Merge e4b54494cb into haskell-updates

.git-blame-ignore-revs

@@ -291,3 +291,7 @@ b4532efe93882ae2e3fc579929a42a5a56544146
 
 # systemd: nixfmt
 b1c5cd3e794cdf89daa5e4f0086274a416a1cded
+
+#nixos/nextcloud: remove with lib usage
+b6088b0d8e13e8d18464d78935f0130052784658
+f7611cad5154a9096faa26d156a4079577bfae17

.github/workflows/backport.yml

@@ -34,6 +34,7 @@ jobs:
           private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
           permission-contents: write
           permission-pull-requests: write
+          permission-workflows: write
 
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:

.github/workflows/check.yml

@@ -38,7 +38,7 @@ jobs:
     permissions:
       pull-requests: write
     runs-on: ubuntu-24.04-arm
-    timeout-minutes: 3
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:

.github/workflows/eval.yml

@@ -11,6 +11,10 @@ on:
       systems:
         required: true
         type: string
+      testVersions:
+        required: false
+        default: false
+        type: boolean
     secrets:
       OWNER_APP_PRIVATE_KEY:
         required: false
@@ -22,13 +26,49 @@ defaults:
     shell: bash
 
 jobs:
+  versions:
+    if: inputs.testVersions
+    runs-on: ubuntu-24.04-arm
+    outputs:
+      versions: ${{ steps.versions.outputs.versions }}
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          path: trusted
+          sparse-checkout: |
+            ci/supportedVersions.nix
+
+      - name: Check out the PR at the test merge commit
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          ref: ${{ inputs.mergedSha }}
+          path: untrusted
+          sparse-checkout: |
+            ci/pinned.json
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
+
+      - name: Load supported versions
+        id: versions
+        run: |
+          echo "versions=$(trusted/ci/supportedVersions.nix --arg pinnedJson untrusted/ci/pinned.json)" >> "$GITHUB_OUTPUT"
+
   eval:
     runs-on: ubuntu-24.04-arm
+    needs: versions
+    if: ${{ !cancelled() && !failure() }}
     strategy:
       fail-fast: false
       matrix:
         system: ${{ fromJSON(inputs.systems) }}
-    name: ${{ matrix.system }}
+        version:
+          - "" # Default Eval triggering rebuild labels and such.
+          - ${{ fromJSON(needs.versions.outputs.versions || '[]') }} # Only for ci/pinned.json updates.
+    # Failures for versioned Evals will be collected in a separate job below
+    # to not interrupt main Eval's compare step.
+    continue-on-error: ${{ matrix.version != '' }}
+    name: ${{ matrix.system }}${{ matrix.version && format(' @ {0}', matrix.version) || '' }}
     outputs:
       targetRunId: ${{ steps.targetRunId.outputs.targetRunId }}
     timeout-minutes: 15
@@ -60,17 +100,19 @@ jobs:
       - name: Evaluate the ${{ matrix.system }} output paths for all derivation attributes
         env:
           MATRIX_SYSTEM: ${{ matrix.system }}
+          MATRIX_VERSION: ${{ matrix.version || 'nixVersions.latest' }}
         run: |
           nix-build untrusted/ci --arg nixpkgs ./pinned  -A eval.singleSystem \
             --argstr evalSystem "$MATRIX_SYSTEM" \
             --arg chunkSize 8000 \
+            --argstr nixPath "$MATRIX_VERSION" \
             --out-link merged
           # If it uses too much memory, slightly decrease chunkSize
 
       - name: Upload the output paths and eval stats
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: merged-${{ matrix.system }}
+          name: ${{ matrix.version && format('{0}-', matrix.version) || '' }}merged-${{ matrix.system }}
           path: merged/*
 
       - name: Log current API rate limits
@@ -125,7 +167,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: gh api /rate_limit | jq
 
-      - uses: actions/download-artifact@v5
+      - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         if: steps.targetRunId.outputs.targetRunId
         with:
           run-id: ${{ steps.targetRunId.outputs.targetRunId }}
@@ -149,13 +191,13 @@ jobs:
         if: steps.targetRunId.outputs.targetRunId
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: diff-${{ matrix.system }}
+          name: ${{ matrix.version && format('{0}-', matrix.version) || '' }}diff-${{ matrix.system }}
           path: diff/*
 
   compare:
     runs-on: ubuntu-24.04-arm
     needs: [eval]
-    if: needs.eval.outputs.targetRunId
+    if: needs.eval.outputs.targetRunId && !cancelled() && !failure()
     permissions:
       statuses: write
     timeout-minutes: 5
@@ -171,7 +213,7 @@ jobs:
           pinnedFrom: trusted
 
       - name: Download output paths and eval stats for all systems
-        uses: actions/download-artifact@de96f4613b77ec03b5cf633e7c350c32bd3c5660 # v4.1.8
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           pattern: diff-*
           path: diff
@@ -240,6 +282,91 @@ jobs:
               target_url
             })
 
+  # Creates a matrix of Eval performance for various versions and systems.
+  report:
+    runs-on: ubuntu-24.04-arm
+    needs: [versions, eval]
+    steps:
+      - name: Download output paths and eval stats for all versions
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          pattern: "*-diff-*"
+          path: versions
+
+      - name: Add version comparison table to job summary
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        env:
+          SYSTEMS: ${{ inputs.systems }}
+          VERSIONS: ${{ needs.versions.outputs.versions }}
+        with:
+          script: |
+            const { readFileSync } = require('node:fs')
+            const path = require('node:path')
+
+            const systems = JSON.parse(process.env.SYSTEMS)
+            const versions = JSON.parse(process.env.VERSIONS)
+
+            core.summary.addHeading('Lix/Nix version comparison')
+            core.summary.addTable(
+              [].concat(
+                [
+                  [{ data: 'Version', header: true }].concat(
+                    systems.map((system) => ({ data: system, header: true })),
+                  ),
+                ],
+                versions.map((version) =>
+                  [{ data: version }].concat(
+                    systems.map((system) => {
+                      try {
+                        const artifact = path.join('versions', `${version}-diff-${system}`)
+                        const time = Math.round(
+                          parseFloat(
+                            readFileSync(
+                              path.join(artifact, 'after', system, 'total-time'),
+                              'utf-8',
+                            ),
+                          ),
+                        )
+                        const diff = JSON.parse(
+                          readFileSync(path.join(artifact, system, 'diff.json'), 'utf-8'),
+                        )
+                        const attrs = [].concat(
+                          diff.added,
+                          diff.removed,
+                          diff.changed,
+                          diff.rebuilds
+                        ).filter(attr =>
+                          // Exceptions related to dev shells, which changed at some time between 2.18 and 2.24.
+                          !attr.startsWith('tests.devShellTools.nixos.') &&
+                          !attr.startsWith('tests.devShellTools.unstructuredDerivationInputEnv.')
+                        )
+                        if (attrs.length > 0) {
+                          core.setFailed(
+                            `${version} on ${system} has changed outpaths!\nNote: Please make sure to update ci/pinned.json separately from changes to other packages.`,
+                          )
+                          return { data: ':x:' }
+                        }
+                        return { data: time }
+                      } catch {
+                        core.warning(`${version} on ${system} did not produce artifact.`)
+                        return { data: ':warning:' }
+                      }
+                    }),
+                  ),
+                ),
+              ),
+            )
+            core.summary.addRaw(
+              '\n*Evaluation time in seconds without downloading dependencies.*',
+              true,
+            )
+            core.summary.addRaw('\n*:warning: Job did not report a result.*', true)
+            core.summary.addRaw(
+              '\n*:x: Job produced different outpaths than the target branch.*',
+              true,
+            )
+            core.summary.write()
+
   misc:
     if: ${{ github.event_name != 'push' }}
     runs-on: ubuntu-24.04-arm

.github/workflows/pr.yml

@@ -28,6 +28,7 @@ jobs:
       mergedSha: ${{ steps.get-merge-commit.outputs.mergedSha }}
       targetSha: ${{ steps.get-merge-commit.outputs.targetSha }}
       systems: ${{ steps.systems.outputs.systems }}
+      touched: ${{ steps.files.outputs.touched }}
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
@@ -64,6 +65,20 @@ jobs:
             core.setOutput('head', headClassification)
             core.info('head classification:', headClassification)
 
+      - name: Determine changed files
+        id: files
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            const files = (await github.paginate(github.rest.pulls.listFiles, {
+              ...context.repo,
+              pull_number: context.payload.pull_request.number,
+              per_page: 100,
+            })).map(file => file.filename)
+
+            if (files.includes('ci/pinned.json')) core.setOutput('touched', ['pinned'])
+            else core.setOutput('touched', [])
+
   check:
     name: Check
     needs: [prepare]
@@ -96,6 +111,7 @@ jobs:
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
       targetSha: ${{ needs.prepare.outputs.targetSha }}
       systems: ${{ needs.prepare.outputs.systems }}
+      testVersions: ${{ contains(fromJSON(needs.prepare.outputs.touched), 'pinned') && !contains(fromJSON(needs.prepare.outputs.headBranch).type, 'development') }}
 
   labels:
     name: Labels
@@ -144,7 +160,11 @@ jobs:
     # Do NOT change the name of this job, otherwise the rule will not catch it anymore.
     # This would prevent all PRs from merging.
     name: no PR failures
-    if: ${{ failure() }}
+    # A single job is "cancelled" when it hits its timeout. This is not the same
+    # as "skipped", which happens when the `if` condition doesn't apply.
+    # The "cancelled()" function only checks the whole workflow, but not individual
+    # jobs.
+    if: ${{ failure() || contains(needs.*.result, 'cancelled') }}
     runs-on: ubuntu-24.04-arm
     steps:
       - run: exit 1

.github/workflows/reviewers.yml

@@ -96,7 +96,7 @@ jobs:
         run: gh api /rate_limit | jq
 
       - name: Download the comparison results
-        uses: actions/download-artifact@de96f4613b77ec03b5cf633e7c350c32bd3c5660 # v4.1.8
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           run-id: ${{ steps.eval.outputs.run-id }}
           github-token: ${{ github.token }}

ci/default.nix

@@ -5,6 +5,7 @@ in
   system ? builtins.currentSystem,
 
   nixpkgs ? null,
+  nixPath ? "nixVersions.latest",
 }:
 let
   nixpkgs' =
@@ -16,13 +17,7 @@ let
     else
       nixpkgs;
 
-  pkgs = import nixpkgs' {
-    inherit system;
-    config = {
-      permittedInsecurePackages = [ "nix-2.3.18" ];
-    };
-    overlays = [ ];
-  };
+  pkgs = import nixpkgs' { inherit system; };
 
   fmt =
     let
@@ -115,7 +110,7 @@ rec {
   # (nixVersions.stable and Lix) here somehow at some point to ensure we don't
   # have eval divergence.
   eval = pkgs.callPackage ./eval {
-    nix = pkgs.nixVersions.latest;
+    nix = pkgs.lib.getAttrFromPath (pkgs.lib.splitString "." nixPath) pkgs;
   };
 
   # CI jobs
@@ -127,8 +122,7 @@ rec {
   parse = pkgs.lib.recurseIntoAttrs {
     latest = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.latest; };
     lix = pkgs.callPackage ./parse.nix { nix = pkgs.lix; };
-    # TODO: Raise nixVersions.minimum to 2.24 and flip back to it.
-    minimum = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.nix_2_24; };
+    nix_2_24 = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.nix_2_24; };
   };
   shell = import ../shell.nix { inherit nixpkgs system; };
   tarball = import ../pkgs/top-level/make-tarball.nix {

ci/eval/compare/default.nix

@@ -146,6 +146,12 @@ runCommand "compare"
 
     cp ${changed-paths} $out/changed-paths.json
 
+    {
+      echo
+      echo "# Packages"
+      echo
+      jq -r -f ${./generate-step-summary.jq} < ${changed-paths}
+    } >> $out/step-summary.md
 
     if jq -e '(.attrdiff.added | length == 0) and (.attrdiff.removed | length == 0)' "${changed-paths}" > /dev/null; then
       # Chunks have changed between revisions
@@ -175,12 +181,5 @@ runCommand "compare"
       } >> $out/step-summary.md
     fi
 
