From 9a70845186c7b335de8e54e1962ab96b7ebe355d Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Sun, 24 Aug 2025 11:54:11 +0200
Subject: [PATCH 01/13] radicle-ci-broker: init at 0.21.0

---
 pkgs/by-name/ra/radicle-ci-broker/package.nix | 72 +++++++++++++++++++
 pkgs/by-name/ra/radicle-ci-broker/update.sh   | 18 +++++
 2 files changed, 90 insertions(+)
 create mode 100644 pkgs/by-name/ra/radicle-ci-broker/package.nix
 create mode 100755 pkgs/by-name/ra/radicle-ci-broker/update.sh

diff --git a/pkgs/by-name/ra/radicle-ci-broker/package.nix b/pkgs/by-name/ra/radicle-ci-broker/package.nix
new file mode 100644
index 000000000000..a25b9d43276a
--- /dev/null
+++ b/pkgs/by-name/ra/radicle-ci-broker/package.nix
@@ -0,0 +1,72 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromRadicle,
+  stdenv,
+  jq,
+  gitMinimal,
+  sqlite,
+  radicle-node,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "radicle-ci-broker";
+  version = "0.21.0";
+
+  src = fetchFromRadicle {
+    seed = "seed.radicle.xyz";
+    repo = "zwTxygwuz5LDGBq255RA2CbNGrz8";
+    node = "z6MkgEMYod7Hxfy9qCvDv5hYHkZ4ciWmLFgfvm3Wn1b2w2FV";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-c0Qo6dnR9rP4mLXODkNZp+AnhKS0tqJeh1KgzfHBRV4=";
+    leaveDotGit = true;
+    postFetch = ''
+      git -C $out rev-parse --short HEAD > $out/.git_head
+      rm -rf $out/.git
+    '';
+  };
+
+  cargoHash = "sha256-9MkZh1hlHgLC9rGmLx5ehtLtZfhXsCqrJrCJNr1edBU=";
+
+  postPatch = ''
+    substituteInPlace build.rs \
+      --replace-fail "let hash = " "let hash = \"$(<$src/.git_head)\"; "
+  '';
+
+  preCheck = ''
+    ln -s "$PWD/target/${stdenv.hostPlatform.rust.rustcTarget}/$cargoBuildType" target/debug
+  '';
+
+  nativeCheckInputs = [
+    jq
+    gitMinimal
+    sqlite
+    radicle-node
+  ];
+
+  checkFlags = [
+    "--skip=acceptance_criteria_for_upgrades"
+    "--skip=logs_adapter_stderr_output"
+    "--skip=process_queued_events"
+    "--skip=runs_adapter_with_configuration"
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Radicle CI broker";
+    homepage = "https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:zwTxygwuz5LDGBq255RA2CbNGrz8";
+    changelog = "https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:zwTxygwuz5LDGBq255RA2CbNGrz8/tree/NEWS.md";
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
+    maintainers = with lib.maintainers; [ defelo ];
+    mainProgram = "cib";
+  };
+})
diff --git a/pkgs/by-name/ra/radicle-ci-broker/update.sh b/pkgs/by-name/ra/radicle-ci-broker/update.sh
new file mode 100755
index 000000000000..1438e6cd9a70
--- /dev/null
+++ b/pkgs/by-name/ra/radicle-ci-broker/update.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils gnused gitMinimal nix-update
+
+set -euo pipefail
+
+dirname="$(dirname "${BASH_SOURCE[0]}")"
+
+url=$(nix-instantiate --eval --raw -A radicle-ci-broker.src.url)
+old_node=$(nix-instantiate --eval --raw -A radicle-ci-broker.src.node)
+
+ref=$(git ls-remote "$url" 'refs/namespaces/*/refs/tags/v*' \
+  | cut -f2 | grep -Ev '\^\{\}$' | sort -t/ -k6rV | head -1)
+[[ "$ref" =~ ^refs/namespaces/([^/]+)/refs/tags/v([^/]+)$ ]]
+new_node="${BASH_REMATCH[1]}"
+version="${BASH_REMATCH[2]}"
+
+sed -i "s/${old_node}/${new_node}/g" "${dirname}/package.nix"
+nix-update --version="$version" radicle-ci-broker

From cd2090d9d12f9b0da4bf814d5166101dda3e038a Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Mon, 25 Aug 2025 00:02:26 +0200
Subject: [PATCH 02/13] radicle-native-ci: init at 0.11.1

---
 pkgs/by-name/ra/radicle-native-ci/package.nix | 53 +++++++++++++++++++
 pkgs/by-name/ra/radicle-native-ci/update.sh   | 18 +++++++
 2 files changed, 71 insertions(+)
 create mode 100644 pkgs/by-name/ra/radicle-native-ci/package.nix
 create mode 100755 pkgs/by-name/ra/radicle-native-ci/update.sh

diff --git a/pkgs/by-name/ra/radicle-native-ci/package.nix b/pkgs/by-name/ra/radicle-native-ci/package.nix
new file mode 100644
index 000000000000..6fb5de3a329b
--- /dev/null
+++ b/pkgs/by-name/ra/radicle-native-ci/package.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromRadicle,
+  radicle-node,
+  gitMinimal,
+  writableTmpDirAsHomeHook,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "radicle-native-ci";
+  version = "0.11.1";
+
+  src = fetchFromRadicle {
+    seed = "seed.radicle.xyz";
+    repo = "z3qg5TKmN83afz2fj9z3fQjU8vaYE";
+    node = "z6MkgEMYod7Hxfy9qCvDv5hYHkZ4ciWmLFgfvm3Wn1b2w2FV";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-OjQBq4QopT4dr1/z73fqlGLjQIjUY51/II9m2qQMW1w=";
+  };
+
+  cargoHash = "sha256-zyEdlAXaooEkxD4aZ1poIUX3OwXtP4nFAyOWJDdw1p8=";
+
+  preCheck = ''
+    git config --global user.name nixbld
+    git config --global user.email nixbld@example.com
+  '';
+
+  nativeCheckInputs = [
+    writableTmpDirAsHomeHook
+    radicle-node
+    gitMinimal
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Radicle CI adapter for native CI";
+    homepage = "https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:z3qg5TKmN83afz2fj9z3fQjU8vaYE";
+    changelog = "https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:z3qg5TKmN83afz2fj9z3fQjU8vaYE/tree/NEWS.md";
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
+    maintainers = with lib.maintainers; [ defelo ];
+    mainProgram = "radicle-native-ci";
+  };
+})
diff --git a/pkgs/by-name/ra/radicle-native-ci/update.sh b/pkgs/by-name/ra/radicle-native-ci/update.sh
new file mode 100755
index 000000000000..2f31852ae34b
--- /dev/null
+++ b/pkgs/by-name/ra/radicle-native-ci/update.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils gnused gitMinimal nix-update
+
+set -euo pipefail
+
+dirname="$(dirname "${BASH_SOURCE[0]}")"
+
+url=$(nix-instantiate --eval --raw -A radicle-native-ci.src.url)
+old_node=$(nix-instantiate --eval --raw -A radicle-native-ci.src.node)
+
+ref=$(git ls-remote "$url" 'refs/namespaces/*/refs/tags/v*' \
+  | cut -f2 | grep -Ev '\^\{\}$' | sort -t/ -k6rV | head -1)
+[[ "$ref" =~ ^refs/namespaces/([^/]+)/refs/tags/v([^/]+)$ ]]
+new_node="${BASH_REMATCH[1]}"
+version="${BASH_REMATCH[2]}"
+
+sed -i "s/${old_node}/${new_node}/g" "${dirname}/package.nix"
+nix-update --version="$version" radicle-native-ci

