From b10f51059783efb00af6d07800d5e196bd5c6554 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 24 Jan 2025 23:58:54 +0000
Subject: [PATCH 01/29] volatility3: 2.8.0 -> 2.11.0

---
 pkgs/by-name/vo/volatility3/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vo/volatility3/package.nix b/pkgs/by-name/vo/volatility3/package.nix
index 286c54fae023..db747b0fc29f 100644
--- a/pkgs/by-name/vo/volatility3/package.nix
+++ b/pkgs/by-name/vo/volatility3/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "volatility3";
-  version = "2.8.0";
+  version = "2.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "volatilityfoundation";
     repo = "volatility3";
     tag = "v${version}";
-    hash = "sha256-XMoVfT1Wd8r684y4crTOjW9GklSTkivOGv1Ii10KzII=";
+    hash = "sha256-X2cTZaEUQm7bE0k2ve4vKj0k1N6zeLXfDzhWm32diVY=";
   };
 
   build-system = with python3.pkgs; [

From da96343d0f7121ed4e6f864b5e37fba08d5ccdbe Mon Sep 17 00:00:00 2001
From: Tert0 <tert0byte@gmail.com>
Date: Thu, 26 Dec 2024 00:35:13 +0100
Subject: [PATCH 02/29] maintainers: add Tert0

---
 maintainers/maintainer-list.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e55b7c07349f..6eb3967855ac 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -22307,6 +22307,13 @@
     githubId = 159372832;
     keys = [ { fingerprint = "6F54 C08C 37C8 EC78 15FA  0D01 A721 8CBA 2D80 15C3"; } ];
   };
+  Tert0 = {
+    name = "Tert0";
+    github = "Tert0";
+    githubId = 62036464;
+    email = "tert0byte@gmail.com";
+    keys = [ { fingerprint = "F899 D3B5 00BF 98AE 9097  F616 7069 D89F 9E5C 97ED"; } ];
+  };
   tesq0 = {
     email = "mikolaj.galkowski@gmail.com";
     github = "tesq0";

From 54dba7bed8a55b4c352cf311e2c0dfd1ff5bbc79 Mon Sep 17 00:00:00 2001
From: Tert0 <tert0byte@gmail.com>
Date: Thu, 30 Jan 2025 16:43:51 +0100
Subject: [PATCH 03/29] nixos/restic: nixfmt

---
 nixos/modules/services/backup/restic.nix | 761 ++++++++++++-----------
 1 file changed, 403 insertions(+), 358 deletions(-)

diff --git a/nixos/modules/services/backup/restic.nix b/nixos/modules/services/backup/restic.nix
index 604f399e0088..9c3a9d2e36ce 100644
--- a/nixos/modules/services/backup/restic.nix
+++ b/nixos/modules/services/backup/restic.nix
@@ -1,4 +1,10 @@
-{ config, lib, pkgs, utils, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
 let
   # Type for a valid systemd unit option. Needed for correctly passing "timerConfig" to "systemd.timers"
   inherit (utils.systemdUtils.unitOptions) unitOption;
@@ -8,269 +14,288 @@ in
     description = ''
       Periodic backups to create with Restic.
     '';
-    type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
-      options = {
-        passwordFile = lib.mkOption {
-          type = lib.types.str;
-          description = ''
-            Read the repository password from a file.
-          '';
-          example = "/etc/nixos/restic-password";
-        };
+    type = lib.types.attrsOf (
+      lib.types.submodule (
+        { name, ... }:
+        {
+          options = {
+            passwordFile = lib.mkOption {
+              type = lib.types.str;
+              description = ''
+                Read the repository password from a file.
+              '';
+              example = "/etc/nixos/restic-password";
+            };
 
-        environmentFile = lib.mkOption {
-          type = with lib.types; nullOr str;
-          default = null;
-          description = ''
-            file containing the credentials to access the repository, in the
-            format of an EnvironmentFile as described by {manpage}`systemd.exec(5)`
-          '';
-        };
+            environmentFile = lib.mkOption {
+              type = with lib.types; nullOr str;
+              default = null;
+              description = ''
+                file containing the credentials to access the repository, in the
+                format of an EnvironmentFile as described by {manpage}`systemd.exec(5)`
+              '';
+            };
 
