From ae1cb5ac93f6808be688a1e056d1e58572018f8d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 7 Jul 2022 16:12:19 +0000
Subject: [PATCH 001/176] caf: 0.18.5 -> 0.18.6

---
 pkgs/development/libraries/caf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/caf/default.nix b/pkgs/development/libraries/caf/default.nix
index 8640fb6b5c9c..515f66883d0b 100644
--- a/pkgs/development/libraries/caf/default.nix
+++ b/pkgs/development/libraries/caf/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "actor-framework";
-  version = "0.18.5";
+  version = "0.18.6";
 
   src = fetchFromGitHub {
     owner = "actor-framework";
     repo = "actor-framework";
     rev = version;
-    sha256 = "04b4kjisb5wzq6pilh8xzbxn7qcjgppl8k65hfv0zi0ja8fyp1xk";
+    sha256 = "sha256-AW8AXX9t9vYv8tZvFJvrghmz6tZdfbX4hVc2QoBAvhQ=";
   };
 
   nativeBuildInputs = [ cmake ];

From c926ca0ae0de876403330e72af12b5379084d4da Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 18 Dec 2022 00:34:38 +0000
Subject: [PATCH 002/176] snabb: 2022.10 -> 2022.12

---
 pkgs/tools/networking/snabb/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/snabb/default.nix b/pkgs/tools/networking/snabb/default.nix
index 97d9ff33ddfc..676c3ae01001 100644
--- a/pkgs/tools/networking/snabb/default.nix
+++ b/pkgs/tools/networking/snabb/default.nix
@@ -7,13 +7,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "snabb";
-  version = "2022.10";
+  version = "2022.12";
 
   src = fetchFromGitHub {
     owner = "snabbco";
     repo = "snabb";
     rev = "v${version}";
-    sha256 = "GIIW+2/1fuHTmYev/QvuO5Yb2ozbyw/45qQkym36US8=";
+    sha256 = "sha256-DPJ1GrqZQyiW2s5JBZszcB/Is0Is2f/O/6Riz/M3wAs=";
   };
 
   installPhase = ''

From 041910e6859e2a26ced91cf45789385b968ef926 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 22 Dec 2022 16:03:15 +0000
Subject: [PATCH 003/176] yquake2: 8.10 -> 8.20

---
 pkgs/games/quake2/yquake2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/games/quake2/yquake2/default.nix b/pkgs/games/quake2/yquake2/default.nix
index 2e9c09bc62e3..522a8e39fd88 100644
--- a/pkgs/games/quake2/yquake2/default.nix
+++ b/pkgs/games/quake2/yquake2/default.nix
@@ -13,13 +13,13 @@ let
 
   yquake2 = stdenv.mkDerivation rec {
     pname = "yquake2";
-    version = "8.10";
+    version = "8.20";
 
     src = fetchFromGitHub {
       owner = "yquake2";
       repo = "yquake2";
       rev = "QUAKE2_${builtins.replaceStrings ["."] ["_"] version}";
-      sha256 = "sha256-/BbMR/ZPjHbKzQ+I1+Vgh3/zenLjW3TnmrKhKPR6Gdk=";
+      sha256 = "sha256-x1mk6qo03b438ZBS16/f7pzMCfugtQvaRcV+hg7Zc/w=";
     };
 
     postPatch = ''

From 9e6d466232c5f0ee0b661f14207077139662f93e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 23 Dec 2022 01:51:21 +0000
Subject: [PATCH 004/176] geekbench: 5.4.5 -> 5.4.6

---
 pkgs/tools/misc/geekbench/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/geekbench/default.nix b/pkgs/tools/misc/geekbench/default.nix
index ba9117a29722..77be76f2d2ed 100644
--- a/pkgs/tools/misc/geekbench/default.nix
+++ b/pkgs/tools/misc/geekbench/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "geekbench";
-  version = "5.4.5";
+  version = "5.4.6";
 
   src = fetchurl {
     url = "https://cdn.geekbench.com/Geekbench-${version}-Linux.tar.gz";
-    sha256 = "sha256-JA9bvRb8u0qG6ZsQR9qJ3yaV9ni/MkdWo9xRtmPp92I=";
+    sha256 = "sha256-fCS6cSD3w2EbLL1yNfH+NKxswRUY4zyCR07gKGXW4Yc=";
   };
 
   dontConfigure = true;

From da47c1c26a48bb8bb7f906aac42c311eae4792f6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 31 Dec 2022 01:14:23 +0000
Subject: [PATCH 005/176] zita-alsa-pcmi: 0.5.1 -> 0.6.1

---
 pkgs/development/libraries/audio/zita-alsa-pcmi/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/audio/zita-alsa-pcmi/default.nix b/pkgs/development/libraries/audio/zita-alsa-pcmi/default.nix
index 3d5d973eec55..fc5162b34e8d 100644
--- a/pkgs/development/libraries/audio/zita-alsa-pcmi/default.nix
+++ b/pkgs/development/libraries/audio/zita-alsa-pcmi/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "zita-alsa-pcmi";
-  version = "0.5.1";
+  version = "0.6.1";
   src = fetchurl {
     url = "http://kokkinizita.linuxaudio.org/linuxaudio/downloads/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-zyAKaO22She1e/+zPjiwSHeCctGLVYnT0vWgHODzSwc=";
+    sha256 = "sha256-iil6zj16R0Ex7T+jIQacExM3eFtWojfW8WjIXueW1Ww=";
   };
 
   buildInputs = [ alsa-lib ];

From 42b3ad82ccbccfcf8196ed89ce2be2fe96260618 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 15 Jan 2023 10:15:07 +0000
Subject: [PATCH 006/176] callaudiod: 0.1.4 -> 0.1.7

---
 pkgs/applications/audio/callaudiod/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/audio/callaudiod/default.nix b/pkgs/applications/audio/callaudiod/default.nix
index 562a53fe5927..221febf35dcd 100644
--- a/pkgs/applications/audio/callaudiod/default.nix
+++ b/pkgs/applications/audio/callaudiod/default.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation rec {
   pname = "callaudiod";
-  version = "0.1.4";
+  version = "0.1.7";
 
   src = fetchFromGitLab {
     domain = "gitlab.com";
     owner = "mobian1";
     repo = pname;
     rev = version;
-    sha256 = "sha256-71+9ALz55aqxXRBRwOcs9fwiQK31pJ9E72pGRmt0OkE=";
+    sha256 = "sha256-BDEu3ASlnovMK0lQC+CQvpXvtdt33BRntstPAWaAnsg=";
   };
 
   strictDeps = true;

From 912fc670f6dab8b7370430542c3afdf453d0417a Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Mon, 23 Jan 2023 00:31:49 +0100
Subject: [PATCH 007/176] mariadb: use openssl_3 for 105

compat was backported, but not to 104
---
 pkgs/servers/sql/mariadb/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 9eacea78a37e..13ef62b6576e 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -45,7 +45,7 @@ let
         ++ lib.optionals stdenv.hostPlatform.isDarwin [ CoreServices cctools perl libedit ]
         ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ jemalloc ]
         ++ (if (lib.versionOlder version "10.5") then [ pcre ] else [ pcre2 ])
-        ++ (if (lib.versionOlder version "10.6")
+        ++ (if (lib.versionOlder version "10.5")
             then [ openssl_1_1 (curl.override { openssl = openssl_1_1; }) ]
             else [ openssl curl ]);
 

From 3f5fcc6eab9f05e374e8f93869d9d8ddff252ba0 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Mon, 23 Jan 2023 00:34:34 +0100
Subject: [PATCH 008/176] mariadb_1010: init at 10.10.2

https://mariadb.com/kb/en/mariadb-10-10-2-release-notes/
---
 pkgs/servers/sql/mariadb/default.nix | 7 +++++++
 pkgs/top-level/all-packages.nix      | 1 +
 2 files changed, 8 insertions(+)

diff --git a/pkgs/servers/sql/mariadb/default.nix b/pkgs/servers/sql/mariadb/default.nix
index 13ef62b6576e..fe3e3fba8d2a 100644
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@@ -274,4 +274,11 @@ in
       inherit (self.darwin) cctools;
       inherit (self.darwin.apple_sdk.frameworks) CoreServices;
     };
+    mariadb_1010 = self.callPackage generic {
+      # Supported until 2023-11
+      version = "10.10.2";
+      hash = "sha256-V8vQESsitZL2V81OuC4vNq2QE1Exe/jheElXjoA/PLI=";
+      inherit (self.darwin) cctools;
+      inherit (self.darwin.apple_sdk.frameworks) CoreServices;
+    };
   }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1fc6d073d097..9a8fc0b391a3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -24664,6 +24664,7 @@ with pkgs;
     mariadb_106
     mariadb_108
     mariadb_109
+    mariadb_1010
   ;
   mariadb = mariadb_106;
   mariadb-embedded = mariadb.override { withEmbedded = true; };

From 7e9f255717d06410596d79a776f016b3e51bf60a Mon Sep 17 00:00:00 2001
From: Sebastian Sellmeier <mail@sebastian-sellmeier.de>
Date: Fri, 27 Jan 2023 03:35:14 +0100
Subject: [PATCH 009/176] nwg-panel: 0.7.11 -> 0.7.16

---
 pkgs/applications/misc/nwg-panel/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/misc/nwg-panel/default.nix b/pkgs/applications/misc/nwg-panel/default.nix
index 7724976ebabf..f5ac2ed7e59f 100644
--- a/pkgs/applications/misc/nwg-panel/default.nix
+++ b/pkgs/applications/misc/nwg-panel/default.nix
@@ -14,13 +14,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nwg-panel";
-  version = "0.7.11";
+  version = "0.7.16";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-panel";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-Esr1OPyQCCQIOfgkl6RIn93ZaJkF0O2RM9ObIgBlPi4=";
+    sha256 = "sha256-dwnDrFQZVz6Vxa8bX0gFPBZFQwRJ3+wUy6Rsxvb2dhw=";
   };
 
   # No tests
@@ -56,6 +56,6 @@ python3Packages.buildPythonApplication rec {
     description = "GTK3-based panel for Sway window manager";
     license = licenses.mit;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ berbiche ];
+    maintainers = with maintainers; [ ];
   };
 }

From d9f07dcee585db581688a72d3bcbea2b15794836 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@sap.com>
Date: Mon, 30 Jan 2023 16:52:43 +0100
Subject: [PATCH 010/176] nixos/envfs: use configured environment.usrbinenv and
 environment.binsh

Taken from upstream
https://github.com/Mic92/envfs/commit/d91aeefccb4485646be9415c9e5d1d3599eb5199
---
 nixos/modules/tasks/filesystems/envfs.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/tasks/filesystems/envfs.nix b/nixos/modules/tasks/filesystems/envfs.nix
index 450b805f0f58..df4ce12407bd 100644
--- a/nixos/modules/tasks/filesystems/envfs.nix
+++ b/nixos/modules/tasks/filesystems/envfs.nix
@@ -9,8 +9,8 @@ let
       options = [
         "fallback-path=${pkgs.runCommand "fallback-path" {} ''
           mkdir -p $out
-          ln -s ${pkgs.coreutils}/bin/env $out/env
-          ln -s ${config.system.build.binsh}/bin/sh $out/sh
+          ln -s ${config.environment.usrbinenv} $out/env
+          ln -s ${config.environment.binsh} $out/sh
         ''}"
       ];
     };

From 0ec33e6d27edcf4e1642a0f153d410605280aee8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 2 Feb 2023 05:58:59 +0000
Subject: [PATCH 011/176] folly: 2022.11.28.00 -> 2023.01.30.00

---
 pkgs/development/libraries/folly/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/folly/default.nix b/pkgs/development/libraries/folly/default.nix
index 323a9a2f8b46..78d280b99133 100644
--- a/pkgs/development/libraries/folly/default.nix
+++ b/pkgs/development/libraries/folly/default.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "folly";
-  version = "2022.11.28.00";
+  version = "2023.01.30.00";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "folly";
     rev = "v${version}";
-    sha256 = "sha256-TI3uMlkssKtTvxqj9Et12aAjbHoV9FVBvrZr7oCFlIo=";
+    sha256 = "sha256-p5IAbXPUrGtJotwabpEShNsUZNeF6ncHbDXaNabdaaY=";
   };
 
   nativeBuildInputs = [

From 7ffa6e7d5d067e968d13386262a4c79d61ab3add Mon Sep 17 00:00:00 2001
From: datafoo <34766150+datafoo@users.noreply.github.com>
Date: Thu, 2 Feb 2023 09:05:24 +0100
Subject: [PATCH 012/176] 
 vscode-extensions.streetsidesoftware.code-spell-checker: 2.15.0 -> 2.16.0

---
 pkgs/applications/editors/vscode/extensions/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 9e4548ad0fe1..41666183ce22 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2580,8 +2580,8 @@ let
         mktplcRef = {
           name = "code-spell-checker";
           publisher = "streetsidesoftware";
-          version = "2.15.0";
-          sha256 = "sha256-YfcO/01nO+92xZEJgYyLYAkqXMqfV/QDkcN9Dnjp5ZA=";
+          version = "2.16.0";
+          sha256 = "sha256-Qr4cYAEvAkvvE6KytVeInJzcMQJZqr/e/KPfelVzjUA=";
         };
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/streetsidesoftware.code-spell-checker/changelog";

From 732cfc79473d57728e16dd71c5d80c7b7aaf9897 Mon Sep 17 00:00:00 2001
From: rewine <luhongxu@deepin.org>
Date: Mon, 9 Jan 2023 18:05:24 +0800
Subject: [PATCH 013/176] go-lib: init at 5.8.27

s
---
 pkgs/desktops/deepin/default.nix              | 12 +++++
 .../deepin/go-package/go-lib/default.nix      | 45 +++++++++++++++++++
 2 files changed, 57 insertions(+)
 create mode 100644 pkgs/desktops/deepin/go-package/go-lib/default.nix

diff --git a/pkgs/desktops/deepin/default.nix b/pkgs/desktops/deepin/default.nix
index ec3302908a05..3e01b43f1ed3 100644
--- a/pkgs/desktops/deepin/default.nix
+++ b/pkgs/desktops/deepin/default.nix
@@ -3,6 +3,15 @@ let
   packages = self:
   let
     inherit (self) callPackage;
+
+    replaceAll = x: y: ''
+      echo Replacing "${x}" to "${y}":
+      for file in $(grep -rl "${x}"); do
+        echo -- $file
+        substituteInPlace $file \
+          --replace "${x}" "${y}"
+      done
+    '';
   in {
     #### LIBRARIES
     dtkcommon = callPackage ./library/dtkcommon { };
@@ -25,6 +34,9 @@ let
     deepin-editor = callPackage ./apps/deepin-editor { };
     deepin-terminal = callPackage ./apps/deepin-terminal { };
 
+    #### Go Packages
+    go-lib = callPackage ./go-package/go-lib { inherit replaceAll; };
+
     #### ARTWORK
     dde-account-faces = callPackage ./artwork/dde-account-faces { };
     deepin-icon-theme = callPackage ./artwork/deepin-icon-theme { };
diff --git a/pkgs/desktops/deepin/go-package/go-lib/default.nix b/pkgs/desktops/deepin/go-package/go-lib/default.nix
new file mode 100644
index 000000000000..3a6a8f03dfb5
--- /dev/null
+++ b/pkgs/desktops/deepin/go-package/go-lib/default.nix
@@ -0,0 +1,45 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, fetchpatch
+, replaceAll
+, runtimeShell
+}:
+
+stdenv.mkDerivation rec {
+  pname = "go-lib";
+  version = "5.8.27";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-ZV5zWu7UvNKVcVo79/iKMhF4H09rGyDCvEL61H05lZc=";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "fix_IsDir_for_symlink";
+      url = "https://github.com/linuxdeepin/go-lib/commit/79239904679dc70a11e1ac8e65670afcfdd7c122.patch";
+      sha256 = "sha256-RsN9hK26i/W6P/+e1l1spCLdlgIEWTehhIW6POBOvW4=";
+    })
+  ];
+
+  postPatch = replaceAll "/bin/sh" "${runtimeShell}";
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/gocode/src/github.com/linuxdeepin/go-lib
+    cp -a * $out/share/gocode/src/github.com/linuxdeepin/go-lib
+    rm -r $out/share/gocode/src/github.com/linuxdeepin/go-lib/debian
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Library containing many useful go routines for things such as glib, gettext, archive, graphic, etc";
+    homepage = "https://github.com/linuxdeepin/go-lib";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = teams.deepin.members;
+  };
+}

From ea00098756a2e2504ddee623c9849ce28ff04c42 Mon Sep 17 00:00:00 2001
From: rewine <luhongxu@deepin.org>
Date: Mon, 9 Jan 2023 18:09:01 +0800
Subject: [PATCH 014/176] go-gir-generator: init at 2.2.0

---
 pkgs/desktops/deepin/default.nix              |  1 +
 .../go-package/go-gir-generator/default.nix   | 43 +++++++++++++++++++
 2 files changed, 44 insertions(+)
 create mode 100644 pkgs/desktops/deepin/go-package/go-gir-generator/default.nix

diff --git a/pkgs/desktops/deepin/default.nix b/pkgs/desktops/deepin/default.nix
index 3e01b43f1ed3..ac17a10fe1a0 100644
--- a/pkgs/desktops/deepin/default.nix
+++ b/pkgs/desktops/deepin/default.nix
@@ -36,6 +36,7 @@ let
 
     #### Go Packages
     go-lib = callPackage ./go-package/go-lib { inherit replaceAll; };
+    go-gir-generator = callPackage ./go-package/go-gir-generator { };
 
     #### ARTWORK
     dde-account-faces = callPackage ./artwork/dde-account-faces { };
diff --git a/pkgs/desktops/deepin/go-package/go-gir-generator/default.nix b/pkgs/desktops/deepin/go-package/go-gir-generator/default.nix
new file mode 100644
index 000000000000..7f377d2a6e74
--- /dev/null
+++ b/pkgs/desktops/deepin/go-package/go-gir-generator/default.nix
@@ -0,0 +1,43 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, go
+, pkg-config
+, libgudev
+, gobject-introspection
+}:
+
+stdenv.mkDerivation rec {
+  pname = "go-gir-generator";
+  version = "2.2.0";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-lFseui/M3+TyfYoa+rnS0cGhN6gdLrgpzgOwqzYcyPk=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    go
+  ];
+
+  buildInputs = [
+    libgudev
+    gobject-introspection
+  ];
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+    "GOCACHE=$(TMPDIR)/go-cache"
+  ];
+
+  meta = with lib; {
+    description = "Generate static golang bindings for GObject";
+    homepage = "https://github.com/linuxdeepin/go-gir-generator";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = teams.deepin.members;
+  };
+}

From cb3c159314b371afd48b153bcd6c0fa7f98f903d Mon Sep 17 00:00:00 2001
From: rewine <luhongxu@deepin.org>
Date: Mon, 9 Jan 2023 18:11:21 +0800
Subject: [PATCH 015/176] go-dbus-factory: init at 1.10.23

---
 pkgs/desktops/deepin/default.nix              |  1 +
 .../go-package/go-dbus-factory/default.nix    | 26 +++++++++++++++++++
 2 files changed, 27 insertions(+)
 create mode 100644 pkgs/desktops/deepin/go-package/go-dbus-factory/default.nix

diff --git a/pkgs/desktops/deepin/default.nix b/pkgs/desktops/deepin/default.nix
index ac17a10fe1a0..c1fe29882c64 100644
--- a/pkgs/desktops/deepin/default.nix
+++ b/pkgs/desktops/deepin/default.nix
@@ -37,6 +37,7 @@ let
     #### Go Packages
     go-lib = callPackage ./go-package/go-lib { inherit replaceAll; };
     go-gir-generator = callPackage ./go-package/go-gir-generator { };
+    go-dbus-factory = callPackage ./go-package/go-dbus-factory { };
 
     #### ARTWORK
     dde-account-faces = callPackage ./artwork/dde-account-faces { };
diff --git a/pkgs/desktops/deepin/go-package/go-dbus-factory/default.nix b/pkgs/desktops/deepin/go-package/go-dbus-factory/default.nix
new file mode 100644
index 000000000000..4c12dce491d7
--- /dev/null
+++ b/pkgs/desktops/deepin/go-package/go-dbus-factory/default.nix
@@ -0,0 +1,26 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation rec {
+  pname = "go-dbus-factory";
+  version = "1.10.23";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-6u9Bpoa80j/K1MipncfM378/qmSSMZAlx88jE4hHYBk=";
+  };
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  meta = with lib; {
+    description = "Generate go binding of D-Bus interfaces";
+    homepage = "https://github.com/linuxdeepin/go-dbus-factory";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = teams.deepin.members;
+  };
+}

From c700cb7b5efae55f46a9c70376f08861e5e1fec1 Mon Sep 17 00:00:00 2001
From: rewine <luhongxu@deepin.org>
Date: Wed, 11 Jan 2023 18:12:35 +0800
Subject: [PATCH 016/176] deepin-gettext-tools: init at 1.0.10

---
 pkgs/desktops/deepin/default.nix              |  3 ++
 .../tools/deepin-gettext-tools/default.nix    | 50 +++++++++++++++++++
 2 files changed, 53 insertions(+)
 create mode 100644 pkgs/desktops/deepin/tools/deepin-gettext-tools/default.nix

diff --git a/pkgs/desktops/deepin/default.nix b/pkgs/desktops/deepin/default.nix
index c1fe29882c64..abd6de544e6e 100644
--- a/pkgs/desktops/deepin/default.nix
+++ b/pkgs/desktops/deepin/default.nix
@@ -39,6 +39,9 @@ let
     go-gir-generator = callPackage ./go-package/go-gir-generator { };
     go-dbus-factory = callPackage ./go-package/go-dbus-factory { };
 
+    #### TOOLS
+    deepin-gettext-tools = callPackage ./tools/deepin-gettext-tools { };
+
     #### ARTWORK
     dde-account-faces = callPackage ./artwork/dde-account-faces { };
     deepin-icon-theme = callPackage ./artwork/deepin-icon-theme { };
diff --git a/pkgs/desktops/deepin/tools/deepin-gettext-tools/default.nix b/pkgs/desktops/deepin/tools/deepin-gettext-tools/default.nix
new file mode 100644
index 000000000000..d219e6d73b16
--- /dev/null
+++ b/pkgs/desktops/deepin/tools/deepin-gettext-tools/default.nix
@@ -0,0 +1,50 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, gettext
+, python3Packages
+, perlPackages
+}:
+
+stdenv.mkDerivation rec {
+  pname = "deepin-gettext-tools";
+  version = "1.0.10";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-5Dd2QU6JYwuktusssNDfA7IHa6HbFcWo9sZf5PS7NtI=";
+  };
+
+  postPatch = ''
+    substituteInPlace src/generate_mo.py --replace "sudo cp" "cp"
+  '';
+
+  nativeBuildInputs = [ python3Packages.wrapPython ];
+
+  buildInputs = [
+    gettext
+    perlPackages.perl
+    perlPackages.ConfigTiny
+    perlPackages.XMLLibXML
+  ];
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+  ];
+
+  postFixup = ''
+    wrapPythonPrograms
+    wrapPythonProgramsIn "$out/lib/${pname}"
+    wrapProgram $out/bin/deepin-desktop-ts-convert --set PERL5LIB $PERL5LIB
+  '';
+
+  meta = with lib; {
+    description = "Translation file processing utils for DDE development";
+    homepage = "https://github.com/linuxdeepin/deepin-gettext-tools";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = teams.deepin.members;
+  };
+}

From dc0b701631888d5e08d5696c8343b15db40fa0a9 Mon Sep 17 00:00:00 2001
From: rewine <luhongxu@deepin.org>
Date: Thu, 12 Jan 2023 13:26:32 +0800
Subject: [PATCH 017/176] deepin-pw-check: init at 5.1.17

---
 pkgs/desktops/deepin/default.nix              |  1 +
 .../go-package/deepin-pw-check/default.nix    | 84 +++++++++++++++++++
 .../go-package/deepin-pw-check/deps.nix       | 75 +++++++++++++++++
 3 files changed, 160 insertions(+)
 create mode 100644 pkgs/desktops/deepin/go-package/deepin-pw-check/default.nix
 create mode 100644 pkgs/desktops/deepin/go-package/deepin-pw-check/deps.nix

diff --git a/pkgs/desktops/deepin/default.nix b/pkgs/desktops/deepin/default.nix
index abd6de544e6e..68463c4fed8b 100644
--- a/pkgs/desktops/deepin/default.nix
+++ b/pkgs/desktops/deepin/default.nix
@@ -38,6 +38,7 @@ let
     go-lib = callPackage ./go-package/go-lib { inherit replaceAll; };
     go-gir-generator = callPackage ./go-package/go-gir-generator { };
     go-dbus-factory = callPackage ./go-package/go-dbus-factory { };
+    deepin-pw-check = callPackage ./go-package/deepin-pw-check { };
 
     #### TOOLS
     deepin-gettext-tools = callPackage ./tools/deepin-gettext-tools { };
diff --git a/pkgs/desktops/deepin/go-package/deepin-pw-check/default.nix b/pkgs/desktops/deepin/go-package/deepin-pw-check/default.nix
new file mode 100644
index 000000000000..040c561d352e
--- /dev/null
+++ b/pkgs/desktops/deepin/go-package/deepin-pw-check/default.nix
@@ -0,0 +1,84 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, buildGoPackage
+, pkg-config
+, deepin-gettext-tools
+, go-dbus-factory
+, go-gir-generator
+, go-lib
+, gtk3
+, glib
+, libxcrypt
+, gettext
+, iniparser
+, cracklib
+, linux-pam
+}:
+
+buildGoPackage rec {
+  pname = "deepin-pw-check";
+  version = "5.1.18";
+
+  goPackagePath = "github.com/linuxdeepin/deepin-pw-check";
+
+  src = fetchFromGitHub {
+    owner = "linuxdeepin";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-v1Z4ArkrejjOCO1vD+BhfEl9pTfuvKgLM6Ont0IUCQk=";
+  };
+
+  goDeps = ./deps.nix;
+
+  nativeBuildInputs = [
+    pkg-config
+    gettext
+    deepin-gettext-tools
+  ];
+
+  buildInputs = [
+    go-dbus-factory
+    go-gir-generator
+    go-lib
+    glib
+    libxcrypt
+    gtk3
+    iniparser
+    cracklib
+    linux-pam
+  ];
+
+  postPatch = ''
+    sed -i 's|iniparser/||' */*.c
+    substituteInPlace misc/pkgconfig/libdeepin_pw_check.pc \
+      --replace "/usr" "$out"
+    substituteInPlace misc/system-services/com.deepin.daemon.PasswdConf.service \
+      --replace "/usr/lib/deepin-pw-check/deepin-pw-check" "$out/lib/deepin-pw-check/deepin-pw-check"
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    GOPATH="$GOPATH:${go-dbus-factory}/share/gocode"
+    GOPATH="$GOPATH:${go-gir-generator}/share/gocode"
+    GOPATH="$GOPATH:${go-lib}/share/gocode"
+    make -C go/src/${goPackagePath}
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    make install PREFIX="$out" PKG_FILE_DIR=$out/lib/pkg-config PAM_MODULE_DIR=$out/etc/pam.d -C go/src/${goPackagePath}
+    # https://github.com/linuxdeepin/deepin-pw-check/blob/d5597482678a489077a506a87f06d2b6c4e7e4ed/debian/rules#L21
+    ln -s $out/lib/libdeepin_pw_check.so $out/lib/libdeepin_pw_check.so.1
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Tool to verify the validity of the password";
+    homepage = "https://github.com/linuxdeepin/deepin-pw-check";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = teams.deepin.members;
+  };
+}
diff --git a/pkgs/desktops/deepin/go-package/deepin-pw-check/deps.nix b/pkgs/desktops/deepin/go-package/deepin-pw-check/deps.nix
new file mode 100644
index 000000000000..509940b6d570
--- /dev/null
+++ b/pkgs/desktops/deepin/go-package/deepin-pw-check/deps.nix
@@ -0,0 +1,75 @@
+[
+  {
+    goPackagePath = "github.com/fsnotify/fsnotify";
+    fetch = {
+      type = "git";
+      url = "https://github.com/fsnotify/fsnotify";
+      rev = "v1.5.1";
+      sha256 = "sha256-B8kZ8yiWgallT7R2j1kSRJcJkSGFVf9ise+TpXa+7XY=";
+    };
+  }
+  {
+    goPackagePath = "github.com/godbus/dbus";
+    fetch = {
+      type = "git";
+      url = "https://github.com/godbus/dbus";
+      rev = "v5.1.0";
+      sha256 = "sha256-JSPtmkGEStBEVrKGszeLCb7P38SzQKgMiDC3eDppXs0=";
+    };
+  }
+  {
+    goPackagePath = "github.com/stretchr/testify";
+    fetch = {
+      type = "git";
+      url = "https://github.com/stretchr/testify";
+      rev = "v1.7.1";
+      sha256 = "sha256-disUVIHiIDSj/go3APtJH8awSl8QwKRRFLKI7LRnl0w=";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/sys";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/sys";
+      rev = "289d7a0edf712062d9f1484b07bdf2383f48802f";
+      sha256 = "sha256-AzS/J3OocI7mA0xsIfQzyskNKVija7F2yvuts+EFJBs=";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/yaml.v3";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-yaml/yaml";
+      rev = "496545a6307b2a7d7a710fd516e5e16e8ab62dbc";
+      sha256 = "sha256-j8yDji+vqsitpRZirpb4w/Em8nstgf28wpwkcrOlxBk=";
+    };
+  }
+  {
+    goPackagePath = "github.com/davecgh/go-spew";
+    fetch = {
+      type = "git";
+      url = "https://github.com/davecgh/go-spew";
+      rev = "v1.1.1";
+      sha256 = "sha256-nhzSUrE1fCkN0+RL04N4h8jWmRFPPPWbCuDc7Ss0akI=";
+    };
+  }
+  {
+    goPackagePath = "github.com/stretchr/objx";
+    fetch = {
+      type = "git";
+      url = "https://github.com/stretchr/objx";
+      rev = "v0.3.0";
+      sha256 = "sha256-T753/EiD5Cpk6H2JFhd+s1gFvpNptG2XlEHxZF6dQaw=";
+    };
+  }
+  {
+    goPackagePath = "github.com/pmezard/go-difflib";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pmezard/go-difflib";
+      rev = "5d4384ee4fb2527b0a1256a821ebfc92f91efefc";
+      sha256 = "sha256-XA4Oj1gdmdV/F/+8kMI+DBxKPthZ768hbKsO3d9Gx90=";
+    };
+  }
+]
+

From 7dc8f2ab9fc712a6cde1ac4b12f9e4677d225e1b Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Fri, 3 Feb 2023 12:00:00 +0000
Subject: [PATCH 018/176] evolutionWithPlugins: wrap with evolution schema

See https://github.com/NixOS/nixpkgs/issues/140853#issuecomment-1416247760
---
 .../mailreaders/evolution/evolution/wrapper.nix           | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/mailreaders/evolution/evolution/wrapper.nix b/pkgs/applications/networking/mailreaders/evolution/evolution/wrapper.nix
index 7837393926f6..0a4a4a9d7797 100644
--- a/pkgs/applications/networking/mailreaders/evolution/evolution/wrapper.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution/wrapper.nix
@@ -7,10 +7,16 @@ symlinkJoin {
   nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
+    declare -a schemas;
+    for plugin in ${toString plugins}; do
+      for schema in $plugin/share/gsettings-schemas/*; do
+        schemas+=($schema);
+      done
+    done
     for i in $out/bin/* $out/libexec/**; do
     if [ ! -d $i ]; then
       echo wrapping $i
-      wrapProgram $i --set EDS_EXTRA_PREFIXES "${lib.concatStringsSep ":" plugins}"
+      wrapProgram $i --set EDS_EXTRA_PREFIXES "${lib.concatStringsSep ":" plugins}" --prefix XDG_DATA_DIRS : "''${schemas[@]}"
     fi
     done
 

From 3364a1c1a1f7f394e2de48c424f3e95af71ee3f8 Mon Sep 17 00:00:00 2001
From: Matt McHenry <github@matt.mchenryfamily.org>
Date: Thu, 2 Feb 2023 21:30:22 -0500
Subject: [PATCH 019/176] k3b: use cdrecord from cdrtools rather than cdrkit

fixes this warning:

cdrecord <= 2.01.01a05 will be run with root privileges on kernel >= 2.6.8
Since Linux kernel 2.6.8 cdrecord <= 2.01.01a05 will not work when run suid root for security reasons anymore.
---
 nixos/modules/programs/k3b.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/programs/k3b.nix b/nixos/modules/programs/k3b.nix
index cdaed3cf70fb..5d19e4f1cc4f 100644
--- a/nixos/modules/programs/k3b.nix
+++ b/nixos/modules/programs/k3b.nix
@@ -28,7 +28,7 @@ with lib;
       k3b
       dvdplusrwtools
       cdrdao
-      cdrkit
+      cdrtools
     ];
 
     security.wrappers = {
@@ -44,7 +44,7 @@ with lib;
         owner = "root";
         group = "cdrom";
         permissions = "u+wrx,g+x";
-        source = "${pkgs.cdrkit}/bin/cdrecord";
+        source = "${pkgs.cdrtools}/bin/cdrecord";
       };
     };
 

From 36fb0ebeefbd5ccb1b29b0d5a10cc96c6239f3e9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 3 Feb 2023 21:15:38 +0000
Subject: [PATCH 020/176] python310Packages.deep-translator: 1.9.2 -> 1.9.3

---
 pkgs/development/python-modules/deep-translator/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/deep-translator/default.nix b/pkgs/development/python-modules/deep-translator/default.nix
index e68cda8c0e25..dffb7dca66d2 100644
--- a/pkgs/development/python-modules/deep-translator/default.nix
+++ b/pkgs/development/python-modules/deep-translator/default.nix
@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "deep-translator";
-  version = "1.9.2";
+  version = "1.9.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-iHK1A44SZqJ5N+D2ets76xuU0mryGT7TehM4wryB/AY=";
+    sha256 = "sha256-7VsEN6t9c0FMw0zHWnxnIyilQmQ127rXEfLrAYatKEc=";
   };
 
   propagatedBuildInputs = [

From 66532182f511ac0e080791aa712f468d023cf3c9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 4 Feb 2023 00:21:30 +0000
Subject: [PATCH 021/176] kotlin: 1.8.0 -> 1.8.10

---
 pkgs/development/compilers/kotlin/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/kotlin/default.nix b/pkgs/development/compilers/kotlin/default.nix
index cb78eb5c6b34..a07e724cbd7a 100644
--- a/pkgs/development/compilers/kotlin/default.nix
+++ b/pkgs/development/compilers/kotlin/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "kotlin";
-  version = "1.8.0";
+  version = "1.8.10";
 
   src = fetchurl {
     url = "https://github.com/JetBrains/kotlin/releases/download/v${version}/kotlin-compiler-${version}.zip";
-    hash = "sha256-C7lBn6yYMqVqOhnK0oL48tbxI30tRn3I3+m9SipDxC4=";
+    hash = "sha256-TD+nvBu57zBYojGdi8w7cZYHn4jpL9zY0wSkb0trV4c=";
   };
 
   propagatedBuildInputs = [ jre ] ;

From 3cb6f8db35b63ed356f29d2033052fc92ae575f8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 4 Feb 2023 08:47:09 +0000
Subject: [PATCH 022/176] hackrf: 2022.09.1 -> 2023.01.1

---
 pkgs/applications/radio/hackrf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/radio/hackrf/default.nix b/pkgs/applications/radio/hackrf/default.nix
index 1180f5a941ae..647f3efd6706 100644
--- a/pkgs/applications/radio/hackrf/default.nix
+++ b/pkgs/applications/radio/hackrf/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hackrf";
-  version = "2022.09.1";
+  version = "2023.01.1";
 
   src = fetchFromGitHub {
     owner = "greatscottgadgets";
     repo = "hackrf";
     rev = "v${version}";
-    sha256 = "sha256-c+9DEMxioIbEDNTdLSOnxX1zpFk07K9rlGP9goEJMlU=";
+    sha256 = "sha256-zvSSCNtqHOZVlrBggjgxEyUTqTiAIAhdzUkm4Pm9b3k=";
   };
 
   nativeBuildInputs = [

From 67ebd8112558b7e15e0583a06860a6becceaf95b Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Sat, 4 Feb 2023 17:09:58 +0100
Subject: [PATCH 023/176] iosevka: fix Darwin build

---
 pkgs/data/fonts/iosevka/default.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/data/fonts/iosevka/default.nix b/pkgs/data/fonts/iosevka/default.nix
index 53a54f346db1..f64364eaab41 100644
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@@ -4,6 +4,7 @@
 , buildNpmPackage
 , fetchFromGitHub
 , nodejs
+, darwin
 , remarshal
 , ttfautohint-nox
   # Custom font set options.
@@ -67,7 +68,14 @@ buildNpmPackage rec {
 
   npmDepsHash = "sha256-Ncf07ggyOnz/2SpgdmaYS2X/8Bad+J2sz8Yyx9Iri3E=";
 
-  nativeBuildInputs = [ nodejs remarshal ttfautohint-nox ];
+  nativeBuildInputs = [
+    nodejs
+    remarshal
+    ttfautohint-nox
+  ] ++ lib.optionals stdenv.isDarwin [
+    # libtool
+    darwin.cctools
+  ];
 
   buildPlan =
     if builtins.isAttrs privateBuildPlan then

From 6dd324df0dd0da79fd58a4ae6f9ec2605e5745df Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Sat, 4 Feb 2023 17:13:26 +0100
Subject: [PATCH 024/176] iosevka: remove superfluous inputs

---
 pkgs/data/fonts/iosevka/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/data/fonts/iosevka/default.nix b/pkgs/data/fonts/iosevka/default.nix
index f64364eaab41..f9609c6c485b 100644
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@@ -1,9 +1,7 @@
 { stdenv
 , lib
-, pkgs
 , buildNpmPackage
 , fetchFromGitHub
-, nodejs
 , darwin
 , remarshal
 , ttfautohint-nox
@@ -69,7 +67,6 @@ buildNpmPackage rec {
   npmDepsHash = "sha256-Ncf07ggyOnz/2SpgdmaYS2X/8Bad+J2sz8Yyx9Iri3E=";
 
   nativeBuildInputs = [
-    nodejs
     remarshal
     ttfautohint-nox
   ] ++ lib.optionals stdenv.isDarwin [

From 7a28048a7f7e4e7b3d2bdb648ea6367fbe40b8e9 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 4 Feb 2023 21:09:57 +0100
Subject: [PATCH 025/176] python310Packages.deep-translator: add changelog to
 meta

- disable on unsupported Python releases
---
 .../python-modules/deep-translator/default.nix  | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/deep-translator/default.nix b/pkgs/development/python-modules/deep-translator/default.nix
index dffb7dca66d2..e01ada284958 100644
--- a/pkgs/development/python-modules/deep-translator/default.nix
+++ b/pkgs/development/python-modules/deep-translator/default.nix
@@ -1,12 +1,22 @@
-{ lib, buildPythonPackage, fetchPypi, beautifulsoup4, requests, click }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, beautifulsoup4
+, requests
+, click
+, pythonOlder
+}:
 
 buildPythonPackage rec {
   pname = "deep-translator";
   version = "1.9.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-7VsEN6t9c0FMw0zHWnxnIyilQmQ127rXEfLrAYatKEc=";
+    hash = "sha256-7VsEN6t9c0FMw0zHWnxnIyilQmQ127rXEfLrAYatKEc=";
   };
 
   propagatedBuildInputs = [
@@ -25,8 +35,9 @@ buildPythonPackage rec {
   doCheck = false;
 
   meta = with lib; {
-    description = "Flexible, free and unlimited Python tool to translate between different languages in a simple way using multiple translators";
+    description = "Python tool to translate between different languages by using multiple translators";
     homepage = "https://deep-translator.readthedocs.io";
+    changelog = "https://github.com/nidhaloff/deep-translator/releases/tag/v1.10.0";
     license = licenses.mit;
     maintainers = with maintainers; [ wolfangaukang ];
   };

From eedda7e8d87639c6ba65d0c177bbc5266a5fc790 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 5 Feb 2023 13:19:10 +0000
Subject: [PATCH 026/176] rust-analyzer-unwrapped: 2023-01-23 -> 2023-01-30

---
 pkgs/development/tools/rust/rust-analyzer/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/rust/rust-analyzer/default.nix b/pkgs/development/tools/rust/rust-analyzer/default.nix
index a90ac2780e8a..80fbfe249d75 100644
--- a/pkgs/development/tools/rust/rust-analyzer/default.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/default.nix
@@ -12,14 +12,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-analyzer-unwrapped";
-  version = "2023-01-23";
-  cargoSha256 = "sha256-NSdHvWN5BIEXZMFiweKYbJayxDqlFmqJp+sIzeORhSU=";
+  version = "2023-01-30";
+  cargoSha256 = "sha256-ONziMXbMPDoIb44mOJCg5O1QOo5o13kaGb+b6Qp3Ikk=";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = version;
-    sha256 = "sha256-Uq6jngJnf2UqKrOzqMXtq5IVxkU3eNCkmORPdccLxp0=";
+    sha256 = "sha256-W8abw+8SuxSMMBH4ydfawdC6zwPHQwhHerFEXkB4oU4=";
   };
 
   auditable = true; # TODO: remove when this is the default

From faeefbe1b9931eb8f36e8f0638ba9a30088861d0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 5 Feb 2023 12:11:45 -0800
Subject: [PATCH 027/176] flare-signal: init at 0.6.0

Co-authored-by: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
---
 .../flare-signal/default.nix                  | 59 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 61 insertions(+)
 create mode 100644 pkgs/applications/networking/instant-messengers/flare-signal/default.nix

diff --git a/pkgs/applications/networking/instant-messengers/flare-signal/default.nix b/pkgs/applications/networking/instant-messengers/flare-signal/default.nix
new file mode 100644
index 000000000000..a30bfa2dcb02
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/flare-signal/default.nix
@@ -0,0 +1,59 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, meson
+, ninja
+, pkg-config
+, protobuf
+, libsecret
+, libadwaita
+, rustPlatform
+, desktop-file-utils
+, wrapGAppsHook4
+}:
+
+stdenv.mkDerivation rec {
+  pname = "flare";
+  version = "0.6.0";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.com";
+    owner = "Schmiddiii";
+    repo = pname;
+    rev = version;
+    hash = "sha256-wY95sXWGDjEy8vvP79XliJOn5GQkAvDmOXKmRz0TPEw=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-J3MGQlPYGjhZKH599vfW2WhkXx+Tdr53PviiVpye4R0=";
+  };
+
+  nativeBuildInputs = [
+    desktop-file-utils # for update-desktop-database
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook4
+  ] ++ (with rustPlatform; [
+    cargoSetupHook
+    rust.cargo
+    rust.rustc
+  ]);
+
+  buildInputs = [
+    libadwaita
+    libsecret
+    protobuf
+  ];
+
+  meta = {
+    changelog = "https://gitlab.com/Schmiddiii/flare/-/blob/${src.rev}/CHANGELOG.md";
+    description = "An unofficial Signal GTK client";
+    homepage = "https://gitlab.com/Schmiddiii/flare";
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [ dotlambda tomfitzhenry ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f873d604445a..7e999edab024 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -776,6 +776,8 @@ with pkgs;
 
   flare-floss = callPackage ../tools/security/flare-floss { };
 
+  flare-signal = callPackage ../applications/networking/instant-messengers/flare-signal { };
+
   prefer-remote-fetch = import ../build-support/prefer-remote-fetch;
 
   global-platform-pro = callPackage ../development/tools/global-platform-pro { };

From aa5b7e4571619199510e0d86c1a02562bf6e493b Mon Sep 17 00:00:00 2001
From: Shadaj Laddad <shadaj@users.noreply.github.com>
Date: Mon, 6 Feb 2023 10:58:12 -0800
Subject: [PATCH 028/176] openvscode-server: 1.74.3 -> 1.75.0

---
 pkgs/servers/openvscode-server/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/openvscode-server/default.nix b/pkgs/servers/openvscode-server/default.nix
index 1253a6ef8fc3..47ca62c6d01e 100644
--- a/pkgs/servers/openvscode-server/default.nix
+++ b/pkgs/servers/openvscode-server/default.nix
@@ -40,13 +40,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "openvscode-server";
-  version = "1.74.3";
+  version = "1.75.0";
 
   src = fetchFromGitHub {
     owner = "gitpod-io";
     repo = "openvscode-server";
     rev = "openvscode-server-v${version}";
-    sha256 = "2+/5I0dpQsmoWA7Q0dCgPO85dkOKQWHeO34cueH4sjQ=";
+    sha256 = "ZR4gEE+bLVjcGxhoRYQqfxDjk0ulPmdb5IV041qf954=";
   };
 
   yarnCache = stdenv.mkDerivation {
@@ -69,7 +69,7 @@ in stdenv.mkDerivation rec {
 
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
-    outputHash = "sha256-4B/ESi4lM2p+pY0dfUKWgwmYkwqPYaNuCLJ99ByjwWE=";
+    outputHash = "sha256-KcGhHFglBJDyircYUxpsMLRtQblYx3u/BMQq35A0qhE=";
   };
 
   nativeBuildInputs = [

From e3bec64e7fef8a8389967700be2bdbbefa1cd355 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Mon, 6 Feb 2023 22:47:16 +0100
Subject: [PATCH 029/176] phpExtensions.opcache: fix test environment for
 darwin

---
 pkgs/top-level/php-packages.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index 8b1bbecb249f..827985cab7e5 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -84,6 +84,7 @@ lib.makeScope pkgs.newScope (self: with self; {
     , zendExtension ? false
     , doCheck ? true
     , extName ? name
+    , allowLocalNetworking ? false
     , ...
     }@args: stdenv.mkDerivation ((builtins.removeAttrs args [ "name" ]) // {
       pname = "php-${name}";
@@ -103,6 +104,7 @@ lib.makeScope pkgs.newScope (self: with self; {
       ];
 
       inherit configureFlags internalDeps buildInputs zendExtension doCheck;
+      __darwinAllowLocalNetworking = allowLocalNetworking;
 
       preConfigurePhases = [
         "cdToExtensionRootPhase"
@@ -412,7 +414,7 @@ lib.makeScope pkgs.newScope (self: with self; {
           ];
           zendExtension = true;
           # Tests launch the builtin webserver.
-          __darwinAllowLocalNetworking = true;
+          allowLocalNetworking = true;
         }
         {
           name = "openssl";

From 4e6f4f630a4995076283e8487efeb75e0a2aa7b9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Feb 2023 00:58:41 +0000
Subject: [PATCH 030/176] drawio: 20.8.10 -> 20.8.16

---
 pkgs/applications/graphics/drawio/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/graphics/drawio/default.nix b/pkgs/applications/graphics/drawio/default.nix
index c26b2f46e7f6..5c5745646b59 100644
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "drawio";
-  version = "20.8.10";
+  version = "20.8.16";
 
   src = fetchurl {
     url = "https://github.com/jgraph/drawio-desktop/releases/download/v${version}/drawio-x86_64-${version}.rpm";
-    sha256 = "118e9c9a328c92aeeda3c5925c8d8ed50d0993c07715726447ee720699958626";
+    sha256 = "sha256-FBnyogqf5BHLRInjJzC2dENnAwFcWMHDvJ+F0I3ffVg=";
   };
 
   nativeBuildInputs = [

From fad8de6ea191c4ce723d825bb7db6119cf8135ab Mon Sep 17 00:00:00 2001
From: Austin Butler <austinabutler@gmail.com>
Date: Mon, 6 Feb 2023 21:58:43 -0800
Subject: [PATCH 031/176] _1password-gui: 8.9.10 -> 8.9.14, 8.9.12-4.BETA ->
 8.10.0-20.BETA

---
 .../misc/1password-gui/default.nix            | 18 ++++----
 .../applications/misc/1password-gui/update.sh | 46 +++++++++++++++++++
 2 files changed, 55 insertions(+), 9 deletions(-)
 create mode 100755 pkgs/applications/misc/1password-gui/update.sh

diff --git a/pkgs/applications/misc/1password-gui/default.nix b/pkgs/applications/misc/1password-gui/default.nix
index 3c08f1d8a9da..27adbfff713d 100644
--- a/pkgs/applications/misc/1password-gui/default.nix
+++ b/pkgs/applications/misc/1password-gui/default.nix
@@ -9,43 +9,43 @@
 let
 
   pname = "1password";
-  version = if channel == "stable" then "8.9.10" else "8.9.12-4.BETA";
+  version = if channel == "stable" then "8.9.14" else "8.10.0-20.BETA";
 
   sources = {
     stable = {
       x86_64-linux = {
         url = "https://downloads.1password.com/linux/tar/stable/x86_64/1password-${version}.x64.tar.gz";
-        sha256 = "sha256-aoa00W5zvZQeHKd2Eqyrxl5Z1PwLMHc5lkMUskLiD74=";
+        sha256 = "sha256-rlLzPDPOmzamDnRxuvgrpAW0QrMINw/PsdLxOiBpMnA=";
       };
       aarch64-linux = {
         url = "https://downloads.1password.com/linux/tar/stable/aarch64/1password-${version}.arm64.tar.gz";
-        sha256 = "sha256-Zt64UGKI3+DayS6XP7jTE+pxv52tUUZbUHiuzjcm1JI=";
+        sha256 = "sha256-hJTqFr6/KOl4C+1oyo/zrnCbqvRQin6HjyLKOppUl/M=";
       };
       x86_64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        sha256 = "sha256-sx9eASpMcgkIH1GRzJMqSQa5Y5GJlYU/20CZFyFK+OU=";
+        sha256 = "sha256-3/aiUj+WYZfPItYrYNQKsUSpkRTgOhyb8L5gURt1O74=";
       };
       aarch64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        sha256 = "sha256-Z1cEynO9iWZra542CVGmefrTNerMe13OcTAzWXNi8jI=";
+        sha256 = "sha256-n0xqD5WbcC9B6spisa5V7JJRXGZubBwzJFUS8edvz/Q=";
       };
     };
     beta = {
       x86_64-linux = {
         url = "https://downloads.1password.com/linux/tar/beta/x86_64/1password-${version}.x64.tar.gz";
-        sha256 = "sha256-/WXaLINqLFLft+wrmr+fV0kM9qS5w4etFiGltnzoVdo=";
+        sha256 = "sha256-r2MRyw0dfD3vGnCcPW624K5rSaNSCjTVW4cWFgPAIaY=";
       };
       aarch64-linux = {
         url = "https://downloads.1password.com/linux/tar/beta/aarch64/1password-${version}.arm64.tar.gz";
-        sha256 = "sha256-Zv9uHkFCZ0flBMAwQBjNhqFWhAXKyHBfZk733hbSag4=";
+        sha256 = "sha256-98sv4yLvLw8J5uQBB66qTV3lRWnyeZiifhEOW7shz8s=";
       };
       x86_64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        sha256 = "sha256-Vryk6nMQY+0NIgwJkZ2j3vrxyhrzxbe96jbyoNbPIR0=";
+        sha256 = "sha256-ezHk6OgUsmFfMfsY+yyWqn+6JgHSmpkFWGNCCaBv/Bo=";
       };
       aarch64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        sha256 = "sha256-74iOaNkuPRKUsTNNd7UTpy5ahjoMmxiNT84Op5ztRGk=";
+        sha256 = "sha256-JmCrEBucXGPpGbiKOxA8vu6bUVYsavfsYA5QY58Grnw=";
       };
     };
   };
diff --git a/pkgs/applications/misc/1password-gui/update.sh b/pkgs/applications/misc/1password-gui/update.sh
new file mode 100755
index 000000000000..aab589fd37ea
--- /dev/null
+++ b/pkgs/applications/misc/1password-gui/update.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p jq
+#shellcheck shell=bash
+
+CURRENT_HASH=""
+
+print_hash() {
+    OS="$1"
+    CHANNEL="$2"
+    ARCH="$3"
+    VERSION="$4"
+
+    if [[ "$OS" == "linux" ]]; then
+        if [[ "$ARCH" == "x86_64" ]]; then
+            EXT="x64.tar.gz"
+        else
+            EXT="arm64.tar.gz"
+        fi
+        URL="https://downloads.1password.com/${OS}/tar/${CHANNEL}/${ARCH}/1password-${VERSION}.${EXT}"
+    else
+        EXT="$ARCH.zip"
+        URL="https://downloads.1password.com/${OS}/1Password-${VERSION}-${EXT}"
+    fi
+
+    CURRENT_HASH=$(nix store prefetch-file "$URL" --json | jq -r '.hash')
+
+    echo "$CHANNEL ${ARCH}-${OS}: $CURRENT_HASH"
+}
+
+if [[ -z "$STABLE_VER" ]]; then
+    echo "No 'STABLE_VER' environment variable provided, skipping"
+else
+    print_hash "linux" "stable" "x86_64" "$STABLE_VER"
+    print_hash "linux" "stable" "aarch64" "$STABLE_VER"
+    print_hash "mac" "stable" "x86_64" "$STABLE_VER"
+    print_hash "mac" "stable" "aarch64" "$STABLE_VER"
+fi
+
+if [[ -z "$BETA_VER" ]]; then
+    echo "No 'BETA_VER' environment variable provided, skipping"
+else
+    print_hash "linux" "beta" "x86_64" "$BETA_VER"
+    print_hash "linux" "beta" "aarch64" "$BETA_VER"
+    print_hash "mac" "beta" "x86_64" "$BETA_VER"
+    print_hash "mac" "beta" "aarch64" "$BETA_VER"
+fi

