staging-next 2025-08-10 (#432489)

doc/languages-frameworks/agda.section.md

@@ -125,11 +125,10 @@ To install Agda without GHC, use `ghc = null;`.
 
 ## Writing Agda packages {#writing-agda-packages}
 
-To write a nix derivation for an Agda library, first check that the library has a `*.agda-lib` file.
+To write a nix derivation for an Agda library, first check that the library has a (single) `*.agda-lib` file.
 
 A derivation can then be written using `agdaPackages.mkDerivation`. This has similar arguments to `stdenv.mkDerivation` with the following additions:
 
-* `everythingFile` can be used to specify the location of the `Everything.agda` file, defaulting to `./Everything.agda`. If this file does not exist then either it should be patched in or the `buildPhase` should be overridden (see below).
 * `libraryName` should be the name that appears in the `*.agda-lib` file, defaulting to `pname`.
 * `libraryFile` should be the file name of the `*.agda-lib` file, defaulting to `${libraryName}.agda-lib`.
 
@@ -150,9 +149,9 @@ agdaPackages.mkDerivation {
 
 ### Building Agda packages {#building-agda-packages}
 
-The default build phase for `agdaPackages.mkDerivation` runs `agda` on the `Everything.agda` file.
+The default build phase for `agdaPackages.mkDerivation` runs `agda --build-library`.
 If something else is needed to build the package (e.g. `make`) then the `buildPhase` should be overridden.
-Additionally, a `preBuild` or `configurePhase` can be used if there are steps that need to be done prior to checking the `Everything.agda` file.
+Additionally, a `preBuild` or `configurePhase` can be used if there are steps that need to be done prior to checking the library.
 `agda` and the Agda libraries contained in `buildInputs` are made available during the build phase.
 
 ### Installing Agda packages {#installing-agda-packages}
@@ -180,7 +179,7 @@ the Agda package set is small and can (still) be maintained by hand.
 
 ### Adding Agda packages to Nixpkgs {#adding-agda-packages-to-nixpkgs}
 
-To add an Agda package to `nixpkgs`, the derivation should be written to `pkgs/development/libraries/agda/${library-name}/` and an entry should be added to `pkgs/top-level/agda-packages.nix`. Here it is called in a scope with access to all other Agda libraries, so the top line of the `default.nix` can look like:
+To add an Agda package to `nixpkgs`, the derivation should be written to `pkgs/development/libraries/agda/${library-name}/default.nix` and an entry should be added to `pkgs/top-level/agda-packages.nix`. Here it is called in a scope with access to all other Agda libraries, so the derivation could look like:
 
 ```nix
 {
@@ -188,45 +187,29 @@ To add an Agda package to `nixpkgs`, the derivation should be written to `pkgs/d
   standard-library,
   fetchFromGitHub,
 }:
-{ }
+
+mkDerivation {
+  pname = "my-library";
+  version = "1.0";
+  src = <...>;
+  buildInputs = [ standard-library ];
+  meta = <...>;
+}
 ```
 
+You can look at other files under `pkgs/development/libraries/agda/` for more inspiration.
+
 Note that the derivation function is called with `mkDerivation` set to `agdaPackages.mkDerivation`, therefore you
 could use a similar set as in your `default.nix` from [Writing Agda Packages](#writing-agda-packages) with
 `agdaPackages.mkDerivation` replaced with `mkDerivation`.
 
-Here is an example skeleton derivation for iowa-stdlib:
-
-```nix
-mkDerivation {
-  version = "1.5.0";
-  pname = "iowa-stdlib";
-
-  src = <...>;
-
-  libraryFile = "";
-  libraryName = "IAL-1.3";
-
-  buildPhase = ''
-    runHook preBuild
-
-    patchShebangs find-deps.sh
-    make
-
-    runHook postBuild
-  '';
-}
-```
-
-This library has a file called `.agda-lib`, and so we give an empty string to `libraryFile` as nothing precedes `.agda-lib` in the filename. This file contains `name: IAL-1.3`, and so we let `libraryName =  "IAL-1.3"`. This library does not use an `Everything.agda` file and instead has a Makefile, so there is no need to set `everythingFile` and we set a custom `buildPhase`.
-
 When writing an Agda package it is essential to make sure that no `.agda-lib` file gets added to the store as a single file (for example by using `writeText`). This causes Agda to think that the nix store is a Agda library and it will attempt to write to it whenever it typechecks something. See [https://github.com/agda/agda/issues/4613](https://github.com/agda/agda/issues/4613).
 
 In the pull request adding this library,
 you can test whether it builds correctly by writing in a comment:
 
 ```
-@ofborg build agdaPackages.iowa-stdlib
+@ofborg build agdaPackages.my-library
 ```
 
 ### Maintaining Agda packages {#agda-maintaining-packages}

doc/release-notes/rl-2511.section.md

@@ -27,11 +27,12 @@
 - `space-orbit` package has been removed due to lack of upstream maintenance. Debian upstream stopped tracking it in 2011.
 
 - Derivations setting both `separateDebugInfo` and one of `allowedReferences`, `allowedRequistes`, `disallowedReferences` or `disallowedRequisites` must now set `__structuredAttrs` to `true`. The effect of reference whitelisting or blacklisting will be disabled on the `debug` output created by `separateDebugInfo`.
-
 - `victoriametrics` no longer contains VictoriaLogs components. These have been separated into the new package `victorialogs`.
 
 - `mx-puppet-discord` was removed from nixpkgs along with its NixOS module as it was unmaintained and was the only user of sha1 hashes in tree.
 
+- `kbd` package's `outputs` now include a `man` and `scripts` outputs. The `unicode_start` and `unicode_stop` Bash scripts are now part of the `scripts` output, allowing most usages of the `kbd` package to not pull in `bash`.
+
 - `conduwuit` was removed due to upstream ceasing development and deleting their repository. For existing data, a migration to `matrix-conduit`, `matrix-continuwuity` or `matrix-tuwunel` may be possible.
 
 - `gnome-keyring` no longer ships with an SSH agent anymore because it has been deprecated upstream. You should use `gcr_4` instead, which provides the same features. More information on why this was done can be found on [the relevant GCR upstream PR](https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/67).
@@ -109,6 +110,8 @@
 
 - `meta.mainProgram`: Changing this `meta` entry can lead to a package rebuild due to being used to determine the `NIX_MAIN_PROGRAM` environment variable.
 
+- `lisp-modules` were brought in sync with the [June 2025 Quicklisp release](http://blog.quicklisp.org/2025/07/june-2025-quicklisp-dist-now-available.html).
+
 - `searx` was updated to use `envsubst` instead of `sed` for parsing secrets from environment variables.
   If your previous configuration included a secret reference like `server.secret_key = "@SEARX_SECRET_KEY@"`, you must migrate to the new envsubst syntax: `server.secret_key = "$SEARX_SECRET_KEY"`.
 

lib/default.nix

@@ -287,7 +287,6 @@ let
         init
         crossLists
         unique
-        uniqueStrings
         allUnique
         intersectLists
         subtractLists

lib/licenses.nix

@@ -713,6 +713,16 @@ lib.mapAttrs mkLicense (
       spdxId = "HPND-sell-variant";
     };
 
+    hpndDoc = {
+      fullName = "Historical Permission Notice and Disclaimer - documentation variant";
+      spdxId = "HPND-doc";
+    };
+
+    hpndDocSell = {
+      fullName = "Historical Permission Notice and Disclaimer - documentation sell variant";
+      spdxId = "HPND-doc-sell";
+    };
+
     hpndUc = {
       spdxId = "HPND-UC";
       fullName = "Historical Permission Notice and Disclaimer - University of California variant";
@@ -1305,6 +1315,14 @@ lib.mapAttrs mkLicense (
       # Marc Weber (small nix contributor)
     };
 
+    tekHvcLicense = {
+      fullName = "TekHVC License";
+      url = "https://gitlab.freedesktop.org/xorg/lib/libx11/-/blob/7f8305c779ac6948d7261764f5ffb8ae9aa975b1/COPYING#L138-171";
+      # TODO: add spdxId when it gets accepted to spdx
+      # https://tools.spdx.org/app/license_requests/458
+      # https://github.com/spdx/license-list-XML/issues/2757
+    };
+
     tsl = {
       shortName = "TSL";
       fullName = "Timescale License Agreegment";

lib/lists.nix

@@ -11,7 +11,7 @@ let
     warn
     pipe
     ;
-  inherit (lib.attrsets) mapAttrs attrNames;
+  inherit (lib.attrsets) mapAttrs;
   inherit (lib) max;
 in
 rec {
@@ -1839,10 +1839,6 @@ rec {
   /**
     Remove duplicate elements from the `list`. O(n^2) complexity.
 
-    :::{.note}
-    If the list only contains strings and order is not important, the complexity can be reduced to O(n log n) by using [`lib.lists.uniqueStrings`](#function-library-lib.lists.uniqueStrings) instead.
-    :::
-
     # Inputs
 
     `list`
@@ -1868,43 +1864,6 @@ rec {
   */
   unique = foldl' (acc: e: if elem e acc then acc else acc ++ [ e ]) [ ];
 
-  /**
-    Removes duplicate strings from the `list`. O(n log n) complexity.
-
-    :::{.note}
-    Order is not preserved.
-
-    All elements of the list must be strings without context.
-
-    This function fails when the list contains a non-string element or a [string with context](https://nix.dev/manual/nix/latest/language/string-context.html).
-    In that case use [`lib.lists.unique`](#function-library-lib.lists.unique) instead.
-    :::
-
-    # Inputs
-
-    `list`
-
-    : List of strings
-
-    # Type
-
-    ```
-    uniqueStrings :: [ String ] -> [ String ]
-    ```
-
-    # Examples
-    :::{.example}
-    ## `lib.lists.uniqueStrings` usage example
-
-    ```nix
-    uniqueStrings [ "foo" "bar" "foo" ]
-    => [ "bar" "foo" ] # order is not preserved
-    ```
-
-    :::
-  */
-  uniqueStrings = list: attrNames (groupBy id list);
-
   /**
     Check if list contains only unique elements. O(n^2) complexity.
 

lib/systems/default.nix

@@ -563,6 +563,51 @@ let
           # See https://go.dev/wiki/GoArm
           GOARM = toString (lib.intersectLists [ (final.parsed.cpu.version or "") ] [ "5" "6" "7" ]);
         };
+
+        node = {
+          # See these locations for a list of known architectures/platforms:
+          # - https://nodejs.org/api/os.html#osarch
+          # - https://nodejs.org/api/os.html#osplatform
+          arch =
+            if final.isAarch then
+              "arm" + lib.optionalString final.is64bit "64"
+            else if final.isMips32 then
+              "mips" + lib.optionalString final.isLittleEndian "el"
+            else if final.isMips64 && final.isLittleEndian then
+              "mips64el"
+            else if final.isPower then
+              "ppc" + lib.optionalString final.is64bit "64"
+            else if final.isx86_64 then
+              "x64"
+            else if final.isx86_32 then
+              "ia32"
+            else if final.isS390x then
+              "s390x"
+            else if final.isRiscV64 then
+              "riscv64"
+            else if final.isLoongArch64 then
+              "loong64"
+            else
+              null;
+
+          platform =
+            if final.isAndroid then
+              "android"
+            else if final.isDarwin then
+              "darwin"
+            else if final.isFreeBSD then
+              "freebsd"
+            else if final.isLinux then
+              "linux"
+            else if final.isOpenBSD then
+              "openbsd"
+            else if final.isSunOS then
+              "sunos"
+            else if final.isWindows then
+              "win32"
+            else
+              null;
+        };
       };
     in
     assert final.useAndroidPrebuilt -> final.isAndroid;

lib/tests/misc.nix

@@ -113,7 +113,6 @@ let
     toIntBase10
     toShellVars
     types
-    uniqueStrings
     updateManyAttrsByPath
     versions
     xor
@@ -1941,69 +1940,6 @@ runTests {
     expected = false;
   };
 
-  testUniqueStrings_empty = {
-    expr = uniqueStrings [ ];
-    expected = [ ];
-  };
-  testUniqueStrings_singles = {
-    expr = uniqueStrings [
-      "all"
-      "unique"
-      "already"
-    ];
-    expected = [
-      "all"
-      "already"
-      "unique"
-    ];
-  };
-  testUniqueStrings_allDuplicates = {
-    expr = uniqueStrings [
-      "dup"
-      "dup"
-      "dup"
-    ];
-    expected = [ "dup" ];
-  };
-  testUniqueStrings_some_duplicates = {
-    expr = uniqueStrings [
-      "foo"
-      "foo"
-      "bar"
-      "bar"
-      "baz"
-    ];
-    expected = [
-      "bar"
-      "baz"
-      "foo"
-    ];
-  };
-  testUniqueStrings_unicode = {
-    expr = uniqueStrings [
-      "café"
-      "@"
-      "#"
-      "@"
-      "#"
-      "$"
-      "😎"
-      "😎"
-      "🙃"
-      ""
-      ""
-    ];
-    expected = [
-      ""
-      "#"
-      "$"
-      "@"
-      "café"
-      "😎"
-      "🙃"
-    ];
-  };
-
   # ATTRSETS
 
   testConcatMapAttrs = {

maintainers/scripts/haskell/merge-and-open-pr.sh

@@ -80,13 +80,7 @@ echo "Merging https://github.com/NixOS/nixpkgs/pull/${curr_haskell_updates_pr_nu
 gh pr merge --repo NixOS/nixpkgs --merge "$curr_haskell_updates_pr_num"
 
 # Update stackage, Hackage hashes, and regenerate Haskell package set
-echo "Updating Stackage..."
-./maintainers/scripts/haskell/update-stackage.sh --do-commit
-echo "Updating Hackage hashes..."
-./maintainers/scripts/haskell/update-hackage.sh --do-commit
-echo "Regenerating Hackage packages..."
-# Using fast here because after the hackage-update eval errors will likely break the transitive dependencies check.
-./maintainers/scripts/haskell/regenerate-hackage-packages.sh --fast --do-commit
+./maintainers/scripts/haskell/update-package-set.sh
 
 # Push these new commits to the haskell-updates branch
 echo "Pushing commits just created to the remote $push_remote/haskell-updates branch..."

maintainers/scripts/haskell/regenerate-hackage-packages.sh

@@ -107,10 +107,10 @@ nixfmt pkgs/development/haskell-modules/hackage-packages.nix
 if [[ "$DO_COMMIT" -eq 1 ]]; then
 git add pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
 git add pkgs/development/haskell-modules/hackage-packages.nix
-git commit -F - << EOF
+git commit --edit -F - << EOF
 haskellPackages: regenerate package set based on current config
 
-This commit has been generated by maintainers/scripts/haskell/regenerate-hackage-packages.sh
+(generated by maintainers/scripts/haskell/regenerate-hackage-packages.sh)
 EOF
 fi
 

maintainers/scripts/haskell/update-hackage.sh

@@ -1,10 +1,34 @@
 #! /usr/bin/env nix-shell
 #! nix-shell -i bash -p curl jq git gnused -I nixpkgs=.
-
-# See regenerate-hackage-packages.sh for details on the purpose of this script.
+#
+# SYNOPSIS
+#
+#   Update Hackage index and hashes data exposed via pkgs.all-cabal-hashes.
+#
+# DESCRIPTION
+#
+#   Find latest revision of the commercialhaskell/all-cabal-hashes repository's
+#   hackage branch and update pkgs/data/misc/hackage/pin.json accordingly.
+#
+#   This data is used by hackage2nix to generate hackage-packages.nix. Since
+#   hackage2nix uses the latest version of a package unless an explicit
+#   constraint is configured, running this script indirectly updates packages
+#   (when hackage2nix is executed afterwards).
+#
+#   Prints a version difference to stdout if the pin has been updated, nothing
+#   otherwise.
+#
+# EXIT STATUS
+#
+#   Always exit with zero (even if nothing changed) unless there was an error.
 
 set -euo pipefail
 
+if [[ "${1:-}" == "--do-commit" ]]; then
+  echo "$0: --do-commit is no longer supported. Use update-package-set.sh instead."
+  exit 100
+fi
+
 pin_file=pkgs/data/misc/hackage/pin.json
 current_commit="$(jq -r .commit $pin_file)"
 old_date="$(jq -r .msg $pin_file | sed 's/Update from Hackage at //')"
@@ -14,6 +38,7 @@ commit_msg="$(echo "$git_info" | jq -r .commit.commit.message)"
 new_date="$(echo "$commit_msg" | sed 's/Update from Hackage at //')"
 
 if [ "$current_commit" != "$head_commit" ]; then
+   echo "Updating all-cabal-hashes from $old_date to $new_date" >&2
    url="https://github.com/commercialhaskell/all-cabal-hashes/archive/$head_commit.tar.gz"
    hash="$(nix-prefetch-url "$url")"
    jq -n \
@@ -23,13 +48,9 @@ if [ "$current_commit" != "$head_commit" ]; then
      --arg commit_msg "$commit_msg" \
      '{commit: $commit, url: $url, sha256: $hash, msg: $commit_msg}' \
      > $pin_file
+else
+   echo "No new all-cabal-hashes version" >&2
+   exit 0
 fi
 