From acb76ed4d12d6e8f23067b64d31db71239be1c6f Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Mon, 25 Aug 2025 20:29:44 +0200
Subject: [PATCH 03/13] nixos/radicle-ci-broker: init module

---
 .../manual/release-notes/rl-2511.section.md   |   2 +
 nixos/modules/module-list.nix                 |   1 +
 .../radicle/ci-broker.nix                     | 253 ++++++++++++++++++
 3 files changed, 256 insertions(+)
 create mode 100644 nixos/modules/services/continuous-integration/radicle/ci-broker.nix

diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index e31235421271..516a5a7c9cdf 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -58,6 +58,8 @@
 
 - [go-httpbin](https://github.com/mccutchen/go-httpbin), a reasonably complete and well-tested golang port of httpbin, with zero dependencies outside the go stdlib. Available as [services.go-httpbin](#opt-services.go-httpbin.enable).
 
+- [radicle-ci-broker](https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:zwTxygwuz5LDGBq255RA2CbNGrz8), runs CI for repositories in the local [Radicle](https://radicle.xyz/) node. Available as [services.radicle.ci.broker.enable](#opt-services.radicle.ci.broker.enable).
+
 - [llama-swap](https://github.com/mostlygeek/llama-swap), a light weight transparent proxy server that provides automatic model swapping to llama.cpp's server (or any server with an OpenAI compatible endpoint). Available as [](#opt-services.llama-swap.enable).
 
 - [tuwunel](https://matrix-construct.github.io/tuwunel/), a federated chat server implementing the Matrix protocol, forked from Conduwuit. Available as [services.matrix-tuwunel](#opt-services.matrix-tuwunel.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 4611e4efb324..ebc1ac37df3f 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -505,6 +505,7 @@
   ./services/continuous-integration/jenkins/default.nix
   ./services/continuous-integration/jenkins/job-builder.nix
   ./services/continuous-integration/jenkins/slave.nix
+  ./services/continuous-integration/radicle/ci-broker.nix
   ./services/continuous-integration/woodpecker/agents.nix
   ./services/continuous-integration/woodpecker/server.nix
   ./services/databases/aerospike.nix
diff --git a/nixos/modules/services/continuous-integration/radicle/ci-broker.nix b/nixos/modules/services/continuous-integration/radicle/ci-broker.nix
new file mode 100644
index 000000000000..9f428dfac92d
--- /dev/null
+++ b/nixos/modules/services/continuous-integration/radicle/ci-broker.nix
@@ -0,0 +1,253 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.radicle.ci.broker;
+
+  settingsFormat = pkgs.formats.json { };
+  configFile = pkgs.runCommand "ci-broker.json" { } (
+    ''
+      cp ${settingsFormat.generate "ci-broker.json" cfg.settings} $out
+    ''
+    + lib.optionalString cfg.checkConfig ''
+      ${lib.getExe' cfg.package "cib"} --config $out config
+    ''
+  );
+
+  RAD_HOME = "/var/lib/radicle";
+
+  # Convenient wrapper to run `cibtool` in the namespaces of `radicle-ci-broker.service`
+  cibtool-system = pkgs.writeShellScriptBin "cibtool-system" ''
+    set -o allexport
+    ${lib.toShellVars {
+      inherit RAD_HOME;
+      HOME = RAD_HOME;
+    }}
+    # Note that --env is not used to preserve host's envvars like $TERM
+    exec ${lib.getExe' pkgs.util-linux "nsenter"} -a \
+      -t "$(${lib.getExe' config.systemd.package "systemctl"} show -P MainPID radicle-ci-broker.service)" \
+      -S "$(${lib.getExe' config.systemd.package "systemctl"} show -P UID radicle-ci-broker.service)" \
+      -G "$(${lib.getExe' config.systemd.package "systemctl"} show -P GID radicle-ci-broker.service)" \
+      ${lib.getExe' cfg.package "cibtool"} --db ${lib.escapeShellArg cfg.settings.db} "$@"
+  '';
+in
+
+{
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  options.services.radicle.ci.broker = {
+    enable = lib.mkEnableOption "radicle-ci-broker";
+
+    package = lib.mkPackageOption pkgs "radicle-ci-broker" { };
+
+    stateDir = lib.mkOption {
+      type = lib.types.path;
+      description = "State directory of radicle-ci-broker.";
+      default = "/var/lib/radicle-ci";
+    };
+
+    logDir = lib.mkOption {
+      type = lib.types.path;
+      description = "Log directory of radicle-ci-broker.";
+      default = "/var/log/radicle-ci";
+    };
+
+    enableHardening = lib.mkEnableOption "systemd hardening" // {
+      default = true;
+      example = false;
+    };
+
+    checkConfig =
+      lib.mkEnableOption "checking the {file}`ci-broker.yaml` file resulting from [](#opt-services.radicle.ci.broker.settings)"
+      // {
+        default = true;
+        example = false;
+      };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+
+        options = {
+          db = lib.mkOption {
+            type = lib.types.path;
+            description = "Database file path.";
+            defaultText = lib.literalExpression ''"''${config.services.radicle.ci.broker.stateDir}/ci-broker.db"'';
+          };
+
+          report_dir = lib.mkOption {
+            type = lib.types.nullOr lib.types.path;
+            description = "Directory where HTML and JSON report pages are written.";
+            defaultText = lib.literalExpression ''"''${config.services.radicle.ci.broker.stateDir}/reports"'';
+          };
+
+          adapters = lib.mkOption {
+            type = lib.types.attrsOf (
+              lib.types.submodule {
+                freeformType = settingsFormat.type;
+
+                options = {
+                  command = lib.mkOption {
+                    type = lib.types.str;
+                    description = "Adapter command to run.";
+                  };
+                  env = lib.mkOption {
+                    type = lib.types.attrsOf settingsFormat.type;
+                    description = "Environment variables to add when running the adapter.";
+                    default = { };
+                  };
+                };
+              }
+            );
+            description = "CI adapters.";
+            default = { };
+          };
+
+          triggers = lib.mkOption {
+            type = lib.types.listOf (
+              lib.types.submodule {
+                freeformType = settingsFormat.type;
+
+                options = {
+                  adapter = lib.mkOption {
+                    type = lib.types.str;
+                    description = "Adapter name.";
+                  };
+
+                  filters = lib.mkOption {
+                    type = lib.types.listOf settingsFormat.type;
+                    description = "Trigger filter.";
+                  };
+                };
+              }
+            );
+            description = "CI triggers.";
+            default = [ ];
+          };
+        };
+      };
+      description = ''
+        Configuration of radicle-ci-broker.
+        See <https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:zwTxygwuz5LDGBq255RA2CbNGrz8/tree/doc/userguide.md#configuration> for more information.
+      '';
+      default = { };
+      example = lib.literalExpression ''
+        {
+          adapters.native = {
+            command = lib.getExe pkgs.radicle-native-ci;
+            config = { };
+            config_env = "RADICLE_NATIVE_CI";
+            env.PATH = lib.makeBinPath (with pkgs; [ bash coreutils ]);
+          };
+
+          triggers = [
+            {
+              adapter = "native";
+              filters = [
+                {
+                  And = [
+                    { HasFile = ".radicle/native.yaml"; }
+                    { Node = "z6MkgEMYod7Hxfy9qCvDv5hYHkZ4ciWmLFgfvm3Wn1b2w2FV"; }
+                    {
+                      Or = [
+                        "DefaultBranch"
+                        "PatchCreated"
+                        "PatchUpdated"
+                      ];
+                    }
+                  ];
+                }
+              ];
+            }
+          ];
+        }
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.services.radicle.enable;
+        message = "radicle-ci-broker requires a local radicle node to be running.";
+      }
+    ];
+
+    services.radicle.ci.broker.settings = {
+      db = lib.mkDefault "${cfg.stateDir}/ci-broker.db";
+      report_dir = lib.mkDefault "${cfg.stateDir}/reports";
+    };
+
+    systemd.services.radicle-ci-broker = {
+      wantedBy = [ "multi-user.target" ];
+
+      bindsTo = [ "radicle-node.service" ];
+      after = [ "radicle-node.service" ];
+
+      environment = { inherit RAD_HOME; };
+
+      serviceConfig = lib.mkMerge [
+        {
+          User = config.users.users.radicle.name;
+          Group = config.users.groups.radicle.name;
+          Restart = "always";
+
+          StateDirectory = lib.mkIf (cfg.stateDir == "/var/lib/radicle-ci") "radicle-ci";
+          LogsDirectory = lib.mkIf (cfg.logDir == "/var/log/radicle-ci") "radicle-ci";
+          RuntimeDirectory = "radicle-ci-broker";
+          WorkingDirectory = "/run/radicle-ci-broker";
+
+          BindReadOnlyPaths = config.systemd.services.radicle-node.serviceConfig.BindReadOnlyPaths;
+          ReadWritePaths = [ RAD_HOME ];
+
+          ExecStart = "${lib.getExe' cfg.package "cib"} --config ${configFile} process-events";
+        }
+
+        (lib.mkIf cfg.enableHardening {
+          AmbientCapabilities = "";
+          CapabilityBoundingSet = [ "" ];
+          DevicePolicy = "closed";
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [ "AF_INET AF_INET6 AF_UNIX" ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged"
+            "~@resources"
+          ];
+          UMask = "0066";
+        })
+      ];
+    };
+
+    systemd.tmpfiles.settings.radicle-ci-broker.${cfg.settings.report_dir}.d = {
+      user = config.users.users.radicle.name;
+      group = config.users.groups.radicle.name;
+    };
+
+    environment.systemPackages = [ cibtool-system ];
+  };
+}

