Merge master into haskell-updates

doc/languages-frameworks/java.section.md

@@ -33,8 +33,7 @@ stdenv.mkDerivation {
 ```
 
 Note that `jdk` is an alias for the OpenJDK (self-built where available,
-or pre-built via Zulu). Platforms with OpenJDK not (yet) in Nixpkgs
-(`Aarch32`, `Aarch64`) point to the (unfree) `oraclejdk`.
+or pre-built via Zulu).
 
 Also note that not using `stripJavaArchivesHook` will likely cause the
 generated `.jar` files to be non-deterministic, which is not optimal.

maintainers/maintainer-list.nix

@@ -4368,6 +4368,12 @@
     githubId = 18414241;
     name = "Andreas Erdes";
   };
+  computerdane = {
+    email = "danerieber@gmail.com";
+    github = "computerdane";
+    githubId = 6487079;
+    name = "Dane Rieber";
+  };
   confus = {
     email = "con-f-use@gmx.net";
     github = "con-f-use";
@@ -4766,12 +4772,6 @@
     githubId = 24708079;
     name = "Dan Eads";
   };
-  danerieber = {
-    email = "danerieber@gmail.com";
-    github = "danerieber";
-    githubId = 6487079;
-    name = "Dane Rieber";
-  };
   danid3v = {
     email = "sch220233@spengergasse.at";
     github = "DaniD3v";

nixos/doc/manual/administration/rollback.section.md

@@ -12,7 +12,7 @@ system has booted, you can make the selected configuration the default
 for subsequent boots:
 
 ```ShellSession
-# /run/current-system/bin/apply boot
+# /run/current-system/bin/switch-to-configuration boot
 ```
 
 Second, you can switch to the previous configuration in a running
@@ -25,11 +25,11 @@ system:
 This is equivalent to running:
 
 ```ShellSession
-# /nix/var/nix/profiles/system-N-link/bin/apply switch
+# /nix/var/nix/profiles/system-N-link/bin/switch-to-configuration switch
 ```
 
-where `N` is the number of the NixOS system configuration to roll back to.
-To get a list of the available configurations, run:
+where `N` is the number of the NixOS system configuration. To get a
+list of the available configurations, do:
 
 ```ShellSession
 $ ls -l /nix/var/nix/profiles/system-*-link

nixos/doc/manual/development/non-switchable-systems.section.md

@@ -16,6 +16,6 @@ profile:
 The most notable deviation of this profile from a standard NixOS configuration
 is that after building it, you cannot switch *to* the configuration anymore.
 The profile sets `config.system.switch.enable = false;`, which excludes
-`apply` and `switch-to-configuration`, the central scripts called by `nixos-rebuild`, from
+`switch-to-configuration`, the central script called by `nixos-rebuild`, from
 your system. Removing this script makes the image lighter and slightly more
 secure.

nixos/doc/manual/development/what-happens-during-a-system-switch.chapter.md

@@ -5,8 +5,8 @@ This chapter explains some of the internals of this command to make it simpler
 for new module developers to configure their units correctly and to make it
 easier to understand what is happening and why for curious administrators.
 
-`nixos-rebuild`, like many deployment solutions, calls `apply` (or for NixOS older than 24.11, `switch-to-configuration`)
-which resides in a NixOS system at `$out/bin/apply`. The
+`nixos-rebuild`, like many deployment solutions, calls `switch-to-configuration`
+which resides in a NixOS system at `$out/bin/switch-to-configuration`. The
 script is called with the action that is to be performed like `switch`, `test`,
 `boot`. There is also the `dry-activate` action which does not really perform
 the actions but rather prints what it would do if you called it with `test`.

nixos/doc/manual/installation/installing-from-other-distro.section.md

@@ -247,7 +247,7 @@ The first steps to all these are the same:
 
     ```ShellSession
     $ sudo mv -v /boot /boot.bak &&
-    sudo /nix/var/nix/profiles/system/bin/apply boot
+    sudo /nix/var/nix/profiles/system/bin/switch-to-configuration boot
     ```
 
     Cross your fingers, reboot, hopefully you should get a NixOS prompt!

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -54,16 +54,6 @@
   If you experience any issues, please report them.
   The original Perl script is deprecated and is planned for removal in the 25.05 release. It will remain accessible until then by setting `system.switch.enableNg` to `false`.
 
-- Built NixOS configurations now have a `$toplevel/bin/apply` script.
-  Unlike `switch-to-configuration`, it is capable of performing a complete `switch` operation.
-  If you call `switch-to-configuration` directly, you are recommended to use `apply` instead, and remove your call to `nix-env --profile /nix/var/nix/profiles/system --set $toplevel` or similar.
-  It will run the switch operation as a systemd unit if available, as `nixos-rebuild switch` would.
-
-  Benefits include:
-  - The `apply` script reduces the roundtrips required when performing a remote deployment with `nixos-rebuild switch --target-host HOST`.
-  - Developers and power users can now update NixOS in a single call.
-  - Alternative NixOS deployment methods have feature parity with `nixos-rebuild`, and NixOS can evolve all of its switching logic in one place.
-
 - Support for mounting filesystems from block devices protected with [dm-verity](https://docs.kernel.org/admin-guide/device-mapper/verity.html)
   was added through the `boot.initrd.systemd.dmVerity` option.
 
@@ -343,6 +333,11 @@
   This change requires granting access to the repositories to this user or
   setting the appropriate one through `services.cgit.some-instance.user`.
 
+- All Oracle JDKs and JREs (`oraclejdk`, `oraclejdk8`, `oraclejre`, `oraclejre8`,
+  `jrePlugin`, `jre8Plugin`, `jdkdistro`, `oraclejdk8distro`, and `oraclejdk11`)
+  were dropped due to being unmaintained and heavily insecure. OpenJDK provides
+  compatible replacements for JDKs and JREs.
+
 - `gradle_6` was removed due to being [unsupported upstream as of 10 Feb 2023](https://endoflife.date/gradle).
   Additionally, it had numerous security vulnerabilities that were only patched
   in later versions, such as [CVE-2021-29429](https://nvd.nist.gov/vuln/detail/CVE-2021-32751),
@@ -352,6 +347,9 @@
   nvimpager settings: user commands in `-c` and `--cmd` now override the
   respective default settings because they are executed later.
 
+- `javacard-devkit` was dropped due to having a dependency on the Oracle JDK,
+  as well as being several years out-of-date.
+
 - Kubernetes `featureGates` have changed from a `listOf str` to `attrsOf bool`.
   This refactor makes it possible to also disable feature gates, without having
   to use `extraOpts` flags.
@@ -398,6 +396,9 @@
 
 - `services.pgbouncer` systemd service is configured with `Type=notify-reload` and allows reloading configuration without process restart. PgBouncer configuration options were moved to the free-form type option named [`services.pgbouncer.settings`](#opt-services.pgbouncer.settings) according to the NixOS RFC 0042.
 
+- Docear was removed because it was unmaintained upstream.
+  JabRef, Zotero, or Mendeley are potential replacements.
+
 - `nodePackages.coc-metals` was removed due to being deprecated upstream.
   `vimPlugins.nvim-metals` is its official replacement.
 
@@ -502,6 +503,9 @@
 
 - PPD files for Utax printers got renamed (spaces replaced by underscores) in newest `foomatic-db` package; users of Utax printers might need to adapt their `hardware.printers.ensurePrinters.*.model` value.
 
+- `sqldeveloper` was dropped due to being severely out-of-date and having a dependency on
+  JavaFX for Java 8, which we do not support.
+
 - The `kvdo` kernel module package was removed, because it was upstreamed in kernel version 6.9, where it is called `dm-vdo`.
 
 - `libe57format` has been updated to `>= 3.0.0`, which contains some backward-incompatible API changes. See the [release note](https://github.com/asmaloney/libE57Format/releases/tag/v3.0.0) for more details.
@@ -673,6 +677,15 @@
   lists by default. Backwards-compatible behavior can be enabled with
   `atomsCoercedToLists`.
 
+- Atlassian Server products have been removed, as support for the Atlassian Server
+  products ended in February 2024 and there was insufficient interest in
+  maintaining the Atlassian Data Center replacements:
+  - The `atlassian-bamboo` package
+  - The `atlassian-confluence` package and its `services.confluence` NixOS module
+  - The `atlassian-crowd` package and its `services.crowd` NixOS module
+  - The `atlassian-jira` package and its `services.jira` NixOS module
+
+
 - `python3Packages.nose` has been removed, as it has been deprecated and unmaintained for almost a decade and does not work on Python 3.12.
   Please switch to `pytest` or another test runner/framework.
 
@@ -800,6 +813,11 @@
 
 - `iproute2` now has libbpf support.
 
+- `postgresql` is now [hardened by default](#module-services-postgres-hardening) using the common `systemd` settings for that.
+
+  If you use extensions that are not packaged in nixpkgs, please review whether it still works
+  with the current settings and adjust accordingly if needed.
+
 - `nix.channel.enable = false` no longer implies `nix.settings.nix-path = []`.
   Since Nix 2.13, a `nix-path` set in `nix.conf` cannot be overridden by the `NIX_PATH` configuration variable.
 

nixos/lib/testing/nixos-test-base.nix

@@ -23,7 +23,7 @@ in
       };
     }
     ({ config, ... }: {
-      # Don't pull in apply and switch-to-configuration by default, except when specialisations or early boot shenanigans are involved.
+      # Don't pull in switch-to-configuration by default, except when specialisations or early boot shenanigans are involved.
       # This is mostly a Hydra optimization, so we don't rebuild all the tests every time switch-to-configuration-ng changes.
       key = "no-switch-to-configuration";
       system.switch.enable = mkDefault (config.isSpecialisation || config.specialisation != {} || config.virtualisation.installBootLoader);

nixos/modules/module-list.nix

@@ -1390,9 +1390,6 @@
   ./services/web-apps/alps.nix
   ./services/web-apps/anuko-time-tracker.nix
   ./services/web-apps/artalk.nix
-  ./services/web-apps/atlassian/confluence.nix
-  ./services/web-apps/atlassian/crowd.nix
-  ./services/web-apps/atlassian/jira.nix
   ./services/web-apps/audiobookshelf.nix
   ./services/web-apps/bluemap.nix
   ./services/web-apps/bookstack.nix

nixos/modules/rename.nix

@@ -62,7 +62,9 @@ in
     (mkRemovedOptionModule [ "services" "beegfsEnable" ] "The BeeGFS module has been removed")
     (mkRemovedOptionModule [ "services" "cgmanager" "enable"] "cgmanager was deprecated by lxc and therefore removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "chronos" ] "The corresponding package was removed from nixpkgs.")
+    (mkRemovedOptionModule [ "services" "confluence" ] "Atlassian software has been removed, as support for the Atlassian Server products ended in February 2024 and there was insufficient interest in maintaining the Atlassian Data Center replacements")
     (mkRemovedOptionModule [ "services" "couchpotato" ] "The corresponding package was removed from nixpkgs.")
+    (mkRemovedOptionModule [ "services" "crowd" ] "Atlassian software has been removed, as support for the Atlassian Server products ended in February 2024 and there was insufficient interest in maintaining the Atlassian Data Center replacements")
     (mkRemovedOptionModule [ "services" "dd-agent" ] "dd-agent was removed from nixpkgs in favor of the newer datadog-agent.")
     (mkRemovedOptionModule [ "services" "dnscrypt-proxy" ] "Use services.dnscrypt-proxy2 instead")
     (mkRemovedOptionModule [ "services" "dnscrypt-wrapper" ] ''
@@ -82,6 +84,7 @@ in
     (mkRemovedOptionModule [ "services" "homeassistant-satellite"] "The `services.homeassistant-satellite` module has been replaced by `services.wyoming-satellite`.")
     (mkRemovedOptionModule [ "services" "hydron" ] "The `services.hydron` module has been removed as the project has been archived upstream since 2022 and is affected by a severe remote code execution vulnerability.")
     (mkRemovedOptionModule [ "services" "ihatemoney" ] "The ihatemoney module has been removed for lack of downstream maintainer")
+    (mkRemovedOptionModule [ "services" "jira" ] "Atlassian software has been removed, as support for the Atlassian Server products ended in February 2024 and there was insufficient interest in maintaining the Atlassian Data Center replacements")
     (mkRemovedOptionModule [ "services" "kippo" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "lshd" ] "The corresponding package was removed from nixpkgs as it had no maintainer in Nixpkgs and hasn't seen an upstream release in over a decades.")
     (mkRemovedOptionModule [ "services" "mailpile" ] "The corresponding package was removed from nixpkgs.")

nixos/modules/services/databases/postgresql.md

@@ -364,6 +364,24 @@ postgresql.withJIT.pname
 
 evaluates to `"foobar"`.
 
+## Service hardening {#module-services-postgres-hardening}
+
+The service created by the [`postgresql`-module](#opt-services.postgresql.enable) uses
+several common hardening options from `systemd`, most notably:
+
+* Memory pages must not be both writable and executable (this only applies to non-JIT setups).
+* A system call filter (see {manpage}`systemd.exec(5)` for details on `@system-service`).
+* A stricter default UMask (`0027`).
+* Only sockets of type `AF_INET`/`AF_INET6`/`AF_NETLINK`/`AF_UNIX` allowed.
+* Restricted filesystem access (private `/tmp`, most of the file-system hierachy is mounted read-only, only process directories in `/proc` that are owned by the same user).
+
+The NixOS module also contains necessary adjustments for extensions from `nixpkgs`
+if these are enabled. If an extension or a postgresql feature from `nixpkgs` breaks
+with hardening, it's considered a bug.
+
+When using extensions that are not packaged in `nixpkgs`, hardening adjustments may
+become necessary.
+
 ## Notable differences to upstream {#module-services-postgres-upstream-deviation}
 
 - To avoid circular dependencies between default and -dev outputs, the output of the `pg_config` system view has been removed.

nixos/modules/services/databases/postgresql.nix

@@ -623,7 +623,46 @@ in
             TimeoutSec = 120;
 
             ExecStart = "${postgresql}/bin/postgres";
+
+            # Hardening
+            CapabilityBoundingSet = [ "" ];
+            DevicePolicy = "closed";
+            PrivateTmp = true;
+            ProtectHome = true;
+            ProtectSystem = "strict";
+            MemoryDenyWriteExecute = lib.mkDefault (cfg.settings.jit == "off");
+            NoNewPrivileges = true;
+            LockPersonality = true;
+            PrivateDevices = true;
+            PrivateMounts = true;
+            ProcSubset = "pid";
+            ProtectClock = true;
+            ProtectControlGroups = true;
+            ProtectHostname = true;
+            ProtectKernelLogs = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            ProtectProc = "invisible";
+            RemoveIPC = true;
+            RestrictAddressFamilies = [
+              "AF_INET"
+              "AF_INET6"
+              "AF_NETLINK" # used for network interface enumeration
+              "AF_UNIX"
+            ];
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            RestrictSUIDSGID = true;
+            SystemCallArchitectures = "native";
+            SystemCallFilter = [
+              "@system-service"
+              "~@privileged @resources"
+            ];
+            UMask = if groupAccessAvailable then "0027" else "0077";
           }
+          (mkIf (cfg.dataDir != "/var/lib/postgresql") {
+            ReadWritePaths = [ cfg.dataDir ];
+          })
           (mkIf (cfg.dataDir == "/var/lib/postgresql/${cfg.package.psqlSchema}") {
             StateDirectory = "postgresql postgresql/${cfg.package.psqlSchema}";
             StateDirectoryMode = if groupAccessAvailable then "0750" else "0700";

nixos/modules/services/web-apps/atlassian/confluence.nix

@@ -1,224 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  cfg = config.services.confluence;
-
-  pkg = cfg.package.override (optionalAttrs cfg.sso.enable {
-    enableSSO = cfg.sso.enable;
-  });
-
-  crowdProperties = pkgs.writeText "crowd.properties" ''
-    application.name                        ${cfg.sso.applicationName}
-    application.password                    ${if cfg.sso.applicationPassword != null then cfg.sso.applicationPassword else "@NIXOS_CONFLUENCE_CROWD_SSO_PWD@"}
-    application.login.url                   ${cfg.sso.crowd}/console/
-
-    crowd.server.url                        ${cfg.sso.crowd}/services/
-    crowd.base.url                          ${cfg.sso.crowd}/
-
-    session.isauthenticated                 session.isauthenticated
-    session.tokenkey                        session.tokenkey
-    session.validationinterval              ${toString cfg.sso.validationInterval}
-    session.lastvalidation                  session.lastvalidation
-  '';
-
-in
-
-{
-  options = {
-    services.confluence = {
-      enable = mkEnableOption "Atlassian Confluence service";
-
-      user = mkOption {
-        type = types.str;
-        default = "confluence";
-        description = "User which runs confluence.";
-      };
-
-      group = mkOption {
-        type = types.str;
-        default = "confluence";
-        description = "Group which runs confluence.";
-      };
-
-      home = mkOption {
-        type = types.str;
-        default = "/var/lib/confluence";
-        description = "Home directory of the confluence instance.";
-      };
-
-      listenAddress = mkOption {
-        type = types.str;
-        default = "127.0.0.1";
-        description = "Address to listen on.";
-      };
-
-      listenPort = mkOption {
-        type = types.port;
-        default = 8090;
-        description = "Port to listen on.";
-      };
-
-      catalinaOptions = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        example = [ "-Xms1024m" "-Xmx2048m" "-Dconfluence.disable.peopledirectory.all=true" ];
-        description = "Java options to pass to catalina/tomcat.";
-      };
-
-      proxy = {
-        enable = mkEnableOption "proxy support";
-
-        name = mkOption {
-          type = types.str;
-          example = "confluence.example.com";
-          description = "Virtual hostname at the proxy";
-        };
-
-        port = mkOption {
-          type = types.port;
-          default = 443;
-          example = 80;
-          description = "Port used at the proxy";
-        };
-
-        scheme = mkOption {
-          type = types.str;
-          default = "https";
-          example = "http";
-          description = "Protocol used at the proxy.";
-        };
-      };
-
-      sso = {
-        enable = mkEnableOption "SSO with Atlassian Crowd";
-
-        crowd = mkOption {
-          type = types.str;
-          example = "http://localhost:8095/crowd";
-          description = "Crowd Base URL without trailing slash";
-        };
-
-        applicationName = mkOption {
-          type = types.str;
-          example = "jira";
-          description = "Exact name of this Confluence instance in Crowd";
-        };
-
-        applicationPassword = mkOption {
-          type = types.nullOr types.str;
-          default = null;
-          description = "Application password of this Confluence instance in Crowd";
-        };
-
-        applicationPasswordFile = mkOption {
-          type = types.nullOr types.str;
-          default = null;
-          description = "Path to the application password for Crowd of Confluence.";
-        };
-
-        validationInterval = mkOption {
-          type = types.int;
-          default = 2;
-          example = 0;
-          description = ''
-            Set to 0, if you want authentication checks to occur on each
-            request. Otherwise set to the number of minutes between request
-            to validate if the user is logged in or out of the Crowd SSO
-            server. Setting this value to 1 or higher will increase the
-            performance of Crowd's integration.
-          '';
-        };
-      };
-
-      package = mkPackageOption pkgs "atlassian-confluence" { };
-
-      jrePackage = mkPackageOption pkgs "oraclejre8" {
-        extraDescription = ''
-        ::: {.note }
-        Atlassian only supports the Oracle JRE (JRASERVER-46152).
-        :::
-        '';
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-    users.users.${cfg.user} = {
-      isSystemUser = true;
-      group = cfg.group;
-    };
-
-    assertions = [
-      { assertion = cfg.sso.enable -> ((cfg.sso.applicationPassword == null) != (cfg.sso.applicationPasswordFile));
-        message = "Please set either applicationPassword or applicationPasswordFile";
-      }
-    ];
-
-    warnings = mkIf (cfg.sso.enable && cfg.sso.applicationPassword != null) [
-      "Using `services.confluence.sso.applicationPassword` is deprecated! Use `applicationPasswordFile` instead!"
-    ];
-
-    users.groups.${cfg.group} = {};
-
-    systemd.tmpfiles.rules = [
-      "d '${cfg.home}' - ${cfg.user} - - -"
-      "d /run/confluence - - - - -"
-
-      "L+ /run/confluence/home - - - - ${cfg.home}"
-      "L+ /run/confluence/logs - - - - ${cfg.home}/logs"
-      "L+ /run/confluence/temp - - - - ${cfg.home}/temp"
-      "L+ /run/confluence/work - - - - ${cfg.home}/work"
-      "L+ /run/confluence/server.xml - - - - ${cfg.home}/server.xml"
-    ];
-
-    systemd.services.confluence = {
-      description = "Atlassian Confluence";
-
-      wantedBy = [ "multi-user.target" ];
-      requires = [ "postgresql.service" ];
-      after = [ "postgresql.service" ];
-
-      path = [ cfg.jrePackage pkgs.bash ];
-
-      environment = {
-        CONF_USER = cfg.user;
-        JAVA_HOME = "${cfg.jrePackage}";
-        CATALINA_OPTS = concatStringsSep " " cfg.catalinaOptions;
-        JAVA_OPTS = mkIf cfg.sso.enable "-Dcrowd.properties=${cfg.home}/crowd.properties";
-      };
-
-      preStart = ''
-        mkdir -p ${cfg.home}/{logs,work,temp,deploy}
-
-        sed -e 's,port="8090",port="${toString cfg.listenPort}" address="${cfg.listenAddress}",' \
-        '' + (lib.optionalString cfg.proxy.enable ''
-          -e 's,protocol="org.apache.coyote.http11.Http11NioProtocol",protocol="org.apache.coyote.http11.Http11NioProtocol" proxyName="${cfg.proxy.name}" proxyPort="${toString cfg.proxy.port}" scheme="${cfg.proxy.scheme}",' \
-        '') + ''
-          ${pkg}/conf/server.xml.dist > ${cfg.home}/server.xml
-
-        ${optionalString cfg.sso.enable ''
-          install -m660 ${crowdProperties} ${cfg.home}/crowd.properties
-          ${optionalString (cfg.sso.applicationPasswordFile != null) ''
-            ${pkgs.replace-secret}/bin/replace-secret \
-              '@NIXOS_CONFLUENCE_CROWD_SSO_PWD@' \
-              ${cfg.sso.applicationPasswordFile} \
-              ${cfg.home}/crowd.properties
-          ''}
-        ''}
-      '';
-
-      serviceConfig = {
-        User = cfg.user;
-        Group = cfg.group;
-        PrivateTmp = true;
-        Restart = "on-failure";
-        RestartSec = "10";
-        ExecStart = "${pkg}/bin/start-confluence.sh -fg";
-        ExecStop = "${pkg}/bin/stop-confluence.sh";
-      };
-    };
-  };
-}

