From 063943c214aed7e583d9ec026a56e5b5b806b53d Mon Sep 17 00:00:00 2001
From: Ivar Larsson <ivar@larsson.me>
Date: Tue, 26 Mar 2024 15:58:26 -0400
Subject: [PATCH 01/42] emulationstation-de: 2.2.1 -> 3.0.2

---
 .../em/emulationstation-de/package.nix        | 33 ++++++++++++++-----
 1 file changed, 25 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/em/emulationstation-de/package.nix b/pkgs/by-name/em/emulationstation-de/package.nix
index 1fca35aea153..d30837b635d2 100644
--- a/pkgs/by-name/em/emulationstation-de/package.nix
+++ b/pkgs/by-name/em/emulationstation-de/package.nix
@@ -15,13 +15,13 @@
   SDL2
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "emulationstation-de";
-  version = "2.2.1";
+  version = "3.0.2";
 
   src = fetchzip {
-    url = "https://gitlab.com/es-de/emulationstation-de/-/archive/v2.2.1/emulationstation-de-v2.2.1.tar.gz";
-    hash = "sha256:1kp9p3fndnx4mapgfvy742zwisyf0y5k57xkqkis0kxyibx0z8i6";
+    url = "https://gitlab.com/es-de/emulationstation-de/-/archive/v${finalAttrs.version}/emulationstation-de-v${finalAttrs.version}.tar.gz";
+    hash = "sha256:RGlXFybbXYx66Hpjp2N3ovK4T5VyS4w0DWRGNvbwugs=";
   };
 
   patches = [ ./001-add-nixpkgs-retroarch-cores.patch ];
@@ -44,8 +44,25 @@ stdenv.mkDerivation {
   ];
 
   installPhase = ''
-    install -D ../emulationstation $out/bin/emulationstation
-    cp -r ../resources/ $out/bin/resources/
+    # Binary
+    install -D ../es-de $out/bin/es-de
+
+    # Resources
+    mkdir -p $out/share/es-de/
+    cp -r ../resources/ $out/share/es-de/resources/
+
+    # Desktop file
+    mkdir -p $out/share/applications
+    cp ../es-app/assets/org.es_de.frontend.desktop $out/share/applications/
+
+    # Icon
+    mkdir -p $out/share/icons/hicolor/scalable/apps
+    cp ../es-app/assets/org.es_de.frontend.svg $out/share/icons/hicolor/scalable/apps/
+  '';
+
+  postInstall = ''
+    substituteInPlace $out/share/applications/org.es_de.frontend.desktop \
+      --replace "Exec=es-de" "Exec=$out/bin/es-de"
   '';
 
   meta = {
@@ -54,6 +71,6 @@ stdenv.mkDerivation {
     maintainers = with lib.maintainers; [ ivarmedi ];
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
-    mainProgram = "emulationstation";
+    mainProgram = "es-de";
   };
-}
+})

From 3c21a5c9d6c87860a9abeb9f3ef753496de9c809 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Tue, 28 May 2024 20:52:06 +0200
Subject: [PATCH 02/42] lib/systems: elaborate properly with non-matching
 system / config / parsed args

When elaborating a system with both "config" and "system" arguments
given, they might not match the parsed results.  Example:

elaborate {
  config = "i686-unknown-linux-gnu";
  system = "x86_64-linux";
}

This would result in a parsed system for i686, because the config
argument is preferred.  But since "// args //" comes after system has
been inferred from parsed, it is overwritten again.  This results in
config and parsed all pointing to i686, while system still tells the
story of x86_64.

Inconsistent arguments can also be given when passing "parsed" directly.
This happened in stage.nix for the various package sets.

The solution is simple: One of the three arguments needs to be treated
as the ultimate source of truth.  "system" can already be losslessly
extracted from "parsed".  However, "config" currently can not, for
example for various -mingw32 cases.  Thus everything must be derived
from "config".

To do so, "system" and "parsed" arguments are made non-overrideable for
systems.elaborate.  This means, that "system" will be used to parse when
"config" is not given - and "parsed" will be ignored entirely.

The systemToAttrs helper is exposed on lib.systems, because it's useful
to deal with top-level localSystem / crossSystem arguments elsewhere.
---
 lib/systems/default.nix  | 23 +++++++++++++++++------
 lib/tests/systems.nix    | 12 ++++++++++++
 pkgs/top-level/stage.nix | 15 ++++++++-------
 3 files changed, 37 insertions(+), 13 deletions(-)

diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index a6ceef2cc3a1..d682eb815003 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -6,9 +6,9 @@ let
     filterAttrs
     foldl
     hasInfix
+    isAttrs
     isFunction
     isList
-    isString
     mapAttrs
     optional
     optionalAttrs
@@ -55,24 +55,34 @@ let
   */
   flakeExposed = import ./flake-systems.nix { };
 
+  # Turn localSystem or crossSystem, which could be system-string or attrset, into
+  # attrset.
+  systemToAttrs = systemOrArgs:
+    if isAttrs systemOrArgs then systemOrArgs else { system = systemOrArgs; };
+
   # Elaborate a `localSystem` or `crossSystem` so that it contains everything
   # necessary.
   #
   # `parsed` is inferred from args, both because there are two options with one
   # clearly preferred, and to prevent cycles. A simpler fixed point where the RHS
   # always just used `final.*` would fail on both counts.
-  elaborate = args': let
-    args = if isString args' then { system = args'; }
-           else args';
+  elaborate = systemOrArgs: let
+    allArgs = systemToAttrs systemOrArgs;
+
+    # Those two will always be derived from "config", if given, so they should NOT
+    # be overridden further down with "// args".
+    args = builtins.removeAttrs allArgs [ "parsed" "system" ];
 
     # TODO: deprecate args.rustc in favour of args.rust after 23.05 is EOL.
     rust = args.rust or args.rustc or {};
 
     final = {
       # Prefer to parse `config` as it is strictly more informative.
-      parsed = parse.mkSystemFromString (if args ? config then args.config else args.system);
-      # Either of these can be losslessly-extracted from `parsed` iff parsing succeeds.
+      parsed = parse.mkSystemFromString (args.config or allArgs.system);
+      # This can be losslessly-extracted from `parsed` iff parsing succeeds.
       system = parse.doubleFromSystem final.parsed;
+      # TODO: This currently can't be losslessly-extracted from `parsed`, for example
+      # because of -mingw32.
       config = parse.tripleFromSystem final.parsed;
       # Determine whether we can execute binaries built for the provided platform.
       canExecute = platform:
@@ -435,5 +445,6 @@ in
     inspect
     parse
     platforms
+    systemToAttrs
     ;
 }
diff --git a/lib/tests/systems.nix b/lib/tests/systems.nix
index f5e7bdd5b705..adba24814078 100644
--- a/lib/tests/systems.nix
+++ b/lib/tests/systems.nix
@@ -78,6 +78,18 @@ lib.runTests (
     expr = toLosslessStringMaybe (lib.systems.elaborate "x86_64-linux" // { something = "extra"; });
     expected = null;
   };
+  test_elaborate_config_over_system = {
+    expr = (lib.systems.elaborate { config = "i686-unknown-linux-gnu"; system = "x86_64-linux"; }).system;
+    expected = "i686-linux";
+  };
+  test_elaborate_config_over_parsed = {
+    expr = (lib.systems.elaborate { config = "i686-unknown-linux-gnu"; parsed = (lib.systems.elaborate "x86_64-linux").parsed; }).parsed.cpu.arch;
+    expected = "i686";
+  };
+  test_elaborate_system_over_parsed = {
+    expr = (lib.systems.elaborate { system = "i686-linux"; parsed = (lib.systems.elaborate "x86_64-linux").parsed; }).parsed.cpu.arch;
+    expected = "i686";
+  };
 }
 
 # Generate test cases to assert that a change in any non-function attribute makes a platform unequal
diff --git a/pkgs/top-level/stage.nix b/pkgs/top-level/stage.nix
index 265ab242d86d..78c22d4f70e2 100644
--- a/pkgs/top-level/stage.nix
+++ b/pkgs/top-level/stage.nix
@@ -246,7 +246,7 @@ let
       })] ++ overlays;
       ${if stdenv.hostPlatform == stdenv.buildPlatform
         then "localSystem" else "crossSystem"} = {
-        parsed = makeMuslParsedPlatform stdenv.hostPlatform.parsed;
+        config = lib.systems.parse.tripleFromSystem (makeMuslParsedPlatform stdenv.hostPlatform.parsed);
       };
     } else throw "Musl libc only supports 64-bit Linux systems.";
 
@@ -258,9 +258,9 @@ let
       })] ++ overlays;
       ${if stdenv.hostPlatform == stdenv.buildPlatform
         then "localSystem" else "crossSystem"} = {
-        parsed = stdenv.hostPlatform.parsed // {
+        config = lib.systems.parse.tripleFromSystem (stdenv.hostPlatform.parsed // {
           cpu = lib.systems.parse.cpuTypes.i686;
-        };
+        });
       };
     } else throw "i686 Linux package set can only be used with the x86 family.";
 
@@ -270,9 +270,9 @@ let
         pkgsx86_64Darwin = super';
       })] ++ overlays;
       localSystem = {
-        parsed = stdenv.hostPlatform.parsed // {
+        config = lib.systems.parse.tripleFromSystem (stdenv.hostPlatform.parsed // {
           cpu = lib.systems.parse.cpuTypes.x86_64;
-        };
+        });
       };
     } else throw "x86_64 Darwin package set can only be used on Darwin systems.";
 
@@ -311,10 +311,11 @@ let
       })] ++ overlays;
       crossSystem = {
         isStatic = true;
-        parsed =
+        config = lib.systems.parse.tripleFromSystem (
           if stdenv.hostPlatform.isLinux
           then makeMuslParsedPlatform stdenv.hostPlatform.parsed
-          else stdenv.hostPlatform.parsed;
+          else stdenv.hostPlatform.parsed
+        );
         gcc = lib.optionalAttrs (stdenv.hostPlatform.system == "powerpc64-linux") { abi = "elfv2"; } //
           stdenv.hostPlatform.gcc or {};
       };

From 696ff473788e14e9abd0b83d0261cbabc60e32b8 Mon Sep 17 00:00:00 2001
From: Jordan Williams <jordan@jwillikers.com>
Date: Mon, 25 Nov 2024 07:44:01 -0600
Subject: [PATCH 03/42] flatpak: set meta.mainProgram

---
 pkgs/by-name/fl/flatpak/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/fl/flatpak/package.nix b/pkgs/by-name/fl/flatpak/package.nix
index 4eec7288bf85..7d31297d22b2 100644
--- a/pkgs/by-name/fl/flatpak/package.nix
+++ b/pkgs/by-name/fl/flatpak/package.nix
@@ -265,6 +265,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/flatpak/flatpak/releases/tag/${finalAttrs.version}";
     license = lib.licenses.lgpl21Plus;
     maintainers = with lib.maintainers; [ getchoo ];
+    mainProgram = "flatpak";
     platforms = lib.platforms.linux;
   };
 })

From b683d90355077b91d6b5509cc1220c0ab399e250 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Tue, 26 Nov 2024 13:35:09 +0100
Subject: [PATCH 04/42] mutt: remove ? null from packages

there are bool flags to enable/disable certain features and overriding
packages with null is a hack which should not be used.
---
 pkgs/by-name/mu/mutt/package.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/mu/mutt/package.nix b/pkgs/by-name/mu/mutt/package.nix
index c45ff30e54d4..8cf62ff05dae 100644
--- a/pkgs/by-name/mu/mutt/package.nix
+++ b/pkgs/by-name/mu/mutt/package.nix
@@ -1,10 +1,10 @@
 { lib, stdenv, fetchurl, fetchpatch, ncurses, which, perl
-, gdbm ? null
-, openssl ? null
-, cyrus_sasl ? null
-, gnupg ? null
-, gpgme ? null
-, libkrb5 ? null
+, gdbm
+, openssl
+, cyrus_sasl
+, gnupg
+, gpgme
+, libkrb5
 , headerCache  ? true
 , sslSupport   ? true
 , saslSupport  ? true

From 6b75aa3623ac2c0d8fadba4576b8c312095b4f68 Mon Sep 17 00:00:00 2001
From: Francesco Carmelo Capria <francesco@capria.eu>
Date: Mon, 18 Nov 2024 18:22:05 +0100
Subject: [PATCH 05/42] hyprgui: 0.1.8 -> 0.1.9

---
 pkgs/by-name/hy/hyprgui/package.nix | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/hy/hyprgui/package.nix b/pkgs/by-name/hy/hyprgui/package.nix
index eb8a15e55e4f..5279bb71358d 100644
--- a/pkgs/by-name/hy/hyprgui/package.nix
+++ b/pkgs/by-name/hy/hyprgui/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hyprgui";
-  version = "0.1.8";
+  version = "0.1.9";
 
   src = fetchFromGitHub {
     owner = "hyprutils";
     repo = "hyprgui";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Bg1S/FhduRSSXc3Yd7SkyrmMKff7oh0jw781jTB0J60=";
+    hash = "sha256-VP+6qWu4nv8h9LLjTnl8Mh1aAlIA+zuufRYoouxl2Tc=";
   };
 
-  cargoHash = "sha256-bhtmU0vGptUYrPN/BbbSvSa27Ykma8UI6TS17eiQkyU=";
+  cargoHash = "sha256-t0HqraCA4q7K4EEtPS8J0ZmnhBB+Zf0aX+yXSUdKJzo=";
 
   strictDeps = true;
 
@@ -29,6 +29,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
     wrapGAppsHook4
   ];
+
   buildInputs = [
     glib
     cairo
@@ -36,9 +37,15 @@ rustPlatform.buildRustPackage rec {
     gtk4
   ];
 
+  prePatch = ''
+    substituteInPlace hyprgui.desktop \
+    --replace-fail "/usr/bin/" ""
+  '';
+
   postInstall = ''
     install -Dm644 -t $out/usr/share/icons hyprgui.png
     install -Dm644 -t $out/usr/share/applications hyprgui.desktop
+    install -Dm644 -t $out/usr/share/licenses/${pname} LICENSE
   '';
 
   meta = {

From 488fde7d06afb6972e6afd6abcd9164ba525fecd Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Tue, 26 Nov 2024 21:34:36 +0100
Subject: [PATCH 06/42] matrix-synapse: 1.119.0 -> 1.120.0

ChangeLog: https://github.com/element-hq/synapse/releases/tag/v1.120.0
---
 pkgs/servers/matrix-synapse/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index 2aae9ab84605..5ac40de5e569 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -17,20 +17,20 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.119.0";
+  version = "1.120.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "synapse";
     rev = "v${version}";
-    hash = "sha256-+3FrxSfQteIga5uiRNzAlV+xNESB9PUX/UkkL6UMETQ=";
+    hash = "sha256-3gPeit2r3q1WF72WUINS7gD8X9/DGQBmZYlUnaU7mvc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-c/19RaBmtfKkFFQyDBwH+yqHp4YNQSqCu23WYbpOc98=";
+    hash = "sha256-ceIRDYHKpkw/H+ts5dXb5s4Eb8btbt/yHqOYqepWG/s=";
   };
 
   postPatch = ''

From 6b0a1f812353447789441d0402612180950b471b Mon Sep 17 00:00:00 2001
From: Audrey Dutcher <audrey@rhelmot.io>
Date: Mon, 25 Nov 2024 21:52:24 -0700
Subject: [PATCH 07/42] freebsd.libc: break into many small derivations

---
 pkgs/os-specific/bsd/freebsd/package-set.nix  |  31 +-
 .../14.1/bsd-lib-mk-force-static.patch        |  81 ----
 .../patches/14.1/libelf-bootstrapping.patch   |  13 +
 .../bsd/freebsd/patches/14.1/mk.patch         | 154 ++++++++
 .../patches/14.1/rtld-elf-symlink.patch       |  13 +
 pkgs/os-specific/bsd/freebsd/pkgs/bin.nix     |   4 -
 .../bsd/freebsd/pkgs/compat/package.nix       |   2 +
 pkgs/os-specific/bsd/freebsd/pkgs/i18n.nix    |  20 +
 .../bsd/freebsd/pkgs/include/package.nix      |   1 -
 pkgs/os-specific/bsd/freebsd/pkgs/install.nix |  15 +-
 pkgs/os-specific/bsd/freebsd/pkgs/kldxref.nix |   6 +-
 pkgs/os-specific/bsd/freebsd/pkgs/ldd.nix     |   3 -
 .../bsd/freebsd/pkgs/libc/package.nix         | 347 +++---------------
 .../bsd/freebsd/pkgs/libcMinimal.nix          |  92 +++++
 .../os-specific/bsd/freebsd/pkgs/libcrypt.nix |  37 ++
 .../os-specific/bsd/freebsd/pkgs/libcxxrt.nix |  18 +-
 .../bsd/freebsd/pkgs/libdevstat.nix           |  44 +++
 pkgs/os-specific/bsd/freebsd/pkgs/libdl.nix   |  31 +-
 pkgs/os-specific/bsd/freebsd/pkgs/libelf.nix  |  42 ++-
 .../bsd/freebsd/pkgs/libexecinfo.nix          |  36 ++
 pkgs/os-specific/bsd/freebsd/pkgs/libgcc.nix  |  49 +++
 .../bsd/freebsd/pkgs/libiconvModules.nix      |  32 ++
 pkgs/os-specific/bsd/freebsd/pkgs/libkvm.nix  |  36 ++
 pkgs/os-specific/bsd/freebsd/pkgs/libmd.nix   | 104 ++++--
 .../bsd/freebsd/pkgs/libmemstat.nix           |  31 ++
 .../bsd/freebsd/pkgs/libnetbsd/package.nix    |   2 +
 .../bsd/freebsd/pkgs/libprocstat.nix          |  42 +++
 .../bsd/freebsd/pkgs/libradius.nix            |   2 -
 .../bsd/freebsd/pkgs/librpcsvc.nix            |  30 ++
 pkgs/os-specific/bsd/freebsd/pkgs/librt.nix   |  36 ++
 pkgs/os-specific/bsd/freebsd/pkgs/libsbuf.nix |   2 +-
 .../bsd/freebsd/pkgs/libssp_nonshared.nix     |  15 +
 pkgs/os-specific/bsd/freebsd/pkgs/libthr.nix  |  36 ++
 pkgs/os-specific/bsd/freebsd/pkgs/libutil.nix |  29 +-
 .../bsd/freebsd/pkgs/mkDerivation.nix         |  19 +
 pkgs/os-specific/bsd/freebsd/pkgs/msun.nix    |  34 ++
 pkgs/os-specific/bsd/freebsd/pkgs/mtree.nix   |  18 +-
 .../bsd/freebsd/pkgs/rpcgen/package.nix       |   1 -
 .../os-specific/bsd/freebsd/pkgs/rtld-elf.nix |  58 +++
 39 files changed, 1093 insertions(+), 473 deletions(-)
 delete mode 100644 pkgs/os-specific/bsd/freebsd/patches/14.1/bsd-lib-mk-force-static.patch
 create mode 100644 pkgs/os-specific/bsd/freebsd/patches/14.1/libelf-bootstrapping.patch
 create mode 100644 pkgs/os-specific/bsd/freebsd/patches/14.1/mk.patch
 create mode 100644 pkgs/os-specific/bsd/freebsd/patches/14.1/rtld-elf-symlink.patch
 create mode 100644 pkgs/os-specific/bsd/freebsd/pkgs/i18n.nix
 create mode 100644 pkgs/os-specific/bsd/freebsd/pkgs/libcMinimal.nix
 create mode 100644 pkgs/os-specific/bsd/freebsd/pkgs/libcrypt.nix
 create mode 100644 pkgs/os-specific/bsd/freebsd/pkgs/libdevstat.nix
 create mode 100644 pkgs/os-specific/bsd/freebsd/pkgs/libexecinfo.nix
 create mode 100644 pkgs/os-specific/bsd/freebsd/pkgs/libgcc.nix
 create mode 100644 pkgs/os-specific/bsd/freebsd/pkgs/libiconvModules.nix
 create mode 100644 pkgs/os-specific/bsd/freebsd/pkgs/libkvm.nix
 create mode 100644 pkgs/os-specific/bsd/freebsd/pkgs/libmemstat.nix
 create mode 100644 pkgs/os-specific/bsd/freebsd/pkgs/libprocstat.nix
 create mode 100644 pkgs/os-specific/bsd/freebsd/pkgs/librpcsvc.nix
 create mode 100644 pkgs/os-specific/bsd/freebsd/pkgs/librt.nix
 create mode 100644 pkgs/os-specific/bsd/freebsd/pkgs/libssp_nonshared.nix
 create mode 100644 pkgs/os-specific/bsd/freebsd/pkgs/libthr.nix
 create mode 100644 pkgs/os-specific/bsd/freebsd/pkgs/msun.nix
 create mode 100644 pkgs/os-specific/bsd/freebsd/pkgs/rtld-elf.nix

diff --git a/pkgs/os-specific/bsd/freebsd/package-set.nix b/pkgs/os-specific/bsd/freebsd/package-set.nix
index 657334370e51..ee6480a660be 100644
--- a/pkgs/os-specific/bsd/freebsd/package-set.nix
+++ b/pkgs/os-specific/bsd/freebsd/package-set.nix
@@ -8,6 +8,7 @@
   buildFreebsd,
   patchesRoot,
   writeText,
+  buildPackages,
 }:
 
 self:
@@ -64,16 +65,32 @@ lib.packagesFromDirectoryRecursive {
     inherit (self) libmd libnetbsd;
   };
 