From 125dc2330e845f7b4ee2ae768dfade114655bfba Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Mon, 25 Aug 2025 20:29:44 +0200
Subject: [PATCH 04/13] nixos/radicle-native-ci: init module

---
 .../manual/release-notes/rl-2511.section.md   |   2 +
 nixos/modules/module-list.nix                 |   1 +
 .../radicle/adapters/native.nix               | 141 ++++++++++++++++++
 .../radicle/ci-broker.nix                     |   5 +-
 4 files changed, 148 insertions(+), 1 deletion(-)
 create mode 100644 nixos/modules/services/continuous-integration/radicle/adapters/native.nix

diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 516a5a7c9cdf..a90ca3797fd4 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -60,6 +60,8 @@
 
 - [radicle-ci-broker](https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:zwTxygwuz5LDGBq255RA2CbNGrz8), runs CI for repositories in the local [Radicle](https://radicle.xyz/) node. Available as [services.radicle.ci.broker.enable](#opt-services.radicle.ci.broker.enable).
 
+- [radicle-native-ci](https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:z3qg5TKmN83afz2fj9z3fQjU8vaYE), an adapter for the [Radicle CI broker](https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:zwTxygwuz5LDGBq255RA2CbNGrz8), for performing CI runs locally. Available as [services.radicle.ci.adapters.native](#opt-services.radicle.ci.adapters.native.instances).
+
 - [llama-swap](https://github.com/mostlygeek/llama-swap), a light weight transparent proxy server that provides automatic model swapping to llama.cpp's server (or any server with an OpenAI compatible endpoint). Available as [](#opt-services.llama-swap.enable).
 
