Merge master into staging-nixos

maintainers/maintainer-list.nix

@@ -1140,6 +1140,13 @@
     githubId = 83360;
     name = "Aleksey Sidorov";
   };
+  aleksi = {
+    email = "ahannula4@gmail.com";
+    github = "Gskartwii";
+    githubId = 6651822;
+    name = "Aleksi Hannula";
+    matrix = "@aleksi:pikaviestin.fi";
+  };
   alemonmk = {
     email = "almk@rmntn.net";
     github = "alemonmk";
@@ -4526,6 +4533,12 @@
     githubId = 8228888;
     name = "Charlie Hanley";
   };
+  channinghe = {
+    email = "channinghey@gmail.com";
+    github = "ChanningHe";
+    githubId = 52875777;
+    name = "Channing He";
+  };
   chaoflow = {
     email = "flo@chaoflow.net";
     github = "chaoflow";

maintainers/team-list.nix

@@ -662,10 +662,12 @@ with lib.maintainers;
   minimal-bootstrap = {
     members = [
       alejandrosame
+      aleksi
       artturin
       emilytrau
       ericson2314
       jk
+      pyrox0
       siraben
     ];
     scope = "Maintain the minimal-bootstrap toolchain and related packages.";

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -22,6 +22,8 @@
 
 - [udp-over-tcp](https://github.com/mullvad/udp-over-tcp), a tunnel for proxying UDP traffic over a TCP stream. Available as `services.udp-over-tcp`.
 
+- [Komodo Periphery](https://github.com/moghtech/komodo), a multi-server Docker and Git deployment agent by Komodo. Available as [services.komodo-periphery](#opt-services.komodo-periphery.enable).
+
 ## Backward Incompatibilities {#sec-release-26.05-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/module-list.nix

@@ -411,6 +411,7 @@
   ./services/accessibility/orca.nix
   ./services/accessibility/speechd.nix
   ./services/admin/docuum.nix
+  ./services/admin/komodo-periphery.nix
   ./services/admin/meshcentral.nix
   ./services/admin/oxidized.nix
   ./services/admin/pgadmin.nix

nixos/modules/security/acme/default.nix

@@ -211,7 +211,8 @@ let
           ${toString acmeServer} ${toString data.dnsProvider}
           ${toString data.ocspMustStaple} ${data.keyType}
         ''
-        + (lib.optionalString (data.csr != null) (" - " + data.csr));
+        + lib.optionalString (data.csr != null) " - ${data.csr}"
+        + lib.optionalString (data.profile != null) " - ${data.profile}";
       certDir = mkHash hashData;
       # TODO remove domainHash usage entirely. Waiting on go-acme/lego#1532
       domainHash = mkHash "${lib.concatStringsSep " " extraDomains} ${data.domain}";
@@ -284,6 +285,7 @@ let
         commonOpts
         ++ [ "run" ]
         ++ lib.optionals data.ocspMustStaple [ "--must-staple" ]
+        ++ lib.optionals (data.profile != null) [ "--profile=${data.profile}" ]
         ++ data.extraLegoRunFlags
       );
       renewOpts = lib.escapeShellArgs (
@@ -293,6 +295,7 @@ let
           "--no-random-sleep"
         ]
         ++ lib.optionals data.ocspMustStaple [ "--must-staple" ]
+        ++ lib.optionals (data.profile != null) [ "--profile=${data.profile}" ]
         ++ data.extraLegoRenewFlags
       );
 
@@ -799,6 +802,14 @@ let
           '';
         };
 
+        profile = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          inherit (defaultAndText "profile" null) default defaultText;
+          description = ''
+            The certificate profile to choose if the CA offers multiple profiles.
+          '';
+        };
+
         extraLegoFlags = lib.mkOption {
           type = lib.types.listOf lib.types.str;
           inherit (defaultAndText "extraLegoFlags" [ ]) default defaultText;

nixos/modules/services/admin/komodo-periphery.nix

@@ -0,0 +1,338 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.komodo-periphery;
+  settingsFormat = pkgs.formats.toml { };
+
+  genFinalSettings =
+    let
+      baseSettings = {
+        port = cfg.port;
+        bind_ip = cfg.bindIp;
+        root_directory = cfg.rootDirectory;
+        repo_dir = "${cfg.rootDirectory}/repos";
+        stack_dir = "${cfg.rootDirectory}/stacks";
+        ssl_enabled = cfg.ssl.enable;
+      }
+      // lib.optionalAttrs cfg.ssl.enable {
+        ssl_key_file = cfg.ssl.keyFile;
+        ssl_cert_file = cfg.ssl.certFile;
+      }
+      // {
+        logging = {
+          level = cfg.logging.level;
+          stdio = cfg.logging.stdio;
+        }
+        // lib.optionalAttrs (cfg.logging.otlpEndpoint != "") {
+          otlp_endpoint = cfg.logging.otlpEndpoint;
+        };
+        allowed_ips = cfg.allowedIps;
+        passkeys = cfg.passkeys;
+        disable_terminals = cfg.disableTerminals;
+        disable_container_exec = cfg.disableContainerExec;
+        stats_polling_rate = cfg.statsPollingRate;
+        container_stats_polling_rate = cfg.containerStatsPollingRate;
+        legacy_compose_cli = cfg.legacyComposeCli;
+        include_disk_mounts = cfg.includeDiskMounts;
+        exclude_disk_mounts = cfg.excludeDiskMounts;
+      }
+      // cfg.extraSettings;
+    in
+    lib.filterAttrsRecursive (_: v: v != null && v != { } && v != [ ]) baseSettings;
+
+  configFile =
+    if cfg.configFile == null then
+      settingsFormat.generate "komodo-periphery.toml" genFinalSettings
+    else
+      cfg.configFile;
+in
+{
+  options.services.komodo-periphery = {
+    enable = lib.mkEnableOption "Periphery, a multi-server Docker and Git deployment agent by Komodo";
+
+    package = lib.mkPackageOption pkgs "komodo" { };
+
+    configFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = "Path to the periphery configuration file. If null, a configuration file will be generated from the module options.";
+      example = lib.literalExpression ''
+        pkgs.writeText "periphery.toml" '''
+          port = 8120
+          bind_ip = "[::]"
+          ssl_enabled = true
+          [logging]
+          level = "info"
+        '''
+      '';
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 8120;
+      description = "Port for the Periphery agent to listen on.";
+    };
+
+    bindIp = lib.mkOption {
+      type = lib.types.str;
+      default = "[::]";
+      description = "IP address to bind to.";
+    };
+
+    rootDirectory = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/komodo-periphery";
+      description = "Root directory for Komodo Periphery data.";
+    };
+
+    ssl = {
+      enable = lib.mkEnableOption "SSL/TLS support" // {
+        default = true;
+      };
+
+      keyFile = lib.mkOption {
+        type = lib.types.path;
+        default = "${cfg.rootDirectory}/ssl/key.pem";
+        defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/key.pem"'';
+        description = "Path to SSL key file.";
+      };
+
+      certFile = lib.mkOption {
+        type = lib.types.path;
+        default = "${cfg.rootDirectory}/ssl/cert.pem";
+        defaultText = lib.literalExpression ''"''${config.services.komodo-periphery.rootDirectory}/ssl/cert.pem"'';
+        description = "Path to SSL certificate file.";
+      };
+    };
+
+    logging = {
+      level = lib.mkOption {
+        type = lib.types.enum [
+          "off"
+          "error"
+          "warn"
+          "info"
+          "debug"
+          "trace"
+        ];
+        default = "info";
+        description = "Logging verbosity level.";
+      };
+
+      stdio = lib.mkOption {
+        type = lib.types.enum [
+          "standard"
+          "json"
+          "none"
+        ];
+        default = "standard";
+        description = "Logging format for stdout/stderr.";
+      };
+
+      otlpEndpoint = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = "OpenTelemetry OTLP endpoint for traces.";
+        example = "http://localhost:4317";
+      };
+    };
+
+    allowedIps = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "IP addresses or subnets allowed to call the periphery API. Empty list allows all.";
+      example = [
+        "::ffff:12.34.56.78"
+        "10.0.10.0/24"
+      ];
+    };
+
+    passkeys = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = ''
+        Passkeys required to access the periphery API.
+        WARNING: These will be stored in the Nix store in plain text!
+      '';
+      example = [ "your-secure-passkey" ];
+    };
+
+    extraSettings = lib.mkOption {
+      type = settingsFormat.type;
+      default = { };
+      description = "Extra settings to add to the generated TOML config.";
+      example = {
+        secrets.GITHUB_TOKEN = "ghp_xxxx";
+      };
+    };
+
+    disableTerminals = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Disable remote shell access through Periphery.";
+    };
+
+    disableContainerExec = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Disable remote container shell access through Periphery.";
+    };
+
+    statsPollingRate = lib.mkOption {
+      type = lib.types.str;
+      default = "5-sec";
+      description = "System stats polling interval.";
+      example = "10-sec";
+    };
+
+    containerStatsPollingRate = lib.mkOption {
+      type = lib.types.str;
+      default = "30-sec";
+      description = "Container stats polling interval.";
+      example = "1-min";
+    };
+
+    legacyComposeCli = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Use `docker-compose` instead of `docker compose`.";
+    };
+
+    includeDiskMounts = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "Only include these mount paths in disk reporting.";
+      example = [
+        "/mnt/data"
+        "/mnt/backup"
+      ];
+    };
+
+    excludeDiskMounts = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "Exclude these mount paths from disk reporting.";
+      example = [
+        "/tmp"
+        "/boot"
+      ];
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "komodo-periphery";
+      description = "User under which the Periphery agent runs.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "komodo-periphery";
+      description = "Group under which the Periphery agent runs.";
+    };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = "Environment file for additional configuration via environment variables.";
+      example = "/run/secrets/komodo-periphery.env";
+    };
+
+    environment = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = { };
+      description = "Environment variables to set for the service.";
+      example = {
+        RUST_LOG = "komodo=debug";
+        DOCKER_HOST = "unix:///var/run/docker.sock";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation.docker.enable = true;
+
+    users.users.${cfg.user} = lib.mkIf (cfg.user == "komodo-periphery") {
+      isSystemUser = true;
+      group = cfg.group;
+      description = "Komodo Periphery service user";
+      home = cfg.rootDirectory;
+      extraGroups = [ "docker" ];
+    };
+
+    users.groups.${cfg.group} = lib.mkIf (cfg.group == "komodo-periphery") { };
+
+    systemd.tmpfiles.settings."10-komodo-periphery" = {
+      "${cfg.rootDirectory}".d = {
+        mode = "0755";
+        user = cfg.user;
+        group = cfg.group;
+      };
+      "${cfg.rootDirectory}/repos".d = {
+        mode = "0755";
+        user = cfg.user;
+        group = cfg.group;
+      };
+      "${cfg.rootDirectory}/stacks".d = {
+        mode = "0755";
+        user = cfg.user;
+        group = cfg.group;
+      };
+      "${cfg.rootDirectory}/ssl".d = {
+        mode = "0700";
+        user = cfg.user;
+        group = cfg.group;
+      };
+    };
+
+    systemd.services.komodo-periphery = {
+      description = "Komodo Periphery - Multi-server Docker and Git deployment agent";
+      after = [
+        "network-online.target"
+        "docker.service"
+      ];
+      wants = [
+        "network-online.target"
+        "docker.service"
+      ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        User = cfg.user;
+        Group = cfg.group;
+        SupplementaryGroups = [ "docker" ];
+        Restart = "on-failure";
+        RestartSec = "10s";
+        WorkingDirectory = cfg.rootDirectory;
+
+        ExecStart = lib.escapeShellArgs [
+          "${lib.getExe' cfg.package "periphery"}"
+          "--config-path"
+          (if cfg.configFile != null then cfg.configFile else configFile)
+        ];
+
+        Environment = lib.mapAttrsToList (name: value: "${name}=${value}") (
+          cfg.environment
+          // lib.optionalAttrs (!cfg.disableTerminals) {
+            PATH = "/run/current-system/sw/bin:/run/wrappers/bin";
+          }
+        );
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
+
+        StateDirectory = "komodo-periphery";
+        StateDirectoryMode = "0755";
+
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectSystem = "full";
+        ProtectHome = true;
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ channinghe ];
+}

nixos/modules/services/security/vaultwarden/default.nix

@@ -7,6 +7,7 @@
 
 let
   cfg = config.services.vaultwarden;
+
   user = config.users.users.vaultwarden.name;
   group = config.users.groups.vaultwarden.name;
 
@@ -115,21 +116,7 @@ in
           DOMAIN = "https://bitwarden.example.com";
           SIGNUPS_ALLOWED = false;
 
-          # Vaultwarden currently recommends running behind a reverse proxy
-          # (nginx or similar) for TLS termination, see
-          # https://github.com/dani-garcia/vaultwarden/wiki/Hardening-Guide#reverse-proxying
-          # > you should avoid enabling HTTPS via vaultwarden's built-in Rocket TLS support,
-          # > especially if your instance is publicly accessible.
-          #
-          # A suitable NixOS nginx reverse proxy example config might be:
-          #
-          #     services.nginx.virtualHosts."bitwarden.example.com" = {
-          #       enableACME = true;
-          #       forceSSL = true;
-          #       locations."/" = {
-          #         proxyPass = "http://127.0.0.1:''${toString config.services.vaultwarden.config.ROCKET_PORT}";
-          #       };
-          #     };
+          # Vaultwarden recommends running behind a reverse proxy, the configureNginx option can be used for that.
           ROCKET_ADDRESS = "127.0.0.1";
           ROCKET_PORT = 8222;
 
@@ -171,6 +158,24 @@ in
       '';
     };
 
+    configureNginx = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Whether to configure nginx to serve VaultWarden.";
+    };
+
+    configurePostgres = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Whether to configure a local PostgreSQL server.";
+    };
+
+    domain = lib.mkOption {
+      type = with lib.types; nullOr str;
+      default = null;
+      description = "The domain under which VaultWarden will be reachable.";
+    };
+
     environmentFile = lib.mkOption {
       type = with lib.types; coercedTo path lib.singleton (listOf path);
       default = [ ];
@@ -210,100 +215,153 @@ in
         assertion = cfg.backupDir != null -> !(lib.hasPrefix dataDir cfg.backupDir);
         message = "Backup directory can not be in ${dataDir}";
       }
+      {
+        assertion = cfg.configureNginx -> cfg.domain != null;
+        message = "Setting services.vaultwarden.configureNginx to true requires configuring services.vaultwarden.domain!";
+      }
     ];
 
-    users.users.vaultwarden = {
-      inherit group;
-      isSystemUser = true;
-    };
-    users.groups.vaultwarden = { };
+    services = {
+      nginx = lib.mkIf cfg.configureNginx {
+        enable = true;
+        upstreams.vaultwarden.servers."127.0.0.1:${toString cfg.config.ROCKET_PORT}" = { };
+        virtualHosts.${cfg.domain} = {
+          forceSSL = true;
+          locations = {
+            "/".proxyPass = "http://vaultwarden";
+            "= /notifications/anonymous-hub" = {
+              proxyPass = "http://vaultwarden";
+              proxyWebsockets = true;
+            };
+            "= /notifications/hub" = {
+              proxyPass = "http://vaultwarden";
+              proxyWebsockets = true;
+            };
+          };
+        };
+      };
 
-    systemd.services.vaultwarden = {
-      after = [ "network-online.target" ];
-      wants = [ "network-online.target" ];
-      path = with pkgs; [ openssl ];
-      serviceConfig = {
-        User = user;
-        Group = group;
-        EnvironmentFile = [ configFile ] ++ cfg.environmentFile;
-        ExecStart = lib.getExe vaultwarden;
-        LimitNOFILE = "1048576";
-        CapabilityBoundingSet = [ "" ];
-        DeviceAllow = [ "" ];
-        DevicePolicy = "closed";
-        LockPersonality = true;
-        MemoryDenyWriteExecute = true;
-        NoNewPrivileges = !useSendmail;
-        PrivateDevices = !useSendmail;
-        PrivateTmp = true;
-        PrivateUsers = !useSendmail;
-        ProcSubset = "pid";
-        ProtectClock = true;
-        ProtectControlGroups = true;
-        ProtectHome = true;
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectProc = "noaccess";
-        ProtectSystem = "strict";
-        RemoveIPC = true;
-        RestrictAddressFamilies = [
-          "AF_INET"
-          "AF_INET6"
-          "AF_UNIX"
+      postgresql = lib.mkIf cfg.configurePostgres {
+        enable = true;
+        ensureDatabases = [ "vaultwarden" ];
+        ensureUsers = [
+          {
+            name = "vaultwarden";
+            ensureDBOwnership = true;
+          }
         ];
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-        inherit StateDirectory;
-        StateDirectoryMode = "0700";
-        SystemCallArchitectures = "native";
-        SystemCallFilter = [
-          "@system-service"
-        ]
-        ++ lib.optionals (!useSendmail) [
-          "~@privileged"
-        ];
-        Restart = "always";
-        UMask = "0077";
       };
-      wantedBy = [ "multi-user.target" ];
+
+      vaultwarden.config = lib.mkMerge [
+        {
+          DATABASE_URL = lib.mkIf cfg.configurePostgres "postgresql:///vaultwarden?host=/run/postgresql";
+          DOMAIN = lib.mkIf (cfg.domain != null) "https://${cfg.domain}";
+        }
+        (lib.mkIf cfg.configureNginx {
+          ENABLE_WEBSOCKET = true;
+          ROCKET_ADDRESS = "127.0.0.1";
+          ROCKET_PORT = lib.mkDefault 8222;
+        })
+      ];
     };
 
-    systemd.services.backup-vaultwarden = lib.mkIf (cfg.backupDir != null) {
-      description = "Backup vaultwarden";
-      environment = {
-        DATA_FOLDER = dataDir;
-        BACKUP_FOLDER = cfg.backupDir;
+    systemd = {
+      services.vaultwarden = {
+        after = [ "network-online.target" ] ++ lib.optional cfg.configurePostgres "postgresql.target";
+        requires = lib.mkIf cfg.configurePostgres [ "postgresql.target" ];
+        wants = [ "network-online.target" ];
+        path = with pkgs; [ openssl ];
+        serviceConfig = {
+          User = user;
+          Group = group;
+          EnvironmentFile = [ configFile ] ++ cfg.environmentFile;
+          ExecStart = lib.getExe vaultwarden;
+          LimitNOFILE = "1048576";
+          CapabilityBoundingSet = [ "" ];
+          DeviceAllow = [ "" ];
+          DevicePolicy = "closed";
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = !useSendmail;
+          PrivateDevices = !useSendmail;
+          PrivateTmp = true;
+          PrivateUsers = !useSendmail;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "noaccess";
+          ProtectSystem = "strict";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+            "AF_UNIX"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          inherit StateDirectory;
+          StateDirectoryMode = "0700";
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+          ]
+          ++ lib.optionals (!useSendmail) [
+            "~@privileged"
+          ];
+          Restart = "always";
+          UMask = "0077";
+        };
+        wantedBy = [ "multi-user.target" ];
       };
-      path = with pkgs; [ sqlite ];
-      # if both services are started at the same time, vaultwarden fails with "database is locked"
-      before = [ "vaultwarden.service" ];
-      serviceConfig = {
-        SyslogIdentifier = "backup-vaultwarden";
-        Type = "oneshot";
-        User = lib.mkDefault user;
-        Group = lib.mkDefault group;
-        ExecStart = "${pkgs.bash}/bin/bash ${./backup.sh}";
+
+      services.backup-vaultwarden = lib.mkIf (cfg.backupDir != null) {
+        description = "Backup vaultwarden";
+        environment = {
+          DATA_FOLDER = dataDir;
+          BACKUP_FOLDER = cfg.backupDir;
+        };
+        path = with pkgs; [ sqlite ];
+        # if both services are started at the same time, vaultwarden fails with "database is locked"
+        before = [ "vaultwarden.service" ];
+        serviceConfig = {
+          SyslogIdentifier = "backup-vaultwarden";
+          Type = "oneshot";
+          User = lib.mkDefault user;
+          Group = lib.mkDefault group;
+          ExecStart = "${pkgs.bash}/bin/bash ${./backup.sh}";
+        };
+        wantedBy = [ "multi-user.target" ];
+      };
+
+      timers.backup-vaultwarden = lib.mkIf (cfg.backupDir != null) {
+        description = "Backup vaultwarden on time";
+        timerConfig = {
+          OnCalendar = lib.mkDefault "23:00";
+          Persistent = "true";
+          Unit = "backup-vaultwarden.service";
+        };
+        wantedBy = [ "multi-user.target" ];
+      };
+
+      tmpfiles.settings = lib.mkIf (cfg.backupDir != null) {
+        "10-vaultwarden".${cfg.backupDir}.d = {
+          inherit user group;
+          mode = "0770";
+        };
       };
-      wantedBy = [ "multi-user.target" ];
     };
 
