAivZAXtqMebe30L+EYa7p+TdSdKNYj7Rl/ZwRNQ="
-        else "sha256-Ev9KG6DvuBnsZrOguLsO1KQzudHCBcJNwKh45Inpnfo=";
-    };
-
-    aarch64-darwin = {
-      arch = "aarch64";
-      zuluVersion = "20.32.11";
-      jdkVersion = "20.0.2";
-      hash =
-        if enableJavaFX then "sha256-iPQzZS4CwaoqT8cSzg4kWCT1OyGBSJLq+NETcbucLo4="
-        else "sha256-15uNZ6uMfSASV3QU2q2oA/jBk2PCHOfSjn1GY7/7qIY=";
-    };
-  }."${stdenv.hostPlatform.system}";
-
-  jce-policies = fetchurl {
-    url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
-  };
-
-  javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
-
-  jdk = stdenv.mkDerivation rec {
-    pname = "zulu${dist.zuluVersion}-${javaPackage}";
-    version = dist.jdkVersion;
-
-    src = fetchurl {
-      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) hash;
-      curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
-    };
-
-    nativeBuildInputs = [ unzip ];
-
-    installPhase = ''
-      mkdir -p $out
-      mv * $out
-
-      unzip ${jce-policies}
-      mv -f ZuluJCEPolicies/*.jar $out/lib/security/
-
-      # jni.h expects jni_md.h to be in the header search path.
-      ln -s $out/include/darwin/*_md.h $out/include/
-
-      if [ -f $out/LICENSE ]; then
-        install -D $out/LICENSE $out/share/zulu/LICENSE
-        rm $out/LICENSE
-      fi
-    '';
-
-    preFixup = ''
-      # Propagate the setJavaClassPath setup hook from the JDK so that
-      # any package that depends on the JDK has $CLASSPATH set up
-      # properly.
-      mkdir -p $out/nix-support
-      printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs
-
-      # Set JAVA_HOME automatically.
-      cat <<EOF >> $out/nix-support/setup-hook
-      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
-      EOF
-    '';
-
-    # fixupPhase is moving the man to share/man which breaks it because it's a
-    # relative symlink.
-    postFixup = ''
-      ln -nsf ../zulu-${lib.versions.major version}.jdk/Contents/Home/man $out/share/man
-    '';
-
-    passthru = {
-      home = jdk;
-    };
-
-    meta = import ./meta.nix lib version;
-  };
-in
-jdk

pkgs/development/compilers/openjdk/darwin/8.nix

@@ -1,96 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, unzip
-, setJavaClassPath
-, enableJavaFX ? false
-}:
-let
-  # Details from https://www.azul.com/downloads/?version=java-8-lts&os=macos&package=jdk
-  # Note that the latest build may differ by platform
-  dist = {
-    x86_64-darwin = {
-      arch = "x64";
-      zuluVersion = "8.72.0.17";
-      jdkVersion = "8.0.382";
-      hash =
-        if enableJavaFX then "sha256-/x8FqygivzddXsOwIV8aj/u+LPXMmokgu97vLAVEv80="
-        else "sha256-3dTPIPGUeT6nb3gncNvEa4VTRyQIBJpp8oZadrT2ToE=";
-    };
-
-    aarch64-darwin = {
-      arch = "aarch64";
-      zuluVersion = "8.72.0.17";
-      jdkVersion = "8.0.382";
-      hash =
-        if enableJavaFX then "sha256-FkQ+0MzSZWUzc/HmiDVZEHGOrdKAVCdK5pm9wXXzzaU="
-        else "sha256-rN5AI4xAWppE4kJlzMod0JmGyHdHjTXYtx8/wOW6CFk=";
-    };
-  }."${stdenv.hostPlatform.system}";
-
-  jce-policies = fetchurl {
-    url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
-    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
-  };
-
-  javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
-
-  jdk = stdenv.mkDerivation rec {
-    # @hlolli: Later version than 1.8.0_202 throws error when building jvmci.
-    # dyld: lazy symbol binding failed: Symbol not found: _JVM_BeforeHalt
-    # Referenced from: ../libjava.dylib Expected in: .../libjvm.dylib
-    pname = "zulu${dist.zuluVersion}-${javaPackage}";
-    version = dist.jdkVersion;
-
-    src = fetchurl {
-      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-macosx_${dist.arch}.tar.gz";
-      inherit (dist) hash;
-      curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
-    };
-
-    nativeBuildInputs = [ unzip ];
-
-    installPhase = ''
-      mkdir -p $out
-      mv * $out
-
-      unzip ${jce-policies}
-      mv -f ZuluJCEPolicies/*.jar $out/jre/lib/security/
-
-      # jni.h expects jni_md.h to be in the header search path.
-      ln -s $out/include/darwin/*_md.h $out/include/
-
-      if [ -f $out/LICENSE ]; then
-        install -D $out/LICENSE $out/share/zulu/LICENSE
-        rm $out/LICENSE
-      fi
-    '';
-
-    preFixup = ''
-      # Propagate the setJavaClassPath setup hook from the JRE so that
-      # any package that depends on the JRE has $CLASSPATH set up
-      # properly.
-      mkdir -p $out/nix-support
-      printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs
-
-      # Set JAVA_HOME automatically.
-      cat <<EOF >> $out/nix-support/setup-hook
-      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
-      EOF
-    '';
-
-    # fixupPhase is moving the man to share/man which breaks it because it's a
-    # relative symlink.
-    postFixup = ''
-      ln -nsf ../zulu-${lib.versions.major version}.jdk/Contents/Home/man $out/share/man
-    '';
-
-    passthru = {
-      jre = jdk;
-      home = jdk;
-    };
-
-    meta = import ./meta.nix lib version;
-  };
-in
-jdk

pkgs/development/compilers/openjdk/darwin/meta.nix

@@ -1,4 +0,0 @@
-lib: version: (removeAttrs (import ../meta.nix lib version) [ "maintainers" ]) // {
-  platforms = lib.platforms.darwin;
-  homepage = "https://www.azul.com/";
-}

pkgs/development/compilers/openjdk/fix-java-home-jdk21.patch

@@ -0,0 +1,14 @@
+--- a/src/hotspot/os/linux/os_linux.cpp	2017-07-04 23:09:02.533972226 -0400
++++ b/src/hotspot/os/linux/os_linux.cpp	2017-07-04 23:07:52.118338845 -0400
+@@ -2270,8 +2270,5 @@
+   assert(ret, "cannot locate libjvm");
+   char *rp = nullptr;
+   if (ret && dli_fname[0] != '\0') {
+-    rp = os::Posix::realpath(dli_fname, buf, buflen);
+-  }
+-  if (rp == nullptr) {
+-    return;
++    snprintf(buf, buflen, "%s", dli_fname);
+   }
+
+   if (Arguments::sun_java_launcher_is_altjvm()) {

