staging-next 2025-01-06 (#371501)

doc/interoperability/openxr.md

@@ -0,0 +1,5 @@
+# OpenXR in NixOS
+
+OpenXR is a standard for eXtended Reality (XR) applications and drivers (providers).
+
+OpenXR runtime providers must ensure that the library path of the runtime's shared library can be loaded by Nix applications. If your OpenXR runtime provider runs in an FHSEnv, this means you may have to use `auto-patchelf` to link dependencies to the Nix store.

doc/languages-frameworks/haskell.section.md

@@ -57,7 +57,7 @@ Available compilers are collected under `haskell.compiler`.
 Each of those compiler versions has a corresponding attribute set `packages` built with
 it. However, the non-standard package sets are not tested regularly and, as a
 result, contain fewer working packages. The corresponding package set for GHC
-9.4.5 is `haskell.packages.ghc945`. In fact `haskellPackages` (at the time of writing) is just an alias
+9.4.8 is `haskell.packages.ghc948`. In fact `haskellPackages` (at the time of writing) is just an alias
 for `haskell.packages.ghc966`:
 
 Every package set also re-exposes the GHC used to build its packages as `haskell.packages.*.ghc`.
@@ -764,7 +764,7 @@ that depend on that library, you may want to use:
 
 ```nix
 haskellPackages.haskell-ci.overrideScope (self: super: {
-  Cabal = self.Cabal_3_14_0_0;
+  Cabal = self.Cabal_3_14_1_0;
 })
 ```
 

doc/stdenv/cross-compilation.chapter.md

@@ -135,7 +135,7 @@ Many packages assume that an unprefixed binutils (`cc`/`ar`/`ld` etc.) is availa
 ```
 
 #### How do I avoid compiling a GCC cross-compiler from source? {#cross-qa-avoid-compiling-gcc-cross-compiler}
-On less powerful machines, it can be inconvenient to cross-compile a package only to find out that GCC has to be compiled from source, which could take up to several hours. Nixpkgs maintains a limited [cross-related jobset on Hydra](https://hydra.nixos.org/jobset/nixpkgs/cross-trunk), which tests cross-compilation to various platforms from build platforms "x86\_64-darwin", "x86\_64-linux", and "aarch64-linux".  See `pkgs/top-level/release-cross.nix` for the full list of target platforms and packages.  For instance, the following invocation fetches the pre-built cross-compiled GCC for `armv6l-unknown-linux-gnueabihf` and builds GNU Hello from source.
+On less powerful machines, it can be inconvenient to cross-compile a package only to find out that GCC has to be compiled from source, which could take up to several hours. Nixpkgs maintains a limited [cross-related jobset on Hydra](https://hydra.nixos.org/jobset/nixpkgs/cross-trunk), which tests cross-compilation to various platforms from build platforms "x86\_64-linux", "aarch64-linux", and "aarch64-darwin".  See `pkgs/top-level/release-cross.nix` for the full list of target platforms and packages.  For instance, the following invocation fetches the pre-built cross-compiled GCC for `armv6l-unknown-linux-gnueabihf` and builds GNU Hello from source.
 
 ```ShellSession
 $ nix-build '<nixpkgs>' -A pkgsCross.raspberryPi.hello

doc/stdenv/stdenv.chapter.md

@@ -75,17 +75,9 @@ stdenv.mkDerivation {
 }
 ```
 
-where the builder can do anything it wants, but typically starts with
+where `stdenv` sets up the environment automatically (e.g. by resetting `PATH` and populating it from build inputs). If you want, you can use `stdenv`’s generic builder:
 
 ```bash
-source $stdenv/setup
-```
-
-to let `stdenv` set up the environment (e.g. by resetting `PATH` and populating it from build inputs). If you want, you can still use `stdenv`’s generic builder:
-
-```bash
-source $stdenv/setup
-
 buildPhase() {
   echo "... this is my custom build phase ..."
   gcc foo.c -o foo
@@ -1276,7 +1268,7 @@ addEnvHooks "$hostOffset" myBashFunction
 
 The *existence* of setups hooks has long been documented and packages inside Nixpkgs are free to use this mechanism. Other packages, however, should not rely on these mechanisms not changing between Nixpkgs versions. Because of the existing issues with this system, there’s little benefit from mandating it be stable for any period of time.
 
-First, let’s cover some setup hooks that are part of Nixpkgs default `stdenv`. This means that they are run for every package built using `stdenv.mkDerivation` or when using a custom builder that has `source $stdenv/setup`. Some of these are platform specific, so they may run on Linux but not Darwin or vice-versa.
+First, let’s cover some setup hooks that are part of Nixpkgs default `stdenv`. This means that they are run for every package built using `stdenv.mkDerivation`, even with custom builders. Some of these are platform specific, so they may run on Linux but not Darwin or vice-versa.
 
 ### `move-docs.sh` {#move-docs.sh}
 
@@ -1411,6 +1403,7 @@ these in the [Hooks Reference](#chap-hooks).
 ### Compiler and Linker wrapper hooks {#compiler-linker-wrapper-hooks}
 
 If the file `${cc}/nix-support/cc-wrapper-hook` exists, it will be run at the end of the [compiler wrapper](#cc-wrapper).
+If the file `${binutils}/nix-support/ld-wrapper-hook` exists, it will be run at the end of the linker wrapper, before the linker runs.
 If the file `${binutils}/nix-support/post-link-hook` exists, it will be run at the end of the linker wrapper.
 These hooks allow a user to inject code into the wrappers.
 As an example, these hooks can be used to extract `extraBefore`, `params` and `extraAfter` which store all the command line arguments passed to the compiler and linker respectively.

maintainers/maintainer-list.nix

@@ -17251,6 +17251,14 @@
     githubId = 108072;
     name = "Slawomir Gonet";
   };
+  outfoxxed = {
+    name = "outfoxxed";
+    email = "nixpkgs@outfoxxed.me";
+    matrix = "@outfoxxed:outfoxxed.me";
+    github = "outfoxxed";
+    githubId = 83010835;
+    keys = [ { fingerprint = "0181 FF89 4F34 7FCC EB06  5710 4C88 A185 FB89 301E"; } ];
+  };
   ovlach = {
     email = "ondrej@vlach.xyz";
     name = "Ondrej Vlach";

maintainers/scripts/haskell/update-cabal2nix-unstable.sh

@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -p coreutils curl jq gnused haskellPackages.cabal2nix-unstable -I nixpkgs=.
+#! nix-shell -i bash -p coreutils curl jq gnused haskellPackages.cabal2nix-unstable nixfmt-rfc-style -I nixpkgs=.
 
 # Updates cabal2nix-unstable to the latest master of the nixos/cabal2nix repository.
 # See regenerate-hackage-packages.sh for details on the purpose of this script.
@@ -13,5 +13,7 @@ commit="$(jq -r .commit.sha <<< "$head_info")"
 # extract commit timestamp and convert to date
 date="$(date "--date=$(jq -r .commit.commit.committer.date <<< "$head_info")" +%F)"
 # generate nix expression from cabal file, replacing the version with the commit date
-echo '# This file defines cabal2nix-unstable, used by maintainers/scripts/haskell/regenerate-hackage-packages.sh.' > pkgs/development/haskell-modules/cabal2nix-unstable.nix
-cabal2nix --subpath cabal2nix "https://github.com/NixOS/cabal2nix/archive/$commit.tar.gz" | sed -e 's/version = ".*"/version = "'"unstable-$date"'"/' >> pkgs/development/haskell-modules/cabal2nix-unstable.nix
+output=pkgs/development/haskell-modules/cabal2nix-unstable.nix
+echo '# This file defines cabal2nix-unstable, used by maintainers/scripts/haskell/regenerate-hackage-packages.sh.' > "$output"
+cabal2nix --subpath cabal2nix "https://github.com/NixOS/cabal2nix/archive/$commit.tar.gz" | sed -e 's/version = ".*"/version = "'"unstable-$date"'"/' >> "$output"
+nixfmt "$output"

maintainers/scripts/haskell/update-stackage.sh

@@ -8,7 +8,7 @@ set -eu -o pipefail
 # (should be capitalized like the display name)
 SOLVER=LTS
 # Stackage solver verson, if any. Use latest if empty
-VERSION=
+VERSION=22
 TMP_TEMPLATE=update-stackage.XXXXXXX
 readonly SOLVER
 readonly VERSION

nixos/lib/make-disk-image.nix

@@ -1,115 +1,117 @@
-/* Technical details
+/*
+  Technical details
 
-`make-disk-image` has a bit of magic to minimize the amount of work to do in a virtual machine.
+  `make-disk-image` has a bit of magic to minimize the amount of work to do in a virtual machine.
 
-It relies on the [LKL (Linux Kernel Library) project](https://github.com/lkl/linux) which provides Linux kernel as userspace library.
+  It relies on the [LKL (Linux Kernel Library) project](https://github.com/lkl/linux) which provides Linux kernel as userspace library.
 
-The Nix-store only image only need to run LKL tools to produce an image and will never spawn a virtual machine, whereas full images will always require a virtual machine, but also use LKL.
+  The Nix-store only image only need to run LKL tools to produce an image and will never spawn a virtual machine, whereas full images will always require a virtual machine, but also use LKL.
 
-### Image preparation phase
+  ### Image preparation phase
 
-Image preparation phase will produce the initial image layout in a folder:
+  Image preparation phase will produce the initial image layout in a folder:
 
-- devise a root folder based on `$PWD`
-- prepare the contents by copying and restoring ACLs in this root folder
-- load in the Nix store database all additional paths computed by `pkgs.closureInfo` in a temporary Nix store
-- run `nixos-install` in a temporary folder
-- transfer from the temporary store the additional paths registered to the installed NixOS
-- compute the size of the disk image based on the apparent size of the root folder
-- partition the disk image using the corresponding script according to the partition table type
-- format the partitions if needed
-- use `cptofs` (LKL tool) to copy the root folder inside the disk image
+  - devise a root folder based on `$PWD`
+  - prepare the contents by copying and restoring ACLs in this root folder
+  - load in the Nix store database all additional paths computed by `pkgs.closureInfo` in a temporary Nix store
+  - run `nixos-install` in a temporary folder
+  - transfer from the temporary store the additional paths registered to the installed NixOS
+  - compute the size of the disk image based on the apparent size of the root folder
+  - partition the disk image using the corresponding script according to the partition table type
+  - format the partitions if needed
+  - use `cptofs` (LKL tool) to copy the root folder inside the disk image
 
-At this step, the disk image already contains the Nix store, it now only needs to be converted to the desired format to be used.
+  At this step, the disk image already contains the Nix store, it now only needs to be converted to the desired format to be used.
 
-### Image conversion phase
+  ### Image conversion phase
 
-Using `qemu-img`, the disk image is converted from a raw format to the desired format: qcow2(-compressed), vdi, vpc.
+  Using `qemu-img`, the disk image is converted from a raw format to the desired format: qcow2(-compressed), vdi, vpc.
 
-### Image Partitioning
+  ### Image Partitioning
 
-#### `none`
+  #### `none`
 
-No partition table layout is written. The image is a bare filesystem image.
+  No partition table layout is written. The image is a bare filesystem image.
 
-#### `legacy`
+  #### `legacy`
 
-The image is partitioned using MBR. There is one primary ext4 partition starting at 1 MiB that fills the rest of the disk image.
+  The image is partitioned using MBR. There is one primary ext4 partition starting at 1 MiB that fills the rest of the disk image.
 
-This partition layout is unsuitable for UEFI.
+  This partition layout is unsuitable for UEFI.
 
-#### `legacy+gpt`
+  #### `legacy+gpt`
 
-This partition table type uses GPT and:
+  This partition table type uses GPT and:
 
-- create a "no filesystem" partition from 1MiB to 2MiB ;
-- set `bios_grub` flag on this "no filesystem" partition, which marks it as a [GRUB BIOS partition](https://www.gnu.org/software/parted/manual/html_node/set.html) ;
-- create a primary ext4 partition starting at 2MiB and extending to the full disk image ;
-- perform optimal alignments checks on each partition
+  - create a "no filesystem" partition from 1MiB to 2MiB ;
+  - set `bios_grub` flag on this "no filesystem" partition, which marks it as a [GRUB BIOS partition](https://www.gnu.org/software/parted/manual/html_node/set.html) ;
+  - create a primary ext4 partition starting at 2MiB and extending to the full disk image ;
+  - perform optimal alignments checks on each partition
 
-This partition layout is unsuitable for UEFI boot, because it has no ESP (EFI System Partition) partition. It can work with CSM (Compatibility Support Module) which emulates legacy (BIOS) boot for UEFI.
+  This partition layout is unsuitable for UEFI boot, because it has no ESP (EFI System Partition) partition. It can work with CSM (Compatibility Support Module) which emulates legacy (BIOS) boot for UEFI.
 
-#### `efi`
+  #### `efi`
 
-This partition table type uses GPT and:
+  This partition table type uses GPT and:
 
-- creates an FAT32 ESP partition from 8MiB to specified `bootSize` parameter (256MiB by default), set it bootable ;
-- creates an primary ext4 partition starting after the boot partition and extending to the full disk image
+  - creates an FAT32 ESP partition from 8MiB to specified `bootSize` parameter (256MiB by default), set it bootable ;
+  - creates an primary ext4 partition starting after the boot partition and extending to the full disk image
 
-#### `efixbootldr`
+  #### `efixbootldr`
 
-This partition table type uses GPT and:
+  This partition table type uses GPT and:
 
-- creates an FAT32 ESP partition from 8MiB to 100MiB, set it bootable ;
-- creates an FAT32 BOOT partition from 100MiB to specified `bootSize` parameter (256MiB by default), set `bls_boot` flag ;
-- creates an primary ext4 partition starting after the boot partition and extending to the full disk image
+  - creates an FAT32 ESP partition from 8MiB to 100MiB, set it bootable ;
+  - creates an FAT32 BOOT partition from 100MiB to specified `bootSize` parameter (256MiB by default), set `bls_boot` flag ;
+  - creates an primary ext4 partition starting after the boot partition and extending to the full disk image
 
-#### `hybrid`
+  #### `hybrid`
 
-This partition table type uses GPT and:
+  This partition table type uses GPT and:
 
-- creates a "no filesystem" partition from 0 to 1MiB, set `bios_grub` flag on it ;
-- creates an FAT32 ESP partition from 8MiB to specified `bootSize` parameter (256MiB by default), set it bootable ;
-- creates a primary ext4 partition starting after the boot one and extending to the full disk image
+  - creates a "no filesystem" partition from 0 to 1MiB, set `bios_grub` flag on it ;
+  - creates an FAT32 ESP partition from 8MiB to specified `bootSize` parameter (256MiB by default), set it bootable ;
+  - creates a primary ext4 partition starting after the boot one and extending to the full disk image
 
-This partition could be booted by a BIOS able to understand GPT layouts and recognizing the MBR at the start.
+  This partition could be booted by a BIOS able to understand GPT layouts and recognizing the MBR at the start.
 
-### How to run determinism analysis on results?
+  ### How to run determinism analysis on results?
 
-Build your derivation with `--check` to rebuild it and verify it is the same.
+  Build your derivation with `--check` to rebuild it and verify it is the same.
 
-If it fails, you will be left with two folders with one having `.check`.
+  If it fails, you will be left with two folders with one having `.check`.
 
-You can use `diffoscope` to see the differences between the folders.
+  You can use `diffoscope` to see the differences between the folders.
 
-However, `diffoscope` is currently not able to diff two QCOW2 filesystems, thus, it is advised to use raw format.
+  However, `diffoscope` is currently not able to diff two QCOW2 filesystems, thus, it is advised to use raw format.
 
-Even if you use raw disks, `diffoscope` cannot diff the partition table and partitions recursively.
+  Even if you use raw disks, `diffoscope` cannot diff the partition table and partitions recursively.
 
-To solve this, you can run `fdisk -l $image` and generate `dd if=$image of=$image-p$i.raw skip=$start count=$sectors` for each `(start, sectors)` listed in the `fdisk` output. Now, you will have each partition as a separate file and you can compare them in pairs.
+  To solve this, you can run `fdisk -l $image` and generate `dd if=$image of=$image-p$i.raw skip=$start count=$sectors` for each `(start, sectors)` listed in the `fdisk` output. Now, you will have each partition as a separate file and you can compare them in pairs.
 */
-{ pkgs
-, lib
+{
+  pkgs,
+  lib,
 
-, # The NixOS configuration to be installed onto the disk image.
-  config
+  # The NixOS configuration to be installed onto the disk image.
+  config,
 
-, # The size of the disk, in megabytes.
+  # The size of the disk, in megabytes.
   # if "auto" size is calculated based on the contents copied to it and
   #   additionalSpace is taken into account.
-  diskSize ? "auto"
+  diskSize ? "auto",
 
-, # additional disk space to be added to the image if diskSize "auto"
+  # additional disk space to be added to the image if diskSize "auto"
   # is used
-  additionalSpace ? "512M"
+  additionalSpace ? "512M",
 
-, # size of the boot partition, is only used if partitionTableType is
+  # size of the boot partition, is only used if partitionTableType is
   # either "efi" or "hybrid"
   # This will be undersized slightly, as this is actually the offset of
   # the end of the partition. Generally it will be 1MiB smaller.
-  bootSize ? "256M"
+  bootSize ? "256M",
 
-, # The files and directories to be placed in the target file system.
+  # The files and directories to be placed in the target file system.
   # This is a list of attribute sets {source, target, mode, user, group} where
   # `source' is the file system object (regular file or directory) to be
   # grafted in the file system at path `target', `mode' is a string containing
@@ -117,54 +119,54 @@ To solve this, you can run `fdisk -l $image` and generate `dd if=$image of=$imag
   # user and group name that will be set as owner of the files.
   # `mode', `user', and `group' are optional.
   # When setting one of `user' or `group', the other needs to be set too.
-  contents ? []
+  contents ? [ ],
 
-, # Type of partition table to use; described in the `Image Partitioning` section above.
-  partitionTableType ? "legacy"
+  # Type of partition table to use; described in the `Image Partitioning` section above.
+  partitionTableType ? "legacy",
 
-, # Whether to invoke `switch-to-configuration boot` during image creation
-  installBootLoader ? true
+  # Whether to invoke `switch-to-configuration boot` during image creation
+  installBootLoader ? true,
 
-, # Whether to output have EFIVARS available in $out/efi-vars.fd and use it during disk creation
-  touchEFIVars ? false
+  # Whether to output have EFIVARS available in $out/efi-vars.fd and use it during disk creation
+  touchEFIVars ? false,
 
-, # OVMF firmware derivation
-  OVMF ? pkgs.OVMF.fd
+  # OVMF firmware derivation
+  OVMF ? pkgs.OVMF.fd,
 
-, # EFI firmware
-  efiFirmware ? OVMF.firmware
+  # EFI firmware
+  efiFirmware ? OVMF.firmware,
 
-, # EFI variables
-  efiVariables ? OVMF.variables
+  # EFI variables
+  efiVariables ? OVMF.variables,
 
-, # The root file system type.
-  fsType ? "ext4"
+  # The root file system type.
+  fsType ? "ext4",
 
-, # Filesystem label
-  label ? if onlyNixStore then "nix-store" else "nixos"
+  # Filesystem label
+  label ? if onlyNixStore then "nix-store" else "nixos",
 
-, # The initial NixOS configuration file to be copied to
+  # The initial NixOS configuration file to be copied to
   # /etc/nixos/configuration.nix.
-  configFile ? null
+  configFile ? null,
 
-, # Shell code executed after the VM has finished.
-  postVM ? ""
+  # Shell code executed after the VM has finished.
+  postVM ? "",
 
-, # Guest memory size
-  memSize ? 1024
+  # Guest memory size
+  memSize ? 1024,
 
-, # Copy the contents of the Nix store to the root of the image and
+  # Copy the contents of the Nix store to the root of the image and
   # skip further setup. Incompatible with `contents`,
   # `installBootLoader` and `configFile`.
-  onlyNixStore ? false
+  onlyNixStore ? false,
 
-, name ? "nixos-disk-image"
+  name ? "nixos-disk-image",
 
-, # Disk image format, one of qcow2, qcow2-compressed, vdi, vpc, raw.
-  format ? "raw"
+  # Disk image format, one of qcow2, qcow2-compressed, vdi, vpc, raw.
+  format ? "raw",
 
-, # Disk image filename, without any extensions (e.g. `image_1`).
-  baseName ? "nixos"
+  # Disk image filename, without any extensions (e.g. `image_1`).
+  baseName ? "nixos",
 
   # Whether to fix:
   #   - GPT Disk Unique Identifier (diskGUID)
@@ -174,139 +176,191 @@ To solve this, you can run `fdisk -l $image` and generate `dd if=$image of=$imag
   # BIOS/MBR support is "best effort" at the moment.
   # Boot partitions may not be deterministic.
   # Also, to fix last time checked of the ext4 partition if fsType = ext4.
-, deterministic ? true
+  deterministic ? true,
 
   # GPT Partition Unique Identifier for root partition.
-, rootGPUID ? "F222513B-DED1-49FA-B591-20CE86A2FE7F"
+  rootGPUID ? "F222513B-DED1-49FA-B591-20CE86A2FE7F",
   # When fsType = ext4, this is the root Filesystem Unique Identifier.
   # TODO: support other filesystems someday.
-, rootFSUID ? (if fsType == "ext4" then rootGPUID else null)
+  rootFSUID ? (if fsType == "ext4" then rootGPUID else null),
 
-, # Whether a nix channel based on the current source tree should be
+  # Whether a nix channel based on the current source tree should be
   # made available inside the image. Useful for interactive use of nix
   # utils, but changes the hash of the image when the sources are
   # updated.
-  copyChannel ? true
+  copyChannel ? true,
 
-, # Additional store paths to copy to the image's store.
-  additionalPaths ? []
+  # Additional store paths to copy to the image's store.
+  additionalPaths ? [ ],
 }:
 
-assert (lib.assertOneOf "partitionTableType" partitionTableType [ "legacy" "legacy+gpt" "efi" "efixbootldr" "hybrid" "none" ]);
-assert (lib.assertMsg (fsType == "ext4" && deterministic -> rootFSUID != null) "In deterministic mode with a ext4 partition, rootFSUID must be non-null, by default, it is equal to rootGPUID.");
-  # We use -E offset=X below, which is only supported by e2fsprogs
-assert (lib.assertMsg (partitionTableType != "none" -> fsType == "ext4") "to produce a partition table, we need to use -E offset flag which is support only for fsType = ext4");
-assert (lib.assertMsg (touchEFIVars -> partitionTableType == "hybrid" || partitionTableType == "efi" || partitionTableType == "efixbootldr" || partitionTableType == "legacy+gpt") "EFI variables can be used only with a partition table of type: hybrid, efi, efixbootldr, or legacy+gpt.");
-  # If only Nix store image, then: contents must be empty, configFile must be unset, and we should no install bootloader.
-assert (lib.assertMsg (onlyNixStore -> contents == [] && configFile == null && !installBootLoader) "In a only Nix store image, the contents must be empty, no configuration must be provided and no bootloader should be installed.");
+assert (
+  lib.assertOneOf "partitionTableType" partitionTableType [
+    "legacy"
+    "legacy+gpt"
+    "efi"
+    "efixbootldr"
+    "hybrid"
+    "none"
+  ]
+);
+assert (
+  lib.assertMsg (fsType == "ext4" && deterministic -> rootFSUID != null)
+    "In deterministic mode with a ext4 partition, rootFSUID must be non-null, by default, it is equal to rootGPUID."
+);
+# We use -E offset=X below, which is only supported by e2fsprogs
+assert (
+  lib.assertMsg (partitionTableType != "none" -> fsType == "ext4")
+    "to produce a partition table, we need to use -E offset flag which is support only for fsType = ext4"
+);
+assert (
+  lib.assertMsg
+    (
+      touchEFIVars
+      ->
+        partitionTableType == "hybrid"
+        || partitionTableType == "efi"
+        || partitionTableType == "efixbootldr"
+        || partitionTableType == "legacy+gpt"
+    )
+    "EFI variables can be used only with a partition table of type: hybrid, efi, efixbootldr, or legacy+gpt."
+);
+# If only Nix store image, then: contents must be empty, configFile must be unset, and we should no install bootloader.
+assert (
+  lib.assertMsg (onlyNixStore -> contents == [ ] && configFile == null && !installBootLoader)
+    "In a only Nix store image, the contents must be empty, no configuration must be provided and no bootloader should be installed."
+);
 # Either both or none of {user,group} need to be set
-assert (lib.assertMsg (lib.all
-         (attrs: ((attrs.user  or null) == null)
-              == ((attrs.group or null) == null))
-        contents) "Contents of the disk image should set none of {user, group} or both at the same time.");
+assert (
+  lib.assertMsg (lib.all (
+    attrs: ((attrs.user or null) == null) == ((attrs.group or null) == null)
+  ) contents) "Contents of the disk image should set none of {user, group} or both at the same time."
+);
 
-let format' = format; in let
+let
+  format' = format;
+in
+let
 
   format = if format' == "qcow2-compressed" then "qcow2" else format';
 
   compress = lib.optionalString (format' == "qcow2-compressed") "-c";
 
-  filename = "${baseName}." + {
-    qcow2 = "qcow2";
-    vdi   = "vdi";
-    vpc   = "vhd";
-    raw   = "img";
-  }.${format} or format;
+  filename =
+    "${baseName}."
+    + {
+      qcow2 = "qcow2";
+      vdi = "vdi";
+      vpc = "vhd";
+      raw = "img";
+    }
+    .${format} or format;
 
-  rootPartition = { # switch-case
-    legacy = "1";
-    "legacy+gpt" = "2";
-    efi = "2";
-    efixbootldr = "3";
-    hybrid = "3";
-  }.${partitionTableType};
+  rootPartition =
+    {
+      # switch-case
+      legacy = "1";
+      "legacy+gpt" = "2";
+      efi = "2";
+      efixbootldr = "3";
+      hybrid = "3";
+    }
+    .${partitionTableType};
 