-    systemd.timers.backup-vaultwarden = lib.mkIf (cfg.backupDir != null) {
-      description = "Backup vaultwarden on time";
-      timerConfig = {
-        OnCalendar = lib.mkDefault "23:00";
-        Persistent = "true";
-        Unit = "backup-vaultwarden.service";
-      };
-      wantedBy = [ "multi-user.target" ];
-    };
-
-    systemd.tmpfiles.settings = lib.mkIf (cfg.backupDir != null) {
-      "10-vaultwarden".${cfg.backupDir}.d = {
-        inherit user group;
-        mode = "0770";
+    users = {
+      groups.vaultwarden = { };
+      users.vaultwarden = {
+        inherit group;
+        isSystemUser = true;
       };
     };
   };

nixos/tests/all-tests.nix

@@ -828,6 +828,7 @@ in
   kmonad = runTest ./kmonad.nix;
   knot = runTest ./knot.nix;
   komga = runTest ./komga.nix;
+  komodo-periphery = runTest ./komodo-periphery.nix;
   krb5 = discoverTests (import ./krb5);
   ksm = runTest ./ksm.nix;
   kthxbye = runTest ./kthxbye.nix;

nixos/tests/komodo-periphery.nix

@@ -0,0 +1,26 @@
+{ lib, ... }:
+{
+  name = "komodo-periphery";
+  meta = {
+    maintainers = with lib.maintainers; [ channinghe ];
+  };
+
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      virtualisation.docker.enable = true;
+      services.komodo-periphery = {
+        enable = true;
+        bindIp = "127.0.0.1";
+        port = 8120;
+        ssl.enable = false;
+        passkeys = [ "test-passkey" ];
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("komodo-periphery.service")
+    machine.wait_for_open_port(8120)
+    machine.succeed("systemctl status komodo-periphery.service")
+  '';
+}

pkgs/applications/backup/timeshift/unwrapped.nix

@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "timeshift";
-  version = "25.07.7";
+  version = "25.12.0";
   outputs = [
     "out"
     "man"
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "linuxmint";
     repo = "timeshift";
     tag = finalAttrs.version;
-    hash = "sha256-X3TwUkOeGzcgFM/4Fyfs8eQuGK2wHe3t13WSpIizX8s=";
+    hash = "sha256-JAp1kZ8DBjhB6Xk4ZeL2ozJoTPPcu5gn7Fh+vbm+Zjg=";
   };
 
   postPatch = ''

pkgs/applications/video/mpv/scripts/mpv-gallery-view.nix

@@ -0,0 +1,77 @@
+{
+  lib,
+  fetchFromGitHub,
+  unstableGitUpdater,
+  buildLua,
+  extraThumbgens ? 0,
+}:
+let
+  zeroPad =
+    num: width:
+    let
+      len = builtins.stringLength (toString num);
+      padLen = lib.max 0 (width - len);
+      padding = lib.concatStrings (builtins.genList (_: "0") padLen);
+    in
+    "${padding}${toString num}";
+  width = builtins.stringLength (toString extraThumbgens);
+  extraThumbgenScripts = builtins.genList (
+    i: "gallery-thumbgen.${zeroPad (i + 1) width}.lua"
+  ) extraThumbgens;
+in
+buildLua (finalAttrs: {
+  pname = "mpv-gallery-view";
+  version = "0-unstable-2024-09-27";
+
+  src = fetchFromGitHub {
+    owner = "occivink";
+    repo = "mpv-gallery-view";
+    rev = "4a8e664d52679fff3f05f29aa7a54b86150704bc";
+    hash = "sha256-u4PQtTKdE357G1X+Ag0Dexd/jhmZVsAXxdUgEp8bMPw=";
+  };
+
+  postPatch = ''
+    substituteInPlace \
+      scripts/contact-sheet.lua \
+      scripts/playlist-view.lua \
+      --replace-fail "~~/script-modules/?.lua;" "$out/share/mpv/script-modules/?.lua;"
+  '';
+
+  dontFixup = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm444 -t $out/share/mpv/scripts scripts/*.lua
+    install -Dm444 -t $out/share/mpv/script-modules script-modules/*.lua
+
+    for thumbgen in ${lib.escapeShellArgs extraThumbgenScripts}; do
+      ln -s $out/share/mpv/scripts/gallery-thumbgen.lua $out/share/mpv/scripts/"$thumbgen"
+    done
+
+    runHook postInstall
+  '';
+
+  scriptPath = "playlist-view.lua";
+  extraScripts = [
+    "contact-sheet.lua"
+    "gallery-thumbgen.lua"
+  ]
+  ++ extraThumbgenScripts;
+
+  passthru = {
+    updateScript = unstableGitUpdater { };
+    extraWrapperArgs = map (script: [
+      "--add-flags"
+      "--script=${finalAttrs.finalPackage}/share/mpv/scripts/${script}"
+    ]) finalAttrs.extraScripts;
+  };
+
+  meta = {
+    description = "Gallery-view scripts for mpv";
+    homepage = "https://github.com/occivink/mpv-gallery-view";
+    platforms = lib.platforms.all;
+    license = lib.licenses.unlicense;
+    maintainers = with lib.maintainers; [ musjj ];
+  };
+})

pkgs/applications/virtualization/docker/cli-system-plugin-dir-from-env.patch

@@ -0,0 +1,31 @@
+diff --git a/cli-plugins/manager/manager_unix.go b/cli-plugins/manager/manager_unix.go
+index f546dc3849..5e3ae08dbc 100644
+--- a/cli-plugins/manager/manager_unix.go
++++ b/cli-plugins/manager/manager_unix.go
+@@ -2,6 +2,11 @@
+ 
+ package manager
+ 
++import (
++	"os"
++	"path/filepath"
++)
++
+ // defaultSystemPluginDirs are the platform-specific locations to search
+ // for plugins in order of preference.
+ //
+@@ -12,9 +17,8 @@
+ // 3. Platform-specific defaultSystemPluginDirs (as defined below).
+ //
+ // [ConfigFile.CLIPluginsExtraDirs]: https://pkg.go.dev/github.com/docker/cli@v26.1.4+incompatible/cli/config/configfile#ConfigFile.CLIPluginsExtraDirs
+-var defaultSystemPluginDirs = []string{
+-	"/usr/local/lib/docker/cli-plugins",
+-	"/usr/local/libexec/docker/cli-plugins",
+-	"/usr/lib/docker/cli-plugins",
+-	"/usr/libexec/docker/cli-plugins",
++var defaultSystemPluginDirs []string
++
++func init() {
++	defaultSystemPluginDirs = filepath.SplitList(os.Getenv("DOCKER_CLI_PLUGIN_DIRS"))
+ }
+

pkgs/applications/virtualization/docker/compose.nix

@@ -15,7 +15,11 @@ buildGoModule rec {
     hash = "sha256-7g9l9SBxPY3jMS3DWZNI/fhOZN1oZo1qkUfhMfbzAaM=";
   };
 
-  vendorHash = "sha256-COfB0MLBMOfTdLbpShBkMOEule/1cu6Bo5lm1ieO/nA=";
+  vendorHash = "sha256-EFbEd1UwrBnH6pSh+MvupYdie8SnKr8y6K9lQflBSlk=";
+
+  modPostBuild = ''
+    patch -d vendor/github.com/docker/cli/ -p1 < ${./cli-system-plugin-dir-from-env.patch}
+  '';
 
   ldflags = [
     "-X github.com/docker/compose/v2/internal.Version=${version}"

pkgs/applications/virtualization/docker/default.nix

@@ -258,10 +258,9 @@ let
         ++ lib.optionals sbomSupport [ docker-sbom ]
         ++ lib.optionals initSupport [ docker-init ];
 
-      pluginsRef = symlinkJoin {
-        name = "docker-plugins";
-        paths = plugins;
-      };
+      dockerCliPluginsDirs = lib.strings.concatStringsSep ":" (
+        map (p: "${p}/libexec/docker/cli-plugins") plugins
+      );
     in
     buildGoModule (
       {
@@ -277,6 +276,10 @@ let
           hash = cliHash;
         };
 
+        patches = [
+          ./cli-system-plugin-dir-from-env.patch
+        ];
+
         vendorHash = null;
 
         nativeBuildInputs = [
@@ -298,10 +301,6 @@ let
         postPatch = ''
           patchShebangs man scripts/build/
           substituteInPlace ./scripts/build/.variables --replace-fail "set -eu" ""
-        ''
-        + lib.optionalString (plugins != [ ]) ''
-          substituteInPlace ./cli-plugins/manager/manager_unix.go --replace-fail /usr/libexec/docker/cli-plugins \
-              "${pluginsRef}/libexec/docker/cli-plugins"
         '';
 
         # Keep eyes on BUILDTIME format - https://github.com/docker/cli/blob/${version}/scripts/build/.variables
@@ -330,7 +329,8 @@ let
           install -Dm755 ./build/docker $out/libexec/docker/docker
 
           makeWrapper $out/libexec/docker/docker $out/bin/docker \
-            --prefix PATH : "$out/libexec/docker:$extraPath"
+            --prefix PATH : "$out/libexec/docker:$extraPath" \
+            --prefix DOCKER_CLI_PLUGIN_DIRS : "${dockerCliPluginsDirs}"
         ''
         + lib.optionalString (!clientOnly) ''
           # symlink docker daemon to docker cli derivation

pkgs/by-name/ad/adios2/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   perl,
   cmake,
   ninja,
@@ -66,12 +67,25 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     chmod +x cmake/install/post/adios2-config.pre.sh.in
     patchShebangs cmake/install/post/{generate-adios2-config,adios2-config.pre}.sh.in
+  '';
 
+  # TODO: remove these patches when updating to > v2.11.x, which will already include these commits
+  patches = [
     # use upstream GoogleTest.cmake
     # see https://github.com/ornladios/ADIOS2/issues/4659
-    substituteInPlace cmake/GoogleTest.cmake \
-      --replace-fail 'CMAKE_VERSION VERSION_LESS 4' 'TRUE'
-  '';
+    (fetchpatch2 {
+      name = "googletest-cmake-fix.patch";
+      url = "https://github.com/ornladios/ADIOS2/commit/20aab0f99d38dc4437b086edf6b44ecf4100ed76.patch?full_index=1";
+      hash = "sha256-CZD3QUATX0JI75Oip0LNwirWIwgQakWuCHs1fIjwzj0=";
+    })
+    # fix double import cmake conflict
+    # see https://github.com/ornladios/ADIOS2/issues/4760
+    (fetchpatch2 {
+      name = "cmake-target-guard-fix.patch";
+      url = "https://github.com/ornladios/ADIOS2/commit/23fd08a10b52a971150f93f99d341b83b8096e3d.patch?full_index=1";
+      hash = "sha256-+29a9JgiCv2kBz0uUT8Kn/Tf3KDD1JNPdzeb/DruTBo=";
+    })
+  ];
 
   nativeBuildInputs = [
     perl

pkgs/by-name/ba/basedpyright/package.nix

@@ -18,16 +18,16 @@
 
 buildNpmPackage rec {
   pname = "basedpyright";
-  version = "1.34.0";
+  version = "1.36.0";
 
   src = fetchFromGitHub {
     owner = "detachhead";
     repo = "basedpyright";
     tag = "v${version}";
-    hash = "sha256-GTyxJBjzRlCjyaa7xayHzlKQApCbMTh+MUOEZydjteA=";
+    hash = "sha256-S9//JconHEst7JkmTejwRc9gtmnokEV4otUQURA7pNI=";
   };
 
-  npmDepsHash = "sha256-zNmZ4wXxe31NnQ+VlTLoPM2zTDmKdw1D28pi/roybdQ=";
+  npmDepsHash = "sha256-VHQOmRWirZYnoxk/JzGwFFV5QEIyHGg/isDvf/f7uro=";
   npmWorkspace = "packages/pyright";
 
   preBuild = ''

pkgs/by-name/ch/chirp/package.nix

@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication {
   pname = "chirp";
-  version = "0.4.0-unstable-2025-12-03";
+  version = "0.4.0-unstable-2025-12-11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kk7ds";
     repo = "chirp";
-    rev = "ac7574adb5e1c93a2f7c32aa218b7974dd15b4e5";
-    hash = "sha256-GXzegpdm61QvuXaUVokMO5rC7mrOOw2dD+0FGZLF9HY=";
+    rev = "02e4fd371333129f3496431f400c63442a427806";
+    hash = "sha256-1D50VYW8YGHlwfKyIMx/mrCsbqKqPSK+VZitLfZlozs=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ci/cinnamon-session/package.nix

@@ -33,13 +33,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cinnamon-session";
-  version = "6.6.0";
+  version = "6.6.1";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "cinnamon-session";
     tag = version;
-    hash = "sha256-16bBehc8NuPd9vr/J7Y5MoVsqOBQWzh63pzQZ96O0vs=";
+    hash = "sha256-zPfyPBKN9Qqs2UndW0vYzBqmeFla3ytvdcv/X2dv1zs=";
   };
 
   buildInputs = [

pkgs/by-name/ci/cinnamon-settings-daemon/package.nix

@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-settings-daemon";
-  version = "6.6.0";
+  version = "6.6.1";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "cinnamon-settings-daemon";
     tag = version;
-    hash = "sha256-Ho7L4BqLJ0Vz9+ZijZ8ZhQr1NJmGVf8JWtUpplx1JF0=";
+    hash = "sha256-WK7MU63M3B0C4Dsik6j4cDyBTZlkF6pofZi2aJcH9eI=";
   };
 
   patches = [

pkgs/by-name/cl/clj-kondo/package.nix

@@ -6,11 +6,11 @@
 
 buildGraalvmNativeImage (finalAttrs: {
   pname = "clj-kondo";
-  version = "2025.09.22";
+  version = "2025.10.23";
 
   src = fetchurl {
     url = "https://github.com/clj-kondo/clj-kondo/releases/download/v${finalAttrs.version}/clj-kondo-${finalAttrs.version}-standalone.jar";
-    sha256 = "sha256-TD7GlvYfGbFaM3qIEngIRbBVKEQ2g2sdAjE/oO1ZlHw=";
+    sha256 = "sha256-bqHCDPL0R/Or6xHb5QDaw32S+Q2hAly3H5BUbQMDU0M=";
   };
 
   extraNativeImageBuildArgs = [

pkgs/by-name/de/desync/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "desync";
-  version = "0.9.6";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "folbricht";
     repo = "desync";
     tag = "v${version}";
-    hash = "sha256-TwzD9WYi4cdDPKKV2XoqkGWJ9CzIwoxeFll8LqNWf/E=";
+    hash = "sha256-aRxWq9gGfglfBixS7xOoj8r29rJRAfGj4ydcSFf/7P0=";
   };
 
-  vendorHash = "sha256-CBw5FFGQgvdYoOUZ6E1F/mxqzNKOwh2IZbsh0dAsLEE=";
+  vendorHash = "sha256-ywID0txn7L6+QkYNvGvO5DTsDQBZLU+pGwNd3q7kLKI=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ea/eaglemode/package.nix

@@ -12,7 +12,7 @@
   pkg-config,
   librsvg,
   glib,
-  gtk2,
+  gtk3,
   libXext,
   libXxf86vm,
   poppler,
@@ -32,18 +32,22 @@
   extraRuntimeDeps ? [ ],
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "eaglemode";
-  version = "0.96.2";
+  version = "0.96.3";
 
   src = fetchurl {
-    url = "mirror://sourceforge/eaglemode/${pname}-${version}.tar.bz2";
-    hash = "sha256:1al5n2mcjp0hmsvi4hsdmzd7i0id5i3255xplk0il1nmzydh312a";
+    url = "mirror://sourceforge/eaglemode/eaglemode-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-AHeupgEnyQylRWFDrPeo4b0mNONqG+6QwWnRpYknqOQ=";
   };
 
   # Fixes "Error: No time zones found." on the clock
   postPatch = ''
-    substituteInPlace src/emClock/emTimeZonesModel.cpp --replace "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
+    substituteInPlace src/emClock/emTimeZonesModel.cpp \
+      --replace-fail "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
+
+    substituteInPlace makers/emPdf.maker.pm \
+      --replace-fail gtk+-2.0 gtk+-3.0
   '';
 
   nativeBuildInputs = [
@@ -61,7 +65,7 @@ stdenv.mkDerivation rec {
     libwebp
     librsvg
     glib
-    gtk2
+    gtk3
     libXxf86vm
     libXext
     poppler
@@ -109,18 +113,18 @@ stdenv.mkDerivation rec {
       wrapProgram $out/bin/eaglemode --set EM_DIR "$out" --prefix LD_LIBRARY_PATH : "$out/lib" --prefix PATH : "${runtimeDeps}"
       for i in 32 48 96; do
         mkdir -p $out/share/icons/hicolor/''${i}x''${i}/apps
-        ln -s $out/res/icons/${pname}$i.png $out/share/icons/hicolor/''${i}x''${i}/apps/${pname}.png
+        ln -s $out/res/icons/eaglemode$i.png $out/share/icons/hicolor/''${i}x''${i}/apps/eaglemode.png
       done
       runHook postInstall
     '';
 
   desktopItems = [
     (makeDesktopItem {
-      name = pname;
-      exec = pname;
-      icon = pname;
+      name = "eaglemode";
+      exec = "eaglemode";
+      icon = "eaglemode";
       desktopName = "Eagle Mode";
-      genericName = meta.description;
+      genericName = "Zoomable User Interface";
       categories = [
         "Game"
         "Graphics"
@@ -132,7 +136,7 @@ stdenv.mkDerivation rec {
 
   passthru.updateScript = directoryListingUpdater {
     url = "https://eaglemode.sourceforge.net/download.html";
-    extraRegex = "(?!.*(x86_64|setup64|livecd)).*";
+    extraRegex = "(?!.*(x86_64|setup64|livecd|amd64)).*";
   };
 
   meta = {
@@ -145,4 +149,4 @@ stdenv.mkDerivation rec {
     ];
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/ea/easyrsa/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "easyrsa";
-  version = "3.2.4";
+  version = "3.2.5";
 
   src = fetchFromGitHub {
     owner = "OpenVPN";
     repo = "easy-rsa";
     rev = "v${version}";
-    hash = "sha256-X/EXiiSLDSxxSSNnb6lkPsvdA0vSp/zPN+wSNuUMzrg=";
+    hash = "sha256-GD4KL8CqQ8U0ISrLm8zlnfi1AuYK0AZLiLuufEhZ7B0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/fd/fdt-viewer/package.nix

@@ -0,0 +1,41 @@
+{
+  cmake,
+  fetchFromGitHub,
+  git,
+  lib,
+  qt6,
+  stdenv,
+  unstableGitUpdater,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "fdt-viewer";
+  version = "0-unstable-2024-12-06";
+
+  src = fetchFromGitHub {
+    owner = "dev-0x7C6";
+    repo = "fdt-viewer";
+    rev = "3488a599bfe0a92a0aec3cf421ef0c6f385f0737";
+    hash = "sha256-THu6HZpVSqsU2M/5AVflTaW8l8FNSYVI/f1kbZ+zCsA=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    qt6.wrapQtAppsHook
+    cmake
+    git
+  ];
+
+  buildInputs = [ qt6.qtbase ];
+
+  passthru.updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };
+
+  meta = {
+    description = "Flattened Device Tree Viewer written in Qt";
+    homepage = "https://github.com/dev-0x7C6/fdt-viewer";
+    license = lib.licenses.gpl3Only;
+    maintainers = [ lib.maintainers.jmbaur ];
+    mainProgram = "fdt-viewer";
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/fo/folder-color-switcher/package.nix

@@ -8,14 +8,14 @@
 
 stdenvNoCC.mkDerivation {
   pname = "folder-color-switcher";
-  version = "1.6.8";
+  version = "1.6.9";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "folder-color-switcher";
     # They don't really do tags, this is just a named commit.
-    rev = "d135f29d688d89a0e7b48acec9e08738c7976ee1";
-    hash = "sha256-3EFnQxTYcJLGjfAzZNS7pgVDUwuU3juOAwUyaKOHemI=";
+    rev = "fefe156e336d2a0bbfe1ca61cf4e6873c74ae405";
+    hash = "sha256-KL3ipzZiHEj+jwAmbIOCeSBOwm3bMpJf4PVhGS+Xx24=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fo/fosrl-gerbil/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gerbil";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "gerbil";
     tag = version;
-    hash = "sha256-Pnti0agkohRBWQ42cqNOA5TnnSLP9JbOK1eyGf88cao=";
+    hash = "sha256-A3ehUYR5dM2No0AXxOCXZi83Lh/NXo6vMSFtYpvSAJo=";
   };
 
-  vendorHash = "sha256-Sz+49ViQUwJCy7wXDrQf7c76rOZbSGBCgB+Du8T6ug0=";
+  vendorHash = "sha256-FZuIDHAQtqEuxE1W4yYRnr4Kj8YedNi0Z1NeuWrgnRc=";
 
   # patch out the /usr/sbin/iptables
   postPatch = ''

pkgs/by-name/fo/fosrl-newt/package.nix

@@ -3,37 +3,36 @@
   buildGoModule,
   fetchFromGitHub,
   versionCheckHook,
+  nix-update-script,
 }:
 
 buildGoModule rec {
   pname = "newt";
-  version = "1.5.2";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "newt";
     tag = version;
-    hash = "sha256-svMAMPK8f5cwIPzr0+WdoWzHDV1jtuO1Lm2oZIVHE6k=";
+    hash = "sha256-R6X9DOu1iGS/a4d5kmKoBZI0L5k7S0w3SHHFQnQH/ho=";
   };
 
-  vendorHash = "sha256-wNdZEfPx12T0jvCEDkz04X8N6t/pNIOXWFSTHteeZYs=";
-
-  postPatch = ''
-    substituteInPlace main.go \
-      --replace-fail "version_replaceme" "${version}"
-  '';
+  vendorHash = "sha256-5Xr6mwPtsqEliKeKv2rhhp6JC7u3coP4nnhIxGMqccU=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
   ldflags = [
     "-s"
     "-w"
+    "-X=main.newtVersion=${version}"
   ];
 
   doInstallCheck = true;
 
   versionCheckProgramArg = [ "-version" ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Tunneling client for Pangolin";
     homepage = "https://github.com/fosrl/newt";
@@ -43,6 +42,7 @@ buildGoModule rec {
       fab
       jackr
       sigmasquadron
+      water-sucks
     ];
     mainProgram = "newt";
   };

pkgs/by-name/fo/fosrl-olm/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "olm";
-  version = "1.1.5";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "olm";
     tag = version;
-    hash = "sha256-zUqKfrtNx6XmMSJHAfc1/ht3nPR5xy1BIijMT6u2+s8=";
+    hash = "sha256-NVd0kPfP9JzCOBoBtz+9MPmuoX353XyOx4L/m9q8zY0=";
   };
 
