Merge staging-next into staging

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -173,6 +173,8 @@
 
 - [Recyclarr](https://github.com/recyclarr/recyclarr) a TRaSH Guides synchronizer for Sonarr and Radarr. Available as [services.recyclarr](#opt-services.recyclarr.enable).
 
+- [Rebuilderd](https://github.com/kpcyrd/rebuilderd) an independent verification of binary packages - Reproducible Builds. Available as [services.rebuilderd](#opt-services.rebuilderd.enable).
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## Backward Incompatibilities {#sec-release-25.05-incompatibilities}

nixos/modules/module-list.nix

@@ -868,6 +868,7 @@
   ./services/misc/radicle.nix
   ./services/misc/readarr.nix
   ./services/misc/realmd.nix
+  ./services/misc/rebuilderd.nix
   ./services/misc/recyclarr.nix
   ./services/misc/redlib.nix
   ./services/misc/redmine.nix

nixos/modules/services/hardware/rasdaemon.nix

@@ -14,6 +14,8 @@ in
 
     enable = lib.mkEnableOption "RAS logging daemon";
 
+    package = lib.mkPackageOption pkgs "rasdaemon" { };
+
     record = lib.mkOption {
       type = lib.types.bool;
       default = true;
@@ -99,7 +101,7 @@ in
       };
     };
     environment.systemPackages =
-      [ pkgs.rasdaemon ]
+      [ cfg.package ]
       ++ lib.optionals (cfg.testing) (
         with pkgs.error-inject;
         [
@@ -151,12 +153,12 @@ in
           StateDirectory = lib.optionalString (cfg.record) "rasdaemon";
 
           ExecStart =
-            "${pkgs.rasdaemon}/bin/rasdaemon --foreground" + lib.optionalString (cfg.record) " --record";
-          ExecStop = "${pkgs.rasdaemon}/bin/rasdaemon --disable";
+            "${cfg.package}/bin/rasdaemon --foreground" + lib.optionalString (cfg.record) " --record";
+          ExecStop = "${cfg.package}/bin/rasdaemon --disable";
           Restart = "on-abort";
 
           # src/misc/rasdaemon.service.in shows this:
-          # ExecStartPost = ${pkgs.rasdaemon}/bin/rasdaemon --enable
+          # ExecStartPost = ${cfg.package}/bin/rasdaemon --enable
           # but that results in unpredictable existence of the database
           # and everything seems to be enabled without this...
         };
@@ -167,7 +169,7 @@ in
         wantedBy = [ "multi-user.target" ];
         serviceConfig = {
           Type = "oneshot";
-          ExecStart = "${pkgs.rasdaemon}/bin/ras-mc-ctl --register-labels";
+          ExecStart = "${cfg.package}/bin/ras-mc-ctl --register-labels";
           RemainAfterExit = true;
         };
       };

nixos/modules/services/misc/rebuilderd.nix

@@ -0,0 +1,49 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  inherit (lib) mkEnableOption mkIf mkPackageOption;
+  cfg = config.services.rebuilderd;
+
+  format = pkgs.formats.toml { };
+  settings = lib.attrsets.filterAttrs (n: v: v != null) cfg.settings;
+  configFile = format.generate "rebuilderd.conf" settings;
+in
+{
+  options.services.rebuilderd = {
+    enable = mkEnableOption "rebuilderd service for independent verification of binary packages";
+    package = mkPackageOption pkgs "rebuilderd" { };
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = format.type;
+      };
+      default = { };
+      description = ''
+        Configuration for rebuilderd (rebuilderd.conf)
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.rebuilderd = {
+      description = "Independent verification of binary packages";
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        REBUILDERD_COOKIE_PATH = "/var/lib/rebuilderd/auth-cookie";
+      };
+      after = [
+        "network.target"
+      ];
+      serviceConfig = {
+        ExecStart = "${cfg.package}/bin/rebuilderd --config ${configFile}";
+        DynamicUser = true;
+        StateDirectory = "rebuilderd";
+        WorkingDirectory = "/var/lib/rebuilderd";
+      };
+    };
+  };
+}

nixos/modules/services/misc/tandoor-recipes.nix

@@ -75,10 +75,33 @@ in
       };
     };
 
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "tandoor_recipes";
+      description = "User account under which Tandoor runs.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "tandoor_recipes";
+      description = "Group under which Tandoor runs.";
+    };
+
     package = lib.mkPackageOption pkgs "tandoor-recipes" { };
   };
 
   config = lib.mkIf cfg.enable {
+    users.users = lib.mkIf (cfg.user == "tandoor_recipes") {
+      tandoor-recipes = {
+        inherit (cfg) group;
+        isSystemUser = true;
+      };
+    };
+
+    users.groups = lib.mkIf (cfg.group == "tandoor_recipes") {
+      tandoor-recipes = { };
+    };
+
     systemd.services.tandoor-recipes = {
       description = "Tandoor Recipes server";
 
@@ -88,9 +111,8 @@ in
         '';
         Restart = "on-failure";
 
-        User = "tandoor_recipes";
-        Group = "tandoor_recipes";
-        DynamicUser = true;
+        User = cfg.user;
+        Group = cfg.group;
         StateDirectory = "tandoor-recipes";
         WorkingDirectory = env.MEDIA_ROOT;
         RuntimeDirectory = "tandoor-recipes";

nixos/tests/all-tests.nix

@@ -956,6 +956,7 @@ in {
   readarr = handleTest ./readarr.nix {};
   realm = handleTest ./realm.nix {};
   readeck = runTest ./readeck.nix;
+  rebuilderd = runTest ./rebuilderd.nix;
   redis = handleTest ./redis.nix {};
   redlib = handleTest ./redlib.nix {};
   redmine = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./redmine.nix {};

nixos/tests/freshrss/none-auth.nix

@@ -18,7 +18,7 @@ import ../make-test-python.nix (
       machine.wait_for_unit("multi-user.target")
       machine.wait_for_open_port(80)
       response = machine.succeed("curl -vvv -s http://localhost:80/i/")
-      assert '<title>Main stream · FreshRSS</title>' in response, "FreshRSS stream page didn't load successfully"
+      assert '<title> · FreshRSS</title>' in response, "FreshRSS stream page didn't load successfully"
     '';
   }
 )

nixos/tests/rasdaemon.nix

@@ -29,7 +29,7 @@ import ./make-test-python.nix (
       machine.wait_for_unit("multi-user.target")
       # confirm rasdaemon is running and has a valid database
       # some disk errors detected in qemu for some reason ¯\_(ツ)_/¯
-      machine.succeed("ras-mc-ctl --errors | tee /dev/stderr | grep -q 'No .* errors.'")
+      machine.wait_until_succeeds("ras-mc-ctl --errors | tee /dev/stderr | grep -q 'No .* errors.'")
       # confirm the supplied labels text made it into the system
       machine.succeed("grep -q 'vendor: none' /etc/ras/dimm_labels.d/labels >&2")
       machine.shutdown()

nixos/tests/rebuilderd.nix

@@ -0,0 +1,38 @@
+{ lib, ... }:
+
+{
+  name = "rebuilderd";
+
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        services.rebuilderd = {
+          enable = true;
+        };
+      };
+
+    machine_custom_config =
+      { pkgs, ... }:
+      {
+        services.rebuilderd = {
+          enable = true;
+          settings = {
+            http.bind_addr = "0.0.0.0:1234";
+          };
+        };
+      };
+  };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("rebuilderd.service")
+    machine.wait_for_open_port(8484)
+
+    machine_custom_config.start()
+    machine_custom_config.wait_for_unit("rebuilderd.service")
+    machine_custom_config.wait_for_open_port(1234)
+  '';
+
+  meta.maintainers = [ lib.maintainers.drupol ];
+}

pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "3.3.0";
-    hash = "sha256-5ZZUkI/QhD50cfgadXjqxPoi7iShd88EsH5ophHGb3s=";
+    version = "3.4.0";
+    hash = "sha256-7DRj167dEl12aUiGkodRa7Nem/hZNqPvGv35GqFdfb0=";
   };
 
   meta = {

pkgs/applications/radio/qlog/default.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qlog";
-  version = "0.42.0";
+  version = "0.42.1";
 
   src = fetchFromGitHub {
     owner = "foldynl";
     repo = "QLog";
     rev = "v${version}";
-    hash = "sha256-ZeDFhBfw6da44FRjMDXFRWE5O9M6xk1Vc+JpnrPgPFc=";
+    hash = "sha256-pCF6Q/kBPDNbCorXk77edLmc4niUeiYRrJAKfD0kfVs=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/ai/airtame/package.nix

