Merge remote-tracking branch 'upstream/staging-next' into fix-merge-conflict-1735949935

.github/workflows/eval.yml

@@ -219,7 +219,7 @@ jobs:
   tag:
     name: Tag
     runs-on: ubuntu-latest
-    needs: process
+    needs: [ attrs, process ]
     if: needs.process.outputs.baseRunId
     permissions:
       pull-requests: write
@@ -239,6 +239,21 @@ jobs:
           name: comparison
           path: comparison
 
+      - name: Install Nix
+        uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+
+      # Important: This workflow job runs with extra permissions,
+      # so we need to make sure to not run untrusted code from PRs
+      - name: Check out Nixpkgs at the base commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.attrs.outputs.baseSha }}
+          path: base
+          sparse-checkout: ci
+
+      - name: Build the requestReviews derivation
+        run: nix-build base/ci -A requestReviews
+
       - name: Tagging pull request
         run: |
           # Get all currently set rebuild labels
@@ -271,20 +286,21 @@ jobs:
           # maintainers.json contains GitHub IDs. Look up handles to request reviews from.
           # There appears to be no API to request reviews based on GitHub IDs
           jq -r 'keys[]' comparison/maintainers.json \
-            | while read -r id; do gh api /user/"$id"; done \
-            | jq -s '{ reviewers: map(.login) }' \
+            | while read -r id; do gh api /user/"$id" --jq .login; done \
+            | GH_TOKEN=${{ steps.app-token.outputs.token }} result/bin/process-reviewers.sh "$REPOSITORY" "$NUMBER" "$AUTHOR" \
             > reviewers.json
 
           # Request reviewers from maintainers of changed output paths
           GH_TOKEN=${{ steps.app-token.outputs.token }} gh api \
             --method POST \
-            /repos/${{ github.repository }}/pulls/${{ github.event.number }}/requested_reviewers \
+            /repos/"$REPOSITORY"/pulls/"$NUMBER"/requested_reviewers \
             --input reviewers.json
 
         env:
           GH_TOKEN: ${{ github.token }}
           REPOSITORY: ${{ github.repository }}
           NUMBER: ${{ github.event.number }}
+          AUTHOR: ${{ github.event.pull_request.user.login }}
 
       - name: Add eval summary to commit statuses
         if: ${{ github.event_name == 'pull_request_target' }}

ci/request-reviews/default.nix

@@ -15,6 +15,7 @@ stdenvNoCC.mkDerivation {
     root = ./.;
     fileset = lib.fileset.unions [
       ./get-reviewers.sh
+      ./process-reviewers.sh
       ./request-reviews.sh
       ./verify-base-branch.sh
       ./dev-branches.txt

ci/request-reviews/get-reviewers.sh

@@ -1,8 +1,6 @@
 #!/usr/bin/env bash
 
-# Get the code owners of the files changed by a PR,
-# suitable to be consumed by the API endpoint to request reviews:
-# https://docs.github.com/en/rest/pulls/review-requests?apiVersion=2022-11-28#request-reviewers-for-a-pull-request
+# Get the code owners of the files changed by a PR, returning one username per line
 
 set -euo pipefail
 
@@ -10,18 +8,15 @@ log() {
     echo "$@" >&2
 }
 
-if (( "$#" < 7 )); then
-    log "Usage: $0 GIT_REPO OWNERS_FILE BASE_REPO BASE_REF HEAD_REF PR_NUMBER PR_AUTHOR"
+if (( "$#" < 4 )); then
+    log "Usage: $0 GIT_REPO OWNERS_FILE BASE_REF HEAD_REF"
     exit 1
 fi
 
 gitRepo=$1
 ownersFile=$2
-baseRepo=$3
-baseRef=$4
-headRef=$5
-prNumber=$6
-prAuthor=$7
+baseRef=$3
+headRef=$4
 
 tmp=$(mktemp -d)
 trap 'rm -rf "$tmp"' exit
@@ -98,29 +93,4 @@ for file in "${touchedFiles[@]}"; do
 
 done
 
-# Cannot request a review from the author
-if [[ -v users[${prAuthor,,}] ]]; then
-    log "One or more files are owned by the PR author, ignoring"
-    unset 'users[${prAuthor,,}]'
-fi
-
-gh api \
-    -H "Accept: application/vnd.github+json" \
-    -H "X-GitHub-Api-Version: 2022-11-28" \
-    "/repos/$baseRepo/pulls/$prNumber/reviews" \
-    --jq '.[].user.login' > "$tmp/already-reviewed-by"
-
-# And we don't want to rerequest reviews from people who already reviewed
-while read -r user; do
-    if [[ -v users[${user,,}] ]]; then
-        log "User $user is a code owner but has already left a review, ignoring"
-        unset 'users[${user,,}]'
-    fi
-done < "$tmp/already-reviewed-by"
-
-# Turn it into a JSON for the GitHub API call to request PR reviewers
-jq -n \
-    --arg users "${!users[*]}" \
-    '{
-      reviewers: $users | split(" "),
-    }'
+printf "%s\n" "${!users[@]}"

ci/request-reviews/process-reviewers.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+
+# Process reviewers for a PR, reading line-separated usernames on stdin,
+# returning a JSON suitable to be consumed by the API endpoint to request reviews:
+# https://docs.github.com/en/rest/pulls/review-requests?apiVersion=2022-11-28#request-reviewers-for-a-pull-request
+
+set -euo pipefail
+
+log() {
+    echo "$@" >&2
+}
+
+if (( "$#" < 3 )); then
+    log "Usage: $0 BASE_REPO PR_NUMBER PR_AUTHOR"
+    exit 1
+fi
+
+baseRepo=$1
+prNumber=$2
+prAuthor=$3
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' exit
+
+declare -A users=()
+while read -r handle && [[ -n "$handle" ]]; do
+    users[$handle]=
+done
+
+# Cannot request a review from the author
+if [[ -v users[${prAuthor,,}] ]]; then
+    log "One or more files are owned by the PR author, ignoring"
+    unset 'users[${prAuthor,,}]'
+fi
+
+gh api \
+    -H "Accept: application/vnd.github+json" \
+    -H "X-GitHub-Api-Version: 2022-11-28" \
+    "/repos/$baseRepo/pulls/$prNumber/reviews" \
+    --jq '.[].user.login' > "$tmp/already-reviewed-by"
+
+# And we don't want to rerequest reviews from people who already reviewed
+while read -r user; do
+    if [[ -v users[${user,,}] ]]; then
+        log "User $user is a code owner but has already left a review, ignoring"
+        unset 'users[${user,,}]'
+    fi
+done < "$tmp/already-reviewed-by"
+
+for user in "${!users[@]}"; do
+    if ! gh api \
+        -H "Accept: application/vnd.github+json" \
+        -H "X-GitHub-Api-Version: 2022-11-28" \
+        "/repos/$baseRepo/collaborators/$user" >&2; then
+        log "User $user is not a repository collaborator, probably missed the automated invite to the maintainers team (see <https://github.com/NixOS/nixpkgs/issues/234293>), ignoring"
+        unset 'users[$user]'
+    fi
+done
+
+# Turn it into a JSON for the GitHub API call to request PR reviewers
+jq -n \
+    --arg users "${!users[*]}" \
+    '{
+      reviewers: $users | split(" "),
+    }'

ci/request-reviews/request-reviews.sh

@@ -78,7 +78,8 @@ if ! "$SCRIPT_DIR"/verify-base-branch.sh "$tmp/nixpkgs.git" "$headRef" "$baseRep
 fi
 
 log "Getting code owners to request reviews from"
-"$SCRIPT_DIR"/get-reviewers.sh "$tmp/nixpkgs.git" "$ownersFile" "$baseRepo" "$baseBranch" "$headRef" "$prNumber" "$prAuthor" > "$tmp/reviewers.json"
+"$SCRIPT_DIR"/get-reviewers.sh "$tmp/nixpkgs.git" "$ownersFile" "$baseBranch" "$headRef" | \
+    "$SCRIPT_DIR"/process-reviewers.sh "$baseRepo" "$prNumber" "$prAuthor" > "$tmp/reviewers.json"
 
 log "Requesting reviews from: $(<"$tmp/reviewers.json")"
 

nixos/modules/profiles/minimal.nix

@@ -1,40 +1,46 @@
 # This module defines a small NixOS configuration.  It does not
 # contain any graphical stuff.
 
-{ config, lib, ... }:
-
-with lib;
-
 {
-  documentation.enable = mkDefault false;
+  lib,
+  ...
+}:
+let
+  inherit (lib) mkDefault;
+in
+{
+  documentation = {
+    enable = mkDefault false;
+    doc.enable = mkDefault false;
+    info.enable = mkDefault false;
+    man.enable = mkDefault false;
+    nixos.enable = mkDefault false;
+  };
 
-  documentation.doc.enable = mkDefault false;
+  environment = {
+    # Perl is a default package.
+    defaultPackages = mkDefault [ ];
+    stub-ld.enable = mkDefault false;
+  };
 
-  documentation.info.enable = mkDefault false;
-
-  documentation.man.enable = mkDefault false;
-
-  documentation.nixos.enable = mkDefault false;
-
-  # Perl is a default package.
-  environment.defaultPackages = mkDefault [ ];
-
-  environment.stub-ld.enable = mkDefault false;
-
-  # The lessopen package pulls in Perl.
-  programs.less.lessopen = mkDefault null;
+  programs = {
+    # The lessopen package pulls in Perl.
+    less.lessopen = mkDefault null;
+    command-not-found.enable = mkDefault false;
+  };
 
   # This pulls in nixos-containers which depends on Perl.
   boot.enableContainers = mkDefault false;
 
-  programs.command-not-found.enable = mkDefault false;
+  services = {
+    logrotate.enable = mkDefault false;
+    udisks2.enable = mkDefault false;
+  };
 