-  partitionDiskScript = { # switch-case
-    legacy = ''
-      parted --script $diskImage -- \
-        mklabel msdos \
-        mkpart primary ext4 1MiB -1
-    '';
-    "legacy+gpt" = ''
-      parted --script $diskImage -- \
-        mklabel gpt \
-        mkpart no-fs 1MB 2MB \
-        set 1 bios_grub on \
-        align-check optimal 1 \
-        mkpart primary ext4 2MB -1 \
-        align-check optimal 2 \
-        print
-      ${lib.optionalString deterministic ''
+  partitionDiskScript =
+    {
+      # switch-case
+      legacy = ''
+        parted --script $diskImage -- \
+          mklabel msdos \
+          mkpart primary ext4 1MiB 100% \
+          print
+      '';
+      "legacy+gpt" = ''
+        parted --script $diskImage -- \
+          mklabel gpt \
+          mkpart no-fs 1MiB 2MiB \
+          set 1 bios_grub on \
+          mkpart primary ext4 2MiB 100% \
+          align-check optimal 2 \
+          print
+        ${lib.optionalString deterministic ''
           sgdisk \
           --disk-guid=97FD5997-D90B-4AA3-8D16-C1723AEA73C \
           --partition-guid=1:1C06F03B-704E-4657-B9CD-681A087A2FDC \
           --partition-guid=2:970C694F-AFD0-4B99-B750-CDB7A329AB6F \
           --partition-guid=3:${rootGPUID} \
           $diskImage
-      ''}
-    '';
-    efi = ''
-      parted --script $diskImage -- \
-        mklabel gpt \
-        mkpart ESP fat32 8MiB ${bootSize} \
-        set 1 boot on \
-        mkpart primary ext4 ${bootSize} -1
-      ${lib.optionalString deterministic ''
+        ''}
+      '';
+      efi = ''
+        parted --script $diskImage -- \
+          mklabel gpt \
+          mkpart ESP fat32 8MiB $bootSizeMiB \
+          set 1 boot on \
+          align-check optimal 1 \
+          mkpart primary ext4 $bootSizeMiB 100% \
+          align-check optimal 2 \
+          print
+        ${lib.optionalString deterministic ''
           sgdisk \
           --disk-guid=97FD5997-D90B-4AA3-8D16-C1723AEA73C \
           --partition-guid=1:1C06F03B-704E-4657-B9CD-681A087A2FDC \
           --partition-guid=2:${rootGPUID} \
           $diskImage
-      ''}
-    '';
-    efixbootldr = ''
-      parted --script $diskImage -- \
-        mklabel gpt \
-        mkpart ESP fat32 8MiB 100MiB \
-        set 1 boot on \
-        mkpart BOOT fat32 100MiB ${bootSize} \
-        set 2 bls_boot on \
-        mkpart ROOT ext4 ${bootSize} -1
-      ${lib.optionalString deterministic ''
+        ''}
+      '';
+      efixbootldr = ''
+        parted --script $diskImage -- \
+          mklabel gpt \
+          mkpart ESP fat32 8MiB 100MiB \
+          set 1 boot on \
+          align-check optimal 1 \
+          mkpart BOOT fat32 100MiB $bootSizeMiB \
+          set 2 bls_boot on \
+          align-check optimal 2 \
+          mkpart ROOT ext4 $bootSizeMiB 100% \
+          align-check optimal 3 \
+          print
+        ${lib.optionalString deterministic ''
           sgdisk \
           --disk-guid=97FD5997-D90B-4AA3-8D16-C1723AEA73C \
           --partition-guid=1:1C06F03B-704E-4657-B9CD-681A087A2FDC  \
           --partition-guid=2:970C694F-AFD0-4B99-B750-CDB7A329AB6F  \
           --partition-guid=3:${rootGPUID} \
           $diskImage
-      ''}
-    '';
-    hybrid = ''
-      parted --script $diskImage -- \
-        mklabel gpt \
-        mkpart ESP fat32 8MiB ${bootSize} \
-        set 1 boot on \
-        mkpart no-fs 0 1024KiB \
-        set 2 bios_grub on \
-        mkpart primary ext4 ${bootSize} -1
-      ${lib.optionalString deterministic ''
+        ''}
+      '';
+      hybrid = ''
+        parted --script $diskImage -- \
+          mklabel gpt \
+          mkpart ESP fat32 8MiB $bootSizeMiB \
+          set 1 boot on \
+          align-check optimal 1 \
+          mkpart no-fs 0 1024KiB \
+          set 2 bios_grub on \
+          mkpart primary ext4 $bootSizeMiB 100% \
+          align-check optimal 3 \
+          print
+        ${lib.optionalString deterministic ''
           sgdisk \
           --disk-guid=97FD5997-D90B-4AA3-8D16-C1723AEA73C \
           --partition-guid=1:1C06F03B-704E-4657-B9CD-681A087A2FDC \
           --partition-guid=2:970C694F-AFD0-4B99-B750-CDB7A329AB6F \
           --partition-guid=3:${rootGPUID} \
           $diskImage
-      ''}
-    '';
-    none = "";
-  }.${partitionTableType};
+        ''}
+      '';
+      none = "";
+    }
+    .${partitionTableType};
 
   useEFIBoot = touchEFIVars;
 
   nixpkgs = lib.cleanSource pkgs.path;
 
   # FIXME: merge with channel.nix / make-channel.nix.
-  channelSources = pkgs.runCommand "nixos-${config.system.nixos.version}" {} ''
+  channelSources = pkgs.runCommand "nixos-${config.system.nixos.version}" { } ''
     mkdir -p $out
     cp -prd ${nixpkgs.outPath} $out/nixos
     chmod -R u+w $out/nixos
@@ -317,7 +371,9 @@ let format' = format; in let
     echo -n ${config.system.nixos.versionSuffix} > $out/nixos/.version-suffix
   '';
 
-  binPath = lib.makeBinPath (with pkgs; [
+  binPath = lib.makeBinPath (
+    with pkgs;
+    [
       rsync
       util-linux
       parted
@@ -329,19 +385,19 @@ let format' = format; in let
       systemdMinimal
     ]
     ++ lib.optional deterministic gptfdisk
-    ++ stdenv.initialPath);
+    ++ stdenv.initialPath
+  );
 
   # I'm preserving the line below because I'm going to search for it across nixpkgs to consolidate
   # image building logic. The comment right below this now appears in 4 different places in nixpkgs :)
   # !!! should use XML.
   sources = map (x: x.source) contents;
   targets = map (x: x.target) contents;
-  modes   = map (x: x.mode  or "''") contents;
-  users   = map (x: x.user  or "''") contents;
-  groups  = map (x: x.group or "''") contents;
+  modes = map (x: x.mode or "''") contents;
+  users = map (x: x.user or "''") contents;
+  groups = map (x: x.group or "''") contents;
 
-  basePaths = [ config.system.build.toplevel ]
-    ++ lib.optional copyChannel channelSources;
+  basePaths = [ config.system.build.toplevel ] ++ lib.optional copyChannel channelSources;
 
   additionalPaths' = lib.subtractLists basePaths additionalPaths;
 
@@ -381,6 +437,10 @@ let format' = format; in let
       echo $(( $1 * 52 / 1000 ))
     }
 
+    round_to_nearest() {
+      echo $(( ( $1 / $2 + 1) * $2 ))
+    }
+
     mkdir $out
 
     root="$PWD/root"
@@ -444,75 +504,102 @@ let format' = format; in let
       ${if copyChannel then "--channel ${channelSources}" else "--no-channel-copy"} \
       --substituters ""
 
-    ${lib.optionalString (additionalPaths' != []) ''
+    ${lib.optionalString (additionalPaths' != [ ]) ''
       nix --extra-experimental-features nix-command copy --to $root --no-check-sigs ${lib.concatStringsSep " " additionalPaths'}
     ''}
 
     diskImage=nixos.raw
 
-    ${if diskSize == "auto" then ''
-      ${if partitionTableType == "efi" || partitionTableType == "efixbootldr" || partitionTableType == "hybrid" then ''
-        # Add the GPT at the end
-        gptSpace=$(( 512 * 34 * 1 ))
-        # Normally we'd need to account for alignment and things, if bootSize
-        # represented the actual size of the boot partition. But it instead
-        # represents the offset at which it ends.
-        # So we know bootSize is the reserved space in front of the partition.
-        reservedSpace=$(( gptSpace + $(numfmt --from=iec '${bootSize}') ))
-      '' else if partitionTableType == "legacy+gpt" then ''
-        # Add the GPT at the end
-        gptSpace=$(( 512 * 34 * 1 ))
-        # And include the bios_grub partition; the ext4 partition starts at 2MB exactly.
-        reservedSpace=$(( gptSpace + 2 * mebibyte ))
-      '' else if partitionTableType == "legacy" then ''
-        # Add the 1MiB aligned reserved space (includes MBR)
-        reservedSpace=$(( mebibyte ))
-      '' else ''
-        reservedSpace=0
-      ''}
-      additionalSpace=$(( $(numfmt --from=iec '${additionalSpace}') + reservedSpace ))
+    bootSize=$(round_to_nearest $(numfmt --from=iec '${bootSize}') $mebibyte)
+    bootSizeMiB=$(( bootSize / 1024 / 1024 ))MiB
 
-      # Compute required space in filesystem blocks
-      diskUsage=$(find . ! -type d -print0 | du --files0-from=- --apparent-size --count-links --block-size "${blockSize}" | cut -f1 | sum_lines)
-      # Each inode takes space!
-      numInodes=$(find . | wc -l)
-      # Convert to bytes, inodes take two blocks each!
-      diskUsage=$(( (diskUsage + 2 * numInodes) * ${blockSize} ))
-      # Then increase the required space to account for the reserved blocks.
-      fudge=$(compute_fudge $diskUsage)
-      requiredFilesystemSpace=$(( diskUsage + fudge ))
+    ${
+      if diskSize == "auto" then
+        ''
+          ${
+            if
+              partitionTableType == "efi" || partitionTableType == "efixbootldr" || partitionTableType == "hybrid"
+            then
+              ''
+                # Add the GPT at the end
+                gptSpace=$(( 512 * 34 * 1 ))
+                # Normally we'd need to account for alignment and things, if bootSize
+                # represented the actual size of the boot partition. But it instead
+                # represents the offset at which it ends.
+                # So we know bootSize is the reserved space in front of the partition.
+                reservedSpace=$(( gptSpace + bootSize ))
+              ''
+            else if partitionTableType == "legacy+gpt" then
+              ''
+                # Add the GPT at the end
+                gptSpace=$(( 512 * 34 * 1 ))
+                # And include the bios_grub partition; the ext4 partition starts at 2MiB exactly.
+                reservedSpace=$(( gptSpace + 2 * mebibyte ))
+              ''
+            else if partitionTableType == "legacy" then
+              ''
+                # Add the 1MiB aligned reserved space (includes MBR)
+                reservedSpace=$(( mebibyte ))
+              ''
+            else
+              ''
+                reservedSpace=0
+              ''
+          }
+          additionalSpace=$(( $(numfmt --from=iec '${additionalSpace}') + reservedSpace ))
 
-      diskSize=$(( requiredFilesystemSpace  + additionalSpace ))
+          # Compute required space in filesystem blocks
+          diskUsage=$(find . ! -type d -print0 | du --files0-from=- --apparent-size --count-links --block-size "${blockSize}" | cut -f1 | sum_lines)
+          # Each inode takes space!
+          numInodes=$(find . | wc -l)
+          # Convert to bytes, inodes take two blocks each!
+          diskUsage=$(( (diskUsage + 2 * numInodes) * ${blockSize} ))
+          # Then increase the required space to account for the reserved blocks.
+          fudge=$(compute_fudge $diskUsage)
+          requiredFilesystemSpace=$(( diskUsage + fudge ))
 
-      # Round up to the nearest mebibyte.
-      # This ensures whole 512 bytes sector sizes in the disk image
-      # and helps towards aligning partitions optimally.
-      if (( diskSize % mebibyte )); then
-        diskSize=$(( ( diskSize / mebibyte + 1) * mebibyte ))
-      fi
+          # Round up to the nearest block size.
+          # This ensures whole $blockSize bytes block sizes in the filesystem
+          # and helps towards aligning partitions optimally.
+          requiredFilesystemSpace=$(round_to_nearest $requiredFilesystemSpace ${blockSize})
 
-      truncate -s "$diskSize" $diskImage
+          diskSize=$(( requiredFilesystemSpace + additionalSpace ))
 
-      printf "Automatic disk size...\n"
-      printf "  Closure space use: %d bytes\n" $diskUsage
-      printf "  fudge: %d bytes\n" $fudge
-      printf "  Filesystem size needed: %d bytes\n" $requiredFilesystemSpace
-      printf "  Additional space: %d bytes\n" $additionalSpace
-      printf "  Disk image size: %d bytes\n" $diskSize
-    '' else ''
-      truncate -s ${toString diskSize}M $diskImage
-    ''}
+          # Round up to the nearest mebibyte.
+          # This ensures whole 512 bytes sector sizes in the disk image
+          # and helps towards aligning partitions optimally.
+          diskSize=$(round_to_nearest $diskSize $mebibyte)
+
+          truncate -s "$diskSize" $diskImage
+
+          printf "Automatic disk size...\n"
+          printf "  Closure space use: %d bytes\n" $diskUsage
+          printf "  fudge: %d bytes\n" $fudge
+          printf "  Filesystem size needed: %d bytes\n" $requiredFilesystemSpace
+          printf "  Additional space: %d bytes\n" $additionalSpace
+          printf "  Disk image size: %d bytes\n" $diskSize
+        ''
+      else
+        ''
+          truncate -s ${toString diskSize}M $diskImage
+        ''
+    }
 
     ${partitionDiskScript}
 
-    ${if partitionTableType != "none" then ''
-      # Get start & length of the root partition in sectors to $START and $SECTORS.
-      eval $(partx $diskImage -o START,SECTORS --nr ${rootPartition} --pairs)
+    ${
+      if partitionTableType != "none" then
+        ''
+          # Get start & length of the root partition in sectors to $START and $SECTORS.
+          eval $(partx $diskImage -o START,SECTORS --nr ${rootPartition} --pairs)
 
-      mkfs.${fsType} -b ${blockSize} -F -L ${label} $diskImage -E offset=$(sectorsToBytes $START) $(sectorsToKilobytes $SECTORS)K
-    '' else ''
-      mkfs.${fsType} -b ${blockSize} -F -L ${label} $diskImage
-    ''}
+          mkfs.${fsType} -b ${blockSize} -F -L ${label} $diskImage -E offset=$(sectorsToBytes $START) $(sectorsToKilobytes $SECTORS)K
+        ''
+      else
+        ''
+          mkfs.${fsType} -b ${blockSize} -F -L ${label} $diskImage
+        ''
+    }
 
     echo "copying staging root to image..."
     cptofs -p ${lib.optionalString (partitionTableType != "none") "-P ${rootPartition}"} \
@@ -523,11 +610,16 @@ let format' = format; in let
   '';
 
   moveOrConvertImage = ''
-    ${if format == "raw" then ''
-      mv $diskImage $out/${filename}
-    '' else ''
-      ${pkgs.qemu-utils}/bin/qemu-img convert -f raw -O ${format} ${compress} $diskImage $out/${filename}
-    ''}
+    ${
+      if format == "raw" then
+        ''
+          mv $diskImage $out/${filename}
+        ''
+      else
+        ''
+          ${pkgs.qemu-utils}/bin/qemu-img convert -f raw -O ${format} ${compress} $diskImage $out/${filename}
+        ''
+    }
     diskImage=$out/${filename}
   '';
 
@@ -543,74 +635,87 @@ let format' = format; in let
   '';
 
   buildImage = pkgs.vmTools.runInLinuxVM (
-    pkgs.runCommand name {
-      preVM = prepareImage + lib.optionalString touchEFIVars createEFIVars;
-      buildInputs = with pkgs; [ util-linux e2fsprogs dosfstools ];
-      postVM = moveOrConvertImage + createHydraBuildProducts + postVM;
-      QEMU_OPTS =
-        lib.concatStringsSep " " (lib.optional useEFIBoot "-drive if=pflash,format=raw,unit=0,readonly=on,file=${efiFirmware}"
-        ++ lib.optionals touchEFIVars [
-          "-drive if=pflash,format=raw,unit=1,file=$efiVars"
-        ] ++ lib.optionals (OVMF.systemManagementModeRequired or false) [
-          "-machine" "q35,smm=on"
-          "-global" "driver=cfi.pflash01,property=secure,value=on"
-        ]
-      );
-      inherit memSize;
-    } ''
-      export PATH=${binPath}:$PATH
+    pkgs.runCommand name
+      {
+        preVM = prepareImage + lib.optionalString touchEFIVars createEFIVars;
+        buildInputs = with pkgs; [
+          util-linux
+          e2fsprogs
+          dosfstools
+        ];
+        postVM = moveOrConvertImage + createHydraBuildProducts + postVM;
+        QEMU_OPTS = lib.concatStringsSep " " (
+          lib.optional useEFIBoot "-drive if=pflash,format=raw,unit=0,readonly=on,file=${efiFirmware}"
+          ++ lib.optionals touchEFIVars [
+            "-drive if=pflash,format=raw,unit=1,file=$efiVars"
+          ]
+          ++ lib.optionals (OVMF.systemManagementModeRequired or false) [
+            "-machine"
+            "q35,smm=on"
+            "-global"
+            "driver=cfi.pflash01,property=secure,value=on"
+          ]
+        );
+        inherit memSize;
+      }
+      ''
+        export PATH=${binPath}:$PATH
 
-      rootDisk=${if partitionTableType != "none" then "/dev/vda${rootPartition}" else "/dev/vda"}
+        rootDisk=${if partitionTableType != "none" then "/dev/vda${rootPartition}" else "/dev/vda"}
 
-      # It is necessary to set root filesystem unique identifier in advance, otherwise
-      # bootloader might get the wrong one and fail to boot.
-      # At the end, we reset again because we want deterministic timestamps.
-      ${lib.optionalString (fsType == "ext4" && deterministic) ''
-        tune2fs -T now ${lib.optionalString deterministic "-U ${rootFSUID}"} -c 0 -i 0 $rootDisk
-      ''}
-      # make systemd-boot find ESP without udev
-      mkdir /dev/block
-      ln -s /dev/vda1 /dev/block/254:1
+        # It is necessary to set root filesystem unique identifier in advance, otherwise
+        # bootloader might get the wrong one and fail to boot.
+        # At the end, we reset again because we want deterministic timestamps.
+        ${lib.optionalString (fsType == "ext4" && deterministic) ''
+          tune2fs -T now ${lib.optionalString deterministic "-U ${rootFSUID}"} -c 0 -i 0 $rootDisk
+        ''}
+        # make systemd-boot find ESP without udev
+        mkdir /dev/block
+        ln -s /dev/vda1 /dev/block/254:1
 
-      mountPoint=/mnt
-      mkdir $mountPoint
-      mount $rootDisk $mountPoint
+        mountPoint=/mnt
+        mkdir $mountPoint
+        mount $rootDisk $mountPoint
 
-      # Create the ESP and mount it. Unlike e2fsprogs, mkfs.vfat doesn't support an
-      # '-E offset=X' option, so we can't do this outside the VM.
-      ${lib.optionalString (partitionTableType == "efi" || partitionTableType == "hybrid") ''
-        mkdir -p /mnt/boot
-        mkfs.vfat -n ESP /dev/vda1
-        mount /dev/vda1 /mnt/boot
+        # Create the ESP and mount it. Unlike e2fsprogs, mkfs.vfat doesn't support an
+        # '-E offset=X' option, so we can't do this outside the VM.
+        ${lib.optionalString (partitionTableType == "efi" || partitionTableType == "hybrid") ''
+          mkdir -p /mnt/boot
+          mkfs.vfat -n ESP /dev/vda1
+          mount /dev/vda1 /mnt/boot
 
-        ${lib.optionalString touchEFIVars "mount -t efivarfs efivarfs /sys/firmware/efi/efivars"}
-      ''}
-      ${lib.optionalString (partitionTableType == "efixbootldr") ''
-        mkdir -p /mnt/{boot,efi}
-        mkfs.vfat -n ESP /dev/vda1
-        mkfs.vfat -n BOOT /dev/vda2
-        mount /dev/vda1 /mnt/efi
-        mount /dev/vda2 /mnt/boot
+          ${lib.optionalString touchEFIVars "mount -t efivarfs efivarfs /sys/firmware/efi/efivars"}
+        ''}
+        ${lib.optionalString (partitionTableType == "efixbootldr") ''
+          mkdir -p /mnt/{boot,efi}
+          mkfs.vfat -n ESP /dev/vda1
+          mkfs.vfat -n BOOT /dev/vda2
+          mount /dev/vda1 /mnt/efi
+          mount /dev/vda2 /mnt/boot
 
-        ${lib.optionalString touchEFIVars "mount -t efivarfs efivarfs /sys/firmware/efi/efivars"}
-      ''}
+          ${lib.optionalString touchEFIVars "mount -t efivarfs efivarfs /sys/firmware/efi/efivars"}
+        ''}
 
-      # Install a configuration.nix
-      mkdir -p /mnt/etc/nixos
-      ${lib.optionalString (configFile != null) ''
-        cp ${configFile} /mnt/etc/nixos/configuration.nix
-      ''}
+        # Install a configuration.nix
+        mkdir -p /mnt/etc/nixos
+        ${lib.optionalString (configFile != null) ''
+          cp ${configFile} /mnt/etc/nixos/configuration.nix
+        ''}
 
-      ${lib.optionalString installBootLoader ''
-        # In this throwaway resource, we only have /dev/vda, but the actual VM may refer to another disk for bootloader, e.g. /dev/vdb
-        # Use this option to create a symlink from vda to any arbitrary device you want.
-        ${lib.optionalString (config.boot.loader.grub.enable) (lib.concatMapStringsSep " " (device:
-          lib.optionalString (device != "/dev/vda") ''
-            mkdir -p "$(dirname ${device})"
-            ln -s /dev/vda ${device}
-          '') config.boot.loader.grub.devices)}
+        ${lib.optionalString installBootLoader ''
+          # In this throwaway resource, we only have /dev/vda, but the actual VM may refer to another disk for bootloader, e.g. /dev/vdb
+          # Use this option to create a symlink from vda to any arbitrary device you want.
+          ${lib.optionalString (config.boot.loader.grub.enable) (
+            lib.concatMapStringsSep " " (
+              device:
+              lib.optionalString (device != "/dev/vda") ''
+                mkdir -p "$(dirname ${device})"
+                ln -s /dev/vda ${device}
+              ''
+            ) config.boot.loader.grub.devices
+          )}
 
-        # Set up core system link, bootloader (sd-boot, GRUB, uboot, etc.), etc.
+          # Set up core system link, bootloader (sd-boot, GRUB, uboot, etc.), etc.
 
