From a0c77aecaaf24a32600b88d05406dfd57e1b8639 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Mon, 14 Aug 2023 01:32:29 -0700
Subject: [PATCH 01/22] lib.systems: add ubootArch

u-boot has its own rosetta stone, almost but not exactly the same as
the Linux kernel's.  This commit adds it and the two cases where it
diverges.
---
 lib/systems/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 40a2c88f32b8..09024d587c56 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -178,6 +178,12 @@ rec {
         else if final.isLoongArch64 then "loongarch"
         else final.parsed.cpu.name;
 
+      # https://source.denx.de/u-boot/u-boot/-/blob/9bfb567e5f1bfe7de8eb41f8c6d00f49d2b9a426/common/image.c#L81-106
+      ubootArch =
+        if      final.isx86_32 then "x86"    # not i386
+        else if final.isMips64 then "mips64" # uboot *does* distinguish between mips32/mips64
+        else final.linuxArch;                # other cases appear to agree with linuxArch
+
       qemuArch =
         if final.isAarch32 then "arm"
         else if final.isS390 && !final.isS390x then null

From a97e8fc272782d69d94053bc434b9b6fef399a7b Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Mon, 14 Aug 2023 01:33:06 -0700
Subject: [PATCH 02/22] make-initrd-ng: use hostPlatform.ubootArch for
 uinitrdArch

This allows make-initrd-ng to pick up the few cases where Linux and
u-boot disagree.
---
 pkgs/build-support/kernel/make-initrd-ng.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/build-support/kernel/make-initrd-ng.nix b/pkgs/build-support/kernel/make-initrd-ng.nix
index 2418838176ef..f2f7aaa6d1b6 100644
--- a/pkgs/build-support/kernel/make-initrd-ng.nix
+++ b/pkgs/build-support/kernel/make-initrd-ng.nix
@@ -54,7 +54,7 @@ in
 # guess may not align with u-boot's nomenclature correctly, so it can
 # be overridden.
 # See https://gitlab.denx.de/u-boot/u-boot/-/blob/9bfb567e5f1bfe7de8eb41f8c6d00f49d2b9a426/common/image.c#L81-106 for a list.
-, uInitrdArch ? stdenvNoCC.hostPlatform.linuxArch
+, uInitrdArch ? stdenvNoCC.hostPlatform.ubootArch
 
 # The name of the compression, as recognised by u-boot.
 # See https://gitlab.denx.de/u-boot/u-boot/-/blob/9bfb567e5f1bfe7de8eb41f8c6d00f49d2b9a426/common/image.c#L195-204 for a list.

From b93e67e1719ff03c02052ea07d8acac71f22f06a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabi=C3=A1n=20Heredia=20Montiel?= <fabianhjr@protonmail.com>
Date: Thu, 28 Sep 2023 13:20:38 -0600
Subject: [PATCH 03/22] kubo: use buildGo120Module due to breakage after
 default go version bump

---
 pkgs/top-level/all-packages.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 062d0df6125e..4009efc9095b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9854,7 +9854,9 @@ with pkgs;
 
   kubergrunt = callPackage ../applications/networking/cluster/kubergrunt { };
 
-  kubo = callPackage ../applications/networking/kubo { };
+  kubo = callPackage ../applications/networking/kubo {
+    buildGoModule = buildGo120Module;
+  };
 
   kubo-migrator-all-fs-repo-migrations = callPackage ../applications/networking/kubo-migrator/all-migrations.nix { };
   kubo-migrator-unwrapped = callPackage ../applications/networking/kubo-migrator/unwrapped.nix { };

From a5f65f7cad42ff7781123755c2b895d3805cf6b5 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Sat, 30 Sep 2023 01:19:45 +0200
Subject: [PATCH 04/22] krita: add patch for exiv2 0.28

---
 pkgs/applications/graphics/krita/generic.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/graphics/krita/generic.nix b/pkgs/applications/graphics/krita/generic.nix
index 4a946ef8c159..507aaf0f7686 100644
--- a/pkgs/applications/graphics/krita/generic.nix
+++ b/pkgs/applications/graphics/krita/generic.nix
@@ -1,4 +1,4 @@
-{ mkDerivation, lib, stdenv, makeWrapper, fetchurl, cmake, extra-cmake-modules
+{ mkDerivation, lib, stdenv, fetchpatch, makeWrapper, fetchurl, cmake, extra-cmake-modules
 , karchive, kconfig, kwidgetsaddons, kcompletion, kcoreaddons
 , kguiaddons, ki18n, kitemmodels, kitemviews, kwindowsystem
 , kio, kcrash, breeze-icons
@@ -21,6 +21,14 @@ mkDerivation rec {
     inherit sha256;
   };
 
+  patches = [
+    (fetchpatch {
+      name = "exiv2-0.28.patch";
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/krita/-/raw/acd9a818660e86b14a66fceac295c2bab318c671/exiv2-0.28.patch";
+      hash = "sha256-iD2pyid513ThJVeotUlVDrwYANofnEiZmWINNUm/saw=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake extra-cmake-modules python3Packages.sip makeWrapper ];
 
   buildInputs = [

From 3fe98ccfc80ae1a283892e4cd42b79fbc6e8f93c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 29 Sep 2023 23:49:34 +0000
Subject: [PATCH 05/22] riffdiff: 2.25.2 -> 2.27.0

---
 pkgs/tools/text/riffdiff/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/text/riffdiff/default.nix b/pkgs/tools/text/riffdiff/default.nix
index c26966a15817..cd5e2caa8f0d 100644
--- a/pkgs/tools/text/riffdiff/default.nix
+++ b/pkgs/tools/text/riffdiff/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "riffdiff";
-  version = "2.25.2";
+  version = "2.27.0";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = "riff";
     rev = version;
-    hash = "sha256-JZWgI4yAsk+jtTyS3QZBxdAOPYmUxb7pn1SbcUeCh6Y=";
+    hash = "sha256-yrIZsCxoFV9LFh96asYxpAYv1KvrLq+RlqL8gZXaeak=";
   };
 