nixos/modules/services/web-apps/atlassian/crowd.nix

@@ -1,193 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  cfg = config.services.crowd;
-
-  pkg = cfg.package.override {
-    home = cfg.home;
-    port = cfg.listenPort;
-    openidPassword = cfg.openidPassword;
-  } // (optionalAttrs cfg.proxy.enable {
-    proxyUrl = "${cfg.proxy.scheme}://${cfg.proxy.name}:${toString cfg.proxy.port}";
-  });
-
-  crowdPropertiesFile = pkgs.writeText "crowd.properties" ''
-    application.name                        crowd-openid-server
-    application.password @NIXOS_CROWD_OPENID_PW@
-    application.base.url                    http://localhost:${toString cfg.listenPort}/openidserver
-    application.login.url                   http://localhost:${toString cfg.listenPort}/openidserver
-    application.login.url.template          http://localhost:${toString cfg.listenPort}/openidserver?returnToUrl=''${RETURN_TO_URL}
-
-    crowd.server.url                        http://localhost:${toString cfg.listenPort}/crowd/services/
-
-    session.isauthenticated                 session.isauthenticated
-    session.tokenkey                        session.tokenkey
-    session.validationinterval              0
-    session.lastvalidation                  session.lastvalidation
-  '';
-
-in
-
-{
-  options = {
-    services.crowd = {
-      enable = mkEnableOption "Atlassian Crowd service";
-
-      user = mkOption {
-        type = types.str;
-        default = "crowd";
-        description = "User which runs Crowd.";
-      };
-
-      group = mkOption {
-        type = types.str;
-        default = "crowd";
-        description = "Group which runs Crowd.";
-      };
-
-      home = mkOption {
-        type = types.str;
-        default = "/var/lib/crowd";
-        description = "Home directory of the Crowd instance.";
-      };
-
-      listenAddress = mkOption {
-        type = types.str;
-        default = "127.0.0.1";
-        description = "Address to listen on.";
-      };
-
-      listenPort = mkOption {
-        type = types.port;
-        default = 8092;
-        description = "Port to listen on.";
-      };
-
-      openidPassword = mkOption {
-        type = types.str;
-        default = "WILL_NEVER_BE_SET";
-        description = "Application password for OpenID server.";
-      };
-
-      openidPasswordFile = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        description = "Path to the file containing the application password for OpenID server.";
-      };
-
-      catalinaOptions = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        example = [ "-Xms1024m" "-Xmx2048m" ];
-        description = "Java options to pass to catalina/tomcat.";
-      };
-
-      proxy = {
-        enable = mkEnableOption "reverse proxy support";
-
-        name = mkOption {
-          type = types.str;
-          example = "crowd.example.com";
-          description = "Virtual hostname at the proxy";
-        };
-
-        port = mkOption {
-          type = types.port;
-          default = 443;
-          example = 80;
-          description = "Port used at the proxy";
-        };
-
-        scheme = mkOption {
-          type = types.str;
-          default = "https";
-          example = "http";
-          description = "Protocol used at the proxy.";
-        };
-
-        secure = mkOption {
-          type = types.bool;
-          default = true;
-          description = "Whether the connections to the proxy should be considered secure.";
-        };
-      };
-
-      package = mkPackageOption pkgs "atlassian-crowd" { };
-
-      jrePackage = mkPackageOption pkgs "oraclejre8" {
-        extraDescription = ''
-        ::: {.note }
-        Atlassian only supports the Oracle JRE (JRASERVER-46152).
-        :::
-        '';
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-    users.users.${cfg.user} = {
-      isSystemUser = true;
-      group = cfg.group;
-    };
-
-    users.groups.${cfg.group} = {};
-
-    systemd.tmpfiles.rules = [
-      "d '${cfg.home}' - ${cfg.user} ${cfg.group} - -"
-      "d /run/atlassian-crowd - - - - -"
-
-      "L+ /run/atlassian-crowd/database - - - - ${cfg.home}/database"
-      "L+ /run/atlassian-crowd/logs - - - - ${cfg.home}/logs"
-      "L+ /run/atlassian-crowd/work - - - - ${cfg.home}/work"
-      "L+ /run/atlassian-crowd/server.xml - - - - ${cfg.home}/server.xml"
-    ];
-
-    systemd.services.atlassian-crowd = {
-      description = "Atlassian Crowd";
-
-      wantedBy = [ "multi-user.target" ];
-      requires = [ "postgresql.service" ];
-      after = [ "postgresql.service" ];
-
-      path = [ cfg.jrePackage ];
-
-      environment = {
-        JAVA_HOME = "${cfg.jrePackage}";
-        CATALINA_OPTS = concatStringsSep " " cfg.catalinaOptions;
-        CATALINA_TMPDIR = "/tmp";
-        JAVA_OPTS = mkIf (cfg.openidPasswordFile != null) "-Dcrowd.properties=${cfg.home}/crowd.properties";
-      };
-
-      preStart = ''
-        rm -rf ${cfg.home}/work
-        mkdir -p ${cfg.home}/{logs,database,work}
-
-        sed -e 's,port="8095",port="${toString cfg.listenPort}" address="${cfg.listenAddress}",' \
-        '' + (lib.optionalString cfg.proxy.enable ''
-          -e 's,compression="on",compression="off" protocol="HTTP/1.1" proxyName="${cfg.proxy.name}" proxyPort="${toString cfg.proxy.port}" scheme="${cfg.proxy.scheme}" secure="${boolToString cfg.proxy.secure}",' \
-        '') + ''
-          ${pkg}/apache-tomcat/conf/server.xml.dist > ${cfg.home}/server.xml
-
-        ${optionalString (cfg.openidPasswordFile != null) ''
-          install -m660 ${crowdPropertiesFile} ${cfg.home}/crowd.properties
-          ${pkgs.replace-secret}/bin/replace-secret \
-            '@NIXOS_CROWD_OPENID_PW@' \
-            ${cfg.openidPasswordFile} \
-            ${cfg.home}/crowd.properties
-        ''}
-      '';
-
-      serviceConfig = {
-        User = cfg.user;
-        Group = cfg.group;
-        PrivateTmp = true;
-        Restart = "on-failure";
-        RestartSec = "10";
-        ExecStart = "${pkg}/start_crowd.sh -fg";
-      };
-    };
-  };
-}

nixos/modules/services/web-apps/atlassian/jira.nix

@@ -1,219 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  cfg = config.services.jira;
-
-  pkg = cfg.package.override (optionalAttrs cfg.sso.enable {
-    enableSSO = cfg.sso.enable;
-  });
-
-  crowdProperties = pkgs.writeText "crowd.properties" ''
-    application.name                        ${cfg.sso.applicationName}
-    application.password                    @NIXOS_JIRA_CROWD_SSO_PWD@
-    application.login.url                   ${cfg.sso.crowd}/console/
-
-    crowd.server.url                        ${cfg.sso.crowd}/services/
-    crowd.base.url                          ${cfg.sso.crowd}/
-
-    session.isauthenticated                 session.isauthenticated
-    session.tokenkey                        session.tokenkey
-    session.validationinterval              ${toString cfg.sso.validationInterval}
-    session.lastvalidation                  session.lastvalidation
-  '';
-
-in
-
-{
-  options = {
-    services.jira = {
-      enable = mkEnableOption "Atlassian JIRA service";
-
-      user = mkOption {
-        type = types.str;
-        default = "jira";
-        description = "User which runs JIRA.";
-      };
-
-      group = mkOption {
-        type = types.str;
-        default = "jira";
-        description = "Group which runs JIRA.";
-      };
-
-      home = mkOption {
-        type = types.str;
-        default = "/var/lib/jira";
-        description = "Home directory of the JIRA instance.";
-      };
-
-      listenAddress = mkOption {
-        type = types.str;
-        default = "127.0.0.1";
-        description = "Address to listen on.";
-      };
-
-      listenPort = mkOption {
-        type = types.port;
-        default = 8091;
-        description = "Port to listen on.";
-      };
-
-      catalinaOptions = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        example = [ "-Xms1024m" "-Xmx2048m" ];
-        description = "Java options to pass to catalina/tomcat.";
-      };
-
-      proxy = {
-        enable = mkEnableOption "reverse proxy support";
-
-        name = mkOption {
-          type = types.str;
-          example = "jira.example.com";
-          description = "Virtual hostname at the proxy";
-        };
-
-        port = mkOption {
-          type = types.port;
-          default = 443;
-          example = 80;
-          description = "Port used at the proxy";
-        };
-
-        scheme = mkOption {
-          type = types.str;
-          default = "https";
-          example = "http";
-          description = "Protocol used at the proxy.";
-        };
-
-        secure = mkOption {
-          type = types.bool;
-          default = true;
-          description = "Whether the connections to the proxy should be considered secure.";
-        };
-      };
-
-      sso = {
-        enable = mkEnableOption "SSO with Atlassian Crowd";
-
-        crowd = mkOption {
-          type = types.str;
-          example = "http://localhost:8095/crowd";
-          description = "Crowd Base URL without trailing slash";
-        };
-
-        applicationName = mkOption {
-          type = types.str;
-          example = "jira";
-          description = "Exact name of this JIRA instance in Crowd";
-        };
-
-        applicationPasswordFile = mkOption {
-          type = types.str;
-          description = "Path to the file containing the application password of this JIRA instance in Crowd";
-        };
-
-        validationInterval = mkOption {
-          type = types.int;
-          default = 2;
-          example = 0;
-          description = ''
-            Set to 0, if you want authentication checks to occur on each
-            request. Otherwise set to the number of minutes between request
-            to validate if the user is logged in or out of the Crowd SSO
-            server. Setting this value to 1 or higher will increase the
-            performance of Crowd's integration.
-          '';
-        };
-      };
-
-      package = mkPackageOption pkgs "atlassian-jira" { };
-
-      jrePackage = mkPackageOption pkgs "oraclejre8" {
-        extraDescription = ''
-        ::: {.note }
-        Atlassian only supports the Oracle JRE (JRASERVER-46152).
-        :::
-        '';
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-    users.users.${cfg.user} = {
-      isSystemUser = true;
-      group = cfg.group;
-      home = cfg.home;
-    };
-
-    users.groups.${cfg.group} = {};
-
-    systemd.tmpfiles.rules = [
-      "d '${cfg.home}' - ${cfg.user} - - -"
-      "d /run/atlassian-jira - - - - -"
-
-      "L+ /run/atlassian-jira/home - - - - ${cfg.home}"
-      "L+ /run/atlassian-jira/logs - - - - ${cfg.home}/logs"
-      "L+ /run/atlassian-jira/work - - - - ${cfg.home}/work"
-      "L+ /run/atlassian-jira/temp - - - - ${cfg.home}/temp"
-      "L+ /run/atlassian-jira/server.xml - - - - ${cfg.home}/server.xml"
-    ];
-
-    systemd.services.atlassian-jira = {
-      description = "Atlassian JIRA";
-
-      wantedBy = [ "multi-user.target" ];
-      requires = [ "postgresql.service" ];
-      after = [ "postgresql.service" ];
-
-      path = [ cfg.jrePackage pkgs.bash ];
-
-      environment = {
-        JIRA_USER = cfg.user;
-        JIRA_HOME = cfg.home;
-        JAVA_HOME = "${cfg.jrePackage}";
-        CATALINA_OPTS = concatStringsSep " " cfg.catalinaOptions;
-        JAVA_OPTS = mkIf cfg.sso.enable "-Dcrowd.properties=${cfg.home}/crowd.properties";
-      };
-
-      preStart = ''
-        mkdir -p ${cfg.home}/{logs,work,temp,deploy}
-
-        sed -e 's,port="8080",port="${toString cfg.listenPort}" address="${cfg.listenAddress}",' \
-        '' + (lib.optionalString cfg.proxy.enable ''
-          -e 's,protocol="HTTP/1.1",protocol="HTTP/1.1" proxyName="${cfg.proxy.name}" proxyPort="${toString cfg.proxy.port}" scheme="${cfg.proxy.scheme}" secure="${toString cfg.proxy.secure}",' \
-        '') + ''
-          ${pkg}/conf/server.xml.dist > ${cfg.home}/server.xml
-
-        ${optionalString cfg.sso.enable ''
-          install -m660 ${crowdProperties} ${cfg.home}/crowd.properties
-          ${pkgs.replace-secret}/bin/replace-secret \
-            '@NIXOS_JIRA_CROWD_SSO_PWD@' \
-            ${cfg.sso.applicationPasswordFile} \
-            ${cfg.home}/crowd.properties
-        ''}
-      '';
-
-      serviceConfig = {
-        User = cfg.user;
-        Group = cfg.group;
-        PrivateTmp = true;
-        Restart = "on-failure";
-        RestartSec = "10";
-        ExecStart = "${pkg}/bin/start-jira.sh -fg";
-        ExecStop = "${pkg}/bin/stop-jira.sh";
-      };
-    };
-  };
-
-  imports = [
-    (mkRemovedOptionModule [ "services" "jira" "sso" "applicationPassword" ] ''
-      Use `applicationPasswordFile` instead!
-    '')
-  ];
-}

nixos/modules/system/activation/apply/apply.sh

@@ -1,163 +0,0 @@
-#!@bash@
-
-
-# This is the NixOS apply script, typically located at
-#
-# ${config.system.build.toplevel}/bin/apply
-#
-# This script is responsible for managing the profile link and calling the
-# appropriate scripts for its subcommands, such as switch, boot, and test.
-
-
-set -euo pipefail
-
-toplevel=@toplevel@
-
-subcommand=
-
-installBootloader=
-specialisation=
-profile=/nix/var/nix/profiles/system
-
-log() {
-    echo "$@" >&2
-}
-
-die() {
-    log "NixOS apply error: $*"
-    exit 1
-}
-
-usage() {
-    log "NixOS apply invocation error: $*"
-cat >&2 <<EOF
-Usage: apply [switch|boot|test|dry-activate] [OPTIONS]
-Subcommands:
-    switch        make the configuration the boot default and activate it
-    boot          make the configuration the boot default
-    test          activate the configuration, but don\'t make it the boot default
-    dry-activate  show what would be done if this configuration were activated
-Options:
-    --install-bootloader    install the bootloader
-    --profile PROFILE       use PROFILE as the target profile (if applicable)
-    --specialisation NAME   use the specialisation NAME
-EOF
-}
-
-
-parse_args() {
-    while [[ $# -gt 0 ]]; do
-        case "$1" in
-            switch|boot|test|dry-activate)
-                subcommand="$1"
-                ;;
-            --install-bootloader)
-                installBootloader=1
-                ;;
-            --profile)
-                if [[ $# -lt 2 ]]; then
-                    die "missing argument for --profile"
-                fi
-                profile="$2"
-                shift
-                ;;
-            # --rollback is not an `apply` responsibility, and it should be
-            # implemented by the caller of `apply` instead.
-            --specialisation)
-                if [[ $# -lt 2 ]]; then
-                    die "missing argument for --specialisation"
-                fi
-                specialisation="$2"
-                shift
-                ;;
-            *)
-                if [[ -n "$subcommand" ]]; then
-                    die "unexpected argument or flag: $1"
-                else
-                    die "unexpected subcommand or flag: $1"
-                fi
-                ;;
-        esac
-        shift
-    done
-
-    if [ -z "$subcommand" ]; then
-        die "no subcommand specified"
-    fi
-}
-
-main() {
-    local cmd activity
-
-    case "$subcommand" in
-        boot|switch)
-            nix-env -p "$profile" --set "$toplevel"
-            ;;
-    esac
-
-    # Using systemd-run here to protect against PTY failures/network
-    # disconnections during rebuild.
-    # See: https://github.com/NixOS/nixpkgs/issues/39118
-    cmd=(
-        "systemd-run"
-        "-E" "LOCALE_ARCHIVE" # Will be set to new value early in switch-to-configuration script, but interpreter starts out with old value
-        "-E" "NIXOS_INSTALL_BOOTLOADER=$installBootloader"
-        "--collect"
-        "--no-ask-password"
-        "--pipe"
-        "--quiet"
-        "--same-dir"
-        "--service-type=exec"
-        "--unit=nixos-rebuild-switch-to-configuration"
-        "--wait"
-    )
-    # Check if we have a working systemd-run. In chroot environments we may have
-    # a non-working systemd, so we fallback to not using systemd-run.
-    if ! "${cmd[@]}" true; then
-        log "Skipping systemd-run to switch configuration since it is not working in target host."
-        cmd=(
-            "env"
-            "-i"
-            "LOCALE_ARCHIVE=${LOCALE_ARCHIVE:-}"
-            "NIXOS_INSTALL_BOOTLOADER=$installBootloader"
-        )
-    fi
-    if [[ -z "$specialisation" ]]; then
-        cmd+=("$toplevel/bin/switch-to-configuration")
-    else
-        cmd+=("$toplevel/specialisation/$specialisation/bin/switch-to-configuration")
-
-        if ! [[ -f "${cmd[-1]}" ]]; then
-            log "error: specialisation not found: $specialisation"
-            exit 1
-        fi
-    fi
-
-    if ! "${cmd[@]}" "$subcommand"; then
-        case "$subcommand" in
-            switch)
-                activity="switching to the new configuration"
-                ;;
-            boot)
-                activity="switching the boot entry to the new configuration"
-                ;;
-            test)
-                activity="switching to the new configuration (in test mode)"
-                ;;
-            dry-activate)
-                activity="switching to the new configuration (in dry-activate mode)"
-                ;;
-            *)  # Should never happen
-                activity="running $subcommand"
-                ;;
-        esac
-        log "warning: error(s) occurred while $activity"
-        exit 1
-    fi
-}
-
-if ! type test_run_tests &>/dev/null; then
-    # We're not loaded into the test.sh, so we run main.
-    parse_args "$@"
-    main
-fi

nixos/modules/system/activation/apply/checks.nix

@@ -1,51 +0,0 @@
-# Run:
-#   nix-build -A nixosTests.apply
-#
-# These are not all tests. See also nixosTests.
-
-{
-  lib,
-  stdenvNoCC,
-  testers,
-  ...
-}:
-
-let
-  fileset = lib.fileset.unions [
-    ./test.sh
-    ./apply.sh
-  ];
-in
-
-{
-  unitTests = stdenvNoCC.mkDerivation {
-    name = "nixos-apply-unit-tests";
-    src = lib.fileset.toSource {
-      root = ./.;
-      inherit fileset;
-    };
-    dontBuild = true;
-    checkPhase = ''
-      ./test.sh
-    '';
-    installPhase = ''
-      touch $out
-    '';
-  };
-
-  shellcheck =
-    (testers.shellcheck {
-      src = lib.fileset.toSource {
-        # This makes the error messages include the full path
-        root = ../../../../..;
-        inherit fileset;
-      };
-    }).overrideAttrs
-      {
-        postUnpack = ''
-          for f in $(find . -type f); do
-            substituteInPlace $f --replace @bash@ /usr/bin/bash
-          done
-        '';
-      };
-}

nixos/modules/system/activation/apply/test.sh

@@ -1,176 +0,0 @@
-#!/usr/bin/env bash
-# shellcheck disable=SC2317 disable=SC2031
-# False positives:
-# SC2317: Unreachable code: TEST_*
-# SC2031: <variable> was modified in a subshell. That change might be lost.
-#         We have a lot of that, and that's expected.
-
-# This is a unit test script for the NixOS apply script.
-# It can be run quickly with the following command:
-#
-#     ./test.sh
-#
-# Alternatively, run the following to run all tests and checks
-#
-#     TODO
-#
-
-set -euo pipefail
-# set -x
-
-apply="${BASH_SOURCE[0]%/*}/apply.sh"
-# source_apply() {
-
-run_parse_args() {
-  bash -c "source $apply;"' parse_args "$@"' -- "$@"
-}
-
-TEST_parse_args_none() {
-  if errout="$(run_parse_args 2>&1)"; then
-    test_fail "apply without arguments should fail"
-  elif [[ $? -ne 1 ]]; then
-    test_fail "apply without arguments should exit with code 1"
-  fi
-  grep -F "no subcommand specified" <<<"$errout" >/dev/null
-}
-
-TEST_parse_args_switch() {
-  (
-    # shellcheck source=nixos/modules/system/activation/apply/apply.sh
-    source "$apply";
-    parse_args switch;
-    [[ $subcommand == switch ]]
-    [[ $specialisation == "" ]]
-    [[ $profile == "" ]]
-  )
-}
-
-TEST_parse_args_boot() {
-  (
-    # shellcheck source=nixos/modules/system/activation/apply/apply.sh
-    source "$apply";
-    parse_args boot;
-    [[ $subcommand == boot ]]
-    [[ $specialisation == "" ]]
-    [[ $profile == "" ]]
-  )
-}
-
-TEST_parse_args_test() {
-  (
-    # shellcheck source=nixos/modules/system/activation/apply/apply.sh
-    source "$apply";
-    parse_args test;
-    [[ $subcommand == test ]]
-    [[ $specialisation == "" ]]
-    [[ $profile == "" ]]
-  )
-}
-
-TEST_parse_args_dry_activate() {
-  (
-    # shellcheck source=nixos/modules/system/activation/apply/apply.sh
-    source "$apply";
-    parse_args dry-activate;
-    [[ $subcommand == dry-activate ]]
-    [[ $specialisation == "" ]]
-    [[ $profile == "" ]]
-  )
-}
-
-TEST_parse_args_unknown() {
-  if errout="$(run_parse_args foo 2>&1)"; then
-    test_fail "apply with unknown subcommand should fail"
-  fi
-  grep -F "unexpected argument or flag: foo" <<<"$errout" >/dev/null
-}
-
-TEST_parse_args_switch_specialisation_no_arg() {
-  if errout="$(run_parse_args switch --specialisation 2>&1)"; then
-    test_fail "apply with --specialisation without argument should fail"
-  fi
-  grep -F "missing argument for --specialisation" <<<"$errout" >/dev/null
-}
-
-TEST_parse_args_switch_specialisation() {
-  (
-    # shellcheck source=nixos/modules/system/activation/apply/apply.sh
-    source "$apply";
-    parse_args switch --specialisation low-power;
-    [[ $subcommand == switch ]]
-    [[ $specialisation == low-power ]]
-    [[ $profile == "" ]]
-  )
-}
-
-TEST_parse_args_switch_profile() {
-  (
-    # shellcheck source=nixos/modules/system/activation/apply/apply.sh
-    source "$apply";
-    parse_args switch --profile /nix/var/nix/profiles/system;
-    [[ $subcommand == switch ]]
-    [[ $specialisation == "" ]]
-    [[ $profile == /nix/var/nix/profiles/system ]]
-  )
-}
-
-
-
-# Support code
-
-test_fail() {
-  echo "TEST FAILURE: $*" >&2
-  exit 1
-}
-
-test_print_trace() {
-  local frame=${1:0}
-  local caller
-  # shellcheck disable=SC2207 disable=SC2086
-  while caller=( $(caller $frame) ); do
-    echo "  in ${caller[1]} at ${caller[2]}:${caller[0]}"
-    frame=$((frame+1));
-  done
-}
-test_on_err() {
-  echo "ERROR running: ${BASH_COMMAND}" >&2
-  test_print_trace 1 >&2
-}
-
-test_init() {
-  trap 'test_on_err' ERR
-}
-
-test_find() {
-  declare -F | grep -o 'TEST_.*' | sort
-}
-
-test_run_tests() {
-  local status=0
-  for test in $(test_find); do
-    set +e
-    (
-      set -eEuo pipefail
-      trap 'test_on_err' ERR
-      $test
-    )
-    r=$?
-    set -e
-    if [[ $r == 0 ]]; then
-      echo "ok: $test"
-    else
-      echo "TEST FAIL: $test"; status=1;
-    fi
-  done
-  if [[ $status == 0 ]]; then
-    echo "All good"
-  else
-    echo
-    echo "TEST SUITE FAILED"
-  fi
-  exit $status
-}
-
-# Main
-test_init
-test_run_tests

nixos/modules/system/activation/specialisation.nix

@@ -42,7 +42,7 @@ in
         (e.g. `fewJobsManyCores`) at runtime, run:
 
