Merge staging-next into staging

2026-03-25 06:24:44 +00:00
parent 1229fd8829 e76f38868b
commit 8c9999bc72
77 changed files with 1030 additions and 1128 deletions
@@ -17325,6 +17325,11 @@
    github = "Mephistophiles";
    githubId = 4850908;
  };
+  Merikei = {
+    name = "Merikei";
+    github = "Merikei";
+    githubId = 73759842;
+  };
  merrkry = {
    email = "merrkry@tsubasa.moe";
    name = "merrkry";
@@ -31,7 +31,7 @@ in
      ;
    inherit (config.image) baseName;
    additionalSpace = "1024M";
-    pkgs = import ../../../.. { inherit (pkgs) system; }; # ensure we use the regular qemu-kvm package
+    pkgs = import ../../../.. { inherit (pkgs.stdenv.hostPlatform) system; }; # ensure we use the regular qemu-kvm package
    configFile = pkgs.writeText "configuration.nix" ''
      {
        imports = [ <nixpkgs/nixos/modules/virtualisation/openstack-config.nix> ];
@@ -1,20 +1,20 @@
 {
  config,
  lib,
-  pkgs,
  ...
 }:

 let
  cfg = config.services.firewalld;
-  format = pkgs.formats.keyValue { };
  inherit (lib) mkOption;
  inherit (lib.types)
+    attrsOf
    bool
    commas
    either
    enum
    nonEmptyStr
+    oneOf
    separatedString
    submodule
    ;
@@ -27,7 +27,10 @@ in
    '';
    default = { };
    type = submodule {
-      freeformType = format.type;
+      freeformType = attrsOf (oneOf [
+        bool
+        nonEmptyStr
+      ]);
      options = {
        DefaultZone = mkOption {
          type = nonEmptyStr;
@@ -191,8 +194,8 @@ in
      }
    ];

-    environment.etc."firewalld/firewalld.conf" = {
-      source = format.generate "firewalld.conf" cfg.settings;
-    };
+    environment.etc."firewalld/firewalld.conf".text = lib.concatMapAttrsStringSep "\n" (
+      k: v: "${k}=${if lib.isBool v then lib.boolToYesNo v else v}"
+    ) cfg.settings;
  };
 }
@@ -11,7 +11,6 @@ let
    literalExpression
    makeLibraryPath
    mkEnableOption
-    mkForce
    mkIf
    mkOption
    mkPackageOption
@@ -129,11 +128,6 @@ in

    hardware.cpu.intel.sgx.provision.enable = true;

-    # Make sure the AESM service can find the SGX devices until
-    # https://github.com/intel/linux-sgx/issues/772 is resolved
-    # and updated in nixpkgs.
-    hardware.cpu.intel.sgx.enableDcapCompat = mkForce true;
-
    systemd.services.aesmd =
      let
        storeAesmFolder = "${sgx-psw}/aesm";
@@ -156,25 +150,16 @@ in
        }
        // cfg.environment;

-        # Make sure any of the SGX application enclave devices is available
-        unitConfig.AssertPathExists = [
-          # legacy out-of-tree driver
-          "|/dev/isgx"
-          # DCAP driver
-          "|/dev/sgx/enclave"
-          # in-tree driver
-          "|/dev/sgx_enclave"
-        ];
+        # Ensure the SGX application enclave device is available
+        unitConfig.AssertPathExists = [ "/dev/sgx_enclave" ];

        serviceConfig = {
-          ExecStartPre = pkgs.writeShellScript "copy-aesmd-data-files.sh" ''
-            set -euo pipefail
-            whiteListFile="${aesmDataFolder}/white_list_cert_to_be_verify.bin"
-            if [[ ! -f "$whiteListFile" ]]; then
-              ${pkgs.coreutils}/bin/install -m 644 -D \
+          # Run with elevated privileges to create /var/opt/aesmd/... before
+          # dropping to DynamicUser.
+          ExecStartPre = ''
+            +${lib.getExe' pkgs.coreutils "install"} -m 644 -D \
                "${storeAesmFolder}/data/white_list_cert_to_be_verify.bin" \
-                "$whiteListFile"
-            fi
+                "${aesmDataFolder}/white_list_cert_to_be_verify.bin"
          '';
          ExecStart = "${sgx-psw}/bin/aesm_service --no-daemon";
          ExecReload = ''${pkgs.coreutils}/bin/kill -SIGHUP "$MAINPID"'';
@@ -196,9 +181,8 @@ in
          RuntimeDirectory = "aesmd";
          RuntimeDirectoryMode = "0750";

-          # Hardening
+          # --- Hardening ---

-          # chroot into the runtime directory
          RootDirectory = "%t/aesmd";
          BindReadOnlyPaths = [
            builtins.storeDir
@@ -215,10 +199,6 @@ in
          PrivateDevices = false;
          DevicePolicy = "closed";
          DeviceAllow = [
-            # legacy out-of-tree driver
-            "/dev/isgx rw"
-            # DCAP driver
-            "/dev/sgx rw"
            # in-tree driver
            "/dev/sgx_enclave rw"
            "/dev/sgx_provision rw"
@@ -230,7 +210,7 @@ in
          RestrictAddressFamilies = [
            # Allocates the socket /var/run/aesmd/aesm.socket
            "AF_UNIX"
-            # Uses the HTTP protocol to initialize some services
+            # Makes HTTPS requests to the Intel PCCS service (or a cache).
            "AF_INET"
            "AF_INET6"
          ];
@@ -3,7 +3,12 @@ mkdir -p "$metaDir"
 chmod 0755 "$metaDir"
 rm -f "$metaDir/*"

+IMDS_ENDPOINTS="http://169.254.169.254 http://[fd00:ec2::254]"
+IMDS_BASE_URL="http://169.254.169.254"
+IMDS_TOKEN=""
+
 get_imds_token() {
+  local endpoint=$1
  # retry-delay of 1 selected to give the system a second to get going,
  # but not add a lot to the bootup time
  curl \
@@ -15,10 +20,11 @@ get_imds_token() {
    -X PUT \
    --connect-timeout 1 \
    -H "X-aws-ec2-metadata-token-ttl-seconds: 600" \
-    http://169.254.169.254/latest/api/token
+    "$endpoint/latest/api/token"
 }

 preflight_imds_token() {
+  local endpoint=$1
  # retry-delay of 1 selected to give the system a second to get going,
  # but not add a lot to the bootup time
  curl \
@@ -30,13 +36,18 @@ preflight_imds_token() {
    --connect-timeout 1 \
    -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" \
    -o /dev/null \
-    http://169.254.169.254/1.0/meta-data/instance-id
+    "$endpoint/1.0/meta-data/instance-id"
 }

 try=1
 while [ $try -le 3 ]; do
  echo "(attempt $try/3) getting an EC2 instance metadata service v2 token..."
-  IMDS_TOKEN=$(get_imds_token) && break
+  for endpoint in $IMDS_ENDPOINTS; do
+    IMDS_TOKEN=$(get_imds_token "$endpoint") && IMDS_BASE_URL=$endpoint && break
+  done
+  if [ -n "$IMDS_TOKEN" ]; then
+    break
+  fi
  try=$((try + 1))
  sleep 1
 done
@@ -48,7 +59,7 @@ fi
 try=1
 while [ $try -le 10 ]; do
  echo "(attempt $try/10) validating the EC2 instance metadata service v2 token..."
-  preflight_imds_token && break
+  preflight_imds_token "$IMDS_BASE_URL" && break
  try=$((try + 1))
  sleep 1
 done
@@ -85,7 +96,7 @@ try_decompress() {
  fi
 }

-get_imds -o "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path
-(umask 077 && get_imds -o "$metaDir/user-data" http://169.254.169.254/1.0/user-data && try_decompress "$metaDir/user-data")
-get_imds -o "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname
-get_imds -o "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key
+get_imds -o "$metaDir/ami-manifest-path" "$IMDS_BASE_URL/1.0/meta-data/ami-manifest-path"
+(umask 077 && get_imds -o "$metaDir/user-data" "$IMDS_BASE_URL/1.0/user-data" && try_decompress "$metaDir/user-data")
+get_imds -o "$metaDir/hostname" "$IMDS_BASE_URL/1.0/meta-data/hostname"
+get_imds -o "$metaDir/public-keys-0-openssh-key" "$IMDS_BASE_URL/1.0/meta-data/public-keys/0/openssh-key"
@@ -2,12 +2,17 @@

 with pkgs.lib;

+let
+  imdsServer = import ./imds-server.nix { inherit pkgs; };
+in
 {
+  inherit imdsServer;
+
  makeEc2Test =
    {
      name,
      image,
-      userData,
+      userData ? null,
      script,
      hostname ? "ec2-instance",
      sshPublicKey ? null,
@@ -18,9 +23,13 @@ with pkgs.lib;
        name = "metadata";
        buildCommand = ''
          mkdir -p $out/1.0/meta-data
-          ln -s ${pkgs.writeText "userData" userData} $out/1.0/user-data
+          ${optionalString (
+            userData != null
+          ) "ln -s ${pkgs.writeText "userData" userData} $out/1.0/user-data"}
+          ${optionalString (userData == null) "touch $out/1.0/user-data"}
          echo "${hostname}" > $out/1.0/meta-data/hostname
          echo "(unknown)" > $out/1.0/meta-data/ami-manifest-path
+          echo "i-1234567890abcdef0" > $out/1.0/meta-data/instance-id
        ''
        + optionalString (sshPublicKey != null) ''
          mkdir -p $out/1.0/meta-data/public-keys/0
@@ -67,7 +76,7 @@ with pkgs.lib;
        start_command = (
            "qemu-kvm -m 1024"
            + " -device virtio-net-pci,netdev=vlan0"
-            + " -netdev 'user,id=vlan0,net=169.0.0.0/8,guestfwd=tcp:169.254.169.254:80-cmd:${pkgs.micro-httpd}/bin/micro_httpd ${metaData}'"
+            + " -netdev 'user,id=vlan0,net=169.0.0.0/8,guestfwd=tcp:169.254.169.254:80-cmd:${getExe imdsServer} ${metaData}'"
            + f" -drive file={disk_image},if=virtio,werror=report"
            + " $QEMU_OPTS"
        )
@@ -0,0 +1,4 @@
+# Minimal IMDSv2-compatible metadata server for NixOS EC2 tests.
+# Runs in inetd mode (stdin/stdout), drop-in for micro_httpd in
+# QEMU guestfwd and socat contexts.
+{ pkgs }: pkgs.writers.writePython3Bin "imds-server" { } (builtins.readFile ./imds-server.py)
@@ -0,0 +1,102 @@
+"""Minimal IMDSv2-compatible metadata server for NixOS EC2 tests.
+
+Runs in inetd mode: reads one HTTP request from stdin, writes the
+response to stdout. Drop-in replacement for micro_httpd in QEMU
+guestfwd and socat contexts.
+
+Usage: imds-server <metadata-directory>
+
+The metadata directory should contain:
+  latest/api/token                        - Token value (returned on PUT)
+  1.0/meta-data/hostname                  - Instance hostname
+  1.0/meta-data/ami-manifest-path         - AMI manifest path
+  1.0/meta-data/instance-id               - Instance ID
+  1.0/meta-data/public-keys/0/openssh-key - SSH public key
+  1.0/user-data                           - User data
+"""
+
+import os
+import sys
+
+
+def read_request():
+    """Read and parse one HTTP request from stdin (inetd mode)."""
+    request_line = sys.stdin.readline()
+    if not request_line:
+        sys.exit(0)
+
+    parts = request_line.strip().split()
+    method = parts[0] if parts else ""
+    path = parts[1] if len(parts) > 1 else "/"
+
+    headers = {}
+    while True:
+        line = sys.stdin.readline()
+        if not line or line.strip() == "":
+            break
+        if ":" in line:
+            key, _, value = line.partition(":")
+            headers[key.strip().lower()] = value.strip()
+
+    return method, path, headers
+
+
+def respond(status, body):
+    """Write an HTTP response to stdout."""
+    if isinstance(body, str):
+        body = body.encode()
+    header = (
+        f"HTTP/1.1 {status}\r\n"
+        f"Content-Type: text/plain\r\n"
+        f"Content-Length: {len(body)}\r\n"
+        f"Connection: close\r\n"
+        f"\r\n"
+    ).encode()
+    sys.stdout.buffer.write(header + body)
+    sys.stdout.buffer.flush()
+
+
+def main():
+    base_dir = sys.argv[1] if len(sys.argv) > 1 else "."
+
+    # Load expected token from file. If no token file exists, IMDSv2
+    # authentication is disabled — requests are served without tokens.
+    # This supports both EC2 (IMDSv2 with tokens) and OpenStack (plain GET)
+    # metadata fetchers.
+    token_path = os.path.join(base_dir, "latest", "api", "token")
+    if os.path.isfile(token_path):
+        with open(token_path) as f:
+            expected_token = f.read().strip()
+    else:
+        expected_token = None
+
+    method, path, headers = read_request()
+    rel_path = path.lstrip("/")
+
+    # PUT /latest/api/token — IMDSv2 token acquisition
+    if method == "PUT" and rel_path == "latest/api/token":
+        if expected_token is not None:
+            respond("200 OK", expected_token)
+        else:
+            respond("404 Not Found", "IMDSv2 token endpoint not configured\n")
+        return
+
+    # Token validation (only when a token file is present)
+    if expected_token is not None:
+        request_token = headers.get("x-aws-ec2-metadata-token", "")
+        if request_token != expected_token:
+            respond("401 Unauthorized", "Invalid or missing IMDSv2 token\n")
+            return
+
+    # Serve file from the metadata directory
+    file_path = os.path.join(base_dir, rel_path)
+    if os.path.isfile(file_path):
+        with open(file_path, "rb") as f:
+            content = f.read()
+        respond("200 OK", content)
+    else:
+        respond("404 Not Found", f"Not found: {path}\n")
+
+
+if __name__ == "__main__":
+    main()
@@ -13,6 +13,8 @@ let
  inherit (lib) mkAfter mkForce;
  pkgs = config.node.pkgs;

+  imdsServer = import ./common/imds-server.nix { inherit pkgs; };
+
  # Build an EC2 image configuration
  imageCfg =
    (import ../lib/eval-config.nix {
@@ -44,6 +46,13 @@ let
            ];
          };

+          # Packages needed for IPv6 IMDS fallback test
+          environment.systemPackages = [
+            pkgs.socat
+            imdsServer
+            pkgs.iptables
+          ];
+
          nixpkgs.pkgs = pkgs;
        }
      ];
@@ -87,11 +96,8 @@ in