-    {
-      echo
-      echo "# Packages"
-      echo
-      jq -r -f ${./generate-step-summary.jq} < ${changed-paths}
-    } >> $out/step-summary.md
-
     cp "$maintainersPath" "$out/maintainers.json"
   ''

ci/pinned.json

@@ -9,9 +9,9 @@
       },
       "branch": "nixpkgs-unstable",
       "submodules": false,
-      "revision": "6a489c9482ca676ce23c0bcd7f2e1795383325fa",
-      "url": "https://github.com/NixOS/nixpkgs/archive/6a489c9482ca676ce23c0bcd7f2e1795383325fa.tar.gz",
-      "hash": "0vsvkhy3gb8yzq62vazhmpqixssmd4xinnll7w73l4vrqd611wlf"
+      "revision": "641d909c4a7538f1539da9240dedb1755c907e40",
+      "url": "https://github.com/NixOS/nixpkgs/archive/641d909c4a7538f1539da9240dedb1755c907e40.tar.gz",
+      "hash": "10hpb1aw884k3zzcy1mhf47dqvfagiyx7kr6hg0p5xcwg04mkx8x"
     },
     "treefmt-nix": {
       "type": "Git",
@@ -22,9 +22,9 @@
       },
       "branch": "main",
       "submodules": false,
-      "revision": "58bd4da459f0a39e506847109a2a5cfceb837796",
-      "url": "https://github.com/numtide/treefmt-nix/archive/58bd4da459f0a39e506847109a2a5cfceb837796.tar.gz",
-      "hash": "01bg9b4xzlv6s5q1q78vib6l2csw02b3rk5bm5yj4gx2sk2hvmrq"
+      "revision": "7d81f6fb2e19bf84f1c65135d1060d829fae2408",
+      "url": "https://github.com/numtide/treefmt-nix/archive/7d81f6fb2e19bf84f1c65135d1060d829fae2408.tar.gz",
+      "hash": "1cg20q8ja8k2nb7mzy95hgmd8whxapc3fbyndh1ip5dr6d1grxfs"
     }
   },
   "version": 5

ci/supportedVersions.nix

@@ -0,0 +1,32 @@
+#!/usr/bin/env -S nix-instantiate --eval --strict --json --arg unused true
+# Unused argument to trigger nix-instantiate calling this function with the default arguments.
+{
+  pinnedJson ? ./pinned.json,
+}:
+let
+  pinned = (builtins.fromJSON (builtins.readFile pinnedJson)).pins;
+  nixpkgs = fetchTarball {
+    inherit (pinned.nixpkgs) url;
+    sha256 = pinned.nixpkgs.hash;
+  };
+  pkgs = import nixpkgs {
+    config.allowAliases = false;
+  };
+
+  inherit (pkgs) lib;
+
+  lix = lib.pipe pkgs.lixPackageSets [
+    (lib.filterAttrs (_: set: lib.isDerivation set.lix or null && set.lix.meta.available))
+    lib.attrNames
+    (lib.filter (name: lib.match "lix_[0-9_]+|git" name != null))
+    (map (name: "lixPackageSets.${name}.lix"))
+  ];
+
+  nix = lib.pipe pkgs.nixVersions [
+    (lib.filterAttrs (_: drv: lib.isDerivation drv && drv.meta.available))
+    lib.attrNames
+    (lib.filter (name: lib.match "nix_[0-9_]+|git" name != null))
+    (map (name: "nixVersions.${name}"))
+  ];
+in
+lix ++ nix

doc/languages-frameworks/python.section.md

@@ -2121,7 +2121,7 @@ The following rules are desired to be respected:
 * `pythonImportsCheck` is set. This is still a good smoke test even if `pytestCheckHook` is set.
 * `meta.platforms` takes the default value in many cases.
   It does not need to be set explicitly unless the package requires a specific platform.
-* The file is formatted with `nixfmt-rfc-style`.
+* The file is formatted with `nixfmt`.
 * Commit names of Python libraries must reflect that they are Python
   libraries (e.g. `python313Packages.numpy: 1.11 -> 1.12` rather than `numpy: 1.11 -> 1.12`).
 * The current default version of python should be included

doc/release-notes/rl-2511.section.md

@@ -16,6 +16,10 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- `nixVersions.nix_2_3` has been dropped because it was insecure and unmaintained.
+
+- The minimum version of Nix required to evaluate Nixpkgs has been raised from 2.3 to 2.18.
+
 - The `offrss` package was removed due to lack of upstream maintenance since 2012. It's recommended for users to migrate to another RSS reader
 
 - `base16-builder` node package has been removed due to lack of upstream maintenance.
@@ -48,6 +52,8 @@
 
 - `tooling-language-server` has been renamed to `deputy` (both the package and binary), following the rename of the upstream project.
 
+- `fetchtorrent`, when using the "rqbit" backend, erroneously started fetching files into a subdirectory in Nixpkgs 24.11.  The original behaviour &ndash; which matches the behaviour using the "transmission" backend &ndash; has now been restored.  Users reliant on the erroneous behaviour can temporarily maintain it by adding `flatten = false` to the `fetchtorrent` arguments; Nix will produce an evaluation warning for anyone using `backend = "rqbit"` without `flatten = true`.
+
 - `webfontkitgenerator` has been renamed to `webfont-bundler`, following the rename of the upstream project.
   The binary name remains `webfontkitgenerator`.
   The `webfontkitgenerator` package is an alias to `webfont-bundler`.

lib/minver.nix

@@ -1,2 +1,2 @@
 # Expose the minimum required version for evaluating Nixpkgs
-"2.3.17"
+"2.18"

lib/tests/release.nix

@@ -2,21 +2,14 @@
   # The pkgs used for dependencies for the testing itself
   # Don't test properties of pkgs.lib, but rather the lib in the parent directory
   system ? builtins.currentSystem,
-  pkgs ?
-    import ../.. {
-      inherit system;
-      config = {
-        permittedInsecurePackages = [ "nix-2.3.18" ];
-      };
-    }
-    // {
-      lib = throw "pkgs.lib accessed, but the lib tests should use nixpkgs' lib path directly!";
-    },
+  pkgs ? import ../.. { inherit system; } // {
+    lib = throw "pkgs.lib accessed, but the lib tests should use nixpkgs' lib path directly!";
+  },
   # For testing someone may edit impure.nix to return cross pkgs, use `pkgsBuildBuild` directly so everything here works.
   pkgsBB ? pkgs.pkgsBuildBuild,
   nix ? pkgs-nixVersions.stable,
   nixVersions ? [
-    pkgs-nixVersions.minimum
+    pkgs-nixVersions.nix_2_24
     nix
     pkgs-nixVersions.latest
   ],

maintainers/maintainer-list.nix

@@ -5914,7 +5914,7 @@
   };
   dblsaiko = {
     email = "me@dblsaiko.net";
-    github = "2xsaiko";
+    github = "dblsaiko";
     githubId = 3987560;
     name = "Katalin Rebhan";
   };
@@ -6886,6 +6886,11 @@
     github = "dstengele";
     githubId = 1706418;
   };
+  dstremur = {
+    name = "Diego Strebel";
+    github = "dstremur";
+    githubId = 76773187;
+  };
   dsuetin = {
     name = "Danil Suetin";
     email = "suetin085+nixpkgs@protonmail.com";
@@ -16745,6 +16750,12 @@
     githubId = 24192522;
     name = "MithicSpirit";
   };
+  miyu = {
+    email = "miyu@allthingslinux.org";
+    github = "fndov";
+    githubId = 168955383;
+    name = "Tommy B";
+  };
   mjm = {
     email = "matt@mattmoriarity.com";
     github = "mjm";
@@ -26917,6 +26928,12 @@
     name = "Stefan Zabka";
     githubId = 13276717;
   };
+  vrose = {
+    email = "vrose04@gmail.com";
+    github = "vinnybod";
+    name = "Vince Rose";
+    githubId = 9831420;
+  };
   vrthra = {
     email = "rahul@gopinath.org";
     github = "vrthra";
@@ -28141,6 +28158,12 @@
     githubId = 908716;
     name = "Zach Coyle";
   };
+  ZachDavies = {
+    name = "Zach Davies";
+    email = "zdmalta@proton.me";
+    github = "ZachDavies";
+    githubId = 131615861;
+  };
   Zaczero = {
     name = "Kamil Monicz";
     email = "kamil@monicz.dev";

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -187,6 +187,8 @@
 
 - `services.monero` now includes the `environmentFile` option for adding secrets to the Monero daemon config.
 
+- `services.netbird.server` now uses dedicated packages split out due to relicensing of server components to AGPLv3 with version `0.53.0`,
+
 - The new option [networking.ipips](#opt-networking.ipips) has been added to create IP within IP kind of tunnels (including 4in6, ip6ip6 and ipip).
   With the existing [networking.sits](#opt-networking.sits) option (6in4), it is now possible to create all combinations of IPv4 and IPv6 encapsulation.
 

nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-gnome.nix

@@ -11,7 +11,7 @@
     # Add Firefox and other tools useful for installation to the launcher
     favoriteAppsOverride = ''
       [org.gnome.shell]
-      favorite-apps=[ 'firefox.desktop', 'nixos-manual.desktop', 'org.gnome.Console.desktop', 'org.gnome.Nautilus.desktop', 'gparted.desktop', 'io.calamares.calamares.desktop' ]
+      favorite-apps=[ 'firefox.desktop', 'nixos-manual.desktop', 'org.gnome.Console.desktop', 'org.gnome.Nautilus.desktop', 'gparted.desktop', 'calamares.desktop' ]
     '';
 
     # Override GNOME defaults to disable GNOME tour and disable suspend

nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-plasma5.nix

@@ -45,8 +45,8 @@
       ln -sfT ${pkgs.plasma5Packages.konsole}/share/applications/org.kde.konsole.desktop ${
         desktopDir + "org.kde.konsole.desktop"
       }
-      ln -sfT ${pkgs.calamares-nixos}/share/applications/io.calamares.calamares.desktop ${
-        desktopDir + "io.calamares.calamares.desktop"
+      ln -sfT ${pkgs.calamares-nixos}/share/applications/calamares.desktop ${
+        desktopDir + "calamares.desktop"
       }
     '';
 

nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares-plasma6.nix

@@ -50,8 +50,8 @@
 
       ln -sfT ${manualDesktopFile} ${desktopDir + "nixos-manual.desktop"}
       ln -sfT ${pkgs.gparted}/share/applications/gparted.desktop ${desktopDir + "gparted.desktop"}
-      ln -sfT ${pkgs.calamares-nixos}/share/applications/io.calamares.calamares.desktop ${
-        desktopDir + "io.calamares.calamares.desktop"
+      ln -sfT ${pkgs.calamares-nixos}/share/applications/calamares.desktop ${
+        desktopDir + "calamares.desktop"
       }
     '';
 

nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares.nix

@@ -4,16 +4,18 @@
 { pkgs, ... }:
 let
   calamares-nixos-autostart = pkgs.makeAutostartItem {
-    name = "io.calamares.calamares";
+    name = "calamares";
     package = pkgs.calamares-nixos;
   };
 in
 {
   imports = [ ./installation-cd-graphical-base.nix ];
 
+  # required for kpmcore to work correctly
+  programs.partition-manager.enable = true;
+
   environment.systemPackages = with pkgs; [
     # Calamares for graphical installation
-    libsForQt5.kpmcore
     calamares-nixos
     calamares-nixos-autostart
     calamares-nixos-extensions

nixos/modules/misc/documentation/modular-services.nix

@@ -21,6 +21,7 @@ let
     _file = "${__curPos.file}:${toString __curPos.line}";
     options = {
       "<imports = [ pkgs.ghostunnel.services.default ]>" = fakeSubmodule pkgs.ghostunnel.services.default;
+      "<imports = [ pkgs.php.services.default ]>" = fakeSubmodule pkgs.php.services.default;
     };
   };
 in

nixos/modules/programs/partition-manager.nix

@@ -15,7 +15,7 @@ in
     programs.partition-manager = {
       enable = lib.mkEnableOption "KDE Partition Manager";
 