@@ -0,0 +1,133 @@
+{
+  stdenv,
+  fetchurl,
+  autoPatchelfHook,
+  dpkg,
+  makeBinaryWrapper,
+  libgcc,
+  glib,
+  nss,
+  nspr,
+  at-spi2-atk,
+  cups,
+  libdrm,
+  gtk3,
+  pango,
+  cairo,
+  libgbm,
+  expat,
+  libxkbcommon,
+  alsa-lib,
+  libva-minimal,
+  pulseaudio,
+  libGL,
+  vulkan-loader,
+  curlWithGnuTls,
+  xorg,
+  lib,
+  libnotify,
+  libappindicator-gtk3,
+  systemd,
+  pciutils,
+}:
+let
+  xorgDeps = with xorg; [
+    libXdamage
+    libXext
+    libXfixes
+    libXcomposite
+    libXrandr
+  ];
+
+  deps = [
+    libgcc.lib
+    glib
+    nss
+    nspr
+    at-spi2-atk
+    cups
+    libdrm
+    gtk3
+    pango
+    cairo
+    libgbm
+    expat
+    libxkbcommon
+    alsa-lib
+    libva-minimal
+    pulseaudio
+    libGL
+    vulkan-loader
+    curlWithGnuTls
+  ] ++ xorgDeps;
+
+  libPath = lib.makeLibraryPath deps + ":" + lib.makeSearchPathOutput "lib" "lib64" deps;
+  binPath = lib.makeBinPath deps;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "airtame-application";
+  version = "4.12.0";
+
+  src = fetchurl {
+    url = "https://downloads.airtame.com/app/latest/linux/Airtame-${finalAttrs.version}.deb";
+    hash = "sha256-HTqJ637iPtiReFLoGdgKkpxW0UGRPvLjgMMcVV+cRfY=";
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    dpkg
+    makeBinaryWrapper
+  ];
+
+  buildInputs = deps;
+  runtimeDependencies = [
+    (lib.getLib systemd)
+    libnotify
+    libappindicator-gtk3
+    pulseaudio
+    pciutils
+  ];
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,share/Airtame}
+    mv usr/share/* $out/share
+    mv opt/Airtame/* $out/share/Airtame
+
+    # Ensure ANGLE libGLESv2.so finds libGL and libvulkan.
+    ln -sf ${lib.getLib vulkan-loader}/lib/libvulkan.so.1 $out/share/Airtame/libvulkan.so.1
+    patchelf $out/share/Airtame/lib*GL* --set-rpath ${libPath}
+
+    for elf in $out/share/Airtame/{chrome-sandbox,chrome_crashpad_handler}; do
+      patchelf $elf --set-rpath ${libPath} --set-interpreter ${stdenv.cc.bintools.dynamicLinker}
+    done
+
+    makeBinaryWrapper $out/share/Airtame/airtame-application $out/bin/airtame-application \
+      --prefix LD_LIBRARY_PATH : ${libPath} \
+      --prefix PATH : ${binPath}
+
+    # Install licenses.
+    install -m 644 -D $out/share/Airtame/LICENSE.electron.txt $out/share/licenses/airtame-application/LICENSE.electron.txt
+    install -m 644 -D $out/share/Airtame/LICENSES.chromium.html $out/share/licenses/airtame-application/LICENSES.chromium.html
+
+    # Fix the Exec path in the .desktop file.
+    sed -i "s|Exec.*$|Exec=$out/bin/airtame-application \$U|" $out/share/applications/airtame-application.desktop
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Airtame official screen streaming application";
+    homepage = "https://airtame.com";
+    downloadPage = "https://downloads.airtame.com/app/latest/linux/Airtame-${finalAttrs.version}.deb";
+    mainProgram = "airtame-application";
+    license = lib.licenses.unfree;
+    platforms = lib.platforms.linux;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    maintainers = with lib.maintainers; [ BastianAsmussen ];
+  };
+})

pkgs/by-name/am/amazon-cloudwatch-agent/package.nix

@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "amazon-cloudwatch-agent";
-  version = "1.300053.0";
+  version = "1.300052.1";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "amazon-cloudwatch-agent";
     tag = "v${version}";
-    hash = "sha256-nM/QwyYhE8QTa3wpNJ1KZ9nWJjLeBkMHufOS58OWGmE=";
+    hash = "sha256-7E5jAkX9AHlURl27PfpnSk4qauSytGx7qEbz2XV3K9w=";
   };
 
-  vendorHash = "sha256-UIwFUXEMtxPVHrioptYjslSm0qTBCyVR9OudkBR01tg=";
+  vendorHash = "sha256-EyhT1gfrd189jqcEQ97CSKziKrT2bBeQ9pWIEK039Io=";
 
   # See the list in https://github.com/aws/amazon-cloudwatch-agent/blob/v1.300049.1/Makefile#L68-L77.
   subPackages = [

pkgs/by-name/bf/bfs/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bfs";
-  version = "4.0.5";
+  version = "4.0.6";
 
   src = fetchFromGitHub {
     repo = "bfs";
     owner = "tavianator";
     rev = version;
-    hash = "sha256-vYK3lQsHE3GD8mFCZLxJN+TrJZJGwq9+kNm6y0zAa2U=";
+    hash = "sha256-TXnoy+VWkS5ilW6QEtE6vd80FaJ/nIWGaeBJ/cjvquM=";
   };
 
   buildInputs =

pkgs/by-name/co/cosmic-design-demo/package.nix

@@ -3,25 +3,20 @@
   stdenv,
   fetchFromGitHub,
   rustPlatform,
-  cmake,
   just,
-  pkg-config,
+  libcosmicAppHook,
   expat,
-  libxkbcommon,
   fontconfig,
   freetype,
-  wayland,
-  makeBinaryWrapper,
-  cosmic-icons,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage {
   pname = "cosmic-design-demo";
-  version = "unstable-2024-01-08";
+  version = "0-unstable-2024-01-08";
 
   src = fetchFromGitHub {
     owner = "pop-os";
-    repo = pname;
+    repo = "cosmic-design-demo";
     rev = "d58cfad46f2982982494fce27fb00ad834dc8992";
     hash = "sha256-nWkiaegSjxgyGlpjXE9vzGjiDORaRCSoZJMDv0jtvaA=";
   };
@@ -30,20 +25,18 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-czfDtiSEmzmcLfpqv0/8sP8zDAEKh+pkQkGXdd5NskM=";
 
   nativeBuildInputs = [
-    cmake
     just
-    pkg-config
-    makeBinaryWrapper
+    libcosmicAppHook
   ];
+
   buildInputs = [
-    libxkbcommon
     expat
     fontconfig
     freetype
-    wayland
   ];
 
   dontUseJustBuild = true;
+  dontUseJustCheck = true;
 
   justFlags = [
     "--unstable"
@@ -55,18 +48,15 @@ rustPlatform.buildRustPackage rec {
     "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-design-demo"
   ];
 
