From 4be64d9d058bd2ecf73ac64002c094c1a7dcd97b Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 8 Jul 2025 15:45:44 +0300
Subject: [PATCH 01/12] ubootAmx335xEVM: mark broken

---
 pkgs/misc/uboot/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 90ad35aae031..7d671ecf84dd 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -222,7 +222,10 @@ in
 
   ubootAmx335xEVM = buildUBoot {
     defconfig = "am335x_evm_defconfig";
-    extraMeta.platforms = [ "armv7l-linux" ];
+    extraMeta = {
+      platforms = [ "armv7l-linux" ];
+      broken = true; # too big, exceeds memory size
+    };
     filesToInstall = [
       "MLO"
       "u-boot.img"

From ae9f1765fc73be7966522c4f9fa1086d60bd59da Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 8 Jul 2025 15:45:52 +0300
Subject: [PATCH 02/12] ubootSheevaplug: mark broken

---
 pkgs/misc/uboot/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 7d671ecf84dd..5066211e1255 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -784,7 +784,10 @@ in
 
   ubootSheevaplug = buildUBoot {
     defconfig = "sheevaplug_defconfig";
-    extraMeta.platforms = [ "armv5tel-linux" ];
+    extraMeta = {
+      platforms = [ "armv5tel-linux" ];
+      broken = true; # too big, exceeds partition size
+    };
     filesToInstall = [ "u-boot.kwb" ];
   };
 

From 08605bb2b99703311cf7089ed827cf15c3db05f4 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 8 Jul 2025 15:49:37 +0300
Subject: [PATCH 03/12] ubootRockPro64: drop patch that should no longer be
 necessary

Further testing needed.
---
 pkgs/misc/uboot/default.nix | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 5066211e1255..693e7424a4c2 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -755,13 +755,6 @@ in
   };
 
   ubootRockPro64 = buildUBoot {
-    extraPatches = [
-      # https://patchwork.ozlabs.org/project/uboot/list/?series=237654&archive=both&state=*
-      (fetchpatch {
-        url = "https://patchwork.ozlabs.org/series/237654/mbox/";
-        sha256 = "0aiw9zk8w4msd3v8nndhkspjify0yq6a5f0zdy6mhzs0ilq896c3";
-      })
-    ];
     defconfig = "rockpro64-rk3399_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
     BL31 = "${armTrustedFirmwareRK3399}/bl31.elf";

From 76f5cd8f8197c34c3ef7532a3cc67664c18a76c0 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 8 Jul 2025 15:32:21 +0300
Subject: [PATCH 04/12] uboot: 2025.01 -> 2025.07

---
 ...configs-rpi-allow-for-bigger-kernels.patch | 19 -------------------
 pkgs/misc/uboot/default.nix                   |  8 +++-----
 2 files changed, 3 insertions(+), 24 deletions(-)
 delete mode 100644 pkgs/misc/uboot/0001-configs-rpi-allow-for-bigger-kernels.patch

diff --git a/pkgs/misc/uboot/0001-configs-rpi-allow-for-bigger-kernels.patch b/pkgs/misc/uboot/0001-configs-rpi-allow-for-bigger-kernels.patch
deleted file mode 100644
index 65497a6d4f06..000000000000
--- a/pkgs/misc/uboot/0001-configs-rpi-allow-for-bigger-kernels.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-diff --git a/board/raspberrypi/rpi/rpi.env b/board/raspberrypi/rpi/rpi.env
-index 30228285ed..0327ef74fa 100644
---- a/board/raspberrypi/rpi/rpi.env
-+++ b/board/raspberrypi/rpi/rpi.env
-@@ -69,9 +69,9 @@ fdt_high=ffffffff
- initrd_high=ffffffff
- #endif
- kernel_addr_r=0x00080000
--scriptaddr=0x02400000
--pxefile_addr_r=0x02500000
--fdt_addr_r=0x02600000
--ramdisk_addr_r=0x02700000
-+scriptaddr=0x05500000
-+pxefile_addr_r=0x05600000
-+fdt_addr_r=0x05700000
-+ramdisk_addr_r=0x05800000
- 
- boot_targets=mmc usb pxe dhcp
-
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 693e7424a4c2..e5d9b16eb354 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -32,10 +32,10 @@
 }@pkgs:
 
 let
-  defaultVersion = "2025.01";
+  defaultVersion = "2025.07";
   defaultSrc = fetchurl {
     url = "https://ftp.denx.de/pub/u-boot/u-boot-${defaultVersion}.tar.bz2";
-    hash = "sha256-ze99UHyT8bvZ8BXqm8IfoHQmhIFAVQGUWrxvhU1baG8=";
+    hash = "sha256-D5M/bFpCaJW/MG6T5qxTxghw5LVM2lbZUhG+yZ5jvsc=";
   };
 
