Merge master into staging-next

maintainers/maintainer-list.nix

@@ -11437,6 +11437,12 @@
     githubId = 458783;
     name = "Martin Gammelsæter";
   };
+  martinjlowm = {
+    email = "martin@martinjlowm.dk";
+    github = "martinjlowm";
+    githubId = 110860;
+    name = "Martin Jesper Low Madsen";
+  };
   martinramm = {
     email = "martin-ramm@gmx.de";
     github = "MartinRamm";
@@ -15806,6 +15812,12 @@
     githubId = 7221768;
     name = "Andika Demas Riyandi";
   };
+  rjpcasalino = {
+    email = "ryan@rjpc.net";
+    github = "rjpcasalino";
+    githubId = 12821230;
+    name = "Ryan J.P. Casalino";
+  };
   rkitover = {
     email = "rkitover@gmail.com";
     github = "rkitover";

nixos/doc/manual/release-notes/rl-2405.section.md

@@ -68,6 +68,18 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 - `mkosi` was updated to v19. Parts of the user interface have changed. Consult the
   [release notes](https://github.com/systemd/mkosi/releases/tag/v19) for a list of changes.
 
+- `services.nginx` will no longer advertise HTTP/3 availability automatically. This must now be manually added, preferably to each location block.
+  Example:
+
+  ```nix
+    locations."/".extraConfig = ''
+      add_header Alt-Svc 'h3=":$server_port"; ma=86400';
+    '';
+    locations."^~ /assets/".extraConfig = ''
+      add_header Alt-Svc 'h3=":$server_port"; ma=86400';
+    '';
+
+  ```
 - The `kanata` package has been updated to v1.5.0, which includes [breaking changes](https://github.com/jtroo/kanata/releases/tag/v1.5.0).
 
 - The latest available version of Nextcloud is v28 (available as `pkgs.nextcloud28`). The installation logic is as follows:

nixos/lib/make-single-disk-zfs-image.nix

@@ -21,6 +21,9 @@
 , # size of the FAT partition, in megabytes.
   bootSize ? 1024
 
+  , # memory allocated for virtualized build instance
+  memSize ? 1024
+
 , # The size of the root partition, in megabytes.
   rootSize ? 2048
 
@@ -230,7 +233,7 @@ let
   ).runInLinuxVM (
     pkgs.runCommand name
       {
-        memSize = 1024;
+        inherit memSize;
         QEMU_OPTS = "-drive file=$rootDiskImage,if=virtio,cache=unsafe,werror=report";
         preVM = ''
           PATH=$PATH:${pkgs.qemu_kvm}/bin

nixos/maintainers/scripts/openstack/openstack-image-zfs.nix

@@ -20,6 +20,12 @@ in
       default = "nixos-openstack-image-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}";
     };
 
+    ramMB = mkOption {
+      type = types.int;
+      default = 1024;
+      description = lib.mdDoc "RAM allocation for build VM";
+    };
+
     sizeMB = mkOption {
       type = types.int;
       default = 8192;
@@ -64,7 +70,7 @@ in
       includeChannel = copyChannel;
 
       bootSize = 1000;
-
+      memSize = cfg.ramMB;
       rootSize = cfg.sizeMB;
       rootPoolProperties = {
         ashift = 12;

nixos/modules/services/admin/pgadmin.nix

@@ -44,12 +44,19 @@ in
 
     initialPasswordFile = mkOption {
       description = lib.mdDoc ''
-        Initial password file for the pgAdmin account.
+        Initial password file for the pgAdmin account. Minimum length by default is 6.
+        Please see `services.pgadmin.minimumPasswordLength`.
         NOTE: Should be string not a store path, to prevent the password from being world readable
       '';
       type = types.path;
     };
 
+    minimumPasswordLength = mkOption {
+      description = lib.mdDoc "Minimum length of the password";
+      type = types.int;
+      default = 6;
+    };
+
     emailServer = {
       enable = mkOption {
         description = lib.mdDoc ''
@@ -116,6 +123,7 @@ in
 
     services.pgadmin.settings = {
       DEFAULT_SERVER_PORT = cfg.port;
+      PASSWORD_LENGTH_MIN = cfg.minimumPasswordLength;
       SERVER_MODE = true;
       UPGRADE_CHECK_ENABLED = false;
     } // (optionalAttrs cfg.openFirewall {
@@ -141,6 +149,14 @@ in
 
       preStart = ''
         # NOTE: this is idempotent (aka running it twice has no effect)
+        # Check here for password length to prevent pgadmin from starting
+        # and presenting a hard to find error message
+        # see https://github.com/NixOS/nixpkgs/issues/270624
+        PW_LENGTH=$(wc -m < ${escapeShellArg cfg.initialPasswordFile})
+        if [ $PW_LENGTH -lt ${toString cfg.minimumPasswordLength} ]; then
+            echo "Password must be at least ${toString cfg.minimumPasswordLength} characters long"
+            exit 1
+        fi
         (
           # Email address:
           echo ${escapeShellArg cfg.initialEmail}

nixos/modules/services/mail/dovecot.nix

@@ -1,8 +1,11 @@
 { options, config, lib, pkgs, ... }:
 
-with lib;
-
 let
+  inherit (lib) any attrValues concatMapStringsSep concatStrings
+    concatStringsSep flatten imap1 isList literalExpression mapAttrsToList
+    mkEnableOption mkIf mkOption mkRemovedOptionModule optional optionalAttrs
+    optionalString singleton types;
+
   cfg = config.services.dovecot2;
   dovecotPkg = pkgs.dovecot;
 
@@ -113,6 +116,36 @@ let
       ''
     )
 
+    ''
+      plugin {
+        sieve_plugins = ${concatStringsSep " " cfg.sieve.plugins}
+        sieve_extensions = ${concatStringsSep " " (map (el: "+${el}") cfg.sieve.extensions)}
+        sieve_global_extensions = ${concatStringsSep " " (map (el: "+${el}") cfg.sieve.globalExtensions)}
+    ''
+    (optionalString (cfg.imapsieve.mailbox != []) ''
+      ${
+        concatStringsSep "\n" (flatten (imap1 (
+            idx: el:
+              singleton "imapsieve_mailbox${toString idx}_name = ${el.name}"
+              ++ optional (el.from != null) "imapsieve_mailbox${toString idx}_from = ${el.from}"
+              ++ optional (el.causes != null) "imapsieve_mailbox${toString idx}_causes = ${el.causes}"
+              ++ optional (el.before != null) "imapsieve_mailbox${toString idx}_before = file:${stateDir}/imapsieve/before/${baseNameOf el.before}"
+              ++ optional (el.after != null) "imapsieve_mailbox${toString idx}_after = file:${stateDir}/imapsieve/after/${baseNameOf el.after}"
+          )
+          cfg.imapsieve.mailbox))
+      }
+    '')
+    (optionalString (cfg.sieve.pipeBins != []) ''
+        sieve_pipe_bin_dir = ${pkgs.linkFarm "sieve-pipe-bins" (map (el: {
+          name = builtins.unsafeDiscardStringContext (baseNameOf el);
+          path = el;
+        })
+        cfg.sieve.pipeBins)}
+    '')
+    ''
+      }
+    ''
+
     cfg.extraConfig
   ];
 
@@ -343,6 +376,104 @@ in
       description = lib.mdDoc "Quota limit for the user in bytes. Supports suffixes b, k, M, G, T and %.";
     };
 
+    imapsieve.mailbox = mkOption {
+      default = [];
+      description = "Configure Sieve filtering rules on IMAP actions";
+      type = types.listOf (types.submodule ({ config, ... }: {
+        options = {
+          name = mkOption {
+            description = ''
+              This setting configures the name of a mailbox for which administrator scripts are configured.
+
+              The settings defined hereafter with matching sequence numbers apply to the mailbox named by this setting.
+
+              This setting supports wildcards with a syntax compatible with the IMAP LIST command, meaning that this setting can apply to multiple or even all ("*") mailboxes.
+            '';
+            example = "Junk";
+            type = types.str;
+          };
+
+          from = mkOption {
+            default = null;
+            description = ''
+              Only execute the administrator Sieve scripts for the mailbox configured with services.dovecot2.imapsieve.mailbox.<name>.name when the message originates from the indicated mailbox.
+
+              This setting supports wildcards with a syntax compatible with the IMAP LIST command, meaning that this setting can apply to multiple or even all ("*") mailboxes.
+            '';
+            example = "*";
+            type = types.nullOr types.str;
+          };
+
+          causes = mkOption {
+            default = null;
+            description = ''
+              Only execute the administrator Sieve scripts for the mailbox configured with services.dovecot2.imapsieve.mailbox.<name>.name when one of the listed IMAPSIEVE causes apply.
+
+              This has no effect on the user script, which is always executed no matter the cause.
+            '';
+            example = "COPY";
+            type = types.nullOr (types.enum [ "APPEND" "COPY" "FLAG" ]);
+          };
+
+          before = mkOption {
+            default = null;
+            description = ''
+              When an IMAP event of interest occurs, this sieve script is executed before any user script respectively.
+
+              This setting each specify the location of a single sieve script. The semantics of this setting is similar to sieve_before: the specified scripts form a sequence together with the user script in which the next script is only executed when an (implicit) keep action is executed.
+            '';
+            example = literalExpression "./report-spam.sieve";
+            type = types.nullOr types.path;
+          };
+
+          after = mkOption {
+            default = null;
+            description = ''
+              When an IMAP event of interest occurs, this sieve script is executed after any user script respectively.
+
+              This setting each specify the location of a single sieve script. The semantics of this setting is similar to sieve_after: the specified scripts form a sequence together with the user script in which the next script is only executed when an (implicit) keep action is executed.
+            '';
+            example = literalExpression "./report-spam.sieve";
+            type = types.nullOr types.path;
+          };
+        };
+      }));
+    };
+
+    sieve = {
+      plugins = mkOption {
+        default = [];
+        example = [ "sieve_extprograms" ];
+        description = "Sieve plugins to load";
+        type = types.listOf types.str;
+      };
+
+      extensions = mkOption {
+        default = [];
+        description = "Sieve extensions for use in user scripts";
+        example = [ "notify" "imapflags" "vnd.dovecot.filter" ];
+        type = types.listOf types.str;
+      };
+
+      globalExtensions = mkOption {
+        default = [];
+        example = [ "vnd.dovecot.environment" ];
+        description = "Sieve extensions for use in global scripts";
+        type = types.listOf types.str;
+      };
+
+      pipeBins = mkOption {
+        default = [];
+        example = literalExpression ''
+          map lib.getExe [
+            (pkgs.writeShellScriptBin "learn-ham.sh" "exec ''${pkgs.rspamd}/bin/rspamc learn_ham")
+            (pkgs.writeShellScriptBin "learn-spam.sh" "exec ''${pkgs.rspamd}/bin/rspamc learn_spam")
+          ]
+        '';
+        description = "Programs available for use by the vnd.dovecot.pipe extension";
+        type = types.listOf types.path;
+      };
+    };
   };
 
 
@@ -353,14 +484,23 @@ in
       enable = true;
       params.dovecot2 = {};
     };
-    services.dovecot2.protocols =
-      optional cfg.enableImap "imap"
-      ++ optional cfg.enablePop3 "pop3"
-      ++ optional cfg.enableLmtp "lmtp";
 
-    services.dovecot2.mailPlugins = mkIf cfg.enableQuota {
-      globally.enable = [ "quota" ];
-      perProtocol.imap.enable = [ "imap_quota" ];
+    services.dovecot2 = {
+      protocols =
+        optional cfg.enableImap "imap"
+        ++ optional cfg.enablePop3 "pop3"
+        ++ optional cfg.enableLmtp "lmtp";
+
+      mailPlugins = mkIf cfg.enableQuota {
+        globally.enable = [ "quota" ];
+        perProtocol.imap.enable = [ "imap_quota" ];
+      };
+
+      sieve.plugins =
+        optional (cfg.imapsieve.mailbox != []) "sieve_imapsieve"
+        ++ optional (cfg.sieve.pipeBins != []) "sieve_extprograms";
+
+      sieve.globalExtensions = optional (cfg.sieve.pipeBins != []) "vnd.dovecot.pipe";
     };
 
     users.users = {
@@ -415,7 +555,7 @@ in
       # (should be 0) so that the compiled sieve script is newer than
       # the source file and Dovecot won't try to compile it.
       preStart = ''
-        rm -rf ${stateDir}/sieve
+        rm -rf ${stateDir}/sieve ${stateDir}/imapsieve
       '' + optionalString (cfg.sieveScripts != {}) ''
         mkdir -p ${stateDir}/sieve
         ${concatStringsSep "\n" (
@@ -432,6 +572,29 @@ in
         ) cfg.sieveScripts
       )}
         chown -R '${cfg.mailUser}:${cfg.mailGroup}' '${stateDir}/sieve'
+      ''
+      + optionalString (cfg.imapsieve.mailbox != []) ''
+        mkdir -p ${stateDir}/imapsieve/{before,after}
+
+        ${
+          concatMapStringsSep "\n"
+            (el:
+              optionalString (el.before != null) ''
+                cp -p ${el.before} ${stateDir}/imapsieve/before/${baseNameOf el.before}
+                ${pkgs.dovecot_pigeonhole}/bin/sievec '${stateDir}/imapsieve/before/${baseNameOf el.before}'
+              ''
+              + optionalString (el.after != null) ''
+                cp -p ${el.after} ${stateDir}/imapsieve/after/${baseNameOf el.after}
+                ${pkgs.dovecot_pigeonhole}/bin/sievec '${stateDir}/imapsieve/after/${baseNameOf el.after}'
+              ''
+            )
+            cfg.imapsieve.mailbox
+        }
+
+        ${
+          optionalString (cfg.mailUser != null && cfg.mailGroup != null)
+            "chown -R '${cfg.mailUser}:${cfg.mailGroup}' '${stateDir}/imapsieve'"
+        }
       '';
     };
 
@@ -459,4 +622,5 @@ in
 
   };
 
+  meta.maintainers = [ lib.maintainers.dblsaiko ];
 }

nixos/modules/services/misc/ntfy-sh.nix

@@ -79,12 +79,6 @@ in
         cache-file = mkDefault "/var/lib/ntfy-sh/cache-file.db";
       };
 
-      systemd.tmpfiles.rules = [
-        "f ${cfg.settings.auth-file} 0600 ${cfg.user} ${cfg.group} - -"
-        "d ${cfg.settings.attachment-cache-dir} 0700 ${cfg.user} ${cfg.group} - -"
-        "f ${cfg.settings.cache-file} 0600 ${cfg.user} ${cfg.group} - -"
-      ];
-
       systemd.services.ntfy-sh = {
         description = "Push notifications server";
 

nixos/modules/services/networking/miniupnpd.nix

@@ -13,8 +13,17 @@ let
       listening_ip=${range}
     '') cfg.internalIPs}
 
+    ${lib.optionalString (firewall == "nftables") ''
+      upnp_table_name=miniupnpd
+      upnp_nat_table_name=miniupnpd
+    ''}
+
     ${cfg.appendConfig}
   '';
+  firewall = if config.networking.nftables.enable then "nftables" else "iptables";
+  miniupnpd = pkgs.miniupnpd.override { inherit firewall; };
+  firewallScripts = lib.optionals (firewall == "iptables")
+    ([ "iptables"] ++ lib.optional (config.networking.enableIPv6) "ip6tables");
 in
 {
   options = {
@@ -57,20 +66,50 @@ in
   };
 
   config = mkIf cfg.enable {
-    networking.firewall.extraCommands = ''
-      ${pkgs.bash}/bin/bash -x ${pkgs.miniupnpd}/etc/miniupnpd/iptables_init.sh -i ${cfg.externalInterface}
-    '';
+    networking.firewall.extraCommands = lib.mkIf (firewallScripts != []) (builtins.concatStringsSep "\n" (map (fw: ''
+      EXTIF=${cfg.externalInterface} ${pkgs.bash}/bin/bash -x ${miniupnpd}/etc/miniupnpd/${fw}_init.sh
+    '') firewallScripts));
 