-  vendorHash = "sha256-mY/JE26/nug9cg4hPp7hgIoKf8ORnVlDDzVw3ioBj2s=";
+  vendorHash = "sha256-BhMJ7x4WDOC6pSi9nW4F2H3cumOeoHkbrQ6Xq9njkog=";
 
   ldflags = [
     "-s"

pkgs/by-name/ga/garmindb/package.nix

@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "garmindb";
-  version = "3.6.5";
+  version = "3.6.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tcgoetz";
     repo = "garmindb";
     tag = "v${version}";
-    hash = "sha256-uXRFvItaO4ptvxzvqN8bOzTUWcVeGk0IX82z+yLWFDw=";
+    hash = "sha256-Dosw6/n4GYYJR3KFP4RdNOUpACpRAfMMmyNj/J54TMk=";
   };
 
   pythonRelaxDeps = [

pkgs/by-name/gh/gh-gei/package.nix

@@ -7,13 +7,13 @@
 
 buildDotnetModule rec {
   pname = "gh-gei";
-  version = "1.22.0";
+  version = "1.23.0";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "gh-gei";
     rev = "v${version}";
-    hash = "sha256-5BGYNhrHtRHtjfdjSodlhc0Yu/GcYXjvdzGBg2AWVzc=";
+    hash = "sha256-9sTyxLs5ug1fKh2qvKkuhA9r0cmfdaPT+pWuc6hxyN4=";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0_4xx;

pkgs/by-name/gn/gnome-kra-ora-thumbnailer/package.nix

@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  gnome-common,
+  intltool,
+  libarchive,
+  gdk-pixbuf,
+  autoreconfHook,
+  pkg-config,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gnome-kra-ora-thumbnailer";
+  version = "1.4";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "GNOME";
+    repo = "gnome-kra-ora-thumbnailer";
+    tag = finalAttrs.version;
+    hash = "sha256-zyEX8vOn8Gdt3B8sx3oXcRUpm2h2use4CUKsWqaqbaw=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    intltool
+    autoreconfHook
+    pkg-config
+    gnome-common
+  ];
+
+  buildInputs = [
+    libarchive
+    gdk-pixbuf
+  ];
+
+  meta = {
+    description = "Thumbnailer for Krita and MyPaint images";
+    homepage = "https://gitlab.gnome.org/GNOME/gnome-kra-ora-thumbnailer/-/blob/${finalAttrs.src.tag}?ref_type=tags";
+    changelog = "https://gitlab.gnome.org/GNOME/gnome-kra-ora-thumbnailer/-/blob/${finalAttrs.src.tag}/NEWS?ref_type=tags";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ pancaek ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/go/google-chrome/package.nix

@@ -170,11 +170,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "143.0.7499.40";
+    version = "143.0.7499.109";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-rx5yfN8fD4bs2SRASJ65YFijfq9xknUDwZiXdgAagIU=";
+      hash = "sha256-36YeOTThfFzMQs+wxxFLwwUmp0uPBb0+b8TD7LG1e+0=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -272,11 +272,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "143.0.7499.41";
+    version = "143.0.7499.110";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/mn7icxthshss2p6fseuwaupjs4_143.0.7499.41/GoogleChrome-143.0.7499.41.dmg";
-      hash = "sha256-L8Zl/hGDqWPQQ+dnaZw7QVifo+N81BCYNzawW+kcyDg=";
+      url = "http://dl.google.com/release2/chrome/p5xbkc3osahdfsgniofymq5nqq_143.0.7499.110/GoogleChrome-143.0.7499.110.dmg";
+      hash = "sha256-Ed0THsSrWWK0x/h+yhzQdU8PBrZkM/tLiqDEnWAtCMw=";
     };
 
     dontPatch = true;
@@ -316,6 +316,7 @@ let
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [
       johnrtitor
+      mdaniels5757
     ];
     platforms = lib.platforms.darwin ++ [ "x86_64-linux" ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];

pkgs/by-name/go/google-chrome/update.sh

@@ -41,7 +41,7 @@ update_linux() {
 
     local download_url="https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${version}-1_amd64.deb"
     new_hash="$(nix-prefetch-url "$download_url" 2>/dev/null)"
-    new_sri_hash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$new_hash")"
+    new_sri_hash="$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$new_hash")"
 
     sed -i "/^  linux = stdenvNoCC.mkDerivation/,/^  });/s/version = \".*\"/version = \"$version\"/" "$DEFAULT_NIX"
     sed -i "/^  linux = stdenvNoCC.mkDerivation/,/^  });/s|hash = \".*\"|hash = \"$new_sri_hash\"|" "$DEFAULT_NIX"
@@ -87,8 +87,8 @@ update_darwin() {
     manifest_version="$(echo "$response" | xmllint --xpath "string(//manifest/@version)" -)"
 
     local download_url="$url$pkg"
-    new_hash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$(nix-prefetch-url "$download_url" 2>/dev/null)")"
-    new_sri_hash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$new_hash")"
+    new_hash="$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$(nix-prefetch-url "$download_url" 2>/dev/null)")"
+    new_sri_hash="$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$new_hash")"
 
     sed -i "/^  darwin = stdenvNoCC.mkDerivation/,/^  });/s/version = \".*\"/version = \"$manifest_version\"/" "$DEFAULT_NIX"
     sed -i "/^  darwin = stdenvNoCC.mkDerivation/,/^  });/s|hash = \".*\"|hash = \"$new_sri_hash\"|" "$DEFAULT_NIX"

pkgs/by-name/is/istat-menus/package.nix

@@ -10,11 +10,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "istat-menus";
-  version = "7.10.4";
+  version = "7.20";
 
   src = fetchurl {
     url = "https://cdn.istatmenus.app/files/istatmenus${lib.versions.major finalAttrs.version}/versions/iStatMenus${finalAttrs.version}.zip";
-    hash = "sha256-9fw0J492ywzuKXGR47WAjL6IROCRByCn7KsbQecUU+w=";
+    hash = "sha256-oJApYp7ejtcMrm7CyeohV/euXYkJJ0yCRBW2i5AgcEE=";
   };
 
   sourceRoot = ".";

pkgs/by-name/ko/komodo/package.nix

@@ -3,6 +3,7 @@
   rustPlatform,
   fetchFromGitHub,
   nix-update-script,
+  nixosTests,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -22,7 +23,12 @@ rustPlatform.buildRustPackage rec {
   # > error: doctest failed, to rerun pass `-p komodo_client --doc`
   doCheck = false;
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = {
+      inherit (nixosTests) komodo-periphery;
+    };
+  };
 
   meta = {
     description = "Tool to build and deploy software on many servers";

pkgs/by-name/li/lightdm-slick-greeter/package.nix

@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lightdm-slick-greeter";
-  version = "2.2.3";
+  version = "2.2.4";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "slick-greeter";
     rev = version;
-    hash = "sha256-htyFH1Q8RFyvkW75NMpjajNJDzv/87k/Dr8+R5beT2w=";
+    hash = "sha256-Kq5FcippvMyxxA56uH41UdOCrP2wSuw0Tyv1OFxKD5Q=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ll/llama-cpp/package.nix

@@ -3,6 +3,7 @@
   autoAddDriverRunpath,
   cmake,
   fetchFromGitHub,
+  installShellFiles,
   nix-update-script,
   stdenv,
 
@@ -89,6 +90,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
+    installShellFiles
     ninja
     pkg-config
   ]
@@ -151,6 +153,10 @@ effectiveStdenv.mkDerivation (finalAttrs: {
 
     mkdir -p $out/include
     cp $src/include/llama.h $out/include/
+
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd llama-server --bash <($out/bin/llama-server --completion-bash)
   ''
   + optionalString rpcSupport "cp bin/rpc-server $out/bin/llama-rpc-server";
 

pkgs/by-name/mi/mint-l-theme/package.nix

@@ -3,25 +3,23 @@
   lib,
   fetchFromGitHub,
   python3,
-  sassc,
-  sass,
+  python3Packages,
 }:
 
 stdenvNoCC.mkDerivation rec {
   pname = "mint-l-theme";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "mint-l-theme";
     rev = version;
-    hash = "sha256-QPTU/wCOytleuiQAodGzZ1MGWD2Sk7eoeXWpi6nS5As=";
+    hash = "sha256-RdcojX+8SQDJ9LPb81iMzdoCZBpoypf/+aQcgotnVGE=";
   };
 
   nativeBuildInputs = [
     python3
-    sassc
-    sass
+    python3Packages.libsass
   ];
 
   postPatch = ''

pkgs/by-name/mi/mint-themes/package.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mint-themes";
-  version = "2.3.2";
+  version = "2.3.4";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "mint-themes";
     rev = version;
-    hash = "sha256-99bE20XheHzEa2IIlXqdTHs044FRqI3O1xOLkhEC/gY=";
+    hash = "sha256-A4k9iy0d9pGPSYa4m3tAv2GKhFuJPrQODbv+LcP/YXU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/mi/mint-y-icons/package.nix

@@ -10,13 +10,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mint-y-icons";
-  version = "1.8.9";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "mint-y-icons";
     rev = version;
-    hash = "sha256-eUMBn+2qnU6mgDPM6i2ebwEq3mSV3Uo6bXveVew3j9U=";
+    hash = "sha256-1ymx9qcv7YyIK1+mwKaXn8afh1o6I6jMIZtdvId8dEg=";
   };
 
   propagatedBuildInputs = [

pkgs/by-name/ne/nemo/package.nix

@@ -36,13 +36,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "nemo";
-  version = "6.6.0";
+  version = "6.6.1";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "nemo";
     rev = version;
-    hash = "sha256-4YbWkS4J0iDkp+wnwyJg5TD/fhHsbutyh7q+yFLV9Mk=";
+    hash = "sha256-oJvGuPm6FOknSe+5TDLNf0eoE3xC+i78SkYdJUBY4PU=";
   };
 
   patches = [

pkgs/by-name/re/resilio-sync/package.nix

@@ -3,23 +3,24 @@
   stdenv,
   fetchurl,
   autoPatchelfHook,
+  installShellFiles,
   libxcrypt-legacy,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "resilio-sync";
-  version = "3.0.2.1058";
+  version = "3.1.1.1075";
 
   src =
     {
       x86_64-linux = fetchurl {
-        url = "https://download-cdn.resilio.com/${version}/linux/x64/0/resilio-sync_x64.tar.gz";
-        hash = "sha256-jdkxSN/JscL2hxIWuShNKyUk28d453LPDM/+FtzquGQ=";
+        url = "https://download-cdn.resilio.com/${finalAttrs.version}/linux/x64/0/resilio-sync_x64.tar.gz";
+        hash = "sha256-FgRMK5dOxkbaXyi0BPYQZK0tR/ZZuuUGAciwThqICBk=";
       };
 
       aarch64-linux = fetchurl {
-        url = "https://download-cdn.resilio.com/${version}/linux/arm64/0/resilio-sync_arm64.tar.gz";
-        hash = "sha256-iczg1jEy+49QczKxc0/UZJ8LPaCHsXKmSrudVb3RWZ8=";
+        url = "https://download-cdn.resilio.com/${finalAttrs.version}/linux/arm64/0/resilio-sync_arm64.tar.gz";
+        hash = "sha256-P3gUwj3Vr9qn9S6iqlgGfZpK7x5u4U96b886JCE3CYY=";
       };
     }
     .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
@@ -29,6 +30,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     autoPatchelfHook
+    installShellFiles
   ];
 
   buildInputs = [
@@ -37,7 +39,11 @@ stdenv.mkDerivation rec {
   ];
 
   installPhase = ''
-    install -D rslsync "$out/bin/rslsync"
+    runHook preInstall
+
+    installBin rslsync
+
+    runHook postInstall
   '';
 
   meta = {
@@ -52,4 +58,4 @@ stdenv.mkDerivation rec {
     ];
     mainProgram = "rslsync";
   };
-}
+})

pkgs/by-name/ro/roam-research/common.nix

@@ -1,22 +1,22 @@
 { fetchurl }:
 let
   pname = "roam-research";
-  version = "0.0.22";
+  version = "0.0.24";
 in
 {
   inherit pname version;
   sources = {
     x86_64-darwin = fetchurl {
       url = "https://roam-electron-deploy.s3.us-east-2.amazonaws.com/Roam+Research-${version}.dmg";
-      hash = "sha256-GA9m4z+3Dy87Dz/YPG5MYbREQ1cEAdX/MJvkAJ/fe34=";
+      hash = "sha256-c7h+ZvR1LtHhOr63xQcRxXC00on2Ob0XfRyS2HU3Qkg=";
     };
     aarch64-darwin = fetchurl {
       url = "https://roam-electron-deploy.s3.us-east-2.amazonaws.com/Roam+Research-${version}-arm64.dmg";
-      hash = "sha256-+lgV5TpTzN7mJvvVEpBbmq+aBOBKy1CpYkMNhfoxhK0=";
+      hash = "sha256-fPtJAKfh65/dEryi0kdg+1hLfdvzBU87uS0y6eaaVy4=";
     };
     x86_64-linux = fetchurl {
       url = "https://roam-electron-deploy.s3.us-east-2.amazonaws.com/${pname}_${version}_amd64.deb";
-      hash = "sha256-HVGytdP5fkQQABeL9y869GZioutvnBHrwPprAjfBbFg=";
+      hash = "sha256-vpceynkr0/IOSqdmtVxKliSIJEGvLhczqgrsQyqPVIo=";
     };
   };
 }

pkgs/by-name/ro/roboto-mono/package.nix

@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
-    homepage = "https://www.google.com/fonts/specimen/Roboto+Mono";
+    homepage = "https://fonts.google.com/specimen/Roboto+Mono";
     description = "Google Roboto Mono fonts";
     longDescription = ''
       Roboto Mono is a monospaced addition to the Roboto type family. Like

pkgs/by-name/ro/roboto-slab/package.nix

@@ -25,7 +25,7 @@ stdenv.mkDerivation {
   outputHash = "0g663npi5lkvwcqafd4cjrm90ph0nv1lig7d19xzfymnj47qpj8x";
 
   meta = {
-    homepage = "https://www.google.com/fonts/specimen/Roboto+Slab";
+    homepage = "https://fonts.google.com/specimen/Roboto+Slab";
     description = "Roboto Slab Typeface by Google";
     longDescription = ''
       Roboto has a dual nature. It has a mechanical skeleton and the forms

pkgs/by-name/ro/rocketchat-desktop/missing-hashes.json

@@ -0,0 +1,17 @@
+{
+  "@rollup/rollup-android-arm-eabi@npm:4.9.6": "0c2f9b26ec12048da21048a2005fb85b82918066eba3066fd55e1d3b3aaaa948d48e4a5bdaf01e783fc302cfd14248af305c2ab678e3601751dcc9cb34a90280",
+  "@rollup/rollup-android-arm64@npm:4.9.6": "1e971371a8b472db35c43078c620d72a45807e005f7ba981cbc02f477c1871b670462860b8591f55c784fe4755812cb62449b52280e7727edd44030a5f722287",
+  "@rollup/rollup-darwin-arm64@npm:4.9.6": "f0f3a11e6b1c9f86c1be8e6c349395713f01ad304ca698c27634132a06400d4caf76ab8d3b2e93ce42917c4bd1940ed0989565af57af9c3bba9af9afe13828a8",
+  "@rollup/rollup-darwin-x64@npm:4.9.6": "aabb57c3e53c104ce9246f52293f3d6fa3593105e425da7e58b68e3f0e2b19c48cbcf1cdf6420e646297703bc2f07de4134cd456f3c98cb8a694c67c2e438b09",
+  "@rollup/rollup-linux-arm-gnueabihf@npm:4.9.6": "f2279ec807463905bb37d417a4f460037fe464eba8cfc3b0e360dc681922ba7918986c0537adecb4c6f669e3c959fc557f90a83b4bf135a277163461282199fd",
+  "@rollup/rollup-linux-arm64-gnu@npm:4.9.6": "628d62f3db2344f27b10d6efe0d0aae1f1215d3a1f69c36b76f7413afd87bdfd973efac38757c06348111047367acdb5027a49d720250846a4bf6591700728d3",
+  "@rollup/rollup-linux-arm64-musl@npm:4.9.6": "deda2d49fa48dd5b128b5de1250646f9f1f6475ba2ea850989eb53b998caf7807a3b60d088650313ae7acacac5c275e10dbe6e45b652f66a8560f83c21ceb39b",
+  "@rollup/rollup-linux-riscv64-gnu@npm:4.9.6": "f83d37dfc8626c3a39202ce395868bb7042c8213a0f0c05047ac90e83c734c3850e8047467d22517e0b069745d1f3a1963a8910c19ac1e332ad2a9ede7124642",
+  "@rollup/rollup-linux-x64-gnu@npm:4.9.6": "422d2d719db0cc4aba06312102514ec84fa5f7b0a9899ea803275dd7562616e84ba2b022cc8816cb2d6378caa228f3de9d74658bb253e5071b41ea47d19e6f15",
+  "@rollup/rollup-linux-x64-musl@npm:4.9.6": "9c4299965b36bb8a2b36c58039b9e3855d8dccaeb6514e498b4c55af89b2bda9e381e07739b860f3b63fc11395815cfe74abe636101efaaec3bad8182bba640f",
+  "@rollup/rollup-win32-arm64-msvc@npm:4.9.6": "4f5cb68d8ee166083e0c2d95f28823ca70031675953a776de929e4d65401eb1bc98e06c329c442a7a80250ddd4ec8da74af5610d6c6322143d16888bf2968145",
+  "@rollup/rollup-win32-ia32-msvc@npm:4.9.6": "17aa37afe754006c6b5dce3191a2dcb9442694bac6c67457acaeb7397ca8029bb173c95aa8cef85a4d5a986a055807f217a46bcb09d0549f12c6d90bd8a1ad15",
+  "@rollup/rollup-win32-x64-msvc@npm:4.9.6": "9bf08c01d9da090f59de86904228990dbd74f2ade598d19f0684135acdb711f233cd532ab7ee96c7368a68c40942c8c34d868b83e3146ba97b20e8065dece8e0",
+  "dmg-license@npm:1.0.11": "36c0a7b030801b91216affa9b2bb00caa345b2327f298accb2263a80a0320ca305f90b99da68007d187c830c543410d58a0a2bbc229e8d169b0e1d1652ff42aa",
+  "iconv-corefoundation@npm:1.1.7": "0189733ef51a9f481379202cb1919f2677efc44aa014ba662a6fd99e47993e350eab0ff724ed18cda8011c9b78c4702b2d374f732955f1def3fd2a14a29d25c0"
+}

pkgs/by-name/ro/rocketchat-desktop/package.nix

@@ -1,104 +1,148 @@
 {
   lib,
   stdenv,
-  pkgs,
-  fetchurl,
-  wrapGAppsHook3,
+  fetchFromGitHub,
+  yarn-berry,
+  nodejs,
+  pkg-config,
+  node-gyp,
+  python3Packages,
+  electron_39,
+  vips,
+  xvfb-run,
+  copyDesktopItems,
+  makeDesktopItem,
+  makeWrapper,
+  nix-update-script,
 }:
 let
-  libPathNative = { packages }: lib.makeLibraryPath packages;
+  electron = electron_39;
 in
 stdenv.mkDerivation rec {
   pname = "rocketchat-desktop";
-  version = "4.9.1";
+  version = "4.10.0";
 
-  src = fetchurl {
-    url = "https://github.com/RocketChat/Rocket.Chat.Electron/releases/download/${version}/rocketchat-${version}-linux-amd64.deb";
-    hash = "sha256-71B5EqsMVGsTvrdl4gLW3O+7/xy2DNv/zROg2CfXl1E=";
+  src = fetchFromGitHub {
+    owner = "RocketChat";
+    repo = "Rocket.Chat.Electron";
+    tag = version;
+    hash = "sha256-ZEjhYjMcCA2ABNfcwe7JbYCoTBHr+geyMSSh6ceBt5g=";
+  };
+
+  # This might need to be updated between releases.
+  # See https://nixos.org/manual/nixpkgs/stable/#javascript-yarnBerry-missing-hashes
+  missingHashes = ./missing-hashes.json;
+
+  offlineCache = yarn-berry.fetchYarnBerryDeps {
+    inherit src missingHashes;
+    hash = "sha256-ZAb8zDdxsJYRD6LRhtFS8XRc8NbstJbUyaQCbvSdKSg=";
   };
 
   nativeBuildInputs = [
-    wrapGAppsHook3 # to fully work with gnome also needs programs.dconf.enable = true in your configuration.nix
+    yarn-berry.yarnBerryConfigHook
+    yarn-berry
+    nodejs # needed for rollup
+    # needed for vips compilation for the JS sharp dependency
+    pkg-config
+    node-gyp
+    python3Packages.python
+    python3Packages.distutils
+    # install phase helpers
+    copyDesktopItems
+    makeWrapper
   ];
 
