From 0eabede44b064fb3da5026d4dc5f01fa4c1fd3cf Mon Sep 17 00:00:00 2001
From: Philipp Bartsch <phil@grmr.de>
Date: Sat, 1 Jul 2023 22:37:14 +0200
Subject: [PATCH 01/23] nixos/apparmor: make abstractions/ssl_certs more go
 friendly

By default golang's crypto/x509 implementation wants to read
/etc/pki/tls/certs/ when loading system certificates.

This patch adds the path to reduce audit log noise.

Relevant code:
- https://github.com/golang/go/blob/go1.20.5/src/crypto/x509/root_unix.go#L32-L82
- https://github.com/golang/go/blob/go1.20.5/src/crypto/x509/root_linux.go#L17-L22
---
 nixos/modules/security/apparmor/includes.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/security/apparmor/includes.nix b/nixos/modules/security/apparmor/includes.nix
index adfca04426ca..7711f1fdb7e7 100644
--- a/nixos/modules/security/apparmor/includes.nix
+++ b/nixos/modules/security/apparmor/includes.nix
@@ -279,6 +279,8 @@ config.security.apparmor.includes = {
     r /var/lib/acme/*/chain.pem,
     r /var/lib/acme/*/fullchain.pem,
 
+    r /etc/pki/tls/certs/,
+
     '' + lib.concatMapStringsSep "\n" etcRule [
       "ssl/certs/ca-certificates.crt"
       "ssl/certs/ca-bundle.crt"

From 9145e6df84b171a96ff3b3e2ba5d6d5083b25834 Mon Sep 17 00:00:00 2001
From: Philipp Bartsch <phil@grmr.de>
Date: Sun, 2 Jul 2023 02:35:27 +0200
Subject: [PATCH 02/23] nixos/apparmor: add missing abstraction/nss-systemd

The abstraction/nameservice profile from apparmor-profiles package
includes abstractions/nss-systemd. Without "reexporting" it,
the include fails and we get some errors.
---
 nixos/modules/security/apparmor/includes.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/nixos/modules/security/apparmor/includes.nix b/nixos/modules/security/apparmor/includes.nix
index 7711f1fdb7e7..8e9706eef973 100644
--- a/nixos/modules/security/apparmor/includes.nix
+++ b/nixos/modules/security/apparmor/includes.nix
@@ -211,6 +211,9 @@ config.security.apparmor.includes = {
   "abstractions/nis" = ''
     include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/nis"
   '';
+  "abstractions/nss-systemd" = ''
+    include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/nss-systemd"
+  '';
   "abstractions/nvidia" = ''
     include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/nvidia"
     ${etcRule "vdpau_wrapper.cfg"}

From ad7ffe3a7c270a82e06caea439963278bbc70348 Mon Sep 17 00:00:00 2001
From: Philipp Bartsch <phil@grmr.de>
Date: Sun, 2 Jul 2023 14:23:59 +0200
Subject: [PATCH 03/23] nixos/apparmor: fix syntax in abstractions/bash

---
 nixos/modules/security/apparmor/includes.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/security/apparmor/includes.nix b/nixos/modules/security/apparmor/includes.nix
index 8e9706eef973..d05a1d1b0d1d 100644
--- a/nixos/modules/security/apparmor/includes.nix
+++ b/nixos/modules/security/apparmor/includes.nix
@@ -72,7 +72,7 @@ config.security.apparmor.includes = {
 
     # bash inspects filesystems at startup
     # and /etc/mtab is linked to /proc/mounts
-    @{PROC}/mounts
+    r @{PROC}/mounts,
 
     # system-wide bash configuration
     '' + lib.concatMapStringsSep "\n" etcRule [

From 0f474b4c6cd6202d346bc7b7220b88f3c281e478 Mon Sep 17 00:00:00 2001
From: Philipp Bartsch <phil@grmr.de>
Date: Sun, 9 Jul 2023 15:48:59 +0200
Subject: [PATCH 04/23] nixos/apparmor: support custom i18n glibc locales

The i18n nixos module creates a customized glibcLocales package.
Use the system specific glibcLocale instead of the vanilla one.
---
 nixos/modules/security/apparmor/includes.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/security/apparmor/includes.nix b/nixos/modules/security/apparmor/includes.nix
index d05a1d1b0d1d..88051de484c5 100644
--- a/nixos/modules/security/apparmor/includes.nix
+++ b/nixos/modules/security/apparmor/includes.nix
@@ -62,7 +62,7 @@ config.security.apparmor.includes = {
     include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/base"
     r ${pkgs.stdenv.cc.libc}/share/locale/**,
     r ${pkgs.stdenv.cc.libc}/share/locale.alias,
-    ${lib.optionalString (pkgs.glibcLocales != null) "r ${pkgs.glibcLocales}/lib/locale/locale-archive,"}
+    r ${config.i18n.glibcLocales}/lib/locale/locale-archive,
     ${etcRule "localtime"}
     r ${pkgs.tzdata}/share/zoneinfo/**,
     r ${pkgs.stdenv.cc.libc}/share/i18n/**,

From 125617826334fbf6be4f4f0e312f40b137bcb932 Mon Sep 17 00:00:00 2001
From: Philipp Bartsch <phil@grmr.de>
Date: Sat, 1 Jul 2023 16:45:18 +0200
Subject: [PATCH 05/23] apparmor: fix python import issues

With buildPythonApplication the PYTHONPATH is now populated properly,
which should address the ModuleNotFoundError issue.

I also moved some of the substitutions from postInstall to prePatch, so
they don't conflict with the wrapped executables.

Because upstream does not seem to hardcode binary paths in the utils
anymore, some of the old substituteInPlace rules could be removed.

Partial fix for nixpkgs#169056
---
 pkgs/os-specific/linux/apparmor/default.nix | 31 +++++++++++----------
 1 file changed, 16 insertions(+), 15 deletions(-)

diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index f579c00eb5c9..7c3503d16a65 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -128,9 +128,10 @@ let
     meta = apparmor-meta "library";
   };
 
-  apparmor-utils = stdenv.mkDerivation {
+  apparmor-utils = python.pkgs.buildPythonApplication {
     pname = "apparmor-utils";
     version = apparmor-version;
+    format = "other";
 
     src = apparmor-sources;
 
@@ -146,14 +147,25 @@ let
       libapparmor.python
     ];
 
+    propagatedBuildInputs = [
+      libapparmor.python
+
+      # Used by aa-notify
+      python.pkgs.notify2
+      python.pkgs.psutil
+    ];
+
     prePatch = prePatchCommon +
       # Do not build vim file
       lib.optionalString stdenv.hostPlatform.isMusl ''
         sed -i ./utils/Makefile -e "/\<vim\>/d"
       '' + ''
-      for file in utils/apparmor/easyprof.py utils/apparmor/aa.py utils/logprof.conf; do
-        substituteInPlace $file --replace "/sbin/apparmor_parser" "${apparmor-parser}/bin/apparmor_parser"
-      done
+      sed -i -E 's/^(DESTDIR|BINDIR|PYPREFIX)=.*//g' ./utils/Makefile
+
+      sed -i utils/aa-unconfined -e "/my_env\['PATH'\]/d"
+
+      substituteInPlace utils/aa-remove-unknown \
+       --replace "/lib/apparmor/rc.apparmor.functions" "${apparmor-parser}/lib/apparmor/rc.apparmor.functions"
     '';
     inherit patches;
     postPatch = "cd ./utils";
@@ -161,17 +173,6 @@ let
     installFlags = [ "DESTDIR=$(out)" "BINDIR=$(out)/bin" "VIM_INSTALL_PATH=$(out)/share" "PYPREFIX=" ];
 
     postInstall = ''
-      sed -i $out/bin/aa-unconfined -e "/my_env\['PATH'\]/d"
-      for prog in aa-audit aa-autodep aa-cleanprof aa-complain aa-disable aa-enforce aa-genprof aa-logprof aa-mergeprof aa-unconfined ; do
-        wrapProgram $out/bin/$prog --prefix PYTHONPATH : "$out/lib/${python.sitePackages}:$PYTHONPATH"
-      done
-
-      substituteInPlace $out/bin/aa-notify \
-        --replace /usr/bin/notify-send ${libnotify}/bin/notify-send \
-        --replace /usr/bin/perl "${perl}/bin/perl -I ${libapparmor}/${perl.libPrefix}"
-
-      substituteInPlace $out/bin/aa-remove-unknown \
-       --replace "/lib/apparmor/rc.apparmor.functions" "${apparmor-parser}/lib/apparmor/rc.apparmor.functions"
       wrapProgram $out/bin/aa-remove-unknown \
        --prefix PATH : ${lib.makeBinPath [ gawk ]}
 