pkgs/development/compilers/openjdk/openjfx/21.nix

@@ -0,0 +1,113 @@
+{ stdenv, lib, fetchFromGitHub, fetchpatch, writeText, openjdk17_headless
+, openjdk19_headless, gradle_7, pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst
+, libXxf86vm, glib, alsa-lib, ffmpeg_4, python3, ruby, icu68
+, withMedia ? true
+, withWebKit ? false
+}:
+
+let
+  major = "21";
+  update = "";
+  build = "-ga";
+  repover = "${major}${update}${build}";
+  gradle_ = (gradle_7.override {
+    # note: gradle does not yet support running on 19
+    java = openjdk17_headless;
+  });
+
+  makePackage = args: stdenv.mkDerivation ({
+    version = "${major}${update}${build}";
+
+    src = fetchFromGitHub {
+      owner = "openjdk";
+      repo = "jfx";
+      rev = repover;
+      hash = "sha256-deNAGfnA6gwcAa64l0AWdkX+vJd3ZOfIgAifSl+/m+s=";
+    };
+
+    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 icu68 ];
+    nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];
+
+    dontUseCmakeConfigure = true;
+
+    config = writeText "gradle.properties" (''
+      CONF = Release
+      JDK_HOME = ${openjdk19_headless.home}
+    '' + args.gradleProperties or "");
+
+    buildPhase = ''
+      runHook preBuild
+
+      export GRADLE_USER_HOME=$(mktemp -d)
+      ln -s $config gradle.properties
+      export NIX_CFLAGS_COMPILE="$(pkg-config --cflags glib-2.0) $NIX_CFLAGS_COMPILE"
+      gradle --no-daemon $gradleFlags sdk
+
+      runHook postBuild
+    '';
+  } // args);
+
+  # Fake build to pre-download deps into fixed-output derivation.
+  # We run nearly full build because I see no other way to download everything that's needed.
+  # Anyone who knows a better way?
+  deps = makePackage {
+    pname = "openjfx-deps";
+
+    # perl code mavenizes pathes (com.squareup.okio/okio/1.13.0/a9283170b7305c8d92d25aff02a6ab7e45d06cbe/okio-1.13.0.jar -> com/squareup/okio/okio/1.13.0/okio-1.13.0.jar)
+    installPhase = ''
+      find $GRADLE_USER_HOME -type f -regex '.*/modules.*\.\(jar\|pom\)' \
+        | perl -pe 's#(.*/([^/]+)/([^/]+)/([^/]+)/[0-9a-f]{30,40}/([^/\s]+))$# ($x = $2) =~ tr|\.|/|; "install -Dm444 $1 \$out/$x/$3/$4/$5" #e' \
+        | sh
+      rm -rf $out/tmp
+    '';
+
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+    # suspiciously the same as for openjfx 17 ...
+    # could they really not have changed any of their dependencies?
+    # or did we miss changing another upstream hash when copy-pasting?
+    outputHash = "sha256-dV7/U5GpFxhI13smZ587C6cVE4FRNPY0zexZkYK4Yqo=";
+  };
+
+in makePackage {
+  pname = "openjfx-modular-sdk";
+
+  gradleProperties = ''
+    COMPILE_MEDIA = ${lib.boolToString withMedia}
+    COMPILE_WEBKIT = ${lib.boolToString withWebKit}
+  '';
+
+  preBuild = ''
+    swtJar="$(find ${deps} -name org.eclipse.swt\*.jar)"
+    substituteInPlace build.gradle \
+      --replace 'mavenCentral()' 'mavenLocal(); maven { url uri("${deps}") }' \
+      --replace 'name: SWT_FILE_NAME' "files('$swtJar')"
+  '';
+
+  installPhase = ''
+    cp -r build/modular-sdk $out
+  '';
+
+  stripDebugList = [ "." ];
+
+  postFixup = ''
+    # Remove references to bootstrap.
+    export openjdkOutPath='${openjdk19_headless.outPath}'
+    find "$out" -name \*.so | while read lib; do
+      new_refs="$(patchelf --print-rpath "$lib" | perl -pe 's,:?\Q$ENV{openjdkOutPath}\E[^:]*,,')"
+      patchelf --set-rpath "$new_refs" "$lib"
+    done
+  '';
+
+  disallowedReferences = [ openjdk17_headless openjdk19_headless ];
+
+  passthru.deps = deps;
+
+  meta = with lib; {
+    homepage = "https://openjdk.org/projects/openjfx/";
+    license = licenses.gpl2Classpath;
+    description = "The next-generation Java client toolkit";
+    maintainers = with maintainers; [ abbradar ];
+    platforms = platforms.unix;
+  };
+}

pkgs/development/compilers/zulu/11.nix

@@ -0,0 +1,42 @@
+{ callPackage
+, enableJavaFX ? false
+, ...
+}@args:
+
+callPackage ./common.nix ({
+  # Details from https://www.azul.com/downloads/?version=java-11-lts&package=jdk
+  # Note that the latest build may differ by platform
+  dists = {
+    x86_64-linux = {
+      zuluVersion = "11.66.15";
+      jdkVersion = "11.0.20";
+      hash =
+        if enableJavaFX then "sha256-CjWtqnirEDrpF61WXm/Yi372IzhpTpi+/AfEqirlZnc="
+        else "sha256-o0tAT4egimEUizjhQW2DcYnh33oEDZSedDYz2vRpWjw=";
+    };
+
+    aarch64-linux = {
+      zuluVersion = "11.66.15";
+      jdkVersion = "11.0.20";
+      hash =
+        if enableJavaFX then throw "JavaFX is not available for aarch64-linux"
+        else "sha256-VBdEOfKz/d0R8QSMOX/nu0XUydZtRS1oibAT0E0hxN4=";
+    };
+
+    x86_64-darwin = {
+      zuluVersion = "11.66.15";
+      jdkVersion = "11.0.20";
+      hash =
+        if enableJavaFX then "sha256-pVgCJkgYTlFeL7nkkMWLeJ/J8ELhgvWb7gzf3erZP7Y="
+        else "sha256-vKqxHP5Yb651g8bZ0xHGQ4Q1T7JjjrmgEuykw/Gh2f0=";
+    };
+
+    aarch64-darwin = {
+      zuluVersion = "11.66.15";
+      jdkVersion = "11.0.20";
+      hash =
+        if enableJavaFX then "sha256-VoZo34SCUU+HHnTl6iLe0QBC+4VDkPP14N98oqSg9EQ="
+        else "sha256-djK8Kfikt9SSuT87x1p7YWMIlNuF0TZFYDWrKiTTiIU=";
+    };
+  };
+} // builtins.removeAttrs args [ "callPackage" ])

pkgs/development/compilers/zulu/16.nix

@@ -0,0 +1,26 @@
+{ callPackage
+, enableJavaFX ? false
+, ...
+}@args:
+
+callPackage ./common.nix ({
+  # Details from https://www.azul.com/downloads/?version=java-16-sts&package=jdk
+  # Note that the latest build may differ by platform
+  dists = {
+    x86_64-darwin = {
+      zuluVersion = "16.32.15";
+      jdkVersion = "16.0.2";
+      hash =
+        if enableJavaFX then "sha256-6URaSBNHQWLauO//kCuKXb4Z7AqyshWnoeJEyVRKgaY="
+        else "sha256-NXgBj/KixTknaCYbo3B+rOo11NImH5CDUIU0LhTCtMo=";
+    };
+
+    aarch64-darwin = {
+      zuluVersion = "16.32.15";
+      jdkVersion = "16.0.2";
+      hash =
+        if enableJavaFX then "sha256-QuyhIAxUY3Vv1adGihW+LIsXtpDX2taCmFsMFj9o5vs="
+        else "sha256-3bUfDcLLyahLeURFAgLAVapBZHvqtam8GHbWTA6MQog=";
+    };
+  };
+} // builtins.removeAttrs args [ "callPackage" ])