-  cargoHash = "sha256-Z33CGF02rPf24LaYh+wEmmGgPPw+oxMNCgMzCrUEKqk=";
+  cargoHash = "sha256-tO49qAEW15q76hLcHOtniwLqGy29MZ/dabyZHYAsiME=";
 
   meta = with lib; {
     description = "A diff filter highlighting which line parts have changed";

From 31e23fcb1bee2ce61980baa30f20f7aefb771bb0 Mon Sep 17 00:00:00 2001
From: Yaya <github@uwu.is>
Date: Sat, 30 Sep 2023 06:45:08 +0200
Subject: [PATCH 06/22] electron_22-bin: 22.3.24 -> 22.3.25

https://github.com/electron/electron/releases/tag/v22.3.25

Resolves CVE-2023-5217
---
 pkgs/development/tools/electron/binary/default.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/tools/electron/binary/default.nix b/pkgs/development/tools/electron/binary/default.nix
index 5bc91ce1fbf9..5539245aa335 100644
--- a/pkgs/development/tools/electron/binary/default.nix
+++ b/pkgs/development/tools/electron/binary/default.nix
@@ -142,13 +142,13 @@ rec {
     headers = "03mb1v5xzn2lp317r0mik9dx2nnxc7m26imygk13dgmafydd6aah";
   };
 
-  electron_22-bin = mkElectron "22.3.24" {
-    armv7l-linux = "bf986ec2e04c1f81a753dc17d71d231e16e0903d9114b1a73b1df0f18281d549";
-    aarch64-linux = "055776ed281fa2db76a9e663677155b9631e4c6ac57c1e86938c789913c72fe7";
-    x86_64-linux = "0c48912ff2bcbfe7e7c80eae76b82e2ba1e03cc872c0c6817faa560155447edd";
-    x86_64-darwin = "a2adc99b44fbded082cbb5f1c49eceaf0c6f678c5ba951332b2c902b4fa7f63e";
-    aarch64-darwin = "2ac36fdd664cb53c6cbc8ac67ac66e95e6418db4009636fbb865df97b711c818";
-    headers = "1817viv29v1lgph9rcknm6rz64x6w2l8p0ng681644cv4m5gjsq1";
+  electron_22-bin = mkElectron "22.3.25" {
+    armv7l-linux = "d90184e22f9d57fa4f207d5e5006bbfb6df1b9e10760333c3f72353ffa5ef3d1";
+    aarch64-linux = "08c4e127d06d73ad91fa308c811ace9d4f8607fe15ba0b2694261d32a2127a8c";
+    x86_64-linux = "f1d0f66b13d5b7b9e3f7d9b22891bf0b5b6f87e45c46054cd3fa74636c19e921";
+    x86_64-darwin = "945839af7ad0656d6c3462f6b47d871ce3d3860c112b2f574f62624b5b67ca8a";
+    aarch64-darwin = "3b0d7cb9ca7dda2b178af0084814f82c331df6abac63f19c3c6d72759db1e826";
+    headers = "0dbwdfrrd3r2kkfq000gwx5q0w01ndgpglkjw7i2q8b3pr5b2n62";
   };
 
   electron_23-bin = mkElectron "23.3.13" {

From 622be904118caa1c8eb85ef0f234d6c57f24eca4 Mon Sep 17 00:00:00 2001
From: Yaya <github@uwu.is>
Date: Sat, 30 Sep 2023 06:46:19 +0200
Subject: [PATCH 07/22] electron_24-bin: 24.8.3 -> 24.8.5

https://github.com/electron/electron/releases/tag/v24.8.5

Resolves CVE-2023-5217
---
 pkgs/development/tools/electron/binary/default.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/tools/electron/binary/default.nix b/pkgs/development/tools/electron/binary/default.nix
index 5539245aa335..93983bd0641e 100644
--- a/pkgs/development/tools/electron/binary/default.nix
+++ b/pkgs/development/tools/electron/binary/default.nix
@@ -160,13 +160,13 @@ rec {
     headers = "04k25z0d6xs2ar5mbbnr0phcs97kvxg28df3njhaniws6wf6qcmg";
   };
 
-  electron_24-bin = mkElectron "24.8.3" {
-    armv7l-linux = "93dc26ce72b2b4cafaf1c09091c23c764294a95da040b515963c5a269fc4112a";
-    aarch64-linux = "6684c37e427335818db146bb7b9c860be72ea582064fad349a54c62042676439";
-    x86_64-linux = "fcc2754fecdc6ffb814938ae7c806c8ab7d68c748d5906ae3e4b0f3d90eda2e1";
-    x86_64-darwin = "73f1913a9594057a47d473ff697c36ebb3d7d2fa012a24d301624af15fe9f251";
-    aarch64-darwin = "1b276595078b2733c33570a0d27309117711d176629580c09bd31e5e3edb21f2";
-    headers = "1rd0nww6gxvdzw6ja17gv5kd0wszjs9bcfspkp0iamsp5d9ixjf8";
+  electron_24-bin = mkElectron "24.8.5" {
+    armv7l-linux = "12063cec367c7ec5b018eb308aaf34cfc73997f325cd37d19703caba842520e2";
+    aarch64-linux = "a36978af2296a9594035a8dd59c1f7199c68f3f530013a919fc10baec7471668";
+    x86_64-linux = "bdb2ecc81462018a69f105eb0d121deff48b54831af31b7da664fc193969f352";
+    x86_64-darwin = "5eb6f9f9f1860bb76267c85b0bc12cc0bd6158b3cc88a2b484e4896e80f6f693";
+    aarch64-darwin = "49f8a31e3863496d009740ecb4ce95c08870874c284de7a13e8d12c6056c1c48";
+    headers = "11909wjni9wvlinvp0d7gypmv4sqg7xv0bn5x2x8h4sfgqydzwr6";
   };
 