-  buildInputs = with pkgs; [
-    gtk3
-    stdenv.cc.cc
-    zlib
-    glib
-    dbus
-    atk
-    pango
-    freetype
-    libgnome-keyring
-    fontconfig
-    gdk-pixbuf
-    cairo
-    cups
-    expat
-    libgpg-error
-    alsa-lib
-    nspr
-    nss
-    xorg.libXrender
-    xorg.libX11
-    xorg.libXext
-    xorg.libXdamage
-    xorg.libXtst
-    xorg.libXcomposite
-    xorg.libXi
-    xorg.libXfixes
-    xorg.libXrandr
-    xorg.libXcursor
-    xorg.libxkbfile
-    xorg.libXScrnSaver
-    systemd
-    libnotify
-    xorg.libxcb
-    at-spi2-atk
-    at-spi2-core
-    libdbusmenu
-    libdrm
-    libgbm
-    xorg.libxshmfence
-    libxkbcommon
+  buildInputs = [
+    vips
   ];
 
-  dontBuild = true;
-  dontConfigure = true;
-
-  unpackPhase = ''
-    ar p $src data.tar.xz | tar xJ ./opt/ ./usr/
+  postPatch = ''
+    # Avoid downloading a changing file during the `rollup` build
+    substituteInPlace rollup.config.mjs \
+      --replace-fail 'downloadSupportedVersions(),' ""
   '';
 
+  env = {
+    PUPPETEER_SKIP_DOWNLOAD = "1";
+    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+    ELECTRON_OVERRIDE_DIST_PATH = electron.dist;
+    NODE_ENV = "production";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    yarn build
+
+    # electronDist needs to be writable
+    cp -r ${electron.dist} electron-dist
+    chmod -R u+w electron-dist
+
+    yarn electron-builder \
+        --config electron-builder.json \
+        --dir \
+        -c.electronDist=electron-dist \
+        -c.electronVersion=${electron.version}
+
+    runHook postBuild
+  '';
+
+  nativeCheckInputs = [
+    xvfb-run
+  ];
+
+  checkPhase = "yarn test";
+
+  desktopItems = [
+    (makeDesktopItem {
+      type = "Application";
+      categories = [
+        "GNOME"
+        "GTK"
+        "Network"
+        "InstantMessaging"
+      ];
+      name = "rocketchat-desktop";
+      desktopName = "Rocket.Chat";
+      genericName = "Rocket.Chat";
+      comment = "Official Desktop Client for Rocket.Chat";
+      icon = "rocketchat-desktop";
+      exec = "rocketchat-desktop";
+      terminal = false;
+      startupWMClass = "Rocket.Chat";
+      mimeTypes = [ "x-scheme-handler/rocketchat" ];
+    })
+  ];
+
   installPhase = ''
     runHook preInstall
-    mkdir -p $out/bin
-    mv opt $out
-    mv usr/share $out
-    ln -s $out/opt/Rocket.Chat/rocketchat-desktop $out/bin/rocketchat-desktop
+
+    mkdir -p $out/bin $out/share/applications
+
+    cp -a dist/*-unpacked/resources $out/share/rocketchat-desktop
+
+    for icon in build/icons/*.png
+    do
+      install -Dm644 $icon $out/share/icons/hicolor/$(basename ''${icon%.png})/apps/rocketchat-desktop.png
+    done
+
+    makeWrapper '${lib.getExe electron}' $out/bin/rocketchat-desktop \
+      --set-default ELECTRON_IS_DEV 0 \
+      --add-flags $out/share/rocketchat-desktop/app.asar \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}"
+
     runHook postInstall
   '';
 
-  postFixup =
-    let
-      libpath = libPathNative { packages = buildInputs; };
-    in
-    ''
-      app=$out/opt/Rocket.Chat
-      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath "${libpath}:$app" \
-        $app/rocketchat-desktop
-      sed -i -e "s|Exec=.*$|Exec=$out/bin/rocketchat-desktop|" $out/share/applications/rocketchat-desktop.desktop
-    '';
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Official Desktop client for Rocket.Chat";
     mainProgram = "rocketchat-desktop";
     homepage = "https://github.com/RocketChat/Rocket.Chat.Electron";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    changelog = "https://github.com/RocketChat/Rocket.Chat.Electron/releases/tag/${src.tag}";
     license = lib.licenses.mit;
-    maintainers = [ ];
-    platforms = [ "x86_64-linux" ];
+    maintainers = with lib.maintainers; [ mynacol ];
+    platforms = lib.platforms.linux;
   };
 }

pkgs/by-name/ro/rover/package.nix

@@ -4,20 +4,21 @@
   pkg-config,
   rustPlatform,
   openssl,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rover";
-  version = "0.24.0";
+  version = "0.37.0";
 
   src = fetchFromGitHub {
     owner = "apollographql";
     repo = "rover";
-    rev = "v${version}";
-    sha256 = "sha256-uyeePAHBDCzXzwIWrKcc9LHClwSI7DMBYod/o4LfK+Y=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-r/uVaj1+J8wQhc/mTCr9RaMMzEIXdJoRU5iX7/eYZMA=";
   };
 
-  cargoHash = "sha256-uR5XvkHUmZzCHZITKgScmzqjLOIvbPyrih/0B1OpsAc=";
+  cargoHash = "sha256-Z9B9DKu6t78Xd75EAKXfB+nr1Au4ylYkZojiENxSykQ=";
 
   buildInputs = [
     openssl
@@ -31,6 +32,8 @@ rustPlatform.buildRustPackage rec {
     OPENSSL_NO_VENDOR = true;
   };
 
+  __darwinAllowLocalNetworking = true;
+
   # This test checks whether the plugins specified in the plugins json file are
   # valid by making a network call to the repo that houses their binaries; but, the
   # build env can't make network calls (impurity)
@@ -38,8 +41,6 @@ rustPlatform.buildRustPackage rec {
     "-- --skip=latest_plugins_are_valid_versions"
   ];
 
-  passthru.updateScript = ./update.sh;
-
   # Some tests try to write configuration data to a location in the user's home
   # directory. Since this would be /homeless-shelter during the build, point at
   # a writeable location instead.
@@ -47,6 +48,8 @@ rustPlatform.buildRustPackage rec {
     export APOLLO_CONFIG_HOME="$PWD"
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "CLI for interacting with ApolloGraphQL's developer tooling, including managing self-hosted and GraphOS graphs";
     mainProgram = "rover";
@@ -57,4 +60,4 @@ rustPlatform.buildRustPackage rec {
       lib.maintainers.aaronarinder
     ];
   };
-}
+})

pkgs/by-name/ro/rover/update.sh

@@ -1,51 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnugrep gnused jq nix-prefetch
-
-set -eu -o pipefail
-
-dirname=$(realpath "$(dirname "$0")")
-nixpkgs=$(realpath "${dirname}/../../../..")
-
-old_rover_version=$(nix eval --raw -f "$nixpkgs" rover.version)
-rover_url=https://api.github.com/repos/apollographql/rover/releases/latest
-rover_tag=$(curl "$rover_url" | jq --raw-output ".tag_name")
-rover_version="$(expr "$rover_tag" : 'v\(.*\)')"
-
-if [[ "$old_rover_version" == "$rover_version" ]]; then
-    echo "rover is up-to-date: ${old_rover_version}"
-    exit 0
-fi
-
-echo "Fetching rover"
-rover_tar_url="https://github.com/apollographql/rover/archive/refs/tags/${rover_tag}.tar.gz"
-{
-    read rover_hash
-    read repo
-} < <(nix-prefetch-url "$rover_tar_url" --unpack --type sha256 --print-path)
-
-# Convert hash to SRI representation
-rover_sri_hash=$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$rover_hash")
-
-# Update rover version.
-sed --in-place \
-    "s|version = \"[0-9.]*\"|version = \"$rover_version\"|" \
-    "$dirname/default.nix"
-
-# Update rover hash.
-sed --in-place \
-    "s|sha256 = \"[a-zA-Z0-9\/+-=]*\"|sha256 = \"$rover_sri_hash\"|" \
-    "$dirname/default.nix"
-
-# Clear cargoHash.
-sed --in-place \
-    "s|cargoHash = \".*\"|cargoHash = \"sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=\"|" \
-    "$dirname/default.nix"
-
-# Update cargoHash
-echo "Computing cargoHash"
-cargoHash=$(
-    nix-prefetch "{ hash }: (import $nixpkgs {}).rover.cargoDeps.overrideAttrs (_: { outputHash = hash; })"
-)
-sed --in-place \
-    "s|cargoHash = \".*\"|cargoHash = \"$cargoHash\"|" \
-    "$dirname/default.nix"

pkgs/by-name/ru/rune/package.nix

@@ -2,28 +2,31 @@
   lib,
   rustPlatform,
   fetchCrate,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rune";
-  version = "0.13.4";
+  version = "0.14.1";
 
   src = fetchCrate {
     pname = "rune-cli";
-    inherit version;
-    hash = "sha256-+2eXTkn9yOMhvS8cFwAorLBNIPvIRwsPOsGCl3gtRSE=";
+    inherit (finalAttrs) version;
+    hash = "sha256-Y/iCH6hwYRhDnu+lPVcJd2YaK3c4YJbfp9VEP1/c1ic=";
   };
 
-  cargoHash = "sha256-SgfgoMqr2Cc7+qhf9Ejl4Ect1JR9RqI9I0b+PrdvdOs=";
+  cargoHash = "sha256-Xp87BvDh3uPtvUMmG1R8g6lEZcf/frEHVXdQ/+kV5OI=";
 
   env = {
-    RUNE_VERSION = version;
+    RUNE_VERSION = finalAttrs.version;
   };
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Interpreter for the Rune Language, an embeddable dynamic programming language for Rust";
     homepage = "https://rune-rs.github.io/";
-    changelog = "https://github.com/rune-rs/rune/releases/tag/${version}";
+    changelog = "https://github.com/rune-rs/rune/releases/tag/${finalAttrs.version}";
     license = with lib.licenses; [
       asl20
       mit
@@ -31,4 +34,4 @@ rustPlatform.buildRustPackage rec {
     maintainers = [ ];
     mainProgram = "rune";
   };
-}
+})

pkgs/by-name/s3/s3backer/fix-darwin-builds.patch

@@ -1,25 +0,0 @@
-From 303a669356fa7cd6bc95ac7076ce51b1cab3970a Mon Sep 17 00:00:00 2001
-From: Adrian Ho <the.gromgit@gmail.com>
-Date: Tue, 6 Sep 2022 10:49:10 +0800
-Subject: [PATCH] Enable macOS builds
-
-macOS requires explicit `environ` declaration.
----
- s3backer.h | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/s3backer.h b/s3backer.h
-index ccc9053..383e246 100644
---- a/s3backer.h
-+++ b/s3backer.h
-@@ -90,6 +90,10 @@
- #include <zlib.h>
- #include <fuse.h>
- 
-+#ifdef __APPLE__
-+extern char **environ;
-+#endif
-+
- #ifndef FUSE_OPT_KEY_DISCARD
- #define FUSE_OPT_KEY_DISCARD -4
- #endif

pkgs/by-name/s3/s3backer/package.nix

@@ -4,41 +4,35 @@
   fetchFromGitHub,
   autoreconfHook,
   pkg-config,
-  fuse,
+  fuse3,
   curl,
   expat,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "s3backer";
-  version = "2.1.4";
+  version = "2.1.6";
 
   src = fetchFromGitHub {
-    sha256 = "sha256-QOTQsU2R68217eO2+2yZhBWtjAdkHuVRbCGv1JD0YLQ=";
-    rev = version;
-    repo = "s3backer";
     owner = "archiecobbs";
+    repo = "s3backer";
+    tag = finalAttrs.version;
+    hash = "sha256-bSqkgNZFevtxyaJwoVRcWWO6ZA/Ekbp2gwSJNBmjHwI=";
   };
 
-  patches = [
-    # from upstream, after latest release
-    # https://github.com/archiecobbs/s3backer/commit/303a669356fa7cd6bc95ac7076ce51b1cab3970a
-    ./fix-darwin-builds.patch
-  ];
-
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
   ];
   buildInputs = [
-    fuse
+    fuse3
     curl
     expat
   ];
 
   # AC_CHECK_DECLS doesn't work with clang
   postPatch = lib.optionalString stdenv.cc.isClang ''
-    substituteInPlace configure.ac --replace \
+    substituteInPlace configure.ac --replace-fail \
       'AC_CHECK_DECLS(fdatasync)' ""
   '';
 
@@ -49,4 +43,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     mainProgram = "s3backer";
   };
-}
+})

pkgs/by-name/st/sticky/package.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sticky";
-  version = "1.28";
+  version = "1.29";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "sticky";
     rev = version;
-    hash = "sha256-6CRkeJ2xuUs3viyYxnrgGFUIakK7ANyVpPZuwU486NM=";
+    hash = "sha256-5KDjvohmdw8j5G8V+uFXPzRSRo/C2HgeRodWfguQjYg=";
   };
 
   postPatch = ''

pkgs/by-name/ty/typescript-go/package.nix

@@ -10,17 +10,17 @@ let
 in
 buildGoModule {
   pname = "typescript-go";
-  version = "0-unstable-2025-12-06";
+  version = "0-unstable-2025-12-13";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "typescript-go";
-    rev = "1d138eaa29bc189e6b4f04b87fe278b6afe7e62f";
-    hash = "sha256-CNVKfWvlRzKPm3WSFxT7te5gd5TfErApseUfrqcwUQU=";
+    rev = "2046634603b3283c38b31489e5e4d81a013832a0";
+    hash = "sha256-F5CCz5IDNe0mhofh7JPmmUwGzasUrTUDQLClybfsBxc=";
     fetchSubmodules = false;
   };
 
-  vendorHash = "sha256-1QEwrFS4Qesp2CwzcsuMP8mLQlXKzfNaM9PFMEfDYxk=";
+  vendorHash = "sha256-1uZemqPsDxiYRVjLlC/UUP4ZXVCjocIBCj9uCzQHmog=";
 
   ldflags = [
     "-s"

pkgs/by-name/wi/windmill/package.nix

@@ -47,13 +47,13 @@
 
 let
   pname = "windmill";
-  version = "1.589.3";
+  version = "1.592.1";
 
   src = fetchFromGitHub {
     owner = "windmill-labs";
     repo = "windmill";
     rev = "v${version}";
-    hash = "sha256-AZcD6eUXzxM8wxVZuLsYci34obuS7NI5vNMrSrheoA0=";
+    hash = "sha256-bVfz0p37Xk1YKP4Ld7GUCq8xpmQvjEtQsjFB2IbMINM=";
   };
 in
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -66,7 +66,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     RUSTY_V8_ARCHIVE = librusty_v8;
   };
 
-  cargoHash = "sha256-kJOBTrq6o/BELNY4YMOChxiMLSvdvICqJiaitImOZMk=";
+  cargoHash = "sha256-ltsPsTXimMpkRiCY2dMo0FZo9YEEi06TyYK0Fi2wF08=";
 
   buildFeatures = [
     "agent_worker_server"
@@ -195,7 +195,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
     sourceRoot = "${src.name}/frontend";
 
-    npmDepsHash = "sha256-LsH4X/FK5RlqR3etFS9BmeQ0bVlPNGztU67VsutusZs=";
+    npmDepsHash = "sha256-w4/ifKMyDnEH1MUxhgHlzuIo5T6faenXx2szGSK1Q10=";
 
     # without these you get a
     # FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory

pkgs/by-name/wr/wrangler/package.nix

@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wrangler";
-  version = "4.53.0";
+  version = "4.54.0";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "workers-sdk";
     rev = "wrangler@${finalAttrs.version}";
-    hash = "sha256-YVIjmqPPgzf++eSwniR82QMun5/c1O+EerFqamZSyNY=";
+    hash = "sha256-aDBKdpAoeVmKRvgNfQ9UrwpoeRG+WWHJ9pu1jrnxA0M=";
   };
 
   pnpmDeps = pnpm_9.fetchDeps {
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
       postPatch
       ;
     fetcherVersion = 2;
-    hash = "sha256-ChOQXP9eW82f6Sxna3mZ5YJMlalPZGaBvsA1C6a5kds=";
+    hash = "sha256-TiaMBbx3diKkyYWD0tbqnLwvvjF4LfL/GhlONJ0iUH4=";
   };
   # pnpm packageManager version in workers-sdk root package.json may not match nixpkgs
   postPatch = ''

pkgs/by-name/xa/xapp-symbolic-icons/package.nix

@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "xapp-symbolic-icons";
-  version = "1.0.5";
+  version = "1.0.6";
 
   src = fetchFromGitHub {
     owner = "xapp-project";
     repo = "xapp-symbolic-icons";
     tag = finalAttrs.version;
-    hash = "sha256-lzxNtalNNKTamoToHWXkqWUoPqQZiWvgETVqLF1ov8Q=";
+    hash = "sha256-vKQLqpKII790bl+oXvKP08sOBCsgpKwHIR2N/bq3pcM=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/xe/xed-editor/package.nix

@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  fetchpatch,
   libxml2,
   libpeas,
   glib,
@@ -13,6 +12,7 @@
   xapp-symbolic-icons,
   pkg-config,
   python3,
+  python3Packages,
   meson,
   ninja,
   versionCheckHook,
@@ -23,25 +23,19 @@
 
 stdenv.mkDerivation rec {
   pname = "xed-editor";
-  version = "3.8.5";
+  version = "3.8.6";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "xed";
     rev = version;
-    hash = "sha256-iPD9SawHA0bwnZvC+IyMq9cFE1YOYLISehUJjTXiqGw=";
+    hash = "sha256-CeKgJg9pyQdnpatdlgqviLnzNv9JCVDm+bFv56trrT8=";
   };
 
   patches = [
     # We patch gobject-introspection and meson to store absolute paths to libraries in typelibs
     # but that requires the install_dir is an absolute path.
     ./correct-gir-lib-path.patch
-
-    # Switch to girepository-2.0
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/xed/raw/6c1a775158f166a3bc5759a6c7bd57bab8f2771a/f/libpeas_libgirepository2.patch";
-      hash = "sha256-wGbmS33YHMiSfd3S0fQRhL6tT536kto69MSgPkY2QIs=";
-    })
   ];
 
   nativeBuildInputs = [
@@ -62,6 +56,7 @@ stdenv.mkDerivation rec {
     gtksourceview4
     libpeas
     gspell
+    python3Packages.pygobject3
     xapp
   ];
 

pkgs/by-name/xv/xviewer/package.nix

@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xviewer";
-  version = "3.4.13";
+  version = "3.4.14";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "xviewer";
     rev = version;
-    hash = "sha256-g7ifQ+2FeZzpWfKgtFrWj0YDOB0++s6KGffHhvqGNQE=";
+    hash = "sha256-2UWe9c9JkNhJyukDp+NTG/bvbMuwSyLBkk2wWvPbxRk=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/zv/zvm/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "zvm";
-  version = "0.8.8";
+  version = "0.8.10";
 
   src = fetchFromGitHub {
     owner = "tristanisham";
     repo = "zvm";
     tag = "v${version}";
-    hash = "sha256-M1xpE2Lq6XZgvH9J0c2Xj1BJNN+4TTGwp4iluVyVAJs=";
+    hash = "sha256-n6V6fMfE7yBSta+RLkQbTFjQUOs4VuonEu6ecWQIFUc=";
   };
 
-  vendorHash = "sha256-wo+vA9AYXIjv6SGb7hNY6ZIVMyJ5enMd8gpQ6u3F7To=";
+  vendorHash = "sha256-yk1n0mW4WIKHTg9xgr+1IKbUpZWIaBaYrA6FwNBjVKc=";
 
   doInstallCheck = true;
   versionCheckProgramArg = "--version";

pkgs/desktops/gnome/extensions/extensionOverrides.nix

@@ -7,6 +7,7 @@
   gjs,
   glib,
   gnome-menus,
+  gtk3,
   nautilus,
   gobject-introspection,
   hddtemp,
@@ -83,6 +84,20 @@ lib.trivial.pipe super [
     '';
   }))
 
+  (patchExtension "ding@rastersoft.com" (old: {
+    nativeBuildInputs = [ wrapGAppsHook3 ];
+    patches = [
+      (replaceVars ./extensionOverridesPatches/ding_at_rastersoft.com.patch {
+        inherit gjs;
+        util_linux = util-linux;
+        xdg_utils = xdg-utils;
+        gtk3_gsettings_path = glib.getSchemaPath gtk3;
+        nautilus_gsettings_path = glib.getSchemaPath nautilus;
+        typelib_path = "${gtk3}/lib/girepository-1.0";
+      })
+    ];
+  }))
+
   (patchExtension "display-brightness-ddcutil@themightydeity.github.com" (old: {
     # Make glib-compile-schemas available
     nativeBuildInputs = [ glib ];

pkgs/desktops/gnome/extensions/extensionOverridesPatches/ding_at_rastersoft.com.patch