         # NOTE: systemd-boot-builder.py calls nix-env --list-generations which
         # clobbers $HOME/.nix-defexpr/channels/nixos This would cause a  folder
@@ -621,37 +726,37 @@ let format' = format; in let
         NIXOS_INSTALL_BOOTLOADER=1 nixos-enter --root $mountPoint -- /nix/var/nix/profiles/system/bin/switch-to-configuration boot
       ''}
 
-      # Set the ownerships of the contents. The modes are set in preVM.
-      # No globbing on targets, so no need to set -f
-      targets_=(${lib.concatStringsSep " " targets})
-      users_=(${lib.concatStringsSep " " users})
-      groups_=(${lib.concatStringsSep " " groups})
-      for ((i = 0; i < ''${#targets_[@]}; i++)); do
-        target="''${targets_[$i]}"
-        user="''${users_[$i]}"
-        group="''${groups_[$i]}"
-        if [ -n "$user$group" ]; then
-          # We have to nixos-enter since we need to use the user and group of the VM
-          nixos-enter --root $mountPoint -- chown -R "$user:$group" "$target"
-        fi
-      done
+        # Set the ownerships of the contents. The modes are set in preVM.
+        # No globbing on targets, so no need to set -f
+        targets_=(${lib.concatStringsSep " " targets})
+        users_=(${lib.concatStringsSep " " users})
+        groups_=(${lib.concatStringsSep " " groups})
+        for ((i = 0; i < ''${#targets_[@]}; i++)); do
+          target="''${targets_[$i]}"
+          user="''${users_[$i]}"
+          group="''${groups_[$i]}"
+          if [ -n "$user$group" ]; then
+            # We have to nixos-enter since we need to use the user and group of the VM
+            nixos-enter --root $mountPoint -- chown -R "$user:$group" "$target"
+          fi
+        done
 
-      umount -R /mnt
+        umount -R /mnt
 
-      # Make sure resize2fs works. Note that resize2fs has stricter criteria for resizing than a normal
-      # mount, so the `-c 0` and `-i 0` don't affect it. Setting it to `now` doesn't produce deterministic
-      # output, of course, but we can fix that when/if we start making images deterministic.
-      # In deterministic mode, this is fixed to 1970-01-01 (UNIX timestamp 0).
-      # This two-step approach is necessary otherwise `tune2fs` will want a fresher filesystem to perform
-      # some changes.
-      ${lib.optionalString (fsType == "ext4") ''
-        tune2fs -T now ${lib.optionalString deterministic "-U ${rootFSUID}"} -c 0 -i 0 $rootDisk
-        ${lib.optionalString deterministic "tune2fs -f -T 19700101 $rootDisk"}
-      ''}
-    ''
+        # Make sure resize2fs works. Note that resize2fs has stricter criteria for resizing than a normal
+        # mount, so the `-c 0` and `-i 0` don't affect it. Setting it to `now` doesn't produce deterministic
+        # output, of course, but we can fix that when/if we start making images deterministic.
+        # In deterministic mode, this is fixed to 1970-01-01 (UNIX timestamp 0).
+        # This two-step approach is necessary otherwise `tune2fs` will want a fresher filesystem to perform
+        # some changes.
+        ${lib.optionalString (fsType == "ext4") ''
+          tune2fs -T now ${lib.optionalString deterministic "-U ${rootFSUID}"} -c 0 -i 0 $rootDisk
+          ${lib.optionalString deterministic "tune2fs -f -T 19700101 $rootDisk"}
+        ''}
+      ''
   );
 in
-  if onlyNixStore then
-    pkgs.runCommand name {}
-      (prepareImage + moveOrConvertImage + createHydraBuildProducts + postVM)
-  else buildImage
+if onlyNixStore then
+  pkgs.runCommand name { } (prepareImage + moveOrConvertImage + createHydraBuildProducts + postVM)
+else
+  buildImage

nixos/lib/make-system-tarball.sh

@@ -1,5 +1,3 @@
-source $stdenv/setup
-
 sources_=($sources)
 targets_=($targets)
 

nixos/modules/installer/tools/tools.nix

@@ -43,7 +43,7 @@ let
     manPage = ./manpages/nixos-version.8;
   };
 
-  nixos-install = pkgs.nixos-install.override { nix = config.nix.package; };
+  nixos-install = pkgs.nixos-install.override { };
   nixos-rebuild = pkgs.nixos-rebuild.override { nix = config.nix.package; };
   nixos-rebuild-ng = pkgs.nixos-rebuild-ng.override {
     nix = config.nix.package;

nixos/modules/programs/command-not-found/command-not-found.nix

@@ -12,16 +12,18 @@
 
 let
   cfg = config.programs.command-not-found;
-  commandNotFound = pkgs.substituteAll {
+  commandNotFound = pkgs.replaceVarsWith {
     name = "command-not-found";
     dir = "bin";
     src = ./command-not-found.pl;
     isExecutable = true;
-    inherit (cfg) dbPath;
-    perl = pkgs.perl.withPackages (p: [
-      p.DBDSQLite
-      p.StringShellQuote
-    ]);
+    replacements = {
+      inherit (cfg) dbPath;
+      perl = pkgs.perl.withPackages (p: [
+        p.DBDSQLite
+        p.StringShellQuote
+      ]);
+    };
   };
 
 in

nixos/modules/services/computing/slurm/slurm.nix

@@ -331,7 +331,6 @@ in
         name = "wrappedSlurm";
 
         builder = pkgs.writeText "builder.sh" ''
-          source $stdenv/setup
           mkdir -p $out/bin
           find  ${lib.getBin cfg.package}/bin -type f -executable | while read EXE
           do

nixos/modules/services/networking/hylafax/systemd.nix

@@ -49,27 +49,31 @@ let
       preferLocalBuild = true;
     } ''mkdir --parents "$out/" ${concatStringsSep "\n" (mapModems mkLine)}'';
 
-  setupSpoolScript = pkgs.substituteAll {
+  setupSpoolScript = pkgs.replaceVarsWith {
     name = "hylafax-setup-spool.sh";
     src = ./spool.sh;
     isExecutable = true;
-    faxuser = "uucp";
-    faxgroup = "uucp";
-    lockPath = "/var/lock";
-    inherit globalConfigPath modemConfigPath;
-    inherit (cfg) sendmailPath spoolAreaPath userAccessFile;
-    inherit (pkgs) hylafaxplus runtimeShell;
+    replacements = {
+      faxuser = "uucp";
+      faxgroup = "uucp";
+      lockPath = "/var/lock";
+      inherit globalConfigPath modemConfigPath;
+      inherit (cfg) spoolAreaPath userAccessFile;
+      inherit (pkgs) hylafaxplus runtimeShell;
+    };
   };
 
-  waitFaxqScript = pkgs.substituteAll {
+  waitFaxqScript = pkgs.replaceVarsWith {
     # This script checks the modems status files
     # and waits until all modems report readiness.
     name = "hylafax-faxq-wait-start.sh";
     src = ./faxq-wait.sh;
     isExecutable = true;
-    timeoutSec = toString 10;
-    inherit (cfg) spoolAreaPath;
-    inherit (pkgs) runtimeShell;
+    replacements = {
+      timeoutSec = toString 10;
+      inherit (cfg) spoolAreaPath;
+      inherit (pkgs) runtimeShell;
+    };
   };
 
   sockets.hylafax-hfaxd = {

nixos/modules/services/networking/ircd-hybrid/builder.sh

@@ -1,6 +1,3 @@
-if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
-source $stdenv/setup
-
 doSub() {
     local src=$1
     local dst=$2

nixos/modules/services/web-apps/kasmweb/default.nix

@@ -140,31 +140,33 @@ in
         serviceConfig = {
           Type = "oneshot";
           TimeoutStartSec = 300;
-          ExecStart = pkgs.substituteAll {
+          ExecStart = pkgs.replaceVarsWith {
             src = ./initialize_kasmweb.sh;
             isExecutable = true;
-            binPath = lib.makeBinPath [
-              pkgs.docker
-              pkgs.openssl
-              pkgs.gnused
-              pkgs.yq-go
-            ];
-            runtimeShell = pkgs.runtimeShell;
-            kasmweb = pkgs.kasmweb;
-            postgresUser = "postgres";
-            postgresPassword = "postgres";
-            inherit (cfg)
-              datastorePath
-              sslCertificate
-              sslCertificateKey
-              redisPassword
-              networkSubnet
-              defaultUserPassword
-              defaultAdminPassword
-              defaultManagerToken
-              defaultRegistrationToken
-              defaultGuacToken
-              ;
+            replacements = {
+              binPath = lib.makeBinPath [
+                pkgs.docker
+                pkgs.openssl
+                pkgs.gnused
+                pkgs.yq-go
+              ];
+              runtimeShell = pkgs.runtimeShell;
+              kasmweb = pkgs.kasmweb;
+              postgresUser = "postgres";
+              postgresPassword = "postgres";
+              inherit (cfg)
+                datastorePath
+                sslCertificate
+                sslCertificateKey
+                redisPassword
+                networkSubnet
+                defaultUserPassword
+                defaultAdminPassword
+                defaultManagerToken
+                defaultRegistrationToken
+                defaultGuacToken
+                ;
+            };
           };
         };
       };

nixos/modules/services/web-servers/jboss/builder.sh

@@ -1,8 +1,5 @@
 set -e
 
-if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
-source $stdenv/setup
-
 mkdir -p $out/bin
 
 cat > $out/bin/control <<EOF

nixos/modules/system/boot/loader/generations-dir/generations-dir-builder.sh

@@ -2,8 +2,7 @@
 
 shopt -s nullglob
 
-export PATH=/empty
-for i in @path@; do PATH=$PATH:$i/bin; done
+export PATH=/empty:@path@
 
 default=$1
 if test -z "$1"; then

nixos/modules/system/boot/loader/generations-dir/generations-dir.nix

@@ -4,12 +4,14 @@ with lib;
 
 let
 
-  generationsDirBuilder = pkgs.substituteAll {
+  generationsDirBuilder = pkgs.replaceVarsWith {
     src = ./generations-dir-builder.sh;
     isExecutable = true;
-    inherit (pkgs) bash;
-    path = [pkgs.coreutils pkgs.gnused pkgs.gnugrep];
-    inherit (config.boot.loader.generationsDir) copyKernels;
+    replacements = {
+      inherit (pkgs) bash;
+      path = lib.makeBinPath [pkgs.coreutils pkgs.gnused pkgs.gnugrep];
+      inherit (config.boot.loader.generationsDir) copyKernels;
+    };
   };
 
 in

nixos/modules/system/boot/loader/generic-extlinux-compatible/default.nix

@@ -10,9 +10,9 @@ let
   timeoutStr = if blCfg.timeout == null then "-1" else toString blCfg.timeout;
 
   # The builder used to write during system activation
-  builder = import ./extlinux-conf-builder.nix { inherit pkgs; };
+  builder = import ./extlinux-conf-builder.nix { inherit lib pkgs; };
   # The builder exposed in populateCmd, which runs on the build architecture
-  populateBuilder = import ./extlinux-conf-builder.nix { pkgs = pkgs.buildPackages; };
+  populateBuilder = import ./extlinux-conf-builder.nix { inherit lib; pkgs = pkgs.buildPackages; };
 in
 {
   options = {

nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.nix

@@ -1,8 +1,10 @@
-{ pkgs }:
+{ lib, pkgs }:
 
-pkgs.substituteAll {
+pkgs.replaceVarsWith {
   src = ./extlinux-conf-builder.sh;
   isExecutable = true;
-  path = [pkgs.coreutils pkgs.gnused pkgs.gnugrep];
-  inherit (pkgs) bash;
+  replacements = {
+    path = lib.makeBinPath [pkgs.coreutils pkgs.gnused pkgs.gnugrep];
+    inherit (pkgs) bash;
+  };
 }

nixos/modules/system/boot/loader/generic-extlinux-compatible/extlinux-conf-builder.sh

@@ -2,8 +2,7 @@
 
 shopt -s nullglob
 
-export PATH=/empty
-for i in @path@; do PATH=$PATH:$i/bin; done
+export PATH=/empty:@path@
 
 usage() {
     echo "usage: $0 -t <timeout> -c <path-to-default-configuration> [-d <boot-dir>] [-g <num-generations>] [-n <dtbName>] [-r]" >&2

nixos/modules/system/boot/loader/init-script/init-script-builder.sh

@@ -2,8 +2,7 @@
 
 shopt -s nullglob
 
-export PATH=/empty
-for i in @path@; do PATH=$PATH:$i/bin; done
+export PATH=/empty:@path@
 
 if test $# -ne 1; then
     echo "Usage: init-script-builder.sh DEFAULT-CONFIG"

nixos/modules/system/boot/loader/init-script/init-script.nix

@@ -9,16 +9,18 @@ with lib;
 
 let
 
-  initScriptBuilder = pkgs.substituteAll {
+  initScriptBuilder = pkgs.replaceVarsWith {
     src = ./init-script-builder.sh;
     isExecutable = true;
-    inherit (pkgs) bash;
-    inherit (config.system.nixos) distroName;
-    path = [
-      pkgs.coreutils
-      pkgs.gnused
-      pkgs.gnugrep
-    ];
+    replacements = {
+      inherit (pkgs) bash;
+      inherit (config.system.nixos) distroName;
+      path = lib.makeBinPath [
+        pkgs.coreutils
+        pkgs.gnused
+        pkgs.gnugrep
+      ];
+    };
   };
 
 in

nixos/modules/system/boot/stage-1.nix

@@ -289,11 +289,8 @@ let
 
   # The init script of boot stage 1 (loading kernel modules for
   # mounting the root FS).
-  bootStage1 = pkgs.substituteAll {
+  bootStage1 = pkgs.replaceVarsWith {
     src = ./stage-1-init.sh;
-
-    shell = "${extraUtils}/bin/ash";
-
     isExecutable = true;
 
     postInstall = ''
@@ -304,35 +301,39 @@ let
       ${pkgs.buildPackages.busybox}/bin/ash -n $target
     '';
 
-    inherit linkUnits udevRules extraUtils;
+    replacements = {
+      shell = "${extraUtils}/bin/ash";
 
-    inherit (config.boot) resumeDevice;
+      inherit linkUnits udevRules extraUtils;
 
-    inherit (config.system.nixos) distroName;
+      inherit (config.boot) resumeDevice;
 
-    inherit (config.system.build) earlyMountScript;
+      inherit (config.system.nixos) distroName;
 
-    inherit (config.boot.initrd) checkJournalingFS verbose
-      preLVMCommands preDeviceCommands postDeviceCommands postResumeCommands postMountCommands preFailCommands kernelModules;
+      inherit (config.system.build) earlyMountScript;
 
-    resumeDevices = map (sd: if sd ? device then sd.device else "/dev/disk/by-label/${sd.label}")
-                    (filter (sd: hasPrefix "/dev/" sd.device && !sd.randomEncryption.enable
-                             # Don't include zram devices
-                             && !(hasPrefix "/dev/zram" sd.device)
-                            ) config.swapDevices);
+      inherit (config.boot.initrd) checkJournalingFS verbose
+        preLVMCommands preDeviceCommands postDeviceCommands postResumeCommands postMountCommands preFailCommands kernelModules;
 
-    fsInfo =
-      let f = fs: [ fs.mountPoint (if fs.device != null then fs.device else "/dev/disk/by-label/${fs.label}") fs.fsType (builtins.concatStringsSep "," fs.options) ];
-      in pkgs.writeText "initrd-fsinfo" (concatStringsSep "\n" (concatMap f fileSystems));
+      resumeDevices = map (sd: if sd ? device then sd.device else "/dev/disk/by-label/${sd.label}")
+                      (filter (sd: hasPrefix "/dev/" sd.device && !sd.randomEncryption.enable
+                               # Don't include zram devices
+                               && !(hasPrefix "/dev/zram" sd.device)
+                              ) config.swapDevices);
 
-    setHostId = optionalString (config.networking.hostId != null) ''
-      hi="${config.networking.hostId}"
-      ${if pkgs.stdenv.hostPlatform.isBigEndian then ''
-        echo -ne "\x''${hi:0:2}\x''${hi:2:2}\x''${hi:4:2}\x''${hi:6:2}" > /etc/hostid
-      '' else ''
-        echo -ne "\x''${hi:6:2}\x''${hi:4:2}\x''${hi:2:2}\x''${hi:0:2}" > /etc/hostid
-      ''}
-    '';
+      fsInfo =
+        let f = fs: [ fs.mountPoint (if fs.device != null then fs.device else "/dev/disk/by-label/${fs.label}") fs.fsType (builtins.concatStringsSep "," fs.options) ];
+        in pkgs.writeText "initrd-fsinfo" (concatStringsSep "\n" (concatMap f fileSystems));
+
+      setHostId = optionalString (config.networking.hostId != null) ''
+        hi="${config.networking.hostId}"
+        ${if pkgs.stdenv.hostPlatform.isBigEndian then ''
+          echo -ne "\x''${hi:0:2}\x''${hi:2:2}\x''${hi:4:2}\x''${hi:6:2}" > /etc/hostid
+        '' else ''
+          echo -ne "\x''${hi:6:2}\x''${hi:4:2}\x''${hi:2:2}\x''${hi:0:2}" > /etc/hostid
+        ''}
+      '';
+    };
   };
 
 

nixos/modules/system/boot/stage-2.nix

@@ -11,26 +11,28 @@ let
 
   useHostResolvConf = config.networking.resolvconf.enable && config.networking.useHostResolvConf;
 
-  bootStage2 = pkgs.substituteAll {
+  bootStage2 = pkgs.replaceVarsWith {
     src = ./stage-2-init.sh;
-    shellDebug = "${pkgs.bashInteractive}/bin/bash";
-    shell = "${pkgs.bash}/bin/bash";
-    inherit (config.boot) readOnlyNixStore systemdExecutable extraSystemdUnitPaths;
-    inherit (config.system.nixos) distroName;
     isExecutable = true;
-    inherit useHostResolvConf;
-    inherit (config.system.build) earlyMountScript;
-    path = lib.makeBinPath (
-      [
-        pkgs.coreutils
-        pkgs.util-linux
-      ]
-      ++ lib.optional useHostResolvConf pkgs.openresolv
-    );
-    postBootCommands = pkgs.writeText "local-cmds" ''
-      ${config.boot.postBootCommands}
-      ${config.powerManagement.powerUpCommands}
-    '';
+    replacements = {
+      shell = "${pkgs.bash}/bin/bash";
+      systemConfig = null; # replaced in ../activation/top-level.nix
+      inherit (config.boot) readOnlyNixStore systemdExecutable;
+      inherit (config.system.nixos) distroName;
+      inherit useHostResolvConf;
+      inherit (config.system.build) earlyMountScript;
+      path = lib.makeBinPath (
+        [
+          pkgs.coreutils
+          pkgs.util-linux
+        ]
+        ++ lib.optional useHostResolvConf pkgs.openresolv
+      );
+      postBootCommands = pkgs.writeText "local-cmds" ''
+        ${config.boot.postBootCommands}
+        ${config.powerManagement.powerUpCommands}
+      '';
+    };
   };
 
 in

nixos/modules/system/etc/test.nix

@@ -64,7 +64,14 @@ lib.recurseIntoAttrs {
       } ''
       mkdir fake-root
       export FAKECHROOT_EXCLUDE_PATH=/dev:/proc:/sys:${builtins.storeDir}:$out
-      fakechroot fakeroot chroot $PWD/fake-root bash -c 'source $stdenv/setup; eval "$fakeRootCommands"'
+      if [ -e "$NIX_ATTRS_SH_FILE" ]; then
+        export FAKECHROOT_EXCLUDE_PATH=$FAKECHROOT_EXCLUDE_PATH:$NIX_ATTRS_SH_FILE
+      fi
+      fakechroot fakeroot chroot $PWD/fake-root bash -e -c '
+        if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; fi
+        source $stdenv/setup
+        eval "$fakeRootCommands"
+      '
     '';
 
 }

nixos/modules/tasks/tty-backgrounds-combine.sh

@@ -1,32 +0,0 @@
-source $stdenv/setup
-
-ttys=($ttys)
-themes=($themes)
-
-mkdir -p $out
-
-defaultName=$(cd $default && ls | grep -v default)
-echo $defaultName
-ln -s $default/$defaultName $out/$defaultName
-ln -s $defaultName $out/default
-
-for ((n = 0; n < ${#ttys[*]}; n++)); do
-    tty=${ttys[$n]}
-    theme=${themes[$n]}
-
-    echo "TTY $tty -> $theme"
-
-    if [ "$theme" != default ]; then
-        themeName=$(cd $theme && ls | grep -v default)
-        ln -sfn $theme/$themeName $out/$themeName
-    else
-        themeName=default
-    fi
-
-    if test -e $out/$tty; then
-        echo "Multiple themes defined for the same TTY!"
-        exit 1
-    fi
-
-    ln -sfn $themeName $out/$tty
-done

nixos/tests/grow-partition.nix

@@ -32,6 +32,9 @@ let
         "/".device = rootFsDevice;
       };
 
+      # Needed for installing bootloader
+      system.switch.enable = true;
+
       system.build.diskImage = import ../lib/make-disk-image.nix {
         inherit config lib pkgs;
         label = rootFslabel;

nixos/tests/jenkins.nix

@@ -60,6 +60,11 @@ import ./make-test-python.nix ({ pkgs, ...} : {
         users.users.jenkins.extraGroups = [ "users" ];
 
         systemd.services.jenkins.serviceConfig.TimeoutStartSec = "6min";
+
+        # Increase disk space to prevent this issue:
+        #
+        # WARNING h.n.DiskSpaceMonitorDescriptor#markNodeOfflineOrOnline: Making Built-In Node offline temporarily due to the lack of disk space
+        virtualisation.diskSize = 2 * 1024;
       };
 
     slave =

nixos/tests/pppd.nix

@@ -5,9 +5,14 @@ import ./make-test-python.nix (
       mode = "0640";
     };
   in
+  { pkgs, ... }:
   {
     name = "pppd";
 
+    meta = with pkgs.lib.maintainers; {
+      maintainers = [ stv0g ];
+    };
+
     nodes = {
       server =
         { config, pkgs, ... }:

nixos/tests/systemd-journal-gateway.nix

@@ -47,7 +47,7 @@ import ./make-test-python.nix (
 
       def copy_pem(file: str):
         machine.copy_from_host(source=f"{tmpdir}/{file}", target=f"/run/secrets/{file}")
-        machine.succeed(f"chmod 644 /run/secrets/{file}")
+        machine.succeed(f"chmod 600 /run/secrets/{file} && chown systemd-journal-gateway /run/secrets/{file}")
 
       with subtest("Copying keys and certificates"):
         machine.succeed("mkdir -p /run/secrets/{client,server}")

nixos/tests/systemd-repart.nix

@@ -22,7 +22,7 @@ let
     shutil.copyfile("${machine.system.build.diskImage}/nixos.img", tmp_disk_image.name)
 
     subprocess.run([
-      "${machine.config.virtualisation.qemu.package}/bin/qemu-img",
+      "${machine.virtualisation.qemu.package}/bin/qemu-img",
       "resize",
       "-f",
       "raw",
@@ -151,6 +151,7 @@ in
       }:
       {
         virtualisation.useDefaultFilesystems = false;
+        virtualisation.mountHostNixStore = false;
         virtualisation.fileSystems = {
           "/" = {
             device = "/dev/disk/by-partlabel/created-root";

nixos/tests/systemd.nix

@@ -128,7 +128,7 @@ import ./make-test-python.nix (
             # it's not possible because we're not in a tty when grepping
             # (i.e. hacky way to ensure that the error from above doesn't appear here).
             _, out = machine.execute("systemctl --user edit testservice2.service 2>&1")
-            assert out.rstrip("\n") == "Cannot edit units if not on a tty."
+            assert out.rstrip("\n") == "Cannot edit units interactively if not on a tty."
 
         # Regression test for https://github.com/NixOS/nixpkgs/issues/105049
         with subtest("systemd reads timezone database in /etc/zoneinfo"):

pkgs/applications/audio/fluidsynth/default.nix

@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluidsynth";
-  version = "2.3.7";
+  version = "2.4.2";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     rev = "v${version}";
-    hash = "sha256-4Jn8pyVPrTPYZGdPZB+8guxTbD6s/1OpmLJlioDQFMA=";
+    hash = "sha256-rpTL1eOm3PQIBuxoPEZwj64QXasNQN80kGSW7h6dDdw=";
   };
 
   outputs = [ "out" "dev" "man" ];

pkgs/applications/audio/mpg123/default.nix

@@ -23,11 +23,11 @@ assert withConplay -> !libOnly;
 
 stdenv.mkDerivation rec {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.32.9";
+  version = "1.32.10";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
-    hash = "sha256-A7YeQATpYLrPKs2toD7ZTTduaqsnpgFEe9SQjYQHspE=";
+    hash = "sha256-h7LBf+DJedPvOO7O/2Nis1sorIWJ+/GFS1vnXJq2VXw=";
   };
 
   outputs = [

pkgs/applications/audio/pianoteq/default.nix

@@ -99,8 +99,6 @@ let
     stdenv.mkDerivation {
       inherit name;
       builder = writeShellScript "builder.sh" ''
-        source $stdenv/setup
-
         curlVersion=$(${curl}/bin/curl -V | head -1 | cut -d' ' -f2)
 