         ```
-        sudo /run/current-system/specialisation/fewJobsManyCores/bin/apply test
+        sudo /run/current-system/specialisation/fewJobsManyCores/bin/switch-to-configuration test
         ```
       '';
       type = types.attrsOf (types.submodule (

nixos/modules/system/activation/switch-to-configuration.pl

@@ -80,9 +80,12 @@ if ("@localeArchive@" ne "") {
 
 if (!defined($action) || ($action ne "switch" && $action ne "boot" && $action ne "test" && $action ne "dry-activate")) {
     print STDERR <<"EOF";
-error: Unknown action $action
 Usage: $0 [switch|boot|test|dry-activate]
-Consider calling `apply` instead of `switch-to-configuration`.
+
+switch:       make the configuration the boot default and activate now
+boot:         make the configuration the boot default
+test:         activate the configuration, but don\'t make it the boot default
+dry-activate: show what would be done if this configuration were activated
 EOF
     exit(1);
 }

nixos/modules/system/activation/switchable-system.nix

@@ -40,30 +40,7 @@ in
     };
   };
 
-  options.system.apply.enable = lib.mkOption {
-    type = lib.types.bool;
-    default = config.system.switch.enable;
-    internal = true;
-    description = ''
-      Whether to include the `bin/apply` script.
-
-      Disabling puts `nixos-rebuild` in a legacy mode that won't be maintained
-      and removes cheap and useful functionality. It's also slower over ssh.
-      This should only be used for testing the `nixos-rebuild` command, to
-      pretend that the configuration is an old NixOS.
-    '';
-  };
-
   config = lib.mkMerge [
-    (lib.mkIf config.system.apply.enable {
-      system.activatableSystemBuilderCommands = ''
-        mkdir -p $out/bin
-        substitute ${./apply/apply.sh} $out/bin/apply \
-          --subst-var-by bash ${lib.getExe pkgs.bash} \
-          --subst-var-by toplevel ''${!toplevelVar}
-        chmod +x $out/bin/apply
-      '';
-    })
     (lib.mkIf (config.system.switch.enable && !config.system.switch.enableNg) {
       warnings = [
         ''
@@ -77,7 +54,7 @@ in
       ];
 
       system.activatableSystemBuilderCommands = ''
-        mkdir -p $out/bin
+        mkdir $out/bin
         substitute ${./switch-to-configuration.pl} $out/bin/switch-to-configuration \
           --subst-var out \
           --subst-var-by toplevel ''${!toplevelVar} \
@@ -109,7 +86,7 @@ in
         (
           source ${pkgs.buildPackages.makeWrapper}/nix-support/setup-hook
 
-          mkdir -p $out/bin
+          mkdir $out/bin
           ln -sf ${lib.getExe pkgs.switch-to-configuration-ng} $out/bin/switch-to-configuration
           wrapProgram $out/bin/switch-to-configuration \
             --set OUT $out \

nixos/modules/system/activation/top-level.nix

@@ -49,8 +49,8 @@ let
   # Putting it all together.  This builds a store path containing
   # symlinks to the various parts of the built configuration (the
   # kernel, systemd units, init scripts, etc.) as well as a script
-  # `bin/apply` that activates the configuration and
-  # makes it bootable. See `activatable-system.nix` and `switchable-system.nix`.
+  # `switch-to-configuration' that activates the configuration and
+  # makes it bootable. See `activatable-system.nix`.
   baseSystem = pkgs.stdenvNoCC.mkDerivation ({
     name = "nixos-system-${config.system.name}-${config.system.nixos.label}";
     preferLocalBuild = true;

nixos/modules/tasks/filesystems/zfs.nix

@@ -221,7 +221,7 @@ in
         type = lib.types.package;
         default = pkgs.zfs;
         defaultText = lib.literalExpression "pkgs.zfs";
-        description = "Configured ZFS userland tools package, use `pkgs.zfs_unstable` if you want to track the latest staging ZFS branch.";
+        description = "Configured ZFS userland tools package.";
       };
 
       modulePackage = lib.mkOption {

nixos/tests/all-tests.nix

@@ -129,7 +129,6 @@ in {
   apfs = runTest ./apfs.nix;
   appliance-repart-image = runTest ./appliance-repart-image.nix;
   appliance-repart-image-verity-store = runTest ./appliance-repart-image-verity-store.nix;
-  apply = pkgs.callPackage ../modules/system/activation/apply/checks.nix { };
   apparmor = handleTest ./apparmor.nix {};
   archi = handleTest ./archi.nix {};
   aria2 = handleTest ./aria2.nix {};
@@ -704,17 +703,7 @@ in {
   nixos-generate-config = handleTest ./nixos-generate-config.nix {};
   nixos-rebuild-install-bootloader = handleTestOn ["x86_64-linux"] ./nixos-rebuild-install-bootloader.nix {};
   nixos-rebuild-specialisations = runTestOn ["x86_64-linux"] ./nixos-rebuild-specialisations.nix;
-  nixos-rebuild-specialisations-legacy = runTestOn ["x86_64-linux"] {
-    name = mkForce "nixos-rebuild-specialisations-legacy";
-    imports = [ ./nixos-rebuild-specialisations.nix ];
-    extraBaseModules = { system.apply.enable = false; };
-  };
   nixos-rebuild-target-host = runTest ./nixos-rebuild-target-host.nix;
-  nixos-rebuild-target-host-legacy = runTest {
-    name = mkForce "nixos-rebuild-target-host-legacy";
-    imports = [ ./nixos-rebuild-target-host.nix ];
-    extraBaseModules = { system.apply.enable = false; };
-  };
   nixpkgs = pkgs.callPackage ../modules/misc/nixpkgs/test.nix { inherit evalMinimalConfig; };
   nixseparatedebuginfod = handleTest ./nixseparatedebuginfod.nix {};
   node-red = handleTest ./node-red.nix {};

nixos/tests/postgresql-wal-receiver.nix

@@ -22,8 +22,8 @@ let
       replicationUser = "wal_receiver_user";
       replicationSlot = "wal_receiver_slot";
       replicationConn = "postgresql://${replicationUser}@localhost";
-      baseBackupDir = "/tmp/pg_basebackup";
-      walBackupDir = "/tmp/pg_wal";
+      baseBackupDir = "/var/cache/wals/pg_basebackup";
+      walBackupDir = "/var/cache/wals/pg_wal";
 
       recoveryFile = pkgs.writeTextDir "recovery.signal" "";
 
@@ -32,6 +32,10 @@ let
       meta.maintainers = with lib.maintainers; [ pacien ];
 
       nodes.machine = { ... }: {
+        systemd.tmpfiles.rules = [
+          "d /var/cache/wals 0750 postgres postgres - -"
+        ];
+
         services.postgresql = {
           package = pkg;
           enable = true;
@@ -60,6 +64,7 @@ let
         # This is only to speedup test, it isn't time racing. Service is set to autorestart always,
         # default 60sec is fine for real system, but is too much for a test
         systemd.services.postgresql-wal-receiver-main.serviceConfig.RestartSec = lib.mkForce 5;
+        systemd.services.postgresql.serviceConfig.ReadWritePaths = [ "/var/cache/wals" ];
       };
 
       testScript = ''

nixos/tests/postgresql.nix

@@ -126,6 +126,8 @@ let
       with subtest("Initdb works"):
           machine.succeed("sudo -u postgres initdb -D /tmp/testpostgres2")
 
+      machine.log(machine.execute("systemd-analyze security postgresql.service | grep -v ✓")[1])
+
       machine.shutdown()
     '';
 

pkgs/applications/audio/easyaudiosync/0001-fix-project-name.patch

@@ -1,5 +1,5 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 7065538..b2716e1 100644
+index 34f3094..b161ba8 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
 @@ -4,7 +4,7 @@ if (VCPKG)
@@ -8,6 +8,6 @@ index 7065538..b2716e1 100644
  
 -project("Easy Audio Sync"
 +project("easyaudiosync"
-   VERSION 1.1.1
+   VERSION 1.1.2
    DESCRIPTION "Audio library syncing and conversion utility"
    HOMEPAGE_URL "https://github.com/complexlogic/EasyAudioSync"

pkgs/applications/audio/easyaudiosync/0002-fix-qt67-deprecated-methods.patch

@@ -1,21 +0,0 @@
-diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
-index e7befae..8689f13 100644
---- a/src/CMakeLists.txt
-+++ b/src/CMakeLists.txt
-@@ -43,11 +43,14 @@ configure_file("${PROJECT_SOURCE_DIR}/translations/languages.hpp.in" "${PROJECT_
- 
- # Make lupdate target for Qt 6
- if (${QT_VERSION} VERSION_GREATER_EQUAL "6")
--  qt_add_lupdate(${EXECUTABLE_NAME}
-+  qt_add_lupdate(
-     TS_FILES ${TS_FILES} "${PROJECT_SOURCE_DIR}/translations/source.ts"
-+    SOURCE_TARGETS ${EXECUTABLE_NAME}
-   )
- endif ()
--qt_add_translation(QM_FILES "${TS_FILES}")
-+qt_add_translations(
-+  ${EXECUTABLE_NAME} 
-+)
- foreach (FILE ${QM_FILES})
-   get_filename_component(BASENAME ${FILE} NAME)
-   string(APPEND TRANSLATION_FILES "    <file>${BASENAME}</file>\n")

pkgs/applications/audio/easyaudiosync/default.nix

@@ -15,18 +15,17 @@
 
 stdenv.mkDerivation rec {
   pname = "easyaudiosync";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "complexlogic";
     repo = "EasyAudioSync";
     rev = "v${version}";
-    hash = "sha256-w98tj9BuixPhuDgwn74EYY0gvKH6kbfQmtg030RWRU0=";
+    hash = "sha256-UCOL4DzynKjNDvS0HZ4/K+Wn5lOqHZ0bNop0zqJl5kc=";
   };
 
   patches = [
     ./0001-fix-project-name.patch
-    ./0002-fix-qt67-deprecated-methods.patch
     ./0003-fix-darwin-app.patch
     ./0004-force-qt6.patch
   ];

pkgs/applications/audio/grandorgue/darwin-fixes.patch

@@ -0,0 +1,13 @@
+diff --git a/resources/CMakeLists.txt b/resources/CMakeLists.txt
+index d231e3d1..73f389a2 100644
+--- a/resources/CMakeLists.txt
++++ b/resources/CMakeLists.txt
+@@ -62,7 +62,7 @@ if(WIN32)
+ 		     DEPENDS "${CMAKE_SOURCE_DIR}/resources/GrandOrgue.manifest")
+   LIST(APPEND DEPLIST "${RESOURCEDIR}/GOIcon.ico" "${RESOURCEDIR}/GrandOrgue.rc" "${RESOURCEDIR}/GrandOrgue.manifest")
+ elseif(APPLE)
+-   ADD_CUSTOM_COMMAND(OUTPUT "${RESOURCEDIR}/GrandOrgue.icns" COMMAND iconutil -c icns --output "${RESOURCEDIR}/GrandOrgue.icns" ${GENERATED_ICONS_DIR} DEPENDS ${GENERATED_ICONS})
++   ADD_CUSTOM_COMMAND(OUTPUT "${RESOURCEDIR}/GrandOrgue.icns" COMMAND png2icns "${RESOURCEDIR}/GrandOrgue.icns" ${GENERATED_ICONS_DIR}/*{16,32,128,256,512,1024}.png DEPENDS ${GENERATED_ICONS})
+    INSTALL(FILES "${RESOURCEDIR}/GrandOrgue.icns" DESTINATION "${RESOURCEINSTDIR}")
+    LIST(APPEND DEPLIST "${RESOURCEDIR}/GrandOrgue.icns")
+ elseif(UNIX)

pkgs/applications/audio/grandorgue/default.nix

@@ -21,22 +21,17 @@
 
 stdenv.mkDerivation rec {
   pname = "grandorgue";
-  version = "3.15.1-1";
+  version = "3.15.2-1";
 
   src = fetchFromGitHub {
     owner = "GrandOrgue";
     repo = "grandorgue";
     rev = version;
     fetchSubmodules = true;
-    hash = "sha256-5uAA878OBc04PkUgCwoRtc6lIASivq3YcfFffTae6uM=";
+    hash = "sha256-U0DAWCzhXqdL2klSFQjnLiWp7yTdw/n0dmNUJSAg/5c=";
   };
 
-  postPatch = ''
-    substituteInPlace resources/CMakeLists.txt \
-      --replace \
-        "iconutil -c icns \''${GENERATED_ICONS_DIR}" \
-        "png2icns \''${GENERATED_ICONS_DIR}/../GrandOrgue.icns \''${GENERATED_ICONS_DIR}/*{16,32,128,256,512,1024}.png" \
-  '';
+  patches = [ ./darwin-fixes.patch ];
 
   nativeBuildInputs = [ cmake pkg-config imagemagick libicns makeWrapper ];
 

pkgs/applications/audio/mympd/default.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mympd";
-  version = "18.0.0";
+  version = "18.1.2";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-h88wqKwkxY/5uOU0SQp8vb4ri3Ndi3ezHPTDFJGVE2Q=";
+    sha256 = "sha256-4BGW7jDeqwhbAi1LODeiFrmBIzv0qAMKT3IVRgYn87E=";
   };
 
   nativeBuildInputs = [

pkgs/applications/audio/r128gain/default.nix

@@ -9,13 +9,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "r128gain";
-  version = "1.0.3";
+  version = "1.0.7";
 
   src = fetchFromGitHub {
     owner = "desbma";
     repo = "r128gain";
     rev = version;
-    sha256 = "0w2i2szajv1vcmc96w0fczdr8xc28ijcf1gdg180f21gi6yh96sc";
+    sha256 = "sha256-JyKacDqjIKTNl2GjbJPkgbakF8HR4Jd4czAtOaemDH8=";
   };
 
   patches = [

pkgs/applications/audio/r128gain/ffmpeg-location.patch

@@ -1,29 +1,31 @@
---- i/r128gain/__init__.py
-+++ w/r128gain/__init__.py
-@@ -78,7 +78,7 @@ def get_ffmpeg_lib_versions(ffmpeg_path=None):
-   Example: 0x3040100 for FFmpeg 3.4.1
-   """
-   r = collections.OrderedDict()
--  cmd = (ffmpeg_path or "ffmpeg", "-version")
-+  cmd = (ffmpeg_path or "@ffmpeg@/bin/ffmpeg", "-version")
-   output = subprocess.run(cmd,
-                           check=True,
-                           stdout=subprocess.PIPE,
-@@ -156,7 +156,7 @@ def get_r128_loudness(audio_filepaths, *, calc_peak=True, enable_ffmpeg_threadin
-                                      os.devnull,
-                                      **additional_ffmpeg_args,
-                                      f="null").global_args("-hide_banner", "-nostats"),
--                       cmd=ffmpeg_path or "ffmpeg")
-+                       cmd=ffmpeg_path or "@ffmpeg@/bin/ffmpeg")
+diff --git a/r128gain/__init__.py b/r128gain/__init__.py
+index 79a5cbd..d8f13ba 100755
+--- a/r128gain/__init__.py
++++ b/r128gain/__init__.py
+@@ -86,7 +86,7 @@ def get_ffmpeg_lib_versions(ffmpeg_path: Optional[str] = None) -> Dict[str, int]
+     Example: 0x3040100 for FFmpeg 3.4.1
+     """
+     r = collections.OrderedDict()
+-    cmd = (ffmpeg_path or "ffmpeg", "-version")
++    cmd = (ffmpeg_path or "@ffmpeg@/bin/ffmpeg", "-version")
+     output_str = subprocess.run(cmd, check=True, stdout=subprocess.PIPE, universal_newlines=True).stdout
+     output_lines = output_str.splitlines()
+     lib_version_regex = re.compile(r"^\s*(lib[a-z]+)\s+([0-9]+).\s*([0-9]+).\s*([0-9]+)\s+")
+@@ -194,7 +194,7 @@ def get_r128_loudness(  # noqa: C901
+         ffmpeg.output(*output_streams, os.devnull, **additional_ffmpeg_args, f="null").global_args(
+             "-hide_banner", "-nostats"
+         ),
+-        cmd=ffmpeg_path or "ffmpeg",
++        cmd=ffmpeg_path or "@ffmpeg@/bin/ffmpeg",
+     )
  
-   # run
-   logger().debug(cmd_to_string(cmd))
-@@ -740,7 +740,7 @@ def cl_main():
-                           help="Maximum number of tracks to scan in parallel. If not specified, autodetect CPU count")
-   arg_parser.add_argument("-f",
-                           "--ffmpeg-path",
--                          default=shutil.which("ffmpeg"),
-+                          default="@ffmpeg@/bin/ffmpeg",
-                           help="""Full file path of ffmpeg executable (only needed if not in PATH).
-                                   If not specified, autodetect""")
-   arg_parser.add_argument("-d",
+     # run
+@@ -885,7 +885,7 @@ def cl_main() -> None:
+     arg_parser.add_argument(
+         "-f",
+         "--ffmpeg-path",
+-        default=shutil.which("ffmpeg"),
++        default="@ffmpeg@/bin/ffmpeg",
+         help="""Full file path of ffmpeg executable (only needed if not in PATH).
+                 If not specified, autodetect""",
+     )

pkgs/applications/audio/shortwave/default.nix

@@ -1,87 +0,0 @@
-{ stdenv
-, lib
-, fetchFromGitLab
-, cargo
-, dbus
-, desktop-file-utils
-, gdk-pixbuf
-, gettext
-, gitMinimal
-, glib
-, gst_all_1
-, gtk4
-, libadwaita
-, meson
-, ninja
-, openssl
-, pkg-config
-, rustPlatform
-, rustc
-, sqlite
-, wrapGAppsHook4
-, cmake
-, libshumate
-}:
-
-stdenv.mkDerivation rec {
-  pname = "shortwave";
-  version = "3.2.0";
-
-  src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    owner = "World";
-    repo = "Shortwave";
-    rev = version;
-    sha256 = "sha256-ESZ1yD1IuBar8bv83xMczZbtPtHbWRpe2yMVyr7K5gQ=";
-  };
-
-  cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
-    name = "${pname}-${version}";
-    hash = "sha256-8W46bGAitR2YbZbnsigAZMW5pSFTkDAe5JNaNOH5JfA=";
-  };
-
-  nativeBuildInputs = [
-    desktop-file-utils
-    gettext
-    gitMinimal
-    glib # for glib-compile-schemas
-    meson
-    ninja
-    pkg-config
-    cargo
-    rustPlatform.cargoSetupHook
-    rustc
-    wrapGAppsHook4
-    cmake
-  ];
-
-  buildInputs = [
-    dbus
-    gdk-pixbuf
-    glib
-    gtk4
-    libadwaita
-    openssl
-    sqlite
-    libshumate
-  ] ++ (with gst_all_1; [
-    gstreamer
-    gst-plugins-base
-    gst-plugins-good
-    gst-plugins-bad
-  ]);
-
-  meta = with lib; {
-    homepage = "https://gitlab.gnome.org/World/Shortwave";
-    description = "Find and listen to internet radio stations";
-    mainProgram = "shortwave";
-    longDescription = ''
-      Shortwave is a streaming audio player designed for the GNOME
-      desktop. It is the successor to the older Gradio application.
-    '';
-    maintainers = with maintainers; [ lasandell ];
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-  };
-}

pkgs/applications/editors/mg/default.nix

@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, ncurses, buildPackages }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, ncurses, buildPackages, darwin }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "mg";
   version = "7.3-unstable-2024-06-04";
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   '';
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ ncurses ];
+  buildInputs = [ ncurses ] ++ lib.optional stdenv.isDarwin [ darwin.libutil ];
 
   meta = with lib; {
     description = "Micro GNU/emacs, a portable version of the mg maintained by the OpenBSD team";

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1122,8 +1122,8 @@ let
         mktplcRef = {
           name = "dbclient-jdbc";
           publisher = "cweijan";
-          version = "1.3.4";
-          hash = "sha256-qknooeedRhTvEWSuGXFoO/BczGanYCdMr7WWjthxG+k=";
+          version = "1.3.6";
+          hash = "sha256-CETB2hLaXD7DuNmop/DHjpI8NgHfMGyMMZyfw/Bt1yc=";
         };
         meta = {
           description = "JDBC Adapter For Database Client";
@@ -1724,8 +1724,8 @@ let
         mktplcRef = {
           name = "vsc-material-theme-icons";
           publisher = "Equinusocio";
-          version = "3.5.0";
-          hash = "sha256-XqtyZVlsPaPkKB9HdigKSXjCwqXe9wzJWeRcPpS6EVM=";
+          version = "3.8.8";
+          hash = "sha256-el2hQaq1gZBn2PZ+f+S1fHM/g3V0sX7Chyre04sds8k=";
         };
         meta = {
           description = "Material Theme Icons, the most epic icons theme for Visual Studio Code and Material Theme";
@@ -1852,8 +1852,8 @@ let
         mktplcRef = {
           name = "vscode-jest-runner";
           publisher = "firsttris";
-          version = "0.4.72";
-          hash = "sha256-1nUpOXdteWsyFYJ2uATCcr1SUbeusmbpa09Bkw9/TZM=";
+          version = "0.4.74";
+          hash = "sha256-35Ix6B/vkYQIky9KYsMsxgmRh1LYzBoRs9pMe8M5/rI=";
         };
         meta = {
           description = "Simple way to run or debug a single (or multiple) tests from context-menu";
@@ -2262,8 +2262,8 @@ let
         mktplcRef = {
           name = "HCL";
           publisher = "HashiCorp";
-          version = "0.3.2";
-          hash = "sha256-cxF3knYY29PvT3rkRS8SGxMn9vzt56wwBXpk2PqO0mo=";
+          version = "0.6.0";
+          hash = "sha256-Za2ODrsHR/y0X/FOhVEtbg6bNs439G6rlBHW84EZS60=";
         };
         meta = {
           description = "HashiCorp HCL syntax";
@@ -2694,6 +2694,23 @@ let
         };
       };
 