 - [tuwunel](https://matrix-construct.github.io/tuwunel/), a federated chat server implementing the Matrix protocol, forked from Conduwuit. Available as [services.matrix-tuwunel](#opt-services.matrix-tuwunel.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index ebc1ac37df3f..63964a5cac56 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -505,6 +505,7 @@
   ./services/continuous-integration/jenkins/default.nix
   ./services/continuous-integration/jenkins/job-builder.nix
   ./services/continuous-integration/jenkins/slave.nix
+  ./services/continuous-integration/radicle/adapters/native.nix
   ./services/continuous-integration/radicle/ci-broker.nix
   ./services/continuous-integration/woodpecker/agents.nix
   ./services/continuous-integration/woodpecker/server.nix
diff --git a/nixos/modules/services/continuous-integration/radicle/adapters/native.nix b/nixos/modules/services/continuous-integration/radicle/adapters/native.nix
new file mode 100644
index 000000000000..5ac5d02fbbe6
--- /dev/null
+++ b/nixos/modules/services/continuous-integration/radicle/adapters/native.nix
@@ -0,0 +1,141 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.radicle.ci.adapters.native;
+  brokerCfg = config.services.radicle.ci.broker;
+
+  settingsFormat = pkgs.formats.yaml { };
+
+  enabledInstances = lib.filter (instance: instance.enable) (lib.attrValues cfg.instances);
+in
+
+{
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  options.services.radicle.ci.adapters.native = {
+    instances = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule (
+          { config, name, ... }:
+          {
+            options = {
+              enable = lib.mkEnableOption "this radicle-native-ci instance" // {
+                default = true;
+                example = false;
+              };
+
+              name = lib.mkOption {
+                type = lib.types.str;
+                description = ''
+                  Adapter name that is used in the radicle-ci-broker configuration.
+                  Defaults to the attribute name.
+                '';
+              };
+
+              package = lib.mkPackageOption pkgs "radicle-native-ci" { };
+
+              runtimePackages = lib.mkOption {
+                type = lib.types.listOf lib.types.package;
+                description = "Packages added to the adapter's {env}`PATH`.";
+                defaultText = lib.literalExpression ''
+                  with pkgs; [
+                    bash
+                    coreutils
+                    curl
+                    gawk
+                    gitMinimal
+                    gnused
+                    wget
+                  ]
+                '';
+              };
+
+              settings = lib.mkOption {
+                type = lib.types.submodule {
+                  freeformType = settingsFormat.type;
+
+                  options = {
+                    state = lib.mkOption {
+                      type = lib.types.path;
+                      description = "Directory where per-run directories are stored.";
+                      defaultText = lib.literalExpression ''"''${config.services.radicle.ci.broker.stateDir}/adapters/native/${config.name}"'';
+                    };
+
+                    log = lib.mkOption {
+                      type = lib.types.path;
+                      description = "File where radicle-native-ci should write the run log.";
+                      defaultText = lib.literalExpression ''"''${config.services.radicle.ci.broker.logDir}/adapters/native/${config.name}.log"'';
+                    };
+
+                    base_url = lib.mkOption {
+                      type = lib.types.nullOr lib.types.str;
+                      description = "Base URL for build logs (mandatory for access from CI broker page).";
+                      default = null;
+                    };
+                  };
+                };
+                description = ''
+                  Configuration of radicle-native-ci.
+                  See <https://app.radicle.xyz/nodes/seed.radicle.xyz/rad:z3qg5TKmN83afz2fj9z3fQjU8vaYE#configuration> for more information.
+                '';
+                default = { };
+              };
+            };
+
+            config = {
+              name = lib.mkDefault name;
+
+              runtimePackages = with pkgs; [
+                bash
+                coreutils
+                curl
+                gawk
+                gitMinimal
+                gnused
+                wget
+              ];
+
+              settings = {
+                state = lib.mkDefault "${brokerCfg.stateDir}/adapters/native/${config.name}";
+                log = lib.mkDefault "${brokerCfg.logDir}/adapters/native/${config.name}.log";
+              };
+            };
+          }
+        )
+      );
+      description = "radicle-native-ci adapter instances.";
+      default = { };
+    };
+  };
+
+  config = lib.mkIf (enabledInstances != [ ]) {
+    services.radicle.ci.broker.settings.adapters = lib.listToAttrs (
+      map (
+        instance:
+        lib.nameValuePair instance.name {
+          command = lib.getExe instance.package;
+          config = instance.settings;
+          config_env = "RADICLE_NATIVE_CI";
+          env.PATH = lib.makeBinPath instance.runtimePackages;
+        }
+      ) enabledInstances
+    );
+
+    systemd.tmpfiles.settings.radicle-native-ci = lib.listToAttrs (
+      map (
+        instance:
+        lib.nameValuePair (builtins.dirOf instance.settings.log) {
+          d = {
+            user = config.users.users.radicle.name;
+            group = config.users.groups.radicle.name;
+          };
+        }
+      ) enabledInstances
+    );
+  };
+}
diff --git a/nixos/modules/services/continuous-integration/radicle/ci-broker.nix b/nixos/modules/services/continuous-integration/radicle/ci-broker.nix
index 9f428dfac92d..d2616ba32b28 100644
--- a/nixos/modules/services/continuous-integration/radicle/ci-broker.nix
+++ b/nixos/modules/services/continuous-integration/radicle/ci-broker.nix
@@ -103,7 +103,10 @@ in
                 };
               }
             );
-            description = "CI adapters.";
+            description = ''
+              CI adapters.
+              See also the options under [services.radicle.ci.adapters](#opt-services.radicle.ci.adapters.native.instances).
+            '';
             default = { };
           };
 

From c88215b4a8b4a08251a849548ecbd49a305aafca Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Mon, 25 Aug 2025 20:29:44 +0200
Subject: [PATCH 05/13] nixos/tests/radicle-ci-broker: init