-    networking.firewall.extraStopCommands = ''
-      ${pkgs.bash}/bin/bash -x ${pkgs.miniupnpd}/etc/miniupnpd/iptables_removeall.sh -i ${cfg.externalInterface}
-    '';
+    networking.firewall.extraStopCommands = lib.mkIf (firewallScripts != []) (builtins.concatStringsSep "\n" (map (fw: ''
+      EXTIF=${cfg.externalInterface} ${pkgs.bash}/bin/bash -x ${miniupnpd}/etc/miniupnpd/${fw}_removeall.sh
+    '') firewallScripts));
+
+    networking.nftables = lib.mkIf (firewall == "nftables") {
+      # see nft_init in ${miniupnpd-nftables}/etc/miniupnpd
+      tables.miniupnpd = {
+        family = "inet";
+        # The following is omitted because it's expected that the firewall is to be responsible for it.
+        #
+        # chain forward {
+        #   type filter hook forward priority filter; policy drop;
+        #   jump miniupnpd
+        # }
+        #
+        # Otherwise, it quickly gets ugly with (potentially) two forward chains with "policy drop".
+        # This means the chain "miniupnpd" never actually gets triggered and is simply there to satisfy
+        # miniupnpd. If you're doing it yourself (without networking.firewall), the easiest way to get
+        # it to work is adding a rule "ct status dnat accept" - this is what networking.firewall does.
+        # If you don't want to simply accept forwarding for all "ct status dnat" packets, override
+        # upnp_table_name with whatever your table is, create a chain "miniupnpd" in your table and
+        # jump into it from your forward chain.
+        content = ''
+          chain miniupnpd {}
+          chain prerouting_miniupnpd {
+            type nat hook prerouting priority dstnat; policy accept;
+          }
+          chain postrouting_miniupnpd {
+            type nat hook postrouting priority srcnat; policy accept;
+          }
+        '';
+      };
+    };
 
     systemd.services.miniupnpd = {
       description = "MiniUPnP daemon";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
-        ExecStart = "${pkgs.miniupnpd}/bin/miniupnpd -f ${configFile}";
+        ExecStart = "${miniupnpd}/bin/miniupnpd -f ${configFile}";
         PIDFile = "/run/miniupnpd.pid";
         Type = "forking";
       };

nixos/modules/services/web-servers/nginx/default.nix

@@ -334,8 +334,8 @@ let
           + optionalString vhost.default "default_server "
           + optionalString vhost.reuseport "reuseport "
           + optionalString (extraParameters != []) (concatStringsSep " "
-            (let inCompatibleParameters = [ "ssl" "proxy_protocol" "http2" ];
-                isCompatibleParameter = param: !(any (p: p == param) inCompatibleParameters);
+            (let inCompatibleParameters = [ "accept_filter" "backlog" "deferred" "fastopen" "http2" "proxy_protocol" "so_keepalive" "ssl" ];
+                isCompatibleParameter = param: !(any (p: lib.hasPrefix p param) inCompatibleParameters);
             in filter isCompatibleParameter extraParameters))
           + ";"))
           + "
@@ -408,12 +408,6 @@ let
             ssl_conf_command Options KTLS;
           ''}
 
-          ${optionalString (hasSSL && vhost.quic && vhost.http3)
-            # Advertise that HTTP/3 is available
-          ''
-            add_header Alt-Svc 'h3=":$server_port"; ma=86400';
-          ''}
-
           ${mkBasicAuth vhostName vhost}
 
           ${optionalString (vhost.root != null) "root ${vhost.root};"}

nixos/modules/services/web-servers/nginx/vhost-options.nix

@@ -235,9 +235,9 @@ with lib;
         which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;`
         and activate the QUIC transport protocol
         `services.nginx.virtualHosts.<name>.quic = true;`.
-        Note that HTTP/3 support is experimental and
-        *not* yet recommended for production.
+        Note that HTTP/3 support is experimental and *not* yet recommended for production.
         Read more at https://quic.nginx.org/
+        HTTP/3 availability must be manually advertised, preferably in each location block.
       '';
     };
 
@@ -250,8 +250,7 @@ with lib;
         which can be achieved by setting `services.nginx.package = pkgs.nginxQuic;`
         and activate the QUIC transport protocol
         `services.nginx.virtualHosts.<name>.quic = true;`.
-        Note that special application protocol support is experimental and
-        *not* yet recommended for production.
+        Note that special application protocol support is experimental and *not* yet recommended for production.
         Read more at https://quic.nginx.org/
       '';
     };

nixos/modules/tasks/filesystems/zfs.nix

@@ -71,7 +71,7 @@ let
     done
     poolReady() {
       pool="$1"
-      state="$("${zpoolCmd}" import 2>/dev/null | "${awkCmd}" "/pool: $pool/ { found = 1 }; /state:/ { if (found == 1) { print \$2; exit } }; END { if (found == 0) { print \"MISSING\" } }")"
+      state="$("${zpoolCmd}" import -d "${cfgZfs.devNodes}" 2>/dev/null | "${awkCmd}" "/pool: $pool/ { found = 1 }; /state:/ { if (found == 1) { print \$2; exit } }; END { if (found == 0) { print \"MISSING\" } }")"
       if [[ "$state" = "ONLINE" ]]; then
         return 0
       else

nixos/modules/virtualisation/libvirtd.nix

@@ -116,6 +116,15 @@ let
           QEMU's swtpm options.
         '';
       };
+
+      vhostUserPackages = mkOption {
+        type = types.listOf types.package;
+        default = [ ];
+        example = lib.literalExpression "[ pkgs.virtiofsd ]";
+        description = lib.mdDoc ''
+          Packages containing out-of-tree vhost-user drivers.
+        '';
+      };
     };
   };
 
@@ -502,6 +511,14 @@ in
     # https://libvirt.org/daemons.html#monolithic-systemd-integration
     systemd.sockets.libvirtd.wantedBy = [ "sockets.target" ];
 
+    systemd.tmpfiles.rules = let
+      vhostUserCollection = pkgs.buildEnv {
+        name = "vhost-user";
+        paths = cfg.qemu.vhostUserPackages;
+        pathsToLink = [ "/share/qemu/vhost-user" ];
+      };
+    in [ "L+ /var/lib/qemu/vhost-user - - - - ${vhostUserCollection}/share/qemu/vhost-user" ];
+
     security.polkit = {
       enable = true;
       extraConfig = ''

nixos/tests/all-tests.nix

@@ -617,6 +617,7 @@ in {
   nscd = handleTest ./nscd.nix {};
   nsd = handleTest ./nsd.nix {};
   ntfy-sh = handleTest ./ntfy-sh.nix {};
+  ntfy-sh-migration = handleTest ./ntfy-sh-migration.nix {};
   nzbget = handleTest ./nzbget.nix {};
   nzbhydra2 = handleTest ./nzbhydra2.nix {};
   oh-my-zsh = handleTest ./oh-my-zsh.nix {};
@@ -910,7 +911,8 @@ in {
   unbound = handleTest ./unbound.nix {};
   unifi = handleTest ./unifi.nix {};
   unit-php = handleTest ./web-servers/unit-php.nix {};
-  upnp = handleTest ./upnp.nix {};
+  upnp.iptables = handleTest ./upnp.nix { useNftables = false; };
+  upnp.nftables = handleTest ./upnp.nix { useNftables = true; };
   uptermd = handleTest ./uptermd.nix {};
   uptime-kuma = handleTest ./uptime-kuma.nix {};
   usbguard = handleTest ./usbguard.nix {};

nixos/tests/ntfy-sh-migration.nix

@@ -0,0 +1,77 @@
+# the ntfy-sh module was switching to DynamicUser=true. this test assures that
+# the migration does not break existing setups.
+#
+# this test works doing a migration and asserting ntfy-sh runs properly. first,
+# ntfy-sh is configured to use a static user and group. then ntfy-sh is
+# started and tested. after that, ntfy-sh is shut down and a systemd drop
+# in configuration file is used to upate the service configuration to use
+# DynamicUser=true. then the ntfy-sh is started again and tested.
+
+import ./make-test-python.nix {
+  name = "ntfy-sh";
+
+  nodes.machine = {
+    lib,
+    pkgs,
+    ...
+  }: {
+    environment.etc."ntfy-sh-dynamic-user.conf".text = ''
+      [Service]
+      Group=new-ntfy-sh
+      User=new-ntfy-sh
+      DynamicUser=true
+    '';
+
+    services.ntfy-sh.enable = true;
+    services.ntfy-sh.settings.base-url = "http://localhost:2586";
+
+    systemd.services.ntfy-sh.serviceConfig = {
+      DynamicUser = lib.mkForce false;
+      ExecStartPre = [
+        "${pkgs.coreutils}/bin/id"
+        "${pkgs.coreutils}/bin/ls -lahd /var/lib/ntfy-sh/"
+        "${pkgs.coreutils}/bin/ls -lah /var/lib/ntfy-sh/"
+      ];
+      Group = lib.mkForce "old-ntfy-sh";
+      User = lib.mkForce "old-ntfy-sh";
+    };
+
+    users.users.old-ntfy-sh = {
+      isSystemUser = true;
+      group = "old-ntfy-sh";
+    };
+
+    users.groups.old-ntfy-sh = {};
+  };
+
+  testScript = ''
+    import json
+
+    msg = "Test notification"
+
+    def test_ntfysh():
+      machine.wait_for_unit("ntfy-sh.service")
+      machine.wait_for_open_port(2586)
+
+      machine.succeed(f"curl -d '{msg}' localhost:2586/test")
+
+      text = machine.succeed("curl -s localhost:2586/test/json?poll=1")
+      for line in text.splitlines():
+        notif = json.loads(line)
+        assert msg == notif["message"], "Wrong message"
+
+      machine.succeed("ntfy user list")
+
+    machine.wait_for_unit("multi-user.target")
+
+    test_ntfysh()
+
+    machine.succeed("systemctl stop ntfy-sh.service")
+    machine.succeed("mkdir -p /run/systemd/system/ntfy-sh.service.d")
+    machine.succeed("cp /etc/ntfy-sh-dynamic-user.conf /run/systemd/system/ntfy-sh.service.d/dynamic-user.conf")
+    machine.succeed("systemctl daemon-reload")
+    machine.succeed("systemctl start ntfy-sh.service")
+
+    test_ntfysh()
+  '';
+}

nixos/tests/pgadmin4.nix

@@ -4,31 +4,49 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
   name = "pgadmin4";
   meta.maintainers = with lib.maintainers; [ mkg20001 gador ];
 
-  nodes.machine = { pkgs, ... }: {
+  nodes = {
+    machine = { pkgs, ... }: {
 
-    imports = [ ./common/user-account.nix ];
+      imports = [ ./common/user-account.nix ];
 
-    environment.systemPackages = with pkgs; [
-      wget
-      curl
-      pgadmin4-desktopmode
-    ];
+      environment.systemPackages = with pkgs; [
+        wget
+        curl
+        pgadmin4-desktopmode
+      ];
 
-    services.postgresql = {
-      enable = true;
-      authentication = ''
-        host    all             all             localhost               trust
-      '';
+      services.postgresql = {
+        enable = true;
+        authentication = ''
+          host    all             all             localhost               trust
+        '';
+      };
+
+      services.pgadmin = {
+        port = 5051;
+        enable = true;
+        initialEmail = "bruh@localhost.de";
+        initialPasswordFile = pkgs.writeText "pw" "bruh2012!";
+      };
     };
+    machine2 = { pkgs, ... }: {
 
-    services.pgadmin = {
-      port = 5051;
-      enable = true;
-      initialEmail = "bruh@localhost.de";
-      initialPasswordFile = pkgs.writeText "pw" "bruh2012!";
+      imports = [ ./common/user-account.nix ];
+
+      services.postgresql = {
+        enable = true;
+      };
+
+      services.pgadmin = {
+        enable = true;
+        initialEmail = "bruh@localhost.de";
+        initialPasswordFile = pkgs.writeText "pw" "bruh2012!";
+        minimumPasswordLength = 12;
+      };
     };
   };
 
+
   testScript = ''
     with subtest("Check pgadmin module"):
       machine.wait_for_unit("postgresql")
@@ -49,5 +67,9 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
       machine.wait_until_succeeds("curl -sS localhost:5050")
       machine.wait_until_succeeds("curl -sS localhost:5050/browser/ | grep \"<title>pgAdmin 4</title>\" > /dev/null")
       machine.succeed("wget -nv --level=1 --spider --recursive localhost:5050/browser")
+
+    with subtest("Check pgadmin minimum password length"):
+      machine2.wait_for_unit("postgresql")
+      machine2.wait_for_console_text("Password must be at least 12 characters long")
   '';
 })

nixos/tests/upnp.nix

@@ -5,7 +5,7 @@
 # this succeeds an external client will try to connect to the port
 # mapping.
 
-import ./make-test-python.nix ({ pkgs, ... }:
+import ./make-test-python.nix ({ pkgs, useNftables, ... }:
 
 let
   internalRouterAddress = "192.168.3.1";
@@ -27,6 +27,7 @@ in
           networking.nat.enable = true;
           networking.nat.internalInterfaces = [ "eth2" ];
           networking.nat.externalInterface = "eth1";
+          networking.nftables.enable = useNftables;
           networking.firewall.enable = true;
           networking.firewall.trustedInterfaces = [ "eth2" ];
           networking.interfaces.eth1.ipv4.addresses = [
@@ -82,7 +83,7 @@ in
       # Wait for network and miniupnpd.
       router.wait_for_unit("network-online.target")
       # $router.wait_for_unit("nat")
-      router.wait_for_unit("firewall.service")
+      router.wait_for_unit("${if useNftables then "nftables" else "firewall"}.service")
       router.wait_for_unit("miniupnpd")
 
       client1.wait_for_unit("network-online.target")

pkgs/applications/editors/xmlcopyeditor/default.nix

@@ -25,6 +25,13 @@ stdenv.mkDerivation rec {
 
   patches = [ ./xmlcopyeditor.patch ];
 
+  # error: cannot initialize a variable of type 'xmlErrorPtr' (aka '_xmlError *')
+  #        with an rvalue of type 'const xmlError *' (aka 'const _xmlError *')
+  postPatch = ''
+    substituteInPlace src/wraplibxml.cpp \
+      --replace "xmlErrorPtr err" "const xmlError *err"
+  '';
+
   nativeBuildInputs = [
     intltool
     pkg-config

pkgs/applications/graphics/identity/default.nix

@@ -1,54 +1,60 @@
-{ appstream-glib
-, blueprint-compiler
-, desktop-file-utils
+{ lib
+, stdenv
 , fetchFromGitLab
-, gst_all_1
-, gtk4
-, lib
-, libadwaita
+, rustPlatform
+, nix-update-script
+
+, appstream
+, blueprint-compiler
 , cargo
+, desktop-file-utils
 , meson
 , ninja
-, nix-update-script
 , pkg-config
-, rustPlatform
 , rustc
-, stdenv
 , wrapGAppsHook4
+
+, dav1d
+, gst_all_1
+, gtk4
+, libadwaita
+, libwebp
 }:
 
 stdenv.mkDerivation rec {
   pname = "identity";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "YaLTeR";
     repo = "identity";
     rev = "v${version}";
-    sha256 = "sha256-ZBK2Vc2wnohABnWXRtmRdAAOnkTIHt4RriZitu8BW1A=";
+    hash = "sha256-AiOaTjYOc7Eo+9kl1H91TKAkCKNUJNWobmBENZlHBhQ=";
   };
 