-if [[ "${1:-}" == "--do-commit" ]]; then
-git add pkgs/data/misc/hackage/pin.json
-git commit -F - << EOF
-all-cabal-hashes: $old_date -> $new_date
-
-This commit has been generated by maintainers/scripts/haskell/update-hackage.sh
-EOF
-fi
+echo "$old_date -> $new_date"

maintainers/scripts/haskell/update-package-set.sh

@@ -0,0 +1,53 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash
+#! nix-shell -p git -I nixpkgs=.
+set -euo pipefail
+
+filesToStage=(
+  'pkgs/data/misc/hackage/pin.json'
+  'pkgs/development/haskell-modules/configuration-hackage2nix/stackage.yaml'
+  'pkgs/development/haskell-modules/hackage-packages.nix'
+)
+
+if ! git diff --quiet --cached; then
+  echo "Please commit staged changes before running $0" >&2
+  exit 100
+fi
+
+if ! git diff --quiet -- "${filesToStage[@]}"; then
+  echo -n "Please commit your changes to the following files before running $0: " >&2
+  echo    "${filesToStage[@]}" >&2
+  exit 100
+fi
+
+stackage_diff="$(./maintainers/scripts/haskell/update-stackage.sh)"
+hackage_diff="$(./maintainers/scripts/haskell/update-hackage.sh)"
+readonly stackage_diff hackage_diff
+
+# Prefer Stackage version diff in the commit header, fall back to Hackage
+if [[ -n "$stackage_diff" ]]; then
+  commit_message="haskellPackages: stackage $stackage_diff"
+  if [[ -n "$hackage_diff" ]]; then
+    commit_message="$commit_message
+
+all-cabal-hashes: $hackage_diff"
+  fi
+elif [[ -n "$hackage_diff" ]]; then
+  commit_message="haskellPackages: hackage $hackage_diff
+
+all-cabal-hashes: $hackage_diff"
+else
+  echo "Neither Hackage nor Stackage changed. Nothing to do." >&2
+  exit 0
+fi
+
+commit_message="$commit_message
+
+(generated by maintainers/scripts/haskell/update-package-set.sh)"
+
+# Using fast here because after the hackage-update eval errors will likely break the transitive dependencies check.
+./maintainers/scripts/haskell/regenerate-hackage-packages.sh --fast
+
+# A --do-commit flag probably doesn't make much sense
+git add -- "${filesToStage[@]}"
+git commit -m "$commit_message"

maintainers/scripts/haskell/update-stackage.sh

@@ -1,9 +1,36 @@
 #! /usr/bin/env nix-shell
 #! nix-shell -i bash -p curl jq git gnused gnugrep -I nixpkgs=.
 # shellcheck shell=bash
+#
+# SYNOPSIS
+#
+#   Update version constraints in hackage2nix config file from Stackage.
+#
+# DESCRIPTION
+#
+#   Fetches the latest snapshot of the configured Stackage solver which is
+#   configured via the SOLVER (either LTS or Nightly) and VERSION variables in
+#   the script.
+#
+#   VERSION is only applicable if SOLVER is LTS. SOLVER=LTS and VERSION=22
+#   will cause update-stackage.sh to fetch the latest LTS-22.XX version.
+#   If empty, the latest version of the solver is used.
+#
+#   If the configuration file has been updated, update-stackage.sh prints a
+#   version difference to stdout, e.g. 23.11 -> 23.13. Otherwise, stdout remains
+#   empty.
+#
+# EXIT STATUS
+#
+#   Always exit with zero (even if nothing changed) unless there was an error.
 
 set -eu -o pipefail
 
+if [[ "${1:-}" == "--do-commit" ]]; then
+  echo "$0: --do-commit is no longer supported. Use update-package-set.sh instead."
+  exit 100
+fi
+
 # Stackage solver to use, LTS or Nightly
 # (should be capitalized like the display name)
 SOLVER=LTS
@@ -31,11 +58,11 @@ old_version=$(grep '^# Stackage' $stackage_config | sed -e 's/.\+ \([A-Za-z]\+ [
 version="$SOLVER $(sed -rn "s/^--.*http:..(www.)?stackage.org.snapshot.$(toLower "$SOLVER")-//p" "$tmpfile")"
 
 if [[ "$old_version" == "$version" ]]; then
-   echo "No new stackage version"
+   echo "No new stackage version" >&2
    exit 0 # Nothing to do
 fi
 
-echo "Updating Stackage from $old_version to $version."
+echo "Updating Stackage from $old_version to $version." >&2
 
 # Create a simple yaml version of the file.
 sed -r \
@@ -78,11 +105,4 @@ sed -r \
 # ShellCheck: latest version of command-line dev tool.
 # Agda: The Agda community is fast-moving; we strive to always include the newest versions of Agda and the Agda packages in nixpkgs.
 
-if [[ "${1:-}" == "--do-commit" ]]; then
-git add $stackage_config
-git commit -F - << EOF
-haskellPackages: stackage $old_version -> $version
-
-This commit has been generated by maintainers/scripts/haskell/update-stackage.sh
-EOF
-fi
+echo "$old_version -> $version"

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -166,6 +166,8 @@
 
 - `command-not-found` package is now disabled by default; it works only for nix-channels based systems, and requires setup for it to work.
 
+- The systemd target `kbrequest.target` is now unset by default, instead of being forcibly symlinked to `rescue.target`. In case you were relying on this behavior (Alt + ArrowUp on the tty causing the current target to be changed to `rescue.target`), you can restore it by setting `systemd.targets.rescue.aliases = [ "kbrequest.target" ];` in your configuration.
+
 ## Other Notable Changes {#sec-release-25.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/lib/systemd-lib.nix

@@ -524,7 +524,6 @@ rec {
           # Stupid misc. symlinks.
           ln -s ${cfg.defaultUnit} $out/default.target
           ln -s ${cfg.ctrlAltDelUnit} $out/ctrl-alt-del.target
-          ln -s rescue.target $out/kbrequest.target
 
           ln -s ../remote-fs.target $out/multi-user.target.wants/
         ''}

nixos/modules/security/pam.nix

@@ -1311,7 +1311,7 @@ let
                 name = "lastlog";
                 enable = cfg.updateWtmp;
                 control = "required";
-                modulePath = "${package}/lib/security/pam_lastlog.so";
+                modulePath = "${pkgs.util-linux.lastlog}/lib/security/pam_lastlog2.so";
                 settings = {
                   silent = true;
                 };
@@ -2311,6 +2311,29 @@ in
 
     environment.etc = lib.mapAttrs' makePAMService enabledServices;
 
+    systemd =
+      lib.optionalAttrs
+        (lib.any (service: service.updateWtmp) (lib.attrValues config.security.pam.services))
+        {
+          tmpfiles.packages = [ pkgs.util-linux.lastlog ]; # /lib/tmpfiles.d/lastlog2-tmpfiles.conf
+          services.lastlog2-import = {
+            enable = true;
+            wantedBy = [ "default.target" ];
+            after = [
+              "local-fs.target"
+              "systemd-tmpfiles-setup.service"
+            ];
+            # TODO: ${pkgs.util-linux.lastlog}/lib/systemd/system/lastlog2-import.service
+            # uses unpatched /usr/bin/mv, needs to be fixed on staging
+            # in the meantime, use a service drop-in here
+            serviceConfig.ExecStartPost = [
+              ""
+              "${lib.getExe' pkgs.coreutils "mv"} /var/log/lastlog /var/log/lastlog.migrated"
+            ];
+          };
+          packages = [ pkgs.util-linux.lastlog ]; # lib/systemd/system/lastlog2-import.service
+        };
+
     security.pam.services = {
       other.text = ''
         auth     required pam_warn.so

nixos/modules/system/boot/systemd/sysupdate.nix

@@ -11,7 +11,14 @@ let
 
   format = pkgs.formats.ini { listToValue = toString; };
 
-  definitionsDirectory = utils.systemdUtils.lib.definitions "sysupdate.d" format cfg.transfers;
+  # TODO: Switch back to using utils.systemdUtils.lib.definitions once
+  # https://github.com/systemd/systemd/pull/38187 is resolved. Also ensure
+  # utils.systemdUtils.lib.definitions is capable of setting a custom file
+  # suffix.
+  sysupdateTransfers = lib.mapAttrs' (name: value: {
+    name = "sysupdate.d/${name}.transfer";
+    value.source = format.generate "${name}.transfer" value;
+  }) cfg.transfers;
 in
 {
   options.systemd.sysupdate = {
@@ -114,14 +121,23 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = config.systemd.package.withSysupdate;
+        message = "Cannot enable systemd-sysupdate with systemd package not built with sysupdate support";
+      }
+    ];
 
     systemd.additionalUpstreamSystemUnits = [
       "systemd-sysupdate.service"
       "systemd-sysupdate.timer"
       "systemd-sysupdate-reboot.service"
       "systemd-sysupdate-reboot.timer"
+      "systemd-sysupdated.service"
     ];
 
+    systemd.services.systemd-sysupdated.aliases = [ "dbus-org.freedesktop.sysupdate1.service" ];
+
     systemd.timers = {
       "systemd-sysupdate" = {
         wantedBy = [ "timers.target" ];
@@ -133,8 +149,11 @@ in
       };
     };
 
-    environment.etc."sysupdate.d".source = definitionsDirectory;
+    environment.etc = sysupdateTransfers;
   };
 
-  meta.maintainers = with lib.maintainers; [ nikstur ];
+  meta.maintainers = with lib.maintainers; [
+    nikstur
+    jmbaur
+  ];
 }

nixos/tests/all-tests.nix

@@ -1135,6 +1135,7 @@ in
   packagekit = runTest ./packagekit.nix;
   paisa = runTest ./paisa.nix;
   pam-file-contents = runTest ./pam/pam-file-contents.nix;
+  pam-lastlog = runTest ./pam/pam-lastlog.nix;
   pam-oath-login = runTest ./pam/pam-oath-login.nix;
   pam-u2f = runTest ./pam/pam-u2f.nix;
   pam-ussh = runTest ./pam/pam-ussh.nix;

nixos/tests/pam/pam-lastlog.nix

@@ -0,0 +1,30 @@
+{ ... }:
+
+{
+  name = "pam-lastlog";
+
+  nodes.machine =
+    { ... }:
+    {
+      # we abuse run0 for a quick login as root as to not require setting up accounts and passwords
+      security.pam.services.systemd-run0 = {
+        updateWtmp = true; # enable lastlog
+      };
+    };
+
+  testScript = ''
+    with subtest("Test legacy lastlog import"):
+      # create old lastlog file to test import
+      # empty = nothing will actually be imported, but the service will run
+      machine.succeed("touch /var/log/lastlog")
+      machine.wait_for_unit("lastlog2-import.service")
+      machine.succeed("journalctl -b --grep 'Starting Import lastlog data into lastlog2 database'")
+      machine.succeed("stat /var/log/lastlog.migrated")
+
+    with subtest("Test lastlog entries are created by logins"):
+      machine.wait_for_unit("multi-user.target")
+      machine.succeed("run0 --pty true") # perform full login
+      print(machine.succeed("lastlog2 --active --user root"))
+      machine.succeed("stat /var/lib/lastlog/lastlog2.db")
+  '';
+}

nixos/tests/systemd-sysupdate.nix

@@ -1,7 +1,7 @@
 # Tests downloading a signed update artifact from a server to a target machine.
 # This test does not rely on the `systemd.timer` units provided by the
-# `systemd-sysupdate` module but triggers the `systemd-sysupdate` service
-# manually to make the test more robust.
+# `systemd-sysupdate` module but triggers the `updatectl` tool directly to
+# demonstrate how to initiate updates manually.
 
 { lib, pkgs, ... }:
 
@@ -62,7 +62,8 @@ in
   testScript = ''
     server.wait_for_unit("nginx.service")
 
-    target.succeed("systemctl start systemd-sysupdate")
+    print(target.succeed("updatectl list"))
+    target.succeed("updatectl update")
     assert "nixos" in target.wait_until_succeeds("cat /nixos_1.txt", timeout=5)
   '';
 }

pkgs/applications/blockchains/bitcoin-knots/default.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchFromGitHub,
   autoreconfHook,
   pkg-config,
   util-linux,
@@ -22,30 +21,20 @@
   python3,
   withGui,
   withWallet ? true,
-  gnupg,
-  # Signatures from the following GPG public keys checked during verification of the source code.
-  # The list can be found at https://github.com/bitcoinknots/guix.sigs/tree/knots/builder-keys
-  builderKeys ? [
-    "1A3E761F19D2CC7785C5502EA291A2C45D0C504A" # luke-jr.gpg
-    "32FE1E61B1C711186CA378DEFD8981F1BC41ABB9" # oomahq.gpg
-    "CACC7CBB26B3D2EE8FC2F2BC0E37EBAB8574F005" # leo-haf.gpg
-  ],
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation rec {
   pname = if withGui then "bitcoin-knots" else "bitcoind-knots";
   version = "28.1.knots20250305";
 
   src = fetchurl {
-    url = "https://bitcoinknots.org/files/28.x/${finalAttrs.version}/bitcoin-${finalAttrs.version}.tar.gz";
-    # hash retrieved from signed SHA256SUMS
+    url = "https://bitcoinknots.org/files/28.x/${version}/bitcoin-${version}.tar.gz";
     hash = "sha256-DKO3+43Tn/BTKQVrLrCkeMtzm8SfbaJD8rPlb6lDA8A=";
   };
 
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
-    gnupg
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ util-linux ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ hexdump ]
@@ -69,58 +58,11 @@ stdenv.mkDerivation (finalAttrs: {
     qttools
   ];
 
-  preUnpack =
-    let
-      majorVersion = lib.versions.major finalAttrs.version;
-
-      publicKeys = fetchFromGitHub {
-        owner = "bitcoinknots";
-        repo = "guix.sigs";
-        rev = "b998306d462f39b6077518521700d7156fec76b8";
-        sha256 = "sha256-q4tumAfTr828AZNOa9ia7Y0PYoe6W47V/7SEApTzl3w=";
-      };
-
-      checksums = fetchurl {
-        url = "https://bitcoinknots.org/files/${majorVersion}.x/${finalAttrs.version}/SHA256SUMS";
-        hash = "sha256-xWJKaZBLm9H6AuMBSC21FLy/5TRUI0AQVIUF/2PvDhs=";
-      };
-
-      signatures = fetchurl {
-        url = "https://bitcoinknots.org/files/${majorVersion}.x/${finalAttrs.version}/SHA256SUMS.asc";
-        hash = "sha256-SywdBEzZqsf2aDeOs7J9n513RTCm+TJA/QYP5+h7Ifo=";
-      };
-
-      verifyBuilderKeys =
-        let
-          script = publicKey: ''
-            echo "Checking if public key ${publicKey} signed the checksum file..."
-            grep "^\[GNUPG:\] VALIDSIG .* ${publicKey}$" verify.log > /dev/null
-            echo "OK"
-          '';
-        in
-        builtins.concatStringsSep "\n" (builtins.map script builderKeys);
-    in
-    ''
-      pushd $(mktemp -d)
-      export GNUPGHOME=$PWD/gnupg
-      mkdir -m 700 -p $GNUPGHOME
-      gpg --no-autostart --batch --import ${publicKeys}/builder-keys/*
-      ln -s ${checksums} ./SHA256SUMS
-      ln -s ${signatures} ./SHA256SUMS.asc
-      ln -s $src ./bitcoin-${finalAttrs.version}.tar.gz
-      gpg --no-autostart --batch --verify --status-fd 1 SHA256SUMS.asc SHA256SUMS > verify.log
-      ${verifyBuilderKeys}
-      grep bitcoin-${finalAttrs.version}.tar.gz SHA256SUMS > SHA256SUMS.filtered
-      echo "Verifying the checksum of bitcoin-${finalAttrs.version}.tar.gz..."
-      sha256sum -c SHA256SUMS.filtered
-      popd
-    '';
-
   configureFlags = [
     "--with-boost-libdir=${boost.out}/lib"
     "--disable-bench"
   ]
-  ++ lib.optionals (!finalAttrs.doCheck) [
+  ++ lib.optionals (!doCheck) [
     "--disable-tests"
     "--disable-gui-tests"
   ]
@@ -148,7 +90,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Derivative of Bitcoin Core with a collection of improvements";
     homepage = "https://bitcoinknots.org/";
-    changelog = "https://github.com/bitcoinknots/bitcoin/blob/v${finalAttrs.version}/doc/release-notes.md";
+    changelog = "https://github.com/bitcoinknots/bitcoin/blob/v${version}/doc/release-notes.md";
     maintainers = with lib.maintainers; [
       prusnak
       mmahut
@@ -156,4 +98,4 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
   };
-})
+}

pkgs/applications/blockchains/bitcoin/default.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchFromGitHub,
   cmake,
   pkg-config,
   installShellFiles,
@@ -24,16 +23,6 @@
   withGui,
   withWallet ? true,
   enableTracing ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isStatic,
-  gnupg,
-  # Signatures from the following GPG public keys checked during verification of the source code.
-  # The list can be found at https://github.com/bitcoin-core/guix.sigs/tree/main/builder-keys
-  builderKeys ? [
-    "152812300785C96444D3334D17565732E08E5E41" # achow101.gpg
-    "9EDAFF80E080659604F4A76B2EBB056FD847F8A7" # Emzy.gpg
-    "71A3B16735405025D447E8F274810B012346C9A6" # laanwj.gpg
-    "6B002C6EA3F91B1B0DF0C9BC8F617F1200A6D25C" # glozow.gpg
-    "D1DBF2C4B96F2DEBF4C16654410108112E7EA81F" # hebasto.gpg
-  ],
 }:
 
 let
@@ -59,7 +48,6 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     pkg-config
     installShellFiles
-    gnupg
   ]
   ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
     autoSignDarwinBinariesHook
@@ -82,51 +70,6 @@ stdenv.mkDerivation (finalAttrs: {
     qttools
   ];
 
