Merge staging-next into staging

doc/languages-frameworks/rust.section.md

@@ -651,6 +651,66 @@ buildPythonPackage rec {
 }
 ```
 
+#### Rust package built with `meson` {#rust-package-built-with-meson}
+
+Some projects, especially GNOME applications, are built with the Meson Build System instead of calling Cargo directly. Using `rustPlatform.buildRustPackage` may successfully build the main program, but related files will be missing. Instead, you need to set up Cargo dependencies with `fetchCargoTarball` and `cargoSetupHook` and leave the rest to Meson. `rust` and `cargo` are still needed in `nativeBuildInputs` for Meson to use.
+
+```nix
+{ lib
+, stdenv
+, fetchFromGitLab
+, meson
+, ninja
+, pkg-config
+, rustPlatform
+, rustc
+, cargo
+, wrapGAppsHook4
+, blueprint-compiler
+, libadwaita
+, libsecret
+, tracker
+}:
+
+stdenv.mkDerivation rec {
+  pname = "health";
+  version = "0.95.0";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "World";
+    repo = "health";
+    rev = version;
+    hash = "sha256-PrNPprSS98yN8b8yw2G6hzTSaoE65VbsM3q7FVB4mds=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-8fa3fa+sFi5H+49B5sr2vYPkp9C9s6CcE0zv4xB8gww=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    rustPlatform.cargoSetupHook
+    rustc
+    cargo
+    wrapGAppsHook4
+    blueprint-compiler
+  ];
+
+  buildInputs = [
+    libadwaita
+    libsecret
+    tracker
+  ];
+
+  # ...
+}
+```
+
 ## `buildRustCrate`: Compiling Rust crates using Nix instead of Cargo {#compiling-rust-crates-using-nix-instead-of-cargo}
 
 ### Simple operation {#simple-operation}

lib/licenses.nix

@@ -392,6 +392,12 @@ in mkLicense lset) ({
     fullName = "Common Public Attribution License 1.0";
   };
 
+  commons-clause = {
+    fullName = "Commons Clause License";
+    url = "https://commonsclause.com/";
+    free = false;
+  };
+
   cpl10 = {
     spdxId = "CPL-1.0";
     fullName = "Common Public License 1.0";

lib/systems/default.nix

@@ -1,7 +1,25 @@
 { lib }:
-  let inherit (lib.attrsets) mapAttrs; in
 
-rec {
+let
+  inherit (lib)
+    any
+    filterAttrs
+    foldl
+    hasInfix
+    isFunction
+    isList
+    isString
+    mapAttrs
+    optional
+    optionalAttrs
+    optionalString
+    removeSuffix
+    replaceStrings
+    toUpper
+    ;
+
+  inherit (lib.strings) toJSON;
+
   doubles = import ./doubles.nix { inherit lib; };
   parse = import ./parse.nix { inherit lib; };
   inspect = import ./inspect.nix { inherit lib; };
@@ -24,7 +42,7 @@ rec {
     both arguments have been `elaborate`-d.
   */
   equals =
-    let removeFunctions = a: lib.filterAttrs (_: v: !builtins.isFunction v) a;
+    let removeFunctions = a: filterAttrs (_: v: !isFunction v) a;
     in a: b: removeFunctions a == removeFunctions b;
 
   /* List of all Nix system doubles the nixpkgs flake will expose the package set
@@ -41,7 +59,7 @@ rec {
   # clearly preferred, and to prevent cycles. A simpler fixed point where the RHS
   # always just used `final.*` would fail on both counts.
   elaborate = args': let
-    args = if lib.isString args' then { system = args'; }
+    args = if isString args' then { system = args'; }
            else args';
 
     # TODO: deprecate args.rustc in favour of args.rust after 23.05 is EOL.
@@ -96,7 +114,7 @@ rec {
         then "lib64"
         else "lib"
       else null;
-      extensions = lib.optionalAttrs final.hasSharedLibraries {
+      extensions = optionalAttrs final.hasSharedLibraries {
         sharedLibrary =
           if      final.isDarwin  then ".dylib"
           else if final.isWindows then ".dll"
@@ -134,9 +152,9 @@ rec {
          # uname -m
          processor =
            if final.isPower64
-           then "ppc64${lib.optionalString final.isLittleEndian "le"}"
+           then "ppc64${optionalString final.isLittleEndian "le"}"
            else if final.isPower
-           then "ppc${lib.optionalString final.isLittleEndian "le"}"
+           then "ppc${optionalString final.isLittleEndian "le"}"
            else if final.isMips64
            then "mips64"  # endianness is *not* included on mips64
            else final.parsed.cpu.name;
@@ -202,8 +220,8 @@ rec {
         else if final.isS390 && !final.isS390x then null
         else if final.isx86_64 then "x86_64"
         else if final.isx86 then "i386"
-        else if final.isMips64n32 then "mipsn32${lib.optionalString final.isLittleEndian "el"}"
-        else if final.isMips64 then "mips64${lib.optionalString final.isLittleEndian "el"}"
+        else if final.isMips64n32 then "mipsn32${optionalString final.isLittleEndian "el"}"
+        else if final.isMips64 then "mips64${optionalString final.isLittleEndian "el"}"
         else final.uname.processor;
 
       # Name used by UEFI for architectures.
@@ -259,7 +277,7 @@ rec {
           if pkgs.stdenv.hostPlatform.canExecute final
           then "${pkgs.runtimeShell} -c '\"$@\"' --"
           else if final.isWindows
-          then "${wine}/bin/wine${lib.optionalString (final.parsed.cpu.bits == 64) "64"}"
+          then "${wine}/bin/wine${optionalString (final.parsed.cpu.bits == 64) "64"}"
           else if final.isLinux && pkgs.stdenv.hostPlatform.isLinux && final.qemuArch != null
           then "${qemu-user}/bin/qemu-${final.qemuArch}"
           else if final.isWasi
@@ -310,10 +328,10 @@ rec {
                   let
                     f = args.rustc.platform.target-family;
                   in
-                    if builtins.isList f then f else [ f ]
+                    if isList f then f else [ f ]
                 )
-              else lib.optional final.isUnix "unix"
-                   ++ lib.optional final.isWindows "windows";
+              else optional final.isUnix "unix"
+                   ++ optional final.isWindows "windows";
 
             # https://doc.rust-lang.org/reference/conditional-compilation.html#target_vendor
             vendor = let
@@ -337,13 +355,13 @@ rec {
             vendor_ = final.rust.platform.vendor;
           # TODO: deprecate args.rustc in favour of args.rust after 23.05 is EOL.
           in args.rust.rustcTarget or args.rustc.config
-            or "${cpu_}-${vendor_}-${kernel.name}${lib.optionalString (abi.name != "unknown") "-${abi.name}"}";
+            or "${cpu_}-${vendor_}-${kernel.name}${optionalString (abi.name != "unknown") "-${abi.name}"}";
 
           # The name of the rust target if it is standard, or the json file
           # containing the custom target spec.
           rustcTargetSpec = rust.rustcTargetSpec or (
             /**/ if rust ? platform
-            then builtins.toFile (final.rust.rustcTarget + ".json") (builtins.toJSON rust.platform)
+            then builtins.toFile (final.rust.rustcTarget + ".json") (toJSON rust.platform)
             else final.rust.rustcTarget);
 
           # The name of the rust target if it is standard, or the
@@ -352,7 +370,7 @@ rec {
           #
           # This is the name used by Cargo for target subdirectories.
           cargoShortTarget =
-            lib.removeSuffix ".json" (baseNameOf "${final.rust.rustcTargetSpec}");
+            removeSuffix ".json" (baseNameOf "${final.rust.rustcTargetSpec}");
 
           # When used as part of an environment variable name, triples are
           # uppercased and have all hyphens replaced by underscores:
@@ -360,17 +378,17 @@ rec {
           # https://github.com/rust-lang/cargo/pull/9169
           # https://github.com/rust-lang/cargo/issues/8285#issuecomment-634202431
           cargoEnvVarTarget =
-            lib.strings.replaceStrings ["-"] ["_"]
-              (lib.strings.toUpper final.rust.cargoShortTarget);
+            replaceStrings ["-"] ["_"]
+              (toUpper final.rust.cargoShortTarget);
 
           # True if the target is no_std
           # https://github.com/rust-lang/rust/blob/2e44c17c12cec45b6a682b1e53a04ac5b5fcc9d2/src/bootstrap/config.rs#L415-L421
           isNoStdTarget =
-            builtins.any (t: lib.hasInfix t final.rust.rustcTarget) ["-none" "nvptx" "switch" "-uefi"];
+            any (t: hasInfix t final.rust.rustcTarget) ["-none" "nvptx" "switch" "-uefi"];
         };
       };
   in assert final.useAndroidPrebuilt -> final.isAndroid;
-     assert lib.foldl
+     assert foldl
        (pass: { assertion, message }:
          if assertion final
          then pass
@@ -378,4 +396,20 @@ rec {
        true
        (final.parsed.abi.assertions or []);
     final;
+
+in
+
+# Everything in this attrset is the public interface of the file.
+{
+  inherit
+    architectures
+    doubles
+    elaborate
+    equals
+    examples
+    flakeExposed
+    inspect
+    parse
+    platforms
+    ;
 }

lib/systems/inspect.nix

@@ -1,10 +1,31 @@
 { lib }:
-with import ./parse.nix { inherit lib; };
-with lib.attrsets;
-with lib.lists;
 
-let abis_ = abis; in
-let abis = lib.mapAttrs (_: abi: builtins.removeAttrs abi [ "assertions" ]) abis_; in
+let
+  inherit (lib)
+    any
+    attrValues
+    concatMap
+    filter
+    hasPrefix
+    isList
+    mapAttrs
+    matchAttrs
+    recursiveUpdateUntil
+    toList
+    ;
+
+  inherit (lib.strings) toJSON;
+
+  inherit (lib.systems.parse)
+    kernels
+    kernelFamilies
+    significantBytes
+    cpuTypes
+    execFormats
+    ;
+
+  abis = mapAttrs (_: abi: removeAttrs abi [ "assertions" ]) lib.systems.parse.abis;
+in
 
 rec {
   # these patterns are to be matched against {host,build,target}Platform.parsed
@@ -32,8 +53,8 @@ rec {
     isx86          = { cpu = { family = "x86"; }; };
     isAarch32      = { cpu = { family = "arm"; bits = 32; }; };
     isArmv7        = map ({ arch, ... }: { cpu = { inherit arch; }; })
-                       (lib.filter (cpu: lib.hasPrefix "armv7" cpu.arch or "")
-                         (lib.attrValues cpuTypes));
+                       (filter (cpu: hasPrefix "armv7" cpu.arch or "")
+                         (attrValues cpuTypes));
     isAarch64      = { cpu = { family = "arm"; bits = 64; }; };
     isAarch        = { cpu = { family = "arm"; }; };
     isMicroBlaze   = { cpu = { family = "microblaze"; }; };
@@ -111,19 +132,19 @@ rec {
     let
       # patterns can be either a list or a (bare) singleton; turn
       # them into singletons for uniform handling
-      pat1 = lib.toList pat1_;
-      pat2 = lib.toList pat2_;
+      pat1 = toList pat1_;
+      pat2 = toList pat2_;
     in
-      lib.concatMap (attr1:
+      concatMap (attr1:
         map (attr2:
-          lib.recursiveUpdateUntil
+          recursiveUpdateUntil
             (path: subattr1: subattr2:
               if (builtins.intersectAttrs subattr1 subattr2) == {} || subattr1 == subattr2
               then true
               else throw ''
                 pattern conflict at path ${toString path}:
-                  ${builtins.toJSON subattr1}
-                  ${builtins.toJSON subattr2}
+                  ${toJSON subattr1}
+                  ${toJSON subattr2}
                 '')
             attr1
             attr2
@@ -132,7 +153,7 @@ rec {
         pat1;
 
   matchAnyAttrs = patterns:
-    if builtins.isList patterns then attrs: any (pattern: matchAttrs pattern attrs) patterns
+    if isList patterns then attrs: any (pattern: matchAttrs pattern attrs) patterns
     else matchAttrs patterns;
 
   predicates = mapAttrs (_: matchAnyAttrs) patterns;

lib/systems/parse.nix

@@ -15,14 +15,45 @@
 # systems that overlap with existing ones and won't notice something amiss.
 #
 { lib }:
-with lib.lists;
-with lib.types;
-with lib.attrsets;
-with lib.strings;
-with (import ./inspect.nix { inherit lib; }).predicates;
 
 let
-  inherit (lib.options) mergeOneOption;
+  inherit (lib)
+    all
+    any
+    attrValues
+    elem
+    elemAt
+    hasPrefix
+    id
+    length
+    mapAttrs
+    mergeOneOption
+    optionalString
+    splitString
+    versionAtLeast
+    ;
+
+  inherit (lib.strings) match;
+
+  inherit (lib.systems.inspect.predicates)
+    isAarch32
+    isBigEndian
+    isDarwin
+    isLinux
+    isPower64
+    isWindows
+    ;
+
+  inherit (lib.types)
+    enum
+    float
+    isType
+    mkOptionType
+    number
+    setType
+    string
+    types
+    ;
 
   setTypes = type:
     mapAttrs (name: value:
@@ -33,10 +64,10 @@ let
   # regex `e?abi.*$` when determining the validity of a triple.  In
   # other words, `i386-linuxabichickenlips` is a valid triple.
   removeAbiSuffix = x:
-    let match = builtins.match "(.*)e?abi.*" x;
-    in if match==null
+    let found = match "(.*)e?abi.*" x;
+    in if found == null
        then x
-       else lib.elemAt match 0;
+       else elemAt found 0;
 
 in
 
@@ -76,7 +107,7 @@ rec {
 
   types.cpuType = enum (attrValues cpuTypes);
 
-  cpuTypes = with significantBytes; setTypes types.openCpuType {
+  cpuTypes = let inherit (significantBytes) bigEndian littleEndian; in setTypes types.openCpuType {
     arm      = { bits = 32; significantByte = littleEndian; family = "arm"; };
     armv5tel = { bits = 32; significantByte = littleEndian; family = "arm"; version = "5"; arch = "armv5t"; };
     armv6m   = { bits = 32; significantByte = littleEndian; family = "arm"; version = "6"; arch = "armv6-m"; };
@@ -166,7 +197,7 @@ rec {
   # Note: Since 22.11 the archs of a mode switching CPU are no longer considered
   # pairwise compatible. Mode switching implies that binaries built for A
   # and B respectively can't be executed at the same time.
-  isCompatible = a: b: with cpuTypes; lib.any lib.id [
+  isCompatible = with cpuTypes; a: b: any id [
     # x86
     (b == i386 && isCompatible a i486)
     (b == i486 && isCompatible a i586)
@@ -287,7 +318,10 @@ rec {
 
   types.kernel = enum (attrValues kernels);
 
-  kernels = with execFormats; with kernelFamilies; setTypes types.openKernel {
+  kernels = let
+    inherit (execFormats) elf pe wasm unknown macho;
+    inherit (kernelFamilies) bsd darwin;
+  in setTypes types.openKernel {
     # TODO(@Ericson2314): Don't want to mass-rebuild yet to keeping 'darwin' as
     # the normalized name for macOS.
     macos    = { execFormat = macho;   families = { inherit darwin; }; name = "darwin"; };
@@ -359,7 +393,7 @@ rec {
             The "gnu" ABI is ambiguous on 32-bit ARM. Use "gnueabi" or "gnueabihf" instead.
           '';
         }
-        { assertion = platform: with platform; !(isPower64 && isBigEndian);
+        { assertion = platform: !(platform.isPower64 && platform.isBigEndian);
           message = ''
             The "gnu" ABI is ambiguous on big-endian 64-bit PowerPC. Use "gnuabielfv2" or "gnuabielfv1" instead.
           '';
@@ -480,7 +514,7 @@ rec {
         /**/ if args ? abi       then getAbi args.abi
         else if isLinux parsed || isWindows parsed then
           if isAarch32 parsed then
-            if lib.versionAtLeast (parsed.cpu.version or "0") "6"
+            if versionAtLeast (parsed.cpu.version or "0") "6"
             then abis.gnueabihf
             else abis.gnueabi
           # Default ppc64 BE to ELFv2
@@ -491,7 +525,7 @@ rec {
 
   in mkSystem parsed;
 
-  mkSystemFromString = s: mkSystemFromSkeleton (mkSkeletonFromList (lib.splitString "-" s));
+  mkSystemFromString = s: mkSystemFromSkeleton (mkSkeletonFromList (splitString "-" s));
 
   kernelName = kernel:
     kernel.name + toString (kernel.version or "");
@@ -503,10 +537,10 @@ rec {
 
   tripleFromSystem = { cpu, vendor, kernel, abi, ... } @ sys: assert isSystem sys; let
     optExecFormat =
-      lib.optionalString (kernel.name == "netbsd" &&
+      optionalString (kernel.name == "netbsd" &&
                           gnuNetBSDDefaultExecFormat cpu != kernel.execFormat)
         kernel.execFormat.name;
-    optAbi = lib.optionalString (abi != abis.unknown) "-${abi.name}";
+    optAbi = optionalString (abi != abis.unknown) "-${abi.name}";
   in "${cpu.name}-${vendor.name}-${kernelName kernel}${optExecFormat}${optAbi}";
 
   ################################################################################

maintainers/maintainer-list.nix

@@ -2958,6 +2958,12 @@
     github = "bycEEE";
     githubId = 8891115;
     name = "Brian Choy";
+  };
+   ByteSudoer = {
+    email = "bytesudoer@gmail.com";
+    github = "bytesudoer";
+    githubId = 88513682;
+    name = "ByteSudoer";
   };
   bzizou = {
     email = "Bruno@bzizou.net";
@@ -12556,6 +12562,15 @@
     githubId = 15093162;
     name = "Melanie B. Sigl";
   };
+  melvyn2 = {
+    email = "melvyn2@dnsense.pub";
+    github = "melvyn2";
+    githubId = 9157412;
+    name = "melvyn";
+    keys = [{
+      fingerprint = "232B 9F00 2153 CA86 849C  9224 25A2 B728 0CE3 AFF6";
+    }];
+  };
   mephistophiles = {
     email = "mussitantesmortem@gmail.com";
     name = "Maxim Zhukov";
@@ -16548,6 +16563,11 @@
     githubId = 61013287;
     name = "Ricardo Steijn";
   };
+  richar = {
+    github = "ri-char";
+    githubId = 17962023;
+    name = "richar";
+  };
   richardipsum = {
     email = "richardipsum@fastmail.co.uk";
     github = "richardipsum";

nixos/doc/manual/release-notes/rl-2405.section.md

@@ -456,6 +456,12 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - The module `services.github-runner` has been removed. To configure a single GitHub Actions Runner refer to `services.github-runners.*`. Note that this will trigger a new runner registration.
 
+- The `services.slskd` has been refactored to include more configuation options in
+  the freeform `services.slskd.settings` option, and some defaults (including listen ports)
+  have been changed to match the upstream defaults. Additionally, disk logging is now
+  disabled by default, and the log rotation timer has been removed.
+  The nginx virtualhost option is now of the `vhost-options` type.
+
 - The `btrbk` module now automatically selects and provides required compression
   program depending on the configured `stream_compress` option. Since this
   replaces the need for the `extraPackages` option, this option will be

nixos/modules/services/desktops/flatpak.nix

@@ -32,6 +32,8 @@ in {
 
     security.polkit.enable = true;
 
+    fonts.fontDir.enable = true;
+
     services.dbus.packages = [ pkgs.flatpak ];
 
     systemd.packages = [ pkgs.flatpak ];

nixos/modules/services/web-apps/slskd.nix

@@ -2,122 +2,250 @@
 
 let
   settingsFormat = pkgs.formats.yaml {};
+  defaultUser = "slskd";
 in {
   options.services.slskd = with lib; with types; {
     enable = mkEnableOption "enable slskd";
 
-    rotateLogs = mkEnableOption "enable an unit and timer that will rotate logs in /var/slskd/logs";
+    package = mkPackageOptionMD pkgs "slskd" { };
 
-    package = mkPackageOption pkgs "slskd" { };
+    user = mkOption {
+      type = types.str;
+      default = defaultUser;
+      description = "User account under which slskd runs.";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = defaultUser;
+      description = "Group under which slskd runs.";
+    };
+
+    domain = mkOption {
+      type = types.nullOr types.str;
+      description = ''
+        If non-null, enables an nginx reverse proxy virtual host at this FQDN,
+        at the path configurated with `services.slskd.web.url_base`.
+      '';
+      example = "slskd.example.com";
+    };
 
     nginx = mkOption {
-      description = lib.mdDoc "options for nginx";
-      example = {
-        enable = true;
-        domain = "example.com";
-        contextPath = "/slskd";
-      };
-      type = submodule ({name, config, ...}: {
-        options = {
-          enable = mkEnableOption "enable nginx as a reverse proxy";
-
-          domainName = mkOption {
-            type = str;
-            description = "Domain you want to use";
-          };
-          contextPath = mkOption {
-            type = types.path;
-            default = "/";
-            description = lib.mdDoc ''
-              The context path, i.e., the last part of the slskd
-              URL. Typically '/' or '/slskd'. Default '/'
-            '';
-          };
-        };
-      });
+      type = types.submodule (import ../web-servers/nginx/vhost-options.nix { inherit config lib; });
+      default = {};
+      example = lib.literalExpression ''
+        {
+          enableACME = true;
+          forceHttps = true;
+        }
+      '';
+      description = ''
+        This option customizes the nginx virtual host set up for slskd.
+      '';
     };
 
     environmentFile = mkOption {
       type = path;
       description = ''
-        Path to a file containing secrets.
-        It must at least contain the variable `SLSKD_SLSK_PASSWORD`
+        Path to the environment file sourced on startup.
+        It must at least contain the variables `SLSKD_SLSK_USERNAME` and `SLSKD_SLSK_PASSWORD`.
+        Web interface credentials should also be set here in `SLSKD_USERNAME` and `SLSKD_PASSWORD`.
+        Other, optional credentials like SOCKS5 with `SLSKD_SLSK_PROXY_USERNAME` and `SLSKD_SLSK_PROXY_PASSWORD`
+        should all reside here instead of in the world-readable nix store.
+        Variables are documented at https://github.com/slskd/slskd/blob/master/docs/config.md
       '';
     };
 
     openFirewall = mkOption {
       type = bool;
-      description = ''
-        Whether to open the firewall for services.slskd.settings.listen_port";
-      '';
+      description = "Whether to open the firewall for the soulseek network listen port (not the web interface port).";
       default = false;
     };
 
     settings = mkOption {
-      description = lib.mdDoc ''
-        Configuration for slskd, see
-        [available options](https://github.com/slskd/slskd/blob/master/docs/config.md)
-        `APP_DIR` is set to /var/lib/slskd, where default download & incomplete directories,
-        log and databases will be created.
+      description = ''
+        Application configuration for slskd. See
+        [documentation](https://github.com/slskd/slskd/blob/master/docs/config.md).
       '';
       default = {};
       type = submodule {
         freeformType = settingsFormat.type;
         options = {
+          remote_file_management = mkEnableOption "modification of share contents through the web ui";
 
-          soulseek = {
-            username = mkOption {
-              type = str;
-              description = "Username on the Soulseek Network";
+          flags = {
+            force_share_scan = mkOption {
+              type = bool;
+              description = "Force a rescan of shares on every startup.";
             };
-            listen_port = mkOption {
-              type = port;
-              description = "Port to use for communication on the Soulseek Network";
-              default = 50000;
-            };
-          };
-
-          web = {
-            port = mkOption {
-              type = port;
-              default = 5001;
-              description = "The HTTP listen port";
-            };
-            url_base = mkOption {
-              type = path;
-              default = config.services.slskd.nginx.contextPath;
-              defaultText = "config.services.slskd.nginx.contextPath";
-              description = lib.mdDoc ''
-                The context path, i.e., the last part of the slskd URL
-              '';
-            };
-          };
-
-          shares = {
-            directories = mkOption {
-              type = listOf str;
-              description = lib.mdDoc ''
-                Paths to your shared directories. See
-                [documentation](https://github.com/slskd/slskd/blob/master/docs/config.md#directories)
-                for advanced usage
-              '';
+            no_version_check = mkOption {
+              type = bool;
+              default = true;
+              visible = false;
+              description = "Don't perform a version check on startup.";
             };
           };
 
           directories = {
             incomplete = mkOption {
               type = nullOr path;
-              description = "Directory where downloading files are stored";
-              defaultText = "<APP_DIR>/incomplete";
+              description = "Directory where incomplete downloading files are stored.";
+              defaultText = "/var/lib/slskd/incomplete";
               default = null;
             };
             downloads = mkOption {
               type = nullOr path;
-              description = "Directory where downloaded files are stored";
-              defaultText = "<APP_DIR>/downloads";
+              description = "Directory where downloaded files are stored.";
+              defaultText = "/var/lib/slskd/downloads";
               default = null;
             };
           };
+
+          shares = {
+            directories = mkOption {
+              type = listOf str;
+              description = ''
+                Paths to shared directories. See
+                [documentation](https://github.com/slskd/slskd/blob/master/docs/config.md#directories)
+                for advanced usage.