-  cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
-    name = "${pname}-${version}";
-    hash = "sha256-5NUnrBHj3INhh9zbdwPink47cP6uJiRyzzdj+yiSVD8=";
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "gst-plugin-gtk4-0.12.0-alpha.1" = "sha256-JSw9yZ4oy7m6c9pqOT+fnYEbTlneLTtWQf3/Jbek/ps=";
+    };
   };
 
   nativeBuildInputs = [
-    appstream-glib
+    appstream
     blueprint-compiler
+    cargo
     desktop-file-utils
     meson
     ninja
     pkg-config
-    wrapGAppsHook4
-    rustPlatform.cargoSetupHook
-    cargo
     rustc
+    rustPlatform.cargoSetupHook
+    wrapGAppsHook4
   ];
 
   buildInputs = [
+    dav1d
     gst_all_1.gst-libav
     gst_all_1.gst-plugins-bad
     gst_all_1.gst-plugins-base
@@ -56,15 +62,16 @@ stdenv.mkDerivation rec {
     gst_all_1.gstreamer
     gtk4
     libadwaita
+    libwebp
   ];
 
   passthru.updateScript = nix-update-script { };
 
-  meta = {
+  meta = with lib; {
     description = "A program for comparing multiple versions of an image or video";
     homepage = "https://gitlab.gnome.org/YaLTeR/identity";
-    maintainers = [ lib.maintainers.paveloom ];
-    license = lib.licenses.gpl3Plus;
-    platforms = lib.platforms.linux;
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ paveloom ];
   };
 }

pkgs/applications/misc/cartridges/default.nix

@@ -6,29 +6,32 @@
 , libadwaita
 , meson
 , ninja
-, python3
+, python3Packages
 , stdenv
 , wrapGAppsHook4
+, nix-update-script
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "cartridges";
-  version = "2.3";
+  version = "2.7.2";
 
   src = fetchFromGitHub {
     owner = "kra-mo";
     repo = "cartridges";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-d0c0043kssPvGxs6FygDkTKZoYtFge2cH4MIhz2vVYk=";
+    hash = "sha256-+18TWtxKT87CZ8vTtYac9aQ0wIbhJEXbXFZrSj5BmjI=";
   };
 
+  pythonPath = with python3Packages; [
+    pillow
+    pygobject3
+    pyyaml
+    requests
+  ];
+
   buildInputs = [
     libadwaita
-    (python3.withPackages (p: with p; [
-      pillow
-      pygobject3
-      pyyaml
-      requests
-    ]))
+    (python3Packages.python.withPackages (_: finalAttrs.pythonPath))
   ];
 
   nativeBuildInputs = [
@@ -37,9 +40,21 @@ stdenv.mkDerivation (finalAttrs: {
     gobject-introspection
     meson
     ninja
+    python3Packages.wrapPython
     wrapGAppsHook4
   ];
 
+  dontWrapGApps = true;
+
+  postFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+    wrapPythonPrograms "$out/bin" "$out" "$pythonPath"
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
   meta = with lib; {
     description = "A GTK4 + Libadwaita game launcher";
     longDescription = ''

pkgs/applications/misc/girara/default.nix

@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
 
   mesonFlags = [
     "-Ddocs=disabled" # docs do not seem to be installed
-    (lib.mesonEnable "tests" (stdenv.buildPlatform.canExecute stdenv.hostPlatform))
+    (lib.mesonEnable "tests" ((stdenv.buildPlatform.canExecute stdenv.hostPlatform) && (!stdenv.isDarwin)))
   ];
 
   checkPhase = ''

pkgs/applications/misc/gnome-extension-manager/default.nix

@@ -7,6 +7,7 @@
 , ninja
 , gettext
 , gtk4
+, appstream
 , appstream-glib
 , desktop-file-utils
 , gobject-introspection
@@ -16,32 +17,30 @@
 , libsoup_3
 , glib
 , libbacktrace
-, python3
 , text-engine
 }:
 
 stdenv.mkDerivation rec {
   pname = "gnome-extension-manager";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "mjakeman";
     repo = "extension-manager";
     rev = "v${version}";
-    hash = "sha256-AQdYZsOaTk+EX1bi/kDI2GcVfu7ZKIyrFpNf/fRcJmo=";
+    hash = "sha256-e+s8iIUvW9Rw0Wq4aIn3IzBLGTQC6o0TmNXd5gz892Y=";
   };
 
   nativeBuildInputs = [
+    appstream
     appstream-glib
     desktop-file-utils
     gettext
     glib
     gobject-introspection
-    libadwaita
     meson
     ninja
     pkg-config
-    python3
     wrapGAppsHook4
   ];
 
@@ -49,16 +48,23 @@ stdenv.mkDerivation rec {
     blueprint-compiler
     gtk4
     json-glib
+    libadwaita
     libsoup_3
     libbacktrace
     text-engine
   ];
 
+  mesonFlags = [
+    (lib.mesonOption "package" "Nix")
+    (lib.mesonOption "distributor" "nixpkgs")
+  ];
+
   meta = with lib; {
     description = "Desktop app for managing GNOME shell extensions";
     homepage = "https://github.com/mjakeman/extension-manager";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
+    mainProgram = "extension-manager";
     maintainers = with maintainers; [ foo-dogsquared ];
   };
 }

pkgs/applications/misc/waylock/default.nix

@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "waylock";
-  version = "0.6.3";
+  version = "0.6.4";
 
   src = fetchFromGitHub {
     owner = "ifreund";
     repo = "waylock";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-Q1FlahawsnJ77gP6QVs9AR058rhMU92iueRPudPf+sE=";
+    hash = "sha256-RSAUSlsBB9IphvdSiFqJIvyhhJoAKKb+KyGhdoTa3vs=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/mailreaders/neomutt/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, gettext, makeWrapper, tcl, which
+{ lib, stdenv, fetchFromGitHub, gettext, makeWrapper, tcl, which
 , ncurses, perl , cyrus_sasl, gss, gpgme, libkrb5, libidn2, libxml2, notmuch, openssl
 , lua, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, w3m, mailcap, sqlite, zlib, lndir
 , pkg-config, zstd, enableZstd ? true, enableMixmaster ? false, enableLua ? false
@@ -6,27 +6,16 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "20231103";
+  version = "20231221";
   pname = "neomutt";
 
   src = fetchFromGitHub {
     owner  = "neomutt";
     repo   = "neomutt";
     rev    = version;
-    sha256 = "sha256-9/XYgQjOdIwDpoJz5kNmiRBdoSod9l7Yl0u4e20KDPw=";
+    sha256 = "sha256-IXly2N/DD2+XBXVIXJw1sE/0eJwbUaONDNRMi7n1T44=";
   };
 
-  patches = [
-    # https://github.com/neomutt/neomutt/issues/3773#issuecomment-1493295144
-    ./fix-open-very-large-mailbox.patch
-    # https://github.com/neomutt/neomutt/issues/4128
-    (fetchpatch {
-      name = "fix-attr-color-copy.patch";
-      url = "https://github.com/neomutt/neomutt/commit/24f8644c28e602206a63fae53c4eb3d32426ce0c.patch";
-      hash = "sha256-8qcW9hb6yxEZICRYgl6ZhPQDrI6nZN9NH+40GhTgR0o=";
-    })
-  ];
-
   buildInputs = [
     cyrus_sasl gss gpgme libkrb5 libidn2 ncurses
     notmuch openssl perl lmdb

pkgs/applications/networking/mailreaders/neomutt/fix-open-very-large-mailbox.patch

@@ -1,51 +0,0 @@
-diff --git a/mutt_mailbox.c b/mutt_mailbox.c
-index 5581a8187..22f0ca21a 100644
---- a/mutt_mailbox.c
-+++ b/mutt_mailbox.c
-@@ -160,6 +160,9 @@ int mutt_mailbox_check(struct Mailbox *m_cur, CheckStatsFlags flags)
-   st_ctx.st_dev = 0;
-   st_ctx.st_ino = 0;
-
-+  if (kInMboxOpen)
-+    return 0;
-+
- #ifdef USE_IMAP
-   if (flags & MUTT_MAILBOX_CHECK_FORCE)
-     mutt_update_num_postponed();
-diff --git a/mx.c b/mx.c
-index 4bf5af141..a4e9f83f5 100644
---- a/mx.c
-+++ b/mx.c
-@@ -295,6 +295,8 @@ bool mx_mbox_ac_link(struct Mailbox *m)
-   return true;
- }
-
-+int kInMboxOpen = 0;
-+
- /**
-  * mx_mbox_open - Open a mailbox and parse it
-  * @param m     Mailbox to open
-@@ -386,8 +388,10 @@ bool mx_mbox_open(struct Mailbox *m, OpenMailboxFlags flags)
-   m->msg_tagged = 0;
-   m->vcount = 0;
-
-+  kInMboxOpen = 1;
-   enum MxOpenReturns rc = m->mx_ops->mbox_open(m);
-   m->opened++;
-+  kInMboxOpen = 0;
-
-   if ((rc == MX_OPEN_OK) || (rc == MX_OPEN_ABORT))
-   {
-diff --git a/mx.h b/mx.h
-index 741431570..43e40bf32 100644
---- a/mx.h
-+++ b/mx.h
-@@ -38,6 +38,8 @@ extern const struct MxOps *mx_ops[];
-
- extern struct EnumDef MboxTypeDef;
-
-+extern int kInMboxOpen;
-+
- typedef uint8_t MsgOpenFlags;      ///< Flags for mx_msg_open_new(), e.g. #MUTT_ADD_FROM
- #define MUTT_MSG_NO_FLAGS       0  ///< No flags are set
- #define MUTT_ADD_FROM     (1 << 0) ///< add a From_ line

pkgs/applications/science/misc/rink/default.nix

@@ -2,17 +2,17 @@
 , libiconv, Security }:
 
 rustPlatform.buildRustPackage rec {
-  version = "0.6.3";
+  version = "0.7.0";
   pname = "rink";
 
   src = fetchFromGitHub {
     owner = "tiffany352";
     repo = "rink-rs";
     rev = "v${version}";
-    sha256 = "sha256-AhC3c6CpV0tlD6d/hFWt7hGj2UsXsOCeujkRSDlpvCM=";
+    sha256 = "sha256-5UrSJ/y6GxDUNaljal57JJY17NuI+2yLwVTwp+xBNxs=";
   };
 
-  cargoSha256 = "sha256-Xo5iYwL4Db+GWMl5UXbPmj0Y0PJYR4Q0aUGnYCd+NB8=";
+  cargoHash = "sha256-G30NcP1ej01ygHzaxZ2OdgfksvXe/SCsmZFwamxlDvA=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ ncurses ]

pkgs/applications/video/open-in-mpv/default.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "open-in-mpv";
-  version = "2.1.0";
+  version = "2.1.0-unstable-2023-05-13";
 
   src = fetchFromGitHub {
     owner = "Baldomo";
     repo = "open-in-mpv";
-    rev = "v${version}";
-    hash = "sha256-3Fsa3AwiHsb8VcKa4a/RKyYu+CD5nEX0nIXENhBZCWk=";
+    rev = "07fc639b2882a9a68e539f0fc34b61e247c355fa";
+    hash = "sha256-XkoXvSh5uu96isXc1at36mxSCPylHgMLN97qSpj2cyc=";
   };
 
   vendorHash = "sha256-G6GZO2+CfEAYcf7zBcqDa808A0eJjM8dq7+4VGZ+P4c=";

pkgs/applications/virtualization/docker/buildx.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "docker-buildx";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "buildx";
     rev = "v${version}";
-    hash = "sha256-O2oXswExH6OQLDZcgCGF62oZ7v6svZuOziw0SZgOVHI=";
+    hash = "sha256-QC2mlJWjOtqYAB+YrL+s2FsJ79LuLFZGOgSVGL6WmX8=";
   };
 
   doCheck = false;

pkgs/build-support/dotnet/build-dotnet-module/default.nix

@@ -37,7 +37,7 @@
 
   # The path to publish the project to. When unset, the directory "$out/lib/$pname" is used.
 , installPath ? null
-  # The binaries that should get installed to `$out/bin`, relative to `$out/lib/$pname/`. These get wrapped accordingly.
+  # The binaries that should get installed to `$out/bin`, relative to `$installPath/`. These get wrapped accordingly.
   # Unfortunately, dotnet has no method for doing this automatically.
   # If unset, all executables in the projects root will get installed. This may cause bloat!
 , executables ? null

pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-fixup-hook.sh

@@ -32,7 +32,7 @@ dotnetFixupHook() {
 
     if [ "${executables-}" ]; then
         for executable in ${executables[@]}; do
-            path="$out/lib/$pname/$executable"
+            path="${installPath-$out/lib/$pname}/$executable"
 
             if test -x "$path"; then
                 wrapDotnetProgram "$path" "$out/bin/$(basename "$executable")"
@@ -45,7 +45,7 @@ dotnetFixupHook() {
     else
         while IFS= read -d '' executable; do
             wrapDotnetProgram "$executable" "$out/bin/$(basename "$executable")" \;
-        done < <(find "$out/lib/$pname" ! -name "*.dll" -executable -type f -print0)
+        done < <(find "${installPath-$out/lib/$pname}" ! -name "*.dll" -executable -type f -print0)
     fi
 
     echo "Finished dotnetFixupPhase"

pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-install-hook.sh

@@ -30,7 +30,7 @@ dotnetInstallHook() {
         env dotnet publish ${project-} \
             -p:ContinuousIntegrationBuild=true \
             -p:Deterministic=true \
-            --output "$out/lib/${pname}" \
+            --output "${installPath-$out/lib/$pname}" \
             --configuration "@buildType@" \
             --no-build \
             ${runtimeIdFlags[@]} \

pkgs/build-support/fetchgithub/default.nix

@@ -19,7 +19,7 @@ let
   baseUrl = "https://${githubBase}/${owner}/${repo}";
   newMeta = meta // {
     homepage = meta.homepage or baseUrl;
-
+  } // lib.optionalAttrs (position != null) {
     # to indicate where derivation originates, similar to make-derivation.nix's mkDerivation
     position = "${position.file}:${toString position.line}";
   };

pkgs/by-name/co/cosmic-applibrary/package.nix

@@ -0,0 +1,70 @@
+{ lib
+, fetchFromGitHub
+, stdenv
+, rustPlatform
+, just
+, pkg-config
+, makeBinaryWrapper
+, libxkbcommon
+, wayland
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cosmic-applibrary";
+  version = "unstable-2024-01-03";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = pname;
+    rev = "889cb6078c05cdf3eb94f19f64db552fa2be32dc";
+    hash = "sha256-qLAFSHA7YdOWr7ZmLCkQ+aGWb2schANfgdD2BxsrvaE=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "accesskit-0.11.0" = "sha256-xVhe6adUb8VmwIKKjHxwCwOo5Y1p3Or3ylcJJdLDrrE=";
+      "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
+      "cosmic-config-0.1.0" = "sha256-WM08/jnB2kAf77FE+0xpBJcVGOHOCcUorifQ/5LXav0=";
+      "cosmic-client-toolkit-0.1.0" = "sha256-AEgvF7i/OWPdEMi8WUaAg99igBwE/AexhAXHxyeJMdc=";
+      "glyphon-0.3.0" = "sha256-JGkNIfj1HjOF8kGxqJPNq/JO+NhZD6XrZ4KmkXEP6Xc=";
+      "smithay-client-toolkit-0.18.0" = "sha256-2WbDKlSGiyVmi7blNBr2Aih9FfF2dq/bny57hoA4BrE=";
+      "softbuffer-0.3.3" = "sha256-eKYFVr6C1+X6ulidHIu9SP591rJxStxwL9uMiqnXx4k=";
+      "taffy-0.3.11" = "sha256-SCx9GEIJjWdoNVyq+RZAGn0N71qraKZxf9ZWhvyzLaI=";
+      "cosmic-settings-daemon-0.1.0" = "sha256-z/dvRyc3Zc1fAQh2HKk6NI6QSDpNqarqslwszjU+0nc=";
+      "cosmic-text-0.10.0" = "sha256-C2FHJBESbiyL2BhLb6T+wI9EX+xCyp02Kk6cI46EfDs=";
+    };
+  };
+
+  nativeBuildInputs = [ just pkg-config makeBinaryWrapper ];
+  buildInputs = [ libxkbcommon wayland ];
+
+  dontUseJustBuild = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-app-library"
+  ];
+
+  postPatch = ''
+    substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
+  '';
+
+  postInstall = ''
+    wrapProgram $out/bin/cosmic-app-library \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [wayland]}"
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-applibrary";
+    description = "Application Template for the COSMIC Desktop Environment";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ nyanbinary ];
+    platforms = platforms.linux;
+    mainProgram = "cosmic-app-library";
+  };
+}