    # Instance Metadata Service (IMDSv2 with 1.0 metadata version)
    # TODO: Use 'latest' metadata version instead of '1.0'
-    #       - Consider https://github.com/aws/amazon-ec2-metadata-mock
-    #         - Blocked on https://github.com/aws/amazon-ec2-metadata-mock/issues/234
-    #       - Consider https://github.com/purpleclay/imds-mock
-    #       - [Test matrix] also test providing the host key through IMDS
-    #         - i.e. a test module argument to select between writing or reading the host key
+    # TODO: [Test matrix] also test providing the host key through IMDS
+    #       - i.e. a test module argument to select between writing or reading the host key
    def create_ec2_metadata_dir(temp_dir, client_pubkey):
        """Create fake EC2 metadata directory structure with mock data"""
        metadata_dir = os.path.join(temp_dir.name, "ec2-metadata")
@@ -171,7 +177,7 @@ in
        )
        metadata_net = (
            " -device virtio-net-pci,netdev=ec2meta"
-            + f" -netdev 'user,id=ec2meta,net=169.0.0.0/8,guestfwd=tcp:169.254.169.254:80-cmd:${pkgs.micro-httpd}/bin/micro_httpd {metadata_dir}'"
+            + f" -netdev 'user,id=ec2meta,net=169.0.0.0/8,guestfwd=tcp:169.254.169.254:80-cmd:${lib.getExe imdsServer} {metadata_dir}'"
        )

        start_command = (
@@ -189,7 +195,7 @@ in
        test_marker = f"{format_name}-decompression-test"
        with open(user_data_path, "wb") as f:
            f.write(compressed_data)
-        machine.succeed("systemctl restart fetch-ec2-metadata")
+        machine.succeed("systemctl reset-failed fetch-ec2-metadata; systemctl restart fetch-ec2-metadata")
        result = machine.succeed("cat /etc/ec2-metadata/user-data")
        assert test_marker in result, f"Expected '{test_marker}' in decompressed {format_name} content, got: {result}"
        journal = machine.succeed("journalctl -u fetch-ec2-metadata --no-pager -b")
@@ -220,7 +226,16 @@ in
        machine_ip = "${config.nodes.machine.networking.primaryIPAddress}"

        with subtest("EC2 metadata service connectivity"):
-            hostname_response = machine.succeed("curl --fail -s http://169.254.169.254/1.0/meta-data/hostname")
+            # Obtain an IMDSv2 token, then use it to fetch metadata
+            imds_token = machine.succeed(
+                "curl -sf -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 600'"
+                " http://169.254.169.254/latest/api/token"
+            ).strip()
+            assert imds_token, "Failed to obtain IMDSv2 token"
+            hostname_response = machine.succeed(
+                f"curl -sf -H 'X-aws-ec2-metadata-token: {imds_token}'"
+                " http://169.254.169.254/1.0/meta-data/hostname"
+            )
            assert "test-instance" in hostname_response, f"Expected 'test-instance', got: {hostname_response}"

        with subtest("SSH host key extraction from console"):
@@ -299,6 +314,66 @@ in
            )
            test_userdata_decompression(machine, user_data_path, proc.stdout, "lzip")

+        with subtest("IPv6 IMDS fallback"):
+            # Save hostname fetched via IPv4 for later comparison
+            original_hostname = machine.succeed("cat /etc/ec2-metadata/hostname").strip()
+
+            # Assign the EC2 IPv6 IMDS address to loopback
+            machine.succeed("ip -6 addr add fd00:ec2::254/128 dev lo")
+
+            # Create metadata directory structure for the IPv6 endpoint
+            machine.succeed(
+                "mkdir -p /tmp/ipv6-metadata/1.0/meta-data/public-keys/0"
+                " && mkdir -p /tmp/ipv6-metadata/latest/api"
+                " && cp /etc/ec2-metadata/hostname /tmp/ipv6-metadata/1.0/meta-data/hostname"
+                " && cp /etc/ec2-metadata/ami-manifest-path /tmp/ipv6-metadata/1.0/meta-data/ami-manifest-path"
+                " && echo i-1234567890abcdef0 > /tmp/ipv6-metadata/1.0/meta-data/instance-id"
+                " && echo ipv6-test-token > /tmp/ipv6-metadata/latest/api/token"
+                " && touch /tmp/ipv6-metadata/1.0/user-data"
+            )
+            machine.execute(
+                "test -f /etc/ec2-metadata/public-keys-0-openssh-key"
+                " && cp /etc/ec2-metadata/public-keys-0-openssh-key"
+                " /tmp/ipv6-metadata/1.0/meta-data/public-keys/0/openssh-key"
+            )
+
+            # Serve metadata on the IPv6 IMDS address via socat + imds-server (inetd-style)
+            machine.succeed(
+                "systemd-run --unit=ipv6-imds --"
+                " socat TCP6-LISTEN:80,bind=[fd00:ec2::254],fork,reuseaddr"
+                " SYSTEM:'${lib.getExe imdsServer} /tmp/ipv6-metadata'"
+            )
+
+            # Wait for IPv6 IMDS to become reachable (token endpoint doesn't require auth)
+            machine.wait_until_succeeds(
+                "curl -sf -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 600'"
+                " http://[fd00:ec2::254]/latest/api/token"
+            )
+
+            # Block IPv4 IMDS to force fallback to IPv6
+            machine.succeed(
+                "iptables -I OUTPUT -d 169.254.169.254 -p tcp --dport 80 -j REJECT"
+            )
+
+            # Verify IPv4 IMDS is now unreachable
+            machine.fail(
+                "curl -sf --connect-timeout 2 http://169.254.169.254/1.0/meta-data/hostname"
+            )
+
+            # Clear fetched metadata and re-run the fetcher
+            machine.succeed("rm -f /etc/ec2-metadata/*")
+            machine.succeed("systemctl restart fetch-ec2-metadata")
+
+            # Verify metadata was successfully re-fetched via IPv6
+            hostname = machine.succeed("cat /etc/ec2-metadata/hostname").strip()
+            assert hostname == original_hostname, f"Expected '{original_hostname}', got '{hostname}'"
+
+            # Clean up: restore IPv4 IMDS access
+            machine.succeed(
+                "iptables -D OUTPUT -d 169.254.169.254 -p tcp --dport 80 -j REJECT"
+            )
+            machine.succeed("systemctl stop ipv6-imds")
+
    finally:
        machine.shutdown()
        temp_dir.cleanup()
@@ -59,7 +59,7 @@ let
        }
      ];
    }).config;
-  image = "${imageCfg.system.build.amazonImage}/${imageCfg.image.imageFile}";
+  image = "${imageCfg.system.build.amazonImage}/${imageCfg.image.fileName}";

  sshKeys = import ./ssh-keys.nix pkgs;
  snakeOilPrivateKey = sshKeys.snakeOilPrivateKey.text;
@@ -51,7 +51,6 @@ in
 makeEc2Test {
  name = "image-contents";
  inherit image;
-  userData = null;
  script = ''
    machine.start()
    # Test that if contents includes a file, it is copied to the target.
@@ -10,7 +10,7 @@ with pkgs.lib;
 with import common/ec2.nix { inherit makeTest pkgs; };

 let
-  image =
+  imageCfg =
    (import ../lib/eval-config.nix {
      system = null;
      modules = [
@@ -26,8 +26,8 @@ let
          nixpkgs.pkgs = pkgs;
        }
      ];
-    }).config.system.build.openstackImage
-    + "/nixos.qcow2";
+    }).config;
+  image = "${imageCfg.system.build.openstackImage}/${imageCfg.image.fileName}";

  sshKeys = import ./ssh-keys.nix pkgs;
  snakeOilPrivateKey = sshKeys.snakeOilPrivateKey.text;
@@ -80,6 +80,7 @@ in

  userdata = makeEc2Test {
    name = "openstack-ec2-metadata";
+    meta.broken = true; # amazon-init wants to download from the internet while building the system
    inherit image;
    sshPublicKey = snakeOilPublicKey;
    userData = ''
@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "hardhat-solidity";
    publisher = "nomicfoundation";
-    version = "0.8.28";
-    hash = "sha256-IKJ0d/Da0haRmtR5r/bKvDNkDV58cDdARuPGoJ2mUqI=";
+    version = "0.8.29";
+    hash = "sha256-0WC4MBCjY2TyZmeBtiCsKD95dudtCfo2HzvMWorWbOY=";
  };

  meta = {
@@ -21,5 +21,10 @@
    Takes an arbitrary derivation and says whether it is an agda library package
    *  that is not marked as broken.
  */
-  isUnbrokenAgdaPackage = pkg: pkg.isAgdaDerivation or false && !pkg.meta.broken;
+  isUnbrokenAgdaPackage =
+    pkg:
+    let
+      r = builtins.tryEval (pkg.isAgdaDerivation or false && !pkg.meta.broken);
+    in
+    r.success && r.value;
 }
@@ -22,6 +22,20 @@ stdenv.mkDerivation (finalAttrs: {

  sourceRoot = "${finalAttrs.src.name}/ARDOPC";

+  postPatch = ''
+    substituteInPlace pktSession.c \
+      --replace-fail 'VOID L2SENDCOMMAND();' 'VOID L2SENDCOMMAND(struct _LINKTABLE * LINK, int CMD);' \
+      --replace-fail 'VOID CONNECTFAILED();' 'VOID CONNECTFAILED(struct _LINKTABLE * LINK);'
+    substituteInPlace ARDOPC.h \
+      --replace-fail 'BOOL CheckForPktData();' 'BOOL CheckForPktData(int Channel);'
+    substituteInPlace ALSASound.c \
+      --replace-fail 'void InitSound(BOOL Quiet)' 'void InitSound()'
+    substituteInPlace ARQ.c \
+      --replace-fail 'SendData(FALSE);' 'SendData();'
+    substituteInPlace Modulate.c \
+      --replace-fail 'SoundFlush(Number);' 'SoundFlush();'
+  '';
+
  nativeBuildInputs = [
    makeWrapper
    pkg-config
@@ -125,8 +125,8 @@ let
      name = "kvantum";
      owner = "catppuccin";
      repo = "Kvantum";
-      rev = "c7cb144b041395e83e4f510a62526b7adfb79911";
-      hash = "sha256-YNUkri+no+rNLTJHf6cPdy4AmQLzPiRK1Jbp2o8e1LE=";
+      rev = "71105d224fef95dd023691303477ce3eea487457";
+      hash = "sha256-gcvCVZjVbj5fRZWaM+mZTwH/g158MH36JmMuMgCBuqQ=";
    };

    lazygit = fetchFromGitHub {
@@ -149,16 +149,16 @@ let
      name = "palette";
      owner = "catppuccin";
      repo = "palette";
-      rev = "0df7db6fe201b437d91e7288fa22807bb0e44701";
-      hash = "sha256-R52Q1FVAclvBk7xNgj/Jl+GPCIbORNf6YbJ1nxH3Gzs=";
+      rev = "07d02aa110ef9eb7e7427afca5c73ba9cf7f8ebd";
+      hash = "sha256-hsy+GhuM4MSjnwGq1YJSLBFIbVm67SSdPRgObP00mxw=";
    };

    plymouth = fetchFromGitHub {
      name = "plymouth";
      owner = "catppuccin";
      repo = "plymouth";
-      rev = "e0f58d6fcf3dbc2d35dfc4fec394217fbfa92666";
-      hash = "sha256-He6ER1QNrJCUthFoBBGHBINouW/tozxQy3R79F5tsuo=";
+      rev = "da38011d25f6f36152f2409372dfadb11c8f047c";
+      hash = "sha256-3JK4lX2ZmxysITDEEkhBLkyINUeCzvu5nUgrpvWZ+ZE=";
    };

    qt5ct = fetchFromGitHub {
@@ -222,7 +222,7 @@ lib.checkListOfEnum "${pname}: variant" validVariants [ variant ] lib.checkListO
  stdenvNoCC.mkDerivation
  {
    inherit pname;
-    version = "unstable-2025-10-07";
+    version = "0-unstable-2026-03-24";

    srcs = selectedSources;

@@ -1,22 +1,22 @@
 {
-  "version": "2.6.20",
+  "version": "2.6.21",
  "vscodeVersion": "1.105.1",
  "sources": {
    "x86_64-linux": {
-      "url": "https://downloads.cursor.com/production/b29eb4ee5f9f6d1cb2afbc09070198d3ea6ad76f/linux/x64/Cursor-2.6.20-x86_64.AppImage",
-      "hash": "sha256-fEvDNnFdJ2WhFam6tw1rnDbNQEZmxsoraIuvrHuKy+w="
+      "url": "https://downloads.cursor.com/production/fea2f546c979a0a4ad1deab23552a43568807592/linux/x64/Cursor-2.6.21-x86_64.AppImage",
+      "hash": "sha256-ZohAVWsde5fOac0JL9kc8ql/ZGohbc7S0yStARXQVSU="
    },
    "aarch64-linux": {
-      "url": "https://downloads.cursor.com/production/b29eb4ee5f9f6d1cb2afbc09070198d3ea6ad76f/linux/arm64/Cursor-2.6.20-aarch64.AppImage",
-      "hash": "sha256-SEiPNP1wZrLN+fW6q3ldniZYA7ndFf4p7OarPOvCxig="
+      "url": "https://downloads.cursor.com/production/fea2f546c979a0a4ad1deab23552a43568807592/linux/arm64/Cursor-2.6.21-aarch64.AppImage",
+      "hash": "sha256-U1iWEcCeXwGQjX5Wc8mp1jfFp1eUDfida+n6Ahmay7s="
    },
    "x86_64-darwin": {
-      "url": "https://downloads.cursor.com/production/b29eb4ee5f9f6d1cb2afbc09070198d3ea6ad76f/darwin/x64/Cursor-darwin-x64.dmg",
-      "hash": "sha256-PWgoiEFLXJr3AIcPN485BUUuGeCxXr0yk3ROmOILOh4="
+      "url": "https://downloads.cursor.com/production/fea2f546c979a0a4ad1deab23552a43568807592/darwin/x64/Cursor-darwin-x64.dmg",
+      "hash": "sha256-KhR7DnQMMbpbr8wPHMr75HDyoCOHRxsr/goeN3tAoTs="
    },
    "aarch64-darwin": {
-      "url": "https://downloads.cursor.com/production/b29eb4ee5f9f6d1cb2afbc09070198d3ea6ad76f/darwin/arm64/Cursor-darwin-arm64.dmg",
-      "hash": "sha256-WxJUezRquZglmjRzjFkBcqLeByAwGTuYSJFWCccuKXc="
+      "url": "https://downloads.cursor.com/production/fea2f546c979a0a4ad1deab23552a43568807592/darwin/arm64/Cursor-darwin-arm64.dmg",
+      "hash": "sha256-1zPqim1x1x01p5FM8PmAtordVUKdtqEhqkqoAswF1OE="
    }
  }
 }
@@ -55,13 +55,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "dolphin-emu";
-  version = "2603";
+  version = "2603a";

  src = fetchFromGitHub {
    owner = "dolphin-emu";
    repo = "dolphin";
    tag = finalAttrs.version;
-    hash = "sha256-9kB5hFAJwLkFi2y5c5ZavwcnXRDE5bxerg5E1hPAutY=";
+    hash = "sha256-+3/JtjKFsTEkKQa0LjycqNmDz0M8o2FndWQtw5R5/jQ=";
    fetchSubmodules = true;
    leaveDotGit = true;
    postFetch = ''
@@ -0,0 +1,7 @@
+{
+  grub2,
+}:
+
+grub2.override {
+  efiSupport = true;
+}
@@ -0,0 +1,7 @@
+{
+  grub2,
+}:
+
+grub2.override {
+  ieee1275Support = true;
+}
@@ -0,0 +1,7 @@
+{
+  grub2,
+}:
+
+grub2.override {
+  zfsSupport = false;
+}
@@ -0,0 +1,7 @@
+{
+  grub2_pvhgrub_image,
+}:
+
+grub2_pvhgrub_image.override {
+  grubPlatform = "xen";
+}
@@ -0,0 +1,7 @@
+{
+  grub2,
+}:
+
+grub2.override {
+  xenSupport = true;
+}
@@ -0,0 +1,7 @@
+{
+  grub2,
+}:
+
+grub2.override {
+  xenPvhSupport = true;
+}
@@ -21,16 +21,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "halloy";
-  version = "2026.4";
+  version = "2026.5";

  src = fetchFromGitHub {
    owner = "squidowl";
    repo = "halloy";
    tag = finalAttrs.version;
-    hash = "sha256-gWN+KcAoMTRySZObRleDCNfUukprGkNGFELD7xT/x/Q=";
+    hash = "sha256-K+kNn7GPNZWXkXS+hfOjdmaWEjina6Vy4FfAJGZ5cPE=";
  };

-  cargoHash = "sha256-g9Q2YCjgC5MBX/Tv/dvRuHIxo7qq5J7hjsw3YeTn0jI=";
+  cargoHash = "sha256-ij08oI0IIihVoHY4RS1FGpkvsWLcjCv2fp8voAae+DI=";

  nativeBuildInputs = [
    copyDesktopItems
@@ -10,7 +10,7 @@

 buildGoModule rec {
  pname = "kubo";
-  version = "0.39.0"; # When updating, also check if the repo version changed and adjust repoVersion below
+  version = "0.40.1"; # When updating, also check if the repo version changed and adjust repoVersion below
  rev = "v${version}";

  passthru.repoVersion = "18";
@@ -18,7 +18,7 @@ buildGoModule rec {
  # Kubo makes changes to its source tarball that don't match the git source.
  src = fetchurl {
    url = "https://github.com/ipfs/kubo/releases/download/${rev}/kubo-source.tar.gz";
-    hash = "sha256-qGqJ2Gb0BYcY7yxunAFDguc8IgzDIP9680+tKrKFvsY=";
+    hash = "sha256-O6mSFDKj1DdTMGhg5Q6L0hiLW9CUyUq9uyFz9Xjmm4s=";
  };