-  postInstall = ''
-    wrapProgram "$out/bin/cosmic-design-demo" \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ wayland ]}" \
-      --suffix XDG_DATA_DIRS : "${cosmic-icons}/share"
-  '';
-
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/pop-os/cosmic-design-demo";
     description = "Design Demo for the COSMIC Desktop Environment";
-    license = licenses.mpl20;
-    maintainers = with maintainers; [ nyabinary ];
-    platforms = platforms.linux;
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [
+      nyabinary
+      HeitorAugustoLN
+    ];
+    platforms = lib.platforms.linux;
     mainProgram = "cosmic-design-demo";
   };
 }

pkgs/by-name/co/cosmic-randr/package.nix

@@ -6,29 +6,32 @@
   just,
   pkg-config,
   wayland,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cosmic-randr";
-  version = "1.0.0-alpha.5.1";
+  version = "1.0.0-alpha.6";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-randr";
-    rev = "epoch-${version}";
-    hash = "sha256-mPi6TVUWKlHqLzGL84vSBZYuCjdThVVYc7hv9vq7zho=";
+    tag = "epoch-${version}";
+    hash = "sha256-Sqxe+vKonsK9MmJGtbrZHE7frfrjkHXysm0WQt7WSU4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-3I4ZyZvV9ELBNCvYVYBUHbh9bGw7B/RrwUlam5fdLxU=";
+  cargoHash = "sha256-UQ/fhjUiniVeHRQYulYko4OxcWB6UhFuxH1dVAfAzIY=";
 
   nativeBuildInputs = [
     just
     pkg-config
   ];
+
   buildInputs = [ wayland ];
 
   dontUseJustBuild = true;
+  dontUseJustCheck = true;
 
   justFlags = [
     "--set"
@@ -39,12 +42,24 @@ rustPlatform.buildRustPackage rec {
     "target/${stdenv.hostPlatform.rust.cargoShortTarget}/release/cosmic-randr"
   ];
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version"
+      "unstable"
+      "--version-regex"
+      "epoch-(.*)"
+    ];
+  };
+
+  meta = {
     homepage = "https://github.com/pop-os/cosmic-randr";
     description = "Library and utility for displaying and configuring Wayland outputs";
-    license = licenses.mpl20;
-    maintainers = with maintainers; [ nyabinary ];
-    platforms = platforms.linux;
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [
+      nyabinary
+      HeitorAugustoLN
+    ];
+    platforms = lib.platforms.linux;
     mainProgram = "cosmic-randr";
   };
 }

pkgs/by-name/du/dust/package.nix

@@ -10,13 +10,13 @@ rustPlatform.buildRustPackage rec {
   # Since then, `dust` has been freed up, allowing this package to take that attribute.
   # However in order for tools like `nix-env` to detect package updates, keep `du-dust` for pname.
   pname = "du-dust";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "bootandy";
     repo = "dust";
     rev = "v${version}";
-    hash = "sha256-oaDJLDFI193tSzUDqQI/Lvrks0FLYTMLrrwigXwJ+rY=";
+    hash = "sha256-pb7IscmC21GNYWclW95Ctz+QGinn1VqN5QEyc6j9aQA=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ED4gVlvlTKsa6ghD/m4w2HVSxATd4SNl5a6nZ3hqMn0=";
+  cargoHash = "sha256-z4T2Vb0ylL4N5drS6D408Nt/f5cxF85Saqut6qArDak=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ef/efibootmgr/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   efivar,
   nix-update-script,
   pkg-config,
@@ -21,10 +22,19 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "rhboot";
     repo = "efibootmgr";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
     hash = "sha256-DYYQGALEn2+mRHgqCJsA7OQCF7xirIgQlWexZ9uoKcg=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      # https://github.com/rhboot/efibootmgr/issues/186
+      name = "efibootmgr_fix-editing-nonfinal-entry.patch";
+      url = "https://github.com/rhboot/efibootmgr/commit/3eac27c5fccf93d2d6e634d6fe2a76d06708ec6e.diff?full_index=1";
+      hash = "sha256-zXkmfW+BYv8jc/dibu0LEni06KyydVjfW/Lug0i+jUw=";
+    })
+  ];
+
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [

pkgs/by-name/ek/eks-node-viewer/package.nix

@@ -2,22 +2,23 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
-  testers,
-  eks-node-viewer,
+  versionCheckHook,
 }:
 
 buildGoModule rec {
   pname = "eks-node-viewer";
-  version = "0.6.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-BK84hxbwZSJDO5WoyborJnVBS5pB69jTMU1csgiT0sw=";
+    tag = "v${version}";
+    hash = "sha256-KdddfixQewj30rIC1qZzyS3h/jq+RdxId9WgQPqW8nE=";
   };
 
-  vendorHash = "sha256-EJAL5jNftA/g5H6WUMBJ98EyRp7QJ1C53EKr6GRz71I=";
+  vendorHash = "sha256-yTF1PRRUlJ27ZrKO0FW4IztIE1Wo05qixTCFvETg358=";
+
+  excludedPackages = [ "hack" ];
 
   ldflags = [
     "-s"
@@ -27,17 +28,18 @@ buildGoModule rec {
     "-X=main.version=${version}"
   ];
 
-  passthru.tests = {
-    version = testers.testVersion {
-      package = eks-node-viewer;
-    };
-  };
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
 
-  meta = with lib; {
+  meta = {
     description = "Tool to visualize dynamic node usage within a cluster";
     homepage = "https://github.com/awslabs/eks-node-viewer";
     changelog = "https://github.com/awslabs/eks-node-viewer/releases/tag/${src.rev}";
-    license = licenses.asl20;
-    maintainers = [ maintainers.ivankovnatsky ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ ivankovnatsky ];
+    mainProgram = "eks-node-viewer";
   };
 }

pkgs/by-name/gi/gifsicle/package.nix

@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gifsicle";
-  version = "1.95";
+  version = "1.96";
 
   src = fetchurl {
     url = "https://www.lcdf.org/gifsicle/gifsicle-${version}.tar.gz";
-    hash = "sha256-snEWRwCf0qExMPO+FgUy7UZTjnYr/A8CDepQYYp9yVA=";
+    hash = "sha256-/SPSeWgabf48FSZOM/NEBFs7pHPaTRn0nmelCZSwd/s=";
   };
 