pkgs/development/compilers/zulu/17.nix

@@ -0,0 +1,42 @@
+{ callPackage
+, enableJavaFX ? false
+, ...
+}@args:
+
+callPackage ./common.nix ({
+  # Details from https://www.azul.com/downloads/?version=java-17-lts&package=jdk
+  # Note that the latest build may differ by platform
+  dists = {
+    x86_64-linux = {
+      zuluVersion = "17.44.53";
+      jdkVersion = "17.0.8.1";
+      hash =
+        if enableJavaFX then "sha256-R6VJcSjpKFfsO3l32+8s+wlcuAVoXcSsW5Dg2M/hjpI="
+        else "sha256-uUgvIwShpophTfrN3PKVaacvD6wy5sdPg9wbmhV7g0A=";
+    };
+
+    aarch64-linux = {
+      zuluVersion = "17.44.53";
+      jdkVersion = "17.0.8.1";
+      hash =
+        if enableJavaFX then throw "JavaFX is not available for aarch64-linux"
+        else "sha256-ZTHO9h5BbVp7aRVVyM8r3/aJIBuKAB/0WrZ0AGK0QxM=";
+    };
+
+    x86_64-darwin = {
+      zuluVersion = "17.44.53";
+      jdkVersion = "17.0.8.1";
+      hash =
+        if enableJavaFX then "sha256-9U0XYZRA+LZTQ7eHrT5SWhgcxv43ajC9n9Tj3qPPLWA="
+        else "sha256-ZART6K/o/+D7Tc60U1+1DbnCg8ZGZe67C6aLGeZfSx8=";
+    };
+
+    aarch64-darwin = {
+      zuluVersion = "17.44.53";
+      jdkVersion = "17.0.8.1";
+      hash =
+        if enableJavaFX then "sha256-udYW3nOADclWqVcVtS9dgjSY0w6xf2nsBpLzPmQCYlI="
+        else "sha256-MUsEVo7Arps2ugPJy9Qq3J4SZfdGeJI7GSl9ZuuE3Mo=";
+    };
+  };
+} // builtins.removeAttrs args [ "callPackage" ])

pkgs/development/compilers/zulu/18.nix

@@ -0,0 +1,26 @@
+{ callPackage
+, enableJavaFX ? false
+, ...
+}@args:
+
+callPackage ./common.nix ({
+  # Details from https://www.azul.com/downloads/?version=java-18-sts&package=jdk
+  # Note that the latest build may differ by platform
+  dists = {
+    x86_64-darwin = {
+      zuluVersion = "18.32.13";
+      jdkVersion = "18.0.2.1";
+      hash =
+        if enableJavaFX then "sha256-ZVZ1gbpJwxTduq2PPOCKqbSl+shq2NTFgqG++OXvFcg="
+        else "sha256-uHPcyOgxUdTgzmIVRp/awtwve9zSt+1TZNef7DUuoRg=";
+    };
+
+    aarch64-darwin = {
+      zuluVersion = "18.32.13";
+      jdkVersion = "18.0.2.1";
+      hash =
+        if enableJavaFX then "sha256-tNx0a1u9iamcN9VFOJ3eqDEA6C204dtIBJZvuAH2Vjk="
+        else "sha256-jAZDgxtWMq/74yKAxA69oOU0C9nXvKG5MjmZLsK04iM=";
+    };
+  };
+} // builtins.removeAttrs args [ "callPackage" ])

pkgs/development/compilers/zulu/19.nix

@@ -0,0 +1,26 @@
+{ callPackage
+, enableJavaFX ? false
+, ...
+}@args:
+
+callPackage ./common.nix ({
+  # Details from https://www.azul.com/downloads/?version=java-19-sts&package=jdk
+  # Note that the latest build may differ by platform
+  dists = {
+    x86_64-darwin = {
+      zuluVersion = if enableJavaFX then "19.32.15" else "19.32.13";
+      jdkVersion = "19.0.2";
+      hash =
+        if enableJavaFX then "sha256-AwLcIId0gH5D6DUU8CgJ3qnKVQm28LXYirBeXBHwPYE="
+        else "sha256-KARXWumsY+OcqpEOV2EL9SsPni1nGSipjRji/Mn2KsE=";
+    };
+
+    aarch64-darwin = {
+      zuluVersion = if enableJavaFX then "19.32.15" else "19.32.13";
+      jdkVersion = "19.0.2";
+      hash =
+        if enableJavaFX then "sha256-/R2rrcBr64qPGEtvhruXBhPwnvurt/hiR1ICzZAdYxE="
+        else "sha256-F30FjZaLL756X/Xs6xjNwW9jds4pEATxoxOeeLL7Y5E=";
+    };
+  };
+} // builtins.removeAttrs args [ "callPackage" ])

pkgs/development/compilers/zulu/20.nix

@@ -0,0 +1,26 @@
+{ callPackage
+, enableJavaFX ? false
+, ...
+}@args:
+
+callPackage ./common.nix ({
+  # Details from https://www.azul.com/downloads/?version=java-20-sts&package=jdk
+  # Note that the latest build may differ by platform
+  dists = {
+    x86_64-darwin = {
+      zuluVersion = "20.32.11";
+      jdkVersion = "20.0.2";
+      hash =
+        if enableJavaFX then "sha256-hyxQAivZAXtqMebe30L+EYa7p+TdSdKNYj7Rl/ZwRNQ="
+        else "sha256-Ev9KG6DvuBnsZrOguLsO1KQzudHCBcJNwKh45Inpnfo=";
+    };
+
+    aarch64-darwin = {
+      zuluVersion = "20.32.11";
+      jdkVersion = "20.0.2";
+      hash =
+        if enableJavaFX then "sha256-iPQzZS4CwaoqT8cSzg4kWCT1OyGBSJLq+NETcbucLo4="
+        else "sha256-15uNZ6uMfSASV3QU2q2oA/jBk2PCHOfSjn1GY7/7qIY=";
+    };
+  };
+} // builtins.removeAttrs args [ "callPackage" ])

pkgs/development/compilers/zulu/21.nix

@@ -0,0 +1,42 @@
+{ callPackage
+, enableJavaFX ? false
+, ...
+}@args:
+
+callPackage ./common.nix ({
+  # Details from https://www.azul.com/downloads/?version=java-21-lts&package=jdk
+  # Note that the latest build may differ by platform
+  dists = {
+    x86_64-linux = {
+      zuluVersion = "21.28.85";
+      jdkVersion = "21.0.0";
+      hash =
+        if enableJavaFX then "sha256-ew/tgSdkrPdk1CTguk9nyl30w7se+YZYqyqOTaeketk="
+        else "sha256-DA6t+9xHp8pkrqtRucBh9xtuTSXS2HZ0US6bY4fp46Y=";
+    };
+
+    aarch64-linux = {
+      zuluVersion = "21.28.85";
+      jdkVersion = "21.0.0";
+      hash =
+        if enableJavaFX then throw "JavaFX is not available for aarch64-linux"
+        else "sha256-H7ZLgDbF1GPYq1mvBr9bawBoEeYBLjsOtrzPV/HFWDU=";
+    };
+
+    x86_64-darwin = {
+      zuluVersion = "21.28.85";
+      jdkVersion = "21.0.0";
+      hash =
+        if enableJavaFX then "sha256-QrgEpLaNGc2aNFF38z2ckUTCpweKnuALYLOWATZFJPA="
+        else "sha256-ljm4fbWG0MifepiSrkf0IeRCxkuXuuvf8xeI++IyZb0=";
+    };
+
+    aarch64-darwin = {
+      zuluVersion = "21.28.85";
+      jdkVersion = "21.0.0";
+      hash =
+        if enableJavaFX then "sha256-PUVB/R1K1dLTi1FsOYIvcI76M6EYYeMG1Bm+oMno//Y="
+        else "sha256-KnqZo+omPb2NMqZ9Hm42O6iyXGRcgm9eFnoCu6+v8fo=";
+    };
+  };
+} // builtins.removeAttrs args [ "callPackage" ])

