From 7b6fa3f33e15a9951293d8379b93c44032099f34 Mon Sep 17 00:00:00 2001
From: laalsaas <laalsaas@systemli.org>
Date: Tue, 30 Jul 2024 09:25:30 +0200
Subject: [PATCH 01/53] maintainers: add laalsaas to FC team

---
 maintainers/team-list.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 8ce7e4273feb..75a6248c264d 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -315,6 +315,7 @@ with lib.maintainers;
       leona
       osnyx
       ma27
+      laalsaas
     ];
     scope = "Team for Flying Circus employees who collectively maintain packages.";
     shortName = "Flying Circus employees";

From cf642a11d355754053ecd990cfd6c72f8d6e60e2 Mon Sep 17 00:00:00 2001
From: laalsaas <laalsaas@systemli.org>
Date: Tue, 30 Jul 2024 09:29:20 +0200
Subject: [PATCH 02/53] matomo_5: 5.0.2 -> 5.1.0

---
 pkgs/servers/web-apps/matomo/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/web-apps/matomo/default.nix b/pkgs/servers/web-apps/matomo/default.nix
index 529deabd48bc..d90a6122ed58 100644
--- a/pkgs/servers/web-apps/matomo/default.nix
+++ b/pkgs/servers/web-apps/matomo/default.nix
@@ -7,8 +7,8 @@ let
       hash = "sha256-cGnsxfpvt7FyhxFcA2/gWWe7CyanVGZVKtCDES3XLdI=";
     };
     matomo_5 = {
-      version = "5.0.2";
-      hash = "sha256-rLAShJLtzd3HB1Je+P+i8GKWdeklyC2sTnmPR07Md+8=";
+      version = "5.1.0";
+      hash = "sha256-AVfuqVdsEFL2up/8FCxAPlfmOXl+KSGwzCNrkPssoho=";
     };
     matomo-beta = {
       version = "5.0.0";

From 0799550a95c11510ef864ea40f68916db9f3d49d Mon Sep 17 00:00:00 2001
From: codgician <15964984+codgician@users.noreply.github.com>
Date: Fri, 9 Aug 2024 08:46:10 +0800
Subject: [PATCH 03/53] azure-agent: remove x86 assertion

---
 nixos/modules/virtualisation/azure-agent.nix | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/nixos/modules/virtualisation/azure-agent.nix b/nixos/modules/virtualisation/azure-agent.nix
index 5b3b7080ea68..8903bf0985a2 100644
--- a/nixos/modules/virtualisation/azure-agent.nix
+++ b/nixos/modules/virtualisation/azure-agent.nix
@@ -11,7 +11,6 @@ let
   '';
 
 in
-
 {
 
   ###### interface
@@ -35,13 +34,9 @@ in
 
   config = lib.mkIf cfg.enable {
     assertions = [{
-      assertion = pkgs.stdenv.hostPlatform.isx86;
-      message = "Azure not currently supported on ${pkgs.stdenv.hostPlatform.system}";
-    }
-      {
-        assertion = config.networking.networkmanager.enable == false;
-        message = "Windows Azure Linux Agent is not compatible with NetworkManager";
-      }];
+      assertion = config.networking.networkmanager.enable == false;
+      message = "Windows Azure Linux Agent is not compatible with NetworkManager";
+    }];
 
     boot.initrd.kernelModules = [ "ata_piix" ];
     networking.firewall.allowedUDPPorts = [ 68 ];

From f6fe3b3bffa2c012b014e608953ea15076b72b21 Mon Sep 17 00:00:00 2001
From: codgician <15964984+codgician@users.noreply.github.com>
Date: Fri, 9 Aug 2024 08:47:10 +0800
Subject: [PATCH 04/53] azure-common: add accelerated networking configs

---
 nixos/modules/virtualisation/azure-common.nix | 127 ++++++++++--------
 1 file changed, 74 insertions(+), 53 deletions(-)

diff --git a/nixos/modules/virtualisation/azure-common.nix b/nixos/modules/virtualisation/azure-common.nix
index cd1ffdb6cbcc..430e076d354a 100644
--- a/nixos/modules/virtualisation/azure-common.nix
+++ b/nixos/modules/virtualisation/azure-common.nix
@@ -1,67 +1,88 @@
 { lib, pkgs, ... }:
 
 with lib;
+let
+  cfg = config.virtualisation.azure;
+in
 {
+  options.virtualisation.azure = {
+    acceleratedNetworking = mkOption {
+      default = false;
+      description = "Whether the machine's network interface has enabled accelerated networking.";
+    };
+  };
+
   imports = [ ../profiles/headless.nix ];
 
   require = [ ./azure-agent.nix ];
-  virtualisation.azure.agent.enable = true;
 
-  boot.kernelParams = [ "console=ttyS0" "earlyprintk=ttyS0" "rootdelay=300" "panic=1" "boot.panic_on_fail" ];
-  boot.initrd.kernelModules = [ "hv_vmbus" "hv_netvsc" "hv_utils" "hv_storvsc" ];
+  config = let
+    mlxDrivers = [ "mlx4_en" "mlx4_core" "mlx5_core" ];
+  in
+  {
+    virtualisation.azure.agent.enable = true;
 
-  # Generate a GRUB menu.
-  boot.loader.grub.device = "/dev/sda";
-  boot.loader.timeout = 0;
+    boot.kernelParams = [ "console=ttyS0" "earlyprintk=ttyS0" "rootdelay=300" "panic=1" "boot.panic_on_fail" ];
+    boot.initrd.kernelModules = [ "hv_vmbus" "hv_netvsc" "hv_utils" "hv_storvsc" ] ++ (lib.optionals cfg.acceleratedNetworking mlxDrivers);
 
-  boot.growPartition = true;
+    # Accelerated networking
+    systemd.network.networks."99-azure-unmanaged-devices.network" = lib.mkIf cfg.acceleratedNetworking {
+      matchConfig.Driver = mlxDrivers;
+      linkConfig.Unmanaged = "yes";
+    };
 
-  # Don't put old configurations in the GRUB menu.  The user has no
-  # way to select them anyway.
-  boot.loader.grub.configurationLimit = 0;
+    # Generate a GRUB menu.
+    boot.loader.grub.device = "/dev/sda";
+    boot.loader.timeout = 0;
 
-  fileSystems."/" = {
-    device = "/dev/disk/by-label/nixos";
-    fsType = "ext4";
-    autoResize = true;
+    boot.growPartition = true;
+
+    # Don't put old configurations in the GRUB menu.  The user has no
+    # way to select them anyway.
+    boot.loader.grub.configurationLimit = 0;
+
+    fileSystems."/" = {
+      device = "/dev/disk/by-label/nixos";
+      fsType = "ext4";
+      autoResize = true;
+    };
+
+    # Allow root logins only using the SSH key that the user specified
+    # at instance creation time, ping client connections to avoid timeouts
+    services.openssh.enable = true;
+    services.openssh.settings.PermitRootLogin = "prohibit-password";
+    services.openssh.settings.ClientAliveInterval = 180;
+
+    # Force getting the hostname from Azure
+    networking.hostName = mkDefault "";
+
+    # Always include cryptsetup so that NixOps can use it.
+    # sg_scan is needed to finalize disk removal on older kernels
+    environment.systemPackages = [ pkgs.cryptsetup pkgs.sg3_utils ];
+
+    networking.usePredictableInterfaceNames = false;
+
+    services.udev.extraRules = ''
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:0", ATTR{removable}=="0", SYMLINK+="disk/by-lun/0",
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:1", ATTR{removable}=="0", SYMLINK+="disk/by-lun/1",
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:2", ATTR{removable}=="0", SYMLINK+="disk/by-lun/2"
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:3", ATTR{removable}=="0", SYMLINK+="disk/by-lun/3"
+
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:4", ATTR{removable}=="0", SYMLINK+="disk/by-lun/4"
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:5", ATTR{removable}=="0", SYMLINK+="disk/by-lun/5"
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:6", ATTR{removable}=="0", SYMLINK+="disk/by-lun/6"
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:7", ATTR{removable}=="0", SYMLINK+="disk/by-lun/7"
+
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:8", ATTR{removable}=="0", SYMLINK+="disk/by-lun/8"
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:9", ATTR{removable}=="0", SYMLINK+="disk/by-lun/9"
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:10", ATTR{removable}=="0", SYMLINK+="disk/by-lun/10"
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:11", ATTR{removable}=="0", SYMLINK+="disk/by-lun/11"
+
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:12", ATTR{removable}=="0", SYMLINK+="disk/by-lun/12"
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:13", ATTR{removable}=="0", SYMLINK+="disk/by-lun/13"
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:14", ATTR{removable}=="0", SYMLINK+="disk/by-lun/14"
+      ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:15", ATTR{removable}=="0", SYMLINK+="disk/by-lun/15"
+
+    '';
   };
-
-  # Allow root logins only using the SSH key that the user specified
-  # at instance creation time, ping client connections to avoid timeouts
-  services.openssh.enable = true;
-  services.openssh.settings.PermitRootLogin = "prohibit-password";
-  services.openssh.settings.ClientAliveInterval = 180;
-
-  # Force getting the hostname from Azure
-  networking.hostName = mkDefault "";
-
-  # Always include cryptsetup so that NixOps can use it.
-  # sg_scan is needed to finalize disk removal on older kernels
-  environment.systemPackages = [ pkgs.cryptsetup pkgs.sg3_utils ];
-
-  networking.usePredictableInterfaceNames = false;
-
-  services.udev.extraRules = ''
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:0", ATTR{removable}=="0", SYMLINK+="disk/by-lun/0",
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:1", ATTR{removable}=="0", SYMLINK+="disk/by-lun/1",
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:2", ATTR{removable}=="0", SYMLINK+="disk/by-lun/2"
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:3", ATTR{removable}=="0", SYMLINK+="disk/by-lun/3"
-
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:4", ATTR{removable}=="0", SYMLINK+="disk/by-lun/4"
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:5", ATTR{removable}=="0", SYMLINK+="disk/by-lun/5"
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:6", ATTR{removable}=="0", SYMLINK+="disk/by-lun/6"
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:7", ATTR{removable}=="0", SYMLINK+="disk/by-lun/7"
-
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:8", ATTR{removable}=="0", SYMLINK+="disk/by-lun/8"
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:9", ATTR{removable}=="0", SYMLINK+="disk/by-lun/9"
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:10", ATTR{removable}=="0", SYMLINK+="disk/by-lun/10"
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:11", ATTR{removable}=="0", SYMLINK+="disk/by-lun/11"
-
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:12", ATTR{removable}=="0", SYMLINK+="disk/by-lun/12"
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:13", ATTR{removable}=="0", SYMLINK+="disk/by-lun/13"
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:14", ATTR{removable}=="0", SYMLINK+="disk/by-lun/14"
-    ENV{DEVTYPE}=="disk", KERNEL!="sda" SUBSYSTEM=="block", SUBSYSTEMS=="scsi", KERNELS=="?:0:0:15", ATTR{removable}=="0", SYMLINK+="disk/by-lun/15"
-
-  '';
-
 }

From 0769bb8aac006c6cdc9a3e21ec3fcb292395068d Mon Sep 17 00:00:00 2001
From: codgician <15964984+codgician@users.noreply.github.com>
Date: Fri, 9 Aug 2024 14:47:30 +0800
Subject: [PATCH 05/53] azure-image: support creating v2 image

---
 nixos/modules/virtualisation/azure-image.nix | 31 +++++++++++++++++---
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/virtualisation/azure-image.nix b/nixos/modules/virtualisation/azure-image.nix
index 98678346a8fd..ecb57483cce9 100644
--- a/nixos/modules/virtualisation/azure-image.nix
+++ b/nixos/modules/virtualisation/azure-image.nix
@@ -7,8 +7,8 @@ in
 {
   imports = [ ./azure-common.nix ];
 
-  options = {
-    virtualisation.azureImage.diskSize = mkOption {
+  options.virtualisation.azureImage = {
+    diskSize = mkOption {
       type = with types; either (enum [ "auto" ]) int;
       default = "auto";
       example = 2048;
@@ -16,14 +16,34 @@ in
         Size of disk image. Unit is MB.
       '';
     };
-    virtualisation.azureImage.contents = mkOption {
+
+    bootSize = mkOption {
+      type = types.int;
+      default = 256;
+      description = ''
+        ESP partition size. Unit is MB.
+        Only effective when vmGeneration is `v2`.
+      '';
+    };
+
+    contents = mkOption {
       type = with types; listOf attrs;
       default = [ ];
       description = ''
         Extra contents to add to the image.
       '';
     };
+
+    vmGeneration = mkOption {
+      type = with types; enum [ "v1" "v2" ];
+      default = "v1";
+      description = ''
+        VM Generation to use.
+        For v2, secure boot needs to be turned off during creation.
+      '';
+    };
   };
+
   config = {
     system.build.azureImage = import ../../lib/make-disk-image.nix {
       name = "azure-image";
@@ -33,9 +53,12 @@ in
       '';
       configFile = ./azure-config-user.nix;
       format = "raw";
+
+      bootSize = "${toString cfg.bootSize}M";
+      partitionTableType = if cfg.vmGeneration == "v2" then "efi" else "legacy";
+
       inherit (cfg) diskSize contents;
       inherit config lib pkgs;
     };
-
   };
 }

From 85fcdad66cf53a416426660ed47ab2979c85828c Mon Sep 17 00:00:00 2001
From: codgician <15964984+codgician@users.noreply.github.com>
Date: Fri, 9 Aug 2024 15:10:07 +0800
Subject: [PATCH 06/53] azure-common: fix unsupported attribute

---
 nixos/modules/virtualisation/azure-common.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/virtualisation/azure-common.nix b/nixos/modules/virtualisation/azure-common.nix
index 430e076d354a..b2cf5c943693 100644
--- a/nixos/modules/virtualisation/azure-common.nix
+++ b/nixos/modules/virtualisation/azure-common.nix
@@ -12,9 +12,10 @@ in
     };
   };
 
-  imports = [ ../profiles/headless.nix ];
-
-  require = [ ./azure-agent.nix ];
+  imports = [ 
+    ../profiles/headless.nix 
+    ./azure-agent.nix
+  ];
 
   config = let
     mlxDrivers = [ "mlx4_en" "mlx4_core" "mlx5_core" ];