   buildInputs = lib.optionals gifview [

pkgs/by-name/in/influxdb3/package.nix

@@ -0,0 +1,85 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  protobuf,
+  python3,
+  rust-jemalloc-sys-unprefixed,
+  rustc,
+  makeWrapper,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage {
+  pname = "influxdb3";
+  version = "0-unstable-2025-02-17";
+  src = fetchFromGitHub {
+    owner = "influxdata";
+    repo = "influxdb";
+    rev = "8daccb7ee8f82ffae99b25236af9645fd60e448b";
+    hash = "sha256-tHnLD5W3KQ1cILRHNmXAi4lvQQSBVUPxYCXmXLMLwIs=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-KnmaIbK/2tRXjCpOLHcadIX8Od7lVDOwZ+FgE+yFE+Q=";
+
+  nativeBuildInputs = [
+    makeWrapper
+    protobuf
+    rustc.llvmPackages.lld
+  ];
+
+  buildInputs = [
+    rust-jemalloc-sys-unprefixed
+    python3
+  ];
+
+  env = {
+    GIT_HASH = "000000000000000000000000000000000000000000000000000";
+    GIT_HASH_SHORT = "0000000";
+    PYO3_PYTHON = lib.getExe python3;
+  };
+
+  postPatch = ''
+    # We provide GIT_HASH and GIT_HASH_SHORT ourselves
+    rm influxdb3_process/build.rs
+  '';
+
+  buildNoDefaultFeatures = true;
+  buildFeatures = [
+    "aws"
+    "gcp"
+    "azure"
+    "jemalloc_replacing_malloc"
+    "system-py"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/influxdb3 \
+      --set PYTHONHOME ${python3} \
+      --suffix LD_LIBRARY_PATH : ${
+        lib.makeLibraryPath [
+          rust-jemalloc-sys-unprefixed
+          python3
+        ]
+      }
+  '';
+
+  # Tests require running instance
+  doCheck = false;
+
+  passthru.updateScript = nix-update-script {
+    # Switch to "--version-regex" "v(3.*)" once the first real release tag is added
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = {
+    description = "Scalable datastore for metrics, events, and real-time analytics";
+    homepage = "https://github.com/influxdata/influxdb";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    maintainers = with lib.maintainers; [ oddlama ];
+    mainProgram = "influxdb3";
+  };
+}

pkgs/by-name/ka/kargo/package.nix

@@ -0,0 +1,74 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  kargo,
+  stdenv,
+  testers,
+  writableTmpDirAsHomeHook,
+}:
+
+buildGoModule rec {
+  pname = "kargo";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "akuity";
+    repo = "kargo";
+    tag = "v${version}";
+    hash = "sha256-GC3u4v8qrVi8+Ne08f074DvPh0RFmpmCOdJ5XD3kk+o=";
+  };
+
+  vendorHash = "sha256-Xb+9zu2uivOYETtz3ryMnBUJ3gJ/1ta1dLEpsD00jpU=";
+
+  subPackages = [ "cmd/cli" ];
+
+  ldflags =
+    let
+      package_url = "github.com/akuity/kargo/internal/version";
+    in
+    [
+      "-s"
+      "-w"
+      "-X ${package_url}.version=${version}"
+      "-X ${package_url}.buildDate=1970-01-01T00:00:00Z"
+      "-X ${package_url}.gitCommit=${src.rev}"
+      "-X ${package_url}.gitTreeState=clean"
+    ];
+
+  nativeBuildInputs = [
+    installShellFiles
+    writableTmpDirAsHomeHook
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    install -Dm755 "$GOPATH/bin/cli" -T $out/bin/kargo
+    runHook postInstall
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = kargo;
+    command = "HOME=$TMPDIR ${meta.mainProgram} version --client";
+  };
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd kargo \
+      --bash <($out/bin/kargo completion bash) \
+      --fish <($out/bin/kargo completion fish) \
+      --zsh <($out/bin/kargo completion zsh)
+  '';
+
+  meta = {
+    description = "Application lifecycle orchestration";
+    mainProgram = "kargo";
+    downloadPage = "https://github.com/akuity/kargo";
+    homepage = "https://kargo.akuity.io";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      bbigras
+    ];
+  };
+}

pkgs/by-name/oc/ocm/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "ocm";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "openshift-online";
     repo = "ocm-cli";
     rev = "v${version}";
-    sha256 = "sha256-RuGUIG58cyyWvHD/0T7xwtzFy9XJUmavkQg4MRAHQqQ=";
+    sha256 = "sha256-K/hAxzstRY0Mh7qYMqwWfIbop+AhgzvPZsrZo8eTzsQ=";
   };
 
-  vendorHash = "sha256-qkTh+tkU6MXBJkX0XwktRCMjoySe1/9uWHFGTc7ozRM=";
+  vendorHash = "sha256-RQioZq/fdqr6baTTDeLUhFh/dlByNM5Ys0L4pAYXkHI=";
 
   # Strip the final binary.
   ldflags = [

pkgs/by-name/op/opensc/package.nix

@@ -15,7 +15,6 @@
   libxslt,
   docbook_xml_dtd_412,
   darwin,
-  buildPackages,
   nix-update-script,
   withApplePCSC ? stdenv.hostPlatform.isDarwin,
 }:
@@ -34,6 +33,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     autoreconfHook
+    libxslt # xsltproc
   ];
   buildInputs =
     [
@@ -42,7 +42,6 @@ stdenv.mkDerivation rec {
       openssl
       libassuan
       libXt
-      libxslt
       libiconv
       docbook_xml_dtd_412
     ]
@@ -68,9 +67,6 @@ stdenv.mkDerivation rec {
       else
         "${lib.getLib pcsclite}/lib/libpcsclite${stdenv.hostPlatform.extensions.sharedLibrary}"
     }"
-    (lib.optionalString (
-      stdenv.hostPlatform != stdenv.buildPlatform
-    ) "XSLTPROC=${buildPackages.libxslt}/bin/xsltproc")
   ];
 
   PCSC_CFLAGS = lib.concatStringsSep " " (

pkgs/by-name/pc/pcm/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pcm";
-  version = "202409";
+  version = "202502";
 
   src = fetchFromGitHub {
     owner = "opcm";
     repo = "pcm";
     rev = version;
-    hash = "sha256-eCFyk6V1wpTImDKbsSiwgnqIduh62YG8GK0jxZL04Yc=";
+    hash = "sha256-U6V3LX+JlVL9MRFBP3xpYwPQ6Y7pnJ4F/7dpKG3Eyuw=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/pi/pixi-pack/package.nix

@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pixi-pack";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "Quantco";
     repo = "pixi-pack";
     tag = "v${version}";
-    hash = "sha256-fTQSSrmfWvyGD1+YM2I6Lly6gYwMlB/h8VRbDsvG3mU=";
+    hash = "sha256-Yf0ewDGDYpdl/tk4qvhKTbFmnGceqTJFv0bExL7N9AE=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ujrEUXQGaESNSZndBblM/4e/zl376FRdj4Hp3AA2yJA=";
+  cargoHash = "sha256-W8C3d+2KYgPwb5zyC59cdUC79W9Ho4gX4McKm/xtWjU=";
 
   buildInputs = [ openssl ];
 

pkgs/by-name/po/pot/package.nix

@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "pot-app";
     repo = "pot-desktop";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
     hash = "sha256-PUXZT1kiInM/CXUoRko/5qlrRurGpQ4ym5YMTgFwuxE=";
   };
 
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
-      --replace "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
+      --replace-fail "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
   '';
 
   pnpmDeps = pnpm.fetchDeps {
@@ -48,12 +48,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmRoot = "..";
 
-  cargoDeps = rustPlatform.importCargoLock {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      # All other crates in the same workspace reuse this hash.
-      "tauri-plugin-autostart-0.0.0" = "sha256-rWk9Qz1XmByqPRIgR+f12743uYvnEGTHno9RrxmT8JE=";
-    };
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) src;
+    sourceRoot = "${finalAttrs.src.name}/src-tauri";
+    hash = "sha256-dyXINRttgsqCfmgtZNXxr/Rl8Yn0F2AVm8v2Ao+OBsw=";
   };
 
   nativeBuildInputs = [
@@ -87,7 +85,7 @@ stdenv.mkDerivation (finalAttrs: {
             src = fetchFromGitHub {
               owner = "evanw";
               repo = "esbuild";
-              rev = "v${version}";
+              tag = "v${version}";
               hash = "sha256-FpvXWIlt67G8w3pBKZo/mcp57LunxDmRUaCU/Ne89B8=";
             };
           }

pkgs/by-name/ra/rasdaemon/package.nix

@@ -1,65 +1,56 @@
 {
-  lib,
-  stdenv,
-  fetchFromGitHub,
   autoreconfHook,
-  pkg-config,
-  glibcLocales,
-  kmod,
-  coreutils,
-  perl,
-  dmidecode,
-  hwdata,
-  sqlite,
+  fetchFromGitHub,
+  lib,
   libtraceevent,
-  fetchpatch,
+  nix-update-script,
   nixosTests,
+  perl,
+  pkg-config,
+  sqlite,
+  stdenv,
+  # Options
+  enableDmidecode ? stdenv.hostPlatform.isx86_64,
+  dmidecode,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "rasdaemon";
-  version = "0.8.0";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "mchehab";
     repo = "rasdaemon";
-    rev = "v${version}";
-    sha256 = "sha256-BX3kc629FOh5cnD6Sa/69wKdhmhT3Rpz5ZvhnD4MclQ=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-veaqAbSJvoUzkn1OLYY3t3y9Bh8dzuenpLGO2yz/yaM=";
   };
 
