From ea0022cc22d9f8d4559eeb22676194ce94c29b41 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Sat, 15 Apr 2023 23:20:26 +0100
Subject: [PATCH 01/52] libpcap: add some key reverse dependencies to
 passthru.tests

---
 pkgs/development/libraries/libpcap/default.nix | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/pkgs/development/libraries/libpcap/default.nix b/pkgs/development/libraries/libpcap/default.nix
index 04c8a0f16ad8..a298ebddea2e 100644
--- a/pkgs/development/libraries/libpcap/default.nix
+++ b/pkgs/development/libraries/libpcap/default.nix
@@ -9,6 +9,16 @@
 , pkg-config
 , withBluez ? false
 , withRemote ? false
+
+# for passthru.tests
+, ettercap
+, nmap
+, ostinato
+, tcpreplay
+, vde2
+, wireshark
+, python3
+, haskellPackages
 }:
 
 stdenv.mkDerivation rec {
@@ -44,6 +54,12 @@ stdenv.mkDerivation rec {
     fi
   '';
 
+  passthru.tests = {
+    inherit ettercap nmap ostinato tcpreplay vde2 wireshark;
+    inherit (python3.pkgs) pcapy-ng scapy;
+    haskell-pcap = haskellPackages.pcap;
+  };
+
   meta = with lib; {
     homepage = "https://www.tcpdump.org";
     description = "Packet Capture Library";

From 66ca0dc9a203eb7b2a0c2d5f85a04ea71d828c8b Mon Sep 17 00:00:00 2001
From: Jairo Llopis <yajo.sk8@gmail.com>
Date: Wed, 14 Jun 2023 13:46:08 +0100
Subject: [PATCH 02/52] python3Packages.setuptools-odoo: init at 3.1.12

---
 .../setuptools-odoo/default.nix               | 76 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 78 insertions(+)
 create mode 100644 pkgs/development/python-modules/setuptools-odoo/default.nix

diff --git a/pkgs/development/python-modules/setuptools-odoo/default.nix b/pkgs/development/python-modules/setuptools-odoo/default.nix
new file mode 100644
index 000000000000..a9129334208f
--- /dev/null
+++ b/pkgs/development/python-modules/setuptools-odoo/default.nix
@@ -0,0 +1,76 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+, nix-update-script
+, pytestCheckHook
+, git
+, setuptools-scm
+, writeScript
+}:
+buildPythonPackage rec {
+  pname = "setuptools-odoo";
+  version = "3.1.12";
+  src = fetchFromGitHub {
+    owner = "acsone";
+    repo = pname;
+    rev = version;
+    hash = "sha256-GIX21gOENE0r3yFIyzwjaoEcb0XvuCqiPU8F3GLxNt4=";
+  };
+
+  propagatedBuildInputs = [
+    setuptools-scm
+  ];
+
+  # HACK https://github.com/NixOS/nixpkgs/pull/229460
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+  patchPhase = ''
+    runHook prePatch
+
+    old_manifest="$(cat MANIFEST.in 2>/dev/null || true)"
+    echo 'global-include **' > MANIFEST.in
+    echo "$old_manifest" >> MANIFEST.in
+
+    runHook postPatch
+  '';
+
+  pythonImportsCheck = [
+    "setuptools_odoo"
+  ];
+
+  setupHook = writeScript "setupHook.sh" ''
+    setuptoolsOdooHook() {
+      # Don't look for a version suffix from git when building addons
+      export SETUPTOOLS_ODOO_POST_VERSION_STRATEGY_OVERRIDE=none
+
+      # Let setuptools-odoo know which files to install, when Git is missing
+      # HACK https://github.com/acsone/setuptools-odoo/issues/20#issuecomment-340192355
+      echo 'recursive-include odoo/addons/* **' >> MANIFEST.in
+
+      # Make sure you can import the built addon
+      for manifest in $(find -L . -name __manifest__.py); do
+        export pythonImportsCheck="$pythonImportsCheck odoo.addons.$(basename $(dirname $manifest))"
+      done
+    }
+
+    preBuildHooks+=(setuptoolsOdooHook)
+  '';
+
+  nativeCheckInputs = [ pytestCheckHook git ];
+  disabledTests = [
+    "test_addon1_uncommitted_change"
+    "test_addon1"
+    "test_addon2_uncommitted_version_change"
+    "test_odoo_addon1_sdist"
+    "test_odoo_addon1"
+    "test_odoo_addon5_wheel"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Setuptools plugin for Odoo addons";
+    homepage = "https://github.com/acsone/setuptools-odoo";
+    license = lib.licenses.lgpl3Only;
+    maintainers = with lib.maintainers; [ yajo ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index fd5c9b3b1f00..8df57275a8d8 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11109,6 +11109,8 @@ self: super: with self; {
 
   setuptools-lint = callPackage ../development/python-modules/setuptools-lint { };
 
+  setuptools-odoo = callPackage ../development/python-modules/setuptools-odoo { };
+
   setuptools-rust = callPackage ../development/python-modules/setuptools-rust { };
 
   setuptools-scm = callPackage ../development/python-modules/setuptools-scm { };

From 5ec85dc83ef8adeb620866701e9b58cc9fcbd76b Mon Sep 17 00:00:00 2001
From: Jairo Llopis <yajo.sk8@gmail.com>
Date: Tue, 4 Jul 2023 13:57:56 +0100
Subject: [PATCH 03/52] python3Packages.manifestoo-core: init at 0.11.0

---
 .../manifestoo-core/default.nix               | 40 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 42 insertions(+)
 create mode 100644 pkgs/development/python-modules/manifestoo-core/default.nix

diff --git a/pkgs/development/python-modules/manifestoo-core/default.nix b/pkgs/development/python-modules/manifestoo-core/default.nix
new file mode 100644
index 000000000000..3135ded66ebf
--- /dev/null
+++ b/pkgs/development/python-modules/manifestoo-core/default.nix
@@ -0,0 +1,40 @@
+{ buildPythonPackage
+, typing-extensions
+, fetchPypi
+, lib
+, nix-update-script
+, hatch-vcs
+, pythonOlder
+, importlib-resources
+}:
+
+buildPythonPackage rec {
+  pname = "manifestoo-core";
+  version = "0.11.0";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit version;
+    pname = "manifestoo_core";
+    hash = "sha256-ZZAJDOtGcYWm0yS5bMOUdM1Jf+kfurwiLsJwyTYPz/4=";
+  };
+
+  nativeBuildInputs = [
+    hatch-vcs
+  ];
+
+  propagatedBuildInputs =
+    lib.optionals (pythonOlder "3.7") [ importlib-resources ]
+    ++ lib.optionals (pythonOlder "3.8") [ typing-extensions ];
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    description = "A library to reason about Odoo addons manifests";
+    homepage = "https://github.com/acsone/manifestoo-core";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ yajo ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 114450f0818e..750759aeb764 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6097,6 +6097,8 @@ self: super: with self; {
 
   manifest-ml = callPackage ../development/python-modules/manifest-ml { };
 
+  manifestoo-core = callPackage ../development/python-modules/manifestoo-core { };
+
   manifestparser = callPackage ../development/python-modules/marionette-harness/manifestparser.nix { };
 
   manuel = callPackage ../development/python-modules/manuel { };

From 8d6db778ff575a709bfdf3b650c02dca3dcf72df Mon Sep 17 00:00:00 2001
From: Jairo Llopis <yajo.sk8@gmail.com>
Date: Tue, 4 Jul 2023 13:58:29 +0100
Subject: [PATCH 04/52] python3Packages.click-odoo: init at 1.6.0

---
 .../python-modules/click-odoo/default.nix     | 37 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 39 insertions(+)
 create mode 100644 pkgs/development/python-modules/click-odoo/default.nix

diff --git a/pkgs/development/python-modules/click-odoo/default.nix b/pkgs/development/python-modules/click-odoo/default.nix
new file mode 100644
index 000000000000..a618359735f1
--- /dev/null
+++ b/pkgs/development/python-modules/click-odoo/default.nix
@@ -0,0 +1,37 @@
+{ buildPythonPackage
+, click
+, fetchPypi
+, lib
+, nix-update-script
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "click-odoo";
+  version = "1.6.0";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-zyfgsHzIoz4lnqANe63b2oqgD/oxBbTbJYEedfSHWQ8=";
+  };
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    click
+  ];
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    description = "Odoo scripting helper library";
+    homepage = "https://github.com/acsone/click-odoo";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ yajo ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 750759aeb764..d37eb9409dcf 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1929,6 +1929,8 @@ self: super: with self; {
 
   click-log = callPackage ../development/python-modules/click-log { };
 
+  click-odoo = callPackage ../development/python-modules/click-odoo { };
+
   click-option-group = callPackage ../development/python-modules/click-option-group { };
 
   click-plugins = callPackage ../development/python-modules/click-plugins { };

From dd4cb577d92212e76e5a29745fccef5fc01f7e03 Mon Sep 17 00:00:00 2001
From: Jairo Llopis <yajo.sk8@gmail.com>
Date: Tue, 4 Jul 2023 14:10:03 +0100
Subject: [PATCH 05/52] python3Packages.click-odoo-contrib: init at 1.16.1

---
 .../click-odoo-contrib/default.nix            | 43 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 45 insertions(+)
 create mode 100644 pkgs/development/python-modules/click-odoo-contrib/default.nix

diff --git a/pkgs/development/python-modules/click-odoo-contrib/default.nix b/pkgs/development/python-modules/click-odoo-contrib/default.nix
new file mode 100644
index 000000000000..b0ddaef004b9
--- /dev/null
+++ b/pkgs/development/python-modules/click-odoo-contrib/default.nix
@@ -0,0 +1,43 @@
+{ buildPythonPackage
+, click-odoo
+, fetchPypi
+, importlib-resources
+, lib
+, manifestoo-core
+, nix-update-script
+, pythonOlder
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "click-odoo-contrib";
+  version = "1.16.1";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-VFoS/lOw/jbJNj9xfgZHKzR6JDTwnlCAItq4mZ3RA6I=";
+  };
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    click-odoo
+    manifestoo-core
+  ] ++ lib.optionals (pythonOlder "3.9") [ importlib-resources ];
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  passthru.updateScript = nix-update-script { };
+
+  pythonImportsCheck = [ "click_odoo_contrib" ];
+
+  meta = with lib; {
+    description = "Collection of community-maintained scripts for Odoo maintenance";
+    homepage = "https://github.com/acsone/click-odoo-contrib";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ yajo ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d37eb9409dcf..fd5e6dbb7ad2 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1931,6 +1931,8 @@ self: super: with self; {
 
   click-odoo = callPackage ../development/python-modules/click-odoo { };
 
+  click-odoo-contrib = callPackage ../development/python-modules/click-odoo-contrib { };
+
   click-option-group = callPackage ../development/python-modules/click-option-group { };
 
   click-plugins = callPackage ../development/python-modules/click-plugins { };

From cb0966b94f5e112f262fafd70ddbc833928ecd59 Mon Sep 17 00:00:00 2001
From: Jairo Llopis <yajo.sk8@gmail.com>
Date: Thu, 6 Jul 2023 11:56:24 +0100
Subject: [PATCH 06/52] python3Packages.manifestoo: init at 0.7

---
 .../python-modules/manifestoo/default.nix     | 51 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 53 insertions(+)
 create mode 100644 pkgs/development/python-modules/manifestoo/default.nix

diff --git a/pkgs/development/python-modules/manifestoo/default.nix b/pkgs/development/python-modules/manifestoo/default.nix
new file mode 100644
index 000000000000..c9499eb11310
--- /dev/null
+++ b/pkgs/development/python-modules/manifestoo/default.nix
@@ -0,0 +1,51 @@
+{ buildPythonPackage
+, fetchPypi
+, hatch-vcs
+, importlib-metadata
+, lib
+, manifestoo-core
+, nix-update-script
+, pytestCheckHook
+, pythonOlder
+, textual
+, typer
+, typing-extensions
+}:
+
+buildPythonPackage rec {
+  pname = "manifestoo";
+  version = "0.7";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-gCGchc+fShBgt6fVJAx80+QnH+vxWo3jsIyePkFwhYE=";
+  };
+
+  nativeBuildInputs = [
+    hatch-vcs
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  propagatedBuildInputs = [
+    manifestoo-core
+    textual
+    typer
+  ]
+  ++ typer.passthru.optional-dependencies.all
+  ++ lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    description = "A tool to reason about Odoo addons manifests";
+    homepage = "https://github.com/acsone/manifestoo";
+    license = licenses.mit;
+    maintainers = with maintainers; [ yajo ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index fd5e6dbb7ad2..69678348b806 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6101,6 +6101,8 @@ self: super: with self; {
 
   manifest-ml = callPackage ../development/python-modules/manifest-ml { };
 
+  manifestoo = callPackage ../development/python-modules/manifestoo { };
+
   manifestoo-core = callPackage ../development/python-modules/manifestoo-core { };
 
   manifestparser = callPackage ../development/python-modules/marionette-harness/manifestparser.nix { };

From 7ac8d2c63bed21f0cca9c564fc8bc05bcf54bbf2 Mon Sep 17 00:00:00 2001
From: Jairo Llopis <yajo.sk8@gmail.com>
Date: Thu, 6 Jul 2023 12:30:59 +0100
Subject: [PATCH 07/52] python3Packages.syrupy: fix wrong version disabler

`pythonOlder` only checks for major and minor version specifiers of python.

However, https://github.com/tophat/syrupy/releases/tag/v4.0.0 specifies that 3.8.1 is the minimum supported release.

Currently, although deprecated, the provided python38 version is 3.8.17. Thus this package should be available.
---
 pkgs/development/python-modules/syrupy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/syrupy/default.nix b/pkgs/development/python-modules/syrupy/default.nix
index 4043cb637c2f..d571c9dd7655 100644
--- a/pkgs/development/python-modules/syrupy/default.nix
+++ b/pkgs/development/python-modules/syrupy/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pythonOlder
+, python
 , poetry-core
 , pytest
 , colored
@@ -13,7 +13,7 @@ buildPythonPackage rec {
   version = "4.0.2";
   format = "pyproject";
 
-  disabled = pythonOlder "3.8.1";
+  disabled = lib.versionOlder python.version "3.8.1";
 
   src = fetchFromGitHub {
     owner = "tophat";

From ed25f5deeef0159f9c78bb9a07e4170d178feb23 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Thu, 3 Aug 2023 00:23:06 +0100
Subject: [PATCH 08/52] librsvg: add some key reverse dependencies to
 passthru.tests

---
 .../development/libraries/librsvg/default.nix | 21 +++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/pkgs/development/libraries/librsvg/default.nix b/pkgs/development/libraries/librsvg/default.nix
index 9974826573a7..a513f02cdc8f 100644
--- a/pkgs/development/libraries/librsvg/default.nix
+++ b/pkgs/development/libraries/librsvg/default.nix
@@ -28,6 +28,16 @@
 , common-updater-scripts
 , jq
 , nix
+
+# for passthru.tests
+, enlightenment
+, ffmpeg
+, gegl
+, gimp
+, imagemagick
+, imlib2
+, vips
+, xfce
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -194,6 +204,17 @@ stdenv.mkDerivation (finalAttrs: {
         updateSource
         updateLockfile
       ];
+    tests = {
+      inherit
+        gegl
+        gimp
+        imagemagick
+        imlib2
+        vips;
+      inherit (enlightenment) efl;
+      inherit (xfce) xfwm4;
+      ffmpeg = ffmpeg.override { withSvg = true; };
+    };
   };
 
   meta = with lib; {

From bff13ed20e3061fbef3dba8d6a7ca9411be9c4e3 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Sat, 19 Aug 2023 00:20:10 +0100
Subject: [PATCH 09/52] libcap: add some key reverse-dependencies to
 passthru.tests

---
 pkgs/os-specific/linux/libcap/default.nix | 26 +++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/pkgs/os-specific/linux/libcap/default.nix b/pkgs/os-specific/linux/libcap/default.nix
index 17fcbd128408..9b23625102ae 100644
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@@ -1,6 +1,18 @@
 { stdenv, lib, buildPackages, fetchurl, attr, runtimeShell
 , usePam ? !isStatic, pam ? null
 , isStatic ? stdenv.hostPlatform.isStatic
+
+# passthru.tests
+, bind
+, chrony
+, htop
+, libgcrypt
+, libvirt
+, ntp
+, qemu
+, squid
+, tor
+, uwsgi
 }:
 
 assert usePam -> pam != null;
@@ -57,6 +69,20 @@ stdenv.mkDerivation rec {
     mv "$lib"/lib/security "$pam/lib"
   '';
 
+  passthru.tests = {
+    inherit
+      bind
+      chrony
+      htop
+      libgcrypt
+      libvirt
+      ntp
+      qemu
+      squid
+      tor
+      uwsgi;
+  };
+
   meta = {
     description = "Library for working with POSIX capabilities";
     homepage = "https://sites.google.com/site/fullycapable";

From 0482394fe0eb4d3eba91bded8e1d9dbef1bb7c64 Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Tue, 8 Aug 2023 11:53:51 +0200
Subject: [PATCH 10/52] ragnarwm: init at 1.3.1