From 5b4f446d6a1ab09b2295212e5d31f3cdea104369 Mon Sep 17 00:00:00 2001
From: codgician <15964984+codgician@users.noreply.github.com>
Date: Fri, 9 Aug 2024 15:17:12 +0800
Subject: [PATCH 07/53] azure-common: improve code style

---
 nixos/modules/virtualisation/azure-common.nix | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/nixos/modules/virtualisation/azure-common.nix b/nixos/modules/virtualisation/azure-common.nix
index b2cf5c943693..d639e7f7c807 100644
--- a/nixos/modules/virtualisation/azure-common.nix
+++ b/nixos/modules/virtualisation/azure-common.nix
@@ -1,8 +1,9 @@
-{ lib, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
 with lib;
 let
   cfg = config.virtualisation.azure;
+  mlxDrivers = [ "mlx4_en" "mlx4_core" "mlx5_core" ];
 in
 {
   options.virtualisation.azure = {
@@ -12,19 +13,17 @@ in
     };
   };
 
-  imports = [ 
+  imports = [
     ../profiles/headless.nix 
     ./azure-agent.nix
   ];
 
-  config = let
-    mlxDrivers = [ "mlx4_en" "mlx4_core" "mlx5_core" ];
-  in
-  {
+  config = {
     virtualisation.azure.agent.enable = true;
 
     boot.kernelParams = [ "console=ttyS0" "earlyprintk=ttyS0" "rootdelay=300" "panic=1" "boot.panic_on_fail" ];
-    boot.initrd.kernelModules = [ "hv_vmbus" "hv_netvsc" "hv_utils" "hv_storvsc" ] ++ (lib.optionals cfg.acceleratedNetworking mlxDrivers);
+    boot.initrd.kernelModules = [ "hv_vmbus" "hv_netvsc" "hv_utils" "hv_storvsc" ] 
+      ++ (lib.optionals cfg.acceleratedNetworking mlxDrivers);
 
     # Accelerated networking
     systemd.network.networks."99-azure-unmanaged-devices.network" = lib.mkIf cfg.acceleratedNetworking {

From 1f26575842dd1d30bfd742910bba1713f899e705 Mon Sep 17 00:00:00 2001
From: codgician <15964984+codgician@users.noreply.github.com>
Date: Sat, 10 Aug 2024 02:03:27 +0800
Subject: [PATCH 08/53] azure-common: rm trailing whitespace

---
 nixos/modules/virtualisation/azure-common.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/virtualisation/azure-common.nix b/nixos/modules/virtualisation/azure-common.nix
index d639e7f7c807..13116fe81764 100644
--- a/nixos/modules/virtualisation/azure-common.nix
+++ b/nixos/modules/virtualisation/azure-common.nix
@@ -14,7 +14,7 @@ in
   };
 
   imports = [
-    ../profiles/headless.nix 
+    ../profiles/headless.nix
     ./azure-agent.nix
   ];
 
@@ -22,7 +22,7 @@ in
     virtualisation.azure.agent.enable = true;
 
     boot.kernelParams = [ "console=ttyS0" "earlyprintk=ttyS0" "rootdelay=300" "panic=1" "boot.panic_on_fail" ];
-    boot.initrd.kernelModules = [ "hv_vmbus" "hv_netvsc" "hv_utils" "hv_storvsc" ] 
+    boot.initrd.kernelModules = [ "hv_vmbus" "hv_netvsc" "hv_utils" "hv_storvsc" ]
       ++ (lib.optionals cfg.acceleratedNetworking mlxDrivers);
 
     # Accelerated networking

From 028138f20147703bf4a466f77f0f66bb895ad7d5 Mon Sep 17 00:00:00 2001
From: codgician <15964984+codgician@users.noreply.github.com>
Date: Sat, 10 Aug 2024 11:47:18 +0800
Subject: [PATCH 09/53] azure-common: put mlx drivers into
 availableKernelModules

---
 nixos/modules/virtualisation/azure-common.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/virtualisation/azure-common.nix b/nixos/modules/virtualisation/azure-common.nix
index 13116fe81764..ee81a3c70968 100644
--- a/nixos/modules/virtualisation/azure-common.nix
+++ b/nixos/modules/virtualisation/azure-common.nix
@@ -22,8 +22,8 @@ in
     virtualisation.azure.agent.enable = true;
 
     boot.kernelParams = [ "console=ttyS0" "earlyprintk=ttyS0" "rootdelay=300" "panic=1" "boot.panic_on_fail" ];
-    boot.initrd.kernelModules = [ "hv_vmbus" "hv_netvsc" "hv_utils" "hv_storvsc" ]
-      ++ (lib.optionals cfg.acceleratedNetworking mlxDrivers);
+    boot.initrd.kernelModules = [ "hv_vmbus" "hv_netvsc" "hv_utils" "hv_storvsc" ];
+    boot.initrd.availableKernelModules = lib.optionals cfg.acceleratedNetworking mlxDrivers;
 
     # Accelerated networking
     systemd.network.networks."99-azure-unmanaged-devices.network" = lib.mkIf cfg.acceleratedNetworking {

From 88c5242599db9fe3e4c50466a58b972a2c339e5d Mon Sep 17 00:00:00 2001
From: codgician <15964984+codgician@users.noreply.github.com>
Date: Tue, 13 Aug 2024 17:39:47 +0800
Subject: [PATCH 10/53] azure-common: remove bootloader timeout since we can
 access serial console now

---
 nixos/modules/virtualisation/azure-common.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/nixos/modules/virtualisation/azure-common.nix b/nixos/modules/virtualisation/azure-common.nix
index ee81a3c70968..cdb848950dc2 100644
--- a/nixos/modules/virtualisation/azure-common.nix
+++ b/nixos/modules/virtualisation/azure-common.nix
@@ -33,14 +33,9 @@ in
 
     # Generate a GRUB menu.
     boot.loader.grub.device = "/dev/sda";
-    boot.loader.timeout = 0;
 
     boot.growPartition = true;
 
-    # Don't put old configurations in the GRUB menu.  The user has no
-    # way to select them anyway.
-    boot.loader.grub.configurationLimit = 0;
-
     fileSystems."/" = {
       device = "/dev/disk/by-label/nixos";
       fsType = "ext4";

From 5ccaa56a46444ee8512dcf6ab64fbfd3fc9889c0 Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Tue, 13 Aug 2024 18:24:55 +0400
Subject: [PATCH 11/53] =?UTF-8?q?python3Packages.stravalib:=201.6=20?=
 =?UTF-8?q?=E2=86=92=202.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/python-modules/stravalib/default.nix | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/stravalib/default.nix b/pkgs/development/python-modules/stravalib/default.nix
index 935f40d00004..f35593ecd95b 100644
--- a/pkgs/development/python-modules/stravalib/default.nix
+++ b/pkgs/development/python-modules/stravalib/default.nix
@@ -15,24 +15,24 @@
 
 buildPythonPackage rec {
   pname = "stravalib";
-  version = "1.6";
+  version = "2.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "stravalib";
     repo = "stravalib";
     rev = "refs/tags/v${version}";
-    hash = "sha256-U+QlSrijvT77/m+yjhFxbcVTQe51J+PR4Kc8N+qG+wI=";
+    hash = "sha256-uF29fK+ZSSO688zKYYiSEygBUJZ6NBcvdgGgz3I1I6Q=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
     setuptools-scm
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     arrow
     pint
     pydantic
@@ -52,6 +52,5 @@ buildPythonPackage rec {
     changelog = "https://github.com/stravalib/stravalib/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ sikmir ];
-    broken = lib.versionAtLeast pydantic.version "2";
   };
 }

From 94683f9e55d47996b7403791863143f7afad8a51 Mon Sep 17 00:00:00 2001
From: codgician <15964984+codgician@users.noreply.github.com>
Date: Wed, 14 Aug 2024 11:02:58 +0800
Subject: [PATCH 12/53] azure-common: take networkmanager users into account
 for accelerated networking

---
 nixos/modules/virtualisation/azure-common.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/virtualisation/azure-common.nix b/nixos/modules/virtualisation/azure-common.nix
index cdb848950dc2..d8d835dd303d 100644
--- a/nixos/modules/virtualisation/azure-common.nix
+++ b/nixos/modules/virtualisation/azure-common.nix
@@ -30,6 +30,8 @@ in
       matchConfig.Driver = mlxDrivers;
       linkConfig.Unmanaged = "yes";
     };
+    networking.networkmanager.unmanaged = lib.mkIf cfg.acceleratedNetworking
+      (builtins.map (drv: "driver:${drv}") mlxDrivers);
 
     # Generate a GRUB menu.
     boot.loader.grub.device = "/dev/sda";

From a58bfa1150d1675664747c70b2d5677e2fa32ce7 Mon Sep 17 00:00:00 2001
From: Yuriy Taraday <yuriy.taraday@tweag.io>
Date: Fri, 2 Aug 2024 16:09:11 +0200
Subject: [PATCH 13/53] lima-bin: Fix completion generation

It was running unpatched binary which was failing and thus generating
empty output. After https://github.com/NixOS/nixpkgs/pull/289517
installShellCompletion errors out because of this, which lead to broken
build.

Move installShellCompletion call to after autoPatchelfHook in
fixupPhase.
---
 pkgs/applications/virtualization/lima/bin.nix | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/virtualization/lima/bin.nix b/pkgs/applications/virtualization/lima/bin.nix
index ba26d9e6041d..7549f0c1528b 100644
--- a/pkgs/applications/virtualization/lima/bin.nix
+++ b/pkgs/applications/virtualization/lima/bin.nix
@@ -57,10 +57,17 @@ stdenvNoCC.mkDerivation {
     chmod +x $out/bin/limactl
     wrapProgram $out/bin/limactl \
       --prefix PATH : ${lib.makeBinPath [ qemu ]}
-    installShellCompletion --cmd limactl \
-      --bash <($out/bin/limactl completion bash) \
-      --fish <($out/bin/limactl completion fish) \
-      --zsh <($out/bin/limactl completion zsh)
+
+    # the shell completion only works with a patched $out/bin/limactl and so
+    # needs to run after the autoPatchelfHook is executed in postFixup.
+    doShellCompletion() {
+      installShellCompletion --cmd limactl \
+        --bash <($out/bin/limactl completion bash) \
+        --fish <($out/bin/limactl completion fish) \
+        --zsh <($out/bin/limactl completion zsh)
+    }
+    postFixupHooks+=(doShellCompletion)
+
     runHook postInstall
   '';
 

From ed48acbc06b1c71063b665c8ac5e3d2b690d4b4f Mon Sep 17 00:00:00 2001
From: laalsaas <laalsaas@systemli.org>
Date: Tue, 20 Aug 2024 12:06:56 +0200
Subject: [PATCH 14/53] matomo_5: 5.1.0 -> 5.1.1

---
 pkgs/servers/web-apps/matomo/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/web-apps/matomo/default.nix b/pkgs/servers/web-apps/matomo/default.nix
index d90a6122ed58..989d96df645c 100644
--- a/pkgs/servers/web-apps/matomo/default.nix
+++ b/pkgs/servers/web-apps/matomo/default.nix
@@ -7,8 +7,8 @@ let
       hash = "sha256-cGnsxfpvt7FyhxFcA2/gWWe7CyanVGZVKtCDES3XLdI=";
     };
     matomo_5 = {
-      version = "5.1.0";
-      hash = "sha256-AVfuqVdsEFL2up/8FCxAPlfmOXl+KSGwzCNrkPssoho=";
+      version = "5.1.1";
+      hash = "sha256-xi6R9O/pOxBgga6+wwqziwDKK7Q1Ispldvxg+0mpdeQ=";
     };
     matomo-beta = {
       version = "5.0.0";

From 33d8eabcbeb03702566c625572b4a6b84d51160d Mon Sep 17 00:00:00 2001
From: Justinas Stankevicius <justinas@justinas.org>
Date: Sun, 18 Aug 2024 15:39:20 +0300
Subject: [PATCH 15/53] wlx-overlay-s: add required libraries

---
 pkgs/by-name/wl/wlx-overlay-s/package.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/wl/wlx-overlay-s/package.nix b/pkgs/by-name/wl/wlx-overlay-s/package.nix
index 411d83799b99..fb9404b3c8a4 100644
--- a/pkgs/by-name/wl/wlx-overlay-s/package.nix
+++ b/pkgs/by-name/wl/wlx-overlay-s/package.nix
@@ -4,6 +4,8 @@
   fetchFromGitHub,
   fontconfig,
   lib,
+  libGL,
+  libuuid,
   libX11,
   libXext,
   libXrandr,
@@ -19,6 +21,7 @@
   shaderc,
   stdenv,
   testers,
+  vulkan-loader,
   wayland,
   wlx-overlay-s,
 }:
@@ -76,7 +79,11 @@ rustPlatform.buildRustPackage rec {
   postInstall = ''
     patchelf $out/bin/wlx-overlay-s \
       --add-needed ${lib.getLib wayland}/lib/libwayland-client.so.0 \
-      --add-needed ${lib.getLib libxkbcommon}/lib/libxkbcommon.so.0
+      --add-needed ${lib.getLib libxkbcommon}/lib/libxkbcommon.so.0 \
+      --add-needed ${lib.getLib libGL}/lib/libEGL.so.1 \
+      --add-needed ${lib.getLib libGL}/lib/libGL.so.1 \
+      --add-needed ${lib.getLib vulkan-loader}/lib/libvulkan.so.1 \
+      --add-needed ${lib.getLib libuuid}/lib/libuuid.so.1
   '';
 
   passthru = {

From 30fe276d69fe0fd3e319281d1133c90bd433f10d Mon Sep 17 00:00:00 2001
From: h7x4 <h7x4@nani.wtf>
Date: Fri, 23 Aug 2024 16:11:27 +0200
Subject: [PATCH 16/53] newsboat: add mainProgram

