Merge master into staging-next

2025-06-02 12:06:59 +00:00
parent c925278913 0238456546
commit bb90e78db3
124 changed files with 3849 additions and 3731 deletions
@@ -44,5 +44,11 @@ jobs:

      - uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31

+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
+        with:
+          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
+          name: nixpkgs-ci
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+
      - name: Build shell
        run: nix-build untrusted/ci -A shell
@@ -32,6 +32,12 @@ jobs:
        with:
          extra_nix_config: sandbox = true

+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
+        with:
+          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
+          name: nixpkgs-ci
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+
      - name: Building Nixpkgs lib-tests
        run: |
          nix-build untrusted/ci -A lib-tests
@@ -15,12 +15,9 @@

 # CI
 /.github/*_TEMPLATE*                    @SigmaSquadron
-/.github/actions                        @NixOS/Security @Mic92 @zowoq @infinisil @azuwis @wolfgangwalther
-/.github/workflows                      @NixOS/Security @Mic92 @zowoq @infinisil @azuwis @wolfgangwalther
-/.github/workflows/check-format.yml     @infinisil @wolfgangwalther
-/.github/workflows/codeowners-v2.yml    @infinisil @wolfgangwalther
-/.github/workflows/nixpkgs-vet.yml      @infinisil @philiptaron @wolfgangwalther
-/ci                                     @infinisil @philiptaron @NixOS/Security @wolfgangwalther
+/.github/actions                        @NixOS/Security @Mic92 @zowoq @infinisil @azuwis @wolfgangwalther @philiptaron
+/.github/workflows                      @NixOS/Security @Mic92 @zowoq @infinisil @azuwis @wolfgangwalther @philiptaron
+/ci                                     @NixOS/Security @Mic92 @zowoq @infinisil @azuwis @wolfgangwalther @philiptaron
 /ci/OWNERS                              @infinisil @philiptaron

 # Development support
@@ -28,6 +28,10 @@
  - Applications linked against different Mesa versions than installed on the system should now work correctly going forward (however, applications against older Mesa, e.g. from Nixpkgs releases before 25.05, remain broken)
  - Packages that used to depend on Mesa for libgbm or libdri should use `libgbm` or `dri-pkgconfig-stub` as inputs, respectively

+- GNU Taler has been updated to version 1.0.
+  This marks a significant milestone as the GNU Taler payment system is now available in Swiss Francs for individuals and businesses in Switzerland.
+  For more details, see the [upstream release notes](https://www.taler.net/en/news/2025-01.html).
+
 - OpenSSH has been updated from 9.9p2 to 10.0p2, dropping support for DSA keys and adding a new `ssh-auth` binary to handle user authentication in a different address space from unauthenticated sessions. See the [full changelog](https://www.openwall.com/lists/oss-security/2025/04/09/1) for more details.

 - Emacs has been updated to 30.1.
@@ -54,7 +54,7 @@ let

  missingGithubIds = lib.concatLists (lib.mapAttrsToList checkMaintainer lib.maintainers);

-  success = pkgs.runCommand "checked-maintainers-success" { } ">$out";
+  success = pkgs.runCommand "checked-maintainers-success" { } "mkdir $out";

  failure =
    pkgs.runCommand "checked-maintainers-failure"
@@ -28,5 +28,14 @@ let
 in
 pkgsBB.symlinkJoin {
  name = "nixpkgs-lib-tests";
-  paths = map testWithNix nixVersions;
+  paths = map testWithNix nixVersions ++ [
+    (import ./maintainers.nix {
+      inherit pkgs;
+      lib = import ../.;
+    })
+    (import ./teams.nix {
+      inherit pkgs;
+      lib = import ../.;
+    })
+  ];
 }
@@ -19,14 +19,6 @@ pkgs.runCommand "nixpkgs-lib-tests-nix-${nix.version}"
    buildInputs = [
      (import ./check-eval.nix)
      (import ./fetchers.nix)
-      (import ./maintainers.nix {
-        inherit pkgs;
-        lib = import ../.;
-      })
-      (import ./teams.nix {
-        inherit pkgs;
-        lib = import ../.;
-      })
      (import ../path/tests {
        inherit pkgs;
      })
@@ -2644,6 +2644,12 @@
    githubId = 9315;
    name = "Zhong Jianxin";
  };
+  b-m-f = {
+    email = "maximilian@sodawa.com";
+    github = "b-m-f";
+    githubId = 2843450;
+    name = "Maximilian Ehlers";
+  };
  b-rodrigues = {
    email = "bruno@brodrigues.co";
    github = "b-rodrigues";
@@ -15567,6 +15573,12 @@
    name = "Max Niederman";
    keys = [ { fingerprint = "1DE4 424D BF77 1192 5DC4  CF5E 9AED 8814 81D8 444E"; } ];
  };
+  max06 = {
+    email = "max06.net@outlook.com";
+    github = "max06";
+    githubId = 7556827;
+    name = "Flo";
+  };
  maxbrunet = {
    email = "max@brnt.mx";
    github = "maxbrunet";
@@ -18099,8 +18111,10 @@
    github = "numinit";
    githubId = 369111;
    keys = [
-      # >=2025
+      # >=2025, stays in one place
      { fingerprint = "FD28 F9C9 81C5 D78E 56E8  8311 5C3E B94D 198F 1491"; }
+      # >=2025, travels with me
+      { fingerprint = "C48F 475F 30A9 B192 3213  D5D5 C6E2 4809 77B2 F2F4"; }
      # <=2024
      { fingerprint = "190B DA97 F616 DE35 6899  ED17 F819 F1AF 2FC1 C1FF"; }
    ];
@@ -59,5 +59,5 @@ in
    ];
  };

-  meta.maintainers = with lib.maintainers; [ blackheaven ];
+  meta.maintainers = with lib.maintainers; [ gdifolco ];
 }
@@ -35,6 +35,7 @@ libeufinComponent:
          cfg.settings."libeufin-${libeufinComponent}db-postgres".CONFIG;

      bankPort = cfg.settings."${if isNexus then "nexus-httpd" else "libeufin-bank"}".PORT;
+      bankHost = lib.elemAt (lib.splitString "/" cfg.settings.libeufin-bank.BASE_URL) 2;
    in
    lib.mkIf cfg.enable {
      services.libeufin.settings = cfg.settings;
@@ -82,7 +83,7 @@ libeufinComponent:
                args = lib.cli.toGNUCommandLineShell { } {
                  c = configFile;
                  inherit (account) username password name;
-                  payto_uri = "payto://x-taler-bank/bank:${toString bankPort}/${account.username}?receiver-name=${account.name}";
+                  payto_uri = "payto://x-taler-bank/${bankHost}/${account.username}?receiver-name=${account.name}";
                  exchange = lib.toLower account.username == "exchange";
                };
              in
@@ -51,7 +51,7 @@ in
      (lib.genAttrs (map (n: "taler-${talerComponent}-${n}") services) (name: {
        serviceConfig = {
          DynamicUser = true;
-          User = name;
+          User = dbName;
          Group = groupName;
          ExecStart = toString [
            (lib.getExe' cfg.package name)
@@ -85,6 +85,7 @@ in
            Type = "oneshot";
            DynamicUser = true;
            User = dbName;
+            Group = groupName;
            Restart = "on-failure";
            RestartSec = "5s";
          };
@@ -116,7 +117,7 @@ in
    services.postgresql = {
      enable = true;
      ensureDatabases = [ dbName ];
-      ensureUsers = map (service: { name = "taler-${talerComponent}-${service}"; }) servicesDB ++ [
+      ensureUsers = [
        {
          name = dbName;
          ensureDBOwnership = true;
@@ -25,6 +25,8 @@ let
    "secmod-eddsa"
    "secmod-rsa"
  ];
+
+  configFile = config.environment.etc."taler/taler.conf".source;
 in

 {
@@ -44,11 +46,19 @@ in
        options = {
          # TODO: do we want this to be a sub-attribute or only define the exchange set of options here
          exchange = {
-            AML_THRESHOLD = lib.mkOption {
+            CURRENCY = lib.mkOption {
+              type = lib.types.nonEmptyStr;
+              description = ''
+                The currency which the exchange will operate with. This cannot be changed later.
+              '';
+            };
+            CURRENCY_ROUND_UNIT = lib.mkOption {
              type = lib.types.str;
-              default = "${cfgTaler.settings.taler.CURRENCY}:1000000";
-              defaultText = "1000000 in {option}`CURRENCY`";
-              description = "Monthly transaction volume until an account is considered suspicious and flagged for AML review.";
+              default = "${cfg.settings.exchange.CURRENCY}:0.01";
+              defaultText = "0.01 in {option}`CURRENCY`";
+              description = ''
+                Smallest amount in this currency that can be transferred using the underlying RTGS. For example: "EUR:0.01" or "JPY:1"
+              '';
            };
            DB = lib.mkOption {
              type = lib.types.enum [ "postgres" ];
@@ -131,24 +141,8 @@ in
      after = [ "taler-exchange-httpd.service" ];
    };

-    # Taken from https://docs.taler.net/taler-exchange-manual.html#exchange-database-setup
-    # TODO: Why does aggregator need DELETE?
-    systemd.services."taler-${talerComponent}-dbinit".script =
-      let
-        deletePerm = name: lib.optionalString (name == "aggregator") ",DELETE";
-        dbScript = pkgs.writers.writeText "taler-exchange-db-permissions.sql" (
-          lib.pipe servicesDB [
-            (map (name: ''
-              GRANT SELECT,INSERT,UPDATE${deletePerm name} ON ALL TABLES IN SCHEMA exchange TO "taler-exchange-${name}";
-              GRANT USAGE ON SCHEMA exchange TO "taler-exchange-${name}";
-            ''))
-            lib.concatStrings
-          ]
-        );
-      in
-      ''
-        ${lib.getExe' cfg.package "taler-exchange-dbinit"}
-        psql -U taler-exchange-httpd -f ${dbScript}
-      '';
+    systemd.services."taler-${talerComponent}-dbinit".script = ''
+      ${lib.getExe' cfg.package "taler-exchange-dbinit"} -c ${configFile}
+    '';
  };
 }
@@ -17,8 +17,10 @@ let
    "webhook"
    "wirewatch"
    "depositcheck"
-    "exchange"
+    "exchangekeyupdate"
  ];
+
+  configFile = config.environment.etc."taler/taler.conf".source;
 in
 {
  imports = [
@@ -88,21 +90,8 @@ in
      path = [ cfg.package ];
    };

-    systemd.services."taler-${talerComponent}-dbinit".script =
-      let
-        # NOTE: not documented, but is necessary
-        dbScript = pkgs.writers.writeText "taler-merchant-db-permissions.sql" (
-          lib.concatStrings (
-            map (name: ''
-              GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA merchant TO "taler-merchant-${name}";
-              GRANT USAGE ON SCHEMA merchant TO "taler-merchant-${name}";
-            '') servicesDB
-          )
-        );
-      in
-      ''
-        ${lib.getExe' cfg.package "taler-merchant-dbinit"}
-        psql -U taler-${talerComponent}-httpd -f ${dbScript}
-      '';
+    systemd.services."taler-${talerComponent}-dbinit".script = ''
+      ${lib.getExe' cfg.package "taler-merchant-dbinit"} -c ${configFile}
+    '';
  };
 }
@@ -32,6 +32,10 @@ let
        restricted-rpc=1
      ''}

+      ${lib.optionalString (banlist != null) ''
+        ban-list=${banlist}
+      ''}
+
      limit-rate-up=${toString limits.upload}
      limit-rate-down=${toString limits.download}
      max-concurrency=${toString limits.threads}
@@ -64,6 +68,23 @@ in
        '';
      };