---
 .../services/x11/window-managers/default.nix  |  1 +
 .../services/x11/window-managers/ragnarwm.nix | 33 +++++++++
 nixos/tests/all-tests.nix                     |  1 +
 nixos/tests/ragnarwm.nix                      | 32 ++++++++
 .../window-managers/ragnarwm/default.nix      | 73 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 6 files changed, 142 insertions(+)
 create mode 100644 nixos/modules/services/x11/window-managers/ragnarwm.nix
 create mode 100644 nixos/tests/ragnarwm.nix
 create mode 100644 pkgs/applications/window-managers/ragnarwm/default.nix

diff --git a/nixos/modules/services/x11/window-managers/default.nix b/nixos/modules/services/x11/window-managers/default.nix
index ce1d4115f225..e180f2693e0c 100644
--- a/nixos/modules/services/x11/window-managers/default.nix
+++ b/nixos/modules/services/x11/window-managers/default.nix
@@ -35,6 +35,7 @@ in
     ./openbox.nix
     ./pekwm.nix
     ./notion.nix
+    ./ragnarwm.nix
     ./ratpoison.nix
     ./sawfish.nix
     ./smallwm.nix
diff --git a/nixos/modules/services/x11/window-managers/ragnarwm.nix b/nixos/modules/services/x11/window-managers/ragnarwm.nix
new file mode 100644
index 000000000000..0843b872dba5
--- /dev/null
+++ b/nixos/modules/services/x11/window-managers/ragnarwm.nix
@@ -0,0 +1,33 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.xserver.windowManager.ragnarwm;
+in
+{
+  ###### interface
+
+  options = {
+    services.xserver.windowManager.ragnarwm = {
+      enable = mkEnableOption (lib.mdDoc "ragnarwm");
+      package = mkOption {
+        type = types.package;
+        default = pkgs.ragnarwm;
+        defaultText = literalExpression "pkgs.ragnarwm";
+        description = lib.mdDoc ''
+          The ragnar package to use.
+        '';
+      };
+    };
+  };
+
+  ###### implementation
+
+  config = mkIf cfg.enable {
+    services.xserver.displayManager.sessionPackages = [ cfg.package ];
+    environment.systemPackages = [ cfg.package ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ sigmanificient ];
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 06d63b4f2d07..0e06e3997c41 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -667,6 +667,7 @@ in {
   rabbitmq = handleTest ./rabbitmq.nix {};
   radarr = handleTest ./radarr.nix {};
   radicale = handleTest ./radicale.nix {};
+  ragnarwm = handleTest ./ragnarwm.nix {};
   rasdaemon = handleTest ./rasdaemon.nix {};
   readarr = handleTest ./readarr.nix {};
   redis = handleTest ./redis.nix {};
diff --git a/nixos/tests/ragnarwm.nix b/nixos/tests/ragnarwm.nix
new file mode 100644
index 000000000000..f7c588b92008
--- /dev/null
+++ b/nixos/tests/ragnarwm.nix
@@ -0,0 +1,32 @@
+import ./make-test-python.nix ({ lib, ...} : {
+  name = "ragnarwm";
+
+  meta = {
+    maintainers = with lib.maintainers; [ sigmanificient ];
+  };
+
+  nodes.machine = { pkgs, lib, ... }: {
+    imports = [ ./common/x11.nix ./common/user-account.nix ];
+    test-support.displayManager.auto.user = "alice";
+    services.xserver.displayManager.defaultSession = lib.mkForce "ragnar";
+    services.xserver.windowManager.ragnarwm.enable = true;
+
+    # Setup the default terminal of Ragnar
+    environment.systemPackages = [ pkgs.alacritty ];
+  };
+
+  testScript = ''
+    with subtest("ensure x starts"):
+        machine.wait_for_x()
+        machine.wait_for_file("/home/alice/.Xauthority")
+        machine.succeed("xauth merge ~alice/.Xauthority")
+
+    with subtest("ensure we can open a new terminal"):
+        # Sleeping a bit before the test, as it may help for sending keys
+        machine.sleep(2)
+        machine.send_key("meta_l-ret")
+        machine.wait_for_window(r"alice.*?machine")
+        machine.sleep(2)
+        machine.screenshot("terminal")
+  '';
+})
diff --git a/pkgs/applications/window-managers/ragnarwm/default.nix b/pkgs/applications/window-managers/ragnarwm/default.nix
new file mode 100644
index 000000000000..528ae2bf7b80
--- /dev/null
+++ b/pkgs/applications/window-managers/ragnarwm/default.nix
@@ -0,0 +1,73 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, writeText
+, fontconfig
+, libX11
+, libXft
+, libXcursor
+, libXcomposite
+, conf ? null
+, nixosTests
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ragnarwm";
+  version = "1.3.1";
+
+  src = fetchFromGitHub {
+    owner = "cococry";
+    repo = "Ragnar";
+    rev = finalAttrs.version;
+    hash = "sha256-SZWhmFNmS2oLdO9BnPzimoind1452v/EEQzadc5A+bI";
+  };
+
+  prePatch = ''
+    substituteInPlace Makefile \
+      --replace '/usr/bin' "$out/bin" \
+      --replace '/usr/share' "$out/share"
+  '';
+
+  postPatch =
+    let
+      configFile =
+        if lib.isDerivation conf || builtins.isPath conf
+        then conf else writeText "config.h" conf;
+    in
+    lib.optionalString (conf != null) "cp ${configFile} config.h";
+
+  buildInputs = [
+    fontconfig
+    libX11
+    libXft
+    libXcursor
+    libXcomposite
+  ];
+
+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
+  enableParallelBuilding = true;
+
+  preInstall = ''
+    mkdir -p $out/bin
+    mkdir -p $out/share/applications
+  '';
+
+  postInstall = ''
+    install -Dm644 $out/share/applications/ragnar.desktop $out/share/xsessions/ragnar.desktop
+  '';
+
+  passthru = {
+    tests.ragnarwm = nixosTests.ragnarwm;
+    providedSessions = [ "ragnar" ];
+  };
+
+  meta = with lib; {
+    description = "Minimal, flexible & user-friendly X tiling window manager";
+    homepage = "https://ragnar-website.vercel.app";
+    changelog = "https://github.com/cococry/Ragnar/releases/tag/${finalAttrs.version}";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ sigmanificient ];
+    mainProgram = "ragnar";
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2639afba28ae..a0c90ddf29fc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -33926,6 +33926,8 @@ with pkgs;
 
   qemacs = callPackage ../applications/editors/qemacs { };
 
+  ragnarwm = callPackage ../applications/window-managers/ragnarwm {};
+
   rime-cli = callPackage ../applications/office/rime-cli { };
 
   roxctl = callPackage ../applications/networking/cluster/roxctl {

From d3ac8de01e1fdcab7e7aa3da90478ae727520d90 Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Wed, 23 Aug 2023 10:41:18 +0200
Subject: [PATCH 11/52] maintainers: add rvdp

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 780c1dbd9c48..87d48b926193 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -14826,6 +14826,12 @@
     githubId = 7365864;
     name = "Rafael Varago";
   };
+  rvdp = {
+    email = "ramses@well-founded.dev";
+    github = "R-VdP";
+    githubId = 141248;
+    name = "Ramses";
+  };
   rvl = {
     email = "dev+nix@rodney.id.au";
     github = "rvl";

From 7b0326e46f92961b9d1d757b923b0481f12fac2d Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Tue, 22 Aug 2023 16:00:21 +0200
Subject: [PATCH 12/52] fwupd: 1.9.3 -> 1.9.4

https://github.com/fwupd/fwupd/releases/tag/1.9.4
---
 pkgs/os-specific/linux/firmware/fwupd/default.nix | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 371e13de589e..25bce432bc5f 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -123,7 +123,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fwupd";
-  version = "1.9.3";
+  version = "1.9.4";
 
   # libfwupd goes to lib
   # daemon, plug-ins and libfwupdplugin go to out
@@ -134,7 +134,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "fwupd";
     repo = "fwupd";
     rev = finalAttrs.version;
-    hash = "sha256-IVP5RVHRxWkvPqndiuCxiguYWN5d32qJo9YzBOHoyUk";
+    hash = "sha256-xjN6nHqg7sQzgojClySQEjLQBdI5291TxPhgLjKzKvk=";
   };
 
   patches = [
@@ -212,9 +212,6 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dplugin_dummy=true"
     # We are building the official releases.
     "-Dsupported_build=enabled"
-    # Would dlopen libsoup to preserve compatibility with clients linking against older fwupd.
-    # https://github.com/fwupd/fwupd/commit/173d389fa59d8db152a5b9da7cc1171586639c97
-    "-Dsoup_session_compat=false"
     "-Dudevdir=lib/udev"
     "-Dsystemd_root_prefix=${placeholder "out"}"
     "-Dinstalled_test_prefix=${placeholder "installedTests"}"
@@ -399,7 +396,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = with lib; {
     homepage = "https://fwupd.org/";
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ rvdp ];
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
   };

From 0f3611743aa1d4ba189d74716e5044460a435a1b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 25 Aug 2023 11:39:02 +0000
Subject: [PATCH 13/52] wine64Packages.unstable: 8.13 -> 8.14

---
 pkgs/applications/emulators/wine/sources.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/wine/sources.nix b/pkgs/applications/emulators/wine/sources.nix
index 1bfb35e76d78..aca987417558 100644
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@@ -69,9 +69,9 @@ in rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "8.13";
+    version = "8.14";
     url = "https://dl.winehq.org/wine/source/8.x/wine-${version}.tar.xz";
-    hash = "sha256-JuXTqD0lxUGMbA9USORD0gh2OiZDqrSw8a01KSKkwnU=";
+    hash = "sha256-4YNu9msYJfqdoEKDDASVsqw5SBVENkNGaXnuif3X+vQ=";
     inherit (stable) patches;
 
     ## see http://wiki.winehq.org/Gecko
@@ -117,7 +117,7 @@ in rec {
   staging = fetchFromGitHub rec {
     # https://github.com/wine-staging/wine-staging/releases
     inherit (unstable) version;
-    hash = "sha256-5upC+IWHBJE5DeFv96lD1hr4LYYaqAAzfxIroK9KlOY=";
+    hash = "sha256-ct/RGXt9B6F3PHbirX8K03AZ0Kunitd2HmI0N5k6VHI=";
     owner = "wine-staging";
     repo = "wine-staging";
     rev = "v${version}";

From 991afce31d372a5cc4a0e052719604ffcf9d4e23 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 26 Aug 2023 14:18:45 +0000
Subject: [PATCH 14/52] freetds: 1.3.18 -> 1.3.19

---
 pkgs/development/libraries/freetds/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/freetds/default.nix b/pkgs/development/libraries/freetds/default.nix
index cd9e99b352eb..ee9a08f1e50c 100644
--- a/pkgs/development/libraries/freetds/default.nix
+++ b/pkgs/development/libraries/freetds/default.nix
@@ -8,11 +8,11 @@ assert odbcSupport -> unixODBC != null;
 
 stdenv.mkDerivation rec {
   pname = "freetds";
-  version = "1.3.18";
+  version = "1.3.19";
 
   src = fetchurl {
     url    = "https://www.freetds.org/files/stable/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-HYVh1XxxmRoo9GgTQ3hcI6aj61TVvNI4l9B+OCX/LVY=";
+    sha256 = "sha256-Neaa5czXBFyKUpHp/CsjhEqf3+9rTg7n9ioGlXkBK4U=";
   };
 
   buildInputs = [

From 8823a5ba0d6d1a3b05cb9b409c349436b9fa267a Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 26 Aug 2023 21:03:26 +0200
Subject: [PATCH 15/52] invidious: unstable-2023-08-07 -> unstable-2023-08-25

---
 pkgs/servers/invidious/versions.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/invidious/versions.json b/pkgs/servers/invidious/versions.json
index f2bc1e7af4d8..61ee89b6e742 100644
--- a/pkgs/servers/invidious/versions.json
+++ b/pkgs/servers/invidious/versions.json
@@ -4,9 +4,9 @@
     "sha256": "sha256-EU6T9yQCdOLx98Io8o01rEsgxDFF/Xoy42LgPopD2/A="
   },
   "invidious": {
-    "rev": "34508966027fce3f460d9670eeecef67b92565a0",
-    "sha256": "sha256-z+6YHhESb0Ws9DRaVH4AR2i/SaWgM9OhTzxdY1bkv/0=",
-    "version": "unstable-2023-08-07"
+    "rev": "1377f2ce7d0a8fed716e8e285902bfbfef1a17e0",
+    "sha256": "sha256-ro5XneQqKGOfR7UZrowiht5V45s7EgkpbJiyBoLcnBo=",
+    "version": "unstable-2023-08-25"
   },
   "lsquic": {
     "sha256": "sha256-hG8cUvhbCNeMOsKkaJlgGpzUrIx47E/WhmPIdI5F3qM=",

From a2028f60339895b0e305801fe7a7cbfc59dbb309 Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Sun, 27 Aug 2023 04:20:00 +0000
Subject: [PATCH 16/52] flexget: 3.9.4 -> 3.9.5

Diff: https://github.com/Flexget/Flexget/compare/refs/tags/v3.9.4...v3.9.5

Changelog: https://github.com/Flexget/Flexget/releases/tag/v3.9.5
---
 pkgs/applications/networking/flexget/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/flexget/default.nix b/pkgs/applications/networking/flexget/default.nix
index 84827d228108..649be6767c28 100644
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@@ -6,7 +6,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.9.4";
+  version = "3.9.5";
   format = "pyproject";
 
   # Fetch from GitHub in order to use `requirements.in`
@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "Flexget";
     repo = "Flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cdmW0VSWjr3rm/1T0uDy1iPm3ojR5wrgRixyjIQhodU=";
+    hash = "sha256-L3AQCc5ErWjMATKMSZf9r+4rfFA8SjCCcT0rW9oMmbA=";
   };
 
   postPatch = ''

From 48853167e4ab52cedfed1ecc441d4288cd47198a Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Sun, 27 Aug 2023 04:20:00 +0000
Subject: [PATCH 17/52] freetds: 1.3.19 -> 1.3.20

Changelog: https://github.com/FreeTDS/freetds/releases/tag/v1.3.20
---
 pkgs/development/libraries/freetds/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/freetds/default.nix b/pkgs/development/libraries/freetds/default.nix
index ee9a08f1e50c..b42fdbd60ccb 100644
--- a/pkgs/development/libraries/freetds/default.nix
+++ b/pkgs/development/libraries/freetds/default.nix
@@ -8,11 +8,11 @@ assert odbcSupport -> unixODBC != null;
 
 stdenv.mkDerivation rec {
   pname = "freetds";
-  version = "1.3.19";
+  version = "1.3.20";
 
   src = fetchurl {
     url    = "https://www.freetds.org/files/stable/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-Neaa5czXBFyKUpHp/CsjhEqf3+9rTg7n9ioGlXkBK4U=";
+    sha256 = "sha256-IK4R87gG5PvA+gtZMftHO7V0i+6dSH9qoSiFCDV4pe0=";
   };
 
   buildInputs = [
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Libraries to natively talk to Microsoft SQL Server and Sybase databases";
     homepage    = "https://www.freetds.org";
+    changelog   = "https://github.com/FreeTDS/freetds/releases/tag/v${version}";
     license     = licenses.lgpl2;
     maintainers = with maintainers; [ peterhoeg ];
     platforms   = platforms.all;

From cd2ae27e0a061c90cc7b07e68b8dc3716975fd73 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 27 Aug 2023 08:27:57 +0000
Subject: [PATCH 18/52] frp: 0.51.2 -> 0.51.3

---
 pkgs/tools/networking/frp/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/networking/frp/default.nix b/pkgs/tools/networking/frp/default.nix
index 078d80af10eb..519aedad558e 100644
--- a/pkgs/tools/networking/frp/default.nix
+++ b/pkgs/tools/networking/frp/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "frp";
-  version = "0.51.2";
+  version = "0.51.3";
 
   src = fetchFromGitHub {
     owner = "fatedier";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-uiF27qGHwAg05o9thCxIf6Z2xhMnKzhDgMKTuS6IJ8A=";
+    sha256 = "sha256-ijcYSuB91I9lD4qx6ohVFDQgTE0+FTQ5Hr1heNwKyUo=";
   };
 
-  vendorHash = "sha256-sqlBgEfIWuDnGsepSZtrgxmG/DoP+Hc4c3nOpo8S/Ks=";
+  vendorHash = "sha256-DFQ59E24LR5/qodtge0EsqajvrjPN0otpxGB8JQ0ERw=";
 
   doCheck = false;
 

From bdf47492d43d88844db5bd758150bb493aa22ff1 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Sun, 27 Aug 2023 10:58:27 +0200
Subject: [PATCH 19/52] wine64Packages.unstable: Darwin compatibility fixes

- Wine 8.12 changed the implementation of `macdrv_get_gpus_from_metal`,
  causing the patch used by nixpkgs to break. This patch splits that
  patch up to apply cleanly depending on the version;
- Silence an implicit pointer to integer conversion warning due to the
  above patch (required by the Clang 16 stdenv bump);
- Add the PCSC framework on Darwin, which is required as of Wine 8.14.