---
 pkgs/applications/networking/feedreaders/newsboat/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/applications/networking/feedreaders/newsboat/default.nix b/pkgs/applications/networking/feedreaders/newsboat/default.nix
index 5d0249249478..43f3c565d244 100644
--- a/pkgs/applications/networking/feedreaders/newsboat/default.nix
+++ b/pkgs/applications/networking/feedreaders/newsboat/default.nix
@@ -66,5 +66,6 @@ rustPlatform.buildRustPackage rec {
     maintainers = with lib.maintainers; [ dotlambda nicknovitski ];
     license     = lib.licenses.mit;
     platforms   = lib.platforms.unix;
+    mainProgram = "newsboat";
   };
 }

From 718a5333ef83e3dddd26e735ce5bc71376b0f027 Mon Sep 17 00:00:00 2001
From: techknowlogick <techknowlogick@gitea.com>
Date: Sat, 24 Aug 2024 23:50:28 -0400
Subject: [PATCH 17/53] stalwart-mail: only include foundationdb for linux
 builds

---
 pkgs/by-name/st/stalwart-mail/package.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/st/stalwart-mail/package.nix b/pkgs/by-name/st/stalwart-mail/package.nix
index 6c697a494d34..ed2770a8974d 100644
--- a/pkgs/by-name/st/stalwart-mail/package.nix
+++ b/pkgs/by-name/st/stalwart-mail/package.nix
@@ -61,14 +61,19 @@ rustPlatform.buildRustPackage {
     bzip2
     openssl
     sqlite
-    foundationdb
     zstd
+  ] ++ lib.optionals stdenv.isLinux [
+    foundationdb
   ] ++ lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.CoreFoundation
     darwin.apple_sdk.frameworks.Security
     darwin.apple_sdk.frameworks.SystemConfiguration
   ];
 
+  # skip defaults on darwin because foundationdb is not available
+  buildNoDefaultFeatures = stdenv.isDarwin;
+  buildFeatures = lib.optional (stdenv.isDarwin) [ "sqlite" "postgres" "mysql" "rocks" "elastic" "s3" "redis" ];
+
   env = {
     OPENSSL_NO_VENDOR = true;
     ZSTD_SYS_USE_PKG_CONFIG = true;

From 7f4a574a0b16ee6866e125a1b77e64d27623d0f2 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Sun, 25 Aug 2024 15:05:11 +0100
Subject: [PATCH 18/53] _389-ds-base: 2.4.5 -> 2.4.6

addressing CVE-2024-6237 & CVE-2024-5953
---
 pkgs/servers/ldap/389/default.nix | 25 +++----------------------
 1 file changed, 3 insertions(+), 22 deletions(-)

diff --git a/pkgs/servers/ldap/389/default.nix b/pkgs/servers/ldap/389/default.nix
index 0658b7a36fed..e8cfaa1f1ca6 100644
--- a/pkgs/servers/ldap/389/default.nix
+++ b/pkgs/servers/ldap/389/default.nix
@@ -31,45 +31,26 @@
 , withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd, systemd
 , zlib
 , rsync
-, fetchpatch
 , withCockpit ? true
 , withAsan ? false
 }:
 
 stdenv.mkDerivation rec {
   pname = "389-ds-base";
-  version = "2.4.5";
+  version = "2.4.6";
 
   src = fetchFromGitHub {
     owner = "389ds";
     repo = pname;
     rev = "${pname}-${version}";
-    hash = "sha256-12JCd2R00L0T5EPUNO/Aw2HRID+z2krNQ09RSX9Qkj8=";
+    hash = "sha256-+FTCzEyQY71TCkj8HMnSkrnQtxjHxOmtYhfZEAYOLis=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "fix-32bit.patch";
-      url = "https://github.com/389ds/389-ds-base/commit/1fe029c495cc9f069c989cfbb09d449a078c56e2.patch";
-      hash = "sha256-b0HSaDjuEUKERIXKg8np+lZDdZNmrCTAXybJzF+0hq0=";
-    })
-    (fetchpatch {
-      name = "CVE-2024-2199.patch";
-      url = "https://git.rockylinux.org/staging/rpms/389-ds-base/-/raw/dae373bd6b4e7d6f35a096e6f27be1c3bf1e48ac/SOURCES/0004-CVE-2024-2199.patch";
-      hash = "sha256-grANphTafCoa9NQy+FowwPhGQnvuCbfGnSpQ1Wp69Vg=";
-    })
-    (fetchpatch {
-      name = "CVE-2024-3657.patch";
-      url = "https://git.rockylinux.org/staging/rpms/389-ds-base/-/raw/dae373bd6b4e7d6f35a096e6f27be1c3bf1e48ac/SOURCES/0005-CVE-2024-3657.patch";
-      hash = "sha256-CuiCXQp3PMiYERzFk7oH3T91yQ1dP/gtLNWF0eqGAQ4=";
-    })
-  ];
-
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     sourceRoot = "${src.name}/src";
     name = "${pname}-${version}";
-    hash = "sha256-fE3bJROwti9Ru0jhCiWhXcuQdxXTqzN9yOd2nlhKABI=";
+    hash = "sha256-2Ng268tfbMRU3Uyo5ljSS/HxPnw1abvGjcczo25HyVk=";
   };
 
   nativeBuildInputs = [

From 711d9378355ed4585beda643fdf0419e118ee72f Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Mon, 5 Aug 2024 16:34:56 +0200
Subject: [PATCH 19/53] userborn: init at 0.1.0

---
 pkgs/by-name/us/userborn/package.nix | 43 ++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 pkgs/by-name/us/userborn/package.nix

diff --git a/pkgs/by-name/us/userborn/package.nix b/pkgs/by-name/us/userborn/package.nix
new file mode 100644
index 000000000000..5b0f14eb396f
--- /dev/null
+++ b/pkgs/by-name/us/userborn/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  makeBinaryWrapper,
+  mkpasswd,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "userborn";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "nikstur";
+    repo = "userborn";
+    rev = version;
+    hash = "sha256-aptFDrL9RPPTu4wp2ee3LVaEruRdCWtLGIKdOgsR+/s=";
+  };
+
+  sourceRoot = "${src.name}/rust/userborn";
+
+  cargoHash = "sha256-m39AC26E0Pxu1E/ap2kSwr5uznJNgExf5QUrZ+zTNX0=";
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  buildInputs = [ mkpasswd ];
+
+  nativeCheckInputs = [ mkpasswd ];
+
+  postInstall = ''
+    wrapProgram $out/bin/userborn --prefix PATH : ${lib.makeBinPath [ mkpasswd ]}
+  '';
+
+  stripAllList = [ "bin" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/nikstur/userborn";
+    description = "Declaratively bear (manage) Linux users and groups";
+    license = licenses.mit;
+    maintainers = with lib.maintainers; [ nikstur ];
+    mainProgram = "userborn";
+  };
+}

From 4620067d79ee663adaafb9293c1559260776f10a Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Mon, 5 Aug 2024 16:37:07 +0200
Subject: [PATCH 20/53] nixos/userborn: init

---
 nixos/modules/module-list.nix               |   1 +
 nixos/modules/services/system/userborn.nix  | 183 ++++++++++++++++++++
 nixos/modules/system/etc/etc-activation.nix |   4 +-
 3 files changed, 186 insertions(+), 2 deletions(-)
 create mode 100644 nixos/modules/services/system/userborn.nix

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index fb0c67cad0a7..56bf7f6c54ca 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1347,6 +1347,7 @@
   ./services/system/systembus-notify.nix
   ./services/system/systemd-lock-handler.nix
   ./services/system/uptimed.nix
+  ./services/system/userborn.nix
   ./services/system/zram-generator.nix
   ./services/torrent/deluge.nix
   ./services/torrent/flexget.nix
diff --git a/nixos/modules/services/system/userborn.nix b/nixos/modules/services/system/userborn.nix
new file mode 100644
index 000000000000..d73bd2646c80
--- /dev/null
+++ b/nixos/modules/services/system/userborn.nix
@@ -0,0 +1,183 @@
+{
+  utils,
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+
+  cfg = config.services.userborn;
+  userCfg = config.users;
+
+  userbornConfig = {
+    groups = lib.mapAttrsToList (username: opts: {
+      inherit (opts) name gid members;
+    }) config.users.groups;
+
+    users = lib.mapAttrsToList (username: opts: {
+      inherit (opts)
+        name
+        uid
+        group
+        description
+        home
+        password
+        hashedPassword
+        hashedPasswordFile
+        initialPassword
+        initialHashedPassword
+        ;
+      isNormal = opts.isNormalUser;
+      shell = utils.toShellPath opts.shell;
+    }) config.users.users;
+  };
+
+  userbornConfigJson = pkgs.writeText "userborn.json" (builtins.toJSON userbornConfig);
+
+  immutableEtc = config.system.etc.overlay.enable && !config.system.etc.overlay.mutable;
+  # The filenames created by userborn.
+  passwordFiles = [
+    "group"
+    "passwd"
+    "shadow"
+  ];
+
+in
+{
+
+  options.services.userborn = {
+
+    enable = lib.mkEnableOption "userborn";
+
+    package = lib.mkPackageOption pkgs "userborn" { };
+
+    passwordFilesLocation = lib.mkOption {
+      type = lib.types.str;
+      default = if immutableEtc then "/var/lib/nixos" else "/etc";
+      defaultText = lib.literalExpression ''if immutableEtc then "/var/lib/nixos" else "/etc"'';
+      description = ''
+        The location of the original password files.
+
+        If this is not `/etc`, the files are symlinked from this location to `/etc`.
+
+        The primary motivation for this is an immutable `/etc`, where we cannot
+        write the files directly to `/etc`.
+
+        However this an also serve other use cases, e.g. when `/etc` is on a `tmpfs`.
+      '';
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    assertions = [
+      {
+        assertion = !(config.systemd.sysusers.enable && cfg.enable);
+        message = "You cannot use systemd-sysusers and Userborn at the same time";
+      }
+      {
+        assertion = config.system.activationScripts.users == "";
+        message = "system.activationScripts.users has to be empty to use userborn";
+      }
+      {
+        assertion = immutableEtc -> (cfg.passwordFilesLocation != "/etc");
+        message = "When `system.etc.overlay.mutable = false`, `services.userborn.passwordFilesLocation` cannot be set to `/etc`";
+      }
+    ];
+
+    system.activationScripts.users = lib.mkForce "";
+    system.activationScripts.hashes = lib.mkForce "";
+
+    systemd = {
+
+      # Create home directories, do not create /var/empty even if that's a user's
+      # home.
+      tmpfiles.settings.home-directories = lib.mapAttrs' (
+        username: opts:
+        lib.nameValuePair opts.home {
+          d = {
+            mode = opts.homeMode;
+            user = username;
+            inherit (opts) group;
+          };
+        }
+      ) (lib.filterAttrs (_username: opts: opts.home != "/var/empty") userCfg.users);
+
+      services.userborn = {
+        wantedBy = [ "sysinit.target" ];
+        requiredBy = [ "sysinit-reactivation.target" ];
+        after = [
+          "systemd-remount-fs.service"
+          "systemd-tmpfiles-setup-dev-early.service"
+        ];
+        before = [
+          "systemd-tmpfiles-setup-dev.service"
+          "sysinit.target"
+          "shutdown.target"
+          "sysinit-reactivation.target"
+        ];
+        conflicts = [ "shutdown.target" ];
+        restartTriggers = [
+          userbornConfigJson
+          cfg.passwordFilesLocation
+        ];
+        # This way we don't have to re-declare all the dependencies to other
+        # services again.
+        aliases = [ "systemd-sysusers.service" ];
+
+        unitConfig = {
+          Description = "Manage Users and Groups";
+          DefaultDependencies = false;
+        };
+
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          TimeoutSec = "90s";
+
+          ExecStart = "${lib.getExe cfg.package} ${userbornConfigJson} ${cfg.passwordFilesLocation}";
+
+          ExecStartPre = lib.mkMerge [
+            (lib.mkIf (!config.system.etc.overlay.mutable) [
+              "${pkgs.coreutils}/bin/mkdir -p ${cfg.passwordFilesLocation}"
+            ])
+
+            # Make the source files writable before executing userborn.
+            (lib.mkIf (!userCfg.mutableUsers) (
+              lib.map (file: "-${pkgs.util-linux}/bin/umount ${cfg.passwordFilesLocation}/${file}") passwordFiles
+            ))
+          ];
+
+          # Make the source files read-only after userborn has finished.
+          ExecStartPost = lib.mkIf (!userCfg.mutableUsers) (
+            lib.map (
+              file:
+              "${pkgs.util-linux}/bin/mount --bind -o ro ${cfg.passwordFilesLocation}/${file} ${cfg.passwordFilesLocation}/${file}"
+            ) passwordFiles
+          );
+        };
+      };
+    };
+
+    # Statically create the symlinks to passwordFilesLocation when they're not
+    # inside /etc because we will not be able to do it at runtime in case of an
+    # immutable /etc!
+    environment.etc = lib.mkIf (cfg.passwordFilesLocation != "/etc") (
+      lib.listToAttrs (
+        lib.map (
+          file:
+          lib.nameValuePair file {
+            source = "${cfg.passwordFilesLocation}/${file}";
+            mode = "direct-symlink";
+          }
+        ) passwordFiles
+      )
+    );
+  };
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+}
diff --git a/nixos/modules/system/etc/etc-activation.nix b/nixos/modules/system/etc/etc-activation.nix
index ed9f50941771..9b43d76e8746 100644
--- a/nixos/modules/system/etc/etc-activation.nix
+++ b/nixos/modules/system/etc/etc-activation.nix
@@ -19,8 +19,8 @@
           message = "`system.etc.overlay.enable` requires `boot.initrd.systemd.enable`";
         }
         {
-          assertion = (!config.system.etc.overlay.mutable) -> config.systemd.sysusers.enable;
-          message = "`system.etc.overlay.mutable = false` requires `systemd.sysusers.enable`";
+          assertion = (!config.system.etc.overlay.mutable) -> (config.systemd.sysusers.enable || config.services.userborn.enable);
+          message = "`!system.etc.overlay.mutable` requires `systemd.sysusers.enable` or `services.userborn.enable`";
         }
         {
           assertion = lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.6";