pkgs/development/compilers/zulu/8.nix

@@ -1,120 +1,34 @@
-{ stdenv
-, lib
-, fetchurl
-, autoPatchelfHook
-, unzip
-, makeWrapper
-, setJavaClassPath
-, zulu
-# minimum dependencies
-, alsa-lib
-, fontconfig
-, freetype
-, xorg
-# runtime dependencies
-, cups
-# runtime dependencies for GTK+ Look and Feel
-, gtkSupport ? stdenv.isLinux
-, cairo
-, glib
-, gtk3
-}:
+{ callPackage
+, enableJavaFX ? false
+, ...
+}@args:
 
-let
-  version = "8.68.0.19";
-  openjdk = "8.0.362";
+callPackage ./common.nix ({
+  # Details from https://www.azul.com/downloads/?version=java-8-lts&package=jdk
+  # Note that the latest build may differ by platform
+  dists = {
+    x86_64-linux = {
+      zuluVersion = "8.72.0.17";
+      jdkVersion = "8.0.382";
+      hash =
+        if enableJavaFX then "sha256-mIPCFESU7hy2naYur2jvFBtVn/LZQRcFiyiG61buCYs="
+        else "sha256-exWlbyrgBb7aD4daJps9qtFP+hKWkwbMdFR4OFslupY=";
+    };
 
-  sha256_linux = "sha256-jNty0iJoXG+sp7v2fGCrwZWCSZfQ4tkYe8ERixQMKL0=";
-  sha256_darwin = "sha256-3/P3puM6a7tCHP5eZM6IzbdPrqnhY1dTa7QWss9M08M=";
+    x86_64-darwin = {
+      zuluVersion = "8.72.0.17";
+      jdkVersion = "8.0.382";
+      hash =
+        if enableJavaFX then "sha256-/x8FqygivzddXsOwIV8aj/u+LPXMmokgu97vLAVEv80="
+        else "sha256-3dTPIPGUeT6nb3gncNvEa4VTRyQIBJpp8oZadrT2ToE=";
+    };
 
-  platform = if stdenv.isDarwin then "macosx" else "linux";
-  hash = if stdenv.isDarwin then sha256_darwin else sha256_linux;
-  extension = if stdenv.isDarwin then "zip" else "tar.gz";
-
-  runtimeDependencies = [
-    cups
-  ] ++ lib.optionals gtkSupport [
-    cairo glib gtk3
-  ];
-  runtimeLibraryPath = lib.makeLibraryPath runtimeDependencies;
-
-in stdenv.mkDerivation {
-  inherit version openjdk platform hash extension;
-
-  pname = "zulu";
-
-  src = fetchurl {
-    url = "https://cdn.azul.com/zulu/bin/zulu${version}-ca-jdk${openjdk}-${platform}_x64.${extension}";
-    sha256 = hash;
+    aarch64-darwin = {
+      zuluVersion = "8.72.0.17";
+      jdkVersion = "8.0.382";
+      hash =
+        if enableJavaFX then "sha256-FkQ+0MzSZWUzc/HmiDVZEHGOrdKAVCdK5pm9wXXzzaU="
+        else "sha256-rN5AI4xAWppE4kJlzMod0JmGyHdHjTXYtx8/wOW6CFk=";
+    };
   };
-
-  buildInputs = lib.optionals stdenv.isLinux [
-    alsa-lib # libasound.so wanted by lib/libjsound.so
-    fontconfig
-    freetype
-    stdenv.cc.cc # libstdc++.so.6
-    xorg.libX11
-    xorg.libXext
-    xorg.libXi
-    xorg.libXrender
-    xorg.libXtst
-  ];
-
-  nativeBuildInputs = [
-    makeWrapper
-  ] ++ lib.optionals stdenv.isLinux [
-    autoPatchelfHook
-  ] ++ lib.optionals stdenv.isDarwin [
-    unzip
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out
-    cp -r ./* "$out/"
-  '' + lib.optionalString stdenv.isLinux ''
-    # jni.h expects jni_md.h to be in the header search path.
-    ln -s $out/include/linux/*_md.h $out/include/
-  '' + ''
-    mkdir -p $out/nix-support
-    printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs
-
-    # Set JAVA_HOME automatically.
-    cat <<EOF >> $out/nix-support/setup-hook
-    if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
-    EOF
-  '' + lib.optionalString stdenv.isLinux ''
-    # We cannot use -exec since wrapProgram is a function but not a command.
-    for bin in $( find "$out" -executable -type f ); do
-      if patchelf --print-interpreter "$bin" &> /dev/null; then
-        wrapProgram "$bin" --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
-      fi
-    done
-  '' + ''
-    runHook postInstall
-  '';
-
-  preFixup = ''
-    find "$out" -name libfontmanager.so -exec \
-      patchelf --add-needed libfontconfig.so {} \;
-  '';
-
-  passthru = {
-    home = zulu;
-  };
-
-  meta = with lib; {
-    homepage = "https://www.azul.com/products/zulu/";
-    sourceProvenance = with sourceTypes; [ binaryBytecode binaryNativeCode ];
-    license = licenses.gpl2;
-    description = "Certified builds of OpenJDK";
-    longDescription = ''
-      Certified builds of OpenJDK that can be deployed across multiple
-      operating systems, containers, hypervisors and Cloud platforms.
-    '';
-    maintainers = with maintainers; [ ];
-    platforms = [ "x86_64-linux" "x86_64-darwin" ];
-    mainProgram = "java";
-  };
-}
+} // builtins.removeAttrs args [ "callPackage" ])