From 82a0b7d7df926b2b4411494dbfb0a92410213714 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Tue, 7 Feb 2023 17:08:57 +0800
Subject: [PATCH 032/176] python311Packages.python-zbar: fix build since
 Py_SIZE is turned into a function

Python 3.11 turned Py_SIZE into a function, thus Py_SIZE(obj) will be a rvalue,
we need to use Py_SET_SIZE to set size now.
---
 ...ython-enum-fix-build-for-Python-3.11.patch | 61 +++++++++++++++++++
 .../python-modules/python-zbar/default.nix    | 15 ++++-
 2 files changed, 75 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/python-modules/python-zbar/0001-python-enum-fix-build-for-Python-3.11.patch

diff --git a/pkgs/development/python-modules/python-zbar/0001-python-enum-fix-build-for-Python-3.11.patch b/pkgs/development/python-modules/python-zbar/0001-python-enum-fix-build-for-Python-3.11.patch
new file mode 100644
index 000000000000..11b554151790
--- /dev/null
+++ b/pkgs/development/python-modules/python-zbar/0001-python-enum-fix-build-for-Python-3.11.patch
@@ -0,0 +1,61 @@
+From 64de7911d2938fc3601fec39c08008465b9d4f6f Mon Sep 17 00:00:00 2001
+From: Nick Cao <nickcao@nichi.co>
+Date: Tue, 7 Feb 2023 17:12:50 +0800
+Subject: [PATCH] python: enum: fix build for Python 3.11
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Python 3.9 introduced Py_SET_SIZE function to set size instead of
+relying on Py_SIZE() as a macro [3.9].
+
+Python 3.10 started to encourage to use Py_SET_SIZE instead of
+assigning into return value of Py_SIZE [3.10].
+
+Python 3.11 flips the switch, turn Py_SIZE into a function [3.11],
+thus Py_SIZE(obj) will be a rvalue. We need to use Py_SET_SIZE
+to set size now.
+
+[3.9]: https://docs.python.org/3.9/c-api/structures.html#c.Py_SET_SIZE
+[3.10]: https://docs.python.org/3.10/c-api/structures.html#c.Py_SIZE
+[3.11]: https://docs.python.org/3.11/c-api/structures.html#c.Py_SIZE
+
+Adapted from https://github.com/mchehab/zbar/pull/231
+
+Signed-off-by: Đoàn Trần Công Danh <congdanhqx@gmail.com>
+Signed-off-by: Nick Cao <nickcao@nichi.co>
+---
+ python/enum.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/python/enum.c b/python/enum.c
+index dfe1b1e..4833a20 100644
+--- a/python/enum.c
++++ b/python/enum.c
+@@ -52,7 +52,11 @@ enumitem_new (PyTypeObject *type,
+ 
+     /* we assume the "fast path" for a single-digit ints (see longobject.c) */
+     /* this also holds if we get a small_int preallocated long */
++#if PY_VERSION_HEX >= 0x030900A4
++    Py_SET_SIZE(&self->val, Py_SIZE(longval));
++#else
+     Py_SIZE(&self->val) = Py_SIZE(longval);
++#endif
+     self->val.ob_digit[0] = longval->ob_digit[0];
+     Py_DECREF(longval);
+ #else
+@@ -143,7 +147,11 @@ zbarEnumItem_New (PyObject *byname,
+ 
+     /* we assume the "fast path" for a single-digit ints (see longobject.c) */
+     /* this also holds if we get a small_int preallocated long */
++#if PY_VERSION_HEX >= 0x030900A4
++    Py_SET_SIZE(&self->val, Py_SIZE(longval));
++#else
+     Py_SIZE(&self->val) = Py_SIZE(longval);
++#endif
+     self->val.ob_digit[0] = longval->ob_digit[0];
+     Py_DECREF(longval);
+ 
+-- 
+2.39.1
+
diff --git a/pkgs/development/python-modules/python-zbar/default.nix b/pkgs/development/python-modules/python-zbar/default.nix
index 7ad125b26ef5..178b1899ef51 100644
--- a/pkgs/development/python-modules/python-zbar/default.nix
+++ b/pkgs/development/python-modules/python-zbar/default.nix
@@ -1,4 +1,10 @@
-{ lib , buildPythonPackage , fetchFromGitHub , pillow , zbar , pytestCheckHook }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pillow
+, zbar
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "python-zbar";
@@ -12,6 +18,13 @@ buildPythonPackage rec {
     sha256 = "sha256-FvV7TMc4JbOiRjWLka0IhtpGGqGm5fis7h870OmJw2U=";
   };
 
+  patches = [
+    # python: enum: fix build for Python 3.11
+    # https://github.com/mchehab/zbar/pull/231
+    # the patch is reworked as it does not cleanly apply
+    ./0001-python-enum-fix-build-for-Python-3.11.patch
+  ];
+
   propagatedBuildInputs = [ pillow ];
 
   buildInputs = [ zbar ];

From 6b92d2f403d522d2ff91036495a27839f1a93ba4 Mon Sep 17 00:00:00 2001
From: superherointj <5861043+superherointj@users.noreply.github.com>
Date: Sun, 5 Feb 2023 10:59:11 -0300
Subject: [PATCH 033/176] python311Packages.dvc-data: 0.36.2 -> 0.38.1

Release: https://github.com/iterative/dvc-data/releases/tag/0.38.1
Diff: https://github.com/iterative/dvc-data/compare/0.36.2...0.38.1
---
 pkgs/development/python-modules/dvc-data/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dvc-data/default.nix b/pkgs/development/python-modules/dvc-data/default.nix
index 56a27acb6019..316e20f91d0e 100644
--- a/pkgs/development/python-modules/dvc-data/default.nix
+++ b/pkgs/development/python-modules/dvc-data/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "dvc-data";
-  version = "0.36.2";
+  version = "0.38.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-HKNltc5pWc0mU+yCj/PV9E6GYQ+3fbcacRRXtquGM4w=";
+    hash = "sha256-xuNxsG8wMpdwyA0BkEYepnGjIZGmUzTivN5paLtM68Q=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From 73c0fd813b6449a8ab73483c4c7f06fa4c3f07cd Mon Sep 17 00:00:00 2001
From: superherointj <5861043+superherointj@users.noreply.github.com>
Date: Tue, 7 Feb 2023 09:04:37 -0300
Subject: [PATCH 034/176] python311Packages.sqltrie: 0.0.27 -> 0.0.28

Release: https://github.com/iterative/sqltrie/releases/tag/0.0.28
Diff: https://github.com/iterative/sqltrie/compare/0.0.27...0.0.28

Co-authored-by: @fabaff
---
 pkgs/development/python-modules/sqltrie/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sqltrie/default.nix b/pkgs/development/python-modules/sqltrie/default.nix
index 76c1eb22b2dc..da465eb0ccb3 100644
--- a/pkgs/development/python-modules/sqltrie/default.nix
+++ b/pkgs/development/python-modules/sqltrie/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "sqltrie";
-  version = "0.0.27";
+  version = "0.0.28";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-8ymTdbJgRUf9BBNMEVF1lm29qA+N1629cekEohaxt0c=";
+    hash = "sha256-i1IFkibQ7VHrkD8KzeInBE4ZbjxAw8nQIeE6O4iYmbw=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From 099a60d04e4fb75297c8013257cd2bd813445a60 Mon Sep 17 00:00:00 2001
From: superherointj <5861043+superherointj@users.noreply.github.com>
Date: Tue, 7 Feb 2023 09:05:04 -0300
Subject: [PATCH 035/176] python311Packages.dvc-objects: 0.19.0 -> 0.19.3

Release: https://github.com/iterative/dvc-objects/releases/tag/0.19.3
Diff: https://github.com/iterative/dvc-objects/compare/0.19.0...0.19.3
---
 pkgs/development/python-modules/dvc-objects/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dvc-objects/default.nix b/pkgs/development/python-modules/dvc-objects/default.nix
index c20540b8eeb3..a0ab592eaa90 100644
--- a/pkgs/development/python-modules/dvc-objects/default.nix
+++ b/pkgs/development/python-modules/dvc-objects/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "dvc-objects";
-  version = "0.19.0";
+  version = "0.19.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "iterative";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-jwjhRY1SMqiTZ5UJmoZb4odg3g8uC9ehPmxRU2VsH8U=";
+    hash = "sha256-oKK+BhOgdRPZZAACgxgmr9rlzEH9yWmvbmx09d42u/Y=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From f87b50832aefeae63709504c1efc2672bea23ef6 Mon Sep 17 00:00:00 2001
From: Atemu <atemu.main@gmail.com>
Date: Tue, 7 Feb 2023 14:02:54 +0100
Subject: [PATCH 036/176] BeatSaberModManager: bump deps

---
 pkgs/games/BeatSaberModManager/deps.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/games/BeatSaberModManager/deps.nix b/pkgs/games/BeatSaberModManager/deps.nix
index 1542b120c9af..e36521e19149 100644
--- a/pkgs/games/BeatSaberModManager/deps.nix
+++ b/pkgs/games/BeatSaberModManager/deps.nix
@@ -26,9 +26,9 @@
   (fetchNuGet { pname = "HarfBuzzSharp.NativeAssets.Win32"; version = "2.8.2.1-preview.108"; sha256 = "0n6ymn9jqms3mk5hg0ar4y9jmh96myl6q0jimn7ahb1a8viq55k1"; })
   (fetchNuGet { pname = "JetBrains.Annotations"; version = "10.3.0"; sha256 = "1grdx28ga9fp4hwwpwv354rizm8anfq4lp045q4ss41gvhggr3z8"; })
   (fetchNuGet { pname = "MicroCom.Runtime"; version = "0.11.0"; sha256 = "0p9c3m0zk59x9dcqw077hzd2yk60myisbacvm36mnwpcjwzjkp2m"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Ref"; version = "6.0.12"; sha256 = "0x8x922jhdn4zzbqqhlnzg5cmg69myn9zibk363py3yamkywcami"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-arm64"; version = "6.0.12"; sha256 = "1zi1x4w51fawi8083s48mxrlpqzkc48qsvrq2h7xx58x48ml465s"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "6.0.12"; sha256 = "1wwciddbnykamlwl9i88l9081q27l0i17jmvymsxddbi0v9rr3sb"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Ref"; version = "6.0.13"; sha256 = "1k49nrz5rw1yglkjypmmnclahib2qiwm838008yahk00ysy039f4"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-arm64"; version = "6.0.13"; sha256 = "1a80w34yb700cvjzfcsq3c5sb32bk95ccgjfcvyqxkpzlgcc50xn"; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "6.0.13"; sha256 = "1y2gnkrc788y9k79sygx7dmgkj674qwdajyrxizx0a70rwmjszmw"; })
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "3.0.0"; sha256 = "0bbl0jpqywqmzz2gagld1p2gvdfldjfjmm25hil9wj2nq1zc4di8"; })
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.Common"; version = "3.8.0"; sha256 = "12n7rvr39bzkf2maw7zplw8rwpxpxss4ich3bb2pw770rx4nyvyw"; })
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp"; version = "3.8.0"; sha256 = "1kmry65csvfn72zzc16vj1nfbfwam28wcmlrk3m5rzb8ydbzgylb"; })
@@ -36,11 +36,11 @@
   (fetchNuGet { pname = "Microsoft.CodeAnalysis.Scripting.Common"; version = "3.8.0"; sha256 = "0hjgxcsj5zy27lqk0986m59n5dbplx2vjjla2lsvg4bwg8qa7bpk"; })
   (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.3.0"; sha256 = "0gw297dgkh0al1zxvgvncqs0j15lsna9l1wpqas4rflmys440xvb"; })
   (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.5.0"; sha256 = "01i28nvzccxbqmiz217fxs6hnjwmd5fafs37rd49a6qp53y6623l"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-arm64"; version = "6.0.12"; sha256 = "0axj326a79h8762ahrxgpnzczivfvdjn2xa2np2djc7ybn6j3491"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-x64"; version = "6.0.12"; sha256 = "0dfivz2wq18gsdn8b9d0v6q0lf2mvayl85nad7cvysfc93aw05jg"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Ref"; version = "6.0.12"; sha256 = "00s1flhzvxsdhgn469vc1q63qkcv05g5zqx10p1gsnzxjpdx01in"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-arm64"; version = "6.0.12"; sha256 = "1j615cjwkyjkvvc03pvwmfgqbh1z9aq08bvw0bnjkhs1qs6dz7x0"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "6.0.12"; sha256 = "1w7kfgld8wcbqqyb1cpbnd6b08f83jfny2q70vb1qdqfn5bgcb1h"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-arm64"; version = "6.0.13"; sha256 = "1xy7x37mkdiv907xbxxc0aijjhgi2hli1s79adqn4adw8fbn2aki"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Host.linux-x64"; version = "6.0.13"; sha256 = "0ph1r2vhnqg7agk1zz4873983qy2i5nwa10q40ba3g96rdy2pg1f"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Ref"; version = "6.0.13"; sha256 = "0ddygsnms3vfg6s7w2mcm7gqdmb4h7glrdj73hm1l42sndmn9p7v"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-arm64"; version = "6.0.13"; sha256 = "0l1bq22d85sm36hrsmyf74hir1fj0msqv0c6d4ba0b64b3rwhvg0"; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "6.0.13"; sha256 = "0in8sk9bl2r2dgjf3ncvmqzbdnyvy2329bzmykmvsrq511c76gh3"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; sha256 = "01al6cfxp68dscl15z7rxfw9zvhm64dncsw09a1vmdkacsa2v6lr"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "2.1.2"; sha256 = "1507hnpr9my3z4w1r6xk5n0s1j3y6a2c2cnynj76za7cphxi1141"; })

From 91dced3734fa7bd38ddbd9c81357dffdf528c5cd Mon Sep 17 00:00:00 2001
From: jopejoe1 <johannes@joens.email>
Date: Tue, 7 Feb 2023 14:49:20 +0100
Subject: [PATCH 037/176] plasma5Packages.kimageformats: enable RAW image
 support

---
 pkgs/development/libraries/kde-frameworks/kimageformats.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/kde-frameworks/kimageformats.nix b/pkgs/development/libraries/kde-frameworks/kimageformats.nix
index c221f3489112..beec3e13cf71 100644
--- a/pkgs/development/libraries/kde-frameworks/kimageformats.nix
+++ b/pkgs/development/libraries/kde-frameworks/kimageformats.nix
@@ -1,7 +1,7 @@
 {
   mkDerivation, lib,
   extra-cmake-modules,
-  ilmbase, karchive, openexr, libavif, libheif, libjxl, qtbase
+  ilmbase, karchive, openexr, libavif, libheif, libjxl, libraw, qtbase
 }:
 
 let inherit (lib) getDev; in
@@ -10,7 +10,7 @@ mkDerivation {
   pname = "kimageformats";
 
   nativeBuildInputs = [ extra-cmake-modules ];
-  buildInputs = [ karchive openexr libavif libheif libjxl qtbase ];
+  buildInputs = [ karchive openexr libavif libheif libjxl libraw qtbase ];
   outputs = [ "out" ]; # plugins only
   CXXFLAGS = "-I${getDev ilmbase}/include/OpenEXR";
   cmakeFlags = [

From ce2fdc97662c8b11f26c097ba2478266009721ce Mon Sep 17 00:00:00 2001
From: superherointj <5861043+superherointj@users.noreply.github.com>
Date: Wed, 1 Feb 2023 10:40:00 -0300
Subject: [PATCH 038/176] k3s: add multiple versions

---
 ...d-strip-downloading-just-package-CRD.patch |  41 +++
 .../networking/cluster/k3s/1_23/default.nix   | 331 ++++++++++++++++++
 ...d-strip-downloading-just-package-CRD.patch |  41 +++
 .../networking/cluster/k3s/1_24/default.nix   | 329 +++++++++++++++++
 ...d-strip-downloading-just-package-CRD.patch |  41 +++
 .../networking/cluster/k3s/1_25/default.nix   | 329 +++++++++++++++++
 .../cluster/k3s/{ => 1_26}/chart-versions.nix |   0
 .../cluster/k3s/{ => 1_26}/default.nix        |   0
 .../cluster/k3s/{ => 1_26}/update.sh          |   0
 pkgs/top-level/all-packages.nix               |   6 +-
 10 files changed, 1117 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/applications/networking/cluster/k3s/1_23/0001-script-download-strip-downloading-just-package-CRD.patch
 create mode 100644 pkgs/applications/networking/cluster/k3s/1_23/default.nix
 create mode 100644 pkgs/applications/networking/cluster/k3s/1_24/0001-script-download-strip-downloading-just-package-CRD.patch
 create mode 100644 pkgs/applications/networking/cluster/k3s/1_24/default.nix
 create mode 100644 pkgs/applications/networking/cluster/k3s/1_25/0001-script-download-strip-downloading-just-package-CRD.patch
 create mode 100644 pkgs/applications/networking/cluster/k3s/1_25/default.nix
 rename pkgs/applications/networking/cluster/k3s/{ => 1_26}/chart-versions.nix (100%)
 rename pkgs/applications/networking/cluster/k3s/{ => 1_26}/default.nix (100%)
 rename pkgs/applications/networking/cluster/k3s/{ => 1_26}/update.sh (100%)

diff --git a/pkgs/applications/networking/cluster/k3s/1_23/0001-script-download-strip-downloading-just-package-CRD.patch b/pkgs/applications/networking/cluster/k3s/1_23/0001-script-download-strip-downloading-just-package-CRD.patch
new file mode 100644
index 000000000000..115fd6824772
--- /dev/null
+++ b/pkgs/applications/networking/cluster/k3s/1_23/0001-script-download-strip-downloading-just-package-CRD.patch
@@ -0,0 +1,41 @@
+From 6f53bd36a40da4c71486e3b79f6e32d53d6eea5d Mon Sep 17 00:00:00 2001
+From: Euan Kemp <euank@euank.com>
+Date: Thu, 3 Feb 2022 23:50:40 -0800
+Subject: [PATCH 2/2] scrips/download: strip downloading, just package CRD
+
+The CRD packaging is a complicated set of commands, so let's reuse it.
+---
+ scripts/download | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+diff --git a/scripts/download b/scripts/download
+index 5effc0562a..82361803ee 100755
+--- a/scripts/download
++++ b/scripts/download
+@@ -24,12 +24,6 @@ rm -rf ${CONTAINERD_DIR}
+ mkdir -p ${CHARTS_DIR}
+ mkdir -p ${DATA_DIR}
+ 
+-curl --compressed -sfL https://github.com/k3s-io/k3s-root/releases/download/${VERSION_ROOT}/k3s-root-${ARCH}.tar | tar xf - --exclude=bin/socat
+-
+-git clone --single-branch --branch=${VERSION_RUNC} --depth=1 https://github.com/opencontainers/runc ${RUNC_DIR}
+-
+-git clone --single-branch --branch=${VERSION_CONTAINERD} --depth=1 https://github.com/k3s-io/containerd ${CONTAINERD_DIR}
+-
+ setup_tmp() {
+     TMP_DIR=$(mktemp -d --tmpdir=${CHARTS_DIR})
+     cleanup() {
+@@ -44,8 +38,8 @@ setup_tmp() {
+ 
+ download_and_package_traefik () {
+   echo "Downloading Traefik Helm chart from ${TRAEFIK_URL}"
+-  curl -sfL ${TRAEFIK_URL} -o ${TMP_DIR}/${TRAEFIK_FILE}
+-  code=$?
++  # nixpkgs: copy in our known traefik chart instead
++  cp $TRAEFIK_CHART_FILE ${TMP_DIR}/${TRAEFIK_FILE}
+ 
+   if [ $code -ne 0 ]; then
+     echo "Error: Failed to download Traefik Helm chart!"
+-- 
+2.34.1
+
diff --git a/pkgs/applications/networking/cluster/k3s/1_23/default.nix b/pkgs/applications/networking/cluster/k3s/1_23/default.nix
new file mode 100644
index 000000000000..1fbe7687a006
--- /dev/null
+++ b/pkgs/applications/networking/cluster/k3s/1_23/default.nix
@@ -0,0 +1,331 @@
+{ stdenv
+, lib
+, makeWrapper
+, socat
+, iptables
+, iproute2
+, bridge-utils
+, btrfs-progs
+, conntrack-tools
+, buildGoModule
+, runc
+, rsync
+, kmod
+, libseccomp
+, pkg-config
+, ethtool
+, util-linux
+, fetchFromGitHub
+, fetchurl
+, fetchzip
+, fetchgit
+, zstd
+, yq-go
+, nixosTests
+, k3s
+, pkgsBuildBuild
+}:
+
+with lib;
+
+# k3s is a kinda weird derivation. One of the main points of k3s is the
+# simplicity of it being one binary that can perform several tasks.
+# However, when you have a good package manager (like nix), that doesn't
+# actually make much of a difference; you don't really care if it's one binary
+# or 10 since with a good package manager, installing and running it is
+# identical.
+# Since upstream k3s packages itself as one large binary with several
+# "personalities" (in the form of subcommands like 'k3s agent' and 'k3s
+# kubectl'), it ends up being easiest to mostly mimic upstream packaging, with
+# some exceptions.
+# K3s also carries patches to some packages (such as containerd and cni
+# plugins), so we intentionally use the k3s versions of those binaries for k3s,
+# even if the upstream version of those binaries exist in nixpkgs already. In
+# the end, that means we have a thick k3s binary that behaves like the upstream
+# one for the most part.
+# However, k3s also bundles several pieces of unpatched software, from the
+# strongswan vpn software, to iptables, to socat, conntrack, busybox, etc.
+# Those pieces of software we entirely ignore upstream's handling of, and just
+# make sure they're in the path if desired.
+let
+  k3sVersion = "1.23.6+k3s1";     # k3s git tag
+  k3sCommit = "418c3fa858b69b12b9cefbcff0526f666a6236b9"; # k3s git commit at the above version
+  k3sRepoSha256 = "0fmw491dn5mpi058mr7sij51i5m4qg2grx30cnl3h2v4s0sdkx2i";
+  k3sVendorSha256 = "sha256-iHg5ySMaiSWXs98YGmxPwdZr4zdBIFma12dNEuf30Hs=";
+
+  # taken from ./manifests/traefik.yaml, extracted from '.spec.chart' https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/download#L9
+  # The 'patch' and 'minor' versions are currently hardcoded as single digits only, so ignore the trailing two digits. Weird, I know.
+  traefikChartVersion = "10.19.3";
+  traefikChartSha256 = "04zg5li957svgscdmkzmzjkwljaljyav68rzxmhakkwgav6q9058";
+
+  # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L47
+  k3sRootVersion = "0.11.0";
+  k3sRootSha256 = "016n56vi09xkvjph7wgzb2m86mhd5x65fs4d11pmh20hl249r620";
+
+  # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L45
+  k3sCNIVersion = "1.0.1-k3s1";
+  k3sCNISha256 = "11ihlzzdnqf9p21y0a4ckpbxac016nm7746dcykhj26ym9zxyv92";
+
+  # taken from go.mod, the 'github.com/containerd/containerd' line
+  # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
+  containerdVersion = "1.5.11-k3s2";
+  containerdSha256 = "16132snvrg8r0vwm6c0lz0q6fx686s2ix53nm3aka9a83xs75vf2";
+
+  # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
+  criCtlVersion = "1.22.0-k3s1";
+
+  baseMeta = k3s.meta;
+
+  # https://github.com/k3s-io/k3s/blob/5fb370e53e0014dc96183b8ecb2c25a61e891e76/scripts/build#L19-L40
+  versionldflags = [
+    "-X github.com/rancher/k3s/pkg/version.Version=v${k3sVersion}"
+    "-X github.com/rancher/k3s/pkg/version.GitCommit=${lib.substring 0 8 k3sCommit}"
+    "-X k8s.io/client-go/pkg/version.gitVersion=v${k3sVersion}"
+    "-X k8s.io/client-go/pkg/version.gitCommit=${k3sCommit}"
+    "-X k8s.io/client-go/pkg/version.gitTreeState=clean"
+    "-X k8s.io/client-go/pkg/version.buildDate=1970-01-01T01:01:01Z"
+    "-X k8s.io/component-base/version.gitVersion=v${k3sVersion}"
+    "-X k8s.io/component-base/version.gitCommit=${k3sCommit}"
+    "-X k8s.io/component-base/version.gitTreeState=clean"
+    "-X k8s.io/component-base/version.buildDate=1970-01-01T01:01:01Z"
+    "-X github.com/kubernetes-sigs/cri-tools/pkg/version.Version=v${criCtlVersion}"
+    "-X github.com/containerd/containerd/version.Version=v${containerdVersion}"
+    "-X github.com/containerd/containerd/version.Package=github.com/k3s-io/containerd"
+  ];
+
+  # bundled into the k3s binary
+  traefikChart = fetchurl {
+    url = "https://helm.traefik.io/traefik/traefik-${traefikChartVersion}.tgz";
+    sha256 = traefikChartSha256;
+  };
+  # so, k3s is a complicated thing to package
+  # This derivation attempts to avoid including any random binaries from the
+  # internet. k3s-root is _mostly_ binaries built to be bundled in k3s (which
+  # we don't care about doing, we can add those as build or runtime
+  # dependencies using a real package manager).
+  # In addition to those binaries, it's also configuration though (right now
+  # mostly strongswan configuration), and k3s does use those files.
+  # As such, we download it in order to grab 'etc' and bundle it into the final
+  # k3s binary.
+  k3sRoot = fetchzip {
+    # Note: marked as apache 2.0 license
+    url = "https://github.com/k3s-io/k3s-root/releases/download/v${k3sRootVersion}/k3s-root-amd64.tar";
+    sha256 = k3sRootSha256;
+    stripRoot = false;
+  };
+  k3sCNIPlugins = buildGoModule rec {
+    pname = "k3s-cni-plugins";
+    version = k3sCNIVersion;
+    vendorSha256 = null;
+
+    subPackages = [ "." ];
+
+    src = fetchFromGitHub {
+      owner = "rancher";
+      repo = "plugins";
+      rev = "v${version}";
+      sha256 = k3sCNISha256;
+    };
+
+    postInstall = ''
+      mv $out/bin/plugins $out/bin/cni
+    '';
+
+    meta = baseMeta // {
+      description = "CNI plugins, as patched by rancher for k3s";
+    };
+  };
+  # Grab this separately from a build because it's used by both stages of the
+  # k3s build.
+  k3sRepo = fetchgit {
+    url = "https://github.com/k3s-io/k3s";
+    rev = "v${k3sVersion}";
+    sha256 = k3sRepoSha256;
+  };
+  # Stage 1 of the k3s build:
+  # Let's talk about how k3s is structured.
+  # One of the ideas of k3s is that there's the single "k3s" binary which can
+  # do everything you need, from running a k3s server, to being a worker node,
+  # to running kubectl.
+  # The way that actually works is that k3s is a single go binary that contains
+  # a bunch of bindata that it unpacks at runtime into directories (either the
+  # user's home directory or /var/lib/rancher if run as root).
+  # This bindata includes both binaries and configuration.
+  # In order to let nixpkgs do all its autostripping/patching/etc, we split this into two derivations.
+  # First, we build all the binaries that get packed into the thick k3s binary
+  # (and output them from one derivation so they'll all be suitably patched up).
+  # Then, we bundle those binaries into our thick k3s binary and use that as
+  # the final single output.
+  # This approach was chosen because it ensures the bundled binaries all are
+  # correctly built to run with nix (we can lean on the existing buildGoModule
+  # stuff), and we can again lean on that tooling for the final k3s binary too.
+  # Other alternatives would be to manually run the
+  # strip/patchelf/remove-references step ourselves in the installPhase of the
+  # derivation when we've built all the binaries, but haven't bundled them in
+  # with generated bindata yet.
+
+  k3sServer = buildGoModule rec {
+    pname = "k3s-server";
+    version = k3sVersion;
+
+    src = k3sRepo;
+    vendorSha256 = k3sVendorSha256;
+
+    nativeBuildInputs = [ pkg-config ];
+    buildInputs = [ libseccomp ];
+
+    subPackages = [ "cmd/server" ];
+    ldflags = versionldflags;
+
+    # create the multicall symlinks for k3s
+    postInstall = ''
+      mv $out/bin/server $out/bin/k3s
+      pushd $out
+      # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/build#L105-L113
+      ln -s k3s ./bin/k3s-agent
+      ln -s k3s ./bin/k3s-server
+      ln -s k3s ./bin/k3s-etcd-snapshot
+      ln -s k3s ./bin/k3s-secrets-encrypt
+      ln -s k3s ./bin/k3s-certificate
+      ln -s k3s ./bin/kubectl
+      ln -s k3s ./bin/crictl
+      ln -s k3s ./bin/ctr
+      popd
+    '';
+
+    meta = baseMeta // {
+      description = "The various binaries that get packaged into the final k3s binary";
+    };
+  };
+  k3sContainerd = buildGoModule {
+    pname = "k3s-containerd";
+    version = containerdVersion;
+    src = fetchFromGitHub {
+      owner = "k3s-io";
+      repo = "containerd";
+      rev = "v${containerdVersion}";
+      sha256 = containerdSha256;
+    };
+    vendorSha256 = null;
+    buildInputs = [ btrfs-progs ];
+    subPackages = [ "cmd/containerd" "cmd/containerd-shim-runc-v2" ];
+    ldflags = versionldflags;
+  };
+in
+buildGoModule rec {
+  pname = "k3s";
+  version = k3sVersion;
+
+  src = k3sRepo;
+  vendorSha256 = k3sVendorSha256;
+
+  patches = [
+    ./0001-script-download-strip-downloading-just-package-CRD.patch
+  ];
+
+  postPatch = ''
+    # Nix prefers dynamically linked binaries over static binary.
+
+    substituteInPlace scripts/package-cli \
+      --replace '"$LDFLAGS $STATIC" -o' \
+                '"$LDFLAGS" -o' \
+      --replace "STATIC=\"-extldflags \'-static\'\"" \
+                ""
+
+    # Upstream codegen fails with trimpath set. Removes "trimpath" for 'go generate':
+
+    substituteInPlace scripts/package-cli \
+      --replace '"''${GO}" generate' \
+                'GOFLAGS="" \
+                 GOOS="${pkgsBuildBuild.go.GOOS}" \
+                 GOARCH="${pkgsBuildBuild.go.GOARCH}" \
+                 CC="${pkgsBuildBuild.stdenv.cc}/bin/cc" \
+                 "''${GO}" generate'
+  '';
+
+  # Important utilities used by the kubelet, see
+  # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
+  # Note the list in that issue is stale and some aren't relevant for k3s.
+  k3sRuntimeDeps = [
+    kmod
+    socat
+    iptables
+    iproute2
+    bridge-utils
+    ethtool
+    util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
+    conntrack-tools
+  ];
+
+  buildInputs = k3sRuntimeDeps;
+
+  nativeBuildInputs = [
+    makeWrapper
+    rsync
+    yq-go
+    zstd
+  ];
+
+  # embedded in the final k3s cli
+  propagatedBuildInputs = [
+    k3sCNIPlugins
+    k3sContainerd
+    k3sServer
+    runc
+  ];
+
+  # We override most of buildPhase due to peculiarities in k3s's build.
+  # Specifically, it has a 'go generate' which runs part of the package. See
+  # this comment:
+  # https://github.com/NixOS/nixpkgs/pull/158089#discussion_r799965694
+  # So, why do we use buildGoModule at all? For the `vendorSha256` / `go mod download` stuff primarily.
+  buildPhase = ''
+    patchShebangs ./scripts/package-cli ./scripts/download ./scripts/build-upload
+
+    # copy needed 'go generate' inputs into place
+    mkdir -p ./bin/aux
+    rsync -a --no-perms ${k3sServer}/bin/ ./bin/
+    ln -vsf ${runc}/bin/runc ./bin/runc
+    ln -vsf ${k3sCNIPlugins}/bin/cni ./bin/cni
+    ln -vsf ${k3sContainerd}/bin/* ./bin/
+    rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/
+    mkdir -p ./build/static/charts
+    # Note, upstream's chart has a 00 suffix. This seems to not matter though, so we're ignoring that naming detail.
+    export TRAEFIK_CHART_FILE=${traefikChart}
+    # place the traefik chart using their code since it's complicated
+    # We trim the actual download, see patches
+    ./scripts/download
+
+    export ARCH=$GOARCH
+    export DRONE_TAG="v${k3sVersion}"
+    export DRONE_COMMIT="${k3sCommit}"
+    # use ./scripts/package-cli to run 'go generate' + 'go build'
+
+    ./scripts/package-cli
+    mkdir -p $out/bin
+  '';
+
+  # Otherwise it depends on 'getGoDirs', which is normally set in buildPhase
+  doCheck = false;
+
+  installPhase = ''
+    # wildcard to match the arm64 build too
+    install -m 0755 dist/artifacts/k3s* -D $out/bin/k3s
+    wrapProgram $out/bin/k3s \
+      --prefix PATH : ${lib.makeBinPath k3sRuntimeDeps} \
+      --prefix PATH : "$out/bin"
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/k3s --version | grep -F "v${k3sVersion}" >/dev/null
+  '';
+
+  # Fix-Me: Needs to be adapted specifically for 1.23
+  # passthru.updateScript = ./update.sh;
+
+  # Fix-Me: Needs to be adapted specifically for 1.23
+  # passthru.tests = { inherit (nixosTests) k3s-single-node k3s-single-node-docker; };
+
+  meta = baseMeta;
+}
diff --git a/pkgs/applications/networking/cluster/k3s/1_24/0001-script-download-strip-downloading-just-package-CRD.patch b/pkgs/applications/networking/cluster/k3s/1_24/0001-script-download-strip-downloading-just-package-CRD.patch
new file mode 100644
index 000000000000..115fd6824772
--- /dev/null
+++ b/pkgs/applications/networking/cluster/k3s/1_24/0001-script-download-strip-downloading-just-package-CRD.patch
@@ -0,0 +1,41 @@
+From 6f53bd36a40da4c71486e3b79f6e32d53d6eea5d Mon Sep 17 00:00:00 2001
+From: Euan Kemp <euank@euank.com>
+Date: Thu, 3 Feb 2022 23:50:40 -0800
+Subject: [PATCH 2/2] scrips/download: strip downloading, just package CRD
+
+The CRD packaging is a complicated set of commands, so let's reuse it.
+---
+ scripts/download | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+diff --git a/scripts/download b/scripts/download
+index 5effc0562a..82361803ee 100755
+--- a/scripts/download
++++ b/scripts/download
+@@ -24,12 +24,6 @@ rm -rf ${CONTAINERD_DIR}
+ mkdir -p ${CHARTS_DIR}
+ mkdir -p ${DATA_DIR}
+ 
+-curl --compressed -sfL https://github.com/k3s-io/k3s-root/releases/download/${VERSION_ROOT}/k3s-root-${ARCH}.tar | tar xf - --exclude=bin/socat
+-
+-git clone --single-branch --branch=${VERSION_RUNC} --depth=1 https://github.com/opencontainers/runc ${RUNC_DIR}
+-
+-git clone --single-branch --branch=${VERSION_CONTAINERD} --depth=1 https://github.com/k3s-io/containerd ${CONTAINERD_DIR}
+-
+ setup_tmp() {
+     TMP_DIR=$(mktemp -d --tmpdir=${CHARTS_DIR})
+     cleanup() {
+@@ -44,8 +38,8 @@ setup_tmp() {
+ 
+ download_and_package_traefik () {
+   echo "Downloading Traefik Helm chart from ${TRAEFIK_URL}"
+-  curl -sfL ${TRAEFIK_URL} -o ${TMP_DIR}/${TRAEFIK_FILE}
+-  code=$?
++  # nixpkgs: copy in our known traefik chart instead
++  cp $TRAEFIK_CHART_FILE ${TMP_DIR}/${TRAEFIK_FILE}
+ 
+   if [ $code -ne 0 ]; then
+     echo "Error: Failed to download Traefik Helm chart!"
+-- 
+2.34.1
+
diff --git a/pkgs/applications/networking/cluster/k3s/1_24/default.nix b/pkgs/applications/networking/cluster/k3s/1_24/default.nix
new file mode 100644
index 000000000000..18e0258432ee
--- /dev/null
+++ b/pkgs/applications/networking/cluster/k3s/1_24/default.nix
@@ -0,0 +1,329 @@
+{ stdenv
+, lib
+, makeWrapper
+, socat
+, iptables
+, iproute2
+, bridge-utils
+, btrfs-progs
+, conntrack-tools
+, buildGoModule
+, runc
+, rsync
+, kmod
+, libseccomp
+, pkg-config
+, ethtool
+, util-linux
+, fetchFromGitHub
+, fetchurl
+, fetchzip
+, fetchgit
+, zstd
+, yq-go
+, nixosTests
+, k3s
+, pkgsBuildBuild
+}:
+
+# k3s is a kinda weird derivation. One of the main points of k3s is the
+# simplicity of it being one binary that can perform several tasks.
+# However, when you have a good package manager (like nix), that doesn't
+# actually make much of a difference; you don't really care if it's one binary
+# or 10 since with a good package manager, installing and running it is
+# identical.
+# Since upstream k3s packages itself as one large binary with several
+# "personalities" (in the form of subcommands like 'k3s agent' and 'k3s
+# kubectl'), it ends up being easiest to mostly mimic upstream packaging, with
+# some exceptions.
+# K3s also carries patches to some packages (such as containerd and cni
+# plugins), so we intentionally use the k3s versions of those binaries for k3s,
+# even if the upstream version of those binaries exist in nixpkgs already. In
+# the end, that means we have a thick k3s binary that behaves like the upstream
+# one for the most part.
+# However, k3s also bundles several pieces of unpatched software, from the
+# strongswan vpn software, to iptables, to socat, conntrack, busybox, etc.
+# Those pieces of software we entirely ignore upstream's handling of, and just
+# make sure they're in the path if desired.
+let
+  k3sVersion = "1.24.4+k3s1";     # k3s git tag
+  k3sCommit = "c3f830e9b9ed8a4d9d0e2aa663b4591b923a296e"; # k3s git commit at the above version
+  k3sRepoSha256 = "00ns6n7jxnacah8ahndhgdb160prgsqhswbb5809kkgvig7k8b27";
+  k3sVendorSha256 = "sha256-ReZvJCgxqffG2H39JlynGPUBSV5ngPkRtAoZ++OQZZI=";
+
+  # taken from ./manifests/traefik.yaml, extracted from '.spec.chart' https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/download#L9
+  # The 'patch' and 'minor' versions are currently hardcoded as single digits only, so ignore the trailing two digits. Weird, I know.
+  traefikChartVersion = "10.19.3";
+  traefikChartSha256 = "04zg5li957svgscdmkzmzjkwljaljyav68rzxmhakkwgav6q9058";
+
+  # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L47
+  k3sRootVersion = "0.11.0";
+  k3sRootSha256 = "016n56vi09xkvjph7wgzb2m86mhd5x65fs4d11pmh20hl249r620";
+
+  # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L45
+  k3sCNIVersion = "1.1.1-k3s1";
+  k3sCNISha256 = "14mb3zsqibj1sn338gjmsyksbm0mxv9p016dij7zidccx2rzn6nl";
+
+  # taken from go.mod, the 'github.com/containerd/containerd' line
+  # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
+  containerdVersion = "1.5.13-k3s1";
+  containerdSha256 = "09bj4ghwbsj9whkv1d5icqs52k64m449j8b73dmak2wz62fbzbvp";
+
+  # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
+  criCtlVersion = "1.24.0-k3s1";
+
+  baseMeta = k3s.meta;
+
+  # https://github.com/k3s-io/k3s/blob/5fb370e53e0014dc96183b8ecb2c25a61e891e76/scripts/build#L19-L40
+  versionldflags = [
+    "-X github.com/rancher/k3s/pkg/version.Version=v${k3sVersion}"
+    "-X github.com/rancher/k3s/pkg/version.GitCommit=${lib.substring 0 8 k3sCommit}"
+    "-X k8s.io/client-go/pkg/version.gitVersion=v${k3sVersion}"
+    "-X k8s.io/client-go/pkg/version.gitCommit=${k3sCommit}"
+    "-X k8s.io/client-go/pkg/version.gitTreeState=clean"
+    "-X k8s.io/client-go/pkg/version.buildDate=1970-01-01T01:01:01Z"
+    "-X k8s.io/component-base/version.gitVersion=v${k3sVersion}"
+    "-X k8s.io/component-base/version.gitCommit=${k3sCommit}"
+    "-X k8s.io/component-base/version.gitTreeState=clean"
+    "-X k8s.io/component-base/version.buildDate=1970-01-01T01:01:01Z"
+    "-X github.com/kubernetes-sigs/cri-tools/pkg/version.Version=v${criCtlVersion}"
+    "-X github.com/containerd/containerd/version.Version=v${containerdVersion}"
+    "-X github.com/containerd/containerd/version.Package=github.com/k3s-io/containerd"
+  ];
+
+  # bundled into the k3s binary
+  traefikChart = fetchurl {
+    url = "https://helm.traefik.io/traefik/traefik-${traefikChartVersion}.tgz";
+    sha256 = traefikChartSha256;
+  };
+  # so, k3s is a complicated thing to package
+  # This derivation attempts to avoid including any random binaries from the
+  # internet. k3s-root is _mostly_ binaries built to be bundled in k3s (which
+  # we don't care about doing, we can add those as build or runtime
+  # dependencies using a real package manager).
+  # In addition to those binaries, it's also configuration though (right now
+  # mostly strongswan configuration), and k3s does use those files.
+  # As such, we download it in order to grab 'etc' and bundle it into the final
+  # k3s binary.
+  k3sRoot = fetchzip {
+    # Note: marked as apache 2.0 license
+    url = "https://github.com/k3s-io/k3s-root/releases/download/v${k3sRootVersion}/k3s-root-amd64.tar";
+    sha256 = k3sRootSha256;
+    stripRoot = false;
+  };
+  k3sCNIPlugins = buildGoModule rec {
+    pname = "k3s-cni-plugins";
+    version = k3sCNIVersion;
+    vendorSha256 = null;
+
+    subPackages = [ "." ];
+
+    src = fetchFromGitHub {
+      owner = "rancher";
+      repo = "plugins";
+      rev = "v${version}";
+      sha256 = k3sCNISha256;
+    };
+
+    postInstall = ''
+      mv $out/bin/plugins $out/bin/cni
+    '';
+
+    meta = baseMeta // {
+      description = "CNI plugins, as patched by rancher for k3s";
+    };
+  };
+  # Grab this separately from a build because it's used by both stages of the
+  # k3s build.
+  k3sRepo = fetchgit {
+    url = "https://github.com/k3s-io/k3s";
+    rev = "v${k3sVersion}";
+    sha256 = k3sRepoSha256;
+  };
+  # Stage 1 of the k3s build:
+  # Let's talk about how k3s is structured.
+  # One of the ideas of k3s is that there's the single "k3s" binary which can
+  # do everything you need, from running a k3s server, to being a worker node,
+  # to running kubectl.
+  # The way that actually works is that k3s is a single go binary that contains
+  # a bunch of bindata that it unpacks at runtime into directories (either the
+  # user's home directory or /var/lib/rancher if run as root).
+  # This bindata includes both binaries and configuration.
+  # In order to let nixpkgs do all its autostripping/patching/etc, we split this into two derivations.
+  # First, we build all the binaries that get packed into the thick k3s binary
+  # (and output them from one derivation so they'll all be suitably patched up).
+  # Then, we bundle those binaries into our thick k3s binary and use that as
+  # the final single output.
+  # This approach was chosen because it ensures the bundled binaries all are
+  # correctly built to run with nix (we can lean on the existing buildGoModule
+  # stuff), and we can again lean on that tooling for the final k3s binary too.
+  # Other alternatives would be to manually run the
+  # strip/patchelf/remove-references step ourselves in the installPhase of the
+  # derivation when we've built all the binaries, but haven't bundled them in
+  # with generated bindata yet.
+
+  k3sServer = buildGoModule rec {
+    pname = "k3s-server";
+    version = k3sVersion;
+
+    src = k3sRepo;
+    vendorSha256 = k3sVendorSha256;
+
+    nativeBuildInputs = [ pkg-config ];
+    buildInputs = [ libseccomp ];
+
+    subPackages = [ "cmd/server" ];
+    ldflags = versionldflags;
+
+    # create the multicall symlinks for k3s
+    postInstall = ''
+      mv $out/bin/server $out/bin/k3s
+      pushd $out
+      # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/build#L105-L113
+      ln -s k3s ./bin/k3s-agent
+      ln -s k3s ./bin/k3s-server
+      ln -s k3s ./bin/k3s-etcd-snapshot
+      ln -s k3s ./bin/k3s-secrets-encrypt
+      ln -s k3s ./bin/k3s-certificate
+      ln -s k3s ./bin/kubectl
+      ln -s k3s ./bin/crictl
+      ln -s k3s ./bin/ctr
+      popd
+    '';
+
+    meta = baseMeta // {
+      description = "The various binaries that get packaged into the final k3s binary";
+    };
+  };
+  k3sContainerd = buildGoModule {
+    pname = "k3s-containerd";
+    version = containerdVersion;
+    src = fetchFromGitHub {
+      owner = "k3s-io";
+      repo = "containerd";
+      rev = "v${containerdVersion}";
+      sha256 = containerdSha256;
+    };
+    vendorSha256 = null;
+    buildInputs = [ btrfs-progs ];
+    subPackages = [ "cmd/containerd" "cmd/containerd-shim-runc-v2" ];
+    ldflags = versionldflags;
+  };
+in
+buildGoModule rec {
+  pname = "k3s";
+  version = k3sVersion;
+
+  src = k3sRepo;
+  vendorSha256 = k3sVendorSha256;
+
+  patches = [
+    ./0001-script-download-strip-downloading-just-package-CRD.patch
+  ];
+
+  postPatch = ''
+    # Nix prefers dynamically linked binaries over static binary.
+
+    substituteInPlace scripts/package-cli \
+      --replace '"$LDFLAGS $STATIC" -o' \
+                '"$LDFLAGS" -o' \
+      --replace "STATIC=\"-extldflags \'-static\'\"" \
+                ""
+
+    # Upstream codegen fails with trimpath set. Removes "trimpath" for 'go generate':
+
+    substituteInPlace scripts/package-cli \
+      --replace '"''${GO}" generate' \
+                'GOFLAGS="" \
+                 GOOS="${pkgsBuildBuild.go.GOOS}" \
+                 GOARCH="${pkgsBuildBuild.go.GOARCH}" \
+                 CC="${pkgsBuildBuild.stdenv.cc}/bin/cc" \
+                 "''${GO}" generate'
+  '';
+
+  # Important utilities used by the kubelet, see
+  # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
+  # Note the list in that issue is stale and some aren't relevant for k3s.
+  k3sRuntimeDeps = [
+    kmod
+    socat
+    iptables
+    iproute2
+    bridge-utils
+    ethtool
+    util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
+    conntrack-tools
+  ];
+
+  buildInputs = k3sRuntimeDeps;
+
+  nativeBuildInputs = [
+    makeWrapper
+    rsync
+    yq-go
+    zstd
+  ];
+
+  # embedded in the final k3s cli
+  propagatedBuildInputs = [
+    k3sCNIPlugins
+    k3sContainerd
+    k3sServer
+    runc
+  ];
+
+  # We override most of buildPhase due to peculiarities in k3s's build.
+  # Specifically, it has a 'go generate' which runs part of the package. See
+  # this comment:
+  # https://github.com/NixOS/nixpkgs/pull/158089#discussion_r799965694
+  # So, why do we use buildGoModule at all? For the `vendorSha256` / `go mod download` stuff primarily.
+  buildPhase = ''
+    patchShebangs ./scripts/package-cli ./scripts/download ./scripts/build-upload
+
+    # copy needed 'go generate' inputs into place
+    mkdir -p ./bin/aux
+    rsync -a --no-perms ${k3sServer}/bin/ ./bin/
+    ln -vsf ${runc}/bin/runc ./bin/runc
+    ln -vsf ${k3sCNIPlugins}/bin/cni ./bin/cni
+    ln -vsf ${k3sContainerd}/bin/* ./bin/
+    rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/
+    mkdir -p ./build/static/charts
+    # Note, upstream's chart has a 00 suffix. This seems to not matter though, so we're ignoring that naming detail.
+    export TRAEFIK_CHART_FILE=${traefikChart}
+    # place the traefik chart using their code since it's complicated
+    # We trim the actual download, see patches
+    ./scripts/download
+
+    export ARCH=$GOARCH
+    export DRONE_TAG="v${k3sVersion}"
+    export DRONE_COMMIT="${k3sCommit}"
+    # use ./scripts/package-cli to run 'go generate' + 'go build'
+
+    ./scripts/package-cli
+    mkdir -p $out/bin
+  '';
+
+  # Otherwise it depends on 'getGoDirs', which is normally set in buildPhase
+  doCheck = false;
+
+  installPhase = ''
+    # wildcard to match the arm64 build too
+    install -m 0755 dist/artifacts/k3s* -D $out/bin/k3s
+    wrapProgram $out/bin/k3s \
+      --prefix PATH : ${lib.makeBinPath k3sRuntimeDeps} \
+      --prefix PATH : "$out/bin"
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/k3s --version | grep -F "v${k3sVersion}" >/dev/null
+  '';
+
+  # Fix-Me: Needs to be adapted specifically for 1.24
+  # passthru.updateScript = ./update.sh;
+
+  # Fix-Me: Needs to be adapted specifically for 1.24
+  # passthru.tests = nixosTests.k3s;
+
+  meta = baseMeta;
+}
diff --git a/pkgs/applications/networking/cluster/k3s/1_25/0001-script-download-strip-downloading-just-package-CRD.patch b/pkgs/applications/networking/cluster/k3s/1_25/0001-script-download-strip-downloading-just-package-CRD.patch
new file mode 100644
index 000000000000..115fd6824772
--- /dev/null
+++ b/pkgs/applications/networking/cluster/k3s/1_25/0001-script-download-strip-downloading-just-package-CRD.patch
@@ -0,0 +1,41 @@
+From 6f53bd36a40da4c71486e3b79f6e32d53d6eea5d Mon Sep 17 00:00:00 2001
+From: Euan Kemp <euank@euank.com>
+Date: Thu, 3 Feb 2022 23:50:40 -0800
+Subject: [PATCH 2/2] scrips/download: strip downloading, just package CRD
+
+The CRD packaging is a complicated set of commands, so let's reuse it.
+---
+ scripts/download | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+diff --git a/scripts/download b/scripts/download
+index 5effc0562a..82361803ee 100755
+--- a/scripts/download
++++ b/scripts/download
+@@ -24,12 +24,6 @@ rm -rf ${CONTAINERD_DIR}
+ mkdir -p ${CHARTS_DIR}
+ mkdir -p ${DATA_DIR}
+ 
+-curl --compressed -sfL https://github.com/k3s-io/k3s-root/releases/download/${VERSION_ROOT}/k3s-root-${ARCH}.tar | tar xf - --exclude=bin/socat
+-
+-git clone --single-branch --branch=${VERSION_RUNC} --depth=1 https://github.com/opencontainers/runc ${RUNC_DIR}
+-
+-git clone --single-branch --branch=${VERSION_CONTAINERD} --depth=1 https://github.com/k3s-io/containerd ${CONTAINERD_DIR}
+-
+ setup_tmp() {
+     TMP_DIR=$(mktemp -d --tmpdir=${CHARTS_DIR})
+     cleanup() {
+@@ -44,8 +38,8 @@ setup_tmp() {
+ 
+ download_and_package_traefik () {
+   echo "Downloading Traefik Helm chart from ${TRAEFIK_URL}"
+-  curl -sfL ${TRAEFIK_URL} -o ${TMP_DIR}/${TRAEFIK_FILE}
+-  code=$?
++  # nixpkgs: copy in our known traefik chart instead
++  cp $TRAEFIK_CHART_FILE ${TMP_DIR}/${TRAEFIK_FILE}
+ 
+   if [ $code -ne 0 ]; then
+     echo "Error: Failed to download Traefik Helm chart!"
+-- 
+2.34.1
+
diff --git a/pkgs/applications/networking/cluster/k3s/1_25/default.nix b/pkgs/applications/networking/cluster/k3s/1_25/default.nix
new file mode 100644
index 000000000000..dc34821fb255
--- /dev/null
+++ b/pkgs/applications/networking/cluster/k3s/1_25/default.nix
@@ -0,0 +1,329 @@
+{ stdenv
+, lib
+, makeWrapper
+, socat
+, iptables
+, iproute2
+, bridge-utils
+, btrfs-progs
+, conntrack-tools
+, buildGoModule
+, runc
+, rsync
+, kmod
+, libseccomp
+, pkg-config
+, ethtool
+, util-linux
+, fetchFromGitHub
+, fetchurl
+, fetchzip
+, fetchgit
+, zstd
+, yq-go
+, nixosTests
+, pkgsBuildBuild
+, k3s
+}:
+
+# k3s is a kinda weird derivation. One of the main points of k3s is the
+# simplicity of it being one binary that can perform several tasks.
+# However, when you have a good package manager (like nix), that doesn't
+# actually make much of a difference; you don't really care if it's one binary
+# or 10 since with a good package manager, installing and running it is
+# identical.
+# Since upstream k3s packages itself as one large binary with several
+# "personalities" (in the form of subcommands like 'k3s agent' and 'k3s
+# kubectl'), it ends up being easiest to mostly mimic upstream packaging, with
+# some exceptions.
+# K3s also carries patches to some packages (such as containerd and cni
+# plugins), so we intentionally use the k3s versions of those binaries for k3s,
+# even if the upstream version of those binaries exist in nixpkgs already. In
+# the end, that means we have a thick k3s binary that behaves like the upstream
+# one for the most part.
+# However, k3s also bundles several pieces of unpatched software, from the
+# strongswan vpn software, to iptables, to socat, conntrack, busybox, etc.
+# Those pieces of software we entirely ignore upstream's handling of, and just
+# make sure they're in the path if desired.
+let
+  k3sVersion = "1.25.3+k3s1";     # k3s git tag
+  k3sCommit = "f2585c1671b31b4b34bddbb3bf4e7d69662b0821"; # k3s git commit at the above version
+  k3sRepoSha256 = "0zwf3iwjcidx14zw36s1hr0q8wmmbfc0rfqwd7fmpjq597h8zkms";
+  k3sVendorSha256 = "sha256-U67tJRGqPFk5AfRe7I50zKGC9HJ2oh+iI/C7qF/76BQ=";
+
+  # taken from ./manifests/traefik.yaml, extracted from '.spec.chart' https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/download#L9
+  # The 'patch' and 'minor' versions are currently hardcoded as single digits only, so ignore the trailing two digits. Weird, I know.
+  traefikChartVersion = "12.0.0";
+  traefikChartSha256 = "1sqmi71fi3ad5dh5fmsp9mv80x6pkgqwi4r9fr8l6i9sdnai6f1a";
+
+  # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L47
+  k3sRootVersion = "0.11.0";
+  k3sRootSha256 = "016n56vi09xkvjph7wgzb2m86mhd5x65fs4d11pmh20hl249r620";
+
+  # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L45
+  k3sCNIVersion = "1.1.1-k3s1";
+  k3sCNISha256 = "14mb3zsqibj1sn338gjmsyksbm0mxv9p016dij7zidccx2rzn6nl";
+
+  # taken from go.mod, the 'github.com/containerd/containerd' line
+  # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
+  containerdVersion = "1.5.13-k3s2";
+  containerdSha256 = "1pfr2ji4aij9js90gf4a3hqnhyw5hshcjdccm62l700j68gs5z97";
+
+  # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
+  criCtlVersion = "1.25.0-k3s1";
+
+  baseMeta = k3s.meta;
+
+  # https://github.com/k3s-io/k3s/blob/5fb370e53e0014dc96183b8ecb2c25a61e891e76/scripts/build#L19-L40
+  versionldflags = [
+    "-X github.com/rancher/k3s/pkg/version.Version=v${k3sVersion}"
+    "-X github.com/rancher/k3s/pkg/version.GitCommit=${lib.substring 0 8 k3sCommit}"
+    "-X k8s.io/client-go/pkg/version.gitVersion=v${k3sVersion}"
+    "-X k8s.io/client-go/pkg/version.gitCommit=${k3sCommit}"
+    "-X k8s.io/client-go/pkg/version.gitTreeState=clean"
+    "-X k8s.io/client-go/pkg/version.buildDate=1970-01-01T01:01:01Z"
+    "-X k8s.io/component-base/version.gitVersion=v${k3sVersion}"
+    "-X k8s.io/component-base/version.gitCommit=${k3sCommit}"
+    "-X k8s.io/component-base/version.gitTreeState=clean"
+    "-X k8s.io/component-base/version.buildDate=1970-01-01T01:01:01Z"
+    "-X github.com/kubernetes-sigs/cri-tools/pkg/version.Version=v${criCtlVersion}"
+    "-X github.com/containerd/containerd/version.Version=v${containerdVersion}"
+    "-X github.com/containerd/containerd/version.Package=github.com/k3s-io/containerd"
+  ];
+
+  # bundled into the k3s binary
+  traefikChart = fetchurl {
+    url = "https://helm.traefik.io/traefik/traefik-${traefikChartVersion}.tgz";
+    sha256 = traefikChartSha256;
+  };
+  # so, k3s is a complicated thing to package
+  # This derivation attempts to avoid including any random binaries from the
+  # internet. k3s-root is _mostly_ binaries built to be bundled in k3s (which
+  # we don't care about doing, we can add those as build or runtime
+  # dependencies using a real package manager).
+  # In addition to those binaries, it's also configuration though (right now
+  # mostly strongswan configuration), and k3s does use those files.
+  # As such, we download it in order to grab 'etc' and bundle it into the final
+  # k3s binary.
+  k3sRoot = fetchzip {
+    # Note: marked as apache 2.0 license
+    url = "https://github.com/k3s-io/k3s-root/releases/download/v${k3sRootVersion}/k3s-root-amd64.tar";
+    sha256 = k3sRootSha256;
+    stripRoot = false;
+  };
+  k3sCNIPlugins = buildGoModule rec {
+    pname = "k3s-cni-plugins";
+    version = k3sCNIVersion;
+    vendorSha256 = null;
+
+    subPackages = [ "." ];
+
+    src = fetchFromGitHub {
+      owner = "rancher";
+      repo = "plugins";
+      rev = "v${version}";
+      sha256 = k3sCNISha256;
+    };
+
+    postInstall = ''
+      mv $out/bin/plugins $out/bin/cni
+    '';
+
+    meta = baseMeta // {
+      description = "CNI plugins, as patched by rancher for k3s";
+    };
+  };
+  # Grab this separately from a build because it's used by both stages of the
+  # k3s build.
+  k3sRepo = fetchgit {
+    url = "https://github.com/k3s-io/k3s";
+    rev = "v${k3sVersion}";
+    sha256 = k3sRepoSha256;
+  };
+  # Stage 1 of the k3s build:
+  # Let's talk about how k3s is structured.
+  # One of the ideas of k3s is that there's the single "k3s" binary which can
+  # do everything you need, from running a k3s server, to being a worker node,
+  # to running kubectl.
+  # The way that actually works is that k3s is a single go binary that contains
+  # a bunch of bindata that it unpacks at runtime into directories (either the
+  # user's home directory or /var/lib/rancher if run as root).
+  # This bindata includes both binaries and configuration.
+  # In order to let nixpkgs do all its autostripping/patching/etc, we split this into two derivations.
+  # First, we build all the binaries that get packed into the thick k3s binary
+  # (and output them from one derivation so they'll all be suitably patched up).
+  # Then, we bundle those binaries into our thick k3s binary and use that as
+  # the final single output.
+  # This approach was chosen because it ensures the bundled binaries all are
+  # correctly built to run with nix (we can lean on the existing buildGoModule
+  # stuff), and we can again lean on that tooling for the final k3s binary too.
+  # Other alternatives would be to manually run the
+  # strip/patchelf/remove-references step ourselves in the installPhase of the
+  # derivation when we've built all the binaries, but haven't bundled them in
+  # with generated bindata yet.
+
+  k3sServer = buildGoModule rec {
+    pname = "k3s-server";
+    version = k3sVersion;
+
+    src = k3sRepo;
+    vendorSha256 = k3sVendorSha256;
+
+    nativeBuildInputs = [ pkg-config ];
+    buildInputs = [ libseccomp ];
+
+    subPackages = [ "cmd/server" ];
+    ldflags = versionldflags;
+
+    # create the multicall symlinks for k3s
+    postInstall = ''
+      mv $out/bin/server $out/bin/k3s
+      pushd $out
+      # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/build#L105-L113
+      ln -s k3s ./bin/k3s-agent
+      ln -s k3s ./bin/k3s-server
+      ln -s k3s ./bin/k3s-etcd-snapshot
+      ln -s k3s ./bin/k3s-secrets-encrypt
+      ln -s k3s ./bin/k3s-certificate
+      ln -s k3s ./bin/kubectl
+      ln -s k3s ./bin/crictl
+      ln -s k3s ./bin/ctr
+      popd
+    '';
+
+    meta = baseMeta // {
+      description = "The various binaries that get packaged into the final k3s binary";
+    };
+  };
+  k3sContainerd = buildGoModule {
+    pname = "k3s-containerd";
+    version = containerdVersion;
+    src = fetchFromGitHub {
+      owner = "k3s-io";
+      repo = "containerd";
+      rev = "v${containerdVersion}";
+      sha256 = containerdSha256;
+    };
+    vendorSha256 = null;
+    buildInputs = [ btrfs-progs ];
+    subPackages = [ "cmd/containerd" "cmd/containerd-shim-runc-v2" ];
+    ldflags = versionldflags;
+  };
+in
+buildGoModule rec {
+  pname = "k3s";
+  version = k3sVersion;
+
+  src = k3sRepo;
+  vendorSha256 = k3sVendorSha256;
+
+  patches = [
+    ./0001-script-download-strip-downloading-just-package-CRD.patch
+  ];
+
+  postPatch = ''
+    # Nix prefers dynamically linked binaries over static binary.
+
+    substituteInPlace scripts/package-cli \
+      --replace '"$LDFLAGS $STATIC" -o' \
+                '"$LDFLAGS" -o' \
+      --replace "STATIC=\"-extldflags \'-static\'\"" \
+                ""
+
+    # Upstream codegen fails with trimpath set. Removes "trimpath" for 'go generate':
+
+    substituteInPlace scripts/package-cli \
+      --replace '"''${GO}" generate' \
+                'GOFLAGS="" \
+                 GOOS="${pkgsBuildBuild.go.GOOS}" \
+                 GOARCH="${pkgsBuildBuild.go.GOARCH}" \
+                 CC="${pkgsBuildBuild.stdenv.cc}/bin/cc" \
+                 "''${GO}" generate'
+  '';
+
+  # Important utilities used by the kubelet, see
+  # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
+  # Note the list in that issue is stale and some aren't relevant for k3s.
+  k3sRuntimeDeps = [
+    kmod
+    socat
+    iptables
+    iproute2
+    bridge-utils
+    ethtool
+    util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
+    conntrack-tools
+  ];
+
+  buildInputs = k3sRuntimeDeps;
+
+  nativeBuildInputs = [
+    makeWrapper
+    rsync
+    yq-go
+    zstd
+  ];
+
+  # embedded in the final k3s cli
+  propagatedBuildInputs = [
+    k3sCNIPlugins
+    k3sContainerd
+    k3sServer
+    runc
+  ];
+
+  # We override most of buildPhase due to peculiarities in k3s's build.
+  # Specifically, it has a 'go generate' which runs part of the package. See
+  # this comment:
+  # https://github.com/NixOS/nixpkgs/pull/158089#discussion_r799965694
+  # So, why do we use buildGoModule at all? For the `vendorSha256` / `go mod download` stuff primarily.
+  buildPhase = ''
+    patchShebangs ./scripts/package-cli ./scripts/download ./scripts/build-upload
+
+    # copy needed 'go generate' inputs into place
+    mkdir -p ./bin/aux
+    rsync -a --no-perms ${k3sServer}/bin/ ./bin/
+    ln -vsf ${runc}/bin/runc ./bin/runc
+    ln -vsf ${k3sCNIPlugins}/bin/cni ./bin/cni
+    ln -vsf ${k3sContainerd}/bin/* ./bin/
+    rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/
+    mkdir -p ./build/static/charts
+    # Note, upstream's chart has a 00 suffix. This seems to not matter though, so we're ignoring that naming detail.
+    export TRAEFIK_CHART_FILE=${traefikChart}
+    # place the traefik chart using their code since it's complicated
+    # We trim the actual download, see patches
+    ./scripts/download
+
+    export ARCH=$GOARCH
+    export DRONE_TAG="v${k3sVersion}"
+    export DRONE_COMMIT="${k3sCommit}"
+    # use ./scripts/package-cli to run 'go generate' + 'go build'
+
+    ./scripts/package-cli
+    mkdir -p $out/bin
+  '';
+
+  # Otherwise it depends on 'getGoDirs', which is normally set in buildPhase
+  doCheck = false;
+
+  installPhase = ''
+    # wildcard to match the arm64 build too
+    install -m 0755 dist/artifacts/k3s* -D $out/bin/k3s
+    wrapProgram $out/bin/k3s \
+      --prefix PATH : ${lib.makeBinPath k3sRuntimeDeps} \
+      --prefix PATH : "$out/bin"
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/k3s --version | grep -F "v${k3sVersion}" >/dev/null
+  '';
+
+  # Fix-Me: Needs to be adapted specifically for 1.25
+  # passthru.updateScript = ./update.sh;
+
+  # Fix-Me: Needs to be adapted specifically for 1.25
+  # passthru.tests = nixosTests.k3s;
+
+  meta = baseMeta;
+}
diff --git a/pkgs/applications/networking/cluster/k3s/chart-versions.nix b/pkgs/applications/networking/cluster/k3s/1_26/chart-versions.nix
similarity index 100%
rename from pkgs/applications/networking/cluster/k3s/chart-versions.nix
rename to pkgs/applications/networking/cluster/k3s/1_26/chart-versions.nix
diff --git a/pkgs/applications/networking/cluster/k3s/default.nix b/pkgs/applications/networking/cluster/k3s/1_26/default.nix
similarity index 100%
rename from pkgs/applications/networking/cluster/k3s/default.nix
rename to pkgs/applications/networking/cluster/k3s/1_26/default.nix
diff --git a/pkgs/applications/networking/cluster/k3s/update.sh b/pkgs/applications/networking/cluster/k3s/1_26/update.sh
similarity index 100%
rename from pkgs/applications/networking/cluster/k3s/update.sh
rename to pkgs/applications/networking/cluster/k3s/1_26/update.sh
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8ad2ba05d011..fc3d0343e6fb 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -30579,7 +30579,11 @@ with pkgs;
 