-  preUnpack =
-    let
-      publicKeys = fetchFromGitHub {
-        owner = "bitcoin-core";
-        repo = "guix.sigs";
-        rev = "a788388207bd244d5ab07b31ecd6c126f213a6c6";
-        sha256 = "sha256-gbenuEWP6pqY9ywPd/yZy6QfWI7jvSObwto27DRXjGI=";
-      };
-
-      checksums = fetchurl {
-        url = "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/SHA256SUMS";
-        hash = "sha256-lOwVH0UqIhOT0I9rAvswuqy+tZ8ZRhH0kGnn9VCbRv4=";
-      };
-
-      signatures = fetchurl {
-        url = "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/SHA256SUMS.asc";
-        hash = "sha256-s05cRmZ9aoPdSZTaz6D6qmVwX6OprqxynPn5vZQ7bbw=";
-      };
-
-      verifyBuilderKeys =
-        let
-          script = publicKey: ''
-            echo "Checking if public key ${publicKey} signed the checksum file..."
-            grep "^\[GNUPG:\] VALIDSIG .* ${publicKey}$" verify.log > /dev/null
-            echo "OK"
-          '';
-        in
-        builtins.concatStringsSep "\n" (builtins.map script builderKeys);
-    in
-    ''
-      pushd $(mktemp -d)
-      export GNUPGHOME=$PWD/gnupg
-      mkdir -m 700 -p $GNUPGHOME
-      gpg --no-autostart --batch --import ${publicKeys}/builder-keys/*
-      ln -s ${checksums} ./SHA256SUMS
-      ln -s ${signatures} ./SHA256SUMS.asc
-      ln -s $src ./bitcoin-${finalAttrs.version}.tar.gz
-      gpg --no-autostart --batch --verify --status-fd 1 SHA256SUMS.asc SHA256SUMS > verify.log
-      ${verifyBuilderKeys}
-      grep bitcoin-${finalAttrs.version}.tar.gz SHA256SUMS > SHA256SUMS.filtered
-      echo "Verifying the checksum of bitcoin-${finalAttrs.version}.tar.gz..."
-      sha256sum -c SHA256SUMS.filtered
-      popd
-    '';
-
   postInstall = ''
     cd ..
     installShellCompletion --bash contrib/completions/bash/bitcoin-cli.bash

pkgs/applications/editors/tiled/default.nix

@@ -28,14 +28,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "tiled";
-  # nixpkgs-update: no auto update
-  version = "1.11.2";
+  version = "1.11.90";
 
   src = fetchFromGitHub {
     owner = "mapeditor";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9oUKn51MQcsStgIJrp9XW5YAIpAUcO0kzfGnYA3gz/E=";
+    sha256 = "sha256-gGsozdFEE5c315DF+EsIY9wGv50wwrOBycejTkVwEHA=";
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/vim/common.nix

@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.1475";
+  version = "9.1.1566";
 
   outputs = [
     "out"
@@ -11,7 +11,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-KKUzS0dS9K/jlfP+igyLX1Fwjb7Y5ZAzGLjqHvkA3bs=";
+    hash = "sha256-/hzyjFGjl8Wu9tHtFgnnHtGbcJ5AIjCMUNCScrdIgwU=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vim/full.nix

@@ -26,6 +26,7 @@
   libXmu,
   libsodium,
   libICE,
+  wayland-scanner,
   vimPlugins,
   makeWrapper,
   wrapGAppsHook3,
@@ -33,6 +34,7 @@
   features ? "huge", # One of tiny, small, normal, big or huge
   wrapPythonDrv ? false,
   guiSupport ? config.vim.gui or (if stdenv.hostPlatform.isDarwin then "gtk2" else "gtk3"),
+  waylandSupport ? !stdenv.hostPlatform.isDarwin,
   luaSupport ? config.vim.lua or true,
   perlSupport ? config.vim.perl or false, # Perl interpreter
   pythonSupport ? config.vim.python or true, # Python interpreter
@@ -120,6 +122,7 @@ stdenv.mkDerivation {
     "--disable-nextaf_check"
     "--disable-carbon_check"
     "--disable-gtktest"
+    (lib.strings.enableFeature waylandSupport "wayland")
   ]
   ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "vim_cv_toupper_broken=no"
@@ -185,6 +188,7 @@ stdenv.mkDerivation {
   ]
   ++ lib.optional (guiSupport == "gtk2") gtk2-x11
   ++ lib.optional (guiSupport == "gtk3") gtk3-x11
+  ++ lib.optional waylandSupport wayland-scanner
   ++ lib.optional luaSupport lua
   ++ lib.optional pythonSupport python3
   ++ lib.optional tclSupport tcl

pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix

@@ -12,18 +12,18 @@
   pkgs,
 }:
 let
-  version = "0.0.27-unstable-2025-08-14";
+  version = "0.0.27-unstable-2025-08-06";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
-    rev = "be0937a459624ce1170f158f9d8660d0ade47eb4";
-    hash = "sha256-1NzzyWW2Tp91wa+Ujv2cDTv/Cb/HgA6LiDuwxVWdJwU=";
+    rev = "2fc63d4128d2dc2fef0913c7480b4586959ebe4e";
+    hash = "sha256-hHa300Ldszsnp6AuYVJwOFc5FfuRTd3phyM6/qBUIQo=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";
     inherit version src;
 
-    cargoHash = "sha256-pTWCT2s820mjnfTscFnoSKC37RE7DAPKxP71QuM+JXQ=";
+    cargoHash = "sha256-8mBpzndz34RrmhJYezd4hLrJyhVL4S4IHK3plaue1k8=";
 
     nativeBuildInputs = [
       pkg-config

pkgs/applications/emulators/libretro/cores/flycast.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2025-08-12";
+  version = "0-unstable-2025-08-01";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "33833cfd1ed2d94d907223442fdb8cdafd8d5d80";
-    hash = "sha256-6YXWJi3xbImfBMWILzsnwJGvj2XDoHcrWgLDPwaHfJs=";
+    rev = "40e400ab084175d3bd0f9e10cf8d6ac78c8b9544";
+    hash = "sha256-k/w1tmuGuRD98bR/kmc/9pLFGeobHMhKQapJOv8qVJo=";
     fetchSubmodules = true;
   };
 

pkgs/applications/graphics/gimp/2.0/default.nix

@@ -28,6 +28,7 @@
   libwmf,
   zlib,
   libzip,
+  xz,
   ghostscript,
   aalib,
   shared-mime-info,
@@ -133,6 +134,7 @@ stdenv.mkDerivation (finalAttrs: {
     libwmf
     zlib
     libzip
+    xz
     ghostscript
     aalib
     shared-mime-info

pkgs/applications/misc/googleearth-pro/default.nix

@@ -20,7 +20,7 @@
   fontconfig,
   dpkg,
   libproxy,
-  libxml2,
+  libxml2_13,
   gst_all_1,
   dbus,
   makeWrapper,
@@ -37,14 +37,6 @@ let
       "amd64"
     else
       throw "Unsupported system ${stdenv.hostPlatform.system} ";
-
-  libxml2' = libxml2.overrideAttrs rec {
-    version = "2.13.8";
-    src = fetchurl {
-      url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
-      hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo=";
-    };
-  };
 in
 mkDerivation rec {
   pname = "googleearth-pro";
@@ -78,7 +70,7 @@ mkDerivation rec {
     libXrender
     libproxy
     libxcb
-    libxml2'
+    libxml2_13
     sqlite
     zlib
     alsa-lib

pkgs/applications/networking/browsers/chromium/common.nix

@@ -526,6 +526,24 @@ let
       # preventing compilations of chromium with versions below their intended version, not about running the very
       # exact version or even running a newer version.
       ./patches/chromium-136-nodejs-assert-minimal-version-instead-of-exact-match.patch
+    ]
+    ++ lib.optionals (chromiumVersionAtLeast "138") [
+      (fetchpatch {
+        # Unbreak building with Rust 1.89+ which introduced
+        # a new mismatched_lifetime_syntaxes lint.
+        # https://issues.chromium.org/issues/424424323
+        name = "chromium-138-rust-1.86-mismatched_lifetime_syntaxes.patch";
+        # https://chromium-review.googlesource.com/c/chromium/src/+/6658267
+        url = "https://chromium.googlesource.com/chromium/src/+/94a87ff38c51fd1a71980a5051d3553978391608^!?format=TEXT";
+        decode = "base64 -d";
+        includes = [ "build/rust/cargo_crate.gni" ];
+        hash = "sha256-xf1Jq5v3InXkiVH0uT7+h1HPwZse5MDcHKuJNjSLR6k=";
+      })
+    ]
+    ++ lib.optionals (!chromiumVersionAtLeast "138") [
+      # Rebased variant of the patch above for
+      # electron 35 (M134) and 36 (M136)
+      ./patches/chromium-134-rust-1.86-mismatched_lifetime_syntaxes.patch
     ];
 
     postPatch =

pkgs/applications/networking/browsers/chromium/default.nix

@@ -79,13 +79,7 @@ let
         pulseSupport
         ungoogled
         ;
-      gnChromium = buildPackages.gn.overrideAttrs (oldAttrs: {
-        version = if (upstream-info.deps.gn ? "version") then upstream-info.deps.gn.version else "0";
-        src = fetchgit {
-          url = "https://gn.googlesource.com/gn";
-          inherit (upstream-info.deps.gn) rev hash;
-        };
-      });
+      gnChromium = buildPackages.gn.override upstream-info.deps.gn;
     });
 
     browser = callPackage ./browser.nix {

pkgs/applications/networking/browsers/chromium/info.json

@@ -12,8 +12,9 @@
         "hash": "sha256-UouvzNFStYScnyfIJcz1Om7cDhC7EyShZQ/Icu73BPo="
       },
       "gn": {
+        "version": "0-unstable-2025-06-19",
         "rev": "97b68a0bb62b7528bc3491c7949d6804223c2b82",
-        "hash": "sha256-m+z10s40Q/iYcoMw3o/+tmhIdqHMsYJjdGabHrK/aqo="
+        "hash": "sha256-gwptzuirIdPAV9XCaAT09aM/fY7d6xgBU7oSu9C4tmE="
       },
       "npmHash": "sha256-R2gOpfPOUAmnsnUTIvzDPHuHNzL/b2fwlyyfTrywEcI="
     },
@@ -809,8 +810,9 @@
         "hash": "sha256-UouvzNFStYScnyfIJcz1Om7cDhC7EyShZQ/Icu73BPo="
       },
       "gn": {
+        "version": "0-unstable-2025-06-19",
         "rev": "97b68a0bb62b7528bc3491c7949d6804223c2b82",
-        "hash": "sha256-m+z10s40Q/iYcoMw3o/+tmhIdqHMsYJjdGabHrK/aqo="
+        "hash": "sha256-gwptzuirIdPAV9XCaAT09aM/fY7d6xgBU7oSu9C4tmE="
       },
       "ungoogled-patches": {
         "rev": "139.0.7258.138-1",

pkgs/applications/networking/browsers/chromium/patches/chromium-134-rust-1.86-mismatched_lifetime_syntaxes.patch

@@ -0,0 +1,14 @@
+diff --git a/build/rust/cargo_crate.gni b/build/rust/cargo_crate.gni
+index 8266c44cbd1dfb8a53797dbe911ea74c32ce070e..ec7d751f2d068151dfeb71aa1f6510483bebd95c 100644
+--- a/build/rust/cargo_crate.gni
++++ b/build/rust/cargo_crate.gni
+@@ -285,6 +285,9 @@ template("cargo_crate") {
+     }
+     rustenv = _rustenv
+
++    # TODO(crbug.com/424424323): Clean up and enable.
++    rustflags += [ "-Amismatched_lifetime_syntaxes" ]
++
+     if (!defined(build_native_rust_unit_tests)) {
+       build_native_rust_unit_tests = _crate_type != "proc-macro"
+     }

pkgs/applications/networking/browsers/chromium/update.mjs

@@ -62,7 +62,7 @@ for (const attr_path of Object.keys(lockfile)) {
       chromedriver: !ungoogled ? await fetch_chromedriver_binaries(await get_latest_chromium_release('mac')) : undefined,
       deps: {
         depot_tools: {},
-        gn: {},
+        gn: await fetch_gn(chromium_rev, lockfile_initial[attr_path].deps.gn),
         'ungoogled-patches': !ungoogled ? undefined : {
           rev: ungoogled_patches.rev,
           hash: ungoogled_patches.hash,
@@ -78,12 +78,6 @@ for (const attr_path of Object.keys(lockfile)) {
       hash: depot_tools.hash,
     }
 
-    const gn = await fetch_gn(chromium_rev, lockfile_initial[attr_path].deps.gn)
-    lockfile[attr_path].deps.gn = {
-      rev: gn.rev,
-      hash: gn.hash,
-    }
-
     // DEPS update loop
     lockfile[attr_path].DEPS = await resolve_DEPS(depot_tools.out, chromium_rev)
     for (const [path, value] of Object.entries(lockfile[attr_path].DEPS)) {
@@ -133,10 +127,34 @@ for (const attr_path of Object.keys(lockfile)) {
 
 async function fetch_gn(chromium_rev, gn_previous) {
   const DEPS_file = await get_gitiles_file('https://chromium.googlesource.com/chromium/src', chromium_rev, 'DEPS')
-  const gn_rev = /^\s+'gn_version': 'git_revision:(?<rev>.+)',$/m.exec(DEPS_file).groups.rev
-  const hash = gn_rev === gn_previous.rev ? gn_previous.hash : ''
+  const { rev } = /^\s+'gn_version': 'git_revision:(?<rev>.+)',$/m.exec(DEPS_file).groups
 
-  return await prefetch_gitiles('https://gn.googlesource.com/gn', gn_rev, hash)
+  const cache_hit = rev === gn_previous.rev;
+  if (cache_hit) {
+    return gn_previous
+  }
+
+  const commit_date = await get_gitiles_commit_date('https://gn.googlesource.com/gn', rev)
+  const version = `0-unstable-${commit_date}`
+
+  const expr = [`(import ./. {}).gn.override { version = "${version}"; rev = "${rev}"; hash = ""; }`]
+  const derivation = await $nixpkgs`nix-instantiate --expr ${expr}`
+
+  return {
+    version,
+    rev,
+    hash: await prefetch_FOD(derivation),
+  }
+}
+
+
+async function get_gitiles_commit_date(base_url, rev) {
+  const url = `${base_url}/+/${rev}?format=json`
+  const response = await (await fetch(url)).text()
+  const json = JSON.parse(response.replace(`)]}'\n`, ''))
+
+  const date = new Date(json.commiter.time)
+  return date.toISOString().split("T")[0]
 }
 
 
@@ -259,4 +277,3 @@ async function prefetch_FOD(...args) {
 
   return hash
 }
-

pkgs/applications/networking/mailreaders/thunderbird/packages.nix

@@ -48,6 +48,13 @@ let
         # The file to be patched is different from firefox's `no-buildconfig-ffx90.patch`.
         (if lib.versionOlder version "140" then ./no-buildconfig.patch else ./no-buildconfig-tb140.patch)
       ]
+      ++ lib.optional (lib.versionAtLeast version "140") (fetchpatch2 {
+        # https://bugzilla.mozilla.org/show_bug.cgi?id=1982003
+        name = "rustc-1.89.patch";
+        url = "https://raw.githubusercontent.com/openbsd/ports/3ef8a2538893109bea8211ef13a870822264e096/mail/mozilla-thunderbird/patches/patch-third_party_rust_allocator-api2_src_stable_vec_mod_rs";
+        extraPrefix = "";
+        hash = "sha256-eL+RNVLMkj8x/8qQJVUFHDdDpS0ahV1XEN1L0reaYG4=";
+      })
       ++ lib.optionals (lib.versionOlder version "139") [
         # clang-19 fixes for char_traits build issue
         # https://github.com/rnpgp/rnp/pull/2242/commits/e0790a2c4ff8e09d52522785cec1c9db23d304ac

pkgs/applications/networking/remote/citrix-workspace/generic.nix

@@ -40,7 +40,7 @@
   libsecret,
   libsoup_2_4,
   libvorbis,
-  libxml2,
+  libxml2_13,
   llvmPackages,
   more,
   nspr,
@@ -90,19 +90,6 @@ let
     '';
   };
 
-  libxml2' = libxml2.overrideAttrs (oldAttrs: rec {
-    version = "2.13.8";
-    src = fetchurl {
-      url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
-      hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo=";
-    };
-    meta = oldAttrs.meta // {
-      knownVulnerabilities = oldAttrs.meta.knownVulnerabilities or [ ] ++ [
-        "CVE-2025-6021"
-      ];
-    };
-  });
-
 in
 
 stdenv.mkDerivation rec {
@@ -174,7 +161,7 @@ stdenv.mkDerivation rec {
     libsecret
     libsoup_2_4
     libvorbis
-    libxml2'
+    libxml2_13
     llvmPackages.libunwind
     nspr
     nss

pkgs/applications/version-management/git/default.nix

@@ -96,18 +96,23 @@ stdenv.mkDerivation (finalAttrs: {
   separateDebugInfo = true;
   __structuredAttrs = true;
 
-  hardeningDisable = [ "format" ];
-
   enableParallelBuilding = true;
   enableParallelInstalling = true;
 
   patches = [
+    # This patch does two things: (1) use the right name for `docbook2texi',
+    # and (2) make sure `gitman.info' isn't produced since it's broken
+    # (duplicate node names).
     ./docbook2texi.patch
+    # Fix references to gettext.sh at runtime: hard-code it to
+    # ${pkgs.gettext}/bin/gettext.sh instead of assuming gettext.sh is in $PATH
     ./git-sh-i18n.patch
+    # Do not search for sendmail in /usr, only in $PATH
     ./git-send-email-honor-PATH.patch
-    ./installCheck-path.patch
   ]
   ++ lib.optionals withSsh [
+    # Hard-code the ssh executable to ${pkgs.openssh}/bin/ssh instead of
+    # searching in $PATH
     ./ssh-path.patch
   ];
 
@@ -476,9 +481,6 @@ stdenv.mkDerivation (finalAttrs: {
     disable_test t1301-shared-repo
     # /build/git-2.44.0/contrib/completion/git-completion.bash: line 452: compgen: command not found
     disable_test t9902-completion
-
-    # Our patched gettext never fallbacks
-    disable_test t0201-gettext-fallbacks
   ''
   + lib.optionalString (!sendEmailSupport) ''
     # Disable sendmail tests

pkgs/applications/virtualization/qemu/default.nix

@@ -146,11 +146,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString nixosTestRunner "-for-vm-tests"
     + lib.optionalString toolsOnly "-utils"
     + lib.optionalString userOnly "-user";
-  version = "10.0.2";
+  version = "10.0.3";
 
   src = fetchurl {
     url = "https://download.qemu.org/qemu-${finalAttrs.version}.tar.xz";
-    hash = "sha256-73hvI5jLUYRgD2mu9NXWke/URXajz/QSbTjUxv7Id1k=";
+    hash = "sha256-XIkSZ7FTSndEZduLGg38sMXm1+y29xNFYlrfTgiJlFs=";
   };
 
   depsBuildBuild = [
@@ -170,7 +170,7 @@ stdenv.mkDerivation (finalAttrs: {
     perl
 