From ad63319ca56d4ed6d1b017d86ad35fc0f3821c41 Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Wed, 7 Aug 2024 14:56:05 +0200
Subject: [PATCH 21/53] nixos/tests/userborn: init

---
 nixos/tests/all-tests.nix                |   5 +
 nixos/tests/userborn-immutable-etc.nix   |  70 +++++++++++++
 nixos/tests/userborn-immutable-users.nix |  75 +++++++++++++
 nixos/tests/userborn-mutable-etc.nix     |  70 +++++++++++++
 nixos/tests/userborn-mutable-users.nix   |  76 ++++++++++++++
 nixos/tests/userborn.nix                 | 127 +++++++++++++++++++++++
 6 files changed, 423 insertions(+)
 create mode 100644 nixos/tests/userborn-immutable-etc.nix
 create mode 100644 nixos/tests/userborn-immutable-users.nix
 create mode 100644 nixos/tests/userborn-mutable-etc.nix
 create mode 100644 nixos/tests/userborn-mutable-users.nix
 create mode 100644 nixos/tests/userborn.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 0cd52cbec9a3..7faa7d4748e0 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1057,6 +1057,11 @@ in {
   uptime-kuma = handleTest ./uptime-kuma.nix {};
   urn-timer = handleTest ./urn-timer.nix {};
   usbguard = handleTest ./usbguard.nix {};
+  userborn = runTest ./userborn.nix;
+  userborn-mutable-users = runTest ./userborn-mutable-users.nix;
+  userborn-immutable-users = runTest ./userborn-immutable-users.nix;
+  userborn-mutable-etc = runTest ./userborn-mutable-etc.nix;
+  userborn-immutable-etc = runTest ./userborn-immutable-etc.nix;
   user-activation-scripts = handleTest ./user-activation-scripts.nix {};
   user-expiry = runTest ./user-expiry.nix;
   user-home-mode = handleTest ./user-home-mode.nix {};
diff --git a/nixos/tests/userborn-immutable-etc.nix b/nixos/tests/userborn-immutable-etc.nix
new file mode 100644
index 000000000000..e95fba23063b
--- /dev/null
+++ b/nixos/tests/userborn-immutable-etc.nix
@@ -0,0 +1,70 @@
+{ lib, ... }:
+
+let
+  normaloHashedPassword = "$y$j9T$IEWqhKtWg.r.8fVkSEF56.$iKNxdMC6hOAQRp6eBtYvBk4c7BGpONXeZMqc8I/LM46";
+
+  common = {
+    services.userborn.enable = true;
+    boot.initrd.systemd.enable = true;
+    system.etc.overlay = {
+      enable = true;
+      mutable = false;
+    };
+  };
+in
+
+{
+
+  name = "userborn-immutable-etc";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine =
+    { config, ... }:
+    {
+      imports = [ common ];
+
+      users = {
+        users = {
+          normalo = {
+            isNormalUser = true;
+            hashedPassword = normaloHashedPassword;
+          };
+        };
+      };
+
+      specialisation.new-generation = {
+        inheritParentConfig = false;
+        configuration = {
+          nixpkgs = {
+            inherit (config.nixpkgs) hostPlatform;
+          };
+          imports = [ common ];
+
+          users.users = {
+            new-normalo = {
+              isNormalUser = true;
+            };
+          };
+        };
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("userborn.service")
+
+    with subtest("normalo user is created"):
+      assert "${normaloHashedPassword}" in machine.succeed("getent shadow normalo"), "normalo user password is not correct"
+
+
+    machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
+
+
+    with subtest("normalo user is disabled"):
+      print(machine.succeed("getent shadow normalo"))
+      assert "!*" in machine.succeed("getent shadow normalo"), "normalo user is not disabled"
+
+    with subtest("new-normalo user is created after switching to new generation"):
+      print(machine.succeed("getent passwd new-normalo"))
+  '';
+}
diff --git a/nixos/tests/userborn-immutable-users.nix b/nixos/tests/userborn-immutable-users.nix
new file mode 100644
index 000000000000..887d2d312eb7
--- /dev/null
+++ b/nixos/tests/userborn-immutable-users.nix
@@ -0,0 +1,75 @@
+{ lib, ... }:
+
+let
+  normaloHashedPassword = "$y$j9T$IEWqhKtWg.r.8fVkSEF56.$iKNxdMC6hOAQRp6eBtYvBk4c7BGpONXeZMqc8I/LM46";
+
+  common = {
+    services.userborn.enable = true;
+    users.mutableUsers = false;
+  };
+in
+
+{
+
+  name = "userborn-immutable-users";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine =
+    { config, ... }:
+    {
+      imports = [ common ];
+
+      users = {
+        users = {
+          normalo = {
+            isNormalUser = true;
+            hashedPassword = normaloHashedPassword;
+          };
+        };
+      };
+
+      specialisation.new-generation = {
+        inheritParentConfig = false;
+        configuration = {
+          nixpkgs = {
+            inherit (config.nixpkgs) hostPlatform;
+          };
+          imports = [ common ];
+
+          users.users = {
+            new-normalo = {
+              isNormalUser = true;
+            };
+          };
+        };
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("userborn.service")
+
+    with subtest("normalo user is created"):
+      assert "${normaloHashedPassword}" in machine.succeed("getent shadow normalo"), "normalo user password is not correct"
+
+    with subtest("Fail to add new user manually"):
+      machine.fail("useradd manual-normalo")
+
+    with subtest("Fail to add delete user manually"):
+      machine.fail("userdel normalo")
+
+
+    machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
+
+
+    with subtest("normalo user is disabled"):
+      print(machine.succeed("getent shadow normalo"))
+      assert "!*" in machine.succeed("getent shadow normalo"), "normalo user is not disabled"
+
+    with subtest("new-normalo user is created after switching to new generation"):
+      print(machine.succeed("getent passwd new-normalo"))
+
+    with subtest("Still fail to add new user manually"):
+      machine.fail("useradd again-normalo")
+  '';
+}
diff --git a/nixos/tests/userborn-mutable-etc.nix b/nixos/tests/userborn-mutable-etc.nix
new file mode 100644
index 000000000000..6199b84ce71d
--- /dev/null
+++ b/nixos/tests/userborn-mutable-etc.nix
@@ -0,0 +1,70 @@
+{ lib, ... }:
+
+let
+  normaloHashedPassword = "$y$j9T$IEWqhKtWg.r.8fVkSEF56.$iKNxdMC6hOAQRp6eBtYvBk4c7BGpONXeZMqc8I/LM46";
+
+  common = {
+    services.userborn.enable = true;
+    boot.initrd.systemd.enable = true;
+    system.etc.overlay = {
+      enable = true;
+      mutable = true;
+    };
+  };
+in
+
+{
+
+  name = "userborn-mutable-etc";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine =
+    { config, ... }:
+    {
+      imports = [ common ];
+
+      users = {
+        users = {
+          normalo = {
+            isNormalUser = true;
+            hashedPassword = normaloHashedPassword;
+          };
+        };
+      };
+
+      specialisation.new-generation = {
+        inheritParentConfig = false;
+        configuration = {
+          nixpkgs = {
+            inherit (config.nixpkgs) hostPlatform;
+          };
+          imports = [ common ];
+
+          users.users = {
+            new-normalo = {
+              isNormalUser = true;
+            };
+          };
+        };
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("userborn.service")
+
+    with subtest("normalo user is created"):
+      assert "${normaloHashedPassword}" in machine.succeed("getent shadow normalo"), "normalo user password is not correct"
+
+
+    machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
+
+
+    with subtest("normalo user is disabled"):
+      print(machine.succeed("getent shadow normalo"))
+      assert "!*" in machine.succeed("getent shadow normalo"), "normalo user is not disabled"
+
+    with subtest("new-normalo user is created after switching to new generation"):
+      print(machine.succeed("getent passwd new-normalo"))
+  '';
+}
diff --git a/nixos/tests/userborn-mutable-users.nix b/nixos/tests/userborn-mutable-users.nix
new file mode 100644
index 000000000000..e2b9c3df4953
--- /dev/null
+++ b/nixos/tests/userborn-mutable-users.nix
@@ -0,0 +1,76 @@
+{ lib, ... }:
+
+let
+  normaloHashedPassword = "$y$j9T$IEWqhKtWg.r.8fVkSEF56.$iKNxdMC6hOAQRp6eBtYvBk4c7BGpONXeZMqc8I/LM46";
+
+  common = {
+    services.userborn.enable = true;
+    users.mutableUsers = true;
+  };
+in
+
+{
+
+  name = "userborn-mutable-users";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine =
+    { config, ... }:
+    {
+      imports = [ common ];
+
+      users = {
+        mutableUsers = true;
+        users = {
+          normalo = {
+            isNormalUser = true;
+            hashedPassword = normaloHashedPassword;
+          };
+        };
+      };
+
+      specialisation.new-generation = {
+        inheritParentConfig = false;
+        configuration = {
+          nixpkgs = {
+            inherit (config.nixpkgs) hostPlatform;
+          };
+          imports = [ common ];
+
+          users.users = {
+            new-normalo = {
+              isNormalUser = true;
+            };
+          };
+        };
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("userborn.service")
+
+    with subtest("normalo user is created"):
+      assert 1000 == int(machine.succeed("id --user normalo")), "normalo user doesn't have UID 1000"
+      assert "${normaloHashedPassword}" in machine.succeed("getent shadow normalo"), "normalo user password is not correct"
+
+    with subtest("Add new user manually"):
+      machine.succeed("useradd manual-normalo")
+      assert 1001 == int(machine.succeed("id --user manual-normalo")), "manual-normalo user doesn't have UID 1001"
+
+    with subtest("Delete manual--normalo user manually"):
+      machine.succeed("userdel manual-normalo")
+
+
+    machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
+
+
+    with subtest("normalo user is disabled"):
+      print(machine.succeed("getent shadow normalo"))
+      assert "!*" in machine.succeed("getent shadow normalo"), "normalo user is not disabled"
+
+    with subtest("new-normalo user is created after switching to new generation"):
+      print(machine.succeed("getent passwd new-normalo"))
+      assert 1001 == int(machine.succeed("id --user new-normalo")), "new-normalo user doesn't have UID 1001"
+  '';
+}
diff --git a/nixos/tests/userborn.nix b/nixos/tests/userborn.nix
new file mode 100644
index 000000000000..c89880a14a5c
--- /dev/null
+++ b/nixos/tests/userborn.nix
@@ -0,0 +1,127 @@
+{ lib, ... }:
+
+let
+  # All passwords are "test"
+  rootHashedPasswordFile = "$y$j9T$6ueoTO5y7vvFsGvpQJEEa.$vubxgBiMnkTCtRtPD3hNiZHa7Nm1WsJeE9QomYqSRXB";
+  updatedRootHashedPassword = "$y$j9T$pBCO9N1FRF1rSl6V15n9n/$1JmRLEYPO7TRCx43cvLO19u59WA/oqTEhmSR4wrhzr.";
+
+  normaloPassword = "test";
+  updatedNormaloHashedPassword = "$y$j9T$IEWqhKtWg.r.8fVkSEF56.$iKNxdMC6hOAQRp6eBtYvBk4c7BGpONXeZMqc8I/LM46";
+
+  sysuserInitialHashedPassword = "$y$j9T$Kb6jGrk41hudTZpNjazf11$iw7fZXrewC6JxRaGPz7/gPXDZ.Z1VWsupvy81Hi1XiD";
+  updatedSysuserInitialHashedPassword = "$y$j9T$kUBVhgOdSjymSfwfRVja70$eqCwWzVsz0fI0Uc6JsdD2CYMCpfJcErqnIqva2JCi1D";
+
+  newNormaloHashedPassword = "$y$j9T$UFBMWbGjjVola0YE9YCcV/$jRSi5S6lzkcifbuqjMcyXLTwgOGm9BTQk/G/jYaxroC";
+in
+
+{
+
+  name = "userborn";
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+
+  nodes.machine = {
+    services.userborn.enable = true;
+
+    # Read this password file at runtime from outside the Nix store.
+    environment.etc."rootpw.secret".text = rootHashedPasswordFile;
+
+    users = {
+      users = {
+        root = {
+          # Override the empty root password set by the test instrumentation.
+          hashedPasswordFile = lib.mkForce "/etc/rootpw.secret";
+        };
+        normalo = {
+          isNormalUser = true;
+          password = normaloPassword;
+        };
+        sysuser = {
+          isSystemUser = true;
+          group = "sysusers";
+          initialHashedPassword = sysuserInitialHashedPassword;
+        };
+      };
+      groups = {
+        sysusers = { };
+      };
+    };
+
+    specialisation.new-generation.configuration = {
+      users = {
+        users = {
+          root = {
+            # Forcing this to null simulates removing the config value in a new
+            # generation.
+            hashedPasswordFile = lib.mkOverride 9 null;
+            hashedPassword = updatedRootHashedPassword;
+          };
+          normalo = {
+            hashedPassword = updatedNormaloHashedPassword;
+          };
+          sysuser = {
+            initialHashedPassword = lib.mkForce updatedSysuserInitialHashedPassword;
+          };
+          new-normalo = {
+            isNormalUser = true;
+            hashedPassword = newNormaloHashedPassword;
+          };
+        };
+        groups = {
+          new-group = { };
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("userborn.service")
+
+    with subtest("Correct mode on the password files"):
+      assert machine.succeed("stat -c '%a' /etc/passwd") == "644\n"
+      assert machine.succeed("stat -c '%a' /etc/group") == "644\n"
+      assert machine.succeed("stat -c '%a' /etc/shadow") == "0\n"
+
+    with subtest("root user has correct password"):
+      print(machine.succeed("getent passwd root"))
+      assert "${rootHashedPasswordFile}" in machine.succeed("getent shadow root"), "root user password is not correct"
+
+    with subtest("normalo user is created"):
+      print(machine.succeed("getent passwd normalo"))
+      assert 1000 <= int(machine.succeed("id --user normalo")), "normalo user doesn't have a normal UID"
+      assert machine.succeed("stat -c '%U' /home/normalo") == "normalo\n"
+
+    with subtest("system user is created with correct password"):
+      print(machine.succeed("getent passwd sysuser"))
+      assert 1000 > int(machine.succeed("id --user sysuser")), "sysuser user doesn't have a system UID"
+      assert "${sysuserInitialHashedPassword}" in machine.succeed("getent shadow sysuser"), "system user password is not correct"
+
+    with subtest("sysusers group is created"):
+      print(machine.succeed("getent group sysusers"))
+
+
+    machine.succeed("/run/current-system/specialisation/new-generation/bin/switch-to-configuration switch")
+
+
+    with subtest("root user password is updated"):
+      print(machine.succeed("getent passwd root"))
+      assert "${updatedRootHashedPassword}" in machine.succeed("getent shadow root"), "root user password is not updated"
+
+    with subtest("normalo user password is updated"):
+      print(machine.succeed("getent passwd normalo"))
+      assert "${updatedNormaloHashedPassword}" in machine.succeed("getent shadow normalo"), "normalo user password is not updated"
+
+    with subtest("system user password is NOT updated"):
+      print(machine.succeed("getent passwd sysuser"))
+      assert "${sysuserInitialHashedPassword}" in machine.succeed("getent shadow sysuser"), "sysuser user password is not updated"
+
+    with subtest("new-normalo user is created after switching to new generation"):
+      print(machine.succeed("getent passwd new-normalo"))
+      assert 1000 <= int(machine.succeed("id --user new-normalo")), "new-normalo user doesn't have a normal UID"
+      assert machine.succeed("stat -c '%U' /home/new-normalo") == "new-normalo\n"
+      assert "${newNormaloHashedPassword}" in machine.succeed("getent shadow new-normalo"), "new-normalo user password is not correct"
+
+    with subtest("new-group group is created after switching to new generation"):
+      print(machine.succeed("getent group new-group"))
+  '';
+}