pkgs/development/compilers/zulu/common.nix

@@ -0,0 +1,159 @@
+{ lib
+, stdenv
+, fetchurl
+, setJavaClassPath
+, enableJavaFX ? false
+, dists
+  # minimum dependencies
+, unzip
+, autoPatchelfHook
+, makeWrapper
+, alsa-lib
+, fontconfig
+, freetype
+, zlib
+, xorg
+  # runtime dependencies
+, cups
+  # runtime dependencies for GTK+ Look and Feel
+, gtkSupport ? stdenv.isLinux
+, cairo
+, glib
+, gtk3
+}:
+let
+  dist = dists.${stdenv.hostPlatform.system}
+    or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+
+  arch = {
+    "aarch64" = "aarch64";
+    "x86_64" = "x64";
+  }.${stdenv.hostPlatform.parsed.cpu.name}
+    or (throw "Unsupported architecture: ${stdenv.hostPlatform.parsed.cpu.name}");
+
+  platform = {
+    "darwin" = "macosx";
+    "linux" = "linux";
+  }.${stdenv.hostPlatform.parsed.kernel.name}
+    or (throw "Unsupported platform: ${stdenv.hostPlatform.parsed.kernel.name}");
+
+  runtimeDependencies = [
+    cups
+  ] ++ lib.optionals gtkSupport [
+    cairo
+    glib
+    gtk3
+  ];
+
+  runtimeLibraryPath = lib.makeLibraryPath runtimeDependencies;
+
+  jce-policies = fetchurl {
+    url = "https://web.archive.org/web/20211126120343/http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
+    hash = "sha256-gCGii4ysQbRPFCH9IQoKCCL8r4jWLS5wo1sv9iioZ1o=";
+  };
+
+  javaPackage = if enableJavaFX then "ca-fx-jdk" else "ca-jdk";
+
+  isJdk8 = lib.versions.major dist.jdkVersion == "8";
+
+  jdk = stdenv.mkDerivation rec {
+    pname = "zulu${dist.zuluVersion}-${javaPackage}";
+    version = dist.jdkVersion;
+
+    src = fetchurl {
+      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-${platform}_${arch}.tar.gz";
+      inherit (dist) hash;
+      curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/";
+    };
+
+    nativeBuildInputs = [
+      unzip
+    ] ++ lib.optionals stdenv.isLinux [
+      autoPatchelfHook
+      makeWrapper
+    ];
+
+    buildInputs = lib.optionals stdenv.isLinux [
+      alsa-lib # libasound.so wanted by lib/libjsound.so
+      fontconfig
+      freetype
+      stdenv.cc.cc # libstdc++.so.6
+      xorg.libX11
+      xorg.libXext
+      xorg.libXi
+      xorg.libXrender
+      xorg.libXtst
+      zlib
+    ];
+
+    installPhase = ''
+      mkdir -p $out
+      mv * $out
+
+      unzip ${jce-policies}
+      mv -f ZuluJCEPolicies/*.jar $out/${lib.optionalString isJdk8 "jre/"}lib/security/
+
+      # jni.h expects jni_md.h to be in the header search path.
+      ln -s $out/include/${stdenv.hostPlatform.parsed.kernel.name}/*_md.h $out/include/
+
+      if [ -f $out/LICENSE ]; then
+        install -D $out/LICENSE $out/share/zulu/LICENSE
+        rm $out/LICENSE
+      fi
+    '';
+
+    preFixup = ''
+      # Propagate the setJavaClassPath setup hook from the ${if isJdk8 then "JRE" else "JDK"} so that
+      # any package that depends on the ${if isJdk8 then "JRE" else "JDK"} has $CLASSPATH set up
+      # properly.
+      mkdir -p $out/nix-support
+      printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs
+
+      # Set JAVA_HOME automatically.
+      cat <<EOF >> $out/nix-support/setup-hook
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
+      EOF
+    '' + lib.optionalString stdenv.isLinux ''
+      # We cannot use -exec since wrapProgram is a function but not a command.
+      #
+      # jspawnhelper is executed from JVM, so it doesn't need to wrap it, and it
+      # breaks building OpenJDK (#114495).
+      for bin in $( find "$out" -executable -type f -not -name jspawnhelper ); do
+        if patchelf --print-interpreter "$bin" &> /dev/null; then
+          wrapProgram "$bin" --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
+        fi
+      done
+    ''
+    # FIXME: move all of the above to installPhase.
+    + lib.optionalString stdenv.isLinux ''
+      find "$out" -name libfontmanager.so -exec \
+        patchelf --add-needed libfontconfig.so {} \;
+    '';
+
+    # fixupPhase is moving the man to share/man which breaks it because it's a
+    # relative symlink.
+    postFixup = lib.optionalString stdenv.isDarwin ''
+      ln -nsf ../zulu-${lib.versions.major version}.jdk/Contents/Home/man $out/share/man
+    '';
+
+    passthru = (lib.optionalAttrs isJdk8 {
+      jre = jdk;
+    }) // {
+      home = jdk;
+    };
+
+    meta = (import ../openjdk/meta.nix lib version) // {
+      description = "Certified builds of OpenJDK";
+      longDescription = ''
+        Certified builds of OpenJDK that can be deployed across multiple
+        operating systems, containers, hypervisors and Cloud platforms.
+      '';
+      homepage = "https://www.azul.com/products/zulu/";
+      mainProgram = "java";
+      maintainers = [ ];
+      platforms = builtins.attrNames dists;
+      sourceProvenance = with lib.sourceTypes; [ binaryBytecode binaryNativeCode ];
+    };
+  };
+in
+jdk

pkgs/development/compilers/zulu/default.nix

@@ -1,125 +0,0 @@
-{ stdenv
-, lib
-, fetchurl
-, autoPatchelfHook
-, unzip
-, makeWrapper
-, setJavaClassPath
-, zulu
-# minimum dependencies
-, alsa-lib
-, fontconfig
-, freetype
-, zlib
-, xorg
-# runtime dependencies
-, cups
-# runtime dependencies for GTK+ Look and Feel
-, gtkSupport ? stdenv.isLinux
-, cairo
-, glib
-, gtk3
-}:
-
-let
-  version = "11.62.17";
-  openjdk = "11.0.18";
-
-  sha256_x64_linux = "sha256-b65oEbDzrrsUw+WaX94USBz/QS74yiMiGZPxqzMmmqs=";
-  sha256_x64_darwin = "sha256-nRRWTWiog8bRblmmPIPE5YibA34St3ZrJpZN91qEDUg=";
-  sha256_aarch64_darwin = "sha256-TBTrBxOfGo6MV+Md49P3sDfqVG1e+NraqfVbw9WTppk=";
-
-  platform = if stdenv.isDarwin then "macosx" else "linux";
-  hash = if stdenv.isAarch64 && stdenv.isDarwin then sha256_aarch64_darwin else if stdenv.isDarwin then sha256_x64_darwin else sha256_x64_linux;
-  extension = if stdenv.isDarwin then "zip" else "tar.gz";
-  architecture = if stdenv.isAarch64 then "aarch64" else "x64";
-
-  runtimeDependencies = [
-    cups
-  ] ++ lib.optionals gtkSupport [
-    cairo glib gtk3
-  ];
-  runtimeLibraryPath = lib.makeLibraryPath runtimeDependencies;
-
-in stdenv.mkDerivation {
-  inherit version openjdk platform hash extension;
-
-  pname = "zulu";
-
-  src = fetchurl {
-    url = "https://cdn.azul.com/zulu/bin/zulu${version}-ca-jdk${openjdk}-${platform}_${architecture}.${extension}";
-    sha256 = hash;
-  };
-
-  buildInputs = lib.optionals stdenv.isLinux [
-    alsa-lib # libasound.so wanted by lib/libjsound.so
-    fontconfig
-    freetype
-    stdenv.cc.cc # libstdc++.so.6
-    xorg.libX11
-    xorg.libXext
-    xorg.libXi
-    xorg.libXrender
-    xorg.libXtst
-    zlib
-  ];
-
-  nativeBuildInputs = [
-    makeWrapper
-  ] ++ lib.optionals stdenv.isLinux [
-    autoPatchelfHook
-  ] ++ lib.optionals stdenv.isDarwin [
-    unzip
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out
-    cp -r ./* "$out/"
-  '' + lib.optionalString stdenv.isLinux ''
-    # jni.h expects jni_md.h to be in the header search path.
-    ln -s $out/include/linux/*_md.h $out/include/
-  '' + ''
-    mkdir -p $out/nix-support
-    printWords ${setJavaClassPath} > $out/nix-support/propagated-build-inputs
-
-    # Set JAVA_HOME automatically.
-    cat <<EOF >> $out/nix-support/setup-hook
-    if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
-    EOF
-  '' + lib.optionalString stdenv.isLinux ''
-    # We cannot use -exec since wrapProgram is a function but not a command.
-    #
-    # jspawnhelper is executed from JVM, so it doesn't need to wrap it, and it
-    # breaks building OpenJDK (#114495).
-    for bin in $( find "$out" -executable -type f -not -name jspawnhelper ); do
-      wrapProgram "$bin" --prefix LD_LIBRARY_PATH : "${runtimeLibraryPath}"
-    done
-  '' + ''
-    runHook postInstall
-  '';
-
-  preFixup = ''
-    find "$out" -name libfontmanager.so -exec \
-      patchelf --add-needed libfontconfig.so {} \;
-  '';
-
-  passthru = {
-    home = zulu;
-  };
-
-  meta = with lib; {
-    homepage = "https://www.azul.com/products/zulu/";
-    sourceProvenance = with sourceTypes; [ binaryBytecode binaryNativeCode ];
-    license = licenses.gpl2;
-    description = "Certified builds of OpenJDK";
-    longDescription = ''
-      Certified builds of OpenJDK that can be deployed across multiple
-      operating systems, containers, hypervisors and Cloud platforms.
-    '';
-    maintainers = with maintainers; [ ];
-    platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" ];
-    mainProgram = "java";
-  };
-}