-      package = lib.mkPackageOption pkgs [ "libsForQt5" "partitionmanager" ] { };
+      package = lib.mkPackageOption pkgs [ "kdePackages" "partitionmanager" ] { };
     };
   };
 

nixos/modules/services/backup/sanoid.nix

@@ -57,6 +57,42 @@ let
       type = with lib.types; nullOr bool;
       default = null;
     };
+
+    pre_snapshot_script = lib.mkOption {
+      description = "Script to run before taking snapshot.";
+      type = with lib.types; nullOr str;
+      default = null;
+    };
+
+    post_snapshot_script = lib.mkOption {
+      description = "Script to run after taking snapshot.";
+      type = with lib.types; nullOr str;
+      default = null;
+    };
+
+    pruning_script = lib.mkOption {
+      description = "Script to run after pruning snapshot.";
+      type = with lib.types; nullOr str;
+      default = null;
+    };
+
+    no_inconsistent_snapshot = lib.mkOption {
+      description = "Whether to take a snapshot if the pre script fails";
+      type = with lib.types; nullOr bool;
+      default = null;
+    };
+
+    force_post_snapshot_script = lib.mkOption {
+      description = "Whether to run the post script if the pre script fails";
+      type = with lib.types; nullOr bool;
+      default = null;
+    };
+
+    script_timeout = lib.mkOption {
+      description = "Time limit for pre/post/pruning script execution time (<=0 for infinite).";
+      type = with lib.types; nullOr int;
+      default = null;
+    };
   };
 
   datasetOptions = rec {

nixos/modules/services/misc/open-webui.nix

@@ -97,6 +97,23 @@ in
       }
       // cfg.environment;
 
+      # backwards compatability migration
+      preStart = ''
+        if [ -d "${cfg.stateDir}/data" ] && [ -n "$(ls -A "${cfg.stateDir}/data" 2>/dev/null)" ]; then
+          exit 0
+        fi
+
+        mkdir -p "${cfg.stateDir}/data"
+
+        [ -f "${cfg.stateDir}/webui.db" ] && mv "${cfg.stateDir}/webui.db" "${cfg.stateDir}/data/"
+
+        for dir in cache uploads vector_db; do
+          [ -d "${cfg.stateDir}/$dir" ] && mv "${cfg.stateDir}/$dir" "${cfg.stateDir}/data/"
+        done
+
+        exit 0
+      '';
+
       serviceConfig = {
         ExecStart = "${lib.getExe cfg.package} serve --host \"${cfg.host}\" --port ${toString cfg.port}";
         EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile;

nixos/modules/services/networking/netbird/management.nix

@@ -139,7 +139,7 @@ in
   options.services.netbird.server.management = {
     enable = mkEnableOption "Netbird Management Service";
 
-    package = mkPackageOption pkgs "netbird" { };
+    package = mkPackageOption pkgs "netbird-management" { };
 
     domain = mkOption {
       type = str;

nixos/modules/services/networking/netbird/signal.nix

@@ -31,7 +31,7 @@ in
   options.services.netbird.server.signal = {
     enable = mkEnableOption "Netbird's Signal Service";
 
-    package = mkPackageOption pkgs "netbird" { };
+    package = mkPackageOption pkgs "netbird-signal" { };
 
     enableNginx = mkEnableOption "Nginx reverse-proxy for the netbird signal service";
 

nixos/modules/services/networking/wireguard-networkd.nix

@@ -105,7 +105,7 @@ let
       # See: https://github.com/systemd/systemd/issues/9911
       # This hack does the job but takes down the whole interface to do it.
       script = ''
-        ip link delete ${name}
+        ip link delete ${name} || :
         networkctl reload
       '';
     };

nixos/modules/virtualisation/oci-containers.nix

@@ -494,7 +494,7 @@ let
           filterAttrs (_: v: v == false) container.capabilities
         )
         ++ map (d: "--device=${escapeShellArg d}") container.devices
-        ++ map (n: "--network=${escapeShellArg n}") container.networks
+        ++ map (n: "--network=${escapeShellArg n}") (lib.lists.unique container.networks)
         ++ [ "--pull ${escapeShellArg container.pull}" ]
         ++ map escapeShellArg container.extraOptions
         ++ [ container.image ]

nixos/tests/all-terminfo.nix

@@ -13,6 +13,10 @@
       ...
     }:
     let
+      # Use derivations instead of attr names to avoid listing missing packages
+      maskedTerminfos = with pkgs; [
+        alacritty-graphics # would clobber alacritty terminfo
+      ];
       infoFilter =
         name: drv:
         let
@@ -23,7 +27,8 @@
         && o.value ? outputs
         && builtins.elem "terminfo" o.value.outputs
         && !o.value.meta.broken
-        && lib.meta.availableOn pkgs.stdenv.hostPlatform o.value;
+        && lib.meta.availableOn pkgs.stdenv.hostPlatform o.value
+        && !(builtins.elem o.value maskedTerminfos);
       terminfos = lib.filterAttrs infoFilter pkgs;
       excludedTerminfos = lib.filterAttrs (
         _: drv: !(builtins.elem drv.terminfo config.environment.systemPackages)

nixos/tests/all-tests.nix

@@ -1123,6 +1123,7 @@ in
   osquery = handleTestOn [ "x86_64-linux" ] ./osquery.nix { };
   osrm-backend = runTest ./osrm-backend.nix;
   overlayfs = runTest ./overlayfs.nix;
+  oxidized = handleTest ./oxidized.nix { };
   pacemaker = runTest ./pacemaker.nix;
   packagekit = runTest ./packagekit.nix;
   paisa = runTest ./paisa.nix;

nixos/tests/netbird.nix

@@ -7,7 +7,7 @@
   ];
 
   nodes = {
-    clients =
+    node =
       { ... }:
       {
         services.netbird.enable = true;
@@ -15,34 +15,16 @@
       };
   };
 
-  # TODO: confirm the whole solution is working end-to-end when netbird server is implemented
-  testScript = ''
-    start_all()
-    def did_start(node, name, interval=0.5, timeout=10):
-      node.wait_for_unit(f"{name}.service")
-      node.wait_for_file(f"/var/run/{name}/sock")
-      # `netbird status` returns a full "Disconnected" status during initialization
-      # only after a while passes it starts returning "NeedsLogin" help message
-
-      start = time.time()
-      output = node.succeed(f"{name} status")
-      while "Disconnected" in output and (time.time() - start) < timeout:
-        time.sleep(interval)
-        output = node.succeed(f"{name} status")
-      assert "NeedsLogin" in output
-
-    did_start(clients, "netbird")
-    did_start(clients, "netbird-custom")
-  '';
-
   /*
-    `netbird status` used to print `Daemon status: NeedsLogin`
-        https://github.com/netbirdio/netbird/blob/23a14737974e3849fa86408d136cc46db8a885d0/client/cmd/status.go#L154-L164
-    as the first line, but now it is just:
+    Historically waiting for the NetBird client daemon initialization helped catch number of bugs with the service,
+     so we keep try to keep it here in as much details as it makes sense.
 
-        Daemon version: 0.26.3
-        CLI version: 0.26.3
-        Management: Disconnected
+    Initially `netbird status` returns a "Disconnected" messages:
+        OS: linux/amd64
+        Daemon version: 0.54.0
+        CLI version: 0.54.0
+        Profile: default
+        Management: Disconnected, reason: rpc error: code = FailedPrecondition desc = failed connecting to Management Service : context deadline exceeded
         Signal: Disconnected
         Relays: 0/0 Available
         Nameservers: 0/0 Available
@@ -50,7 +32,69 @@
         NetBird IP: N/A
         Interface type: N/A
         Quantum resistance: false
-        Routes: -
+        Lazy connection: false
+        Networks: -
+        Forwarding rules: 0
         Peers count: 0/0 Connected
+
+    After a while passes it should start returning "NeedsLogin" help message.
+
+    As of ~0.53.0+ in ~30 second intervals the `netbird status` instead of "NeedsLogin" it briefly (for under 2 seconds) crashes with:
+
+        Error: status failed: failed connecting to Management Service : context deadline exceeded
+
+    This might be related to the following log line:
+
+        2025-08-11T15:03:25Z ERRO shared/management/client/grpc.go:65: failed creating connection to Management Service: context deadline exceeded
   */
+  # TODO: confirm the whole solution is working end-to-end when netbird server is implemented
+  testScript = ''
+    import textwrap
+    import time
+
+    start_all()
+
+    def run_with_debug(node, cmd, check=True, display=True, **kwargs):
+      cmd = f"{cmd} 2>&1"
+      start = time.time()
+      ret, output = node.execute(cmd, **kwargs)
+      duration = time.time() - start
+      txt = f">>> {cmd=} {ret=} {duration=:.2f}:\n{textwrap.indent(output, '... ')}"
+      if check:
+        assert ret == 0, txt
+      if display:
+        print(txt)
+      return ret, output
+
+    def wait_until_rcode(node, cmd, rcode=0, retries=30, **kwargs):
+      def check_success(_last_try):
+        nonlocal output
+        ret, output = run_with_debug(node, cmd, **kwargs)
+        return ret == rcode
+
+      kwargs.setdefault('check', False)
+      output = None
+      with node.nested(f"waiting for {cmd=} to exit with {rcode=}"):
+          retry(check_success, retries)
+          return output
+
+    instances = ["netbird", "netbird-custom"]
+
+    for name in instances:
+      node.wait_for_unit(f"{name}.service")
+      node.wait_for_file(f"/var/run/{name}/sock")
+
+    for name in instances:
+      wait_until_rcode(node, f"{name} status |& grep -C20 Disconnected", 0, retries=5)
+  ''
+  # The status used to turn into `NeedsLogin`, but recently started crashing instead.
+  # leaving the snippets in here, in case some update goes back to the old behavior and can be tested again
+  + lib.optionalString false ''
+    for name in instances:
+      #wait_until_rcode(node, f"{name} status |& grep -C20 NeedsLogin", 0, retries=20)
+      output = wait_until_rcode(node, f"{name} status", 1, retries=61)
+      msg = "Error: status failed: failed connecting to Management Service : context deadline exceeded"
+      assert output.strip() == msg, f"expected {msg=}, got {output=} instead"
+      wait_until_rcode(node, f"{name} status |& grep -C20 Disconnected", 0, retries=10)
+  '';
 }

nixos/tests/oxidized.nix

@@ -0,0 +1,104 @@
+{
+  system ? builtins.currentSystem,
+  pkgs ? import ../.. {
+    inherit system;
+    config = { };
+  },
+}:
+
+let
+  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
+in
+makeTest {
+  name = "oxidized";
+
+  nodes.server =
+    { config, pkgs, ... }:
+    {
+      security.pam.services.sshd.allowNullPassword = true; # the default `UsePam yes` makes this necessary
+      services = {
+        sshd.enable = true;
+        openssh = {
+          settings.PermitRootLogin = "yes";
+          settings.PermitEmptyPasswords = "yes";
+        };
+        oxidized = {
+          enable = true;
+          package = pkgs.oxidized;
+          routerDB = pkgs.writeText "oxidized-router.db" ''
+            localhost:linuxgeneric:root
+          '';
+          configFile = pkgs.writeText "oxidized-config.yml" ''
+            # vi: ft=yaml
+            ---
+            extensions:
+              oxidized-web:
+                load: true
+                listen: 127.0.0.1
+                port: 8888
+                vhosts:
+                  - localhost
+                  - 127.0.0.1
+                  - oxidized
+                  - oxidized.example.com
+            interval: 3600
+            retries: 3
+            model: linuxgeneric
+            username: root
+            source:
+              default: csv
+              csv:
+                file: "/var/lib/oxidized/.config/oxidized/router.db"
+                delimiter: !ruby/regexp /:/
+                map:
+                  name: 0
+                  model: 1
+                  username: 2
+                  password: 3
+                vars_map:
+                  enable: 4
+            input:
+              default: ssh
+              utf8_encoded: true
+            output:
+              default: git
+              git:
+                single_repo:  true
+                user: oxidized
+                email: oxidized@example.com
+                repo: /var/lib/oxidized/git
+          '';
+        };
+      };
+      systemd.services.oxidized = {
+        stopIfChanged = false;
+        environment.HOME = "/var/lib/oxidized";
+        environment.APP_ENV = "production";
+        serviceConfig = {
+          StateDirectory = "oxidized";
+          MemoryDenyWriteExecute = false;
+
+          PrivateNetwork = false;
+          SystemCallFilter = "@system-service";
+        };
+
+        path = [ config.programs.ssh.package ];
+      };
+
+    };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+
+      server.wait_for_unit("oxidized.service")
+
+      with subtest("Check if oxidized reports the correct version"):
+        server.wait_until_succeeds(("curl --silent --fail --location http://127.0.0.1:8888/ | grep '${nodes.server.services.oxidized.package.version}' >&2"))
+      with subtest("Check if oxidized can be accessed with a vhost and reports the correct version"):
+        server.wait_until_succeeds(("curl --silent --fail --resolve oxidized:8888:127.0.0.1 --location http://oxidized:8888/ | grep '${nodes.server.services.oxidized.package.version}' >&2"))
+      with subtest("Check if oxidized can connect to linuxgeneric model"):
+        server.wait_until_succeeds("journalctl -b --grep 'Oxidized::Worker -- Configuration updated for /localhost' -t oxidized")
+    '';
+}