From aded1bccf23a3f52c325479706c79e55c50979f3 Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Sun, 11 Aug 2024 13:38:29 +0200
Subject: [PATCH 22/53] nixos/profiles/perlless: systemd-sysusers -> userborn

---
 nixos/modules/profiles/perlless.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/profiles/perlless.nix b/nixos/modules/profiles/perlless.nix
index f34c3d2d210b..cb98895743d5 100644
--- a/nixos/modules/profiles/perlless.nix
+++ b/nixos/modules/profiles/perlless.nix
@@ -12,7 +12,7 @@
   # Remove perl from activation
   boot.initrd.systemd.enable = lib.mkDefault true;
   system.etc.overlay.enable = lib.mkDefault true;
-  systemd.sysusers.enable = lib.mkDefault true;
+  services.userborn.enable = lib.mkDefault true;
 
   # Random perl remnants
   system.disableInstallerTools = lib.mkDefault true;

From f20c7afd65429b3d75da7cc8116bfd9a51ef46a8 Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Sun, 11 Aug 2024 13:28:49 +0200
Subject: [PATCH 23/53] nixos/doc: add userborn section

---
 .../manual/configuration/user-mgmt.chapter.md | 43 +++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/nixos/doc/manual/configuration/user-mgmt.chapter.md b/nixos/doc/manual/configuration/user-mgmt.chapter.md
index 7d83121d41e0..2edca78f4a38 100644
--- a/nixos/doc/manual/configuration/user-mgmt.chapter.md
+++ b/nixos/doc/manual/configuration/user-mgmt.chapter.md
@@ -100,6 +100,9 @@ modified using `usermod`. Unix groups can be managed using `groupadd`,
 
 ::: {.note}
 This is experimental.
+
+Please consider using [Userborn](#sec-userborn) over systemd-sysusers as it's
+more feature complete.
 :::
 