-        rcloneOptions = lib.mkOption {
-          type = with lib.types; nullOr (attrsOf (oneOf [ str bool ]));
-          default = null;
-          description = ''
-            Options to pass to rclone to control its behavior.
-            See <https://rclone.org/docs/#options> for
-            available options. When specifying option names, strip the
-            leading `--`. To set a flag such as
-            `--drive-use-trash`, which does not take a value,
-            set the value to the Boolean `true`.
-          '';
-          example = {
-            bwlimit = "10M";
-            drive-use-trash = "true";
+            rcloneOptions = lib.mkOption {
+              type =
+                with lib.types;
+                nullOr (
+                  attrsOf (oneOf [
+                    str
+                    bool
+                  ])
+                );
+              default = null;
+              description = ''
+                Options to pass to rclone to control its behavior.
+                See <https://rclone.org/docs/#options> for
+                available options. When specifying option names, strip the
+                leading `--`. To set a flag such as
+                `--drive-use-trash`, which does not take a value,
+                set the value to the Boolean `true`.
+              '';
+              example = {
+                bwlimit = "10M";
+                drive-use-trash = "true";
+              };
+            };
+
+            rcloneConfig = lib.mkOption {
+              type =
+                with lib.types;
+                nullOr (
+                  attrsOf (oneOf [
+                    str
+                    bool
+                  ])
+                );
+              default = null;
+              description = ''
+                Configuration for the rclone remote being used for backup.
+                See the remote's specific options under rclone's docs at
+                <https://rclone.org/docs/>. When specifying
+                option names, use the "config" name specified in the docs.
+                For example, to set `--b2-hard-delete` for a B2
+                remote, use `hard_delete = true` in the
+                attribute set.
+                Warning: Secrets set in here will be world-readable in the Nix
+                store! Consider using the `rcloneConfigFile`
+                option instead to specify secret values separately. Note that
+                options set here will override those set in the config file.
+              '';
+              example = {
+                type = "b2";
+                account = "xxx";
+                key = "xxx";
+                hard_delete = true;
+              };
+            };
+
+            rcloneConfigFile = lib.mkOption {
+              type = with lib.types; nullOr path;
+              default = null;
+              description = ''
+                Path to the file containing rclone configuration. This file
+                must contain configuration for the remote specified in this backup
+                set and also must be readable by root. Options set in
+                `rcloneConfig` will override those set in this
+                file.
+              '';
+            };
+
+            inhibitsSleep = lib.mkOption {
+              default = false;
+              type = lib.types.bool;
+              example = true;
+              description = ''
+                Prevents the system from sleeping while backing up.
+              '';
+            };
+
+            repository = lib.mkOption {
+              type = with lib.types; nullOr str;
+              default = null;
+              description = ''
+                repository to backup to.
+              '';
+              example = "sftp:backup@192.168.1.100:/backups/${name}";
+            };
+
+            repositoryFile = lib.mkOption {
+              type = with lib.types; nullOr path;
+              default = null;
+              description = ''
+                Path to the file containing the repository location to backup to.
+              '';
+            };
+
+            paths = lib.mkOption {
+              # This is nullable for legacy reasons only. We should consider making it a pure listOf
+              # after some time has passed since this comment was added.
+              type = lib.types.nullOr (lib.types.listOf lib.types.str);
+              default = [ ];
+              description = ''
+                Which paths to backup, in addition to ones specified via
+                `dynamicFilesFrom`.  If null or an empty array and
+                `dynamicFilesFrom` is also null, no backup command will be run.
+                 This can be used to create a prune-only job.
+              '';
+              example = [
+                "/var/lib/postgresql"
+                "/home/user/backup"
+              ];
+            };
+
+            exclude = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [ ];
+              description = ''
+                Patterns to exclude when backing up. See
+                https://restic.readthedocs.io/en/latest/040_backup.html#excluding-files for
+                details on syntax.
+              '';
+              example = [
+                "/var/cache"
+                "/home/*/.cache"
+                ".git"
+              ];
+            };
+
+            timerConfig = lib.mkOption {
+              type = lib.types.nullOr (lib.types.attrsOf unitOption);
+              default = {
+                OnCalendar = "daily";
+                Persistent = true;
+              };
+              description = ''
+                When to run the backup. See {manpage}`systemd.timer(5)` for
+                details. If null no timer is created and the backup will only
+                run when explicitly started.
+              '';
+              example = {
+                OnCalendar = "00:05";
+                RandomizedDelaySec = "5h";
+                Persistent = true;
+              };
+            };
+
+            user = lib.mkOption {
+              type = lib.types.str;
+              default = "root";
+              description = ''
+                As which user the backup should run.
+              '';
+              example = "postgresql";
+            };
+
+            extraBackupArgs = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [ ];
+              description = ''
+                Extra arguments passed to restic backup.
+              '';
+              example = [
+                "--exclude-file=/etc/nixos/restic-ignore"
+              ];
+            };
+
+            extraOptions = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [ ];
+              description = ''
+                Extra extended options to be passed to the restic --option flag.
+              '';
+              example = [
+                "sftp.command='ssh backup@192.168.1.100 -i /home/user/.ssh/id_rsa -s sftp'"
+              ];
+            };
+
+            initialize = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = ''
+                Create the repository if it doesn't exist.
+              '';
+            };
+
+            pruneOpts = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [ ];
+              description = ''
+                A list of options (--keep-\* et al.) for 'restic forget
+                --prune', to automatically prune old snapshots.  The
+                'forget' command is run *after* the 'backup' command, so
+                keep that in mind when constructing the --keep-\* options.
+              '';
+              example = [
+                "--keep-daily 7"
+                "--keep-weekly 5"
+                "--keep-monthly 12"
+                "--keep-yearly 75"
+              ];
+            };
+
+            runCheck = lib.mkOption {
+              type = lib.types.bool;
+              default = (builtins.length config.services.restic.backups.${name}.checkOpts > 0);
+              defaultText = lib.literalExpression ''builtins.length config.services.backups.${name}.checkOpts > 0'';
+              description = "Whether to run the `check` command with the provided `checkOpts` options.";
+              example = true;
+            };
+
+            checkOpts = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [ ];
+              description = ''
+                A list of options for 'restic check'.
+              '';
+              example = [
+                "--with-cache"
+              ];
+            };
+
+            dynamicFilesFrom = lib.mkOption {
+              type = with lib.types; nullOr str;
+              default = null;
+              description = ''
+                A script that produces a list of files to back up.  The
+                results of this command are given to the '--files-from'
+                option. The result is merged with paths specified via `paths`.
+              '';
+              example = "find /home/matt/git -type d -name .git";
+            };
+
+            backupPrepareCommand = lib.mkOption {
+              type = with lib.types; nullOr str;
+              default = null;
+              description = ''
+                A script that must run before starting the backup process.
+              '';
+            };
+
+            backupCleanupCommand = lib.mkOption {
+              type = with lib.types; nullOr str;
+              default = null;
+              description = ''
+                A script that must run after finishing the backup process.
+              '';
+            };
+
+            package = lib.mkPackageOption pkgs "restic" { };
+
+            createWrapper = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+              description = ''
+                Whether to generate and add a script to the system path, that has the same environment variables set
+                as the systemd service. This can be used to e.g. mount snapshots or perform other opterations, without
+                having to manually specify most options.
+              '';
+            };
           };
-        };
-
-        rcloneConfig = lib.mkOption {
-          type = with lib.types; nullOr (attrsOf (oneOf [ str bool ]));
-          default = null;
-          description = ''
-            Configuration for the rclone remote being used for backup.
-            See the remote's specific options under rclone's docs at
-            <https://rclone.org/docs/>. When specifying
-            option names, use the "config" name specified in the docs.
-            For example, to set `--b2-hard-delete` for a B2
-            remote, use `hard_delete = true` in the
-            attribute set.
-            Warning: Secrets set in here will be world-readable in the Nix
-            store! Consider using the `rcloneConfigFile`
-            option instead to specify secret values separately. Note that
-            options set here will override those set in the config file.
-          '';
-          example = {
-            type = "b2";
-            account = "xxx";
-            key = "xxx";
-            hard_delete = true;
-          };
-        };
-
-        rcloneConfigFile = lib.mkOption {
-          type = with lib.types; nullOr path;
-          default = null;
-          description = ''
-            Path to the file containing rclone configuration. This file
-            must contain configuration for the remote specified in this backup
-            set and also must be readable by root. Options set in
-            `rcloneConfig` will override those set in this
-            file.
-          '';
-        };
-
-        inhibitsSleep = lib.mkOption {
-          default = false;
-          type = lib.types.bool;
-          example = true;
-          description = ''
-            Prevents the system from sleeping while backing up.
-          '';
-        };
-
-        repository = lib.mkOption {
-          type = with lib.types; nullOr str;
-          default = null;
-          description = ''
-            repository to backup to.
-          '';
-          example = "sftp:backup@192.168.1.100:/backups/${name}";
-        };
-
-        repositoryFile = lib.mkOption {
-          type = with lib.types; nullOr path;
-          default = null;
-          description = ''
-            Path to the file containing the repository location to backup to.
-          '';
-        };
-
-        paths = lib.mkOption {
-          # This is nullable for legacy reasons only. We should consider making it a pure listOf
-          # after some time has passed since this comment was added.
-          type = lib.types.nullOr (lib.types.listOf lib.types.str);
-          default = [ ];
-          description = ''
-            Which paths to backup, in addition to ones specified via
-            `dynamicFilesFrom`.  If null or an empty array and
-            `dynamicFilesFrom` is also null, no backup command will be run.
-             This can be used to create a prune-only job.
-          '';
-          example = [
-            "/var/lib/postgresql"
-            "/home/user/backup"
-          ];
-        };
-
-        exclude = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          default = [ ];
-          description = ''
-            Patterns to exclude when backing up. See
-            https://restic.readthedocs.io/en/latest/040_backup.html#excluding-files for
-            details on syntax.
-          '';
-          example = [
-            "/var/cache"
-            "/home/*/.cache"
-            ".git"
-          ];
-        };
-
-        timerConfig = lib.mkOption {
-          type = lib.types.nullOr (lib.types.attrsOf unitOption);
-          default = {
-            OnCalendar = "daily";
-            Persistent = true;
-          };
-          description = ''
-            When to run the backup. See {manpage}`systemd.timer(5)` for
-            details. If null no timer is created and the backup will only
-            run when explicitly started.
-          '';
-          example = {
-            OnCalendar = "00:05";
-            RandomizedDelaySec = "5h";
-            Persistent = true;
-          };
-        };
-
-        user = lib.mkOption {
-          type = lib.types.str;
-          default = "root";
-          description = ''
-            As which user the backup should run.
-          '';
-          example = "postgresql";
-        };
-
-        extraBackupArgs = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          default = [ ];
-          description = ''
-            Extra arguments passed to restic backup.
-          '';
-          example = [
-            "--exclude-file=/etc/nixos/restic-ignore"
-          ];
-        };
-
-        extraOptions = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          default = [ ];
-          description = ''
-            Extra extended options to be passed to the restic --option flag.
-          '';
-          example = [
-            "sftp.command='ssh backup@192.168.1.100 -i /home/user/.ssh/id_rsa -s sftp'"
-          ];
-        };
-
-        initialize = lib.mkOption {
-          type = lib.types.bool;
-          default = false;
-          description = ''
-            Create the repository if it doesn't exist.
-          '';
-        };
-
-        pruneOpts = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          default = [ ];
-          description = ''
-            A list of options (--keep-\* et al.) for 'restic forget
-            --prune', to automatically prune old snapshots.  The
-            'forget' command is run *after* the 'backup' command, so
-            keep that in mind when constructing the --keep-\* options.
-          '';
-          example = [
-            "--keep-daily 7"
-            "--keep-weekly 5"
-            "--keep-monthly 12"
-            "--keep-yearly 75"
-          ];
-        };
-
-        runCheck = lib.mkOption {
-          type = lib.types.bool;
-          default = (builtins.length config.services.restic.backups.${name}.checkOpts > 0);
-          defaultText = lib.literalExpression ''builtins.length config.services.backups.${name}.checkOpts > 0'';
-          description = "Whether to run the `check` command with the provided `checkOpts` options.";
-          example = true;
-        };
-
-        checkOpts = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          default = [ ];
-          description = ''
-            A list of options for 'restic check'.
-          '';
-          example = [
-            "--with-cache"
-          ];
-        };
-
-        dynamicFilesFrom = lib.mkOption {
-          type = with lib.types; nullOr str;
-          default = null;
-          description = ''
-            A script that produces a list of files to back up.  The
-            results of this command are given to the '--files-from'
-            option. The result is merged with paths specified via `paths`.
-          '';
-          example = "find /home/matt/git -type d -name .git";
-        };
-
-        backupPrepareCommand = lib.mkOption {
-          type = with lib.types; nullOr str;
-          default = null;
-          description = ''
-            A script that must run before starting the backup process.
-          '';
-        };
-
-        backupCleanupCommand = lib.mkOption {
-          type = with lib.types; nullOr str;
-          default = null;
-          description = ''
-            A script that must run after finishing the backup process.
-          '';
-        };
-
-        package = lib.mkPackageOption pkgs "restic" { };
-
-        createWrapper = lib.mkOption {
-          type = lib.types.bool;
-          default = true;
-          description = ''
-            Whether to generate and add a script to the system path, that has the same environment variables set
-            as the systemd service. This can be used to e.g. mount snapshots or perform other opterations, without
-            having to manually specify most options.
-          '';
-        };
-      };
-    }));
+        }
+      )
+    );
     default = { };
     example = {
       localbackup = {
@@ -300,119 +325,139 @@ in
       assertion = (v.repository == null) != (v.repositoryFile == null);
       message = "services.restic.backups.${n}: exactly one of repository or repositoryFile should be set";
     }) config.services.restic.backups;
-    systemd.services =
-      lib.mapAttrs'
-        (name: backup:
-          let
-            extraOptions = lib.concatMapStrings (arg: " -o ${arg}") backup.extraOptions;
-            inhibitCmd = lib.concatStringsSep " " [
-              "${pkgs.systemd}/bin/systemd-inhibit"
-              "--mode='block'"
-              "--who='restic'"
-              "--what='sleep'"
-              "--why=${lib.escapeShellArg "Scheduled backup ${name}"} "
-            ];
-            resticCmd = "${lib.optionalString backup.inhibitsSleep inhibitCmd}${backup.package}/bin/restic${extraOptions}";
-            excludeFlags = lib.optional (backup.exclude != []) "--exclude-file=${pkgs.writeText "exclude-patterns" (lib.concatStringsSep "\n" backup.exclude)}";
-            filesFromTmpFile = "/run/restic-backups-${name}/includes";
-            doBackup = (backup.dynamicFilesFrom != null) || (backup.paths != null && backup.paths != []);
-            pruneCmd = lib.optionals (builtins.length backup.pruneOpts > 0) [
-              (resticCmd + " forget --prune " + (lib.concatStringsSep " " backup.pruneOpts))
-            ];
-            checkCmd = lib.optionals backup.runCheck [
-                (resticCmd + " check " + (lib.concatStringsSep " " backup.checkOpts))
-            ];
-            # Helper functions for rclone remotes
-            rcloneRemoteName = builtins.elemAt (lib.splitString ":" backup.repository) 1;
-            rcloneAttrToOpt = v: "RCLONE_" + lib.toUpper (builtins.replaceStrings [ "-" ] [ "_" ] v);
-            rcloneAttrToConf = v: "RCLONE_CONFIG_" + lib.toUpper (rcloneRemoteName + "_" + v);
-            toRcloneVal = v: if lib.isBool v then lib.boolToString v else v;
-          in
-          lib.nameValuePair "restic-backups-${name}" ({
-            environment = {
+    systemd.services = lib.mapAttrs' (
+      name: backup:
+      let
+        extraOptions = lib.concatMapStrings (arg: " -o ${arg}") backup.extraOptions;
+        inhibitCmd = lib.concatStringsSep " " [
+          "${pkgs.systemd}/bin/systemd-inhibit"
+          "--mode='block'"
+          "--who='restic'"
+          "--what='sleep'"
+          "--why=${lib.escapeShellArg "Scheduled backup ${name}"} "
+        ];
+        resticCmd = "${lib.optionalString backup.inhibitsSleep inhibitCmd}${backup.package}/bin/restic${extraOptions}";
+        excludeFlags = lib.optional (
+          backup.exclude != [ ]
+        ) "--exclude-file=${pkgs.writeText "exclude-patterns" (lib.concatStringsSep "\n" backup.exclude)}";
+        filesFromTmpFile = "/run/restic-backups-${name}/includes";
+        doBackup = (backup.dynamicFilesFrom != null) || (backup.paths != null && backup.paths != [ ]);
+        pruneCmd = lib.optionals (builtins.length backup.pruneOpts > 0) [
+          (resticCmd + " forget --prune " + (lib.concatStringsSep " " backup.pruneOpts))
+        ];
+        checkCmd = lib.optionals backup.runCheck [
+          (resticCmd + " check " + (lib.concatStringsSep " " backup.checkOpts))
+        ];
+        # Helper functions for rclone remotes
+        rcloneRemoteName = builtins.elemAt (lib.splitString ":" backup.repository) 1;
+        rcloneAttrToOpt = v: "RCLONE_" + lib.toUpper (builtins.replaceStrings [ "-" ] [ "_" ] v);
+        rcloneAttrToConf = v: "RCLONE_CONFIG_" + lib.toUpper (rcloneRemoteName + "_" + v);
+        toRcloneVal = v: if lib.isBool v then lib.boolToString v else v;
+      in
+      lib.nameValuePair "restic-backups-${name}" (
+        {
+          environment =
+            {
               # not %C, because that wouldn't work in the wrapper script
               RESTIC_CACHE_DIR = "/var/cache/restic-backups-${name}";
               RESTIC_PASSWORD_FILE = backup.passwordFile;
               RESTIC_REPOSITORY = backup.repository;
               RESTIC_REPOSITORY_FILE = backup.repositoryFile;
-            } // lib.optionalAttrs (backup.rcloneOptions != null) (lib.mapAttrs'
-              (name: value:
-                lib.nameValuePair (rcloneAttrToOpt name) (toRcloneVal value)
-              )
-              backup.rcloneOptions) // lib.optionalAttrs (backup.rcloneConfigFile != null) {
+            }
+            // lib.optionalAttrs (backup.rcloneOptions != null) (
+              lib.mapAttrs' (
+                name: value: lib.nameValuePair (rcloneAttrToOpt name) (toRcloneVal value)
+              ) backup.rcloneOptions
+            )
+            // lib.optionalAttrs (backup.rcloneConfigFile != null) {
               RCLONE_CONFIG = backup.rcloneConfigFile;
-            } // lib.optionalAttrs (backup.rcloneConfig != null) (lib.mapAttrs'
-              (name: value:
-                lib.nameValuePair (rcloneAttrToConf name) (toRcloneVal value)
-              )
-              backup.rcloneConfig);
-            path = [ config.programs.ssh.package ];
-            restartIfChanged = false;
-            wants = [ "network-online.target" ];
-            after = [ "network-online.target" ];
-            serviceConfig = {
+            }
+            // lib.optionalAttrs (backup.rcloneConfig != null) (
+              lib.mapAttrs' (
+                name: value: lib.nameValuePair (rcloneAttrToConf name) (toRcloneVal value)
+              ) backup.rcloneConfig
+            );
+          path = [ config.programs.ssh.package ];
+          restartIfChanged = false;
+          wants = [ "network-online.target" ];
+          after = [ "network-online.target" ];
+          serviceConfig =
+            {
               Type = "oneshot";
-              ExecStart = (lib.optionals doBackup [ "${resticCmd} backup ${lib.concatStringsSep " " (backup.extraBackupArgs ++ excludeFlags)} --files-from=${filesFromTmpFile}" ])
-                ++ pruneCmd ++ checkCmd;
+              ExecStart =
+                (lib.optionals doBackup [
+                  "${resticCmd} backup ${
+                    lib.concatStringsSep " " (backup.extraBackupArgs ++ excludeFlags)
+                  } --files-from=${filesFromTmpFile}"
+                ])
+                ++ pruneCmd
+                ++ checkCmd;
               User = backup.user;
               RuntimeDirectory = "restic-backups-${name}";
               CacheDirectory = "restic-backups-${name}";
               CacheDirectoryMode = "0700";
               PrivateTmp = true;
-            } // lib.optionalAttrs (backup.environmentFile != null) {
+            }
+            // lib.optionalAttrs (backup.environmentFile != null) {
               EnvironmentFile = backup.environmentFile;
             };
-          } // lib.optionalAttrs (backup.initialize || doBackup || backup.backupPrepareCommand != null) {
-            preStart = ''
-              ${lib.optionalString (backup.backupPrepareCommand != null) ''
-                ${pkgs.writeScript "backupPrepareCommand" backup.backupPrepareCommand}
-              ''}
-              ${lib.optionalString (backup.initialize) ''
-                ${resticCmd} cat config > /dev/null || ${resticCmd} init
-              ''}
-              ${lib.optionalString (backup.paths != null && backup.paths != []) ''
-                cat ${pkgs.writeText "staticPaths" (lib.concatLines backup.paths)} >> ${filesFromTmpFile}
-              ''}
-              ${lib.optionalString (backup.dynamicFilesFrom != null) ''
-                ${pkgs.writeScript "dynamicFilesFromScript" backup.dynamicFilesFrom} >> ${filesFromTmpFile}
-              ''}
-            '';
-          } // lib.optionalAttrs (doBackup || backup.backupCleanupCommand != null) {
-            postStop = ''
-              ${lib.optionalString (backup.backupCleanupCommand != null) ''
-                ${pkgs.writeScript "backupCleanupCommand" backup.backupCleanupCommand}
-              ''}
-              ${lib.optionalString doBackup ''
-                rm ${filesFromTmpFile}
-              ''}
-            '';
-          })
-        )
-        config.services.restic.backups;
-    systemd.timers =
-      lib.mapAttrs'
-        (name: backup: lib.nameValuePair "restic-backups-${name}" {
-          wantedBy = [ "timers.target" ];
-          timerConfig = backup.timerConfig;
-        })
-        (lib.filterAttrs (_: backup: backup.timerConfig != null) config.services.restic.backups);
+        }
+        // lib.optionalAttrs (backup.initialize || doBackup || backup.backupPrepareCommand != null) {
+          preStart = ''
+            ${lib.optionalString (backup.backupPrepareCommand != null) ''
+              ${pkgs.writeScript "backupPrepareCommand" backup.backupPrepareCommand}
+            ''}
+            ${lib.optionalString (backup.initialize) ''
+              ${resticCmd} cat config > /dev/null || ${resticCmd} init
+            ''}
+            ${lib.optionalString (backup.paths != null && backup.paths != [ ]) ''
+              cat ${pkgs.writeText "staticPaths" (lib.concatLines backup.paths)} >> ${filesFromTmpFile}
+            ''}
+            ${lib.optionalString (backup.dynamicFilesFrom != null) ''
+              ${pkgs.writeScript "dynamicFilesFromScript" backup.dynamicFilesFrom} >> ${filesFromTmpFile}
+            ''}
+          '';
+        }
+        // lib.optionalAttrs (doBackup || backup.backupCleanupCommand != null) {
+          postStop = ''
+            ${lib.optionalString (backup.backupCleanupCommand != null) ''
+              ${pkgs.writeScript "backupCleanupCommand" backup.backupCleanupCommand}
+            ''}
+            ${lib.optionalString doBackup ''
+              rm ${filesFromTmpFile}
+            ''}
+          '';
+        }
+      )
+    ) config.services.restic.backups;
+    systemd.timers = lib.mapAttrs' (
+      name: backup:
+      lib.nameValuePair "restic-backups-${name}" {
+        wantedBy = [ "timers.target" ];
+        timerConfig = backup.timerConfig;
+      }
+    ) (lib.filterAttrs (_: backup: backup.timerConfig != null) config.services.restic.backups);
 