     # Don't change this to python3 and python3.pkgs.*, breaks cross-compilation
-    python3Packages.python
+    (python3Packages.python.withPackages (ps: with ps; [ distlib ]))
   ]
   ++ lib.optionals gtkSupport [ wrapGAppsHook3 ]
   ++ lib.optionals enableDocs [
@@ -293,9 +293,9 @@ stdenv.mkDerivation (finalAttrs: {
     # avoid conflicts with libc++ include for <version>
     mv VERSION QEMU_VERSION
     substituteInPlace configure \
-      --replace '$source_path/VERSION' '$source_path/QEMU_VERSION'
+      --replace-fail '$source_path/VERSION' '$source_path/QEMU_VERSION'
     substituteInPlace meson.build \
-      --replace "'VERSION'" "'QEMU_VERSION'"
+      --replace-fail "'VERSION'" "'QEMU_VERSION'"
     substituteInPlace python/qemu/machine/machine.py \
       --replace-fail /var/tmp "$TMPDIR"
   '';

pkgs/build-support/agda/default.nix

@@ -90,8 +90,6 @@ let
       pname,
       meta,
       buildInputs ? [ ],
-      everythingFile ? "./Everything.agda",
-      includePaths ? [ ],
       libraryName ? pname,
       libraryFile ? "${libraryName}.agda-lib",
       buildPhase ? null,
@@ -100,17 +98,14 @@ let
       ...
     }:
     let
-      agdaWithArgs = withPackages (filter (p: p ? isAgdaDerivation) buildInputs);
-      includePathArgs = concatMapStrings (path: "-i" + path + " ") (
-        includePaths ++ [ (dirOf everythingFile) ]
-      );
+      agdaWithPkgs = withPackages (filter (p: p ? isAgdaDerivation) buildInputs);
     in
     {
       inherit libraryName libraryFile;
 
       isAgdaDerivation = true;
 
-      buildInputs = buildInputs ++ [ agdaWithArgs ];
+      buildInputs = buildInputs ++ [ agdaWithPkgs ];
 
       buildPhase =
         if buildPhase != null then
@@ -118,8 +113,7 @@ let
         else
           ''
             runHook preBuild
-            agda ${includePathArgs} ${everythingFile}
-            rm ${everythingFile} ${lib.interfaceFile Agda.version everythingFile}
+            agda --build-library
             runHook postBuild
           '';
 

pkgs/build-support/agda/lib.nix

@@ -6,8 +6,8 @@
     * The resulting path may not be normalized.
     *
     * Examples:
-    * interfaceFile pkgs.agda.version "./Everything.agda" == "_build/2.6.4.3/agda/./Everything.agdai"
-    * interfaceFile pkgs.agda.version "src/Everything.lagda.tex" == "_build/2.6.4.3/agda/src/Everything.agdai"
+    * interfaceFile pkgs.agda.version "./Foo.agda" == "_build/AGDA_VERSION/agda/./Foo.agdai"
+    * interfaceFile pkgs.agda.version "src/Foo.lagda.tex" == "_build/AGDA_VERSION/agda/src/Foo.agdai"
   */
   interfaceFile =
     agdaVersion: agdaFile:

pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh

@@ -30,4 +30,8 @@ if $targetPassed && [[ "$targetValue" != "@defaultTarget@" ]] && (( "${NIX_CC_WR
     echo "Warning: supplying the --target $targetValue != @defaultTarget@ argument to a nix-wrapped compiler may not work correctly - cc-wrapper is currently not designed with multi-target compilers in mind. You may want to use an un-wrapped compiler instead." >&2
 elif [[ $0 != *cpp ]]; then
     extraBefore+=(-target @defaultTarget@ @machineFlags@)
+
+    if [[ "@explicitAbiValue@" != "" ]]; then
+        extraBefore+=(-mabi=@explicitAbiValue@)
+    fi
 fi

pkgs/build-support/cc-wrapper/default.nix

@@ -93,12 +93,14 @@ let
     getLib
     getName
     getVersion
+    hasPrefix
     mapAttrsToList
     optional
     optionalAttrs
     optionals
     optionalString
     removePrefix
+    removeSuffix
     replaceStrings
     toList
     versionAtLeast
@@ -362,6 +364,22 @@ let
     else
       targetPlatform.darwinPlatform
   );
+
+  # Header files that use `__FILE__` (e.g., for error reporting) lead
+  # to unwanted references to development packages and outputs in built
+  # binaries, like C++ programs depending on GCC and Boost at runtime.
+  #
+  # We use `-fmacro-prefix-map` to avoid the store references in these
+  # situations while keeping them in compiler diagnostics and debugging
+  # and profiling output.
+  #
+  # Unfortunately, doing this with GCC runs into issues with compiler
+  # argument length limits due to <https://gcc.gnu.org/PR111527>, so we
+  # disable it there in favour of our existing patch.
+  #
+  # TODO: Drop `mangle-NIX_STORE-in-__FILE__.patch` from GCC and make
+  # this unconditional once the upstream bug is fixed.
+  useMacroPrefixMap = !isGNU;
 in
 
 assert includeFortifyHeaders' -> fortify-headers != null;
@@ -454,6 +472,14 @@ stdenvNoCC.mkDerivation {
       substituteAll "$wrapper" "$out/bin/$dst"
       chmod +x "$out/bin/$dst"
     }
+
+    include() {
+      printf -- '%s %s\n' "$1" "$2"
+      ${lib.optionalString useMacroPrefixMap ''
+        local scrubbed="$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-''${2#"$NIX_STORE"/*-}"
+        printf -- '-fmacro-prefix-map=%s=%s\n' "$2" "$scrubbed"
+      ''}
+    }
   ''
 
   + (
@@ -663,13 +689,13 @@ stdenvNoCC.mkDerivation {
         echo "-B${libc_lib}${libc.libdir or "/lib/"}" >> $out/nix-support/libc-crt1-cflags
       ''
       + ''
-        echo "-${
+        include "-${
           if isArocc then "I" else "idirafter"
-        } ${libc_dev}${libc.incdir or "/include"}" >> $out/nix-support/libc-cflags
+        }" "${libc_dev}${libc.incdir or "/include"}" >> $out/nix-support/libc-cflags
       ''
       + optionalString isGNU ''
         for dir in "${cc}"/lib/gcc/*/*/include-fixed; do
-          echo '-idirafter' ''${dir} >> $out/nix-support/libc-cflags
+          include '-idirafter' ''${dir} >> $out/nix-support/libc-cflags
         done
       ''
       + ''
@@ -685,7 +711,7 @@ stdenvNoCC.mkDerivation {
       # like option that forces the libc headers before all -idirafter,
       # hence -isystem here.
       + optionalString includeFortifyHeaders' ''
-        echo "-isystem ${fortify-headers}/include" >> $out/nix-support/libc-cflags
+        include -isystem "${fortify-headers}/include" >> $out/nix-support/libc-cflags
       ''
     )
 
@@ -708,19 +734,19 @@ stdenvNoCC.mkDerivation {
     # https://github.com/NixOS/nixpkgs/pull/209870#issuecomment-1500550903)
     + optionalString (libcxx == null && isClang && (useGccForLibs && gccForLibs.langCC or false)) ''
       for dir in ${gccForLibs}/include/c++/*; do
-        echo "-isystem $dir" >> $out/nix-support/libcxx-cxxflags
+        include -isystem "$dir" >> $out/nix-support/libcxx-cxxflags
       done
       for dir in ${gccForLibs}/include/c++/*/${targetPlatform.config}; do
-        echo "-isystem $dir" >> $out/nix-support/libcxx-cxxflags
+        include -isystem "$dir" >> $out/nix-support/libcxx-cxxflags
       done
     ''
     + optionalString (libcxx.isLLVM or false) ''
-      echo "-isystem ${getDev libcxx}/include/c++/v1" >> $out/nix-support/libcxx-cxxflags
+      include -isystem "${getDev libcxx}/include/c++/v1" >> $out/nix-support/libcxx-cxxflags
       echo "-stdlib=libc++" >> $out/nix-support/libcxx-ldflags
     ''
     # GCC NG friendly libc++
     + optionalString (libcxx != null && libcxx.isGNU or false) ''
-      echo "-isystem ${getDev libcxx}/include" >> $out/nix-support/libcxx-cxxflags
+      include -isystem "${getDev libcxx}/include" >> $out/nix-support/libcxx-cxxflags
     ''
 
     ##
@@ -885,12 +911,24 @@ stdenvNoCC.mkDerivation {
     ## General Clang support
     ## Needs to go after ^ because the for loop eats \n and makes this file an invalid script
     ##
-    + optionalString isClang ''
-      # Escape twice: once for this script, once for the one it gets substituted into.
-      export machineFlags=${escapeShellArg (escapeShellArgs machineFlags)}
-      export defaultTarget=${targetPlatform.config}
-      substituteAll ${./add-clang-cc-cflags-before.sh} $out/nix-support/add-local-cc-cflags-before.sh
-    ''
+    + optionalString isClang (
+      let
+        hasUnsupportedGnuSuffix = hasPrefix "gnuabielfv" targetPlatform.parsed.abi.name;
+        clangCompatibleConfig =
+          if hasUnsupportedGnuSuffix then
+            removeSuffix (removePrefix "gnu" targetPlatform.parsed.abi.name) targetPlatform.config
+          else
+            targetPlatform.config;
+        explicitAbiValue = if hasUnsupportedGnuSuffix then targetPlatform.parsed.abi.abi else "";
+      in
+      ''
+        # Escape twice: once for this script, once for the one it gets substituted into.
+        export machineFlags=${escapeShellArg (escapeShellArgs machineFlags)}
+        export defaultTarget=${clangCompatibleConfig}
+        export explicitAbiValue=${explicitAbiValue}
+        substituteAll ${./add-clang-cc-cflags-before.sh} $out/nix-support/add-local-cc-cflags-before.sh
+      ''
+    )
 
     ##
     ## Extra custom steps
@@ -921,6 +959,7 @@ stdenvNoCC.mkDerivation {
     inherit libc_bin libc_dev libc_lib;
     inherit darwinPlatformForCC;
     default_hardening_flags_str = builtins.toString defaultHardeningFlags;
+    inherit useMacroPrefixMap;
   }
   // lib.mapAttrs (_: lib.optionalString targetPlatform.isDarwin) {
     # These will become empty strings when not targeting Darwin.

pkgs/build-support/cc-wrapper/setup-hook.sh

@@ -68,12 +68,21 @@ ccWrapper_addCVars () {
     local role_post
     getHostRoleEnvHook
 
+    local found=
+
     if [ -d "$1/include" ]; then
         export NIX_CFLAGS_COMPILE${role_post}+=" -isystem $1/include"
+        found=1
     fi
 
     if [ -d "$1/Library/Frameworks" ]; then
         export NIX_CFLAGS_COMPILE${role_post}+=" -iframework $1/Library/Frameworks"
+        found=1
+    fi
+
+    if [[ -n "@useMacroPrefixMap@" && -n ${NIX_STORE:-} && -n $found ]]; then
+        local scrubbed="$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-${1#"$NIX_STORE"/*-}"
+        export NIX_CFLAGS_COMPILE${role_post}+=" -fmacro-prefix-map=$1=$scrubbed"
     fi
 }
 

pkgs/build-support/fetchurl/mirrors.nix

@@ -93,9 +93,7 @@
   gnupg = [
     "https://gnupg.org/ftp/gcrypt/"
     "https://mirrors.dotsrc.org/gcrypt/"
-    "https://ftp.heanet.ie/mirrors/ftp.gnupg.org/gcrypt/"
     "https://www.mirrorservice.org/sites/ftp.gnupg.org/gcrypt/"
-    "http://www.ring.gr.jp/pub/net/"
   ];
 
   # IBiblio (former metalab/sunsite)

pkgs/build-support/node/build-npm-package/default.nix

@@ -103,17 +103,6 @@ lib.extendMkDerivation {
       # Stripping takes way too long with the amount of files required by a typical Node.js project.
       dontStrip = args.dontStrip or true;
 
-      env = {
-        npm_config_arch =
-          {
-            "x86_64" = "x64";
-            "aarch64" = "arm64";
-          }
-          .${stdenv.hostPlatform.parsed.cpu.name} or stdenv.hostPlatform.parsed.cpu.name;
-        npm_config_platform = stdenv.hostPlatform.parsed.kernel.name;
-      }
-      // (args.env or { });
-
       meta = (args.meta or { }) // {
         platforms = args.meta.platforms or nodejs.meta.platforms;
       };

pkgs/build-support/node/build-npm-package/hooks/default.nix

@@ -1,6 +1,7 @@
 {
   lib,
   srcOnly,
+  stdenv,
   makeSetupHook,
   makeWrapper,
   nodejs,
@@ -18,6 +19,8 @@
     substitutions = {
       nodeSrc = srcOnly nodejs;
       nodeGyp = "${nodejs}/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js";
+      npmArch = stdenv.targetPlatform.node.arch;
+      npmPlatform = stdenv.targetPlatform.node.platform;
 
       # Specify `diff`, `jq`, and `prefetch-npm-deps` by abspath to ensure that the user's build
       # inputs do not cause us to find the wrong binaries.

pkgs/build-support/node/build-npm-package/hooks/npm-config-hook.sh

@@ -16,6 +16,8 @@ npmConfigHook() {
     export HOME="$TMPDIR"
     export npm_config_nodedir="@nodeSrc@"
     export npm_config_node_gyp="@nodeGyp@"
+    export npm_config_arch="@npmArch@"
+    export npm_config_platform="@npmPlatform@"
 
     if [ -z "${npmDeps-}" ]; then
         echo

pkgs/build-support/nuke-references/darwin-sign-fixup.sh

@@ -1,5 +0,0 @@
-# Fixup hook for nukeReferences, not stdenv
-
-source @signingUtils@
-
-fixupHooks+=(signIfRequired)

pkgs/build-support/nuke-references/default.nix

@@ -11,12 +11,6 @@
   shell ? stdenvNoCC.shell,
 }:
 
-let
-  stdenv = stdenvNoCC;
-
-  darwinCodeSign = stdenv.targetPlatform.isDarwin && stdenv.targetPlatform.isAarch64;
-in
-
 stdenvNoCC.mkDerivation {
   name = "nuke-references";
 
@@ -32,17 +26,14 @@ stdenvNoCC.mkDerivation {
     chmod a+x $out/bin/nuke-refs
   '';
 
-  postFixup = lib.optionalString darwinCodeSign ''
-    mkdir -p $out/nix-support
-    substituteAll ${./darwin-sign-fixup.sh} $out/nix-support/setup-hooks.sh
-  '';
-
   # FIXME: get rid of perl dependency.
   env = {
     inherit perl;
     inherit (builtins) storeDir;
     shell = lib.getBin shell + (shell.shellPath or "");
-    signingUtils = lib.optionalString darwinCodeSign signingUtils;
+    signingUtils = lib.optionalString (
+      stdenvNoCC.targetPlatform.isDarwin && stdenvNoCC.targetPlatform.isAarch64
+    ) signingUtils;
   };
 
   meta.mainProgram = "nuke-refs";

pkgs/build-support/nuke-references/nuke-refs.sh

@@ -2,8 +2,8 @@
 
 fixupHooks=()
 
-if [ -e @out@/nix-support/setup-hooks.sh ]; then
-    source @out@/nix-support/setup-hooks.sh
+if [[ -n "@signingUtils@" ]]; then
+    source "@signingUtils@"
 fi
 
 excludes=""
@@ -25,9 +25,8 @@ for i in "$@"; do
         cat "$i" | @perl@/bin/perl -pe "s|\Q@storeDir@\E/$excludes[a-z0-9]{32}-|@storeDir@/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-|g" > "$i.tmp"
         if test -x "$i"; then chmod +x "$i.tmp"; fi
         mv "$i.tmp" "$i"
-
-        for hook in "${fixupHooks[@]}"; do
-            eval "$hook" "$i"
-        done
+        if [[ -n "@signingUtils@" ]]; then
+            signIfRequired "$i"
+        fi
     fi
 done

pkgs/build-support/remove-references-to/darwin-sign-fixup.sh

@@ -1,5 +0,0 @@
-# Fixup hook for nukeReferences, not stdenv
-
-source @signingUtils@
-
-fixupHooks+=(signIfRequired)

pkgs/build-support/remove-references-to/default.nix

@@ -10,13 +10,7 @@
   shell ? stdenvNoCC.shell,
 }:
 
-let
-  stdenv = stdenvNoCC;
-
-  darwinCodeSign = stdenv.targetPlatform.isDarwin && stdenv.targetPlatform.isAarch64;
-in
-
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   name = "remove-references-to";
 
   dontUnpack = true;
@@ -29,16 +23,13 @@ stdenv.mkDerivation {
     chmod a+x $out/bin/remove-references-to
   '';
 
-  postFixup = lib.optionalString darwinCodeSign ''
-    mkdir -p $out/nix-support
-    substituteAll ${./darwin-sign-fixup.sh} $out/nix-support/setup-hooks.sh
-  '';
-
   env = {
     inherit (builtins) storeDir;
     shell = lib.getBin shell + (shell.shellPath or "");
-  }
-  // lib.optionalAttrs darwinCodeSign { inherit signingUtils; };
+    signingUtils = lib.optionalString (
+      stdenvNoCC.targetPlatform.isDarwin && stdenvNoCC.targetPlatform.isAarch64
+    ) signingUtils;
+  };
 
   meta.mainProgram = "remove-references-to";
 }

pkgs/build-support/remove-references-to/remove-references-to.sh

@@ -2,10 +2,6 @@
 
 fixupHooks=()
 