nixos/tests/php/default.nix

@@ -13,6 +13,10 @@ in
     imports = [ ./fpm.nix ];
     _module.args.php = php';
   };
+  fpm-modular = runTest {
+    imports = [ ./fpm-modular.nix ];
+    _module.args.php = php';
+  };
   httpd = runTest {
     imports = [ ./httpd.nix ];
     _module.args.php = php';

nixos/tests/php/fpm-modular.nix

@@ -0,0 +1,71 @@
+{ lib, php, ... }:
+{
+  name = "php-${php.version}-fpm-modular-nginx-test";
+  meta.maintainers = with lib.maintainers; [
+    aanderse
+  ];
+
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      environment.systemPackages = [ php ];
+
+      services.nginx = {
+        enable = true;
+
+        virtualHosts."phpfpm" =
+          let
+            testdir = pkgs.writeTextDir "web/index.php" "<?php phpinfo();";
+          in
+          {
+            root = "${testdir}/web";
+            locations."~ \\.php$".extraConfig = ''
+              fastcgi_pass unix:${config.system.services.php-fpm.php-fpm.settings.foobar.listen};
+              fastcgi_index index.php;
+              include ${config.services.nginx.package}/conf/fastcgi_params;
+              include ${pkgs.nginx}/conf/fastcgi.conf;
+            '';
+            locations."/" = {
+              tryFiles = "$uri $uri/ index.php";
+              index = "index.php index.html index.htm";
+            };
+          };
+      };
+
+      system.services.php-fpm = {
+        imports = [ php.services.default ];
+        php-fpm = {
+          package = php;
+          settings = {
+            foobar = {
+              "user" = "nginx";
+              "listen.group" = "nginx";
+              "listen.mode" = "0600";
+              "listen.owner" = "nginx";
+              "pm" = "dynamic";
+              "pm.max_children" = 5;
+              "pm.max_requests" = 500;
+              "pm.max_spare_servers" = 3;
+              "pm.min_spare_servers" = 1;
+              "pm.start_servers" = 2;
+            };
+          };
+        };
+      };
+    };
+  testScript =
+    { ... }:
+    ''
+      machine.wait_for_unit("nginx.service")
+      machine.wait_for_unit("php-fpm.service")
+
+      # Check so we get an evaluated PHP back
+      response = machine.succeed("curl -fvvv -s http://127.0.0.1:80/")
+      assert "PHP Version ${php.version}" in response, "PHP version not detected"
+
+      # Check so we have database and some other extensions loaded
+      for ext in ["json", "opcache", "pdo_mysql", "pdo_pgsql", "pdo_sqlite", "apcu"]:
+          assert ext in response, f"Missing {ext} extension"
+          machine.succeed(f'test -n "$(php -m | grep -i {ext})"')
+    '';
+}

pkgs/applications/editors/android-studio/default.nix

@@ -24,8 +24,8 @@ let
     sha256Hash = "sha256-qA7iu4nK+29aHKsUmyQWuwV0SFnv5cYQvFq5CAMKyKw=";
   };
   latestVersion = {
-    version = "2025.1.3.3"; # "Android Studio Narwhal Feature Drop | 2025.1.3 Canary 3"
-    sha256Hash = "sha256-0BdbAJMQi9qgss1IJTMxjQpOjynLFuiY0Vlw5VYCY+c=";
+    version = "2025.1.3.4"; # "Android Studio Narwhal 3 Feature Drop | 2025.1.3 Canary 4"
+    sha256Hash = "sha256-SAdmuuentJZGtjcFAgAedPa9MLAS9vNtWoOI1pPvDhA=";
   };
 in
 {

pkgs/applications/editors/vim/plugins/generated.nix

@@ -3651,6 +3651,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  cutlass-nvim = buildVimPlugin {
+    pname = "cutlass.nvim";
+    version = "2023-12-18";
+    src = fetchFromGitHub {
+      owner = "gbprod";
+      repo = "cutlass.nvim";
+      rev = "1ac7e4b53d79410be52a9e464d44c60556282b3e";
+      sha256 = "0p00xjn6da7hj10vwnighsf1y0zmndfx9d2nb95whnq6awkbyr6f";
+    };
+    meta.homepage = "https://github.com/gbprod/cutlass.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   cyberdream-nvim = buildVimPlugin {
     pname = "cyberdream.nvim";
     version = "2025-07-25";
@@ -12652,14 +12665,14 @@ final: prev: {
 
   project-nvim = buildVimPlugin {
     pname = "project.nvim";
-    version = "2023-04-04";
+    version = "2025-08-09";
     src = fetchFromGitHub {
-      owner = "ahmedkhalf";
+      owner = "DrKJeff16";
       repo = "project.nvim";
-      rev = "8c6bad7d22eef1b71144b401c9f74ed01526a4fb";
-      sha256 = "1md639mcs3dgvhvx93wi0rxiwjnb195r9al9bfqvcvl3r307gxba";
+      rev = "91d52b8ac227918a26d85daf6774cd5f340202fa";
+      sha256 = "1a4cn58482ilcs5dw6szk98zkv090fb1whgjlfp2h8hy77773skr";
     };
-    meta.homepage = "https://github.com/ahmedkhalf/project.nvim/";
+    meta.homepage = "https://github.com/DrKJeff16/project.nvim/";
     meta.hydraPlatforms = [ ];
   };
 
@@ -14189,6 +14202,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  symbol-usage-nvim = buildVimPlugin {
+    pname = "symbol-usage.nvim";
+    version = "2025-05-03";
+    src = fetchFromGitHub {
+      owner = "Wansmer";
+      repo = "symbol-usage.nvim";
+      rev = "e07c07dfe7504295a369281e95a24e1afa14b243";
+      sha256 = "0539ahy72wh8rdkn2pybsdk58ki0jdn9dk2ap7q65986crjglr6d";
+    };
+    meta.homepage = "https://github.com/Wansmer/symbol-usage.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   symbols-outline-nvim = buildVimPlugin {
     pname = "symbols-outline.nvim";
     version = "2024-01-03";
@@ -15769,6 +15795,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  vague-nvim = buildVimPlugin {
+    pname = "vague.nvim";
+    version = "2025-08-03";
+    src = fetchFromGitHub {
+      owner = "vague2k";
+      repo = "vague.nvim";
+      rev = "676e5b4d74f32ff91c1583eba9c326d2b749672f";
+      sha256 = "1rj02zb12v3rz8z9f80s4pc5jyblql1lyjnq16195z5skfjb95xc";
+    };
+    meta.homepage = "https://github.com/vague2k/vague.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   venn-nvim = buildVimPlugin {
     pname = "venn.nvim";
     version = "2024-05-03";

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -279,6 +279,7 @@ https://github.com/JazzCore/ctrlp-cmatcher/,,
 https://github.com/FelikZ/ctrlp-py-matcher/,,
 https://github.com/amiorin/ctrlp-z/,,
 https://github.com/ctrlpvim/ctrlp.vim/,,
+https://github.com/gbprod/cutlass.nvim/,HEAD,
 https://github.com/scottmckendry/cyberdream.nvim/,,
 https://github.com/JachymPutta/dailies.nvim/,HEAD,
 https://github.com/Koalhack/darcubox-nvim/,HEAD,
@@ -971,7 +972,7 @@ https://github.com/sotte/presenting.vim/,,
 https://github.com/ewilazarus/preto/,HEAD,
 https://github.com/anuvyklack/pretty-fold.nvim/,HEAD,
 https://github.com/vim-scripts/prev_indent/,,
-https://github.com/ahmedkhalf/project.nvim/,,
+https://github.com/DrKJeff16/project.nvim/,,
 https://github.com/GnikDroy/projections.nvim/,HEAD,
 https://github.com/kevinhwang91/promise-async/,HEAD,
 https://github.com/frigoeu/psc-ide-vim/,,
@@ -1089,6 +1090,7 @@ https://github.com/peterbjorgensen/sved/,,
 https://github.com/jamespeapen/swayconfig.vim/,,
 https://github.com/keith/swift.vim/,,
 https://github.com/AndrewRadev/switch.vim/,,
+https://github.com/Wansmer/symbol-usage.nvim/,HEAD,
 https://github.com/simrat39/symbols-outline.nvim/,,
 https://github.com/vim-syntastic/syntastic/,,
 https://github.com/ziontee113/syntax-tree-surfer/,HEAD,
@@ -1210,6 +1212,7 @@ https://github.com/vim-scripts/utl.vim/,,
 https://github.com/benomahony/uv.nvim/,HEAD,
 https://github.com/KabbAmine/vCoolor.vim/,,
 https://github.com/junegunn/vader.vim/,,
+https://github.com/vague2k/vague.nvim/,HEAD,
 https://github.com/jbyuki/venn.nvim/,,
 https://github.com/vhda/verilog_systemverilog.vim/,,
 https://github.com/vifm/vifm.vim/,,

pkgs/applications/editors/vscode/extensions/README.md

@@ -7,7 +7,7 @@
 
 * When adding a new extension, place its definition in a `default.nix` file in a directory with the extension's ID (e.g. `publisher.extension-name/default.nix`) and refer to it in `./default.nix`, e.g. `publisher.extension-name = callPackage ./publisher.extension-name { };`.
 
-* Currently `nixfmt-rfc-style` formatter is being used to format the VSCode extensions.
+* Currently `nixfmt` formatter is being used to format the VSCode extensions.
 
 * Respect `alphabetical order` whenever adding extensions. On disorder, please, kindly open a PR re-establishing the order.
 

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1328,8 +1328,8 @@ let
         mktplcRef = {
           publisher = "denoland";
           name = "vscode-deno";
-          version = "3.45.0";
-          hash = "sha256-U3oNoT0KZiYfebUSEav5MCoun9n2qugruUTWrOMxjXA=";
+          version = "3.45.2";
+          hash = "sha256-U83RWIIorJdFuhr0/l2bIo5JthTFIvedWq52dsSGOx8=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/denoland.vscode-deno/changelog";

pkgs/applications/editors/vscode/extensions/james-yu.latex-workshop/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "latex-workshop";
     publisher = "James-Yu";
-    version = "10.10.0";
-    hash = "sha256-3Rdoer5n2jf8PLRGgg/nqGRoRwQLCdcOXkmKay5uDWE=";
+    version = "10.10.1";
+    hash = "sha256-TFaTpGfGk6RgFH/2gSGXCntBw6yWRg1lxHU+eEMBu3s=";
   };
   meta = {
     changelog = "https://marketplace.visualstudio.com/items/James-Yu.latex-workshop/changelog";

pkgs/applications/emulators/libretro/cores/ppsspp.nix

@@ -13,13 +13,13 @@
 }:
 mkLibretroCore {
   core = "ppsspp";
-  version = "0-unstable-2025-07-16";
+  version = "0-unstable-2025-08-11";
 
   src = fetchFromGitHub {
     owner = "hrydgard";
     repo = "ppsspp";
-    rev = "e68cec63d0d5d89442ddfab5b425c73e2bb5eb35";
-    hash = "sha256-xNh+McD/oGBKTcnhQgM3zCZhX4Q7IOf9CcdIJJvqM4g=";
+    rev = "9912aa5c8d3b95165c56e29ffaa50069aeae0860";
+    hash = "sha256-5snyC0hk1VqYH4aqz4E7ukPyOLrDVZwDsw3LPdHDSzM=";
     fetchSubmodules = true;
   };
 

pkgs/applications/graphics/kcc/default.nix

@@ -1,48 +0,0 @@
-{
-  lib,
-  python3Packages,
-  fetchPypi,
-  libsForQt5,
-  p7zip,
-  archiveSupport ? true,
-}:
-
-python3Packages.buildPythonApplication rec {
-  pname = "kcc";
-  version = "5.5.1";
-  format = "setuptools";
-
-  src = fetchPypi {
-    inherit version;
-    pname = "KindleComicConverter";
-    sha256 = "5dbee5dc5ee06a07316ae5ebaf21ffa1970094dbae5985ad735e2807ef112644";
-  };
-
-  nativeBuildInputs = [ libsForQt5.wrapQtAppsHook ];
-
-  propagatedBuildInputs = with python3Packages; [
-    pillow
-    pyqt5
-    psutil
-    python-slugify
-    raven
-  ];
-
-  qtWrapperArgs = lib.optionals archiveSupport [
-    "--prefix"
-    "PATH"
-    ":"
-    "${lib.makeBinPath [ p7zip ]}"
-  ];
-
-  postFixup = ''
-    wrapProgram $out/bin/kcc "''${qtWrapperArgs[@]}"
-  '';
-
-  meta = with lib; {
-    description = "Python app to convert comic/manga files or folders to EPUB, Panel View MOBI or E-Ink optimized CBZ";
-    homepage = "https://github.com/ciromattia/kcc";
-    license = licenses.isc;
-    maintainers = with maintainers; [ dawidsowa ];
-  };
-}