pkgs/by-name/co/cosmic-bg/package.nix

@@ -0,0 +1,62 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, just
+, pkg-config
+, makeBinaryWrapper
+, libxkbcommon
+, wayland
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cosmic-bg";
+  version = "unstable-2023-10-10";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = pname;
+    rev = "6a6fe4e387e46c2e159df56a9768220a6269ccf4";
+    hash = "sha256-fdRFndhwISmbTqmXfekFqh+Wrtdjg3vSZut4IAQUBbA=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "cosmic-config-0.1.0" = "sha256-vM5iIr71zg8OWShuoyQI+pV9C5dPXnvkfEVYAg0XAH4=";
+      "smithay-client-toolkit-0.17.0" = "sha256-XXfXRXeEm2LCLTfyd74PYuLmTtLu50pcXKld/6H4juA=";
+    };
+  };
+
+  postPatch = ''
+    substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
+  '';
+
+  nativeBuildInputs = [ just pkg-config makeBinaryWrapper ];
+  buildInputs = [ libxkbcommon wayland ];
+
+  dontUseJustBuild = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-bg"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/cosmic-bg \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [wayland]}"
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-bg";
+    description = "Applies Background for the COSMIC Desktop Environment";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ nyanbinary ];
+    platforms = platforms.linux;
+    mainProgram = "cosmic-bg";
+  };
+}

pkgs/by-name/co/cosmic-design-demo/package.nix

@@ -0,0 +1,76 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, cmake
+, just
+, pkg-config
+, expat
+, libxkbcommon
+, fontconfig
+, freetype
+, wayland
+, makeBinaryWrapper
+, cosmic-icons
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cosmic-design-demo";
+  version = "unstable-2024-01-08";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = pname;
+    rev = "d58cfad46f2982982494fce27fb00ad834dc8992";
+    hash = "sha256-nWkiaegSjxgyGlpjXE9vzGjiDORaRCSoZJMDv0jtvaA=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "accesskit-0.11.0" = "sha256-xVhe6adUb8VmwIKKjHxwCwOo5Y1p3Or3ylcJJdLDrrE=";
+      "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
+      "cosmic-client-toolkit-0.1.0" = "sha256-AEgvF7i/OWPdEMi8WUaAg99igBwE/AexhAXHxyeJMdc=";
+      "cosmic-config-0.1.0" = "sha256-fOaAG5p4RVULMZZA1EPXUw2t8R0Xw9B66ZIFow3376Q=";
+      "cosmic-text-0.10.0" = "sha256-lurasfMuFEi1o4aNJfqRe3YpsXpxdaZiUMVquC1DyX0=";
+      "cosmic-time-0.4.0" = "sha256-kPahIznCtjIa38ty8IzGTbZ25tEZ26hLOL1ybPaTeAk=";
+      "glyphon-0.3.0" = "sha256-JGkNIfj1HjOF8kGxqJPNq/JO+NhZD6XrZ4KmkXEP6Xc=";
+      "smithay-client-toolkit-0.16.1" = "sha256-z7EZThbh7YmKzAACv181zaEZmWxTrMkFRzP0nfsHK6c=";
+      "smithay-client-toolkit-0.18.0" = "sha256-2WbDKlSGiyVmi7blNBr2Aih9FfF2dq/bny57hoA4BrE=";
+      "softbuffer-0.3.3" = "sha256-eKYFVr6C1+X6ulidHIu9SP591rJxStxwL9uMiqnXx4k=";
+      "sctk-adwaita-0.5.4" = "sha256-yK0F2w/0nxyKrSiHZbx7+aPNY2vlFs7s8nu/COp2KqQ=";
+      "taffy-0.3.11" = "sha256-SCx9GEIJjWdoNVyq+RZAGn0N71qraKZxf9ZWhvyzLaI=";
+      "winit-0.28.6" = "sha256-FhW6d2XnXCGJUMoT9EMQew9/OPXiehy/JraeCiVd76M=";
+    };
+  };
+
+  nativeBuildInputs = [ cmake just pkg-config makeBinaryWrapper ];
+  buildInputs = [ libxkbcommon expat fontconfig freetype wayland ];
+
+  dontUseJustBuild = true;
+
+  justFlags = [
+    "--unstable"
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-design-demo"
+  ];
+
+  postInstall = ''
+    wrapProgram "$out/bin/cosmic-design-demo" \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [wayland]}" \
+      --suffix XDG_DATA_DIRS : "${cosmic-icons}/share"
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-design-demo";
+    description = "Design Demo for the COSMIC Desktop Environment";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ nyanbinary ];
+    platforms = platforms.linux;
+    mainProgram = "cosmic-design-demo";
+  };
+}

pkgs/by-name/co/cosmic-files/package.nix

@@ -0,0 +1,74 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, makeBinaryWrapper
+, cosmic-icons
+, just
+, pkg-config
+, libxkbcommon
+, wayland
+, xorg
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cosmic-files";
+  version = "unstable-2024-01-12";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = pname;
+    rev = "467414217903d96f71f5566d8359831000dfede1";
+    hash = "sha256-cfIlTHm1lnASjwHnrlLFJd01jT8D1P5XGLXYaJiF8pA=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "accesskit-0.11.0" = "sha256-xVhe6adUb8VmwIKKjHxwCwOo5Y1p3Or3ylcJJdLDrrE=";
+      "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
+      "cosmic-config-0.1.0" = "sha256-+kcul4iOillcWPK+aD3Z2rMfmVb+i2p5ckKRhc1gdDw=";
+      "cosmic-text-0.10.0" = "sha256-PHz5jUecK889E88Y20XUe2adTUO8ElnoV7IIcaohMUw=";
+      "glyphon-0.3.0" = "sha256-JGkNIfj1HjOF8kGxqJPNq/JO+NhZD6XrZ4KmkXEP6Xc=";
+      "sctk-adwaita-0.5.4" = "sha256-yK0F2w/0nxyKrSiHZbx7+aPNY2vlFs7s8nu/COp2KqQ=";
+      "softbuffer-0.3.3" = "sha256-eKYFVr6C1+X6ulidHIu9SP591rJxStxwL9uMiqnXx4k=";
+      "smithay-client-toolkit-0.16.1" = "sha256-z7EZThbh7YmKzAACv181zaEZmWxTrMkFRzP0nfsHK6c=";
+      "systemicons-0.7.0" = "sha256-zzAI+6mnpQOh+3mX7/sJ+w4a7uX27RduQ99PNxLNF78=";
+      "taffy-0.3.11" = "sha256-SCx9GEIJjWdoNVyq+RZAGn0N71qraKZxf9ZWhvyzLaI=";
+      "winit-0.28.6" = "sha256-FhW6d2XnXCGJUMoT9EMQew9/OPXiehy/JraeCiVd76M=";
+    };
+  };
+
+  postPatch = ''
+    substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
+  '';
+
+  nativeBuildInputs = [ just pkg-config makeBinaryWrapper ];
+  buildInputs = [ wayland ];
+
+  dontUseJustBuild = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-files"
+  ];
+
+  # LD_LIBRARY_PATH can be removed once tiny-xlib is bumped above 0.2.2
+  postInstall = ''
+    wrapProgram "$out/bin/${pname}" \
+      --suffix XDG_DATA_DIRS : "${cosmic-icons}/share" \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ xorg.libX11 xorg.libXcursor xorg.libXrandr xorg.libXi wayland libxkbcommon ]}
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-files";
+    description = "File Manager for the COSMIC Desktop Environment";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ ahoneybun nyanbinary ];
+    platforms = platforms.linux;
+  };
+}

pkgs/by-name/co/cosmic-notifications/package.nix

@@ -0,0 +1,73 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, just
+, which
+, pkg-config
+, makeBinaryWrapper
+, libxkbcommon
+, wayland
+, appstream-glib
+, desktop-file-utils
+, intltool
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cosmic-notifications";
+  version = "unstable-2024-01-05";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = pname;
+    rev = "3b07cf550a54b757a5f136e4d8fde74d09afe3fd";
+    hash = "sha256-+S8bPorarSJQwIQfTmo4qK+B1kKAlQvllUuZ2UBL0eY=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "accesskit-0.11.0" = "sha256-xVhe6adUb8VmwIKKjHxwCwOo5Y1p3Or3ylcJJdLDrrE=";
+      "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
+      "cosmic-client-toolkit-0.1.0" = "sha256-AEgvF7i/OWPdEMi8WUaAg99igBwE/AexhAXHxyeJMdc=";
+      "cosmic-config-0.1.0" = "sha256-DmuUvFjhoqI5lneiWFFYF3WM3mACx5ZfZqeKpsyL7Ss=";
+      "cosmic-text-0.10.0" = "sha256-kIBhh6CakQaWGfBWu5qaV8LAbJENX7GW+BStJK/P4iA=";
+      "cosmic-settings-daemon-0.1.0" = "sha256-z/dvRyc3Zc1fAQh2HKk6NI6QSDpNqarqslwszjU+0nc=";
+      "glyphon-0.3.0" = "sha256-JGkNIfj1HjOF8kGxqJPNq/JO+NhZD6XrZ4KmkXEP6Xc=";
+      "smithay-client-toolkit-0.18.0" = "sha256-2WbDKlSGiyVmi7blNBr2Aih9FfF2dq/bny57hoA4BrE=";
+      "softbuffer-0.3.3" = "sha256-eKYFVr6C1+X6ulidHIu9SP591rJxStxwL9uMiqnXx4k=";
+      "taffy-0.3.11" = "sha256-SCx9GEIJjWdoNVyq+RZAGn0N71qraKZxf9ZWhvyzLaI=";
+    };
+  };
+
+  postPatch = ''
+    substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
+  '';
+
+  nativeBuildInputs = [ just which pkg-config makeBinaryWrapper ];
+  buildInputs = [ libxkbcommon wayland appstream-glib desktop-file-utils intltool ];
+
+  dontUseJustBuild = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-notifications"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/cosmic-notifications \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [wayland]}"
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-notifications";
+    description = "Notifications for the COSMIC Desktop Environment";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ nyanbinary ];
+    platforms = platforms.linux;
+  };
+}

pkgs/by-name/co/cosmic-randr/package.nix

@@ -0,0 +1,49 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, just
+, pkg-config
+, wayland
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cosmic-randr";
+  version = "unstable-2023-12-22";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = pname;
+    rev = "8a082103a0365b02fbed2c17c02373eceb7ad4d3";
+    hash = "sha256-LsZpey9OhNq9FTtHXvZXtHyhXttJ+tr5qBS6eSL27dE=";
+  };
+
+  cargoHash = "sha256-XpN9X8CZUGOe6mQhWWQy766gyoiTPObKsv9J8xiDvdA=";
+
+  postPatch = ''
+    substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
+  '';
+
+  nativeBuildInputs = [ just pkg-config ];
+  buildInputs = [ wayland ];
+
+  dontUseJustBuild = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-randr"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-randr";
+    description = "Library and utility for displaying and configuring Wayland outputs";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ nyanbinary ];
+    platforms = platforms.linux;
+    mainProgram = "cosmic-randr";
+  };
+}

pkgs/by-name/co/cosmic-screenshot/package.nix

@@ -0,0 +1,43 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, just
+, pkg-config
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cosmic-screenshot";
+  version = "unstable-2023-11-08";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = pname;
+    rev = "b413a7128ddcdfb3c63e84bdade5c5b90b163a9a";
+    hash = "sha256-SDxBBhmnqNDX95Rb7QiI46sAxrfodB5tSq8AbXAU480=";
+  };
+
+  cargoHash = "sha256-ZRsAhIWPm38Ys9jM/3yVJLW818lUGLCcSfFZb+UTbnU=";
+
+  nativeBuildInputs = [ just pkg-config ];
+
+  dontUseJustBuild = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "bin-src"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-screenshot"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-screenshot";
+    description = "Screenshot tool for the COSMIC Desktop Environment";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ nyanbinary ];
+    platforms = platforms.linux;
+    mainProgram = "cosmic-screenshot";
+  };
+}

pkgs/by-name/co/cosmic-settings-daemon/package.nix

@@ -0,0 +1,31 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+, pkg-config
+, udev
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cosmic-settings-daemon";
+  version = "unstable-2023-12-29";
+
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = pname;
+    rev = "f7183b68c6ca3f68054b5dd6457b1d5798a75a48";
+    hash = "sha256-Wck0NY6CUjD16gxi74stayiahs4UiqS7iQCkbOXCgKE=";
+  };
+
+  cargoHash = "sha256-vCs20RdGhsI1+f78KEau7ohtoGTrGP9QH91wooQlgOE=";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ udev ];
+
+  meta = with lib; {
+    homepage = "https://github.com/pop-os/cosmic-settings-daemon";
+    description = "Settings Daemon for the COSMIC Desktop Environment";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ nyanbinary ];
+    platforms = platforms.linux;
+  };
+}

pkgs/by-name/co/cosmic-settings/package.nix

@@ -1,10 +1,9 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, rust
 , rustPlatform
 , cmake
-, makeWrapper
+, makeBinaryWrapper
 , cosmic-icons
 , just
 , pkg-config
@@ -15,35 +14,34 @@
 , wayland
 , expat
 , udev
-, which
-, lld
-, util-linuxMinimal
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cosmic-settings";
-  version = "unstable-2023-10-26";
+  version = "unstable-2024-01-09";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = pname;
-    rev = "d15ebbd340dee7adf184831311b5da73faaa80f5";
-    hash = "sha256-OlQ2jjT/ygO+hpl5Cc3h8Yp/SVo+pmI/EH7pqvY9GXI=";
+    rev = "f2148eed9a56ef1b5ba73db73e15486e188e01b7";
+    hash = "sha256-JUiUC/RNR1cqJouUEneHZotkN2M18vJhv+ATvGFrQxU=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "accesskit-0.11.0" = "sha256-/6KUCH1CwMHd5YEMOpAdVeAxpjl9JvrzDA4Xnbd1D9k=";
+      "accesskit-0.11.0" = "sha256-xVhe6adUb8VmwIKKjHxwCwOo5Y1p3Or3ylcJJdLDrrE=";
+      "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
       "cosmic-bg-config-0.1.0" = "sha256-fdRFndhwISmbTqmXfekFqh+Wrtdjg3vSZut4IAQUBbA=";
-      "cosmic-comp-config-0.1.0" = "sha256-q0LP8TODETobYg0S6XDsP0Lw/RJIB8YB4jiUkRHpsio=";
-      "cosmic-config-0.1.0" = "sha256-+mnvf/IM9cqoZv5zHW8uBAqeY2pG3IOiOWIESVExnqg=";
-      "cosmic-panel-config-0.1.0" = "sha256-U5FYZ5hjJ5s6lYfWrgyuy8zLjiXGQV+OKwf6nzHZT6w=";
-      "smithay-client-toolkit-0.17.0" = "sha256-vDY4cqz5CZD12twElUWVCsf4N6VO9O+Udl8Dc4arWK4=";
-      "softbuffer-0.2.0" = "sha256-VD2GmxC58z7Qfu/L+sfENE+T8L40mvUKKSfgLmCTmjY=";
-      "taffy-0.3.11" = "sha256-gPHJhYmDb3Pj7eM8eFv1kPoODk0BGiw+yMj9ROXIjAU=";
-      "winit-0.28.6" = "sha256-8IQ6HyvD09v8+KWO5jbAkouRTTX/Des4Pn/sjGrtdok=";
-      "xdg-shell-wrapper-config-0.1.0" = "sha256-pvaI/joul7jWTdIrPq3PbBcQGMLZLd2rTu1aIwXiZN8=";
+      "cosmic-comp-config-0.1.0" = "sha256-xN5VbxRO50BPU0VP1rSOkq3TS2WTiCGavJS8o05Jw50=";
+      "cosmic-config-0.1.0" = "sha256-/oAG5xu0Lnsw/CIGXrvoC3pKkj5aS0qubWIPozQDSsY=";
+      "cosmic-client-toolkit-0.1.0" = "sha256-AEgvF7i/OWPdEMi8WUaAg99igBwE/AexhAXHxyeJMdc=";
+      "cosmic-panel-config-0.1.0" = "sha256-SDqNLuj219FMqlO2devw/DD04RJfSBJLDLH/4ObRCl8=";
+      "glyphon-0.3.0" = "sha256-Uw1zbHVAjB3pUfUd8GnFUnske3Gxs+RktrbaFJfK430=";
+      "smithay-client-toolkit-0.18.0" = "sha256-9NwNrEC+csTVtmXrNQFvOgohTGUO2VCvqOME7SnDCOg=";
+      "softbuffer-0.3.3" = "sha256-eKYFVr6C1+X6ulidHIu9SP591rJxStxwL9uMiqnXx4k=";
+      "taffy-0.3.11" = "sha256-SCx9GEIJjWdoNVyq+RZAGn0N71qraKZxf9ZWhvyzLaI=";
+      "xdg-shell-wrapper-config-0.1.0" = "sha256-3Dc2fU8xBVUmAs0Q1zEdcdG7vlxpBO+UIlyM/kzGcC4=";
     };
   };
 