From ced170c030a409f8e21a7c1e20bced6a9397c1d2 Mon Sep 17 00:00:00 2001
From: Philipp Bartsch <phil@grmr.de>
Date: Sat, 8 Jul 2023 02:18:34 +0200
Subject: [PATCH 06/23] nixos/miniflux: add apparmor policy

This change also extends the test to ensure that normal operations
aren't denied.
---
 nixos/modules/services/web-apps/miniflux.nix | 12 ++++++++++++
 nixos/tests/miniflux.nix                     |  6 ++++++
 2 files changed, 18 insertions(+)

diff --git a/nixos/modules/services/web-apps/miniflux.nix b/nixos/modules/services/web-apps/miniflux.nix
index 7cc8ce10ffe0..3374c746ad3d 100644
--- a/nixos/modules/services/web-apps/miniflux.nix
+++ b/nixos/modules/services/web-apps/miniflux.nix
@@ -130,5 +130,17 @@ in
       environment = cfg.config;
     };
     environment.systemPackages = [ cfg.package ];
+
+    security.apparmor.policies."bin.miniflux".profile = ''
+      include <tunables/global>
+      ${cfg.package}/bin/miniflux {
+        include <abstractions/base>
+        include <abstractions/nameservice>
+        include <abstractions/ssl_certs>
+        include "${pkgs.apparmorRulesFromClosure { name = "miniflux"; } cfg.package}"
+        r ${cfg.package}/bin/miniflux,
+        r @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size,
+      }
+    '';
   };
 }
diff --git a/nixos/tests/miniflux.nix b/nixos/tests/miniflux.nix
index be3e7abb6abd..a3af53db0e7a 100644
--- a/nixos/tests/miniflux.nix
+++ b/nixos/tests/miniflux.nix
@@ -25,6 +25,7 @@ in
     default =
       { ... }:
       {
+        security.apparmor.enable = true;
         services.miniflux = {
           enable = true;
           inherit adminCredentialsFile;
@@ -34,6 +35,7 @@ in
     withoutSudo =
       { ... }:
       {
+        security.apparmor.enable = true;
         services.miniflux = {
           enable = true;
           inherit adminCredentialsFile;
@@ -44,6 +46,7 @@ in
     customized =
       { ... }:
       {
+        security.apparmor.enable = true;
         services.miniflux = {
           enable = true;
           config = {
@@ -63,6 +66,7 @@ in
     default.succeed(
         "curl 'http://localhost:${toString defaultPort}/v1/me' -u '${defaultUsername}:${defaultPassword}' -H Content-Type:application/json | grep '\"is_admin\":true'"
     )
+    default.fail('journalctl -b --no-pager --grep "^audit: .*apparmor=\\"DENIED\\""')
 
     withoutSudo.wait_for_unit("miniflux.service")
     withoutSudo.wait_for_open_port(${toString defaultPort})
@@ -70,6 +74,7 @@ in
     withoutSudo.succeed(
         "curl 'http://localhost:${toString defaultPort}/v1/me' -u '${defaultUsername}:${defaultPassword}' -H Content-Type:application/json | grep '\"is_admin\":true'"
     )
+    withoutSudo.fail('journalctl -b --no-pager --grep "^audit: .*apparmor=\\"DENIED\\""')
 
     customized.wait_for_unit("miniflux.service")
     customized.wait_for_open_port(${toString port})
@@ -77,5 +82,6 @@ in
     customized.succeed(
         "curl 'http://localhost:${toString port}/v1/me' -u '${username}:${password}' -H Content-Type:application/json | grep '\"is_admin\":true'"
     )
+    customized.fail('journalctl -b --no-pager --grep "^audit: .*apparmor=\\"DENIED\\""')
   '';
 })

From 30ad9053abddb3128e90c023faf64e0bdd4fce1a Mon Sep 17 00:00:00 2001
From: Philipp Bartsch <phil@grmr.de>
Date: Sun, 9 Jul 2023 01:01:03 +0200
Subject: [PATCH 07/23] nixos/murmur: add apparmor policy

---
 nixos/modules/services/networking/murmur.nix | 32 ++++++++++++++++++++
 nixos/tests/mumble.nix                       |  4 +++
 2 files changed, 36 insertions(+)

diff --git a/nixos/modules/services/networking/murmur.nix b/nixos/modules/services/networking/murmur.nix
index ebade7aa8e40..fe3eb3787e91 100644
--- a/nixos/modules/services/networking/murmur.nix
+++ b/nixos/modules/services/networking/murmur.nix
@@ -355,5 +355,37 @@ in
       '';
       destination = "/share/dbus-1/system.d/murmur.conf";
     })];
+
+    security.apparmor.policies."bin.mumble-server".profile = ''
+      include <tunables/global>
+
+      ${cfg.package}/bin/{mumble-server,.mumble-server-wrapped} {
+        include <abstractions/base>
+        include <abstractions/nameservice>
+        include <abstractions/ssl_certs>
+        include "${pkgs.apparmorRulesFromClosure { name = "mumble-server"; } cfg.package}"
+        pix ${cfg.package}/bin/.mumble-server-wrapped,
+
+        r ${config.environment.etc."os-release".source},
+        r ${config.environment.etc."lsb-release".source},
+        owner rwk /var/lib/murmur/murmur.sqlite,
+        owner rw /var/lib/murmur/murmur.sqlite-journal,
+        owner r /var/lib/murmur/,
+        r /run/murmur/murmurd.pid,
+        r /run/murmur/murmurd.ini,
+        r ${configFile},
+      '' + optionalString (cfg.logFile != null) ''
+        rw ${cfg.logFile},
+      '' + optionalString (cfg.sslCert != "") ''
+        r ${cfg.sslCert},
+      '' + optionalString (cfg.sslKey != "") ''
+        r ${cfg.sslKey},
+      '' + optionalString (cfg.sslCa != "") ''
+        r ${cfg.sslCa},
+      '' + optionalString (cfg.dbus != null) ''
+        dbus bus=${cfg.dbus}
+      '' + ''
+      }
+    '';
   };
 }
diff --git a/nixos/tests/mumble.nix b/nixos/tests/mumble.nix
index 2b5cc20163bc..8eee454721a1 100644
--- a/nixos/tests/mumble.nix
+++ b/nixos/tests/mumble.nix
@@ -20,6 +20,7 @@ in
 
   nodes = {
     server = { config, ... }: {
+      security.apparmor.enable = true;
       services.murmur.enable = true;
       services.murmur.registerName = "NixOS tests";
       services.murmur.password = "$MURMURD_PASSWORD";
@@ -81,5 +82,8 @@ in
     server.sleep(5)  # wait to get screenshot
     client1.screenshot("screen1")
     client2.screenshot("screen2")
+
+    # check if apparmor denied anything
+    server.fail('journalctl -b --no-pager --grep "^audit: .*apparmor=\\"DENIED\\""')
   '';
 })

From 13e2cb64cfc4236c6b0f11076636b471d97ac0b0 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 2 Aug 2023 04:03:53 +0100
Subject: [PATCH 08/23] cdrdao: use `finalAttrs`