+              '';
+              example = lib.literalExpression ''[ "/home/John/Music" "!/home/John/Music/Recordings" "[Music Drive]/mnt" ]'';
+            };
+            filters = mkOption {
+              type = listOf str;
+              example = lib.literalExpression ''[ "\.ini$" "Thumbs.db$" "\.DS_Store$" ]'';
+              description = "Regular expressions of files to exclude from sharing.";
+            };
+          };
+
+          rooms = mkOption {
+            type = listOf str;
+            description = "Chat rooms to join on startup.";
+          };
+
+          soulseek = {
+            description = mkOption {
+              type = str;
+              description = "The user description for the Soulseek network.";
+              defaultText = "A slskd user. https://github.com/slskd/slskd";
+            };
+            listen_port = mkOption {
+              type = port;
+              description = "The port on which to listen for incoming connections.";
+              default = 50300;
+            };
+          };
+
+          global = {
+            # TODO speed units
+            upload = {
+              slots = mkOption {
+                type = ints.unsigned;
+                description = "Limit of the number of concurrent upload slots.";
+              };
+              speed_limit = mkOption {
+                type = ints.unsigned;
+                description = "Total upload speed limit.";
+              };
+            };
+            download = {
+              slots = mkOption {
+                type = ints.unsigned;
+                description = "Limit of the number of concurrent download slots.";
+              };
+              speed_limit = mkOption {
+                type = ints.unsigned;
+                description = "Total upload download limit";
+              };
+            };
+          };
+
+          filters.search.request = mkOption {
+            type = listOf str;
+            example = lib.literalExpression ''[ "^.{1,2}$" ]'';
+            description = "Incoming search requests which match this filter are ignored.";
+          };
+
+          web = {
+            port = mkOption {
+              type = port;
+              default = 5030;
+              description = "The HTTP listen port.";
+            };
+            url_base = mkOption {
+              type = path;
+              default = "/";
+              description = "The base path in the url for web requests.";
+            };
+            # Users should use a reverse proxy instead for https
+            https.disabled = mkOption {
+              type = bool;
+              default = true;
+              description = "Disable the built-in HTTPS server";
+            };
+          };
+
+          retention = {
+            transfers = {
+              upload = {
+                succeeded = mkOption {
+                  type = ints.unsigned;
+                  description = "Lifespan of succeeded upload tasks.";
+                  defaultText = "(indefinite)";
+                };
+                errored = mkOption {
+                  type = ints.unsigned;
+                  description = "Lifespan of errored upload tasks.";
+                  defaultText = "(indefinite)";
+                };
+                cancelled = mkOption {
+                  type = ints.unsigned;
+                  description = "Lifespan of cancelled upload tasks.";
+                  defaultText = "(indefinite)";
+                };
+              };
+              download = {
+                succeeded = mkOption {
+                  type = ints.unsigned;
+                  description = "Lifespan of succeeded download tasks.";
+                  defaultText = "(indefinite)";
+                };
+                errored = mkOption {
+                  type = ints.unsigned;
+                  description = "Lifespan of errored download tasks.";
+                  defaultText = "(indefinite)";
+                };
+                cancelled = mkOption {
+                  type = ints.unsigned;
+                  description = "Lifespan of cancelled download tasks.";
+                  defaultText = "(indefinite)";
+                };
+              };
+            };
+            files = {
+              complete = mkOption {
+                type = ints.unsigned;
+                description = "Lifespan of completely downloaded files in minutes.";
+                example = 20160;
+                defaultText = "(indefinite)";
+              };
+              incomplete = mkOption {
+                type = ints.unsigned;
+                description = "Lifespan of incomplete downloading files in minutes.";
+                defaultText = "(indefinite)";
+              };
+            };
+          };
+
+          logger = {
+            # Disable by default, journald already retains as needed
+            disk = mkOption {
+              type = bool;
+              description = "Whether to log to the application directory.";
+              default = false;
+              visible = false;
+            };
+          };
         };
       };
     };
@@ -126,38 +254,25 @@ in {
   config = let
     cfg = config.services.slskd;
 
-    confWithoutNullValues = (lib.filterAttrs (key: value: value != null) cfg.settings);
+    confWithoutNullValues = (lib.filterAttrsRecursive (key: value: (builtins.tryEval value).success && value != null) cfg.settings);
 
     configurationYaml = settingsFormat.generate "slskd.yml" confWithoutNullValues;
 
   in lib.mkIf cfg.enable {
 
-    users = {
-      users.slskd = {
+    # Force off, configuration file is in nix store and is immutable
+    services.slskd.settings.remote_configuration = lib.mkForce false;
+
+    users.users = lib.optionalAttrs (cfg.user == defaultUser) {
+      "${defaultUser}" = {
+        group = cfg.group;
         isSystemUser = true;
-        group = "slskd";
-      };
-      groups.slskd = {};
-    };
-
-    # Reverse proxy configuration
-    services.nginx.enable = true;
-    services.nginx.virtualHosts."${cfg.nginx.domainName}" = {
-      forceSSL = true;
-      enableACME = true;
-      locations = {
-        "${cfg.nginx.contextPath}" = {
-          proxyPass = "http://localhost:${toString cfg.settings.web.port}";
-          proxyWebsockets = true;
-        };
       };
     };
 
-    # Hide state & logs
-    systemd.tmpfiles.rules = [
-      "d /var/lib/slskd/data 0750 slskd slskd - -"
-      "d /var/lib/slskd/logs 0750 slskd slskd - -"
-    ];
+    users.groups = lib.optionalAttrs (cfg.group == defaultUser) {
+      "${defaultUser}" = {};
+    };
 
     systemd.services.slskd = {
       description = "A modern client-server application for the Soulseek file sharing network";
@@ -165,12 +280,16 @@ in {
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         Type = "simple";
-        User = "slskd";
+        User = cfg.user;
+        Group = cfg.group;
         EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
-        StateDirectory = "slskd";
+        StateDirectory = "slskd";  # Creates /var/lib/slskd and manages permissions
         ExecStart = "${cfg.package}/bin/slskd --app-dir /var/lib/slskd --config ${configurationYaml}";
         Restart = "on-failure";
         ReadOnlyPaths = map (d: builtins.elemAt (builtins.split "[^/]*(/.+)" d) 1) cfg.settings.shares.directories;
+        ReadWritePaths =
+          (lib.optional (cfg.settings.directories.incomplete != null) cfg.settings.directories.incomplete) ++
+          (lib.optional (cfg.settings.directories.downloads != null) cfg.settings.directories.downloads);
         LockPersonality = true;
         NoNewPrivileges = true;
         PrivateDevices = true;
@@ -194,18 +313,21 @@ in {
 
     networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.settings.soulseek.listen_port;
 
-    systemd.services.slskd-rotatelogs = lib.mkIf cfg.rotateLogs {
-      description = "Rotate slskd logs";
-      serviceConfig = {
-        Type = "oneshot";
-        User = "slskd";
-        ExecStart = [
-          "${pkgs.findutils}/bin/find /var/lib/slskd/logs/ -type f -mtime +10 -delete"
-          "${pkgs.findutils}/bin/find /var/lib/slskd/logs/ -type f -mtime +1  -exec ${pkgs.gzip}/bin/gzip -q {} ';'"
-        ];
-      };
-      startAt = "daily";
+    services.nginx = lib.mkIf (cfg.domain != null) {
+      enable = lib.mkDefault true;
+      virtualHosts."${cfg.domain}" = lib.mkMerge [
+        cfg.nginx
+        {
+          locations."${cfg.settings.web.url_base}" = {
+            proxyPass = "http://127.0.0.1:${toString cfg.settings.web.port}";
+            proxyWebsockets = true;
+          };
+        }
+      ];
     };
+  };
 
+  meta = {
+    maintainers = with lib.maintainers; [ ppom melvyn2 ];
   };
 }

nixos/modules/virtualisation/incus.nix

@@ -1,8 +1,80 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.virtualisation.incus;
   preseedFormat = pkgs.formats.yaml { };
+
+  serverBinPath = ''${pkgs.qemu_kvm}/libexec:${
+    lib.makeBinPath (
+      with pkgs;
+      [
+        cfg.package
+
+        acl
+        attr
+        bash
+        btrfs-progs
+        cdrkit
+        coreutils
+        criu
+        dnsmasq
+        e2fsprogs
+        findutils
+        getent
+        gnugrep
+        gnused
+        gnutar
+        gptfdisk
+        gzip
+        iproute2
+        iptables
+        kmod
+        lvm2
+        minio
+        nftables
+        qemu_kvm
+        qemu-utils
+        rsync
+        squashfsTools
+        systemd
+        thin-provisioning-tools
+        util-linux
+        virtiofsd
+        xz
+
+        (writeShellScriptBin "apparmor_parser" ''
+          exec '${apparmor-parser}/bin/apparmor_parser' -I '${apparmor-profiles}/etc/apparmor.d' "$@"
+        '')
+      ]
+      ++ lib.optionals config.boot.zfs.enabled [
+        config.boot.zfs.package
+        "${config.boot.zfs.package}/lib/udev"
+      ]
+      ++ lib.optionals config.virtualisation.vswitch.enable [ config.virtualisation.vswitch.package ]
+    )
+  }'';
+
+  # https://github.com/lxc/incus/blob/cff35a29ee3d7a2af1f937cbb6cf23776941854b/internal/server/instance/drivers/driver_qemu.go#L123
+  ovmf-prefix = if pkgs.stdenv.hostPlatform.isAarch64 then "AAVMF" else "OVMF";
+  ovmf = pkgs.linkFarm "incus-ovmf" [
+    {
+      name = "OVMF_CODE.4MB.fd";
+      path = "${pkgs.OVMFFull.fd}/FV/${ovmf-prefix}_CODE.fd";
+    }
+    {
+      name = "OVMF_VARS.4MB.fd";
+      path = "${pkgs.OVMFFull.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+    {
+      name = "OVMF_VARS.4MB.ms.fd";
+      path = "${pkgs.OVMFFull.fd}/FV/${ovmf-prefix}_VARS.fd";
+    }
+  ];
 in
 {
   meta = {
@@ -11,26 +83,29 @@ in
 
   options = {
     virtualisation.incus = {
-      enable = lib.mkEnableOption (lib.mdDoc ''
+      enable = lib.mkEnableOption ''
         incusd, a daemon that manages containers and virtual machines.
 
         Users in the "incus-admin" group can interact with
         the daemon (e.g. to start or stop containers) using the
         {command}`incus` command line tool, among others.
-      '');
+      '';
 
       package = lib.mkPackageOption pkgs "incus" { };
 
       lxcPackage = lib.mkPackageOption pkgs "lxc" { };
 
+      clientPackage = lib.mkPackageOption pkgs [
+        "incus"
+        "client"
+      ] { };
+
       preseed = lib.mkOption {
-        type = lib.types.nullOr (
-          lib.types.submodule { freeformType = preseedFormat.type; }
-        );
+        type = lib.types.nullOr (lib.types.submodule { freeformType = preseedFormat.type; });
 
         default = null;
 
-        description = lib.mdDoc ''
+        description = ''
           Configuration for Incus preseed, see
           <https://linuxcontainers.org/incus/docs/main/howto/initialize/#non-interactive-configuration>
           for supported values.
@@ -80,18 +155,16 @@ in
         };
       };
 
-      socketActivation = lib.mkEnableOption (
-        lib.mdDoc ''
-          socket-activation for starting incus.service. Enabling this option
-          will stop incus.service from starting automatically on boot.
-        ''
-      );
+      socketActivation = lib.mkEnableOption (''
+        socket-activation for starting incus.service. Enabling this option
+        will stop incus.service from starting automatically on boot.
+      '');
 
       startTimeout = lib.mkOption {
         type = lib.types.ints.unsigned;
         default = 600;
         apply = toString;
-        description = lib.mdDoc ''
+        description = ''
           Time to wait (in seconds) for incusd to become ready to process requests.
           If incusd does not reply within the configured time, `incus.service` will be
           considered failed and systemd will attempt to restart it.
@@ -99,9 +172,12 @@ in
       };
 
       ui = {
-        enable = lib.mkEnableOption (lib.mdDoc "(experimental) Incus UI");
+        enable = lib.mkEnableOption "(experimental) Incus UI";
 
-        package = lib.mkPackageOption pkgs [ "incus" "ui" ] { };
+        package = lib.mkPackageOption pkgs [
+          "incus"
+          "ui"
+        ] { };
       };
     };
   };
@@ -109,7 +185,12 @@ in
   config = lib.mkIf cfg.enable {
     assertions = [
       {
-        assertion = !(config.networking.firewall.enable && !config.networking.nftables.enable && config.virtualisation.incus.enable);
+        assertion =
+          !(
+            config.networking.firewall.enable
+            && !config.networking.nftables.enable
+            && config.virtualisation.incus.enable
+          );
         message = "Incus on NixOS is unsupported using iptables. Set `networking.nftables.enable = true;`";
       }
     ];
@@ -137,7 +218,12 @@ in
       "vhost_vsock"
     ] ++ lib.optionals (!config.networking.nftables.enable) [ "iptable_mangle" ];
 
-    environment.systemPackages = [ cfg.package ];
+    environment.systemPackages = [
+      cfg.clientPackage
+
+      # gui console support
+      pkgs.spice-gtk
+    ];
 
     # Note: the following options are also declared in virtualisation.lxc, but
     # the latter can't be simply enabled to reuse the formers, because it
@@ -164,32 +250,24 @@ in
         "network-online.target"
         "lxcfs.service"
         "incus.socket"
-      ]
-        ++ lib.optional config.virtualisation.vswitch.enable "ovs-vswitchd.service";
+      ] ++ lib.optionals config.virtualisation.vswitch.enable [ "ovs-vswitchd.service" ];
 
       requires = [
         "lxcfs.service"
         "incus.socket"
-      ]
-        ++ lib.optional config.virtualisation.vswitch.enable "ovs-vswitchd.service";
+      ] ++ lib.optionals config.virtualisation.vswitch.enable [ "ovs-vswitchd.service" ];
 
-      wants = [
-        "network-online.target"
+      wants = [ "network-online.target" ];
+
+      environment = lib.mkMerge [
+        {
+          INCUS_LXC_TEMPLATE_CONFIG = "${pkgs.lxcfs}/share/lxc/config";
+          INCUS_OVMF_PATH = ovmf;
+          PATH = lib.mkForce serverBinPath;
+        }
+        (lib.mkIf (cfg.ui.enable) { "INCUS_UI" = cfg.ui.package; })
       ];
 
-      path = lib.optionals config.boot.zfs.enabled [
-        config.boot.zfs.package
-        "${config.boot.zfs.package}/lib/udev"
-      ]
-        ++ lib.optional config.virtualisation.vswitch.enable config.virtualisation.vswitch.package;
-
-      environment = lib.mkMerge [ {
-        # Override Path to the LXC template configuration directory
-        INCUS_LXC_TEMPLATE_CONFIG = "${pkgs.lxcfs}/share/lxc/config";
-      } (lib.mkIf (cfg.ui.enable) {
-        "INCUS_UI" = cfg.ui.package;
-      }) ];
-
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/incusd --group incus-admin";
         ExecStartPost = "${cfg.package}/bin/incusd waitready --timeout=${cfg.startTimeout}";
@@ -222,15 +300,13 @@ in
     systemd.services.incus-preseed = lib.mkIf (cfg.preseed != null) {
       description = "Incus initialization with preseed file";
 
-      wantedBy = ["incus.service"];
-      after = ["incus.service"];
-      bindsTo = ["incus.service"];
-      partOf = ["incus.service"];
+      wantedBy = [ "incus.service" ];
+      after = [ "incus.service" ];
+      bindsTo = [ "incus.service" ];
+      partOf = [ "incus.service" ];
 
       script = ''
-        ${cfg.package}/bin/incus admin init --preseed <${
-          preseedFormat.generate "incus-preseed.yaml" cfg.preseed
-        }
+        ${cfg.package}/bin/incus admin init --preseed <${preseedFormat.generate "incus-preseed.yaml" cfg.preseed}
       '';
 
       serviceConfig = {

nixos/tests/all-tests.nix

@@ -309,6 +309,7 @@ in {
   firefox-devedition = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-devedition; };
   firefox-esr    = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-esr; }; # used in `tested` job
   firefox-esr-115 = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-esr-115; };
+  firefoxpwa = handleTest ./firefoxpwa.nix {};
   firejail = handleTest ./firejail.nix {};
   firewall = handleTest ./firewall.nix { nftables = false; };
   firewall-nftables = handleTest ./firewall.nix { nftables = true; };

nixos/tests/firefoxpwa.nix

@@ -0,0 +1,36 @@
+import ./make-test-python.nix ({ lib, ... }:
+
+{
+  name = "firefoxpwa";
+  meta.maintainers = with lib.maintainers; [ camillemndn ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ./common/x11.nix ];
+      environment.systemPackages = with pkgs; [ firefoxpwa jq ];
+
+      programs.firefox = {
+        enable = true;
+        nativeMessagingHosts.packages = [ pkgs.firefoxpwa ];
+      };
+
+      services.jellyfin.enable = true;
+    };
+
+  enableOCR = true;
+
+  testScript = ''
+    machine.start()
+
+    with subtest("Install a progressive web app"):
+        machine.wait_for_unit("jellyfin.service")
+        machine.wait_for_open_port(8096)
+        machine.succeed("firefoxpwa site install http://localhost:8096/web/manifest.json >&2")
+
+    with subtest("Launch the progressive web app"):
+        machine.succeed("firefoxpwa site launch $(jq -r < ~/.local/share/firefoxpwa/config.json '.sites | keys[0]') >&2")
+        machine.wait_for_window("Jellyfin")
+        machine.wait_for_text("Jellyfin")
+  '';
+})

nixos/tests/incus/container.nix

@@ -1,20 +1,21 @@
-import ../make-test-python.nix ({ pkgs, lib, extra ? {}, ... } :
+import ../make-test-python.nix ({ pkgs, lib, extra ? {}, name ? "incus-container", ... } :
 
 let
   releases = import ../../release.nix {
-    configuration = {
-      # Building documentation makes the test unnecessarily take a longer time:
-      documentation.enable = lib.mkForce false;
+    configuration = lib.recursiveUpdate {
+        # Building documentation makes the test unnecessarily take a longer time:
+        documentation.enable = lib.mkForce false;
 
-      boot.kernel.sysctl."net.ipv4.ip_forward" = "1";
-    } // extra;
+        boot.kernel.sysctl."net.ipv4.ip_forward" = "1";
+    }
+    extra;
   };
 
   container-image-metadata = releases.lxdContainerMeta.${pkgs.stdenv.hostPlatform.system};
   container-image-rootfs = releases.lxdContainerImage.${pkgs.stdenv.hostPlatform.system};
 in
 {
-  name = "incus-container";
+  inherit name;
 
   meta = {
     maintainers = lib.teams.lxc.members;

nixos/tests/incus/default.nix

@@ -5,16 +5,22 @@
   handleTestOn,
 }:
 {
-  container-old-init = import ./container.nix { inherit system pkgs; };
-  container-new-init = import ./container.nix { inherit system pkgs; extra = {
-    # Enable new systemd init
-    boot.initrd.systemd.enable = true;
-  }; };
+  container-legacy-init = import ./container.nix {
+    name = "container-legacy-init";
+    inherit system pkgs;
+  };
+  container-systemd-init = import ./container.nix {
+    name = "container-systemd-init";
+    inherit system pkgs;
+    extra = {
+      boot.initrd.systemd.enable = true;
+    };
+  };
   lxd-to-incus = import ./lxd-to-incus.nix { inherit system pkgs; };
   openvswitch = import ./openvswitch.nix { inherit system pkgs; };
   preseed = import ./preseed.nix { inherit system pkgs; };
   socket-activated = import ./socket-activated.nix { inherit system pkgs; };
   storage = import ./storage.nix { inherit system pkgs; };
-  ui = import ./ui.nix {inherit system pkgs;};
+  ui = import ./ui.nix { inherit system pkgs; };
   virtual-machine = handleTestOn [ "x86_64-linux" ] ./virtual-machine.nix { inherit system pkgs; };
 }

nixos/tests/incus/lxd-to-incus.nix

@@ -95,7 +95,7 @@ import ../make-test-python.nix (
       machine.wait_for_unit("incus.service")
 
       with machine.nested("run migration"):
-          machine.succeed("lxd-to-incus --yes")
+          machine.succeed("${pkgs.incus}/bin/lxd-to-incus --yes")
 
       with machine.nested("verify resources migrated to incus"):
           machine.succeed("incus config show container")

nixos/tests/nix-ld.nix

@@ -1,17 +1,39 @@
-import ./make-test-python.nix ({ lib, pkgs, ...} :
+{ system ? builtins.currentSystem,
+  config ? {},
+  pkgs ? import ../.. { inherit system config; }
+}:
+let
+  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
+  shared =
+    { config, pkgs, ... }:
+    {
+      programs.nix-ld.enable = true;
+      environment.systemPackages = [
+        (pkgs.runCommand "patched-hello" { } ''
+          install -D -m755 ${pkgs.hello}/bin/hello $out/bin/hello
+          patchelf $out/bin/hello --set-interpreter $(cat ${config.programs.nix-ld.package}/nix-support/ldpath)
+        '')
+      ];
+    };
+in
 {
-  name = "nix-ld";
-  nodes.machine = { pkgs, ... }: {
-    programs.nix-ld.enable = true;
-    environment.systemPackages = [
-      (pkgs.runCommand "patched-hello" {} ''
-        install -D -m755 ${pkgs.hello}/bin/hello $out/bin/hello
-        patchelf $out/bin/hello --set-interpreter $(cat ${pkgs.nix-ld}/nix-support/ldpath)
-      '')
-    ];
+  nix-ld = makeTest {
+    name = "nix-ld";
+    nodes.machine = shared;
+    testScript = ''
+      start_all()
+      machine.succeed("hello")
+    '';
   };
-  testScript = ''
-    start_all()
-    machine.succeed("hello")
- '';
-})
+  nix-ld-rs = makeTest {
+    name = "nix-ld-rs";
+    nodes.machine = {
+      imports = [ shared ];
+      programs.nix-ld.package = pkgs.nix-ld-rs;
+    };
+    testScript = ''
+      start_all()
+      machine.succeed("hello")
+    '';
+  };
+}

nixos/tests/tracee.nix

@@ -1,7 +1,13 @@
-import ./make-test-python.nix ({ pkgs, ... }: {
+import ./make-test-python.nix ({ pkgs, ... }: rec {
   name = "tracee-integration";
   meta.maintainers = pkgs.tracee.meta.maintainers;
 
+  passthru.hello-world-builder = pkgs: pkgs.dockerTools.buildImage {
+    name = "hello-world";
+    tag = "latest";
+    config.Cmd = [ "${pkgs.hello}/bin/hello" ];
+  };
+
   nodes = {
     machine = { config, pkgs, ... }: {
       # EventFilters/trace_only_events_from_new_containers and
@@ -12,57 +18,48 @@ import ./make-test-python.nix ({ pkgs, ... }: {
       environment.systemPackages = with pkgs; [
         # required by Test_EventFilters/trace_events_from_ls_and_which_binary_in_separate_scopes
         which
-        # build the go integration tests as a binary
-        (tracee.overrideAttrs (oa: {
-          pname = oa.pname + "-integration";
-          postPatch = oa.postPatch or "" + ''
-            # prepare tester.sh (which will be embedded in the test binary)
-            patchShebangs tests/integration/tester.sh
-
-            # fix the test to look at nixos paths for running programs
-            substituteInPlace tests/integration/integration_test.go \
-              --replace "bin=/usr/bin/" "comm=" \
-              --replace "binary=/usr/bin/" "comm=" \
-              --replace "/usr/bin/dockerd" "dockerd" \
-              --replace "/usr/bin" "/run/current-system/sw/bin"
-          '';
-          nativeBuildInputs = oa.nativeBuildInputs or [ ] ++ [ makeWrapper ];
-          buildPhase = ''
-            runHook preBuild
-            # just build the static lib we need for the go test binary
-            make $makeFlags ''${enableParallelBuilding:+-j$NIX_BUILD_CORES} bpf-core ./dist/btfhub
-
-            # then compile the tests to be ran later
-            CGO_LDFLAGS="$(pkg-config --libs libbpf)" go test -tags core,ebpf,integration -p 1 -c -o $GOPATH/tracee-integration ./tests/integration/...
-            runHook postBuild
-          '';
-          doCheck = false;
-          outputs = [ "out" ];
-          installPhase = ''
-            mkdir -p $out/bin
-            mv $GOPATH/tracee-integration $out/bin/
-          '';
-          doInstallCheck = false;
-
-          meta = oa.meta // {
-            outputsToInstall = [];
-          };
-        }))
+        # the go integration tests as a binary
+        tracee.passthru.tests.integration-test-cli
       ];
     };
   };
 
-  testScript = ''
-    machine.wait_for_unit("docker.service")
+  testScript =
+    let
+      skippedTests = [
+        # these comm tests for some reason do not resolve.
+        # something about the test is different as it works fine if I replicate
+        # the policies and run tracee myself but doesn't work in the integration
+        # test either with the automatic run or running the commands by hand
+        # while it's searching.