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -99,13 +99,13 @@
     "vendorHash": "sha256-YIn8akPW+DCVF0eYZxsmJxmrJuYhK4QLG/uhmmrXd4c="
   },
   "auth0": {
-    "hash": "sha256-qTSoE9BRVTJEj5Lbhci3b3kyrIhvG0Mqk+ulDqfQrFg=",
+    "hash": "sha256-mKpsTSa1peLXvxKaMQPlYhD26wkmjyPBF9D5s1yZO+k=",
     "homepage": "https://registry.terraform.io/providers/auth0/auth0",
     "owner": "auth0",
     "repo": "terraform-provider-auth0",
-    "rev": "v1.25.0",
+    "rev": "v1.27.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-uKzgEBNrLqcOkrrxKO9c5wKRwUjQInzeseN/euEI2G8="
+    "vendorHash": "sha256-ERuWKsHV7rxQOaq6cwr9/DN/94L+OvDdPKPIjdbzVyo="
   },
   "avi": {
     "hash": "sha256-e8yzc3nRP0ktcuuKyBXydS9NhoceYZKzJcqCWOfaPL0=",
@@ -198,13 +198,13 @@
     "vendorHash": "sha256-ok73U0WWFGXp5TJ7sp7U9umq7DlChCw7fSyFmbifwKE="
   },
   "bitwarden": {
-    "hash": "sha256-eqWyKPzSINSZcO8Ho0WHTeVDOxbUynOzupXu6vzTtuU=",
+    "hash": "sha256-yq45SlP8x/jMSuhgrIIAM+hWa4tcp2d871uoLy+iIZM=",
     "homepage": "https://registry.terraform.io/providers/maxlaverse/bitwarden",
     "owner": "maxlaverse",
     "repo": "terraform-provider-bitwarden",
-    "rev": "v0.14.0",
+    "rev": "v0.15.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-TmlnrCsIM9k2ApPFcSpFUoggIIDrT9S/BeD3kKI2Klc="
+    "vendorHash": "sha256-oQ7rOrWS2cJtAOwO+tQ9aB27DyHMhf5FYpDvJVsLe/k="
   },
   "brightbox": {
     "hash": "sha256-pwFbCP+qDL/4IUfbPRCkddkbsEEeAu7Wp12/mDL0ABA=",
@@ -534,13 +534,13 @@
     "vendorHash": "sha256-n6UUSCQt3mJESEfqVHX4sfr1XqOXu+u7Qejjps6RmBs="
   },
   "google-beta": {
-    "hash": "sha256-HWtH/F4Bf86jzb27jSSpE7h77CH9FpGTF5tpGSxuX+g=",
+    "hash": "sha256-8woiWjYYaojpKykxd9eMT4qXfpHVkXFA9eN3qzhEu+8=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v6.46.0",
+    "rev": "v6.47.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-QQI1BfUgDRYwlqOC2+e/EMcDsEbZV8cAUnscnW8xVLk="
+    "vendorHash": "sha256-BzmaCp0QL2BbYn+NwlvPGV2CoDjKXr75HaPFVdrS5e4="
   },
   "googleworkspace": {
     "hash": "sha256-dedYnsKHizxJZibuvJOMbJoux0W6zgKaK5fxIofKqCY=",
@@ -876,11 +876,11 @@
     "vendorHash": null
   },
   "newrelic": {
-    "hash": "sha256-ymxR4LOgsMg8evg4nBjzJZ5rKi/ql4TLlYb9i9gzKK4=",
+    "hash": "sha256-4l7q9umrbic4lOKMtTWwBDRHMJUlVyrl5un7KAYYiAM=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.65.0",
+    "rev": "v3.66.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-+ogtadT0zekeaynXQCwDBrD+bBnKUsyzLGPQyLsCSR8="
   },
@@ -1138,11 +1138,11 @@
     "vendorHash": "sha256-75GQmp/ybD+VugrrB8qTbP3OPHy3eyBGe5u7CM7CRcc="
   },
   "routeros": {
-    "hash": "sha256-1qdq09QFijxQDUaoPJwJB4F5aZ0AHXJSGndcdR9iqOs=",
+    "hash": "sha256-q0ZRAip6mgHkdBcns8G7VlDnMNB+ux6ITKwcSL4WrcY=",
     "homepage": "https://registry.terraform.io/providers/terraform-routeros/routeros",
     "owner": "terraform-routeros",
     "repo": "terraform-provider-routeros",
-    "rev": "v1.86.1",
+    "rev": "v1.86.2",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-et1xqcaCKTRz9bJjTlRnxhXBoc6PaeSwJgBI4pAzcdg="
   },

pkgs/applications/networking/ktailctl/default.nix

@@ -26,13 +26,13 @@
 }:
 
 let
-  version = "0.20.2";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "f-koehler";
     repo = "KTailctl";
     rev = "v${version}";
-    hash = "sha256-yMP+oAc1ZHr402j3NQOFLGFT/AK/PQ+figoVyOMEaus=";
+    hash = "sha256-mKkHp6ZRTTepg/wo/1jeWBERRezT6hz0EL3ZDlS7nGk=";
   };
 
   goDeps =
@@ -40,7 +40,7 @@ let
       pname = "ktailctl-go-wrapper";
       inherit src version;
       modRoot = "src/wrapper";
-      vendorHash = "sha256-kX2L/ET6saxn73T4414ShRSeOIpX8i1HHjKkPbdjse0=";
+      vendorHash = "sha256-RBjWTNbKS/nzD1tF28BZrBJPbx0s6t7Bi1eRFgtHYwk=";
     }).goModules;
 in
 stdenv.mkDerivation {

pkgs/applications/networking/maestral-qt/default.nix

@@ -52,6 +52,10 @@ python3.pkgs.buildPythonApplication rec {
     "--prefix PYTHONPATH : ${makePythonPath [ maestral ]}"
   ];
 
+  postInstall = ''
+    install -Dm444 -t $out/share/icons/hicolor/512x512/apps src/maestral_qt/resources/maestral.png
+  '';
+
   # no tests
   doCheck = false;
 

pkgs/applications/science/math/cemu-ti/default.nix

@@ -46,11 +46,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://ce-programming.github.io/CEmu";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ ];
-    platforms = [
-      "x86_64-linux"
-      "x86_64-darwin"
-      "aarch64-linux"
-    ];
-    broken = stdenv.hostPlatform.isDarwin || (stdenv.system == "x86_64-linux");
+    platforms = lib.platforms.unix;
   };
 })

pkgs/build-support/fetchtorrent/default.nix

@@ -18,20 +18,20 @@ in
       "bittorrent"
     else
       "bittorrent-" + builtins.head (builtins.match urlRegexp url),
-  config ?
-    if (backend == "transmission") then
-      { }
-    else
-      throw "json config for configuring fetchFromBitorrent only works with the transmission backend",
+  config ? { },
   hash,
   backend ? "transmission",
   recursiveHash ? true,
+  flatten ? null,
   postFetch ? "",
   postUnpack ? "",
   meta ? { },
 }:
 let
-  afterSuccess = writeShellScript "fetch-bittorrent-done.sh" ''
+  # Default to flattening if no flatten argument was specified.
+  flatten' = if flatten == null then true else flatten;
+
+  transmissionFinishScript = writeShellScript "fetch-bittorrent-done.sh" ''
     ${postUnpack}
     # Flatten the directory, so that only the torrent contents are in $out, not
     # the folder name
@@ -43,7 +43,52 @@ let
     kill $PPID
   '';
   jsonConfig = (formats.json { }).generate "jsonConfig" config;
+
+  # https://github.com/NixOS/nixpkgs/issues/432001
+  #
+  # For a while, the transmission backend would put the downloaded torrent in
+  # the output directory, but whether the rqbit backend would put the output in
+  # the output directory or a subdirectory depended on the version of rqbit.
+  # We want to standardise on a single behaviour, but give users of
+  # fetchtorrent with the rqbit backend some warning that the behaviour might
+  # be unexpected, particularly since we can't know what behaviour users might
+  # be expecting at this point, and they probably wouldn't notice a change
+  # straight away because the results are fixed-output derivations.
+  #
+  # This warning was introduced for 25.11, so we can remove handling of the
+  # `flatten` argument once that release is no longer supported.
+  warnings =
+    if backend == "rqbit" && flatten == null then
+      [
+        ''
+          `fetchtorrent` with the rqbit backend may or may not have the
+          downloaded files stored in a subdirectory of the output directory.
+          Verify which behaviour you need, and set the `flatten` argument to
+          `fetchtorrent` accordingly.
+
+          The `flatten = false` behaviour will still produce a warning, as this
+          behaviour is deprecated.  It is only available with the "rqbit" backend
+          to provide temporary support for users who are relying on the
+          previous incorrect behaviour.  For a warning-free evaluation, use
+          `flatten = true`.
+        ''
+      ]
+    else if flatten == false then
+      [
+        ''
+          `fetchtorrent` with `flatten = false` is deprecated and will be
+          removed in a future release.
+        ''
+      ]
+    else
+      [ ];
 in
+assert lib.assertMsg (config != { } -> backend == "transmission") ''
+  json config for configuring fetchtorrent only works with the transmission backend
+'';
+assert lib.assertMsg (backend == "transmission" -> flatten') ''
+  `flatten = false` is only supported by the rqbit backend for fetchtorrent
+'';
 runCommand name
   {
     inherit meta;
@@ -75,17 +120,54 @@ runCommand name
         mkdir -p $downloadedDirectory
         mkdir -p $HOME/.config/transmission
         cp ${jsonConfig} $HOME/.config/transmission/settings.json
+        port="$(shuf -n 1 -i 49152-65535)"
         function handleChild {
           # This detects failures and logs the contents of the transmission fetch
           find $out
           exit 0
         }
         trap handleChild CHLD
-        transmission-cli --port $(shuf -n 1 -i 49152-65535) --portmap --finish ${afterSuccess} --download-dir $downloadedDirectory --config-dir "$HOME"/.config/transmission "$url"
+        transmission-cli \
+            --port "$port" \
+            --portmap \
+            --finish ${transmissionFinishScript} \
+            --download-dir "$downloadedDirectory" \
+            --config-dir "$HOME"/.config/transmission \
+            "$url"
       ''
     else
       ''
         export HOME=$TMP
-        rqbit --disable-dht-persistence --http-api-listen-addr "127.0.0.1:$(shuf -n 1 -i 49152-65535)" download -o $out --exit-on-finish "$url"
+      ''
+      + lib.optionalString flatten' ''
+        downloadedDirectory=$out/downloadedDirectory
+        mkdir -p $downloadedDirectory
+      ''
+      + lib.optionalString (!flatten') ''
+        downloadedDirectory=$out
+      ''
+      + ''
+        port="$(shuf -n 1 -i 49152-65535)"
+
+        rqbit \
+            --disable-dht-persistence \
+            --http-api-listen-addr "127.0.0.1:$port" \
+            download \
+            -o "$downloadedDirectory" \
+            --exit-on-finish \
+            "$url"
+
+        ${postUnpack}
+      ''
+      + lib.optionalString flatten' ''
+        # Flatten the directory, so that only the torrent contents are in $out,
+        # not the folder name
+        shopt -s dotglob
+        mv -v $downloadedDirectory/*/* $out
+        rm -v -rf $downloadedDirectory
+        unset downloadedDirectory
+      ''
+      + ''
+        ${postFetch}
       ''
   )

pkgs/build-support/fetchtorrent/tests.nix

@@ -18,41 +18,74 @@ let
   };
 
