Merge master into staging-next

2023-10-31 18:01:02 +00:00
parent 2fd5f8dd7a 2784272f5b
commit 81270bbdcf
97 changed files with 3953 additions and 1611 deletions
@@ -7,25 +7,81 @@ assignees: ''

 ---

-Building this package twice does not produce the bit-by-bit identical result each time, making it harder to detect CI breaches. You can read more about this at https://reproducible-builds.org/ .
+<!--
+Hello dear reporter,

-Fixing bit-by-bit reproducibility also has additional advantages, such as avoiding hard-to-reproduce bugs, making content-addressed storage more effective and reducing rebuilds in such systems.
+Thank you for bringing attention to this issue. Your insights are valuable to
+us, and we appreciate the time you took to document the problem.
+
+I wanted to kindly point out that in this issue template, it would be beneficial
+to replace the placeholder `<package>` with the actual, canonical name of the
+package you're reporting the issue for. Doing so will provide better context and
+facilitate quicker troubleshooting for anyone who reads this issue in the
+future.
+
+Best regards
+-->
+
+Building this package multiple times does not yield bit-by-bit identical
+results, complicating the detection of Continuous Integration (CI) breaches. For
+more information on this issue, visit
+[reproducible-builds.org](https://reproducible-builds.org/).
+
+Fixing bit-by-bit reproducibility also has additional advantages, such as
+avoiding hard-to-reproduce bugs, making content-addressed storage more effective
+and reducing rebuilds in such systems.

 ### Steps To Reproduce

-```
-nix-build '<nixpkgs>' -A ... && nix-build '<nixpkgs>' -A ... --check --keep-failed
-```
+In the following steps, replace `<package>` with the canonical name of the
+package.

-If this command completes successfully, no differences where found. However, when it ends in `error: derivation '<X>' may not be deterministic: output '<Y>' differs from '<Z>'`, you can use `diffoscope <Y> <Z>` to analyze the differences in the output of the two builds.
+#### 1. Build the package

-To view the build log of the build that produced the artifact in the binary cache:
+This step will build the package. Specific arguments are passed to the command
+to keep the build artifacts so we can compare them in case of differences.
+
+Execute the following command:

 ```
-nix-store --read-log $(nix-instantiate '<nixpkgs>' -A ...)
+nix-build '<nixpkgs>' -A <package> && nix-build '<nixpkgs>' -A <package> --check --keep-failed
+```
+
+Or using the new command line style:
+
+```
+nix build nixpkgs#<package> && nix build nixpkgs#<package> --rebuild --keep-failed
+```
+
+#### 2. Compare the build artifacts
+
+If the previous command completes successfully, no differences were found and
+there's nothing to do, builds are reproducible.
+If it terminates with the error message `error: derivation '<X>' may not be
+deterministic: output '<Y>' differs from '<Z>'`, use `diffoscope` to investigate
+the discrepancies between the two build outputs. You may need to add the
+`--exclude-directory-metadata recursive` option to ignore files and directories
+metadata (*e.g. timestamp*) differences.
+
+```
+nix run nixpkgs#diffoscopeMinimal -- --exclude-directory-metadata recursive <Y> <Z>
+```
+
+#### 3. Examine the build log
+
+To examine the build log, use:
+
+```
+nix-store --read-log $(nix-instantiate '<nixpkgs>' -A <package>)
+```
+
+Or with the new command line style:
+
+```
+nix log $(nix path-info --derivation nixpkgs#<package>)
 ```

 ### Additional context

-(please share the relevant fragment of the diffoscope output here,
-and any additional analysis you may have done)
+(please share the relevant fragment of the diffoscope output here, and any
+additional analysis you may have done)
@@ -162,5 +162,12 @@ rec {
       getExe' pkgs.imagemagick "convert"
       => "/nix/store/5rs48jamq7k6sal98ymj9l4k2bnwq515-imagemagick-7.1.1-15/bin/convert"
  */
-  getExe' = x: y: "${lib.getBin x}/bin/${y}";
+  getExe' = x: y:
+    assert lib.assertMsg (lib.isDerivation x)
+      "lib.meta.getExe': The first argument is of type ${builtins.typeOf x}, but it should be a derivation instead.";
+    assert lib.assertMsg (lib.isString y)
+     "lib.meta.getExe': The second argument is of type ${builtins.typeOf y}, but it should be a string instead.";
+    assert lib.assertMsg (builtins.length (lib.splitString "/" y) == 1)
+     "lib.meta.getExe': The second argument \"${y}\" is a nested path with a \"/\" character, but it should just be the name of the executable instead.";
+    "${lib.getBin x}/bin/${y}";
 }
@@ -1906,4 +1906,32 @@ runTests {
    expr = (with types; either int (listOf (either bool str))).description;
    expected = "signed integer or list of (boolean or string)";
  };
+
+# Meta
+  testGetExe'Output = {
+    expr = getExe' {
+      type = "derivation";
+      out = "somelonghash";
+      bin = "somelonghash";
+    } "executable";
+    expected = "somelonghash/bin/executable";
+  };
+
+  testGetExeOutput = {
+    expr = getExe {
+      type = "derivation";
+      out = "somelonghash";
+      bin = "somelonghash";
+      meta.mainProgram = "mainProgram";
+    };
+    expected = "somelonghash/bin/mainProgram";
+  };
+
+  testGetExe'FailureFirstArg = testingThrow (
+    getExe' "not a derivation" "executable"
+  );
+
+  testGetExe'FailureSecondArg = testingThrow (
+    getExe' { type = "derivation"; } "dir/executable"
+  );
 }
@@ -6111,7 +6111,7 @@
  };
  fugi = {
    email = "me@fugi.dev";
-    github = "FugiMuffi";
+    github = "fugidev";
    githubId = 21362942;
    name = "Fugi";
  };
@@ -8,4 +8,5 @@ installing.chapter.md
 changing-config.chapter.md
 upgrading.chapter.md
 building-nixos.chapter.md
+building-images-via-systemd-repart.chapter.md
 ```
@@ -38,6 +38,8 @@
  true`. This is generally safe behavior, but for anyone needing to opt out from
  the check `users.users.${USERNAME}.ignoreShellProgramCheck = true` will do the job.

+- Cassandra now defaults to 4.x, updated from 3.11.x.
+
 ## New Services {#sec-release-23.11-new-services}

 - [MCHPRS](https://github.com/MCHPR/MCHPRS), a multithreaded Minecraft server built for redstone. Available as [services.mchprs](#opt-services.mchprs.enable).
@@ -351,6 +353,8 @@

 - `service.borgmatic.settings.location` and `services.borgmatic.configurations.<name>.location` are deprecated, please move your options out of sections to the global scope.

+- `privacyidea` (and the corresponding `privacyidea-ldap-proxy`) has been removed from nixpkgs because it has severely outdated dependencies that became unmaintainable with nixpkgs' python package-set.
+
 - `dagger` was removed because using a package called `dagger` and packaging it from source violates their trademark policy.

 - `win-virtio` package was renamed to `virtio-win` to be consistent with the upstream package name.
@@ -508,6 +512,8 @@ The module update takes care of the new config syntax and the data itself (user

 - `fusuma` now enables the following plugins: [appmatcher](https://github.com/iberianpig/fusuma-plugin-appmatcher), [keypress](https://github.com/iberianpig/fusuma-plugin-keypress), [sendkey](https://github.com/iberianpig/fusuma-plugin-sendkey), [tap](https://github.com/iberianpig/fusuma-plugin-tap) and [wmctrl](https://github.com/iberianpig/fusuma-plugin-wmctrl).

+- `services.bitcoind` now properly respects the `enable` option.
+
 ## Nixpkgs internals {#sec-release-23.11-nixpkgs-internals}

 - The use of `sourceRoot = "source";`, `sourceRoot = "source/subdir";`, and similar lines in package derivations using the default `unpackPhase` is deprecated as it requires `unpackPhase` to always produce a directory named "source". Use `sourceRoot = src.name`, `sourceRoot = "${src.name}/subdir";`, or `setSourceRoot = "sourceRoot=$(echo */subdir)";` or similar instead.
@@ -21,11 +21,12 @@ in rec {
        { preferLocalBuild = true;
          allowSubstitutes = false;
          inherit (unit) text;
+          passAsFile = [ "text" ];
        }
        ''
          name=${shellEscape name}
          mkdir -p "$out/$(dirname -- "$name")"
-          echo -n "$text" > "$out/$name"
+          mv "$textPath" "$out/$name"
        ''
    else
      pkgs.runCommand "unit-${mkPathSafeName name}-disabled"
@@ -99,7 +99,7 @@ in

    systemd.tmpfiles.rules = lib.mkIf cfg.channel.enable [
      "f /root/.nix-channels -"
-      ''w "/root/.nix-channels" - - - - "${config.system.defaultChannel} nixos\n"''
+      ''w+ "/root/.nix-channels" - - - - ${config.system.defaultChannel} nixos\n''
    ];
  };
 }
@@ -34,12 +34,13 @@ let
          };
        });
        default = { };
-        example = lib.literalExpression '' {
-          "/EFI/BOOT/BOOTX64.EFI".source =
-            "''${pkgs.systemd}/lib/systemd/boot/efi/systemd-bootx64.efi";
+        example = lib.literalExpression ''
+          {
+            "/EFI/BOOT/BOOTX64.EFI".source =
+              "''${pkgs.systemd}/lib/systemd/boot/efi/systemd-bootx64.efi";

-          "/loader/entries/nixos.conf".source = systemdBootEntry;
-        }
+            "/loader/entries/nixos.conf".source = systemdBootEntry;
+          }
        '';
        description = lib.mdDoc "The contents to end up in the filesystem image.";
      };
@@ -96,26 +97,27 @@ in
    partitions = lib.mkOption {
      type = with lib.types; attrsOf (submodule partitionOptions);
      default = { };
-      example = lib.literalExpression '' {
-        "10-esp" = {
-          contents = {
-            "/EFI/BOOT/BOOTX64.EFI".source =
-              "''${pkgs.systemd}/lib/systemd/boot/efi/systemd-bootx64.efi";
-          }
-          repartConfig = {
-            Type = "esp";
-            Format = "fat";
+      example = lib.literalExpression ''
+        {
+          "10-esp" = {
+            contents = {
+              "/EFI/BOOT/BOOTX64.EFI".source =
+                "''${pkgs.systemd}/lib/systemd/boot/efi/systemd-bootx64.efi";
+            }
+            repartConfig = {
+              Type = "esp";
+              Format = "fat";
+            };
+          };
+          "20-root" = {
+            storePaths = [ config.system.build.toplevel ];
+            repartConfig = {
+              Type = "root";
+              Format = "ext4";
+              Minimize = "guess";
+            };
          };
        };
-        "20-root" = {
-          storePaths = [ config.system.build.toplevel ];
-          repartConfig = {
-            Type = "root";
-            Format = "ext4";
-            Minimize = "guess";
-          };
-        };
-      };
      '';
      description = lib.mdDoc ''
        Specify partitions as a set of the names of the partitions with their
@@ -206,10 +208,7 @@ in
          | tee repart-output.json
      '';

-    meta = {
-      maintainers = with lib.maintainers; [ nikstur ];
-      doc = ./repart.md;
-    };
+    meta.maintainers = with lib.maintainers; [ nikstur ];

  };
 }
@@ -1176,7 +1176,6 @@
  ./services/security/opensnitch.nix
  ./services/security/pass-secret-service.nix
  ./services/security/physlock.nix
-  ./services/security/privacyidea.nix
  ./services/security/shibboleth-sp.nix
  ./services/security/sks.nix
  ./services/security/sshguard.nix
@@ -1531,5 +1530,9 @@
  ./virtualisation/waydroid.nix
  ./virtualisation/xe-guest-utilities.nix
  ./virtualisation/xen-dom0.nix
-  { documentation.nixos.extraModules = [ ./virtualisation/qemu-vm.nix ]; }
+  { documentation.nixos.extraModules = [
+    ./virtualisation/qemu-vm.nix
+    ./image/repart.nix
+    ];
+  }
 ]
@@ -54,7 +54,7 @@ in {
  };

  imports = [
-    (lib.mkRemovedOptionModule ["programs" "direnv" "persistDerivations"] "persistDerivations was removed as it is on longer necessary")
+    (lib.mkRemovedOptionModule ["programs" "direnv" "persistDerivations"] "persistDerivations was removed as it is no longer necessary")
  ];

  config = lib.mkIf cfg.enable {
@@ -3,8 +3,7 @@
 with lib;

 let
-
-  eachBitcoind = config.services.bitcoind;
+  eachBitcoind = filterAttrs (bitcoindName: cfg: cfg.enable) config.services.bitcoind;

  rpcUserOpts = { name, ... }: {
    options = {
@@ -1,458 +0,0 @@
-{ config, lib, options, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.services.privacyidea;
-  opt = options.services.privacyidea;
-
-  uwsgi = pkgs.uwsgi.override { plugins = [ "python3" ]; python3 = pkgs.python310; };
-  python = uwsgi.python3;
-  penv = python.withPackages (const [ pkgs.privacyidea ]);
-  logCfg = pkgs.writeText "privacyidea-log.cfg" ''
-    [formatters]
-    keys=detail
-
-    [handlers]
-    keys=stream
-
-    [formatter_detail]
-    class=privacyidea.lib.log.SecureFormatter
-    format=[%(asctime)s][%(process)d][%(thread)d][%(levelname)s][%(name)s:%(lineno)d] %(message)s
-
-    [handler_stream]
-    class=StreamHandler
-    level=NOTSET
-    formatter=detail
-    args=(sys.stdout,)
-
-    [loggers]
-    keys=root,privacyidea
-
-    [logger_privacyidea]
-    handlers=stream
-    qualname=privacyidea
-    level=INFO
-
-    [logger_root]
-    handlers=stream
-    level=ERROR
-  '';
-
-  piCfgFile = pkgs.writeText "privacyidea.cfg" ''
-    SUPERUSER_REALM = [ '${concatStringsSep "', '" cfg.superuserRealm}' ]
-    SQLALCHEMY_DATABASE_URI = 'postgresql+psycopg2:///privacyidea'
-    SECRET_KEY = '${cfg.secretKey}'
-    PI_PEPPER = '${cfg.pepper}'
-    PI_ENCFILE = '${cfg.encFile}'
-    PI_AUDIT_KEY_PRIVATE = '${cfg.auditKeyPrivate}'
-    PI_AUDIT_KEY_PUBLIC = '${cfg.auditKeyPublic}'
-    PI_LOGCONFIG = '${logCfg}'
-    ${cfg.extraConfig}
-  '';
-
-  renderValue = x:
-    if isList x then concatMapStringsSep "," (x: ''"${x}"'') x
-    else if isString x && hasInfix "," x then ''"${x}"''
-    else x;
-
-  ldapProxyConfig = pkgs.writeText "ldap-proxy.ini"
-    (generators.toINI {}
-      (flip mapAttrs cfg.ldap-proxy.settings
-        (const (mapAttrs (const renderValue)))));
-
-  privacyidea-token-janitor = pkgs.writeShellScriptBin "privacyidea-token-janitor" ''
-    exec -a privacyidea-token-janitor \
-      /run/wrappers/bin/sudo -u ${cfg.user} \
-      env PRIVACYIDEA_CONFIGFILE=${cfg.stateDir}/privacyidea.cfg \
-      ${penv}/bin/privacyidea-token-janitor $@
-  '';
-in
-
-{
-  options = {
-    services.privacyidea = {
-      enable = mkEnableOption (lib.mdDoc "PrivacyIDEA");
-
-      environmentFile = mkOption {
-        type = types.nullOr types.path;
-        default = null;
-        example = "/root/privacyidea.env";
-        description = lib.mdDoc ''
-          File to load as environment file. Environment variables
-          from this file will be interpolated into the config file
-          using `envsubst` which is helpful for specifying
-          secrets:
-          ```
-          { services.privacyidea.secretKey = "$SECRET"; }
-          ```
-
-          The environment-file can now specify the actual secret key:
-          ```
-          SECRET=veryverytopsecret
-          ```
-        '';
-      };
-
-      stateDir = mkOption {
-        type = types.str;
-        default = "/var/lib/privacyidea";
-        description = lib.mdDoc ''
-          Directory where all PrivacyIDEA files will be placed by default.