   # Dependencies for the tools need to be included as either native or cross,
@@ -71,9 +71,7 @@ let
 
         src = if src == null then defaultSrc else src;
 
-        patches = [
-          ./0001-configs-rpi-allow-for-bigger-kernels.patch
-        ] ++ extraPatches;
+        patches = extraPatches;
 
         postPatch = ''
           ${lib.concatMapStrings (script: ''

From f4a9152f34cf7d727e44f51c0095955fd3098de5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Oliv=C3=A9r=20Falvai?= <ofalvai@gmail.com>
Date: Fri, 25 Apr 2025 21:47:45 +0200
Subject: [PATCH 05/12] go-tools: enable tests

---
 pkgs/by-name/go/go-tools/package.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/by-name/go/go-tools/package.nix b/pkgs/by-name/go/go-tools/package.nix
index 27feb8aeeec3..0f6dd8648fbd 100644
--- a/pkgs/by-name/go/go-tools/package.nix
+++ b/pkgs/by-name/go/go-tools/package.nix
@@ -19,8 +19,6 @@ buildGoModule rec {
 
   excludedPackages = [ "website" ];
 
-  doCheck = false;
-
   meta = with lib; {
     description = "Collection of tools and libraries for working with Go code, including linters and static analysis";
     homepage = "https://staticcheck.io";

From 4491dfaa0c863679cd8e707274f98c2fed62d6c6 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Wed, 9 Jul 2025 12:25:54 +0800
Subject: [PATCH 06/12] nixosTests.scion-freestanding-deployment: handleTest ->
 runTest