+        "Test_EventFilters/comm:_event:_args:_trace_event_set_in_a_specific_policy_with_args_from_ls_command"
+        "Test_EventFilters/comm:_event:_trace_events_set_in_two_specific_policies_from_ls_and_uname_commands"
 
-    with subtest("run integration tests"):
-      # EventFilters/trace_only_events_from_new_containers also requires a container called "alpine"
-      machine.succeed('tar c -C ${pkgs.pkgsStatic.busybox} . | docker import - alpine --change "ENTRYPOINT [\"sleep\"]"')
+        # worked at some point, seems to be flakey
+        "Test_EventFilters/pid:_event:_args:_trace_event_sched_switch_with_args_from_pid_0"
+      ];
+    in
+    ''
+      with subtest("prepare for integration tests"):
+        machine.wait_for_unit("docker.service")
+        machine.succeed('which bash')
 
-      # Test_EventFilters/trace_event_set_in_a_specific_scope expects to be in a dir that includes "integration"
-      print(machine.succeed(
-        'mkdir /tmp/integration',
-        'cd /tmp/integration && tracee-integration -test.v'
-      ))
-  '';
+        # EventFilters/trace_only_events_from_new_containers also requires a container called "hello-world"
+        machine.succeed('docker load < ${passthru.hello-world-builder pkgs}')
+
+        # exec= needs fully resolved paths
+        machine.succeed(
+          'mkdir /tmp/testdir',
+          'cp $(which who) /tmp/testdir/who',
+          'cp $(which uname) /tmp/testdir/uname',
+        )
+
+      with subtest("run integration tests"):
+        # Test_EventFilters/trace_event_set_in_a_specific_scope expects to be in a dir that includes "integration"
+        # tests must be ran with 1 process
+        print(machine.succeed(
+          'mkdir /tmp/integration',
+          'cd /tmp/integration && export PATH="/tmp/testdir:$PATH" && integration.test -test.v -test.parallel 1 -test.skip="^${builtins.concatStringsSep "$|^" skippedTests}$"'
+        ))
+    '';
 })

pkgs/applications/audio/tidal-hifi/default.nix

@@ -36,11 +36,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tidal-hifi";
-  version = "5.9.0";
+  version = "5.10.0";
 
   src = fetchurl {
     url = "https://github.com/Mastermindzh/tidal-hifi/releases/download/${finalAttrs.version}/tidal-hifi_${finalAttrs.version}_amd64.deb";
-    sha256 = "sha256-t79GNCqY99JfCT+4wO3CTtLXFdKQudMw4pZNiJzOufo=";
+    sha256 = "sha256-+sRXpRAtbLpQlyJUhbc1Cuzh6aV8HRvYH/ja9sfvKoA=";
   };
 
   nativeBuildInputs = [ autoPatchelfHook dpkg makeWrapper ];

pkgs/applications/audio/waylyrics/Cargo.lock

@@ -126,6 +126,12 @@ version = "0.21.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
 
+[[package]]
+name = "base64"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9475866fec1451be56a3c2400fd081ff546538961565ccb5b7142cbd22bc7a51"
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -431,17 +437,6 @@ dependencies = [
  "powerfmt",
 ]
 
-[[package]]
-name = "derivative"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcc3dd5e9e9c0b295d6e1e4d811fb6f157d5ffd784b8d202fc62eac8035a770b"
-dependencies = [
- "proc-macro2",
- "quote 1.0.35",
- "syn 1.0.109",
-]
-
 [[package]]
 name = "derive_is_enum_variant"
 version = "0.1.1"
@@ -964,9 +959,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.3.24"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb2c4422095b67ee78da96fbb51a4cc413b3b25883c7717ff7ca1ab31022c9c9"
+checksum = "51ee2dd2e4f378392eeff5d51618cd9a63166a2513846bbc55f21cfacd9199d4"
 dependencies = [
  "bytes",
  "fnv",
@@ -1034,9 +1029,9 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "http"
-version = "0.2.11"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8947b1a6fad4393052c7ba1f4cd97bed3e953a95c79c92ad9b051a04611d9fbb"
+checksum = "21b9ddb458710bc376481b842f5da65cdf31522de232c1ca8146abce2a358258"
 dependencies = [
  "bytes",
  "fnv",
@@ -1045,12 +1040,24 @@ dependencies = [
 
 [[package]]
 name = "http-body"
-version = "0.4.6"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
+checksum = "1cac85db508abc24a2e48553ba12a996e87244a0395ce011e62b37158745d643"
 dependencies = [
  "bytes",
  "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0475f8b2ac86659c21b64320d5d653f9efe42acd2a4e560073ec61a155a34f1d"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
  "pin-project-lite",
 ]
 
@@ -1060,47 +1067,60 @@ version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
 
-[[package]]
-name = "httpdate"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
-
 [[package]]
 name = "hyper"
-version = "0.14.28"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf96e135eb83a2a8ddf766e426a841d8ddd7449d5f00d34ea02b41d2f19eef80"
+checksum = "186548d73ac615b32a73aafe38fb4f56c0d340e110e5a200bcadbaf2e199263a"
 dependencies = [
  "bytes",
  "futures-channel",
- "futures-core",
  "futures-util",
  "h2",
  "http",
  "http-body",
  "httparse",
- "httpdate",
  "itoa",
  "pin-project-lite",
- "socket2",
+ "smallvec",
  "tokio",
- "tower-service",
- "tracing",
  "want",
 ]
 
 [[package]]
 name = "hyper-tls"
-version = "0.5.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
+checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
 dependencies = [
  "bytes",
+ "http-body-util",
  "hyper",
+ "hyper-util",
  "native-tls",
  "tokio",
  "tokio-native-tls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca38ef113da30126bbff9cd1705f9273e15d45498615d138b0c20279ac7a76aa"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower",
+ "tower-service",
+ "tracing",
 ]
 
 [[package]]
@@ -1328,9 +1348,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "0.8.10"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f3d0b296e374a4e6f3c7b0a1f5a51d748a0d34c85e7dc48fc3fa9a87657fe09"
+checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
 dependencies = [
  "libc",
  "wasi",
@@ -1371,9 +1391,9 @@ dependencies = [
 [[package]]
 name = "ncmapi"
 version = "0.1.13"
-source = "git+https://github.com/waylyrics/ncmapi-rs.git?rev=51b4d121#51b4d121235823e8040feb3a9c9052da0559fe75"
+source = "git+https://github.com/waylyrics/ncmapi-rs.git?rev=590f280#590f280458e1826df0af0f0f624c2222448a7dee"
 dependencies = [
- "base64",
+ "base64 0.22.0",
  "cookie 0.18.0",
  "hex",
  "openssl",
@@ -1638,6 +1658,26 @@ dependencies = [
  "siphasher",
 ]
 
+[[package]]
+name = "pin-project"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6bf43b791c5b9e34c3d182969b4abb522f9343702850a2e57f460d00d09b4b3"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f38a4412a78282e09a2cf38d195ea5420d15ba0602cb375210efbc877243965"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.35",
+ "syn 2.0.50",
+]
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.13"
@@ -1871,11 +1911,11 @@ dependencies = [
 
 [[package]]
 name = "reqwest"
-version = "0.11.24"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6920094eb85afde5e4a138be3f2de8bbdf28000f0029e72c45025a56b042251"
+checksum = "58b48d98d932f4ee75e541614d32a7f44c889b72bd9c2e04d95edd135989df88"
 dependencies = [
- "base64",
+ "base64 0.21.7",
  "bytes",
  "cookie 0.17.0",
  "cookie_store",
@@ -1885,8 +1925,10 @@ dependencies = [
  "h2",
  "http",
  "http-body",
+ "http-body-util",
  "hyper",
  "hyper-tls",
+ "hyper-util",
  "ipnet",
  "js-sys",
  "log",
@@ -2000,7 +2042,7 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
 dependencies = [
- "base64",
+ "base64 0.21.7",
 ]
 
 [[package]]
@@ -2535,6 +2577,28 @@ dependencies = [
  "winnow 0.6.2",
 ]
 
+[[package]]
+name = "tower"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8fa9be0de6cf49e536ce1851f987bd21a43b771b09473c3549a6c853db37c1c"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project",
+ "pin-project-lite",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c20c8dbed6283a09604c3e69b4b7eeb54e298b8a600d4d5ecb5ad39de609f1d0"
+
 [[package]]
 name = "tower-service"
 version = "0.3.2"
@@ -2547,6 +2611,7 @@ version = "0.1.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3523ab5a71916ccf420eebdf5521fcef02141234bbc0b8a49f2fdc4544364ef"
 dependencies = [
+ "log",
  "pin-project-lite",
  "tracing-attributes",
  "tracing-core",
@@ -2788,14 +2853,13 @@ checksum = "4f186bd2dcf04330886ce82d6f33dd75a7bfcf69ecf5763b89fcde53b6ac9838"
 
 [[package]]
 name = "waylyrics"
-version = "0.2.12"
+version = "0.2.13"
 dependencies = [
  "anyhow",
  "async-channel",
  "async-trait",
  "dbus",
  "dbus-dummy",
- "derivative",
  "documented",
  "gettext-rs",
  "glib-macros",

pkgs/applications/audio/waylyrics/default.nix

@@ -9,19 +9,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "waylyrics";
-  version = "0.2.12";
+  version = "0.2.13";
 
   src = fetchFromGitHub {
     owner = "poly000";
     repo = "waylyrics";
     rev = "v${version}";
-    hash = "sha256-sUhFT3Vq/IjbMir7/AVCU8FyfmoNiZsn2zkqdJkOMFo=";
+    hash = "sha256-522NdpGj0oh2SbWa4GFCFpqNFRhqQxfZ1ZRuS9jUj7Y=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "ncmapi-0.1.13" = "sha256-NxgF1TV+3hK5oE/DfJnWyc+XmPX3U1UeD+xTkcvDzIA=";
+      "ncmapi-0.1.13" = "sha256-qu89qf4IPM14V+oE4QQr/SsXSTx3vQbyfzD+Pihcd3E=";
       "qqmusic-rs-0.1.0" = "sha256-woLsO0n+m3EBUI+PRLio7iLp0UPQSliWK0djCSZEaZc=";
     };
   };
@@ -51,6 +51,14 @@ rustPlatform.buildRustPackage rec {
     # Install icons
     install -d $out/share/icons
     cp -vr res/icons/hicolor $out/share/icons/hicolor
+    # Install translations
+    pushd locales
+    for po in $(find . -type f -name '*.po')
+    do
+      install -d $(dirname "$out/share/locale/$po")
+      msgfmt -o $out/share/locale/''${po%.po}.mo $po
+    done
+    popd
   '';
 
   meta = with lib; {

pkgs/applications/blockchains/trezor-suite/default.nix

@@ -53,6 +53,9 @@ appimageTools.wrapType2 rec {
   '';
 
   meta = with lib; {
+    # trezor-suite fails to detect a connected hardware wallet
+    # ref: https://github.com/NixOS/nixpkgs/issues/281975
+    broken = true;
     description = "Trezor Suite - Desktop App for managing crypto";
     homepage = "https://suite.trezor.io";
     changelog = "https://github.com/trezor/trezor-suite/releases/tag/v${version}";

pkgs/applications/editors/gedit/default.nix

@@ -4,6 +4,7 @@
 , mesonEmulatorHook
 , fetchurl
 , python3
+, python3Packages
 , pkg-config
 , gtk3
 , gtk-mac-integration
@@ -53,6 +54,7 @@ stdenv.mkDerivation rec {
     perl
     pkg-config
     python3
+    python3Packages.wrapPython
     vala
     wrapGAppsHook
     gtk-doc
@@ -85,6 +87,16 @@ stdenv.mkDerivation rec {
   # Reliably fails to generate gedit-file-browser-enum-types.h in time
   enableParallelBuilding = false;
 
+  pythonPath = with python3Packages; [
+    # https://github.com/NixOS/nixpkgs/issues/298716
+    pycairo
+  ];
+
+  postFixup = ''
+    buildPythonPath "$pythonPath"
+    patchPythonScript $out/lib/gedit/plugins/snippets/document.py
+  '';
+
   passthru = {
     updateScript = gnome.updateScript {
       packageName = "gedit";

pkgs/applications/editors/xedit/default.nix

@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation rec {
   pname = "xedit";
-  version = "1.2.3";
+  version = "1.2.4";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "xorg/app";
     repo = "xedit";
     rev = "${pname}-${version}";
-    sha256 = "sha256-WF+4avzRRL0+OA3KxzK7JwmArkPu9fEl+728R6ouXmg=";
+    sha256 = "sha256-0vP+aR8QBXAqbULOLEs7QXsehk18BJ405qoelrcepwE=";
   };
 
   # ./lisp/mathimp.c:493:10: error: implicitly declaring library function 'finite' with type 'int (double)'

pkgs/applications/graphics/graphicsmagick/compat.nix

@@ -1,37 +0,0 @@
-{ lib, stdenv, graphicsmagick }:
-
-stdenv.mkDerivation {
-  pname = "graphicsmagick-imagemagick-compat";
-  inherit (graphicsmagick) version;
-
-  dontUnpack = true;
-  buildPhase = "true";
-
-  utils = [
-    "composite"
-    "conjure"
-    "convert"
-    "identify"
-    "mogrify"
-    "montage"
-    "animate"
-    "display"
-    "import"
-  ];
-
-  # TODO: symlink libraries?
-  installPhase = ''
-    mkdir -p "$out"/bin
-    mkdir -p "$out"/share/man/man1
-    for util in ''${utils[@]}; do
-      ln -s ${graphicsmagick}/bin/gm "$out/bin/$util"
-      ln -s ${graphicsmagick}/share/man/man1/gm.1.gz "$out/share/man/man1/$util.1.gz"
-    done
-  '';
-
-  meta = {
-    description = "ImageMagick interface for GraphicsMagick";
-    license = lib.licenses.free;
-    platforms = lib.platforms.all;
-  };
-}

pkgs/applications/graphics/graphicsmagick/default.nix

@@ -1,67 +0,0 @@
-{ lib, stdenv, fetchurl, bzip2, freetype, graphviz, ghostscript
-, libjpeg, libpng, libtiff, libxml2, zlib, libtool, xz, libX11
-, libwebp, quantumdepth ? 8, fixDarwinDylibNames, nukeReferences
-, coreutils
-, runCommand
-, graphicsmagick  # for passthru.tests
-}:
-
-stdenv.mkDerivation rec {
-  pname = "graphicsmagick";
-  version = "1.3.42";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/graphicsmagick/GraphicsMagick-${version}.tar.xz";
-    sha256 = "sha256-SE/M/Ssvr2wrqRUUaezlByvLkbpO1z517T2ORsdZ1Vc=";
-  };
-
-  patches = [
-    ./disable-popen.patch
-  ];
-
-  configureFlags = [
-    # specify delegates explicitly otherwise `gm` will invoke the build
-    # coreutils for filetypes it doesn't natively support.
-    "MVDelegate=${lib.getExe' coreutils "mv"}"
-    "--enable-shared"
-    "--with-frozenpaths"
-    "--with-quantum-depth=${toString quantumdepth}"
-    "--with-gslib=yes"
-  ];
-
-  buildInputs =
-    [ bzip2 freetype ghostscript graphviz libjpeg libpng libtiff libX11 libxml2
-      zlib libtool libwebp
-    ];
-
-  nativeBuildInputs = [ xz nukeReferences ]
-  ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
-
-  # Remove CFLAGS from the binaries to avoid closure bloat.
-  # In the past we have had -dev packages in the closure of the binaries soley due to the string references.
-  postConfigure = ''
-    nuke-refs -e $out ./magick/magick_config.h
-  '';
-
-  postInstall = ''
-    sed -i 's/-ltiff.*'\'/\'/ $out/bin/*
-  '';
-
-  passthru = {
-    tests = {
-      issue-157920 = runCommand "issue-157920-regression-test" {
-        buildInputs = [ graphicsmagick ];
-      } ''
-        gm convert ${graphviz}/share/doc/graphviz/neatoguide.pdf jpg:$out
-      '';
-    };
-  };
-
-  meta = {
-    homepage = "http://www.graphicsmagick.org";
-    description = "Swiss army knife of image processing";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.all;
-    mainProgram = "gm";
-  };
-}

pkgs/applications/graphics/graphicsmagick/disable-popen.patch

@@ -1,12 +0,0 @@
-http://permalink.gmane.org/gmane.comp.security.oss.general/19669
-
---- a/magick/blob.c Sat Nov 07 14:49:16 2015 -0600
-+++ b/magick/blob.c Sun May 29 14:12:57 2016 -0500
-@@ -68,6 +68,7 @@
- */
- #define DefaultBlobQuantum  65541
- 
-+#undef HAVE_POPEN
- 
- /*
-   Enum declarations.

pkgs/applications/misc/gramps/check-locale-hasattr-textdomain.patch

@@ -0,0 +1,19 @@
+diff --git a/gramps/gen/utils/grampslocale.py b/gramps/gen/utils/grampslocale.py
+index f25030e..59c1c90 100644
+--- a/gramps/gen/utils/grampslocale.py
++++ b/gramps/gen/utils/grampslocale.py
+@@ -370,8 +370,12 @@ class GrampsLocale:
+                 )
+             else:
+                 # bug12278, _build_popup_ui() under linux and macOS
+-                locale.textdomain(self.localedomain)
+-                locale.bindtextdomain(self.localedomain, self.localedir)
++                if hasattr(locale, 'textdomain'):
++                    locale.textdomain(self.localedomain)
++                    locale.bindtextdomain(self.localedomain, self.localedir)
++                else:
++                    gettext.textdomain(self.localedomain)
++                    gettext.bindtextdomain(self.localedomain, self.localedir)
+ 
+         self.rtl_locale = False
+         if self.language[0] in _RTL_LOCALES:

pkgs/applications/misc/gramps/default.nix

@@ -1,5 +1,4 @@
 { lib
-, fetchpatch
 , fetchFromGitHub
 , gtk3
 , pythonPackages
@@ -10,8 +9,8 @@
 , gobject-introspection
 , wrapGAppsHook
 , gettext
-, # Optional packages:
-  enableOSM ? true
+  # Optional packages:
+, enableOSM ? true
 , osm-gps-map
 , glib-networking
 , enableGraphviz ? true
@@ -21,13 +20,29 @@
 }:
 
 let
-  inherit (pythonPackages) python buildPythonApplication;
+  inherit (pythonPackages) buildPythonApplication pythonOlder;
 in
 buildPythonApplication rec {
-  version = "5.1.6";
+  version = "5.2.0";
   pname = "gramps";
   pyproject = true;
 
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "gramps-project";
+    repo = "gramps";
+    rev = "v${version}";
+    hash = "sha256-8iQcaWLiBegVjcV16TfZbp8/4N/9f5pEl7mdV78CeEY=";
+  };
+
+  patches = [
+    # textdomain doesn't exist as a property on locale when running on Darwin
+    ./check-locale-hasattr-textdomain.patch
+    # disables the startup warning about bad GTK installation
+    ./disable-gtk-warning-dialog.patch
+  ];
+
   nativeBuildInputs = [
     wrapGAppsHook
     intltool
@@ -38,6 +53,7 @@ buildPythonApplication rec {
 
   nativeCheckInputs = [
     glibcLocales
+    pythonPackages.unittestCheckHook
     pythonPackages.jsonschema
     pythonPackages.mock
     pythonPackages.lxml
@@ -52,55 +68,25 @@ buildPythonApplication rec {
     ++ lib.optional enableGhostscript ghostscript
   ;
 
-  src = fetchFromGitHub {
-    owner = "gramps-project";
-    repo = "gramps";
-    rev = "v${version}";
-    hash = "sha256-BerkDXdFYfZ3rV5AeMo/uk53IN2U5z4GFs757Ar26v0=";
-  };
-
-  pythonPath = with pythonPackages; [
+  propagatedBuildInputs = with pythonPackages; [
     bsddb3
     pyicu
     pygobject3
     pycairo
   ];
 
-  patches = [
-    # fix for running tests with a temporary home - remove next release
-    # https://gramps-project.org/bugs/view.php?id=12577
-    (fetchpatch {
-      url = "https://github.com/gramps-project/gramps/commit/1e95d8a6b5193d655d8caec1e6ab13628ad123db.patch";
-      hash = "sha256-2riWB13Yl+tk9+Tuo0YDLoxY2Rc0xrJKfb+ZU7Puzxk=";
-    })
-  ];
-
-  # Same installPhase as in buildPythonApplication but without --old-and-unmanageble
-  # install flag.
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p "$out/${python.sitePackages}"
-
-    export PYTHONPATH="$out/${python.sitePackages}:$PYTHONPATH"
-
-    ${python}/bin/${python.executable} setup.py install \
-      --install-lib=$out/${python.sitePackages} \
-      --prefix="$out"
-
-    eapth="$out/${python.sitePackages}/easy-install.pth"
-    if [ -e "$eapth" ]; then
-        # move colliding easy_install.pth to specifically named one
-        mv "$eapth" $(dirname "$eapth")/${pname}-${version}.pth
-    fi
-
-    rm -f "$out/${python.sitePackages}"/site.py*
-
-    runHook postInstall
-  '';
 
   preCheck = ''
-    export HOME=$TMPDIR
+    export HOME=$(mktemp -d)
+    mkdir .git # Make gramps think that it's not in an installed state
+  '';
+
+  dontWrapGApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=(
+      "''${gappsWrapperArgs[@]}"
+    )
   '';
 
   # https://github.com/NixOS/nixpkgs/issues/149812
@@ -111,8 +97,8 @@ buildPythonApplication rec {
     description = "Genealogy software";
     mainProgram = "gramps";
     homepage = "https://gramps-project.org";
-    maintainers = with maintainers; [ jk pinpox ];
-    changelog = "https://github.com/gramps-project/gramps/blob/v${version}/ChangeLog";
+    maintainers = with maintainers; [ jk pinpox tomasajt ];
+    changelog = "https://github.com/gramps-project/gramps/blob/${src.rev}/ChangeLog";
     longDescription = ''
       Every person has their own story but they are also part of a collective
       family history. Gramps gives you the ability to record the many details of

pkgs/applications/misc/gramps/disable-gtk-warning-dialog.patch

@@ -0,0 +1,14 @@
+diff --git a/gramps/gui/grampsgui.py b/gramps/gui/grampsgui.py
+index 0c0d4c3..522f65a 100644
+--- a/gramps/gui/grampsgui.py
++++ b/gramps/gui/grampsgui.py
+@@ -573,9 +573,6 @@ class Gramps:
+         dbstate = DbState()
+         self._vm = ViewManager(app, dbstate, config.get("interface.view-categories"))
+ 
+-        if lin() and glocale.lang != "C" and not gettext.find(GTK_GETTEXT_DOMAIN):
+-            _display_gtk_gettext_message(parent=self._vm.window)
+-
+         _display_translator_message(parent=self._vm.window)
+ 
+         self._vm.init_interface()

pkgs/applications/misc/nwg-displays/default.nix

@@ -14,13 +14,13 @@
 
 python310Packages.buildPythonApplication rec {
   pname = "nwg-displays";
-  version = "0.3.14";
+  version = "0.3.16";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-displays";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jSL+ig1mNJrnHli8B+BqvEG8jcC0gnxzbukiYgt3nP0=";
+    hash = "sha256-rnaBYDGEsc8oGw4yZ60NQFbNf+L0tmHYDYf+UDoDmSI=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/cluster/civo/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "civo";
-  version = "1.0.76";
+  version = "1.0.77";
 
   src = fetchFromGitHub {
     owner  = "civo";
     repo   = "cli";
     rev    = "v${version}";
-    sha256 = "sha256-Bk0YfW9KDliaJIqpVxCXTy7EiGGJPZTXcn6SFEmywRE=";
+    sha256 = "sha256-W9CJAFLGarDG/Y8g2Whoh4v9hxqb8txuLfAkooW8PNM=";
   };
 
-  vendorHash = "sha256-22n+ks1D65Gk2acCMHxgj19VHDf4B23ivqHfo3J45j0=";
+  vendorHash = "sha256-Uh2/4qdJQfqQdjXbOBkUVv2nF1AN+QRKRI0+yta+G5Q=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/networking/cluster/glooctl/default.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.16.8";
+  version = "1.16.9";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-M8ZNDt+sO8ZtVM1PyISOsFwXrD6q9ACPG0T99bqwk1c=";
+    hash = "sha256-9zGtMfVZL+VIpEw2D5n4LzyTYNLCJFKf7Q++QiUKPxA=";
   };
 
   vendorHash = "sha256-UyzqKpF2WBj25Bm4MtkF6yjl87A61vGsteBNCjJV178=";

pkgs/applications/networking/cluster/vcluster/default.nix

@@ -2,27 +2,27 @@
 
 buildGoModule rec {
   pname = "vcluster";
-  version = "0.19.4";
+  version = "0.19.5";
 
   src = fetchFromGitHub {
     owner = "loft-sh";
     repo = "vcluster";
     rev = "v${version}";
-    hash = "sha256-fzHaB+EeS8Gr1EVlxAZzKDYgv3Jij4LwmYaXN4tjYBg=";
+    hash = "sha256-V+Y2LekBYlKZU53BsYCW6ADSMJOxkwSK9hbFGXBaa9o=";
   };
 
   vendorHash = null;
 
   subPackages = [ "cmd/vclusterctl" ];
 
-  nativeBuildInputs = [ installShellFiles ];
-
   ldflags = [
     "-s" "-w"
     "-X main.version=${version}"
     "-X main.goVersion=${lib.getVersion go}"
   ];
 
+  nativeBuildInputs = [ installShellFiles ];
+
   # Test is disabled because e2e tests expect k8s.
   doCheck = false;
 
@@ -48,10 +48,10 @@ buildGoModule rec {
   meta = {
     changelog = "https://github.com/loft-sh/vcluster/releases/tag/v${version}";
     description = "Create fully functional virtual Kubernetes clusters";
-    mainProgram = "vcluster";
     downloadPage = "https://github.com/loft-sh/vcluster";
     homepage = "https://www.vcluster.com/";
     license = lib.licenses.asl20;
+    mainProgram = "vcluster";
     maintainers = with lib.maintainers; [ berryp peterromfeldhk qjoly superherointj ];
   };
 }

pkgs/applications/networking/instant-messengers/beeper/default.nix

@@ -11,11 +11,11 @@
 }:
 let
   pname = "beeper";
-  version = "3.100.26";
+  version = "3.101.24";
   name = "${pname}-${version}";
   src = fetchurl {
-    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.100.26-build-240314pjsp57xom-x86_64.AppImage";
-    hash = "sha256-KYjB7ZfjoVf6UoXQvmtAqtD23JNQGqboNzXekAiJF7k=";
+    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.101.24-build-240322frr3t3orv-x86_64.AppImage";
+    hash = "sha256-yfkWvPYQhI8cfXfmmyi2LoSro1jxJRWy9phycv5TUL8=";
   };
   appimage = appimageTools.wrapType2 {
     inherit version pname src;

pkgs/applications/networking/irc/thelounge/default.nix

@@ -4,7 +4,7 @@
 , fetchYarnDeps
 , nodejs
 , yarn
-, fixup_yarn_lock
+, prefetch-yarn-deps
 , python3
 , npmHooks
 , darwin
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-MM6SgVT7Pjdu96A4eWRucEzT7uNPxBqUDgHKl8mH2C0=";
   };
 
-  nativeBuildInputs = [ nodejs yarn fixup_yarn_lock python3 npmHooks.npmInstallHook ] ++ lib.optional stdenv.isDarwin darwin.cctools;
+  nativeBuildInputs = [ nodejs yarn prefetch-yarn-deps python3 npmHooks.npmInstallHook ] ++ lib.optional stdenv.isDarwin darwin.cctools;
   buildInputs = [ sqlite ];
 
   configurePhase = ''
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     export HOME="$PWD"
 
-    fixup_yarn_lock yarn.lock
+    fixup-yarn-lock yarn.lock
     yarn config --offline set yarn-offline-mirror ${finalAttrs.offlineCache}
     yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
     patchShebangs node_modules

pkgs/applications/networking/onionshare/default.nix

@@ -29,12 +29,12 @@
 }:
 
 let
-  version = "2.6.1";
+  version = "2.6.2";
   src = fetchFromGitHub {
     owner = "onionshare";
     repo = "onionshare";
     rev = "v${version}";
-    sha256 = "sha256-LR3Ao4Q8kEDwrFV+gYdMSEeYF4hDtEa1rJgvRRrJMwc=";
+    hash = "sha256-J8Hdriy8eWpHuMCI87a9a/zCR6xafM3A/Tkyom0Ktko=";
   };
   meta = with lib; {
     description = "Securely and anonymously send and receive files";

pkgs/applications/networking/trayscale/default.nix

@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "trayscale";
-  version = "0.10.4";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "DeedleFake";
     repo = "trayscale";
     rev = "v${version}";
-    hash = "sha256-/31QKCyMeEdpP59B+iXS5hL9W5sWz7R/I2nxBtj+0s4=";
+    hash = "sha256-qSrt94hEJosdvs2N6rbcJLpjqvMPkY20dIKV3jtjFlg=";
   };
 
-  vendorHash = "sha256-xYBiO6Zm32Do19I/cm4T6fubXY++Bhkn+RNAmKzM5cY=";
+  vendorHash = "sha256-eIakjEYfVp2wfXu0oqBmd5hJZTp0xgYKNNbtpRBnT2w=";
 
   subPackages = [ "cmd/trayscale" ];
 

pkgs/applications/radio/qlog/default.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qlog";
-  version = "0.33.1";
+  version = "0.34.0";
 
   src = fetchFromGitHub {
     owner = "foldynl";
     repo = "QLog";
     rev = "v${version}";
-    hash = "sha256-stPzkCLcjzQT0n1NRGT7YN625RPYhJ9FuMkjtFZwtbA=";
+    hash = "sha256-zPIGqVfpd7Gkm3Ify+AwiCSWQ67ybv9BmuolSu9WzHM=";
     fetchSubmodules = true;
   };
 

pkgs/applications/terminal-emulators/alacritty/default.nix

@@ -49,16 +49,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "alacritty";
-  version = "0.13.1";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "alacritty";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Nn/G7SkRuHXRSRgNjlmdX1G07sp7FPx8UyAn63Nivfg=";
+    hash = "sha256-MrlzAZWLgfwIoTdxY+fjWbrv7tygAjnxXebiEgwOM9A=";
   };
 
-  cargoHash = "sha256-vCoKaDd0mQRF6NNfK679FhEXuAdn/1o3F1gTfT8NK+0=";
+  cargoHash = "sha256-7HPTELRlmyjj7CXNbgqrzxW548BgbxybWi+tT3rOCX0=";
 
   nativeBuildInputs = [
     cmake

pkgs/applications/video/handbrake/default.nix