Wine 8.14 changes the implementation of `macdrv_get_gpus_from_metal`,
causing the patch to no longer apply cleanly. Splitting the patch allows
only the parts that are still needed to apply cleanly dependin gon the
Wine version being built.
---
 pkgs/applications/emulators/wine/base.nix     | 19 +++++++++++++---
 .../wine/darwin-metal-compat-pre8.12.patch    | 22 +++++++++++++++++++
 .../emulators/wine/darwin-metal-compat.patch  | 21 +-----------------
 3 files changed, 39 insertions(+), 23 deletions(-)
 create mode 100644 pkgs/applications/emulators/wine/darwin-metal-compat-pre8.12.patch

diff --git a/pkgs/applications/emulators/wine/base.nix b/pkgs/applications/emulators/wine/base.nix
index bc8051d6de5f..50a2e7d75669 100644
--- a/pkgs/applications/emulators/wine/base.nix
+++ b/pkgs/applications/emulators/wine/base.nix
@@ -90,7 +90,7 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
   ++ lib.optionals tlsSupport    [ pkgs.openssl pkgs.gnutls ]
   ++ lib.optionals (openglSupport && !stdenv.isDarwin) [ pkgs.libGLU pkgs.libGL pkgs.mesa.osmesa pkgs.libdrm ]
   ++ lib.optionals stdenv.isDarwin (with pkgs.buildPackages.darwin.apple_sdk.frameworks; [
-     CoreServices Foundation ForceFeedback AppKit OpenGL IOKit DiskArbitration Security
+     CoreServices Foundation ForceFeedback AppKit OpenGL IOKit DiskArbitration PCSC Security
      ApplicationServices AudioToolbox CoreAudio AudioUnit CoreMIDI OpenCL Cocoa Carbon
   ])
   ++ lib.optionals (stdenv.isLinux && !waylandSupport) (with pkgs.xorg; [
@@ -103,14 +103,27 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
 
   patches = [ ]
     ++ lib.optionals stdenv.isDarwin [
-      # Wine requires `MTLDevice.registryID` for `winemac.drv`, but that property is not available
-      # in the 10.12 SDK (current SDK on x86_64-darwin). Work around that by using selector syntax.
+      # Wine uses `MTLDevice.registryID` in `winemac.drv`, but that property is not available in
+      # the 10.12 SDK (current SDK on x86_64-darwin). That can be worked around by using selector
+      # syntax. As of Wine 8.12, the logic has changed and uses selector syntax, but it still
+      # uses property syntax in one place. The first patch is necessary only with older
+      # versions of Wine. The second is needed on all versions of Wine.
+      (lib.optional (lib.versionOlder version "8.12") ./darwin-metal-compat-pre8.12.patch)
       ./darwin-metal-compat.patch
       # Wine requires `qos.h`, which is not included by default on the 10.12 SDK in nixpkgs.
       ./darwin-qos.patch
     ]
     ++ patches';
 
+  # Because the 10.12 SDK doesn’t define `registryID`, clang assumes the undefined selector returns
+  # `id`, which is a pointer. This causes implicit pointer to integer errors in clang 15+.
+  # The following post-processing step adds a cast to `uint64_t` before the selector invocation to
+  # silence these errors.
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    sed -e 's|\(\[[A-Za-z_][][A-Za-z_0-9]* registryID\]\)|(uint64_t)\1|' \
+      -i dlls/winemac.drv/cocoa_display.m
+  '';
+
   configureFlags = prevConfigFlags
     ++ lib.optionals supportFlags.waylandSupport [ "--with-wayland" ]
     ++ lib.optionals supportFlags.vulkanSupport [ "--with-vulkan" ]
diff --git a/pkgs/applications/emulators/wine/darwin-metal-compat-pre8.12.patch b/pkgs/applications/emulators/wine/darwin-metal-compat-pre8.12.patch
new file mode 100644
index 000000000000..aaf8a1b89bfd
--- /dev/null
+++ b/pkgs/applications/emulators/wine/darwin-metal-compat-pre8.12.patch
@@ -0,0 +1,22 @@
+diff --git a/dlls/winemac.drv/cocoa_display.m b/dlls/winemac.drv/cocoa_display.m
+--- a/dlls/winemac.drv/cocoa_display.m
++++ b/dlls/winemac.drv/cocoa_display.m
+@@ -289,7 +289,7 @@ static int macdrv_get_gpus_from_metal(struct macdrv_gpu** new_gpus, int* count)
+      * the primary GPU because we need to hide the integrated GPU for an automatic graphic switching pair to avoid apps
+      * using the integrated GPU. This is the behavior of Windows on a Mac. */
+     primary_device = [MTLCreateSystemDefaultDevice() autorelease];
+-    if (macdrv_get_gpu_info_from_registry_id(&primary_gpu, primary_device.registryID))
++    if (macdrv_get_gpu_info_from_registry_id(&primary_gpu, [primary_device registryID]))
+         goto done;
+
+     /* Hide the integrated GPU if the system default device is a dedicated GPU */
+@@ -301,7 +301,7 @@ static int macdrv_get_gpus_from_metal(struct macdrv_gpu** new_gpus, int* count)
+
+     for (i = 0; i < devices.count; i++)
+     {
+-        if (macdrv_get_gpu_info_from_registry_id(&gpus[gpu_count], devices[i].registryID))
++        if (macdrv_get_gpu_info_from_registry_id(&gpus[gpu_count], [devices[i] registryID]))
+             goto done;
+
+         if (hide_integrated && devices[i].isLowPower)
+
diff --git a/pkgs/applications/emulators/wine/darwin-metal-compat.patch b/pkgs/applications/emulators/wine/darwin-metal-compat.patch
index aeee7533bbd4..181b2a0d1a47 100644
--- a/pkgs/applications/emulators/wine/darwin-metal-compat.patch
+++ b/pkgs/applications/emulators/wine/darwin-metal-compat.patch
@@ -1,31 +1,12 @@
 diff --git a/dlls/winemac.drv/cocoa_display.m b/dlls/winemac.drv/cocoa_display.m
-index f64a6c0f6ad..6da0391e3fa 100644
 --- a/dlls/winemac.drv/cocoa_display.m
 +++ b/dlls/winemac.drv/cocoa_display.m
-@@ -289,7 +289,7 @@ static int macdrv_get_gpus_from_metal(struct macdrv_gpu** new_gpus, int* count)
-      * the primary GPU because we need to hide the integrated GPU for an automatic graphic switching pair to avoid apps
-      * using the integrated GPU. This is the behavior of Windows on a Mac. */
-     primary_device = [MTLCreateSystemDefaultDevice() autorelease];
--    if (macdrv_get_gpu_info_from_registry_id(&primary_gpu, primary_device.registryID))
-+    if (macdrv_get_gpu_info_from_registry_id(&primary_gpu, (uint64_t)[primary_device registryID]))
-         goto done;
- 
-     /* Hide the integrated GPU if the system default device is a dedicated GPU */
-@@ -301,7 +301,7 @@ static int macdrv_get_gpus_from_metal(struct macdrv_gpu** new_gpus, int* count)
- 
-     for (i = 0; i < devices.count; i++)
-     {
--        if (macdrv_get_gpu_info_from_registry_id(&gpus[gpu_count], devices[i].registryID))
-+        if (macdrv_get_gpu_info_from_registry_id(&gpus[gpu_count], (uint64_t)[devices[i] registryID]))
-             goto done;
- 
-         if (hide_integrated && devices[i].isLowPower)
 @@ -354,7 +354,7 @@ static int macdrv_get_gpu_info_from_display_id_using_metal(struct macdrv_gpu* gp
  
      device = [CGDirectDisplayCopyCurrentMetalDevice(display_id) autorelease];
      if (device && [device respondsToSelector:@selector(registryID)])
 -        ret = macdrv_get_gpu_info_from_registry_id(gpu, device.registryID);
-+        ret = macdrv_get_gpu_info_from_registry_id(gpu, (uint64_t)[device registryID]);
++        ret = macdrv_get_gpu_info_from_registry_id(gpu, [device registryID]);
  
  done:
      [pool release];

From 27393315bff2ceb0cb5b8404dbfabd0b48dfad41 Mon Sep 17 00:00:00 2001
From: Matthias Beyer <mail@beyermatthias.de>
Date: Sun, 27 Aug 2023 11:01:28 +0200
Subject: [PATCH 20/52] cargo-udeps: 0.1.41 -> 0.1.42

Signed-off-by: Matthias Beyer <mail@beyermatthias.de>
---
 pkgs/development/tools/rust/cargo-udeps/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/rust/cargo-udeps/default.nix b/pkgs/development/tools/rust/cargo-udeps/default.nix
index 8ff6c841758e..55bf3bb36b68 100644
--- a/pkgs/development/tools/rust/cargo-udeps/default.nix
+++ b/pkgs/development/tools/rust/cargo-udeps/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-udeps";
-  version = "0.1.41";
+  version = "0.1.42";
 
   src = fetchFromGitHub {
     owner = "est31";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-LfPhs3hTM47ktDSSC5TVYQoJa4OzMfL7zKLWV4d6bAA=";
+    sha256 = "sha256-8CQnmUk7jMlcdtZh6046B5duKnZKaMVk2xG4D2svqVw=";
   };
 
-  cargoHash = "sha256-NBxQ75J60kZX6ASk3/42N5JT6pDLEZpnZtUCgRDOvSY=";
+  cargoHash = "sha256-e3ku9c4VLZtnJIUDRMAcUVaJnOsMqckj3XmuJHSR364=";
 
   nativeBuildInputs = [ pkg-config ];
 

From f27b81b421dfff8028fa991c659dff04ced78292 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 27 Aug 2023 09:02:56 +0000
Subject: [PATCH 21/52] liquibase: 4.23.0 -> 4.23.1

---
 pkgs/development/tools/database/liquibase/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/database/liquibase/default.nix b/pkgs/development/tools/database/liquibase/default.nix
index 3309dbd41862..ffc9e712381e 100644
--- a/pkgs/development/tools/database/liquibase/default.nix
+++ b/pkgs/development/tools/database/liquibase/default.nix
@@ -25,11 +25,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "liquibase";
-  version = "4.23.0";
+  version = "4.23.1";
 
   src = fetchurl {
     url = "https://github.com/liquibase/liquibase/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-mIuHNNo/L5h2RvpTN0jZt6ri+Il0H9aSL4auOjIepjU=";
+    hash = "sha256-uWZ9l6C6QlVHqp/ma6/sz07zuCHpGucy7GhNDq8v1/U=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From f08729990a9440aabd6aae817d90e61c208b2baa Mon Sep 17 00:00:00 2001
From: Matthias Beyer <mail@beyermatthias.de>
Date: Sun, 27 Aug 2023 11:03:51 +0200
Subject: [PATCH 22/52] kdash: 0.4.0 -> 0.4.2

Signed-off-by: Matthias Beyer <mail@beyermatthias.de>
---
 pkgs/development/tools/kdash/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/kdash/default.nix b/pkgs/development/tools/kdash/default.nix
index 9a95071bb480..0269598a3e90 100644
--- a/pkgs/development/tools/kdash/default.nix
+++ b/pkgs/development/tools/kdash/default.nix
@@ -12,13 +12,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kdash";
-  version = "0.4.0";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "kdash-rs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-U2Ne0wDgPkNZa68KbJ9Hke5l+tBAf7imu1Cj+r/uZUE=";
+    sha256 = "sha256-PjkRE4JWDxiDKpENN/yDnO45CegxLPov/EhxnUbmpOg=";
   };
 
   nativeBuildInputs = [ perl python3 pkg-config ];
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl xorg.xcbutil ]
     ++ lib.optional stdenv.isDarwin AppKit;
 
-  cargoHash = "sha256-dX5p+eLhZlU1Xg2SoqtEYb8T3/lvoJa78zgQStLPZNE=";
+  cargoHash = "sha256-nCFXhAaVrIkm6XOSa1cDCxukbf/CVmwPEu6gk7VybVQ=";
 
   meta = with lib; {
     description = "A simple and fast dashboard for Kubernetes";

From a424dacb8a50f08bef9dbe7eeaa309d8f8880d9a Mon Sep 17 00:00:00 2001
From: apfelkuchen06 <apfelkuchen@hrnz.li>
Date: Mon, 21 Aug 2023 22:41:53 +0200
Subject: [PATCH 23/52] texlive: move combinePkgs from default.nix to
 combine.nix

---
 pkgs/tools/typesetting/tex/texlive/combine.nix | 16 ++++++++++++++++
 pkgs/tools/typesetting/tex/texlive/default.nix | 18 +-----------------
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/pkgs/tools/typesetting/tex/texlive/combine.nix b/pkgs/tools/typesetting/tex/texlive/combine.nix
index 1821d1c090de..a39b9da2309e 100644
--- a/pkgs/tools/typesetting/tex/texlive/combine.nix
+++ b/pkgs/tools/typesetting/tex/texlive/combine.nix
@@ -8,6 +8,22 @@ args@{
 , ...
 }:
 let
+  # combine a set of TL packages into a single TL meta-package
+  combinePkgs = pkgList: lib.catAttrs "pkg" (
+    let
+      # a TeX package is an attribute set { pkgs = [ ... ]; ... } where pkgs is a list of derivations
+      # the derivations make up the TeX package and optionally (for backward compatibility) its dependencies
+      tlPkgToSets = { pkgs, ... }: map ({ tlType, version ? "", outputName ? "", ... }@pkg: {
+          # outputName required to distinguish among bin.core-big outputs
+          key = "${pkg.pname or pkg.name}.${tlType}-${version}-${outputName}";
+          inherit pkg;
+        }) pkgs;
+      pkgListToSets = lib.concatMap tlPkgToSets; in
+    builtins.genericClosure {
+      startSet = pkgListToSets pkgList;
+      operator = { pkg, ... }: pkgListToSets (pkg.tlDeps or []);
+    });
+
   pkgSet = removeAttrs args [ "pkgFilter" "extraName" "extraVersion" ];
   pkgList = rec {
     combined = combinePkgs (lib.attrValues pkgSet);
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index 90a65ab1405e..37b10f28b336 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -23,7 +23,7 @@ let
 
   # function for creating a working environment from a set of TL packages
   combine = import ./combine.nix {
-    inherit bin combinePkgs buildEnv lib makeWrapper writeText runCommand
+    inherit bin buildEnv lib makeWrapper writeText runCommand
       stdenv perl libfaketime makeFontsConf bash tl coreutils gawk gnugrep gnused;
     ghostscript = ghostscript_headless;
   };
@@ -492,22 +492,6 @@ let
       // lib.optionalAttrs (args ? deps) { deps = map (n: tl.${n}) (args.deps or [ ]); })
   ) overriddenTlpdb;
 
-  # combine a set of TL packages into a single TL meta-package
-  combinePkgs = pkgList: lib.catAttrs "pkg" (
-    let
-      # a TeX package is an attribute set { pkgs = [ ... ]; ... } where pkgs is a list of derivations
-      # the derivations make up the TeX package and optionally (for backward compatibility) its dependencies
-      tlPkgToSets = { pkgs, ... }: map ({ tlType, version ? "", outputName ? "", ... }@pkg: {
-          # outputName required to distinguish among bin.core-big outputs
-          key = "${pkg.pname or pkg.name}.${tlType}-${version}-${outputName}";
-          inherit pkg;
-        }) pkgs;
-      pkgListToSets = lib.concatMap tlPkgToSets; in
-    builtins.genericClosure {
-      startSet = pkgListToSets pkgList;
-      operator = { pkg, ... }: pkgListToSets (pkg.tlDeps or []);
-    });
-
   assertions = with lib;
     assertMsg (tlpdbVersion.year == version.texliveYear) "TeX Live year in texlive does not match tlpdb.nix, refusing to evaluate" &&
     assertMsg (tlpdbVersion.frozen == version.final) "TeX Live final status in texlive does not match tlpdb.nix, refusing to evaluate";

From 9155fec96b3f4c24f7742b5fd1015257e9458cef Mon Sep 17 00:00:00 2001
From: apfelkuchen06 <apfelkuchen@hrnz.li>
Date: Mon, 21 Aug 2023 22:41:53 +0200
Subject: [PATCH 24/52] texlive.combine: explicitly list params

This prepares the use of callPackage (to avoid repeating the parameter names all
over the place) and makes static analysis possible
---
 pkgs/tools/typesetting/tex/texlive/combine.nix | 4 +++-
 pkgs/tools/typesetting/tex/texlive/default.nix | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/typesetting/tex/texlive/combine.nix b/pkgs/tools/typesetting/tex/texlive/combine.nix
index a39b9da2309e..8a3265727168 100644
--- a/pkgs/tools/typesetting/tex/texlive/combine.nix
+++ b/pkgs/tools/typesetting/tex/texlive/combine.nix
@@ -1,4 +1,6 @@
-params: with params;
+{ lib, buildEnv, runCommand, writeText, makeWrapper, libfaketime, makeFontsConf
+, perl, bash, coreutils, gnused, gnugrep, gawk, ghostscript
+, bin, tl }:
 # combine =
 args@{
   pkgFilter ? (pkg: pkg.tlType == "run" || pkg.tlType == "bin" || pkg.pname == "core"
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index 37b10f28b336..466d58bf5372 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -24,7 +24,7 @@ let
   # function for creating a working environment from a set of TL packages
   combine = import ./combine.nix {
     inherit bin buildEnv lib makeWrapper writeText runCommand
-      stdenv perl libfaketime makeFontsConf bash tl coreutils gawk gnugrep gnused;
+      perl libfaketime makeFontsConf bash tl coreutils gawk gnugrep gnused;
     ghostscript = ghostscript_headless;
   };
 

From babce2f26a756aac6017b15a06af8cfb30219875 Mon Sep 17 00:00:00 2001
From: apfelkuchen06 <apfelkuchen@hrnz.li>
Date: Mon, 21 Aug 2023 22:41:53 +0200
Subject: [PATCH 25/52] texlive: factor out tlpdb overrides

---
 .../tools/typesetting/tex/texlive/default.nix | 408 +----------------
 .../tex/texlive/tlpdb-overrides.nix           | 411 ++++++++++++++++++
 2 files changed, 419 insertions(+), 400 deletions(-)
 create mode 100644 pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix

diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index 466d58bf5372..96bc6f61e4f0 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -34,406 +34,14 @@ let
 