+      banlist = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        description = ''
+          Path to a text file containing IPs to block.
+          Useful to prevent DDoS/deanonymization attacks.
+
+          https://github.com/monero-project/meta/issues/1124
+        '';
+        example = lib.literalExpression ''
+          builtins.fetchurl {
+            url = "https://raw.githubusercontent.com/rblaine95/monero-banlist/c6eb9413ddc777e7072d822f49923df0b2a94d88/block.txt";
+            hash = "";
+          };
+        '';
+      };
+
      mining.enable = lib.mkOption {
        type = lib.types.bool;
        default = false;
@@ -225,7 +246,7 @@ in
      serviceConfig = {
        User = "monero";
        Group = "monero";
-        ExecStart = "${pkgs.monero-cli}/bin/monerod --config-file=${configFile} --non-interactive";
+        ExecStart = "${lib.getExe' pkgs.monero-cli "monerod"} --config-file=${configFile} --non-interactive";
        Restart = "always";
        SuccessExitStatus = [
          0
@@ -529,6 +529,7 @@ in
  ft2-clone = runTest ./ft2-clone.nix;
  legit = runTest ./legit.nix;
  mimir = runTest ./mimir.nix;
+  galene = discoverTests (import ./galene.nix);
  gancio = runTest ./gancio.nix;
  garage = handleTest ./garage { };
  gatus = runTest ./gatus.nix;
@@ -0,0 +1,211 @@
+let
+  makeTest = import ./make-test-python.nix;
+  galeneTestGroupsDir = "/var/lib/galene/groups";
+  galeneTestGroupFile = "galene-test-config.json";
+  galenePort = 8443;
+  galeneTestGroupAdminName = "admin";
+  galeneTestGroupAdminPassword = "1234";
+in
+{
+  basic = makeTest (
+    { pkgs, lib, ... }:
+    {
+      name = "galene-works";
+      meta = {
+        inherit (pkgs.galene.meta) maintainers;
+        platforms = lib.platforms.linux;
+      };
+
+      nodes.machine =
+        { config, pkgs, ... }:
+        {
+          imports = [ ./common/x11.nix ];
+
+          services.xserver.enable = true;
+
+          environment = {
+            # https://galene.org/INSTALL.html
+            etc.${galeneTestGroupFile}.source = (pkgs.formats.json { }).generate galeneTestGroupFile {
+              op = [
+                {
+                  username = galeneTestGroupAdminName;
+                  password = galeneTestGroupAdminPassword;
+                }
+              ];
+              other = [ { } ];
+            };
+
+            systemPackages = with pkgs; [
+              firefox
+            ];
+          };
+
+          services.galene = {
+            enable = true;
+            insecure = true;
+            httpPort = galenePort;
+            groupsDir = galeneTestGroupsDir;
+          };
+        };
+
+      enableOCR = true;
+
+      testScript = ''
+        machine.wait_for_x()
+
+        with subtest("galene starts"):
+            # Starts?
+            machine.wait_for_unit("galene")
+
+            # Keeps running after startup?
+            machine.sleep(10)
+            machine.wait_for_unit("galene")
+
+            # Reponds fine?
+            machine.succeed("curl -s -D - -o /dev/null 'http://localhost:${builtins.toString galenePort}' >&2")
+
+        machine.succeed("cp -v /etc/${galeneTestGroupFile} ${galeneTestGroupsDir}/test.json >&2")
+        machine.wait_until_succeeds("curl -s -D - -o /dev/null 'http://localhost:${builtins.toString galenePort}/group/test/' >&2")
+
+        with subtest("galene can join group"):
+            # Open site
+            machine.succeed("firefox --new-window 'http://localhost:${builtins.toString galenePort}/group/test/' >&2 &")
+            # Note: Firefox doesn't use a regular "-" in the window title, but "—" (Hex: 0xe2 0x80 0x94)
+            machine.wait_for_window("Test — Mozilla Firefox")
+            machine.send_key("ctrl-minus")
+            machine.send_key("ctrl-minus")
+            machine.send_key("alt-f10")
+            machine.wait_for_text(r"(Galène|Username|Password|Connect)")
+            machine.screenshot("galene-group-test-join")
+
+            # Log in as admin
+            machine.send_chars("${galeneTestGroupAdminName}")
+            machine.send_key("tab")
+            machine.send_chars("${galeneTestGroupAdminPassword}")
+            machine.send_key("ret")
+            machine.sleep(5)
+            # Close "Remember credentials?" FF prompt
+            machine.send_key("esc")
+            machine.sleep(5)
+            machine.wait_for_text(r"(Enable|Share|Screen)")
+            machine.screenshot("galene-group-test-logged-in")
+      '';
+    }
+  );
+
+  file-transfer = makeTest (
+    { pkgs, lib, ... }:
+    {
+      name = "galene-file-transfer-works";
+      meta = {
+        inherit (pkgs.galene-file-transfer.meta) maintainers;
+        platforms = lib.platforms.linux;
+      };
+
+      nodes.machine =
+        { config, pkgs, ... }:
+        {
+          imports = [ ./common/x11.nix ];
+
+          services.xserver.enable = true;
+
+          environment = {
+            # https://galene.org/INSTALL.html
+            etc.${galeneTestGroupFile}.source = (pkgs.formats.json { }).generate galeneTestGroupFile {
+              op = [
+                {
+                  username = galeneTestGroupAdminName;
+                  password = galeneTestGroupAdminPassword;
+                }
+              ];
+              other = [ { } ];
+            };
+
+            systemPackages = with pkgs; [
+              firefox
+              galene-file-transfer
+            ];
+          };
+
+          services.galene = {
+            enable = true;
+            insecure = true;
+            httpPort = galenePort;
+            groupsDir = galeneTestGroupsDir;
+          };
+        };
+
+      enableOCR = true;
+
+      testScript = ''
+        machine.wait_for_x()
+
+        with subtest("galene starts"):
+            # Starts?
+            machine.wait_for_unit("galene")
+
+            # Keeps running after startup?
+            machine.sleep(10)
+            machine.wait_for_unit("galene")
+
+            # Reponds fine?
+            machine.succeed("curl -s -D - -o /dev/null 'http://localhost:${builtins.toString galenePort}' >&2")
+
+        machine.succeed("cp -v /etc/${galeneTestGroupFile} ${galeneTestGroupsDir}/test.json >&2")
+        machine.wait_until_succeeds("curl -s -D - -o /dev/null 'http://localhost:${builtins.toString galenePort}/group/test/' >&2")
+
+        with subtest("galene can join group"):
+            # Open site
+            machine.succeed("firefox --new-window 'http://localhost:${builtins.toString galenePort}/group/test/' >&2 &")
+            # Note: Firefox doesn't use a regular "-" in the window title, but "—" (Hex: 0xe2 0x80 0x94)
+            machine.wait_for_window("Test — Mozilla Firefox")
+            machine.send_key("ctrl-minus")
+            machine.send_key("ctrl-minus")
+            machine.send_key("alt-f10")
+            machine.wait_for_text(r"(Galène|Username|Password|Connect)")
+            machine.screenshot("galene-group-test-join")
+
+            # Log in as admin
+            machine.send_chars("${galeneTestGroupAdminName}")
+            machine.send_key("tab")
+            machine.send_chars("${galeneTestGroupAdminPassword}")
+            machine.send_key("ret")
+            machine.sleep(5)
+            # Close "Remember credentials?" FF prompt
+            machine.send_key("esc")
+            machine.sleep(5)
+            machine.wait_for_text(r"(Enable|Share|Screen)")
+            machine.screenshot("galene-group-test-logged-in")
+
+        with subtest("galene-file-transfer works"):
+            machine.succeed(
+                "galene-file-transfer "
+                + "-to '${galeneTestGroupAdminName}' "
+                + "-insecure 'http://localhost:${builtins.toString galenePort}/group/test/' "
+                + "${galeneTestGroupsDir}/test.json " # just try sending the groups file
+                + " >&2 &"
+            )
+            machine.sleep(5) # Give pop-up some time to appear
+            machine.wait_for_text(r"(offered to send us a file|Accept|Reject|disclose your IP)")
+            machine.screenshot("galene-file-transfer-dislogue")
+
+            # Focus on Accept button
+            machine.send_key("shift-tab")
+            machine.send_key("shift-tab")
+            machine.send_key("shift-tab")
+            machine.send_key("shift-tab")
+
+            # Accept download
+            machine.sleep(2)
+            machine.send_key("ret")
+
+            # Wait until complete & matching
+            machine.wait_until_succeeds(
+                "diff "
+                + "${galeneTestGroupsDir}/test.json " # original
+                + "/root/Downloads/test.json" # Received via file-transfer
+            )
+      '';
+    }
+  );
+}
@@ -55,14 +55,22 @@ rec {
            settings = {
              taler.CURRENCY = CURRENCY;
            };
-            includes = [ ../conf/taler-accounts.conf ];
+            includes = [
+              ../conf/taler-accounts.conf
+              # The exchange requires a token from the bank, so its credentials
+              # need to be set at runtime
+              "/etc/taler/secrets/exchange-account.secret.conf"
+            ];
            exchange = {
              enable = true;
              debug = true;
              openFirewall = true;
+              # https://docs.taler.net/taler-exchange-manual.html#coins-denomination-keys
+              # NOTE: use `taler-harness`, not `taler-wallet-cli`
              denominationConfig = lib.readFile ../conf/taler-denominations.conf;
              settings = {
                exchange = {
+                  inherit CURRENCY;
                  MASTER_PUBLIC_KEY = "2TQSTPFZBC2MC4E52NHPA050YXYG02VC3AB50QESM6JX1QJEYVQ0";
                  BASE_URL = "http://exchange:8081/";
                };
@@ -103,7 +111,7 @@ rec {
                # WIRE_TYPE = "iban";
                X_TALER_BANK_PAYTO_HOSTNAME = "bank:8082";
                # IBAN_PAYTO_BIC = "SANDBOXX";
-                BASE_URL = "bank:8082";
+                BASE_URL = "http://bank:8082/";

                # Allow creating new accounts
                ALLOW_REGISTRATION = "yes";
@@ -7,7 +7,7 @@

 let
  cfgNodes = pkgs.callPackage ./nodes.nix { inherit lib; };
-  bankConfig = nodes.bank.config.environment.etc."libeufin/libeufin.conf".source;
+  bankConfig = nodes.bank.environment.etc."libeufin/libeufin.conf".source;

  inherit (cfgNodes) CURRENCY FIAT_CURRENCY;
 in
@@ -68,6 +68,31 @@ in
              + command
          )

+      # https://docs.taler.net/core/api-corebank.html#authentication
+      def create_token(machine, username, password):
+          """Create a read-write bank access token for a user"""
+          response = succeed(machine, [
+              "curl -X POST",
+              f"-u {username}:{password}",
+              "-H 'Content-Type: application/json'",
+              """
+              --data '{ "scope": "readwrite" }'
+              """,
+              f"-sSfL 'http://bank:8082/accounts/{username}/token'"
+          ])
+          return json.loads(response)["access_token"]
+
+
+      # Basic auth is deprecated, so exchange credentials must be set at
+      # runtime because it requires a token from the bank.
+      def create_exchange_auth(token: str):
+          template = f"""
+          [exchange-accountcredentials-test]
+          WIRE_GATEWAY_URL = http://bank:8082/accounts/exchange/taler-wire-gateway/
+          WIRE_GATEWAY_AUTH_METHOD = BEARER
+          TOKEN = "{token}"
+          """
+          return "\n".join([line.strip() for line in template.splitlines()])

      def verify_balance(balanceWanted: str):
          """Compare Taler CLI wallet balance with expected amount"""
@@ -84,14 +109,14 @@ in
              client.succeed(f"echo Withdraw successfully made. New balance: {balanceWanted}")


-      def verify_conversion(regionalWanted: str):
+      def verify_conversion(regionalWanted: str, accessToken: str):
          """Compare converted Libeufin Nexus funds with expected regional currency"""
          # Get transaction details
          response = json.loads(
              succeed(bank, [
                  "curl -sSfL",
+                  f"-H 'Authorization: Bearer {accessToken}'",
                  # TODO: get exchange from config?
-                  "-u exchange:exchange",
                  "http://bank:8082/accounts/exchange/transactions"
              ])
          )
@@ -2,9 +2,3 @@
 PAYTO_URI = payto://x-taler-bank/bank:8082/exchange?receiver-name=Exchange
 ENABLE_DEBIT = YES
 ENABLE_CREDIT = YES
-
-[exchange-accountcredentials-test]
-WIRE_GATEWAY_URL = http://bank:8082/accounts/exchange/taler-wire-gateway/
-WIRE_GATEWAY_AUTH_METHOD = BASIC
-USERNAME = exchange
-PASSWORD = exchange
@@ -35,13 +35,14 @@ import ../../make-test-python.nix (
        inherit (cfgNodes) CURRENCY FIAT_CURRENCY;
        inherit (cfgScripts) commonScripts;

-        bankConfig = nodes.bank.config.environment.etc."libeufin/libeufin.conf".source;
+        configFile = nodes.exchange.environment.etc."taler/taler.conf".source;
+        bankConfig = nodes.bank.environment.etc."libeufin/libeufin.conf".source;
        bankSettings = nodes.bank.services.libeufin.settings.libeufin-bank;
        nexusSettings = nodes.bank.services.libeufin.nexus.settings;

        # Bank admin account credentials
        AUSER = "admin";
-        APASS = "admin";
+        APASS = "testAdmin";

        TUSER = "testUser";
        TPASS = "testUser";
@@ -76,17 +77,28 @@ import ../../make-test-python.nix (


        exchange.start()
+
+        # exchange credentials must be set at runtime because it requires a token from the bank
+        exchange.succeed("mkdir -p /etc/taler/secrets/")
+        exchange.succeed("touch /etc/taler/secrets/exchange-account.secret.conf")
+
        exchange.wait_for_open_port(8081)

+        # Create access token for exchange
+        accessTokenExchange = create_token(exchange, "exchange", "exchange")
+
+        exchange.succeed(f'echo "{create_exchange_auth(accessTokenExchange)}" > /etc/taler/secrets/exchange-account.secret.conf')

        with subtest("Set up exchange"):
-            exchange.wait_until_succeeds("taler-exchange-offline download sign upload")
-            # Enable exchange wire account
-            exchange.succeed('taler-exchange-offline upload < ${exchangeAccount}')
+            # Set up exchange keys
+            exchange.wait_until_succeeds('taler-exchange-offline -c "${configFile}" download sign upload')