-  libc = self.callPackage ./pkgs/libc/package.nix {
+  libcMinimal = self.callPackage ./pkgs/libcMinimal.nix {
     inherit (buildFreebsd)
-      makeMinimal
-      install
-      gencat
       rpcgen
-      mkcsmapper
-      mkesdb
+      gencat
       ;
-    inherit (self) csu include;
+    inherit (buildPackages)
+      flex
+      byacc
+      ;
+  };
+
+  libc = self.callPackage ./pkgs/libc/package.nix {
+    inherit (self) libcMinimal librpcsvc libelf;
+  };
+
+  librpcsvc = self.callPackage ./pkgs/librpcsvc.nix {
+    inherit (buildFreebsd) rpcgen;
+  };
+
+  i18n = self.callPackage ./pkgs/i18n.nix { inherit (buildFreebsd) mkcsmapper mkesdb; };
+
+  libelf = self.callPackage ./pkgs/libelf.nix { inherit (buildPackages) m4; };
+
+  rtld-elf = self.callPackage ./pkgs/rtld-elf.nix {
+    inherit (buildFreebsd) rpcgen;
+    inherit (buildPackages) flex byacc;
   };
 
   libnetbsd = self.callPackage ./pkgs/libnetbsd/package.nix { inherit (buildFreebsd) makeMinimal; };
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.1/bsd-lib-mk-force-static.patch b/pkgs/os-specific/bsd/freebsd/patches/14.1/bsd-lib-mk-force-static.patch
deleted file mode 100644
index 04446ce32b5e..000000000000
--- a/pkgs/os-specific/bsd/freebsd/patches/14.1/bsd-lib-mk-force-static.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-From 197b10de54b53a089ad549f2e00787b4fa719210 Mon Sep 17 00:00:00 2001
-From: Artemis Tosini <me@artem.ist>
-Date: Sat, 2 Nov 2024 07:50:13 +0000
-Subject: [PATCH] HACK: bsd.lib.mk: Treat empty SHLIB_NAME as nonexistant
-
-Unsetting SHLIB_NAME in nix package definitions is a pain
-but we can easily set it to be empty. This is useful when
-building static libraries without unneeded static libraries.
----
- share/mk/bsd.lib.mk | 14 +++++++-------
- 1 file changed, 7 insertions(+), 7 deletions(-)
-
-diff --git a/share/mk/bsd.lib.mk b/share/mk/bsd.lib.mk
-index 5f328d5378ca..89d16dc6fa41 100644
---- a/share/mk/bsd.lib.mk
-+++ b/share/mk/bsd.lib.mk
-@@ -242,7 +242,7 @@ PO_FLAG=-pg
- _LIBDIR:=${LIBDIR}
- _SHLIBDIR:=${SHLIBDIR}
- 
--.if defined(SHLIB_NAME)
-+.if defined(SHLIB_NAME) && !empty(SHLIB_NAME)
- .if ${MK_DEBUG_FILES} != "no"
- SHLIB_NAME_FULL=${SHLIB_NAME}.full
- # Use ${DEBUGDIR} for base system debug files, else .debug subdirectory
-@@ -277,7 +277,7 @@ LDFLAGS+=	-Wl,--undefined-version
- .endif
- .endif
- 
--.if defined(LIB) && !empty(LIB) || defined(SHLIB_NAME)
-+.if defined(LIB) && !empty(LIB) || (defined(SHLIB_NAME) && !empty(SHLIB_NAME))
- OBJS+=		${SRCS:N*.h:${OBJS_SRCS_FILTER:ts:}:S/$/.o/}
- BCOBJS+=	${SRCS:N*.[hsS]:N*.asm:${OBJS_SRCS_FILTER:ts:}:S/$/.bco/g}
- LLOBJS+=	${SRCS:N*.[hsS]:N*.asm:${OBJS_SRCS_FILTER:ts:}:S/$/.llo/g}
-@@ -320,14 +320,14 @@ lib${LIB_PRIVATE}${LIB}.ll: ${LLOBJS}
- CLEANFILES+=	lib${LIB_PRIVATE}${LIB}.bc lib${LIB_PRIVATE}${LIB}.ll
- .endif
- 
--.if defined(SHLIB_NAME) || \
-+.if (defined(SHLIB_NAME) && !empty(SHLIB_NAME)) || \
-     defined(INSTALL_PIC_ARCHIVE) && defined(LIB) && !empty(LIB)
- SOBJS+=		${OBJS:.o=.pico}
- DEPENDOBJS+=	${SOBJS}
- CLEANFILES+=	${SOBJS}
- .endif
- 
--.if defined(SHLIB_NAME)
-+.if defined(SHLIB_NAME) && !empty(SHLIB_NAME)
- _LIBS+=		${SHLIB_NAME}
- 
- SOLINKOPTS+=	-shared -Wl,-x
-@@ -435,7 +435,7 @@ all: all-man
- CLEANFILES+=	${_LIBS}
- 
- _EXTRADEPEND:
--.if !defined(NO_EXTRADEPEND) && defined(SHLIB_NAME)
-+.if !defined(NO_EXTRADEPEND) && defined(SHLIB_NAME) && !empty(SHLIB_NAME)
- .if defined(DPADD) && !empty(DPADD)
- 	echo ${SHLIB_NAME_FULL}: ${DPADD} >> ${DEPENDFILE}
- .endif
-@@ -501,7 +501,7 @@ _libinstall:
- 	    ${_INSTALLFLAGS} lib${LIB_PRIVATE}${LIB}_p.a ${DESTDIR}${_LIBDIR}/
- .endif
- .endif
--.if defined(SHLIB_NAME)
-+.if defined(SHLIB_NAME) && !empty(SHLIB_NAME)
- 	${INSTALL} ${TAG_ARGS} ${STRIP} -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \
- 	    ${_INSTALLFLAGS} ${_SHLINSTALLFLAGS} \
- 	    ${SHLIB_NAME} ${DESTDIR}${_SHLIBDIR}/
-@@ -588,7 +588,7 @@ OBJS_DEPEND_GUESS+= ${SRCS:M*.h}
- OBJS_DEPEND_GUESS.${_S:${OBJS_SRCS_FILTER:ts:}}.po+=	${_S}
- .endfor
- .endif
--.if defined(SHLIB_NAME) || \
-+.if (defined(SHLIB_NAME) && !empty(SHLIB_NAME)) || \
-     defined(INSTALL_PIC_ARCHIVE) && defined(LIB) && !empty(LIB)
- .for _S in ${SRCS:N*.[hly]}
- OBJS_DEPEND_GUESS.${_S:${OBJS_SRCS_FILTER:ts:}}.pico+=	${_S}
--- 
-2.46.1
-
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.1/libelf-bootstrapping.patch b/pkgs/os-specific/bsd/freebsd/patches/14.1/libelf-bootstrapping.patch
new file mode 100644
index 000000000000..96c509b290a0
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.1/libelf-bootstrapping.patch
@@ -0,0 +1,13 @@
+diff --git a/lib/libelf/Makefile b/lib/libelf/Makefile
+index c15ce2798a91..d6d8754e2b4f 100644
+--- a/lib/libelf/Makefile
++++ b/lib/libelf/Makefile
+@@ -80,7 +80,7 @@ INCS=		libelf.h gelf.h
+ SRCS+=	sys/elf32.h sys/elf64.h sys/elf_common.h
+ 
+ # Allow bootstrapping elftoolchain on Linux:
+-.if defined(BOOTSTRAPPING) && ${.MAKE.OS} == "Linux"
++.if defined(BOOTSTRAPPING)
+ native-elf-format.h:
+ 	${ELFTCDIR}/common/native-elf-format > ${.TARGET} || rm ${.TARGET}
+ SRCS+=	native-elf-format.h
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.1/mk.patch b/pkgs/os-specific/bsd/freebsd/patches/14.1/mk.patch
new file mode 100644
index 000000000000..51f772ded2ee
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.1/mk.patch
@@ -0,0 +1,154 @@
+diff --git a/share/mk/bsd.incs.mk b/share/mk/bsd.incs.mk
+index df4cf4641141..a87c7f9db03a 100644
+--- a/share/mk/bsd.incs.mk
++++ b/share/mk/bsd.incs.mk
+@@ -63,8 +63,8 @@ stage_includes: stage_as.${header:T}
+ 
+ installincludes: _${group}INS_${header:T}
+ _${group}INS_${header:T}: ${header}
+-	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -C -o ${${group}OWN_${.ALLSRC:T}} \
+-	    -g ${${group}GRP_${.ALLSRC:T}} -m ${${group}MODE_${.ALLSRC:T}} \
++	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -C \
++	    -m ${${group}MODE_${.ALLSRC:T}} \
+ 	    ${.ALLSRC} \
+ 	    ${DESTDIR}${${group}DIR_${.ALLSRC:T}}/${${group}NAME_${.ALLSRC:T}}
+ .else
+@@ -78,10 +78,10 @@ stage_includes: stage_files.${group}
+ installincludes: _${group}INS
+ _${group}INS: ${_${group}INCS}
+ .if defined(${group}NAME)
+-	${INSTALL} ${${group}TAG_ARGS} -C -o ${${group}OWN} -g ${${group}GRP} -m ${${group}MODE} \
++	${INSTALL} ${${group}TAG_ARGS} -C -m ${${group}MODE} \
+ 	    ${.ALLSRC} ${DESTDIR}${${group}DIR}/${${group}NAME}
+ .else
+-	${INSTALL} ${${group}TAG_ARGS} -C -o ${${group}OWN} -g ${${group}GRP} -m ${${group}MODE} \
++	${INSTALL} ${${group}TAG_ARGS} -C -m ${${group}MODE} \
+ 	    ${.ALLSRC} ${DESTDIR}${${group}DIR}/
+ .endif
+ .endif # !empty(_${group}INCS)
+diff --git a/share/mk/bsd.lib.mk b/share/mk/bsd.lib.mk
+index 5f328d5378ca..264bbcc84ffb 100644
+--- a/share/mk/bsd.lib.mk
++++ b/share/mk/bsd.lib.mk
+@@ -242,7 +242,7 @@ PO_FLAG=-pg
+ _LIBDIR:=${LIBDIR}
+ _SHLIBDIR:=${SHLIBDIR}
+ 
+-.if defined(SHLIB_NAME)
++.if defined(SHLIB_NAME) && !empty(SHLIB_NAME)
+ .if ${MK_DEBUG_FILES} != "no"
+ SHLIB_NAME_FULL=${SHLIB_NAME}.full
+ # Use ${DEBUGDIR} for base system debug files, else .debug subdirectory
+@@ -277,7 +277,7 @@ LDFLAGS+=	-Wl,--undefined-version
+ .endif
+ .endif
+ 
+-.if defined(LIB) && !empty(LIB) || defined(SHLIB_NAME)
++.if defined(LIB) && !empty(LIB) || (defined(SHLIB_NAME) && !empty(SHLIB_NAME))
+ OBJS+=		${SRCS:N*.h:${OBJS_SRCS_FILTER:ts:}:S/$/.o/}
+ BCOBJS+=	${SRCS:N*.[hsS]:N*.asm:${OBJS_SRCS_FILTER:ts:}:S/$/.bco/g}
+ LLOBJS+=	${SRCS:N*.[hsS]:N*.asm:${OBJS_SRCS_FILTER:ts:}:S/$/.llo/g}
+@@ -320,14 +320,14 @@ lib${LIB_PRIVATE}${LIB}.ll: ${LLOBJS}
+ CLEANFILES+=	lib${LIB_PRIVATE}${LIB}.bc lib${LIB_PRIVATE}${LIB}.ll
+ .endif
+ 
+-.if defined(SHLIB_NAME) || \
++.if (defined(SHLIB_NAME) && !empty(SHLIB_NAME)) || \
+     defined(INSTALL_PIC_ARCHIVE) && defined(LIB) && !empty(LIB)
+ SOBJS+=		${OBJS:.o=.pico}
+ DEPENDOBJS+=	${SOBJS}
+ CLEANFILES+=	${SOBJS}
+ .endif
+ 
+-.if defined(SHLIB_NAME)
++.if defined(SHLIB_NAME) && !empty(SHLIB_NAME)
+ _LIBS+=		${SHLIB_NAME}
+ 
+ SOLINKOPTS+=	-shared -Wl,-x
+@@ -435,7 +435,7 @@ all: all-man
+ CLEANFILES+=	${_LIBS}
+ 
+ _EXTRADEPEND:
+-.if !defined(NO_EXTRADEPEND) && defined(SHLIB_NAME)
++.if !defined(NO_EXTRADEPEND) && defined(SHLIB_NAME) && !empty(SHLIB_NAME)
+ .if defined(DPADD) && !empty(DPADD)
+ 	echo ${SHLIB_NAME_FULL}: ${DPADD} >> ${DEPENDFILE}
+ .endif
+@@ -482,7 +482,7 @@ _SHLINSTALLFLAGS:=	${_SHLINSTALLFLAGS${ie}}
+ installpcfiles: installpcfiles-${pcfile}
+ 
+ installpcfiles-${pcfile}: ${pcfile}
+-	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \
++	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -m ${LIBMODE} \
+ 	    ${_INSTALLFLAGS} \
+ 	    ${.ALLSRC} ${DESTDIR}${LIBDATADIR}/pkgconfig/
+ .endfor
+@@ -494,28 +494,28 @@ realinstall: _libinstall installpcfiles
+ .ORDER: beforeinstall _libinstall
+ _libinstall:
+ .if defined(LIB) && !empty(LIB) && ${MK_INSTALLLIB} != "no"
+-	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \
++	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -m ${LIBMODE} \
+ 	    ${_INSTALLFLAGS} lib${LIB_PRIVATE}${LIB}${_STATICLIB_SUFFIX}.a ${DESTDIR}${_LIBDIR}/
+ .if ${MK_PROFILE} != "no"
+-	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \
++	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -m ${LIBMODE} \
+ 	    ${_INSTALLFLAGS} lib${LIB_PRIVATE}${LIB}_p.a ${DESTDIR}${_LIBDIR}/
+ .endif
+ .endif
+-.if defined(SHLIB_NAME)
+-	${INSTALL} ${TAG_ARGS} ${STRIP} -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \
++.if defined(SHLIB_NAME) && !empty(SHLIB_NAME)
++	${INSTALL} ${TAG_ARGS} ${STRIP} -m ${LIBMODE} \
+ 	    ${_INSTALLFLAGS} ${_SHLINSTALLFLAGS} \
+ 	    ${SHLIB_NAME} ${DESTDIR}${_SHLIBDIR}/
+ .if ${MK_DEBUG_FILES} != "no"
+ .if defined(DEBUGMKDIR)
+ 	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dbg} -d ${DESTDIR}${DEBUGFILEDIR}/
+ .endif
+-	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dbg} -o ${LIBOWN} -g ${LIBGRP} -m ${DEBUGMODE} \
++	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dbg} -m ${DEBUGMODE} \
+ 	    ${_INSTALLFLAGS} \
+ 	    ${SHLIB_NAME}.debug ${DESTDIR}${DEBUGFILEDIR}/
+ .endif
+ .if defined(SHLIB_LINK)
+ .if commands(${SHLIB_LINK:R}.ld)
+-	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -S -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \
++	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -S -m ${LIBMODE} \
+ 	    ${_INSTALLFLAGS} ${SHLIB_LINK:R}.ld \
+ 	    ${DESTDIR}${_LIBDIR}/${SHLIB_LINK}
+ .for _SHLIB_LINK_LINK in ${SHLIB_LDSCRIPT_LINKS}
+@@ -548,7 +548,7 @@ _libinstall:
+ .endif # SHLIB_LINK
+ .endif # SHIB_NAME
+ .if defined(INSTALL_PIC_ARCHIVE) && defined(LIB) && !empty(LIB)
+-	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \
++	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},dev} -m ${LIBMODE} \
+ 	    ${_INSTALLFLAGS} lib${LIB}_pic.a ${DESTDIR}${_LIBDIR}/
+ .endif
+ .endif # !defined(INTERNALLIB)
+@@ -588,7 +588,7 @@ OBJS_DEPEND_GUESS+= ${SRCS:M*.h}
+ OBJS_DEPEND_GUESS.${_S:${OBJS_SRCS_FILTER:ts:}}.po+=	${_S}
+ .endfor
+ .endif
+-.if defined(SHLIB_NAME) || \
++.if (defined(SHLIB_NAME) && !empty(SHLIB_NAME)) || \
+     defined(INSTALL_PIC_ARCHIVE) && defined(LIB) && !empty(LIB)
+ .for _S in ${SRCS:N*.[hly]}
+ OBJS_DEPEND_GUESS.${_S:${OBJS_SRCS_FILTER:ts:}}.pico+=	${_S}
+diff --git a/share/mk/bsd.man.mk b/share/mk/bsd.man.mk
+index 04316c46b705..9ad3c8ce70e7 100644
+--- a/share/mk/bsd.man.mk
++++ b/share/mk/bsd.man.mk
+@@ -50,9 +50,9 @@
+ .endif
+ 
+ .if ${MK_MANSPLITPKG} == "no"
+-MINSTALL?=	${INSTALL} ${TAG_ARGS} -o ${MANOWN} -g ${MANGRP} -m ${MANMODE}
++MINSTALL?=	${INSTALL} ${TAG_ARGS} -m ${MANMODE}
+ .else
+-MINSTALL?=	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},man} -o ${MANOWN} -g ${MANGRP} -m ${MANMODE}
++MINSTALL?=	${INSTALL} ${TAG_ARGS:D${TAG_ARGS},man} -m ${MANMODE}
+ .endif
+ 
+ CATDIR=		${MANDIR:H:S/$/\/cat/}
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.1/rtld-elf-symlink.patch b/pkgs/os-specific/bsd/freebsd/patches/14.1/rtld-elf-symlink.patch
new file mode 100644
index 000000000000..d23cc82db932
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.1/rtld-elf-symlink.patch
@@ -0,0 +1,13 @@
+diff --git a/libexec/rtld-elf/Makefile b/libexec/rtld-elf/Makefile
+index 0dbd2b8aa935..241d7a78e208 100644
+--- a/libexec/rtld-elf/Makefile
++++ b/libexec/rtld-elf/Makefile
+@@ -54,7 +54,7 @@ NO_WCAST_ALIGN=	yes
+ INSTALLFLAGS=	-C -b
+ PRECIOUSPROG=
+ BINDIR=		/libexec
+-SYMLINKS=	../..${BINDIR}/${PROG} ${LIBEXECDIR}/${PROG}
++SYMLINKS=	${BINDIR}/${PROG} ${LIBEXECDIR}/${PROG}
+ MLINKS?=	rtld.1 ld-elf.so.1.1 \
+ 		rtld.1 ld.so.1
+ 
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/bin.nix b/pkgs/os-specific/bsd/freebsd/pkgs/bin.nix
index 2b2738ec5794..27cd34d9e935 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/bin.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/bin.nix
@@ -2,11 +2,9 @@
   mkDerivation,
   pkgsBuildBuild,
   libjail,
-  libmd,
   libnetbsd,
   libcapsicum,
   libcasper,
-  libelf,
   libxo,
   libncurses-tinfo,
   libedit,
@@ -36,11 +34,9 @@ mkDerivation {
   ];
   buildInputs = [
     libjail
-    libmd
     libnetbsd
     libcapsicum
     libcasper
-    libelf
     libxo
     libncurses-tinfo
     libedit
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/compat/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/compat/package.nix
index 941e0537aef8..961b31d0720a 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/compat/package.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/compat/package.nix
@@ -174,4 +174,6 @@ mkDerivation {
   # build build-time dependencies for building FreeBSD packages). It is
   # not needed when building for FreeBSD.
   meta.broken = stdenv.hostPlatform.isFreeBSD;
+
+  alwaysKeepStatic = true;
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/i18n.nix b/pkgs/os-specific/bsd/freebsd/pkgs/i18n.nix
new file mode 100644
index 000000000000..f51edf4e861a
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/i18n.nix
@@ -0,0 +1,20 @@
+{
+  mkDerivation,
+  mkcsmapper,
+  mkesdb,
+}:
+
+mkDerivation {
+  path = "share/i18n";
+
+  noLibc = true;
+
+  extraNativeBuildInputs = [
+    mkcsmapper
+    mkesdb
+  ];
+
+  preBuild = ''
+    export makeFlags="$makeFlags ESDBDIR=$out/share/i18n/esdb CSMAPPERDIR=$out/share/i18n/csmapper"
+  '';
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/include/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/include/package.nix
index a4a364459daa..1119bdd35d89 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/include/package.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/include/package.nix
@@ -1,5 +1,4 @@
 {
-  stdenv,
   lib,
   mkDerivation,
   buildPackages,
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/install.nix b/pkgs/os-specific/bsd/freebsd/pkgs/install.nix
index b8e59adb09c5..aab60480ec7a 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/install.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/install.nix
@@ -26,6 +26,9 @@ let
       @out@/bin/xinstall "''${args[@]}"
     ''
   );
+  libmd' = libmd.override {
+    bootstrapInstallation = true;
+  };
 in
 mkDerivation {
   path = "usr.bin/xinstall";
@@ -39,10 +42,14 @@ mkDerivation {
     (if stdenv.hostPlatform == stdenv.buildPlatform then boot-install else install)
   ];
   skipIncludesPhase = true;
-  buildInputs = compatIfNeeded ++ [
-    libmd
-    libnetbsd
-  ];
+  buildInputs =
+    compatIfNeeded
+    ++ lib.optionals (!stdenv.hostPlatform.isFreeBSD) [
+      libmd'
+    ]
+    ++ [
+      libnetbsd
+    ];
   makeFlags =
     [
       "STRIP=-s" # flag to install, not command
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/kldxref.nix b/pkgs/os-specific/bsd/freebsd/pkgs/kldxref.nix
index 6c930a51db88..fd092950b2da 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/kldxref.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/kldxref.nix
@@ -1,12 +1,14 @@
 {
+  lib,
+  stdenv,
   mkDerivation,
-  libelf,
   compatIfNeeded,
+  libelf,
 }:
 mkDerivation {
   path = "usr.sbin/kldxref";
 