-  patches = [
-    (fetchpatch {
-      # fix #295002 (segfault on AMD), will be in the release after 0.8.0
-      name = "fix crash on AMD";
-      url = "https://github.com/mchehab/rasdaemon/commit/f1ea76375281001cdf4a048c1a4a24d86c6fbe48.patch";
-      hash = "sha256-1VPDTrAsvZGiGbh52EUdG6tYV/n6wUS0mphOSXzran0=";
-    })
-  ];
+  strictDeps = true;
+
+  enableParallelBuilding = true;
 
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
   ];
 
-  buildInputs = [
-    coreutils
-    glibcLocales
-    hwdata
-    kmod
-    sqlite
-    libtraceevent
-    (perl.withPackages (
-      ps: with ps; [
-        DBI
-        DBDSQLite
-      ]
-    ))
-  ] ++ lib.optionals (!stdenv.hostPlatform.isAarch64) [ dmidecode ];
+  buildInputs =
+    [
+      libtraceevent
+      (perl.withPackages (
+        ps: with ps; [
+          DBDSQLite
+        ]
+      ))
+      sqlite
+    ]
+    ++ lib.optionals enableDmidecode [
+      dmidecode
+    ];
 
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var"
-    "--with-sysconfdefdir=${placeholder "out"}/etc/sysconfig"
     "--enable-all"
   ];
 
@@ -83,9 +74,15 @@ stdenv.mkDerivation rec {
 
   # easy way out, ends up installing /nix/store/...rasdaemon/bin in $out
 
-  postConfigure = ''
-    substituteInPlace Makefile \
-      --replace '"$(DESTDIR)/etc/ras/dimm_labels.d"' '"$(prefix)/etc/ras/dimm_labels.d"'
+  postPatch = ''
+    patchShebangs contrib/
+  '';
+
+  preConfigure = ''
+    substituteInPlace Makefile.am \
+      --replace-fail '"$(DESTDIR)@sysconfdir@/ras/dimm_labels.d"' '"$(prefix)@sysconfdir@/ras/dimm_labels.d"' \
+      --replace-fail '"$(DESTDIR)@SYSCONFDEFDIR@/rasdaemon"' '"$(prefix)@SYSCONFDEFDIR@/rasdaemon"' \
+      --replace-fail '"$(DESTDIR)@sysconfdir@/ras/triggers' '"$(prefix)@sysconfdir@/ras/triggers'
   '';
 
   outputs = [
@@ -100,20 +97,16 @@ stdenv.mkDerivation rec {
     install -Dm 0755 contrib/edac-tests $inject/bin/edac-tests
   '';
 
-  postFixup =
-    ''
-      # Fix dmidecode and modprobe paths
-      substituteInPlace $out/bin/ras-mc-ctl \
-        --replace 'find_prog ("modprobe")  or exit (1)' '"${kmod}/bin/modprobe"'
-    ''
-    + lib.optionalString (!stdenv.hostPlatform.isAarch64) ''
-      substituteInPlace $out/bin/ras-mc-ctl \
-        --replace 'find_prog ("dmidecode")' '"${dmidecode}/bin/dmidecode"'
-    '';
+  postFixup = lib.optionalString enableDmidecode ''
+    substituteInPlace $out/bin/ras-mc-ctl \
+      --replace-fail 'find_prog ("dmidecode")' '"${dmidecode}/bin/dmidecode"'
+  '';
 
   passthru.tests = nixosTests.rasdaemon;
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = ''
       A Reliability, Availability and Serviceability (RAS) logging tool using EDAC kernel tracing events
     '';
@@ -125,9 +118,9 @@ stdenv.mkDerivation rec {
       drivers for other architectures like arm also exists.
     '';
     homepage = "https://github.com/mchehab/rasdaemon";
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    changelog = "https://github.com/mchehab/rasdaemon/blob/v${version}/ChangeLog";
-    maintainers = with maintainers; [ evils ];
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+    changelog = "${finalAttrs.meta.homepage}/releases/tag/v${finalAttrs.version}";
+    maintainers = with lib.maintainers; [ evils ];
   };
-}
+})

pkgs/by-name/re/rebuilderd/package.nix

@@ -0,0 +1,126 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  shared-mime-info,
+  installShellFiles,
+  scdoc,
+  bzip2,
+  openssl,
+  sqlite,
+  xz,
+  zstd,
+  stdenv,
+  darwin,
+  buildPackages,
+  versionCheckHook,
+  nixosTests,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "rebuilderd";
+  version = "0.22.1";
+
+  src = fetchFromGitHub {
+    owner = "kpcyrd";
+    repo = "rebuilderd";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-YMBq+Z9yMQRXOM3U679g2lnBZlH/h0VLjoxySxi4SCo=";
+  };
+
+  postPatch = ''
+    substituteInPlace tools/src/args.rs \
+      --replace-fail "/etc/rebuilderd-sync.conf" '${placeholder "out"}/etc/rebuilderd-sync.conf'
+
+    substituteInPlace worker/src/config.rs \
+      --replace-fail 'from("/etc/rebuilderd-worker.conf")' 'from("${placeholder "out"}/etc/rebuilderd-worker.conf")'
+
+    substituteInPlace worker/src/proc.rs \
+      --replace-fail '/bin/echo' 'echo'
+  '';
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-MjFQ5d9VWHodjj+hIsKgAIUdaiarXIi5GCS+47n5MGU=";
+
+  nativeBuildInputs = [
+    pkg-config
+    installShellFiles
+    scdoc
+  ];
+
+  buildInputs =
+    [
+      bzip2
+      openssl
+      shared-mime-info
+      sqlite
+      xz
+      zstd
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      darwin.apple_sdk.frameworks.Security
+      darwin.apple_sdk.frameworks.SystemConfiguration
+    ];
+
+  postInstall =
+    let
+      emulator = stdenv.hostPlatform.emulator buildPackages;
+    in
+    ''
+      mkdir -p $out/etc
+
+      # install config files
+      install -Dm 644 -t "$out/etc" contrib/confs/rebuilderd-sync.conf
+      install -Dm 640 -t "$out/etc" contrib/confs/rebuilderd-worker.conf contrib/confs/rebuilderd.conf
+
+      installShellCompletion --cmd rebuildctl \
+        --bash <(${emulator} $out/bin/rebuildctl completions bash) \
+        --fish <(${emulator} $out/bin/rebuildctl completions fish) \
+        --zsh <(${emulator} $out/bin/rebuildctl completions zsh)
+
+      for f in contrib/docs/*.scd; do
+        local page="contrib/docs/$(basename "$f" .scd)"
+        scdoc < "$f" > "$page"
+        installManPage "$page"
+      done
+    '';
+
+  checkFlags = [
+    # Failing tests
+    "--skip=decompress::tests::decompress_bzip2_compression"
+    "--skip=decompress::tests::decompress_gzip_compression"
+    "--skip=decompress::tests::decompress_xz_compression"
+    "--skip=decompress::tests::decompress_zstd_compression"
+    "--skip=decompress::tests::detect_bzip2_compression"
+    "--skip=decompress::tests::detect_gzip_compression"
+    "--skip=decompress::tests::detect_xz_compression"
+    "--skip=decompress::tests::detect_zstd_compression"
+    "--skip=proc::tests::hello_world"
+    "--skip=proc::tests::size_limit_kill"
+    "--skip=proc::tests::size_limit_no_kill"
+    "--skip=proc::tests::size_limit_no_kill_but_timeout"
+    "--skip=proc::tests::timeout"
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
+  passthru.tests = {
+    rebuilderd = nixosTests.rebuilderd;
+  };
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Independent verification of binary packages - reproducible builds";
+    homepage = "https://github.com/kpcyrd/rebuilderd";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "rebuilderd";
+  };
+})