   electron_25-bin = mkElectron "25.8.1" {

From 3b4f30eea21100b98a66c6fb5769453539b033ab Mon Sep 17 00:00:00 2001
From: Yaya <github@uwu.is>
Date: Sat, 30 Sep 2023 06:48:21 +0200
Subject: [PATCH 08/22] electron_25-bin: 25.8.1 -> 25.8.4

https://github.com/electron/electron/releases/tag/v25.8.4

Resolves CVE-2023-5217
---
 pkgs/development/tools/electron/binary/default.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/tools/electron/binary/default.nix b/pkgs/development/tools/electron/binary/default.nix
index 93983bd0641e..ea716396823f 100644
--- a/pkgs/development/tools/electron/binary/default.nix
+++ b/pkgs/development/tools/electron/binary/default.nix
@@ -169,13 +169,13 @@ rec {
     headers = "11909wjni9wvlinvp0d7gypmv4sqg7xv0bn5x2x8h4sfgqydzwr6";
   };
 
-  electron_25-bin = mkElectron "25.8.1" {
-    armv7l-linux = "dd3390de2426a1cea9d3176e404b8fb250844a9b0e48cf01822fa66f3c3c4a48";
-    aarch64-linux = "931208419f859f528e19805ae14b5b075213bc40dd20da9e03d8b71d849c147d";
-    x86_64-linux = "de556aef0a80a8fe7b2b39d74ab0bdecc65d72bba3b7349460d18ef2a22fa323";
-    x86_64-darwin = "fe61a3221d4c5dc9415dc2cce81010db61bb4a5ab5021d1023f48786dbaf0b28";
-    aarch64-darwin = "985f4beee009ef6dbe7af75009a1b281aff591b989ee544bd4d2c814f9c4428d";
-    headers = "1kkkxida3cbril65lmm0lkps787mhrrylzvp0j35rc1ip32b7sda";
+  electron_25-bin = mkElectron "25.8.4" {
+    armv7l-linux = "6301e6fde3e7c8149a5eca84c3817ba9ad3ffcb72e79318a355f025d7d3f8408";
+    aarch64-linux = "fbb6e06417b1741b94d59a6de5dcf3262bfb3fc98cffbcad475296c42d1cbe94";
+    x86_64-linux = "0cbbcaf90f3dc79dedec97d073ffe954530316523479c31b11781a141f8a87f6";
+    x86_64-darwin = "d4015cd251e58ef074d1f7f3e99bfbbe4cd6b690981f376fc642b2de955e8750";
+    aarch64-darwin = "5d83e2094a26bfe22e4c80e660ab088ec94ae3cc2d518c6efcac338f48cc0266";
+    headers = "10nbnjkmry1dn103jpc3p3jijq8l6zh3cm6k5fqk94nrbmjjdah9";
   };
 
   electron_26-bin = mkElectron "26.2.1" {

From 1f6f2c5f9df3ec4c1a06ae4336b42a6b23a26bd1 Mon Sep 17 00:00:00 2001
From: Yaya <github@uwu.is>
Date: Sat, 30 Sep 2023 06:50:02 +0200
Subject: [PATCH 09/22] electron_26-bin: 26.2.1 -> 26.2.4

https://github.com/electron/electron/releases/tag/v26.2.4

Resolves CVE-2023-5217
---
 pkgs/development/tools/electron/binary/default.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/tools/electron/binary/default.nix b/pkgs/development/tools/electron/binary/default.nix
index ea716396823f..6cdcac1a70db 100644
--- a/pkgs/development/tools/electron/binary/default.nix
+++ b/pkgs/development/tools/electron/binary/default.nix
@@ -178,12 +178,12 @@ rec {
     headers = "10nbnjkmry1dn103jpc3p3jijq8l6zh3cm6k5fqk94nrbmjjdah9";
   };
 
-  electron_26-bin = mkElectron "26.2.1" {
-    armv7l-linux = "27469331e1b19f732f67e4b3ae01bba527b2744e31efec1ef76748c45fe7f262";
-    aarch64-linux = "fe634b9095120d5b5d2c389ca016c378d1c3ba4f49b33912f9a6d8eb46f76163";
-    x86_64-linux = "be4ca43f4dbc82cacb4c48a04f3c4589fd560a80a77dbb9bdf6c81721c0064df";
-    x86_64-darwin = "007413187793c94cd248f52d3e00e2d95ed73b7a3b2c5a618f22eba7af94cd1a";
-    aarch64-darwin = "4e095994525a0e97e897aad9c1940c8160ce2c9aaf7b6792f31720abc3e04ee6";
-    headers = "02z604nzcm8iw29s5lsgjlzwn666h3ikxpdfjg2h0mffm82d0wfk";
+  electron_26-bin = mkElectron "26.2.4" {
+    armv7l-linux = "300e1a3e84d81277f9ab7f5060b980b2b1387979d6f07ea9d78bce5139430420";
+    aarch64-linux = "a401d68820d1c87006b683d98cfb691ffac1218c815757a3c5a0a4c2f3f08888";
+    x86_64-linux = "d2226ee3fb8bcd17abfe9747ba6c8d6ae2719a6256896d4861e3cb670ec2beeb";
+    x86_64-darwin = "a1e33c66a13913306e80812a9051ce7e5632d7cc13ff76910cc8daa791580589";
+    aarch64-darwin = "dda224e19ff2d2c99624e1da7d20fa24b92a34b49fac8dcef15542e183bc89c6";
+    headers = "0019pwm7n8vwhdflh1yy0lrgfgg92p9l40iw4xxnhm6ppic1f5kk";
   };
 }

From a1666863fdf1861188e1378a6dde2a19b1efa1c0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sat, 30 Sep 2023 09:56:42 +0200
Subject: [PATCH 10/22] nixos/test-driver: convert to pyproject from setup.py