-        '';
-      };
-
-      superuserRealm = mkOption {
-        type = types.listOf types.str;
-        default = [ "super" "administrators" ];
-        description = lib.mdDoc ''
-          The realm where users are allowed to login as administrators.
-        '';
-      };
-
-      secretKey = mkOption {
-        type = types.str;
-        example = "t0p s3cr3t";
-        description = lib.mdDoc ''
-          This is used to encrypt the auth_token.
-        '';
-      };
-
-      pepper = mkOption {
-        type = types.str;
-        example = "Never know...";
-        description = lib.mdDoc ''
-          This is used to encrypt the admin passwords.
-        '';
-      };
-
-      encFile = mkOption {
-        type = types.str;
-        default = "${cfg.stateDir}/enckey";
-        defaultText = literalExpression ''"''${config.${opt.stateDir}}/enckey"'';
-        description = lib.mdDoc ''
-          This is used to encrypt the token data and token passwords
-        '';
-      };
-
-      auditKeyPrivate = mkOption {
-        type = types.str;
-        default = "${cfg.stateDir}/private.pem";
-        defaultText = literalExpression ''"''${config.${opt.stateDir}}/private.pem"'';
-        description = lib.mdDoc ''
-          Private Key for signing the audit log.
-        '';
-      };
-
-      auditKeyPublic = mkOption {
-        type = types.str;
-        default = "${cfg.stateDir}/public.pem";
-        defaultText = literalExpression ''"''${config.${opt.stateDir}}/public.pem"'';
-        description = lib.mdDoc ''
-          Public key for checking signatures of the audit log.
-        '';
-      };
-
-      adminPasswordFile = mkOption {
-        type = types.path;
-        description = lib.mdDoc "File containing password for the admin user";
-      };
-
-      adminEmail = mkOption {
-        type = types.str;
-        example = "admin@example.com";
-        description = lib.mdDoc "Mail address for the admin user";
-      };
-
-      extraConfig = mkOption {
-        type = types.lines;
-        default = "";
-        description = lib.mdDoc ''
-          Extra configuration options for pi.cfg.
-        '';
-      };
-
-      user = mkOption {
-        type = types.str;
-        default = "privacyidea";
-        description = lib.mdDoc "User account under which PrivacyIDEA runs.";
-      };
-
-      group = mkOption {
-        type = types.str;
-        default = "privacyidea";
-        description = lib.mdDoc "Group account under which PrivacyIDEA runs.";
-      };
-
-      tokenjanitor = {
-        enable = mkEnableOption (lib.mdDoc "automatic runs of the token janitor");
-        interval = mkOption {
-          default = "quarterly";
-          type = types.str;
-          description = lib.mdDoc ''
-            Interval in which the cleanup program is supposed to run.
-            See {manpage}`systemd.time(7)` for further information.
-          '';
-        };
-        action = mkOption {
-          type = types.enum [ "delete" "mark" "disable" "unassign" ];
-          description = lib.mdDoc ''
-            Which action to take for matching tokens.
-          '';
-        };
-        unassigned = mkOption {
-          default = false;
-          type = types.bool;
-          description = lib.mdDoc ''
-            Whether to search for **unassigned** tokens
-            and apply [](#opt-services.privacyidea.tokenjanitor.action)
-            onto them.
-          '';
-        };
-        orphaned = mkOption {
-          default = true;
-          type = types.bool;
-          description = lib.mdDoc ''
-            Whether to search for **orphaned** tokens
-            and apply [](#opt-services.privacyidea.tokenjanitor.action)
-            onto them.
-          '';
-        };
-      };
-
-      ldap-proxy = {
-        enable = mkEnableOption (lib.mdDoc "PrivacyIDEA LDAP Proxy");
-
-        configFile = mkOption {
-          type = types.nullOr types.path;
-          default = null;
-          description = lib.mdDoc ''
-            Path to PrivacyIDEA LDAP Proxy configuration (proxy.ini).
-          '';
-        };
-
-        user = mkOption {
-          type = types.str;
-          default = "pi-ldap-proxy";
-          description = lib.mdDoc "User account under which PrivacyIDEA LDAP proxy runs.";
-        };
-
-        group = mkOption {
-          type = types.str;
-          default = "pi-ldap-proxy";
-          description = lib.mdDoc "Group account under which PrivacyIDEA LDAP proxy runs.";
-        };
-
-        settings = mkOption {
-          type = with types; attrsOf (attrsOf (oneOf [ str bool int (listOf str) ]));
-          default = {};
-          description = lib.mdDoc ''
-            Attribute-set containing the settings for `privacyidea-ldap-proxy`.
-            It's possible to pass secrets using env-vars as substitutes and
-            use the option [](#opt-services.privacyidea.ldap-proxy.environmentFile)
-            to inject them via `envsubst`.
-          '';
-        };
-
-        environmentFile = mkOption {
-          default = null;
-          type = types.nullOr types.str;
-          description = lib.mdDoc ''
-            Environment file containing secrets to be substituted into
-            [](#opt-services.privacyidea.ldap-proxy.settings).
-          '';
-        };
-      };
-    };
-  };
-
-  config = mkMerge [
-
-    (mkIf cfg.enable {
-
-      assertions = [
-        {
-          assertion = cfg.tokenjanitor.enable -> (cfg.tokenjanitor.orphaned || cfg.tokenjanitor.unassigned);
-          message = ''
-            privacyidea-token-janitor has no effect if neither orphaned nor unassigned tokens
-            are to be searched.
-          '';
-        }
-      ];
-
-      environment.systemPackages = [ pkgs.privacyidea (hiPrio privacyidea-token-janitor) ];
-
-      services.postgresql.enable = mkDefault true;
-
-      systemd.services.privacyidea-tokenjanitor = mkIf cfg.tokenjanitor.enable {
-        environment.PRIVACYIDEA_CONFIGFILE = "${cfg.stateDir}/privacyidea.cfg";
-        path = [ penv ];
-        serviceConfig = {
-          CapabilityBoundingSet = [ "" ];
-          ExecStart = "${pkgs.writeShellScript "pi-token-janitor" ''
-            ${optionalString cfg.tokenjanitor.orphaned ''
-              echo >&2 "Removing orphaned tokens..."
-              privacyidea-token-janitor find \
-                --orphaned true \
-                --action ${cfg.tokenjanitor.action}
-            ''}
-            ${optionalString cfg.tokenjanitor.unassigned ''
-              echo >&2 "Removing unassigned tokens..."
-              privacyidea-token-janitor find \
-                --assigned false \
-                --action ${cfg.tokenjanitor.action}
-            ''}
-          ''}";
-          Group = cfg.group;
-          LockPersonality = true;
-          MemoryDenyWriteExecute = true;
-          ProtectHome = true;
-          ProtectHostname = true;
-          ProtectKernelLogs = true;
-          ProtectKernelModules = true;
-          ProtectKernelTunables = true;
-          ProtectSystem = "strict";
-          ReadWritePaths = cfg.stateDir;
-          Type = "oneshot";
-          User = cfg.user;
-          WorkingDirectory = cfg.stateDir;
-        };
-      };
-      systemd.timers.privacyidea-tokenjanitor = mkIf cfg.tokenjanitor.enable {
-        wantedBy = [ "timers.target" ];
-        timerConfig.OnCalendar = cfg.tokenjanitor.interval;
-        timerConfig.Persistent = true;
-      };
-
-      systemd.services.privacyidea = let
-        piuwsgi = pkgs.writeText "uwsgi.json" (builtins.toJSON {
-          uwsgi = {
-            buffer-size = 8192;
-            plugins = [ "python3" ];
-            pythonpath = "${penv}/${uwsgi.python3.sitePackages}";
-            socket = "/run/privacyidea/socket";
-            uid = cfg.user;
-            gid = cfg.group;
-            chmod-socket = 770;
-            chown-socket = "${cfg.user}:nginx";
-            chdir = cfg.stateDir;
-            wsgi-file = "${penv}/etc/privacyidea/privacyideaapp.wsgi";
-            processes = 4;
-            harakiri = 60;
-            reload-mercy = 8;
-            stats = "/run/privacyidea/stats.socket";
-            max-requests = 2000;
-            limit-as = 1024;
-            reload-on-as = 512;
-            reload-on-rss = 256;
-            no-orphans = true;
-            vacuum = true;
-          };
-        });
-      in {
-        wantedBy = [ "multi-user.target" ];
-        after = [ "postgresql.service" ];
-        path = with pkgs; [ openssl ];
-        environment.PRIVACYIDEA_CONFIGFILE = "${cfg.stateDir}/privacyidea.cfg";
-        preStart = let
-          pi-manage = "${config.security.sudo.package}/bin/sudo -u privacyidea -HE ${penv}/bin/pi-manage";
-          pgsu = config.services.postgresql.superUser;
-          psql = config.services.postgresql.package;
-        in ''
-          mkdir -p ${cfg.stateDir} /run/privacyidea
-          chown ${cfg.user}:${cfg.group} -R ${cfg.stateDir} /run/privacyidea
-          umask 077
-          ${lib.getBin pkgs.envsubst}/bin/envsubst -o ${cfg.stateDir}/privacyidea.cfg \
-                                                   -i "${piCfgFile}"
-          chown ${cfg.user}:${cfg.group} ${cfg.stateDir}/privacyidea.cfg
-          if ! test -e "${cfg.stateDir}/db-created"; then
-            ${config.security.sudo.package}/bin/sudo -u ${pgsu} ${psql}/bin/createuser --no-superuser --no-createdb --no-createrole ${cfg.user}
-            ${config.security.sudo.package}/bin/sudo -u ${pgsu} ${psql}/bin/createdb --owner ${cfg.user} privacyidea
-            ${pi-manage} create_enckey
-            ${pi-manage} create_audit_keys
-            ${pi-manage} createdb
-            ${pi-manage} admin add admin -e ${cfg.adminEmail} -p "$(cat ${cfg.adminPasswordFile})"
-            ${pi-manage} db stamp head -d ${penv}/lib/privacyidea/migrations
-            touch "${cfg.stateDir}/db-created"
-            chmod g+r "${cfg.stateDir}/enckey" "${cfg.stateDir}/private.pem"
-          fi
-          ${pi-manage} db upgrade -d ${penv}/lib/privacyidea/migrations
-        '';
-        serviceConfig = {
-          Type = "notify";
-          ExecStart = "${uwsgi}/bin/uwsgi --json ${piuwsgi}";
-          ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
-          EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
-          ExecStop = "${pkgs.coreutils}/bin/kill -INT $MAINPID";
-          NotifyAccess = "main";
-          KillSignal = "SIGQUIT";
-        };
-      };
-
-      users.users.privacyidea = mkIf (cfg.user == "privacyidea") {
-        group = cfg.group;
-        isSystemUser = true;
-      };
-
-      users.groups.privacyidea = mkIf (cfg.group == "privacyidea") {};
-    })
-
-    (mkIf cfg.ldap-proxy.enable {
-
-      assertions = [
-        { assertion = let
-            xor = a: b: a && !b || !a && b;
-          in xor (cfg.ldap-proxy.settings == {}) (cfg.ldap-proxy.configFile == null);
-          message = "configFile & settings are mutually exclusive for services.privacyidea.ldap-proxy!";
-        }
-      ];
-
-      warnings = mkIf (cfg.ldap-proxy.configFile != null) [
-        "Using services.privacyidea.ldap-proxy.configFile is deprecated! Use the RFC42-style settings option instead!"
-      ];
-
-      systemd.services.privacyidea-ldap-proxy = let
-        ldap-proxy-env = pkgs.python3.withPackages (ps: [ ps.privacyidea-ldap-proxy ]);
-      in {
-        description = "privacyIDEA LDAP proxy";
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig = {
-          User = cfg.ldap-proxy.user;
-          Group = cfg.ldap-proxy.group;
-          StateDirectory = "privacyidea-ldap-proxy";
-          EnvironmentFile = mkIf (cfg.ldap-proxy.environmentFile != null)
-            [ cfg.ldap-proxy.environmentFile ];
-          ExecStartPre =
-            "${pkgs.writeShellScript "substitute-secrets-ldap-proxy" ''
-              umask 0077
-              ${pkgs.envsubst}/bin/envsubst \
-                -i ${ldapProxyConfig} \
-                -o $STATE_DIRECTORY/ldap-proxy.ini
-            ''}";
-          ExecStart = let
-            configPath = if cfg.ldap-proxy.settings != {}
-              then "%S/privacyidea-ldap-proxy/ldap-proxy.ini"
-              else cfg.ldap-proxy.configFile;
-          in ''
-            ${ldap-proxy-env}/bin/twistd \
-              --nodaemon \
-              --pidfile= \
-              -u ${cfg.ldap-proxy.user} \
-              -g ${cfg.ldap-proxy.group} \
-              ldap-proxy \
-              -c ${configPath}
-          '';
-          Restart = "always";
-        };
-      };
-
-      users.users.pi-ldap-proxy = mkIf (cfg.ldap-proxy.user == "pi-ldap-proxy") {
-        group = cfg.ldap-proxy.group;
-        isSystemUser = true;
-      };
-
-      users.groups.pi-ldap-proxy = mkIf (cfg.ldap-proxy.group == "pi-ldap-proxy") {};
-    })
-  ];
-
-}
@@ -239,6 +239,26 @@ let
  mkService = name: container: let
    dependsOn = map (x: "${cfg.backend}-${x}.service") container.dependsOn;
    escapedName = escapeShellArg name;
+    preStartScript = pkgs.writeShellApplication {
+      name = "pre-start";
+      runtimeInputs = [ ];
+      text = ''
+        ${cfg.backend} rm -f ${name} || true
+        ${optionalString (isValidLogin container.login) ''
+          cat ${container.login.passwordFile} | \
+          ${cfg.backend} login \
+          ${container.login.registry} \
+          --username ${container.login.username} \
+          --password-stdin
+        ''}
+        ${optionalString (container.imageFile != null) ''
+          ${cfg.backend} load -i ${container.imageFile}
+        ''}
+        ${optionalString (cfg.backend == "podman") ''
+          rm -f /run/podman-${escapedName}.ctr-id
+        ''}
+      '';
+    };
  in {
    wantedBy = [] ++ optional (container.autoStart) "multi-user.target";
    after = lib.optionals (cfg.backend == "docker") [ "docker.service" "docker.socket" ]
@@ -253,23 +273,6 @@ let
      else if cfg.backend == "podman" then [ config.virtualisation.podman.package ]
      else throw "Unhandled backend: ${cfg.backend}";

-    preStart = ''
-      ${cfg.backend} rm -f ${name} || true
-      ${optionalString (isValidLogin container.login) ''
-        cat ${container.login.passwordFile} | \
-          ${cfg.backend} login \
-            ${container.login.registry} \
-            --username ${container.login.username} \
-            --password-stdin
-        ''}
-      ${optionalString (container.imageFile != null) ''
-        ${cfg.backend} load -i ${container.imageFile}
-        ''}
-      ${optionalString (cfg.backend == "podman") ''
-        rm -f /run/podman-${escapedName}.ctr-id
-        ''}
-      '';
-
    script = concatStringsSep " \\\n  " ([
      "exec ${cfg.backend} run"
      "--rm"
@@ -318,7 +321,7 @@ let
      ###
      # ExecReload = ...;
      ###
-
+      ExecStartPre = [ "${preStartScript}/bin/pre-start" ];
      TimeoutStartSec = 0;
      TimeoutStopSec = 120;
      Restart = "always";
@@ -10,7 +10,8 @@
    nix.channel.enable = true;
  };

-  testScript = ''
-    print(machine.succeed("cat /root/.nix-channels"))
+  testScript = { nodes, ... }: ''
+    assert machine.succeed("cat /root/.nix-channels") == "${nodes.machine.system.defaultChannel} nixos\n"
  '';
+
 }
@@ -573,7 +573,6 @@ in {
  nginx-njs = handleTest ./nginx-njs.nix {};
  nginx-proxyprotocol = handleTest ./nginx-proxyprotocol {};
  nginx-pubhtml = handleTest ./nginx-pubhtml.nix {};
-  nginx-sandbox = handleTestOn ["x86_64-linux"] ./nginx-sandbox.nix {};
  nginx-sso = handleTest ./nginx-sso.nix {};
  nginx-status-page = handleTest ./nginx-status-page.nix {};
  nginx-tmpdir = handleTest ./nginx-tmpdir.nix {};
@@ -685,7 +684,6 @@ in {
  predictable-interface-names = handleTest ./predictable-interface-names.nix {};
  printing-socket = handleTest ./printing.nix { socket = true; };
  printing-service = handleTest ./printing.nix { socket = false; };
-  privacyidea = handleTest ./privacyidea.nix {};
  privoxy = handleTest ./privoxy.nix {};
  prometheus = handleTest ./prometheus.nix {};
  prometheus-exporters = handleTest ./prometheus-exporters.nix {};
@@ -1,65 +0,0 @@
-import ./make-test-python.nix ({ pkgs, ... }: {
-  name = "nginx-sandbox";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ izorkin ];
-  };
-
-  # This test checks the creation and reading of a file in sandbox mode. Used simple lua script.