   # the set of TeX Live packages, collections, and schemes; using upstream naming
   overriddenTlpdb = let
-    # most format -> engine links are generated by texlinks according to fmtutil.cnf at combine time
-    # so we remove them from binfiles, and add back the ones texlinks purposefully ignore (e.g. mptopdf)
-    removeFormatLinks = lib.mapAttrs (_: attrs:
-      if (attrs ? formats && attrs ? binfiles)
-      then let formatLinks = lib.catAttrs "name" (lib.filter (f: f.name != f.engine) attrs.formats);
-               binNotFormats = lib.subtractLists formatLinks attrs.binfiles;
-           in if binNotFormats != [] then attrs // { binfiles = binNotFormats; } else removeAttrs attrs [ "binfiles" ]
-      else attrs);
-
-    orig = removeFormatLinks (removeAttrs tlpdb [ "00texlive.config" ]); in
-
-    lib.recursiveUpdate orig rec {
-      #### overrides of texlive.tlpdb
-
-      #### nonstandard script folders
-      context.scriptsFolder = "context/stubs/unix";
-      cyrillic-bin.scriptsFolder = "texlive-extra";
-      fontinst.scriptsFolder = "texlive-extra";
-      mptopdf.scriptsFolder = "context/perl";
-      pdftex.scriptsFolder = "simpdftex";
-      texlive-scripts.scriptsFolder = "texlive";
-      texlive-scripts-extra.scriptsFolder = "texlive-extra";
-      xetex.scriptsFolder = "texlive-extra";
-
-      #### interpreters not detected by looking at the script extensions
-      ctanbib.extraBuildInputs = [ bin.luatex ];
-      de-macro.extraBuildInputs = [ python3 ];
-      match_parens.extraBuildInputs = [ ruby ];
-      optexcount.extraBuildInputs = [ python3 ];
-      pdfbook2.extraBuildInputs = [ python3 ];
-      texlogsieve.extraBuildInputs = [ bin.luatex ];
-
-      #### perl packages
-      crossrefware.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ LWP URI ])) ];
-      ctan-o-mat.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ LWP LWPProtocolHttps ])) ];
-      ctanify.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ FileCopyRecursive ])) ];
-      ctanupload.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ HTMLFormatter WWWMechanize ])) ];
-      exceltex.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ SpreadsheetParseExcel ])) ];
-      latex-git-log.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ IPCSystemSimple ])) ];
-      latexindent.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ FileHomeDir LogDispatch LogLog4perl UnicodeLineBreak YAMLTiny ])) ];
-      pax.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ FileWhich ])) ];
-      ptex-fontmaps.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ Tk ])) ];
-      purifyeps.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ FileWhich ])) ];
-      svn-multi.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ TimeDate ])) ];
-      texdoctk.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ Tk ])) ];
-      ulqda.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ DigestSHA1 ])) ];
-
-      #### python packages
-      pythontex.extraBuildInputs = [ (python3.withPackages (ps: with ps; [ pygments ])) ];
-
-      #### other runtime PATH dependencies
-      a2ping.extraBuildInputs = [ ghostscript_headless ];
-      bibexport.extraBuildInputs = [ gnugrep ];
-      checklistings.extraBuildInputs = [ coreutils ];
-      cjk-gs-integrate.extraBuildInputs = [ ghostscript_headless ];
-      context.extraBuildInputs = [ coreutils ruby ];
-      cyrillic-bin.extraBuildInputs = [ coreutils gnused ];
-      dtxgen.extraBuildInputs = [ coreutils getopt gnumake zip ];
-      dviljk.extraBuildInputs = [ coreutils ];
-      epspdf.extraBuildInputs = [ ghostscript_headless ];
-      epstopdf.extraBuildInputs = [ ghostscript_headless ];
-      fragmaster.extraBuildInputs = [ ghostscript_headless ];
-      installfont.extraBuildInputs = [ coreutils getopt gnused ];
-      latexfileversion.extraBuildInputs = [ coreutils gnugrep gnused ];
-      listings-ext.extraBuildInputs = [ coreutils getopt ];
-      ltxfileinfo.extraBuildInputs = [ coreutils getopt gnused ];
-      ltximg.extraBuildInputs = [ ghostscript_headless ];
-      luaotfload.extraBuildInputs = [ ncurses ];
-      makeindex.extraBuildInputs = [ coreutils gnused ];
-      pagelayout.extraBuildInputs = [ gnused ncurses ];
-      pdfcrop.extraBuildInputs = [ ghostscript_headless ];
-      pdftex.extraBuildInputs = [ coreutils ghostscript_headless gnused ];
-      pdftex-quiet.extraBuildInputs = [ coreutils ];
-      pdfxup.extraBuildInputs = [ coreutils ghostscript_headless ];
-      pkfix-helper.extraBuildInputs = [ ghostscript_headless ];
-      ps2eps.extraBuildInputs = [ ghostscript_headless ];
-      pst2pdf.extraBuildInputs = [ ghostscript_headless ];
-      tex4ht.extraBuildInputs = [ ruby ];
-      texlive-scripts.extraBuildInputs = [ gnused ];
-      texlive-scripts-extra.extraBuildInputs = [ coreutils findutils ghostscript_headless gnused ];
-      thumbpdf.extraBuildInputs = [ ghostscript_headless ];
-      tpic2pdftex.extraBuildInputs = [ gawk ];
-      wordcount.extraBuildInputs = [ coreutils gnugrep ];
-      xdvi.extraBuildInputs = [ coreutils gnugrep ];
-      xindy.extraBuildInputs = [ gzip ];
-
-      #### adjustments to binaries
-      # TODO patch the scripts from bin.* directly in bin.* instead of here
-
-      # mptopdf is a format link, but not generated by texlinks
-      # so we add it back to binfiles to generate it from mkPkgBin
-      mptopdf.binfiles = (orig.mptopdf.binfiles or []) ++ [ "mptopdf" ];
-
-      # remove man
-      texlive-scripts.binfiles = lib.remove "man" orig.texlive-scripts.binfiles;
-
-      # upmendex is "TODO" in bin.nix
-      uptex.binfiles = lib.remove "upmendex" orig.uptex.binfiles;
-
-      # xindy is broken on some platforms unfortunately
-      xindy.binfiles = if bin ? xindy
-        then lib.subtractLists [ "xindy.mem" "xindy.run" ] orig.xindy.binfiles
-        else [];
-
-      #### additional symlinks
-      cluttex.binlinks = {
-        cllualatex = "cluttex";
-        clxelatex = "cluttex";
-      };
-
-      epstopdf.binlinks.repstopdf = "epstopdf";
-      pdfcrop.binlinks.rpdfcrop = "pdfcrop";
-
-      ptex.binlinks = {
-        pdvitomp = bin.metapost + "/bin/pdvitomp";
-        pmpost = bin.metapost + "/bin/pmpost";
-        r-pmpost = bin.metapost + "/bin/r-pmpost";
-      };
-
-      texdef.binlinks = {
-        latexdef = "texdef";
-      };
-
-      texlive-scripts.binlinks = {
-        mktexfmt = "fmtutil";
-        texhash = (lib.last tl."texlive.infra".pkgs) + "/bin/mktexlsr";
-      };
-
-      texlive-scripts-extra.binlinks = {
-        allec = "allcm";
-        kpsepath = "kpsetool";
-        kpsexpand = "kpsetool";
-      };
-
-      # metapost binaries are in bin.metapost instead of bin.core
-      uptex.binlinks = {
-        r-upmpost = bin.metapost + "/bin/r-upmpost";
-        updvitomp = bin.metapost + "/bin/updvitomp";
-        upmpost = bin.metapost + "/bin/upmpost";
-      };
-
-      #### add PATH dependencies without wrappers
-      # TODO deduplicate this code
-      a2ping.postFixup = ''
-        sed -i '6i$ENV{PATH}='"'"'${lib.makeBinPath a2ping.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/a2ping
-      '';
-
-      bibexport.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath bibexport.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/bibexport
-      '';
-
-      checklistings.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath checklistings.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/checklistings
-      '';
-
-      cjk-gs-integrate.postFixup = ''
-        sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath cjk-gs-integrate.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/cjk-gs-integrate
-      '';
-
-      context.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath [ coreutils ]}''${PATH:+:$PATH}"' "$out"/bin/{contextjit,mtxrunjit}
-        sed -i '2iPATH="${lib.makeBinPath [ ruby ]}''${PATH:+:$PATH}"' "$out"/bin/texexec
-      '';
-
-      cyrillic-bin.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath cyrillic-bin.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/rumakeindex
-      '';
-
-      dtxgen.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath dtxgen.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/dtxgen
-      '';
-
-      dviljk.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath dviljk.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/dvihp
-      '';
-
-      epstopdf.postFixup = ''
-        sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath epstopdf.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/epstopdf
-      '';
-
-      fragmaster.postFixup = ''
-        sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath fragmaster.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/fragmaster
-      '';
-
-      installfont.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath installfont.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/installfont-tl
-      '';
-
-      latexfileversion.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath latexfileversion.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/latexfileversion
-      '';
-
-      listings-ext.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath listings-ext.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/listings-ext.sh
-      '';
-
-      ltxfileinfo.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath ltxfileinfo.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/ltxfileinfo
-      '';
-
-      ltximg.postFixup = ''
-        sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath ltximg.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/ltximg
-      '';
-
-      luaotfload.postFixup = ''
-        sed -i '2ios.setenv("PATH","${lib.makeBinPath luaotfload.extraBuildInputs}" .. (os.getenv("PATH") and ":" .. os.getenv("PATH") or ""))' "$out"/bin/luaotfload-tool
-      '';
-
-      makeindex.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath makeindex.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/mkindex
-      '';
-
-      pagelayout.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath [ gnused ]}''${PATH:+:$PATH}"' "$out"/bin/pagelayoutapi
-        sed -i '2iPATH="${lib.makeBinPath [ ncurses ]}''${PATH:+:$PATH}"' "$out"/bin/textestvis
-      '';
-
-      pdfcrop.postFixup = ''
-        sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath pdfcrop.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/pdfcrop
-      '';
-
-      pdftex.postFixup = ''
-        sed -i -e '2iPATH="${lib.makeBinPath [ coreutils gnused ]}''${PATH:+:$PATH}"' \
-          -e 's!^distillerpath="/usr/local/bin"$!distillerpath="${lib.makeBinPath [ ghostscript_headless ]}"!' \
-          "$out"/bin/simpdftex
-      '';
-
-      pdftex-quiet.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath pdftex-quiet.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/pdftex-quiet
-      '';
-
-      pdfxup.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath pdfxup.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/pdfxup
-      '';
-
-      pkfix-helper.postFixup = ''
-        sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath pkfix-helper.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/pkfix-helper
-      '';
-
-      ps2eps.postFixup = ''
-        sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath ps2eps.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/ps2eps
-      '';
-
-      pst2pdf.postFixup = ''
-        sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath pst2pdf.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/pst2pdf
-      '';
-
-      tex4ht.postFixup = ''
-        sed -i -e '2iPATH="${lib.makeBinPath tex4ht.extraBuildInputs}''${PATH:+:$PATH}"' -e 's/\\rubyCall//g;' "$out"/bin/htcontext
-      '';
-
-      texlive-scripts.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath texlive-scripts.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/{fmtutil-user,mktexmf,mktexpk,mktextfm,updmap-user}
-      '';
-
-      thumbpdf.postFixup = ''
-        sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath thumbpdf.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/thumbpdf
-      '';
-
-      tpic2pdftex.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath tpic2pdftex.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/tpic2pdftex
-      '';
-
-      wordcount.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath wordcount.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/wordcount
-      '';
-
-      # TODO patch in bin.xdvi
-      xdvi.postFixup = ''
-        sed -i '2iPATH="${lib.makeBinPath xdvi.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/xdvi
-      '';
-
-      xindy.postFixup = ''
-        sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath xindy.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/{texindy,xindy}
-      '';
-
-      #### other script fixes
-      # misc tab and python3 fixes
-      ebong.postFixup = ''
-        sed -Ei 's/import sre/import re/; s/file\(/open(/g; s/\t/        /g; s/print +(.*)$/print(\1)/g' "$out"/bin/ebong
-      '';
-
-      # find files in script directory, not binary directory
-      # add runtime dependencies to PATH
-      epspdf.postFixup = ''
-        sed -i '2ios.setenv("PATH","${lib.makeBinPath epspdf.extraBuildInputs}" .. (os.getenv("PATH") and ":" .. os.getenv("PATH") or ""))' "$out"/bin/epspdf
-        substituteInPlace "$out"/bin/epspdftk --replace '[info script]' "\"$scriptsFolder/epspdftk.tcl\""
-      '';
-
-      # find files in script directory, not in binary directory
-      latexindent.postFixup = ''
-        substituteInPlace "$out"/bin/latexindent --replace 'use FindBin;' "BEGIN { \$0 = '$scriptsFolder' . '/latexindent.pl'; }; use FindBin;"
-      '';
-
-      # Patch texlinks.sh back to 2015 version;
-      # otherwise some bin/ links break, e.g. xe(la)tex.
-      # add runtime dependencies to PATH
-      texlive-scripts-extra.postFixup = ''
-        patch -R "$out"/bin/texlinks < '${./texlinks.diff}'
-        sed -i '2iPATH="${lib.makeBinPath [ coreutils ]}''${PATH:+:$PATH}"' "$out"/bin/{allcm,dvired,mkocp,ps2frag}
-        sed -i '2iPATH="${lib.makeBinPath [ coreutils findutils ]}''${PATH:+:$PATH}"' "$out"/bin/allneeded
-        sed -i '2iPATH="${lib.makeBinPath [ coreutils ghostscript_headless ]}''${PATH:+:$PATH}"' "$out"/bin/dvi2fax
-        sed -i '2iPATH="${lib.makeBinPath [ gnused ]}''${PATH:+:$PATH}"' "$out"/bin/{kpsetool,texconfig,texconfig-sys}
-        sed -i '2iPATH="${lib.makeBinPath [ coreutils gnused ]}''${PATH:+:$PATH}"' "$out"/bin/texconfig-dialog
-      '';
-
-      # patch interpreter
-      texosquery.postFixup = ''
-        substituteInPlace "$out"/bin/* --replace java "$interpJava"
-      '';
-
-      # hardcode revision numbers (since texlive.infra, tlshell are not in either system or user texlive.tlpdb)
-      tlshell.postFixup = ''
-        substituteInPlace "$out"/bin/tlshell \
-          --replace '[dict get $::pkgs texlive.infra localrev]' '${toString orig."texlive.infra".revision}' \
-          --replace '[dict get $::pkgs tlshell localrev]' '${toString orig.tlshell.revision}'
-      '';
-      #### dependency changes
-
-      # it seems to need it to transform fonts
-      xdvi.deps = (orig.xdvi.deps or []) ++  [ "metafont" ];
-
-      # remove dependency-heavy packages from the basic collections
-      collection-basic.deps = lib.subtractLists [ "metafont" "xdvi" ] orig.collection-basic.deps;
-
-      # add them elsewhere so that collections cover all packages
-      collection-metapost.deps = orig.collection-metapost.deps ++ [ "metafont" ];
-      collection-plaingeneric.deps = orig.collection-plaingeneric.deps ++ [ "xdvi" ];
-
-      #### misc
-
-      # tlpdb lists license as "unknown", but the README says lppl13: http://mirrors.ctan.org/language/arabic/arabi-add/README
-      arabi-add.license = [  "lppl13c" ];
-
-      # TODO: remove this when updating to texlive-2023, npp-for-context is no longer in texlive
-      # tlpdb lists license as "noinfo", but it's gpl3: https://github.com/luigiScarso/context-npp
-      npp-for-context.license = [  "gpl3Only" ];
-
-      texdoc = {
-        extraRevision = "-tlpdb${toString tlpdbVersion.revision}";
-        extraVersion = "-tlpdb-${toString tlpdbVersion.revision}";
-
-        extraNativeBuildInputs = [ installShellFiles ];
-
-        # build Data.tlpdb.lua (part of the 'tlType == "run"' package)
-        postUnpack = ''
-          if [[ -f "$out"/scripts/texdoc/texdoc.tlu ]]; then
-            unxz --stdout "${tlpdbxz}" > texlive.tlpdb
-
-            # create dummy doc file to ensure that texdoc does not return an error
-            mkdir -p support/texdoc
-            touch support/texdoc/NEWS
-
-            TEXMFCNF="${bin.core}"/share/texmf-dist/web2c TEXMF="$out" TEXDOCS=. TEXMFVAR=. \
-              "${bin.luatex}"/bin/texlua "$out"/scripts/texdoc/texdoc.tlu \
-              -c texlive_tlpdb=texlive.tlpdb -lM texdoc
-
-            cp texdoc/cache-tlpdb.lua "$out"/scripts/texdoc/Data.tlpdb.lua
-          fi
-        '';
-
-        # install zsh completion
-        postFixup = ''
-          TEXMFCNF="${bin.core}"/share/texmf-dist/web2c TEXMF="$scriptsFolder/../.." \
-            texlua "$out"/bin/texdoc --print-completion zsh > "$TMPDIR"/_texdoc
-          substituteInPlace "$TMPDIR"/_texdoc \
-            --replace 'compdef __texdoc texdoc' '#compdef texdoc' \
-            --replace '$(kpsewhich -var-value TEXMFROOT)/tlpkg/texlive.tlpdb' '$(kpsewhich Data.tlpdb.lua)' \
-            --replace '/^name[^.]*$/ {print $2}' '/^  \["[^"]*"\] = {$/ { print substr($1,3,length($1)-4) }'
-          echo '__texdoc' >> "$TMPDIR"/_texdoc
-          installShellCompletion --zsh "$TMPDIR"/_texdoc
-        '';
-      };
-
-      "texlive.infra" = {
-        extraRevision = ".tlpdb${toString tlpdbVersion.revision}";
-        extraVersion = "-tlpdb-${toString tlpdbVersion.revision}";
-
-        # add license of tlmgr and TeXLive::* perl packages and of bin.core
-        license = [ "gpl2Plus" ] ++ lib.toList bin.core.meta.license.shortName ++ orig."texlive.infra".license or [ ];
-
-        scriptsFolder = "texlive";
-        extraBuildInputs = [ coreutils gnused gnupg (lib.last tl.kpathsea.pkgs) (perl.withPackages (ps: with ps; [ Tk ])) ];
-
-        # make tlmgr believe it can use kpsewhich to evaluate TEXMFROOT
-        postFixup = ''
-          substituteInPlace "$out"/bin/tlmgr \
-            --replace 'if (-r "$bindir/$kpsewhichname")' 'if (1)'
-          sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath [ gnupg ]}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/tlmgr
-          sed -i '2iPATH="${lib.makeBinPath [ coreutils gnused (lib.last tl.kpathsea.pkgs) ]}''${PATH:+:$PATH}"' "$out"/bin/mktexlsr
-        '';
-
-        # add minimal texlive.tlpdb
-        postUnpack = ''
-          if [[ "$tlType" == "tlpkg" ]] ; then
-            xzcat "${tlpdbxz}" | sed -n -e '/^name \(00texlive.config\|00texlive.installation\)$/,/^$/p' > "$out"/texlive.tlpdb
-          fi
-        '';
-      };
-    }; # overrides
+    overrides = import ./tlpdb-overrides.nix {
+      inherit
+        lib bin tlpdb tlpdbxz tl
+        installShellFiles
+        coreutils findutils gawk getopt ghostscript_headless gnugrep
+        gnumake gnupg gnused gzip ncurses perl python3 ruby zip;
+    };
+  in overrides tlpdb;
 