-  services.logrotate.enable = mkDefault false;
-
-  services.udisks2.enable = mkDefault false;
-
-  xdg.autostart.enable = mkDefault false;
-  xdg.icons.enable = mkDefault false;
-  xdg.mime.enable = mkDefault false;
-  xdg.sounds.enable = mkDefault false;
+  xdg = {
+    autostart.enable = mkDefault false;
+    icons.enable = mkDefault false;
+    mime.enable = mkDefault false;
+    sounds.enable = mkDefault false;
+  };
 }

nixos/modules/services/networking/unifi.nix

@@ -143,10 +143,10 @@ in
       restartTriggers = [ cfg.unifiPackage cfg.mongodbPackage ];
 
       serviceConfig = {
-        Type = "simple";
+        Type = "notify";
         ExecStart = "${cmd} start";
         ExecStop = "${cmd} stop";
-        Restart = "on-failure";
+        Restart = "always";
         TimeoutSec = "5min";
         User = "unifi";
         UMask = "0077";

nixos/modules/virtualisation/vmware-guest.nix

@@ -8,6 +8,7 @@ let
   inherit (lib)
     getExe'
     literalExpression
+    maintainers
     mkEnableOption
     mkIf
     mkOption
@@ -25,7 +26,7 @@ in
   ];
 
   meta = {
-    maintainers = [ lib.maintainers.kjeremy ];
+    maintainers = [ maintainers.kjeremy ];
   };
 
   options.virtualisation.vmware.guest = {

pkgs/applications/audio/greg/default.nix

@@ -14,7 +14,7 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "manolomartinez";
     repo = pname;
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     sha256 = "sha256-o4+tXVJTgT52JyJOC+Glr2cvZjbTaZL8TIsmz+A4vE4=";
   };
 

pkgs/applications/audio/littlegptracker/default.nix

@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "djdiskmachine";
     repo = "littlegptracker";
-    rev = "refs/tags/${finalAttrs.version}";
+    tag = finalAttrs.version;
     hash = "sha256-1uXC5nJ63YguQuNIkuK0yx9lmrMBqw0WdlmCV8o11cE=";
   };
 

pkgs/applications/audio/pithos/default.nix

@@ -24,7 +24,7 @@ pythonPackages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = "refs/tags/${version}";
+    tag = version;
     hash = "sha256-3j6IoMi30BQ8WHK4BxbsW+/3XZx7rBFd47EBENa2GiQ=";
   };
 

pkgs/applications/audio/puddletag/default.nix

@@ -16,7 +16,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "puddletag";
     repo = "puddletag";
-    rev = "refs/tags/${version}";
+    tag = version;
     hash = "sha256-oScT8YcQoDf2qZ+J7xKm22Sbfym3tkVUrWT5D2LU5e8=";
   };
 

pkgs/applications/audio/zynaddsubfx/default.nix

@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = "refs/tags/${version}";
+    tag = version;
     fetchSubmodules = true;
     hash = "sha256-0siAx141DZx39facXWmKbsi0rHBNpobApTdey07EcXg=";
   };

pkgs/applications/editors/lapce/default.nix

@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "lapce";
     repo = "lapce";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     sha256 = "sha256-vBBYNHgZiW5JfGeUG6YZObf4oK0hHxTbsZNTfnIX95Y=";
   };
 

pkgs/applications/editors/manuskript/default.nix

@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     repo = pname;
     owner = "olivierkes";
-    rev = "refs/tags/${version}";
+    tag = version;
     hash = "sha256-/Ryvv5mHdZ3iwMpZjOa62h8D2B00pzknJ70DfjDTPPA=";
   };
 

pkgs/applications/editors/retext/default.nix

@@ -25,7 +25,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "retext-project";
     repo = pname;
-    rev = "refs/tags/${version}";
+    tag = version;
     hash = "sha256-BToW9rPFEbgAErvJ5gtUpNadCLtlRihE7eKKFgO5N68=";
   };
 

pkgs/applications/editors/rstudio/clang-location.patch

@@ -1,38 +1,23 @@
+diff --git a/src/cpp/core/libclang/LibClang.cpp b/src/cpp/core/libclang/LibClang.cpp
+index f166a43b37..d8024b2ce7 100644
 --- a/src/cpp/core/libclang/LibClang.cpp
 +++ b/src/cpp/core/libclang/LibClang.cpp
-@@ -62,7 +62,7 @@
- 
-    // we need to add in the associated libclang headers as
-    // they are not discovered / used by default during compilation
--   FilePath llvmPath = s_libraryPath.getParent().getParent();
-+   FilePath llvmPath("@libclang@");
-    boost::format fmt("%1%/lib/clang/%2%/include");
-    fmt % llvmPath.getAbsolutePath() % version.asString();
-    std::string includePath = fmt.str();
-@@ -74,47 +74,7 @@
- 
- std::vector<std::string> systemClangVersions()
- {
--   std::vector<std::string> clangVersions;
--   
--#if defined(__APPLE__)
--   // NOTE: the version of libclang.dylib bundled with Xcode
--   // doesn't seem to work well when loaded as a library
--   // (there seems to be extra orchestration required to get
--   // include paths set up; easier to just depend on command
--   // line tools since we request their installation in other
--   // contexts as well)
--   clangVersions = {
+@@ -84,34 +84,13 @@ std::vector<std::string> systemClangVersions()
+    // line tools since we request their installation in other
+    // contexts as well)
+    clangVersions = {
 -      "/Library/Developer/CommandLineTools/usr/lib/libclang.dylib"
--   };
--#elif defined(__unix__)
--   // default set of versions
--   clangVersions = {
++      "@libclang@/lib/libclang.dylib"
+    };
+ #elif defined(__unix__)
+    // default set of versions
+    clangVersions = {
 -      "/usr/lib/libclang.so",
 -      "/usr/lib/llvm/libclang.so",
 -      "/usr/lib64/libclang.so",
 -      "/usr/lib64/llvm/libclang.so",
--   };
++      "@libclang@/lib/libclang.so",
+    };
 -   
 -   // iterate through the set of available 'llvm' directories
 -   for (const char* prefix : {"/usr/lib", "/usr/lib64"})
@@ -51,11 +36,6 @@
 -         if (path.getFilename().find("llvm") == 0)
 -            clangVersions.push_back(path.completePath("lib/libclang.so.1").getAbsolutePath());
 -   }
--#endif
--   
--   return clangVersions;
-+    return std::vector<std::string> { "@libclang.so@" };
- }
- 
- 
-
+ #endif
+    
+    return clangVersions;

pkgs/applications/editors/rstudio/default.nix

@@ -1,67 +1,39 @@
-{ lib
-, stdenv
-, mkDerivation
-, fetchurl
-, fetchFromGitHub
-, makeDesktopItem
-, copyDesktopItems
-, cmake
-, boost183
-, zlib
-, openssl
-, R
-, qtbase
-, qtxmlpatterns
-, qtsensors
-, qtwebengine
-, qtwebchannel
-, quarto
-, libuuid
-, hunspellDicts
-, unzip
-, ant
-, jdk
-, gnumake
-, pandoc
-, llvmPackages
-, yaml-cpp
-, soci
-, postgresql
-, nodejs
-, qmake
-, server ? false # build server version
-, sqlite
-, pam
-, nixosTests
+{
+  lib,
+  stdenv,
+  fetchzip,
+  fetchFromGitHub,
+  replaceVars,
+  cmake,
+  boost183,
+  zlib,
+  openssl,
+  R,
+  libsForQt5,
+  quarto,
+  libuuid,
+  hunspellDicts,
+  ant,
+  jdk,
+  gnumake,
+  pandoc,
+  llvmPackages,
+  yaml-cpp,
+  soci,
+  sqlite,
+  nodejs,
+  yarn,
+  yarnConfigHook,
+  fetchYarnDeps,
+  server ? false, # build server version
+  pam,
+  nixosTests,
 }:
 
 let
-  pname = "RStudio";
-  version = "2024.04.2+764";
-  RSTUDIO_VERSION_MAJOR = lib.versions.major version;
-  RSTUDIO_VERSION_MINOR = lib.versions.minor version;
-  RSTUDIO_VERSION_PATCH = lib.versions.patch version;
-  RSTUDIO_VERSION_SUFFIX = "+" + toString (
-    lib.tail (lib.splitString "+" version)
-  );
-
-  src = fetchFromGitHub {
-    owner = "rstudio";
-    repo = "rstudio";
-    rev = "v" + version;
-    hash = "sha256-j258eW1MYQrB6kkpjyolXdNuwQ3zSWv9so4q0QLsZuw=";
-  };
-
-  mathJaxSrc = fetchurl {
+  mathJaxSrc = fetchzip {
     url = "https://s3.amazonaws.com/rstudio-buildtools/mathjax-27.zip";
-    hash = "sha256-xWy6psTOA8H8uusrXqPDEtL7diajYCVHcMvLiPsgQXY=";
-  };
-
-  rsconnectSrc = fetchFromGitHub {
-    owner = "rstudio";
-    repo = "rsconnect";
-    rev = "v1.2.2";
-    hash = "sha256-wvM9Bm7Nb6yU9z0o+uF5lB2kdgjOW5wZSk6y48NPF2U=";
+    hash = "sha256-J7SZK/9q3HcXTD7WFHxvh++ttuCd89Vc4SEBrUEU0AI=";
   };
 
   # Ideally, rev should match the rstudio release name.
@@ -73,24 +45,46 @@ let
     hash = "sha256-lZnZvioztbBWWa6H177X6rRrrgACx2gMjVFDgNup93g=";
   };
 
-  description = "Set of integrated tools for the R language";
+  hunspellDictionaries = lib.filter lib.isDerivation (lib.unique (lib.attrValues hunspellDicts));
+  # These dicts contain identically-named dict files, so we only keep the
+  # -large versions in case of clashes
+  largeDicts = lib.filter (d: lib.hasInfix "-large-wordlist" d.name) hunspellDictionaries;
+  otherDicts = lib.filter (
+    d: !(lib.hasAttr "dictFileName" d && lib.elem d.dictFileName (map (d: d.dictFileName) largeDicts))
+  ) hunspellDictionaries;
+  dictionaries = largeDicts ++ otherDicts;
 in
-(if server then stdenv.mkDerivation else mkDerivation)
-  (rec {
-    inherit pname version src RSTUDIO_VERSION_MAJOR RSTUDIO_VERSION_MINOR RSTUDIO_VERSION_PATCH RSTUDIO_VERSION_SUFFIX;
+stdenv.mkDerivation rec {
+  pname = "RStudio";
+  version = "2024.04.2+764";
 
-    nativeBuildInputs = [
+  RSTUDIO_VERSION_MAJOR = lib.versions.major version;
+  RSTUDIO_VERSION_MINOR = lib.versions.minor version;
+  RSTUDIO_VERSION_PATCH = lib.versions.patch version;
+  RSTUDIO_VERSION_SUFFIX = "+" + toString (lib.tail (lib.splitString "+" version));
+
+  src = fetchFromGitHub {
+    owner = "rstudio";
+    repo = "rstudio";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-j258eW1MYQrB6kkpjyolXdNuwQ3zSWv9so4q0QLsZuw=";
+  };
+
+  nativeBuildInputs =
+    [
       cmake
-      unzip
       ant
       jdk
-      pandoc
       nodejs
-    ] ++ lib.optionals (!server) [
-      copyDesktopItems
+      yarn
+      yarnConfigHook
+    ]
+    ++ lib.optionals (!server) [
+      libsForQt5.wrapQtAppsHook
     ];
 