-
-  nodes.machine = { pkgs, ... }: {
-    nixpkgs.overlays = [
-      (self: super: {
-        nginx-lua = super.nginx.override {
-          modules = [
-            pkgs.nginxModules.lua
-          ];
-        };
-      })
-    ];
-    services.nginx.enable = true;
-    services.nginx.package = pkgs.nginx-lua;
-    services.nginx.virtualHosts.localhost = {
-      extraConfig = ''
-        location /test1-write {
-          content_by_lua_block {
-            local create = os.execute('${pkgs.coreutils}/bin/mkdir /tmp/test1-read')
-            local create = os.execute('${pkgs.coreutils}/bin/touch /tmp/test1-read/foo.txt')
-            local echo = os.execute('${pkgs.coreutils}/bin/echo worked > /tmp/test1-read/foo.txt')
-          }
-        }
-        location /test1-read {
-          root /tmp;
-        }
-        location /test2-write {
-          content_by_lua_block {
-            local create = os.execute('${pkgs.coreutils}/bin/mkdir /var/web/test2-read')
-            local create = os.execute('${pkgs.coreutils}/bin/touch /var/web/test2-read/bar.txt')
-            local echo = os.execute('${pkgs.coreutils}/bin/echo error-worked > /var/web/test2-read/bar.txt')
-          }
-        }
-        location /test2-read {
-          root /var/web;
-        }
-      '';
-    };
-    users.users.foo.isNormalUser = true;
-  };
-
-  testScript = ''
-    machine.wait_for_unit("nginx")
-    machine.wait_for_open_port(80)
-
-    # Checking write in temporary folder
-    machine.succeed("$(curl -vvv http://localhost/test1-write)")
-    machine.succeed('test "$(curl -fvvv http://localhost/test1-read/foo.txt)" = worked')
-
-    # Checking write in protected folder. In sandbox mode for the nginx service, the folder /var/web is mounted
-    # in read-only mode.
-    machine.succeed("mkdir -p /var/web")
-    machine.succeed("chown nginx:nginx /var/web")
-    machine.succeed("$(curl -vvv http://localhost/test2-write)")
-    assert "404 Not Found" in machine.succeed(
-        "curl -vvv -s http://localhost/test2-read/bar.txt"
-    )
-  '';
-})
@@ -16,6 +16,12 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:

    nodes = {
      webserver = { pkgs, lib, ... }: {
+        networking = {
+          extraHosts = ''
+            127.0.0.1 default.test
+            127.0.0.1 sandbox.test
+          '';
+        };
        services.nginx = {
          enable = true;
          package = pkgs.openresty;
@@ -24,7 +30,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
            lua_package_path '${luaPath};;';
          '';

-          virtualHosts."default" = {
+          virtualHosts."default.test" = {
            default = true;
            locations."/" = {
              extraConfig = ''
@@ -36,6 +42,33 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
              '';
            };
          };
+
+          virtualHosts."sandbox.test" = {
+            locations."/test1-write" = {
+              extraConfig = ''
+                content_by_lua_block {
+                  local create = os.execute('${pkgs.coreutils}/bin/mkdir /tmp/test1-read')
+                  local create = os.execute('${pkgs.coreutils}/bin/touch /tmp/test1-read/foo.txt')
+                  local echo = os.execute('${pkgs.coreutils}/bin/echo worked > /tmp/test1-read/foo.txt')
+                }
+              '';
+            };
+            locations."/test1-read" = {
+              root = "/tmp";
+            };
+            locations."/test2-write" = {
+              extraConfig = ''
+                content_by_lua_block {
+                  local create = os.execute('${pkgs.coreutils}/bin/mkdir /var/web/test2-read')
+                  local create = os.execute('${pkgs.coreutils}/bin/touch /var/web/test2-read/bar.txt')
+                  local echo = os.execute('${pkgs.coreutils}/bin/echo error-worked > /var/web/test2-read/bar.txt')
+                }
+              '';
+            };
+            locations."/test2-read" = {
+              root = "/var/web";
+            };
+          };
        };
      };
    };
@@ -51,5 +84,18 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
          f"curl -w '%{{http_code}}' --head --fail {url}"
        )
        assert http_code.split("\n")[-1] == "200"
+
+        # This test checks the creation and reading of a file in sandbox mode.
+        # Checking write in temporary folder
+        webserver.succeed("$(curl -vvv http://sandbox.test/test1-write)")
+        webserver.succeed('test "$(curl -fvvv http://sandbox.test/test1-read/foo.txt)" = worked')
+        # Checking write in protected folder. In sandbox mode for the nginx service, the folder /var/web is mounted
+        # in read-only mode.
+        webserver.succeed("mkdir -p /var/web")
+        webserver.succeed("chown nginx:nginx /var/web")
+        webserver.succeed("$(curl -vvv http://sandbox.test/test2-write)")
+        assert "404 Not Found" in machine.succeed(
+            "curl -vvv -s http://sandbox.test/test2-read/bar.txt"
+        )
      '';
  })
@@ -1,43 +0,0 @@
-# Miscellaneous small tests that don't warrant their own VM run.
-
-import ./make-test-python.nix ({ pkgs, ...} : rec {
-  name = "privacyidea";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ ];
-  };
-
-  nodes.machine = { ... }: {
-    virtualisation.cores = 2;
-
-    services.privacyidea = {
-      enable = true;
-      secretKey = "$SECRET_KEY";
-      pepper = "$PEPPER";
-      adminPasswordFile = pkgs.writeText "admin-password" "testing";
-      adminEmail = "root@localhost";
-
-      # Don't try this at home!
-      environmentFile = pkgs.writeText "pi-secrets.env" ''
-        SECRET_KEY=testing
-        PEPPER=testing
-      '';
-    };
-    services.nginx = {
-      enable = true;
-      virtualHosts."_".locations."/".extraConfig = ''
-        uwsgi_pass unix:/run/privacyidea/socket;
-      '';
-    };
-  };
-
-  testScript = ''
-    machine.start()
-    machine.wait_for_unit("multi-user.target")
-    machine.succeed("curl --fail http://localhost | grep privacyIDEA")
-    machine.succeed("grep \"SECRET_KEY = 'testing'\" /var/lib/privacyidea/privacyidea.cfg")
-    machine.succeed("grep \"PI_PEPPER = 'testing'\" /var/lib/privacyidea/privacyidea.cfg")
-    machine.succeed(
-        "curl --fail http://localhost/auth -F username=admin -F password=testing | grep token"
-    )
-  '';
-})
@@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "fulcrum";
-  version = "1.9.2";
+  version = "1.9.3";

  src = fetchFromGitHub {
    owner = "cculianu";
    repo = "Fulcrum";
    rev = "v${version}";
-    sha256 = "sha256-iHVrJySNdbZ9RXP7QgsDy2o2U/EISAp1/9NFpcEOGeI=";
+    sha256 = "sha256-hSunoltau1eG0DDM/bxZ/ssxd7pbutNC34Nwtbu9Fqk=";
  };

  nativeBuildInputs = [ pkg-config qmake ];
@@ -3537,15 +3537,15 @@ let
        mktplcRef = {
          name = "uiua-vscode";
          publisher = "uiua-lang";
-          version = "0.0.21";
-          sha256 = "sha256-u57U/MmxvionFZp/tLK/KpddaxA/SUffeggKBSzmsXo=";
+          version = "0.0.22";
+          sha256 = "sha256-fJcSJwwRVofduWEEMa5f2VrSfyONKPkFl9OW+++lSRw=";
        };
        meta = {
          description = "VSCode language extension for Uiua";
          downloadPage = "https://marketplace.visualstudio.com/items?itemName=uiua-lang.uiua-vscode";
          homepage = "https://github.com/uiua-lang/uiua-vscode";
          license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.wackbyte ];
+          maintainers = with lib.maintainers; [ tomasajt wackbyte ];
        };
      };

@@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "limesctl";
-  version = "3.3.0";
+  version = "3.3.1";

  src = fetchFromGitHub {
    owner = "sapcc";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-zR0+tTPRdmv04t3V0KDA/hG5ZJMT2RYI3+2dkmZHdhk=";
+    hash = "sha256-osXwVZuMB9cMj0tEMBOQ8hrKWAmfXui4ELoi0dm9yB4=";
  };

  vendorHash = null;
@@ -1,263 +0,0 @@
-{ lib, fetchFromGitHub, cacert, openssl, nixosTests
-, python310, fetchPypi, fetchpatch
-}:
-
-let
-  dropDocOutput = { outputs, ... }: {
-    outputs = lib.filter (x: x != "doc") outputs;
-  };
-
-  # Follow issue below for Python 3.11 support
-  # https://github.com/privacyidea/privacyidea/issues/3593
-  python3' = python310.override {
-    packageOverrides = self: super: {
-      django = super.django_3;
-
-      sqlalchemy = super.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
-        version = "1.3.24";
-        src = fetchPypi {
-          inherit (oldAttrs) pname;
-          inherit version;
-          hash = "sha256-67t3fL+TEjWbiXv4G6ANrg9ctp+6KhgmXcwYpvXvdRk=";
-        };
-        doCheck = false;
-      });
-      # version 3.3.0+ does not support SQLAlchemy 1.3
-      factory-boy = super.factory-boy.overridePythonAttrs (oldAttrs: rec {
-        version = "3.2.1";
-        src = oldAttrs.src.override {
-          inherit version;
-          hash = "sha256-qY0newwEfHXrbkq4UIp/gfsD0sshmG9ieRNUbveipV4=";
-        };
-        postPatch = "";
-      });
-      # fails with `no tests ran in 1.75s`
-      alembic = super.alembic.overridePythonAttrs (lib.const {
-        doCheck = false;
-      });
-      flask-migrate = super.flask-migrate.overridePythonAttrs (oldAttrs: rec {
-        version = "2.7.0";
-        src = fetchPypi {
-          pname = "Flask-Migrate";
-          inherit version;
-          hash = "sha256-ri8FZxWIdi3YOiHYsYxR/jVehng+JFlJlf+Nc4Df/jg=";
-        };
-      });
-      flask-sqlalchemy = super.flask-sqlalchemy.overridePythonAttrs (old: rec {
-        version = "2.5.1";
-        format = "setuptools";
-        src = fetchPypi {
-          pname = "Flask-SQLAlchemy";
-          inherit version;
-          hash = "sha256:2bda44b43e7cacb15d4e05ff3cc1f8bc97936cc464623424102bfc2c35e95912";
-        };
-      });
-      # Taken from by https://github.com/NixOS/nixpkgs/pull/173090/commits/d2c0c7eb4cc91beb0a1adbaf13abc0a526a21708
-      werkzeug = super.werkzeug.overridePythonAttrs (old: rec {
-        version = "1.0.1";
-        src = old.src.override {
-          inherit version;
-          hash = "sha256-bICx5a02ZSkOo5MguR4b4eDV9gZSuWSjBwIW3oPS5Hw=";
-        };
-        nativeCheckInputs = old.nativeCheckInputs ++ (with self; [
-          requests
-        ]);
-        doCheck = false;
-      });
-      # Required by flask-1.1
-      jinja2 = super.jinja2.overridePythonAttrs (old: rec {
-        version = "2.11.3";
-        src = old.src.override {
-          inherit version;
-          hash = "sha256-ptWEM94K6AA0fKsfowQ867q+i6qdKeZo8cdoy4ejM8Y=";
-        };
-        patches = [
-          # python 3.10 compat fixes. In later upstream releases, but these
-          # are not compatible with flask 1 which we need here :(
-          (fetchpatch {
-            url = "https://github.com/thmo/jinja/commit/1efb4cc918b4f3d097c376596da101de9f76585a.patch";
-            hash = "sha256-GFaSvYxgzOEFmnnDIfcf0ImScNTh1lR4lxt2Uz1DYdU=";
-          })
-          (fetchpatch {
-            url = "https://github.com/mkrizek/jinja/commit/bd8bad37d1c0e2d8995a44fd88e234f5340afec5.patch";
-            hash = "sha256-Uow+gaO+/dH6zavC0X/SsuMAfhTLRWpamVlL87DXDRA=";
-            excludes = [ "CHANGES.rst" ];
-          })
-        ];
-      });
-      # Required by jinja2-2.11.3
-      markupsafe = super.markupsafe.overridePythonAttrs (old: rec {
-        version = "2.0.1";
-        src = old.src.override {
-          inherit version;
-          hash = "sha256-WUxngH+xYjizDES99082wCzfItHIzake+KDtjav1Ygo=";
-        };
-      });
-      itsdangerous = super.itsdangerous.overridePythonAttrs (old: rec {
-        version = "1.1.0";
-        src = old.src.override {
-          inherit version;
-          hash = "sha256-MhsDPQfypBNtPsdi6snxahDM1g9TwMka+QIXrOe6Hxk=";
-        };
-      });
-      flask = super.flask.overridePythonAttrs (old: rec {
-        version = "1.1.4";
-        src = old.src.override {
-          inherit version;
-          hash = "sha256-D762GA04OpGG0NbtlU4AQq2fGODo3giLK0GdUmkn0ZY=";
-        };
-      });
-      sqlsoup = super.sqlsoup.overrideAttrs ({ meta ? {}, ... }: {
-        meta = meta // { broken = false; };
-      });
-      click = super.click.overridePythonAttrs (old: rec {
-        version = "7.1.2";
-        src = old.src.override {
-          inherit version;
-          hash = "sha256-0rUlXHxjSbwb0eWeCM0SrLvWPOZJ8liHVXg6qU37axo=";
-        };
-        disabledTests = [ "test_bytes_args" ]; # https://github.com/pallets/click/commit/6e05e1fa1c2804
-      });
-      # Now requires `lingua` as check input that requires a newer `click`,
-      # however `click-7` is needed by the older flask we need here. Since it's just
-      # for the test-suite apparently, let's skip it for now.
-      mako = super.mako.overridePythonAttrs (lib.const {
-        nativeCheckInputs = [];
-        doCheck = false;
-      });
-      # Requires pytest-httpserver as checkInput now which requires Werkzeug>=2 which is not
-      # supported by current privacyIDEA.
-      responses = super.responses.overridePythonAttrs (lib.const {
-        doCheck = false;
-      });
-      flask-babel = (super.flask-babel.override {
-        sphinxHook = null;
-        furo = null;
-      }).overridePythonAttrs (old: (dropDocOutput old) // rec {
-        pname = "Flask-Babel";
-        version = "2.0.0";
-        format = "setuptools";
-        src = fetchPypi {
-          inherit pname;
-          inherit version;
-          hash = "sha256:f9faf45cdb2e1a32ea2ec14403587d4295108f35017a7821a2b1acb8cfd9257d";
-        };
-        disabledTests = [
-          # AssertionError: assert 'Apr 12, 2010...46:00\u202fPM' == 'Apr 12, 2010, 1:46:00 PM'
-          # Note the `\u202f` (narrow, no-break space) vs space.