-  buildInputs = [ libelf ] ++ compatIfNeeded;
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isFreeBSD) [ libelf ] ++ compatIfNeeded;
 
   # We symlink in our modules, make it follow symlinks
   postPatch = ''
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/ldd.nix b/pkgs/os-specific/bsd/freebsd/pkgs/ldd.nix
index 406e37402b2b..cc0f7ed2cdb2 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/ldd.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/ldd.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   mkDerivation,
-  libelf,
 }:
 mkDerivation {
   path = "usr.bin/ldd";
@@ -11,8 +10,6 @@ mkDerivation {
     "contrib/elftoolchain/libelf"
   ];
 
-  buildInputs = [ libelf ];
-
   env = {
     NIX_CFLAGS_COMPILE = "-D_RTLD_PATH=${lib.getLib stdenv.cc.libc}/libexec/ld-elf.so.1";
   };
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libc/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libc/package.nix
index 74e01d2be716..ec6aa033959b 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libc/package.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libc/package.nix
@@ -1,303 +1,56 @@
 {
-  lib,
-  buildPackages,
-  stdenv,
-  mkDerivation,
-
-  bsdSetupHook,
-  freebsdSetupHook,
-  makeMinimal,
-  install,
-  flex,
-  byacc,
-  gencat,
-  rpcgen,
-  mkcsmapper,
-  mkesdb,
-
-  csu,
+  symlinkJoin,
   include,
-  versionData,
-}:
-
-mkDerivation {
-  noLibc = true;
-  pname = "libc";
-  path = "lib/libc";
-  extraPaths =
-    [
-      "lib/libc_nonshared"
-      "etc/group"
-      "etc/master.passwd"
-      "etc/shells"
-      "lib/libmd"
-      "lib/libutil"
-      "lib/msun"
-      "sys/kern"
-      "sys/libkern"
-      "sys/sys"
-      "sys/crypto/chacha20"
-      "include/rpcsvc"
-      "contrib/jemalloc"
-      "contrib/gdtoa"
-      "contrib/libc-pwcache"
-      "contrib/libc-vis"
-    ]
-    ++ lib.optionals (versionData.major == 13) [ "contrib/tzcode/stdtime" ]
-    ++ lib.optionals (versionData.major >= 14) [ "contrib/tzcode" ]
-    ++ [
-
-      # libthr
-      "lib/libthr"
-      "lib/libthread_db"
-      "libexec/rtld-elf"
-      "lib/csu/common/crtbrand.S"
-      "lib/csu/common/notes.h"
-
-      # librpcsvc
-      "lib/librpcsvc"
-
-      # librt
-      "lib/librt"
-
-      # libcrypt
-      "lib/libcrypt"
-      "lib/libmd"
-      "sys/crypto/sha2"
-      "sys/crypto/skein"
-
-      # libgcc and friends
-      "lib/libgcc_eh"
-      "lib/libgcc_s"
-      "lib/libcompiler_rt"
-      "contrib/llvm-project/libunwind"
-      "contrib/llvm-project/compiler-rt"
-      #"contrib/llvm-project/libcxx"
-
-      # terminfo
-      "lib/ncurses"
-      "contrib/ncurses"
-      "lib/Makefile.inc"
-    ]
-    ++ lib.optionals (stdenv.hostPlatform.isx86_32) [ "lib/libssp_nonshared" ]
-    ++ [
-      "lib/libexecinfo"
-      "contrib/libexecinfo"
-
-      "lib/libkvm"
-      "sys" # ummmmmmmmmm libkvm wants arch-specific headers from the kernel tree
-
-      "lib/libmemstat"
-
-      "lib/libprocstat"
-      "sys/contrib/openzfs"
-      "sys/contrib/pcg-c"
-      "sys/opencrypto"
-      "sys/contrib/ck"
-      "sys/crypto"
-
-      "lib/libdevstat"
-
-      "lib/libelf"
-      "contrib/elftoolchain"
-
-      "lib/libiconv_modules"
-      "share/i18n"
-      "include/paths.h"
-
-      "lib/libdl"
-
-      # Used for aarch64-freebsd
-      "contrib/arm-optimized-routines"
-    ];
-
-  postPatch = ''
-    substituteInPlace $COMPONENT_PATH/Makefile --replace '.include <src.opts.mk>' ""
-
-    substituteInPlace $BSDSRCDIR/include/paths.h \
-        --replace '/usr/lib/i18n' '${builtins.placeholder "out"}/lib/i18n' \
-        --replace '/usr/share/i18n' '${builtins.placeholder "out"}/share/i18n'
-  '';
-
-  # NIX_CFLAGS_LINK is empty at this point except when building static,
-  # in which case the stdenv adapter adds the `-static` flag.
-  # Building with `-static` set causes linker errors.
-  postConfigure = ''
-    export NIX_CFLAGS_LINK=
-  '';
-
-  nativeBuildInputs = [
-    bsdSetupHook
-    freebsdSetupHook
-    makeMinimal
-    install
-
-    flex
-    byacc
-    gencat
-    rpcgen
-    mkcsmapper
-    mkesdb
-  ];
-  buildInputs = [
+  csu,
+  libcMinimal,
+  libssp_nonshared,
+  libgcc,
+  libmd,
+  libthr,
+  msun,
+  librpcsvc,
+  libutil,
+  librt,
+  libcrypt,
+  libelf,
+  libexecinfo,
+  libkvm,
+  libmemstat,
+  libprocstat,
+  libdevstat,
+  libiconvModules,
+  libdl,
+  i18n,
+  rtld-elf,
+  baseModules ? [
     include
     csu
-  ];
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-B${csu}/lib"
-    # These are supposed to have _RTLD_COMPAT_LIB_SUFFIX so we can get things like "lib32"
-    # but that's unnecessary
-    "-DSTANDARD_LIBRARY_PATH=\"${builtins.placeholder "out"}/lib\""
-    "-D_PATH_RTLD=\"${builtins.placeholder "out"}/libexec/ld-elf.so.1\""
-  ];
+    libcMinimal
+    libssp_nonshared
+    libgcc
+    libmd
+    libthr
+    msun
+    librpcsvc
+    libutil
+    librt
+    libcrypt
+    libelf
+    libexecinfo
+    libkvm
+    libmemstat
+    libprocstat
+    libdevstat
+    libiconvModules
+    libdl
+    i18n
+    rtld-elf
+  ],
+  extraModules ? [ ],
+}:
 
-  makeFlags = [
-    "STRIP=-s" # flag to install, not command
-    # lib/libc/gen/getgrent.c has sketchy cast from `void *` to enum
-    "MK_WERROR=no"
-  ];
-
-  MK_SYMVER = "yes";
-  MK_SSP = "yes";
-  MK_NLS = "yes";
-  MK_ICONV = "yes";
-  MK_NS_CACHING = "yes";
-  MK_INET6_SUPPORT = "yes";
-  MK_HESIOD = "yes";
-  MK_NIS = "yes";
-  MK_HYPERV = "yes";
-  MK_FP_LIBC = "yes";
-
-  MK_TCSH = "no";
-  MK_MALLOC_PRODUCTION = "yes";
-
-  MK_TESTS = "no";
-  MACHINE_ABI = "";
-  MK_DETECT_TZ_CHANGES = "no";
-  MK_MACHDEP_OPTIMIZATIONS = "yes";
-  MK_ASAN = "no";
-  MK_UBSAN = "no";
-
-  NO_FSCHG = "yes";
-
-  preBuild = lib.optionalString (stdenv.hostPlatform.isx86_32) ''
-    make -C $BSDSRCDIR/lib/libssp_nonshared $makeFlags
-    make -C $BSDSRCDIR/lib/libssp_nonshared $makeFlags install
-  '';
-
-  postInstall =
-    ''
-      pushd ${include}
-      find . -type d -exec mkdir -p $out/\{} \;
-      find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
-      popd
-
-      pushd ${csu}
-      find . -type d -exec mkdir -p $out/\{} \;
-      find . \( -type f -o -type l \) -exec cp -pr \{} $out/\{} \;
-      popd
-
-      mkdir $BSDSRCDIR/lib/libcompiler_rt/i386 $BSDSRCDIR/lib/libcompiler_rt/cpu_model
-      make -C $BSDSRCDIR/lib/libcompiler_rt $makeFlags
-      make -C $BSDSRCDIR/lib/libcompiler_rt $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libgcc_eh $makeFlags
-      make -C $BSDSRCDIR/lib/libgcc_eh $makeFlags install
-
-      ln -s $BSDSRCDIR/lib/libc/libc.so.7 $BSDSRCDIR/lib/libc/libc.so  # otherwise these dynamic libraries try to link with libc.a
-      mkdir $BSDSRCDIR/lib/libgcc_s/i386 $BSDSRCDIR/lib/libgcc_s/cpu_model
-      make -C $BSDSRCDIR/lib/libgcc_s $makeFlags
-      make -C $BSDSRCDIR/lib/libgcc_s $makeFlags install
-
-      NIX_CFLAGS_COMPILE+=" -B$out/lib"
-      NIX_CFLAGS_COMPILE+=" -I$out/include"
-      NIX_LDFLAGS+=" -L$out/lib"
-
-      make -C $BSDSRCDIR/lib/libc_nonshared $makeFlags
-      make -C $BSDSRCDIR/lib/libc_nonshared $makeFlags install
-
-      mkdir $BSDSRCDIR/lib/libmd/sys
-      make -C $BSDSRCDIR/lib/libmd $makeFlags
-      make -C $BSDSRCDIR/lib/libmd $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libthr $makeFlags
-      make -C $BSDSRCDIR/lib/libthr $makeFlags install
-
-      make -C $BSDSRCDIR/lib/msun $makeFlags
-      make -C $BSDSRCDIR/lib/msun $makeFlags install
-
-      make -C $BSDSRCDIR/lib/librpcsvc $makeFlags
-      make -C $BSDSRCDIR/lib/librpcsvc $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libutil $makeFlags
-      make -C $BSDSRCDIR/lib/libutil $makeFlags install
-
-      make -C $BSDSRCDIR/lib/librt $makeFlags
-      make -C $BSDSRCDIR/lib/librt $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libcrypt $makeFlags
-      make -C $BSDSRCDIR/lib/libcrypt $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libelf $makeFlags
-      make -C $BSDSRCDIR/lib/libelf $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libexecinfo $makeFlags
-      make -C $BSDSRCDIR/lib/libexecinfo $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libkvm $makeFlags
-      make -C $BSDSRCDIR/lib/libkvm $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libmemstat $makeFlags
-      make -C $BSDSRCDIR/lib/libmemstat $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libprocstat $makeFlags
-      make -C $BSDSRCDIR/lib/libprocstat $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libdevstat $makeFlags
-      make -C $BSDSRCDIR/lib/libdevstat $makeFlags install
-
-      make -C $BSDSRCDIR/lib/libiconv_modules $makeFlags
-      make -C $BSDSRCDIR/lib/libiconv_modules $makeFlags SHLIBDIR=${builtins.placeholder "out"}/lib/i18n install
-
-      make -C $BSDSRCDIR/lib/libdl $makeFlags
-      make -C $BSDSRCDIR/lib/libdl $makeFlags install
-
-      make -C $BSDSRCDIR/share/i18n $makeFlags
-      make -C $BSDSRCDIR/share/i18n $makeFlags ESDBDIR=${builtins.placeholder "out"}/share/i18n/esdb CSMAPPERDIR=${builtins.placeholder "out"}/share/i18n/csmapper install
-
-    ''
-    + lib.optionalString stdenv.hostPlatform.isx86_32 ''
-      $CC -c $BSDSRCDIR/contrib/llvm-project/compiler-rt/lib/builtins/udivdi3.c -o $BSDSRCDIR/contrib/llvm-project/compiler-rt/lib/builtins/udivdi3.o
-      ORIG_NIX_LDFLAGS="$NIX_LDFLAGS"
-      NIX_LDFLAGS+=" $BSDSRCDIR/contrib/llvm-project/compiler-rt/lib/builtins/udivdi3.o"
-    ''
-    + ''
-      make -C $BSDSRCDIR/libexec/rtld-elf $makeFlags
-      make -C $BSDSRCDIR/libexec/rtld-elf $makeFlags install
-      rm -f $out/libexec/ld-elf.so.1
-      mv $out/bin/ld-elf.so.1 $out/libexec
-    ''
-    + lib.optionalString (!stdenv.hostPlatform.isStatic) ''
-      mkdir $out/lib/keep_static
-      mv $out/lib/*_nonshared.a $out/lib/libgcc*.a $out/lib/libcompiler_rt.a $out/lib/keep_static
-      rm $out/lib/*.a
-      mv $out/lib/keep_static/* $out/lib
-      rmdir $out/lib/keep_static
-    '';
-
-  # libc should not be allowed to refer to anything other than itself
-  postFixup = ''
-    find $out -type f | xargs -n1 ${buildPackages.patchelf}/bin/patchelf --shrink-rpath --allowed-rpath-prefixes $out || true
-  '';
-
-  meta.platforms = lib.platforms.freebsd;
-
-  # definitely a bad idea to enable stack protection on the stack protection initializers
-  hardeningDisable = [ "stackprotector" ];
-
-  outputs = [
-    "out"
-    "man"
-    "debug"
-  ];
+symlinkJoin {
+  pname = "libc";
+  inherit (libcMinimal) version;
+  paths = baseModules ++ extraModules;
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libcMinimal.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libcMinimal.nix
new file mode 100644
index 000000000000..9da5df30df53
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libcMinimal.nix
@@ -0,0 +1,92 @@
+{
+  mkDerivation,
+  include,
+  rpcgen,
+  flex,
+  byacc,
+  gencat,
+  csu,
+}:
+
+mkDerivation {
+  pname = "libcMinimal";
+  path = "lib/libc";
+  extraPaths = [
+    "lib/libc_nonshared"
+    "lib/msun"
+    "lib/libmd"
+    "lib/libutil"
+    "libexec/rtld-elf"
+    "include/rpcsvc"
+    "contrib/libc-pwcache"
+    "contrib/libc-vis"
+    "contrib/tzcode"
+    "contrib/gdtoa"
+    "contrib/jemalloc"
+    "sys/sys"
+    "sys/kern"
+    "sys/libkern"
+    "sys/crypto"
+    "sys/opencrypto"
+    "etc/group"
+    "etc/master.passwd"
+    "etc/shells"
+  ];
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+  ];
+
+  extraNativeBuildInputs = [
+    rpcgen
+    flex
+    byacc
+    gencat
+  ];
+
+  # this target is only used in the rtld-elf derivation. build it there instead.
+  postPatch = ''
+    sed -E -i -e '/BUILD_NOSSP_PIC_ARCHIVE=/d' $BSDSRCDIR/lib/libc/Makefile
+  '';
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+
+  postBuild = ''
+    make -C $BSDSRCDIR/lib/libc_nonshared $makeFlags
+  '';
+
+  postInstall = ''
+    make -C $BSDSRCDIR/lib/libc_nonshared $makeFlags install
+  '';
+
+  alwaysKeepStatic = true;
+
+  env = {
+    MK_TESTS = "no";
+    MK_SYMVER = "yes";
+    MK_SSP = "yes";
+    MK_NLS = "yes";
+    MK_ICONV = "yes";
+    MK_NS_CACHING = "yes";
+    MK_INET6_SUPPORT = "yes";
+    MK_HESIOD = "yes";
+    MK_NIS = "yes";
+    MK_HYPERV = "yes";
+    MK_FP_LIBC = "yes";
+    MK_MALLOC_PRODUCTION = "yes";
+    MK_MACHDEP_OPTIMIZATIONS = "yes";
+  };
+
+  # definitely a bad idea to enable stack protection on the stack protection initializers
+  hardeningDisable = [ "stackprotector" ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libcrypt.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libcrypt.nix
new file mode 100644
index 000000000000..f5c90f841e67
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libcrypt.nix
@@ -0,0 +1,37 @@
+{
+  mkDerivation,
+  include,
+  libcMinimal,
+  libgcc,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/libcrypt";
+  extraPaths = [
+    "sys/kern"
+    "sys/crypto"
+    "lib/libmd"
+    "secure/lib/libcrypt"
+  ];
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libcMinimal
+    libgcc
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+
+  env.MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libcxxrt.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libcxxrt.nix
index f49718dc5ef1..8a7a0e1c321c 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libcxxrt.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libcxxrt.nix
@@ -12,14 +12,16 @@ mkDerivation {
   pname = "libcxxrt";
   path = "lib/libcxxrt";
   extraPaths = [ "contrib/libcxxrt" ];
-  outputs =
-    [
-      "out"
-      "dev"
-    ]
-    ++ lib.optionals (!stdenv.hostPlatform.isStatic) [
-      "debug"
-    ];
+  outputs = [
+    "out"
+    "dev"
+    "debug"
+  ];
   noLibcxx = true;
   libName = "cxxrt";
+
+  # they already fixed the undefined symbols in the version map upstream. it'll be released probably in 15.0
+  preBuild = ''
+    export NIX_LDFLAGS="$NIX_LDFLAGS --undefined-version"
+  '';
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libdevstat.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libdevstat.nix
new file mode 100644
index 000000000000..f1287080ea10
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libdevstat.nix
@@ -0,0 +1,44 @@
+{
+  mkDerivation,
+  include,
+  libcMinimal,
+  libgcc,
+  libkvm,
+  libprocstat,
+  libutil,
+  libelf,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/libdevstat";
+  extraPaths = [
+    "lib/libc/Versions.def"
+    "sys/contrib/openzfs"
+    "sys/contrib/pcg-c"
+    "sys/opencrypto"
+    "sys/crypto"
+  ];
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libcMinimal
+    libgcc
+    libkvm
+    libprocstat
+    libutil
+    libelf
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libdl.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libdl.nix
index 2b77a0f71662..5f0b8109dae3 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libdl.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libdl.nix
@@ -1,9 +1,34 @@
-{ mkDerivation, ... }:
+{
+  mkDerivation,
+  include,
+  libcMinimal,
+  libgcc,
+  csu,
+}:
+
 mkDerivation {
   path = "lib/libdl";
   extraPaths = [
-    "lib/libc"
     "libexec/rtld-elf"
+    "lib/libc/gen"
+    "lib/libc/include"
+    "lib/libc/Versions.def"
   ];
-  buildInputs = [ ];
+
+  outputs = [
+    "out"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libcMinimal
+    libgcc
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libelf.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libelf.nix
index d24b242bc4d3..0afedf611112 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libelf.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libelf.nix
@@ -1,26 +1,44 @@
 {
+  lib,
   stdenv,
   mkDerivation,
-  bsdSetupHook,
-  freebsdSetupHook,
-  makeMinimal,
-  install,
   m4,
+  include,
+  libcMinimal,
+  libgcc,
+  compatIfNeeded,
+  csu,
 }:
+
 mkDerivation {
   path = "lib/libelf";
   extraPaths = [
     "lib/libc"
     "contrib/elftoolchain"
-    "sys/sys/elf32.h"
-    "sys/sys/elf64.h"
-    "sys/sys/elf_common.h"
+    "sys/sys"
   ];
-  nativeBuildInputs = [
-    bsdSetupHook
-    freebsdSetupHook
-    makeMinimal
-    install
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = stdenv.hostPlatform.isFreeBSD;
+
+  buildInputs =
+    lib.optionals stdenv.hostPlatform.isFreeBSD [
+      include
+      libcMinimal
+      libgcc
+    ]
+    ++ compatIfNeeded;
+
+  extraNativeBuildInputs = [
     m4
   ];
+
+  preBuild = lib.optionalString stdenv.hostPlatform.isFreeBSD ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libexecinfo.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libexecinfo.nix
new file mode 100644
index 000000000000..fff230ade0a5
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libexecinfo.nix
@@ -0,0 +1,36 @@
+{
+  mkDerivation,
+  include,
+  libelf,
+  libcMinimal,
+  libgcc,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/libexecinfo";
+  extraPaths = [
+    "contrib/libexecinfo"
+  ];
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libelf
+    libcMinimal
+    libgcc
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+
+  env.MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libgcc.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libgcc.nix
new file mode 100644
index 000000000000..6bcc4639d15f
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libgcc.nix
@@ -0,0 +1,49 @@
+{
+  mkDerivation,
+  include,
+  libcMinimal,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/libgcc_eh";
+  extraPaths = [
+    "lib/libgcc_s"
+    "lib/libcompiler_rt"
+    "lib/msun"
+    "lib/libc" # needs arch-specific fpmath files
+    "contrib/llvm-project/compiler-rt"
+    "contrib/llvm-project/libunwind"
+  ];
+
+  outputs = [
+    "out"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libcMinimal
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+
+  postBuild = ''
+    mkdir $BSDSRCDIR/lib/libgcc_s/i386 $BSDSRCDIR/lib/libgcc_s/cpu_model
+    make -C $BSDSRCDIR/lib/libgcc_s $makeFlags
+
+    mkdir $BSDSRCDIR/lib/libcompiler_rt/i386 $BSDSRCDIR/lib/libcompiler_rt/cpu_model
+    make -C $BSDSRCDIR/lib/libcompiler_rt $makeFlags
+  '';
+
+  postInstall = ''
+    make -C $BSDSRCDIR/lib/libgcc_s $makeFlags install
+    make -C $BSDSRCDIR/lib/libcompiler_rt $makeFlags install
+  '';
+
+  alwaysKeepStatic = true;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libiconvModules.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libiconvModules.nix
new file mode 100644
index 000000000000..015274801c42
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libiconvModules.nix
@@ -0,0 +1,32 @@
+{
+  mkDerivation,
+  include,
+  libcMinimal,
+  libgcc,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/libiconv_modules";
+  extraPaths = [
+    "lib/libc/iconv"
+  ];
+
+  outputs = [
+    "out"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libcMinimal
+    libgcc
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+    export makeFlags="$makeFlags SHLIBDIR=$out/lib/i18n"
+  '';
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libkvm.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libkvm.nix
new file mode 100644
index 000000000000..d4a7aac386b8
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libkvm.nix
@@ -0,0 +1,36 @@
+{
+  mkDerivation,
+  include,
+  libcMinimal,
+  libgcc,
+  libelf,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/libkvm";
+  extraPaths = [
+    "sys" # wants sys/${arch}
+  ];
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libcMinimal
+    libgcc
+    libelf
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+
+  env.MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libmd.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libmd.nix
index 71d0c1e50d5e..a2ff458274e2 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libmd.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libmd.nix
@@ -2,48 +2,74 @@
   lib,
   stdenv,
   mkDerivation,
-  freebsdSetupHook,
-  bsdSetupHook,
+  libcMinimal,
+  include,
+  libgcc,
   makeMinimal,
+  bsdSetupHook,
+  freebsdSetupHook,
+  compatIfNeeded,
+  csu,
+  # this is set to true when used as the dependency of install
+  # this is set to false when used as the dependency of libc
+  bootstrapInstallation ? false,
 }:
-mkDerivation {
-  path = "lib/libmd";
-  extraPaths = [
-    "sys/sys/md5.h"
-    "sys/crypto/sha2"
-    "sys/crypto/skein"
-  ];
-  nativeBuildInputs = [
-    makeMinimal
-    bsdSetupHook
-    freebsdSetupHook
-  ];
 