         # Curl flags to handle redirects, not use EPSV, handle cookies for

pkgs/applications/blockchains/bitcoin-abc/default.nix

@@ -22,7 +22,7 @@
   withGui,
   python3,
   jemalloc,
-  zeromq4,
+  zeromq,
 }:
 
 mkDerivation rec {
@@ -57,7 +57,7 @@ mkDerivation rec {
       python3
       jemalloc
       libnatpmp
-      zeromq4
+      zeromq
       miniupnpc
       util-linux
       protobuf

pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix

@@ -53,10 +53,10 @@
     elpaBuild {
       pname = "activities";
       ename = "activities";
-      version = "0.7.1";
+      version = "0.7.2";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/activities-0.7.1.tar";
-        sha256 = "1khhkfyy251mag5zqybsvfg3sak0aac1qlsdl1wyiin7f6sq9563";
+        url = "https://elpa.gnu.org/packages/activities-0.7.2.tar";
+        sha256 = "1b6d77b5h2vikfxqjlb1jx5pnij5bif788nysvvn3wlzpwdi88s0";
       };
       packageRequires = [ persist ];
       meta = {
@@ -419,10 +419,10 @@
     elpaBuild {
       pname = "auctex";
       ename = "auctex";
-      version = "14.0.7";
+      version = "14.0.8";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/auctex-14.0.7.tar";
-        sha256 = "1m71jr853b4d713z1k4jj73c8ba4753hv8nighx62razgmpn4ci8";
+        url = "https://elpa.gnu.org/packages/auctex-14.0.8.tar";
+        sha256 = "0bcjkbwhbkmm0r7pbh44j7vw9b39g2iw1jgw4sq54qp7387j6lmy";
       };
       packageRequires = [ ];
       meta = {
@@ -790,10 +790,10 @@
     elpaBuild {
       pname = "boxy";
       ename = "boxy";
-      version = "1.1.4";
+      version = "2.0.0";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/boxy-1.1.4.tar";
-        sha256 = "0mwj1qc626f1iaq5iaqm1f4iwyz91hzqhzfk5f53gsqka7yz2fnf";
+        url = "https://elpa.gnu.org/packages/boxy-2.0.0.tar";
+        sha256 = "1vfgwgk3vzzp2cy7n0qwhn7hzjxbp9vzxp1al1pkynv9hfs503gb";
       };
       packageRequires = [ ];
       meta = {
@@ -813,10 +813,10 @@
     elpaBuild {
       pname = "boxy-headings";
       ename = "boxy-headings";
-      version = "2.1.6";
+      version = "2.1.8";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/boxy-headings-2.1.6.tar";
-        sha256 = "0wnks9a4agvqjivp9myl8zcdq6rj7hh5ig73f8qv5imar0i76izc";
+        url = "https://elpa.gnu.org/packages/boxy-headings-2.1.8.tar";
+        sha256 = "1r356z090dkgc7wb5qq35pkq3932rr6zy90d85jb9frxf7w1zmd7";
       };
       packageRequires = [
         boxy
@@ -1020,10 +1020,10 @@
     elpaBuild {
       pname = "cape";
       ename = "cape";
-      version = "1.7";
+      version = "1.8";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/cape-1.7.tar";
-        sha256 = "03npj4a8g73dgrivjgc27w0c957naqhxq0hfzshdqci6mrq1gph3";
+        url = "https://elpa.gnu.org/packages/cape-1.8.tar";
+        sha256 = "18z3c3d1wbf2j40rym74918hxccmi84rbqkzc2g73jbigp78kyq4";
       };
       packageRequires = [ compat ];
       meta = {
@@ -1398,10 +1398,10 @@
     elpaBuild {
       pname = "compat";
       ename = "compat";
-      version = "30.0.0.0";
+      version = "30.0.2.0";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/compat-30.0.0.0.tar";
-        sha256 = "0z7049xkdyx22ywq821d19lp73ywaz6brxj461h0h2a73y7999cl";
+        url = "https://elpa.gnu.org/packages/compat-30.0.2.0.tar";
+        sha256 = "0pizq8vwfqls04in95rpnfwv4xc1r2qjpf41g6bjy826i53cfdx0";
       };
       packageRequires = [ seq ];
       meta = {
@@ -1441,10 +1441,10 @@
     elpaBuild {
       pname = "consult";
       ename = "consult";
-      version = "1.8";
+      version = "1.9";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/consult-1.8.tar";
-        sha256 = "0k3k1jmwdw4w8rr5z2030ba37mcia2zghh6p4c36ck51hwvfkb8w";
+        url = "https://elpa.gnu.org/packages/consult-1.9.tar";
+        sha256 = "0qz8l962995znf9lhgy8hdd9z78bdhb8m95dxj1g3266jsgjf8sv";
       };
       packageRequires = [ compat ];
       meta = {
@@ -1554,10 +1554,10 @@
     elpaBuild {
       pname = "corfu";
       ename = "corfu";
-      version = "1.5";
+      version = "1.6";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/corfu-1.5.tar";
-        sha256 = "0m80slhpr9xd57b3nvrqgfxm44851v9gfcy8ky3d3v2g5i2mrm6x";
+        url = "https://elpa.gnu.org/packages/corfu-1.6.tar";
+        sha256 = "1wx7hjvccb2jss4k0vcmmdxkyivs2qnzai6xw2l1fgdan9ngg89n";
       };
       packageRequires = [ compat ];
       meta = {
@@ -1814,10 +1814,10 @@
     elpaBuild {
       pname = "dape";
       ename = "dape";
-      version = "0.17.0";
+      version = "0.19.0";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/dape-0.17.0.tar";
-        sha256 = "113lmy0q1yk81cfi9dbig8p9bmhyqy6w1bvhn91m79my05ny2rxd";
+        url = "https://elpa.gnu.org/packages/dape-0.19.0.tar";
+        sha256 = "11hs0cnzyp75gmz32mqplaknf4lq0zf9zp07h1rhlvz31aacvrqh";
       };
       packageRequires = [ jsonrpc ];
       meta = {
@@ -1901,10 +1901,10 @@
     elpaBuild {
       pname = "debbugs";
       ename = "debbugs";
-      version = "0.42";
+      version = "0.43";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/debbugs-0.42.tar";
-        sha256 = "0n0kvkyzggn8q72dpy6c7rsjwn1rjx0r33y5jc080j7sw85xpigg";
+        url = "https://elpa.gnu.org/packages/debbugs-0.43.tar";
+        sha256 = "1jzdr7bp48incg1bdnq4s1ldnyp6hncz0mydy0bizk3c68chsls5";
       };
       packageRequires = [ soap-client ];
       meta = {
@@ -2045,6 +2045,28 @@
       };
     }
   ) { };
+  dicom = callPackage (
+    {
+      compat,
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "dicom";
+      ename = "dicom";
+      version = "0.5";
+      src = fetchurl {
+        url = "https://elpa.gnu.org/packages/dicom-0.5.tar";
+        sha256 = "1qz4zhq0fcfl7l42qib60j2dzm1vp2vmwfhm48s0ia6dgdkvad3x";
+      };
+      packageRequires = [ compat ];
+      meta = {
+        homepage = "https://elpa.gnu.org/packages/dicom.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   dict-tree = callPackage (
     {
       elpaBuild,
@@ -2539,10 +2561,10 @@
     elpaBuild {
       pname = "eev";
       ename = "eev";
-      version = "20241123";
+      version = "20241223";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/eev-20241123.tar";
-        sha256 = "1bb2134jggj4xg49cwy8ivfb12yafxyy2p5k4rca9an3cr4s8ci7";
+        url = "https://elpa.gnu.org/packages/eev-20241223.tar";
+        sha256 = "0rp7b3sfh94zyah303sk43mfdbzcz6p20dqarkzbsgin3n77ara8";
       };
       packageRequires = [ ];
       meta = {
@@ -2689,10 +2711,10 @@
     elpaBuild {
       pname = "elisa";
       ename = "elisa";
-      version = "1.1.3";
+      version = "1.1.4";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/elisa-1.1.3.tar";
-        sha256 = "0370gvj3r701i2acp3wq705a9n534g719nzz8bg9a4lry76f2crv";
+        url = "https://elpa.gnu.org/packages/elisa-1.1.4.tar";
+        sha256 = "1v5y0piqz31dx38mv217l5z4xn6hnggznmrcxd2ffs0xdvr9iv3s";
       };
       packageRequires = [
         async
@@ -2740,10 +2762,10 @@
     elpaBuild {
       pname = "ellama";
       ename = "ellama";
-      version = "0.13.0";
+      version = "0.13.1";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/ellama-0.13.0.tar";
-        sha256 = "0wfn8fv124qxf9yxl4lsa3hwlicmaiv2zzn8w4vhmlni1kf37nlw";
+        url = "https://elpa.gnu.org/packages/ellama-0.13.1.tar";
+        sha256 = "1hf9lqjcg33xahz8i5ng123z6yljmwm3zw15n96x83x0szxi1wl1";
       };
       packageRequires = [
         compat
@@ -2876,10 +2898,10 @@
     elpaBuild {
       pname = "emms";
       ename = "emms";
-      version = "20.2";
+      version = "21";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/emms-20.2.tar";
-        sha256 = "0amc956amyfsjlq5aqc7nk2cs2ph2zcpci5wkms6w973wx67z2j6";
+        url = "https://elpa.gnu.org/packages/emms-21.tar";
+        sha256 = "188rij39qqaya7hk0p05ygcw5vlha7qd6pm4ws6nfw7g0nv1rbcc";
       };
       packageRequires = [
         cl-lib
@@ -3801,10 +3823,10 @@
     elpaBuild {
       pname = "greader";
       ename = "greader";
-      version = "0.11.18";
+      version = "0.12.6";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/greader-0.11.18.tar";
-        sha256 = "122mvjcbvi7dzggx1dl02iw9jl0h33l8ka4mzvlr6sl0wwwzfpr8";
+        url = "https://elpa.gnu.org/packages/greader-0.12.6.tar";
+        sha256 = "0xv814p7cdf2wj7qdj9cpz3blnkcd8b6sjk2jajym5hilmr9a9b5";
       };
       packageRequires = [
         compat
@@ -4422,10 +4444,10 @@
     elpaBuild {
       pname = "jinx";
       ename = "jinx";
-      version = "1.10";
+      version = "1.11";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/jinx-1.10.tar";
-        sha256 = "19l1wcrv610l6alb9xzyfmdkmnzgcf60z3557q4dkgvz35959p4y";
+        url = "https://elpa.gnu.org/packages/jinx-1.11.tar";
+        sha256 = "0g0iys02k488lbkd7a8qn3hwcmfhmyfp8v3mm07z3zsjhlqw0m57";
       };
       packageRequires = [ compat ];
       meta = {
@@ -4873,10 +4895,10 @@
     elpaBuild {
       pname = "llm";
       ename = "llm";
-      version = "0.19.1";
+      version = "0.20.0";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/llm-0.19.1.tar";
-        sha256 = "03f8yvnq1n2pns62iji2iz50f30wxw50n9a6cxgd9p2vkd4pjb0g";
+        url = "https://elpa.gnu.org/packages/llm-0.20.0.tar";
+        sha256 = "12a6z2knsxp8jy0v9hsfsb7kdzyj6pnq5h58vnkrizd95zp6zf91";
       };
       packageRequires = [
         plz
@@ -5067,10 +5089,10 @@
     elpaBuild {
       pname = "m-buffer";
       ename = "m-buffer";
-      version = "0.16";
+      version = "0.16.1";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/m-buffer-0.16.tar";
-        sha256 = "16drbgamp7yd1ndw2qrycrgmnknv5k7h4d7svcdhv9az6fg1vzn4";
+        url = "https://elpa.gnu.org/packages/m-buffer-0.16.1.tar";
+        sha256 = "1iq7nld1i8v0da1ajhvfdarx4bx3wnwgz5lhb78fcnsq8zb6cp5y";
       };
       packageRequires = [ seq ];
       meta = {
@@ -5110,10 +5132,10 @@
     elpaBuild {
       pname = "marginalia";
       ename = "marginalia";
-      version = "1.7";
+      version = "1.8";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/marginalia-1.7.tar";
-        sha256 = "1bwbkz71w81zcqsydvqic2xri52pm1h9nac8i7i04nl5b98pszkk";
+        url = "https://elpa.gnu.org/packages/marginalia-1.8.tar";
+        sha256 = "0q8mflfsl4vj2r2m47jgm5hrg3a4k5pildb53vlgm5k9wb4sd7md";
       };
       packageRequires = [ compat ];
       meta = {
@@ -5185,6 +5207,27 @@
       };
     }
   ) { };
+  matlab-mode = callPackage (
+    {
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "matlab-mode";
+      ename = "matlab-mode";
+      version = "6.3";
+      src = fetchurl {
+        url = "https://elpa.gnu.org/packages/matlab-mode-6.3.tar";
+        sha256 = "0m3h60629p9rv8k2fk23iwfdgzsdmlk78y1j83xz5m53z7vl3a7m";
+      };
+      packageRequires = [ ];
+      meta = {
+        homepage = "https://elpa.gnu.org/packages/matlab-mode.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   mct = callPackage (
     {
       elpaBuild,
@@ -5943,10 +5986,10 @@
     elpaBuild {
       pname = "orderless";
       ename = "orderless";
-      version = "1.2";
+      version = "1.3";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/orderless-1.2.tar";
-        sha256 = "1iyfnvwqwn8y4bkv25zw15y8yy5dm89kyk7wlxw0al22bhfc2cm7";
+        url = "https://elpa.gnu.org/packages/orderless-1.3.tar";
+        sha256 = "1gh2xw34adk5q6v9sz42j5mwyjjp1yix70jvjylnapwsjjsjm5qk";
       };
       packageRequires = [ compat ];
       meta = {
@@ -5964,10 +6007,10 @@
     elpaBuild {
       pname = "org";
       ename = "org";
-      version = "9.7.16";
+      version = "9.7.19";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/org-9.7.16.tar";
-        sha256 = "1d6vxd7ssfb1v00a37dr723v9cg8i8v78lcymqndqhy6f2ji1f06";
+        url = "https://elpa.gnu.org/packages/org-9.7.19.tar";
+        sha256 = "0v7ridhsz12iwznk8165ll61i1w1avhxfrq3p82p9r6ir2xdan1g";
       };
       packageRequires = [ ];
       meta = {
@@ -6056,10 +6099,10 @@
     elpaBuild {
       pname = "org-modern";
       ename = "org-modern";
-      version = "1.5";
+      version = "1.6";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/org-modern-1.5.tar";
-        sha256 = "08s253r3z5r37swlsgrp97ls7p3bdr4hr2xvyb1pm57j7livv74b";
+        url = "https://elpa.gnu.org/packages/org-modern-1.6.tar";
+        sha256 = "1fmmblqs6v52690fvky3xq48m5a3xh8xrl7j8pqw6hc06igm4m5q";
       };
       packageRequires = [ compat ];
       meta = {
@@ -6100,10 +6143,10 @@
     elpaBuild {
       pname = "org-real";
       ename = "org-real";
-      version = "1.0.9";
+      version = "1.0.11";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/org-real-1.0.9.tar";
-        sha256 = "0g19pgg7rqijb6q1vpifvpzl2gyc13a42q1n23x3kawl2srhcjp2";
+        url = "https://elpa.gnu.org/packages/org-real-1.0.11.tar";
+        sha256 = "1mm2p6487m4sr8zvj7xqryvicvj0qbv7as39hxh1ad7yhfdhgpvw";
       };
       packageRequires = [
         boxy
@@ -6233,10 +6276,10 @@
     elpaBuild {
       pname = "osm";
       ename = "osm";
-      version = "1.4";
+      version = "1.5";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/osm-1.4.tar";
-        sha256 = "0cix4jn3919xnlsj85l4m83znkqf4m2988zzqwcsvvvjrmgccanh";
+        url = "https://elpa.gnu.org/packages/osm-1.5.tar";
+        sha256 = "1hgr1gfkii75nmfsz3nvn5hv9x9jg09as7k12rr7vr9k0fs0j4hk";
       };
       packageRequires = [ compat ];
       meta = {
@@ -6340,10 +6383,10 @@
     elpaBuild {
       pname = "parser-generator";
       ename = "parser-generator";
-      version = "0.2.1";
+      version = "0.2.4";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/parser-generator-0.2.1.tar";
-        sha256 = "1vrgkvcj16550frq2jivw31cmq6rhwrifmdk4rf0266br3jdarpf";
+        url = "https://elpa.gnu.org/packages/parser-generator-0.2.4.tar";
+        sha256 = "01b5bwh484fpicv0g2z64694pjkhrcqz9f8jpq6hk41kzhvr23m1";
       };
       packageRequires = [ ];
       meta = {
@@ -6830,10 +6873,10 @@
     elpaBuild {
       pname = "pulsar";
       ename = "pulsar";
-      version = "1.1.0";
+      version = "1.2.0";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/pulsar-1.1.0.tar";
-        sha256 = "0hs65y2avl8w5g4zd68sdg4rl4q15ac53xlbc4qrfjynlajma6mm";
+        url = "https://elpa.gnu.org/packages/pulsar-1.2.0.tar";
+        sha256 = "03bx06fa7md78xrn10kigrf3p8pm07lxpw70wbhfqgq1b3zr46rl";
       };
       packageRequires = [ ];
       meta = {
@@ -7325,10 +7368,10 @@
     elpaBuild {
       pname = "relint";
       ename = "relint";
-      version = "2.0";
+      version = "2.1";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/relint-2.0.tar";
-        sha256 = "0r89b5yk5lp92k4gnr0sx6ccilqzpv6kd5csqhxydk0xmqh8rsff";
+        url = "https://elpa.gnu.org/packages/relint-2.1.tar";
+        sha256 = "0ikml87y0k85qd92m3l1gkzjd9ng3mhjfk19w15ln0w801351cq0";
       };
       packageRequires = [ xr ];
       meta = {
@@ -7960,6 +8003,28 @@
       };
     }
   ) { };
+  speedrect = callPackage (
+    {
+      compat,
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "speedrect";
+      ename = "speedrect";
+      version = "0.7";
+      src = fetchurl {
+        url = "https://elpa.gnu.org/packages/speedrect-0.7.tar";
+        sha256 = "0nxwwd12qqyxq1fg8n6miyx63fp29cvpfp8w33zmf9dhkcjwyfd1";
+      };
+      packageRequires = [ compat ];
+      meta = {
+        homepage = "https://elpa.gnu.org/packages/speedrect.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   spinner = callPackage (
     {
       elpaBuild,
@@ -8101,10 +8166,10 @@
     elpaBuild {
       pname = "standard-themes";
       ename = "standard-themes";
-      version = "2.1.0";
+      version = "2.2.0";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/standard-themes-2.1.0.tar";
-        sha256 = "0x7fphd36kwg4vfwix5rq7260xl6x6cjfwsq11rj4af30sm4hlfn";
+        url = "https://elpa.gnu.org/packages/standard-themes-2.2.0.tar";
+        sha256 = "0qdld75vcfhsn2l0xips52vrlp5q7ss3973hd722h2gp1wddn5f7";
       };
       packageRequires = [ ];
       meta = {
@@ -8122,10 +8187,10 @@
     elpaBuild {
       pname = "stream";
       ename = "stream";
-      version = "2.3.0";
+      version = "2.4.0";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/stream-2.3.0.tar";
-        sha256 = "0224hjcxvy3cxv1c3pz9j2laxld2cxqbs5sigr02fcdcb9qn7hay";
+        url = "https://elpa.gnu.org/packages/stream-2.4.0.tar";
+        sha256 = "16wl1q7wikk0wyzfwjz16azq025dx4wdh1j9q0nadi68ygxi172b";
       };
       packageRequires = [ ];
       meta = {
@@ -8294,10 +8359,10 @@
     elpaBuild {
       pname = "sxhkdrc-mode";
       ename = "sxhkdrc-mode";
-      version = "1.0.0";
+      version = "1.1.0";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/sxhkdrc-mode-1.0.0.tar";
-        sha256 = "0gfv5l71md2ica9jfa8ynwfag3zvayc435pl91lzcz92qy5n0hlj";
+        url = "https://elpa.gnu.org/packages/sxhkdrc-mode-1.1.0.tar";
+        sha256 = "00mzhxrlcbswsv3jysgqniq02inakz7j5a2hx2w83is5rbmb9bhc";
       };
       packageRequires = [ ];
       meta = {
@@ -8449,10 +8514,10 @@
     elpaBuild {
       pname = "tempel";
       ename = "tempel";
-      version = "1.2";
+      version = "1.3";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/tempel-1.2.tar";
-        sha256 = "0lvdd7lvdx4yf0zhrv380y5q3zvvk7gsxjgxj2c40np86c4q2q7m";
+        url = "https://elpa.gnu.org/packages/tempel-1.3.tar";
+        sha256 = "0fivsldisk17a1vbzx91kmvsd85vl0dnih77pqnzriyqs8dl1wdm";
       };
       packageRequires = [ compat ];
       meta = {
@@ -8688,10 +8753,10 @@
     elpaBuild {
       pname = "tramp";
       ename = "tramp";
-      version = "2.7.1.5";
+      version = "2.7.2";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/tramp-2.7.1.5.tar";
-        sha256 = "11a2zyk0d1y9bxhdqfzcx4ynazfs6hb3mdgpz5kp9p3lk8l6bz5g";
+        url = "https://elpa.gnu.org/packages/tramp-2.7.2.tar";
+        sha256 = "1m1ar9k5f4yx98m8v0y8rm7hq5dwjafb096gmdg6mz57k1k3y6vl";
       };
       packageRequires = [ ];
       meta = {
@@ -8730,10 +8795,10 @@
     elpaBuild {
       pname = "tramp-theme";
       ename = "tramp-theme";
-      version = "0.2";
+      version = "0.3";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/tramp-theme-0.2.tar";
-        sha256 = "0dz8ndnmwc38g1gy30f3jcjqg5nzdi6721x921r4s5a8i1mx2kpm";
+        url = "https://elpa.gnu.org/packages/tramp-theme-0.3.tar";
+        sha256 = "1v9265cnk858jl522zcnqf2cv3f3g93f0mk52plz3n4a8k5nlfa7";
       };
       packageRequires = [ ];
       meta = {
@@ -8774,10 +8839,10 @@
     elpaBuild {
       pname = "transient";
       ename = "transient";
-      version = "0.7.9";
+      version = "0.8.3";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/transient-0.7.9.tar";
-        sha256 = "07d5pzd7nalnjxn6wpj6vpfg8pldnwh69l85immmiww03vl8ngrf";
+        url = "https://elpa.gnu.org/packages/transient-0.8.3.tar";
+        sha256 = "0cx9h7knkyzalkyvbvl762mnl2mslcfxh899mf5wgqfavwkzgqp7";
       };
       packageRequires = [
         compat
@@ -9287,10 +9352,10 @@
     elpaBuild {
       pname = "verilog-mode";
       ename = "verilog-mode";
-      version = "2024.10.9.140346409";
+      version = "2025.1.1.100165202";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/verilog-mode-2024.10.9.140346409.tar";
-        sha256 = "1hm0id8sivb7znvw1f63asbs4sf4v6hkimr0j8bqqda3h9sz197l";
+        url = "https://elpa.gnu.org/packages/verilog-mode-2025.1.1.100165202.tar";
+        sha256 = "1cgv081dlarc0b4s6rjkqbvs4fa9npyq9pjxj7173vmgkfdwmkp5";
       };
       packageRequires = [ ];
       meta = {
@@ -9309,10 +9374,10 @@
     elpaBuild {
       pname = "vertico";
       ename = "vertico";
-      version = "1.9";
+      version = "1.10";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/vertico-1.9.tar";
-        sha256 = "12aiqxsar86xlmsfzvilza10wf184nwhg218bv6bip7v51ikh37y";
+        url = "https://elpa.gnu.org/packages/vertico-1.10.tar";
+        sha256 = "1mka141i5dmdw8c8dsxgxwqfr78s3gjy4rrra8qd5b8qrhv797dx";
       };
       packageRequires = [ compat ];
       meta = {
@@ -9332,10 +9397,10 @@
     elpaBuild {
       pname = "vertico-posframe";
       ename = "vertico-posframe";
-      version = "0.7.7";
+      version = "0.7.8";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/vertico-posframe-0.7.7.tar";
-        sha256 = "0ahn0b5v9xw6f1zvgv27c82kxdh4rx7n9dbp17rkkkg3dvvkdzxy";
+        url = "https://elpa.gnu.org/packages/vertico-posframe-0.7.8.tar";
+        sha256 = "08f1fmr0s9kx3f7ivh1isdik04cq87j69wgl5ir0gppa39ip0dqw";
       };
       packageRequires = [
         posframe
@@ -9853,10 +9918,10 @@
     elpaBuild {
       pname = "xr";
       ename = "xr";
-      version = "2.0";
+      version = "2.1";
       src = fetchurl {
-        url = "https://elpa.gnu.org/packages/xr-2.0.tar";
-        sha256 = "1y5pcrph6v8q06mipv3l49qhw55yvvb1nnq0817bzm25k0s3z70v";
+        url = "https://elpa.gnu.org/packages/xr-2.1.tar";
+        sha256 = "1yssl7av2rpanzmm93iw74acnb3pbrnh0b51kr64wcj6hwb26cy2";
       };
       packageRequires = [ ];
       meta = {

pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix

@@ -956,11 +956,18 @@ let
         # missing optional dependencies
         conda = addPackageRequires super.conda [ self.projectile ];
 
-        consult-gh = super.consult-gh.overrideAttrs (old: {
-          propagatedUserEnvPkgs = old.propagatedUserEnvPkgs or [ ] ++ [ pkgs.gh ];
-        });
+        # needs network during compilation, also native-ice
+        consult-gh = ignoreCompilationError (
+          super.consult-gh.overrideAttrs (old: {
+            propagatedUserEnvPkgs = old.propagatedUserEnvPkgs or [ ] ++ [ pkgs.gh ];
+          })
+        );
 
-        consult-gh-forge = buildWithGit super.consult-gh-forge;
+        # needs network during compilation
+        consult-gh-embark = ignoreCompilationError super.consult-gh-embark;
+
+        # needs network during compilation
+        consult-gh-forge = ignoreCompilationError (buildWithGit super.consult-gh-forge);
 
         counsel-gtags = ignoreCompilationError super.counsel-gtags; # elisp error
 
@@ -1398,7 +1405,7 @@ let
         org-gtd = ignoreCompilationError super.org-gtd; # elisp error
 
         # needs newer org than the Eamcs 29.4 builtin one
-        org-link-beautify = addPackageRequires super.org-link-beautify [ self.org ];
+        org-link-beautify = addPackageRequires super.org-link-beautify [ self.org self.qrencode ];
 