   jwm-settings-manager = callPackage ../applications/window-managers/jwm/jwm-settings-manager.nix { };
 
-  k3s = callPackage ../applications/networking/cluster/k3s { };
+  k3s_1_23 = callPackage ../applications/networking/cluster/k3s/1_23 { };
+  k3s_1_24 = callPackage ../applications/networking/cluster/k3s/1_24 { };
+  k3s_1_25 = callPackage ../applications/networking/cluster/k3s/1_25 { };
+  k3s_1_26 = callPackage ../applications/networking/cluster/k3s/1_26 { };
+  k3s = k3s_1_26;
 
   k3sup = callPackage ../applications/networking/cluster/k3sup {};
 

From e613d0cd72776fa67b31ab4c76201929bfd90e60 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@sap.com>
Date: Mon, 5 Sep 2022 16:19:08 +0200
Subject: [PATCH 039/176] nghttp3: add curlHTTP3 to passthru.tests

---
 pkgs/development/libraries/nghttp3/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/libraries/nghttp3/default.nix b/pkgs/development/libraries/nghttp3/default.nix
index af83fb29c01e..2810114cb6ba 100644
--- a/pkgs/development/libraries/nghttp3/default.nix
+++ b/pkgs/development/libraries/nghttp3/default.nix
@@ -1,6 +1,7 @@
 { lib, stdenv, fetchFromGitHub
 , autoreconfHook, pkg-config, file
 , cunit, ncurses
+, curlHTTP3
 }:
 
 stdenv.mkDerivation rec {
@@ -26,6 +27,10 @@ stdenv.mkDerivation rec {
   doCheck = true;
   enableParallelBuilding = true;
 
+  passthru.tests = {
+    inherit curlHTTP3;
+  };
+
   meta = with lib; {
     homepage = "https://github.com/ngtcp2/nghttp3";
     description = "nghttp3 is an implementation of HTTP/3 mapping over QUIC and QPACK in C.";

From cb86d7d6626ceba84c2a7e1d17562342c92b524f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@sap.com>
Date: Mon, 5 Sep 2022 16:19:17 +0200
Subject: [PATCH 040/176] ngtcp2: add curlHTTP3 to passthru.tests

---
 pkgs/development/libraries/ngtcp2/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix
index d6cacc0aa7f7..c4b7dad90910 100644
--- a/pkgs/development/libraries/ngtcp2/default.nix
+++ b/pkgs/development/libraries/ngtcp2/default.nix
@@ -3,6 +3,7 @@
 , libev, nghttp3, quictls
 , cunit, ncurses
 , withJemalloc ? false, jemalloc
+, curlHTTP3
 }:
 
 stdenv.mkDerivation rec {
@@ -29,6 +30,10 @@ stdenv.mkDerivation rec {
   doCheck = true;
   enableParallelBuilding = true;
 
+  passthru.tests = {
+    inherit curlHTTP3;
+  };
+
   meta = with lib; {
     homepage = "https://github.com/ngtcp2/ngtcp2";
     description = "ngtcp2 project is an effort to implement QUIC protocol which is now being discussed in IETF QUICWG for its standardization.";

From a2093d3ff99d91468781c864f38767153c499e8a Mon Sep 17 00:00:00 2001
From: OPNA2608 <christoph.neidahl@gmail.com>
Date: Sun, 5 Feb 2023 11:26:46 +0100
Subject: [PATCH 041/176] haguichi: Add passthru.updateScript

The upstream repo has regular releases and elementaryOS-specific releases.
We only want the regular releases, so filter out the elementaryOS ones in a
custom updateScript.
---
 pkgs/tools/networking/haguichi/default.nix |  4 +++-
 pkgs/tools/networking/haguichi/update.sh   | 13 +++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)
 create mode 100755 pkgs/tools/networking/haguichi/update.sh

diff --git a/pkgs/tools/networking/haguichi/default.nix b/pkgs/tools/networking/haguichi/default.nix
index 34ba1da28e4a..deb51191306d 100644
--- a/pkgs/tools/networking/haguichi/default.nix
+++ b/pkgs/tools/networking/haguichi/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     owner = "ztefn";
     repo = "haguichi";
     rev = version;
-    sha256 = "1kgjl9g9lyg00cfx4x28s4xyqsqk5057xv6k2cj6ckg9lkxaixvc";
+    hash = "sha256-bPeo+qTpTWYkE9PsfgooE2vsO9FIdNIdA+B5ml6i8s0=";
   };
 
   nativeBuildInputs = [
@@ -44,6 +44,8 @@ stdenv.mkDerivation rec {
     patchShebangs meson_post_install.py
   '';
 
+  passthru.updateScript = ./update.sh;
+
   meta = with lib; {
     description = "Graphical frontend for Hamachi on Linux";
     homepage = "https://haguichi.net/";
diff --git a/pkgs/tools/networking/haguichi/update.sh b/pkgs/tools/networking/haguichi/update.sh
new file mode 100755
index 000000000000..49a76a79d7ae
--- /dev/null
+++ b/pkgs/tools/networking/haguichi/update.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq common-updater-scripts
+
+set -euo pipefail
+
+version="$(
+    curl -s https://api.github.com/repos/ztefn/haguichi/releases |
+    jq '.[] | select(.target_commitish!="elementary") | .tag_name' --raw-output |
+    sort --version-sort --reverse |
+    head -n1
+)"
+
+update-source-version haguichi "$version"

From afb99ad5d444beab408e996a3eed005a50558d18 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Tue, 7 Feb 2023 09:56:44 +0000
Subject: [PATCH 042/176] graalvm*-ce: wrap native-image to pass
 -H:CLibraryPath, misc improvements

Fixes issue #214922 by not adding C libraries to the default library
path of GraalVM. This should reduce the closure size of native compiled
binaries in nixpkgs again, e.g.:

Before:
```
$ ldd ./result/bin/bb
	linux-vdso.so.1 (0x00007fff2669b000)
	libstdc++.so.6 => /nix/store/qbgfsaviwqi2p6jr7an1g2754sv3xqhn-gcc-11.3.0-lib/lib/libstdc++.so.6 (0x00007f77fc0cf000)
	libm.so.6 => /nix/store/l7vp7c9z03dspbmss3gq5wdwx5c6ifcq-graalvm11-ce-22.3.0/lib/svm/clibraries/linux-amd64/libm.so.6 (0x00007f77fbfef000)
	libpthread.so.0 => /nix/store/l7vp7c9z03dspbmss3gq5wdwx5c6ifcq-graalvm11-ce-22.3.0/lib/svm/clibraries/linux-amd64/libpthread.so.0 (0x00007f77fbfea000)
	libdl.so.2 => /nix/store/l7vp7c9z03dspbmss3gq5wdwx5c6ifcq-graalvm11-ce-22.3.0/lib/svm/clibraries/linux-amd64/libdl.so.2 (0x00007f77fbfe5000)
	librt.so.1 => /nix/store/l7vp7c9z03dspbmss3gq5wdwx5c6ifcq-graalvm11-ce-22.3.0/lib/svm/clibraries/linux-amd64/librt.so.1 (0x00007f77fbfde000)
	libc.so.6 => /nix/store/l7vp7c9z03dspbmss3gq5wdwx5c6ifcq-graalvm11-ce-22.3.0/lib/svm/clibraries/linux-amd64/libc.so.6 (0x00007f77fbdd5000)
	/nix/store/c35hf8g5b9vksadym9dbjrd6p2y11m8h-glibc-2.35-224/lib/ld-linux-x86-64.so.2 => /nix/store/9xfad3b5z4y00mzmk2wnn4900q0qmxns-glibc-2.35-224/lib64/ld-linux-x86-64.so.2 (0x00007f77fc2e7000)
	libgcc_s.so.1 => /nix/store/qbgfsaviwqi2p6jr7an1g2754sv3xqhn-gcc-11.3.0-lib/lib/libgcc_s.so.1 (0x00007f77fbdbb000)
```

After:
```
$ ldd ./result/bin/bb
	linux-vdso.so.1 (0x00007fffdfd4e000)
	libstdc++.so.6 => /nix/store/qbgfsaviwqi2p6jr7an1g2754sv3xqhn-gcc-11.3.0-lib/lib/libstdc++.so.6 (0x00007fc3a5658000)
	libm.so.6 => /nix/store/c35hf8g5b9vksadym9dbjrd6p2y11m8h-glibc-2.35-224/lib/libm.so.6 (0x00007fc3a5578000)
	libpthread.so.0 => /nix/store/c35hf8g5b9vksadym9dbjrd6p2y11m8h-glibc-2.35-224/lib/libpthread.so.0 (0x00007fc3a5573000)
	libdl.so.2 => /nix/store/c35hf8g5b9vksadym9dbjrd6p2y11m8h-glibc-2.35-224/lib/libdl.so.2 (0x00007fc3a556e000)
	librt.so.1 => /nix/store/c35hf8g5b9vksadym9dbjrd6p2y11m8h-glibc-2.35-224/lib/librt.so.1 (0x00007fc3a5569000)
	libc.so.6 => /nix/store/c35hf8g5b9vksadym9dbjrd6p2y11m8h-glibc-2.35-224/lib/libc.so.6 (0x00007fc3a535e000)
	/nix/store/c35hf8g5b9vksadym9dbjrd6p2y11m8h-glibc-2.35-224/lib/ld-linux-x86-64.so.2 => /nix/store/9xfad3b5z4y00mzmk2wnn4900q0qmxns-glibc-2.35-224/lib64/ld-linux-x86-64.so.2 (0x00007fc3a5870000)
	libgcc_s.so.1 => /nix/store/qbgfsaviwqi2p6jr7an1g2754sv3xqhn-gcc-11.3.0-lib/lib/libgcc_s.so.1 (0x00007fc3a5344000)
```

Also improves the installCheckPhase to include more tests and improve
the old onest .
---
 .../build-graalvm-native-image/default.nix    |  3 +-
 .../graalvm/community-edition/mkGraal.nix     | 63 +++++++++++--------
 2 files changed, 39 insertions(+), 27 deletions(-)

diff --git a/pkgs/build-support/build-graalvm-native-image/default.nix b/pkgs/build-support/build-graalvm-native-image/default.nix
index f223009cba5c..64c6568e1bc2 100644
--- a/pkgs/build-support/build-graalvm-native-image/default.nix
+++ b/pkgs/build-support/build-graalvm-native-image/default.nix
@@ -10,7 +10,6 @@
   # except in special cases. In most cases, use extraNativeBuildArgs instead
 , nativeImageBuildArgs ? [
     "-jar" jar
-    "-H:CLibraryPath=${lib.getLib graalvm}/lib"
     (lib.optionalString stdenv.isDarwin "-H:-CheckToolchain")
     "-H:Name=${executable}"
     "--verbose"
@@ -50,6 +49,8 @@ stdenv.mkDerivation (args // {
     runHook postInstall
   '';
 
+  disallowedReferences = [ graalvmDrv ];
+
   meta = {
     # default to graalvm's platforms
     platforms = graalvmDrv.meta.platforms;
diff --git a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
index bd2d4413ec52..b66058d35c91 100644
--- a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
@@ -32,6 +32,8 @@
   # Native Image (i.e.: `--static --libc=musl`). This will cause glibc static
   # builds to fail, so it should be used with care
 , useMusl ? false
+  # Extra libraries to be included in native-image using '-H:CLibraryPath' flag
+, extraCLibs ? [ ]
 }:
 
 { stdenv
@@ -76,6 +78,11 @@ let
   name = "graalvm${javaVersion}-ce";
   sources = builtins.fromJSON (builtins.readFile sourcesPath);
 
+  cLibs = [ glibc zlib.static ]
+    ++ lib.optionals (!useMusl) [ glibc.static ]
+    ++ lib.optionals useMusl [ musl ]
+    ++ extraCLibs;
+
   runtimeLibraryPath = lib.makeLibraryPath
     ([ cups ] ++ lib.optionals gtkSupport [ cairo glib gtk3 ]);
 
@@ -118,6 +125,8 @@ let
       ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook;
 
     unpackPhase = ''
+      runHook preUnpack
+
       unpack_jar() {
         jar=$1
         unzip -q -o $jar -d $out
@@ -164,13 +173,13 @@ let
       for jar in "''${arr[@]:1}"; do
         unpack_jar "$jar"
       done
+
+      runHook postUnpack
     '';
 
-    outputs = [ "out" "lib" ];
-
     installPhase = ''
-      # ensure that $lib/lib exists to avoid breaking builds
-      mkdir -p "$lib/lib"
+      runHook preInstall
+
       # jni.h expects jni_md.h to be in the header search path.
       ln -s $out/include/linux/*_md.h $out/include/
 
@@ -181,26 +190,15 @@ let
         if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
       EOF
       ${
-        lib.optionalString (stdenv.isLinux) ''
-          # provide libraries needed for static compilation
-          ${
-            if useMusl then
-              ''for f in "${musl.stdenv.cc.cc}/lib/"* "${musl}/lib/"* "${zlib.static}/lib/"*; do''
-            else
-              ''for f in "${glibc}/lib/"* "${glibc.static}/lib/"* "${zlib.static}/lib/"*; do''
-          }
-            ln -s "$f" "$out/lib/svm/clibraries/${platform.arch}/$(basename $f)"
-          done
-
-          # add those libraries to $lib output too, so we can use them with
-          # `native-image -H:CLibraryPath=''${lib.getLib graalvmXX-ce}/lib ...` and reduce
-          # closure size by not depending on GraalVM $out (that is much bigger)
-          # we always use glibc here, since musl is only supported for static compilation
-          for f in "${glibc}/lib/"*; do
-            ln -s "$f" "$lib/lib/$(basename $f)"
-          done
+        # Wrap native-image binary to pass -H:CLibraryPath flag and find glibc
+        lib.optionalString (withNativeImageSvm && stdenv.isLinux) ''
+          wrapProgram $out/bin/native-image \
+            ${lib.concatStringsSep " "
+              (map (l: "--add-flags '-H:CLibraryPath=${l}/lib'") cLibs)}
         ''
       }
+
+      runHook postInstall
     '';
 
     dontStrip = true;
@@ -240,6 +238,8 @@ let
 
     doInstallCheck = true;
     installCheckPhase = ''
+      runHook preInstallCheck
+
       echo ${
         lib.escapeShellArg ''
           public class HelloWorld {
@@ -252,16 +252,25 @@ let
       $out/bin/javac HelloWorld.java
 
       # run on JVM with Graal Compiler
+      echo "Testing GraalVM"
       $out/bin/java -XX:+UnlockExperimentalVMOptions -XX:+EnableJVMCI -XX:+UseJVMCICompiler HelloWorld | fgrep 'Hello World'
 
+      ${
+        lib.optionalString withNativeImageSvm ''
+          echo "Ahead-Of-Time compilation"
+          $out/bin/native-image -H:-CheckToolchain -H:+ReportExceptionStackTraces HelloWorld
+          ./helloworld | fgrep 'Hello World'
+        ''
+      }
+
       ${# --static flag doesn't work for darwin
         lib.optionalString (withNativeImageSvm && stdenv.isLinux && !useMusl) ''
-          echo "Ahead-Of-Time compilation"
-          $out/bin/native-image -H:-CheckToolchain -H:+ReportExceptionStackTraces --no-server HelloWorld
+          echo "Ahead-Of-Time compilation with -H:+StaticExecutableWithDynamicLibC"
+          $out/bin/native-image -H:+StaticExecutableWithDynamicLibC HelloWorld
           ./helloworld | fgrep 'Hello World'
 
           echo "Ahead-Of-Time compilation with --static"
-          $out/bin/native-image --no-server --static HelloWorld
+          $out/bin/native-image --static HelloWorld
           ./helloworld | fgrep 'Hello World'
         ''
       }
@@ -269,7 +278,7 @@ let
       ${# --static flag doesn't work for darwin
         lib.optionalString (withNativeImageSvm && stdenv.isLinux && useMusl) ''
           echo "Ahead-Of-Time compilation with --static and --libc=musl"
-          $out/bin/native-image --no-server --libc=musl --static HelloWorld
+          $out/bin/native-image --libc=musl --static HelloWorld
           ./helloworld | fgrep 'Hello World'
         ''
       }
@@ -302,6 +311,8 @@ let
           echo '1 + 1' | $out/bin/irb
         ''
       }
+
+      runHook postInstallCheck
     '';
 
     passthru = {

From 3e8caec842f5402c2ce7656e03ab7f54875ec6fb Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Tue, 7 Feb 2023 17:04:03 +0000
Subject: [PATCH 043/176] mkGraal: move some parameters to be easier to
 override

---
 .../compilers/graalvm/community-edition/mkGraal.nix  | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
index b66058d35c91..023fc81474ef 100644
--- a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
@@ -28,12 +28,6 @@
   # Path for the sources file that will be used
   # See `update.nix` file for a description on how this file works
 , sourcesPath ? ./. + "/graalvm${javaVersion}-ce-sources.json"
-  # Use musl instead of glibc to allow true static builds in GraalVM's
-  # Native Image (i.e.: `--static --libc=musl`). This will cause glibc static
-  # builds to fail, so it should be used with care
-, useMusl ? false
-  # Extra libraries to be included in native-image using '-H:CLibraryPath' flag
-, extraCLibs ? [ ]
 }:
 
 { stdenv
@@ -68,6 +62,12 @@
 , gtk3
 , jq
 , writeShellScript
+  # Use musl instead of glibc to allow true static builds in GraalVM's
+  # Native Image (i.e.: `--static --libc=musl`). This will cause glibc static
+  # builds to fail, so it should be used with care
+, useMusl ? false
+  # Extra libraries to be included in native-image using '-H:CLibraryPath' flag
+, extraCLibs ? [ ]
 }:
 
 assert useMusl -> stdenv.isLinux;

From 825fb7750655f1db38a9f1a3ba6e843924ecf9da Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Tue, 7 Feb 2023 12:26:30 -0500
Subject: [PATCH 044/176] sniffnet: 1.0.1 -> 1.1.0

Changelog: https://github.com/gyulyvgc/sniffnet/blob/main/CHANGELOG.md
---
 .../networking/sniffnet/default.nix           | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/networking/sniffnet/default.nix b/pkgs/applications/networking/sniffnet/default.nix
index 6dc59e1432ab..074d636ff821 100644
--- a/pkgs/applications/networking/sniffnet/default.nix
+++ b/pkgs/applications/networking/sniffnet/default.nix
@@ -1,9 +1,11 @@
 { lib
 , rustPlatform
-, fetchCrate
+, fetchFromGitHub
 , pkg-config
 , libpcap
 , stdenv
+, alsa-lib
+, expat
 , fontconfig
 , libGL
 , xorg
@@ -12,20 +14,24 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sniffnet";
-  version = "1.0.1";
+  version = "1.1.0";
 
-  src = fetchCrate {
-    inherit pname version;
-    sha256 = "sha256-8K774j04BOEuJjnFYjaSctPwBrKYYKqjFS2+PyxJ2FM=";
+  src = fetchFromGitHub {
+    owner = "gyulyvgc";
+    repo = "sniffnet";
+    rev = "v${version}";
+    hash = "sha256-zqk0N1S0vylleyyXaSflIZyWncZV0+wbSy1oAbyLx/4=";
   };
 
-  cargoSha256 = "sha256-096i4wDdoJCICd0L2QNY+7cKHQnijK22zj4XaQNuko8=";
+  cargoHash = "sha256-9CTA7Yh2O5S8DvRjwvkrb4ye0/8f+l0tsTxNBMmxLpQ=";
 
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [
     libpcap
   ] ++ lib.optionals stdenv.isLinux [
+    alsa-lib
+    expat
     fontconfig
     libGL
     xorg.libX11
@@ -34,6 +40,7 @@ rustPlatform.buildRustPackage rec {
     xorg.libXrandr
   ] ++ lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.AppKit
+    rustPlatform.bindgenHook
   ];
 
   postFixup = lib.optionalString stdenv.isLinux ''

From 258d80b66c1eed2a54bdb2a4cfd4156b7a5a9e9d Mon Sep 17 00:00:00 2001
From: amesgen <amesgen@amesgen.de>
Date: Tue, 7 Feb 2023 21:14:48 +0100
Subject: [PATCH 045/176] wizer: add amesgen as maintainer

---
 pkgs/development/tools/wizer/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/wizer/default.nix b/pkgs/development/tools/wizer/default.nix
index f79c96f54518..5c931770ac0a 100644
--- a/pkgs/development/tools/wizer/default.nix
+++ b/pkgs/development/tools/wizer/default.nix
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
     description = "The WebAssembly pre-initializer";
     homepage = "https://github.com/bytecodealliance/wizer";
     license = licenses.asl20;
-    maintainers = with maintainers; [ lucperkins ];
+    maintainers = with maintainers; [ lucperkins amesgen ];
     broken = stdenv.isx86_64 && stdenv.isDarwin;
   };
 }

From 4ddacf30c81fd94e50e24361a02e3e5995270286 Mon Sep 17 00:00:00 2001
From: amesgen <amesgen@amesgen.de>
Date: Tue, 7 Feb 2023 21:35:33 +0100
Subject: [PATCH 046/176] wizer: 1.4.0 -> 1.6.0

---
 pkgs/development/tools/wizer/default.nix | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/tools/wizer/default.nix b/pkgs/development/tools/wizer/default.nix
index 5c931770ac0a..727b3f256d43 100644
--- a/pkgs/development/tools/wizer/default.nix
+++ b/pkgs/development/tools/wizer/default.nix
@@ -1,16 +1,20 @@
-{ lib, stdenv, rustPlatform, fetchCrate }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub }:
 
 rustPlatform.buildRustPackage rec {
   pname = "wizer";
-  version = "1.4.0";
+  version = "1.6.0";
 
-  src = fetchCrate {
-    inherit pname version;
-
-    sha256 = "sha256-3Hc3KKqtbZtvD+3lb/W7+AyrwPukJyxpUe94KGQlzBI=";
+  # the crate does not contain files which are necessary for the tests
+  # see https://github.com/bytecodealliance/wizer/commit/3a95e27ce42f1fdaef07b52988e4699eaa221e04
+  src = fetchFromGitHub {
+    owner = "bytecodealliance";
+    repo = "wizer";
+    # see https://github.com/bytecodealliance/wizer/pull/62
+    rev = "e74c6e59562c4b7edcda506674db8aead878a893";
+    sha256 = "sha256-bVxjcb231Ygz+z+8D1U2YQqEdIKsostxISgYt2KecXc=";
   };
 
-  cargoSha256 = "sha256-zv36/W7dNpIupYn8TS+NaF7uX+BVjrI6AW6Hrlqr8Xg=";
+  cargoSha256 = "sha256-S9h47aGG5UhwNoOnUHFrtEyByg8iCMC88Cspb/6tb8c=";
 
   cargoBuildFlags = [ "--bin" pname ];
 
@@ -27,6 +31,5 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/bytecodealliance/wizer";
     license = licenses.asl20;
     maintainers = with maintainers; [ lucperkins amesgen ];
-    broken = stdenv.isx86_64 && stdenv.isDarwin;
   };
 }

From 79375858dd758bef33ddb59ca349a966fe660fcf Mon Sep 17 00:00:00 2001
From: amesgen <amesgen@amesgen.de>
Date: Tue, 7 Feb 2023 22:08:11 +0100
Subject: [PATCH 047/176] wizer: add version test

---
 pkgs/development/tools/wizer/default.nix | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/tools/wizer/default.nix b/pkgs/development/tools/wizer/default.nix
index 727b3f256d43..5f84e1e01ff0 100644
--- a/pkgs/development/tools/wizer/default.nix
+++ b/pkgs/development/tools/wizer/default.nix
@@ -1,4 +1,10 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub }:
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, testers
+, wizer
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "wizer";
@@ -26,6 +32,10 @@ rustPlatform.buildRustPackage rec {
     export HOME=$(mktemp -d)
   '';
 
+  passthru.tests = {
+    version = testers.testVersion { package = wizer; };
+  };
+
   meta = with lib; {
     description = "The WebAssembly pre-initializer";
     homepage = "https://github.com/bytecodealliance/wizer";

From 1ef9f06820b7ccfe59cc3f4df04e9b3b3df430cd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rafael=20Fern=C3=A1ndez=20L=C3=B3pez?=
 <ereslibre@ereslibre.es>
Date: Tue, 7 Feb 2023 22:23:23 +0100
Subject: [PATCH 048/176] fastly: 5.1.1 -> 6.0.0

---
 pkgs/misc/fastly/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/misc/fastly/default.nix b/pkgs/misc/fastly/default.nix
index 1542ed14fafe..1a737ae3ab45 100644
--- a/pkgs/misc/fastly/default.nix
+++ b/pkgs/misc/fastly/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "fastly";
-  version = "5.1.1";
+  version = "6.0.0";
 
   src = fetchFromGitHub {
     owner = "fastly";
     repo = "cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-gPToEeLymKIRjL52wb5AjMpDM6vU0Yb0rbcpouev4rQ=";
+    hash = "sha256-meUKWAFKT6EgHtzgR6jjDCA8EUD1kVoT3reXaRheukw=";
     # The git commit is part of the `fastly version` original output;
     # leave that output the same in nixpkgs. Use the `.git` directory
     # to retrieve the commit SHA, and remove the directory afterwards,
@@ -49,8 +49,8 @@ buildGoModule rec {
   ];
   preBuild = let
     cliConfigToml = fetchurl {
-      url = "https://web.archive.org/web/20221224152051/https://developer.fastly.com/api/internal/cli-config";
-      hash = "sha256-IjakfeqjHshlGoamRJTnhUC8cTVMIY63F3vO6I/ZHO4=";
+      url = "https://web.archive.org/web/20230207211120/https://developer.fastly.com/api/internal/cli-config";
+      hash = "sha256-Vkl8V5AkiJMZLswSN0vTnz7S7/5lXftlWD5UZh//vUw=";
     };
   in ''
     cp ${cliConfigToml} ./pkg/config/config.toml

From 93e438cc07e3dabb43595efe98c0d39f15630f26 Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Tue, 7 Feb 2023 23:08:06 +0100
Subject: [PATCH 049/176] chromium: 109.0.5414.119 -> 110.0.5481.77

https://chromereleases.googleblog.com/2023/02/stable-channel-update-for-desktop.html

This update includes 15 security fixes.

CVEs:
CVE-2023-0696 CVE-2023-0697 CVE-2023-0698 CVE-2023-0699 CVE-2023-0700
CVE-2023-0701 CVE-2023-0702 CVE-2023-0703 CVE-2023-0704 CVE-2023-0705
---
 .../browsers/chromium/upstream-info.json      | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index ead92ac3aec7..bd72ef447e3f 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -1,21 +1,21 @@
 {
   "stable": {
-    "version": "109.0.5414.119",
-    "sha256": "0bdyb14v12izxkldq27jx532p0bid3wdwfpd1mwm7jqswxgfzkfb",
-    "sha256bin64": "0iap6i4zmflp4fsj16knwdp03gixsdkbys0scbvvzs3fzy2r5zkx",
+    "version": "110.0.5481.77",
+    "sha256": "1kl1k29sr5qw8pg7shvizw4b37fxjlgah56p57kq641iqhnsnj73",
+    "sha256bin64": "0jjdgfps6siy9hk2r553vvh0jmkn987ad77sv2zqs9gvx0vsrwgp",
     "deps": {
       "gn": {
-        "version": "2022-11-10",
+        "version": "2022-12-12",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "1c4151ff5c1d6fbf7fa800b8d4bb34d3abc03a41",
-        "sha256": "02621c9nqpr4pwcapy31x36l5kbyd0vdgd0wdaxj5p8hrxk67d6b"
+        "rev": "5e19d2fb166fbd4f6f32147fbb2f497091a54ad8",
+        "sha256": "1b5fwldfmkkbpp5x63n1dxv0nc965hphc8rm8ah7zg44zscm9z30"
       }
     },
     "chromedriver": {
-      "version": "109.0.5414.74",
-      "sha256_linux": "1mhnw4maixwfhrz3r3mhpr9bl9hn7cvr2ji6y6ai32hxa1ix9m6f",
-      "sha256_darwin": "0w46xd05m7irfxqsfnjwgd2v65c9vgnh8awaknqgh02wmdgx3nm0",
-      "sha256_darwin_aarch64": "0amb2kd4cq4clir9gqr1b1mdy46m8nwzka227xxjd2i14vwzckb0"
+      "version": "110.0.5481.30",
+      "sha256_linux": "08j28ahyahlgmy67hcm8b1vd4kilvf2yvc25746a46gdf8zz0nmw",
+      "sha256_darwin": "0xlq0fi9g15yvd6ysqcfkxpbr37av32h0f3af9vxl8vbywjfsxn4",
+      "sha256_darwin_aarch64": "03j47ha9janbawbjxy9n84sx70iisk6qr0bvb218cq5j1d5x058b"
     }
   },
   "beta": {

From b9f654c89c8acc5d46b5084d6fa8ad6cab44ce6c Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 7 Feb 2023 22:27:50 +0000
Subject: [PATCH 050/176] wallabag: 2.5.3 -> 2.5.4

https://github.com/wallabag/wallabag/releases/tag/2.5.4

Fixes: CVE-2023-0734, CVE-2023-0735, CVE-2023-0736, CVE-2022/0737
---
 pkgs/servers/web-apps/wallabag/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/web-apps/wallabag/default.nix b/pkgs/servers/web-apps/wallabag/default.nix
index 956f33ca7404..1e6763c39c3e 100644
--- a/pkgs/servers/web-apps/wallabag/default.nix
+++ b/pkgs/servers/web-apps/wallabag/default.nix
@@ -16,7 +16,7 @@
 
 let
   pname = "wallabag";
-  version = "2.5.3";
+  version = "2.5.4";
 in
 stdenv.mkDerivation {
   inherit pname version;
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
       "https://static.wallabag.org/releases/wallabag-release-${version}.tar.gz"
       "https://github.com/wallabag/wallabag/releases/download/${version}/wallabag-${version}.tar.gz"
     ];
-    hash = "sha256-3o5LFGPd4oFz3leKzCy7lIjQ3ELSLqZuIswptB7i24U=";
+    hash = "sha256-yVMQXjGB8Yv1klQaHEbDGMZmOtANRocFJnawKn10xhg=";
   };
 
   patches = [

From 1e5f0e8eedf716335dc6e855981d7935b357230b Mon Sep 17 00:00:00 2001
From: Malo Bourgon <mbourgon@gmail.com>
Date: Tue, 7 Feb 2023 14:36:26 -0800
Subject: [PATCH 051/176] openai: 0.26.4 -> 0.26.5

Diff: https://github.com/openai/openai-python/compare/v0.26.4...v0.26.5
---
 pkgs/development/python-modules/openai/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/openai/default.nix b/pkgs/development/python-modules/openai/default.nix
index d4cedc80be11..ede1a7a3d84f 100644
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "openai";
-  version = "0.26.4";
+  version = "0.26.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7.1";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "openai";
     repo = "openai-python";
     rev = "v${version}";
-    hash = "sha256-WcUH6zbb5kIH0qk67M+lUx9CbMEbYDXQm6IVzzuQo9w=";
+    hash = "sha256-eKU+WRFf7f1yH63vcoQ9dVeqhJXBqMJGpk/9AoEgR0M=";
   };
 
   propagatedBuildInputs = [

From 03f85e9e938cb84791426f98890b5983437f9166 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Stanis=C5=82aw=20Pitucha?= <stan.pitucha@envato.com>
Date: Wed, 8 Feb 2023 10:03:21 +1100
Subject: [PATCH 052/176] chatterino2: fix darwin build

Use the newer SDK to fix darwin build.
---
 pkgs/top-level/all-packages.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7ff5ab82f3fc..f8d4d8b4e17d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -33872,7 +33872,9 @@ with pkgs;
     pipewire = null;
   };
 
-  chatterino2 = libsForQt5.callPackage ../applications/networking/instant-messengers/chatterino2 {};
+  chatterino2 = libsForQt5.callPackage ../applications/networking/instant-messengers/chatterino2 {
+    stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
+  };
 
   weston = callPackage ../applications/window-managers/weston { };
 

From 4c2b1301113fb836ec05a4a521f3af12179d5daf Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Feb 2023 23:14:42 +0000
Subject: [PATCH 053/176] thunderbird-unwrapped: 102.7.1 -> 102.7.2

---
 .../networking/mailreaders/thunderbird/packages.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 8fefcc1c3143..6c705d7cd362 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -5,13 +5,13 @@ rec {
 
   thunderbird-102 = (buildMozillaMach rec {
     pname = "thunderbird";
-    version = "102.7.1";
+    version = "102.7.2";
     application = "comm/mail";
     applicationName = "Mozilla Thunderbird";
     binaryName = pname;
     src = fetchurl {
       url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
-      sha512 = "6310f3f122a1a61917ec2d0efe3a031b199ac13681e9fb4035abc0f4de0dbafb12accffbd63facb23f2cebf0124a13f7538a33176a2a513d1f685bee40db50ba";
+      sha512 = "7371079d59cceb47fdd0e9661f79eae7510ab0f5bf8e80c21952dfb5fed3db72279a4ac9d3a3de3617194fb36a9420ae814a69ee19a93ba242d2aa2b921e3010";
     };
     extraPatches = [
       # The file to be patched is different from firefox's `no-buildconfig-ffx90.patch`.

