Merge pull request #194986 from fabaff/dissect

python310Packages.acquire: init at 3.2

pkgs/development/python-modules/acquire/default.nix

@@ -0,0 +1,70 @@
+{ lib
+, buildPythonPackage
+, defusedxml
+, dissect-cstruct
+, dissect-target
+, fetchFromGitHub
+, minio
+, pycryptodome
+, pytestCheckHook
+, pythonOlder
+, requests
+, requests-toolbelt
+, rich
+, setuptools
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "acquire";
+  version = "3.2";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "acquire";
+    rev = version;
+    hash = "sha256-YwmrdqWG5qD621+jQMVyTM0Uy0yXCVPv9zfVhZ+ohg0=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    defusedxml
+    dissect-cstruct
+    dissect-target
+  ];
+
+  passthru.optional-dependencies = {
+    full = [
+      dissect-target
+      minio
+      pycryptodome
+      requests
+      requests-toolbelt
+      rich
+    ] ++ dissect-target.optional-dependencies.full;
+  };
+
+  checkInputs = [
+    pytestCheckHook
+  ] ++ passthru.optional-dependencies.full;
+
+  pythonImportsCheck = [
+    "acquire"
+  ];
+
+  meta = with lib; {
+    description = "Tool to quickly gather forensic artifacts from disk images or a live system";
+    homepage = "https://github.com/fox-it/acquire";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-cim/default.nix

@@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, dissect-util
+, fetchFromGitHub
+, setuptools
+, setuptools-scm
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-cim";
+  version = "3.2";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.cim";
+    rev = version;
+    hash = "sha256-rWlAYndqqZ6l/iwk1u2gG0mtQHvAMYUUEWo23hLykXI=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-util
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "dissect.cim"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parser for the Windows Common Information Model (CIM) database";
+    homepage = "https://github.com/fox-it/dissect.cim";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-clfs/default.nix

@@ -0,0 +1,50 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, fetchFromGitHub
+, setuptools
+, setuptools-scm
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-clfs";
+  version = "1.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.clfs";
+    rev = version;
+    hash = "sha256-5rG8YiVBU4ETLgQoFnMaeXHttIB26+OhIdYjKDKmPBc=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "dissect.clfs"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parser for the CLFS (Common Log File System) file system";
+    homepage = "https://github.com/fox-it/dissect.clfs";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-cstruct/default.nix

@@ -0,0 +1,45 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools
+, setuptools-scm
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-cstruct";
+  version = "3.2";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.cstruct";
+    rev = version;
+    hash = "sha256-iP00EcEkUWoYi+SCo/gY9LSVtCSQZ3g2wMs4Z8m+X2M=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "dissect.cstruct"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parser for C-like structures";
+    homepage = "https://github.com/fox-it/dissect.cstruct";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-esedb/default.nix

@@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, dissect-util
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, setuptools
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-esedb";
+  version = "3.2";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.esedb";
+    rev = version;
+    hash = "sha256-DLu6FCWqeESFlsIB21jN/IKCwSKlBoibildv07/hPcw=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-util
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "dissect.esedb"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parser for Microsofts Extensible Storage Engine Database (ESEDB)";
+    homepage = "https://github.com/fox-it/dissect.esedb";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-etl/default.nix

@@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, dissect-util
+, fetchFromGitHub
+, setuptools
+, setuptools-scm
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-etl";
+  version = "3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.etl";
+    rev = version;
+    hash = "sha256-EqEYw2MpNjdw8nXkxe76R5y99Y+rsK42qfTpT/kxtZ0=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-util
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "dissect.etl"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parser for Event Trace Log (ETL) files";
+    homepage = "https://github.com/fox-it/dissect.etl";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-eventlog/default.nix

@@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, dissect-util
+, fetchFromGitHub
+, setuptools
+, setuptools-scm
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-eventlog";
+  version = "3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.eventlog";
+    rev = version;
+    hash = "sha256-cLIsK2/pL9nNOitoTZprqAio1BOo3/Uqfbl8uL/1tG4=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-util
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "dissect.eventlog"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing parsers for the Windows EVT, EVTX and WEVT log file formats";
+    homepage = "https://github.com/fox-it/dissect.eventlog";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-evidence/default.nix

@@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, dissect-util
+, fetchFromGitHub
+, setuptools
+, setuptools-scm
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-evidence";
+  version = "3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.evidence";
+    rev = version;
+    hash = "sha256-X0WMv96Wo3vDZ6HYGdWfn7OKhFuT5Qjzkyj4HzMqCiM=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-util
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "dissect.evidence"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parsers for various forensic evidence file containers";
+    homepage = "https://github.com/fox-it/dissect.evidence";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-extfs/default.nix