---
 nixos/tests/all-tests.nix                     |   2 +-
 .../scion/freestanding-deployment/default.nix | 398 +++++++++---------
 2 files changed, 194 insertions(+), 206 deletions(-)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 1b97ca80a798..20f9aee24dce 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1262,7 +1262,7 @@ in
   saunafs = runTest ./saunafs.nix;
   scaphandre = handleTest ./scaphandre.nix { };
   schleuder = runTest ./schleuder.nix;
-  scion-freestanding-deployment = handleTest ./scion/freestanding-deployment { };
+  scion-freestanding-deployment = runTest ./scion/freestanding-deployment;
   scrutiny = runTest ./scrutiny.nix;
   scx = runTest ./scx/default.nix;
   sddm = import ./sddm.nix { inherit runTest; };
diff --git a/nixos/tests/scion/freestanding-deployment/default.nix b/nixos/tests/scion/freestanding-deployment/default.nix
index 7dbd10c225a5..cd1d35203e7b 100644
--- a/nixos/tests/scion/freestanding-deployment/default.nix
+++ b/nixos/tests/scion/freestanding-deployment/default.nix
@@ -1,211 +1,199 @@
 # implements https://github.com/scionproto/scion/blob/27983125bccac6b84d1f96f406853aab0e460405/doc/tutorials/deploy.rst
-import ../../make-test-python.nix (
-  { pkgs, ... }:
-  let
-    trust-root-configuration-keys = pkgs.runCommand "generate-trc-keys.sh" {
-      buildInputs = [
+{ pkgs, ... }:
+let
+  trust-root-configuration-keys = pkgs.runCommand "generate-trc-keys.sh" {
+    buildInputs = [
+      pkgs.scion
+    ];
+  } (builtins.readFile ./bootstrap.sh);
+
+  imports = hostId: [
+    {
+      services.scion = {
+        enable = true;
+        bypassBootstrapWarning = true;
+      };
+      networking = {
+        useNetworkd = true;
+        useDHCP = false;
+      };
+      systemd.network.networks."01-eth1" = {
+        name = "eth1";
+        networkConfig.Address = "192.168.1.${toString hostId}/24";
+      };
+      environment.etc = {
+        "scion/topology.json".source = ./topology + "${toString hostId}.json";
+        "scion/crypto/as".source = trust-root-configuration-keys + "/AS${toString hostId}";
+        "scion/certs/ISD42-B1-S1.trc".source = trust-root-configuration-keys + "/ISD42-B1-S1.trc";
+        "scion/keys/master0.key".text = "U${toString hostId}v4k23ZXjGDwDofg/Eevw==";
+        "scion/keys/master1.key".text = "dBMko${toString hostId}qMS8DfrN/zP2OUdA==";
+      };
+      environment.systemPackages = [
         pkgs.scion
       ];
-    } (builtins.readFile ./bootstrap.sh);
-
-    imports = hostId: [
-      ({
-        services.scion = {
-          enable = true;
-          bypassBootstrapWarning = true;
-        };
-        networking = {
-          useNetworkd = true;
-          useDHCP = false;
-        };
-        systemd.network.networks."01-eth1" = {
-          name = "eth1";
-          networkConfig.Address = "192.168.1.${toString hostId}/24";
-        };
-        environment.etc = {
-          "scion/topology.json".source = ./topology + "${toString hostId}.json";
-          "scion/crypto/as".source = trust-root-configuration-keys + "/AS${toString hostId}";
-          "scion/certs/ISD42-B1-S1.trc".source = trust-root-configuration-keys + "/ISD42-B1-S1.trc";
-          "scion/keys/master0.key".text = "U${toString hostId}v4k23ZXjGDwDofg/Eevw==";
-          "scion/keys/master1.key".text = "dBMko${toString hostId}qMS8DfrN/zP2OUdA==";
-        };
-        environment.systemPackages = [
-          pkgs.scion
-        ];
-      })
-    ];
-  in
-  {
-    name = "scion-test";
-    nodes = {
-      scion01 =
-        { ... }:
-        {
-          imports = (imports 1);
-        };
-      scion02 =
-        { ... }:
-        {
-          imports = (imports 2);
-        };
-      scion03 =
-        { ... }:
-        {
-          imports = (imports 3);
-        };
-      scion04 =
-        { ... }:
-        {
-          imports = (imports 4);
-          networking.interfaces."lo".ipv4.addresses = [
-            {
-              address = "172.16.1.1";
-              prefixLength = 32;
-            }
-          ];
-          services.scion.scion-ip-gateway = {
-            enable = true;
-            config = {
-              tunnel = {
-                src_ipv4 = "172.16.1.1";
-              };
-            };
-            trafficConfig = {
-              ASes = {
-                "42-ffaa:1:5" = {
-                  Nets = [
-                    "172.16.100.0/24"
-                  ];
-                };
-              };
-              ConfigVersion = 9001;
-            };
-          };
-        };
-      scion05 =
-        { ... }:
-        {
-          imports = (imports 5);
-          networking.interfaces."lo".ipv4.addresses = [
-            {
-              address = "172.16.100.1";
-              prefixLength = 32;
-            }
-          ];
-          services.scion.scion-ip-gateway = {
-            enable = true;
-            config = {
-              tunnel = {
-                src_ipv4 = "172.16.100.1";
-              };
-            };
-            trafficConfig = {
-              ASes = {
-                "42-ffaa:1:4" = {
-                  Nets = [
-                    "172.16.1.0/24"
-                  ];
-                };
-              };
-              ConfigVersion = 9001;
-            };
-          };
-        };
+    }
+  ];
+in
+{
+  name = "scion-test";
+  nodes = {
+    scion01 = {
+      imports = (imports 1);
     };
-    testScript =
-      let
-        pingAll = pkgs.writeShellScript "ping-all-scion.sh" ''
-          addresses="42-ffaa:1:1 42-ffaa:1:2 42-ffaa:1:3 42-ffaa:1:4 42-ffaa:1:5"
-          timeout=100
-          wait_for_all() {
-            ret=0
-            for as in "$@"
-            do
-              scion showpaths $as --no-probe > /dev/null
-              ret=$?
-              if [ "$ret" -ne "0" ]; then
-                break
-              fi
-            done
-            return $ret
-          }
-          ping_all() {
-            ret=0
-            for as in "$@"
-            do
-              scion ping "$as,127.0.0.1" -c 3
-              ret=$?
-              if [ "$ret" -ne "0" ]; then
-                break
-              fi
-            done
-            return $ret