@@ -0,0 +1,93 @@
+diff --git a/app/createThumbnail.js b/app/createThumbnail.js
+index 56875b5..3216e79 100755
+--- a/app/createThumbnail.js
++++ b/app/createThumbnail.js
+@@ -1,4 +1,4 @@
+-#!/usr/bin/gjs
++#!@gjs@/bin/gjs
+
+ /* DING: Desktop Icons New Generation for GNOME Shell
+  *
+diff --git a/app/ding.js b/app/ding.js
+index 9a1550a..7bd25fc 100755
+--- a/app/ding.js
++++ b/app/ding.js
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env gjs
++#!@gjs@/bin/gjs
+
+ /* DING: Desktop Icons New Generation for GNOME Shell
+  *
+@@ -18,6 +18,7 @@
+  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+  */
+ 'use strict';
++imports.gi.GIRepository.Repository.dup_default().prepend_search_path('@typelib_path@');
+ imports.gi.versions.Gtk = '3.0';
+ const Gtk = imports.gi.Gtk;
+ const Gio = imports.gi.Gio;
+diff --git a/app/fileItemMenu.js b/app/fileItemMenu.js
+index 4fae9ef..5127eff 100644
+--- a/app/fileItemMenu.js
++++ b/app/fileItemMenu.js
+@@ -520,7 +520,7 @@ var FileItemMenu = class {
+             return;
+         }
+         let xdgEmailCommand = [];
+-        xdgEmailCommand.push('xdg-email');
++        xdgEmailCommand.push('@xdg_utils@/bin/xdg-email');
+         for (let fileItem of this._desktopManager.getCurrentSelection(false)) {
+             fileItem.unsetSelected();
+             xdgEmailCommand.push('--attach');
+diff --git a/app/preferences.js b/app/preferences.js
+index c6517a3..1379a0e 100644
+--- a/app/preferences.js
++++ b/app/preferences.js
+@@ -46,9 +46,12 @@ var prefsWindow;
+  */
+ function init(path) {
+     let schemaSource = GioSSS.get_default();
+-    let schemaGtk = schemaSource.lookup(Enums.SCHEMA_GTK, true);
++    const schemaSourceGtk = Gio.SettingsSchemaSource.new_from_directory('@gtk3_gsettings_path@', Gio.SettingsSchemaSource.get_default(), true);
++    let schemaGtk = schemaSourceGtk.lookup(Enums.SCHEMA_GTK, true);
++    console.log('schemaGtk: ' + schemaGtk);
+     gtkSettings = new Gio.Settings({settings_schema: schemaGtk});
+-    let schemaObj = schemaSource.lookup(Enums.SCHEMA_NAUTILUS, true);
++    const schemaSourceNautilus = Gio.SettingsSchemaSource.new_from_directory('@nautilus_gsettings_path@', Gio.SettingsSchemaSource.get_default(), true);
++    let schemaObj = schemaSourceNautilus.lookup(Enums.SCHEMA_NAUTILUS, true);
+     if (!schemaObj) {
+         nautilusSettings = null;
+     } else {
+@@ -56,7 +59,7 @@ function init(path) {
+         nautilusSettings.connect('changed', _onNautilusSettingsChanged);
+         _onNautilusSettingsChanged();
+     }
+-    const compressionSchema = schemaSource.lookup(Enums.SCHEMA_NAUTILUS_COMPRESSION, true);
++    const compressionSchema = schemaSourceNautilus.lookup(Enums.SCHEMA_NAUTILUS_COMPRESSION, true);
+     if (!compressionSchema) {
+         nautilusCompression = null;
+     } else {
+diff --git a/extension.js b/extension.js
+index 774fbef..3f2023b 100644
+--- a/extension.js
++++ b/extension.js
+@@ -17,6 +17,7 @@
+  */
+ 'use strict';
+ import Clutter from 'gi://Clutter'
++import GIRepository from 'gi://GIRepository';
+ import GLib from 'gi://GLib'
+ import Gio from 'gi://Gio'
+ import Meta from 'gi://Meta'
+@@ -391,9 +392,9 @@ export default class DING extends Extension {
+                     contents += String.fromCharCode(readData[i]);
+                 }
+             }
+-            let path = `gjs ${GLib.build_filenamev([this.path, 'app', 'ding.js'])}`;
++            let path = `@gjs@/bin/gjs ${GLib.build_filenamev([this.path, 'app', 'ding.js'])}`;
+             if (contents.startsWith(path)) {
+-                let proc = new Gio.Subprocess({argv: ['/bin/kill', filename]});
++                let proc = new Gio.Subprocess({argv: ['@util_linux@/bin/kill', filename]});
+                 proc.init(null);
+                 proc.wait(null);
+             }

pkgs/development/gnuradio-modules/gr-difi/default.nix

@@ -0,0 +1,53 @@
+{
+  boost,
+  cmake,
+  fetchFromGitHub,
+  gmp,
+  gnuradio,
+  lib,
+  mkDerivation,
+  pkg-config,
+  python,
+  spdlog,
+  unstableGitUpdater,
+}:
+
+mkDerivation {
+  pname = "gr-difi";
+  version = "0-unstable-2025-08-16";
+
+  src = fetchFromGitHub {
+    owner = "DIFI-Consortium";
+    repo = "gr-difi";
+    rev = "330dd7f245f840903d034603850222a08c5a7c66";
+    hash = "sha256-zztnTaeYEWw9OAvgvy99aoj5UiJ/dOKQQWF+7Lfp59A=";
+  };
+
+  buildInputs = [
+    boost
+    gmp
+    gnuradio
+    spdlog
+  ]
+  ++ lib.optionals (gnuradio.hasFeature "python-support") [
+    python.pkgs.pybind11
+    python.pkgs.numpy
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  passthru.updateScript = unstableGitUpdater {
+    hardcodeZeroVersion = true;
+  };
+
+  meta = {
+    description = "GNU Radio Digital Intermediate Frequency Interoperability (DIFI) Out of Tree Module";
+    homepage = "https://github.com/DIFI-Consortium/gr-difi";
+    license = lib.licenses.gpl3Plus;
+    maintainers = [ lib.maintainers.jmbaur ];
+    platforms = lib.platforms.linux;
+  };
+}

pkgs/development/python-modules/chatlas/default.nix

@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -155,6 +156,11 @@ buildPythonPackage rec {
     "test_tool_yielding_with_error"
     "test_translate_model_params_openai"
     "test_unknown_tool_error_format_updated"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # Fails in the sandbox
+    # RuntimeError: *** -[__NSPlaceholderArray initWithObjects:count:]: attempt to insert nil object from objects[1]
+    "test_can_create_image_from_plot"
   ];
 
   meta = {

pkgs/development/python-modules/columnize/default.nix

@@ -11,6 +11,9 @@ buildPythonPackage rec {
   version = "0.3.11";
   pyproject = true;
 
+  # 3.11 is the git tag for the 0.3.11 version
+  # r-ryantm keeps trying to change the version to 3.11
+  # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "rocky";
     repo = "pycolumnize";

pkgs/development/python-modules/dask/default.nix

@@ -32,6 +32,7 @@
   pytest-cov-stub,
   pytest-mock,
   pytest-rerunfailures,
+  pytest-timeout,
   pytest-xdist,
   pytestCheckHook,
   versionCheckHook,
@@ -39,14 +40,14 @@
 
 buildPythonPackage rec {
   pname = "dask";
-  version = "2025.11.0";
+  version = "2025.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dask";
     repo = "dask";
     tag = version;
-    hash = "sha256-cU4w4dqJQ3ew+fRyD7Lc4URNfW738kKqls6k6j65pIo=";
+    hash = "sha256-oGBOt2ULLn0Kx1rOVNWaC3l1ECotMC2yNeCHya9Tx+s=";
   };
 
   build-system = [
@@ -94,6 +95,7 @@ buildPythonPackage rec {
     pytest-cov-stub
     pytest-mock
     pytest-rerunfailures
+    pytest-timeout
     pytest-xdist
     pytestCheckHook
     versionCheckHook

pkgs/development/python-modules/instructor/default.nix

@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = "jxnl";
     repo = "instructor";
     tag = "v${version}";
-    hash = "sha256-vknPfRHyLoLo2838p/fbjrqyaBORZzLp9+fN98yVDz0=";
+    hash = "sha256-VWFrMgfe92bHUK1hueqJLHQ7G7ATCgK7wXr+eqrVWcw=";
   };
 
   build-system = [ hatchling ];
@@ -83,6 +83,7 @@ buildPythonPackage rec {
     "successfully"
     "test_mode_functions_deprecation_warning"
     "test_partial"
+    "test_provider_invalid_type_raises_error"
 
     # Requires unpackaged `vertexai`
     "test_json_preserves_description_of_non_english_characters_in_json_mode"

pkgs/development/python-modules/ome-zarr/default.nix

@@ -57,6 +57,11 @@ buildPythonPackage rec {
   disabledTests = [
     # attempts to access network
     "test_s3_info"
+
+    # AssertionError: assert {'blocksize':... 'blosc', ...} == {'blocksize':... 'blosc', ...}
+    # comp {'id': 'blosc', 'cname': 'lz4', 'clevel': 5, 'shuffle': 1, 'blocksize': 0}
+    "test_default_compression"
+    "test_write_image_compressed"
   ];
 
   disabledTestPaths = [

pkgs/development/python-modules/openai/default.nix

@@ -51,14 +51,14 @@
 
 buildPythonPackage rec {
   pname = "openai";
-  version = "2.7.2";
+  version = "2.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "openai-python";
     tag = "v${version}";
-    hash = "sha256-g7YbKzRZQOM4e16Mgo7u3QoQQI6VTNrV4DUip9fYsLA=";
+    hash = "sha256-f4d6gz4W04NPu43u0ovORzvF8ZW7oIYO8DJIqUGIEdE=";
   };
 
   postPatch = ''substituteInPlace pyproject.toml --replace-fail "hatchling==1.26.3" "hatchling"'';

pkgs/development/python-modules/peakrdl-cheader/default.nix

@@ -0,0 +1,45 @@
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  gitUpdater,
+  jinja2,
+  lib,
+  peakrdl,
+  setuptools,
+  setuptools-scm,
+  systemrdl-compiler,
+}:
+
+buildPythonPackage rec {
+  pname = "peakrdl-cheader";
+  version = "1.0.0";
+
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "SystemRDL";
+    repo = "PeakRDL-cheader";
+    tag = "v${version}";
+    hash = "sha256-1LxKGCea5ClKmrArl+CM6ZRpiTh2ThbYSe9TYYHjRlY=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
+    jinja2
+    peakrdl
+    systemrdl-compiler
+  ];
+
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  meta = {
+    description = "C Header generator for a SystemRDL definition";
+    homepage = "https://peakrdl-cheader.readthedocs.io/";
+    license = lib.licenses.lgpl3;
+    maintainers = [ lib.maintainers.jmbaur ];
+  };
+}

pkgs/development/python-modules/peakrdl-ipxact/default.nix

@@ -0,0 +1,43 @@
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  gitUpdater,
+  lib,
+  peakrdl,
+  setuptools,
+  setuptools-scm,
+  systemrdl-compiler,
+}:
+
+buildPythonPackage rec {
+  pname = "peakrdl-ipxact";
+  version = "3.5.0";
+
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "SystemRDL";
+    repo = "PeakRDL-ipxact";
+    tag = "v${version}";
+    hash = "sha256-GFHgIyK82dt+/t0XbDdk61q0DXUOabxtjlhZhgacUVA=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
+    peakrdl
+    systemrdl-compiler
+  ];
+
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  meta = {
+    description = "Import and export IP-XACT XML register models";
+    homepage = "http://peakrdl-ipxact.readthedocs.io/";
+    license = lib.licenses.lgpl3;
+    maintainers = [ lib.maintainers.jmbaur ];
+  };
+}

pkgs/development/python-modules/peakrdl-markdown/default.nix

@@ -0,0 +1,39 @@
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  gitUpdater,
+  lib,
+  peakrdl,
+  py-markdown-table,
+  poetry-core,
+}:
+
+buildPythonPackage rec {
+  pname = "peakrdl-markdown";
+  version = "1.0.3";
+
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "SystemRDL";
+    repo = "PeakRDL-markdown";
+    tag = "v${version}";
+    hash = "sha256-Dt8FxnvvXY9nVhFehIcfSC9mFbbEzEuaVnBMu032dug=";
+  };
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    peakrdl
+    py-markdown-table
+  ];
+
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  meta = {
+    description = "Export Markdown description from the systemrdl-compiler register model";
+    homepage = "https://peakrdl-markdown.readthedocs.io/";
+    license = lib.licenses.gpl3Only;
+    maintainers = [ lib.maintainers.jmbaur ];
+  };
+}

pkgs/development/python-modules/peakrdl-regblock/default.nix

@@ -0,0 +1,45 @@
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  gitUpdater,
+  jinja2,
+  lib,
+  peakrdl,
+  setuptools,
+  setuptools-scm,
+  systemrdl-compiler,
+}:
+
+buildPythonPackage rec {
+  pname = "peakrdl-regblock";
+  version = "1.2.0";
+
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "SystemRDL";
+    repo = "PeakRDL-regblock";
+    tag = "v${version}";
+    hash = "sha256-hVHqdmXsxOoqpo84KPaK+74VPVsl61QyB5b7lFlmA0o=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
+    jinja2
+    peakrdl
+    systemrdl-compiler
+  ];
+
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  meta = {
+    description = "Generate SystemVerilog RTL that implements a register block from compiled SystemRDL input";
+    homepage = "http://peakrdl-regblock.readthedocs.io/";
+    license = lib.licenses.lgpl3;
+    maintainers = [ lib.maintainers.jmbaur ];
+  };
+}

pkgs/development/python-modules/peakrdl-rust/default.nix

@@ -0,0 +1,40 @@
+{
+  buildPythonPackage,
+  case-converter,
+  fetchFromGitHub,
+  jinja2,
+  lib,
+  peakrdl,
+  systemrdl-compiler,
+  uv-build,
+}:
+
+buildPythonPackage rec {
+  pname = "peakrdl-rust";
+  version = "0.4.0";
+
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "darsor";
+    repo = "PeakRDL-rust";
+    tag = "v${version}";
+    hash = "sha256-MD0iMdNFvu/V/yWnivJ9cbE0/d77bsoCVScpMMGMG/I=";
+  };
+
+  build-system = [ uv-build ];
+
+  dependencies = [
+    case-converter
+    jinja2
+    peakrdl
+    systemrdl-compiler
+  ];
+
+  meta = {
+    description = "Generate a Rust crate from SystemRDL for accessing control/status registers";
+    homepage = "https://peakrdl-rust.readthedocs.io/";
+    license = lib.licenses.lgpl21Only;
+    maintainers = [ lib.maintainers.jmbaur ];
+  };
+}

pkgs/development/python-modules/peakrdl/default.nix

@@ -0,0 +1,45 @@
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  gitUpdater,
+  lib,
+  setuptools,
+  setuptools-scm,
+  systemrdl-compiler,
+  typing-extensions,
+}:
+
+buildPythonPackage rec {
+  pname = "peakrdl";
+  version = "1.5.0";
+
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "SystemRDL";
+    repo = "PeakRDL";
+    tag = "v${version}";
+    hash = "sha256-SqLhOzx0gUVG8k4ikNbx8p1vO/ZqTQ/KAtidRWM2SZI=";
+  };
+  sourceRoot = "${src.name}/peakrdl-cli";
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
+    systemrdl-compiler
+    typing-extensions
+  ];
+
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  meta = {
+    description = "Control and status register code generator toolchain";
+    homepage = "https://peakrdl.readthedocs.io/";
+    license = lib.licenses.lgpl3;
+    maintainers = [ lib.maintainers.jmbaur ];
+    mainProgram = "peakrdl";
+  };
+}

pkgs/development/python-modules/py-markdown-table/default.nix

@@ -0,0 +1,29 @@
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  lib,
+  poetry-core,
+}:
+
+buildPythonPackage rec {
+  pname = "py-markdown-table";
+  version = "1.3.0";
+
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "hvalev";
+    repo = "py-markdown-table";
+    tag = "v${version}";
+    hash = "sha256-BZDyBDW6Ok9WUb5FEAevVqkYM1S12pvkUCGbZ0XxxV4=";
+  };
+
+  build-system = [ poetry-core ];
+
+  meta = {
+    description = "Tiny python library with zero dependencies which generates formatted multiline tables in markdown";
+    homepage = "https://github.com/hvalev/py-markdown-table";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jmbaur ];
+  };
+}

pkgs/development/python-modules/systemrdl-compiler/default.nix

@@ -0,0 +1,45 @@
+{
+  antlr4-python3-runtime,
+  buildPythonPackage,
+  colorama,
+  fetchFromGitHub,
+  gitUpdater,
+  lib,
+  markdown,
+  setuptools,
+  setuptools-scm,
+}:
+
+buildPythonPackage rec {
+  pname = "systemrdl-compiler";
+  version = "1.32.1";
+
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "SystemRDL";
+    repo = "systemrdl-compiler";
+    tag = "v${version}";
+    hash = "sha256-BTONBzNE9GfBeallS6P4E1ukPs2EzFa31/SpxEjXmKw=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
+    antlr4-python3-runtime
+    colorama
+    markdown
+  ];
+
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  meta = {
+    description = "SystemRDL 2.0 language compiler front-end";
+    homepage = "https://systemrdl-compiler.readthedocs.io/en/stable/";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jmbaur ];
+  };
+}

pkgs/development/python-modules/unstructured/default.nix

@@ -116,7 +116,7 @@
   grpcio,
 }:
 let
-  version = "0.18.21";
+  version = "0.18.22";
 in
 buildPythonPackage rec {
   pname = "unstructured";
@@ -127,7 +127,7 @@ buildPythonPackage rec {
     owner = "Unstructured-IO";
     repo = "unstructured";
     tag = version;
-    hash = "sha256-7AI23Sa2G1PJ6uvNbgMKuwbwyUvT4qDHoKDLvb2kbCE=";
+    hash = "sha256-m5sBFra/7qjJ/mBq+r7HA+ZURGpiaK1FzR9crL16jtQ=";
   };
 
   build-system = [ setuptools ];

pkgs/os-specific/linux/minimal-bootstrap/bash/default.nix

@@ -19,11 +19,11 @@
 }:
 let
   pname = "bash";
-  version = "5.2.15";
+  version = "5.2.37";
 
   src = fetchurl {
     url = "mirror://gnu/bash/bash-${version}.tar.gz";
-    sha256 = "132qng0jy600mv1fs95ylnlisx2wavkkgpb19c6kmz7lnmjhjwhk";
+    hash = "sha256-lZmyLs0dV4etfTt78MWfMSszltHigRdd0fikAU2mIf8=";
   };
 
   patches = [

pkgs/os-specific/linux/minimal-bootstrap/default.nix

@@ -75,7 +75,7 @@ lib.makeScope
 
       gawk-mes = callPackage ./gawk/mes.nix {
         bash = bash_2_05;
-        tinycc = tinycc-bootstrappable;
+        tinycc = tinycc-mes;
         gnused = gnused-mes;
       };
 
@@ -171,7 +171,7 @@ lib.makeScope
 
       heirloom = callPackage ./heirloom {
         bash = bash_2_05;
-        tinycc = tinycc-bootstrappable;
+        tinycc = tinycc-mes;
       };
 
       heirloom-devtools = callPackage ./heirloom-devtools { tinycc = tinycc-mes; };
@@ -183,11 +183,16 @@ lib.makeScope
       mes = callPackage ./mes { };
       mes-libc = callPackage ./mes/libc.nix { };
 
-      musl11 = callPackage ./musl/1.1.nix {
+      musl11-intermediate = callPackage ./musl/1.1.nix {
         bash = bash_2_05;
         tinycc = tinycc-mes;
         gnused = gnused-mes;
       };
+      musl11 = callPackage ./musl/1.1.nix {
+        bash = bash_2_05;
+        tinycc = tinycc-musl-intermediate;
+        gnused = gnused-mes;
+      };
 
       musl = callPackage ./musl {
         gcc = gcc46;
@@ -205,10 +210,18 @@ lib.makeScope
 
       tinycc-bootstrappable = lib.recurseIntoAttrs (callPackage ./tinycc/bootstrappable.nix { });
       tinycc-mes = lib.recurseIntoAttrs (callPackage ./tinycc/mes.nix { });
+      tinycc-musl-intermediate = lib.recurseIntoAttrs (
+        callPackage ./tinycc/musl.nix {
+          bash = bash_2_05;
+          musl = musl11-intermediate;
+          tinycc = tinycc-mes;
+        }
+      );
       tinycc-musl = lib.recurseIntoAttrs (
         callPackage ./tinycc/musl.nix {
           bash = bash_2_05;
           musl = musl11;
+          tinycc = tinycc-musl-intermediate;
         }
       );
 

pkgs/os-specific/linux/minimal-bootstrap/gnugrep/default.nix

@@ -13,13 +13,6 @@ let
     url = "mirror://gnu/grep/grep-${version}.tar.gz";
     sha256 = "05iayw5sfclc476vpviz67hdy03na0pz2kb5csa50232nfx34853";
   };
-
-  # Thanks to the live-bootstrap project!
-  # See https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/grep-2.4
-  makefile = fetchurl {
-    url = "https://github.com/fosslinux/live-bootstrap/raw/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/grep-2.4/mk/main.mk";
-    sha256 = "08an9ljlqry3p15w28hahm6swnd3jxizsd2188przvvsj093j91k";
-  };
 in
 bash.runCommand "${pname}-${version}"
   {
@@ -54,7 +47,7 @@ bash.runCommand "${pname}-${version}"
     cd grep-${version}
 