         # TODO report to upstream
         org-kindle = addPackageRequires super.org-kindle [ self.dash ];

pkgs/applications/editors/emacs/elisp-packages/nongnu-devel-generated.nix

@@ -177,10 +177,10 @@
     elpaBuild {
       pname = "apropospriate-theme";
       ename = "apropospriate-theme";
-      version = "0.2.0.0.20241118.190153";
+      version = "0.2.0.0.20241215.141144";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/apropospriate-theme-0.2.0.0.20241118.190153.tar";
-        sha256 = "0nqnf57bf21wg2vlw85msg927618hhsn4qfwd60vrx70260432kf";
+        url = "https://elpa.nongnu.org/nongnu-devel/apropospriate-theme-0.2.0.0.20241215.141144.tar";
+        sha256 = "0hr961s3s9n9an63yxkxkryas0vr0cw9g07ir8igyan6b8b2didb";
       };
       packageRequires = [ ];
       meta = {
@@ -220,10 +220,10 @@
     elpaBuild {
       pname = "auto-dim-other-buffers";
       ename = "auto-dim-other-buffers";
-      version = "2.1.1.0.20240515.131159";
+      version = "2.2.1.0.20241219.184527";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/auto-dim-other-buffers-2.1.1.0.20240515.131159.tar";
-        sha256 = "1dp3q1hrdcvi82pcj5hxha9yyy9lkdqs8kxfq6v7lq716wxkwxfl";
+        url = "https://elpa.nongnu.org/nongnu-devel/auto-dim-other-buffers-2.2.1.0.20241219.184527.tar";
+        sha256 = "0596jw2qxk79z26blq7vlch7wszv39f84kpi7gwrbad0jyjcryfw";
       };
       packageRequires = [ ];
       meta = {
@@ -284,10 +284,10 @@
     elpaBuild {
       pname = "bash-completion";
       ename = "bash-completion";
-      version = "3.1.1.0.20241118.194353";
+      version = "3.2.1snapshot0.20250101.145820";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/bash-completion-3.1.1.0.20241118.194353.tar";
-        sha256 = "10cirfnwz34yc7glf1xzshq3926jdwdf3s7bdarykrkxmsrha4f7";
+        url = "https://elpa.nongnu.org/nongnu-devel/bash-completion-3.2.1snapshot0.20250101.145820.tar";
+        sha256 = "11a2fijxi102mnm63vbxgrrw2rr9nf5rhlfal3766m8rv2drwhd7";
       };
       packageRequires = [ ];
       meta = {
@@ -544,10 +544,10 @@
     elpaBuild {
       pname = "cider";
       ename = "cider";
-      version = "1.16.1.0.20241203.160720";
+      version = "1.16.1.0.20250103.102622";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/cider-1.16.1.0.20241203.160720.tar";
-        sha256 = "0b6nqhg5c0ny8ilm4653c7pd34aj02bh6ya9bzc9swdpyq7pwnqr";
+        url = "https://elpa.nongnu.org/nongnu-devel/cider-1.16.1.0.20250103.102622.tar";
+        sha256 = "0xxmarmq2mja45yb4a4aqddbcnhi91dcdlw0xq5j5ab3k9grmmpa";
       };
       packageRequires = [
         clojure-mode
@@ -573,10 +573,10 @@
     elpaBuild {
       pname = "clojure-mode";
       ename = "clojure-mode";
-      version = "5.20.0snapshot0.20241125.112305";
+      version = "5.20.0snapshot0.20241211.152233";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/clojure-mode-5.20.0snapshot0.20241125.112305.tar";
-        sha256 = "0hh17w63j5x4687kbd2vmlj9qs468ivq54mwwcm6p43wr7rvk2cj";
+        url = "https://elpa.nongnu.org/nongnu-devel/clojure-mode-5.20.0snapshot0.20241211.152233.tar";
+        sha256 = "0m6bafwl3687ccl815q70bw4q8k3w12vkfl24g5x9rn6dn44ppxx";
       };
       packageRequires = [ ];
       meta = {
@@ -638,10 +638,10 @@
     elpaBuild {
       pname = "consult-flycheck";
       ename = "consult-flycheck";
-      version = "1.0.0.20241114.112007";
+      version = "1.0.0.20250101.91433";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/consult-flycheck-1.0.0.20241114.112007.tar";
-        sha256 = "1jzli50sjr8pv2j9qg7glxdgm54sx2yw6xr7ka738gisa1r0iscl";
+        url = "https://elpa.nongnu.org/nongnu-devel/consult-flycheck-1.0.0.20250101.91433.tar";
+        sha256 = "05ms0zhswsdlvvrz71md4nsqisshar284xn7idw7z01ddd05rjmb";
       };
       packageRequires = [
         consult
@@ -774,10 +774,10 @@
     elpaBuild {
       pname = "d-mode";
       ename = "d-mode";
-      version = "202408131340.0.20241126.105644";
+      version = "202408131340.0.20241225.185152";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/d-mode-202408131340.0.20241126.105644.tar";
-        sha256 = "11hc3dyxyr1pcq25jvw9x3ys4v73rbqw9p19s4i59p9mdb0bnxpy";
+        url = "https://elpa.nongnu.org/nongnu-devel/d-mode-202408131340.0.20241225.185152.tar";
+        sha256 = "08wlsp1mzsn0xprslwmnhxzj58yy35vjy09l70dxz5pyxk3vg2vd";
       };
       packageRequires = [ ];
       meta = {
@@ -880,10 +880,10 @@
     elpaBuild {
       pname = "diff-ansi";
       ename = "diff-ansi";
-      version = "0.2.0.20240818.235912";
+      version = "0.2.0.20241208.51148";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/diff-ansi-0.2.0.20240818.235912.tar";
-        sha256 = "085h7xb75dkdmsnc572rmqgzw1pp4jmxcfrr3nnpbvirgjij8pma";
+        url = "https://elpa.nongnu.org/nongnu-devel/diff-ansi-0.2.0.20241208.51148.tar";
+        sha256 = "08fvdzs2qmd4mbcz52bhmng2wz2pxn9x06w5sg9fjq744005p7dd";
       };
       packageRequires = [ ];
       meta = {
@@ -902,10 +902,10 @@
     elpaBuild {
       pname = "dirvish";
       ename = "dirvish";
-      version = "2.0.53.0.20230519.150010";
+      version = "2.0.53.0.20250101.212150";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/dirvish-2.0.53.0.20230519.150010.tar";
-        sha256 = "0n73giyvg244s0cxfrkc3j0jrq20bs1zili6liab0s3ks02kvqdg";
+        url = "https://elpa.nongnu.org/nongnu-devel/dirvish-2.0.53.0.20250101.212150.tar";
+        sha256 = "0q4lh8xz2922lsgjb58c116sndcvy2fc0clws6bp1418fsyjxa9l";
       };
       packageRequires = [ transient ];
       meta = {
@@ -923,10 +923,10 @@
     elpaBuild {
       pname = "doc-show-inline";
       ename = "doc-show-inline";
-      version = "0.1.0.20240616.234552";
+      version = "0.1.0.20241208.50508";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/doc-show-inline-0.1.0.20240616.234552.tar";
-        sha256 = "0p39glahjqm2fv8xcnwyhcnzsf53g15013jbnj1lh7610bdgfk6g";
+        url = "https://elpa.nongnu.org/nongnu-devel/doc-show-inline-0.1.0.20241208.50508.tar";
+        sha256 = "1k98b8d0bxiz7i4n4r46zxy14jszskfmvxavwriig59p2g5gx1yb";
       };
       packageRequires = [ ];
       meta = {
@@ -965,10 +965,10 @@
     elpaBuild {
       pname = "dracula-theme";
       ename = "dracula-theme";
-      version = "1.8.2.0.20241102.130126";
+      version = "1.8.2.0.20241217.214522";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/dracula-theme-1.8.2.0.20241102.130126.tar";
-        sha256 = "01f3g7cy9snm4f2b2rx7zd82kwxzlf9g0wapwa83k3i60p23rf5s";
+        url = "https://elpa.nongnu.org/nongnu-devel/dracula-theme-1.8.2.0.20241217.214522.tar";
+        sha256 = "0dizqwzgygkim66lxkxpwcidhhi7ppwazi57nqkahyd3n03ka2f9";
       };
       packageRequires = [ ];
       meta = {
@@ -1008,10 +1008,10 @@
     elpaBuild {
       pname = "dslide";
       ename = "dslide";
-      version = "0.5.5.0.20241128.111432";
+      version = "0.6.2.0.20250102.81901";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/dslide-0.5.5.0.20241128.111432.tar";
-        sha256 = "1d2rsqzn8w6w3qvsfsgpmjwn53nsj30jivli02d7n24q30pxzpv6";
+        url = "https://elpa.nongnu.org/nongnu-devel/dslide-0.6.2.0.20250102.81901.tar";
+        sha256 = "18ggnfj9adlrhni2mb6f1ygc0mf7q8xm99729cbvp2k6l7yidxxc";
       };
       packageRequires = [ ];
       meta = {
@@ -1084,6 +1084,48 @@
       };
     }
   ) { };
+  eglot-inactive-regions = callPackage (
+    {
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "eglot-inactive-regions";
+      ename = "eglot-inactive-regions";
+      version = "0.6.3.0.20241217.45248";
+      src = fetchurl {
+        url = "https://elpa.nongnu.org/nongnu-devel/eglot-inactive-regions-0.6.3.0.20241217.45248.tar";
+        sha256 = "1kf84wzfdysskmxjv45c1vdp5vpg7issk92gvcvrw59afsv25cza";
+      };
+      packageRequires = [ ];
+      meta = {
+        homepage = "https://elpa.nongnu.org/nongnu-devel/eglot-inactive-regions.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
+  eldoc-diffstat = callPackage (
+    {
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "eldoc-diffstat";
+      ename = "eldoc-diffstat";
+      version = "1.0.0.20241214.213403";
+      src = fetchurl {
+        url = "https://elpa.nongnu.org/nongnu-devel/eldoc-diffstat-1.0.0.20241214.213403.tar";
+        sha256 = "10rjz33lhsp61pjdj64k0y9wh9nlfnz1w89xck0gfp2p42kya87n";
+      };
+      packageRequires = [ ];
+      meta = {
+        homepage = "https://elpa.nongnu.org/nongnu-devel/eldoc-diffstat.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   elixir-mode = callPackage (
     {
       elpaBuild,
@@ -1180,10 +1222,10 @@
     elpaBuild {
       pname = "evil";
       ename = "evil";
-      version = "1.15.0.0.20241006.175409";
+      version = "1.15.0.0.20241229.162330";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/evil-1.15.0.0.20241006.175409.tar";
-        sha256 = "0w752hhnpkfa5wqm1rk6nzq6n9y8c8mjzjhzri91l06jngpl6ckd";
+        url = "https://elpa.nongnu.org/nongnu-devel/evil-1.15.0.0.20241229.162330.tar";
+        sha256 = "03l1cg2d4zdh59cf93cvc3i5daq2pw7j8hw7kbdxjy5cl7136d32";
       };
       packageRequires = [
         cl-lib
@@ -1255,10 +1297,10 @@
     elpaBuild {
       pname = "evil-escape";
       ename = "evil-escape";
-      version = "3.16.0.20231122.211452";
+      version = "3.16.0.20241212.131839";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/evil-escape-3.16.0.20231122.211452.tar";
-        sha256 = "1yv77vxvyl41795h7ixl6fhm43n7q6xqkqp1yaqgv5g9iymdj1s0";
+        url = "https://elpa.nongnu.org/nongnu-devel/evil-escape-3.16.0.20241212.131839.tar";
+        sha256 = "18j653kymcvxdr0n0vibl091p2zwdzgqymw3g778visshxgk11mb";
       };
       packageRequires = [
         cl-lib
@@ -1407,10 +1449,10 @@
     elpaBuild {
       pname = "evil-matchit";
       ename = "evil-matchit";
-      version = "3.0.4.0.20241111.120111";
+      version = "4.0.1.0.20241205.72440";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/evil-matchit-3.0.4.0.20241111.120111.tar";
-        sha256 = "1jv7rs102i00kwdkj1n3l0j9as0kbrylhkkn2rrgwv9b97lmlirs";
+        url = "https://elpa.nongnu.org/nongnu-devel/evil-matchit-4.0.1.0.20241205.72440.tar";
+        sha256 = "0hi6p25pbn2xh7jzglmpvs5nvrlzi7b4gjm37q1vbyiji9k5xfci";
       };
       packageRequires = [ ];
       meta = {
@@ -1450,10 +1492,10 @@
     elpaBuild {
       pname = "evil-numbers";
       ename = "evil-numbers";
-      version = "0.7.0.20241204.12906";
+      version = "0.7.0.20241208.52322";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/evil-numbers-0.7.0.20241204.12906.tar";
-        sha256 = "1r4ic5db8vl3mslp48w8lqx904raxi8lzp512jcjv21vs36gjl97";
+        url = "https://elpa.nongnu.org/nongnu-devel/evil-numbers-0.7.0.20241208.52322.tar";
+        sha256 = "1a5lw59lfavfqnaxay4c4j7246q4i3w53ra9gc44qr94432nd1q9";
       };
       packageRequires = [ evil ];
       meta = {
@@ -1610,10 +1652,10 @@
     elpaBuild {
       pname = "flycheck";
       ename = "flycheck";
-      version = "35.0snapshot0.20241130.150233";
+      version = "35.0snapshot0.20250104.70510";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/flycheck-35.0snapshot0.20241130.150233.tar";
-        sha256 = "08viqbba50alfj3783ykymjqwpi08si6bi411sm29gagga1cjxr6";
+        url = "https://elpa.nongnu.org/nongnu-devel/flycheck-35.0snapshot0.20250104.70510.tar";
+        sha256 = "1p186zsjjhaz99776zgys9zxx9fk01mllv9g6bsmzd6srmcf9bc5";
       };
       packageRequires = [ ];
       meta = {
@@ -1856,10 +1898,10 @@
     elpaBuild {
       pname = "geiser-chicken";
       ename = "geiser-chicken";
-      version = "0.17.0.20241204.11932";
+      version = "0.17.0.20241204.144210";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/geiser-chicken-0.17.0.20241204.11932.tar";
-        sha256 = "1l95d72wl74mlfa50m9m999skj993vqdmm13qm42n0lp0y9ndvyf";
+        url = "https://elpa.nongnu.org/nongnu-devel/geiser-chicken-0.17.0.20241204.144210.tar";
+        sha256 = "0lss1nz7kdbpmky96r10gvsbnjxxnqlymz0d0579ggvf9hi1cj66";
       };
       packageRequires = [ geiser ];
       meta = {
@@ -2090,10 +2132,10 @@
     elpaBuild {
       pname = "gnosis";
       ename = "gnosis";
-      version = "0.4.8.0.20241115.104152";
+      version = "0.4.10.0.20241211.105407";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/gnosis-0.4.8.0.20241115.104152.tar";
-        sha256 = "143pmwp5g2wzmmhmbwc1q6hhf86j1cywi8x2hzvlq0p5mhkkilr1";
+        url = "https://elpa.nongnu.org/nongnu-devel/gnosis-0.4.10.0.20241211.105407.tar";
+        sha256 = "0wvqk279qfdvwk7k27lzw9063x7w6jypprlh1rgj6xlhnn3kv9y8";
       };
       packageRequires = [
         compat
@@ -2264,10 +2306,10 @@
     elpaBuild {
       pname = "gptel";
       ename = "gptel";
-      version = "0.9.6.0.20241202.163036";
+      version = "0.9.7.0.20250103.103741";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/gptel-0.9.6.0.20241202.163036.tar";
-        sha256 = "0zlfrnp01hb6syrkgkwfi1hjxm9l4j9sqrwn7a8nmk5wlw4bi6xm";
+        url = "https://elpa.nongnu.org/nongnu-devel/gptel-0.9.7.0.20250103.103741.tar";
+        sha256 = "00d22c6hgm8cr2wfqk4s2xcqblljzcv4iyrvbcjbgipr2nynb6iw";
       };
       packageRequires = [
         compat
@@ -2288,10 +2330,10 @@
     elpaBuild {
       pname = "graphql-mode";
       ename = "graphql-mode";
-      version = "1.0.0.0.20241020.75405";
+      version = "1.0.0.0.20241206.72535";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/graphql-mode-1.0.0.0.20241020.75405.tar";
-        sha256 = "0bds1zv0syg1jfdak2hk3kank4c532r6ki095wamxy06rwdbm2il";
+        url = "https://elpa.nongnu.org/nongnu-devel/graphql-mode-1.0.0.0.20241206.72535.tar";
+        sha256 = "06pn5rk0mkswrx2sd589hbqir1wkczjwy453ssk0az4z49g85ks9";
       };
       packageRequires = [ ];
       meta = {
@@ -2438,10 +2480,10 @@
     elpaBuild {
       pname = "haskell-ts-mode";
       ename = "haskell-ts-mode";
-      version = "1.0.20241108.150811";
+      version = "1.0.20250101.102728";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/haskell-ts-mode-1.0.20241108.150811.tar";
-        sha256 = "1ycbcwhj9j77jgpb3ag7hy8474qdj4rzzg7z5z79f0fqvlnv94m7";
+        url = "https://elpa.nongnu.org/nongnu-devel/haskell-ts-mode-1.0.20250101.102728.tar";
+        sha256 = "15m1qdcb899wmdx7ih53c5ndlvv3q5fny885l287sf17f6p563k7";
       };
       packageRequires = [ ];
       meta = {
@@ -2461,10 +2503,10 @@
     elpaBuild {
       pname = "helm";
       ename = "helm";
-      version = "4.0.0.20241204.51511";
+      version = "4.0.0.20250104.104508";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/helm-4.0.0.20241204.51511.tar";
-        sha256 = "1dzc1jg6p9r589mzwdzhlhj58239ssy85mz27kwr7yyg36cz3m3l";
+        url = "https://elpa.nongnu.org/nongnu-devel/helm-4.0.0.20250104.104508.tar";
+        sha256 = "0xcsfbzkwip67m5lpjwi8a08hfm8nc5xwgvz18d7685gsmizc6hs";
       };
       packageRequires = [
         helm-core
@@ -2486,10 +2528,10 @@
     elpaBuild {
       pname = "helm-core";
       ename = "helm-core";
-      version = "4.0.0.20241204.51511";
+      version = "4.0.0.20250104.104508";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/helm-core-4.0.0.20241204.51511.tar";
-        sha256 = "1xvx1x6p7r1ak40n3740q9iyah2d1npqg7aw1zybshcrai5bm9jm";
+        url = "https://elpa.nongnu.org/nongnu-devel/helm-core-4.0.0.20250104.104508.tar";
+        sha256 = "02silp1myffcm3nwrakfj8zn3c5x8msmmyrqx1id2r6wwki9f8pz";
       };
       packageRequires = [ async ];
       meta = {
@@ -2549,10 +2591,10 @@
     elpaBuild {
       pname = "hl-block-mode";
       ename = "hl-block-mode";
-      version = "0.2.0.20240422.12652";
+      version = "0.2.0.20241208.45934";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/hl-block-mode-0.2.0.20240422.12652.tar";
-        sha256 = "1j3fp1p066j9b67hna6mh7pb96kld9nc0mkv8jl0qdwi95aah81q";
+        url = "https://elpa.nongnu.org/nongnu-devel/hl-block-mode-0.2.0.20241208.45934.tar";
+        sha256 = "0s9x68h46qf49xg7fd7gbrr78l7zc53hnprq6hxhzlw5fara7xsn";
       };
       packageRequires = [ ];
       meta = {
@@ -2619,10 +2661,10 @@
     elpaBuild {
       pname = "hyperdrive";
       ename = "hyperdrive";
-      version = "0.5pre0.20241106.231359";
+      version = "0.6pre0.20241222.235250";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/hyperdrive-0.5pre0.20241106.231359.tar";
-        sha256 = "11b3dvwzrsgg2nj3kasgrz5bwhd2i3ig4v9blzlzhyybw6wy0i1f";
+        url = "https://elpa.nongnu.org/nongnu-devel/hyperdrive-0.6pre0.20241222.235250.tar";
+        sha256 = "0a9z9kbnlzbv21w62zyw3mpbvjfnl5vhjmlpq65w7cc4d1qd2jp5";
       };
       packageRequires = [
         compat
@@ -2764,10 +2806,10 @@
     elpaBuild {
       pname = "inf-ruby";
       ename = "inf-ruby";
-      version = "2.8.1.0.20240925.4944";
+      version = "2.8.1.0.20241220.25141";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/inf-ruby-2.8.1.0.20240925.4944.tar";
-        sha256 = "1wl5nzrbafvmvvvq477lsvc14pvlmq8x9j1cqbd0cj11lvn4k1qb";
+        url = "https://elpa.nongnu.org/nongnu-devel/inf-ruby-2.8.1.0.20241220.25141.tar";
+        sha256 = "0z3vbdb1df0vwjm2lk6bk11c0afg8w6p5n2x8q4wgmwqyp3h3gb2";
       };
       packageRequires = [ ];
       meta = {
@@ -2895,10 +2937,10 @@
     elpaBuild {
       pname = "julia-mode";
       ename = "julia-mode";
-      version = "1.0.1.0.20241120.85729";
+      version = "1.0.2.0.20241213.162017";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/julia-mode-1.0.1.0.20241120.85729.tar";
-        sha256 = "0a6xi5zcq1nfbsjqk84x6avlrzbjdh6fbq1h6jkqcczy7mm5rg5h";
+        url = "https://elpa.nongnu.org/nongnu-devel/julia-mode-1.0.2.0.20241213.162017.tar";
+        sha256 = "09l2awhz4362g03qnpsy4813afjabm2dqh8g3ma354k7ql8rr95h";
       };
       packageRequires = [ ];
       meta = {
@@ -3003,10 +3045,10 @@
     elpaBuild {
       pname = "macrostep";
       ename = "macrostep";
-      version = "0.9.4.0.20241025.145629";
+      version = "0.9.4.0.20241228.221506";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/macrostep-0.9.4.0.20241025.145629.tar";
-        sha256 = "1xbi45ymsqc2vbhl1s3wphirgqz5ky9880fzr949bhd0ff18bw6x";
+        url = "https://elpa.nongnu.org/nongnu-devel/macrostep-0.9.4.0.20241228.221506.tar";
+        sha256 = "0yza9ms8i3nq4fh42s475r0m77b2phq8sx41p6irywi0clc33m0y";
       };
       packageRequires = [
         cl-lib
@@ -3033,10 +3075,10 @@
     elpaBuild {
       pname = "magit";
       ename = "magit";
-      version = "4.1.2.0.20241102.130025";
+      version = "4.2.0.0.20250101.180326";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/magit-4.1.2.0.20241102.130025.tar";
-        sha256 = "1y3fr2qj8a1h7hkrh47zshbmrcfxhw6i8wiqcrrba7ypnas53gcg";
+        url = "https://elpa.nongnu.org/nongnu-devel/magit-4.2.0.0.20250101.180326.tar";
+        sha256 = "1w6yfwsy4i1wj9wm7yk7zlxkqsws1g6ql22rw8cc93hhp9rf3a57";
       };
       packageRequires = [
         compat
@@ -3064,10 +3106,10 @@
     elpaBuild {
       pname = "magit-section";
       ename = "magit-section";
-      version = "4.1.2.0.20241102.130025";
+      version = "4.2.0.0.20250101.180326";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/magit-section-4.1.2.0.20241102.130025.tar";
-        sha256 = "1cnpklpsvbsi1wsmfbp5m8379cbr6jdifxm07zj4hnvi8lyr49vn";
+        url = "https://elpa.nongnu.org/nongnu-devel/magit-section-4.2.0.0.20250101.180326.tar";
+        sha256 = "0wyh9fvgnbn35nak6f3v8651j33sz929xwvkqgyrbicxwdwxinbr";
       };
       packageRequires = [
         compat
@@ -3089,10 +3131,10 @@
     elpaBuild {
       pname = "markdown-mode";
       ename = "markdown-mode";
-      version = "2.7alpha0.20241203.113852";
+      version = "2.7alpha0.20241210.10425";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/markdown-mode-2.7alpha0.20241203.113852.tar";
-        sha256 = "14kkg7wj6qkq84jsa5cdwc7i7lqvilx21nb9lyddqxqxm8h7sld8";
+        url = "https://elpa.nongnu.org/nongnu-devel/markdown-mode-2.7alpha0.20241210.10425.tar";
+        sha256 = "1rlja17nqr9ly5mab5824dc97w7sgr45adrfhn5li79g89hazd3n";
       };
       packageRequires = [ ];
       meta = {
@@ -3113,10 +3155,10 @@
     elpaBuild {
       pname = "mastodon";
       ename = "mastodon";
-      version = "1.1.7.0.20241202.183936";
+      version = "1.1.8.0.20241223.104057";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/mastodon-1.1.7.0.20241202.183936.tar";
-        sha256 = "08683fah6xkfzgxi6si4qgl4mxccczj4dcaivif1qlhfrc3bh66f";
+        url = "https://elpa.nongnu.org/nongnu-devel/mastodon-1.1.8.0.20241223.104057.tar";
+        sha256 = "13iyzv0gyad07215zvvs9q52ikqf97qn851qgjqqhq9k4p07a22q";
       };
       packageRequires = [
         persist
@@ -3189,10 +3231,10 @@
     elpaBuild {
       pname = "meow";
       ename = "meow";
-      version = "1.5.0.0.20241203.160407";
+      version = "1.5.0.0.20241224.211501";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/meow-1.5.0.0.20241203.160407.tar";
-        sha256 = "0a3zdx91j5q0mllm71951392hgnn5q9l960qs2lazs8plpv4pn9f";
+        url = "https://elpa.nongnu.org/nongnu-devel/meow-1.5.0.0.20241224.211501.tar";
+        sha256 = "1xrq21awlf12ki7rdsm6n37hg4m1jjfjz8n0m2193jml94wc4cf8";
       };
       packageRequires = [ ];
       meta = {
@@ -3448,10 +3490,10 @@
     elpaBuild {
       pname = "org-contrib";
       ename = "org-contrib";
-      version = "0.6.0.20241029.204012";
+      version = "0.6.0.20241207.74256";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/org-contrib-0.6.0.20241029.204012.tar";
-        sha256 = "12pfmv5ns5igdvc06glcc8nxqcj7lwjqc3s86720ys57y4py566w";
+        url = "https://elpa.nongnu.org/nongnu-devel/org-contrib-0.6.0.20241207.74256.tar";
+        sha256 = "0i9ii3ngimx1l8s4pq2zn73lnry1npsbrsxzn92gwayj0sm77bkp";
       };
       packageRequires = [ org ];
       meta = {
@@ -3881,10 +3923,10 @@
     elpaBuild {
       pname = "php-mode";
       ename = "php-mode";
-      version = "1.26.1.0.20241024.124149";
+      version = "1.26.1.0.20250103.15745";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/php-mode-1.26.1.0.20241024.124149.tar";
-        sha256 = "0h5lzvsssk0nf3g408a7jg25crglsjkhcfp1ckjnzpgiwf59i6w8";
+        url = "https://elpa.nongnu.org/nongnu-devel/php-mode-1.26.1.0.20250103.15745.tar";
+        sha256 = "0ls4wpcn6lk5qn7n7gamk9sx6fm35cdbrv96pzi6srf3q1r71wpr";
       };
       packageRequires = [ ];
       meta = {
@@ -3923,10 +3965,10 @@
     elpaBuild {
       pname = "popup";
       ename = "popup";
-      version = "0.5.9.0.20240721.5155";
+      version = "0.5.9.0.20250101.4328";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/popup-0.5.9.0.20240721.5155.tar";
-        sha256 = "11ay4yknbc6dy7c08dcaz4sy1ly98m0ghchif0m2mm72s2hgw7g7";
+        url = "https://elpa.nongnu.org/nongnu-devel/popup-0.5.9.0.20250101.4328.tar";
+        sha256 = "0qgkwd0kbkifkpfv0gznd4n81xhf62q9s0bd0831yp1mkxd9y03x";
       };
       packageRequires = [ ];
       meta = {
@@ -4008,10 +4050,10 @@
     elpaBuild {
       pname = "racket-mode";
       ename = "racket-mode";
-      version = "1.0.20241129.85359";
+      version = "1.0.20250103.151851";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/racket-mode-1.0.20241129.85359.tar";
-        sha256 = "0j6hs2wpaknzprcm18y1ayqjcr2sl0z22fhw1yla5rv74lyqzglx";
+        url = "https://elpa.nongnu.org/nongnu-devel/racket-mode-1.0.20250103.151851.tar";
+        sha256 = "03m0ky98s647ajrjf85i9zvqwmwh4l33rdywbcc5vg516hgsnh0d";
       };
       packageRequires = [ ];
       meta = {
@@ -4071,10 +4113,10 @@
     elpaBuild {
       pname = "recomplete";
       ename = "recomplete";
-      version = "0.2.0.20240616.234552";
+      version = "0.2.0.20241208.45418";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/recomplete-0.2.0.20240616.234552.tar";
-        sha256 = "0gkd3g1p6i4l7s6gqjsdj20m3y8n75wlcfw6xii0ka7n8j8dmrz4";
+        url = "https://elpa.nongnu.org/nongnu-devel/recomplete-0.2.0.20241208.45418.tar";
+        sha256 = "1pflxqh7ng3khkmn4g760k8v1amd9x18i452cxd5iwfq1cb9l9f4";
       };
       packageRequires = [ ];
       meta = {
@@ -4092,10 +4134,10 @@
     elpaBuild {
       pname = "reformatter";
       ename = "reformatter";
-      version = "0.8.0.20241106.203153";
+      version = "0.8.0.20241204.105138";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/reformatter-0.8.0.20241106.203153.tar";
-        sha256 = "1gni5f8x8d6m063k9bgaqah80w2hnb12d7qwdw1ai0xg7jb92vp7";
+        url = "https://elpa.nongnu.org/nongnu-devel/reformatter-0.8.0.20241204.105138.tar";
+        sha256 = "1j78naw4jikh7nby67gdbx9banchmf1q5fysal1328gxnyqknmzi";
       };
       packageRequires = [ ];
       meta = {
@@ -4224,10 +4266,10 @@
     elpaBuild {
       pname = "scad-mode";
       ename = "scad-mode";
-      version = "94.0.0.20240926.92457";
+      version = "95.0.0.20250102.95738";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/scad-mode-94.0.0.20240926.92457.tar";
-        sha256 = "09hgnzzfi6wdy3p0nfl6a00npxpsdy30dyc89m1h087wlhkjjyci";
+        url = "https://elpa.nongnu.org/nongnu-devel/scad-mode-95.0.0.20250102.95738.tar";
+        sha256 = "0pzqzz1a0shf0dm70c1d730m3dndal2dvm4dw65vxasj8vc1v8nx";
       };
       packageRequires = [ compat ];
       meta = {
@@ -4245,10 +4287,10 @@
     elpaBuild {
       pname = "scala-mode";
       ename = "scala-mode";
-      version = "1.1.0.0.20240729.42046";
+      version = "1.1.1.0.20241231.83915";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/scala-mode-1.1.0.0.20240729.42046.tar";
-        sha256 = "0981n96zx633iypwyz2f6af7r1lzx0lick7zv0azqglrwgnly35r";
+        url = "https://elpa.nongnu.org/nongnu-devel/scala-mode-1.1.1.0.20241231.83915.tar";
+        sha256 = "079w6awnk36h33fz4gsqcnc3llsfmv1pmwzqyy8vv27x65i9fxjs";
       };
       packageRequires = [ ];
       meta = {
@@ -4351,10 +4393,10 @@
     elpaBuild {
       pname = "slime";
       ename = "slime";
-      version = "2.31.0.20241201.210325";
+      version = "2.31snapshot0.20250101.45918";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/slime-2.31.0.20241201.210325.tar";
-        sha256 = "05skikmrfcwbahph8z50kf1zh5vps7459zw7l1bipgyvhfvpq9fn";
+        url = "https://elpa.nongnu.org/nongnu-devel/slime-2.31snapshot0.20250101.45918.tar";
+        sha256 = "153phs96ibjap5hp0ffs9c9isdhc05vgdqr4hlhjyk62b71n71k4";
       };
       packageRequires = [ macrostep ];
       meta = {
@@ -4386,6 +4428,7 @@
   ) { };
   smartparens = callPackage (
     {
+      dash,
       elpaBuild,
       fetchurl,
       lib,
@@ -4393,12 +4436,12 @@
     elpaBuild {
       pname = "smartparens";
       ename = "smartparens";
-      version = "1.11.0.0.20240713.100215";
+      version = "1.11.0.0.20241220.125445";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/smartparens-1.11.0.0.20240713.100215.tar";
-        sha256 = "0479n363cz4izdxdl2420fcmngbfjp7a5xv9xlxyab62aph63f0w";
+        url = "https://elpa.nongnu.org/nongnu-devel/smartparens-1.11.0.0.20241220.125445.tar";
+        sha256 = "0ww5m3cj78abbpfrshbszgs21mnd6pfcpwrbnqz81a4qk37q3nny";
       };
-      packageRequires = [ ];
+      packageRequires = [ dash ];
       meta = {
         homepage = "https://elpa.nongnu.org/nongnu-devel/smartparens.html";
         license = lib.licenses.free;
@@ -4540,10 +4583,10 @@
     elpaBuild {
       pname = "subed";
       ename = "subed";
-      version = "1.2.21.0.20241117.83905";
+      version = "1.2.23.0.20250101.141954";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/subed-1.2.21.0.20241117.83905.tar";
-        sha256 = "0v95g129yp9s3kknbw1fp4iqn0f0g65bhvw4433v3dbinw9l3k74";
+        url = "https://elpa.nongnu.org/nongnu-devel/subed-1.2.23.0.20250101.141954.tar";
+        sha256 = "1srh30xxx7s4y79rc6fkq3aggywvnkd1wrhbmidhqd3lkfw3f1ms";
       };
       packageRequires = [ ];
       meta = {
@@ -4804,10 +4847,10 @@
     elpaBuild {
       pname = "tp";
       ename = "tp";
-      version = "0.6.0.20241031.72940";
+      version = "0.6.0.20250103.142809";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/tp-0.6.0.20241031.72940.tar";
-        sha256 = "1m8qhar75cglg8qjh3sbgwkzkhfp3640nm73nddxrshnajn978bf";
+        url = "https://elpa.nongnu.org/nongnu-devel/tp-0.6.0.20250103.142809.tar";
+        sha256 = "19mrjhi7qxwxp1shqqvkpmj49kari9g74wym3v2k80586kj2j0cm";
       };
       packageRequires = [ transient ];
       meta = {
@@ -4931,10 +4974,10 @@
     elpaBuild {
       pname = "undo-fu";
       ename = "undo-fu";
-      version = "0.5.0.20240707.141050";
+      version = "0.5.0.20241206.21950";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/undo-fu-0.5.0.20240707.141050.tar";
-        sha256 = "0glgy1manfv9rykkxhafc969mhazd119zgrkm5fg9shcyb7q629a";
+        url = "https://elpa.nongnu.org/nongnu-devel/undo-fu-0.5.0.20241206.21950.tar";
+        sha256 = "0kslql79g5y0sszjm6xxyxjzrnskm70dgglwwl2g4a1rjwavcp3v";
       };
       packageRequires = [ ];
       meta = {
@@ -4952,10 +4995,10 @@
     elpaBuild {
       pname = "undo-fu-session";
       ename = "undo-fu-session";
-      version = "0.7.0.20240713.142701";
+      version = "0.7.0.20241212.4030";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/undo-fu-session-0.7.0.20240713.142701.tar";
-        sha256 = "1c70cvf9f1x96l8gxfl4qpljwsqsqjcn745srsf9w9mcz520fyaa";
+        url = "https://elpa.nongnu.org/nongnu-devel/undo-fu-session-0.7.0.20241212.4030.tar";
+        sha256 = "1nggzbk1xi0w5f5y2xkp2jk4imfbqfaldngavslz1rhskiqwdqqa";
       };
       packageRequires = [ ];
       meta = {
@@ -5062,10 +5105,10 @@
     elpaBuild {
       pname = "web-mode";
       ename = "web-mode";
-      version = "17.3.20.0.20240804.82110";
+      version = "17.3.21.0.20241227.53016";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/web-mode-17.3.20.0.20240804.82110.tar";
-        sha256 = "17r0jhcgxnc1k42yxaw1i7wwyb0sp311a1gz8bdjax0zn05ki4xc";
+        url = "https://elpa.nongnu.org/nongnu-devel/web-mode-17.3.21.0.20241227.53016.tar";
+        sha256 = "0syhyqryfh2rvf2688rqfs3j0p0fh794vw85qwdh3kxi57w8ra8h";
       };
       packageRequires = [ ];
       meta = {
@@ -5130,10 +5173,10 @@
     elpaBuild {
       pname = "wgrep";
       ename = "wgrep";
-      version = "3.0.0.0.20231216.120954";
+      version = "3.0.0.0.20241206.130617";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/wgrep-3.0.0.0.20231216.120954.tar";
-        sha256 = "1qadyl29a70d9m5z32s0r18rjxg0jdmbpjr47zgvppl807mfni85";
+        url = "https://elpa.nongnu.org/nongnu-devel/wgrep-3.0.0.0.20241206.130617.tar";
+        sha256 = "1ihwqz865wcdb83aw6nmzhnkrf7rnxqkcncmz7rvzddsrg19hahr";
       };
       packageRequires = [ ];
       meta = {
@@ -5283,10 +5326,10 @@
     elpaBuild {
       pname = "xah-fly-keys";
       ename = "xah-fly-keys";
-      version = "26.8.20241118173945.0.20241118.174137";
+      version = "26.9.20241225173150.0.20241225.173444";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/xah-fly-keys-26.8.20241118173945.0.20241118.174137.tar";
-        sha256 = "196hv8hjzp87b8y9k65w2zag46bx2jhmah1w9mdjxwkfbq6bjcmq";
+        url = "https://elpa.nongnu.org/nongnu-devel/xah-fly-keys-26.9.20241225173150.0.20241225.173444.tar";
+        sha256 = "08c168kcb0ds9g8hfqwd4qnymmg7z32k3g51ap9rqw6048cyl5fw";
       };
       packageRequires = [ ];
       meta = {
@@ -5369,10 +5412,10 @@
     elpaBuild {
       pname = "yasnippet-snippets";
       ename = "yasnippet-snippets";
-      version = "1.0.0.20241014.94920";
+      version = "1.0.0.20241207.222105";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/yasnippet-snippets-1.0.0.20241014.94920.tar";
-        sha256 = "065wcvb295dhyi6jvb80vagzb8idqycchqgy32pj0fr6vcxx7y88";
+        url = "https://elpa.nongnu.org/nongnu-devel/yasnippet-snippets-1.0.0.20241207.222105.tar";
+        sha256 = "1nd9cnnwqrxizfzqdx3a4l9wj5sdr6gg42fss9dngbd22spa3kkb";
       };
       packageRequires = [ yasnippet ];
       meta = {