---
 pkgs/tools/cd-dvd/cdrdao/default.nix | 33 ++++++++++++++++++++--------
 1 file changed, 24 insertions(+), 9 deletions(-)

diff --git a/pkgs/tools/cd-dvd/cdrdao/default.nix b/pkgs/tools/cd-dvd/cdrdao/default.nix
index 527d70e7a90d..a58754c0370d 100644
--- a/pkgs/tools/cd-dvd/cdrdao/default.nix
+++ b/pkgs/tools/cd-dvd/cdrdao/default.nix
@@ -1,18 +1,33 @@
-{lib, stdenv, fetchurl, libvorbis, libmad, pkg-config, libao}:
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libvorbis,
+  libmad,
+  libao,
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "cdrdao";
   version = "1.2.5";
 
   src = fetchurl {
-    url = "mirror://sourceforge/cdrdao/cdrdao-${version}.tar.bz2";
+    url = "mirror://sourceforge/cdrdao/cdrdao-${finalAttrs.version}.tar.bz2";
     hash = "sha256-0ZtnyFPF26JAavqrbNeI53817r5jTKxGeVKEd8e+AbY=";
   };
 
   makeFlags = [ "RM=rm" "LN=ln" "MV=mv" ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libvorbis libmad libao ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    libvorbis
+    libmad
+    libao
+  ];
 
   hardeningDisable = [ "format" ];
 
@@ -25,10 +40,10 @@ stdenv.mkDerivation rec {
   # Needed on gcc >= 6.
   env.NIX_CFLAGS_COMPILE = "-Wno-narrowing";
 
-  meta = with lib; {
+  meta = {
     description = "A tool for recording audio or data CD-Rs in disk-at-once (DAO) mode";
     homepage = "https://cdrdao.sourceforge.net/";
-    platforms = platforms.linux;
-    license = licenses.gpl2;
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl2;
   };
-}
+})

From 58dff2378fec180a2d273bccfe10a6423fafcba5 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 2 Aug 2023 04:04:42 +0100
Subject: [PATCH 09/23] {cdrdao,whipper}: support Darwin

---
 pkgs/applications/audio/whipper/default.nix |  2 +-
 pkgs/tools/cd-dvd/cdrdao/default.nix        | 19 ++++++++++++++++++-
 pkgs/top-level/all-packages.nix             |  4 +++-
 3 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/audio/whipper/default.nix b/pkgs/applications/audio/whipper/default.nix
index e92b2f13187e..eb179bfa5496 100644
--- a/pkgs/applications/audio/whipper/default.nix
+++ b/pkgs/applications/audio/whipper/default.nix
@@ -95,6 +95,6 @@ in python3.pkgs.buildPythonApplication rec {
     description = "A CD ripper aiming for accuracy over speed";
     maintainers = with maintainers; [ emily ];
     license = licenses.gpl3Plus;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/cd-dvd/cdrdao/default.nix b/pkgs/tools/cd-dvd/cdrdao/default.nix
index a58754c0370d..8d557993f9dc 100644
--- a/pkgs/tools/cd-dvd/cdrdao/default.nix
+++ b/pkgs/tools/cd-dvd/cdrdao/default.nix
@@ -2,10 +2,14 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   pkg-config,
+  libiconv,
   libvorbis,
   libmad,
   libao,
+  CoreServices,
+  IOKit,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -24,13 +28,26 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    libiconv
     libvorbis
     libmad
     libao
+  ] ++ lib.optionals stdenv.isDarwin [
+    CoreServices
+    IOKit
   ];
 
   hardeningDisable = [ "format" ];
 
+  patches = [
+    # Fix build on macOS SDK < 12
+    # https://github.com/cdrdao/cdrdao/pull/19
+    (fetchpatch {
+      url = "https://github.com/cdrdao/cdrdao/commit/105d72a61f510e3c47626476f9bbc9516f824ede.patch";
+      hash = "sha256-NVIw59CSrc/HcslhfbYQNK/qSmD4QbfuV8hWYhWelX4=";
+    })
+  ];
+
   # we have glibc/include/linux as a symlink to the kernel headers,
   # and the magic '..' points to kernelheaders, and not back to the glibc/include
   postPatch = ''
@@ -43,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "A tool for recording audio or data CD-Rs in disk-at-once (DAO) mode";
     homepage = "https://cdrdao.sourceforge.net/";
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
     license = lib.licenses.gpl2;
   };
 })
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2a9362c02dcf..1ec575b69bf5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6547,7 +6547,9 @@ with pkgs;
 
   cdpr = callPackage ../tools/networking/cdpr { };
 
-  cdrdao = callPackage ../tools/cd-dvd/cdrdao { };
+  cdrdao = callPackage ../tools/cd-dvd/cdrdao {
+    inherit (darwin.apple_sdk.frameworks) CoreServices IOKit;
+  };
 
   cdrkit = callPackage ../tools/cd-dvd/cdrkit { };
 

From 8d08ce1f93bfec78965195851b874abf904f8cc9 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 2 Aug 2023 04:05:21 +0100
Subject: [PATCH 10/23] cdrdao: add patch to fix uninitialized variable

---
 pkgs/tools/cd-dvd/cdrdao/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/tools/cd-dvd/cdrdao/default.nix b/pkgs/tools/cd-dvd/cdrdao/default.nix
index 8d557993f9dc..959899d3b3f3 100644
--- a/pkgs/tools/cd-dvd/cdrdao/default.nix
+++ b/pkgs/tools/cd-dvd/cdrdao/default.nix
@@ -46,6 +46,13 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/cdrdao/cdrdao/commit/105d72a61f510e3c47626476f9bbc9516f824ede.patch";
       hash = "sha256-NVIw59CSrc/HcslhfbYQNK/qSmD4QbfuV8hWYhWelX4=";
     })
+
+    # Fix undefined behaviour caused by uninitialized variable
+    # https://github.com/cdrdao/cdrdao/pull/21
+    (fetchpatch {
+      url = "https://github.com/cdrdao/cdrdao/commit/251a40ab42305c412674c7c2d391374d91e91c95.patch";
+      hash = "sha256-+nGlWw5rgc5Ns2l+6fQ4Hp2LbhO4R/I95h9WGIh/Ebw=";
+    })
   ];
 
   # we have glibc/include/linux as a symlink to the kernel headers,

From 4c41208f29db52ea91992327e5460e07a47fc405 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christina=20S=C3=B8rensen?= <christina@cafkafk.com>
Date: Sat, 29 Jul 2023 15:35:32 +0200
Subject: [PATCH 11/23] eza: init at 0.10.4
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

eza: init at unstable-2023-07-29

Changelog (general):
- Merged pr-1177: add hyperlink support
- Merged pr-855: add selinux context outputs
- Merged pr-797: git repo status, current branch
- Merged pr-1219: fish inode completions
- Merged pr-1164: -o shortcut for --octal-permissions
- Merged pr-1099: typo
- Merged pr-69: fix cargo.toml, completions, man pages
- Merged pr-981: use stdout for timezone errors

Changelog (security):
- Bumped openssl-src: SM2 Decryption Buffer Overflow (Critical)
- Bumped openssl-src: openssl-src contains Double free after calling `PEM_read_bio_ex` (High)
- Bumped openssl-src: AES OCB fails to encrypt some bytes (High)
- Bumped openssl-src: openssl-src's infinite loop in `BN_mod_sqrt()` reachable when parsing certificates (High)
- Bumped openssl-src: Read buffer overruns processing ASN.1 strings (High)
- Bumped openssl-src: openssl-src vulnerable to Use-after-free following `BIO_new_NDEF` (High)
- Bumped openssl-src: Vulnerable OpenSSL included in cryptography wheels (High)
- Bumped openssl-src: openssl-src subject to Timing Oracle in RSA Decryption (Moderate)
- Bumped git2-rs: git2-rs fails to verify SSH keys by default (Moderate)
- Bumped git2-rs: git2-rs fails to verify SSH keys by default (Moderate)

Signed-off-by: Christina Sørensen <christina@cafkafk.com>

eza: unstable-2023-07-29 -> unstable-2023-07-30

Signed-off-by: Christina Sørensen <christina@cafkafk.com>

eza: unstable-2023-07-30 -> 0.10.2

Signed-off-by: Christina Sørensen <christina@cafkafk.com>

eza: 0.10.2 -> 0.10.3

Signed-off-by: Christina Sørensen <christina@cafkafk.com>

eza: 0.10.3 -> 0.10.4

Changelog:

Bug Fixes

- Dereferencing linksfile size.
- Dereferencing links users.
- Dereferencing links groups.
- Dereferencing links permissions.
- Dereferencing links timestamps.
- Syntax error

Documentation

- Add -X/--dereference flag

Features

- Add symlink dereferencing flag
- Add -X/--dereference completions
- Add -X/--dereference completions
- Added ".out" files for latex
- Add changelog generation

Signed-off-by: Christina Sørensen <christina@cafkafk.com>
---
 pkgs/tools/misc/eza/default.nix | 61 +++++++++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix |  4 +++
 2 files changed, 65 insertions(+)
 create mode 100644 pkgs/tools/misc/eza/default.nix

diff --git a/pkgs/tools/misc/eza/default.nix b/pkgs/tools/misc/eza/default.nix
new file mode 100644
index 000000000000..f3b2fa0e52b8
--- /dev/null
+++ b/pkgs/tools/misc/eza/default.nix
@@ -0,0 +1,61 @@
+{ lib
+, gitSupport ? true
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, cmake
+, pandoc
+, pkg-config
+, zlib
+, Security
+, libiconv
+, installShellFiles
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "eza";
+  version = "0.10.4";
+
+  src = fetchFromGitHub {
+    owner = "cafkafk";
+    repo = "eza";
+    rev = "v${version}";
+    hash = "sha256-9Pw7DQ/QTRHNsCPen+Nn5HdvjX1ju08q+KyitPF9+xQ=";
+  };
+
+  cargoHash = "sha256-KveRmlgyree77ZDOB4hQA35F/u/ARKiAHRgHpjCXOow=";
+
+  nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
+  buildInputs = [ zlib ]
+    ++ lib.optionals stdenv.isDarwin [ libiconv Security ];
+
+  buildNoDefaultFeatures = true;
+  buildFeatures = lib.optional gitSupport "git";
+
+  outputs = [ "out" "man" ];
+
+  postInstall = ''
+    pandoc --standalone -f markdown -t man man/eza.1.md > man/eza.1
+    pandoc --standalone -f markdown -t man man/eza_colors.5.md > man/eza_colors.5
+    installManPage man/eza.1 man/eza_colors.5
+    installShellCompletion \
+      --bash completions/bash/eza \
+      --fish completions/fish/eza.fish \
+      --zsh completions/zsh/_eza
+  '';
+
+  meta = with lib; {
+    description = "A modern, maintained replacement for ls";
+    longDescription = ''
+      eza is a modern replacement for ls. It uses colours for information by
+      default, helping you distinguish between many types of files, such as
+      whether you are the owner, or in the owning group. It also has extra
+      features not present in the original ls, such as viewing the Git status
+      for a directory, or recursing into directories with a tree view. eza is
+      written in Rust, so it’s small, fast, and portable.
+    '';
+    homepage = "https://github.com/cafkafk/eza";
+    license = licenses.mit;
+    maintainers = with maintainers; [ cafkafk ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f521fbcb14cd..01b859e561dd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7789,6 +7789,10 @@ with pkgs;
 
   expliot = callPackage ../tools/security/expliot { };
 
+  eza = callPackage ../tools/misc/eza {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
   f2fs-tools = callPackage ../tools/filesystems/f2fs-tools { };
 
   Fabric = with python3Packages; toPythonApplication fabric;

From b6910512a0789390af9db312ee8f08665bd662ab Mon Sep 17 00:00:00 2001
From: Joe Neeman <joeneeman@gmail.com>
Date: Mon, 15 May 2023 12:36:46 -0500
Subject: [PATCH 12/23] wasm-bindgen-cli: 0.2.84 -> 0.2.87

Also allow overriding the version
---
 .../tools/wasm-bindgen-cli/default.nix            | 15 +++++++--------
 pkgs/servers/ldap/lldap/default.nix               |  8 +++++++-
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/tools/wasm-bindgen-cli/default.nix b/pkgs/development/tools/wasm-bindgen-cli/default.nix
index ec336d422ab1..d7b6aba2a2a3 100644
--- a/pkgs/development/tools/wasm-bindgen-cli/default.nix
+++ b/pkgs/development/tools/wasm-bindgen-cli/default.nix
@@ -7,28 +7,27 @@
 , stdenv
 , curl
 , Security
-, runCommand
+, version ? "0.2.87"
+, hash ? "sha256-0u9bl+FkXEK2b54n7/l9JOCtKo+pb42GF9E1EnAUQa0="
+, cargoHash ? "sha256-AsZBtE2qHJqQtuCt/wCAgOoxYMfvDh8IzBPAOkYSYko="
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "wasm-bindgen-cli";
-  version = "0.2.84";
+  inherit version hash cargoHash;
 
   src = fetchCrate {
-    inherit pname version;
-    sha256 = "sha256-0rK+Yx4/Jy44Fw5VwJ3tG243ZsyOIBBehYU54XP/JGk=";
+    inherit pname version hash;
   };
 
-  cargoSha256 = "sha256-vcpxcRlW1OKoD64owFF6mkxSqmNrvY+y3Ckn5UwEQ50=";
-
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ curl Security ];
 
   nativeCheckInputs = [ nodejs ];
 
-  # other tests require it to be ran in the wasm-bindgen monorepo
-  cargoTestFlags = [ "--test=interface-types" ];
+  # tests require it to be ran in the wasm-bindgen monorepo
+  doCheck = false;
 
   meta = with lib; {
     homepage = "https://rustwasm.github.io/docs/wasm-bindgen/";
diff --git a/pkgs/servers/ldap/lldap/default.nix b/pkgs/servers/ldap/lldap/default.nix
index 1948ca015dda..93bf09add849 100644
--- a/pkgs/servers/ldap/lldap/default.nix
+++ b/pkgs/servers/ldap/lldap/default.nix
@@ -32,6 +32,12 @@ let
     configureFlags = attrs.configureFlags ++ ["--set=build.docs=false"];
   });
 
+  wasm-bindgen-84 = wasm-bindgen-cli.override {
+    version = "0.2.84";
+    hash = "sha256-0rK+Yx4/Jy44Fw5VwJ3tG243ZsyOIBBehYU54XP/JGk=";
+    cargoHash = "sha256-vcpxcRlW1OKoD64owFF6mkxSqmNrvY+y3Ckn5UwEQ50=";
+  };
+
   commonDerivationAttrs = rec {
     pname = "lldap";
     version = "0.4.3";
@@ -65,7 +71,7 @@ let
     pname = commonDerivationAttrs.pname + "-frontend";
 
     nativeBuildInputs = [
-      wasm-pack wasm-bindgen-cli binaryen which rustc-wasm rustc-wasm.llvmPackages.lld
+      wasm-pack wasm-bindgen-84 binaryen which rustc-wasm rustc-wasm.llvmPackages.lld
     ];
 
     buildPhase = ''

From 65e49fdb5df497b655b8d80d3b525954e4ccd4ca Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Thu, 3 Aug 2023 04:20:00 +0000
Subject: [PATCH 13/23] millet: 0.12.8 -> 0.12.9

Diff: https://github.com/azdavis/millet/compare/v0.12.8...v0.12.9

Changelog: https://github.com/azdavis/millet/blob/v0.12.9/docs/CHANGELOG.md
---
 .../tools/language-servers/millet/Cargo.lock  | 72 +++++++++----------
 .../tools/language-servers/millet/default.nix |  4 +-
 2 files changed, 38 insertions(+), 38 deletions(-)

diff --git a/pkgs/development/tools/language-servers/millet/Cargo.lock b/pkgs/development/tools/language-servers/millet/Cargo.lock
index 96f0e67abb30..e9208f2e315b 100644
--- a/pkgs/development/tools/language-servers/millet/Cargo.lock
+++ b/pkgs/development/tools/language-servers/millet/Cargo.lock
@@ -28,7 +28,7 @@ dependencies = [
 