@@ -51,7 +49,7 @@ rustPlatform.buildRustPackage rec {
     substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
   '';
 
-  nativeBuildInputs = [ cmake just pkg-config which lld util-linuxMinimal makeWrapper ];
+  nativeBuildInputs = [ cmake just pkg-config makeBinaryWrapper ];
   buildInputs = [ libxkbcommon libinput fontconfig freetype wayland expat udev ];
 
   dontUseJustBuild = true;
@@ -76,5 +74,6 @@ rustPlatform.buildRustPackage rec {
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ nyanbinary ];
     platforms = platforms.linux;
+    mainProgram = "cosmic-settings";
   };
 }

pkgs/by-name/dy/dynamodb-local/package.nix

@@ -34,7 +34,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DynamoDBLocal.html";
     license = licenses.unfree;
     mainProgram = "dynamodb-local";
-    maintainers = with maintainers; [ shyim ];
+    maintainers = with maintainers; [ shyim martinjlowm ];
     platforms = platforms.all;
     sourceProvenance = with lib.sourceTypes; [
       binaryBytecode

pkgs/by-name/ii/iina/package.nix

@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iina";
-  version = "1.3.3";
+  version = "1.3.4";
 
   src = fetchurl {
     url = "https://github.com/iina/iina/releases/download/v${version}/IINA.v${version}.dmg";
-    hash = "sha256-Sz9sS+07t32+KcEr9tXQlZKEr7Ace1mjX9caOicIiZE=";
+    hash = "sha256-feUPWtSi/Vsnv1mjGyBgB0wFMxx6r6UzrUratlAo14w=";
   };
 
   nativeBuildInputs = [ undmg ];
@@ -32,6 +32,7 @@ stdenv.mkDerivation rec {
     platforms = platforms.darwin;
     license = licenses.gpl3;
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    mainProgram = "iina";
     maintainers = with maintainers; [ arkivm stepbrobd ];
   };
 }

pkgs/by-name/ni/nix-web/package.nix

@@ -1,9 +1,12 @@
 { lib
+, stdenv
 , rustPlatform
 , fetchFromGitea
 , pkg-config
 , openssl
-, nix
+, nixVersions
+, nixPackage ? nixVersions.nix_2_17
+, darwin
 }:
 
 let
@@ -11,19 +14,20 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "nix-web";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "gorgon";
     repo = "gorgon";
     rev = "nix-web-v${version}";
-    hash = "sha256-+IDvoMRuMt1nS69yFhPPVs+s6Dj0dgXVdjjd9f3+spk=";
+    hash = "sha256-M/0nlD2jUtvdWJ647QHrp8JcUUVYxiLJlGjnZ+cfpYU=";
   };
-  cargoHash = "sha256-uVBfIw++MRxgVAC+KzGVuMZra8oktUfHcZQk90FF1a8=";
+  cargoHash = "sha256-6kcpP/CFiy571B98Y96/cdcClH50gdyPLZ28Npva7B4=";
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ openssl ];
+  buildInputs = lib.optional (!stdenv.isDarwin) openssl
+    ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
 
   postPatch = ''
     substituteInPlace nix-web/nix-web.service \
@@ -36,12 +40,13 @@ rustPlatform.buildRustPackage rec {
   cargoBuildFlags = cargoFlags;
   cargoTestFlags = cargoFlags;
 
-  NIX_WEB_BUILD_NIX_CLI_PATH = "${nix}/bin/nix";
+  NIX_WEB_BUILD_NIX_CLI_PATH = "${nixPackage}/bin/nix";
 
   meta = with lib; {
     description = "Web interface for the Nix store";
     homepage = "https://codeberg.org/gorgon/gorgon/src/branch/main/nix-web";
     license = licenses.eupl12;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ embr ];
     mainProgram = "nix-web";
   };

pkgs/by-name/sp/spicetify-cli/package.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "spicetify-cli";
-  version = "2.29.1";
+  version = "2.30.0";
 
   src = fetchFromGitHub {
     owner = "spicetify";
     repo = "spicetify-cli";
     rev = "v${version}";
-    hash = "sha256-fgecZn0/CWQFH4Tnm5kqOOvWlE1jzGvG6LxVN7KryPg=";
+    hash = "sha256-kQcAn5/NzzH+i24Ss6GaQEycazraE03R4tqMhxKROcY=";
   };
 
-  vendorHash = "sha256-alNUJ+ejwZPvefCTHt0/NWSAIt4MFzbPmkMinMrpe2M=";
+  vendorHash = "sha256-T7aUjzb69ZAnpLCpHv5C6ZyUktfC8Zt94rIju8QplWI=";
 
   ldflags = [
     "-s -w"

pkgs/by-name/ta/tailwindcss-language-server/package.nix

@@ -9,7 +9,7 @@
 }:
 
 let
-  version = "0.0.14";
+  version = "0.0.16";
 in
 buildNpmPackage {
   pname = "tailwindcss-language-server";
@@ -19,11 +19,11 @@ buildNpmPackage {
     owner = "tailwindlabs";
     repo = "tailwindcss-intellisense";
     rev = "@tailwindcss/language-server@v${version}";
-    hash = "sha256-EE1Gd0cmcJmyleoXVNtMJ8IKYpQIzRf2F42HOORHbwo=";
+    hash = "sha256-azzWrT8Ac+bdEfmNo+9WfQgHwA3+q9yGZMLfYXAQHtU=";
   };
 
   makeCacheWritable = true;
-  npmDepsHash = "sha256-gQgGIo/cS0P1B5lSmNpd8WOgucf3RbRk1YOvMXNbxb0=";
+  npmDepsHash = "sha256-z2fLtGnYgI8ocWTBrqpdElgjNghoE42LFJRWyVt/U7M=";
   npmWorkspace = "packages/tailwindcss-language-server";
 
   buildInputs = [ libsecret ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ Security AppKit ]);

pkgs/data/fonts/cozette/default.nix

@@ -2,11 +2,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "cozette";
-  version = "1.23.1";
+  version = "1.23.2";
 
   src = fetchzip {
     url = "https://github.com/slavfox/Cozette/releases/download/v.${version}/CozetteFonts-v-${builtins.replaceStrings ["."] ["-"] version}.zip";
-    hash = "sha256-LbC5siSxDZnOEkfxeqOSyoaDuTEMG2xCpZaOZrHLTJo=";
+    hash = "sha256-v1UWrVx1PnNPiFtMMy4kOkIe//iHxx0LOA4nHo95Zws=";
   };
 
   installPhase = ''

pkgs/development/libraries/glib/default.nix

@@ -280,7 +280,7 @@ stdenv.mkDerivation (finalAttrs: {
       "gobject-2.0"
       "gthread-2.0"
     ];
-    platforms   = platforms.unix;
+    platforms   = platforms.unix ++ platforms.windows;
 
     longDescription = ''
       GLib provides the core application building blocks for libraries

pkgs/development/libraries/harfbuzz/default.nix

@@ -115,7 +115,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/harfbuzz/harfbuzz/raw/${version}/NEWS";
     maintainers = [ maintainers.eelco ];
     license = licenses.mit;
-    platforms = platforms.unix;
+    platforms = platforms.unix ++ platforms.windows;
     pkgConfigModules = [
       "harfbuzz"
       "harfbuzz-gobject"

pkgs/development/libraries/libjcat/default.nix

@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libjcat";
-  version = "0.1.14";
+  version = "0.2.0";
 
   outputs = [ "bin" "out" "dev" "devdoc" "man" "installedTests" ];
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     owner = "hughsie";
     repo = "libjcat";
     rev = version;
-    sha256 = "sha256-XN7/ZtWCCO7lSspXM4vNowoWN1U0NGQPUTM9KjTEHjY=";
+    sha256 = "sha256-nLn2s9hX9f6I1Avxzs24ZPQHglJqKSUTpBpwskVyJKw=";
   };
 
   patches = [

pkgs/development/libraries/proj/default.nix

@@ -15,14 +15,14 @@
 , cacert
 }:
 
-stdenv.mkDerivation (finalAttrs: rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "proj";
   version = "9.3.1";
 
   src = fetchFromGitHub {
     owner = "OSGeo";
     repo = "PROJ";
-    rev = version;
+    rev = finalAttrs.version;
     hash = "sha256-M8Zgy5xnmZu7mzxXXGqaIfe7o7iMf/1sOJVOBsTvtdQ=";
   };
 
@@ -68,7 +68,7 @@ stdenv.mkDerivation (finalAttrs: rec {
   };
 
   meta = with lib; {
-    changelog = "https://github.com/OSGeo/PROJ/blob/${src.rev}/NEWS";
+    changelog = "https://github.com/OSGeo/PROJ/blob/${finalAttrs.src.rev}/NEWS";
     description = "Cartographic Projections Library";
     homepage = "https://proj.org/";
     license = licenses.mit;

pkgs/development/libraries/silgraphite/graphite2.nix

@@ -52,6 +52,6 @@ stdenv.mkDerivation rec {
     license = licenses.lgpl21;
     maintainers = [ maintainers.raskin ];
     mainProgram = "gr2fonttest";
-    platforms = platforms.unix;
+    platforms = platforms.unix ++ platforms.windows;
   };
 }

pkgs/development/python-modules/dnf-plugins-core/default.nix

@@ -22,7 +22,7 @@ in
 
 buildPythonPackage rec {
   pname = "dnf-plugins-core";
-  version = "4.4.3";
+  version = "4.4.4";
   format = "other";
 
   outputs = [ "out" "man" ];
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "rpm-software-management";
     repo = "dnf-plugins-core";
     rev = version;
-    hash = "sha256-YEw8REvK2X7mBg9HDI6V2p8QtZ3TJh4Dzn8Uuhfbrgo=";
+    hash = "sha256-SGgUozOAU6h87SguXh+13CxV4GnVhdN3SpwKfDPh2GY=";
   };
 
   patches = [

pkgs/development/python-modules/marshmallow-sqlalchemy/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "marshmallow-sqlalchemy";
-  version = "0.29.0";
+  version = "0.30.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-NSOndDkO8MHA98cIp1GYCcU5bPYIcg8U9Vw290/1u+w=";
+    hash = "sha256-Ka0KT9G0oeUtywf5Zz0oSmsHlRQZFswhadTuml0Ac0c=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/mautrix/default.nix

@@ -16,20 +16,21 @@
 , pytest-asyncio
 , aiosqlite
 , asyncpg
+, ruamel-yaml
 }:
 
 buildPythonPackage rec {
   pname = "mautrix";
-  version = "0.20.3";
+  version = "0.20.4";
   format = "setuptools";
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.10";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7ZSPxKRLAgwC1ECxa1eOTH60cMJXs1iv2PE2Vq9f0co=";
+    hash = "sha256-A9d/r4Caeo4tO82/MMXgU5xKvXRDnK0iQUm8AFhDPLM=";
   };
 
   propagatedBuildInputs = [
@@ -51,12 +52,10 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
-  ];
-
-  checkInputs = [
     pytest-asyncio
     aiosqlite
     asyncpg
+    ruamel-yaml
   ] ++ passthru.optional-dependencies.encryption;
 
   pythonImportsCheck = [

pkgs/development/python-modules/mwparserfromhell/default.nix

@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "mwparserfromhell";
-  version = "0.6.5";
+  version = "0.6.6";
   format = "setuptools";
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-K60L/2FFdjmeRHDWQAuinFLVlWgqS43mQq+7W+v0o0Y=";
+    hash = "sha256-ca/sHpeEulduldbzSEVYLTxzOjpSuncN2KnDpA5bZJ8=";
   };
 
   postPatch = ''

pkgs/development/python-modules/paddlepaddle/default.nix

@@ -28,8 +28,10 @@ let
   version = "2.5.0";
   format = "wheel";
   pyShortVersion = "cp${builtins.replaceStrings ["."] [""] python.pythonVersion}";
+  cpuOrGpu = if cudaSupport then "gpu" else "cpu";
   allHashAndPlatform = import ./binary-hashes.nix;
-  hash = allHashAndPlatform."${stdenv.system}"."${if cudaSupport then "gpu" else "cpu"}"."${pyShortVersion}";
+  hash = allHashAndPlatform."${stdenv.system}"."${cpuOrGpu}"."${pyShortVersion}"
+    or (throw "${pname} has no binary-hashes.nix entry for '${stdenv.system}.${cpuOrGpu}.${pyShortVersion}' attribute");
   platform = allHashAndPlatform."${stdenv.system}".platform;
   src = fetchPypi ({
     inherit version format hash platform;

pkgs/development/python-modules/pglast/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pglast";
-  version = "5.7";
+  version = "5.8";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-5JYygEthxFvjjbKpzw2CJNAvtrnCqdnR0sbJHhNRYFw=";
+    hash = "sha256-+3ysQuGrAH5xCBKaP0T/PLfbmLuxiKHPB+76D32GG9E=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/virt-firmware/default.nix

@@ -30,6 +30,7 @@ buildPythonPackage rec {
   pytestFlagsArray = ["tests/tests.py"];
 
   propagatedBuildInputs = [
+    setuptools
     cryptography
     pefile
   ];

pkgs/development/tools/azcopy/default.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "azure-storage-azcopy";
-  version = "10.22.1";
+  version = "10.22.2";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-storage-azcopy";
     rev = "refs/tags/v${version}";
-    hash = "sha256-WS8h4WRiCTthZOT3NQE8h7BihpaHFfCe39XoGvnDZ1k=";
+    hash = "sha256-mC6iAsUmnJeVIJPkoI/pNN6mujALW9qvQ4M7Wk9eLnQ=";
   };
 
   subPackages = [ "." ];

pkgs/development/tools/rust/cargo-mutants/default.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-mutants";
-  version = "23.12.2";
+  version = "24.1.0";
 
   src = fetchFromGitHub {
     owner = "sourcefrog";
     repo = "cargo-mutants";
     rev = "v${version}";
-    hash = "sha256-TFVk8uq+wBfCmwU5klqapxp6IeJNnvoH6pDKC8NJuao=";
+    hash = "sha256-hWM8QtzWUrhWHTAv4Fgq9F3ZIZS2HVP4R8J/HIh8T+0=";
   };
 