     # generate wrapper scripts, as described in the createWrapper option
-    environment.systemPackages = lib.mapAttrsToList (name: backup: let
-      extraOptions = lib.concatMapStrings (arg: " -o ${arg}") backup.extraOptions;
-      resticCmd = "${backup.package}/bin/restic${extraOptions}";
-    in pkgs.writeShellScriptBin "restic-${name}" ''
-      set -a  # automatically export variables
-      ${lib.optionalString (backup.environmentFile != null) "source ${backup.environmentFile}"}
-      # set same environment variables as the systemd service
-      ${lib.pipe config.systemd.services."restic-backups-${name}".environment [
-        (lib.filterAttrs (n: v: v != null && n != "PATH"))
-        (lib.mapAttrsToList (n: v: "${n}=${v}"))
-        (lib.concatStringsSep "\n")
-      ]}
-      PATH=${config.systemd.services."restic-backups-${name}".environment.PATH}:$PATH
+    environment.systemPackages = lib.mapAttrsToList (
+      name: backup:
+      let
+        extraOptions = lib.concatMapStrings (arg: " -o ${arg}") backup.extraOptions;
+        resticCmd = "${backup.package}/bin/restic${extraOptions}";
+      in
+      pkgs.writeShellScriptBin "restic-${name}" ''
+        set -a  # automatically export variables
+        ${lib.optionalString (backup.environmentFile != null) "source ${backup.environmentFile}"}
+        # set same environment variables as the systemd service
+        ${lib.pipe config.systemd.services."restic-backups-${name}".environment [
+          (lib.filterAttrs (n: v: v != null && n != "PATH"))
+          (lib.mapAttrsToList (n: v: "${n}=${v}"))
+          (lib.concatStringsSep "\n")
+        ]}
+        PATH=${config.systemd.services."restic-backups-${name}".environment.PATH}:$PATH
 