-            # NOTE: cannot deposit coins/pay merchant if wire fees are not set up
-            exchange.succeed('taler-exchange-offline wire-fee now x-taler-bank "${CURRENCY}:0" "${CURRENCY}:0" upload')
-            exchange.succeed('taler-exchange-offline global-fee now "${CURRENCY}:0" "${CURRENCY}:0" "${CURRENCY}:0" 1h 6a 0 upload')
+            # Enable exchange wire account
+            exchange.succeed('taler-exchange-offline -c "${configFile}" upload < ${exchangeAccount}')
+
+            # Set up wire fees, needed in order to deposit coins/pay merchant
+            exchange.succeed('taler-exchange-offline -c "${configFile}" wire-fee now x-taler-bank "${CURRENCY}:0.01" "${CURRENCY}:0.01" upload')
+            exchange.succeed('taler-exchange-offline -c "${configFile}" global-fee now "${CURRENCY}:0.01" "${CURRENCY}:0.0" "${CURRENCY}:0" 1h 6a 0 upload')


        # Verify that exchange keys exist
@@ -96,12 +108,14 @@ import ../../make-test-python.nix (
        merchant.start()
        merchant.wait_for_open_port(8083)

+        # Create access token for merchant
+        accessTokenMerchant = create_token(client, "merchant", "merchant")

        with subtest("Set up merchant"):
            # Create default instance (similar to admin)
            succeed(merchant, [
                "curl -X POST",
-                "-H 'Authorization: Bearer secret-token:super_secret'",
+                f"-H 'Authorization: Bearer {accessTokenMerchant}'",
                """
                --data '{
                  "auth": { "method": "external" },
@@ -128,7 +142,7 @@ import ../../make-test-python.nix (
                  "credit_facade_credentials":{"type":"basic","username":"merchant","password":"merchant"}
                }'
                """,
-                "-sSfL 'http://merchant:8083/private/accounts'"
+                "-sSfL 'http://merchant:8083/instances/default/private/accounts'"
            ])
            # Register a new product to be ordered
            succeed(merchant, [
@@ -144,12 +158,14 @@ import ../../make-test-python.nix (
                  "next_restock": { "t_s": "never" }
                }'
                """,
-                "-sSfL 'http://merchant:8083/private/products'"
+                "-sSfL 'http://merchant:8083/instances/default/private/products'"
            ])


        client.succeed("curl -s http://exchange:8081/")

+        # Create access token for user
+        accessTokenUser = create_token(client, "${TUSER}", "${TPASS}")

        # Make a withdrawal from the CLI wallet
        with subtest("Make a withdrawal from the CLI wallet"):
@@ -164,7 +180,7 @@ import ../../make-test-python.nix (
            withdrawal = json.loads(
                succeed(client, [
                    "curl -X POST",
-                    "-u ${TUSER}:${TPASS}",
+                    f"-H 'Authorization: Bearer {accessTokenUser}'",
                    "-H 'Content-Type: application/json'",
                    f"""--data '{{"amount": "{balanceWanted}"}}'""", # double brackets escapes them
                    "-sSfL 'http://bank:8082/accounts/${TUSER}/withdrawals'"
@@ -173,11 +189,16 @@ import ../../make-test-python.nix (

            # Accept & confirm withdrawal
            with subtest("Accept & confirm withdrawal"):
-                wallet_cli(f"withdraw accept-uri {withdrawal["taler_withdraw_uri"]} --exchange http://exchange:8081/")
+                # the withdrawal can only be confirmed if this is executed twice, for some reason
+                for i in range(2):
+                    wallet_cli(f"withdraw accept-uri {withdrawal["taler_withdraw_uri"]} --exchange 'http://exchange:8081/'")
+                    client.sleep(5) # needs some time to process things
+
                succeed(client, [
                    "curl -X POST",
-                    "-u ${TUSER}:${TPASS}",
+                    f"-H 'Authorization: Bearer {accessTokenUser}'",
                    "-H 'Content-Type: application/json'",
+                    f"""--data '{{"amount": "{balanceWanted}"}}'""", # double brackets escapes them
                    f"-sSfL 'http://bank:8082/accounts/${TUSER}/withdrawals/{withdrawal["withdrawal_id"]}/confirm'"
                ])

@@ -188,7 +209,8 @@ import ../../make-test-python.nix (


        with subtest("Pay for an order"):
-            balanceWanted = "${CURRENCY}:9" # after paying
+            # after paying (1 for the order and 0.1 as fee)
+            balanceWanted = "${CURRENCY}:8.9"

            # Create an order to be paid
            response = json.loads(
@@ -201,7 +223,7 @@ import ../../make-test-python.nix (
                      "inventory_products": [{ "product_id": "1", "quantity": 1 }]
                    }'
                    """,
-                    "-sSfL 'http://merchant:8083/private/orders'"
+                    "-sSfL 'http://merchant:8083/instances/default/private/orders'"
                ])
            )
            order_id = response["order_id"]
@@ -211,7 +233,7 @@ import ../../make-test-python.nix (
            response = json.loads(
                succeed(merchant, [
                    "curl -sSfL",
-                    f"http://merchant:8083/private/orders/{order_id}"
+                    f"http://merchant:8083/instances/default/private/orders/{order_id}"
                ])
            )
            wallet_cli("run-until-done")
@@ -231,14 +253,17 @@ import ../../make-test-python.nix (
            with subtest("Libeufin Nexus currency conversion"):
                regionalWanted = "20"

+                # Create access token
+                accessTokenAdmin = create_token(bank, "${AUSER}", "${APASS}")
+
                # Setup Nexus ebics keys
                systemd_run(bank, "libeufin-nexus ebics-setup -L debug -c /etc/libeufin/libeufin.conf", "libeufin-nexus")

                # Set currency conversion rates (1:1)
                succeed(bank, [
                    "curl -X POST",
+                    f"-H 'Authorization: Bearer {accessTokenAdmin}'",
                    "-H 'Content-Type: application/json'",
-                    "-u ${AUSER}:${APASS}",
                    """
                    --data '{
                      "cashin_ratio": "1",
@@ -264,7 +289,7 @@ import ../../make-test-python.nix (
                systemd_run(bank, f"""libeufin-nexus testing fake-incoming -c ${bankConfig} --amount="${FIAT_CURRENCY}:{regionalWanted}" --subject="{reservePub}" "payto://iban/CH4740123RW4167362694" """, "libeufin-nexus")
                wallet_cli("run-until-done")

-                verify_conversion(regionalWanted)
+                verify_conversion(regionalWanted, accessTokenExchange)
      '';
  }
 )
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "bsnes";
-  version = "0-unstable-2025-05-16";
+  version = "0-unstable-2025-05-30";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "bsnes-libretro";
-    rev = "aadae1cd3d8175a6e71525ab122e6b7a949091a7";
-    hash = "sha256-Tf/mJ4B3PuAbfYJCrFoC0sHOQgf+UCwp6jNlSau7XH0=";
+    rev = "c2df3ccaeb8f40852a63a4b66a381d82d4e9b95d";
+    hash = "sha256-bPW4ftbdUXsgAs/CEi5/x4iq1NKvgRmHOpMiNJ2W/Gc=";
  };

  makefile = "Makefile";
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
  core = "flycast";
-  version = "0-unstable-2025-05-22";
+  version = "0-unstable-2025-06-01";

  src = fetchFromGitHub {
    owner = "flyinghead";
    repo = "flycast";
-    rev = "1953eb0eea10f6ddc780bea743ad74c57983b554";
-    hash = "sha256-Y0QmDzML8bSQi1DxFErBptSB31TrXmFGVoTYnd3Ppr0=";
+    rev = "d9ec0cb3ab0ce383f24f86d023e1889b7f37c5c7";
+    hash = "sha256-MwXq+qhba+PNS1e2LS3CduWcdO3Tm0OS8ny1Gq3Zo5s=";
    fetchSubmodules = true;
  };

@@ -163,7 +163,7 @@ stdenv.mkDerivation {
    };
  };

-  meta = with lib; {
+  meta = {
    changelog = "https://www.mozilla.org/en-US/firefox/${version}/releasenotes/";
    description = "Mozilla Firefox, free web browser (binary package)";
    homepage = "https://www.mozilla.org/firefox/";
@@ -188,10 +188,10 @@ stdenv.mkDerivation {
      free = false;
      redistributable = true; # since MPL-2.0 still applies
    };
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
    platforms = builtins.attrNames mozillaPlatforms;
    hydraPlatforms = [ ];
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
      taku0
      lovesegfault
    ];
@@ -106,7 +106,7 @@ stdenv.mkDerivation (finalAttrs: {
    runHook preInstall

    install -Dm555 -t $out/bin b/*/7zz${stdenv.hostPlatform.extensions.executable}
-    install -Dm444 -t $out/share/doc/${finalAttrs.pname} ../../../../DOC/*.txt
+    install -Dm444 -t $out/share/doc/7zz ../../../../DOC/*.txt

    runHook postInstall
  '';
@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  cmake,
+  arpa2cm,
+  quickder,
+  quickmem,
+  quick-sasl,
+  lillydap,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  # leaf is already used
+  pname = "arpa2-leaf";
+  version = "0.2";
+
+  src = fetchFromGitLab {
+    owner = "arpa2";
+    repo = "leaf";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-s52gtxM+BmG7oVrB5F0ORjkb4F3fWONiOxIWdDn2P5k=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    arpa2cm
+    quickder
+    quickmem
+    quick-sasl
+    lillydap
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "LDAP Extended Attribute Filter";
+    homepage = "https://gitlab.com/arpa2/leaf";
+    changelog = "https://gitlab.com/arpa2/leaf/-/blob/v${finalAttrs.version}/CHANGES";
+    license = lib.licenses.bsd2;
+    teams = with lib.teams; [ ngi ];
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    platforms = lib.platforms.linux;
+  };
+})
@@ -11,7 +11,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "2.3.1";

  src = fetchurl {
-    url = "mirror://debian/pool/main/a/as31/${finalAttrs.pname}_${finalAttrs.version}.orig.tar.gz";
+    url = "mirror://debian/pool/main/a/as31/as31_${finalAttrs.version}.orig.tar.gz";
    name = "${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
    hash = "sha256-zSEyWHFon5nyq717Mpmdv1XZ5Hz0e8ZABqsP8M83c1U=";
  };
@@ -33,8 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
-    name = "${finalAttrs.pname}-${finalAttrs.version}";
+    inherit (finalAttrs) pname version src;
    hash = "sha256-ePgEAVYXLOHWQXG92Grb9nmenyGj0JkgVy1UDsQF0xw=";
  };

@@ -10,13 +10,13 @@
  xdg-utils,
 }:

-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
  pname = "avrdudess";
  version = "2.18";

  src = fetchurl {
-    url = "https://github.com/ZakKemble/AVRDUDESS/releases/download/v2.18/AVRDUDESS-2.18-portable.zip";
-    sha256 = "sha256-N93FLiXp1WwhI5KwH6sho2wyFtkbODwCHOpEVbVnYdc=";
+    url = "https://github.com/ZakKemble/AVRDUDESS/releases/download/v${finalAttrs.version}/AVRDUDESS-${finalAttrs.version}-portable.zip";
+    hash = "sha256-N93FLiXp1WwhI5KwH6sho2wyFtkbODwCHOpEVbVnYdc=";
  };

  nativeBuildInputs = [ unzip ];
@@ -25,6 +25,8 @@ stdenv.mkDerivation {
  dontInstall = true;

  buildPhase = ''
+    runHook preBuild
+
    mkdir -p "$out/avrdudess"
    mkdir -p "$out/bin"

@@ -52,15 +54,17 @@ stdenv.mkDerivation {
    __EOF__

    chmod a+x "$out/bin/"*
+
+    runHook postBuild
  '';

-  meta = with lib; {
+  meta = {
    description = "GUI for AVRDUDE (AVR microcontroller programmer)";
    homepage = "https://blog.zakkemble.net/avrdudess-a-gui-for-avrdude/";
-    changelog = "https://github.com/ZakKemble/AVRDUDESS/blob/v${version}/Changelog.txt";
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.bjornfor ];
+    changelog = "https://github.com/ZakKemble/AVRDUDESS/blob/v${finalAttrs.version}/Changelog.txt";
+    license = lib.licenses.gpl3;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.bjornfor ];
    mainProgram = "avrdudess";
  };
-}
+})
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "9.20.9";

  src = fetchurl {
-    url = "https://downloads.isc.org/isc/bind9/${finalAttrs.version}/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
+    url = "https://downloads.isc.org/isc/bind9/${finalAttrs.version}/bind-${finalAttrs.version}.tar.xz";
    hash = "sha256-PSaQDtnJqFkHP/6puX4pLBJI2tGCebF7BfyyPDCR+G0=";
  };