---
 nixos/tests/all-tests.nix                     |   1 +
 nixos/tests/radicle-ci-broker.nix             | 137 ++++++++++++++++++
 pkgs/by-name/ra/radicle-ci-broker/package.nix |   6 +-
 3 files changed, 143 insertions(+), 1 deletion(-)
 create mode 100644 nixos/tests/radicle-ci-broker.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 5edeb115fb5a..413240a23b8b 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1281,6 +1281,7 @@ in
   radarr = runTest ./radarr.nix;
   radicale = runTest ./radicale.nix;
   radicle = runTest ./radicle.nix;
+  radicle-ci-broker = runTest ./radicle-ci-broker.nix;
   ragnarwm = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ragnarwm.nix;
   rasdaemon = runTest ./rasdaemon.nix;
   rathole = runTest ./rathole.nix;
diff --git a/nixos/tests/radicle-ci-broker.nix b/nixos/tests/radicle-ci-broker.nix
new file mode 100644
index 000000000000..849192664571
--- /dev/null
+++ b/nixos/tests/radicle-ci-broker.nix
@@ -0,0 +1,137 @@
+{ lib, pkgs, ... }:
+
+let
+  seed-nid = "z6Mkg52RcwDrPKRzzHaYgBkHH3Gi5p4694fvPstVE9HTyMB6";
+  seed-ssh-keys = import ./ssh-keys.nix pkgs;
+
+  radicleConfig =
+    alias:
+    pkgs.writeText "config.json" (
+      builtins.toJSON {
+        preferredSeeds = [ "${seed-nid}@seed:8776" ];
+        node = { inherit alias; };
+      }
+    );
+in
+
+{
+  name = "radicle-ci-broker";
+  meta.maintainers = with lib.maintainers; [ defelo ];
+
+  nodes.seed = {
+    services.radicle = {
+      enable = true;
+      privateKeyFile = seed-ssh-keys.snakeOilEd25519PrivateKey;
+      publicKey = seed-ssh-keys.snakeOilEd25519PublicKey;
+      node.openFirewall = true;
+      settings = {
+        preferredSeeds = [ ];
+        node.alias = "seed";
+      };
+
+      ci = {
+        adapters.native.instances.native = { };
+        broker = {
+          enable = true;
+          settings.triggers = [
+            {
+              adapter = "native";
+              filters = [
+                {
+                  And = [
+                    { HasFile = ".radicle/native.yaml"; }
+                    "DefaultBranch"
+                  ];
+                }
+              ];
+            }
+          ];
+        };
+      };
+    };
+  };
+
+  nodes.alice =
+    { pkgs, ... }:
+    {
+      environment.etc."gitconfig".text = ''
+        [init]
+          defaultBranch = main
+        [user]
+          email = root@alice
+          name = alice
+      '';
+
+      environment.systemPackages = with pkgs; [
+        gitMinimal
+        radicle-node
+        radicle-job
+      ];
+    };
+
+  testScript = ''
+    import json
+    import time
+
+    start_all()
+
+    seed.wait_for_unit("radicle-ci-broker.service")
+
+    alice.succeed("rad auth --alias alice --stdin </dev/null")
+    alice.copy_from_host("${radicleConfig "alice"}", "/root/.radicle/config.json")
+    alice.succeed("rad node start")
+
+    alice_nid = alice.succeed("rad self --nid").strip()
+
+    alice.succeed("mkdir /tmp/repo")
+    alice.succeed("git -C /tmp/repo init")
+    alice.succeed("mkdir /tmp/repo/.radicle")
+    alice.succeed("echo 'shell: echo -n it works > /run/radicle-ci-broker/result' > /tmp/repo/.radicle/native.yaml")
+    alice.succeed("git -C /tmp/repo add .")
+    alice.succeed("git -C /tmp/repo commit -m init")
+
+    alice.succeed("cd /tmp/repo && rad init --name repo --description \"\" --default-branch main --public")
+    rid = alice.succeed("rad inspect --rid /tmp/repo").strip()
+
+    def git_head():
+      return alice.succeed("git -C /tmp/repo rev-parse HEAD").strip()
+
+    def list_runs(oid):
+      alice.succeed(f"rad sync {rid} -f")
+      jobs = json.loads(alice.succeed(f"rad job --repository {rid} list"))["jobs"]
+      return [
+        {"node_id": run["node_id"], **node_run}
+        for job in jobs if job["oid"] == oid
+        for run in job["runs"] for node_run in run["runs"]
+      ]
+
+    def run_succeeded(run):
+      return run["node_id"] == "${seed-nid}" and run["status"] == {"Finished": "Succeeded"}
+
+    def _retry(f):
+      for _ in range(10):
+        if out := f(): return out
+        time.sleep(1)
+      assert False
+
+    assert list_runs(head := git_head()) == []
+    seed.succeed(f"rad-system seed {rid}")
+    assert seed.wait_until_succeeds("cat /run/radicle-ci-broker/result") == "it works"
+    _retry(lambda: len(runs := list_runs(head)) == 1 and run_succeeded(runs[0]))
+
+    alice.succeed("echo 'shell: echo -n second commit > /run/radicle-ci-broker/result2' > /tmp/repo/.radicle/native.yaml")
+    alice.succeed("git -C /tmp/repo add .")
+    alice.succeed("git -C /tmp/repo commit -m 2")
+    assert list_runs(head := git_head()) == []
+    alice.succeed("git -C /tmp/repo push")
+    assert seed.wait_until_succeeds("cat /run/radicle-ci-broker/result2") == "second commit"
+    run = _retry(lambda: len(runs := list_runs(head)) == 1 and run_succeeded(run := runs[0]) and run)
+
+    seed.succeed("rm /run/radicle-ci-broker/result2")
+    seed.fail("cat /run/radicle-ci-broker/result2")
+    seed.succeed(f"cibtool-system trigger --repo repo --node {alice_nid} --commit main")
+    assert seed.wait_until_succeeds("cat /run/radicle-ci-broker/result2") == "second commit"
+    _retry(lambda: len(runs := sorted(list_runs(head), key=run.__ne__)) == 2
+      and runs[0] == run and runs[1]["run_id"] != run["run_id"] and run_succeeded(runs[1]))
+  '';
+}
diff --git a/pkgs/by-name/ra/radicle-ci-broker/package.nix b/pkgs/by-name/ra/radicle-ci-broker/package.nix
index a25b9d43276a..532466da8fa1 100644
--- a/pkgs/by-name/ra/radicle-ci-broker/package.nix
+++ b/pkgs/by-name/ra/radicle-ci-broker/package.nix
@@ -8,6 +8,7 @@
   sqlite,
   radicle-node,
   versionCheckHook,
+  nixosTests,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -56,7 +57,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
   versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
-  passthru.updateScript = ./update.sh;
+  passthru = {
+    tests = { inherit (nixosTests) radicle-ci-broker; };
+    updateScript = ./update.sh;
+  };
 
   meta = {
     description = "Radicle CI broker";

From 88ff20cd445287cad9a8d2687fc73a7073aba0e7 Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Sat, 4 Oct 2025 00:24:28 +0400
Subject: [PATCH 06/13] svxlink: migrate to by-name

---
 .../default.nix => by-name/sv/svxlink/package.nix}     | 10 ++++------
 pkgs/top-level/all-packages.nix                        |  2 --
 2 files changed, 4 insertions(+), 8 deletions(-)
 rename pkgs/{applications/radio/svxlink/default.nix => by-name/sv/svxlink/package.nix} (95%)

diff --git a/pkgs/applications/radio/svxlink/default.nix b/pkgs/by-name/sv/svxlink/package.nix
similarity index 95%
rename from pkgs/applications/radio/svxlink/default.nix
rename to pkgs/by-name/sv/svxlink/package.nix
index e3db5ce7eb2f..b83751ef2a77 100644
--- a/pkgs/applications/radio/svxlink/default.nix
+++ b/pkgs/by-name/sv/svxlink/package.nix
@@ -13,9 +13,7 @@
   libgcrypt,
   libsigcxx,
   popt,
-  qtbase,
-  qttools,
-  wrapQtAppsHook,
+  qt5,
   rtl-sdr,
   tcl,
   doxygen,
@@ -63,7 +61,7 @@ stdenv.mkDerivation rec {
     pkg-config
     doxygen
     groff
-    wrapQtAppsHook
+    qt5.wrapQtAppsHook
   ];
 
   buildInputs = [
@@ -74,8 +72,8 @@ stdenv.mkDerivation rec {
     libsigcxx
     libopus
     popt
-    qtbase
-    qttools
+    qt5.qtbase
+    qt5.qttools
     rtl-sdr
     speex
     tcl
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 069ee2a27620..1082b5321cb4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8895,8 +8895,6 @@ with pkgs;
 
   structuresynth = libsForQt5.callPackage ../development/libraries/structuresynth { };
 
-  svxlink = libsForQt5.callPackage ../applications/radio/svxlink { };
-
   szurubooru = callPackage ../servers/web-apps/szurubooru { };
 
   tclap = tclap_1_2;

From 8bb9de554e470794bceda87a174802f8621b71d4 Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Sat, 4 Oct 2025 00:43:43 +0400
Subject: [PATCH 07/13] svxlink: modernize

---
 pkgs/by-name/sv/svxlink/package.nix | 47 ++++++++++-------------------
 1 file changed, 16 insertions(+), 31 deletions(-)

diff --git a/pkgs/by-name/sv/svxlink/package.nix b/pkgs/by-name/sv/svxlink/package.nix
index b83751ef2a77..c26357a8ffb1 100644
--- a/pkgs/by-name/sv/svxlink/package.nix
+++ b/pkgs/by-name/sv/svxlink/package.nix
@@ -4,13 +4,13 @@
   cmake,
   pkg-config,
   fetchFromGitHub,
-  makeDesktopItem,
   alsa-lib,
   speex,
   libopus,
   curl,
   gsm,
   libgcrypt,
+  libgpiod_1,
   libsigcxx,
   popt,
   qt5,
@@ -21,46 +21,33 @@
   jsoncpp,
 }:
 