-      exec ${resticCmd} "$@"
-    '') (lib.filterAttrs (_: v: v.createWrapper) config.services.restic.backups);
+        exec ${resticCmd} "$@"
+      ''
+    ) (lib.filterAttrs (_: v: v.createWrapper) config.services.restic.backups);
   };
 }

From aca35b7fd69e7236f87046f8cea6c2ed13bad999 Mon Sep 17 00:00:00 2001
From: Tert0 <tert0byte@gmail.com>
Date: Thu, 30 Jan 2025 15:52:12 +0100
Subject: [PATCH 04/29] nixos/restic: add progressFps option

---
 nixos/modules/services/backup/restic.nix | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/backup/restic.nix b/nixos/modules/services/backup/restic.nix
index 9c3a9d2e36ce..cde2107eb3f4 100644
--- a/nixos/modules/services/backup/restic.nix
+++ b/nixos/modules/services/backup/restic.nix
@@ -292,6 +292,15 @@ in
                 having to manually specify most options.
               '';
             };
+
+            progressFps = lib.mkOption {
+              type = with lib.types; nullOr numbers.nonnegative;
+              default = null;
+              description = ''
+                Controls the frequency of progress reporting.
+              '';
+              example = 0.1;
+            };
           };
         }
       )
@@ -376,7 +385,10 @@ in
               lib.mapAttrs' (
                 name: value: lib.nameValuePair (rcloneAttrToConf name) (toRcloneVal value)
               ) backup.rcloneConfig
-            );
+            )
+            // lib.optionalAttrs (backup.progressFps != null) {
+              RESTIC_PROGRESS_FPS = toString backup.progressFps;
+            };
           path = [ config.programs.ssh.package ];
           restartIfChanged = false;
           wants = [ "network-online.target" ];

From f233c450839401a0daee9264346f7ab373a9f3d3 Mon Sep 17 00:00:00 2001
From: Tert0 <tert0byte@gmail.com>
Date: Thu, 26 Dec 2024 00:35:34 +0100
Subject: [PATCH 05/29] cups-brother-dcpl3550cdw: init at 1.0.2-0

---
 .../cu/cups-brother-dcpl3550cdw/package.nix   | 109 ++++++++++++++++++
 1 file changed, 109 insertions(+)
 create mode 100644 pkgs/by-name/cu/cups-brother-dcpl3550cdw/package.nix

diff --git a/pkgs/by-name/cu/cups-brother-dcpl3550cdw/package.nix b/pkgs/by-name/cu/cups-brother-dcpl3550cdw/package.nix
new file mode 100644
index 000000000000..b1ff4e01d229
--- /dev/null
+++ b/pkgs/by-name/cu/cups-brother-dcpl3550cdw/package.nix
@@ -0,0 +1,109 @@
+{
+  pkgsi686Linux,
+  lib,
+  stdenv,
+  fetchurl,
+  dpkg,
+  makeWrapper,
+  ghostscript,
+  file,
+  gnused,
+  gnugrep,
+  coreutils,
+  which,
+  perl,
+}:
+let
+  version = "1.0.2-0";
+  model = "dcpl3550cdw";
+  interpreter = "${pkgsi686Linux.stdenv.cc.libc}/lib/ld-linux.so.2";
+in
+stdenv.mkDerivation {
+  pname = "cups-brother-${model}";
+  inherit version;
+  src = fetchurl {
+    url = "https://download.brother.com/welcome/dlf103919/dcpl3550cdwpdrv-${version}.i386.deb";
+    hash = "sha256-FbtqISK3f1q1+JXJ+RP5O/8G0ZW9gcCS7OI0YRljwyY=";
+  };
+
+  nativeBuildInputs = [
+    dpkg
+    makeWrapper
+  ];
+
+  unpackPhase = ''
+    runHook preUnpack
+
+    dpkg-deb -x $src $out
+
+    runHook postUnpack
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    substituteInPlace $out/opt/brother/Printers/${model}/lpd/filter_${model} \
+      --replace-fail /usr/bin/perl ${lib.getExe perl} \
+      --replace-fail "PRINTER =~" "PRINTER = \"${model}\"; #" \
+      --replace-fail "BR_PRT_PATH =~" "BR_PRT_PATH = \"$out/opt/brother/Printers/${model}/\"; #"
+
+    substituteInPlace $out/opt/brother/Printers/${model}/cupswrapper/brother_lpdwrapper_${model} \
+      --replace-fail /usr/bin/perl ${lib.getExe perl} \
+      --replace-fail "basedir =~ " "basedir = \"$out/opt/brother/Printers/${model}/\"; #" \
+      --replace-fail "PRINTER =~ " "PRINTER = \"${model}\"; #" \
+      --replace-fail "LPDCONFIGEXE=" "LPDCONFIGEXE=\"$out/usr/bin/brprintconf_\"; #"
+
+    patchelf --set-interpreter ${interpreter} $out/opt/brother/Printers/${model}/lpd/br${model}filter
+    patchelf --set-interpreter ${interpreter} $out/usr/bin/brprintconf_${model}
+
+    mkdir -p $out/lib/cups/filter $out/share/cups/model
+    ln -s $out/opt/brother/Printers/${model}/lpd/filter_${model} $out/lib/cups/filter/brlpdwrapper${model}
+    ln -s $out/opt/brother/Printers/${model}/cupswrapper/brother_lpdwrapper_${model} $out/lib/cups/filter/brother_lpdwrapper_${model}
+    ln -s $out/opt/brother/Printers/${model}/cupswrapper/brother_${model}_printer_en.ppd $out/share/cups/model/brother_${model}_printer_en.ppd
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    wrapProgram $out/opt/brother/Printers/${model}/lpd/filter_${model} \
+        --prefix PATH ":" ${
+          lib.makeBinPath [
+            ghostscript
+            file
+            gnused
+            gnugrep
+            coreutils
+            which
+          ]
+        }
+    wrapProgram $out/opt/brother/Printers/${model}/cupswrapper/brother_lpdwrapper_${model} \
+      --prefix PATH ":" ${
+        lib.makeBinPath [
+          gnugrep
+          coreutils
+        ]
+      }
+    wrapProgram $out/usr/bin/brprintconf_${model} \
+      --set LD_PRELOAD "${pkgsi686Linux.libredirect}/lib/libredirect.so" \
+      --set NIX_REDIRECTS /opt=$out/opt
+    wrapProgram $out/opt/brother/Printers/${model}/lpd/br${model}filter \
+      --set LD_PRELOAD "${pkgsi686Linux.libredirect}/lib/libredirect.so" \
+      --set NIX_REDIRECTS /opt=$out/opt
+  '';
+
+  meta = {
+    homepage = "https://www.brother.com/";
+    downloadPage = "https://support.brother.com/g/b/downloadlist.aspx?c=eu_ot&lang=en&prod=${model}_eu&os=128";
+    description = "Brother DCP-L3550CDW printer driver";
+    license = with lib.licenses; [
+      unfreeRedistributable
+      gpl2Only
+    ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+    maintainers = with lib.maintainers; [ Tert0 ];
+  };
+}