-  makeFlags = [
-    "STRIP=-s" # flag to install, not command
-    "RELDIR=."
-  ] ++ lib.optional (!stdenv.hostPlatform.isFreeBSD) "MK_WERROR=no";
+mkDerivation (
+  {
+    path = "lib/libmd";
+    extraPaths = [
+      "sys/crypto"
+      "sys/sys"
+    ];
 
-  preBuild = ''
-    mkdir sys
-  '';
+    outputs = [
+      "out"
+      "man"
+      "debug"
+    ];
 
-  installPhase = ''
-    # libmd is used by install. do it yourself!
-    mkdir -p $out/include $out/lib $man/share/man
-    cp libmd.a $out/lib/libmd.a
-    for f in $(make $makeFlags -V INCS); do
-      if [ -e "$f" ]; then cp "$f" "$out/include/$f"; fi
-      if [ -e "$BSDSRCDIR/sys/crypto/sha2/$f" ]; then cp "$BSDSRCDIR/sys/crypto/sha2/$f" "$out/include/$f"; fi
-      if [ -e "$BSDSRCDIR/sys/crypto/skein/$f" ]; then cp "$BSDSRCDIR/sys/crypto/skein/$f" "$out/include/$f"; fi
-    done
-    for f in $(make $makeFlags -V MAN); do
-      cp "$f" "$man/share/man/$f"
-    done
-  '';
+    noLibc = !bootstrapInstallation;
 
-  outputs = [
-    "out"
-    "man"
-  ];
-}
+    buildInputs =
+      lib.optionals (!bootstrapInstallation) [
+        libcMinimal
+        include
+        libgcc
+      ]
+      ++ compatIfNeeded;
+
+    preBuild =
+      ''
+        mkdir $BSDSRCDIR/lib/libmd/sys
+      ''
+      + lib.optionalString stdenv.hostPlatform.isFreeBSD ''
+        export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+      '';
+
+    installPhase =
+      if (!bootstrapInstallation) then
+        null
+      else
+        ''
+          # libmd is used by install. do it yourself!
+          mkdir -p $out/include $out/lib $man/share/man
+          cp libmd.a $out/lib/libmd.a
+          for f in $(make $makeFlags -V INCS); do
+            if [ -e "$f" ]; then cp "$f" "$out/include/$f"; fi
+            if [ -e "$BSDSRCDIR/sys/crypto/sha2/$f" ]; then cp "$BSDSRCDIR/sys/crypto/sha2/$f" "$out/include/$f"; fi
+            if [ -e "$BSDSRCDIR/sys/crypto/skein/$f" ]; then cp "$BSDSRCDIR/sys/crypto/skein/$f" "$out/include/$f"; fi
+          done
+          for f in $(make $makeFlags -V MAN); do
+            cp "$f" "$man/share/man/$f"
+          done
+        '';
+  }
+  // lib.optionalAttrs bootstrapInstallation {
+    nativeBuildInputs = [
+      makeMinimal
+      bsdSetupHook
+      freebsdSetupHook
+    ];
+  }
+)
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libmemstat.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libmemstat.nix
new file mode 100644
index 000000000000..d5fbee0cf4cd
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libmemstat.nix
@@ -0,0 +1,31 @@
+{
+  mkDerivation,
+  include,
+  libcMinimal,
+  libgcc,
+  libkvm,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/libmemstat";
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libcMinimal
+    libgcc
+    libkvm
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libnetbsd/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libnetbsd/package.nix
index 82a9e140102f..1752583b0532 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libnetbsd/package.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libnetbsd/package.nix
@@ -25,4 +25,6 @@ mkDerivation {
     "STRIP=-s" # flag to install, not command
     "MK_WERROR=no"
   ] ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "INSTALL=boot-install";
+
+  alwaysKeepStatic = true;
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libprocstat.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libprocstat.nix
new file mode 100644
index 000000000000..15c7729919d4
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libprocstat.nix
@@ -0,0 +1,42 @@
+{
+  mkDerivation,
+  include,
+  libcMinimal,
+  libgcc,
+  libkvm,
+  libutil,
+  libelf,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/libprocstat";
+  extraPaths = [
+    "lib/libc/Versions.def"
+    "sys/contrib/openzfs"
+    "sys/contrib/pcg-c"
+    "sys/opencrypto"
+    "sys/crypto"
+  ];
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libcMinimal
+    libgcc
+    libkvm
+    libutil
+    libelf
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libradius.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libradius.nix
index 9766d75e6c3f..807c161c105c 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libradius.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libradius.nix
@@ -1,12 +1,10 @@
 {
   mkDerivation,
   openssl,
-  libmd,
 }:
 mkDerivation {
   path = "lib/libradius";
   buildInputs = [
-    libmd
     openssl
   ];
 
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/librpcsvc.nix b/pkgs/os-specific/bsd/freebsd/pkgs/librpcsvc.nix
new file mode 100644
index 000000000000..84f9093de4e1
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/librpcsvc.nix
@@ -0,0 +1,30 @@
+{
+  mkDerivation,
+  rpcgen,
+  include,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/librpcsvc";
+  extraPaths = [
+    "sys/nlm"
+    "include/rpcsvc"
+  ];
+  noLibc = true;
+
+  extraNativeBuildInputs = [
+    rpcgen
+  ];
+
+  buildInputs = [
+    include
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I${include}/include/rpcsvc"
+  '';
+
+  alwaysKeepStatic = true;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/librt.nix b/pkgs/os-specific/bsd/freebsd/pkgs/librt.nix
new file mode 100644
index 000000000000..2cc2fc746153
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/librt.nix
@@ -0,0 +1,36 @@
+{
+  mkDerivation,
+  include,
+  libcMinimal,
+  libgcc,
+  libthr,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/librt";
+  extraPaths = [
+    "lib/libc/include" # private headers
+    "lib/libc/Versions.def"
+  ];
+
+  outputs = [
+    "out"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libcMinimal
+    libgcc
+    libthr
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+
+  env.MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libsbuf.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libsbuf.nix
index 242492a3f2f2..f8e729d2d76e 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libsbuf.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libsbuf.nix
@@ -3,5 +3,5 @@
 mkDerivation {
   path = "lib/libsbuf";
   extraPaths = [ "sys/kern" ];
-  MK_TESTS = "no";
+  env.MK_TESTS = "no";
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libssp_nonshared.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libssp_nonshared.nix
new file mode 100644
index 000000000000..7b06fd660f1b
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libssp_nonshared.nix
@@ -0,0 +1,15 @@
+{
+  mkDerivation,
+  include,
+}:
+
+mkDerivation {
+  path = "lib/libssp_nonshared";
+  noLibc = true;
+
+  buildInputs = [
+    include
+  ];
+
+  alwaysKeepStatic = true;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libthr.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libthr.nix
new file mode 100644
index 000000000000..f8f4e3e5978e
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libthr.nix
@@ -0,0 +1,36 @@
+{
+  mkDerivation,
+  libcMinimal,
+  include,
+  libgcc,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/libthr";
+  extraPaths = [
+    "lib/libthread_db"
+    "lib/libc" # needs /include + arch-specific files
+    "libexec/rtld-elf"
+  ];
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    libcMinimal
+    include
+    libgcc
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+
+  env.MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libutil.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libutil.nix
index 450cdfde0eaa..e28ec53331ee 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libutil.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libutil.nix
@@ -1,6 +1,31 @@
-{ mkDerivation }:
+{
+  mkDerivation,
+  include,
+  libgcc,
+  libcMinimal,
+  csu,
+}:
 mkDerivation {
   path = "lib/libutil";
   extraPaths = [ "lib/libc/gen" ];
-  MK_TESTS = "no";
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libgcc
+    libcMinimal
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+
+  env.MK_TESTS = "no";
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix b/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix
index 5035dfd3fcdb..4dc0f4c42bb7 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix
@@ -75,6 +75,9 @@ lib.makeOverridable (
           MACHINE_CPUARCH = freebsd-lib.mkBsdCpuArch stdenv';
 
           COMPONENT_PATH = attrs.path or null;
+
+          # don't set filesystem flags that require root
+          NO_FSCHG = "yes";
         }
         // lib.optionalAttrs stdenv'.hasCC {
           # TODO should CC wrapper set this?
@@ -129,5 +132,21 @@ lib.makeOverridable (
         ))
         ++ attrs.patches or [ ];
     }
+    //
+      lib.optionalAttrs
+        (!stdenv.hostPlatform.isStatic && !attrs.alwaysKeepStatic or false && stdenv.hostPlatform.isFreeBSD)
+        {
+          postInstall =
+            (attrs.postInstall or "")
+            + ''
+              rm -f $out/lib/*.a
+            '';
+        }
+    //
+      lib.optionalAttrs
+        ((stdenv.hostPlatform.isStatic || !stdenv.hostPlatform.isFreeBSD) && attrs ? outputs)
+        {
+          outputs = lib.lists.remove "debug" attrs.outputs;
+        }
   )
 )
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/msun.nix b/pkgs/os-specific/bsd/freebsd/pkgs/msun.nix
new file mode 100644
index 000000000000..87e081c6c445
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/msun.nix
@@ -0,0 +1,34 @@
+{
+  mkDerivation,
+  include,
+  libcMinimal,
+  libgcc,
+  csu,
+}:
+
+mkDerivation {
+  path = "lib/msun";
+  extraPaths = [
+    "lib/libc" # wants arch headers
+  ];
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+    libcMinimal
+    libgcc
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+  '';
+
+  env.MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/mtree.nix b/pkgs/os-specific/bsd/freebsd/pkgs/mtree.nix
index f1cf4f9bd220..746d6a1d958c 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/mtree.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/mtree.nix
@@ -4,21 +4,27 @@
   mkDerivation,
   compatIfNeeded,
   compatIsNeeded,
-  libmd,
   libnetbsd,
-  libutil,
+  libmd,
 }:
 
+let
+  libmd' = libmd.override {
+    bootstrapInstallation = true;
+  };
+
+in
 mkDerivation {
   path = "contrib/mtree";
   extraPaths = [ "contrib/mknod" ];
   buildInputs =
     compatIfNeeded
-    ++ [
-      libmd
-      libnetbsd
+    ++ lib.optionals (!stdenv.hostPlatform.isFreeBSD) [
+      libmd'
     ]
-    ++ lib.optional (stdenv.hostPlatform.isFreeBSD) libutil;
+    ++ [
+      libnetbsd
+    ];
 
   postPatch = ''
     ln -s $BSDSRCDIR/contrib/mknod/*.c $BSDSRCDIR/contrib/mknod/*.h $BSDSRCDIR/contrib/mtree
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/rpcgen/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/rpcgen/package.nix
index e187cacbb0d0..49b2ef805bc1 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/rpcgen/package.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/rpcgen/package.nix
@@ -2,7 +2,6 @@
   lib,
   mkDerivation,
   stdenv,
-  patchesRoot,
 }:
 
 mkDerivation {
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/rtld-elf.nix b/pkgs/os-specific/bsd/freebsd/pkgs/rtld-elf.nix
new file mode 100644
index 000000000000..1a9aba91c252
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/rtld-elf.nix
@@ -0,0 +1,58 @@
+{
+  mkDerivation,
+  include,
+  rpcgen,
+  flex,
+  byacc,
+  csu,
+}:
+
+mkDerivation {
+  path = "libexec/rtld-elf";
+  extraPaths = [
+    "lib/csu"
+    "lib/libc"
+    "lib/libmd"
+    "lib/msun"
+    "lib/libutil"
+    "lib/libc_nonshared"
+    "include/rpcsvc"
+    "contrib/libc-pwcache"
+    "contrib/libc-vis"
+    "contrib/tzcode"
+    "contrib/gdtoa"
+    "contrib/jemalloc"
+    "sys/sys"
+    "sys/kern"
+    "sys/libkern"
+    "sys/crypto"
+  ];
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  noLibc = true;
+
+  buildInputs = [
+    include
+  ];
+
+  extraNativeBuildInputs = [
+    rpcgen
+    flex
+    byacc
+  ];
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -B${csu}/lib"
+    make -C $BSDSRCDIR/lib/libc $makeFlags libc_nossp_pic.a
+  '';
+
+  # definitely a bad idea to enable stack protection on the stack protection initializers
+  hardeningDisable = [ "stackprotector" ];
+
+  env.MK_TESTS = "no";
+}

From 2fbd23ab9ee1412063c3a0ede9dc4638bb9aa900 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas.gerbet@enalean.com>
Date: Thu, 28 Nov 2024 12:26:33 +0100
Subject: [PATCH 08/42] percona-server: 8.4.0-1 -> 8.4.2-2

Changes:
https://docs.percona.com/percona-server/8.4/release-notes/8.4.2-2.html
https://docs.percona.com/percona-server/8.4/release-notes/8.4.1.html

Fixes
* CVE-2024-21171
* CVE-2024-21177
* CVE-2024-21163
* CVE-2024-21176
* CVE-2024-20996
* CVE-2024-21157
* CVE-2024-21179
* CVE-2024-21127
* CVE-2024-21129
* CVE-2024-21125
* CVE-2024-21130
* CVE-2024-21162
* CVE-2024-21142
* CVE-2024-21134
---
 pkgs/servers/sql/percona-server/8_4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/percona-server/8_4.nix b/pkgs/servers/sql/percona-server/8_4.nix
index 01bac0fdef56..9b8621e40900 100644
--- a/pkgs/servers/sql/percona-server/8_4.nix
+++ b/pkgs/servers/sql/percona-server/8_4.nix
@@ -50,11 +50,11 @@ assert !(withJemalloc && withTcmalloc);
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "percona-server";
-  version = "8.4.0-1";
+  version = "8.4.2-2";
 
   src = fetchurl {
     url = "https://downloads.percona.com/downloads/Percona-Server-${lib.versions.majorMinor finalAttrs.version}/Percona-Server-${finalAttrs.version}/source/tarball/percona-server-${finalAttrs.version}.tar.gz";
-    hash = "sha256-76PXXqTNBVsD7RX2vhp7RyESiFpJL0h0zG9ucNfy3uQ=";
+    hash = "sha256-KdaF2+vZfWf6fW8HWi+c97SHW+WqmlcpdPzUUgX94EY=";
   };
 
   nativeBuildInputs = [

From 954f9b947ae2d0e0cd276266124910eb37fa13fe Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas.gerbet@enalean.com>
Date: Thu, 28 Nov 2024 12:31:21 +0100
Subject: [PATCH 09/42] percona-server_8_0: 8.0.37-29 -> 8.0.39-30

Changes:
https://docs.percona.com/percona-server/8.0/release-notes/8.0.39-30.html
https://docs.percona.com/percona-server/8.0/release-notes/8.0.38.html

Fixes:
* CVE-2024-21171
* CVE-2024-21177
* CVE-2024-21163
* CVE-2024-21173
* CVE-2024-21179
* CVE-2024-21127
* CVE-2024-21129
* CVE-2024-21125
* CVE-2024-21130
* CVE-2024-21162
* CVE-2024-21165
* CVE-2024-21142
* CVE-2024-21134
---
 pkgs/servers/sql/percona-server/8_0.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/percona-server/8_0.nix b/pkgs/servers/sql/percona-server/8_0.nix
index e48afe07af86..3c9e97d5eea0 100644
--- a/pkgs/servers/sql/percona-server/8_0.nix
+++ b/pkgs/servers/sql/percona-server/8_0.nix
@@ -42,11 +42,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "percona-server";
-  version = "8.0.37-29";
+  version = "8.0.39-30";
 
   src = fetchurl {
     url = "https://www.percona.com/downloads/Percona-Server-8.0/Percona-Server-${finalAttrs.version}/source/tarball/percona-server-${finalAttrs.version}.tar.gz";
-    hash = "sha256-zZgq3AxCRYdte3dTUJiuMvVGdl9U01s8jxcAqDxZiNM=";
+    hash = "sha256-Ag+9tzmWpdF5vxWOFUsn65oJXIkb0HmoMbif7HcSoP8=";
   };
 
   nativeBuildInputs = [

From 1cd22bbd500afa15435a9fca94da976e64811c86 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Thu, 28 Nov 2024 12:52:15 +0100
Subject: [PATCH 10/42] python312Packages.huggingface-hub: 0.26.2 -> 0.26.3

Diff: https://github.com/huggingface/huggingface_hub/compare/refs/tags/v0.26.2...v0.26.3

Changelog: https://github.com/huggingface/huggingface_hub/releases/tag/v0.26.3
---
 pkgs/development/python-modules/huggingface-hub/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/huggingface-hub/default.nix b/pkgs/development/python-modules/huggingface-hub/default.nix
index 00fab837e3ce..a768bee9b48a 100644
--- a/pkgs/development/python-modules/huggingface-hub/default.nix
+++ b/pkgs/development/python-modules/huggingface-hub/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "huggingface-hub";
-  version = "0.26.2";
+  version = "0.26.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "huggingface_hub";
     rev = "refs/tags/v${version}";
-    hash = "sha256-F2E8P0Hq3Ee+RXUEN4t2JtfBtK36aMsHQCnid9VWdLk=";
+    hash = "sha256-GTxtz9UuyvT1C5sba1Nz58xfTsIczEVe9X8gkpztRvQ=";
   };
 
   build-system = [ setuptools ];

From 5a6ea278da9a822471410a0e0f7a743527adc39a Mon Sep 17 00:00:00 2001
From: Juanjo Presa <juanjop@gmail.com>
Date: Thu, 28 Nov 2024 13:25:47 +0100
Subject: [PATCH 11/42] nixos/os-release: make default_hostname distroId

---
 nixos/modules/misc/version.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index f77261b162a6..9e9d5f9de4e7 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -41,7 +41,7 @@ let
       IMAGE_VERSION = optionalString (config.system.image.version != null) config.system.image.version;
       VARIANT = optionalString (cfg.variantName != null) cfg.variantName;
       VARIANT_ID = optionalString (cfg.variant_id != null) cfg.variant_id;
-      DEFAULT_HOSTNAME = config.networking.fqdnOrHostName;
+      DEFAULT_HOSTNAME = config.system.nixos.distroId;
       SUPPORT_END = "2025-06-30";
     };
 

From e62e20249fb34192ba0979efae62ab0ec13aa5da Mon Sep 17 00:00:00 2001
From: Felix Buehler <account@buehler.rocks>
Date: Thu, 28 Nov 2024 22:09:29 +0100
Subject: [PATCH 12/42] android-studio: fix fhsenv version