This also makes configuration available if you just run those tools locally.
Also use ruff instead of pylint because it's faster and more
comprehensive.
---
 nixos/lib/test-driver/default.nix    | 20 ++++++++--------
 nixos/lib/test-driver/pyproject.toml | 35 ++++++++++++++++++++++++++++
 nixos/lib/test-driver/setup.py       | 14 -----------
 3 files changed, 45 insertions(+), 24 deletions(-)
 create mode 100644 nixos/lib/test-driver/pyproject.toml
 delete mode 100644 nixos/lib/test-driver/setup.py

diff --git a/nixos/lib/test-driver/default.nix b/nixos/lib/test-driver/default.nix
index 33313059fff7..6e01e00b4355 100644
--- a/nixos/lib/test-driver/default.nix
+++ b/nixos/lib/test-driver/default.nix
@@ -4,19 +4,20 @@
 , qemu_pkg ? qemu_test
 , coreutils
 , imagemagick_light
-, libtiff
 , netpbm
 , qemu_test
 , socat
+, ruff
 , tesseract4
 , vde2
 , extraPythonPackages ? (_ : [])
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication {
   pname = "nixos-test-driver";
   version = "1.1";
   src = ./.;
+  format = "pyproject";
 
   propagatedBuildInputs = [
     coreutils
@@ -31,14 +32,13 @@ python3Packages.buildPythonApplication rec {
     ++ extraPythonPackages python3Packages;
 
   doCheck = true;
-  nativeCheckInputs = with python3Packages; [ mypy pylint black ];
+  nativeCheckInputs = with python3Packages; [ mypy ruff black ];
   checkPhase = ''
-    mypy --disallow-untyped-defs \
-          --no-implicit-optional \
-          --pretty \
-          --no-color-output \
-          --ignore-missing-imports ${src}/test_driver
-    pylint --errors-only --enable=unused-import ${src}/test_driver
-    black --check --diff ${src}/test_driver
+    echo -e "\x1b[32m## run mypy\x1b[0m"
+    mypy test_driver extract-docstrings.py
+    echo -e "\x1b[32m## run ruff\x1b[0m"
+    ruff .
+    echo -e "\x1b[32m## run black\x1b[0m"
+    black --check --diff .
   '';
 }
diff --git a/nixos/lib/test-driver/pyproject.toml b/nixos/lib/test-driver/pyproject.toml
new file mode 100644
index 000000000000..68921bc9f850
--- /dev/null
+++ b/nixos/lib/test-driver/pyproject.toml
@@ -0,0 +1,35 @@
+[build-system]
+requires = ["setuptools"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "nixos-test-driver"
+version = "0.0.0"
+
+[project.scripts]
+nixos-test-driver = "test_driver:main"
+generate-driver-symbols = "test_driver:generate_driver_symbols"
+
+[tool.setuptools.packages]
+find = {}
+
+[tool.setuptools.package-data]
+test_driver = ["py.typed"]
+
+[tool.ruff]
+line-length = 88
+
+select = ["E", "F", "I", "U", "N"]
+ignore = ["E501"]
+
+[tool.black]
+line-length = 88
+target-version = ['py39']
+include = '\.pyi?$'
+
+[tool.mypy]
+python_version = "3.10"
+warn_redundant_casts = true
+disallow_untyped_calls = true
+disallow_untyped_defs = true
+no_implicit_optional = true
diff --git a/nixos/lib/test-driver/setup.py b/nixos/lib/test-driver/setup.py
deleted file mode 100644
index 1719b988db68..000000000000
--- a/nixos/lib/test-driver/setup.py
+++ /dev/null
@@ -1,14 +0,0 @@
-from setuptools import setup, find_packages
-
-setup(
-  name="nixos-test-driver",
-  version='1.1',
-  packages=find_packages(),
-  package_data={"test_driver": ["py.typed"]},
-  entry_points={
-    "console_scripts": [
-      "nixos-test-driver=test_driver:main",
-      "generate-driver-symbols=test_driver:generate_driver_symbols"
-    ]
-  },
-)

From 9ac9e8407fbe084fb6667bdd3bd0c569ea454271 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sat, 30 Sep 2023 09:59:17 +0200
Subject: [PATCH 11/22] nixos/test-driver: fix type errors in
 extract-docstrings

---
 nixos/lib/test-driver/extract-docstrings.py | 42 ++++++++++++---------
 1 file changed, 25 insertions(+), 17 deletions(-)

diff --git a/nixos/lib/test-driver/extract-docstrings.py b/nixos/lib/test-driver/extract-docstrings.py
index 5aec4c89a9d7..a12e586882a6 100644
--- a/nixos/lib/test-driver/extract-docstrings.py
+++ b/nixos/lib/test-driver/extract-docstrings.py
@@ -1,5 +1,6 @@
 import ast
 import sys
+from pathlib import Path
 
 """
 This program takes all the Machine class methods and prints its methods in
@@ -40,27 +41,34 @@ some_function(param1, param2)
 
 """
 
-assert len(sys.argv) == 2
 
-with open(sys.argv[1], "r") as f:
-    module = ast.parse(f.read())
+def main() -> None:
+    if len(sys.argv) != 2:
+        print(f"Usage: {sys.argv[0]} <path-to-test-driver>")
+        sys.exit(1)
 
-class_definitions = (node for node in module.body if isinstance(node, ast.ClassDef))
+    module = ast.parse(Path(sys.argv[1]).read_text())
 
-machine_class = next(filter(lambda x: x.name == "Machine", class_definitions))
-assert machine_class is not None
+    class_definitions = (node for node in module.body if isinstance(node, ast.ClassDef))
 
-function_definitions = [
-    node for node in machine_class.body if isinstance(node, ast.FunctionDef)
-]
-function_definitions.sort(key=lambda x: x.name)
+    machine_class = next(filter(lambda x: x.name == "Machine", class_definitions))
+    assert machine_class is not None
 