@@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, dissect-util
+, fetchFromGitHub
+, setuptools
+, setuptools-scm
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-extfs";
+  version = "3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.extfs";
+    rev = version;
+    hash = "sha256-i52hlTh0uJJcprA6oVlFQ3v6BpOtSnQAQ0p6BHt56Ac=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-util
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "dissect.extfs"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parser for the ExtFS file system";
+    homepage = "https://github.com/fox-it/dissect.extfs";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-fat/default.nix

@@ -0,0 +1,50 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, dissect-util
+, fetchFromGitHub
+, setuptools
+, setuptools-scm
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-fat";
+  version = "3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.fat";
+    rev = version;
+    hash = "sha256-GBeacQtNA1onh67Svqo5R43gap/Lzpm+20TXcUMmU5k=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-util
+  ];
+
+  # dissect.fat.exceptions.InvalidBPB: Invalid BS_jmpBoot
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "dissect.fat"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parser for the FAT file system";
+    homepage = "https://github.com/fox-it/dissect.fat";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-ffs/default.nix

@@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, dissect-util
+, fetchFromGitHub
+, setuptools
+, setuptools-scm
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-ffs";
+  version = "3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.ffs";
+    rev = version;
+    hash = "sha256-JI0i0pvOOChWCDB8rynDuf0txvPQT7z2JJ1EsE4VNLw=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-util
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "dissect.ffs"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parser for the FFS file system";
+    homepage = "https://github.com/fox-it/dissect.ffs";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-hypervisor/default.nix

@@ -0,0 +1,61 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, dissect-util
+, fetchFromGitHub
+, pycryptodome
+, pytestCheckHook
+, pythonOlder
+, rich
+, setuptools
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-hypervisor";
+  version = "3.2";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.hypervisor";
+    rev = version;
+    hash = "sha256-yc9QfzvWX8jsRVZYglZZuMfxsYUoPr5gf407DABjQcU=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-util
+  ];
+
+  passthru.optional-dependencies = {
+    full = [
+      pycryptodome
+      rich
+    ];
+  };
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "dissect.hypervisor"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing parsers for various hypervisor disk, backup and configuration files";
+    homepage = "https://github.com/fox-it/dissect.hypervisor";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-ntfs/default.nix

@@ -0,0 +1,57 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, dissect-util
+, fetchFromGitHub
+, setuptools
+, setuptools-scm
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-ntfs";
+  version = "3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.ntfs";
+    rev = version;
+    hash = "sha256-hZz/v6qLZnbsZkS/cBU/to4XmZNgUJQwCaPkY2ebl4Q=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-util
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "dissect.ntfs"
+  ];
+
+  disabledTestPaths = [
+    # Test is very time consuming
+    "tests/test_index.py"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parser for the NTFS file system";
+    homepage = "https://github.com/fox-it/dissect.ntfs";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-ole/default.nix

@@ -0,0 +1,50 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, dissect-util
+, fetchFromGitHub
+, setuptools
+, setuptools-scm
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-ole";
+  version = "3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.ole";
+    rev = version;
+    hash = "sha256-qnrbS+gdzBV/mQ08fQzpvevkDtrJ1qXpteW0lxJ+ZUI=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-util
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "dissect.ole"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parser for the Object Linking & Embedding (OLE) format";
+    homepage = "https://github.com/fox-it/dissect.ole";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-regf/default.nix

@@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, dissect-util
+, fetchFromGitHub
+, setuptools
+, setuptools-scm
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-regf";
+  version = "3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.regf";
+    rev = version;
+    hash = "sha256-88qG90jza0EVP5dgz09ZA8Z+zFwqanOODlUgsvkMxGo=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-util
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "dissect.regf"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parser for Windows registry file format";
+    homepage = "https://github.com/fox-it/dissect.regf";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-shellitem/default.nix

@@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, dissect-util
+, fetchFromGitHub
+, setuptools
+, setuptools-scm
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-shellitem";
+  version = "3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.shellitem";
+    rev = version;
+    hash = "sha256-HVnfHsD1V+4kWt9qOClsKuIZMpX4VKrr/5eD7KRq5ww=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-util
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "dissect.shellitem"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parser for the Shellitem structures";
+    homepage = "https://github.com/fox-it/dissect.shellitem";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-sql/default.nix

@@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, dissect-util
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, setuptools
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-sql";
+  version = "3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.sql";
+    rev = version;
+    hash = "sha256-uKCCwTFLQSos+L0qc1pFlF3O4FV13up0qFqDYdTZJBk=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-util
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "dissect.sql"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parsers for the SQLite database file format";
+    homepage = "https://github.com/fox-it/dissect.sql";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-target/default.nix