 Instead of using a custom perl script to create users and groups, you can use
@@ -112,3 +115,43 @@ systemd-sysusers:
 ```
 
 The primary benefit of this is to remove a dependency on perl.
+
+## Manage users and groups with `userborn` {#sec-userborn}
+
+::: {.note}
+This is experimental.
+:::
+
+Like systemd-sysusers, Userborn adoesn't depend on Perl but offers some more
+advantages over systemd-sysusers:
+
+1. It can create "normal" users (with a GID >= 1000).
+2. It can update some information about users. Most notably it can update their
+   passwords.
+3. It will warn when users use an insecure or unsupported password hashing
+   scheme.
+
+Userborn is the recommended way to manage users if you don't want to rely on
+the Perl script. It aims to eventually replace the Perl script by default.
+
+You can enable Userborn via:
+
+```nix
+services.userborn.enable = true;
+```
+
+You can configure Userborn to store the password files
+(`/etc/{group,passwd,shadow}`) outside of `/etc` and symlink them from this
+location to `/etc`:
+
+```nix
+services.userborn.passwordFilesLocation = "/persistent/etc";
+```
+
+This is useful when you store `/etc` on a `tmpfs` or if `/etc` is immutable
+(e.g. when using `system.etc.overlay.mutable = false;`). In the latter case the
+original files are by default stored in `/var/lib/nixos`.
+
+Userborn implements immutable users by re-mounting the password files
+read-only. This means that unlike when using the Perl script, trying to add a
+new user (e.g. via `useradd`) will fail right away.

From a3b027380d0feff4d5e9355ad11a82153a4ee034 Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Mon, 26 Aug 2024 13:52:30 +0200
Subject: [PATCH 24/53] nixos/doc: add release notes for userborn

---
 nixos/doc/manual/release-notes/rl-2411.section.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index 4ca399136920..e31556c71fd3 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -41,6 +41,13 @@
 
 - [Quickwit](https://quickwit.io), sub-second search & analytics engine on cloud storage. Available as [services.quickwit](options.html#opt-services.quickwit).
 
+- [Userborn](https://github.com/nikstur/userborn), a service for declarative
+  user management. This can be used instead of the `update-users-groups.pl`
+  Perl script and instead of systemd-sysusers. To achieve a system without
+  Perl, this is the now recommended tool over systemd-sysusers because it can
+  alos create normal users and change passwords. Available as
+  [services.userborn](#opt-services.userborn.enable)
+
 - [Flood](https://flood.js.org/), a beautiful WebUI for various torrent clients. Available as [services.flood](options.html#opt-services.flood).
 
 - [QGroundControl], a ground station support and configuration manager for the PX4 and APM Flight Stacks. Available as [programs.qgroundcontrol](options.html#opt-programs.qgroundcontrol.enable).

From 80a2825733fc9fe30a5634370dd60013ef0c2525 Mon Sep 17 00:00:00 2001
From: lelgenio <lelgenio@lelgenio.com>
Date: Thu, 22 Aug 2024 19:35:06 -0300
Subject: [PATCH 25/53] npmHooks.npmInstallHook: extract
 npmInstall{Manuals,Executables}

---
 .../node/build-npm-package/hooks/default.nix  |  5 +++-
 .../hooks/npm-install-hook.sh                 | 26 ++----------------
 .../no/nodejsInstallExecutables/hook.sh       | 27 +++++++++++++++++++
 .../no/nodejsInstallExecutables/package.nix   | 19 +++++++++++++
 pkgs/by-name/no/nodejsInstallManuals/hook.sh  | 14 ++++++++++
 .../no/nodejsInstallManuals/package.nix       | 13 +++++++++
 6 files changed, 79 insertions(+), 25 deletions(-)
 create mode 100644 pkgs/by-name/no/nodejsInstallExecutables/hook.sh
 create mode 100644 pkgs/by-name/no/nodejsInstallExecutables/package.nix
 create mode 100644 pkgs/by-name/no/nodejsInstallManuals/hook.sh
 create mode 100644 pkgs/by-name/no/nodejsInstallManuals/package.nix

diff --git a/pkgs/build-support/node/build-npm-package/hooks/default.nix b/pkgs/build-support/node/build-npm-package/hooks/default.nix
index 36f0319e3d23..7a4fed30f5d5 100644
--- a/pkgs/build-support/node/build-npm-package/hooks/default.nix
+++ b/pkgs/build-support/node/build-npm-package/hooks/default.nix
@@ -7,6 +7,8 @@
 , prefetch-npm-deps
 , diffutils
 , installShellFiles
+, nodejsInstallManuals
+, nodejsInstallExecutables
 }:
 
 {
@@ -39,9 +41,10 @@
       propagatedBuildInputs = [
         installShellFiles
         makeWrapper
+        nodejsInstallManuals
+        nodejsInstallExecutables
       ];
       substitutions = {
-        hostNode = "${nodejs}/bin/node";
         jq = "${jq}/bin/jq";
       };
     } ./npm-install-hook.sh;
diff --git a/pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh b/pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh
index 750ed421789f..d495caf2d048 100644
--- a/pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh
+++ b/pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh
@@ -14,31 +14,9 @@ npmInstallHook() {
         cp "${npmWorkspace-.}/$file" "$dest"
     done < <(@jq@ --raw-output '.[0].files | map(.path | select(. | startswith("node_modules/") | not)) | join("\n")' <<< "$(npm_config_cache="$HOME/.npm" npm pack --json --dry-run --loglevel=warn --no-foreground-scripts ${npmWorkspace+--workspace=$npmWorkspace} $npmPackFlags "${npmPackFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}")")
 
-    # Based on code from Python's buildPythonPackage wrap.sh script, for
-    # supporting both the case when makeWrapperArgs is an array and a
-    # IFS-separated string.
-    #
-    # TODO: remove the string branch when __structuredAttrs are used.
-    if [[ "${makeWrapperArgs+defined}" == "defined" && "$(declare -p makeWrapperArgs)" =~ ^'declare -a makeWrapperArgs=' ]]; then
-        local -a user_args=("${makeWrapperArgs[@]}")
-    else
-        local -a user_args="(${makeWrapperArgs:-})"
-    fi
-    while IFS=" " read -ra bin; do
-        mkdir -p "$out/bin"
-        makeWrapper @hostNode@ "$out/bin/${bin[0]}" --add-flags "$packageOut/${bin[1]}" "${user_args[@]}"
-    done < <(@jq@ --raw-output '(.bin | type) as $typ | if $typ == "string" then
-        .name + " " + .bin
-        elif $typ == "object" then .bin | to_entries | map(.key + " " + .value) | join("\n")
-        elif $typ == "null" then empty
-        else "invalid type " + $typ | halt_error end' "${npmWorkspace-.}/package.json")
+    nodejsInstallExecutables "${npmWorkspace-.}/package.json"
 
-    while IFS= read -r man; do
-        installManPage "$packageOut/$man"
-    done < <(@jq@ --raw-output '(.man | type) as $typ | if $typ == "string" then .man
-        elif $typ == "list" then .man | join("\n")
-        elif $typ == "null" then empty
-        else "invalid type " + $typ | halt_error end' "${npmWorkspace-.}/package.json")
+    nodejsInstallManuals "${npmWorkspace-.}/package.json"
 
     local -r nodeModulesPath="$packageOut/node_modules"
 
diff --git a/pkgs/by-name/no/nodejsInstallExecutables/hook.sh b/pkgs/by-name/no/nodejsInstallExecutables/hook.sh
new file mode 100644
index 000000000000..ab2a8e372da4
--- /dev/null
+++ b/pkgs/by-name/no/nodejsInstallExecutables/hook.sh
@@ -0,0 +1,27 @@
+# shellcheck shell=bash
+
+nodejsInstallExecutables() {
+    local -r packageJson="${1-./package.json}"
+
+    local -r packageOut="$out/lib/node_modules/$(@jq@ --raw-output '.name' package.json)"
+
+    # Based on code from Python's buildPythonPackage wrap.sh script, for
+    # supporting both the case when makeWrapperArgs is an array and a
+    # IFS-separated string.
+    #
+    # TODO: remove the string branch when __structuredAttrs are used.
+    if [[ "${makeWrapperArgs+defined}" == "defined" && "$(declare -p makeWrapperArgs)" =~ ^'declare -a makeWrapperArgs=' ]]; then
+        local -a user_args=("${makeWrapperArgs[@]}")
+    else
+        local -a user_args="(${makeWrapperArgs:-})"
+    fi
+
+    while IFS=" " read -ra bin; do
+        mkdir -p "$out/bin"
+        makeWrapper @hostNode@ "$out/bin/${bin[0]}" --add-flags "$packageOut/${bin[1]}" "${user_args[@]}"
+    done < <(@jq@ --raw-output '(.bin | type) as $typ | if $typ == "string" then
+        .name + " " + .bin
+        elif $typ == "object" then .bin | to_entries | map(.key + " " + .value) | join("\n")
+        elif $typ == "null" then empty
+        else "invalid type " + $typ | halt_error end' "$packageJson")
+}
diff --git a/pkgs/by-name/no/nodejsInstallExecutables/package.nix b/pkgs/by-name/no/nodejsInstallExecutables/package.nix
new file mode 100644
index 000000000000..8403cf8881d6
--- /dev/null
+++ b/pkgs/by-name/no/nodejsInstallExecutables/package.nix
@@ -0,0 +1,19 @@
+{
+  makeSetupHook,
+  installShellFiles,
+  makeWrapper,
+  nodejs,
+  jq,
+}:
+
+makeSetupHook {
+  name = "nodejs-install-executables";
+  propagatedBuildInputs = [
+    installShellFiles
+    makeWrapper
+  ];
+  substitutions = {
+    hostNode = "${nodejs}/bin/node";
+    jq = "${jq}/bin/jq";
+  };
+} ./hook.sh
diff --git a/pkgs/by-name/no/nodejsInstallManuals/hook.sh b/pkgs/by-name/no/nodejsInstallManuals/hook.sh
new file mode 100644
index 000000000000..f0ff209c6226
--- /dev/null
+++ b/pkgs/by-name/no/nodejsInstallManuals/hook.sh
@@ -0,0 +1,14 @@
+# shellcheck shell=bash
+
+nodejsInstallManuals() {
+    local -r packageJson="${1-./package.json}"
+
+    local -r packageOut="$out/lib/node_modules/$(@jq@ --raw-output '.name' package.json)"
+
+    while IFS= read -r man; do
+        installManPage "$packageOut/$man"
+    done < <(@jq@ --raw-output '(.man | type) as $typ | if $typ == "string" then .man
+        elif $typ == "list" then .man | join("\n")
+        elif $typ == "null" then empty
+        else "invalid type " + $typ | halt_error end' "$packageJson")
+}
diff --git a/pkgs/by-name/no/nodejsInstallManuals/package.nix b/pkgs/by-name/no/nodejsInstallManuals/package.nix
new file mode 100644
index 000000000000..9f74cf8538da
--- /dev/null
+++ b/pkgs/by-name/no/nodejsInstallManuals/package.nix
@@ -0,0 +1,13 @@
+{
+  makeSetupHook,
+  installShellFiles,
+  jq,
+}:
+
+makeSetupHook {
+  name = "nodejs-install-manuals";
+  propagatedBuildInputs = [ installShellFiles ];
+  substitutions = {
+    jq = "${jq}/bin/jq";
+  };
+} ./hook.sh

From 6b795fb19543762165a2af3b6e80dbccc796f201 Mon Sep 17 00:00:00 2001
From: Jan Likar <jan.likar@protonmail.com>
Date: Tue, 27 Aug 2024 20:26:55 +0200
Subject: [PATCH 26/53] maintainers: add janlikar

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 852735ac9696..5bab877e45b3 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -8655,6 +8655,12 @@
     github = "jankaifer";
     githubId = 12820484;
   };
+  janlikar = {
+    name = "Jan Likar";
+    email = "jan.likar@protonmail.com";
+    github = "janlikar";
+    githubId = 4228250;
+  };
   jansol = {
     email = "jan.solanti@paivola.fi";
     github = "jansol";

From 54cbd6b32ec60d88e183cf00071509ec732391a4 Mon Sep 17 00:00:00 2001
From: Jan Likar <jan.likar@protonmail.com>
Date: Tue, 27 Aug 2024 20:27:20 +0200
Subject: [PATCH 27/53] cargo-clone: add janlikar to maintainers

---
 pkgs/development/tools/rust/cargo-clone/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/rust/cargo-clone/default.nix b/pkgs/development/tools/rust/cargo-clone/default.nix
index 6a8f432ecab7..a275ce98ebc1 100644
--- a/pkgs/development/tools/rust/cargo-clone/default.nix
+++ b/pkgs/development/tools/rust/cargo-clone/default.nix
@@ -36,6 +36,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/janlikar/cargo-clone";
     changelog = "https://github.com/janlikar/cargo-clone/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ asl20 mit ];
-    maintainers = with maintainers; [ figsoda matthiasbeyer ];
+    maintainers = with maintainers; [ figsoda matthiasbeyer janlikar ];
   };
 }

From a6296a5e5e3c4e888d71dcf69ddb1cca3b2b1c01 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Wed, 28 Aug 2024 12:44:49 +0200
Subject: [PATCH 28/53] surrealdb: fix build

---
 pkgs/by-name/su/surrealdb/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/su/surrealdb/package.nix b/pkgs/by-name/su/surrealdb/package.nix
index 31623b5f16ef..5f4ec81470ec 100644
--- a/pkgs/by-name/su/surrealdb/package.nix
+++ b/pkgs/by-name/su/surrealdb/package.nix
@@ -25,8 +25,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-KtR+qU2Xys4NkEARZBbO8mTPa7EI9JplWvXdtuLt2vE=";
   };
 
-  patches = [
-      ./time.patch  # TODO: remove when https://github.com/surrealdb/surrealdb/pull/4565 merged
+  cargoPatches = [
+    ./time.patch # TODO: remove when https://github.com/surrealdb/surrealdb/pull/4565 merged
   ];
 
   cargoHash = "sha256-5qIIPdE6HYov5EIR4do+pMeZ1Lo3at39aKOP9scfMy8=";

From 967f64df385cc290d292dea5528a8aafcfecba67 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 29 Aug 2024 04:53:42 +0000
Subject: [PATCH 29/53] kubefirst: 2.4.17 -> 2.5.0

---
 pkgs/applications/networking/cluster/kubefirst/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/kubefirst/default.nix b/pkgs/applications/networking/cluster/kubefirst/default.nix
index 19c416d5e69b..d9ccd5d5148f 100644
--- a/pkgs/applications/networking/cluster/kubefirst/default.nix
+++ b/pkgs/applications/networking/cluster/kubefirst/default.nix
@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "kubefirst";
-  version = "2.4.17";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "kubefirst";
     repo = "kubefirst";
     rev = "refs/tags/v${version}";
-    hash = "sha256-wYPrQkoz1rivfnhku3Njj8e/rJc2GuT1HOPyNSada+o=";
+    hash = "sha256-1VadsiZZii6gI8vdTNfwmbBPuHcgPh4kWZ2jf/EkFKU=";
   };
 
-  vendorHash = "sha256-ymqBSNzgK79IYSZ+WR+0yi01008jIPaRJ7vnnxMDycY=";
+  vendorHash = "sha256-tOCVDp9oClfeBsyZ6gv6HoGPjZByoxxAceV/wxQeBSA=";
 
   ldflags = [
     "-s"

From 025f1566cd45765cef5d02c0d41aedddd0af13ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <mail@dotlambda.de>
Date: Thu, 29 Aug 2024 09:42:43 -0700
Subject: [PATCH 30/53] python312Packages.aeidon: modernize

---
 .../python-modules/aeidon/default.nix         | 47 ++++++++-----------
 1 file changed, 19 insertions(+), 28 deletions(-)

diff --git a/pkgs/development/python-modules/aeidon/default.nix b/pkgs/development/python-modules/aeidon/default.nix
index 744ece58293f..7438d3a74fe6 100644
--- a/pkgs/development/python-modules/aeidon/default.nix
+++ b/pkgs/development/python-modules/aeidon/default.nix
@@ -1,10 +1,8 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  gettext,
-  flake8,
-  isocodes,
+  fetchFromGitHub,
+  setuptools,
   pytestCheckHook,
   charset-normalizer,
 }:
@@ -12,35 +10,27 @@
 buildPythonPackage rec {
   pname = "aeidon";
   version = "1.15";
+  pyproject = true;
 
-  src = fetchPypi {
-    pname = "aeidon";
-    inherit version;
-    sha256 = "sha256-qGpGraRZFVaW1Jys24qvfPo5WDg7Q/fhvm44JH8ulVw=";
+  src = fetchFromGitHub {
+    owner = "otsaloma";
+    repo = "gaupol";
+    rev = "refs/tags/${version}";
+    hash = "sha256-lhNyeieeiBBm3rNDEU0BuWKeM6XYlOtv1voW8tR8cUM=";
   };
 
-  nativeBuildInputs = [
-    gettext
-    flake8
-  ];
-
-  dependencies = [ isocodes ];
-
-  installPhase = ''
-    runHook preInstall
-    python setup.py --without-gaupol install --prefix=$out
-    runHook postInstall