-    buildInputs = [
+  buildInputs =
+    [
       boost183
       zlib
       openssl
@@ -98,153 +92,130 @@ in
       libuuid
       yaml-cpp
       soci
-      postgresql
-      quarto
-    ] ++ (if server then [
       sqlite.dev
-      pam
-    ] else [
-      qtbase
-      qtxmlpatterns
-      qtsensors
-      qtwebengine
-      qtwebchannel
-    ]);
-
-    cmakeFlags = [
-      "-DRSTUDIO_TARGET=${if server then "Server" else "Desktop"}"
-      "-DRSTUDIO_USE_SYSTEM_SOCI=ON"
-      "-DRSTUDIO_USE_SYSTEM_BOOST=ON"
-      "-DRSTUDIO_USE_SYSTEM_YAML_CPP=ON"
-      "-DRSTUDIO_DISABLE_CHECK_FOR_UPDATES=ON"
-      "-DQUARTO_ENABLED=TRUE"
-      "-DPANDOC_VERSION=${pandoc.version}"
-      "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}/lib/rstudio"
-    ] ++ lib.optionals (!server) [
-      "-DQT_QMAKE_EXECUTABLE=${qmake}/bin/qmake"
+    ]
+    ++ lib.optionals server [ pam ]
+    ++ lib.optionals (!server) [
+      libsForQt5.qtbase
+      libsForQt5.qtxmlpatterns
+      libsForQt5.qtsensors
+      libsForQt5.qtwebengine
+      libsForQt5.qtwebchannel
     ];
 
+  cmakeFlags =
+    [
+      (lib.cmakeFeature "RSTUDIO_TARGET" (if server then "Server" else "Desktop"))
+      (lib.cmakeBool "RSTUDIO_USE_SYSTEM_SOCI" true)
+      (lib.cmakeBool "RSTUDIO_USE_SYSTEM_BOOST" true)
+      (lib.cmakeBool "RSTUDIO_USE_SYSTEM_YAML_CPP" true)
+      (lib.cmakeBool "RSTUDIO_DISABLE_CHECK_FOR_UPDATES" true)
+      (lib.cmakeBool "QUARTO_ENABLED" true)
+      (lib.cmakeFeature "CMAKE_INSTALL_PREFIX" "${placeholder "out"}/lib/rstudio")
+    ]
+    ++ lib.optionals (!server) [
+      (lib.cmakeFeature "QT_QMAKE_EXECUTABLE" "${libsForQt5.qmake}/bin/qmake")
+      (lib.cmakeBool "RSTUDIO_INSTALL_FREEDESKTOP" true)
+    ];
+
+  patches = [
     # Hack RStudio to only use the input R and provided libclang.
-    patches = [
-      ./r-location.patch
-      ./clang-location.patch
-      ./use-system-node.patch
-      ./fix-resources-path.patch
-      ./pandoc-nix-path.patch
-      ./use-system-quarto.patch
-      ./ignore-etc-os-release.patch
-    ];
+    (replaceVars ./r-location.patch {
+      R = lib.getBin R;
+    })
+    (replaceVars ./clang-location.patch {
+      libclang = lib.getLib llvmPackages.libclang;
+    })
 
-    postPatch = ''
-      substituteInPlace src/cpp/core/r_util/REnvironmentPosix.cpp --replace-fail '@R@' ${R}
+    ./fix-resources-path.patch
+    ./ignore-etc-os-release.patch
+    ./dont-yarn-install.patch
+    ./dont-assume-pandoc-in-quarto.patch
+  ];
 
-      substituteInPlace src/gwt/build.xml \
-        --replace-fail '@node@' ${nodejs} \
-        --replace-fail './lib/quarto' ${quartoSrc}
+  postPatch = ''
+    # fix .desktop Exec field
+    substituteInPlace src/node/desktop/resources/freedesktop/rstudio.desktop.in \
+      --replace-fail "''${CMAKE_INSTALL_PREFIX}/rstudio" "rstudio"
 
-      substituteInPlace src/cpp/conf/rsession-dev.conf \
-        --replace-fail '@node@' ${nodejs}
+    # set install path of freedesktop files
+    substituteInPlace src/{cpp,node}/desktop/CMakeLists.txt \
+      --replace-fail "/usr/share" "$out/share"
+  '';
 
-      substituteInPlace src/cpp/core/libclang/LibClang.cpp \
-        --replace-fail '@libclang@' ${lib.getLib llvmPackages.libclang} \
-        --replace-fail '@libclang.so@' ${lib.getLib llvmPackages.libclang}/lib/libclang.so
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = quartoSrc + "/yarn.lock";
+    hash = "sha256-Qw8O1Jzl2EO0DEF3Jrw/cIT9t22zs3jyKgDA5XZbuGA=";
+  };
 
-      substituteInPlace src/cpp/session/CMakeLists.txt \
-        --replace-fail '@pandoc@' ${pandoc} \
-        --replace-fail '@quarto@' ${quarto}
+  dontYarnInstallDeps = true; # will call manually in preConfigure
 
-      substituteInPlace src/cpp/session/include/session/SessionConstants.hpp \
-        --replace-fail '@pandoc@' ${pandoc}/bin \
-        --replace-fail '@quarto@' ${quarto}
-    '';
+  preConfigure = ''
+    # set up node_modules directory inside quarto so that panmirror can be built
+    mkdir src/gwt/lib/quarto
+    cp -r --no-preserve=all ${quartoSrc}/* src/gwt/lib/quarto
+    pushd src/gwt/lib/quarto
+    yarnConfigHook
+    popd
 
-    hunspellDictionaries = lib.filter lib.isDerivation (lib.unique (lib.attrValues hunspellDicts));
-    # These dicts contain identically-named dict files, so we only keep the
-    # -large versions in case of clashes
-    largeDicts = lib.filter (d: lib.hasInfix "-large-wordlist" d.name) hunspellDictionaries;
-    otherDicts = lib.filter
-      (d: !(lib.hasAttr "dictFileName" d &&
-        lib.elem d.dictFileName (map (d: d.dictFileName) largeDicts)))
-      hunspellDictionaries;
-    dictionaries = largeDicts ++ otherDicts;
+    ### set up dependencies that will be copied into the result
+    # note: only the directory names have to match upstream, the actual versions don't
+    # note: symlinks are preserved
 
-    preConfigure = ''
-      mkdir dependencies/dictionaries
-      for dict in ${builtins.concatStringsSep " " dictionaries}; do
-        for i in "$dict/share/hunspell/"*; do
-          ln -s $i dependencies/dictionaries/
-        done
+    mkdir dependencies/dictionaries
+    for dict in ${builtins.concatStringsSep " " dictionaries}; do
+      for i in "$dict/share/hunspell/"*; do
+        ln -s $i dependencies/dictionaries/
       done
+    done
 
-      unzip -q ${mathJaxSrc} -d dependencies/mathjax-27
+    ln -s ${quarto} dependencies/quarto
 
-     # As of Chocolate Cosmos, node 18.20.3 is used for runtime
-     # 18.18.2 is still used for build
-     # see https://github.com/rstudio/rstudio/commit/facb5cf1ab38fe77813aaf36590804e4f865d780
-     mkdir -p dependencies/common/node/18.20.3
+    # version in dependencies/common/install-mathjax
+    ln -s ${mathJaxSrc} dependencies/mathjax-27
 
-      mkdir -p dependencies/pandoc/${pandoc.version}
-      cp ${pandoc}/bin/pandoc dependencies/pandoc/${pandoc.version}/pandoc
+    # version in CMakeGlobals.txt (PANDOC_VERSION)
+    mkdir -p dependencies/pandoc/2.18
+    ln -s ${lib.getBin pandoc}/bin/* dependencies/pandoc/2.18
 
-      cp -r ${rsconnectSrc} dependencies/rsconnect
-      ( cd dependencies && ${R}/bin/R CMD build -d --no-build-vignettes rsconnect )
-    '';
+    # version in CMakeGlobals.txt (RSTUDIO_INSTALLED_NODE_VERSION)
+    mkdir -p dependencies/common/node
+    ln -s ${nodejs} dependencies/common/node/18.20.3
+  '';
 
-    postInstall = ''
-      mkdir -p $out/bin $out/share
+  postInstall = ''
+    mkdir -p $out/bin
 
-      ${lib.optionalString (!server) ''
-        mkdir -p $out/share/icons/hicolor/48x48/apps
-        ln $out/lib/rstudio/rstudio.png $out/share/icons/hicolor/48x48/apps
-      ''}
+    ${lib.optionalString server ''
+      ln -s $out/lib/rstudio/bin/{crash-handler-proxy,postback,r-ldpath,rpostback,rserver,rserver-pam,rsession,rstudio-server} $out/bin
+    ''}
 
-      for f in {${if server
-        then "crash-handler-proxy,postback,r-ldpath,rpostback,rserver,rserver-pam,rsession,rstudio-server"
-        else "diagnostics,rpostback,rstudio"}}; do
-        ln -s $out/lib/rstudio/bin/$f $out/bin
-      done
+    ${lib.optionalString (!server) ''
+      ln -s $out/lib/rstudio/bin/{diagnostics,rpostback,rstudio} $out/bin
+    ''}
+  '';
 
-      for f in .gitignore .Rbuildignore LICENSE README; do
-        find . -name $f -delete
-      done
+  qtWrapperArgs = lib.optionals (!server) [
+    "--suffix PATH : ${lib.makeBinPath [ gnumake ]}"
+  ];
 
-      rm -r $out/lib/rstudio/{INSTALL,COPYING,NOTICE,README.md,SOURCE,VERSION}
-    '';
-
-    meta = {
-      broken = (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64);
-      inherit description;
-      homepage = "https://www.rstudio.com/";
-      license = lib.licenses.agpl3Only;
-      maintainers = with lib.maintainers; [ ciil cfhammill ];
-      mainProgram = "rstudio" + lib.optionalString server "-server";
-      platforms = lib.platforms.linux;
+  passthru = {
+    inherit server;
+    tests = {
+      inherit (nixosTests) rstudio-server;
     };
+  };
 