-  cargoHash = "sha256-cN7mgyKzuYZT+g8j04Ncqb4s2mwyTsNib5RssrEa2F8=";
+  cargoHash = "sha256-dKhxyhLWeaP9/qYZLMDFGF2DmKhzPXOT5qXHP3D3MjY=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.SystemConfiguration

pkgs/games/iortcw/sp.nix

@@ -47,6 +47,6 @@ stdenv.mkDerivation rec {
     homepage = src.meta.homepage;
     license = licenses.gpl3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ rjpcasalino ];
   };
 }

pkgs/os-specific/linux/kernel/common-config.nix

@@ -297,6 +297,7 @@ let
       # At the time of writing (25-06-2023): this is only used in a "correct" way by ath drivers for initiating DFS radiation
       # for "certified devices"
       EXPERT                      = option yes; # this is needed for offering the certification option
+      RFKILL_INPUT                = option yes; # counteract an undesired effect of setting EXPERT
       CFG80211_CERTIFICATION_ONUS = option yes;
       # DFS: "Dynamic Frequency Selection" is a spectrum-sharing mechanism that allows
       # you to use certain interesting frequency when your local regulatory domain mandates it.

pkgs/os-specific/linux/libtraceevent/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "libtraceevent";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/libtrace/libtraceevent.git";
     rev = "libtraceevent-${version}";
-    hash = "sha256-zib2IrgtaDGDEO/2Kp9ytHuceW/7slRPDUClYgqemOE=";
+    hash = "sha256-2oa3pR8DOPaeHcoqcLX00ihx1lpXablnsf0IZR2sOm8=";
   };
 
   postPatch = ''

pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix

@@ -1,6 +1,5 @@
 { stdenv
 , fetchFromGitHub
-, fetchurl
 , lib
 , curl
 , nlohmann_json
@@ -9,7 +8,6 @@
 , linkFarmFromDrvs
 , callPackage
 }:
-
 let
   # Although those headers are also included in the source of `sgx-psw`, the `azure-dcap-client` build needs specific versions
   filterSparse = list: ''
@@ -18,19 +16,11 @@ let
     cp ${lib.concatStringsSep " " list} "$out/"
   '';
   headers = linkFarmFromDrvs "azure-dcpa-client-intel-headers" [
-    (fetchFromGitHub rec {
-      name = "${repo}-headers";
-      owner = "intel";
-      repo = "SGXDataCenterAttestationPrimitives";
-      rev = "0436284f12f1bd5da7e7a06f6274d36b4c8d39f9";
-      sparseCheckout = [ "QuoteGeneration/quote_wrapper/common/inc/sgx_ql_lib_common.h" ];
-      hash = "sha256-ipKpYHbiwjCUXF/pCArJZy5ko1YX2wqMMdSnMUzhkgY=";
-      postFetch = filterSparse sparseCheckout;
-    })
     (fetchFromGitHub rec {
       name = "${repo}-headers";
       owner = "intel";
       repo = "linux-sgx";
+      # See: <src/Linux/configure> for the revision `azure-dcap-client` uses.
       rev = "1ccf25b64abd1c2eff05ead9d14b410b3c9ae7be";
       hash = "sha256-WJRoS6+NBVJrFmHABEEDpDhW+zbWFUl65AycCkRavfs=";
       sparseCheckout = [
@@ -44,13 +34,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "azure-dcap-client";
-  version = "1.11.2";
+  version = "1.12.1";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = pname;
     rev = version;
-    hash = "sha256-EYj3jnzTyJRl6N7avNf9VrB8r9U6zIE6wBNeVsMtWCA=";
+    hash = "sha256-q0dI4WdA1ue4sw+QfSherh31Ldf9gnhoft66o3E9gnU=";
   };
 
   nativeBuildInputs = [

pkgs/os-specific/linux/sgx/azure-dcap-client/test-suite.nix

@@ -3,12 +3,16 @@
 , gtest
 , makeWrapper
 }:
-sgx-azure-dcap-client.overrideAttrs (oldAttrs: {
-  nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [
+sgx-azure-dcap-client.overrideAttrs (old: {
+  nativeBuildInputs = old.nativeBuildInputs ++ [
     makeWrapper
     gtest
   ];
 
+  patches = [
+    ./tests-missing-includes.patch
+  ];
+
   buildFlags = [
     "tests"
   ];
@@ -22,6 +26,7 @@ sgx-azure-dcap-client.overrideAttrs (oldAttrs: {
   '';
 
   postFixup = ''
-    wrapProgram "$out/bin/tests" --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ sgx-azure-dcap-client ]}"
+    wrapProgram "$out/bin/tests" \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ sgx-azure-dcap-client ]}"
   '';
 })

pkgs/os-specific/linux/sgx/azure-dcap-client/tests-missing-includes.patch

@@ -0,0 +1,12 @@
+diff --git a/src/UnitTest/test_local_cache.cpp b/src/UnitTest/test_local_cache.cpp
+index 5fbc31b..6b8d52e 100644
+--- a/src/UnitTest/test_local_cache.cpp
++++ b/src/UnitTest/test_local_cache.cpp
+@@ -5,6 +5,7 @@
+ #include <gtest/gtest.h>
+ 
+ #undef NDEBUG // ensure that asserts are never compiled out
++#include <array>
+ #include <cassert>
+ #include <cstdio>
+ #include <cstring>

pkgs/os-specific/linux/sgx/psw/default.nix

@@ -5,15 +5,11 @@
 , coreutils
 , curl
 , file
-, glibc
 , makeWrapper
 , nixosTests
 , protobuf
 , python3
 , sgx-sdk
-, shadow
-, systemd
-, util-linux
 , which
 , debug ? false
 }:
@@ -23,16 +19,21 @@ stdenv.mkDerivation rec {
 
   postUnpack =
     let
+      # Fetch the pre-built, Intel-signed Architectural Enclaves (AE). They help
+      # run user application enclaves, verify launch policies, produce remote
+      # attestation quotes, and do platform certification.
       ae.prebuilt = fetchurl {
         url = "https://download.01.org/intel-sgx/sgx-linux/${versionTag}/prebuilt_ae_${versionTag}.tar.gz";
-        hash = "sha256-JriA9UGYFkAPuCtRizk8RMM1YOYGR/eO9ILnx47A40s=";
+        hash = "sha256-IckW4p1XWkWCDCErXyTtnKYKeAUaCrp5iAMsRBMjLX0=";
       };
+      # Also include the Data Center Attestation Primitives (DCAP) platform
+      # enclaves.
       dcap = rec {
-        version = "1.13";
+        version = "1.18";
         filename = "prebuilt_dcap_${version}.tar.gz";
         prebuilt = fetchurl {
           url = "https://download.01.org/intel-sgx/sgx-dcap/${version}/linux/${filename}";
-          hash = "sha256-0kD6hxN8qZ/7/H99aboQx7Qg7ewmYPEexoU6nqczAik=";
+          hash = "sha256-9ceys7ozOEienug+9MTZ6dw3nx7VBfxLNiwhZYv4SzY=";
         };
       };
     in
@@ -75,9 +76,6 @@ stdenv.mkDerivation rec {
 
   dontUseCmakeConfigure = true;
 
-  # Randomly fails if enabled
-  enableParallelBuilding = false;
-
   buildFlags = [
     "psw_install_pkg"
   ] ++ lib.optionals debug [
@@ -120,8 +118,18 @@ stdenv.mkDerivation rec {
     rm $sgxPswDir/{cleanup.sh,startup.sh}
     rm -r $sgxPswDir/scripts
 
+    # Move aesmd binaries/libraries/enclaves
     mv $sgxPswDir/aesm/ $out/
 
+    # We absolutely MUST avoid stripping or patching these ".signed.so" SGX
+    # enclaves. Stripping would change each enclave measurement (hash of the
+    # binary).
+    #
+    # We're going to temporarily move these enclave libs to another directory
+    # until after stripping/patching in the fixupPhase.
+    mkdir $TMPDIR/enclaves
+    mv $out/aesm/*.signed.so* $TMPDIR/enclaves
+
     mkdir $out/bin
     makeWrapper $out/aesm/aesm_service $out/bin/aesm_service \
       --suffix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ protobuf ]}:$out/aesm \
@@ -131,10 +139,23 @@ stdenv.mkDerivation rec {
     rmdir $sgxPswDir || (echo "Error: The directory $installDir still contains unhandled files: $(ls -A $installDir)" >&2 && exit 1)
   '';
 
-  # Most—if not all—of those fixups are not relevant for NixOS as we have our own
-  # NixOS module which is based on those files without relying on them. Still, it
-  # is helpful to have properly patched versions for non-NixOS distributions.
+  stripDebugList = [
+    "lib"
+    "bin"
+    # Also strip binaries/libs in the `aesm` directory
+    "aesm"
+  ];
+
   postFixup = ''
+    # Move the SGX enclaves back after everything else has been stripped.
+    mv $TMPDIR/enclaves/*.signed.so* $out/aesm/
+    rmdir $TMPDIR/enclaves
+
+    # Fixup the aesmd systemd service
+    #
+    # Most—if not all—of those fixups are not relevant for NixOS as we have our own
+    # NixOS module which is based on those files without relying on them. Still, it
+    # is helpful to have properly patched versions for non-NixOS distributions.
     echo "Fixing aesmd.service"
     substituteInPlace $out/lib/systemd/system/aesmd.service \
       --replace '@aesm_folder@' \
@@ -151,11 +172,6 @@ stdenv.mkDerivation rec {
                 "${coreutils}/bin/chmod" \
       --replace "/bin/kill" \
                 "${coreutils}/bin/kill"
-
-    echo "Fixing remount-dev-exec.service"
-    substituteInPlace $out/lib/systemd/system/remount-dev-exec.service \
-      --replace '/bin/mount' \
-                "${util-linux}/bin/mount"
   '';
 
   passthru.tests = {

pkgs/os-specific/linux/sgx/samples/default.nix

@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , makeWrapper
+, openssl
 , sgx-sdk
 , sgx-psw
 , which
@@ -18,6 +19,7 @@ let
 
     nativeBuildInputs = [
       makeWrapper
+      openssl
       which
     ];
 
@@ -66,7 +68,9 @@ let
 in
 {
   cxx11SGXDemo = buildSample "Cxx11SGXDemo";
-  localAttestation = (buildSample "LocalAttestation").overrideAttrs (oldAttrs: {
+  cxx14SGXDemo = buildSample "Cxx14SGXDemo";
+  cxx17SGXDemo = buildSample "Cxx17SGXDemo";
+  localAttestation = (buildSample "LocalAttestation").overrideAttrs (old: {
     installPhase = ''
       runHook preInstall
 
@@ -86,7 +90,7 @@ in
   });
   powerTransition = buildSample "PowerTransition";
   protobufSGXDemo = buildSample "ProtobufSGXDemo";
-  remoteAttestation = (buildSample "RemoteAttestation").overrideAttrs (oldAttrs: {
+  remoteAttestation = (buildSample "RemoteAttestation").overrideAttrs (old: {
     # Makefile sets rpath to point to $TMPDIR
     preFixup = ''
       patchelf --remove-rpath $out/bin/app
@@ -97,13 +101,40 @@ in
     '';
   });
   sampleEnclave = buildSample "SampleEnclave";
-  sampleEnclavePCL = buildSample "SampleEnclavePCL";
   sampleEnclaveGMIPP = buildSample "SampleEnclaveGMIPP";
-  sealUnseal = (buildSample "SealUnseal").overrideAttrs (oldAttrs: {
+  sampleMbedCrypto = buildSample "SampleMbedCrypto";
+  sealUnseal = (buildSample "SealUnseal").overrideAttrs (old: {
     prePatch = ''
       substituteInPlace App/App.cpp \
         --replace '"sealed_data_blob.txt"' '"/tmp/sealed_data_blob.txt"'
     '';
   });
   switchless = buildSample "Switchless";
+  # # Requires SGX-patched openssl (sgxssl) build
+  # sampleAttestedTLS = buildSample "SampleAttestedTLS";
+} // lib.optionalAttrs (!isSimulation) {
+  # # Requires kernel >= v6.2 && HW SGX
+  # sampleAEXNotify = buildSample "SampleAEXNotify";
+
+  # Requires HW SGX
+  sampleCommonLoader = (buildSample "SampleCommonLoader").overrideAttrs (old: {
+    nativeBuildInputs = [ sgx-psw ] ++ old.nativeBuildInputs;
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/{bin,lib}
+      mv sample app
+      install -m 755 app $out/bin
+
+      wrapProgram "$out/bin/app" \
+        --chdir "$out/lib" \
+        --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [sgx-psw]}"
+
+      runHook postInstall
+    '';
+  });
+
+  # # SEGFAULTs in simulation mode?
+  # sampleEnclavePCL = buildSample "SampleEnclavePCL";
 }

pkgs/os-specific/linux/sgx/sdk/default.nix

@@ -2,7 +2,6 @@
 , stdenv
 , fetchFromGitHub
 , fetchpatch
-, fetchzip
 , autoconf
 , automake
 , binutils
@@ -13,10 +12,9 @@
 , git
 , libtool
 , linkFarmFromDrvs
-, nasm
 , ocaml
 , ocamlPackages
-, openssl_1_1
+, openssl
 , perl
 , python3
 , texinfo
@@ -29,15 +27,15 @@
 stdenv.mkDerivation rec {
   pname = "sgx-sdk";
   # Version as given in se_version.h
-  version = "2.16.100.4";
+  version = "2.21.100.1";
   # Version as used in the Git tag
-  versionTag = "2.16";
+  versionTag = "2.21";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "linux-sgx";
     rev = "sgx_${versionTag}";
-    hash = "sha256-qgXuJJWiqmcU11umCsE3DnlK4VryuTDAsNf53YPw6UY=";
+    hash = "sha256-Yo2G0H0XUI2p9W7lDRLkFHw2t8X1220brGohQJ0r2WY=";
     fetchSubmodules = true;
   };
 
@@ -55,10 +53,32 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  # There's a `make preparation` step that downloads some prebuilt binaries and
+  # applies some patches to the in-repo git submodules. We can't just run it,
+  # since it downloads things, so this step just extracts the patching steps.
   postPatch = ''
     patchShebangs linux/installer/bin/build-installpkg.sh \
       linux/installer/common/sdk/createTarball.sh \
-      linux/installer/common/sdk/install.sh
+      linux/installer/common/sdk/install.sh \
+      external/sgx-emm/create_symlink.sh
+
+    echo "Running 'make preparation' but without download steps"
+
+    # Seems to download something. Build currently uses ipp-crypto and not
+    # sgxssl so probably not an issue.
+    # $ ./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild
+
+    pushd external/openmp/openmp_code
+      git apply ../0001-Enable-OpenMP-in-SGX.patch >/dev/null 2>&1 \
+        || git apply ../0001-Enable-OpenMP-in-SGX.patch --check -R
+    popd
+
+    pushd external/protobuf/protobuf_code
+      git apply ../sgx_protobuf.patch >/dev/null 2>&1 \
+        || git apply ../sgx_protobuf.patch --check -R
+    popd
+
+    ./external/sgx-emm/create_symlink.sh
   '';
 
   # We need `cmake` as a build input but don't use it to kick off the build phase
@@ -84,7 +104,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libtool
-    openssl_1_1
+    openssl
   ];
 
   BINUTILS_DIR = "${binutils}/bin";
@@ -123,7 +143,7 @@ stdenv.mkDerivation rec {
         lib/linux/intel64/cve_2020_0551_cf/libippcp.a
 
       rm inc/ippcp.h
-      patch ${ipp-crypto-no_mitigation}/include/ippcp.h -i inc/ippcp21u3.patch -o inc/ippcp.h
+      patch ${ipp-crypto-no_mitigation}/include/ippcp.h -i inc/ippcp21u7.patch -o inc/ippcp.h
 
       install -D ${ipp-crypto-no_mitigation.src}/LICENSE license/LICENSE
 
@@ -136,8 +156,6 @@ stdenv.mkDerivation rec {
     "DEBUG=1"
   ];
 
-  enableParallelBuilding = true;
-
   postBuild = ''
     patchShebangs linux/installer/bin/sgx_linux_x64_sdk_${version}.bin
   '';
@@ -166,6 +184,11 @@ stdenv.mkDerivation rec {
     mv $installDir/lib64 lib
     ln -s lib/ lib64
 