+      jroesch.lean = buildVscodeMarketplaceExtension rec {
+        mktplcRef = {
+          name = "lean";
+          publisher = "jroesch";
+          version = "0.16.59";
+          hash = "sha256-tXiAM2MBF+Axd0zB7Rlgx8b8FgwlLaZex0++H2DpBls=";
+        };
+        meta = {
+          changelog = "https://github.com/leanprover/vscode-lean/blob/v${mktplcRef.version}/README.md#release-notes";
+          description = "Lean 3 language support for VS Code";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=jroesch.lean";
+          homepage = "https://github.com/leanprover/vscode-lean";
+          license = lib.licenses.asl20;
+          maintainers = with lib.maintainers; [ dotlambda ];
+        };
+      };
+
       julialang.language-julia = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "language-julia";
@@ -3955,8 +3972,8 @@ let
         mktplcRef = {
           name = "ansible";
           publisher = "redhat";
-          version = "2.12.143";
-          hash = "sha256-NEV7sVYJJvapZjk5sylkzijH8qLZ7xzmBzHI7qcj2Ok=";
+          version = "24.10.0";
+          hash = "sha256-NDIGyVCo3Az6oncnKR9PXXnZ4ynwF7HBeIiNyiGTPko=";
         };
         meta = {
           description = "Ansible language support";
@@ -4547,8 +4564,8 @@ let
         mktplcRef = {
           name = "vscode-stylelint";
           publisher = "stylelint";
-          version = "1.3.0";
-          hash = "sha256-JoCa2d0ayBEuCcQi3Z/90GJ4AIECVz8NCpd+i+9uMeA=";
+          version = "1.4.0";
+          hash = "sha256-CsQBRoVDtNLlkHa6NLmOspkswB/JUMfMuU2dMYDlDnc=";
         };
         meta = {
           description = "Official Stylelint extension for Visual Studio Code";
@@ -5036,8 +5053,8 @@ let
         mktplcRef = {
           name = "intellicode-api-usage-examples";
           publisher = "VisualStudioExptTeam";
-          version = "0.2.8";
-          hash = "sha256-aXAS3QX+mrX0kJqf1LUsvguqRxxC0o+jj1bKQteXPNA=";
+          version = "0.2.9";
+          hash = "sha256-8xBD+WLBaxYt8v3+8lvV2SiqV89iE4jeQod2kH7LNHU=";
         };
         meta = {
           description = "See relevant code examples from GitHub for over 100K different APIs right in your editor";
@@ -5052,8 +5069,8 @@ let
         mktplcRef = {
           name = "vscodeintellicode";
           publisher = "VisualStudioExptTeam";
-          version = "1.2.30";
-          hash = "sha256-f2Gn+W0QHN8jD5aCG+P93Y+JDr/vs2ldGL7uQwBK4lE=";
+          version = "1.3.2";
+          hash = "sha256-2zexyX1YKD5jgtsvDx7/z3luh5We71ys+XRlVcNywfs=";
         };
         meta = {
           description = "AI-assisted development";
@@ -5155,8 +5172,8 @@ let
         mktplcRef = {
           name = "vscode-java-pack";
           publisher = "vscjava";
-          version = "0.25.2023121402";
-          hash = "sha256-JhVJK2gZe3R6dpynon+9wauSAWPdW4LmG9oRWylCexM=";
+          version = "0.29.2024091906";
+          hash = "sha256-A0WHSqqYVkRN1C3WI7Gd7DZJFDJPYDVsEygDCG67GoQ=";
         };
         meta = {
           description = "Popular extensions for Java development that provides Java IntelliSense, debugging, testing, Maven/Gradle support, project management and more";

pkgs/applications/file-managers/lf/default.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "lf";
-  version = "32";
+  version = "33";
 
   src = fetchFromGitHub {
     owner = "gokcehan";
     repo = "lf";
     rev = "r${version}";
-    hash = "sha256-rFK1M15NcshVY2vtXcMWZhB9Rd/DRC8JyKE5u4wjh2I=";
+    hash = "sha256-aKvTf2tqAUbB3plOemvgJJ7qYdGfQoXhsGVE7Y9wuMo=";
   };
 
-  vendorHash = "sha256-r1Kq6CYGNbxTTue3sb3CKMsWZJDzX2dKX7QHQ73nZ8g=";
+  vendorHash = "sha256-E6uZVsQAiwy3uGXp9COvtJSlgXhXxfS7vOfhM5uBPQw=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/misc/comodoro/default.nix

@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage rec {
 
   meta = with lib; {
     description = "CLI to manage your time";
-    homepage = "https://pimalaya.org/comodoro/";
+    homepage = "https://github.com/pimalaya/comodoro";
     changelog = "https://github.com/soywod/comodoro/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ soywod ];

pkgs/applications/misc/lyx/default.nix

@@ -13,12 +13,12 @@
 }:
 
 mkDerivation rec {
-  version = "2.4.1";
+  version = "2.4.2.1";
   pname = "lyx";
 
   src = fetchurl {
     url = "ftp://ftp.lyx.org/pub/lyx/stable/2.4.x/${pname}-${version}.tar.xz";
-    hash = "sha256-dN4ooH7zeqlHG8mWLbGCFSolMQx9H0f2drubxj2XE8U=";
+    hash = "sha256-HSscer45Hi+0kQneLI4Tp9/mBfJ99o9om/lH36/HpNk=";
   };
 
   # LaTeX is used from $PATH, as people often want to have it with extra pkgs

pkgs/applications/misc/xca/default.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xca";
-  version = "2.7.0";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "chris2511";
     repo = "xca";
     rev = "RELEASE.${finalAttrs.version}";
-    hash = "sha256-Ty6j0Fl2smMGxp+1nnD3Fu83bn19gqtRKSA1wDgNZes=";
+    hash = "sha256-2TqqHTutG+5YU2mJNTS3pvtEqV7qKVB+j/dipdmEkIk=";
   };
 
   buildInputs = [ openssl qtbase ];
@@ -36,6 +36,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  dontWrapQtApps = stdenv.hostPlatform.isDarwin;
+
+  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p "$out/Applications"
+    mv "$out/xca.app" "$out/Applications/xca.app"
+  '';
+
   meta = with lib; {
     description = "X509 certificate generation tool, handling RSA, DSA and EC keys, certificate signing requests (PKCS#10) and CRLs";
     mainProgram = "xca";

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -1,11 +1,11 @@
 {
   stable = {
     chromedriver = {
-      hash_darwin = "sha256-SZfl93TcaD9j59zGflPFmHgIP5NaS8bgDi3l3SRRFiI=";
+      hash_darwin = "sha256-4uE34f99fTiG5FJq0xnEodqQvNT2Aa8kesYOxY44xXA=";
       hash_darwin_aarch64 =
-        "sha256-wLX63aA8l+23ehdBHPcXtoZ2WEhrmYVKzqUDBbrhSRw=";
-      hash_linux = "sha256-kP6N7fM+7+S3JwT2JvqfWDRCfAQiNc/rQlHxjJ8DNuo=";
-      version = "130.0.6723.69";
+        "sha256-gDrfR5EgBx3YRxf3/08gayOhmEqSw4G/QcuNtfHmRHk=";
+      hash_linux = "sha256-qMlM6ilsIqm8G5KLE4uGVb/s2bNyZSyQmxsq+EHKX/c=";
+      version = "130.0.6723.91";
     };
     deps = {
       gn = {
@@ -15,8 +15,8 @@
         version = "2024-09-09";
       };
     };
-    hash = "sha256-k0epbUw9D3Vx7ELNDXIFEnsML+cYvDnHZFOW0kz4Kq8=";
-    version = "130.0.6723.69";
+    hash = "sha256-qXCcHas3l3viszDtY5d5JEToPo2hHTaBmi+pJlKQr4M=";
+    version = "130.0.6723.91";
   };
   ungoogled-chromium = {
     deps = {
@@ -27,11 +27,11 @@
         version = "2024-09-09";
       };
       ungoogled-patches = {
-        hash = "sha256-usNlX/ol8Zn3lQTvp311DuyYbSHF/HN0r7k8qeUIJmU=";
-        rev = "130.0.6723.69-1";
+        hash = "sha256-LhCrwOwPmEn5xlBLTgp2NMfQLxYbSg0pdZxshoqQAGw=";
+        rev = "130.0.6723.91-1";
       };
     };
-    hash = "sha256-k0epbUw9D3Vx7ELNDXIFEnsML+cYvDnHZFOW0kz4Kq8=";
-    version = "130.0.6723.69";
+    hash = "sha256-qXCcHas3l3viszDtY5d5JEToPo2hHTaBmi+pJlKQr4M=";
+    version = "130.0.6723.91";
   };
 }

pkgs/applications/networking/browsers/microsoft-edge/browser.nix

@@ -1,197 +0,0 @@
-{ channel, version, revision, hash }:
-
-{ stdenv
-, fetchurl
-, lib
-, makeWrapper
-
-, binutils-unwrapped
-, xz
-, gnutar
-, file
-
-, glibc
-, glib
-, nss
-, nspr
-, atk
-, at-spi2-atk
-, xorg
-, cups
-, dbus
-, expat
-, libdrm
-, libxkbcommon
-, pipewire
-, gtk3
-, pango
-, cairo
-, gdk-pixbuf
-, mesa
-, alsa-lib
-, at-spi2-core
-, libuuid
-, systemd
-, wayland
-, libGL
-
-# command line arguments which are always set e.g "--disable-gpu"
-, commandLineArgs ? ""
-}:
-
-let
-
-  baseName = "microsoft-edge";
-
-  shortName = if channel == "stable"
-              then "msedge"
-              else "msedge-" + channel;
-
-  longName = if channel == "stable"
-             then baseName
-             else baseName + "-" + channel;
-
-  iconSuffix = lib.optionalString (channel != "stable") "_${channel}";
-
-  desktopSuffix = lib.optionalString (channel != "stable") "-${channel}";
-in
-
-stdenv.mkDerivation rec {
-  pname="${baseName}-${channel}";
-  inherit version;
-
-  src = fetchurl {
-    url = "https://packages.microsoft.com/repos/edge/pool/main/m/${baseName}-${channel}/${baseName}-${channel}_${version}-${revision}_amd64.deb";
-    inherit hash;
-  };
-
-  nativeBuildInputs = [
-    makeWrapper
-  ];
-
-  unpackCmd = "${binutils-unwrapped}/bin/ar p $src data.tar.xz | ${xz}/bin/xz -dc | ${gnutar}/bin/tar -xf -";
-  sourceRoot = ".";
-
-  dontPatch = true;
-  dontConfigure = true;
-  dontPatchELF = true;
-
-  buildPhase = let
-    libPath = {
-      msedge = lib.makeLibraryPath [
-        glibc glib nss nspr atk at-spi2-atk xorg.libX11
-        xorg.libxcb cups.lib dbus.lib expat libdrm
-        xorg.libXcomposite xorg.libXdamage xorg.libXext
-        xorg.libXfixes xorg.libXrandr libxkbcommon
-        pipewire gtk3 pango cairo gdk-pixbuf mesa
-        alsa-lib at-spi2-core xorg.libxshmfence systemd wayland
-      ];
-      naclHelper = lib.makeLibraryPath [
-        glib nspr atk libdrm xorg.libxcb mesa xorg.libX11
-        xorg.libXext dbus.lib libxkbcommon
-      ];
-      libwidevinecdm = lib.makeLibraryPath [
-        glib nss nspr
-      ];
-      libGLESv2 = lib.makeLibraryPath [
-        xorg.libX11 xorg.libXext xorg.libxcb wayland libGL
-      ];
-      liboneauth = lib.makeLibraryPath [
-        libuuid xorg.libX11
-      ];
-    };
-  in ''
-    patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath "${libPath.msedge}" \
-      opt/microsoft/${shortName}/msedge
-
-    patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      opt/microsoft/${shortName}/msedge-sandbox
-
-    patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      opt/microsoft/${shortName}/msedge_crashpad_handler
-
-    patchelf \
-      --set-rpath "${libPath.libwidevinecdm}" \
-      opt/microsoft/${shortName}/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so
-
-    patchelf \
-      --set-rpath "${libPath.libGLESv2}" \
-      opt/microsoft/${shortName}/libGLESv2.so
-
-    patchelf \
-      --set-rpath "${libPath.liboneauth}" \
-      opt/microsoft/${shortName}/liboneauth.so
-  '' + lib.optionalString (lib.versionOlder version "121") ''
-    patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath "${libPath.naclHelper}" \
-      opt/microsoft/${shortName}/nacl_helper
-  '';
-
-  installPhase = ''
-    mkdir -p $out
-    cp -R opt usr/bin usr/share $out
-
-    ${if channel == "stable"
-      then "ln -sf $out/bin/${longName} $out/bin/${baseName}-${channel}"
-      else "ln -sf $out/opt/microsoft/${shortName}/${baseName}-${channel} $out/opt/microsoft/${shortName}/${baseName}"}
-
-    ln -sf $out/opt/microsoft/${shortName}/${longName} $out/bin/${longName}
-
-    rm -rf $out/share/doc
-    rm -rf $out/opt/microsoft/${shortName}/cron
-
-    for icon in '16' '24' '32' '48' '64' '128' '256'
-    do
-      ${ "icon_source=$out/opt/microsoft/${shortName}/product_logo_\${icon}${iconSuffix}.png" }
-      ${ "icon_target=$out/share/icons/hicolor/\${icon}x\${icon}/apps" }
-      mkdir -p $icon_target
-      cp $icon_source $icon_target/microsoft-edge${desktopSuffix}.png
-    done
-
-    substituteInPlace $out/share/applications/${longName}.desktop \
-      --replace /usr/bin/${baseName}-${channel} $out/bin/${longName}
-
-    substituteInPlace $out/share/gnome-control-center/default-apps/${longName}.xml \
-      --replace /opt/microsoft/${shortName} $out/opt/microsoft/${shortName}
-
-    substituteInPlace $out/share/menu/${longName}.menu \
-      --replace /opt/microsoft/${shortName} $out/opt/microsoft/${shortName}
-
-    substituteInPlace $out/opt/microsoft/${shortName}/xdg-mime \
-      --replace "\''${XDG_DATA_DIRS:-/usr/local/share:/usr/share}" "\''${XDG_DATA_DIRS:-/run/current-system/sw/share}" \
-      --replace "xdg_system_dirs=/usr/local/share/:/usr/share/" "xdg_system_dirs=/run/current-system/sw/share/" \
-      --replace /usr/bin/file ${file}/bin/file
-
-    substituteInPlace $out/opt/microsoft/${shortName}/default-app-block \
-      --replace /opt/microsoft/${shortName} $out/opt/microsoft/${shortName}
-
-    substituteInPlace $out/opt/microsoft/${shortName}/xdg-settings \
-      --replace "\''${XDG_DATA_DIRS:-/usr/local/share:/usr/share}" "\''${XDG_DATA_DIRS:-/run/current-system/sw/share}" \
-      --replace "\''${XDG_CONFIG_DIRS:-/etc/xdg}" "\''${XDG_CONFIG_DIRS:-/run/current-system/sw/etc/xdg}"
-  '';
-
-  postFixup = ''
-    wrapProgram "$out/bin/${longName}" \
-      --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.pname}-${gtk3.version}" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
-      --add-flags ${lib.escapeShellArg commandLineArgs}
-  '';
-
-  # We only want automatic updates for stable, beta and dev will get updated by the same script
-  # and are only used for testing.
-  passthru = lib.optionalAttrs (channel == "stable") { updateScript = ./update.py; };
-
-  meta = with lib; {
-    homepage = "https://www.microsoft.com/en-us/edge";
-    description = "Web browser from Microsoft";
-    license = licenses.unfree;
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ zanculmarktum kuwii rhysmdnz ];
-  };
-}

pkgs/applications/networking/browsers/microsoft-edge/default.nix

@@ -1,20 +0,0 @@
-{
-  beta = import ./browser.nix {
-    channel = "beta";
-    version = "130.0.2849.5";
-    revision = "1";
-    hash = "sha256-chvB84+zu6/xgRHyUk33aicc44QJLxxdOOu0ngqmsFM=";
-  };
-  dev = import ./browser.nix {
-    channel = "dev";
-    version = "130.0.2849.1";
-    revision = "1";
-    hash = "sha256-JObqtaaUR6J4rZ90WWw7Ku5Ntl/QBWHo23T7Ohu5p1s=";
-  };
-  stable = import ./browser.nix {
-    channel = "stable";
-    version = "129.0.2792.65";
-    revision = "1";
-    hash = "sha256-xuCtHptE2CG4aiY7gu2sWW3Km4qfB0E/L/PBACIaKOc=";
-  };
-}

pkgs/applications/networking/cluster/arkade/default.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "arkade";
-  version = "0.11.27";
+  version = "0.11.29";
 
   src = fetchFromGitHub {
     owner = "alexellis";
     repo = "arkade";
     rev = version;
-    hash = "sha256-5/QAtaAAiIzpvOl43A4OqnIcKlfdxehGjmCREFRKXTs=";
+    hash = "sha256-B5MgBX8GPjBsfOCa1OoZRhQAUQxKH7GXYKMaH6TsUV4=";
   };
 
   CGO_ENABLED = 0;

pkgs/applications/networking/cluster/kubecm/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubecm";
-  version = "0.31.0";
+  version = "0.32.0";
 
   src = fetchFromGitHub {
     owner = "sunny0826";
     repo = "kubecm";
     rev = "v${version}";
-    hash = "sha256-Go2lroa8lq1XjIzvdA5ZL/lOjTAyDKopBepqgWzsUII=";
+    hash = "sha256-wwAJha576P5Gt70Ys83IS4Pe1qAKvq46ucnjAcRKEKA=";
   };
 
-  vendorHash = "sha256-BrSYfxftrnNOcPgG/rsTF3OukDd+VlOvE7OJcos7vW4=";
+  vendorHash = "sha256-7NW6j5GzOCP0Eb6IVeC9NRtMJl4ujXPWoWu/NvkMxYA=";
   ldflags = [ "-s" "-w" "-X github.com/sunny0826/kubecm/version.Version=${version}"];
 
   doCheck = false;

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -498,13 +498,13 @@
     "vendorHash": "sha256-iJSo5zrJWRpm7kPHxEBBovsn1ICQCNe1fjsp4CdJgBU="
   },
   "google-beta": {
-    "hash": "sha256-9KaTzEbl4kUpl9ttC7VOvstVXcf6R5zNqAUpr/om8nA=",
+    "hash": "sha256-vYMyLjb2OQAVPmc9wSxTCWG1lLUOH/cxayCJPZIF2Bo=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v6.7.0",
+    "rev": "v6.9.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-3cwpIOVynJj9G/sWWXmVbosqlggb5TqMCtMg1pgIGic="
+    "vendorHash": "sha256-N7qOuK/RbmXvpalUQEtop8L99R9Q6cYWVFmPxG4+9T4="
   },
   "googleworkspace": {
     "hash": "sha256-dedYnsKHizxJZibuvJOMbJoux0W6zgKaK5fxIofKqCY=",

pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix

@@ -1,49 +1,34 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , callPackage
-, pkg-config
-, cmake
-, ninja
-, clang
-, lld
-, python3
-, wrapQtAppsHook
-, removeReferencesTo
-, qtbase
-, qtimageformats
-, qtsvg
-, qtwayland
-, kcoreaddons
-, lz4
-, xxHash
-, ffmpeg
-, openalSoft
-, minizip
-, libopus
-, alsa-lib
-, libpulseaudio
-, range-v3
-, tl-expected
-, hunspell
-, gobject-introspection
-, jemalloc
-, rnnoise
-, microsoft-gsl
-, boost
-, libicns
-, darwin
+, libsForQt5
+, yasm
 }:
 
-let
-  tg_owt = callPackage ./tg_owt.nix {
+(libsForQt5.callPackage ../telegram-desktop/default.nix {
+  inherit stdenv;
+
+  tg_owt = (callPackage ../telegram-desktop/tg_owt.nix {
     # tg_owt should use the same compiler
     inherit stdenv;
-  };
+  }).overrideAttrs(oldAttrs: {
+    version = "0-unstable-2024-06-15";
 
-  mainProgram = if stdenv.hostPlatform.isLinux then "kotatogram-desktop" else "Kotatogram";
-in
-stdenv.mkDerivation rec {
+    src = fetchFromGitHub {
+      owner = "desktop-app";
+      repo = "tg_owt";
+      rev = "c9cc4390ab951f2cbc103ff783a11f398b27660b";
+      hash = "sha256-FfWmSYaeryTDbsGJT3R7YK1oiyJcrR7YKKBOF+9PmpY=";
+      fetchSubmodules = true;
+    };
+
+    nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ yasm ];
+  });
+
+  withWebKitGTK = false;
+}).overrideAttrs {
   pname = "kotatogram-desktop";
   version = "1.4.9-unstable-2024-09-27";
 
@@ -59,128 +44,15 @@ stdenv.mkDerivation rec {
     ./macos.patch
     ./macos-opengl.patch
     ./macos-qt5.patch
+    (fetchpatch {
+      url = "https://gitlab.com/mnauw/cppgir/-/commit/c8bb1c6017a6f7f2e47bd10543aea6b3ec69a966.patch";
+      stripLen = 1;
+      extraPrefix = "cmake/external/glib/cppgir/";
+      hash = "sha256-8B4h3BTG8dIlt3+uVgBI569E9eCebcor9uohtsrZpnI=";
+    })
   ];
 