-          "test_basics"
-          "test_init_app"
-          "test_custom_locale_selector"
-          "test_refreshing"
-        ];
-      });
-      psycopg2 = (super.psycopg2.override {
-        sphinxHook = null;
-        sphinx-better-theme = null;
-      }).overridePythonAttrs dropDocOutput;
-      pyjwt = (super.pyjwt.override {
-        sphinxHook = null;
-        sphinx-rtd-theme = null;
-      }).overridePythonAttrs (old: (dropDocOutput old) // { format = "setuptools"; });
-      beautifulsoup4 = (super.beautifulsoup4.override {
-        sphinxHook = null;
-      }).overridePythonAttrs dropDocOutput;
-      pydash = (super.pydash.override {
-        sphinx-rtd-theme = null;
-      }).overridePythonAttrs (old: rec {
-        version = "5.1.0";
-        src = fetchPypi {
-          inherit (old) pname;
-          inherit version;
-          hash = "sha256-GysFCsG64EnNB/WSCxT6u+UmOPSF2a2h6xFanuv/aDU=";
-        };
-        format = "setuptools";
-        doCheck = false;
-      });
-      pyopenssl = (super.pyopenssl.override {
-        sphinxHook = null;
-        sphinx-rtd-theme = null;
-      }).overridePythonAttrs dropDocOutput;
-      deprecated = (super.deprecated.override {
-        sphinxHook = null;
-      }).overridePythonAttrs dropDocOutput;
-      wrapt = (super.wrapt.override {
-        sphinxHook = null;
-        sphinx-rtd-theme = null;
-      }).overridePythonAttrs dropDocOutput;
-    };
-  };
-in
-python3'.pkgs.buildPythonPackage rec {
-  pname = "privacyIDEA";
-  version = "3.8.1";
-  format = "setuptools";
-
-  src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-SYXw8PBCb514v3rcy15W/vZS5JyMsu81D2sJmviLRtw=";
-    fetchSubmodules = true;
-  };
-
-  patches = [
-    # https://github.com/privacyidea/privacyidea/pull/3611
-    (fetchpatch {
-      url = "https://github.com/privacyidea/privacyidea/commit/7db6509721726a34e8528437ddbd4210019b11ef.patch";
-      sha256 = "sha256-ZvtauCs1vWyxzGbA0B2+gG8q5JyUO8DF8nm/3/vcYmE=";
-    })
-  ];
-
-  propagatedBuildInputs = with python3'.pkgs; [
-    cryptography pyrad pymysql python-dateutil flask-versioned flask-script
-    defusedxml croniter flask-migrate pyjwt configobj sqlsoup pillow
-    python-gnupg passlib pyopenssl beautifulsoup4 smpplib flask-babel
-    ldap3 huey pyyaml qrcode oauth2client requests lxml cbor2 psycopg2
-    pydash ecdsa google-auth importlib-metadata argon2-cffi bcrypt segno
-  ];
-
-  passthru.tests = { inherit (nixosTests) privacyidea; };
-
-  nativeCheckInputs = with python3'.pkgs; [ openssl mock pytestCheckHook responses testfixtures ];
-  preCheck = "export HOME=$(mktemp -d)";
-  postCheck = "unset HOME";
-  disabledTests = [
-    # expects `/home/` to exist, fails with `FileNotFoundError: [Errno 2] No such file or directory: '/home/'`.
-    "test_01_loading_scripts"
-
-    # Tries to connect to `fcm.googleapis.com`.
-    "test_02_api_push_poll"
-    "test_04_decline_auth_request"
-
-    # Timezone info not available in build sandbox
-    "test_14_convert_timestamp_to_utc"
-
-    # Fails because of different logger configurations
-    "test_01_create_default_app"
-    "test_03_logging_config_file"
-    "test_04_logging_config_yaml"
-    "test_05_logging_config_broken_yaml"
-  ];
-
-  pythonImportsCheck = [ "privacyidea" ];
-
-  postPatch = ''
-    patchShebangs tests/testdata/scripts
-    substituteInPlace privacyidea/lib/resolvers/LDAPIdResolver.py --replace \
-      "/etc/privacyidea/ldap-ca.crt" \
-      "${cacert}/etc/ssl/certs/ca-bundle.crt"
-  '';
-
-  postInstall = ''
-    rm -r $out/${python3'.sitePackages}/tests
-  '';
-
-  meta = with lib; {
-    description = "Multi factor authentication system (2FA, MFA, OTP Server)";
-    license = licenses.agpl3Plus;
-    homepage = "http://www.privacyidea.org";
-    maintainers = with maintainers; [ ma27 ];
-    platforms = platforms.linux;
-  };
-}
@@ -6,16 +6,16 @@

 buildGo121Module rec {
  pname = "timoni";
-  version = "0.14.2";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "stefanprodan";
    repo = "timoni";
    rev = "v${version}";
-    hash = "sha256-45OIj57gb8njYoks7SgIlcMjz07ShEz2G/EECaTRTQg=";
+    hash = "sha256-kMqQiFicuKa0j/li9UmitEeSof0vLlgGR4AMtJksROs=";
  };

-  vendorHash = "sha256-lRZFRnft8vEntVxiLOBcR00FP8AXexLyo3h2LCNWN00=";
+  vendorHash = "sha256-tAqmTl+5tScXOaYWEvMs2RPTdyLTAemQN1VqOQGe6lU=";

  subPackages = [ "cmd/timoni" ];
  nativeBuildInputs = [ installShellFiles ];
@@ -24,11 +24,11 @@

 stdenv.mkDerivation rec {
  pname = "liferea";
-  version = "1.15.3";
+  version = "1.15.4";

  src = fetchurl {
    url = "https://github.com/lwindolf/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    hash = "sha256-FKjsosSSW0U8fQwV6QYhsbuuaTeCt6SfHEcY0v5xUO4=";
+    hash = "sha256-twczHU41xXJvBg4nTQyJrmNCCSoJWAnRLs4DV0uKpjE=";
  };

  nativeBuildInputs = [
@@ -2,14 +2,14 @@

 stdenv.mkDerivation rec {
  pname = "libutp";
-  version = "unstable-2023-08-04";
+  version = "unstable-2023-10-16";

  src = fetchFromGitHub {
    # Use transmission fork from post-3.4-transmission branch
    owner = "transmission";
    repo = pname;
-    rev = "09ef1be66397873516c799b4ec070690ff7365b2";
-    hash = "sha256-DlEbU7uAcQOiBf7QS/1kiw3E0nk3xKhlzhAi8buQNCI=";
+    rev = "2589200eac82fc91b65979680e4b3c026dff0278";
+    hash = "sha256-wsDqdbMWVm3ubTbg5XClEWutJz1irSIazVLFeCyAAL4=";
  };

  nativeBuildInputs = [ cmake ];
@@ -27,14 +27,14 @@

 stdenv.mkDerivation rec {
  pname = "boinc";
-  version = "7.24.1";
+  version = "7.24.2";

  src = fetchFromGitHub {
    name = "${pname}-${version}-src";
    owner = "BOINC";
    repo = "boinc";
    rev = "client_release/${lib.versions.majorMinor version}/${version}";
-    hash = "sha256-CAzAKxNHG8ew9v2B1jK7MxfWGwTfdmDncDe7QT+twd8=";
+    hash = "sha256-Aaoqf53wagCkzkZUs7mVbE2Z2P6GvxiQYxPrL6ahGqA=";
  };

  nativeBuildInputs = [ libtool automake autoconf m4 pkg-config ];
@@ -42,6 +42,8 @@

  obs-pipewire-audio-capture = callPackage ./obs-pipewire-audio-capture.nix { };

+  obs-replay-source = qt6Packages.callPackage ./obs-replay-source.nix { };
+
  obs-rgb-levels-filter = callPackage ./obs-rgb-levels-filter.nix { };

  obs-scale-to-sound = callPackage ./obs-scale-to-sound.nix { };
@@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "obs-pipewire-audio-capture";
-  version = "1.1.1";
+  version = "1.1.2";

  src = fetchFromGitHub {
    owner = "dimtpap";
    repo = pname;
    rev = version;
-    sha256 = "sha256-D4ONz/4S5Kt23Tmfa6jvw0X7680R9YDqG8/N6HhIQLE=";
+    sha256 = "sha256-9HPQ17swMlsCnKkYQXIUzEbx2vKuBUfGf58Up2hHVGI=";
  };

  nativeBuildInputs = [ cmake ninja pkg-config ];
@@ -0,0 +1,40 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, libcaption
+, obs-studio
+, qtbase
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "obs-replay-source";
+  version = "1.6.12";
+
+  src = fetchFromGitHub {
+    owner = "exeldro";
+    repo = "obs-replay-source";
+    rev = finalAttrs.version;
+    sha256 = "sha256-MzugH6r/jY5Kg7GIR8/o1BN36FenBzMnqrPUceJmbPs=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ libcaption obs-studio qtbase ];
+
+  postInstall = ''
+    mkdir -p "$out/lib" "$out/share"
+    mv "$out/obs-plugins/64bit" "$out/lib/obs-plugins"
+    rm -rf "$out/obs-plugins"
+    mv "$out/data" "$out/share/obs"
+  '';
+
+  dontWrapQtApps = true;
+
+  meta = with lib; {
+    description = "Replay source for OBS studio";
+    homepage = "https://github.com/exeldro/obs-replay-source";
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ pschmitt ];
+  };
+})
@@ -14,16 +14,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "uiua";
-  version = "0.0.23";
+  version = "0.0.25";

  src = fetchFromGitHub {
    owner = "uiua-lang";
    repo = "uiua";
    rev = version;
-    hash = "sha256-+Q/dn0pGZ3R+UlAt9stQZU1n+WITujJzTxY5dpXc+Bc=";
+    hash = "sha256-3ALtWcHLkwu+ddZfYMTtAPM9fQI4ceF0KG1jxozi3EQ=";
  };

-  cargoHash = "sha256-R4jQ9Or9vh3dtqJH7nPvYM4o1h277sFUf+nC1VQl1Uk=";
+  cargoHash = "sha256-2qlvAZCKBZlkM7EYceITx1Py1/9F0dS2xorpCtKGi9I=";

  nativeBuildInputs = lib.optionals stdenv.isDarwin [
    rustPlatform.bindgenHook
@@ -14,7 +14,7 @@ stdenvNoCC.mkDerivation {
  '';

  meta = {
-    description = "An Uiua font";
+    description = "A Uiua font";
    homepage = "https://uiua.org/";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ skykanin ];
@@ -19,13 +19,13 @@ lib.checkListOfEnum "${pname}: theme variants" [ "aliz" "azul" "sea" "pueril" "a

 stdenvNoCC.mkDerivation rec {
  inherit pname;
-  version = "2023-04-03";
+  version = "2023-10-30";

  src = fetchFromGitHub {
    owner = "vinceliuice";
    repo = pname;
    rev = version;
-    sha256 = "mr9X7p/H8H2QKZxAQC9j/8OLK4D3EnWLxriFlh16diE=";
+    sha256 = "+sWYUCFp5J+fhPHxicwtsHCQkFTpKwjj9H3GAXqNaYo=";
  };

  nativeBuildInputs = [
@@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "luau";
-  version = "0.600";
+  version = "0.601";

  src = fetchFromGitHub {
    owner = "Roblox";
    repo = "luau";
    rev = version;
-    hash = "sha256-fu4ALQ6mpxSQAWdz6zzcHRC4Z5ykVB0G7e2QzpHt8K8=";
+    hash = "sha256-RkclNY5ZDP0Urht/JBx00SbeQ958CJCTIru2YUIYFa4=";
  };

  nativeBuildInputs = [ cmake ];
@@ -0,0 +1,30 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, re2c
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libcaption";
+  version = "0.7";
+
+  src = fetchFromGitHub {
+    owner = "szatmary";
+    repo = "libcaption";
+    rev = finalAttrs.version;
+    sha256 = "sha256-OBtxoFJF0cxC+kfSK8TIKIdLkmCh5WOJlI0fejnisJo=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ re2c ];
+
+  meta = with lib; {
+    description = "Free open-source CEA608 / CEA708 closed-caption encoder/decoder";
+    homepage = "https://github.com/szatmary/libcaption";
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ pschmitt ];
+  };
+})
@@ -1,6 +1,6 @@
-{ lib, fetchurl, version, astring, base, camlp-streams, cmdliner_1_0
+{ lib, fetchurl, version ? "0.26.1", astring, base, camlp-streams, cmdliner_1_0
 , cmdliner_1_1, csexp, dune-build-info, either, fix, fpath, menhirLib, menhirSdk
-, ocaml-version, ocp-indent, odoc-parser, result, stdio, uuseg, uutf }:
+, ocaml-version, ocp-indent, odoc-parser, result, stdio, uuseg, uutf, ... }:

 # The ocamlformat package have been split into two in version 0.25.1:
 # one for the library and one for the executable.
@@ -23,9 +23,12 @@ rec {
      "0.24.1" = "sha256-AjQl6YGPgOpQU3sjcaSnZsFJqZV9BYB+iKAE0tX0Qc4=";
      "0.25.1" = "sha256-3I8qMwyjkws2yssmI7s2Dti99uSorNKT29niJBpv0z0=";
      "0.26.0" = "sha256-AxSUq3cM7xCo9qocvrVmDkbDqmwM1FexEP7IWadeh30=";
+      "0.26.1" = "sha256-2gBuQn8VuexhL7gI1EZZm9m3w+4lq+s9VVdHpw10xtc=";
    }."${version}";
  };

+  inherit version;
+
  odoc-parser_v = odoc-parser.override {
    version = if lib.versionAtLeast version "0.24.0" then
      "2.0.0"
@@ -1,6 +1,7 @@
-{ lib, callPackage, buildDunePackage, menhir, version ? "0.25.1" }:
+# Version can be selected with the 'version' argument, see generic.nix.
+{ lib, callPackage, buildDunePackage, menhir, ... }@args:

-let inherit (callPackage ./generic.nix { inherit version; }) src library_deps;
+let inherit (callPackage ./generic.nix args) src version library_deps;

 in assert (lib.versionAtLeast version "0.25.1");

@@ -1,25 +1,16 @@
-{ lib, fetchurl, buildDunePackage, ocaml, csexp, sexplib0 }:
+# Version can be selected with the 'version' argument, see generic.nix.
+{ lib, fetchurl, buildDunePackage, ocaml, csexp, sexplib0, callPackage, ... }@args:

-# for compat with ocaml-lsp
-let source =
-  if lib.versionAtLeast ocaml.version "4.13"
-  then {
-    version = "0.26.0";
-    sha256 = "sha256-AxSUq3cM7xCo9qocvrVmDkbDqmwM1FexEP7IWadeh30=";
-  } else {
-    version = "0.20.0";
-    sha256 = "sha256-JtmNCgwjbCyUE4bWqdH5Nc2YSit+rekwS43DcviIfgk=";
-  };
-in
+let
+  # for compat with ocaml-lsp
+  version_arg =
+    if lib.versionAtLeast ocaml.version "4.13" then {} else { version = "0.20.0"; };

-buildDunePackage rec {
+  inherit (callPackage ./generic.nix (args // version_arg)) src version;
+
+in buildDunePackage rec {
  pname = "ocamlformat-rpc-lib";
-  inherit (source) version;
-
-  src = fetchurl {
-    url = "https://github.com/ocaml-ppx/ocamlformat/releases/download/${version}/ocamlformat-${version}.tbz";
-    inherit (source) sha256;
-  };
+  inherit src version;

  minimalOCamlVersion = "4.08";
  duneVersion = "3";
@@ -1,3 +1,4 @@
+# Version can be selected with the 'version' argument, see generic.nix.
 { lib
 , callPackage
 , buildDunePackage
@@ -5,10 +6,10 @@
 , re
 , ocamlformat-lib
 , menhir
-, version ? "0.26.0"
-}:
+, ...