-          }
-          for i in $(seq 0 $timeout); do
-            sleep 1
-            wait_for_all $addresses || continue
-            ping_all $addresses && exit 0
+    scion02 = {
+      imports = (imports 2);
+    };
+    scion03 = {
+      imports = (imports 3);
+    };
+    scion04 = {
+      imports = (imports 4);
+      networking.interfaces."lo".ipv4.addresses = [
+        {
+          address = "172.16.1.1";
+          prefixLength = 32;
+        }
+      ];
+      services.scion.scion-ip-gateway = {
+        enable = true;
+        config = {
+          tunnel = {
+            src_ipv4 = "172.16.1.1";
+          };
+        };
+        trafficConfig = {
+          ASes = {
+            "42-ffaa:1:5" = {
+              Nets = [
+                "172.16.100.0/24"
+              ];
+            };
+          };
+          ConfigVersion = 9001;
+        };
+      };
+    };
+    scion05 = {
+      imports = (imports 5);
+      networking.interfaces."lo".ipv4.addresses = [
+        {
+          address = "172.16.100.1";
+          prefixLength = 32;
+        }
+      ];
+      services.scion.scion-ip-gateway = {
+        enable = true;
+        config = {
+          tunnel = {
+            src_ipv4 = "172.16.100.1";
+          };
+        };
+        trafficConfig = {
+          ASes = {
+            "42-ffaa:1:4" = {
+              Nets = [
+                "172.16.1.0/24"
+              ];
+            };
+          };
+          ConfigVersion = 9001;
+        };
+      };
+    };
+  };
+  testScript =
+    let
+      pingAll = pkgs.writeShellScript "ping-all-scion.sh" ''
+        addresses="42-ffaa:1:1 42-ffaa:1:2 42-ffaa:1:3 42-ffaa:1:4 42-ffaa:1:5"
+        timeout=100
+        wait_for_all() {
+          ret=0
+          for as in "$@"
+          do
+            scion showpaths $as --no-probe > /dev/null
+            ret=$?
+            if [ "$ret" -ne "0" ]; then
+              break
+            fi
           done
-          exit 1
-        '';
-      in
-      ''
-        # List of AS instances
-        machines = [scion01, scion02, scion03, scion04, scion05]
-
-        # Functions to avoid many for loops
-        def start(allow_reboot=False):
-            for i in machines:
-                i.start(allow_reboot=allow_reboot)
-
-        def wait_for_unit(service_name):
-            for i in machines:
-                i.wait_for_unit(service_name)
-
-        def succeed(command):
-            for i in machines:
-                i.succeed(command)
-
-        def reboot():
-            for i in machines:
-                i.reboot()
-
-        def crash():
-            for i in machines:
-                i.crash()
-
-        # Start all machines, allowing reboot for later
-        start(allow_reboot=True)
-
-        # Wait for scion-control.service on all instances
-        wait_for_unit("scion-control.service")
-
-        # Ensure cert is valid against TRC
-        succeed("scion-pki certificate verify --trc /etc/scion/certs/*.trc /etc/scion/crypto/as/*.pem >&2")
-
-        # Execute pingAll command on all instances
-        succeed("${pingAll} >&2")
-
-        # Execute ICMP pings across scion-ip-gateway
-        scion04.succeed("ping -c 3 172.16.100.1 >&2")
-        scion05.succeed("ping -c 3 172.16.1.1 >&2")
-
-        # Restart all scion services and ping again to test robustness
-        succeed("systemctl restart scion-* >&2")
-        succeed("${pingAll} >&2")
-
-        # Reboot machines, wait for service, and ping again
-        reboot()
-        wait_for_unit("scion-control.service")
-        succeed("${pingAll} >&2")
-
-        # Crash, start, wait for service, and ping again
-        crash()
-        start()
-        wait_for_unit("scion-control.service")
-        succeed("pkill -9 scion-* >&2")
-        wait_for_unit("scion-control.service")
-        succeed("${pingAll} >&2")
+          return $ret
+        }
+        ping_all() {
+          ret=0
+          for as in "$@"
+          do
+            scion ping "$as,127.0.0.1" -c 3
+            ret=$?
+            if [ "$ret" -ne "0" ]; then
+              break
+            fi
+          done
+          return $ret
+        }
+        for i in $(seq 0 $timeout); do
+          sleep 1
+          wait_for_all $addresses || continue
+          ping_all $addresses && exit 0
+        done
+        exit 1
       '';
-  }
-)
+    in
+    ''
+      # List of AS instances
+      machines = [scion01, scion02, scion03, scion04, scion05]
+
+      # Functions to avoid many for loops
+      def start(allow_reboot=False):
+          for i in machines:
+              i.start(allow_reboot=allow_reboot)
+
+      def wait_for_unit(service_name):
+          for i in machines:
+              i.wait_for_unit(service_name)
+
+      def succeed(command):
+          for i in machines:
+              i.succeed(command)
+
+      def reboot():
+          for i in machines:
+              i.reboot()
+
+      def crash():
+          for i in machines:
+              i.crash()
+
+      # Start all machines, allowing reboot for later
+      start(allow_reboot=True)
+
+      # Wait for scion-control.service on all instances
+      wait_for_unit("scion-control.service")
+
+      # Ensure cert is valid against TRC
+      succeed("scion-pki certificate verify --trc /etc/scion/certs/*.trc /etc/scion/crypto/as/*.pem >&2")
+
+      # Execute pingAll command on all instances
+      succeed("${pingAll} >&2")
+
+      # Execute ICMP pings across scion-ip-gateway
+      scion04.succeed("ping -c 3 172.16.100.1 >&2")
+      scion05.succeed("ping -c 3 172.16.1.1 >&2")
+
+      # Restart all scion services and ping again to test robustness
+      succeed("systemctl restart scion-* >&2")
+      succeed("${pingAll} >&2")
+
+      # Reboot machines, wait for service, and ping again
+      reboot()
+      wait_for_unit("scion-control.service")
+      succeed("${pingAll} >&2")
+
+      # Crash, start, wait for service, and ping again
+      crash()
+      start()
+      wait_for_unit("scion-control.service")
+      succeed("pkill -9 scion-* >&2")
+      wait_for_unit("scion-control.service")
+      succeed("${pingAll} >&2")
+    '';
+}