@@ -0,0 +1,110 @@
+{ lib
+, asn1crypto
+, buildPythonPackage
+, defusedxml
+, dissect-cim
+, dissect-clfs
+, dissect-cstruct
+, dissect-esedb
+, dissect-etl
+, dissect-eventlog
+, dissect-evidence
+, dissect-extfs
+, dissect-fat
+, dissect-ffs
+, dissect-hypervisor
+, dissect-ntfs
+, dissect-regf
+, dissect-sql
+, dissect-util
+, dissect-volume
+, dissect-xfs
+, fetchFromGitHub
+, flow-record
+, fusepy
+, ipython
+, pytestCheckHook
+, pythonOlder
+, pyyaml
+, setuptools
+, setuptools-scm
+, structlog
+, yara-python
+, zstandard
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-target";
+  version = "3.3";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.target";
+    rev = version;
+    hash = "sha256-EWUYN2OsYeDo3C+QgjAVq9NXiVk1KWGILwtT0cI0tB0=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-eventlog
+    dissect-evidence
+    dissect-hypervisor
+    dissect-ntfs
+    dissect-regf
+    dissect-util
+    dissect-volume
+    flow-record
+    structlog
+  ];
+
+  passthru.optional-dependencies = {
+    full = [
+      asn1crypto
+      defusedxml
+      dissect-cim
+      dissect-clfs
+      dissect-esedb
+      dissect-etl
+      dissect-extfs
+      dissect-fat
+      dissect-ffs
+      dissect-sql
+      dissect-xfs
+      fusepy
+      ipython
+      pyyaml
+      yara-python
+      zstandard
+    ];
+  };
+
+  checkInputs = [
+    pytestCheckHook
+  ] ++ passthru.optional-dependencies.full;
+
+  pythonImportsCheck = [
+    "dissect.target"
+  ];
+
+  disabledTests = [
+    # Test requires rdump
+    "test_exec_target_command"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module that provides a programming API and command line tools";
+    homepage = "https://github.com/fox-it/dissect.target";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-util/default.nix

@@ -0,0 +1,45 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools
+, setuptools-scm
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-util";
+  version = "3.2";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.util";
+    rev = version;
+    hash = "sha256-vit+SQ368limLvdVP/0eVINiEAY/dzD/simHFw489Ck=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "dissect.util"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing various utility functions for the other Dissect modules";
+    homepage = "https://github.com/fox-it/dissect.util";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-vmfs/default.nix

@@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, dissect-util
+, fetchFromGitHub
+, setuptools
+, setuptools-scm
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-vmfs";
+  version = "3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.vmfs";
+    rev = version;
+    hash = "sha256-JVJvuH+ZTlGOnmTSB/nnBuMrc/VtkKVrLDRYnukDXBA=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-util
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "dissect.vmfs"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parser for the VMFS file system";
+    homepage = "https://github.com/fox-it/dissect.vmfs";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-volume/default.nix

@@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, dissect-util
+, fetchFromGitHub
+, setuptools
+, setuptools-scm
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-volume";
+  version = "3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.volume";
+    rev = version;
+    hash = "sha256-9SbluaB2wV4gOCry5c7ZLABMwhGfnYg7dTPdKMXYSZM=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-util
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "dissect.volume"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing various utility functions for the other Dissect modules";
+    homepage = "https://github.com/fox-it/dissect.volume";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect-xfs/default.nix

@@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, dissect-util
+, fetchFromGitHub
+, setuptools
+, setuptools-scm
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-xfs";
+  version = "3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.xfs";
+    rev = version;
+    hash = "sha256-Tg4su78Na6IAQhi7aOY8QNs3tnYOYvdnNQV6rn8QpSE=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-util
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "dissect.xfs"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parser for the XFS file system";
+    homepage = "https://github.com/fox-it/dissect.xfs";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/dissect/default.nix

@@ -0,0 +1,88 @@
+{ lib
+, buildPythonPackage
+, dissect-cim
+, dissect-clfs
+, dissect-cstruct
+, dissect-esedb
+, dissect-etl
+, dissect-eventlog
+, dissect-evidence
+, dissect-extfs
+, dissect-fat
+, dissect-ffs
+, dissect-hypervisor
+, dissect-ntfs
+, dissect-ole
+, dissect-regf
+, dissect-shellitem
+, dissect-sql
+, dissect-target
+, dissect-util
+, dissect-vmfs
+, dissect-volume
+, dissect-xfs
+, fetchFromGitHub
+, pythonOlder
+, setuptools
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "dissect";
+  version = "3.2";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect";
+    rev = version;
+    hash = "sha256-DtiaBKQtz6CgU1csfGhCw0LJLoiKwyH6N6b7/elpJkU=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cim
+    dissect-clfs
+    dissect-cstruct
+    dissect-esedb
+    dissect-etl
+    dissect-eventlog
+    dissect-evidence
+    dissect-extfs
+    dissect-fat
+    dissect-ffs
+    dissect-hypervisor
+    dissect-ntfs
+    dissect-ole
+    dissect-regf
+    dissect-shellitem
+    dissect-sql
+    dissect-target
+    dissect-util
+    dissect-vmfs
+    dissect-volume
+    dissect-xfs
+  ] ++ dissect-target.optional-dependencies.full;
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "dissect"
+  ];
+
+  meta = with lib; {
+    description = "Dissect meta module";
+    homepage = "https://github.com/fox-it/dissect";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/flow-record/default.nix