-  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
-    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioInputALSA.cpp \
-      --replace-fail '"libasound.so.2"' '"${alsa-lib}/lib/libasound.so.2"'
-    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioOutputALSA.cpp \
-      --replace-fail '"libasound.so.2"' '"${alsa-lib}/lib/libasound.so.2"'
-    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioPulse.cpp \
-      --replace-fail '"libpulse.so.0"' '"${libpulseaudio}/lib/libpulse.so.0"'
-  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    substituteInPlace Telegram/lib_webrtc/webrtc/platform/mac/webrtc_environment_mac.mm \
-      --replace-fail kAudioObjectPropertyElementMain kAudioObjectPropertyElementMaster
-  '';
-
-  # Wrapping the inside of the app bundles, avoiding double-wrapping
-  dontWrapQtApps = stdenv.hostPlatform.isDarwin;
-
-  nativeBuildInputs = [
-    pkg-config
-    cmake
-    ninja
-    python3
-    wrapQtAppsHook
-    removeReferencesTo
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    # to build bundled libdispatch
-    clang
-    gobject-introspection
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    lld
-  ];
-
-  buildInputs = [
-    qtbase
-    qtimageformats
-    qtsvg
-    lz4
-    xxHash
-    ffmpeg
-    openalSoft
-    minizip
-    libopus
-    range-v3
-    tl-expected
-    rnnoise
-    tg_owt
-    microsoft-gsl
-    boost
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    qtwayland
-    kcoreaddons
-    alsa-lib
-    libpulseaudio
-    hunspell
-    jemalloc
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk_11_0.frameworks; [
-    Cocoa
-    CoreFoundation
-    CoreServices
-    CoreText
-    CoreGraphics
-    CoreMedia
-    OpenGL
-    AudioUnit
-    ApplicationServices
-    Foundation
-    AGL
-    Security
-    SystemConfiguration
-    Carbon
-    AudioToolbox
-    VideoToolbox
-    VideoDecodeAcceleration
-    AVFoundation
-    CoreAudio
-    CoreVideo
-    CoreMediaIO
-    QuartzCore
-    AppKit
-    CoreWLAN
-    WebKit
-    IOKit
-    GSS
-    MediaPlayer
-    IOSurface
-    Metal
-    NaturalLanguage
-    libicns
-  ]);
-
-  enableParallelBuilding = true;
-
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
-  cmakeFlags = [
-    "-DTDESKTOP_API_TEST=ON"
-  ];
-
-  installPhase = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    mkdir -p $out/Applications
-    cp -r ${mainProgram}.app $out/Applications
-    ln -s $out/{Applications/${mainProgram}.app/Contents/MacOS,bin}
-  '';
-
-  preFixup = ''
-    remove-references-to -t ${stdenv.cc.cc} $out/bin/${mainProgram}
-    remove-references-to -t ${microsoft-gsl} $out/bin/${mainProgram}
-    remove-references-to -t ${tg_owt.dev} $out/bin/${mainProgram}
-  '';
-
-  postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    wrapQtApp $out/Applications/${mainProgram}.app/Contents/MacOS/${mainProgram}
-  '';
-
-  passthru = {
-    inherit tg_owt;
-  };
-
   meta = with lib; {
-    inherit mainProgram;
     description = "Kotatogram – experimental Telegram Desktop fork";
     longDescription = ''
       Unofficial desktop client for the Telegram messenger, based on Telegram Desktop.
@@ -192,5 +64,6 @@ stdenv.mkDerivation rec {
     homepage = "https://kotatogram.github.io";
     changelog = "https://github.com/kotatogram/kotatogram-desktop/releases/tag/k{version}";
     maintainers = with maintainers; [ ilya-fedin ];
+    mainProgram = if stdenv.hostPlatform.isLinux then "kotatogram-desktop" else "Kotatogram";
   };
 }

pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/tg_owt.nix

@@ -1,115 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, fetchpatch2
-, pkg-config
-, cmake
-, ninja
-, yasm
-, libjpeg
-, openssl
-, libopus
-, ffmpeg
-, protobuf
-, openh264
-, crc32c
-, libvpx
-, libX11
-, libXtst
-, libXcomposite
-, libXdamage
-, libXext
-, libXrender
-, libXrandr
-, libXi
-, glib
-, abseil-cpp
-, pipewire
-, mesa
-, libdrm
-, libGL
-, darwin
-}:
-
-stdenv.mkDerivation {
-  pname = "tg_owt";
-  version = "0-unstable-2024-06-15";
-
-  src = fetchFromGitHub {
-    owner = "desktop-app";
-    repo = "tg_owt";
-    rev = "c9cc4390ab951f2cbc103ff783a11f398b27660b";
-    sha256 = "sha256-FfWmSYaeryTDbsGJT3R7YK1oiyJcrR7YKKBOF+9PmpY=";
-    fetchSubmodules = true;
-  };
-
-  patches = [
-    # Remove usage of AVCodecContext::reordered_opaque
-    (fetchpatch2 {
-      name = "webrtc-ffmpeg-7.patch";
-      url = "https://webrtc.googlesource.com/src/+/e7d10047096880feb5e9846375f2da54aef91202%5E%21/?format=TEXT";
-      decode = "base64 -d";
-      stripLen = 1;
-      extraPrefix = "src/";
-      hash = "sha256-EdwHeVko8uDsP5GTw2ryWiQgRVCAdPc1me6hySdiwMU=";
-    })
-  ];
-
-  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
-    substituteInPlace src/modules/desktop_capture/linux/wayland/egl_dmabuf.cc \
-      --replace '"libEGL.so.1"' '"${libGL}/lib/libEGL.so.1"' \
-      --replace '"libGL.so.1"' '"${libGL}/lib/libGL.so.1"' \
-      --replace '"libgbm.so.1"' '"${mesa}/lib/libgbm.so.1"' \
-      --replace '"libdrm.so.2"' '"${libdrm}/lib/libdrm.so.2"'
-  '';
-
-  outputs = [ "out" "dev" ];
-
-  nativeBuildInputs = [ pkg-config cmake ninja yasm ];
-
-  propagatedBuildInputs = [
-    libjpeg
-    openssl
-    libopus
-    ffmpeg
-    protobuf
-    openh264
-    crc32c
-    libvpx
-    abseil-cpp
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    libX11
-    libXtst
-    libXcomposite
-    libXdamage
-    libXext
-    libXrender
-    libXrandr
-    libXi
-    glib
-    pipewire
-    mesa
-    libdrm
-    libGL
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [
-    Cocoa
-    AppKit
-    IOKit
-    IOSurface
-    Foundation
-    AVFoundation
-    CoreMedia
-    VideoToolbox
-    CoreGraphics
-    CoreVideo
-    OpenGL
-    Metal
-    MetalKit
-    CoreFoundation
-    ApplicationServices
-  ]);
-
-  enableParallelBuilding = true;
-
-  meta.license = lib.licenses.bsd3;
-}

pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/with-webkit.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, kotatogram-desktop, glib-networking, webkitgtk_6_0, makeWrapper }:
+{ stdenv, lib, kotatogram-desktop, glib-networking, webkitgtk_4_1, makeWrapper }:
 
 stdenv.mkDerivation {
   pname = "${kotatogram-desktop.pname}-with-webkit";
@@ -8,12 +8,13 @@ stdenv.mkDerivation {
   installPhase = ''
     mkdir -p $out
     cp -r ${kotatogram-desktop}/share $out
+    substituteInPlace $out/share/dbus-1/services/* --replace-fail ${kotatogram-desktop} $out
   '';
   postFixup = ''
     mkdir -p $out/bin
     makeWrapper ${kotatogram-desktop}/bin/kotatogram-desktop $out/bin/kotatogram-desktop \
       --prefix GIO_EXTRA_MODULES : ${glib-networking}/lib/gio/modules \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ webkitgtk_6_0 ]}
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ webkitgtk_4_1 ]}
   '';
   meta = kotatogram-desktop.meta // {
     platforms = lib.platforms.linux;

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix

@@ -1,48 +1,44 @@
 { lib
+, stdenv
 , fetchFromGitHub
 , callPackage
 , pkg-config
 , cmake
 , ninja
+, clang
+, lld
 , python3
-, gobject-introspection
-, wrapGAppsHook3
 , wrapQtAppsHook
-, extra-cmake-modules
+, tg_owt ? callPackage ./tg_owt.nix { inherit stdenv; }
 , qtbase
-, qtwayland
-, qtsvg
 , qtimageformats
-, gtk3
-, glib-networking
-, boost
-, fmt
-, libdbusmenu
+, qtsvg
+, qtwayland
+, kcoreaddons
 , lz4
 , xxHash
 , ffmpeg
+, protobuf
 , openalSoft
 , minizip
 , libopus
 , alsa-lib
 , libpulseaudio
-, pipewire
 , range-v3
 , tl-expected
 , hunspell
-, webkitgtk_6_0
+, gobject-introspection
 , jemalloc
 , rnnoise
-, protobuf
-, abseil-cpp
-, xdg-utils
 , microsoft-gsl
-, rlottie
+, boost
 , ada
-, stdenv
-, darwin
-, lld
+, withWebKitGTK ? true
+, wrapGAppsHook3
+, glib-networking
+, webkitgtk_4_1
 , libicns
+, darwin
 , nix-update-script
 }:
 
@@ -53,14 +49,6 @@
 # - https://git.alpinelinux.org/aports/tree/testing/telegram-desktop/APKBUILD
 # - https://github.com/void-linux/void-packages/blob/master/srcpkgs/telegram-desktop/template
 
-let
-  tg_owt = callPackage ./tg_owt.nix {
-    inherit stdenv;
-    abseil-cpp = abseil-cpp.override {
-      cxxStandard = "20";
-    };
-  };
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "telegram-desktop";
   version = "5.6.3";
@@ -75,10 +63,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./macos.patch
-    # the generated .desktop files contains references to unwrapped tdesktop, breaking scheme handling
-    # and the scheme handler is already registered in the packaged .desktop file, rendering this unnecessary
-    # see https://github.com/NixOS/nixpkgs/issues/218370
-    ./scheme.patch
   ];
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
@@ -88,16 +72,19 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail '"libasound.so.2"' '"${alsa-lib}/lib/libasound.so.2"'
     substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioPulse.cpp \
       --replace-fail '"libpulse.so.0"' '"${libpulseaudio}/lib/libpulse.so.0"'
+  '' + lib.optionalString (stdenv.hostPlatform.isLinux && withWebKitGTK) ''
     substituteInPlace Telegram/lib_webview/webview/platform/linux/webview_linux_webkitgtk_library.cpp \
-      --replace-fail '"libwebkitgtk-6.0.so.4"' '"${webkitgtk_6_0}/lib/libwebkitgtk-6.0.so.4"'
+      --replace-fail '"libwebkit2gtk-4.1.so.0"' '"${webkitgtk_4_1}/lib/libwebkit2gtk-4.1.so.0"'
   '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
     substituteInPlace Telegram/lib_webrtc/webrtc/platform/mac/webrtc_environment_mac.mm \
       --replace-fail kAudioObjectPropertyElementMain kAudioObjectPropertyElementMaster
   '';
 
-  # We want to run wrapProgram manually (with additional parameters)
+  # Avoid double-wrapping
   dontWrapGApps = true;
-  dontWrapQtApps = true;
+
+  # Wrapping the inside of the app bundles, avoiding double-wrapping
+  dontWrapQtApps = stdenv.hostPlatform.isDarwin;
 
   nativeBuildInputs = [
     pkg-config
@@ -106,18 +93,19 @@ stdenv.mkDerivation (finalAttrs: {
     python3
     wrapQtAppsHook
   ] ++ lib.optionals stdenv.hostPlatform.isLinux [
+    # to build bundled libdispatch
+    clang
     gobject-introspection
+  ] ++ lib.optionals (stdenv.hostPlatform.isLinux && withWebKitGTK) [
     wrapGAppsHook3
-    extra-cmake-modules
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
     lld
   ];
 
   buildInputs = [
     qtbase
-    qtsvg
     qtimageformats
-    boost
+    qtsvg
     lz4
     xxHash
     ffmpeg
@@ -127,23 +115,21 @@ stdenv.mkDerivation (finalAttrs: {
     range-v3
     tl-expected
     rnnoise
-    protobuf
     tg_owt
     microsoft-gsl
-    rlottie
+    boost
     ada
   ] ++ lib.optionals stdenv.hostPlatform.isLinux [
+    protobuf
     qtwayland
-    gtk3
-    glib-networking
-    fmt
-    libdbusmenu
+    kcoreaddons
     alsa-lib
     libpulseaudio
-    pipewire
     hunspell
-    webkitgtk_6_0
     jemalloc
+  ] ++ lib.optionals (stdenv.hostPlatform.isLinux && withWebKitGTK) [
+    glib-networking
+    webkitgtk_4_1
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk_11_0.frameworks; [
     Cocoa
     CoreFoundation
@@ -185,33 +171,22 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cmakeFlags = [
-    (lib.cmakeBool "DESKTOP_APP_DISABLE_AUTOUPDATE" true)
     # We're allowed to used the API ID of the Snap package:
     (lib.cmakeFeature "TDESKTOP_API_ID" "611335")
     (lib.cmakeFeature "TDESKTOP_API_HASH" "d524b414d21f4d37f08684c1df41ac9c")
-    # See: https://github.com/NixOS/nixpkgs/pull/130827#issuecomment-885212649
-    (lib.cmakeBool "DESKTOP_APP_USE_PACKAGED_FONTS" false)
   ];
 
-  preBuild = ''
-    # for cppgir to locate gir files
-    export GI_GIR_PATH="$XDG_DATA_DIRS"
-  '';
-
   installPhase = lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir -p $out/Applications
     cp -r ${finalAttrs.meta.mainProgram}.app $out/Applications
     ln -s $out/{Applications/${finalAttrs.meta.mainProgram}.app/Contents/MacOS,bin}
   '';
 
-  postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
-    # This is necessary to run Telegram in a pure environment.
-    # We also use gappsWrapperArgs from wrapGAppsHook.
-    wrapProgram $out/bin/${finalAttrs.meta.mainProgram} \
-      "''${gappsWrapperArgs[@]}" \
-      "''${qtWrapperArgs[@]}" \
-      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
-  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
+  preFixup = lib.optionalString (stdenv.hostPlatform.isLinux && withWebKitGTK) ''
+    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
+  postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
     wrapQtApp $out/Applications/${finalAttrs.meta.mainProgram}.app/Contents/MacOS/${finalAttrs.meta.mainProgram}
   '';
 

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/scheme.patch

@@ -1,12 +0,0 @@
-diff --git a/Telegram/SourceFiles/core/application.cpp b/Telegram/SourceFiles/core/application.cpp
-index e3e0de6c6..d5851bd6e 100644
---- a/Telegram/SourceFiles/core/application.cpp
-+++ b/Telegram/SourceFiles/core/application.cpp
-@@ -421,7 +421,6 @@ void Application::run() {
- 
- void Application::autoRegisterUrlScheme() {
- 	if (!OptionSkipUrlSchemeRegister.value()) {
--		InvokeQueued(this, [] { RegisterUrlScheme(); });
- 	}
- }
- 

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/tg_owt.nix

@@ -5,29 +5,31 @@
   fetchpatch2,
   pkg-config,
   cmake,
-  crc32c,
+  ninja,
   python3,
   libjpeg,
   openssl,
   libopus,
   ffmpeg,
   openh264,
+  crc32c,
   libvpx,
-  libXi,
-  libXfixes,
+  libX11,
   libXtst,
   libXcomposite,
   libXdamage,
   libXext,
   libXrender,
   libXrandr,
+  libXi,
   glib,
   abseil-cpp,
   pipewire,
   mesa,
+  libdrm,
   libGL,
-  unstableGitUpdater,
   darwin,
+  unstableGitUpdater,
 }:
 
 stdenv.mkDerivation {
@@ -38,7 +40,7 @@ stdenv.mkDerivation {
     owner = "desktop-app";
     repo = "tg_owt";
     rev = "dc17143230b5519f3c1a8da0079e00566bd4c5a8";
-    sha256 = "sha256-7j7hBIOXEdNJDnDSVUqy234nkTCaeZ9tDAzqvcuaq0o=";
+    hash = "sha256-7j7hBIOXEdNJDnDSVUqy234nkTCaeZ9tDAzqvcuaq0o=";
     fetchSubmodules = true;
   };
 
@@ -54,36 +56,50 @@ stdenv.mkDerivation {
     })
   ];
 
+  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
+    substituteInPlace src/modules/desktop_capture/linux/wayland/egl_dmabuf.cc \
+      --replace-fail '"libEGL.so.1"' '"${lib.getLib libGL}/lib/libEGL.so.1"' \
+      --replace-fail '"libGL.so.1"' '"${lib.getLib libGL}/lib/libGL.so.1"' \
+      --replace-fail '"libgbm.so.1"' '"${lib.getLib mesa}/lib/libgbm.so.1"' \
+      --replace-fail '"libdrm.so.2"' '"${lib.getLib libdrm}/lib/libdrm.so.2"'
+  '';
+
   outputs = [
     "out"
     "dev"
   ];
 
   nativeBuildInputs = [
-    cmake
     pkg-config
+    cmake
+    ninja
     python3
   ];
 
-  buildInputs =
+  propagatedBuildInputs =
     [
-      openssl
       libjpeg
+      openssl
       libopus
       ffmpeg
+      openh264
+      crc32c
+      libvpx
+      abseil-cpp
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
-      glib
-      libXi
+      libX11
+      libXtst
       libXcomposite
       libXdamage
       libXext
-      libXfixes
       libXrender
       libXrandr
-      libXtst
+      libXi
+      glib
       pipewire
       mesa
+      libdrm
       libGL
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin (
@@ -99,6 +115,7 @@ stdenv.mkDerivation {
         VideoToolbox
         CoreGraphics
         CoreVideo
+        OpenGL
         Metal
         MetalKit
         CoreFoundation
@@ -106,18 +123,6 @@ stdenv.mkDerivation {
       ]
     );
 
-  propagatedBuildInputs = [
-    abseil-cpp
-    crc32c
-    openh264
-    libvpx
-  ];
-
-  cmakeFlags = [
-    # Building as a shared library isn't officially supported and may break at any time.
-    (lib.cmakeBool "BUILD_SHARED_LIBS" false)
-  ];
-
   passthru.updateScript = unstableGitUpdater { };
 
   meta = {

pkgs/applications/networking/mullvad-vpn/default.nix

@@ -64,7 +64,7 @@ let
     systemd
   ];
 
-  version = "2024.4";
+  version = "2024.6";
 
   selectSystem = attrs: attrs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
@@ -74,8 +74,8 @@ let
   };
 
   hash = selectSystem {
-    x86_64-linux = "sha256-bsXlOzqGr37AZhEij68Fy2/3Lk50J7A3jHV0re5U6j0=";
-    aarch64-linux = "sha256-6OBCqOnSkXBntFGxXicPU7GSb9+a5WN4rYExgDa08/I=";
+    x86_64-linux = "sha256-paP9W23AbA9O4MiTdF5r7N50GgT4xu2vb9ktfBdPqDM=";
+    aarch64-linux = "sha256-5FRPjiLyWDe7RNlhkiF4NUaCxVkfXZbxeoQxNAAls/I=";
   };
 in
 

pkgs/applications/office/docear/default.nix

@@ -1,45 +0,0 @@
-{lib, stdenv, fetchurl, runtimeShell, makeWrapper
-, oraclejre
-, antialiasFont ? true
-}:
-
-stdenv.mkDerivation {
-  pname = "docear";
-  version = "1.2";
-
-  src = fetchurl {
-    url = "http://docear.org/downloads/docear_linux.tar.gz";
-    sha256 = "1g5n7r2x4gas6dl2fbyh7v9yxdcb6bzml8n3ldmpzv1rncgjcdp4";
-  };
-
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ oraclejre ];
-
-  buildPhase = "";
-  installPhase = ''
-    mkdir -p $out/bin
-    mkdir -p $out/share
-    cp -R * $out/share
-    chmod 0755 $out/share/ -R
-
-    # The wrapper ensures oraclejre is used
-    makeWrapper ${runtimeShell} $out/bin/docear \
-      --set _JAVA_OPTIONS "${lib.optionalString antialiasFont "-Dswing.aatext=TRUE -Dawt.useSystemAAFontSettings=on"}" \
-      --set JAVA_HOME ${oraclejre.home} \
-      --add-flags "$out/share/docear.sh"
-
-    chmod 0755 $out/bin/docear
-    '';
-
-  meta = with lib; {
-    description = "Unique solution to academic literature management";
-    homepage = "http://www.docear.org/";
-    # Licenses at: http://www.docear.org/software/download/
-    license = with licenses; [
-      gpl2 # for the main software and some dependencies
-      bsd3 # for one of its dependencies
-    ];
-    maintainers = with maintainers; [ unode ];
-    platforms = platforms.all;
-  };
-}

pkgs/applications/office/libreoffice/default.nix

@@ -99,7 +99,7 @@
 , libetonyek
 , liborcus
 , libpng
-, langs ? [ "ar" "ca" "cs" "da" "de" "en-GB" "en-US" "eo" "es" "fi" "fr" "hu" "it" "ja" "ko" "nl" "pl" "pt" "pt-BR" "ro" "ru" "sk" "sl" "tr" "uk" "zh-CN" ]
+, langs ? [ "ar" "ca" "cs" "da" "de" "en-GB" "en-US" "eo" "es" "fi" "fr" "hu" "it" "ja" "ko" "nl" "pl" "pt" "pt-BR" "ro" "ru" "sk" "sl" "tr" "uk" "zh-CN" "zh-TW" ]
 , withFonts ? false
 , withHelp ? true
 , kdeIntegration ? false

pkgs/applications/science/biology/seqkit/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "seqkit";
-  version = "2.8.2";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "shenwei356";
     repo = "seqkit";
     rev = "v${version}";
-    sha256 = "sha256-jCzd36ds9YVBpnyR3gDJSX3CCVXzC9WkQWmkcDiDWfM=";
+    sha256 = "sha256-xPlqS0tYx077YD/MIxGFn8Bdy4h25dY8idhypIj28rI=";
   };
 
-  vendorHash = "sha256-0//kySYhNmfiwiys/Ku0/8RzKpnxO0+byD8pcIkvDY0=";
+  vendorHash = "sha256-EzEomz9GVcirx+Uk1Ygmmb1/GkdUS9aBStLxuNzjHAU=";
 
   meta = with lib; {
     description = "cross-platform and ultrafast toolkit for FASTA/Q file manipulation";

pkgs/applications/science/logic/surelog/default.nix

@@ -12,6 +12,7 @@
 , antlr4
 , capnproto
 , nlohmann_json
+, darwin
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -45,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     capnproto
     antlr4.runtime.cpp
     nlohmann_json
-  ];
+  ] ++ lib.optional stdenv.isDarwin [ darwin.libutil ];
 
   cmakeFlags = [
     "-DSURELOG_USE_HOST_CAPNP=On"

pkgs/applications/science/logic/uhdm/default.nix

@@ -5,6 +5,7 @@
 , python3
 , capnproto
 , gtest
+, darwin
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -28,6 +29,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     capnproto
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.libutil
   ];
 
   cmakeFlags = [

pkgs/applications/science/math/clp/default.nix

@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, coin-utils, zlib, osi }:
 
 stdenv.mkDerivation rec {
-  version = "1.17.9";
+  version = "1.17.10";
   pname = "clp";
   src = fetchFromGitHub {
     owner = "coin-or";
     repo = "Clp";
     rev = "releases/${version}";
-    hash = "sha256-kHCDji+yIf5mCoxKB2b/HaATGmwwIAPEV74tthIMeMY=";
+    hash = "sha256-9IlBT6o1aHAaYw2/39XrUis72P9fesmG3B6i/e+v3mM=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/applications/science/math/pari/gp2c.nix

