From 9c20cc62cfbf12bb9ac5a0d243dac47ced3aefcd Mon Sep 17 00:00:00 2001
From: Jared Baur <jaredbaur@fastmail.com>
Date: Sun, 9 Feb 2025 12:56:08 -0800
Subject: [PATCH 001/102] microcode-intel: enable building on platforms other
 than x86_64-linux

iucode_tool is ran on x86_64-linux, so we must use an emulator to run
it.
---
 pkgs/by-name/mi/microcode-intel/package.nix | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/mi/microcode-intel/package.nix b/pkgs/by-name/mi/microcode-intel/package.nix
index 46769b79174f..33ee2000837d 100644
--- a/pkgs/by-name/mi/microcode-intel/package.nix
+++ b/pkgs/by-name/mi/microcode-intel/package.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   libarchive,
   iucode-tool,
+  buildPackages,
 }:
 
 stdenv.mkDerivation rec {
@@ -17,16 +18,13 @@ stdenv.mkDerivation rec {
     hash = "sha256-dvXt4SX/90oFM4GR9R7C2udhZ+plxnabOZpbtwN3V8Q=";
   };
 
-  nativeBuildInputs = [
-    iucode-tool
-    libarchive
-  ];
+  nativeBuildInputs = [ libarchive ];
 
   installPhase = ''
     runHook preInstall
 
     mkdir -p $out kernel/x86/microcode
-    iucode_tool -w kernel/x86/microcode/GenuineIntel.bin intel-ucode/
+    ${stdenv.hostPlatform.emulator buildPackages} ${lib.getExe iucode-tool} -w kernel/x86/microcode/GenuineIntel.bin intel-ucode/
     touch -d @$SOURCE_DATE_EPOCH kernel/x86/microcode/GenuineIntel.bin
     echo kernel/x86/microcode/GenuineIntel.bin | bsdtar --uid 0 --gid 0 -cnf - -T - | bsdtar --null -cf - --format=newc @- > $out/intel-ucode.img
 

From 5eaebff88194af0a0811cc107490604c74d25aef Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Fri, 4 Apr 2025 11:29:11 +0200
Subject: [PATCH 002/102] vmware-workstation: make overridable

---
 .../by-name/vm/vmware-workstation/package.nix | 31 +++++++++----------
 1 file changed, 14 insertions(+), 17 deletions(-)

diff --git a/pkgs/by-name/vm/vmware-workstation/package.nix b/pkgs/by-name/vm/vmware-workstation/package.nix
index 2f8a60403087..79414bbd0381 100644
--- a/pkgs/by-name/vm/vmware-workstation/package.nix
+++ b/pkgs/by-name/vm/vmware-workstation/package.nix
@@ -33,7 +33,8 @@
   unzip,
 }:
 
-let
+stdenv.mkDerivation (finalAttrs: {
+  pname = "vmware-workstation";
   # base - versions
   version = "17.6.3";
   build = "24583834";
@@ -45,13 +46,13 @@ let
   unlockerSrc = fetchFromGitHub {
     owner = "paolo-projects";
     repo = "unlocker";
-    rev = "${unlockerVersion}";
+    rev = "${finalAttrs.unlockerVersion}";
     sha256 = "sha256-JSEW1gqQuLGRkathlwZU/TnG6dL/xWKW4//SfE+kO0A=";
   };
 
   vmware-unpack-env = buildFHSEnv {
     pname = "vmware-unpack-env";
-    inherit version;
+    inherit (finalAttrs) version;
     targetPkgs = pkgs: [ zlib ];
   };
 
@@ -62,10 +63,6 @@ let
       ln -s $out/lib/libreadline.so $out/lib/libreadline.so.6
     '';
   };
-in
-stdenv.mkDerivation rec {
-  pname = "vmware-workstation";
-  inherit version build;
 
   buildInputs = [
     libxslt
@@ -102,29 +99,29 @@ stdenv.mkDerivation rec {
   nativeBuildInputs =
     [
       python3
-      vmware-unpack-env
+      finalAttrs.vmware-unpack-env
       autoPatchelfHook
       makeWrapper
     ]
     ++ lib.optionals enableInstaller [
       bzip2
       sqlite
-      readline70_compat63
+      finalAttrs.readline70_compat63
     ]
     ++ lib.optionals enableMacOSGuests [ unzip ];
 
   src = requireFile {
-    name = "VMware-Workstation-Full-${version}-${build}.x86_64.bundle";
+    name = "VMware-Workstation-Full-${finalAttrs.version}-${finalAttrs.build}.x86_64.bundle";
     url = "https://support.broadcom.com/group/ecx/productdownloads?subfamily=VMware%20Workstation%20Pro&freeDownloads=true";
     hash = "sha256-eVdZF3KN7UxtC4n0q2qBvpp3PADuto0dEqwNsSVHjuA=";
   };
 
   unpackPhase = ''
-    ${vmware-unpack-env}/bin/vmware-unpack-env -c "sh ${src} --extract unpacked"
+    ${finalAttrs.vmware-unpack-env}/bin/vmware-unpack-env -c "sh ${finalAttrs.src} --extract unpacked"
   '';
 
   postPatch = lib.optionalString enableMacOSGuests ''
-    cp -R "${unlockerSrc}" unlocker/
+    cp -R "${finalAttrs.unlockerSrc}" unlocker/
 
     substituteInPlace unlocker/unlocker.py --replace \
       "/usr/lib/vmware/bin/" "$out/lib/vmware/bin"
@@ -167,7 +164,7 @@ stdenv.mkDerivation rec {
       cp ${./vmware-installer-bootstrap} $out/etc/vmware-installer/bootstrap
       sed -i -e "s,@@INSTALLERDIR@@,$dest," $out/etc/vmware-installer/bootstrap
       sed -i -e "s,@@IVERSION@@,$vmware_installer_version," $out/etc/vmware-installer/bootstrap
-      sed -i -e "s,@@BUILD@@,${build}," $out/etc/vmware-installer/bootstrap
+      sed -i -e "s,@@BUILD@@,${finalAttrs.build}," $out/etc/vmware-installer/bootstrap
 
       # create database of vmware guest tools (avoids vmware fetching them later)
       mkdir -p $out/etc/vmware-installer/components
@@ -181,7 +178,7 @@ stdenv.mkDerivation rec {
         component_version=$(cat unpacked/$component/manifest.xml | grep -oPm1 "(?<=<version>)[^<]+")
         component_core_id=$([ "$component" == "vmware-installer" ] && echo "-1" || echo "1")
         type=$([ "$component" == "vmware-workstation" ] && echo "0" || echo "1")
-        sqlite3 "$database_filename" "INSERT INTO components(name,version,buildNumber,component_core_id,longName,description,type) VALUES('$component','$component_version',${build},$component_core_id,'$component','$component',$type);"
+        sqlite3 "$database_filename" "INSERT INTO components(name,version,buildNumber,component_core_id,longName,description,type) VALUES('$component','$component_version',${finalAttrs.build},$component_core_id,'$component','$component',$type);"
         mkdir -p $out/etc/vmware-installer/components/$component
         cp -r $folder/* $out/etc/vmware-installer/components/$component
       done
@@ -195,8 +192,8 @@ stdenv.mkDerivation rec {
     ## VMware Config
     echo "Installing VMware Config"
     cp ${./vmware-config} $out/etc/vmware/config
-    sed -i -e "s,@@VERSION@@,${version}," $out/etc/vmware/config
-    sed -i -e "s,@@BUILD@@,${build}," $out/etc/vmware/config
+    sed -i -e "s,@@VERSION@@,${finalAttrs.version}," $out/etc/vmware/config
+    sed -i -e "s,@@BUILD@@,${finalAttrs.build}," $out/etc/vmware/config
     sed -i -e "s,@@PREFIXDIR@@,$out," $out/etc/vmware/config
 
     ## VMware VMX
@@ -390,4 +387,4 @@ stdenv.mkDerivation rec {
       vifino
     ];
   };
-}
+})

From 09ff535e100a3681936602f98ab71d4b4783d3f4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Fri, 4 Apr 2025 11:54:09 +0200
Subject: [PATCH 003/102] vmware-workstation: modernize

---
 .../by-name/vm/vmware-workstation/package.nix | 21 +++++++------------
 1 file changed, 8 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/vm/vmware-workstation/package.nix b/pkgs/by-name/vm/vmware-workstation/package.nix
index 79414bbd0381..3d3652bb1ec2 100644
--- a/pkgs/by-name/vm/vmware-workstation/package.nix
+++ b/pkgs/by-name/vm/vmware-workstation/package.nix
@@ -35,19 +35,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vmware-workstation";
-  # base - versions
   version = "17.6.3";
   build = "24583834";
 
-  # macOS - versions
-  unlockerVersion = "3.0.5";
-
-  # macOS - Unlocker
-  unlockerSrc = fetchFromGitHub {
+  macOSUnlockerSrc = fetchFromGitHub {
     owner = "paolo-projects";
     repo = "unlocker";
-    rev = "${finalAttrs.unlockerVersion}";
-    sha256 = "sha256-JSEW1gqQuLGRkathlwZU/TnG6dL/xWKW4//SfE+kO0A=";
+    tag = "3.0.5";
+    hash = "sha256-JSEW1gqQuLGRkathlwZU/TnG6dL/xWKW4//SfE+kO0A=";
   };
 
   vmware-unpack-env = buildFHSEnv {
@@ -121,7 +116,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postPatch = lib.optionalString enableMacOSGuests ''
-    cp -R "${finalAttrs.unlockerSrc}" unlocker/
+    cp -R "${finalAttrs.macOSUnlockerSrc}" unlocker/
 
     substituteInPlace unlocker/unlocker.py --replace \
       "/usr/lib/vmware/bin/" "$out/lib/vmware/bin"
@@ -375,13 +370,13 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Industry standard desktop hypervisor for x86-64 architecture";
     homepage = "https://www.vmware.com/products/workstation-pro.html";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.unfree;
     platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       cawilliamson
       deinferno
       vifino

From 18ba6d1375eac5b2c268fd670a6eadeba60cdfc2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Fri, 4 Apr 2025 11:57:09 +0200
Subject: [PATCH 004/102] vmware-workstation: update meta attrs

---
 pkgs/by-name/vm/vmware-workstation/package.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/vm/vmware-workstation/package.nix b/pkgs/by-name/vm/vmware-workstation/package.nix
index 3d3652bb1ec2..15c33f2a521b 100644
--- a/pkgs/by-name/vm/vmware-workstation/package.nix
+++ b/pkgs/by-name/vm/vmware-workstation/package.nix
@@ -372,10 +372,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Industry standard desktop hypervisor for x86-64 architecture";
-    homepage = "https://www.vmware.com/products/workstation-pro.html";
+    homepage = "https://www.vmware.com/products/desktop-hypervisor/workstation-and-fusion";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     platforms = [ "x86_64-linux" ];
+    mainProgram = "vmware";
     maintainers = with lib.maintainers; [
       cawilliamson
       deinferno

From 5e3aa011a08a48b1232416bbd28ae208d221e9c2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Fri, 4 Apr 2025 12:00:17 +0200
Subject: [PATCH 005/102] vmware-workstation: reorder attrs

---
 .../by-name/vm/vmware-workstation/package.nix | 78 +++++++++----------
 1 file changed, 39 insertions(+), 39 deletions(-)

diff --git a/pkgs/by-name/vm/vmware-workstation/package.nix b/pkgs/by-name/vm/vmware-workstation/package.nix
index 15c33f2a521b..71ee44c92531 100644
--- a/pkgs/by-name/vm/vmware-workstation/package.nix
+++ b/pkgs/by-name/vm/vmware-workstation/package.nix
@@ -38,11 +38,10 @@ stdenv.mkDerivation (finalAttrs: {
   version = "17.6.3";
   build = "24583834";
 
-  macOSUnlockerSrc = fetchFromGitHub {
-    owner = "paolo-projects";
-    repo = "unlocker";
-    tag = "3.0.5";
-    hash = "sha256-JSEW1gqQuLGRkathlwZU/TnG6dL/xWKW4//SfE+kO0A=";
+  src = requireFile {
+    name = "VMware-Workstation-Full-${finalAttrs.version}-${finalAttrs.build}.x86_64.bundle";
+    url = "https://support.broadcom.com/group/ecx/productdownloads?subfamily=VMware%20Workstation%20Pro&freeDownloads=true";
+    hash = "sha256-eVdZF3KN7UxtC4n0q2qBvpp3PADuto0dEqwNsSVHjuA=";
   };
 
   vmware-unpack-env = buildFHSEnv {
@@ -51,6 +50,27 @@ stdenv.mkDerivation (finalAttrs: {
     targetPkgs = pkgs: [ zlib ];
   };
 
+  unpackPhase = ''
+    ${finalAttrs.vmware-unpack-env}/bin/vmware-unpack-env -c "sh ${finalAttrs.src} --extract unpacked"
+  '';
+
+  macOSUnlockerSrc = fetchFromGitHub {
+    owner = "paolo-projects";
+    repo = "unlocker";
+    tag = "3.0.5";
+    hash = "sha256-JSEW1gqQuLGRkathlwZU/TnG6dL/xWKW4//SfE+kO0A=";
+  };
+
+  postPatch = lib.optionalString enableMacOSGuests ''
+    cp -R "${finalAttrs.macOSUnlockerSrc}" unlocker/
+
+    substituteInPlace unlocker/unlocker.py --replace \
+      "/usr/lib/vmware/bin/" "$out/lib/vmware/bin"
+
+    substituteInPlace unlocker/unlocker.py --replace \
+      "/usr/lib/vmware/lib/libvmwarebase.so/libvmwarebase.so" "$out/lib/vmware/lib/libvmwarebase.so/libvmwarebase.so"
+  '';
+
   readline70_compat63 = symlinkJoin {
     name = "readline70_compat63";
     paths = [ readline70 ];
@@ -59,6 +79,20 @@ stdenv.mkDerivation (finalAttrs: {
     '';
   };
 
+  nativeBuildInputs =
+    [
+      python3
+      finalAttrs.vmware-unpack-env
+      autoPatchelfHook
+      makeWrapper
+    ]
+    ++ lib.optionals enableInstaller [
+      bzip2
+      sqlite
+      finalAttrs.readline70_compat63
+    ]
+    ++ lib.optionals enableMacOSGuests [ unzip ];
+
   buildInputs = [
     libxslt
     libxml2
@@ -91,40 +125,6 @@ stdenv.mkDerivation (finalAttrs: {
     xorg.libXtst
   ];
 
-  nativeBuildInputs =
-    [
-      python3
-      finalAttrs.vmware-unpack-env
-      autoPatchelfHook
-      makeWrapper
-    ]
-    ++ lib.optionals enableInstaller [
-      bzip2
-      sqlite
-      finalAttrs.readline70_compat63
-    ]
-    ++ lib.optionals enableMacOSGuests [ unzip ];
-
-  src = requireFile {
-    name = "VMware-Workstation-Full-${finalAttrs.version}-${finalAttrs.build}.x86_64.bundle";
-    url = "https://support.broadcom.com/group/ecx/productdownloads?subfamily=VMware%20Workstation%20Pro&freeDownloads=true";
-    hash = "sha256-eVdZF3KN7UxtC4n0q2qBvpp3PADuto0dEqwNsSVHjuA=";
-  };
-
-  unpackPhase = ''
-    ${finalAttrs.vmware-unpack-env}/bin/vmware-unpack-env -c "sh ${finalAttrs.src} --extract unpacked"
-  '';
-
-  postPatch = lib.optionalString enableMacOSGuests ''
-    cp -R "${finalAttrs.macOSUnlockerSrc}" unlocker/
-
-    substituteInPlace unlocker/unlocker.py --replace \
-      "/usr/lib/vmware/bin/" "$out/lib/vmware/bin"
-
-    substituteInPlace unlocker/unlocker.py --replace \
-      "/usr/lib/vmware/lib/libvmwarebase.so/libvmwarebase.so" "$out/lib/vmware/lib/libvmwarebase.so/libvmwarebase.so"
-  '';
-
   installPhase = ''
     runHook preInstall
 

From ab1ea56b74e9c06c4c061d0c1090b0b1d12162f1 Mon Sep 17 00:00:00 2001
From: wxt <3264117476@qq.com>
Date: Sun, 11 May 2025 08:13:50 +0800
Subject: [PATCH 006/102] hplip: stylix

---
 pkgs/by-name/hp/hplip/package.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/hp/hplip/package.nix b/pkgs/by-name/hp/hplip/package.nix
index 5b75315c16e7..8e11c58fa276 100644
--- a/pkgs/by-name/hp/hplip/package.nix
+++ b/pkgs/by-name/hp/hplip/package.nix
@@ -161,8 +161,8 @@ python3Packages.buildPythonApplication {
   postPatch = ''
     # https://github.com/NixOS/nixpkgs/issues/44230
     substituteInPlace createPPD.sh \
-      --replace ppdc "${cups}/bin/ppdc" \
-      --replace "gzip -c" "gzip -cn"
+      --replace-fail ppdc "${cups}/bin/ppdc" \
+      --replace-fail "gzip -c" "gzip -cn"
 
     # HPLIP hardcodes absolute paths everywhere. Nuke from orbit.
     find . -type f -exec sed -i \
@@ -347,15 +347,15 @@ python3Packages.buildPythonApplication {
     "lib/sane"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Print, scan and fax HP drivers for Linux";
     homepage = "https://developers.hp.com/hp-linux-imaging-and-printing";
     downloadPage = "https://sourceforge.net/projects/hplip/files/hplip/";
     license =
       if withPlugin then
-        licenses.unfree
+        lib.licenses.unfree
       else
-        with licenses;
+        with lib.licenses;
         [
           mit
           bsd2
@@ -368,6 +368,6 @@ python3Packages.buildPythonApplication {
       "armv7l-linux"
       "aarch64-linux"
     ];
-    maintainers = with maintainers; [ ttuegel ];
+    maintainers = with lib.maintainers; [ ttuegel ];
   };
 }

From 34a65cfa85dbc0f66e2fcdd3ae8633bd47d993c7 Mon Sep 17 00:00:00 2001
From: wxt <3264117476@qq.com>
Date: Sun, 11 May 2025 08:16:16 +0800
Subject: [PATCH 007/102] hplip: 3.24.4 -> 3.25.2

---
 pkgs/by-name/hp/hplip/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/hp/hplip/package.nix b/pkgs/by-name/hp/hplip/package.nix
index 8e11c58fa276..12ace2d35cbc 100644
--- a/pkgs/by-name/hp/hplip/package.nix
+++ b/pkgs/by-name/hp/hplip/package.nix
@@ -35,16 +35,16 @@
 let
 
   pname = "hplip";
-  version = "3.24.4";
+  version = "3.25.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/hplip/${pname}-${version}.tar.gz";
-    hash = "sha256-XXZDgxiTpeKt351C1YGl2/5arwI2Johrh2LFZF2g8fs=";
+    hash = "sha256-6HL/KOslF3Balfbhg576HlCnejOq6JBSeN8r2CCRllM=";
   };
 
   plugin = fetchurl {
     url = "https://www.openprinting.org/download/printdriver/auxfiles/HP/plugins/${pname}-${version}-plugin.run";
-    hash = "sha256-Hzxr3SVmGoouGBU2VdbwbwKMHZwwjWnI7P13Z6LQxao=";
+    hash = "sha256-miz41WYehGVI27tZUjGlRIpctjcpzJPfjR9lLf0WelQ=";
   };
 
   hplipState = replaceVars ./hplip.state {
@@ -223,6 +223,7 @@ python3Packages.buildPythonApplication {
       "policykit_dir=${out}/share/polkit-1/actions"
       "policykit_dbus_etcdir=${out}/etc/dbus-1/system.d"
       "policykit_dbus_sharedir=${out}/share/dbus-1/system-services"
+      "PYTHONEXECDIR=${out}/lib/python${lib.versions.majorMinor python3Packages.python.version}/site-packages"
       "hplip_confdir=${out}/etc/hp"
       "hplip_statedir=${out}/var/lib/hp"
     ];

From 9aa0e679da72a6e76a9fdf70f55a9519011b9559 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Tue, 13 May 2025 21:28:06 -0400
Subject: [PATCH 008/102] colima: use source build lima on darwin too

Signed-off-by: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
---
 pkgs/by-name/co/colima/package.nix | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/pkgs/by-name/co/colima/package.nix b/pkgs/by-name/co/colima/package.nix
index 5337a0c85cde..52cdc4f08e5b 100644
--- a/pkgs/by-name/co/colima/package.nix
+++ b/pkgs/by-name/co/colima/package.nix
@@ -6,14 +6,10 @@
   fetchFromGitHub,
   installShellFiles,
   lima,
-  lima-bin,
   makeWrapper,
   qemu,
   testers,
   colima,
-  # use lima-bin on darwin to support native macOS virtualization
-  # https://github.com/NixOS/nixpkgs/pull/209171
-  lima-drv ? if stdenv.hostPlatform.isDarwin then lima-bin else lima,
 }:
 
 buildGoModule rec {
@@ -55,7 +51,7 @@ buildGoModule rec {
     wrapProgram $out/bin/colima \
       --prefix PATH : ${
         lib.makeBinPath [
-          lima-drv
+          lima
           qemu
         ]
       }

From 174377456dbeb7fa6bd5e6e56ce0953e4e3e8e83 Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Thu, 15 May 2025 23:03:39 +1000
Subject: [PATCH 009/102] rclone: remove tomfitzhenry as maintainer

---
 pkgs/applications/networking/sync/rclone/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/applications/networking/sync/rclone/default.nix b/pkgs/applications/networking/sync/rclone/default.nix
index 1739968fea15..bdee2c1d3ce6 100644
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@@ -107,7 +107,6 @@ buildGoModule rec {
     mainProgram = "rclone";
     maintainers = with maintainers; [
       SuperSandro2000
-      tomfitzhenry
     ];
   };
 }

From 7c859e433c849178574d90795f6f629c10ed700d Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Thu, 15 May 2025 23:04:05 +1000
Subject: [PATCH 010/102] git-absorb: remove tomfitzhenry as maintainer

---
 pkgs/by-name/gi/git-absorb/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/gi/git-absorb/package.nix b/pkgs/by-name/gi/git-absorb/package.nix
index 344a043c28c3..4cbe68946f74 100644
--- a/pkgs/by-name/gi/git-absorb/package.nix
+++ b/pkgs/by-name/gi/git-absorb/package.nix
@@ -52,7 +52,6 @@ rustPlatform.buildRustPackage rec {
     description = "git commit --fixup, but automatic";
     license = [ licenses.bsd3 ];
     maintainers = with maintainers; [
-      tomfitzhenry
       matthiasbeyer
     ];
     mainProgram = "git-absorb";

From acb0aca85cd38ee6dfa8fa1533987946d89abd21 Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Thu, 15 May 2025 23:05:15 +1000
Subject: [PATCH 011/102] go-landlock: remove tomfitzhenry as maintainer

---
 pkgs/by-name/go/go-landlock/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/go/go-landlock/package.nix b/pkgs/by-name/go/go-landlock/package.nix
index 6be26c1b0d3b..b708cce8a2d8 100644
--- a/pkgs/by-name/go/go-landlock/package.nix
+++ b/pkgs/by-name/go/go-landlock/package.nix
@@ -26,6 +26,6 @@ buildGoModule {
     description = "Go library for the Linux Landlock sandboxing feature";
     homepage = "https://github.com/landlock-lsm/go-landlock";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ tomfitzhenry ];
+    maintainers = [ ];
   };
 }

From 5aa68f7ab62ccd11764c0d79b3a05eb96253be23 Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Thu, 15 May 2025 23:05:49 +1000
Subject: [PATCH 012/102] paper-age: remove tomfitzhenry as maintainer

---
 pkgs/by-name/pa/paper-age/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/pa/paper-age/package.nix b/pkgs/by-name/pa/paper-age/package.nix
index c1a59f48b72d..f68b73b20237 100644
--- a/pkgs/by-name/pa/paper-age/package.nix
+++ b/pkgs/by-name/pa/paper-age/package.nix
@@ -23,7 +23,7 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/matiaskorhonen/paper-age";
     changelog = "https://github.com/matiaskorhonen/paper-age/blob/${src.rev}/CHANGELOG.md";
     license = licenses.mit;
-    maintainers = with maintainers; [ tomfitzhenry ];
+    maintainers = [ ];
     mainProgram = "paper-age";
   };
 }

From 97082c5ff9de8376a87c9bf3c6b57d790f2f9cb9 Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Thu, 15 May 2025 23:06:35 +1000
Subject: [PATCH 013/102] wayidle: remove tomfitzhenry as maintainer

---
 pkgs/by-name/wa/wayidle/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/wa/wayidle/package.nix b/pkgs/by-name/wa/wayidle/package.nix
index 8a0dae1133e4..6e3b7cdae297 100644
--- a/pkgs/by-name/wa/wayidle/package.nix
+++ b/pkgs/by-name/wa/wayidle/package.nix
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage rec {
     description = "Execute a program when a Wayland compositor reports being N seconds idle";
     homepage = "https://git.sr.ht/~whynothugo/wayidle";
     license = licenses.isc;
-    maintainers = with maintainers; [ tomfitzhenry ];
+    maintainers = [ ];
     mainProgram = "wayidle";
     platforms = platforms.linux;
   };

From 702c5f774358bd5cb10ed29cde895a3c92cefbbe Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Thu, 15 May 2025 23:07:14 +1000
Subject: [PATCH 014/102] ibm-sw-tpm2: remove tomfitzhenry as maintainer

---
 pkgs/by-name/ib/ibm-sw-tpm2/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ib/ibm-sw-tpm2/package.nix b/pkgs/by-name/ib/ibm-sw-tpm2/package.nix
index f5f83f4736eb..bcb5024daf36 100644
--- a/pkgs/by-name/ib/ibm-sw-tpm2/package.nix
+++ b/pkgs/by-name/ib/ibm-sw-tpm2/package.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     mainProgram = "tpm_server";
     homepage = "https://sourceforge.net/projects/ibmswtpm2/";
     platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ tomfitzhenry ];
+    maintainers = [ ];
     license = licenses.bsd3;
   };
 }

From a598371de1535e53ed1dd3857d84d4c32d5af3e0 Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Thu, 15 May 2025 23:07:42 +1000
Subject: [PATCH 015/102] tpm2-tools: remove tomfitzhenry as maintainer

---
 pkgs/by-name/tp/tpm2-tools/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/tp/tpm2-tools/package.nix b/pkgs/by-name/tp/tpm2-tools/package.nix
index 88a20e99b1d2..363ba53c7b00 100644
--- a/pkgs/by-name/tp/tpm2-tools/package.nix
+++ b/pkgs/by-name/tp/tpm2-tools/package.nix
@@ -57,6 +57,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/tpm2-software/tpm2-tools";
     license = licenses.bsd3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ tomfitzhenry ];
+    maintainers = [ ];
   };
 }

From bb1451f46b043b94f740d281b91a7041fb3ecbdf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 7 Apr 2025 02:06:14 +0200
Subject: [PATCH 016/102] pdftk: use minimal jre

---
 pkgs/by-name/pd/pdftk/package.nix | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/pd/pdftk/package.nix b/pkgs/by-name/pd/pdftk/package.nix
index 025652d69b87..54f55796473b 100644
--- a/pkgs/by-name/pd/pdftk/package.nix
+++ b/pkgs/by-name/pd/pdftk/package.nix
@@ -3,12 +3,21 @@
   stdenv,
   fetchFromGitLab,
   gradle_8,
-  jre,
+  jre_headless,
+  jre_minimal,
   runtimeShell,
 }:
 let
   # "Deprecated Gradle features were used in this build, making it incompatible with Gradle 9.0."
   gradle = gradle_8;
+
+  jre = jre_minimal.override {
+    modules = [
+      "java.base"
+      "java.desktop"
+    ];
+    jdk = jre_headless;
+  };
 in
 stdenv.mkDerivation rec {
   pname = "pdftk";

From 07f2db67e1c4a2ad2babed0aa96e6596ee5381f1 Mon Sep 17 00:00:00 2001
From: Yifei Sun <ysun@hey.com>
Date: Thu, 15 May 2025 15:59:50 -0400
Subject: [PATCH 017/102] aldente: 1.32 -> 1.33

---
 pkgs/by-name/al/aldente/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/al/aldente/package.nix b/pkgs/by-name/al/aldente/package.nix
index b951c444ace3..f3a63b58a25d 100644
--- a/pkgs/by-name/al/aldente/package.nix
+++ b/pkgs/by-name/al/aldente/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "aldente";
-  version = "1.32";
+  version = "1.33";
 
   src = fetchurl {
     url = "https://github.com/davidwernhart/aldente-charge-limiter/releases/download/${finalAttrs.version}/AlDente.dmg";
-    hash = "sha256-pUFcP7J60lLeuX9v3qhCMcsRmurfw0LnoCcbRONnxKM=";
+    hash = "sha256-uUklxpQEVVXp2eZLYBpmAsVo5ziV0zvHRJA4JRiJAJk=";
   };
 
   dontBuild = true;