---
 .../editors/android-studio-for-platform/common.nix             | 3 ++-
 pkgs/applications/editors/android-studio/common.nix            | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/android-studio-for-platform/common.nix b/pkgs/applications/editors/android-studio-for-platform/common.nix
index b0e7e1c839a4..049a5600d684 100644
--- a/pkgs/applications/editors/android-studio-for-platform/common.nix
+++ b/pkgs/applications/editors/android-studio-for-platform/common.nix
@@ -130,7 +130,8 @@ let
   # (e.g. `mksdcard`) have `/lib/ld-linux.so.2` set as the interpreter. An FHS
   # environment is used as a work around for that.
   fhsEnv = buildFHSEnv {
-    name = "${drvName}-fhs-env";
+    pname = "${drvName}-fhs-env";
+    inherit version;
     multiPkgs = pkgs: [
       zlib
       ncurses5
diff --git a/pkgs/applications/editors/android-studio/common.nix b/pkgs/applications/editors/android-studio/common.nix
index 33c9bd77aef1..a3e5f4cc3e52 100644
--- a/pkgs/applications/editors/android-studio/common.nix
+++ b/pkgs/applications/editors/android-studio/common.nix
@@ -208,7 +208,8 @@ let
   # (e.g. `mksdcard`) have `/lib/ld-linux.so.2` set as the interpreter. An FHS
   # environment is used as a work around for that.
   fhsEnv = buildFHSEnv {
-    name = "${drvName}-fhs-env";
+    pname = "${drvName}-fhs-env";
+    inherit version;
     multiPkgs = pkgs: [
       ncurses5
 

From af1aa40e7332e838d7a639c4a7fdc928da983b5c Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Thu, 28 Nov 2024 00:04:17 +0100
Subject: [PATCH 13/42] workflows/eval.yml: Run on dev branch pushes and apply
 rebuild labels

---
 .github/workflows/eval.yml          | 136 ++++++++++++++++++++++---
 ci/eval/compare.jq                  | 152 ++++++++++++++++++++++++++++
 ci/eval/default.nix                 |  19 ++++
 ci/request-reviews/dev-branches.txt |   1 +
 4 files changed, 292 insertions(+), 16 deletions(-)
 create mode 100644 ci/eval/compare.jq

diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 280ed141576c..90be4670e414 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -1,6 +1,16 @@
 name: Eval
 
-on: pull_request_target
+on:
+  pull_request_target:
+  push:
+    # Keep this synced with ci/request-reviews/dev-branches.txt
+    branches:
+      - master
+      - staging
+      - release-*
+      - staging-*
+      - haskell-updates
+      - python-updates
 
 permissions:
   contents: read
@@ -11,6 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       mergedSha: ${{ steps.merged.outputs.mergedSha }}
+      baseSha: ${{ steps.baseSha.outputs.baseSha }}
       systems: ${{ steps.systems.outputs.systems }}
     steps:
       # Important: Because of `pull_request_target`, this doesn't check out the PR,
@@ -24,14 +35,22 @@ jobs:
         id: merged
         env:
           GH_TOKEN: ${{ github.token }}
+          GH_EVENT: ${{ github.event_name }}
         run: |
-          if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
-            echo "Checking the merge commit $mergedSha"
-            echo "mergedSha=$mergedSha" >> "$GITHUB_OUTPUT"
-          else
-            # Skipping so that no notifications are sent
-            echo "Skipping the rest..."
-          fi
+          case "$GH_EVENT" in
+            push)
+              echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"
+              ;;
+            pull_request_target)
+              if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
+                echo "Checking the merge commit $mergedSha"
+                echo "mergedSha=$mergedSha" >> "$GITHUB_OUTPUT"
+              else
+                # Skipping so that no notifications are sent
+                echo "Skipping the rest..."
+              fi
+              ;;
+          esac
           rm -rf base
       - name: Check out the PR at the test merge commit
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -39,8 +58,16 @@ jobs:
         if: steps.merged.outputs.mergedSha
         with:
           ref: ${{ steps.merged.outputs.mergedSha }}
+          fetch-depth: 2
           path: nixpkgs
 
+      - name: Determine base commit
+        if: github.event_name == 'pull_request_target' && steps.merged.outputs.mergedSha
+        id: baseSha
+        run: |
+          baseSha=$(git -C nixpkgs rev-parse HEAD^1)
+          echo "baseSha=$baseSha" >> "$GITHUB_OUTPUT"
+
       - name: Install Nix
         uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
         if: steps.merged.outputs.mergedSha
@@ -105,6 +132,8 @@ jobs:
     name: Process
     runs-on: ubuntu-latest
     needs: [ outpaths, attrs ]
+    outputs:
+      baseRunId: ${{ steps.baseRunId.outputs.baseRunId }}
     steps:
       - name: Download output paths and eval stats for all systems
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
@@ -124,18 +153,93 @@ jobs:
       - name: Combine all output paths and eval stats
         run: |
           nix-build nixpkgs/ci -A eval.combine \
-            --arg resultsDir ./intermediate
+            --arg resultsDir ./intermediate \
+            -o prResult
 
       - name: Upload the combined results
         uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: result
-          path: result/*
+          path: prResult/*
 
+      - name: Get base run id
+        if: needs.attrs.outputs.baseSha
+        id: baseRunId
+        run: |
+          # Get the latest eval.yml workflow run for the PR's base commit
+          if ! run=$(gh api --method GET /repos/"$REPOSITORY"/actions/workflows/eval.yml/runs \
+            -f head_sha="$BASE_SHA" \
+            --jq '.workflow_runs | sort_by(.run_started_at) | .[-1]') \
+            || [[ -z "$run" ]]; then
+            echo "Could not find an eval.yml workflow run for $BASE_SHA, cannot make comparison"
+            exit 0
+          fi
+          echo "Comparing against $(jq .html_url <<< "$run")"
+          runId=$(jq .id <<< "$run")
+          conclusion=$(jq -r .conclusion <<< "$run")
 
-      # TODO: Run this workflow also on `push` (on at least the main development branches)
-      # Then add an extra step here that waits for the base branch (not the merge base, because that could be very different)
-      # to have completed the eval, then use
-      # gh api --method GET /repos/NixOS/nixpkgs/actions/workflows/eval.yml/runs -f head_sha=<BASE>
-      # and follow it to the artifact results, where you can then download the outpaths.json from the base branch
-      # That can then be used to compare the number of changed paths, get evaluation stats and ping appropriate reviewers
+          while [[ "$conclusion" == null ]]; do
+            echo "Workflow not done, waiting 10 seconds before checking again"
+            sleep 10
+            conclusion=$(gh api /repos/"$REPOSITORY"/actions/runs/"$runId" --jq '.conclusion')
+          done
+
+          if [[ "$conclusion" != "success" ]]; then
+            echo "Workflow was not successful, cannot make comparison"
+            exit 0
+          fi
+
+          echo "baseRunId=$runId" >> "$GITHUB_OUTPUT"
+        env:
+          REPOSITORY: ${{ github.repository }}
+          BASE_SHA: ${{ needs.attrs.outputs.baseSha }}
+          GH_TOKEN: ${{ github.token }}
+
+      - uses: actions/download-artifact@v4
+        if: steps.baseRunId.outputs.baseRunId
+        with:
+          name: result
+          path: baseResult
+          github-token: ${{ github.token }}
+          run-id: ${{ steps.baseRunId.outputs.baseRunId }}
+
+      - name: Compare against the base branch
+        if: steps.baseRunId.outputs.baseRunId
+        run: |
+          nix-build nixpkgs/ci -A eval.compare \
+            --arg beforeResultDir ./baseResult \
+            --arg afterResultDir ./prResult \
+            -o comparison
+
+          # TODO: Request reviews from maintainers for packages whose files are modified in the PR
+
+      - name: Upload the combined results
+        if: steps.baseRunId.outputs.baseRunId
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        with:
+          name: comparison
+          path: comparison/*
+
+  # Separate job to have a very tightly scoped PR write token
+  tag:
+    name: Tag
+    runs-on: ubuntu-latest
+    needs: process
+    if: needs.process.outputs.baseRunId
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Download process result
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          name: comparison
+          path: comparison
+
+      - name: Tagging pull request
+        run: |
+          gh api \
+            --method POST \
+            /repos/${{ github.repository }}/issues/${{ github.event.number }}/labels \
+            --input <(jq -c '{ labels: .labels }' comparison/changed-paths.json)
+        env:
+          GH_TOKEN: ${{ github.token }}
diff --git a/ci/eval/compare.jq b/ci/eval/compare.jq
new file mode 100644
index 000000000000..fb94d525bc03
--- /dev/null
+++ b/ci/eval/compare.jq
@@ -0,0 +1,152 @@
+# Turns
+#
+#   {
+#     "hello.aarch64-linux": "a",
+#     "hello.x86_64-linux": "b",
+#     "hello.aarch64-darwin": "c",
+#     "hello.x86_64-darwin": "d"
+#   }
+#
+# into
+#
+#   {
+#     "hello": {
+#       "linux": {
+#         "aarch64": "a",
+#         "x86_64": "b"
+#       },
+#       "darwin": {
+#         "aarch64": "c",
+#         "x86_64": "d"
+#       }
+#     }
+#   }
+#
+# while filtering out any attribute paths that don't match this pattern
+def expand_system:
+  to_entries
+  | map(
+    .key |= split(".")
+    | select(.key | length > 1)
+    | .double = (.key[-1] | split("-"))
+    | select(.double | length == 2)
+  )
+  | group_by(.key[0:-1])
+  | map(
+    {
+      key: .[0].key[0:-1] | join("."),
+      value:
+        group_by(.double[1])
+        | map(
+          {
+            key: .[0].double[1],
+            value: map(.key = .double[0]) | from_entries
+          }
+        )
+        | from_entries
+    })
+  | from_entries
+  ;
+
+# Transposes
+#
+#   {
+#     "a": [ "x", "y" ],
+#     "b": [ "x" ],
+#   }
+#
+# into
+#
+#   {
+#     "x": [ "a", "b" ],
+#     "y": [ "a" ]
+#   }
+def transpose:
+  [
+    to_entries[]
+    | {
+      key: .key,
+      value: .value[]
+    }
+  ]
+  | group_by(.value)
+  | map({
+    key: .[0].value,
+    value: map(.key)
+  })
+  | from_entries
+  ;
+
+# Computes the key difference for two objects:
+# {
+#   added: [ <keys only in the second object> ],
+#   removed: [ <keys only in the first object> ],
+#   changed: [ <keys with different values between the two objects> ],
+# }
+#
+def diff($before; $after):
+  {
+    added: $after | delpaths($before | keys | map([.])) | keys,
+    removed: $before | delpaths($after | keys | map([.])) | keys,
+    changed:
+      $before
+      | to_entries
+      | map(
+        $after."\(.key)" as $after2
+        | select(
+          # Filter out attributes that don't exist anymore
+          ($after2 != null)
+          and
+          # Filter out attributes that are the same as the new value
+          (.value != $after2)
+        )
+        | .key
+      )
+  }
+  ;
+
+($before[0] | expand_system) as $before
+| ($after[0] | expand_system) as $after
+| .attrdiff = diff($before; $after)
+| .rebuildsByKernel = (
+  .attrdiff.changed
+  | map({
+    key: .,
+    value: diff($before."\(.)"; $after."\(.)").changed
+  })
+  | from_entries
+  | transpose
+)
+| .rebuildCountByKernel = (
+  .rebuildsByKernel
+  | with_entries(.value |= length)
+  | pick(.linux, .darwin)
+  | {
+    linux: (.linux // 0),
+    darwin: (.darwin // 0),
+  }
+)
+| .labels = (
+  .rebuildCountByKernel
+  | to_entries
+  | map(
+    "10.rebuild-\(.key): " +
+      if .value == 0 then
+        "0"
+      elif .value <= 10 then
+        "1-10"
+      elif .value <= 100 then
+        "11-100"
+      elif .value <= 500 then
+        "101-500"
+      elif .value <= 1000 then
+        "501-1000"
+      elif .value <= 2500 then
+        "1001-2500"
+      elif .value <= 5000 then
+        "2501-5000"
+      else
+        "5000+"
+      end
+  )
+)
diff --git a/ci/eval/default.nix b/ci/eval/default.nix
index 3f31faef73ae..1855efc79f5e 100644
--- a/ci/eval/default.nix
+++ b/ci/eval/default.nix
@@ -238,6 +238,24 @@ let
           jq -s from_entries > $out/stats.json
       '';
 
+  compare =
+    { beforeResultDir, afterResultDir }:
+    runCommand "compare"
+      {
+        nativeBuildInputs = [
+          jq
+        ];
+      }
+      ''
+        mkdir $out
+        jq -n -f ${./compare.jq} \
+          --slurpfile before ${beforeResultDir}/outpaths.json \
+          --slurpfile after ${afterResultDir}/outpaths.json \
+          > $out/changed-paths.json
+
+        # TODO: Compare eval stats
+      '';
+
   full =
     {
       # Whether to evaluate just a single system, by default all are evaluated
@@ -268,6 +286,7 @@ in
     attrpathsSuperset
     singleSystem
     combine
+    compare
     # The above three are used by separate VMs in a GitHub workflow,
     # while the below is intended for testing on a single local machine
     full
diff --git a/ci/request-reviews/dev-branches.txt b/ci/request-reviews/dev-branches.txt
index 2282529881ba..b34092546f18 100644
--- a/ci/request-reviews/dev-branches.txt
+++ b/ci/request-reviews/dev-branches.txt
@@ -1,5 +1,6 @@
 # Trusted development branches:
 # These generally require PRs to update and are built by Hydra.
+# Keep this synced with the branches in .github/workflows/eval.yml
 master
 staging
 release-*

From 8d4851c6f2e4222aa330a1822dfacfedfd93e604 Mon Sep 17 00:00:00 2001
From: Felix Buehler <account@buehler.rocks>
Date: Thu, 28 Nov 2024 22:24:10 +0100
Subject: [PATCH 14/42] unigine-superposition: fix fhsenv version

---
 .../graphics/unigine-superposition/default.nix             | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/graphics/unigine-superposition/default.nix b/pkgs/applications/graphics/unigine-superposition/default.nix
index 926fe1a1d744..6d62edab7a4a 100644
--- a/pkgs/applications/graphics/unigine-superposition/default.nix
+++ b/pkgs/applications/graphics/unigine-superposition/default.nix
@@ -28,10 +28,11 @@
 }:
 
 let
+  pname = "unigine-superposition";
+  version = "1.1";
 
   superposition = stdenv.mkDerivation rec{
-    pname = "unigine-superposition";
-    version = "1.1";
+    inherit pname version;
 
     src = fetchurl {
       url = "https://assets.unigine.com/d/Unigine_Superposition-${version}.run";
@@ -97,7 +98,7 @@ in
 # For that we need use a buildFHSEnv.
 
 buildFHSEnv {
-  name = "Superposition";
+  inherit pname version;
 
   targetPkgs = pkgs: [
     superposition

From e892b4118707361357a94d683b821084abb874dd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 29 Nov 2024 06:01:41 +0000
Subject: [PATCH 15/42] python312Packages.rmsd: 1.5.1 -> 1.6.0

---
 pkgs/development/python-modules/rmsd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/rmsd/default.nix b/pkgs/development/python-modules/rmsd/default.nix
index c60fcf298f08..ab318ec15093 100644
--- a/pkgs/development/python-modules/rmsd/default.nix
+++ b/pkgs/development/python-modules/rmsd/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "rmsd";
-  version = "1.5.1";
+  version = "1.6.0";
   format = "setuptools";
 
   propagatedBuildInputs = [ scipy ];
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wDQoIUMqrBDpgImHeHWizYu/YkFjlxB22TaGpA8Q0Sc=";
+    hash = "sha256-9bALeHmdw6OJGxp3aabkDfCxo4fGv2etKzpBDhmZOrI=";
   };
 
   pythonImportsCheck = [ "rmsd" ];

From 40142caad071b5c0075d38fe65e2b26a698cad03 Mon Sep 17 00:00:00 2001
From: phaer <hello@phaer.org>
Date: Tue, 8 Oct 2024 10:25:54 +0200
Subject: [PATCH 16/42] format files with nixfmt

---
 nixos/modules/virtualisation/kubevirt.nix     |  7 ++-
 .../vagrant-virtualbox-image.nix              | 44 +++++++++----------
 nixos/modules/virtualisation/vmware-image.nix |  7 ++-
 3 files changed, 34 insertions(+), 24 deletions(-)

diff --git a/nixos/modules/virtualisation/kubevirt.nix b/nixos/modules/virtualisation/kubevirt.nix
index 408822b6af0b..b67384502989 100644
--- a/nixos/modules/virtualisation/kubevirt.nix
+++ b/nixos/modules/virtualisation/kubevirt.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 {
   imports = [
diff --git a/nixos/modules/virtualisation/vagrant-virtualbox-image.nix b/nixos/modules/virtualisation/vagrant-virtualbox-image.nix
index 556228436b99..0d1adc3d7b9a 100644
--- a/nixos/modules/virtualisation/vagrant-virtualbox-image.nix
+++ b/nixos/modules/virtualisation/vagrant-virtualbox-image.nix
@@ -29,31 +29,31 @@
       mkdir workdir
       cd workdir
 
-      # 1. create that metadata.json file
-      echo '{"provider":"virtualbox"}' > metadata.json
+    # 1. create that metadata.json file
+    echo '{"provider":"virtualbox"}' > metadata.json
 
-      # 2. create a default Vagrantfile config
-      cat <<VAGRANTFILE > Vagrantfile
-      Vagrant.configure("2") do |config|
-        config.vm.base_mac = "0800275F0936"
-      end
-      VAGRANTFILE
+    # 2. create a default Vagrantfile config
+    cat <<VAGRANTFILE > Vagrantfile
+    Vagrant.configure("2") do |config|
+      config.vm.base_mac = "0800275F0936"
+    end
+    VAGRANTFILE
 
-      # 3. add the exported VM files
-      tar xvf ${config.system.build.virtualBoxOVA}/*.ova
+    # 3. add the exported VM files
+    tar xvf ${config.system.build.virtualBoxOVA}/*.ova
 
-      # 4. move the ovf to the fixed location
-      mv *.ovf box.ovf
+    # 4. move the ovf to the fixed location
+    mv *.ovf box.ovf
 
-      # 5. generate OVF manifest file
-      rm *.mf
-      touch box.mf
-      for fname in *; do
-        checksum=$(sha256sum $fname | cut -d' ' -f 1)
-        echo "SHA256($fname)= $checksum" >> box.mf
-      done
+    # 5. generate OVF manifest file
+    rm *.mf
+    touch box.mf
+    for fname in *; do
+      checksum=$(sha256sum $fname | cut -d' ' -f 1)
+      echo "SHA256($fname)= $checksum" >> box.mf
+    done
 
-      # 6. compress everything back together
-      tar --owner=0 --group=0 --sort=name --numeric-owner -czf $out .
-    '';
+    # 6. compress everything back together
+    tar --owner=0 --group=0 --sort=name --numeric-owner -czf $out .
+  '';
 }
diff --git a/nixos/modules/virtualisation/vmware-image.nix b/nixos/modules/virtualisation/vmware-image.nix
index 47b7c212bcd1..21aee5f4ed8b 100644
--- a/nixos/modules/virtualisation/vmware-image.nix
+++ b/nixos/modules/virtualisation/vmware-image.nix
@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   boolToStr = value: if value then "on" else "off";
   cfg = config.vmware;

From 47c83cb438298e4c78f1b982f996acd0478367d7 Mon Sep 17 00:00:00 2001
From: phaer <hello@phaer.org>
Date: Fri, 15 Nov 2024 00:02:35 +0100
Subject: [PATCH 17/42] virtualisation/linode-image: Use system.build.image

---
 nixos/modules/virtualisation/linode-image.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/virtualisation/linode-image.nix b/nixos/modules/virtualisation/linode-image.nix
index ff61c5f5d1db..80aefbf54a36 100644
--- a/nixos/modules/virtualisation/linode-image.nix
+++ b/nixos/modules/virtualisation/linode-image.nix
@@ -20,6 +20,7 @@ in
   imports = [
     ./linode-config.nix
     ./disk-size-option.nix
+    ../image/file-options.nix
     (lib.mkRenamedOptionModuleWith {
       sinceRelease = 2411;
       from = [
@@ -57,13 +58,17 @@ in
   };
 
   config = {
+    system.nixos.tags = [ "linode" ];
+    image.extension = "img.gz";
+    system.build.image = config.system.build.linodeImage;
     system.build.linodeImage = import ../../lib/make-disk-image.nix {
       name = "linode-image";
+      baseName = config.image.baseName;
       # NOTE: Linode specifically requires images to be `gzip`-ed prior to upload
       # See: https://www.linode.com/docs/products/tools/images/guides/upload-an-image/#requirements-and-considerations
       postVM = ''
         ${pkgs.gzip}/bin/gzip -${toString cfg.compressionLevel} -c -- $diskImage > \
-        $out/nixos-image-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.img.gz
+        $out/${config.image.fileName}
         rm $diskImage
       '';
       format = "raw";

From b0b3a756769aad26f25dee8d5f984c5d0c94559a Mon Sep 17 00:00:00 2001
From: phaer <hello@phaer.org>
Date: Fri, 15 Nov 2024 00:05:20 +0100
Subject: [PATCH 18/42] virtualisation/vmware-image: vmware.vmFileName ->
 image.fileName