@@ -21,13 +21,13 @@

 stdenv.mkDerivation rec {
  pname = "bpftrace";
-  version = "0.23.3";
+  version = "0.23.4";

  src = fetchFromGitHub {
    owner = "bpftrace";
    repo = "bpftrace";
    rev = "v${version}";
-    hash = "sha256-Jvl8Up3IH2/G0QMb0pZmQ2SSXOmjTj08KXoJXOR3Z48=";
+    hash = "sha256-fJOc5M+DhYjmooDb8p/kZbUOhQX27/6aau7Ff9dgjbs=";
  };

  buildInputs = with llvmPackages; [
@@ -7,17 +7,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-nextest";
-  version = "0.9.95";
+  version = "0.9.97";

  src = fetchFromGitHub {
    owner = "nextest-rs";
    repo = "nextest";
    rev = "cargo-nextest-${version}";
-    hash = "sha256-OtCFehXzcdE8kBUkDg8y5ygTOtH2eP5aMzTpugDSg/E=";
+    hash = "sha256-5UhmWewLj3bjtvqyb6FcC1qZQbAutRPXnBi7e/lyArM=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-nrRq5ET++jplx5argN04Ax+HTE6VqvBhnSsS/ZFNYr8=";
+  cargoHash = "sha256-mTKcQ76A++LK+54ChmCUF/7dsubdz7GZpOZUp+afqfQ=";

  cargoBuildFlags = [
    "-p"
@@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "changie";
-  version = "1.21.1";
+  version = "1.22.0";

  src = fetchFromGitHub {
    owner = "miniscruff";
    repo = "changie";
    rev = "v${version}";
-    hash = "sha256-zLRMH5TxEz/fspMOPAMTEqO19fj9PZsRh6zddbTqSXM=";
+    hash = "sha256-tq29L9YlzhjbHkUfE0ZZhSrH+rcAwgYjcEAUjP/lHm8=";
  };

-  vendorHash = "sha256-LWf10MM9SBU9sHb59c6ILlsHs8E8ETYAR34296aeHlI=";
+  vendorHash = "sha256-nAwBVa+UssbfFbcOWFcsWUllBTeW89xPcgS+ofXDPf0=";

  nativeBuildInputs = [
    installShellFiles
@@ -75,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];
  postFixup = ''
    moveToOutput share/ament_index "$dev"
-    moveToOutput share/${finalAttrs.pname} "$dev"
+    moveToOutput share/coal "$dev"
  '';

  meta = {
@@ -21,9 +21,9 @@ php.buildComposerProject2 (finalAttrs: {
  postInstall = ''
    chmod -R u+w $out/share
    # Only include the files needed for runtime in the derivation
-    mv $out/share/php/${finalAttrs.pname}/{migrations,public,src,config,bin,templates,tests,translations,vendor,symfony.lock,composer.json,composer.lock} $out
+    mv $out/share/php/davis/{migrations,public,src,config,bin,templates,tests,translations,vendor,symfony.lock,composer.json,composer.lock} $out
    # Save the upstream .env file for reference, but rename it so it is not loaded
-    mv $out/share/php/${finalAttrs.pname}/.env $out/env-upstream
+    mv $out/share/php/davis/.env $out/env-upstream
    rm -rf "$out/share"
  '';

@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "2.1";

  src = fetchurl {
-    url = "mirror://samba/paulus/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
+    url = "mirror://samba/paulus/dirdiff-${finalAttrs.version}.tar.gz";
    hash = "sha256-yzc2VNV4gCeAQ1XjVd8GlYYsO/wfaj/GAUcisxVqklI=";
  };

@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
  cmakeFlags = [ "-DQT_VERSION_MAJOR=6" ];

  postInstall = ''
-    install -Dm644 $src/LICENSE.txt $out/share/licenses/${finalAttrs.pname}/LICENSE
+    install -Dm644 $src/LICENSE.txt $out/share/licenses/efibooteditor/LICENSE
  '';

  meta = {
@@ -1,6 +1,5 @@
 {
  "ente_crypto_dart": "sha256-xBBK9BdXh4+OTj+Jkf3zh5sMZjXtvhyuE1R5LFE8iTY=",
  "flutter_local_authentication": "sha256-r50jr+81ho+7q2PWHLf4VnvNJmhiARZ3s4HUpThCgc0=",
-  "flutter_secure_storage_linux": "sha256-Rp+b6ZRH7F5AnM5UvYzfVjprXkpeeA7V6Ep/oYqDeiM=",
  "sqflite": "sha256-+XTVtkFJ94VifwnutvUuAqqiyWwrcEiZ3Uz0H4D9zWA="
 }
@@ -18,14 +18,14 @@ let
 in
 flutter324.buildFlutterApplication rec {
  pname = "ente-auth";
-  version = "4.3.5";
+  version = "4.3.6";

  src = fetchFromGitHub {
    owner = "ente-io";
    repo = "ente";
    sparseCheckout = [ "auth" ];
    tag = "auth-v${version}";
-    hash = "sha256-kM1y3Q5Z8J84qHhki9A+I/uY7xYQNMlfh2ZhxzpUBHM=";
+    hash = "sha256-6S0sgxiPrakqtQ/KoEKR10yWxOk6Rs5MOHjFZXkAbcg=";
  };

  sourceRoot = "${src.name}/auth";
@@ -4,17 +4,17 @@
      "dependency": "transitive",
      "description": {
        "name": "_fe_analyzer_shared",
-        "sha256": "f256b0c0ba6c7577c15e2e4e114755640a875e885099367bf6e012b19314c834",
+        "sha256": "16e298750b6d0af7ce8a3ba7c18c69c3785d11b15ec83f6dcd0ad2a0009b3cab",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "72.0.0"
+      "version": "76.0.0"
    },
    "_macros": {
      "dependency": "transitive",
      "description": "dart",
      "source": "sdk",
-      "version": "0.3.2"
+      "version": "0.3.3"
    },
    "adaptive_theme": {
      "dependency": "direct main",
@@ -30,11 +30,11 @@
      "dependency": "transitive",
      "description": {
        "name": "analyzer",
-        "sha256": "b652861553cd3990d8ed361f7979dc6d7053a9ac8843fa73820ab68ce5410139",
+        "sha256": "1f14db053a8c23e260789e9b0980fa27f2680dd640932cae5e1137cce0e46e1e",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "6.7.0"
+      "version": "6.11.0"
    },
    "ansicolor": {
      "dependency": "transitive",
@@ -110,11 +110,11 @@
      "dependency": "transitive",
      "description": {
        "name": "async",
-        "sha256": "947bfcf187f74dbc5e146c9eb9c0f10c9f8b30743e341481c1e2ed3ecc18c20c",
+        "sha256": "d2872f9c19731c2e5f10444b14686eb7cc85c76274bd6c16e1816bff9a3bab63",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.11.0"
+      "version": "2.12.0"
    },
    "auto_size_text": {
      "dependency": "direct main",
@@ -160,11 +160,11 @@
      "dependency": "transitive",
      "description": {
        "name": "boolean_selector",
-        "sha256": "6cfb5af12253eaf2b368f07bacc5a80d1301a071c73360d746b7f2e32d762c66",
+        "sha256": "8aab1771e1243a5063b8b0ff68042d67334e3feab9e95b9490f9a6ebf73b42ea",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.1.1"
+      "version": "2.1.2"
    },
    "build": {
      "dependency": "transitive",
@@ -250,11 +250,11 @@
      "dependency": "transitive",
      "description": {
        "name": "characters",
-        "sha256": "04a925763edad70e8443c99234dc3328f442e811f1d8fd1a72f1c8ad0f69a605",
+        "sha256": "f71061c654a3380576a52b451dd5532377954cf9dbd272a78fc8479606670803",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.3.0"
+      "version": "1.4.0"
    },
    "checked_yaml": {
      "dependency": "transitive",
@@ -290,11 +290,11 @@
      "dependency": "transitive",
      "description": {
        "name": "clock",
-        "sha256": "cb6d7f03e1de671e34607e909a7213e31d7752be4fb66a86d29fe1eb14bfb5cf",
+        "sha256": "fddb70d9b5277016c77a80201021d40a2247104d9f4aa7bab7157b7e3f05b84b",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.1.1"
+      "version": "1.1.2"
    },
    "code_builder": {
      "dependency": "transitive",
@@ -310,11 +310,11 @@
      "dependency": "direct main",
      "description": {
        "name": "collection",
-        "sha256": "ee67cb0715911d28db6bf4af1026078bd6f0128b07a5f66fb2ed94ec6783c09a",
+        "sha256": "2f5709ae4d3d59dd8f7cd309b4e023046b57d8a6c82130785d2b0e5868084e76",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.18.0"
+      "version": "1.19.1"
    },
    "confetti": {
      "dependency": "direct main",
@@ -541,11 +541,11 @@
      "dependency": "transitive",
      "description": {
        "name": "fake_async",
-        "sha256": "511392330127add0b769b75a987850d136345d9227c6b94c96a04cf4a391bf78",
+        "sha256": "6a95e56b2449df2273fd8c45a662d6947ce1ebb7aafe80e550a3f68297f3cacc",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.3.1"
+      "version": "1.3.2"
    },
    "ffi": {
      "dependency": "direct main",
@@ -841,15 +841,14 @@
      "version": "9.2.2"
    },
    "flutter_secure_storage_linux": {
-      "dependency": "direct overridden",
+      "dependency": "transitive",
      "description": {
-        "path": "flutter_secure_storage_linux",
-        "ref": "develop",
-        "resolved-ref": "5a5692b609b3886cdd49b2ed06b9c079ecdff996",
-        "url": "https://github.com/mogol/flutter_secure_storage.git"
+        "name": "flutter_secure_storage_linux",
+        "sha256": "be76c1d24a97d0b98f8b54bce6b481a380a6590df992d0098f868ad54dc8f688",
+        "url": "https://pub.dev"
      },
-      "source": "git",
-      "version": "1.2.1"
+      "source": "hosted",
+      "version": "1.2.3"
    },
    "flutter_secure_storage_macos": {
      "dependency": "transitive",
@@ -1177,21 +1176,21 @@
      "dependency": "transitive",
      "description": {
        "name": "leak_tracker",
-        "sha256": "3f87a60e8c63aecc975dda1ceedbc8f24de75f09e4856ea27daf8958f2f0ce05",
+        "sha256": "c35baad643ba394b40aac41080300150a4f08fd0fd6a10378f8f7c6bc161acec",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "10.0.5"
+      "version": "10.0.8"
    },
    "leak_tracker_flutter_testing": {
      "dependency": "transitive",
      "description": {
        "name": "leak_tracker_flutter_testing",
-        "sha256": "932549fb305594d82d7183ecd9fa93463e9914e1b67cacc34bc40906594a1806",
+        "sha256": "f8b613e7e6a13ec79cfdc0e97638fddb3ab848452eff057653abd3edba760573",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "3.0.5"
+      "version": "3.0.9"
    },
    "leak_tracker_testing": {
      "dependency": "transitive",
@@ -1277,21 +1276,21 @@
      "dependency": "transitive",
      "description": {
        "name": "macros",
-        "sha256": "0acaed5d6b7eab89f63350bccd82119e6c602df0f391260d0e32b5e23db79536",
+        "sha256": "1d9e801cd66f7ea3663c45fc708450db1fa57f988142c64289142c9b7ee80656",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.1.2-main.4"
+      "version": "0.1.3-main.0"
    },
    "matcher": {
      "dependency": "transitive",
      "description": {
        "name": "matcher",
-        "sha256": "d2323aa2060500f906aa31a895b4030b6da3ebdcc5619d14ce1aada65cd161cb",
+        "sha256": "dc58c723c3c24bf8d3e2d3ad3f2f9d7bd9cf43ec6feaa64181775e60190153f2",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.12.16+1"
+      "version": "0.12.17"
    },
    "material_color_utilities": {
      "dependency": "transitive",
@@ -1317,11 +1316,11 @@
      "dependency": "transitive",
      "description": {
        "name": "meta",
-        "sha256": "bdb68674043280c3428e9ec998512fb681678676b3c54e773629ffe74419f8c7",
+        "sha256": "e3641ec5d63ebf0d9b41bd43201a66e3fc79a65db5f61fc181f04cd27aab950c",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.15.0"
+      "version": "1.16.0"
    },
    "mime": {
      "dependency": "transitive",
@@ -1457,11 +1456,11 @@
      "dependency": "direct main",
      "description": {
        "name": "path",
-        "sha256": "087ce49c3f0dc39180befefc60fdb4acd8f8620e5682fe2476afd0b3688bb4af",
+        "sha256": "75cca69d1490965be98c73ceaea117e8a04dd21217b37b292c9ddbec0d955bc5",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.9.0"
+      "version": "1.9.1"
    },
    "path_drawing": {
      "dependency": "transitive",
@@ -1697,21 +1696,21 @@
      "dependency": "direct main",
      "description": {
        "name": "sentry",
-        "sha256": "033287044a6644a93498969449d57c37907e56f5cedb17b88a3ff20a882261dd",
+        "sha256": "599701ca0693a74da361bc780b0752e1abc98226cf5095f6b069648116c896bb",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "8.9.0"
+      "version": "8.14.2"
    },
    "sentry_flutter": {
      "dependency": "direct main",
      "description": {
        "name": "sentry_flutter",
-        "sha256": "3780b5a0bb6afd476857cfbc6c7444d969c29a4d9bd1aa5b6960aa76c65b737a",
+        "sha256": "5ba2cf40646a77d113b37a07bd69f61bb3ec8a73cbabe5537b05a7c89d2656f8",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "8.9.0"
+      "version": "8.14.2"
    },
    "share_plus": {
      "dependency": "direct main",
@@ -1837,7 +1836,7 @@
      "dependency": "transitive",
      "description": "flutter",
      "source": "sdk",
-      "version": "0.0.99"
+      "version": "0.0.0"
    },
    "sodium": {
      "dependency": "transitive",
@@ -1883,11 +1882,11 @@
      "dependency": "transitive",
      "description": {
        "name": "source_span",
-        "sha256": "53e943d4206a5e30df338fd4c6e7a077e02254531b138a15aec3bd143c1a8b3c",
+        "sha256": "254ee5351d6cb365c859e20ee823c3bb479bf4a293c22d17a9f1bf144ce86f7c",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.10.0"
+      "version": "1.10.1"
    },
    "sprintf": {
      "dependency": "transitive",
@@ -1944,11 +1943,11 @@
      "dependency": "transitive",
      "description": {
        "name": "stack_trace",
-        "sha256": "73713990125a6d93122541237550ee3352a2d84baad52d375a4cad2eb9b7ce0b",
+        "sha256": "8b27215b45d22309b5cddda1aa2b19bdfec9df0e765f2de506401c071d38d1b1",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.11.1"
+      "version": "1.12.1"
    },
    "steam_totp": {
      "dependency": "direct main",
@@ -1974,11 +1973,11 @@
      "dependency": "transitive",
      "description": {
        "name": "stream_channel",
-        "sha256": "ba2aa5d8cc609d96bbb2899c28934f9e1af5cddbd60a827822ea467161eb54e7",
+        "sha256": "969e04c80b8bcdf826f8f16579c7b14d780458bd97f56d107d3950fdbeef059d",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "2.1.2"
+      "version": "2.1.4"
    },
    "stream_transform": {
      "dependency": "transitive",
@@ -1994,11 +1993,11 @@
      "dependency": "transitive",
      "description": {
        "name": "string_scanner",
-        "sha256": "556692adab6cfa87322a115640c11f13cb77b3f076ddcc5d6ae3c20242bedcde",
+        "sha256": "921cd31725b72fe181906c6a94d987c78e3b98c2e205b397ea399d4054872b43",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.2.0"
+      "version": "1.4.1"
    },
    "styled_text": {
      "dependency": "direct main",
@@ -2024,21 +2023,21 @@
      "dependency": "transitive",
      "description": {
        "name": "term_glyph",
-        "sha256": "a29248a84fbb7c79282b40b8c72a1209db169a2e0542bce341da992fe1bc7e84",
+        "sha256": "7f554798625ea768a7518313e58f83891c7f5024f88e46e7182a4558850a4b8e",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "1.2.1"
+      "version": "1.2.2"
    },
    "test_api": {
      "dependency": "transitive",
      "description": {
        "name": "test_api",
-        "sha256": "5b8a98dafc4d5c4c9c72d8b31ab2b23fc13422348d2997120294d3bac86b4ddb",
+        "sha256": "fb31f383e2ee25fbbfe06b40fe21e1e458d14080e3c67e7ba0acfde4df4e0bbd",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "0.7.2"
+      "version": "0.7.4"
    },
    "timezone": {
      "dependency": "transitive",
@@ -2244,11 +2243,11 @@
      "dependency": "transitive",
      "description": {
        "name": "vm_service",
-        "sha256": "5c5f338a667b4c644744b661f309fb8080bb94b18a7e91ef1dbd343bed00ed6d",
+        "sha256": "0968250880a6c5fe7edc067ed0a13d4bae1577fe2771dcf3010d52c4a9d3ca14",
        "url": "https://pub.dev"
      },
      "source": "hosted",
-      "version": "14.2.5"
+      "version": "14.3.1"
    },
    "watcher": {
      "dependency": "transitive",
@@ -2362,7 +2361,7 @@
    }
  },
  "sdks": {
-    "dart": ">=3.5.0 <4.0.0",
+    "dart": ">=3.7.0-0 <4.0.0",
    "flutter": ">=3.24.0"
  }
 }
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
  # The package expect to find an `example-robot-data/robots` folder somewhere
  # either in install prefix or in the sources
  # where it can find the meshes for unit tests
-  preCheck = "ln -s source ../../${finalAttrs.pname}";
+  preCheck = "ln -s source ../../example-robot-data";
  pythonImportsCheck = [ "example_robot_data" ];