  # tarball contains multiple files/directories
@@ -3,6 +3,7 @@
  stdenv,
  fetchFromGitHub,
  fetchurl,
+  fetchpatch2,
  autoreconfHook,
  pkg-config,
  SDL2,
@@ -36,6 +37,11 @@ stdenv.mkDerivation (finalAttrs: {
      url = "https://github.com/clementgallet/libTAS/commit/779ff0fb0f3accfc62949680d85ecf96b28d18ef.patch";
      hash = "sha256-xAaTWIXt8FkMu6GE5mBWtLypROFZ1aEqmBTtG+6rTWk=";
    })
+    # Fix build with gcc15
+    (fetchpatch2 {
+      url = "https://github.com/clementgallet/libTAS/commit/9699b158c522cf778bcdf626d0520fdd0a8b83aa.patch?full_index=1";
+      hash = "sha256-vM1f6rvKIFyzEGJ7k+b/Zp4gAv8u6mdDUD5evV+hCJU=";
+    })
  ];

  nativeBuildInputs = [
@@ -1,21 +1,21 @@
 {
-  "version": "3.193.0",
+  "version": "3.194.0",
  "assets": {
    "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.193.0/mirrord_linux_x86_64",
-      "hash": "sha256-IeOilRMOzEYXEF0qbAwTSr4Y6zIz8dIzCiTzE4VadxI="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.194.0/mirrord_linux_x86_64",
+      "hash": "sha256-6coP0EiDrTv0HNk+55C37d+eKhsOm25rQy42mRkoTy0="
    },
    "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.193.0/mirrord_linux_aarch64",
-      "hash": "sha256-LOLf1q7vA/SZvOIxj0mAYZrPwccuU90Shghkk94xxPo="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.194.0/mirrord_linux_aarch64",
+      "hash": "sha256-k8/kkhYYk+eHdekIwi2wFmn6mX7WiKuKtaOC3soBT6U="
    },
    "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.193.0/mirrord_mac_universal",
-      "hash": "sha256-oa5dJxSfZKaKub8WxuOZ8Nut1cIcvl3E/zT6xNQJy00="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.194.0/mirrord_mac_universal",
+      "hash": "sha256-VwcqBf3Jq9H3wgNz5o/7oJ5Pz0nXBRkzDA7D51hIWe0="
    },
    "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.193.0/mirrord_mac_universal",
-      "hash": "sha256-oa5dJxSfZKaKub8WxuOZ8Nut1cIcvl3E/zT6xNQJy00="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.194.0/mirrord_mac_universal",
+      "hash": "sha256-VwcqBf3Jq9H3wgNz5o/7oJ5Pz0nXBRkzDA7D51hIWe0="
    }
  }
 }
@@ -1,51 +1,54 @@
 {
  lib,
-  python3,
+  python3Packages,
  fetchPypi,
+  qt6,
+  R,
  copyDesktopItems,
-  libsForQt5,
  makeDesktopItem,
 }:
-
-let
-  inherit (libsForQt5)
-    qtsvg
-    wrapQtAppsHook
-    ;
-in
-python3.pkgs.buildPythonApplication (finalAttrs: {
-  format = "setuptools";
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "pyspread";
  version = "2.4";
+
  src = fetchPypi {
    pname = "pyspread";
    inherit (finalAttrs) version;
    hash = "sha256-MZlR2Rap5oMRfCmswg9W//FYFkSEki7eyMNhLoGZgJM=";
  };

+  pyproject = true;
+
  nativeBuildInputs = [
+    R
    copyDesktopItems
-    wrapQtAppsHook
+    qt6.wrapQtAppsHook
  ];

-  buildInputs = [
-    qtsvg
-  ];
+  buildInputs = [ qt6.qtsvg ];

-  propagatedBuildInputs = with python3.pkgs; [
-    python-dateutil
-    markdown2
-    matplotlib
+  dependencies = with python3Packages; [
+    pyqt6
    numpy
-    pyenchant
-    pyqt5
-    setuptools
+    markdown2
+
+    # Optional
+    matplotlib # data visualization
+    pyenchant # spellchecker bindings
+    pip # python package installer
+    python-dateutil # extensions to standard datetime module
+    rpy2 # interface to R
+    plotnine # data visualization
+    openpyxl # r/w Excel 2010 xlsx/xlsm files
+
+    # Optional & not in nixpkgs
+    #py-moneyed # currency & money classes
+    #pycel # compile Excel spreadsheets to Python code
  ];

  strictDeps = true;

-  doCheck = false; # it fails miserably with a core dump
-
+  doCheck = true;
  pythonImportsCheck = [ "pyspread" ];

  desktopItems = [
@@ -55,7 +58,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
      icon = "pyspread";
      desktopName = "Pyspread";
      genericName = "Spreadsheet";
-      comment = "A Python-oriented spreadsheet application";
+      comment = "Python-oriented spreadsheet application";
      categories = [
        "Office"
        "Development"
@@ -64,6 +67,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    })
  ];

+  makeWrapperArgs = [ "--set R_HOME ${lib.getLib R}/lib/R" ];
+
  preFixup = ''
    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
  '';
@@ -83,6 +88,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    '';
    license = with lib.licenses; [ gpl3Plus ];
    mainProgram = "pyspread";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ Merikei ];
+    platforms = lib.platforms.linux;
  };
 })
@@ -6,13 +6,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "rasm";
-  version = "3.0.8";
+  version = "3.0.9";

  src = fetchFromGitHub {
    owner = "EdouardBERGE";
    repo = "rasm";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nBNJsqnz0PlwPAJ4T4CFBGr7UYy6u8VtklIkINaurvM=";
+    hash = "sha256-QlFdp/Cju28yOoqoQzM1JiZqRcxKjX7RgJPyz0VJYJ0=";
  };

  # by default the EXEC variable contains `rasm.exe`
@@ -0,0 +1,24 @@
+diff --git a/src/Linux/curl_easy.h b/src/Linux/curl_easy.h
+index 047f3e2..c9c5e83 100644
+--- a/src/Linux/curl_easy.h
+++ b/src/Linux/curl_easy.h
+@@ -6,6 +6,7 @@
+ #define CURL_EASY_H
+ 
+ #define _CRT_SECURE_NO_WARNINGS // Use strncpy for portability.
+#include <cstdint>
+ #include <cassert>
+ #include <cstddef>
+ #include <exception>
+diff --git a/src/local_cache.h b/src/local_cache.h
+index da86967..d9b0d3f 100644
+--- a/src/local_cache.h
+++ b/src/local_cache.h
+@@ -5,6 +5,7 @@
+ #ifndef LOCAL_CACHE_H
+ #define LOCAL_CACHE_H
+ 
+#include <cstdint>
+ #include <string>
+ #include <vector>
+ #include <memory>
@@ -1,7 +1,6 @@
 {
  stdenv,
  fetchFromGitHub,
-  fetchpatch,
  lib,
  curl,
  nlohmann_json,
@@ -36,23 +35,18 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "azure-dcap-client";
-  version = "1.12.3";
+  version = "1.13.0-pre0";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "azure-dcap-client";
-    rev = finalAttrs.version;
-    hash = "sha256-zTDaICsSPXctgFRCZBiZwXV9dLk2pFL9kp5a8FkiTZA=";
+    rev = "839ac4a2acc11b90cb91a483fcfc0cf7ae6a75c7";
+    hash = "sha256-dVO5cSOcpkOuxql06exS4aLJgvtRg+Oi6k8HBIjwPlg=";
  };

  patches = [
-    # Fix gcc-13 build:
-    #   https://github.com/microsoft/Azure-DCAP-Client/pull/197
-    (fetchpatch {
-      name = "gcc-13.patch";
-      url = "https://github.com/microsoft/Azure-DCAP-Client/commit/fbcae7b3c8f1155998248cf5b5f4c1df979483f5.patch";
-      hash = "sha256-ezEuQql3stn58N1ZPKMlhPpUOBkDpCcENpGwFAmWtHc=";
-    })
+    # missing `#include <cstdint>`
+    ./missing-includes.patch
  ];

  nativeBuildInputs = [
@@ -11,7 +11,11 @@ sgx-azure-dcap-client.overrideAttrs (old: {
  ];

  patches = (old.patches or [ ]) ++ [
+    # Missing `#include <array>`
    ./tests-missing-includes.patch
+
+    # gtest no longer supports c++14. Use c++17.
+    ./tests-cpp-version.patch
  ];

  buildFlags = [
@@ -0,0 +1,39 @@
+diff --git a/src/Linux/CMakeLists.txt b/src/Linux/CMakeLists.txt
+index 8567253..0137a7a 100644
+--- a/src/Linux/CMakeLists.txt
+++ b/src/Linux/CMakeLists.txt
+@@ -13,8 +13,8 @@ endif(__SERVICE_VM__)
+ 
+ find_package(OpenSSL REQUIRED)
+ 
+-set(CMAKE_CXX_STANDARD 14)
+-set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++14")
+set(CMAKE_CXX_STANDARD 17)
+set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++17")
+ 
+ # Link runTests with what we want to test and the GTest and pthread library
+ add_executable(dcap_provider_utests ../UnitTest/test_local_cache.cpp ../UnitTest/test_quote_prov.cpp ../UnitTest/main.cpp ../Linux/local_cache.cpp)
+diff --git a/src/Linux/Makefile.in b/src/Linux/Makefile.in
+index 58a1c77..1ce6431 100644
+--- a/src/Linux/Makefile.in
+++ b/src/Linux/Makefile.in
+@@ -8,15 +8,15 @@ DEBUG ?= 0
+ SERVICE_VM ?= 0
+ ifeq ($(DEBUG), 1)
+ ifeq ($(SERVICE_VM), 1)
+-	CFLAGS = -fPIC -std=c++14 -g -Wall -I /usr/local/include/gtest/ -Werror $(INCLUDES) -D__LINUX__ -D__SERVICE_VM__ -Wno-unknown-pragmas -pthread
+	CFLAGS = -fPIC -std=c++17 -g -Wall -I /usr/local/include/gtest/ -Werror $(INCLUDES) -D__LINUX__ -D__SERVICE_VM__ -Wno-unknown-pragmas -pthread
+ else
+-	CFLAGS = -fPIC -std=c++14 -g -Wall -I /usr/local/include/gtest/ -Werror $(INCLUDES) -D__LINUX__ -Wno-unknown-pragmas -pthread
+	CFLAGS = -fPIC -std=c++17 -g -Wall -I /usr/local/include/gtest/ -Werror $(INCLUDES) -D__LINUX__ -Wno-unknown-pragmas -pthread
+ endif
+ else
+ ifeq ($(SERVICE_VM), 1)
+-	CFLAGS = -fPIC -std=c++14 -Wall -I /usr/local/include/gtest/ -Werror $(INCLUDES) -D__LINUX__ -D__SERVICE_VM__ -Wno-unknown-pragmas -pthread
+	CFLAGS = -fPIC -std=c++17 -Wall -I /usr/local/include/gtest/ -Werror $(INCLUDES) -D__LINUX__ -D__SERVICE_VM__ -Wno-unknown-pragmas -pthread
+ else
+-	CFLAGS = -fPIC -std=c++14 -Wall -I /usr/local/include/gtest/ -Werror $(INCLUDES) -D__LINUX__ -Wno-unknown-pragmas -pthread
+	CFLAGS = -fPIC -std=c++17 -Wall -I /usr/local/include/gtest/ -Werror $(INCLUDES) -D__LINUX__ -Wno-unknown-pragmas -pthread
+ endif
+ endif
+ 
@@ -1,95 +0,0 @@
-{
-  stdenv,
-  callPackage,
-  fetchFromGitHub,
-  fetchurl,
-  lib,
-  perl,
-  sgx-sdk,
-  which,
-  debug ? false,
-}:
-let
-  sgxVersion = sgx-sdk.versionTag;
-  opensslVersion = "3.0.13";
-in
-stdenv.mkDerivation {
-  pname = "sgx-ssl" + lib.optionalString debug "-debug";
-  version = "${sgxVersion}_${opensslVersion}";
-
-  src = fetchFromGitHub {
-    owner = "intel";
-    repo = "intel-sgx-ssl";
-    rev = "3.0_Rev2";
-    hash = "sha256-dmLyaG6v+skjSa0KxLAfIfSBOxp9grrI7ds6WdGPe0I=";
-  };
-
-  postUnpack =
-    let
-      opensslSourceArchive = fetchurl {
-        url = "https://www.openssl.org/source/openssl-${opensslVersion}.tar.gz";
-        hash = "sha256-iFJXU/edO+wn0vp8ZqoLkrOqlJja/ZPXz6SzeAza4xM=";
-      };
-    in
-    ''
-      ln -s ${opensslSourceArchive} $sourceRoot/openssl_source/openssl-${opensslVersion}.tar.gz
-    '';
-
-  postPatch = ''
-    patchShebangs Linux/build_openssl.sh
-
-    # Skip the tests. Build and run separately (see below).
-    substituteInPlace Linux/sgx/Makefile \
-      --replace-fail '$(MAKE) -C $(TEST_DIR) all' \
-                     'bash -c "true"'
-  '';
-
-  nativeBuildInputs = [
-    perl
-    sgx-sdk
-    which
-  ];
-
-  makeFlags = [
-    "-C Linux"
-  ]
-  ++ lib.optionals debug [
-    "DEBUG=1"
-  ];
-
-  installFlags = [
-    "DESTDIR=$(out)"
-  ];
-
-  # These tests build on any x86_64-linux but BOTH SIM and HW will only _run_ on
-  # real Intel hardware. Split these out so OfBorg doesn't choke on this pkg.
-  #
-  # ```
-  # nix run .#sgx-ssl.tests.HW
-  # nix run .#sgx-ssl.tests.SIM
-  # ```
-  passthru.tests = {
-    HW = callPackage ./tests.nix {
-      sgxMode = "HW";
-      inherit opensslVersion;
-    };
-    SIM = callPackage ./tests.nix {
-      sgxMode = "SIM";
-      inherit opensslVersion;
-    };
-  };
-
-  meta = {
-    description = "Cryptographic library for Intel SGX enclave applications based on OpenSSL";
-    homepage = "https://github.com/intel/intel-sgx-ssl";
-    maintainers = with lib.maintainers; [
-      phlip9
-      veehaitch
-    ];
-    platforms = [ "x86_64-linux" ];
-    license = with lib.licenses; [
-      bsd3
-      openssl
-    ];
-  };
-}
@@ -1,96 +0,0 @@
-# This package _builds_ (but doesn't run!) the sgx-ssl test enclave + harness.
-# The whole package effectively does:
-#
-# ```
-# SGX_MODE=${sgxMode} make -C Linux/sgx/test_app
-# cp Linux/sgx/{TestApp,TestEnclave.signed.so} $out/bin
-# ```
-#
-# OfBorg fails to run these tests since they require real Intel HW. That
-# includes the simulation mode! The tests appears to do something fancy with
-# cpuid and exception trap handlers that make them very non-portable.
-#
-# These tests are split out from the parent pkg since recompiling the parent
-# takes like 30 min : )
-
-{
-  lib,
-  openssl,
-  sgx-psw,
-  sgx-sdk,
-  sgx-ssl,
-  stdenv,
-  which,
-  opensslVersion ? throw "required parameter",
-  sgxMode ? throw "required parameter", # "SIM" or "HW"
-}:
-stdenv.mkDerivation {
-  inherit (sgx-ssl) postPatch src version;
-  pname = sgx-ssl.pname + "-tests-${sgxMode}";
-
-  postUnpack = sgx-ssl.postUnpack + ''
-    sourceRootAbs=$(readlink -e $sourceRoot)
-    packageDir=$sourceRootAbs/Linux/package
-
-    # Do the inverse of 'make install' and symlink built artifacts back into
-    # '$src/Linux/package/' to avoid work.
-    mkdir $packageDir/lib $packageDir/lib64
-    ln -s ${lib.getLib sgx-ssl}/lib/* $packageDir/lib/
-    ln -s ${lib.getLib sgx-ssl}/lib64/* $packageDir/lib64/
-    ln -sf ${lib.getDev sgx-ssl}/include/* $packageDir/include/
-
-    # test_app needs some internal openssl headers.
-    # See: tail end of 'Linux/build_openssl.sh'
-    tar -C $sourceRootAbs/openssl_source -xf $sourceRootAbs/openssl_source/openssl-${opensslVersion}.tar.gz
-    echo '#define OPENSSL_VERSION_STR "${opensslVersion}"' > $sourceRootAbs/Linux/sgx/osslverstr.h
-    ln -s $sourceRootAbs/openssl_source/openssl-${opensslVersion}/include/crypto $sourceRootAbs/Linux/sgx/test_app/enclave/
-    ln -s $sourceRootAbs/openssl_source/openssl-${opensslVersion}/include/internal $sourceRootAbs/Linux/sgx/test_app/enclave/
-  '';
-
-  nativeBuildInputs = [
-    openssl.bin
-    sgx-sdk
-    which
-  ];
-
-  preBuild = ''
-    # Need to regerate the edl header
-    make -C Linux/sgx/libsgx_tsgxssl sgx_tsgxssl_t.c
-  '';
-
-  makeFlags = [
-    "-C Linux/sgx/test_app"
-    "SGX_MODE=${sgxMode}"
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    # Enclaves can't be stripped after signing.
-    install -Dm 755 Linux/sgx/test_app/TestEnclave.signed.so -t $TMPDIR/enclaves
-
-    install -Dm 755 Linux/sgx/test_app/TestApp -t $out/bin
-
-    runHook postInstall
-  '';
-
-  postFixup = ''
-    # Move the enclaves where they actually belong.
-    mv $TMPDIR/enclaves/*.signed.so* $out/bin/
-
-    # HW SGX must runs against sgx-psw, not sgx-sdk.
-    if [[ "${sgxMode}" == "HW" ]]; then
-      patchelf \
-        --set-rpath "$( \
-          patchelf --print-rpath $out/bin/TestApp \
-            | sed 's|${lib.getLib sgx-sdk}|${lib.getLib sgx-psw}|' \
-        )" \
-        $out/bin/TestApp
-    fi
-  '';
-
-  meta = {
-    platforms = [ "x86_64-linux" ];
-    mainProgram = "TestApp";
-  };
-}
@@ -17,18 +17,18 @@
  includeLSP ? true,
  includeForge ? true,
 }:
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "steel";
-  version = "0-unstable-2026-02-12";
+  version = "0.8.2";