From dd5438925296cb8940620a11661387bf64a3fff1 Mon Sep 17 00:00:00 2001
From: Leona Maroni <dev@leona.is>
Date: Sat, 17 May 2025 12:43:24 +0200
Subject: [PATCH 018/102] python313Packages.tendo: fix build with python 3.13

---
 .../python-modules/tendo/default.nix          |   4 +
 .../tendo/fix-python-313-build.patch          | 183 ++++++++++++++++++
 2 files changed, 187 insertions(+)
 create mode 100644 pkgs/development/python-modules/tendo/fix-python-313-build.patch

diff --git a/pkgs/development/python-modules/tendo/default.nix b/pkgs/development/python-modules/tendo/default.nix
index 89d826a9dfe2..5630c802ad43 100644
--- a/pkgs/development/python-modules/tendo/default.nix
+++ b/pkgs/development/python-modules/tendo/default.nix
@@ -19,6 +19,10 @@ buildPythonPackage rec {
     hash = "sha256-ZOozMGxAKcEtmUEzHCFSojKc+9Ha+T2MOTmMvdMqNuQ=";
   };
 
+  patches = [
+    ./fix-python-313-build.patch
+  ];
+
   postPatch = ''
     # marken broken and not required
     sed -i '/setuptools_scm_git_archive/d' pyproject.toml
diff --git a/pkgs/development/python-modules/tendo/fix-python-313-build.patch b/pkgs/development/python-modules/tendo/fix-python-313-build.patch
new file mode 100644
index 000000000000..adcc685d5ec2
--- /dev/null
+++ b/pkgs/development/python-modules/tendo/fix-python-313-build.patch
@@ -0,0 +1,183 @@
+From 938d220ce48859cfbb117fb8df42c94c64b88043 Mon Sep 17 00:00:00 2001
+From: Leona Maroni <dev@leona.is>
+Date: Mon, 11 Nov 2024 12:03:54 +0000
+Subject: [PATCH] Enable support for python 3.13 and 3.13 (#96)
+
+adapter from 938d220ce48859cfbb117fb8df42c94c64b88043
+
+---
+ .gitignore                |  1 +
+ pyproject.toml            | 18 ++++++-----
+ setup.cfg                 |  3 ++
+ src/tendo/tee.py          |  4 +--
+ tox.ini                   | 67 +++++++++++++++++++--------------------
+ 5 files changed, 49 insertions(+), 44 deletions(-)
+
+index 215dce7..a1f51a7 100644
+--- a/.gitignore
++++ b/.gitignore
+@@ -29,3 +29,4 @@ test-distribute.sh
+ /.pytest_cache
+ venv/*
+ src/tendo/_version.py
++coverage.lcov
+diff --git a/pyproject.toml b/pyproject.toml
+index ef76df7..ad86d7d 100644
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -10,18 +10,20 @@ build-backend = "setuptools.build_meta"
+ [tool.black]
+ target-version = ["py38"]
+ 
++[tool.coverage.report]
++exclude_lines = ["pragma: no cover", "if TYPE_CHECKING:"]
++fail_under = 100
++skip_covered = true
++show_missing = true
++
+ [tool.coverage.run]
+-source_pkgs = ["tendo"]
+-branch = true
++source = ["src"]
++# Do not use branch until bug is fixes:
++# https://github.com/nedbat/coveragepy/issues/605
++branch = false
+ parallel = true
+ concurrency = ["multiprocessing", "thread"]
+ 
+-[tool.coverage.paths]
+-source = ["src", ".tox/*/site-packages"]
+-
+-[tool.coverage.report]
+-exclude_lines = ["pragma: no cover", "if TYPE_CHECKING:"]
+-
+ [tool.isort]
+ profile = "black"
+ add_imports = "from __future__ import annotations"
+diff --git a/setup.cfg b/setup.cfg
+index 0a6d8c0..bf97071 100644
+--- a/setup.cfg
++++ b/setup.cfg
+@@ -23,6 +23,8 @@ classifier =
+     Programming Language :: Python :: 3.9
+     Programming Language :: Python :: 3.10
+     Programming Language :: Python :: 3.11
++    Programming Language :: Python :: 3.12
++    Programming Language :: Python :: 3.13
+     Topic :: Software Development :: Libraries :: Python Modules
+     Topic :: Internet :: WWW/HTTP
+ 
+@@ -52,6 +54,7 @@ test =
+     coverage[toml]>=6.5.0
+     coveralls~=3.3.1
+     pre-commit>=3.3.3
++    pip
+     pytest-cache~=1.0
+     pytest-cov~=3.0.0
+     pytest-html~=3.1.1
+diff --git a/src/tendo/tee.py b/src/tendo/tee.py
+index 04d21cf..5b08794 100755
+--- a/src/tendo/tee.py
++++ b/src/tendo/tee.py
+@@ -3,7 +3,7 @@
+ import codecs
+ import logging
+ import os
+-import pipes
++from shlex import quote
+ import subprocess
+ import sys
+ import time
+@@ -57,7 +57,7 @@ def system2(
+     # because collections.Iterable seems to be missing on Debian Python 2.5.5
+     # (but not on OS X 10.8 with Python 2.5.6)
+     if hasattr(cmd, "__iter__"):
+-        cmd = " ".join(pipes.quote(s) for s in cmd)
++        cmd = " ".join(quote(s) for s in cmd)
+ 
+     t = time.process_time()
+     output = []
+diff --git a/tox.ini b/tox.ini
+index 5faabef..7f81e8b 100644
+--- a/tox.ini
++++ b/tox.ini
+@@ -11,45 +11,44 @@ isolated_build = True
+ 
+ [testenv]
+ sitepackages=False
++commands_pre =
++  # safety measure to assure we do not accidentally run tests with broken dependencies
++  {envpython} -m pip check
++  # cleaning needed to prevent errors between runs
++  sh -c "rm -f {envdir}/.coverage.* 2>/dev/null || true"
++commands=
++  # We add coverage options but not making them mandatory as we do not want to force
++  # pytest users to run coverage when they just want to run a single test with `pytest -k test`
++  coverage run -m pytest {posargs:}
++  # needed for upload to codecov.io
++  {py,py39,py310,py311,py312,py313}: sh -c "coverage combine -q --data-file={envdir}/.coverage {envdir}/.coverage.* && coverage xml --data-file={envdir}/.coverage -o {envdir}/coverage.xml --ignore-errors --fail-under=0 && COVERAGE_FILE={envdir}/.coverage coverage lcov --fail-under=0 --ignore-errors -q && COVERAGE_FILE={envdir}/.coverage coverage report --fail-under=0 --ignore-errors"
++  # lcov needed for vscode integration due to https://github.com/ryanluker/vscode-coverage-gutters/issues/403
++editable = true
++extras = test
+ passenv =
+-    CURL_CA_BUNDLE  # https proxies, https://github.com/tox-dev/tox/issues/1437
+-    FORCE_COLOR
+-    HOME
+-    LANG
+-    LC_ALL
+-    LC_CTYPE
+-    NO_COLOR
+-    PYENV_VERSION
+-    PYTEST_*  # allows developer to define their own preferences
+-    PYTEST_REQPASS  # needed for CI
+-    PY_*
+-    PY_COLORS
+-    REQUESTS_CA_BUNDLE  # https proxies
+-    RTD_TOKEN
+-    RTOX*
+-    SSH_AUTH_SOCK
+-    SSL_CERT_FILE  # https proxies
++  CURL_CA_BUNDLE  # https proxies, https://github.com/tox-dev/tox/issues/1437
++  FORCE_COLOR
++  HOME
++  NO_COLOR
++  PYTEST_*  # allows developer to define their own preferences
++  PYTEST_REQPASS  # needed for CI
++  PYTHON*  # PYTHONPYCACHEPREFIX, PYTHONIOENCODING, PYTHONBREAKPOINT,...
++  PY_COLORS
++  RTD_TOKEN
++  REQUESTS_CA_BUNDLE  # https proxies
++  SETUPTOOLS_SCM_DEBUG
++  SSL_CERT_FILE  # https proxies
++  SSH_AUTH_SOCK # may be needed by git
++  LANG
++  LC_*
+ setenv =
+-    COVERAGE_FILE={env:COVERAGE_FILE:{toxworkdir}/.coverage.{envname}}
+-    COVERAGE_PROCESS_START={toxinidir}/pyproject.toml
+-commands=
+-    coverage run -m pytest --color=yes --html={envlogdir}/report.html --self-contained-html
+-    # --pyargs tendo
++  COVERAGE_FILE = {env:COVERAGE_FILE:{envdir}/.coverage.{envname}}
++  COVERAGE_PROCESS_START={toxinidir}/pyproject.toml
++  PIP_DISABLE_PIP_VERSION_CHECK = 1
+ allowlist_externals =
+     sh
+-deps =
+-    --editable .[test]
+ 
+-[testenv:coverage]
+-description = Combines and displays coverage results
+-commands =
+-  sh -c "coverage combine .tox/.coverage.*"
+-  # needed by codecov github actions:
+-  coverage xml
+-  # just for humans running it:
+-  coverage report --skip-covered --fail-under=43
+-deps =
+-  coverage[toml]>=6.5.0
++
+ 
+ [testenv:docs]
+ changedir=docs
+

From d3e1f04cce1f6233930428fe529e103bc266a503 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Tue, 13 May 2025 21:29:47 -0400
Subject: [PATCH 019/102] lima-bin: drop; alias to lima

lima is now source built on darwin and linux; no reason to carry the
package forward.

Signed-off-by: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
---
 pkgs/applications/virtualization/lima/bin.nix | 127 ------------------
 pkgs/top-level/aliases.nix                    |   1 +
 pkgs/top-level/all-packages.nix               |   2 -
 3 files changed, 1 insertion(+), 129 deletions(-)
 delete mode 100644 pkgs/applications/virtualization/lima/bin.nix

diff --git a/pkgs/applications/virtualization/lima/bin.nix b/pkgs/applications/virtualization/lima/bin.nix
deleted file mode 100644
index f9ee61291426..000000000000
--- a/pkgs/applications/virtualization/lima/bin.nix
+++ /dev/null
@@ -1,127 +0,0 @@
-{
-  stdenvNoCC,
-  lib,
-  fetchurl,
-  writeScript,
-  installShellFiles,
-  qemu,
-  makeBinaryWrapper,
-  autoPatchelfHook,
-}:
-
-let
-  version = "0.22.0";
-
-  dist = {
-    aarch64-darwin = rec {
-      archSuffix = "Darwin-arm64";
-      url = "https://github.com/lima-vm/lima/releases/download/v${version}/lima-${version}-${archSuffix}.tar.gz";
-      sha256 = "271e0224d3e678450424abd4e6766a14ea52b146824bf8cfac7a0f486ceb2a0c";
-    };
-
-    x86_64-darwin = rec {
-      archSuffix = "Darwin-x86_64";
-      url = "https://github.com/lima-vm/lima/releases/download/v${version}/lima-${version}-${archSuffix}.tar.gz";
-      sha256 = "f2d331ef783e0bb00e193efc3d5c9438df5d284b1cbac771e5d239c3459b2b3d";
-    };
-
-    aarch64-linux = rec {
-      archSuffix = "Linux-aarch64";
-      url = "https://github.com/lima-vm/lima/releases/download/v${version}/lima-${version}-${archSuffix}.tar.gz";
-      sha256 = "8c5c6dc21fae19c5645bf8db8f441aeab7fba21fbe882b2b9db58c126d07846b";
-    };
-
-    x86_64-linux = rec {
-      archSuffix = "Linux-x86_64";
-      url = "https://github.com/lima-vm/lima/releases/download/v${version}/lima-${version}-${archSuffix}.tar.gz";
-      sha256 = "58e66114ae1e991512a86b6952ab3a1ffe0e12e08199a9a3ea13c3d2f24b307e";
-    };
-  };
-in
-stdenvNoCC.mkDerivation {
-  inherit version;
-  pname = "lima";
-  src = fetchurl {
-    inherit
-      (dist.${stdenvNoCC.hostPlatform.system}
-        or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}")
-      )
-      url
-      sha256
-      ;
-  };
-
-  sourceRoot = ".";
-
-  nativeBuildInputs = [
-    makeBinaryWrapper
-    installShellFiles
-  ] ++ lib.optionals stdenvNoCC.hostPlatform.isLinux [ autoPatchelfHook ];
-
-  installPhase =
-    ''
-      runHook preInstall
-      mkdir -p $out
-      cp -r bin share $out
-      chmod +x $out/bin/limactl
-      wrapProgram $out/bin/limactl \
-        --prefix PATH : ${lib.makeBinPath [ qemu ]}
-    ''
-    + lib.optionalString (stdenvNoCC.buildPlatform.canExecute stdenvNoCC.hostPlatform) ''
-      # the shell completion only works with a patched $out/bin/limactl and so
-      # needs to run after the autoPatchelfHook is executed in postFixup.
-      doShellCompletion() {
-        installShellCompletion --cmd limactl \
-          --bash <($out/bin/limactl completion bash) \
-          --fish <($out/bin/limactl completion fish) \
-          --zsh <($out/bin/limactl completion zsh)
-      }
-      postFixupHooks+=(doShellCompletion)
-    ''
-    + ''
-      runHook postInstall
-    '';
-
-  doInstallCheck = true;
-  installCheckPhase = ''
-    USER=nix $out/bin/limactl validate $out/share/lima/examples/default.yaml
-    USER=nix $out/bin/limactl validate $out/share/lima/examples/experimental/vz.yaml
-  '';
-
-  # Stripping removes entitlements of the binary on Darwin making it non-operational.
-  # Therefore, disable stripping on Darwin.
-  dontStrip = stdenvNoCC.hostPlatform.isDarwin;
-
-  passthru.updateScript =
-    let
-      lima-bin = builtins.toString ./bin.nix;
-    in
-    writeScript "update-lima-bin.sh" ''
-      #!/usr/bin/env nix-shell
-      #!nix-shell -i bash -p common-updater-scripts curl jq gawk
-
-      set -eou pipefail
-
-      LATEST_VERSION=$(curl -H "Accept: application/vnd.github+json" -Ls https://api.github.com/repos/lima-vm/lima/releases/latest | jq -r .tag_name | cut -c 2-)
-      curl -Ls -o SHA256SUMS https://github.com/lima-vm/lima/releases/download/v$LATEST_VERSION/SHA256SUMS
-      AARCH64_DARWIN_SHA256=$(cat SHA256SUMS | awk '/Darwin-arm64/{print $1}')
-      X86_64_DARWIN_SHA256=$(cat SHA256SUMS | awk '/Darwin-x86_64/{print $1}')
-      AARCH64_LINUX_SHA256=$(cat SHA256SUMS | awk '/Linux-aarch64/{print $1}')
-      X86_64_LINUX_SHA256=$(cat SHA256SUMS | awk '/Linux-x86_64/{print $1}')
-
-      # reset version first so that all platforms are always updated and in sync
-      update-source-version lima-bin $LATEST_VERSION $AARCH64_DARWIN_SHA256 --file=${lima-bin} --ignore-same-version --system=aarch64-darwin
-      update-source-version lima-bin $LATEST_VERSION $X86_64_DARWIN_SHA256 --file=${lima-bin} --ignore-same-version --system=x86_64-darwin
-      update-source-version lima-bin $LATEST_VERSION $AARCH64_LINUX_SHA256 --file=${lima-bin} --ignore-same-version --system=aarch64-linux
-      update-source-version lima-bin $LATEST_VERSION $X86_64_LINUX_SHA256 --file=${lima-bin} --ignore-same-version --system=x86_64-linux
-      rm SHA256SUMS
-    '';
-
-  meta = with lib; {
-    homepage = "https://github.com/lima-vm/lima";
-    description = "Linux virtual machines (on macOS, in most cases)";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ tricktron ];
-    platforms = platforms.linux ++ platforms.darwin;
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 08350e4c731c..684373d28eb8 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1010,6 +1010,7 @@ mapAliases {
   licensor = throw "'licensor' has been removed due to lack of upstream maintenance"; # Added 2025-01-25
   lightdm_gtk_greeter = lightdm-gtk-greeter; # Added 2022-08-01
   lightstep-tracer-cpp = throw "lightstep-tracer-cpp is deprecated since 2022-08-29; the upstream recommends migration to opentelemetry projects.";
+  lima-bin = lib.warnOnInstantiate "lima-bin has been replaced by lima" lima; # Added 2025-05-13
   lime3ds = throw "lime3ds is deprecated, use 'azahar' instead."; # Added 2025-03-22
   limesctl = throw "limesctl has been removed because it is insignificant."; # Added 2024-11-25
   linenoise-ng = throw "'linenoise-ng' has been removed as the upstream project was archived. Consider using 'linenoise' instead."; # Added 2025-05-05
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b36a8a52b50d..0d5733076306 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16343,8 +16343,6 @@ with pkgs;
     inherit (darwin) sigtool;
   };
 
-  lima-bin = callPackage ../applications/virtualization/lima/bin.nix { };
-
   image_optim = callPackage ../applications/graphics/image_optim { inherit (nodePackages) svgo; };
 
   # using the new configuration style proposal which is unstable

From e3002620b903a67bf9ccb26e698215a6af86a663 Mon Sep 17 00:00:00 2001
From: Liam Murphy <liampm32@gmail.com>
Date: Sun, 18 May 2025 08:44:29 +1000
Subject: [PATCH 020/102] jimtcl: unmark as broken on Darwin

---
 pkgs/by-name/ji/jimtcl/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/ji/jimtcl/package.nix b/pkgs/by-name/ji/jimtcl/package.nix
index 908a550d29c1..13181a2c0e5c 100644
--- a/pkgs/by-name/ji/jimtcl/package.nix
+++ b/pkgs/by-name/ji/jimtcl/package.nix
@@ -78,7 +78,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "http://jim.tcl.tk/";
     license = lib.licenses.bsd2;
     platforms = lib.platforms.all;
-    broken = stdenv.hostPlatform.isDarwin;
     maintainers = with lib.maintainers; [
       dbohdan
       fgaz

From 5de8edee04f3f00742a960c139328411a8913947 Mon Sep 17 00:00:00 2001
From: Liam Murphy <liampm32@gmail.com>
Date: Sun, 18 May 2025 08:36:16 +1000
Subject: [PATCH 021/102] openocd: unmark as broken on Darwin

---
 pkgs/by-name/op/openocd/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/op/openocd/package.nix b/pkgs/by-name/op/openocd/package.nix
index f7d326599f7d..618b998eefcb 100644
--- a/pkgs/by-name/op/openocd/package.nix
+++ b/pkgs/by-name/op/openocd/package.nix
@@ -97,6 +97,5 @@ stdenv.mkDerivation rec {
       prusnak
     ];
     platforms = platforms.unix ++ platforms.windows;
-    broken = stdenv.hostPlatform.isDarwin;
   };
 }

From 68443d7da6c9458501a52363196814b467744b6a Mon Sep 17 00:00:00 2001
From: Liam Murphy <liampm32@gmail.com>
Date: Sun, 18 May 2025 08:46:35 +1000
Subject: [PATCH 022/102] tinygo: unmark as broken on Darwin

---
 pkgs/by-name/ti/tinygo/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/ti/tinygo/package.nix b/pkgs/by-name/ti/tinygo/package.nix
index f0c003ab801b..e32871b6a40d 100644
--- a/pkgs/by-name/ti/tinygo/package.nix
+++ b/pkgs/by-name/ti/tinygo/package.nix
@@ -146,7 +146,6 @@ buildGoModule rec {
     homepage = "https://tinygo.org/";
     description = "Go compiler for small places";
     license = licenses.bsd3;
-    broken = stdenv.hostPlatform.isDarwin;
     maintainers = with maintainers; [
       Madouura
       muscaln

From d74f180f83c26a38b641f813ebba5bff6b36af41 Mon Sep 17 00:00:00 2001
From: JetHair <jethair@duck.com>
Date: Sun, 18 May 2025 04:17:32 +0530
Subject: [PATCH 023/102] maintainers: add jethair

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 26386447e5ca..6c6a32c0e071 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11482,6 +11482,12 @@
     githubId = 30251156;
     name = "Jesse Moore";
   };
+  jethair= {
+    email = "jethair@duck.com";
+    github = "JetHair";
+    githubId = 106916147;
+    name = "JetHair";
+  };
   jethro = {
     email = "jethrokuan95@gmail.com";
     github = "jethrokuan";

From 79927b4ec250465a7ad98692c79861eaba241935 Mon Sep 17 00:00:00 2001
From: JetHair <jethair@duck.com>
Date: Sun, 18 May 2025 04:22:11 +0530
Subject: [PATCH 024/102] libansilove: init at 1.4.2

---
 maintainers/maintainer-list.nix         |  2 +-
 pkgs/by-name/li/libansilove/package.nix | 35 +++++++++++++++++++++++++
 2 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/by-name/li/libansilove/package.nix

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 6c6a32c0e071..a9575f72bd37 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11482,7 +11482,7 @@
     githubId = 30251156;
     name = "Jesse Moore";
   };
-  jethair= {
+  jethair = {
     email = "jethair@duck.com";
     github = "JetHair";
     githubId = 106916147;
diff --git a/pkgs/by-name/li/libansilove/package.nix b/pkgs/by-name/li/libansilove/package.nix
new file mode 100644
index 000000000000..5343ed1b0b0c
--- /dev/null
+++ b/pkgs/by-name/li/libansilove/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  gd,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libansilove";
+  version = "1.4.2";
+
+  src = fetchFromGitHub {
+    owner = "ansilove";
+    repo = "libansilove";
+    tag = version;
+    hash = "sha256-kbQ7tbQbJ8zYhdbfiVZY26woyR4NNzqjCJ/5nrunlWs=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [ gd ];
+
+  meta = {
+    description = "Library for converting ANSI, ASCII, and other formats to PNG";
+    homepage = "https://github.com/ansilove/libansilove";
+    changelog = "https://github.com/ansilove/libansilove/blob/${src.rev}/ChangeLog";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ jethair ];
+    mainProgram = "libansilove";
+    platforms = lib.platforms.unix;
+  };
+}

From 93cf1a9a62497013c87792038290a67e3ccb3a34 Mon Sep 17 00:00:00 2001
From: JetHair <jethair@duck.com>
Date: Sun, 18 May 2025 05:28:10 +0530
Subject: [PATCH 025/102] ansilove: init at 4.2.1

---
 pkgs/by-name/an/ansilove/package.nix | 35 ++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 pkgs/by-name/an/ansilove/package.nix

diff --git a/pkgs/by-name/an/ansilove/package.nix b/pkgs/by-name/an/ansilove/package.nix
new file mode 100644
index 000000000000..ea2faa9b5fd5
--- /dev/null
+++ b/pkgs/by-name/an/ansilove/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  libansilove,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ansilove";
+  version = "4.2.1";
+
+  src = fetchFromGitHub {
+    owner = "ansilove";
+    repo = "ansilove";
+    tag = version;
+    hash = "sha256-13v2NLVJt11muwocBiQYz/rxQkte/W6LXwB/H/E9Nvk=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [ libansilove ];
+
+  meta = {
+    description = "ANSI and ASCII art to PNG converter in C";
+    homepage = "https://github.com/ansilove/ansilove";
+    changelog = "https://github.com/ansilove/ansilove/blob/${src.rev}/ChangeLog";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ jethair ];
+    mainProgram = "ansilove";
+    platforms = lib.platforms.unix;
+  };
+}

From c529a88fcce23f8114c9a28b16bee408e59fa0b0 Mon Sep 17 00:00:00 2001
From: Martin Madsen <mj@factbird.com>
Date: Sun, 18 May 2025 13:48:18 +0200
Subject: [PATCH 026/102] vorbis-tools: remove patch applied upstream

---
 pkgs/applications/audio/vorbis-tools/default.nix | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/pkgs/applications/audio/vorbis-tools/default.nix b/pkgs/applications/audio/vorbis-tools/default.nix
index 8ff65cef581d..2632fafb6751 100644
--- a/pkgs/applications/audio/vorbis-tools/default.nix
+++ b/pkgs/applications/audio/vorbis-tools/default.nix
@@ -22,13 +22,6 @@ stdenv.mkDerivation rec {
     hash = "sha256-of493Gd3vc6/a3l+ft/gQ3lUskdW/8yMa4FrY+BGDd4=";
   };
 
-  # ld64 on darwin doesn't support nested archives and as the nested lib
-  # (libbase64.a) is not required to build so leave it out
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    substituteInPlace share/Makefile.am \
-      --replace-fail libpicture_a_LIBADD '#libpicture_a_LIBADD'
-  '';
-
   nativeBuildInputs = [
     autoreconfHook
     pkg-config

From fac152987b4533b1a45fa28ec32564f5e208ccd9 Mon Sep 17 00:00:00 2001
From: Fiona Behrens <me@kloenk.dev>
Date: Sun, 18 May 2025 16:34:07 +0200
Subject: [PATCH 027/102] gitrs: add libz on darwin

---
 pkgs/by-name/gi/gitrs/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/gi/gitrs/package.nix b/pkgs/by-name/gi/gitrs/package.nix
index 9e3de5731e9f..d4155f294a13 100644
--- a/pkgs/by-name/gi/gitrs/package.nix
+++ b/pkgs/by-name/gi/gitrs/package.nix
@@ -6,6 +6,7 @@
   pkg-config,
   libiconv,
   rustPlatform,
+  libz,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -30,6 +31,7 @@ rustPlatform.buildRustPackage rec {
     [ openssl.dev ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       libiconv
+      libz
     ];
 
   meta = with lib; {

From b94931a3fb99ca9392344af8f82fc8d708f0bdc3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maxime=20Tr=C3=A9ca?=
 <16440823+mtreca@users.noreply.github.com>
Date: Mon, 19 May 2025 00:00:37 +0200
Subject: [PATCH 028/102] maintainers: remove mtreca from maintainers

---
 maintainers/maintainer-list.nix       | 6 ------
 pkgs/by-name/pa/pam_gnupg/package.nix | 2 +-
 pkgs/by-name/su/sumo/package.nix      | 2 +-
 3 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index de2af1f94e3a..9cedee0e00e3 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -16818,12 +16818,6 @@
     githubId = 72663763;
     keys = [ { fingerprint = "DB3E A12D B291 594A 79C5 F6B3 10AB 6868 37F6 FA3F"; } ];
   };
-  mtreca = {
-    email = "maxime.treca@gmail.com";
-    github = "mtreca";
-    githubId = 16440823;
-    name = "Maxime Tréca";
-  };
   mtreskin = {
     email = "zerthurd@gmail.com";
     github = "Zert";
diff --git a/pkgs/by-name/pa/pam_gnupg/package.nix b/pkgs/by-name/pa/pam_gnupg/package.nix
index ff5546320ec2..96b0491d3ef3 100644
--- a/pkgs/by-name/pa/pam_gnupg/package.nix
+++ b/pkgs/by-name/pa/pam_gnupg/package.nix
@@ -37,6 +37,6 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://github.com/cruegge/pam-gnupg";
     license = licenses.gpl3;
-    maintainers = with maintainers; [ mtreca ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/by-name/su/sumo/package.nix b/pkgs/by-name/su/sumo/package.nix
index dd0549d90503..b3782c77dcc0 100644
--- a/pkgs/by-name/su/sumo/package.nix
+++ b/pkgs/by-name/su/sumo/package.nix
@@ -93,6 +93,6 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://github.com/eclipse/sumo";
     license = licenses.epl20;
-    maintainers = with maintainers; [ mtreca ];
+    maintainers = with maintainers; [ ];
   };
 }

From 0c1b5093126b2d6a51b82bc2ccc0c9aa3ede8312 Mon Sep 17 00:00:00 2001
From: Break Yang <breakds@gmail.com>
Date: Sun, 18 May 2025 16:26:16 -0700
Subject: [PATCH 029/102] flashinfer: init at 0.2.5