pkgs/applications/editors/emacs/elisp-packages/nongnu-generated.nix

@@ -220,10 +220,10 @@
     elpaBuild {
       pname = "auto-dim-other-buffers";
       ename = "auto-dim-other-buffers";
-      version = "2.1.1";
+      version = "2.2.1";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/auto-dim-other-buffers-2.1.1.tar";
-        sha256 = "0rgf0q66kdw9ind5bi01ydk84rclcd3kmlfzm9rfb429xnhqfzw8";
+        url = "https://elpa.nongnu.org/nongnu/auto-dim-other-buffers-2.2.1.tar";
+        sha256 = "00x0niv1zd47b2xl19k3fi0xxskdndiabns107cxzwb7pnkp4f0m";
       };
       packageRequires = [ ];
       meta = {
@@ -284,10 +284,10 @@
     elpaBuild {
       pname = "bash-completion";
       ename = "bash-completion";
-      version = "3.1.1";
+      version = "3.2";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/bash-completion-3.1.1.tar";
-        sha256 = "1yc1a5cvmnp8dranrglpd7qjg35r6x4ndniinbmzinqr7dmydh62";
+        url = "https://elpa.nongnu.org/nongnu/bash-completion-3.2.tar";
+        sha256 = "19xpv87nb1gskfsfqj8hmhbzlhxk0m6dflizsnrq94bh7rbw3s12";
       };
       packageRequires = [ ];
       meta = {
@@ -1031,10 +1031,10 @@
     elpaBuild {
       pname = "dslide";
       ename = "dslide";
-      version = "0.5.5";
+      version = "0.6.2";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/dslide-0.5.5.tar";
-        sha256 = "1hnmnl6ildr2cyc8hx1maa3vnz621d41yhsx8naxq3mssz4rkajp";
+        url = "https://elpa.nongnu.org/nongnu/dslide-0.6.2.tar";
+        sha256 = "02lny7c7v6345nlprmpi39pyk7m9lpr85g8xkd70ivkpc122qdy2";
       };
       packageRequires = [ ];
       meta = {
@@ -1108,6 +1108,48 @@
       };
     }
   ) { };
+  eglot-inactive-regions = callPackage (
+    {
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "eglot-inactive-regions";
+      ename = "eglot-inactive-regions";
+      version = "0.6.3";
+      src = fetchurl {
+        url = "https://elpa.nongnu.org/nongnu/eglot-inactive-regions-0.6.3.tar";
+        sha256 = "03958dgr48zqak06qjqdz6qgfxn5rs60425qcvb7wdv2jb4400hc";
+      };
+      packageRequires = [ ];
+      meta = {
+        homepage = "https://elpa.nongnu.org/nongnu/eglot-inactive-regions.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
+  eldoc-diffstat = callPackage (
+    {
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "eldoc-diffstat";
+      ename = "eldoc-diffstat";
+      version = "1.0";
+      src = fetchurl {
+        url = "https://elpa.nongnu.org/nongnu/eldoc-diffstat-1.0.tar";
+        sha256 = "0cxmhi1whzh4z62vv1pyvl2v6wr0jbq560m6zib8zicvdfxqlpgk";
+      };
+      packageRequires = [ ];
+      meta = {
+        homepage = "https://elpa.nongnu.org/nongnu/eldoc-diffstat.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   elixir-mode = callPackage (
     {
       elpaBuild,
@@ -1425,10 +1467,10 @@
     elpaBuild {
       pname = "evil-matchit";
       ename = "evil-matchit";
-      version = "3.0.4";
+      version = "4.0.1";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/evil-matchit-3.0.4.tar";
-        sha256 = "1ib2xlz7ciaszw2j5184mf6560jmap93vh515sk8dmkkahdwsjgz";
+        url = "https://elpa.nongnu.org/nongnu/evil-matchit-4.0.1.tar";
+        sha256 = "08vnf56zmqicfjwf7ihlmg9iil3bivhwpafq8vwlvp5nkmirhivv";
       };
       packageRequires = [ ];
       meta = {
@@ -2107,10 +2149,10 @@
     elpaBuild {
       pname = "gnosis";
       ename = "gnosis";
-      version = "0.4.8";
+      version = "0.4.10";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/gnosis-0.4.8.tar";
-        sha256 = "1sf6213qj6i306rqbp1a5wj7haw5vkmc1684fdfqzyqa1gw2ni5v";
+        url = "https://elpa.nongnu.org/nongnu/gnosis-0.4.10.tar";
+        sha256 = "16z0f93x8x4ldyld2aqpprmk6xqz4qnd5fbrclcvj8gcg6qj4iz8";
       };
       packageRequires = [
         compat
@@ -2281,10 +2323,10 @@
     elpaBuild {
       pname = "gptel";
       ename = "gptel";
-      version = "0.9.6";
+      version = "0.9.7";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/gptel-0.9.6.tar";
-        sha256 = "0n7d8plabgmpyl224079cqrwlgqq7wwysba0wd0ry75h6z388rcb";
+        url = "https://elpa.nongnu.org/nongnu/gptel-0.9.7.tar";
+        sha256 = "0sh8q80q620d6yr4437ddrjrzygd15iwkc9jvwh3pw9sncv2laqn";
       };
       packageRequires = [
         compat
@@ -2635,10 +2677,10 @@
     elpaBuild {
       pname = "hyperdrive";
       ename = "hyperdrive";
-      version = "0.4.2";
+      version = "0.5.2";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/hyperdrive-0.4.2.tar";
-        sha256 = "19cgx0x54xj2z98m8mr1xmz0bbja0nilh8n47mkbnzmcqidv75gq";
+        url = "https://elpa.nongnu.org/nongnu/hyperdrive-0.5.2.tar";
+        sha256 = "1gn6kdxvds27bjfsamzihqg8bddwsyfmc2g36p50km2qfa8fgpvz";
       };
       packageRequires = [
         compat
@@ -2911,10 +2953,10 @@
     elpaBuild {
       pname = "julia-mode";
       ename = "julia-mode";
-      version = "1.0.1";
+      version = "1.0.2";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/julia-mode-1.0.1.tar";
-        sha256 = "0203h99yia5k37ansy2wshkiyn105jaahmkm0ncf54far8dw6mwx";
+        url = "https://elpa.nongnu.org/nongnu/julia-mode-1.0.2.tar";
+        sha256 = "1wwnyanxbpzy4n8n3ixafdbx7badkl1krcnk0yf5923f2ahiqhlr";
       };
       packageRequires = [ ];
       meta = {
@@ -3049,10 +3091,10 @@
     elpaBuild {
       pname = "magit";
       ename = "magit";
-      version = "4.1.2";
+      version = "4.2.0";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/magit-4.1.2.tar";
-        sha256 = "1jyivrk78fnp7kcrac9sm2ldbxg9c96qhnlz06wv1m7hbvd3fgfx";
+        url = "https://elpa.nongnu.org/nongnu/magit-4.2.0.tar";
+        sha256 = "04nf4ff7a11z65mcw6qnkxwk9srpi248f1k0li947i4264gl3prd";
       };
       packageRequires = [
         compat
@@ -3080,10 +3122,10 @@
     elpaBuild {
       pname = "magit-section";
       ename = "magit-section";
-      version = "4.1.2";
+      version = "4.2.0";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/magit-section-4.1.2.tar";
-        sha256 = "0g24aj030fh55y44f3c33708fbm02jwzggh75zvg63bka3g6j242";
+        url = "https://elpa.nongnu.org/nongnu/magit-section-4.2.0.tar";
+        sha256 = "05wlc327x45vfsphwz9bf1hl8w46ychqkp6j7wsngjzwzsifxmb4";
       };
       packageRequires = [
         compat
@@ -3129,10 +3171,10 @@
     elpaBuild {
       pname = "mastodon";
       ename = "mastodon";
-      version = "1.1.7";
+      version = "1.1.8";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/mastodon-1.1.7.tar";
-        sha256 = "0qnkbab6y0gpqq0kvil4gnbajflpv0mz3pzcimcvz79dnmb0vc9p";
+        url = "https://elpa.nongnu.org/nongnu/mastodon-1.1.8.tar";
+        sha256 = "06jy1n7ikz4xdpw4rkma596pqgkxcmh7qfkz93584rjfqav88anl";
       };
       packageRequires = [
         persist
@@ -4031,10 +4073,10 @@
     elpaBuild {
       pname = "racket-mode";
       ename = "racket-mode";
-      version = "1.0.20241129.85359";
+      version = "1.0.20250103.151851";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/racket-mode-1.0.20241129.85359.tar";
-        sha256 = "0ish7ysdqypw849k9d3cw0bl69r5ksc3hrqdmyh8k2ipq2xbcn2w";
+        url = "https://elpa.nongnu.org/nongnu/racket-mode-1.0.20250103.151851.tar";
+        sha256 = "11m25729hm7m5srjiys1ws070yi2aa7ni5rn240w9290nj1brjnb";
       };
       packageRequires = [ ];
       meta = {
@@ -4243,10 +4285,10 @@
     elpaBuild {
       pname = "scad-mode";
       ename = "scad-mode";
-      version = "94.0";
+      version = "95.0";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/scad-mode-94.0.tar";
-        sha256 = "1cqai7qb9m17rf7llkn9vbxddgn0ixcf3dbnsjk1aflvj8mq9nr3";
+        url = "https://elpa.nongnu.org/nongnu/scad-mode-95.0.tar";
+        sha256 = "1wkpgrkx3cjmh72qg9yiq2x9sqswx6x6pbr8zzhldyjs6kmjl7km";
       };
       packageRequires = [ compat ];
       meta = {
@@ -4264,10 +4306,10 @@
     elpaBuild {
       pname = "scala-mode";
       ename = "scala-mode";
-      version = "1.1.0";
+      version = "1.1.1";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/scala-mode-1.1.0.tar";
-        sha256 = "1x3vw4fzy1z6gavnbsm4lnwzkp47zd8gasvxxvfk57qn09hpwixh";
+        url = "https://elpa.nongnu.org/nongnu/scala-mode-1.1.1.tar";
+        sha256 = "1dmaq00432smrwqx6ybw855vdwp7s8h358c135ji5d581mkhpai5";
       };
       packageRequires = [ ];
       meta = {
@@ -4559,10 +4601,10 @@
     elpaBuild {
       pname = "subed";
       ename = "subed";
-      version = "1.2.21";
+      version = "1.2.23";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/subed-1.2.21.tar";
-        sha256 = "1d0w96amchcpblcbkl16yiwsvj8qfpax66ysjg02550lhpb493x7";
+        url = "https://elpa.nongnu.org/nongnu/subed-1.2.23.tar";
+        sha256 = "0bvsv688mqhga8dffy3841wxs5pkw0vish15dgligll47cj98mzp";
       };
       packageRequires = [ ];
       meta = {
@@ -5056,10 +5098,10 @@
     elpaBuild {
       pname = "web-mode";
       ename = "web-mode";
-      version = "17.3.20";
+      version = "17.3.21";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/web-mode-17.3.20.tar";
-        sha256 = "1l4bmvc53ma2n3y143k86ip0w4am65zwxnl36lzqavs1hr55qvb2";
+        url = "https://elpa.nongnu.org/nongnu/web-mode-17.3.21.tar";
+        sha256 = "0yqaszrkllfgp0ph7rvjhz35wqzi4bas0qw70d49vaxq4z7bikzg";
       };
       packageRequires = [ ];
       meta = {
@@ -5277,10 +5319,10 @@
     elpaBuild {
       pname = "xah-fly-keys";
       ename = "xah-fly-keys";
-      version = "26.8.20241118173945";
+      version = "26.9.20241225173150";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/xah-fly-keys-26.8.20241118173945.tar";
-        sha256 = "1l6wwv1zmpsf64v23zzi2idjb14wnbpv5fcspiygiah62zag44vf";
+        url = "https://elpa.nongnu.org/nongnu/xah-fly-keys-26.9.20241225173150.tar";
+        sha256 = "0b2pjrfa130n4bam80p676k3xz417d6dfn8921xh6msf8b14cwpv";
       };
       packageRequires = [ ];
       meta = {

pkgs/applications/editors/vim/common.nix

@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.0905";
+  version = "9.1.0990";
 
   outputs = [
     "out"
@@ -11,7 +11,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-sFsTONGeSocn1M8NZo5LjIhagmq/nR1zrGRN7p86Q4o=";
+    hash = "sha256-KKjJCuGczwYP+NVx5f6YQRsKR0zW44ciNNvmjQ03ytM=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/emulators/wine/builder-wow.sh

@@ -1,6 +1,4 @@
 ## build described at https://wiki.winehq.org/Building_Wine#Shared_WoW64
-
-source $stdenv/setup
 preFlags="${configureFlags}"
 
 unpackPhase

pkgs/applications/misc/prusa-slicer/default.nix

@@ -6,8 +6,7 @@
 , cmake
 , pkg-config
 , wrapGAppsHook3
-, boost
-, boost183
+, boost186
 , cereal
 , cgal
 , curl
@@ -72,14 +71,6 @@ let
 
   patches = [
   ];
-
-  # Build requires at least Boost v1.83.  If the mainline package satisfies
-  # that, just use the mainline package, otherwise use an explicitly versioned
-  # package.
-  boost183OrBetter =
-    if lib.versionAtLeast boost.version "1.83"
-    then boost
-    else boost183;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "prusa-slicer";
@@ -111,7 +102,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     binutils
-    boost183OrBetter
+    boost186  # does not build with 1.87, see https://github.com/prusa3d/PrusaSlicer/issues/13799
     cereal
     cgal
     curl

pkgs/applications/networking/sync/rsync/configure.ac-fix-failing-IPv6-check.patch

@@ -1,12 +0,0 @@
-diff -rup rsync-3.2.7/configure.sh rsync-3.2.7-fixed/configure.sh
---- rsync-3.2.7/configure.sh	2022-10-20 17:57:22
-+++ rsync-3.2.7-fixed/configure.sh	2024-01-01 19:51:58
-@@ -7706,7 +7706,7 @@ else $as_nop
- #include <stdlib.h>
- #include <sys/types.h>
- #include <sys/socket.h>
--main()
-+int main()
- {
-    if (socket(AF_INET6, SOCK_STREAM, 0) < 0)
-      exit(1);

pkgs/applications/networking/sync/rsync/default.nix

@@ -22,12 +22,12 @@
 
 stdenv.mkDerivation rec {
   pname = "rsync";
-  version = "3.3.0";
+  version = "3.4.1";
 
   src = fetchurl {
-    # signed with key 0048 C8B0 26D4 C96F 0E58  9C2F 6C85 9FB1 4B96 A8C5
+    # signed with key 9FEF 112D CE19 A0DC 7E88  2CB8 1BB2 4997 A853 5F6F
     url = "mirror://samba/rsync/src/rsync-${version}.tar.gz";
-    hash = "sha256-c5nppnCMMtZ4pypjIZ6W8jvgviM25Q/RNISY0HBB35A=";
+    hash = "sha256-KSS8s6Hti1UfwQH3QLnw/gogKxFQJ2R89phQ1l/YjFI=";
   };
 
   nativeBuildInputs = [
@@ -35,23 +35,6 @@ stdenv.mkDerivation rec {
     perl
   ];
 