  src = fetchFromGitHub {
    owner = "mattwparas";
    repo = "steel";
-    rev = "e9cb24fe9c6584f4a352c3cb43e7f0bd934e3277";
-    hash = "sha256-9ZyAPqZNcAP1ObxVxjK+q87ZyKMPzaDno1v7JweU6z4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-GZ0VeoAwVGnK/Px5IvBGIHlpEsAh2do/QPuYtLexLt4=";
  };

-  cargoHash = "sha256-ss3S4eRoczvF0DlTpUS9mZ09pfMKgyLNAmjm3WWi8KQ=";
+  cargoHash = "sha256-Z5v+8bhIgBCB2pDB5AgX42vFiNkgqjU95gata0sLUrA=";

  nativeBuildInputs = [
    curl
@@ -103,7 +103,10 @@ rustPlatform.buildRustPackage {
  };

  passthru.updateScript = nix-update-script {
-    extraArgs = [ "--version=branch" ];
+    extraArgs = [
+      "--version-regex"
+      "^v(.*)"
+    ];
  };

  meta = {
@@ -118,4 +121,4 @@ rustPlatform.buildRustPackage {
    platforms = lib.platforms.unix;
    sourceProvenance = [ lib.sourceTypes.fromSource ];
  };
-}
+})
@@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "wgsl-analyzer";
-  version = "2025-11-14";
+  version = "2026-03-13";

  src = fetchFromGitHub {
    owner = "wgsl-analyzer";
    repo = "wgsl-analyzer";
    tag = finalAttrs.version;
-    hash = "sha256-9oulnN2mjOVOo1Z1mHlSeBXzsET/vJGe1h6UuNSC/LU=";
+    hash = "sha256-a1H/QJhLdBiwjqiG3icsKrSMz079yBjdBKffGANgdTQ=";
  };

-  cargoHash = "sha256-gUOoNa9BySZF/jfN39GrfoKN4t9h4dKq474d8fkwTOI=";
+  cargoHash = "sha256-UM8oEg8gpsq9lnoDpeArGTl36EE7Tn6YMHXEIagVGvI=";

  checkFlags = [
    # Imports failures
@@ -36,6 +36,14 @@ buildPythonPackage (finalAttrs: {
    hash = "sha256-Vjv62cYDIuTLE7MxRt4Havy7DMOiMTyIixbs4LGFGGs=";
  };

+  # TypeError: NDArray.record() missing 1 required keyword-only argument: 'in_warmup'
+  postPatch = ''
+    substituteInPlace bambi/backend/pymc.py \
+      --replace-fail \
+        "strace.record(point=dict(zip(varnames, value)))" \
+        "strace.record(point=dict(zip(varnames, value)), in_warmup=False)"
+  '';
+
  build-system = [
    setuptools
    setuptools-scm
@@ -15,11 +15,12 @@
  typing-extensions,

  # checks
+  chex,
  pytestCheckHook,
  pytest-xdist,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "blackjax";
  version = "1.3";
  pyproject = true;
@@ -27,7 +28,7 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "blackjax-devs";
    repo = "blackjax";
-    tag = version;
+    tag = finalAttrs.version;
    hash = "sha256-ystvPfIsnMFYkC+LNtcRQsI19i/y/905SnPSApM8v4E=";
  };

@@ -46,6 +47,7 @@ buildPythonPackage rec {
  ];

  nativeCheckInputs = [
+    chex
    pytestCheckHook
    pytest-xdist
  ];
@@ -83,8 +85,8 @@ buildPythonPackage rec {
  meta = {
    homepage = "https://blackjax-devs.github.io/blackjax";
    description = "Sampling library designed for ease of use, speed and modularity";
-    changelog = "https://github.com/blackjax-devs/blackjax/releases/tag/${version}";
+    changelog = "https://github.com/blackjax-devs/blackjax/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ bcdarwin ];
  };
-}
+})
@@ -36,16 +36,16 @@
  transforms3d,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "brax";
-  version = "0.14.0";
+  version = "0.14.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "google";
    repo = "brax";
-    tag = "v${version}";
-    hash = "sha256-CkRXEYtlP8IhEZ7lVnpxlwiyLdICAfILwHfRUfuub08=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-/oznBa44xKl+9T1YrTVhCbuKZj16V1BTlnmCGRbF45g=";
  };

  build-system = [
@@ -88,6 +88,11 @@ buildPythonPackage rec {
    "testModelEncoding1"
    "testTrain"
    "testTrainDomainRandomize"
+
+    # ValueError: Error: no decoder found for mesh file 'meshes/pyramid.stl'
+    "test_convex_convex"
+    "test_dumps"
+    "test_dumps_invalidstate_raises"
  ]
  ++ lib.optionals stdenv.hostPlatform.isAarch64 [
    # Flaky:
@@ -100,9 +105,7 @@ buildPythonPackage rec {
    "brax/generalized/constraint_test.py"
  ];

-  pythonImportsCheck = [
-    "brax"
-  ];
+  pythonImportsCheck = [ "brax" ];

  meta = {
    description = "Massively parallel rigidbody physics simulation on accelerator hardware";
@@ -110,4 +113,4 @@ buildPythonPackage rec {
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ nim65s ];
  };
-}
+})
@@ -19,6 +19,7 @@
  wrapt,

  # tests
+  chex,
  keras,
  pytestCheckHook,
  tensorflow,
@@ -26,7 +27,7 @@
  torch,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "clu";
  version = "0.0.12";
  pyproject = true;
@@ -34,7 +35,7 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "google";
    repo = "CommonLoopUtils";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-ntqRz3fCXMf0EDQsddT68Mdi105ECBVQpVsStzk2kvQ=";
  };

@@ -59,6 +60,7 @@ buildPythonPackage rec {
  pythonImportsCheck = [ "clu" ];

  nativeCheckInputs = [
+    chex
    keras
    pytestCheckHook
    tensorflow
@@ -76,8 +78,8 @@ buildPythonPackage rec {
  meta = {
    description = "Common training loops in JAX";
    homepage = "https://github.com/google/CommonLoopUtils";
-    changelog = "https://github.com/google/CommonLoopUtils/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/google/CommonLoopUtils/blob/${finalAttrs.src.tag}/CHANGELOG.md";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ GaetanLepage ];
  };
-}
+})
@@ -20,7 +20,7 @@
  pytestCheckHook,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "distrax";
  version = "0.1.7";
  pyproject = true;
@@ -28,7 +28,7 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "google-deepmind";
    repo = "distrax";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-R6rGGNzup3O6eZ2z4vygYWTjroE/Irt3aog8Op+0hco=";
  };

@@ -57,6 +57,9 @@ buildPythonPackage rec {
  pythonImportsCheck = [ "distrax" ];

  disabledTests = [
+    # execnet.gateway_base.DumpError: can't serialize <class 'method'>
+    "test_raises_on_invalid_input_shape"
+
    # Flaky: AssertionError: 1 not less than 0.7000000000000001
    "test_von_mises_sample_uniform_ks_test"

@@ -124,7 +127,7 @@ buildPythonPackage rec {
  meta = {
    description = "Probability distributions in JAX";
    homepage = "https://github.com/deepmind/distrax";
-    changelog = "https://github.com/google-deepmind/distrax/releases/tag/v${version}";
+    changelog = "https://github.com/google-deepmind/distrax/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ onny ];
    badPlatforms = [
@@ -132,4 +135,4 @@ buildPythonPackage rec {
      lib.systems.inspect.patterns.isDarwin
    ];
  };
-}
+})
@@ -1,6 +1,5 @@
 {
  lib,
-  stdenv,
  buildPythonPackage,
  fetchFromGitHub,

@@ -20,16 +19,16 @@
  pytestCheckHook,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "equinox";
-  version = "0.13.2";
+  version = "0.13.6";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "patrick-kidger";
    repo = "equinox";
-    tag = "v${version}";
-    hash = "sha256-d7IqRuohcZ3IYpbjm76Ir6I33zI5dnHvX5eX2WjSJQk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-OETWXAcCp945mMrpC8U4gSBvEeQX8RoUGZR4irBs7Ak=";
  };

  # Relax speed constraints on tests that can fail on busy builders
@@ -39,12 +38,6 @@ buildPythonPackage rec {
      --replace-fail "speed < 0.5" "speed < 1" \
      --replace-fail "speed < 1" "speed < 20" \
      --replace-fail "speed < 2" "speed < 20"
-  ''
-  # Fix jax 0.8.2 compat
-  # Fix submitted upstream: https://github.com/patrick-kidger/equinox/pull/1162
-  + ''
-    substituteInPlace equinox/_ad.py equinox/internal/_primitive.py \
-      --replace-fail "jax.core.get_aval(" "jax.typeof("
  '';

  build-system = [ hatchling ];
@@ -68,22 +61,27 @@ buildPythonPackage rec {
    "-Wignore::DeprecationWarning"
  ];

+  disabledTestPaths = [
+    # ValueError: not enough values to unpack (expected 2, got 0)
+    "tests/test_finalise_jaxpr.py"
+  ];
+
  disabledTests = [
    # Failed: DID NOT WARN. No warnings of type (<class 'Warning'>,) were emitted.
+    # Reported upstream: https://github.com/patrick-kidger/equinox/issues/1186
    "test_jax_transform_warn"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    # SystemError: nanobind::detail::nb_func_error_except(): exception could not be translated!
-    "test_filter"
+
+    # Flaky: AssertionError: Non-linear scaling detected
+    "test_speed_buffer_while"
  ];

  pythonImportsCheck = [ "equinox" ];

  meta = {
    description = "JAX library based around a simple idea: represent parameterised functions (such as neural networks) as PyTrees";
-    changelog = "https://github.com/patrick-kidger/equinox/releases/tag/v${version}";
+    changelog = "https://github.com/patrick-kidger/equinox/releases/tag/${finalAttrs.src.tag}";
    homepage = "https://github.com/patrick-kidger/equinox";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ GaetanLepage ];
  };
-}
+})
@@ -13,14 +13,12 @@
  numpy,
  optax,
  orbax-checkpoint,
+  orbax-export,
  pyyaml,
  rich,
  tensorstore,
  typing-extensions,

-  # optional-dependencies
-  matplotlib,
-
  # tests
  cloudpickle,
  keras,
@@ -36,16 +34,16 @@
  tomlq,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "flax";
-  version = "0.12.2";
+  version = "0.12.6";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "google";
    repo = "flax";
-    tag = "v${version}";
-    hash = "sha256-Wdfc35/iah98C5WNYZWiAd2FJUJlyGLJ8xELpuYD3GU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rIDfF9W8cxF0njH4e4uhqURQ0C4N8Boe76u6meMgC34=";
  };

  build-system = [
@@ -60,6 +58,7 @@ buildPythonPackage rec {
    numpy
    optax
    orbax-checkpoint
+    orbax-export
    pyyaml
    rich
    tensorstore
@@ -67,10 +66,6 @@ buildPythonPackage rec {
    typing-extensions
  ];

-  optional-dependencies = {
-    all = [ matplotlib ];
-  };
-
  pythonImportsCheck = [ "flax" ];

  nativeCheckInputs = [
@@ -132,8 +127,8 @@ buildPythonPackage rec {
  meta = {
    description = "Neural network library for JAX";
    homepage = "https://github.com/google/flax";
-    changelog = "https://github.com/google/flax/releases/tag/v${version}";
+    changelog = "https://github.com/google/flax/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ ndl ];
  };
-}
+})
@@ -19,7 +19,7 @@
  pytestCheckHook,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "flowmc";
  version = "0.4.5";
  pyproject = true;
@@ -27,7 +27,7 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "kazewong";
    repo = "flowMC";
-    tag = "flowMC-${version}";
+    tag = "flowMC-${finalAttrs.version}";
    hash = "sha256-D3K9cvmUvwsVAjvXdSDgYlqrzTYXVlSVQbfx7TANz8A=";
  };

@@ -59,11 +59,22 @@ buildPythonPackage rec {

  nativeCheckInputs = [ pytestCheckHook ];