@@ -26,7 +26,7 @@
 , numactl
 , writeText
   # Processing, video codecs, containers
-, ffmpeg_5-full
+, ffmpeg-full
 , nv-codec-headers
 , libogg
 , x264
@@ -69,6 +69,10 @@
   # for now we disable GTK GUI support on Darwin. (It may be possible to remove
   # this restriction later.)
 , useGtk ? !stdenv.isDarwin
+, bzip2
+, desktop-file-utils
+, meson
+, ninja
 , wrapGAppsHook
 , intltool
 , glib
@@ -86,64 +90,70 @@
 }:
 
 let
-  version = "1.6.1";
+  version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "HandBrake";
     repo = "HandBrake";
     rev = version;
-    sha256 = "sha256-0MJ1inMNA6s8l2S0wnpM2c7FxOoOHxs9u4E/rgKfjJo=";
+    hash = "sha256-4Q//UU/CPgWvhtpROfNPLzBvZlB02hbFe9Z9FA7mX04=";
   };
 
   # Handbrake maintains a set of ffmpeg patches. In particular, these
   # patches are required for subtitle timing to work correctly. See:
   # https://github.com/HandBrake/HandBrake/issues/4029
-  ffmpeg-version = "5.1.2";
-  ffmpeg-hb = ffmpeg_5-full.overrideAttrs (old: {
+  # base ffmpeg version is specified in:
+  # https://github.com/HandBrake/HandBrake/blob/master/contrib/ffmpeg/module.defs
+  ffmpeg-version = "6.1";
+  ffmpeg-hb = ffmpeg-full.overrideAttrs (old: {
     version = ffmpeg-version;
     src = fetchurl {
       url = "https://www.ffmpeg.org/releases/ffmpeg-${ffmpeg-version}.tar.bz2";
-      hash = "sha256-OaC8yNmFSfFsVwYkZ4JGpqxzbAZs69tAn5UC6RWyLys=";
+      hash = "sha256-632j3n3TzkiplGq0R6c0a9EaOoXm77jyws5jfn9UdhE=";
     };
-    patches = old.patches or [ ] ++ [
-      "${src}/contrib/ffmpeg/A01-qsv-libavfilter-qsvvpp-change-the-output-frame-s-width-a.patch"
-      "${src}/contrib/ffmpeg/A02-qsv-configure-ensure-enable-libmfx-uses-libmfx-1.x.patch"
-      "${src}/contrib/ffmpeg/A03-qsv-configure-fix-the-check-for-MFX_CODEC_VP9.patch"
-      "${src}/contrib/ffmpeg/A04-qsv-remove-mfx-prefix-from-mfx-headers.patch"
-      "${src}/contrib/ffmpeg/A05-qsv-load-user-plugin-for-MFX_VERSION-2.0.patch"
-      "${src}/contrib/ffmpeg/A06-qsv-build-audio-related-code-when-MFX_VERSION-2.0.patch"
-      "${src}/contrib/ffmpeg/A07-qsvenc-support-multi-frame-encode-when-MFX_VERSION-2.patch"
-      "${src}/contrib/ffmpeg/A08-qsvenc-support-MFX_RATECONTROL_LA_EXT-when-MFX_VERSI.patch"
-      "${src}/contrib/ffmpeg/A09-qsv-support-OPAQUE-memory-when-MFX_VERSION-2.0.patch"
-      "${src}/contrib/ffmpeg/A10-qsv-configure-add-enable-libvpl-option.patch"
-      "${src}/contrib/ffmpeg/A11-qsv-use-a-new-method-to-create-mfx-session-when-usin.patch"
-      "${src}/contrib/ffmpeg/A12-qsv-fix-decode-10bit-hdr.patch"
-      "${src}/contrib/ffmpeg/A13-mov-read-name-track-tag-written-by-movenc.patch"
-      "${src}/contrib/ffmpeg/A14-movenc-write-3gpp-track-titl-tag.patch"
-      "${src}/contrib/ffmpeg/A15-mov-read-3gpp-udta-tags.patch"
-      "${src}/contrib/ffmpeg/A16-movenc-write-3gpp-track-names-tags-for-all-available.patch"
-      "${src}/contrib/ffmpeg/A17-FFmpeg-devel-amfenc-Add-support-for-pict_type-field.patch"
-      "${src}/contrib/ffmpeg/A18-dvdsubdec-fix-processing-of-partial-packets.patch"
-      "${src}/contrib/ffmpeg/A19-ccaption_dec-return-number-of-bytes-used.patch"
-      "${src}/contrib/ffmpeg/A20-dvdsubdec-return-number-of-bytes-used.patch"
-      "${src}/contrib/ffmpeg/A21-dvdsubdec-use-pts-of-initial-packet.patch"
-      "${src}/contrib/ffmpeg/A22-matroskaenc-aac-extradata-updated.patch"
-      "${src}/contrib/ffmpeg/A23-ccaption_dec-fix-pts-in-real_time-mode.patch"
-      "${src}/contrib/ffmpeg/A24-fix-eac3-dowmix.patch"
-      "${src}/contrib/ffmpeg/A25-enable-truehd-pass.patch"
-      "${src}/contrib/ffmpeg/A26-Update-the-min-version-to-1.4.23.0-for-AMF-SDK.patch"
-      "${src}/contrib/ffmpeg/A27-avcodec-amfenc-Fixes-the-color-information-in-the-ou.patch"
-      "${src}/contrib/ffmpeg/A28-avcodec-amfenc-HDR-metadata.patch"
-      # This patch is not applying since ffmpeg 5.1.1, probably it was backported by upstream
-      # "${src}/contrib/ffmpeg/A30-svt-av1-backports.patch"
-      (fetchpatch {
-        name = "vulkan-remove-extensions.patch";
-        url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff_plain/eb0455d64690";
-        hash = "sha256-qvLrb7b+9/bel8A2lZuSmBiJtHXsABw0Lvgn1ggnmCU=";
-      })
+    patches = (old.patches or [ ]) ++ [
+      "${src}/contrib/ffmpeg/A01-mov-read-name-track-tag-written-by-movenc.patch"
+      "${src}/contrib/ffmpeg/A02-movenc-write-3gpp-track-titl-tag.patch"
+      "${src}/contrib/ffmpeg/A03-mov-read-3gpp-udta-tags.patch"
+      "${src}/contrib/ffmpeg/A04-movenc-write-3gpp-track-names-tags-for-all-available.patch"
+      "${src}/contrib/ffmpeg/A05-dvdsubdec-fix-processing-of-partial-packets.patch"
+      "${src}/contrib/ffmpeg/A06-dvdsubdec-return-number-of-bytes-used.patch"
+      "${src}/contrib/ffmpeg/A07-dvdsubdec-use-pts-of-initial-packet.patch"
+      "${src}/contrib/ffmpeg/A08-ccaption_dec-fix-pts-in-real_time-mode.patch"
+      "${src}/contrib/ffmpeg/A09-matroskaenc-aac-extradata-updated.patch"
+      "${src}/contrib/ffmpeg/A10-amfenc-Add-support-for-pict_type-field.patch"
+      "${src}/contrib/ffmpeg/A11-amfenc-Fixes-the-color-information-in-the-ou.patch"
+      "${src}/contrib/ffmpeg/A12-amfenc-HDR-metadata.patch"
+      "${src}/contrib/ffmpeg/A13-libavcodec-amfenc-Fix-issue-with-missing-headers-in-.patch"
+      "${src}/contrib/ffmpeg/A14-avcodec-add-ambient-viewing-environment-packet-side-.patch"
+      "${src}/contrib/ffmpeg/A15-avformat-mov-add-support-for-amve-ambient-viewing-en.patch"
+      "${src}/contrib/ffmpeg/A16-videotoolbox-dec-h264.patch"
+
+      # patch to fix <https://github.com/HandBrake/HandBrake/issues/5011>
+      # commented out because it causes ffmpeg's filter-pixdesc-p010le test to fail.
+      # "${src}/contrib/ffmpeg/A17-libswscale-fix-yuv420p-to-p01xle-color-conversion-bu.patch"
+
+      "${src}/contrib/ffmpeg/A18-qsv-fix-decode-10bit-hdr.patch"
+      "${src}/contrib/ffmpeg/A19-ffbuild-common-use-gzip-n-flag-for-cuda.patch"
     ];
   });
 
+  x265-hb = x265.overrideAttrs (old: {
+    # nixpkgs' x265 sourceRoot is x265-.../source whereas handbrake's x265 patches
+    # are written with respect to the parent directory instead of that source directory.
+    # patches which don't cleanly apply are commented out.
+    postPatch = (old.postPatch or "") + ''
+      pushd ..
+      # patch -p1 < ${src}/contrib/x265/A00-crosscompile-fix.patch
+      patch -p1 < ${src}/contrib/x265/A01-threads-priority.patch
+      patch -p1 < ${src}/contrib/x265/A02-threads-pool-adjustments.patch
+      patch -p1 < ${src}/contrib/x265/A03-sei-length-crash-fix.patch
+      patch -p1 < ${src}/contrib/x265/A04-ambient-viewing-enviroment-sei.patch
+      # patch -p1 < ${src}/contrib/x265/A05-memory-leaks.patch
+      popd
+    '';
+  });
+
   versionFile = writeText "version.txt" ''
     BRANCH=${versions.majorMinor version}.x
     DATE=1970-01-01 00:00:01 +0000
@@ -189,6 +199,17 @@ let
       # Use the Nix-provided libxml2 instead of the system-provided one.
       substituteInPlace libhb/module.defs \
         --replace /usr/include/libxml2 ${libxml2.dev}/include/libxml2
+    '' + optionalString useGtk ''
+      substituteInPlace gtk/module.rules \
+        --replace-fail '$(MESON.exe)' 'meson' \
+        --replace-fail '$(NINJA.exe)' 'ninja' \
+      # Force using nixpkgs dependencies
+      substituteInPlace gtk/meson.build \
+        --replace-fail "cc.find_library('bz2', dirs: hb_libdirs)" "cc.find_library('bz2')" \
+        --replace-fail "cc.find_library('mp3lame', dirs: hb_libdirs)" "cc.find_library('mp3lame')" \
+        --replace-fail \
+          "hb_incdirs = include_directories(hb_dir / 'libhb', hb_dir / 'contrib/include')" \
+          "hb_incdirs = include_directories(hb_dir / 'libhb')" \
     '';
 
     nativeBuildInputs = [
@@ -199,7 +220,7 @@ let
       pkg-config
       python3
     ]
-    ++ optionals useGtk [ intltool wrapGAppsHook ];
+    ++ optionals useGtk [ desktop-file-utils intltool meson ninja wrapGAppsHook ];
 
     buildInputs = [
       a52dec
@@ -228,12 +249,13 @@ let
       speex
       svt-av1
       x264
-      x265
+      x265-hb
       xz
       zimg
     ]
     ++ optional (!stdenv.isDarwin) numactl
     ++ optionals useGtk [
+      bzip2
       dbus-glib
       glib
       gst_all_1.gst-plugins-base
@@ -254,7 +276,6 @@ let
     configureFlags = [
       "--disable-df-fetch"
       "--disable-df-verify"
-      "--disable-gtk-update-checks"
     ]
     ++ optional (!useGtk) "--disable-gtk"
     ++ optional useFdk "--enable-fdk-aac"
@@ -264,10 +285,19 @@ let
     # NOTE: 2018-12-27: Check NixOS HandBrake test if changing
     NIX_LDFLAGS = [ "-lx265" ];
 
+    # meson/ninja are used only for the subprojects, not the toplevel
+    dontUseMesonConfigure = true;
+    dontUseMesonInstall = true;
+    dontUseNinjaBuild = true;
+    dontUseNinjaInstall = true;
+
     makeFlags = [ "--directory=build" ];
 
-    passthru.tests = {
-      basic-conversion =
+    passthru = {
+      # for convenience
+      inherit ffmpeg-hb x265-hb;
+
+      tests.basic-conversion =
         let
           # Big Buck Bunny example, licensed under CC Attribution 3.0.
           testMkv = fetchurl {
@@ -283,7 +313,8 @@ let
           HandBrakeCLI -i ${testMkv} -o test.mkv -e x264 -q 20 -B 160
           test -e test.mkv
         '';
-      version = testers.testVersion { package = self; command = "HandBrakeCLI --version"; };
+
+      tests.version = testers.testVersion { package = self; command = "HandBrakeCLI --version"; };
     };
 
     meta = with lib; {
@@ -300,7 +331,7 @@ let
       license = licenses.gpl2Only;
       maintainers = with maintainers; [ Anton-Latukha wmertens ];
       platforms = with platforms; unix;
-      broken = stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "10.13";
+      broken = stdenv.isDarwin;  # https://github.com/NixOS/nixpkgs/pull/297984#issuecomment-2016503434
     };
   };
 in

pkgs/applications/video/kodi/addons/trakt/default.nix

@@ -2,11 +2,11 @@
 buildKodiAddon rec {
   pname = "trakt";
   namespace = "script.trakt";
-  version = "3.5.0";
+  version = "3.6.1";
 
   src = fetchzip {
     url = "https://mirrors.kodi.tv/addons/nexus/${namespace}/${namespace}-${version}.zip";
-    sha256 = "sha256-OyU6S5r/y3vqW6Wg6OP0+Zn4YchBy8x1i++hzCQHyx0=";
+    sha256 = "sha256-ZlBucYYRA1cL5c0H1jhXeKE1itReZe2gAJYFFxuUebo=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/obs-studio/plugins/obs-source-clone.nix

@@ -5,22 +5,22 @@
 , obs-studio
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "obs-source-clone";
-  version = "0.1.4";
+  version = "0.1.4-unstable-2024-02-19";
 
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-source-clone";
-    rev = version;
-    sha256 = "sha256-E2pHJO3cdOXmSlTVGsz4tncm9fMaa8Rhsq9YZDNidjs=";
+    rev = "d1524d5d932d6841a1fbd6061cc4a0033fb615b7";
+    hash = "sha256-W9IIIGQdreI2FQGii5NUB5tVHcqsiYAKTutOHEPCyms=";
   };
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ obs-studio ];
 
   cmakeFlags = [
-    "-DBUILD_OUT_OF_TREE=On"
+    (lib.cmakeBool "BUILD_OUT_OF_TREE" true)
   ];
 
   postInstall = ''
@@ -32,6 +32,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/exeldro/obs-source-clone";
     maintainers = with maintainers; [ flexiondotorg ];
     license = licenses.gpl2Plus;
-    platforms = [ "x86_64-linux" "i686-linux" ];
+    platforms = platforms.linux;
   };
 }

pkgs/applications/virtualization/virtualbox/default.nix

@@ -116,11 +116,11 @@ in stdenv.mkDerivation {
      # we don't take any chances and only apply it if people actually want to use KVM support.
   ++ optional enableKvm (fetchpatch
     (let
-      patchVersion = "20240226";
+      patchVersion = "20240325";
     in {
       name = "virtualbox-${version}-kvm-dev-${patchVersion}.patch";
-      url = "https://github.com/cyberus-technology/virtualbox-kvm/releases/download/dev-${patchVersion}/virtualbox-${version}-kvm-dev-${patchVersion}.patch";
-      hash = "sha256-3YT1ZN/TwoNWNb2eqOcPF8GTrVGfOPaPb8vpGoPNISY=";
+      url = "https://github.com/cyberus-technology/virtualbox-kvm/releases/download/dev-${patchVersion}/kvm-backend-${version}-dev-${patchVersion}.patch";
+      hash = "sha256-D1ua8X5Iyw/I89PtskiGdnGr4NhdFtI93ThltiOcu8w=";
     }))
   ++ [
     ./qt-dependency-paths.patch
@@ -281,7 +281,7 @@ in stdenv.mkDerivation {
     ];
     license = licenses.gpl2;
     homepage = "https://www.virtualbox.org/";
-    maintainers = with maintainers; [ sander friedrichaltheide ];
+    maintainers = with maintainers; [ sander friedrichaltheide blitz ];
     platforms = [ "x86_64-linux" ];
     mainProgram = "VirtualBox";
   };

pkgs/build-support/build-fhsenv-bubblewrap/default.nix

@@ -133,6 +133,8 @@ let
     ro_mounts=()
     symlinks=()
     etc_ignored=()
+
+    # loop through all entries of root in the fhs environment, except its /etc.
     for i in ${fhsenv}/*; do
       path="/''${i##*/}"
       if [[ $path == '/etc' ]]; then
@@ -146,6 +148,7 @@ let
       fi
     done
 
+    # loop through the entries of /etc in the fhs environment.
     if [[ -d ${fhsenv}/etc ]]; then
       for i in ${fhsenv}/etc/*; do
         path="/''${i##*/}"
@@ -154,7 +157,11 @@ let
         if [[ $path == '/fonts' || $path == '/ssl' ]]; then
           continue
         fi
-        ro_mounts+=(--ro-bind "$i" "/etc$path")
+        if [[ -L $i ]]; then
+          symlinks+=(--symlink "$i" "/etc$path")
+        else
+          ro_mounts+=(--ro-bind "$i" "/etc$path")
+        fi
         etc_ignored+=("/etc$path")
       done
     fi
@@ -166,6 +173,7 @@ let
       ro_mounts+=(--ro-bind /etc /.host-etc)
     fi
 
+    # link selected etc entries from the actual root
     for i in ${escapeShellArgs etcBindEntries}; do
       if [[ "''${etc_ignored[@]}" =~ "$i" ]]; then
         continue

pkgs/by-name/af/affine/package.nix

@@ -0,0 +1,68 @@
+{ lib
+, writeText
+, fetchurl
+, stdenvNoCC
+, copyDesktopItems
+, makeDesktopItem
+, makeWrapper
+, unzip
+, bash
+, electron
+, commandLineArgs ? ""
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: let
+  icon = fetchurl {
+    url = "https://raw.githubusercontent.com/toeverything/AFFiNE/v${finalAttrs.version}/packages/frontend/core/public/favicon-192.png";
+    hash = "sha256-smZ5W7fy3TK3bvjwV4i71j2lVmKSZcyhMhcWfPxNnN4=";
+  };
+in {
+  pname = "affine";
+  version = "0.13.1";
+  src = fetchurl {
+    url = "https://github.com/toeverything/AFFiNE/releases/download/v${finalAttrs.version}/affine-${finalAttrs.version}-stable-linux-x64.zip";
+    hash = "sha256-2Du5g/I82iTr8Bwb+qkLzyfbk1OrOlXqx6FHImVoAoE=";
+  };
+  nativeBuildInputs = [
+    copyDesktopItems
+    makeWrapper
+    unzip
+  ];
+  postInstall = ''
+    mkdir -p $out/lib
+    cp -r ./resources/* -t $out/lib/
+    cp LICENSE* $out/
+    install -Dm644 ${icon} $out/share/pixmaps/affine.png
+    makeWrapper "${electron}/bin/electron" $out/bin/affine \
+      --inherit-argv0 \
+      --add-flags $out/lib/app.asar \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --add-flags ${lib.escapeShellArg commandLineArgs}
+  '';
+  desktopItems = [
+    (makeDesktopItem {
+      name = "affine";
+      desktopName = "AFFiNE";
+      exec = "affine %U";
+      terminal = false;
+      icon = "affine";
+      startupWMClass = "affine";
+      categories = ["Utility"];
+    })
+  ];
+  meta = with lib; {
+    description = "A workspace with fully merged docs, whiteboards and databases";
+    longDescription = ''
+      AFFiNE is an open-source, all-in-one workspace and an operating
+      system for all the building blocks that assemble your knowledge
+      base and much more -- wiki, knowledge management, presentation
+      and digital assets
+    '';
+    homepage = "https://affine.pro/";
+    downloadPage = "https://affine.pro/download";
+    license = licenses.mit;
+    maintainers = with maintainers; [richar];
+    mainProgram = "affine";
+    platforms = ["x86_64-linux"];
+  };
+})

pkgs/by-name/ba/backgroundremover/package.nix

@@ -0,0 +1,92 @@
+{ python3
+, lib
+, runCommand
+, fetchFromGitHub
+, fetchurl
+}:
+
+let
+  p = python3.pkgs;
+  self = p.buildPythonApplication rec {
+    pname = "backgroundremover";
+    version = "0.2.6";
+    pyproject = true;
+
+    src = fetchFromGitHub {
+      owner = "nadermx";
+      repo = "backgroundremover";
+      rev = "v${version}";
+      hash = "sha256-dDOo7NPwvdfV+ae2oMUytCGC+2HF6xUI7dyKk2we23w=";
+    };
+
+    models = runCommand "background-remover-models" {} ''
+      mkdir $out
+      cat ${src}/models/u2a{a,b,c,d} > $out/u2net.pth
+      cat ${src}/models/u2ha{a,b,c,d} > $out/u2net_human_seg.pth
+      cp ${src}/models/u2netp.pth $out
+    '';
+
+    postPatch = ''
+      substituteInPlace backgroundremover/bg.py backgroundremover/u2net/detect.py \
+        --replace 'os.path.expanduser(os.path.join("~", ".u2net", model_name + ".pth"))' "os.path.join(\"$models\", model_name + \".pth\")"
+    '';
+
+    nativeBuildInputs = [ p.setuptools p.wheel ];
+
+    propagatedBuildInputs = [
+      p.certifi
+      p.charset-normalizer
+      p.ffmpeg-python
+      p.filelock
+      p.filetype
+      p.hsh
+      p.idna
+      p.more-itertools
+      p.moviepy
+      p.numpy
+      p.pillow
+      p.pymatting
+      p.pysocks
+      p.requests
+      p.scikit-image
+      p.scipy
+      p.six
+      p.torch
+      p.torchvision
+      p.tqdm
+      p.urllib3
+      p.waitress
+    ];
+
+    pythonImportsCheck = [ "backgroundremover" ];
+
+    passthru = {
+      inherit models;
+      tests = {
+        image = let
+          # random no copyright car image from the internet
+          demoImage = fetchurl {
+            url = "https://pics.craiyon.com/2023-07-16/38653769ac3b4e068181cb5ab1e542a1.webp";
+            hash = "sha256-Kvd06eZdibgDbabVVe0+cNTeS1rDnMXIZZpPlHIlfBo=";
+          };
+        in runCommand "backgroundremover-image-test.png" {
+          buildInputs = [ self ];
+        } ''
+          export NUMBA_CACHE_DIR=$(mktemp -d)
+          backgroundremover -i ${demoImage} -o $out
+        '';
+      };
+    };
+
+    doCheck = false; # no tests
+
+    meta = with lib; {
+      mainProgram = "backgroundremover";
+      description = "Command line tool to remove background from image and video, made by nadermx to power";
+      homepage = "https://BackgroundRemoverAI.com";
+      downloadPage = "https://github.com/nadermx/backgroundremover/releases";
+      license = licenses.mit;
+      maintainers = [ maintainers.lucasew ];
+    };
+  };
+in self

pkgs/by-name/ba/backgroundremover/test-script.py

@@ -0,0 +1,20 @@
+from argparse import ArgumentParser
+from pathlib import Path
+
+import backgroundremover.utilities as utilities
+from backgroundremover import bg
+
+parser = ArgumentParser()
+
+parser.add_argument('input', type=Path)
+parser.add_argument('output', type=Path)
+
+args = parser.parse_args()
+
+input_bytes = args.input.read_bytes()
+
+output_bytes = bg.remove(
+  input_bytes,
+)
+
+args.output.write_bytes(output_bytes)

pkgs/by-name/bi/bibata-cursors/package.nix

@@ -0,0 +1,58 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, fetchzip
+, clickgen
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "bibata-cursors";
+  version = "2.0.6";
+
+  src = fetchFromGitHub {
+    owner = "ful1e5";
+    repo = "Bibata_Cursor";
+    rev = "v${version}";
+    hash = "sha256-iLBgQ0reg8HzUQMUcZboMYJxqpKXks5vJVZMHirK48k=";
+  };
+
+  bitmaps = fetchzip {
+    url = "https://github.com/ful1e5/Bibata_Cursor/releases/download/v${version}/bitmaps.zip";
+    hash = "sha256-8ujkyqby5sPcnscIPkay1gvd/1CH4R9yMJs1nH/mx8M=";
+  };
+
+  nativeBuildInputs = [
+    clickgen
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    ctgen build.toml -p x11 -d $bitmaps/Bibata-Modern-Amber -n 'Bibata-Modern-Amber' -c 'Yellowish and rounded edge bibata cursors.'