   # Via https://webtorrent.io/free-torrents
-  httpUrl = "https://webtorrent.io/torrents/sintel.torrent";
-  magnetUrl = "magnet:?xt=urn:btih:08ada5a7a6183aae1e09d831df6748d566095a10&dn=Sintel&tr=udp%3A%2F%2Fexplodie.org%3A6969&tr=udp%3A%2F%2Ftracker.coppersurfer.tk%3A6969&tr=udp%3A%2F%2Ftracker.empire-js.us%3A1337&tr=udp%3A%2F%2Ftracker.leechers-paradise.org%3A6969&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337&tr=wss%3A%2F%2Ftracker.btorrent.xyz&tr=wss%3A%2F%2Ftracker.fastcast.nz&tr=wss%3A%2F%2Ftracker.openwebtorrent.com&ws=https%3A%2F%2Fwebtorrent.io%2Ftorrents%2F&xs=https%3A%2F%2Fwebtorrent.io%2Ftorrents%2Fsintel.torrent";
+  http.url = "https://webtorrent.io/torrents/sintel.torrent";
+  magnet.url = "magnet:?xt=urn:btih:08ada5a7a6183aae1e09d831df6748d566095a10&dn=Sintel&tr=udp%3A%2F%2Fexplodie.org%3A6969&tr=udp%3A%2F%2Ftracker.coppersurfer.tk%3A6969&tr=udp%3A%2F%2Ftracker.empire-js.us%3A1337&tr=udp%3A%2F%2Ftracker.leechers-paradise.org%3A6969&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337&tr=wss%3A%2F%2Ftracker.btorrent.xyz&tr=wss%3A%2F%2Ftracker.fastcast.nz&tr=wss%3A%2F%2Ftracker.openwebtorrent.com&ws=https%3A%2F%2Fwebtorrent.io%2Ftorrents%2F&xs=https%3A%2F%2Fwebtorrent.io%2Ftorrents%2Fsintel.torrent";
 
-  # All routes to download the torrent should produce the same output and
-  # therefore have the same FOD hash.
-  hash = "sha256-EzbmBiTEWOlFUNaV5R4eDeD9EBbp6d93rfby88ACg0s=";
+  flattened.hash = "sha256-EzbmBiTEWOlFUNaV5R4eDeD9EBbp6d93rfby88ACg0s=";
+  unflattened.hash = "sha256-lVrlo1AwmFcxwsIsY976VYqb3hAprFH1xWYdmlTuw0U=";
 in
-
-{
-  http-link = testers.invalidateFetcherByDrvHash fetchtorrent {
-    inherit hash;
-    url = httpUrl;
-    backend = "transmission";
+# Seems almost but not quite worth using lib.mapCartesianProduct...
+builtins.mapAttrs (n: v: testers.invalidateFetcherByDrvHash fetchtorrent v) {
+  http-link = {
+    inherit (http) url;
+    inherit (flattened) hash;
     inherit (sintel) meta;
   };
-  magnet-link = testers.invalidateFetcherByDrvHash fetchtorrent {
-    inherit hash;
-    url = magnetUrl;
+  http-link-transmission = {
+    inherit (http) url;
     backend = "transmission";
+    inherit (flattened) hash;
     inherit (sintel) meta;
   };
-  http-link-rqbit = testers.invalidateFetcherByDrvHash fetchtorrent {
-    inherit hash;
-    url = httpUrl;
-    backend = "rqbit";
-    meta = sintel.meta // {
-      broken = true;
-    };
+  magnet-link = {
+    inherit (magnet) url;
+    inherit (flattened) hash;
+    inherit (sintel) meta;
   };
-  magnet-link-rqbit = testers.invalidateFetcherByDrvHash fetchtorrent {
-    inherit hash;
-    url = magnetUrl;
+  magnet-link-transmission = {
+    inherit (magnet) url;
+    backend = "transmission";
+    inherit (flattened) hash;
+    inherit (sintel) meta;
+  };
+  http-link-rqbit = {
+    inherit (http) url;
     backend = "rqbit";
-    meta = sintel.meta // {
-      broken = true;
-    };
+    inherit (flattened) hash;
+    inherit (sintel) meta;
+  };
+  magnet-link-rqbit = {
+    inherit (magnet) url;
+    backend = "rqbit";
+    inherit (flattened) hash;
+    inherit (sintel) meta;
+  };
+  http-link-rqbit-flattened = {
+    inherit (http) url;
+    backend = "rqbit";
+    flatten = true;
+    inherit (flattened) hash;
+    inherit (sintel) meta;
+  };
+  magnet-link-rqbit-flattened = {
+    inherit (magnet) url;
+    backend = "rqbit";
+    flatten = true;
+    inherit (flattened) hash;
+    inherit (sintel) meta;
+  };
+  http-link-rqbit-unflattened = {
+    inherit (http) url;
+    backend = "rqbit";
+    flatten = false;
+    inherit (unflattened) hash;
+    inherit (sintel) meta;
+  };
+  magnet-link-rqbit-unflattened = {
+    inherit (magnet) url;
+    backend = "rqbit";
+    flatten = false;
+    inherit (unflattened) hash;
+    inherit (sintel) meta;
   };
 }

pkgs/by-name/ab/abbaye-des-morts/package.nix

@@ -7,14 +7,14 @@
   SDL2_mixer,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "abbaye-des-morts";
   version = "2.0.5";
 
   src = fetchFromGitHub {
     owner = "nevat";
     repo = "abbayedesmorts-gpl";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     sha256 = "sha256-muJt1cml0nYdgl0v8cudpUXcdSntc49e6zICTCwzkks=";
   };
 
@@ -25,18 +25,17 @@ stdenv.mkDerivation rec {
   ];
 
   makeFlags = [
-    "PREFIX=$(out)"
+    "PREFIX=${placeholder "out"}"
     "DESTDIR="
-  ];
+  ]
+  ++ lib.optional stdenv.isDarwin "PLATFORM=mac";
 
-  preBuild = lib.optionalString stdenv.cc.isClang ''
+  # Even with PLATFORM=mac, the Makefile specifies some GCC-specific CFLAGS that
+  # are not supported by modern Clang on macOS
+  postPatch = lib.optionalString stdenv.isDarwin ''
     substituteInPlace Makefile \
-      --replace -fpredictive-commoning ""
-  '';
-
-  preInstall = ''
-    mkdir -p $out/bin
-    mkdir -p $out/share/applications
+      --replace-fail "-funswitch-loops" "" \
+      --replace-fail "-fgcse-after-reload" ""
   '';
 
   meta = {
@@ -46,4 +45,4 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ marius851000 ];
   };
-}
+})

pkgs/by-name/al/aliyun-cli/package.nix

@@ -8,17 +8,17 @@
 
 buildGoModule rec {
   pname = "aliyun-cli";
-  version = "3.0.292";
+  version = "3.0.294";
 
   src = fetchFromGitHub {
     owner = "aliyun";
     repo = "aliyun-cli";
     tag = "v${version}";
-    hash = "sha256-/bw4ukQRQ7rJLa+Muy7KjgyBh7ffFGSJ/q5Wnd/y7FY=";
+    hash = "sha256-u7a90QObYcsZFLlKoaIanqadxrSaWEVB/FCHFBul/dI=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-pa60hGn1UmzSgmopw+OAFgsL0o7mjEXTpYLAHgdTcMI=";
+  vendorHash = "sha256-Vp7cvIlswhRf1ntZESd7Oabg+xZ4UOFJGD2usRcnnhY=";
 
   subPackages = [ "main" ];
 

pkgs/by-name/an/analyze-build/package.nix

@@ -0,0 +1,46 @@
+{
+  lib,
+  llvmPackages,
+  python3,
+}:
+let
+  inherit (llvmPackages) clang-unwrapped;
+in
+python3.pkgs.buildPythonApplication rec {
+  pname = "analyze-build";
+  inherit (clang-unwrapped) version;
+
+  format = "other";
+
+  src = clang-unwrapped + "/bin";
+
+  dontUnpack = true;
+
+  dependencies = with python3.pkgs; [
+    libscanbuild
+  ];
+
+  installPhase = ''
+    mkdir -p "$out/bin"
+    install "$src/analyze-build" "$out/bin/"
+  '';
+
+  makeWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath [ clang-unwrapped ])
+  ];
+
+  meta = {
+    description = "run Clang static analyzer against a project with compilation database";
+    homepage = "https://github.com/llvm/llvm-project/tree/llvmorg-${version}/clang/tools/scan-build-py/";
+    mainProgram = "scan-build";
+    license = with lib.licenses; [
+      asl20
+      llvm-exception
+    ];
+    maintainers = with lib.maintainers; [ RossSmyth ];
+    platforms = lib.intersectLists python3.meta.platforms clang-unwrapped.meta.platforms;
+  };
+}

pkgs/by-name/ar/archipelago/package.nix

@@ -7,10 +7,10 @@
 }:
 let
   pname = "archipelago";
-  version = "0.6.2";
+  version = "0.6.3";
   src = fetchurl {
     url = "https://github.com/ArchipelagoMW/Archipelago/releases/download/${version}/Archipelago_${version}_linux-x86_64.AppImage";
-    hash = "sha256-DdlfHb8iTCfTGGBUYQeELYh2NF/2GcamtuJzeYb2A5M=";
+    hash = "sha256-PetlGYsdhyvThIFqy+7wbPLAXDcgN2Kcl2WF3rta8PA=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit pname version src; };

pkgs/by-name/ar/argyllcms/package.nix

@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "argyllcms";
-  version = "3.3.0";
+  version = "3.4.0";
 
   src = fetchzip {
     # Kind of flacky URL, it was reaturning 406 and inconsistent binaries for a
     # while on me. It might be good to find a mirror
     url = "https://www.argyllcms.com/Argyll_V${version}_src.zip";
-    hash = "sha256-xpbj15GzpGS0d1UjzvYiZ1nmmTjNIyv0ST2blmi7ZSk=";
+    hash = "sha256-jY6X9mQaP9NTIkbpW5QO31s+5Iv/mFEDgtwDgYXzIU4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ar/arti/package.nix

@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "arti";
-  version = "1.4.4";
+  version = "1.4.6";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
@@ -20,10 +20,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "core";
     repo = "arti";
     tag = "arti-v${finalAttrs.version}";
-    hash = "sha256-mLeiG+503+kuzNUC9Qh2JE1Mm8XEa6CDJYkouzGUJpQ=";
+    hash = "sha256-4HEJiA7FLM3NGV0dcx5aEwky8UTzVLR092b/0HTGCvY=";
   };
 
-  cargoHash = "sha256-mjlrylfQZN8/zei/1enApYryhlv0zlghOPEr86iklg4=";
+  cargoHash = "sha256-ke58MnRYL2ZRck5UKCsGCqiiAZtnOZFTOaoQneP6tV0=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
 

pkgs/by-name/as/asn/package.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "asn";
-  version = "0.78.3";
+  version = "0.78.6";
 
   src = fetchFromGitHub {
     owner = "nitefood";
     repo = "asn";
     tag = "v${version}";
-    hash = "sha256-ydCpCmW6NK3LM05YLw6KtJWo7UtMcsxQt2RH/Xl+bFw=";
+    hash = "sha256-IcAXcsmzxzDUPJp2ieouxfkpdwpOZP6IBTPdm3C5/k4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/as/ast-grep/package.nix