-for f in function_definitions:
-    docstr = ast.get_docstring(f)
-    if docstr is not None:
-        args = ", ".join((a.arg for a in f.args.args[1:]))
-        args = f"({args})"
+    function_definitions = [
+        node for node in machine_class.body if isinstance(node, ast.FunctionDef)
+    ]
+    function_definitions.sort(key=lambda x: x.name)
 
-        docstr = "\n".join((f"    {l}" for l in docstr.strip().splitlines()))
+    for f in function_definitions:
+        docstr = ast.get_docstring(f)
+        if docstr is not None:
+            args = ", ".join(a.arg for a in f.args.args[1:])
+            args = f"({args})"
 
-        print(f"{f.name}{args}\n\n:{docstr[1:]}\n")
+            docstr = "\n".join(f"    {l}" for l in docstr.strip().splitlines())
+
+            print(f"{f.name}{args}\n\n:{docstr[1:]}\n")
+
+
+if __name__ == "__main__":
+    main()

From d7465572601648cadf292b23baf962afc0b0760a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sat, 30 Sep 2023 10:13:51 +0200
Subject: [PATCH 12/22] nixos/test-driver: add shell.nix

this useful for local development
---
 nixos/lib/test-driver/shell.nix | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 nixos/lib/test-driver/shell.nix

diff --git a/nixos/lib/test-driver/shell.nix b/nixos/lib/test-driver/shell.nix
new file mode 100644
index 000000000000..367bbad556c0
--- /dev/null
+++ b/nixos/lib/test-driver/shell.nix
@@ -0,0 +1,2 @@
+with import ../../.. {};
+pkgs.callPackage ./default.nix {}

From 93b1fa09d52970b449b36b8649b2831dad08604e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sat, 30 Sep 2023 10:14:56 +0200
Subject: [PATCH 13/22] nixos/test-driver: disable typecheck for dependencies
 where don't have typing

---
 nixos/lib/test-driver/pyproject.toml        | 9 +++++++++
 nixos/lib/test-driver/test_driver/logger.py | 3 +++
 2 files changed, 12 insertions(+)

diff --git a/nixos/lib/test-driver/pyproject.toml b/nixos/lib/test-driver/pyproject.toml
index 68921bc9f850..8638f14dfdae 100644
--- a/nixos/lib/test-driver/pyproject.toml
+++ b/nixos/lib/test-driver/pyproject.toml
@@ -22,6 +22,15 @@ line-length = 88
 select = ["E", "F", "I", "U", "N"]
 ignore = ["E501"]
 
+# xxx: we can import https://pypi.org/project/types-colorama/ here
+[[tool.mypy.overrides]]
+module = "colorama.*"
+ignore_missing_imports = true
+
+[[tool.mypy.overrides]]
+module = "ptpython.*"
+ignore_missing_imports = true
+
 [tool.black]
 line-length = 88
 target-version = ['py39']
diff --git a/nixos/lib/test-driver/test_driver/logger.py b/nixos/lib/test-driver/test_driver/logger.py
index e6182ff7c761..ea14c50dc517 100644
--- a/nixos/lib/test-driver/test_driver/logger.py
+++ b/nixos/lib/test-driver/test_driver/logger.py
@@ -1,3 +1,6 @@
+# mypy: disable-error-code="no-untyped-call"
+# drop the above line when mypy is upgraded to include
+# https://github.com/python/typeshed/commit/49b717ca52bf0781a538b04c0d76a5513f7119b8
 from colorama import Style, Fore
 from contextlib import contextmanager
 from typing import Any, Dict, Iterator

From a1f01abe53e9b20965df7b6c929bc2a129052551 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sat, 30 Sep 2023 10:18:47 +0200
Subject: [PATCH 14/22] nixos/test-driver: apply ruff fixes & suggestions

---
 nixos/lib/test-driver/extract-docstrings.py          | 10 +++++-----
 nixos/lib/test-driver/test_driver/__init__.py        | 11 +++++------
 nixos/lib/test-driver/test_driver/driver.py          |  8 ++++----
 nixos/lib/test-driver/test_driver/logger.py          | 11 ++++++-----
 nixos/lib/test-driver/test_driver/machine.py         | 12 ++++++------
 .../lib/test-driver/test_driver/polling_condition.py |  4 ++--
 nixos/lib/test-driver/test_driver/vlan.py            |  2 +-
 7 files changed, 29 insertions(+), 29 deletions(-)

diff --git a/nixos/lib/test-driver/extract-docstrings.py b/nixos/lib/test-driver/extract-docstrings.py
index a12e586882a6..64850ca711f3 100644
--- a/nixos/lib/test-driver/extract-docstrings.py
+++ b/nixos/lib/test-driver/extract-docstrings.py
@@ -59,15 +59,15 @@ def main() -> None:
     ]
     function_definitions.sort(key=lambda x: x.name)
 
-    for f in function_definitions:
-        docstr = ast.get_docstring(f)
+    for function in function_definitions:
+        docstr = ast.get_docstring(function)
         if docstr is not None:
-            args = ", ".join(a.arg for a in f.args.args[1:])
+            args = ", ".join(a.arg for a in function.args.args[1:])
             args = f"({args})"
 
-            docstr = "\n".join(f"    {l}" for l in docstr.strip().splitlines())
+            docstr = "\n".join(f"    {line}" for line in docstr.strip().splitlines())
 
-            print(f"{f.name}{args}\n\n:{docstr[1:]}\n")
+            print(f"{function.name}{args}\n\n:{docstr[1:]}\n")
 
 
 if __name__ == "__main__":
diff --git a/nixos/lib/test-driver/test_driver/__init__.py b/nixos/lib/test-driver/test_driver/__init__.py
index c90e3d9e1cdb..371719d7a988 100755
--- a/nixos/lib/test-driver/test_driver/__init__.py
+++ b/nixos/lib/test-driver/test_driver/__init__.py
@@ -1,11 +1,12 @@
-from pathlib import Path
 import argparse
-import ptpython.repl
 import os
 import time
+from pathlib import Path
+
+import ptpython.repl
 