+  postPatch = ''
+    mv setup.py setup_gaupol.py
+    substituteInPlace setup-aeidon.py \
+      --replace "from setup import" "from setup_gaupol import"
+    mv setup-aeidon.py setup.py
   '';
 
-  nativeCheckInputs = [
-    pytestCheckHook
-    charset-normalizer
-  ];
+  build-system = [ setuptools ];
 
-  # Aeidon is looking in the wrong subdirectory for data
-  preCheck = ''
-    cp -r data aeidon/
-  '';
+  dependencies = [ charset-normalizer ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
 
   pytestFlagsArray = [ "aeidon/test" ];
 
@@ -52,9 +42,10 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "aeidon" ];
 
   meta = with lib; {
+    changelog = "https://github.com/otsaloma/gaupol/releases/tag/${version}";
     description = "Reading, writing and manipulationg text-based subtitle files";
     homepage = "https://github.com/otsaloma/gaupol";
-    license = licenses.gpl3Only;
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ erictapen ];
   };
 

From 246b26e3e29de7b6f748b8b0af56bff1cc12150f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 29 Aug 2024 17:32:40 +0000
Subject: [PATCH 31/53] python312Packages.gvm-tools: 24.7.0 -> 24.8.0

---
 pkgs/development/python-modules/gvm-tools/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/gvm-tools/default.nix b/pkgs/development/python-modules/gvm-tools/default.nix
index 860c7254b100..73184dcad346 100644
--- a/pkgs/development/python-modules/gvm-tools/default.nix
+++ b/pkgs/development/python-modules/gvm-tools/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "gvm-tools";
-  version = "24.7.0";
+  version = "24.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = "gvm-tools";
     rev = "refs/tags/v${version}";
-    hash = "sha256-m4wEAx2WyVIMi+xucqUCPr2PLxLo00haObjf+0swUdA=";
+    hash = "sha256-MwLwJyxKu4O0cEabBjcdhqtqW3uwgbyVlezZysUDYa4=";
   };
 
   __darwinAllowLocalNetworking = true;

From 23b3f9dfad28edcfdd85f131b15f440711926c6f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 29 Aug 2024 17:32:59 +0000
Subject: [PATCH 32/53] python312Packages.python-gvm: 24.7.0 -> 24.8.0

---
 pkgs/development/python-modules/python-gvm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-gvm/default.nix b/pkgs/development/python-modules/python-gvm/default.nix
index 223f43fbd5ff..763999be86ad 100644
--- a/pkgs/development/python-modules/python-gvm/default.nix
+++ b/pkgs/development/python-modules/python-gvm/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "python-gvm";
-  version = "24.7.0";
+  version = "24.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "greenbone";
     repo = "python-gvm";
     rev = "refs/tags/v${version}";
-    hash = "sha256-WsZxISvPw4uvRKv5CYpcLunAxvoCvVWTSp+m2QTEe0g=";
+    hash = "sha256-JyImC75Le6S2kQXSU/Ze4TNaitJSJ8LD9j/ny+xjoGA=";
   };
 
   build-system = [ poetry-core ];

From 2158b8b869fdda7eba8c3c8df768718002020e94 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 29 Aug 2024 18:48:04 +0000
Subject: [PATCH 33/53] stalwart-mail: 0.9.2 -> 0.9.3

---
 pkgs/by-name/st/stalwart-mail/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/st/stalwart-mail/package.nix b/pkgs/by-name/st/stalwart-mail/package.nix
index 6c697a494d34..02495cc49c72 100644
--- a/pkgs/by-name/st/stalwart-mail/package.nix
+++ b/pkgs/by-name/st/stalwart-mail/package.nix
@@ -25,7 +25,7 @@ let
   # See upstream issue for rocksdb 9.X support
   # https://github.com/stalwartlabs/mail-server/issues/407
   rocksdb = rocksdb_8_11;
-  version = "0.9.2";
+  version = "0.9.3";
 in
 rustPlatform.buildRustPackage {
   pname = "stalwart-mail";
@@ -35,11 +35,11 @@ rustPlatform.buildRustPackage {
     owner = "stalwartlabs";
     repo = "mail-server";
     rev = "refs/tags/v${version}";
-    hash = "sha256-8O+0yOdaHnc2vDLCPK7PIuR6IBeOmH9RNDo0uaw7EeU=";
+    hash = "sha256-XjHm9jBpBQcf1qaZJLDSSrPK9Nqi3olG0pMXHdNUjbg=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-ofF9eTXLVyFfrTnAj6rMYV3dMY613tjhKgoLs303CEA=";
+  cargoHash = "sha256-sFYvEKZVTS5v37CpIl/KjoOY0iWCHLgIJFUdht5SjJY=";
 
   patches = [
     # Remove "PermissionsStartOnly" from systemd service files,

From 4750b9e80e67d26eddeeb0aa50daf7a42ea75781 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 29 Aug 2024 21:05:48 +0000
Subject: [PATCH 34/53] yamlscript: 0.1.72 -> 0.1.73

---
 pkgs/by-name/ya/yamlscript/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ya/yamlscript/package.nix b/pkgs/by-name/ya/yamlscript/package.nix
index e9e221b946e7..14c9bbb5326d 100644
--- a/pkgs/by-name/ya/yamlscript/package.nix
+++ b/pkgs/by-name/ya/yamlscript/package.nix
@@ -2,11 +2,11 @@
 
 buildGraalvmNativeImage rec {
   pname = "yamlscript";
-  version = "0.1.72";
+  version = "0.1.73";
 
   src = fetchurl {
     url = "https://github.com/yaml/yamlscript/releases/download/${version}/yamlscript.cli-${version}-standalone.jar";
-    hash = "sha256-Qp2/Bifh+KXUjpcW/Lct6nGBv50TUEOGTjVPkXGbD54=";
+    hash = "sha256-FXw476RXIFnjnK8cz/Kxni4dZ58LJvevcxiotDO7+bQ=";
   };
 
   executable = "ys";

From 430ffc664a9dcf8a40ab889d589e5cada6c4717d Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Thu, 29 Aug 2024 18:05:19 -0600
Subject: [PATCH 35/53] linuxKernel.kernels.linux_zen: 6.10.5-zen1 ->
 6.10.7-zen1; linuxKernel.kernels.linux_lqx: 6.10.5-lqx1 -> 6.10.6-lqx1

---
 pkgs/os-specific/linux/kernel/zen-kernels.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 6c9d2da1e9db..246ab4f2d728 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -5,16 +5,16 @@ let
   variants = {
     # ./update-zen.py zen
     zen = {
-      version = "6.10.5"; #zen
+      version = "6.10.7"; #zen
       suffix = "zen1"; #zen
-      sha256 = "08ibz7560xsmlnrm8j13hxf8hjjcxfmnjdrwffqc81g9g6rvpqra"; #zen
+      sha256 = "1km3b7nad429hw7d8ff14zj1cg0fhh65ycrrwk4iaxj6rvafzsz1"; #zen
       isLqx = false;
     };
     # ./update-zen.py lqx
     lqx = {
-      version = "6.10.5"; #lqx
+      version = "6.10.6"; #lqx
       suffix = "lqx1"; #lqx
-      sha256 = "09rscj20j94qkmvk0hlpjm6v1n1ndnkv2vl035gsp5lwggws2jqm"; #lqx
+      sha256 = "0b1pqsssnxc69yhx2wai5xnj6cb9713z33m8xal25jjgx9z4v8kv"; #lqx
       isLqx = true;
     };
   };

From 0c594546c6a32733af97573668c5f54e8e3e8f8b Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Fri, 30 Aug 2024 12:04:24 +1000
Subject: [PATCH 36/53] nix-update: remove nixpkgs-fmt

---
 pkgs/by-name/ni/nix-update/package.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/by-name/ni/nix-update/package.nix b/pkgs/by-name/ni/nix-update/package.nix
index db47d4b5abd6..89b1d5c8e5d7 100644
--- a/pkgs/by-name/ni/nix-update/package.nix
+++ b/pkgs/by-name/ni/nix-update/package.nix
@@ -3,7 +3,6 @@
 , fetchFromGitHub
 , nix
 , nix-prefetch-git
-, nixpkgs-fmt
 , nixpkgs-review
 }:
 
@@ -24,7 +23,7 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   makeWrapperArgs = [
-    "--prefix" "PATH" ":" (lib.makeBinPath [ nix nix-prefetch-git nixpkgs-fmt nixpkgs-review ])
+    "--prefix" "PATH" ":" (lib.makeBinPath [ nix nix-prefetch-git nixpkgs-review ])
   ];
 
   checkPhase = ''

From 20d0abb80b61c102e56ff905fa3ce2a9a867d8b6 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Fri, 30 Aug 2024 12:08:06 +1000
Subject: [PATCH 37/53] nix-update: remove maintainer

---
 pkgs/by-name/ni/nix-update/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ni/nix-update/package.nix b/pkgs/by-name/ni/nix-update/package.nix
index 89b1d5c8e5d7..ecd378884767 100644
--- a/pkgs/by-name/ni/nix-update/package.nix
+++ b/pkgs/by-name/ni/nix-update/package.nix
@@ -35,7 +35,7 @@ python3.pkgs.buildPythonApplication rec {
     inherit (src.meta) homepage;
     changelog = "https://github.com/Mic92/nix-update/releases/tag/${version}";
     license = licenses.mit;
-    maintainers = with maintainers; [ figsoda mic92 zowoq ];
+    maintainers = with maintainers; [ figsoda mic92 ];
     mainProgram = "nix-update";
     platforms = platforms.all;
   };

From aa904172a065f5d88a6110205017db2e78a19d28 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 30 Aug 2024 02:09:52 +0000
Subject: [PATCH 38/53] optimism: 1.9.0 -> 1.9.1

---
 pkgs/applications/blockchains/optimism/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/blockchains/optimism/default.nix b/pkgs/applications/blockchains/optimism/default.nix
index 14c763e27c23..945ef865f964 100644
--- a/pkgs/applications/blockchains/optimism/default.nix
+++ b/pkgs/applications/blockchains/optimism/default.nix
@@ -6,19 +6,19 @@
 
 buildGoModule rec {
   pname = "optimism";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "ethereum-optimism";
     repo = "optimism";
     rev = "op-node/v${version}";
-    hash = "sha256-TIxA+Dyxdwm3Q8U6xh7x7hBPNXmH+vVDK2lAaRFKSN0=";
+    hash = "sha256-PlwpN8P1t0NNIU+Ys50dIXmfUQFIY9e1tLABiVK0JQo=";
     fetchSubmodules = true;
   };
 
   subPackages = [ "op-node/cmd" "op-proposer/cmd" "op-batcher/cmd" ];
 
-  vendorHash = "sha256-xoflPeUeFlbMBUSas+dmBOCFOOvrBHEvYWEk7QkNW14=";
+  vendorHash = "sha256-n1uJ/dkEjjsTdmL7TeHU4PKnBhiRrqCNtcGxK70Q0c4=";
 
   buildInputs = [
     libpcap

From 5982a2768719537b2b631e3122ae8685cd032345 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 30 Aug 2024 02:20:10 +0000
Subject: [PATCH 39/53] python312Packages.craft-platforms: 0.1.1 -> 0.2.0

---
 pkgs/development/python-modules/craft-platforms/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/craft-platforms/default.nix b/pkgs/development/python-modules/craft-platforms/default.nix
index 3cd303990859..f183449961d3 100644
--- a/pkgs/development/python-modules/craft-platforms/default.nix
+++ b/pkgs/development/python-modules/craft-platforms/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "craft-platforms";
-  version = "0.1.1";
+  version = "0.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "canonical";
     repo = "craft-platforms";
     rev = "refs/tags/${version}";
-    hash = "sha256-KzskmSw7NsH1CAYjPf2281Ob71Jd6AhWxtp5tR3IqyU=";
+    hash = "sha256-chCPuncy+//Y5iohTh0d8qRNaEno6Sqze2Zoas3uwPQ=";
   };
 
   postPatch = ''

From e6bc981b083569c7ba1b52e21b0287e34cc07f34 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 30 Aug 2024 03:35:29 +0000
Subject: [PATCH 40/53] python312Packages.lib4sbom: 0.7.3 -> 0.7.4

---
 pkgs/development/python-modules/lib4sbom/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/lib4sbom/default.nix b/pkgs/development/python-modules/lib4sbom/default.nix
index 3dc8f0c4c236..dbf4d5a5025f 100644
--- a/pkgs/development/python-modules/lib4sbom/default.nix
+++ b/pkgs/development/python-modules/lib4sbom/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "lib4sbom";
-  version = "0.7.3";
+  version = "0.7.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "anthonyharrison";
     repo = "lib4sbom";
     rev = "refs/tags/v${version}";
-    hash = "sha256-RuIvhlLnWf/ayU6tjpHYKvBFqU8ojPwJK/pDIdLrD2s=";
+    hash = "sha256-Uqv6E9qMJRsfYICVAiZEQGlG/0w8aECuh8wMa85FnlE=";
   };
 
   build-system = [ setuptools ];

From 75101db5f8fd6a800507c6d52d930830d8382bc5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 30 Aug 2024 04:02:27 +0000
Subject: [PATCH 41/53] python312Packages.model-bakery: 1.19.4 -> 1.19.5

---
 pkgs/development/python-modules/model-bakery/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/model-bakery/default.nix b/pkgs/development/python-modules/model-bakery/default.nix
index 0b6c3f49443c..464b2920a799 100644
--- a/pkgs/development/python-modules/model-bakery/default.nix
+++ b/pkgs/development/python-modules/model-bakery/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "model-bakery";
-  version = "1.19.4";
+  version = "1.19.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "model-bakers";
     repo = "model_bakery";
     rev = "refs/tags/${version}";
-    hash = "sha256-Jok5fQ8z9/v6n482yYA06ugC+4SSMuV7fmt1cdv3/dg=";
+    hash = "sha256-hOXE3mddGmRRgO9qAlj3bnmco8QTg2rD0sgui3J9pp8=";
   };
 
   build-system = [ hatchling ];

From 4c5d04c5f9c1384c878976e6fa6faf4283ec7fef Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Fri, 30 Aug 2024 08:05:52 +0200
Subject: [PATCH 42/53] hatch: skip failing test

---
 pkgs/by-name/ha/hatch/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/ha/hatch/package.nix b/pkgs/by-name/ha/hatch/package.nix
index 141fb9a51ec6..5ae22d698f21 100644
--- a/pkgs/by-name/ha/hatch/package.nix
+++ b/pkgs/by-name/ha/hatch/package.nix
@@ -96,6 +96,9 @@ python3Packages.buildPythonApplication rec {
       "test_uv_env"
       "test_pyenv"
       "test_pypirc"
+      # Relies on FHS
+      # Could not read ELF interpreter from any of the following paths: /bin/sh, /usr/bin/env, /bin/dash, /bin/ls
+      "test_new_selected_python"
     ]
     ++ lib.optionals stdenv.isDarwin [
       # https://github.com/NixOS/nixpkgs/issues/209358

From 6f88a5d09ce47c25138fe9e831c0c9259562eade Mon Sep 17 00:00:00 2001
From: Akhil Reddimalla <akhilreddimalla@gmail.com>
Date: Fri, 30 Aug 2024 00:30:34 -0400
Subject: [PATCH 43/53] uv: 0.3.5 -> 0.4.0

https://github.com/astral-sh/uv/releases/tag/0.4.0
---
 pkgs/by-name/uv/uv/Cargo.lock  | 44 +++-------------------------------
 pkgs/by-name/uv/uv/package.nix |  4 ++--
 2 files changed, 5 insertions(+), 43 deletions(-)

diff --git a/pkgs/by-name/uv/uv/Cargo.lock b/pkgs/by-name/uv/uv/Cargo.lock
index 12b4b0f77e29..f247509778bc 100644
--- a/pkgs/by-name/uv/uv/Cargo.lock
+++ b/pkgs/by-name/uv/uv/Cargo.lock
@@ -43,21 +43,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "alloc-no-stdlib"
-version = "2.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3"
-
-[[package]]
-name = "alloc-stdlib"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94fb8275041c72129eb51b7d0322c29b8387a0386127718b096429201a5d6ece"
-dependencies = [
- "alloc-no-stdlib",
-]
-
 [[package]]
 name = "android-tzdata"
 version = "0.1.1"
@@ -211,7 +196,6 @@ version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fec134f64e2bc57411226dfc4e52dec859ddfc7e711fc5e07b612584f000e4aa"
 dependencies = [
- "brotli",
  "bzip2",
  "flate2",
  "futures-core",
@@ -461,27 +445,6 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "510a90332002c1af3317ef6b712f0dab697f30bbe809b86965eac2923c0bca8e"
 
-[[package]]
-name = "brotli"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74f7971dbd9326d58187408ab83117d8ac1bb9c17b085fdacd1cf2f598719b6b"
-dependencies = [
- "alloc-no-stdlib",
- "alloc-stdlib",
- "brotli-decompressor",
-]
-
-[[package]]
-name = "brotli-decompressor"
-version = "4.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a45bd2e4095a8b518033b128020dd4a55aab1c0a381ba4404a472630f4bc362"
-dependencies = [
- "alloc-no-stdlib",
- "alloc-stdlib",
-]
-
 [[package]]
 name = "bstr"
 version = "1.10.0"
@@ -4529,7 +4492,7 @@ checksum = "81dfa00651efa65069b0b6b651f4aaa31ba9e3c3ce0137aaad053604ee7e0314"
 
 [[package]]
 name = "uv"
-version = "0.3.5"
+version = "0.4.0"
 dependencies = [
  "anstream",
  "anyhow",
@@ -4780,7 +4743,6 @@ dependencies = [
  "uv-auth",
  "uv-cache",
  "uv-normalize",
- "uv-workspace",
 ]
 
 [[package]]
@@ -5080,7 +5042,7 @@ dependencies = [
  "uv-state",
  "uv-warnings",
  "which",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
  "winsafe 0.0.22",