---
 .../python-modules/flashinfer/default.nix     | 99 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 101 insertions(+)
 create mode 100644 pkgs/development/python-modules/flashinfer/default.nix

diff --git a/pkgs/development/python-modules/flashinfer/default.nix b/pkgs/development/python-modules/flashinfer/default.nix
new file mode 100644
index 000000000000..d05a07a7f2b1
--- /dev/null
+++ b/pkgs/development/python-modules/flashinfer/default.nix
@@ -0,0 +1,99 @@
+# NOTE: At runtime, FlashInfer will fall back to PyTorch’s JIT compilation if a
+# requested kernel wasn’t pre-compiled in AOT mode, and JIT compilation always
+# requires the CUDA toolkit (via nvcc) to be available.
+#
+# This means that if you plan to use flashinfer, you will need to set the
+# environment varaible `CUDA_HOME` to `cudatoolkit`.
+{ lib,
+  buildPythonPackage,
+  symlinkJoin,
+  fetchFromGitHub,
+  setuptools,
+  cmake,
+  ninja,
+  numpy,
+  torch
+}:
+
+assert torch.cudaSupport;
+
+let
+  pname = "flashinfer";
+  version = "0.2.5";
+
+  inherit (torch) cudaPackages;
+  inherit (cudaPackages) cudaMajorMinorVersion;
+
+  cudaMajorMinorVersionString = lib.replaceStrings [ "." ] [ "" ] cudaMajorMinorVersion;
+
+  src_cutlass = fetchFromGitHub {
+    owner = "NVIDIA";
+    repo = "cutlass";
+    # Using the revision obtained in submodule inside flashinfer's `3rdparty`.
+    rev = "df8a550d3917b0e97f416b2ed8c2d786f7f686a3";
+    hash = "sha256-d4czDoEv0Focf1bJHOVGX4BDS/h5O7RPoM/RrujhgFQ=";
+  };
+
+in buildPythonPackage {
+  inherit pname version;
+
+  src = fetchFromGitHub {
+    owner = "flashinfer-ai";
+    repo = "flashinfer";
+    tag = "v${version}";
+    hash = "sha256-YrYfatkI9DQkFEEGiF8CK/bTafaNga4Ufyt+882C0bQ=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    cudaPackages.cudatoolkit
+  ];
+  dontUseCmakeConfigure = true;
+
+  postPatch = ''
+    rmdir 3rdparty/cutlass
+    ln -s ${src_cutlass} 3rdparty/cutlass
+  '';
+
+  # FlashInfer offers two installation modes:
+  #
+  # JIT mode: CUDA kernels are compiled at runtime using PyTorch’s JIT, with
+  # compiled kernels cached for future use. JIT mode allows fast installation,
+  # as no CUDA kernels are pre-compiled, making it ideal for development and
+  # testing. JIT version is also available as a sdist in PyPI.
+  # 
+  # AOT mode: Core CUDA kernels are pre-compiled and included in the library,
+  # reducing runtime compilation overhead. If a required kernel is not
+  # pre-compiled, it will be compiled at runtime using JIT. AOT mode is
+  # recommended for production environments.
+  #
+  # Here we use opt for the AOT version.
+  preConfigure = ''
+    export FLASHINFER_ENABLE_AOT=1
+    export TORCH_NVCC_FLAGS="--maxrregcount=64"
+  '';
+
+  CUDA_HOME = "${cudaPackages.cudatoolkit}";
+  TORCH_CUDA_ARCH_LIST = "${lib.concatStringsSep ";" torch.cudaCapabilities}";
+
+  dependencies = [
+    numpy
+    torch
+  ];
+
+  meta = with lib; {
+    homepage = "https://flashinfer.ai/";
+    description = '';
+      FlashInfer is a library and kernel generator for Large Language Models
+      that provides high-performance implementation of LLM GPU kernels such as
+      FlashAttention, PageAttention and LoRA. FlashInfer focus on LLM serving
+      and inference, and delivers state-of-the-art performance across diverse
+      scenarios.
+    '';
+    license = licenses.asl20;
+    maintainers = with maintainers; [ breakds ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 144581c5e046..5ac6fe4de7a4 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5015,6 +5015,8 @@ self: super: with self; {
 
   flasgger = callPackage ../development/python-modules/flasgger { };
 
+  flashinfer = callPackage ../development/python-modules/flashinfer { };
+
   flashtext = callPackage ../development/python-modules/flashtext { };
 
   flask = callPackage ../development/python-modules/flask { };

From e034c55e6b294125412e133ff29cf7391f800291 Mon Sep 17 00:00:00 2001
From: Break Yang <breakds@gmail.com>
Date: Sun, 18 May 2025 17:04:48 -0700
Subject: [PATCH 030/102] treefmt

---
 .../python-modules/flashinfer/default.nix     | 23 +++++++++++--------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/python-modules/flashinfer/default.nix b/pkgs/development/python-modules/flashinfer/default.nix
index d05a07a7f2b1..fb2004be007f 100644
--- a/pkgs/development/python-modules/flashinfer/default.nix
+++ b/pkgs/development/python-modules/flashinfer/default.nix
@@ -4,7 +4,8 @@
 #
 # This means that if you plan to use flashinfer, you will need to set the
 # environment varaible `CUDA_HOME` to `cudatoolkit`.
-{ lib,
+{
+  lib,
   buildPythonPackage,
   symlinkJoin,
   fetchFromGitHub,
@@ -12,7 +13,7 @@
   cmake,
   ninja,
   numpy,
-  torch
+  torch,
 }:
 
 assert torch.cudaSupport;
@@ -34,7 +35,8 @@ let
     hash = "sha256-d4czDoEv0Focf1bJHOVGX4BDS/h5O7RPoM/RrujhgFQ=";
   };
 
-in buildPythonPackage {
+in
+buildPythonPackage {
   inherit pname version;
 
   src = fetchFromGitHub {
@@ -64,7 +66,7 @@ in buildPythonPackage {
   # compiled kernels cached for future use. JIT mode allows fast installation,
   # as no CUDA kernels are pre-compiled, making it ideal for development and
   # testing. JIT version is also available as a sdist in PyPI.
-  # 
+  #
   # AOT mode: Core CUDA kernels are pre-compiled and included in the library,
   # reducing runtime compilation overhead. If a required kernel is not
   # pre-compiled, it will be compiled at runtime using JIT. AOT mode is
@@ -86,12 +88,13 @@ in buildPythonPackage {
 
   meta = with lib; {
     homepage = "https://flashinfer.ai/";
-    description = '';
-      FlashInfer is a library and kernel generator for Large Language Models
-      that provides high-performance implementation of LLM GPU kernels such as
-      FlashAttention, PageAttention and LoRA. FlashInfer focus on LLM serving
-      and inference, and delivers state-of-the-art performance across diverse
-      scenarios.
+    description = ''
+      ;
+            FlashInfer is a library and kernel generator for Large Language Models
+            that provides high-performance implementation of LLM GPU kernels such as
+            FlashAttention, PageAttention and LoRA. FlashInfer focus on LLM serving
+            and inference, and delivers state-of-the-art performance across diverse
+            scenarios.
     '';
     license = licenses.asl20;
     maintainers = with maintainers; [ breakds ];

From 89834ea370e42011446959d62510894241255f73 Mon Sep 17 00:00:00 2001
From: GueLaKais <koroyeldiores@gmail.com>
Date: Wed, 9 Apr 2025 09:30:19 +0200
Subject: [PATCH 031/102] python312Packages.colcon-cargo: init at 0.1.3

---
 .../python-modules/colcon-cargo/default.nix   | 59 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 61 insertions(+)
 create mode 100644 pkgs/development/python-modules/colcon-cargo/default.nix

diff --git a/pkgs/development/python-modules/colcon-cargo/default.nix b/pkgs/development/python-modules/colcon-cargo/default.nix
new file mode 100644
index 000000000000..81cd80d2fc1d
--- /dev/null
+++ b/pkgs/development/python-modules/colcon-cargo/default.nix
@@ -0,0 +1,59 @@
+{
+  lib,
+  buildPythonPackage,
+  colcon,
+  cargo,
+  fetchFromGitHub,
+  scspell,
+  setuptools,
+  pythonOlder,
+  pytestCheckHook,
+  rustfmt,
+  toml,
+  writableTmpDirAsHomeHook,
+}:
+buildPythonPackage rec {
+  pname = "colcon-cargo";
+  version = "0.1.3";
+  pyproject = true;
+
+  disabled = pythonOlder "3.10";
+
+  src = fetchFromGitHub {
+    owner = "colcon";
+    repo = "colcon-cargo";
+    tag = version;
+    hash = "sha256-Do8i/Z1nn8wsj0xzCQdSaaXoDf9N34SiMb/GIe4YOs4=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    colcon
+    toml
+  ];
+
+  nativeCheckInputs = [
+    cargo
+    pytestCheckHook
+    scspell
+    rustfmt
+    writableTmpDirAsHomeHook
+  ];
+
+  disabledTestPaths = [
+    # Skip the linter tests
+    "test/test_flake8.py"
+  ];
+
+  pythonImportsCheck = [
+    "colcon_cargo"
+  ];
+
+  meta = {
+    description = "An extension for colcon-core to support Rust packages built with Cargo";
+    homepage = "https://github.com/colcon/colcon-cargo";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ guelakais ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 144581c5e046..e83fd711a233 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2683,6 +2683,8 @@ self: super: with self; {
 
   colcon-argcomplete = callPackage ../development/python-modules/colcon-argcomplete { };
 
+  colcon-cargo = callPackage ../development/python-modules/colcon-cargo { };
+
   colcon-defaults = callPackage ../development/python-modules/colcon-defaults { };
 
   colcon-notification = callPackage ../development/python-modules/colcon-notification { };

From 16c819bb917c13c005e08543acae7084e6bf6fbb Mon Sep 17 00:00:00 2001
From: Victor Engmark <victor@engmark.name>
Date: Mon, 19 May 2025 18:09:33 +0200
Subject: [PATCH 032/102] dependabot-cli: Remove myself as maintainer

---
 pkgs/by-name/de/dependabot-cli/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/de/dependabot-cli/package.nix b/pkgs/by-name/de/dependabot-cli/package.nix
index 240b096997e7..ffa3ffc1dcb7 100644
--- a/pkgs/by-name/de/dependabot-cli/package.nix
+++ b/pkgs/by-name/de/dependabot-cli/package.nix
@@ -106,7 +106,6 @@ buildGoModule {
     homepage = "https://github.com/dependabot/cli";
     license = licenses.mit;
     maintainers = with maintainers; [
-      l0b0
       infinisil
     ];
   };

From d660155168f20e3c7a49b90933658c059ecfa790 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 19 May 2025 16:17:13 +0000
Subject: [PATCH 033/102] qq: 3.2.17-2025.4.29 -> 3.2.17-2025.5.19

---
 pkgs/by-name/qq/qq/sources.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/qq/qq/sources.nix b/pkgs/by-name/qq/qq/sources.nix
index 56f4838b4faa..4db1d34cccc8 100644
--- a/pkgs/by-name/qq/qq/sources.nix
+++ b/pkgs/by-name/qq/qq/sources.nix
@@ -1,9 +1,9 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2025-05-03
+# Last updated: 2025-05-19
 {
-  version = "3.2.17-2025.4.29";
-  amd64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.17_250429_amd64_01.deb";
-  arm64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.17_250429_arm64_01.deb";
-  arm64_hash = "sha256-BxyJ9NNdMck3qk8wzCd07x/W9QlTMemHi3l0TIQ04ZY=";
-  amd64_hash = "sha256-DDqLHl8Ig7miZTheRltBq+riLXyGGnW8NtcOI0PgKtc=";
+  version = "3.2.17-2025.5.19";
+  amd64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.17_250519_amd64_01.deb";
+  arm64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.17_250519_arm64_01.deb";
+  arm64_hash = "sha256-IGwcZfxePhhu46ARCML/TgVCC2QrIqsd6sh5As30JBY=";
+  amd64_hash = "sha256-kCA5MmLHumCJqQ959L3wXO9bX5mzhowyrRxy5LRocfY=";
 }

From f492075c533da70721c28e29d4442d30050373a1 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Mon, 19 May 2025 23:21:07 +0200
Subject: [PATCH 034/102] midori: drop

Package is broken for a while and upstream project
seems to have been re-oriented to a Firefox fork.
See https://github.com/midori-browser/core/issues/468

Closes #374354
---
 nixos/tests/custom-ca.nix                    |  8 +--
 pkgs/by-name/mi/midori-unwrapped/package.nix | 72 --------------------
 pkgs/top-level/aliases.nix                   |  2 +
 pkgs/top-level/all-packages.nix              |  2 -
 4 files changed, 4 insertions(+), 80 deletions(-)
 delete mode 100644 pkgs/by-name/mi/midori-unwrapped/package.nix

diff --git a/nixos/tests/custom-ca.nix b/nixos/tests/custom-ca.nix
index b246f5b9ba57..e6aa31b5845a 100644
--- a/nixos/tests/custom-ca.nix
+++ b/nixos/tests/custom-ca.nix
@@ -1,6 +1,6 @@
 # Checks that `security.pki` options are working in curl and the main browser
-# engines: Gecko (via Firefox), Chromium, QtWebEngine (via qutebrowser) and
-# WebKitGTK (via Midori). The test checks that certificates issued by a custom
+# engines: Gecko (via Firefox), Chromium, QtWebEngine (via qutebrowser).
+# The test checks that certificates issued by a custom
 # trusted CA are accepted but those from an unknown CA are rejected.
 
 {
@@ -210,8 +210,4 @@ in
     args = "-T";
     error = "Certificate error";
   };
-  midori = {
-    args = "-p";
-    error = "Security";
-  };
 }
diff --git a/pkgs/by-name/mi/midori-unwrapped/package.nix b/pkgs/by-name/mi/midori-unwrapped/package.nix
deleted file mode 100644
index 906354905354..000000000000
--- a/pkgs/by-name/mi/midori-unwrapped/package.nix
+++ /dev/null
@@ -1,72 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  cmake,
-  ninja,
-  pkg-config,
-  intltool,
-  vala,
-  wrapGAppsHook3,
-  gcr,
-  libpeas,
-  gtk3,
-  webkitgtk_4_0,
-  sqlite,
-  gsettings-desktop-schemas,
-  libsoup_2_4,
-  glib-networking,
-  json-glib,
-  libarchive,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "midori";
-  version = "9.0";
-
-  src = fetchurl {
-    url = "https://github.com/midori-browser/core/releases/download/v${version}/midori-v${version}.tar.gz";
-    sha256 = "05i04qa83dnarmgkx4xsk6fga5lw1lmslh4rb3vhyyy4ala562jy";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    intltool
-    ninja
-    pkg-config
-    vala
-    wrapGAppsHook3
-  ];
-
-  buildInputs = [
-    (libsoup_2_4.override { gnomeSupport = true; })
-    gcr
-    glib-networking
-    gsettings-desktop-schemas
-    gtk3
-    libpeas
-    sqlite
-    webkitgtk_4_0
-    json-glib
-    libarchive
-  ];
-
-  passthru = {
-    inherit gtk3;
-    applicationName = "Midori";
-  };
-
-  meta = with lib; {
-    description = "Lightweight WebKitGTK web browser";
-    mainProgram = "midori";
-    homepage = "https://github.com/midori-browser/core";
-    license = with licenses; [ lgpl21Plus ];
-    platforms = with platforms; linux;
-    maintainers = with maintainers; [
-      raskin
-      ramkromberg
-    ];
-    # https://github.com/NixOS/nixpkgs/issues/374354
-    broken = true;
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index d767c8eb2842..c8664c72d39b 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1220,6 +1220,8 @@ mapAliases {
   micropad = throw "micropad has been removed, since it was unmaintained and blocked the Electron 27 removal."; # Added 2025-02-24
   microsoft-edge = throw "microsoft-edge has been removed due to lack of maintenance in nixpkgs"; # Added 2025-05-19
   microsoft_gsl = microsoft-gsl; # Added 2023-05-26
+  midori = throw "'midori' original project has been abandonned upstream and the package was broken for a while in nixpkgs"; # Added 2025-05-19
+  midori-unwrapped = midori; # Added 2025-05-19
   MIDIVisualizer = midivisualizer; # Added 2024-06-12
   mikutter = throw "'mikutter' has been removed because the package was broken and had no maintainers"; # Added 2024-10-01
   mime-types = mailcap; # Added 2022-01-21
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9e36badfce8b..b9e8562fcc2c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13262,8 +13262,6 @@ with pkgs;
 
   michabo = libsForQt5.callPackage ../applications/misc/michabo { };
 
-  midori = wrapFirefox midori-unwrapped { };
-
   miniaudicle = qt6Packages.callPackage ../applications/audio/miniaudicle { };
 
   minitube = libsForQt5.callPackage ../applications/video/minitube { };

From d58e5041de83a3af4ae733837445fb0bc331c60a Mon Sep 17 00:00:00 2001
From: Alex James <git@alextjam.es>
Date: Sun, 18 May 2025 20:48:10 -0500
Subject: [PATCH 035/102] luaPackages.luv: fix `installCheckPhase` on Darwin

---
 pkgs/development/lua-modules/luv/default.nix  | 18 ++++++++++-
 .../luv/disable-failing-darwin-tests.patch    | 19 ++++++++++++
 .../luv/disable-failing-tests.patch           | 30 +++++++++++++++++++
 3 files changed, 66 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/lua-modules/luv/disable-failing-darwin-tests.patch
 create mode 100644 pkgs/development/lua-modules/luv/disable-failing-tests.patch

diff --git a/pkgs/development/lua-modules/luv/default.nix b/pkgs/development/lua-modules/luv/default.nix
index 61de3da4c359..e0390b47a788 100644
--- a/pkgs/development/lua-modules/luv/default.nix
+++ b/pkgs/development/lua-modules/luv/default.nix
@@ -1,4 +1,5 @@
 {
+  stdenv,
   lib,
   buildLuarocksPackage,
   cmake,
@@ -28,6 +29,18 @@ buildLuarocksPackage rec {
     rm -rf deps/lua deps/luajit deps/libuv
   '';
 
+  patches =
+    [
+      # Fails with "Uncaught Error: ./tests/test-dns.lua:164: assertion failed!"
+      # and "./tests/test-tty.lua:19: bad argument #1 to 'is_readable' (Expected
+      # uv_stream userdata)"
+      ./disable-failing-tests.patch
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # Fails with "Uncaught Error: ./tests/test-udp.lua:261: EHOSTUNREACH"
+      ./disable-failing-darwin-tests.patch
+    ];
+
   buildInputs = [ libuv ];
   nativeBuildInputs = [ cmake ];
 
@@ -56,10 +69,13 @@ buildLuarocksPackage rec {
     EOF
   '';
 
+  __darwinAllowLocalNetworking = true;
+
   doInstallCheck = true;
   installCheckPhase = ''
-    rm tests/test-{dns,thread,tty}.lua
+    runHook preInstallCheck
     luarocks test
+    runHook postInstallCheck
   '';
 
   disabled = luaOlder "5.1";
diff --git a/pkgs/development/lua-modules/luv/disable-failing-darwin-tests.patch b/pkgs/development/lua-modules/luv/disable-failing-darwin-tests.patch
new file mode 100644
index 000000000000..d87902458b41
--- /dev/null
+++ b/pkgs/development/lua-modules/luv/disable-failing-darwin-tests.patch
@@ -0,0 +1,19 @@
+diff --git a/tests/test-udp.lua b/tests/test-udp.lua
+index bd0f46d..e4542b4 100644
+--- a/tests/test-udp.lua
++++ b/tests/test-udp.lua
+@@ -280,14 +280,6 @@ return require('lib/tap')(function (test)
+   -- same check for skipping the ipv6 test; we just expanded it to
+   -- the ipv4 test as well.
+   local function has_external_interface(uv, family)
+-    local addresses = assert(uv.interface_addresses())
+-    for _, vals in pairs(addresses) do
+-      for _, info in ipairs(vals) do
+-        if (not family or info.family == family) and not info.internal then
+-          return true
+-        end
+-      end
+-    end
+     return false
+   end
+ 
diff --git a/pkgs/development/lua-modules/luv/disable-failing-tests.patch b/pkgs/development/lua-modules/luv/disable-failing-tests.patch
new file mode 100644
index 000000000000..14ae9fd94412
--- /dev/null
+++ b/pkgs/development/lua-modules/luv/disable-failing-tests.patch
@@ -0,0 +1,30 @@
+diff --git a/tests/test-dns.lua b/tests/test-dns.lua
+index 894220b..0763b36 100644
+--- a/tests/test-dns.lua
++++ b/tests/test-dns.lua
+@@ -161,7 +161,6 @@ return require('lib/tap')(function (test)
+       p{err=err,hostname=hostname,service=service}
+       assert(not err, err)
+       assert(hostname)
+-      assert(service == "http")
+     end)))
+   end)
+ 
+diff --git a/tests/test-tty.lua b/tests/test-tty.lua
+index 165e58d..11368df 100644
+--- a/tests/test-tty.lua
++++ b/tests/test-tty.lua
+@@ -13,13 +13,10 @@ end
+ return require('lib/tap')(function (test)
+ 
+   test("tty normal", function (print, p, expect, uv)
+-    local stdin = uv.new_tty(0, true)
+     local stdout = uv.new_tty(1, false)
+ 
+-    assert(uv.is_readable(stdin))
+     assert(uv.is_writable(stdout))
+ 
+-    uv.close(stdin)
+     uv.close(stdout)
+   end)
+ 

From 05859772ecafed33ea224022d40fcb629bb8189c Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Tue, 20 May 2025 02:18:30 +0200
Subject: [PATCH 036/102] glance: fix build on x86_64-darwin

---
 pkgs/by-name/gl/glance/package.nix         |  4 +++-
 pkgs/by-name/gl/glance/update_purego.patch | 26 ++++++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/by-name/gl/glance/update_purego.patch

diff --git a/pkgs/by-name/gl/glance/package.nix b/pkgs/by-name/gl/glance/package.nix
index ed0a3386dfee..f0ee91131fd5 100644
--- a/pkgs/by-name/gl/glance/package.nix
+++ b/pkgs/by-name/gl/glance/package.nix
@@ -18,7 +18,9 @@ buildGoModule (finalAttrs: {
     hash = "sha256-syWalphoKjUYrQjKrQUMDijgILQ+AIOVTMqYCiYVWyU=";
   };
 
-  vendorHash = "sha256-81FAWMe7ksmbklXGGg15v2W4nuT6AcBHLIhXF7bI78c=";
+  patches = [ ./update_purego.patch ];
+
+  vendorHash = "sha256-esPtCg63A40mX9hADOhEa+NjNk+9MI/0qZG3uE91qxg=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/gl/glance/update_purego.patch b/pkgs/by-name/gl/glance/update_purego.patch
new file mode 100644
index 000000000000..b91fa89f2de4
--- /dev/null
+++ b/pkgs/by-name/gl/glance/update_purego.patch
@@ -0,0 +1,26 @@
+diff --git a/go.mod b/go.mod
+index ccea58ca68..118d91c650 100644
+--- a/go.mod
++++ b/go.mod
+@@ -15,7 +15,7 @@
+ require (
+ 	github.com/PuerkitoBio/goquery v1.10.3 // indirect
+ 	github.com/andybalholm/cascadia v1.3.3 // indirect
+-	github.com/ebitengine/purego v0.8.2 // indirect
++	github.com/ebitengine/purego v0.8.3 // indirect
+ 	github.com/go-ole/go-ole v1.3.0 // indirect
+ 	github.com/json-iterator/go v1.1.12 // indirect
+ 	github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35 // indirect
+diff --git a/go.sum b/go.sum
+index 80c2d6c664..6236b4de85 100644
+--- a/go.sum
++++ b/go.sum
+@@ -11,6 +11,8 @@
+ github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+ github.com/ebitengine/purego v0.8.2 h1:jPPGWs2sZ1UgOSgD2bClL0MJIqu58nOmIcBuXr62z1I=
+ github.com/ebitengine/purego v0.8.2/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
++github.com/ebitengine/purego v0.8.3 h1:K+0AjQp63JEZTEMZiwsI9g0+hAMNohwUOtY0RPGexmc=
++github.com/ebitengine/purego v0.8.3/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+ github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
+ github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+ github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=

From f519f7581cb093e24ab06fec6d9eaffe74c1c65c Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Tue, 20 May 2025 02:18:30 +0200
Subject: [PATCH 037/102] glance: 0.8.1 -> 0.8.3

---
 pkgs/by-name/gl/glance/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gl/glance/package.nix b/pkgs/by-name/gl/glance/package.nix
index f0ee91131fd5..e6e96550ff72 100644
--- a/pkgs/by-name/gl/glance/package.nix
+++ b/pkgs/by-name/gl/glance/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "glance";
-  version = "0.8.1";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "glanceapp";
     repo = "glance";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-syWalphoKjUYrQjKrQUMDijgILQ+AIOVTMqYCiYVWyU=";
+    hash = "sha256-o2Yom40HbNKe3DMMxz0Mf2gG8zresgU52Odpj2H7ZPU=";
   };
 
   patches = [ ./update_purego.patch ];

From 8ae40661d1ad7fbb6d77080a9918a4fd28aee433 Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Tue, 20 May 2025 07:13:49 +0200
Subject: [PATCH 038/102] cups-browsed: Fix cross-compilation RiscV

---
 pkgs/by-name/cu/cups-browsed/package.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cu/cups-browsed/package.nix b/pkgs/by-name/cu/cups-browsed/package.nix
index 169bfda6e3bc..7db6cb771a95 100644
--- a/pkgs/by-name/cu/cups-browsed/package.nix
+++ b/pkgs/by-name/cu/cups-browsed/package.nix
@@ -24,15 +24,17 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     autoreconfHook
-    pkg-config
     cups
+    glib # Required for gdbus-codegen
+    pkg-config
   ];
 
   buildInputs = [
     avahi
+    cups
+    glib
     libcupsfilters
     libppd
-    glib
   ];
 
   configureFlags = [

From 29ae2000b1c073078267c0decf5e2755fdbdef94 Mon Sep 17 00:00:00 2001
From: Yureka <yureka@cyberchaos.dev>
Date: Tue, 20 May 2025 12:40:03 +0200
Subject: [PATCH 039/102] stalwart-mail: use system jemalloc

fixes the package on aarch64 16k-pagesize systems
---
 pkgs/by-name/st/stalwart-mail/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/st/stalwart-mail/package.nix b/pkgs/by-name/st/stalwart-mail/package.nix
index 0a9ed8b7d733..16f984cb86c1 100644
--- a/pkgs/by-name/st/stalwart-mail/package.nix
+++ b/pkgs/by-name/st/stalwart-mail/package.nix
@@ -9,6 +9,7 @@
   sqlite,
   foundationdb,
   zstd,
+  rust-jemalloc-sys,
   stdenv,
   nix-update-script,
   nixosTests,
@@ -43,6 +44,7 @@ rustPlatform.buildRustPackage rec {
     openssl
     sqlite
     zstd
+    rust-jemalloc-sys
   ] ++ lib.optionals (stdenv.hostPlatform.isLinux && withFoundationdb) [ foundationdb ];
 
   # Issue: https://github.com/stalwartlabs/mail-server/issues/1104

From 78389cbde318fb31dd6941412593a4a58c3c3d00 Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Mon, 19 May 2025 00:25:08 +0200
Subject: [PATCH 040/102] gerrit: 3.11.3 -> 3.12.0

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 pkgs/by-name/ge/gerrit/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ge/gerrit/package.nix b/pkgs/by-name/ge/gerrit/package.nix
index 724ac4f462e0..d26ddf70b00f 100644
--- a/pkgs/by-name/ge/gerrit/package.nix
+++ b/pkgs/by-name/ge/gerrit/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gerrit";
-  version = "3.11.3";
+  version = "3.12.0";
 
   src = fetchurl {
     url = "https://gerrit-releases.storage.googleapis.com/gerrit-${version}.war";
-    hash = "sha256-SkLfxBU4ePnrgqB9k9qoYZ1njgHVMjRX4BZYbbeUaAQ=";
+    hash = "sha256-/1QKWu1OF6uPkuBcnHBoVRqiiIxr7LPkrfQHpjO9sz4=";
   };
 
   buildCommand = ''

From 23d344b9da949dc26300a0f2dab495b4937a97ef Mon Sep 17 00:00:00 2001
From: Casey Link <unnamedrambler@gmail.com>
Date: Tue, 20 May 2025 14:53:15 +0200
Subject: [PATCH 041/102] nixos/davis: fix several outstanding bugs

As reported in #317303, this fixes:

- nginx config is now actually optional
- mail dsn options are now optional
- broken stdout logging has been replaced with default file logging in
  state dir

fixes #317303
---
 nixos/modules/services/web-apps/davis.md  |  3 +-
 nixos/modules/services/web-apps/davis.nix | 28 ++++++----
 nixos/tests/davis.nix                     | 62 ++++++++++++++++++-----
 3 files changed, 70 insertions(+), 23 deletions(-)

diff --git a/nixos/modules/services/web-apps/davis.md b/nixos/modules/services/web-apps/davis.md
index 9775d8221b5b..d654f2fd7f43 100644
--- a/nixos/modules/services/web-apps/davis.md
+++ b/nixos/modules/services/web-apps/davis.md
@@ -24,9 +24,10 @@ After that, `davis` can be deployed like this:
     adminLogin = "admin";
     adminPasswordFile = "/run/secrets/davis-admin-password";
     appSecretFile = "/run/secrets/davis-app-secret";
-    nginx = {};
   };
 }
 ```
 
 This deploys Davis using a sqlite database running out of `/var/lib/davis`.
+
+Logs can be found in `/var/lib/davis/var/log/`.
diff --git a/nixos/modules/services/web-apps/davis.nix b/nixos/modules/services/web-apps/davis.nix
index 45748c346e2e..c21bb1e479ca 100644
--- a/nixos/modules/services/web-apps/davis.nix
+++ b/nixos/modules/services/web-apps/davis.nix
@@ -220,10 +220,13 @@ in
     };
 
     nginx = lib.mkOption {
-      type = lib.types.submodule (
-        lib.recursiveUpdate (import ../web-servers/nginx/vhost-options.nix { inherit config lib; }) { }
+      type = lib.types.nullOr (
+        lib.types.submodule (
+          lib.recursiveUpdate (import ../web-servers/nginx/vhost-options.nix { inherit config lib; }) {
+          }
+        )
       );
-      default = null;
+      default = { };
       example = ''
         {
           serverAliases = [
@@ -235,7 +238,7 @@ in
         }
       '';
       description = ''
-        With this option, you can customize the nginx virtualHost settings.
+        Use this option to customize an nginx virtual host. To disable the nginx set this to null.
       '';
     };
 
@@ -308,18 +311,16 @@ in
           message = "One of services.davis.database.urlFile or services.davis.database.createLocally must be set.";
         }
         {
-          assertion = (mail.dsn != null) != (mail.dsnFile != null);
-          message = "One of (and only one of) services.davis.mail.dsn or services.davis.mail.dsnFile must be set.";
+          assertion = !(mail.dsn != null && mail.dsnFile != null);
+          message = "services.davis.mail.dsn and services.davis.mail.dsnFile cannot both be set.";
         }
       ];
       services.davis.config =
         {
           APP_ENV = "prod";
           APP_CACHE_DIR = "${cfg.dataDir}/var/cache";
-          # note: we do not need the log dir (we log to stdout/journald), by davis/symfony will try to create it, and the default value is one in the nix-store
-          #       so we set it to a path under dataDir to avoid something like: Unable to create the "logs" directory (/nix/store/5cfskz0ybbx37s1161gjn5klwb5si1zg-davis-4.4.1/var/log).
           APP_LOG_DIR = "${cfg.dataDir}/var/log";
-          LOG_FILE_PATH = "/dev/stdout";
+          LOG_FILE_PATH = "%kernel.logs_dir%/%kernel.environment%.log";
           DATABASE_DRIVER = db.driver;
           INVITE_FROM_ADDRESS = mail.inviteFromAddress;
           APP_SECRET._secret = cfg.appSecretFile;
@@ -330,7 +331,14 @@ in
           CALDAV_ENABLED = true;
           CARDDAV_ENABLED = true;
         }
-        // (if mail.dsn != null then { MAILER_DSN = mail.dsn; } else { MAILER_DSN._secret = mail.dsnFile; })
+        // (
+          if mail.dsn != null then
+            { MAILER_DSN = mail.dsn; }
+          else if mail.dsnFile != null then
+            { MAILER_DSN._secret = mail.dsnFile; }
+          else
+            { }
+        )
         // (
           if db.createLocally then
             {
diff --git a/nixos/tests/davis.nix b/nixos/tests/davis.nix
index 480191704e2c..0dfa08342801 100644
--- a/nixos/tests/davis.nix
+++ b/nixos/tests/davis.nix
@@ -1,10 +1,14 @@
-{ pkgs, ... }:
+{
+  pkgs,
+  config,
+  ...
+}:
 {
   name = "davis";
 
   meta.maintainers = pkgs.davis.meta.maintainers;
 
-  nodes.machine =
+  nodes.machine1 =
     { config, ... }:
     {
       virtualisation = {
@@ -24,33 +28,67 @@
         adminLogin = "admin";
         appSecretFile = "${pkgs.writeText "davisAppSecret" "52882ef142066e09ab99ce816ba72522e789505caba224"}";
         adminPasswordFile = "${pkgs.writeText "davisAdminPass" "nixos"}";
-        nginx = { };
+      };
+    };
+  nodes.machine2 =
+    { nodes, config, ... }:
+    {
+      virtualisation = {
+        memorySize = 512;
+      };
+      environment.systemPackages = [ pkgs.fcgi ];
+
+      # no nginx, and no mail dsn
+      services.davis = {
+        enable = true;
+        hostname = "davis.example.com";
+        database = {
+          driver = "postgresql";
+        };
+        adminLogin = "admin";
+        appSecretFile = "${pkgs.writeText "davisAppSecret" "52882ef142066e09ab99ce816ba72522e789505caba224"}";
+        adminPasswordFile = "${pkgs.writeText "davisAdminPass" "nixos"}";
+        nginx = null;
       };
     };
 
   testScript = ''
     start_all()
-    machine.wait_for_unit("postgresql.service")
-    machine.wait_for_unit("davis-env-setup.service")
-    machine.wait_for_unit("davis-db-migrate.service")
-    machine.wait_for_unit("nginx.service")
-    machine.wait_for_unit("phpfpm-davis.service")
+
+    machine1.wait_for_unit("postgresql.service")
+    machine1.wait_for_unit("davis-env-setup.service")
+    machine1.wait_for_unit("davis-db-migrate.service")
+    machine1.wait_for_unit("phpfpm-davis.service")
 
     with subtest("welcome screen loads"):
-        machine.succeed(
+        machine1.succeed(
             "curl -sSfL --resolve davis.example.com:80:127.0.0.1 http://davis.example.com/ | grep '<title>Davis</title>'"
         )
 
     with subtest("login works"):
-        csrf_token = machine.succeed(
+        csrf_token = machine1.succeed(
             "curl -c /tmp/cookies -sSfL --resolve davis.example.com:80:127.0.0.1 http://davis.example.com/login | grep '_csrf_token' | sed -E 's,.*value=\"(.*)\".*,\\1,g'"
         )
-        r = machine.succeed(
+        r = machine1.succeed(
             f"curl -b /tmp/cookies --resolve davis.example.com:80:127.0.0.1 http://davis.example.com/login -X POST -F _username=admin -F _password=nixos -F _csrf_token={csrf_token.strip()} -D headers"
         )
         print(r)
-        machine.succeed(
+        machine1.succeed(
           "[[ $(grep -i 'location: ' headers | cut -d: -f2- | xargs echo) == /dashboard* ]]"
         )
+    machine2.wait_for_unit("davis-env-setup.service")
+    machine2.wait_for_unit("davis-db-migrate.service")
+    machine2.wait_for_unit("phpfpm-davis.service")
+    r = machine2.succeed(
+        "find /var/lib/davis/var/log"
+    )
+    print(r)
+    env = (
+      "SCRIPT_NAME=/index.php",
+      "SCRIPT_FILENAME=${config.nodes.machine2.services.davis.package}/public/index.php",
+      "REMOTE_ADDR=127.0.0.1",
+      "REQUEST_METHOD=GET",
+    );
+    page = machine2.succeed(f"{' '.join(env)} ${pkgs.fcgi}/bin/cgi-fcgi -bind -connect ${config.nodes.machine2.services.phpfpm.pools.davis.socket}")
   '';
 }

From a0fbac25d6d7c3197e9bb2be2188c64bb8e2c4f7 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Tue, 20 May 2025 20:51:07 +0800
Subject: [PATCH 042/102] xfce.xfce4-battery-plugin: 1.1.6 -> 1.2.0

https://gitlab.xfce.org/panel-plugins/xfce4-battery-plugin/-/compare/xfce4-battery-plugin-1.1.6...xfce4-battery-plugin-1.2.0
---
 .../xfce4-battery-plugin/default.nix          | 44 ++++++++++++++-----
 1 file changed, 34 insertions(+), 10 deletions(-)

diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-battery-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-battery-plugin/default.nix
index e80e2b58f16b..9c07356f1fc9 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-battery-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-battery-plugin/default.nix
@@ -1,21 +1,40 @@
 {
+  stdenv,
   lib,
-  mkXfceDerivation,
+  fetchFromGitLab,
+  gettext,
+  meson,
+  ninja,
+  pkg-config,
   glib,
   gtk3,
   libxfce4ui,
   libxfce4util,
   xfce4-panel,
   xfconf,
+  gitUpdater,
 }:
 
-mkXfceDerivation {
-  category = "panel-plugins";
+stdenv.mkDerivation (finalAttrs: {
   pname = "xfce4-battery-plugin";
-  version = "1.1.6";
-  rev-prefix = "xfce4-battery-plugin-";
-  odd-unstable = false;
-  sha256 = "sha256-tbI4zg6BFsPzREbh/tdFiEbZVXkAsblxzcZdIaQIqa0=";
+  version = "1.2.0";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.xfce.org";
+    owner = "panel-plugins";
+    repo = "xfce4-battery-plugin";
+    tag = "xfce4-battery-plugin-${finalAttrs.version}";
+    hash = "sha256-I4x2QRYp6H5mR4J7nQ+VZ/T3r/dj4r4M9JbgN+oZHWQ=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    gettext
+    meson
+    ninja
+    pkg-config
+  ];
 
   buildInputs = [
     glib
@@ -26,8 +45,13 @@ mkXfceDerivation {
     xfconf
   ];
 
-  meta = with lib; {
+  passthru.updateScript = gitUpdater { rev-prefix = "xfce4-battery-plugin-"; };
+
+  meta = {
     description = "Battery plugin for Xfce panel";
-    teams = [ teams.xfce ];
+    homepage = "https://gitlab.xfce.org/panel-plugins/xfce4-battery-plugin";
+    license = lib.licenses.gpl2Plus;
+    teams = [ lib.teams.xfce ];
+    platforms = lib.platforms.linux;
   };
-}
+})

From b11e2ec94f3cfbe7a10030831af84d3c08d1b99c Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Tue, 20 May 2025 20:55:33 +0800
Subject: [PATCH 043/102] xfce.xfce4-clipman-plugin: 1.6.7 -> 1.7.0

https://gitlab.xfce.org/panel-plugins/xfce4-clipman-plugin/-/compare/xfce4-clipman-plugin-1.6.7...xfce4-clipman-plugin-1.7.0
---
 .../xfce4-clipman-plugin/default.nix          | 45 +++++++++++++++----
 1 file changed, 37 insertions(+), 8 deletions(-)

diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin/default.nix
index 85c21e0b5071..91228bf7e6ba 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin/default.nix
@@ -1,7 +1,13 @@
 {
+  stdenv,
   lib,
-  mkXfceDerivation,
+  fetchFromGitLab,
+  gettext,
+  meson,
+  ninja,
+  pkg-config,
   wayland-scanner,
+  wrapGAppsHook3,
   glib,
   gtk3,
   libX11,
@@ -13,16 +19,34 @@
   xfconf,
   wayland,
   wlr-protocols,
+  gitUpdater,
 }:
 
-mkXfceDerivation {
-  category = "panel-plugins";
+stdenv.mkDerivation (finalAttrs: {
   pname = "xfce4-clipman-plugin";
-  version = "1.6.7";
-  sha256 = "sha256-kbcA1X5LBnk1FcrhVqpCENp5bleJga2jnCh1RltN72o=";
+  version = "1.7.0";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.xfce.org";
+    owner = "panel-plugins";
+    repo = "xfce4-clipman-plugin";
+    tag = "xfce4-clipman-plugin-${finalAttrs.version}";
+    hash = "sha256-w9axHJJnTQrkN9s3RQyvkOcK0FOqsvWpoJ+UCDntnZk=";
+  };
+
+  strictDeps = true;
+
+  depsBuildBuild = [
+    pkg-config
+  ];
 
   nativeBuildInputs = [
+    gettext
+    meson
+    ninja
+    pkg-config
     wayland-scanner
+    wrapGAppsHook3
   ];
 
   buildInputs = [
@@ -39,8 +63,13 @@ mkXfceDerivation {
     wlr-protocols
   ];
 
-  meta = with lib; {
+  passthru.updateScript = gitUpdater { rev-prefix = "xfce4-clipman-plugin-"; };
+
+  meta = {
     description = "Clipboard manager for Xfce panel";
-    teams = [ teams.xfce ];
+    homepage = "https://gitlab.xfce.org/panel-plugins/xfce4-clipman-plugin";
+    license = lib.licenses.gpl2Plus;
+    teams = [ lib.teams.xfce ];
+    platforms = lib.platforms.linux;
   };
-}
+})

From 6fbed703d6aaf0b245f55dae84c326c43ad7d66a Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Tue, 20 May 2025 20:57:48 +0800
Subject: [PATCH 044/102] xfce.xfce4-cpufreq-plugin: 1.2.9 -> 1.3.0

https://gitlab.xfce.org/panel-plugins/xfce4-cpufreq-plugin/-/compare/xfce4-cpufreq-plugin-1.2.9...xfce4-cpufreq-plugin-1.3.0
---
 .../xfce4-cpufreq-plugin/default.nix          | 44 +++++++++++++++----
 1 file changed, 36 insertions(+), 8 deletions(-)

diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-cpufreq-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-cpufreq-plugin/default.nix
index ea2988edc8cf..e7d31cffa48e 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-cpufreq-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-cpufreq-plugin/default.nix
@@ -1,20 +1,43 @@
 {
+  stdenv,
   lib,
-  mkXfceDerivation,
+  fetchFromGitLab,
+  gettext,
+  meson,
+  ninja,
+  pkg-config,
+  glib,
   gtk3,
   libxfce4ui,
   libxfce4util,
   xfce4-panel,
   xfconf,
+  gitUpdater,
 }:
 
-mkXfceDerivation {
-  category = "panel-plugins";
+stdenv.mkDerivation (finalAttrs: {
   pname = "xfce4-cpufreq-plugin";
-  version = "1.2.9";
-  sha256 = "sha256-WC419ZRQAnV+yNbdWH5lMt4RGvQb7zv2dqQdTE2kIFU=";
+  version = "1.3.0";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.xfce.org";
+    owner = "panel-plugins";
+    repo = "xfce4-cpufreq-plugin";
+    tag = "xfce4-cpufreq-plugin-${finalAttrs.version}";
+    hash = "sha256-IJ0gOzMs2JBS8KIlD5NHyUOf53PtTytm8J/j+5AEh5E=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    gettext
+    meson
+    ninja
+    pkg-config
+  ];
 
   buildInputs = [
+    glib
     gtk3
     libxfce4ui
     libxfce4util
@@ -22,8 +45,13 @@ mkXfceDerivation {
     xfconf
   ];
 
-  meta = with lib; {
+  passthru.updateScript = gitUpdater { rev-prefix = "xfce4-cpufreq-plugin-"; };
+
+  meta = {
     description = "CPU Freq load plugin for Xfce panel";
-    teams = [ teams.xfce ];
+    homepage = "https://gitlab.xfce.org/panel-plugins/xfce4-cpufreq-plugin";
+    license = lib.licenses.gpl2Plus;
+    teams = [ lib.teams.xfce ];
+    platforms = lib.platforms.linux;
   };
-}
+})

From b7597774c328ecd7c53998ca9219c68d6f83b551 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Tue, 20 May 2025 21:02:13 +0800
Subject: [PATCH 045/102] xfce.xfce4-cpugraph-plugin: 1.2.11 -> 1.3.0

https://gitlab.xfce.org/panel-plugins/xfce4-cpugraph-plugin/-/compare/xfce4-cpugraph-plugin-1.2.11...xfce4-cpugraph-plugin-1.3.0
---
 .../xfce4-cpugraph-plugin/default.nix         | 50 +++++++++++++------
 1 file changed, 34 insertions(+), 16 deletions(-)

diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-cpugraph-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-cpugraph-plugin/default.nix
index 7b808f305f91..e390d014568b 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-cpugraph-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-cpugraph-plugin/default.nix
@@ -1,39 +1,57 @@
 {
+  stdenv,
   lib,
-  mkXfceDerivation,
-  exo,
+  fetchFromGitLab,
+  gettext,
+  meson,
+  ninja,
+  pkg-config,
   glib,
   gtk3,
-  libXtst,
   libxfce4ui,
   libxfce4util,
   xfce4-panel,
   xfconf,
-  xorgproto,
+  gitUpdater,
 }:
 
-mkXfceDerivation {
-  category = "panel-plugins";
+stdenv.mkDerivation (finalAttrs: {
   pname = "xfce4-cpugraph-plugin";
-  version = "1.2.11";
-  rev-prefix = "xfce4-cpugraph-plugin-";
-  odd-unstable = false;
-  sha256 = "sha256-Q+H6riGF5sEcyrVFoDfudwVw4QORa2atE6NTb+xde/w=";
+  version = "1.3.0";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.xfce.org";
+    owner = "panel-plugins";
+    repo = "xfce4-cpugraph-plugin";
+    tag = "xfce4-cpugraph-plugin-${finalAttrs.version}";
+    hash = "sha256-IXAoxMzKZhABiiZYhL4UGkzqFNGMJicGQqSIfy2DEfc=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    gettext
+    meson
+    ninja
+    pkg-config
+  ];
 
   buildInputs = [
-    exo
     glib
     gtk3
-    libXtst
     libxfce4ui
     libxfce4util
     xfce4-panel
     xfconf
-    xorgproto
   ];
 
-  meta = with lib; {
+  passthru.updateScript = gitUpdater { rev-prefix = "xfce4-cpugraph-plugin-"; };
+
+  meta = {
     description = "CPU graph show for Xfce panel";
-    teams = [ teams.xfce ];
+    homepage = "https://gitlab.xfce.org/panel-plugins/xfce4-cpugraph-plugin";
+    license = lib.licenses.gpl2Plus;
+    teams = [ lib.teams.xfce ];
+    platforms = lib.platforms.linux;
   };
-}
+})

From d928858be80a8a7a68cdf25192d7c6f47d1bc080 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Tue, 20 May 2025 21:14:41 +0800
Subject: [PATCH 046/102] xfce.xfce4-datetime-plugin: Remove

Unmaintained.
---
 pkgs/desktops/xfce/default.nix                |  7 ++--
 .../xfce4-datetime-plugin/default.nix         | 32 -------------------
 2 files changed, 5 insertions(+), 34 deletions(-)
 delete mode 100644 pkgs/desktops/xfce/panel-plugins/xfce4-datetime-plugin/default.nix

diff --git a/pkgs/desktops/xfce/default.nix b/pkgs/desktops/xfce/default.nix
index bfff7d4b9387..2a907a4ba39c 100644
--- a/pkgs/desktops/xfce/default.nix
+++ b/pkgs/desktops/xfce/default.nix
@@ -119,8 +119,6 @@ makeScopeWithSplicing' {
 
       xfce4-cpugraph-plugin = callPackage ./panel-plugins/xfce4-cpugraph-plugin { };
 
-      xfce4-datetime-plugin = callPackage ./panel-plugins/xfce4-datetime-plugin { };
-
       xfce4-dockbarx-plugin = callPackage ./panel-plugins/xfce4-dockbarx-plugin { };
 
       xfce4-docklike-plugin = callPackage ./panel-plugins/xfce4-docklike-plugin { };
@@ -173,6 +171,11 @@ makeScopeWithSplicing' {
 
       thunar-bare = self.thunar.override { thunarPlugins = [ ]; }; # added 2019-11-04
 
+      xfce4-datetime-plugin = throw ''
+        xfce4-datetime-plugin has been removed: this plugin has been merged into the xfce4-panel's built-in clock
+        plugin and thus no longer maintained upstream, see https://gitlab.xfce.org/xfce/xfce4-panel/-/issues/563.
+      ''; # Added 2025-05-20
+
       xfce4-embed-plugin = throw "xfce4-embed-plugin has been removed, as it was broken"; # Added 2024-07-15
 
       xfce4-hardware-monitor-plugin = throw "xfce.xfce4-hardware-monitor-plugin has been removed: abandoned by upstream and does not build"; # added 2023-01-15
diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-datetime-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-datetime-plugin/default.nix
deleted file mode 100644
index 387f800f9832..000000000000
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-datetime-plugin/default.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  mkXfceDerivation,
-  lib,
-  intltool,
-  libxfce4ui,
-  xfce4-panel,
-  gettext,
-}:
-
-mkXfceDerivation {
-  category = "panel-plugins";
-  pname = "xfce4-datetime-plugin";
-  version = "0.8.3";
-
-  rev-prefix = "xfce4-datetime-plugin-";
-  sha256 = "sha256-dpN5ZN7VjgO1GQ6v8NXuBKACyIwIosaiVGtmLEb6auI=";
-
-  nativeBuildInputs = [
-    gettext
-    intltool
-  ];
-
-  buildInputs = [
-    libxfce4ui
-    xfce4-panel
-  ];
-
-  meta = with lib; {
-    description = "Shows the date and time in the panel, and a calendar appears when you left-click on it";
-    teams = [ teams.xfce ];
-  };
-}

From e7326d809a42f4e10d7d4f2849955b35a5414e51 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Tue, 20 May 2025 21:22:13 +0800
Subject: [PATCH 047/102] xfce.xfce4-docklike-plugin: 0.4.3 -> 0.5.0

https://gitlab.xfce.org/panel-plugins/xfce4-docklike-plugin/-/compare/xfce4-docklike-plugin-0.4.3...xfce4-docklike-plugin-0.5.0
---
 .../xfce4-docklike-plugin/default.nix         | 54 ++++++++++++++-----
 1 file changed, 42 insertions(+), 12 deletions(-)

diff --git a/pkgs/desktops/xfce/panel-plugins/xfce4-docklike-plugin/default.nix b/pkgs/desktops/xfce/panel-plugins/xfce4-docklike-plugin/default.nix
index 29a916adcce9..3253513edaa9 100644
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-docklike-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-docklike-plugin/default.nix
@@ -1,22 +1,49 @@
 {
+  stdenv,
   lib,
-  mkXfceDerivation,
+  fetchFromGitLab,
+  gettext,
+  meson,
+  ninja,
+  pkg-config,
   cairo,
   glib,
   gtk3,
   gtk-layer-shell,
   libX11,
+  libXi,
   libxfce4ui,
   libxfce4util,
-  xfce4-panel,
   libxfce4windowing,
+  xfce4-panel,
+  gitUpdater,
 }:
 
-mkXfceDerivation {
-  category = "panel-plugins";
+stdenv.mkDerivation (finalAttrs: {
   pname = "xfce4-docklike-plugin";
-  version = "0.4.3";
-  sha256 = "sha256-cQ9B/sIzp1sq3GXPMtbb8xrfFhWiBS+FDe7/qlWVPdA=";
+  version = "0.5.0";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.xfce.org";
+    owner = "panel-plugins";
+    repo = "xfce4-docklike-plugin";
+    tag = "xfce4-docklike-plugin-${finalAttrs.version}";
+    hash = "sha256-1R9qQKqn/CIV36GYmyg54t3xiY23qUs5EMLxvAIavK8=";
+  };
+
+  strictDeps = true;
+
+  depsBuildBuild = [
+    pkg-config
+  ];
+
+  nativeBuildInputs = [
+    gettext
+    glib # glib-compile-resources
+    meson
+    ninja
+    pkg-config
+  ];
 
   buildInputs = [
     cairo
@@ -24,17 +51,20 @@ mkXfceDerivation {
     gtk3
     gtk-layer-shell
     libX11
+    libXi
     libxfce4ui
     libxfce4util
-    xfce4-panel
     libxfce4windowing
+    xfce4-panel
   ];
 
-  meta = with lib; {
+  passthru.updateScript = gitUpdater { rev-prefix = "xfce4-docklike-plugin-"; };
+
+  meta = {
     homepage = "https://docs.xfce.org/panel-plugins/xfce4-docklike-plugin/start";
     description = "Modern, minimalist taskbar for Xfce";
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-    teams = [ teams.xfce ];
+    license = lib.licenses.gpl3Plus;
+    teams = [ lib.teams.xfce ];
+    platforms = lib.platforms.linux;
   };
-}
+})

From ed8e18ad6a22122e6b7640a3ee13d85be74c1bbf Mon Sep 17 00:00:00 2001
From: TheTaoOfSu <TheTaoOfSu@protonmail.com>
Date: Tue, 20 May 2025 17:26:00 +0200
Subject: [PATCH 048/102] maintainers: add thetaoofsu

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 2bdd25f9a199..51952c15985c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -24620,6 +24620,12 @@
     githubId = 6579555;
     name = "Jeroen Jetten";
   };
+  thetaoofsu = {
+    email = "TheTaoOfSu@protonmail.com";
+    github = "TheTaoOfSu";
+    githubId = 45526311;
+    name = "TheTaoOfSu";
+  };
   theuni = {
     email = "ct@flyingcircus.io";
     github = "ctheune";

From 4673e3b79ed9f8dad1395756fd5f4424a66f74c2 Mon Sep 17 00:00:00 2001
From: Yureka <yureka@cyberchaos.dev>
Date: Tue, 20 May 2025 12:37:21 +0200
Subject: [PATCH 049/102] attic-server: don't depend on nix

---
 pkgs/by-name/at/attic-client/package.nix | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/at/attic-client/package.nix b/pkgs/by-name/at/attic-client/package.nix
index 99b38d0e0228..3b8a97074e52 100644
--- a/pkgs/by-name/at/attic-client/package.nix
+++ b/pkgs/by-name/at/attic-client/package.nix
@@ -10,6 +10,11 @@
   installShellFiles,
   crates ? [ "attic-client" ],
 }:
+let
+  # Only the attic-client crate builds against the Nix C++ libs
+  # This derivation is also used to build the server
+  needNixInclude = lib.elem "attic-client" crates;
+in
 rustPlatform.buildRustPackage {
   pname = "attic";
   version = "0-unstable-2025-02-02";
@@ -26,8 +31,7 @@ rustPlatform.buildRustPackage {
     installShellFiles
   ];
 
-  buildInputs = [
-    nixVersions.nix_2_24
+  buildInputs = lib.optional needNixInclude nixVersions.nix_2_24 ++ [
     boost
   ];
 
@@ -35,8 +39,13 @@ rustPlatform.buildRustPackage {
   cargoHash = "sha256-AbpWnYfBMrR6oOfy2LkQvIPYsClCWE89bJav+iHTtLM=";
   useFetchCargoVendor = true;
 
-  ATTIC_DISTRIBUTOR = "nixpkgs";
-  NIX_INCLUDE_PATH = "${lib.getDev nixVersions.nix_2_24}/include";
+  env =
+    {
+      ATTIC_DISTRIBUTOR = "nixpkgs";
+    }
+    // lib.optionalAttrs needNixInclude {
+      NIX_INCLUDE_PATH = "${lib.getDev nixVersions.nix_2_24}/include";
+    };
 
   # Attic interacts with Nix directly and its tests require trusted-user access
   # to nix-daemon to import NARs, which is not possible in the build sandbox.

From 30557761ee286c369663b5346590a2a5786ec4e5 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 20 May 2025 19:11:41 +0200
Subject: [PATCH 050/102] python312Packages.huggingface-hub: 0.30.2 -> 0.31.4

Diff: https://github.com/huggingface/huggingface_hub/compare/refs/tags/v0.30.2...refs/tags/v0.31.4

Changelog: https://github.com/huggingface/huggingface_hub/releases/tag/v0.31.4
---
 pkgs/development/python-modules/huggingface-hub/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/huggingface-hub/default.nix b/pkgs/development/python-modules/huggingface-hub/default.nix
index 923405a61efc..7f0f3155bbf8 100644
--- a/pkgs/development/python-modules/huggingface-hub/default.nix
+++ b/pkgs/development/python-modules/huggingface-hub/default.nix
@@ -39,14 +39,14 @@
 
 buildPythonPackage rec {
   pname = "huggingface-hub";
-  version = "0.30.2";
+  version = "0.31.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "huggingface_hub";
     tag = "v${version}";
-    hash = "sha256-6nE6iKIC6ymI+NMOw/xQT4l5nshDyPdGI0YhqK7tQRE=";
+    hash = "sha256-V/FbInskBHefbPkbwQyx+aWBcdrk5WaXXbR/v3fNU+Y=";
   };
 
   build-system = [ setuptools ];

From b5cd0c70b68098cdb4498425fce05a86ba6882d0 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 20 May 2025 19:11:57 +0200
Subject: [PATCH 051/102] python312Packages.transformers: 4.51.3 -> 4.52.0

Diff: https://github.com/huggingface/transformers/compare/refs/tags/v4.51.3...refs/tags/v4.52.0

Changelog: https://github.com/huggingface/transformers/releases/tag/v4.52.0
---
 pkgs/development/python-modules/transformers/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/transformers/default.nix b/pkgs/development/python-modules/transformers/default.nix
index 1167a01ee3bd..ebbe924c181c 100644
--- a/pkgs/development/python-modules/transformers/default.nix
+++ b/pkgs/development/python-modules/transformers/default.nix
@@ -58,14 +58,14 @@
 
 buildPythonPackage rec {
   pname = "transformers";
-  version = "4.51.3";
+  version = "4.52.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "transformers";
     tag = "v${version}";
-    hash = "sha256-VYEkBt0fpG27MVdnABcMAMmk2Pzsc+2Fetx/GmeFBac=";
+    hash = "sha256-dMdXkhLClFxClBl/Nk4nnfrFZaulnhMsGFKmhkMq2Q0=";
   };
 
   build-system = [ setuptools ];

From 53507d63f6a8d9bacb08c3de5411b2c6a976ff5e Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 20 May 2025 12:53:26 +0300
Subject: [PATCH 052/102] opencloud: init at 2.3.0

Co-authored-by: Christoph Heiss <christoph@c8h4.io>
---
 pkgs/by-name/op/opencloud/package.nix | 116 ++++++++++++++++++++++++++
 1 file changed, 116 insertions(+)
 create mode 100644 pkgs/by-name/op/opencloud/package.nix

diff --git a/pkgs/by-name/op/opencloud/package.nix b/pkgs/by-name/op/opencloud/package.nix
new file mode 100644
index 000000000000..089e33c8ae7c
--- /dev/null
+++ b/pkgs/by-name/op/opencloud/package.nix
@@ -0,0 +1,116 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  ncurses,
+  gettext,
+  pigeon,
+  go-mockery,
+  protoc-go-inject-tag,
+  libxcrypt,
+  vips,
+  pkg-config,
+  nixosTests,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+let
+  bingoBinsMakefile = builtins.concatStringsSep "\n" (
+    lib.mapAttrsToList (n: v: "${n} := ${v}\n\\$(${n}):") {
+      GO_XGETTEXT = "xgettext";
+      MOCKERY = "mockery";
+      PIGEON = "pigeon";
+      PROTOC_GO_INJECT_TAG = "protoc-go-inject-tag";
+    }
+  );
+in
+buildGoModule rec {
+  pname = "opencloud";
+  version = "2.3.0";
+
+  src = fetchFromGitHub {
+    owner = "opencloud-eu";
+    repo = "opencloud";
+    tag = "v${version}";
+    hash = "sha256-IIasFyKF28ynYi8bAmx8LddF0OWB1/Hji6Ovp5pm9QE=";
+  };
+
+  postPatch = ''
+    echo "${bingoBinsMakefile}" >.bingo/Variables.mk
+
+    # tries to build web assets, done separately
+    substituteInPlace services/idp/Makefile \
+      --replace-fail 'node-generate-prod: assets' 'node-generate-prod:'
+    # tries to download something web assets ..
+    substituteInPlace services/web/Makefile \
+      --replace-fail 'node-generate-prod: download-assets' 'node-generate-prod:'
+
+    # tries to build some random binaries off the internet and
+    # no need to build protobuf bindings anyway, as they are in-repo already
+    sed -i -e '/\$(BINGO) get/d' -e '/\$(BUF) generate/d' .make/protobuf.mk
+  '';
+
+  vendorHash = null;
+
+  preConfigure = ''
+    export HOME=$(mktemp -d)
+    make generate
+  '';
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X"
+    "github.com/opencloud-eu/opencloud/pkg/version.String=nixos"
+    "-X"
+    "github.com/opencloud-eu/opencloud/pkg/version.Tag=${version}"
+    "-X"
+    "github.com/opencloud-eu/opencloud/pkg/version.Date=19700101"
+  ];
+
+  tags = [ "enable_vips" ];
+
+  nativeBuildInputs = [
+    ncurses
+    gettext
+    pigeon
+    go-mockery
+    protoc-go-inject-tag
+    pkg-config
+  ];
+
+  buildInputs = [
+    libxcrypt
+    vips
+  ];
+
+  env = {
+    # avoids 'make generate' calling `git`, otherwise no-op
+    STRING = version;
+    VERSION = version;
+  };
+
+  excludedPackages = [ "tests/*" ];
+
+  passthru = {
+    tests = { inherit (nixosTests) opencloud; };
+    updateScript = nix-update-script { };
+  };
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = [ "version" ];
+
+  meta = {
+    description = "OpenCloud gives you a secure and private way to store, access, and share your files.";
+    homepage = "https://github.com/opencloud-eu/opencloud";
+    changelog = "https://github.com/opencloud-eu/opencloud/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      christoph-heiss
+      k900
+    ];
+    mainProgram = "opencloud";
+  };
+}

From 733af62ab3580af9b8ba0ac950ddfda12e9ba111 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 20 May 2025 12:53:33 +0300
Subject: [PATCH 053/102] opencloud-web: init at 2.4.0

Co-authored-by: Christoph Heiss <christoph@c8h4.io>
---
 pkgs/by-name/op/opencloud/package.nix |  2 +
 pkgs/by-name/op/opencloud/web.nix     | 57 +++++++++++++++++++++++++++
 2 files changed, 59 insertions(+)
 create mode 100644 pkgs/by-name/op/opencloud/web.nix

diff --git a/pkgs/by-name/op/opencloud/package.nix b/pkgs/by-name/op/opencloud/package.nix
index 089e33c8ae7c..3362c1459bf1 100644
--- a/pkgs/by-name/op/opencloud/package.nix
+++ b/pkgs/by-name/op/opencloud/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  callPackage,
   buildGoModule,
   fetchFromGitHub,
   ncurses,
@@ -94,6 +95,7 @@ buildGoModule rec {
   excludedPackages = [ "tests/*" ];
 
   passthru = {
+    web = callPackage ./web.nix { };
     tests = { inherit (nixosTests) opencloud; };
     updateScript = nix-update-script { };
   };
diff --git a/pkgs/by-name/op/opencloud/web.nix b/pkgs/by-name/op/opencloud/web.nix
new file mode 100644
index 000000000000..665ca2fd8586
--- /dev/null
+++ b/pkgs/by-name/op/opencloud/web.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  nodejs,
+  pnpm_10,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "opencloud-web";
+  version = "2.4.0";
+
+  src = fetchFromGitHub {
+    owner = "opencloud-eu";
+    repo = "web";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-64Dwkx5IEwlaIX1z6Roi6cSWB2ETBldQcNWxgWiUX18=";
+  };
+
+  pnpmDeps = pnpm_10.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-UKgtthdRnI+iR4Qn07nabQOzWZFATjIfrQfwxhKJkx8=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm_10.configHook
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    pnpm build
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir $out
+    cp -r dist/* $out
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Web UI for OpenCloud built with Vue.js and TypeScript";
+    homepage = "https://github.com/opencloud-eu/web";
+    changelog = "https://github.com/opencloud-eu/web/blob/${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [
+      christoph-heiss
+      k900
+    ];
+    platforms = lib.platforms.all;
+  };
+})

From 3c20fdf1f83773473aeac99e1f5b85c91211307f Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 20 May 2025 12:53:38 +0300
Subject: [PATCH 054/102] opencloud-idp-web: init at 2.3.0

Co-authored-by: Christoph Heiss <christoph@c8h4.io>
---
 pkgs/by-name/op/opencloud/idp-web.nix | 55 +++++++++++++++++++++++++++
 pkgs/by-name/op/opencloud/package.nix |  1 +
 2 files changed, 56 insertions(+)
 create mode 100644 pkgs/by-name/op/opencloud/idp-web.nix

diff --git a/pkgs/by-name/op/opencloud/idp-web.nix b/pkgs/by-name/op/opencloud/idp-web.nix
new file mode 100644
index 000000000000..914915399118
--- /dev/null
+++ b/pkgs/by-name/op/opencloud/idp-web.nix
@@ -0,0 +1,55 @@
+{
+  stdenvNoCC,
+  lib,
+  opencloud,
+  pnpm_10,
+  nodejs,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "opencloud-idp-web";
+
+  inherit (opencloud) version src;
+
+  pnpmRoot = "services/idp";
+
+  pnpmDeps = pnpm_10.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pnpmRoot}";
+    hash = "sha256-gFhWDYk3DcwUowZ9AQjCqHZL1oniK3YCNiG1cDGabYg=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm_10.configHook
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    cd $pnpmRoot
+    pnpm build
+    mkdir -p assets/identifier/static
+    cp -v src/images/favicon.svg assets/identifier/static/favicon.svg
+    cp -v src/images/icon-lilac.svg assets/identifier/static/icon-lilac.svg
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir $out
+    cp -r assets $out
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "OpenCloud - IDP Web UI";
+    homepage = "https://github.com/opencloud-eu/opencloud";
+    changelog = "https://github.com/opencloud-eu/opencloud/blob/v${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      christoph-heiss
+      k900
+    ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/op/opencloud/package.nix b/pkgs/by-name/op/opencloud/package.nix
index 3362c1459bf1..a3736dacbf12 100644
--- a/pkgs/by-name/op/opencloud/package.nix
+++ b/pkgs/by-name/op/opencloud/package.nix
@@ -96,6 +96,7 @@ buildGoModule rec {
 
   passthru = {
     web = callPackage ./web.nix { };
+    idp-web = callPackage ./idp-web.nix { };
     tests = { inherit (nixosTests) opencloud; };
     updateScript = nix-update-script { };
   };

From c1bbd4cb879b73617c4039d9a9254ea576296d73 Mon Sep 17 00:00:00 2001
From: Casey Link <unnamedrambler@gmail.com>
Date: Fri, 9 May 2025 15:21:00 +0200
Subject: [PATCH 055/102] davis: pin to php83 because php84 is broken

As per upstream's request:
https://github.com/tchapi/davis/issues/195#issuecomment-2866750216

The imap libraries have been unbundled in php 8.4 causing rippling
effects throughout the ecosystem. https://php.watch/versions/8.4/imap-unbundled
---
 pkgs/by-name/da/davis/package.nix | 7 +++++--
 pkgs/top-level/all-packages.nix   | 4 ++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/da/davis/package.nix b/pkgs/by-name/da/davis/package.nix
index 9c937919c864..45923d8625f2 100644
--- a/pkgs/by-name/da/davis/package.nix
+++ b/pkgs/by-name/da/davis/package.nix
@@ -27,8 +27,11 @@ php.buildComposerProject2 (finalAttrs: {
     rm -rf "$out/share"
   '';
 
-  passthru.tests = {
-    inherit (nixosTests) davis;
+  passthru = {
+    php = php;
+    tests = {
+      inherit (nixosTests) davis;
+    };
   };
 
   meta = {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 198ea1b474a6..ac0bd59f05d4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16940,4 +16940,8 @@ with pkgs;
   rustdesk-flutter = callPackage ../by-name/ru/rustdesk-flutter/package.nix {
     flutter = flutter324;
   };
+
+  davis = callPackage ../by-name/da/davis/package.nix {
+    php = php83; # https://github.com/tchapi/davis/issues/195
+  };
 }

From b6f51cf13d46151f92e4d55130bde3f852eaa090 Mon Sep 17 00:00:00 2001
From: Casey Link <unnamedrambler@gmail.com>
Date: Fri, 9 May 2025 16:45:20 +0200
Subject: [PATCH 056/102] nixos/davis: Use the php version defined by the davis
 package

---
 nixos/modules/services/web-apps/davis.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/web-apps/davis.nix b/nixos/modules/services/web-apps/davis.nix
index 45748c346e2e..444f8fc2cd20 100644
--- a/nixos/modules/services/web-apps/davis.nix
+++ b/nixos/modules/services/web-apps/davis.nix
@@ -381,6 +381,7 @@ in
           APP_CACHE_DIR = "${cfg.dataDir}/var/cache";
           APP_LOG_DIR = "${cfg.dataDir}/var/log";
         };
+        phpPackage = lib.mkDefault cfg.package.passthru.php;
         settings =
           {
             "listen.mode" = "0660";

From 54d456eaa5963614b90bae35708b81917d4587c0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 20 May 2025 19:08:59 +0000
Subject: [PATCH 057/102] kora-icon-theme: 1.6.4 -> 1.6.5

---
 pkgs/data/icons/kora-icon-theme/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/data/icons/kora-icon-theme/default.nix b/pkgs/data/icons/kora-icon-theme/default.nix
index 22f5ddd734d4..bb32bda29cf4 100644
--- a/pkgs/data/icons/kora-icon-theme/default.nix
+++ b/pkgs/data/icons/kora-icon-theme/default.nix
@@ -11,13 +11,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "kora-icon-theme";
-  version = "1.6.4";
+  version = "1.6.5";
 
   src = fetchFromGitHub {
     owner = "bikass";
     repo = "kora";
     rev = "v${version}";
-    sha256 = "sha256-5bGiePD0PwTvVEdVDzr6hIVtLwwF2mPa8ywLH1u8hLk=";
+    sha256 = "sha256-Oralfx5MzCzkx+c+zwtFp8q83oKrNINd/PmVeugNKGo=";
   };
 
   nativeBuildInputs = [

From 821b7aac04da30ada9f24c90b8dfb24c1bd86034 Mon Sep 17 00:00:00 2001
From: RockWolf <git@rockwolf.eu>
Date: Tue, 20 May 2025 22:09:41 +0200
Subject: [PATCH 058/102] k3s: add details about `prefer-bundled-bin`

---
 pkgs/applications/networking/cluster/k3s/docs/USAGE.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/applications/networking/cluster/k3s/docs/USAGE.md b/pkgs/applications/networking/cluster/k3s/docs/USAGE.md
index 326118e1712a..e3f3dfb8d38c 100644
--- a/pkgs/applications/networking/cluster/k3s/docs/USAGE.md
+++ b/pkgs/applications/networking/cluster/k3s/docs/USAGE.md
@@ -28,6 +28,7 @@ Multi-node setup
 it is simple to create a cluster of multiple nodes in a highly available setup (all nodes are in the control-plane and are a part of the etcd cluster).
 
 The first node is configured like this:
+
 ```
 {
   services.k3s = {
@@ -55,3 +56,11 @@ Any other subsequent nodes can be added with a slightly different config:
 For this to work you need to open the aforementioned API, etcd, and flannel ports in the firewall. Official documentation on what ports need to be opened for specific use cases can be found on [k3s' documentation site](https://docs.k3s.io/installation/requirements#inbound-rules-for-k3s-nodes). Note that it is [recommended](https://etcd.io/docs/v3.3/faq/#why-an-odd-number-of-cluster-members) to use an odd number of nodes in such a cluster.
 