 [[package]]
 name = "analysis"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "config",
  "diagnostic",
@@ -115,7 +115,7 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chain-map"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "fast-hash",
  "str-util",
@@ -128,7 +128,7 @@ source = "git+https://github.com/azdavis/language-util.git#f2c149459f0544fb6a8e1
 
 [[package]]
 name = "cm-syntax"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "lex-util",
  "paths",
@@ -157,7 +157,7 @@ dependencies = [
 
 [[package]]
 name = "config"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "fast-hash",
  "serde",
@@ -185,7 +185,7 @@ checksum = "7704b5fdd17b18ae31c4c1da5a2e0305a2bf17b5249300a9ee9ed7b72114c636"
 
 [[package]]
 name = "cov-mark"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "fast-hash",
  "once_cell",
@@ -412,7 +412,7 @@ dependencies = [
 
 [[package]]
 name = "input"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "cm-syntax",
  "config",
@@ -460,7 +460,7 @@ checksum = "3752f229dcc5a481d60f385fa479ff46818033d881d2d801aa27dffcfb5e8306"
 
 [[package]]
 name = "lang-srv"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "analysis",
  "anyhow",
@@ -488,7 +488,7 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "lex-util"
-version = "0.12.8"
+version = "0.12.9"
 
 [[package]]
 name = "libc"
@@ -560,7 +560,7 @@ dependencies = [
 
 [[package]]
 name = "millet-cli"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "analysis",
  "codespan-reporting",
@@ -578,7 +578,7 @@ dependencies = [
 
 [[package]]
 name = "millet-ls"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "anyhow",
  "env_logger",
@@ -598,7 +598,7 @@ dependencies = [
 
 [[package]]
 name = "mlb-hir"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "fast-hash",
  "paths",
@@ -609,7 +609,7 @@ dependencies = [
 
 [[package]]
 name = "mlb-statics"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "config",
  "diagnostic",
@@ -633,7 +633,7 @@ dependencies = [
 
 [[package]]
 name = "mlb-syntax"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "lex-util",
  "paths",
@@ -696,7 +696,7 @@ checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
 
 [[package]]
 name = "panic-hook"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "better-panic",
 ]
@@ -899,7 +899,7 @@ dependencies = [
 
 [[package]]
 name = "slash-var-path"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "fast-hash",
  "str-util",
@@ -907,14 +907,14 @@ dependencies = [
 
 [[package]]
 name = "sml-comment"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "sml-syntax",
 ]
 
 [[package]]
 name = "sml-dynamics"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "fast-hash",
  "fmt-util",
@@ -925,7 +925,7 @@ dependencies = [
 
 [[package]]
 name = "sml-dynamics-tests"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "config",
  "pretty_assertions",
@@ -941,7 +941,7 @@ dependencies = [
 
 [[package]]
 name = "sml-file-syntax"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "config",
  "elapsed",
@@ -955,7 +955,7 @@ dependencies = [
 
 [[package]]
 name = "sml-fixity"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "fast-hash",
  "once_cell",
@@ -964,7 +964,7 @@ dependencies = [
 
 [[package]]
 name = "sml-hir"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "la-arena",
  "sml-lab",
@@ -975,7 +975,7 @@ dependencies = [
 
 [[package]]
 name = "sml-hir-lower"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "config",
  "cov-mark",
@@ -990,14 +990,14 @@ dependencies = [
 
 [[package]]
 name = "sml-lab"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "str-util",
 ]
 
 [[package]]
 name = "sml-lex"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "cov-mark",
  "diagnostic",
@@ -1012,7 +1012,7 @@ source = "git+https://github.com/azdavis/sml-libs.git#3948485e5bf5649e50271caf3e
 
 [[package]]
 name = "sml-naive-fmt"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "fast-hash",
  "sml-comment",
@@ -1021,11 +1021,11 @@ dependencies = [
 
 [[package]]
 name = "sml-namespace"
-version = "0.12.8"
+version = "0.12.9"
 
 [[package]]
 name = "sml-parse"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "diagnostic",
  "event-parse",
@@ -1037,14 +1037,14 @@ dependencies = [
 
 [[package]]
 name = "sml-path"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "str-util",
 ]
 
 [[package]]
 name = "sml-scon"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "num-bigint",
  "num-traits",
@@ -1053,7 +1053,7 @@ dependencies = [
 
 [[package]]
 name = "sml-statics"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "chain-map",
  "config",
@@ -1076,7 +1076,7 @@ dependencies = [
 
 [[package]]
 name = "sml-statics-types"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "chain-map",
  "code-h2-md-map",
@@ -1095,7 +1095,7 @@ dependencies = [
 
 [[package]]
 name = "sml-symbol-kind"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "sml-namespace",
  "sml-statics-types",
@@ -1103,7 +1103,7 @@ dependencies = [
 
 [[package]]
 name = "sml-syntax"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "code-h2-md-map",
  "fast-hash",
@@ -1114,7 +1114,7 @@ dependencies = [
 
 [[package]]
 name = "sml-ty-var-scope"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "fast-hash",
  "sml-hir",
@@ -1172,7 +1172,7 @@ dependencies = [
 
 [[package]]
 name = "tests"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "analysis",
  "cm-syntax",
@@ -1516,7 +1516,7 @@ dependencies = [
 
 [[package]]
 name = "xtask"
-version = "0.12.8"
+version = "0.12.9"
 dependencies = [
  "anyhow",
  "flate2",
diff --git a/pkgs/development/tools/language-servers/millet/default.nix b/pkgs/development/tools/language-servers/millet/default.nix
index d28677fc3a8f..8b1fc8c47745 100644
--- a/pkgs/development/tools/language-servers/millet/default.nix
+++ b/pkgs/development/tools/language-servers/millet/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "millet";
-  version = "0.12.8";
+  version = "0.12.9";
 
   src = fetchFromGitHub {
     owner = "azdavis";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-H44aQGrLv/A1yo44DaR9FJ0ReXiHU4SQ3zLoEkxF9M8=";
+    hash = "sha256-PGB5sgYxiXYTj6O9SY/druDpNCf4O8HsivT8zhJM62M=";
   };
 
   cargoLock = {

From eacf49d19ecfd2e121d523f83bf449ba368e3c33 Mon Sep 17 00:00:00 2001
From: Phillip Seeber <phillip.seeber@uni-jena.de>
Date: Thu, 3 Aug 2023 17:34:32 +0200
Subject: [PATCH 14/23] openmolcas: enable dmrg and nevpt2 support

---
 .../science/chemistry/openmolcas/default.nix  | 74 ++++++++++++++++---
 .../chemistry/openmolcas/qcmaquis.patch       | 46 ++++++++++++
 2 files changed, 108 insertions(+), 12 deletions(-)
 create mode 100644 pkgs/applications/science/chemistry/openmolcas/qcmaquis.patch

diff --git a/pkgs/applications/science/chemistry/openmolcas/default.nix b/pkgs/applications/science/chemistry/openmolcas/default.nix
index c99c5da06f37..695d5502b5eb 100644
--- a/pkgs/applications/science/chemistry/openmolcas/default.nix
+++ b/pkgs/applications/science/chemistry/openmolcas/default.nix
@@ -1,19 +1,47 @@
-{ lib, stdenv, fetchFromGitLab, cmake, gfortran, perl
-, blas-ilp64, hdf5-cpp, python3, texlive
-, armadillo, libxc, makeWrapper
-# Note that the CASPT2 module is broken with MPI
-# See https://gitlab.com/Molcas/OpenMolcas/-/issues/169
+{ lib
+, stdenv
+, fetchFromGitLab
+, fetchFromGitHub
+, cmake
+, gfortran
+, perl
+, blas-ilp64
+, hdf5-cpp
+, python3
+, texlive
+, armadillo
+, libxc
+, makeWrapper
+, gsl
+, boost175
+, autoPatchelfHook
+  # Note that the CASPT2 module is broken with MPI
+  # See https://gitlab.com/Molcas/OpenMolcas/-/issues/169
 , enableMpi ? false
-, mpi, globalarrays
-} :
+, mpi
+, globalarrays
+}:
 
 assert blas-ilp64.isILP64;
 assert lib.elem blas-ilp64.passthru.implementation [ "openblas" "mkl" ];
 
 let
-  python = python3.withPackages (ps : with ps; [ six pyparsing numpy h5py ]);
+  python = python3.withPackages (ps: with ps; [ six pyparsing numpy h5py ]);
+  qcmaquisSrc = fetchFromGitHub {
+    owner = "qcscine";
+    repo = "qcmaquis";
+    rev = "release-3.1.1"; # Must match tag in cmake/custom/qcmaquis.cmake
+    hash = "sha256-diLDWj/Om6EHrVp+Hd24jsN6R9vV2vRl0y9gqyRWhkI=";
+  };
+  nevtp2Src = fetchFromGitHub {
+    owner = "qcscine";
+    repo = "nevpt2";
+    rev = "e1484fd"; # Must match tag in cmake/custom/nevpt2.cmake
+    hash = "sha256-Vl+FhwhJBbD/7U2CwsYE9BClSQYLJ8DKXV9EXxQUmz0=";
+  };
 