+  disabledTestPaths = [
+    # ValueError: Expected None, got JitTracer(bool[3,2])
+    "test/integration/test_quickstart.py"
+  ];
+
+  disabledTests = [
+    # ValueError: Expected None, got JitTracer(bool[3,2])
+    "test_rqSpline"
+    "test_training"
+  ];
+
  meta = {
    description = "Normalizing-flow enhanced sampling package for probabilistic inference in Jax";
    homepage = "https://github.com/kazewong/flowMC";
-    changelog = "https://github.com/kazewong/flowMC/releases/tag/flowMC-${version}";
+    changelog = "https://github.com/kazewong/flowMC/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ GaetanLepage ];
  };
-}
+})
@@ -31,7 +31,7 @@ let
  );

 in
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "jax-cuda12-pjrt";
  inherit version;
  pyproject = false;
@@ -50,8 +50,8 @@ buildPythonPackage rec {
      .${stdenv.hostPlatform.system};
    hash =
      {
-        x86_64-linux = "sha256-47q0HKfEjkFj255+/ScbOqhfD+RfXtBwjWu+2TpZ+Xc=";
-        aarch64-linux = "sha256-cXobGWpkJAnOGV3fAxwgu+rcyIb1Xkmh0/SSc3Ou7a4=";
+        x86_64-linux = "sha256-U2owUpInbFdF77un61dXaEnFp8dzmKOp5h/TG69RAvA=";
+        aarch64-linux = "sha256-VvSifl8ZypFMD0QCU5RpqpLQG/cTNqzQ7Y/dwgqRvI0=";
      }
      .${stdenv.hostPlatform.system};
  };
@@ -102,4 +102,4 @@ buildPythonPackage rec {
    # https://jax.readthedocs.io/en/latest/installation.html#pip-installation-nvidia-gpu-cuda-installed-locally-harder
    broken = !(lib.versionAtLeast cudaPackages.cudnn.version "9.1");
  };
-}
+})
@@ -39,42 +39,42 @@ let
    "3.11-x86_64-linux" = getSrcFromPypi {
      platform = "manylinux_2_27_x86_64";
      dist = "cp311";
-      hash = "sha256-CwozBM5+SUrNjZxZNJDBEqMs22AQ/hr8WE2eQf2GMWc=";
+      hash = "sha256-1Vd82Ge9kmd2nkU7rYUNSAeoQ5a8l29jKlFe29d+SEs=";
    };
    "3.11-aarch64-linux" = getSrcFromPypi {
      platform = "manylinux_2_27_aarch64";
      dist = "cp311";
-      hash = "sha256-cNMyIkhK1cN1uPg1e3wjysuET27Pw5Vn+N1H/eboeFg=";
+      hash = "sha256-s5VfN10XkC8NJ+cFlnLNGWOlU0WVOkJpnk4HjOxyWtw=";
    };
    "3.12-x86_64-linux" = getSrcFromPypi {
      platform = "manylinux_2_27_x86_64";
      dist = "cp312";
-      hash = "sha256-IBZYYbPT5m67LA9jpUfR1e4X6kSsO+cVPHkIycqMiPM=";
+      hash = "sha256-iKVZCNd1sG3akqjE9MAVd44lulw2BbV/hLAAUvZujvE=";
    };
    "3.12-aarch64-linux" = getSrcFromPypi {
      platform = "manylinux_2_27_aarch64";
      dist = "cp312";
-      hash = "sha256-QD1eB3MbXNrDvZ+z9Ei9hIAGLLLAq2HqKtI/zQplR5o=";
+      hash = "sha256-sozPBbzAvHzLy9Mm2AKEZXTPbaA5FY52FHvZb1xvEYk=";
    };
    "3.13-x86_64-linux" = getSrcFromPypi {
      platform = "manylinux_2_27_x86_64";
      dist = "cp313";
-      hash = "sha256-gsZ5i+Zr+MdzOGkY5MjlzYEZdT87+zyku8RoGCg3UMY=";
+      hash = "sha256-vX3+0Xv6nQ4wFvjCpnZ8dHnZHhvf33kW6ysHQ1zEZY4=";
    };
    "3.13-aarch64-linux" = getSrcFromPypi {
      platform = "manylinux_2_27_aarch64";
      dist = "cp313";
-      hash = "sha256-Y3OH3DQIzSBFYmaFAvnpX3bG7d4KbS5I8FUWLcKuvw0=";
+      hash = "sha256-uaJwhdiTzFnCsoaxeJdV+Rzz6rHeobW+nmMvTJc5og4=";
    };
    "3.14-x86_64-linux" = getSrcFromPypi {
      platform = "manylinux_2_27_x86_64";
      dist = "cp314";
-      hash = "sha256-pYmLrB2KtgILVFRkQCVkCfLGa8u7OhCZykc8hIQ63a0=";
+      hash = "sha256-U1F0LA/LIdqeCUoZZasg/eUlhih392kYpJCxtWZk1To=";
    };
    "3.14-aarch64-linux" = getSrcFromPypi {
      platform = "manylinux_2_27_aarch64";
      dist = "cp314";
-      hash = "sha256-WMUUc/xiLgMTgDWYX3QYM1ZNcKS9WiF49htizaoy/5Q=";
+      hash = "sha256-MyEmmeG7sb7V0q4Urp/3Kh7tLQkqUearzAJ4prK4KHQ=";
    };
  };
 in
@@ -39,17 +39,17 @@
 let
  usingMKL = blas.implementation == "mkl" || lapack.implementation == "mkl";
 in
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "jax";
-  version = "0.8.2";
+  version = "0.9.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "google";
    repo = "jax";
    # google/jax contains tags for jax and jaxlib. Only use jax tags!
-    tag = "jax-v${version}";
-    hash = "sha256-WKdFEhOxJPLjOXOChZbLRGcw0GFeg/TT/FT6M72C6bo=";
+    tag = "jax-v${finalAttrs.version}";
+    hash = "sha256-/vLCTAF46M1H0Q64RLM7+IFMofmjZmZ4IFzvm/y7zkg=";
  };

  patches = [
@@ -73,7 +73,7 @@ buildPythonPackage rec {
    opt-einsum
    scipy
  ]
-  ++ lib.optionals cudaSupport optional-dependencies.cuda;
+  ++ lib.optionals cudaSupport finalAttrs.passthru.optional-dependencies.cuda;

  optional-dependencies = rec {
    cuda = [ jax-cuda12-plugin ];
@@ -194,4 +194,4 @@ buildPythonPackage rec {
      samuela
    ];
  };
-}
+})
@@ -18,7 +18,7 @@
 }:

 let
-  version = "0.8.2";
+  version = "0.9.2";
  inherit (python) pythonVersion;

  # As of 2023-06-06, google/jax upstream is no longer publishing CPU-only wheels to their GCS bucket. Instead the
@@ -49,65 +49,65 @@ let
      "3.11-x86_64-linux" = getSrcFromPypi {
        platform = "manylinux_2_27_x86_64";
        dist = "cp311";
-        hash = "sha256-zPd9qReiCTUkfJkGkd7Py90Gwl7wrJTZFKBKrbIvcUw=";
+        hash = "sha256-msmVtLoaru2uDWnzGZh9UV3K7NRQW2QrYxL54VQ5NR8=";
      };
      "3.11-aarch64-linux" = getSrcFromPypi {
        platform = "manylinux_2_27_aarch64";
        dist = "cp311";
-        hash = "sha256-u4m+RSsbgI0/iPwBxBWzZKJgvkzHrBIMA4AJ9hUKMtw=";
+        hash = "sha256-MG3lSh3nOGyAbHI+NWzjMtkj73SPinLWdP77dIEh1Nw=";
      };
      "3.11-aarch64-darwin" = getSrcFromPypi {
        platform = "macosx_11_0_arm64";
        dist = "cp311";
-        hash = "sha256-SQvwywKcc8ZclDESS4bNyVCC28H7dvxUnSTXXaM+VFQ=";
+        hash = "sha256-eF8XfD63jLfceXxV7VxLYxIUGEXJpoaVfkhLrL/OXog=";
      };

      "3.12-x86_64-linux" = getSrcFromPypi {
        platform = "manylinux_2_27_x86_64";
        dist = "cp312";
-        hash = "sha256-K5eJvQj4sMxaXBKuiW/kMtWULjLkFwkbi1qWqab9XPE=";
+        hash = "sha256-iLJ2px9PIHGx/S6SKr/WfIfGl3pVGhA2/rzqeNXvfiI=";
      };
      "3.12-aarch64-linux" = getSrcFromPypi {
        platform = "manylinux_2_27_aarch64";
        dist = "cp312";
-        hash = "sha256-OxblDFtzDJ3QpJ5V8az6pyKwCxrwUipZFVjcwEZCUvI=";
+        hash = "sha256-/vAthGhjtybnJFKZOIOoWW6sMl8ioux+qSHaD7xVCbQ=";
      };
      "3.12-aarch64-darwin" = getSrcFromPypi {
        platform = "macosx_11_0_arm64";
        dist = "cp312";
-        hash = "sha256-Aj3m8/Vtoq9wN5cJllAFhjMf21C1MOy7VLlmbaYzvQA=";
+        hash = "sha256-l8L75Yy+5KJ9lMpzXXCdIxspmrbtizsQdfUthk39MsE=";
      };

      "3.13-x86_64-linux" = getSrcFromPypi {
        platform = "manylinux_2_27_x86_64";
        dist = "cp313";
-        hash = "sha256-G/vPbD3iIXhPpM22dloJ1xy0KYsVYms9BAmz382Khmc=";
+        hash = "sha256-ttUAPjrdXDRqNK6e3EcFjLwttgyO1cUAllIhdtrwHJ8=";
      };
      "3.13-aarch64-linux" = getSrcFromPypi {
        platform = "manylinux_2_27_aarch64";
        dist = "cp313";
-        hash = "sha256-fDBPOgFpZbnR9SOaigOZpzkl9WBP6RTFymbs9zS/ZCI=";
+        hash = "sha256-vvYe7zbtOM7BBp6pc/iK+eAzNeiE9lAew/5/YiKhVVs=";
      };
      "3.13-aarch64-darwin" = getSrcFromPypi {
        platform = "macosx_11_0_arm64";
        dist = "cp313";
-        hash = "sha256-TQBtuWvgIMgWUhKhIWNy+KysT/T4+wZ3Q9aU7yswGs4=";
+        hash = "sha256-UqADJQj4z1eRx6e+4UJTHucGw8BVGBF/sLbujV4X/ec=";
      };

      "3.14-x86_64-linux" = getSrcFromPypi {
        platform = "manylinux_2_27_x86_64";
        dist = "cp314";
-        hash = "sha256-5ql9+wIy7tmiu244KOT2gtusGn/qhAv9pXTK4tv1+vk=";
+        hash = "sha256-PXFRFApJNvMhiy0bE0PdI3vShlz1FEKIS22C/ohKPec=";
      };
      "3.14-aarch64-linux" = getSrcFromPypi {
        platform = "manylinux_2_27_aarch64";
        dist = "cp314";
-        hash = "sha256-aBCN/w3nStxGgBa+mhn4Dv5IxmDA1aEiKHCUtEsJKvw=";
+        hash = "sha256-vkYnxC1Erdf+F9KE71ef+NFZ48tpR/ZDd1jzQXfoeOY=";
      };
      "3.14-aarch64-darwin" = getSrcFromPypi {
        platform = "macosx_11_0_arm64";
        dist = "cp314";
-        hash = "sha256-vv+wBOfutcmvskQ54rLPRaTuPj6K30XjVe3yr2Ks+Lg=";
+        hash = "sha256-urFo0lVVRkRhvQdzI0hPaQxHHmnOiww5o5+4Gz46i/A=";
      };
    };
 in
@@ -21,7 +21,7 @@
  scikit-learn,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "jaxopt";
  version = "0.8.5";
  pyproject = true;
@@ -29,10 +29,27 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "google";
    repo = "jaxopt";
-    tag = "jaxopt-v${version}";
+    tag = "jaxopt-v${finalAttrs.version}";
    hash = "sha256-vPXrs8J81O+27w9P/fEFr7w4xClKb8T0IASD+iNhztQ=";
  };

+  postPatch =
+    # TypeError: LogisticRegression.__init__() got an unexpected keyword argument 'multi_class'
+    ''
+      substituteInPlace jaxopt/_src/test_util.py \
+        --replace-fail "multi_class=multiclass," ""
+    ''
+    # AttributeError: jax.experimental.enable_x64 was removed in JAX v0.9.0; use jax.enable_x64(True) instead.
+    + ''
+      substituteInPlace \
+        tests/zoom_linesearch_test.py \
+        tests/lbfgsb_test.py \
+        tests/lbfgs_test.py \
+        --replace-fail \
+          "jax.experimental.enable_x64()" \
+          "jax.enable_x64(True)"
+    '';
+
  build-system = [ setuptools ];

  dependencies = [
@@ -83,8 +100,8 @@ buildPythonPackage rec {
  meta = {
    homepage = "https://jaxopt.github.io";
    description = "Hardware accelerated, batchable and differentiable optimizers in JAX";
-    changelog = "https://github.com/google/jaxopt/releases/tag/jaxopt-v${version}";
+    changelog = "https://github.com/google/jaxopt/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ bcdarwin ];
  };
-}
+})
@@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  pythonOlder,

  # build-system
  hatchling,
@@ -16,8 +17,9 @@
  jax,
  jaxlib,
  pytestCheckHook,
-  tensorflow,
  torch,
+  # python <= 3.12 only
+  tensorflow,

  # passthru
  jaxtyping,
@@ -25,14 +27,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "jaxtyping";
-  version = "0.3.5";
+  version = "0.3.9";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "patrick-kidger";
    repo = "jaxtyping";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0Vt6UD1xQkwve6yDVi5XQCoJ/IsJWHCkGesj66myQq4=";
+    hash = "sha256-Ex84xtns3wtIodXdpC6/88Kn0I+33B7ScHPIc9C5tuY=";
  };

  build-system = [ hatchling ];
@@ -50,8 +52,10 @@ buildPythonPackage (finalAttrs: {
    jax
    jaxlib
    pytestCheckHook
-    tensorflow
    torch
+  ]
+  ++ lib.optionals (pythonOlder "3.13") [
+    tensorflow
  ];

  doCheck = false;
@@ -18,16 +18,16 @@
  python,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "lineax";
-  version = "0.0.8";
+  version = "0.1.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "patrick-kidger";
    repo = "lineax";
-    tag = "v${version}";
-    hash = "sha256-VMTDCExgxfCcd/3UZAglfAxAFaSjzFJJuvSWJAx2tJs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-oUqJRp4pge3t9g7o/9PCZTb7e4EPkBEGLclHMIdUqiw=";
  };

  build-system = [ hatchling ];
@@ -59,8 +59,8 @@ buildPythonPackage rec {
  meta = {
    description = "Linear solvers in JAX and Equinox";
    homepage = "https://github.com/patrick-kidger/lineax";
-    changelog = "https://github.com/patrick-kidger/lineax/releases/tag/${src.tag}";
+    changelog = "https://github.com/patrick-kidger/lineax/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ GaetanLepage ];
  };
-}
+})
@@ -81,6 +81,12 @@ buildPythonPackage (finalAttrs: {
  ];

  disabledTests = [
+    # Failing with jax>=0.9.0
+    # TypeError: Error interpreting argument to closed_call as a JAX value
+    "test_provenance_call"
+    "test_provenance_closed_call"
+    "test_numpyrooptim_no_double_jit"
+
    # ValueError: Found unexpected Arrays on value of type <class 'list'> in static attribute 'layers'
    # of Pytree type '<class 'test_module.test_random_nnx_module_mcmc_sequence_params.<locals>.MLP'>'.
    # This is an error starting from Flax version 0.12.0.
@@ -8,7 +8,6 @@

  # dependencies
  absl-py,
-  chex,
  jax,
  jaxlib,
  numpy,
@@ -17,16 +16,16 @@
  callPackage,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "optax";
-  version = "0.2.6";
+  version = "0.2.8";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "deepmind";
    repo = "optax";
-    tag = "v${version}";
-    hash = "sha256-+9Q/Amb60m65ZiJsmH93e6tQmpJlMyzVUL0A7q3mS8Y=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-dVmMacQx6V5lv0z4nWUTlekuEDqtIZlxJazAeA9UR+E=";
  };

  outputs = [
@@ -38,7 +37,6 @@ buildPythonPackage rec {

  dependencies = [
    absl-py
-    chex
    jax
    jaxlib
    numpy
@@ -61,8 +59,8 @@ buildPythonPackage rec {
  meta = {
    description = "Gradient processing and optimization library for JAX";
    homepage = "https://github.com/deepmind/optax";
-    changelog = "https://github.com/deepmind/optax/releases/tag/v${version}";
+    changelog = "https://github.com/deepmind/optax/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ ndl ];
  };
-}
+})
@@ -149,6 +149,7 @@ buildPythonPackage (finalAttrs: {
    "orbax/checkpoint/_src/path/snapshot/snapshot_test.py"