-let
-  desktopItem = makeDesktopItem rec {
-    name = "Qtel";
-    exec = "qtel";
-    icon = "qtel";
-    desktopName = name;
-    genericName = "EchoLink Client";
-    categories = [
-      "HamRadio"
-      "Qt"
-      "Network"
-    ];
-  };
-
-in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "svxlink";
   version = "25.05.1";
 
   src = fetchFromGitHub {
     owner = "sm0svx";
     repo = "svxlink";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-OyAR/6heGX6J53p6x+ZPXY6nzSv22umMTg0ISlWcjp8=";
   };
 
+  sourceRoot = "${finalAttrs.src.name}/src";
+
   cmakeFlags = [
-    "-DDO_INSTALL_CHOWN=NO"
-    "-DRTLSDR_LIBRARIES=${rtl-sdr}/lib/librtlsdr.so"
-    "-DRTLSDR_INCLUDE_DIRS=${rtl-sdr}/include"
-    "../src"
+    (lib.cmakeBool "DO_INSTALL_CHOWN" false)
+    (lib.cmakeFeature "RTLSDR_LIBRARIES" "${rtl-sdr}/lib/librtlsdr.so")
+    (lib.cmakeFeature "RTLSDR_INCLUDE_DIRS" "${rtl-sdr}/include")
   ];
 
   dontWrapQtApps = true;
 
   nativeBuildInputs = [
     cmake
-    pkg-config
     doxygen
     groff
+    pkg-config
+    qt5.qttools
     qt5.wrapQtAppsHook
   ];
 
@@ -68,21 +55,19 @@ stdenv.mkDerivation rec {
     alsa-lib
     curl
     gsm
+    jsoncpp
     libgcrypt
-    libsigcxx
+    libgpiod_1
     libopus
+    libsigcxx
     popt
     qt5.qtbase
-    qt5.qttools
     rtl-sdr
     speex
     tcl
-    jsoncpp
   ];
 
   postInstall = ''
-    rm -rf $out/share/applications
-    ln -s ${desktopItem}/share/applications $out/share/applications
     wrapQtApp $out/bin/qtel
   '';
 
@@ -92,9 +77,9 @@ stdenv.mkDerivation rec {
       Advanced repeater controller and EchoLink software for Linux including a
       GUI, Qtel - The Qt EchoLink client
     '';
-    homepage = "http://www.svxlink.org/";
-    license = with lib.licenses; [ gpl2 ];
+    homepage = "https://www.svxlink.org/";
+    license = with lib.licenses; [ gpl2Plus ];
     maintainers = with lib.maintainers; [ zaninime ];
     platforms = lib.platforms.linux;
   };
-}
+})

From ef47e99112648a072ebc1db3c5f6f52e8e9f8680 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 11 Oct 2025 13:42:54 +0300
Subject: [PATCH 08/13] ryubing: 1.3.2 -> 1.3.3

Diff: https://git.ryujinx.app/Ryubing/Ryujinx/-/compare/1.3.2...1.3.3

Changelog: https://git.ryujinx.app/ryubing/ryujinx/-/wikis/changelog
---
 pkgs/by-name/ry/ryubing/deps.json   | 53 +++++++++++++----------------
 pkgs/by-name/ry/ryubing/package.nix |  4 +--
 2 files changed, 25 insertions(+), 32 deletions(-)

diff --git a/pkgs/by-name/ry/ryubing/deps.json b/pkgs/by-name/ry/ryubing/deps.json
index a98df2485f7a..a16e7e8307cf 100644
--- a/pkgs/by-name/ry/ryubing/deps.json
+++ b/pkgs/by-name/ry/ryubing/deps.json
@@ -126,13 +126,13 @@
   },
   {
     "pname": "DiscordRichPresence",
-    "version": "1.2.1.24",
-    "hash": "sha256-oRNrlF1/yK0QvrW2+48RsmSg9h9/pDIfA56/bpoHXFU="
+    "version": "1.6.1.70",
+    "hash": "sha256-uXTNIWfZU7Gf/JpXQ5ufKA3SQdXYSkg3yLm5yCrBDd8="
   },
   {
     "pname": "DynamicData",
-    "version": "9.0.4",
-    "hash": "sha256-3pyiJeWRwfaT7p1ArsoR13aI78Jo13aHOEw3BelTS9g="
+    "version": "9.4.1",
+    "hash": "sha256-CX4NQj2LTk/8f4xDE5rUVBsqcY74H/1qUHFTrVX+9/0="
   },
   {
     "pname": "ExCSS",
@@ -151,8 +151,8 @@
   },
   {
     "pname": "Gommon",
-    "version": "2.7.1.1",
-    "hash": "sha256-2AnVtyEbg5A+K/LDjgOpKw/CNRDkAhjVa38L5LYYyrw="
+    "version": "2.7.2.1",
+    "hash": "sha256-QxrgAaVuHeUR8QZDHdT/9np9ADrE+nwjw9vT9DhXVf4="
   },
   {
     "pname": "HarfBuzzSharp",
@@ -559,11 +559,6 @@
     "version": "1.1.0",
     "hash": "sha256-FeM40ktcObQJk4nMYShB61H/E8B7tIKfl9ObJ0IOcCM="
   },
-  {
-    "pname": "Microsoft.NETCore.Platforms",
-    "version": "2.0.0",
-    "hash": "sha256-IEvBk6wUXSdyCnkj6tHahOJv290tVVT8tyemYcR0Yro="
-  },
   {
     "pname": "Microsoft.NETCore.Platforms",
     "version": "2.1.2",
@@ -584,11 +579,6 @@
     "version": "17.9.0",
     "hash": "sha256-1BZIY1z+C9TROgdTV/tq4zsPy7Q71GQksr/LoMKAzqU="
   },
-  {
-    "pname": "Microsoft.Win32.Registry",
-    "version": "4.5.0",
-    "hash": "sha256-WMBXsIb0DgPFPaFkNVxY9b9vcMxPqtgFgijKYMJfV/0="
-  },
   {
     "pname": "MsgPack.Cli",
     "version": "1.0.1",
@@ -801,14 +791,27 @@
   },
   {
     "pname": "Ryujinx.LibHac",
-    "version": "0.20.0",
-    "hash": "sha256-msrn9BElOOGtQAz6oK3HbMeyLOQ10Xt8wT0Qyr8NwYU="
+    "version": "0.21.0-alpha.116",
+    "hash": "sha256-ldma+AbTb75/cwWdLbRg5V0eCIqtyovT6zjh50JRvgo=",
+    "url": "https://git.ryujinx.app/api/v4/projects/17/packages/nuget/download/ryujinx.libhac/0.21.0-alpha.116/ryujinx.libhac.0.21.0-alpha.116.nupkg"
   },
   {
     "pname": "Ryujinx.SDL2-CS",
     "version": "2.30.0-build32",
     "hash": "sha256-KrrlDq0pXcunnOhJL12dt1CAdNbaupbDlnza5gXuVKE="
   },
+  {
+    "pname": "Ryujinx.Systems.Update.Common",
+    "version": "1.0.44",
+    "hash": "sha256-gYCmB2nbOlDJAd0hEAAjPXZmju4sd7DH+i6ciBWSRb4=",
+    "url": "https://git.ryujinx.app/api/v4/projects/71/packages/nuget/download/ryujinx.systems.update.common/1.0.44/ryujinx.systems.update.common.1.0.44.nupkg"
+  },
+  {
+    "pname": "Ryujinx.UpdateClient",
+    "version": "1.0.44",
+    "hash": "sha256-b/z8jPkU7Pc10g4gscgl8pD/NtQPT8EDA0SpKVZLW8U=",
+    "url": "https://git.ryujinx.app/api/v4/projects/71/packages/nuget/download/ryujinx.updateclient/1.0.44/ryujinx.updateclient.1.0.44.nupkg"
+  },
   {
     "pname": "securifybv.PropertyStore",
     "version": "0.1.0",
@@ -821,8 +824,8 @@
   },
   {
     "pname": "Sep",
-    "version": "0.6.0",
-    "hash": "sha256-O7v1QBhdzoKTq0cGWEvXOk3H6l85TliETqCLeKnhZwE="
+    "version": "0.11.1",
+    "hash": "sha256-GkDWF51QOIKUu55By5ya471KrwXvQbm98DOo/zV0Bew="
   },
   {
     "pname": "shaderc.net",
@@ -1149,16 +1152,6 @@
     "version": "4.3.0",
     "hash": "sha256-8sDH+WUJfCR+7e4nfpftj/+lstEiZixWUBueR2zmHgI="
   },
-  {
-    "pname": "System.Security.AccessControl",
-    "version": "4.5.0",
-    "hash": "sha256-AFsKPb/nTk2/mqH/PYpaoI8PLsiKKimaXf+7Mb5VfPM="
-  },
-  {
-    "pname": "System.Security.Principal.Windows",
-    "version": "4.5.0",
-    "hash": "sha256-BkUYNguz0e4NJp1kkW7aJBn3dyH9STwB5N8XqnlCsmY="
-  },
   {
     "pname": "System.Text.Encoding",
     "version": "4.3.0",
diff --git a/pkgs/by-name/ry/ryubing/package.nix b/pkgs/by-name/ry/ryubing/package.nix
index ea690c0f8968..d84777c5ee3e 100644
--- a/pkgs/by-name/ry/ryubing/package.nix
+++ b/pkgs/by-name/ry/ryubing/package.nix
@@ -32,14 +32,14 @@
 