+    ctgen build.toml -p x11 -d $bitmaps/Bibata-Modern-Classic -n 'Bibata-Modern-Classic' -c 'Black and rounded edge Bibata cursors.'
+    ctgen build.toml -p x11 -d $bitmaps/Bibata-Modern-Ice -n 'Bibata-Modern-Ice' -c 'White and rounded edge Bibata cursors.'
+
+    ctgen build.toml -p x11 -d $bitmaps/Bibata-Original-Amber -n 'Bibata-Original-Amber' -c 'Yellowish and sharp edge Bibata cursors.'
+    ctgen build.toml -p x11 -d $bitmaps/Bibata-Original-Classic -n 'Bibata-Original-Classic' -c 'Black and sharp edge Bibata cursors.'
+    ctgen build.toml -p x11 -d $bitmaps/Bibata-Original-Ice -n 'Bibata-Original-Ice' -c 'White and sharp edge Bibata cursors.'
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -dm 0755 $out/share/icons
+    cp -rf themes/* $out/share/icons/
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Material Based Cursor Theme";
+    homepage = "https://github.com/ful1e5/Bibata_Cursor";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ rawkode AdsonCicilioti ];
+  };
+}

pkgs/by-name/br/bruno/package.nix

@@ -16,6 +16,7 @@
 , npm-lockfile-fix
 , overrideSDK
 , darwin
+, fetchpatch
 }:
 
 let
@@ -24,23 +25,31 @@ let
     buildNpmPackage.override {
       stdenv = if stdenv.isDarwin then overrideSDK stdenv "11.0" else stdenv;
     };
+  # update package-lock to fix build errors. this will be resolved in the
+  # next patch version of Bruno at which point the patch can be removed entirely.
+  # upstream PR: https://github.com/usebruno/bruno/pull/1894
+  brunoLockfilePatch_1_12_2 = fetchpatch {
+    url = "https://github.com/usebruno/bruno/pull/1894/commits/e3bab23446623315ee674283285a86e210778fe7.patch";
+    hash = "sha256-8rYBvgu9ZLXjb9AFyk4yMBVjcyFPmlNi66YEaQGQaKw=";
+  };
 in
 buildNpmPackage' rec {
   pname = "bruno";
-  version = "1.11.0";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "usebruno";
     repo = "bruno";
     rev = "v${version}";
-    hash = "sha256-Urskhzs00OEucoR17NDXNtnrcXk9h75E806Re0HvYyw=";
+    hash = "sha256-C/WeEloUGF0PEfeanm6lHe/MgpcF+g/ZY2tnqXFl9LA=";
 
     postFetch = ''
+      patch -d $out <${brunoLockfilePatch_1_12_2}
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json
     '';
   };
 
-  npmDepsHash = "sha256-48xzx7dTalceXzjFBHIkkUS83pqP/OQ0L2tnMESpHII=";
+  npmDepsHash = "sha256-Zt5cVB1S86iPYKOUj7FwyR97lwmnFz6sZ+S3Ms/b9+o=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   nativeBuildInputs = [

pkgs/by-name/de/devenv/package.nix

@@ -1,14 +1,18 @@
-{ stdenv
-, lib
-, openssl
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeWrapper
+, rustPlatform
+, testers
+
+, cachix
 , darwin
 , libgit2
-, makeWrapper
 , nix
+, openssl
 , pkg-config
-, rustPlatform
-, cachix
-, fetchFromGitHub
+
+, devenv  # required to run version test
 }:
 
 let
@@ -25,7 +29,7 @@ let
     doInstallCheck = false;
   });
 
-  version = "1.0.1";
+  version = "1.0.2";
 in rustPlatform.buildRustPackage {
   pname = "devenv";
   inherit version;
@@ -34,12 +38,10 @@ in rustPlatform.buildRustPackage {
     owner = "cachix";
     repo = "devenv";
     rev = "v${version}";
-    hash = "sha256-9LnGe0KWqXj18IV+A1panzXQuTamrH/QcasaqnuqiE0=";
+    hash = "sha256-JCxjmWr2+75KMPOoVybNZhy9zhhrg9BAKA8D+J6MNBc=";
   };
 
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-  };
+  cargoHash = "sha256-FGB8p9ClGokYDrV0b47PnjeSlOv7p+IgThNajve3yms=";
 
   nativeBuildInputs = [ makeWrapper pkg-config ];
 
@@ -51,6 +53,13 @@ in rustPlatform.buildRustPackage {
     wrapProgram $out/bin/devenv --set DEVENV_NIX ${devenv_nix} --prefix PATH ":" "$out/bin:${cachix}/bin"
   '';
 
+  passthru.tests = {
+    version = testers.testVersion {
+      package = devenv;
+      command = "export XDG_DATA_HOME=$PWD; devenv version";
+    };
+  };
+
   meta = {
     changelog = "https://github.com/cachix/devenv/releases/tag/v${version}";
     description = "Fast, Declarative, Reproducible, and Composable Developer Environments";

pkgs/by-name/di/disko/package.nix

@@ -9,12 +9,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   name = "disko";
-  version = "1.4.1";
+  version = "1.5.0";
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "disko";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-HeWFrRuHpnAiPmIr26OKl2g142HuGerwoO/XtW53pcI=";
+    hash = "sha256-5DUNQl9BSmLxgGLbF05G7hi/UTk9DyZq8AuEszhQA7Q=";
   };
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ bash ];

pkgs/by-name/ep/epub-thumbnailer/package.nix

@@ -0,0 +1,40 @@
+{ lib
+, python3
+, fetchFromGitHub
+, unstableGitUpdater
+}:
+
+python3.pkgs.buildPythonApplication {
+  pname = "epub-thumbnailer";
+  version = "0-unstable-2024-03-16";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "marianosimone";
+    repo = "epub-thumbnailer";
+    rev = "035c31e9269bcb30dcc20fed31b6dc54e9bfed63";
+    hash = "sha256-G/CeYmr+wgJidbavfvIuCbRLJGQzoxAnpo3t4YFJq0c=";
+  };
+
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pillow
+  ];
+
+  postInstall = ''
+    mv $out/bin/epub-thumbnailer.py $out/bin/epub-thumbnailer
+  '';
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = with lib; {
+    description = "Script to extract the cover of an epub book and create a thumbnail for it";
+    homepage = "https://github.com/marianosimone/epub-thumbnailer";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ GaetanLepage ];
+    mainProgram = "epub-thumbnailer";
+  };
+}

pkgs/by-name/fi/firefoxpwa/package.nix

@@ -0,0 +1,133 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, makeWrapper
+, pkg-config
+, installShellFiles
+, firefox-unwrapped
+, openssl
+, stdenv
+, udev
+, libva
+, mesa
+, libnotify
+, xorg
+, cups
+, pciutils
+, libcanberra-gtk3
+, extraLibs ? [ ]
+, nixosTests
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "firefoxpwa";
+  version = "2.11.1";
+
+  src = fetchFromGitHub {
+    owner = "filips123";
+    repo = "PWAsForFirefox";
+    rev = "v${version}";
+    hash = "sha256-ZD/bTziVmHtQVKejzj+fUXVazCm2PaulS2NZjTribSk=";
+  };
+
+  sourceRoot = "${src.name}/native";
+  buildFeatures = [ "immutable-runtime" ];
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "mime-0.4.0-a.0" = "sha256-LjM7LH6rL3moCKxVsA+RUL9lfnvY31IrqHa9pDIAZNE=";
+      "web_app_manifest-0.0.0" = "sha256-G+kRN8AEmAY1TxykhLmgoX8TG8y2lrv7SCRJlNy0QzA=";
+    };
+  };
+
+  preConfigure = ''
+    sed -i 's;version = "0.0.0";version = "${version}";' Cargo.toml
+    sed -zi 's;name = "firefoxpwa"\nversion = "0.0.0";name = "firefoxpwa"\nversion = "${version}";' Cargo.lock
+    sed -i $'s;DISTRIBUTION_VERSION = \'0.0.0\';DISTRIBUTION_VERSION = \'${version}\';' userchrome/profile/chrome/pwa/chrome.jsm
+  '';
+
+  nativeBuildInputs = [ makeWrapper pkg-config installShellFiles ];
+  buildInputs = [ openssl ];
+
+  FFPWA_EXECUTABLES = ""; # .desktop entries generated without any store path references
+  FFPWA_SYSDATA = "${placeholder "out"}/share/firefoxpwa";
+  completions = "target/${stdenv.targetPlatform.config}/release/completions";
+
+  gtk_modules = map (x: x + x.gtkModule) [ libcanberra-gtk3 ];
+  libs = let libs = lib.optionals stdenv.isLinux [ udev libva mesa libnotify xorg.libXScrnSaver cups pciutils ] ++ gtk_modules ++ extraLibs; in lib.makeLibraryPath libs + ":" + lib.makeSearchPathOutput "lib" "lib64" libs;
+
+  postInstall = ''
+    # Runtime
+    mkdir -p $out/share/firefoxpwa
+    cp -Lr ${firefox-unwrapped}/lib/firefox $out/share/firefoxpwa/runtime
+    chmod -R +w $out/share/firefoxpwa
+
+    # UserChrome
+    cp -r userchrome $out/share/firefoxpwa
+
+    # Runtime patching
+    FFPWA_USERDATA=$out/share/firefoxpwa $out/bin/firefoxpwa runtime patch
+
+    # Manifest
+    sed -i "s!/usr/libexec!$out/bin!" manifests/linux.json
+    install -Dm644 manifests/linux.json $out/lib/mozilla/native-messaging-hosts/firefoxpwa.json
+
+    installShellCompletion --cmd firefoxpwa \
+      --bash $completions/firefoxpwa.bash \
+      --fish $completions/firefoxpwa.fish \
+      --zsh $completions/_firefoxpwa
+
+    # AppStream Metadata
+    install -Dm644 packages/appstream/si.filips.FirefoxPWA.metainfo.xml $out/share/metainfo/si.filips.FirefoxPWA.metainfo.xml
+    install -Dm644 packages/appstream/si.filips.FirefoxPWA.svg $out/share/icons/hicolor/scalable/apps/si.filips.FirefoxPWA.svg
+
+    wrapProgram $out/bin/firefoxpwa \
+      --prefix FFPWA_SYSDATA : "$out/share/firefoxpwa" \
+      --prefix LD_LIBRARY_PATH : "$libs" \
+      --suffix-each GTK_PATH : "$gtk_modules"
+
+    wrapProgram $out/bin/firefoxpwa-connector \
+      --prefix FFPWA_SYSDATA : "$out/share/firefoxpwa" \
+      --prefix LD_LIBRARY_PATH : "$libs" \
+      --suffix-each GTK_PATH : "$gtk_modules"
+  '';
+
+  passthru.tests.firefoxpwa = nixosTests.firefoxpwa;
+
+  meta = with lib; {
+    description = "A tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)";
+    longDescription = ''
+      Progressive Web Apps (PWAs) are web apps that use web APIs and features along
+      with progressive enhancement strategy to bring a native app-like user experience
+      to cross-platform web applications. Although Firefox supports many of Progressive
+      Web App APIs, it does not support functionality to install them as a standalone
+      system app with an app-like experience.
+
+      This project creates a custom modified Firefox runtime to allow websites to be
+      installed as standalone apps and provides a console tool and browser extension
+      to install, manage and use them.
+
+      This package contains only the native part of the PWAsForFirefox project. You
+      should also install the browser extension if you haven't already. You can download
+      it from the [Firefox Add-ons](https://addons.mozilla.org/firefox/addon/pwas-for-firefox/)
+      website.
+
+      To install the package on NixOS, you need to add the following options:
+
+      ```
+      programs.firefox.nativeMessagingHosts.packages = [ pkgs.firefoxpwa ];
+      environment.systemPackages = [ pkgs.firefoxpwa ];
+      ```
+
+      As it needs to be both in the `PATH` and in the `nativeMessagingHosts` to make it
+      possible for the extension to detect and use it.
+    '';
+    homepage = "https://pwasforfirefox.filips.si/";
+    changelog = "https://github.com/filips123/PWAsForFirefox/releases/tag/v${version}";
+    license = licenses.mpl20;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ camillemndn pasqui23 ];
+    mainProgram = "firefoxpwa";
+  };
+}

pkgs/by-name/fo/forbidden/package.nix

@@ -0,0 +1,51 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "forbidden";
+  version = "10.8";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ivan-sincek";
+    repo = "forbidden";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-jitmgN+We6m5CTgRc1NYwZkg5GYvD6ZlJ8FKtTa+rAY=";
+  };
+
+  pythonRemoveDeps = [
+    # https://github.com/ivan-sincek/forbidden/pull/3
+    "argparse"
+  ];
+
+  build-system = with python3.pkgs; [
+    pythonRelaxDepsHook
+    setuptools
+  ];
+
+  dependencies = with python3.pkgs; [
+    colorama
+    datetime
+    pycurl
+    pyjwt
+    regex
+    requests
+    tabulate
+    termcolor
+  ];
+
+  pythonImportsCheck = [
+    "forbidden"
+  ];
+
+  meta = with lib; {
+    description = "Tool to bypass 4xx HTTP response status code";
+    homepage = "https://github.com/ivan-sincek/forbidden";
+    changelog = "https://github.com/ivan-sincek/forbidden/releases/tag/v${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "forbidden";
+  };
+}

pkgs/by-name/fr/frankenphp/package.nix

@@ -26,13 +26,13 @@ let
   pieBuild = stdenv.hostPlatform.isMusl;
 in buildGoModule rec {
   pname = "frankenphp";
-  version = "1.1.0";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "dunglas";
     repo = "frankenphp";
     rev = "v${version}";
-    hash = "sha256-tQ35GZuw7Ag1YfmOUarVY45yk4yugNLJetEV4m2w3GE=";
+    hash = "sha256-r6BMlcjvRbVnBHsfRhJyMiyZzH2Z+FLOYz6ik4I8p+A=";
   };
 
   sourceRoot = "${src.name}/caddy";
@@ -40,7 +40,7 @@ in buildGoModule rec {
   # frankenphp requires C code that would be removed with `go mod tidy`
   # https://github.com/golang/go/issues/26366
   proxyVendor = true;
-  vendorHash = "sha256-sv3IcNj1rjolgF0HZZnJ3dLV9+QeRw3ItRguz6Un9CY=";
+  vendorHash = "sha256-gxBD2KPkWtAM0MsaQ9Ed4QDjJCg1uJQpXvnCOnAsZTw=";
 
   buildInputs = [ phpUnwrapped brotli ] ++ phpUnwrapped.buildInputs;
   nativeBuildInputs = [ makeBinaryWrapper ] ++ lib.optionals stdenv.isDarwin [ pkg-config darwin.cctools darwin.autoSignDarwinBinariesHook ];

pkgs/by-name/gn/gnucap/package.nix

@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
 
         propagatedBuildInputs = selectedPlugins;
 
-        phases = [ "installPhase" "fixupPhase" ];
+        dontUnpack = true;
 
         installPhase = ''
           mkdir -p $out/bin

pkgs/by-name/gr/graphicsmagick/imagemagick-compat.nix

@@ -0,0 +1,48 @@
+{ lib
+, graphicsmagick
+, stdenvNoCC
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "graphicsmagick-imagemagick-compat";
+  inherit (graphicsmagick) version;
+
+  outputs = [ "out" "man" ];
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  # TODO: symlink libraries?
+  installPhase = let
+    utilities = [
+      "animate"
+      "composite"
+      "conjure"
+      "convert"
+      "display"
+      "identify"
+      "import"
+      "mogrify"
+      "montage"
+    ];
+    linkUtilityBin = utility: ''
+      ln -s ${lib.getExe graphicsmagick} "$out/bin/${utility}"
+    '';
+    linkUtilityMan = utility: ''
+      ln -s ${lib.getMan graphicsmagick}/share/man/man1/gm.1.gz "$man/share/man/man1/${utility}.1.gz"
+    '';
+  in ''
+    runHook preInstall
+
+    mkdir -p "$out"/bin
+    ${lib.concatStringsSep "\n" (map linkUtilityBin utilities)}
+    mkdir -p "$man"/share/man/man1
+    ${lib.concatStringsSep "\n" (map linkUtilityMan utilities)}
+
+    runHook postInstall
+  '';
+
+  meta = graphicsmagick.meta // {
+    description = "A repack of GraphicsMagick that provides compatibility with ImageMagick interfaces";
+  };
+}

pkgs/by-name/gr/graphicsmagick/package.nix

@@ -0,0 +1,105 @@
+{ lib
+, bzip2
+, callPackage
+, coreutils
+, fetchurl
+, fixDarwinDylibNames
+, freetype
+, ghostscript
+, graphviz
+, libX11
+, libjpeg
+, libpng
+, libtiff
+, libtool
+, libwebp
+, libxml2
+, nukeReferences
+, quantumdepth ? 8
+, runCommand
+, stdenv
+, xz
+, zlib
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "graphicsmagick";
+  version = "1.3.43";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/graphicsmagick/GraphicsMagick-${finalAttrs.version}.tar.xz";
+    hash = "sha256-K4hYBzLNfkCdniLGEWI4vvSuBvzaEUUb8z0ln5y/OZ8=";
+  };
+
+  outputs = [ "out" "man" ];
+
+  buildInputs = [
+    bzip2
+    freetype
+    ghostscript
+    graphviz
+    libX11
+    libjpeg
+    libpng
+    libtiff
+    libtool
+    libwebp
+    libxml2
+    zlib
+  ];
+
+  nativeBuildInputs = [
+    nukeReferences
+    xz
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ];
+
+  configureFlags = [
+    # specify delegates explicitly otherwise `gm` will invoke the build
+    # coreutils for filetypes it doesn't natively support.
+    "MVDelegate=${lib.getExe' coreutils "mv"}"
+    (lib.enableFeature true "shared")
+    (lib.withFeature true "frozenpaths")
+    (lib.withFeatureAs true "quantum-depth" (toString quantumdepth))
+    (lib.withFeatureAs true "gslib" "yes")
+  ];
+
+  # Remove CFLAGS from the binaries to avoid closure bloat.
+  # In the past we have had -dev packages in the closure of the binaries soley
+  # due to the string references.
+  postConfigure = ''
+    nuke-refs -e $out ./magick/magick_config.h
+  '';
+
+  postInstall = ''
+    sed -i 's/-ltiff.*'\'/\'/ $out/bin/*
+  '';
+
+  passthru = {
+    imagemagick-compat = callPackage ./imagemagick-compat.nix {
+      graphicsmagick = finalAttrs.finalPackage;
+    };
+    tests = {
+      issue-157920 = runCommand "issue-157920-regression-test" {
+        buildInputs = [ finalAttrs.finalPackage ];
+      } ''
+        gm convert ${graphviz}/share/doc/graphviz/neatoguide.pdf jpg:$out
+      '';
+    };
+  };
+
+  meta = {
+    homepage = "http://www.graphicsmagick.org";
+    description = "Swiss army knife of image processing";
+    longDescription = ''
+      GraphicsMagick is the swiss army knife of image processing, providing a
+      robust and efficient collection of tools and libraries which support
+      reading, writing, and manipulating an image in over 92 major formats
+      including important formats like DPX, GIF, JPEG, JPEG-2000, JXL, PNG, PDF,
+      PNM, TIFF, and WebP.
+    '';
+    license = with lib.licenses; [ mit ];
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    mainProgram = "gm";
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/in/incus/529.patch

@@ -0,0 +1,29 @@
+From 32a4beecbf8098fdbb15ef5f36088956922630f7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stgraber@stgraber.org>
+Date: Fri, 23 Feb 2024 18:47:15 -0500
+Subject: [PATCH] incusd/device/disk: Fix incorrect block volume usage
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
+---
+ internal/server/device/disk.go | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/internal/server/device/disk.go b/internal/server/device/disk.go
+index 0d19e21139..4f9a3e7c1b 100644
+--- a/internal/server/device/disk.go
++++ b/internal/server/device/disk.go
+@@ -339,6 +339,11 @@ func (d *disk) validateConfig(instConf instance.ConfigReader) error {
+ 				var usedBy []string
+ 
+ 				err = storagePools.VolumeUsedByInstanceDevices(d.state, d.pool.Name(), storageProjectName, &dbVolume.StorageVolume, true, func(inst db.InstanceArgs, project api.Project, usedByDevices []string) error {
++					// Don't count the current instance.