    # Circular dependency flax
+    "orbax/checkpoint/_src/handlers/pytree_checkpoint_handler_test.py"
    "orbax/checkpoint/_src/metadata/empty_values_test.py"
    "orbax/checkpoint/_src/metadata/tree_rich_types_test.py"
    "orbax/checkpoint/_src/metadata/tree_test.py"
@@ -159,13 +160,12 @@ buildPythonPackage (finalAttrs: {
    "orbax/checkpoint/checkpoint_manager_test.py"
    "orbax/checkpoint/single_host_test.py"
    "orbax/checkpoint/transform_utils_test.py"
-    "orbax/checkpoint/_src/handlers/pytree_checkpoint_handler_test.py"
  ];

  meta = {
    description = "Orbax provides common utility libraries for JAX users";
    homepage = "https://github.com/google/orbax/tree/main/checkpoint";
-    changelog = "https://github.com/google/orbax/blob/v${finalAttrs.version}/checkpoint/CHANGELOG.md";
+    changelog = "https://github.com/google/orbax/blob/${finalAttrs.src.tag}/checkpoint/CHANGELOG.md";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ fab ];
  };
@@ -0,0 +1,90 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+
+  # build-system
+  flit-core,
+
+  # dependencies
+  absl-py,
+  dataclasses-json,
+  etils,
+  jax,
+  jaxlib,
+  jaxtyping,
+  numpy,
+  orbax-checkpoint,
+  protobuf,
+  tensorflow,
+
+  # tests
+  chex,
+  flax,
+  pytestCheckHook,
+
+  # passthru
+  orbax-export,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "orbax-export";
+  version = "0.0.8";
+  pyproject = true;
+
+  # Tags on the GitHub repo don't match the Pypi releases for orbax-export
+  src = fetchPypi {
+    pname = "orbax_export";
+    inherit (finalAttrs) version;
+    hash = "sha256-VE7vVk4qbxfNEbEWf+vjSLe3z1bZV13plKM9VhPdVoo=";
+  };
+
+  build-system = [
+    flit-core
+  ];
+
+  dependencies = [
+    absl-py
+    dataclasses-json
+    etils
+    jax
+    jaxlib
+    jaxtyping
+    numpy
+    orbax-checkpoint
+    protobuf
+    tensorflow
+  ];
+
+  pythonImportsCheck = [
+    "orbax"
+    "orbax.export"
+    "orbax.export.bfloat16_toolkit.python"
+  ];
+
+  nativeCheckInputs = [
+    chex
+    flax
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    cd orbax/export
+    rm -rf ./**/__init__.py
+    rm -rf typing
+  '';
+
+  # Circular dependency with flax
+  doCheck = false;
+
+  passthru.tests.pytest = orbax-export.overridePythonAttrs {
+    doCheck = true;
+  };
+
+  meta = {
+    description = "Serialization library for JAX users, enabling the exporting of JAX models to the TensorFlow SavedModel format";
+    homepage = "https://github.com/google/orbax/tree/main/export";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+})
@@ -33,6 +33,7 @@ buildPythonPackage rec {

  pythonRelaxDeps = [
    "numpy"
+    "pyqtgraph"
  ];

  passthru.optional-dependencies = {
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  pymodbus,
+  pytestCheckHook,
+  pytest-asyncio,
+  pytest-timeout,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pysaunum";
+  version = "0.5.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "mettolen";
+    repo = "pysaunum";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-0O/U79265YCr3iauVxXL0NRjVy7TZhlfUV3idfYa3fc=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ pymodbus ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-asyncio
+    pytest-timeout
+  ];
+
+  pythonImportsCheck = [ "pysaunum" ];
+
+  meta = {
+    description = "Python library for controlling Saunum sauna controllers via Modbus TCP";
+    homepage = "https://github.com/mettolen/pysaunum";
+    changelog = "https://github.com/mettolen/pysaunum/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+})
@@ -90,6 +90,10 @@ buildPythonPackage (finalAttrs: {

    # AssertionError: equal_computations failed
    "test_infer_shape_db_handles_xtensor_lowering"
+
+    # Crashes with jax>=0.9.0
+    # in .../jax/_src/compiler.py", line 362 in backend_compile_and_load
+    "test_higher_order_derivatives"
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    # Numerical assertion error
@@ -1,25 +0,0 @@
-From 4c2b65c47d328c2f20cc74adcec2286fee6cb5de Mon Sep 17 00:00:00 2001
-From: Yaroslav Bolyukin <iam@lach.pw>
-Date: Tue, 30 Jan 2024 18:18:35 +0100
-Subject: [PATCH] fix: allow building without git
-
---
- setup.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/setup.py b/setup.py
-index e01c008..92eca62 100644
--- a/setup.py
-+++ b/setup.py
-@@ -71,7 +71,7 @@ def get_flash_version() -> str:
-             ["git", "describe", "--tags", "--always"],
-             cwd=flash_dir,
-         ).decode("ascii")[:-1]
-    except subprocess.CalledProcessError:
-+    except Exception:
-         version = flash_dir / "version.txt"
-         if version.is_file():
-             return version.read_text().strip()
-- 
-2.43.0
-
@@ -3,75 +3,83 @@
  stdenv,
  buildPythonPackage,
  fetchFromGitHub,
-  which,
-  setuptools,
-  # runtime dependencies
-  numpy,
+
+  # build-system
  torch,
-  # check dependencies
-  pytestCheckHook,
-  pytest-cov-stub,
-  # , pytest-mpi
-  pytest-timeout,
-  # , pytorch-image-models
-  hydra-core,
-  fairscale,
-  scipy,
-  cmake,
-  ninja,
-  triton,
-  networkx,
-  #, apex
-  einops,
-  transformers,
-  timm,
-  #, flash-attn
+  setuptools,
+
+  # buildInputs
  openmp,
+
+  # dependencies
+  numpy,
+  pynvml,
+
+  # tests
+  einops,
+  fairscale,
+  hydra-core,
+  networkx,
+  pytest-cov-stub,
+  pytest-timeout,
+  pytestCheckHook,
+  scipy,
+  timm,
+  transformers,
+  triton,
+  python,
+
+  # passthru
+  xformers,
+  writableTmpDirAsHomeHook,
 }:
 let
  inherit (torch) cudaCapabilities cudaPackages cudaSupport;

-  # version 0.0.32.post2 was confirmed to break CUDA.
-  # Remove this note once the latest published revision "just works".
-  version = "0.0.30";
  effectiveStdenv = if cudaSupport then cudaPackages.backendStdenv else stdenv;
 in
-buildPythonPackage.override { stdenv = effectiveStdenv; } {
+buildPythonPackage.override { stdenv = effectiveStdenv; } (finalAttrs: {
  pname = "xformers";
-  inherit version;
+  version = "0.0.35";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "facebookresearch";
    repo = "xformers";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-ozaw9z8qnGpZ28LQNtwmKeVnrn7KDWNeJKtT6g6Q/W0=";
+    hash = "sha256-UqpRHLN0INpW6sA8DbQCSeL8uhS+IoW60UPVUIh1NY0=";
  };

-  patches = [ ./0001-fix-allow-building-without-git.patch ];
+  # ModuleNotFoundError: No module named 'xformers.components'
+  postPatch = ''
+    touch xformers/components/__init__.py
+    touch xformers/components/attention/__init__.py
+  '';

-  build-system = [ setuptools ];
+  build-system = [
+    setuptools
+    torch
+  ];

  preBuild = ''
-    cat << EOF > ./xformers/version.py
-    # noqa: C801
-    __version__ = "${version}"
-    EOF
-
    export MAX_JOBS=$NIX_BUILD_CORES
  '';

  env = lib.attrsets.optionalAttrs cudaSupport {
-    TORCH_CUDA_ARCH_LIST = "${lib.concatStringsSep ";" torch.cudaCapabilities}";
+    # Don't silently fallback to a non-CUDA build
+    FORCE_CUDA = 1;
+
+    TORCH_CUDA_ARCH_LIST = "${lib.concatStringsSep ";" cudaCapabilities}";
  };

  buildInputs =
-    lib.optional stdenv.hostPlatform.isDarwin openmp
+    lib.optionals stdenv.hostPlatform.isDarwin [
+      openmp
+    ]
    ++ lib.optionals cudaSupport (
      with cudaPackages;
      [
-        # flash-attn build
        cuda_cudart # cuda_runtime_api.h
        libcusparse # cusparse.h
        cuda_cccl # nv/target
@@ -81,51 +89,127 @@ buildPythonPackage.override { stdenv = effectiveStdenv; } {
      ]
    );

-  nativeBuildInputs = [
-    ninja
-    which
-  ]
-  ++ lib.optionals cudaSupport (with cudaPackages; [ cuda_nvcc ])
-  ++ lib.optional stdenv.hostPlatform.isDarwin openmp.dev;
+  nativeBuildInputs =
+    lib.optionals cudaSupport [
+      cudaPackages.cuda_nvcc
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      openmp.dev
+    ];

  dependencies = [
    numpy
    torch
+  ]
+  ++ lib.optionals cudaSupport [
+    pynvml
  ];

-  pythonImportsCheck = [ "xformers" ];
-
-  # Has broken 0.03 version:
-  # https://github.com/NixOS/nixpkgs/pull/285495#issuecomment-1920730720
-  passthru.skipBulkUpdate = true;
-
-  dontUseCmakeConfigure = true;
-
-  # see commented out missing packages
-  doCheck = false;
+  pythonImportsCheck = [
+    "xformers"
+    "xformers.components"
+    "xformers.components.attention"
+  ];

  nativeCheckInputs = [
-    pytestCheckHook
+    einops
+    fairscale
+    hydra-core
+    networkx
    pytest-cov-stub
    pytest-timeout
-    hydra-core
-    fairscale
+    pytestCheckHook
    scipy
-    cmake
-    networkx
-    triton
-    # apex
-    einops
-    transformers
    timm
-    # flash-attn
+    transformers
+    triton
  ];

+  preCheck =
+    # Otherwise the CPP bindings are not available and the GPU tests fail with:
+    # `fa2F@2.5.7-pt` is not supported because:
+    #     xFormers wasn't build with CUDA support: False
+    ''
+      rm -rf xformers
+    ''
+    # Display information about the installation
+    + ''
+      ${python.interpreter} -m xformers.info
+    '';
+
+  enabledTestPaths = [
+    "tests"
+  ];
+
+  disabledTestPaths = [
+    # Those tests require access to the GPU and should be tagged accordingly:
+    # https://github.com/facebookresearch/xformers/pull/1385
+    "tests/test_fwbw_overlap.py"
+  ];
+
+  disabledTests =
+    # The following tests fail without cudaSupport
+    lib.optionals (!cudaSupport) [
+      # AssertionError: Torch not compiled with CUDA enabled
+      "test_flash_gqa_wrong_strides"
+      "test_memeff_compile"
+      "test_paged_attention"
+      "test_paged_attention_flash"
+      "test_triton_splitk_decoder"
+      "test_triton_splitk_decoder_manyqueries"
+      "test_unsupported_dropout_combine_flash_cutlass"
+
+      # AssertionError: Should use Flash-Decoding with BMHK MQA
+      "test_dispatch_decoding_bmhk"
+
+      # AssertionError: Should use Flash-Decoding with MQA
+      "test_dispatch_decoding_bmghk"
+    ];
+
+  passthru.gpuCheck = xformers.overridePythonAttrs (old: {
+    requiredSystemFeatures = [ "cuda" ];
+
+    # Run all tests, including the ones that need a GPU
+    disabledTestPaths = [ ];
+
+    disabledTests = (old.disabledTests or [ ]) ++ [
+      # `fa3F@0.0.0` is not supported because:
+      #   operator wasn't built - see `python -m xformers.info` for more info
+      "test_merge_training"
+
+      # Not enough GPU memory (on a 20G RTX 4000 SFF Ada)
+      # triton.runtime.errors.OutOfResources: out of resource:
+      # shared memory, Required: 147456, Hardware limit: 101376.
+      "test_consistency"
+      "test_forward"
+      "test_logsumexp"
+      "test_mqa_decoding"
+      "test_tree_attention"
+
+      # Tolerance issues:
+      # AssertionError: cutlassF-pt+cutlassB-pt:key: out=4.65625 and ref=3.1875
+      # (diff=0.251953125 > 0) at (np.int64(0), np.int64(0), np.int64(4))
+      # of shape (1, 4, 8) / atol=0.9, rtol=0.1/ total failing elements: 1 (3.12%)
+      "test_backward"
+
+      # AssertionError: Legacy CUDA profiling requires use_cpu=True
+      "test_profiler_dispatcher_stream_workaround"
+
+      # RuntimeError: two_four_sgemm_cutlass, /build/source/xformers/csrc/sparse24/gemm.cu:190,
+      # Got CUTLASS error: Error Internal
+      "test_linearw24"
+    ];
+
+    nativeCheckInputs = old.nativeCheckInputs ++ [
+      writableTmpDirAsHomeHook
+    ];
+  });
+
  meta = {
    description = "Collection of composable Transformer building blocks";
    homepage = "https://github.com/facebookresearch/xformers";
-    changelog = "https://github.com/facebookresearch/xformers/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/facebookresearch/xformers/blob/${finalAttrs.src.tag}/CHANGELOG.md";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [ happysalada ];
  };
-}
+})
@@ -0,0 +1,87 @@
+diff --git a/external/CppMicroServices/CMakeLists.txt b/external/CppMicroServices/CMakeLists.txt
+index 8d0aff3..44d45d9 100644
+--- a/external/CppMicroServices/CMakeLists.txt
+++ b/external/CppMicroServices/CMakeLists.txt
+@@ -1,7 +1,7 @@
+ # Extract the current version from the VERSION file
+ file(STRINGS VERSION _version LIMIT_COUNT 1)
+ 
+-set(US_CMAKE_MINIMUM_REQUIRED_VERSION 3.2)
+set(US_CMAKE_MINIMUM_REQUIRED_VERSION 3.10)
+ 
+ cmake_minimum_required(VERSION ${US_CMAKE_MINIMUM_REQUIRED_VERSION})
+ 
+diff --git a/external/CppMicroServices/framework/include/cppmicroservices/AnyMap.h b/external/CppMicroServices/framework/include/cppmicroservices/AnyMap.h
+index 3f240f4..e8acef9 100644
+--- a/external/CppMicroServices/framework/include/cppmicroservices/AnyMap.h
+++ b/external/CppMicroServices/framework/include/cppmicroservices/AnyMap.h
+@@ -25,6 +25,7 @@
+ 
+ #include "cppmicroservices/Any.h"
+ 
+#include <cstdint>
+ #include <string>
+ #include <unordered_map>
+ 
+diff --git a/external/CppMicroServices/framework/include/cppmicroservices/BundleEvent.h b/external/CppMicroServices/framework/include/cppmicroservices/BundleEvent.h
+index 9b36a9b..12894fa 100644
+--- a/external/CppMicroServices/framework/include/cppmicroservices/BundleEvent.h
+++ b/external/CppMicroServices/framework/include/cppmicroservices/BundleEvent.h
+@@ -25,6 +25,7 @@
+ 
+ #include "cppmicroservices/FrameworkExport.h"
+ 
+#include <cstdint>
+ #include <iostream>
+ #include <memory>
+ 
+diff --git a/external/CppMicroServices/framework/include/cppmicroservices/Constants.h b/external/CppMicroServices/framework/include/cppmicroservices/Constants.h
+index 590a890..cf60926 100644
+--- a/external/CppMicroServices/framework/include/cppmicroservices/Constants.h
+++ b/external/CppMicroServices/framework/include/cppmicroservices/Constants.h
+@@ -25,6 +25,7 @@
+ 
+ #include "cppmicroservices/FrameworkConfig.h"
+ 
+#include <cstdint>
+ #include <string>
+ 
+ namespace cppmicroservices {
+diff --git a/external/CppMicroServices/framework/include/cppmicroservices/FrameworkEvent.h b/external/CppMicroServices/framework/include/cppmicroservices/FrameworkEvent.h
+index 71caf1b..a29e87c 100644
+--- a/external/CppMicroServices/framework/include/cppmicroservices/FrameworkEvent.h
+++ b/external/CppMicroServices/framework/include/cppmicroservices/FrameworkEvent.h
+@@ -25,6 +25,7 @@
+ 
+ #include "cppmicroservices/FrameworkExport.h"
+ 
+#include <cstdint>
+ #include <iostream>
+ #include <memory>
+ 
+diff --git a/external/CppMicroServices/framework/include/cppmicroservices/ServiceEvent.h b/external/CppMicroServices/framework/include/cppmicroservices/ServiceEvent.h
+index 451cb82..da7c5f0 100644
+--- a/external/CppMicroServices/framework/include/cppmicroservices/ServiceEvent.h
+++ b/external/CppMicroServices/framework/include/cppmicroservices/ServiceEvent.h
+@@ -25,6 +25,8 @@
+ 
+ #include "cppmicroservices/ServiceReference.h"
+ 
+#include <cstdint>
+
+ US_MSVC_PUSH_DISABLE_WARNING(
+   4251) // 'identifier' : class 'type' needs to have dll-interface to be used by clients of class 'type2'
+ 
+diff --git a/psw/ae/aesm_service/source/CMakeLists.txt b/psw/ae/aesm_service/source/CMakeLists.txt
+index 5728e9b..0169263 100644
+--- a/psw/ae/aesm_service/source/CMakeLists.txt
+++ b/psw/ae/aesm_service/source/CMakeLists.txt
+@@ -30,7 +30,7 @@
+ #
+ 
+ # [proj-begin]
+-cmake_minimum_required(VERSION 3.0.0)
+cmake_minimum_required(VERSION 3.10.0)
+ project(ModularAESM VERSION 0.1.0)
+ 
+ 
@@ -20,15 +20,15 @@
 stdenv.mkDerivation rec {
  pname = "sgx-psw";
  # Version as given in se_version.h
-  version = "2.25.100.3";
+  version = "2.27.100.1";
  # Version as used in the Git tag
-  versionTag = "2.25";
+  versionTag = "2.27";