From df4a5afec87f5a0fd1abbddc9590d8b61213b2aa Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Feb 2023 23:22:33 +0000
Subject: [PATCH 054/176] python310Packages.rpy2: 3.5.7 -> 3.5.8

---
 pkgs/development/python-modules/rpy2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/rpy2/default.nix b/pkgs/development/python-modules/rpy2/default.nix
index dd27a7ca110d..206c38cda762 100644
--- a/pkgs/development/python-modules/rpy2/default.nix
+++ b/pkgs/development/python-modules/rpy2/default.nix
@@ -24,13 +24,13 @@
 }:
 
 buildPythonPackage rec {
-    version = "3.5.7";
+    version = "3.5.8";
     pname = "rpy2";
 
     disabled = isPyPy;
     src = fetchPypi {
       inherit version pname;
-      sha256 = "sha256-h6QJA3m0/DTn86Q0cXMJBndsNzmIhwhqgDV9ZP3QZUs=";
+      sha256 = "sha256-ImEfIbxSeYCH+5gwlwXxolz76L/Sf7/u6gHz01L92yk=";
     };
 
     patches = [

From 48cb3498fa1c8107ac743ab266af7960c774e9cf Mon Sep 17 00:00:00 2001
From: Ingo Ruhnke <grumbel@gmail.com>
Date: Wed, 8 Feb 2023 00:45:08 +0100
Subject: [PATCH 055/176] dduper: Update btrfs-progs patch to v6.1

---
 pkgs/tools/filesystems/dduper/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/filesystems/dduper/default.nix b/pkgs/tools/filesystems/dduper/default.nix
index e7eecbf766ee..9c38852e4e90 100644
--- a/pkgs/tools/filesystems/dduper/default.nix
+++ b/pkgs/tools/filesystems/dduper/default.nix
@@ -5,8 +5,8 @@ let
     patches = [
       (fetchpatch {
         name = "0001-Print-csum-for-a-given-file-on-stdout.patch";
-        url = "https://raw.githubusercontent.com/Lakshmipathi/dduper/f45d04854a40cb52ae0e6736916d5955cb68b8ee/patch/btrfs-progs-v5.12.1/0001-Print-csum-for-a-given-file-on-stdout.patch";
-        sha256 = "0c7dd44q2ww6k9nk5dh6m0f0wbd8x84vb2m61fk6a44nsv2fwz1x";
+        url = "https://raw.githubusercontent.com/Lakshmipathi/dduper/ecc2664c380616ec75cfc1e600b5514cdff5c687/patch/btrfs-progs-v6.1/0001-Print-csum-for-a-given-file-on-stdout.patch";
+        sha256 = "sha256-M4LT7G6gwBfSXf6EL4pxNoQJMyUTOA+ojxEJqw2yss4=";
       })
     ];
   });

From cfcf7d63e1f395cad310578a708c652b9d10ae2a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 00:03:11 +0000
Subject: [PATCH 056/176] python310Packages.yfinance: 0.2.9 -> 0.2.10

---
 pkgs/development/python-modules/yfinance/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/yfinance/default.nix b/pkgs/development/python-modules/yfinance/default.nix
index d2a113fb51d0..ac8c68239bf7 100644
--- a/pkgs/development/python-modules/yfinance/default.nix
+++ b/pkgs/development/python-modules/yfinance/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "yfinance";
-  version = "0.2.9";
+  version = "0.2.10";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "ranaroussi";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-CcvBVW9MdXVx1BnIcPB9b1PHGK2zw4Hg0vVNW6s87/Q=";
+    hash = "sha256-1LRnvyr3QNYR33qTyN/WepGH8InYmXWwO5gQfm20MP4=";
   };
 
   propagatedBuildInputs = [

From 60ebc035de23fb531e4f656492308cc8d6efd456 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 8 Feb 2023 00:59:55 +0100
Subject: [PATCH 057/176] babeld: 1.12.1 -> 1.12.2

https://www.mail-archive.com/babel-users@alioth-lists.debian.net/msg00960.html
---
 pkgs/tools/networking/babeld/default.nix | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/pkgs/tools/networking/babeld/default.nix b/pkgs/tools/networking/babeld/default.nix
index 5714a75e50e5..6e8c7669f0dd 100644
--- a/pkgs/tools/networking/babeld/default.nix
+++ b/pkgs/tools/networking/babeld/default.nix
@@ -1,17 +1,27 @@
-{ lib, stdenv, fetchurl, nixosTests }:
+{ lib
+, stdenv
+, fetchurl
+, nixosTests
+}:
 
 stdenv.mkDerivation rec {
   pname = "babeld";
-  version = "1.12.1";
+  version = "1.12.2";
 
   src = fetchurl {
     url = "https://www.irif.fr/~jch/software/files/${pname}-${version}.tar.gz";
-    sha256 = "sha256-mrWdesdB82MN8j+cO2fGApTYs0q2IjmPm4l3OoeOyx4=";
+    hash = "sha256-HbIrYZMHDqJFChq1EZb9cvWKEyn3gMsDiOLksud2jLs=";
   };
 
-  preBuild = ''
-    makeFlags="PREFIX=$out ETCDIR=$out/etc"
-  '';
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+    "ETCDIR=${placeholder "out"}/etc"
+  ];
 
   passthru.tests.babeld = nixosTests.babeld;
 

From f80b895b153bf56d2cd712a78bcd43f38ef02f34 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 00:17:08 +0000
Subject: [PATCH 058/176] librime: 1.8.4 -> 1.8.5

---
 pkgs/development/libraries/librime/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/librime/default.nix b/pkgs/development/libraries/librime/default.nix
index 0f0a311cdfac..a1daa89ef787 100644
--- a/pkgs/development/libraries/librime/default.nix
+++ b/pkgs/development/libraries/librime/default.nix
@@ -10,13 +10,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "librime";
-  version = "1.8.4";
+  version = "1.8.5";
 
   src = fetchFromGitHub {
     owner = "rime";
     repo = pname;
     rev = version;
-    sha256 = "sha256-FcEthx5uaTROmW+wrWdpRoVT8o5Ok0HgkllMut/FEyM=";
+    sha256 = "sha256-FkkZIxSuqlFFOjABBpnE5ax2Vdo9tzP0prM7ATDIIdk=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];

From 759bf66c38900482d043a91b6ff6541a2e7bfa4a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 00:17:53 +0000
Subject: [PATCH 059/176] erigon: 2.37.0 -> 2.38.1

---
 pkgs/applications/blockchains/erigon/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/blockchains/erigon/default.nix b/pkgs/applications/blockchains/erigon/default.nix
index a17bef8cae37..51b6d4d16b2b 100644
--- a/pkgs/applications/blockchains/erigon/default.nix
+++ b/pkgs/applications/blockchains/erigon/default.nix
@@ -2,7 +2,7 @@
 
 let
   pname = "erigon";
-  version = "2.37.0";
+  version = "2.38.1";
 in
 buildGoModule {
   inherit pname version;
@@ -11,11 +11,11 @@ buildGoModule {
     owner = "ledgerwatch";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-r/mumt/f0wrOsXyEHo/NX0lJGt8zqXEVNC+9DWDkHAM=";
+    sha256 = "sha256-sLJMmSEUQNsodZ9Ms0ipDwN2QOYa9pZTlEqt4CF23Sc=";
     fetchSubmodules = true;
   };
 
-  vendorSha256 = "sha256-vSJZ1wIx1CiLE04ZBDnQDQqM2v8BBLxw5qbAsixC3/U=";
+  vendorSha256 = "sha256-KESY+PSbWQHPJphop4GnVF4T8Q/MPb2GFDEko0ieXEM=";
   proxyVendor = true;
 
   # Build errors in mdbx when format hardening is enabled:

From 92ea4539e79fb15e57f617515f145785e644d026 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 00:28:35 +0000
Subject: [PATCH 060/176] velero: 1.10.0 -> 1.10.1

---
 pkgs/applications/networking/cluster/velero/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/velero/default.nix b/pkgs/applications/networking/cluster/velero/default.nix
index bc4f1959eaac..dcb4dd9eb08d 100644
--- a/pkgs/applications/networking/cluster/velero/default.nix
+++ b/pkgs/applications/networking/cluster/velero/default.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "velero";
-  version = "1.10.0";
+  version = "1.10.1";
 
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "velero";
     rev = "v${version}";
-    sha256 = "sha256-PBCTVws5N42q68rKcMLW7GgZvdsQgmdlsKMpJ5bCF00=";
+    sha256 = "sha256-jN45chUeoGJGJWD6Rj6duNE36/QCzPqci8V3h1OHtw4=";
   };
 
   ldflags = [
@@ -20,7 +20,7 @@ buildGoModule rec {
     "-X github.com/vmware-tanzu/velero/pkg/buildinfo.GitSHA=none"
   ];
 
-  vendorSha256 = "sha256-5Po8TRCE6VP+RcaIJImYjElTMHHS/2JwbrHreeWLxio=";
+  vendorHash = "sha256-mvVwf4w/65L+F6aiTNf2jmJtaT1EpWCQJ6r9NHUUUqQ=";
 
   excludedPackages = [ "issue-template-gen" "release-tools" "v1" "velero-restic-restore-helper" ];
 

From d32f1286ce974eec0e65b5fd51a2017ff072d47c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 00:33:54 +0000
Subject: [PATCH 061/176] zef: 0.14.6 -> 0.15.0

---
 pkgs/development/interpreters/rakudo/zef.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/rakudo/zef.nix b/pkgs/development/interpreters/rakudo/zef.nix
index cfdeac264cbd..efd08f7d85b7 100644
--- a/pkgs/development/interpreters/rakudo/zef.nix
+++ b/pkgs/development/interpreters/rakudo/zef.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zef";
-  version = "0.14.6";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "ugexe";
     repo = "zef";
     rev = "v${version}";
-    sha256 = "sha256-3FRzqHbzNhmYg3wRvajMzTWB7lOlgrxwQvvnB3fggGM=";
+    sha256 = "sha256-MJKG/8b8l2RqWec5JoWcYLYrEKI9zrhJMyLqVcvAY+g=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 87fc6ea2199417c00992902901144509664c77c9 Mon Sep 17 00:00:00 2001
From: superherointj <5861043+superherointj@users.noreply.github.com>
Date: Tue, 7 Feb 2023 21:50:12 -0300
Subject: [PATCH 062/176] flexoptix-app: 5.13.3 -> 5.13.4

---
 pkgs/tools/misc/flexoptix-app/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/misc/flexoptix-app/default.nix b/pkgs/tools/misc/flexoptix-app/default.nix
index 50f51cfd7119..4cd81c8c640f 100644
--- a/pkgs/tools/misc/flexoptix-app/default.nix
+++ b/pkgs/tools/misc/flexoptix-app/default.nix
@@ -1,11 +1,11 @@
 { lib, appimageTools, fetchurl, nodePackages }: let
   pname = "flexoptix-app";
-  version = "5.13.3";
+  version = "5.13.4";
 
   src = fetchurl {
     name = "${pname}-${version}.AppImage";
     url = "https://flexbox.reconfigure.me/download/electron/linux/x64/FLEXOPTIX%20App.${version}.AppImage";
-    hash = "sha256-kDw9+Llqvq4NgN89Cw/HwEqYlv42wLbho1eHjI6wVSQ=";
+    hash = "sha256-W+9KmKZ1bPfQfv1DXCJrIswriw4ivBVZPW81tfvRBc0=";
   };
 
   udevRules = fetchurl {
@@ -47,7 +47,7 @@ in appimageTools.wrapAppImage {
   '';
 
   meta = {
-    description = "Configure FLEXOPTIX Universal Transcievers in seconds";
+    description = "Configure FLEXOPTIX Universal Transceivers in seconds";
     homepage = "https://www.flexoptix.net";
     changelog = "https://www.flexoptix.net/en/flexoptix-app/?os=linux#flexapp__modal__changelog";
     license = lib.licenses.unfree;

From cd16b0bdb85ce735a68cdbe4201a4ffdfcf16222 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 01:08:16 +0000
Subject: [PATCH 063/176] python310Packages.pyutil: 3.3.0 -> 3.3.2

---
 pkgs/development/python-modules/pyutil/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyutil/default.nix b/pkgs/development/python-modules/pyutil/default.nix
index 3a6c3871a441..e6391349927c 100644
--- a/pkgs/development/python-modules/pyutil/default.nix
+++ b/pkgs/development/python-modules/pyutil/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "pyutil";
-  version = "3.3.0";
+  version = "3.3.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8c4d4bf668c559186389bb9bce99e4b1b871c09ba252a756ccaacd2b8f401848";
+    sha256 = "sha256-6hbSxVtvg0Eh3rYyp0VLCg+uJdXRMLFfa+l667B2yfw=";
   };
 
   propagatedBuildInputs = [ simplejson ];

From 027df72b836ba071526a5f9c8092a916931c42a2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 01:16:30 +0000
Subject: [PATCH 064/176] python310Packages.pyathena: 2.19.0 -> 2.21.0

---
 pkgs/development/python-modules/pyathena/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyathena/default.nix b/pkgs/development/python-modules/pyathena/default.nix
index 8c6086092a71..2de176f2c690 100644
--- a/pkgs/development/python-modules/pyathena/default.nix
+++ b/pkgs/development/python-modules/pyathena/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pyathena";
-  version = "2.19.0";
+  version = "2.21.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-59NH4HIhgDOxwgSUJq71ewpQTn2sbpNNT9Q3nj8qJss=";
+    hash = "sha256-DhG8JdYVRrsRuXsmlUzp7HDRlBsI/pLMBDzYqIzmae4=";
   };
 
   propagatedBuildInputs = [

From 8585096b79e3fb3c763894035be25bbd6c758716 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 01:33:02 +0000
Subject: [PATCH 065/176] python310Packages.xknx: 2.3.0 -> 2.4.0

---
 pkgs/development/python-modules/xknx/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/xknx/default.nix b/pkgs/development/python-modules/xknx/default.nix
index 2d1cbab86c6d..af7f10e3fd8d 100644
--- a/pkgs/development/python-modules/xknx/default.nix
+++ b/pkgs/development/python-modules/xknx/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "xknx";
-  version = "2.3.0";
+  version = "2.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "XKNX";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-G4az6YmCDv1MPF30mBQVNBPZdebjZqd+0vxo5F5iDWY=";
+    hash = "sha256-MSk/c2qLztq5GQ6+CzK0Jw+rOJTClguaoL284YaBPjw=";
   };
 
   propagatedBuildInputs = [

From 1ebe29e665d84c2b2dea2c0319810dd1c3288072 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 01:56:22 +0000
Subject: [PATCH 066/176] snapcast: 0.26.0 -> 0.27.0

---
 pkgs/applications/audio/snapcast/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/audio/snapcast/default.nix b/pkgs/applications/audio/snapcast/default.nix
index 558948ab4a0d..aef561e692a6 100644
--- a/pkgs/applications/audio/snapcast/default.nix
+++ b/pkgs/applications/audio/snapcast/default.nix
@@ -9,13 +9,13 @@ assert pulseaudioSupport -> libpulseaudio != null;
 
 stdenv.mkDerivation rec {
   pname = "snapcast";
-  version = "0.26.0";
+  version = "0.27.0";
 
   src = fetchFromGitHub {
     owner  = "badaix";
     repo   = "snapcast";
     rev    = "v${version}";
-    sha256 = "sha256-CCifn9OEFM//Hk1PJj8T3MXIV8pXCTdBBXPsHuZwLyQ=";
+    sha256 = "sha256-dlK1xQQqst4VQjioC7MZzqXwMC+JfqtvnD5lrOqGhYI=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];

From 0be7779b4be40c902faf0987b070dd89706ab5cd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 02:44:28 +0000
Subject: [PATCH 067/176] python310Packages.aesedb: 0.1.0 -> 0.1.1

---
 pkgs/development/python-modules/aesedb/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aesedb/default.nix b/pkgs/development/python-modules/aesedb/default.nix
index cb9db9a886fa..982525e4bd43 100644
--- a/pkgs/development/python-modules/aesedb/default.nix
+++ b/pkgs/development/python-modules/aesedb/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "aesedb";
-  version = "0.1.0";
+  version = "0.1.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-TetXhDrWG6MECm/nhsZDUwcOJwP5drFO+YLarGC2pak=";
+    hash = "sha256-pnbzPVXr3qgBH7t5wNR+jbTdQGMdnLpV+xfgQjdc+7A=";
   };
 
   propagatedBuildInputs = [

From 6949cfdcb4c7ff9f59e5e00f2ddef180d17d0f92 Mon Sep 17 00:00:00 2001
From: Aaron Jheng <wentworth@outlook.com>
Date: Wed, 8 Feb 2023 03:01:37 +0000
Subject: [PATCH 068/176] temporal: 1.17.5 -> 1.19.1

---
 .../applications/networking/cluster/temporal/default.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/temporal/default.nix b/pkgs/applications/networking/cluster/temporal/default.nix
index 0b1077443a49..6a2c39de113c 100644
--- a/pkgs/applications/networking/cluster/temporal/default.nix
+++ b/pkgs/applications/networking/cluster/temporal/default.nix
@@ -2,16 +2,18 @@
 
 buildGoModule rec {
   pname = "temporal";
-  version = "1.17.5";
+  version = "1.19.1";
 
   src = fetchFromGitHub {
     owner = "temporalio";
     repo = "temporal";
     rev = "v${version}";
-    sha256 = "sha256-u8GyaXpiVZdPDoPAqIa+TY+JQFZeSGOLrUy+e3E4kig=";
+    hash = "sha256-j2+K/ZDDNakofrToxhyA1gh534l3Eq6G/fNXE0ktceY=";
   };
 
-  vendorSha256 = "sha256-MT/BmGTdyEzmXjuwlA6WhLIWlrQz3Wc4Tl5dMI1587Q=";
+  vendorHash = "sha256-KkgyL37VJy1DhfCB5RJpjczBPbzQwt1xsovQ0xCXGr4=";
+
+  excludedPackages = [ "./build" ];
 
   CGO_ENABLED = 0;
 
@@ -26,6 +28,7 @@ buildGoModule rec {
     install -Dm755 "$GOPATH/bin/server" -T $out/bin/temporal-server
     install -Dm755 "$GOPATH/bin/cassandra" -T $out/bin/temporal-cassandra-tool
     install -Dm755 "$GOPATH/bin/sql" -T $out/bin/temporal-sql-tool
+    install -Dm755 "$GOPATH/bin/tdbg" -T $out/bin/tdbg
 
     runHook postInstall
   '';

From 41463817adead6cd168d061752afa06fc8057367 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 03:05:32 +0000
Subject: [PATCH 069/176] python310Packages.types-requests: 2.28.11.11 ->
 2.28.11.12

---
 pkgs/development/python-modules/types-requests/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/types-requests/default.nix b/pkgs/development/python-modules/types-requests/default.nix
index a6d685a5371e..1d22826b6eea 100644
--- a/pkgs/development/python-modules/types-requests/default.nix
+++ b/pkgs/development/python-modules/types-requests/default.nix
@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "types-requests";
-  version = "2.28.11.11";
+  version = "2.28.11.12";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-GWIqzjWl2hg47pytDfSlDH46Qg+KN+g1fOhw/tSS+oE=";
+    sha256 = "sha256-/VMKqz/E8F7jZAavFo8INubwDx7lGguWtzEfgstnUjA=";
   };
 
   propagatedBuildInputs = [

From 48915f8317be5bd9d2f7853959ee970e2cd4183b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 03:20:27 +0000
Subject: [PATCH 070/176] zoom-us: 5.13.5.431 -> 5.13.7.683

---
 .../instant-messengers/zoom-us/default.nix           | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
index d18761689ee3..cb132610d0c2 100644
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@@ -48,23 +48,23 @@ let
   # and often with different versions.  We write them on three lines
   # like this (rather than using {}) so that the updater script can
   # find where to edit them.
-  versions.aarch64-darwin = "5.13.6.14918";
-  versions.x86_64-darwin = "5.13.6.14918";
-  versions.x86_64-linux = "5.13.5.431";
+  versions.aarch64-darwin = "5.13.7.15481";
+  versions.x86_64-darwin = "5.13.7.15481";
+  versions.x86_64-linux = "5.13.7.683";
 
   srcs = {
     aarch64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
       name = "zoomusInstallerFull.pkg";
-      hash = "sha256-QY9z1bTKtL32HE4XWnBIvCNmDF+3x5N9BdfqJA+24fA=";
+      hash = "sha256-lCg8xCEuZSWnd4fieug9xjudE9q6pNICRsbvA4ATVK8=";
     };
     x86_64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
-      hash = "sha256-eSPKzxDPXCbME0eTTDlfsI5KM5qRm79JTtnGJvpiS98=";
+      hash = "sha256-jmMpkqUga/KQJfXFbGURcWQudnCKlIi5NGY6LuekjKw=";
     };
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-R0IMV/+R7AGFy/ZvNyyvIBv10t1x1U1X6jdHoo6UHKY=";
+      hash = "sha256-1aA3W9eXYhjxr39PoTSAVG7mToFInF7uz8MCiJhk/10=";
     };
   };
 

From fca22e9a3e7e4dce55212d0032611e4d03ced187 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 03:25:56 +0000
Subject: [PATCH 071/176] python310Packages.karton-core: 5.0.0 -> 5.0.1

---
 pkgs/development/python-modules/karton-core/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/karton-core/default.nix b/pkgs/development/python-modules/karton-core/default.nix
index 65c56cbae18c..e62b7cee010b 100644
--- a/pkgs/development/python-modules/karton-core/default.nix
+++ b/pkgs/development/python-modules/karton-core/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "karton-core";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitHub {
     owner = "CERT-Polska";
     repo = "karton";
     rev = "refs/tags/v${version}";
-    hash = "sha256-0B2u2xnrGc3iQ8B9iAQ3fcovQQCPqdFsn5evgdDwg5M=";
+    hash = "sha256-TKO0l0AKsC9MMB58ao/EXcJ9k/J3y3S9tc127H7vA6w=";
   };
 
   propagatedBuildInputs = [

From 7baf69753479602fddc2aa7d6ac54758698ac4f0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 03:35:57 +0000
Subject: [PATCH 072/176] cubiomes-viewer: 3.0.1 -> 3.1.0

---
 pkgs/applications/misc/cubiomes-viewer/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/misc/cubiomes-viewer/default.nix b/pkgs/applications/misc/cubiomes-viewer/default.nix
index 3912e8d221e9..f6035b3c6c49 100644
--- a/pkgs/applications/misc/cubiomes-viewer/default.nix
+++ b/pkgs/applications/misc/cubiomes-viewer/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cubiomes-viewer";
-  version = "3.0.1";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "Cubitect";
     repo = pname;
     rev = version;
-    sha256 = "sha256-UPphXaxq/Hnt1U3J+lgwa0lp3vX1B/Ou8eqD9rHe3sw=";
+    sha256 = "sha256-pA+SWktSjgH7lRqK14yJX2ziLoKpxMCpEIh0H6slpxw=";
     fetchSubmodules = true;
   };
 

From 4d396483629b109f9ed01089d2ee4dc6b38504c2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 03:55:00 +0000
Subject: [PATCH 073/176] klayout: 0.28.4 -> 0.28.5

---
 pkgs/applications/misc/klayout/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/misc/klayout/default.nix b/pkgs/applications/misc/klayout/default.nix
index dd3e5406ca32..4348afb0205b 100644
--- a/pkgs/applications/misc/klayout/default.nix
+++ b/pkgs/applications/misc/klayout/default.nix
@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "klayout";
-  version = "0.28.4";
+  version = "0.28.5";
 
   src = fetchFromGitHub {
     owner = "KLayout";
     repo = "klayout";
     rev = "v${version}";
-    hash = "sha256-6RIzgC/PA2DqO24vKu+d/+GttufUbIH+k9GZe09M0vM=";
+    hash = "sha256-fjKxQ3oVtnFwzLeeE6kN0jKE5PIfBZubTF54KO+k/DE=";
   };
 
   postPatch = ''

From b2d04c115552eea5c3b0b1e0669a3667695ae817 Mon Sep 17 00:00:00 2001
From: Winter <winter@winter.cafe>
Date: Tue, 7 Feb 2023 20:35:32 -0500
Subject: [PATCH 074/176] nixos/luksroot: build pbkdf2-sha512 binary in its own
 derivation

Since this feature's inception, we've compiled a binary that uses OpenSSL
to perform PBKDF-SHA512 during the extra-utils build. In addition to this
being inefficient, it broke as of 6ea1a2a1be4e93f938ff084863eab1bd13292f65,
which switched the extra-utils derivation to use stdenvNoCC.

For now, I think the path of least resistence is to move the pbkdf-sha512
build to its own derivation, to fix the breakage, as well as improving
the efficiency of the extra-utils build.

(I do believe that at some point, we should revisit this binary -- perhaps
rewriting it -- as Clang even just on its default settings emits more
warnings than you'd want to see in a security-related codebase when
compiling it.)
---
 nixos/modules/system/boot/luksroot.nix | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/system/boot/luksroot.nix b/nixos/modules/system/boot/luksroot.nix
index 03d03cb348e8..cdb5d8bf3c26 100644
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@@ -929,7 +929,14 @@ in
       ++ (if builtins.elem "xts" luks.cryptoModules then ["ecb"] else []);
 
     # copy the cryptsetup binary and it's dependencies
-    boot.initrd.extraUtilsCommands = mkIf (!config.boot.initrd.systemd.enable) ''
+    boot.initrd.extraUtilsCommands = let
+      pbkdf2-sha512 = pkgs.runCommandCC "pbkdf2-sha512" { buildInputs = [ pkgs.openssl ]; } ''
+        mkdir -p "$out/bin"
+        cc -O3 -lcrypto ${./pbkdf2-sha512.c} -o "$out/bin/pbkdf2-sha512"
+        strip -s "$out/bin/pbkdf2-sha512"
+      '';
+    in
+    mkIf (!config.boot.initrd.systemd.enable) ''
       copy_bin_and_libs ${pkgs.cryptsetup}/bin/cryptsetup
       copy_bin_and_libs ${askPass}/bin/cryptsetup-askpass
       sed -i s,/bin/sh,$out/bin/sh, $out/bin/cryptsetup-askpass
@@ -939,9 +946,7 @@ in
         copy_bin_and_libs ${pkgs.yubikey-personalization}/bin/ykinfo
         copy_bin_and_libs ${pkgs.openssl.bin}/bin/openssl
 
-        cc -O3 -I${pkgs.openssl.dev}/include -L${lib.getLib pkgs.openssl}/lib ${./pbkdf2-sha512.c} -o pbkdf2-sha512 -lcrypto
-        strip -s pbkdf2-sha512
-        copy_bin_and_libs pbkdf2-sha512
+        copy_bin_and_libs ${pbkdf2-sha512}/bin/pbkdf2-sha512
 
         mkdir -p $out/etc/ssl
         cp -pdv ${pkgs.openssl.out}/etc/ssl/openssl.cnf $out/etc/ssl

From 9ef3416184c1c74a98fb1d9bee6a400a808875a1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 04:11:45 +0000
Subject: [PATCH 075/176] kube-bench: 0.6.10 -> 0.6.11

---
 pkgs/tools/security/kube-bench/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/security/kube-bench/default.nix b/pkgs/tools/security/kube-bench/default.nix
index 9492475aadb5..80be86403adf 100644
--- a/pkgs/tools/security/kube-bench/default.nix
+++ b/pkgs/tools/security/kube-bench/default.nix
@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "kube-bench";
-  version = "0.6.10";
+  version = "0.6.11";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-0rhs5MZzf9E848FxYuZdXTarYG1BwnfS9HDz9iYR/vo=";
+    sha256 = "sha256-fh7kVYajpn8DKteyvAJf3dk1UrSXFX2gKtTAvuiOjpY=";
   };
-  vendorSha256 = "sha256-uaFEtWI5tdL0egaJPTKh7k66Kyjq+N8YDlUGJDtFRqY=";
+  vendorHash = "sha256-PM8VnPNMLhDhRVy6xafW0kuTHgd374r0Ol2U9k8LNIw=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From ab41e13f6ce7bd032920440db104e05ff76c0d12 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Wed, 8 Feb 2023 01:08:25 +0000
Subject: [PATCH 076/176] sourcehut.dispatchsrht: respect allowAliases

Nixpkgs convention is to only add attributes for deprecation throws
when config.allowAliases hasn't been explicitly disabled.  This is
useful as it makes it easy to test building all non-deprecated
packages:

	nix-build --arg config '{ allowAliases = false; }' -A sourcehut

Precedent for this convention in Nixpkgs is easy to find by grepping
for "config.allowAliases".
---
 .../version-management/sourcehut/default.nix           | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/version-management/sourcehut/default.nix b/pkgs/applications/version-management/sourcehut/default.nix
index 7faca39e2fe4..9c9f6f403330 100644
--- a/pkgs/applications/version-management/sourcehut/default.nix
+++ b/pkgs/applications/version-management/sourcehut/default.nix
@@ -2,6 +2,7 @@
 , callPackage
 , recurseIntoAttrs
 , nixosTests
+, config
 }:
 
 # To expose the *srht modules, they have to be a python module so we use `buildPythonModule`
@@ -28,12 +29,10 @@ let
     };
   };
 in
-with python.pkgs; recurseIntoAttrs {
+with python.pkgs; recurseIntoAttrs ({
   inherit python;
   coresrht = toPythonApplication srht;
   buildsrht = toPythonApplication buildsrht;
-  # Added 2022-10-29
-  dispatchsrht = throw "dispatch is deprecated. See https://sourcehut.org/blog/2022-08-01-dispatch-deprecation-plans/ for more information.";
   gitsrht = toPythonApplication gitsrht;
   hgsrht = toPythonApplication hgsrht;
   hubsrht = toPythonApplication hubsrht;
@@ -46,4 +45,7 @@ with python.pkgs; recurseIntoAttrs {
   passthru.tests = {
     nixos-sourcehut = nixosTests.sourcehut;
   };
-}
+} // lib.optionalAttrs config.allowAliases {
+  # Added 2022-10-29
+  dispatchsrht = throw "dispatch is deprecated. See https://sourcehut.org/blog/2022-08-01-dispatch-deprecation-plans/ for more information.";
+})

From ca4904aa828daf954587cbda85902e24252a0390 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 04:16:59 +0000
Subject: [PATCH 077/176] golangci-lint: 1.51.0 -> 1.51.1

---
 pkgs/development/tools/golangci-lint/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/golangci-lint/default.nix b/pkgs/development/tools/golangci-lint/default.nix
index ccd230cc5f5c..f3a54a83a636 100644
--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint";
-  version = "1.51.0";
+  version = "1.51.1";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    hash = "sha256-mmnzbgnu/S9DhFY5JQSs8U5tvsGqIcDaX5Y7dhCgr68=";
+    hash = "sha256-BkkC23dO40gnEQ6sJcbLR2UzdigMrta2+NnZA2bk3E8=";
   };
 
-  vendorHash = "sha256-QoUxZBl0wOpbD2xPCQAeTNiLxdtXZ3+KWB/TLSt53v4=";
+  vendorHash = "sha256-CS9Z3nvOleKTYjw89IKybsUI33w0If/mYDUpQHLO58U=";
 
   doCheck = false;
 

From b73e720c40f984ab08ea9b38a465a9df8464ec8d Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Wed, 8 Feb 2023 04:20:00 +0000
Subject: [PATCH 078/176] libfyaml: 0.7.12 -> 0.8

---
 pkgs/development/libraries/libfyaml/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libfyaml/default.nix b/pkgs/development/libraries/libfyaml/default.nix
index 9384a7c97603..6fe2f398b25e 100644
--- a/pkgs/development/libraries/libfyaml/default.nix
+++ b/pkgs/development/libraries/libfyaml/default.nix
@@ -2,17 +2,19 @@
 
 stdenv.mkDerivation rec {
   pname = "libfyaml";
-  version = "0.7.12";
+  version = "0.8";
 
   src = fetchFromGitHub {
     owner = "pantoniou";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-gmVjiwf8PsDYRt8jmXNrd+hJSL099hbLjq8Z0c1u2HE=";
+    hash = "sha256-b/jRKe23NIVSydoczI+Ax2VjBJLfAEwF8SW61vIDTwA=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
+  outputs = [ "bin" "dev" "out" "man" ];
+
   doCheck = true;
 
   preCheck = ''

From 10e9b8203c4b8ab6dd72971f607c18ab55ba6067 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Wed, 8 Feb 2023 04:20:00 +0000
Subject: [PATCH 079/176] python310Packages.jupyter-book: 0.13.1 -> 0.13.2

https://github.com/executablebooks/jupyter-book/releases/tag/v0.13.2
---
 .../python-modules/jupyter-book/default.nix   | 36 +++++++++----------
 1 file changed, 17 insertions(+), 19 deletions(-)

diff --git a/pkgs/development/python-modules/jupyter-book/default.nix b/pkgs/development/python-modules/jupyter-book/default.nix
index 44f88d56d953..ac2a6c8125df 100644
--- a/pkgs/development/python-modules/jupyter-book/default.nix
+++ b/pkgs/development/python-modules/jupyter-book/default.nix
@@ -3,6 +3,7 @@
 , fetchPypi
 , pythonOlder
 , flit-core
+, pythonRelaxDepsHook
 , click
 , docutils
 , jinja2
@@ -25,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "jupyter-book";
-  version = "0.13.1";
+  version = "0.13.2";
 
   format = "flit";
 
@@ -33,24 +34,13 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-RgpC/H4J3kbdZsKuwYu7EOKCqcgM2v4uUsm6PVFknQE=";
+    sha256 = "sha256-wJWY0tBrlCkOFDfGZS4xWvv87sOlyrNl3fiGqgayqTs=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "jsonschema<4" "jsonschema" \
-      --replace "sphinx-external-toc~=0.2.3" "sphinx-external-toc" \
-      --replace "sphinx-jupyterbook-latex~=0.4.6" "sphinx-jupyterbook-latex" \
-      --replace "sphinx-thebe~=0.1.1" "sphinx-thebe" \
-      --replace "sphinx>=4,<5" "sphinx" \
-      --replace "sphinx_book_theme~=0.3.2" "sphinx_book_theme" \
-      --replace "myst-nb~=0.13.1" "myst-nb" \
-      --replace "docutils>=0.15,<0.18" "docutils" \
-      --replace "sphinx-design~=0.1.0" "sphinx-design" \
-      --replace "linkify-it-py~=1.0.1" "linkify-it-py"
-  '';
-
-  nativeBuildInputs = [ flit-core ];
+  nativeBuildInputs = [
+    flit-core
+    pythonRelaxDepsHook
+  ];
 
   propagatedBuildInputs = [
     click
@@ -73,11 +63,19 @@ buildPythonPackage rec {
     sphinx-multitoc-numbering
   ];
 
-  pythonImportsCheck = [ "jupyter_book" ];
+  pythonRelaxDeps = [
+    "docutils"
+    "myst-nb"
+    "sphinx"
+  ];
+
+  pythonImportsCheck = [
+    "jupyter_book"
+  ];
 
   meta = with lib; {
     description = "Build a book with Jupyter Notebooks and Sphinx";
-    homepage = "https://executablebooks.org/";
+    homepage = "https://jupyterbook.org/";
     license = licenses.bsd3;
     maintainers = with maintainers; [ marsam ];
   };

From cf87e23f9278795c32648df173566bbf825e6546 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Wed, 8 Feb 2023 04:20:00 +0000
Subject: [PATCH 080/176] bazel-buildtools: 5.1.0 -> 6.0.1

https://github.com/bazelbuild/buildtools/releases/tag/6.0.0
https://github.com/bazelbuild/buildtools/releases/tag/6.0.1
---
 .../tools/build-managers/bazel/buildtools/default.nix     | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/build-managers/bazel/buildtools/default.nix b/pkgs/development/tools/build-managers/bazel/buildtools/default.nix
index cd313a5bc50b..693ecce9d1e1 100644
--- a/pkgs/development/tools/build-managers/bazel/buildtools/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/buildtools/default.nix
@@ -2,21 +2,23 @@
 
 buildGoModule rec {
   pname = "bazel-buildtools";
-  version = "5.1.0";
+  version = "6.0.1";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = "buildtools";
     rev = version;
-    sha256 = "sha256-PNIqsP5p+OdYH0JgOmjqvge9zVOrAcNg0FMflXFJHwQ=";
+    hash = "sha256-WXzrGJaulcwg4MnyfY5jWBEVxCXryqMK+/R7J/gFI38=";
   };
 
-  vendorSha256 = "sha256-9WUjQhXWkpSEJj9Xq+9rOe3I1VZ7nqMTnX7DPl+rxsU=";
+  vendorHash = "sha256-DigTREfI6I48wxRpGp/bfH1NbUZ4E1B5UTQXpI0LY1A=";
 
   preBuild = ''
     rm -r warn/docs
   '';
 
+  proxyVendor = true;
+
   doCheck = false;
 
   excludedPackages = [ "generatetables" ];

From 312979b055a9c4eb9e89f8d747334d1fd853c5f3 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Wed, 8 Feb 2023 04:20:00 +0000
Subject: [PATCH 081/176] libpg_query: 15-4.1.0 -> 15-4.2.0

https://github.com/pganalyze/libpg_query/releases/tag/15-4.2.0
---
 pkgs/development/libraries/libpg_query/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libpg_query/default.nix b/pkgs/development/libraries/libpg_query/default.nix
index 254e5ca51e99..95d615c5d24d 100644
--- a/pkgs/development/libraries/libpg_query/default.nix
+++ b/pkgs/development/libraries/libpg_query/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libpg_query";
-  version = "15-4.1.0";
+  version = "15-4.2.0";
 
   src = fetchFromGitHub {
     owner = "pganalyze";
     repo = "libpg_query";
     rev = version;
-    hash = "sha256-uZdszDE0UJVeegU1bi0ISYooC4ztNv7W4UQ2gWIjrH8=";
+    hash = "sha256-2fPdvsfuXKaRwkPjsPsBBfP0+yUgYXEUzQNFZfhyvGk=";
   };
 
   nativeBuildInputs = [ which ];

From 250a8eb77398734f4cbe8cd03d6ec503ba0c5f3a Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Wed, 8 Feb 2023 04:20:00 +0000
Subject: [PATCH 082/176] scheme-manpages: 2022-07-04 -> 2023-02-06

---
 pkgs/data/documentation/scheme-manpages/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/data/documentation/scheme-manpages/default.nix b/pkgs/data/documentation/scheme-manpages/default.nix
index f839ce0c6dcd..59620b16a6cc 100644
--- a/pkgs/data/documentation/scheme-manpages/default.nix
+++ b/pkgs/data/documentation/scheme-manpages/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "scheme-manpages";
-  version = "unstable-2022-07-04";
+  version = "unstable-2023-02-06";
 
   src = fetchFromGitHub {
     owner = "schemedoc";
     repo = "manpages";
-    rev = "0b95de112857b185b83141ac9324fb0e786c56df";
-    sha256 = "sha256-HWkZJd4t7gsbbSGiQ92Lav9EMBPMLXmXFT6HVfyFLSI=";
+    rev = "ccaa76761a1b100e99287c120196bd5f32d4a403";
+    hash = "sha256-RL/94dQiZJ60cXHQ9r4P3hRBqe55oUissCmSp4XLM+o=";
   };
 
   dontBuild = true;

From 65a5907b83338c61cf3b1a900c7ff20073fa7555 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Wed, 8 Feb 2023 04:20:00 +0000
Subject: [PATCH 083/176] caf: 0.18.6 -> 0.18.7

https://github.com/actor-framework/actor-framework/releases/tag/0.18.7
---
 pkgs/development/libraries/caf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/caf/default.nix b/pkgs/development/libraries/caf/default.nix
index 515f66883d0b..f05f55cd8c92 100644
--- a/pkgs/development/libraries/caf/default.nix
+++ b/pkgs/development/libraries/caf/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "actor-framework";
-  version = "0.18.6";
+  version = "0.18.7";
 
   src = fetchFromGitHub {
     owner = "actor-framework";
     repo = "actor-framework";
     rev = version;
-    sha256 = "sha256-AW8AXX9t9vYv8tZvFJvrghmz6tZdfbX4hVc2QoBAvhQ=";
+    hash = "sha256-y1RE6AnyOrUN/z4md/xjlVwlIcL97ZEcKEOf8ZsCf+U=";
   };
 
   nativeBuildInputs = [ cmake ];

From 98232c145a5266c3c07819e451806f0717491cee Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 04:33:00 +0000
Subject: [PATCH 084/176] rssguard: 4.3.1 -> 4.3.2

---
 pkgs/applications/networking/feedreaders/rssguard/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/feedreaders/rssguard/default.nix b/pkgs/applications/networking/feedreaders/rssguard/default.nix
index f1225f87eefb..57cf5e20bcd5 100644
--- a/pkgs/applications/networking/feedreaders/rssguard/default.nix
+++ b/pkgs/applications/networking/feedreaders/rssguard/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rssguard";
-  version = "4.3.1";
+  version = "4.3.2";
 
   src = fetchFromGitHub {
     owner = "martinrotter";
     repo = pname;
     rev = version;
-    sha256 = "sha256-hfUtxPGPhPC2VgGLLIaYHlEMpXHAPZ5fkLL0glhyQcY=";
+    sha256 = "sha256-2h9fVah0WZ8X0GsCLtiUWRan1Gkl4WBxuEQ3gx4FFBo=";
   };
 
   buildInputs =  [ qtwebengine qttools ];

From a3a254e22ed47d34eac1a02b1be22efe61f867ca Mon Sep 17 00:00:00 2001
From: Aaron Jheng <wentworth@outlook.com>
Date: Wed, 8 Feb 2023 05:32:31 +0000
Subject: [PATCH 085/176] glab: 1.24.1 -> 1.25.3

---
 pkgs/applications/version-management/glab/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/version-management/glab/default.nix b/pkgs/applications/version-management/glab/default.nix
index 9d6bbbd13f67..a789a35f7a5d 100644
--- a/pkgs/applications/version-management/glab/default.nix
+++ b/pkgs/applications/version-management/glab/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "glab";
-  version = "1.24.1";
+  version = "1.25.3";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-CUchYPMBTINkMJg8TC8rKMVkrcj/Gy+ZxV7jbtMFvpg=";
+    hash = "sha256-x/VH6cRrJZ2t2iftBPC86FcgIwjRNzV11MwLG2y+Paw=";
   };
 
-  vendorSha256 = "sha256-NuK63ibb1t+HnSR/gCFS7HWVtfGLazVx2M+qxRNCR1I=";
+  vendorHash = "sha256-FZ1CiR8Rj/sMoCnQm6ArGQfRTlvmD14EZDmufnlTSTk=";
 
   ldflags = [
     "-s"

From 5d580276e92966ee2b1fe792c1e8735fc01046a3 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Wed, 8 Feb 2023 07:08:47 +0100
Subject: [PATCH 086/176] python310Packages.soundfile: fix build on
 x86_64-darwin

---
 pkgs/development/python-modules/soundfile/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/soundfile/default.nix b/pkgs/development/python-modules/soundfile/default.nix
index 5847dc2a63f9..91b4e2ec7a42 100644
--- a/pkgs/development/python-modules/soundfile/default.nix
+++ b/pkgs/development/python-modules/soundfile/default.nix
@@ -29,6 +29,10 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ numpy libsndfile cffi ];
   propagatedNativeBuildInputs = [ cffi ];
 
+  preConfigure = lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
+    export PYSOUNDFILE_ARCHITECTURE=x86_64
+  '';
+
   meta = {
     description = "An audio library based on libsndfile, CFFI and NumPy";
     license = lib.licenses.bsd3;

From 79ed5244c132d3b0e418986d3311acbc18d81a82 Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Wed, 8 Feb 2023 06:35:50 +0100
Subject: [PATCH 087/176] gh: 2.22.1 -> 2.23.0

---
 pkgs/applications/version-management/gh/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/version-management/gh/default.nix b/pkgs/applications/version-management/gh/default.nix
index 9018635ad9b8..3f154f0350c4 100644
--- a/pkgs/applications/version-management/gh/default.nix
+++ b/pkgs/applications/version-management/gh/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.22.1";
+  version = "2.23.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-TREy2pzVAHClwbryfEgX2WqtQ8+RmJtCNrESeaHDHMs=";
+    hash = "sha256-91TmPIjFOCeZmbobn3mIJis5qofJFmNGuX19+Cyo8Ck=";
   };
 
-  vendorHash = "sha256-OjTl43UQGGHqCrw0kMBShuS8aonjWczfzQGmGJLhdrU=";
+  vendorHash = "sha256-NiXC0ooUkAqFCLp3eRBpryazQU94gSnw0gYFwQNeCo4=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 48c9598791b204ea99c02c20d78228821bbaab6e Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 8 Feb 2023 03:15:09 +0000
Subject: [PATCH 088/176] =?UTF-8?q?terraform-providers.tencentcloud:=201.7?=
 =?UTF-8?q?9.7=20=E2=86=92=201.79.8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../networking/cluster/terraform-providers/providers.json     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index b7587ebd0677..ee6f1145ef1a 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1091,11 +1091,11 @@
     "vendorHash": "sha256-2wPmLpjhG6QgG+BUCO0oIzHjBOWIOYuptgdtSIm9TZw="
   },
   "tencentcloud": {
-    "hash": "sha256-QJUxLwKG3XabACbAvLLKBG9+cmCYRQFpRTWRU6rKwfI=",
+    "hash": "sha256-yVI1f86Gpkwl3jCAs5d54rZS8lM7cjbwWq+HUXwi8EU=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.79.7",
+    "rev": "v1.79.8",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

From 29a22901dfb3da433928e98422da78fca73e95d0 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 8 Feb 2023 03:15:48 +0000
Subject: [PATCH 089/176] =?UTF-8?q?terraform-providers.oci:=204.105.0=20?=
 =?UTF-8?q?=E2=86=92=204.106.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../networking/cluster/terraform-providers/providers.json     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index ee6f1145ef1a..ffd23a5ca7ff 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -812,11 +812,11 @@
     "vendorHash": "sha256-LRIfxQGwG988HE5fftGl6JmBG7tTknvmgpm4Fu1NbWI="
   },
   "oci": {
-    "hash": "sha256-L8y00f+57hndpVevliJ2kNqpGeNR2Jv/FHbqkAUIRMI=",
+    "hash": "sha256-ecel4aXOqkPmeOzG5G/D8vmjo2HP9TG+c8H27pCYn2g=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v4.105.0",
+    "rev": "v4.106.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

From d60172380e03bac79f8a3774bf37f0a3792932f5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 06:56:23 +0000
Subject: [PATCH 090/176] rt-tests: 2.4 -> 2.5

---
 pkgs/os-specific/linux/rt-tests/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/rt-tests/default.nix b/pkgs/os-specific/linux/rt-tests/default.nix
index 67000776256c..6185bf9912dd 100644
--- a/pkgs/os-specific/linux/rt-tests/default.nix
+++ b/pkgs/os-specific/linux/rt-tests/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rt-tests";
-  version = "2.4";
+  version = "2.5";
 
   src = fetchurl {
     url = "https://git.kernel.org/pub/scm/utils/rt-tests/rt-tests.git/snapshot/${pname}-${version}.tar.gz";
-    sha256 = "sha256-yuSfeYTaCZ0F1GXQkDnH8PBvyzR2w/XDitN8csHB9xE=";
+    sha256 = "sha256-LzN3YB3Lb7tjyEplrFaNYtiGwHUUTztZBsMrUndd2cU=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 0de24eafa9c95b259322375f9572c5dc263968bd Mon Sep 17 00:00:00 2001
From: oluceps <i@oluceps.uk>
Date: Wed, 8 Feb 2023 15:00:05 +0800
Subject: [PATCH 091/176] hysteria: 1.3.2 -> 1.3.3

---
 pkgs/tools/networking/hysteria/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/networking/hysteria/default.nix b/pkgs/tools/networking/hysteria/default.nix
index bd8e6e6d31c7..94365191cdc3 100644
--- a/pkgs/tools/networking/hysteria/default.nix
+++ b/pkgs/tools/networking/hysteria/default.nix
@@ -4,16 +4,16 @@
 }:
 buildGoModule rec {
   pname = "hysteria";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "HyNetwork";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9ib/29yCfI4oS2yZQUePzZ+5FVTevvJCPjpTXmKnKeA=";
+    sha256 = "sha256-CQgCFtvQDvhHTk10gpxfAvEJLz/i+CXXyzGrxi26hBk=";
   };
 
-  vendorSha256 = "sha256-sRPnPKVuvcUHEldKVpgmGFGpwOSK5qh4EfeUQMFdMw8=";
+  vendorSha256 = "sha256-sN+2XYoC+dDs6QKxwxuBCW4dOf4elSNKdOrbMxjOtSY=";
   proxyVendor = true;
 
   ldflags = [

From 900cf6ed74dd30449ccd340af67fea0b66d793f2 Mon Sep 17 00:00:00 2001
From: Rouven Czerwinski <rouven@czerwinskis.de>
Date: Tue, 7 Feb 2023 19:46:03 +0100
Subject: [PATCH 092/176] xwayland: 22.1.7 -> 22.1.8

Changelog: https://lists.x.org/archives/xorg-announce/2023-February/003322.html
---
 pkgs/servers/x11/xorg/xwayland.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/x11/xorg/xwayland.nix b/pkgs/servers/x11/xorg/xwayland.nix
index ae3025461449..582ec11231cd 100644
--- a/pkgs/servers/x11/xorg/xwayland.nix
+++ b/pkgs/servers/x11/xorg/xwayland.nix
@@ -43,11 +43,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xwayland";
-  version = "22.1.7";
+  version = "22.1.8";
 
   src = fetchurl {
     url = "mirror://xorg/individual/xserver/${pname}-${version}.tar.xz";
-    sha256 = "sha256-1Tr6xscZU/XPZtA9KJ2s2JYdpb0wnB3/El1ZVdnbX3Y=";
+    sha256 = "sha256-0R7u5zKQuI6o2kKn2TUN7fq6hWzkrkTljARa2eyqL3M=";
   };
 
   depsBuildBuild = [

From dda83f54001bdad3dff1cbe4a8a5f328607334f3 Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Wed, 8 Feb 2023 08:05:38 +0100
Subject: [PATCH 093/176] nextcloud-client: 3.6.6 -> 3.7.1

---
 ...xplicitly-copy-dbus-files-into-the-store-dir.patch | 11 +++--------
 .../networking/nextcloud-client/default.nix           |  4 ++--
 2 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/pkgs/applications/networking/nextcloud-client/0001-Explicitly-copy-dbus-files-into-the-store-dir.patch b/pkgs/applications/networking/nextcloud-client/0001-Explicitly-copy-dbus-files-into-the-store-dir.patch
index ab7cb9bffa45..260a7dd4ddd7 100644
--- a/pkgs/applications/networking/nextcloud-client/0001-Explicitly-copy-dbus-files-into-the-store-dir.patch
+++ b/pkgs/applications/networking/nextcloud-client/0001-Explicitly-copy-dbus-files-into-the-store-dir.patch
@@ -8,18 +8,13 @@ Subject: [PATCH] Explicitly copy dbus files into the store dir
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/shell_integration/libcloudproviders/CMakeLists.txt b/shell_integration/libcloudproviders/CMakeLists.txt
-index 1f35335..7f76951 100644
+index 2e7349ef7..512d4b188 100644
 --- a/shell_integration/libcloudproviders/CMakeLists.txt
 +++ b/shell_integration/libcloudproviders/CMakeLists.txt
-@@ -19,7 +19,7 @@ MACRO(PKGCONFIG_GETVAR _package _var _output_variable)
- ENDMACRO(PKGCONFIG_GETVAR _package _var _output_variable)
- 
+@@ -1,5 +1,6 @@
  macro(dbus_add_activation_service _sources)
--    PKGCONFIG_GETVAR(dbus-1 session_bus_services_dir _install_dir)
+     pkg_get_variable(_install_dir dbus-1 session_bus_services_dir)
 +    set(_install_dir "${CMAKE_INSTALL_DATADIR}/dbus-1/service")
      foreach (_i ${_sources})
          get_filename_component(_service_file ${_i} ABSOLUTE)
          string(REGEX REPLACE "\\.service.*$" ".service" _output_file ${_i})
--- 
-2.19.2
-
diff --git a/pkgs/applications/networking/nextcloud-client/default.nix b/pkgs/applications/networking/nextcloud-client/default.nix
index e409551f1232..24d0cdab722e 100644
--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@@ -26,7 +26,7 @@
 
 mkDerivation rec {
   pname = "nextcloud-client";
-  version = "3.6.6";
+  version = "3.7.1";
 
   outputs = [ "out" "dev" ];
 
@@ -34,7 +34,7 @@ mkDerivation rec {
     owner = "nextcloud";
     repo = "desktop";
     rev = "v${version}";
-    sha256 = "sha256-P3LSgrcMZZM0OY3yQz8t3Cf5spJJTB+JTIpoT9U3+xc=";
+    sha256 = "sha256-MbxGS1Msb3xCW0z8FrIZEY3XaBa4BmN+JFBkV/Pf79A=";
   };
 
   patches = [

From d482d7fef1ac5b3c9aac826ca70cc41431843904 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 07:18:28 +0000
Subject: [PATCH 094/176] jackett: 0.20.2986 -> 0.20.3004

---
 pkgs/servers/jackett/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
index dc93a7977ad8..ae8b8eacabe4 100644
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@@ -9,13 +9,13 @@
 
 buildDotnetModule rec {
   pname = "jackett";
-  version = "0.20.2986";
+  version = "0.20.3004";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha512-IbcIn2n5Cob+Ewp0lkkIENuo00HBlNy6V5pKARC6EgBDRKbB+YXETDX1Ko3Dsl0x6mxZgoTCbzEIPxD+Y2J4Rw==";
+    hash = "sha512-UNGkcCQeeMxonJ9Kf1SDMTgSC8uTM2gD377qA+ViSfpWoOGQCY003EZ0c3c0q6oSGVbiIma1wvyW/T/ILLi5yw==";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";

From 99682c8588e3e726b8416bbe8615b6b6c9a9c700 Mon Sep 17 00:00:00 2001
From: Austin Butler <austinabutler@gmail.com>
Date: Tue, 7 Feb 2023 23:59:39 -0800
Subject: [PATCH 095/176] yubikey-manager: 5.0.0 -> 5.0.1

---
 pkgs/tools/misc/yubikey-manager/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/misc/yubikey-manager/default.nix b/pkgs/tools/misc/yubikey-manager/default.nix
index 730dfabe00f2..5487d9835cd5 100644
--- a/pkgs/tools/misc/yubikey-manager/default.nix
+++ b/pkgs/tools/misc/yubikey-manager/default.nix
@@ -3,14 +3,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "yubikey-manager";
-  version = "5.0.0";
+  version = "5.0.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     repo = "yubikey-manager";
     rev = "refs/tags/${version}";
     owner = "Yubico";
-    sha256 = "sha256-ZQQhRiUsQwLaOY8NCzSc/PTmRewTL0ECBKj7Uj+6Gn8=";
+    sha256 = "sha256-Dj3ftyFeVgM0YMFI8cbiH5dmc8SKi2SBbScnc0+ad0M=";
   };
 
   postPatch = ''
@@ -23,7 +23,7 @@ python3Packages.buildPythonPackage rec {
   nativeBuildInputs = with python3Packages; [ poetry-core ];
 
   propagatedBuildInputs =
-    with python3Packages; ([
+    with python3Packages; [
       click
       cryptography
       pyscard
@@ -31,7 +31,7 @@ python3Packages.buildPythonPackage rec {
       six
       fido2
       keyring
-    ]) ++ [
+    ] ++ [
       libu2f-host
       libusb1
       yubikey-personalization

From 4b5b453266adffb794dc56d1771587e70edb7156 Mon Sep 17 00:00:00 2001
From: Austin Butler <austinabutler@gmail.com>
Date: Wed, 8 Feb 2023 00:00:03 -0800
Subject: [PATCH 096/176] yubioath-flutter: 6.0.2 -> 6.1.0

---
 pkgs/applications/misc/yubioath-flutter/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/misc/yubioath-flutter/default.nix b/pkgs/applications/misc/yubioath-flutter/default.nix
index bac11b6899b3..e4369a7ab9fd 100644
--- a/pkgs/applications/misc/yubioath-flutter/default.nix
+++ b/pkgs/applications/misc/yubioath-flutter/default.nix
@@ -10,19 +10,19 @@
 }:
 let
   vendorHashes = {
-    x86_64-linux = "sha256-BwhWA8N0S55XkljDKPNkDhsj0QSpmJJ5MwEnrPjymS8=";
-    aarch64-linux = "sha256-T1aGz3+2Sls+rkUVDUo39Ky2igg+dxGSUaf3qpV7ovQ=";
+    x86_64-linux = "sha256-Upe0cEDG02RJD50Ht9VNMwkelsJHX8zOuJZssAhMuMY=";
+    aarch64-linux = "sha256-Upe0cEDG02RJD50Ht9VNMwkelsJHX8zOuJZssAhMuMY=";
   };
 in
 flutter.mkFlutterApp rec {
   pname = "yubioath-flutter";
-  version = "6.0.2";
+  version = "6.1.0";
 
   src = fetchFromGitHub {
     owner = "Yubico";
     repo = "yubioath-flutter";
     rev = version;
-    sha256 = "13nh5qpq02c6azfdh4cbzhlrq0hs9is45q5z5cnxg84hrx26hd4k";
+    sha256 = "sha256-N9/qwC79mG9r+zMPLHSPjNSQ+srGtnXuKsf0ijtH7CI=";
   };
 
   passthru.helper = python3.pkgs.callPackage ./helper.nix { inherit src version meta; };

From c3ad496c12b4108e4879c279a1b313cd4062581f Mon Sep 17 00:00:00 2001
From: superherointj <5861043+superherointj@users.noreply.github.com>
Date: Wed, 8 Feb 2023 05:47:03 -0300
Subject: [PATCH 097/176] cryptodev: unpin kernel

---
 pkgs/top-level/all-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9713f167e427..f26ed6f0bcb2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -26055,7 +26055,7 @@ with pkgs;
 
   linux-doc = callPackage ../os-specific/linux/kernel/htmldocs.nix { };
 
-  cryptodev = linuxKernel.packages.linux_4_9.cryptodev;
+  cryptodev = linuxPackages.cryptodev;
 
   dpdk = callPackage ../os-specific/linux/dpdk {
     kernel = null; # dpdk modules are in linuxPackages.dpdk.kmod

From a112c3d50fcf1ad915bd6e1326d91836c85fe0e6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 08:51:32 +0000
Subject: [PATCH 098/176] python310Packages.types-pyyaml: 6.0.12.3 -> 6.0.12.4

---
 pkgs/development/python-modules/types-pyyaml/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/types-pyyaml/default.nix b/pkgs/development/python-modules/types-pyyaml/default.nix
index f0b4056e2b58..710e1ad32cd5 100644
--- a/pkgs/development/python-modules/types-pyyaml/default.nix
+++ b/pkgs/development/python-modules/types-pyyaml/default.nix
@@ -5,13 +5,13 @@
 
 buildPythonPackage rec {
   pname = "types-pyyaml";
-  version = "6.0.12.3";
+  version = "6.0.12.4";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "types-PyYAML";
     inherit version;
-    sha256 = "sha256-F84Xs+rY8G5BajsdW43cbLgqQiuyACVN2LRpQ0sEX/w=";
+    sha256 = "sha256-rebjKKWj34FsR8kSwuHpRq4rrOkHRKpzER7mg0sDoxQ=";
   };
 
   # Module doesn't have tests

From 7e07464c250c9478f4398e81550d7222db5340ac Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Wed, 8 Feb 2023 10:26:51 +0100
Subject: [PATCH 099/176] yubioath-flutter: fix build on aarch64-linux