From ea3e5b125ccb0ea511da8becd2cd8843a2e56c5d Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Wed, 9 Jul 2025 12:15:45 +0800
Subject: [PATCH 07/12] nixosTests.scaphandre: handleTest -> runTest

---
 nixos/tests/all-tests.nix  |  2 +-
 nixos/tests/scaphandre.nix | 30 +++++++++++++-----------------
 2 files changed, 14 insertions(+), 18 deletions(-)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 1b97ca80a798..4223143e9f9a 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1260,7 +1260,7 @@ in
   sane = runTest ./sane.nix;
   sanoid = runTest ./sanoid.nix;
   saunafs = runTest ./saunafs.nix;
-  scaphandre = handleTest ./scaphandre.nix { };
+  scaphandre = runTest ./scaphandre.nix;
   schleuder = runTest ./schleuder.nix;
   scion-freestanding-deployment = handleTest ./scion/freestanding-deployment { };
   scrutiny = runTest ./scrutiny.nix;
diff --git a/nixos/tests/scaphandre.nix b/nixos/tests/scaphandre.nix
index 9ca191ab794b..bf9854b1c919 100644
--- a/nixos/tests/scaphandre.nix
+++ b/nixos/tests/scaphandre.nix
@@ -1,22 +1,18 @@
-import ./make-test-python.nix {
+{
   name = "scaphandre";
 
-  nodes = {
-    scaphandre =
-      { pkgs, ... }:
-      {
-        boot.kernelModules = [ "intel_rapl_common" ];
+  nodes.scaphandre =
+    { pkgs, ... }:
+    {
+      boot.kernelModules = [ "intel_rapl_common" ];
 
-        environment.systemPackages = [ pkgs.scaphandre ];
-      };
-  };
+      environment.systemPackages = [ pkgs.scaphandre ];
+    };
 
-  testScript =
-    { nodes, ... }:
-    ''
-      scaphandre.start()
-      scaphandre.wait_until_succeeds(
-          "scaphandre stdout -t 4",
-      )
-    '';
+  testScript = ''
+    scaphandre.start()
+    scaphandre.wait_until_succeeds(
+        "scaphandre stdout -t 4",
+    )
+  '';
 }

From f253690f029eebf6bcb538f329c38834d3023a70 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Wed, 9 Jul 2025 00:42:32 +0800
Subject: [PATCH 08/12] nixosTests.nagios: handleTest -> runTest

---
 nixos/tests/all-tests.nix |   2 +-
 nixos/tests/nagios.nix    | 224 +++++++++++++++++++-------------------
 2 files changed, 111 insertions(+), 115 deletions(-)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 4fd1c64693ac..8c0aca3c30c5 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -912,7 +912,7 @@ in
   mysql-backup = handleTest ./mysql/mysql-backup.nix { };
   mysql-replication = handleTest ./mysql/mysql-replication.nix { };
   n8n = runTest ./n8n.nix;
-  nagios = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./nagios.nix { };
+  nagios = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./nagios.nix;
   nar-serve = runTest ./nar-serve.nix;
   nat.firewall = handleTest ./nat.nix { withFirewall = true; };
   nat.standalone = handleTest ./nat.nix { withFirewall = false; };
diff --git a/nixos/tests/nagios.nix b/nixos/tests/nagios.nix
index 9dd58215be1f..8def92b441e1 100644
--- a/nixos/tests/nagios.nix
+++ b/nixos/tests/nagios.nix
@@ -1,124 +1,120 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "nagios";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ symphorien ];
+{ lib, ... }:
+{
+  name = "nagios";
+  meta = with lib.maintainers; {
+    maintainers = [ symphorien ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    let
+      writer = pkgs.writeShellScript "write" ''
+        set -x
+        echo "$@"  >> /tmp/notifications
+      '';
+    in
+    {
+      # tested service
+      services.sshd.enable = true;
+      # nagios
+      services.nagios = {
+        enable = true;
+        # make state transitions faster
+        extraConfig.interval_length = "5";
+        objectDefs =
+          (map (x: "${pkgs.nagios}/etc/objects/${x}.cfg") [
+            "templates"
+            "timeperiods"
+            "commands"
+          ])
+          ++ [
+            (pkgs.writeText "objects.cfg" ''
+              # notifications are written to /tmp/notifications
+              define command {
+              command_name notify-host-by-file
+              command_line ${writer} "$HOSTNAME is $HOSTSTATE$"
+              }
+              define command {
+              command_name notify-service-by-file
+              command_line ${writer} "$SERVICEDESC$ is $SERVICESTATE$"
+              }
+
+              # nagios boilerplate
+              define contact {
+              contact_name                    alice
+              alias                           alice
+              host_notifications_enabled      1
+              service_notifications_enabled   1
+              service_notification_period     24x7
+              host_notification_period        24x7
+              service_notification_options    w,u,c,r,f,s
+              host_notification_options       d,u,r,f,s
+              service_notification_commands   notify-service-by-file
+              host_notification_commands      notify-host-by-file
+              email                           foo@example.com
+              }
+              define contactgroup {
+              contactgroup_name   admins
+              alias               Admins
+              members alice
+              }
+              define hostgroup{
+              hostgroup_name  allhosts
+              alias  All hosts
+              }
+
+              # monitored objects
+              define host {
+              use         generic-host
+              host_name   localhost
+              alias       localhost
+              address     localhost
+              hostgroups  allhosts
+              contact_groups admins
+              # make state transitions faster.
+              max_check_attempts 2
+              check_interval 1
+              retry_interval 1
+              }
+              define service {
+              use                 generic-service
+              host_name           localhost
+              service_description ssh
+              check_command       check_ssh
+              # make state transitions faster.
+              max_check_attempts 2
+              check_interval 1
+              retry_interval 1
+              }
+            '')
+          ];
+      };
     };
 