+    # Fixup the symlinks for libsgx_urts.so.* -> libsgx_urts.so
+    for file in lib/libsgx_urts.so.*; do
+      ln -srf lib/libsgx_urts.so $file
+    done
+
     mv $installDir/include/ .
 
     mkdir -p share/
@@ -204,7 +227,6 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-
   preFixup = ''
     echo "Strip sgxsdk prefix"
     for path in "$out/share/bin/environment" "$out/bin/sgx-gdb"; do

pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix

@@ -1,36 +1,28 @@
-{ lib
-, gcc11Stdenv
+{ gcc11Stdenv
 , fetchFromGitHub
 , cmake
 , nasm
-, openssl_1_1
+, openssl
 , python3
 , extraCmakeFlags ? [ ]
 }:
-
 gcc11Stdenv.mkDerivation rec {
   pname = "ipp-crypto";
-  version = "2021.3";
+  version = "2021.9.0";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "ipp-crypto";
     rev = "ippcp_${version}";
-    hash = "sha256-QEJXvQ//zhQqibFxXwPMdS1MHewgyb24LRmkycVSGrM=";
+    hash = "sha256-+ITnxyrkDQp4xRa+PVzXdYsSkI5sMNwQGfGU+lFJ6co=";
   };
 
-  # Fix typo: https://github.com/intel/ipp-crypto/pull/33
-  postPatch = ''
-    substituteInPlace sources/cmake/ippcp-gen-config.cmake \
-      --replace 'ippcpo-config.cmake' 'ippcp-config.cmake'
-  '';
-
   cmakeFlags = [ "-DARCH=intel64" ] ++ extraCmakeFlags;
 
   nativeBuildInputs = [
     cmake
     nasm
-    openssl_1_1
+    openssl
     python3
   ];
 }

pkgs/os-specific/linux/sgx/ssl/default.nix

@@ -1,8 +1,8 @@
 { stdenv
 , fetchFromGitHub
-, fetchpatch
 , fetchurl
 , lib
+, openssl
 , perl
 , sgx-sdk
 , which
@@ -10,9 +10,9 @@
 }:
 let
   sgxVersion = sgx-sdk.versionTag;
-  opensslVersion = "1.1.1l";
+  opensslVersion = "1.1.1u";
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "sgx-ssl" + lib.optionalString debug "-debug";
   version = "${sgxVersion}_${opensslVersion}";
 
@@ -20,25 +20,20 @@ stdenv.mkDerivation rec {
     owner = "intel";
     repo = "intel-sgx-ssl";
     rev = "lin_${sgxVersion}_${opensslVersion}";
-    hash = "sha256-ibPXs90ni2fkxJ09fNO6wWVpfCFdko6MjBFkEsyIih8=";
+    hash = "sha256-zbXEQz72VUPqnGrboX6oXliaLpbcos7tV6K9lX+zleg=";
   };
 
   postUnpack =
     let
       opensslSourceArchive = fetchurl {
         url = "https://www.openssl.org/source/openssl-${opensslVersion}.tar.gz";
-        hash = "sha256-C3o+XlnDSCf+DDp0t+yLrvMCuY+oAIjX+RU6oW+na9E=";
+        hash = "sha256-4vjYS1I+7NBse+diaDA3AwD7zBU4a/UULXJ1j2lj68Y=";
       };
     in
     ''
       ln -s ${opensslSourceArchive} $sourceRoot/openssl_source/openssl-${opensslVersion}.tar.gz
     '';
 
-  patches = [
-    # https://github.com/intel/intel-sgx-ssl/pull/111
-    ./intel-sgx-ssl-pr-111.patch
-  ];
-
   postPatch = ''
     patchShebangs Linux/build_openssl.sh
 
@@ -48,8 +43,6 @@ stdenv.mkDerivation rec {
                 'bash -c "true"'
   '';
 
-  enableParallelBuilding = true;
-
   nativeBuildInputs = [
     perl
     sgx-sdk
@@ -68,28 +61,21 @@ stdenv.mkDerivation rec {
   ];
 
   # Build the test app
-  #
-  # Running the test app is currently only supported on Intel CPUs
-  # and will fail on non-Intel CPUs even in SGX simulation mode.
-  # Therefore, we only build the test app without running it until
-  # upstream resolves the issue: https://github.com/intel/intel-sgx-ssl/issues/113
   doInstallCheck = true;
-  installCheckTarget = "all";
+  installCheckTarget = "test";
   installCheckFlags = [
     "SGX_MODE=SIM"
-    "-C sgx/test_app"
     "-j 1" # Makefile doesn't support multiple jobs
   ];
-  preInstallCheck = ''
-    # Expects the enclave file in the current working dir
-    ln -s sgx/test_app/TestEnclave.signed.so .
-  '';
+  nativeInstallCheckInputs = [
+    openssl
+  ];
 
   meta = with lib; {
     description = "Cryptographic library for Intel SGX enclave applications based on OpenSSL";
     homepage = "https://github.com/intel/intel-sgx-ssl";
     maintainers = with maintainers; [ trundle veehaitch ];
     platforms = [ "x86_64-linux" ];
-    license = with licenses; [ bsd3 openssl ];
+    license = [ licenses.bsd3 licenses.openssl ];
   };
 }

pkgs/os-specific/linux/sgx/ssl/intel-sgx-ssl-pr-111.patch

@@ -1,99 +0,0 @@
-From 1683c336e11b3cbe2b48c1be1c9460a661523c71 Mon Sep 17 00:00:00 2001
-From: Vincent Haupert <mail@vincent-haupert.de>
-Date: Sat, 8 Jan 2022 17:22:31 +0100
-Subject: [PATCH 1/3] Linux: fix Nix detection
-
-Detect the `OS_ID` of Nix by probing for the presence of the `NIX_STORE`
-environment variable instead of `NIX_PATH`. The latter is only set in a
-`nix-shell` session but isn't when building a derivation through
-`nix-build`. In contrast, the `NIX_STORE` environment variable is set in
-both cases.
-
-Signed-off-by: Vincent Haupert <mail@vincent-haupert.de>
----
- Linux/sgx/buildenv.mk | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/Linux/sgx/buildenv.mk b/Linux/sgx/buildenv.mk
-index cd8818e..dac23c7 100644
---- a/Linux/sgx/buildenv.mk
-+++ b/Linux/sgx/buildenv.mk
-@@ -65,7 +65,7 @@ $(shell mkdir -p $(PACKAGE_LIB))
- UBUNTU_CONFNAME:=/usr/include/x86_64-linux-gnu/bits/confname.h
- ifneq ("$(wildcard $(UBUNTU_CONFNAME))","")
- 	OS_ID=1
--else ifeq ($(origin NIX_PATH),environment)
-+else ifeq ($(origin NIX_STORE),environment)
- 	OS_ID=3
- else
- 	OS_ID=2
-
-From f493525face589d759223bfa45bb802c31ddce4f Mon Sep 17 00:00:00 2001
-From: Vincent Haupert <mail@vincent-haupert.de>
-Date: Sat, 8 Jan 2022 17:33:22 +0100
-Subject: [PATCH 2/3] Linux: call binaries relative to PATH
-
-Using an absolute path to call binaries is incompatible with
-distributions which do not follow the Filesystem Hierachy Standard;
-Nix is an example. Also, it is inconsistent with the rest of the code
-base, let alone superfluous.
-
-Signed-off-by: Vincent Haupert <mail@vincent-haupert.de>
----
- Linux/build_openssl.sh | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/Linux/build_openssl.sh b/Linux/build_openssl.sh
-index 7d77b79..e8b59a1 100755
---- a/Linux/build_openssl.sh
-+++ b/Linux/build_openssl.sh
-@@ -38,7 +38,7 @@ SGXSSL_ROOT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
- echo $SGXSSL_ROOT
- 
- OPENSSL_INSTALL_DIR="$SGXSSL_ROOT/../openssl_source/OpenSSL_install_dir_tmp"
--OPENSSL_VERSION=`/bin/ls $SGXSSL_ROOT/../openssl_source/*1.1.1*.tar.gz | /usr/bin/head -1 | /bin/grep -o '[^/]*$' | /bin/sed -s -- 's/\.tar\.gz//'`
-+OPENSSL_VERSION=`ls $SGXSSL_ROOT/../openssl_source/*1.1.1*.tar.gz | head -1 | grep -o '[^/]*$' | sed -s -- 's/\.tar\.gz//'`
- if [ "$OPENSSL_VERSION" == "" ] 
- then
- 	echo "In order to run this script, OpenSSL tar.gz package must be located in openssl_source/ directory."
-
-From fdb883d30fff72b5cfb8c61a2288d3d948f64224 Mon Sep 17 00:00:00 2001
-From: Vincent Haupert <mail@vincent-haupert.de>
-Date: Tue, 11 Jan 2022 10:56:39 +0100
-Subject: [PATCH 3/3] Linux: properly extract GCC major version
-
-Calling `gcc -dumpversion` yields the full version string, e.g.,
-`10.3.0`. The `build_openssl.sh` bash script uses the `-ge` number
-comparison operator to check if the returned version is at least
-8. This results in an error if the returned GCC version includes a patch
-version; "10.3.0" isn't a valid number.
-
-This commit fixes the version detection by only extracting the relevant
-major version of GCC.
-
-Signed-off-by: Vincent Haupert <mail@vincent-haupert.de>
----
- Linux/build_openssl.sh | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/Linux/build_openssl.sh b/Linux/build_openssl.sh
-index e8b59a1..6e4046f 100755
---- a/Linux/build_openssl.sh
-+++ b/Linux/build_openssl.sh
-@@ -82,6 +82,7 @@ fi
- MITIGATION_OPT=""
- MITIGATION_FLAGS=""
- CC_VERSION=`gcc -dumpversion`
-+CC_VERSION_MAJOR=`echo "$CC_VERSION" | cut -f1 -d.`
- for arg in "$@"
- do
-     case $arg in
-@@ -99,7 +100,7 @@ do
-         ;;
-     -mfunction-return=thunk-extern)
-         MITIGATION_FLAGS+=" $arg"
--        if [[ $CC_VERSION -ge 8 ]] ; then
-+        if [[ "$CC_VERSION_MAJOR" -ge 8 ]] ; then
-             MITIGATION_FLAGS+=" -fcf-protection=none"
-         fi
-         shift

pkgs/os-specific/linux/sssd/default.nix

@@ -13,13 +13,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "sssd";
-  version = "2.9.3";
+  version = "2.9.4";
 
   src = fetchFromGitHub {
     owner = "SSSD";
     repo = "sssd";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-WTVOt2TpTCyMmFYzWJMBQdwgmov7m1Sd8CwyL4ywPUY=";
+    hash = "sha256-VJXZndbmC6mAVxzvv5Wjb4adrQkP16Rt4cgjl4qGDIc=";
   };
 
   postPatch = ''

pkgs/servers/misc/virtiofsd/default.nix

@@ -21,6 +21,14 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [ libcap_ng libseccomp ];
 
+  postConfigure = ''
+    sed -i "s|/usr/libexec|$out/bin|g" 50-virtiofsd.json
+  '';
+
+  postInstall = ''
+    install -Dm644 50-virtiofsd.json "$out/share/qemu/vhost-user/50-virtiofsd.json"
+  '';
+
   meta = with lib; {
     homepage = "https://gitlab.com/virtio-fs/virtiofsd";
     description = "vhost-user virtio-fs device backend written in Rust";

pkgs/servers/snac2/default.nix

@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation rec {
   pname = "snac2";
-  version = "2.43";
+  version = "2.44";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "grunfink";
     repo = pname;
     rev = version;
-    hash = "sha256-253uibzgo5p3DtODrZelZeULcd16lR7ueEOWidm6zOE=";
+    hash = "sha256-0bsXL6b41CchWrNZhQyPsj3JEjCLLdaOIi07icF6roQ=";
   };
 
   buildInputs = [ curl openssl ];

pkgs/tools/filesystems/stuffbin/default.nix

@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "stuffbin";
-  version = "1.2.0";
+  version = "1.3.0";
 
   vendorHash = null;
 
@@ -10,7 +10,7 @@ buildGoModule rec {
     owner = "knadh";
     repo = "stuffbin";
     rev = "v${version}";
-    sha256 = "sha256-roXjE0t4iwrL2y/G2oePYL2AbTwd9uzQPtgdY14WeZk=";
+    sha256 = "sha256-dOlc/G2IiuMAN0LqiZtbpXLSYaOpe5cl1+cs3YhaAbg=";
   };
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];