@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gp2c";
-  version = "0.0.13";
+  version = "0.0.14";
 
   src = fetchurl {
     url = "https://pari.math.u-bordeaux.fr/pub/pari/GP2C/${pname}-${version}.tar.gz";
-    hash = "sha256-JhN07Kc+vXbBEqlZPcootkgSqnYlYf2lpLLCzXmmnTY=";
+    hash = "sha256-r2ESzAKUBFfiOdpEM9Gg2Npg7u8p98xyL2TNSsALezA=";
   };
 
   buildInputs = [

pkgs/applications/search/xlsxgrep/default.nix

@@ -1,21 +0,0 @@
-{ lib, python3Packages, fetchPypi }:
-
-python3Packages.buildPythonApplication rec {
-  pname = "xlsxgrep";
-  version = "0.0.29";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-vgHNu7MVDjULoBiTkk74W8ZLJ02eds60XshTX3iLJGI=";
-  };
-
-  pythonPath = with python3Packages; [ xlrd ];
-
-  meta = with lib; {
-    maintainers = with maintainers; [ felixscheinost ];
-    description = "CLI tool to search text in XLSX and XLS files. It works similarly to Unix/GNU Linux grep";
-    mainProgram = "xlsxgrep";
-    homepage = "https://github.com/zazuum/xlsxgrep";
-    license = licenses.mit;
-  };
-}

pkgs/applications/system/glances/default.nix

@@ -5,20 +5,15 @@
   isPyPy,
   lib,
   defusedxml,
-  future,
-  ujson,
   packaging,
   psutil,
   setuptools,
-  pydantic,
   # Optional dependencies:
   fastapi,
   jinja2,
-  orjson,
   pysnmp,
   hddtemp,
   netifaces, # IP module
-  py-cpuinfo,
   uvicorn,
   requests,
   prometheus-client,
@@ -26,16 +21,20 @@
 
 buildPythonApplication rec {
   pname = "glances";
-  version = "4.1.2.1";
+  version = "4.2.0";
+  pyproject = true;
+
   disabled = isPyPy;
 
   src = fetchFromGitHub {
     owner = "nicolargo";
     repo = "glances";
     rev = "refs/tags/v${version}";
-    hash = "sha256-SlKt+wjzI9QRmMVvbIERuhQuCCaOh7L89WuNUXNhkuI=";
+    hash = "sha256-liyrMaqBgK7UZjWIKIgIFbskTGaWfyrK8L74DKmaDmY=";
   };
 
+  build-system = [ setuptools ];
+
   # On Darwin this package segfaults due to mismatch of pure and impure
   # CoreFoundation. This issues was solved for binaries but for interpreted
   # scripts a workaround below is still required.
@@ -46,27 +45,27 @@ buildPythonApplication rec {
     "/System/Library/Frameworks"
   ];
 
-  doCheck = true;
-  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    export DYLD_FRAMEWORK_PATH=/System/Library/Frameworks
+  # some tests fail in darwin sandbox
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
+  checkPhase = ''
+    runHook preCheck
+
+    python unittest-core.py
+
+    runHook postCheck
   '';
 
-  propagatedBuildInputs = [
+  dependencies = [
     defusedxml
-    future
-    ujson
     netifaces
     packaging
     psutil
     pysnmp
-    setuptools
-    py-cpuinfo
-    pydantic
     fastapi
     uvicorn
     requests
     jinja2
-    orjson
     prometheus-client
   ] ++ lib.optional stdenv.hostPlatform.isLinux hddtemp;
 

pkgs/applications/version-management/fnc/default.nix

@@ -1,4 +1,4 @@
-{ lib, fetchurl, stdenv, zlib, ncurses, libiconv }:
+{ lib, fetchurl, stdenv, zlib, ncurses, libiconv, darwin }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fnc";
@@ -9,7 +9,9 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-npS+sOxF0S/9TuFjtEFlev0HpIOsaP6zmcfopPNUehk=";
   };
 
-  buildInputs = [ libiconv ncurses zlib ];
+  buildInputs = [ libiconv ncurses zlib ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.libutil
+  ];
 
   makeFlags = [ "PREFIX=$(out)" ];
 

pkgs/applications/version-management/gql/default.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gql";
-  version = "0.28.0";
+  version = "0.29.1";
 
   src = fetchFromGitHub {
     owner = "AmrDeveloper";
     repo = "GQL";
     rev = version;
-    hash = "sha256-BA94Q8nRf4NptVBHSMYLMEklB9vHaXRU1+o7shXhkZQ=";
+    hash = "sha256-Py2wTWuUfr6Poxtab4JikG4D7Iv6mBocLEbn0zgz+k8=";
   };
 
-  cargoHash = "sha256-L+o0ZhTI7x01DpGuhWrvzvSZDYHc++31svWTJ41qx90=";
+  cargoHash = "sha256-BAaHnBkTmk58uAnZyZ7id1WmKz/HiOKSvdZApmgk6rs=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/video/go-chromecast/default.nix

@@ -1,25 +0,0 @@
-{ lib, buildGoModule, fetchFromGitHub }:
-
-buildGoModule rec {
-  pname = "go-chromecast";
-  version = "0.3.1";
-
-  src = fetchFromGitHub {
-    owner = "vishen";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-Kzo8iWj4mtnX1Jxm2sLsnmEOmpzScxWHZ/sLYYm3vQI=";
-  };
-
-  vendorHash = "sha256-cEUlCR/xtPJJSWplV1COwV6UfzSmVArF4V0pJRk+/Og=";
-
-  ldflags = [ "-s" "-w" "-X main.version=${version}" "-X main.commit=${src.rev}" "-X main.date=unknown" ];
-
-  meta = with lib; {
-    homepage = "https://github.com/vishen/go-chromecast";
-    description = "CLI for Google Chromecast, Home devices and Cast Groups";
-    license = licenses.asl20;
-    maintainers = [ ];
-    mainProgram = "go-chromecast";
-  };
-}

pkgs/applications/video/mlv-app/aarch64-flags.patch

@@ -2,12 +2,12 @@ diff --git a/platform/qt/MLVApp.pro b/platform/qt/MLVApp.pro
 index ebdc552..3e37573 100644
 --- a/platform/qt/MLVApp.pro
 +++ b/platform/qt/MLVApp.pro
-@@ -84,7 +84,7 @@ win32{
+@@ -120,7 +120,7 @@ win32{
 
  # Linux
  linux-g++*{
--    QMAKE_CFLAGS += -O3 -fopenmp -msse4.1 -mssse3 -msse3 -msse2 -msse -std=c99
-+    QMAKE_CFLAGS += -O3 -fopenmp -std=c99
-     QMAKE_CXXFLAGS += -fopenmp
+-    QMAKE_CFLAGS += -O3 -fopenmp -msse4.1 -mssse3 -msse3 -msse2 -msse -std=c99 -ftree-vectorize
++    QMAKE_CFLAGS += -O3 -fopenmp -std=c99 -ftree-vectorize
+     QMAKE_CXXFLAGS += -fopenmp -std=c++11 -ftree-vectorize
      LIBS += -lgomp
  }

pkgs/applications/video/mlv-app/default.nix

@@ -18,7 +18,10 @@ mkDerivation rec {
     sha256 = "sha256-RfZXHmWSjZBxNFwQ/bzHppsLS0LauURIdnkAzxAIBcU=";
   };
 
-  patches = if stdenv.hostPlatform.isAarch64 then ./aarch64-flags.patch else null;
+  patches = lib.optionals stdenv.hostPlatform.isAarch64 [
+    # remove optimization flags with x86 only instruction sets
+    ./aarch64-flags.patch
+  ];
 
   installPhase = ''
     runHook preInstall

pkgs/applications/virtualization/distrobox/default.nix

@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "distrobox";
-  version = "1.7.2.1";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "89luca89";
     repo = "distrobox";
     rev = finalAttrs.version;
-    hash = "sha256-H2jeKs0h4ZAcP33HB5jptlubq62cwnjPK2wSlEIfFWA=";
+    hash = "sha256-e9oSTk+UlkrkRSipqjjMqwtxEvEZffVBmlSTmsIT7cU=";
   };
 
   dontConfigure = true;
@@ -16,12 +16,14 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ makeWrapper ];
 
+  patches = [
+    # https://github.com/89luca89/distrobox/issues/408
+    ./relative-default-icon.patch
+  ];
+
   installPhase = ''
     runHook preInstall
 
-    # https://github.com/89luca89/distrobox/issues/408
-    substituteInPlace ./distrobox-generate-entry \
-      --replace-fail 'icon_default="''${HOME}/.local' "icon_default=\"$out"
     ./install -P $out
 
     runHook postInstall

pkgs/applications/virtualization/distrobox/relative-default-icon.patch

@@ -0,0 +1,26 @@
+diff --git a/distrobox-generate-entry b/distrobox-generate-entry
+index 65fcea0..8d57e4e 100755
+--- a/distrobox-generate-entry
++++ b/distrobox-generate-entry
+@@ -51,7 +51,7 @@ container_manager="autodetect"
+ container_name_default="my-distrobox"
+ delete=0
+ icon="auto"
+-icon_default="${XDG_DATA_HOME:-${HOME}/.local/share}/icons/terminal-distrobox-icon.svg"
++icon_default="terminal-distrobox-icon"
+ verbose=0
+ online=0
+ version="1.8.0"
+@@ -335,12 +335,6 @@ if [ "${icon}" = "auto" ]; then
+ 
+ 	icon_url="$(echo "${DISTRO_ICON_MAP}" | grep "${container_distro}:" | cut -d':' -f2-)"
+ 
+-	# Distro not found in our map, fallback to generic icon
+-	if [ -z "${icon_url}" ]; then
+-		icon_url="https://raw.githubusercontent.com/89luca89/distrobox/main/icons/terminal-distrobox-icon.svg"
+-		container_distro="terminal-distrobox-icon"
+-	fi
+-
+ 	if [ -n "${icon_url}" ] && [ "${download}" != "null" ]; then
+ 		icon_extension="${icon_url##*.}"
+ 

pkgs/build-support/setup-hooks/mpi-check-hook/mpi-check-hook.sh

@@ -6,7 +6,6 @@ setupMpiCheck() {
   # Find out which MPI implementation we are using
   # and set safe defaults that are guaranteed to run
   # on any build machine
-
   mpiType="NONE"
 
   # OpenMPI signature
@@ -41,6 +40,10 @@ setupMpiCheck() {
       export OMPI_MCA_rmaps_base_oversubscribe=1
       export PRTE_MCA_rmaps_default_mapping_policy=node:oversubscribe
 
+      # Make sure we do not need openssh in the checkPhase
+      export OMPI_MCA_plm_ssh_agent=false
+      export PRRTE_MCA_plm_ssh_agent=false
+
       # Disable CPU pinning
       export OMPI_MCA_hwloc_base_binding_policy=none
       export PRTE_MCA_hwloc_default_binding_policy=none

pkgs/build-support/trivial-builders/default.nix

@@ -82,6 +82,7 @@ rec {
     , destination ? ""
     , checkPhase ? ""
     , meta ? { }
+    , passthru ? { }
     , allowSubstitutes ? false
     , preferLocalBuild ? true
     , derivationArgs ? { }
@@ -105,7 +106,8 @@ rec {
           {
             mainProgram = lib.head matches;
           } // meta // derivationArgs.meta or {};
-      } // removeAttrs derivationArgs [ "passAsFile" "meta" ])
+        passthru = passthru // derivationArgs.passthru or {};
+      } // removeAttrs derivationArgs [ "passAsFile" "meta" "passthru" ])
       ''
         target=$out${lib.escapeShellArg destination}
         mkdir -p "$(dirname "$target")"
@@ -220,6 +222,12 @@ rec {
          Type: AttrSet
        */
       meta ? { },
+      /*
+         `stdenv.mkDerivation`'s `passthru` argument.
+
+         Type: AttrSet
+       */
+      passthru ? { },
       /*
          The `checkPhase` to run. Defaults to `shellcheck` on supported
          platforms and `bash -n`.
@@ -263,7 +271,7 @@ rec {
       derivationArgs ? { },
     }:
     writeTextFile {
-      inherit name meta derivationArgs;
+      inherit name meta passthru derivationArgs;
       executable = true;
       destination = "/bin/${name}";
       allowSubstitutes = true;
@@ -366,9 +374,10 @@ rec {
     , destination ? ""   # relative path appended to $out eg "/bin/foo"
     , checkPhase ? ""    # syntax checks, e.g. for scripts
     , meta ? { }
+    , passthru ? { }
     }:
     runCommandLocal name
-      { inherit files executable checkPhase meta destination; }
+      { inherit files executable checkPhase meta passthru destination; }
       ''
         file=$out$destination
         mkdir -p "$(dirname "$file")"

pkgs/by-name/_6/_64gram/package.nix

@@ -28,6 +28,7 @@ telegram-desktop.overrideAttrs (old: rec {
   ];
 
   cmakeFlags = (old.cmakeFlags or []) ++ [
+    (lib.cmakeBool "DESKTOP_APP_DISABLE_AUTOUPDATE" true)
     (lib.cmakeBool "disable_autoupdate" true)
   ];
 

pkgs/by-name/ai/aiken/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "aiken";
-  version = "1.1.4";
+  version = "1.1.5";
 
   src = fetchFromGitHub {
     owner = "aiken-lang";
     repo = "aiken";
     rev = "v${version}";
-    hash = "sha256-PTC7qn8Z1PGcBTNK5MtMvThIEhmAqTj23B/cHHhiDFE=";
+    hash = "sha256-cspIIuH+0LJItTz9wk6mChwEMFP3GDpI+KKg0FWM9bQ=";
   };
 
-  cargoHash = "sha256-p//1TZJ6sJUUDPPpxRBKL7w7MBTUQppbQedj2x4T17w=";
+  cargoHash = "sha256-aylmZFb+UaK3OEpJLOf4NuT4uMLRhdUg+cSjzxRo7t8=";
 
   buildInputs =
     [ openssl ]

pkgs/by-name/an/ansel/package.nix

@@ -77,13 +77,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "ansel";
-  version = "0-unstable-2024-08-13";
+  version = "0-unstable-2024-09-29";
 
   src = fetchFromGitHub {
     owner = "aurelienpierreeng";
     repo = "ansel";
-    rev = "85f2b8b15fe2081634c6f2c3f96b5d430e045bf0";
-    hash = "sha256-w2DziVBoCy1NpH4AoIFmKdjqufopqUeYjAwqkOhxHBc=";
+    rev = "0e942648c4f9b1fd89fee8ca91d6e9bd5e06344c";
+    hash = "sha256-gzIZwbTdGE0+uLScV/JfGW0ZxXIbnnSrYO1OxPS5Xz0=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/az/azure-cli/commit-update-hunks.sh

@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-
-# Just a tiny imperfect helper script to commit generated updates.
-#
-# First, ensure that that `git add -p extensions-generated.nix` only
-# returns a series of clean update hunks, where each hunk updates a
-# single package version. All additions/removals must be committed
-# by hand.
-# The script will then commit the remaining hunks with fitting commit messages.
-
-while true; do
-  echo -e "y\nq" | git add -p extensions-generated.nix || break
-  pname=$(git diff --no-ext-diff --cached | grep "pname =" | cut -d'"' -f2 | head -n1) || break
-  versions=$(git diff --no-ext-diff --cached | grep "version =" | cut -d'"' -f2) || break
-  oldver=$(echo "$versions" | head -n1) || break
-  newver=$(echo "$versions" | tail -n1) || break
-  commitmsg="azure-cli-extensions.${pname}: ${oldver} -> ${newver}"
-  git commit -m "$commitmsg"
-done

pkgs/by-name/az/azure-cli/extensions-manual.nix

@@ -18,7 +18,7 @@
     pname = "application-insights";
     version = "1.2.1";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/application_insights-${version}-py2.py3-none-any.whl";
-    sha256 = "e1fa824eb587e2bec7f4cb4d1c4ce1033ab3d3fac65af42dd6218f673b019cee";
+    hash = "sha256-4fqCTrWH4r7H9MtNHEzhAzqz0/rGWvQt1iGPZzsBnO4=";
     description = "Support for managing Application Insights components and querying metrics, events, and logs from such components";
     propagatedBuildInputs = with python3Packages; [ isodate ];
     meta.maintainers = with lib.maintainers; [ andreasvoss ];
@@ -28,7 +28,7 @@
     pname = "azure-devops";
     version = "1.0.1";
     url = "https://github.com/Azure/azure-devops-cli-extension/releases/download/20240206.1/azure_devops-${version}-py2.py3-none-any.whl";
-    sha256 = "658a2854d8c80f874f9382d421fa45abf6a38d00334737dda006f8dec64cf70a";
+    hash = "sha256-ZYooVNjID4dPk4LUIfpFq/ajjQAzRzfdoAb43sZM9wo=";
     description = "Tools for managing Azure DevOps";
     propagatedBuildInputs = with python3Packages; [ distro ];
     meta.maintainers = with lib.maintainers; [ katexochen ];
@@ -39,7 +39,7 @@
     description = "The Azure IoT extension for Azure CLI.";
     version = "0.25.0";
     url = "https://github.com/Azure/azure-iot-cli-extension/releases/download/v${version}/azure_iot-${version}-py3-none-any.whl";
-    sha256 = "7db4bc07667efa8472513d9e121fb2551fcaeae68255c7bc0768ad4177c1b1c6";
+    hash = "sha256-fbS8B2Z++oRyUT2eEh+yVR/K6uaCVce8B2itQXfBscY=";
     propagatedBuildInputs = (
       with python3Packages;
       [
@@ -65,7 +65,7 @@
     pname = "confcom";
     version = "1.0.0";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/confcom-${version}-py3-none-any.whl";
-    sha256 = "73823e10958a114b4aca84c330b4debcc650c4635e74c568679b6c32c356411d";
+    hash = "sha256-c4I+EJWKEUtKyoTDMLTevMZQxGNedMVoZ5tsMsNWQR0=";
     description = "Microsoft Azure Command-Line Tools Confidential Container Security Policy Generator Extension";
     nativeBuildInputs = [ autoPatchelfHook ];
     buildInputs = [ openssl_1_1 ];
@@ -85,7 +85,7 @@
     pname = "containerapp";
     version = "1.0.0b1";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/containerapp-${version}-py2.py3-none-any.whl";
-    sha256 = "d80b83b0e22770925c24bca150c84182376b7b0aff9b6f28498d769dc8618b45";
+    hash = "sha256-2AuDsOIncJJcJLyhUMhBgjdrewr/m28oSY12nchhi0U=";
     description = "Microsoft Azure Command-Line Tools Containerapp Extension";
     propagatedBuildInputs = with python3Packages; [
       docker
@@ -98,7 +98,7 @@
     pname = "rdbms-connect";
     version = "1.0.6";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/rdbms_connect-${version}-py2.py3-none-any.whl";
-    sha256 = "49cbe8d9b7ea07a8974a29ad90247e864ed798bed5f28d0e3a57a4b37f5939e7";
+    hash = "sha256-Scvo2bfqB6iXSimtkCR+hk7XmL7V8o0OOleks39ZOec=";
     description = "Support for testing connection to Azure Database for MySQL & PostgreSQL servers";
     propagatedBuildInputs =
       (with python3Packages; [
@@ -115,7 +115,7 @@
     pname = "ssh";
     version = "2.0.5";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/ssh-${version}-py3-none-any.whl";
-    sha256 = "80c98b10d7bf1ce4005b7694aedd05c47355456775ba6125308be65fb0fefc93";
+    hash = "sha256-gMmLENe/HOQAW3aUrt0FxHNVRWd1umElMIvmX7D+/JM=";
     description = "SSH into Azure VMs using RBAC and AAD OpenSSH Certificates";
     propagatedBuildInputs = with python3Packages; [
       oras
@@ -128,7 +128,7 @@
     pname = "storage-preview";
     version = "1.0.0b2";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/storage_preview-${version}-py2.py3-none-any.whl";
-    sha256 = "2de8fa421622928a308bb70048c3fdf40400bad3b34afd601d0b3afcd8b82764";
+    hash = "sha256-Lej6QhYikoowi7cASMP99AQAutOzSv1gHQs6/Ni4J2Q=";
     description = "Provides a preview for upcoming storage features";
     propagatedBuildInputs = with python3Packages; [ azure-core ];
     meta.maintainers = with lib.maintainers; [ katexochen ];