---
 pkgs/applications/misc/yubioath-flutter/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/misc/yubioath-flutter/default.nix b/pkgs/applications/misc/yubioath-flutter/default.nix
index e4369a7ab9fd..dde9f3b69862 100644
--- a/pkgs/applications/misc/yubioath-flutter/default.nix
+++ b/pkgs/applications/misc/yubioath-flutter/default.nix
@@ -11,7 +11,7 @@
 let
   vendorHashes = {
     x86_64-linux = "sha256-Upe0cEDG02RJD50Ht9VNMwkelsJHX8zOuJZssAhMuMY=";
-    aarch64-linux = "sha256-Upe0cEDG02RJD50Ht9VNMwkelsJHX8zOuJZssAhMuMY=";
+    aarch64-linux = "sha256-lKER4+gcyFqnCvgBl/qdVBCbUpocWUnXGLXsX82MSy4=";
   };
 in
 flutter.mkFlutterApp rec {

From fe585e398899151d7aa329fd10e90cb73a028995 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 8 Feb 2023 12:35:13 +0300
Subject: [PATCH 100/176] kio-admin: init at 1.0.0

---
 pkgs/tools/filesystems/kio-admin/default.nix | 17 +++++++++++++++++
 pkgs/top-level/all-packages.nix              |  2 ++
 2 files changed, 19 insertions(+)
 create mode 100644 pkgs/tools/filesystems/kio-admin/default.nix

diff --git a/pkgs/tools/filesystems/kio-admin/default.nix b/pkgs/tools/filesystems/kio-admin/default.nix
new file mode 100644
index 000000000000..f7f7484cc00c
--- /dev/null
+++ b/pkgs/tools/filesystems/kio-admin/default.nix
@@ -0,0 +1,17 @@
+{ stdenv, fetchFromGitLab, cmake, extra-cmake-modules, qtbase, wrapQtAppsHook, kio, ki18n, polkit-qt }:
+
+stdenv.mkDerivation rec {
+  pname = "kio-admin";
+  version = "1.0.0";
+
+  src = fetchFromGitLab {
+    domain = "invent.kde.org";
+    owner = "system";
+    repo = "kio-admin";
+    rev = "v${version}";
+    hash = "sha256-llnUsOttqFJVArJdZS9s6qHS9eGbdtdoaPMXKHtsUn4=";
+  };
+
+  nativeBuildInputs = [ cmake extra-cmake-modules wrapQtAppsHook ];
+  buildInputs = [ qtbase kio ki18n polkit-qt ];
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3a2404b7e402..6458e9b71680 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8791,6 +8791,8 @@ with pkgs;
 
   kibi = callPackage ../applications/editors/kibi { };
 
+  kio-admin = libsForQt5.callPackage ../tools/filesystems/kio-admin { };
+
   kio-fuse = libsForQt5.callPackage ../tools/filesystems/kio-fuse { };
 
   kismet = callPackage ../applications/networking/sniffers/kismet { };

From 4a514c67547e0f1f1638b0f6fa95a7e7aae04596 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 8 Feb 2023 12:35:30 +0300
Subject: [PATCH 101/176] nixos/plasma5: install kio-admin for desktop

---
 nixos/modules/services/x11/desktop-managers/plasma5.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/x11/desktop-managers/plasma5.nix b/nixos/modules/services/x11/desktop-managers/plasma5.nix
index eb0373c686c5..181db01ad88e 100644
--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@@ -448,6 +448,7 @@ in
             dolphin-plugins
             ffmpegthumbs
             kdegraphics-thumbnailers
+            pkgs.kio-admin
             kio-extras
           ];
           optionalPackages = [

From ba1f0de69499dfba97fcd29bb22106537d2768c0 Mon Sep 17 00:00:00 2001
From: Damien Cassou <damien@cassou.me>
Date: Thu, 2 Feb 2023 16:03:27 +0100
Subject: [PATCH 102/176] borgmatic: 1.7.2 -> 1.7.6

---
 pkgs/tools/backup/borgmatic/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/backup/borgmatic/default.nix b/pkgs/tools/backup/borgmatic/default.nix
index dc77b5de403f..dcc4caaa6362 100644
--- a/pkgs/tools/backup/borgmatic/default.nix
+++ b/pkgs/tools/backup/borgmatic/default.nix
@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "borgmatic";
-  version = "1.7.2";
+  version = "1.7.6";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "sha256-0o2tKg7BfhkNt/k8XdZ1agaSJxKO5OxB5aaRgV9IPeU=";
+    sha256 = "sha256-TNh0laNAyHkIZLC51hzchSIDvsHst2aPxoRdI6Mdr84=";
   };
 
   nativeCheckInputs = with python3Packages; [ flexmock pytestCheckHook pytest-cov ];

From b33d6407cc37c9f4fe112692fb0b74a45fc7e7a3 Mon Sep 17 00:00:00 2001
From: Yueh-Shun Li <44064051+ShamrockLee@users.noreply.github.com>
Date: Sun, 29 Jan 2023 01:02:47 +0800
Subject: [PATCH 103/176] singularity-tool: format expression

---
 .../singularity-tools/default.nix             | 57 ++++++++++---------
 1 file changed, 31 insertions(+), 26 deletions(-)

diff --git a/pkgs/build-support/singularity-tools/default.nix b/pkgs/build-support/singularity-tools/default.nix
index 46df792bdf6c..bf542e307008 100644
--- a/pkgs/build-support/singularity-tools/default.nix
+++ b/pkgs/build-support/singularity-tools/default.nix
@@ -10,8 +10,8 @@
 , gawk
 , util-linux
 , runtimeShell
-, e2fsprogs }:
-
+, e2fsprogs
+}:
 rec {
   shellScript = name: text:
     writeScript name ''
@@ -20,35 +20,39 @@ rec {
       ${text}
     '';
 
-  mkLayer = {
-    name,
-    contents ? [],
-  }:
-    runCommand "singularity-layer-${name}" {
-      inherit contents;
-    } ''
+  mkLayer =
+    { name
+    , contents ? [ ]
+    ,
+    }:
+    runCommand "singularity-layer-${name}"
+      {
+        inherit contents;
+      } ''
       mkdir $out
       for f in $contents ; do
         cp -ra $f $out/
       done
     '';
 
-  buildImage = {
-    name,
-    contents ? [],
-    diskSize ? 1024,
-    runScript ? "#!${stdenv.shell}\nexec /bin/sh",
-    runAsRoot ? null,
-    memSize ? 512
-  }:
-    let layer = mkLayer {
-          inherit name;
-          contents = contents ++ [ bash runScriptFile ];
-          };
-        runAsRootFile = shellScript "run-as-root.sh" runAsRoot;
-        runScriptFile = shellScript "run-script.sh" runScript;
-        result = vmTools.runInLinuxVM (
-          runCommand "singularity-image-${name}.img" {
+  buildImage =
+    { name
+    , contents ? [ ]
+    , diskSize ? 1024
+    , runScript ? "#!${stdenv.shell}\nexec /bin/sh"
+    , runAsRoot ? null
+    , memSize ? 512
+    }:
+    let
+      layer = mkLayer {
+        inherit name;
+        contents = contents ++ [ bash runScriptFile ];
+      };
+      runAsRootFile = shellScript "run-as-root.sh" runAsRoot;
+      runScriptFile = shellScript "run-script.sh" runScript;
+      result = vmTools.runInLinuxVM (
+        runCommand "singularity-image-${name}.img"
+          {
             buildInputs = [ singularity e2fsprogs util-linux gawk ];
             layerClosure = writeReferencesToFile layer;
             preVM = vmTools.createEmptyImage {
@@ -106,5 +110,6 @@ rec {
             TMPDIR=$(pwd -P) singularity build $out ./img
           '');
 
-    in result;
+    in
+    result;
 }

From 136bbe260598e4497cd6c8973480277e8a030274 Mon Sep 17 00:00:00 2001
From: Yueh-Shun Li <44064051+ShamrockLee@users.noreply.github.com>
Date: Sun, 29 Jan 2023 01:02:47 +0800
Subject: [PATCH 104/176] nixos/modules/programs/singularity.nix: format
 expression

---
 nixos/modules/programs/singularity.nix | 27 ++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/nixos/modules/programs/singularity.nix b/nixos/modules/programs/singularity.nix
index 9648d0c27874..e1530e604fe6 100644
--- a/nixos/modules/programs/singularity.nix
+++ b/nixos/modules/programs/singularity.nix
@@ -3,32 +3,35 @@
 with lib;
 let
   cfg = config.programs.singularity;
-  singularity = pkgs.singularity.overrideAttrs (attrs : {
+  singularity = pkgs.singularity.overrideAttrs (attrs: {
     installPhase = attrs.installPhase + ''
       mv $out/libexec/singularity/bin/starter-suid $out/libexec/singularity/bin/starter-suid.orig
       ln -s /run/wrappers/bin/singularity-suid $out/libexec/singularity/bin/starter-suid
     '';
   });
-in {
+in
+{
+
   options.programs.singularity = {
     enable = mkEnableOption (lib.mdDoc "Singularity");
   };
 
   config = mkIf cfg.enable {
-      environment.systemPackages = [ singularity ];
-      security.wrappers.singularity-suid =
-      { setuid = true;
+    environment.systemPackages = [ singularity ];
+    security.wrappers.singularity-suid =
+      {
+        setuid = true;
         owner = "root";
         group = "root";
         source = "${singularity}/libexec/singularity/bin/starter-suid.orig";
       };
-      systemd.tmpfiles.rules = [
-        "d /var/singularity/mnt/session 0770 root root -"
-        "d /var/singularity/mnt/final 0770 root root -"
-        "d /var/singularity/mnt/overlay 0770 root root -"
-        "d /var/singularity/mnt/container 0770 root root -"
-        "d /var/singularity/mnt/source 0770 root root -"
-      ];
+    systemd.tmpfiles.rules = [
+      "d /var/singularity/mnt/session 0770 root root -"
+      "d /var/singularity/mnt/final 0770 root root -"
+      "d /var/singularity/mnt/overlay 0770 root root -"
+      "d /var/singularity/mnt/container 0770 root root -"
+      "d /var/singularity/mnt/source 0770 root root -"
+    ];
   };
 
 }

From ef09cfec0bbba5a4adc4745981053654c6c170f2 Mon Sep 17 00:00:00 2001
From: Yueh-Shun Li <44064051+ShamrockLee@users.noreply.github.com>
Date: Sun, 29 Jan 2023 01:02:47 +0800
Subject: [PATCH 105/176] all-packages.nix: move the line of singularity per
 alphabetical ordering

---
 pkgs/top-level/all-packages.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3a2404b7e402..d4895b725213 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -30196,6 +30196,8 @@ with pkgs;
 
   shepherd = nodePackages."@nerdwallet/shepherd";
 
+  singularity = callPackage ../applications/virtualization/singularity { };
+
   skate = callPackage ../applications/misc/skate { };
 
   slack = callPackage ../applications/networking/instant-messengers/slack { };
@@ -30206,8 +30208,6 @@ with pkgs;
 
   slweb = callPackage ../applications/misc/slweb { };
 
-  singularity = callPackage ../applications/virtualization/singularity { };
-
   sonixd = callPackage ../applications/audio/sonixd { };
 
   sosreport = python3Packages.callPackage ../applications/logging/sosreport { };

From 26546353f50a54e43e112d861b289391605fbf35 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 8 Feb 2023 10:52:40 +0100
Subject: [PATCH 106/176] python310Packages.archinfo: 9.2.36 -> 9.2.37

---
 pkgs/development/python-modules/archinfo/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/archinfo/default.nix b/pkgs/development/python-modules/archinfo/default.nix
index 22a460cc2741..7f7aff682bed 100644
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "archinfo";
-  version = "9.2.36";
+  version = "9.2.37";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-anZsvDIH1AWaFUG5UTuyQiOKeoUB/+MSbu5pjPZJxag=";
+    hash = "sha256-WGc6FmrS0aVmiY5s8fUVHCT6cqcmj52H6FD2TR1HyK0=";
   };
 
   nativeBuildInputs = [

From 9fa09eab2e871c1202255d029f193b368b364ec1 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 8 Feb 2023 10:52:44 +0100
Subject: [PATCH 107/176] python310Packages.ailment: 9.2.36 -> 9.2.37

---
 pkgs/development/python-modules/ailment/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/ailment/default.nix b/pkgs/development/python-modules/ailment/default.nix
index 2e878b014cc2..81f73d324b1d 100644
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "ailment";
-  version = "9.2.36";
+  version = "9.2.37";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-PEX2SanglMqjtJHuH+gA5dnikh7qqLFiXbmrcIzs1+A=";
+    hash = "sha256-MFQiLOCqEAKzST7voMIQH0TYGuwICSVBcQZwUkk9S1Q=";
   };
 
   nativeBuildInputs = [

From 748a4c726a05f4a3187ae7e25fad81a733f472ec Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 8 Feb 2023 10:52:47 +0100
Subject: [PATCH 108/176] python310Packages.pyvex: 9.2.36 -> 9.2.37

---
 pkgs/development/python-modules/pyvex/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyvex/default.nix b/pkgs/development/python-modules/pyvex/default.nix
index 58523a13b066..20d7da5f4883 100644
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyvex";
-  version = "9.2.36";
+  version = "9.2.37";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KV/fkgYUt8hfpGxDO3CNNrC91BaI9W8T2mr2H4eJdxo=";
+    hash = "sha256-JGTfOE16tycBkbsihKPgSZPlfqun1vr/86kAlNwrSZA=";
   };
 
   nativeBuildInputs = [

From 5c4a77c4392288b565c47a98b8d17e9adacb6f7d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 8 Feb 2023 10:52:54 +0100
Subject: [PATCH 109/176] python310Packages.claripy: 9.2.36 -> 9.2.37

---
 pkgs/development/python-modules/claripy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/claripy/default.nix b/pkgs/development/python-modules/claripy/default.nix
index a8811d7f37ac..05ff5762bb35 100644
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "claripy";
-  version = "9.2.36";
+  version = "9.2.37";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-gF8T1ZTvTjyt+kEOxI3ryDJOZv4go54VTxSGEdUyGt4=";
+    hash = "sha256-8kABsLp3Nrzjn7staiNfU6HdQTu1x6DNQzilMceqKVY=";
   };
 
   nativeBuildInputs = [

From af2d3b2e91c8ea95d6112c6f74f79c111c7c1d35 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 8 Feb 2023 10:52:59 +0100
Subject: [PATCH 110/176] python310Packages.cle: 9.2.36 -> 9.2.37

---
 pkgs/development/python-modules/cle/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cle/default.nix b/pkgs/development/python-modules/cle/default.nix
index e1f022c1a463..8ed14ba28cc3 100644
--- a/pkgs/development/python-modules/cle/default.nix
+++ b/pkgs/development/python-modules/cle/default.nix
@@ -16,7 +16,7 @@
 
 let
   # The binaries are following the argr projects release cycle
-  version = "9.2.36";
+  version = "9.2.37";
 
   # Binary files from https://github.com/angr/binaries (only used for testing and only here)
   binaries = fetchFromGitHub {
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "angr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-XqoBFV87m/uz0proGDtbaewsoY8vsA6ToGwdv7xvO9Y=";
+    hash = "sha256-vgH8UAR8B4l29RH0dwMlGVjOHgdcOTfLMHPiKN9Z36s=";
   };
 
   nativeBuildInputs = [

From 498a1c28a0f96318a7d7a917417ae91ff32f9099 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 8 Feb 2023 10:53:05 +0100
Subject: [PATCH 111/176] python310Packages.angr: 9.2.36 -> 9.2.37

---
 pkgs/development/python-modules/angr/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/angr/default.nix b/pkgs/development/python-modules/angr/default.nix
index 4abcad0e7c9b..a164cd284c57 100644
--- a/pkgs/development/python-modules/angr/default.nix
+++ b/pkgs/development/python-modules/angr/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "angr";
-  version = "9.2.36";
+  version = "9.2.37";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-KVIrhzd3EoDIVImshfjZrBAiNkCtlFAd6Ox9ATsvPTY=";
+    hash = "sha256-sl3GzNMN90ez1Zks43B2How7QTaaJZbxOxK2hl/UzdQ=";
   };
 
   propagatedBuildInputs = [

From b1e672e63943ff0e60b65330e98f8378b3dc597d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 8 Feb 2023 10:54:55 +0100
Subject: [PATCH 112/176] python310Packages.aiohomekit: 2.4.6 -> 2.5.0

Diff: https://github.com/Jc2k/aiohomekit/compare/refs/tags/2.4.6...2.5.0

Changelog: https://github.com/Jc2k/aiohomekit/releases/tag/2.5.0
---
 pkgs/development/python-modules/aiohomekit/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiohomekit/default.nix b/pkgs/development/python-modules/aiohomekit/default.nix
index e19f613e301a..e9b27ea7a83e 100644
--- a/pkgs/development/python-modules/aiohomekit/default.nix
+++ b/pkgs/development/python-modules/aiohomekit/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "aiohomekit";
-  version = "2.4.6";
+  version = "2.5.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "Jc2k";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-QCPZaxVCQSckZ7qjV9wF7YqgTOFPbRy4xOQVDvReav4=";
+    hash = "sha256-uFmQLeGPnFDABA4Uu1sL/2uUJnL+feclpGyJyISJx2E=";
   };
 
   nativeBuildInputs = [

From 9819ff90674d381007103d90b106837d016a74c2 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 8 Feb 2023 10:56:53 +0100
Subject: [PATCH 113/176] python310Packages.peaqevcore: 11.1.2 -> 11.2.0

---
 pkgs/development/python-modules/peaqevcore/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/peaqevcore/default.nix b/pkgs/development/python-modules/peaqevcore/default.nix
index b8b5f092dcb2..3e1776b97b49 100644
--- a/pkgs/development/python-modules/peaqevcore/default.nix
+++ b/pkgs/development/python-modules/peaqevcore/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "11.1.2";
+  version = "11.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZuXc/7xCCFl20+GAMpL1c4iavjr7iR0pTvAoDCMnxx4=";
+    hash = "sha256-L4QUQsLdFwJPGq8ZdpTHRv5dNn1o6lc1q37LVNNCOOM=";
   };
 
   postPatch = ''

From 50788d2fb00e79c3f3ef720edbb5218d561c8ce7 Mon Sep 17 00:00:00 2001
From: Yueh-Shun Li <44064051+ShamrockLee@users.noreply.github.com>
Date: Sun, 29 Jan 2023 01:02:47 +0800
Subject: [PATCH 114/176] apptainer, singularity: fix defaultPath and reflect
 upstream changes

Upstream changes:
singularity 3.8.7 (the legacy) -> apptainer 1.1.3 (the renamed) / singularity 3.10.4 (Sylabs's fork)

Build process:
*   Share between different sources
*   Fix the sed regexp to make defaultPath patch work
*   allowGoReference is now true
*   Provied input parameter removeCompat (default to false)
    that removes the compatible "*singularity*" symbolic links
    and related autocompletion files when projectName != "singularity"
*   Change localstatedir to /var/lib
*   Format with nixpkgs-fmt
*   Fix the defaultPath patching
    and use it instead of the `<executable> path` config directive
    deprecated in Apptainer
*   Provide dependencies for new functionalities such as
    squashfuse (unprivileged squashfs mount)
*   Provide an attribute `defaultPathInputs` to override
    prefix of container runtime default PATH

NixOS module programs.singularity:
*   Allow users to specify packages
*   Place related directories to /var/lib
*   Format with nixpkgs-fmt

singularity-tools:
*   Allow users to specify packages
*   Place related directories to /var/lib when building images in VM
---
 .../from_md/release-notes/rl-2305.section.xml |  36 +++
 .../manual/release-notes/rl-2305.section.md   |  10 +
 nixos/modules/programs/singularity.nix        |  84 +++++--
 .../virtualization/singularity/default.nix    |  73 ------
 .../virtualization/singularity/generic.nix    | 222 ++++++++++++++++++
 .../virtualization/singularity/packages.nix   |  70 ++++++
 .../singularity-tools/default.nix             |  29 ++-
 pkgs/top-level/all-packages.nix               |   4 +-
 8 files changed, 423 insertions(+), 105 deletions(-)
 delete mode 100644 pkgs/applications/virtualization/singularity/default.nix
 create mode 100644 pkgs/applications/virtualization/singularity/generic.nix
 create mode 100644 pkgs/applications/virtualization/singularity/packages.nix

diff --git a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
index b4041c026129..3c240585b987 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
@@ -922,6 +922,42 @@
           as general purpose ephemeral block devices has been removed.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          As Singularity has renamed to
+          <link xlink:href="https://apptainer.org/news/community-announcement-20211130">Apptainer</link>
+          to distinguish from
+          <link xlink:href="https://sylabs.io/2021/05/singularity-community-edition">an
+          un-renamed fork by Sylabs Inc.</link>, there are now two
+          packages of Singularity/Apptainer:
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              <literal>apptainer</literal>: From
+              <literal>github.com/apptainer/apptainer</literal>, which
+              is the new repo after renaming.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <literal>singularity</literal>: From
+              <literal>github.com/sylabs/singularity</literal>, which is
+              the fork by Sylabs Inc..
+            </para>
+          </listitem>
+        </itemizedlist>
+        <para>
+          <literal>programs.singularity</literal> got a new
+          <literal>package</literal> option to specify which package to
+          use.
+        </para>
+        <para>
+          <literal>singularity-tools.buildImage</literal> got a new
+          input argument <literal>singularity</literal> to specify which
+          package to use.
+        </para>
+      </listitem>
       <listitem>
         <para>
           The <literal>unifi-poller</literal> package and corresponding
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 305458c66546..81a029bf891b 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -225,6 +225,16 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The `zramSwap` is now implemented with `zram-generator`, and the option `zramSwap.numDevices` for using ZRAM devices as general purpose ephemeral block devices has been removed.
 
+- As Singularity has renamed to [Apptainer](https://apptainer.org/news/community-announcement-20211130)
+  to distinguish from [an un-renamed fork by Sylabs Inc.](https://sylabs.io/2021/05/singularity-community-edition),
+  there are now two packages of Singularity/Apptainer:
+  * `apptainer`: From `github.com/apptainer/apptainer`, which is the new repo after renaming.
+  * `singularity`: From `github.com/sylabs/singularity`, which is the fork by Sylabs Inc..
+
+  `programs.singularity` got a new `package` option to specify which package to use.
+
+  `singularity-tools.buildImage` got a new input argument `singularity` to specify which package to use.
+
 - The `unifi-poller` package and corresponding NixOS module have been renamed to `unpoller` to match upstream.
 
 - The new option `services.tailscale.useRoutingFeatures` controls various settings for using Tailscale features like exit nodes and subnet routers. If you wish to use your machine as an exit node, you can set this setting to `server`, otherwise if you wish to use an exit node you can set this setting to `client`. The strict RPF warning has been removed as the RPF will be loosened automatically based on the value of this setting.
diff --git a/nixos/modules/programs/singularity.nix b/nixos/modules/programs/singularity.nix
index e1530e604fe6..097c7a7f842b 100644
--- a/nixos/modules/programs/singularity.nix
+++ b/nixos/modules/programs/singularity.nix
@@ -3,34 +3,78 @@
 with lib;
 let
   cfg = config.programs.singularity;
-  singularity = pkgs.singularity.overrideAttrs (attrs: {
-    installPhase = attrs.installPhase + ''
-      mv $out/libexec/singularity/bin/starter-suid $out/libexec/singularity/bin/starter-suid.orig
-      ln -s /run/wrappers/bin/singularity-suid $out/libexec/singularity/bin/starter-suid
-    '';
-  });
 in
 {
 
   options.programs.singularity = {
-    enable = mkEnableOption (lib.mdDoc "Singularity");
+    enable = mkEnableOption (mdDoc "singularity") // {
+      description = mdDoc ''
+        Whether to install Singularity/Apptainer with system-level overriding such as SUID support.
+      '';
+    };
+    package = mkOption {
+      type = types.package;
+      default = pkgs.singularity;
+      defaultText = literalExpression "pkgs.singularity";
+      example = literalExpression "pkgs.apptainer";
+      description = mdDoc ''
+        Singularity/Apptainer package to override and install.
+      '';
+    };
+    packageOverriden = mkOption {
+      type = types.nullOr types.package;
+      default = null;
+      description = mdDoc ''
+        This option provides access to the overriden result of `programs.singularity.package`.
+
+        For example, the following configuration makes all the Nixpkgs packages use the overriden `singularity`:
+        ```Nix
+        { config, lib, pkgs, ... }:
+        {
+          nixpkgs.overlays = [
+            (final: prev: {
+              _singularity-orig = prev.singularity;
+              singularity = config.programs.singularity.packageOverriden;
+            })
+          ];
+          programs.singularity.enable = true;
+          programs.singularity.package = pkgs._singularity-orig;
+        }
+        ```
+
+        Use `lib.mkForce` to forcefully specify the overriden package.
+      '';
+    };
+    enableSuid = mkOption {
+      type = types.bool;
+      default = true;
+      example = false;
+      description = mdDoc ''
+        Whether to enable the SUID support of Singularity/Apptainer.
+      '';
+    };
   };
 
   config = mkIf cfg.enable {
-    environment.systemPackages = [ singularity ];
-    security.wrappers.singularity-suid =
-      {
-        setuid = true;
-        owner = "root";
-        group = "root";
-        source = "${singularity}/libexec/singularity/bin/starter-suid.orig";
-      };
+    programs.singularity.packageOverriden = (cfg.package.override (
+      optionalAttrs cfg.enableSuid {
+        enableSuid = true;
+        starterSuidPath = "/run/wrappers/bin/${cfg.package.projectName}-suid";
+      }
+    ));
+    environment.systemPackages = [ cfg.packageOverriden ];
+    security.wrappers."${cfg.packageOverriden.projectName}-suid" = mkIf cfg.enableSuid {
+      setuid = true;
+      owner = "root";
+      group = "root";
+      source = "${cfg.packageOverriden}/libexec/${cfg.packageOverriden.projectName}/bin/starter-suid.orig";
+    };
     systemd.tmpfiles.rules = [
-      "d /var/singularity/mnt/session 0770 root root -"
-      "d /var/singularity/mnt/final 0770 root root -"
-      "d /var/singularity/mnt/overlay 0770 root root -"
-      "d /var/singularity/mnt/container 0770 root root -"
-      "d /var/singularity/mnt/source 0770 root root -"
+      "d /var/lib/${cfg.packageOverriden.projectName}/mnt/session 0770 root root -"
+      "d /var/lib/${cfg.packageOverriden.projectName}/mnt/final 0770 root root -"
+      "d /var/lib/${cfg.packageOverriden.projectName}/mnt/overlay 0770 root root -"
+      "d /var/lib/${cfg.packageOverriden.projectName}/mnt/container 0770 root root -"
+      "d /var/lib/${cfg.packageOverriden.projectName}/mnt/source 0770 root root -"
     ];
   };
 
diff --git a/pkgs/applications/virtualization/singularity/default.nix b/pkgs/applications/virtualization/singularity/default.nix
deleted file mode 100644
index 5ec5b19ce042..000000000000
--- a/pkgs/applications/virtualization/singularity/default.nix
+++ /dev/null
@@ -1,73 +0,0 @@
-{ lib
-, fetchurl
-, util-linux
-, gpgme
-, openssl
-, libuuid
-, coreutils
-, which
-, makeWrapper
-, cryptsetup
-, squashfsTools
-, buildGoPackage}:
-
-with lib;
-
-buildGoPackage rec {
-  pname = "singularity";
-  version = "3.8.7";
-
-  src = fetchurl {
-    url = "https://github.com/hpcng/singularity/releases/download/v${version}/singularity-${version}.tar.gz";
-    sha256 = "sha256-Myny5YP4SoNDyywDgKHWy86vrn0eYztcvK33FD6shZs=";
-  };
-
-  goPackagePath = "github.com/sylabs/singularity";
-
-  buildInputs = [ gpgme openssl libuuid ];
-  nativeBuildInputs = [ util-linux which makeWrapper cryptsetup ];
-  propagatedBuildInputs = [ coreutils squashfsTools ];
-
-  postPatch = ''
-    substituteInPlace internal/pkg/build/files/copy.go \
-      --replace /bin/cp ${coreutils}/bin/cp
-  '';
-
-  postConfigure = ''
-    cd go/src/github.com/sylabs/singularity
-
-    patchShebangs .
-    sed -i 's|defaultPath := "[^"]*"|defaultPath := "${lib.makeBinPath propagatedBuildInputs}"|' cmd/internal/cli/actions.go
-
-    ./mconfig -V ${version} -p $out --localstatedir=/var
-
-    # Don't install SUID binaries
-    sed -i 's/-m 4755/-m 755/g' builddir/Makefile
-  '';
-
-  buildPhase = ''
-    runHook preBuild
-    make -C builddir
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-    make -C builddir install LOCALSTATEDIR=$out/var
-    chmod 755 $out/libexec/singularity/bin/starter-suid
-
-    # Explicitly configure paths in the config file
-    sed -i 's|^# mksquashfs path =.*$|mksquashfs path = ${lib.makeBinPath [squashfsTools]}/mksquashfs|' $out/etc/singularity/singularity.conf
-    sed -i 's|^# cryptsetup path =.*$|cryptsetup path = ${lib.makeBinPath [cryptsetup]}/cryptsetup|' $out/etc/singularity/singularity.conf
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    homepage = "http://www.sylabs.io/";
-    description = "Application containers for linux";
-    license = licenses.bsd3;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.jbedo ];
-  };
-}
diff --git a/pkgs/applications/virtualization/singularity/generic.nix b/pkgs/applications/virtualization/singularity/generic.nix
new file mode 100644
index 000000000000..6910674b93e1
--- /dev/null
+++ b/pkgs/applications/virtualization/singularity/generic.nix
@@ -0,0 +1,222 @@
+# Configurations that should only be overrided by
+# overrideAttrs
+{ pname
+, version
+, src
+, projectName # "apptainer" or "singularity"
+, vendorHash ? null
+, deleteVendor ? false
+, proxyVendor ? false
+, extraConfigureFlags ? [ ]
+, extraDescription ? ""
+, extraMeta ? { }
+}:
+
+let
+  # Workaround for vendor-related attributes not overridable (#86349)
+  # should be removed when the issue is resolved
+  _defaultGoVendorArgs = {
+    inherit
+      vendorHash
+      deleteVendor
+      proxyVendor
+      ;
+  };
+in
+{ lib
+, buildGoModule
+  # Native build inputs
+, makeWrapper
+, pkg-config
+, util-linux
+, which
+  # Build inputs
+, bash
+, conmon
+, coreutils
+, cryptsetup
+, fakeroot
+, go
+, gpgme
+, libseccomp
+, libuuid
+  # This is for nvidia-container-cli
+, nvidia-docker
+, openssl
+, squashfsTools
+, squashfuse
+  # Overridable configurations
+, enableNvidiaContainerCli ? true
+  # Compile with seccomp support
+  # SingularityCE 3.10.0 and above requires explicit --without-seccomp when libseccomp is not available.
+, enableSeccomp ? true
+  # Whether the configure script treat SUID support as default
+, defaultToSuid ? true
+  # Whether to compile with SUID support
+, enableSuid ? false
+, starterSuidPath ? null
+  # Remove the symlinks to `singularity*` when projectName != "singularity"
+, removeCompat ? false
+  # Workaround #86349
+  # should be removed when the issue is resolved
+, vendorHash ? _defaultGoVendorArgs.vendorHash
+, deleteVendor ? _defaultGoVendorArgs.deleteVendor
+, proxyVendor ? _defaultGoVendorArgs.proxyVendor
+}:
+
+let
+  defaultPathOriginal = "/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin:/usr/local/sbin";
+in
+buildGoModule {
+  inherit pname version src;
+
+  # Override vendorHash with the output got from
+  # nix-prefetch -E "{ sha256 }: ((import ./. { }).apptainer.override { vendorHash = sha256; }).go-modules"
+  # or with `null` when using vendored source tarball.
+  inherit vendorHash deleteVendor proxyVendor;
+
+  # go is used to compile extensions when building container images
+  allowGoReference = true;
+
+  strictDeps = true;
+
+  passthru = {
+    inherit
+      enableSeccomp
+      enableSuid
+      projectName
+      removeCompat
+      starterSuidPath
+      ;
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    pkg-config
+    util-linux
+    which
+  ];
+
+  buildInputs = [
+    bash # To patch /bin/sh shebangs.
+    conmon
+    cryptsetup
+    gpgme
+    libuuid
+    openssl
+    squashfsTools
+    squashfuse
+  ]
+  ++ lib.optional enableNvidiaContainerCli nvidia-docker
+  ++ lib.optional enableSeccomp libseccomp
+  ;
+
+  configureScript = "./mconfig";
+
+  configureFlags = [
+    "--localstatedir=/var/lib"
+    "--runstatedir=/var/run"
+  ]
+  ++ lib.optional (!enableSeccomp) "--without-seccomp"
+  ++ lib.optional (defaultToSuid && !enableSuid) "--without-suid"
+  ++ lib.optional (!defaultToSuid && enableSuid) "--with-suid"
+  ++ extraConfigureFlags
+  ;
+
+  # Packages to prefix to the Apptainer/Singularity container runtime default PATH
+  # Use overrideAttrs to override
+  defaultPathInputs = [
+    bash
+    coreutils
+    cryptsetup # cryptsetup
+    go
+    squashfsTools # mksquashfs unsquashfs # Make / unpack squashfs image
+    squashfuse # squashfuse_ll squashfuse # Mount (without unpacking) a squashfs image without privileges
+  ]
+  ++ lib.optional enableNvidiaContainerCli nvidia-docker
+  ;
+
+  postPatch = ''
+    if [[ ! -e .git || ! -e VERSION ]]; then
+      echo "${version}" > VERSION
+    fi
+    # Patch shebangs for script run during build
+    patchShebangs --build "$configureScript" makeit e2e scripts mlocal/scripts
+    # Patching the hard-coded defaultPath by prefixing the packages in defaultPathInputs
+    substituteInPlace cmd/internal/cli/actions.go \
+      --replace "defaultPath = \"${defaultPathOriginal}\"" "defaultPath = \"''${defaultPathInputs// /\/bin:}''${defaultPathInputs:+/bin:}${defaultPathOriginal}\""
+  '';
+
+  postConfigure = ''
+    # Code borrowed from pkgs/stdenv/generic/setup.sh configurePhase()
+
+    # set to empty if unset
+    : ''${configureFlags=}
+
+    # shellcheck disable=SC2086
+    $configureScript -V ${version} "''${prefixKey:---prefix=}$prefix" $configureFlags "''${configureFlagsArray[@]}"
+
+    # End of the code from pkgs/stdenv/generic/setup.sh configurPhase()
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    make -C builddir -j"$NIX_BUILD_CORES"
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    make -C builddir install LOCALSTATEDIR="$out/var/lib"
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    substituteInPlace "$out/bin/run-singularity" \
+      --replace "/usr/bin/env ${projectName}" "$out/bin/${projectName}"
+    wrapProgram "$out/bin/${projectName}" \
+      --prefix PATH : "${lib.makeBinPath [
+        fakeroot
+        squashfsTools # Singularity (but not Apptainer) expects unsquashfs from the host PATH
+      ]}"
+    # Make changes in the config file
+    ${lib.optionalString enableNvidiaContainerCli ''
+      substituteInPlace "$out/etc/${projectName}/${projectName}.conf" \
+        --replace "use nvidia-container-cli = no" "use nvidia-container-cli = yes"
+    ''}
+    ${lib.optionalString (removeCompat && (projectName != "singularity")) ''
+      unlink "$out/bin/singularity"
+      for file in "$out"/share/man/man?/singularity*.gz; do
+        if [[ -L "$file" ]]; then
+          unlink "$file"
+        fi
+      done
+      for file in "$out"/share/*-completion/completions/singularity; do
+        if [[ -e "$file" ]]
+        rm "$file"
+      done
+    ''}
+    ${lib.optionalString enableSuid (lib.warnIf (isNull starterSuidPath) "${projectName}: Null starterSuidPath when enableSuid produces non-SUID-ed starter-suid and run-time permission denial." ''
+      chmod +x $out/libexec/${projectName}/bin/starter-suid
+    '')}
+    ${lib.optionalString (enableSuid && !isNull starterSuidPath) ''
+      mv "$out"/libexec/${projectName}/bin/starter-suid{,.orig}
+      ln -s ${lib.escapeShellArg starterSuidPath} "$out/libexec/${projectName}/bin/starter-suid"
+    ''}
+  '';
+
+  meta = with lib; {
+    description = "Application containers for linux" + extraDescription;
+    longDescription = ''
+      Singularity (the upstream) renamed themselves to Apptainer
+      to distinguish themselves from a fork made by Sylabs Inc.. See
+
+      https://sylabs.io/2021/05/singularity-community-edition
+      https://apptainer.org/news/community-announcement-20211130
+    '';
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ jbedo ShamrockLee ];
+    mainProgram = projectName;
+  } // extraMeta;
+}
diff --git a/pkgs/applications/virtualization/singularity/packages.nix b/pkgs/applications/virtualization/singularity/packages.nix
new file mode 100644
index 000000000000..c0f0d79d43f7
--- /dev/null
+++ b/pkgs/applications/virtualization/singularity/packages.nix
@@ -0,0 +1,70 @@
+{ callPackage
+, fetchFromGitHub
+, conmon
+}:
+
+{
+  apptainer = callPackage
+    (import ./generic.nix rec {
+      pname = "apptainer";
+      # TODO: Upgrade to 1.1.4 only after https://github.com/apptainer/apptainer/pull/967 get merge
+      # and https://github.com/apptainer/apptainer/issues/958 get fixed
+      version = "1.1.3";
+      projectName = "apptainer";
+
+      src = fetchFromGitHub {
+        owner = "apptainer";
+        repo = "apptainer";
+        rev = "v${version}";
+        hash = "sha256-QFg6RC77OE/a6Qlzn6Zi5I7Iaq/U3/m0eI9yLArzuNc=";
+      };
+
+      # Update by running
+      # nix-prefetch -E "{ sha256 }: ((import ./. { }).apptainer.override { vendorHash = sha256; }).go-modules"
+      # at the root directory of the Nixpkgs repository
+      vendorHash = "sha256-tAnh7A8Lw5KtY7hq+sqHMEUlgXvgeeCKKIfRZFoRtug=";
+
+      extraDescription = " (previously known as Singularity)";
+      extraMeta.homepage = "https://apptainer.org";
+    })
+    {
+      # Apptainer doesn't depend on conmon
+      conmon = null;
+
+      # defaultToSuid becomes false since Apptainer 1.1.0
+      # https://github.com/apptainer/apptainer/pull/495
+      # https://github.com/apptainer/apptainer/releases/tag/v1.1.0
+      defaultToSuid = false;
+    };
+
+  singularity = callPackage
+    (import ./generic.nix rec {
+      pname = "singularity-ce";
+      version = "3.10.4";
+      projectName = "singularity";
+
+      src = fetchFromGitHub {
+        owner = "sylabs";
+        repo = "singularity";
+        rev = "v${version}";
+        hash = "sha256-bUnQXQVwaVA3Lkw3X9TBWqNBgiPxAVCHnkq0vc+CIsM=";
+      };
+
+      # Update by running
+      # nix-prefetch -E "{ sha256 }: ((import ./. { }).singularity.override { vendorHash = sha256; }).go-modules"
+      # at the root directory of the Nixpkgs repository
+      vendorHash = "sha256-K8helLcOuz3E4LzBE9y3pnZqwdwhO/iMPTN1o22ipVg=";
+
+      # Do not build conmon from the Git submodule source,
+      # Use Nixpkgs provided version
+      extraConfigureFlags = [
+        "--without-conmon"
+      ];
+
+      extraDescription = " (Sylabs Inc's fork of Singularity, a.k.a. SingularityCE)";
+      extraMeta.homepage = "https://sylabs.io/";
+    })
+    {
+      defaultToSuid = true;
+    };
+}
diff --git a/pkgs/build-support/singularity-tools/default.nix b/pkgs/build-support/singularity-tools/default.nix
index bf542e307008..9689e4124590 100644
--- a/pkgs/build-support/singularity-tools/default.nix
+++ b/pkgs/build-support/singularity-tools/default.nix
@@ -23,9 +23,10 @@ rec {
   mkLayer =
     { name
     , contents ? [ ]
-    ,
+      # May be "apptainer" instead of "singularity"
+    , projectName ? (singularity.projectName or "singularity")
     }:
-    runCommand "singularity-layer-${name}"
+    runCommand "${projectName}-layer-${name}"
       {
         inherit contents;
       } ''
@@ -36,28 +37,34 @@ rec {
     '';
 
   buildImage =
+    let
+      defaultSingularity = singularity;
+    in
     { name
     , contents ? [ ]
     , diskSize ? 1024
     , runScript ? "#!${stdenv.shell}\nexec /bin/sh"
     , runAsRoot ? null
     , memSize ? 512
+    , singularity ? defaultSingularity
     }:
     let
+      projectName = singularity.projectName or "singularity";
       layer = mkLayer {
         inherit name;
         contents = contents ++ [ bash runScriptFile ];
+        inherit projectName;
       };
       runAsRootFile = shellScript "run-as-root.sh" runAsRoot;
       runScriptFile = shellScript "run-script.sh" runScript;
       result = vmTools.runInLinuxVM (
-        runCommand "singularity-image-${name}.img"
+        runCommand "${projectName}-image-${name}.img"
           {
             buildInputs = [ singularity e2fsprogs util-linux gawk ];
             layerClosure = writeReferencesToFile layer;
             preVM = vmTools.createEmptyImage {
               size = diskSize;
-              fullName = "singularity-run-disk";
+              fullName = "${projectName}-run-disk";
             };
             inherit memSize;
           }
@@ -96,18 +103,18 @@ rec {
             if [ ! -e bin/sh ]; then
               ln -s ${runtimeShell} bin/sh
             fi
-            mkdir -p .singularity.d
-            ln -s ${runScriptFile} .singularity.d/runscript
+            mkdir -p .${projectName}.d
+            ln -s ${runScriptFile} .${projectName}.d/runscript
 
-            # Fill out .singularity.d
-            mkdir -p .singularity.d/env
-            touch .singularity.d/env/94-appsbase.sh
+            # Fill out .${projectName}.d
+            mkdir -p .${projectName}.d/env
+            touch .${projectName}.d/env/94-appsbase.sh
 
             cd ..
-            mkdir -p /var/singularity/mnt/{container,final,overlay,session,source}
+            mkdir -p /var/lib/${projectName}/mnt/{container,final,overlay,session,source}
             echo "root:x:0:0:System administrator:/root:/bin/sh" > /etc/passwd
             echo > /etc/resolv.conf
-            TMPDIR=$(pwd -P) singularity build $out ./img
+            TMPDIR=$(pwd -P) ${projectName} build $out ./img
           '');
 
     in
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d4895b725213..d0aa674ac8f5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -30196,7 +30196,9 @@ with pkgs;
 
   shepherd = nodePackages."@nerdwallet/shepherd";
 
-  singularity = callPackage ../applications/virtualization/singularity { };
+  inherit (callPackage ../applications/virtualization/singularity/packages.nix { })
+    apptainer
+    singularity;
 
   skate = callPackage ../applications/misc/skate { };
 

From 71a89291ee0643b23b87aba090c885324d30bc45 Mon Sep 17 00:00:00 2001
From: Yueh-Shun Li <44064051+ShamrockLee@users.noreply.github.com>
Date: Sun, 29 Jan 2023 01:02:48 +0800
Subject: [PATCH 115/176] apptainer, singularity: enable non-FHS --fakeroot
 support

This patch provides input arguments `newuidmapPath` and `newgidmapPath`
for apptainer and singularity to specify the path to the SUID-ed executables
newuidmap and newgidmap where they are not available from the FHS PATH.

As NixOS places those suided executables in a non-FHS position
(/run/wrapper/bin), this patch provides
programs.singularity.enableFakeroot option and implement with the above
input parameters.
---
 .../from_md/release-notes/rl-2305.section.xml      | 10 ++++++++++
 nixos/doc/manual/release-notes/rl-2305.section.md  |  2 ++
 nixos/modules/programs/singularity.nix             | 13 ++++++++++++-
 .../virtualization/singularity/generic.nix         | 14 ++++++++++++++
 4 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
index 3c240585b987..6936fdd2605f 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
@@ -958,6 +958,16 @@
           package to use.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The new option
+          <literal>programs.singularity.enableFakeroot</literal>, if set
+          to <literal>true</literal>, provides
+          <literal>--fakeroot</literal> support for
+          <literal>apptainer</literal> and
+          <literal>singularity</literal>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           The <literal>unifi-poller</literal> package and corresponding
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 81a029bf891b..b7614c0788cf 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -235,6 +235,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
   `singularity-tools.buildImage` got a new input argument `singularity` to specify which package to use.
 
+- The new option `programs.singularity.enableFakeroot`, if set to `true`, provides `--fakeroot` support for `apptainer` and `singularity`.
+
 - The `unifi-poller` package and corresponding NixOS module have been renamed to `unpoller` to match upstream.
 
 - The new option `services.tailscale.useRoutingFeatures` controls various settings for using Tailscale features like exit nodes and subnet routers. If you wish to use your machine as an exit node, you can set this setting to `server`, otherwise if you wish to use an exit node you can set this setting to `client`. The strict RPF warning has been removed as the RPF will be loosened automatically based on the value of this setting.
diff --git a/nixos/modules/programs/singularity.nix b/nixos/modules/programs/singularity.nix
index 097c7a7f842b..4884e5bdf2dd 100644
--- a/nixos/modules/programs/singularity.nix
+++ b/nixos/modules/programs/singularity.nix
@@ -45,6 +45,14 @@ in
         Use `lib.mkForce` to forcefully specify the overriden package.
       '';
     };
+    enableFakeroot = mkOption {
+      type = types.bool;
+      default = true;
+      example = false;
+      description = mdDoc ''
+        Whether to enable the `--fakeroot` support of Singularity/Apptainer.
+      '';
+    };
     enableSuid = mkOption {
       type = types.bool;
       default = true;
@@ -57,7 +65,10 @@ in
 
   config = mkIf cfg.enable {
     programs.singularity.packageOverriden = (cfg.package.override (
-      optionalAttrs cfg.enableSuid {
+      optionalAttrs cfg.enableFakeroot {
+        newuidmapPath = "/run/wrappers/bin/newuidmap";
+        newgidmapPath = "/run/wrappers/bin/newgidmap";
+      } // optionalAttrs cfg.enableSuid {
         enableSuid = true;
         starterSuidPath = "/run/wrappers/bin/${cfg.package.projectName}-suid";
       }
diff --git a/pkgs/applications/virtualization/singularity/generic.nix b/pkgs/applications/virtualization/singularity/generic.nix
index 6910674b93e1..562781b09a31 100644
--- a/pkgs/applications/virtualization/singularity/generic.nix
+++ b/pkgs/applications/virtualization/singularity/generic.nix
@@ -25,6 +25,7 @@ let
 in
 { lib
 , buildGoModule
+, runCommandLocal
   # Native build inputs
 , makeWrapper
 , pkg-config
@@ -55,6 +56,12 @@ in
   # Whether to compile with SUID support
 , enableSuid ? false
 , starterSuidPath ? null
+  # newuidmapPath and newgidmapPath are to support --fakeroot
+  # where those SUID-ed executables are unavailable from the FHS system PATH.
+  # Path to SUID-ed newuidmap executable
+, newuidmapPath ? null
+  # Path to SUID-ed newgidmap executable
+, newgidmapPath ? null
   # Remove the symlinks to `singularity*` when projectName != "singularity"
 , removeCompat ? false
   # Workaround #86349
@@ -66,6 +73,12 @@ in
 
 let
   defaultPathOriginal = "/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin:/usr/local/sbin";
+  privileged-un-utils = if ((isNull newuidmapPath) && (isNull newgidmapPath)) then null else
+  (runCommandLocal "privileged-un-utils" { } ''
+    mkdir -p "$out/bin"
+    ln -s ${lib.escapeShellArg newuidmapPath} "$out/bin/newuidmap"
+    ln -s ${lib.escapeShellArg newgidmapPath} "$out/bin/newgidmap"
+  '');
 in
 buildGoModule {
   inherit pname version src;
@@ -130,6 +143,7 @@ buildGoModule {
     coreutils
     cryptsetup # cryptsetup
     go
+    privileged-un-utils
     squashfsTools # mksquashfs unsquashfs # Make / unpack squashfs image
     squashfuse # squashfuse_ll squashfuse # Mount (without unpacking) a squashfs image without privileges
   ]

From d35f5c2695ee27e69229b870e74b7fb0c5e976e8 Mon Sep 17 00:00:00 2001
From: Yueh-Shun Li <44064051+ShamrockLee@users.noreply.github.com>
Date: Sun, 29 Jan 2023 01:02:48 +0800
Subject: [PATCH 116/176] 
 apptainer-overriden-nixos,singularity-overriden-nixos: init

---
 .../virtualization/singularity/packages.nix   | 28 +++++++++++++++++--
 pkgs/top-level/all-packages.nix               |  5 +++-
 2 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/virtualization/singularity/packages.nix b/pkgs/applications/virtualization/singularity/packages.nix
index c0f0d79d43f7..06c8c4fcc0da 100644
--- a/pkgs/applications/virtualization/singularity/packages.nix
+++ b/pkgs/applications/virtualization/singularity/packages.nix
@@ -1,9 +1,9 @@
 { callPackage
 , fetchFromGitHub
+, nixos
 , conmon
 }:
-
-{
+let
   apptainer = callPackage
     (import ./generic.nix rec {
       pname = "apptainer";
@@ -67,4 +67,28 @@
     {
       defaultToSuid = true;
     };
+
+  genOverridenNixos = package: packageName: (nixos {
+    programs.singularity = {
+      enable = true;
+      inherit package;
+    };
+  }).config.programs.singularity.packageOverriden.overrideAttrs (oldAttrs: {
+    meta = oldAttrs.meta // {
+      description = "";
+      longDescription = ''
+        This package produces identical store derivations to `pkgs.${packageName}`
+        overriden and installed by the NixOS module `programs.singularity`
+        with default configuration.
+
+        This is for binary substitutes only. Use pkgs.${packageName} instead.
+      '';
+    };
+  });
+in
+{
+  inherit apptainer singularity;
+
+  apptainer-overriden-nixos = genOverridenNixos apptainer "apptainer";
+  singularity-overriden-nixos = genOverridenNixos singularity "singularity";
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d0aa674ac8f5..c599f7f51059 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -30198,7 +30198,10 @@ with pkgs;
 
   inherit (callPackage ../applications/virtualization/singularity/packages.nix { })
     apptainer
-    singularity;
+    singularity
+    apptainer-overriden-nixos
+    singularity-overriden-nixos
+    ;
 
   skate = callPackage ../applications/misc/skate { };
 

From 09d1372cb900186ac865132b1ac6f0125c4026fd Mon Sep 17 00:00:00 2001
From: Phillip Seeber <phillip.seeber@uni-jena.de>
Date: Mon, 6 Feb 2023 17:10:55 +0100
Subject: [PATCH 117/176] harminv: init at 1.4.2

---
 .../science/chemistry/harminv/default.nix     | 42 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 44 insertions(+)
 create mode 100644 pkgs/development/libraries/science/chemistry/harminv/default.nix

diff --git a/pkgs/development/libraries/science/chemistry/harminv/default.nix b/pkgs/development/libraries/science/chemistry/harminv/default.nix
new file mode 100644
index 000000000000..54c0d03979ab
--- /dev/null
+++ b/pkgs/development/libraries/science/chemistry/harminv/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, gfortran
+, blas
+, lapack
+}:
+
+assert !blas.isILP64;
+assert !lapack.isILP64;
+
+stdenv.mkDerivation rec {
+  pname = "harminv";
+  version = "1.4.2";
+
+  src = fetchFromGitHub {
+    owner = "NanoComp";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-EXEt7l69etcBdDdEDlD1ODOdhTBZCVjgY1jhRUDd/W0=";
+  };
+
+  # File is missing in the git checkout but required by autotools
+  postPatch = ''
+    touch ChangeLog
+  '';
+
+  nativeBuildInputs = [ autoreconfHook gfortran ];
+
+  buildInputs = [ blas lapack ];
+
+  configureFlags = [ "--enable-shared" ];
+
+  meta = with lib; {
+    description = "Harmonic inversion algorithm of Mandelshtam: decompose signal into sum of decaying sinusoids";
+    homepage = "https://github.com/NanoComp/harminv";
+    license = with licenses; [ gpl2Only ];
+    maintainers = with maintainers; [ sheepforce markuskowa ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3a2404b7e402..226314f9f199 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7899,6 +7899,8 @@ with pkgs;
 
   gyb = callPackage ../tools/backup/gyb { };
 
+  harminv = callPackage ../development/libraries/science/chemistry/harminv { };
+
   igrep = callPackage ../tools/text/igrep {
     inherit (darwin.apple_sdk.frameworks) Security;
   };

From 4c45a5f874b50df05ae812afea91e0c7311c5b85 Mon Sep 17 00:00:00 2001
From: Phillip Seeber <phillip.seeber@uni-jena.de>
Date: Mon, 6 Feb 2023 13:29:29 +0100
Subject: [PATCH 118/176] libGDSII: init at 0.21