+}@args:

-let inherit (callPackage ./generic.nix { inherit version; }) src library_deps;
+let inherit (callPackage ./generic.nix args) src version library_deps;
 in

 lib.throwIf (lib.versionAtLeast ocaml.version "5.0" && !lib.versionAtLeast version "0.23")
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "aiopegelonline";
-  version = "0.0.6";
+  version = "0.0.7";
  format = "setuptools";

  disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "mib1185";
    repo = "aiopegelonline";
    rev = "refs/tags/v${version}";
-    hash = "sha256-UbH5S+BfXMAurEvPx0sOzNoV/yypbMCPN3Y3cSherfQ=";
+    hash = "sha256-r+5b52N/vliKHx6qOLJ4lWcQt1TPEcn5Dz7cZNhRbNg=";
  };

  propagatedBuildInputs = [
@@ -26,6 +26,6 @@ buildPythonPackage rec {
    description = "Sync github, bitbucket, bugzilla, and trac issues with taskwarrior";
    license = licenses.gpl3Plus;
    platforms = platforms.all;
-    maintainers = with maintainers; [ pierron yurrriq ];
+    maintainers = with maintainers; [ pierron ];
  };
 }
@@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "dvc-data";
-  version = "2.19.0";
+  version = "2.20.0";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "iterative";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-8VjKuYI4/IyQSMM/He5dQv5edoWChfB5+LLkLsjVSm0=";
+    hash = "sha256-CtTagSfAYrEOkEZaeeQ71Dn0RvFpHwH552RpAy+kjlg=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "dvc-objects";
-  version = "1.0.1";
+  version = "1.1.0";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "iterative";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-mpYSlddzYIUZctF3kGWQWT+kxshIdAckVvaXWuyJnlw=";
+    hash = "sha256-D0GNigdphMArcpU6eI4roiiarIop3qW1tW2KIvJhlWU=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
@@ -55,14 +55,14 @@

 buildPythonPackage rec {
  pname = "dvc";
-  version = "3.27.0";
+  version = "3.28.0";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "iterative";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-yaZCx9NPdr2136Z8ig+5Db8+wUbZpSgzMSyILOQZCR8=";
+    hash = "sha256-0XuljGj+gvYGhYD4CqGgZlESNuXG0V896mztEbJErb8=";
  };

  pythonRelaxDeps = [
@@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "heatzypy";
-  version = "2.1.7";
+  version = "2.1.9";
  pyproject = true;

  disabled = pythonOlder "3.11";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "Cyr-ius";
    repo = "heatzypy";
    rev = "refs/tags/${version}";
-    hash = "sha256-bMhxxVZs6fTKlUWtSO0jfzYCHa1WPf2faEjfrmfUg8E=";
+    hash = "sha256-O2HtCaNtBvjhjlSXLRhEuilI8z7nGgzFa8USYiHfZ+E=";
  };

  postPatch = ''
@@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "oss2";
-  version = "2.18.2";
+  version = "2.18.3";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "aliyun";
    repo = "aliyun-oss-python-sdk";
    rev = "refs/tags/${version}";
-    hash = "sha256-xbbdzuaUvFnXA5glGr/1/s1Bm28d4XbtuvCKaj8Js68=";
+    hash = "sha256-jDSXPVyy8XvPgsGZXsdfavFPptq28pCwr9C63OZvNrY=";
  };

  nativeBuildInputs = [
@@ -108,6 +108,8 @@ buildPythonPackage rec {
    "test_crypto_get_compact_deprecated_kms"
    # RuntimeError
    "test_crypto_put"
+    # Tests require network access
+    "test_write_get_object_response"
  ];

  meta = with lib; {
@@ -6,14 +6,14 @@

 buildPythonPackage rec {
  pname = "peaqevcore";
-  version = "19.5.12";
+  version = "19.5.13";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-NsQrfJQ1+WZ4wNBH8ZGGo9IMJ+yvWrVQmesDBQrfRKg=";
+    hash = "sha256-0WixwsBvfRgHxKrs/eAhzDNgFIpPdUbfEdJxnlaGmCA=";
  };

  postPatch = ''
@@ -0,0 +1,13 @@
+diff --git a/crates/polars-lazy/src/frame/mod.rs b/crates/polars-lazy/src/frame/mod.rs
+index 2d2ede651..be24b8809 100644
+--- a/crates/polars-lazy/src/frame/mod.rs
+++ b/crates/polars-lazy/src/frame/mod.rs
+@@ -25,7 +25,7 @@ pub use parquet::*;
+ use polars_core::frame::explode::MeltArgs;
+ use polars_core::prelude::*;
+ use polars_io::RowCount;
+-use polars_plan::dsl::all_horizontal;
+use polars_plan::dsl::functions::all_horizontal;
+ pub use polars_plan::frame::{AllowedOptimizations, OptState};
+ use polars_plan::global::FETCH_ROWS;
+ #[cfg(any(feature = "ipc", feature = "parquet", feature = "csv"))]
@@ -3,20 +3,27 @@
 , buildPythonPackage
 , pythonOlder
 , rustPlatform
+, cmake
 , libiconv
 , fetchFromGitHub
 , typing-extensions
+, jemalloc
 , rust-jemalloc-sys
 , darwin
 }:
 let
  pname = "polars";
-  version = "0.18.13";
+  version = "0.19.12";
  rootSource = fetchFromGitHub {
    owner = "pola-rs";
    repo = "polars";
    rev = "refs/tags/py-${version}";
-    hash = "sha256-kV30r2wmswpCUmMRaFsCOeRrlTN5/PU0ogaU2JIHq0E=";
+    hash = "sha256-6tn3Q6oZfMjgQ5l5xCFnGimLSDLOjTWCW5uEbi6yFZY=";
+  };
+  rust-jemalloc-sys' = rust-jemalloc-sys.override {
+    jemalloc = jemalloc.override {
+      disableInitExecTls = true;
+    };
  };
 in
 buildPythonPackage {
@@ -25,6 +32,13 @@ buildPythonPackage {
  disabled = pythonOlder "3.6";
  src = rootSource;

+  patches = [
+    # workaround for apparent rustc bug
+    # remove when we're at Rust 1.73
+    # https://github.com/pola-rs/polars/issues/12050
+    ./all_horizontal.patch
+  ];
+
  # Cargo.lock file is sometimes behind actual release which throws an error,
  # thus the `sed` command
  # Make sure to check that the right substitutions are made when updating the package
@@ -36,9 +50,7 @@ buildPythonPackage {
  cargoDeps = rustPlatform.importCargoLock {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "arrow2-0.17.3" = "sha256-pM6lNjMCpUzC98IABY+M23lbLj0KMXDefgBMjUPjDlg=";
      "jsonpath_lib-0.3.0" = "sha256-NKszYpDGG8VxfZSMbsTlzcMGFHBOUeFojNw4P2wM3qk=";
-      "simd-json-0.10.0" = "sha256-0q/GhL7PG5SLgL0EETPqe8kn6dcaqtyL+kLU9LL+iQs=";
    };
  };
  cargoRoot = "py-polars";
@@ -48,10 +60,19 @@ buildPythonPackage {

  propagatedBuildInputs = lib.optionals (pythonOlder "3.11") [ typing-extensions ];

-  nativeBuildInputs = with rustPlatform; [ cargoSetupHook maturinBuildHook ];
+  dontUseCmakeConfigure = true;
+
+  nativeBuildInputs = [
+    # needed for libz-ng-sys
+    # TODO: use pkgs.zlib-ng
+    cmake
+  ] ++ (with rustPlatform; [
+    cargoSetupHook
+    maturinBuildHook
+  ]);

  buildInputs = [
-    rust-jemalloc-sys
+    rust-jemalloc-sys'
  ] ++ lib.optionals stdenv.isDarwin [
    libiconv
    darwin.apple_sdk.frameworks.Security
@@ -1,32 +0,0 @@
-{ lib, buildPythonPackage, fetchFromGitHub, twisted, ldaptor, configobj, fetchpatch }:
-
-buildPythonPackage rec {
-  pname = "privacyidea-ldap-proxy";
-  version = "0.7";
-
-  src = fetchFromGitHub {
-    owner = "privacyidea";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "1i2kgxqd38xvb42qj0a4a35w4vk0fyp3n7w48kqmvrxc77p6r6i8";
-  };
-
-  patches = [
-    # support for LDAPCompareRequest.
-    (fetchpatch {
-      url = "https://github.com/mayflower/privacyidea-ldap-proxy/commit/a13356717379b174f1a6abf767faa0dbd459f5dd.patch";
-      hash = "sha256-SBTj9ayQ8JFD8BoYIl77nxWVV3PXnHZ8JMlJnxd/nEk=";
-    })
-  ];
-
-  propagatedBuildInputs = [ twisted ldaptor configobj ];
-
-  pythonImportsCheck = [ "pi_ldapproxy" ];
-
-  meta = with lib; {
-    description = "LDAP Proxy to intercept LDAP binds and authenticate against privacyIDEA";
-    homepage = "https://github.com/privacyidea/privacyidea-ldap-proxy";
-    license = licenses.agpl3Only;
-    maintainers = [ ];
-  };
-}
@@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "pubnub";
-  version = "7.3.0";
+  version = "7.3.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = pname;
    repo = "python";
    rev = "refs/tags/v${version}";
-    hash = "sha256-KZC6a0ZrTPn033tQxn7HeCRhZUAgO2I5rGDzLJITtpI=";
+    hash = "sha256-V6yw/OscTGwrFcjHEhwtaT7txWLqbVj0uYjuoSAtP2E=";
  };

  propagatedBuildInputs = [
@@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "pysensibo";
-  version = "1.0.35";
+  version = "1.0.36";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-E3XUQ7Ltu9zhjWVvl1LN+UUz8B2dAjLa0CZI9ca35nc=";
+    hash = "sha256-lsHKwFzfkGWuUiZGkt9zwjNDDU7i6gcqcEsi5SQqsSQ=";
  };

  propagatedBuildInputs = [
@@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "sybil";
-  version = "4.0.1";
+  version = "5.0.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
    owner = "simplistix";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-NvgmAFRuiBbyPnJykQlYNyQYALx1bFubMrakw671fDY=";
+    hash = "sha256-FeyamQDm/EqOWrRlxA8iIQniHI5xag+zUVfRGRHmslE=";
  };

  # Circular dependency with testfixtures
@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-make";
-  version = "0.37.3";
+  version = "0.37.4";

  src = fetchFromGitHub {
    owner = "sagiegurari";
    repo = "cargo-make";
    rev = version;
-    hash = "sha256-7xWxIvMaoKZ1TVgfdBUDvK8VJzW6alrO8xFvSlMusOY=";
+    hash = "sha256-ZcigUYHNhzLFXA726FqalSt0hIzBVBvmep8jqzaCioc=";
  };

-  cargoHash = "sha256-2I+VZD4KLTtoTIb2NNpfLcFH/lmD6Z/TTPJrr3FcZzI=";
+  cargoHash = "sha256-hmEo5UQlVtgdmb6b/vhK5GHHUCgbEKdnAu2S+xrDpuk=";

  nativeBuildInputs = [ pkg-config ];

@@ -19,17 +19,17 @@

 buildGoModule rec {
  pname = "aaaaxy";
-  version = "1.4.50";
+  version = "1.4.72";

  src = fetchFromGitHub {
    owner = "divVerent";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-J4SCmIwGlVD8MHs13NO3JFKfH1rvh2dgVV0/8BX9IcY=";
+    hash = "sha256-wKnwyjgEV1M5CJR0uxs9vNbF3iJvDPWOqya0iLHXjGw=";
    fetchSubmodules = true;
  };

-  vendorHash = "sha256-dugSK/5mowBfRqnzI3sZqCm69E0WtX2Tydh6Q06+vLU=";
+  vendorHash = "sha256-hK5w3JhcYUW5bAUovv/ldHoYcY0oIh5q4LWxiGuP2NQ=";

  buildInputs = [
    alsa-lib
@@ -2,56 +2,56 @@
  "x86_64-linux": {
    "alpha": {
      "experimental": {
-        "name": "factorio_alpha_x64-1.1.92.tar.xz",
+        "name": "factorio_alpha_x64-1.1.94.tar.xz",
        "needsAuth": true,
-        "sha256": "1arirh9180bmix2dglqlgcm036mbjanc4sxx0kc92j2grpw7xf53",
+        "sha256": "06z3l828drnqv075qa3sg8l1877dlakqnppr79y031jlp8vg19pm",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.92/alpha/linux64",
-        "version": "1.1.92"
+        "url": "https://factorio.com/get-download/1.1.94/alpha/linux64",
+        "version": "1.1.94"
      },
      "stable": {
-        "name": "factorio_alpha_x64-1.1.91.tar.xz",
+        "name": "factorio_alpha_x64-1.1.94.tar.xz",
        "needsAuth": true,
-        "sha256": "0dcanryqmikhllp8lwhdapbm9scrgfgnvgwdf18wn8asr652vz39",
+        "sha256": "06z3l828drnqv075qa3sg8l1877dlakqnppr79y031jlp8vg19pm",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.91/alpha/linux64",
-        "version": "1.1.91"
+        "url": "https://factorio.com/get-download/1.1.94/alpha/linux64",
+        "version": "1.1.94"
      }
    },
    "demo": {
      "experimental": {
-        "name": "factorio_demo_x64-1.1.92.tar.xz",
+        "name": "factorio_demo_x64-1.1.94.tar.xz",
        "needsAuth": false,
-        "sha256": "02mqj2hlpsd0kgg0rav4k70pqh2sk4g2879c2nhp61ms79kdizh4",
+        "sha256": "1z2l8xj3vvrd1m3q1rypczzqdzrmldmyipfg54qly8cfj3pxvk4w",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.92/demo/linux64",
-        "version": "1.1.92"
+        "url": "https://factorio.com/get-download/1.1.94/demo/linux64",
+        "version": "1.1.94"
      },
      "stable": {
-        "name": "factorio_demo_x64-1.1.91.tar.xz",
+        "name": "factorio_demo_x64-1.1.94.tar.xz",
        "needsAuth": false,
-        "sha256": "1j9nzc3rs9q43vh9i0jgpyhgnjjif98sdgk4r47m0qrxjb4pnfx0",
+        "sha256": "1z2l8xj3vvrd1m3q1rypczzqdzrmldmyipfg54qly8cfj3pxvk4w",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.91/demo/linux64",
-        "version": "1.1.91"
+        "url": "https://factorio.com/get-download/1.1.94/demo/linux64",
+        "version": "1.1.94"
      }
    },
    "headless": {
      "experimental": {
-        "name": "factorio_headless_x64-1.1.92.tar.xz",
+        "name": "factorio_headless_x64-1.1.94.tar.xz",
        "needsAuth": false,
-        "sha256": "04j3p2r1r0h3fak3vxxq3d7qqpyjlg57n3c8sm6gadg4q4h15aw8",
+        "sha256": "0ajs883dnz2ak1mxqvsw6hmpahcxqq243ravp5gb3iyiaaprqa4n",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.92/headless/linux64",
-        "version": "1.1.92"
+        "url": "https://factorio.com/get-download/1.1.94/headless/linux64",
+        "version": "1.1.94"
      },
      "stable": {
-        "name": "factorio_headless_x64-1.1.91.tar.xz",
+        "name": "factorio_headless_x64-1.1.94.tar.xz",
        "needsAuth": false,
-        "sha256": "0v8zg3q79n15242fr79f9amg0icw3giy4aiaf43am5hxzcdb5212",
+        "sha256": "0ajs883dnz2ak1mxqvsw6hmpahcxqq243ravp5gb3iyiaaprqa4n",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.91/headless/linux64",
-        "version": "1.1.91"
+        "url": "https://factorio.com/get-download/1.1.94/headless/linux64",
+        "version": "1.1.94"
      }
    }
  }
@@ -5,16 +5,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "minesweep-rs";
-  version = "6.0.35";
+  version = "6.0.39";

  src = fetchFromGitHub {
    owner = "cpcloud";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-IxyryBWU4NULjcQtUXHel533JosAmp0d0w/+Ntl2aT0=";
+    hash = "sha256-gV+16gxXfogHFFAXz/aG+D/uaXbZTgVjYK24QQizQ0c=";
  };

-  cargoHash = "sha256-BGjxZxT7iypvhusyx6K4yvK1S7j4WlvoSTkb79d/H1s=";
+  cargoHash = "sha256-D6HnpXxixmVugbjr5pMYZiVeGLgje41k3n3xic6Ecps=";

  meta = with lib; {
    description = "Sweep some mines for fun, and probably not for profit";
@@ -1,16 +1,9 @@
-{ lib, stdenv
-, makeWrapper
+{ callPackage
 , fetchFromGitHub
 , nixosTests
-, gradle
-, perl
-, jre
-, libpulseaudio
-, makeDesktopItem
-, copyDesktopItems
 }:

-let
+callPackage ./generic.nix rec {
  pname = "shattered-pixel-dungeon";
  version = "2.1.4";

@@ -21,103 +14,17 @@ let
    hash = "sha256-WbRvsHxTYYlhJavYVGMGK25fXEfSfnIztJ6KuCgBjF8=";
  };

-  patches = [
-    ./disable-beryx.patch
-  ];
-
-  postPatch = ''
-    # disable gradle plugins with native code and their targets
-    perl -i.bak1 -pe "s#(^\s*id '.+' version '.+'$)#// \1#" build.gradle
-    perl -i.bak2 -pe "s#(.*)#// \1# if /^(buildscript|task portable|task nsis|task proguard|task tgz|task\(afterEclipseImport\)|launch4j|macAppBundle|buildRpm|buildDeb|shadowJar|robovm)/ ... /^}/" build.gradle