---
 nixos/modules/virtualisation/vmware-image.nix | 30 ++++++++++++++-----
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/nixos/modules/virtualisation/vmware-image.nix b/nixos/modules/virtualisation/vmware-image.nix
index 21aee5f4ed8b..162d3dc0a0cc 100644
--- a/nixos/modules/virtualisation/vmware-image.nix
+++ b/nixos/modules/virtualisation/vmware-image.nix
@@ -17,6 +17,23 @@ let
   ];
 
 in {
+  imports = [
+    ../image/file-options.nix
+    (lib.mkRenamedOptionModuleWith {
+      sinceRelease = 2505;
+      from = [
+        "virtualisation"
+        "vmware"
+        "vmFileName"
+      ];
+      to = [
+        "image"
+        "fileName"
+      ];
+    })
+
+  ];
+
   options = {
     vmware = {
       baseImageSize = lib.mkOption {
@@ -34,13 +51,6 @@ in {
           The name of the derivation for the VMWare appliance.
         '';
       };
-      vmFileName = lib.mkOption {
-        type = lib.types.str;
-        default = "nixos-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.vmdk";
-        description = ''
-          The file name of the VMWare appliance.
-        '';
-      };
       vmSubformat = lib.mkOption {
         type = lib.types.enum subformats;
         default = "monolithicSparse";
@@ -56,10 +66,14 @@ in {
   };
 
   config = {
+    system.nixos.tags = [ "vmware" ];
+    image.extension = "vmdk";
+    system.build.image = config.system.build.vmwareImage;
     system.build.vmwareImage = import ../../lib/make-disk-image.nix {
       name = cfg.vmDerivationName;
+      baseName = config.image.baseName;
       postVM = ''
-        ${pkgs.vmTools.qemu}/bin/qemu-img convert -f raw -o compat6=${boolToStr cfg.vmCompat6},subformat=${cfg.vmSubformat} -O vmdk $diskImage $out/${cfg.vmFileName}
+        ${pkgs.vmTools.qemu}/bin/qemu-img convert -f raw -o compat6=${boolToStr cfg.vmCompat6},subformat=${cfg.vmSubformat} -O vmdk $diskImage $out/${config.image.fileName}
         rm $diskImage
       '';
       format = "raw";

From 6cc7449e308b5ae496982b17751690149380cf69 Mon Sep 17 00:00:00 2001
From: phaer <hello@phaer.org>
Date: Fri, 15 Nov 2024 00:09:13 +0100
Subject: [PATCH 19/42] virtualisation/virtualbox: virtualbox.vmFileName ->
 image.fileName

---
 .../virtualisation/virtualbox-image.nix       | 26 +++++++++++++------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/nixos/modules/virtualisation/virtualbox-image.nix b/nixos/modules/virtualisation/virtualbox-image.nix
index 22646011d33d..26633731f647 100644
--- a/nixos/modules/virtualisation/virtualbox-image.nix
+++ b/nixos/modules/virtualisation/virtualbox-image.nix
@@ -11,6 +11,7 @@ in
 {
   imports = [
     ./disk-size-option.nix
+    ../image/file-options.nix
     (lib.mkRenamedOptionModuleWith {
       sinceRelease = 2411;
       from = [
@@ -22,6 +23,18 @@ in
         "diskSize"
       ];
     })
+    (lib.mkRenamedOptionModuleWith {
+      sinceRelease = 2505;
+      from = [
+        "virtualisation"
+        "virtualbox"
+        "vmFileName"
+      ];
+      to = [
+        "image"
+        "fileName"
+      ];
+    })
   ];
 
   options = {
@@ -54,13 +67,6 @@ in
           The name of the VirtualBox appliance.
         '';
       };
-      vmFileName = lib.mkOption {
-        type = lib.types.str;
-        default = "nixos-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.ova";
-        description = ''
-          The file name of the VirtualBox appliance.
-        '';
-      };
       params = lib.mkOption {
         type =
           with lib.types;
@@ -207,8 +213,12 @@ in
       (lib.mkIf (pkgs.stdenv.hostPlatform.system == "i686-linux") { pae = "on"; })
     ];
 
+    system.nixos.tags = [ "virtualbox" ];
+    image.extension = "ova";
+    system.build.image = lib.mkDefault config.system.build.virtualBoxOVA;
     system.build.virtualBoxOVA = import ../../lib/make-disk-image.nix {
       name = cfg.vmDerivationName;
+      baseName = config.image.baseName;
 
       inherit pkgs lib config;
       partitionTableType = "legacy";
@@ -253,7 +263,7 @@ in
 
         echo "exporting VirtualBox VM..."
         mkdir -p $out
-        fn="$out/${cfg.vmFileName}"
+        fn="$out/${config.image.fileName}"
         VBoxManage export "$vmName" --output "$fn" --options manifest ${lib.escapeShellArgs cfg.exportParams}
         ${cfg.postExportCommands}
 

From 342a5021dfbb2636392f4bd071a08effeccb325f Mon Sep 17 00:00:00 2001
From: phaer <hello@phaer.org>
Date: Fri, 15 Nov 2024 00:11:59 +0100
Subject: [PATCH 20/42] virtualisation/vagrant-virtualbox: use
 system.build.image

---
 nixos/modules/virtualisation/vagrant-virtualbox-image.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/virtualisation/vagrant-virtualbox-image.nix b/nixos/modules/virtualisation/vagrant-virtualbox-image.nix
index 0d1adc3d7b9a..78c228bc46fb 100644
--- a/nixos/modules/virtualisation/vagrant-virtualbox-image.nix
+++ b/nixos/modules/virtualisation/vagrant-virtualbox-image.nix
@@ -1,6 +1,6 @@
 # Vagrant + VirtualBox
 
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 
 {
   imports = [
@@ -22,8 +22,11 @@
 
   # generate the box v1 format which is much easier to generate
   # https://www.vagrantup.com/docs/boxes/format.html
+  image.extension = lib.mkOverride 999 "${config.image.baseName}.box";
+  system.nixos.tags = [ "vagrant"];
+  system.build.image = lib.mkOverride 999 config.system.build.vagrantVirtualbox;
   system.build.vagrantVirtualbox = pkgs.runCommand
-    "virtualbox-vagrant.box"
+    config.image.fileName
     {}
     ''
       mkdir workdir

From a0ce661c998cad4b15d8e020d580a46320657b41 Mon Sep 17 00:00:00 2001
From: phaer <hello@phaer.org>
Date: Fri, 15 Nov 2024 00:18:54 +0100
Subject: [PATCH 21/42] virtualisation/proxmox-image: use system.build.image

---
 nixos/modules/virtualisation/proxmox-image.nix | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/virtualisation/proxmox-image.nix b/nixos/modules/virtualisation/proxmox-image.nix
index 9bbe7a596f07..5b28bccfd064 100644
--- a/nixos/modules/virtualisation/proxmox-image.nix
+++ b/nixos/modules/virtualisation/proxmox-image.nix
@@ -9,6 +9,7 @@ with lib;
 {
   imports = [
     ./disk-size-option.nix
+    ../image/file-options.nix
     (lib.mkRenamedOptionModuleWith {
       sinceRelease = 2411;
       from = [
@@ -250,8 +251,12 @@ with lib;
           message = "'legacy+gpt' disk partitioning requires 'seabios' bios";
         }
       ];
+      image.baseName = lib.mkDefault "vzdump-qemu-${cfg.filenameSuffix}";
+      image.extension = "vma.zst";
+      system.build.image = config.system.build.VMA;
       system.build.VMA = import ../../lib/make-disk-image.nix {
         name = "proxmox-${cfg.filenameSuffix}";
+        baseName = config.image.baseName;
         inherit (cfg) partitionTableType;
         postVM =
           let
@@ -299,16 +304,16 @@ with lib;
                 });
           in
           ''
-            ${vma}/bin/vma create "vzdump-qemu-${cfg.filenameSuffix}.vma" \
+            ${vma}/bin/vma create "${config.image.baseName}.vma" \
               -c ${
                 cfgFile "qemu-server.conf" (cfg.qemuConf // cfg.qemuExtraConf)
               }/qemu-server.conf drive-virtio0=$diskImage
             rm $diskImage
-            ${pkgs.zstd}/bin/zstd "vzdump-qemu-${cfg.filenameSuffix}.vma"
-            mv "vzdump-qemu-${cfg.filenameSuffix}.vma.zst" $out/
+            ${pkgs.zstd}/bin/zstd "${config.image.baseName}.vma"
+            mv "${config.image.fileName}" $out/
 
             mkdir -p $out/nix-support
-            echo "file vma $out/vzdump-qemu-${cfg.filenameSuffix}.vma.zst" > $out/nix-support/hydra-build-products
+            echo "file vma $out/${config.image.fileName}" > $out/nix-support/hydra-build-products
           '';
         inherit (cfg.qemuConf) additionalSpace bootSize;
         inherit (config.virtualisation) diskSize;

From d8410d8366d3be9510dad6f7d111aa0a352fb21b Mon Sep 17 00:00:00 2001
From: phaer <hello@phaer.org>
Date: Fri, 15 Nov 2024 00:21:39 +0100
Subject: [PATCH 22/42] virtualisation/oci-image: use system.build.image

---
 nixos/modules/virtualisation/oci-image.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/virtualisation/oci-image.nix b/nixos/modules/virtualisation/oci-image.nix
index fe286853de81..1856b16f3d17 100644
--- a/nixos/modules/virtualisation/oci-image.nix
+++ b/nixos/modules/virtualisation/oci-image.nix
@@ -9,7 +9,10 @@ let
   cfg = config.oci;
 in
 {
-  imports = [ ./oci-common.nix ];
+  imports = [
+    ./oci-common.nix
+    ../image/file-options.nix
+  ];
 
   config = {
     # Use a priority just below mkOptionDefault (1500) instead of lib.mkDefault
@@ -17,10 +20,14 @@ in
     virtualisation.diskSize = lib.mkOverride 1490 (8 * 1024);
     virtualisation.diskSizeAutoSupported = false;
 
+    system.nixos.tags = [ "oci" ];
+    image.extension = "qcow2";
+    system.build.image = config.system.build.OCIImage;
     system.build.OCIImage = import ../../lib/make-disk-image.nix {
       inherit config lib pkgs;
       inherit (config.virtualisation) diskSize;
       name = "oci-image";
+      baseName = config.image.baseName;
       configFile = ./oci-config-user.nix;
       format = "qcow2";
       partitionTableType = if cfg.efi then "efi" else "legacy";

From 6d50a8c57fa2b2739dbeedca072abb35f3e3cab7 Mon Sep 17 00:00:00 2001
From: phaer <hello@phaer.org>
Date: Fri, 15 Nov 2024 00:26:07 +0100
Subject: [PATCH 23/42] virtualisation/kubevirt: use system.build.image

---
 nixos/modules/virtualisation/kubevirt.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nixos/modules/virtualisation/kubevirt.nix b/nixos/modules/virtualisation/kubevirt.nix
index b67384502989..5e855d3af06e 100644
--- a/nixos/modules/virtualisation/kubevirt.nix
+++ b/nixos/modules/virtualisation/kubevirt.nix
@@ -8,6 +8,7 @@
 {
   imports = [
     ../profiles/qemu-guest.nix
+    ../image/file-options.nix
   ];
 
   config = {
@@ -27,8 +28,12 @@
     services.cloud-init.enable = true;
     systemd.services."serial-getty@ttyS0".enable = true;
 
+    system.nixos.tags = [ "kubevirt" ];
+    image.extension = "qcow2";
+    system.build.image = config.system.build.kubevirtImage;
     system.build.kubevirtImage = import ../../lib/make-disk-image.nix {
       inherit lib config pkgs;
+      inherit (config.image) baseName;
       format = "qcow2";
     };
   };

From a230d5228d9ea7f52a7e5eae69ffc06932f64758 Mon Sep 17 00:00:00 2001
From: phaer <hello@phaer.org>
Date: Fri, 15 Nov 2024 00:27:51 +0100
Subject: [PATCH 24/42] virtualisation/hyperv-image: hyperv.vmFileName ->
 image.fileName

---
 nixos/modules/virtualisation/hyperv-image.nix | 26 +++++++++++++------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/nixos/modules/virtualisation/hyperv-image.nix b/nixos/modules/virtualisation/hyperv-image.nix
index ea0603fa6ae5..8f77d384a9ba 100644
--- a/nixos/modules/virtualisation/hyperv-image.nix
+++ b/nixos/modules/virtualisation/hyperv-image.nix
@@ -14,6 +14,7 @@ in
 
   imports = [
     ./disk-size-option.nix
+    ../image/file-options.nix
     (lib.mkRenamedOptionModuleWith {
       sinceRelease = 2411;
       from = [
@@ -25,6 +26,18 @@ in
         "diskSize"
       ];
     })
+    (lib.mkRenamedOptionModuleWith {
+      sinceRelease = 2505;
+      from = [
+        "virtualisation"
+        "hyperv"
+        "vmFileName"
+      ];
+      to = [
+        "image"
+        "fileName"
+      ];
+    })
   ];
 
   options = {
@@ -36,13 +49,6 @@ in
           The name of the derivation for the hyper-v appliance.
         '';
       };
-      vmFileName = mkOption {
-        type = types.str;
-        default = "nixos-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.vhdx";
-        description = ''
-          The file name of the hyper-v appliance.
-        '';
-      };
     };
   };
 
@@ -51,10 +57,14 @@ in
     # to avoid breaking existing configs using that.
     virtualisation.diskSize = lib.mkOverride 1490 (4 * 1024);
 
+    system.nixos.tags = [ "hyperv" ];
+    image.extension = "vhdx";
+    system.build.image = config.system.build.hypervImage;
     system.build.hypervImage = import ../../lib/make-disk-image.nix {
       name = cfg.vmDerivationName;
+      baseName = config.image.baseName;
       postVM = ''
-        ${pkgs.vmTools.qemu}/bin/qemu-img convert -f raw -o subformat=dynamic -O vhdx $diskImage $out/${cfg.vmFileName}
+        ${pkgs.vmTools.qemu}/bin/qemu-img convert -f raw -o subformat=dynamic -O vhdx $diskImage $out/${config.image.fileName}
         rm $diskImage
       '';
       format = "raw";

From 41db5209c7455c69f64cd1b65039c287bb06c5ff Mon Sep 17 00:00:00 2001
From: phaer <hello@phaer.org>
Date: Fri, 15 Nov 2024 00:30:30 +0100
Subject: [PATCH 25/42] virtualisation/google-compute: use system.build.image

---
 .../modules/virtualisation/google-compute-image.nix  | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/virtualisation/google-compute-image.nix b/nixos/modules/virtualisation/google-compute-image.nix
index c2529bb3db3f..8bdbd75783a4 100644
--- a/nixos/modules/virtualisation/google-compute-image.nix
+++ b/nixos/modules/virtualisation/google-compute-image.nix
@@ -22,6 +22,7 @@ in
   imports = [
     ./google-compute-config.nix
     ./disk-size-option.nix
+    ../image/file-options.nix
     (lib.mkRenamedOptionModuleWith {
       sinceRelease = 2411;
       from = [
@@ -72,8 +73,12 @@ in
       fsType = "vfat";
     };
 
+    system.nixos.tags = [ "google-compute" ];
+    image.extension = "raw.tar.gz";
+    system.build.image = config.system.build.googleComputeImage;
     system.build.googleComputeImage = import ../../lib/make-disk-image.nix {
       name = "google-compute-image";
+      inherit (config.image) baseName;
       postVM = ''
         PATH=$PATH:${
           with pkgs;
@@ -83,10 +88,9 @@ in
           ]
         }
         pushd $out
-        mv $diskImage disk.raw
-        tar -Sc disk.raw | gzip -${toString cfg.compressionLevel} > \
-          nixos-image-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.raw.tar.gz
-        rm $out/disk.raw
+        tar -Sc $diskImage | gzip -${toString cfg.compressionLevel} > \
+          ${config.image.fileName}
+        rm $diskImage
         popd
       '';
       format = "raw";

From 77fce1dc584c4ea42f182bb3f45b3f40f283e18f Mon Sep 17 00:00:00 2001
From: phaer <hello@phaer.org>
Date: Fri, 15 Nov 2024 00:34:15 +0100
Subject: [PATCH 26/42] virtualisation/digital-ocean: use system.build.image

---
 .../virtualisation/digital-ocean-image.nix    | 70 ++++++++++++-------
 1 file changed, 46 insertions(+), 24 deletions(-)

diff --git a/nixos/modules/virtualisation/digital-ocean-image.nix b/nixos/modules/virtualisation/digital-ocean-image.nix
index b6ef01516e34..3d9fe52bb0db 100644
--- a/nixos/modules/virtualisation/digital-ocean-image.nix
+++ b/nixos/modules/virtualisation/digital-ocean-image.nix
@@ -14,6 +14,7 @@ in
   imports = [
     ./digital-ocean-config.nix
     ./disk-size-option.nix
+    ../image/file-options.nix
     (lib.mkRenamedOptionModuleWith {
       sinceRelease = 2411;
       from = [
@@ -57,32 +58,53 @@ in
   };
 
   #### implementation
-  config = {
-    system.build.digitalOceanImage = import ../../lib/make-disk-image.nix {
-      name = "digital-ocean-image";
+  config =
+    let
       format = "qcow2";
-      postVM =
-        let
-          compress =
-            {
-              "gzip" = "${pkgs.gzip}/bin/gzip";
-              "bzip2" = "${pkgs.bzip2}/bin/bzip2";
-            }
-            .${cfg.compressionMethod};
-        in
-        ''
-          ${compress} $diskImage
-        '';
-      configFile =
-        if cfg.configFile == null then
-          config.virtualisation.digitalOcean.defaultConfigFile
-        else
-          cfg.configFile;
-      inherit (config.virtualisation) diskSize;
-      inherit config lib pkgs;
-    };
+    in
+    {
+      image.extension = lib.concatStringsSep "." [
+        format
+        (
+          {
+            "gzip" = "gz";
+            "bzip2" = "bz2";
+          }
+          .${cfg.compressionMethod}
+        )
+      ];
+      system.nixos.tags = [ "digital-ocean" ];
+      system.build.image = config.system.build.digitalOceanImage;
+      system.build.digitalOceanImage = import ../../lib/make-disk-image.nix {
+        name = "digital-ocean-image";
+        inherit (config.image) baseName;
+        inherit (config.virtualisation) diskSize;
+        inherit
+          config
+          lib
+          pkgs
+          format
+          ;
+        postVM =
+          let
+            compress =
+              {
+                "gzip" = "${pkgs.gzip}/bin/gzip";
+                "bzip2" = "${pkgs.bzip2}/bin/bzip2";
+              }
+              .${cfg.compressionMethod};
+          in
+          ''
+            ${compress} $diskImage
+          '';
+        configFile =
+          if cfg.configFile == null then
+            config.virtualisation.digitalOcean.defaultConfigFile
+          else
+            cfg.configFile;
+      };
 
-  };
+    };
 
   meta.maintainers = with maintainers; [
     arianvp

From f3563c996e070676a180a0c7f2d35e96fbc472c4 Mon Sep 17 00:00:00 2001
From: phaer <hello@phaer.org>
Date: Fri, 15 Nov 2024 00:35:48 +0100
Subject: [PATCH 27/42] virtualisation/azure-image: use system.build.image

---
 nixos/modules/virtualisation/azure-image.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/virtualisation/azure-image.nix b/nixos/modules/virtualisation/azure-image.nix
index 76d8a3bb365b..53021e635b07 100644
--- a/nixos/modules/virtualisation/azure-image.nix
+++ b/nixos/modules/virtualisation/azure-image.nix
@@ -13,6 +13,7 @@ in
   imports = [
     ./azure-common.nix
     ./disk-size-option.nix
+    ../image/file-options.nix
     (lib.mkRenamedOptionModuleWith {
       sinceRelease = 2411;
       from = [
@@ -61,10 +62,14 @@ in
   };
 
   config = {
+    image.extension = "vhd";
+    system.nixos.tags = [ "azure" ];
+    system.build.image = config.system.build.azureImage;
     system.build.azureImage = import ../../lib/make-disk-image.nix {
       name = "azure-image";
+      inherit (config.image) baseName;
       postVM = ''
-        ${pkgs.vmTools.qemu}/bin/qemu-img convert -f raw -o subformat=fixed,force_size -O vpc $diskImage $out/disk.vhd
+        ${pkgs.vmTools.qemu}/bin/qemu-img convert -f raw -o subformat=fixed,force_size -O vpc $diskImage $out/${config.image.fileName}
         rm $diskImage
       '';
       configFile = ./azure-config-user.nix;

From 06ad3811a856a1769e35eecfd2c2d56aebf0ae6a Mon Sep 17 00:00:00 2001
From: phaer <hello@phaer.org>
Date: Fri, 22 Nov 2024 11:47:30 +0100
Subject: [PATCH 28/42] virtualisation/lxc-container: use system.build.image

---
 .../modules/virtualisation/lxc-container.nix  | 180 ++++++++++--------
 .../virtualisation/lxc-image-metadata.nix     |   9 +
 2 files changed, 109 insertions(+), 80 deletions(-)

diff --git a/nixos/modules/virtualisation/lxc-container.nix b/nixos/modules/virtualisation/lxc-container.nix
index ff7a4c11060b..8bd252e96c28 100644
--- a/nixos/modules/virtualisation/lxc-container.nix
+++ b/nixos/modules/virtualisation/lxc-container.nix
@@ -1,4 +1,9 @@
-{ lib, config, pkgs, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 
 {
   meta = {
@@ -8,18 +13,27 @@
   imports = [
     ./lxc-instance-common.nix
 
-    (lib.mkRemovedOptionModule [ "virtualisation" "lxc" "nestedContainer" ] "")
-    (lib.mkRemovedOptionModule [ "virtualisation" "lxc" "privilegedContainer" ] "")
+    (lib.mkRemovedOptionModule [
+      "virtualisation"
+      "lxc"
+      "nestedContainer"
+    ] "")
+    (lib.mkRemovedOptionModule [
+      "virtualisation"
+      "lxc"
+      "privilegedContainer"
+    ] "")
   ];
 
   options = { };
 