  meta = with lib; {
@@ -11,18 +11,18 @@ GEM
    artifactory (3.0.17)
    atomos (0.1.3)
    aws-eventstream (1.3.2)
-    aws-partitions (1.1090.0)
-    aws-sdk-core (3.222.2)
+    aws-partitions (1.1106.0)
+    aws-sdk-core (3.224.0)
      aws-eventstream (~> 1, >= 1.3.0)
      aws-partitions (~> 1, >= 1.992.0)
      aws-sigv4 (~> 1.9)
      base64
      jmespath (~> 1, >= 1.6.1)
      logger
-    aws-sdk-kms (1.99.0)
+    aws-sdk-kms (1.101.0)
      aws-sdk-core (~> 3, >= 3.216.0)
      aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.183.0)
+    aws-sdk-s3 (1.186.1)
      aws-sdk-core (~> 3, >= 3.216.0)
      aws-sdk-kms (~> 1)
      aws-sigv4 (~> 1.5)
@@ -71,7 +71,7 @@ GEM
    faraday_middleware (1.2.1)
      faraday (~> 1.0)
    fastimage (2.4.0)
-    fastlane (2.227.1)
+    fastlane (2.227.2)
      CFPropertyList (>= 2.3, < 4.0.0)
      addressable (>= 2.8, < 3.0.0)
      artifactory (~> 3.0)
@@ -158,7 +158,7 @@ GEM
    httpclient (2.9.0)
      mutex_m
    jmespath (1.6.2)
-    json (2.10.2)
+    json (2.12.1)
    jwt (2.10.1)
      base64
    logger (1.7.0)
@@ -173,7 +173,7 @@ GEM
    optparse (0.6.0)
    os (1.1.4)
    plist (3.7.2)
-    public_suffix (6.0.1)
+    public_suffix (6.0.2)
    rake (13.2.1)
    representable (3.2.0)
      declarative (< 0.1.0)
@@ -185,7 +185,7 @@ GEM
    ruby2_keywords (0.0.5)
    rubyzip (2.4.1)
    security (0.1.5)
-    signet (0.19.0)
+    signet (0.20.0)
      addressable (~> 2.8)
      faraday (>= 0.17.5, < 3.a)
      jwt (>= 1.5, < 3.0)
@@ -55,10 +55,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "15nkd4iskiy2c2lh1w499978zvnxkirpdm2i0y5i0yvym43kkycx";
+      sha256 = "12svi07s5hss8wq9xpaxwy1ibl64bd00hsn12v810wvz19fw823l";
      type = "gem";
    };
-    version = "1.1090.0";
+    version = "1.1106.0";
  };
  aws-sdk-core = {
    dependencies = [
@@ -73,10 +73,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1lf8aykj9ybs7mvfk27ccs221z7rhqm3lxqx6zy27lf6jl2hff86";
+      sha256 = "1b0pi1iibp644dn78g53s7hs7gcxghfa7h8rz3lvz8ivykisl5y6";
      type = "gem";
    };
-    version = "3.222.2";
+    version = "3.224.0";
  };
  aws-sdk-kms = {
    dependencies = [
@@ -87,10 +87,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1a3mh89kfh6flqxw48wfv9wfwkj2zxazw096mqm56wnnzz1jyads";
+      sha256 = "1mv8jc8sbvim2m3y3zxm8z4i5sh4x9ds7y9h5z04qfg7kjvbbn24";
      type = "gem";
    };
-    version = "1.99.0";
+    version = "1.101.0";
  };
  aws-sdk-s3 = {
    dependencies = [
@@ -102,10 +102,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0k4zg6i7xrgqv4s66hxj0l5icx44bb1ax52al2s5gz3n1hrv01lc";
+      sha256 = "00sq22mfibxq3rjy9c4vj1s8yjszv8988di7z7rs8v62my53nw2v";
      type = "gem";
    };
-    version = "1.183.0";
+    version = "1.186.1";
  };
  aws-sigv4 = {
    dependencies = [ "aws-eventstream" ];
@@ -461,10 +461,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "124ijrgr9w709093g7p7hvhg1l4wy4kr1c8rn82krri89pl4q6y2";
+      sha256 = "1dw9smmpzhlca2zzp2pgmr2slhwnz8926s5rnjfjrclilz33p22z";
      type = "gem";
    };
-    version = "2.227.1";
+    version = "2.227.2";
  };
  fastlane-sirp = {
    dependencies = [ "sysrandom" ];
@@ -668,10 +668,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "01lbdaizhkxmrw4y8j3wpvsryvnvzmg0pfs56c52laq2jgdfmq1l";
+      sha256 = "0fr0dxwn5a7z5m3i16v66pc35wmwc6mgj9f8dg7ch2bwq42y73zw";
      type = "gem";
    };
-    version = "2.10.2";
+    version = "2.12.1";
  };
  jwt = {
    dependencies = [ "base64" ];
@@ -809,10 +809,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0vqcw3iwby3yc6avs1vb3gfd0vcp2v7q310665dvxfswmcf4xm31";
+      sha256 = "1543ap9w3ydhx39ljcd675cdz9cr948x9mp00ab8qvq6118wv9xz";
      type = "gem";
    };
-    version = "6.0.1";
+    version = "6.0.2";
  };
  rake = {
    groups = [ "default" ];
@@ -910,10 +910,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0cfxa11wy1nv9slmnzjczkdgld0gqizajsb03rliy53zylwkjzsk";
+      sha256 = "18s7xiclzajp9w9cmq8k28iy5ig1zpx1zv1mrm416cb2c0m0wrmw";
      type = "gem";
    };
-    version = "0.19.0";
+    version = "0.20.0";
  };
  simctl = {
    dependencies = [
@@ -19,7 +19,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    runHook preInstall

    # https://gitlab.archlinux.org/archlinux/packaging/packages/fcitx5-material-color/-/blob/main/PKGBUILD?ref_type=heads#L16
-    install -Dm644 arrow.png radio.png -t $out/share/${finalAttrs.pname}/
+    install -Dm644 arrow.png radio.png -t $out/share/fcitx5-material-color/
    for _variant in black blue brown deepPurple indigo orange pink red sakuraPink teal; do
      _variant_name=Material-Color-$_variant
      install -dm755 $_variant_name $out/share/fcitx5/themes/$_variant_name
@@ -82,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {

  postFixup = ''
    substituteInPlace $out/share/applications/figma-linux.desktop \
-          --replace "Exec=/opt/figma-linux/figma-linux" "Exec=$out/bin/${finalAttrs.pname}"
+          --replace "Exec=/opt/figma-linux/figma-linux" "Exec=$out/bin/figma-linux"
  '';

  meta = with lib; {
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "0.0.38";
  src = fetchFromGitHub {
    owner = "modelica";
-    repo = finalAttrs.pname;
+    repo = "reference-fmus";
    rev = "v${finalAttrs.version}";
    hash = "sha256-FeDKYcm9K670q1FGqy41Tp2Ag8p2JidH4z78zpHOngw=";
  };
@@ -29,8 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
-    src = finalAttrs.src;
-    name = "${finalAttrs.pname}-${finalAttrs.version}";
+    inherit (finalAttrs) pname version src;
    hash = "sha256-Gl78z9FR/sB14uFDLKgnfN4B5yOi6A6MH64gDXcLiWA=";
  };

@@ -30,8 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
-    name = "${finalAttrs.pname}-${finalAttrs.version}";
+    inherit (finalAttrs) pname version src;
    hash = "sha256-SFp9YCmneOll2pItWmg2b2jrpRqPnvV9vwz4mjjvwM4=";
  };