++					if d.inst != nil && d.inst.Project().Name == inst.Project && d.inst.Name() == inst.Name {
++						return nil
++					}
++
+ 					usedBy = append(usedBy, inst.Name)
+ 
+ 					return nil

pkgs/by-name/in/incus/client.nix

@@ -1,28 +1,28 @@
 {
   lts ? false,
+  meta,
+  patches,
+  src,
+  vendorHash,
+  version,
 
   lib,
   buildGoModule,
-  fetchpatch,
-  fetchFromGitHub,
   installShellFiles,
 }:
 let
-  releaseFile = if lts then ./lts.nix else ./latest.nix;
-  inherit (import releaseFile { inherit fetchpatch; }) version hash vendorHash;
+  pname = "incus${lib.optionalString lts "-lts"}-client";
 in
 
-buildGoModule rec {
-  pname = "incus-client";
-
-  inherit vendorHash version;
-
-  src = fetchFromGitHub {
-    owner = "lxc";
-    repo = "incus";
-    rev = "refs/tags/v${version}";
-    inherit hash;
-  };
+buildGoModule {
+  inherit
+    meta
+    patches
+    pname
+    src
+    vendorHash
+    version
+    ;
 
   CGO_ENABLED = 0;
 
@@ -41,14 +41,4 @@ buildGoModule rec {
 
   # don't run the full incus test suite
   doCheck = false;
-
-  meta = {
-    description = "Powerful system container and virtual machine manager";
-    homepage = "https://linuxcontainers.org/incus";
-    changelog = "https://github.com/lxc/incus/releases/tag/v${version}";
-    license = lib.licenses.asl20;
-    maintainers = lib.teams.lxc.members;
-    platforms = lib.platforms.unix;
-    mainProgram = "incus";
-  };
 }

pkgs/by-name/in/incus/generic.nix

@@ -1,10 +1,18 @@
 {
+  hash,
   lts ? false,
+  patches,
+  updateScriptArgs ? "",
+  vendorHash,
+  version,
+}:
 
+{
+  callPackage,
   lib,
   buildGoModule,
-  fetchpatch,
   fetchFromGitHub,
+  writeScript,
   writeShellScript,
   acl,
   cowsql,
@@ -19,31 +27,28 @@
 }:
 
 let
-  releaseFile = if lts then ./lts.nix else ./latest.nix;
-  inherit (import releaseFile { inherit fetchpatch; })
-    version
-    hash
-    patches
-    vendorHash
-    ;
-  name = "incus${lib.optionalString lts "-lts"}";
+  pname = "incus${lib.optionalString lts "-lts"}";
 in
 
-buildGoModule {
-  pname = "${name}-unwrapped";
-
-  inherit patches vendorHash version;
+buildGoModule rec {
+  inherit
+    patches
+    pname
+    vendorHash
+    version
+    ;
 
   src = fetchFromGitHub {
     owner = "lxc";
     repo = "incus";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     inherit hash;
   };
 
+  # replace with env var > 0.6 https://github.com/lxc/incus/pull/610
   postPatch = ''
     substituteInPlace internal/usbid/load.go \
-      --replace "/usr/share/misc/usb.ids" "${hwdata}/share/hwdata/usb.ids"
+      --replace-fail "/usr/share/misc/usb.ids" "${hwdata}/share/hwdata/usb.ids"
   '';
 
   excludedPackages = [
@@ -107,12 +112,23 @@ buildGoModule {
   '';
 
   passthru = {
-    tests.incus = nixosTests.incus;
+    client = callPackage ./client.nix {
+      inherit
+        lts
+        meta
+        patches
+        src
+        vendorHash
+        version
+        ;
+    };
 
-    updateScript = writeShellScript "update-incus" ''
-      nix-update ${name}.unwrapped -vr 'v(.*)' --override-filename pkgs/by-name/in/incus/${
-        if lts then "lts" else "latest"
-      }.nix
+    tests = nixosTests.incus;
+
+    ui = callPackage ./ui.nix { };
+
+    updateScript = writeScript "ovs-update.nu" ''
+      ${./update.nu} ${updateScriptArgs}
     '';
   };
 
@@ -123,5 +139,6 @@ buildGoModule {
     license = lib.licenses.asl20;
     maintainers = lib.teams.lxc.members;
     platforms = lib.platforms.linux;
+    mainProgram = "incus";
   };
 }

pkgs/by-name/in/incus/latest.nix

@@ -1,12 +0,0 @@
-{ fetchpatch }:
-{
-  hash = "sha256-tGuAS0lZvoYb+TvmCklQ8TADZhbm4w/lhdI0ycS4/0o=";
-  version = "0.6.0";
-  vendorHash = "sha256-+WmgLOEBJ/7GF596iiTgyTPxn8l+hE6RVqjLKfCi5rs=";
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/lxc/incus/pull/529.patch";
-      hash = "sha256-2aaPrzW/LVJidWeom0rqYOGpT2gvuV1yHLJN/TwQ1fk=";
-    })
-  ];
-}

pkgs/by-name/in/incus/lts.nix

@@ -1,3 +1,3 @@
 # this release doesn't exist yet, but satisfay the by-name checks
 # will be added as incus-lts in all-packages.nix once ready
-_: { }
+import ./generic.nix { }

pkgs/by-name/in/incus/package.nix

@@ -1,157 +1,9 @@
-{
-  lts ? false,
-
-  lib,
-  callPackage,
-  linkFarm,
-  makeWrapper,
-  stdenv,
-  symlinkJoin,
-  writeShellScriptBin,
-  acl,
-  apparmor-parser,
-  apparmor-profiles,
-  attr,
-  bash,
-  btrfs-progs,
-  cdrkit,
-  criu,
-  dnsmasq,
-  e2fsprogs,
-  getent,
-  gnutar,
-  gptfdisk,
-  gzip,
-  iproute2,
-  iptables,
-  kmod,
-  lvm2,
-  minio,
-  nftables,
-  OVMF,
-  qemu_kvm,
-  qemu-utils,
-  rsync,
-  spice-gtk,
-  squashfsTools,
-  thin-provisioning-tools,
-  util-linux,
-  virtiofsd,
-  xz,
-}:
-let
-  unwrapped = callPackage ./unwrapped.nix { inherit lts; };
-  client = callPackage ./client.nix { inherit lts; };
-  name = "incus${lib.optionalString lts "-lts"}";
-
-  binPath = lib.makeBinPath [
-    acl
-    attr
-    bash
-    btrfs-progs
-    cdrkit
-    criu
-    dnsmasq
-    e2fsprogs
-    getent
-    gnutar
-    gptfdisk
-    gzip
-    iproute2
-    iptables
-    kmod
-    lvm2
-    minio
-    nftables
-    qemu_kvm
-    qemu-utils
-    rsync
-    squashfsTools
-    thin-provisioning-tools
-    util-linux
-    virtiofsd
-    xz
-
-    (writeShellScriptBin "apparmor_parser" ''
-      exec '${apparmor-parser}/bin/apparmor_parser' -I '${apparmor-profiles}/etc/apparmor.d' "$@"
-    '')
+import ./generic.nix {
+  hash = "sha256-tGuAS0lZvoYb+TvmCklQ8TADZhbm4w/lhdI0ycS4/0o=";
+  version = "0.6.0";
+  vendorHash = "sha256-+WmgLOEBJ/7GF596iiTgyTPxn8l+hE6RVqjLKfCi5rs=";
+  patches = [
+    # fix storage bug, fixed in > 0.6
+    ./529.patch
   ];
-
-  clientBinPath = [ spice-gtk ];
-
-  ovmf-2mb = OVMF.override {
-    secureBoot = true;
-    fdSize2MB = true;
-  };
-
-  ovmf-4mb = OVMF.override {
-    secureBoot = true;
-    fdSize4MB = true;
-  };
-
-  ovmf-prefix = if stdenv.hostPlatform.isAarch64 then "AAVMF" else "OVMF";
-
-  # mimic ovmf from https://github.com/canonical/incus-pkg-snap/blob/3abebe1dfeb20f9b7729556960c7e9fe6ad5e17c/snapcraft.yaml#L378
-  # also found in /snap/incus/current/share/qemu/ on a snap install
-  ovmf = linkFarm "incus-ovmf" [
-    {
-      name = "OVMF_CODE.2MB.fd";
-      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_CODE.fd";
-    }
-    {
-      name = "OVMF_CODE.4MB.fd";
-      path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_CODE.fd";
-    }
-    {
-      name = "OVMF_CODE.fd";
-      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_CODE.fd";
-    }
-
-    {
-      name = "OVMF_VARS.2MB.fd";
-      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
-    {
-      name = "OVMF_VARS.2MB.ms.fd";
-      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
-    {
-      name = "OVMF_VARS.4MB.fd";
-      path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
-    {
-      name = "OVMF_VARS.4MB.ms.fd";
-      path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
-    {
-      name = "OVMF_VARS.fd";
-      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
-    {
-      name = "OVMF_VARS.ms.fd";
-      path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd";
-    }
-  ];
-in
-symlinkJoin {
-  name = "${name}-${unwrapped.version}";
-
-  paths = [ unwrapped ];
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  postBuild = ''
-    wrapProgram $out/bin/incusd --prefix PATH : ${lib.escapeShellArg binPath}:${qemu_kvm}/libexec:$out/bin --set INCUS_OVMF_PATH ${ovmf}
-
-    wrapProgram $out/bin/incus --prefix PATH : ${lib.makeBinPath clientBinPath}
-  '';
-
-  passthru = {
-    inherit client unwrapped;
-    ui = callPackage ./ui.nix {};
-
-    inherit (unwrapped) tests;
-  };
-
-  inherit (unwrapped) meta pname version;
 }

pkgs/by-name/in/incus/update.nu

@@ -0,0 +1,22 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i nu -p nushell common-updater-scripts gnused
+
+def main [--lts = false, --regex: string] {
+  let attr = $"incus(if $lts {"-lts"})"
+  let file = $"(pwd)/pkgs/by-name/in/incus/(if $lts { "lts" } else { "package" }).nix"
+
+  let tags = list-git-tags --url=https://github.com/lxc/incus | lines | sort --natural | str replace v ''
+  let latest_tag = if $regex == null { $tags } else { $tags | find --regex $regex } | last
+  let current_version = nix eval --raw -f default.nix $"($attr).version" | str trim
+
+  if $latest_tag != $current_version {
+    update-source-version $attr $latest_tag $"--file=($file)"
+
+    let oldVendorHash = nix-instantiate . --eval --strict -A $"($attr).goModules.drvAttrs.outputHash" --json | from json
+    let vendorHash = do { nix-build -A $"($attr).goModules" } | complete | get stderr | lines | str trim | find --regex 'got:[[:space:]]*sha256' | split row ' ' | last
+    open $file | str replace $oldVendorHash $vendorHash | save --force $file
+
+  }
+
+  {"lts?": $lts, before: $current_version, after: $latest_tag}
+}

pkgs/by-name/in/insync/package.nix

@@ -1,22 +1,27 @@
 { lib
 , writeShellScript
-, buildFHSEnvBubblewrap
+, buildFHSEnv
 , stdenvNoCC
 , fetchurl
 , autoPatchelfHook
 , dpkg
 , nss
+, cacert
+, alsa-lib
 , libvorbis
 , libdrm
 , libGL
 , wayland
 , xkeyboard_config
 , libthai
+, libsForQt5
 }:
 
 let
   pname = "insync";
-  version = "3.8.6.50504";
+  # Find a binary from https://www.insynchq.com/downloads/linux#ubuntu.
+  version = "3.8.7.50516";
+  ubuntu-dist = "mantic_amd64";
   meta = with lib; {
     platforms = ["x86_64-linux"];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
@@ -35,7 +40,6 @@ let
      Known bug(s):
 
      1) Currently the system try icon does not render correctly.
-     2) libqtvirtualkeyboardplugin does not have necessary Qt library shipped from vendor.
     '';
     mainProgram = "insync";
   };
@@ -45,22 +49,27 @@ let
     inherit version meta;
 
     src = fetchurl {
-      # Find a binary from https://www.insynchq.com/downloads/linux#ubuntu.
-      url = "https://cdn.insynchq.com/builds/linux/insync_${version}-lunar_amd64.deb";
-      sha256 = "sha256-BxTFtQ1rAsOuhKnH5vsl3zkM7WOd+vjA4LKZGxl4jk0=";
+      url = "https://cdn.insynchq.com/builds/linux/insync_${version}-${ubuntu-dist}.deb";
+      sha256 = "sha256-U7BcgghbdR7r9WiZpEOka+BzXwnxrzL6p4imGESuB/k=";
     };
 
+    nativeBuildInputs = [
+      dpkg
+      autoPatchelfHook
+      libsForQt5.qt5.wrapQtAppsHook
+    ];
+
     buildInputs = [
       nss
+      alsa-lib
       libvorbis
       libdrm
       libGL
       wayland
       libthai
+      libsForQt5.qt5.qtvirtualkeyboard
     ];
 
-    nativeBuildInputs = [ autoPatchelfHook dpkg ];
-
     unpackPhase = ''
       dpkg-deb --fsys-tarfile $src | tar -x --no-same-permissions --no-same-owner
     '';
@@ -71,15 +80,6 @@ let
       mkdir -p $out
       cp -R usr/* $out/
 
-      # use system glibc
-      rm $out/lib/insync/{libgcc_s.so.1,libstdc++.so.6}
-
-      # remove badly packaged plugins
-      rm $out/lib/insync/PySide2/plugins/platforminputcontexts/libqtvirtualkeyboardplugin.so
-
-      # remove the unused vendor wrapper
-      rm $out/bin/insync
-
       runHook postInstall
     '';
 
@@ -87,29 +87,25 @@ let
     dontStrip = true;
   };
 
-in buildFHSEnvBubblewrap {
+in buildFHSEnv {
   name = pname;
   inherit meta;
 
   targetPkgs = pkgs: with pkgs; [
-    insync-pkg
     libudev0-shim
+    insync-pkg
   ];
 
-  runScript = writeShellScript "insync-wrapper.sh" ''
-    # QT_STYLE_OVERRIDE was used to suppress a QT warning, it should have no actual effect for this binary.
-    echo Unsetting QT_STYLE_OVERRIDE=$QT_STYLE_OVERRIDE
-    echo Unsetting QT_QPA_PLATFORMTHEME=$QT_QPA_PLATFORMTHEME
-    unset QT_STYLE_OVERRIDE
-    unset QPA_PLATFORMTHEME
+  extraInstallCommands = ''
+    cp -rsHf "${insync-pkg}"/share $out
+  '';
 
+  runScript = writeShellScript "insync-wrapper.sh" ''
     # xkb configuration needed: https://github.com/NixOS/nixpkgs/issues/236365
     export XKB_CONFIG_ROOT=${xkeyboard_config}/share/X11/xkb/
-    echo XKB_CONFIG_ROOT=$XKB_CONFIG_ROOT
 
-    # For debuging:
+    # For debugging:
     # export QT_DEBUG_PLUGINS=1
-    # find -L /usr/share -name "*insync*"
 
     exec /usr/lib/insync/insync "$@"
     '';
@@ -121,6 +117,6 @@ in buildFHSEnvBubblewrap {
   unshareNet    = false;
   unshareUts    = false;
   unshareCgroup = false;
-  # Since "insync start" command starts a daemon, this daemon should die with it.
-  dieWithParent = false;
+
+  dieWithParent = true;
 }

pkgs/by-name/ko/kor/package.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kor";
-  version = "0.3.6";
+  version = "0.3.7";
 
   src = fetchFromGitHub {
     owner = "yonahd";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Q2VUc91ecBRr/m9DGYWwuSsH2prB+EKmBoQrekgPvTE=";
+    hash = "sha256-wjq4IkF3agmculIH+WfBAGd0ciJBX9aj4EsmUvje9Aw=";
   };
 
-  vendorHash = "sha256-DRbwM6fKTIlefD0rUmNLlUXrK+t3vNCl4rxHF7m8W10=";
+  vendorHash = "sha256-UN3Zf8eo6kMNNzkGsnqyDVMgE2QXRn4wg+XULu/uBGE=";
 
   preCheck = ''
     HOME=$(mktemp -d)

pkgs/by-name/li/libhttpserver/package.nix

@@ -0,0 +1,46 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, autoconf
+, automake
+, libtool
+, gnutls
+, libmicrohttpd
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libhttpserver";
+  version = "0.19.0";
+
+  src = fetchFromGitHub {
+    owner = "etr";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-Pc3Fvd8D4Ymp7dG9YgU58mDceOqNfhWE1JtnpVaNx/Y=";
+  };
+
+  nativeBuildInputs = [ autoconf automake libtool ];
+
+  buildInputs = [ gnutls libmicrohttpd ];
+
+  enableParallelBuilding = true;
+
+  postPatch = ''
+    patchShebangs ./bootstrap
+  '';
+
+  preConfigure = ''
+    ./bootstrap
+  '';
+
+  configureFlags = [ "--enable-same-directory-build" ];
+
+  meta = with lib; {
+    description = "C++ library for creating an embedded Rest HTTP server (and more)";
+    homepage = "https://github.com/etr/libhttpserver";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ pongo1231 ];
+    platforms = platforms.unix;
+    broken = stdenv.isDarwin; # configure: error: cannot find required auxiliary files: ltmain.sh
+  };
+}

pkgs/by-name/li/libisoburn/package.nix

@@ -1,12 +1,16 @@
 { lib
-, stdenv
-, fetchFromGitea
 , acl
 , attr
 , autoreconfHook
+, bzip2
+, fetchFromGitea
 , libburn
+, libcdio
+, libiconv
 , libisofs
 , pkg-config
+, readline
+, stdenv
 , zlib
 }:
 
@@ -28,13 +32,19 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    attr
+    bzip2
+    libcdio
+    libiconv
+    readline
     zlib
     libburn
     libisofs
+  ] ++ lib.optionals stdenv.isLinux [
+    acl
+    attr
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = lib.optionals stdenv.isLinux [
     acl
   ];
 

pkgs/by-name/ll/llama-cpp/package.nix

@@ -16,6 +16,8 @@
 , clblast
 
 , blasSupport ? builtins.all (x: !x) [ cudaSupport metalSupport openclSupport rocmSupport vulkanSupport ]
+, blas
+
 , pkg-config
 , metalSupport ? stdenv.isDarwin && stdenv.isAarch64 && !openclSupport
 , vulkanSupport ? false
@@ -91,9 +93,10 @@ effectiveStdenv.mkDerivation (finalAttrs: {
 
   buildInputs = optionals effectiveStdenv.isDarwin darwinBuildInputs
     ++ optionals cudaSupport cudaBuildInputs
-    ++ optionals mpiSupport mpi
+    ++ optionals mpiSupport [ mpi ]
     ++ optionals openclSupport [ clblast ]
     ++ optionals rocmSupport rocmBuildInputs
+    ++ optionals blasSupport [ blas ]
     ++ optionals vulkanSupport vulkanBuildInputs;
 
   cmakeFlags = [
@@ -128,8 +131,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
         # Should likely use `rocmPackages.clr.gpuTargets`.
         "-DAMDGPU_TARGETS=gfx803;gfx900;gfx906:xnack-;gfx908:xnack-;gfx90a:xnack+;gfx90a:xnack-;gfx940;gfx941;gfx942;gfx1010;gfx1012;gfx1030;gfx1100;gfx1101;gfx1102"
       ]
-      ++ optionals metalSupport [ (cmakeFeature "CMAKE_C_FLAGS" "-D__ARM_FEATURE_DOTPROD=1") ]
-      ++ optionals blasSupport [ (cmakeFeature "LLAMA_BLAS_VENDOR" "OpenBLAS") ];
+      ++ optionals metalSupport [ (cmakeFeature "CMAKE_C_FLAGS" "-D__ARM_FEATURE_DOTPROD=1") ];
 
   # upstream plans on adding targets at the cmakelevel, remove those
   # additional steps after that

pkgs/by-name/mi/minijinja/package.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "minijinja";
-  version = "1.0.13";
+  version = "1.0.15";
 
   src = fetchFromGitHub {
     owner = "mitsuhiko";
     repo = "minijinja";
     rev = version;
-    hash = "sha256-VVd90j8ZOubtHX15jMGAIA3LF4tg4SzFxO046QVwDjc=";
+    hash = "sha256-ync0MkLi+CV1g9eBDLcV1dnV101H5Gc6K0NrnVeh8Jw=";
   };
 
-  cargoHash = "sha256-f9hXH0c8vVpexYyuQuS0D8jzEqJSrHOwp/FropTKTJg=";
+  cargoHash = "sha256-j8GLpMU7xwc3BWkjcFmGODiKieedNIB8VbHjJcrq8z4=";
 
   # The tests relies on the presence of network connection
   doCheck = false;

pkgs/by-name/ni/nix-ld-rs/package.nix

@@ -0,0 +1,54 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  nixosTests,
+  rustPlatform,
+  lib,
+}:
+
+rustPlatform.buildRustPackage {
+  name = "nix-ld-rs";
+
+  src = fetchFromGitHub {
+    owner = "nix-community";
+    repo = "nix-ld-rs";
+    rev = "f7154a6aedba4917c8cc72b805b79444b5bfafca";
+    sha256 = "sha256-tx6gO6NR4BnYVhoskyvQY9l6/8sK0HwoDHvsYcvIlgo=";
+  };
+
+  cargoHash = "sha256-4IDu5qAgF4Zq4GOsimuy8NiRCN9PXM+8oVzD2GO3QmM=";
+
+  hardeningDisable = [ "stackprotector" ];
+
+  NIX_SYSTEM = stdenv.system;
+  RUSTC_BOOTSTRAP = "1";
+
+  preCheck = ''
+    export NIX_LD=${stdenv.cc.bintools.dynamicLinker}
+  '';
+
+  postInstall = ''
+    mkdir -p $out/libexec
+    ln -s $out/bin/nix-ld-rs $out/libexec/nix-ld-rs
+    ln -s $out/bin/nix-ld-rs $out/libexec/nix-ld
+
+    mkdir -p $out/nix-support
+
+    ldpath=/${stdenv.hostPlatform.libDir}/$(basename ${stdenv.cc.bintools.dynamicLinker})
+    echo "$ldpath" > $out/nix-support/ldpath
+    mkdir -p $out/lib/tmpfiles.d/
+    cat > $out/lib/tmpfiles.d/nix-ld.conf <<EOF
+      L+ $ldpath - - - - $out/libexec/nix-ld-rs
+    EOF
+  '';
+
+  passthru.tests = nixosTests.nix-ld;
+
+  meta = with lib; {
+    description = "Run unpatched dynamic binaries on NixOS (rust version)";
+    homepage = "https://github.com/nix-community/nix-ld-rs";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mic92 ];
+    platforms = platforms.linux;
+  };
+}

pkgs/by-name/ni/nix-ld/package.nix

@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   postInstall = ''
     mkdir -p $out/nix-support
 
-    ldpath=/${stdenv.hostPlatform.libDir}/$(basename $(< ${stdenv.cc}/nix-support/dynamic-linker))
+    ldpath=/${stdenv.hostPlatform.libDir}/$(basename ${stdenv.cc.bintools.dynamicLinker})
     echo "$ldpath" > $out/nix-support/ldpath
     mkdir -p $out/lib/tmpfiles.d/
     cat > $out/lib/tmpfiles.d/nix-ld.conf <<EOF
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     EOF
   '';
 
-  passthru.tests.nix-ld = nixosTests.nix-ld;
+  passthru.tests = nixosTests.nix-ld;
 
   meta = with lib; {
     description = "Run unpatched dynamic binaries on NixOS";

pkgs/by-name/pu/puncia/package.nix

@@ -0,0 +1,42 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "puncia";
+  version = "0.15-unstable-2024-03-23";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ARPSyndicate";
+    repo = "puncia";
+    # https://github.com/ARPSyndicate/puncia/issues/5
+    rev = "c70ed93ea1e7e42e12dd9c14713cab71bb0e0fe9";
+    hash = "sha256-xGJk8y26tluHUPm9ikrBBiWGuzq6MKl778BF8wNDmps=";
+  };
+
+  build-system = with python3.pkgs; [
+    setuptools
+  ];
+
+  dependencies = with python3.pkgs; [
+    requests
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "puncia"
+  ];
+
+  meta = with lib; {
+    description = "CLI utility for Subdomain Center & Exploit Observer";
+    homepage = "https://github.com/ARPSyndicate/puncia";
+    # https://github.com/ARPSyndicate/puncia/issues/6
+    license = licenses.unfree;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "puncia";
+  };
+}

pkgs/by-name/ri/ricochet-refresh/package.nix

@@ -13,13 +13,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ricochet-refresh";
-  version = "3.0.18";
+  version = "3.0.22";
 
   src = fetchFromGitHub {
     owner = "blueprint-freespeech";
     repo = "ricochet-refresh";
     rev = "v${finalAttrs.version}-release";
-    hash = "sha256-QN2cxcYWGoszPdrWv+4FoTGNjQViK/OwxbBC6uoDhfA=";
+    hash = "sha256-xPOAtH+K3WTPjbDw4ZhwpO2+wUYe5JdqKdtfNKQbgSM=";
     fetchSubmodules = true;
   };
 
@@ -75,6 +75,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://www.ricochetrefresh.net/";
     downloadPage = "https://github.com/blueprint-freespeech/ricochet-refresh/releases";
     license = lib.licenses.bsd3;
-    platforms = lib.platforms.unix;
+    platforms = lib.platforms.linux;
   };
 })

pkgs/by-name/sc/screenly-cli/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "screenly-cli";
-  version = "0.2.4";
+  version = "0.2.5";
 
   src = fetchFromGitHub {
     owner = "screenly";
     repo = "cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-DSeI7ddsdsb+DLVPRyqpvz6WIRFBBaWjYJHlFpN8SrY=";
+    hash = "sha256-lRvJuoGxuKeijdFkJp6Gm+zXAhomYdSKCt8ng0cPjZg=";
   };
 
-  cargoHash = "sha256-W8xFOotHxFlBZhEUDRTJGsbr+GjG3ALynaoMgTxPPmM=";
+  cargoHash = "sha256-7hgm5i3Wr0qX+l3OihlxgBz6UO975bfC9mMXsYJ9Qhw=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/sh/shopware-cli/package.nix

@@ -9,18 +9,18 @@
 
 buildGoModule rec {
   pname = "shopware-cli";
-  version = "0.4.29";
+  version = "0.4.30";
   src = fetchFromGitHub {
     repo = "shopware-cli";
     owner = "FriendsOfShopware";
     rev = version;
-    hash = "sha256-gAn/AkubIwcNBrqBWggVXEmqXuXxjt1xZop0dQ291pA=";
+    hash = "sha256-QfeQ73nTvLavUIpHlTBTkY1GGqZCednlXRBigwPCt48=";
   };
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
   nativeCheckInputs = [ git dart-sass ];
 
-  vendorHash = "sha256-S7M7B4jtAe1jD6W5q2UewgwG++ecE46Rrp2Qt6kCDeQ=";
+  vendorHash = "sha256-dhOw/38FRQCA90z0DdyIPLrYiQ/tutGsdCb108ZLliU=";
 
   postInstall = ''
     export HOME="$(mktemp -d)"

pkgs/by-name/ta/tailscale-nginx-auth/package.nix

@@ -1,7 +1,7 @@
 { lib, stdenv, buildGoModule, fetchFromGitHub }:
 
 let
-  version = "1.58.2";
+  version = "1.62.0";
 in
 buildGoModule {
   pname = "tailscale-nginx-auth";
@@ -11,9 +11,9 @@ buildGoModule {
     owner = "tailscale";
     repo = "tailscale";
     rev = "v${version}";
-    hash = "sha256-FiFFfUtse0CKR4XJ82HEjpZNxCaa4FnwSJfEzJ5kZgk=";
+    hash = "sha256-qotoCKUb5INgdSELvJpDaDvCuzVqet5zeIazzRnYoqo=";
   };
-  vendorHash = "sha256-BK1zugKGtx2RpWHDvFZaFqz/YdoewsG8SscGt25uwtQ=";
+  vendorHash = "sha256-jyRjT/CQBlmjHzilxJvMuzZQlGyJB4X/yISgWjBVDxc=";
 
   CGO_ENABLED = 0;
 

pkgs/by-name/tu/tunnelgraf/package.nix

@@ -0,0 +1,52 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "tunnelgraf";
+  version = "0.6.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "denniswalker";
+    repo = "tunnelgraf";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-CsrbSpp1VszEAKpmHx8GbB7vfZCOvB+tDFNFwWKexEw=";
+  };
+
+  pythonRelaxDeps = [
+    "click"
+    "pydantic"
+  ];
+
+  build-system = with python3.pkgs; [
+    hatchling
+    pythonRelaxDepsHook
+  ];
+
+  dependencies = with python3.pkgs; [
+    click
+    deepmerge
+    paramiko
+    pydantic
+    python-hosts
+    pyyaml
+    sshtunnel
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "tunnelgraf"
+  ];
+
+  meta = with lib; {
+    description = "Tool to manage SSH tunnel hops to many endpoints";
+    homepage = "https://github.com/denniswalker/tunnelgraf";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "tunnelgraf";
+  };
+}

pkgs/by-name/vi/vidmerger/Cargo.lock

@@ -0,0 +1,750 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8901269c6307e8d93993578286ac0edf7f195079ffff5ebdeea6a59ffb7e36bc"
+
+[[package]]
+name = "anyhow"
+version = "1.0.81"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0952808a6c2afd1aa8947271f3a60f1a6763c7b912d210184c5149b5cf147247"
+
+[[package]]
+name = "assert_cmd"
+version = "2.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed72493ac66d5804837f480ab3766c72bdfab91a65e565fc54fa9e42db0073a8"
+dependencies = [
+ "anstyle",
+ "bstr",
+ "doc-comment",
+ "predicates",
+ "predicates-core",
+ "predicates-tree",
+ "wait-timeout",
+]
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi 0.1.19",
+ "libc",
+ "winapi 0.3.9",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed570934406eb16438a4e976b1b4500774099c13b8cb96eec99f620f05090ddf"
+
+[[package]]
+name = "bstr"
+version = "1.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05efc5cfd9110c8416e471df0e96702d58690178e206e61b7173706673c93706"
+dependencies = [
+ "memchr",
+ "regex-automata",
+ "serde",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "clap"
+version = "3.2.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea181bf566f71cb9a5d17a59e1871af638180a18fb0035c92ae62b705207123"
+dependencies = [
+ "atty",
+ "bitflags 1.3.2",
+ "clap_derive",
+ "clap_lex",
+ "indexmap",
+ "once_cell",
+ "strsim",
+ "termcolor",
+ "textwrap",
+]
+