-  config = let
-    initScript = if config.boot.initrd.systemd.enable then "prepare-root" else "init";
-  in {
-    boot.isContainer = true;
-    boot.postBootCommands =
-      ''
+  config =
+    let
+      initScript = if config.boot.initrd.systemd.enable then "prepare-root" else "init";
+    in
+    {
+      boot.isContainer = true;
+      boot.postBootCommands = ''
         # After booting, register the contents of the Nix store in the Nix
         # database.
         if [ -f /nix-path-registration ]; then
@@ -31,78 +45,84 @@
         ${config.nix.package.out}/bin/nix-env -p /nix/var/nix/profiles/system --set /run/current-system
       '';
 
-    # supplement 99-ethernet-default-dhcp which excludes veth
-    systemd.network = lib.mkIf config.networking.useDHCP {
-      networks."99-lxc-veth-default-dhcp" = {
-        matchConfig = {
-          Type = "ether";
-          Kind = "veth";
-          Name = [
-            "en*"
-            "eth*"
-          ];
+      # supplement 99-ethernet-default-dhcp which excludes veth
+      systemd.network = lib.mkIf config.networking.useDHCP {
+        networks."99-lxc-veth-default-dhcp" = {
+          matchConfig = {
+            Type = "ether";
+            Kind = "veth";
+            Name = [
+              "en*"
+              "eth*"
+            ];
+          };
+          DHCP = "yes";
+          networkConfig.IPv6PrivacyExtensions = "kernel";
         };
-        DHCP = "yes";
-        networkConfig.IPv6PrivacyExtensions = "kernel";
       };
+
+      system.nixos.tags = lib.mkOverride 99 [ "lxc" ];
+      image.extension = "tar.xz";
+      image.filePath = "tarball/${config.image.fileName}";
+      system.build.image = lib.mkOverride 99 config.system.build.tarball;
+
+      system.build.tarball = pkgs.callPackage ../../lib/make-system-tarball.nix {
+        fileName = config.image.baseName;
+        extraArgs = "--owner=0";
+
+        storeContents = [
+          {
+            object = config.system.build.toplevel;
+            symlink = "none";
+          }
+        ];
+
+        contents = [
+          {
+            source = config.system.build.toplevel + "/${initScript}";
+            target = "/sbin/init";
+          }
+          # Technically this is not required for lxc, but having also make this configuration work with systemd-nspawn.
+          # Nixos will setup the same symlink after start.
+          {
+            source = config.system.build.toplevel + "/etc/os-release";
+            target = "/etc/os-release";
+          }
+        ];
+
+        extraCommands = "mkdir -p proc sys dev";
+      };
+
+      system.build.squashfs = pkgs.callPackage ../../lib/make-squashfs.nix {
+        fileName = "nixos-lxc-image-${pkgs.stdenv.hostPlatform.system}";
+
+        hydraBuildProduct = true;
+        noStrip = true; # keep directory structure
+        comp = "zstd -Xcompression-level 6";
+
+        storeContents = [ config.system.build.toplevel ];
+
+        pseudoFiles = [
+          "/sbin d 0755 0 0"
+          "/sbin/init s 0555 0 0 ${config.system.build.toplevel}/${initScript}"
+          "/dev d 0755 0 0"
+          "/proc d 0555 0 0"
+          "/sys d 0555 0 0"
+        ];
+      };
+
+      system.build.installBootLoader = pkgs.writeScript "install-lxc-sbin-init.sh" ''
+        #!${pkgs.runtimeShell}
+        ${pkgs.coreutils}/bin/ln -fs "$1/${initScript}" /sbin/init
+      '';
+
+      # networkd depends on this, but systemd module disables this for containers
+      systemd.additionalUpstreamSystemUnits = [ "systemd-udev-trigger.service" ];
+
+      systemd.packages = [ pkgs.distrobuilder.generator ];
+
+      system.activationScripts.installInitScript = lib.mkForce ''
+        ln -fs $systemConfig/${initScript} /sbin/init
+      '';
     };
-
-    system.build.tarball = pkgs.callPackage ../../lib/make-system-tarball.nix {
-      extraArgs = "--owner=0";
-
-      storeContents = [
-        {
-          object = config.system.build.toplevel;
-          symlink = "none";
-        }
-      ];
-
-      contents = [
-        {
-          source = config.system.build.toplevel + "/${initScript}";
-          target = "/sbin/init";
-        }
-        # Technically this is not required for lxc, but having also make this configuration work with systemd-nspawn.
-        # Nixos will setup the same symlink after start.
-        {
-          source = config.system.build.toplevel + "/etc/os-release";
-          target = "/etc/os-release";
-        }
-      ];
-
-      extraCommands = "mkdir -p proc sys dev";
-    };
-
-    system.build.squashfs = pkgs.callPackage ../../lib/make-squashfs.nix {
-      fileName = "nixos-lxc-image-${pkgs.stdenv.hostPlatform.system}";
-
-      hydraBuildProduct = true;
-      noStrip = true; # keep directory structure
-      comp = "zstd -Xcompression-level 6";
-
-      storeContents = [config.system.build.toplevel];
-
-      pseudoFiles = [
-        "/sbin d 0755 0 0"
-        "/sbin/init s 0555 0 0 ${config.system.build.toplevel}/${initScript}"
-        "/dev d 0755 0 0"
-        "/proc d 0555 0 0"
-        "/sys d 0555 0 0"
-      ];
-    };
-
-    system.build.installBootLoader = pkgs.writeScript "install-lxc-sbin-init.sh" ''
-      #!${pkgs.runtimeShell}
-      ${pkgs.coreutils}/bin/ln -fs "$1/${initScript}" /sbin/init
-    '';
-
-    # networkd depends on this, but systemd module disables this for containers
-    systemd.additionalUpstreamSystemUnits = ["systemd-udev-trigger.service"];
-
-    systemd.packages = [ pkgs.distrobuilder.generator ];
-
-    system.activationScripts.installInitScript = lib.mkForce ''
-      ln -fs $systemConfig/${initScript} /sbin/init
-    '';
-  };
 }
diff --git a/nixos/modules/virtualisation/lxc-image-metadata.nix b/nixos/modules/virtualisation/lxc-image-metadata.nix
index eb14f9dc5fc1..4b6596dc8e12 100644
--- a/nixos/modules/virtualisation/lxc-image-metadata.nix
+++ b/nixos/modules/virtualisation/lxc-image-metadata.nix
@@ -46,6 +46,10 @@ let
   else { files = []; properties = {}; };
 
 in {
+  imports = [
+    ../image/file-options.nix
+  ];
+
   meta = {
     maintainers = lib.teams.lxc.members;
   };
@@ -87,7 +91,12 @@ in {
   };
 
   config = {
+    system.nixos.tags = [ "lxc" "metadata" ];
+    image.extension = "tar.xz";
+    image.filePath = "tarball/${config.image.fileName}";
+    system.build.image = config.system.build.metadata;
     system.build.metadata = pkgs.callPackage ../../lib/make-system-tarball.nix {
+      fileName = config.image.baseName;
       contents = [
         {
           source = toYAML "metadata.yaml" {

From 91d74082c43b1e7cc34d3aab459d2fab03d52f04 Mon Sep 17 00:00:00 2001
From: phaer <hello@phaer.org>
Date: Fri, 22 Nov 2024 11:48:34 +0100
Subject: [PATCH 29/42] virtualisation/proxmox-lxc: use system.build.image

---
 nixos/modules/virtualisation/proxmox-lxc.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/nixos/modules/virtualisation/proxmox-lxc.nix b/nixos/modules/virtualisation/proxmox-lxc.nix
index b2f9d0635fd1..f4c6815eb377 100644
--- a/nixos/modules/virtualisation/proxmox-lxc.nix
+++ b/nixos/modules/virtualisation/proxmox-lxc.nix
@@ -8,6 +8,10 @@
 with lib;
 
 {
+  imports = [
+    ../image/file-options.nix
+  ];
+
   options.proxmoxLXC = {
     enable = mkOption {
       default = true;
@@ -46,7 +50,15 @@ with lib;
       cfg = config.proxmoxLXC;
     in
     mkIf cfg.enable {
+      system.nixos.tags = [
+        "proxmox"
+        "lxc"
+      ];
+      image.extension = "tar.xz";
+      image.filePath = "tarball/${config.image.fileName}";
+      system.build.image = config.system.build.tarball;
       system.build.tarball = pkgs.callPackage ../../lib/make-system-tarball.nix {
+        fileName = config.image.baseName;
         storeContents = [
           {
             object = config.system.build.toplevel;

From 0aa1319ab1b240bea09f32896b80786456919d9a Mon Sep 17 00:00:00 2001
From: phaer <hello@phaer.org>
Date: Tue, 26 Nov 2024 17:41:15 +0100
Subject: [PATCH 30/42] Update .git-blame-ignore-revs

---
 .git-blame-ignore-revs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
index 05ce9aec0135..d771be5b40bd 100644
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@@ -206,3 +206,6 @@ ce21e97a1f20dee15da85c084f9d1148d84f853b
 
 # treewide: migrate packages to pkgs/by-name, take 1
 571c71e6f73af34a229414f51585738894211408
+
+# format files with nixfmt (#347275)
+adb9714bd909df283c66bbd641bd631ff50a4260

From c78003c4e080967ffea950d1f8af4d505c1edc53 Mon Sep 17 00:00:00 2001
From: phaer <hello@phaer.org>
Date: Tue, 26 Nov 2024 17:58:26 +0100
Subject: [PATCH 31/42] image/images: Add image modules defined in
 virtualisation/

---
 nixos/modules/image/images.nix | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/image/images.nix b/nixos/modules/image/images.nix
index 96d02f64fb9b..776f896f720f 100644
--- a/nixos/modules/image/images.nix
+++ b/nixos/modules/image/images.nix
@@ -8,7 +8,21 @@
 let
   inherit (lib) types;
 
-  imageModules = { };
+  imageModules = {
+    azure = [ ../virtualisation/azure-image.nix ];
+    digital-ocean = [ ../virtualisation/digital-ocean-image.nix ];
+    google-compute = [ ../virtualisation/google-compute-image.nix ];
+    hyperv = [ ../virtualisation/hyperv-image.nix ];
+    linode = [ ../virtualisation/linode-image.nix ];
+    lxc = [ ../virtualisation/lxc-container.nix ];
+    lxc-metadata = [ ../virtualisation/lxc-image-metadata.nix ];
+    oci = [ ../virtualisation/oci-image.nix ];
+    proxmox = [ ../virtualisation/proxmox-image.nix ];
+    kubevirt = [ ../virtualisation/kubevirt.nix ];
+    vagrant-virtualbox = [ ../virtualisation/vagrant-virtualbox-image.nix ];
+    virtualbox = [ ../virtualisation/virtualbox-image.nix ];
+    vmware = [ ../virtualisation/vmware-image.nix ];
+  };
   imageConfigs = lib.mapAttrs (
     name: modules:
     extendModules {

From 03f953d285b980dd69906e53e3d547295593421d Mon Sep 17 00:00:00 2001
From: Noa Aarts <noa@voorwaarts.nl>
Date: Fri, 29 Nov 2024 18:40:05 +0100
Subject: [PATCH 32/42] bluejeans-gui: remove

---
 .../instant-messengers/bluejeans/default.nix  | 137 ------------------
 .../bluejeans/localtime64_stub.c              |  12 --
 .../instant-messengers/bluejeans/update.sh    |  12 --
 pkgs/top-level/all-packages.nix               |   2 -
 4 files changed, 163 deletions(-)
 delete mode 100644 pkgs/applications/networking/instant-messengers/bluejeans/default.nix
 delete mode 100644 pkgs/applications/networking/instant-messengers/bluejeans/localtime64_stub.c
 delete mode 100755 pkgs/applications/networking/instant-messengers/bluejeans/update.sh

diff --git a/pkgs/applications/networking/instant-messengers/bluejeans/default.nix b/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
deleted file mode 100644
index 62655ada43a9..000000000000
--- a/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
+++ /dev/null
@@ -1,137 +0,0 @@
-{ stdenv
-, lib
-, fetchurl
-, rpmextract
-, libnotify
-, libuuid
-, cairo
-, cups
-, pango
-, fontconfig
-, udev
-, dbus
-, gtk3
-, atk
-, at-spi2-atk
-, expat
-, gdk-pixbuf
-, freetype
-, nspr
-, glib
-, nss
-, libX11
-, libXrandr
-, libXrender
-, libXtst
-, libXdamage
-, libxcb
-, libXcursor
-, libXi
-, libXext
-, libXfixes
-, libXft
-, libXcomposite
-, libXScrnSaver
-, alsa-lib
-, pulseaudio
-, makeWrapper
-, xdg-utils
-}:
-
-let
-  getFirst = n: v: builtins.concatStringsSep "." (lib.take n (lib.splitString "." v));
-in
-
-stdenv.mkDerivation rec {
-  pname = "bluejeans";
-  version = "2.32.1.3";
-
-  src = fetchurl {
-    url = "https://swdl.bluejeans.com/desktop-app/linux/${getFirst 3 version}/BlueJeans_${version}.rpm";
-    sha256 = "sha256-lsUS7JymCMOa5wlWJOwLFm4KRnAYixi9Kk5CYHB17Ac=";
-  };
-
-  nativeBuildInputs = [ rpmextract makeWrapper ];
-
-  libPath =
-    lib.makeLibraryPath
-      [
-        libnotify
-        libuuid
-        cairo
-        cups
-        pango
-        fontconfig
-        gtk3
-        atk
-        at-spi2-atk
-        expat
-        gdk-pixbuf
-        dbus
-        (lib.getLib udev)
-        freetype
-        nspr
-        glib
-        stdenv.cc.cc
-        nss
-        libX11
-        libXrandr
-        libXrender
-        libXtst
-        libXdamage
-        libxcb
-        libXcursor
-        libXi
-        libXext
-        libXfixes
-        libXft
-        libXcomposite
-        libXScrnSaver
-        alsa-lib
-        pulseaudio
-      ];
-
-  localtime64_stub = ./localtime64_stub.c;
-
-  buildCommand = ''
-    mkdir -p $out/bin/
-    cd $out
-    rpmextract $src
-    mv usr/share share
-    rmdir usr
-
-    patchelf \
-      --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
-      --replace-needed libudev.so.0 libudev.so.1 \
-      opt/BlueJeans/bluejeans-v2
-
-    patchelf \
-      --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
-      opt/BlueJeans/resources/BluejeansHelper
-
-    cc $localtime64_stub -shared -o "${placeholder "out"}"/opt/BlueJeans/liblocaltime64_stub.so
-
-    # make xdg-open overrideable at runtime
-    makeWrapper $out/opt/BlueJeans/bluejeans-v2 $out/bin/bluejeans \
-      --set LD_LIBRARY_PATH "${libPath}":"${placeholder "out"}"/opt/BlueJeans \
-      --set LD_PRELOAD "$out"/opt/BlueJeans/liblocaltime64_stub.so \
-      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
-
-    substituteInPlace "$out"/share/applications/bluejeans-v2.desktop \
-      --replace "/opt/BlueJeans/bluejeans-v2" "$out/bin/bluejeans"
-
-    patchShebangs "$out"
-  '';
-
-  passthru.updateScript = ./update.sh;
-
-  meta = with lib; {
-    description = "Video, audio, and web conferencing that works together with the collaboration tools you use every day";
-    homepage = "https://www.bluejeans.com";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
-    maintainers = [ ];
-    platforms = [ "x86_64-linux" ];
-  };
-}
-
diff --git a/pkgs/applications/networking/instant-messengers/bluejeans/localtime64_stub.c b/pkgs/applications/networking/instant-messengers/bluejeans/localtime64_stub.c
deleted file mode 100644
index 87c2fa11714c..000000000000
--- a/pkgs/applications/networking/instant-messengers/bluejeans/localtime64_stub.c
+++ /dev/null
@@ -1,12 +0,0 @@
-#include <stdio.h>
-#include <stdlib.h>
-
-void *localtime64() {
-  fprintf(stderr, "nixpkgs: call into localtime64_r\n");
-  abort();
-}
-
-void *localtime64_r() {
-  fprintf(stderr, "nixpkgs: call into localtime64_r\n");
-  abort();
-}
diff --git a/pkgs/applications/networking/instant-messengers/bluejeans/update.sh b/pkgs/applications/networking/instant-messengers/bluejeans/update.sh
deleted file mode 100755
index 3bb7d309e875..000000000000
--- a/pkgs/applications/networking/instant-messengers/bluejeans/update.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl pup common-updater-scripts
-
-set -eu -o pipefail
-
-version="$(curl -Ls https://www.bluejeans.com/downloads | \
-    pup 'a[href$=".rpm"] attr{href}' | \
-    # output contains app and events
-    grep "desktop-app" | \
-    awk -F'[ ._ ]' '{printf $6"."$7"."$8"."$9"\n"}')"
-
-update-source-version bluejeans-gui "$version"
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d3c648bc6d29..496efb4d29a4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13433,8 +13433,6 @@ with pkgs;
     gtk = gtk3;
   };
 
-  bluejeans-gui = callPackage ../applications/networking/instant-messengers/bluejeans { };
-
   breezy = with python3Packages; toPythonApplication breezy;
 
   cage = callPackage ../applications/window-managers/cage {

From 3c18c8fcc29545a53bef6688748024d08e5972bc Mon Sep 17 00:00:00 2001
From: Felix Buehler <account@buehler.rocks>
Date: Thu, 28 Nov 2024 22:07:19 +0100
Subject: [PATCH 33/42] arduino-cli: fix fhsenv version

---
 pkgs/by-name/ar/arduino-cli/package.nix | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/ar/arduino-cli/package.nix b/pkgs/by-name/ar/arduino-cli/package.nix
index eaf469e7d202..47efa27782ec 100644
--- a/pkgs/by-name/ar/arduino-cli/package.nix
+++ b/pkgs/by-name/ar/arduino-cli/package.nix
@@ -94,17 +94,13 @@ if stdenv.hostPlatform.isLinux then
   # toolchains from the internet that have their interpreters pointed at
   # /lib64/ld-linux-x86-64.so.2
   buildFHSEnv {
-    inherit (pkg) name meta;
+    inherit (pkg) pname version meta;
 
     runScript = "${pkg.outPath}/bin/arduino-cli";
 
-    extraInstallCommands =
-      ''
-        mv $out/bin/$name $out/bin/arduino-cli
-      ''
-      + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-        cp -r ${pkg.outPath}/share $out/share
-      '';
+    extraInstallCommands = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      cp -r ${pkg.outPath}/share $out/share
+    '';
     passthru.pureGoPkg = pkg;
 
     targetPkgs = pkgs: with pkgs; [ zlib ];

From c055f6bc0a7ee3b315cc19ae4f20ed32b99bda2a Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 29 Nov 2024 21:38:28 +0100
Subject: [PATCH 34/42] nixos/mysql: fix evaluation of percona test

Commit e14483d6a67399485876ab51c9726dbd2eb0836a fixed a bug in the `ini`
type with `listsAsDuplicatedKeys = true;`: multiple list declarations
weren't merged, but latter declarations shadowed the former without any
error.

The fix brought another issue to surface however: before, the
`plugin-load-add` declaration in the MySQL test shadowed the
`auth_socket.so` setting in the module. But now the attempt
to merge a list and a single declaration breaks because of
`types.either` seeing a mix of declarations from the left
AND right type.

Turning the `plugin-load-add` in the module into a list triggers the
correct merging behavior and thus fixes the evaluation error (and
merging behavior of `plugin-load-add`)!