---
 .../science/chemistry/libGDSII/default.nix    | 32 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 ++
 2 files changed, 34 insertions(+)
 create mode 100644 pkgs/development/libraries/science/chemistry/libGDSII/default.nix

diff --git a/pkgs/development/libraries/science/chemistry/libGDSII/default.nix b/pkgs/development/libraries/science/chemistry/libGDSII/default.nix
new file mode 100644
index 000000000000..c3257bad3e26
--- /dev/null
+++ b/pkgs/development/libraries/science/chemistry/libGDSII/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libGDSII";
+  version = "0.21";
+
+  src = fetchFromGitHub {
+    owner = "HomerReid";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-EXEt7l69etcBdDdEDlD1ODOdhTBZCVjgY1jhRUDd/W0=";
+  };
+
+  # File is missing in the repo but automake requires it
+  postPatch = ''
+    touch ChangeLog
+  '';
+
+  nativeBuildInputs = [ autoreconfHook ];
+
+  meta = with lib; {
+    description = "Library and command-line utility for reading GDSII geometry files";
+    homepage = "https://github.com/HomerReid/libGDSII";
+    license = [ licenses.gpl2Only ];
+    maintainers = with maintainers; [ sheepforce markuskowa ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 226314f9f199..af044d10f32b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -27322,6 +27322,8 @@ with pkgs;
 
   ledger-udev-rules = callPackage ../os-specific/linux/ledger-udev-rules {};
 
+  libGDSII = callPackage ../development/libraries/science/chemistry/libGDSII { };
+
   inherit (callPackages ../data/fonts/liberation-fonts { })
     liberation_ttf_v1
     liberation_ttf_v2

From bd09beae9e9ce65b61fd445c976316ef1df3017a Mon Sep 17 00:00:00 2001
From: Phillip Seeber <phillip.seeber@uni-jena.de>
Date: Wed, 8 Feb 2023 11:28:15 +0100
Subject: [PATCH 119/176] meep: init at 1.25.0

meep: more comments
---
 .../python-modules/meep/default.nix           | 151 ++++++++++++++++++
 pkgs/top-level/python-packages.nix            |   2 +
 2 files changed, 153 insertions(+)
 create mode 100644 pkgs/development/python-modules/meep/default.nix

diff --git a/pkgs/development/python-modules/meep/default.nix b/pkgs/development/python-modules/meep/default.nix
new file mode 100644
index 000000000000..021121a44ac2
--- /dev/null
+++ b/pkgs/development/python-modules/meep/default.nix
@@ -0,0 +1,151 @@
+{ stdenv
+, lib
+, buildPythonPackage
+, fetchFromGitHub
+, autoreconfHook
+, pkg-config
+, gfortran
+, mpi
+, blas
+, lapack
+, fftw
+, hdf5-mpi
+, swig
+, gsl
+, harminv
+, libctl
+, libGDSII
+, openssh
+, guile
+, python
+, numpy
+, scipy
+, matplotlib
+, h5py-mpi
+, cython
+, autograd
+, mpi4py
+}:
+
+assert !blas.isILP64;
+assert !lapack.isILP64;
+
+buildPythonPackage rec {
+  pname = "meep";
+  version = "1.25.0";
+
+  src = fetchFromGitHub {
+    owner = "NanoComp";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-4rIz2RXLSWzZbRuv8d4nidOa0ULYc4QHIdaYrGu1WkI=";
+  };
+
+  format = "other";
+
+  # MPI is needed in nativeBuildInputs too, otherwise MPI libs will be missing
+  # at runtime
+  nativeBuildInputs = [
+    autoreconfHook
+    gfortran
+    pkg-config
+    swig
+    mpi
+  ];
+
+  buildInputs = [
+    gsl
+    blas
+    lapack
+    fftw
+    hdf5-mpi
+    harminv
+    libctl
+    libGDSII
+    guile
+    gsl
+  ];
+
+  propagatedBuildInputs = [
+    mpi
+    numpy
+    scipy
+    matplotlib
+    h5py-mpi
+    cython
+    autograd
+    mpi4py
+  ];
+
+  propagatedUserEnvPkgs = [ mpi ];
+
+  dontUseSetuptoolsBuild = true;
+  dontUsePipInstall = true;
+  dontUseSetuptoolsCheck = true;
+
+  enableParallelBuilding = true;
+
+  preConfigure = ''
+    export HDF5_MPI=ON
+    export PYTHON=${python}/bin/${python.executable};
+  '';
+
+  configureFlags = [
+    "--without-libctl"
+    "--enable-shared"
+    "--with-mpi"
+    "--with-openmp"
+    "--enable-maintainer-mode"
+  ];
+
+  passthru = { inherit mpi; };
+
+  /*
+  This test is taken from the MEEP tutorial "Fields in a Waveguide" at
+  <https://meep.readthedocs.io/en/latest/Python_Tutorials/Basics/>.
+  It is important, that the test actually performs a calculation
+  (calls `sim.run()`), as only then MPI will be initialised and MPI linking
+  errors can be caught.
+  */
+  doCheck = true;
+  checkPhase = ''
+    export PATH=$PATH:${openssh}/bin
+    export PYTHONPATH="$out/lib/${python.libPrefix}/site-packages:$PYTHONPATH"
+
+    export OMP_NUM_THREADS=1
+
+    # Fix to make mpich run in a sandbox
+    export HYDRA_IFACE=lo
+    export OMPI_MCA_rmaps_base_oversubscribe=1
+
+    # Generate a python test script
+    cat > test.py << EOF
+    import meep as mp
+    cell = mp.Vector3(16,8,0)
+    geometry = [mp.Block(mp.Vector3(mp.inf,1,mp.inf),
+                     center=mp.Vector3(),
+                     material=mp.Medium(epsilon=12))]
+    sources = [mp.Source(mp.ContinuousSource(frequency=0.15),
+                     component=mp.Ez,
+                     center=mp.Vector3(-7,0))]
+    pml_layers = [mp.PML(1.0)]
+    resolution = 10
+    sim = mp.Simulation(cell_size=cell,
+                    boundary_layers=pml_layers,
+                    geometry=geometry,
+                    sources=sources,
+                    resolution=resolution)
+    sim.run(until=200)
+    EOF
+
+    ${mpi}/bin/mpiexec -np 2 python3 test.py
+  '';
+
+  meta = with lib; {
+    description = "Free finite-difference time-domain (FDTD) software for electromagnetic simulations";
+    homepage = "https://meep.readthedocs.io/en/latest/";
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ sheepforce markuskowa ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 988f7e71981c..79fd78f9d70b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5804,6 +5804,8 @@ self: super: with self; {
 
   mediapy = callPackage ../development/python-modules/mediapy { };
 
+  meep = callPackage ../development/python-modules/meep { };
+
   meilisearch = callPackage ../development/python-modules/meilisearch { };
 
   meinheld = callPackage ../development/python-modules/meinheld { };

From ee0eef3c84967939a3a9d9bc9fd2d2a81976b938 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 11:37:52 +0000
Subject: [PATCH 120/176] quickemu: 4.5 -> 4.6

---
 pkgs/development/quickemu/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/quickemu/default.nix b/pkgs/development/quickemu/default.nix
index d5b56f585eca..25cb3b4d7eb8 100644
--- a/pkgs/development/quickemu/default.nix
+++ b/pkgs/development/quickemu/default.nix
@@ -50,13 +50,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "quickemu";
-  version = "4.5";
+  version = "4.6";
 
   src = fetchFromGitHub {
     owner = "quickemu-project";
     repo = "quickemu";
     rev = version;
-    hash = "sha256-31f4BIIYCh2acbueUtGZShKnlhctd1FfKkFqsNiUqrI=";
+    hash = "sha256-C/3zyHnxAxCu8rrR4Znka47pVPp0vvaVGyd4TVQG3qg=";
   };
 
   postPatch = ''

From 4db65d131e0d54105bf66475ca584362e5f2104b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 11:47:14 +0000
Subject: [PATCH 121/176] fend: 1.1.4 -> 1.1.5

---
 pkgs/tools/misc/fend/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/misc/fend/default.nix b/pkgs/tools/misc/fend/default.nix
index 18ffdb71cde4..6d96c33e5eef 100644
--- a/pkgs/tools/misc/fend/default.nix
+++ b/pkgs/tools/misc/fend/default.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fend";
-  version = "1.1.4";
+  version = "1.1.5";
 
   src = fetchFromGitHub {
     owner = "printfn";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-jg2rMiFXtN3oLru1gTaTyIo5eBEI23paKJiDV6KZZE4=";
+    sha256 = "sha256-9qvIxKg/fj08wYY2fK5J1nWzojStUb9ArXwvA/cTOcQ=";
   };
 
-  cargoHash = "sha256-9Gri/EBaUiCpFBL0f132JDD4Zl5v40e8JmlRvm019S4=";
+  cargoHash = "sha256-kVnA8w2YVg6+h1V1O4cvciuB7GM4/LULFsGrzy8xUMQ=";
 
   nativeBuildInputs = [ pandoc installShellFiles ];
   buildInputs = lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];

From 3c178e21d78fe8053e88c78b11d5147fb4ea1a56 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 11:51:18 +0000
Subject: [PATCH 122/176] hyperrogue: 12.1h -> 12.1i

---
 pkgs/games/hyperrogue/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/games/hyperrogue/default.nix b/pkgs/games/hyperrogue/default.nix
index f8f0d55fb9c3..1eabfe77a7ae 100644
--- a/pkgs/games/hyperrogue/default.nix
+++ b/pkgs/games/hyperrogue/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hyperrogue";
-  version = "12.1h";
+  version = "12.1i";
 
   src = fetchFromGitHub {
     owner = "zenorogue";
     repo = "hyperrogue";
     rev = "v${version}";
-    sha256 = "sha256-9ChPO0YCsrAyQ81TAbKCMJSgSXoUtkvvNPMTPimPBUo=";
+    sha256 = "sha256-TMPumyTEzDbV/31UgwXJwr7zt7ufENX3ESxlcBEnaSc=";
   };
 
   CXXFLAGS = [

From 84d8894b2b9de245ffa3f14fafb935cbe6c755de Mon Sep 17 00:00:00 2001
From: Anthony Roussel <anthony@roussel.dev>
Date: Wed, 8 Feb 2023 13:33:29 +0100
Subject: [PATCH 123/176] yubico-piv-tool: 2.3.0 -> 2.3.1

---
 pkgs/tools/misc/yubico-piv-tool/default.nix | 31 +++++++++++++++++++--
 1 file changed, 28 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/misc/yubico-piv-tool/default.nix b/pkgs/tools/misc/yubico-piv-tool/default.nix
index 60fc7c2ac709..a8a7dfd3ee68 100644
--- a/pkgs/tools/misc/yubico-piv-tool/default.nix
+++ b/pkgs/tools/misc/yubico-piv-tool/default.nix
@@ -1,14 +1,26 @@
-{ lib, stdenv, fetchurl, pkg-config, openssl, check, pcsclite, PCSC, gengetopt, cmake
+{ lib
+, stdenv
+, fetchurl
+, pkg-config
+, openssl
+, check
+, pcsclite
+, PCSC
+, gengetopt
+, cmake
 , withApplePCSC ? stdenv.isDarwin
+, gitUpdater
+, testers
+, yubico-piv-tool
 }:
 
 stdenv.mkDerivation rec {
   pname = "yubico-piv-tool";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchurl {
     url = "https://developers.yubico.com/yubico-piv-tool/Releases/yubico-piv-tool-${version}.tar.gz";
-    hash = "sha256-oCoS2VRdHvehuZhgbYm3tlWl9aFDdzbPUdsIP4dvVak=";
+    hash = "sha256-2ona/YthhapjU0Z1P53bKa8pvEq9kt2B832dZWC11k4=";
   };
 
   postPatch = ''
@@ -29,8 +41,21 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--with-backend=${if withApplePCSC then "macscard" else "pcsc"}" ];
 
+  passthru = {
+    updateScript = gitUpdater {
+      url = "https://github.com/Yubico/yubico-piv-tool.git";
+      rev-prefix = "yubico-piv-tool-";
+    };
+    tests.version = testers.testVersion {
+      inherit version;
+      package = yubico-piv-tool;
+      command = "yubico-piv-tool --version";
+    };
+  };
+
   meta = with lib; {
     homepage = "https://developers.yubico.com/yubico-piv-tool/";
+    changelog = "https://developers.yubico.com/yubico-piv-tool/Release_Notes.html";
     description = ''
       Used for interacting with the Privilege and Identification Card (PIV)
       application on a YubiKey

From 9347d7d26588710d7c8277cb97bf394b67d7f7b2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 12:49:16 +0000
Subject: [PATCH 124/176] polymake: 4.8 -> 4.9

---
 pkgs/applications/science/math/polymake/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/science/math/polymake/default.nix b/pkgs/applications/science/math/polymake/default.nix
index 0eecff0a1798..4dc11db532fd 100644
--- a/pkgs/applications/science/math/polymake/default.nix
+++ b/pkgs/applications/science/math/polymake/default.nix
@@ -25,13 +25,13 @@
 
 stdenv.mkDerivation rec {
   pname = "polymake";
-  version = "4.8";
+  version = "4.9";
 
   src = fetchurl {
     # "The minimal version is a packager friendly version which omits
     # the bundled sources of cdd, lrs, libnormaliz, nauty and jReality."
     url = "https://polymake.org/lib/exe/fetch.php/download/polymake-${version}-minimal.tar.bz2";
-    sha256 = "sha256-GfsAypJBpHwpvoEl/IzJ1gQfeMcYwB7oNe01xWJ+86w=";
+    sha256 = "sha256-BMkLgms6JsWmPhi+MZv/Eqie8BKL+KaPtk3xBZSyWfM=";
   };
 
   nativeBuildInputs = [

From b4b4d8db8d43329c23b7f92348683c8ac50c314c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 12:49:53 +0000
Subject: [PATCH 125/176] exploitdb: 2022-11-22 -> 2023-02-03

---
 pkgs/tools/security/exploitdb/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/exploitdb/default.nix b/pkgs/tools/security/exploitdb/default.nix
index 9718f0095d02..a710daca6013 100644
--- a/pkgs/tools/security/exploitdb/default.nix
+++ b/pkgs/tools/security/exploitdb/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2022-11-22";
+  version = "2023-02-03";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-G871FvwekcF5uMq7NRoWuIb9UqzIbMniboKlUzgCaeI=";
+    hash = "sha256-uTyUACY9Pm+gMuLrttGCNZ/UQaOW/h12ysY/noTkw7A=";
   };
 
   nativeBuildInputs = [

From 4d89637b5d8870c62032c5484c0e0552e2a45669 Mon Sep 17 00:00:00 2001
From: Enno Richter <enno@nerdworks.de>
Date: Wed, 8 Feb 2023 13:50:11 +0100
Subject: [PATCH 126/176] python3Packages.watchfiles: fix build on Darwin

---
 pkgs/development/python-modules/watchfiles/default.nix | 8 +++++++-
 pkgs/top-level/python-packages.nix                     | 4 +++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/watchfiles/default.nix b/pkgs/development/python-modules/watchfiles/default.nix
index c31aa264bd84..82060561a8d4 100644
--- a/pkgs/development/python-modules/watchfiles/default.nix
+++ b/pkgs/development/python-modules/watchfiles/default.nix
@@ -11,6 +11,8 @@
 , pytest-timeout
 , pytestCheckHook
 , python
+, CoreServices
+, libiconv
 }:
 
 buildPythonPackage rec {
@@ -33,6 +35,11 @@ buildPythonPackage rec {
     hash = "sha256-IWONA3o+2emJ7cKEw5xYSMdWzGuUSwn1B70zUDzj7Cw=";
   };
 
+  buildInputs = lib.optionals stdenv.isDarwin [
+    CoreServices
+    libiconv
+  ];
+
   nativeBuildInputs = [
   ] ++ (with rustPlatform; [
     cargoSetupHook
@@ -69,6 +76,5 @@ buildPythonPackage rec {
     homepage = "https://watchfiles.helpmanual.io/";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
-    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 988f7e71981c..9c54f9e4a9b8 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -12183,7 +12183,9 @@ self: super: with self; {
     inherit (pkgs.darwin.apple_sdk.frameworks) CoreServices;
   };
 
-  watchfiles = callPackage ../development/python-modules/watchfiles { };
+  watchfiles = callPackage ../development/python-modules/watchfiles {
+    inherit (pkgs.darwin.apple_sdk.frameworks) CoreServices;
+  };
 
   watchgod = callPackage ../development/python-modules/watchgod { };
 

From dbe669d8fb8be4d1a5262a624cd368a6279e93eb Mon Sep 17 00:00:00 2001
From: superherointj <5861043+superherointj@users.noreply.github.com>
Date: Tue, 7 Feb 2023 19:52:22 -0300
Subject: [PATCH 127/176] SDL2_image: 2.0.5 -> 2.6.3

SDL2_image_2_0_5: pinned for pygame, toppler

Fixes #187685

Release: https://github.com/libsdl-org/SDL_image/releases/tag/release-2.6.3
---
 pkgs/development/libraries/SDL2_image/default.nix | 11 ++++++++---
 pkgs/top-level/all-packages.nix                   |  4 ++++
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/SDL2_image/default.nix b/pkgs/development/libraries/SDL2_image/default.nix
index 4ff02ffb7b2e..a8824904aea8 100644
--- a/pkgs/development/libraries/SDL2_image/default.nix
+++ b/pkgs/development/libraries/SDL2_image/default.nix
@@ -1,15 +1,20 @@
 { lib, stdenv, fetchurl
 , pkg-config
 , SDL2, libpng, libjpeg, libtiff, giflib, libwebp, libXpm, zlib, Foundation
+, version ? "2.6.3"
+, hash ? "sha256-kxyb5b8dfI+um33BV4KLfu6HTiPH8ktEun7/a0g2MSw="
 }:
 
-stdenv.mkDerivation rec {
+let
   pname = "SDL2_image";
-  version = "2.0.5";
+in
+
+stdenv.mkDerivation {
+  inherit pname version;
 
   src = fetchurl {
     url = "https://www.libsdl.org/projects/SDL_image/release/${pname}-${version}.tar.gz";
-    sha256 = "1l0864kas9cwpp2d32yxl81g98lx40dhbdp03dz7sbv84vhgdmdx";
+    inherit hash;
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3a2404b7e402..aaad642f6b84 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -23047,6 +23047,10 @@ with pkgs;
   SDL2_image = callPackage ../development/libraries/SDL2_image {
     inherit (darwin.apple_sdk.frameworks) Foundation;
   };
+  SDL2_image_2_0_5 = SDL2_image.override({ # Pinned for pygame, toppler
+    version = "2.0.5";
+    hash = "sha256-vdX24CZoL31+G+C2BRsgnaL0AqLdi9HEvZwlrSYxCNA";
+  });
 
   SDL2_mixer = callPackage ../development/libraries/SDL2_mixer {
     inherit (darwin.apple_sdk.frameworks) CoreServices AudioUnit AudioToolbox;

From 2379d34aa028ea79f0e7ce805669007650b57aa3 Mon Sep 17 00:00:00 2001
From: Markus Kowalewski <markus.kowalewski@fysik.su.se>
Date: Wed, 8 Feb 2023 14:10:27 +0100
Subject: [PATCH 128/176] gromacs: 2022.4 -> 2023

---
 .../science/molecular-dynamics/gromacs/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
index 5093a586a85a..26e6ab12ab04 100644
--- a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
+++ b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
@@ -19,11 +19,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "gromacs";
-  version = "2022.4";
+  version = "2023";
 
   src = fetchurl {
     url = "ftp://ftp.gromacs.org/pub/gromacs/gromacs-${version}.tar.gz";
-    sha256 = "sha256-xRG+YC/ylAIGW1CQaEHe+YdSY5uSqV8bChBg2bXicpc=";
+    sha256 = "sha256-rJLG2nL7vMpBT9io2Xnlbs8XxMHNq+0tpc+05yd7e6g=";
   };
 
   nativeBuildInputs = [ cmake ];

From 655b5be0ceafea054bda74d63a3fdfef6c9d890f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 13:16:07 +0000
Subject: [PATCH 129/176] python310Packages.requests-aws4auth: 1.2.1 -> 1.2.2

---
 pkgs/development/python-modules/requests-aws4auth/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/requests-aws4auth/default.nix b/pkgs/development/python-modules/requests-aws4auth/default.nix
index d67f8f364ea2..b240aa81509c 100644
--- a/pkgs/development/python-modules/requests-aws4auth/default.nix
+++ b/pkgs/development/python-modules/requests-aws4auth/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "requests-aws4auth";
-  version = "1.2.1";
+  version = "1.2.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "tedder";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Dr3i+5xTKLKOMjGkCdKhkK2BCV8/FgTGMtGsYtvB5s8=";
+    hash = "sha256-RbaRFMyvK3y7xN+xwNi/lHJjx+xIlpfizJj9BIn6cT4=";
   };
 
   propagatedBuildInputs = [

From ba0b9791c0f26ac4de79840a431c581bf3c70fc4 Mon Sep 17 00:00:00 2001
From: Markus Kowalewski <markus.kowalewski@fysik.su.se>
Date: Wed, 8 Feb 2023 14:20:19 +0100
Subject: [PATCH 130/176] mvapich: 2.3.6 -> 2.3.7

---
 pkgs/development/libraries/mvapich/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/mvapich/default.nix b/pkgs/development/libraries/mvapich/default.nix
index 0f358c279628..987f4022f511 100644
--- a/pkgs/development/libraries/mvapich/default.nix
+++ b/pkgs/development/libraries/mvapich/default.nix
@@ -14,11 +14,11 @@ assert builtins.elem network [ "ethernet" "infiniband" "omnipath" ];
 
 stdenv.mkDerivation rec {
   pname = "mvapich";
-  version = "2.3.6";
+  version = "2.3.7";
 
   src = fetchurl {
     url = "http://mvapich.cse.ohio-state.edu/download/mvapich/mv2/mvapich2-${version}.tar.gz";
-    sha256 = "0jd28vy9ivl3rcpkxmhw73b6krzm0pd9jps8asw92wa00lm2z9mk";
+    sha256 = "sha256-w5pEkvS+UN9hAHhXSLoolOI85FCpQSgYHVFtpXV3Ua4=";
   };
 
   nativeBuildInputs = [ pkg-config bison makeWrapper gfortran ];

From 9c30624f1a8aee562ebf4b6d62f0948b4c7db5f2 Mon Sep 17 00:00:00 2001
From: superherointj <5861043+superherointj@users.noreply.github.com>
Date: Wed, 8 Feb 2023 06:31:11 -0300
Subject: [PATCH 131/176] python310Packages.pygame: pin SDL2_image to 2.0.5

https://github.com/pygame/pygame/issues/3430#issuecomment-1279955564
---
 pkgs/top-level/python-packages.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 988f7e71981c..dd0f400580b5 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8070,6 +8070,7 @@ self: super: with self; {
 
   pygame = callPackage ../development/python-modules/pygame {
     inherit (pkgs.darwin.apple_sdk.frameworks) AppKit;
+    SDL2_image = pkgs.SDL2_image_2_0_5;
   };
 
   pygame_sdl2 = callPackage ../development/python-modules/pygame_sdl2 { };

From 162dcb9b00ca13b22ffa11328f0b19b52e550753 Mon Sep 17 00:00:00 2001
From: superherointj <5861043+superherointj@users.noreply.github.com>
Date: Wed, 8 Feb 2023 09:55:49 -0300
Subject: [PATCH 132/176] toppler: pin SDL2_image to 2.0.5

---
 pkgs/top-level/all-packages.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index aaad642f6b84..a61bae9dfdb8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -35746,7 +35746,9 @@ with pkgs;
 
   tome4 = callPackage ../games/tome4 { };
 
-  toppler = callPackage ../games/toppler { };
+  toppler = callPackage ../games/toppler {
+    SDL2_image = SDL2_image_2_0_5;
+  };
 
   torus-trooper = callPackage ../games/torus-trooper { };
 

From 85dac16ffb10ba0f848c056c54d855d6e0f53cdd Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 8 Feb 2023 16:37:47 +0300
Subject: [PATCH 133/176] kio-admin: add meta

---
 pkgs/tools/filesystems/kio-admin/default.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/tools/filesystems/kio-admin/default.nix b/pkgs/tools/filesystems/kio-admin/default.nix
index f7f7484cc00c..7e4a97fa255a 100644
--- a/pkgs/tools/filesystems/kio-admin/default.nix
+++ b/pkgs/tools/filesystems/kio-admin/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitLab, cmake, extra-cmake-modules, qtbase, wrapQtAppsHook, kio, ki18n, polkit-qt }:
+{ lib, stdenv, fetchFromGitLab, cmake, extra-cmake-modules, qtbase, wrapQtAppsHook, kio, ki18n, polkit-qt }:
 
 stdenv.mkDerivation rec {
   pname = "kio-admin";
@@ -14,4 +14,12 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake extra-cmake-modules wrapQtAppsHook ];
   buildInputs = [ qtbase kio ki18n polkit-qt ];
+
+  meta = with lib; {
+    description = "Manage files as administrator using the admin:// KIO protocol.";
+    homepage = "https://invent.kde.org/system/kio-admin";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ k900 ];
+  };
 }

From 7932c9c05598aff843295215c53e2c54c4e0419f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 13:42:51 +0000
Subject: [PATCH 134/176] python310Packages.pontos: 23.2.0 -> 23.2.4

---
 pkgs/development/python-modules/pontos/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pontos/default.nix b/pkgs/development/python-modules/pontos/default.nix
index ae3b4c551dd4..9383bdbf100e 100644
--- a/pkgs/development/python-modules/pontos/default.nix
+++ b/pkgs/development/python-modules/pontos/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pontos";
-  version = "23.2.0";
+  version = "23.2.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-4GIfXHDY2g6dhvymYzunK2UWxJcO37dXQbI2jxOIwCw=";
+    hash = "sha256-tunFd+hgaRx5wc1gRwZaNUEX550Rl1NR9rZfEWUw6H4=";
   };
 
   nativeBuildInputs = [

From 0e52a5627ecfeaf036323cfa8c8e590c7fb105ea Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Wed, 8 Feb 2023 15:18:37 +0100
Subject: [PATCH 135/176] python310Packages.deep-translator: relicense to asl20

---
 pkgs/development/python-modules/deep-translator/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/deep-translator/default.nix b/pkgs/development/python-modules/deep-translator/default.nix
index e01ada284958..eec2c9fd895c 100644
--- a/pkgs/development/python-modules/deep-translator/default.nix
+++ b/pkgs/development/python-modules/deep-translator/default.nix
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     description = "Python tool to translate between different languages by using multiple translators";
     homepage = "https://deep-translator.readthedocs.io";
     changelog = "https://github.com/nidhaloff/deep-translator/releases/tag/v1.10.0";
-    license = licenses.mit;
+    license = licenses.asl20;
     maintainers = with maintainers; [ wolfangaukang ];
   };
 }

From edccae739ac95d97b29bbedb164241a3d0c956a7 Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Sun, 5 Feb 2023 07:48:49 +0100
Subject: [PATCH 136/176] nixos-render-docs: add a test for running mypy

pulling mypy into the build closure is unfortunately not reasonable, the
closure for mypy is rather large and takes a long time to build. if we
have the type checks hooked into CI we'll get most of the benefit though.
---
 pkgs/tools/nix/nixos-render-docs/default.nix | 34 ++++++++++++++++----
 1 file changed, 28 insertions(+), 6 deletions(-)

diff --git a/pkgs/tools/nix/nixos-render-docs/default.nix b/pkgs/tools/nix/nixos-render-docs/default.nix
index 55bbbd9ffa56..312bc8058245 100644
--- a/pkgs/tools/nix/nixos-render-docs/default.nix
+++ b/pkgs/tools/nix/nixos-render-docs/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , python3
 , python3Minimal
+, runCommand
 }:
 
 let
@@ -21,9 +22,23 @@ let
     markdown-it-py = markdown-it-py-no-tests;
     disableTests = true;
   };
+
+  makeDeps = pkgs: small:
+    [ pkgs.frozendict ]
+    ++ (
+      if small
+      then [
+        markdown-it-py-no-tests
+        mdit-py-plugins-no-tests
+      ]
+      else [
+        pkgs.markdown-it-py
+        pkgs.mdit-py-plugins
+      ]
+    );
 in
 
-python.pkgs.buildPythonApplication {
+python.pkgs.buildPythonApplication rec {
   pname = "nixos-render-docs";
   version = "0.0";
   format = "pyproject";
@@ -47,14 +62,21 @@ python.pkgs.buildPythonApplication {
     python.pkgs.pytestCheckHook
   ];
 
-  propagatedBuildInputs = [
-    markdown-it-py-no-tests
-    mdit-py-plugins-no-tests
-    python.pkgs.frozendict
-  ];
+  propagatedBuildInputs = makeDeps python.pkgs true;
 
   pytestFlagsArray = [ "-vvrP" "tests/" ];
 
+  # NOTE this is a CI test rather than a build-time test because we want to keep the
+  # build closures small. mypy has an unreasonably large build closure for docs builds.
+  passthru.tests.typing = runCommand "${pname}-mypy" {
+    nativeBuildInputs = [
+      (python3.withPackages (p: [ p.mypy p.pytest ] ++ makeDeps p false))
+    ];
+  } ''
+    mypy --strict ${src}
+    touch $out
+  '';
+
   meta = with lib; {
     description = "Renderer for NixOS manual and option docs";
     license = licenses.mit;

From 2f9d71afdb892f399d78d454d3de8188caf259fa Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Wed, 1 Feb 2023 00:23:43 +0100
Subject: [PATCH 137/176] nixos/x11: fix some docs links

the docbook stylesheets duplicated the target of these untitled links
into their label, but we should do that in markdown instead.
---
 nixos/modules/services/x11/extra-layouts.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/x11/extra-layouts.nix b/nixos/modules/services/x11/extra-layouts.nix
index 574657a50c82..9c88d12ca6f2 100644
--- a/nixos/modules/services/x11/extra-layouts.nix
+++ b/nixos/modules/services/x11/extra-layouts.nix
@@ -106,9 +106,9 @@ in
       description = lib.mdDoc ''
         Extra custom layouts that will be included in the xkb configuration.
         Information on how to create a new layout can be found here:
-        [](https://www.x.org/releases/current/doc/xorg-docs/input/XKB-Enhancing.html#Defining_New_Layouts).
+        <https://www.x.org/releases/current/doc/xorg-docs/input/XKB-Enhancing.html#Defining_New_Layouts>.
         For more examples see
-        [](https://wiki.archlinux.org/index.php/X_KeyBoard_extension#Basic_examples)
+        <https://wiki.archlinux.org/index.php/X_KeyBoard_extension#Basic_examples>
       '';
     };
 

From bf4c0c19002fc2fa88d64b585497ae5a1c36287f Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Wed, 1 Feb 2023 06:12:57 +0100
Subject: [PATCH 138/176] nixos/*: remove trailing period in mkEnableOptions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

those are added by mkEnableOption, and .. is replaced to … by markdown
processing.
---
 nixos/modules/config/stevenblack.nix               |  2 +-
 nixos/modules/programs/proxychains.nix             |  2 +-
 nixos/modules/security/polkit.nix                  |  2 +-
 nixos/modules/services/backup/zfs-replication.nix  |  2 +-
 .../services/cluster/kubernetes/addon-manager.nix  |  2 +-
 .../services/cluster/kubernetes/kubelet.nix        |  2 +-
 .../desktops/gnome/evolution-data-server.nix       |  4 ++--
 nixos/modules/services/development/zammad.nix      |  2 +-
 nixos/modules/services/games/freeciv.nix           |  2 +-
 nixos/modules/services/hardware/udisks2.nix        |  2 +-
 nixos/modules/services/mail/dovecot.nix            | 14 +++++++-------
 nixos/modules/services/misc/atuin.nix              |  2 +-
 nixos/modules/services/misc/input-remapper.nix     |  2 +-
 nixos/modules/services/misc/sourcehut/default.nix  |  2 +-
 .../modules/services/monitoring/mackerel-agent.nix |  2 +-
 .../monitoring/prometheus/exporters/unpoller.nix   |  6 +++---
 nixos/modules/services/monitoring/uptime-kuma.nix  |  4 ++--
 .../services/network-filesystems/moosefs.nix       |  6 +++---
 .../services/networking/blockbook-frontend.nix     |  2 +-
 nixos/modules/services/security/kanidm.nix         |  2 +-
 nixos/modules/services/web-apps/cloudlog.nix       |  2 +-
 nixos/modules/services/web-apps/dokuwiki.nix       |  2 +-
 nixos/modules/services/web-apps/galene.nix         |  2 +-
 nixos/modules/services/web-apps/hledger-web.nix    |  2 +-
 nixos/modules/services/web-apps/jirafeau.nix       |  2 +-
 nixos/modules/services/web-apps/limesurvey.nix     |  2 +-
 nixos/modules/system/boot/kernel.nix               |  2 +-
 27 files changed, 39 insertions(+), 39 deletions(-)

diff --git a/nixos/modules/config/stevenblack.nix b/nixos/modules/config/stevenblack.nix
index ec6868484942..07a0aa339a56 100644
--- a/nixos/modules/config/stevenblack.nix
+++ b/nixos/modules/config/stevenblack.nix
@@ -15,7 +15,7 @@ let
 in
 {
   options.networking.stevenblack = {
-    enable = mkEnableOption (mdDoc "Enable the stevenblack hosts file blocklist.");
+    enable = mkEnableOption (mdDoc "Enable the stevenblack hosts file blocklist");
 
     block = mkOption {
       type = types.listOf (types.enum [ "fakenews" "gambling" "porn" "social" ]);
diff --git a/nixos/modules/programs/proxychains.nix b/nixos/modules/programs/proxychains.nix
index 0771f03c77d3..a52783aa6698 100644
--- a/nixos/modules/programs/proxychains.nix
+++ b/nixos/modules/programs/proxychains.nix
@@ -86,7 +86,7 @@ in {
         description = lib.mdDoc "Proxy DNS requests - no leak for DNS data.";
       };
 
-      quietMode = mkEnableOption (lib.mdDoc "Quiet mode (no output from the library).");
+      quietMode = mkEnableOption (lib.mdDoc "Quiet mode (no output from the library)");
 
       remoteDNSSubnet = mkOption {
         type = types.enum [ 10 127 224 ];
diff --git a/nixos/modules/security/polkit.nix b/nixos/modules/security/polkit.nix
index f33898578b81..de427ccb295b 100644
--- a/nixos/modules/security/polkit.nix
+++ b/nixos/modules/security/polkit.nix
@@ -14,7 +14,7 @@ in
 
     security.polkit.enable = mkEnableOption (lib.mdDoc "polkit");
 
-    security.polkit.debug = mkEnableOption (lib.mdDoc "debug logs from polkit. This is required in order to see log messages from rule definitions.");
+    security.polkit.debug = mkEnableOption (lib.mdDoc "debug logs from polkit. This is required in order to see log messages from rule definitions");
 
     security.polkit.extraConfig = mkOption {
       type = types.lines;
diff --git a/nixos/modules/services/backup/zfs-replication.nix b/nixos/modules/services/backup/zfs-replication.nix
index ce914003c622..8e7059e5b59d 100644
--- a/nixos/modules/services/backup/zfs-replication.nix
+++ b/nixos/modules/services/backup/zfs-replication.nix
@@ -9,7 +9,7 @@ let
 in {
   options = {
     services.zfs.autoReplication = {
-      enable = mkEnableOption (lib.mdDoc "ZFS snapshot replication.");
+      enable = mkEnableOption (lib.mdDoc "ZFS snapshot replication");
 
       followDelete = mkOption {
         description = lib.mdDoc "Remove remote snapshots that don't have a local correspondent.";
diff --git a/nixos/modules/services/cluster/kubernetes/addon-manager.nix b/nixos/modules/services/cluster/kubernetes/addon-manager.nix
index 7aa2a8323b1d..dc851688fbec 100644
--- a/nixos/modules/services/cluster/kubernetes/addon-manager.nix
+++ b/nixos/modules/services/cluster/kubernetes/addon-manager.nix
@@ -62,7 +62,7 @@ in
       '';
     };
 
-    enable = mkEnableOption (lib.mdDoc "Kubernetes addon manager.");
+    enable = mkEnableOption (lib.mdDoc "Kubernetes addon manager");
   };
 
   ###### implementation
diff --git a/nixos/modules/services/cluster/kubernetes/kubelet.nix b/nixos/modules/services/cluster/kubernetes/kubelet.nix
index 3ede1cb80e85..8e935d621be4 100644
--- a/nixos/modules/services/cluster/kubernetes/kubelet.nix
+++ b/nixos/modules/services/cluster/kubernetes/kubelet.nix
@@ -146,7 +146,7 @@ in
       default = "unix:///run/containerd/containerd.sock";
     };
 
-    enable = mkEnableOption (lib.mdDoc "Kubernetes kubelet.");
+    enable = mkEnableOption (lib.mdDoc "Kubernetes kubelet");
 
     extraOpts = mkOption {
       description = lib.mdDoc "Kubernetes kubelet extra command line options.";
diff --git a/nixos/modules/services/desktops/gnome/evolution-data-server.nix b/nixos/modules/services/desktops/gnome/evolution-data-server.nix
index 0006ba1a7bad..a8db7dce8fdf 100644
--- a/nixos/modules/services/desktops/gnome/evolution-data-server.nix
+++ b/nixos/modules/services/desktops/gnome/evolution-data-server.nix
@@ -27,7 +27,7 @@ with lib;
   options = {
 
     services.gnome.evolution-data-server = {
-      enable = mkEnableOption (lib.mdDoc "Evolution Data Server, a collection of services for storing addressbooks and calendars.");
+      enable = mkEnableOption (lib.mdDoc "Evolution Data Server, a collection of services for storing addressbooks and calendars");
       plugins = mkOption {
         type = types.listOf types.package;
         default = [ ];
@@ -35,7 +35,7 @@ with lib;
       };
     };
     programs.evolution = {
-      enable = mkEnableOption (lib.mdDoc "Evolution, a Personal information management application that provides integrated mail, calendaring and address book functionality.");
+      enable = mkEnableOption (lib.mdDoc "Evolution, a Personal information management application that provides integrated mail, calendaring and address book functionality");
       plugins = mkOption {
         type = types.listOf types.package;
         default = [ ];
diff --git a/nixos/modules/services/development/zammad.nix b/nixos/modules/services/development/zammad.nix
index 7de11b08b7e7..0faeb4c0e9fa 100644
--- a/nixos/modules/services/development/zammad.nix
+++ b/nixos/modules/services/development/zammad.nix
@@ -28,7 +28,7 @@ in
 
   options = {
     services.zammad = {
-      enable = mkEnableOption (lib.mdDoc "Zammad, a web-based, open source user support/ticketing solution.");
+      enable = mkEnableOption (lib.mdDoc "Zammad, a web-based, open source user support/ticketing solution");
 
       package = mkOption {
         type = types.package;
diff --git a/nixos/modules/services/games/freeciv.nix b/nixos/modules/services/games/freeciv.nix
index 8b340bb161a5..f33ea5c08a27 100644
--- a/nixos/modules/services/games/freeciv.nix
+++ b/nixos/modules/services/games/freeciv.nix
@@ -54,7 +54,7 @@ in
             default = 0;
             description = lib.mdDoc "Set debug log level.";
           };
-          options.exit-on-end = mkEnableOption (lib.mdDoc "exit instead of restarting when a game ends.");
+          options.exit-on-end = mkEnableOption (lib.mdDoc "exit instead of restarting when a game ends");
           options.Guests = mkEnableOption (lib.mdDoc "guests to login if auth is enabled");
           options.Newusers = mkEnableOption (lib.mdDoc "new users to login if auth is enabled");
           options.port = mkOption {
diff --git a/nixos/modules/services/hardware/udisks2.nix b/nixos/modules/services/hardware/udisks2.nix
index 7368845dafd5..d5c71bb821df 100644
--- a/nixos/modules/services/hardware/udisks2.nix
+++ b/nixos/modules/services/hardware/udisks2.nix
@@ -19,7 +19,7 @@ in
 
     services.udisks2 = {
 
-      enable = mkEnableOption (lib.mdDoc "udisks2, a DBus service that allows applications to query and manipulate storage devices.");
+      enable = mkEnableOption (lib.mdDoc "udisks2, a DBus service that allows applications to query and manipulate storage devices");
 
       settings = mkOption rec {
         type = types.attrsOf settingsFormat.type;
diff --git a/nixos/modules/services/mail/dovecot.nix b/nixos/modules/services/mail/dovecot.nix
index f6a167572f72..21bafd859c3c 100644
--- a/nixos/modules/services/mail/dovecot.nix
+++ b/nixos/modules/services/mail/dovecot.nix
@@ -171,11 +171,11 @@ in
   options.services.dovecot2 = {
     enable = mkEnableOption (lib.mdDoc "the dovecot 2.x POP3/IMAP server");
 
-    enablePop3 = mkEnableOption (lib.mdDoc "starting the POP3 listener (when Dovecot is enabled).");
+    enablePop3 = mkEnableOption (lib.mdDoc "starting the POP3 listener (when Dovecot is enabled)");
 
-    enableImap = mkEnableOption (lib.mdDoc "starting the IMAP listener (when Dovecot is enabled).") // { default = true; };
+    enableImap = mkEnableOption (lib.mdDoc "starting the IMAP listener (when Dovecot is enabled)") // { default = true; };
 
-    enableLmtp = mkEnableOption (lib.mdDoc "starting the LMTP listener (when Dovecot is enabled).");
+    enableLmtp = mkEnableOption (lib.mdDoc "starting the LMTP listener (when Dovecot is enabled)");
 
     protocols = mkOption {
       type = types.listOf types.str;
@@ -300,9 +300,9 @@ in
       description = lib.mdDoc "Path to the server's private key.";
     };
 
-    enablePAM = mkEnableOption (lib.mdDoc "creating a own Dovecot PAM service and configure PAM user logins.") // { default = true; };
+    enablePAM = mkEnableOption (lib.mdDoc "creating a own Dovecot PAM service and configure PAM user logins") // { default = true; };
 
-    enableDHE = mkEnableOption (lib.mdDoc "enable ssl_dh and generation of primes for the key exchange.") // { default = true; };
+    enableDHE = mkEnableOption (lib.mdDoc "enable ssl_dh and generation of primes for the key exchange") // { default = true; };
 
     sieveScripts = mkOption {
       type = types.attrsOf types.path;
@@ -310,7 +310,7 @@ in
       description = lib.mdDoc "Sieve scripts to be executed. Key is a sequence, e.g. 'before2', 'after' etc.";
     };
 
-    showPAMFailure = mkEnableOption (lib.mdDoc "showing the PAM failure message on authentication error (useful for OTPW).");
+    showPAMFailure = mkEnableOption (lib.mdDoc "showing the PAM failure message on authentication error (useful for OTPW)");
 
     mailboxes = mkOption {
       type = with types; coercedTo
@@ -326,7 +326,7 @@ in
       description = lib.mdDoc "Configure mailboxes and auto create or subscribe them.";
     };
 
-    enableQuota = mkEnableOption (lib.mdDoc "the dovecot quota service.");
+    enableQuota = mkEnableOption (lib.mdDoc "the dovecot quota service");
 
     quotaPort = mkOption {
       type = types.str;
diff --git a/nixos/modules/services/misc/atuin.nix b/nixos/modules/services/misc/atuin.nix
index c94852e3aad9..508e2862b63f 100644
--- a/nixos/modules/services/misc/atuin.nix
+++ b/nixos/modules/services/misc/atuin.nix
@@ -8,7 +8,7 @@ in
 {
   options = {
     services.atuin = {
-      enable = mkEnableOption (mdDoc "Enable server for shell history sync with atuin.");
+      enable = mkEnableOption (mdDoc "Enable server for shell history sync with atuin");
 
       openRegistration = mkOption {
         type = types.bool;
diff --git a/nixos/modules/services/misc/input-remapper.nix b/nixos/modules/services/misc/input-remapper.nix
index 6353966f5c3f..3f6d97f85738 100644
--- a/nixos/modules/services/misc/input-remapper.nix
+++ b/nixos/modules/services/misc/input-remapper.nix
@@ -6,7 +6,7 @@ let cfg = config.services.input-remapper; in
 {
   options = {
     services.input-remapper = {
-      enable = mkEnableOption (lib.mdDoc "input-remapper, an easy to use tool to change the mapping of your input device buttons.");
+      enable = mkEnableOption (lib.mdDoc "input-remapper, an easy to use tool to change the mapping of your input device buttons");
       package = mkPackageOptionMD pkgs "input-remapper" { };
       enableUdevRules = mkEnableOption (lib.mdDoc "udev rules added by input-remapper to handle hotplugged devices. Currently disabled by default due to https://github.com/sezanzeb/input-remapper/issues/140");
       serviceWantedBy = mkOption {
diff --git a/nixos/modules/services/misc/sourcehut/default.nix b/nixos/modules/services/misc/sourcehut/default.nix
index b2cadbf0c436..d4391bc49e31 100644
--- a/nixos/modules/services/misc/sourcehut/default.nix
+++ b/nixos/modules/services/misc/sourcehut/default.nix
@@ -438,7 +438,7 @@ in
         };
 
         options."lists.sr.ht" = commonServiceSettings "lists" // {
-          allow-new-lists = mkEnableOption (lib.mdDoc "Allow creation of new lists.");
+          allow-new-lists = mkEnableOption (lib.mdDoc "Allow creation of new lists");
           notify-from = mkOption {
             description = lib.mdDoc "Outgoing email for notifications generated by users.";
             type = types.str;
diff --git a/nixos/modules/services/monitoring/mackerel-agent.nix b/nixos/modules/services/monitoring/mackerel-agent.nix
index 4185cd76c4eb..67dc1bc19edd 100644
--- a/nixos/modules/services/monitoring/mackerel-agent.nix
+++ b/nixos/modules/services/monitoring/mackerel-agent.nix
@@ -11,7 +11,7 @@ in {
 
     # the upstream package runs as root, but doesn't seem to be strictly
     # necessary for basic functionality
-    runAsRoot = mkEnableOption (lib.mdDoc "Whether to run as root.");
+    runAsRoot = mkEnableOption (lib.mdDoc "Whether to run as root");
 
     autoRetirement = mkEnableOption (lib.mdDoc ''
       Whether to automatically retire the host upon OS shutdown.
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/unpoller.nix b/nixos/modules/services/monitoring/prometheus/exporters/unpoller.nix
index 5cd1e2c65e90..3b7f978528cd 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/unpoller.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/unpoller.nix
@@ -24,9 +24,9 @@ in {
     inherit (options.services.unpoller.unifi) controllers;
     inherit (options.services.unpoller) loki;
     log = {
-      debug = mkEnableOption (lib.mdDoc "debug logging including line numbers, high resolution timestamps, per-device logs.");
-      quiet = mkEnableOption (lib.mdDoc "startup and error logs only.");
-      prometheusErrors = mkEnableOption (lib.mdDoc "emitting errors to prometheus.");
+      debug = mkEnableOption (lib.mdDoc "debug logging including line numbers, high resolution timestamps, per-device logs");
+      quiet = mkEnableOption (lib.mdDoc "startup and error logs only");
+      prometheusErrors = mkEnableOption (lib.mdDoc "emitting errors to prometheus");
     };
   };
 
diff --git a/nixos/modules/services/monitoring/uptime-kuma.nix b/nixos/modules/services/monitoring/uptime-kuma.nix
index 886e14b5f6c9..5f803d57b5e9 100644
--- a/nixos/modules/services/monitoring/uptime-kuma.nix
+++ b/nixos/modules/services/monitoring/uptime-kuma.nix
@@ -11,7 +11,7 @@ in
 
   options = {
     services.uptime-kuma = {
-      enable = mkEnableOption (mdDoc "Uptime Kuma, this assumes a reverse proxy to be set.");
+      enable = mkEnableOption (mdDoc "Uptime Kuma, this assumes a reverse proxy to be set");
 
       package = mkOption {
         type = types.package;
@@ -20,7 +20,7 @@ in
         description = lib.mdDoc "Uptime Kuma package to use.";
       };
 
-      appriseSupport = mkEnableOption (mdDoc "apprise support for notifications.");
+      appriseSupport = mkEnableOption (mdDoc "apprise support for notifications");
 
       settings = lib.mkOption {
         type = lib.types.submodule { freeformType = with lib.types; attrsOf str; };
diff --git a/nixos/modules/services/network-filesystems/moosefs.nix b/nixos/modules/services/network-filesystems/moosefs.nix
index ab82a2a07dd4..49cbc89d5a91 100644
--- a/nixos/modules/services/network-filesystems/moosefs.nix
+++ b/nixos/modules/services/network-filesystems/moosefs.nix
@@ -85,7 +85,7 @@ in {
         description = lib.mdDoc "Run daemons as user moosefs instead of root.";
       };
 
-      client.enable = mkEnableOption (lib.mdDoc "Moosefs client.");
+      client.enable = mkEnableOption (lib.mdDoc "Moosefs client");
 
       master = {
         enable = mkOption {
@@ -131,7 +131,7 @@ in {
       };
 
       metalogger = {
-        enable = mkEnableOption (lib.mdDoc "Moosefs metalogger daemon.");
+        enable = mkEnableOption (lib.mdDoc "Moosefs metalogger daemon");
 
         settings = mkOption {
           type = types.submodule {
@@ -149,7 +149,7 @@ in {
       };
 
       chunkserver = {
-        enable = mkEnableOption (lib.mdDoc "Moosefs chunkserver daemon.");
+        enable = mkEnableOption (lib.mdDoc "Moosefs chunkserver daemon");
 
         openFirewall = mkOption {
           type = types.bool;
diff --git a/nixos/modules/services/networking/blockbook-frontend.nix b/nixos/modules/services/networking/blockbook-frontend.nix
index ab784563e4ac..46b26195d211 100644
--- a/nixos/modules/services/networking/blockbook-frontend.nix
+++ b/nixos/modules/services/networking/blockbook-frontend.nix
@@ -10,7 +10,7 @@ let
 
     options = {
 
-      enable = mkEnableOption (lib.mdDoc "blockbook-frontend application.");
+      enable = mkEnableOption (lib.mdDoc "blockbook-frontend application");
 
       package = mkOption {
         type = types.package;
diff --git a/nixos/modules/services/security/kanidm.nix b/nixos/modules/services/security/kanidm.nix
index 55120799c993..5583c39368f7 100644
--- a/nixos/modules/services/security/kanidm.nix
+++ b/nixos/modules/services/security/kanidm.nix
@@ -55,7 +55,7 @@ in
   options.services.kanidm = {
     enableClient = lib.mkEnableOption (lib.mdDoc "the Kanidm client");
     enableServer = lib.mkEnableOption (lib.mdDoc "the Kanidm server");
-    enablePam = lib.mkEnableOption (lib.mdDoc "the Kanidm PAM and NSS integration.");
+    enablePam = lib.mkEnableOption (lib.mdDoc "the Kanidm PAM and NSS integration");
 
     serverSettings = lib.mkOption {
       type = lib.types.submodule {
diff --git a/nixos/modules/services/web-apps/cloudlog.nix b/nixos/modules/services/web-apps/cloudlog.nix
index ffd1085bde65..9c6284fd1b57 100644
--- a/nixos/modules/services/web-apps/cloudlog.nix
+++ b/nixos/modules/services/web-apps/cloudlog.nix
@@ -68,7 +68,7 @@ let
 in
 {
   options.services.cloudlog = with types; {
-    enable = mkEnableOption (mdDoc "Whether to enable Cloudlog.");
+    enable = mkEnableOption (mdDoc "Whether to enable Cloudlog");
     dataDir = mkOption {
       type = str;
       default = "/var/lib/cloudlog";
diff --git a/nixos/modules/services/web-apps/dokuwiki.nix b/nixos/modules/services/web-apps/dokuwiki.nix
index 54cd5fd33bef..215372083654 100644
--- a/nixos/modules/services/web-apps/dokuwiki.nix
+++ b/nixos/modules/services/web-apps/dokuwiki.nix
@@ -148,7 +148,7 @@ let
       ];
 
       options = {
-        enable = mkEnableOption (lib.mdDoc "DokuWiki web application.");
+        enable = mkEnableOption (lib.mdDoc "DokuWiki web application");
 
         package = mkOption {
           type = types.package;
diff --git a/nixos/modules/services/web-apps/galene.nix b/nixos/modules/services/web-apps/galene.nix
index 15ef09aa0b87..747b85f94c65 100644
--- a/nixos/modules/services/web-apps/galene.nix
+++ b/nixos/modules/services/web-apps/galene.nix
@@ -12,7 +12,7 @@ in
 {
   options = {
     services.galene = {
-      enable = mkEnableOption (lib.mdDoc "Galene Service.");
+      enable = mkEnableOption (lib.mdDoc "Galene Service");
 
       stateDir = mkOption {
         default = defaultstateDir;
diff --git a/nixos/modules/services/web-apps/hledger-web.nix b/nixos/modules/services/web-apps/hledger-web.nix
index 86716a02649c..0fc283ff5219 100644
--- a/nixos/modules/services/web-apps/hledger-web.nix
+++ b/nixos/modules/services/web-apps/hledger-web.nix
@@ -7,7 +7,7 @@ in {
 
     enable = mkEnableOption (lib.mdDoc "hledger-web service");
 
-    serveApi = mkEnableOption (lib.mdDoc "Serve only the JSON web API, without the web UI.");
+    serveApi = mkEnableOption (lib.mdDoc "Serve only the JSON web API, without the web UI");
 
     host = mkOption {
       type = types.str;
diff --git a/nixos/modules/services/web-apps/jirafeau.nix b/nixos/modules/services/web-apps/jirafeau.nix
index 293cbb3af425..b2e274167164 100644
--- a/nixos/modules/services/web-apps/jirafeau.nix
+++ b/nixos/modules/services/web-apps/jirafeau.nix
@@ -36,7 +36,7 @@ in
       description = lib.mdDoc "Location of Jirafeau storage directory.";
     };
 