@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ast-grep";
-  version = "0.39.2";
+  version = "0.39.3";
 
   src = fetchFromGitHub {
     owner = "ast-grep";
     repo = "ast-grep";
     tag = finalAttrs.version;
-    hash = "sha256-RfsBgxxb9Kd28hzDXNBNFEwpRchxt+VmSMwc2wRDuig=";
+    hash = "sha256-oUVsfR5azu4i6irCQL1CXCWA8ygIHK+dpWC/grbkSyk=";
   };
 
   # error: linker `aarch64-linux-gnu-gcc` not found
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm .cargo/config.toml
   '';
 
-  cargoHash = "sha256-5SDGkOeByG8SUQJH/89TLuEJeKcu9lu/ZKbudwCAM0o=";
+  cargoHash = "sha256-BX5OAwIZzl9dm7ebw/zyJ2ICVpzCcHUVRTyUDMY4fH0=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/au/audiothekar/package.nix

@@ -38,10 +38,6 @@ buildDotnetModule rec {
 
   passthru = {
     updateScript = ./update.sh;
-    tests.version = testers.testVersion {
-      package = audiothekar;
-      command = "audiothekar-cli --version";
-    };
   };
 
   meta = with lib; {

pkgs/by-name/au/autobase/package.nix

@@ -7,13 +7,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "autobase";
-  version = "7.17.0";
+  version = "7.17.3";
 
   src = fetchFromGitHub {
     owner = "holepunchto";
     repo = "autobase";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KSx9zOnoJouH2sAByG0947uxgqPu9cx3fTbA2MDiMt4=";
+    hash = "sha256-RTbK1U63gNuUN81ceJVjFzqNtg0kfvfq8DiLEpDXJq0=";
   };
 
   npmDepsHash = "sha256-H9Xy1VD7WQvi0+86v6CMcmc0L3mB6KuSCtgQSF4AlkY=";

pkgs/by-name/ba/baresip/package.nix

@@ -31,14 +31,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.24.0";
+  version = "4.0.0";
   pname = "baresip";
 
   src = fetchFromGitHub {
     owner = "baresip";
     repo = "baresip";
     rev = "v${version}";
-    hash = "sha256-32XyMblHF+ST+TpIbdyPFdRtWnIugYMr4lYZnfeFm/c=";
+    hash = "sha256-Kun6fcDy7JQU0zrHfNxv9cV77Bm/WNrgrrGqCzrgTJ4=";
   };
 
   patches = [

pkgs/by-name/ba/bashunit/package.nix

@@ -12,13 +12,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "bashunit";
-  version = "0.22.3";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "TypedDevs";
     repo = "bashunit";
     tag = finalAttrs.version;
-    hash = "sha256-CN3BmsAFRQSkcS97XkKsL9+lChxb7V05iw8xoq0QVZE=";
+    hash = "sha256-sYg5zrB887rliBLdiZ6ZFcK2OVJjpRMO2fT498aOYF0=";
     forceFetchGit = true; # needed to include the tests directory for the check phase
   };
 

pkgs/by-name/be/beeper/package.nix

@@ -9,10 +9,10 @@
 }:
 let
   pname = "beeper";
-  version = "4.1.20";
+  version = "4.1.64";
   src = fetchurl {
     url = "https://beeper-desktop.download.beeper.com/builds/Beeper-${version}.AppImage";
-    hash = "sha256-4sJ61j9/DdZM9mn3JqrvjlWPDb6nN4A4wzQR5lXthxU=";
+    hash = "sha256-8Gd7qSp0/anYLrLCUfq15OacVsKwFVWQxaVvN9xsXkY=";
   };
   appimageContents = appimageTools.extract {
     inherit pname version src;

pkgs/by-name/be/beszel/package.nix

@@ -5,16 +5,15 @@
   nix-update-script,
   buildNpmPackage,
 }:
-
 buildGoModule rec {
   pname = "beszel";
-  version = "0.11.1";
+  version = "0.12.3";
 
   src = fetchFromGitHub {
     owner = "henrygd";
     repo = "beszel";
     tag = "v${version}";
-    hash = "sha256-tAi48PAHDGIZn/HMsnCq0mLpvFSqUOMocq47hooiFT8=";
+    hash = "sha256-rthaufUL0JX3sE2hdrcJ8J73DLK4/2wMR+uOs8GoX2A=";
   };
 
   webui = buildNpmPackage {
@@ -48,12 +47,12 @@ buildGoModule rec {
 
     sourceRoot = "${src.name}/beszel/site";
 
-    npmDepsHash = "sha256-27NUV23dNHFSwOHiB/wGSAWkp6eZMnw/6Pd3Fwn98+s=";
+    npmDepsHash = "sha256-6J1LwRzwbQyXVBHNgG7k8CQ67JZIDqYreDbgfm6B4w4=";
   };
 
   sourceRoot = "${src.name}/beszel";
 
-  vendorHash = "sha256-B6mOqOgcrRn0jV9wnDgRmBvfw7I/Qy5MNYvTiaCgjBE=";
+  vendorHash = "sha256-Nd2jDlq+tdGrgxU6ZNgj9awAb+G/yDqY1J15dpMcjtw=";
 
   preBuild = ''
     mkdir -p site/dist

pkgs/by-name/bi/bilibili/sources.nix

@@ -1,6 +1,6 @@
 # Generated by ./update.sh - do not update manually!
 {
-  version = "1.16.5-4";
-  arm64-hash = "sha256-8APk13cLzhOaPXCpkdX5OLpXM/EV93uR2LHuMaBeUb0=";
-  x86_64-hash = "sha256-S7R4XmBnqyXugwf5henOZG5TzGUw4IrU42SXINm6Wcw=";
+  version = "1.17.0-2";
+  arm64-hash = "sha256-skqxt0IPn3X1ejltxTdT7Xm1zEeFTmyJdxRmNK8+fvY=";
+  x86_64-hash = "sha256-ZYTELa0syIS2fZCNNFHg7WlTh9+Zu7XxSJTAvwavg5w=";
 }

pkgs/by-name/bi/bitwarden-desktop/fix-lock-files.diff

@@ -1,282 +0,0 @@
-diff --git a/apps/cli/package.json b/apps/cli/package.json
-index 2ec4e6f697..db5981b5ec 100644
---- a/apps/cli/package.json
-+++ b/apps/cli/package.json
-@@ -85,7 +85,7 @@
-     "multer": "1.4.5-lts.2",
-     "node-fetch": "2.6.12",
-     "node-forge": "1.3.1",
--    "open": "10.1.2",
-+    "open": "8.4.2",
-     "papaparse": "5.5.3",
-     "proper-lockfile": "4.1.2",
-     "rxjs": "7.8.1",
-diff --git a/apps/desktop/desktop_native/Cargo.lock b/apps/desktop/desktop_native/Cargo.lock
-index 05663ea7e0..eadd75e598 100644
---- a/apps/desktop/desktop_native/Cargo.lock
-+++ b/apps/desktop/desktop_native/Cargo.lock
-@@ -162,7 +162,7 @@ dependencies = [
-  "serde_repr",
-  "tokio",
-  "url",
-- "zbus 5.6.0",
-+ "zbus",
- ]
- 
- [[package]]
-@@ -900,7 +900,7 @@ dependencies = [
-  "widestring",
-  "windows 0.61.1",
-  "windows-future",
-- "zbus 4.4.0",
-+ "zbus",
-  "zbus_polkit",
-  "zeroizing-alloc",
- ]
-@@ -2063,10 +2063,10 @@ dependencies = [
-  "sha2",
-  "subtle",
-  "tokio",
-- "zbus 5.6.0",
-- "zbus_macros 5.6.0",
-+ "zbus",
-+ "zbus_macros",
-  "zeroize",
-- "zvariant 5.5.1",
-+ "zvariant",
- ]
- 
- [[package]]
-@@ -2715,17 +2715,6 @@ dependencies = [
-  "syn",
- ]
- 
--[[package]]
--name = "sha1"
--version = "0.10.6"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
--dependencies = [
-- "cfg-if",
-- "cpufeatures",
-- "digest",
--]
--
- [[package]]
- name = "sha2"
- version = "0.10.8"
-@@ -3921,9 +3910,9 @@ dependencies = [
- 
- [[package]]
- name = "zbus"
--version = "4.4.0"
-+version = "5.5.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "bb97012beadd29e654708a0fdb4c84bc046f537aecfde2c3ee0a9e4b4d48c725"
-+checksum = "59c333f648ea1b647bc95dc1d34807c8e25ed7a6feff3394034dc4776054b236"
- dependencies = [
-  "async-broadcast",
-  "async-executor",
-@@ -3938,90 +3927,37 @@ dependencies = [
-  "enumflags2",
-  "event-listener",
-  "futures-core",
-- "futures-sink",
-- "futures-util",
-- "hex",
-- "nix",
-- "ordered-stream",
-- "rand 0.8.5",
-- "serde",
-- "serde_repr",
-- "sha1",
-- "static_assertions",
-- "tracing",
-- "uds_windows",
-- "windows-sys 0.52.0",
-- "xdg-home",
-- "zbus_macros 4.4.0",
-- "zbus_names 3.0.0",
-- "zvariant 4.2.0",
--]
--
--[[package]]
--name = "zbus"
--version = "5.6.0"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "2522b82023923eecb0b366da727ec883ace092e7887b61d3da5139f26b44da58"
--dependencies = [
-- "async-broadcast",
-- "async-recursion",
-- "async-trait",
-- "enumflags2",
-- "event-listener",
-- "futures-core",
-  "futures-lite",
-  "hex",
-  "nix",
-  "ordered-stream",
-  "serde",
-  "serde_repr",
-+ "static_assertions",
-  "tokio",
-  "tracing",
-  "uds_windows",
-  "windows-sys 0.59.0",
-  "winnow",
-- "zbus_macros 5.6.0",
-- "zbus_names 4.2.0",
-- "zvariant 5.5.1",
-+ "xdg-home",
-+ "zbus_macros",
-+ "zbus_names",
-+ "zvariant",
- ]
- 
- [[package]]
- name = "zbus_macros"
--version = "4.4.0"
-+version = "5.5.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "267db9407081e90bbfa46d841d3cbc60f59c0351838c4bc65199ecd79ab1983e"
-+checksum = "f325ad10eb0d0a3eb060203494c3b7ec3162a01a59db75d2deee100339709fc0"
- dependencies = [
-  "proc-macro-crate",
-  "proc-macro2",
-  "quote",
-  "syn",
-- "zvariant_utils 2.1.0",
--]
--
--[[package]]
--name = "zbus_macros"
--version = "5.6.0"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "05d2e12843c75108c00c618c2e8ef9675b50b6ec095b36dc965f2e5aed463c15"
--dependencies = [
-- "proc-macro-crate",
-- "proc-macro2",
-- "quote",
-- "syn",
-- "zbus_names 4.2.0",
-- "zvariant 5.5.1",
-- "zvariant_utils 3.2.0",
--]
--
--[[package]]
--name = "zbus_names"
--version = "3.0.0"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "4b9b1fef7d021261cc16cba64c351d291b715febe0fa10dc3a443ac5a5022e6c"
--dependencies = [
-- "serde",
-- "static_assertions",
-- "zvariant 4.2.0",
-+ "zbus_names",
-+ "zvariant",
-+ "zvariant_utils",
- ]
- 
- [[package]]
-@@ -4033,20 +3969,20 @@ dependencies = [
-  "serde",
-  "static_assertions",
-  "winnow",
-- "zvariant 5.5.1",
-+ "zvariant",
- ]
- 
- [[package]]
- name = "zbus_polkit"
--version = "4.0.0"
-+version = "5.0.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "00a29bfa927b29f91b7feb4e1990f2dd1b4604072f493dc2f074cf59e4e0ba90"
-+checksum = "ad23d5c4d198c7e2641b33e6e0d1f866f117408ba66fe80bbe52e289eeb77c52"
- dependencies = [
-  "enumflags2",
-  "serde",
-  "serde_repr",
-  "static_assertions",
-- "zbus 4.4.0",
-+ "zbus",
- ]
- 
- [[package]]
-@@ -4149,19 +4085,6 @@ dependencies = [
-  "syn",
- ]
- 
--[[package]]
--name = "zvariant"
--version = "4.2.0"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "2084290ab9a1c471c38fc524945837734fbf124487e105daec2bb57fd48c81fe"
--dependencies = [
-- "endi",
-- "enumflags2",
-- "serde",
-- "static_assertions",
-- "zvariant_derive 4.2.0",
--]
--
- [[package]]
- name = "zvariant"
- version = "5.5.1"
-@@ -4173,21 +4096,8 @@ dependencies = [
-  "serde",
-  "url",
-  "winnow",
-- "zvariant_derive 5.5.1",
-- "zvariant_utils 3.2.0",
--]
--
--[[package]]
--name = "zvariant_derive"
--version = "4.2.0"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "73e2ba546bda683a90652bac4a279bc146adad1386f25379cf73200d2002c449"
--dependencies = [
-- "proc-macro-crate",
-- "proc-macro2",
-- "quote",
-- "syn",
-- "zvariant_utils 2.1.0",
-+ "zvariant_derive",
-+ "zvariant_utils",
- ]
- 
- [[package]]
-@@ -4200,18 +4110,7 @@ dependencies = [
-  "proc-macro2",
-  "quote",
-  "syn",
-- "zvariant_utils 3.2.0",
--]
--
--[[package]]
--name = "zvariant_utils"
--version = "2.1.0"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "c51bcff7cc3dbb5055396bcf774748c3dab426b4b8659046963523cee4808340"
--dependencies = [
-- "proc-macro2",
-- "quote",
-- "syn",
-+ "zvariant_utils",
- ]
- 
- [[package]]
-diff --git a/package-lock.json b/package-lock.json
-index 5df63a79dd..702b6d1c81 100644
---- a/package-lock.json
-+++ b/package-lock.json
-@@ -225,7 +225,7 @@
-         "multer": "1.4.5-lts.2",
-         "node-fetch": "2.6.12",
-         "node-forge": "1.3.1",
--        "open": "10.1.2",
-+        "open": "8.4.2",
-         "papaparse": "5.5.3",
-         "proper-lockfile": "4.1.2",
-         "rxjs": "7.8.1",