 Tip: If you run into connectivity issues between nodes for specific applications (e.g. ingress controller), please verify the firewall settings you have enabled (example under [Single Node](#single-node)) against the documentation for that specific application. In the ingress controller example, you may want to open 443 or 80 depending on your use case.
+
+## Quirks
+
+### `prefer-bundled-bin`
+
+K3s has a config setting `prefer-bundled-bin` (and CLI flag `--prefer-bundled-bin`) that makes k3s use binaries from the `/var/lib/rancher/k3s/data/current/bin/aux/` directory, as unpacked by the k3s binary, before the system `$PATH`.
+This works with the official distribution of k3s but not with the package from nixpkgs, as it does not bundle the upstream binaries from [`k3s-root`](https://github.com/k3s-io/k3s-root) into the k3s binary.
+Thus the `prefer-bundled-bin` setting **cannot** be used to work around issues (like [this `mount` regression](https://github.com/util-linux/util-linux/issues/3474)) with binaries used/called by the kubelet.

From 427d00982483b773be765febf71513925ec0eed3 Mon Sep 17 00:00:00 2001
From: Break Yang <BreakDS@gmail.com>
Date: Tue, 20 May 2025 14:27:18 -0700
Subject: [PATCH 059/102] Update
 pkgs/development/python-modules/flashinfer/default.nix

Co-authored-by: Connor Baker <ConnorBaker01@Gmail.com>
---
 .../python-modules/flashinfer/default.nix          | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/flashinfer/default.nix b/pkgs/development/python-modules/flashinfer/default.nix
index fb2004be007f..09b74b3ba3c8 100644
--- a/pkgs/development/python-modules/flashinfer/default.nix
+++ b/pkgs/development/python-modules/flashinfer/default.nix
@@ -88,13 +88,13 @@ buildPythonPackage {
 
   meta = with lib; {
     homepage = "https://flashinfer.ai/";
-    description = ''
-      ;
-            FlashInfer is a library and kernel generator for Large Language Models
-            that provides high-performance implementation of LLM GPU kernels such as
-            FlashAttention, PageAttention and LoRA. FlashInfer focus on LLM serving
-            and inference, and delivers state-of-the-art performance across diverse
-            scenarios.
+    description = "Library and kernel generator for Large Language Models";
+    longDescription = ''
+      FlashInfer is a library and kernel generator for Large Language Models
+      that provides high-performance implementation of LLM GPU kernels such as
+      FlashAttention, PageAttention and LoRA. FlashInfer focus on LLM serving
+      and inference, and delivers state-of-the-art performance across diverse
+      scenarios.
     '';
     license = licenses.asl20;
     maintainers = with maintainers; [ breakds ];

From a792e3cc6e3c660912942a24af937071c1b594a9 Mon Sep 17 00:00:00 2001
From: Break Yang <BreakDS@gmail.com>
Date: Tue, 20 May 2025 14:31:01 -0700
Subject: [PATCH 060/102] Update
 pkgs/development/python-modules/flashinfer/default.nix

Co-authored-by: Connor Baker <ConnorBaker01@Gmail.com>
---
 pkgs/development/python-modules/flashinfer/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/flashinfer/default.nix b/pkgs/development/python-modules/flashinfer/default.nix
index 09b74b3ba3c8..50bb5b345984 100644
--- a/pkgs/development/python-modules/flashinfer/default.nix
+++ b/pkgs/development/python-modules/flashinfer/default.nix
@@ -87,6 +87,7 @@ buildPythonPackage {
   ];
 
   meta = with lib; {
+    broken = !torch.cudaSupport || !config.cudaSupport;
     homepage = "https://flashinfer.ai/";
     description = "Library and kernel generator for Large Language Models";
     longDescription = ''

From e511952b610fe5b9d82a774cdbc9036648422aad Mon Sep 17 00:00:00 2001
From: Break Yang <breakds@gmail.com>
Date: Tue, 20 May 2025 14:31:33 -0700
Subject: [PATCH 061/102] Remove assert

---
 pkgs/development/python-modules/flashinfer/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/flashinfer/default.nix b/pkgs/development/python-modules/flashinfer/default.nix
index 50bb5b345984..ee255c57336c 100644
--- a/pkgs/development/python-modules/flashinfer/default.nix
+++ b/pkgs/development/python-modules/flashinfer/default.nix
@@ -16,8 +16,6 @@
   torch,
 }:
 
-assert torch.cudaSupport;
-
 let
   pname = "flashinfer";
   version = "0.2.5";

From 4875dd88d8774cdbab05b904e1f802fa2cbd4820 Mon Sep 17 00:00:00 2001
From: Break Yang <breakds@gmail.com>
Date: Tue, 20 May 2025 14:33:32 -0700
Subject: [PATCH 062/102] Simplify TORCH_CUDA_ARCH_LIST - function call already
 returns a string

---
 pkgs/development/python-modules/flashinfer/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/flashinfer/default.nix b/pkgs/development/python-modules/flashinfer/default.nix
index ee255c57336c..99da58ba8f87 100644
--- a/pkgs/development/python-modules/flashinfer/default.nix
+++ b/pkgs/development/python-modules/flashinfer/default.nix
@@ -77,7 +77,7 @@ buildPythonPackage {
   '';
 
   CUDA_HOME = "${cudaPackages.cudatoolkit}";
-  TORCH_CUDA_ARCH_LIST = "${lib.concatStringsSep ";" torch.cudaCapabilities}";
+  TORCH_CUDA_ARCH_LIST = lib.concatStringsSep ";" torch.cudaCapabilities;
 
   dependencies = [
     numpy

From d40d3b0fe7ad80b4e602b586936ba268f6efe402 Mon Sep 17 00:00:00 2001
From: Break Yang <breakds@gmail.com>
Date: Tue, 20 May 2025 15:29:12 -0700
Subject: [PATCH 063/102] A few updates

---
 .../development/python-modules/flashinfer/default.nix | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/flashinfer/default.nix b/pkgs/development/python-modules/flashinfer/default.nix
index 99da58ba8f87..7f0cd14224a9 100644
--- a/pkgs/development/python-modules/flashinfer/default.nix
+++ b/pkgs/development/python-modules/flashinfer/default.nix
@@ -6,10 +6,11 @@
 # environment varaible `CUDA_HOME` to `cudatoolkit`.
 {
   lib,
+  config,
   buildPythonPackage,
-  symlinkJoin,
   fetchFromGitHub,
   setuptools,
+  cudaPackages,
   cmake,
   ninja,
   numpy,
@@ -20,11 +21,6 @@ let
   pname = "flashinfer";
   version = "0.2.5";
 
-  inherit (torch) cudaPackages;
-  inherit (cudaPackages) cudaMajorMinorVersion;
-
-  cudaMajorMinorVersionString = lib.replaceStrings [ "." ] [ "" ] cudaMajorMinorVersion;
-
   src_cutlass = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "cutlass";
@@ -49,7 +45,7 @@ buildPythonPackage {
   nativeBuildInputs = [
     cmake
     ninja
-    cudaPackages.cudatoolkit
+    (lib.getBin cudaPackages.cuda_nvcc)
   ];
   dontUseCmakeConfigure = true;
 
@@ -76,7 +72,6 @@ buildPythonPackage {
     export TORCH_NVCC_FLAGS="--maxrregcount=64"
   '';
 
-  CUDA_HOME = "${cudaPackages.cudatoolkit}";
   TORCH_CUDA_ARCH_LIST = lib.concatStringsSep ";" torch.cudaCapabilities;
 
   dependencies = [

From ca6b5eddaf25a56571a950b2b214883aebbde42a Mon Sep 17 00:00:00 2001
From: Break Yang <breakds@gmail.com>
Date: Tue, 20 May 2025 15:49:47 -0700
Subject: [PATCH 064/102] Replace `cudatoolkit` with only the necessary parts

---
 pkgs/development/python-modules/flashinfer/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/flashinfer/default.nix b/pkgs/development/python-modules/flashinfer/default.nix
index 7f0cd14224a9..d9f95a650a27 100644
--- a/pkgs/development/python-modules/flashinfer/default.nix
+++ b/pkgs/development/python-modules/flashinfer/default.nix
@@ -46,6 +46,7 @@ buildPythonPackage {
     cmake
     ninja
     (lib.getBin cudaPackages.cuda_nvcc)
+    (lib.getLib cudaPackages.cuda_cudart)
   ];
   dontUseCmakeConfigure = true;
 

From 818b179bde1cc7a360b817728525a3806f605c39 Mon Sep 17 00:00:00 2001
From: Break Yang <breakds@gmail.com>
Date: Tue, 20 May 2025 16:15:45 -0700
Subject: [PATCH 065/102] Add missing cudaPackages libraries

---
 pkgs/development/python-modules/flashinfer/default.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/flashinfer/default.nix b/pkgs/development/python-modules/flashinfer/default.nix
index d9f95a650a27..1600ab2c38a4 100644
--- a/pkgs/development/python-modules/flashinfer/default.nix
+++ b/pkgs/development/python-modules/flashinfer/default.nix
@@ -46,10 +46,16 @@ buildPythonPackage {
     cmake
     ninja
     (lib.getBin cudaPackages.cuda_nvcc)
-    (lib.getLib cudaPackages.cuda_cudart)
   ];
   dontUseCmakeConfigure = true;
 
+  buildInputs = [
+    cudaPackages.cuda_cudart
+    cudaPackages.libcublas
+    cudaPackages.cuda_cccl
+    cudaPackages.libcurand
+  ];
+
   postPatch = ''
     rmdir 3rdparty/cutlass
     ln -s ${src_cutlass} 3rdparty/cutlass

From 7c7410ff6af4bbc3323e93dc54ad52f176a66d00 Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Sat, 19 Apr 2025 03:35:23 +0200
Subject: [PATCH 066/102] catcli: drop

---
 pkgs/by-name/ca/catcli/package.nix | 44 ------------------------------
 pkgs/top-level/aliases.nix         |  1 +
 2 files changed, 1 insertion(+), 44 deletions(-)
 delete mode 100644 pkgs/by-name/ca/catcli/package.nix

diff --git a/pkgs/by-name/ca/catcli/package.nix b/pkgs/by-name/ca/catcli/package.nix
deleted file mode 100644
index 2e330b671508..000000000000
--- a/pkgs/by-name/ca/catcli/package.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  python3,
-}:
-
-python3.pkgs.buildPythonApplication rec {
-  pname = "catcli";
-  version = "1.0";
-  format = "setuptools";
-
-  src = fetchFromGitHub {
-    owner = "deadc0de6";
-    repo = pname;
-    tag = "v${version}";
-    hash = "sha256-dAt9NysH3q5YC+vO9XTnapBxFZmC4vWwJ8SxT9CzCQE=";
-  };
-
-  postPatch = "patchShebangs . ";
-
-  propagatedBuildInputs = with python3.pkgs; [
-    anytree
-    docopt
-    fusepy
-    pyfzf
-    types-docopt
-    cmd2
-    natsort
-  ];
-
-  nativeCheckInputs = with python3.pkgs; [
-    pytestCheckHook
-  ];
-
-  meta = with lib; {
-    description = "Command line catalog tool for your offline data";
-    mainProgram = "catcli";
-    homepage = "https://github.com/deadc0de6/catcli";
-    changelog = "https://github.com/deadc0de6/catcli/releases/tag/v${version}";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ petersjt014 ];
-    platforms = platforms.all;
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index ebd3a2b31f29..7769eeb5b1e7 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -393,6 +393,7 @@ mapAliases {
   callPackage_i686 = pkgsi686Linux.callPackage;
   cargo-asm = throw "'cargo-asm' has been removed due to lack of upstream maintenance. Consider 'cargo-show-asm' as an alternative.";
   cask = emacs.pkgs.cask; # Added 2022-11-12
+  catcli = throw "catcli has been superseded by gocatcli"; # Added 2025-04-19
   canonicalize-jars-hook = stripJavaArchivesHook; # Added 2024-03-17
   cargo-deps = throw "cargo-deps has been removed as the repository is deleted"; # Added 2024-04-09
   cargo-espflash = espflash;

From e5a10947bbf6e83a23b6962475a0c20d799a17f6 Mon Sep 17 00:00:00 2001
From: emaryn <emaryn@users.noreply.github.com>
Date: Wed, 21 May 2025 07:33:13 +0800
Subject: [PATCH 067/102] pdns-recursor: 5.1.2 -> 5.2.2

---
 pkgs/by-name/pd/pdns-recursor/package.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/pd/pdns-recursor/package.nix b/pkgs/by-name/pd/pdns-recursor/package.nix
index bba6c4f4d185..ceae53962ea0 100644
--- a/pkgs/by-name/pd/pdns-recursor/package.nix
+++ b/pkgs/by-name/pd/pdns-recursor/package.nix
@@ -20,17 +20,17 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pdns-recursor";
-  version = "5.1.2";
+  version = "5.2.2";
 
   src = fetchurl {
     url = "https://downloads.powerdns.com/releases/pdns-recursor-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-s6N+uyAoWrmsu7DhNw5iO7OY7TCH8OZ48j/6OwBjmD0=";
+    hash = "sha256-+clSdCMe48XJQZf20FAR1Vq/BrKTdTW6jnjiTqT7vW4=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
     sourceRoot = "pdns-recursor-${finalAttrs.version}/settings/rust";
-    hash = "sha256-/fxFqs5lDzOhatc6KBc7Zwsq3A7N5AOanGOebttr1l8=";
+    hash = "sha256-A3NX1zj9+9qCLTkfca3v8Rr8oc/zL/Ruknjl3g1aMG4=";
   };
 
   cargoRoot = "settings/rust";
@@ -38,10 +38,10 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cargo
     rustc
-
     rustPlatform.cargoSetupHook
     pkg-config
   ];
+
   buildInputs = [
     boost
     openssl
@@ -67,14 +67,14 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (nixosTests) pdns-recursor ncdns;
   };
 
-  meta = with lib; {
+  meta = {
     description = "Recursive DNS server";
     homepage = "https://www.powerdns.com/";
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
     badPlatforms = [
       "i686-linux" # a 64-bit time_t is needed
     ];
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ rnhmjoj ];
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ rnhmjoj ];
   };
 })

From 5ce72bd5670ecd8cba912f7716b84900d061fb46 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 21 May 2025 02:02:51 +0000
Subject: [PATCH 068/102] clash-meta: 1.19.6 -> 1.19.8

---
 pkgs/by-name/mi/mihomo/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mi/mihomo/package.nix b/pkgs/by-name/mi/mihomo/package.nix
index 04cfe3d893d1..d91d5a580d2c 100644
--- a/pkgs/by-name/mi/mihomo/package.nix
+++ b/pkgs/by-name/mi/mihomo/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "mihomo";
-  version = "1.19.6";
+  version = "1.19.8";
 
   src = fetchFromGitHub {
     owner = "MetaCubeX";
     repo = "mihomo";
     rev = "v${version}";
-    hash = "sha256-eVqV7Dt6V4fAT0yGF8D7niZevMmX6WggSpA5J+LU7jY=";
+    hash = "sha256-C8g2KhhXY11bqGKthNgiqdZwxoPVPhflhkh+X6JU33I=";
   };
 
-  vendorHash = "sha256-8LATtCrQs7rDiEWKep9xPlzKw413DpS1FGJsLiWriIQ=";
+  vendorHash = "sha256-j97UFlcN8SfY6nireI6NDw8UcQuxyH34gue1Ywf25Yg=";
 
   excludedPackages = [ "./test" ];
 

From e211f788a632ff56ae796d593224926f8d74cb57 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 21 May 2025 09:27:16 +0200
Subject: [PATCH 069/102] python313Packages.aiokem: 0.5.10 -> 0.5.11

Diff: https://github.com/kohlerlibs/aiokem/compare/refs/tags/v0.5.10...refs/tags/v0.5.11

Changelog: https://github.com/kohlerlibs/aiokem/blob/v0.5.11/CHANGELOG.md
---
 pkgs/development/python-modules/aiokem/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiokem/default.nix b/pkgs/development/python-modules/aiokem/default.nix
index c22bb8805e13..fc6aedde3eaf 100644
--- a/pkgs/development/python-modules/aiokem/default.nix
+++ b/pkgs/development/python-modules/aiokem/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "aiokem";
-  version = "0.5.10";
+  version = "0.5.11";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "kohlerlibs";
     repo = "aiokem";
     tag = "v${version}";
-    hash = "sha256-C9px2Gooh6Ob3rGGhKtRdScuA+PCU93xDvOjk7+q3e8=";
+    hash = "sha256-1fBGmsp6DoDP1EUjp2tfWT3nTux0/2iiC6x/LxrCrd8=";
   };
 
   build-system = [ setuptools ];