+[[package]]
+name = "clap_derive"
+version = "3.2.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae6371b8bdc8b7d3959e9cf7b22d4435ef3e79e138688421ec654acf8c81b008"
+dependencies = [
+ "heck",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
+dependencies = [
+ "os_str_bytes",
+]
+
+[[package]]
+name = "colored"
+version = "1.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a5f741c91823341bebf717d4c71bda820630ce065443b58bd1b7451af008355"
+dependencies = [
+ "is-terminal",
+ "lazy_static",
+ "winapi 0.3.9",
+]
+
+[[package]]
+name = "ctor"
+version = "0.1.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d2301688392eb071b0bf1a37be05c469d3cc4dbbd95df672fe28ab021e6a096"
+dependencies = [
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "diff"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56254986775e3233ffa9c4d7d3faaf6d36a2c09d30b20687e9f88bc8bafc16c8"
+
+[[package]]
+name = "difflib"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6184e33543162437515c2e2b48714794e37845ec9851711914eec9d308f6ebe8"
+
+[[package]]
+name = "doc-comment"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
+
+[[package]]
+name = "either"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11157ac094ffbdde99aa67b23417ebdd801842852b500e395a45a9c0aac03e4a"
+
+[[package]]
+name = "errno"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a258e46cdc063eb8519c00b9fc845fc47bcfca4130e2f08e88665ceda8474245"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "190092ea657667030ac6a35e305e62fc4dd69fd98ac98631e5d3a2b1575a12b5"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "heck"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
+
+[[package]]
+name = "home"
+version = "0.5.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3d1354bf6b7235cb4a0576c2619fd4ed18183f689b12b006a0ee7329eeff9a5"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown",
+]
+
+[[package]]
+name = "is-terminal"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f23ff5ef2b80d608d61efee834934d862cd92461afc0560dedf493e4c033738b"
+dependencies = [
+ "hermit-abi 0.3.9",
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "k9"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32ddb58b0079a063218472916af599f2753ccb40942cdaba9d1f3fefccef17a9"
+dependencies = [
+ "anyhow",
+ "colored",
+ "diff",
+ "lazy_static",
+ "libc",
+ "proc-macro2",
+ "regex",
+ "syn 1.0.109",
+ "term_size",
+]
+
+[[package]]
+name = "kernel32-sys"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7507624b29483431c0ba2d82aece8ca6cdba9382bff4ddd0f7490560c056098d"
+dependencies = [
+ "winapi 0.2.8",
+ "winapi-build",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.153"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"
+
+[[package]]
+name = "memchr"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "523dc4f511e55ab87b694dc30d0f820d60906ef06413f93d4d7a1385599cc149"
+
+[[package]]
+name = "nanoid"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ffa00dec017b5b1a8b7cf5e2c008bfda1aa7e0697ac1508b491fdf2622fb4d8"
+dependencies = [
+ "rand",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+
+[[package]]
+name = "os_str_bytes"
+version = "6.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2355d85b9a3786f481747ced0e0ff2ba35213a1f9bd406ed906554d7af805a1"
+
+[[package]]
+name = "path-slash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "498a099351efa4becc6a19c72aa9270598e8fd274ca47052e37455241c88b696"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
+
+[[package]]
+name = "predicates"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68b87bfd4605926cdfefc1c3b5f8fe560e3feca9d5552cf68c466d3d8236c7e8"
+dependencies = [
+ "anstyle",
+ "difflib",
+ "predicates-core",
+]
+
+[[package]]
+name = "predicates-core"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b794032607612e7abeb4db69adb4e33590fa6cf1149e95fd7cb00e634b92f174"
+
+[[package]]
+name = "predicates-tree"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "368ba315fb8c5052ab692e68a0eefec6ec57b23a36959c14496f0b0df2c0cecf"
+dependencies = [
+ "predicates-core",
+ "termtree",
+]
+
+[[package]]
+name = "proc-macro-error"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.79"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e835ff2298f5721608eb1a980ecaee1aef2c132bf95ecc026a11b7bf3c01c02e"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "regex"
+version = "1.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b62dbe01f0b06f9d8dc7d49e05a0785f153b00b2c227856282f671e0318c9b15"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86b83b8b9847f9bf95ef68afb0b8e6cdb80f498442f5179a29fad448fcc1eaea"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
+
+[[package]]
+name = "rustix"
+version = "0.38.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ea3e1a662af26cd7a3ba09c0297a31af215563ecf42817c98df621387f4e949"
+dependencies = [
+ "bitflags 2.4.2",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.197"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fb1c873e1b9b056a4dc4c0c198b24c3ffa059243875552b2bd0933b1aee4ce2"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.197"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.53",
+]
+
+[[package]]
+name = "stdext"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a61b4ae487cb43d0479907e74d36f8813e9940bd3b1adcbecc69fe8a0cee3ec"
+
+[[package]]
+name = "strsim"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.53"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7383cd0e49fff4b6b90ca5670bfd3e9d6a733b3f90c686605aa7eec8c4996032"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "system_shutdown"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "035e081d603551d8d78db27d2232913269c749ea67648c369100049820406a14"
+dependencies = [
+ "winapi 0.3.9",
+]
+
+[[package]]
+name = "term"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa63644f74ce96fbeb9b794f66aff2a52d601cbd5e80f4b97123e3899f4570f1"
+dependencies = [
+ "kernel32-sys",
+ "winapi 0.2.8",
+]
+
+[[package]]
+name = "term-painter"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dcaa948f0e3e38470cd8dc8dcfe561a75c9e43f28075bb183845be2b9b3c08cf"
+dependencies = [
+ "term",
+]
+
+[[package]]
+name = "term_size"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e4129646ca0ed8f45d09b929036bafad5377103edd06e50bf574b353d2b08d9"
+dependencies = [
+ "libc",
+ "winapi 0.3.9",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "termtree"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3369f5ac52d5eb6ab48c6b4ffdc8efbcad6b89c765749064ba298f2c68a16a76"
+
+[[package]]
+name = "textwrap"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23d434d3f8967a09480fb04132ebe0a3e088c173e6d0ee7897abbdf4eab0f8b9"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "vidmerger"
+version = "0.3.2"
+dependencies = [
+ "assert_cmd",
+ "clap",
+ "ctor",
+ "k9",
+ "nanoid",
+ "path-slash",
+ "regex",
+ "stdext",
+ "system_shutdown",
+ "term-painter",
+ "which",
+]
+
+[[package]]
+name = "wait-timeout"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f200f5b12eb75f8c1ed65abd4b2db8a6e1b138a20de009dacee265a2498f3f6"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "which"
+version = "4.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
+dependencies = [
+ "either",
+ "home",
+ "once_cell",
+ "rustix",
+]
+
+[[package]]
+name = "winapi"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "167dc9d6949a9b857f3451275e911c3f44255842c1f7a76f33c55103a909087a"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-build"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d315eee3b34aca4797b2da6b13ed88266e6d612562a0c46390af8299fc699bc"
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
+dependencies = [
+ "winapi 0.3.9",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dd37b7e5ab9018759f893a1952c9420d060016fc19a472b4bb20d1bdd694d1b"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcf46cf4c365c6f2d1cc93ce535f2c8b244591df96ceee75d8e83deb70a9cac9"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da9f259dd3bcf6990b55bffd094c4f7235817ba4ceebde8e6d11cd0c5633b675"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b474d8268f99e0995f25b9f095bc7434632601028cf86590aea5c8a5cb7801d3"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1515e9a29e5bed743cb4415a9ecf5dfca648ce85ee42e15873c3cd8610ff8e02"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eee091590e89cc02ad514ffe3ead9eb6b660aedca2183455434b93546371a03"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ca79f2451b49fa9e2af39f0747fe999fcda4f5e241b2898624dca97a1f2177"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32b752e52a2da0ddfbdbcc6fceadfeede4c939ed16d13e648833a61dfb611ed8"

pkgs/by-name/vi/vidmerger/package.nix

@@ -0,0 +1,40 @@
+{ lib
+, ffmpeg
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "vidmerger";
+  version = "0.3.2";
+
+  src = fetchFromGitHub {
+    owner = "TGotwig";
+    repo = "vidmerger";
+    rev = version;
+    hash = "sha256-E3Y1UaYXl6NdCMM7IepqFzWNuHaMGLCN5BvQ/lxjFoc=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+  };
+
+  postPatch = ''
+    cp ${./Cargo.lock} Cargo.lock
+  '';
+
+  # Running cargo test -- . fails because it expects to have two mp4 files so that it can test the video merging functionalities
+  doCheck = false;
+
+  buildInputs = [
+    ffmpeg
+  ];
+
+  meta = with lib; {
+    description = "Merge video & audio files via CLI ";
+    homepage = "https://github.com/TGotwig/vidmerger";
+    license = with licenses; [ mit commons-clause ];
+    maintainers = with maintainers; [ ByteSudoer ];
+    mainProgram = "vidmerger";
+  };
+}

pkgs/by-name/xe/xemu/package.nix

@@ -1,9 +1,8 @@
 { lib
-, stdenv
-, fetchFromGitHub
 , SDL2
 , SDL2_image
 , copyDesktopItems
+, fetchFromGitHub
 , gettext
 , glib
 , gtk3
@@ -20,7 +19,8 @@
 , openssl
 , perl
 , pkg-config
-, python3
+, python3Packages
+, stdenv
 , vte
 , which
 , wrapGAppsHook
@@ -34,8 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "xemu-project";
     repo = "xemu";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-FFxYp53LLDOPZ1Inr70oyQXhNjJO23G+gNmXd/lvrYs=";
     fetchSubmodules = true;
+    hash = "sha256-FFxYp53LLDOPZ1Inr70oyQXhNjJO23G+gNmXd/lvrYs=";
   };
 
   nativeBuildInputs = [
@@ -44,11 +44,12 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     perl
     pkg-config
-    python3
-    python3.pkgs.pyyaml
     which
     wrapGAppsHook
-  ];
+  ] ++ (with python3Packages; [
+    python
+    pyyaml
+  ]);
 
   buildInputs = [
     SDL2
@@ -91,13 +92,18 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
-  preConfigure = ''
+  postPatch = ''
     patchShebangs .
-    configureFlagsArray+=("--extra-cflags=-DXBOX=1 -Wno-error=redundant-decls")
     substituteInPlace ./scripts/xemu-version.sh \
       --replace 'date -u' "date -d @$SOURCE_DATE_EPOCH '+%Y-%m-%d %H:%M:%S'"
-    # When the data below can't be obtained through git, the build process tries
-    # to run `XEMU_COMMIT=$(cat XEMU_COMMIT)` (and similar)
+  '';
+
+  preConfigure = ''
+    configureFlagsArray+=("--extra-cflags=-DXBOX=1 -Wno-error=redundant-decls")
+  '' +
+  # When the data below can't be obtained through git, the build process tries
+  # to run `XEMU_COMMIT=$(cat XEMU_COMMIT)` (and similar)
+  ''
     echo '${finalAttrs.version}' > XEMU_VERSION
   '';
 
@@ -106,18 +112,19 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace ./build.ninja --replace /usr/bin/env $(which env)
   '';
 
-  installPhase = ''
+  installPhase = let
+    installIcon = resolution: ''
+      install -Dm644 -T ../ui/icons/xemu_${resolution}.png \
+        $out/share/icons/hicolor/${resolution}/apps/xemu.png
+    '';
+  in ''
     runHook preInstall
 
     install -Dm755 -T qemu-system-i386 $out/bin/xemu
   '' +
-  # Generate code to install the icons
-  (lib.concatMapStringsSep ";\n"
-    (res:
-      "install -Dm644 -T ../ui/icons/xemu_${res}.png $out/share/icons/hicolor/${res}/apps/xemu.png")
-    [ "16x16" "24x24" "32x32" "48x48" "128x128" "256x256" "512x512" ]) +
+  (lib.concatMapStringsSep "\n" installIcon
+    [ "16x16" "24x24" "32x32" "48x48" "128x128" "256x256" "512x512" ]) + "\n" +
   ''
-
     runHook postInstall
   '';
 
@@ -131,8 +138,8 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     changelog = "https://github.com/xemu-project/xemu/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [ AndersonTorres genericnerdyusername ];
-    platforms = lib.platforms.linux;
     mainProgram = "xemu";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    platforms = lib.platforms.linux;
   };
 })

pkgs/by-name/xo/xorriso/package.nix

@@ -1,59 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, acl
-, attr
-, bzip2
-, libcdio
-, libiconv
-, readline
-, zlib
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "xorriso";
-  version = "1.5.7-unstable-2023-12-06";
-
-  src = fetchurl {
-    url = "https://web.archive.org/web/20231206123448/https://www.gnu.org/software/xorriso/xorriso-1.5.7.tar.gz";
-    hash = "sha256-B7lV3n3e1aF7yJsLxwi8C8m3sBmUUePpCV9KfWRuTm0=";
-  };
-
-  buildInputs = [
-    bzip2
-    libcdio
-    libiconv
-    readline
-    zlib
-  ]
-  ++ lib.optionals stdenv.isLinux [
-    acl
-    attr
-  ];
-
-  outputs = [ "out" "man" ];
-
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-include unistd.h";
-
-  doCheck = true;
-
-  strictDeps = true;
-
-  meta = {
-    homepage = "https://www.gnu.org/software/xorriso/";
-    description = "ISO 9660 Rock Ridge file system manipulator";
-    longDescription = ''
-      GNU xorriso copies file objects from POSIX compliant filesystems into Rock
-      Ridge enhanced ISO 9660 filesystems and allows session-wise manipulation
-      of such filesystems. It can load the management information of existing
-      ISO images and it writes the session results to optical media or to
-      filesystem objects.
-      Vice versa xorriso is able to copy file objects out of ISO 9660
-      filesystems.
-    '';
-    license = lib.licenses.gpl3Plus;
-    mainProgram = "xorriso";
-    maintainers = [ lib.maintainers.AndersonTorres ];
-    platforms = lib.platforms.unix;
-  };
-})

pkgs/data/fonts/iosevka/default.nix

@@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;
 
 buildNpmPackage rec {
   pname = "Iosevka${toString set}";
-  version = "28.1.0";
+  version = "29.0.3";
 
   src = fetchFromGitHub {
     owner = "be5invis";
     repo = "iosevka";
     rev = "v${version}";
-    hash = "sha256-cYnGJ7Z0PDRZtC/vz8hX/+mqk7iVkajFTfNGgRW+edQ=";
+    hash = "sha256-7vNfmrQ/B+T9hF5/ikIU1RvBcSRStnEmOY7VPbrll6s=";
   };
 
-  npmDepsHash = "sha256-bzQ7dc7UiC++0DxnQHusu6Ym7rd7GgeA6bGSnnla1nk=";
+  npmDepsHash = "sha256-FGGhuMlDhXd97AY23/ZPlrcrmirZIooAYJaskn2aM6w=";
 
   nativeBuildInputs = [
     remarshal
@@ -110,7 +110,7 @@ buildNpmPackage rec {
   buildPhase = ''
     export HOME=$TMPDIR
     runHook preBuild
-    npm run build --no-update-notifier -- --jCmd=$NIX_BUILD_CORES --verbose=9 ttf::$pname
+    npm run build --no-update-notifier --targets ttf::$pname -- --jCmd=$NIX_BUILD_CORES --verbose=9
     runHook postBuild
   '';
 

pkgs/data/fonts/material-icons/default.nix

@@ -1,25 +1,33 @@
-{ lib, stdenvNoCC, fetchFromGitHub }:
+{ lib, stdenvNoCC, fetchFromGitHub, nix-update-script }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "material-icons";
-  version = "3.0.1";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "material-design-icons";
-    rev = version;
-    hash = "sha256-4FphNJCsaLWzlVR4TmXnDBid0EVj39fkeoh5j1leBZ8=";
+    rev = finalAttrs.version;
+    hash = "sha256-wX7UejIYUxXOnrH2WZYku9ljv4ZAlvgk8EEJJHOCCjE=";
   };
 
+  dontConfigure = true;
+  dontBuild = true;
+
   installPhase = ''
     runHook preInstall
 
     mkdir -p $out/share/fonts/truetype
-    cp iconfont/*.ttf $out/share/fonts/truetype
+    cp font/*.ttf $out/share/fonts/truetype
+
+    mkdir -p $out/share/fonts/opentype
+    cp font/*.otf $out/share/fonts/opentype
 
     runHook postInstall
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "System status icons by Google, featuring material design";
     homepage = "https://material.io/icons";
@@ -27,4 +35,4 @@ stdenvNoCC.mkDerivation rec {
     platforms = platforms.all;
     maintainers = with maintainers; [ mpcsh ];
   };
-}
+})

pkgs/data/icons/bibata-cursors/default.nix

@@ -1,44 +0,0 @@
-{ lib
-, stdenvNoCC
-, fetchFromGitHub
-, fetchurl
-, clickgen
-, attrs
-}:
-
-stdenvNoCC.mkDerivation rec {
-  pname = "bibata-cursors";
-  version = "2.0.3";
-
-  src = fetchFromGitHub {
-    owner = "ful1e5";
-    repo = "Bibata_Cursor";
-    rev = "v${version}";
-    sha256 = "zCk7qgPeae0BfzhxxU2Dk1SOWJQOxiWyJuzH/ri+Gq4=";
-  };
-
-  buildInputs = [ clickgen attrs ];
-
-  buildPhase = ''
-    ctgen build.toml -p x11 -d 'bitmaps/Bibata-Modern-Amber' -n 'Bibata-Modern-Amber' -c 'Yellowish and rounded edge bibata cursors.'
-    ctgen build.toml -p x11 -d 'bitmaps/Bibata-Modern-Classic' -n 'Bibata-Modern-Classic' -c 'Black and rounded edge Bibata cursors.'
-    ctgen build.toml -p x11 -d 'bitmaps/Bibata-Modern-Ice' -n 'Bibata-Modern-Ice' -c 'White and rounded edge Bibata cursors.'
-
-    ctgen build.toml -p x11 -d 'bitmaps/Bibata-Original-Amber' -n 'Bibata-Original-Amber' -c 'Yellowish and sharp edge Bibata cursors.'
-    ctgen build.toml -p x11 -d 'bitmaps/Bibata-Original-Classic' -n 'Bibata-Original-Classic' -c 'Black and sharp edge Bibata cursors.'
-    ctgen build.toml -p x11 -d 'bitmaps/Bibata-Original-Ice' -n 'Bibata-Original-Ice' -c 'White and sharp edge Bibata cursors.'
-  '';
-
-  installPhase = ''
-    install -dm 0755 $out/share/icons
-    cp -rf themes/* $out/share/icons/
-  '';
-
-  meta = with lib; {
-    description = "Material Based Cursor Theme";
-    homepage = "https://github.com/ful1e5/Bibata_Cursor";
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ rawkode AdsonCicilioti ];
-  };
-}

pkgs/desktops/budgie/budgie-desktop/default.nix

@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch2
 , accountsservice
 , alsa-lib
 , budgie-screensaver
@@ -49,6 +50,27 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./plugins.patch
+
+    # Fix workspace applet window icon click not performing workspace switch
+    # https://github.com/BuddiesOfBudgie/budgie-desktop/issues/524
+    (fetchpatch2 {
+      url = "https://github.com/BuddiesOfBudgie/budgie-desktop/commit/9b775d613ad0c324db628ed5a32d3fccc90f82d6.patch";
+      hash = "sha256-QtPviPW7pJYZIs28CYwE3N8vcDswqnjD6d0WVPFchL4=";
+    })
+
+    # Work around even more SNI noncompliance
+    # https://github.com/BuddiesOfBudgie/budgie-desktop/issues/539
+    (fetchpatch2 {
+      url = "https://github.com/BuddiesOfBudgie/budgie-desktop/commit/84269e2fcdcac6d737ee5100881e8b306eaae570.patch";
+      hash = "sha256-1Uj+6GZ9/oDQOt+5P8UYiVP3P0BrsJe3HqXVLkWCkAM=";
+    })
+
+    # vapi: Update libxfce4windowing to 4.19.3
+    # https://github.com/BuddiesOfBudgie/budgie-desktop/issues/546
+    (fetchpatch2 {
+      url = "https://github.com/BuddiesOfBudgie/budgie-desktop/commit/a040ccb96094f1d3a1ee81a6733c9434722bdf6c.patch";
+      hash = "sha256-9eMYB5Zyn3BDYvAwORXTHaPGYDP7LnqHAwp+6Wy6XLk=";
+    })
   ];
 
   nativeBuildInputs = [

pkgs/desktops/xfce/core/libxfce4windowing/default.nix

@@ -1,14 +1,35 @@
-{ lib, mkXfceDerivation, gobject-introspection, glib, gtk3, libwnck, wayland }:
+{ lib
+, mkXfceDerivation
+, gobject-introspection
+, wayland-scanner
+, glib
+, gtk3
+, libwnck
+, libX11
+, wayland
+, wlr-protocols
+}:
 
 mkXfceDerivation {
   category = "xfce";
   pname = "libxfce4windowing";
-  version = "4.19.2";
+  version = "4.19.3";
 
-  sha256 = "sha256-mXxxyfwZB/AJFVVGFAAXLqC5p7pZAeqmhljQym55hyM=";
+  sha256 = "sha256-nsobRyGeagUq1WHzYBq6vd9g5A65KEQC4cX+m7w0pqg=";
 
-  nativeBuildInputs = [ gobject-introspection ];
-  buildInputs = [ glib gtk3 libwnck wayland ];
+  nativeBuildInputs = [
+    gobject-introspection
+    wayland-scanner
+  ];
+
+  buildInputs = [
+    glib
+    gtk3
+    libwnck
+    libX11
+    wayland
+    wlr-protocols
+  ];
 
   meta = {
     description = "Windowing concept abstraction library for X11 and Wayland";

pkgs/development/compilers/openjdk/22.nix

@@ -0,0 +1,260 @@
+{ stdenv
+, lib
+, fetchurl
+, fetchpatch
+, fetchFromGitHub
+, bash
+, pkg-config
+, autoconf
+, cpio
+, file
+, which
+, unzip
+, zip
+, perl
+, cups
+, freetype
+, alsa-lib
+, libjpeg
+, giflib
+, libpng
+, zlib
+, lcms2
+, libX11
+, libICE
+, libXrender
+, libXext
+, libXt
+, libXtst
+, libXi
+, libXinerama
+, libXcursor
+, libXrandr
+, fontconfig
+, openjdk22-bootstrap
+, ensureNewerSourcesForZipFilesHook
+, setJavaClassPath
+  # TODO(@sternenseemann): gtk3 fails to evaluate in pkgsCross.ghcjs.buildPackages
+  # which should be fixable, this is a no-rebuild workaround for GHC.
+, headless ? stdenv.targetPlatform.isGhcjs
+, enableJavaFX ? false
+, openjfx
+, enableGnome2 ? true
+, gtk3
+, gnome_vfs
+, glib
+, GConf
+}:
+
+let
+  version = {
+    feature = "22";
+    interim = "";
+    build = "36";
+  };
+
+  # when building a headless jdk, also bootstrap it with a headless jdk
+  openjdk-bootstrap = openjdk22-bootstrap.override { gtkSupport = !headless; };
+
+  openjdk = stdenv.mkDerivation {
+    pname = "openjdk" + lib.optionalString headless "-headless";
+    version = "${version.feature}${version.interim}+${version.build}";
+
+    src = fetchFromGitHub {
+      owner = "openjdk";
+      repo = "jdk${version.feature}u";
+      rev = "jdk-${version.feature}${version.interim}+${version.build}";
+      hash = "sha256-itjvIedPwJl/l3a2gIVpNMs1zkbrjioVqbCj1Z1nCJE=";
+    };
+
+    nativeBuildInputs = [ pkg-config autoconf unzip ensureNewerSourcesForZipFilesHook ];
+    buildInputs = [
+      cpio
+      file
+      which
+      zip
+      perl
+      zlib
+      cups
+      freetype
+      alsa-lib
+      libjpeg
+      giflib
+      libpng
+      zlib
+      lcms2
+      libX11
+      libICE
+      libXrender
+      libXext
+      libXtst
+      libXt
+      libXtst
+      libXi
+      libXinerama
+      libXcursor
+      libXrandr
+      fontconfig
+      openjdk-bootstrap
+    ] ++ lib.optionals (!headless && enableGnome2) [
+      gtk3
+      gnome_vfs
+      GConf
+      glib
+    ];
+
+    patches = [
+      ./fix-java-home-jdk21.patch
+      ./read-truststore-from-env-jdk10.patch
+      ./currency-date-range-jdk10.patch
+      ./increase-javadoc-heap-jdk13.patch
+      ./ignore-LegalNoticeFilePlugin-jdk18.patch
+
+      # -Wformat etc. are stricter in newer gccs, per
+      # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79677
+      # so grab the work-around from
+      # https://src.fedoraproject.org/rpms/java-openjdk/pull-request/24
+      (fetchurl {
+        url = "https://src.fedoraproject.org/rpms/java-openjdk/raw/06c001c7d87f2e9fe4fedeef2d993bcd5d7afa2a/f/rh1673833-remove_removal_of_wformat_during_test_compilation.patch";
+        sha256 = "082lmc30x64x583vqq00c8y0wqih3y4r0mp1c4bqq36l22qv6b6r";
+      })
+
+      # Fix build for gnumake-4.4.1:
+      #   https://github.com/openjdk/jdk/pull/12992
+      (fetchpatch {
+        name = "gnumake-4.4.1";
+        url = "https://github.com/openjdk/jdk/commit/9341d135b855cc208d48e47d30cd90aafa354c36.patch";
+        hash = "sha256-Qcm3ZmGCOYLZcskNjj7DYR85R4v07vYvvavrVOYL8vg=";
+      })
+    ] ++ lib.optionals (!headless && enableGnome2) [
+      ./swing-use-gtk-jdk13.patch
+    ];
+
+    postPatch = ''
+      chmod +x configure
+      patchShebangs --build configure
+    '';
+
+    # JDK's build system attempts to specifically detect
+    # and special-case WSL, and we don't want it to do that,
+    # so pass the correct platform names explicitly
+    configurePlatforms = [ "build" "host" ];
+
+
+    # https://openjdk.org/groups/build/doc/building.html
+    configureFlags = [
+      "--with-boot-jdk=${openjdk-bootstrap.home}"
+      "--with-version-build=${version.build}"
+      "--with-version-opt=nixos"
+      "--with-version-pre="
+      "--enable-unlimited-crypto"
+      "--with-native-debug-symbols=internal"
+      "--with-libjpeg=system"
+      "--with-giflib=system"
+      "--with-libpng=system"
+      "--with-zlib=system"
+      "--with-lcms=system"
+      "--with-stdc++lib=dynamic"
+    ]
+    ++ lib.optional headless "--enable-headless-only"
+    ++ lib.optional (!headless && enableJavaFX) "--with-import-modules=${openjfx}";
+
+    separateDebugInfo = true;
+
+    env.NIX_CFLAGS_COMPILE = "-Wno-error";
+
+    NIX_LDFLAGS = toString (lib.optionals (!headless) [
+      "-lfontconfig"
+      "-lcups"
+      "-lXinerama"
+      "-lXrandr"
+      "-lmagic"
+    ] ++ lib.optionals (!headless && enableGnome2) [
+      "-lgtk-3"
+      "-lgio-2.0"
+      "-lgnomevfs-2"
+      "-lgconf-2"
+    ]);
+
+    # -j flag is explicitly rejected by the build system:
+    #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+    # Note: it does not make build sequential. Build system
+    # still runs in parallel.