From e82a00718398f3ffeeb0a4d43896e30ed2f43754 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 1 Feb 2025 12:12:43 +0100
Subject: [PATCH 06/29] python313Packages.boto3-stubs: 1.36.10 -> 1.36.11

---
 pkgs/development/python-modules/boto3-stubs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index c9b34c0c920b..6663feddc114 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -359,7 +359,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.36.10";
+  version = "1.36.11";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -367,7 +367,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-/fgvvifEuQnfEwgJIv4nsuVlv1tUa/7JgF5m6YPBtdk=";
+    hash = "sha256-tBzTzvXEQvL3fRCkYJ//qowiMjKzYRVK9nT1WWUfcIk=";
   };
 
   build-system = [ setuptools ];

From 8b55ae776f0611a7802d14bc035451df799e787c Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 1 Feb 2025 12:12:46 +0100
Subject: [PATCH 07/29] python313Packages.botocore-stubs: 1.36.10 -> 1.36.11

---
 pkgs/development/python-modules/botocore-stubs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index f2893710fa47..6c37fbbf0b33 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.36.10";
+  version = "1.36.11";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-Jubwgr4mJigOgCEAK1u1j4DffOmtXgF5AaAxv0FBe4c=";
+    hash = "sha256-TBjwmUJURW+DTQEp7R9JQhyM2ABHxOXbkAcPafDm89I=";
   };
 
   nativeBuildInputs = [ setuptools ];

From 38d77124d7389a1738021db6dbe65d66d83dd322 Mon Sep 17 00:00:00 2001
From: nayeko <nayeko@users.noreply.github.com>
Date: Sun, 2 Feb 2025 05:31:21 +0800
Subject: [PATCH 08/29] tgpt: 2.7.4 -> 2.9.0

---
 pkgs/by-name/tg/tgpt/package.nix | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/tg/tgpt/package.nix b/pkgs/by-name/tg/tgpt/package.nix
index 6abb1dd1401d..c0f0a1d3104d 100644
--- a/pkgs/by-name/tg/tgpt/package.nix
+++ b/pkgs/by-name/tg/tgpt/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "tgpt";
-  version = "2.7.4";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "aandrew-me";
     repo = "tgpt";
     tag = "v${version}";
-    hash = "sha256-Nk+iLsTXnw6RAc1VztW8ZqeUVsywFjMCOBY2yuWbUXQ=";
+    hash = "sha256-8R6rb4GvSf4nw78Yxcuh9Vct/qUTkQNatRolT1m7JR4=";
   };
 
-  vendorHash = "sha256-docq/r6yyMPsuUyFbtCMaYfEVL0gLmyTy4PbrAemR00=";
+  vendorHash = "sha256-HObEC0SqSHJOgiJxlniN4yJ3U8ksv1HeiMhtOiZRq50=";
 
   ldflags = [
     "-s"
@@ -25,14 +25,15 @@ buildGoModule rec {
   preCheck = ''
     # Remove test which need network access
     rm providers/koboldai/koboldai_test.go
+    rm providers/phind/phind_test.go
   '';
 
-  meta = with lib; {
+  meta = {
     description = "ChatGPT in terminal without needing API keys";
     homepage = "https://github.com/aandrew-me/tgpt";
     changelog = "https://github.com/aandrew-me/tgpt/releases/tag/v${version}";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ fab ];
     mainProgram = "tgpt";
   };
 }

From b47982cc709c1da6900926c7bb1518175503f430 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 24 Jan 2025 22:21:22 +0000
Subject: [PATCH 09/29] diffoscope: 285 -> 287

Changes:
- https://diffoscope.org/news/diffoscope-286-released/
- https://diffoscope.org/news/diffoscope-287-released/
---
 pkgs/tools/misc/diffoscope/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/diffoscope/default.nix b/pkgs/tools/misc/diffoscope/default.nix
index f2846c846abf..6f0efb5fc4ee 100644
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@@ -106,11 +106,11 @@ in
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "285";
+  version = "287";
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-OTS4Lr2OF1mdIAiPGK31Ptc/gr3D216Z1kvKOMNeaJI=";
+    hash = "sha256-0s7pT8pAMCE+csd9/+Dv4AbCK0qxDacQ9fNcMYCNDbw=";
   };
 
   outputs = [

From c397110901d896fa8f7d012136eed54fbeaf34e4 Mon Sep 17 00:00:00 2001
From: Torsten Trautwein <trautwein@fastmail.com>
Date: Fri, 24 Jan 2025 09:04:40 +0100
Subject: [PATCH 10/29] nixos/immich: Add accelerationDevices configuration
 option

This allows immich to utilize devices for hardware accelerated video
transcoding.
---
 nixos/modules/services/web-apps/immich.nix | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/immich.nix b/nixos/modules/services/web-apps/immich.nix
index fa80c47305ba..cc7d5ff6f39e 100644
--- a/nixos/modules/services/web-apps/immich.nix
+++ b/nixos/modules/services/web-apps/immich.nix
@@ -20,7 +20,8 @@ let
     NoNewPrivileges = true;
     PrivateUsers = true;
     PrivateTmp = true;
-    PrivateDevices = true;
+    PrivateDevices = cfg.accelerationDevices == [ ];
+    DeviceAllow = mkIf (cfg.accelerationDevices != null) cfg.accelerationDevices;
     PrivateMounts = true;
     ProtectClock = true;
     ProtectControlGroups = true;
@@ -161,6 +162,17 @@ in
       };
     };
 
+    accelerationDevices = mkOption {
+      type = types.nullOr (types.listOf types.str);
+      default = [ ];
+      example = [ "/dev/dri/renderD128" ];
+      description = ''
+        A list of device paths to hardware acceleration devices that immich should
+        have access to. This is useful when transcoding media files.
+        The special value `[ ]` will disallow all devices using `PrivateDevices`. `null` will give access to all devices.
+      '';
+    };
+
     database = {
       enable =
         mkEnableOption "the postgresql database for use with immich. See {option}`services.postgresql`"

From b309fd081b0bc4c6c1d45d8b533f3ac76170b9f2 Mon Sep 17 00:00:00 2001
From: FliegendeWurst <arne.keller@posteo.de>
Date: Sun, 2 Feb 2025 21:30:17 +0100
Subject: [PATCH 11/29] python312Packages.enturclient: fix build, misc. cleanup

---
 .../python-modules/enturclient/default.nix    | 27 +++++++++++--------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/python-modules/enturclient/default.nix b/pkgs/development/python-modules/enturclient/default.nix
index 1b62fc88ef50..372bdf17e075 100644
--- a/pkgs/development/python-modules/enturclient/default.nix
+++ b/pkgs/development/python-modules/enturclient/default.nix
@@ -6,14 +6,15 @@
   fetchFromGitHub,
   poetry-core,
   pythonOlder,
+  unittestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "enturclient";
   version = "0.2.4";
-  disabled = pythonOlder "3.8";
+  pyproject = true;
 
-  format = "pyproject";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "hfurubotten";
@@ -22,23 +23,27 @@ buildPythonPackage rec {
     hash = "sha256-Y2sBPikCAxumylP1LUy8XgjBRCWaNryn5XHSrRjJIIo=";
   };
 
-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ poetry-core ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     async-timeout
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'async_timeout = "^3.0.1"' 'async_timeout = ">=3.0.1"'
-  '';
-
-  # Project has no tests
-  doCheck = false;
+  pythonRelaxDeps = [
+    "async_timeout"
+  ];
 
   pythonImportsCheck = [ "enturclient" ];
 