-from test_driver.logger import rootlog
 from test_driver.driver import Driver
+from test_driver.logger import rootlog
 
 
 class EnvDefault(argparse.Action):
@@ -25,9 +26,7 @@ class EnvDefault(argparse.Action):
                 )
         if required and default:
             required = False
-        super(EnvDefault, self).__init__(
-            default=default, required=required, nargs=nargs, **kwargs
-        )
+        super().__init__(default=default, required=required, nargs=nargs, **kwargs)
 
     def __call__(self, parser, namespace, values, option_string=None):  # type: ignore
         setattr(namespace, self.dest, values)
diff --git a/nixos/lib/test-driver/test_driver/driver.py b/nixos/lib/test-driver/test_driver/driver.py
index 835d60ec3b4f..723c80717860 100644
--- a/nixos/lib/test-driver/test_driver/driver.py
+++ b/nixos/lib/test-driver/test_driver/driver.py
@@ -1,14 +1,14 @@
-from contextlib import contextmanager
-from pathlib import Path
-from typing import Any, Dict, Iterator, List, Union, Optional, Callable, ContextManager
 import os
 import re
 import tempfile
+from contextlib import contextmanager
+from pathlib import Path
+from typing import Any, Callable, ContextManager, Dict, Iterator, List, Optional, Union
 
 from test_driver.logger import rootlog
 from test_driver.machine import Machine, NixStartScript, retry
-from test_driver.vlan import VLan
 from test_driver.polling_condition import PollingCondition
+from test_driver.vlan import VLan
 
 
 def get_tmp_dir() -> Path:
diff --git a/nixos/lib/test-driver/test_driver/logger.py b/nixos/lib/test-driver/test_driver/logger.py
index ea14c50dc517..116244b5e4ae 100644
--- a/nixos/lib/test-driver/test_driver/logger.py
+++ b/nixos/lib/test-driver/test_driver/logger.py
@@ -1,16 +1,17 @@
 # mypy: disable-error-code="no-untyped-call"
 # drop the above line when mypy is upgraded to include
 # https://github.com/python/typeshed/commit/49b717ca52bf0781a538b04c0d76a5513f7119b8
-from colorama import Style, Fore
-from contextlib import contextmanager
-from typing import Any, Dict, Iterator
-from queue import Queue, Empty
-from xml.sax.saxutils import XMLGenerator
 import codecs
 import os
 import sys
 import time
 import unicodedata
+from contextlib import contextmanager
+from queue import Empty, Queue
+from typing import Any, Dict, Iterator
+from xml.sax.saxutils import XMLGenerator
+
+from colorama import Fore, Style
 
 
 class Logger:
diff --git a/nixos/lib/test-driver/test_driver/machine.py b/nixos/lib/test-driver/test_driver/machine.py
index 4accd2f9d195..5ee842450606 100644
--- a/nixos/lib/test-driver/test_driver/machine.py
+++ b/nixos/lib/test-driver/test_driver/machine.py
@@ -1,7 +1,3 @@
-from contextlib import _GeneratorContextManager, nullcontext
-from pathlib import Path
-from queue import Queue
-from typing import Any, Callable, Dict, Iterable, List, Optional, Tuple
 import base64
 import io
 import os
@@ -16,6 +12,10 @@ import sys
 import tempfile
 import threading
 import time
+from contextlib import _GeneratorContextManager, nullcontext
+from pathlib import Path
+from queue import Queue
+from typing import Any, Callable, Dict, Iterable, List, Optional, Tuple
 
 from test_driver.logger import rootlog
 
@@ -599,7 +599,7 @@ class Machine:
             return (-1, output.decode())
 
         # Get the return code
-        self.shell.send("echo ${PIPESTATUS[0]}\n".encode())
+        self.shell.send(b"echo ${PIPESTATUS[0]}\n")
         rc = int(self._next_newline_closed_block_from_shell().strip())
 
         return (rc, output.decode(errors="replace"))
@@ -1132,7 +1132,7 @@ class Machine:
             return
 
         assert self.shell
-        self.shell.send("poweroff\n".encode())
+        self.shell.send(b"poweroff\n")
         self.wait_for_shutdown()
 
     def crash(self) -> None:
diff --git a/nixos/lib/test-driver/test_driver/polling_condition.py b/nixos/lib/test-driver/test_driver/polling_condition.py
index 02ca0a03ab3d..895ac6cb72f5 100644
--- a/nixos/lib/test-driver/test_driver/polling_condition.py
+++ b/nixos/lib/test-driver/test_driver/polling_condition.py
@@ -1,6 +1,6 @@
-from typing import Callable, Optional
-from math import isfinite
 import time
+from math import isfinite
+from typing import Callable, Optional
 
 from .logger import rootlog
 
diff --git a/nixos/lib/test-driver/test_driver/vlan.py b/nixos/lib/test-driver/test_driver/vlan.py
index f2a7f250d1d2..ec9679108e58 100644
--- a/nixos/lib/test-driver/test_driver/vlan.py
+++ b/nixos/lib/test-driver/test_driver/vlan.py
@@ -1,8 +1,8 @@
-from pathlib import Path
 import io
 import os
 import pty
 import subprocess
+from pathlib import Path
 
 from test_driver.logger import rootlog
 

From 1810265b57aa29198522bec882514f413574189c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sat, 30 Sep 2023 10:23:21 +0200
Subject: [PATCH 15/22] nixos/test-driver: name exception according to pep8

see https://docs.astral.sh/ruff/rules/error-suffix-on-exception-name/
---
 nixos/lib/test-driver/test_driver/polling_condition.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/lib/test-driver/test_driver/polling_condition.py b/nixos/lib/test-driver/test_driver/polling_condition.py
index 895ac6cb72f5..12cbad69e34e 100644
--- a/nixos/lib/test-driver/test_driver/polling_condition.py
+++ b/nixos/lib/test-driver/test_driver/polling_condition.py
@@ -5,7 +5,7 @@ from typing import Callable, Optional
 from .logger import rootlog
 