-    enable = mkEnableOption (lib.mdDoc "Jirafeau file upload application.");
+    enable = mkEnableOption (lib.mdDoc "Jirafeau file upload application");
 
     extraConfig = mkOption {
       type = types.lines;
diff --git a/nixos/modules/services/web-apps/limesurvey.nix b/nixos/modules/services/web-apps/limesurvey.nix
index 7093d1de0dac..dd51174c8b8e 100644
--- a/nixos/modules/services/web-apps/limesurvey.nix
+++ b/nixos/modules/services/web-apps/limesurvey.nix
@@ -32,7 +32,7 @@ in
   # interface
 
   options.services.limesurvey = {
-    enable = mkEnableOption (lib.mdDoc "Limesurvey web application.");
+    enable = mkEnableOption (lib.mdDoc "Limesurvey web application");
 
     database = {
       type = mkOption {
diff --git a/nixos/modules/system/boot/kernel.nix b/nixos/modules/system/boot/kernel.nix
index 8f203b2c8b32..0298e28f3289 100644
--- a/nixos/modules/system/boot/kernel.nix
+++ b/nixos/modules/system/boot/kernel.nix
@@ -20,7 +20,7 @@ in
   ###### interface
 
   options = {
-    boot.kernel.enable = mkEnableOption (lib.mdDoc "the Linux kernel. This is useful for systemd-like containers which do not require a kernel.") // {
+    boot.kernel.enable = mkEnableOption (lib.mdDoc "the Linux kernel. This is useful for systemd-like containers which do not require a kernel") // {
       default = true;
     };
 

From 8fe19590c36dc4c5a9409c55ec466321203d5c54 Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Wed, 1 Feb 2023 06:45:22 +0100
Subject: [PATCH 139/176] nixos/make-options-doc: fix related packages link
 label

the pkgs path literal surely shouldn't include the title, right?
---
 nixos/lib/make-options-doc/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/lib/make-options-doc/default.nix b/nixos/lib/make-options-doc/default.nix
index 271af9ba1801..09b0191d2bb8 100644
--- a/nixos/lib/make-options-doc/default.nix
+++ b/nixos/lib/make-options-doc/default.nix
@@ -78,7 +78,7 @@ let
           title = args.title or null;
           name = args.name or (lib.concatStringsSep "." args.path);
         in ''
-          - [`${lib.optionalString (title != null) "${title} aka "}pkgs.${name}`](
+          - [${lib.optionalString (title != null) "${title} aka "}`pkgs.${name}`](
               https://search.nixos.org/packages?show=${name}&sort=relevance&query=${name}
             )${
               lib.optionalString (args ? comment) "\n\n  ${args.comment}"

From 5a5255983bcd9fdb95697f93f21a0582d0dde4a0 Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Wed, 1 Feb 2023 20:30:53 +0100
Subject: [PATCH 140/176] nixos-render-docs: calculate list end indices

that'll be useful to calculate the width of list item heads, which we'll
ned to render manpages.
---
 .../nix/nixos-render-docs/src/nixos_render_docs/md.py  |  9 ++++++++-
 .../nix/nixos-render-docs/src/tests/test_lists.py      | 10 ++++++----
 2 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/md.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/md.py
index c08675870f6a..3274d6de2fda 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/md.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/md.py
@@ -1,7 +1,7 @@
 from abc import ABC
 from collections.abc import Mapping, MutableMapping, Sequence
 from frozendict import frozendict # type: ignore[attr-defined]
-from typing import Any, Callable, Optional
+from typing import Any, Callable, cast, Optional
 
 import re
 
@@ -364,14 +364,21 @@ class Converter(ABC):
         # of each item to hidden. this is not useful for our stylesheets, which
         # signify this with a special css class on list elements instead.
         wide_stack = []
+        end_stack = []
         for i in range(0, len(tokens)):
             if tokens[i].type in [ 'bullet_list_open', 'ordered_list_open' ]:
                 wide_stack.append([i, True])
+                end_stack.append([i, cast(int, tokens[i].attrs.get('start', 1))])
             elif tokens[i].type in [ 'bullet_list_close', 'ordered_list_close' ]:
                 (idx, compact) = wide_stack.pop()
                 tokens[idx].attrs['compact'] = compact
+                (idx, end) = end_stack.pop()
+                if tokens[i].type == 'ordered_list_close':
+                    tokens[idx].meta['end'] = end - 1
             elif len(wide_stack) > 0 and tokens[i].type == 'paragraph_open' and not tokens[i].hidden:
                 wide_stack[-1][1] = False
+            elif tokens[i].type == 'list_item_open':
+                end_stack[-1][1] += 1
 
         return tokens
 
diff --git a/pkgs/tools/nix/nixos-render-docs/src/tests/test_lists.py b/pkgs/tools/nix/nixos-render-docs/src/tests/test_lists.py
index 0f5d28407367..af284c9d3abe 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/tests/test_lists.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/tests/test_lists.py
@@ -13,9 +13,10 @@ def test_list_wide(ordered: bool) -> None:
         ("ordered", "ol", ".", "1.", "2.", "1", "2") if ordered else ("bullet", "ul", "-", "-", "-", "", "")
     )
     c = Converter({})
+    meta = { 'end': int(e2[:-1]) } if ordered else {}
     assert c._parse(f"{e1} a\n\n{e2} b") == [
         Token(type=f'{t}_list_open', tag=tag, nesting=1, attrs={'compact': False}, map=[0, 3], level=0,
-              children=None, content='', markup=m, info='', meta={}, block=True, hidden=False),
+              children=None, content='', markup=m, info='', meta=meta, block=True, hidden=False),
         Token(type='list_item_open', tag='li', nesting=1, attrs={}, map=[0, 2], level=1, children=None,
               content='', markup=m, info=i1, meta={}, block=True, hidden=False),
         Token(type='paragraph_open', tag='p', nesting=1, attrs={}, map=[0, 1], level=2, children=None,
@@ -54,9 +55,10 @@ def test_list_narrow(ordered: bool) -> None:
         ("ordered", "ol", ".", "1.", "2.", "1", "2") if ordered else ("bullet", "ul", "-", "-", "-", "", "")
     )
     c = Converter({})
+    meta = { 'end': int(e2[:-1]) } if ordered else {}
     assert c._parse(f"{e1} a\n{e2} b") == [
         Token(type=f'{t}_list_open', tag=tag, nesting=1, attrs={'compact': True}, map=[0, 2], level=0,
-              children=None, content='', markup=m, info='', meta={}, block=True, hidden=False),
+              children=None, content='', markup=m, info='', meta=meta, block=True, hidden=False),
         Token(type='list_item_open', tag='li', nesting=1, attrs={}, map=[0, 1], level=1, children=None,
               content='', markup=m, info=i1, meta={}, block=True, hidden=False),
         Token(type='paragraph_open', tag='p', nesting=1, attrs={}, map=[0, 1], level=2, children=None,
@@ -90,7 +92,7 @@ def test_list_narrow(ordered: bool) -> None:
     ]
     assert c._parse(f"{e1} - a\n{e2} b") == [
         Token(type=f'{t}_list_open', tag=tag, nesting=1, attrs={'compact': True}, map=[0, 2], level=0,
-              children=None, content='', markup=m, info='', meta={}, block=True, hidden=False),
+              children=None, content='', markup=m, info='', meta=meta, block=True, hidden=False),
         Token(type='list_item_open', tag='li', nesting=1, attrs={}, map=[0, 1], level=1, children=None,
               content='', markup=m, info=i1, meta={}, block=True, hidden=False),
         Token(type='bullet_list_open', tag='ul', nesting=1, attrs={'compact': True}, map=[0, 1], level=2,
@@ -132,7 +134,7 @@ def test_list_narrow(ordered: bool) -> None:
     ]
     assert c._parse(f"{e1} - a\n{e2} - b") == [
         Token(type=f'{t}_list_open', tag=tag, nesting=1, attrs={'compact': True}, map=[0, 2], level=0,
-              children=None, content='', markup=m, info='', meta={}, block=True, hidden=False),
+              children=None, content='', markup=m, info='', meta=meta, block=True, hidden=False),
         Token(type='list_item_open', tag='li', nesting=1, attrs={}, map=[0, 1], level=1, children=None,
               content='', markup=m, info=i1, meta={}, block=True, hidden=False),
         Token(type='bullet_list_open', tag='ul', nesting=1, attrs={'compact': True}, map=[0, 1], level=2,

From 11daebd2d92e972ead541cdfa04afc8f191379cb Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Wed, 1 Feb 2023 21:04:28 +0100
Subject: [PATCH 141/176] nixos-render-docs: add block and inline joiners

these work together with render and renderInline to produce an output
from either of the two. rendering manpages will need both: to join
blocks with newlines, and to run some postprocessing and the rendered inlines.
---
 .../nix/nixos-render-docs/src/nixos_render_docs/md.py | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/md.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/md.py
index 3274d6de2fda..104a43d9edfd 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/md.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/md.py
@@ -1,7 +1,7 @@
 from abc import ABC
 from collections.abc import Mapping, MutableMapping, Sequence
 from frozendict import frozendict # type: ignore[attr-defined]
-from typing import Any, Callable, cast, Optional
+from typing import Any, Callable, cast, Iterable, Optional
 
 import re
 
@@ -79,6 +79,11 @@ class Renderer(markdown_it.renderer.RendererProtocol):
         }
         self._admonition_stack = []
 
+    def _join_block(self, ls: Iterable[str]) -> str:
+        return "".join(ls)
+    def _join_inline(self, ls: Iterable[str]) -> str:
+        return "".join(ls)
+
     def admonition_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
                         env: MutableMapping[str, Any]) -> str:
         tag = token.info.strip()
@@ -98,7 +103,7 @@ class Renderer(markdown_it.renderer.RendererProtocol):
                 return self.rules[token.type](tokens[i], tokens, i, options, env)
             else:
                 raise NotImplementedError("md token not supported yet", token)
-        return "".join(map(lambda arg: do_one(*arg), enumerate(tokens)))
+        return self._join_block(map(lambda arg: do_one(*arg), enumerate(tokens)))
     def renderInline(self, tokens: Sequence[Token], options: OptionsDict,
                      env: MutableMapping[str, Any]) -> str:
         def do_one(i: int, token: Token) -> str:
@@ -106,7 +111,7 @@ class Renderer(markdown_it.renderer.RendererProtocol):
                 return self.rules[token.type](tokens[i], tokens, i, options, env)
             else:
                 raise NotImplementedError("md token not supported yet", token)
-        return "".join(map(lambda arg: do_one(*arg), enumerate(tokens)))
+        return self._join_inline(map(lambda arg: do_one(*arg), enumerate(tokens)))
 
     def text(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
              env: MutableMapping[str, Any]) -> str:

From 32136b1b01e1766737884fe48d8b0b035e0cb994 Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Wed, 1 Feb 2023 21:24:58 +0100
Subject: [PATCH 142/176] nixos-render-docs: don't render empty descriptions at
 all

---
 .../nix/nixos-render-docs/src/nixos_render_docs/options.py    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
index 3667c7bbcdeb..b53d50c97ed9 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
@@ -107,9 +107,9 @@ class BaseConverter(Converter):
 
     def _render_description(self, desc: str | dict[str, str]) -> list[str]:
         if isinstance(desc, str) and self._markdown_by_default:
-            return [ self._render(desc) ]
+            return [ self._render(desc) ] if desc else []
         elif isinstance(desc, dict) and desc.get('_type') == 'mdDoc':
-            return [ self._render(desc['text']) ]
+            return [ self._render(desc['text']) ] if desc['text'] else []
         else:
             raise Exception("description has unrecognized type", desc)
 

From 09411102f60e241a65d5ce708d369fdfcad3e977 Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Wed, 1 Feb 2023 22:34:30 +0100
Subject: [PATCH 143/176] nixos-render-docs: add option block separators

this will be necessary for manpages, which separate option declarations
not with external tags but by interspersing mandoc spacing instructions.
---
 .../src/nixos_render_docs/options.py          | 28 ++++++++++++-------
 1 file changed, 18 insertions(+), 10 deletions(-)

diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
index b53d50c97ed9..8550dc26809d 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
@@ -22,6 +22,8 @@ def option_is(option: Option, key: str, typ: str) -> Optional[dict[str, str]]:
     return option[key] # type: ignore[return-value]
 
 class BaseConverter(Converter):
+    __option_block_separator__: str
+
     _options: dict[str, RenderedOption]
 
     def __init__(self, manpage_urls: dict[str, str],
@@ -117,26 +119,31 @@ class BaseConverter(Converter):
     def _related_packages_header(self) -> list[str]: raise NotImplementedError()
 
     def _convert_one(self, option: dict[str, Any]) -> list[str]:
-        result = []
+        blocks: list[list[str]] = []
 
         if desc := option.get('description'):
-            result += self._render_description(desc)
+            blocks.append(self._render_description(desc))
         if typ := option.get('type'):
             ro = " *(read only)*" if option.get('readOnly', False) else ""
-            result.append(self._render(f"*Type:* {md_escape(typ)}{ro}"))
+            blocks.append([ self._render(f"*Type:*\n{md_escape(typ)}{ro}") ])
 
-        result += self._render_code(option, 'default')
-        result += self._render_code(option, 'example')
+        if option.get('default'):
+            blocks.append(self._render_code(option, 'default'))
+        if option.get('example'):
+            blocks.append(self._render_code(option, 'example'))
 
         if related := option.get('relatedPackages'):
-            result += self._related_packages_header()
-            result.append(self._render(related))
+            blocks.append(self._related_packages_header())
+            blocks[-1].append(self._render(related))
         if decl := option.get('declarations'):
-            result += self._render_decl_def("Declared by", decl)
+            blocks.append(self._render_decl_def("Declared by", decl))
         if defs := option.get('definitions'):
-            result += self._render_decl_def("Defined by", defs)
+            blocks.append(self._render_decl_def("Defined by", defs))
 
-        return result
+        for part in [ p for p in blocks[0:-1] if p ]:
+            part.append(self.__option_block_separator__)
+
+        return [ l for part in blocks for l in part ]
 
     def add_options(self, options: dict[str, Any]) -> None:
         for (name, option) in options.items():
@@ -168,6 +175,7 @@ class OptionsDocBookRenderer(DocBookRenderer):
 
 class DocBookConverter(BaseConverter):
     __renderer__ = OptionsDocBookRenderer
+    __option_block_separator__ = ""
 
     def _render_code(self, option: dict[str, Any], key: str) -> list[str]:
         if lit := option_is(option, key, 'literalDocBook'):

From b2a5b4d7899138eb9cc8af31fc1f296af582a4ce Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Tue, 7 Feb 2023 07:14:12 +0100
Subject: [PATCH 144/176] nixos-render-docs: move list-is-compact attr to meta

Token.attr is a dict[str, str | int | float], meta has no restriction on
the value type. attrs is ostensibly meant for html attributes, meta for
any information whatsoever.
---
 .../src/nixos_render_docs/docbook.py          |  4 ++--
 .../src/nixos_render_docs/md.py               |  2 +-
 .../src/nixos_render_docs/options.py          |  4 ++--
 .../nixos-render-docs/src/tests/test_lists.py | 22 ++++++++++---------
 4 files changed, 17 insertions(+), 15 deletions(-)

diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/docbook.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/docbook.py
index bad36e57a2f3..28c4425d8c08 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/docbook.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/docbook.py
@@ -103,7 +103,7 @@ class DocBookRenderer(Renderer):
     # HACK open and close para for docbook change size. remove soon.
     def bullet_list_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
                          env: MutableMapping[str, Any]) -> str:
-        spacing = ' spacing="compact"' if token.attrs.get('compact', False) else ''
+        spacing = ' spacing="compact"' if token.meta.get('compact', False) else ''
         return f"<para><itemizedlist{spacing}>\n"
     def bullet_list_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
                           env: MutableMapping[str, Any]) -> str:
@@ -218,7 +218,7 @@ class DocBookRenderer(Renderer):
     def ordered_list_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
                           env: MutableMapping[str, Any]) -> str:
         start = f' startingnumber="{token.attrs["start"]}"' if 'start' in token.attrs else ""
-        spacing = ' spacing="compact"' if token.attrs.get('compact', False) else ''
+        spacing = ' spacing="compact"' if token.meta.get('compact', False) else ''
         return f"<orderedlist{start}{spacing}>"
     def ordered_list_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
                            env: MutableMapping[str, Any]) -> str:
diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/md.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/md.py
index 104a43d9edfd..16e473e97ade 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/md.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/md.py
@@ -376,7 +376,7 @@ class Converter(ABC):
                 end_stack.append([i, cast(int, tokens[i].attrs.get('start', 1))])
             elif tokens[i].type in [ 'bullet_list_close', 'ordered_list_close' ]:
                 (idx, compact) = wide_stack.pop()
-                tokens[idx].attrs['compact'] = compact
+                tokens[idx].meta['compact'] = compact
                 (idx, end) = end_stack.pop()
                 if tokens[i].type == 'ordered_list_close':
                     tokens[idx].meta['end'] = end - 1
diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
index 8550dc26809d..68c753507e99 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
@@ -166,11 +166,11 @@ class OptionsDocBookRenderer(DocBookRenderer):
     # TODO keep optionsDocBook diff small. remove soon if rendering is still good.
     def ordered_list_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
                           env: MutableMapping[str, Any]) -> str:
-        token.attrs['compact'] = False
+        token.meta['compact'] = False
         return super().ordered_list_open(token, tokens, i, options, env)
     def bullet_list_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
                          env: MutableMapping[str, Any]) -> str:
-        token.attrs['compact'] = False
+        token.meta['compact'] = False
         return super().bullet_list_open(token, tokens, i, options, env)
 
 class DocBookConverter(BaseConverter):
diff --git a/pkgs/tools/nix/nixos-render-docs/src/tests/test_lists.py b/pkgs/tools/nix/nixos-render-docs/src/tests/test_lists.py
index af284c9d3abe..660c410a85cc 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/tests/test_lists.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/tests/test_lists.py
@@ -14,8 +14,9 @@ def test_list_wide(ordered: bool) -> None:
     )
     c = Converter({})
     meta = { 'end': int(e2[:-1]) } if ordered else {}
+    meta['compact'] = False
     assert c._parse(f"{e1} a\n\n{e2} b") == [
-        Token(type=f'{t}_list_open', tag=tag, nesting=1, attrs={'compact': False}, map=[0, 3], level=0,
+        Token(type=f'{t}_list_open', tag=tag, nesting=1, attrs={}, map=[0, 3], level=0,
               children=None, content='', markup=m, info='', meta=meta, block=True, hidden=False),
         Token(type='list_item_open', tag='li', nesting=1, attrs={}, map=[0, 2], level=1, children=None,
               content='', markup=m, info=i1, meta={}, block=True, hidden=False),
@@ -56,8 +57,9 @@ def test_list_narrow(ordered: bool) -> None:
     )
     c = Converter({})
     meta = { 'end': int(e2[:-1]) } if ordered else {}
+    meta['compact'] = True
     assert c._parse(f"{e1} a\n{e2} b") == [
-        Token(type=f'{t}_list_open', tag=tag, nesting=1, attrs={'compact': True}, map=[0, 2], level=0,
+        Token(type=f'{t}_list_open', tag=tag, nesting=1, attrs={}, map=[0, 2], level=0,
               children=None, content='', markup=m, info='', meta=meta, block=True, hidden=False),
         Token(type='list_item_open', tag='li', nesting=1, attrs={}, map=[0, 1], level=1, children=None,
               content='', markup=m, info=i1, meta={}, block=True, hidden=False),
@@ -91,12 +93,12 @@ def test_list_narrow(ordered: bool) -> None:
               content='', markup=m, info='', meta={}, block=True, hidden=False)
     ]
     assert c._parse(f"{e1} - a\n{e2} b") == [
-        Token(type=f'{t}_list_open', tag=tag, nesting=1, attrs={'compact': True}, map=[0, 2], level=0,
+        Token(type=f'{t}_list_open', tag=tag, nesting=1, attrs={}, map=[0, 2], level=0,
               children=None, content='', markup=m, info='', meta=meta, block=True, hidden=False),
         Token(type='list_item_open', tag='li', nesting=1, attrs={}, map=[0, 1], level=1, children=None,
               content='', markup=m, info=i1, meta={}, block=True, hidden=False),
-        Token(type='bullet_list_open', tag='ul', nesting=1, attrs={'compact': True}, map=[0, 1], level=2,
-              children=None, content='', markup='-', info='', meta={}, block=True, hidden=False),
+        Token(type='bullet_list_open', tag='ul', nesting=1, attrs={}, map=[0, 1], level=2,
+              children=None, content='', markup='-', info='', meta={'compact': True}, block=True, hidden=False),
         Token(type='list_item_open', tag='li', nesting=1, attrs={}, map=[0, 1], level=3, children=None,
               content='', markup='-', info='', meta={}, block=True, hidden=False),
         Token(type='paragraph_open', tag='p', nesting=1, attrs={}, map=[0, 1], level=4, children=None,
@@ -133,12 +135,12 @@ def test_list_narrow(ordered: bool) -> None:
               content='', markup=m, info='', meta={}, block=True, hidden=False)
     ]
     assert c._parse(f"{e1} - a\n{e2} - b") == [
-        Token(type=f'{t}_list_open', tag=tag, nesting=1, attrs={'compact': True}, map=[0, 2], level=0,
+        Token(type=f'{t}_list_open', tag=tag, nesting=1, attrs={}, map=[0, 2], level=0,
               children=None, content='', markup=m, info='', meta=meta, block=True, hidden=False),
         Token(type='list_item_open', tag='li', nesting=1, attrs={}, map=[0, 1], level=1, children=None,
               content='', markup=m, info=i1, meta={}, block=True, hidden=False),
-        Token(type='bullet_list_open', tag='ul', nesting=1, attrs={'compact': True}, map=[0, 1], level=2,
-              children=None, content='', markup='-', info='', meta={}, block=True, hidden=False),
+        Token(type='bullet_list_open', tag='ul', nesting=1, attrs={}, map=[0, 1], level=2,
+              children=None, content='', markup='-', info='', meta={'compact': True}, block=True, hidden=False),
         Token(type='list_item_open', tag='li', nesting=1, attrs={}, map=[0, 1], level=3, children=None,
               content='', markup='-', info='', meta={}, block=True, hidden=False),
         Token(type='paragraph_open', tag='p', nesting=1, attrs={}, map=[0, 1], level=4, children=None,
@@ -159,8 +161,8 @@ def test_list_narrow(ordered: bool) -> None:
               content='', markup=m, info='', meta={}, block=True, hidden=False),
         Token(type='list_item_open', tag='li', nesting=1, attrs={}, map=[1, 2], level=1, children=None,
               content='', markup=m, info=i2, meta={}, block=True, hidden=False),
-        Token(type='bullet_list_open', tag='ul', nesting=1, attrs={'compact': True}, map=[1, 2], level=2,
-              children=None, content='', markup='-', info='', meta={}, block=True, hidden=False),
+        Token(type='bullet_list_open', tag='ul', nesting=1, attrs={}, map=[1, 2], level=2,
+              children=None, content='', markup='-', info='', meta={'compact': True}, block=True, hidden=False),
         Token(type='list_item_open', tag='li', nesting=1, attrs={}, map=[1, 2], level=3, children=None,
               content='', markup='-', info='', meta={}, block=True, hidden=False),
         Token(type='paragraph_open', tag='p', nesting=1, attrs={}, map=[1, 2], level=4, children=None,

From 56f1d99b161a8665b7df57984af5f76dc842be9b Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Thu, 2 Feb 2023 06:05:34 +0100
Subject: [PATCH 145/176] nixos-render-docs: factor out sorting of options list

---
 .../src/nixos_render_docs/options.py               | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
index 68c753507e99..9603b5726897 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
@@ -40,6 +40,12 @@ class BaseConverter(Converter):
         self._id_prefix = id_prefix
         self._markdown_by_default = markdown_by_default
 
+    def _sorted_options(self) -> list[tuple[str, RenderedOption]]:
+        keys = list(self._options.keys())
+        keys.sort(key=lambda opt: [ (0 if p.startswith("enable") else 1 if p.startswith("package") else 2, p)
+                                    for p in self._options[opt].loc ])
+        return [ (k, self._options[k]) for k in keys ]
+
     def _format_decl_def_loc(self, loc: OptionLoc) -> tuple[Optional[str], str]:
         # locations can be either plain strings (specific to nixpkgs), or attrsets
         # { name = "foo/bar.nix"; url = "https://github.com/....."; }
@@ -215,10 +221,6 @@ class DocBookConverter(BaseConverter):
         return [ "</simplelist>" ]
 
     def finalize(self) -> str:
-        keys = list(self._options.keys())
-        keys.sort(key=lambda opt: [ (0 if p.startswith("enable") else 1 if p.startswith("package") else 2, p)
-                                    for p in self._options[opt].loc ])
-
         result = []
 
         result.append('<?xml version="1.0" encoding="UTF-8"?>')
@@ -235,7 +237,7 @@ class DocBookConverter(BaseConverter):
             f'              xml:id="{self._varlist_id}">',
         ]
 
-        for name in keys:
+        for (name, opt) in self._sorted_options():
             id = make_xml_id(self._id_prefix + name)
             result += [
                 "<varlistentry>",
@@ -244,7 +246,7 @@ class DocBookConverter(BaseConverter):
                  f"<option>{escape(name)}</option></term>"),
                 "<listitem>"
             ]
-            result += self._options[name].lines
+            result += opt.lines
             result += [
                 "</listitem>",
                 "</varlistentry>"

From 10a4f0daca909e580df687426ced8e0d39056297 Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Tue, 31 Jan 2023 04:19:28 +0100
Subject: [PATCH 146/176] nixos-render-docs: add options manpage converter

mdoc is just too slow to render on groff, and semantic markup doesn't
help us any for generated pages.

this produces a lot of changes to configuration.nix.5, but only few
rendering changes. most of those seem to be place losing a space where
docbook emitted roff code that did not faithfully represent the input
text, though a few places also gained space where docbook dropped them.
notably we also don't need the compatibility code docbook-xsl emitted
because that problem was fixed over a decade ago.

this will handle block quotes, which the docbook stylesheets turned into
a mess of roff requests that ended up showing up in the output instead
of being processed.
---
 nixos/doc/manual/default.nix                  |  35 +-
 .../src/nixos_render_docs/manpage.py          | 316 ++++++++++++++++++
 .../src/nixos_render_docs/md.py               |   4 +-
 .../src/nixos_render_docs/options.py          | 141 +++++++-
 .../src/tests/test_manpage.py                 |  29 ++
 .../src/tests/test_options.py                 |   2 +-
 6 files changed, 505 insertions(+), 22 deletions(-)
 create mode 100644 pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
 create mode 100644 pkgs/tools/nix/nixos-render-docs/src/tests/test_manpage.py

diff --git a/nixos/doc/manual/default.nix b/nixos/doc/manual/default.nix
index 342834e257a2..9dab1738abed 100644
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@@ -21,6 +21,8 @@ let
     withManOptDedupPatch = true;
   };
 
+  manpageUrls = pkgs.path + "/doc/manpage-urls.json";
+
   # We need to strip references to /nix/store/* from options,
   # including any `extraSources` if some modules came from elsewhere,
   # or else the build will fail.
@@ -72,7 +74,7 @@ let
     nativeBuildInputs = [ pkgs.nixos-render-docs ];
   } ''
     nixos-render-docs manual docbook \
-      --manpage-urls ${pkgs.path + "/doc/manpage-urls.json"} \
+      --manpage-urls ${manpageUrls} \
       "$out" \
       --section \
         --section-id modules \
@@ -255,9 +257,12 @@ in rec {
   manpages = runCommand "nixos-manpages"
     { inherit sources;
       nativeBuildInputs = [
+        buildPackages.installShellFiles
+      ] ++ lib.optionals allowDocBook [
         buildPackages.libxml2.bin
         buildPackages.libxslt.bin
-        buildPackages.installShellFiles
+      ] ++ lib.optionals (! allowDocBook) [
+        buildPackages.nixos-render-docs
       ];
       allowedReferences = ["out"];
     }
@@ -265,14 +270,24 @@ in rec {
       # Generate manpages.
       mkdir -p $out/share/man/man8
       installManPage ${./manpages}/*
-      xsltproc --nonet \
-        --maxdepth 6000 \
-        --param man.output.in.separate.dir 1 \
-        --param man.output.base.dir "'$out/share/man/'" \
-        --param man.endnotes.are.numbered 0 \
-        --param man.break.after.slash 1 \
-        ${docbook_xsl_ns}/xml/xsl/docbook/manpages/docbook.xsl \
-        ${manual-combined}/man-pages-combined.xml
+      ${if allowDocBook
+        then ''
+          xsltproc --nonet \
+            --maxdepth 6000 \
+            --param man.output.in.separate.dir 1 \
+            --param man.output.base.dir "'$out/share/man/'" \
+            --param man.endnotes.are.numbered 0 \
+            --param man.break.after.slash 1 \
+            ${docbook_xsl_ns}/xml/xsl/docbook/manpages/docbook.xsl \
+            ${manual-combined}/man-pages-combined.xml
+        ''
+        else ''
+          mkdir -p $out/share/man/man5
+          nixos-render-docs options manpage \
+            --revision ${lib.escapeShellArg revision} \
+            ${optionsJSON}/share/doc/nixos/options.json \
+            $out/share/man/man5/configuration.nix.5
+        ''}
     '';
 
 }
diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
new file mode 100644
index 000000000000..8188cfb9871b
--- /dev/null
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
@@ -0,0 +1,316 @@
+from collections.abc import Mapping, MutableMapping, Sequence
+from dataclasses import dataclass
+from typing import Any, cast, Iterable, Optional
+
+import re
+
+import markdown_it
+from markdown_it.token import Token
+from markdown_it.utils import OptionsDict
+
+from .md import Renderer
+
+# roff(7) says:
+#
+# > roff documents may contain only graphable 7-bit ASCII characters, the space character,
+# > and, in certain circumstances, the tab character. The backslash character ‘\’ indicates
+# > the start of an escape sequence […]
+#
+# mandoc_char(7) says about the `'~^ characters:
+#
+# > In prose, this automatic substitution is often desirable; but when these characters have
+# > to be displayed as plain ASCII characters, for example in source code samples, they require
+# > escaping to render as follows:
+#
+# since we don't want these to be touched anywhere (because markdown will do all substituations
+# we want to have) we'll escape those as well. we also escape " (macro metacharacter), - (might
+# turn into a typographic hyphen), and . (roff request marker at SOL, changes spacing semantics
+# at EOL). groff additionally does not allow unicode escapes for codepoints below U+0080, so
+# those need "proper" roff escapes/replacements instead.
+_roff_unicode = re.compile(r'''[^\n !#$%&()*+,\-./0-9:;<=>?@A-Z[\\\]_a-z{|}]''', re.ASCII)
+_roff_escapes = {
+    ord('"'): "\\(dq",
+    ord("'"): "\\(aq",
+    ord('-'): "\\-",
+    ord('.'): "\\&.",
+    ord('\\'): "\\e",
+    ord('^'): "\\(ha",
+    ord('`'): "\\(ga",
+    ord('~'): "\\(ti",
+    ord('…'): "...", # TODO docbook compat, remove later
+}
+def man_escape(s: str) -> str:
+    s = s.translate(_roff_escapes)
+    return _roff_unicode.sub(lambda m: f"\\[u{ord(m[0]):04X}]", s)
+
+# remove leading and trailing spaces from links and condense multiple consecutive spaces
+# into a single space for presentation parity with html. this is currently easiest with
+# regex postprocessing and some marker characters. since we don't want to drop spaces
+# from code blocks we will have to specially protect *inline* code (luckily not block code)
+# so normalization can turn the spaces inside it into regular spaces again.
+_normalize_space_re = re.compile(r'''\u0000 < *| *>\u0000 |(?<= ) +''')
+def _normalize_space(s: str) -> str:
+    return _normalize_space_re.sub("", s).replace("\0p", " ")
+
+def _protect_spaces(s: str) -> str:
+    return s.replace(" ", "\0p")
+
+@dataclass(kw_only=True)
+class List:
+    width: int
+    next_idx: Optional[int] = None
+    compact: bool
+    first_item_seen: bool = False
+
+# this renderer assumed that it produces a set of lines as output, and that those lines will
+# be pasted as-is into a larger output. no prefixing or suffixing is allowed for correctness.
+#
+# NOTE that we output exclusively physical markup. this is because we have to use the older
+# mandoc(7) format instead of the newer mdoc(7) format due to limitations in groff: while
+# using mdoc in groff works fine it is not a native format and thus very slow to render on
+# manpages as large as configuration.nix.5. mandoc(1) renders both really quickly, but with
+# groff being our predominant manpage viewer we have to optimize for groff instead.
+#
+# while we do use only physical markup (adjusting indentation with .RS and .RE, adding
+# vertical spacing with .sp, \f[BIRP] escapes for bold/italic/roman/$previous font, \h for
+# horizontal motion in a line) we do attempt to copy the style of mdoc(7) semantic requests
+# as appropriate for each markup element.
+class ManpageRenderer(Renderer):
+    __output__ = "man"
+
+    _href_targets: dict[str, str]
+
+    _do_parbreak_stack: list[bool]
+    _list_stack: list[List]
+    _font_stack: list[str]
+
+    def __init__(self, manpage_urls: Mapping[str, str], href_targets: dict[str, str],
+                 parser: Optional[markdown_it.MarkdownIt] = None):
+        super().__init__(manpage_urls, parser)
+        self._href_targets = href_targets
+        self._do_parbreak_stack = []
+        self._list_stack = []
+        self._font_stack = []
+
+    def _join_block(self, ls: Iterable[str]) -> str:
+        return "\n".join([ l for l in ls if len(l) ])
+    def _join_inline(self, ls: Iterable[str]) -> str:
+        return _normalize_space(super()._join_inline(ls))
+
+    def _enter_block(self) -> None:
+        self._do_parbreak_stack.append(False)
+    def _leave_block(self) -> None:
+        self._do_parbreak_stack.pop()
+        self._do_parbreak_stack[-1] = True
+    def _maybe_parbreak(self, suffix: str = "") -> str:
+        result = f".sp{suffix}" if self._do_parbreak_stack[-1] else ""
+        self._do_parbreak_stack[-1] = True
+        return result
+
+    def _admonition_open(self, kind: str) -> str:
+        self._enter_block()
+        return (
+            '.sp\n'
+            '.RS 4\n'
+            f'\\fB{kind}\\fP\n'
+            '.br'
+        )
+    def _admonition_close(self) -> str:
+        self._leave_block()
+        return ".RE"
+
+    def render(self, tokens: Sequence[Token], options: OptionsDict,
+               env: MutableMapping[str, Any]) -> str:
+        self._do_parbreak_stack = [ False ]
+        self._font_stack = [ "\\fR" ]
+        return super().render(tokens, options, env)
+
+    def text(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+             env: MutableMapping[str, Any]) -> str:
+        return man_escape(token.content)
+    def paragraph_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                       env: MutableMapping[str, Any]) -> str:
+        return self._maybe_parbreak()
+    def paragraph_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                        env: MutableMapping[str, Any]) -> str:
+        return ""
+    def hardbreak(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                  env: MutableMapping[str, Any]) -> str:
+        return ".br"
+    def softbreak(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                  env: MutableMapping[str, Any]) -> str:
+        return " "
+    def code_inline(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                    env: MutableMapping[str, Any]) -> str:
+        return _protect_spaces(man_escape(token.content))
+    def code_block(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                   env: MutableMapping[str, Any]) -> str:
+        return self.fence(token, tokens, i, options, env)
+    def link_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                  env: MutableMapping[str, Any]) -> str:
+        href = cast(str, token.attrs['href'])
+        (text, font) = ("", "\\fB")
+        if tokens[i + 1].type == 'link_close' and href in self._href_targets:
+            # TODO error or warning if the target can't be resolved
+            text = self._href_targets[href]
+        elif href in self._href_targets:
+            font = "\\fR" # TODO docbook renders these links differently for some reason
+        self._font_stack.append(font)
+        return f"{font}{text}\0 <"
+    def link_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                   env: MutableMapping[str, Any]) -> str:
+        self._font_stack.pop()
+        return f">\0 {self._font_stack[-1]}"
+    def list_item_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                       env: MutableMapping[str, Any]) -> str:
+        self._enter_block()
+        lst = self._list_stack[-1]
+        maybe_space = '' if not lst.first_item_seen else '.sp\n'
+        lst.first_item_seen = True
+        head = "•"
+        if lst.next_idx is not None:
+            head = f" {lst.next_idx}."
+            lst.next_idx += 1
+        return (
+            f'{maybe_space}'
+            f'.RS {lst.width}\n'
+            f"\\h'-{lst.width}'{man_escape(head)}\\h'{lst.width - len(head)}'\\c"
+        )
+    def list_item_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                        env: MutableMapping[str, Any]) -> str:
+        self._leave_block()
+        return ".RE"
+    def bullet_list_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                         env: MutableMapping[str, Any]) -> str:
+        self._list_stack.append(List(width=4, compact=False))
+        return self._maybe_parbreak()
+    def bullet_list_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                          env: MutableMapping[str, Any]) -> str:
+        self._list_stack.pop()
+        return ""
+    def em_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                env: MutableMapping[str, Any]) -> str:
+        self._font_stack.append("\\fI")
+        return "\\fI"
+    def em_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                 env: MutableMapping[str, Any]) -> str:
+        self._font_stack.pop()
+        return self._font_stack[-1]
+    def strong_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                    env: MutableMapping[str, Any]) -> str:
+        self._font_stack.append("\\fB")
+        return "\\fB"
+    def strong_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                     env: MutableMapping[str, Any]) -> str:
+        self._font_stack.pop()
+        return self._font_stack[-1]
+    def fence(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+              env: MutableMapping[str, Any]) -> str:
+        s = man_escape(token.content).rstrip('\n')
+        return (
+            '.sp\n'
+            '.RS 4\n'
+            '.nf\n'
+            f'{s}\n'
+            '.fi\n'
+            '.RE'
+        )
+    def blockquote_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                        env: MutableMapping[str, Any]) -> str:
+        maybe_par = self._maybe_parbreak("\n")
+        self._enter_block()
+        return (
+            f"{maybe_par}"
+            ".RS 4\n"
+            f"\\h'-3'\\fI\\(lq\\(rq\\fP\\h'1'\\c"
+        )
+    def blockquote_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                         env: MutableMapping[str, Any]) -> str:
+        self._leave_block()
+        return ".RE"
+    def note_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                  env: MutableMapping[str, Any]) -> str:
+        return self._admonition_open("Note")
+    def note_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                   env: MutableMapping[str, Any]) -> str:
+        return self._admonition_close()
+    def caution_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                     env: MutableMapping[str, Any]) -> str:
+        return self._admonition_open( "Caution")
+    def caution_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                      env: MutableMapping[str, Any]) -> str:
+        return self._admonition_close()
+    def important_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                       env: MutableMapping[str, Any]) -> str:
+        return self._admonition_open( "Important")
+    def important_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                        env: MutableMapping[str, Any]) -> str:
+        return self._admonition_close()
+    def tip_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                 env: MutableMapping[str, Any]) -> str:
+        return self._admonition_open( "Tip")
+    def tip_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                  env: MutableMapping[str, Any]) -> str:
+        return self._admonition_close()
+    def warning_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                     env: MutableMapping[str, Any]) -> str:
+        return self._admonition_open( "Warning")
+    def warning_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                      env: MutableMapping[str, Any]) -> str:
+        return self._admonition_close()
+    def dl_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                env: MutableMapping[str, Any]) -> str:
+        return ""
+    def dl_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                 env: MutableMapping[str, Any]) -> str:
+        return ""
+    def dt_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                env: MutableMapping[str, Any]) -> str:
+        return ".PP"
+    def dt_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                 env: MutableMapping[str, Any]) -> str:
+        return ""
+    def dd_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                env: MutableMapping[str, Any]) -> str:
+        self._enter_block()
+        return ".RS 4"
+    def dd_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                 env: MutableMapping[str, Any]) -> str:
+        self._leave_block()
+        return ".RE"
+    def myst_role(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                  env: MutableMapping[str, Any]) -> str:
+        if token.meta['name'] in [ 'command', 'env', 'option' ]:
+            return f'\\fB{man_escape(token.content)}\\fP'
+        elif token.meta['name'] == 'file':
+            return f'{man_escape(token.content)}'
+        elif token.meta['name'] == 'var':
+            return f'\\fI{man_escape(token.content)}\\fP'
+        elif token.meta['name'] == 'manpage':
+            [page, section] = [ s.strip() for s in token.content.rsplit('(', 1) ]
+            section = section[:-1]
+            return f'\\fB{man_escape(page)}\\fP\\fR({man_escape(section)})\\fP'
+        else:
+            raise NotImplementedError("md node not supported yet", token)
+    def inline_anchor(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                      env: MutableMapping[str, Any]) -> str:
+        return "" # mdoc knows no anchors
+    def heading_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                     env: MutableMapping[str, Any]) -> str:
+        raise RuntimeError("md token not supported in manpages", token)
+    def heading_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                      env: MutableMapping[str, Any]) -> str:
+        raise RuntimeError("md token not supported in manpages", token)
+    def ordered_list_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                          env: MutableMapping[str, Any]) -> str:
+        # max item head width for a number, a dot, and one leading space and one trailing space
+        width = 3 + len(str(cast(int, token.meta['end'])))
+        self._list_stack.append(
+            List(width    = width,
+                 next_idx = cast(int, token.attrs.get('start', 1)),
+                 compact  = bool(token.meta['compact'])))
+        return self._maybe_parbreak()
+    def ordered_list_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
+                           env: MutableMapping[str, Any]) -> str:
+        self._list_stack.pop()
+        return ""
diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/md.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/md.py
index 16e473e97ade..5bc16e65933c 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/md.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/md.py
@@ -391,7 +391,7 @@ class Converter(ABC):
         tokens = self._md.parse(src, env if env is not None else {})
         return self._post_parse(tokens)
 
-    def _render(self, src: str) -> str:
-        env: dict[str, Any] = {}
+    def _render(self, src: str, env: Optional[MutableMapping[str, Any]] = None) -> str:
+        env = {} if env is None else env
         tokens = self._parse(src, env)
         return self._md.renderer.render(tokens, self._md.options, env) # type: ignore[no-any-return]
diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
index 9603b5726897..364fb6dc2c3a 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
@@ -2,13 +2,16 @@ import argparse
 import json
 
 from abc import abstractmethod
-from collections.abc import MutableMapping, Sequence
+from collections.abc import Mapping, MutableMapping, Sequence
 from markdown_it.utils import OptionsDict
 from markdown_it.token import Token
 from typing import Any, Optional
 from xml.sax.saxutils import escape, quoteattr
 
+import markdown_it
+
 from .docbook import DocBookRenderer, make_xml_id
+from .manpage import ManpageRenderer, man_escape
 from .md import Converter, md_escape
 from .types import OptionLoc, Option, RenderedOption
 
@@ -28,16 +31,10 @@ class BaseConverter(Converter):
 
     def __init__(self, manpage_urls: dict[str, str],
                  revision: str,
-                 document_type: str,
-                 varlist_id: str,
-                 id_prefix: str,
                  markdown_by_default: bool):
         super().__init__(manpage_urls)
         self._options = {}
         self._revision = revision
-        self._document_type = document_type
-        self._varlist_id = varlist_id
-        self._id_prefix = id_prefix
         self._markdown_by_default = markdown_by_default
 
     def _sorted_options(self) -> list[tuple[str, RenderedOption]]:
@@ -183,6 +180,17 @@ class DocBookConverter(BaseConverter):
     __renderer__ = OptionsDocBookRenderer
     __option_block_separator__ = ""
 
+    def __init__(self, manpage_urls: dict[str, str],
+                 revision: str,
+                 markdown_by_default: bool,
+                 document_type: str,
+                 varlist_id: str,
+                 id_prefix: str):
+        super().__init__(manpage_urls, revision, markdown_by_default)
+        self._document_type = document_type
+        self._varlist_id = varlist_id
+        self._id_prefix = id_prefix
+
     def _render_code(self, option: dict[str, Any], key: str) -> list[str]:
         if lit := option_is(option, key, 'literalDocBook'):
             return [ f"<para><emphasis>{key.capitalize()}:</emphasis> {lit['text']}</para>" ]
@@ -258,6 +266,101 @@ class DocBookConverter(BaseConverter):
 
         return "\n".join(result)
 
+class OptionsManpageRenderer(ManpageRenderer):
+    pass
+
+class ManpageConverter(BaseConverter):
+    def __renderer__(self, manpage_urls: Mapping[str, str],
+                     parser: Optional[markdown_it.MarkdownIt] = None) -> OptionsManpageRenderer:
+        return OptionsManpageRenderer(manpage_urls, self._options_by_id, parser)
+
+    __option_block_separator__ = ".sp"
+
+    _options_by_id: dict[str, str]
+
+    def __init__(self, revision: str, markdown_by_default: bool):
+        self._options_by_id = {}
+        super().__init__({}, revision, markdown_by_default)
+
+    def add_options(self, options: dict[str, Any]) -> None:
+        for (k, v) in options.items():
+            self._options_by_id[f'#{make_xml_id(f"opt-{k}")}'] = k
+        return super().add_options(options)
+
+    def _render_code(self, option: dict[str, Any], key: str) -> list[str]:
+        if lit := option_is(option, key, 'literalDocBook'):
+            raise RuntimeError("can't render manpages in the presence of docbook")
+        else:
+            return super()._render_code(option, key)
+
+    def _render_description(self, desc: str | dict[str, Any]) -> list[str]:
+        if isinstance(desc, str) and not self._markdown_by_default:
+            raise RuntimeError("can't render manpages in the presence of docbook")
+        else:
+            return super()._render_description(desc)
+
+    def _related_packages_header(self) -> list[str]:
+        return [
+            '\\fIRelated packages:\\fP',
+            '.sp',
+        ]
+
+    def _decl_def_header(self, header: str) -> list[str]:
+        return [
+            f'\\fI{man_escape(header)}:\\fP',
+        ]
+
+    def _decl_def_entry(self, href: Optional[str], name: str) -> list[str]:
+        return [
+            '.RS 4',
+            f'\\fB{man_escape(name)}\\fP',
+            '.RE'
+        ]
+
+    def _decl_def_footer(self) -> list[str]:
+        return []
+
+    def finalize(self) -> str:
+        result = []
+
+        result += [
+            r'''.TH "CONFIGURATION\&.NIX" "5" "01/01/1980" "NixOS" "NixOS Reference Pages"''',
+            r'''.\" disable hyphenation''',
+            r'''.nh''',
+            r'''.\" disable justification (adjust text to left margin only)''',
+            r'''.ad l''',
+            r'''.\" enable line breaks after slashes''',
+            r'''.cflags 4 /''',
+            r'''.SH "NAME"''',
+            self._render('{file}`configuration.nix` - NixOS system configuration specification'),
+            r'''.SH "DESCRIPTION"''',
+            r'''.PP''',
+            self._render('The file {file}`/etc/nixos/configuration.nix` contains the '
+                        'declarative specification of your NixOS system configuration. '
+                        'The command {command}`nixos-rebuild` takes this file and '
+                        'realises the system configuration specified therein.'),
+            r'''.SH "OPTIONS"''',
+            r'''.PP''',
+            self._render('You can use the following options in {file}`configuration.nix`.'),
+        ]
+
+        for (name, opt) in self._sorted_options():
+            result += [
+                ".PP",
+                f"\\fB{man_escape(name)}\\fR",
+                ".RS 4",
+            ]
+            result += opt.lines
+            result.append(".RE")
+
+        result += [
+            r'''.SH "AUTHORS"''',
+            r'''.PP''',
+            r'''Eelco Dolstra and the Nixpkgs/NixOS contributors''',
+        ]
+
+        return "\n".join(result)
+
 def _build_cli_db(p: argparse.ArgumentParser) -> None:
     p.add_argument('--manpage-urls', required=True)
     p.add_argument('--revision', required=True)
@@ -268,27 +371,47 @@ def _build_cli_db(p: argparse.ArgumentParser) -> None:
     p.add_argument("infile")
     p.add_argument("outfile")
 
+def _build_cli_manpage(p: argparse.ArgumentParser) -> None:
+    p.add_argument('--revision', required=True)
+    p.add_argument("infile")
+    p.add_argument("outfile")
+
 def _run_cli_db(args: argparse.Namespace) -> None:
     with open(args.manpage_urls, 'r') as manpage_urls:
         md = DocBookConverter(
             json.load(manpage_urls),
             revision = args.revision,
+            markdown_by_default = args.markdown_by_default,
             document_type = args.document_type,
             varlist_id = args.varlist_id,
-            id_prefix = args.id_prefix,
-            markdown_by_default = args.markdown_by_default)
+            id_prefix = args.id_prefix)
 
         with open(args.infile, 'r') as f:
             md.add_options(json.load(f))
         with open(args.outfile, 'w') as f:
             f.write(md.finalize())
 
+def _run_cli_manpage(args: argparse.Namespace) -> None:
+    md = ManpageConverter(
+        revision = args.revision,
+        # manpage rendering only works if there's no docbook, so we can
+        # also set markdown_by_default with no ill effects.
+        markdown_by_default = True)
+
+    with open(args.infile, 'r') as f:
+        md.add_options(json.load(f))
+    with open(args.outfile, 'w') as f:
+        f.write(md.finalize())
+
 def build_cli(p: argparse.ArgumentParser) -> None:
     formats = p.add_subparsers(dest='format', required=True)
     _build_cli_db(formats.add_parser('docbook'))
+    _build_cli_manpage(formats.add_parser('manpage'))
 
 def run_cli(args: argparse.Namespace) -> None:
     if args.format == 'docbook':
         _run_cli_db(args)
+    elif args.format == 'manpage':
+        _run_cli_manpage(args)
     else:
         raise RuntimeError('format not hooked up', args)
diff --git a/pkgs/tools/nix/nixos-render-docs/src/tests/test_manpage.py b/pkgs/tools/nix/nixos-render-docs/src/tests/test_manpage.py
new file mode 100644
index 000000000000..0ccd33f1be41
--- /dev/null
+++ b/pkgs/tools/nix/nixos-render-docs/src/tests/test_manpage.py
@@ -0,0 +1,29 @@
+import nixos_render_docs
+
+from typing import Mapping, Optional
+
+import markdown_it
+
+class Converter(nixos_render_docs.md.Converter):
+    def __renderer__(self, manpage_urls: Mapping[str, str],
+                     parser: Optional[markdown_it.MarkdownIt] = None
+                     ) -> nixos_render_docs.manpage.ManpageRenderer:
+        return nixos_render_docs.manpage.ManpageRenderer(manpage_urls, self.options_by_id, parser)
+
+    def __init__(self, manpage_urls: Mapping[str, str], options_by_id: dict[str, str] = {}):
+        self.options_by_id = options_by_id
+        super().__init__(manpage_urls)
+
+def test_inline_code() -> None:
+    c = Converter({})
+    assert c._render("1  `x  a  x`  2") == "1 x  a  x 2"
+
+def test_fonts() -> None:
+    c = Converter({})
+    assert c._render("*a **b** c*") == "\\fIa \\fBb\\fI c\\fR"
+    assert c._render("*a [1 `2`](3) c*") == "\\fIa \\fB1 2\\fI c\\fR"
+
+def test_expand_link_targets() -> None:
+    c = Converter({}, { '#foo1': "bar", "#foo2": "bar" })
+    assert (c._render("[a](#foo1) [](#foo2) [b](#bar1) [](#bar2)") ==
+            "\\fRa\\fR \\fBbar\\fR \\fBb\\fR \\fB\\fR")
diff --git a/pkgs/tools/nix/nixos-render-docs/src/tests/test_options.py b/pkgs/tools/nix/nixos-render-docs/src/tests/test_options.py
index 5a02fabde0fb..9608ed639218 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/tests/test_options.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/tests/test_options.py
@@ -4,7 +4,7 @@ from markdown_it.token import Token
 import pytest
 
 def test_option_headings() -> None:
-    c = nixos_render_docs.options.DocBookConverter({}, 'local', 'none', 'vars', 'opt-', False)
+    c = nixos_render_docs.options.DocBookConverter({}, 'local', False, 'none', 'vars', 'opt-')
     with pytest.raises(RuntimeError) as exc:
         c._render("# foo")
     assert exc.value.args[0] == 'md token not supported in options doc'

From 5c5dadd382c983cc626c930fc14df798f957d72c Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Thu, 2 Feb 2023 02:57:28 +0100
Subject: [PATCH 147/176] nixos-render-docs: support compact lists in manpages

most of the lists in option docs are actually compact, but docbook to
manpage processing always rendered them as non-compact. compactifying
these lists improves readability somewhat since most lists and their
contents are pretty short.
---
 .../nix/nixos-render-docs/src/nixos_render_docs/manpage.py    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
index 8188cfb9871b..b64e06a97df3 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
@@ -165,7 +165,7 @@ class ManpageRenderer(Renderer):
                        env: MutableMapping[str, Any]) -> str:
         self._enter_block()
         lst = self._list_stack[-1]
-        maybe_space = '' if not lst.first_item_seen else '.sp\n'
+        maybe_space = '' if lst.compact or not lst.first_item_seen else '.sp\n'
         lst.first_item_seen = True
         head = "•"
         if lst.next_idx is not None:
@@ -182,7 +182,7 @@ class ManpageRenderer(Renderer):
         return ".RE"
     def bullet_list_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
                          env: MutableMapping[str, Any]) -> str:
-        self._list_stack.append(List(width=4, compact=False))
+        self._list_stack.append(List(width=4, compact=bool(token.meta['compact'])))
         return self._maybe_parbreak()
     def bullet_list_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
                           env: MutableMapping[str, Any]) -> str:

From 3a3274231ef6b8febbf72b9e5fb04dc0b59aeaa2 Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Thu, 2 Feb 2023 04:14:08 +0100
Subject: [PATCH 148/176] nixos-render-docs: always render links bold in
 manpages

no reason to differentiate between links by source of their label. this
feature seems to be mostly used to change labels of links to other
options, but this should ultimately be done by auto-linking from
{option}`...`. at some point we may want to introduce a warning when
this pattern is encountered, but there's a lot to work out still before
we can do that.
---
 .../nixos-render-docs/src/nixos_render_docs/manpage.py    | 8 +++-----
 .../tools/nix/nixos-render-docs/src/tests/test_manpage.py | 2 +-
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
index b64e06a97df3..15fb258b4a0a 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
@@ -149,14 +149,12 @@ class ManpageRenderer(Renderer):
     def link_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
                   env: MutableMapping[str, Any]) -> str:
         href = cast(str, token.attrs['href'])
-        (text, font) = ("", "\\fB")
+        text = ""
         if tokens[i + 1].type == 'link_close' and href in self._href_targets:
             # TODO error or warning if the target can't be resolved
             text = self._href_targets[href]
-        elif href in self._href_targets:
-            font = "\\fR" # TODO docbook renders these links differently for some reason
-        self._font_stack.append(font)
-        return f"{font}{text}\0 <"
+        self._font_stack.append("\\fB")
+        return f"\\fB{text}\0 <"
     def link_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
                    env: MutableMapping[str, Any]) -> str:
         self._font_stack.pop()
diff --git a/pkgs/tools/nix/nixos-render-docs/src/tests/test_manpage.py b/pkgs/tools/nix/nixos-render-docs/src/tests/test_manpage.py
index 0ccd33f1be41..409c292fd5e4 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/tests/test_manpage.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/tests/test_manpage.py
@@ -26,4 +26,4 @@ def test_fonts() -> None:
 def test_expand_link_targets() -> None:
     c = Converter({}, { '#foo1': "bar", "#foo2": "bar" })
     assert (c._render("[a](#foo1) [](#foo2) [b](#bar1) [](#bar2)") ==
-            "\\fRa\\fR \\fBbar\\fR \\fBb\\fR \\fB\\fR")
+            "\\fBa\\fR \\fBbar\\fR \\fBb\\fR \\fB\\fR")

From f33e360f675949751c85bec50eb692ae1b74b8b3 Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Wed, 1 Feb 2023 06:24:38 +0100
Subject: [PATCH 149/176] nixos-render-docs: remove the ... escape in manpages

this is a holdover from docbook stylesheets. not really sure why they
did that.
---
 .../tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
index 15fb258b4a0a..8adae2c8a0b0 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
@@ -37,7 +37,6 @@ _roff_escapes = {
     ord('^'): "\\(ha",
     ord('`'): "\\(ga",
     ord('~'): "\\(ti",
-    ord('…'): "...", # TODO docbook compat, remove later
 }
 def man_escape(s: str) -> str:
     s = s.translate(_roff_escapes)

From 29252d1477dd224e88af915ff7e13cadd52838fb Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Wed, 1 Feb 2023 03:01:27 +0100
Subject: [PATCH 150/176] nixos-render-docs: add quotes to inline code in
 manpages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

other output types already have markings for inline code, manpages do
not. this can be somewhat confusing, so we'll do the least intrusive
thing: surrounding inline code blocks in ‘’. doing so separates inline
code from the rest of the text and is unlikely to collide with the
quoted contents. it's also what mdoc does with its Ql macro.
---
 .../nixos-render-docs/src/nixos_render_docs/manpage.py    | 8 +++++++-
 .../nixos-render-docs/src/nixos_render_docs/options.py    | 7 ++++++-
 .../tools/nix/nixos-render-docs/src/tests/test_manpage.py | 4 ++--
 3 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
index 8adae2c8a0b0..5a16884a67df 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
@@ -77,6 +77,11 @@ class List:
 class ManpageRenderer(Renderer):
     __output__ = "man"
 
+    # whether to emit mdoc .Ql equivalents for inline code or just the contents. this is
+    # mainly used by the options manpage converter to not emit extra quotes in defaults
+    # and examples where it's already clear from context that the following text is code.
+    inline_code_is_quoted: bool = True
+
     _href_targets: dict[str, str]
 
     _do_parbreak_stack: list[bool]
@@ -141,7 +146,8 @@ class ManpageRenderer(Renderer):
         return " "
     def code_inline(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
                     env: MutableMapping[str, Any]) -> str:
-        return _protect_spaces(man_escape(token.content))
+        s = _protect_spaces(man_escape(token.content))
+        return f"\\fR\\(oq{s}\\(cq\\fP" if self.inline_code_is_quoted else s
     def code_block(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
                    env: MutableMapping[str, Any]) -> str:
         return self.fence(token, tokens, i, options, env)
diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
index 364fb6dc2c3a..a613ada1e68b 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
@@ -291,7 +291,12 @@ class ManpageConverter(BaseConverter):
         if lit := option_is(option, key, 'literalDocBook'):
             raise RuntimeError("can't render manpages in the presence of docbook")
         else:
-            return super()._render_code(option, key)
+            assert isinstance(self._md.renderer, OptionsManpageRenderer)
+            try:
+                self._md.renderer.inline_code_is_quoted = False
+                return super()._render_code(option, key)
+            finally:
+                self._md.renderer.inline_code_is_quoted = True
 
     def _render_description(self, desc: str | dict[str, Any]) -> list[str]:
         if isinstance(desc, str) and not self._markdown_by_default:
diff --git a/pkgs/tools/nix/nixos-render-docs/src/tests/test_manpage.py b/pkgs/tools/nix/nixos-render-docs/src/tests/test_manpage.py
index 409c292fd5e4..5bd374dba406 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/tests/test_manpage.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/tests/test_manpage.py
@@ -16,12 +16,12 @@ class Converter(nixos_render_docs.md.Converter):
 
 def test_inline_code() -> None:
     c = Converter({})
-    assert c._render("1  `x  a  x`  2") == "1 x  a  x 2"
+    assert c._render("1  `x  a  x`  2") == "1 \\fR\\(oqx  a  x\\(cq\\fP 2"
 
 def test_fonts() -> None:
     c = Converter({})
     assert c._render("*a **b** c*") == "\\fIa \\fBb\\fI c\\fR"
-    assert c._render("*a [1 `2`](3) c*") == "\\fIa \\fB1 2\\fI c\\fR"
+    assert c._render("*a [1 `2`](3) c*") == "\\fIa \\fB1 \\fR\\(oq2\\(cq\\fP\\fI c\\fR"
 
 def test_expand_link_targets() -> None:
     c = Converter({}, { '#foo1': "bar", "#foo2": "bar" })

From 1e4bafdbc5dbdad9542be6aa42febb7766dea918 Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Wed, 1 Feb 2023 03:03:14 +0100
Subject: [PATCH 151/176] nixos-render-docs: style file literals in manpages

similar to inline code these were indistinguishale from other text.
render then in italic font instead, like mdoc .Pa does.
---
 .../nix/nixos-render-docs/src/nixos_render_docs/manpage.py    | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
index 5a16884a67df..29a2981e51b8 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
@@ -285,9 +285,7 @@ class ManpageRenderer(Renderer):
                   env: MutableMapping[str, Any]) -> str:
         if token.meta['name'] in [ 'command', 'env', 'option' ]:
             return f'\\fB{man_escape(token.content)}\\fP'
-        elif token.meta['name'] == 'file':
-            return f'{man_escape(token.content)}'
-        elif token.meta['name'] == 'var':
+        elif token.meta['name'] in [ 'file', 'var' ]:
             return f'\\fI{man_escape(token.content)}\\fP'
         elif token.meta['name'] == 'manpage':
             [page, section] = [ s.strip() for s in token.content.rsplit('(', 1) ]

From f47adfcb6f8bdb617c78579d51bc3e0dc25ac74a Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Wed, 1 Feb 2023 03:10:02 +0100
Subject: [PATCH 152/176] nixos-render-docs: make manpage deflists a little
 nicer

indent the entire list by 4, just like each definition is already
indented by 4. this matches rendering in html, which indents terms once
and indents definitions twice.
---
 .../nix/nixos-render-docs/src/nixos_render_docs/manpage.py    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
index 29a2981e51b8..d1cd8c95a7c7 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
@@ -263,10 +263,10 @@ class ManpageRenderer(Renderer):
         return self._admonition_close()
     def dl_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
                 env: MutableMapping[str, Any]) -> str:
-        return ""
+        return ".RS 4"
     def dl_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
                  env: MutableMapping[str, Any]) -> str:
-        return ""
+        return ".RE"
     def dt_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
                 env: MutableMapping[str, Any]) -> str:
         return ".PP"

From 3c7fd940ba22a735cfc267bb641e0bce4e23677e Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Fri, 3 Feb 2023 01:57:42 +0100
Subject: [PATCH 153/176] nixos-render-docs: indent and embolden list item
 heads in manpages

this matches what html outputs do more closely, and feels like it'll be
easier to read because it looks less like just another paragraph.
---
 .../nix/nixos-render-docs/src/nixos_render_docs/manpage.py    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
index d1cd8c95a7c7..c6836ade33be 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
@@ -172,12 +172,12 @@ class ManpageRenderer(Renderer):
         lst.first_item_seen = True
         head = "•"
         if lst.next_idx is not None:
-            head = f" {lst.next_idx}."
+            head = f"{lst.next_idx}."
             lst.next_idx += 1
         return (
             f'{maybe_space}'
             f'.RS {lst.width}\n'
-            f"\\h'-{lst.width}'{man_escape(head)}\\h'{lst.width - len(head)}'\\c"
+            f"\\h'-{len(head) + 1}'\\fB{man_escape(head)}\\fP\\h'1'\\c"
         )
     def list_item_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
                         env: MutableMapping[str, Any]) -> str:

From 78052a22cbd1d33a88b1a46461b3b7f7ad41ac63 Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Thu, 2 Feb 2023 06:15:59 +0100
Subject: [PATCH 154/176] nixos-render-docs: track links in manpages

for the longest time we completely dropped link targets in
configuration.nix.5.  let's stop doing this now and instead provide a
footnote for each link in a given option, numbered locally per option.

we will currently duplicate the link for <labelless-links> because it
makes it easier to get the collection of all links in a given option.
this may not be useful enough, so over time we might decide to drop the
footnotes for such links.
---
 .../src/nixos_render_docs/manpage.py          | 15 +++++++++-
 .../src/nixos_render_docs/options.py          | 30 ++++++++++++++++---
 .../src/nixos_render_docs/types.py            |  6 ++--
 .../src/tests/test_manpage.py                 | 14 +++++++++
 4 files changed, 58 insertions(+), 7 deletions(-)

diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
index c6836ade33be..24d0e8f3d699 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/manpage.py
@@ -81,9 +81,11 @@ class ManpageRenderer(Renderer):
     # mainly used by the options manpage converter to not emit extra quotes in defaults
     # and examples where it's already clear from context that the following text is code.
     inline_code_is_quoted: bool = True
+    link_footnotes: Optional[list[str]] = None
 
     _href_targets: dict[str, str]
 
+    _link_stack: list[str]
     _do_parbreak_stack: list[bool]
     _list_stack: list[List]
     _font_stack: list[str]
@@ -92,6 +94,7 @@ class ManpageRenderer(Renderer):
                  parser: Optional[markdown_it.MarkdownIt] = None):
         super().__init__(manpage_urls, parser)
         self._href_targets = href_targets
+        self._link_stack = []
         self._do_parbreak_stack = []
         self._list_stack = []
         self._font_stack = []
@@ -154,6 +157,7 @@ class ManpageRenderer(Renderer):
     def link_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
                   env: MutableMapping[str, Any]) -> str:
         href = cast(str, token.attrs['href'])
+        self._link_stack.append(href)
         text = ""
         if tokens[i + 1].type == 'link_close' and href in self._href_targets:
             # TODO error or warning if the target can't be resolved
@@ -162,8 +166,17 @@ class ManpageRenderer(Renderer):
         return f"\\fB{text}\0 <"
     def link_close(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
                    env: MutableMapping[str, Any]) -> str:
+        href = self._link_stack.pop()
+        text = ""
+        if self.link_footnotes is not None:
+            try:
+                idx = self.link_footnotes.index(href) + 1
+            except ValueError:
+                self.link_footnotes.append(href)
+                idx = len(self.link_footnotes)
+            text = "\\fR" + man_escape(f"[{idx}]")
         self._font_stack.pop()
-        return f">\0 {self._font_stack[-1]}"
+        return f">\0 {text}{self._font_stack[-1]}"
     def list_item_open(self, token: Token, tokens: Sequence[Token], i: int, options: OptionsDict,
                        env: MutableMapping[str, Any]) -> str:
         self._enter_block()
diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
index a613ada1e68b..95091d3cdd28 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/options.py
@@ -148,12 +148,15 @@ class BaseConverter(Converter):
 
         return [ l for part in blocks for l in part ]
 
+    def _render_option(self, name: str, option: dict[str, Any]) -> RenderedOption:
+        try:
+            return RenderedOption(option['loc'], self._convert_one(option))
+        except Exception as e:
+            raise Exception(f"Failed to render option {name}") from e
+
     def add_options(self, options: dict[str, Any]) -> None:
         for (name, option) in options.items():
-            try:
-                self._options[name] = RenderedOption(option['loc'], self._convert_one(option))
-            except Exception as e:
-                raise Exception(f"Failed to render option {name}") from e
+            self._options[name] = self._render_option(name, option)
 
     @abstractmethod
     def finalize(self) -> str: raise NotImplementedError()
@@ -277,11 +280,19 @@ class ManpageConverter(BaseConverter):
     __option_block_separator__ = ".sp"
 
     _options_by_id: dict[str, str]
+    _links_in_last_description: Optional[list[str]] = None
 
     def __init__(self, revision: str, markdown_by_default: bool):
         self._options_by_id = {}
         super().__init__({}, revision, markdown_by_default)
 
+    def _render_option(self, name: str, option: dict[str, Any]) -> RenderedOption:
+        assert isinstance(self._md.renderer, OptionsManpageRenderer)
+        links = self._md.renderer.link_footnotes = []
+        result = super()._render_option(name, option)
+        self._md.renderer.link_footnotes = None
+        return result._replace(links=links)
+
     def add_options(self, options: dict[str, Any]) -> None:
         for (k, v) in options.items():
             self._options_by_id[f'#{make_xml_id(f"opt-{k}")}'] = k
@@ -356,6 +367,17 @@ class ManpageConverter(BaseConverter):
                 ".RS 4",
             ]
             result += opt.lines
+            if links := opt.links:
+                result.append(self.__option_block_separator__)
+                md_links = ""
+                for i in range(0, len(links)):
+                    md_links += "\n" if i > 0 else ""
+                    if links[i].startswith('#opt-'):
+                        md_links += f"{i+1}. see the {{option}}`{self._options_by_id[links[i]]}` option"
+                    else:
+                        md_links += f"{i+1}. " + md_escape(links[i])
+                result.append(self._render(md_links))
+
             result.append(".RE")
 
         result += [
diff --git a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/types.py b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/types.py
index 7814b3a4854b..d20e056aacdc 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/types.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs/types.py
@@ -7,7 +7,9 @@ from markdown_it.utils import OptionsDict
 OptionLoc = str | dict[str, str]
 Option = dict[str, str | dict[str, str] | list[OptionLoc]]
 
-RenderedOption = NamedTuple('RenderedOption', [('loc', list[str]),
-                                               ('lines', list[str])])
+class RenderedOption(NamedTuple):
+    loc: list[str]
+    lines: list[str]
+    links: Optional[list[str]] = None
 
 RenderFn = Callable[[Token, Sequence[Token], int, OptionsDict, MutableMapping[str, Any]], str]
diff --git a/pkgs/tools/nix/nixos-render-docs/src/tests/test_manpage.py b/pkgs/tools/nix/nixos-render-docs/src/tests/test_manpage.py
index 5bd374dba406..92073edf557b 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/tests/test_manpage.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/tests/test_manpage.py
@@ -27,3 +27,17 @@ def test_expand_link_targets() -> None:
     c = Converter({}, { '#foo1': "bar", "#foo2": "bar" })
     assert (c._render("[a](#foo1) [](#foo2) [b](#bar1) [](#bar2)") ==
             "\\fBa\\fR \\fBbar\\fR \\fBb\\fR \\fB\\fR")
+
+def test_collect_links() -> None:
+    c = Converter({}, { '#foo': "bar" })
+    assert isinstance(c._md.renderer, nixos_render_docs.manpage.ManpageRenderer)
+    c._md.renderer.link_footnotes = []
+    assert c._render("[a](link1) [b](link2)") == "\\fBa\\fR[1]\\fR \\fBb\\fR[2]\\fR"
+    assert c._md.renderer.link_footnotes == ['link1', 'link2']
+
+def test_dedup_links() -> None:
+    c = Converter({}, { '#foo': "bar" })
+    assert isinstance(c._md.renderer, nixos_render_docs.manpage.ManpageRenderer)
+    c._md.renderer.link_footnotes = []
+    assert c._render("[a](link) [b](link)") == "\\fBa\\fR[1]\\fR \\fBb\\fR[1]\\fR"
+    assert c._md.renderer.link_footnotes == ['link']

From 702e1fc743cfe66f9ccb38ca7bfcc1f5aae8279b Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Sun, 5 Feb 2023 01:27:08 +0100
Subject: [PATCH 155/176] nixos-render-docs: add all-features manpage renderer
 test

now that the renderer produces the output we want to keep for the future
we can add a test that checks all of its features. this test notably
does not include markdown headings since we don't want to have those in
manpages (at least right now), but tests for other converters may add
headings for themselves.
---
 .../nixos-render-docs/src/tests/sample_md.py  |  62 ++++++++
 .../src/tests/test_manpage.py                 | 134 ++++++++++++++++++
 2 files changed, 196 insertions(+)
 create mode 100644 pkgs/tools/nix/nixos-render-docs/src/tests/sample_md.py

diff --git a/pkgs/tools/nix/nixos-render-docs/src/tests/sample_md.py b/pkgs/tools/nix/nixos-render-docs/src/tests/sample_md.py
new file mode 100644
index 000000000000..73a64fde8364
--- /dev/null
+++ b/pkgs/tools/nix/nixos-render-docs/src/tests/sample_md.py
@@ -0,0 +1,62 @@
+sample1 = """\
+:::: {.warning}
+foo
+::: {.note}
+nested
+:::
+::::
+
+[
+  multiline
+](link)
+
+{manpage}`man(1)` reference
+
+[some [nested]{#a} anchors]{#b}
+
+*emph* **strong** *nesting emph **and strong** and `code`*
+
+- wide bullet
+
+- list
+
+1. wide ordered
+
+2. list
+
+- narrow bullet
+- list
+
+1. narrow ordered
+2. list
+
+> quotes
+>> with *nesting*
+>>
+>>     nested code block
+>
+> - and lists
+> - ```
+>   containing code
+>   ```
+>
+> and more quote
+
+100. list starting at 100
+1. goes on
+
+deflist
+: > with a quote
+  > and stuff
+
+      code block
+
+  ```
+  fenced block
+  ```
+
+  text
+
+more stuff in same deflist
+: foo
+"""
diff --git a/pkgs/tools/nix/nixos-render-docs/src/tests/test_manpage.py b/pkgs/tools/nix/nixos-render-docs/src/tests/test_manpage.py
index 92073edf557b..fbfd21358a85 100644
--- a/pkgs/tools/nix/nixos-render-docs/src/tests/test_manpage.py
+++ b/pkgs/tools/nix/nixos-render-docs/src/tests/test_manpage.py
@@ -1,5 +1,7 @@
 import nixos_render_docs
 
+from sample_md import sample1
+
 from typing import Mapping, Optional
 
 import markdown_it
@@ -41,3 +43,135 @@ def test_dedup_links() -> None:
     c._md.renderer.link_footnotes = []
     assert c._render("[a](link) [b](link)") == "\\fBa\\fR[1]\\fR \\fBb\\fR[1]\\fR"
     assert c._md.renderer.link_footnotes == ['link']
+
+def test_full() -> None:
+    c = Converter({ 'man(1)': 'http://example.org' })
+    assert c._render(sample1) == """\
+.sp
+.RS 4
+\\fBWarning\\fP
+.br
+foo
+.sp
+.RS 4
+\\fBNote\\fP
+.br
+nested
+.RE
+.RE
+.sp
+\\fBmultiline\\fR
+.sp
+\\fBman\\fP\\fR(1)\\fP reference
+.sp
+some nested anchors
+.sp
+\\fIemph\\fR \\fBstrong\\fR \\fInesting emph \\fBand strong\\fI and \\fR\\(oqcode\\(cq\\fP\\fR
+.sp
+.RS 4
+\\h'-2'\\fB\\[u2022]\\fP\\h'1'\\c
+wide bullet
+.RE
+.sp
+.RS 4
+\\h'-2'\\fB\\[u2022]\\fP\\h'1'\\c
+list
+.RE
+.sp
+.RS 4
+\\h'-3'\\fB1\\&.\\fP\\h'1'\\c
+wide ordered
+.RE
+.sp
+.RS 4
+\\h'-3'\\fB2\\&.\\fP\\h'1'\\c
+list
+.RE
+.sp
+.RS 4
+\\h'-2'\\fB\\[u2022]\\fP\\h'1'\\c
+narrow bullet
+.RE
+.RS 4
+\\h'-2'\\fB\\[u2022]\\fP\\h'1'\\c
+list
+.RE
+.sp
+.RS 4
+\\h'-3'\\fB1\\&.\\fP\\h'1'\\c
+narrow ordered
+.RE
+.RS 4
+\\h'-3'\\fB2\\&.\\fP\\h'1'\\c
+list
+.RE
+.sp
+.RS 4
+\\h'-3'\\fI\\(lq\\(rq\\fP\\h'1'\\c
+quotes
+.sp
+.RS 4
+\\h'-3'\\fI\\(lq\\(rq\\fP\\h'1'\\c
+with \\fInesting\\fR
+.sp
+.RS 4
+.nf
+nested code block
+.fi
+.RE
+.RE
+.sp
+.RS 4
+\\h'-2'\\fB\\[u2022]\\fP\\h'1'\\c
+and lists
+.RE
+.RS 4
+\\h'-2'\\fB\\[u2022]\\fP\\h'1'\\c
+.sp
+.RS 4
+.nf
+containing code
+.fi
+.RE
+.RE
+.sp
+and more quote
+.RE
+.sp
+.RS 6
+\\h'-5'\\fB100\\&.\\fP\\h'1'\\c
+list starting at 100
+.RE
+.RS 6
+\\h'-5'\\fB101\\&.\\fP\\h'1'\\c
+goes on
+.RE
+.RS 4
+.PP
+deflist
+.RS 4
+.RS 4
+\\h'-3'\\fI\\(lq\\(rq\\fP\\h'1'\\c
+with a quote and stuff
+.RE
+.sp
+.RS 4
+.nf
+code block
+.fi
+.RE
+.sp
+.RS 4
+.nf
+fenced block
+.fi
+.RE
+.sp
+text
+.RE
+.PP
+more stuff in same deflist
+.RS 4
+foo
+.RE
+.RE"""

From 5e9d0077cdf4f6a360b27d17a3c3d5ebc127c44b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 14:29:32 +0000
Subject: [PATCH 156/176] python310Packages.azure-mgmt-datalake-store: 0.5.0 ->
 1.0.0

---
 .../python-modules/azure-mgmt-datalake-store/default.nix      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/azure-mgmt-datalake-store/default.nix b/pkgs/development/python-modules/azure-mgmt-datalake-store/default.nix
index b2b96ec2994e..18665f4dbb6e 100644
--- a/pkgs/development/python-modules/azure-mgmt-datalake-store/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-datalake-store/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-datalake-store";
-  version = "0.5.0";
+  version = "1.0.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "sha256-k3bTVJVmHRn4rMVgT2ewvFlJOxg1u8SA+aGVL5ABekw=";
+    sha256 = "sha256-GrmVK97M+iojevPLVTuLmfQRLxvrHtr9DRHymJvLYHE=";
   };
 
   propagatedBuildInputs = [

From cc08236d06867feba6f382ca30910fff8c27bfe0 Mon Sep 17 00:00:00 2001
From: Arjan Schrijver <github@anymore.nl>
Date: Wed, 8 Feb 2023 14:26:02 +0100
Subject: [PATCH 157/176] oh-my-posh: 13.8.0 -> 14.2.3

Diff: https://github.com/jandedobbeleer/oh-my-posh/compare/refs/tags/v13.8.0...v14.2.3

Changelog: https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v14.2.3
---
 pkgs/development/tools/oh-my-posh/default.nix | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/oh-my-posh/default.nix b/pkgs/development/tools/oh-my-posh/default.nix
index b4843ddc1030..fae74f6f13fc 100644
--- a/pkgs/development/tools/oh-my-posh/default.nix
+++ b/pkgs/development/tools/oh-my-posh/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "oh-my-posh";
-  version = "13.8.0";
+  version = "14.2.3";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-mplWF/lmgRfYd1Gg2loZI5NIfmTHR8quG1/KcZj5W54=";
+    hash = "sha256-PghWKyZG19MVmc2fQSQN/BCMbF7YOZWybUSKiQzUxl8=";
   };
 
-  vendorHash = "sha256-WiH4qu8DODEhAkxUm6VDcBwFyQO7kNjaiaWPDHCHj9E=";
+  vendorHash = "sha256-ehG71B351u+LoXDuKQkuEdEpUdHslVU2HcPKUz6FAnQ=";
 
   sourceRoot = "source/src";
 
@@ -35,6 +35,11 @@ buildGoModule rec {
     "static_build"
   ];
 
+  postPatch = ''
+    # this test requires internet access
+    rm engine/migrate_glyphs_test.go
+  '';
+
   postInstall = ''
     mv $out/bin/{src,oh-my-posh}
     mkdir -p $out/share/oh-my-posh

From 79553c2d0d56992f304b9ed411f16c509f1d0cc3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 14:38:56 +0000
Subject: [PATCH 158/176] v2ray-geoip: 202302020047 -> 202302081046

---
 pkgs/data/misc/v2ray-geoip/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/data/misc/v2ray-geoip/default.nix b/pkgs/data/misc/v2ray-geoip/default.nix
index be7466674259..40d915dace26 100644
--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "v2ray-geoip";
-  version = "202302020047";
+  version = "202302081046";
 
   src = fetchFromGitHub {
     owner = "v2fly";
     repo = "geoip";
-    rev = "9ab244ed78fea88a1ce5bf789fb31bbcd81e8d17";
-    sha256 = "sha256-2NYuvzOU0W3qZqWZMr3rTNqX+0rH3fhIr1zCD5dSdWc=";
+    rev = "d85771a99440dd75294bfd9d00011307b7596d0d";
+    sha256 = "sha256-gVL7koUG3BgY8HAYWa2fTwTJIE3svGUgauwI1jlA2/M=";
   };
 
   installPhase = ''

From 1c664befd4c198db2c6993f8afde709024bcec6d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@sap.com>
Date: Mon, 30 Jan 2023 16:53:08 +0100
Subject: [PATCH 159/176] nixos/envfs: add extraFallbackPathCommands options

this is mainly useful for restricted platforms like wsl which require
some extra entries in /bin/
---
 nixos/modules/tasks/filesystems/envfs.nix | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/tasks/filesystems/envfs.nix b/nixos/modules/tasks/filesystems/envfs.nix
index df4ce12407bd..76344f5f87ea 100644
--- a/nixos/modules/tasks/filesystems/envfs.nix
+++ b/nixos/modules/tasks/filesystems/envfs.nix
@@ -7,11 +7,11 @@ let
       device = "none";
       fsType = "envfs";
       options = [
-        "fallback-path=${pkgs.runCommand "fallback-path" {} ''
+        "fallback-path=${pkgs.runCommand "fallback-path" {} (''
           mkdir -p $out
           ln -s ${config.environment.usrbinenv} $out/env
           ln -s ${config.environment.binsh} $out/sh
-        ''}"
+        '' + cfg.extraFallbackPathCommands)}"
       ];
     };
     "/bin" = {
@@ -31,11 +31,19 @@ in {
           etc.
         '';
       };
+
       package = lib.mkOption {
         type = lib.types.package;
-        description = lib.mdDoc "Which package to use for the envfs.";
         default = pkgs.envfs;
         defaultText = lib.literalExpression "pkgs.envfs";
+        description = lib.mdDoc "Which package to use for the envfs.";
+      };
+
+      extraFallbackPathCommands = lib.mkOption {
+        type = lib.types.lines;
+        default = "";
+        example = "ln -s $''{pkgs.bash}/bin/bash $out/bash";
+        description = lib.mdDoc "Extra commands to run in the package that contains fallback executables in case not other executable is found";
       };
     };
   };

From a8ffe9162466325733a0bc0ff1b0e22cbbfb0b80 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 14:56:57 +0000
Subject: [PATCH 160/176] python310Packages.browser-cookie3: 0.16.5 -> 0.17.0

---
 pkgs/development/python-modules/browser-cookie3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/browser-cookie3/default.nix b/pkgs/development/python-modules/browser-cookie3/default.nix
index cd596cecbb9f..52ef0cd8ec20 100644
--- a/pkgs/development/python-modules/browser-cookie3/default.nix
+++ b/pkgs/development/python-modules/browser-cookie3/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "browser-cookie3";
-  version = "0.16.5";
+  version = "0.17.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-i2Ib7OGnoimiZ2R/vGe6phPhA8lEP0BJ/gP1q9RVeiU=";
+    hash = "sha256-fyyZ7pkNlD6MH1+SRUYjU0mXMUsZJ3qhOqJrcmJ/hgc=";
   };
 
   propagatedBuildInputs = [

From 7da5418f1d20665113c1530f3bb72a65ca008ac7 Mon Sep 17 00:00:00 2001
From: Martin Milata <martin@martinmilata.cz>
Date: Wed, 8 Feb 2023 12:09:32 +0100
Subject: [PATCH 161/176] torq: build frontend

---
 .../applications/blockchains/torq/default.nix | 28 ++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/blockchains/torq/default.nix b/pkgs/applications/blockchains/torq/default.nix
index cf7722238ef7..4b786168bce3 100644
--- a/pkgs/applications/blockchains/torq/default.nix
+++ b/pkgs/applications/blockchains/torq/default.nix
@@ -1,9 +1,10 @@
 { lib
 , buildGoModule
+, buildNpmPackage
 , fetchFromGitHub
 }:
 
-buildGoModule rec {
+let
   pname = "torq";
   version = "0.17.3";
 
@@ -14,6 +15,27 @@ buildGoModule rec {
     hash = "sha256-fqHJZi1NQCrZqsa+N+FVYZ8s9o0D555Sqn5qNlJ1MmI=";
   };
 
+  web = buildNpmPackage {
+    pname = "${pname}-frontend";
+    inherit version;
+    src = "${src}/web";
+    npmDepsHash = "sha256-8mUfTFzPjQlQvhC3zZf+WruDBkYnmGt3yckNi0CPWs0=";
+
+    # copied from upstream Dockerfile
+    npmInstallFlags = [ "--legacy-peer-deps" ];
+    TSX_COMPILE_ON_ERROR="true";
+    ESLINT_NO_DEV_ERRORS="true";
+
+    # override npmInstallHook, we only care about the build/ directory
+    installPhase = ''
+      mkdir $out
+      cp -r build $out/
+    '';
+  };
+in
+buildGoModule rec {
+  inherit pname version src;
+
   vendorHash = "sha256-HETN2IMnpxnTyg6bQDpoD0saJu+gKocdEf0VzEi12Gs=";
 
   subPackages = [ "cmd/torq" ];
@@ -24,6 +46,10 @@ buildGoModule rec {
     "-X github.com/lncapital/torq/build.version=v${version}"
   ];
 
+  postInstall = ''
+    ln -s ${web} $out/web
+  '';
+
   meta = with lib; {
     description = "Capital management tool for lightning network nodes";
     license = licenses.mit;

From ea4693ba9157746f64f3e8ef28b232998c2556b0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 15:24:51 +0000
Subject: [PATCH 162/176] git-machete: 3.14.3 -> 3.15.0

---
 pkgs/applications/version-management/git-machete/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/version-management/git-machete/default.nix b/pkgs/applications/version-management/git-machete/default.nix
index 24fc850b31b0..9667e7bd2fee 100644
--- a/pkgs/applications/version-management/git-machete/default.nix
+++ b/pkgs/applications/version-management/git-machete/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonApplication rec {
   pname = "git-machete";
-  version = "3.14.3";
+  version = "3.15.0";
 
   src = fetchFromGitHub {
     owner = "virtuslab";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-VOny8r00JYUT4Z7LukvWTH9ZTn86vn2Dc1YhPmtdE5s=";
+    hash = "sha256-HSgCvHjSOrMPsdOPtgFUeK6b0ioVnwTtg2oHGg4BrZw=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

From 5494775bb3b134b1cd3ae7e92b7e8e50ba4efaf0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 15:30:23 +0000
Subject: [PATCH 163/176] python310Packages.pyisy: 3.1.11 -> 3.1.13

---
 pkgs/development/python-modules/pyisy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyisy/default.nix b/pkgs/development/python-modules/pyisy/default.nix
index 472bf727edca..892c44b0b3b2 100644
--- a/pkgs/development/python-modules/pyisy/default.nix
+++ b/pkgs/development/python-modules/pyisy/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyisy";
-  version = "3.1.11";
+  version = "3.1.13";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "automicus";
     repo = "PyISY";
     rev = "refs/tags/v${version}";
-    hash = "sha256-RYC0mfskDcCU9O2pSKRL9ulPUaJQO9UKp7WANXZWJ60=";
+    hash = "sha256-FjreG+xjX8f68nUq/4HHEaYcUYjU/9sYvzmIN6kXezU=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

From b88f8c9713b7083ea06d6e4b5c45b5fa5f0b5dbe Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 15:41:37 +0000
Subject: [PATCH 164/176] python310Packages.py-synologydsm-api: 2.1.2 -> 2.1.4

---
 .../development/python-modules/py-synologydsm-api/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/py-synologydsm-api/default.nix b/pkgs/development/python-modules/py-synologydsm-api/default.nix
index 2437aba73a13..0ae3cf8bd0d1 100644
--- a/pkgs/development/python-modules/py-synologydsm-api/default.nix
+++ b/pkgs/development/python-modules/py-synologydsm-api/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "py-synologydsm-api";
-  version = "2.1.2";
+  version = "2.1.4";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "mib1185";
     repo = "py-synologydsm-api";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dugWA/Ruc/BhPBbo2bTXf225YndDl0t2vc+NeutaO58=";
+    hash = "sha256-37JzdhMny6YDTBO9NRzfrZJAVAOPnpcr95fOKxisbTg=";
   };
 
   nativeBuildInputs = [

From 9a11fad34fa16831beae989e3255b0adb3ef2ec6 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 8 Feb 2023 18:25:37 +0100
Subject: [PATCH 165/176] python310Packages.inkbird-ble: 0.5.5 -> 0.5.6

Diff: https://github.com/Bluetooth-Devices/inkbird-ble/compare/v0.5.5...v0.5.6
---
 pkgs/development/python-modules/inkbird-ble/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/inkbird-ble/default.nix b/pkgs/development/python-modules/inkbird-ble/default.nix
index 2172a8841140..4c39d264ce75 100644
--- a/pkgs/development/python-modules/inkbird-ble/default.nix
+++ b/pkgs/development/python-modules/inkbird-ble/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "inkbird-ble";
-  version = "0.5.5";
+  version = "0.5.6";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "Bluetooth-Devices";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-KUBOjeFM4h2Qt9eT0mQKPFYJJ8OWdbYy9+AiHsJWNyU=";
+    hash = "sha256-re5HjPtssFkpcltCr0HEJmJyHbXJdkr2wDgaAHfy2Tk=";
   };
 
   nativeBuildInputs = [

From acf02f40d83d2bf5de4c60c13e55c2975cf68404 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 8 Feb 2023 18:26:07 +0100
Subject: [PATCH 166/176] python310Packages.jaraco-abode: 3.2.1 -> 3.3.0

Diff: https://github.com/jaraco/jaraco.abode/compare/refs/tags/v3.2.1...v3.3.0
---
 pkgs/development/python-modules/jaraco-abode/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/jaraco-abode/default.nix b/pkgs/development/python-modules/jaraco-abode/default.nix
index 15ac7c63a7f1..8ddb8f4b493c 100644
--- a/pkgs/development/python-modules/jaraco-abode/default.nix
+++ b/pkgs/development/python-modules/jaraco-abode/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "jaraco-abode";
-  version = "3.2.1";
+  version = "3.3.0";
 
   disabled = pythonOlder "3.7";
 
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "jaraco";
     repo = "jaraco.abode";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ZDdZba1oTOPaUm+r4fWC5E3ni/k8kXo6t5AWQTvfd5E=";
+    hash = "sha256-LnbWzIST+GMtdsHDKg67WWt9GmHUcSuGZ5Spei3nEio=";
   };
 
   postPatch = ''

From c1c48c028975dca7d88f70841760b3d26c12c896 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 8 Feb 2023 18:30:57 +0100
Subject: [PATCH 167/176] python310Packages.pyrainbird: 1.1.1 -> 2.0.0

https://github.com/allenporter/pyrainbird/releases/tag/2.0.0
---
 .../python-modules/pyrainbird/default.nix        | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyrainbird/default.nix b/pkgs/development/python-modules/pyrainbird/default.nix
index 899e1cfd7b60..8d9c546213f8 100644
--- a/pkgs/development/python-modules/pyrainbird/default.nix
+++ b/pkgs/development/python-modules/pyrainbird/default.nix
@@ -1,11 +1,17 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, freezegun
+, ical
 , parameterized
 , pycryptodome
 , pydantic
 , pytest-aiohttp
+, pytest-asyncio
+, pytest-golden
+, pytest-mock
 , pytestCheckHook
+, python-dateutil
 , pythonOlder
 , pyyaml
 , requests
@@ -15,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "pyrainbird";
-  version = "1.1.1";
+  version = "2.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -24,7 +30,7 @@ buildPythonPackage rec {
     owner = "allenporter";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-e+neyzH+sGTzGwdy/N7n6GUvctHlHQgwDkRQsnzL7Jw=";
+    hash = "sha256-fQHWamtGA1Cz/9Hbxbns5lDd08Q01nIvaMXp9PWrelM=";
   };
 
   postPatch = ''
@@ -36,15 +42,21 @@ buildPythonPackage rec {
   '';
 
   propagatedBuildInputs = [
+    ical
     pycryptodome
     pydantic
+    python-dateutil
     pyyaml
     requests
   ];
 
   nativeCheckInputs = [
+    freezegun
     parameterized
     pytest-aiohttp
+    pytest-asyncio
+    pytest-golden
+    pytest-mock
     pytestCheckHook
     requests-mock
     responses

From dfd3e6e1e56043ede66463aceb2e9c3bffdcb537 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 8 Feb 2023 18:32:12 +0100
Subject: [PATCH 168/176] home-assistant: 2022.2.2 -> 2022.2.3

https://github.com/home-assistant/core/releases/tag/2023.2.3
---
 pkgs/servers/home-assistant/component-packages.nix | 2 +-
 pkgs/servers/home-assistant/default.nix            | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 51a694006528..8abe197bee7d 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2023.2.2";
+  version = "2023.2.3";
   components = {
     "3_day_blinds" = ps: with ps; [
     ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 07bb320e7112..94ab3ab5b509 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -271,7 +271,7 @@ let
   extraPackagesFile = writeText "home-assistant-packages" (lib.concatMapStringsSep "\n" (pkg: pkg.pname) extraBuildInputs);
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2023.2.2";
+  hassVersion = "2023.2.3";
 
 in python.pkgs.buildPythonApplication rec {
   pname = "homeassistant";
@@ -289,7 +289,7 @@ in python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = "refs/tags/${version}";
-    hash = "sha256-HEL8e/2zoWPjeJL9iaCRu8aIldE3uTw9Yu9Q06Nyvz4=";
+    hash = "sha256-cRdxlmlgkKTnrtqGQPbSpBLHf+vfI9T6sdETcGshN9M=";
   };
 
   nativeBuildInputs = with python3.pkgs; [

From f4a93aa86fb3cccf91de7831b7a49707674d770f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 19:03:24 +0000
Subject: [PATCH 169/176] gfold: 4.2.0 -> 4.3.0

---
 pkgs/applications/version-management/gfold/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/version-management/gfold/default.nix b/pkgs/applications/version-management/gfold/default.nix
index dcce6f7f3c00..92e8d9095b72 100644
--- a/pkgs/applications/version-management/gfold/default.nix
+++ b/pkgs/applications/version-management/gfold/default.nix
@@ -12,7 +12,7 @@
 
 let
   pname = "gfold";
-  version = "4.2.0";
+  version = "4.3.0";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -21,10 +21,10 @@ rustPlatform.buildRustPackage {
     owner = "nickgerace";
     repo = pname;
     rev = version;
-    sha256 = "sha256-cH4FhXrdT0ejpyt8G2rSGw9WE9sfOXRkSA9+FVwRmtQ=";
+    sha256 = "sha256-yvMp5x1uiJGkWHnwfONx4pVotSSE6sTW4uqWpI2AFXg=";
   };
 
-  cargoSha256 = "sha256-NmVmqBzRUdumWQ9MzolZTo0VQW9JTjIyYRwUTzGiQZ4=";
+  cargoHash = "sha256-MBWaNjs840twU9SQLvgVcXTT0RN2QJ7PiaAohiiQu3s=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Security ];
 

From 17970a6ad96b117589e9514fd9b6fea0152988d6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 19:12:42 +0000
Subject: [PATCH 170/176] oxker: 0.2.1 -> 0.2.3

---
 pkgs/applications/misc/oxker/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/misc/oxker/default.nix b/pkgs/applications/misc/oxker/default.nix
index 56490754e172..ba8324a02fb3 100644
--- a/pkgs/applications/misc/oxker/default.nix
+++ b/pkgs/applications/misc/oxker/default.nix
@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oxker";
-  version = "0.2.1";
+  version = "0.2.3";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-CsfzQN7n/LsNIivJShDG02cHwPktkXl/0udBSPz0i2U=";
+    sha256 = "sha256-J+3wi1nqkxR3ZDfR+F3rvFjUz1DJ7/jhjmcvFdMzWYc=";
   };
 
-  cargoHash = "sha256-FSuhG+ZSQzwj1YB3xs3A1uFWPhwK8FIfVfUY9V/J2Z8=";
+  cargoHash = "sha256-oQPCUm/X2vt6wN5AKhtgq8tzQQrp0H42bBK7Az+I9BE=";
 
   meta = with lib; {
     description = "A simple tui to view & control docker containers";

From ebc58683192cef317d556a7d24366ba3365adc4f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Feb 2023 19:16:39 +0000
Subject: [PATCH 171/176] moosefs: 3.0.116 -> 3.0.117

---
 pkgs/tools/filesystems/moosefs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/filesystems/moosefs/default.nix b/pkgs/tools/filesystems/moosefs/default.nix
index 898ba9ed3c15..55b796ec3254 100644
--- a/pkgs/tools/filesystems/moosefs/default.nix
+++ b/pkgs/tools/filesystems/moosefs/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "moosefs";
-  version = "3.0.116";
+  version = "3.0.117";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/+l4BURvL1R6te6tlXRJx7YBDyYuMrGnzzhMc9XeXKc=";
+    sha256 = "sha256-6zBMAi9ruPPlcnpdgqwl35QZ5u4MyFPUa70yvGTkHpo=";
   };
 
   nativeBuildInputs = [

From fc36e212fbe0e58020ef3300fb0cd89d1514ddf8 Mon Sep 17 00:00:00 2001
From: Mauricio Collares <mauricio@collares.org>
Date: Wed, 8 Feb 2023 21:18:25 +0100
Subject: [PATCH 172/176] bliss: build on aarch64-linux

---
 pkgs/applications/science/math/bliss/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/science/math/bliss/default.nix b/pkgs/applications/science/math/bliss/default.nix
index fe68d9d245c5..4fccc3a46403 100644
--- a/pkgs/applications/science/math/bliss/default.nix
+++ b/pkgs/applications/science/math/bliss/default.nix
@@ -32,6 +32,6 @@ stdenv.mkDerivation rec {
     description = "An open source tool for computing automorphism groups and canonical forms of graphs. It has both a command line user interface as well as C++ and C programming language APIs";
     homepage = "http://www.tcs.hut.fi/Software/bliss/";
     license = licenses.lgpl3;
-    platforms = [ "i686-linux" "x86_64-linux" ];
+    platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" ];
   };
 }

From ea41744b5ca62b7f1e9dfc38e9b69735fc3b5416 Mon Sep 17 00:00:00 2001
From: 3JlOy_PYCCKUI <3jl0y_pycckui@riseup.net>
Date: Wed, 4 Jan 2023 20:14:32 +0300
Subject: [PATCH 173/176] ttdl: init at 3.6.3

---
 pkgs/applications/misc/ttdl/default.nix | 26 +++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix         |  2 ++
 2 files changed, 28 insertions(+)
 create mode 100644 pkgs/applications/misc/ttdl/default.nix

diff --git a/pkgs/applications/misc/ttdl/default.nix b/pkgs/applications/misc/ttdl/default.nix
new file mode 100644
index 000000000000..9f098efef8a0
--- /dev/null
+++ b/pkgs/applications/misc/ttdl/default.nix
@@ -0,0 +1,26 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "ttdl";
+  version = "3.6.3";
+
+  src = fetchFromGitHub {
+    owner = "VladimirMarkelov";
+    repo = "ttdl";
+    rev = "v${version}";
+    sha256 = "sha256-IR0cDXQHnMDI71Vg50atS98YorqAQKc95EF1+m9cxFY=";
+  };
+
+  cargoSha256 = "sha256-658mN3R3opjvqfnIDcbh11ZSOTDbpYnhCgGGx46Mrrc=";
+
+  meta = with lib; {
+    description = "A CLI tool to manage todo lists in todo.txt format";
+    homepage = "https://github.com/VladimirMarkelov/ttdl";
+    changelog = "https://github.com/VladimirMarkelov/ttdl/blob/v${version}/changelog";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ _3JlOy-PYCCKUi ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c8d00d31611a..e730a6b97d4d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12450,6 +12450,8 @@ with pkgs;
 
   tthsum = callPackage ../applications/misc/tthsum { };
 
+  ttdl = callPackage ../applications/misc/ttdl { };
+
   ttp = with python3.pkgs; toPythonApplication ttp;
 
   trace-cmd = callPackage ../os-specific/linux/trace-cmd { };

From bc58d7444f846e4452487cc7dd361e79617a0bab Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Wed, 8 Feb 2023 23:19:48 +0100
Subject: [PATCH 174/176] chromiumDev: 111.0.5563.8 -> 111.0.5563.19

---
 .../networking/browsers/chromium/upstream-info.json         | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index bd72ef447e3f..1eeec11742a6 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -32,9 +32,9 @@
     }
   },
   "dev": {
-    "version": "111.0.5563.8",
-    "sha256": "0gflrk5i6dr5vrywhxab73044gryxj49px59blgl6nyphw7swpwy",
-    "sha256bin64": "1dgfjz9pnziy1zymk7g15i5zdb002g77q8kqhkwgi4m0fndknpmj",
+    "version": "111.0.5563.19",
+    "sha256": "0hrapzi45jpkb1b87nzlb896jd2h2jbz1mq91md5r2y6ag6fc55w",
+    "sha256bin64": "02aaqny23dcdp611n6jr7swkjnx1wd0lb8dgxq53b806f0s374cp",
     "deps": {
       "gn": {
         "version": "2022-12-12",

From 5a2b689d2549748e6b4c4e863788d8b5d4ffe7f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 19 Dec 2022 09:59:48 -0800
Subject: [PATCH 175/176] python310Packages.docformatter: 1.5.0 -> 1.5.1

https://github.com/PyCQA/docformatter/blob/v1.5.1/CHANGELOG.md
---
 .../python-modules/docformatter/default.nix   | 27 +++++++++++++++--
 .../docformatter/test-path.patch              | 29 +++++++++++++++++++
 2 files changed, 53 insertions(+), 3 deletions(-)
 create mode 100644 pkgs/development/python-modules/docformatter/test-path.patch

diff --git a/pkgs/development/python-modules/docformatter/default.nix b/pkgs/development/python-modules/docformatter/default.nix
index f7be25f61509..0eb7506a2ce1 100644
--- a/pkgs/development/python-modules/docformatter/default.nix
+++ b/pkgs/development/python-modules/docformatter/default.nix
@@ -2,6 +2,9 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+, poetry-core
+, charset-normalizer
+, tomli
 , untokenize
 , mock
 , pytestCheckHook
@@ -9,20 +12,37 @@
 
 buildPythonPackage rec {
   pname = "docformatter";
-  version = "1.5.0";
+  version = "1.5.1";
 
   disabled = pythonOlder "3.6";
 
-  format = "setuptools";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "PyCQA";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-GSfsM6sPSLOIH0YJYFVTB3SigI62/ps51mA2iZ7GOEg=";
+    hash = "sha256-r+8FOl9Rrfi3V8f8wD41bRsaqDb+UrOBWuR3goK43xY=";
   };
 
+  patches = [
+    ./test-path.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace 'charset_normalizer = "^2.0.0"' 'charset_normalizer = ">=2.0.0"'
+    substituteInPlace tests/conftest.py \
+      --subst-var-by docformatter $out/bin/docformatter
+  '';
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
   propagatedBuildInputs = [
+    charset-normalizer
+    tomli
     untokenize
   ];
 
@@ -34,6 +54,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "docformatter" ];
 
   meta = {
+    changelog = "https://github.com/PyCQA/docformatter/blob/${src.rev}/CHANGELOG.md";
     description = "Formats docstrings to follow PEP 257";
     homepage = "https://github.com/myint/docformatter";
     license = lib.licenses.mit;
diff --git a/pkgs/development/python-modules/docformatter/test-path.patch b/pkgs/development/python-modules/docformatter/test-path.patch
new file mode 100644
index 000000000000..bd61c0ca829b
--- /dev/null
+++ b/pkgs/development/python-modules/docformatter/test-path.patch
@@ -0,0 +1,29 @@
+diff --git a/tests/conftest.py b/tests/conftest.py
+index 5f5a9aa..3289222 100644
+--- a/tests/conftest.py
++++ b/tests/conftest.py
+@@ -92,21 +92,9 @@ def run_docformatter(arguments, temporary_file):
+ 
+     Return subprocess object.
+     """
+-    if "DOCFORMATTER_COVERAGE" in os.environ and int(
+-            os.environ["DOCFORMATTER_COVERAGE"]
+-    ):
+-        DOCFORMATTER_COMMAND = [
+-            "coverage",
+-            "run",
+-            "--branch",
+-            "--parallel",
+-            "--omit=*/site-packages/*",
+-            os.environ["VIRTUAL_ENV"] + "/bin/docformatter",
+-        ]
+-    else:
+-        DOCFORMATTER_COMMAND = [
+-            os.environ["VIRTUAL_ENV"] + "/bin/docformatter",
+-        ]  # pragma: no cover
++    DOCFORMATTER_COMMAND = [
++        "@docformatter@"
++    ]
+ 
+     if "-" not in arguments:
+         arguments.append(temporary_file)

From dcf4487fc79fcdc1b3adba6e9b3d70eeec27f527 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 4 Feb 2023 15:48:44 -0800
Subject: [PATCH 176/176] python310Packages.xsdata: use docformatter 1.5.1

---
 pkgs/development/python-modules/xsdata/default.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/development/python-modules/xsdata/default.nix b/pkgs/development/python-modules/xsdata/default.nix
index 6ad48ac12364..d3d06d407493 100644
--- a/pkgs/development/python-modules/xsdata/default.nix
+++ b/pkgs/development/python-modules/xsdata/default.nix
@@ -2,6 +2,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchPypi
+, fetchpatch
 , click
 , click-default-group
 , docformatter
@@ -25,6 +26,16 @@ buildPythonPackage rec {
     hash = "sha256-o9Xxt7b/+MkW94Jcg26ihaTn0/OpTcu+0OY7oV3JRGY=";
   };
 
+  patches = [
+    # https://github.com/tefra/xsdata/pull/741
+    (fetchpatch {
+      name = "use-docformatter-1.5.1.patch";
+      url = "https://github.com/tefra/xsdata/commit/040692db47e6e51028fd959c793e757858c392d7.patch";
+      excludes = [ "setup.cfg" ];
+      hash = "sha256-ncecMJLJUiUb4lB8ys+nyiGU/UmayK++o89h3sAwREQ=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace setup.cfg \
       --replace "--benchmark-skip" ""