-if [ -e @out@/nix-support/setup-hooks.sh ]; then
-    source @out@/nix-support/setup-hooks.sh
-fi
-
 # References to remove
 targets=()
 while getopts t: o; do
@@ -30,8 +26,9 @@ for target in "${targets[@]}" ; do
     sed -i -e "s|$target|eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee|g" "${regions[@]}"
 done
 
-for region in "${regions[@]}"; do
-    for hook in "${fixupHooks[@]}"; do
-        eval "$hook" "$region"
+if [[ -n "@signingUtils@" ]]; then
+    source "@signingUtils@"
+    for region in "${regions[@]}"; do
+        signIfRequired "$region"
     done
-done
+fi

pkgs/build-support/rust/replace-workspace-values.py

@@ -123,6 +123,7 @@ def main() -> None:
         and crate_manifest["lints"]["workspace"] is True
     ):
         crate_manifest["lints"] = workspace_manifest["lints"]
+        changed = True
 
     if not changed:
         return

pkgs/build-support/rust/test/import-cargo-lock/git-dependency-workspace-inheritance/crate_lints.toml

@@ -0,0 +1,15 @@
+[package]
+name = "im_using_workspaces"
+version = { workspace = true }
+publish = false
+keywords = [
+    "workspace",
+    "other_thing",
+    "third_thing",
+]
+
+[lints]
+workspace = true
+
+[dependencies]
+bar = "1.0.0"

pkgs/build-support/rust/test/import-cargo-lock/git-dependency-workspace-inheritance/default.nix

@@ -4,4 +4,8 @@ runCommand "git-dependency-workspace-inheritance-test" { } ''
   cp --no-preserve=mode ${./crate.toml} "$out"
   ${replaceWorkspaceValues} "$out" ${./workspace.toml}
   diff -u "$out" ${./want.toml}
+
+  cp --no-preserve=mode ${./crate_lints.toml} "$out"
+  ${replaceWorkspaceValues} "$out" ${./workspace.toml}
+  diff -u "$out" ${./want_lints.toml}
 ''

pkgs/build-support/rust/test/import-cargo-lock/git-dependency-workspace-inheritance/want_lints.toml

@@ -0,0 +1,15 @@
+[package]
+name = "im_using_workspaces"
+version = "1.0.0"
+publish = false
+keywords = [
+    "workspace",
+    "other_thing",
+    "third_thing",
+]
+
+[lints]
+dbg_macro = "warn"
+
+[dependencies]
+bar = "1.0.0"

pkgs/build-support/rust/test/import-cargo-lock/git-dependency-workspace-inheritance/workspace.toml

@@ -3,3 +3,6 @@ version = "1.0.0"
 
 [workspace.dependencies]
 foo = { version = "1.0.0", features = ["meow"] }
+
+[workspace.lints]
+dbg_macro = "warn"

pkgs/build-support/src-only/default.nix

@@ -37,28 +37,48 @@
 
 attrs:
 let
-  args = attrs.drvAttrs or attrs;
-  name = args.name or "${args.pname}-${args.version}";
-  stdenv = args.stdenv or (lib.warn "srcOnly: stdenv not provided, using stdenvNoCC" stdenvNoCC);
-  drv = stdenv.mkDerivation (
-    args
-    // {
-      name = "${name}-source";
+  argsToOverride = args: {
+    name = "${args.name or "${args.pname}-${args.version}"}-source";
 
-      outputs = [ "out" ];
+    outputs = [ "out" ];
 
-      phases = [
-        "unpackPhase"
-        "patchPhase"
-        "installPhase"
-      ];
-      separateDebugInfo = false;
+    phases = [
+      "unpackPhase"
+      "patchPhase"
+      "installPhase"
+    ];
+    separateDebugInfo = false;
 
-      dontUnpack = false;
+    dontUnpack = lib.warnIf (args.dontUnpack or false
+    ) "srcOnly: derivation has dontUnpack set, overriding" false;
 
-      dontInstall = false;
-      installPhase = "cp -pr --reflink=auto -- . $out";
-    }
-  );
+    dontInstall = false;
+    installPhase = "cp -pr --reflink=auto -- . $out";
+  };
 in
-lib.warnIf (args.dontUnpack or false) "srcOnly: derivation has dontUnpack set, overriding" drv
+
+# If we are passed a derivation (based on stdenv*), we can use overrideAttrs to
+# update the arguments to mkDerivation. This gives us the proper awareness of
+# what arguments were effectively passed *to* mkDerivation as opposed to
+# builtins.derivation (by mkDerivation). For example, stdenv.mkDerivation
+# accepts an `env` attribute set which is postprocessed before being passed to
+# builtins.derivation. This can lead to evaluation failures, if we assume
+# that drvAttrs is equivalent to the arguments passed to mkDerivation.
+# See https://github.com/NixOS/nixpkgs/issues/269539.
+if lib.isDerivation attrs && attrs ? overrideAttrs then
+  attrs.overrideAttrs (_finalAttrs: prevAttrs: argsToOverride prevAttrs)
+else
+  let
+    # If we don't have overrideAttrs, it is extremely unlikely that we are seeing
+    # a derivation constructed by stdenv.mkDerivation. Since srcOnly assumes
+    # that we are using stdenv's setup.sh, it therefore doesn't make sense to
+    # have derivation specific logic in this branch.
+    # TODO(@sternenseemann): remove drvAttrs special casing in NixOS 26.05
+    args =
+      lib.warnIf (lib.isDerivation attrs)
+        "srcOnly: derivations not created by a variant of stdenv.mkDerivation are not supported. Code relying on behaviour of srcOnly with non-stdenv derivations may break in the future."
+        attrs.drvAttrs or attrs;
+    stdenv = args.stdenv or (lib.warn "srcOnly: stdenv not provided, using stdenvNoCC" stdenvNoCC);
+    drv = stdenv.mkDerivation (args // argsToOverride args);
+  in
+  drv

pkgs/build-support/src-only/tests.nix

@@ -5,19 +5,43 @@
   hello,
   emptyDirectory,
   zlib,
+  git,
+  withCFlags,
   stdenv,
   testers,
 }:
 
 let
+  # Extract (effective) arguments passed to stdenv.mkDerivation and compute the
+  # arguments we would need to pass to srcOnly manually in order to get the same
+  # as `srcOnly drv`, i.e. the arguments passed to stdenv.mkDerivation plus the
+  # used stdenv itself.
+  getEquivAttrs =
+    drv:
+    let
+      drv' = drv.overrideAttrs (
+        _finalAttrs: prevAttrs: {
+          passthru = prevAttrs.passthru or { } // {
+            passedAttrs = prevAttrs;
+          };
+        }
+      );
+    in
+    drv'.passedAttrs // { inherit (drv') stdenv; };
+
+  canEvalDrv = drv: (builtins.tryEval drv.drvPath).success;
+
   emptySrc = srcOnly emptyDirectory;
   zlibSrc = srcOnly zlib;
 
   # It can be invoked in a number of ways. Let's make sure they're equivalent.
-  zlibSrcDrvAttrs = srcOnly zlib.drvAttrs;
+  zlibSrcEquiv = srcOnly (getEquivAttrs zlib);
   # zlibSrcFreeform = # ???;
   helloSrc = srcOnly hello;
-  helloSrcDrvAttrs = srcOnly hello.drvAttrs;
+  helloSrcEquiv = srcOnly (getEquivAttrs hello);
+
+  gitSrc = srcOnly git;
+  gitSrcEquiv = srcOnly (getEquivAttrs git);
 
   # The srcOnly <drv> invocation leaks a lot of attrs into the srcOnly derivation,
   # so for comparing with the freeform invocation, we need to make a selection.
@@ -33,42 +57,81 @@ let
       ;
   };
   helloDrvSimpleSrc = srcOnly helloDrvSimple;
-  helloDrvSimpleSrcFreeform = srcOnly (
-    {
-      inherit (helloDrvSimple)
-        name
-        pname
-        version
-        src
-        patches
-        stdenv
-        ;
-    }
-    # __impureHostDeps get duplicated in helloDrvSimpleSrc (on darwin)
-    # This is harmless, but fails the test for what is arguably an
-    # unrelated non-problem, so we just work around it here.
-    # The inclusion of __impureHostDeps really shouldn't be required,
-    # and should be removed from this test.
-    // lib.optionalAttrs (helloDrvSimple ? __impureHostDeps) {
-      inherit (helloDrvSimple) __impureHostDeps;
+  helloDrvSimpleSrcFreeform = srcOnly ({
+    inherit (helloDrvSimple)
+      name
+      pname
+      version
+      src
+      patches
+      stdenv
+      ;
+  });
+
+  # Test the issue reported in https://github.com/NixOS/nixpkgs/issues/269539
+  stdenvAdapterDrv =
+    let
+      drv = (withCFlags [ "-Werror" "-Wall" ] stdenv).mkDerivation {
+        name = "drv-using-stdenv-adapter";
+      };
+    in
+    # Confirm the issue we are trying to avoid exists
+    assert !(canEvalDrv (srcOnly drv.drvAttrs));
+    drv;
+  stdenvAdapterDrvSrc = srcOnly stdenvAdapterDrv;
+  stdenvAdapterDrvSrcEquiv = srcOnly (
+    getEquivAttrs stdenvAdapterDrv
+    // {
+      # The upside of using overrideAttrs is that any stdenv adapter related
+      # modifications are only applied once. Using the adapter here again would
+      # mean applying it twice in total (since withCFlags functions more or less
+      # like an automatic overrideAttrs).
+      inherit stdenv;
     }
   );
 
+  # Issue similar to https://github.com/NixOS/nixpkgs/issues/269539
+  structuredAttrsDrv =
+    let
+      drv = stdenv.mkDerivation {
+        name = "drv-using-structured-attrs";
+        src = emptyDirectory;
+
+        env.NIX_DEBUG = true;
+        __structuredAttrs = true;
+      };
+    in
+    # Confirm the issue we are trying to avoid exists
+    assert !(canEvalDrv (srcOnly drv.drvAttrs));
+    drv;
+  structuredAttrsDrvSrc = srcOnly structuredAttrsDrv;
+  structuredAttrsDrvSrcEquiv = srcOnly (getEquivAttrs structuredAttrsDrv);
+
 in
 
 runCommand "srcOnly-tests"
   {
     moreTests = [
-      (testers.testEqualDerivation "zlibSrcDrvAttrs == zlibSrc" zlibSrcDrvAttrs zlibSrc)
+      (testers.testEqualDerivation "zlibSrcEquiv == zlibSrc" zlibSrcEquiv zlibSrc)
       # (testers.testEqualDerivation
       #   "zlibSrcFreeform == zlibSrc"
       #   zlibSrcFreeform
       #   zlibSrc)
-      (testers.testEqualDerivation "helloSrcDrvAttrs == helloSrc" helloSrcDrvAttrs helloSrc)
+      (testers.testEqualDerivation "helloSrcEquiv == helloSrc" helloSrcEquiv helloSrc)
+      (testers.testEqualDerivation "helloSrcEquiv == helloSrc" helloSrcEquiv helloSrc)
+      (testers.testEqualDerivation "gitSrcEquiv == gitSrc" gitSrcEquiv gitSrc)
       (testers.testEqualDerivation "helloDrvSimpleSrcFreeform == helloDrvSimpleSrc"
         helloDrvSimpleSrcFreeform
         helloDrvSimpleSrc
       )
+      (testers.testEqualDerivation "stdenvAdapterDrvSrcEquiv == stdenvAdapterDrvSrc"
+        stdenvAdapterDrvSrcEquiv
+        stdenvAdapterDrvSrc
+      )
+      (testers.testEqualDerivation "structuredAttrsDrvSrcEquiv == structuredAttrsDrvSrc"
+        structuredAttrsDrvSrcEquiv
+        structuredAttrsDrvSrc
+      )
     ];
   }
   ''

pkgs/by-name/ab/abseil-cpp_202501/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "abseil-cpp";
-  version = "20250512.1";
+  version = "20250127.1";
 
   src = fetchFromGitHub {
     owner = "abseil";
     repo = "abseil-cpp";
     tag = finalAttrs.version;
-    hash = "sha256-eB7OqTO9Vwts9nYQ/Mdq0Ds4T1KgmmpYdzU09VPWOhk=";
+    hash = "sha256-QTywqQCkyGFpdbtDBvUwz9bGXxbJs/qoFKF6zYAZUmQ=";
   };
 
   cmakeFlags = [

pkgs/by-name/ab/abseil-cpp_202505/package.nix

@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  gtest,
+  static ? stdenv.hostPlatform.isStatic,
+  cxxStandard ? null,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "abseil-cpp";
+  version = "20250512.1";
+
+  src = fetchFromGitHub {
+    owner = "abseil";
+    repo = "abseil-cpp";
+    tag = finalAttrs.version;
+    hash = "sha256-eB7OqTO9Vwts9nYQ/Mdq0Ds4T1KgmmpYdzU09VPWOhk=";
+  };
+
+  cmakeFlags = [
+    (lib.cmakeBool "ABSL_BUILD_TEST_HELPERS" true)
+    (lib.cmakeBool "ABSL_USE_EXTERNAL_GOOGLETEST" true)
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!static))
+  ]
+  ++ lib.optionals (cxxStandard != null) [
+    (lib.cmakeFeature "CMAKE_CXX_STANDARD" cxxStandard)
+  ];
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ gtest ];
+
+  meta = {
+    description = "Open-source collection of C++ code designed to augment the C++ standard library";
+    homepage = "https://abseil.io/";
+    changelog = "https://github.com/abseil/abseil-cpp/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.all;
+    maintainers = [ lib.maintainers.GaetanLepage ];
+  };
+})

pkgs/by-name/af/affine-bin/package.nix

@@ -13,14 +13,8 @@
 }:
 let
   hostPlatform = stdenvNoCC.hostPlatform;
-  nodePlatform = hostPlatform.parsed.kernel.name; # nodejs's `process.platform`
-  nodeArch = # nodejs's `process.arch`
-    {
-      "x86_64" = "x64";
-      "aarch64" = "arm64";
-    }
-    .${hostPlatform.parsed.cpu.name}
-      or (throw "affine-bin(${buildType}): unsupported CPU family ${hostPlatform.parsed.cpu.name}");
+  nodePlatform = hostPlatform.node.platform;
+  nodeArch = hostPlatform.node.arch;
 in
 stdenvNoCC.mkDerivation (
   finalAttrs:

pkgs/by-name/af/affine/package.nix

@@ -26,14 +26,8 @@
 }:
 let
   hostPlatform = stdenvNoCC.hostPlatform;
-  nodePlatform = hostPlatform.parsed.kernel.name; # nodejs's `process.platform`
-  nodeArch = # nodejs's `process.arch`
-    {
-      "x86_64" = "x64";
-      "aarch64" = "arm64";
-    }
-    .${hostPlatform.parsed.cpu.name}
-      or (throw "affine(${buildType}): unsupported CPU family ${hostPlatform.parsed.cpu.name}");
+  nodePlatform = hostPlatform.node.platform;
+  nodeArch = hostPlatform.node.arch;
   electron = electron_35;
   nodejs = nodejs_22;
   yarn-berry = yarn-berry_4.override { inherit nodejs; };

pkgs/by-name/al/alsa-ucm-conf/package.nix

@@ -2,18 +2,18 @@
   directoryListingUpdater,
   fetchurl,
   lib,
-  stdenv,
+  stdenvNoCC,
   coreutils,
   kmod,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alsa-ucm-conf";
-  version = "1.2.12";
+  version = "1.2.14";
 
   src = fetchurl {
     url = "mirror://alsa/lib/alsa-ucm-conf-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-Fo58BUm3v4mRCS+iv7kDYx33edxMQ+6PQnf8t3LYwDU=";
+    hash = "sha256-MumAn1ktkrl4qhAy41KTwzuNDx7Edfk3Aiw+6aMGnCE=";
   };
 
   dontBuild = true;
@@ -24,21 +24,10 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace ucm2/lib/card-init.conf \
       --replace-fail "/bin/rm" "${coreutils}/bin/rm" \
       --replace-fail "/bin/mkdir" "${coreutils}/bin/mkdir"
-
-    files=(
-        "ucm2/HDA/HDA.conf"
-        "ucm2/codecs/rt715/init.conf"
-        "ucm2/codecs/rt715-sdca/init.conf"
-        "ucm2/Intel/cht-bsw-rt5672/cht-bsw-rt5672.conf"
-        "ucm2/Intel/bytcr-rt5640/bytcr-rt5640.conf"
-    )
-
   ''
-  + lib.optionalString stdenv.hostPlatform.isLinux ''
-    for file in "''${files[@]}"; do
-        substituteInPlace "$file" \
-            --replace-fail '/sbin/modprobe' '${kmod}/bin/modprobe'
-    done
+  + lib.optionalString stdenvNoCC.hostPlatform.isLinux ''
+    substituteInPlace ucm2/common/ctl/led.conf \
+      --replace-fail '/sbin/modprobe' '${kmod}/bin/modprobe'
   ''
   + ''
 