-    passthru = {
-      inherit server;
-      tests = { inherit (nixosTests) rstudio-server; };
-    };
-  } // lib.optionalAttrs (!server) {
-    qtWrapperArgs = [
-      "--suffix PATH : ${lib.makeBinPath [ gnumake ]}"
+  meta = {
+    broken = (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64);
+    description = "Set of integrated tools for the R language";
+    homepage = "https://www.rstudio.com/";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [
+      ciil
+      cfhammill
     ];
-
-    desktopItems = [
-      (makeDesktopItem {
-        name = pname;
-        exec = "rstudio %F";
-        icon = "rstudio";
-        desktopName = "RStudio";
-        genericName = "IDE";
-        comment = description;
-        categories = [ "Development" ];
-        mimeTypes = [
-          "text/x-r-source" "text/x-r" "text/x-R" "text/x-r-doc" "text/x-r-sweave" "text/x-r-markdown"
-          "text/x-r-html" "text/x-r-presentation" "application/x-r-data" "application/x-r-project"
-          "text/x-r-history" "text/x-r-profile" "text/x-tex" "text/x-markdown" "text/html"
-          "text/css" "text/javascript" "text/x-chdr" "text/x-csrc" "text/x-c++hdr" "text/x-c++src"
-        ];
-      })
-    ];
-  })
+    mainProgram = "rstudio" + lib.optionalString server "-server";
+    platforms = lib.platforms.linux;
+  };
+}

pkgs/applications/editors/rstudio/dont-assume-pandoc-in-quarto.patch

@@ -0,0 +1,48 @@
+diff --git a/src/cpp/session/CMakeLists.txt b/src/cpp/session/CMakeLists.txt
+index 0202e84..596b9f8 100644
+--- a/src/cpp/session/CMakeLists.txt
++++ b/src/cpp/session/CMakeLists.txt
+@@ -59,11 +59,7 @@ endif()
+ 
+ 
+ # install pandoc
+-# - by default, we use quarto + quarto's bundled pandoc
+-# - if quarto is not enabled, use pandoc fallback
+-if(QUARTO_ENABLED)
+-   set(RSTUDIO_DEPENDENCIES_PANDOC_DIR "${RSTUDIO_DEPENDENCIES_QUARTO_DIR}/bin/tools")
+-elseif(EXISTS "${RSTUDIO_TOOLS_ROOT}/pandoc/${PANDOC_VERSION}")
++if(EXISTS "${RSTUDIO_TOOLS_ROOT}/pandoc/${PANDOC_VERSION}")
+    set(RSTUDIO_DEPENDENCIES_PANDOC_DIR "${RSTUDIO_TOOLS_ROOT}/pandoc/${PANDOC_VERSION}")
+ else()
+    set(RSTUDIO_DEPENDENCIES_PANDOC_DIR "${RSTUDIO_DEPENDENCIES_DIR}/pandoc/${PANDOC_VERSION}")
+@@ -733,11 +729,10 @@ if(NOT RSTUDIO_SESSION_WIN32 AND NOT RSESSION_ALTERNATE_BUILD)
+                PATTERN ".gitignore"
+                EXCLUDE)
+       endif()
+-   else()
+-      install(DIRECTORY "${RSTUDIO_DEPENDENCIES_PANDOC_DIR}/"
+-              DESTINATION "${RSTUDIO_INSTALL_BIN}/pandoc"
+-              USE_SOURCE_PERMISSIONS)
+    endif()
++   install(DIRECTORY "${RSTUDIO_DEPENDENCIES_PANDOC_DIR}/"
++           DESTINATION "${RSTUDIO_INSTALL_BIN}/pandoc"
++           USE_SOURCE_PERMISSIONS)
+ 
+    # install embedded packages
+    foreach(PKG ${RSTUDIO_EMBEDDED_PACKAGES})
+diff --git a/src/cpp/session/include/session/SessionConstants.hpp b/src/cpp/session/include/session/SessionConstants.hpp
+index e6aef22..57491ec 100644
+--- a/src/cpp/session/include/session/SessionConstants.hpp
++++ b/src/cpp/session/include/session/SessionConstants.hpp
+@@ -147,11 +147,7 @@
+ #define kSessionTmpDirEnvVar       "RS_SESSION_TMP_DIR"
+ #define kSessionTmpDir             "rstudio-rsession"
+ 
+-#ifdef QUARTO_ENABLED
+-# define kDefaultPandocPath        "bin/quarto/bin/tools"
+-#else
+ # define kDefaultPandocPath        "bin/pandoc"
+-#endif
+ 
+ #define kDefaultNodePath           "bin/node"
+ #define kDefaultQuartoPath         "bin/quarto"

pkgs/applications/editors/rstudio/dont-yarn-install.patch

@@ -0,0 +1,16 @@
+diff --git a/src/gwt/build.xml b/src/gwt/build.xml
+index 27ffe33..4218678 100644
+--- a/src/gwt/build.xml
++++ b/src/gwt/build.xml
+@@ -139,11 +139,6 @@
+       <echo message="panmirror minify: ${panmirror.minify}"/>
+ 
+       <mkdir dir="${panmirror.build.dir}"/>
+-      <exec executable="${yarn.bin}" dir="${panmirror.dir}" resolveexecutable="true" failonerror="true">
+-         <arg value="install"/>
+-         <arg value="--network-timeout"/>
+-         <arg value="240000"/>
+-      </exec>
+       <exec executable="${yarn.bin}" dir="${panmirror.dir}" resolveexecutable="true" failonerror="true">
+          <arg value="build"/>
+          <arg value="--minify"/>

pkgs/applications/editors/rstudio/pandoc-nix-path.patch

@@ -1,18 +0,0 @@
---- a/src/cpp/session/include/session/SessionConstants.hpp
-+++ b/src/cpp/session/include/session/SessionConstants.hpp
-@@ -142,13 +142,13 @@
- #define kSessionTmpDir             "rstudio-rsession"
- 
- #ifdef QUARTO_ENABLED
--# define kDefaultPandocPath        "bin/quarto/bin/tools"
-+# define kDefaultPandocPath        "@pandoc@"
- #else
- # define kDefaultPandocPath        "bin/pandoc"
- #endif
- 
- #define kDefaultNodePath           "bin/node"
--#define kDefaultQuartoPath         "bin/quarto"
-+#define kDefaultQuartoPath         "@quarto@"
- #define kDefaultRsclangPath        "bin/rsclang"
- 
- #ifdef _WIN32

pkgs/applications/editors/rstudio/use-system-node.patch

@@ -1,81 +0,0 @@
-diff --git a/src/cpp/conf/rsession-dev.conf b/src/cpp/conf/rsession-dev.conf
-index d18362b..98cdd4c 100644
---- a/src/cpp/conf/rsession-dev.conf
-+++ b/src/cpp/conf/rsession-dev.conf
-@@ -39,7 +39,7 @@ external-mathjax-path=${RSTUDIO_DEPENDENCIES_MATHJAX_DIR}
- external-pandoc-path=${RSTUDIO_DEPENDENCIES_PANDOC_DIR}
- external-quarto-path=${RSTUDIO_DEPENDENCIES_QUARTO_DIR}
- external-libclang-path=${RSTUDIO_DEPENDENCIES_DIR}/common/libclang
--external-node-path=${RSTUDIO_DEPENDENCIES_DIR}/common/node/18.18.2/bin/node
-+external-node-path=@node@/bin/node
- 
- # enable copilot
- copilot-enabled=1
-diff --git a/src/gwt/build.xml b/src/gwt/build.xml
-index 033d605..f1ee63d 100644
---- a/src/gwt/build.xml
-+++ b/src/gwt/build.xml
-@@ -87,29 +87,7 @@
-    <!-- ensure version matches RSTUDIO_NODE_VERSION -->
-    <property name="node.version" value="18.18.2"/>
-    <property name="node.dir" value="../../dependencies/common/node/${node.version}"/>
--   <!-- use yarn from system but will prefer yarn from dependencies if available -->
--   <condition property="yarn.bin" value="yarn">
--     <not>
--        <os family="windows" />
--     </not>
--   </condition>
--   <available
--      property="yarn.bin"
--      value="${node.dir}/bin/yarn"
--      file="${node.dir}/bin/yarn"/>
--   <condition property="yarn.bin" value="${node.dir}/node_modules/yarn/bin/yarn.cmd">
--     <os family="windows" />
--   </condition>
--   <!-- use yarn from /opt/rstudio-tools if installed (typical for Docker) -->
--   <available
--      property="yarn.bin"
--      value="/opt/rstudio-tools/dependencies/common/node/${node.version}/bin/yarn"
--      file="/opt/rstudio-tools/dependencies/common/node/${node.version}/bin/yarn"/>
--   <!-- use yarn from c:/rstudio-tools if installed (typical for Docker on Windows) -->
--   <available
--      property="yarn.bin"
--      value="c:\rstudio-tools\dependencies\common\node\${node.version}\node_modules\yarn\bin\yarn.cmd"
--      file="c:\rstudio-tools\dependencies\common\node\${node.version}\node_modules\yarn\bin\yarn.cmd"/>
-+   <property name="node.bin" value="@node@/bin/node"/>
-
-    <property name="panmirror.dir" value="./lib/quarto/apps/panmirror"/>
-    <property name="panmirror.build.dir" value="./www/js/panmirror"/>
-@@ -133,28 +111,11 @@
-             <isset property="panmirror.minify" />
-          </not>
-       </condition>
--
--      <echo message="yarn location: ${yarn.bin}"/>
--      <echo message="panmirror location: ${panmirror.dir}"/>
--      <echo message="panmirror minify: ${panmirror.minify}"/>
--
-       <mkdir dir="${panmirror.build.dir}"/>
--      <exec executable="${yarn.bin}" dir="${panmirror.dir}" resolveexecutable="true" failonerror="true">
--         <arg value="install"/>
--         <arg value="--network-timeout"/>
--         <arg value="240000"/>
--      </exec>
--      <exec executable="${yarn.bin}" dir="${panmirror.dir}" resolveexecutable="true" failonerror="true">
--         <arg value="build"/>
--         <arg value="--minify"/>
--         <arg value="${panmirror.minify}"/>
--         <arg value="--sourcemap"/>
--         <arg value="true"/>
--         <env key="PANMIRROR_OUTDIR" value="dist-rstudio"/>
-+     <exec executable="${node.bin}" dir="${panmirror.dir}" spawn="${panmirror.spawn}">
-+          <arg value="fuse"/>
-+          <arg value="${panmirror.target}"/>
-       </exec>
--      <copy todir="${panmirror.build.dir}">
--         <fileset dir="${panmirror.dir}/dist-rstudio"/>
--      </copy>
-    </target>
-
-    <target name="javac" description="Compile java source">
-    