+  nativeCheckInputs = [
+    unittestCheckHook
+  ];
+
+  unittestFlagsArray = [
+    "tests/dto/"
+  ];
+
   meta = with lib; {
     description = "Python library for interacting with the Entur.org API";
     homepage = "https://github.com/hfurubotten/enturclient";

From ad0af4d8d155b75f0c3541fbd3070c40cd5b0d12 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 3 Feb 2025 16:12:27 +0100
Subject: [PATCH 12/29] checkov: 3.2.360 -> 3.2.361

Diff: https://github.com/bridgecrewio/checkov/compare/refs/tags/3.2.360...3.2.361

Changelog: https://github.com/bridgecrewio/checkov/releases/tag/3.2.361
---
 pkgs/development/tools/analysis/checkov/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index f7c8af22db8e..5a48bb73d802 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.360";
+  version = "3.2.361";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     tag = version;
-    hash = "sha256-kFLtEVbj0XTa19MOS0di6bHBMHeHH4b9+H/iHqV39kU=";
+    hash = "sha256-7w8oAIBAgYH/TXNnAVKC6E3AT37WJDSSgnpAeRfY4vA=";
   };
 
   patches = [ ./flake8-compat-5.x.patch ];

From c4e076079c160a3710880fb532a563f366cced3c Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 3 Feb 2025 16:24:23 +0100
Subject: [PATCH 13/29] python313Packages.aiosmtplib: 3.0.2 -> 4.0.0

Diff: https://github.com/cole/aiosmtplib/compare/refs/tags/v3.0.2...v4.0.0

Changelog: https://github.com/cole/aiosmtplib/releases/tag/v4.0.0
---
 pkgs/development/python-modules/aiosmtplib/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiosmtplib/default.nix b/pkgs/development/python-modules/aiosmtplib/default.nix
index 12c49c681005..b737d7135306 100644
--- a/pkgs/development/python-modules/aiosmtplib/default.nix
+++ b/pkgs/development/python-modules/aiosmtplib/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aiosmtplib";
-  version = "3.0.2";
+  version = "4.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "cole";
     repo = "aiosmtplib";
     tag = "v${version}";
-    hash = "sha256-1GuxlgNvzVv6hEQY1Mkv7NxAoOik9gpIS90a6flfC+k=";
+    hash = "sha256-Bj5wkNaNm9ojjffsS4nNKUucwbitvApIK1Ux88MSOoE=";
   };
 
   build-system = [ hatchling ];

From cf3d305b41e25d73ec3c6a4718086b770e9a3047 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 3 Feb 2025 16:29:29 +0100
Subject: [PATCH 14/29] python313Packages.aiosmtplib: refactor

---
 pkgs/development/python-modules/aiosmtplib/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiosmtplib/default.nix b/pkgs/development/python-modules/aiosmtplib/default.nix
index b737d7135306..bf3346f83183 100644
--- a/pkgs/development/python-modules/aiosmtplib/default.nix
+++ b/pkgs/development/python-modules/aiosmtplib/default.nix
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   version = "4.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "cole";
@@ -41,7 +41,7 @@ buildPythonPackage rec {
     description = "Module which provides a SMTP client";
     homepage = "https://github.com/cole/aiosmtplib";
     changelog = "https://github.com/cole/aiosmtplib/releases/tag/v${version}";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }

From 3f2aff1378879a8baf91c04bc19ce1163439bc9e Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Mon, 3 Feb 2025 19:00:51 +0100
Subject: [PATCH 15/29] yara-x: 0.12.0 -> 0.13.0

https://github.com/VirusTotal/yara-x/releases/tag/v0.13.0
---
 pkgs/by-name/ya/yara-x/package.nix | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ya/yara-x/package.nix b/pkgs/by-name/ya/yara-x/package.nix
index 050c331e002d..d3c00c58559f 100644
--- a/pkgs/by-name/ya/yara-x/package.nix
+++ b/pkgs/by-name/ya/yara-x/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
-  cmake,
   installShellFiles,
   testers,
   yara-x,
@@ -11,19 +10,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "yara-x";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara-x";
     tag = "v${version}";
-    hash = "sha256-gIYqWRJI/IZwEyc1Fke/CD8PPoSZvwtvOT0rnK+LFIo=";
+    hash = "sha256-ZSJHvpRZO6Tbw7Ct4oD6QmuV4mJ4RGW5gnT6PTX+nC8=";
   };
 
-  cargoHash = "sha256-hlwHF6ESrRpXduXZmC/svldzYuoIwwOllf5pSbvEpCM=";
+  cargoHash = "sha256-IK6EAN0vn2V4GEOhDRFfGbehHELWQglFJVTlTonSka4=";
 
   nativeBuildInputs = [
-    cmake
     installShellFiles
   ];
 

From 6a92422184eaeb0bfc33e5e0318a42e6279c39c7 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Mon, 3 Feb 2025 12:43:01 -0600
Subject: [PATCH 16/29] vimPlugins.ctags-lsp-nvim: init at 2024-12-08

---
 pkgs/applications/editors/vim/plugins/generated.nix  | 12 ++++++++++++
 .../editors/vim/plugins/vim-plugin-names             |  1 +
 2 files changed, 13 insertions(+)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 2f724348c701..891680e449d2 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -3007,6 +3007,18 @@ final: prev:
     meta.homepage = "https://github.com/hat0uma/csvview.nvim/";
   };
 
+  ctags-lsp-nvim = buildVimPlugin {
+    pname = "ctags-lsp.nvim";
+    version = "2024-12-08";
+    src = fetchFromGitHub {
+      owner = "netmute";
+      repo = "ctags-lsp.nvim";
+      rev = "aaae7b5d8dc7aeb836c63301b8eb7311af49bb2a";
+      sha256 = "06h388vkp8nv15wbh96pza85994xf979s7kjqrli4s6y5ygw6m02";
+    };
+    meta.homepage = "https://github.com/netmute/ctags-lsp.nvim/";
+  };
+
   ctrlp-cmatcher = buildVimPlugin {
     pname = "ctrlp-cmatcher";
     version = "2015-10-15";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 812b04c932fb..3b96955440fb 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -248,6 +248,7 @@ https://github.com/Decodetalkers/csharpls-extended-lsp.nvim/,HEAD,
 https://github.com/davidmh/cspell.nvim/,HEAD,
 https://github.com/chrisbra/csv.vim/,,
 https://github.com/hat0uma/csvview.nvim/,HEAD,
+https://github.com/netmute/ctags-lsp.nvim/,HEAD,
 https://github.com/JazzCore/ctrlp-cmatcher/,,
 https://github.com/FelikZ/ctrlp-py-matcher/,,
 https://github.com/amiorin/ctrlp-z/,,

From 2c3fc4c71575868b72aa4c82a777fa5710c2b9ed Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 3 Feb 2025 20:05:48 +0100
Subject: [PATCH 17/29] linux/common-config: update for 6.14

> Existing users of CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE=y should use
> CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO.

Link: https://git.kernel.org/linus/44d46b76c3a4b514a0cc9dab147ed430e5c1d699
---
 pkgs/os-specific/linux/kernel/common-config.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 4c9e256a8dcb..0f7606c79b53 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -1342,7 +1342,8 @@ let
             ACPI_HOTPLUG_CPU = yes;
             ACPI_HOTPLUG_MEMORY = yes;
             MEMORY_HOTPLUG = yes;
-            MEMORY_HOTPLUG_DEFAULT_ONLINE = yes;
+            MEMORY_HOTPLUG_DEFAULT_ONLINE = whenOlder "6.14" yes;
+            MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO = whenAtLeast "6.14" yes;
             MEMORY_HOTREMOVE = yes;
             HOTPLUG_CPU = yes;
             MIGRATION = yes;

From 580ccd0ecc820494a77ec52c2e6e402cca180573 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 3 Feb 2025 19:39:32 +0100
Subject: [PATCH 18/29] linux_testing: 6.13-rc7 -> 6.14-rc1

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 5ab026e291b8..5488bb52e1d7 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "6.13-rc7",
-        "hash": "sha256:12c9bd0ikppkdpqmvg7g2062s60ks9p0qxx1jis29wl9swr74120"
+        "version": "6.14-rc1",
+        "hash": "sha256:0schcgij7kdzj0zb6g3sjf32mq7s388hysrfzjzi5g1y3py21igk"
     },
     "6.1": {
         "version": "6.1.128",

From e9c363c6285a8d767dd51b96fba8bfe7c7985d96 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 3 Feb 2025 19:42:38 +0100
Subject: [PATCH 19/29] linux-rt_5_10: 5.10.231-rt123 -> 5.10.233-rt125