   version = {
     # day of the snapshot being taken
diff --git a/pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix b/pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix
new file mode 100644
index 000000000000..4d2ce46ed475
--- /dev/null
+++ b/pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix
@@ -0,0 +1,411 @@
+{ lib, tlpdb, bin, tlpdbxz, tl
+, installShellFiles
+, coreutils, findutils, gawk, getopt, ghostscript_headless, gnugrep
+, gnumake, gnupg, gnused, gzip, ncurses, perl, python3, ruby, zip
+}:
+
+oldTlpdb:
+
+let
+  tlpdbVersion = tlpdb."00texlive.config";
+
+    # most format -> engine links are generated by texlinks according to fmtutil.cnf at combine time
+    # so we remove them from binfiles, and add back the ones texlinks purposefully ignore (e.g. mptopdf)
+    removeFormatLinks = lib.mapAttrs (_: attrs:
+      if (attrs ? formats && attrs ? binfiles)
+      then let formatLinks = lib.catAttrs "name" (lib.filter (f: f.name != f.engine) attrs.formats);
+               binNotFormats = lib.subtractLists formatLinks attrs.binfiles;
+           in if binNotFormats != [] then attrs // { binfiles = binNotFormats; } else removeAttrs attrs [ "binfiles" ]
+      else attrs);
+
+    orig = removeFormatLinks (removeAttrs oldTlpdb [ "00texlive.config" ]);
+
+in lib.recursiveUpdate orig rec {
+  #### overrides of texlive.tlpdb
+
+  #### nonstandard script folders
+  context.scriptsFolder = "context/stubs/unix";
+  cyrillic-bin.scriptsFolder = "texlive-extra";
+  fontinst.scriptsFolder = "texlive-extra";
+  mptopdf.scriptsFolder = "context/perl";
+  pdftex.scriptsFolder = "simpdftex";
+  texlive-scripts.scriptsFolder = "texlive";
+  texlive-scripts-extra.scriptsFolder = "texlive-extra";
+  xetex.scriptsFolder = "texlive-extra";
+
+  #### interpreters not detected by looking at the script extensions
+  ctanbib.extraBuildInputs = [ bin.luatex ];
+  de-macro.extraBuildInputs = [ python3 ];
+  match_parens.extraBuildInputs = [ ruby ];
+  optexcount.extraBuildInputs = [ python3 ];
+  pdfbook2.extraBuildInputs = [ python3 ];
+  texlogsieve.extraBuildInputs = [ bin.luatex ];
+
+  #### perl packages
+  crossrefware.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ LWP URI ])) ];
+  ctan-o-mat.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ LWP LWPProtocolHttps ])) ];
+  ctanify.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ FileCopyRecursive ])) ];
+  ctanupload.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ HTMLFormatter WWWMechanize ])) ];
+  exceltex.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ SpreadsheetParseExcel ])) ];
+  latex-git-log.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ IPCSystemSimple ])) ];
+  latexindent.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ FileHomeDir LogDispatch LogLog4perl UnicodeLineBreak YAMLTiny ])) ];
+  pax.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ FileWhich ])) ];
+  ptex-fontmaps.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ Tk ])) ];
+  purifyeps.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ FileWhich ])) ];
+  svn-multi.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ TimeDate ])) ];
+  texdoctk.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ Tk ])) ];
+  ulqda.extraBuildInputs = [ (perl.withPackages (ps: with ps; [ DigestSHA1 ])) ];
+
+  #### python packages
+  pythontex.extraBuildInputs = [ (python3.withPackages (ps: with ps; [ pygments ])) ];
+
+  #### other runtime PATH dependencies
+  a2ping.extraBuildInputs = [ ghostscript_headless ];
+  bibexport.extraBuildInputs = [ gnugrep ];
+  checklistings.extraBuildInputs = [ coreutils ];
+  cjk-gs-integrate.extraBuildInputs = [ ghostscript_headless ];
+  context.extraBuildInputs = [ coreutils ruby ];
+  cyrillic-bin.extraBuildInputs = [ coreutils gnused ];
+  dtxgen.extraBuildInputs = [ coreutils getopt gnumake zip ];
+  dviljk.extraBuildInputs = [ coreutils ];
+  epspdf.extraBuildInputs = [ ghostscript_headless ];
+  epstopdf.extraBuildInputs = [ ghostscript_headless ];
+  fragmaster.extraBuildInputs = [ ghostscript_headless ];
+  installfont.extraBuildInputs = [ coreutils getopt gnused ];
+  latexfileversion.extraBuildInputs = [ coreutils gnugrep gnused ];
+  listings-ext.extraBuildInputs = [ coreutils getopt ];
+  ltxfileinfo.extraBuildInputs = [ coreutils getopt gnused ];
+  ltximg.extraBuildInputs = [ ghostscript_headless ];
+  luaotfload.extraBuildInputs = [ ncurses ];
+  makeindex.extraBuildInputs = [ coreutils gnused ];
+  pagelayout.extraBuildInputs = [ gnused ncurses ];
+  pdfcrop.extraBuildInputs = [ ghostscript_headless ];
+  pdftex.extraBuildInputs = [ coreutils ghostscript_headless gnused ];
+  pdftex-quiet.extraBuildInputs = [ coreutils ];
+  pdfxup.extraBuildInputs = [ coreutils ghostscript_headless ];
+  pkfix-helper.extraBuildInputs = [ ghostscript_headless ];
+  ps2eps.extraBuildInputs = [ ghostscript_headless ];
+  pst2pdf.extraBuildInputs = [ ghostscript_headless ];
+  tex4ht.extraBuildInputs = [ ruby ];
+  texlive-scripts.extraBuildInputs = [ gnused ];
+  texlive-scripts-extra.extraBuildInputs = [ coreutils findutils ghostscript_headless gnused ];
+  thumbpdf.extraBuildInputs = [ ghostscript_headless ];
+  tpic2pdftex.extraBuildInputs = [ gawk ];
+  wordcount.extraBuildInputs = [ coreutils gnugrep ];
+  xdvi.extraBuildInputs = [ coreutils gnugrep ];
+  xindy.extraBuildInputs = [ gzip ];
+
+  #### adjustments to binaries
+  # TODO patch the scripts from bin.* directly in bin.* instead of here
+
+  # mptopdf is a format link, but not generated by texlinks
+  # so we add it back to binfiles to generate it from mkPkgBin
+  mptopdf.binfiles = (orig.mptopdf.binfiles or []) ++ [ "mptopdf" ];
+
+  # remove man
+  texlive-scripts.binfiles = lib.remove "man" orig.texlive-scripts.binfiles;
+
+  # upmendex is "TODO" in bin.nix
+  uptex.binfiles = lib.remove "upmendex" orig.uptex.binfiles;
+
+  # xindy is broken on some platforms unfortunately
+  xindy.binfiles = if bin ? xindy
+    then lib.subtractLists [ "xindy.mem" "xindy.run" ] orig.xindy.binfiles
+    else [];
+
+  #### additional symlinks
+  cluttex.binlinks = {
+    cllualatex = "cluttex";
+    clxelatex = "cluttex";
+  };
+
+  epstopdf.binlinks.repstopdf = "epstopdf";
+  pdfcrop.binlinks.rpdfcrop = "pdfcrop";
+
+  ptex.binlinks = {
+    pdvitomp = bin.metapost + "/bin/pdvitomp";
+    pmpost = bin.metapost + "/bin/pmpost";
+    r-pmpost = bin.metapost + "/bin/r-pmpost";
+  };
+
+  texdef.binlinks = {
+    latexdef = "texdef";
+  };
+
+  texlive-scripts.binlinks = {
+    mktexfmt = "fmtutil";
+    texhash = (lib.last tl."texlive.infra".pkgs) + "/bin/mktexlsr";
+  };
+
+  texlive-scripts-extra.binlinks = {
+    allec = "allcm";
+    kpsepath = "kpsetool";
+    kpsexpand = "kpsetool";
+  };
+
+  # metapost binaries are in bin.metapost instead of bin.core
+  uptex.binlinks = {
+    r-upmpost = bin.metapost + "/bin/r-upmpost";
+    updvitomp = bin.metapost + "/bin/updvitomp";
+    upmpost = bin.metapost + "/bin/upmpost";
+  };
+
+  #### add PATH dependencies without wrappers
+  # TODO deduplicate this code
+  a2ping.postFixup = ''
+    sed -i '6i$ENV{PATH}='"'"'${lib.makeBinPath a2ping.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/a2ping
+  '';
+
+  bibexport.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath bibexport.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/bibexport
+  '';
+
+  checklistings.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath checklistings.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/checklistings
+  '';
+
+  cjk-gs-integrate.postFixup = ''
+    sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath cjk-gs-integrate.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/cjk-gs-integrate
+  '';
+
+  context.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath [ coreutils ]}''${PATH:+:$PATH}"' "$out"/bin/{contextjit,mtxrunjit}
+    sed -i '2iPATH="${lib.makeBinPath [ ruby ]}''${PATH:+:$PATH}"' "$out"/bin/texexec
+  '';
+
+  cyrillic-bin.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath cyrillic-bin.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/rumakeindex
+  '';
+
+  dtxgen.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath dtxgen.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/dtxgen
+  '';
+
+  dviljk.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath dviljk.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/dvihp
+  '';
+
+  epstopdf.postFixup = ''
+    sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath epstopdf.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/epstopdf
+  '';
+
+  fragmaster.postFixup = ''
+    sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath fragmaster.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/fragmaster
+  '';
+
+  installfont.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath installfont.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/installfont-tl
+  '';
+
+  latexfileversion.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath latexfileversion.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/latexfileversion
+  '';
+
+  listings-ext.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath listings-ext.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/listings-ext.sh
+  '';
+
+  ltxfileinfo.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath ltxfileinfo.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/ltxfileinfo
+  '';
+
+  ltximg.postFixup = ''
+    sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath ltximg.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/ltximg
+  '';
+
+  luaotfload.postFixup = ''
+    sed -i '2ios.setenv("PATH","${lib.makeBinPath luaotfload.extraBuildInputs}" .. (os.getenv("PATH") and ":" .. os.getenv("PATH") or ""))' "$out"/bin/luaotfload-tool
+  '';
+
+  makeindex.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath makeindex.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/mkindex
+  '';
+
+  pagelayout.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath [ gnused ]}''${PATH:+:$PATH}"' "$out"/bin/pagelayoutapi
+    sed -i '2iPATH="${lib.makeBinPath [ ncurses ]}''${PATH:+:$PATH}"' "$out"/bin/textestvis
+  '';
+
+  pdfcrop.postFixup = ''
+    sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath pdfcrop.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/pdfcrop
+  '';
+
+  pdftex.postFixup = ''
+    sed -i -e '2iPATH="${lib.makeBinPath [ coreutils gnused ]}''${PATH:+:$PATH}"' \
+      -e 's!^distillerpath="/usr/local/bin"$!distillerpath="${lib.makeBinPath [ ghostscript_headless ]}"!' \
+      "$out"/bin/simpdftex
+  '';
+
+  pdftex-quiet.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath pdftex-quiet.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/pdftex-quiet
+  '';
+
+  pdfxup.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath pdfxup.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/pdfxup
+  '';
+
+  pkfix-helper.postFixup = ''
+    sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath pkfix-helper.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/pkfix-helper
+  '';
+
+  ps2eps.postFixup = ''
+    sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath ps2eps.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/ps2eps
+  '';
+
+  pst2pdf.postFixup = ''
+    sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath pst2pdf.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/pst2pdf
+  '';
+
+  tex4ht.postFixup = ''
+    sed -i -e '2iPATH="${lib.makeBinPath tex4ht.extraBuildInputs}''${PATH:+:$PATH}"' -e 's/\\rubyCall//g;' "$out"/bin/htcontext
+  '';
+
+  texlive-scripts.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath texlive-scripts.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/{fmtutil-user,mktexmf,mktexpk,mktextfm,updmap-user}
+  '';
+
+  thumbpdf.postFixup = ''
+    sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath thumbpdf.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/thumbpdf
+  '';
+
+  tpic2pdftex.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath tpic2pdftex.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/tpic2pdftex
+  '';
+
+  wordcount.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath wordcount.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/wordcount
+  '';
+
+  # TODO patch in bin.xdvi
+  xdvi.postFixup = ''
+    sed -i '2iPATH="${lib.makeBinPath xdvi.extraBuildInputs}''${PATH:+:$PATH}"' "$out"/bin/xdvi
+  '';
+
+  xindy.postFixup = ''
+    sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath xindy.extraBuildInputs}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/{texindy,xindy}
+  '';
+
+  #### other script fixes
+  # misc tab and python3 fixes
+  ebong.postFixup = ''
+    sed -Ei 's/import sre/import re/; s/file\(/open(/g; s/\t/        /g; s/print +(.*)$/print(\1)/g' "$out"/bin/ebong
+  '';
+
+  # find files in script directory, not binary directory
+  # add runtime dependencies to PATH
+  epspdf.postFixup = ''
+    sed -i '2ios.setenv("PATH","${lib.makeBinPath epspdf.extraBuildInputs}" .. (os.getenv("PATH") and ":" .. os.getenv("PATH") or ""))' "$out"/bin/epspdf
+    substituteInPlace "$out"/bin/epspdftk --replace '[info script]' "\"$scriptsFolder/epspdftk.tcl\""
+  '';
+
+  # find files in script directory, not in binary directory
+  latexindent.postFixup = ''
+    substituteInPlace "$out"/bin/latexindent --replace 'use FindBin;' "BEGIN { \$0 = '$scriptsFolder' . '/latexindent.pl'; }; use FindBin;"
+  '';
+
+  # Patch texlinks.sh back to 2015 version;
+  # otherwise some bin/ links break, e.g. xe(la)tex.
+  # add runtime dependencies to PATH
+  texlive-scripts-extra.postFixup = ''
+    patch -R "$out"/bin/texlinks < '${./texlinks.diff}'
+    sed -i '2iPATH="${lib.makeBinPath [ coreutils ]}''${PATH:+:$PATH}"' "$out"/bin/{allcm,dvired,mkocp,ps2frag}
+    sed -i '2iPATH="${lib.makeBinPath [ coreutils findutils ]}''${PATH:+:$PATH}"' "$out"/bin/allneeded
+    sed -i '2iPATH="${lib.makeBinPath [ coreutils ghostscript_headless ]}''${PATH:+:$PATH}"' "$out"/bin/dvi2fax
+    sed -i '2iPATH="${lib.makeBinPath [ gnused ]}''${PATH:+:$PATH}"' "$out"/bin/{kpsetool,texconfig,texconfig-sys}
+    sed -i '2iPATH="${lib.makeBinPath [ coreutils gnused ]}''${PATH:+:$PATH}"' "$out"/bin/texconfig-dialog
+  '';
+
+  # patch interpreter
+  texosquery.postFixup = ''
+    substituteInPlace "$out"/bin/* --replace java "$interpJava"
+  '';
+
+  # hardcode revision numbers (since texlive.infra, tlshell are not in either system or user texlive.tlpdb)
+  tlshell.postFixup = ''
+    substituteInPlace "$out"/bin/tlshell \
+      --replace '[dict get $::pkgs texlive.infra localrev]' '${toString orig."texlive.infra".revision}' \
+      --replace '[dict get $::pkgs tlshell localrev]' '${toString orig.tlshell.revision}'
+  '';
+  #### dependency changes
+
+  # it seems to need it to transform fonts
+  xdvi.deps = (orig.xdvi.deps or []) ++  [ "metafont" ];
+
+  # remove dependency-heavy packages from the basic collections
+  collection-basic.deps = lib.subtractLists [ "metafont" "xdvi" ] orig.collection-basic.deps;
+
+  # add them elsewhere so that collections cover all packages
+  collection-metapost.deps = orig.collection-metapost.deps ++ [ "metafont" ];
+  collection-plaingeneric.deps = orig.collection-plaingeneric.deps ++ [ "xdvi" ];
+
+  #### misc
+
+  # tlpdb lists license as "unknown", but the README says lppl13: http://mirrors.ctan.org/language/arabic/arabi-add/README
+  arabi-add.license = [  "lppl13c" ];
+
+  # TODO: remove this when updating to texlive-2023, npp-for-context is no longer in texlive
+  # tlpdb lists license as "noinfo", but it's gpl3: https://github.com/luigiScarso/context-npp
+  npp-for-context.license = [  "gpl3Only" ];
+
+  texdoc = {
+    extraRevision = "-tlpdb${toString tlpdbVersion.revision}";
+    extraVersion = "-tlpdb-${toString tlpdbVersion.revision}";
+
+    extraNativeBuildInputs = [ installShellFiles ];
+
+    # build Data.tlpdb.lua (part of the 'tlType == "run"' package)
+    postUnpack = ''
+      if [[ -f "$out"/scripts/texdoc/texdoc.tlu ]]; then
+        unxz --stdout "${tlpdbxz}" > texlive.tlpdb
+
+        # create dummy doc file to ensure that texdoc does not return an error
+        mkdir -p support/texdoc
+        touch support/texdoc/NEWS
+
+        TEXMFCNF="${bin.core}"/share/texmf-dist/web2c TEXMF="$out" TEXDOCS=. TEXMFVAR=. \
+          "${bin.luatex}"/bin/texlua "$out"/scripts/texdoc/texdoc.tlu \
+          -c texlive_tlpdb=texlive.tlpdb -lM texdoc
+
+        cp texdoc/cache-tlpdb.lua "$out"/scripts/texdoc/Data.tlpdb.lua
+      fi
+    '';
+
+    # install zsh completion
+    postFixup = ''
+      TEXMFCNF="${bin.core}"/share/texmf-dist/web2c TEXMF="$scriptsFolder/../.." \
+        texlua "$out"/bin/texdoc --print-completion zsh > "$TMPDIR"/_texdoc
+      substituteInPlace "$TMPDIR"/_texdoc \
+        --replace 'compdef __texdoc texdoc' '#compdef texdoc' \
+        --replace '$(kpsewhich -var-value TEXMFROOT)/tlpkg/texlive.tlpdb' '$(kpsewhich Data.tlpdb.lua)' \
+        --replace '/^name[^.]*$/ {print $2}' '/^  \["[^"]*"\] = {$/ { print substr($1,3,length($1)-4) }'
+      echo '__texdoc' >> "$TMPDIR"/_texdoc
+      installShellCompletion --zsh "$TMPDIR"/_texdoc
+    '';
+  };
+
+  "texlive.infra" = {
+    extraRevision = ".tlpdb${toString tlpdbVersion.revision}";
+    extraVersion = "-tlpdb-${toString tlpdbVersion.revision}";
+
+    # add license of tlmgr and TeXLive::* perl packages and of bin.core
+    license = [ "gpl2Plus" ] ++ lib.toList bin.core.meta.license.shortName ++ orig."texlive.infra".license or [ ];
+
+    scriptsFolder = "texlive";
+    extraBuildInputs = [ coreutils gnused gnupg (lib.last tl.kpathsea.pkgs) (perl.withPackages (ps: with ps; [ Tk ])) ];
+
+    # make tlmgr believe it can use kpsewhich to evaluate TEXMFROOT
+    postFixup = ''
+      substituteInPlace "$out"/bin/tlmgr \
+        --replace 'if (-r "$bindir/$kpsewhichname")' 'if (1)'
+      sed -i '2i$ENV{PATH}='"'"'${lib.makeBinPath [ gnupg ]}'"'"' . ($ENV{PATH} ? ":$ENV{PATH}" : '"'''"');' "$out"/bin/tlmgr
+      sed -i '2iPATH="${lib.makeBinPath [ coreutils gnused (lib.last tl.kpathsea.pkgs) ]}''${PATH:+:$PATH}"' "$out"/bin/mktexlsr
+    '';
+
+    # add minimal texlive.tlpdb
+    postUnpack = ''
+      if [[ "$tlType" == "tlpkg" ]] ; then
+        xzcat "${tlpdbxz}" | sed -n -e '/^name \(00texlive.config\|00texlive.installation\)$/,/^$/p' > "$out"/texlive.tlpdb
+      fi
+    '';
+  };
+}