pkgs/tools/graphics/pngquant/add-Cargo.lock.patch

@@ -0,0 +1,428 @@
+diff --git a/Cargo.lock b/Cargo.lock
+new file mode 100644
+index 0000000..319b40b
+--- /dev/null
++++ b/Cargo.lock
+@@ -0,0 +1,422 @@
++# This file is automatically @generated by Cargo.
++# It is not intended for manual editing.
++version = 3
++
++[[package]]
++name = "arrayvec"
++version = "0.7.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"
++
++[[package]]
++name = "autocfg"
++version = "1.1.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
++
++[[package]]
++name = "bitflags"
++version = "1.3.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
++
++[[package]]
++name = "bitflags"
++version = "2.4.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07"
++
++[[package]]
++name = "bytemuck"
++version = "1.14.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "374d28ec25809ee0e23827c2ab573d729e293f281dfe393500e7ad618baa61c6"
++
++[[package]]
++name = "cc"
++version = "1.0.83"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
++dependencies = [
++ "jobserver",
++ "libc",
++]
++
++[[package]]
++name = "cfg-if"
++version = "1.0.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
++
++[[package]]
++name = "cocoa_image"
++version = "1.0.6"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "ea3dcd9c6980e6b9152a61476163a7039bdd73b4508f699b4b3b102d53490839"
++dependencies = [
++ "core-foundation",
++ "core-graphics",
++ "imgref",
++ "objc",
++ "rgb",
++]
++
++[[package]]
++name = "core-foundation"
++version = "0.9.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "194a7a9e6de53fa55116934067c844d9d749312f75c6f6d0980e8c252f8c2146"
++dependencies = [
++ "core-foundation-sys",
++ "libc",
++]
++
++[[package]]
++name = "core-foundation-sys"
++version = "0.8.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "e496a50fda8aacccc86d7529e2c1e0892dbd0f898a6b5645b5561b89c3210efa"
++
++[[package]]
++name = "core-graphics"
++version = "0.23.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "970a29baf4110c26fedbc7f82107d42c23f7e88e404c4577ed73fe99ff85a212"
++dependencies = [
++ "bitflags 1.3.2",
++ "core-foundation",
++ "core-graphics-types",
++ "foreign-types",
++ "libc",
++]
++
++[[package]]
++name = "core-graphics-types"
++version = "0.1.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "2bb142d41022986c1d8ff29103a1411c8a3dfad3552f87a4f8dc50d61d4f4e33"
++dependencies = [
++ "bitflags 1.3.2",
++ "core-foundation",
++ "libc",
++]
++
++[[package]]
++name = "crossbeam-deque"
++version = "0.8.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "ce6fd6f855243022dcecf8702fef0c297d4338e226845fe067f6341ad9fa0cef"
++dependencies = [
++ "cfg-if",
++ "crossbeam-epoch",
++ "crossbeam-utils",
++]
++
++[[package]]
++name = "crossbeam-epoch"
++version = "0.9.15"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "ae211234986c545741a7dc064309f67ee1e5ad243d0e48335adc0484d960bcc7"
++dependencies = [
++ "autocfg",
++ "cfg-if",
++ "crossbeam-utils",
++ "memoffset",
++ "scopeguard",
++]
++
++[[package]]
++name = "crossbeam-utils"
++version = "0.8.16"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "5a22b2d63d4d1dc0b7f1b6b2747dd0088008a9be28b6ddf0b1e7d335e3037294"
++dependencies = [
++ "cfg-if",
++]
++
++[[package]]
++name = "dunce"
++version = "1.0.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "56ce8c6da7551ec6c462cbaf3bfbc75131ebbfa1c944aeaa9dab51ca1c5f0c3b"
++
++[[package]]
++name = "either"
++version = "1.9.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
++
++[[package]]
++name = "foreign-types"
++version = "0.5.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
++dependencies = [
++ "foreign-types-macros",
++ "foreign-types-shared",
++]
++
++[[package]]
++name = "foreign-types-macros"
++version = "0.2.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "1a5c6c585bc94aaf2c7b51dd4c2ba22680844aba4c687be581871a6f518c5742"
++dependencies = [
++ "proc-macro2",
++ "quote",
++ "syn",
++]
++
++[[package]]
++name = "foreign-types-shared"
++version = "0.3.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "aa9a19cbb55df58761df49b23516a86d432839add4af60fc256da840f66ed35b"
++
++[[package]]
++name = "getopts"
++version = "0.2.21"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "14dbbfd5c71d70241ecf9e6f13737f7b5ce823821063188d7e46c41d371eebd5"
++dependencies = [
++ "unicode-width",
++]
++
++[[package]]
++name = "glob"
++version = "0.3.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "d2fabcfbdc87f4758337ca535fb41a6d701b65693ce38287d856d1674551ec9b"
++
++[[package]]
++name = "imagequant"
++version = "4.2.2"
++dependencies = [
++ "arrayvec",
++ "once_cell",
++ "rayon",
++ "rgb",
++ "thread_local",
++]
++
++[[package]]
++name = "imagequant-sys"
++version = "4.0.3"
++dependencies = [
++ "bitflags 2.4.1",
++ "imagequant",
++ "libc",
++]
++
++[[package]]
++name = "imgref"
++version = "1.10.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "90d944e334f00f4449c9640b440a171f816be0152305c12ef90424fc35fd035c"
++
++[[package]]
++name = "jobserver"
++version = "0.1.27"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "8c37f63953c4c63420ed5fd3d6d398c719489b9f872b9fa683262f8edd363c7d"
++dependencies = [
++ "libc",
++]
++
++[[package]]
++name = "lcms2-sys"
++version = "4.0.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "137dae56197ab9e66729ff73e2942e26f16f9ddcd14a53295c35f53dcd067b58"
++dependencies = [
++ "cc",
++ "dunce",
++ "libc",
++ "pkg-config",
++]
++
++[[package]]
++name = "libc"
++version = "0.2.150"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "89d92a4743f9a61002fae18374ed11e7973f530cb3a3255fb354818118b2203c"
++
++[[package]]
++name = "libpng-sys"
++version = "1.1.9"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "b531eb8c558e697d1fc6a642b260426aa85ba4d054a8f0db66f5866918332674"
++dependencies = [
++ "cc",
++ "dunce",
++ "libc",
++ "libz-sys",
++ "pkg-config",
++]
++
++[[package]]
++name = "libz-sys"
++version = "1.1.12"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "d97137b25e321a73eef1418d1d5d2eda4d77e12813f8e6dead84bc52c5870a7b"
++dependencies = [
++ "cc",
++ "libc",
++ "pkg-config",
++ "vcpkg",
++]
++
++[[package]]
++name = "malloc_buf"
++version = "0.0.6"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "62bb907fe88d54d8d9ce32a3cceab4218ed2f6b7d35617cafe9adf84e43919cb"
++dependencies = [
++ "libc",
++]
++
++[[package]]
++name = "memoffset"
++version = "0.9.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
++dependencies = [
++ "autocfg",
++]
++
++[[package]]
++name = "objc"
++version = "0.2.7"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "915b1b472bc21c53464d6c8461c9d3af805ba1ef837e1cac254428f4a77177b1"
++dependencies = [
++ "malloc_buf",
++]
++
++[[package]]
++name = "once_cell"
++version = "1.18.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
++
++[[package]]
++name = "pkg-config"
++version = "0.3.27"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"
++
++[[package]]
++name = "pngquant"
++version = "3.0.3"
++dependencies = [
++ "cc",
++ "cocoa_image",
++ "dunce",
++ "getopts",
++ "imagequant-sys",
++ "lcms2-sys",
++ "libc",
++ "libpng-sys",
++ "wild",
++]
++
++[[package]]
++name = "proc-macro2"
++version = "1.0.69"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da"
++dependencies = [
++ "unicode-ident",
++]
++
++[[package]]
++name = "quote"
++version = "1.0.33"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
++dependencies = [
++ "proc-macro2",
++]
++
++[[package]]
++name = "rayon"
++version = "1.8.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "9c27db03db7734835b3f53954b534c91069375ce6ccaa2e065441e07d9b6cdb1"
++dependencies = [
++ "either",
++ "rayon-core",
++]
++
++[[package]]
++name = "rayon-core"
++version = "1.12.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "5ce3fb6ad83f861aac485e76e1985cd109d9a3713802152be56c3b1f0e0658ed"
++dependencies = [
++ "crossbeam-deque",
++ "crossbeam-utils",
++]
++
++[[package]]
++name = "rgb"
++version = "0.8.37"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "05aaa8004b64fd573fc9d002f4e632d51ad4f026c2b5ba95fcb6c2f32c2c47d8"
++dependencies = [
++ "bytemuck",
++]
++
++[[package]]
++name = "scopeguard"
++version = "1.2.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
++
++[[package]]
++name = "syn"
++version = "2.0.39"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "23e78b90f2fcf45d3e842032ce32e3f2d1545ba6636271dcbf24fa306d87be7a"
++dependencies = [
++ "proc-macro2",
++ "quote",
++ "unicode-ident",
++]
++
++[[package]]
++name = "thread_local"
++version = "1.1.7"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "3fdd6f064ccff2d6567adcb3873ca630700f00b5ad3f060c25b5dcfd9a4ce152"
++dependencies = [
++ "cfg-if",
++ "once_cell",
++]
++
++[[package]]
++name = "unicode-ident"
++version = "1.0.12"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
++
++[[package]]
++name = "unicode-width"
++version = "0.1.11"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "e51733f11c9c4f72aa0c160008246859e340b00807569a0da0e7a1079b27ba85"
++
++[[package]]
++name = "vcpkg"
++version = "0.2.15"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
++
++[[package]]
++name = "wild"
++version = "2.2.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "10d01931a94d5a115a53f95292f51d316856b68a035618eb831bbba593a30b67"
++dependencies = [
++ "glob",
++]

pkgs/tools/graphics/pngquant/default.nix

@@ -1,25 +1,33 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, libpng, zlib, lcms2 }:
+{ lib, rustPlatform, fetchFromGitHub, pkg-config, libpng, zlib, lcms2 }:
 
-stdenv.mkDerivation rec {
+rustPlatform.buildRustPackage rec {
   pname = "pngquant";
-  version = "2.17.0";
+  version = "3.0.3";
+
+  outputs = [ "out" "man" ];
 
   src = fetchFromGitHub {
     owner = "kornelski";
     repo = "pngquant";
     rev = version;
-    sha256 = "sha256-D2KNn6AJ4eIHeb/2Oo1Wf0djMCXTtVGrua0D6z7+9V4=";
+    hash = "sha256-u2zEp9Llo+c/+1QGW4V4r40KQn/ATHCTEsrpy7bRf/I=";
     fetchSubmodules = true;
   };
 
-  preConfigure = "patchShebangs .";
-
-  configureFlags = lib.optionals (!stdenv.hostPlatform.isx86) [ "--disable-sse" ];
+  cargoHash = "sha256-mZpg6BRpsvEiMsS6ZJzVYg6wXHLb3Cf72sK1yzTF8y4=";
+  cargoPatches = [
+    # https://github.com/kornelski/pngquant/issues/347
+    ./add-Cargo.lock.patch
+  ];
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libpng zlib lcms2 ];
 
-  doCheck = true;
+  doCheck = false; # Has no Rust-based tests
+
+  postInstall = ''
+    install -Dpm0444 pngquant.1 $man/share/man/man1/pngquant.1
+  '';
 
   meta = with lib; {
     homepage = "https://pngquant.org/";

pkgs/tools/networking/i2p/default.nix

@@ -79,7 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
       mit
       publicDomain
     ];
-    platforms = [ "x86_64-linux" "i686-linux" ];
+    platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
     maintainers = with maintainers; [ joelmo ];
   };
 })

pkgs/tools/networking/miniupnpd/default.nix

@@ -1,10 +1,30 @@
 { stdenv, lib, fetchurl, iptables-legacy, libuuid, openssl, pkg-config
-, which, iproute2, gnused, coreutils, gawk, makeWrapper
+, which, iproute2, gnused, coreutils, gnugrep, gawk, makeWrapper
 , nixosTests
+, firewall ? "iptables", nftables, libmnl, libnftnl
 }:
 
 let
-  scriptBinEnv = lib.makeBinPath [ which iproute2 iptables-legacy gnused coreutils gawk ];
+  scriptBinEnv = lib.makeBinPath {
+    iptables = [
+      # needed for dirname in ip{,6}tables_*.sh
+      coreutils
+      # used in miniupnpd_functions.sh:
+      which
+      iproute2
+      iptables-legacy
+      gnused
+      gnugrep
+      gawk
+    ];
+    nftables = [
+      # needed for dirname in nft_*.sh & cat in nft_init.sh
+      coreutils
+      # used in miniupnpd_functions.sh:
+      which
+      nftables
+    ];
+  }.${firewall};
 in
 stdenv.mkDerivation rec {
   pname = "miniupnpd";
@@ -15,22 +35,42 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-b9cBn5Nv+IxB58gi9G8QtRvXLWZZePZYZIPedbMMNr8=";
   };
 
-  buildInputs = [ iptables-legacy libuuid openssl ];
+  buildInputs = [ iptables-legacy libuuid openssl ]
+    ++ lib.optionals (firewall == "nftables") [ libmnl libnftnl ];
   nativeBuildInputs= [ pkg-config makeWrapper ];
 
-
   # ./configure is not a standard configure file, errors with:
   # Option not recognized : --prefix=
   dontAddPrefix = true;
+  configureFlags = [
+    "--firewall=${firewall}"
+    # allow using various config options
+    "--ipv6"
+    "--leasefile"
+    "--regex"
+    "--vendorcfg"
+    # hardening
+    "--portinuse"
+  ];
 
   installFlags = [ "PREFIX=$(out)" "INSTALLPREFIX=$(out)" ];
 
-  postFixup = ''
-    for script in $out/etc/miniupnpd/ip{,6}tables_{init,removeall}.sh
-    do
-      wrapProgram $script --set PATH '${scriptBinEnv}:$PATH'
-    done
-  '';
+  postFixup = {
+    # Ideally we'd prefer using system's config.firewall.package here for iptables,
+    # however for some reason switching --prefix to --suffix breaks the script
+    iptables = ''
+      for script in $out/etc/miniupnpd/ip{,6}tables_{init,removeall}.sh
+      do
+        wrapProgram $script --prefix PATH : '${scriptBinEnv}:$PATH'
+      done
+    '';
+    nftables = ''
+      for script in $out/etc/miniupnpd/nft_{delete_chain,flush,init,removeall}.sh
+      do
+        wrapProgram $script --suffix PATH : '${scriptBinEnv}:$PATH'
+      done
+    '';
+  }.${firewall};
 
   passthru.tests = {
     bittorrent-integration = nixosTests.bittorrent;
@@ -42,5 +82,6 @@ stdenv.mkDerivation rec {
     description = "A daemon that implements the UPnP Internet Gateway Device (IGD) specification";
     platforms = platforms.linux;
     license = licenses.bsd3;
+    mainProgram = "miniupnpd";
   };
 }

pkgs/tools/package-management/apx/default.nix

@@ -2,21 +2,24 @@
 , buildGoModule
 , fetchFromGitHub
 , distrobox
+, installShellFiles
 }:
 
 buildGoModule rec {
   pname = "apx";
-  version = "2.1.2";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "Vanilla-OS";
     repo = "apx";
     rev = "v${version}";
-    hash = "sha256-0xQfbnLvNB1X1B8440CYHZWFGSQV319IU5tgXS3lyUI=";
+    hash = "sha256-za3QS0ZJuxSCt5xbYa/Kt4ARsDhUn34vJTy0fJoqr9U=";
   };
 
   vendorHash = null;
 
+  nativeBuildInputs = [ installShellFiles ];
+
   ldflags = [ "-s" "-w" ];
 
   postPatch = ''
@@ -28,8 +31,8 @@ buildGoModule rec {
   '';
 
   postInstall = ''
-    install -D config/apx.json -t $out/share/apx/
-    install -D man/man1/apx.1 -t $out/man/man1/
+    install -m 444 -D config/apx.json -t $out/share/apx/
+    installManPage man/man1/*
   '';
 
   meta = with lib; {

pkgs/tools/security/oath-toolkit/default.nix

@@ -8,11 +8,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "oath-toolkit";
-  version = "2.6.7";
+  version = "2.6.10";
 
   src = fetchurl {
     url = "mirror://savannah/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1aa620k05lsw3l3slkp2mzma40q3p9wginspn9zk8digiz7dzv9n";
+    sha256 = "sha256-hsJyJPfW19rUek9r7mX2uIS/W70VxemM8sxpYl2/I5E=";
   };
 
   buildInputs = [ securityDependency ];

pkgs/tools/virtualization/multipass/default.nix

@@ -16,16 +16,16 @@
 , qemu
 , qemu-utils
 , qtbase
-, qtx11extras
+, qtwayland
+, wrapQtAppsHook
 , slang
 , stdenv
-, wrapQtAppsHook
 , xterm
 }:
 
 let
   pname = "multipass";
-  version = "1.12.2";
+  version = "1.13.0";
 
   # This is done here because a CMakeLists.txt from one of it's submodules tries
   # to modify a file, so we grab the source for the submodule here, copy it into
@@ -46,7 +46,7 @@ stdenv.mkDerivation
     owner = "canonical";
     repo = "multipass";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1k0jbYMwfYuHmM/Cm76sbo3+mN6WypALMQBwlZ+9d+c=";
+    hash = "sha256-DMyIvhlkMuUyOlUw8b4312NUtpK0n8rI8nhoV6Dscyo=";
     fetchSubmodules = true;
     leaveDotGit = true;
     postFetch = ''
@@ -104,7 +104,7 @@ stdenv.mkDerivation
     libxml2
     openssl
     qtbase
-    qtx11extras
+    qtwayland
   ];
 
   nativeBuildInputs = [

pkgs/top-level/all-packages.nix

@@ -5733,8 +5733,6 @@ with pkgs;
 
   ifm = callPackage ../tools/graphics/ifm { };
 
-  iina = callPackage ../applications/video/iina { };
-
   ink = callPackage ../tools/misc/ink { };
 
   inklecate = callPackage ../development/compilers/inklecate { };
@@ -10894,6 +10892,8 @@ with pkgs;
 
   miniupnpd = callPackage ../tools/networking/miniupnpd { };
 
+  miniupnpd-nftables = callPackage ../tools/networking/miniupnpd { firewall = "nftables"; };
+
   miniball = callPackage ../development/libraries/miniball { };
 
   minijail = callPackage ../tools/system/minijail { };
@@ -11032,7 +11032,7 @@ with pkgs;
 
   muffet = callPackage ../tools/networking/muffet { };
 
-  multipass = libsForQt5.callPackage ../tools/virtualization/multipass { };
+  multipass = qt6Packages.callPackage ../tools/virtualization/multipass { };
 
   multitime = callPackage ../tools/misc/multitime { };
 
@@ -30957,8 +30957,6 @@ with pkgs;
 
   cordless = callPackage ../applications/networking/instant-messengers/cordless { };
 
-  cosmic-settings = callPackage ../applications/window-managers/cosmic/settings { };
-
   coursera-dl = callPackage ../applications/misc/coursera-dl { };
 
   coyim = callPackage ../applications/networking/instant-messengers/coyim { };