From 385c3b6712e48add6123e7d2979fa83553b6ff7a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 21 May 2025 07:31:08 +0000
Subject: [PATCH 070/102] prometheus-klipper-exporter: 0.12.0 -> 0.13.0

---
 pkgs/by-name/pr/prometheus-klipper-exporter/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pr/prometheus-klipper-exporter/package.nix b/pkgs/by-name/pr/prometheus-klipper-exporter/package.nix
index db41ced6fd45..4015eab336fe 100644
--- a/pkgs/by-name/pr/prometheus-klipper-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-klipper-exporter/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "prometheus-klipper-exporter";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "scross01";
     repo = "prometheus-klipper-exporter";
     rev = "v${version}";
-    sha256 = "sha256-OlNUBdCizMOSb7WEtu00LaHYSXLSPlISVJD/0rHujnY=";
+    sha256 = "sha256-zNRjD2YO7OfcNXF5pukXChxhC5LB88C1EKfiMreMzTs=";
   };
 
   vendorHash = "sha256-0nbLHZ2WMLMK0zKZuUYz355K01Xspn9svmlFCtQjed0=";

From dec0d28eb97dc116fe7352610bf603701d2c4b42 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 21 May 2025 08:05:55 +0000
Subject: [PATCH 071/102] python3Packages.unstructured-inference: 0.8.10 ->
 1.0.2

---
 .../python-modules/unstructured-inference/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/unstructured-inference/default.nix b/pkgs/development/python-modules/unstructured-inference/default.nix
index f19299fc4c96..e21dadc0743b 100644
--- a/pkgs/development/python-modules/unstructured-inference/default.nix
+++ b/pkgs/development/python-modules/unstructured-inference/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "unstructured-inference";
-  version = "0.8.10";
+  version = "1.0.2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "Unstructured-IO";
     repo = "unstructured-inference";
     tag = version;
-    hash = "sha256-c5brGGY1PPuKYUb1UOvyKFZC4ph0pGRagHuTLKPXErY=";
+    hash = "sha256-wRFTwSvkPdvvB08qGOvn8lrbUuoXF6yPqNSk9iiB1S8=";
   };
 
   propagatedBuildInputs =

From db35a5cdaa024753eab204fd601c905804cc2bc9 Mon Sep 17 00:00:00 2001
From: GueLaKais <koroyeldiores@gmail.com>
Date: Wed, 9 Apr 2025 22:47:25 +0200
Subject: [PATCH 072/102] python312Packages.colcon-ros-domain-id-coordinator:
 init at 0.2.1

---
 .../default.nix                               | 54 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  4 ++
 2 files changed, 58 insertions(+)
 create mode 100644 pkgs/development/python-modules/colcon-ros-domain-id-coordinator/default.nix

diff --git a/pkgs/development/python-modules/colcon-ros-domain-id-coordinator/default.nix b/pkgs/development/python-modules/colcon-ros-domain-id-coordinator/default.nix
new file mode 100644
index 000000000000..cf3c58ee1142
--- /dev/null
+++ b/pkgs/development/python-modules/colcon-ros-domain-id-coordinator/default.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  buildPythonPackage,
+  colcon,
+  fetchFromGitHub,
+  pytestCheckHook,
+  pytest-cov,
+  pytest-repeat,
+  pytest-rerunfailures,
+  scspell,
+  setuptools,
+  writableTmpDirAsHomeHook,
+}:
+buildPythonPackage {
+  pname = "colcon-ros-domain-id-coordinator";
+  version = "0.2.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "colcon";
+    repo = "colcon-ros-domain-id-coordinator";
+    tag = "0.2.1";
+    hash = "sha256-8DTpixa5ZGuSOpmwoeJgxLQI+17XheLxPWcJymE0GqM=";
+  };
+  build-system = [ setuptools ];
+
+  dependencies = [
+    colcon
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-cov
+    pytest-repeat
+    pytest-rerunfailures
+    scspell
+    writableTmpDirAsHomeHook
+  ];
+
+  disabledTestPaths = [
+    "test/test_flake8.py"
+  ];
+
+  pythonImportsCheck = [
+    "colcon_ros_domain_id_coordinator"
+  ];
+
+  meta = {
+    description = "An extension for colcon-core to coordinate ROS_DOMAIN_ID values across multiple terminals";
+    homepage = "https://github.com/colcon/colcon-ros-domain-id-coordinator";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ guelakais ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 52952d3da035..74d7ab6588b5 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2693,6 +2693,10 @@ self: super: with self; {
 
   colcon-parallel-executor = callPackage ../development/python-modules/colcon-parallel-executor { };
 
+  colcon-ros-domain-id-coordinator =
+    callPackage ../development/python-modules/colcon-ros-domain-id-coordinator
+      { };
+
   collections-extended = callPackage ../development/python-modules/collections-extended { };
 
   collidoscope = callPackage ../development/python-modules/collidoscope { };

From 490a00c7d98adc51c4c41dd5bbe5a3f4845ed6bc Mon Sep 17 00:00:00 2001
From: FliegendeWurst <arne.keller@posteo.de>
Date: Mon, 19 May 2025 18:45:01 +0200
Subject: [PATCH 073/102] authelia: fix cross build

---
 pkgs/servers/authelia/default.nix | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/pkgs/servers/authelia/default.nix b/pkgs/servers/authelia/default.nix
index beea275ace20..1d247e4899cb 100644
--- a/pkgs/servers/authelia/default.nix
+++ b/pkgs/servers/authelia/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   nodejs,
   pnpm,
   fetchFromGitHub,
@@ -59,15 +60,17 @@ buildGoModule rec {
   # several tests with networking and several that want chromium
   doCheck = false;
 
-  postInstall = ''
-    mkdir -p $out/etc/authelia
-    cp config.template.yml $out/etc/authelia
-
-    installShellCompletion --cmd authelia \
-      --bash <($out/bin/authelia completion bash) \
-      --fish <($out/bin/authelia completion fish) \
-      --zsh <($out/bin/authelia completion zsh)
-  '';
+  postInstall =
+    ''
+      mkdir -p $out/etc/authelia
+      cp config.template.yml $out/etc/authelia
+    ''
+    + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      installShellCompletion --cmd authelia \
+        --bash <($out/bin/authelia completion bash) \
+        --fish <($out/bin/authelia completion fish) \
+        --zsh <($out/bin/authelia completion zsh)
+    '';
 
   doInstallCheck = true;
   installCheckPhase = ''

From 6035e60b1c62fbef571e72c27ea1ecd8ab0ca117 Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Wed, 21 May 2025 11:19:58 +0200
Subject: [PATCH 074/102] brscan5: use udevCheckHook and fix permissions of
 udev rules file

---
 nixos/tests/brscan5.nix             | 4 ----
 pkgs/by-name/br/brscan5/package.nix | 7 ++++++-
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/nixos/tests/brscan5.nix b/nixos/tests/brscan5.nix
index ba1916e27d26..f61228bac41e 100644
--- a/nixos/tests/brscan5.nix
+++ b/nixos/tests/brscan5.nix
@@ -48,10 +48,6 @@ import ./make-test-python.nix (
       print(scanimage)
       assert """device `brother5:net1;dev0' is a Brother b ADS-1200""" in scanimage
       assert """device `brother5:net1;dev1' is a Brother a ADS-1200""" in scanimage
-
-      # Confirm systemd-udevd no longer logs errors about SYSFS
-      logs = machine.succeed('journalctl --unit systemd-udevd')
-      assert "Invalid key 'SYSFS'" not in logs
     '';
   }
 )
diff --git a/pkgs/by-name/br/brscan5/package.nix b/pkgs/by-name/br/brscan5/package.nix
index 01a36caff2ab..688d12caa454 100644
--- a/pkgs/by-name/br/brscan5/package.nix
+++ b/pkgs/by-name/br/brscan5/package.nix
@@ -9,6 +9,7 @@
   glib,
   libredirect,
   nixosTests,
+  udevCheckHook,
 }:
 let
   myPatchElf = file: ''
@@ -43,6 +44,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     makeWrapper
     patchelf
+    udevCheckHook
   ];
   buildInputs = [
     libusb1
@@ -114,7 +116,7 @@ stdenv.mkDerivation rec {
     echo "brother5" > $out/etc/sane.d/dll.d/brother5.conf
 
     mkdir -p $out/etc/udev/rules.d
-    cp -p $PATH_TO_BRSCAN5/udev-rules/NN-brother-mfp-brscan5-1.0.2-2.rules \
+    install -m 0444 $PATH_TO_BRSCAN5/udev-rules/NN-brother-mfp-brscan5-1.0.2-2.rules \
       $out/etc/udev/rules.d/49-brother-mfp-brscan5-1.0.2-2.rules
 
     ETCDIR=$out/etc/opt/brother/scanner/brscan5
@@ -124,6 +126,9 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  # We want to run the udevCheckHook
+  doInstallCheck = true;
+
   dontPatchELF = true;
 
   passthru.tests = { inherit (nixosTests) brscan5; };

From 1de00c4a2bcecb769c85e1166fd58f25fe2393c7 Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Wed, 21 May 2025 10:19:01 +0000
Subject: [PATCH 075/102] synapse-admin-etkecc: 0.10.4-etke41 -> 0.11.0-etke42

---
 pkgs/by-name/sy/synapse-admin-etkecc/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sy/synapse-admin-etkecc/package.nix b/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
index b4356f22f81f..4937bca343f3 100644
--- a/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
+++ b/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
@@ -17,18 +17,18 @@ assert lib.asserts.assertMsg (
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "synapse-admin-etkecc";
-  version = "0.10.4-etke41";
+  version = "0.11.0-etke42";
 
   src = fetchFromGitHub {
     owner = "etkecc";
     repo = "synapse-admin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LHZtB6139sV2HdbIKCZruwH1G5+8iTfKXwjjo4gbNcI=";
+    hash = "sha256-HWhyG/dVP9M84OOYH95RPLqiXDYOs+QOxwLM8pPl1vA=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-wdnmsz41rIu8HvsoVHSW8PZLwtmwpz+YSeeDs1GT/vA=";
+    hash = "sha256-GO5m+7fcm/XO38XlsQq6fwKslzdZkE6WleP3GHNKuPU=";
   };
 
   nativeBuildInputs = [

From 27c79b53f945c8b01a8838a035333fbc9fbfe9f7 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 21 May 2025 13:21:51 +0200
Subject: [PATCH 076/102] python312Packages.polyswarm-api: 3.11.0 -> 3.12.0

Diff: https://github.com/polyswarm/polyswarm-api/compare/refs/tags/3.11.0...refs/tags/3.12.0

Changelog: https://github.com/polyswarm/polyswarm-api/releases/tag/3.12.0
---
 pkgs/development/python-modules/polyswarm-api/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/polyswarm-api/default.nix b/pkgs/development/python-modules/polyswarm-api/default.nix
index 34d82cc18221..4ffa74130384 100644
--- a/pkgs/development/python-modules/polyswarm-api/default.nix
+++ b/pkgs/development/python-modules/polyswarm-api/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "polyswarm-api";
-  version = "3.11.0";
+  version = "3.12.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "polyswarm";
     repo = "polyswarm-api";
     tag = version;
-    hash = "sha256-7hmuJr+1ghVsp8EfykhVLCHwJYrO2m6cBREUFRov5Mo=";
+    hash = "sha256-LM+8U7gEo16e8vuFuheonLB685zeNEm736UVXgmtPDw=";
   };
 
   pythonRelaxDeps = [ "future" ];

From 86e3302381f25397802a29d65ae54676f5fbedfc Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Wed, 21 May 2025 12:26:46 +0100
Subject: [PATCH 077/102] nixos-rebuild-ng: avoid get_qualified_name usage for
 pathlib.Path

Seems to be broken since Python 3.13.
---
 .../ni/nixos-rebuild-ng/src/tests/test_main.py     |  4 ++--
 .../ni/nixos-rebuild-ng/src/tests/test_models.py   | 14 +++++++-------
 .../ni/nixos-rebuild-ng/src/tests/test_nix.py      |  4 ++--
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
index db21ddd9d64a..f218311cf63d 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
@@ -1083,8 +1083,8 @@ def test_execute_test_flake(mock_run: Mock, tmp_path: Path) -> None:
 
 
 @patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
-@patch(get_qualified_name(nr.nix.Path.exists, nr.nix), autospec=True, return_value=True)
-@patch(get_qualified_name(nr.nix.Path.mkdir, nr.nix), autospec=True)
+@patch("pathlib.Path.exists", autospec=True, return_value=True)
+@patch("pathlib.Path.mkdir", autospec=True)
 def test_execute_test_rollback(
     mock_path_mkdir: Mock,
     mock_path_exists: Mock,
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
index 6d2017392fbf..0bbe42d3291b 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
@@ -100,7 +100,7 @@ def test_flake_from_arg(
 
     # None when we do not have /etc/nixos/flake.nix
     with patch(
-        get_qualified_name(m.Path.exists, m),
+        "pathlib.Path.exists",
         autospec=True,
         return_value=False,
     ):
@@ -109,12 +109,12 @@ def test_flake_from_arg(
     # None when we have a file in /etc/nixos/flake.nix
     with (
         patch(
-            get_qualified_name(m.Path.exists, m),
+            "pathlib.Path.exists",
             autospec=True,
             return_value=True,
         ),
         patch(
-            get_qualified_name(m.Path.is_symlink, m),
+            "pathlib.Path.is_symlink",
             autospec=True,
             return_value=False,
         ),
@@ -130,17 +130,17 @@ def test_flake_from_arg(
 
     with (
         patch(
-            get_qualified_name(m.Path.exists, m),
+            "pathlib.Path.exists",
             autospec=True,
             return_value=True,
         ),
         patch(
-            get_qualified_name(m.Path.is_symlink, m),
+            "pathlib.Path.is_symlink",
             autospec=True,
             return_value=True,
         ),
         patch(
-            get_qualified_name(m.Path.resolve, m),
+            "pathlib.Path.resolve",
             autospec=True,
             return_value=Path("/path/to/flake.nix"),
         ),
@@ -161,7 +161,7 @@ def test_flake_from_arg(
         )
 
 
-@patch(get_qualified_name(m.Path.mkdir, m), autospec=True)
+@patch("pathlib.Path.mkdir", autospec=True)
 def test_profile_from_arg(mock_mkdir: Mock) -> None:
     assert m.Profile.from_arg("system") == m.Profile(
         "system",
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index a6fac1c6de1e..9a30c0dce011 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -809,7 +809,7 @@ def test_switch_to_configuration_with_systemd_run(
 
 
 @patch(
-    get_qualified_name(n.Path.glob, n),
+    "pathlib.Path.glob",
     autospec=True,
     return_value=[
         Path("/nix/var/nix/profiles/per-user/root/channels/nixos"),
@@ -817,7 +817,7 @@ def test_switch_to_configuration_with_systemd_run(
         Path("/nix/var/nix/profiles/per-user/root/channels/home-manager"),
     ],
 )
-@patch(get_qualified_name(n.Path.is_dir, n), autospec=True, return_value=True)
+@patch("pathlib.Path.is_dir", autospec=True, return_value=True)
 def test_upgrade_channels(mock_is_dir: Mock, mock_glob: Mock) -> None:
     with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
         n.upgrade_channels(False)

From 90f7121314791a8907f58bef465245a9a9a7e23b Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Wed, 21 May 2025 12:40:15 +0100
Subject: [PATCH 078/102] nixos-rebuild-ng: do not use get_qualified_name for
 non-internal modules

To avoid breakage in future this avoid using `get_qualified_name()` for
any non-internal mock. This is fine because the idea to
`get_qualified_name()` is to make it easier to refactor since you can
rename the method name and this is also automatically rename the mocks,
but non-internal mocks are unlikely to change names anyway.
---
 .../nixos-rebuild-ng/src/nixos_rebuild/nix.py |  6 +-
 .../src/nixos_rebuild/process.py              |  4 +-
 .../nixos-rebuild-ng/src/tests/test_main.py   | 55 ++++++++++---------
 .../nixos-rebuild-ng/src/tests/test_models.py |  7 +--
 .../ni/nixos-rebuild-ng/src/tests/test_nix.py |  2 +-
 .../src/tests/test_process.py                 | 10 +---
 6 files changed, 40 insertions(+), 44 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index 0929cf7fe4aa..f4f3db5f13b5 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -2,6 +2,7 @@ import json
 import logging
 import os
 import textwrap
+import uuid
 from concurrent.futures import ThreadPoolExecutor
 from datetime import datetime
 from importlib.resources import files
@@ -9,7 +10,6 @@ from pathlib import Path
 from string import Template
 from subprocess import PIPE, CalledProcessError
 from typing import Final, Literal
-from uuid import uuid4
 
 from . import tmpdir
 from .constants import WITH_NIX_2_18
@@ -107,7 +107,7 @@ def build_remote(
             "--attr",
             build_attr.to_attr(attr),
             "--add-root",
-            tmpdir.TMPDIR_PATH / uuid4().hex,
+            tmpdir.TMPDIR_PATH / uuid.uuid4().hex,
             *dict_to_flags(instantiate_flags),
         ],
         stdout=PIPE,
@@ -127,7 +127,7 @@ def build_remote(
                 "--realise",
                 drv,
                 "--add-root",
-                remote_tmpdir / uuid4().hex,
+                remote_tmpdir / uuid.uuid4().hex,
                 *dict_to_flags(realise_flags),
             ],
             remote=build_host,
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
index 0c556411331e..462c4178e8f7 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
@@ -1,4 +1,5 @@
 import atexit
+import getpass
 import logging
 import os
 import re
@@ -6,7 +7,6 @@ import shlex
 import subprocess
 from collections.abc import Sequence
 from dataclasses import dataclass
-from getpass import getpass
 from typing import Final, Self, TypedDict, Unpack
 
 from . import tmpdir
@@ -46,7 +46,7 @@ class Remote:
             cls._validate_opts(opts, ask_sudo_password)
         sudo_password = None
         if ask_sudo_password:
-            sudo_password = getpass(f"[sudo] password for {host}: ")
+            sudo_password = getpass.getpass(f"[sudo] password for {host}: ")
         return cls(host, opts, sudo_password)
 
     @staticmethod
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
index f218311cf63d..e41bd1c6ad0f 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
@@ -1,4 +1,5 @@
 import logging
+import os
 import textwrap
 import uuid
 from pathlib import Path
@@ -126,8 +127,8 @@ def test_parse_args() -> None:
     ]
 
 
-@patch.dict(nr.os.environ, {}, clear=True)
-@patch(get_qualified_name(nr.os.execve, nr.os), autospec=True)
+@patch.dict(os.environ, {}, clear=True)
+@patch("os.execve", autospec=True)
 @patch(get_qualified_name(nr.nix.build), autospec=True)
 def test_reexec(mock_build: Mock, mock_execve: Mock, monkeypatch: MonkeyPatch) -> None:
     monkeypatch.setattr(nr, "EXECUTABLE", "nixos-rebuild-ng")
@@ -170,8 +171,8 @@ def test_reexec(mock_build: Mock, mock_execve: Mock, monkeypatch: MonkeyPatch) -
     )
 
 
-@patch.dict(nr.os.environ, {}, clear=True)
-@patch(get_qualified_name(nr.os.execve, nr.os), autospec=True)
+@patch.dict(os.environ, {}, clear=True)
+@patch("os.execve", autospec=True)
 @patch(get_qualified_name(nr.nix.build_flake), autospec=True)
 def test_reexec_flake(
     mock_build: Mock, mock_execve: Mock, monkeypatch: MonkeyPatch
@@ -212,8 +213,8 @@ def test_reexec_flake(
     )
 
 
-@patch.dict(nr.process.os.environ, {}, clear=True)
-@patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
+@patch.dict(os.environ, {}, clear=True)
+@patch("subprocess.run", autospec=True)
 def test_execute_nix_boot(mock_run: Mock, tmp_path: Path) -> None:
     nixpkgs_path = tmp_path / "nixpkgs"
     nixpkgs_path.mkdir()
@@ -296,8 +297,8 @@ def test_execute_nix_boot(mock_run: Mock, tmp_path: Path) -> None:
     )
 
 
-@patch.dict(nr.process.os.environ, {}, clear=True)
-@patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
+@patch.dict(os.environ, {}, clear=True)
+@patch("subprocess.run", autospec=True)
 def test_execute_nix_build_vm(mock_run: Mock, tmp_path: Path) -> None:
     config_path = tmp_path / "test"
     config_path.touch()
@@ -345,8 +346,8 @@ def test_execute_nix_build_vm(mock_run: Mock, tmp_path: Path) -> None:
     )
 
 
-@patch.dict(nr.process.os.environ, {}, clear=True)
-@patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
+@patch.dict(os.environ, {}, clear=True)
+@patch("subprocess.run", autospec=True)
 def test_execute_nix_build_image_flake(mock_run: Mock, tmp_path: Path) -> None:
     config_path = tmp_path / "test"
     config_path.touch()
@@ -420,8 +421,8 @@ def test_execute_nix_build_image_flake(mock_run: Mock, tmp_path: Path) -> None:
     )
 
 
-@patch.dict(nr.process.os.environ, {}, clear=True)
-@patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
+@patch.dict(os.environ, {}, clear=True)
+@patch("subprocess.run", autospec=True)
 def test_execute_nix_switch_flake(mock_run: Mock, tmp_path: Path) -> None:
     config_path = tmp_path / "test"
     config_path.touch()
@@ -503,13 +504,13 @@ def test_execute_nix_switch_flake(mock_run: Mock, tmp_path: Path) -> None:
     )
 
 
-@patch.dict(nr.process.os.environ, {}, clear=True)
-@patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
-@patch(get_qualified_name(nr.cleanup_ssh, nr), autospec=True)
-@patch(get_qualified_name(nr.nix.uuid4, nr.nix), autospec=True)
+@patch.dict(os.environ, {}, clear=True)
+@patch("subprocess.run", autospec=True)
+@patch("uuid.uuid4", autospec=True)
+@patch(get_qualified_name(nr.cleanup_ssh), autospec=True)
 def test_execute_nix_switch_build_target_host(
-    mock_uuid4: Mock,
     mock_cleanup_ssh: Mock,
+    mock_uuid4: Mock,
     mock_run: Mock,
     tmp_path: Path,
 ) -> None:
@@ -713,9 +714,9 @@ def test_execute_nix_switch_build_target_host(
     )
 
 
-@patch.dict(nr.process.os.environ, {}, clear=True)
-@patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
-@patch(get_qualified_name(nr.cleanup_ssh, nr), autospec=True)
+@patch.dict(os.environ, {}, clear=True)
+@patch("subprocess.run", autospec=True)
+@patch(get_qualified_name(nr.cleanup_ssh), autospec=True)
 def test_execute_nix_switch_flake_target_host(
     mock_cleanup_ssh: Mock,
     mock_run: Mock,
@@ -816,9 +817,9 @@ def test_execute_nix_switch_flake_target_host(
     )
 
 
-@patch.dict(nr.process.os.environ, {}, clear=True)
-@patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
-@patch(get_qualified_name(nr.cleanup_ssh, nr), autospec=True)
+@patch.dict(os.environ, {}, clear=True)
+@patch("subprocess.run", autospec=True)
+@patch(get_qualified_name(nr.cleanup_ssh), autospec=True)
 def test_execute_nix_switch_flake_build_host(
     mock_cleanup_ssh: Mock,
     mock_run: Mock,
@@ -927,7 +928,7 @@ def test_execute_nix_switch_flake_build_host(
     )
 
 
-@patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
+@patch("subprocess.run", autospec=True)
 def test_execute_switch_rollback(mock_run: Mock, tmp_path: Path) -> None:
     nixpkgs_path = tmp_path / "nixpkgs"
     nixpkgs_path.touch()
@@ -1004,7 +1005,7 @@ def test_execute_switch_rollback(mock_run: Mock, tmp_path: Path) -> None:
     )
 
 
-@patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
+@patch("subprocess.run", autospec=True)
 def test_execute_build(mock_run: Mock, tmp_path: Path) -> None:
     config_path = tmp_path / "test"
     config_path.touch()
@@ -1033,7 +1034,7 @@ def test_execute_build(mock_run: Mock, tmp_path: Path) -> None:
     )
 
 
-@patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
+@patch("subprocess.run", autospec=True)
 def test_execute_test_flake(mock_run: Mock, tmp_path: Path) -> None:
     config_path = tmp_path / "test"
     config_path.touch()
@@ -1082,7 +1083,7 @@ def test_execute_test_flake(mock_run: Mock, tmp_path: Path) -> None:
     )
 
 
-@patch(get_qualified_name(nr.process.subprocess.run), autospec=True)
+@patch("subprocess.run", autospec=True)
 @patch("pathlib.Path.exists", autospec=True, return_value=True)
 @patch("pathlib.Path.mkdir", autospec=True)
 def test_execute_test_rollback(
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
index 0bbe42d3291b..cf9c052c709b 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_models.py
@@ -1,4 +1,3 @@
-import platform
 import subprocess
 from pathlib import Path
 from unittest.mock import Mock, patch
@@ -77,7 +76,7 @@ def test_flake_to_attr() -> None:
     )
 
 
-@patch(get_qualified_name(platform.node), autospec=True)
+@patch("platform.node", autospec=True)
 def test_flake_from_arg(
     mock_node: Mock, monkeypatch: MonkeyPatch, tmpdir: Path
 ) -> None:
@@ -119,7 +118,7 @@ def test_flake_from_arg(
             return_value=False,
         ),
         patch(
-            get_qualified_name(m.discover_git, m),
+            get_qualified_name(m.discover_git),
             autospec=True,
             return_value="/etc/nixos",
         ),
@@ -151,7 +150,7 @@ def test_flake_from_arg(
 
     with (
         patch(
-            get_qualified_name(m.subprocess.run),
+            "subprocess.run",
             autospec=True,
             return_value=subprocess.CompletedProcess([], 0, "remote-hostname\n"),
         ),
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index 9a30c0dce011..2180abd55d71 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -78,7 +78,7 @@ def test_build_flake(mock_run: Mock, monkeypatch: MonkeyPatch, tmpdir: Path) ->
 
 
 @patch(get_qualified_name(n.run_wrapper, n), autospec=True)
-@patch(get_qualified_name(n.uuid4, n), autospec=True)
+@patch("uuid.uuid4", autospec=True)
 def test_build_remote(
     mock_uuid4: Mock, mock_run: Mock, monkeypatch: MonkeyPatch
 ) -> None:
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
index 8ac92bb4848b..84eba633b21b 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
@@ -6,10 +6,8 @@ from pytest import MonkeyPatch
 import nixos_rebuild.models as m
 import nixos_rebuild.process as p
 
-from .helpers import get_qualified_name
 
-
-@patch(get_qualified_name(p.subprocess.run), autospec=True)
+@patch("subprocess.run", autospec=True)
 def test_run(mock_run: Any) -> None:
     p.run_wrapper(["test", "--with", "flags"], check=True)
     mock_run.assert_called_with(
@@ -96,7 +94,7 @@ def test_run(mock_run: Any) -> None:
     )
 
 
-@patch(get_qualified_name(p.subprocess.run), autospec=True)
+@patch("subprocess.run", autospec=True)
 def test__kill_long_running_ssh_process(mock_run: Any) -> None:
     p._kill_long_running_ssh_process(
         [
@@ -135,9 +133,7 @@ def test_remote_from_name(monkeypatch: MonkeyPatch) -> None:
         sudo_password=None,
     )
 
-    # get_qualified_name doesn't work because getpass is aliased to another
-    # function
-    with patch(f"{p.__name__}.getpass", autospec=True, return_value="password"):
+    with patch("getpass.getpass", autospec=True, return_value="password"):
         monkeypatch.setenv("NIX_SSHOPTS", "-f foo -b bar -t")
         assert m.Remote.from_arg("user@localhost", True, True) == m.Remote(
             "user@localhost",

From d9de2dfd8501463f0bb12c18255c943450bea6a9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 21 May 2025 11:50:25 +0000
Subject: [PATCH 079/102] yaziPlugins.mediainfo: 25.2.7-unstable-2025-04-17 ->
 25.4.8-unstable-2025-05-19

---
 pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix b/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix
index 452a40de6bd5..21f78d2b4d16 100644
--- a/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "mediainfo.yazi";
-  version = "25.2.7-unstable-2025-04-17";
+  version = "25.4.8-unstable-2025-05-19";
 
   src = fetchFromGitHub {
     owner = "boydaihungst";
     repo = "mediainfo.yazi";
-    rev = "9629b1e85c3757c834ec83fb7d931982c55f4c3f";
-    hash = "sha256-EDEIiZJy/RfXVaLNsKDeklH4qY2h+js2m0y6VSAjPkk=";
+    rev = "70ed2287159b17bf2b9c1598252c5c33ba52b8a3";
+    hash = "sha256-MMsKb9+zeOtWrpE3SalWhGIqeOwHrLdwf8xWYvWXjbo=";
   };
 
   meta = {

From b1a205154c8facdd58a3bc9922780ae2416a9dca Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Wed, 21 May 2025 12:56:38 +0100
Subject: [PATCH 080/102] nixos-rebuild-ng: assert if get_qualified_name is
 used by internal modules