From ed9c38b3fa956d50c835b8f95d14f735c985508b Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Sun, 27 Aug 2023 12:26:54 +0200
Subject: [PATCH 26/52] chromium: Fix the chromedriver version

Chromium was updated to M116 but the ChromeDriver version wasn't.
---
 .../networking/browsers/chromium/upstream-info.nix        | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index c7a2c1637e15..36be3c536ee1 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -27,11 +27,11 @@
   };
   stable = {
     chromedriver = {
-      sha256_darwin = "1c41cb7zh13ny4xvpwy7703cnjrkmqxd3n8zpja7n6a38mi8mgsk";
+      sha256_darwin = "0gzx3zka8i2ngsdiqp8sr0v6ir978vywa1pj7j08vsf8kmb93iiy";
       sha256_darwin_aarch64 =
-        "1kliszw10jnnlhzi8jrdzjq0r7vfn6ksk1spsh2rfn2hmghccv2d";
-      sha256_linux = "1797qmb213anvp9lmrkj6wmfdwkdfswmshmk1816zankw5dl883j";
-      version = "115.0.5790.98";
+        "18iyapwjg0yha8qgbw7f605n0j54nd36shv3497bd84lc9k74b14";
+      sha256_linux = "0d8mqzjc11g1bvxvffk0xyhxfls2ycl7ym4ssyjq752g2apjblhp";
+      version = "116.0.5845.96";
     };
     deps = {
       gn = {

From 7ce7e093e850face3bfa81bb177c90aa3be3c2c7 Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Sun, 27 Aug 2023 12:26:26 +0200
Subject: [PATCH 27/52] chromiumDev: 117.0.5897.3 -> 118.0.5966.0

---
 .../networking/browsers/chromium/upstream-info.nix   | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index c7a2c1637e15..ff1d244402d6 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -15,15 +15,15 @@
   dev = {
     deps = {
       gn = {
-        rev = "fae280eabe5d31accc53100137459ece19a7a295";
-        sha256 = "02javy4jsllwl4mxl2zmg964jvzw800w6gbmr5z6jdkip24fw0kj";
+        rev = "cc56a0f98bb34accd5323316e0292575ff17a5d4";
+        sha256 = "1ly7z48v147bfdb1kqkbc98myxpgqq3g6vgr8bjx1ikrk17l82ab";
         url = "https://gn.googlesource.com/gn";
-        version = "2023-07-12";
+        version = "2023-08-10";
       };
     };
-    sha256 = "0pyf3k58m26lkc6v6mqpwvhyaj6bbyywl4c17cxb5zmzc1zmc5ia";
-    sha256bin64 = "10w5dm68aaffgdq0xqi4ans2w7byisqqld09pz5vpk350gy16fjh";
-    version = "117.0.5897.3";
+    sha256 = "1z01b6w4sgndrlcd26jgimk3rhv3wzpn67nv1fd5ln7dwfwkyq20";
+    sha256bin64 = "11y09hsy7y1vg65xfilq44ffsmn15dqy80fa57psj1kin4a52v2x";
+    version = "118.0.5966.0";
   };
   stable = {
     chromedriver = {

From 6f74163d4a5887b5079e246601a7e4b71209033e Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Sun, 27 Aug 2023 12:26:02 +0200
Subject: [PATCH 28/52] chromiumBeta: 116.0.5845.50 -> 117.0.5938.22

---
 .../networking/browsers/chromium/upstream-info.nix   | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.nix b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
index c7a2c1637e15..500a56de0e64 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -2,15 +2,15 @@
   beta = {
     deps = {
       gn = {
-        rev = "4bd1a77e67958fb7f6739bd4542641646f264e5d";
-        sha256 = "14h9jqspb86sl5lhh6q0kk2rwa9zcak63f8drp7kb3r4dx08vzsw";
+        rev = "811d332bd90551342c5cbd39e133aa276022d7f8";
+        sha256 = "0jlg3d31p346na6a3yk0x29pm6b7q03ck423n5n6mi8nv4ybwajq";
         url = "https://gn.googlesource.com/gn";
-        version = "2023-06-09";
+        version = "2023-08-01";
       };
     };
-    sha256 = "0r5m2bcrh2zpl2m8wnzyl4afh8s0dh2m2fnfjf50li94694vy4jz";
-    sha256bin64 = "047wsszg4c23vxq93a335iymiqpy7lw5izzz4f0zk1a4sijafd59";
-    version = "116.0.5845.50";
+    sha256 = "1wf0j189cxpayy6ffmj5j6h5yg3amivryilimjc2ap0jkyj4xrbi";
+    sha256bin64 = "11w1di146mjb9ql30df9yk9x4b9amc6514jzyfbf09mqsrw88dvr";
+    version = "117.0.5938.22";
   };
   dev = {
     deps = {

From 0a89a79460a854e936a07e8bd5cec7e7dbb810f6 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Sun, 27 Aug 2023 12:32:11 +0200
Subject: [PATCH 29/52] haproxy: 2.8.1 -> 2.8.2

Fixes CVE-2023-40225.

Changelog:
https://www.haproxy.org/download/2.8/src/CHANGELOG
---
 pkgs/tools/networking/haproxy/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/networking/haproxy/default.nix b/pkgs/tools/networking/haproxy/default.nix
index b7c39d83d896..6ac8dfb04ef6 100644
--- a/pkgs/tools/networking/haproxy/default.nix
+++ b/pkgs/tools/networking/haproxy/default.nix
@@ -18,11 +18,11 @@ assert usePcre -> pcre != null;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "haproxy";
-  version = "2.8.1";
+  version = "2.8.2";
 
   src = fetchurl {
     url = "https://www.haproxy.org/download/${lib.versions.majorMinor finalAttrs.version}/src/haproxy-${finalAttrs.version}.tar.gz";
-    hash = "sha256-SFVS/NnV1fQarQRvEx/Ap+hJvvJaNJoEB1CvDG/FaAc=";
+    hash = "sha256-aY1pBtFwlGqGl2mWTleBa6PaOt9h/3XomXKxN/RljbA=";
   };
 
   buildInputs = [ openssl zlib libxcrypt ]
@@ -76,5 +76,6 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     maintainers = with lib.maintainers; [ ];
     platforms = with lib.platforms; linux ++ darwin;
+    mainProgram = "haproxy";
   };
 })

From 7f42717cf995965e255100488924cb598d78c205 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 27 Aug 2023 13:50:32 +0200
Subject: [PATCH 30/52] checkov: 2.4.10 -> 2.4.12

Diff: https://github.com/bridgecrewio/checkov/compare/refs/tags/2.4.10...2.4.12

Changelog: https://github.com/bridgecrewio/checkov/releases/tag/2.4.12
---
 pkgs/development/tools/analysis/checkov/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/analysis/checkov/default.nix b/pkgs/development/tools/analysis/checkov/default.nix
index 1c7e54ffbc43..4c0b4ffd156b 100644
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@@ -22,14 +22,14 @@ with py.pkgs;
 
 buildPythonApplication rec {
   pname = "checkov";
-  version = "2.4.10";
+  version = "2.4.12";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-L5BRpwWAP4WyP3kyzp8ELVnXth84jRwP9wmj9kA+xcw=";
+    hash = "sha256-DBwYEE/JyjN97VZX1bwooozFONwMf9w31NTlzDA058k=";
   };
 
   patches = [

From 41032ee3681e20d38b444ac9f790ccc712be49f5 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 27 Aug 2023 13:52:46 +0200
Subject: [PATCH 31/52] python311Packages.msgspec: 0.18.1 -> 0.18.2

Diff: https://github.com/jcrist/msgspec/compare/refs/tags/0.18.1...0.18.2

Changelog: https://github.com/jcrist/msgspec/releases/tag/0.18.2
---
 pkgs/development/python-modules/msgspec/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/msgspec/default.nix b/pkgs/development/python-modules/msgspec/default.nix
index 89ccbb63ff60..f5ae1860039c 100644
--- a/pkgs/development/python-modules/msgspec/default.nix
+++ b/pkgs/development/python-modules/msgspec/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "msgspec";
-  version = "0.18.1";
+  version = "0.18.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "jcrist";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-cacwbl5JYqQGXhdt/F0nhX032GCw8RwFi0XBsn7dlq0=";
+    hash = "sha256-t5TM7CgVIxdXR6jMOXh1XhpA9vBrYHBcR2iLYP4A/Jc=";
   };
 
   # Requires libasan to be accessible

From a56c246ae830204e29631abe60b8bd6341fcd56d Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Sun, 27 Aug 2023 10:10:23 -0400
Subject: [PATCH 32/52] leptosfmt: 0.1.12 -> 0.1.13

Diff: https://github.com/bram209/leptosfmt/compare/0.1.12...0.1.13

Changelog: https://github.com/bram209/leptosfmt/blob/0.1.13/CHANGELOG.md
---
 pkgs/development/tools/rust/leptosfmt/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/rust/leptosfmt/default.nix b/pkgs/development/tools/rust/leptosfmt/default.nix
index b4e2480d1c70..c2dbf742162a 100644
--- a/pkgs/development/tools/rust/leptosfmt/default.nix
+++ b/pkgs/development/tools/rust/leptosfmt/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "leptosfmt";
-  version = "0.1.12";
+  version = "0.1.13";
 
   src = fetchFromGitHub {
     owner = "bram209";
     repo = "leptosfmt";
     rev = version;
-    hash = "sha256-RR4gwmYna/mvUw5akQutWKaUCWzCjK512gynR9Pddd0=";
+    hash = "sha256-QitvZ0AkZcXmjv8EnewWjexQMVEHy/naUarBIrzHbBA=";
   };
 
-  cargoHash = "sha256-6du44SfH0dT1gWVFluB3+AA3GUzwN7Sjh03rKhSRKCM=";
+  cargoHash = "sha256-Fjj4lgkdHeA/3ajNbF1vTf6/YzGvDUJsDmiXzkEpels=";
 
   meta = with lib; {
     description = "A formatter for the leptos view! macro";

From af9e1b2fa6143a27b0e09ac3533f559f10db0f64 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Sun, 27 Aug 2023 10:13:18 -0400
Subject: [PATCH 33/52] nomino: 1.3.1 -> 1.3.2

Diff: https://github.com/yaa110/nomino/compare/1.3.1...1.3.2

Changelog: https://github.com/yaa110/nomino/releases/tag/1.3.2
---
 pkgs/tools/misc/nomino/default.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/misc/nomino/default.nix b/pkgs/tools/misc/nomino/default.nix
index ce9be1fd5878..1eb472ee8fa1 100644
--- a/pkgs/tools/misc/nomino/default.nix
+++ b/pkgs/tools/misc/nomino/default.nix
@@ -1,21 +1,22 @@
-{ fetchFromGitHub, lib, rustPlatform }:
+{ lib, rustPlatform, fetchFromGitHub }:
 
 rustPlatform.buildRustPackage rec {
   pname = "nomino";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "yaa110";
     repo = pname;
     rev = version;
-    sha256 = "sha256-XUxoHmZePn/VVlu2KctC+TbmCwp+tYEYg5EYXI8ZB7o=";
+    hash = "sha256-pzAL7e72sO94qLEwsH/5RuiuzvnsSelIq47jdU8INDw=";
   };
 
-  cargoSha256 = "sha256-RyEqDC2gRacd27uvNf3XOATZdeVg70vBEdPURNuf38w=";
+  cargoHash = "sha256-gDOZ3nD7pTIRNXG3S+qTkl+HInBcAErvwPqa0NZWxY4=";
 
   meta = with lib; {
     description = "Batch rename utility for developers";
     homepage = "https://github.com/yaa110/nomino";
+    changelog = "https://github.com/yaa110/nomino/releases/tag/${src.rev}";
     license = with licenses; [ mit /* or */ asl20 ];
     maintainers = with maintainers; [ figsoda ];
   };

From 5d65594677a51435b78d771504d4eadabdff21a5 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Sun, 27 Aug 2023 10:47:50 -0400
Subject: [PATCH 34/52] textplots: 0.8.0 -> 0.8.1

Diff: https://diff.rs/textplots/0.8.0/0.8.1
---
 pkgs/tools/graphics/textplots/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/graphics/textplots/default.nix b/pkgs/tools/graphics/textplots/default.nix
index a0c5e72ac23c..efb6c6cce7ef 100644
--- a/pkgs/tools/graphics/textplots/default.nix
+++ b/pkgs/tools/graphics/textplots/default.nix
@@ -1,15 +1,15 @@
-{ fetchCrate, lib, rustPlatform }:
+{ lib, rustPlatform, fetchCrate }:
 
 rustPlatform.buildRustPackage rec {
   pname = "textplots";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "07lxnvg8g24r1j6h07w91j5lp0azngmb76lagk55y28br0y70qr4";
+    hash = "sha256-fzuvJwxU6Vi9hWW0IcRAHUeSoOBpGyebzvgjKiYxAbs=";
   };
 
-  cargoSha256 = "19xb1ann3bqx26nhjjvcwqdsvzg7lflg9fdrnlx05ndd2ip44flz";
+  cargoHash = "sha256-QH27BjS75jZOQBBflGapAjg49LpG12DxWZo8TjLoXmI=";
 
   meta = with lib; {
     description = "Terminal plotting written in Rust";

From 1de3e4ddeddeb86c027b4e93acf3a81347d0d186 Mon Sep 17 00:00:00 2001
From: rewine <luhongxu@deepin.org>
Date: Mon, 28 Aug 2023 00:28:22 +0800
Subject: [PATCH 35/52] neocmakelsp: 0.6.1 -> 0.6.3

---
 .../tools/language-servers/neocmakelsp/default.nix          | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/language-servers/neocmakelsp/default.nix b/pkgs/development/tools/language-servers/neocmakelsp/default.nix
index fde707ec6641..b8807f0a26f8 100644
--- a/pkgs/development/tools/language-servers/neocmakelsp/default.nix
+++ b/pkgs/development/tools/language-servers/neocmakelsp/default.nix
@@ -5,16 +5,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "neocmakelsp";
-  version = "0.6.1";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "Decodetalkers";
     repo = "neocmakelsp";
     rev = "v${version}";
-    hash = "sha256-wwFek9668tC+j2F12b9YiYbYJWp5z4J4F09dlj+hlq0=";
+    hash = "sha256-8FQFg9EV50wGnhAoK6TNL2n7BSuvJnVw73LRNdmaegw=";
   };
 
-  cargoHash = "sha256-XmacBalkevCmYxWFcez/++1ng2yyURge466VX6QZC9M=";
+  cargoHash = "sha256-HWu+SYwjnZCv9K9Uru3YlZukpjK9+en2HBMTbRz5oW4=";
 
   meta = with lib; {
     description = "A cmake lsp based on tower-lsp and treesitter";