@@ -0,0 +1,75 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  gitUpdater,
+  nixosTests,
+  writeShellApplication,
+  _experimental-update-script-combinators,
+  galene,
+  nix,
+  sd,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "galene-file-transfer";
+  version = "0.2";
+
+  src = fetchFromGitHub {
+    owner = "jech";
+    repo = "galene-file-transfer";
+    tag = "galene-file-transfer-${finalAttrs.version}";
+    hash = "sha256-T3OtEsHysAmHwvDIkxqXMKLqIeXEeX9uhEG4WFUgQL4=";
+  };
+
+  vendorHash = "sha256-Z2IYZtB2PAxJD8993reu+ldTG3LdPLNMbr9pP2NUBMA=";
+
+  strictDeps = true;
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  passthru = {
+    tests.vm = nixosTests.galene.file-transfer;
+    updateScriptSrc = gitUpdater {
+      rev-prefix = "galene-file-transfer-";
+    };
+    updateScriptVendor = writeShellApplication {
+      name = "update-galene-file-transfer-vendorHash";
+      runtimeInputs = [
+        nix
+        sd
+      ];
+      text = ''
+        export UPDATE_NIX_ATTR_PATH="''${UPDATE_NIX_ATTR_PATH:-galene-file-transfer}"
+
+        oldhash="$(nix-instantiate . --eval --strict -A "$UPDATE_NIX_ATTR_PATH.goModules.drvAttrs.outputHash" | cut -d'"' -f2)"
+        newhash="$(nix-build -A "$UPDATE_NIX_ATTR_PATH.goModules" --no-out-link 2>&1 | tail -n3 | grep 'got:' | cut -d: -f2- | xargs echo || true)"
+
+        if [ "$newhash" == "" ]; then
+          echo "No new vendorHash."
+          exit 0
+        fi
+
+        fname="$(nix-instantiate --eval -E "with import ./. {}; (builtins.unsafeGetAttrPos \"version\" $UPDATE_NIX_ATTR_PATH).file" | cut -d'"' -f2)"
+
+        ${sd.meta.mainProgram} --string-mode "$oldhash" "$newhash" "$fname"
+      '';
+    };
+    updateScript = _experimental-update-script-combinators.sequence [
+      finalAttrs.passthru.updateScriptSrc.command
+      (lib.getExe finalAttrs.passthru.updateScriptVendor)
+    ];
+  };
+
+  meta = {
+    description = "Command-line file transfer client for the Galene videoconferencing server";
+    homepage = "https://github.com/jech/galene-file-transfer";
+    changelog = "https://github.com/jech/galene-file-transfer/raw/${finalAttrs.src.rev}/CHANGES";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    inherit (galene.meta) maintainers;
+  };
+})
@@ -0,0 +1,73 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  gitUpdater,
+  writeShellApplication,
+  _experimental-update-script-combinators,
+  galene,
+  nix,
+  sd,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "galene-ldap";
+  version = "0.2";
+
+  src = fetchFromGitHub {
+    owner = "jech";
+    repo = "galene-ldap";
+    tag = "galene-ldap-${finalAttrs.version}";
+    hash = "sha256-FXD90ishU3FBRj16tQx8wr+lSFl1dffNM1rU81Kfe1I=";
+  };
+
+  vendorHash = "sha256-i/pWXgcd01PgH1Q+WEm0gP1leTFBhqGxVGnl6c+J1aQ=";
+
+  strictDeps = true;
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  passthru = {
+    updateScriptSrc = gitUpdater {
+      rev-prefix = "galene-ldap-";
+    };
+    updateScriptVendor = writeShellApplication {
+      name = "update-galene-ldap-vendorHash";
+      runtimeInputs = [
+        nix
+        sd
+      ];
+      text = ''
+        export UPDATE_NIX_ATTR_PATH="''${UPDATE_NIX_ATTR_PATH:-galene-ldap}"
+
+        oldhash="$(nix-instantiate . --eval --strict -A "$UPDATE_NIX_ATTR_PATH.goModules.drvAttrs.outputHash" | cut -d'"' -f2)"
+        newhash="$(nix-build -A "$UPDATE_NIX_ATTR_PATH.goModules" --no-out-link 2>&1 | tail -n3 | grep 'got:' | cut -d: -f2- | xargs echo || true)"
+
+        if [ "$newhash" == "" ]; then
+          echo "No new vendorHash."
+          exit 0
+        fi
+
+        fname="$(nix-instantiate --eval -E "with import ./. {}; (builtins.unsafeGetAttrPos \"version\" $UPDATE_NIX_ATTR_PATH).file" | cut -d'"' -f2)"
+
+        ${sd.meta.mainProgram} --string-mode "$oldhash" "$newhash" "$fname"
+      '';
+    };
+    updateScript = _experimental-update-script-combinators.sequence [
+      finalAttrs.passthru.updateScriptSrc.command
+      (lib.getExe finalAttrs.passthru.updateScriptVendor)
+    ];
+  };
+
+  meta = {
+    description = "LDAP support for the Galene videoconferencing server";
+    homepage = "https://github.com/jech/galene-ldap";
+    changelog = "https://github.com/jech/galene-ldap/raw/${finalAttrs.src.rev}/CHANGES";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    inherit (galene.meta) maintainers;
+  };
+})
@@ -0,0 +1,91 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  gitUpdater,
+  writeShellApplication,
+  _experimental-update-script-combinators,
+  galene,
+  libopus,
+  nix,
+  pkg-config,
+  sd,
+  whisper-cpp,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "galene-stt";
+  version = "0.1";
+
+  src = fetchFromGitHub {
+    owner = "jech";
+    repo = "galene-stt";
+    tag = "galene-stt-${finalAttrs.version}";
+    hash = "sha256-uW1b5T+p7KGvqt+PlR9d7bo62V+URHniS45sZP/VuLQ=";
+  };
+
+  vendorHash = "sha256-UFOxo8jq+gxN1dkM2A/BQqtT9ggIp7qovFRLv3Q6Io0=";
+
+  # Not necessary, but feels cleaner to pull it in like that
+  postPatch = ''
+    substituteInPlace whisper.go \
+      --replace-fail 'cgo LDFLAGS: -lwhisper' 'cgo pkg-config: whisper'
+  '';
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    libopus
+    whisper-cpp
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  passthru = {
+    updateScriptSrc = gitUpdater {
+      rev-prefix = "galene-stt-";
+    };
+    updateScriptVendor = writeShellApplication {
+      name = "update-galene-stt-vendorHash";
+      runtimeInputs = [
+        nix
+        sd
+      ];
+      text = ''
+        export UPDATE_NIX_ATTR_PATH="''${UPDATE_NIX_ATTR_PATH:-galene-stt}"
+
+        oldhash="$(nix-instantiate . --eval --strict -A "$UPDATE_NIX_ATTR_PATH.goModules.drvAttrs.outputHash" | cut -d'"' -f2)"
+        newhash="$(nix-build -A "$UPDATE_NIX_ATTR_PATH.goModules" --no-out-link 2>&1 | tail -n3 | grep 'got:' | cut -d: -f2- | xargs echo || true)"
+
+        if [ "$newhash" == "" ]; then
+          echo "No new vendorHash."
+          exit 0
+        fi
+
+        fname="$(nix-instantiate --eval -E "with import ./. {}; (builtins.unsafeGetAttrPos \"version\" $UPDATE_NIX_ATTR_PATH).file" | cut -d'"' -f2)"
+
+        ${sd.meta.mainProgram} --string-mode "$oldhash" "$newhash" "$fname"
+      '';
+    };
+    updateScript = _experimental-update-script-combinators.sequence [
+      finalAttrs.passthru.updateScriptSrc.command
+      (lib.getExe finalAttrs.passthru.updateScriptVendor)
+    ];
+  };
+
+  meta = {
+    description = "Speech-to-text support for Galene";
+    homepage = "https://github.com/jech/galene-stt";
+    changelog = "https://github.com/jech/galene-stt/raw/${finalAttrs.src.rev}/CHANGES";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    inherit (galene.meta) maintainers;
+  };
+})
@@ -2,6 +2,7 @@
  lib,
  fetchFromGitHub,
  buildGoModule,
+  nixosTests,
 }:

 buildGoModule rec {
@@ -33,12 +34,17 @@ buildGoModule rec {
    cp -r ./static $static
  '';

+  passthru = {
+    tests.vm = nixosTests.galene.basic;
+  };
+
  meta = with lib; {
    description = "Videoconferencing server that is easy to deploy, written in Go";
    homepage = "https://github.com/jech/galene";
    changelog = "https://github.com/jech/galene/raw/galene-${version}/CHANGES";
    license = licenses.mit;
    platforms = platforms.linux;
+    teams = [ lib.teams.ngi ];
    maintainers = with maintainers; [
      rgrunbla
      erdnaxe
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {

    mkdir -p $out
    mv bin lib $out
-    wrapProgram $out/bin/${finalAttrs.pname} \
+    wrapProgram $out/bin/genesys \
      --set JAVA_HOME "${jre.home}" \
      --prefix PATH : "${graphviz}/bin"

@@ -1,32 +0,0 @@
-{
-  lib,
-  buildNpmPackage,
-  fetchzip,
-}:
-
-buildNpmPackage rec {
-  pname = "github-copilot-cli";
-  version = "0.1.36";
-
-  src = fetchzip {
-    url = "https://registry.npmjs.org/@githubnext/github-copilot-cli/-/github-copilot-cli-${version}.tgz";
-    hash = "sha256-7n+7sN61OrqMVGaKll85+HwX7iGG9M/UW5lf2Pd5sRU=";
-  };
-
-  npmDepsHash = "sha256-h0StxzGbl3ZeOQ4Jy1BgJ5sJ0pAbubMCRsiIOYpU04w=";
-
-  postPatch = ''
-    cp ${./package-lock.json} package-lock.json
-  '';
-
-  dontNpmBuild = true;
-
-  meta = with lib; {
-    description = "CLI experience for letting GitHub Copilot help you on the command line";
-    homepage = "https://githubnext.com/projects/copilot-cli/";
-    license = licenses.unfree; # upstream has no license
-    maintainers = [ maintainers.malo ];
-    platforms = platforms.all;
-    mainProgram = "github-copilot-cli";
-  };
-}
@@ -33,8 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) src;
-    name = "${finalAttrs.pname}-${finalAttrs.version}";
+    inherit (finalAttrs) pname version src;
    hash = "sha256-Llgn+dYNKZ9Mles9f9Xor+GZoCCQ0cERkXz4MicZglY=";
  };

@@ -11,7 +11,7 @@ buildGoModule (finalAttrs: {

  src = fetchFromGitHub {
    owner = "google";
-    repo = finalAttrs.pname;
+    repo = "go-jsonnet";
    tag = "v${finalAttrs.version}";
    hash = "sha256-J92xNDpCidbiSsN6NveS6BX6Tx+qDQqkgm6pjk1wBTQ=";
  };
@@ -24,9 +24,9 @@ buildNimPackage (finalAttrs: {
  desktopItem = makeDesktopItem {
    categories = [ "Utility" ];
    comment = finalAttrs.meta.description;
-    desktopName = finalAttrs.pname;
-    exec = finalAttrs.pname;
-    name = finalAttrs.pname;
+    desktopName = "hottext";
+    exec = "hottext";
+    name = "hottext";
  };

  postInstall = ''
@@ -135,10 +135,10 @@ stdenv.mkDerivation (finalAttrs: {
    runHook preInstall

    install -D usr/lib/x86_64-linux-gnu/ideamaker/ideamaker \
-      $out/bin/${finalAttrs.pname}
+      $out/bin/ideamaker

    patchelf --replace-needed libquazip.so.1 libquazip1-qt5.so \
-      $out/bin/${finalAttrs.pname}
+      $out/bin/ideamaker

    mimetypeDir=$out/share/icons/hicolor/128x128/mimetypes
    mkdir -p ''$mimetypeDir
@@ -146,10 +146,10 @@ stdenv.mkDerivation (finalAttrs: {
      mv $file ''$mimetypeDir/''$(basename ''${file%.ico}).png
    done
    install -D ${./mimetypes.xml} \
-      $out/share/mime/packages/${finalAttrs.pname}.xml
+      $out/share/mime/packages/ideamaker.xml

    install -D usr/share/ideamaker/icons/ideamaker-icon.png \
-      $out/share/pixmaps/${finalAttrs.pname}.png
+      $out/share/pixmaps/ideamaker.png

    ln -s ${finalAttrs.desktopItem}/share/applications $out/share/

@@ -157,9 +157,9 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  desktopItem = makeDesktopItem {
-    name = finalAttrs.pname;
-    exec = finalAttrs.pname;
-    icon = finalAttrs.pname;
+    name = "ideamaker";
+    exec = "ideamaker";
+    icon = "ideamaker";
    desktopName = "Ideamaker";
    comment = "ideaMaker - www.raise3d.com";
    categories = [
@@ -10,7 +10,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "2.3";

  src = fetchurl {
-    url = "https://jprs.co.jp/idn/${finalAttrs.pname}-${finalAttrs.version}.tar.bz2";
+    url = "https://jprs.co.jp/idn/idnkit-${finalAttrs.version}.tar.bz2";
    hash = "sha256-JtBxF2UAQqtGk/DgCWAnXVihvnc+bRPFA7o4RxDz6X4=";
  };

@@ -44,8 +44,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  desktopItems = [
    (makeDesktopItem {
-      name = finalAttrs.pname;
-      exec = finalAttrs.pname;
+      name = "irpf";
+      exec = "irpf";
      icon = "rfb64";
      desktopName = "Imposto de Renda Pessoa Física";
      comment = "Programa Oficial da Receita para elaboração do IRPF";
@@ -56,7 +56,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  installPhase = ''
    runHook preInstall

-    BASEDIR="$out/share/${finalAttrs.pname}"
+    BASEDIR="$out/share/irpf"
    mkdir -p "$BASEDIR"

    cp --no-preserve=mode -r help lib lib-modulos "$BASEDIR"
@@ -64,10 +64,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    install -Dm644 irpf.jar Leia-me.htm offline.png online.png pgd-updater.jar "$BASEDIR"

    # make xdg-open overrideable at runtime
-    makeWrapper ${jdk11}/bin/java $out/bin/${finalAttrs.pname} \
+    makeWrapper ${jdk11}/bin/java $out/bin/irpf \
      --add-flags "-Dawt.useSystemAAFontSettings=on" \
      --add-flags "-Dswing.aatext=true" \
-      --add-flags "-jar $BASEDIR/${finalAttrs.pname}.jar" \
+      --add-flags "-jar $BASEDIR/irpf.jar" \
      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} \
      --set _JAVA_AWT_WM_NONREPARENTING 1 \
      --set AWT_TOOLKIT MToolkit
@@ -7,7 +7,7 @@ GEM
    docker-api (2.4.0)
      excon (>= 0.64.0)
      multi_json
-    ed25519 (1.3.0)
+    ed25519 (1.4.0)
    excon (1.2.5)
      logger
    hashie (5.0.0)
@@ -25,7 +25,7 @@ GEM
    net-telnet (0.2.0)
    schash (0.1.2)
    sfl (2.3)
-    specinfra (2.92.0)
+    specinfra (2.94.0)
      base64
      net-scp
      net-ssh (>= 2.7)
@@ -43,4 +43,4 @@ DEPENDENCIES
  itamae