---
 pkgs/by-name/ni/nixos-rebuild-ng/src/tests/helpers.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/helpers.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/helpers.py
index 77ddad740865..c7a2a29ee3dc 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/helpers.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/helpers.py
@@ -8,4 +8,8 @@ def get_qualified_name(
 ) -> str:
     module_name = getattr(module, "__name__", method.__module__)
     method_name = getattr(method, "__qualname__", method.__name__)
-    return f"{module_name}.{method_name}"
+    name = f"{module_name}.{method_name}"
+    assert name.startswith("nixos_rebuild"), (
+        f"Non-internal module '{name}' called with 'get_qualified_name'"
+    )
+    return name

From b67fbd8419cafce79613824e9561f17ee3b78921 Mon Sep 17 00:00:00 2001
From: Vincent Tourneur <vincent@pimoid.fr>
Date: Tue, 20 May 2025 14:26:48 +0200
Subject: [PATCH 081/102] ocamlPackages.readline: 0.1 -> 0.2

Add myself as a maintainer.
---
 maintainers/maintainer-list.nix                    |  6 ++++++
 .../development/ocaml-modules/readline/default.nix | 14 +++++++-------
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 2bdd25f9a199..07e651ba7564 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -25149,6 +25149,12 @@
     github = "totoroot";
     githubId = 39650930;
   };
+  tournev = {
+    name = "Vincent Tourneur";
+    email = "vincent@pimoid.fr";
+    github = "vtourneur";
+    githubId = 48284424;
+  };
   ToxicFrog = {
     email = "toxicfrog@ancilla.ca";
     github = "ToxicFrog";
diff --git a/pkgs/development/ocaml-modules/readline/default.nix b/pkgs/development/ocaml-modules/readline/default.nix
index 4efafe2f4e32..b16aa5cff7f0 100644
--- a/pkgs/development/ocaml-modules/readline/default.nix
+++ b/pkgs/development/ocaml-modules/readline/default.nix
@@ -7,16 +7,16 @@
 
 buildDunePackage {
   pname = "readline";
-  version = "0.1";
+  version = "0.2";
 
   minimalOCamlVersion = "4.14";
 
   src = fetchFromGitLab {
     domain = "gitlab.inria.fr";
-    owner = "vtourneu";
-    repo = "readline-ocaml";
-    rev = "b3f84c8a006439142884d3e0df51b395d963f9fe";
-    hash = "sha256-h4kGbzwM88rPGj/KkHKgGyfyvkAYHP83ZY1INZzTaIE=";
+    owner = "acg";
+    repo = "dev/readline-ocaml";
+    tag = "v0.2";
+    hash = "sha256-qWxciodgINCFCxAVLdoU4z+ypWPYjrUwq8pU80saclw=";
   };
 
   patches = [ ./dune.patch ];
@@ -30,8 +30,8 @@ buildDunePackage {
 
   meta = {
     description = "OCaml bindings for GNU Readline";
-    homepage = "https://vtourneu.gitlabpages.inria.fr/readline-ocaml/readline/index.html";
+    homepage = "https://acg.gitlabpages.inria.fr/dev/readline-ocaml/readline/index.html";
     license = lib.licenses.cecill20;
-    maintainers = [ lib.maintainers.vbgl ];
+    maintainers = [ lib.maintainers.tournev ];
   };
 }

From 8d5d9d28be5d5b396bffd93c7e3fb2e582b45876 Mon Sep 17 00:00:00 2001
From: Brian McGee <brian@bmcgee.ie>
Date: Wed, 21 May 2025 13:37:06 +0100
Subject: [PATCH 082/102] treefmt: 2.3.0 -> 2.3.1

---
 pkgs/by-name/tr/treefmt/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/tr/treefmt/package.nix b/pkgs/by-name/tr/treefmt/package.nix
index 0c0151b4a7b7..8d26504197d5 100644
--- a/pkgs/by-name/tr/treefmt/package.nix
+++ b/pkgs/by-name/tr/treefmt/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
   pname = "treefmt";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "numtide";
     repo = "treefmt";
     rev = "v${version}";
-    hash = "sha256-tDezwRWEfPz+u/i9Wz7MZULMmmIUwnl+5gcFU+dDj6Y=";
+    hash = "sha256-Z1AGLaGrRrUd75aQJc/UKwzMGb9gI/p5WxQ5XUgp98o=";
   };
 
   vendorHash = "sha256-9yAvqz99YlBfFU/hGs1PB/sH0iOyWaVadqGhfXMkj5E=";

From 1461a8401c9a489429b770e4a2fe455af50a53e4 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Wed, 21 May 2025 13:44:58 +0200
Subject: [PATCH 083/102] udevCheckHook: guard platform

It is technically possible to guard all udevCheckHook usages behind
`lib.optionals (lib.meta.availableOn stdenv.buildPlatform systemdMinimal)`.

However, doing this is hard to read, clunky, and hard to discover.
*Not* doing such a guard would mean cross-compilation darwin -> linux breaks.
The workaround here is to just accept any udev rules if they can't be properly checked.
---
 pkgs/by-name/ud/udevCheckHook/hook.sh     |  2 +-
 pkgs/by-name/ud/udevCheckHook/package.nix | 12 ++++++++++--
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ud/udevCheckHook/hook.sh b/pkgs/by-name/ud/udevCheckHook/hook.sh
index 507e0292b8c8..bdb8e9c1f746 100644
--- a/pkgs/by-name/ud/udevCheckHook/hook.sh
+++ b/pkgs/by-name/ud/udevCheckHook/hook.sh
@@ -21,7 +21,7 @@ udevCheckHook() {
     echo Finished udevCheckPhase
 }
 
-if [[ -z "${dontUdevCheck-}" ]]; then
+if [[ -z "${dontUdevCheck-}" && -n "@udevadm@" ]]; then
     echo "Using udevCheckHook"
     preInstallCheckHooks+=(udevCheckHook)
 fi
diff --git a/pkgs/by-name/ud/udevCheckHook/package.nix b/pkgs/by-name/ud/udevCheckHook/package.nix
index 61a82530cdd3..261a503595ea 100644
--- a/pkgs/by-name/ud/udevCheckHook/package.nix
+++ b/pkgs/by-name/ud/udevCheckHook/package.nix
@@ -2,12 +2,20 @@
   lib,
   makeSetupHook,
   systemdMinimal,
+  udev,
+  stdenv,
 }:
-
+let
+  # udev rules can only be checked if systemd (specifically, 'udevadm') can be executed on build platform
+  # if udev is not available on hostPlatform, there is no point in checking rules
+  applyHook =
+    lib.meta.availableOn stdenv.hostPlatform udev
+    && lib.meta.availableOn stdenv.buildPlatform systemdMinimal;
+in
 makeSetupHook {
   name = "udev-check-hook";
   substitutions = {
-    udevadm = lib.getExe' systemdMinimal "udevadm";
+    udevadm = if applyHook then lib.getExe' systemdMinimal "udevadm" else "";
   };
   meta = {
     description = "check validity of udev rules in outputs";

From 75aae3d848f5e5380d8640dfb8b599c3f2984e20 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Wed, 21 May 2025 09:25:00 -0400
Subject: [PATCH 084/102] erlang_28: 28.0-rc4 -> 28.0

https://github.com/erlang/otp/releases/tag/OTP-28.0
https://www.erlang.org/blog/highlights-otp-28/
https://www.erlang.org/news/180
---
 pkgs/development/interpreters/erlang/28.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/erlang/28.nix b/pkgs/development/interpreters/erlang/28.nix
index 3eb0d72a42de..93e9e596b0c7 100644
--- a/pkgs/development/interpreters/erlang/28.nix
+++ b/pkgs/development/interpreters/erlang/28.nix
@@ -1,6 +1,6 @@
 { mkDerivation }:
 
 mkDerivation {
-  version = "28.0-rc4";
-  sha256 = "sha256-CZAs1lqzTWyNoKhEpHdYnFYOfHRX00X2CimC4VeA0MA=";
+  version = "28.0";
+  sha256 = "sha256-ZqND4bOp0vUkBKznhojwsN3MygDf3I7OLkR05EUnSRg=";
 }

From c34df98ee8f8a36e3cd292555145d77659ef1f68 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 21 May 2025 13:32:09 +0000
Subject: [PATCH 085/102] pict-rs: 0.5.16 -> 0.5.19

---
 pkgs/by-name/pi/pict-rs/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pi/pict-rs/package.nix b/pkgs/by-name/pi/pict-rs/package.nix
index c57f590b7e6f..b75a4b8a74db 100644
--- a/pkgs/by-name/pi/pict-rs/package.nix
+++ b/pkgs/by-name/pi/pict-rs/package.nix
@@ -13,18 +13,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pict-rs";
-  version = "0.5.16";
+  version = "0.5.19";
 
   src = fetchFromGitea {
     domain = "git.asonix.dog";
     owner = "asonix";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-q0h+H3260CSpZemVuyaiwSHDi8yKXUX8Df9ih3IzAWo=";
+    sha256 = "sha256-ifuN3Kb7Hhq8H/eoZcumO5yyrxOCA+nWQQvAdFk7w2Q=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-JJB5d9N2/tu2SYudNNguQGocQdyFAMvBea/Q3V7pYOw=";
+  cargoHash = "sha256-wZRWusETLl32BJy5lza4Bvix500VkpXLUpQb5aO8yJ0=";
 
   # needed for internal protobuf c wrapper library
   PROTOC = "${protobuf}/bin/protoc";

From afdb66e90e1279608691beb1fda92a6f88b68f6b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 21 May 2025 13:37:33 +0000
Subject: [PATCH 086/102] bdf2psf: 1.236 -> 1.237

---
 pkgs/by-name/bd/bdf2psf/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bd/bdf2psf/package.nix b/pkgs/by-name/bd/bdf2psf/package.nix
index 4c8c369fa384..1518904c7e58 100644
--- a/pkgs/by-name/bd/bdf2psf/package.nix
+++ b/pkgs/by-name/bd/bdf2psf/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bdf2psf";
-  version = "1.236";
+  version = "1.237";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/c/console-setup/bdf2psf_${version}_all.deb";
-    sha256 = "sha256-b4zEgpDxvllj/9EuKdgTOz1X6bB+4nk/W1WUUMBCU+s=";
+    sha256 = "sha256-TdEIXD4COatzgtPm8EGMxQFqqgy/5gkgnZKrze4U2sM=";
   };
 
   nativeBuildInputs = [ dpkg ];

From 8eb1c7a3e62f0822c2c58ba89fdd2f70641b3a3f Mon Sep 17 00:00:00 2001
From: fdinel <67470164+fdinel@users.noreply.github.com>
Date: Wed, 21 May 2025 09:46:08 -0400
Subject: [PATCH 087/102] shotwell: Add heif support (#408919)

Add heif support to shotwell (based on PR 212842).
---
 pkgs/by-name/sh/shotwell/package.nix | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/by-name/sh/shotwell/package.nix b/pkgs/by-name/sh/shotwell/package.nix
index 272e607725a7..e745c4c2f318 100644
--- a/pkgs/by-name/sh/shotwell/package.nix
+++ b/pkgs/by-name/sh/shotwell/package.nix
@@ -35,6 +35,7 @@
   libsecret,
   libportal-gtk3,
   gsettings-desktop-schemas,
+  libheif,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -87,6 +88,18 @@ stdenv.mkDerivation (finalAttrs: {
     libportal-gtk3
   ];
 
+  postInstall = ''
+    # Pull in HEIF support.
+    # In postInstall to run before gappsWrapperArgsHook.
+    export GDK_PIXBUF_MODULE_FILE="${
+      gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
+        extraLoaders = [
+          libheif.out
+        ];
+      }
+    }"
+  '';
+
   passthru = {
     updateScript = gnome.updateScript {
       packageName = "shotwell";

From 128319666bf57c6d4b8d17f373bd2886f075ad7a Mon Sep 17 00:00:00 2001
From: "JS (normalc/ea)" <normalc@posteo.net>
Date: Tue, 20 May 2025 20:19:11 -0400
Subject: [PATCH 088/102] embellish: init at 0.4.7

Adds Embellish, a libadwaita application that assists with downloading
and managing nerd fonts locally.
---
 pkgs/by-name/em/embellish/package.nix | 70 +++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100644 pkgs/by-name/em/embellish/package.nix

diff --git a/pkgs/by-name/em/embellish/package.nix b/pkgs/by-name/em/embellish/package.nix
new file mode 100644
index 000000000000..7e3ef1eea662
--- /dev/null
+++ b/pkgs/by-name/em/embellish/package.nix
@@ -0,0 +1,70 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  pkg-config,
+  glib,
+  gobject-introspection,
+  gtk4,
+  desktop-file-utils,
+  gettext,
+  wrapGAppsHook4,
+  libadwaita,
+  gjs,
+  gnome-autoar,
+  libsoup_3,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "embellish";
+  version = "0.4.7";
+
+  src = fetchFromGitHub {
+    owner = "getnf";
+    repo = "embellish";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+tTuQNok2rqTcQR4CRMc4qRqw0Ah2rovIut618z9GhU=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    glib
+    gobject-introspection
+    gtk4
+    gettext
+    desktop-file-utils
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    gtk4
+    libadwaita
+    gjs
+    gnome-autoar
+    libsoup_3
+  ];
+
+  meta = {
+    description = "User-friendly application designed for managing Nerd Fonts on your system";
+    longDescription = ''
+      Embellish provides a seamless experience for installing, uninstalling
+      and updating of Nerd Fonts. It's able to:
+      - List all available Nerd Fonts
+      - Download and install a Font
+      - Uninstall an installed Font
+      - Update an installed font
+      - Preview fonts
+      - Search fonts
+      - Read font's licence(s)
+    '';
+    homepage = "https://github.com/getnf/embellish";
+    changelog = "https://github.com/getnf/embellish/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ normalcea ];
+    mainProgram = "io.github.getnf.embellish";
+    platforms = lib.platforms.linux;
+  };
+})

From 1208d75e7eaf380c0ba13aa611bfcb0093713df1 Mon Sep 17 00:00:00 2001
From: DontEatOreo <57304299+DontEatOreo@users.noreply.github.com>
Date: Sun, 18 May 2025 02:32:25 +0300
Subject: [PATCH 089/102] raycast: 1.98.0 -> 1.99.0

Changelog: https://www.raycast.com/changelog/1-99-0
---
 pkgs/by-name/ra/raycast/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ra/raycast/package.nix b/pkgs/by-name/ra/raycast/package.nix
index 3425277776a4..71a0e29a62b4 100644
--- a/pkgs/by-name/ra/raycast/package.nix
+++ b/pkgs/by-name/ra/raycast/package.nix
@@ -12,19 +12,19 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.98.0";
+  version = "1.99.0";
 
   src =
     {
       aarch64-darwin = fetchurl {
         name = "Raycast.dmg";
         url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=arm";
-        hash = "sha256-cHTGXuzi7YVAPeeMHugL7uvR9BHJ5xR7I9NE63H3vcg=";
+        hash = "sha256-5TMVwZ912+r0OP2NeBc53FOkanaRHJgw+P+JbtdBsKg=";
       };
       x86_64-darwin = fetchurl {
         name = "Raycast.dmg";
         url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=x86_64";
-        hash = "sha256-KYMjr8SA8a0B19hmdsKLLz+smBpB687e+BLRRCRM+AM=";
+        hash = "sha256-fhW/qQksn69ri7dLwMerRsktZ3Ykn5qmlNkWZ2piN58=";
       };
     }
     .${stdenvNoCC.system} or (throw "raycast: ${stdenvNoCC.system} is unsupported.");

From cb222fb899d7a99860054276788495d120835633 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Sun, 18 May 2025 17:42:39 -0400
Subject: [PATCH 090/102] librepcb: 1.2.0 -> 1.3.0

Release notes: https://librepcb.org/blog/2025-03-24_release_1.3.0/

Of note, this now uses rustc/cargo to build.

Resolves: #404910 (Update request)
Closes: #405549 (previous PR)
---
 .../science/electronics/librepcb/default.nix   | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/science/electronics/librepcb/default.nix b/pkgs/applications/science/electronics/librepcb/default.nix
index ef645d36b079..6a706e5a81c4 100644
--- a/pkgs/applications/science/electronics/librepcb/default.nix
+++ b/pkgs/applications/science/electronics/librepcb/default.nix
@@ -10,17 +10,20 @@
   libGLU,
   cmake,
   wrapQtAppsHook,
+  rustPlatform,
+  cargo,
+  rustc,
 }:
 
 stdenv.mkDerivation rec {
   pname = "librepcb";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    hash = "sha256-/Hw7ZTv2CbDcKuyI27wC46IxCcTnrXDS/Mf7csUTc7w=";
+    hash = "sha256-J4y0ikZNuOguN9msmEQzgcY0/REnOEOoDkY/ga+Cfd8=";
     fetchSubmodules = true;
   };
 
@@ -32,9 +35,20 @@ stdenv.mkDerivation rec {
     wrapQtAppsHook
     opencascade-occt
     libGLU
+    rustPlatform.cargoSetupHook
+    cargo
+    rustc
   ];
   buildInputs = [ qtbase ];
 
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src;
+    sourceRoot = "source/${cargoRoot}";
+    hash = "sha256-1td3WjxbDq2lX7c0trpYRhO82ChNAG/ZABBRsekYtq4=";
+  };
+
+  cargoRoot = "libs/librepcb/rust-core";
+
   meta = with lib; {
     description = "Free EDA software to develop printed circuit boards";
     homepage = "https://librepcb.org/";

From d6fa60faf1e990b170c46582085bfb12e5f5ed51 Mon Sep 17 00:00:00 2001
From: TheTaoOfSu <TheTaoOfSu@protonmail.com>
Date: Tue, 20 May 2025 17:36:54 +0200
Subject: [PATCH 091/102] bootloadhid: init at 0-unstable-2012-12-08

---
 pkgs/by-name/bo/bootloadhid/package.nix | 43 +++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 pkgs/by-name/bo/bootloadhid/package.nix

diff --git a/pkgs/by-name/bo/bootloadhid/package.nix b/pkgs/by-name/bo/bootloadhid/package.nix
new file mode 100644
index 000000000000..302ee02cd917
--- /dev/null
+++ b/pkgs/by-name/bo/bootloadhid/package.nix
@@ -0,0 +1,43 @@
+{
+  fetchurl,
+  lib,
+  libusb-compat-0_1,
+  stdenv,
+  ...
+}:
+
+stdenv.mkDerivation {
+  pname = "bootloadhid";
+  version = "0-unstable-2012-12-08";
+
+  src = fetchurl {
+    url = "https://www.obdev.at/downloads/vusb/bootloadHID.2012-12-08.tar.gz";
+    hash = "sha256-FU5+OGKaOi7sLfZm7foe4vLppXAY8X2fD48GTMINh1Q=";
+  };
+
+  nativeBuildInputs = [
+    libusb-compat-0_1
+  ];
+
+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
+
+  setSourceRoot = "sourceRoot=$(echo */commandline)";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    install bootloadHID $out/bin
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "USB boot loader for AVR microcontrollers with at least 2 kB of boot load section, e.g. ATMega8";
+    homepage = "https://www.obdev.at/products/vusb/bootloadhid.html";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ thetaoofsu ];
+    mainProgram = "bootloadHID";
+    platforms = lib.platforms.unix;
+  };
+}

From c0b34e03b99b0913d9ac282a94e2239e5bfdf918 Mon Sep 17 00:00:00 2001
From: Ilan Joselevich <personal@ilanjoselevich.com>
Date: Tue, 20 May 2025 21:12:50 +0300
Subject: [PATCH 092/102] home-assistant-custom-lovelace-modules.auto-entities:
 init at 1.15.1

---
 .../auto-entities/package.nix                 | 35 +++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 pkgs/servers/home-assistant/custom-lovelace-modules/auto-entities/package.nix

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/auto-entities/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/auto-entities/package.nix
new file mode 100644
index 000000000000..c855d8857b47
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/auto-entities/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+}:
+
+buildNpmPackage rec {
+  pname = "auto-entities";
+  version = "1.15.1";
+
+  src = fetchFromGitHub {
+    owner = "thomasloven";
+    repo = "lovelace-auto-entities";
+    tag = "v${version}";
+    hash = "sha256-dGTbF7KO59Flw470i5U+0/ROEZYKe0KH9Y2R4JVyvd8=";
+  };
+
+  npmDepsHash = "sha256-OvXlCqD9KI4D9xsTY7morOzXsB+3w12METm2uvcO9h8=";
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D auto-entities.js $out/auto-entities.js
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Automatically populate the entities-list of lovelace cards";
+    homepage = "https://github.com/thomasloven/lovelace-auto-entities";
+    changelog = "https://github.com/thomasloven/lovelace-auto-entities/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with maintainers; [ kranzes ];
+  };
+}

From b504cc1362f60da06bcf6637b691fe7ff8db60b1 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 20 May 2025 12:53:44 +0300
Subject: [PATCH 093/102] nixos/opencloud: init module

Co-authored-by: Christoph Heiss <christoph@c8h4.io>
---
 nixos/doc/manual/redirects.json               |   6 +
 .../manual/release-notes/rl-2505.section.md   |   2 +
 nixos/modules/module-list.nix                 |   1 +
 nixos/modules/services/web-apps/opencloud.md  |  64 +++++
 nixos/modules/services/web-apps/opencloud.nix | 242 ++++++++++++++++++
 nixos/tests/all-tests.nix                     |   1 +
 nixos/tests/opencloud.nix                     | 110 ++++++++
 7 files changed, 426 insertions(+)
 create mode 100644 nixos/modules/services/web-apps/opencloud.md
 create mode 100644 nixos/modules/services/web-apps/opencloud.nix
 create mode 100644 nixos/tests/opencloud.nix

diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index d8a07c11a916..6f5bbe8b01b5 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -50,6 +50,12 @@
   "module-services-crab-hole-upstream-options": [
     "index.html#module-services-crab-hole-upstream-options"
   ],
+  "module-services-opencloud": [
+    "index.html#module-services-opencloud"
+  ],
+  "module-services-opencloud-basic-usage": [
+    "index.html#module-services-opencloud-basic-usage"
+  ],
   "module-services-strfry": [
     "index.html#module-services-strfry"
   ],
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index dbc62a4edb36..67327fdd17a7 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -200,6 +200,8 @@ Alongside many enhancements to NixOS modules and general system improvements, th
 
 - [`g3proxy`](https://github.com/bytedance/g3), an open source enterprise forward proxy from ByteDance, similar to Squid or tinyproxy. Available as [services.g3proxy](#opt-services.g3proxy.enable).
 
+- [OpenCloud](https://opencloud.eu/), an open-source, modern file-sync and sharing platform. It is a fork of oCIS, a ground-up rewrite of the well-known PHP-based NextCloud server. Available as [services.opencloud](#opt-services.opencloud.enable).
+
 - [echoip](https://github.com/mpolden/echoip), a simple service for looking up your IP address. Available as [services.echoip](#opt-services.echoip.enable).
 