-    # Remove unbuildable Android/iOS stuff
-    rm android/build.gradle ios/build.gradle
-  '';
-
-  # fake build to pre-download deps into fixed-output derivation
-  deps = stdenv.mkDerivation {
-    pname = "${pname}-deps";
-    inherit version src patches postPatch;
-    nativeBuildInputs = [ gradle perl ];
-    buildPhase = ''
-      export GRADLE_USER_HOME=$(mktemp -d)
-      # https://github.com/gradle/gradle/issues/4426
-      ${lib.optionalString stdenv.isDarwin "export TERM=dumb"}
-      gradle --no-daemon desktop:release
-    '';
-    # perl code mavenizes pathes (com.squareup.okio/okio/1.13.0/a9283170b7305c8d92d25aff02a6ab7e45d06cbe/okio-1.13.0.jar -> com/squareup/okio/okio/1.13.0/okio-1.13.0.jar)
-    installPhase = ''
-      find $GRADLE_USER_HOME/caches/modules-2 -type f -regex '.*\.\(jar\|pom\)' \
-        | perl -pe 's#(.*/([^/]+)/([^/]+)/([^/]+)/[0-9a-f]{30,40}/([^/\s]+))$# ($x = $2) =~ tr|\.|/|; "install -Dm444 $1 \$out/$x/$3/$4/$5" #e' \
-        | sh
-    '';
-    outputHashMode = "recursive";
-    outputHash = "sha256-i4k5tdo07E1NJwywroaGvRjZ+/xrDp6ra+GTYwTB7uk=";
-  };
-
-  desktopItem = makeDesktopItem {
-    name = "shattered-pixel-dungeon";
-    desktopName = "Shattered Pixel Dungeon";
-    comment = "An open-source traditional roguelike dungeon crawler";
-    icon = "shattered-pixel-dungeon";
-    exec = "shattered-pixel-dungeon";
-    terminal = false;
-    categories = [ "Game" "AdventureGame" ];
-    keywords = [ "roguelike" "dungeon" "crawler" ];
-  };
-
-in stdenv.mkDerivation rec {
-  inherit pname version src patches postPatch;
-
-  nativeBuildInputs = [ gradle perl makeWrapper copyDesktopItems ];
-
-  desktopItems = [ desktopItem ];
-
-  buildPhase = ''
-    runHook preBuild
-
-    export GRADLE_USER_HOME=$(mktemp -d)
-    # https://github.com/gradle/gradle/issues/4426
-    ${lib.optionalString stdenv.isDarwin "export TERM=dumb"}
-    # point to offline repo
-    sed -ie "s#repositories {#repositories { maven { url '${deps}' };#g" build.gradle
-    gradle --offline --no-daemon desktop:release
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm644 desktop/build/libs/desktop-${version}.jar $out/share/shattered-pixel-dungeon.jar
-    mkdir $out/bin
-    makeWrapper ${jre}/bin/java $out/bin/shattered-pixel-dungeon \
-      --prefix LD_LIBRARY_PATH : ${libpulseaudio}/lib \
-      --add-flags "-jar $out/share/shattered-pixel-dungeon.jar"
-
-    for s in 16 32 48 64 128 256; do
-      install -Dm644 desktop/src/main/assets/icons/icon_$s.png \
-        $out/share/icons/hicolor/''${s}x$s/apps/shattered-pixel-dungeon.png
-    done
-
-    runHook postInstall
-  '';
+  depsHash = "sha256-i4k5tdo07E1NJwywroaGvRjZ+/xrDp6ra+GTYwTB7uk=";

  passthru.tests = {
    shattered-pixel-dungeon-starts = nixosTests.shattered-pixel-dungeon;
  };

-  meta = with lib; {
+  desktopName = "Shattered Pixel Dungeon";
+
+  meta = {
    homepage = "https://shatteredpixel.com/";
    downloadPage = "https://github.com/00-Evan/shattered-pixel-dungeon/releases";
    description = "Traditional roguelike game with pixel-art graphics and simple interface";
-    sourceProvenance = with sourceTypes; [
-      fromSource
-      binaryBytecode  # deps
-    ];
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ fgaz ];
-    platforms = platforms.all;
-    # https://github.com/NixOS/nixpkgs/pull/99885#issuecomment-740065005
-    broken = stdenv.isDarwin;
  };
 }
@@ -38,10 +38,3 @@ index 97f35f7..afd5116 100644
 
 dependencies {
     implementation project(':core')
-@@ -123,4 +124,4 @@ dependencies {
- 
-     implementation project(':services:updates:githubUpdates')
-     implementation project(':services:news:shatteredNews')
-}
-\ No newline at end of file
-+}
@@ -0,0 +1,29 @@
+diff --git a/build.gradle b/build.gradle
+--- a/build.gradle
+++ b/build.gradle
+@@ -11,7 +11,6 @@ buildscript {
+         //FIXME the version of R8 coming with gradle plugin 4.0.0 causes serious problems
+         //noinspection GradleDependency
+         classpath 'com.android.tools.build:gradle:3.6.4'
+-        classpath "com.palantir.gradle.gitversion:gradle-git-version:0.12.3"
+     }
+ }
+ 
+@@ -19,16 +18,13 @@ buildscript {
+ 
+ allprojects {
+ 
+-    apply plugin: "com.palantir.git-version"
+-
+-    def details = versionDetails()
+ 
+     ext {
+         appName = 'Summoning Pixel Dungeon'
+         appPackageName = 'com.trashboxbobylev.summoningpixeldungeon'
+ 
+         appVersionCode = 430
+-        appVersionName = '@version@-' + details.gitHash.substring(0, 7)
+        appVersionName = '@version@'
+ 
+         appAndroidCompileSDK = 33
+         appAndroidMinSDK = 15
@@ -0,0 +1,30 @@
+{ callPackage
+, fetchFromGitHub
+}:
+
+callPackage ./generic.nix rec {
+  pname = "experienced-pixel-dungeon";
+  version = "2.15.3";
+
+  src = fetchFromGitHub {
+    owner = "TrashboxBobylev";
+    repo = "Experienced-Pixel-Dungeon-Redone";
+    rev = "ExpPD-${version}";
+    hash = "sha256-qwZk08e+GX8YAVnOZCQ6sIIfV06lWn5bM6/PKD0PAH0=";
+  };
+
+  postPatch = ''
+    substituteInPlace build.gradle \
+      --replace "gdxControllersVersion = '2.2.3-SNAPSHOT'" "gdxControllersVersion = '2.2.3'"
+  '';
+
+  depsHash = "sha256-MUUeWZUCVPakK1MJwn0lPnjAlLpPWB/J17Ad68XRcHg=";
+
+  desktopName = "Experienced Pixel Dungeon";
+
+  meta = {
+    homepage = "https://github.com/TrashboxBobylev/Experienced-Pixel-Dungeon-Redone";
+    downloadPage = "https://github.com/TrashboxBobylev/Experienced-Pixel-Dungeon-Redone/releases";
+    description = "A fork of the Shattered Pixel Dungeon roguelike without limits on experience and items";
+  };
+}
@@ -0,0 +1,137 @@
+# Generic builder for shattered pixel forks/mods
+{ pname
+, version
+, src
+, depsHash
+, meta
+, desktopName
+, patches ? [ ./disable-beryx.patch ]
+
+, lib
+, stdenv
+, makeWrapper
+, gradle
+, perl
+, jre
+, libpulseaudio
+, makeDesktopItem
+, copyDesktopItems
+, ...
+}@attrs:
+
+let
+  cleanAttrs = builtins.removeAttrs attrs [
+    "lib"
+    "stdenv"
+    "makeWrapper"
+    "gradle"
+    "perl"
+    "jre"
+    "libpulseaudio"
+    "makeDesktopItem"
+    "copyDesktopItems"
+  ];
+
+  postPatch = ''
+    # disable gradle plugins with native code and their targets
+    perl -i.bak1 -pe "s#(^\s*id '.+' version '.+'$)#// \1#" build.gradle
+    perl -i.bak2 -pe "s#(.*)#// \1# if /^(buildscript|task portable|task nsis|task proguard|task tgz|task\(afterEclipseImport\)|launch4j|macAppBundle|buildRpm|buildDeb|shadowJar|robovm|git-version)/ ... /^}/" build.gradle
+    # Remove unbuildable Android/iOS stuff
+    rm -f android/build.gradle ios/build.gradle
+    ${attrs.postPatch or ""}
+  '';
+
+  desktopItem = makeDesktopItem {
+    name = pname;
+    inherit desktopName;
+    comment = meta.description;
+    icon = pname;
+    exec = pname;
+    terminal = false;
+    categories = [ "Game" "AdventureGame" ];
+    keywords = [ "roguelike" "dungeon" "crawler" ];
+  };
+
+  # fake build to pre-download deps into fixed-output derivation
+  deps = stdenv.mkDerivation {
+    pname = "${pname}-deps";
+    inherit version src patches postPatch;
+    nativeBuildInputs = [ gradle perl ] ++ attrs.nativeBuildInputs or [];
+    buildPhase = ''
+      export GRADLE_USER_HOME=$(mktemp -d)
+      # https://github.com/gradle/gradle/issues/4426
+      ${lib.optionalString stdenv.isDarwin "export TERM=dumb"}
+      gradle --no-daemon desktop:release
+    '';
+    # perl code mavenizes pathes (com.squareup.okio/okio/1.13.0/a9283170b7305c8d92d25aff02a6ab7e45d06cbe/okio-1.13.0.jar -> com/squareup/okio/okio/1.13.0/okio-1.13.0.jar)
+    installPhase = ''
+      find $GRADLE_USER_HOME/caches/modules-2 -type f -regex '.*\.\(jar\|pom\)' \
+        | perl -pe 's#(.*/([^/]+)/([^/]+)/([^/]+)/[0-9a-f]{30,40}/([^/\s]+))$# ($x = $2) =~ tr|\.|/|; "install -Dm444 $1 \$out/$x/$3/$4/$5" #e' \
+        | sh
+    '';
+    outputHashMode = "recursive";
+    outputHash = depsHash;
+  };
+
+in stdenv.mkDerivation (cleanAttrs // {
+  inherit pname version src patches postPatch;
+
+  nativeBuildInputs = [
+    gradle
+    perl
+    makeWrapper
+    copyDesktopItems
+  ] ++ attrs.nativeBuildInputs or [];
+
+  desktopItems = [ desktopItem ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    export GRADLE_USER_HOME=$(mktemp -d)
+    # https://github.com/gradle/gradle/issues/4426
+    ${lib.optionalString stdenv.isDarwin "export TERM=dumb"}
+    # point to offline repo
+    sed -ie "s#repositories {#repositories { maven { url '${deps}' };#g" build.gradle
+    gradle --offline --no-daemon desktop:release
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 desktop/build/libs/desktop-*.jar $out/share/${pname}.jar
+    mkdir $out/bin
+    makeWrapper ${jre}/bin/java $out/bin/${pname} \
+      --prefix LD_LIBRARY_PATH : ${libpulseaudio}/lib \
+      --add-flags "-jar $out/share/${pname}.jar"
+
+    for s in 16 32 48 64 128 256; do
+      # Some forks only have some icons and/or name them slightly differently
+      if [ -f desktop/src/main/assets/icons/icon_$s.png ]; then
+        install -Dm644 desktop/src/main/assets/icons/icon_$s.png \
+          $out/share/icons/hicolor/''${s}x$s/apps/${pname}.png
+      fi
+      if [ -f desktop/src/main/assets/icons/icon_''${s}x$s.png ]; then
+        install -Dm644 desktop/src/main/assets/icons/icon_''${s}x$s.png \
+          $out/share/icons/hicolor/''${s}x$s/apps/${pname}.png
+      fi
+    done
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    sourceProvenance = with sourceTypes; [
+      fromSource
+      binaryBytecode  # deps
+    ];
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ fgaz ];
+    platforms = platforms.all;
+    # https://github.com/NixOS/nixpkgs/pull/99885#issuecomment-740065005
+    broken = stdenv.isDarwin;
+    mainProgram = pname;
+  } // meta;
+})
@@ -0,0 +1,25 @@
+{ callPackage
+, fetchFromGitHub
+}:
+
+callPackage ./generic.nix rec {
+  pname = "rat-king-adventure";
+  version = "1.5.2a";
+
+  src = fetchFromGitHub {
+    owner = "TrashboxBobylev";
+    repo = "Rat-King-Adventure";
+    rev = version;
+    hash = "sha256-UgUm7GIn1frS66YYrx+ax+oqMKnQnDlqpn9e1kWwDzo=";
+  };
+
+  depsHash = "sha256-yE6zuLnFLtNq76AhtyE+giGLF2vcCqF7sfIvcY8W6Lg=";
+
+  desktopName = "Rat King Adventure";
+
+  meta = {
+    homepage = "https://github.com/TrashboxBobylev/Rat-King-Adventure";
+    downloadPage = "https://github.com/TrashboxBobylev/Rat-King-Adventure/releases";
+    description = "An expansive fork of RKPD2, itself a fork of the Shattered Pixel Dungeon roguelike";
+  };
+}
@@ -0,0 +1,25 @@
+{ callPackage
+, fetchFromGitHub
+}:
+
+callPackage ./generic.nix rec {
+  pname = "rkpd2";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "Zrp200";
+    repo = "rkpd2";
+    rev = "v${version}";
+    hash = "sha256-3WKQCXFDyliObXaIRp3x0kRh3XeNd24SCoTgdFA8/rM=";
+  };
+
+  depsHash = "sha256-yE6zuLnFLtNq76AhtyE+giGLF2vcCqF7sfIvcY8W6Lg=";
+
+  desktopName = "Rat King Pixel Dungeon 2";
+
+  meta = {
+    homepage = "https://github.com/Zrp200/rkpd2";
+    downloadPage = "https://github.com/Zrp200/rkpd2/releases";
+    description = "Fork of popular roguelike game Shattered Pixel Dungeon that drastically buffs heroes and thus makes the game significantly easier";
+  };
+}
@@ -0,0 +1,30 @@
+{ callPackage
+, fetchFromGitHub
+}:
+
+callPackage ./generic.nix rec {
+  pname = "shorter-pixel-dungeon";
+  version = "1.2.0";
+
+  src = fetchFromGitHub {
+    owner = "TrashboxBobylev";
+    repo = "Shorter-Pixel-Dungeon";
+    rev = "Short-${version}";
+    hash = "sha256-8vmh65XlNqfIh4WHLPuWU68tb3ajKI8kBMI68CYlsSk=";
+  };
+
+  postPatch = ''
+    substituteInPlace build.gradle \
+      --replace "gdxControllersVersion = '2.2.4-SNAPSHOT'" "gdxControllersVersion = '2.2.3'"
+  '';
+
+  depsHash = "sha256-MUUeWZUCVPakK1MJwn0lPnjAlLpPWB/J17Ad68XRcHg=";
+
+  desktopName = "Shorter Pixel Dungeon";
+
+  meta = {
+    homepage = "https://github.com/TrashboxBobylev/Shorter-Pixel-Dungeon";
+    downloadPage = "https://github.com/TrashboxBobylev/Shorter-Pixel-Dungeon/releases";
+    description = "A shorter fork of the Shattered Pixel Dungeon roguelike";
+  };
+}
@@ -0,0 +1,36 @@
+{ callPackage
+, fetchFromGitHub
+, gradle_6
+, substitute
+}:
+
+callPackage ./generic.nix rec {
+  pname = "summoning-pixel-dungeon";
+  version = "1.2.5";
+
+  src = fetchFromGitHub {
+    owner = "TrashboxBobylev";
+    repo = "Summoning-Pixel-Dungeon";
+    # The GH release is named "$version-$hash", but it's actually a mutable "_latest" tag
+    rev = "fc63a89a0f9bdf9cb86a750dfec65bc56d9fddcb";
+    hash = "sha256-n1YR7jYJ8TQFe654aERgmOHRgaPZ82eXxu0K12/5MGw=";
+  };
+
+  patches = [(substitute {
+    src = ./disable-git-version.patch;
+    replacements = [ "--subst-var-by" "version" version ];
+  })];
+
+  depsHash = "sha256-0P/BcjNnbDN25DguRcCyzPuUG7bouxEx1ySodIbSwvg=";
+
+  desktopName = "Summoning Pixel Dungeon";
+
+  meta = {
+    homepage = "https://github.com/TrashboxBobylev/Summoning-Pixel-Dungeon";
+    downloadPage = "https://github.com/TrashboxBobylev/Summoning-Pixel-Dungeon/releases";
+    description = "A fork of the Shattered Pixel Dungeon roguelike with added summoning mechanics";
+  };
+
+  # Probably due to https://github.com/gradle/gradle/issues/17236
+  gradle = gradle_6;
+}
@@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "android-udev-rules";
-  version = "20230614";
+  version = "20231030";

  src = fetchFromGitHub {
    owner = "M0Rf30";
    repo = "android-udev-rules";
    rev = version;
-    sha256 = "sha256-TLQHZYcnO7VzIHH+aCj78plTwK5RrcsU/OfNXApAvdM=";
+    sha256 = "sha256-+h0FwvfIoluhldOi6cgVDvmNWe1Lvj1SV3pL8Zh+gRM=";
  };

  installPhase = ''
@@ -84,6 +84,17 @@ kaem.runCommand "${pname}-${version}" {
        "-e"
        (builtins.toFile "bash-builder.sh" ''
          export CONFIG_SHELL=$SHELL
+
+          # Normalize the NIX_BUILD_CORES variable. The value might be 0, which
+          # means that we're supposed to try and auto-detect the number of
+          # available CPU cores at run-time. We don't have nproc to detect the
+          # number of available CPU cores so default to 1 if not set.