     # Configure
-    cp ${makefile} Makefile
+    cp ${./main.mk} Makefile
 
     # Build
     make CC="tcc -B ${tinycc.libs}/lib"

pkgs/os-specific/linux/minimal-bootstrap/gnugrep/main.mk

@@ -0,0 +1,39 @@
+# SPDX-FileCopyrightText: 2021 Andrius Štikonas <andrius@stikonas.eu>
+# SPDX-FileCopyrightText: 2022 Samuel Tyler <samuel@samuelt.me>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+PACKAGE=grep
+VERSION=2.4
+
+CC      = tcc
+LD      = tcc
+AR      = tcc -ar
+
+CFLAGS  = -DPACKAGE=\"$(PACKAGE)\" \
+          -DVERSION=\"$(VERSION)\" \
+          -DHAVE_DIRENT_H=1 \
+          -DHAVE_UNISTD_H=1 \
+          -DHAVE_STRERROR=1 \
+          -DSTDC_HEADERS=1
+
+.PHONY: all
+
+GREP_SRC = grep dfa kwset obstack regex stpcpy savedir getopt getopt1 search grepmat
+GREP_OBJECTS = $(addprefix src/, $(addsuffix .o, $(GREP_SRC)))
+
+all: grep egrep fgrep
+
+grep: $(GREP_OBJECTS)
+	$(CC) $(CFLAGS) $^ $(LDFLAGS) -o $@
+
+egrep: $(GREP_OBJECTS) src/egrepmat.c
+	$(CC) $(CFLAGS) $^ $(LDFLAGS) -o $@
+
+fgrep: $(GREP_OBJECTS) src/fgrepmat.c
+	$(CC) $(CFLAGS) $^ $(LDFLAGS) -o $@
+
+install: all
+	install -D grep $(DESTDIR)$(PREFIX)/bin/grep
+	install -D egrep $(DESTDIR)$(PREFIX)/bin/egrep
+	install -D fgrep $(DESTDIR)$(PREFIX)/bin/fgrep

pkgs/os-specific/linux/minimal-bootstrap/gnupatch/default.nix

@@ -38,6 +38,7 @@ let
     "-DSTDC_HEADERS"
     "-DHAVE_STRING_H"
     "-DHAVE_STDLIB_H"
+    "-DHAVE_VPRINTF"
   ];
 
   # Maintenance note: List of sources from Makefile.in

pkgs/os-specific/linux/minimal-bootstrap/heirloom/stubs.h

@@ -1,11 +1,11 @@
 #include <getopt.h>
 extern int optopt;
 
-int ftruncate(int fd, int offset) {
+static int ftruncate(int fd, int offset) {
   return -1;
 }
 
-int getsid (int pid) {
+static int getsid (int pid) {
   return -1;
 }
 
@@ -21,14 +21,25 @@ static int isblank(int c)
 int lstat (char const *file_name, struct stat *statbuf);
 
 #include <fcntl.h>
-int mkstemp(char *t)
+static int mkstemp(char *t)
 {
   mktemp(t);
   int fd = open(t, O_CREAT|O_RDWR|O_TRUNC, 0600);
   return fd;
 }
 
-#define strncasecmp(a,b,n) strncmp(strupr(a),strupr(b),n)
+static int strncasecmp(char *a, char *b, size_t n) {
+  while (n > 0 && (*a || *b)) {
+      if (toupper(*a) < toupper(*b)) {
+          return -1;
+      }
+      if (toupper(*a) > toupper(*b)) {
+          return 1;
+      }
+      a++; b++; n--;
+  }
+  return 0;
+}
 
 
 #define nlink_t unsigned long

pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix

@@ -4,6 +4,7 @@
   callPackage,
   kaem,
   mescc-tools,
+  buildPlatform,
 }:
 
 # Maintenance note:
@@ -22,12 +23,41 @@ let
 
   nyacc = callPackage ./nyacc.nix { inherit nyacc; };
 
+  intptr =
+    {
+      i686-linux = "int";
+      x86_64-linux = "long";
+    }
+    .${buildPlatform.system};
+  uintptr = "unsigned ${intptr}";
+
   config_h = builtins.toFile "config.h" ''
+    #ifndef _MES_CONFIG_H
     #undef SYSTEM_LIBC
     #define MES_VERSION "${version}"
+    #ifndef __M2__
+    typedef ${uintptr} uintptr_t;
+    typedef ${uintptr} size_t;
+    typedef ${intptr} ssize_t;
+    typedef ${intptr} intptr_t;
+    typedef ${intptr} ptrdiff_t;
+    #define __MES_SIZE_T
+    #define __MES_SSIZE_T
+    #define __MES_INTPTR_T
+    #define __MES_UINTPTR_T
+    #define __MES_PTRDIFF_T
+    #endif
+    #endif
   '';
 
-  sources = (import ./sources.nix).x86.linux.mescc;
+  arch =
+    {
+      i686-linux = "x86";
+      x86_64-linux = "x86_64";
+    }
+    .${buildPlatform.system};
+
+  sources = (import ./sources.nix).${arch}.linux.mescc;
 
   inherit (sources)
     libc_mini_SOURCES
@@ -38,6 +68,7 @@ let
 
   # add symlink() to libc+tcc so we can use it in ln-boot
   libc_tcc_SOURCES = sources.libc_tcc_SOURCES ++ [ "lib/linux/symlink.c" ];
+  setjmp_x86_64 = ./setjmp_x86_64.c;
 
   meta = {
     description = "Scheme interpreter and C compiler for bootstrapping";
@@ -46,6 +77,7 @@ let
     teams = [ lib.teams.minimal-bootstrap ];
     platforms = [
       "i686-linux"
+      "x86_64-linux"
     ];
   };
 
@@ -71,10 +103,91 @@ let
 
         cp ${config_h} include/mes/config.h
 
+        # rax is used to indicate the syscall; we need to inform the assembler that rax should not be used to
+        # pass the exit code as it would be overwritten
+        exit_c=lib/linux/x86_64-mes-gcc/_exit.c
+        replace --file ''${exit_c} --output ''${exit_c} --match-on "(code)" --replace-with "(code) : \"rax\", \"rdi\""
+
+        # Replace broken implementation of setjmp & longjmp with asm.
+        cp ${setjmp_x86_64} lib/x86_64-mes-gcc/setjmp.c
+
+        # wrong number of arguments for linkat() syscall
+        link_c=lib/linux/link.c
+        replace --file ''${link_c} --output ''${link_c} --match-on "_sys_call4" --replace-with "_sys_call5"
+        replace --file ''${link_c} --output ''${link_c} --match-on "AT_FDCWD, (long) new_name" --replace-with "AT_FDCWD, (long) new_name, 0"
+
+        # wrong syscall number used for nanosleep.
+        amd64_syscall_h=include/linux/x86_64/syscall.h
+        replace --file ''${amd64_syscall_h} --output ''${amd64_syscall_h} --match-on "SYS_nanosleep 0x33" --replace-with "SYS_nanosleep 0x23"
+
+        # strpbrk should return NULL when there is no match.
+        # The order of these `replace` commands is significant.
+        strpbrk_c=lib/string/strpbrk.c
+        replace --file ''${strpbrk_c} --output ''${strpbrk_c} --match-on "return p;" --replace-with "return 0;"
+        replace --file ''${strpbrk_c} --output ''${strpbrk_c} --match-on "break;" --replace-with "return p;"
+
+        # Wrong type used; fix.
+        # ntoab.c:  __measbi_uldiv should use unsigned long as per "ul", not size_t
+        # ioctl3.c: unsigned long used to align with ioctl.c
+        # lib.h:    change ioctl3 signature, per above
+        ntoab=lib/mes/ntoab.c
+        replace --file ''${ntoab} --output ''${ntoab} --match-on "size_t" --replace-with "unsigned long"
+        ioctl=lib/linux/ioctl3.c
+        replace --file ''${ioctl} --output ''${ioctl} --match-on "size_t" --replace-with "unsigned long"
+        lib_h=include/mes/lib.h
+        replace --file ''${lib_h} --output ''${lib_h} --match-on "size_t command" --replace-with "unsigned long command"
+
+        # vfprintf assumes %d arguments can be accessed as `long`. This
+        # is true on sign-extending platforms like RV64, but not on i686 or x86_64.
+        # Let's use the caller-specified width for better portability. Also account for
+        # potential need to zero-extend.
+        vfprintf_c=lib/stdio/vfprintf.c
+        replace --file ''${vfprintf_c} --output ''${vfprintf_c} --match-on "int count = 0;" --replace-with "int count = 0; int has_l = 0;"
+        replace --file ''${vfprintf_c} --output ''${vfprintf_c} --match-on "long d = va_arg (ap, long);" --replace-with "
+          long d;
+          if (has_l) {
+            has_l = 0;
+            d = va_arg (ap, long);
+          } else if (c != 'd' && c != 'i') {
+            d = (long) (va_arg (ap, unsigned int));
+          } else {
+            d = (long) (va_arg (ap, int));
+          }
+        "
+        replace --file ''${vfprintf_c} --output ''${vfprintf_c} --match-on "if (c == 'l')" --replace-with "
+          if (c == 'l') {
+            /* this is annoying to patch... */
+            has_l = 1;
+            c = *++p;
+          } else if (0)"
+        # Also, get rid of va_arg8
+        replace --file ''${vfprintf_c} --output ''${vfprintf_c} --match-on "va_arg8" --replace-with "va_arg"
+        # Same thing for vsnprintf.
+        vsnprintf_c=lib/stdio/vsnprintf.c
+        replace --file ''${vsnprintf_c} --output ''${vsnprintf_c} --match-on "int count = 0;" --replace-with "int count = 0; int has_l = 0;"
+        replace --file ''${vsnprintf_c} --output ''${vsnprintf_c} --match-on "long d = va_arg (ap, long);" --replace-with "
+          long d;
+          if (has_l) {
+            has_l = 0;
+            d = va_arg (ap, long);
+          } else if (c != 'd' && c != 'i') {
+            d = (long) (va_arg (ap, unsigned int));
+          } else {
+            d = (long) (va_arg (ap, int));
+          }
+        "
+        replace --file ''${vsnprintf_c} --output ''${vsnprintf_c} --match-on "if (c == 'l')" --replace-with "
+          if (c == 'l') {
+            /* this is annoying to patch... */
+            has_l = 1;
+            c = *++p;
+          } else if (0)"
+        replace --file ''${vsnprintf_c} --output ''${vsnprintf_c} --match-on "va_arg8" --replace-with "va_arg"
+
         mkdir include/arch
-        cp include/linux/x86/kernel-stat.h include/arch/kernel-stat.h
-        cp include/linux/x86/signal.h include/arch/signal.h
-        cp include/linux/x86/syscall.h include/arch/syscall.h
+        cp include/linux/${arch}/kernel-stat.h include/arch/kernel-stat.h
+        cp include/linux/${arch}/signal.h include/arch/signal.h
+        cp include/linux/${arch}/syscall.h include/arch/syscall.h
 
         # Remove pregenerated files
         rm mes/module/mes/psyntax.pp mes/module/mes/psyntax.pp.header
@@ -113,13 +226,13 @@ let
         replace --file ''${mescc_in} --output ''${mescc_in} --match-on "(getenv \"libdir\")" --replace-with "\"''${MES_PREFIX}/lib\""
         replace --file ''${mescc_in} --output ''${mescc_in} --match-on @prefix@ --replace-with ''${MES_PREFIX}
         replace --file ''${mescc_in} --output ''${mescc_in} --match-on @VERSION@ --replace-with ${version}
-        replace --file ''${mescc_in} --output ''${mescc_in} --match-on @mes_cpu@ --replace-with x86
+        replace --file ''${mescc_in} --output ''${mescc_in} --match-on @mes_cpu@ --replace-with ${arch}
         replace --file ''${mescc_in} --output ''${mescc_in} --match-on @mes_kernel@ --replace-with linux
         mkdir -p ''${bin}/bin
         cp ''${mescc_in} ''${bin}/bin/mescc.scm
 
         # Build mes-m2
-        kaem --verbose --strict --file kaem.x86
+        kaem --verbose --strict --file kaem.${arch}
         cp bin/mes-m2 ''${bin}/bin/mes-m2
         chmod 555 ''${bin}/bin/mes-m2
       '';
@@ -136,7 +249,7 @@ let
     "-I"
     "${srcPrefix}/include"
     "-I"
-    "${srcPrefix}/include/linux/x86"
+    "${srcPrefix}/include/linux/${arch}"
   ];
 
   CC = toString ([ cc ] ++ ccArgs);
@@ -151,7 +264,7 @@ let
       ${CC} -c ${srcPrefix}/${source}
     '';
 
-  crt1 = compile "/lib/linux/x86-mes-mescc/crt1.c";
+  crt1 = compile "/lib/linux/${arch}-mes-mescc/crt1.c";
 
   getRes = suffix: res: "${res}/${res.name}${suffix}";
 
@@ -200,27 +313,27 @@ let
         LIBDIR=''${out}/lib
         mkdir -p ''${out} ''${LIBDIR}
 
-        mkdir -p ''${LIBDIR}/x86-mes
+        mkdir -p ''${LIBDIR}/${arch}-mes
 
         # crt1.o
-        cp ${crt1}/crt1.o ''${LIBDIR}/x86-mes
-        cp ${crt1}/crt1.s ''${LIBDIR}/x86-mes
+        cp ${crt1}/crt1.o ''${LIBDIR}/${arch}-mes
+        cp ${crt1}/crt1.s ''${LIBDIR}/${arch}-mes
 
         # libc-mini.a
-        cp ${libc-mini}/lib/libc-mini.a ''${LIBDIR}/x86-mes
-        cp ${libc-mini}/lib/libc-mini.s ''${LIBDIR}/x86-mes
+        cp ${libc-mini}/lib/libc-mini.a ''${LIBDIR}/${arch}-mes
+        cp ${libc-mini}/lib/libc-mini.s ''${LIBDIR}/${arch}-mes
 
         # libmescc.a
-        cp ${libmescc}/lib/libmescc.a ''${LIBDIR}/x86-mes
-        cp ${libmescc}/lib/libmescc.s ''${LIBDIR}/x86-mes
+        cp ${libmescc}/lib/libmescc.a ''${LIBDIR}/${arch}-mes
+        cp ${libmescc}/lib/libmescc.s ''${LIBDIR}/${arch}-mes
 
         # libc.a
-        cp ${libc}/lib/libc.a ''${LIBDIR}/x86-mes
-        cp ${libc}/lib/libc.s ''${LIBDIR}/x86-mes
+        cp ${libc}/lib/libc.a ''${LIBDIR}/${arch}-mes
+        cp ${libc}/lib/libc.s ''${LIBDIR}/${arch}-mes
 
         # libc+tcc.a
-        cp ${libc_tcc}/lib/libc+tcc.a ''${LIBDIR}/x86-mes
-        cp ${libc_tcc}/lib/libc+tcc.s ''${LIBDIR}/x86-mes
+        cp ${libc_tcc}/lib/libc+tcc.a ''${LIBDIR}/${arch}-mes
+        cp ${libc_tcc}/lib/libc+tcc.s ''${LIBDIR}/${arch}-mes
       '';
 
   # Build mes itself
@@ -248,7 +361,7 @@ let
           -lmescc \
           -nostdlib \
           -o ''${out}/bin/mes \
-          ${libs}/lib/x86-mes/crt1.o \
+          ${libs}/lib/${arch}-mes/crt1.o \
           ${lib.concatMapStringsSep " " (getRes ".o") (map compile mes_SOURCES)}
       '';
 in

pkgs/os-specific/linux/minimal-bootstrap/mes/gen-sources.sh

@@ -13,7 +13,7 @@
 set -eu
 
 # Supported platforms
-ARCHS="x86"
+ARCHS="x86 x86_64"
 KERNELS="linux"
 COMPILERS="mescc gcc"
 

pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix

@@ -4,21 +4,35 @@
   ln-boot,
   mes,
   mes-libc,
+  buildPlatform,
+  fetchurl,
 }:
 let
   pname = "mes-libc";
   inherit (mes.compiler) version;
 
-  sources = (import ./sources.nix).x86.linux.gcc;
+  arch =
+    {
+      i686-linux = "x86";
+      x86_64-linux = "x86_64";
+    }
+    .${buildPlatform.system};
+
+  sources = (import ./sources.nix).${arch}.linux.gcc;
   inherit (sources) libtcc1_SOURCES libc_gnu_SOURCES;
 
+  ldexpl = fetchurl {
+    url = "https://gitlab.com/janneke/mes/-/raw/c837abed8edb341d4e56913729fbe9803b4de47c/lib/math/ldexpl.c";
+    hash = "sha256-3QoFZZIqVmlMUosEqOdYIMEHzYgQ7GJ7Hz0Bf/1iIig=";
+  };
+
   # Concatenate all source files into a convenient bundle
   # "gcc" variants of source files (eg. "lib/linux/x86-mes-gcc") can also be
   # compiled by tinycc
   #
   # Passing this many arguments is too much for kaem so we need to split
   # the operation in two
-  firstLibc = lib.take 100 libc_gnu_SOURCES;
+  firstLibc = (lib.take 100 libc_gnu_SOURCES) ++ [ ldexpl ];
   lastLibc = lib.drop 100 libc_gnu_SOURCES;
 in
 kaem.runCommand "${pname}-${version}"
@@ -27,30 +41,33 @@ kaem.runCommand "${pname}-${version}"
 
     nativeBuildInputs = [ ln-boot ];
 
-    passthru.CFLAGS = "-DHAVE_CONFIG_H=1 -I${mes-libc}/include -I${mes-libc}/include/linux/x86";
+    passthru.CFLAGS = "-std=c11";
 
     meta = {
       description = "Mes C Library";
       homepage = "https://www.gnu.org/software/mes";
       license = lib.licenses.gpl3Plus;
       teams = [ lib.teams.minimal-bootstrap ];
-      platforms = [ "i686-linux" ];
+      platforms = [
+        "i686-linux"
+        "x86_64-linux"
+      ];
     };
   }
   ''
     cd ${mes.srcPrefix}
 
     # mescc compiled libc.a
-    mkdir -p ''${out}/lib/x86-mes
+    mkdir -p ''${out}/lib/${arch}-mes
 
     # libc.c
     catm ''${TMPDIR}/first.c ${lib.concatStringsSep " " firstLibc}
     catm ''${out}/lib/libc.c ''${TMPDIR}/first.c ${lib.concatStringsSep " " lastLibc}
 
     # crt{1,n,i}.c
-    cp lib/linux/x86-mes-gcc/crt1.c ''${out}/lib
-    cp lib/linux/x86-mes-gcc/crtn.c ''${out}/lib
-    cp lib/linux/x86-mes-gcc/crti.c ''${out}/lib
+    cp lib/linux/${arch}-mes-gcc/crt1.c ''${out}/lib
+    cp lib/linux/${arch}-mes-gcc/crtn.c ''${out}/lib
+    cp lib/linux/${arch}-mes-gcc/crti.c ''${out}/lib
 
     # libtcc1.c
     catm ''${out}/lib/libtcc1.c ${lib.concatStringsSep " " libtcc1_SOURCES}

pkgs/os-specific/linux/minimal-bootstrap/mes/nyacc.nix

@@ -9,11 +9,16 @@ let
   # NYACC is a tightly coupled dependency of mes. This version is known to work
   # with mes 0.27.1.
   # https://git.savannah.gnu.org/cgit/mes.git/tree/INSTALL?h=v0.27.1#n31
-  version = "2.02.2";
+  #
+  # Note: mes has issues with NYACC 1.09.2 and up. The mes interpreter cannot
+  # parse block comments outside top level. This seems to be fixed in development
+  # versions of mes.
+  # https://gitlab.com/janneke/commencement.scm/-/blob/fdc718f050171f12da58524f60c4d52c03e83df3/gcc-bootstrap.scm#L621
+  version = "1.09.1";
 
   src = fetchurl {
     url = "mirror://savannah/nyacc/nyacc-${version}.tar.gz";
-    hash = "sha256-aRpTcKU6c6Lc+onZL4EbPlZIOmf5IZnNAGGUTQRLAgU=";
+    hash = "sha256-DsmuU34NlReBpQ3jx5KayXqFwdS16F5dUVQuN1ECJxc=";
   };
 in
 kaem.runCommand "${pname}-${version}"

pkgs/os-specific/linux/minimal-bootstrap/mes/setjmp_x86_64.c

@@ -0,0 +1,48 @@
+/*
+ * setjmp() & longjmp() implementation for x86_64.
+ * Replaces a buggy C implementation.
+ */
+
+#include <setjmp.h>
+#include <stdlib.h>
+
+asm (".global __longjmp\n\t"
+     ".global _longjmp\n\t"
+     ".global longjmp\n\t"
+     ".type __longjmp, %function\n\t"
+     ".type _longjmp,  %function\n\t"
+     ".type longjmp,   %function\n\t"
+     "__longjmp:\n\t"
+     "_longjmp:\n\t"
+     "longjmp:\n\t"
+
+     /* ensure return value is non-zero */
+     "mov    %rsi,     %rax\n\t"
+     "test   %rax,     %rax\n\t"
+     "sete   %bl\n\t"
+     "movsbq %bl,      %rbx\n\t"
+     "add    %rbx,     %rax\n\t"
+
+     "movq 0x00(%rdi), %rbp\n\t" /* rbp = env->__bp */
+     "movq 0x10(%rdi), %rsp\n\t" /* rsp = env->__sp */
+     "movq 0x08(%rdi), %rbx\n\t" /* rbx = env->__pc */
+     "jmp  *%rbx\n\t"
+);
+
+asm (".global __setjmp\n\t"
+     ".global _setjmp \n\t"
+     ".global setjmp\n\t"
+     ".type __setjmp, %function\n\t"
+     ".type _setjmp,  %function\n\t"
+     ".type setjmp,   %function\n\t"
+     "__setjmp:\n\t"
+     "_setjmp:\n\t"
+     "setjmp:\n\t"
+     "movq %rbp,   0x00(%rdi)\n\t" /* env->__bp = base pointer from caller */
+     "movq (%rsp), %rax\n\t"       /* rax = return address to caller */
+     "movq %rax,   0x08(%rdi)\n\t" /* env->__pc = retaddr */
+     "movq %rsp,   %rax\n\t"       /* rax = stack pointer */
+     "add  $8,     %rax\n\t"       /* offset sp to skip return addr */
+     "movq %rax,   0x10(%rdi)\n\t" /* env->__sp = sp before call */
+     "movq $0,     %rax\n\t"
+     "ret\n\t");

pkgs/os-specific/linux/minimal-bootstrap/musl/1.1.nix

@@ -34,18 +34,6 @@ let
       url = "${liveBootstrap}/patches/avoid_sys_clone.patch";
       hash = "sha256-/ZmH64J57MmbxdfQ4RNjamAiBdkImMTlHsHdgV4gMj4=";
     })
-    (fetchurl {
-      url = "${liveBootstrap}/patches/fenv.patch";
-      hash = "sha256-vMVGjoN4deAJW5gsSqA207SJqAbvhrnOsGK49DdEiTI=";
-    })
-    (fetchurl {
-      url = "${liveBootstrap}/patches/makefile.patch";
-      hash = "sha256-03iYBAUnsrEdLIIhhhq5mM6BGnPn2EfUmIHu51opxbw=";
-    })
-    (fetchurl {
-      url = "${liveBootstrap}/patches/musl_weak_symbols.patch";
-      hash = "sha256-/d9a2eUkpe9uyi1ye6T4CiYc9MR3FZ9na0Gb90+g4v0=";
-    })
     (fetchurl {
       url = "${liveBootstrap}/patches/set_thread_area.patch";
       hash = "sha256-RIZYqbbRSx4X/0iFUhriwwBRmoXVR295GNBUjf2UrM0=";
@@ -58,6 +46,7 @@ let
     # to avoid `error: implicit declaration of function '__stdio_exit'`
     # Required to fix buffered stdout being truncated on exit
     ./stdio_flush_on_exit.patch
+    ./avoid_pthread_x86_64.patch
     (fetchurl {
       url = "${liveBootstrap}/patches/va_list.patch";
       hash = "sha256-UmcMIl+YCi3wIeVvjbsCyqFlkyYsM4ECNwTfXP+s7vg=";
@@ -99,6 +88,11 @@ bash.runCommand "${pname}-${version}"
     sed -i 's|execl("/bin/sh", "sh", "-c",|execlp("sh", "-c",|'\
       src/misc/wordexp.c
 