-  patches = [
-    # https://github.com/WayneD/rsync/pull/558
-    ./configure.ac-fix-failing-IPv6-check.patch
-    ./CVE-2024-12084/0001-Some-checksum-buffer-fixes.patch
-    ./CVE-2024-12084/0002-Another-cast-when-multiplying-integers.patch
-    ./CVE-2024-12085/0001-prevent-information-leak-off-the-stack.patch
-    ./CVE-2024-12086/0001-refuse-fuzzy-options-when-fuzzy-not-selected.patch
-    ./CVE-2024-12086/0002-added-secure_relative_open.patch
-    ./CVE-2024-12086/0003-receiver-use-secure_relative_open-for-basis-file.patch
-    ./CVE-2024-12086/0004-disallow-.-elements-in-relpath-for-secure_relative_o.patch
-    ./CVE-2024-12087/0001-Refuse-a-duplicate-dirlist.patch
-    ./CVE-2024-12087/0002-range-check-dir_ndx-before-use.patch
-    ./CVE-2024-12088/0001-make-safe-links-stricter.patch
-    ./CVE-2024-12747/0001-fixed-symlink-race-condition-in-sender.patch
-    ./raise-protocol-version-to-32.patch
-  ];
-
   buildInputs =
     [
       libiconv

pkgs/applications/radio/uhd/default.nix

@@ -1,6 +1,8 @@
 {
   lib,
   stdenv,
+  substitute,
+  fetchpatch,
   fetchurl,
   fetchFromGitHub,
   cmake,
@@ -180,6 +182,23 @@ stdenv.mkDerivation (finalAttrs: {
   # Build only the host software
   preConfigure = "cd host";
   patches = [
+    # fix for boost 187 remove on next update
+    (substitute {
+      src = fetchpatch {
+        name = "boost-187.patch";
+        url = "https://github.com/EttusResearch/uhd/commit/adfe953d965e58b5931c1b1968899492c8087cf6.patch";
+        hash = "sha256-qzxe6QhGoyBul7YjCiPJfeP+3dIoo1hh2sjgYmc9IiI=";
+      };
+      # The last two hunks in client.cc will fail without these substitutions
+      substitutions = [
+        "--replace-fail"
+        "[buffer, idx, func_name, p, this]"
+        "[=]"
+        "--replace-fail"
+        "[buffer, this]"
+        "[=]"
+      ];
+    })
     # Disable tests that fail in the sandbox, last checked at version 4.6.0.0
     ./no-adapter-tests.patch
   ];

pkgs/applications/version-management/git/default.nix

@@ -30,7 +30,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.47.0";
+  version = "2.47.1";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    hash = "sha256-HOEU2ohwQnG0PgJ8UeBNk5n4yI6e91Qtrnrrrn2HvE4=";
+    hash = "sha256-89j5uyOuOSN06RzZ05WXDavFucXucvOYhGE82Epu0xA=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";

pkgs/applications/version-management/mercurial/default.nix

@@ -39,11 +39,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.8.2";
+    version = "6.9";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      hash = "sha256-qsYYEGdorR7ZdsP+fIZZ/smebwtTN+pupVT66EkMT04=";
+      hash = "sha256-YpYEKT3yvoFx7IVr9Pi0+qjkMFrxNgfc4PifdBMoNtY=";
     };
 
     format = "other";
@@ -55,7 +55,7 @@ let
         rustPlatform.fetchCargoTarball {
           inherit src;
           name = "mercurial-${version}";
-          hash = "sha256-/HjgGtjKfLLufEqyT7xHYIlC5xnVunYoA+H1xLS1bVw=";
+          hash = "sha256-E8Q0hMLPLkUZ5W5iqe4w5t/71HQuRBTF3SRUBN8EMik=";
           sourceRoot = "mercurial-${version}/rust";
         }
       else

pkgs/build-support/appimage/appimage-exec.sh

@@ -1,4 +1,4 @@
-#!@shell@
+#!@runtimeShell@
 # shellcheck shell=bash
 
 if [ -n "$DEBUG" ] ; then

pkgs/build-support/appimage/default.nix

@@ -11,19 +11,22 @@
 }:
 
 rec {
-  appimage-exec = pkgs.substituteAll {
+  appimage-exec = pkgs.replaceVarsWith {
     src = ./appimage-exec.sh;
     isExecutable = true;
     dir = "bin";
-    path = lib.makeBinPath [
-      bash
-      binutils-unwrapped
-      coreutils
-      gawk
-      libarchive
-      pv
-      squashfsTools
-    ];
+    replacements = {
+      inherit (pkgs) runtimeShell;
+      path = lib.makeBinPath [
+        bash
+        binutils-unwrapped
+        coreutils
+        gawk
+        libarchive
+        pv
+        squashfsTools
+      ];
+    };
   };
 
   extract = args@{ pname, version, name ? null, postExtract ? "", src, ... }:

pkgs/build-support/bintools-wrapper/default.nix

@@ -348,7 +348,7 @@ stdenvNoCC.mkDerivation {
     ##
 
     # TODO(@sternenseemann): make a generic strip wrapper?
-    + optionalString (bintools.isGNU or false || bintools.isCCTools or false) ''
+    + optionalString (bintools.isGNU or false || bintools.isLLVM or false || bintools.isCCTools or false) ''
       wrap ${targetPrefix}strip ${./gnu-binutils-strip-wrapper.sh} \
         "${bintools_bin}/bin/${targetPrefix}strip"
     ''

pkgs/build-support/bintools-wrapper/ld-wrapper.sh

@@ -237,6 +237,11 @@ if [ "$NIX_SET_BUILD_ID_@suffixSalt@" = 1 ] && ! (( "$relocatable" )); then
     extraAfter+=(--build-id="${NIX_BUILD_ID_STYLE:-sha1}")
 fi
 
+# if a ld-wrapper-hook exists, run it.
+if [[ -e @out@/nix-support/ld-wrapper-hook ]]; then
+    linker=@prog@
+    source @out@/nix-support/ld-wrapper-hook
+fi
 
 # Optionally print debug info.
 if (( "${NIX_DEBUG:-0}" >= 1 )); then

pkgs/build-support/buildenv/builder.pl

@@ -1,6 +1,7 @@
 #! @perl@ -w
 
 use strict;
+use feature 'signatures';
 use Cwd 'abs_path';
 use IO::Handle;
 use File::Path;
@@ -18,8 +19,7 @@ my $extraPrefix = $ENV{"extraPrefix"};
 
 my @pathsToLink = split ' ', $ENV{"pathsToLink"};
 
-sub isInPathsToLink {
-    my $path = shift;
+sub isInPathsToLink($path) {
     $path = "/" if $path eq "";
     foreach my $elem (@pathsToLink) {
         return 1 if
@@ -32,8 +32,7 @@ sub isInPathsToLink {
 
 # Returns whether a path in one of the linked packages may contain
 # files in one of the elements of pathsToLink.
-sub hasPathsToLink {
-    my $path = shift;
+sub hasPathsToLink($path) {
     foreach my $elem (@pathsToLink) {
         return 1 if
             $path eq "" ||
@@ -44,8 +43,7 @@ sub hasPathsToLink {
 }
 
 # Similar to `lib.isStorePath`
-sub isStorePath {
-    my $path = shift;
+sub isStorePath($path) {
     my $storePath = "@storeDir@";
 
     return substr($path, 0, 1) eq "/" && dirname($path) eq $storePath;
@@ -76,22 +74,18 @@ for my $p (@pathsToLink) {
 
 sub findFiles;
 
-sub findFilesInDir {
-    my ($relName, $target, $ignoreCollisions, $ignoreSingleFileOutputs, $checkCollisionContents, $priority) = @_;
-
+sub findFilesInDir($relName, $target, $ignoreCollisions, $checkCollisionContents, $priority, $ignoreSingleFileOutputs) {
     opendir DIR, "$target" or die "cannot open `$target': $!";
     my @names = readdir DIR or die;
     closedir DIR;
 
     foreach my $name (@names) {
         next if $name eq "." || $name eq "..";
-        findFiles("$relName/$name", "$target/$name", $name, $ignoreCollisions, $ignoreSingleFileOutputs, $checkCollisionContents, $priority);
+        findFiles("$relName/$name", "$target/$name", $name, $ignoreCollisions, $checkCollisionContents, $priority, $ignoreSingleFileOutputs);
     }
 }
 
-sub checkCollision {
-    my ($path1, $path2) = @_;
-
+sub checkCollision($path1, $path2) {
     if (! -e $path1 || ! -e $path2) {
         return 0;
     }
@@ -109,14 +103,11 @@ sub checkCollision {
     return compare($path1, $path2) == 0;
 }
 
-sub prependDangling {
-    my $path = shift;
+sub prependDangling($path) {
     return (-l $path && ! -e $path ? "dangling symlink " : "") . "`$path'";
 }
 
-sub findFiles {
-    my ($relName, $target, $baseName, $ignoreCollisions, $ignoreSingleFileOutputs, $checkCollisionContents, $priority) = @_;
-
+sub findFiles($relName, $target, $baseName, $ignoreCollisions, $checkCollisionContents, $priority, $ignoreSingleFileOutputs) {
     # The store path must not be a file when not ignoreSingleFileOutputs
     if (-f $target && isStorePath $target) {
         if ($ignoreSingleFileOutputs) {
@@ -193,8 +184,8 @@ sub findFiles {
         }
     }
 
-    findFilesInDir($relName, $oldTarget, $ignoreCollisions, $ignoreSingleFileOutputs, $checkCollisionContents, $oldPriority) unless $oldTarget eq "";
-    findFilesInDir($relName, $target, $ignoreCollisions, $ignoreSingleFileOutputs, $checkCollisionContents, $priority);
+    findFilesInDir($relName, $oldTarget, $ignoreCollisions, $checkCollisionContents, $oldPriority, $ignoreSingleFileOutputs) unless $oldTarget eq "";
+    findFilesInDir($relName, $target, $ignoreCollisions, $checkCollisionContents, $priority, $ignoreSingleFileOutputs);
 
     $symlinks{$relName} = ["", $priority]; # denotes directory
 }
@@ -203,13 +194,11 @@ sub findFiles {
 my %done;
 my %postponed;
 
-sub addPkg {
-    my ($pkgDir, $ignoreCollisions, $ignoreSingleFileOutputs, $checkCollisionContents, $priority)  = @_;
-
+sub addPkg($pkgDir, $ignoreCollisions, $checkCollisionContents, $priority, $ignoreSingleFileOutputs) {
     return if (defined $done{$pkgDir});
     $done{$pkgDir} = 1;
 
-    findFiles("", $pkgDir, "", $ignoreCollisions, $ignoreSingleFileOutputs, $checkCollisionContents, $priority);
+    findFiles("", $pkgDir, "", $ignoreCollisions, $checkCollisionContents, $priority, $ignoreSingleFileOutputs);
 
     my $propagatedFN = "$pkgDir/nix-support/propagated-user-env-packages";
     if (-e $propagatedFN) {
@@ -240,9 +229,9 @@ for my $pkg (@{decode_json $pkgs}) {
     for my $path (@{$pkg->{paths}}) {
         addPkg($path,
                $ENV{"ignoreCollisions"} eq "1",
-               $ENV{"ignoreSingleFileOutputs"} eq "1",
                $ENV{"checkCollisionContents"} eq "1",
-               $pkg->{priority})
+               $pkg->{priority},
+               $ENV{"ignoreSingleFileOutputs"} eq "1")
            if -e $path;
     }
 }
@@ -257,7 +246,7 @@ while (scalar(keys %postponed) > 0) {
     my @pkgDirs = keys %postponed;
     %postponed = ();
     foreach my $pkgDir (sort @pkgDirs) {
-        addPkg($pkgDir, 2, $ENV{"ignoreSingleFileOutputs"} eq "1", $ENV{"checkCollisionContents"} eq "1", $priorityCounter++);
+        addPkg($pkgDir, 2, $ENV{"checkCollisionContents"} eq "1", $priorityCounter++, $ENV{"ignoreSingleFileOutputs"} eq "1");
     }
 }
 
@@ -269,9 +258,9 @@ if ($extraPathsFilePath) {
         chomp $line;
         addPkg($line,
                $ENV{"ignoreCollisions"} eq "1",
-               $ENV{"ignoreSingleFileOutputs"} eq "1",
                $ENV{"checkCollisionContents"} eq "1",
-               1000)
+               1000,
+               $ENV{"ignoreSingleFileOutputs"} eq "1")
             if -d $line;
     }
 

pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh

@@ -2,7 +2,11 @@ needsTarget=true
 
 for p in "${params[@]}"; do
     case "$p" in
-    -target | --target=*) needsTarget=false ;;
+    -target | --target=*)
+        needsTarget=false
+
+        echo "Warning: supplying the --target argument to a nix-wrapped compiler may not work correctly - cc-wrapper is currently not designed with multi-target compilers in mind. You may want to use an un-wrapped compiler instead." >&2
+        ;;
     esac
 done
 

pkgs/build-support/cc-wrapper/cc-wrapper.sh

@@ -131,7 +131,7 @@ if [ "$NIX_ENFORCE_NO_NATIVE_@suffixSalt@" = 1 ]; then
     # Old bash empty array hack
     for p in ${params+"${params[@]}"}; do
         if [[ "$p" = -m*=native ]]; then
-            skip "$p"
+            >&2 echo "warning: Skipping impure flag $p because NIX_ENFORCE_NO_NATIVE is set"
         else
             kept+=("$p")
         fi
@@ -232,6 +232,12 @@ if [[ "${#positionalArgs[@]}" -gt 0 ]]; then
     extraAfter+=(-- "${positionalArgs[@]}")
 fi
 
+# if a cc-wrapper-hook exists, run it.
+if [[ -e @out@/nix-support/cc-wrapper-hook ]]; then
+    compiler=@prog@
+    source @out@/nix-support/cc-wrapper-hook
+fi
+
 # Optionally print debug info.
 if (( "${NIX_DEBUG:-0}" >= 1 )); then
     # Old bash workaround, see ld-wrapper for explanation.
@@ -246,12 +252,6 @@ fi
 PATH="$path_backup"
 # Old bash workaround, see above.
 
-# if a cc-wrapper-hook exists, run it.
-if [[ -e @out@/nix-support/cc-wrapper-hook ]]; then
-    compiler=@prog@
-    source @out@/nix-support/cc-wrapper-hook
-fi
-
 if (( "${NIX_CC_USE_RESPONSE_FILE:-@use_response_file_by_default@}" >= 1 )); then
     responseFile=$(@mktemp@ "${TMPDIR:-/tmp}/cc-params.XXXXXX")
     trap '@rm@ -f -- "$responseFile"' EXIT

pkgs/build-support/docker/default.nix

@@ -980,7 +980,8 @@ rec {
 
             mkdir $out
             ${if enableFakechroot then ''
-              proot -r $PWD/old_out ${bind-paths} --pwd=/ fakeroot bash -c '
+              proot -r $PWD/old_out ${bind-paths} --pwd=/ fakeroot bash -e -c '
+                if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; fi
                 source $stdenv/setup
                 eval "$fakeRootCommands"
                 tar \
@@ -994,7 +995,8 @@ rec {
                   -cf $out/layer.tar .
               '
             '' else ''
-              fakeroot bash -c '
+              fakeroot bash -e -c '
+                if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; fi
                 source $stdenv/setup
                 cd old_out
                 eval "$fakeRootCommands"

pkgs/build-support/dotnet/add-nuget-deps/default.nix

@@ -3,7 +3,7 @@
   runtimeShell,
   nix,
   lib,
-  substituteAll,
+  replaceVarsWith,
   nuget-to-nix,
   nixfmt-rfc-style,
   nuget-to-json,
@@ -84,15 +84,16 @@ attrs
         let
           drv = builtins.unsafeDiscardOutputDependency fetch-drv.drvPath;
 
-          innerScript = substituteAll {
+          innerScript = replaceVarsWith {
             src = ./fetch-deps.sh;
             isExecutable = true;
-            inherit cacert;
-            binPath = lib.makeBinPath [
-              nuget-to-nix
-              nixfmt-rfc-style
-              nuget-to-json
-            ];
+            replacements = {
+              binPath = lib.makeBinPath [
+                nuget-to-nix
+                nixfmt-rfc-style
+                nuget-to-json
+              ];
+            };
           };
 
           defaultDepsFile =

pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-fixup-hook.sh

@@ -97,5 +97,5 @@ dotnetFixupHook() {
 }
 
 if [[ -z "${dontFixup-}" && -z "${dontDotnetFixup-}" ]]; then
-    preFixupPhases+=" dotnetFixupHook"
+    appendToVar preFixupPhases dotnetFixupHook
 fi

pkgs/build-support/fetchbzr/builder.sh

@@ -1,6 +1,3 @@
-if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
-source "$stdenv/setup"
-
 echo "exporting \`$url' (revision $rev) into \`$out'"
 
 # Perform a lightweight checkout so that we don't end up importing

pkgs/build-support/fetchcvs/builder.sh

@@ -1,6 +1,3 @@
-if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
-source $stdenv/setup
-
 (echo "#!$SHELL"; \
  echo 'ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"') > ssh
 chmod +x ssh

pkgs/build-support/fetchdarcs/builder.sh

@@ -1,6 +1,3 @@
-if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
-source $stdenv/setup
-
 tagtext=""
 tagflags=""
 # Darcs hashes are sha1 (120 bits, 40-character hex)

pkgs/build-support/fetchdocker/fetchdocker-builder.sh

@@ -1,5 +1,3 @@
-if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
-source "${stdenv}/setup"
 echo "exporting ${repository}/${imageName} (tag: ${tag}) into ${out}"
 mkdir -p "${out}"
 

pkgs/build-support/fetchdocker/generic-fetcher.nix

@@ -35,7 +35,6 @@ in
 stdenv.mkDerivation {
   inherit name;
   builder = writeText "${fetcher}-builder.sh" ''
-    source "$stdenv/setup"
     echo "${fetcher} exporting to $out"
 
     declare -A creds

pkgs/build-support/fetchfirefoxaddon/default.nix

@@ -33,8 +33,6 @@ stdenv.mkDerivation {
   };
 
   builder = writeScript "xpibuilder" ''
-    source $stdenv/setup
-
     echo "firefox addon $name into $out"
 
     UUID="${extid}"

pkgs/build-support/fetchfossil/builder.sh

@@ -1,5 +1,3 @@
-if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
-source $stdenv/setup
 echo "Cloning Fossil $url [$rev] into $out"
 
 # Fossil, bless its adorable little heart, wants to write global configuration

pkgs/build-support/fetchgit/builder.sh

@@ -3,8 +3,6 @@
 # - revision specified and remote has a HEAD
 # - revision specified and remote without HEAD
 #
-if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
-source $stdenv/setup
 
 echo "exporting $url (rev $rev) into $out"
 

pkgs/build-support/fetchhg/builder.sh

@@ -1,5 +1,3 @@
-if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
-source $stdenv/setup
 echo "getting $url${rev:+ ($rev)} into $out"
 
 hg clone --insecure "$url" hg-clone

pkgs/build-support/fetchipfs/builder.sh

@@ -1,6 +1,3 @@
-if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
-source $stdenv/setup
-
 # Curl flags to handle redirects, not use EPSV, handle cookies for
 # servers to need them during redirects, and work on SSL without a
 # certificate (this isn't a security problem because we check the

pkgs/build-support/fetchmtn/builder.sh

@@ -1,6 +1,3 @@
-if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
-source $stdenv/setup
-
 set -x
 
 if ! [ -f "$cacheDB" ]; then

pkgs/build-support/fetchsvn/builder.sh

@@ -1,6 +1,3 @@
-if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
-source $stdenv/setup
-
 echo "exporting $url (r$rev) into $out"
 
 if test -n "$http_proxy"; then

pkgs/build-support/fetchsvnssh/builder.sh

@@ -1,6 +1,3 @@
-if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
-source $stdenv/setup
-
 echo "exporting $url (r$rev) into $out"
 
 if test "$sshSupport"; then

pkgs/build-support/fetchurl/builder.sh

@@ -1,6 +1,3 @@
-if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
-source $stdenv/setup
-
 source $mirrorsFile
 
 curlVersion=$(curl -V | head -1 | cut -d' ' -f2)

pkgs/build-support/fetchurl/write-mirror-list.sh

@@ -1,4 +1,2 @@
-source $stdenv/setup
-
 # !!! this is kinda hacky.
 set | grep -E '^[a-zA-Z]+=.*://' > $out

pkgs/build-support/go/module.nix

@@ -237,8 +237,8 @@ in
         local cmd="$1" dir="$2"
 
         declare -a flags
-        flags+=(''${tags:+-tags=''${tags// /,}})
-        flags+=(''${ldflags:+-ldflags="$ldflags"})
+        flags+=(''${tags:+-tags=$(concatStringsSep "," tags)})
+        flags+=(''${ldflags:+-ldflags="''${ldflags[*]}"})
         flags+=("-p" "$NIX_BUILD_CORES")
         if (( "''${NIX_DEBUG:-0}" >= 1 )); then
           flags+=(-x)
@@ -282,7 +282,7 @@ in
     '' + lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
       # normalize cross-compiled builds w.r.t. native builds
       (
-        dir=$GOPATH/bin/${go.GOOS}_${go.GOARCH}
+        dir=$GOPATH/bin/''${GOOS}_''${GOARCH}
         if [[ -n "$(shopt -s nullglob; echo $dir/*)" ]]; then
           mv $dir/* $dir/..
         fi

pkgs/build-support/kernel/make-initrd.sh

@@ -1,5 +1,3 @@
-source $stdenv/setup
-
 set -o pipefail
 
 objects=($objects)

pkgs/build-support/kernel/modules-closure.sh

@@ -1,5 +1,3 @@
-source $stdenv/setup
-
 # When no modules are built, the $out/lib/modules directory will not
 # exist. Because the rest of the script assumes it does exist, we
 # handle this special case first.

pkgs/build-support/node/fetch-npm-deps/src/main.rs

@@ -66,7 +66,7 @@ fn fixup_lockfile(
             {
                 if let Some(Value::String(resolved)) = package.get("resolved") {
                     if let Some(Value::String(integrity)) = package.get("integrity") {
-                        if resolved.starts_with("git+ssh://") {
+                        if resolved.starts_with("git+") {
                             fixed = true;
 