+          NIX_BUILD_CORES="''${NIX_BUILD_CORES:-1}"
+          if [ $NIX_BUILD_CORES -le 0 ]; then
+            NIX_BUILD_CORES=1
+          fi
+          export NIX_BUILD_CORES
+
          bash -eux $buildCommandPath
        '')
      ];
@@ -54,6 +54,17 @@ bootBash.runCommand "${pname}-${version}" {
        "-e"
        (builtins.toFile "bash-builder.sh" ''
          export CONFIG_SHELL=$SHELL
+
+          # Normalize the NIX_BUILD_CORES variable. The value might be 0, which
+          # means that we're supposed to try and auto-detect the number of
+          # available CPU cores at run-time.
+          NIX_BUILD_CORES="''${NIX_BUILD_CORES:-1}"
+          if ((NIX_BUILD_CORES <= 0)); then
+            guess=$(nproc 2>/dev/null || true)
+            ((NIX_BUILD_CORES = guess <= 0 ? 1 : guess))
+          fi
+          export NIX_BUILD_CORES
+
          bash -eux $buildCommandPath
        '')
      ];
@@ -24,14 +24,12 @@ lib.makeScope
    };

    binutils = callPackage ./binutils {
-      bash = bash_2_05;
      tinycc = tinycc-musl;
      gnumake = gnumake-musl;
      gnutar = gnutar-musl;
    };

    bzip2 = callPackage ./bzip2 {
-      bash = bash_2_05;
      tinycc = tinycc-musl;
      gnumake = gnumake-musl;
      gnutar = gnutar-musl;
@@ -53,7 +51,6 @@ lib.makeScope
    };

    findutils = callPackage ./findutils {
-      bash = bash_2_05;
      tinycc = tinycc-musl;
      gnumake = gnumake-musl;
      gnutar = gnutar-musl;
@@ -27,12 +27,12 @@ rec {
  stable = if stdenv.hostPlatform.system == "i686-linux" then legacy_390 else latest;

  production = generic {
-    version = "535.113.01";
-    sha256_64bit = "sha256-KOME2N/oG39en2BAS/OMYvyjVXjZdSLjxwoOjyMWdIE=";
-    sha256_aarch64 = "sha256-mw/p5ELGTNcM4P94soJIGqpLMBJHSPf+z9qsGnISuCk=";
-    openSha256 = "sha256-SePRFb5S2T0pOmkSGflYfJkJBjG3Dx/Z0MjwnWccfcI=";
-    settingsSha256 = "sha256-hiX5Nc4JhiYYt0jaRgQzfnmlEQikQjuO0kHnqGdDa04=";
-    persistencedSha256 = "sha256-V5Wu8a7EhwZarGsflAhEQDE9s9PjuQ3JNMU1nWvNNsQ=";
+    version = "535.129.03";
+    sha256_64bit = "sha256-5tylYmomCMa7KgRs/LfBrzOLnpYafdkKwJu4oSb/AC4=";
+    sha256_aarch64 = "sha256-i6jZYUV6JBvN+Rt21v4vNstHPIu9sC+2ZQpiLOLoWzM=";
+    openSha256 = "sha256-/Hxod/LQ4CGZN1B1GRpgE/xgoYlkPpMh+n8L7tmxwjs=";
+    settingsSha256 = "sha256-QKN/gLGlT+/hAdYKlkIjZTgvubzQTt4/ki5Y+2Zj3pk=";
+    persistencedSha256 = "sha256-FRMqY5uAJzq3o+YdM2Mdjj8Df6/cuUUAnh52Ne4koME=";
  };

  latest = selectHighestVersion production (generic {
@@ -93,25 +93,14 @@ rec {

  # Last one supporting Kepler architecture
  legacy_470 = generic {
-    version = "470.199.02";
-    sha256_64bit = "sha256-/fggDt8RzjLDW0JiGjr4aV4RGnfEKL8MTTQ4tCjXaP0=";
-    sha256_aarch64 = "sha256-UmF7LszdrO2d+bOaoQYrTVKXUwDqzMy1UDBW5SPuZy4=";
-    settingsSha256 = "sha256-FkKPE4QV5IiVizGYUNUYoEXRpEhojt/cbH/I8iCn3hw=";
-    persistencedSha256 = "sha256-JP71wt3uCNOgheLNlQbW3DqVFQNTC5vj4y4COWKQzAs=";
+    version = "470.223.02";
+    sha256_64bit = "sha256-s2hi1TNsw+br6Ow6tPiFsYPaJY8d+x4FrkBrP2xNRPg=";
+    sha256_aarch64 = "sha256-CFkg2ARlGWqlFQKm8SlbwMH6eLidHKA/q5QGVOpPGuU=";
+    settingsSha256 = "sha256-r6DuIH/rnsCm/y51iRgPNi5/kz+EFMVABREdTjBneZ0=";
+    persistencedSha256 = "sha256-e71fpPBBv8S/aoeXxBXkzKy5bsMMbv8y024cSLc8DYc=";

    patchFlags = [ "-p1" "-d" "kernel" ];
-    patches = [
-      # source: https://gist.github.com/joanbm/dfe8dc59af1c83e2530a1376b77be8ba
-      (fetchpatch {
-        url = "https://gist.github.com/joanbm/dfe8dc59af1c83e2530a1376b77be8ba/raw/37ff2b5ccf99f295ff958c9a44ca4ed4f42503b4/nvidia-470xx-fix-linux-6.5.patch";
-        hash = "sha256-s5r7nwuMva0BLy2qJBVKqNtnUN9am5+PptnVwNdzdbk=";
-      })
-      # source: https://gist.github.com/joanbm/2ec3c512a1ac21f5f5c6b3c1a4dbef35
-      (fetchpatch {
-        url = "https://gist.github.com/joanbm/2ec3c512a1ac21f5f5c6b3c1a4dbef35/raw/615feaefed2de3a28bd12fe9783894b84a7c86e4/nvidia-470xx-fix-linux-6.6.patch";
-        hash = "sha256-gdV+a+JFzQX8MzRz9eb4gVbnOfTWN+Ds9sOeyIBN5y0=";
-      })
-    ];
+    patches = [];
  };

  # Last one supporting x86
@@ -1,13 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index 963e40e..fb76d78 100644
--- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -230,7 +230,7 @@ dependencies = [
-
- [[package]]
- name = "fishnet"
-version = "2.5.1-dev"
-+version = "2.5.1"
- dependencies = [
-  "arrayvec",
-  "atty",
@@ -6,21 +6,21 @@
 }:

 let
-  nnueFile = "nn-13406b1dcbe0.nnue";
+  nnueFile = "nn-5af11540bbfe.nnue";
  nnue = fetchurl {
    url = "https://tests.stockfishchess.org/api/nn/${nnueFile}";
-    sha256 = "sha256-E0BrHcvgo238XgfaUdjbOLekXX2kMHjsJadiTCuDI28=";
+    hash = "sha256-WvEVQLv+/LVOOMXdAAyrS0ad+nWZodVb5dJyLCCokps=";
  };
 in
 rustPlatform.buildRustPackage rec {
  pname = "fishnet";
-  version = "2.5.1";
+  version = "2.7.1";

  src = fetchFromGitHub {
-    owner = "niklasf";
+    owner = "lichess-org";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-nVRG60sSpTqfqhCclvWoeyHR0+oO1Jn1PgftigDGq5c=";
+    hash = "sha256-q73oGQYSWx1aFy9IvbGpecOoc0wLEY2IzJH9GufnvCs=";
    fetchSubmodules = true;
  };

@@ -29,19 +29,18 @@ rustPlatform.buildRustPackage rec {
    cp -v '${nnue}' 'Fairy-Stockfish/src/${nnueFile}'
  '';

-  cargoSha256 = "sha256-BJK7M/pjHRj74xoeciavhkK2YRpeogkELIuXetX73so=";
+  # Copying again bacause the file is deleted during build.
+  postBuild = ''
+    cp -v '${nnue}' 'Stockfish/src/${nnueFile}'
+  '';

-  # TODO: Cargo.lock is out of date, so fix it. Likely not necessary anymore in
-  # the next update.
-  cargoPatches = [
-    ./Cargo.lock.patch
-  ];
+  cargoHash = "sha256-NO3u2ZXSiDQnZ/FFZLOtTnQoGMyN9pSI4sqGIXtjEcI=";

  meta = with lib; {
    description = "Distributed Stockfish analysis for lichess.org";
-    homepage = "https://github.com/niklasf/fishnet";
+    homepage = "https://github.com/lichess-org/fishnet";
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ tu-maurice ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "aarch64-linux" "x86_64-linux" ];
  };
 }
@@ -186,7 +186,7 @@ stdenv.mkDerivation {
  passthru = {
    inherit modules;
    tests = {
-      inherit (nixosTests) nginx nginx-auth nginx-etag nginx-globalredirect nginx-http3 nginx-proxyprotocol nginx-pubhtml nginx-sandbox nginx-sso nginx-status-page nginx-unix-socket;
+      inherit (nixosTests) nginx nginx-auth nginx-etag nginx-globalredirect nginx-http3 nginx-proxyprotocol nginx-pubhtml nginx-sso nginx-status-page nginx-unix-socket;
      variants = lib.recurseIntoAttrs nixosTests.nginx-variants;
      acme-integration = nixosTests.acme;
    } // passthru.tests;
@@ -16,20 +16,20 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
  pname = "matrix-synapse";
-  version = "1.95.0";
+  version = "1.95.1";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "matrix-org";
    repo = "synapse";
    rev = "v${version}";
-    hash = "sha256-WYKuWTOP0w9Xtao9vF3+km4mXVTrt/mshcaXuF92voQ=";
+    hash = "sha256-5RyJCMYsf6p9rd1ATEHa+FMV6vv3ULbcx7PXxMSUGSU=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-uUu2Hu4a7J49S3rhZ7xsLJQC7seYkVScYYbWaw4Q/rU=";
+    hash = "sha256-gNjpML+j9ABv24WrAiJI5hoEoIqcVPL2I4V/W+sWFSg=";
  };

  postPatch = ''
@@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "check_ssl_cert";
-  version = "2.75.0";
+  version = "2.76.0";

  src = fetchFromGitHub {
    owner = "matteocorti";
    repo = "check_ssl_cert";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Tz1ogwht6MCRUM4Knr7Ka0VNN2yUmh/lQrJNdPEUMiI=";
+    hash = "sha256-nk+uYO8tJPUezu/nqfwNhK4q/ds9C96re/fWebrTa1Y=";
  };

  nativeBuildInputs = [
@@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "postgres_exporter";
-  version = "0.14.0";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "prometheus-community";
    repo = "postgres_exporter";
    rev = "v${version}";
-    sha256 = "sha256-Y66VxzKaadTNE/84aQxgTKsr/KpXwq2W/1BOvsvyNbM=";
+    sha256 = "sha256-fxVU2z1RGgI8AoKiJb+3LIEa1KDhPptmdP21/ESzmgw=";
  };

-  vendorHash = "sha256-+ly4zZFCnrWycdi/RP8L0yG5/lsGzu4VwKDlea2prio=";
+  vendorHash = "sha256-/AL9Qkcrp5Kvj2epJMuNrtwqBbyCy4P6oVGUfODXS/Q=";

  ldflags =
    let
@@ -1,26 +1,17 @@
-{ lib, buildGoModule, fetchFromGitHub, fetchpatch }:
+{ lib, buildGoModule, fetchFromGitHub }:

 buildGoModule rec {
  pname = "tempo";
-  version = "2.2.3";
+  version = "2.3.0";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = "tempo";
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-23wjD8HTSEGonIMAWCoKORMLIISASxlN4FeY+Bmt/+I=";
+    hash = "sha256-vqYewQT2alW9HFYRh/Ok3jFt2a+VsfqDypNaT+mngys=";
  };

-  patches = [
-    # Backport patch for Go 1.21 compatibility
-    # FIXME: remove after 2.3.0
-    (fetchpatch {
-      url = "https://github.com/grafana/tempo/commit/0d37e8f0edd8a96876b0a5f5ab97ef79ff04608f.patch";
-      hash = "sha256-YC59g5pdcrwJeQ4raS0Oq+fZvRBKFj4johZtGTAYpEs=";
-    })
-  ];
-
  vendorHash = null;

  subPackages = [
@@ -2,13 +2,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "agdsn-zsh-config";
-  version = "0.7.1";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "agdsn";
    repo = "agdsn-zsh-config";
    rev = "v${version}";
-    sha256 = "sha256-79bD3YQcpNTKYvEoKu22gqOKvNH7eZPGS/iU+/4IbAU=";
+    sha256 = "sha256-kbpiA+aI3mXQAanmTyZo2rJNOKX77FKjpVsQywyyq90=";
  };

  dontBuild = true;
@@ -6,26 +6,18 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "iredis";
-  version = "1.13.2";
-  format = "pyproject";
+  version = "1.14.0";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "laixintao";
    repo = "iredis";
    rev = "refs/tags/v${version}";
-    hash = "sha256-dGOB7emhuP+V0pHlSdS1L1OC4jO3jtf5RFOy0UFYiuY=";
+    hash = "sha256-5TMO1c29ahAQDbAJZb3u2oY0Z8M+6b8hwbNfqMsuPzM=";
  };

-  pythonRelaxDeps = [
-    "configobj"
-    "wcwidth"
-    "click"
-    "packaging"
-  ];
-
  nativeBuildInputs = with python3.pkgs; [
    poetry-core
-    pythonRelaxDepsHook
  ];

  propagatedBuildInputs = with python3.pkgs; [
@@ -65,5 +57,6 @@ python3.pkgs.buildPythonApplication rec {
    homepage = "https://iredis.io/";
    license = licenses.bsd3;
    maintainers = with maintainers; [ marsam ];
+    mainProgram = "iredis";
  };
 }
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl
-, cmake, pkg-config, perl, go, python3
+, cmake, ninja, pkg-config, perl, go, python3
 , protobuf, zlib, gtest, brotli, lz4, zstd, libusb1, pcre2
 }:

@@ -9,33 +9,17 @@ in

 stdenv.mkDerivation rec {
  pname = "android-tools";
-  version = "34.0.1";
+  version = "34.0.4";

  src = fetchurl {
    url = "https://github.com/nmeum/android-tools/releases/download/${version}/android-tools-${version}.tar.xz";
-    hash = "sha256-YCNOy8oZoXp+L0akWBlg1kW3xVuHDZJKIUlMdqb1SOw=";
+    hash = "sha256-eiL/nOqB/0849WBoeFjo+PtzNiRBJZfjzBqwJi+No6E=";
  };

-  patches = [
-    # Fix building with newer protobuf versions.