@@ -62,7 +51,11 @@ stdenv.mkDerivation (finalAttrs: {
     '';
 
     license = lib.licenses.bsd3;
-    maintainers = [ lib.maintainers.roastiek ];
+    maintainers = with lib.maintainers; [
+      roastiek
+      mvs
+    ];
+
     platforms = lib.platforms.linux ++ lib.platforms.freebsd;
   };
 })

pkgs/by-name/au/audit/musl.patch

@@ -1,76 +0,0 @@
-From 87c782153deb10bd8c3345723a8bcee343826e78 Mon Sep 17 00:00:00 2001
-From: Grimmauld <Grimmauld@grimmauld.de>
-Date: Thu, 10 Jul 2025 18:58:31 +0200
-Subject: [PATCH 1/2] lib/audit_logging.h: fix includes for musl
-
-`sys/types.h` is indirectly included with `glibc`,
-but needs to be specified explicitly on musl.
----
- lib/audit_logging.h | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/lib/audit_logging.h b/lib/audit_logging.h
-index 9082a2720..c58861b1e 100644
---- a/lib/audit_logging.h
-+++ b/lib/audit_logging.h
-@@ -25,6 +25,7 @@
- 
- // Next include is to pick up the function attribute macros
- #include <features.h>
-+#include <sys/types.h>
- #include <audit-records.h>
- 
- #ifdef __cplusplus
-
-From 98adfcc4bfa66ac25db0b609d7172d7d40c4f85f Mon Sep 17 00:00:00 2001
-From: Grimmauld <Grimmauld@grimmauld.de>
-Date: Fri, 11 Jul 2025 08:11:21 +0200
-Subject: [PATCH 2/2] Guard __attr_dealloc_free seperately from __attr_dealloc
-
-Otherwise, header include order matters when building against a libc that
-does not itself define __attr_dealloc_free, such as musl.
----
- auparse/auparse.h   | 2 ++
- lib/audit_logging.h | 2 ++
- lib/libaudit.h      | 2 ++
- 3 files changed, 6 insertions(+)
-
-diff --git a/auparse/auparse.h b/auparse/auparse.h
-index 48375e2c7..ba5139625 100644
---- a/auparse/auparse.h
-+++ b/auparse/auparse.h
-@@ -31,6 +31,8 @@
- #endif
- #ifndef __attr_dealloc
- # define __attr_dealloc(dealloc, argno)
-+#endif
-+#ifndef __attr_dealloc_free
- # define __attr_dealloc_free
- #endif
- #ifndef __attribute_malloc__
-diff --git a/lib/audit_logging.h b/lib/audit_logging.h
-index c58861b1e..fab7e75d1 100644
---- a/lib/audit_logging.h
-+++ b/lib/audit_logging.h
-@@ -40,6 +40,8 @@ extern "C" {
- #endif
- #ifndef __attr_dealloc
- # define __attr_dealloc(dealloc, argno)
-+#endif
-+#ifndef __attr_dealloc_free
- # define __attr_dealloc_free
- #endif
- // Warn unused result
-diff --git a/lib/libaudit.h b/lib/libaudit.h
-index 2c51853b7..cce5dc493 100644
---- a/lib/libaudit.h
-+++ b/lib/libaudit.h
-@@ -43,6 +43,8 @@
- // malloc and free assignments
- #ifndef __attr_dealloc
- # define __attr_dealloc(dealloc, argno)
-+#endif
-+#ifndef __attr_dealloc_free
- # define __attr_dealloc_free
- #endif
- #ifndef __attribute_malloc__

pkgs/by-name/au/audit/package.nix

@@ -4,12 +4,14 @@
   fetchFromGitHub,
   autoreconfHook,
   bash,
+  bashNonInteractive,
   buildPackages,
   linuxHeaders,
   python3,
   swig,
   pkgsCross,
   libcap_ng,
+  installShellFiles,
 
   # Enabling python support while cross compiling would be possible, but the
   # configure script tries executing python to gather info instead of relying on
@@ -21,20 +23,15 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "audit";
-  version = "4.1.0";
+  version = "4.1.1-unstable-2025-08-01";
 
   src = fetchFromGitHub {
     owner = "linux-audit";
     repo = "audit-userspace";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-MWlHaGue7Ca8ks34KNg74n4Rfj8ivqAhLOJHeyE2Q04=";
+    rev = "bee5984843d0b38992a369825a87a65fb54b18fc"; # musl fixes, --disable-legacy-actions and --runstatedir support
+    hash = "sha256-l3JHWEHz2xGrYxEvfCUD29W8xm5llUnXwX5hLymRG74=";
   };
 
-  patches = [
-    # https://github.com/linux-audit/audit-userspace/pull/476
-    ./musl.patch
-  ];
-
   postPatch = ''
     substituteInPlace bindings/swig/src/auditswig.i \
       --replace-fail "/usr/include/linux/audit.h" \
@@ -61,6 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     autoreconfHook
+    installShellFiles
   ]
   ++ lib.optionals enablePython [
     python3
@@ -76,14 +74,34 @@ stdenv.mkDerivation (finalAttrs: {
     # z/OS plugin is not useful on Linux, and pulls in an extra openldap
     # dependency otherwise
     "--disable-zos-remote"
+    # remove legacy start/stop scripts to remove a bash dependency in $lib
+    # People interested in logging auditd interactions (e.g. for compliance) can start/stop audit using `auditctl --signal`
+    # See also https://github.com/linux-audit/audit-userspace?tab=readme-ov-file#starting-and-stopping-the-daemon
+    "--disable-legacy-actions"
     "--with-arm"
     "--with-aarch64"
+    "--with-io_uring"
+    # allows putting audit files in /run/audit, which removes the requirement
+    # to wait for tmpfiles to set up the /var/run -> /run symlink
+    "--runstatedir=/run"
     # capability dropping, currently mostly for plugins as those get spawned as root
     # see auditd-plugins(5)
     "--with-libcap-ng=yes"
     (if enablePython then "--with-python" else "--without-python")
   ];
 
+  __structuredAttrs = true;
+
+  # lib output is part of the mandatory nixos system closure, so avoid bash here
+  outputChecks.lib.disallowedRequisites = [
+    bash
+    bashNonInteractive
+  ];
+
+  postInstall = ''
+    installShellCompletion --bash init.d/audit.bash_completion
+  '';
+
   enableParallelBuilding = true;
 
   passthru = {
@@ -98,7 +116,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://people.redhat.com/sgrubb/audit/";
     description = "Audit Library";
-    changelog = "https://github.com/linux-audit/audit-userspace/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/linux-audit/audit-userspace/releases/tag/v4.1.1";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ grimmauld ];
     pkgConfigModules = [

pkgs/by-name/aw/aws-c-auth/package.nix

@@ -16,13 +16,13 @@
 stdenv.mkDerivation rec {
   pname = "aws-c-auth";
   # nixpkgs-update: no auto update
-  version = "0.8.1";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-auth";
     rev = "v${version}";
-    hash = "sha256-p8D79BRjaPlhzap/FWbqMlkrbVELSgeJW8CljxBAaCI=";
+    hash = "sha256-HzDUINTmgjW7rNEe+5iwZBv6ayxNKmGAJy+Lg4tp1t0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/aw/aws-c-cal/aws-c-cal-musl-compat.patch

@@ -1,33 +0,0 @@
-From: Emil Lerch <emil@lerch.org>
-Date: Wed, 28 Apr 2021 17:46:24 -0700
-Subject: [PATCH] Allow dlopen to fail on musl systems
-
-Now that references are forced when linking statically, the assertion is
-no longer necessary. See https://github.com/awslabs/aws-c-cal/pull/54
----
- source/unix/openssl_platform_init.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/source/unix/openssl_platform_init.c b/source/unix/openssl_platform_init.c
-index 5266ecc1..99f210bd 100644
---- a/source/unix/openssl_platform_init.c
-+++ b/source/unix/openssl_platform_init.c
-@@ -496,7 +502,6 @@ static enum aws_libcrypto_version s_resolve_libcrypto(void) {
-     /* Try to auto-resolve against what's linked in/process space */
-     FLOGF("searching process and loaded modules");
-     void *process = dlopen(NULL, RTLD_NOW);
--    AWS_FATAL_ASSERT(process && "Unable to load symbols from process space");
-     enum aws_libcrypto_version result = s_resolve_libcrypto_symbols(AWS_LIBCRYPTO_LC, process);
-     if (result == AWS_LIBCRYPTO_NONE) {
-         result = s_resolve_libcrypto_symbols(AWS_LIBCRYPTO_1_0_2, process);
-@@ -504,7 +509,9 @@ static enum aws_libcrypto_version s_resolve_libcrypto(void) {
-     if (result == AWS_LIBCRYPTO_NONE) {
-         result = s_resolve_libcrypto_symbols(AWS_LIBCRYPTO_1_1_1, process);
-     }
--    dlclose(process);
-+    if (process) {
-+        dlclose(process);
-+    }
- 
-     if (result == AWS_LIBCRYPTO_NONE) {
-         FLOGF("libcrypto symbols were not statically linked, searching for shared libraries");

pkgs/by-name/aw/aws-c-cal/package.nix

@@ -11,20 +11,15 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-c-cal";
   # nixpkgs-update: no auto update
-  version = "0.8.0";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-cal";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-dYFUYdMQMT8CZFMrCrhQ8JPEhA4CVf+f7VLFt3JNmn8=";
+    hash = "sha256-ufMoB71xebxO/Cu/xVQ3BMrcCgIlkG+MXH2Ru2i6uXo=";
   };
 
-  patches = [
-    # Fix openssl adaptor code for musl based static binaries.
-    ./aws-c-cal-musl-compat.patch
-  ];
-
   nativeBuildInputs = [ cmake ];
 
   buildInputs = [

pkgs/by-name/aw/aws-c-common/package.nix

@@ -9,13 +9,13 @@
 stdenv.mkDerivation rec {
   pname = "aws-c-common";
   # nixpkgs-update: no auto update
-  version = "0.10.3";
+  version = "0.12.4";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-common";
     rev = "v${version}";
-    hash = "sha256-sA6CsLLHh4Ce/+ffl4OhisMSgdrD+EmXvTNGSq7/vvk=";
+    hash = "sha256-hKCIPZlLPyH7D3Derk2onyqTzWGUtCx+f2+EKtAKlwA=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/aw/aws-c-compression/package.nix

@@ -10,13 +10,13 @@
 stdenv.mkDerivation rec {
   pname = "aws-c-compression";
   # nixpkgs-update: no auto update
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-compression";
     rev = "v${version}";
-    sha256 = "sha256-EjvOf2UMju6pycPdYckVxqQ34VOhrIIyvK+O3AVRED4=";
+    sha256 = "sha256-gpru+hnppgLHhcPfVBOaMdcT6e8wUjZmY7Caaa/KAW4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/aw/aws-c-event-stream/package.nix

@@ -15,13 +15,13 @@
 stdenv.mkDerivation rec {
   pname = "aws-c-event-stream";
   # nixpkgs-update: no auto update
-  version = "0.5.0";
+  version = "0.5.5";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-event-stream";
     rev = "v${version}";
-    hash = "sha256-lg1qS/u5Fi8nt/tv2ekd8dgQ7rlrF3DrRxqidAoEywY=";
+    hash = "sha256-wVjpDKKwoksq5gFtvhH76c7ciP0XmMozhkWmzY6GwgU=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/aw/aws-c-http/package.nix

@@ -14,13 +14,13 @@
 stdenv.mkDerivation rec {
   pname = "aws-c-http";
   # nixpkgs-update: no auto update
-  version = "0.9.2";
+  version = "0.10.4";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-http";
     rev = "v${version}";
-    hash = "sha256-3nT64dFUcuwPfhQDwY5MTe/xPdr7XZMBpVL7V0y9tng=";
+    hash = "sha256-t9PoxOjgV9qLris+C18SaEwXodBGcgK591LZl0dajxU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/aw/aws-c-io/package.nix

@@ -12,13 +12,13 @@
 stdenv.mkDerivation rec {
   pname = "aws-c-io";
   # nixpkgs-update: no auto update
-  version = "0.15.3";
+  version = "0.21.2";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-io";
     rev = "v${version}";
-    hash = "sha256-/pG/+MHAu/TYTtY/RQrr1U1ev2FZ1p/O8kIRUDDOcvQ=";
+    hash = "sha256-QNf4TJIqtypDliiu6I72CbgjyJhdS9Uuim9tZOb3SJs=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/aw/aws-c-mqtt/package.nix

@@ -15,13 +15,13 @@
 stdenv.mkDerivation rec {
   pname = "aws-c-mqtt";
   # nixpkgs-update: no auto update
-  version = "0.11.0";
+  version = "0.13.3";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-mqtt";
     rev = "v${version}";
-    hash = "sha256-gIoC3OG6VFzNH9/DjuC42eCIuN+w1AikaGAbx6ao8qQ=";
+    hash = "sha256-Nf8c5iVl+NOPZFjsAPCMOGq2e7D8e7PafuMQh6t0DYw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/aw/aws-c-s3/package.nix

@@ -17,13 +17,13 @@
 stdenv.mkDerivation rec {
   pname = "aws-c-s3";
   # nixpkgs-update: no auto update
-  version = "0.7.1";
+  version = "0.8.6";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-s3";
     rev = "v${version}";
-    hash = "sha256-UE42U3UszobaUdo0ry9IlwTbSbGqmYkux19ILrVgUZY=";
+    hash = "sha256-g2w1igjv0N0o6+bewypJm2coHTvhYN2v8usdMN7TBI4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/aw/aws-c-sdkutils/package.nix

@@ -10,13 +10,13 @@
 stdenv.mkDerivation rec {
   pname = "aws-c-sdkutils";
   # nixpkgs-update: no auto update
-  version = "0.2.1";
+  version = "0.2.4";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-sdkutils";
     rev = "v${version}";
-    hash = "sha256-Z9c+uBiGMXW5v+khdNaElhno16ikBO4voTzwd2mP6rA=";
+    hash = "sha256-zc8E5ESZxXBJ6WA/V5i2Us61UcNf9wXa2k63NWqGRtI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/aw/aws-checksums/package.nix

@@ -10,13 +10,13 @@
 stdenv.mkDerivation rec {
   pname = "aws-checksums";
   # nixpkgs-update: no auto update
-  version = "0.2.2";
+  version = "0.2.7";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-checksums";
     rev = "v${version}";
-    sha256 = "sha256-hiqV6FrOZ19YIxL3UKBuexLJwoC2mY7lqysnV7ze0gg=";
+    sha256 = "sha256-dYDTDWZJJ0JlvkMfLS376uUt5QzSmbV0UNRC4aq35TY=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/aw/aws-crt-cpp/0001-build-Make-includedir-properly-overrideable.patch

@@ -1,65 +0,0 @@
-From b3a46b9a2a9f86ff416a0ff5f84882c0dedebd14 Mon Sep 17 00:00:00 2001
-From: Jan Tojnar <jtojnar@gmail.com>
-Date: Sun, 9 Jan 2022 01:57:18 +0100
-Subject: [PATCH] build: Make includedir properly overrideable
-
-This is required by some package managers like Nix.
-
-Co-authored-by: Artturin <Artturin@artturin.com>
----
- CMakeLists.txt | 26 +++++++++++++++-----------
- 1 file changed, 15 insertions(+), 11 deletions(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 9f062ca..b28f13c 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -49,6 +49,10 @@ if(${CMAKE_INSTALL_LIBDIR} STREQUAL "lib64")
-     set(FIND_LIBRARY_USE_LIB64_PATHS true)
- endif()
- 
-+if(NOT DEFINED CMAKE_INSTALL_INCLUDEDIR)
-+    set(CMAKE_INSTALL_INCLUDEDIR "include")
-+endif()
-+
- if(NOT CMAKE_CXX_STANDARD)
-     set(CMAKE_CXX_STANDARD 11)
- endif()
-@@ -329,7 +333,7 @@ endif()
- target_include_directories(${PROJECT_NAME} PUBLIC
-     $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
-     $<BUILD_INTERFACE:${GENERATED_INCLUDE_DIR}>
--    $<INSTALL_INTERFACE:include>)
-+    $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>)
- 
- aws_use_package(aws-c-http)
- aws_use_package(aws-c-mqtt)
-@@ -346,16 +350,16 @@ aws_add_sanitizers(${PROJECT_NAME})
- 
- target_link_libraries(${PROJECT_NAME} PUBLIC ${DEP_AWS_LIBS})
- 
--install(FILES ${AWS_CRT_HEADERS} DESTINATION "include/aws/crt" COMPONENT Development)
--install(FILES ${AWS_CRT_AUTH_HEADERS} DESTINATION "include/aws/crt/auth" COMPONENT Development)
--install(FILES ${AWS_CRT_CHECKSUM_HEADERS} DESTINATION "include/aws/crt/checksum" COMPONENT Development)
--install(FILES ${AWS_CRT_CRYPTO_HEADERS} DESTINATION "include/aws/crt/crypto" COMPONENT Development)
--install(FILES ${AWS_CRT_IO_HEADERS} DESTINATION "include/aws/crt/io" COMPONENT Development)
--install(FILES ${AWS_CRT_IOT_HEADERS} DESTINATION "include/aws/iot" COMPONENT Development)
--install(FILES ${AWS_CRT_MQTT_HEADERS} DESTINATION "include/aws/crt/mqtt" COMPONENT Development)
--install(FILES ${AWS_CRT_HTTP_HEADERS} DESTINATION "include/aws/crt/http" COMPONENT Development)
--install(FILES ${AWS_CRT_ENDPOINT_HEADERS} DESTINATION "include/aws/crt/endpoints" COMPONENT Development)
--install(FILES ${AWS_CRT_CBOR_HEADERS} DESTINATION "include/aws/crt/cbor" COMPONENT Development)
-+install(FILES ${AWS_CRT_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/crt" COMPONENT Development)
-+install(FILES ${AWS_CRT_AUTH_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/crt/auth" COMPONENT Development)
-+install(FILES ${AWS_CRT_CHECKSUM_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/crt/checksum" COMPONENT Development)
-+install(FILES ${AWS_CRT_CRYPTO_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/crt/crypto" COMPONENT Development)
-+install(FILES ${AWS_CRT_IO_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/crt/io" COMPONENT Development)
-+install(FILES ${AWS_CRT_IOT_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/iot" COMPONENT Development)
-+install(FILES ${AWS_CRT_MQTT_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/crt/mqtt" COMPONENT Development)
-+install(FILES ${AWS_CRT_HTTP_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/crt/http" COMPONENT Development)
-+install(FILES ${AWS_CRT_ENDPOINT_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/crt/endpoints" COMPONENT Development)
-+install(FILES ${AWS_CRT_CBOR_HEADERS} DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/aws/crt/cbor" COMPONENT Development)
- 
- install(
-     TARGETS ${PROJECT_NAME}
--- 
-2.46.0

pkgs/by-name/aw/aws-crt-cpp/package.nix

@@ -20,7 +20,7 @@
 stdenv.mkDerivation rec {
   pname = "aws-crt-cpp";
   # nixpkgs-update: no auto update
-  version = "0.29.4";
+  version = "0.33.1";
 
   outputs = [
     "out"
@@ -31,17 +31,13 @@ stdenv.mkDerivation rec {
     owner = "awslabs";
     repo = "aws-crt-cpp";
     rev = "v${version}";
-    sha256 = "sha256-Uv1BHM39f9soq7kziedqRhHqQ/xwnqcz++1UM5nuo8g=";
+    sha256 = "sha256-C8KWe5+CXujD8nN3gLkjaaMld15sat/ohwEKhyWELKI=";
   };
 