---
 pkgs/os-specific/linux/kernel/linux-rt-5.10.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index a56dcefd49a9..db1cef1ae7c7 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -10,7 +10,7 @@
 }@args:
 
 let
-  version = "5.10.231-rt123"; # updated by ./update-rt.sh
+  version = "5.10.233-rt125"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in
@@ -25,7 +25,7 @@ buildLinux (
 
     src = fetchurl {
       url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-      sha256 = "0xcnlz5ib4b368z5cyp4qwys3jsbm18wlvwn73rzj2j6rj1lhnjn";
+      sha256 = "0lkz2g8r032f027j3gih3f7crx991mrpng9qgqc5k4cc1wl5g7i3";
     };
 
     kernelPatches =
@@ -34,7 +34,7 @@ buildLinux (
           name = "rt";
           patch = fetchurl {
             url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-            sha256 = "01ibh8krzmwdh7229fc3ajbg1mlmd4sv969px6nh7z8fvpb60lfn";
+            sha256 = "1cx91p88h169v69lxz7vbjjnxdzdz9v28liypz099xghibwhcwfh";
           };
         };
       in

From 1017c9f0ccf263fed38516f6f439d7f9a76306e6 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 3 Feb 2025 19:44:09 +0100
Subject: [PATCH 20/29] linux-rt_5_15: 5.15.173-rt82 -> 5.15.177-rt83

---
 pkgs/os-specific/linux/kernel/linux-rt-5.15.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
index 648938217933..ec8816894f78 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
@@ -10,7 +10,7 @@
 }@args:
 
 let
-  version = "5.15.173-rt82"; # updated by ./update-rt.sh
+  version = "5.15.177-rt83"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in
@@ -29,7 +29,7 @@ buildLinux (
 
     src = fetchurl {
       url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-      sha256 = "1a3x3ld6g7ny0hdfqfvj5j2i5sx5l5p236pdnsr0icn9ri3jljwa";
+      sha256 = "1q56w3lqwi3ynny6z7siqzv3h8nryksyw70r3fhghca2il4bi7pa";
     };
 
     kernelPatches =
@@ -38,7 +38,7 @@ buildLinux (
           name = "rt";
           patch = fetchurl {
             url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-            sha256 = "1xykbqkj4pqd7rdqnjk91mbdia3lxlng3c2nz7lnhhjnbva6b3vw";
+            sha256 = "1rc0cbc5jkgr3q3q2syqidak744lxcq3f5zdq6si2rsfxjz45www";
           };
         };
       in

From 32c81b7581b19fc3fa35049cdc0194b66a012537 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 3 Feb 2025 19:48:07 +0100
Subject: [PATCH 21/29] linux-rt_6_1: 6.1.120-rt47 -> 6.1.127-rt48

---
 pkgs/os-specific/linux/kernel/linux-rt-6.1.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
index 78f1c77db53c..088c7ef0fe50 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
@@ -10,7 +10,7 @@
 }@args:
 
 let
-  version = "6.1.120-rt47"; # updated by ./update-rt.sh
+  version = "6.1.127-rt48"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in
@@ -29,7 +29,7 @@ buildLinux (
 
     src = fetchurl {
       url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-      sha256 = "06gp5fdq0bc39hd8mf9mrdrygdybdr3nzsb58lcapf5vmjw9gjb1";
+      sha256 = "0xkqpwhvz6qhaxzg1j993lv1iyvb2zydgq6d8mhdbfkz38fx9c0q";
     };
 
     kernelPatches =
@@ -38,7 +38,7 @@ buildLinux (
           name = "rt";
           patch = fetchurl {
             url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-            sha256 = "0nq8diqbanlkglb0liva3s43wx8g6pr9znvl9cq6df093by4gcya";
+            sha256 = "1sq79iibjsph3jmmihabamzmm4sr68sw87jqqa3khzq7f2s6cwmg";
           };
         };
       in

From faf8bf712dd8839b68d7853b73c311ad1eb6dca4 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 3 Feb 2025 19:48:56 +0100
Subject: [PATCH 22/29] linux-rt_6_6: 6.6.65-rt47 -> 6.6.74-rt48

---
 pkgs/os-specific/linux/kernel/linux-rt-6.6.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
index 15f738348095..3210da6a022b 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
@@ -10,7 +10,7 @@
 }@args:
 
 let
-  version = "6.6.65-rt47"; # updated by ./update-rt.sh
+  version = "6.6.74-rt48"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in
@@ -29,7 +29,7 @@ buildLinux (
 
     src = fetchurl {
       url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-      sha256 = "1q53xiwnszchl9c4g4yfxyzk4nffzgb4a7aq9rsyg1jcidp4gqbs";
+      sha256 = "0ka9snxl0y57fajy8vszwa4ggn48pid8m1879d4vl3mbicd2nppi";
     };
 
     kernelPatches =
@@ -38,7 +38,7 @@ buildLinux (
           name = "rt";
           patch = fetchurl {
             url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-            sha256 = "1sb6mmbiwh7kijb2bxhlz09dgvd2hpxh6rxghwi1d4cg2151jsr5";
+            sha256 = "1rpbbm9fln2v6xigxrsajivr4zmh0nika3nmm1y7ws31njkg57gq";
           };
         };
       in

From b49bd29d0fb39731fb06a78e487cd45015841813 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 3 Feb 2025 19:49:03 +0100
Subject: [PATCH 23/29] linux_latest-libre: 19683 -> 19707

---
 pkgs/os-specific/linux/kernel/linux-libre.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 0e541e127cae..6dcf421c690f 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -5,8 +5,8 @@
   linux,
   scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19683";
-    sha256 = "1xp4vslbvvwys2pmms3y9phxwc7gnar3zvbwbgbp9vgjq0bsadjw";
+    rev = "19707";
+    sha256 = "1ixvavd9rhhwfnyvkdnyyjwckdijh02xppl0sjv1vw9i0jn1s1l2";
   },
   ...
 }@args:

From 5c1fa4a4381c2e2e11a848bacf7184cd76800931 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 5 Jan 2025 22:52:18 +0100
Subject: [PATCH 24/29] python312Packages.pynfsclient: init at 0.1.5

Pure python NFS client

https://pypi.org/project/pyNfsClient/
---
 .../python-modules/pynfsclient/default.nix    | 38 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 40 insertions(+)
 create mode 100644 pkgs/development/python-modules/pynfsclient/default.nix

diff --git a/pkgs/development/python-modules/pynfsclient/default.nix b/pkgs/development/python-modules/pynfsclient/default.nix
new file mode 100644
index 000000000000..cda64710c0c5
--- /dev/null
+++ b/pkgs/development/python-modules/pynfsclient/default.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "pynfsclient";
+  version = "0.1.5";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "pyNfsClient";
+    inherit version;
+    hash = "sha256-xgZL08NlMCpSkALQwklh7Xq16bK2Sm2hAynbrIWsgaU=";
+  };
+
+  postPatch = ''
+    # HISTORY.md is missing
+    substituteInPlace setup.py \
+      --replace-fail "HISTORY.md" "README.rst"
+  '';
+
+  build-system = [ setuptools ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "pyNfsClient" ];
+
+  meta = {
+    description = "Pure python NFS client";
+    homepage = "https://pypi.org/project/pyNfsClient/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 68d4ddea886b..79c239dfbc38 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10699,6 +10699,8 @@ self: super: with self; {
 
   pylsl = callPackage ../development/python-modules/pylsl { };
 
+  pynfsclient = callPackage ../development/python-modules/pynfsclient { };
+
   pyngo = callPackage ../development/python-modules/pyngo { };
 
   pyngrok = callPackage ../development/python-modules/pyngrok { };

From efe51355b4732aff65c99d75133fb7d9aa3690f0 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 6 Jan 2025 00:53:29 +0100
Subject: [PATCH 25/29] netexec: 1.1.0-unstable-2024-01-15 -> 1.3.0

Diff: https://github.com/Pennyw0rth/NetExec/compare/refs/tags/v1.1.0...v1.3.0

Changelog: https://github.com/Pennyw0rth/NetExec/releases/tag/v1.3.0
---
 pkgs/tools/security/netexec/default.nix | 42 ++++++++++++++-----------
 1 file changed, 24 insertions(+), 18 deletions(-)

diff --git a/pkgs/tools/security/netexec/default.nix b/pkgs/tools/security/netexec/default.nix
index 81659210895c..f3145427148f 100644
--- a/pkgs/tools/security/netexec/default.nix
+++ b/pkgs/tools/security/netexec/default.nix
@@ -27,32 +27,35 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "netexec";
-  version = "1.1.0-unstable-2024-01-15";
+  version = "1.3.0";
   pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Pennyw0rth";
+    repo = "NetExec";
+    tag = "v${version}";
+    hash = "sha256-Pub7PAw6CTN4c/PHTPE9KcnDR2a6hSza1ODp3EWMOH0=";
+  };
+
   pythonRelaxDeps = true;
+
   pythonRemoveDeps = [
     # Fail to detect dev version requirement
     "neo4j"
   ];
 