+    # @PLT specifier is not supported by tinycc.
+    # Calls do go through PLT regardless.
+    sed -i 's|@PLT||' src/math/x86_64/expl.s
+    sed -i 's|@PLT||' src/signal/x86_64/sigsetjmp.s
+
     # Configure
     bash ./configure \
       --prefix=$out \

pkgs/os-specific/linux/minimal-bootstrap/musl/avoid_pthread_x86_64.patch

@@ -0,0 +1,16 @@
+diff --git arch/x86_64/pthread_arch.h arch/x86_64/pthread_arch.h
+index 65e880c..91b4a63 100644
+--- arch/x86_64/pthread_arch.h
++++ arch/x86_64/pthread_arch.h
+@@ -1,8 +1,8 @@
++extern pthread_t g_pthread;
++
+ static inline struct pthread *__pthread_self()
+ {
+-	struct pthread *self;
+-	__asm__ ("mov %%fs:0,%0" : "=r" (self) );
+-	return self;
++	return g_pthread;
+ }
+ 
+ #define TP_ADJ(p) (p)

pkgs/os-specific/linux/minimal-bootstrap/tinycc/bootstrappable.nix

@@ -9,6 +9,7 @@
 
 {
   lib,
+  buildPlatform,
   callPackage,
   fetchurl,
   kaem,
@@ -21,6 +22,20 @@ let
   version = "unstable-2024-07-07";
   rev = "ea3900f6d5e71776c5cfabcabee317652e3a19ee";
 
+  arch =
+    {
+      i686-linux = "x86";
+      x86_64-linux = "x86_64";
+    }
+    .${buildPlatform.system};
+
+  tccTarget =
+    {
+      i686-linux = "I386";
+      x86_64-linux = "X86_64";
+    }
+    .${buildPlatform.system};
+
   tarball = fetchurl {
     url = "https://gitlab.com/janneke/tinycc/-/archive/${rev}/tinycc-${rev}.tar.gz";
     sha256 = "sha256-16JBGJATAWP+lPylOi3+lojpdv0SR5pqyxOV2PiVx0A=";
@@ -34,8 +49,39 @@ let
 
       # Patch
       cd tinycc-${rev}
+
+      cp ${mes-libc}/lib/libtcc1.c lib/libtcc1.c
+
       # Static link by default
       replace --file libtcc.c --output libtcc.c --match-on "s->ms_extensions = 1;" --replace-with "s->ms_extensions = 1; s->static_link = 1;"
+
+      # TODO: may not need following patches for mes 0.28.
+      # Or maybe we don't need tinycc-bootstrappable for mes 0.28?
+
+      # mes-libc depends on max_align_t in stddef.h, which is not provided by tinycc-boot
+      replace --file include/stddef.h --output include/stddef.h --match-on "void *alloca" --replace-with "
+        typedef union { long double ld; long long ll; } max_align_t;
+        void *alloca
+      "
+      # VLA is broken in mescc 0.27.1. alloca is not available either. Let's just use malloc and leak on x86_64.
+      replace --file x86_64-gen.c --output x86_64-gen.c --match-on "char _onstack[nb_args], *onstack = _onstack;" --replace-with "char *onstack = tcc_malloc(nb_args);"
+
+      # Abort is not provided by mescc
+      replace --file x86_64-gen.c --output x86_64-gen.c --match-on "abort();" --replace-with "/* abort(); */"
+
+      # Work around bug in mescc.
+      replace --file x86_64-gen.c --output x86_64-gen.c --match-on "g(vtop->c.i & (ll ? 63 : 31));" --replace-with "if (ll) g(vtop->c.i & 63); else g(vtop->c.i & 31);"
+
+      # Normally tinycc only performs relocations on the PLT when creating a dynamically-linked executable.
+      # This is fine for most targets because a PLT is not generated. But on x86_64 we do generate a PLT and hence
+      # we must assure plt->got references are appropriately relocated.
+      # This patch is applied even if we aren't targeting x86_64. Because there's no PLT outside x86_64, it's basically a no-op.
+      replace --file tccelf.c --output tccelf.c --match-on "fill_got(s1);" --replace-with "
+      {
+        fill_got(s1);
+        relocate_plt(s1);
+      }
+      "
     '')
     + "/tinycc-${rev}";
 
@@ -44,7 +90,10 @@ let
     homepage = "https://gitlab.com/janneke/tinycc";
     license = lib.licenses.lgpl21Only;
     teams = [ lib.teams.minimal-bootstrap ];
-    platforms = [ "i686-linux" ];
+    platforms = [
+      "i686-linux"
+      "x86_64-linux"
+    ];
   };
 
   pname = "tinycc-boot-mes";
@@ -67,23 +116,24 @@ let
             -o tcc.s \
             -I . \
             -D BOOTSTRAP=1 \
-            -D HAVE_LONG_LONG=0 \
+            -D HAVE_LONG_LONG=${if buildPlatform.is64bit then "1" else "0"} \
             -I ${src} \
-            -D TCC_TARGET_I386=1 \
+            -D TCC_TARGET_${tccTarget}=1 \
             -D inline= \
             -D CONFIG_TCCDIR=\"\" \
             -D CONFIG_SYSROOT=\"\" \
             -D CONFIG_TCC_CRTPREFIX=\"{B}\" \
             -D CONFIG_TCC_ELFINTERP=\"/mes/loader\" \
             -D CONFIG_TCC_LIBPATHS=\"{B}\" \
-            -D CONFIG_TCC_SYSINCLUDEPATHS=\"${mes-libc}/include\" \
-            -D TCC_LIBGCC=\"${mes-libc}/lib/x86-mes/libc.a\" \
+            -D CONFIG_TCC_SYSINCLUDEPATHS=\"${src}/include:${mes-libc}/include\" \
+            -D TCC_LIBGCC=\"libc.a\" \
+            -D TCC_LIBTCC1=\"libtcc1.a\" \
             -D CONFIG_TCC_LIBTCC1_MES=0 \
             -D CONFIG_TCCBOOT=1 \
             -D CONFIG_TCC_STATIC=1 \
             -D CONFIG_USE_LIBGCC=1 \
             -D TCC_MES_LIBC=1 \
-            -D TCC_VERSION=\"${version}\" \
+            -D TCC_VERSION=\"0.9.28-${version}\" \
             -D ONE_SOURCE=1 \
             ${src}/tcc.c
           mkdir -p ''${out}/bin
@@ -95,10 +145,9 @@ let
         '';
 
     libs = recompileLibc {
-      inherit pname version;
+      inherit pname version src;
       tcc = compiler;
-      src = mes-libc;
-      libtccOptions = mes-libc.CFLAGS;
+      libtccOptions = mes-libc.CFLAGS + " -DTCC_TARGET_${tccTarget}=1";
     };
   };
 
@@ -110,11 +159,12 @@ let
     inherit src version meta;
     prev = tinycc-boot-mes;
     buildOptions = [
-      "-D HAVE_LONG_LONG_STUB=1"
+      "-D HAVE_LONG_LONG=1"
       "-D HAVE_SETJMP=1"
     ];
     libtccBuildOptions = [
-      "-D HAVE_LONG_LONG_STUB=1"
+      "-D HAVE_LONG_LONG=1"
+      "-DTCC_TARGET_${tccTarget}=1"
     ];
   };
 
@@ -129,6 +179,7 @@ let
     ];
     libtccBuildOptions = [
       "-D HAVE_LONG_LONG=1"
+      "-DTCC_TARGET_${tccTarget}=1"
     ];
   };
 
@@ -145,6 +196,7 @@ let
     libtccBuildOptions = [
       "-D HAVE_FLOAT_STUB=1"
       "-D HAVE_LONG_LONG=1"
+      "-DTCC_TARGET_${tccTarget}=1"
     ];
   };
 
@@ -161,6 +213,7 @@ let
     libtccBuildOptions = [
       "-D HAVE_FLOAT=1"
       "-D HAVE_LONG_LONG=1"
+      "-DTCC_TARGET_${tccTarget}=1"
     ];
   };
 in
@@ -177,5 +230,6 @@ buildTinyccMes {
   libtccBuildOptions = [
     "-D HAVE_FLOAT=1"
     "-D HAVE_LONG_LONG=1"
+    "-DTCC_TARGET_${tccTarget}=1"
   ];
 }

pkgs/os-specific/linux/minimal-bootstrap/tinycc/common.nix

@@ -2,6 +2,7 @@
   lib,
   kaem,
   mes-libc,
+  buildPlatform,
 }:
 
 rec {
@@ -14,6 +15,14 @@ rec {
       version,
       src,
       libtccOptions,
+      libtccSources ? [
+        "${src}/lib/libtcc1.c"
+        "${src}/lib/va_list.c"
+      ],
+      libtccObjects ? [
+        "libtcc1.o"
+        "va_list.o"
+      ],
     }:
     let
 
@@ -25,15 +34,18 @@ rec {
       '';
 
       library =
-        lib: options: source:
-        kaem.runCommand "${lib}.a" { } ''
-          ${tcc}/bin/tcc ${options} -c -o ${lib}.o ${source}
-          ${tcc}/bin/tcc -ar cr ''${out} ${lib}.o
+        let
+          compileCmd = options: source: "${tcc}/bin/tcc ${options} -c ${source}";
+        in
+        libName: options: sources: objs:
+        kaem.runCommand "${libName}.a" { } ''
+          ${lib.strings.concatMapStringsSep "\n" (compileCmd options) sources}
+          ${tcc}/bin/tcc -ar cr ''${out} ${lib.strings.concatStringsSep " " objs}
         '';
 
-      libtcc1 = library "libtcc1" libtccOptions "${src}/lib/libtcc1.c";
-      libc = library "libc" mes-libc.CFLAGS "${mes-libc}/lib/libc.c";
-      libgetopt = library "libgetopt" mes-libc.CFLAGS "${mes-libc}/lib/libgetopt.c";
+      libtcc1 = library "libtcc1" libtccOptions libtccSources libtccObjects;
+      libc = library "libc" mes-libc.CFLAGS [ "${mes-libc}/lib/libc.c" ] [ "libc.o" ];
+      libgetopt = library "libgetopt" mes-libc.CFLAGS [ "${mes-libc}/lib/libgetopt.c" ] [ "libgetopt.o" ];
     in
     kaem.runCommand "${pname}-libs-${version}" { } ''
       mkdir -p ''${out}/lib
@@ -52,16 +64,30 @@ rec {
       src,
       prev,
       buildOptions,
+      libtccSources ? [
+        "${src}/lib/libtcc1.c"
+        "${src}/lib/va_list.c"
+      ],
+      libtccObjects ? [
+        "libtcc1.o"
+        "va_list.o"
+      ],
       libtccBuildOptions,
       meta,
     }:
     let
+      tccTarget =
+        {
+          i686-linux = "I386";
+          x86_64-linux = "X86_64";
+        }
+        .${buildPlatform.system};
       options = lib.strings.concatStringsSep " " buildOptions;
       libtccOptions = lib.strings.concatStringsSep " " (
         [
           "-c"
           "-D"
-          "TCC_TARGET_I386=1"
+          "TCC_TARGET_${tccTarget}=1"
         ]
         ++ libtccBuildOptions
       );
@@ -97,20 +123,20 @@ rec {
               ${options} \
               -I . \
               -I ${src} \
-              -D TCC_TARGET_I386=1 \
+              -D TCC_TARGET_${tccTarget}=1 \
               -D CONFIG_TCCDIR=\"\" \
               -D CONFIG_SYSROOT=\"\" \
               -D CONFIG_TCC_CRTPREFIX=\"{B}\" \
               -D CONFIG_TCC_ELFINTERP=\"\" \
               -D CONFIG_TCC_LIBPATHS=\"{B}\" \
-              -D CONFIG_TCC_SYSINCLUDEPATHS=\"${mes-libc}/include\" \
+              -D CONFIG_TCC_SYSINCLUDEPATHS=\"${src}/include:${mes-libc}/include\" \
               -D TCC_LIBGCC=\"libc.a\" \
               -D TCC_LIBTCC1=\"libtcc1.a\" \
               -D CONFIG_TCCBOOT=1 \
               -D CONFIG_TCC_STATIC=1 \
               -D CONFIG_USE_LIBGCC=1 \
               -D TCC_MES_LIBC=1 \
-              -D TCC_VERSION=\"${version}\" \
+              -D TCC_VERSION=\"0.9.28-${version}\" \
               -D ONE_SOURCE=1 \
               ${src}/tcc.c
           '';
@@ -120,6 +146,8 @@ rec {
           version
           src
           libtccOptions
+          libtccSources
+          libtccObjects
           ;
         tcc = compiler;
       };

pkgs/os-specific/linux/minimal-bootstrap/tinycc/mes.nix

@@ -14,12 +14,12 @@
 let
   inherit (callPackage ./common.nix { }) buildTinyccMes;
 
-  version = "unstable-2023-04-20";
-  rev = "86f3d8e33105435946383aee52487b5ddf918140";
+  version = "unstable-2025-12-03";
+  rev = "cb41cbfe717e4c00d7bb70035cda5ee5f0ff9341";
 
   tarball = fetchurl {
     url = "https://repo.or.cz/tinycc.git/snapshot/${rev}.tar.gz";
-    sha256 = "11idrvbwfgj1d03crv994mpbbbyg63j1k64lw1gjy7mkiifw2xap";
+    hash = "sha256-MRuqq3TKcfIahtUWdhAcYhqDiGPkAjS8UTMsDE+/jGU=";
   };
   src =
     (kaem.runCommand "tinycc-${version}-source" { } ''
@@ -32,6 +32,10 @@ let
       cd tinycc-${builtins.substring 0 7 rev}
       # Static link by default
       replace --file libtcc.c --output libtcc.c --match-on "s->ms_extensions = 1;" --replace-with "s->ms_extensions = 1; s->static_link = 1;"
+      replace --file i386-asm.c --output i386-asm.c --match-on "switch(size)" --replace-with "if (reg >= 8) { cstr_printf(add_str, \"%%r%d%c\", reg, (size == 1) ? 'b' : ((size == 2) ? 'w' : ((size == 4) ? 'd' : ' '))); return; } switch(size)"
+
+      # If performing ptr + (-1) for example, the offset should be ptrdiff_t and not size_t
+      replace --file tccgen.c --output tccgen.c --match-on "vpush_type_size(pointed_type(&vtop[-1].type), &align);" --replace-with "vpush_type_size(pointed_type(&vtop[-1].type), &align); if (!(vtop[-1].type.t & VT_UNSIGNED)) gen_cast_s(VT_PTRDIFF_T);"
     '')
     + "/tinycc-${builtins.substring 0 7 rev}";
 
@@ -40,9 +44,15 @@ let
     homepage = "https://repo.or.cz/w/tinycc.git";
     license = lib.licenses.lgpl21Only;
     teams = [ lib.teams.minimal-bootstrap ];
-    platforms = [ "i686-linux" ];
+    platforms = [
+      "i686-linux"
+      "x86_64-linux"
+    ];
   };
 
+  config_h = builtins.toFile "config_tccdefs.h" ''
+    "#include <mes/config.h>\n"
+  '';
   tccdefs = kaem.runCommand "tccdefs-${version}" { } ''
     mkdir ''${out}
     ${tinycc-bootstrappable.compiler}/bin/tcc \
@@ -50,7 +60,8 @@ let
       -DC2STR \
       -o c2str \
       ${src}/conftest.c
-    ./c2str ${src}/include/tccdefs.h ''${out}/tccdefs_.h
+    ./c2str ${src}/include/tccdefs.h tccdefs_.h
+    catm ''${out}/tccdefs_.h tccdefs_.h ${config_h}
   '';
 
   tinycc-mes-boot = buildTinyccMes {
@@ -66,6 +77,14 @@ let
       "-I ${tccdefs}"
       "-D CONFIG_TCC_SEMLOCK=0"
     ];
+    libtccSources = [
+      "${src}/lib/libtcc1.c"
+      "${src}/lib/alloca.S"
+    ];
+    libtccObjects = [
+      "libtcc1.o"
+      "alloca.o"
+    ];
     libtccBuildOptions = [
       "-D HAVE_FLOAT=1"
       "-D HAVE_LONG_LONG=1"
@@ -89,6 +108,14 @@ buildTinyccMes {
     "-I ${tccdefs}"
     "-D CONFIG_TCC_SEMLOCK=0"
   ];
+  libtccSources = [
+    "${src}/lib/libtcc1.c"
+    "${src}/lib/alloca.S"
+  ];
+  libtccObjects = [
+    "libtcc1.o"
+    "alloca.o"
+  ];
   libtccBuildOptions = [
     "-D HAVE_FLOAT=1"
     "-D HAVE_LONG_LONG=1"

pkgs/os-specific/linux/minimal-bootstrap/tinycc/musl.nix

@@ -2,26 +2,31 @@
   lib,
   fetchurl,
   bash,
-  tinycc-bootstrappable,
+  tinycc,
   musl,
   gnupatch,
   gnutar,
   gzip,
+  buildPlatform,
 }:
 let
   pname = "tinycc-musl";
-  # next commit introduces use of realpath (unsupported in mes-libc)
-  version = "unstable-2023-07-31";
-  rev = "fd6d2180c5c801bb0b4c5dde27d61503059fc97d";
+  version = "unstable-2025-12-03";
+  rev = "cb41cbfe717e4c00d7bb70035cda5ee5f0ff9341";
 
   src = fetchurl {
     url = "https://repo.or.cz/tinycc.git/snapshot/${rev}.tar.gz";
-    hash = "sha256-R81SNbEmh4s9FNQxCWZwUiMCYRkkwOHAdRf0aMnnRiA=";
+    hash = "sha256-MRuqq3TKcfIahtUWdhAcYhqDiGPkAjS8UTMsDE+/jGU=";
   };
 
+  tccTarget =
+    {
+      i686-linux = "I386";
+      x86_64-linux = "X86_64";
+    }
+    .${buildPlatform.system};
+
   patches = [
-    ./ignore-duplicate-symbols.patch
-    ./ignore-static-inside-array.patch
     ./static-link.patch
   ];
 
@@ -30,7 +35,10 @@ let
     homepage = "https://repo.or.cz/w/tinycc.git";
     license = lib.licenses.lgpl21Only;
     teams = [ lib.teams.minimal-bootstrap ];
-    platforms = [ "i686-linux" ];
+    platforms = [
+      "i686-linux"
+      "x86_64-linux"
+    ];
   };
 
   tinycc-musl =
@@ -39,7 +47,7 @@ let
         inherit pname version meta;
 
         nativeBuildInputs = [
-          tinycc-bootstrappable.compiler
+          tinycc.compiler
           gnupatch
           gnutar
           gzip
@@ -52,6 +60,10 @@ let
 
         # Patch
         ${lib.concatMapStringsSep "\n" (f: "patch -Np0 -i ${f}") patches}
+        replace --file i386-asm.c --output i386-asm.c --match-on "switch(size)" --replace-with "if (reg >= 8) { cstr_printf(add_str, \"%%r%d%c\", reg, (size == 1) ? 'b' : ((size == 2) ? 'w' : ((size == 4) ? 'd' : ' '))); return; } switch(size)"
+
+        # If performing ptr + (-1) for example, the offset should be ptrdiff_t and not size_t
+        replace --file tccgen.c --output tccgen.c --match-on "vpush_type_size(pointed_type(&vtop[-1].type), &align);" --replace-with "vpush_type_size(pointed_type(&vtop[-1].type), &align); if (!(vtop[-1].type.t & VT_UNSIGNED)) gen_cast_s(VT_PTRDIFF_T);"
 