 BUNDLED WITH
-   2.6.2
+   2.6.6
@@ -48,10 +48,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0zb2dr2ihb1qiknn5iaj1ha1w9p7lj9yq5waasndlfadz225ajji";
+      sha256 = "01n5rbyws1ijwc5dw7s88xx3zzacxx9k97qn8x11b6k8k18pzs8n";
      type = "gem";
    };
-    version = "1.3.0";
+    version = "1.4.0";
  };
  excon = {
    dependencies = [ "logger" ];
@@ -174,10 +174,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0aswlmhh152c974i8bn8d90kjbwadp0bjgs9kgpxxb3vffsfxc1w";
+      sha256 = "1m7vplx6w0w0mmij6n7zgc68kd1xbkhyb4qg25vmk8p21nbjbw6j";
      type = "gem";
    };
-    version = "2.92.0";
+    version = "2.94.0";
  };
  thor = {
    groups = [ "default" ];
@@ -123,7 +123,7 @@ stdenv.mkDerivation (finalAttrs: {
  installPhase = ''
    runHook preInstall

-    target="$out/lib/dotnet/${finalAttrs.pname}"
+    target="$out/lib/dotnet/keepass"
    mkdir -p "$target"

    cp -rv $outputFiles "$target"
@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "1.8";

  src = fetchurl {
-    url = "https://hyperrealm.github.io/${finalAttrs.pname}/dist/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
+    url = "https://hyperrealm.github.io/libconfig/dist/libconfig-${finalAttrs.version}.tar.gz";
    hash = "sha256-BR4V3Q6QfESQXzF5M/VIcxTypW6MZybIMEzpkIhIUKo=";
  };

@@ -1,7 +1,7 @@
 {
  lib,
  stdenv,
-  fetchzip,
+  fetchFromGitea,
  pugixml,
  updfparser,
  curl,
@@ -10,14 +10,16 @@
  installShellFiles,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "libgourou";
-  version = "0.8.2";
+  version = "0.8.7";

-  src = fetchzip {
-    url = "https://indefero.soutade.fr/p/libgourou/source/download/v${version}/";
-    sha256 = "sha256-adkrvBCgN07Ir+J3JFCy+X9p9609lj1w8nElrlHXTxc";
-    extension = "zip";
+  src = fetchFromGitea {
+    domain = "forge.soutade.fr";
+    owner = "soutade";
+    repo = "libgourou";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Tkft/pe3lH07pmyVibTEutIIvconUWDH1ZVN3qV4sSY=";
  };

  postPatch = ''
@@ -47,7 +49,7 @@ stdenv.mkDerivation rec {
    runHook preInstall
    install -Dt $out/include include/libgourou*.h
    install -Dt $out/lib libgourou.so
-    install -Dt $out/lib libgourou.so.${version}
+    install -Dt $out/lib libgourou.so.${finalAttrs.version}
    install -Dt $out/lib libgourou.a
    install -Dt $out/bin utils/acsmdownloader
    install -Dt $out/bin utils/adept_{activate,loan_mgt,remove}
@@ -57,10 +59,10 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Implementation of Adobe's ADEPT protocol for ePub/PDF DRM";
-    homepage = "https://indefero.soutade.fr/p/libgourou";
+    homepage = "https://forge.soutade.fr/soutade/libgourou";
    license = licenses.lgpl3Plus;
    maintainers = with maintainers; [ autumnal ];
    platforms = platforms.all;
    broken = stdenv.hostPlatform.isDarwin;
  };
-}
+})
@@ -0,0 +1,46 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  cmake,
+  gperf,
+  arpa2cm,
+  quickder,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "lillydap";
+  version = "1.0.1";
+
+  src = fetchFromGitLab {
+    owner = "arpa2";
+    repo = "lillydap";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-SQuvu1A9Iq/fKthfYyVQGWFuyHYnhIry/wvnwgdMKHY=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    gperf
+  ];
+
+  buildInputs = [
+    arpa2cm
+    quickder
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Little LDAP: Event-driven, lock-free kernel for dynamic data servers, clients, filters";
+    homepage = "https://gitlab.com/arpa2/lillydap";
+    changelog = "https://gitlab.com/arpa2/lillydap/-/blob/v${finalAttrs.version}/CHANGES";
+    license = lib.licenses.bsd2;
+    teams = with lib.teams; [ ngi ];
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    platforms = lib.platforms.unix;
+  };
+})
@@ -29,8 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
-    src = finalAttrs.src;
-    name = "${finalAttrs.pname}-${finalAttrs.version}";
+    inherit (finalAttrs) pname version src;
    hash = "sha256-4JYYcfsEoCGJWZCp0273gXrf8hfuHL/QSsLEHvNa4uA=";
  };

@@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "mapproxy";
-  version = "4.1.1";
+  version = "4.1.2";
  disabled = python3Packages.pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "mapproxy";
    repo = "mapproxy";
    tag = version;
-    hash = "sha256-rsravNSmvx1/291VvfRm0Yx1eg32UJd+egeG4S2SNnk=";
+    hash = "sha256-sh0kViv1Ax/2YPL2ON+X03d5Moa2oPWhb4Rp6Ni5AAY=";
  };

  prePatch = ''
@@ -11,7 +11,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "markdownlint-cli2";
-  version = "0.17.2";
+  version = "0.18.1";

  # upstream is not interested in including package-lock.json in the source
  # https://github.com/DavidAnson/markdownlint-cli2/issues/198#issuecomment-1690529976
@@ -19,7 +19,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  # so use the tarball from the archlinux mirror
  src = fetchurl {
    url = "https://us.mirrors.cicku.me/archlinux/extra/os/x86_64/markdownlint-cli2-${finalAttrs.version}-1-any.pkg.tar.zst";
-    hash = "sha256-TuiLFP/XItJh5VQWdwCvXRQCVzmqst4Sxna0eLobEQ4=";
+    hash = "sha256-M7qmhRDJGm2MhgS2oMfRrkLAst1Ye/rPCwP78UBbyyY=";
  };

  nativeBuildInputs = [
@@ -154,7 +154,7 @@ php.buildComposerProject2 (finalAttrs: {
    mkdir -p $out/bin
    cat << EOF > $out/bin/movim
    #!${lib.getExe dash}
-    ${lib.getExe finalAttrs.php} $out/share/php/${finalAttrs.pname}/daemon.php "\$@"
+    ${lib.getExe finalAttrs.php} $out/share/php/movim/daemon.php "\$@"
    EOF
    chmod +x $out/bin/movim

@@ -44,9 +44,9 @@ stdenv.mkDerivation (finalAttrs: {
    runHook preInstall

    # Based on the upstream PKGBUILD
-    mkdir -p $out/share/doc/${finalAttrs.pname}
+    mkdir -p $out/share/doc/mya
    cp -a bin $out
-    cp $cmakeDir/README.md $out/share/doc/${finalAttrs.pname}
+    cp $cmakeDir/README.md $out/share/doc/mya

    runHook postInstall
  '';
@@ -126,7 +126,7 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.cmakeFeature "NETGEN_VERSION_GIT" "v${finalAttrs.version}-0")
    (lib.cmakeFeature "NG_INSTALL_DIR_BIN" "bin")
    (lib.cmakeFeature "NG_INSTALL_DIR_LIB" "lib")
-    (lib.cmakeFeature "NG_INSTALL_DIR_CMAKE" "lib/cmake/${finalAttrs.pname}")
+    (lib.cmakeFeature "NG_INSTALL_DIR_CMAKE" "lib/cmake/netgen")
    (lib.cmakeFeature "NG_INSTALL_DIR_PYTHON" python3Packages.python.sitePackages)
    (lib.cmakeFeature "NG_INSTALL_DIR_RES" "share")
    (lib.cmakeFeature "NG_INSTALL_DIR_INCLUDE" "include")
@@ -160,11 +160,11 @@ stdenv.mkDerivation (finalAttrs: {
  postInstall =
    lib.optionalString stdenv.hostPlatform.isDarwin ''
      rm $out/bin/{Netgen1,startup.sh}
-      mkdir -p $out/Applications/${finalAttrs.pname}.app/Contents/{MacOS,Resouces}
+      mkdir -p $out/Applications/netgen.app/Contents/{MacOS,Resouces}
      substituteInPlace $out/Info.plist --replace-fail "Netgen1" "netgen"
-      mv $out/Info.plist $out/Applications/${finalAttrs.pname}.app/Contents
-      mv $out/Netgen.icns $out/Applications/${finalAttrs.pname}.app/Contents/Resouces
-      ln -s $out/bin/netgen $out/Applications/${finalAttrs.pname}.app/Contents/MacOS/netgen
+      mv $out/Info.plist $out/Applications/netgen.app/Contents
+      mv $out/Netgen.icns $out/Applications/netgen.app/Contents/Resouces
+      ln -s $out/bin/netgen $out/Applications/netgen.app/Contents/MacOS/netgen
    ''
    + lib.optionalString stdenv.hostPlatform.isLinux ''
      # Extract pngs from the Apple icon image and create
@@ -57,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
    runHook preInstall

    mkdir -p $out/bin
-    install -D -m 0755 $src $out/bin/${finalAttrs.pname}
+    install -D -m 0755 $src $out/bin/oakctl

    runHook postInstall
  '';
@@ -77,14 +77,14 @@ stdenv.mkDerivation (finalAttrs: {
    ''
      runHook preInstall

-      mkdir -p $out/{bin,share/${finalAttrs.pname}}
-      install -Dm644 ${finalAttrs.src} $out/share/${finalAttrs.pname}/ocelot-desktop.jar
+      mkdir -p $out/{bin,share/ocelot-desktop}
+      install -Dm644 ${finalAttrs.src} $out/share/ocelot-desktop/ocelot-desktop.jar

      makeBinaryWrapper ${jre}/bin/java $out/bin/ocelot-desktop \
        --set JAVA_HOME ${jre.home} \
        --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeLibs}" \
        --prefix PATH : "${lib.makeBinPath runtimePrograms}" \
-        --add-flags "-jar $out/share/${finalAttrs.pname}/ocelot-desktop.jar"
+        --add-flags "-jar $out/share/ocelot-desktop/ocelot-desktop.jar"

      # copy icons from zip file
      # ocelot/desktop/images/icon*.png
@@ -92,7 +92,7 @@ stdenv.mkDerivation (finalAttrs: {

      for size in 16 32 64 128 256; do
        mkdir -p $out/share/icons/hicolor/"$size"x"$size"/apps
-        unzip -p $out/share/${finalAttrs.pname}/ocelot-desktop.jar \
+        unzip -p $out/share/ocelot-desktop/ocelot-desktop.jar \
          ocelot/desktop/images/icon"$size".png > $out/share/icons/hicolor/"$size"x"$size"/apps/ocelot-desktop.png
      done

@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
  installPhase = ''
    runHook preInstall

-    sitePackages=$out/${python3.sitePackages}/${finalAttrs.pname}
+    sitePackages=$out/${python3.sitePackages}/payload_dumper

    install -D ./payload_dumper.py $out/bin/payload_dumper
    install -D ./update_metadata_pb2.py $sitePackages/update_metadata_pb2.py
@@ -4,14 +4,14 @@
  fetchFromGitHub,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "pb";
  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "parseablehq";
    repo = "pb";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-OXxLHi7v/xJZVvxHZvJ0eH4MYrlLFxDAMT9CVG2mWTM=";
  };

@@ -20,7 +20,7 @@ buildGoModule rec {
  ldflags = [
    "-s"
    "-w"
-    "-X main.Version=${version}"
+    "-X main.Version=${finalAttrs.version}"
  ];

  tags = [ "kqueue" ];
@@ -29,10 +29,10 @@ buildGoModule rec {

  meta = {
    homepage = "https://github.com/parseablehq/pb";
-    changelog = "https://github.com/parseablehq/pb/releases/tag/v${version}";
+    changelog = "https://github.com/parseablehq/pb/releases/tag/v${finalAttrs.version}";
    description = "CLI client for Parseable server";
    license = lib.licenses.agpl3Plus;
    maintainers = with lib.maintainers; [ aaronjheng ];
    mainProgram = "pb";
  };
-}
+})
@@ -106,7 +106,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchFromGitHub {
    owner = "picolibc";
-    repo = finalAttrs.pname;
+    repo = "picolibc";
    tag = finalAttrs.version;
    hash = "sha256-djOZKkinsaaYD4tUEA6mKdo+5em0GP1/+rI0mIm7Vs8=";
  };
@@ -23,7 +23,7 @@ php.buildComposerProject2 (finalAttrs: {

  postInstall = ''
    chmod -R u+w $out/share
-    mv "$out/share/php/${finalAttrs.pname}"/* $out
+    mv "$out/share/php/pixelfed"/* $out
    rm -R $out/bootstrap/cache
    # Move static contents for the NixOS module to pick it up, if needed.
    mv $out/bootstrap $out/bootstrap-static
@@ -15,14 +15,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "pmbootstrap";
-  version = "3.4.0";
+  version = "3.4.2";
  pyproject = true;

  src = fetchFromGitLab {
    owner = "postmarketOS";
    repo = "pmbootstrap";
    tag = version;
-    hash = "sha256-vNa0MMU5NHO8RjgfKxNjhQDKQ2Rd/ZGU0HndOD2Sypo=";
+    hash = "sha256-5N8yAd/1gSzHP2wXpqZb+LpylQ/LYspJ+YaY2YaWCSs=";
    domain = "gitlab.postmarketos.org";
  };