pkgs/by-name/sc/sc-controller/package.nix

@@ -1,35 +1,31 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
   wrapGAppsHook3,
-  pytestCheckHook,
   gtk3,
   gobject-introspection,
   libappindicator-gtk3,
   librsvg,
-  evdev,
-  pygobject3,
-  pylibacl,
   bluez,
-  vdf,
   linuxHeaders,
   libX11,
   libXext,
   libXfixes,
   libusb1,
   udev,
+  gtk-layer-shell,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "sc-controller";
-  version = "0.4.8.21";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "C0rn3j";
-    repo = pname;
+    repo = "sc-controller";
     tag = "v${version}";
-    hash = "sha256-XakbCuwjIAXYFZxvJsAlDIJEl09pwFPT12h04onXd34=";
+    hash = "sha256-Zxzka9zM9u7AJxrqh8011plP/HgQK61e6ejKksYfPz0=";
   };
 
   nativeBuildInputs = [
@@ -43,14 +39,27 @@ buildPythonApplication rec {
     librsvg
   ];
 
-  propagatedBuildInputs = [
-    evdev
-    pygobject3
-    pylibacl
-    vdf
+  dependencies =
+    with python3Packages;
+    [
+      evdev
+      pygobject3
+      pylibacl
+      vdf
+      ioctl-opt
+    ]
+    ++ [
+      gtk-layer-shell
+      python3Packages.libusb1
+    ];
+
+  nativeCheckInputs = [
+    python3Packages.pytestCheckHook
+    python3Packages.libusb1
+    python3Packages.toml
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  patches = [ ./scc_osd_keyboard.patch ];
 
   postPatch = ''
     substituteInPlace scc/paths.py --replace sys.prefix "'$out'"
@@ -80,13 +89,13 @@ buildPythonApplication rec {
     )
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/C0rn3j/sc-controller";
     # donations: https://www.patreon.com/kozec
     description = "User-mode driver and GUI for Steam Controller and other controllers";
-    license = licenses.gpl2Only;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
       orivej
       rnhmjoj
     ];

pkgs/by-name/sc/sc-controller/scc_osd_keyboard.patch

@@ -0,0 +1,21 @@
+diff --git a/scc/bin/scc_osd_keyboard.py b/scc/bin/scc_osd_keyboard.py
+index 832d6e0..29e0cda 100755
+--- a/scc/bin/scc_osd_keyboard.py
++++ b/scc/bin/scc_osd_keyboard.py
+@@ -5,7 +5,7 @@ def sigint(*a):
+ 	print("\n*break*")
+ 	sys.exit(0)
+ 
+-if __name__ == "__main__":
++def main():
+ 	signal.signal(signal.SIGINT, sigint)
+ 
+ 	import gi
+@@ -23,3 +23,6 @@ if __name__ == "__main__":
+ 		sys.exit(1)
+ 	k.run()
+ 	sys.exit(k.get_exit_code())
++
++if __name__ == "__main__":
++	main()
+

pkgs/by-name/sk/skeema/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "skeema";
-  version = "1.12.2";
+  version = "1.12.3";
 
   src = fetchFromGitHub {
     owner = "skeema";
     repo = "skeema";
     rev = "v${version}";
-    hash = "sha256-3oI/bedw2bCh8cNVO+V0CkpwwKiCc/nkVLwUaNWIckY=";
+    hash = "sha256-3sxUy/TkacuRN8UDGgrvkdUQi//6VufoYoVFN1+X3BM=";
   };
 
   vendorHash = null;

pkgs/by-name/su/super-productivity/package.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "super-productivity";
-  version = "10.0.11";
+  version = "11.1.2";
 
   src = fetchurl {
-    url = "https://github.com/johannesjo/super-productivity/releases/download/v${version}/superProductivity-${version}.AppImage";
-    sha256 = "sha256-sYHfzqP/Vla0DEReVjaPvo8fe1wNdZnNDhefqPrPFPE=";
+    url = "https://github.com/johannesjo/super-productivity/releases/download/v${version}/superProductivity-x86_64.AppImage";
+    sha256 = "sha256-AtN7x0Vt0wWxNoXwRc78drFE8UfMpssFBYZ83w1QgbU=";
     name = "${pname}-${version}.AppImage";
   };
 

pkgs/by-name/wi/windsurf/info.json

@@ -1,20 +1,20 @@
 {
   "aarch64-darwin": {
-    "version": "1.3.4",
+    "version": "1.3.9",
     "vscodeVersion": "1.94.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/ff5014a12e72ceb812f9e7f61876befac66725e5/Windsurf-darwin-arm64-1.3.4.zip",
-    "sha256": "3873c50e09500fe43ee78fe6c63b86311d4ea689173bc2660239466b3f2e4fa4"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/43976ecab7354ba352849517e15779fe8a4eff88/Windsurf-darwin-arm64-1.3.9.zip",
+    "sha256": "1f6c3b1f1fd1a634ad90b523a892989fe18b1b95aa7cea074070bff4b792c2e5"
   },
   "x86_64-darwin": {
-    "version": "1.3.4",
+    "version": "1.3.9",
     "vscodeVersion": "1.94.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/ff5014a12e72ceb812f9e7f61876befac66725e5/Windsurf-darwin-x64-1.3.4.zip",
-    "sha256": "2534839a0e026316cb4fd98b128c44d4c6cf938f47be9a5e7e67457d2f8bf61b"
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/43976ecab7354ba352849517e15779fe8a4eff88/Windsurf-darwin-x64-1.3.9.zip",
+    "sha256": "3388e05e2cf3835fe2a1c9442cb2cf7fa5c6abdbc4e36af9af56fa8a64132364"
   },
   "x86_64-linux": {
-    "version": "1.3.4",
+    "version": "1.3.9",
     "vscodeVersion": "1.94.0",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/ff5014a12e72ceb812f9e7f61876befac66725e5/Windsurf-linux-x64-1.3.4.tar.gz",
-    "sha256": "6dcf686038c6587410b25dd041a748a59593164b6c3ffb31935abef1325bfa8c"
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/43976ecab7354ba352849517e15779fe8a4eff88/Windsurf-linux-x64-1.3.9.tar.gz",
+    "sha256": "0228099a39128cb21b1cd87516d74ac1bfaa1dd801f47feb3a67b1dbef7365c7"
   }
 }

pkgs/development/coq-modules/extructures/default.nix

@@ -75,5 +75,6 @@
   (o: {
     propagatedBuildInputs =
       o.propagatedBuildInputs
-      ++ lib.optional (lib.versionAtLeast o.version "0.3.0") deriving;
+      ++ lib.optional (lib.versionAtLeast o.version "0.3.0"
+                       || o.version == "dev") deriving;
   })

pkgs/development/php-packages/grumphp/default.nix

@@ -6,16 +6,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "grumphp";
-  version = "2.10.0";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = "phpro";
     repo = "grumphp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-cgrQ8cBe6pQVofcJK1l2Vylt1SESwy0pvW7BIFS6uuM=";
+    hash = "sha256-JRLx9laFdtHSwyUmnAQY4Rcaac6buhbA2vfBCIAzk04=";
   };
 