pkgs/applications/editors/rstudio/use-system-quarto.patch

@@ -1,46 +0,0 @@
---- a/src/cpp/session/CMakeLists.txt
-+++ b/src/cpp/session/CMakeLists.txt
-@@ -36,18 +36,14 @@
-    else()
-       set(RSTUDIO_DEPENDENCIES_DICTIONARIES_DIR "${RSTUDIO_DEPENDENCIES_DIR}/dictionaries")
-    endif()
--   
-+
-    if(EXISTS "${RSTUDIO_TOOLS_ROOT}/mathjax-27")
-       set(RSTUDIO_DEPENDENCIES_MATHJAX_DIR "${RSTUDIO_TOOLS_ROOT}/mathjax-27")
-    else()
-       set(RSTUDIO_DEPENDENCIES_MATHJAX_DIR "${RSTUDIO_DEPENDENCIES_DIR}/mathjax-27")
-    endif()
- 
--   if(EXISTS "${RSTUDIO_TOOLS_ROOT}/quarto")
--      set(RSTUDIO_DEPENDENCIES_QUARTO_DIR "${RSTUDIO_TOOLS_ROOT}/quarto")
--   else()
--      set(RSTUDIO_DEPENDENCIES_QUARTO_DIR "${RSTUDIO_DEPENDENCIES_DIR}/quarto")
--   endif()
-+   set(RSTUDIO_DEPENDENCIES_QUARTO_DIR "@quarto@")
- 
- endif()
- 
-@@ -56,7 +52,7 @@
- # - by default, we use quarto + quarto's bundled pandoc
- # - if quarto is not enabled, use pandoc fallback
- if(QUARTO_ENABLED)
--   set(RSTUDIO_DEPENDENCIES_PANDOC_DIR "${RSTUDIO_DEPENDENCIES_QUARTO_DIR}/bin/tools")
-+   set(RSTUDIO_DEPENDENCIES_PANDOC_DIR "@pandoc@/bin")
- elseif(EXISTS "${RSTUDIO_TOOLS_ROOT}/pandoc/${PANDOC_VERSION}")
-    set(RSTUDIO_DEPENDENCIES_PANDOC_DIR "${RSTUDIO_TOOLS_ROOT}/pandoc/${PANDOC_VERSION}")
- else()
-@@ -66,11 +62,9 @@
- 
- # validate our dependencies exist
- foreach(VAR RSTUDIO_DEPENDENCIES_DICTIONARIES_DIR
--            RSTUDIO_DEPENDENCIES_MATHJAX_DIR
--            RSTUDIO_DEPENDENCIES_PANDOC_DIR
--            RSTUDIO_DEPENDENCIES_QUARTO_DIR)
-+            RSTUDIO_DEPENDENCIES_MATHJAX_DIR)
-+
- 
-- 
-    # skip quarto if not enabled
-    if("${VAR}" STREQUAL "RSTUDIO_DEPENDENCIES_QUARTO_DIR" AND NOT QUARTO_ENABLED)
-       continue()

pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix

@@ -1,15 +1,37 @@
 {
+  stdenvNoCC,
   lib,
   vscode-utils,
 }:
 
 vscode-utils.buildVscodeMarketplaceExtension {
-  mktplcRef = {
-    name = "visualjj";
-    publisher = "visualjj";
-    version = "0.13.4";
-    hash = "sha256-/uuLRkEY430R5RS7B6972iginpA3pWpApjI6RUTxcHM=";
-  };
+  mktplcRef =
+    let
+      sources = {
+        "x86_64-linux" = {
+          arch = "linux-x64";
+          hash = "sha256-q9ubYkhrV28sB9CV1dyBEIFEkTrkGHRXdz5+4xjeVzI=";
+        };
+        "x86_64-darwin" = {
+          arch = "darwin-x64";
+          hash = "sha256-vV5u1QBICz3GIYRgH9UWM38a8YXtvW0u8r7c1SaKwxM=";
+        };
+        "aarch64-linux" = {
+          arch = "linux-arm64";
+          hash = "sha256-fgT4brIhHI6gNCcsbHpz+v4/diyox2VoFlvCnhPIbPM=";
+        };
+        "aarch64-darwin" = {
+          arch = "darwin-arm64";
+          hash = "sha256-/uuLRkEY430R5RS7B6972iginpA3pWpApjI6RUTxcHM=";
+        };
+      };
+    in
+    {
+      name = "visualjj";
+      publisher = "visualjj";
+      version = "0.13.4";
+    }
+    // sources.${stdenvNoCC.system} or (throw "Unsupported system ${stdenvNoCC.system}");
 
   meta = {
     description = "Jujutsu version control integration, for simpler Git workflow";

pkgs/applications/emulators/dolphin-emu/default.nix

@@ -60,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "dolphin-emu";
     repo = "dolphin";
-    rev = "refs/tags/${finalAttrs.version}";
+    tag = finalAttrs.version;
     hash = "sha256-5Eir8EQPGVSg2QXzzuHH9lf7CrV76KwmRsHiDqs6tD4=";
     fetchSubmodules = true;
   };

pkgs/applications/graphics/eddy/default.nix

@@ -13,7 +13,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "obdasystems";
     repo = pname;
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     sha256 = "sha256-vRmLUIqU0qfcnKzymBGb9gfM/uQiAcUHUnyz8iH/GrM=";
   };
 

pkgs/applications/graphics/f3d/default.nix

@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "f3d-app";
     repo = "f3d";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-S3eigdW6rkDRSm4uCCTFHx5fhJGNVWpAAAKboougr08=";
   };
 

pkgs/applications/graphics/hydrus/default.nix

@@ -21,7 +21,7 @@ python3Packages.buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-i9XeZJgB0oDimoc0D5UTYSBs9C55QXC6HIxv2gP8vWY=";
   };
 

pkgs/applications/graphics/inkscape/extensions/silhouette/default.nix

@@ -30,7 +30,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "fablabnbg";
     repo = pname;
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     sha256 = "sha256-MfR88BuaAx6n5XRIjslpIk4PnDf6TLU9AsmHxKkcFS0=";
   };
 

pkgs/applications/graphics/inkscape/extensions/textext/default.nix

@@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "textext";
     repo = "textext";
-    rev = "refs/tags/${version}";
+    tag = version;
     sha256 = "sha256-JbI/ScCFCvHbK9JZzHuT67uSAL3546et+gtTkwRnCSE=";
   };
 

pkgs/applications/graphics/ipe/default.nix

@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "otfried";
     repo = "ipe";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-bvwEgEP/cinigixJr8e964sm6secSK+7Ul7WFfwM0gE=";
   };
 

pkgs/applications/misc/cask-server/default.nix

@@ -13,7 +13,7 @@ mkDerivation rec {
   src = fetchFromGitHub {
     owner = "Nitrux";
     repo = pname;
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     sha256 = "sha256-XUgLtZMcvzGewtUcgu7FbBCn/1zqOjWvw2AI9gUwWkc=";
   };
 

pkgs/applications/misc/databricks-sql-cli/default.nix

@@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "databricks-sql-cli";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-wmwXw1o+pRsRjA7ai9x5o1el7mNBqM6xlGrvw0IqfMo=";
   };
 

pkgs/applications/misc/electron-cash/default.nix

@@ -8,7 +8,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "Electron-Cash";
     repo = "Electron-Cash";
-    rev = "refs/tags/${version}";
+    tag = version;
     sha256 = "sha256-xOyj5XerOwgfvI0qj7+7oshDvd18h5IeZvcJTis8nWo=";
   };
 

pkgs/applications/misc/golden-cheetah/default.nix

@@ -40,7 +40,7 @@ mkDerivation rec {
   src = fetchFromGitHub {
     owner = "GoldenCheetah";
     repo = "GoldenCheetah";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-6JAdnYaKULJsc/zdcTMbCkbOCbiVtnJivEazDKL721c=";
   };
 

pkgs/applications/misc/gramps/default.nix

@@ -33,7 +33,7 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "gramps-project";
     repo = "gramps";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-DfKKB+rgMGQ8HTqhCp11UTYLj3Fdd0B0v4a922GJ8L8=";
   };
 

pkgs/applications/misc/html5validator/default.nix

@@ -13,7 +13,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "svenkreiss";
     repo = "html5validator";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-yvclqE4+2R9q/UJU9W95U1/xVJeNj+5eKvT6VQel9k8=";
   };
 

pkgs/applications/misc/inkcut/default.nix

@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     sha256 = "sha256-S5IrNWVoUp1w+P7DrKlOUOyY3Q16CHSct9ndZOB3UpU=";
   };
 

pkgs/applications/misc/maliit-framework/default.nix

@@ -31,7 +31,7 @@ mkDerivation rec {
   src = fetchFromGitHub {
     owner = "maliit";
     repo = "framework";
-    rev = "refs/tags/${version}";
+    tag = version;
     sha256 = "sha256-q+hiupwlA0PfG+xtomCUp2zv6HQrGgmOd9CU193ucrY=";
   };
 

pkgs/applications/misc/mbutil/default.nix

@@ -14,7 +14,7 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "mapbox";
     repo = "mbutil";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-vxAF49NluEI/cZMUv1dlQBpUh1jfZ6KUVkYAmFAWphk=";
   };
 

pkgs/applications/misc/meerk40t/default.nix

@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "meerk40t";
     repo = pname;
-    rev = "refs/tags/${version}";
+    tag = version;
     hash = "sha256-dybmbmEvvTka0wMBIUDYemqDaCvG9odgCbIWYhROJLI=";
   };
 

pkgs/applications/misc/ola/default.nix

@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "OpenLightingProject";
     repo = "ola";
-    rev = "refs/tags/${version}";
+    tag = version;
     hash = "sha256-8w8ZT3D/+8Pxl9z2KTXeydVxE5xiPjxZevgmMFgrblU=";
   };
 

pkgs/applications/misc/pagefind/default.nix

@@ -43,7 +43,7 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "cloudcannon";
     repo = "pagefind";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-NIEiXwuy8zuUDxPsD4Hiq3x4cOG3VM+slfNIBSJU2Mk=";
   };
 

pkgs/applications/misc/remarkable/rmview/default.nix

@@ -13,7 +13,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "bordaigorl";
     repo = pname;
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     sha256 = "sha256-V26zmu8cQkLs0IMR7eFO8x34McnT3xYyzlZfntApYkk=";
   };
 

pkgs/applications/misc/rofi-rbw/default.nix

@@ -24,7 +24,7 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "fdw";
     repo = "rofi-rbw";
-    rev = "refs/tags/${version}";
+    tag = version;
     hash = "sha256-wUb89GkNB2lEfb42hMvcxpbjc1O+wx8AkFjq7aJwAko=";
   };
 

pkgs/applications/misc/visidata/default.nix

@@ -165,6 +165,7 @@ buildPythonApplication rec {
 
   meta = {
     description = "Interactive terminal multitool for tabular data";
+    mainProgram = "visidata";
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [
       raskin

pkgs/applications/networking/cloudflared/default.nix

@@ -13,7 +13,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflared";
-    rev = "refs/tags/${version}";
+    tag = version;
     hash = "sha256-gk18N8iJve4lznkUb93Qzdgl93fTCOZCAXqm1BjsDak=";
   };
 

pkgs/applications/networking/cluster/tftui/default.nix

@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "idoavrah";
     repo = "terraform-tui";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-xOlPuPVwfVT7jfBJPqZ5FbOs80HE0k2ZqcA+Jcxh9p4=";
   };
 

pkgs/applications/networking/cluster/tubekit/default.nix

@@ -11,7 +11,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "reconquest";
     repo = "tubekit";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-fUe5bMFF569A9Xdx3bfQH2DzbQDRfZ+ewlDL+gK2gWw=";
   };
 

pkgs/applications/networking/feedreaders/rssguard/default.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "martinrotter";
     repo = pname;
-    rev = "refs/tags/${version}";
+    tag = version;
     sha256 = "sha256-eF0jPT0gQnnBWu9IKfY0DwMwotL3IEjovqnQqx9v2NA=";
   };
 

pkgs/applications/networking/gopher/phetch/default.nix

@@ -23,7 +23,7 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "xvxx";
     repo = pname;
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-J+ka7/B37WzVPPE2Krkd/TIiVwuKfI2QYWmT0JHgBGQ=";
   };
 

pkgs/applications/networking/instant-messengers/twitch-tui/default.nix

@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "Xithrius";
     repo = pname;
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-QwFCabksDG+G7nfQPtxshd4n71Dj/uKOGRRutnZxECM=";
   };
 

pkgs/applications/networking/irc/irssi/default.nix

@@ -28,6 +28,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     meson
     ninja
+    perl
     pkg-config
   ];
 