 - [whoami](https://github.com/traefik/whoami), a tiny Go server that prints OS information and HTTP request to output. Available as [services.whoami](#opt-services.whoami.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index a0889ddc18b5..ff65ce2125f1 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1610,6 +1610,7 @@
   ./services/web-apps/oncall.nix
   ./services/web-apps/onlyoffice.nix
   ./services/web-apps/open-web-calendar.nix
+  ./services/web-apps/opencloud.nix
   ./services/web-apps/openvscode-server.nix
   ./services/web-apps/openwebrx.nix
   ./services/web-apps/outline.nix
diff --git a/nixos/modules/services/web-apps/opencloud.md b/nixos/modules/services/web-apps/opencloud.md
new file mode 100644
index 000000000000..5226e7922955
--- /dev/null
+++ b/nixos/modules/services/web-apps/opencloud.md
@@ -0,0 +1,64 @@
+# OpenCloud {#module-services-opencloud}
+
+[OpenCloud](https://opencloud.eu/en) is an open-source, modern file-sync and
+sharing platform. It is a fork of oCIS, a ground-up rewrite of the well-known
+PHP-based NextCloud server.
+
+The service can be configured using a combination of [](#opt-services.opencloud.settings),
+[](#opt-services.opencloud.environment) and [](#opt-services.opencloud.environmentFile).
+
+## Basic usage {#module-services-opencloud-basic-usage}
+
+OpenCloud is configured using a combination of YAML and environment
+variables. The full documentation can be found at
+[OpenCloud Admin Docs](https://docs.opencloud.eu/docs/admin/intro).
+
+The general flow of configuring OpenCloud is:
+- configure services with `services.opencloud.settings.<service>` when possible
+- configure global settings that affect multiple services via `services.opencloud.environment`
+- allow NixOS to provision a default `opencloud.yaml` for you, containing default credentials
+  for communication between the microservices
+- provide additional secrets via `environmentFile`, provisioned out of band
+
+Please note that current NixOS module for OpenCloud is configured to run in
+`fullstack` mode, which starts all the services for OpenCloud in a single
+instance, in so called supervised mode. This will start multiple OpenCloud
+services and listen on multiple other ports.
+
+Current known services and their ports are as below:
+
+| Service            | Group   |  Port |
+|--------------------|---------|-------|
+| gateway            | api     |  9142 |
+| sharing            | api     |  9150 |
+| app-registry       | api     |  9242 |
+| ocdav              | web     | 45023 |
+| auth-machine       | api     |  9166 |
+| storage-system     | api     |  9215 |
+| webdav             | web     |  9115 |
+| webfinger          | web     | 46871 |
+| storage-system     | web     |  9216 |
+| web                | web     |  9100 |
+| eventhistory       | api     | 33177 |
+| ocs                | web     |  9110 |
+| storage-publiclink | api     |  9178 |
+| settings           | web     |  9190 |
+| ocm                | api     |  9282 |
+| settings           | api     |  9191 |
+| ocm                | web     |  9280 |
+| app-provider       | api     |  9164 |
+| storage-users      | api     |  9157 |
+| auth-service       | api     |  9199 |
+| thumbnails         | web     |  9186 |
+| thumbnails         | api     |  9185 |
+| storage-shares     | api     |  9154 |
+| sse                | sse     | 46833 |
+| userlog            | userlog | 45363 |
+| search             | api     |  9220 |
+| proxy              | web     |  9200 |
+| idp                | web     |  9130 |
+| frontend           | web     |  9140 |
+| groups             | api     |  9160 |
+| graph              | graph   |  9120 |
+| users              | api     |  9144 |
+| auth-basic         | api     |  9146 |
diff --git a/nixos/modules/services/web-apps/opencloud.nix b/nixos/modules/services/web-apps/opencloud.nix
new file mode 100644
index 000000000000..0eded3cc96f9
--- /dev/null
+++ b/nixos/modules/services/web-apps/opencloud.nix
@@ -0,0 +1,242 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib) types;
+  cfg = config.services.opencloud;
+
+  defaultUser = "opencloud";
+  defaultGroup = defaultUser;
+
+  settingsFormat = pkgs.formats.yaml { };
+in
+{
+  options = {
+    services.opencloud = {
+      enable = lib.mkEnableOption "OpenCloud";
+
+      package = lib.mkPackageOption pkgs "opencloud" { };
+      webPackage = lib.mkPackageOption pkgs [ "opencloud" "web" ] { };
+      idpWebPackage = lib.mkPackageOption pkgs [ "opencloud" "idp-web" ] { };
+
+      user = lib.mkOption {
+        type = types.str;
+        default = defaultUser;
+        example = "mycloud";
+        description = ''
+          The user to run OpenCloud as.
+          By default, a user named `${defaultUser}` will be created whose home
+          directory is [](#opt-services.opencloud.stateDir).
+        '';
+      };
+
+      group = lib.mkOption {
+        type = types.str;
+        default = defaultGroup;
+        example = "mycloud";
+        description = ''
+          The group to run OpenCloud under.
+          By default, a group named `${defaultGroup}` will be created.
+        '';
+      };
+
+      address = lib.mkOption {
+        type = types.str;
+        default = "127.0.0.1";
+        description = "Web server bind address.";
+      };
+
+      port = lib.mkOption {
+        type = types.port;
+        default = 9200;
+        description = "Web server port.";
+      };
+
+      url = lib.mkOption {
+        type = types.str;
+        default = "https://localhost:9200";
+        example = "https://cloud.example.com";
+        description = "Web interface root public URL, including scheme and port (if non-default).";
+      };
+
+      stateDir = lib.mkOption {
+        default = "/var/lib/opencloud";
+        type = types.str;
+        description = "OpenCloud data directory.";
+      };
+
+      settings = lib.mkOption {
+        type = lib.types.attrsOf settingsFormat.type;
+        default = { };
+        description = ''
+          Additional YAML configuration for OpenCloud services.
+
+          Every item in this attrset will be mapped to a .yaml file in /etc/opencloud.
+
+          The possible config options are currently not well documented, see source code:
+          https://github.com/opencloud-eu/opencloud/blob/main/pkg/config/config.go
+        '';
+      };
+
+      environmentFile = lib.mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/run/keys/opencloud.env";
+        description = ''
+          An environment file as defined in {manpage}`systemd.exec(5)`.
+
+          Use this to inject secrets, e.g. database or auth credentials out of band.
+
+          Configuration provided here will override `settings` and `environment`.
+        '';
+      };
+
+      environment = lib.mkOption {
+        type = types.attrsOf types.str;
+        default = {
+          OC_INSECURE = "true";
+        };
+        description = ''
+          Extra environment variables to set for the service.
+
+          Use this to set configuration that may affect multiple microservices.
+
+          Configuration provided here will override `settings`.
+        '';
+        example = {
+          OC_INSECURE = "false";
+          OC_LOG_LEVEL = "error";
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.${defaultUser} = lib.mkIf (cfg.user == defaultUser) {
+      group = cfg.group;
+      home = cfg.stateDir;
+      isSystemUser = true;
+      createHome = true;
+      description = "OpenCloud daemon user";
+    };
+
+    users.groups = lib.mkIf (cfg.group == defaultGroup) { ${defaultGroup} = { }; };
+
+    systemd = {
+      services =
+        let
+          environment = {
+            PROXY_HTTP_ADDR = "${cfg.address}:${toString cfg.port}";
+            OC_URL = cfg.url;
+            OC_BASE_DATA_PATH = cfg.stateDir;
+            WEB_ASSET_CORE_PATH = "${cfg.webPackage}";
+            IDP_ASSET_PATH = "${cfg.idpWebPackage}/assets";
+            OC_CONFIG_DIR = "/etc/opencloud";
+          } // cfg.environment;
+          commonServiceConfig = {
+            EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;
+            MemoryDenyWriteExecute = true;
+            NoNewPrivileges = true;
+            PrivateTmp = true;
+            PrivateDevices = true;
+            ProtectSystem = "strict";
+            ProtectHome = true;
+            ProtectControlGroups = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            ProtectKernelLogs = true;
+            RestrictAddressFamilies = [
+              "AF_UNIX"
+              "AF_INET"
+              "AF_INET6"
+            ];
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            RestrictSUIDSGID = true;
+            LockPersonality = true;
+            SystemCallArchitectures = "native";
+          };
+        in
+        {
+          opencloud-init-config = lib.mkIf (cfg.settings.opencloud or { } == { }) {
+            description = "Provision initial OpenCloud config";
+            before = [ "opencloud.service" ];
+            wantedBy = [ "multi-user.target" ];
+
+            inherit environment;
+
+            serviceConfig = {
+              Type = "oneshot";
+              ReadWritePaths = [ "/etc/opencloud" ];
+            } // commonServiceConfig;
+
+            path = [ cfg.package ];
+            script = ''
+              set -x
+              config="''${OC_CONFIG_DIR}/opencloud.yaml"
+              if [ ! -e "$config" ]; then
+                echo "Provisioning initial OpenCloud config..."
+                opencloud init --insecure "''${OC_INSECURE:false}" --config-path "''${OC_CONFIG_DIR}"
+                chown ${cfg.user}:${cfg.group} "$config"
+              fi
+            '';
+          };
+
+          opencloud = {
+            description = "OpenCloud - a secure and private way to store, access, and share your files";
+            after = [ "network.target" ];
+            wantedBy = [ "multi-user.target" ];
+
+            inherit environment;
+
+            serviceConfig = {
+              Type = "simple";
+              ExecStart = "${lib.getExe cfg.package} server";
+              WorkingDirectory = cfg.stateDir;
+              User = cfg.user;
+              Group = cfg.group;
+              Restart = "always";
+              ReadWritePaths = [ cfg.stateDir ];
+            } // commonServiceConfig;
+
+            restartTriggers = lib.mapAttrsToList (
+              name: _: config.environment.etc."opencloud/${name}.yaml".source
+            ) cfg.settings;
+          };
+        };
+    };
+
+    systemd.tmpfiles.settings."10-opencloud" = {
+      ${cfg.stateDir}.d = {
+        inherit (cfg) user group;
+        mode = "0750";
+      };
+      "${cfg.stateDir}/idm".d = {
+        inherit (cfg) user group;
+        mode = "0750";
+      };
+    };
+
+    environment.etc =
+      (lib.mapAttrs' (name: value: {
+        name = "opencloud/${name}.yaml";
+        value.source = settingsFormat.generate "${name}.yaml" value;
+      }) cfg.settings)
+      // {
+        # ensure /etc/opencloud gets created, so we can provision the config
+        "opencloud/.keep".text = "";
+      };
+  };
+
+  meta = {
+    doc = ./opencloud.md;
+    maintainers = with lib.maintainers; [
+      christoph-heiss
+      k900
+    ];
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 03a736fdd7dc..5501ffb8b92b 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -975,6 +975,7 @@ in
   ombi = handleTest ./ombi.nix { };
   openarena = handleTest ./openarena.nix { };
   openbao = runTest ./openbao.nix;
+  opencloud = runTest ./opencloud.nix;
   openldap = handleTest ./openldap.nix { };
   opensearch = discoverTests (import ./opensearch.nix);
   openresty-lua = handleTest ./openresty-lua.nix { };
diff --git a/nixos/tests/opencloud.nix b/nixos/tests/opencloud.nix
new file mode 100644
index 000000000000..1fdac34b6ccd
--- /dev/null
+++ b/nixos/tests/opencloud.nix
@@ -0,0 +1,110 @@
+{ lib, pkgs, ... }:
+
+let
+  certs = import ./common/acme/server/snakeoil-certs.nix;
+  inherit (certs) domain;
+
+  # this is a demo user created by IDM_CREATE_DEMO_USERS=true
+  demoUser = "alan";
+  demoPassword = "demo";
+
+  adminUser = "admin";
+  adminPassword = "hunter2";
+  testRunner =
+    pkgs.writers.writePython3Bin "test-runner"
+      {
+        libraries = [ pkgs.python3Packages.selenium ];
+        flakeIgnore = [ "E501" ];
+      }
+      ''
+        import sys
+        from selenium.webdriver.common.by import By
+        from selenium.webdriver import Firefox
+        from selenium.webdriver.firefox.options import Options
+        from selenium.webdriver.support.ui import WebDriverWait
+        from selenium.webdriver.support import expected_conditions as EC
+
+        options = Options()
+        options.add_argument('--headless')
+        driver = Firefox(options=options)
+
+        host = sys.argv[1]
+        user = sys.argv[2]
+        password = sys.argv[3]
+
+        driver.get(f"https://{host}/")
+        wait = WebDriverWait(driver, 60)
+        wait.until(EC.title_contains("Sign in"))
+        wait.until(EC.url_contains(f"https://{host}/signin/v1/identifier"))
+        wait.until(EC.visibility_of_element_located((By.ID, 'oc-login-username')))
+        driver.find_element(By.ID, 'oc-login-username').send_keys(user)
+        driver.find_element(By.ID, 'oc-login-password').send_keys(password)
+        wait.until(EC.visibility_of_element_located((By.XPATH, '//button[@type="submit"]')))
+        driver.find_element(By.XPATH, '//button[@type="submit"]').click()
+        wait.until(EC.visibility_of_element_located((By.ID, 'new-file-menu-btn')))
+        wait.until(EC.title_contains("Personal"))
+      '';
+in
+
+{
+  name = "opencloud";
+
+  meta.maintainers = with lib.maintainers; [
+    christoph-heiss
+    k900
+  ];
+
+  nodes.machine = {
+    virtualisation.memorySize = 2048;
+    environment.systemPackages = [
+      pkgs.firefox-unwrapped
+      pkgs.geckodriver
+      testRunner
+    ];
+
+    networking.hosts."127.0.0.1" = [ domain ];
+    security.pki.certificateFiles = [ certs.ca.cert ];
+
+    services.opencloud = {
+      enable = true;
+      url = "https://${domain}:9200";
+      environment = {
+        ADMIN_PASSWORD = adminPassword;
+        IDM_CREATE_DEMO_USERS = "true";
+        IDM_LDAPS_CERT = "${certs.${domain}.cert}";
+        IDM_LDAPS_KEY = "${certs.${domain}.key}";
+        OC_INSECURE = "false";
+        OC_LDAP_URI = "ldaps://${domain}:9235";
+        OC_LDAP_CACERT = "${certs.${domain}.cert}";
+        OC_HTTP_TLS_ENABLED = "true";
+        OC_HTTP_TLS_CERTIFICATE = "${certs.${domain}.cert}";
+        OC_HTTP_TLS_KEY = "${certs.${domain}.key}";
+        PROXY_TLS = "true";
+        PROXY_TRANSPORT_TLS_CERT = "${certs.${domain}.cert}";
+        PROXY_TRANSPORT_TLS_KEY = "${certs.${domain}.key}";
+        PROXY_INSECURE_BACKENDS = "true";
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("opencloud.service")
+    machine.wait_for_open_port(9200)
+
+    # wait for OpenCloud to fully come up
+    machine.sleep(10)
+
+    with subtest("opencloud bin works"):
+        machine.succeed("${lib.getExe pkgs.opencloud} version")
+
+    with subtest("web interface presents start page"):
+        machine.succeed("curl -sSf https://${domain}:9200 | grep '<title>OpenCloud</title>'")
+
+    with subtest("use the web interface to log in with the provisioned admin user"):
+        machine.succeed("PYTHONUNBUFFERED=1 systemd-cat -t test-runner test-runner ${domain}:9200 ${adminUser} ${adminPassword}")
+
+    with subtest("use the web interface to log in with a demo user"):
+        machine.succeed("PYTHONUNBUFFERED=1 systemd-cat -t test-runner test-runner ${domain}:9200 ${demoUser} ${demoPassword}")
+  '';
+}

From 8ab765e2d4d2007815ebbccdeba49137a6557ea1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 21 May 2025 17:11:52 +0200
Subject: [PATCH 094/102] esphome: pin paho-mqtt at 1.6.1

Closes: #409387
---
 pkgs/by-name/es/esphome/package.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/by-name/es/esphome/package.nix b/pkgs/by-name/es/esphome/package.nix
index 60de831b46f1..5846a147625b 100644
--- a/pkgs/by-name/es/esphome/package.nix
+++ b/pkgs/by-name/es/esphome/package.nix
@@ -17,6 +17,17 @@ let
     self = python;
     packageOverrides = self: super: {
       esphome-dashboard = self.callPackage ./dashboard.nix { };
+
+      paho-mqtt = super.paho-mqtt.overridePythonAttrs (oldAttrs: rec {
+        version = "1.6.1";
+        src = fetchFromGitHub {
+          inherit (oldAttrs.src) owner repo;
+          tag = "v${version}";
+          hash = "sha256-9nH6xROVpmI+iTKXfwv2Ar1PAmWbEunI3HO0pZyK6Rg=";
+        };
+        build-system = with self; [ setuptools ];
+        doCheck = false;
+      });
     };
   };
 in

From 35c36693ac92238ce35a2939c92b257dd719ad15 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 21 May 2025 17:22:23 +0200
Subject: [PATCH 095/102] esphome: 2025.4.2 -> 2025.5.0

https://github.com/esphome/esphome/releases/tag/2025.5.0
---
 pkgs/by-name/es/esphome/dashboard.nix | 6 +++---
 pkgs/by-name/es/esphome/package.nix   | 9 +++------
 2 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/es/esphome/dashboard.nix b/pkgs/by-name/es/esphome/dashboard.nix
index 97f30042b558..cdbab8d18f13 100644
--- a/pkgs/by-name/es/esphome/dashboard.nix
+++ b/pkgs/by-name/es/esphome/dashboard.nix
@@ -13,19 +13,19 @@
 
 buildPythonPackage rec {
   pname = "esphome-dashboard";
-  version = "20250415.0";
+  version = "20250514.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "dashboard";
     rev = "refs/tags/${version}";
-    hash = "sha256-HpmHII1pSsSO/hEHcy/QHv7jxslpz9a6EeHcEZQ+VIA=";
+    hash = "sha256-t0+YlITnxgnLrK/SN0bSmMIv3djR9DKMlnFrR9Btwx8=";
   };
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-SiH6CqFOpDQMMtRcgxr0LSJKuziZoYVjgVTpKBoebbg=";
+    hash = "sha256-Uiz26kPxoz32t/GRppiYiVBVwWcQqUzPr0kScVUZak8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/by-name/es/esphome/package.nix b/pkgs/by-name/es/esphome/package.nix
index 5846a147625b..8b017eb21ff4 100644
--- a/pkgs/by-name/es/esphome/package.nix
+++ b/pkgs/by-name/es/esphome/package.nix
@@ -33,14 +33,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "2025.4.2";
+  version = "2025.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     tag = version;
-    hash = "sha256-vy/wjtl/IbdSOxAUsV4bl7VNEBTetsvIDh2V1gDHSMs=";
+    hash = "sha256-BcPdgAvRR7zataL4KOhLAvQaQnS60z8UZ9xdIK7ydz4=";
   };
 
   build-systems = with python.pkgs; [
@@ -61,10 +61,7 @@ python.pkgs.buildPythonApplication rec {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail "setuptools==" "setuptools>="
-
-    # ensure component dependencies are available
-    cat requirements_optional.txt >> requirements.txt
+      --replace-fail "setuptools==80.4.0" "setuptools"
   '';
 
   # Remove esptool and platformio from requirements

From edcbcdc9fa59b76319ca86014fb9ae2b07dc46c7 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 21 May 2025 17:23:38 +0200
Subject: [PATCH 096/102] esphome: remove globin from maintainers

Added in 2019 but no changes since.
---
 pkgs/by-name/es/esphome/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/es/esphome/package.nix b/pkgs/by-name/es/esphome/package.nix
index 8b017eb21ff4..42ce5755059e 100644
--- a/pkgs/by-name/es/esphome/package.nix
+++ b/pkgs/by-name/es/esphome/package.nix
@@ -168,7 +168,6 @@ python.pkgs.buildPythonApplication rec {
       gpl3Only # The python codebase and all other parts of this codebase
     ];
     maintainers = with maintainers; [
-      globin
       hexa
     ];
     mainProgram = "esphome";

From 8c469ad5922b09a63d80f3c876c89ad8fbd3f137 Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Thu, 15 May 2025 23:08:08 +1000
Subject: [PATCH 097/102] spiped: remove tomfitzhenry as maintainer

---
 nixos/tests/spiped.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/tests/spiped.nix b/nixos/tests/spiped.nix
index a39fc2fd722b..994ec2be02e4 100644
--- a/nixos/tests/spiped.nix
+++ b/nixos/tests/spiped.nix
@@ -5,7 +5,7 @@ in
 {
   name = "spiped";
   meta = with pkgs.lib.maintainers; {
-    maintainers = [ tomfitzhenry ];
+    maintainers = [ ];
   };
 
   nodes = {

From 1d34e6827d3350c351bbb1d24aeaf4235dc5ddf7 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 21 May 2025 18:04:29 +0200
Subject: [PATCH 098/102] python312Packages.ctranslate2: skip crashing test on
 darwin

---
 pkgs/development/python-modules/ctranslate2/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/ctranslate2/default.nix b/pkgs/development/python-modules/ctranslate2/default.nix
index 210d7aaacf02..d1a56041f07b 100644
--- a/pkgs/development/python-modules/ctranslate2/default.nix
+++ b/pkgs/development/python-modules/ctranslate2/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
 
   # build-system
@@ -59,6 +60,11 @@ buildPythonPackage rec {
     export HOME=$TMPDIR
   '';
 
+  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
+    # Fatal Python error: Aborted
+    "test_invalid_model_path"
+  ];
+
   disabledTestPaths = [
     # TODO: ModuleNotFoundError: No module named 'opennmt'
     "tests/test_opennmt_tf.py"

From 6eb25745769b364b79e5b474a2fd1ba0d72eb2b3 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 21 May 2025 18:10:01 +0200
Subject: [PATCH 099/102] python312Packages.ctranslate2: cleanup

---
 .../development/python-modules/ctranslate2/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/ctranslate2/default.nix b/pkgs/development/python-modules/ctranslate2/default.nix
index d1a56041f07b..031516b63965 100644
--- a/pkgs/development/python-modules/ctranslate2/default.nix
+++ b/pkgs/development/python-modules/ctranslate2/default.nix
@@ -16,6 +16,7 @@
   pytestCheckHook,
   torch,
   transformers,
+  writableTmpDirAsHomeHook,
   wurlitzer,
 }:
 
@@ -50,14 +51,13 @@ buildPythonPackage rec {
     pytestCheckHook
     torch
     transformers
+    writableTmpDirAsHomeHook
     wurlitzer
   ];
 
   preCheck = ''
     # run tests against build result, not sources
     rm -rf ctranslate2
-
-    export HOME=$TMPDIR
   '';
 
   disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
@@ -72,11 +72,11 @@ buildPythonPackage rec {
     "tests/test_transformers.py"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Fast inference engine for Transformer models";
     homepage = "https://github.com/OpenNMT/CTranslate2";
     changelog = "https://github.com/OpenNMT/CTranslate2/blob/${src.rev}/CHANGELOG.md";
-    license = licenses.mit;
-    maintainers = with maintainers; [ hexa ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hexa ];
   };
 }

From 36ecfe6216f0aa7f2a1ffe5aafc2c0eae6c8cdcf Mon Sep 17 00:00:00 2001
From: programmerlexi <lexi@reyer.name>
Date: Sun, 18 May 2025 14:57:11 +0200
Subject: [PATCH 100/102] nixos/limine: add support for secure boot

Signed-off-by: John Titor <50095635+JohnRTitor@users.noreply.github.com>
---
 doc/release-notes/rl-2511.section.md          |  1 -
 .../manual/release-notes/rl-2511.section.md   |  2 +-
 .../boot/loader/limine/limine-install.py      | 26 ++++++
 .../system/boot/loader/limine/limine.nix      | 88 +++++++++++++++++++
 nixos/tests/limine/default.nix                |  1 +
 nixos/tests/limine/secure-boot.nix            | 34 +++++++
 6 files changed, 150 insertions(+), 2 deletions(-)
 create mode 100644 nixos/tests/limine/secure-boot.nix

diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index ba2d9f256d34..da42ae4326de 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -34,4 +34,3 @@
 ### Additions and Improvements {#sec-nixpkgs-release-25.11-lib-additions-improvements}
 
 - Create the first release note entry in this section!
-
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 794c0dc6a633..65bac7327ed9 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -4,7 +4,7 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Create the first release note entry in this section!
+- Secure boot support can now be enabled for the Limine bootloader through {option}`boot.loader.limine.secureBoot.enable`. Bootloader install script signs the bootloader, then kernels are hashed during system rebuild and written to a config. This allows Limine to boot only the kernels installed through NixOS system.
 
 ## New Modules {#sec-release-25.11-new-modules}
 
diff --git a/nixos/modules/system/boot/loader/limine/limine-install.py b/nixos/modules/system/boot/loader/limine/limine-install.py
index 9279db7f58f0..94d47a3169c1 100644
--- a/nixos/modules/system/boot/loader/limine/limine-install.py
+++ b/nixos/modules/system/boot/loader/limine/limine-install.py
@@ -249,6 +249,10 @@ def main():
             partition formatted as FAT.
         '''))
 
+    if config('secureBoot')['enable'] and not config('secureBoot')['createAndEnrollKeys'] and not os.path.exists("/var/lib/sbctl"):
+        print("There are no sbctl secure boot keys present. Please generate some.")
+        sys.exit(1)
+
     if not os.path.exists(limine_dir):
         os.makedirs(limine_dir)
     else:
@@ -352,6 +356,28 @@ def main():
                 print('error: failed to enroll limine config.', file=sys.stderr)
                 sys.exit(1)
 
+        if config('secureBoot')['enable']:
+            sbctl = os.path.join(config('secureBoot')['sbctl'], 'bin', 'sbctl')
+            if config('secureBoot')['createAndEnrollKeys']:
+                print("TEST MODE: creating and enrolling keys")
+                try:
+                    subprocess.run([sbctl, 'create-keys'])
+                except:
+                    print('error: failed to create keys', file=sys.stderr)
+                    sys.exit(1)
+                try:
+                    subprocess.run([sbctl, 'enroll-keys', '--yes-this-might-brick-my-machine'])
+                except:
+                    print('error: failed to enroll keys', file=sys.stderr)
+                    sys.exit(1)
+
+            print('signing limine...')
+            try:
+                subprocess.run([sbctl, 'sign', dest_path])
+            except:
+                print('error: failed to sign limine', file=sys.stderr)
+                sys.exit(1)
+
         if not config('efiRemovable') and not config('canTouchEfiVariables'):
             print('warning: boot.loader.efi.canTouchEfiVariables is set to false while boot.loader.limine.efiInstallAsRemovable.\n  This may render the system unbootable.')
 
diff --git a/nixos/modules/system/boot/loader/limine/limine.nix b/nixos/modules/system/boot/loader/limine/limine.nix
index 14aa49ae579d..50a000380287 100644
--- a/nixos/modules/system/boot/loader/limine/limine.nix
+++ b/nixos/modules/system/boot/loader/limine/limine.nix
@@ -18,6 +18,7 @@ let
       canTouchEfiVariables = efi.canTouchEfiVariables;
       efiSupport = cfg.efiSupport;
       efiRemovable = cfg.efiInstallAsRemovable;
+      secureBoot = cfg.secureBoot;
       biosSupport = cfg.biosSupport;
       biosDevice = cfg.biosDevice;
       partitionIndex = cfg.partitionIndex;
@@ -177,6 +178,41 @@ in
       '';
     };
 
+    secureBoot = {
+      enable = lib.mkEnableOption null // {
+        description = ''
+          Whether to use sign the limine binary with sbctl.
+
+          ::: {.note}
+          This requires you to already have generated the keys and enrolled them with {command}`sbctl`.
+
+          To create keys use {command}`sbctl create-keys`.
+
+          To enroll them first reset secure boot to "Setup Mode". This is device specific.
+          Then enroll them using {command}`sbctl enroll-keys -m -f`.
+
+          You can now rebuild your system with this option enabled.
+
+          Afterwards turn setup mode off and enable secure boot.
+          :::
+        '';
+      };
+
+      createAndEnrollKeys = lib.mkEnableOption null // {
+        internal = true;
+        description = ''
+          Creates secure boot signing keys and enrolls them during bootloader installation.
+
+          ::: {.note}
+          This is used for automated nixos tests.
+          NOT INTENDED to be used on a real system.
+          :::
+        '';
+      };
+
+      sbctl = lib.mkPackageOption pkgs "sbctl" { };
+    };
+
     style = {
       wallpapers = lib.mkOption {
         default = [ ];
@@ -368,5 +404,57 @@ in
         };
       };
     })
+    (lib.mkIf (cfg.enable && cfg.secureBoot.enable) {
+      assertions = [
+        {
+          assertion = cfg.enrollConfig;
+          message = "Disabling enrollConfig allows bypassing secure boot.";
+        }
+        {
+          assertion = cfg.validateChecksums;
+          message = "Disabling validateChecksums allows bypassing secure boot.";
+        }
+        {
+          assertion = cfg.panicOnChecksumMismatch;
+          message = "Disabling panicOnChecksumMismatch allows bypassing secure boot.";
+        }
+        {
+          assertion = cfg.efiSupport;
+          message = "Secure boot is only supported on EFI systems.";
+        }
+      ];
+
+      boot.loader.limine.enrollConfig = true;
+      boot.loader.limine.validateChecksums = true;
+      boot.loader.limine.panicOnChecksumMismatch = true;
+    })
+
+    # Fwupd binary needs to be signed in secure boot mode
+    (lib.mkIf (cfg.enable && cfg.secureBoot.enable && config.services.fwupd.enable) {
+      systemd.services.fwupd = {
+        environment.FWUPD_EFIAPPDIR = "/run/fwupd-efi";
+      };
+
+      systemd.services.fwupd-efi = {
+        description = "Sign fwupd EFI app for secure boot";
+        wantedBy = [ "fwupd.service" ];
+        partOf = [ "fwupd.service" ];
+        before = [ "fwupd.service" ];
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          RuntimeDirectory = "fwupd-efi";
+        };
+        script = ''
+          cp ${config.services.fwupd.package.fwupd-efi}/libexec/fwupd/efi/fwupd*.efi /run/fwupd-efi/
+          chmod +w /run/fwupd-efi/fwupd*.efi
+          ${lib.getExe pkgs.sbctl} sign /run/fwupd-efi/fwupd*.efi
+        '';
+      };
+
+      services.fwupd.uefiCapsuleSettings = {
+        DisableShimForSecureBoot = true;
+      };
+    })
   ];
 }
diff --git a/nixos/tests/limine/default.nix b/nixos/tests/limine/default.nix
index 7458b9641633..9497e06a18f6 100644
--- a/nixos/tests/limine/default.nix
+++ b/nixos/tests/limine/default.nix
@@ -4,5 +4,6 @@
 }:
 {
   checksum = runTest ./checksum.nix;
+  secureBoot = runTest ./secure-boot.nix;
   uefi = runTest ./uefi.nix;
 }
diff --git a/nixos/tests/limine/secure-boot.nix b/nixos/tests/limine/secure-boot.nix
new file mode 100644
index 000000000000..9f7969e626a0
--- /dev/null
+++ b/nixos/tests/limine/secure-boot.nix
@@ -0,0 +1,34 @@
+{ lib, ... }:
+{
+  name = "secureBoot";
+  meta.maintainers = with lib.maintainers; [
+    programmerlexi
+  ];
+  meta.platforms = [
+    "aarch64-linux"
+    "i686-linux"
+    "x86_64-linux"
+  ];
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      virtualisation.useBootLoader = true;
+      virtualisation.useEFIBoot = true;
+      virtualisation.useSecureBoot = true;
+      virtualisation.efi.OVMF = pkgs.OVMFFull.fd;
+      virtualisation.efi.keepVariables = true;
+
+      boot.loader.efi.canTouchEfiVariables = true;
+
+      boot.loader.limine.enable = true;
+      boot.loader.limine.efiSupport = true;
+      boot.loader.limine.secureBoot.enable = true;
+      boot.loader.limine.secureBoot.createAndEnrollKeys = true;
+      boot.loader.timeout = 0;
+    };
+
+  testScript = ''
+    machine.start()
+    assert "Secure Boot: enabled (user)" in machine.succeed("bootctl status")
+  '';
+}

From 95030d7eb31bcba8b01a0d05673e4a508bdc7017 Mon Sep 17 00:00:00 2001
From: programmerlexi <lexi@reyer.name>
Date: Wed, 21 May 2025 14:53:20 +0200
Subject: [PATCH 101/102] nixos/limine: don't modify boot order on bootloader
 update

---
 .../modules/system/boot/loader/limine/limine-install.py  | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/system/boot/loader/limine/limine-install.py b/nixos/modules/system/boot/loader/limine/limine-install.py
index 94d47a3169c1..3407d778d62b 100644
--- a/nixos/modules/system/boot/loader/limine/limine-install.py
+++ b/nixos/modules/system/boot/loader/limine/limine-install.py
@@ -388,9 +388,16 @@ def main():
                 efibootmgr = os.path.join(config('efiBootMgrPath'), 'bin', 'efibootmgr')
                 efi_partition = find_mounted_device(config('efiMountPoint'))
                 efi_disk = find_disk_device(efi_partition)
+
+                efibootmgr_output = subprocess.check_output([efibootmgr], stderr=subprocess.STDOUT, universal_newlines=True)
+                create_flag = '-c'
+                # Check the output of `efibootmgr` to find if limine is already installed and present in the boot record
+                if matches := re.findall(r'Boot[0-9a-fA-F]{4}\*? Limine', efibootmgr_output):
+                    create_flag = '-C' # if present, keep the same boot order
+
                 efibootmgr_output = subprocess.check_output([
                     efibootmgr,
-                    '-c',
+                    create_flag,
                     '-d', efi_disk,
                     '-p', efi_partition.removeprefix(efi_disk).removeprefix('p'),
                     '-l', f'\\efi\\limine\\{boot_file}',

From 486b9e4b909dcc173c9b01a5b476d60a4bb3644b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 16 May 2025 03:56:11 +0000
Subject: [PATCH 102/102] klipper: 0.13.0-unstable-2025-05-02 ->
 0.13.0-unstable-2025-05-14

---
 pkgs/servers/klipper/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/klipper/default.nix b/pkgs/servers/klipper/default.nix
index 34ec693f0fa5..ffaf4ee7a957 100644
--- a/pkgs/servers/klipper/default.nix
+++ b/pkgs/servers/klipper/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "klipper";
-  version = "0.13.0-unstable-2025-05-02";
+  version = "0.13.0-unstable-2025-05-14";
 
   src = fetchFromGitHub {
     owner = "KevinOConnor";
     repo = "klipper";
-    rev = "1cc63980747b80516f8fc4f022eedf18ae739086";
-    sha256 = "sha256-0VKlbCdfVE8XxGoKZQd5Gab5Aq3oq4EHdtCh3tEkgwI=";
+    rev = "82f540bb731fe4ae4575d48aefb2f837491ba4e6";
+    sha256 = "sha256-eP6QQu1FHq08lkZIwaPamuIQg54bLBMDF0UBfQnKiRQ=";
   };
 
   sourceRoot = "${src.name}/klippy";