-    nodes.machine =
-      { lib, ... }:
-      let
-        writer = pkgs.writeShellScript "write" ''
-          set -x
-          echo "$@"  >> /tmp/notifications
-        '';
-      in
-      {
-        # tested service
-        services.sshd.enable = true;
-        # nagios
-        services.nagios = {
-          enable = true;
-          # make state transitions faster
-          extraConfig.interval_length = "5";
-          objectDefs =
-            (map (x: "${pkgs.nagios}/etc/objects/${x}.cfg") [
-              "templates"
-              "timeperiods"
-              "commands"
-            ])
-            ++ [
-              (pkgs.writeText "objects.cfg" ''
-                # notifications are written to /tmp/notifications
-                define command {
-                command_name notify-host-by-file
-                command_line ${writer} "$HOSTNAME is $HOSTSTATE$"
-                }
-                define command {
-                command_name notify-service-by-file
-                command_line ${writer} "$SERVICEDESC$ is $SERVICESTATE$"
-                }
-
-                # nagios boilerplate
-                define contact {
-                contact_name                    alice
-                alias                           alice
-                host_notifications_enabled      1
-                service_notifications_enabled   1
-                service_notification_period     24x7
-                host_notification_period        24x7
-                service_notification_options    w,u,c,r,f,s
-                host_notification_options       d,u,r,f,s
-                service_notification_commands   notify-service-by-file
-                host_notification_commands      notify-host-by-file
-                email                           foo@example.com
-                }
-                define contactgroup {
-                contactgroup_name   admins
-                alias               Admins
-                members alice
-                }
-                define hostgroup{
-                hostgroup_name  allhosts
-                alias  All hosts
-                }
-
-                # monitored objects
-                define host {
-                use         generic-host
-                host_name   localhost
-                alias       localhost
-                address     localhost
-                hostgroups  allhosts
-                contact_groups admins
-                # make state transitions faster.
-                max_check_attempts 2
-                check_interval 1
-                retry_interval 1
-                }
-                define service {
-                use                 generic-service
-                host_name           localhost
-                service_description ssh
-                check_command       check_ssh
-                # make state transitions faster.
-                max_check_attempts 2
-                check_interval 1
-                retry_interval 1
-                }
-              '')
-            ];
-        };
-      };
-
-    testScript =
-      { ... }:
-      ''
-        with subtest("ensure sshd starts"):
-            machine.wait_for_unit("sshd.service")
+  testScript = ''
+    with subtest("ensure sshd starts"):
+        machine.wait_for_unit("sshd.service")
 
 
-        with subtest("ensure nagios starts"):
-            machine.wait_for_file("/var/log/nagios/current")
+    with subtest("ensure nagios starts"):
+        machine.wait_for_file("/var/log/nagios/current")
 
 
-        def assert_notify(text):
-            machine.wait_for_file("/tmp/notifications")
-            real = machine.succeed("cat /tmp/notifications").strip()
-            print(f"got {real!r}, expected {text!r}")
-            assert text == real
+    def assert_notify(text):
+        machine.wait_for_file("/tmp/notifications")
+        real = machine.succeed("cat /tmp/notifications").strip()
+        print(f"got {real!r}, expected {text!r}")
+        assert text == real
 