@@ -80,7 +80,7 @@ python3Packages.buildPythonApplication rec {

  meta = {
    description = "Sophisticated chroot/build/flash tool to develop and install postmarketOS";
-    homepage = "https://gitlab.com/postmarketOS/pmbootstrap";
+    homepage = "https://gitlab.postmarketos.org/postmarketOS/pmbootstrap";
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [
      onny
@@ -9,11 +9,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "proton-ge-bin";
-  version = "GE-Proton10-3";
+  version = "GE-Proton10-4";

  src = fetchzip {
    url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz";
-    hash = "sha256-V4znOni53KMZ0rs7O7TuBst5kDSaEOyWUGgL7EESVAU=";
+    hash = "sha256-Si/CQ2PINfhmsC+uW3iFBUoSczZdkqwCZ8FAFuipu68=";
  };

  dontUnpack = true;
@@ -5,7 +5,7 @@
  qt6Packages,
  cmake,
  makeWrapper,
-  botan2,
+  botan3,
  pkg-config,
  nixosTests,
  installShellFiles,
@@ -17,11 +17,11 @@
 stdenv.mkDerivation (finalAttrs: {
  pname = "qownnotes";
  appname = "QOwnNotes";
-  version = "25.5.10";
+  version = "25.6.0";

  src = fetchurl {
    url = "https://github.com/pbek/QOwnNotes/releases/download/v${finalAttrs.version}/qownnotes-${finalAttrs.version}.tar.xz";
-    hash = "sha256-P8vBLDnkBjTU/x47ka0Ps3nR+Wi4C6Gx+d0sP8lF/xM=";
+    hash = "sha256-RUW8fWPJxTq7Ya+uZ6xGg7URHc+ojuBs9g++UXrK9I0=";
  };

  nativeBuildInputs =
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
    qt6Packages.qtdeclarative
    qt6Packages.qtsvg
    qt6Packages.qtwebsockets
-    botan2
+    botan3
  ] ++ lib.optionals stdenv.hostPlatform.isLinux [ qt6Packages.qtwayland ];

  cmakeFlags = [
@@ -25,8 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
-    src = finalAttrs.src;
-    name = "${finalAttrs.pname}-${finalAttrs.version}";
+    inherit (finalAttrs) pname version src;
    hash = "sha256-gqc6en59QQpD14hOgRuGEPWLvrkyGn9tPR9vQmRAxIg=";
  };

@@ -9,7 +9,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "20230902";

  src = fetchurl {
-    url = "https://groups.csail.mit.edu/mac/users/gjs/6946/mechanics-system-installation/native-code/${finalAttrs.pname}-src-${finalAttrs.version}.tar.gz";
+    url = "https://groups.csail.mit.edu/mac/users/gjs/6946/mechanics-system-installation/native-code/scmutils-src-${finalAttrs.version}.tar.gz";
    hash = "sha256-9/shOxoKwJ4uDTHmvXqhemgy3W+GUCmoqFm5e1t3W0M=";
  };

@@ -10,12 +10,12 @@

 buildGoModule rec {
  pname = "shopware-cli";
-  version = "0.6.1";
+  version = "0.6.3";
  src = fetchFromGitHub {
    repo = "shopware-cli";
    owner = "FriendsOfShopware";
    tag = version;
-    hash = "sha256-GdZq3Jn+SAtf0SqJSc+52JA+VR3cFJ5DzQo3cMu9Ahs=";
+    hash = "sha256-UkLzjW3Ak+bMw+nRqlaojeJ67cxadkvufZ/pn1nTmoM=";
  };

  nativeBuildInputs = [
@@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "sigil";
-  version = "2.4.2";
+  version = "2.5.1";

  src = fetchFromGitHub {
    repo = "Sigil";
    owner = "Sigil-Ebook";
    tag = version;
-    hash = "sha256-/lnSNamLkPLG8tn0w8F0zFyypMUXyMhgxA2WyQFegKw=";
+    hash = "sha256-1Z+OosEZJEHiUz+62wYuNeAyQXARh14WAtqBVjq1FZw=";
  };

  pythonPath = with python3Packages; [ lxml ];
@@ -41,7 +41,7 @@

 stdenv.mkDerivation rec {
  pname = "slurm";
-  version = "24.11.5.1";
+  version = "25.05.0.1";

  # N.B. We use github release tags instead of https://www.schedmd.com/downloads.php
  # because the latter does not keep older releases.
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
    repo = "slurm";
    # The release tags use - instead of .
    rev = "${pname}-${builtins.replaceStrings [ "." ] [ "-" ] version}";
-    hash = "sha256-0c8b+quLeWpCyuCOcp/B8Yd0dxr90UtSV/tgeTi7tbk=";
+    hash = "sha256-C1euW/twT3AhwtNUmUDtmFjMUi5B4I7r488YcT+N/zM=";
  };

  outputs = [
@@ -106,9 +106,9 @@ stdenv.mkDerivation (finalAttrs: {
    runHook preInstall

    install -Dm755 snes9x -t "$out/bin/"
-    install -Dm644 snes9x.conf.default -t "$out/share/doc/${finalAttrs.pname}/"
+    install -Dm644 snes9x.conf.default -t "$out/share/doc/snes9x/"
    install -Dm644 ../docs/{control-inputs,controls,snapshots}.txt -t \
-      "$out/share/doc/${finalAttrs.pname}/"
+      "$out/share/doc/snes9x/"

    runHook postInstall
  '';
@@ -90,8 +90,8 @@ stdenv.mkDerivation (finalAttrs: {
  desktopItems = [
    (makeDesktopItem rec {
      name = "Sonic Robo Blast 2";
-      exec = finalAttrs.pname;
-      icon = finalAttrs.pname;
+      exec = "srb2";
+      icon = "srb2";
      comment = finalAttrs.meta.description;
      desktopName = name;
      genericName = name;
@@ -73,8 +73,8 @@ stdenv.mkDerivation (finalAttrs: {
  desktopItems = [
    (makeDesktopItem rec {
      name = "Sonic Robo Blast 2 Kart";
-      exec = finalAttrs.pname;
-      icon = finalAttrs.pname;
+      exec = "srb2kart";
+      icon = "srb2kart";
      comment = "Kart racing mod based on SRB2";
      desktopName = name;
      genericName = name;
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
  version = "0.1.13";

  src = fetchurl {
-    url = "http://iwar.free.fr/spip/IMG/gz/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
+    url = "http://iwar.free.fr/spip/IMG/gz/stardust-${finalAttrs.version}.tar.gz";
    hash = "sha256-t5cykB5zHYYj4tlk9QDhL7YQVgEScBZw9OIVXz5NOqc=";
  };

@@ -23,10 +23,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  desktopItems = [
    (makeDesktopItem {
      type = "Application";
-      name = finalAttrs.pname;
+      name = "stegsolve";
      desktopName = "Stegsolve";
      comment = "A steganographic image analyzer, solver and data extractor for challanges";
-      exec = finalAttrs.pname;
+      exec = "stegsolve";
      categories = [ "Graphics" ];
    })
  ];
@@ -27,21 +27,21 @@ stdenv.mkDerivation (finalAttrs: {
  installPhase = ''
    runHook preInstall

-    mkdir -p $out/bin $out/share/${finalAttrs.pname}/
-    mv resources/app.asar* $out/share/${finalAttrs.pname}/
+    mkdir -p $out/bin $out/share/stretchly/
+    mv resources/app.asar* $out/share/stretchly/

    mkdir -p $out/share/applications
    ln -s ${finalAttrs.desktopItem}/share/applications/* $out/share/applications/

-    makeWrapper ${electron}/bin/electron $out/bin/${finalAttrs.pname} \
-      --add-flags $out/share/${finalAttrs.pname}/app.asar
+    makeWrapper ${electron}/bin/electron $out/bin/stretchly \
+      --add-flags $out/share/stretchly/app.asar

    runHook postInstall
  '';

  desktopItem = makeDesktopItem {
-    name = finalAttrs.pname;
-    exec = finalAttrs.pname;
+    name = "stretchly";
+    exec = "stretchly";
    icon = finalAttrs.icon;
    desktopName = "Stretchly";
    genericName = "Stretchly";
@@ -51,10 +51,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  installPhase = ''
    runHook preInstall

-    mkdir -p $out/{bin,lib/${finalAttrs.pname}}
-    mv {dist,node_modules} $out/lib/${finalAttrs.pname}
-    chmod a+x $out/lib/${finalAttrs.pname}/dist/index.js
-    ln -s $out/lib/${finalAttrs.pname}/dist/index.js $out/bin/stylelint-lsp
+    mkdir -p $out/{bin,lib/stylelint-lsp}
+    mv {dist,node_modules} $out/lib/stylelint-lsp
+    chmod a+x $out/lib/stylelint-lsp/dist/index.js
+    ln -s $out/lib/stylelint-lsp/dist/index.js $out/bin/stylelint-lsp

    runHook postInstall
  '';
@@ -75,13 +75,13 @@ stdenv.mkDerivation (finalAttrs: {

    for i in 16 24 48 64 96 128 256 512; do
      mkdir -p $out/share/icons/hicolor/''${i}x''${i}/apps
-      magick scribbleres/write_512.png -resize ''${i}x''${i} $out/share/icons/hicolor/''${i}x''${i}/apps/${finalAttrs.pname}.png
+      magick scribbleres/write_512.png -resize ''${i}x''${i} $out/share/icons/hicolor/''${i}x''${i}/apps/styluslabs-write.png
    done

    install -Dm444 scribbleres/linux/Write.desktop -t $out/share/applications
    substituteInPlace $out/share/applications/Write.desktop \
        --replace-fail 'Exec=/opt/Write/Write' 'Exec=Write' \
-        --replace-fail 'Icon=Write144x144' 'Icon=${finalAttrs.pname}'
+        --replace-fail 'Icon=Write144x144' 'Icon=styluslabs-write'
  '';

  enableParallelBuilding = true;
@@ -31,13 +31,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "swayimg";
-  version = "4.0";
+  version = "4.1";

  src = fetchFromGitHub {
    owner = "artemsen";
    repo = "swayimg";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2UmaU60+5NNj2CVJt4oJXyBPjVeA0zBfEqZOOSI2vvk=";
+    hash = "sha256-xwhEt+FhHPgfXJL1zTPsMD8ia5s+rr/eIJLlAlG8QzY=";
  };

  strictDeps = true;
@@ -19,6 +19,7 @@
  gettext,
  texinfo,
  libtool,
+  nixosTests,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -109,6 +110,8 @@ stdenv.mkDerivation (finalAttrs: {

  checkTarget = "check";

+  passthru.tests = nixosTests.taler.basic;
+
  meta = {
    description = "Exchange component for the GNU Taler electronic payment system";
    longDescription = ''
@@ -14,6 +14,7 @@
  libgcrypt,
  texinfo,
  curl,
+  nixosTests,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -82,6 +83,14 @@ stdenv.mkDerivation (finalAttrs: {
    done
  '';

+  postFixup = ''
+    # - taler-merchant-dbinit expects `versioning.sql` under `share/taler/sql`
+    # - taler-merchant-httpd expects `share/taler/merchant/templates`
+    mkdir -p $out/share/taler/sql
+    ln -s $out/share/taler-merchant $out/share/taler/merchant
+    ln -s $out/share/taler-merchant/sql $out/share/taler/sql/merchant
+  '';
+
  enableParallelBuilding = true;

  doInstallCheck = true;
@@ -90,6 +99,8 @@ stdenv.mkDerivation (finalAttrs: {

  checkTarget = "check";

+  passthru.tests = nixosTests.taler.basic;
+
  meta = {
    description = "Merchant component for the GNU Taler electronic payment system";
    longDescription = ''
@@ -95,6 +95,11 @@ stdenv.mkDerivation (finalAttrs: {
    done
  '';

+  postFixup = ''
+    # else it fails to find the python interpreter
+    patchShebangs --build $out/bin/taler-helper-sqlite3
+  '';
+
  env.ESBUILD_BINARY_PATH = lib.getExe esbuild';

  meta = {
@@ -13,17 +13,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "tasks";
-  version = "0.1.1";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "cosmic-utils";
    repo = "tasks";
    tag = version;
-    hash = "sha256-OKXkAJ+TyMnTzvlUPwPU2MWgCTIN3cDiPcVPOzU4WEg=";
+    hash = "sha256-R8wXIw9Gn4uyLoXxyjp/bcK8vK7NkG/chcHe8LtTvo8=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-3SbqKB9DI1Bl8u8rrAPCO/sPKMByYhQ3YT63K5BDVvE=";
+  cargoHash = "sha256-iJutA18TvsWJceacfhzfEQa5zaQBMVC7fmtF1uPN3sQ=";

  nativeBuildInputs = [
    libcosmicAppHook
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {

  installPhase = ''
    runHook preInstall
-    install -Dm0755 -t "$out/bin/" "build/${finalAttrs.pname}"
+    install -Dm0755 -t "$out/bin/" "build/texpresso"
    runHook postInstall
  '';

--- a/Show More
+++ b/Show More