-  patches = [
-    # Correct include path for split outputs.
-    # https://github.com/awslabs/aws-crt-cpp/pull/325
-    ./0001-build-Make-includedir-properly-overrideable.patch
-  ];
-
   postPatch = ''
-    substituteInPlace CMakeLists.txt --replace '-Werror' ""
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "$<INSTALL_INTERFACE:include>" "$<INSTALL_INTERFACE:$dev/include>" \
+      --replace-fail '-Werror' ""
   '';
 
   nativeBuildInputs = [

pkgs/by-name/aw/aws-sdk-cpp/package.nix

@@ -33,13 +33,13 @@ in
 stdenv.mkDerivation rec {
   pname = "aws-sdk-cpp";
   # nixpkgs-update: no auto update
-  version = "1.11.448";
+  version = "1.11.612";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-sdk-cpp";
     rev = version;
-    hash = "sha256-K0UFs7vOeZeQIs3G5L4FfEWXDGTXT9ssr/vQwa1l2lw=";
+    hash = "sha256-W4eKgUvN2NLYEOO47HTJYJpEmyn10gNK29RIrvoXkek=";
   };
 
   postPatch = ''

pkgs/by-name/aw/awscli/package.nix

@@ -14,14 +14,14 @@ let
     pname = "awscli";
     # N.B: if you change this, change botocore and boto3 to a matching version too
     # check e.g. https://github.com/aws/aws-cli/blob/1.33.21/setup.py
-    version = "1.40.31";
+    version = "1.42.4";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "aws";
       repo = "aws-cli";
       tag = version;
-      hash = "sha256-BjQyA7uK9F/5myPXsMpD0HZK69Se3WveYMHNCzhVNKc=";
+      hash = "sha256-vkQFhSsK9MWhp+jvomkVdjxXuBOH4GnFgz/9jtPRNIs=";
     };
 
     pythonRelaxDeps = [

pkgs/by-name/aw/awscli2/package.nix

@@ -53,6 +53,7 @@ let
           build-system = with final; [
             setuptools
           ];
+          postPatch = null;
           src = prev.src.override {
             inherit version;
             hash = "sha256-+OzBu6VmdBNFfFKauVW/jGe0XbeZ0VkGYmFxnjKFgKA=";

pkgs/by-name/bm/bmake/package.nix

@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bmake";
-  version = "20250528";
+  version = "20250707";
 
   src = fetchurl {
     url = "https://www.crufty.net/ftp/pub/sjg/bmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-DcOJpeApiqWFNTtgeW1dYy3mYNreWNAKzWCtcihGyaM=";
+    hash = "sha256-phJApAZdkMOSXdd0+Po9c97sGnMiiobulfzYIGPSiwg=";
   };
 
   patches = [

pkgs/by-name/bo/borgbackup/package.nix

@@ -4,6 +4,7 @@
   acl,
   e2fsprogs,
   fetchFromGitHub,
+  fetchpatch,
   libb2,
   lz4,
   openssh,
@@ -30,6 +31,14 @@ python.pkgs.buildPythonApplication rec {
     hash = "sha256-1RRizsHY6q1ruofTkRZ4sSN4k6Hoo+sG85w2zz+7yL8=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "allow-msgpack-1.1.1.patch";
+      url = "https://github.com/borgbackup/borg/commit/f6724bfef2515ed5bf66c9a0434655c60a82aae2.patch";
+      hash = "sha256-UfLaAFKEAHvbIR5WDYJY7bz3aiffdwAXJKfzZZU+NT8=";
+    })
+  ];
+
   postPatch = ''
     # sandbox does not support setuid/setgid/sticky bits
     substituteInPlace src/borg/testsuite/archiver.py \

pkgs/by-name/bu/bundler/package.nix

@@ -13,8 +13,8 @@ buildRubyGem rec {
   inherit ruby;
   name = "${gemName}-${version}";
   gemName = "bundler";
-  version = "2.6.9";
-  source.sha256 = "sha256-olZ1/70FWuEYZ2bMHhILTPYliOiKu1m5nFfiKxxVyes=";
+  version = "2.7.1";
+  source.sha256 = "sha256-CtWgAqh5d2sqmL5lL1V6yHMb4zU2EtY/pO8bJwbcHgs=";
   dontPatchShebangs = true;
 
   postFixup = ''

pkgs/by-name/ca/cacert/package.nix

@@ -23,7 +23,7 @@ let
     lib.concatStringsSep "\n\n" extraCertificateStrings
   );
 
-  srcVersion = "3.113.1";
+  srcVersion = "3.114";
   version = if nssOverride != null then nssOverride.version else srcVersion;
   meta = with lib; {
     homepage = "https://curl.haxx.se/docs/caextract.html";
@@ -47,7 +47,7 @@ let
           owner = "nss-dev";
           repo = "nss";
           rev = "NSS_${lib.replaceStrings [ "." ] [ "_" ] version}_RTM";
-          hash = "sha256-Yfs9Hh98ASJe1D4qyQEXaTC2xjeDI2Cdxp5Xgy0rYdQ=";
+          hash = "sha256-YVtXk1U9JtqfOH7+m/+bUI/yXJcydqjjGbCy/5xbMe8=";
         };
 
     dontBuild = true;

pkgs/by-name/ca/cargo-c/package.nix

@@ -10,18 +10,21 @@
   rav1e,
 }:
 
+let
+  # this version may need to be updated along with package version
+  cargoVersion = "0.89.0";
+in
 rustPlatform.buildRustPackage rec {
   pname = "cargo-c";
-  version = "0.10.2";
+  version = "0.10.14";
 
   src = fetchCrate {
     inherit pname;
-    # this version may need to be updated along with package version
-    version = "${version}+cargo-0.80.0";
-    hash = "sha256-ltxd4n3oo8ZF/G/zmR4FSVtNOkxwCjDv6PdxkmWxZ+8=";
+    version = "${version}+cargo-${cargoVersion}";
+    hash = "sha256-t6cbufPdpyaFzwEFWt19Nid2S5FXCJCS+SHJ0aJICX0=";
   };
 
-  cargoHash = "sha256-tCJ7Giyj7Wqowhk0N7CkvAiWvF6DBNw7G7aAnn2+mp8=";
+  cargoHash = "sha256-nW+akmbpIGZnhJLBdwDAGI4m5eSwdT2Z/iY2RV4zMQY=";
 
   nativeBuildInputs = [
     pkg-config
@@ -45,8 +48,11 @@ rustPlatform.buildRustPackage rec {
     runHook postInstallCheck
   '';
 
-  passthru.tests = {
-    inherit rav1e;
+  passthru = {
+    tests = {
+      inherit rav1e;
+    };
+    updateScript.command = [ ./update.sh ];
   };
 
   meta = {

pkgs/by-name/ca/cargo-c/update.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash curl coreutils nix-update jq
+
+set -ex
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
+
+latestVersion=`curl https://crates.io/api/v1/crates/cargo-c/versions | jq '.versions[0].num | split("+cargo-")'`
+crateVersion=`jq -r '.[0]' <<< $latestVersion`
+cargoVersion=`jq -r '.[1]' <<< $latestVersion`
+
+sed -E -i "s/(cargoVersion = ).*;/\1\"$cargoVersion\";/" $SCRIPT_DIR/package.nix
+
+nix-update cargo-c --version="$crateVersion"

pkgs/by-name/ch/chameleon-cli/package.nix

@@ -1,91 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-  cmake,
-  makeWrapper,
-  xz,
-  python3,
-}:
-
-let
-  # https://github.com/RfidResearchGroup/ChameleonUltra/blob/main/software/script/requirements.txt
-  pythonPath =
-    with python3.pkgs;
-    makePythonPath [
-      colorama
-      prompt-toolkit
-      pyserial
-    ];
-in
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "chameleon-cli";
-  version = "2.0.0-unstable-2025-08-04";
-
-  src = fetchFromGitHub {
-    owner = "RfidResearchGroup";
-    repo = "ChameleonUltra";
-    rev = "098e0a914b206900f7ea7ae7265486c4349ab644";
-    sparseCheckout = [ "software" ];
-    hash = "sha256-WKxP4jLHkTqBO+nwxhr8DRb3TzDIMlwjA4v+6txQbDo=";
-  };
-
-  sourceRoot = "${finalAttrs.src.name}/software";
-
-  patches = [
-    # Use execute_tool to simplify running hardnested tool,
-    # also fix when the dir conatains hardnested is read only
-    # https://github.com/RfidResearchGroup/ChameleonUltra/pull/266
-    (fetchpatch {
-      url = "https://github.com/RfidResearchGroup/ChameleonUltra/commit/39270fd09ee61ef0659bf3b79ffa4d2b27f3ba63.patch";
-      hash = "sha256-OlHQ2cL+NFdTsSPFI9geg3dabATRjyKxGp5gGG+eDl8=";
-      stripLen = 1;
-    })
-  ];
-
-  postPatch = ''
-    substituteInPlace src/CMakeLists.txt \
-      --replace-fail "liblzma" "lzma" \
-      --replace-fail "FetchContent_MakeAvailable(xz)" ""
-  '';
-
-  nativeBuildInputs = [
-    cmake
-    makeWrapper
-  ];
-
-  buildInputs = [
-    xz
-  ];
-
-  cmakeFlags = [
-    "-S"
-    "../src"
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/libexec
-    cp -r ../script/* $out/libexec
-    rm -r $out/libexec/tests
-    rm $out/libexec/requirements.txt
-    makeWrapper ${lib.getExe python3} $out/bin/chameleon-cli \
-      --add-flags "$out/libexec/chameleon_cli_main.py" \
-      --prefix PYTHONPATH : ${pythonPath}
-
-    runHook postInstall
-  '';
-
-  passthru.updateScript = ./update.sh;
-
-  meta = {
-    description = "Command line interface for Chameleon Ultra";
-    homepage = "https://github.com/RfidResearchGroup/ChameleonUltra";
-    license = lib.licenses.gpl3Only;
-    mainProgram = "chameleon-cli";
-    maintainers = with lib.maintainers; [ azuwis ];
-  };
-})

pkgs/by-name/ch/chameleon-cli/update.sh

@@ -1,18 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils nix-update
-
-# This update script exists, because nix-update is unable to ignore `dev`
-# tags that exist on the upstream repo.
-#
-# Once https://github.com/Mic92/nix-update/issues/322 is resolved it can be
-# removed.
-
-set -exuo pipefail
-
-cd "$(git rev-parse --show-toplevel)"
-
-nix-update --version=branch chameleon-cli
-
-tag=$(git ls-remote --tags --refs --sort='-version:refname' https://github.com/RfidResearchGroup/ChameleonUltra.git 'v*' | head -n 1 | cut --delimiter=/ --field=3-)
-tag="${tag#v}"
-sed -i -e 's|version = "[^-]*-unstable-|version = "'"${tag}"'-unstable-|' pkgs/by-name/ch/chameleon-cli/package.nix

pkgs/by-name/ch/chatbox/package.nix

@@ -6,11 +6,11 @@
 }:
 let
   pname = "chatbox";
-  version = "1.15.4";
+  version = "1.15.2";
 
   src = fetchurl {
     url = "https://download.chatboxai.app/releases/Chatbox-${version}-x86_64.AppImage";
-    hash = "sha256-plKibAg1tv0Togt+Jlwm8qrTp7UbBmuEM20xKLi7bb4=";
+    hash = "sha256-KxL073BIfZfjFndwtkDNXwlt1xny76BMV9CQF3x7ATQ=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };

pkgs/by-name/ch/chhoto-url/package.nix

@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chhoto-url";
-  version = "6.2.13";
+  version = "6.2.12";
 
   src = fetchFromGitHub {
     owner = "SinTan1729";
     repo = "chhoto-url";
     tag = finalAttrs.version;
-    hash = "sha256-onGmDAVhT2lzq2pQ5runGuHgPdh1MjgFLU7DUvN7nt0=";
+    hash = "sha256-hV/YWxOPRTojVTFIXwzqImBKyQ1dCDq5+bgCdS7T1p0=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/actix";
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail "./resources/" "${placeholder "out"}/share/chhoto-url/resources/"
   '';
 
-  cargoHash = "sha256-GbjbVr82Aj/CRdBl9gPGwHiyrc7l2F918DNnlEoPI58=";
+  cargoHash = "sha256-9wXbd56KOQ7suZqtg2cSFf2FGQJADFMHJbwAAxJ2V4g=";
 
   postInstall = ''
     mkdir -p $out/share/chhoto-url

pkgs/by-name/ci/ciscoPacketTracer7/package.nix

@@ -1,116 +1,149 @@
 {
-  stdenv,
   lib,
+  stdenvNoCC,
+  requireFile,
+  autoPatchelfHook,
+  dpkg,
+  makeWrapper,
+  alsa-lib,
+  dbus,
+  expat,
+  fontconfig,
+  glib,
+  libdrm,
+  libglvnd,
+  libpulseaudio,
+  libudev0-shim,
+  libxkbcommon,
+  libxml2_13,
+  libxslt,
+  nspr,
+  nss,
+  xorg,
   buildFHSEnv,
   copyDesktopItems,
-  dpkg,
-  fetchurl,
-  libxml2,
-  lndir,
   makeDesktopItem,
-  makeWrapper,
-  requireFile,
+  packetTracerSource ? null,
 }:
 
 let
   version = "7.3.1";
 
-  ptFiles = stdenv.mkDerivation {
-    pname = "PacketTracer7drv";
+  unwrapped = stdenvNoCC.mkDerivation {
+    pname = "ciscoPacketTracer7-unwrapped";
     inherit version;
 
-    dontUnpack = true;
-    src = requireFile {
-      name = "PacketTracer_${builtins.replaceStrings [ "." ] [ "" ] version}_amd64.deb";
-      hash = "sha256-w5gC0V3WHQC6J/uMEW2kX9hWKrS0mZZVWtZriN6s4n8=";
-      url = "https://www.netacad.com";
-    };
+    src =
+      if (packetTracerSource != null) then
+        packetTracerSource
+      else
+        requireFile {
+          name = "PacketTracer_731_amd64.deb";
+          hash = "sha256-w5gC0V3WHQC6J/uMEW2kX9hWKrS0mZZVWtZriN6s4n8=";
+          url = "https://www.netacad.com";
+        };
 
     nativeBuildInputs = [
+      autoPatchelfHook
       dpkg
       makeWrapper
     ];
 
-    installPhase = ''
+    buildInputs = [
+      alsa-lib
+      dbus
+      expat
+      fontconfig
+      glib
+      libdrm
+      libglvnd
+      libpulseaudio
+      libudev0-shim
+      libxkbcommon
+      libxml2_13
+      libxslt
+      nspr
+      nss
+    ]
+    ++ (with xorg; [
+      libICE
+      libSM
+      libX11
+      libXScrnSaver
+    ]);
+
+    unpackPhase = ''
+      runHook preUnpack
+
       dpkg-deb -x $src $out
+      chmod 755 "$out"
+
+      runHook postUnpack
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
       makeWrapper "$out/opt/pt/bin/PacketTracer7" "$out/bin/packettracer7" \
-          --prefix LD_LIBRARY_PATH : "$out/opt/pt/bin"
+        --prefix LD_LIBRARY_PATH : "$out/opt/pt/bin"
+
+      runHook postInstall
     '';
   };
 
-  desktopItem = makeDesktopItem {
-    name = "cisco-pt7.desktop";
-    desktopName = "Cisco Packet Tracer 7";
-    icon = "${ptFiles}/opt/pt/art/app.png";
-    exec = "packettracer7 %f";
-    mimeTypes = [
-      "application/x-pkt"
-      "application/x-pka"
-      "application/x-pkz"
-    ];
-  };
-
-  libxml2' = libxml2.overrideAttrs (oldAttrs: rec {
-    version = "2.13.8";
-    src = fetchurl {
-      url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
-      hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo=";
-    };
-    meta = oldAttrs.meta // {
-      knownVulnerabilities = oldAttrs.meta.knownVulnerabilities or [ ] ++ [
-        "CVE-2025-6021"
-      ];
-    };
-  });
-
-  fhs = buildFHSEnv {
-    pname = "packettracer7";
-    inherit version;
-    runScript = "${ptFiles}/bin/packettracer7";
-
-    targetPkgs =
-      pkgs: with pkgs; [
-        alsa-lib
-        dbus
-        expat
-        fontconfig
-        glib
-        libglvnd
-        libpulseaudio
-        libudev0-shim
-        libxkbcommon
-        libxml2'
-        libxslt
-        nspr
-        nss
-        xorg.libICE
-        xorg.libSM
-        xorg.libX11
-        xorg.libXScrnSaver
-      ];
+  fhs-env = buildFHSEnv {
+    name = "ciscoPacketTracer7-fhs-env";
+    runScript = lib.getExe' unwrapped "packettracer7";
+    targetPkgs = _: [ libudev0-shim ];
   };
 in
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   pname = "ciscoPacketTracer7";
   inherit version;
 
   dontUnpack = true;
 