pkgs/by-name/az/azure-cli/extensions-tool.py

@@ -0,0 +1,319 @@
+#!/usr/bin/env python
+
+import argparse
+import base64
+import datetime
+import json
+import logging
+import os
+import sys
+from dataclasses import asdict, dataclass, replace
+from pathlib import Path
+from typing import Any, Dict, Iterable, List, Optional, Set, Tuple
+from urllib.request import Request, urlopen
+
+import git
+from packaging.version import Version, parse
+
+INDEX_URL = "https://azcliextensionsync.blob.core.windows.net/index1/index.json"
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass(frozen=True)
+class Ext:
+    pname: str
+    version: Version
+    url: str
+    hash: str
+    description: str
+
+
+def _read_cached_index(path: Path) -> Tuple[datetime.datetime, Any]:
+    with open(path, "r") as f:
+        data = f.read()
+
+    j = json.loads(data)
+    cache_date_str = j["cache_date"]
+    if cache_date_str:
+        cache_date = datetime.datetime.fromisoformat(cache_date_str)
+    else:
+        cache_date = datetime.datetime.min
+    return cache_date, data
+
+
+def _write_index_to_cache(data: Any, path: Path):
+    j = json.loads(data)
+    j["cache_date"] = datetime.datetime.now().isoformat()
+    with open(path, "w") as f:
+        json.dump(j, f, indent=2)
+
+
+def _fetch_remote_index():
+    r = Request(INDEX_URL)
+    with urlopen(r) as resp:
+        return resp.read()
+
+
+def get_extension_index(cache_dir: Path) -> Set[Ext]:
+    index_file = cache_dir / "index.json"
+    os.makedirs(cache_dir, exist_ok=True)
+
+    try:
+        index_cache_date, index_data = _read_cached_index(index_file)
+    except FileNotFoundError:
+        logger.info("index has not been cached, downloading from source")
+        logger.info("creating index cache in %s", index_file)
+        _write_index_to_cache(_fetch_remote_index(), index_file)
+        return get_extension_index(cache_dir)
+
+    if (
+        index_cache_date
+        and datetime.datetime.now() - index_cache_date > datetime.timedelta(days=1)
+    ):
+        logger.info(
+            "cache is outdated (%s), refreshing",
+            datetime.datetime.now() - index_cache_date,
+        )
+        _write_index_to_cache(_fetch_remote_index(), index_file)
+        return get_extension_index(cache_dir)
+
+    logger.info("using index cache from %s", index_file)
+    return json.loads(index_data)
+
+
+def _read_extension_set(extensions_generated: Path) -> Set[Ext]:
+    with open(extensions_generated, "r") as f:
+        data = f.read()
+
+    parsed_exts = {Ext(**json_ext) for _pname, json_ext in json.loads(data).items()}
+    parsed_exts_with_ver = set()
+    for ext in parsed_exts:
+        ext2 = replace(ext, version=parse(ext.version))
+        parsed_exts_with_ver.add(ext2)
+
+    return parsed_exts_with_ver
+
+
+def _write_extension_set(extensions_generated: Path, extensions: Set[Ext]) -> None:
+    set_without_ver = {replace(ext, version=str(ext.version)) for ext in extensions}
+    ls = list(set_without_ver)
+    ls.sort(key=lambda e: e.pname)
+    with open(extensions_generated, "w") as f:
+        json.dump({ext.pname: asdict(ext) for ext in ls}, f, indent=2)
+
+
+def _convert_hash_digest_from_hex_to_b64_sri(s: str) -> str:
+    try:
+        b = bytes.fromhex(s)
+    except ValueError as err:
+        logger.error("not a hex value: %s", str(err))
+        raise err
+
+    return f"sha256-{base64.b64encode(b).decode('utf-8')}"
+
+
+def _commit(repo: git.Repo, message: str, files: List[Path]) -> None:
+    repo.index.add([str(f.resolve()) for f in files])
+    if repo.index.diff("HEAD"):
+        logger.info(f'committing to nixpkgs "{message}"')
+        repo.index.commit(message)
+    else:
+        logger.warning("no changes in working tree to commit")
+
+
+def _filter_invalid(o: Dict[str, Any]) -> bool:
+    if "metadata" not in o:
+        logger.warning("extension without metadata")
+        return False
+    metadata = o["metadata"]
+    if "name" not in metadata:
+        logger.warning("extension without name")
+        return False
+    if "version" not in metadata:
+        logger.warning(f"{metadata['name']} without version")
+        return False
+    if "azext.minCliCoreVersion" not in metadata:
+        logger.warning(
+            f"{metadata['name']} {metadata['version']} does not have azext.minCliCoreVersion"
+        )
+        return False
+    if "summary" not in metadata:
+        logger.info(f"{metadata['name']} {metadata['version']} without summary")
+        return False
+    if "downloadUrl" not in o:
+        logger.warning(f"{metadata['name']} {metadata['version']} without downloadUrl")
+        return False
+    if "sha256Digest" not in o:
+        logger.warning(f"{metadata['name']} {metadata['version']} without sha256Digest")
+        return False
+
+    return True
+
+
+def _filter_compatible(o: Dict[str, Any], cli_version: Version) -> bool:
+    minCliVersion = parse(o["metadata"]["azext.minCliCoreVersion"])
+    return cli_version >= minCliVersion
+
+
+def _transform_dict_to_obj(o: Dict[str, Any]) -> Ext:
+    m = o["metadata"]
+    return Ext(
+        pname=m["name"],
+        version=parse(m["version"]),
+        url=o["downloadUrl"],
+        hash=_convert_hash_digest_from_hex_to_b64_sri(o["sha256Digest"]),
+        description=m["summary"].rstrip("."),
+    )
+
+
+def _get_latest_version(versions: dict) -> dict:
+    return max(versions, key=lambda e: parse(e["metadata"]["version"]), default=None)
+
+
+def processExtension(
+    extVersions: dict,
+    cli_version: Version,
+    ext_name: Optional[str] = None,
+    requirements: bool = False,
+) -> Optional[Ext]:
+    versions = filter(_filter_invalid, extVersions)
+    versions = filter(lambda v: _filter_compatible(v, cli_version), versions)
+    latest = _get_latest_version(versions)
+    if not latest:
+        return None
+    if ext_name and latest["metadata"]["name"] != ext_name:
+        return None
+    if not requirements and "run_requires" in latest["metadata"]:
+        return None
+
+    return _transform_dict_to_obj(latest)
+
+
+def _diff_sets(
+    set_local: Set[Ext], set_remote: Set[Ext]
+) -> Tuple[Set[Ext], Set[Ext], Set[Tuple[Ext, Ext]]]:
+    local_exts = {ext.pname: ext for ext in set_local}
+    remote_exts = {ext.pname: ext for ext in set_remote}
+    only_local = local_exts.keys() - remote_exts.keys()
+    only_remote = remote_exts.keys() - local_exts.keys()
+    both = remote_exts.keys() & local_exts.keys()
+    return (
+        {local_exts[pname] for pname in only_local},
+        {remote_exts[pname] for pname in only_remote},
+        {(local_exts[pname], remote_exts[pname]) for pname in both},
+    )
+
+
+def _filter_updated(e: Tuple[Ext, Ext]) -> bool:
+    prev, new = e
+    return prev != new
+
+
+def main() -> None:
+    sh = logging.StreamHandler(sys.stderr)
+    sh.setFormatter(
+        logging.Formatter(
+            "[%(asctime)s] [%(levelname)8s] --- %(message)s (%(filename)s:%(lineno)s)",
+            "%Y-%m-%d %H:%M:%S",
+        )
+    )
+    logging.basicConfig(level=logging.INFO, handlers=[sh])
+
+    parser = argparse.ArgumentParser(
+        prog="azure-cli.extensions-tool",
+        description="Script to handle Azure CLI extension updates",
+    )
+    parser.add_argument(
+        "--cli-version", type=str, help="version of azure-cli (required)"
+    )
+    parser.add_argument("--extension", type=str, help="name of extension to query")
+    parser.add_argument(
+        "--cache-dir",
+        type=Path,
+        help="path where to cache the extension index",
+        default=Path(os.getenv("XDG_CACHE_HOME", Path.home() / ".cache"))
+        / "azure-cli-extensions-tool",
+    )
+    parser.add_argument(
+        "--requirements",
+        action=argparse.BooleanOptionalAction,
+        help="whether to list extensions that have requirements",
+    )
+    parser.add_argument(
+        "--commit",
+        action=argparse.BooleanOptionalAction,
+        help="whether to commit changes to git",
+    )
+    args = parser.parse_args()
+
+    repo = git.Repo(Path(".").resolve(), search_parent_directories=True)
+
+    index = get_extension_index(args.cache_dir)
+    assert index["formatVersion"] == "1"  # only support formatVersion 1
+    extensions_remote = index["extensions"]
+
+    cli_version = parse(args.cli_version)
+
+    extensions_remote_filtered = set()
+    for _ext_name, extension in extensions_remote.items():
+        extension = processExtension(extension, cli_version, args.extension)
+        if extension:
+            extensions_remote_filtered.add(extension)
+
+    extension_file = (
+        Path(repo.working_dir) / "pkgs/by-name/az/azure-cli/extensions-generated.json"
+    )
+    extensions_local = _read_extension_set(extension_file)
+    extensions_local_filtered = set()
+    if args.extension:
+        extensions_local_filtered = filter(
+            lambda ext: args.extension == ext.pname, extensions_local
+        )
+    else:
+        extensions_local_filtered = extensions_local
+
+    removed, init, updated = _diff_sets(
+        extensions_local_filtered, extensions_remote_filtered
+    )
+    updated = set(filter(_filter_updated, updated))
+
+    logger.info("initialized extensions:")
+    for ext in init:
+        logger.info(f"  {ext.pname} {ext.version}")
+    logger.info("removed extensions:")
+    for ext in removed:
+        logger.info(f"  {ext.pname} {ext.version}")
+    logger.info("updated extensions:")
+    for prev, new in updated:
+        logger.info(f"  {prev.pname} {prev.version} -> {new.version}")
+
+    for ext in removed:
+        extensions_local.remove(ext)
+        # TODO: Add additional check why this is removed
+        # TODO: Add an alias to extensions manual?
+        commit_msg = f"azure-cli-extensions.{ext.pname}: remove"
+        _write_extension_set(extension_file, extensions_local)
+        if args.commit:
+            _commit(repo, commit_msg, [extension_file])
+
+    for ext in init:
+        extensions_local.add(ext)
+        commit_msg = f"azure-cli-extensions.{ext.pname}: init at {ext.version}"
+        _write_extension_set(extension_file, extensions_local)
+        if args.commit:
+            _commit(repo, commit_msg, [extension_file])
+
+    for prev, new in updated:
+        extensions_local.remove(prev)
+        extensions_local.add(new)
+        commit_msg = (
+            f"azure-cli-extension.{prev.pname}: {prev.version} -> {new.version}"
+        )
+        _write_extension_set(extension_file, extensions_local)
+        if args.commit:
+            _commit(repo, commit_msg, [extension_file])
+
+
+if __name__ == "__main__":
+    main()

pkgs/by-name/az/azure-cli/package.nix

@@ -10,6 +10,11 @@
   python3,
   writeScriptBin,
 
+  black,
+  isort,
+  mypy,
+  makeWrapper,
+
   # Whether to include patches that enable placing certain behavior-defining
   # configuration files in the Nix store.
   withImmutableConfig ? true,
@@ -41,14 +46,14 @@ let
       pname,
       version,
       url,
-      sha256,
+      hash,
       description,
       ...
     }@args:
     python3.pkgs.buildPythonPackage (
       {
         format = "wheel";
-        src = fetchurl { inherit url sha256; };
+        src = fetchurl { inherit url hash; };
         meta = {
           inherit description;
           inherit (azure-cli.meta) platforms maintainers;
@@ -60,18 +65,20 @@ let
       }
       // (removeAttrs args [
         "url"
-        "sha256"
+        "hash"
         "description"
         "meta"
       ])
     );
 
-  extensions =
-    callPackages ./extensions-generated.nix { inherit mkAzExtension; }
-    // callPackages ./extensions-manual.nix {
-      inherit mkAzExtension;
-      python3Packages = python3.pkgs;
-    };
+  extensions-generated = lib.mapAttrs (name: ext: mkAzExtension ext) (
+    builtins.fromJSON (builtins.readFile ./extensions-generated.json)
+  );
+  extensions-manual = callPackages ./extensions-manual.nix {
+    inherit mkAzExtension;
+    python3Packages = python3.pkgs;
+  };
+  extensions = extensions-generated // extensions-manual;
 
   extensionDir = stdenvNoCC.mkDerivation {
     name = "azure-cli-extensions";
@@ -376,17 +383,42 @@ py.pkgs.toPythonApplication (
       };
 
       generate-extensions = writeScriptBin "${pname}-update-extensions" ''
-        export FILE=extensions-generated.nix
-        echo "# This file is automatically generated. DO NOT EDIT! Read README.md" > $FILE
-        echo "{ mkAzExtension }:" >> $FILE
-        echo "{" >> $FILE
-        ${./query-extension-index.sh} --requirements=false --download --nix --cli-version=${version} \
-          | xargs -n1 -d '\n' echo " " >> $FILE
-        echo "" >> $FILE
-        echo "}" >> $FILE
-        echo "Extension was saved to \"extensions-generated.nix\" file."
-        echo "Move it to \"{nixpkgs}/pkgs/by-name/az/azure-cli/extensions-generated.nix\"."
+        ${lib.getExe azure-cli.extensions-tool} --cli-version ${azure-cli.version} --commit
       '';
+
+      extensions-tool =
+        runCommand "azure-cli-extensions-tool"
+          {
+            src = ./extensions-tool.py;
+            nativeBuildInputs = [
+              black
+              isort
+              makeWrapper
+              mypy
+              python3
+            ];
+            meta.mainProgram = "extensions-tool";
+          }
+          ''
+            black --check --diff $src
+            # mypy --strict $src
+            isort --profile=black --check --diff $src
+
+            install -Dm755 $src $out/bin/extensions-tool
+
+            patchShebangs --build $out
+            wrapProgram $out/bin/extensions-tool \
+              --set PYTHONPATH "${
+                python3.pkgs.makePythonPath (
+                  with python3.pkgs;
+                  [
+                    packaging
+                    semver
+                    gitpython
+                  ]
+                )
+              }"
+          '';
     };
 
     meta = {

pkgs/by-name/az/azure-cli/query-extension-index.sh

@@ -1,163 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-function usage() {
-    {
-        echo "${0} - query Azure CLI extension index"
-        echo
-        echo "The Azure CLI extension index contains all versions of all extensions. This"
-        echo "script queries the index for the latest version of an extensions that is"
-        echo "compatible with the specified version of the Azure CLI. Data for that extension"
-        echo "is filtered for fields relevant to package the extension in Nix."
-        echo
-        echo "Usage:"
-        echo "  --cli-version=<version>      version of azure-cli (required)"
-        echo "  --extension=<name>           name of extension to query"
-        echo "  --file=<path>                path to extension index file"
-        echo "  --download                   download extension index file"
-        echo "  --nix                        output Nix expression"
-        echo "  --requirements=<true/false>  filter for extensions with/without requirements"
-    } >&2
-}
-
-for arg in "$@"; do
-    case "$arg" in
-        --cli-version=*)
-            cliVer="${arg#*=}"
-            shift
-            ;;
-        --extension=*)
-            extName="${arg#*=}"
-            shift
-            ;;
-        --file=*)
-            extensionFile="${arg#*=}"
-            shift
-            ;;
-        --download)
-            download=true
-            shift
-            ;;
-        --nix)
-            nix=true
-            shift
-            ;;
-        --requirements=*)
-            requirements="${arg#*=}"
-            shift
-            ;;
-        --help)
-            usage
-            exit 0
-            ;;
-        *)
-            echo "Unknown argument: $arg" >&2
-            exit 1
-            ;;
-    esac
-done
-
-if [[ -z "${cliVer:-}" ]]; then
-    echo "Missing --cli-version argument" >&2
-    exit 1
-fi
-if [[ -z "${extensionFile:-}" && -z "${download:-}" ]]; then
-    echo "Either --file or --download must be specified" >&2
-    exit 1
-fi
-if [[ -n "${extName:-}" && -n "${requirements:-}" ]]; then
-    echo "--requirements can only be used when listing all extensions" >&2
-    exit 1
-fi
-
-if [[ "${download:-}" == true ]]; then
-    extensionFile="$(mktemp)"
-    echo "Downloading extensions index to ${extensionFile}" >&2
-    curl -fsSL "https://azcliextensionsync.blob.core.windows.net/index1/index.json" > "${extensionFile}"
-fi
-
-# shellcheck disable=SC2016
-jqProgram='
-    def opt(f):
-        . as $in | try f catch $in
-        ;
-
-    def version_to_array:
-        sub("\\+.*$"; "")
-        | capture("^(?<v>[^a-z-]+)(?:(?<p>.*))?") | [.v, .p // empty]
-        | map(split(".")
-        | map(opt(tonumber)))
-        | flatten
-        ;
-
-    def version_le($contstraint):
-        version_to_array as $v
-        | $contstraint | version_to_array as $c
-        | $v[0] < $c[0] or
-          ($v[0] == $c[0] and $v[1] < $c[1]) or
-          ($v[0] == $c[0] and $v[1] == $c[1] and $v[2] < $c[2]) or
-          ($v[0] == $c[0] and $v[1] == $c[1] and $v[2] == $c[2] and $v[3] <= $c[3])
-        ;
-
-    def max_constrained_version($constraint):
-        [
-            .[] | select(.metadata."azext.minCliCoreVersion" // "0.0.0" | version_le($cliVer))
-        ]
-        | sort_by(.metadata.version | version_to_array)
-        | last
-        ;
-
-    def translate_struct:
-        {
-            pname : .metadata.name,
-            description: .metadata.summary,
-            version: .metadata.version,
-            url: .downloadUrl,
-            sha256: .sha256Digest,
-            license: .metadata.license,
-            requires: .metadata.run_requires.[0].requires
-        }
-        ;
-
-    def to_nix:
-        [.].[] as $in
-        | .version as $version
-        | .description as $description
-        | .url | sub($version;"${version}") as $url
-        | $description |rtrimstr(".") as $description
-        | $in.pname + " = mkAzExtension rec {\n" +
-        "  pname = \"" + $in.pname + "\";\n" +
-        "  version = \"" + $in.version + "\";\n" +
-        "  url = \"" + $url + "\";\n" +
-        "  sha256 = \"" + $in.sha256 + "\";\n" +
-        "  description = \"" + $description + "\";\n" +
-        "};"
-        ;
-
-    def main:
-        .extensions
-        | map(max_constrained_version($cliVer))
-        | .[]
-        | translate_struct
-        | if $extName  != "" then
-            select(.pname == $extName)
-        elif $requirements == "false" then
-            select(.requires == null)
-        elif $requirements == "true" then
-            select(.requires != null)
-        end
-        | if $nix == "true" then
-            to_nix
-        end
-        ;
-
-    main
-'
-
-jq -r \
-    --arg cliVer "${cliVer}" \
-    --arg extName "${extName:-}" \
-    --arg nix "${nix:-}" \
-    --arg requirements "${requirements:-}" \
-    "$jqProgram" "${extensionFile}"

pkgs/by-name/bo/boxbuddy/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "boxbuddy";
-  version = "2.2.13";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "Dvlv";
     repo = "BoxBuddyRS";
     rev = version;
-    hash = "sha256-47LOwBm7ql3Nvx6PZ2+x5aR9LSpzc8xuixdvKGdNS94=";
+    hash = "sha256-s0StSMpLNRwiI+T78ySfW2DQ3s5A9kuclC9f32UDkiI=";
   };
 
-  cargoHash = "sha256-W4W2tnnNgBcGD0/t5pobj4ca/YrRkHE1l5dIVe21KPU=";
+  cargoHash = "sha256-WJ35lxo4h91xtcfUuevLsWNBvulxq5ZaAVE3u9BbtzI=";
 
   # The software assumes it is installed either in flatpak or in the home directory
   # so the xdg data path needs to be patched here

pkgs/by-name/ch/chezmoi/package.nix

@@ -8,16 +8,16 @@
 let
   argset = {
     pname = "chezmoi";
-    version = "2.52.3";
+    version = "2.53.1";
 
     src = fetchFromGitHub {
       owner = "twpayne";
       repo = "chezmoi";
       rev = "v${argset.version}";
-      hash = "sha256-OoVf0Gxyd+hTlM4VOei1atNEZYL2ZF3eKAHyUqRkRzs=";
+      hash = "sha256-E7kr2fKBabbFVmtVRjgYy5TWhvQYb/RjhiNEcXYXL0E=";
     };
 
-    vendorHash = "sha256-QJkTscj3MvmscanEqA9Md2OZPYoNtxIJsAd2J6E9zHk=";
+    vendorHash = "sha256-wOdDG/J/JYGNUGSUCPVCNtO+5TFkt5O5kFYniQgcN7A=";
 
     nativeBuildInputs = [
       installShellFiles

pkgs/by-name/ch/chrony/package.nix

@@ -1,7 +1,6 @@
 {
   lib,
   stdenv,
-  overrideSDK,
   fetchurl,
   pkg-config,
   gnutls,
@@ -11,19 +10,11 @@
   libseccomp,
   pps-tools,
   nixosTests,
+  apple-sdk_11,
+  darwinMinVersionHook,
 }:
 
-let
-  stdenv' =
-    if stdenv.hostPlatform.isDarwin then
-      overrideSDK stdenv {
-        darwinSdkVersion = "11.0";
-        darwinMinVersion = "10.13";
-      }
-    else
-      stdenv;
-in
-stdenv'.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "chrony";
   version = "4.6.1";
 
@@ -49,6 +40,10 @@ stdenv'.mkDerivation rec {
       libcap
       libseccomp
       pps-tools
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      apple-sdk_11
+      (darwinMinVersionHook "10.13")
     ];
 
   configureFlags = [

pkgs/by-name/cl/clever-tools/package.nix

@@ -4,13 +4,14 @@
   fetchFromGitHub,
   nodejs_18,
   installShellFiles,
+  makeWrapper,
   stdenv,
 }:
 
 buildNpmPackage rec {
   pname = "clever-tools";
 
-  version = "3.8.3";
+  version = "3.9.0";
 
   nodejs = nodejs_18;
 
@@ -18,27 +19,32 @@ buildNpmPackage rec {
     owner = "CleverCloud";
     repo = "clever-tools";
     rev = version;
-    hash = "sha256-70wyu8+Jb9kR5lIucBZG9UWIufMhsgMBMkT2ohGvE50=";
+    hash = "sha256-nSTcJIZO/CMliAYFUGu/oA+VdtONDPwyj6vCr5Ry6ac=";
   };
 
-  npmDepsHash = "sha256-LljwS6Rd/8WnGpxSHwCr87KWLaRR2i7sMdUuuprYiOE=";
+  npmDepsHash = "sha256-+3/zSsO5+s1MUome3CQ1p1tN3OtWp+XE9Z6GSdDiRh8=";
 
-  dontNpmBuild = true;
+  nativeBuildInputs = [
+    installShellFiles
+    makeWrapper
+  ];
 
-  nativeBuildInputs = [ installShellFiles ];
+  installPhase = ''
+    mkdir -p $out/bin $out/lib/clever-tools
+    cp build/clever.cjs $out/lib/clever-tools/clever.cjs
 
-  makeWrapperArgs = [ "--set NO_UPDATE_NOTIFIER true" ];
+    makeWrapper ${nodejs}/bin/node $out/bin/clever \
+      --add-flags "$out/lib/clever-tools/clever.cjs" \
+      --set NO_UPDATE_NOTIFIER true
 