pkgs/development/interpreters/hugs/default.nix

@@ -41,6 +41,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     broken = stdenv.isDarwin;
+    mainProgram = "hugs";
     homepage = "https://www.haskell.org/hugs";
     description = "Haskell interpreter";
     maintainers = with maintainers; [ joachifm ];

pkgs/development/interpreters/luau/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "luau";
-  version = "0.596";
+  version = "0.598";
 
   src = fetchFromGitHub {
     owner = "Roblox";
     repo = "luau";
     rev = version;
-    hash = "sha256-25SMgBW5Uqh0dGM8A9qCTcUPPP7wzH8wCGk4w+0wp/c=";
+    hash = "sha256-B3ggPrhvq1kYmclmuomi6PhXIwN8GKBzbKRLIjH0pac=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/dqlite/default.nix

@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dqlite";
-  version = "1.15.1";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "canonical";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-GmteQy+nYQFspLvdw44TjuQQeTRQ24OtDeAA+TQJKiU=";
+    hash = "sha256-8MPAyCqqjDpDHSyiZ1cvvgflaOLNzPGswZSsSjSffvw=";
   };
 
   nativeBuildInputs = [ autoreconfHook file pkg-config ];

pkgs/development/libraries/libaec/default.nix

@@ -4,20 +4,22 @@
 
 stdenv.mkDerivation rec {
   pname = "libaec";
-  version  = "1.0.6";
+  version  = "1.1.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.dkrz.de";
     owner = "k202009";
     repo = "libaec";
     rev = "v${version}";
-    sha256 = "sha256-N0YwJuVqv8jv/uSbpn/eJBTMhlHDcY/74+anH2vNvpI=";
+    sha256 = "sha256-5nsJrbJVqjXNb3exYgEvSGUq8ccy9HG+gwmBZvjnupc=";
   };
 
   nativeBuildInputs = [
     cmake
   ];
 
+  doCheck = true;
+
   meta = with lib; {
     homepage = "https://gitlab.dkrz.de/k202009/libaec";
     description = "Adaptive Entropy Coding library";

pkgs/development/libraries/libetpan/default.nix

@@ -10,22 +10,53 @@ stdenv.mkDerivation rec {
     owner = "dinhviethoa";
     repo = "libetpan";
     rev = version;
-    sha256 = "0g7an003simfdn7ihg9yjv7hl2czsmjsndjrp39i7cad8icixscn";
+    hash = "sha256-lukeWURNsRPTuFk2q2XVnwkKz5Y+PRiPba5GPQCw6jw=";
   };
 
   outputs = [ "out" "dev" ];
 
   patches = [
-    # The following two patches are fixing CVE-2020-15953, as reported in the
-    # issue tracker: https://github.com/dinhvh/libetpan/issues/386
-    # They might be removed for the next version bump.
+    # The following patches are security and/or reliability fixes.
+    # They all must be removed for the next version bump.
+
+    # Fix potential null pointer deference
+    # https://github.com/dinhvh/libetpan/pull/348
+    (fetchpatch {
+      name = "pr-348-null-pointer-deference.patch";
+      url = "https://github.com/dinhvh/libetpan/commit/720e92e5752e562723a9730f8e604cb78f3a9163.patch";
+      hash = "sha256-/bA/ekeMhLE3OyREHIanlrb+uuSxwur+ZloeaX9AyyM=";
+    })
+
+    # Fix potential null pointer deference
+    # https://github.com/dinhvh/libetpan/pull/361
+    (fetchpatch {
+      name = "pr-361-null-pointer-deference.patch";
+      url = "https://github.com/dinhvh/libetpan/commit/0cdefb017fcfd0fae56a151dc14c8439a38ecc44.patch";
+      hash = "sha256-qbWisOCPI91AIXzg3n7mceSVbBKHZXd8Z0z1u/SrIG8=";
+    })
+
+    # Fix potential null pointer deference
+    # https://github.com/dinhvh/libetpan/pull/363
+    (fetchpatch {
+      name = "pr-363-null-pointer-deference.patch";
+      url = "https://github.com/dinhvh/libetpan/commit/68bde8b12b40a680c29d228f0b8fe4dfbf2d8d0b.patch";
+      hash = "sha256-dUbnh2RoeELk/usHeFsdGC+J198jcudx3rb6/3sUAX0=";
+    })
+
+    # Missing boundary fix
+    # https://github.com/dinhvh/libetpan/pull/384
+    (fetchpatch {
+      name = "pr-384-missing-boundary-fix.patch";
+      url = "https://github.com/dinhvh/libetpan/commit/24c485495216c00076b29391591f46b61fcb3dac.patch";
+      hash = "sha256-6ry8EfiYgbMtQYtT7L662I1A7N7N6OOy9T2ECgR7+cI=";
+    })
 
     # CVE-2020-15953: Detect extra data after STARTTLS response and exit
     # https://github.com/dinhvh/libetpan/pull/387
     (fetchpatch {
       name = "cve-2020-15953-imap.patch";
       url = "https://github.com/dinhvh/libetpan/commit/1002a0121a8f5a9aee25357769807f2c519fa50b.patch";
-      sha256 = "1h9ds2z4jii40a0i3z6hsnzx1ldmd2jqidsxp2y2ksyp1ijcgabn";
+      hash = "sha256-dqnHZAzX6ym8uF23iKVotdHQv9XQ/BGBAiRGSb7QLcE=";
     })
 