                             package

pkgs/build-support/replace-vars/default.nix

@@ -1,86 +0,0 @@
-{ lib, stdenvNoCC }:
-
-/**
-  `replaceVars` is a wrapper around the [bash function `substitute`](https://nixos.org/manual/nixpkgs/stable/#fun-substitute)
-  in the stdenv. It allows for terse replacement of names in the specified path, while checking
-  for common mistakes such as naming a replacement that does nothing or forgetting a variable which
-  needs to be replaced.
-
-  As with the [`--subst-var-by`](https://nixos.org/manual/nixpkgs/stable/#fun-substitute-subst-var-by)
-  flag, names are encoded as `@name@` in the provided file at the provided path.
-
-  Any unmatched variable names in the file at the provided path will cause a build failure.
-
-  By default, any remaining text that matches `@[A-Za-z_][0-9A-Za-z_'-]@` in the output after replacement
-  has occurred will cause a build failure. Variables can be excluded from this check by passing "null" for them.
-
-  # Inputs
-
-  `path` ([Store Path](https://nixos.org/manual/nix/latest/store/store-path.html#store-path) String)
-  : The file in which to replace variables.
-
-  `attrs` (AttrsOf String)
-  : Each entry in this set corresponds to a `--subst-var-by` entry in [`substitute`](https://nixos.org/manual/nixpkgs/stable/#fun-substitute) or
-    null to keep it unchanged.
-
-  # Example
-
-  ```nix
-  { replaceVars }:
-
-  replaceVars ./greeting.txt { world = "hello"; }
-  ```
-
-  See `../../test/replace-vars/default.nix` for tests of this function.
-*/
-path: attrs:
-
-let
-  # We use `--replace-fail` instead of `--subst-var-by` so that if the thing isn't there, we fail.
-  subst-var-by =
-    name: value:
-    lib.optionals (value != null) [
-      "--replace-fail"
-      (lib.escapeShellArg "@${name}@")
-      (lib.escapeShellArg value)
-    ];
-
-  replacements = lib.concatLists (lib.mapAttrsToList subst-var-by attrs);
-
-  left-overs = map ({ name, ... }: name) (
-    builtins.filter ({ value, ... }: value == null) (lib.attrsToList attrs)
-  );
-in
-
-stdenvNoCC.mkDerivation {
-  name = baseNameOf (toString path);
-  src = path;
-  doCheck = true;
-  dontUnpack = true;
-  preferLocalBuild = true;
-  allowSubstitutes = false;
-
-  buildPhase = ''
-    runHook preBuild
-    substitute "$src" "$out" ${lib.concatStringsSep " " replacements}
-    runHook postBuild
-  '';
-
-  # Look for Nix identifiers surrounded by `@` that aren't substituted.
-  checkPhase =
-    let
-      lookahead =
-        if builtins.length left-overs == 0 then "" else "(?!${builtins.concatStringsSep "|" left-overs}@)";
-      regex = lib.escapeShellArg "@${lookahead}[a-zA-Z_][0-9A-Za-z_'-]*@";
-    in
-    ''
-      runHook preCheck
-      if grep -Pqe ${regex} "$out"; then
-        echo The following look like unsubstituted Nix identifiers that remain in "$out":
-        grep -Poe ${regex} "$out"
-        echo Use the more precise '`substitute`' function if this check is in error.
-        exit 1
-      fi
-      runHook postCheck
-    '';
-}

pkgs/build-support/replace-vars/replace-vars-with.nix

@@ -0,0 +1,131 @@
+{ lib, stdenvNoCC }:
+
+/**
+  `replaceVarsWith` is a wrapper around the [bash function `substitute`](https://nixos.org/manual/nixpkgs/stable/#fun-substitute)
+  in the stdenv. It allows for terse replacement of names in the specified path, while checking
+  for common mistakes such as naming a replacement that does nothing or forgetting a variable which
+  needs to be replaced.
+
+  As with the [`--subst-var-by`](https://nixos.org/manual/nixpkgs/stable/#fun-substitute-subst-var-by)
+  flag, names are encoded as `@name@` in the provided file at the provided path.
+
+  Any unmatched variable names in the file at the provided path will cause a build failure.
+
+  By default, any remaining text that matches `@[A-Za-z_][0-9A-Za-z_'-]@` in the output after replacement
+  has occurred will cause a build failure. Variables can be excluded from this check by passing "null" for them.
+
+  # Inputs
+
+  `src` ([Store Path](https://nixos.org/manual/nix/latest/store/store-path.html#store-path) String)
+  : The file in which to replace variables.
+
+  `replacements` (AttrsOf String)
+  : Each entry in this set corresponds to a `--subst-var-by` entry in [`substitute`](https://nixos.org/manual/nixpkgs/stable/#fun-substitute) or
+    null to keep it unchanged.
+
+  `dir` (String)
+  : Sub directory in $out to store the result in. Commonly set to "bin".
+
+  `isExecutable` (Boolean)
+  : Whether to mark the output file as executable.
+
+  Most arguments supported by mkDerivation are also supported, with some exceptions for which
+  an error will be thrown.
+
+  # Example
+
+  ```nix
+  { replaceVarsWith }:
+
+  replaceVarsWith {
+    src = ./my-setup-hook.sh;
+    replacements = { world = "hello"; };
+    dir = "bin";
+    isExecutable = true;
+  }
+  ```
+
+  See `../../test/replace-vars/default.nix` for tests of this function. Also see `replaceVars` for a short
+  version with src and replacements only.
+*/
+{
+  src,
+  replacements,
+  dir ? null,
+  isExecutable ? false,
+  ...
+}@attrs:
+
+let
+  # We use `--replace-fail` instead of `--subst-var-by` so that if the thing isn't there, we fail.
+  subst-var-by =
+    name: value:
+    lib.optionals (value != null) [
+      "--replace-fail"
+      (lib.escapeShellArg "@${name}@")
+      (lib.escapeShellArg value)
+    ];
+
+  substitutions = lib.concatLists (lib.mapAttrsToList subst-var-by replacements);
+
+  left-overs = map ({ name, ... }: name) (
+    builtins.filter ({ value, ... }: value == null) (lib.attrsToList replacements)
+  );
+
+  optionalAttrs =
+    if (builtins.intersectAttrs attrs forcedAttrs == { }) then
+      builtins.removeAttrs attrs [ "replacements" ]
+    else
+      throw "Passing any of ${builtins.concatStringsSep ", " (builtins.attrNames forcedAttrs)} to replaceVarsWith is not supported.";
+
+  forcedAttrs = {
+    doCheck = true;
+    dontUnpack = true;
+    preferLocalBuild = true;
+    allowSubstitutes = false;
+
+    buildPhase = ''
+      runHook preBuild
+
+      target=$out
+      if test -n "$dir"; then
+          target=$out/$dir/$name
+          mkdir -p $out/$dir
+      fi
+
+      substitute "$src" "$target" ${lib.concatStringsSep " " substitutions}
+
+      if test -n "$isExecutable"; then
+          chmod +x $target
+      fi
+
+      runHook postBuild
+    '';
+
+    # Look for Nix identifiers surrounded by `@` that aren't substituted.
+    checkPhase =
+      let
+        lookahead =
+          if builtins.length left-overs == 0 then "" else "(?!${builtins.concatStringsSep "|" left-overs}@)";
+        regex = lib.escapeShellArg "@${lookahead}[a-zA-Z_][0-9A-Za-z_'-]*@";
+      in
+      ''
+        runHook preCheck
+        if grep -Pqe ${regex} "$target"; then
+          echo The following look like unsubstituted Nix identifiers that remain in "$target":
+          grep -Poe ${regex} "$target"
+          echo Use the more precise '`substitute`' function if this check is in error.
+          exit 1
+        fi
+        runHook postCheck
+      '';
+  };
+in
+
+stdenvNoCC.mkDerivation (
+  {
+    name = baseNameOf (toString src);
+  }
+  // optionalAttrs
+  // forcedAttrs
+)

pkgs/build-support/replace-vars/replace-vars.nix

@@ -0,0 +1,36 @@
+{ replaceVarsWith }:
+
+/**
+  `replaceVars` is a wrapper around the [bash function `substitute`](https://nixos.org/manual/nixpkgs/stable/#fun-substitute)
+  in the stdenv. It allows for terse replacement of names in the specified path, while checking
+  for common mistakes such as naming a replacement that does nothing or forgetting a variable which
+  needs to be replaced.
+
+  As with the [`--subst-var-by`](https://nixos.org/manual/nixpkgs/stable/#fun-substitute-subst-var-by)
+  flag, names are encoded as `@name@` in the provided file at the provided path.
+
+  Any unmatched variable names in the file at the provided path will cause a build failure.
+
+  By default, any remaining text that matches `@[A-Za-z_][0-9A-Za-z_'-]@` in the output after replacement
+  has occurred will cause a build failure. Variables can be excluded from this check by passing "null" for them.
+
+  # Inputs
+
+  `src` ([Store Path](https://nixos.org/manual/nix/latest/store/store-path.html#store-path) String)
+  : The file in which to replace variables.
+
+  `replacements` (AttrsOf String)
+  : Each entry in this set corresponds to a `--subst-var-by` entry in [`substitute`](https://nixos.org/manual/nixpkgs/stable/#fun-substitute) or
+    null to keep it unchanged.
+
+  # Example
+
+  ```nix
+  { replaceVars }:
+
+  replaceVars ./greeting.txt { world = "hello"; }
+  ```
+
+  See `../../test/replace-vars/default.nix` for tests of this function.
+*/
+src: replacements: replaceVarsWith { inherit src replacements; }

pkgs/build-support/rust/fetch-cargo-vendor-util.py

@@ -9,6 +9,7 @@ import sys
 import tomllib
 from pathlib import Path
 from typing import Any, TypedDict, cast
+from urllib.parse import unquote
 
 import requests
 from requests.adapters import HTTPAdapter, Retry
@@ -21,6 +22,15 @@ def load_toml(path: Path) -> dict[str, Any]:
         return tomllib.load(f)
 
 
+def get_lockfile_version(cargo_lock_toml: dict[str, Any]) -> int:
+    # lockfile v1 and v2 don't have the `version` key, so assume v2
+    version = cargo_lock_toml.get("version", 2)
+
+    # TODO: add logic for differentiating between v1 and v2
+
+    return version
+
+
 def download_file_with_checksum(url: str, destination_path: Path) -> str:
     retries = Retry(
         total=5,
@@ -93,20 +103,29 @@ class GitSourceInfo(TypedDict):
     git_sha_rev: str
 
 
-def parse_git_source(source: str) -> GitSourceInfo:
+def parse_git_source(source: str, lockfile_version: int) -> GitSourceInfo:
     match = GIT_SOURCE_REGEX.match(source)
     if match is None:
         raise Exception(f"Unable to process git source: {source}.")
-    return cast(GitSourceInfo, match.groupdict(default=None))
+
+    source_info = cast(GitSourceInfo, match.groupdict(default=None))
+
+    # the source URL is URL-encoded in lockfile_version >=4
+    # since we just used regex to parse it we have to manually decode the escaped branch/tag name
+    if lockfile_version >= 4 and source_info["value"] is not None:
+        source_info["value"] = unquote(source_info["value"])
+
+    return source_info
 
 
 def create_vendor_staging(lockfile_path: Path, out_dir: Path) -> None:
-    cargo_toml = load_toml(lockfile_path)
+    cargo_lock_toml = load_toml(lockfile_path)
+    lockfile_version = get_lockfile_version(cargo_lock_toml)
 
     git_packages: list[dict[str, Any]] = []
     registry_packages: list[dict[str, Any]] = []
 
-    for pkg in cargo_toml["package"]:
+    for pkg in cargo_lock_toml["package"]:
         # ignore local dependenices
         if "source" not in pkg.keys():
             eprint(f"Skipping local dependency: {pkg["name"]}")
@@ -122,7 +141,7 @@ def create_vendor_staging(lockfile_path: Path, out_dir: Path) -> None:
 
     git_sha_rev_to_url: dict[str, str] = {}
     for pkg in git_packages:
-        source_info = parse_git_source(pkg["source"])
+        source_info = parse_git_source(pkg["source"], lockfile_version)
         git_sha_rev_to_url[source_info["git_sha_rev"]] = source_info["url"]
 
     out_dir.mkdir(exist_ok=True)
@@ -207,7 +226,8 @@ def create_vendor(vendor_staging_dir: Path, out_dir: Path) -> None:
     out_dir.mkdir(exist_ok=True)
     shutil.copy(lockfile_path, out_dir / "Cargo.lock")
 
-    cargo_toml = load_toml(lockfile_path)
+    cargo_lock_toml = load_toml(lockfile_path)
+    lockfile_version = get_lockfile_version(cargo_lock_toml)
 
     config_lines = [
         '[source.vendored-sources]',
@@ -217,7 +237,7 @@ def create_vendor(vendor_staging_dir: Path, out_dir: Path) -> None:
     ]
 
     seen_source_keys = set()
-    for pkg in cargo_toml["package"]:
+    for pkg in cargo_lock_toml["package"]:
 
         # ignore local dependenices
         if "source" not in pkg.keys():
@@ -230,7 +250,8 @@ def create_vendor(vendor_staging_dir: Path, out_dir: Path) -> None:
 
         if source.startswith("git+"):
 
-            source_info = parse_git_source(pkg["source"])
+            source_info = parse_git_source(pkg["source"], lockfile_version)
+
             git_sha_rev = source_info["git_sha_rev"]
             git_tree = vendor_staging_dir / "git" / git_sha_rev
 

pkgs/build-support/rust/hooks/maturin-build-hook.sh

@@ -12,6 +12,11 @@ maturinBuildHook() {
         pushd "${buildAndTestSubdir}"
     fi
 
+    # This is a huge hack, but it's the least invasive way
+    # to get the required interpreter name for maturin.
+    local interpreter_path="$(command -v python3 || command -v pypy3)"
+    local interpreter_name="$($interpreter_path -c 'import os; import sysconfig; print(os.path.basename(sysconfig.get_config_var('\''INCLUDEPY'\'')))')"
+
     local flagsArray=(
         "--jobs=$NIX_BUILD_CORES"
         "--offline"
@@ -20,6 +25,7 @@ maturinBuildHook() {
         "--strip"
         "--release"
         "--out" "$dist"
+        "--interpreter" "$interpreter_name"
     )
 
     concatTo flagsArray maturinBuildFlags

pkgs/build-support/rust/import-cargo-lock.nix

@@ -49,6 +49,10 @@ let
 
   parsedLockFile = builtins.fromTOML lockFileContents;
 
+  # lockfile v1 and v2 don't have the `version` key, so assume v2
+  # we can implement more fine-grained detection later, if needed
+  lockFileVersion = parsedLockFile.version or 2;
+
   packages = parsedLockFile.package;
 
   # There is no source attribute for the source package itself. But
@@ -202,11 +206,20 @@ let
         # Cargo is happy with empty metadata.
         printf '{"files":{},"package":null}' > "$out/.cargo-checksum.json"
 
+        ${lib.optionalString (gitParts ? type) ''
+          gitPartsValue=${lib.escapeShellArg gitParts.value}
+          # starting with lockfile version v4 the git source url contains encoded query parameters
+          # our regex parser does not know how to unescape them to get the actual value, so we do it here
+          ${lib.optionalString (lockFileVersion >= 4) ''
+            gitPartsValue=$(${lib.getExe python3Packages.python} -c "import sys, urllib.parse; print(urllib.parse.unquote(sys.argv[1]))" "$gitPartsValue")
+          ''}
+        ''}
+
         # Set up configuration for the vendor directory.
         cat > $out/.cargo-config <<EOF
-        [source."${gitParts.url}${lib.optionalString (gitParts ? type) "?${gitParts.type}=${gitParts.value}"}"]
+        [source."${pkg.source}"]
         git = "${gitParts.url}"
-        ${lib.optionalString (gitParts ? type) "${gitParts.type} = \"${gitParts.value}\""}
+        ${lib.optionalString (gitParts ? type) "${gitParts.type} = \"$gitPartsValue\""}
         replace-with = "vendored-sources"
         EOF
       ''

pkgs/build-support/rust/lib/default.nix

@@ -44,6 +44,16 @@ rec {
     #
     setEnv = ''
     env \
+      "CC_${stdenv.buildPlatform.rust.cargoEnvVarTarget}=${ccForBuild}" \
+      "CXX_${stdenv.buildPlatform.rust.cargoEnvVarTarget}=${cxxForBuild}" \
+      "CARGO_TARGET_${stdenv.buildPlatform.rust.cargoEnvVarTarget}_LINKER=${ccForBuild}" \
+      "CARGO_BUILD_TARGET=${rustBuildPlatform}" \
+      "HOST_CC=${pkgsBuildHost.stdenv.cc}/bin/cc" \
+      "HOST_CXX=${pkgsBuildHost.stdenv.cc}/bin/c++" \
+    '' + ''
+      "CC_${stdenv.hostPlatform.rust.cargoEnvVarTarget}=${ccForHost}" \
+      "CXX_${stdenv.hostPlatform.rust.cargoEnvVarTarget}=${cxxForHost}" \
+      "CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_LINKER=${ccForHost}" \
     ''
     # Due to a bug in how splicing and pkgsTargetTarget works, in
     # situations where pkgsTargetTarget is irrelevant
@@ -54,17 +64,6 @@ rec {
       "CC_${stdenv.targetPlatform.rust.cargoEnvVarTarget}=${ccForTarget}" \
       "CXX_${stdenv.targetPlatform.rust.cargoEnvVarTarget}=${cxxForTarget}" \
       "CARGO_TARGET_${stdenv.targetPlatform.rust.cargoEnvVarTarget}_LINKER=${ccForTarget}" \
-    '' + ''
-      "CC_${stdenv.hostPlatform.rust.cargoEnvVarTarget}=${ccForHost}" \
-      "CXX_${stdenv.hostPlatform.rust.cargoEnvVarTarget}=${cxxForHost}" \
-      "CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_LINKER=${ccForHost}" \
-    '' + ''
-      "CC_${stdenv.buildPlatform.rust.cargoEnvVarTarget}=${ccForBuild}" \
-      "CXX_${stdenv.buildPlatform.rust.cargoEnvVarTarget}=${cxxForBuild}" \
-      "CARGO_TARGET_${stdenv.buildPlatform.rust.cargoEnvVarTarget}_LINKER=${ccForBuild}" \
-      "CARGO_BUILD_TARGET=${rustBuildPlatform}" \
-      "HOST_CC=${pkgsBuildHost.stdenv.cc}/bin/cc" \
-      "HOST_CXX=${pkgsBuildHost.stdenv.cc}/bin/c++" \
     '';
   };
 } // lib.mapAttrs (old: new: platform:

pkgs/build-support/setup-hooks/patch-shebangs.sh

@@ -24,7 +24,7 @@ fixupOutputHooks+=(patchShebangsAuto)
 
 patchShebangs() {
     local pathName
-    local update
+    local update=false
 
     while [[ $# -gt 0 ]]; do
         case "$1" in

pkgs/build-support/setup-hooks/set-source-date-epoch-to-latest.sh

@@ -7,7 +7,7 @@ updateSourceDateEpoch() {
     # Get the last modification time of all regular files, sort them,
     # and get the most recent. Maybe we should use
     # https://github.com/0-wiz-0/findnewest here.
-    local -a res=($(find "$path" -type f -not -newer "$NIX_BUILD_TOP/.." -printf '%T@ %p\0' \
+    local -a res=($(find "$path" -type f -not -newer "$NIX_BUILD_TOP/.." -printf '%T@ "%p"\0' \
                     | sort -n --zero-terminated | tail -n1 --zero-terminated | head -c -1))
     local time="${res[0]//\.[0-9]*/}" # remove the fraction part
     local newestFile="${res[1]}"

pkgs/build-support/setup-hooks/strip.sh

@@ -22,7 +22,7 @@ _doStrip() {
     #   push arrays all the way through this logic.
 
     # Strip only host paths by default. Leave targets as is.
-    stripDebugList=${stripDebugList[*]:-lib lib32 lib64 libexec bin sbin}
+    stripDebugList=${stripDebugList[*]:-lib lib32 lib64 libexec bin sbin Applications Library/Frameworks}
     stripDebugListTarget=${stripDebugListTarget[*]:-}
     stripAllList=${stripAllList[*]:-}
     stripAllListTarget=${stripAllListTarget[*]:-}

pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh

@@ -28,13 +28,13 @@ gappsWrapperArgsHook() {
     fi
 
     for v in ${wrapPrefixVariables:-} GST_PLUGIN_SYSTEM_PATH_1_0 GI_TYPELIB_PATH GRL_PLUGIN_PATH; do
-        if [ -n "${!v}" ]; then
+        if [ -n "${!v:-}" ]; then
             gappsWrapperArgs+=(--prefix "$v" : "${!v}")
         fi
     done
 }
 
-preFixupPhases+=" gappsWrapperArgsHook"
+appendToVar preFixupPhases gappsWrapperArgsHook
 
 wrapGApp() {
     local program="$1"

pkgs/build-support/substitute-files/substitute-all-files.nix

@@ -5,7 +5,6 @@ args:
 stdenv.mkDerivation ({
   name = if args ? name then args.name else baseNameOf (toString args.src);
   builder = builtins.toFile "builder.sh" ''
-    source $stdenv/setup
     set -o pipefail
 
     eval "$preInstall"

pkgs/build-support/substitute/substitute-all.sh

@@ -1,5 +1,3 @@
-source $stdenv/setup
-
 eval "$preInstall"
 
 args=

pkgs/build-support/substitute/substitute.sh

@@ -1,5 +1,3 @@
-source $stdenv/setup
-
 args=
 
 target=$out

pkgs/by-name/aa/aalib/ncurses-6.5.patch

@@ -0,0 +1,20 @@
+Without the change build fails on ncurses-6.5 (enables opaque WINDOW by
+default) as:
+
+    aacurses.c: In function 'curses_getsize':
+    aacurses.c:74:20: error: invalid use of incomplete typedef 'WINDOW' {aka 'struct _win_st'}
+     74 |     *width = stdscr->_maxx + 1;
+        |                    ^~
+--- a/src/aacurses.c
++++ b/src/aacurses.c
+@@ -71,8 +71,8 @@ static void curses_getsize(aa_context * c, int *width, int *height)
+ {
+     if (__resized_curses)
+ 	curses_uninit(c), curses_init(&c->params, NULL,&c->driverparams, NULL), __resized_curses = 0;
+-    *width = stdscr->_maxx + 1;
+-    *height = stdscr->_maxy + 1;
++    *width = getmaxx(stdscr);
++    *height = getmaxy(stdscr);
+ #ifdef GPM_MOUSEDRIVER
+     gpm_mx = *width;
+     gpm_my = *height;

pkgs/by-name/aa/aalib/package.nix

@@ -12,7 +12,12 @@ stdenv.mkDerivation rec {
   outputs = [ "bin" "dev" "out" "man" "info" ];
   setOutputFlags = false; # Doesn't support all the flags
 
-  patches = [ ./clang.patch ] # Fix implicit `int` on `main` error with newer versions of clang
+  patches = [
+    # Fix implicit `int` on `main` error with newer versions of clang
+    ./clang.patch
+    # Fix build against opaque aalib API
+    ./ncurses-6.5.patch
+  ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ ./darwin.patch ];
 
   # The fuloong2f is not supported by aalib still

pkgs/by-name/al/alsa-ucm-conf/package.nix

@@ -3,14 +3,16 @@
   fetchurl,
   lib,
   stdenv,
+  coreutils,
+  kmod,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-ucm-conf";
   version = "1.2.12";
 
   src = fetchurl {
-    url = "mirror://alsa/lib/alsa-ucm-conf-${version}.tar.bz2";
+    url = "mirror://alsa/lib/alsa-ucm-conf-${finalAttrs.version}.tar.bz2";
     hash = "sha256-Fo58BUm3v4mRCS+iv7kDYx33edxMQ+6PQnf8t3LYwDU=";
   };
 
@@ -19,6 +21,23 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
+    substituteInPlace ucm2/lib/card-init.conf \
+      --replace-fail "/bin/rm" "${coreutils}/bin/rm" \
+      --replace-fail "/bin/mkdir" "${coreutils}/bin/mkdir"
+
+    files=(
+        "ucm2/HDA/HDA.conf"
+        "ucm2/codecs/rt715/init.conf"
+        "ucm2/codecs/rt715-sdca/init.conf"
+        "ucm2/Intel/cht-bsw-rt5672/cht-bsw-rt5672.conf"
+        "ucm2/Intel/bytcr-rt5640/bytcr-rt5640.conf"
+    )
+
+    for file in "''${files[@]}"; do
+        substituteInPlace "$file" \
+            --replace-fail '/sbin/modprobe' '${kmod}/bin/modprobe'
+    done
+
     mkdir -p $out/share/alsa
     cp -r ucm ucm2 $out/share/alsa
 
@@ -29,7 +48,7 @@ stdenv.mkDerivation rec {
     url = "https://www.alsa-project.org/files/pub/lib/";
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://www.alsa-project.org/";
     description = "ALSA Use Case Manager configuration";
 
@@ -38,8 +57,8 @@ stdenv.mkDerivation rec {
       MIDI functionality to the Linux-based operating system.
     '';
 
-    license = licenses.bsd3;
-    maintainers = [ maintainers.roastiek ];
-    platforms = platforms.linux;
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.roastiek ];
+    platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/ar/arrow-cpp/package.nix

@@ -79,7 +79,7 @@ let
     hash = "sha256-zLWJOWcW7OYL32OwBm9VFtHbmG+ibhteRfHlKr9G3CQ=";
   };
 
-  version = "18.0.0";
+  version = "18.1.0";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "arrow-cpp";
@@ -89,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "apache";
     repo = "arrow";
     rev = "apache-arrow-${version}";
-    hash = "sha256-V2lOYOUJwXSvPPk2G17uc1eZO88EATHKwwDnEroBrPw=";
+    hash = "sha256-Jo3be5bVuDaDcSbW3pS8y9Wc2sz1W2tS6QTwf0XpODA";
   };
 
   sourceRoot = "${finalAttrs.src.name}/cpp";
@@ -103,6 +103,13 @@ stdenv.mkDerivation (finalAttrs: {
       includes = [ "src/arrow/buffer_test.cc" ];
       hash = "sha256-ZHkznOilypi1J22d56PhLlw/hbz8RqwsOGDMqI1NsMs=";
     })
+    # https://github.com/apache/arrow/pull/45057 remove on update
+    (fetchpatch {
+      name = "boost-187.patch";
+      url = "https://github.com/apache/arrow/commit/5ec8b64668896ff06a86b6a41e700145324e1e34.patch";
+      relative = "cpp";
+      hash = "sha256-GkB7u4YnnaCApOMQPYFJuLdY7R2LtLzKccMEpKCO9ic=";
+    })
   ];
 
   # versions are all taken from

pkgs/by-name/at/atf/package.nix

@@ -10,33 +10,28 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "atf";
-  version = "0.21-unstable-2021-09-01"; # Match the commit used in FreeBSD’s port.
+  version = "0.22";
 
   src = fetchFromGitHub {
     owner = "freebsd";
     repo = "atf";
-    rev = "55c21b2c5fb189bbdfccb2b297bfa89236502542";
-    hash = "sha256-u0YBPcoIBvqBVaytaO9feBaRnQygtzEPGJV0ItI1Vco=";
+    tag = "atf-${finalAttrs.version}";
+    hash = "sha256-vZfBk/lH+04d3NbTUYjAaxwGFHtnagl/kY04hgkE4Iw=";
   };
 
   patches = [
-    # Fixes use after free that causes failures in Kyua’s test suite.
-    # https://github.com/freebsd/atf/pull/57
-    # https://github.com/freebsd/kyua/issues/223
+    # https://github.com/freebsd/atf/issues/88
+    # https://github.com/freebsd/atf/pull/85
+    # Maintainer say it fix some tests in issue 88.
+    ./pr-85.patch
     (fetchpatch {
-      name = "fix-use-after-free.patch";
-      url = "https://github.com/freebsd/atf/commit/fb22f3837bcfdce5ce8b3c0e18af131bb6902a02.patch";
-      hash = "sha256-p4L3sxSYfMSzwKrUDlEZpoJydbaK3Hcbvn90KlPHkic=";
+      url = "https://github.com/freebsd/atf/commit/b42c98612cb99fa3f52766a46203263dc1de7187.patch?full_index=1";
+      hash = "sha256-goDPIdIF8vHXDengVIYbxw5W/JT5kfsG5japgtranas=";
     })
   ];
 
   postPatch =
     lib.optionalString finalAttrs.doInstallCheck ''
-      # https://github.com/freebsd/atf/issues/61
-      substituteInPlace atf-c/check_test.c \
-        --replace-fail 'ATF_TP_ADD_TC(tp, build_cpp)' ""
-      substituteInPlace atf-c++/check_test.cpp \
-        --replace-fail 'ATF_ADD_TEST_CASE(tcs, build_cpp);' ""
       # Can’t find `c_helpers` in the work folder.
       substituteInPlace test-programs/Kyuafile \
         --replace-fail 'atf_test_program{name="srcdir_test"}' ""
@@ -60,12 +55,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   makeFlags = [
     # ATF isn’t compatible with C++17, which is the default on current clang and GCC.
-    "CXXFLAGS=-std=c++11"
+    "CXXFLAGS=-std=c++14"
   ];
 
   doInstallCheck = true;
 
-  nativeInstallCheckInputs = [ kyua ];
+  nativeInstallCheckInputs = [
+    kyua
+  ];
 
   installCheckPhase = ''
     runHook preInstallCheck