  src = fetchFromGitHub {
    owner = "intel";
    repo = "linux-sgx";
    rev = "sgx_${versionTag}";
-    hash = "sha256-RR+vFTd9ZM6XUn3KgQeUM+xoj1Ava4zQzFYA/nfXyaw=";
+    hash = "sha256-hNmh4IgNJDNqt2xF8zBnD/x+saMyMk5hZLA3aOqzqEA=";
    fetchSubmodules = true;
  };

@@ -52,11 +52,11 @@ stdenv.mkDerivation rec {
      # Fetch the Data Center Attestation Primitives (DCAP) platform enclaves
      # and pre-built sgxssl.
      dcap = rec {
-        version = "1.22";
+        version = "1.24";
        filename = "prebuilt_dcap_${version}.tar.gz";
        prebuilt = fetchurl {
          url = "https://download.01.org/intel-sgx/sgx-dcap/${version}/linux/${filename}";
-          hash = "sha256-RTpJQ6epoAN8YQXSJUjJQ5mPaQIiQpStTWFsnspjjDQ=";
+          hash = "sha256-sc/eYIPdhwAyDk2Zh1HU6yuFlobqVy/4++m5OnQE3Bc=";
        };
      };
    in
@@ -72,8 +72,8 @@ stdenv.mkDerivation rec {
      grep -q 'ae_file_name=${dcap.filename}' "$src/external/dcap_source/QuoteGeneration/download_prebuilt.sh" \
        || (echo "Could not find expected prebuilt DCAP ${dcap.filename} in linux-sgx source" >&2 && exit 1)

-      tar -xzvf ${dcap.prebuilt} -C $sourceRoot/external/dcap_source ./prebuilt/
-      tar -xzvf ${dcap.prebuilt} -C $sourceRoot/external/dcap_source/QuoteGeneration ./psw/
+      tar -xzvf ${dcap.prebuilt} -C $sourceRoot/external/dcap_source prebuilt/
+      tar -xzvf ${dcap.prebuilt} -C $sourceRoot/external/dcap_source/QuoteGeneration psw/
    '';

  patches = [
@@ -90,6 +90,13 @@ stdenv.mkDerivation rec {
    # binary. Without changes, the `aesm_service` will be different after every
    # build because the embedded zip file contents have different modified times.
    ./cppmicroservices-no-mtime.patch
+
+    # CppMicroServices is failing to build with CMake 4 and GCC 15
+    # PR: <https://github.com/intel/confidential-computing.sgx/pull/1098>
+    # - CMake 4 dropped support for <3.5 and warns on <3.10, so bump the
+    #   `cmake_minimum_required` to 3.10
+    # - Various header files now need `#include <cstdint>` to compile
+    ./cppmicroservices-compat.patch
  ];

  postPatch =
@@ -1,32 +1,27 @@
 diff --git a/Makefile b/Makefile
-index 19bc05a..6b1acd4 100644
+index 144f4e4..834c23e 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -50,13 +50,13 @@ tips:
+@@ -50,22 +50,17 @@ tips:
 preparation:
 # As SDK build needs to clone and patch openmp, we cannot support the mode that download the source from github as zip.
 # Only enable the download from git
 -	git submodule update --init --recursive
-+	# git submodule update --init --recursive
 	cd external/dcap_source/external/jwt-cpp && git apply ../0001-Add-a-macro-to-disable-time-support-in-jwt-for-SGX.patch >/dev/null 2>&1 || \
 	git apply ../0001-Add-a-macro-to-disable-time-support-in-jwt-for-SGX.patch -R --check
 -	./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild
-+	# ./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild
 	cd external/openmp/openmp_code && git apply ../0001-Enable-OpenMP-in-SGX.patch >/dev/null 2>&1 ||  git apply ../0001-Enable-OpenMP-in-SGX.patch --check -R
 	cd external/protobuf/protobuf_code && git apply ../sgx_protobuf.patch >/dev/null 2>&1 ||  git apply ../sgx_protobuf.patch --check -R
+ 	cd external/protobuf/protobuf_code && git apply ../0001-bumped-protobuf-to-1.33.0.patch >/dev/null 2>&1 ||  git apply ../0001-bumped-protobuf-to-1.33.0.patch --check -R
 -	cd external/protobuf/protobuf_code && git submodule update --init --recursive && cd third_party/abseil-cpp && git apply ../../../sgx_abseil.patch>/dev/null 2>&1 || git apply ../../../sgx_abseil.patch --check -R
-+	cd external/protobuf/protobuf_code && cd third_party/abseil-cpp && git apply ../../../sgx_abseil.patch>/dev/null 2>&1 || git apply ../../../sgx_abseil.patch --check -R
 	./external/sgx-emm/create_symlink.sh
- 	cd external/mbedtls/mbedtls_code && git apply ../sgx_mbedtls.patch >/dev/null 2>&1 || git apply ../sgx_mbedtls.patch --check -R
 	cd external/cbor && cp -r libcbor sgx_libcbor
-@@ -64,8 +64,8 @@ preparation:
+ 	cd external/cbor/libcbor && git apply ../raw_cbor.patch >/dev/null 2>&1 || git apply ../raw_cbor.patch --check -R
 	cd external/cbor/sgx_libcbor && git apply ../sgx_cbor.patch >/dev/null 2>&1 || git apply ../sgx_cbor.patch --check -R
 	cd external/ippcp_internal/ipp-crypto && git apply ../0001-IPP-crypto-for-SGX.patch > /dev/null 2>&1 || git apply ../0001-IPP-crypto-for-SGX.patch --check -R
 	cd external/ippcp_internal/ipp-crypto && mkdir -p build
 -	./download_prebuilt.sh
 -	./external/dcap_source/QuoteGeneration/download_prebuilt.sh
-+	# ./download_prebuilt.sh
-+	# ./external/dcap_source/QuoteGeneration/download_prebuilt.sh
 