@@ -0,0 +1,68 @@
+{ lib
+, buildPythonPackage
+, elasticsearch
+, fetchFromGitHub
+, lz4
+, msgpack
+, pytestCheckHook
+, pythonOlder
+, setuptools
+, setuptools-scm
+, zstandard
+}:
+
+buildPythonPackage rec {
+  pname = "flow-record";
+  version = "3.5";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "flow.record";
+    rev = version;
+    hash = "sha256-hULz5pIqCKujVH3SpzFgzNM9R7WTtqAmuNOxG7VlUd0=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    msgpack
+  ];
+
+  passthru.optional-dependencies = {
+    compression = [
+      lz4
+      zstandard
+    ];
+    elastic = [
+      elasticsearch
+    ];
+  };
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "flow.record"
+  ];
+
+  disabledTestPaths = [
+    # Test requires rdump
+    "tests/test_rdump.py"
+  ];
+
+  meta = with lib; {
+    description = "Library for defining and creating structured data";
+    homepage = "https://github.com/fox-it/flow.record";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/top-level/all-packages.nix

@@ -1106,6 +1106,8 @@ with pkgs;
 
   acpica-tools = callPackage ../tools/system/acpica-tools { };
 
+  acquire = with python3Packages; toPythonApplication acquire;
+
   act = callPackage ../development/tools/misc/act { };
 
   actdiag = with python3.pkgs; toPythonApplication actdiag;

pkgs/top-level/python-packages.nix

@@ -171,6 +171,8 @@ in {
 
   acoustics = callPackage ../development/python-modules/acoustics { };
 
+  acquire = callPackage ../development/python-modules/acquire { };
+
   actdiag = callPackage ../development/python-modules/actdiag { };
 
   adafruit-io = callPackage ../development/python-modules/adafruit-io { };
@@ -2477,6 +2479,50 @@ in {
 
   diskcache = callPackage ../development/python-modules/diskcache { };
 
+  dissect = callPackage ../development/python-modules/dissect { };
+
+  dissect-cim = callPackage ../development/python-modules/dissect-cim { };
+
+  dissect-clfs = callPackage ../development/python-modules/dissect-clfs { };
+
+  dissect-cstruct = callPackage ../development/python-modules/dissect-cstruct { };
+
+  dissect-fat = callPackage ../development/python-modules/dissect-fat { };
+
+  dissect-ffs = callPackage ../development/python-modules/dissect-ffs { };
+
+  dissect-esedb = callPackage ../development/python-modules/dissect-esedb { };
+
+  dissect-etl = callPackage ../development/python-modules/dissect-etl { };
+
+  dissect-eventlog = callPackage ../development/python-modules/dissect-eventlog { };
+
+  dissect-evidence = callPackage ../development/python-modules/dissect-evidence { };
+
+  dissect-extfs = callPackage ../development/python-modules/dissect-extfs { };
+
+  dissect-hypervisor = callPackage ../development/python-modules/dissect-hypervisor { };
+
+  dissect-ntfs = callPackage ../development/python-modules/dissect-ntfs { };
+
+  dissect-ole = callPackage ../development/python-modules/dissect-ole { };
+
+  dissect-regf = callPackage ../development/python-modules/dissect-regf { };
+
+  dissect-shellitem = callPackage ../development/python-modules/dissect-shellitem { };
+
+  dissect-sql = callPackage ../development/python-modules/dissect-sql { };
+
+  dissect-target = callPackage ../development/python-modules/dissect-target { };
+
+  dissect-util = callPackage ../development/python-modules/dissect-util { };
+
+  dissect-vmfs = callPackage ../development/python-modules/dissect-vmfs { };
+
+  dissect-volume = callPackage ../development/python-modules/dissect-volume { };
+
+  dissect-xfs = callPackage ../development/python-modules/dissect-xfs { };
+
   dissononce = callPackage ../development/python-modules/dissononce { };
 
   distlib = callPackage ../development/python-modules/distlib { };
@@ -3470,6 +3516,8 @@ in {
 
   flit-core = callPackage ../development/python-modules/flit-core { };
 
+  flow-record = callPackage ../development/python-modules/flow-record { };
+
   flower = callPackage ../development/python-modules/flower { };
 
   flowlogs_reader = callPackage ../development/python-modules/flowlogs_reader { };