-    (fetchurl {
-      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/android-tools/-/raw/295ad7d5cb1e3b4c75bd40281d827f9168bbaa57/protobuf-23.patch";
-      hash = "sha256-KznGgZdYT6e5wG3gtfJ6i93bYfp/JFygLW/ZzvXUA0Y=";
-    })
-  ];
-
-  # Fix linking with private abseil-cpp libraries.
-  postPatch = ''
-    sed -i '/^find_package(Protobuf REQUIRED)$/i find_package(protobuf CONFIG)' vendor/CMakeLists.txt
-  '';
-
-  nativeBuildInputs = [ cmake pkg-config perl go ];
+  nativeBuildInputs = [ cmake ninja pkg-config perl go ];
  buildInputs = [ protobuf zlib gtest brotli lz4 zstd libusb1 pcre2 ];
  propagatedBuildInputs = [ pythonEnv ];

-  # Don't try to fetch any Go modules via the network:
-  GOFLAGS = [ "-mod=vendor" ];
-
  preConfigure = ''
    export GOCACHE=$TMPDIR/go-cache
  '';
@@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "gh-actions-cache";
-  version = "1.0.3";
+  version = "1.0.4";

  src = fetchFromGitHub {
    owner = "actions";
    repo = "gh-actions-cache";
    rev = "v${version}";
-    hash = "sha256-5iCj6z4HCMVFeplb3dGP/V60z6zMUnUPVBMnPi4yU1Q=";
+    hash = "sha256-GVha3xxLTBTiKfAjGb2q9btsGYzWQivGLyZ4Gg0s/N0=";
  };

-  vendorHash = "sha256-i9akQ0IjH9NItjYvMWLiGnFQrfZhA7SOvPZiUvdtDrk=";
+  vendorHash = "sha256-4/Zt+ga3abEPtR0FjWIsDpOiG1bfVtVuLuXP8aHbzqk=";

  ldflags = [
    "-s"
@@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "mapcidr";
-  version = "1.1.11";
+  version = "1.1.13";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = pname;
    rev = "refs/tags/v${version}";
-    hash = "sha256-gi1saAav8VrlssXW8ezLAze2kp1hnATd3RCIZUspEcM=";
+    hash = "sha256-ggfk9ceogvTP0Q1RzA6tZgEj+iVVuGa+MU0zSZfO2ZI=";
  };

-  vendorHash = "sha256-9mX+EUeLp4zpVHAzdlmrr31vjWjG1VjHwSDwbTxMufM=";
+  vendorHash = "sha256-wqbAOoRQEE7CDmaH5MRzsSKOdyrxwBY/1wDz3MCfsBc=";

  modRoot = ".";
  subPackages = [
@@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv, perl, makeWrapper, procps, coreutils, buildPackages }:
+{ fetchurl, lib, stdenv, perl, makeWrapper, procps, coreutils, gawk, buildPackages }:

 stdenv.mkDerivation rec {
  pname = "parallel";
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {

  postInstall = ''
    wrapProgram $out/bin/parallel \
-      --prefix PATH : "${lib.makeBinPath [ procps perl coreutils ]}"
+      --prefix PATH : "${lib.makeBinPath [ procps perl coreutils gawk ]}"
  '';

  doCheck = true;
@@ -11,23 +11,22 @@

 buildGoModule rec {
  pname = "sing-box";
-  version = "1.5.5";
+  version = "1.6.0";

  src = fetchFromGitHub {
    owner = "SagerNet";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-/8BeBBFbtVpqEVqlt3wNF5+qZvExtPngbic8kR7Gkck=";
+    hash = "sha256-buYI/WCVwjN5iSmyT1sM969oFuOPxaEjK5CwrLuX7/o=";
  };

-  vendorHash = "sha256-xB0A3jbwNSISipKLB3WPuqM8mfjN4IYbiwhUs04K8VY=";
+  vendorHash = "sha256-gEUYR7nfmaAcm9qJt8q0IFd/EECHbxuWYZIU+nVs100=";

  tags = [
    "with_quic"
    "with_grpc"
    "with_dhcp"
    "with_wireguard"
-    "with_shadowsocksr"
    "with_ech"
    "with_utls"
    "with_reality_server"
@@ -5,14 +5,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "sigma-cli";
-  version = "0.7.7";
+  version = "0.7.8";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "SigmaHQ";
-    repo = pname;
+    repo = "sigma-cli";
    rev = "refs/tags/v${version}";
-    hash = "sha256-Qqe9nJZfCb7xh93ERrV3XpqdtfeRECt7RDca9eQU3eQ=";
+    hash = "sha256-HvT2B0pahQbwa0atN2o9rc93QkCIaPttV859wOyHQzY=";
  };

  postPatch = ''
@@ -50,6 +50,11 @@ python3.pkgs.buildPythonApplication rec {
    "test_plugin_install_notexisting"
    "test_plugin_install"
    "test_plugin_uninstall"
+    # Tests require network access
+    "test_check_with_issues"
+    "test_plugin_show_identifier"
+    "test_plugin_show_nonexisting"
+    "test_plugin_show_uuid"
  ];

  pythonImportsCheck = [
@@ -59,6 +64,7 @@ python3.pkgs.buildPythonApplication rec {
  meta = with lib; {
    description = "Sigma command line interface";
    homepage = "https://github.com/SigmaHQ/sigma-cli";
+    changelog = "https://github.com/SigmaHQ/sigma-cli/releases/tag/v${version}";
    license = with licenses; [ lgpl21Plus ];
    maintainers = with maintainers; [ fab ];
    mainProgram = "sigma";
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "trufflehog";
-  version = "3.61.0";
+  version = "3.62.0";

  src = fetchFromGitHub {
    owner = "trufflesecurity";
    repo = "trufflehog";
    rev = "refs/tags/v${version}";
-    hash = "sha256-thUDdfNSQHybP5y03Jh94u8lHlj0FSuJP+U+d1OqKI8=";
+    hash = "sha256-lG3gU5cDbrvYejLC4YFAHwBne7OicGCY5XPJtte7rGo=";
  };

-  vendorHash = "sha256-KEU2G5x2d0N+H8p9MXL9yzK1lC0YqWuuxcLw/cboUzs=";
+  vendorHash = "sha256-jdJ0Avh1wNisO6f3qvUV1rNX5nKnmP7EHVTL79sE4A0=";

  ldflags = [
    "-s"
@@ -1,51 +1,42 @@
-{ stdenv, lib, fetchFromGitHub, rustPlatform, makeWrapper, ffmpeg
-, pandoc, poppler_utils, ripgrep, Security, imagemagick, tesseract3
+{ stdenv
+, lib
+, fetchFromGitHub
+, rustPlatform
+, makeWrapper
+, ffmpeg
+, pandoc
+, poppler_utils
+, ripgrep
+, Security
+, zip
 }:

 rustPlatform.buildRustPackage rec {
  pname = "ripgrep-all";
-  version = "0.9.6";
+  version = "1.0.0-alpha.5";

  src = fetchFromGitHub {
    owner = "phiresky";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1wjpgi7m3lxybllkr3r60zaphp02ykq2syq72q9ail2760cjcir6";
+    sha256 = "sha256-fpDYzn4oAz6GJQef520+Vi2xI09xFjpWdAlFIAVzcoA=";
  };

-  cargoSha256 = "1l71xj5crfb51wfp2bdvdqp1l8kg182n5d6w23lq2wjszaqcj7cw";
-  nativeBuildInputs = [ makeWrapper ];
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "tokio-tar-0.3.1" = "sha256-gp4UM6YV7P9k1FZxt3eVjyC4cK1zvpMjM5CPt2oVBEA=";
+    };
+  };
+
+  nativeBuildInputs = [ makeWrapper poppler_utils ];
  buildInputs = lib.optional stdenv.isDarwin Security;

  postInstall = ''
    wrapProgram $out/bin/rga \
-      --prefix PATH ":" "${lib.makeBinPath [ ffmpeg pandoc poppler_utils ripgrep imagemagick tesseract3 ]}"
+    --prefix PATH ":" "${lib.makeBinPath [ ffmpeg pandoc poppler_utils ripgrep zip ]}"
  '';

-  # Use upstream's example data to run a couple of queries to ensure the dependencies
-  # for all of the adapters are available.
-  installCheckPhase = ''
-    set -e
-    export PATH="$PATH:$out/bin"
-
-    test1=$(rga --rga-no-cache "hello" exampledir/ | wc -l)
-    test2=$(rga --rga-no-cache --rga-adapters=tesseract "crate" exampledir/screenshot.png | wc -l)
-
-    if [ $test1 != 26 ]
-    then
-      echo "ERROR: test1 failed! Could not find the word 'hello' 26 times in the sample data."
-      exit 1
-    fi
-
-    if [ $test2 != 1 ]
-    then
-      echo "ERROR: test2 failed! Could not find the word 'crate' in the screenshot."
-      exit 1
-    fi
-  '';
-
-  doInstallCheck = true;
-
  meta = with lib; {
    description = "Ripgrep, but also search in PDFs, E-Books, Office documents, zip, tar.gz, and more";
    longDescription = ''
@@ -1,14 +1,20 @@
-{ lib, python3Packages, fetchPypi, ffmpeg }:
+{ lib, python3Packages, fetchFromGitHub, ffmpeg }:

 python3Packages.buildPythonApplication rec {
  pname = "vcsi";
-  version = "7.0.13";
+  version = "7.0.16";

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "01qwbb2l8gwf622zzhh0kzdzw3njvsdwmndwn01i9bn4qm5cas8r";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "amietn";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-I0o6GX/TNMfU+rQtSqReblRplXPynPF6m2zg0YokmtI=";
  };

+  nativeBuildInputs = [ python3Packages.poetry-core ];
+
  propagatedBuildInputs = with python3Packages; [
    numpy
    pillow
@@ -26,6 +32,6 @@ python3Packages.buildPythonApplication rec {
    description = "Create video contact sheets";
    homepage = "https://github.com/amietn/vcsi";
    license = licenses.mit;
-    maintainers = with maintainers; [ dandellion ];
+    maintainers = with maintainers; [ dandellion zopieux ];
  };
 }
@@ -711,6 +711,7 @@ mapAliases ({
  pinentry_qt = throw "'pinentry_qt' has been renamed to/replaced by 'pinentry-qt'"; # Converted to throw 2023-09-10
  pinentry_qt5 = pinentry-qt; # Added 2020-02-11
  poetry2nix = throw "poetry2nix is now maintained out-of-tree. Please use https://github.com/nix-community/poetry2nix/"; # Added 2023-10-26
+  privacyidea = throw "privacyidea has been removed from nixpkgs"; # Added 2023-10-31
  probe-rs-cli = throw "probe-rs-cli is now part of the probe-rs package"; # Added 2023-07-03
  processing3 = throw "'processing3' has been renamed to/replaced by 'processing'"; # Converted to throw 2023-09-10
  prometheus-dmarc-exporter = dmarc-metrics-exporter; # added 2022-05-31
@@ -5797,7 +5797,7 @@ with pkgs;

  klipper = callPackage ../servers/klipper { };

-  klipper-firmware = callPackage ../servers/klipper/klipper-firmware.nix { };
+  klipper-firmware = callPackage ../servers/klipper/klipper-firmware.nix { gcc-arm-embedded = gcc-arm-embedded-11; };

  klipper-flash = callPackage ../servers/klipper/klipper-flash.nix { };

@@ -16898,7 +16898,7 @@ with pkgs;
    ocamlformat # latest version
    ocamlformat_0_19_0 ocamlformat_0_20_0 ocamlformat_0_20_1 ocamlformat_0_21_0
    ocamlformat_0_22_4 ocamlformat_0_23_0 ocamlformat_0_24_1 ocamlformat_0_25_1
-    ocamlformat_0_26_0;
+    ocamlformat_0_26_0 ocamlformat_0_26_1;

  inherit (ocamlPackages) odig;

@@ -19878,8 +19878,6 @@ with pkgs;

  premake = premake4;

-  privacyidea = callPackage ../applications/misc/privacyidea { };
-
  process-compose = callPackage ../applications/misc/process-compose { };

  process-viewer = callPackage ../applications/misc/process-viewer { };
@@ -22547,6 +22545,8 @@ with pkgs;
    then pkgs.libcanberra
    else pkgs.libcanberra-gtk2;

+  libcaption = callPackage ../development/libraries/libcaption { };
+
  libcbor = callPackage ../development/libraries/libcbor { };

  libccd = callPackage ../development/libraries/libccd { };
@@ -26237,7 +26237,7 @@ with pkgs;
    jre = pkgs.jdk11_headless;
    python = python3;
  };
-  cassandra = cassandra_3_11;
+  cassandra = cassandra_4;

  cassandra-cpp-driver = callPackage ../development/libraries/cassandra-cpp-driver/default.nix { };

@@ -38321,6 +38321,11 @@ with pkgs;
  };

  shattered-pixel-dungeon = callPackage ../games/shattered-pixel-dungeon { };
+  rkpd2 = callPackage ../games/shattered-pixel-dungeon/rkpd2.nix { };
+  rat-king-adventure = callPackage ../games/shattered-pixel-dungeon/rat-king-adventure.nix { };
+  experienced-pixel-dungeon = callPackage ../games/shattered-pixel-dungeon/experienced-pixel-dungeon.nix { };
+  summoning-pixel-dungeon = callPackage ../games/shattered-pixel-dungeon/summoning-pixel-dungeon.nix { };
+  shorter-pixel-dungeon = callPackage ../games/shattered-pixel-dungeon/shorter-pixel-dungeon.nix { };

  shticker-book-unwritten = callPackage ../games/shticker-book-unwritten { };

@@ -1273,6 +1273,7 @@ let
    ocamlformat_0_24_1 = ocamlformat.override { version = "0.24.1"; };
    ocamlformat_0_25_1 = ocamlformat.override { version = "0.25.1"; };
    ocamlformat_0_26_0 = ocamlformat.override { version = "0.26.0"; };
+    ocamlformat_0_26_1 = ocamlformat.override { version = "0.26.1"; };

    ocamlformat = callPackage ../development/ocaml-modules/ocamlformat/ocamlformat.nix {};

@@ -262,7 +262,7 @@ mapAliases ({
  poster3 = throw "poster3 is unmaintained and source is no longer available"; # added 2023-05-29
  postorius = throw "Please use pkgs.mailmanPackages.postorius"; # added 2022-04-29
  powerlineMemSegment = powerline-mem-segment; # added 2021-10-08
-  privacyidea = throw "privacyidea has been renamed to pkgs.privacyidea"; # added 2021-06-20
+  privacyidea-ldap-proxy = throw "privacyidea-ldap-proxy has been removed from nixpkgs"; # added 2023-10-31
  prometheus_client = prometheus-client; # added 2021-06-10
  prompt_toolkit = prompt-toolkit; # added 2021-07-22
  protonup = protonup-ng; # Added 2022-11-06
@@ -9510,8 +9510,6 @@ self: super: with self; {

  prison = callPackage ../development/python-modules/prison { };

-  privacyidea-ldap-proxy = callPackage ../development/python-modules/privacyidea-ldap-proxy { };
-
  proboscis = callPackage ../development/python-modules/proboscis { };

  process-tests = callPackage ../development/python-modules/process-tests { };