 psw:
 	$(MAKE) -C psw/ USE_OPT_LIBS=$(USE_OPT_LIBS)
@@ -1,146 +0,0 @@
-{
-  stdenv,
-  lib,
-  makeWrapper,
-  openssl,
-  sgx-sdk,
-  sgx-psw,
-  which,
-  # "SIM" or "HW"
-  sgxMode,
-}:
-let
-  isSimulation = sgxMode == "SIM";
-  buildSample =
-    name:
-    stdenv.mkDerivation {
-      pname = name;
-      version = sgxMode;
-
-      src = sgx-sdk.out;
-      sourceRoot = "${sgx-sdk.name}/share/SampleCode/${name}";
-
-      nativeBuildInputs = [
-        makeWrapper
-        openssl
-        which
-      ];
-
-      buildInputs = [
-        sgx-sdk
-      ];
-
-      # The samples don't have proper support for parallel building
-      # causing them to fail randomly.
-      enableParallelBuilding = false;
-
-      buildFlags = [
-        "SGX_MODE=${sgxMode}"
-      ];
-
-      installPhase = ''
-        runHook preInstall
-
-        mkdir -p $out/{bin,lib}
-        install -m 755 app $out/bin
-        install *.so $out/lib
-
-        wrapProgram "$out/bin/app" \
-          --chdir "$out/lib" \
-          ${lib.optionalString (!isSimulation)
-            ''--prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ sgx-psw ]}"''
-          }
-
-        runHook postInstall
-      '';
-
-      # Breaks the signature of the enclaves
-      dontFixup = true;
-
-      # We don't have access to real SGX hardware during the build
-      doInstallCheck = isSimulation;
-      installCheckPhase = ''
-        runHook preInstallCheck
-
-        pushd /
-        echo a | $out/bin/app
-        popd
-
-        runHook preInstallCheck
-      '';
-    };
-in
-{
-  cxx11SGXDemo = buildSample "Cxx11SGXDemo";
-  cxx14SGXDemo = buildSample "Cxx14SGXDemo";
-  cxx17SGXDemo = buildSample "Cxx17SGXDemo";
-  localAttestation = (buildSample "LocalAttestation").overrideAttrs (old: {
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out/{bin,lib}
-      install -m 755 bin/app* $out/bin
-      install bin/*.so $out/lib
-
-      for bin in $out/bin/*; do
-        wrapProgram $bin \
-          --chdir "$out/lib" \
-          ${lib.optionalString (!isSimulation)
-            ''--prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ sgx-psw ]}"''
-          }
-      done
-
-      runHook postInstall
-    '';
-  });
-  powerTransition = buildSample "PowerTransition";
-  protobufSGXDemo = buildSample "ProtobufSGXDemo";
-  remoteAttestation = (buildSample "RemoteAttestation").overrideAttrs (old: {
-    # Makefile sets rpath to point to $TMPDIR
-    preFixup = ''
-      patchelf --remove-rpath $out/bin/app
-    '';
-
-    postInstall = ''
-      install sample_libcrypto/*.so $out/lib
-    '';
-  });
-  sampleEnclave = buildSample "SampleEnclave";
-  sampleEnclaveGMIPP = buildSample "SampleEnclaveGMIPP";
-  sampleMbedCrypto = buildSample "SampleMbedCrypto";
-  sealUnseal = (buildSample "SealUnseal").overrideAttrs (old: {
-    prePatch = ''
-      substituteInPlace App/App.cpp \
-        --replace '"sealed_data_blob.txt"' '"/tmp/sealed_data_blob.txt"'
-    '';
-  });
-  switchless = buildSample "Switchless";
-  # # Requires SGX-patched openssl (sgxssl) build
-  # sampleAttestedTLS = buildSample "SampleAttestedTLS";
-}
-// lib.optionalAttrs (!isSimulation) {
-  # # Requires kernel >= v6.2 && HW SGX
-  # sampleAEXNotify = buildSample "SampleAEXNotify";
-
-  # Requires HW SGX
-  sampleCommonLoader = (buildSample "SampleCommonLoader").overrideAttrs (old: {
-    nativeBuildInputs = [ sgx-psw ] ++ old.nativeBuildInputs;
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out/{bin,lib}
-      mv sample app
-      install -m 755 app $out/bin
-
-      wrapProgram "$out/bin/app" \
-        --chdir "$out/lib" \
-        --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ sgx-psw ]}"
-
-      runHook postInstall
-    '';
-  });
-
-  # # SEGFAULTs in simulation mode?
-  # sampleEnclavePCL = buildSample "SampleEnclavePCL";
-}
@@ -1,26 +0,0 @@
-diff --git a/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp b/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp
-index aee499e9..13fa89d4 100644
--- a/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp
-+++ b/external/CppMicroServices/framework/src/bundle/BundleResourceContainer.cpp
-@@ -105,7 +105,7 @@ bool BundleResourceContainer::GetStat(int index,
-                    const_cast<mz_zip_archive*>(&m_ZipArchive), index)
-                    ? true
-                    : false;
-    stat.modifiedTime = zipStat.m_time;
-+    stat.modifiedTime = 0;
-     stat.crc32 = zipStat.m_crc32;
-     // This will limit the size info from uint64 to uint32 on 32-bit
-     // architectures. We don't care because we assume resources > 2GB
-diff --git a/external/CppMicroServices/third_party/miniz.c b/external/CppMicroServices/third_party/miniz.c
-index 6b0ebd7a..fa2aebca 100644
--- a/external/CppMicroServices/third_party/miniz.c
-+++ b/external/CppMicroServices/third_party/miniz.c
-@@ -170,7 +170,7 @@
- // If MINIZ_NO_TIME is specified then the ZIP archive functions will not be able to get the current time, or
- // get/set file times, and the C run-time funcs that get/set times won't be called.
- // The current downside is the times written to your archives will be from 1979.
-//#define MINIZ_NO_TIME
-+#define MINIZ_NO_TIME
-
- // Define MINIZ_NO_ARCHIVE_APIS to disable all ZIP archive API's.
- //#define MINIZ_NO_ARCHIVE_APIS
@@ -1,304 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  autoconf,
-  automake,
-  binutils,
-  callPackage,
-  cmake,
-  file,
-  gdb,
-  git,
-  libtool,
-  linkFarmFromDrvs,
-  ocamlPackages,
-  openssl,
-  perl,
-  python3,
-  texinfo,
-  validatePkgConfig,
-  writeShellApplication,
-  writeShellScript,
-  writeText,
-  debug ? false,
-}:
-stdenv.mkDerivation (finalAttrs: {
-  pname = "sgx-sdk";
-  # Version as given in se_version.h
-  version = "2.24.100.3";
-  # Version as used in the Git tag
-  versionTag = "2.24";
-
-  src = fetchFromGitHub {
-    owner = "intel";
-    repo = "linux-sgx";
-    rev = "sgx_${finalAttrs.versionTag}";
-    hash = "sha256-1urEdfMKNUqqyJ3wQ10+tvtlRuAKELpaCWIOzjCbYKw=";
-    fetchSubmodules = true;
-  };
-
-  postUnpack = ''
-    # Make sure this is the right version of linux-sgx
-    grep -q '"${finalAttrs.version}"' "$src/common/inc/internal/se_version.h" \
-      || (echo "Could not find expected version ${finalAttrs.version} in linux-sgx source" >&2 && exit 1)
-  '';
-
-  patches = [
-    # There's a `make preparation` step that downloads some prebuilt binaries
-    # and applies some patches to the in-repo git submodules. This patch removes
-    # the parts that download things, since we can't do that inside the sandbox.
-    ./disable-downloads.patch
-
-    # This patch disable mtime in bundled zip file for reproducible builds.
-    #
-    # Context: The `aesm_service` binary depends on a vendored library called
-    # `CppMicroServices`. At build time, this lib creates and then bundles
-    # service resources into a zip file and then embeds this zip into the
-    # binary. Without changes, the `aesm_service` will be different after every
-    # build because the embedded zip file contents have different modified times.
-    ./cppmicroservices-no-mtime.patch
-  ];
-
-  postPatch = ''
-    patchShebangs linux/installer/bin/build-installpkg.sh \
-      linux/installer/common/sdk/createTarball.sh \
-      linux/installer/common/sdk/install.sh \
-      external/sgx-emm/create_symlink.sh
-
-    make preparation
-  '';
-
-  # We need `cmake` as a build input but don't use it to kick off the build phase
-  dontUseCmakeConfigure = true;
-
-  # SDK built with stackprotector produces broken enclaves which crash at runtime.
-  # Disable all to be safe, SDK build configures compiler mitigations manually.
-  hardeningDisable = [ "all" ];
-
-  nativeBuildInputs = [
-    autoconf
-    automake
-    cmake
-    file
-    git
-    ocamlPackages.ocaml
-    ocamlPackages.ocamlbuild
-    perl
-    python3
-    texinfo
-    validatePkgConfig
-  ];
-
-  buildInputs = [
-    libtool
-    openssl
-  ];
-
-  env.BINUTILS_DIR = "${binutils}/bin";
-
-  # Build external/ippcp_internal first. The Makefile is rewritten to make the
-  # build faster by splitting different versions of ipp-crypto builds and to
-  # avoid patching the Makefile for reproducibility issues.
-  preBuild =
-    let
-      ipp-crypto-no_mitigation = callPackage ./ipp-crypto.nix { };
-
-      sgx-asm-pp = "python ${finalAttrs.src}/build-scripts/sgx-asm-pp.py --assembler=nasm";
-
-      nasm-load = writeShellScript "nasm-load" "${sgx-asm-pp} --MITIGATION-CVE-2020-0551=LOAD $@";
-      ipp-crypto-cve_2020_0551_load = callPackage ./ipp-crypto.nix {
-        extraCmakeFlags = [ "-DCMAKE_ASM_NASM_COMPILER=${nasm-load}" ];
-      };
-
-      nasm-cf = writeShellScript "nasm-cf" "${sgx-asm-pp} --MITIGATION-CVE-2020-0551=CF $@";
-      ipp-crypto-cve_2020_0551_cf = callPackage ./ipp-crypto.nix {
-        extraCmakeFlags = [ "-DCMAKE_ASM_NASM_COMPILER=${nasm-cf}" ];
-      };
-    in
-    ''
-      echo "Setting up IPP crypto build artifacts"
-
-      pushd 'external/ippcp_internal'
-
-      install -D -m a+rw ${ipp-crypto-no_mitigation}/lib/intel64/libippcp.a \
-        lib/linux/intel64/no_mitigation/libippcp.a
-      install -D -m a+rw ${ipp-crypto-cve_2020_0551_load}/lib/intel64/libippcp.a \
-        lib/linux/intel64/cve_2020_0551_load/libippcp.a
-      install -D -m a+rw ${ipp-crypto-cve_2020_0551_cf}/lib/intel64/libippcp.a \
-        lib/linux/intel64/cve_2020_0551_cf/libippcp.a
-
-      cp -r ${ipp-crypto-no_mitigation}/include/* inc/
-
-      mkdir inc/ippcp
-      cp ${ipp-crypto-no_mitigation}/include/fips_cert.h inc/ippcp/
-
-      rm inc/ippcp.h
-      patch ${ipp-crypto-no_mitigation}/include/ippcp.h -i ./inc/ippcp21u11.patch -o ./inc/ippcp.h
-
-      install -D ${ipp-crypto-no_mitigation.src}/LICENSE license/LICENSE
-
-      popd
-    '';
-
-  buildFlags = [
-    "sdk_install_pkg"
-  ]
-  ++ lib.optionals debug [
-    "DEBUG=1"
-  ];
-
-  postBuild = ''
-    patchShebangs linux/installer/bin/sgx_linux_x64_sdk_${finalAttrs.version}.bin
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    installDir=$TMPDIR
-    ./linux/installer/bin/sgx_linux_x64_sdk_${finalAttrs.version}.bin -prefix $installDir
-    installDir=$installDir/sgxsdk
-
-    echo "Move files created by installer"
-
-    mkdir -p $out/bin
-    pushd $out
-
-    mv $installDir/bin/sgx-gdb $out/bin
-    mkdir $out/bin/x64
-    for file in $installDir/bin/x64/*; do
-      mv $file bin/
-      ln -sr bin/$(basename $file) bin/x64/
-    done
-    rmdir $installDir/bin/{x64,}
-
-    # Move `lib64` to `lib` and symlink `lib64`
-    mv $installDir/lib64 lib
-    ln -s lib/ lib64
-
-    # Fixup the symlinks for libsgx_urts.so.* -> libsgx_urts.so
-    for file in lib/libsgx_urts.so.*; do
-      ln -srf lib/libsgx_urts.so $file
-    done
-
-    mv $installDir/include/ .
-
-    mkdir -p share/
-    mv $installDir/{SampleCode,licenses} share/
-
-    mkdir -p share/bin
-    mv $installDir/{environment,buildenv.mk} share/bin/
-    ln -s share/bin/{environment,buildenv.mk} .
-
-    # pkgconfig should go to lib/
-    mv $installDir/pkgconfig lib/
-    ln -s lib/pkgconfig/ .
-
-    # Also create the `sdk_libs` for compat. All the files
-    # link to libraries in `lib64/`, we shouldn't link the entire
-    # directory, however, as there seems to be some ambiguity between
-    # SDK and PSW libraries.
-    mkdir sdk_libs/
-    for file in $installDir/sdk_libs/*; do
-      ln -sr lib/$(basename $file) sdk_libs/
-      rm $file
-    done
-    rmdir $installDir/sdk_libs
-
-    # No uninstall script required
-    rm $installDir/uninstall.sh
-
-    # Create an `sgxsdk` symlink which points to `$out` for compat
-    ln -sr . sgxsdk
-
-    # Make sure we didn't forget any files
-    rmdir $installDir || (echo "Error: The directory $installDir still contains unhandled files: $(ls -A $installDir)" >&2 && exit 1)
-
-    popd
-
-    runHook postInstall
-  '';
-
-  preFixup = ''
-    echo "Strip sgxsdk prefix"
-    for path in "$out/share/bin/environment" "$out/bin/sgx-gdb"; do
-      substituteInPlace $path --replace "$TMPDIR/sgxsdk" "$out"
-    done
-
-    echo "Fixing pkg-config files"
-    sed -i "s|prefix=.*|prefix=$out|g" $out/lib/pkgconfig/*.pc
-
-    echo "Fixing SGX_SDK default in samples"
-    substituteInPlace $out/share/SampleCode/LocalAttestation/buildenv.mk \
-      --replace '/opt/intel/sgxsdk' "$out"
-    for file in $out/share/SampleCode/*/Makefile; do
-      substituteInPlace $file \
-        --replace '/opt/intel/sgxsdk' "$out"
-    done
-
-    echo "Fixing BINUTILS_DIR in buildenv.mk"
-    substituteInPlace $out/share/bin/buildenv.mk \
-      --replace 'BINUTILS_DIR ?= /usr/local/bin' \
-                'BINUTILS_DIR ?= ${finalAttrs.env.BINUTILS_DIR}'
-
-    echo "Fixing GDB path in bin/sgx-gdb"
-    substituteInPlace $out/bin/sgx-gdb --replace '/usr/local/bin/gdb' '${gdb}/bin/gdb'
-  '';
-
-  doInstallCheck = true;
-
-  installCheckPhase = ''
-    runHook preInstallCheck
-
-    # Make sure all symlinks are valid
-    output=$(find "$out" -type l -exec test ! -e {} \; -print)
-    if [[ -n "$output" ]]; then
-      echo "Broken symlinks:"
-      echo "$output"
-      exit 1
-    fi
-
-    runHook postInstallCheck
-  '';
-
-  setupHook = writeText "setup-hook.sh" ''
-    sgxsdk() {
-        export SGX_SDK=@out@
-    }
-
-    postHooks+=(sgxsdk)
-  '';
-
-  passthru.tests = callPackage ../samples { sgxMode = "SIM"; };
-
-  # Run tests in SGX hardware mode on an SGX-enabled machine
-  # $(nix-build -A sgx-sdk.runTestsHW)/bin/run-tests-hw
-  passthru.runTestsHW =
-    let
-      testsHW = lib.filterAttrs (_: v: v ? "name") (callPackage ../samples { sgxMode = "HW"; });
-      testsHWLinked = linkFarmFromDrvs "sgx-samples-hw-bundle" (lib.attrValues testsHW);
-    in
-    writeShellApplication {
-      name = "run-tests-hw";
-      text = ''
-        for test in ${testsHWLinked}/*; do
-          printf '*** Running test %s ***\n\n' "$(basename "$test")"
-          printf 'a\n' | "$test/bin/app"
-          printf '\n'
-        done
-      '';
-    };
-
-  meta = {
-    description = "Intel SGX SDK for Linux built with IPP Crypto Library";
-    homepage = "https://github.com/intel/linux-sgx";
-    maintainers = with lib.maintainers; [
-      phlip9
-      sbellem
-      arturcygan
-      veehaitch
-    ];
-    platforms = [ "x86_64-linux" ];
-    license = [ lib.licenses.bsd3 ];
-  };
-})
@@ -1,28 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 73502a7..f24bd11 100644
--- a/Makefile
-+++ b/Makefile
-@@ -50,18 +50,18 @@ tips:
- preparation:
- # As SDK build needs to clone and patch openmp, we cannot support the mode that download the source from github as zip.
- # Only enable the download from git
-	git submodule update --init --recursive
-	./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild
-+	# git submodule update --init --recursive
-+	# ./external/dcap_source/QuoteVerification/prepare_sgxssl.sh nobuild
- 	cd external/openmp/openmp_code && git apply ../0001-Enable-OpenMP-in-SGX.patch >/dev/null 2>&1 ||  git apply ../0001-Enable-OpenMP-in-SGX.patch --check -R
- 	cd external/protobuf/protobuf_code && git apply ../sgx_protobuf.patch >/dev/null 2>&1 ||  git apply ../sgx_protobuf.patch --check -R
-	cd external/protobuf/protobuf_code && git submodule update --init --recursive && cd third_party/abseil-cpp && git apply ../../../sgx_abseil.patch>/dev/null 2>&1 || git apply ../../../sgx_abseil.patch --check -R
-+	cd external/protobuf/protobuf_code && cd third_party/abseil-cpp && git apply ../../../sgx_abseil.patch>/dev/null 2>&1 || git apply ../../../sgx_abseil.patch --check -R
- 	./external/sgx-emm/create_symlink.sh
- 	cd external/mbedtls/mbedtls_code && git apply ../sgx_mbedtls.patch >/dev/null 2>&1 || git apply ../sgx_mbedtls.patch --check -R
- 	cd external/cbor && cp -r libcbor sgx_libcbor
- 	cd external/cbor/libcbor && git apply ../raw_cbor.patch >/dev/null 2>&1 || git apply ../raw_cbor.patch --check -R
- 	cd external/cbor/sgx_libcbor && git apply ../sgx_cbor.patch >/dev/null 2>&1 || git apply ../sgx_cbor.patch --check -R
-	./download_prebuilt.sh
-	./external/dcap_source/QuoteGeneration/download_prebuilt.sh
-+	# ./download_prebuilt.sh
-+	# ./external/dcap_source/QuoteGeneration/download_prebuilt.sh
- 
- psw:
- 	$(MAKE) -C psw/ USE_OPT_LIBS=$(USE_OPT_LIBS)
@@ -1,40 +0,0 @@
-{
-  stdenv,
-  fetchFromGitHub,
-  cmake,
-  nasm,
-  openssl,
-  python3,
-  extraCmakeFlags ? [ ],
-}:
-stdenv.mkDerivation rec {
-  pname = "ipp-crypto";
-  version = "2021.11.1";
-
-  src = fetchFromGitHub {
-    owner = "intel";
-    repo = "ipp-crypto";
-    rev = "ippcp_${version}";
-    hash = "sha256-OgNrrPE8jFVD/hcv7A43Bno96r4Z/lb7/SE6TEL7RDI=";
-  };
-
-  cmakeFlags = [
-    "-DARCH=intel64"
-    # sgx-sdk now requires FIPS-compliance mode turned on
-    "-DIPPCP_FIPS_MODE=on"
-  ]
-  ++ extraCmakeFlags;
-
-  # Yes, it seems bad for a cryptography library to trigger this
-  # warning. We previously pinned an EOL GCC which avoided it, but this
-  # issue is present regardless of whether we use a compiler that flags
-  # it up or not; upstream just doesn’t test with modern compilers.
-  env.NIX_CFLAGS_COMPILE = "-Wno-error=stringop-overflow";
-
-  nativeBuildInputs = [
-    cmake
-    nasm
-    openssl
-    python3
-  ];
-}
@@ -5392,7 +5392,8 @@
      ];
    "saunum" =
      ps: with ps; [
-      ]; # missing inputs: pysaunum
+        pysaunum
+      ];
    "scene" =
      ps: with ps; [
      ];
@@ -8013,6 +8014,7 @@
    "samsungtv"
    "sanix"
    "satel_integra"
+    "saunum"
    "scene"
    "schedule"
    "schlage"
@@ -1771,6 +1771,8 @@ mapAliases {
  serverless = throw "'serverless' has been removed because version 3.x is unmaintained upstream and vulnerable, and version 4.x lacks a suitable binary or source download."; # Added 2025-11-22
  session-desktop-appimage = throw "'session-desktop-appimage' has been renamed to/replaced by 'session-desktop'"; # Converted to throw 2025-10-27
  sexp = throw "'sexp' has been renamed to/replaced by 'sexpp'"; # Converted to throw 2025-10-27
+  sgx-sdk = throw "'sgx-sdk' has been removed as it was unmaintained and broken"; # Added 2026-02-20
+  sgx-ssl = throw "'sgx-ssl' has been removed as it was unmaintained and broken"; # Added 2026-02-20
  shadered = throw "shadered has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-01
  shades-of-gray-theme = throw "'shades-of-gray-theme' has been removed because upstream is a 404"; # Added 2025-12-20
  shared_desktop_ontologies = throw "'shared_desktop_ontologies' has been removed as it had been abandoned upstream"; # Added 2025-11-09
@@ -2520,32 +2520,6 @@ with pkgs;
    withXorg = false;
  };

-  grub2 = callPackage ../tools/misc/grub/default.nix { };
-
-  grub2_efi = grub2.override {
-    efiSupport = true;
-  };
-
-  grub2_ieee1275 = grub2.override {
-    ieee1275Support = true;
-  };
-
-  grub2_light = grub2.override {
-    zfsSupport = false;
-  };
-
-  grub2_xen = grub2.override {
-    xenSupport = true;
-  };
-
-  grub2_xen_pvh = grub2.override {
-    xenPvhSupport = true;
-  };
-
-  grub2_pvgrub_image = grub2_pvhgrub_image.override {
-    grubPlatform = "xen";
-  };
-
  gruut = with python3.pkgs; toPythonApplication gruut;

  gruut-ipa = with python3.pkgs; toPythonApplication gruut-ipa;
@@ -8794,12 +8768,8 @@ with pkgs;

  rfkill_udev = callPackage ../os-specific/linux/rfkill/udev.nix { };

-  sgx-sdk = callPackage ../os-specific/linux/sgx/sdk {
-    ocamlPackages = ocaml-ng.ocamlPackages_5_3;
-  };
-
  sgx-psw = callPackage ../os-specific/linux/sgx/psw {
-    protobuf = protobuf_21;
+    protobuf = protobuf_33;
  };

  sinit = callPackage ../os-specific/linux/sinit {
@@ -11823,6 +11823,8 @@ self: super: with self; {

  orbax-checkpoint = callPackage ../development/python-modules/orbax-checkpoint { };

+  orbax-export = callPackage ../development/python-modules/orbax-export { };
+
  ordered-set = callPackage ../development/python-modules/ordered-set { };

  orderedmultidict = callPackage ../development/python-modules/orderedmultidict { };
@@ -14839,6 +14841,8 @@ self: super: with self; {

  pysatochip = callPackage ../development/python-modules/pysatochip { };

+  pysaunum = callPackage ../development/python-modules/pysaunum { };
+
  pysbd = callPackage ../development/python-modules/pysbd { };

  pysc2 = callPackage ../development/python-modules/pysc2 { };