-in stdenv.mkDerivation {
+in
+stdenv.mkDerivation {
   pname = "openmolcas";
   version = "23.06";
 
@@ -28,12 +56,22 @@ in stdenv.mkDerivation {
   patches = [
     # Required to handle openblas multiple outputs
     ./openblasPath.patch
+
+    # Required for a local QCMaquis build
+    ./qcmaquis.patch
   ];
 
   postPatch = ''
     # Using env fails in the sandbox
     substituteInPlace Tools/pymolcas/export.py --replace \
       "/usr/bin/env','python3" "python3"
+
+    # Pointing CMake to local QCMaquis and NEVPT2 archives
+    substituteInPlace cmake/custom/qcmaquis.cmake \
+      --subst-var-by "qcmaquis_src_url" "file://${qcmaquisSrc}"
+
+    substituteInPlace cmake/custom/nevpt2.cmake \
+      --subst-var-by "nevpt2_src_url" "file://${nevtp2Src}"
   '';
 
   nativeBuildInputs = [
@@ -42,6 +80,7 @@ in stdenv.mkDerivation {
     cmake
     texlive.combined.scheme-minimal
     makeWrapper
+    autoPatchelfHook
   ];
 
   buildInputs = [
@@ -50,6 +89,8 @@ in stdenv.mkDerivation {
     python
     armadillo
     libxc
+    gsl.dev
+    boost175
   ] ++ lib.optionals enableMpi [
     mpi
     globalarrays
@@ -64,10 +105,15 @@ in stdenv.mkDerivation {
     "-DHDF5=ON"
     "-DFDE=ON"
     "-DEXTERNAL_LIBXC=${libxc}"
+    "-DDMRG=ON"
+    "-DNEVPT2=ON"
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
   ] ++ lib.optionals (blas-ilp64.passthru.implementation == "openblas") [
-    "-DOPENBLASROOT=${blas-ilp64.passthru.provider.dev}" "-DLINALG=OpenBLAS"
+    "-DOPENBLASROOT=${blas-ilp64.passthru.provider.dev}"
+    "-DLINALG=OpenBLAS"
   ] ++ lib.optionals (blas-ilp64.passthru.implementation == "mkl") [
-    "-DMKLROOT=${blas-ilp64.passthru.provider}" "-DLINALG=MKL"
+    "-DMKLROOT=${blas-ilp64.passthru.provider}"
+    "-DLINALG=MKL"
   ] ++ lib.optionals enableMpi [
     "-DGA=ON"
     "-DMPI=ON"
@@ -89,6 +135,10 @@ in stdenv.mkDerivation {
     rm -r $out/Tools
   '';
 
+  # DMRG executables contain references to /build, however, they are properly
+  # removed by autopatchelf
+  noAuditTmpdir = true;
+
   postFixup = ''
     # Wrong store path in shebang (no Python pkgs), force re-patching
     sed -i "1s:/.*:/usr/bin/env python:" $out/bin/pymolcas
@@ -101,7 +151,7 @@ in stdenv.mkDerivation {
     description = "Advanced quantum chemistry software package";
     homepage = "https://gitlab.com/Molcas/OpenMolcas";
     maintainers = [ maintainers.markuskowa ];
-    license = licenses.lgpl21Only;
+    license = with licenses; [ lgpl21Only bsd3 ];
     platforms = [ "x86_64-linux" ];
     mainProgram = "pymolcas";
   };
diff --git a/pkgs/applications/science/chemistry/openmolcas/qcmaquis.patch b/pkgs/applications/science/chemistry/openmolcas/qcmaquis.patch
new file mode 100644
index 000000000000..ca276bb3fb58
--- /dev/null
+++ b/pkgs/applications/science/chemistry/openmolcas/qcmaquis.patch
@@ -0,0 +1,46 @@
+diff --git a/cmake/custom/nevpt2.cmake b/cmake/custom/nevpt2.cmake
+index 789739ec8..6c86a7b8c 100644
+--- a/cmake/custom/nevpt2.cmake
++++ b/cmake/custom/nevpt2.cmake
+@@ -67,6 +67,7 @@ list(APPEND NEVPT2CMakeArgs
+   "-DMOLCAS_BUILD_DIR=${PROJECT_BINARY_DIR}"
+   "-DCMAKE_Fortran_MODULE_DIRECTORY=${mod_dir}"
+   "-DDMRG_INCLUDE=${HDF5_QCM_INCLUDE}"
++  "-DCMAKE_SKIP_BUILD_RPATH=ON"
+   )
+ 
+ if(HDF5_ROOT)
+@@ -118,9 +119,7 @@ endif ()
+ 
+ ExternalProject_Add(${EP_PROJECT}
+                     PREFIX ${CUSTOM_NEVPT2_LOCATION}
+-                    GIT_REPOSITORY ${reference_git_repo}
+-                    GIT_TAG ${reference_git_commit}
+-                    UPDATE_DISCONNECTED ${EP_SkipUpdate}
++                    URL @nevpt2_src_url@
+                     CMAKE_ARGS "${NEVPT2CMakeArgs}"
+                     INSTALL_DIR "${PROJECT_BINARY_DIR}/qcmaquis"
+                    )
+diff --git a/cmake/custom/qcmaquis.cmake b/cmake/custom/qcmaquis.cmake
+index 176d02761..e160b7bc8 100644
+--- a/cmake/custom/qcmaquis.cmake
++++ b/cmake/custom/qcmaquis.cmake
+@@ -78,6 +78,7 @@ list(APPEND QCMaquisCMakeArgs
+   -DCMAKE_CXX_COMPILER=${CMAKE_CXX_COMPILER}
+   -DCMAKE_CXX_FLAGS=${QCM_CMake_CXX_FLAGS}
+   -DCMAKE_INSTALL_PREFIX:PATH=<INSTALL_DIR>
++  -DCMAKE_SKIP_BUILD_RPATH=ON
+   )
+ if(HDF5_ROOT)
+   list(APPEND QCMaquisCMakeArgs
+@@ -278,9 +279,7 @@ set (CMAKE_DISABLE_SOURCE_CHANGES OFF)
+ 
+     ExternalProject_Add(${EP_PROJECT}
+         PREFIX ${extprojpath}
+-        GIT_REPOSITORY ${reference_git_repo}
+-        GIT_TAG ${reference_git_commit}
+-        UPDATE_DISCONNECTED ${EP_SkipUpdate}
++        URL @qcmaquis_src_url@
+ 
+         SOURCE_SUBDIR dmrg
+         CMAKE_ARGS ${EP_CMAKE_ARGS}

From a882b4a3f7516542c001c78445f46f68fb47e7ce Mon Sep 17 00:00:00 2001
From: Ludovico Piero <ludovicopiero@pm.me>
Date: Thu, 3 Aug 2023 21:58:08 +1000
Subject: [PATCH 15/23] mailspring: 1.10.8 -> 1.11.0