From e0c075a8bf652e05131efe30a6013d4aaf95cbad Mon Sep 17 00:00:00 2001
From: beeb <703631+beeb@users.noreply.github.com>
Date: Sun, 27 Aug 2023 20:46:01 +0200
Subject: [PATCH 36/52] awsbck: 0.3.3 -> 0.3.4

https://github.com/beeb/awsbck/releases/tag/v0.3.4
---
 pkgs/tools/backup/awsbck/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/backup/awsbck/default.nix b/pkgs/tools/backup/awsbck/default.nix
index 9e1286312120..f0ef8367e0ee 100644
--- a/pkgs/tools/backup/awsbck/default.nix
+++ b/pkgs/tools/backup/awsbck/default.nix
@@ -8,20 +8,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "awsbck";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "beeb";
     repo = "awsbck";
     rev = "v${version}";
-    hash = "sha256-L5hQ6vwuC9HuAGD9mvS8BGkPV3Ry5jJgRUF4Qf7fqaM=";
+    hash = "sha256-MDlFCbBAvGovhCO5uxXRQhIN4Fw9wav0afIBNzz3Mow=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 
-  cargoSha256 = "sha256-VKm27IzCUv3e1Mapb46SBJqvEwifgGxaRX2uM9MTNnQ=";
+  cargoSha256 = "sha256-p7t/QtihdP6dyJ7tKpNkqcyYJvFJG8+fPqSGH7DNAtg=";
 
   doCheck = false;
 

From ecae7dc206a68d5d2517765f2b4ade25fb3aba7a Mon Sep 17 00:00:00 2001
From: emilylange <git@emilylange.de>
Date: Sun, 27 Aug 2023 21:58:52 +0200
Subject: [PATCH 37/52] python3Packages.pyssim: unbreak after recent pillow
 bump

`Image.LANCZOS` is a drop-in replacement for `Image.ANTIALIAS`.
See https://pillow.readthedocs.io/en/stable/releasenotes/10.0.0.html#constants

Pillow bump: bdf1a96570808dc9e11cfbb1ffa5b8a7ff001e2d

https://hydra.nixos.org/build/230653960

Co-authored-by: tjni <3806110+tjni@users.noreply.github.com>
---
 pkgs/development/python-modules/pyssim/default.nix | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pyssim/default.nix b/pkgs/development/python-modules/pyssim/default.nix
index 6b32660ad02d..b69bf47c96d7 100644
--- a/pkgs/development/python-modules/pyssim/default.nix
+++ b/pkgs/development/python-modules/pyssim/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchFromGitHub, numpy, scipy, pillow }:
+{ lib, buildPythonPackage, fetchFromGitHub, numpy, scipy, pillow, fetchpatch }:
 
 buildPythonPackage rec {
   pname = "pyssim";
@@ -14,6 +14,18 @@ buildPythonPackage rec {
     sha256 = "sha256-VvxQTvDTDms6Ccyclbf9P0HEQksl5atPPzHuH8yXTmc=";
   };
 
+  patches = [
+    # "Replace Image.ANTIALIAS with Image.LANCZOS"
+    # Image.ANTIALIAS has been removed in Pillow 10.0.0,
+    # the version currently in nixpkgs,
+    # and Image.LANCZOS is a drop-in since Pillow 2.7.0.
+    # https://github.com/jterrace/pyssim/pull/45
+    (fetchpatch {
+      url = "https://github.com/jterrace/pyssim/commit/db4296c12ca9c027eb9cd61b52195a78dfcc6711.patch";
+      hash = "sha256-wNp47EFtjXv6jIFX25IErXg83ksmGRNFKNeMFS+tP6s=";
+    })
+  ];
+
   # Tests are copied from .travis.yml
   checkPhase = ''
     $out/bin/pyssim test-images/test1-1.png test-images/test1-1.png | grep 1

From 9fa3a8b6296ad4cebdabc8be4880337bd78e0bed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20Kr=C3=BCger?= <mkg20001@gmail.com>
Date: Mon, 28 Aug 2023 00:07:09 +0200
Subject: [PATCH 38/52] odoo15: 15.0.20230317->15.020230816 fix broken fetcher

Upstream seems to publish and retain `.zip` more consistently than `.tar.gz`, which caused the previous expression to break. This modifies the odoo package and updater script to use the `zip` sources.
---
 pkgs/applications/finance/odoo/odoo15.nix | 16 +++++-----------
 pkgs/applications/finance/odoo/update.sh  |  6 +++---
 2 files changed, 8 insertions(+), 14 deletions(-)

diff --git a/pkgs/applications/finance/odoo/odoo15.nix b/pkgs/applications/finance/odoo/odoo15.nix
index 1ed0cf316088..b3c66c60c6b6 100644
--- a/pkgs/applications/finance/odoo/odoo15.nix
+++ b/pkgs/applications/finance/odoo/odoo15.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, fetchurl, python310, nodePackages, wkhtmltopdf
+{ stdenv, lib, fetchFromGitHub, fetchzip, python310, nodePackages, wkhtmltopdf
 , nixosTests }:
 
 let
@@ -38,7 +38,7 @@ let
   };
 
   odoo_version = "15.0";
-  odoo_release = "20230720";
+  odoo_release = "20230816";
 in python.pkgs.buildPythonApplication rec {
   pname = "odoo15";
   version = "${odoo_version}.${odoo_release}";
@@ -46,18 +46,12 @@ in python.pkgs.buildPythonApplication rec {
   format = "setuptools";
 
   # latest release is at https://github.com/odoo/docker/blob/master/15.0/Dockerfile
-  src = fetchurl {
-    url =
-      "https://nightly.odoo.com/${odoo_version}/nightly/src/odoo_${version}.tar.gz";
+  src = fetchzip {
+    url = "https://nightly.odoo.com/${odoo_version}/nightly/src/odoo_${version}.zip";
     name = "${pname}-${version}";
-    hash = "sha256-XH4cN2OrPvMjN3VcDJFxCacNxKkrN65jwhUN1dnGwgo="; # odoo
+    hash = "sha256-h81JA0o44DVtl/bZ52rGQfg54TigwQcNpcMjQbi0zIQ="; # odoo
   };
 
-  unpackPhase = ''
-    tar xfz $src
-    cd odoo*
-  '';
-
   # needs some investigation
   doCheck = false;
 
diff --git a/pkgs/applications/finance/odoo/update.sh b/pkgs/applications/finance/odoo/update.sh
index 1bec751ae7e7..0f7ee144cf8a 100755
--- a/pkgs/applications/finance/odoo/update.sh
+++ b/pkgs/applications/finance/odoo/update.sh
@@ -1,9 +1,9 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused nix coreutils
+#!nix-shell -i bash -p curl gnused nix coreutils nix-prefetch
 
 set -euo pipefail
 
-DOCKER=$(curl -s https://raw.githubusercontent.com/odoo/docker/master/15.0/Dockerfile)
+DOCKER=$(curl -s https://raw.githubusercontent.com/odoo/docker/master/16.0/Dockerfile)
 
 get_var() {
   echo "$DOCKER" | grep -E "^[A-Z][A-Z][A-Z] ODOO_$1" | sed -r "s|^[A-Z]{3} ODOO_$1.||g"
@@ -22,6 +22,6 @@ fi
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
-sed -ri "s| hash.+ # odoo| hash = \"$(nix-prefetch-url --type sha256 "https://nightly.odoo.com/${VERSION}/nightly/src/odoo_${latestVersion}.tar.gz")\"; # odoo|g" default.nix
+sed -ri "s| hash.+ # odoo| hash = \"$(nix-prefetch -q fetchzip --url "https://nightly.odoo.com/${VERSION}/nightly/src/odoo_${latestVersion}.zip")\"; # odoo|g" default.nix
 sed -ri "s| odoo_version.+| odoo_version = \"$VERSION\";|" default.nix
 sed -ri "s| odoo_release.+| odoo_release = \"$RELEASE\";|" default.nix

From b0ace70d46d40acf77c88ccc77ca311ebdf96089 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20Kr=C3=BCger?= <mkg20001@gmail.com>
Date: Mon, 28 Aug 2023 00:07:38 +0200
Subject: [PATCH 39/52] odoo: use fetchzip

---
 pkgs/applications/finance/odoo/default.nix | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/pkgs/applications/finance/odoo/default.nix b/pkgs/applications/finance/odoo/default.nix
index d3436f929ed1..dc52f72b2d52 100644
--- a/pkgs/applications/finance/odoo/default.nix
+++ b/pkgs/applications/finance/odoo/default.nix
@@ -1,7 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
-, fetchurl
+, fetchzip
 , python310
 , nodePackages
 , wkhtmltopdf
@@ -53,17 +53,12 @@ in python.pkgs.buildPythonApplication rec {
   format = "setuptools";
 
   # latest release is at https://github.com/odoo/docker/blob/master/16.0/Dockerfile
-  src = fetchurl {
-    url = "https://nightly.odoo.com/${odoo_version}/nightly/src/odoo_${version}.tar.gz";
+  src = fetchzip {
+    url = "https://nightly.odoo.com/${odoo_version}/nightly/src/odoo_${version}.zip";
     name = "${pname}-${version}";
-    hash = "sha256-DV5JBY+2gq5mUfcvN9S5xkd+ufgEBjvyvBY1X7pPFPk="; # odoo
+    hash = "sha256-pSycpYSiqJ6DKENvCWwLz+JaPUXT5dmaq8x4Aency60="; # odoo
   };
 
-  unpackPhase = ''
-    tar xfz $src
-    cd odoo*
-  '';
-
   # needs some investigation
   doCheck = false;
 

From e0b74ead2d458e286d359639db9971a8682682c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20Kr=C3=BCger?= <mkg20001@gmail.com>
Date: Mon, 28 Aug 2023 00:08:09 +0200
Subject: [PATCH 40/52] odoo15: remove updatescript

---
 pkgs/applications/finance/odoo/odoo15.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/applications/finance/odoo/odoo15.nix b/pkgs/applications/finance/odoo/odoo15.nix
index b3c66c60c6b6..675264e42a38 100644
--- a/pkgs/applications/finance/odoo/odoo15.nix
+++ b/pkgs/applications/finance/odoo/odoo15.nix
@@ -109,7 +109,6 @@ in python.pkgs.buildPythonApplication rec {
   dontStrip = true;
 
   passthru = {
-    updateScript = ./update.sh;
     tests = { inherit (nixosTests) odoo15; };
   };
 

From 048ef0d45573d89195d69bdb5045aa50fa94d6a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20Kr=C3=BCger?= <mkg20001@gmail.com>
Date: Sat, 17 Dec 2022 19:28:14 +0100
Subject: [PATCH 41/52] networking/nftables: add .tables property and disable
 ruleset flushing by default

This allows for other unmanaged tables to co-exist peacefully on the os,
by having the nixos-managed tables be re-created atomically and the other
tables will simply be left untouched.
---
 .../modules/services/networking/nftables.nix  | 94 ++++++++++++++++++-
 1 file changed, 93 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/nftables.nix b/nixos/modules/services/networking/nftables.nix
index faff1dca89ba..4bc115cd580c 100644
--- a/nixos/modules/services/networking/nftables.nix
+++ b/nixos/modules/services/networking/nftables.nix
@@ -2,6 +2,35 @@
 with lib;
 let
   cfg = config.networking.nftables;
+
+  tableSubmodule = { name, ... }: {
+    options = {
+      enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = lib.mdDoc "Enable this table.";
+      };
+
+      name = mkOption {
+        type = types.str;
+        description = lib.mdDoc "Table name.";
+      };
+
+      content = mkOption {
+        type = types.lines;
+        description = lib.mdDoc "The table content.";
+      };
+
+      family = mkOption {
+        description = lib.mdDoc "Table family.";
+        type = types.enum [ "ip" "ip6" "inet" "arp" "bridge" "netdev" ];
+      };
+    };
+
+    config = {
+      name = mkDefault name;
+    };
+  };
 in
 {
   ###### interface
@@ -116,6 +145,62 @@ in
           This option conflicts with ruleset and nftables based firewall.
         '';
     };
+    networking.nftables.tables = mkOption {
+      type = types.attrsOf (types.submodule tableSubmodule);
+
+      default = {};
+
+      description = lib.mdDoc ''
+        Tables to be added to ruleset.
+        Tables will be added together with delete statements to clean up the table before every update.
+      '';
+
+      example = {
+        filter = {
+          family = "inet";
+          content = ''
+            # Check out https://wiki.nftables.org/ for better documentation.
+            # Table for both IPv4 and IPv6.
+            # Block all incoming connections traffic except SSH and "ping".
+            chain input {
+              type filter hook input priority 0;
+
+              # accept any localhost traffic
+              iifname lo accept
+
+              # accept traffic originated from us
+              ct state {established, related} accept
+
+              # ICMP
+              # routers may also want: mld-listener-query, nd-router-solicit
+              ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept
+              ip protocol icmp icmp type { destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept
+
+              # allow "ping"
+              ip6 nexthdr icmpv6 icmpv6 type echo-request accept
+              ip protocol icmp icmp type echo-request accept
+
+              # accept SSH connections (required for a server)
+              tcp dport 22 accept
+
+              # count and drop any other traffic
+              counter drop
+            }
+
+            # Allow all outgoing connections.
+            chain output {
+              type filter hook output priority 0;
+              accept
+            }
+
+            chain forward {
+              type filter hook forward priority 0;
+              accept
+            }
+          '';
+        };
+      };
+    };
   };
 
   ###### implementation
@@ -131,12 +216,19 @@ in
       wantedBy = [ "multi-user.target" ];
       reloadIfChanged = true;
       serviceConfig = let
+        enabledTables = filterAttrs (_: table: table.enable) cfg.tables;
         rulesScript = pkgs.writeTextFile {
           name =  "nftables-rules";
           executable = true;
           text = ''
             #! ${pkgs.nftables}/bin/nft -f
-            flush ruleset
+            ${concatStringsSep "\n" (mapAttrsToList (_: table: ''
+              table ${table.family} ${table.name}
+              delete table ${table.family} ${table.name}
+              table ${table.family} ${table.name} {
+                ${table.content}
+              }
+            '') enabledTables)}
             ${if cfg.rulesetFile != null then ''
               include "${cfg.rulesetFile}"
             '' else cfg.ruleset}

From 311d2fa994565ab412681b9ab8cbb12054ab265a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20Kr=C3=BCger?= <mkg20001@gmail.com>
Date: Mon, 26 Dec 2022 00:28:57 +0100
Subject: [PATCH 42/52] *: migrate to using nftables.tables instead of ruleset
 directly

---
 .../services/networking/firewall-nftables.nix |  9 ++---
 .../services/networking/nat-nftables.nix      | 36 +++++++++----------
 nixos/tests/lxd/nftables.nix                  |  5 ++-
 3 files changed, 22 insertions(+), 28 deletions(-)

diff --git a/nixos/modules/services/networking/firewall-nftables.nix b/nixos/modules/services/networking/firewall-nftables.nix
index 452dd97d89d2..7c7136cc96f1 100644
--- a/nixos/modules/services/networking/firewall-nftables.nix
+++ b/nixos/modules/services/networking/firewall-nftables.nix
@@ -70,10 +70,8 @@ in
       }
     ];
 
-    networking.nftables.ruleset = ''
-
-      table inet nixos-fw {
-
+    networking.nftables.tables."nixos-fw".family = "inet";
+    networking.nftables.tables."nixos-fw".content = ''
         ${optionalString (cfg.checkReversePath != false) ''
           chain rpfilter {
             type filter hook prerouting priority mangle + 10; policy drop;
@@ -169,9 +167,6 @@ in
 
           }
         ''}
-
-      }
-
     '';
 
   };
diff --git a/nixos/modules/services/networking/nat-nftables.nix b/nixos/modules/services/networking/nat-nftables.nix
index 483910a16658..4b2317ca2ffc 100644
--- a/nixos/modules/services/networking/nat-nftables.nix
+++ b/nixos/modules/services/networking/nat-nftables.nix
@@ -145,28 +145,28 @@ in
       }
     ];
 
-    networking.nftables.ruleset = ''
-      table ip nixos-nat {
-        ${mkTable {
+    networking.nftables.tables = {
+      "nixos-nat" = {
+        family = "ip";
+        content = mkTable {
           ipVer = "ip";
           inherit dest ipSet;
           forwardPorts = filter (x: !(isIPv6 x.destination)) cfg.forwardPorts;
           inherit (cfg) dmzHost;
-        }}
-      }
-
-      ${optionalString cfg.enableIPv6 ''
-        table ip6 nixos-nat {
-          ${mkTable {
-            ipVer = "ip6";
-            dest = destIPv6;
-            ipSet = ipv6Set;
-            forwardPorts = filter (x: isIPv6 x.destination) cfg.forwardPorts;
-            dmzHost = null;
-          }}
-        }
-      ''}
-    '';
+        };
+      };
+      "nixos-nat6" = mkIf cfg.enableIPv6 {
+        family = "ip6";
+        name = "nixos-nat";
+        content = mkTable {
+          ipVer = "ip6";
+          dest = destIPv6;
+          ipSet = ipv6Set;
+          forwardPorts = filter (x: isIPv6 x.destination) cfg.forwardPorts;
+          dmzHost = null;
+        };
+      };
+    };
 
     networking.firewall.extraForwardRules = optionalString config.networking.firewall.filterForward ''
       ${optionalString (ifaceSet != "") ''
diff --git a/nixos/tests/lxd/nftables.nix b/nixos/tests/lxd/nftables.nix
index b85caa9eb368..d98bd4952906 100644
--- a/nixos/tests/lxd/nftables.nix
+++ b/nixos/tests/lxd/nftables.nix
@@ -20,8 +20,8 @@ import ../make-test-python.nix ({ pkgs, ...} : {
     networking = {
       firewall.enable = false;
       nftables.enable = true;
-      nftables.ruleset = ''
-        table inet filter {
+      nftables.tables."filter".family = "inet";
+      nftables.tables."filter".content = ''
           chain incoming {
             type filter hook input priority 0;
             policy accept;
@@ -36,7 +36,6 @@ import ../make-test-python.nix ({ pkgs, ...} : {
             type filter hook output priority 0;
             policy accept;
           }
-        }
       '';
     };
   };

From cd3af25932425e1b1acfaad9c9ee85694fe70ae6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20Kr=C3=BCger?= <mkg20001@gmail.com>
Date: Mon, 26 Dec 2022 00:35:15 +0100
Subject: [PATCH 43/52] networking/nftables: enable flushing ruleset for older
 versions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Naïm Favier <n@monade.li>
---
 nixos/modules/services/networking/nftables.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/nixos/modules/services/networking/nftables.nix b/nixos/modules/services/networking/nftables.nix
index 4bc115cd580c..810dc22a20a8 100644
--- a/nixos/modules/services/networking/nftables.nix
+++ b/nixos/modules/services/networking/nftables.nix
@@ -83,6 +83,8 @@ in
       '';
     };
 
+    networking.nftables.flushRuleset = mkEnableOption (lib.mdDoc "Flush the entire ruleset on each reload.");
+
     networking.nftables.ruleset = mkOption {
       type = types.lines;
       default = "";
@@ -209,6 +211,7 @@ in
     boot.blacklistedKernelModules = [ "ip_tables" ];
     environment.systemPackages = [ pkgs.nftables ];
     networking.networkmanager.firewallBackend = mkDefault "nftables";
+    networking.nftables.flushRuleset = mkDefault (versionOlder config.system.stateVersion "23.11");
     systemd.services.nftables = {
       description = "nftables firewall";
       before = [ "network-pre.target" ];
@@ -222,6 +225,7 @@ in
           executable = true;
           text = ''
             #! ${pkgs.nftables}/bin/nft -f
+            ${optionalString cfg.flushRuleset "flush ruleset"}
             ${concatStringsSep "\n" (mapAttrsToList (_: table: ''
               table ${table.family} ${table.name}
               delete table ${table.family} ${table.name}

From dc3f8728b949550d10ffe6a165cd2a1d5b9f7a97 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20Kr=C3=BCger?= <mkg20001@gmail.com>
Date: Mon, 26 Dec 2022 01:09:11 +0100
Subject: [PATCH 44/52] release-notes: add networking.nftables.tables news

---
 nixos/doc/manual/release-notes/rl-2311.section.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index 49b2433c8820..d4fa6e941e57 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -223,6 +223,12 @@ The module update takes care of the new config syntax and the data itself (user
 
 - Suricata was upgraded from 6.0 to 7.0 and no longer considers HTTP/2 support as experimental, see [upstream release notes](https://forum.suricata.io/t/suricata-7-0-0-released/3715) for more details.
 