 ]
 
@@ -5284,7 +5246,7 @@ dependencies = [
 
 [[package]]
 name = "uv-version"
-version = "0.3.5"
+version = "0.4.0"
 
 [[package]]
 name = "uv-virtualenv"
diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix
index e15660f5b3a4..977cb057fe3b 100644
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -16,14 +16,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "uv";
-  version = "0.3.5";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     rev = "refs/tags/${version}";
-    hash = "sha256-D/BCxA7GOEu26xDkMmchXAMFB1pDewYSiOrNj2oSTyE=";
+    hash = "sha256-JEGcX4dT/cVLb07n2Y0nai17jW0tXpV18qaYVnoEpew=";
   };
 
   cargoDeps = rustPlatform.importCargoLock {

From dce00c0b4231c8347f9ffefb21baad47d361d811 Mon Sep 17 00:00:00 2001
From: Drewry Pope <drewrypope@gmail.com>
Date: Fri, 30 Aug 2024 02:54:08 -0500
Subject: [PATCH 44/53] taskwarrior:  fix typo  upstram=>upstream (#338319)

typo:  upstram=>upstream
---
 pkgs/top-level/aliases.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 1e5bf39be48d..886f5a7dc38e 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1467,7 +1467,7 @@ mapAliases ({
 
   tabula = throw "tabula has been removed from nixpkgs, as it was broken"; # Added 2024-07-15
   tangogps = foxtrotgps; # Added 2020-01-26
-  taskwarrior = lib.warn "taskwarrior was replaced by taskwarrior3, which requires manual transition from taskwarrior 2.6, read upstram's docs: https://taskwarrior.org/docs/upgrade-3/" taskwarrior2;
+  taskwarrior = lib.warn "taskwarrior was replaced by taskwarrior3, which requires manual transition from taskwarrior 2.6, read upstream's docs: https://taskwarrior.org/docs/upgrade-3/" taskwarrior2;
   taplo-cli = taplo; # Added 2022-07-30
   taplo-lsp = taplo; # Added 2022-07-30
   taro = taproot-assets; # Added 2023-07-04

From df05ee79ea51f82c3d1b8bd4d4d6bd01d6b69feb Mon Sep 17 00:00:00 2001
From: Peter Hoeg <peter@hoeg.com>
Date: Thu, 29 Aug 2024 16:37:43 +0200
Subject: [PATCH 45/53] compsize: fix build

---
 pkgs/os-specific/linux/compsize/default.nix | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/compsize/default.nix b/pkgs/os-specific/linux/compsize/default.nix
index 441108b0e54f..a1175df20629 100644
--- a/pkgs/os-specific/linux/compsize/default.nix
+++ b/pkgs/os-specific/linux/compsize/default.nix
@@ -1,5 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, btrfs-progs }:
+{ lib, stdenv, fetchFromGitHub, fetchurl, btrfs-progs }:
 
+let
+  # https://github.com/kilobyte/compsize/issues/52
+  btrfs-progs' = btrfs-progs.overrideAttrs (old: rec {
+    pname = "btrfs-progs";
+    version = "6.10";
+    src = fetchurl {
+      url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
+      hash = "sha256-M4KoTj/P4f/eoHphqz9OhmZdOPo18fNFSNXfhnQj4N8=";
+    };
+  });
+
+in
 stdenv.mkDerivation rec {
   pname = "compsize";
   version = "1.5";
@@ -11,7 +23,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-OX41ChtHX36lVRL7O2gH21Dfw6GPPEClD+yafR/PFm8=";
   };
 
-  buildInputs = [ btrfs-progs ];
+  buildInputs = [ btrfs-progs' ];
 
   installFlags = [
     "PREFIX=${placeholder "out"}"

From 914f69f0a5520c4c743ac048547f41c711131d8e Mon Sep 17 00:00:00 2001
From: Peter Hoeg <peter@hoeg.com>
Date: Fri, 30 Aug 2024 10:20:59 +0200
Subject: [PATCH 46/53] kdePackages.konsole: add mainProgram

---
 pkgs/kde/gear/konsole/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/kde/gear/konsole/default.nix b/pkgs/kde/gear/konsole/default.nix
index 8cd29b8a4f91..65a94bb19096 100644
--- a/pkgs/kde/gear/konsole/default.nix
+++ b/pkgs/kde/gear/konsole/default.nix
@@ -7,4 +7,6 @@ mkKdeDerivation {
   pname = "konsole";
 
   extraBuildInputs = [qt5compat qtmultimedia];
+
+  meta.mainProgram = "konsole";
 }

From 2243f4315d2f27e0e6bc7c38df234aa097d99e37 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 30 Aug 2024 08:53:30 +0000
Subject: [PATCH 47/53] qbittorrent-enhanced: 4.6.5.10 -> 4.6.6.10

---
 pkgs/by-name/qb/qbittorrent-enhanced/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/qb/qbittorrent-enhanced/package.nix b/pkgs/by-name/qb/qbittorrent-enhanced/package.nix
index a86b62968423..261b729d4922 100644
--- a/pkgs/by-name/qb/qbittorrent-enhanced/package.nix
+++ b/pkgs/by-name/qb/qbittorrent-enhanced/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qbittorrent-enhanced";
-  version = "4.6.5.10";
+  version = "4.6.6.10";
 
   src = fetchFromGitHub {
     owner = "c0re100";
     repo = "qBittorrent-Enhanced-Edition";
     rev = "release-${version}";
-    hash = "sha256-Yy0DUTz1lWkseh9x1xnHJCI89BKqi/D7zUn/S+qC+kM=";
+    hash = "sha256-mmM/1eU8FTWAciq2rh7fRa96fOkovMk4ScoehnqHdIQ=";
   };
 
   nativeBuildInputs = [

From 173253179d2c92ec4bfe74933d7f611cc9bad007 Mon Sep 17 00:00:00 2001
From: embr <git@liclac.eu>
Date: Fri, 30 Aug 2024 12:01:56 +0200
Subject: [PATCH 48/53] imhex: 1.35.3 -> 1.35.4

---
 pkgs/by-name/im/imhex/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/im/imhex/package.nix b/pkgs/by-name/im/imhex/package.nix
index a1b55f16899d..55283031e79d 100644
--- a/pkgs/by-name/im/imhex/package.nix
+++ b/pkgs/by-name/im/imhex/package.nix
@@ -25,15 +25,15 @@
 }:
 
 let
-  version = "1.35.3";
-  patterns_version = "1.35.3";
+  version = "1.35.4";
+  patterns_version = "1.35.4";
 
   patterns_src = fetchFromGitHub {
     name = "ImHex-Patterns-source-${patterns_version}";
     owner = "WerWolv";
     repo = "ImHex-Patterns";
     rev = "ImHex-v${patterns_version}";
-    hash = "sha256-h86qoFMSP9ehsXJXOccUK9Mfqe+DVObfSRT4TCtK0rY=";
+    hash = "sha256-7ch2KXkbkdRAvo3HyErWcth3kG4bzYvp9I5GZSsb/BQ=";
   };
 
 in
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     owner = "WerWolv";
     repo = "ImHex";
     rev = "refs/tags/v${version}";
-    hash = "sha256-8vhOOHfg4D9B9yYgnGZBpcjAjuL4M4oHHax9ad5PJtA=";
+    hash = "sha256-6QpmFkSMQpGlEzo7BHZn20c+q8CTDUB4yO87wMU5JT4=";
   };
 
   nativeBuildInputs = [

From a4ad12ca52cac49a1da37bf89f30a6d49e5b49fe Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Fri, 23 Aug 2024 13:00:51 +0200
Subject: [PATCH 49/53] =?UTF-8?q?ocamlPackages.multicore-magic:=C2=A0init?=
 =?UTF-8?q?=20at=202.3.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../ocaml-modules/multicore-magic/default.nix | 24 +++++++++++++++++++
 pkgs/top-level/ocaml-packages.nix             |  2 ++
 2 files changed, 26 insertions(+)
 create mode 100644 pkgs/development/ocaml-modules/multicore-magic/default.nix

diff --git a/pkgs/development/ocaml-modules/multicore-magic/default.nix b/pkgs/development/ocaml-modules/multicore-magic/default.nix
new file mode 100644
index 000000000000..3082eece19cf
--- /dev/null
+++ b/pkgs/development/ocaml-modules/multicore-magic/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildDunePackage, fetchurl
+, alcotest, domain_shims
+}:
+
+buildDunePackage rec {
+  pname = "multicore-magic";
+  version = "2.3.0";
+
+  src = fetchurl {
+    url = "https://github.com/ocaml-multicore/multicore-magic/releases/download/${version}/multicore-magic-${version}.tbz";
+    hash = "sha256-r50UqLOd2DoTz0CEXHpJMHX0fty+mGiAKTdtykgnzu4=";
+  };
+
+  doCheck = true;
+
+  checkInputs = [ alcotest domain_shims ];
+
+  meta = {
+    description = "Low-level multicore utilities for OCaml";
+    license = lib.licenses.isc;
+    homepage = "https://github.com/ocaml-multicore/multicore-magic";
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+}
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 8fb8986dd9b0..d550e02e42df 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1199,6 +1199,8 @@ let
 
     mtime =  callPackage ../development/ocaml-modules/mtime { };
 
+    multicore-magic =  callPackage ../development/ocaml-modules/multicore-magic { };
+
     multipart-form-data =  callPackage ../development/ocaml-modules/multipart-form-data { };
 
     mustache =  callPackage ../development/ocaml-modules/mustache { };

From 5b297f7871ad43bccc7b4e0aba9b26afe86b477a Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Fri, 23 Aug 2024 13:00:55 +0200
Subject: [PATCH 50/53] =?UTF-8?q?ocamlPackages.backoff:=C2=A0init=20at=200?=
 =?UTF-8?q?.1.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../ocaml-modules/backoff/default.nix         | 24 +++++++++++++++++++
 pkgs/top-level/ocaml-packages.nix             |  2 ++
 2 files changed, 26 insertions(+)
 create mode 100644 pkgs/development/ocaml-modules/backoff/default.nix

diff --git a/pkgs/development/ocaml-modules/backoff/default.nix b/pkgs/development/ocaml-modules/backoff/default.nix
new file mode 100644
index 000000000000..5f8f7a12d79b
--- /dev/null
+++ b/pkgs/development/ocaml-modules/backoff/default.nix
@@ -0,0 +1,24 @@
+{ lib, buildDunePackage, fetchurl, alcotest}:
+
+buildDunePackage rec {
+  pname = "backoff";
+  version = "0.1.0";
+
+  src = fetchurl {
+    url = "https://github.com/ocaml-multicore/backoff/releases/download/${version}/backoff-${version}.tbz";
+    hash = "sha256-EaSseCKekNE03gaNiqh5Y11r8TF9XulR9AZboPWMIwA=";
+  };
+
+  doCheck = true;
+
+  checkInputs = [ alcotest ];
+
+  meta = {
+    description = "Exponential backoff mechanism for OCaml";
+    homepage = "https://github.com/ocaml-multicore/backoff";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+
+  minimalOCamlVersion = "4.13";
+}
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index d550e02e42df..d7509a7efa9f 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -64,6 +64,8 @@ let
 
     b0 = callPackage ../development/ocaml-modules/b0 { };
 
+    backoff = callPackage ../development/ocaml-modules/backoff { };
+
     bap = janeStreet_0_15.bap;
 
     base64 = callPackage ../development/ocaml-modules/base64 { };

From 36820f5d58a84cd5f83b46e5da5c548360d1bcbf Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Fri, 23 Aug 2024 13:00:59 +0200
Subject: [PATCH 51/53] ocamlPackages.multicore-bench: init at 0.1.4

---
 .../ocaml-modules/multicore-bench/default.nix | 22 +++++++++++++++++++
 pkgs/top-level/ocaml-packages.nix             |  2 ++
 2 files changed, 24 insertions(+)
 create mode 100644 pkgs/development/ocaml-modules/multicore-bench/default.nix

diff --git a/pkgs/development/ocaml-modules/multicore-bench/default.nix b/pkgs/development/ocaml-modules/multicore-bench/default.nix
new file mode 100644
index 000000000000..5e1d2275e5b6
--- /dev/null
+++ b/pkgs/development/ocaml-modules/multicore-bench/default.nix
@@ -0,0 +1,22 @@
+{ lib, buildDunePackage, fetchurl
+, domain-local-await, mtime, multicore-magic, yojson
+}:
+
+buildDunePackage rec {
+  pname = "multicore-bench";
+  version = "0.1.4";
+
+  src = fetchurl {
+    url = "https://github.com/ocaml-multicore/multicore-bench/releases/download/${version}/multicore-bench-${version}.tbz";
+    hash = "sha256-iCx5QvhYo/e53cW23Sza2as4aez4HeESVvLPF1DW85A=";
+  };
+
+  propagatedBuildInputs = [ domain-local-await mtime multicore-magic yojson ];
+
+  meta = {
+    description = "Framework for writing multicore benchmark executables to run on current-bench";
+    homepage = "https://github.com/ocaml-multicore/multicore-bench";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+}
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index d7509a7efa9f..c487541fa2e8 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1201,6 +1201,8 @@ let
 
     mtime =  callPackage ../development/ocaml-modules/mtime { };
 
+    multicore-bench =  callPackage ../development/ocaml-modules/multicore-bench { };
+
     multicore-magic =  callPackage ../development/ocaml-modules/multicore-magic { };
 
     multipart-form-data =  callPackage ../development/ocaml-modules/multipart-form-data { };

From 43b68513274145fa695ee6372cd169a30e4fdc38 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Fri, 23 Aug 2024 13:01:02 +0200
Subject: [PATCH 52/53] docfd: remove spurrious dependency on domainslib

---
 pkgs/by-name/do/docfd/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/do/docfd/package.nix b/pkgs/by-name/do/docfd/package.nix
index 3636296b8de4..18b80cf7142b 100644
--- a/pkgs/by-name/do/docfd/package.nix
+++ b/pkgs/by-name/do/docfd/package.nix
@@ -42,7 +42,6 @@ buildDunePackage' rec {
     cmdliner
     containers-data
     digestif
-    domainslib
     eio_main
     lwd
     nottui

From b956c2f42a5d0c9fbbfd8b2a9cf3bb5f0a6fcf41 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Fri, 23 Aug 2024 13:01:14 +0200
Subject: [PATCH 53/53] =?UTF-8?q?ocamlPackages.lockfree:=200.4.0=20?=
 =?UTF-8?q?=E2=86=92=200.5.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ocamlPackages.domainslib: mark as broken
---
 pkgs/development/ocaml-modules/domainslib/default.nix |  1 +
 pkgs/development/ocaml-modules/saturn/default.nix     | 11 ++++++++++-
 pkgs/development/ocaml-modules/saturn/lockfree.nix    | 10 +++++-----
 3 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/ocaml-modules/domainslib/default.nix b/pkgs/development/ocaml-modules/domainslib/default.nix
index 096ba5434996..e912cfeb57af 100644
--- a/pkgs/development/ocaml-modules/domainslib/default.nix
+++ b/pkgs/development/ocaml-modules/domainslib/default.nix
@@ -29,5 +29,6 @@ buildDunePackage rec {
     description = "Nested-parallel programming";
     license = lib.licenses.isc;
     maintainers = [ lib.maintainers.vbgl ];
+    broken = true; # Not compatible with saturn > 0.4.0
   };
 }
diff --git a/pkgs/development/ocaml-modules/saturn/default.nix b/pkgs/development/ocaml-modules/saturn/default.nix
index 582f0e7f5aea..d5b8d0478f2a 100644
--- a/pkgs/development/ocaml-modules/saturn/default.nix
+++ b/pkgs/development/ocaml-modules/saturn/default.nix
@@ -1,6 +1,8 @@
 { lib, buildDunePackage, ocaml
 , saturn_lockfree
+, domain_shims
 , dscheck
+, multicore-bench
 , qcheck, qcheck-alcotest, qcheck-stm
 }:
 
@@ -12,7 +14,14 @@ buildDunePackage rec {
   propagatedBuildInputs = [ saturn_lockfree ];
 
   doCheck = lib.versionAtLeast ocaml.version "5.0";
-  checkInputs = [ dscheck qcheck qcheck-alcotest qcheck-stm ];
+  checkInputs = [
+    domain_shims
+    dscheck
+    multicore-bench
+    qcheck
+    qcheck-alcotest
+    qcheck-stm
+  ];
 
   meta = saturn_lockfree.meta // {
     description = "Parallelism-safe data structures for multicore OCaml";
diff --git a/pkgs/development/ocaml-modules/saturn/lockfree.nix b/pkgs/development/ocaml-modules/saturn/lockfree.nix
index 42858626e58d..07b8dc785cff 100644
--- a/pkgs/development/ocaml-modules/saturn/lockfree.nix
+++ b/pkgs/development/ocaml-modules/saturn/lockfree.nix
@@ -1,19 +1,19 @@
 { lib, fetchurl, buildDunePackage
-, domain_shims
+, backoff, multicore-magic
 }:
 
 buildDunePackage rec {
   pname = "saturn_lockfree";
-  version = "0.4.0";
+  version = "0.5.0";
 
-  minimalOCamlVersion = "4.12";
+  minimalOCamlVersion = "4.13";
 
   src = fetchurl {
     url = "https://github.com/ocaml-multicore/saturn/releases/download/${version}/saturn-${version}.tbz";
-    hash = "sha256-fHvslaJwVbQaqDVA/MHGqHybetYbxRGlMrhgXqM3iPs=";
+    hash = "sha256-ZmmxwIe5PiPYTTdvOHbOjRbv2b/bb9y0IekByfREPjk=";
   };
 
-  propagatedBuildInputs = [ domain_shims ];
+  propagatedBuildInputs = [ backoff multicore-magic ];
 
   meta = {
     description = "Lock-free data structures for multicore OCaml";