-  vendorHash = "sha256-lzrPVkklU8NOhq4G2bJLLv8IxcSma6jx4hEvCr0ufuA=";
+  vendorHash = "sha256-ptRWX0W0UylsaDjpjdaYq+KBx9aAxYzKGeI44lby+OY=";
 
   meta = {
     changelog = "https://github.com/phpro/grumphp/releases/tag/v${finalAttrs.version}";

pkgs/development/php-packages/phpstan/default.nix

@@ -6,16 +6,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "phpstan";
-  version = "2.1.5";
+  version = "2.1.6";
 
   src = fetchFromGitHub {
     owner = "phpstan";
     repo = "phpstan-src";
     tag = finalAttrs.version;
-    hash = "sha256-mhptuyX3tp0ABo8MEp+jL+P7jV6BiQhNPaxVlWggfjs=";
+    hash = "sha256-kcZeiC92jw9mwmxrni32aPrSDH67UVm6QnT7n5GvG7w=";
   };
 
-  vendorHash = "sha256-WILu0qPmN4O6qiu9CF1R6Y2N8fNbdqWBbbS6lwdzo7k=";
+  vendorHash = "sha256-HmD/A4NRkkRj66Q1XAAoKRKnWQFc+iWlvCH9+3CVyFs=";
   composerStrictValidation = false;
 
   meta = {

pkgs/development/php-packages/tideways/default.nix

@@ -23,7 +23,7 @@ in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tideways-php";
   extensionName = "tideways";
-  version = "5.17.2";
+  version = "5.18.2";
 
   src =
     finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system}
@@ -43,15 +43,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://s3-eu-west-1.amazonaws.com/tideways/extension/${finalAttrs.version}/tideways-php-${finalAttrs.version}-x86_64.tar.gz";
-        hash = "sha256-Uo9GWpT3TV2+NCaAaFeWwcoyya4ZMrhOOMI5PtJ5WEo=";
+        hash = "sha256-JThRW4ghBy2NXe2hNP2Q1VHbocrYmZi7wMTdWYX8QTo=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://s3-eu-west-1.amazonaws.com/tideways/extension/${finalAttrs.version}/tideways-php-${finalAttrs.version}-arm64.tar.gz";
-        hash = "sha256-p1ng6v2GkoqoH3WuGT3d/ZqD6lbpqS4PIlq9Fodpkog=";
+        hash = "sha256-hz5lzjsfFT61fBFyMlV9ZB99S4jYokzN0lLtxm3G9gc=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://s3-eu-west-1.amazonaws.com/tideways/extension/${finalAttrs.version}/tideways-php-${finalAttrs.version}-macos-arm.tar.gz";
-        hash = "sha256-T43HwPKB5LOqR7wA1Gw5eTzIEc5kmn+uGZik1b6dwB4=";
+        hash = "sha256-BmmoHQE0gL1dDhS+WpmAIkEuIOb/EPLT4RMMLkkeMvw=";
       };
     };
 

pkgs/development/python-modules/ioctl-opt/default.nix

@@ -0,0 +1,30 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "ioctl-opt";
+  version = "1.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "vpelletier";
+    repo = "python-ioctl-opt";
+    tag = version;
+    hash = "sha256-OPQmJUrZIFPdoKitlqWvgMHkLSK2nC01Yy7UpGy+aP8=";
+  };
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "ioctl_opt" ];
+
+  meta = {
+    description = "Pythonified linux asm-generic/ioctl.h";
+    homepage = "https://github.com/vpelletier/python-ioctl-opt";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ rnhmjoj ];
+  };
+}

pkgs/development/python-modules/pystac/default.nix

@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "pystac";
-  version = "1.12.1";
+  version = "1.12.2";
   pyproject = true;
   disabled = pythonOlder "3.9";
 
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "stac-utils";
     repo = "pystac";
     tag = "v${version}";
-    hash = "sha256-VTpkQdPydKUb/FGZhfFM/2IDUbsVz903q6s5MxLRlYM=";
+    hash = "sha256-Cz9VyHIAfeRvK+az1ETVrTXvBh/VpkgmtERElfgAdBo=";
   };
 
   build-system = [ setuptools ];

pkgs/development/web/nodejs/v23.nix

@@ -16,8 +16,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "23.8.0";
-  sha256 = "6ec5d54d0e8423fc5986f6efa4f661e8370659818b14f458cdc9d1b9f75d3b88";
+  version = "23.9.0";
+  sha256 = "c6b420bedbb049a6538c33af28abaf89011ccc879f0f0f81791675263c238f97";
   patches =
     [
       ./configure-emulator.patch

pkgs/games/shattered-pixel-dungeon/default.nix

@@ -6,13 +6,13 @@
 
 callPackage ./generic.nix rec {
   pname = "shattered-pixel-dungeon";
-  version = "2.5.4";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "00-Evan";
     repo = "shattered-pixel-dungeon";
     rev = "v${version}";
-    hash = "sha256-I8DO0HwMfuIwgraX8Q8Ns4ynQMV0aFsAoXCG7EbltPs=";
+    hash = "sha256-6t6ernRLKFQS57wzLERnx9QDA0pxRzj35n0vhR//WyA=";
   };
 
   depsPath = ./deps.json;

pkgs/os-specific/linux/kernel/kernels-org.json

@@ -20,19 +20,19 @@
         "hash": "sha256:0mm4q8f6kbqddy4zaxjf5xyqpnla5qprvsf7v3vq01gmlzr3rivc"
     },
     "6.6": {
-        "version": "6.6.79",
-        "hash": "sha256:13gyklpaxil0dc08pxrq4hpxi7crb81f70qnmacs188d8w2gk9h7"
+        "version": "6.6.80",
+        "hash": "sha256:09qkadl9fm0c589qyjdwhgryr85xampz0k7lsafmrx142g813ybc"
     },
     "6.11": {
         "version": "6.11.11",
         "hash": "sha256:1z2913y38clnlmhvwj49h7p4pic24s4d8np7nmd4lk7m2xz8w532"
     },
     "6.12": {
-        "version": "6.12.16",
-        "hash": "sha256:1i3xkprqsd3yqbai1pbgrszcg6ycy5rwpblzzw5m4lagd4m3d0az"
+        "version": "6.12.17",
+        "hash": "sha256:1cv3vrvwsj4ldbq7f9ccmal9as2ziw0cn8g3fd4lx5w09z9mq82w"
     },
     "6.13": {
-        "version": "6.13.4",
-        "hash": "sha256:17ikc4yvjj36s2pjbk58pq0hx96gri6hilc4bb7fjcdwxz40n3mq"
+        "version": "6.13.5",
+        "hash": "sha256:1qp6aprkkf2iwlhg2czd2msyqc728ab1vyr2v1nw3yzkhh3wngi8"
     }
 }

pkgs/servers/web-apps/freshrss/default.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "FreshRSS";
-  version = "1.25.0";
+  version = "1.26.0";
 
   src = fetchFromGitHub {
     owner = "FreshRSS";
     repo = "FreshRSS";
     rev = version;
-    hash = "sha256-jBIU8xxXsl/67sebo8MS59Q0dWBTe0tO+xpVf1/uo0c=";
+    hash = "sha256-J3YYx2enB8NHxgWUcJHStd5LkGRIB6dx3avbjhyIs3Q=";
   };
 
   postPatch = ''

pkgs/tools/audio/beets/common.nix

@@ -1,13 +1,16 @@
 {
   lib,
+  stdenv,
   src,
   version,
+  fetchpatch,
   bashInteractive,
   diffPlugins,
   gobject-introspection,
   gst_all_1,
   python3Packages,
   sphinxHook,
+  writableTmpDirAsHomeHook,
   runtimeShell,
   writeScript,
 