+- `networking.nftables` now has the option `networking.nftables.table.<table>` to create tables
+  and have them be updated atomically, instead of flushing the ruleset.
+
+- `networking.nftables` is no longer flushing all rulesets on every reload.
+  Use `networking.nftables.flushRuleset = true;` to get back the old behaviour.
+
 ## Nixpkgs internals {#sec-release-23.11-nixpkgs-internals}
 
 - The use of `sourceRoot = "source";`, `sourceRoot = "source/subdir";`, and similar lines in package derivations using the default `unpackPhase` is deprecated as it requires `unpackPhase` to always produce a directory named "source". Use `sourceRoot = src.name`, `sourceRoot = "${src.name}/subdir";`, or `setSourceRoot = "sourceRoot=$(echo */subdir)";` or similar instead.

From d5a08266866f91efd7d27ccde9f89469b09047a2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20Kr=C3=BCger?= <mkg20001@gmail.com>
Date: Mon, 26 Dec 2022 01:25:09 +0100
Subject: [PATCH 45/52] networking/nftables: remove no longer relevant conflict
 warnings

---
 nixos/modules/services/networking/nftables.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/nixos/modules/services/networking/nftables.nix b/nixos/modules/services/networking/nftables.nix
index 810dc22a20a8..a96528f2d184 100644
--- a/nixos/modules/services/networking/nftables.nix
+++ b/nixos/modules/services/networking/nftables.nix
@@ -134,7 +134,6 @@ in
         lib.mdDoc ''
           The ruleset to be used with nftables.  Should be in a format that
           can be loaded using "/bin/nft -f".  The ruleset is updated atomically.
-          This option conflicts with rulesetFile.
         '';
     };
     networking.nftables.rulesetFile = mkOption {
@@ -144,7 +143,6 @@ in
         lib.mdDoc ''
           The ruleset file to be used with nftables.  Should be in a format that
           can be loaded using "nft -f".  The ruleset is updated atomically.
-          This option conflicts with ruleset and nftables based firewall.
         '';
     };
     networking.nftables.tables = mkOption {

From 5f300ad70cbbb7192f5a86795c37ed99d70ab545 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20Kr=C3=BCger?= <mkg20001@gmail.com>
Date: Wed, 28 Dec 2022 02:52:26 +0100
Subject: [PATCH 46/52] networking/nftables: only delete our tables if
 flushRuleset is set to false

---
 nixos/modules/services/networking/nftables.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/nftables.nix b/nixos/modules/services/networking/nftables.nix
index a96528f2d184..b238f09df2f3 100644
--- a/nixos/modules/services/networking/nftables.nix
+++ b/nixos/modules/services/networking/nftables.nix
@@ -248,7 +248,11 @@ in
         RemainAfterExit = true;
         ExecStart = rulesScript;
         ExecReload = rulesScript;
-        ExecStop = "${pkgs.nftables}/bin/nft flush ruleset";
+        ExecStop = "${pkgs.nftables}/bin/nft ${
+          if cfg.flushRuleset then "flush ruleset"
+          else escapeShellArg (concatStringsSep "; " (
+            mapAttrsToList (_: table: "delete table ${table.family} ${table.name}") enabledTables
+          ))}";
       };
     };
   };

From 55213b54f0ebb96250021a8788e36126174ca8a7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20Kr=C3=BCger?= <mkg20001@gmail.com>
Date: Mon, 27 Mar 2023 19:52:19 +0200
Subject: [PATCH 47/52] nixos/nftables: save deletions to file and run them
 afterwards

Co-authored-by: duament
---
 .../modules/services/networking/nftables.nix  | 60 +++++++++++++++----
 1 file changed, 50 insertions(+), 10 deletions(-)

diff --git a/nixos/modules/services/networking/nftables.nix b/nixos/modules/services/networking/nftables.nix
index b238f09df2f3..2107448131ec 100644
--- a/nixos/modules/services/networking/nftables.nix
+++ b/nixos/modules/services/networking/nftables.nix
@@ -85,6 +85,22 @@ in
 
     networking.nftables.flushRuleset = mkEnableOption (lib.mdDoc "Flush the entire ruleset on each reload.");
 
+    networking.nftables.extraDeletions = mkOption {
+      type = types.lines;
+      default = "";
+      example = ''
+        # this makes deleting a non-existing table a no-op instead of an error
+        table inet some-table;
+
+        delete table inet some-table;
+      '';
+      description =
+        lib.mdDoc ''
+          Extra deletion commands to be run on every firewall start, reload
+          and after stopping the firewall.
+        '';
+    };
+
     networking.nftables.ruleset = mkOption {
       type = types.lines;
       default = "";
@@ -134,6 +150,10 @@ in
         lib.mdDoc ''
           The ruleset to be used with nftables.  Should be in a format that
           can be loaded using "/bin/nft -f".  The ruleset is updated atomically.
+          Note that if the tables should be cleaned first, either:
+          - networking.nftables.flushRuleset = true; needs to be set (flushes all tables)
+          - networking.nftables.extraDeletions needs to be set
+          - or networking.nftables.tables can be used, which will clean up the table automatically
         '';
     };
     networking.nftables.rulesetFile = mkOption {
@@ -218,15 +238,36 @@ in
       reloadIfChanged = true;
       serviceConfig = let
         enabledTables = filterAttrs (_: table: table.enable) cfg.tables;
+        deletionsScript = pkgs.writeScript "nftables-deletions" ''
+          #! ${pkgs.nftables}/bin/nft -f
+          ${if cfg.flushRuleset then "flush ruleset"
+            else concatStringsSep "\n" (mapAttrsToList (_: table: ''
+              table ${table.family} ${table.name}
+              delete table ${table.family} ${table.name}
+            '') enabledTables)}
+          ${cfg.extraDeletions}
+        '';
+        deletionsScriptVar = "/var/lib/nftables/deletions.nft";
+        ensureDeletions = pkgs.writeShellScript "nftables-ensure-deletions" ''
+          touch ${deletionsScriptVar}
+          chmod +x ${deletionsScriptVar}
+        '';
+        saveDeletionsScript = pkgs.writeShellScript "nftables-save-deletions" ''
+          cp ${deletionsScript} ${deletionsScriptVar}
+        '';
+        cleanupDeletionsScript = pkgs.writeShellScript "nftables-cleanup-deletions" ''
+          rm ${deletionsScriptVar}
+        '';
         rulesScript = pkgs.writeTextFile {
           name =  "nftables-rules";
           executable = true;
           text = ''
             #! ${pkgs.nftables}/bin/nft -f
-            ${optionalString cfg.flushRuleset "flush ruleset"}
+            # previous deletions, if any
+            include "${deletionsScriptVar}"
+            # current deletions
+            include "${deletionsScript}"
             ${concatStringsSep "\n" (mapAttrsToList (_: table: ''
-              table ${table.family} ${table.name}
-              delete table ${table.family} ${table.name}
               table ${table.family} ${table.name} {
                 ${table.content}
               }
@@ -237,6 +278,7 @@ in
           '';
           checkPhase = lib.optionalString cfg.checkRuleset ''
             cp $out ruleset.conf
+            sed 's|include "${deletionsScriptVar}"||' -i ruleset.conf
             ${cfg.preCheckRuleset}
             export NIX_REDIRECTS=/etc/protocols=${pkgs.buildPackages.iana-etc}/etc/protocols:/etc/services=${pkgs.buildPackages.iana-etc}/etc/services
             LD_PRELOAD="${pkgs.buildPackages.libredirect}/lib/libredirect.so ${pkgs.buildPackages.lklWithFirewall.lib}/lib/liblkl-hijack.so" \
@@ -246,13 +288,11 @@ in
       in {
         Type = "oneshot";
         RemainAfterExit = true;
-        ExecStart = rulesScript;
-        ExecReload = rulesScript;
-        ExecStop = "${pkgs.nftables}/bin/nft ${
-          if cfg.flushRuleset then "flush ruleset"
-          else escapeShellArg (concatStringsSep "; " (
-            mapAttrsToList (_: table: "delete table ${table.family} ${table.name}") enabledTables
-          ))}";
+        ExecStart = [ ensureDeletions rulesScript ];
+        ExecStartPost = saveDeletionsScript;
+        ExecReload = [ rulesScript saveDeletionsScript ];
+        ExecStop = [ deletionsScriptVar cleanupDeletionsScript ];
+        StateDirectory = "nftables";
       };
     };
   };

From a1dd69d7615feb8d3f6ddc63351849f279344395 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20Kr=C3=BCger?= <mkg20001@gmail.com>
Date: Mon, 27 Mar 2023 20:09:46 +0200
Subject: [PATCH 48/52] networking/nftables: enable flushRuleset by default if
 rulset{,File} used

---
 nixos/modules/services/networking/nftables.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/nftables.nix b/nixos/modules/services/networking/nftables.nix
index 2107448131ec..cf32876c2c5b 100644
--- a/nixos/modules/services/networking/nftables.nix
+++ b/nixos/modules/services/networking/nftables.nix
@@ -229,7 +229,8 @@ in
     boot.blacklistedKernelModules = [ "ip_tables" ];
     environment.systemPackages = [ pkgs.nftables ];
     networking.networkmanager.firewallBackend = mkDefault "nftables";
-    networking.nftables.flushRuleset = mkDefault (versionOlder config.system.stateVersion "23.11");
+    # versionOlder for backportability, remove afterwards
+    networking.nftables.flushRuleset = mkDefault (versionOlder config.system.stateVersion "23.11" || (cfg.rulesetFile != null || cfg.ruleset != ""));
     systemd.services.nftables = {
       description = "nftables firewall";
       before = [ "network-pre.target" ];

From 6658b3fcf185f6b9eef7ab1923711c35023407b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20Kr=C3=BCger?= <mkg20001@gmail.com>
Date: Mon, 27 Mar 2023 20:10:18 +0200
Subject: [PATCH 49/52] networking/nftables: make ruleset+rulesetFile
 non-exclusive

---
 nixos/modules/services/networking/nftables.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/networking/nftables.nix b/nixos/modules/services/networking/nftables.nix
index cf32876c2c5b..5397917d0cec 100644
--- a/nixos/modules/services/networking/nftables.nix
+++ b/nixos/modules/services/networking/nftables.nix
@@ -273,9 +273,10 @@ in
                 ${table.content}
               }
             '') enabledTables)}
-            ${if cfg.rulesetFile != null then ''
+            ${cfg.ruleset}
+            ${lib.optionalString (cfg.rulesetFile != null) ''
               include "${cfg.rulesetFile}"
-            '' else cfg.ruleset}
+            ''}
           '';
           checkPhase = lib.optionalString cfg.checkRuleset ''
             cp $out ruleset.conf

From 7c6847bfc92561333a6dca89dc887de4dee98379 Mon Sep 17 00:00:00 2001
From: Michael Raskin <7c6f434c@mail.ru>
Date: Mon, 28 Aug 2023 00:43:57 +0200
Subject: [PATCH 50/52] winePackages: add reckenrode as a maintainer

---
 pkgs/applications/emulators/wine/base.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/emulators/wine/base.nix b/pkgs/applications/emulators/wine/base.nix
index 50a2e7d75669..8b1b4966ddab 100644
--- a/pkgs/applications/emulators/wine/base.nix
+++ b/pkgs/applications/emulators/wine/base.nix
@@ -205,7 +205,7 @@ stdenv.mkDerivation ((lib.optionalAttrs (buildScript != null) {
     ];
     description = if supportFlags.waylandSupport then "An Open Source implementation of the Windows API on top of OpenGL and Unix (with experimental Wayland support)" else "An Open Source implementation of the Windows API on top of X, OpenGL, and Unix";
     platforms = if supportFlags.waylandSupport then (lib.remove "x86_64-darwin" prevPlatforms) else prevPlatforms;
-    maintainers = with lib.maintainers; [ avnik raskin bendlas jmc-figueira ];
+    maintainers = with lib.maintainers; [ avnik raskin bendlas jmc-figueira reckenrode ];
     inherit mainProgram;
   };
 })

From 369e18f1c78c6f7b5b67b177430a2c347eae5375 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20Kr=C3=BCger?= <mkg20001@gmail.com>
Date: Mon, 28 Aug 2023 00:44:16 +0200
Subject: [PATCH 51/52] networking/nftables: ensure deletions

---
 nixos/modules/services/networking/nftables.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/nftables.nix b/nixos/modules/services/networking/nftables.nix
index 5397917d0cec..0e4cd6fa1503 100644
--- a/nixos/modules/services/networking/nftables.nix
+++ b/nixos/modules/services/networking/nftables.nix
@@ -292,7 +292,7 @@ in
         RemainAfterExit = true;
         ExecStart = [ ensureDeletions rulesScript ];
         ExecStartPost = saveDeletionsScript;
-        ExecReload = [ rulesScript saveDeletionsScript ];
+        ExecReload = [ ensureDeletions rulesScript saveDeletionsScript ];
         ExecStop = [ deletionsScriptVar cleanupDeletionsScript ];
         StateDirectory = "nftables";
       };

From f938e1ac056804e432c01a8cb0873de90d4d7c70 Mon Sep 17 00:00:00 2001
From: Konstantin Astafurov <konstantin.astafurov@gmail.com>
Date: Fri, 25 Aug 2023 19:01:29 -0400
Subject: [PATCH 52/52] ssl-proxy: init at 0.2.7

Ssl-proxy is a reverse proxy that makes it easy to put up and sign ssl
certificates. Homepage: https://github.com/suyashkumar/ssl-proxy
---
 pkgs/tools/networking/ssl-proxy/default.nix | 31 +++++++++++++++++++++
 pkgs/top-level/all-packages.nix             |  2 ++
 2 files changed, 33 insertions(+)
 create mode 100644 pkgs/tools/networking/ssl-proxy/default.nix

diff --git a/pkgs/tools/networking/ssl-proxy/default.nix b/pkgs/tools/networking/ssl-proxy/default.nix
new file mode 100644
index 000000000000..1aac650885b6
--- /dev/null
+++ b/pkgs/tools/networking/ssl-proxy/default.nix
@@ -0,0 +1,31 @@
+{ lib, buildGo118Module, fetchFromGitHub }:
+
+buildGo118Module rec {
+  pname = "ssl-proxy";
+  version = "0.2.7";
+
+  src = fetchFromGitHub {
+    owner = "suyashkumar";
+    repo = "ssl-proxy";
+    rev = "v${version}";
+    hash = "sha256-c9BLdDlkrg1z1QrO+vEAVyPtrV/nQcYlGXFmwfAOSpQ=";
+  };
+
+  vendorHash = "sha256-310K9ZSxy/OQ4HYFCcHQaj4NQwzATrOZ2YkhiSkhY5I=";
+
+  checkTarget = "test";
+
+  meta = with lib; {
+    homepage = "https://github.com/suyashkumar/ssl-proxy";
+    description = "Simple single-command SSL reverse proxy with autogenerated certificates (LetsEncrypt, self-signed)";
+    longDescription = ''
+      A handy and simple way to add SSL to your thing running on a VM--be it your personal jupyter
+      notebook or your team jenkins instance. ssl-proxy autogenerates SSL certs and proxies
+      HTTPS traffic to an existing HTTP server in a single command.
+    '';
+    license = licenses.mit;
+    mainProgram = "ssl-proxy";
+    maintainers = [ maintainers.konst-aa ];
+    platforms = platforms.linux ++ platforms.darwin ++ platforms.windows ;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1cb9c464e1eb..a74987323a14 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -42172,4 +42172,6 @@ with pkgs;
   wpm = callPackage ../applications/misc/wpm { };
 
   yazi = callPackage ../applications/file-managers/yazi { inherit (darwin.apple_sdk.frameworks) Foundation; };
+
+  ssl-proxy = callPackage ../tools/networking/ssl-proxy { };
 }