 buildDotnetModule rec {
   pname = "ryubing";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitLab {
     domain = "git.ryujinx.app";
     owner = "Ryubing";
     repo = "Ryujinx";
     tag = version;
-    hash = "sha256-6BCDFd0nU96OgI5lqf4fbyNkG4PS5P4raHVbvBAhB5A=";
+    hash = "sha256-LhQaXxmj5HIgfmrsDN8GhhVXlXHpDO2Q8JtNLaCq0mk=";
   };
 
   nativeBuildInputs =

From c6b60d196180eb229bc54652a025037fe7db8838 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 11 Oct 2025 15:26:09 +0300
Subject: [PATCH 09/13] treewide: drop 'tinyxml2' alias

We have tinyxml, tinyxml2, which is an alias for tinyxml,
and tinyxml-2, which is an entirely different thing.
This is very confusing. Reduce confusion by removing the alias.
---
 pkgs/applications/video/kodi/unwrapped.nix | 4 ++--
 pkgs/games/pokerth/default.nix             | 4 ++--
 pkgs/tools/filesystems/encfs/default.nix   | 4 ++--
 pkgs/top-level/aliases.nix                 | 1 +
 pkgs/top-level/all-packages.nix            | 8 ++------
 5 files changed, 9 insertions(+), 12 deletions(-)

diff --git a/pkgs/applications/video/kodi/unwrapped.nix b/pkgs/applications/video/kodi/unwrapped.nix
index d737a2151097..22719bf31bb4 100644
--- a/pkgs/applications/video/kodi/unwrapped.nix
+++ b/pkgs/applications/video/kodi/unwrapped.nix
@@ -26,7 +26,7 @@
   which,
   openssl,
   gperf,
-  tinyxml2,
+  tinyxml,
   tinyxml-2,
   taglib,
   libssh,
@@ -299,7 +299,7 @@ stdenv.mkDerivation (
       libdrm
       openssl
       gperf
-      tinyxml2
+      tinyxml
       tinyxml-2
       taglib
       libssh
diff --git a/pkgs/games/pokerth/default.nix b/pkgs/games/pokerth/default.nix
index 1f3e43e02d1f..5321d15eafff 100644
--- a/pkgs/games/pokerth/default.nix
+++ b/pkgs/games/pokerth/default.nix
@@ -15,7 +15,7 @@
   protobuf,
   sqlite,
   wrapQtAppsHook,
-  tinyxml2,
+  tinyxml,
   target ? "client",
 }:
 
@@ -77,7 +77,7 @@ mkDerivation rec {
     protobuf
     qtbase
     sqlite
-    tinyxml2
+    tinyxml
   ];
 
   qmakeFlags = [
diff --git a/pkgs/tools/filesystems/encfs/default.nix b/pkgs/tools/filesystems/encfs/default.nix
index 7d43131ea403..08e14c7624d6 100644
--- a/pkgs/tools/filesystems/encfs/default.nix
+++ b/pkgs/tools/filesystems/encfs/default.nix
@@ -9,7 +9,7 @@
   gettext,
   fuse,
   openssl,
-  tinyxml2,
+  tinyxml-2,
   gtest,
 }:
 
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     fuse
     openssl
-    tinyxml2
+    tinyxml-2
     gtest
   ];
   nativeBuildInputs = [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 8880d26a6e64..9b649d0d2c43 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -2608,6 +2608,7 @@ mapAliases {
   timescale-prometheus = throw "'timescale-prometheus' has been renamed to/replaced by 'promscale'"; # Converted to throw 2024-10-17
   tightvnc = throw "'tightvnc' has been removed as the version 1.3 is not maintained upstream anymore and is insecure"; # Added 2024-08-22
   timelens = throw "'timelens' has been removed due to lack of upstream maintenance"; # Added 2025-01-25
+  tinyxml2 = throw "The 'tinyxml2' alias has been removed, use 'tinyxml' for https://sourceforge.net/projects/tinyxml/ or 'tinyxml-2' for https://github.com/leethomason/tinyxml2"; # Added 2025-10-11
   tix = tclPackages.tix; # Added 2024-10-02
   tkcvs = tkrev; # Added 2022-03-07
   tkgate = throw "'tkgate' has been removed as it is unmaintained"; # Added 2025-05-17
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7929573bb49d..9b99e96907c0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2703,9 +2703,7 @@ with pkgs;
 
   emborg = python3Packages.callPackage ../development/python-modules/emborg { };
 