 
-        with subtest("ensure we get a notification when sshd is down"):
-            machine.succeed("systemctl stop sshd")
-            assert_notify("ssh is CRITICAL")
+    with subtest("ensure we get a notification when sshd is down"):
+        machine.succeed("systemctl stop sshd")
+        assert_notify("ssh is CRITICAL")
 
 
-        with subtest("ensure tests can succeed"):
-            machine.succeed("systemctl start sshd")
-            machine.succeed("rm /tmp/notifications")
-            assert_notify("ssh is OK")
-      '';
-  }
-)
+    with subtest("ensure tests can succeed"):
+        machine.succeed("systemctl start sshd")
+        machine.succeed("rm /tmp/notifications")
+        assert_notify("ssh is OK")
+  '';
+}

From d8ff41798b9052fc5c24d45202d41f573d66a720 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 10 Jul 2025 09:19:36 +0300
Subject: [PATCH 09/12] steam: add xdg-utils to fhsenv

Fixes #423871
---
 pkgs/by-name/st/steam/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/st/steam/package.nix b/pkgs/by-name/st/steam/package.nix
index 0a9ba6105321..7d7a18405606 100644
--- a/pkgs/by-name/st/steam/package.nix
+++ b/pkgs/by-name/st/steam/package.nix
@@ -45,6 +45,7 @@ let
           lsb-release # not documented, called from Big Picture
           pciutils # not documented, complains about lspci on startup
           glibc_multi.bin
+          xdg-utils # calls xdg-open occasionally
           xz
           zenity
 

From e30021f627be31915b394f4349d740ad9c116372 Mon Sep 17 00:00:00 2001
From: Mutsuha Asada <me@momee.mt>
Date: Tue, 10 Jun 2025 16:48:49 +0900
Subject: [PATCH 10/12] ocamlPackages.amqp-client: init at 2.3.0

---
 .../ocaml-modules/amqp-client/async.nix       | 29 ++++++++++++++
 .../ocaml-modules/amqp-client/default.nix     | 39 +++++++++++++++++++
 .../ocaml-modules/amqp-client/lwt.nix         | 28 +++++++++++++
 pkgs/top-level/ocaml-packages.nix             |  6 +++
 4 files changed, 102 insertions(+)
 create mode 100644 pkgs/development/ocaml-modules/amqp-client/async.nix
 create mode 100644 pkgs/development/ocaml-modules/amqp-client/default.nix
 create mode 100644 pkgs/development/ocaml-modules/amqp-client/lwt.nix

diff --git a/pkgs/development/ocaml-modules/amqp-client/async.nix b/pkgs/development/ocaml-modules/amqp-client/async.nix
new file mode 100644
index 000000000000..0bc781de66e4
--- /dev/null
+++ b/pkgs/development/ocaml-modules/amqp-client/async.nix
@@ -0,0 +1,29 @@
+{
+  buildDunePackage,
+  async,
+  uri,
+  amqp-client,
+  ezxmlm,
+}:
+
+buildDunePackage {
+  pname = "amqp-client-async";
+
+  inherit (amqp-client) version src;
+
+  doCheck = true;
+
+  buildInputs = [
+    ezxmlm
+  ];
+
+  propagatedBuildInputs = [
+    amqp-client
+    async
+    uri
+  ];
+
+  meta = amqp-client.meta // {
+    description = "Amqp client library, async version";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/amqp-client/default.nix b/pkgs/development/ocaml-modules/amqp-client/default.nix
new file mode 100644
index 000000000000..112710d2a439
--- /dev/null
+++ b/pkgs/development/ocaml-modules/amqp-client/default.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  buildDunePackage,
+  fetchFromGitHub,
+  version ? "2.3.0",
+}:
+
+buildDunePackage {
+  pname = "amqp-client";
+
+  inherit version;
+  minimalOCamlVersion = "4.14.0";
+
+  src = fetchFromGitHub {
+    owner = "andersfugmann";
+    repo = "amqp-client";
+    tag = version;
+    hash = "sha256-zWhkjVoKyNCIBXD5746FywCg3DKn1mXb1tn1VlF9Tyg=";
+  };
+
+  doCheck = true;
+
+  meta = {
+    description = "Amqp client base library";
+    homepage = "https://github.com/andersfugmann/amqp-client";
+    license = lib.licenses.bsd3;
+    changelog = "https://raw.githubusercontent.com/andersfugmann/amqp-client/refs/tags/${version}/Changelog";
+    maintainers = with lib.maintainers; [ momeemt ];
+    longDescription = ''
+      This library provides high level client bindings for amqp. The library
+      is tested with rabbitmq, but should work with other amqp
+      servers. The library is written in pure OCaml.
+
+      This is the base library required by lwt/async versions.
+      You should install either amqp-client-async or amqp-client-lwt
+      for actual client functionality.
+    '';
+  };
+}
diff --git a/pkgs/development/ocaml-modules/amqp-client/lwt.nix b/pkgs/development/ocaml-modules/amqp-client/lwt.nix
new file mode 100644
index 000000000000..6ddb2683c46e
--- /dev/null
+++ b/pkgs/development/ocaml-modules/amqp-client/lwt.nix
@@ -0,0 +1,28 @@
+{
+  buildDunePackage,
+  lwt,
+  lwt_log,
+  amqp-client,
+  uri,
+  ezxmlm,
+}:
+buildDunePackage {
+  pname = "amqp-client-lwt";
+
+  inherit (amqp-client) version src;
+
+  buildInputs = [ ezxmlm ];
+
+  propagatedBuildInputs = [
+    lwt
+    lwt_log
+    amqp-client
+    uri
+  ];
+
+  doCheck = true;
+
+  meta = amqp-client.meta // {
+    description = "Amqp client library, lwt version";
+  };
+}
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index ae6b6a4b7312..6a323c16944d 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -32,6 +32,12 @@ let
 