 
-class PollingConditionFailed(Exception):
+class PollingConditionError(Exception):
     pass
 
 
@@ -60,7 +60,7 @@ class PollingCondition:
 
     def maybe_raise(self) -> None:
         if not self.check():
-            raise PollingConditionFailed(self.status_message(False))
+            raise PollingConditionError(self.status_message(False))
 
     def status_message(self, status: bool) -> str:
         return f"Polling condition {'succeeded' if status else 'failed'}: {self.description}"

From f1450e660f4adb3df96e0608ff6b850c3b235ddf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sat, 30 Sep 2023 10:27:28 +0200
Subject: [PATCH 16/22] nixos/test-driver: whitelist variable names that don't
 follow pep8

https://docs.astral.sh/ruff/rules/invalid-argument-name/
---
 nixos/lib/test-driver/test_driver/machine.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/nixos/lib/test-driver/test_driver/machine.py b/nixos/lib/test-driver/test_driver/machine.py
index 5ee842450606..7ed001a1dfce 100644
--- a/nixos/lib/test-driver/test_driver/machine.py
+++ b/nixos/lib/test-driver/test_driver/machine.py
@@ -236,14 +236,14 @@ class LegacyStartCommand(StartCommand):
 
     def __init__(
         self,
-        netBackendArgs: Optional[str] = None,
-        netFrontendArgs: Optional[str] = None,
+        netBackendArgs: Optional[str] = None,  # noqa: N803
+        netFrontendArgs: Optional[str] = None,  # noqa: N803
         hda: Optional[Tuple[Path, str]] = None,
         cdrom: Optional[str] = None,
         usb: Optional[str] = None,
         bios: Optional[str] = None,
-        qemuBinary: Optional[str] = None,
-        qemuFlags: Optional[str] = None,
+        qemuBinary: Optional[str] = None,  # noqa: N803
+        qemuFlags: Optional[str] = None,  # noqa: N803
     ):
         if qemuBinary is not None:
             self._cmd = qemuBinary

From a6909370c4c45ca9368e876826238002a72a6e25 Mon Sep 17 00:00:00 2001
From: Trevor Richards <trev@trevdev.ca>
Date: Fri, 29 Sep 2023 22:38:11 -0700
Subject: [PATCH 17/22] maintainers: add trevdev

---
 maintainers/maintainer-list.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e9e8f4363360..01662de253a7 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -17720,6 +17720,13 @@
     githubId = 25440339;
     name = "Tom Repetti";
   };
+  trevdev = {
+    email = "trev@trevdev.ca";
+    matrix = "@trevdev:matrix.org";
+    github = "trev-dev";
+    githubId = 28788713;
+    name = "Trevor Richards";
+  };
   trevorj = {
     email = "nix@trevor.joynson.io";
     github = "akatrevorjay";

From cad9cf0dacdf2fe87ce101d6a96f3c349cfdc8de Mon Sep 17 00:00:00 2001
From: Trevor Richards <trev@trevdev.ca>
Date: Fri, 29 Sep 2023 22:39:04 -0700
Subject: [PATCH 18/22] nimPackages: add csvtools

---
 .../nim-packages/csvtools/default.nix         | 19 +++++++++++++++++++
 pkgs/top-level/nim-packages.nix               |  2 ++
 2 files changed, 21 insertions(+)
 create mode 100644 pkgs/development/nim-packages/csvtools/default.nix

diff --git a/pkgs/development/nim-packages/csvtools/default.nix b/pkgs/development/nim-packages/csvtools/default.nix
new file mode 100644
index 000000000000..2eaaae1dc526
--- /dev/null
+++ b/pkgs/development/nim-packages/csvtools/default.nix
@@ -0,0 +1,19 @@
+{ lib, pkgs, buildNimPackage, fetchFromGitHub }:
+
+buildNimPackage (finalAttrs: {
+  pname = "csvtools";
+  version = "0.2.1";
+  src = fetchFromGitHub {
+    owner = "andreaferretti";
+    repo = "csvtools";
+    rev = "${finalAttrs.version}";
+    hash = "sha256-G/OvcusnlRR5zdGF+wC7z411RLXI6D9aFJVj9LrMR+s=";
+  };
+  doCheck = true;
+  meta = finalAttrs.src.meta // {
+    description = "Manage CSV files easily in Nim";
+    homepage = "https://github.com/andreaferretti/csvtools";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.trevdev ];
+  };
+})
diff --git a/pkgs/top-level/nim-packages.nix b/pkgs/top-level/nim-packages.nix
index 640a4c854bfe..c360263435e1 100644
--- a/pkgs/top-level/nim-packages.nix
+++ b/pkgs/top-level/nim-packages.nix
@@ -31,6 +31,8 @@ lib.makeScope newScope (self:
 
     coap = callPackage  ../development/nim-packages/coap { };
 
+    csvtools = callPackage ../development/nim-packages/csvtools { };
+
     db_connector = callPackage ../development/nim-packages/db_connector { };
 
     docopt = callPackage ../development/nim-packages/docopt { };

From f510dc434bd817b0f7a505b8901c9ee8c716855f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 30 Sep 2023 10:33:07 +0000
Subject: [PATCH 19/22] jackett: 0.21.932 -> 0.21.938