+    enableParallelBuilding = false;
+
+    buildFlags = [ "images" ];
+
+    installPhase = ''
+      mkdir -p $out/lib
+
+      mv build/*/images/jdk $out/lib/openjdk
+
+      # Remove some broken manpages.
+      rm -rf $out/lib/openjdk/man/ja*
+
+      # Mirror some stuff in top-level.
+      mkdir -p $out/share
+      ln -s $out/lib/openjdk/include $out/include
+      ln -s $out/lib/openjdk/man $out/share/man
+
+      # IDEs use the provided src.zip to navigate the Java codebase (https://github.com/NixOS/nixpkgs/pull/95081)
+      ln -s $out/lib/openjdk/lib/src.zip $out/lib/src.zip
+
+      # jni.h expects jni_md.h to be in the header search path.
+      ln -s $out/include/linux/*_md.h $out/include/
+
+      # Remove crap from the installation.
+      rm -rf $out/lib/openjdk/demo
+      ${lib.optionalString headless ''
+        rm $out/lib/openjdk/lib/{libjsound,libfontmanager}.so
+      ''}
+
+      ln -s $out/lib/openjdk/bin $out/bin
+    '';
+
+    preFixup = ''
+      # Propagate the setJavaClassPath setup hook so that any package
+      # that depends on the JDK has $CLASSPATH set up properly.
+      mkdir -p $out/nix-support
+      #TODO or printWords?  cf https://github.com/NixOS/nixpkgs/pull/27427#issuecomment-317293040
+      echo -n "${setJavaClassPath}" > $out/nix-support/propagated-build-inputs
+
+      # Set JAVA_HOME automatically.
+      mkdir -p $out/nix-support
+      cat <<EOF > $out/nix-support/setup-hook
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out/lib/openjdk; fi
+      EOF
+    '';
+
+    postFixup = ''
+      # Build the set of output library directories to rpath against
+      LIBDIRS=""
+      for output in $(getAllOutputNames); do
+        if [ "$output" = debug ]; then continue; fi
+        LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort -u | tr '\n' ':'):$LIBDIRS"
+      done
+      # Add the local library paths to remove dependencies on the bootstrap
+      for output in $(getAllOutputNames); do
+        if [ "$output" = debug ]; then continue; fi
+        OUTPUTDIR=$(eval echo \$$output)
+        BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
+        echo "$BINLIBS" | while read i; do
+          patchelf --set-rpath "$LIBDIRS:$(patchelf --print-rpath "$i")" "$i" || true
+          patchelf --shrink-rpath "$i" || true
+        done
+      done
+    '';
+
+    disallowedReferences = [ openjdk-bootstrap ];
+
+    pos = builtins.unsafeGetAttrPos "feature" version;
+    meta = import ./meta.nix lib version.feature;
+
+    passthru = {
+      architecture = "";
+      home = "${openjdk}/lib/openjdk";
+      inherit gtk3;
+    };
+  };
+in
+openjdk

pkgs/development/compilers/openjdk/openjfx/22.nix

@@ -0,0 +1,126 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, fetchpatch
+, writeText
+, openjdk21_headless
+, gradle
+, pkg-config
+, perl
+, cmake
+, gperf
+, gtk2
+, gtk3
+, libXtst
+, libXxf86vm
+, glib
+, alsa-lib
+, ffmpeg_4
+, python3
+, ruby
+, icu68
+, withMedia ? true
+, withWebKit ? false
+}:
+
+let
+  major = "22";
+  update = "";
+  build = "+30";
+  repover = "${major}${update}${build}";
+
+  makePackage = args: stdenv.mkDerivation ({
+    version = "${major}${update}${build}";
+
+    src = fetchFromGitHub {
+      owner = "openjdk";
+      repo = "jfx";
+      rev = repover;
+      hash = "sha256-sZF7ZPC0kgTTxWgtkxmGtOlfroGPGVZcMw0/wSTJUxQ=";
+    };
+
+    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 icu68 ];
+    nativeBuildInputs = [ gradle perl pkg-config cmake gperf python3 ruby ];
+
+    dontUseCmakeConfigure = true;
+
+    config = writeText "gradle.properties" (''
+      CONF = Release
+      JDK_HOME = ${openjdk21_headless.home}
+    '' + args.gradleProperties or "");
+
+    buildPhase = ''
+      runHook preBuild
+
+      export NUMBER_OF_PROCESSORS=$NIX_BUILD_CORES
+      export GRADLE_USER_HOME=$(mktemp -d)
+      ln -s $config gradle.properties
+      export NIX_CFLAGS_COMPILE="$(pkg-config --cflags glib-2.0) $NIX_CFLAGS_COMPILE"
+      gradle --no-daemon $gradleFlags sdk
+
+      runHook postBuild
+    '';
+  } // args);
+
+  # Fake build to pre-download deps into fixed-output derivation.
+  # We run nearly full build because I see no other way to download everything that's needed.
+  # Anyone who knows a better way?
+  deps = makePackage {
+    pname = "openjfx-deps";
+
+    # perl code mavenizes pathes (com.squareup.okio/okio/1.13.0/a9283170b7305c8d92d25aff02a6ab7e45d06cbe/okio-1.13.0.jar -> com/squareup/okio/okio/1.13.0/okio-1.13.0.jar)
+    installPhase = ''
+      find $GRADLE_USER_HOME -type f -regex '.*/modules.*\.\(jar\|pom\)' \
+        | perl -pe 's#(.*/([^/]+)/([^/]+)/([^/]+)/[0-9a-f]{30,40}/([^/\s]+))$# ($x = $2) =~ tr|\.|/|; "install -Dm444 $1 \$out/$x/$3/$4/$5" #e' \
+        | sh
+      rm -rf $out/tmp
+    '';
+
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+    outputHash = "sha256-2I7LvYcudlB4DKJ/wEiTjY6nICUxUY52euosUqOA+Bs=";
+  };
+
+in
+makePackage {
+  pname = "openjfx-modular-sdk";
+
+  gradleProperties = ''
+    COMPILE_MEDIA = ${lib.boolToString withMedia}
+    COMPILE_WEBKIT = ${lib.boolToString withWebKit}
+  '';
+
+  preBuild = ''
+    swtJar="$(find ${deps} -name org.eclipse.swt\*.jar)"
+    substituteInPlace build.gradle \
+      --replace 'mavenCentral()' 'mavenLocal(); maven { url uri("${deps}") }' \
+      --replace 'name: SWT_FILE_NAME' "files('$swtJar')"
+  '';
+
+  installPhase = ''
+    cp -r build/modular-sdk $out
+  '';
+
+  stripDebugList = [ "." ];
+
+  postFixup = ''
+    # Remove references to bootstrap.
+    export openjdkOutPath='${openjdk21_headless.outPath}'
+    find "$out" -name \*.so | while read lib; do
+      new_refs="$(patchelf --print-rpath "$lib" | perl -pe 's,:?\Q$ENV{openjdkOutPath}\E[^:]*,,')"
+      patchelf --set-rpath "$new_refs" "$lib"
+    done
+  '';
+
+  disallowedReferences = [ openjdk21_headless openjdk21_headless ];
+
+  passthru.deps = deps;
+
+  meta = with lib; {
+    homepage = "https://openjdk.org/projects/openjfx/";
+    license = licenses.gpl2Classpath;
+    description = "The next-generation Java client toolkit";
+    maintainers = with maintainers; [ abbradar ];
+    platforms = platforms.unix;
+  };
+}

pkgs/development/compilers/zulu/22.nix

@@ -0,0 +1,42 @@
+{ callPackage
+, enableJavaFX ? false
+, ...
+}@args:
+
+callPackage ./common.nix ({
+  # Details from https://www.azul.com/downloads/?version=java-22-lts&package=jdk
+  # Note that the latest build may differ by platform
+  dists = {
+    x86_64-linux = {
+      zuluVersion = "22.28.91";
+      jdkVersion = "22.0.0";
+      hash =
+        if enableJavaFX then "sha256-HvMiODsz+puu1xtxG2RRXH/PWCk91PGNZ7UcOd9orqQ="
+        else "sha256-HvMiODsz+puu1xtxG2RRXH/PWCk91PGNZ7UcOd9orqQ=";
+    };
+
+    aarch64-linux = {
+      zuluVersion = "22.28.91";
+      jdkVersion = "22.0.0";
+      hash =
+        if enableJavaFX then throw "JavaFX is not available for aarch64-linux"
+        else "sha256-3RLNNEbMk5wAZsQmbQj/jpx9iTL/yr9N3wL4t7m6c+s=";
+    };
+
+    x86_64-darwin = {
+      zuluVersion = "22.28.91";
+      jdkVersion = "22.0.0";
+      hash =
+        if enableJavaFX then "sha256-Y6PSNQjHRXukwux2sVbvpTIqT+Cg+KeG1C0iSEwyKZw="
+        else "sha256-Y6PSNQjHRXukwux2sVbvpTIqT+Cg+KeG1C0iSEwyKZw=";
+    };
+
+    aarch64-darwin = {
+      zuluVersion = "22.28.91";
+      jdkVersion = "22.0.0";
+      hash =
+        if enableJavaFX then "sha256-o0VkWB4+PzBmNNWy+FZlyjTgukBTe6owfydb3YNfEE0="
+        else "sha256-o0VkWB4+PzBmNNWy+FZlyjTgukBTe6owfydb3YNfEE0=";
+    };
+  };
+} // builtins.removeAttrs args [ "callPackage" ])

pkgs/development/libraries/flatpak/default.nix

@@ -97,6 +97,10 @@ stdenv.mkDerivation (finalAttrs: {
     # The icon validator needs to access the gdk-pixbuf loaders in the Nix store
     # and cannot bind FHS paths since those are not available on NixOS.
     finalAttrs.passthru.icon-validator-patch
+
+    # Try mounting fonts and icons from NixOS locations if FHS locations don't exist.
+    # https://github.com/NixOS/nixpkgs/issues/119433
+    ./fix-fonts-icons.patch
   ];
 
   nativeBuildInputs = [

pkgs/development/libraries/flatpak/fix-fonts-icons.patch

@@ -0,0 +1,87 @@
+diff --git a/common/flatpak-run.c b/common/flatpak-run.c
+index 94ad013..5c9f55e 100644
+--- a/common/flatpak-run.c
++++ b/common/flatpak-run.c
+@@ -871,6 +871,49 @@ out:
+   return res;
+ }
+ 
++static void
++get_nix_closure (GHashTable *closure, const gchar *source_path)
++{
++  if (g_file_test (source_path, G_FILE_TEST_IS_SYMLINK))
++    {
++      g_autofree gchar *path = g_malloc(PATH_MAX);
++      realpath(source_path, path);
++      if (g_str_has_prefix(path, "/nix/store/"))
++        {
++          *strchr(path + strlen("/nix/store/"), '/') = 0;
++          g_hash_table_add(closure, g_steal_pointer (&path));
++        }
++    }
++  else if (g_file_test (source_path, G_FILE_TEST_IS_DIR))
++    {
++      g_autoptr(GDir) dir = g_dir_open(source_path, 0, NULL);
++      const gchar *file_name;
++      while ((file_name = g_dir_read_name(dir)))
++        {
++          g_autofree gchar *path = g_build_filename (source_path, file_name, NULL);
++          get_nix_closure (closure, path);
++        }
++    }
++}
++
++static void
++add_nix_store_symlink_targets (FlatpakBwrap *bwrap, const gchar *source_path)
++{
++  GHashTable *closure = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, NULL);
++
++  get_nix_closure(closure, source_path);
++
++  GHashTableIter iter;
++  gpointer path;
++  g_hash_table_iter_init(&iter, closure);
++  while (g_hash_table_iter_next(&iter, &path, NULL))
++    {
++      flatpak_bwrap_add_args (bwrap, "--ro-bind", path, path, NULL);
++    }
++
++  g_hash_table_destroy(closure);
++}
++
+ static void
+ add_font_path_args (FlatpakBwrap *bwrap)
+ {
+@@ -898,6 +946,18 @@ add_font_path_args (FlatpakBwrap *bwrap)
+                               "\t<remap-dir as-path=\"%s\">/run/host/fonts</remap-dir>\n",
+                               SYSTEM_FONTS_DIR);
+     }
++  else if (g_file_test ("/run/current-system/sw/share/X11/fonts", G_FILE_TEST_EXISTS))
++    {
++      add_nix_store_symlink_targets (bwrap, "/run/current-system/sw/share/X11/fonts");
++      flatpak_bwrap_add_args (bwrap,
++                              "--ro-bind",
++                              "/run/current-system/sw/share/X11/fonts",
++                              "/run/host/fonts",
++                              NULL);
++      g_string_append_printf (xml_snippet,
++                              "\t<remap-dir as-path=\"%s\">/run/host/fonts</remap-dir>\n",
++                              "/run/current-system/sw/share/X11/fonts");
++    }
+ 
+   if (g_file_test ("/usr/local/share/fonts", G_FILE_TEST_EXISTS))
+     {
+@@ -998,6 +1058,13 @@ add_icon_path_args (FlatpakBwrap *bwrap)
+                               "--ro-bind", "/usr/share/icons", "/run/host/share/icons",
+                               NULL);
+     }
++  else if (g_file_test ("/run/current-system/sw/share/icons", G_FILE_TEST_IS_DIR))
++    {
++      add_nix_store_symlink_targets (bwrap, "/run/current-system/sw/share/icons");
++      flatpak_bwrap_add_args (bwrap,
++                              "--ro-bind", "/run/current-system/sw/share/icons", "/run/host/share/icons",
++                              NULL);
++    }
+ 
+   user_icons_path = g_build_filename (g_get_user_data_dir (), "icons", NULL);
+   user_icons = g_file_new_for_path (user_icons_path);

pkgs/development/libraries/gfxstream/default.nix

@@ -1,5 +1,5 @@
-{ lib, stdenv, fetchFromGitiles, meson, ninja, pkg-config, python3
-, aemu, libdrm, libglvnd, vulkan-headers, vulkan-loader, xorg
+{ lib, stdenv, fetchFromGitiles, fetchpatch, meson, ninja, pkg-config, python3
+, aemu, darwin, libdrm, libglvnd, vulkan-headers, vulkan-loader, xorg
 }:
 
 stdenv.mkDerivation {
@@ -12,14 +12,45 @@ stdenv.mkDerivation {
     hash = "sha256-IYXkaHZPEYIE9KW731GN6x6yRS+FYtP1zyHcaSofhIM=";
   };
 
+  patches = [
+    # Make libdrm an optional dependency, which is required to build on Darwin.
+    (fetchpatch {
+      url = "https://android.googlesource.com/platform/hardware/google/gfxstream/+/a8df2a3eb099b419a7b3638e68ea30b4cffb751b%5E%21/?format=TEXT";
+      decode = "base64 -d";
+      hash = "sha256-shjeNuxtQokscCGBKEUbOPKOWRELBAnHFNj3Y5w87Nw=";
+    })
+  ];
+
+  # Ensure that meson can find an Objective-C compiler on Darwin.
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    substituteInPlace meson.build \
+      --replace-fail "project('gfxstream_backend', 'cpp', 'c'" "project('gfxstream_backend', 'cpp', 'c', 'objc'"
+  '';
+
   nativeBuildInputs = [ meson ninja pkg-config python3 ];
   buildInputs = [ aemu libglvnd vulkan-headers vulkan-loader xorg.libX11 ]
-    ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform libdrm) libdrm;
+    ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform libdrm) [ libdrm ]
+    ++ lib.optionals stdenv.isDarwin [
+      darwin.apple_sdk.frameworks.Cocoa
+      darwin.apple_sdk.frameworks.CoreGraphics
+      darwin.apple_sdk.frameworks.IOKit
+      darwin.apple_sdk.frameworks.IOSurface
+      darwin.apple_sdk.frameworks.OpenGL
+      darwin.apple_sdk.frameworks.QuartzCore
+    ];
+
+  env = lib.optionalAttrs stdenv.isDarwin {
+    NIX_LDFLAGS = toString [
+      "-framework Cocoa"
+      "-framework IOKit"
+      "-framework IOSurface"
+      "-framework OpenGL"
+      "-framework QuartzCore"
+      "-needed-lvulkan"
+    ];
+  };
 
   # dlopens libvulkan.
-  #
-  # XXX: Unsure if this is required on Darwin.  If it is, it probably
-  #      needs to be done using install_name_tool.
   preConfigure = lib.optionalString (!stdenv.isDarwin) ''
     mesonFlagsArray=(-Dcpp_link_args="-Wl,--push-state -Wl,--no-as-needed -lvulkan -Wl,--pop-state")
   '';

pkgs/development/libraries/java/jffi/default.nix

@@ -1,40 +1,66 @@
-{ lib, stdenv, fetchFromGitHub, jdk, jre, ant, libffi, texinfo, pkg-config }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, ant
+, jdk
+, libffi
+, pkg-config
+, texinfo
+, stripJavaArchivesHook
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "jffi";
   version = "1.3.13";
 
   src = fetchFromGitHub {
     owner = "jnr";
     repo = "jffi";
-    rev = "jffi-${version}";
-    sha256 = "sha256-aBQkkZyXZkaJc4sr/jHnIRaJYP116u4Jqsr9XXzfOBA=";
+    rev = "jffi-${finalAttrs.version}";
+    hash = "sha256-aBQkkZyXZkaJc4sr/jHnIRaJYP116u4Jqsr9XXzfOBA=";
   };
 
-  nativeBuildInputs = [ jdk ant texinfo pkg-config ];
-  buildInputs = [ libffi ] ;
+  nativeBuildInputs = [
+    ant
+    jdk
+    pkg-config
+    texinfo
+    stripJavaArchivesHook
+  ];
+
+  buildInputs = [ libffi ];
+
+  # The pkg-config script in the build.xml doesn't work propery
+  # set the lib path manually to work around this.
+  env.LIBFFI_LIBS = "${libffi}/lib/libffi${stdenv.hostPlatform.extensions.sharedLibrary}";
+  env.ANT_ARGS = "-Duse.system.libffi=1";
 
   buildPhase = ''
-    # The pkg-config script in the build.xml doesn't work propery
-    # set the lib path manually to work around this.
-    export LIBFFI_LIBS="${libffi}/lib/libffi.so"
-
-    ant -Duse.system.libffi=1 jar
-    ant -Duse.system.libffi=1 archive-platform-jar
-  '';
-
-  installPhase = ''
-    mkdir -p $out/share/java
-    cp -r dist/* $out/share/java
+    runHook preBuild
+    ant jar
+    ant archive-platform-jar
+    runHook postBuild
   '';
 
   doCheck = true;
-  checkPhase = ''
-    # The pkg-config script in the build.xml doesn't work propery
-    # set the lib path manually to work around this.
-    export LIBFFI_LIBS="${libffi}/lib/libffi.so"
 
-    ant -Duse.system.libffi=1 test
+  checkPhase = ''
+    runHook preCheck
+    ant test
+    runHook postCheck
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm644 dist/*.jar -t $out/share/java
+    runHook postInstall
+  '';
+
+  # nix can't detect libffi as a dependency inside the jar file, so we create
+  # a dummy file with the path to libffi, to make sure that nix knows about it
+  postFixup = ''
+    mkdir -p $out/nix-support
+    echo ${libffi} > $out/nix-support/depends
   '';
 
   meta = with lib; {
@@ -45,4 +71,4 @@ stdenv.mkDerivation rec {
     license = licenses.asl20;
     maintainers = with maintainers; [ bachp ];
   };
-}
+})

pkgs/development/libraries/raylib/default.nix

@@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "raylib";
-  version = "4.5.0";
+  version = "5.0";
 
   src = fetchFromGitHub {
     owner = "raysan5";
     repo = "raylib";
     rev = finalAttrs.version;
-    hash = "sha256-Uqqzq5shDp0AgSBT5waHBNUkEu0LRj70SNOlR5R2yAM=";
+    hash = "sha256-gEstNs3huQ1uikVXOW4uoYnIDr5l8O9jgZRTX1mkRww=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -56,20 +56,17 @@ stdenv.mkDerivation (finalAttrs: {
   passthru.tests = [ raylib-games ];
 
   patches = [
-    # Patch version in CMakeList to 4.5.0
-    # Remove this when updating to a new revision
+    # Patch version in CMakeLists.txt to 5.0.0
+    # The library author doesn't use cmake, so when updating this package please
+    # check that the resulting library extension matches the version
+    # and remove/update this patch (resulting library name should match
+    # libraylib.so.${finalAttrs.version}
     (fetchpatch {
-      url = "https://github.com/raysan5/raylib/commit/0d4db7ad7f6fd442ed165ebf8ab8b3f4033b04e7.patch";
-      hash = "sha256-RGokbQAwJAZm2FU2VNwraE3xko8E+RLLFjUfDRXeKhA=";
+      url = "https://github.com/raysan5/raylib/commit/032cc497ca5aaca862dc926a93c2a45ed8017737.patch";
+      hash = "sha256-qsX5AwyQaGoRsbdszOO7tUF9dR+AkEFi4ebNkBVHNEY=";
     })
   ];
 
-  # fix libasound.so/libpulse.so not being found
-  preFixup = ''
-    ${lib.optionalString alsaSupport "patchelf --add-needed ${alsa-lib}/lib/libasound.so $out/lib/libraylib.so.${finalAttrs.version}"}
-    ${lib.optionalString pulseSupport "patchelf --add-needed ${libpulseaudio}/lib/libpulse.so $out/lib/libraylib.so.${finalAttrs.version}"}
-  '';
-
   meta = with lib; {
     description = "A simple and easy-to-use library to enjoy videogames programming";
     homepage = "https://www.raylib.com/";

pkgs/development/libraries/rutabaga_gfx/darwin-install.patch

@@ -0,0 +1,31 @@
+diff --git a/rutabaga_gfx/ffi/Makefile b/rutabaga_gfx/ffi/Makefile
+index f8c7820bf..e88a6c308 100644
+--- a/rutabaga_gfx/ffi/Makefile
++++ b/rutabaga_gfx/ffi/Makefile
+@@ -47,24 +47,16 @@ build:
+ 	cargo build $(gfxstream_feature) $(release)
+ 
+ install: build
+-ifeq ($(UNAME), Linux)
+ 	install -D -m 755 $(OUT)/$(LIB_NAME) $(DESTDIR)$(libdir)/$(LIB_NAME).$(RUTABAGA_VERSION)
+-endif
+ ifeq ($(UNAME), Darwin)
+-	install_name_tool -id $(DESTDIR)$(libdir)/$(LIB_NAME).$(RUTABAGA_VERSION) $(DESTDIR)$(libdir)/$(LIB_NAME)
++	install_name_tool -id $(DESTDIR)$(libdir)/$(LIB_NAME).$(RUTABAGA_VERSION) $(DESTDIR)$(libdir)/$(LIB_NAME).$(RUTABAGA_VERSION)
+ endif
+ 
+ 	ln -sf $(LIB_NAME).$(RUTABAGA_VERSION) $(DESTDIR)$(libdir)/$(LIB_NAME).$(RUTABAGA_VERSION_MAJOR)
+ 	ln -sf $(LIB_NAME).$(RUTABAGA_VERSION) $(DESTDIR)$(libdir)/$(LIB_NAME)
+ 
+-ifeq ($(UNAME), Linux)
+ 	install -D -m 0644 $(SRC)/share/rutabaga_gfx_ffi.pc $(DESTDIR)$(libdir)/pkgconfig/rutabaga_gfx_ffi.pc
+ 	install -D -m 0644 $(SRC)/include/rutabaga_gfx_ffi.h $(DESTDIR)$(includedir)/rutabaga_gfx_ffi.h
+-endif
+-ifeq ($(UNAME), Darwin)
+-	install -m 0644 $(SRC)/share/rutabaga_gfx_ffi.pc $(DESTDIR)$(libdir)/pkgconfig/rutabaga_gfx_ffi.pc
+-	install -m 0644 $(SRC)/include/rutabaga_gfx_ffi.h $(DESTDIR)$(includedir)/rutabaga_gfx_ffi.h
+-endif
+ 
+ clean:
+ 	cargo clean $(release)
+

pkgs/development/libraries/rutabaga_gfx/default.nix

@@ -8,6 +8,7 @@
 , aemu
 , gfxstream
 , libdrm
+, libiconv
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -29,10 +30,19 @@ stdenv.mkDerivation (finalAttrs: {
       decode = "base64 -d";
       hash = "sha256-Ji1bK7jnRlg0OpDfCLcTHfPSiz3zYcdgsWL4n3EoIYI=";
     })
+    # Fix error in Makefile where it uses eight spaces instead of a tab
+    # https://chromium-review.googlesource.com/c/crosvm/crosvm/+/4863380
+    (fetchpatch {
+      url = "https://chromium.googlesource.com/crosvm/crosvm/+/fc415bccc43d36f63a2fd4c28878591bb1053450%5E%21/?format=TEXT";
+      decode = "base64 -d";
+      hash = "sha256-SLzlZ4o1+R2bGTPvA0a5emq97hOIIIHrubFhcQjqYwg=";
+    })
+    # Install the dylib on Darwin.
+    ./darwin-install.patch
   ];
 
   nativeBuildInputs = [ cargo pkg-config rustPlatform.cargoSetupHook ];
-  buildInputs = lib.optionals (lib.meta.availableOn stdenv.hostPlatform gfxstream) ([
+  buildInputs = [ libiconv ] ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform gfxstream) ([
     aemu
     gfxstream
   ] ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform libdrm) [

pkgs/development/python-modules/aiopvpc/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "aiopvpc";
-  version = "4.3.0";
+  version = "4.3.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "azogue";
     repo = "aiopvpc";
     rev = "refs/tags/v${version}";
-    hash = "sha256-8CNmrE3EMFg/bCrdI+K/8f0MRzKtGI74ILFMuSg1Ivo=";
+    hash = "sha256-1xeXfhoXRfJ7vrpRPeYmwcAGjL09iNCOm/f4pPvuZLU=";
   };
 
   postPatch = ''
@@ -31,11 +31,11 @@ buildPythonPackage rec {
       --replace-fail " --cov --cov-report term --cov-report html" ""
   '';
 
-  nativeBuildInputs = [
+  build-system = [
     poetry-core
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     async-timeout
   ] ++ lib.optionals (pythonOlder "3.9") [