         # Configure
         touch config.h
@@ -62,7 +74,7 @@ let
         ln -s ${musl}/lib/libtcc1.a ./libtcc1.a
 
         tcc \
-          -B ${tinycc-bootstrappable.libs}/lib \
+          -B ${tinycc.libs}/lib \
           -DC2STR \
           -o c2str \
           conftest.c
@@ -71,7 +83,7 @@ let
         tcc -v \
           -static \
           -o tcc-musl \
-          -D TCC_TARGET_I386=1 \
+          -D TCC_TARGET_${tccTarget}=1 \
           -D CONFIG_TCCDIR=\"\" \
           -D CONFIG_TCC_CRTPREFIX=\"{B}\" \
           -D CONFIG_TCC_ELFINTERP=\"/musl/loader\" \
@@ -86,8 +98,9 @@ let
           -D TCC_MUSL=1 \
           -D CONFIG_TCC_PREDEFS=1 \
           -D CONFIG_TCC_SEMLOCK=0 \
+          -D CONFIG_TCC_BACKTRACE=0 \
           -B . \
-          -B ${tinycc-bootstrappable.libs}/lib \
+          -B ${tinycc.libs}/lib \
           tcc.c
         # libtcc1.a
         rm -f libtcc1.a
@@ -99,7 +112,7 @@ let
           -v \
           -static \
           -o tcc-musl \
-          -D TCC_TARGET_I386=1 \
+          -D TCC_TARGET_${tccTarget}=1 \
           -D CONFIG_TCCDIR=\"\" \
           -D CONFIG_TCC_CRTPREFIX=\"{B}\" \
           -D CONFIG_TCC_ELFINTERP=\"/musl/loader\" \
@@ -114,6 +127,7 @@ let
           -D TCC_MUSL=1 \
           -D CONFIG_TCC_PREDEFS=1 \
           -D CONFIG_TCC_SEMLOCK=0 \
+          -D CONFIG_TCC_BACKTRACE=0 \
           -B . \
           -B ${musl}/lib \
           tcc.c

pkgs/os-specific/linux/minimal-bootstrap/xz/default.nix

@@ -62,6 +62,10 @@ bash.runCommand "${pname}-${version}"
     export CC="tcc -B ${tinycc.libs}/lib"
     export AR="tcc -ar"
     export LD=tcc
+    # With a lower max_cmd_len (which is mistakenly detected by the
+    # configure script), libtool invokes ar in append mode. This is not
+    # supported by tinycc.
+    export lt_cv_sys_max_cmd_len=32768
     bash ./configure \
       --prefix=$out \
       --build=${buildPlatform.config} \

pkgs/stdenv/generic/check-meta.nix

@@ -15,15 +15,15 @@ let
     concatMapStrings
     concatMapStringsSep
     concatStrings
+    filter
     findFirst
+    getName
     isDerivation
     length
     concatMap
     mutuallyExclusive
     optional
-    optionalAttrs
     optionalString
-    optionals
     isAttrs
     isString
     mapAttrs
@@ -47,6 +47,11 @@ let
     toPretty
     ;
 
+  inherit (builtins)
+    getEnv
+    trace
+    ;
+
   # If we're in hydra, we can dispense with the more verbose error
   # messages and make problems easier to spot.
   inHydra = config.inHydra or false;
@@ -57,11 +62,11 @@ let
   getNameWithVersion =
     attrs: attrs.name or "${attrs.pname or "«name-missing»"}-${attrs.version or "«version-missing»"}";
 
-  allowUnfree = config.allowUnfree || builtins.getEnv "NIXPKGS_ALLOW_UNFREE" == "1";
+  allowUnfree = config.allowUnfree || getEnv "NIXPKGS_ALLOW_UNFREE" == "1";
 
   allowNonSource =
     let
-      envVar = builtins.getEnv "NIXPKGS_ALLOW_NONSOURCE";
+      envVar = getEnv "NIXPKGS_ALLOW_NONSOURCE";
     in
     if envVar != "" then envVar != "0" else config.allowNonSource or true;
 
@@ -74,33 +79,34 @@ let
     else
       throw "allowlistedLicenses and blocklistedLicenses are not mutually exclusive.";
 
-  hasLicense = attrs: attrs ? meta.license;
-
   hasListedLicense =
     assert areLicenseListsValid;
-    list: attrs:
-    length list > 0
-    && hasLicense attrs
-    && (
-      if isList attrs.meta.license then
-        any (l: elem l list) attrs.meta.license
-      else
-        elem attrs.meta.license list
-    );
+    list:
+    if list == [ ] then
+      attrs: false
+    else
+      attrs:
+      attrs ? meta.license
+      && (
+        if isList attrs.meta.license then
+          any (l: elem l list) attrs.meta.license
+        else
+          elem attrs.meta.license list
+      );
 
-  hasAllowlistedLicense = attrs: hasListedLicense allowlist attrs;
+  hasAllowlistedLicense = hasListedLicense allowlist;
 
-  hasBlocklistedLicense = attrs: hasListedLicense blocklist attrs;
+  hasBlocklistedLicense = hasListedLicense blocklist;
 
-  allowBroken = config.allowBroken || builtins.getEnv "NIXPKGS_ALLOW_BROKEN" == "1";
+  allowBroken = config.allowBroken || getEnv "NIXPKGS_ALLOW_BROKEN" == "1";
 
   allowUnsupportedSystem =
-    config.allowUnsupportedSystem || builtins.getEnv "NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM" == "1";
+    config.allowUnsupportedSystem || getEnv "NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM" == "1";
 
   isUnfree =
     licenses:
     if isAttrs licenses then
-      !licenses.free or true
+      !(licenses.free or true)
     # TODO: Returning false in the case of a string is a bug that should be fixed.
     # In a previous implementation of this function the function body
     # was `licenses: lib.lists.any (l: !l.free or true) licenses;`
@@ -108,9 +114,9 @@ let
     else if isString licenses then
       false
     else
-      any (l: !l.free or true) licenses;
+      any (l: !(l.free or true)) licenses;
 
-  hasUnfreeLicense = attrs: hasLicense attrs && isUnfree attrs.meta.license;
+  hasUnfreeLicense = attrs: attrs ? meta.license && isUnfree attrs.meta.license;
 
   hasNoMaintainers =
     # To get usable output, we want to avoid flagging "internal" derivations.
@@ -161,19 +167,13 @@ let
     attrs: hasUnfreeLicense attrs && !allowUnfree && !allowUnfreePredicate attrs;
 
   allowInsecureDefaultPredicate =
-    x: builtins.elem (getNameWithVersion x) (config.permittedInsecurePackages or [ ]);
-  allowInsecurePredicate = x: (config.allowInsecurePredicate or allowInsecureDefaultPredicate) x;
+    x: elem (getNameWithVersion x) (config.permittedInsecurePackages or [ ]);
+  allowInsecurePredicate = config.allowInsecurePredicate or allowInsecureDefaultPredicate;
 
-  hasAllowedInsecure =
-    attrs:
-    !(isMarkedInsecure attrs)
-    || allowInsecurePredicate attrs
-    || builtins.getEnv "NIXPKGS_ALLOW_INSECURE" == "1";
+  allowInsecure = getEnv "NIXPKGS_ALLOW_INSECURE" == "1";
 
-  isNonSource = sourceTypes: any (t: !t.isSource) sourceTypes;
-
-  hasNonSourceProvenance =
-    attrs: (attrs ? meta.sourceProvenance) && isNonSource attrs.meta.sourceProvenance;
+  hasDisallowedInsecure =
+    attrs: isMarkedInsecure attrs && !allowInsecure && !allowInsecurePredicate attrs;
 
   # Allow granular checks to allow only some non-source-built packages
   # Example:
@@ -188,7 +188,11 @@ let
   # package has non-source provenance and is not explicitly allowed by the
   # `allowNonSourcePredicate` function.
   hasDeniedNonSourceProvenance =
-    attrs: hasNonSourceProvenance attrs && !allowNonSource && !allowNonSourcePredicate attrs;
+    attrs:
+    attrs ? meta.sourceProvenance
+    && any (t: !t.isSource) attrs.meta.sourceProvenance
+    && !allowNonSource
+    && !allowNonSourcePredicate attrs;
 
   showLicenseOrSourceType =
     value: toString (map (v: v.shortName or v.fullName or "unknown") (toList value));
@@ -197,17 +201,6 @@ let
 
   pos_str = meta: meta.position or "«unknown-file»";
 
-  remediation = {
-    unfree = remediate_allowlist "Unfree" (remediate_predicate "allowUnfreePredicate");
-    non-source = remediate_allowlist "NonSource" (remediate_predicate "allowNonSourcePredicate");
-    broken = remediate_allowlist "Broken" (x: "");
-    unsupported = remediate_allowlist "UnsupportedSystem" (x: "");
-    blocklisted = x: "";
-    insecure = remediate_insecure;
-    broken-outputs = remediateOutputsToInstall;
-    unknown-meta = x: "";
-    maintainerless = x: "";
-  };
   remediation_env_var =
     allow_attr:
     {
@@ -230,7 +223,7 @@ let
 
     Alternatively you can configure a predicate to allow specific packages:
       { nixpkgs.config.${predicateConfigAttr} = pkg: builtins.elem (lib.getName pkg) [
-          "${lib.getName attrs}"
+          "${getName attrs}"
         ];
       }
   '';
@@ -300,7 +293,7 @@ let
     let
       expectedOutputs = attrs.meta.outputsToInstall or [ ];
       actualOutputs = attrs.outputs or [ "out" ];
-      missingOutputs = builtins.filter (output: !builtins.elem output actualOutputs) expectedOutputs;
+      missingOutputs = filter (output: !elem output actualOutputs) expectedOutputs;
     in
     ''
       The package ${getNameWithVersion attrs} has set meta.outputsToInstall to: ${builtins.concatStringsSep ", " expectedOutputs}
@@ -312,45 +305,6 @@ let
       ${concatStrings (map (output: "  - ${output}\n") missingOutputs)}
     '';
 
-  handleEvalIssue =
-    { meta, attrs }:
-    {
-      reason,
-      errormsg ? "",
-    }:
-    let
-      msg =
-        if inHydra then
-          "Failed to evaluate ${getNameWithVersion attrs}: «${reason}»: ${errormsg}"
-        else
-          ''
-            Package ‘${getNameWithVersion attrs}’ in ${pos_str meta} ${errormsg}, refusing to evaluate.
-
-          ''
-          + (builtins.getAttr reason remediation) attrs;
-
-      handler = if config ? handleEvalIssue then config.handleEvalIssue reason else throw;
-    in
-    handler msg;
-
-  handleEvalWarning =
-    { meta, attrs }:
-    {
-      reason,
-      errormsg ? "",
-    }:
-    let
-      remediationMsg = (builtins.getAttr reason remediation) attrs;
-      msg =
-        if inHydra then
-          "Warning while evaluating ${getNameWithVersion attrs}: «${reason}»: ${errormsg}"
-        else
-          "Package ${getNameWithVersion attrs} in ${pos_str meta} ${errormsg}, continuing anyway."
-          + (optionalString (remediationMsg != "") "\n${remediationMsg}");
-      isEnabled = findFirst (x: x == reason) null showWarnings;
-    in
-    if isEnabled != null then builtins.trace msg true else true;
-
   metaTypes =
     let
       types = import ./meta-types.nix { inherit lib; };
@@ -446,11 +400,10 @@ let
       identifiers = attrs;
     };
 
+  # Map attrs directly to the verify function for performance
+  metaTypes' = mapAttrs (_: t: t.verify) metaTypes;
+
   checkMetaAttr =
-    let
-      # Map attrs directly to the verify function for performance
-      metaTypes' = mapAttrs (_: t: t.verify) metaTypes;
-    in
     k: v:
     if metaTypes ? ${k} then
       if metaTypes'.${k} v then
@@ -467,81 +420,80 @@ let
           concatMapStringsSep ", " (x: "'${x}'") (attrNames metaTypes)
         }]"
       ];
-  checkMeta =
-    meta:
-    optionals config.checkMeta (concatMap (attr: checkMetaAttr attr meta.${attr}) (attrNames meta));
+
+  checkMeta = meta: concatMap (attr: checkMetaAttr attr meta.${attr}) (attrNames meta);
+
+  metaInvalid =
+    if config.checkMeta then
+      meta: !all (attr: metaTypes ? ${attr} && metaTypes'.${attr} meta.${attr}) (attrNames meta)
+    else
+      meta: false;
 
   checkOutputsToInstall =
-    attrs:
-    let
-      expectedOutputs = attrs.meta.outputsToInstall or [ ];
-      actualOutputs = attrs.outputs or [ "out" ];
-      missingOutputs = builtins.filter (output: !builtins.elem output actualOutputs) expectedOutputs;
-    in
-    if config.checkMeta then builtins.length missingOutputs > 0 else false;
+    if config.checkMeta then
+      attrs:
+      let
+        actualOutputs = attrs.outputs or [ "out" ];
+      in
+      any (output: !elem output actualOutputs) (attrs.meta.outputsToInstall or [ ])
+    else
+      attrs: false;
 
   # Check if a derivation is valid, that is whether it passes checks for
   # e.g brokenness or license.
   #
   # Return { valid: "yes", "warn" or "no" } and additionally
-  # { reason: String; errormsg: String } if it is not valid, where
+  # { reason: String; errormsg: String, remediation: String } if it is not valid, where
   # reason is one of "unfree", "blocklisted", "broken", "insecure", ...
   # !!! reason strings are hardcoded into OfBorg, make sure to keep them in sync
   # Along with a boolean flag for each reason
   checkValidity =
-    let
-      validYes = {
-        valid = "yes";
-        handled = true;
-      };
-    in
     attrs:
     # Check meta attribute types first, to make sure it is always called even when there are other issues
     # Note that this is not a full type check and functions below still need to by careful about their inputs!
-    let
-      res = checkMeta (attrs.meta or { });
-    in
-    if res != [ ] then
+    if metaInvalid (attrs.meta or { }) then
       {
-        valid = "no";
         reason = "unknown-meta";
-        errormsg = "has an invalid meta attrset:${concatMapStrings (x: "\n  - " + x) res}\n";
+        errormsg = "has an invalid meta attrset:${
+          concatMapStrings (x: "\n  - " + x) (checkMeta attrs.meta)
+        }\n";
+        remediation = "";
       }
 
     # --- Put checks that cannot be ignored here ---
     else if checkOutputsToInstall attrs then
       {
-        valid = "no";
         reason = "broken-outputs";
         errormsg = "has invalid meta.outputsToInstall";
+        remediation = remediateOutputsToInstall attrs;
       }
 
     # --- Put checks that can be ignored here ---
     else if hasDeniedUnfreeLicense attrs && !(hasAllowlistedLicense attrs) then
       {
-        valid = "no";
         reason = "unfree";
         errormsg = "has an unfree license (‘${showLicense attrs.meta.license}’)";
+        remediation = remediate_allowlist "Unfree" (remediate_predicate "allowUnfreePredicate") attrs;
       }
     else if hasBlocklistedLicense attrs then
       {
-        valid = "no";
         reason = "blocklisted";
         errormsg = "has a blocklisted license (‘${showLicense attrs.meta.license}’)";
+        remediation = "";
       }
     else if hasDeniedNonSourceProvenance attrs then
       {
-        valid = "no";
         reason = "non-source";
         errormsg = "contains elements not built from source (‘${showSourceType attrs.meta.sourceProvenance}’)";
+        remediation = remediate_allowlist "NonSource" (remediate_predicate "allowNonSourcePredicate") attrs;
       }
     else if hasDeniedBroken attrs then
       {
-        valid = "no";
         reason = "broken";
         errormsg = "is marked as broken";
+        remediation = remediate_allowlist "Broken" (x: "");
       }
-    else if !allowUnsupportedSystem && hasUnsupportedPlatform attrs then
+    else if hasUnsupportedPlatform attrs && !allowUnsupportedSystem then
       let
         toPretty' = toPretty {
           allowPrettyValues = true;
@@ -549,7 +501,6 @@ let
         };
       in
       {
-        valid = "no";
         reason = "unsupported";
         errormsg = ''
           is not available on the requested hostPlatform:
@@ -557,25 +508,28 @@ let
             package.meta.platforms = ${toPretty' (attrs.meta.platforms or [ ])}
             package.meta.badPlatforms = ${toPretty' (attrs.meta.badPlatforms or [ ])}
         '';
+        remediation = remediate_allowlist "UnsupportedSystem" (x: "") attrs;
       }
-    else if !(hasAllowedInsecure attrs) then
+    else if hasDisallowedInsecure attrs then
       {
-        valid = "no";
         reason = "insecure";
         errormsg = "is marked as insecure";
+        remediation = remediate_insecure attrs;
       }
+    else
+      null;
 
-    # --- warnings ---
-    # Please also update the type in /pkgs/top-level/config.nix alongside this.
-    else if hasNoMaintainers attrs then
+  # Please also update the type in /pkgs/top-level/config.nix alongside this.
+  checkWarnings =
+    attrs:
+    if hasNoMaintainers attrs then
       {
-        valid = "warn";
         reason = "maintainerless";
         errormsg = "has no maintainers or teams";
+        remediation = "";
       }
-    # -----
     else
-      validYes;
+      null;
 
   # Helper functions and declarations to handle identifiers, extracted to reduce allocations
   hasAllCPEParts =
@@ -730,34 +684,57 @@ let
 
       available =
         validity.valid != "no"
-        && (
-          if config.checkMetaRecursively or false then all (d: d.meta.available or true) references else true
-        );
+        && ((config.checkMetaRecursively or false) -> all (d: d.meta.available or true) references);
     };
 
+  validYes = {
+    valid = "yes";
+    handled = true;
+  };
+
   assertValidity =
     { meta, attrs }:
     let
-      validity = checkValidity attrs;
-      inherit (validity) valid;
+      invalid = checkValidity attrs;
+      warning = checkWarnings attrs;
     in
-    if validity ? handled then
-      validity
+    if isNull invalid then
+      if isNull warning then
+        validYes
+      else
+        let
+          msg =
+            if inHydra then
+              "Warning while evaluating ${getNameWithVersion attrs}: «${warning.reason}»: ${warning.errormsg}"
+            else
+              "Package ${getNameWithVersion attrs} in ${pos_str meta} ${warning.errormsg}, continuing anyway."
+              + (optionalString (warning.remediation != "") "\n${warning.remediation}");
+
+          handled = if elem warning.reason showWarnings then trace msg true else true;
+        in
+        warning
+        // {
+          valid = "warn";
+          handled = handled;
+        }
     else
-      validity
-      // {
-        # Throw an error if trying to evaluate a non-valid derivation
-        # or, alternatively, just output a warning message.
-        handled = (
-          if valid == "yes" then
-            true
-          else if valid == "no" then
-            (handleEvalIssue { inherit meta attrs; } { inherit (validity) reason errormsg; })
-          else if valid == "warn" then
-            (handleEvalWarning { inherit meta attrs; } { inherit (validity) reason errormsg; })
+      let
+        msg =
+          if inHydra then
+            "Failed to evaluate ${getNameWithVersion attrs}: «${invalid.reason}»: ${invalid.errormsg}"
           else
-            throw "Unknown validity: '${valid}'"
-        );
+            ''
+              Package ‘${getNameWithVersion attrs}’ in ${pos_str meta} ${invalid.errormsg}, refusing to evaluate.
+
+            ''
+            + invalid.remediation;
+
+        handled = if config ? handleEvalIssue then config.handleEvalIssue invalid.reason msg else throw msg;
+      in
+      invalid
+      // {
+        valid = "no";
+        handled = handled;
       };
 
 in

pkgs/top-level/gnuradio-packages.nix

@@ -49,5 +49,6 @@ lib.makeScope newScope (
 
     fosphor = callPackage ../development/gnuradio-modules/fosphor/default.nix { };
 
+    gr-difi = callPackage ../development/gnuradio-modules/gr-difi/default.nix { };
   }
 )

pkgs/top-level/python-packages.nix

@@ -11870,6 +11870,18 @@ self: super: with self; {
 
   peacasso = callPackage ../development/python-modules/peacasso { };
 
+  peakrdl = callPackage ../development/python-modules/peakrdl { };
+
+  peakrdl-cheader = callPackage ../development/python-modules/peakrdl-cheader { };
+
+  peakrdl-ipxact = callPackage ../development/python-modules/peakrdl-ipxact { };
+
+  peakrdl-markdown = callPackage ../development/python-modules/peakrdl-markdown { };
+
+  peakrdl-regblock = callPackage ../development/python-modules/peakrdl-regblock { };
+
+  peakrdl-rust = callPackage ../development/python-modules/peakrdl-rust { };
+
   peakutils = callPackage ../development/python-modules/peakutils { };
 
   peaqevcore = callPackage ../development/python-modules/peaqevcore { };
@@ -12722,6 +12734,8 @@ self: super: with self; {
 
   py-madvr2 = callPackage ../development/python-modules/py-madvr2 { };
 
+  py-markdown-table = callPackage ../development/python-modules/py-markdown-table { };
+
   py-melissa-climate = callPackage ../development/python-modules/py-melissa-climate { };
 
   py-multiaddr = callPackage ../development/python-modules/py-multiaddr { };
@@ -18341,6 +18355,8 @@ self: super: with self; {
 
   systemdunitparser = callPackage ../development/python-modules/systemdunitparser { };
 
+  systemrdl-compiler = callPackage ../development/python-modules/systemrdl-compiler { };
+
   sysv-ipc = callPackage ../development/python-modules/sysv-ipc { };
 
   t61codec = callPackage ../development/python-modules/t61codec { };