-  encfs = callPackage ../tools/filesystems/encfs {
-    tinyxml2 = tinyxml-2;
-  };
+  encfs = callPackage ../tools/filesystems/encfs { };
 
   ethercalc = callPackage ../servers/web-apps/ethercalc { };
 
@@ -8747,9 +8745,7 @@ with pkgs;
 
   tclap_1_4 = callPackage ../development/libraries/tclap/1.4.nix { };
 
-  tinyxml = tinyxml2;
-
-  tinyxml2 = callPackage ../development/libraries/tinyxml/2.6.2.nix { };
+  tinyxml = callPackage ../development/libraries/tinyxml/2.6.2.nix { };
 
   tk = tk-8_6;
 

From f4c43fa8e294ee1a5c875b79b510c3ab8be20786 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Oct 2025 14:41:00 +0000
Subject: [PATCH 10/13] cargo-temp: 0.3.4 -> 0.3.5

---
 pkgs/by-name/ca/cargo-temp/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-temp/package.nix b/pkgs/by-name/ca/cargo-temp/package.nix
index afe2dab17d27..bfe22cef9c51 100644
--- a/pkgs/by-name/ca/cargo-temp/package.nix
+++ b/pkgs/by-name/ca/cargo-temp/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-temp";
-  version = "0.3.4";
+  version = "0.3.5";
 
   src = fetchFromGitHub {
     owner = "yozhgoor";
     repo = "cargo-temp";
     rev = "v${version}";
-    hash = "sha256-SE96RFOW3/BHglOnQa/Hd5rwyzQLQLaa7wlNio57uMI=";
+    hash = "sha256-kCiw3a9C78mcJ2/bX+E5gXZKYcfLXF0crMIZu4cJsdY=";
   };
 
-  cargoHash = "sha256-osGKIskHZAx6gXbpYJua7pL02CdKmiudwnokUSM/U+E=";
+  cargoHash = "sha256-7S7L/OKHTOAP9tbM7+xWhvcYBZScvX6SBW3U1AyFGrs=";
 
   meta = with lib; {
     description = "CLI tool that allow you to create a temporary new Rust project using cargo with already installed dependencies";

From a5a5ef7d51b44f125ffcbdad1cd7d482eec77915 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Oct 2025 17:11:14 +0000
Subject: [PATCH 11/13] remnote: 1.21.5 -> 1.21.8

---
 pkgs/by-name/re/remnote/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/re/remnote/package.nix b/pkgs/by-name/re/remnote/package.nix
index fe3b126810ee..7a490b8baf6b 100644
--- a/pkgs/by-name/re/remnote/package.nix
+++ b/pkgs/by-name/re/remnote/package.nix
@@ -6,10 +6,10 @@
 }:
 let
   pname = "remnote";
-  version = "1.21.5";
+  version = "1.21.8";
   src = fetchurl {
     url = "https://download2.remnote.io/remnote-desktop2/RemNote-${version}.AppImage";
-    hash = "sha256-Tq8qyjlyB/1tQkB5rLVSLy8HbpnfBZ4QmNQB/CVEiN0=";
+    hash = "sha256-KJHdLHmLGYYxv4eKCDoUsTn3bhWg3h8QOlwmtxNFC6Y=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in

From 240e3c90dac4908c28aba6a59e00309a0edeb020 Mon Sep 17 00:00:00 2001
From: Markus Hauck <markus1189@gmail.com>
Date: Sat, 11 Oct 2025 19:11:22 +0200
Subject: [PATCH 12/13] claude-code: 2.0.11 -> 2.0.14

https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md
---
 .../vscode/extensions/anthropic.claude-code/default.nix     | 4 ++--
 pkgs/by-name/cl/claude-code/package-lock.json               | 4 ++--
 pkgs/by-name/cl/claude-code/package.nix                     | 6 +++---
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
index f9ab6f4edaff..983376d01fb0 100644
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-code";
     publisher = "anthropic";
-    version = "2.0.10";
-    hash = "sha256-wtqtjvU7HZZWUxRRN/H7I0lgCMRzGZy/Mu5s30ZbJ0g=";
+    version = "2.0.14";
+    hash = "sha256-+3GkCBfAAIaORU+qKGv6OmN2w9aXt3QKMgWtyLMJUS0=";
   };
 
   meta = {
diff --git a/pkgs/by-name/cl/claude-code/package-lock.json b/pkgs/by-name/cl/claude-code/package-lock.json
index 4c777b7c6946..3c76d6cb7b1c 100644
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@anthropic-ai/claude-code",
-  "version": "2.0.1",
+  "version": "2.0.14",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@anthropic-ai/claude-code",
-      "version": "2.0.1",
+      "version": "2.0.14",
       "license": "SEE LICENSE IN README.md",
       "bin": {
         "claude": "cli.js"
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index b57c1bfde1f0..077af090e2eb 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -7,14 +7,14 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "claude-code";
-  version = "2.0.11";
+  version = "2.0.14";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${finalAttrs.version}.tgz";
-    hash = "sha256-h+xNtaA2X9uFlmQgaRUEXB0utIpC9FT2tn+QnnWMVSs=";
+    hash = "sha256-U/wd00eva/qbSS4LpW1L7nmPW4dT9naffeMkHQ5xr5o=";
   };
 
-  npmDepsHash = "sha256-DehkeMZvzn+hvcCDzJfd4p9oYc1GSZm8gu8vKS4Uncw=";
+  npmDepsHash = "sha256-ugI5JSCxEneQmIMF2rzOWihMw9RuZjNco4YRNmaQ69A=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json

From 673688270192d181618d94e10fd876e066f76040 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Oct 2025 17:15:27 +0000
Subject: [PATCH 13/13] home-assistant-custom-components.frigate: 5.9.4 ->
 5.10.0

---
 .../home-assistant/custom-components/frigate/package.nix      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/frigate/package.nix b/pkgs/servers/home-assistant/custom-components/frigate/package.nix
index 7f701a6aee4b..4dba06a69378 100644
--- a/pkgs/servers/home-assistant/custom-components/frigate/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/frigate/package.nix
@@ -18,13 +18,13 @@
 buildHomeAssistantComponent rec {
   owner = "blakeblackshear";
   domain = "frigate";
-  version = "5.9.4";
+  version = "5.10.0";
 
   src = fetchFromGitHub {
     owner = "blakeblackshear";
     repo = "frigate-hass-integration";
     tag = "v${version}";
-    hash = "sha256-LzrIvHJMB6mFAEfKoMIs0wL+xbEjoBIx48pSEcCHmg4=";
+    hash = "sha256-rhYShAb251LfcrBjarcle041AWVSEi0wqc9/W1SlgUo=";
   };
 
   dependencies = [ hass-web-proxy-lib ];