---
 pkgs/servers/jackett/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/jackett/default.nix b/pkgs/servers/jackett/default.nix
index 867569e6ecb6..8b1302b91153 100644
--- a/pkgs/servers/jackett/default.nix
+++ b/pkgs/servers/jackett/default.nix
@@ -9,13 +9,13 @@
 
 buildDotnetModule rec {
   pname = "jackett";
-  version = "0.21.932";
+  version = "0.21.938";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha512-aGuaOLx43P2GzH1BYhLYd9wkkEhuDBH7bdtXlC2kgxcS5GCbn8pVro4VYVxkzh1P3WxpkMoD8A5bDPCHBebX4w==";
+    hash = "sha512-NxtXVEh56aed7rz4LZZ/pAiB2KHsONfsDXCZzVep60w08rTC+cIbbB5DQcRRdGJk+f6pH35TxcAGuS2nQi+pwg==";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";

From 9b374ca016fe3b349137dada1f62138c9f362e23 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christina=20S=C3=B8rensen?= <christina@cafkafk.com>
Date: Sat, 30 Sep 2023 12:16:55 +0200
Subject: [PATCH 20/22] nix-update: 0.19.3 -> 1.0.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Christina Sørensen <christina@cafkafk.com>
---
 pkgs/tools/package-management/nix-update/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/package-management/nix-update/default.nix b/pkgs/tools/package-management/nix-update/default.nix
index c0030fcf8a60..755286ec8705 100644
--- a/pkgs/tools/package-management/nix-update/default.nix
+++ b/pkgs/tools/package-management/nix-update/default.nix
@@ -9,14 +9,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "nix-update";
-  version = "0.19.3";
+  version = "1.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = pname;
     rev = version;
-    hash = "sha256-+WD+SV/L3TvksWBIg6jk+T0dUTNdp4VKONzdzVT+pac=";
+    hash = "sha256-C7ke51QlBcTR98ovQi5NcxToEPP6s9gqnxWO1eBw/sI=";
   };
 
   nativeBuildInputs = [

From 976134f777ec8a4ac5a9515c92d27afcdf0d4736 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 30 Sep 2023 08:26:18 +0000
Subject: [PATCH 21/22] vault-bin: 1.14.3 -> 1.15.0

---
 pkgs/tools/security/vault/vault-bin.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/tools/security/vault/vault-bin.nix b/pkgs/tools/security/vault/vault-bin.nix
index e876aba23531..f9d1dd74e126 100644
--- a/pkgs/tools/security/vault/vault-bin.nix
+++ b/pkgs/tools/security/vault/vault-bin.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vault-bin";
-  version = "1.14.3";
+  version = "1.15.0";
 
   src =
     let
@@ -16,11 +16,11 @@ stdenv.mkDerivation rec {
         aarch64-darwin = "darwin_arm64";
       };
       sha256 = selectSystem {
-        x86_64-linux = "sha256-zgRX4RfyZMHuE/yYFGLfbEi2SJ1DIxp5UShOvIYZmG8=";
-        aarch64-linux = "sha256-ZGLzZylXnkS/0BuUz/PSGHDXRZoVqSA/+hREDp9tmsE=";
-        i686-linux = "sha256-qG2dpE/snBL7eVTrtX1ZP9gtCIyhPqebUo3T515uHBU=";
-        x86_64-darwin = "sha256-21OH98/vlUtnb3s4wA3iDV4b5jVnN2BFJ3AWMonHpPw=";
-        aarch64-darwin = "sha256-Usbwmqyo/RKUeGXCBPul14cccjawt1Des/hsr8mKA/Q=";
+        x86_64-linux = "sha256-TLpH6s9odZFh9LFnLiZjpcx0+W+6XrdDhja/xcixx7s=";
+        aarch64-linux = "sha256-QQejEfJrCB+68SXhQm7Ub763ZL72Cy+HB1be+4p4XrM=";
+        i686-linux = "sha256-1dFPAIBNyDQheIdszmoiHU6AmLZ1TtbT+If7n8ZQQAY=";
+        x86_64-darwin = "sha256-51A12pOMaJGYacgiIIW3sqUytApDXrSWBkNl7fWqFgk=";
+        aarch64-darwin = "sha256-PacsdP9n7mdK/wKJW63Ajbt5G+PFPwa+XB4OEz3YUno=";
       };
     in
     fetchzip {

From 612035c45f36cc089f0392875c31c7efa2cf608c Mon Sep 17 00:00:00 2001
From: Reno Reckling <exi@wthack.de>
Date: Sat, 30 Sep 2023 14:00:13 +0200
Subject: [PATCH 22/22] Fix broken genJqSecretsReplacementSnippet for jq 1.7
 (#257932)

jq 1.7 updated it's behaviour and now throws an error
if the first argument is an empty string. It now needs
"." to pass the input through.
---
 nixos/lib/utils.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/nixos/lib/utils.nix b/nixos/lib/utils.nix
index 7ea9d6a5c713..e618cf2f861a 100644
--- a/nixos/lib/utils.nix
+++ b/nixos/lib/utils.nix
@@ -177,6 +177,7 @@ rec {
   genJqSecretsReplacementSnippet' = attr: set: output:
     let
       secrets = recursiveGetAttrWithJqPrefix set attr;
+      stringOrDefault = str: def: if str == "" then def else str;
     in ''
       if [[ -h '${output}' ]]; then
         rm '${output}'
@@ -195,10 +196,12 @@ rec {
                (attrNames secrets))
     + "\n"
     + "${pkgs.jq}/bin/jq >'${output}' "
-    + lib.escapeShellArg (concatStringsSep
-      " | "
-      (imap1 (index: name: ''${name} = $ENV.secret${toString index}'')
-             (attrNames secrets)))
+    + lib.escapeShellArg (stringOrDefault
+          (concatStringsSep
+            " | "
+            (imap1 (index: name: ''${name} = $ENV.secret${toString index}'')
+                   (attrNames secrets)))
+          ".")
     + ''
        <<'EOF'
       ${builtins.toJSON set}