-  postInstall =
-    lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-      installShellCompletion --cmd clever \
-        --bash <($out/bin/clever --bash-autocomplete-script $out/bin/clever) \
-        --zsh <($out/bin/clever --zsh-autocomplete-script $out/bin/clever)
-    ''
-    + ''
-      rm $out/bin/install-clever-completion
-      rm $out/bin/uninstall-clever-completion
-    '';
+    runHook postInstall
+  '';
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd clever \
+      --bash <($out/bin/clever --bash-autocomplete-script $out/bin/clever) \
+      --zsh <($out/bin/clever --zsh-autocomplete-script $out/bin/clever)
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/CleverCloud/clever-tools";

pkgs/by-name/co/code-cursor/package.nix

@@ -8,11 +8,11 @@
 }:
 let
   pname = "cursor";
-  version = "0.42.3";
+  version = "0.42.4";
   appKey = "230313mzl4w4u92";
   src = fetchurl {
-    url = "https://download.todesktop.com/230313mzl4w4u92/cursor-0.42.3-build-241016kxu9umuir-x86_64.AppImage";
-    hash = "sha256-GWkilBlpXube//jbxRjmKJjYcmB42nhMY8K0OgkvtwA=";
+    url = "https://download.todesktop.com/230313mzl4w4u92/cursor-0.42.4-build-2410291z3bdg1dy-x86_64.AppImage";
+    hash = "sha256-CD6bQ4T8DhJidiOxNRgRDL4obfEZx7hnO0VotVb6lDc=";
   };
   appimageContents = appimageTools.extractType2 { inherit version pname src; };
 in

pkgs/by-name/co/conduwuit/package.nix

@@ -6,7 +6,8 @@
   bzip2,
   zstd,
   stdenv,
-  darwin,
+  apple-sdk_15,
+  darwinMinVersionHook,
   rocksdb,
   nix-update-script,
   testers,
@@ -63,7 +64,9 @@ rustPlatform.buildRustPackage rec {
     ++ lib.optional enableJemalloc rust-jemalloc-sys'
     ++ lib.optional enableLiburing liburing
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
+      apple-sdk_15
+      # aws-lc-sys requires CryptoKit's CommonCrypto, which is available on macOS 10.15+
+      (darwinMinVersionHook "10.15")
     ];
 
   env = {

pkgs/by-name/cp/cp2k/package.nix

@@ -18,7 +18,6 @@
   mpi,
   gsl,
   scalapack,
-  openssh,
   makeWrapper,
   libxsmm,
   spglib,
@@ -83,7 +82,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     python3
     which
-    openssh
     makeWrapper
     pkg-config
   ] ++ lib.optional (gpuBackend == "cuda") cudaPackages.cuda_nvcc;
@@ -225,7 +223,6 @@ stdenv.mkDerivation rec {
 
   nativeCheckInputs = [
     mpiCheckPhaseHook
-    openssh
   ];
 
   checkPhase = ''

pkgs/by-name/db/dbip-asn-lite/package.nix

@@ -5,11 +5,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbip-asn-lite";
-  version = "2024-10";
+  version = "2024-11";
 
   src = fetchurl {
     url = "https://download.db-ip.com/free/dbip-asn-lite-${finalAttrs.version}.mmdb.gz";
-    hash = "sha256-zfBRxZ6xwIrOC6MrmtbfKrIK7jxMD/1EMOgQDON6nPw=";
+    hash = "sha256-uqtn3Dy8GYjRHX3LNky0DUAc+MxEph41AKShxsPdJJM=";
   };
 
   dontUnpack = true;

pkgs/by-name/db/dbip-city-lite/package.nix

@@ -5,11 +5,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbip-city-lite";
-  version = "2024-10";
+  version = "2024-11";
 
   src = fetchurl {
     url = "https://download.db-ip.com/free/dbip-city-lite-${finalAttrs.version}.mmdb.gz";
-    hash = "sha256-sPjtO0WRdMxGiTySFO3vA1mL3RHxDnhLFzQ1fq2LNUw=";
+    hash = "sha256-w/Dl89AdhIfsfNu4IvVMEVKqZtQcqg0UAjB7HJxq/OE=";
   };
 
   dontUnpack = true;

pkgs/by-name/db/dbip-country-lite/package.nix

@@ -5,11 +5,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbip-country-lite";
-  version = "2024-10";
+  version = "2024-11";
 
   src = fetchurl {
     url = "https://download.db-ip.com/free/dbip-country-lite-${finalAttrs.version}.mmdb.gz";
-    hash = "sha256-MeAhfDY2jdX2WDsNGNjvH/JeCo9C1hx3PWyk8am9Ut0=";
+    hash = "sha256-Ua4hm0duKHAD/cgtOaDqAYT/4lWsuoIdPnM7K0Lqecw=";
   };
 
   dontUnpack = true;

pkgs/by-name/ea/earlyoom/package.nix

@@ -58,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     license = lib.licenses.mit;
     mainProgram = "earlyoom";
-    maintainers = with lib.maintainers; [ AndersonTorres ];
+    maintainers = with lib.maintainers; [ ];
     platforms = lib.platforms.linux;
   };
 })

pkgs/by-name/ed/edopro/deps.nix

@@ -4,11 +4,8 @@
   assets-hash = "sha256-vZhkWJ1ZoNEwdc5kM1S0hyXnWmupiTOanCi9DCuqw/k=";
   edopro-version = "40.1.4";
   edopro-rev = "c713e23491a1e55c9d8e91257e5f2b5873696b9b";
-  edopro-hash = "sha256-2E1cjG0FONu/fbr67/3qRCKQ1W/wPznClEWsMa1FAzo=";
+  edopro-hash = "sha256-mj0xEJsFcnY//za0uJosAPOPbU/jlduNX0YSNmvduLE=";
   irrlicht-version = "1.9.0-unstable-2023-02-18";
   irrlicht-rev = "7edde28d4f8c0c3589934c398a3a441286bb7c22";
   irrlicht-hash = "sha256-Q2tNiYE/enZPqA5YhUe+Tkvmqtmmz2E0OqTRUDnt+UA=";
-  ocgcore-version = "0-unstable-2022-09-15";
-  ocgcore-rev = "4a872ad7686e0d00ee4c1c051e90fc07c40613d4";
-  ocgcore-hash = "sha256-s3DOHrZilRUy6fbXObNiLRinxpdHY99vDOmS/ZfOI78=";
 }

pkgs/by-name/ed/edopro/ocgcore-lua-symbols.patch

@@ -1,29 +0,0 @@
-From 41e750142b44465f3af197b7e2f0d6f54fc48c2d Mon Sep 17 00:00:00 2001
-From: OPNA2608 <opna2608@protonmail.com>
-Date: Mon, 21 Oct 2024 17:42:24 +0200
-Subject: [PATCH] Mark Lua symbols as C symbols
-
-Otherwise linking against our Lua built by a C-compiler fails due to the symbols being resolved as C++ symbols.
----
- interpreter.h | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/interpreter.h b/interpreter.h
-index 6c405a1..c471ecb 100644
---- a/interpreter.h
-+++ b/interpreter.h
-@@ -9,9 +9,11 @@
- #define INTERPRETER_H_
- 
- // Due to longjmp behaviour, we must build Lua as C++ to avoid UB
-+extern "C" {
- #include <lua.h>
- #include <lualib.h>
- #include <lauxlib.h>
-+}
- 
- #include "common.h"
- #include <unordered_map>
--- 
-2.44.1
-

pkgs/by-name/ed/edopro/package.nix

@@ -15,6 +15,7 @@
   # Use fmt 10+ after release 40.1.4+
   fmt_9,
   freetype,
+  irrlicht,
   libevent,
   libgit2,
   libGL,
@@ -25,7 +26,6 @@
   libX11,
   libxkbcommon,
   libXxf86vm,
-  lua5_3,
   mono,
   nlohmann_json,
   openal,
@@ -50,6 +50,11 @@ let
     .${stdenv.hostPlatform.system}
       or (throw "${stdenv.hostPlatform.system} is an unsupported arch label for edopro");
 
+  maintainers = with lib.maintainers; [
+    OPNA2608
+    redhawk
+  ];
+
   deps = import ./deps.nix;
 in
 let
@@ -78,9 +83,7 @@ let
     ];
 
     enableParallelBuilding = true;
-    buildFlags = [
-      "NDEBUG=1"
-    ];
+    buildFlags = [ "NDEBUG=1" ];
     makeFlags = [
       "-C"
       "source/Irrlicht"
@@ -89,57 +92,18 @@ let
     installPhase = ''
       runHook preInstall
 
-      mkdir -p $out/{bin,include}
-      cp lib/Linux/libIrrlicht.a $out/bin
-      cp -r include/* $out/include
+      install -Dm644 -t $out/lib lib/Linux/libIrrlicht.a
+      cp -r include $out/include
 
       runHook postInstall
     '';
-  };
 
-  ocgcore = stdenv.mkDerivation {
-    pname = "ygopro-core";
-    version = deps.ocgcore-version;
-
-    src = fetchFromGitHub {
-      owner = "edo9300";
-      repo = "ygopro-core";
-      rev = deps.ocgcore-rev;
-      hash = deps.ocgcore-hash;
-      fetchSubmodules = true;
+    meta = {
+      inherit (irrlicht.meta) description platforms;
+      homepage = "https://github.com/edo9300/irrlicht1-8-4";
+      license = lib.licenses.agpl3Plus;
+      inherit maintainers;
     };
-
-    patches = [
-      ./ocgcore-lua-symbols.patch
-    ];
-
-    nativeBuildInputs = [ premake5 ];
-
-    buildInputs = [ lua5_3 ];
-
-    preBuild = ''
-      premake5 gmake2 \
-        --lua-path="${lua5_3}"
-    '';
-
-    enableParallelBuilding = true;
-    buildFlags = [
-      "verbose=true"
-      "config=release"
-      "ocgcoreshared"
-    ];
-    makeFlags = [
-      "-C"
-      "build"
-    ];
-
-    installPhase = ''
-      runHook preInstall
-
-      install -Dm644 -t $out/lib bin/release/libocgcore${stdenv.hostPlatform.extensions.sharedLibrary}
-
-      runHook postInstall
-    '';
   };
 
   edopro = stdenv.mkDerivation {
@@ -151,7 +115,6 @@ let
       repo = "edopro";
       rev = deps.edopro-rev;
       hash = deps.edopro-hash;
-      fetchSubmodules = true;
     };
 
     nativeBuildInputs = [
@@ -171,9 +134,7 @@ let
       libjpeg
       libpng
       libvorbis
-      lua5_3
       nlohmann_json
-      ocgcore
       openal
       SDL2
       sqlite
@@ -183,6 +144,8 @@ let
     postPatch = ''
       substituteInPlace premake5.lua \
         --replace-fail 'flags "LinkTimeOptimization"' 'removeflags "LinkTimeOptimization"'
+
+      touch ocgcore/premake5.lua
     '';
 
     preBuild = ''
@@ -191,7 +154,7 @@ let
         --covers=\"${covers_url}\" \
         --fields=\"${fields_url}\" \
         --pics=\"${pics_url}\" \
-        --prebuilt-core="${lib.getLib ocgcore}/lib" \
+        --no-core \
         --sound=sfml
     '';
 
@@ -205,7 +168,7 @@ let
     buildFlags = [
       "verbose=true"
       "config=release_${archLabel}"
-      "ygopro"
+      "ygoprodll"
     ];
     makeFlags = [
       "-C"
@@ -216,8 +179,8 @@ let
       runHook preInstall
 
       mkdir -p $out/bin
-      cp bin/${archLabel}/release/ygopro $out/bin
-      wrapProgram $out/bin/ygopro \
+      cp bin/${archLabel}/release/ygoprodll $out/bin
+      wrapProgram $out/bin/ygoprodll \
         --prefix PATH : ${lib.makeBinPath [ mono ]} \
         --prefix LD_LIBRARY_PATH : ${
           lib.makeLibraryPath [
@@ -233,12 +196,30 @@ let
 
       runHook postInstall
     '';
+
+    meta = {
+      description = "Bleeding-edge automatic duel simulator, a fork of the YGOPro client";
+      homepage = "https://projectignis.github.io";
+      changelog = "https://github.com/edo9300/edopro/releases";
+      license = lib.licenses.agpl3Plus;
+      mainProgram = "ygoprodll";
+      # This is likely a very easy app to port if you're interested.
+      # We just have no way to test on other platforms.
+      platforms = [
+        "x86_64-linux"
+        # Currently offline mode does not work, the problem is that the core is updated whenever it is needed.
+        # So in our method we would have to update the client if it's statically linked as well.
+        # It is possible but we have decided against it for now.  In theory if we added more logic to the update script it could work.
+        "aarch64-linux"
+      ];
+      inherit maintainers;
+    };
   };
 
   edopro-script =
     let
       assetsToCopy = lib.concatStringsSep "," [
-        # Needed if we download files from ProjectIgnis' website or any https only website.
+        # Needed if we download files from ProjectIgnis' website or any https-only website.
         "cacert.pem"
         "config"
         "deck"
@@ -267,17 +248,18 @@ let
           rm $EDOPRO_DIR/config/io.github.edo9300.EDOPro.desktop.in
       fi
 
-      exec ${edopro}/bin/ygopro -C $EDOPRO_DIR $@
+      exec ${lib.getExe edopro} -C $EDOPRO_DIR $@
     '';
 
   edopro-desktop = runCommandLocal "io.github.edo9300.EDOPro.desktop" { } ''
-    cp ${assets}/config/io.github.edo9300.EDOPro.desktop.in desktop-template
+    mkdir -p $out/share/applications
 
-    sed '/Path=/d' -i desktop-template
-    sed 's/Exec=.*/Exec=EDOPro/' -i desktop-template
-    sed 's/Icon=.*/Icon=EDOPro/' -i desktop-template
-
-    install -D desktop-template $out/share/applications/io.github.edo9300.EDOPro.desktop
+    sed ${assets}/config/io.github.edo9300.EDOPro.desktop.in \
+      -e '/Path=/d' \
+      -e 's/Exec=.*/Exec=edopro/' \
+      -e 's/Icon=.*/Icon=edopro/' \
+      -e 's/StartupWMClass=.*/StartupWMClass=edopro/' \
+      >$out/share/applications/io.github.edo9300.EDOPro.desktop
   '';
 in
 symlinkJoin {
@@ -289,30 +271,28 @@ symlinkJoin {
   ];
 
   postBuild = ''
-    mkdir -p $out/share/icons/hicolor/256x256/apps/
-    ${imagemagick}/bin/magick \
-        ${assets}/textures/AppIcon.png \
-        -resize 256x256 \
-        $out/share/icons/hicolor/256x256/apps/EDOPro.png
+    for size in 16 32 48 64 128 256 512 1024; do
+      res="$size"x"$size"
+      mkdir -p $out/share/icons/hicolor/"$res"/apps/
+      ${imagemagick}/bin/magick \
+          ${assets}/textures/AppIcon.png \
+          -resize "$res" \
+          $out/share/icons/hicolor/"$res"/apps/edopro.png
+    done
   '';
 
   passthru.updateScript = ./update.py;
 
   meta = {
-    description = "Bleeding-edge automatic duel simulator, a fork of the YGOPro client";
-    homepage = "https://projectignis.github.io";
-    changelog = "https://github.com/edo9300/edopro/releases";
-    license = lib.licenses.agpl3Plus;
-    maintainers = with lib.maintainers; [
-      OPNA2608
-      redhawk
-    ];
+    inherit (edopro.meta)
+      description
+      homepage
+      changelog
+      license
+      platforms
+      maintainers
+      ;
+    # To differenciate it from the original YGOPro
     mainProgram = "edopro";
-    # This is likely a very easy app to port if you're interested.
-    # We just have no way to test on other platforms.
-    platforms = [
-      "x86_64-linux"
-      "aarch64-linux"
-    ];
   };
 }

pkgs/by-name/ed/edopro/update.py

@@ -15,14 +15,6 @@ DEPS_PATH: str = "./pkgs/by-name/ed/edopro/deps.nix"
 with GitHub(UnauthAuthStrategy()) as github:
     edopro: Tag = github.rest.repos.list_tags("edo9300", "edopro").parsed_data[0]
 
-    ocgcore_submodule: ContentSubmodule = github.rest.repos.get_content(
-        "edo9300", "edopro", "ocgcore"
-    ).parsed_data
-
-    ocgcore: Commit = github.rest.repos.get_commit(
-        "edo9300", "ygopro-core", ocgcore_submodule.sha
-    ).parsed_data
-
     # This dep is not versioned in anyway and is why we check below to see if this is a new version.
     irrlicht: Commit = github.rest.repos.list_commits(
         "edo9300", "irrlicht1-8-4"
@@ -64,8 +56,7 @@ def get_hash(owner: str, repo: str, rev: str, submodule: bool = False) -> str:
     return out_json["hash"]
 
 
-edopro_hash = get_hash("edo9300", "edopro", edopro.commit.sha, submodule=True)
-ocgcore_hash = get_hash("edo9300", "ygopro-core", ocgcore.sha)
+edopro_hash = get_hash("edo9300", "edopro", edopro.commit.sha)
 irrlicht_hash = get_hash("edo9300", "irrlicht1-8-4", irrlicht.sha)
 
 asset_legacy_hash: str = (
@@ -110,9 +101,6 @@ with open(DEPS_PATH, "w") as file:
   irrlicht-version = "{"1.9.0-unstable-" + irrlicht.commit.committer.date.split("T")[0]}";
   irrlicht-rev = "{irrlicht.sha}";
   irrlicht-hash = "{irrlicht_hash}";
-  ocgcore-version = "{"0-unstable-" + ocgcore.commit.committer.date.split("T")[0]}";
-  ocgcore-rev = "{ocgcore.sha}";
-  ocgcore-hash = "{ocgcore_hash}";
 }}
 """
 

pkgs/by-name/ev/evillimiter/package.nix

@@ -1,28 +1,26 @@
-{ lib
-, buildPythonApplication
-, fetchFromGitHub
-, colorama
-, iproute2
-, iptables
-, netaddr
-, netifaces
-, scapy
-, terminaltables
-, tqdm
+{
+  lib,
+  fetchFromGitHub,
+  iproute2,
+  iptables,
+  python3Packages,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "evillimiter";
   version = "1.5.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bitbrute";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "1l0acd4a36wzz1gyc6mcw3zpagyi2mc425c6d4c6anq3jxwm3847";
+    repo = "evillimiter";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-h6BReZcDW2UYaYYVQVgV0T91/+CsGuZf+J+boUhjCtA=";
   };
 
-  propagatedBuildInputs = [
+  build-system = with python3Packages; [ setuptools-scm ];
+
+  dependencies = with python3Packages; [
     colorama
     iproute2
     iptables
@@ -33,14 +31,11 @@ buildPythonApplication rec {
     tqdm
   ];
 
-  # no tests present
+  # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [ "evillimiter.evillimiter" ];
-
-  meta = with lib; {
+   meta = with lib; {
     description = "Tool that monitors, analyzes and limits the bandwidth";
-    mainProgram = "evillimiter";
     longDescription = ''
       A tool to monitor, analyze and limit the bandwidth (upload/download) of
       devices on your local network without physical or administrative access.
@@ -48,7 +43,8 @@ buildPythonApplication rec {
       bandwidth of hosts on the network.
     '';
     homepage = "https://github.com/bitbrute/evillimiter";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "evillimiter";
   };
 }

pkgs/by-name/ex/exodus/package.nix

@@ -28,12 +28,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "exodus";
-  version = "24.19.4";
+  version = "24.41.3";
 
   src = requireFile {
     name = "exodus-linux-x64-${finalAttrs.version}.zip";
     url = "https://downloads.exodus.com/releases/exodus-linux-x64-${finalAttrs.version}.zip";
-    hash = "sha256-+g7DdDrSVmBl1wCSCoJcO2gmbWQBnJUYqjT+GuDlCYw=";
+    hash = "sha256-cq8vHE/wAGRu20F3N3q9F+JXLV8VgGbo5JE9Q2OFuMw=";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/by-name/fa/factorio/versions.json

@@ -3,25 +3,25 @@
     "alpha": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio_linux_2.0.11.tar.xz"
+          "factorio_linux_2.0.14.tar.xz"
         ],
-        "name": "factorio_alpha_x64-2.0.11.tar.xz",
+        "name": "factorio_alpha_x64-2.0.14.tar.xz",
         "needsAuth": true,
-        "sha256": "84cc76d9197c274ee73f05f1ceb1895c7c2423ccc3452ac0bdf73cdbfcd4f44e",
+        "sha256": "8853ce1cdea0c142f78c3ebb3b7d51420f9eb28e9113f2be08a12d4e476dcadc",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.11/alpha/linux64",
-        "version": "2.0.11"
+        "url": "https://factorio.com/get-download/2.0.14/alpha/linux64",
+        "version": "2.0.14"
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio_linux_2.0.11.tar.xz"
+          "factorio_linux_2.0.13.tar.xz"
         ],
-        "name": "factorio_alpha_x64-2.0.11.tar.xz",
+        "name": "factorio_alpha_x64-2.0.13.tar.xz",
         "needsAuth": true,
-        "sha256": "84cc76d9197c274ee73f05f1ceb1895c7c2423ccc3452ac0bdf73cdbfcd4f44e",
+        "sha256": "25fc4c8b0c0b63d8024e1e76efda50e6f8348e967e03c2770eb8a867494b9c98",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.11/alpha/linux64",
-        "version": "2.0.11"
+        "url": "https://factorio.com/get-download/2.0.13/alpha/linux64",
+        "version": "2.0.13"
       }
     },
     "demo": {
@@ -51,51 +51,51 @@
     "expansion": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio-space-age_linux_2.0.11.tar.xz"
+          "factorio-space-age_linux_2.0.14.tar.xz"
         ],
-        "name": "factorio_expansion_x64-2.0.11.tar.xz",
+        "name": "factorio_expansion_x64-2.0.14.tar.xz",
         "needsAuth": true,
-        "sha256": "6d7754718bd980b27469e2298655abfe3d6ad7d6bd22b765f75bbf23770ab179",
+        "sha256": "7878444d65dc12815d7ce4d2c941441b8b7e05605e3f0bd69d45d02b3aa8f81a",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.11/expansion/linux64",
-        "version": "2.0.11"
+        "url": "https://factorio.com/get-download/2.0.14/expansion/linux64",
+        "version": "2.0.14"
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio-space-age_linux_2.0.11.tar.xz"
+          "factorio-space-age_linux_2.0.13.tar.xz"
         ],
-        "name": "factorio_expansion_x64-2.0.11.tar.xz",
+        "name": "factorio_expansion_x64-2.0.13.tar.xz",
         "needsAuth": true,
-        "sha256": "6d7754718bd980b27469e2298655abfe3d6ad7d6bd22b765f75bbf23770ab179",
+        "sha256": "5834dc11791aa24c0edc6ecfdd223f80af9c6842c39be0fb8c3b188463ec0f54",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.11/expansion/linux64",
-        "version": "2.0.11"
+        "url": "https://factorio.com/get-download/2.0.13/expansion/linux64",
+        "version": "2.0.13"
       }
     },
     "headless": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio-headless_linux_2.0.11.tar.xz",
-          "factorio_headless_x64_2.0.11.tar.xz"
+          "factorio-headless_linux_2.0.14.tar.xz",
+          "factorio_headless_x64_2.0.14.tar.xz"
         ],
-        "name": "factorio_headless_x64-2.0.11.tar.xz",
+        "name": "factorio_headless_x64-2.0.14.tar.xz",
         "needsAuth": false,
-        "sha256": "7848f2d8b2b32a0efeb8a401657459486eda9b8072c221d0f9c0b450290da0d6",
+        "sha256": "5a4bc4c3b2a97ed1fc58eb796321e848dcc64435bd91013dd9c78a14a8ce8815",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.11/headless/linux64",
-        "version": "2.0.11"
+        "url": "https://factorio.com/get-download/2.0.14/headless/linux64",
+        "version": "2.0.14"
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio-headless_linux_2.0.11.tar.xz",
-          "factorio_headless_x64_2.0.11.tar.xz"
+          "factorio-headless_linux_2.0.13.tar.xz",
+          "factorio_headless_x64_2.0.13.tar.xz"
         ],
-        "name": "factorio_headless_x64-2.0.11.tar.xz",
+        "name": "factorio_headless_x64-2.0.13.tar.xz",
         "needsAuth": false,
-        "sha256": "7848f2d8b2b32a0efeb8a401657459486eda9b8072c221d0f9c0b450290da0d6",
+        "sha256": "27b36901a39e593adf28418c0286142c6c7a9f83d156963c7369bd405a25c7d1",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.11/headless/linux64",
-        "version": "2.0.11"
+        "url": "https://factorio.com/get-download/2.0.13/headless/linux64",
+        "version": "2.0.13"
       }
     }
   }