@@ -38,7 +39,6 @@ stdenv.mkDerivation rec {
     libotr
     ncurses
     openssl
-    perl
   ];
 
   configureFlags = [

pkgs/applications/networking/maestral-qt/default.nix

@@ -19,7 +19,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "SamSchott";
     repo = "maestral-qt";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-VkJOKKYnoXux3WjD1JwINGWwv1SMIXfidyV2ITE7dJc=";
   };
 

pkgs/applications/networking/mailreaders/thunderbird/0001-Implemented-char_traits-for-SEXP-octet_t.patch

@@ -0,0 +1,262 @@
+From 46744a14ffc235330bb99cebfaf294829c31bba4 Mon Sep 17 00:00:00 2001
+From: "Maxim [maxirmx] Samsonov" <m.samsonov@computer.org>
+Date: Mon, 3 Jun 2024 13:39:47 +0300
+Subject: [PATCH] Implemented char_traits for SEXP octet_t
+
+---
+ comm/third_party/rnp/src/libsexpp/include/sexpp/sexp.h                    |  95 ++++++++++++++++++-
+ comm/third_party/rnp/src/libsexpp/tests/src/traits-tests.cpp              | 116 ++++++++++++++++++++++++
+ comm/third_party/rnp/src/libsexpp/version.txt                             |   2 +-
+ 3 files changed, 208 insertions(+), 7 deletions(-)
+ create mode 100644 tests/src/traits-tests.cpp
+
+diff --git a/comm/third_party/rnp/src/libsexpp/include/sexpp/sexp.h b/comm/third_party/rnp/src/libsexpp/include/sexpp/sexp.h
+index bb6ae4e..3ffb735 100644
+--- a/comm/third_party/rnp/src/libsexpp/include/sexpp/sexp.h
++++ b/comm/third_party/rnp/src/libsexpp/include/sexpp/sexp.h
+@@ -44,8 +44,93 @@
+ #include "sexp-public.h"
+ #include "sexp-error.h"
+ 
++// We are implementing char traits for octet_t with trhe following restrictions
++//  -- limit visibility so that other traits for unsigned char are still possible
++//  -- create template specializatio in std workspace (use workspace specialization
++//     is not specified and causes issues at least with gcc 4.8
++
+ namespace sexp {
++using octet_t = uint8_t;
++} // namespace sexp
++
++namespace std {
++
++template <> struct char_traits<sexp::octet_t> {
++    typedef sexp::octet_t  char_type;
++    typedef int            int_type;
++    typedef std::streampos pos_type;
++    typedef std::streamoff off_type;
++    typedef mbstate_t      state_type;
++
++    static void assign(char_type &__c1, const char_type &__c2) noexcept { __c1 = __c2; }
++
++    static constexpr bool eq(const char_type &__c1, const char_type &__c2) noexcept
++    {
++        return __c1 == __c2;
++    }
++
++    static constexpr bool lt(const char_type &__c1, const char_type &__c2) noexcept
++    {
++        return __c1 < __c2;
++    }
++
++    static int compare(const char_type *__s1, const char_type *__s2, size_t __n)
++    {
++        return memcmp(__s1, __s2, __n);
++    }
++
++    static size_t length(const char_type *__s)
++    {
++        return strlen(reinterpret_cast<const char *>(__s));
++    }
++
++    static const char_type *find(const char_type *__s, size_t __n, const char_type &__a)
++    {
++        return static_cast<const char_type *>(memchr(__s, __a, __n));
++    }
++
++    static char_type *move(char_type *__s1, const char_type *__s2, size_t __n)
++    {
++        return static_cast<char_type *>(memmove(__s1, __s2, __n));
++    }
++
++    static char_type *copy(char_type *__s1, const char_type *__s2, size_t __n)
++    {
++        return static_cast<char_type *>(memcpy(__s1, __s2, __n));
++    }
++
++    static char_type *assign(char_type *__s, size_t __n, char_type __a)
++    {
++        return static_cast<char_type *>(memset(__s, __a, __n));
++    }
++
++    static constexpr char_type to_char_type(const int_type &__c) noexcept
++    {
++        return static_cast<char_type>(__c);
++    }
++
++    // To keep both the byte 0xff and the eof symbol 0xffffffff
++    // from ending up as 0xffffffff.
++    static constexpr int_type to_int_type(const char_type &__c) noexcept
++    {
++        return static_cast<int_type>(static_cast<unsigned char>(__c));
++    }
++
++    static constexpr bool eq_int_type(const int_type &__c1, const int_type &__c2) noexcept
++    {
++        return __c1 == __c2;
++    }
++
++    static constexpr int_type eof() noexcept { return static_cast<int_type>(0xFFFFFFFF); }
+ 
++    static constexpr int_type not_eof(const int_type &__c) noexcept
++    {
++        return (__c == eof()) ? 0 : __c;
++    }
++};
++} // namespace std
++
++namespace sexp {
+ /*
+  * SEXP octet_t definitions
+  * We maintain some presumable redundancy with ctype
+@@ -99,14 +184,14 @@ class sexp_input_stream_t;
+  * SEXP simple string
+  */
+ 
+-typedef uint8_t octet_t;
++using octet_traits = std::char_traits<octet_t>;
++using octet_string = std::basic_string<octet_t, octet_traits>;
+ 
+-class SEXP_PUBLIC_SYMBOL sexp_simple_string_t : public std::basic_string<octet_t>,
+-                                                private sexp_char_defs_t {
++class SEXP_PUBLIC_SYMBOL sexp_simple_string_t : public octet_string, private sexp_char_defs_t {
+   public:
+     sexp_simple_string_t(void) = default;
+-    sexp_simple_string_t(const octet_t *dt) : std::basic_string<octet_t>{dt} {}
+-    sexp_simple_string_t(const octet_t *bt, size_t ln) : std::basic_string<octet_t>{bt, ln} {}
++    sexp_simple_string_t(const octet_t *dt) : octet_string{dt} {}
++    sexp_simple_string_t(const octet_t *bt, size_t ln) : octet_string{bt, ln} {}
+     sexp_simple_string_t &append(int c)
+     {
+         (*this) += (octet_t)(c & 0xFF);
+diff --git a/comm/third_party/rnp/src/libsexpp/tests/src/traits-tests.cpp b/comm/third_party/rnp/src/libsexpp/tests/src/traits-tests.cpp
+new file mode 100644
+index 0000000..52e1019
+--- /dev/null
++++ b/comm/third_party/rnp/src/libsexpp/tests/src/traits-tests.cpp
+@@ -0,0 +1,116 @@
++/**
++ *
++ * Copyright 2024 Ribose Inc. (https://www.ribose.com)
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a copy of
++ * this software and associated documentation files (the "Software"), to deal in
++ * the Software without restriction, including without limitation the rights to
++ * use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
++ * the Software, and to permit persons to whom the Software is furnished to do so,
++ * subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in all
++ * copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
++ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
++ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
++ * IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
++ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
++ *
++ */
++
++#include "sexp-tests.h"
++
++using namespace sexp;
++
++namespace {
++
++TEST(OctetTraitsTest, Assign)
++{
++    octet_t a = 0x12;
++    octet_t b = 0x34;
++    octet_traits::assign(a, b);
++    EXPECT_EQ(a, b);
++}
++
++TEST(OctetTraitsTest, Eq)
++{
++    octet_t a = 0x12;
++    octet_t b = 0x12;
++    EXPECT_TRUE(octet_traits::eq(a, b));
++}
++
++TEST(OctetTraitsTest, Lt)
++{
++    octet_t a = 0x12;
++    octet_t b = 0x34;
++    EXPECT_TRUE(octet_traits::lt(a, b));
++}
++
++TEST(OctetTraitsTest, Compare)
++{
++    octet_t s1[] = {0x12, 0x34, 0x56};
++    octet_t s2[] = {0x12, 0x34, 0x57};
++    EXPECT_LT(octet_traits::compare(s1, s2, 3), 0);
++}
++
++TEST(OctetTraitsTest, Find)
++{
++    octet_t s[] = {0x12, 0x34, 0x56};
++    octet_t a = 0x34;
++    EXPECT_EQ(octet_traits::find(s, 3, a), s + 1);
++}
++
++TEST(OctetTraitsTest, Move)
++{
++    octet_t s1[] = {0x12, 0x34, 0x56};
++    octet_t s2[3];
++    octet_traits::move(s2, s1, 3);
++    EXPECT_EQ(memcmp(s1, s2, 3), 0);
++}
++
++TEST(OctetTraitsTest, Copy)
++{
++    octet_t s1[] = {0x12, 0x34, 0x56};
++    octet_t s2[3];
++    octet_traits::copy(s2, s1, 3);
++    EXPECT_EQ(memcmp(s1, s2, 3), 0);
++}
++
++TEST(OctetTraitsTest, AssignMultiple)
++{
++    octet_t s[3];
++    octet_t a = 0x12;
++    octet_traits::assign(s, 3, a);
++    for (int i = 0; i < 3; i++) {
++        EXPECT_EQ(s[i], a);
++    }
++}
++
++TEST(OctetTraitsTest, ToCharType)
++{
++    octet_traits::int_type a = 0x12;
++    EXPECT_EQ(octet_traits::to_char_type(a), 0x12);
++}
++
++TEST(OctetTraitsTest, ToIntType)
++{
++    octet_t a = 0x12;
++    EXPECT_EQ(octet_traits::to_int_type(a), 0x12);
++}
++
++TEST(OctetTraitsTest, EqIntType)
++{
++    octet_traits::int_type a = 0x12;
++    octet_traits::int_type b = 0x12;
++    EXPECT_TRUE(octet_traits::eq_int_type(a, b));
++}
++
++TEST(OctetTraitsTest, NotEof)
++{
++    octet_traits::int_type a = 0x12;
++    EXPECT_EQ(octet_traits::not_eof(a), 0x12);
++}
++} // namespace
+diff --git a/comm/third_party/rnp/src/libsexpp/version.txt b/comm/third_party/rnp/src/libsexpp/version.txt
+index 1e9b46b..6201b5f 100644
+--- a/comm/third_party/rnp/src/libsexpp/version.txt
++++ b/comm/third_party/rnp/src/libsexpp/version.txt
+@@ -1 +1 @@
+-0.8.7
++0.8.8
+-- 
+2.47.0
+

pkgs/applications/networking/mailreaders/thunderbird/0001-Removed-lookup-against-basic_string-uint8_t.patch