---
 .../networking/mailreaders/mailspring/default.nix             | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/mailreaders/mailspring/default.nix b/pkgs/applications/networking/mailreaders/mailspring/default.nix
index 6e694d01b466..9b5adb3a9772 100644
--- a/pkgs/applications/networking/mailreaders/mailspring/default.nix
+++ b/pkgs/applications/networking/mailreaders/mailspring/default.nix
@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mailspring";
-  version = "1.10.8";
+  version = "1.11.0";
 
   src = fetchurl {
     url = "https://github.com/Foundry376/Mailspring/releases/download/${version}/mailspring-${version}-amd64.deb";
-    sha256 = "sha256-aXpPn6tpSOwWL/34qlpJ+on/H+X7303J1jwvwcVOTNs=";
+    hash = "sha256-aAqkltVxIlGwRVGM+1QkrVgfnitl+D3Xb0qi0o8ow+Q=";
   };
 
   nativeBuildInputs = [

From a13c86515a340c564eab98c4c175f0f510dd311b Mon Sep 17 00:00:00 2001
From: Ludovico Piero <ludovicopiero@pm.me>
Date: Fri, 4 Aug 2023 06:46:13 +1000
Subject: [PATCH 16/23] maintainers: add ludovicopiero

---
 maintainers/maintainer-list.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index c4247443f566..c3dac5d13841 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -9926,6 +9926,15 @@
     githubId = 1168435;
     name = "Ludovic Courtès";
   };
+  ludovicopiero = {
+    email = "ludovicopiero@pm.me";
+    github = "ludovicopiero";
+    githubId = 44255157;
+    name = "Ludovico Piero";
+    keys = [{
+      fingerprint = "72CA 4F61 46C6 0DAB 6193  4D35 3911 DD27 6CFE 779C";
+    }];
+  };
   lufia = {
     email = "lufia@lufia.org";
     github = "lufia";

From 3ea80c9c2c26ff0740fd29b30f04766dbca179de Mon Sep 17 00:00:00 2001
From: "Travis A. Everett" <travis.a.everett@gmail.com>
Date: Thu, 3 Aug 2023 20:29:24 -0500
Subject: [PATCH 17/23] srt-to-vtt-cl: fix macOS builds

The upstream Makefile is using logic to build into different dirs
depending on uname output. Trivial to get macOS builds working if
we just don't do that.

I've also stripped out a use of substituteAll that was having no
effect (the variables it replaced were removed during review of
the initial PR.)
---
 pkgs/tools/cd-dvd/srt-to-vtt-cl/default.nix   | 11 +++----
 .../srt-to-vtt-cl/simplify-macOS-builds.patch | 31 +++++++++++++++++++
 2 files changed, 36 insertions(+), 6 deletions(-)
 create mode 100644 pkgs/tools/cd-dvd/srt-to-vtt-cl/simplify-macOS-builds.patch

diff --git a/pkgs/tools/cd-dvd/srt-to-vtt-cl/default.nix b/pkgs/tools/cd-dvd/srt-to-vtt-cl/default.nix
index 70fcedde858a..80e456d072ce 100644
--- a/pkgs/tools/cd-dvd/srt-to-vtt-cl/default.nix
+++ b/pkgs/tools/cd-dvd/srt-to-vtt-cl/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, substituteAll }:
+{ lib, stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
   pname = "srt-to-vtt-cl";
@@ -12,14 +12,13 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    (substituteAll {
-      src = ./fix-validation.patch;
-    })
+    ./fix-validation.patch
+    ./simplify-macOS-builds.patch
   ];
 
   installPhase = ''
     mkdir -p $out/bin
-    cp bin/$(uname -s)/$(uname -m)/srt-vtt $out/bin
+    cp bin/srt-vtt $out/bin
   '';
 
   meta = with lib; {
@@ -27,6 +26,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     maintainers = with maintainers; [ ericdallo ];
     homepage = "https://github.com/nwoltman/srt-to-vtt-cl";
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/tools/cd-dvd/srt-to-vtt-cl/simplify-macOS-builds.patch b/pkgs/tools/cd-dvd/srt-to-vtt-cl/simplify-macOS-builds.patch
new file mode 100644
index 000000000000..71497f23beef
--- /dev/null
+++ b/pkgs/tools/cd-dvd/srt-to-vtt-cl/simplify-macOS-builds.patch
@@ -0,0 +1,31 @@
+From be08356f421825d3d2dd7ab687f86d9981a31f9a Mon Sep 17 00:00:00 2001
+From: "Travis A. Everett" <travis.a.everett@gmail.com>
+Date: Thu, 3 Aug 2023 20:15:40 -0500
+Subject: [PATCH] simplify macOS builds
+
+---
+ Makefile | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 6dfd829..19c3ae3 100644
+--- a/Makefile
++++ b/Makefile
+@@ -8,13 +8,7 @@ CXXFLAGS = -std=c++11 -O2 -MMD -I ./deps
+ OBJECTS := src/text_encoding_detect.o src/Utils.o src/Converter.o src/main.o
+ DEPENDS := $(OBJECTS:.o=.d)
+ EXEC = srt-vtt
+-UNAME_S := $(shell uname -s)
+-ifeq ($(UNAME_S), Darwin)
+-	BIN_DIR = bin/Mac-OSX
+-else
+-	UNAME_M := $(shell uname -m)
+-	BIN_DIR = bin/$(UNAME_S)/$(UNAME_M)
+-endif
++BIN_DIR = bin
+ EXEC_PATH = $(BIN_DIR)/$(EXEC)
+ 
+ .PHONY: test
+-- 
+2.39.0
+

From 2ff8d8b24fee303b6b9888d7b4f91d42053a592b Mon Sep 17 00:00:00 2001
From: meppu <meppu@proton.me>
Date: Fri, 4 Aug 2023 08:27:29 +0300
Subject: [PATCH 18/23] gleam: add nix-update-script

---
 pkgs/development/compilers/gleam/default.nix | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/gleam/default.nix b/pkgs/development/compilers/gleam/default.nix
index c7e6669dd14e..d0e4f9994c87 100644
--- a/pkgs/development/compilers/gleam/default.nix
+++ b/pkgs/development/compilers/gleam/default.nix
@@ -1,4 +1,14 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, git, pkg-config, openssl, Security, libiconv }:
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, git
+, pkg-config
+, openssl
+, Security
+, libiconv
+, nix-update-script
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "gleam";
@@ -18,6 +28,8 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-K7MrrnupH1BS8KEIgVdlnGF91J5ND5umgdeLVCg7DbQ=";
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "A statically typed language for the Erlang VM";
     homepage = "https://gleam.run/";

From a546cb6b3e2626cb3c6ea6462dce3af6ab3923e0 Mon Sep 17 00:00:00 2001
From: meppu <meppu@proton.me>
Date: Fri, 4 Aug 2023 08:39:28 +0300
Subject: [PATCH 19/23] gleam: 0.30.2 -> 0.30.5

---
 pkgs/development/compilers/gleam/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/gleam/default.nix b/pkgs/development/compilers/gleam/default.nix
index d0e4f9994c87..ea82d72a481a 100644
--- a/pkgs/development/compilers/gleam/default.nix
+++ b/pkgs/development/compilers/gleam/default.nix
@@ -12,13 +12,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gleam";
-  version = "0.30.2";
+  version = "0.30.5";
 
   src = fetchFromGitHub {
     owner = "gleam-lang";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-XrXN+HZlCPzywFo10/vLHbz/zjglSZnNQKfYvLvx35I=";
+    hash = "sha256-DOQhuSNIyP6K+M9a/uM8Cn6gyzpaH23+n4fux8otPWQ=";
   };
 
   nativeBuildInputs = [ git pkg-config ];
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ] ++
     lib.optionals stdenv.isDarwin [ Security libiconv ];
 
-  cargoHash = "sha256-K7MrrnupH1BS8KEIgVdlnGF91J5ND5umgdeLVCg7DbQ=";
+  cargoHash = "sha256-CkMUconCw94Jvy7FhrOZvBbA8DAi91Ae5GFxGFBcEew=";
 
   passthru.updateScript = nix-update-script { };
 