     # CVE-2020-15953: Detect extra data after STARTTLS responses in SMTP and POP3 and exit
@@ -33,7 +64,23 @@ stdenv.mkDerivation rec {
     (fetchpatch {
       name = "cve-2020-15953-pop3-smtp.patch";
       url = "https://github.com/dinhvh/libetpan/commit/298460a2adaabd2f28f417a0f106cb3b68d27df9.patch";
-      sha256 = "0lq829djar7nb3fai3vdzirmks3w2lfagzqc809lx2lln6y213a0";
+      hash = "sha256-QI0gvLGUik4TQAz/pxwVfOhZc/xtj6jcWPZkJVsSCFM=";
+    })
+
+    # Fix buffer overwrite for empty string in remove_trailing_eol
+    # https://github.com/dinhvh/libetpan/pull/408
+    (fetchpatch {
+      name = "pr-408-fix-buffer-overwrite.patch";
+      url = "https://github.com/dinhvh/libetpan/commit/078b924c7f49ac435b10b0f53a73f1bbc4717064.patch";
+      hash = "sha256-lBRS+bv/7IK7yat2p3mc0SRYn/wRB/spjE7ungj6DT0=";
+    })
+
+    # CVE-2022-4121: Fixed crash when st_info_list is NULL.
+    # https://github.com/dinhvh/libetpan/issues/420
+    (fetchpatch {
+      name = "cve-2022-4121.patch";
+      url = "https://github.com/dinhvh/libetpan/commit/5c9eb6b6ba64c4eb927d7a902317410181aacbba.patch";
+      hash = "sha256-O+LUkI91oej7MFg4Pg6/xq1uhSanweH81VzPXBdiPh4=";
     })
   ];
 
@@ -45,9 +92,8 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Mail Framework for the C Language";
-    homepage = "http://www.etpan.org/libetpan.html";
+    homepage = "https://www.etpan.org/libetpan.html";
     license = licenses.bsd3;
     maintainers = with maintainers; [ oxzi ];
-    platforms = platforms.linux;
   };
 }

pkgs/development/libraries/liblinphone/backport-cpp17.patch

@@ -0,0 +1,98 @@
+From 9ece6e77dcf6545c3b8104068302c6243e3a5e88 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micka=C3=ABl=20Turnel?=
+ <mickael.turnel@belledonne-communications.com>
+Date: Wed, 1 Mar 2023 09:14:53 +0100
+Subject: [PATCH] Set c++ version 17 and fix compilation errors
+
+Backported-by: Lorenz Brun <lorenz@brun.one>
+
+---
+ CMakeLists.txt                           |  2 +-
+ daemon/daemon.cc                         |  2 +-
+ libxsd/xsd/cxx/config.hxx                |  2 +-
+ src/conference/session/streams-group.cpp | 10 +++++-----
+ 4 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 475ff16a8..a771e4595 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -92,7 +92,7 @@ cmake_dependent_option(ENABLE_QRCODE "Enable QRCode support" YES "ENABLE_VIDEO"
+ # * DISABLE_BC_PACKAGE_SEARCH: skip find_package() for every BC package (bctoolbox, ortp, etc.)
+ # * DISABLE_SOCI_PACKAGE_SEARCH: skip find_package() for Soci.
+ 
+-set(CMAKE_CXX_STANDARD 14)
++set(CMAKE_CXX_STANDARD 17)
+ set(CMAKE_CXX_EXTENSIONS NO)
+ 
+ if(NOT CMAKE_BUILD_TYPE)
+diff --git a/daemon/daemon.cc b/daemon/daemon.cc
+index 197fc22ef..fd09edb26 100644
+--- a/daemon/daemon.cc
++++ b/daemon/daemon.cc
+@@ -628,7 +628,7 @@ void Daemon::execCommand(const string &command) {
+ 	ist.get(argsbuf);
+ 	string args = argsbuf.str();
+ 	if (!args.empty() && (args[0] == ' ')) args.erase(0, 1);
+-	list<DaemonCommand*>::iterator it = find_if(mCommands.begin(), mCommands.end(), bind2nd(mem_fun(&DaemonCommand::matches), name));
++	list<DaemonCommand*>::iterator it = find_if(mCommands.begin(), mCommands.end(), [&name](const DaemonCommand *dc) { return dc->matches(name); });
+ 	if (it != mCommands.end()) {
+ 		ms_mutex_lock(&mMutex);
+ 		(*it)->exec(this, args);
+diff --git a/libxsd/xsd/cxx/config.hxx b/libxsd/xsd/cxx/config.hxx
+index 076b107f5..385841731 100644
+--- a/libxsd/xsd/cxx/config.hxx
++++ b/libxsd/xsd/cxx/config.hxx
+@@ -19,7 +19,7 @@
+ #  endif
+ #else
+ #  if defined(__GXX_EXPERIMENTAL_CXX0X__) || __cplusplus >= 201103L
+-#    ifdef __GNUC__
++#    if defined(__GNUC__) && !defined(__clang__)
+ #      if (__GNUC__ == 4 && __GNUC_MINOR__ >= 6) || __GNUC__ > 4
+ #        define XSD_CXX11_NULLPTR
+ #      endif
+diff --git a/src/conference/session/streams-group.cpp b/src/conference/session/streams-group.cpp
+index bff739dda..84277a6b7 100644
+--- a/src/conference/session/streams-group.cpp
++++ b/src/conference/session/streams-group.cpp
+@@ -447,11 +447,11 @@ float StreamsGroup::computeOverallQuality(_functor func){
+ }
+ 
+ float StreamsGroup::getAverageQuality(){
+-	return computeOverallQuality(mem_fun(&Stream::getAverageQuality));
++	return computeOverallQuality(mem_fn(&Stream::getAverageQuality));
+ }
+ 
+ float StreamsGroup::getCurrentQuality(){
+-	return computeOverallQuality(mem_fun(&Stream::getCurrentQuality));
++	return computeOverallQuality(mem_fn(&Stream::getCurrentQuality));
+ }
+ 
+ int StreamsGroup::getAvpfRrInterval()const{
+@@ -481,11 +481,11 @@ bool StreamsGroup::avpfEnabled() const{
+ }
+ 
+ void StreamsGroup::refreshSockets(){
+-	forEach<Stream>(mem_fun(&Stream::refreshSockets));
++	forEach<Stream>(mem_fn(&Stream::refreshSockets));
+ }
+ 
+ void StreamsGroup::computeAndReportBandwidth(){
+-	forEach<Stream>(mem_fun(&Stream::updateBandwidthReports));
++	forEach<Stream>(mem_fn(&Stream::updateBandwidthReports));
+ 	
+ 	if (!bctbx_log_level_enabled(BCTBX_LOG_DOMAIN, BCTBX_LOG_MESSAGE)) return;
+ 	
+@@ -540,7 +540,7 @@ void StreamsGroup::finish(){
+ 	mIceService->finish(); // finish ICE first, as it has actions on the streams.
+ 	for (auto & ss : mSharedServices) ss.second->checkDestroy();
+ 	mSharedServices.clear();
+-	forEach<Stream>(mem_fun(&Stream::finish));
++	forEach<Stream>(mem_fn(&Stream::finish));
+ 	mFinished = true;
+ }
+ 
+-- 
+2.41.0
+

pkgs/development/libraries/liblinphone/default.nix

@@ -1,7 +1,7 @@
-{ bctoolbox
+{ lib
+, bc-soci
 , belcard
 , belle-sip
-, belr
 , cmake
 , doxygen
 , fetchFromGitLab
@@ -10,9 +10,7 @@
 , lime
 , mediastreamer
 , python3
-, bc-soci
 , sqlite
-, lib
 , stdenv
 , xercesc
 , zxing-cpp
@@ -31,6 +29,12 @@ stdenv.mkDerivation rec {
     hash = "sha256-kQZePMa7MTaSJLEObM8khfSFYLqhlgTcVyKfTPLwKYU=";
   };
 