@@ -0,0 +1,100 @@
+From 20419f739f632fb30666650544f0055e8d4f1afa Mon Sep 17 00:00:00 2001
+From: Maxim Samsonov <m.samsonov@computer.org>
+Date: Wed, 19 Jun 2024 16:52:08 +0300
+Subject: [PATCH] Removed lookup against basic_string<uint8_t>
+
+---
+ comm/third_party/rnp/src/lib/types.h                |  5 +----
+ comm/third_party/rnp/src/lib/utils.cpp              | 17 +----------------
+ comm/third_party/rnp/src/librekey/key_store_g10.cpp |  8 ++++----
+ 3 files changed, 7 insertions(+), 25 deletions(-)
+
+diff --git a/comm/third_party/rnp/src/lib/types.h b/comm/third_party/rnp/src/lib/types.h
+index f0c25d3d..a7eac3a1 100644
+--- a/comm/third_party/rnp/src/lib/types.h
++++ b/comm/third_party/rnp/src/lib/types.h
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2017-2021, [Ribose Inc](https://www.ribose.com).
++ * Copyright (c) 2017-2024, [Ribose Inc](https://www.ribose.com).
+  * Copyright (c) 2009 The NetBSD Foundation, Inc.
+  * All rights reserved.
+  *
+@@ -71,9 +71,6 @@ class id_str_pair {
+     static int         lookup(const id_str_pair           pair[],
+                               const std::vector<uint8_t> &bytes,
+                               int                         notfound = 0);
+-    static int         lookup(const id_str_pair                 pair[],
+-                              const std::basic_string<uint8_t> &bytes,
+-                              int                               notfound = 0);
+ };
+ 
+ /** pgp_fingerprint_t */
+diff --git a/comm/third_party/rnp/src/lib/utils.cpp b/comm/third_party/rnp/src/lib/utils.cpp
+index 3c6216c6..fd526379 100644
+--- a/comm/third_party/rnp/src/lib/utils.cpp
++++ b/comm/third_party/rnp/src/lib/utils.cpp
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2021, [Ribose Inc](https://www.ribose.com).
++ * Copyright (c) 2021, 2024 [Ribose Inc](https://www.ribose.com).
+  * All rights reserved.
+  *
+  * Redistribution and use in source and binary forms, with or without
+@@ -63,18 +63,3 @@ id_str_pair::lookup(const id_str_pair pair[], const std::vector<uint8_t> &bytes,
+     }
+     return notfound;
+ }
+-
+-int
+-id_str_pair::lookup(const id_str_pair                 pair[],
+-                    const std::basic_string<uint8_t> &bytes,
+-                    int                               notfound)
+-{
+-    while (pair && pair->str) {
+-        if ((strlen(pair->str) == bytes.size()) &&
+-            !memcmp(pair->str, bytes.data(), bytes.size())) {
+-            return pair->id;
+-        }
+-        pair++;
+-    }
+-    return notfound;
+-}
+diff --git a/comm/third_party/rnp/src/librekey/key_store_g10.cpp b/comm/third_party/rnp/src/librekey/key_store_g10.cpp
+index e646f02f..21136866 100644
+--- a/comm/third_party/rnp/src/librekey/key_store_g10.cpp
++++ b/comm/third_party/rnp/src/librekey/key_store_g10.cpp
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2017-2022, [Ribose Inc](https://www.ribose.com).
++ * Copyright (c) 2017-2024, [Ribose Inc](https://www.ribose.com).
+  * All rights reserved.
+  *
+  * Redistribution and use in source and binary forms, with or without
+@@ -311,12 +311,12 @@ read_curve(const sexp_list_t *list, const std::string &name, pgp_ec_key_t &key)
+ 
+     const auto &bytes = data->get_string();
+     pgp_curve_t curve = static_cast<pgp_curve_t>(
+-      id_str_pair::lookup(g10_curve_aliases, data->get_string(), PGP_CURVE_UNKNOWN));
++      id_str_pair::lookup(g10_curve_aliases, (const char *) bytes.data(), PGP_CURVE_UNKNOWN));
+     if (curve != PGP_CURVE_UNKNOWN) {
+         key.curve = curve;
+         return true;
+     }
+-    RNP_LOG("Unknown curve: %.*s", (int) bytes.size(), (char *) bytes.data());
++    RNP_LOG("Unknown curve: %.*s", (int) bytes.size(), (const char *) bytes.data());
+     return false;
+ }
+ 
+@@ -807,7 +807,7 @@ g23_parse_seckey(pgp_key_pkt_t &seckey,
+ 
+     auto &           alg_bt = alg_s_exp->sexp_string_at(0)->get_string();
+     pgp_pubkey_alg_t alg = static_cast<pgp_pubkey_alg_t>(
+-      id_str_pair::lookup(g10_alg_aliases, alg_bt.c_str(), PGP_PKA_NOTHING));
++      id_str_pair::lookup(g10_alg_aliases, (const char *) alg_bt.data(), PGP_PKA_NOTHING));
+     if (alg == PGP_PKA_NOTHING) {
+         RNP_LOG(
+           "Unsupported algorithm: '%.*s'", (int) alg_bt.size(), (const char *) alg_bt.data());
+-- 
+2.47.0
+

pkgs/applications/networking/mailreaders/thunderbird/packages.nix

@@ -42,6 +42,12 @@ let
       extraPatches = [
         # The file to be patched is different from firefox's `no-buildconfig-ffx90.patch`.
         ./no-buildconfig.patch
+        # clang-19 fixes for char_traits build issue
+        # https://github.com/rnpgp/rnp/pull/2242/commits/e0790a2c4ff8e09d52522785cec1c9db23d304ac
+        # https://github.com/rnpgp/sexpp/pull/54/commits/46744a14ffc235330bb99cebfaf294829c31bba4
+        # Remove when upstream bumps bundled rnp version: https://bugzilla.mozilla.org/show_bug.cgi?id=1893950
+        ./0001-Removed-lookup-against-basic_string-uint8_t.patch
+        ./0001-Implemented-char_traits-for-SEXP-octet_t.patch
       ];
 
       extraPassthru = {

pkgs/applications/networking/pjsip/default.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "pjsip";
     repo = "pjproject";
-    rev = "refs/tags/${finalAttrs.version}";
+    tag = finalAttrs.version;
     hash = "sha256-LDA3o1QMrAxcGuOi/YRoMzXmw/wFkfDs2wweZuIJ2RY=";
   };
 

pkgs/applications/networking/protonvpn-cli/default.nix

@@ -18,7 +18,7 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "protonvpn";
     repo = "linux-cli";
-    rev = "refs/tags/${version}";
+    tag = version;
     sha256 = "sha256-KhfogC23i7THe6YZJ6Sy1+q83vZupHsS69NurHCeo8I=";
   };
 

pkgs/applications/networking/protonvpn-gui/default.nix

@@ -27,7 +27,7 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "proton-vpn-gtk-app";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-+UnMsjIJ0M1YiF+BcY7RObUoCeDZGtE0ul6KBaODzeY=";
   };
 

pkgs/applications/networking/syncplay/default.nix

@@ -21,7 +21,7 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "Syncplay";
     repo = "syncplay";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     sha256 = "sha256-ipo027XyN4BpMkxzXznbnaufsaG/YkHxFJYo+XWzbyE=";
   };
 

pkgs/applications/networking/syncthing/default.nix

@@ -18,7 +18,7 @@ let
       src = fetchFromGitHub {
         owner = "syncthing";
         repo = "syncthing";
-        rev = "refs/tags/v${version}";
+        tag = "v${version}";
         hash = "sha256-JW78n/3hssH600uXn4YLxcIJylPbSpEZICtKmqfqamI=";
       };
 

pkgs/applications/networking/twtxt/default.nix

@@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "buckket";
     repo = "twtxt";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     sha256 = "sha256-CbFh1o2Ijinfb8X+h1GP3Tp+8D0D3/Czt/Uatd1B4cw=";
   };
 

pkgs/applications/office/qnotero/default.nix

@@ -14,7 +14,7 @@ python3Packages.buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "ealbiter";
     repo = pname;
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     sha256 = "sha256-Rym7neluRbYCpuezRQyLc6gSl3xbVR9fvhOxxW5+Nzo=";
   };
 

pkgs/applications/radio/btlejack/default.nix

@@ -13,7 +13,7 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "virtualabs";
     repo = "btlejack";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     sha256 = "sha256-Q6y9murV1o2i1sluqTVB5+X3B7ywFsI0ZvlJjHrHSpo=";
   };
 

pkgs/applications/science/astronomy/calcmysky/default.nix

@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "10110111";
     repo = "CalcMySky";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-18ZNnLK2zMT7P0MDXS6Z38LffE8EqXKBH89TPPxVWlo=";
   };
 

pkgs/applications/science/biology/ants/default.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "ANTsX";
     repo = "ANTs";
-    rev = "refs/tags/v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-7df9RcZZwfSkokG8dMQg65bCOk2atDGkJpPo8SrRrfY=";
   };
 

pkgs/applications/science/biology/mrtrix/default.nix

@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "MRtrix3";
     repo = "mrtrix3";
-    rev = "refs/tags/${version}";
+    tag = version;
     hash = "sha256-87zBAoBLWQPccGS37XyQ8H0GhL01k8GQFgcLL6IwbcM=";
     fetchSubmodules = true;
   };

pkgs/applications/science/chemistry/autodock-vina/default.nix

@@ -17,7 +17,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "ccsb-scripps";
     repo = "autodock-vina";
-    rev = "refs/tags/v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-yguUMEX0tn75wKrPKyqlCYbBFaEwC5b1s3k9xept1Fw=";
   };
 

pkgs/applications/science/computer-architecture/qtrvsim/default.nix

@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "cvut";
     repo = "qtrvsim";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     sha256 = "sha256-+EpPDA2+mBTdQjq6i9TN11yeXqvJA28JtmdNihM1a/U=";
   };
 

pkgs/applications/science/electronics/degate/default.nix

@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "DegateCommunity";
     repo = "Degate";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-INoA3Z6ya03ZMn6E+nOCkXZLoxoo2WgPDw9v5miI09A=";
   };
 

pkgs/applications/science/electronics/gerbv/default.nix

@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "gerbv";
     repo = pname;
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-sr48RGLYcMKuyH9p+5BhnR6QpKBvNOqqtRryw3+pbBk=";
   };
 

pkgs/applications/science/electronics/kicad/addons/kikit.nix

@@ -1,11 +1,12 @@
 # For building the multiple addons that are in the kikit repo.
-{ stdenv
-, bc
-, kikit
-, zip
-, python3
-, addonName
-, addonPath
+{
+  stdenv,
+  bc,
+  kikit,
+  zip,
+  python3,
+  addonName,
+  addonPath,
 }:
 let
   # This python is only used when building the package, it's not the python
@@ -30,10 +31,14 @@ let
   targetSpec = targetSpecs.${addonName};
 in
 stdenv.mkDerivation {
-  name = "kicadaddon-${addonName}";
+  pname = "kicadaddon-${addonName}";
   inherit (kikit-module) src version;
 