@@ -78,7 +81,19 @@ python3Packages.buildPythonApplication {
   inherit src version;
   pyproject = true;
 
-  patches = extraPatches;
+  patches = [
+    (fetchpatch {
+      # Already on master. TODO: remove when updating to the next release
+      # Issue: https://github.com/beetbox/beets/issues/5527
+      # PR: https://github.com/beetbox/beets/pull/5650
+      name = "fix-im-backend";
+      url = "https://github.com/beetbox/beets/commit/1f938674015ee71431fe9bd97c2214f58473efd2.patch";
+      hash = "sha256-koCYeiUhk1ifo6CptOSu3p7Nz0FFUeiuArTknM/tpVQ=";
+      excludes = [
+        "docs/changelog.rst"
+      ];
+    })
+  ] ++ extraPatches;
 
   build-system = [
     python3Packages.poetry-core
@@ -145,14 +160,26 @@ python3Packages.buildPythonApplication {
       rarfile
       responses
     ]
+    ++ [
+      writableTmpDirAsHomeHook
+    ]
     ++ pluginWrapperBins;
 
   __darwinAllowLocalNetworking = true;
 
-  disabledTestPaths = disabledTestPaths ++ [
-    # touches network
-    "test/plugins/test_aura.py"
-  ];
+  disabledTestPaths =
+    disabledTestPaths
+    ++ [
+      # touches network
+      "test/plugins/test_aura.py"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # Flaky: several tests fail randomly with:
+      # if not self._poll(timeout):
+      #   raise Empty
+      #   _queue.Empty
+      "test/plugins/test_player.py"
+    ];
   disabledTests = disabledTests ++ [
     # beets.ui.UserError: unknown command 'autobpm'
     "test/plugins/test_autobpm.py::TestAutoBPMPlugin::test_import"
@@ -170,8 +197,7 @@ python3Packages.buildPythonApplication {
       | sort -u > plugins_available
     ${diffPlugins (attrNames builtinPlugins) "plugins_available"}
 
-    export BEETS_TEST_SHELL="${bashInteractive}/bin/bash --norc"
-    export HOME="$(mktemp -d)"
+    export BEETS_TEST_SHELL="${lib.getExe bashInteractive} --norc"
 
     env EDITOR="${writeScript "beetconfig.sh" ''
       #!${runtimeShell}

pkgs/tools/audio/beets/default.nix

@@ -38,7 +38,7 @@ lib.makeExtensible (self: {
     src = fetchFromGitHub {
       owner = "beetbox";
       repo = "beets";
-      rev = "v${version}";
+      tag = "v${version}";
       hash = "sha256-jhwXRgUUQJgQ/PLwvY1UfHCJ9UC8DcdBpE/janao0RM=";
     };
   };

pkgs/tools/audio/beets/plugins/alternatives.nix

@@ -3,38 +3,51 @@
   fetchFromGitHub,
   beets,
   python3Packages,
+  writableTmpDirAsHomeHook,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "beets-alternatives";
-  version = "0.13.0";
+  version = "0.13.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     repo = "beets-alternatives";
     owner = "geigerzaehler";
-    rev = "refs/tags/v${version}";
-    sha256 = "sha256-i67Bzdh84TuVwcgwo5SgHFp1W04KF3VA6cbrFz82je0=";
+    tag = "v${version}";
+    hash = "sha256-+LvQC7hYtbJeWJiDEKtSFZaEtnuXZ+4mI75rrX9Sd64=";
   };
 
   nativeBuildInputs = [
     beets
+  ];
+
+  dependencies = [
     python3Packages.poetry-core
   ];
 
-  nativeCheckInputs = with python3Packages; [
-    pytestCheckHook
-    pytest-cov
-    mock
-    typeguard
+  nativeCheckInputs =
+    with python3Packages;
+    [
+      pytestCheckHook
+      pytest-cov-stub
+      mock
+      typeguard
+    ]
+    ++ [
+      writableTmpDirAsHomeHook
+    ];
+
+  disabledTests = [
+    # ValueError: too many values to unpack (expected 2)
+    # https://github.com/geigerzaehler/beets-alternatives/issues/122
+    "test_embed_art"
   ];
-  preCheck = ''
-    export HOME=$(mktemp -d)
-  '';
 
   meta = {
     description = "Beets plugin to manage external files";
     homepage = "https://github.com/geigerzaehler/beets-alternatives";
+    changelog = "https://github.com/geigerzaehler/beets-alternatives/blob/v${version}/CHANGELOG.md";
     maintainers = with lib.maintainers; [
       aszlig
       lovesegfault

pkgs/tools/filesystems/ceph/default.nix

@@ -174,6 +174,7 @@ let
       johanot
       krav
       nh2
+      benaryorg
     ];
     platforms = [
       "x86_64-linux"

pkgs/tools/graphics/directx-shader-compiler/default.nix

@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "directx-shader-compiler";
-  version = "1.8.2407";
+  version = "1.8.2502";
 
   # Put headers in dev, there are lot of them which aren't necessary for
   # using the compiler binary.
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "microsoft";
     repo = "DirectXShaderCompiler";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-7quRcuY3SAuGuS4Slz476WxJ7GHMjJmT2Jmb8kdmsI8=";
+    hash = "sha256-O2kmUudZyga1VxhCReessRDlgi5edU6nvwvyr72cU3c=";
     fetchSubmodules = true;
   };
 

pkgs/top-level/aliases.nix

@@ -706,7 +706,6 @@ mapAliases {
   kube3d = k3d; # Added 2022-0705
   kafkacat = throw "'kafkacat' has been renamed to/replaced by 'kcat'"; # Converted to throw 2024-10-17
   kak-lsp = kakoune-lsp; # Added 2024-04-01
-  kargo = throw "kargo was removed as it is deprecated upstream and depends on the removed boto package"; # Added 2024-09-22
   kdbplus = throw "'kdbplus' has been removed from nixpkgs"; # Added 2024-05-06
   kdeconnect = throw "'kdeconnect' has been renamed to/replaced by 'plasma5Packages.kdeconnect-kde'"; # Converted to throw 2024-10-17
   keepkey_agent = keepkey-agent; # added 2024-01-06

pkgs/top-level/all-packages.nix

@@ -17823,10 +17823,6 @@ with pkgs;
 
   sane-frontends = callPackage ../applications/graphics/sane/frontends.nix { };
 
-  sc-controller = python3Packages.callPackage ../misc/drivers/sc-controller {
-    inherit libusb1; # Shadow python.pkgs.libusb1.
-  };
-
   slock = callPackage ../misc/screensavers/slock {
     conf = config.slock.conf or null;
   };

pkgs/top-level/python-packages.nix

@@ -6492,6 +6492,8 @@ self: super: with self; {
 
   iocextract = callPackage ../development/python-modules/iocextract { };
 
+  ioctl-opt = callPackage ../development/python-modules/ioctl-opt { };
+
   ionhash = callPackage ../development/python-modules/ionhash { };
 
   ionoscloud = callPackage ../development/python-modules/ionoscloud { };