This wasn't an issue for mysql itself (empty `plugin-load-add` in the
test) and neither for mariadb (the `auth_socket.so` isn't added for
this).
---
 nixos/modules/services/databases/mysql.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/databases/mysql.nix b/nixos/modules/services/databases/mysql.nix
index 40844b26d0da..412fe4836cd3 100644
--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@@ -314,7 +314,7 @@ in
         binlog-ignore-db = [ "information_schema" "performance_schema" "mysql" ];
       })
       (lib.mkIf (!isMariaDB) {
-        plugin-load-add = "auth_socket.so";
+        plugin-load-add = [ "auth_socket.so" ];
       })
     ];
 

From 5978e7fa2fbec36ba253fb78e5ffaab13f7192bc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Fri, 29 Nov 2024 21:31:24 +0100
Subject: [PATCH 35/42] ci/eval: don't allow IFD

---
 ci/eval/default.nix | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/ci/eval/default.nix b/ci/eval/default.nix
index 3f31faef73ae..039c9bde7dca 100644
--- a/ci/eval/default.nix
+++ b/ci/eval/default.nix
@@ -50,8 +50,12 @@ let
         export GC_INITIAL_HEAP_SIZE=4g
         command time -v \
           nix-instantiate --eval --strict --json --show-trace \
-          $src/pkgs/top-level/release-attrpaths-superset.nix -A paths \
-          --arg enableWarnings false > $out/paths.json
+            "$src/pkgs/top-level/release-attrpaths-superset.nix" \
+            -A paths \
+            -I "$src" \
+            --option restrict-eval true \
+            --option allow-import-from-derivation false \
+            --arg enableWarnings false > $out/paths.json
         mv "$supportedSystemsPath" $out/systems.json
       '';
 
@@ -84,6 +88,8 @@ let
         set +e
         command time -f "Chunk $myChunk on $system done [%MKB max resident, %Es elapsed] %C" \
           nix-env -f "${nixpkgs}/pkgs/top-level/release-attrpaths-parallel.nix" \
+          --option restrict-eval true \
+          --option allow-import-from-derivation false \
           --query --available \
           --no-name --attr-path --out-path \
           --show-trace \
@@ -93,6 +99,8 @@ let
           --arg systems "[ \"$system\" ]" \
           --arg checkMeta ${lib.boolToString checkMeta} \
           --arg includeBroken ${lib.boolToString includeBroken} \
+          -I ${nixpkgs} \
+          -I ${attrpathFile} \
           > "$outputDir/result/$myChunk"
         exitCode=$?
         set -e

From 4a98c23fd0f7cfad160085bbd95ec6aed40eb9a6 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Fri, 29 Nov 2024 21:28:33 +0000
Subject: [PATCH 36/42] mpvScripts.mpv-image-viewer: init at
 0-unstable-2023-03-03 (#347323)

can be used like:

```nix
mpv.override { scripts = [ mpvScripts.mpv-image-viewer.image-positioning ]; }
```

Co-authored-by: Arne Keller <2012gdwu+github@posteo.de>
---
 .../video/mpv/scripts/mpv-image-viewer.nix    | 58 +++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 pkgs/applications/video/mpv/scripts/mpv-image-viewer.nix

diff --git a/pkgs/applications/video/mpv/scripts/mpv-image-viewer.nix b/pkgs/applications/video/mpv/scripts/mpv-image-viewer.nix
new file mode 100644
index 000000000000..f00f0cbd9ba4
--- /dev/null
+++ b/pkgs/applications/video/mpv/scripts/mpv-image-viewer.nix
@@ -0,0 +1,58 @@
+{
+  buildLua,
+  fetchFromGitHub,
+  lib,
+  unstableGitUpdater,
+}:
+let
+  mkScript =
+    pname: args:
+    let
+      self = {
+        inherit pname;
+        version = "0-unstable-2023-03-03";
+        src = fetchFromGitHub {
+          owner = "occivink";
+          repo = "mpv-image-viewer";
+          rev = "efc82147cba4809f22e9afae6ed7a41ad9794ffd";
+          hash = "sha256-H7uBwrIb5uNEr3m+rHED/hO2CHypGu7hbcRpC30am2Q=";
+        };
+
+        sourceRoot = "source/scripts";
+
+        passthru = {
+          updateScript = unstableGitUpdater { };
+        };
+
+        meta = {
+          description = "Configuration, scripts and tips for using mpv as an image viewer";
+          longDescription = ''
+            ${pname} is a component of mpv-image-viewer.
+
+            mpv-image-viewer aggregates configurations, scripts and tips for using
+            mpv as an image viewer. The affectionate nickname mvi is given to mpv in
+            such case.
+
+            Each mpv-image-viewer script can be used on its own without depending on
+            any of the others. Refer to the README and script-opts/ directory for
+            additional configuration tips or examples.
+          '';
+          homepage = "https://github.com/occivink/mpv-image-viewer";
+          license = lib.licenses.unlicense;
+          maintainers = with lib.maintainers; [ colinsane ];
+        };
+      };
+    in
+    buildLua (lib.attrsets.recursiveUpdate self args);
+in
+lib.recurseIntoAttrs (
+  lib.mapAttrs (name: lib.makeOverridable (mkScript name)) {
+    detect-image.meta.description = "Allows you to run specific commands when images are being displayed. Does not do anything by default, needs to be configured through detect_image.conf";
+    equalizer = { };
+    freeze-window.meta.description = "By default, mpv automatically resizes the window when the current file changes to fit its size. This script freezes the window so that this does not happen. There is no configuration";
+    image-positioning.meta.description = "Adds several high-level commands to zoom and pan";
+    minimap.meta.description = "Adds a minimap that displays the position of the image relative to the view";
+    ruler.meta.description = "Adds a ruler command that lets you measure positions, distances and angles in the image. Can be configured through ruler.conf";
+    status-line.meta.description = "Adds a status line that can show different properties in the corner of the window. By default it shows filename [positon/total] in the bottom left";
+  }
+)

From 61f3a9680a6ea4dcde256dea0e666da0af7bb861 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <mail@dotlambda.de>
Date: Fri, 29 Nov 2024 10:49:34 -0800
Subject: [PATCH 37/42] nixos/prometheus.exporters.unifi: drop

The corresponding package was dropped in 826bef9b514bd5ceb5af55ccd79592778de03277.
---
 .../monitoring/prometheus/exporters.nix       |  1 -
 .../monitoring/prometheus/exporters/unifi.nix | 71 -------------------
 2 files changed, 72 deletions(-)
 delete mode 100644 nixos/modules/services/monitoring/prometheus/exporters/unifi.nix

diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix
index c388a7aa5558..20f0183b752e 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@@ -89,7 +89,6 @@ let
     "surfboard"
     "systemd"
     "unbound"
-    "unifi"
     "unpoller"
     "v2ray"
     "varnish"
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/unifi.nix b/nixos/modules/services/monitoring/prometheus/exporters/unifi.nix
deleted file mode 100644
index 07d177251f40..000000000000
--- a/nixos/modules/services/monitoring/prometheus/exporters/unifi.nix
+++ /dev/null
@@ -1,71 +0,0 @@
-{ config, lib, pkgs, options, ... }:
-
-let
-  cfg = config.services.prometheus.exporters.unifi;
-  inherit (lib)
-    mkOption
-    types
-    escapeShellArg
-    optionalString
-    concatStringsSep
-    ;
-in
-{
-  port = 9130;
-  extraOpts = {
-    unifiAddress = mkOption {
-      type = types.str;
-      example = "https://10.0.0.1:8443";
-      description = ''
-        URL of the UniFi Controller API.
-      '';
-    };
-
-    unifiInsecure = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        If enabled skip the verification of the TLS certificate of the UniFi Controller API.
-        Use with caution.
-      '';
-    };
-
-    unifiUsername = mkOption {
-      type = types.str;
-      example = "ReadOnlyUser";
-      description = ''
-        username for authentication against UniFi Controller API.
-      '';
-    };
-
-    unifiPassword = mkOption {
-      type = types.str;
-      description = ''
-        Password for authentication against UniFi Controller API.
-      '';
-    };
-
-    unifiTimeout = mkOption {
-      type = types.str;
-      default = "5s";
-      example = "2m";
-      description = ''
-        Timeout including unit for UniFi Controller API requests.
-      '';
-    };
-  };
-  serviceOpts = {
-    serviceConfig = {
-      ExecStart = ''
-        ${pkgs.prometheus-unifi-exporter}/bin/unifi_exporter \
-          -telemetry.addr ${cfg.listenAddress}:${toString cfg.port} \
-          -unifi.addr ${cfg.unifiAddress} \
-          -unifi.username ${escapeShellArg cfg.unifiUsername} \
-          -unifi.password ${escapeShellArg cfg.unifiPassword} \
-          -unifi.timeout ${cfg.unifiTimeout} \
-          ${optionalString cfg.unifiInsecure "-unifi.insecure" } \
-          ${concatStringsSep " \\\n  " cfg.extraFlags}
-      '';
-    };
-  };
-}

From 64de6c47ca242f3dc0b2608a28e66ba76678edf4 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Thu, 28 Nov 2024 17:21:41 +0100
Subject: [PATCH 38/42] rl-2411: `lib` release notes

---
 nixos/doc/manual/redirects.json               | 12 ++++
 .../manual/release-notes/rl-2411.section.md   | 55 +++++++++++++++++--
 2 files changed, 63 insertions(+), 4 deletions(-)

diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index e36f45074be3..5f7bf93db21e 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -1871,6 +1871,18 @@
   "sec-release-24.11-wiki": [
     "release-notes.html#sec-release-24.11-wiki"
   ],
+  "sec-release-24.11-lib": [
+    "release-notes.html#sec-release-24.11-lib"
+  ],
+  "sec-release-24.11-lib-breaking": [
+    "release-notes.html#sec-release-24.11-lib-breaking"
+  ],
+  "sec-release-24.11-lib-additions-improvements": [
+    "release-notes.html#sec-release-24.11-lib-additions-improvements"
+  ],
+  "sec-release-24.11-lib-deprecations": [
+    "release-notes.html#sec-release-24.11-lib-deprecations"
+  ],
   "sec-release-24.05": [
     "release-notes.html#sec-release-24.05"
   ],
diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index bf0d7c2646f7..74072bb3d42d 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -797,10 +797,6 @@
   not the `hare` package, should be added to `nativeBuildInputs` when building
   Hare programs.
 
-- [`lib.options.mkPackageOptionMD`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.options.mkPackageOptionMD) is now obsolete; use the identical [`lib.options.mkPackageOption`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.options.mkPackageOption) instead.
-
-- `lib.misc.mapAttrsFlatten` is now formally deprecated and will be removed in future releases; use the identical [`lib.attrsets.mapAttrsToList`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.attrsets.mapAttrsToList) instead.
-
 - `virtualisation.docker.liveRestore` has been renamed to `virtualisation.docker.daemon.settings."live-restore"` and turned off by default for state versions of at least 24.11.
 
 - Tailscale's `authKeyFile` can now have its corresponding parameters set through `config.services.tailscale.authKeyParameters`, allowing for non-ephemeral unsupervised deployment and more.
@@ -979,6 +975,57 @@ To provide some examples:
 
 Note that this also allows writing overlays that explicitly apply to multiple boards.
 
+## Nixpkgs Library {#sec-release-24.11-lib}
+
+### Breaking changes {#sec-release-24.11-lib-breaking}
+
+- [`lib.escapeShellArg`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.strings.escapeShellArg) and [`lib.escapeShellArgs`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.strings.escapeShellArgs): Arguments that don't need to be escaped won't be anymore, which is not breaking according to the functions documentation, but it can cause breakages if used for the non-intended use cases.
+- [`lib.warn msg val`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.trivial.warn) (and its relatives [`lib.warnIf`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.trivial.warnIf) and [`lib.warnIfNot`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.trivial.warnIfNot)) now require `msg` to be a string to match the behavior of the new [`builtins.warn`](https://nix.dev/manual/nix/2.25/language/builtins.html?highlight=warn#builtins-warn).
+- `lib.mdDoc`: Removed after deprecation in the previous release.
+
+### Additions and Improvements {#sec-release-24.11-lib-additions-improvements}
+
+New and extended interfaces:
+- [`lib.fromHexString`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.trivial.fromHexString): Convert a hexadecimal string to it's integer representation.
+- `lib.network.ipv6.fromString`: Parse an IPv6 address.
+- [`lib.getLicenseFromSpdxIdOr`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.meta.getLicenseFromSpdxIdOr): Get the corresponding attribute in `lib.licenses` from an SPDX ID or fall back to the given default value.
+- [`lib.licensesSpdx`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.meta.licensesSpdx): Mapping of SPDX ID to the attributes in `lib.licenses`.
+- [`lib.getFirstOutput`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.attrsets.getFirstOutput): Like `getOutput` but with a list of fallback output names.
+- [`lib.getInclude`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.attrsets.getInclude) and [`lib.getStatic`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.attrsets.getStatic): Get a package’s `include`/`static` output.
+- [`lib.trim`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.strings.trim) and [`lib.trimWith`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.strings.trimWith): Remove leading and trailing whitespace from a string.
+- [`lib.meta.defaultPriority`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.meta.defaultPriority): The default priority of packages in Nix.
+- [`lib.toExtension`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.fixedPoints.toExtension): Convert to an extending function (overlay).
+- `lib.fetchers.normalizeHash`: Convert an attrset containing one of `hash`, `sha256` or `sha512` into one containing `outputHash{,Algo}` as accepted by `mkDerivation`.
+- `lib.fetchers.withNormalizedHash`: Wraps a function which accepts `outputHash{,Algo}` into one which accepts `hash`, `sha256` or `sha512`.
+- Various builtins are now reexported in a more standard way:
+  - `lib.map` -> `lib.lists.map` -> `builtins.map`
+  - `lib.intersectAttrs` -> `lib.attrsets.intersectAttrs` -> `builtins.intersectAttrs`
+  - `lib.removeAttrs` -> `lib.attrsets.removeAttrs` -> `builtins.removeAttrs`
+  - `lib.match` -> `lib.strings.match` -> `builtins.match`
+  - `lib.split` -> `lib.strings.split` -> `builtins.split`
+  - `lib.typeOf` -> `builtins.typeOf`
+  - `lib.unsafeGetAttrPos` -> `builtins.unsafeGetAttrPos`
+- [`lib.cli.toGNUCommandLine`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.cli.toGNUCommandLine) now supports the `optionValueSeparator` argument attribute to control the key-value separator for arguments.
+
+Documentation improvements:
+- Much of the documentation has been migrated to the [standard doc-comment format](https://github.com/NixOS/rfcs/pull/145), including [`lib.derivations`](https://nixos.org/manual/nixpkgs/unstable/#sec-functions-library-derivations), [`lib.fixedPoints`](https://nixos.org/manual/nixpkgs/unstable/#sec-functions-library-fixedPoints), [`lib.gvariant`](https://nixos.org/manual/nixpkgs/unstable/#sec-functions-library-gvariant), [`lib.filesystem`](https://nixos.org/manual/nixpkgs/unstable/#sec-functions-library-filesystem), [`lib.strings`](https://nixos.org/manual/nixpkgs/unstable/#sec-functions-library-strings), [`lib.meta`](https://nixos.org/manual/nixpkgs/unstable/#sec-functions-library-meta).
+- [`lib.generators` documentation](https://nixos.org/manual/nixpkgs/unstable/#sec-functions-library-generators) is now improved and rendered in the manual.
+- [`lib.cli` documentation](https://nixos.org/manual/nixpkgs/unstable/#sec-functions-library-cli) is now improved and rendered in the manual.
+- [`lib.composeExtensions`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.fixedPoints.composeExtensions) and [`lib.composeManyExtensions`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.fixedPoints.composeManyExtensions) documentation is now improved.
+- [`lib.importTOML`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.trivial.importTOML) and [`lib.importJSON`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.trivial.importJSON)'s documentation now have an example.
+
+Module System:
+- `lib.importApply`: New function, imports a Nix expression file much like the module system would, after passing an extra positional argument to the function in the file.
+- Improve error message when accessing an option that isn't defined.
+- `lib.types.anything`: Don't fail to merge when specifying the same list multiple times.
+- Improve error when loading a flake as a module.
+
+### Deprecations {#sec-release-24.11-lib-deprecations}
+
+- [`lib.options.mkPackageOptionMD`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.options.mkPackageOptionMD) is now obsolete; use the identical [`lib.options.mkPackageOption`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.options.mkPackageOption) instead.
+- `lib.misc.mapAttrsFlatten` is now formally deprecated and will be removed in future releases; use the identical [`lib.attrsets.mapAttrsToList`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.attrsets.mapAttrsToList) instead.
+- `lib.isInOldestRelease`: Renamed to [`oldestSupportedReleaseIsAtLeast`](https://nixos.org/manual/nixpkgs/unstable/#function-library-lib.trivial.oldestSupportedReleaseIsAtLeast) and deprecated.
+
 ## NixOS Wiki {#sec-release-24.11-wiki}
 
 The official NixOS Wiki at [wiki.nixos.org](https://wiki.nixos.org/) was launched in April 2024, featuring

From cb016f116bf8134bb2095cdec67cf37eae747a04 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Fri, 29 Nov 2024 23:34:12 +0100
Subject: [PATCH 39/42] ci/check-shell: only run if `shell.nix` or `./ci/**` is
 changed

saves a bit of CI time
---
 .github/workflows/check-shell.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/check-shell.yml b/.github/workflows/check-shell.yml
index 82bc43fb9294..18ec9780b56b 100644
--- a/.github/workflows/check-shell.yml
+++ b/.github/workflows/check-shell.yml
@@ -2,6 +2,9 @@ name: "Check shell"
 
 on:
   pull_request_target:
+    paths:
+      - 'shell.nix'
+      - './ci/**'
 
 permissions: {}
 

From 9ba5483ef3060e59f672e1f758981eb11592de26 Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Fri, 29 Nov 2024 23:53:16 +0100
Subject: [PATCH 40/42] webdav: 5.4.3 -> 5.4.4

Diff: https://github.com/hacdias/webdav/compare/v5.4.3...v5.4.4
---
 pkgs/by-name/we/webdav/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/we/webdav/package.nix b/pkgs/by-name/we/webdav/package.nix
index ebd4bffa33fa..d0f0f921e474 100644
--- a/pkgs/by-name/we/webdav/package.nix
+++ b/pkgs/by-name/we/webdav/package.nix
@@ -2,16 +2,16 @@
 
 buildGo123Module rec {
   pname = "webdav";
-  version = "5.4.3";
+  version = "5.4.4";
 
   src = fetchFromGitHub {
     owner = "hacdias";
     repo = "webdav";
     rev = "v${version}";
-    sha256 = "sha256-ASc+ioVBpCFESEryI0EwKYZln1JzPCOKLJJWmh7L8oA=";
+    sha256 = "sha256-8T/CRIVB4jW9kJ26om6fcm/khfzqdYCWbhJIIRZlMC0=";
   };
 
-  vendorHash = "sha256-d8WauJ1i429dr79iHgrbFRZCmx+W6OobSINy8aNGG6w=";
+  vendorHash = "sha256-f/Og0FkuaeUJ4bjqeUXVacIWnp6uiod7s146iKDSMgU=";
 
   __darwinAllowLocalNetworking = true;
 

From b4d7b9ade25a49c1a2e77e94b7076ce848b61879 Mon Sep 17 00:00:00 2001
From: Fernando Rodrigues <alpha@sigmasquadron.net>
Date: Sun, 27 Oct 2024 19:14:48 +0000
Subject: [PATCH 41/42] nixos/version: use 24-bit ANSI colour code

It's almost 2025; we don't need to use 3-bit colour anymore. Let's use
the proper colour code for NixOS' light blue:
https://github.com/NixOS/nixos-artwork/blob/ea1384e183f556a94df85c7aa1dcd411f5a69646/logo/README.md#colours

Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
---
 nixos/modules/misc/version.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index 9e9d5f9de4e7..8b6f3b0bfe14 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -36,7 +36,7 @@ let
       DOCUMENTATION_URL = optionalString isNixos "https://nixos.org/learn.html";
       SUPPORT_URL = optionalString isNixos "https://nixos.org/community.html";
       BUG_REPORT_URL = optionalString isNixos "https://github.com/NixOS/nixpkgs/issues";
-      ANSI_COLOR = optionalString isNixos "1;34";
+      ANSI_COLOR = optionalString isNixos "0;38;2;126;186;228";
       IMAGE_ID = optionalString (config.system.image.id != null) config.system.image.id;
       IMAGE_VERSION = optionalString (config.system.image.version != null) config.system.image.version;
       VARIANT = optionalString (cfg.variantName != null) cfg.variantName;

From 02e1f93cb4e713fd56f27445be69b6a6cf12860d Mon Sep 17 00:00:00 2001
From: Fernando Rodrigues <alpha@sigmasquadron.net>
Date: Thu, 31 Oct 2024 22:31:40 +0000
Subject: [PATCH 42/42] nixos/version: add extraOSReleaseArgs and
 extraLSBReleaseArgs

A free-form `attrsOf str` option that is merged with the /etc/os-release
builder, allowing downstreams to customise arbitrary os-release fields.
This is separate from the variant option, as using an attribute set
merge means one gets an infinte recursion when making extraOSReleaseArgs
a recursive set, and the variant attribute is useful to define elsewhere
or multiple times.

Ditto for /etc/lsb-release.

Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
---
 nixos/modules/misc/version.nix | 27 +++++++++++++++++++++++----
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index 8b6f3b0bfe14..2a982b254def 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -42,8 +42,7 @@ let
       VARIANT = optionalString (cfg.variantName != null) cfg.variantName;
       VARIANT_ID = optionalString (cfg.variant_id != null) cfg.variant_id;
       DEFAULT_HOSTNAME = config.system.nixos.distroId;
-      SUPPORT_END = "2025-06-30";
-    };
+    } // cfg.extraOSReleaseArgs;
 
   initrdReleaseContents = (removeAttrs osReleaseContents [ "BUILD_ID" ]) // {
     PRETTY_NAME = "${osReleaseContents.PRETTY_NAME} (Initrd)";
@@ -143,6 +142,26 @@ in
         default = "NixOS";
         description = "The name of the operating system vendor";
       };
+
+      extraOSReleaseArgs = mkOption {
+        internal = true;
+        type = types.attrsOf types.str;
+        default = { };
+        description = "Additional attributes to be merged with the /etc/os-release generator.";
+        example = {
+          ANSI_COLOR = "1;31";
+        };
+      };
+
+      extraLSBReleaseArgs = mkOption {
+        internal = true;
+        type = types.attrsOf types.str;
+        default = { };
+        description = "Additional attributes to be merged with the /etc/lsb-release generator.";
+        example = {
+          LSB_VERSION = "1.0";
+        };
+      };
     };
 
     image = {
@@ -237,13 +256,13 @@ in
     # https://www.freedesktop.org/software/systemd/man/os-release.html for the
     # format.
     environment.etc = {
-      "lsb-release".text = attrsToText {
+      "lsb-release".text = attrsToText ({
         LSB_VERSION = "${cfg.release} (${cfg.codeName})";
         DISTRIB_ID = "${cfg.distroId}";
         DISTRIB_RELEASE = cfg.release;
         DISTRIB_CODENAME = toLower cfg.codeName;
         DISTRIB_DESCRIPTION = "${cfg.distroName} ${cfg.release} (${cfg.codeName})";
-      };
+      } // cfg.extraLSBReleaseArgs);
 
       "os-release".text = attrsToText osReleaseContents;
     };