+  patches = [
+    # zxing-cpp 2.0+ requires C++ 17
+    # Manual backport as upstream ran formatters in the meantime
+    ./backport-cpp17.patch
+  ];
+
   postPatch = ''
     substituteInPlace src/CMakeLists.txt \
       --replace "jsoncpp_object" "jsoncpp" \

pkgs/development/libraries/mlt/default.nix

@@ -40,13 +40,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mlt";
-  version = "7.18.0";
+  version = "7.20.0";
 
   src = fetchFromGitHub {
     owner = "mltframework";
     repo = "mlt";
     rev = "v${version}";
-    hash = "sha256-3qvMuBr2w/gedTDIjG6ezatleXuQSnKX4SkBShzj6aw=";
+    hash = "sha256-5yELGA3U/YkINEtRyr/tb3HjWMQjqKIWjUbH7ZFMgLU=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/neatvnc/default.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "neatvnc";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "any1";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-3hNdgfAJGJkMXdB86+u3bKwrvXoMei1YCFXDG4ObkU4=";
+    sha256 = "sha256-R+PvD7E/z+Gc7h2y0pUYaCkzfgpxzwToOr4pKSrOnxU=";
   };
 
   strictDeps = true;

pkgs/development/libraries/the-foundation/default.nix

@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "the-foundation";
-  version = "1.6.1";
+  version = "1.7.0";
 
   src = fetchFromGitea {
     domain = "git.skyjake.fi";
     owner = "skyjake";
     repo = "the_Foundation";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-GOvdnmutSQcsNT57tADLSkJAUX0JDVsualII+y21a+I=";
+    hash = "sha256-6bEd8KzOfBse5sQ2zp+cZtEAu8xIl3GqrpxSZ7h/edI=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];

pkgs/development/libraries/xsimd/10.nix

@@ -0,0 +1,47 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, doctest
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xsimd";
+  version = "10.0.0";
+
+  src = fetchFromGitHub {
+    owner = "xtensor-stack";
+    repo = "xsimd";
+    rev = finalAttrs.version;
+    sha256 = "sha256-+ewKbce+rjNWQ0nQzm6O4xSwgzizSPpDPidkQYuoSTU=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+  patches = lib.optionals stdenv.isDarwin [
+    # https://github.com/xtensor-stack/xsimd/issues/807
+    ./disable-test_error_gamma-test.patch
+  ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
+    # https://github.com/xtensor-stack/xsimd/issues/798
+    ./disable-polar-test.patch
+  ];
+
+  cmakeFlags = [
+    "-DBUILD_TESTS=${if (finalAttrs.doCheck && stdenv.hostPlatform == stdenv.buildPlatform) then "ON" else "OFF"}"
+  ];
+
+  doCheck = true;
+  nativeCheckInputs = [
+    doctest
+  ];
+  checkTarget = "xtest";
+
+  meta = with lib; {
+    description = "C++ wrappers for SIMD intrinsics";
+    homepage = "https://github.com/xtensor-stack/xsimd";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ tobim ];
+    platforms = platforms.all;
+  };
+})

pkgs/development/libraries/xsimd/default.nix

@@ -5,13 +5,13 @@
 , doctest
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "xsimd";
   version = "11.1.0";
   src = fetchFromGitHub {
     owner = "xtensor-stack";
     repo = "xsimd";
-    rev = version;
+    rev = finalAttrs.version;
     sha256 = "sha256-l6IRzndjb95hIcFCCm8zmlNHWtKduqy2t/oml/9Xp+w=";
   };
   patches = [
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
   ];
 
   cmakeFlags = [
-    "-DBUILD_TESTS=${if (doCheck && stdenv.hostPlatform == stdenv.buildPlatform) then "ON" else "OFF"}"
+    "-DBUILD_TESTS=${if (finalAttrs.doCheck && stdenv.hostPlatform == stdenv.buildPlatform) then "ON" else "OFF"}"
   ];
 
   doCheck = true;
@@ -57,4 +57,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ tobim ];
     platforms = platforms.all;
   };
-}
+})

pkgs/development/libraries/xtensor/default.nix

@@ -2,36 +2,54 @@
 , stdenv
 , fetchFromGitHub
 , cmake
-, gtest
-, xsimd
+, doctest
+, enableAssertions ? false
+, enableBoundChecks ? false # Broadcasts don't pass bound checks
+, nlohmann_json
 , xtl
+# Although this dependency is of the same GitHub organization, xtensor don't
+# support xsimd 11 yet, see:
+# https://github.com/xtensor-stack/xtensor/issues/2721
+, xsimd10
 }:
-stdenv.mkDerivation rec {
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "xtensor";
-  version = "0.23.10";
+  version = "0.24.7";
 
   src = fetchFromGitHub {
     owner = "xtensor-stack";
     repo = "xtensor";
-    rev = version;
-    sha256 = "1ayrhyh9x33b87ic01b4jzxc8x27yxpxzya5x54ikazvz8p71n14";
+    rev = finalAttrs.version;
+    hash = "sha256-dVbpcBW+jK9nIl5efk5LdKdBm8CkaJWEZ0ZY7ZuApwk=";
   };
 
-  nativeBuildInputs = [ cmake ];
-  propagatedBuildInputs = [ xtl xsimd ];
+  nativeBuildInputs = [
+    cmake
+  ];
+  propagatedBuildInputs = [
+    nlohmann_json
+    xtl
+  ] ++ lib.optionals (!(stdenv.isAarch64 && stdenv.isLinux)) [
+    # xsimd support is broken on aarch64-linux, see:
+    # https://github.com/xtensor-stack/xsimd/issues/945
+    xsimd10
+  ];
 
-  cmakeFlags = [ "-DBUILD_TESTS=ON" ];
+  cmakeFlags = let
+    cmakeBool = x: if x then "ON" else "OFF";
+  in [
+    "-DBUILD_TESTS=${cmakeBool finalAttrs.doCheck}"
+    "-DXTENSOR_ENABLE_ASSERT=${cmakeBool enableAssertions}"
+    "-DXTENSOR_CHECK_DIMENSION=${cmakeBool enableBoundChecks}"
+  ];
 
   doCheck = true;
-  nativeCheckInputs = [ gtest ];
+  nativeCheckInputs = [
+    doctest
+  ];
   checkTarget = "xtest";
 
-  # https://github.com/xtensor-stack/xtensor/issues/2542
-  postPatch = ''
-    substituteInPlace xtensor.pc.in \
-      --replace '$'{prefix}/@CMAKE_INSTALL_LIBDIR@ @CMAKE_INSTALL_FULL_LIBDIR@
-  '';
-
   meta = with lib; {
     description = "Multi-dimensional arrays with broadcasting and lazy computing.";
     homepage = "https://github.com/xtensor-stack/xtensor";
@@ -39,4 +57,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ cpcloud ];
     platforms = platforms.all;
   };
-}
+})

pkgs/development/ocaml-modules/pprint/default.nix

@@ -2,7 +2,7 @@
 
 buildDunePackage rec {
   pname = "pprint";
-  version = "20220103";
+  version = "20230830";
 
   useDune2 = true;
 
@@ -10,7 +10,7 @@ buildDunePackage rec {
     owner = "fpottier";
     repo = pname;
     rev = version;
-    sha256 = "sha256:09y6nwnjldifm47406q1r9987njlk77g4ifqg6qs54dckhr64vax";
+    sha256 = "sha256-avf71vAgCL1MU8O7Q3FNN3wEdCDtbNZP0ipETnn8AqA=";
   };
 
   meta = with lib; {