From cf086d9ae6960e376d3370343cde8fa3ad3a2617 Mon Sep 17 00:00:00 2001
From: Damien Cassou <damien@cassou.me>
Date: Fri, 4 Aug 2023 08:49:16 +0200
Subject: [PATCH 20/23] safeeyes: Add passthru.tests.version

---
 pkgs/applications/misc/safeeyes/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/applications/misc/safeeyes/default.nix b/pkgs/applications/misc/safeeyes/default.nix
index f5cd73e03137..4b845737e7c8 100644
--- a/pkgs/applications/misc/safeeyes/default.nix
+++ b/pkgs/applications/misc/safeeyes/default.nix
@@ -7,6 +7,8 @@
 , libnotify
 , wlrctl
 , gtk3
+, safeeyes
+, testers
 , xprintidle
 , xprop
 , wrapGAppsHook
@@ -61,6 +63,8 @@ buildPythonApplication rec {
 
   doCheck = false; # no tests
 
+  passthru.tests.version = testers.testVersion { package = safeeyes; };
+
   meta = with lib; {
     homepage = "http://slgobinath.github.io/SafeEyes";
     description = "Protect your eyes from eye strain using this simple and beautiful, yet extensible break reminder. A Free and Open Source Linux alternative to EyeLeo";

From 3ebfba5f605d0ebe6d5962e7530524c3c23aa790 Mon Sep 17 00:00:00 2001
From: happysalada <raphael@megzari.com>
Date: Fri, 4 Aug 2023 14:54:01 +0800
Subject: [PATCH 21/23] zoxide: 0.9.1 -> 0.9.2

---
 pkgs/tools/misc/zoxide/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/misc/zoxide/default.nix b/pkgs/tools/misc/zoxide/default.nix
index 8d311223be75..cba030c8a653 100644
--- a/pkgs/tools/misc/zoxide/default.nix
+++ b/pkgs/tools/misc/zoxide/default.nix
@@ -10,13 +10,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zoxide";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "ajeetdsouza";
     repo = "zoxide";
     rev = "v${version}";
-    sha256 = "sha256-qmT/gTkizZpyYN/YdobBq2vunGM5SpNpCHIFmg8nPhk=";
+    sha256 = "sha256-h/T3McaKKASwQt+0SBBxFXMnYyt+0Xl+5i8IulUAdnU=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage rec {
       --replace '"fzf"' '"${fzf}/bin/fzf"'
   '';
 
-  cargoSha256 = "sha256-1sW6bvRJJp+qT5A9+l8wN3TQuzFDiBoeLyY5JvAA7dQ=";
+  cargoSha256 = "sha256-uu7zi6prnfbi4EQ0+0QcTEo/t5CIwNEQgJkIgxSk5u4=";
 
   postInstall = ''
     installManPage man/man*/*

From 74e9b9cd498824105d65c08faf084a157fad9817 Mon Sep 17 00:00:00 2001
From: aleksana <me@aleksana.moe>
Date: Thu, 3 Aug 2023 15:36:23 +0800
Subject: [PATCH 22/23] openvi: 7.3.22 -> 7.4.23

---
 pkgs/applications/editors/openvi/default.nix | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/pkgs/applications/editors/openvi/default.nix b/pkgs/applications/editors/openvi/default.nix
index e104c4dd7591..19da3daf78fc 100644
--- a/pkgs/applications/editors/openvi/default.nix
+++ b/pkgs/applications/editors/openvi/default.nix
@@ -1,30 +1,22 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , ncurses
+, perl
 }:
 
 stdenv.mkDerivation rec {
   pname = "openvi";
-  version = "7.3.22";
+  version = "7.4.23";
 
   src = fetchFromGitHub {
     owner = "johnsonjh";
     repo = "OpenVi";
     rev = version;
-    hash = "sha256-yXYiH2FCT7ffRPmb28V54+KO1RLs8L9KHk3remkMWmA=";
+    hash = "sha256-DwecSnByRkjBFqy3gWJ0+1srF2YsNACqKrAITn6wXJw=";
   };
 
-  patches = [
-    # do not attempt to install to /var/tmp/vi.recover
-    (fetchpatch {
-      url = "https://github.com/johnsonjh/OpenVi/commit/5205f0234369963c443e83ca5028ca63feaaac91.patch";
-      hash = "sha256-hoKzQLnpdRbc48wffWbzFtivr20VqEPs4WRPXuDa/88=";
-    })
-  ];
-
-  buildInputs = [ ncurses ];
+  buildInputs = [ ncurses perl ];
 
   makeFlags = [
     "PREFIX=$(out)"

From 4f5308922f99987cabb1821b675da86948af00b4 Mon Sep 17 00:00:00 2001
From: zendo <linzway@qq.com>
Date: Fri, 4 Aug 2023 08:13:11 +0800
Subject: [PATCH 23/23] treewide: add meta.mainProgram

Related PR: https://github.com/NixOS/nixpkgs/pull/246386
---
 pkgs/applications/networking/nload/default.nix | 1 +
 pkgs/shells/any-nix-shell/default.nix          | 1 +
 pkgs/shells/zsh/default.nix                    | 1 +
 pkgs/tools/admin/procs/default.nix             | 1 +
 pkgs/tools/misc/exa/default.nix                | 1 +
 5 files changed, 5 insertions(+)

diff --git a/pkgs/applications/networking/nload/default.nix b/pkgs/applications/networking/nload/default.nix
index 8b97bbf4635a..e46a95d71e49 100644
--- a/pkgs/applications/networking/nload/default.nix
+++ b/pkgs/applications/networking/nload/default.nix
@@ -36,5 +36,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2;
     platforms = lib.platforms.linux;
     maintainers = [ lib.maintainers.devhell ];
+    mainProgram = "nload";
   };
 }
diff --git a/pkgs/shells/any-nix-shell/default.nix b/pkgs/shells/any-nix-shell/default.nix
index 095347a3ca99..fd4807e6d675 100644
--- a/pkgs/shells/any-nix-shell/default.nix
+++ b/pkgs/shells/any-nix-shell/default.nix
@@ -25,5 +25,6 @@ stdenv.mkDerivation rec {
     license = licenses.mit;
     homepage = "https://github.com/haslersn/any-nix-shell";
     maintainers = with maintainers; [ haslersn ];
+    mainProgram = "any-nix-shell";
   };
 }
diff --git a/pkgs/shells/zsh/default.nix b/pkgs/shells/zsh/default.nix
index 1297e622269f..d2bdd5d34d22 100644
--- a/pkgs/shells/zsh/default.nix
+++ b/pkgs/shells/zsh/default.nix
@@ -131,6 +131,7 @@ EOF
     homepage = "https://www.zsh.org/";
     maintainers = with lib.maintainers; [ pSub artturin ];
     platforms = lib.platforms.unix;
+    mainProgram = "zsh";
   };
 
   passthru = {
diff --git a/pkgs/tools/admin/procs/default.nix b/pkgs/tools/admin/procs/default.nix
index 03d26fd64988..b9c2a463909b 100644
--- a/pkgs/tools/admin/procs/default.nix
+++ b/pkgs/tools/admin/procs/default.nix
@@ -31,5 +31,6 @@ rustPlatform.buildRustPackage rec {
     changelog = "https://github.com/dalance/procs/raw/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ Br1ght0ne sciencentistguy ];
+    mainProgram = "procs";
   };
 }
diff --git a/pkgs/tools/misc/exa/default.nix b/pkgs/tools/misc/exa/default.nix
index 91d0b1c49d09..d22303e150c9 100644
--- a/pkgs/tools/misc/exa/default.nix
+++ b/pkgs/tools/misc/exa/default.nix
@@ -58,5 +58,6 @@ rustPlatform.buildRustPackage {
     homepage = "https://the.exa.website";
     license = licenses.mit;
     maintainers = with maintainers; [ ehegnes lilyball globin fortuneteller2k ];
+    mainProgram = "exa";
   };
 }