-  nativeBuildInputs = [ python bc zip ];
+  nativeBuildInputs = [
+    python
+    bc
+    zip
+  ];
   propagatedBuildInputs = [ kikit-module ];
 
   buildPhase = ''

pkgs/applications/science/misc/nextinspace/default.nix

@@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "not-stirred";
     repo = pname;
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-CrhzCvIA3YAFsWvdemvK1RLMacsM5RtgMjLeiqz5MwY=";
   };
 

pkgs/applications/science/robotics/mavproxy/default.nix

@@ -22,7 +22,7 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "ArduPilot";
     repo = pname;
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-A7tqV1kBCSuWHJUTdUZGcPY/r7X1edGZs6xDctpMbMI=";
   };
 

pkgs/applications/system/glances/default.nix

@@ -31,7 +31,7 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "nicolargo";
     repo = "glances";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-8Jm6DE3B7OQkaNwX/KwXMNZHUyvPtln8mJYaD6yzJRM=";
   };
 

pkgs/applications/terminal-emulators/cool-retro-term/default.nix

@@ -18,7 +18,7 @@ mkDerivation rec {
   src = fetchFromGitHub {
     owner = "Swordfish90";
     repo = "cool-retro-term";
-    rev = "refs/tags/${version}";
+    tag = version;
     hash = "sha256-PewHLVmo+RTBHIQ/y2FBkgXsIvujYd7u56JdFC10B4c=";
   };
 

pkgs/applications/terminal-emulators/kitty/default.nix

@@ -41,7 +41,7 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "kovidgoyal";
     repo = "kitty";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-0M4Bvhh3j9vPedE/d+8zaiZdET4mXcrSNUgLllhaPJw=";
   };
 

pkgs/applications/version-management/git-absorb/default.nix

@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "tummychow";
     repo = "git-absorb";
-    rev = "refs/tags/${version}";
+    tag = version;
     hash = "sha256-7Y/gEym+29lTwJ7FbuvOqzbiMSzrY9f5IPhtvIJUKbU=";
   };
 

pkgs/applications/version-management/gitlint/default.nix

@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "jorisroovers";
     repo = "gitlint";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-4SGkkC4LjZXTDXwK6jMOIKXR1qX76CasOwSqv8XUrjs=";
   };
 

pkgs/applications/version-management/pass-git-helper/default.nix

@@ -17,7 +17,7 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "languitar";
     repo = "pass-git-helper";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     sha256 = "sha256-DLH3l4wYfBlrc49swLgyHeZXebJ5JSzU7cHjD7Hmw0g=";
   };
 

pkgs/applications/video/go2tv/default.nix

@@ -20,7 +20,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "alexballas";
     repo = "go2tv";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-NCfr6FXxHFFTe9l7K68MkKU71Hu/vWQFZcJXFAB94q8=";
   };
 

pkgs/applications/video/openshot-qt/default.nix

@@ -21,7 +21,7 @@ let
   src = fetchFromGitHub {
     owner = "OpenShot";
     repo = "openshot-qt";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-zZZ7C/1+Qh7KS1WJ8YWkhFgw0+UHJhjk+145u9/TBcI=";
   };
 in

pkgs/applications/video/plex-mpv-shim/default.nix

@@ -21,7 +21,7 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "iwalton3";
     repo = pname;
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     sha256 = "sha256-hUGKOJEDZMK5uhHoevFt1ay6QQEcoN4F8cPxln5uMRo=";
   };
 

pkgs/applications/video/rtabmap/default.nix

@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "introlab";
     repo = "rtabmap";
-    rev = "refs/tags/${version}";
+    tag = version;
     hash = "sha256-y/p1uFSxVQNXO383DLGCg4eWW7iu1esqpWlyPMF3huk=";
   };
 

pkgs/applications/virtualization/virtualbox/default.nix

@@ -14,6 +14,7 @@
   xorgproto,
   libXext,
   libXcursor,
+  libXfixes,
   libXmu,
   libIDL,
   SDL2,
@@ -204,6 +205,9 @@ stdenv.mkDerivation (finalAttrs: {
     grep 'libdbus-1\.so\.3'     src include -rI --files-with-match | xargs sed -i -e '
       s@"libdbus-1\.so\.3"@"${dbus.lib}/lib/libdbus-1.so.3"@g'
 
+    grep 'libXfixes\.so\.3'     src include -rI --files-with-match | xargs sed -i -e '
+      s@"libXfixes\.so\.3"@"${libXfixes.out}/lib/libXfixes.so.3"@g'
+
     grep 'libasound\.so\.2'     src include -rI --files-with-match | xargs sed -i -e '
       s@"libasound\.so\.2"@"${alsa-lib.out}/lib/libasound.so.2"@g'
 

pkgs/applications/window-managers/cage/default.nix

@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "cage-kiosk";
     repo = "cage";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-2SFtz62z0EF8cpFTC6wGi125MD4a5mkXqP/C+7fH+3g=";
   };
 

pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprfocus.nix

@@ -3,12 +3,13 @@
   mkHyprlandPlugin,
   hyprland,
   fetchFromGitHub,
+  fetchpatch2,
   nix-update-script,
 }:
 
 mkHyprlandPlugin hyprland {
   pluginName = "hyprfocus";
-  version = "0-unstable-2024-10-09";
+  version = "0-unstable-2024-11-09";
 
   src = fetchFromGitHub {
     owner = "pyt0xic";
@@ -17,6 +18,13 @@ mkHyprlandPlugin hyprland {
     hash = "sha256-qIl7opF7fA1ZmC91TGQ7D12tB7kHc6Sn9DrfUN6sbBY=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/pyt0xic/hyprfocus/commit/e7d9ee3c470b194fe16179ff2f16fc4233e928ef.patch";
+      hash = "sha256-iETrtvoIZfcaD3TcKIIwFL8Rua0dFEqboml9AgQ/RZ0=";
+    })
+  ];
+
   installPhase = ''
     runHook preInstall
 

pkgs/applications/window-managers/hyprwm/hyprshade/default.nix

@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "loqusion";
     repo = "hyprshade";
-    rev = "refs/tags/${version}";
+    tag = version;
     hash = "sha256-MlbNE9n//Qb6OJc3DMkOpnPtoodfV8JlG/I5rOfWMtQ=";
   };
 

pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix

@@ -32,7 +32,7 @@ gcc14Stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "xdg-desktop-portal-hyprland";
-    rev = "refs/tags/v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-sAObJHBZjJHzYR62g+BLNBNq19cqb5LTw73H8m57K0w=";
   };
 

pkgs/applications/window-managers/i3/default.nix

@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "i3";
     repo = "i3";
-    rev = "refs/tags/${finalAttrs.version}";
+    tag = finalAttrs.version;
     hash = "sha256-2tuhfB/SMN+osCBfZtw/yDPhNNEhBH4Qo6dexpqVWYk=";
   };
 

pkgs/build-support/cc-wrapper/default.nix

@@ -639,7 +639,7 @@ stdenvNoCC.mkDerivation {
     # no `/usr/include`, there’s essentially no risk to dropping
     # the flag there. See discussion in NixOS/nixpkgs#191152.
     #
-    + optionalString ((cc.isClang or false) && !targetPlatform.isDarwin) ''
+    + optionalString ((cc.isClang or false) && !(cc.isROCm or false) && !targetPlatform.isDarwin) ''
       echo " -nostdlibinc" >> $out/nix-support/cc-cflags
     ''
 

pkgs/by-name/_1/_1oom/package.nix

@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "1oom-fork";
     repo = "1oom";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-xEHFuCOyuWmee6kgOc0WUk1iWWFqfFb42F7shGZmutQ=";
   };
 

pkgs/by-name/_2/_2ship2harkinian/package.nix

@@ -102,7 +102,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "HarbourMasters";
     repo = "2ship2harkinian";
-    rev = "refs/tags/${finalAttrs.version}";
+    tag = finalAttrs.version;
     hash = "sha256-1iSFzroKxwFpsIGNMetSlQKTKRWCy7QtgCTepFdSeY8=";
     fetchSubmodules = true;
   };

pkgs/by-name/aa/aactivator/package.nix

@@ -12,7 +12,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "Yelp";
     repo = "aactivator";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-vnBDtLEvU1jHbb5/MXAulXaBaugdCZdLQSP2b8P6SiQ=";
   };
 

pkgs/by-name/ab/abcmidi/package.nix

@@ -11,7 +11,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "sshlien";
     repo = "abcmidi";
-    rev = "refs/tags/${finalAttrs.version}";
+    tag = finalAttrs.version;
     hash = "sha256-8kzgojLwVVFjpWiQ1/0S3GCVU8oEpoFItjtRDByauDg=";
   };
 

pkgs/by-name/ab/abctl/package.nix

@@ -13,7 +13,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "airbytehq";
     repo = "abctl";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-O+ABjageccJudXtO5wUYLIT/kI04f68RLW0B7d//jdw=";
   };
 

pkgs/by-name/ab/above/package.nix

@@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "casterbyte";
     repo = "Above";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     hash = "sha256-tOSAci9aIALNCL3nLui96EdvqjNxnnuj2/dMdWLY9yI=";
   };
 

pkgs/by-name/ab/abpoa/package.nix

@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "yangao07";
     repo = "abPOA";
-    rev = "refs/tags/v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-90mkXp4cC0Omnx0C7ab7NNs/M2oedIcICTUJl3qhcyo=";
   };
 
@@ -93,7 +93,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = with lib; {
     description = "SIMD-based C library for fast partial order alignment using adaptive band";
     homepage = "https://github.com/yangao07/abPOA";
-    changelog = "https://github.com/yangao07/abPOA/releases/tag/${lib.removePrefix "refs/tags/" finalAttrs.src.rev}";
+    changelog = "https://github.com/yangao07/abPOA/releases/tag/v${finalAttrs.version}";
     license = licenses.mit;
     maintainers = with maintainers; [ natsukium ];
     mainProgram = "abpoa";

pkgs/by-name/ac/ac-library/package.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "atcoder";
     repo = "ac-library";
-    rev = "refs/tags/v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-AIqG98c1tcxxhYcX+NSf6Rw3onw61T5NTZtqQzT9jls=";
   };