+  nativeBuildInputs = [
+    copyDesktopItems
+  ];
+
   installPhase = ''
-    mkdir $out
-    ${lndir}/bin/lndir -silent ${fhs} $out
+    runHook preInstall
+
+    mkdir -p $out/bin
+    ln -s ${fhs-env}/bin/${fhs-env.name} $out/bin/packettracer7
+
+    mkdir -p $out/share/icons/hicolor/48x48/apps
+    ln -s ${unwrapped}/opt/pt/art/app.png $out/share/icons/hicolor/48x48/apps/cisco-packet-tracer-7.png
+    ln -s ${unwrapped}/usr/share/icons/gnome/48x48/mimetypes $out/share/icons/hicolor/48x48/mimetypes
+    ln -s ${unwrapped}/usr/share/mime $out/share/mime
+
+    runHook postInstall
   '';
 
-  desktopItems = [ desktopItem ];
+  desktopItems = [
+    (makeDesktopItem {
+      name = "cisco-pt7.desktop";
+      desktopName = "Cisco Packet Tracer 7";
+      icon = "cisco-packet-tracer-7";
+      exec = "packettracer7 %f";
+      mimeTypes = [
+        "application/x-pkt"
+        "application/x-pka"
+        "application/x-pkz"
+      ];
+    })
+  ];
 
-  nativeBuildInputs = [ copyDesktopItems ];
-
-  meta = with lib; {
+  meta = {
     description = "Network simulation tool from Cisco";
     homepage = "https://www.netacad.com/courses/packet-tracer";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
-    maintainers = with maintainers; [ ];
+    license = lib.licenses.unfree;
+    mainProgram = "packettracer7";
+    maintainers = with lib.maintainers; [
+      gepbird
+    ];
     platforms = [ "x86_64-linux" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
 }

pkgs/by-name/ci/ciscoPacketTracer8/package.nix

@@ -3,11 +3,11 @@
   stdenvNoCC,
   requireFile,
   autoPatchelfHook,
+  dpkg,
   makeWrapper,
   alsa-lib,
   dbus,
   expat,
-  fetchurl,
   fontconfig,
   glib,
   libdrm,
@@ -15,13 +15,12 @@
   libpulseaudio,
   libudev0-shim,
   libxkbcommon,
-  libxml2,
+  libxml2_13,
   libxslt,
   nspr,
-  wayland,
   nss,
+  wayland,
   xorg,
-  dpkg,
   buildFHSEnv,
   copyDesktopItems,
   makeDesktopItem,
@@ -41,19 +40,6 @@ let
     "8.2.2" = "CiscoPacketTracer822_amd64_signed.deb";
   };
 
-  libxml2' = libxml2.overrideAttrs (oldAttrs: rec {
-    version = "2.13.8";
-    src = fetchurl {
-      url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
-      hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo=";
-    };
-    meta = oldAttrs.meta // {
-      knownVulnerabilities = oldAttrs.meta.knownVulnerabilities or [ ] ++ [
-        "CVE-2025-6021"
-      ];
-    };
-  });
-
   unwrapped = stdenvNoCC.mkDerivation {
     name = "ciscoPacketTracer8-unwrapped";
     inherit version;
@@ -68,9 +54,13 @@ let
           url = "https://www.netacad.com";
         };
 
-    buildInputs = [
+    nativeBuildInputs = [
       autoPatchelfHook
+      dpkg
       makeWrapper
+    ];
+
+    buildInputs = [
       alsa-lib
       dbus
       expat
@@ -81,7 +71,7 @@ let
       libpulseaudio
       libudev0-shim
       libxkbcommon
-      libxml2'
+      libxml2_13
       libxslt
       nspr
       nss
@@ -111,7 +101,7 @@ let
     unpackPhase = ''
       runHook preUnpack
 
-      ${lib.getExe' dpkg "dpkg-deb"} -x $src $out
+      dpkg-deb -x $src $out
       chmod 755 "$out"
 
       runHook postUnpack
@@ -130,7 +120,7 @@ let
   fhs-env = buildFHSEnv {
     name = "ciscoPacketTracer8-fhs-env";
     runScript = lib.getExe' unwrapped "packettracer8";
-    targetPkgs = pkgs: [ libudev0-shim ];
+    targetPkgs = _: [ libudev0-shim ];
   };
 in
 
@@ -151,7 +141,7 @@ stdenvNoCC.mkDerivation {
     ln -s ${fhs-env}/bin/${fhs-env.name} $out/bin/packettracer8
 
     mkdir -p $out/share/icons/hicolor/48x48/apps
-    ln -s ${unwrapped}/opt/pt/art/app.png $out/share/icons/hicolor/48x48/apps/cisco-packet-tracer.png
+    ln -s ${unwrapped}/opt/pt/art/app.png $out/share/icons/hicolor/48x48/apps/cisco-packet-tracer-8.png
     ln -s ${unwrapped}/usr/share/icons/gnome/48x48/mimetypes $out/share/icons/hicolor/48x48/mimetypes
     ln -s ${unwrapped}/usr/share/mime $out/share/mime
 
@@ -162,7 +152,7 @@ stdenvNoCC.mkDerivation {
     (makeDesktopItem {
       name = "cisco-pt8.desktop";
       desktopName = "Cisco Packet Tracer 8";
-      icon = "cisco-packet-tracer";
+      icon = "cisco-packet-tracer-8";
       exec = "packettracer8 %f";
       mimeTypes = [
         "application/x-pkt"

pkgs/by-name/cl/clouddrive2/package.nix

@@ -11,16 +11,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "clouddrive2";
-  version = "0.9.5";
+  version = "0.9.4";
 
   src = fetchurl {
     url = "https://github.com/cloud-fs/cloud-fs.github.io/releases/download/v${finalAttrs.version}/clouddrive-2-${os}-${arch}-${finalAttrs.version}.tgz";
     hash =
       {
-        x86_64-linux = "sha256-Gsq5rvr0SeGxCRwAeeFRZBPOe32EIa7uO6SAIuinezA=";
-        aarch64-linux = "sha256-M+lCUzoiy/sImBZrOjjeP4eqG3F4wbkMQg9Ho3ELGFo=";
-        x86_64-darwin = "sha256-Uyz1wuHICSq5C+n3ZjPinZznhajd6QR36CZgQBm+QRE=";
-        aarch64-darwin = "sha256-ZQxRHTzLUAhnL1rRLR9l8Ix5XzxeTAds7XAmEgZ9Xmo=";
+        x86_64-linux = "sha256-i6+YoZfCFaVcF7XO7wPo8AEpU0LrD4bcsIqLNz/V3aM=";
+        aarch64-linux = "sha256-BV+47uJnvH/Gapz7dACnXIM49x7u/MTdbXiFRGq2DVc=";
+        x86_64-darwin = "sha256-Jjsdx203akCmlveGZD1x8fO6V0N5d3AzGAFIAzgOkHs=";
+        aarch64-darwin = "sha256-DuSZoXTQyfC3CIwNGTsGuQNP410rK9qMBei5T7TZN7A=";
       }
       .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
   };

pkgs/by-name/cp/cpuinfo/package.nix

@@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "cpuinfo";
-  version = "0-unstable-2025-06-10";
+  version = "0-unstable-2025-07-24";
 
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "cpuinfo";
-    rev = "d7427551d6531037da216d20cd36feb19ed4905f";
-    hash = "sha256-gJgvE3823NyVOIL0Grkldde3U/N9NNqlLAA0btj3TSg=";
+    rev = "33ed0be77d7767d0e2010e2c3cf972ef36c7c307";
+    hash = "sha256-0rZzbZkOo6DAt1YnH4rtx0FvmCuYH8M6X3DNJ0gURpU=";
   };
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };

pkgs/by-name/cr/cracklib/package.nix

@@ -1,70 +1,82 @@
-let
-  version = "2.10.0";
-in
 {
   stdenv,
   lib,
-  buildPackages,
-  fetchurl,
+  fetchFromGitHub,
+  autoreconfHook,
   zlib,
-  gettext,
-  fetchpatch2,
-  lists ? [
-    (fetchurl {
-      url = "https://github.com/cracklib/cracklib/releases/download/v${version}/cracklib-words-${version}.gz";
-      hash = "sha256-JDLo/bSLIijC2DUl+8Q704i2zgw5cxL6t68wvuivPpY=";
-    })
-  ],
+  bash,
+  buildPackages,
+  nix-update-script,
+  pkgsCross,
+  pkgsStatic,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "cracklib";
-  inherit version;
+  version = "2.10.3";
 
-  src = fetchurl {
-    url = "https://github.com/${pname}/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    hash = "sha256-cAw5YMplCx6vAhfWmskZuBHyB1o4dGd7hMceOG3V51Y=";
+  src = fetchFromGitHub {
+    owner = "cracklib";
+    repo = "cracklib";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ORpJje4TGw1STtvRiNEwUwSDbLXdS+WgXGlc1Wtf/gw=";
   };
 
-  patches = lib.optionals stdenv.hostPlatform.isDarwin [
-    # Fixes build failure on Darwin due to missing byte order functions.
-    # https://github.com/cracklib/cracklib/pull/96
-    (fetchpatch2 {
-      url = "https://github.com/cracklib/cracklib/commit/dff319e543272c1fb958261cf9ee8bb82960bc40.patch";
-      hash = "sha256-QaWpEVV6l1kl4OIkJAqkXPVThbo040Rv9X2dY/+syqs=";
-      stripLen = 1;
-    })
+  sourceRoot = "${finalAttrs.src.name}/src";
+
+  outputs = [
+    "bin"
+    "out"
+    "dev"
+    "man"
   ];
 
-  nativeBuildInputs = lib.optional (
-    stdenv.hostPlatform != stdenv.buildPlatform
-  ) buildPackages.cracklib;
+  strictDeps = true;
+  enableParallelBuilding = true;
+
+  nativeBuildInputs = [
+    autoreconfHook
+  ]
+  ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ buildPackages.cracklib ];
+
   buildInputs = [
     zlib
-    gettext
+    bash
   ];
 
-  postPatch =
-    lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
-      chmod +x util/cracklib-format
-      patchShebangs util
+  configureFlags = [
+    "--without-python"
+  ];
 
+  postInstall =
+    # For cross compilation use the tools from nativeBuildInputs. Otherwise use
+    # the ones in the util directory of the source tree.
+    lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
+      PATH=$PATH:util
     ''
     + ''
-      ln -vs ${toString lists} dicts/
+      cracklib-format $out/share/cracklib/cracklib-small \
+      | cracklib-packer $out/share/cracklib/pw_dict
     '';
 
-  postInstall = ''
-    make dict-local
-  '';
-  doInstallCheck = true;
-  installCheckTarget = "test";
-
-  meta = with lib; {
-    homepage = "https://github.com/cracklib/cracklib";
-    description = "Library for checking the strength of passwords";
-    license = licenses.lgpl21; # Different license for the wordlist: http://www.openwall.com/wordlists
-    maintainers = with maintainers; [ lovek323 ];
-    platforms = platforms.unix;
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = {
+      cross =
+        let
+          systemString = if stdenv.buildPlatform.isAarch64 then "gnu64" else "aarch64-multiplatform";
+        in
+        pkgsCross.${systemString}.cracklib;
+      static = pkgsStatic.cracklib;
+    };
   };
-}
+
+  meta = {
+    homepage = "https://github.com/cracklib/cracklib";
+    description = "Password checking library";
+    changelog = "https://github.com/cracklib/cracklib/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.lgpl21;
+    maintainers = with lib.maintainers; [ lovek323 ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/cr/crush/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "crush";
-  version = "0.6.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "crush";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QUYNJ2Ifny9Zj9YVQHcH80E2qa4clWVg2T075IEWujM=";
+    hash = "sha256-u2w19Xmcm3cx/B8QRNGaP2qeg+Cif/L92RNlJav6H3w=";
   };
 
-  vendorHash = "sha256-vdzAVVGr7uTW/A/I8TcYW189E3960SCIqatu7Kb60hg=";
+  vendorHash = "sha256-H92TgZoWdYQ863AAb2116zJtmgkKXh2hRoEBRcn5zeA=";
 
   # rename TestMain to prevent it from running, as it panics in the sandbox.
   postPatch = ''

pkgs/by-name/dj/djvulibre/CVE-2021-3500+CVE-2021-32490+CVE-2021-32491+CVE-2021-32492+CVE-2021-32493.patch

@@ -1,105 +0,0 @@
-From cd8b5c97b27a5c1dc83046498b6ca49ad20aa9b6 Mon Sep 17 00:00:00 2001
-From: Leon Bottou <leon@bottou.org>
-Date: Tue, 11 May 2021 14:44:09 -0400
-Subject: [PATCH] Reviewed Fedora patches and adopted some of them (or variants
- thereof)
-
- - Patch0: djvulibre-3.5.22-cdefs.patch                  (forward ported)
-Does not make imuch sense. GSmartPointer.h already includes "stddef.h"
- - Patch6: djvulibre-3.5.27-export-file.patch              (forward ported)
-Incorrect: inkscape command is --export-png, not --export-filename.
- - Patch8: djvulibre-3.5.27-check-image-size.patch         (forward ported)
-Correct: adopted a variant of this
- - Patch9: djvulibre-3.5.27-integer-overflow.patch         (forward ported)
-Correct: adopted a variant of this
- - Patch10: djvulibre-3.5.27-check-input-pool.patch        (forward ported)
-Adopted: input validation never hurts
- - Patch11: djvulibre-3.5.27-djvuport-stack-overflow.patch (forward ported)
-Dubious: Instead I changed djvufile to prevent a file from including itself
-which is the only way I can imagine to create an file creation loop.
- - Patch12: djvulibre-3.5.27-unsigned-short-overflow.patch (forward ported)
-Adopted: but without including limits.h
----
- libdjvu/DataPool.cpp  | 3 ++-
- libdjvu/DjVuFile.cpp  | 2 ++
- libdjvu/GBitmap.cpp   | 2 ++
- libdjvu/IW44Image.cpp | 4 ++++
- tools/ddjvu.cpp       | 7 +++++--
- 5 files changed, 15 insertions(+), 3 deletions(-)
-
-diff --git a/libdjvu/DataPool.cpp b/libdjvu/DataPool.cpp
-index 5fcbedf..b58fc45 100644
---- a/libdjvu/DataPool.cpp
-+++ b/libdjvu/DataPool.cpp
-@@ -790,7 +790,8 @@ DataPool::create(const GP<DataPool> & pool, int start, int length)
- {
-   DEBUG_MSG("DataPool::DataPool: pool=" << (void *)((DataPool *)pool) << " start=" << start << " length= " << length << "\n");
-   DEBUG_MAKE_INDENT(3);
--
-+  if (!pool)
-+    G_THROW( ERR_MSG("DataPool.zero_DataPool") );
-   DataPool *xpool=new DataPool();
-   GP<DataPool> retval=xpool;
-   xpool->init();
-diff --git a/libdjvu/DjVuFile.cpp b/libdjvu/DjVuFile.cpp
-index 143346b..2587491 100644
---- a/libdjvu/DjVuFile.cpp
-+++ b/libdjvu/DjVuFile.cpp
-@@ -576,6 +576,8 @@ DjVuFile::process_incl_chunk(ByteStream & str, int file_num)
-     GURL incl_url=pcaster->id_to_url(this, incl_str);
-     if (incl_url.is_empty())	// Fallback. Should never be used.
-       incl_url=GURL::UTF8(incl_str,url.base());
-+    if (incl_url == url)        // Infinite loop avoidance
-+      G_THROW( ERR_MSG("DjVuFile.malformed") );
-     
-     // Now see if there is already a file with this *name* created
-     {
-diff --git a/libdjvu/GBitmap.cpp b/libdjvu/GBitmap.cpp
-index c2fdbe4..8ad64b2 100644
---- a/libdjvu/GBitmap.cpp
-+++ b/libdjvu/GBitmap.cpp
-@@ -1284,6 +1284,8 @@ GBitmap::decode(unsigned char *runs)
-   // initialize pixel array
-   if (nrows==0 || ncolumns==0)
-     G_THROW( ERR_MSG("GBitmap.not_init") );
-+  if (ncolumns + border != (unsigned short)(ncolumns+border))
-+    G_THROW("GBitmap: image size exceeds maximum (corrupted file?)");
-   bytes_per_row = ncolumns + border;
-   if (runs==0)
-     G_THROW( ERR_MSG("GBitmap.null_arg") );
-diff --git a/libdjvu/IW44Image.cpp b/libdjvu/IW44Image.cpp
-index e8d4b44..4a1797e 100644
---- a/libdjvu/IW44Image.cpp
-+++ b/libdjvu/IW44Image.cpp
-@@ -676,9 +676,13 @@ IW44Image::Map::image(signed char *img8, int rowsize, int pixsep, int fast)
-   // Allocate reconstruction buffer
-   short *data16;
-   size_t sz = bw * bh;
-+  if (sz == 0)
-+    G_THROW("IW44Image: image size is zero (corrupted file?)");
-   if (sz / (size_t)bw != (size_t)bh) // multiplication overflow
-     G_THROW("IW44Image: image size exceeds maximum (corrupted file?)");
-   GPBuffer<short> gdata16(data16,sz);
-+  if (data16 == 0)
-+    G_THROW("IW44Image: unable to allocate image buffer");
-   // Copy coefficients
-   int i;
-   short *p = data16;
-diff --git a/tools/ddjvu.cpp b/tools/ddjvu.cpp
-index 7109952..e7b489b 100644
---- a/tools/ddjvu.cpp
-+++ b/tools/ddjvu.cpp
-@@ -393,8 +393,11 @@ render(ddjvu_page_t *page, int pageno)
-   } else if (style == DDJVU_FORMAT_GREY8)
-     rowsize = rrect.w;
-   else
--    rowsize = rrect.w * 3; 
--  if (! (image = (char*)malloc(rowsize * rrect.h)))
-+    rowsize = rrect.w * 3;
-+  size_t bufsize = (size_t)rowsize * rrect.h;
-+  if (bufsize / rowsize != rrect.h)
-+    die(i18n("Integer overflow when allocating image buffer for page %d"), pageno);
-+  if (! (image = (char*)malloc(bufsize)))
-     die(i18n("Cannot allocate image buffer for page %d"), pageno);
- 
-   /* Render */