-  src = fetchFromGitHub {
-    owner = "Pennyw0rth";
-    repo = "NetExec";
-    rev = "9df72e2f68b914dfdbd75b095dd8f577e992615f";
-    hash = "sha256-oQHtTE5hdlxHX4uc412VfNUrN0UHVbwI0Mm9kmJpNW4=";
-  };
-
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace '{ git = "https://github.com/Pennyw0rth/impacket.git", branch = "gkdi" }' '"*"' \
-      --replace '{ git = "https://github.com/Pennyw0rth/oscrypto" }' '"*"'
+      --replace-fail '{ git = "https://github.com/fortra/impacket.git" }' '"*"' \
+      --replace-fail '{ git = "https://github.com/Pennyw0rth/NfsClient" }' '"*"'
   '';
 
-  nativeBuildInputs = with python.pkgs; [
+  build-system = with python.pkgs; [
     poetry-core
+    poetry-dynamic-versioning
   ];
 
-  propagatedBuildInputs = with python.pkgs; [
+  dependencies = with python.pkgs; [
     aardwolf
     aioconsole
     aiosqlite
@@ -67,13 +70,15 @@ python.pkgs.buildPythonApplication rec {
     masky
     minikerberos
     msgpack
+    msldap
     neo4j
-    oscrypto
     paramiko
     pyasn1-modules
     pylnk3
+    pynfsclient
     pypsrp
     pypykatz
+    python-dateutil
     python-libnmap
     pywerview
     requests
@@ -84,9 +89,10 @@ python.pkgs.buildPythonApplication rec {
     xmltodict
   ];
 
-  nativeCheckInputs = with python.pkgs; [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = with python.pkgs; [ pytestCheckHook ];
+
+  # Tests no longer works out-of-box with 1.3.0
+  doCheck = false;
 
   preCheck = ''
     export HOME=$(mktemp -d)
@@ -96,9 +102,9 @@ python.pkgs.buildPythonApplication rec {
     description = "Network service exploitation tool (maintained fork of CrackMapExec)";
     homepage = "https://github.com/Pennyw0rth/NetExec";
     changelog = "https://github.com/Pennyw0rth/NetExec/releases/tag/v${version}";
-    license = with licenses; [ bsd2 ];
-    mainProgram = "nxc";
+    license = licenses.bsd2;
     maintainers = with maintainers; [ vncsb ];
+    mainProgram = "nxc";
     # FIXME: failing fixupPhase:
     # $ Rewriting #!/nix/store/<hash>-python3-3.11.7/bin/python3.11 to #!/nix/store/<hash>-python3-3.11.7
     # $ /nix/store/<hash>-wrap-python-hook/nix-support/setup-hook: line 65: 47758 Killed: 9               sed -i "$f" -e "1 s^#!/nix/store/<hash>-python3-3.11.7^#!/nix/store/<hash>-python3-3.11.7^"

From 9398c621bed20e7d9e65bcc0bd62f9ef4de0d85f Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Mon, 3 Feb 2025 12:56:30 -0600
Subject: [PATCH 26/29] vimPlugins.blink-cmp-git: init at 2025-01-27

---
 pkgs/applications/editors/vim/plugins/generated.nix  | 12 ++++++++++++
 pkgs/applications/editors/vim/plugins/overrides.nix  |  4 ++++
 .../editors/vim/plugins/vim-plugin-names             |  1 +
 3 files changed, 17 insertions(+)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index f68e38d634b7..20b536396919 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -1314,6 +1314,18 @@ final: prev:
     meta.homepage = "https://github.com/ribru17/blink-cmp-spell/";
   };
 
+  blink-cmp-git = buildVimPlugin {
+    pname = "blink-cmp-git";
+    version = "2025-01-27";
+    src = fetchFromGitHub {
+      owner = "Kaiser-Yang";
+      repo = "blink-cmp-git";
+      rev = "7c6cfa3d427f50a6eae5c38628b31b8675bab05d";
+      sha256 = "08hfwnjgsl88bkphpdxkdswdnc10mlxpsrk084kgzk4j19w55gyq";
+    };
+    meta.homepage = "https://github.com/Kaiser-Yang/blink-cmp-git/";
+  };
+
   blink-compat = buildVimPlugin {
     pname = "blink.compat";
     version = "2025-01-20";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index bd9f3940bf2a..953d95428e5d 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -296,6 +296,10 @@ in
     dependencies = [ self.blink-cmp ];
   };
 
+  blink-cmp-git = super.blink-cmp-git.overrideAttrs {
+    dependencies = [ self.plenary-nvim ];
+  };
+
   bluloco-nvim = super.bluloco-nvim.overrideAttrs {
     dependencies = [ self.lush-nvim ];
   };
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 88fe6203cdd3..1acdec95428e 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -106,6 +106,7 @@ https://github.com/max397574/better-escape.nvim/,,
 https://github.com/LunarVim/bigfile.nvim/,,
 https://github.com/APZelos/blamer.nvim/,HEAD,
 https://github.com/giuxtaposition/blink-cmp-copilot/,HEAD,
+https://github.com/Kaiser-Yang/blink-cmp-git/,HEAD,
 https://github.com/ribru17/blink-cmp-spell/,HEAD,
 https://github.com/fang2hou/blink-copilot/,HEAD,
 https://github.com/moyiz/blink-emoji.nvim/,HEAD,

From ddc4da2c8ba0e7fff69575bf6a0930a491e810de Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 3 Feb 2025 20:17:13 +0100
Subject: [PATCH 27/29] python313Packages.pynfsclient: disable on > 3.13

---
 pkgs/development/python-modules/pynfsclient/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/pynfsclient/default.nix b/pkgs/development/python-modules/pynfsclient/default.nix
index cda64710c0c5..11b0d47f2939 100644
--- a/pkgs/development/python-modules/pynfsclient/default.nix
+++ b/pkgs/development/python-modules/pynfsclient/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  pythonAtLeast,
   setuptools,
 }:
 
@@ -10,6 +11,8 @@ buildPythonPackage rec {
   version = "0.1.5";
   pyproject = true;
 
+  disabled = pythonAtLeast "3.13";
+
   src = fetchPypi {
     pname = "pyNfsClient";
     inherit version;

From eb3431789cef743af9dace58eb2ba7b33a332b56 Mon Sep 17 00:00:00 2001
From: FliegendeWurst <arne.keller@posteo.de>
Date: Wed, 29 Jan 2025 10:17:09 +0100
Subject: [PATCH 28/29] systemd: add missing patch for Musl

For context, see https://github.com/systemd/systemd/issues/35755.
Musl defines fork and setsid only if unistd.h is included.
---
 pkgs/os-specific/linux/systemd/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 59ecbb865ef9..11492bd163e3 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -17,6 +17,7 @@
   getent,
   glibcLocales,
   autoPatchelfHook,
+  fetchpatch,
 
   # glib is only used during tests (test-bus-gvariant, test-bus-marshal)
   glib,
@@ -281,6 +282,14 @@ stdenv.mkDerivation (finalAttrs: {
         "0025-adjust-header-inclusion-order-to-avoid-redeclaration.patch"
         "0026-build-path.c-avoid-boot-time-segfault-for-musl.patch"
       ]
+      ++ [
+        # add a missing include
+        (fetchpatch {
+          url = "https://github.com/systemd/systemd/commit/34fcd3638817060c79e1186b370e46d9b3a7409f.patch";
+          hash = "sha256-Uaewo3jPrZGJttlLcqO6cCj1w3IGZmvbur4+TBdIPxc=";
+          excludes = [ "src/udev/udevd.c" ];
+        })
+      ]
     );
 
   postPatch =

From e543b8a4a12b4b439d01fe18ac898efa7b35abab Mon Sep 17 00:00:00 2001
From: raf <raf@notashelf.dev>
Date: Mon, 3 Feb 2025 20:03:01 +0000
Subject: [PATCH 29/29] soteria: update hash after upstream re-tag (#379135)

Enable `useFetchCargoVendor`
---
 pkgs/by-name/so/soteria/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/so/soteria/package.nix b/pkgs/by-name/so/soteria/package.nix
index 1b32e51d4595..f815d91a4ab4 100644
--- a/pkgs/by-name/so/soteria/package.nix
+++ b/pkgs/by-name/so/soteria/package.nix
@@ -22,10 +22,11 @@ rustPlatform.buildRustPackage {
     owner = "imvaskel";
     repo = "soteria";
     tag = "v${version}";
-    hash = "sha256-CinJEzH4GsCAzU8FiInulPHLm73KI4nLlAcskkjgeJM=";
+    hash = "sha256-T6bJOXSXFWZYAxZ+nTDu+H8Wi75QRKddXkXdSOPwHbI=";
   };
 
-  cargoHash = "sha256-vv7gK0ZfwO2AHXXQcXfkne9wZl+8JH9h8vELdRjg8WM=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-5f915lrymOwg5bPsTp6sxKikCcTpbeia1fQzKnLYGOs=";
 
   nativeBuildInputs = [
     pkg-config