         ancient = callPackage ../development/ocaml-modules/ancient { };
 
+        amqp-client = callPackage ../development/ocaml-modules/amqp-client { };
+
+        amqp-client-async = callPackage ../development/ocaml-modules/amqp-client/async.nix { };
+
+        amqp-client-lwt = callPackage ../development/ocaml-modules/amqp-client/lwt.nix { };
+
         angstrom = callPackage ../development/ocaml-modules/angstrom { };
 
         angstrom-async = callPackage ../development/ocaml-modules/angstrom-async { };

From ae291a176133208a674ca25c67d624d7188a51d6 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 8 Jul 2025 15:41:14 +0300
Subject: [PATCH 11/12] ubootOrangePi5Max: init

---
 pkgs/misc/uboot/default.nix     | 13 +++++++++++++
 pkgs/top-level/all-packages.nix |  1 +
 2 files changed, 14 insertions(+)

diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index e5d9b16eb354..8142ede3407d 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -474,6 +474,19 @@ in
     ];
   };
 
+  ubootOrangePi5Max = buildUBoot {
+    defconfig = "orangepi-5-max-rk3588_defconfig";
+    extraMeta.platforms = [ "aarch64-linux" ];
+    BL31 = "${armTrustedFirmwareRK3588}/bl31.elf";
+    ROCKCHIP_TPL = rkbin.TPL_RK3588;
+    filesToInstall = [
+      "u-boot.itb"
+      "idbloader.img"
+      "u-boot-rockchip.bin"
+      "u-boot-rockchip-spi.bin"
+    ];
+  };
+
   ubootOrangePi5Plus = buildUBoot {
     defconfig = "orangepi-5-plus-rk3588_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f995ab32c465..bcc1e9f2dcb4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11348,6 +11348,7 @@ with pkgs;
     ubootOrangePi3
     ubootOrangePi3B
     ubootOrangePi5
+    ubootOrangePi5Max
     ubootOrangePi5Plus
     ubootOrangePiPc
     ubootOrangePiZeroPlus2H5

From 9118da1e21e09bb8970fd75f8e8cdeeb9271fb17 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 8 Jul 2025 16:04:56 +0300
Subject: [PATCH 12/12] arm-trusted-firmware: 2.12.1 -> 2.13.0

---
 pkgs/misc/arm-trusted-firmware/default.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/misc/arm-trusted-firmware/default.nix b/pkgs/misc/arm-trusted-firmware/default.nix
index 743e429c0051..c4618ba9403e 100644
--- a/pkgs/misc/arm-trusted-firmware/default.nix
+++ b/pkgs/misc/arm-trusted-firmware/default.nix
@@ -39,13 +39,13 @@ let
       rec {
 
         pname = "arm-trusted-firmware${lib.optionalString (platform != null) "-${platform}"}";
-        version = "2.12.1";
+        version = "2.13.0";
 
         src = fetchFromGitHub {
           owner = "ARM-software";
           repo = "arm-trusted-firmware";
-          tag = "lts-v${version}";
-          hash = "sha256-yPWygW1swSwL3DrHPNIlTeTeV7XG4C9ALFA/+OTiz+4=";
+          tag = "v${version}";
+          hash = "sha256-rxm5RCjT/MyMCTxiEC8jQeFMrCggrb2DRbs/qDPXb20=";
         };
 
         patches = lib.optionals deleteHDCPBlobBeforeBuild [
@@ -96,6 +96,9 @@ let
         hardeningDisable = [ "all" ];
         dontStrip = true;
 
+        # breaks secondary CPU bringup on at least RK3588, maybe others
+        env.NIX_CFLAGS_COMPILE = "-fomit-frame-pointer";
+
         meta =
           with lib;
           {