pkgs/by-name/bi/bitwarden-desktop/package.nix

@@ -14,7 +14,7 @@
   makeWrapper,
   napi-rs-cli,
   nix-update-script,
-  nodejs_20,
+  nodejs_22,
   pkg-config,
   rustc,
   rustPlatform,
@@ -34,20 +34,18 @@ let
 in
 buildNpmPackage' rec {
   pname = "bitwarden-desktop";
-  version = "2025.6.1";
+  version = "2025.7.0";
 
   src = fetchFromGitHub {
     owner = "bitwarden";
     repo = "clients";
     rev = "desktop-v${version}";
-    hash = "sha256-dYeq0YkQwmRve++RcMWnAuJyslaTZ4VIV4V/lMgSauQ=";
+    hash = "sha256-i1osaSK2Nnjnt2j/bS6VEMi4j5UvEEHf+RVt0901DvA=";
   };
 
   patches = [
     ./electron-builder-package-lock.patch
     ./dont-auto-setup-biometrics.patch
-    # The nixpkgs tooling trips over upstreams inconsistent lock files, so we fixed them by running npm install open@10.2.1 and cargo b
-    ./fix-lock-files.diff
 
     # ensures `app.getPath("exe")` returns our wrapper, not ${electron}/bin/electron
     ./set-exe-path.patch
@@ -67,9 +65,12 @@ buildNpmPackage' rec {
     # will open releases page instead of trying to update files
     substituteInPlace apps/desktop/src/main/updater.main.ts \
       --replace-fail 'this.canUpdate =' 'this.canUpdate = false; let _dummy ='
+
+    # unneeded for desktop, and causes errors
+    rm -r apps/cli
   '';
 
-  nodejs = nodejs_20;
+  nodejs = nodejs_22;
 
   makeCacheWritable = true;
   npmFlags = [
@@ -82,7 +83,7 @@ buildNpmPackage' rec {
     "--ignore-scripts"
   ];
   npmWorkspace = "apps/desktop";
-  npmDepsHash = "sha256-yzOz1X75Wz/NwjlGHL439bEek082vJBL/9imnla3SyU=";
+  npmDepsHash = "sha256-NnkT+NO3zUI71w9dSinnPeJbOlWBA4IHAxnMlYUmOT4=";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit
@@ -92,7 +93,7 @@ buildNpmPackage' rec {
       cargoRoot
       patches
       ;
-    hash = "sha256-mt7zWKgH21khAIrfpBFzb+aS2V2mV56zMqCSLzDhGfQ=";
+    hash = "sha256-nhQUUj7Hz21fnbhqrQL4eYInPNlNLVgbkWylWMRJkAk=";
   };
   cargoRoot = "apps/desktop/desktop_native";
 

pkgs/by-name/bl/blade-formatter/package.nix

@@ -16,18 +16,18 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "blade-formatter";
-  version = "1.43.0";
+  version = "1.44.2";
 
   src = fetchFromGitHub {
     owner = "shufo";
     repo = "blade-formatter";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jxRC7VYApAZrC/1b2r5cc9OCQ9/mA8ttizA4v0SY4U8=";
+    hash = "sha256-FrP+D7SYUPSn82TIRGh9mo/ZpbYxmiTOKagbl/9D7Hk=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-pWa2gI3RiZd5BJ2KJQHKH6+KBJasIVV5xnIoFi8jzlg=";
+    hash = "sha256-XUd1p9AQXVUtADERNcHY7pHkMCr2g7+N/Dy7z4hL0g4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/bo/bolt-launcher/package.nix

@@ -38,14 +38,14 @@ in
 let
   bolt = stdenv.mkDerivation (finalAttrs: {
     pname = "bolt-launcher";
-    version = "0.18.0";
+    version = "0.19.0";
 
     src = fetchFromGitHub {
       owner = "AdamCake";
       repo = "bolt";
       tag = finalAttrs.version;
       fetchSubmodules = true;
-      hash = "sha256-S9SZ9UfohEHfwmXmHsTeSW45BHTJA4wPdFQXsX3Pk34=";
+      hash = "sha256-RTLlNB6eiesXZayC69hpnXQsAgmPuaJTC+18Q6KzAP0=";
     };
 
     nativeBuildInputs = [

pkgs/by-name/bo/bootdev-cli/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "bootdev-cli";
-  version = "1.19.2";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "bootdotdev";
     repo = "bootdev";
     tag = "v${version}";
-    hash = "sha256-jTI91t/gcEdOc3mwP0dFqL5sYeaC6nD96+RpuQfAf4s=";
+    hash = "sha256-Hm8fvY50stoeQE3A2HeMsL/uDo8+Y4zQx/Zv/ksi7gg=";
   };
 
   vendorHash = "sha256-jhRoPXgfntDauInD+F7koCaJlX4XDj+jQSe/uEEYIMM=";

pkgs/by-name/bo/boxflat/package.nix

@@ -14,14 +14,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "boxflat";
-  version = "1.34.2";
+  version = "1.34.2-1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Lawstorant";
     repo = "boxflat";
     tag = "v${version}";
-    hash = "sha256-u1rhZfYCQC0qm79cMCCBvlHC4F9rwkL6X72rylPhJwE=";
+    hash = "sha256-A18YhQp4USFQ4xoyR1Zc0o0fs5mVFVrvfbdPWvo1NXw=";
   };
 
   build-system = [ python3Packages.setuptools ];

pkgs/by-name/bu/bun/package.nix

@@ -17,7 +17,7 @@
 }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "1.2.19";
+  version = "1.2.20";
   pname = "bun";
 
   src =
@@ -87,19 +87,19 @@ stdenvNoCC.mkDerivation rec {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-Z0pIN4NC76rcPCkVlrVzAQ88I4iVj3xEZ42H9vt1mZE=";
+        hash = "sha256-QE9abdH2BLQOs7FW1Bl7uNOYuybgrkyKyOeqSQ9+I18=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-/P1HHNvVp4/Uo5DinMzSu3AEpJ01K6A3rzth1P1dC4M=";
+        hash = "sha256-mNLgssCUIVaRcrTUa2+BN4wtvdd0gOuyfzmJ3U5y4Ys=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64-baseline.zip";
-        hash = "sha256-7CE3X3nul26pjI7wn+KnijCkibQxWUd13amCgPexEGQ=";
+        hash = "sha256-li1ZeAHkLjxi+/b2O/8edqoaRxpYluvYMZeC8QzgiWE=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-w9PBTppeyD/2fQrP525DFa0G2p809Z/HsTgTeCyvH2Y=";
+        hash = "sha256-Tp7cTLoMfBYjooi+AeU7veEaTQc/LPM5yrAmYnhYtUg=";
       };
     };
     updateScript = writeShellScript "update-bun" ''

pkgs/by-name/ca/calamares-nixos-extensions/package.nix

@@ -1,26 +1,25 @@
 {
   stdenv,
-  fetchFromGitHub,
   lib,
+  glibcLocales,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "calamares-nixos-extensions";
   version = "0.3.23";
 
-  src = fetchFromGitHub {
-    owner = "NixOS";
-    repo = "calamares-nixos-extensions";
-    rev = finalAttrs.version;
-    hash = "sha256-KNRztajU7sTLNDwCwP4WOdR2IRMqfbeapdko58LcrjM=";
-  };
+  src = ./src;
 
   installPhase = ''
     runHook preInstall
-    mkdir -p $out/{lib,share}/calamares
+    mkdir -p $out/{etc,lib,share}/calamares
     cp -r modules $out/lib/calamares/
-    cp -r config/* $out/share/calamares/
+    cp -r config/* $out/etc/calamares/
     cp -r branding $out/share/calamares/
+
+    substituteInPlace $out/etc/calamares/settings.conf --replace-fail @out@ $out
+    substituteInPlace $out/etc/calamares/modules/locale.conf --replace-fail @glibcLocales@ ${glibcLocales}
+
     runHook postInstall
   '';
 
@@ -28,11 +27,10 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Calamares modules for NixOS";
     homepage = "https://github.com/NixOS/calamares-nixos-extensions";
     license = with licenses; [
-      gpl3Plus
-      bsd2
+      mit
+      # assets
       cc-by-40
       cc-by-sa-40
-      cc0
     ];
     maintainers = with maintainers; [ vlinkz ];
     platforms = platforms.linux;

pkgs/by-name/ca/calamares-nixos-extensions/src/branding/nixos/branding.desc

@@ -0,0 +1,233 @@
+# SPDX-FileCopyrightText: no
+# SPDX-License-Identifier: CC0-1.0
+#
+---
+componentName:  nixos
+
+
+### WELCOME / OVERALL WORDING
+#
+# These settings affect some overall phrasing and looks,
+# which are most visible in the welcome page.
+
+# This selects between different welcome texts. When false, uses
+# the traditional "Welcome to the %1 installer.", and when true,
+# uses "Welcome to the Calamares installer for %1." This allows
+# to distinguish this installer from other installers for the
+# same distribution.
+welcomeStyleCalamares:   false
+
+# Should the welcome image (productWelcome, below) be scaled
+# up beyond its natural size? If false, the image does not grow
+# with the window but remains the same size throughout (this
+# may have surprising effects on HiDPI monitors).
+welcomeExpandingLogo:   true
+
+### WINDOW CONFIGURATION
+#
+# The settings here affect the placement of the Calamares
+# window through hints to the window manager and initial
+# sizing of the Calamares window.
+
+# Size and expansion policy for Calamares.
+#  - "normal" or unset, expand as needed, use *windowSize*
+#  - "fullscreen", start as large as possible, ignore *windowSize*
+#  - "noexpand", don't expand automatically, use *windowSize*
+windowExpanding:    normal
+
+# Size of Calamares window, expressed as w,h. Both w and h
+# may be either pixels (suffix px) or font-units (suffix em).
+#   e.g.    "800px,600px"
+#           "60em,480px"
+# This setting is ignored if "fullscreen" is selected for
+# *windowExpanding*, above. If not set, use constants defined
+# in CalamaresUtilsGui, 800x520.
+windowSize: 800px,520px
+
+# Placement of Calamares window. Either "center" or "free".
+# Whether "center" actually works does depend on the window
+# manager in use (and only makes sense if you're not using
+# *windowExpanding* set to "fullscreen").
+windowPlacement: center
+
+### PANELS CONFIGURATION
+#
+# Calamares has a main content area, and two panels (navigation
+# and progress / sidebar). The panels can be controlled individually,
+# or switched off. If both panels are switched off, the layout of
+# the main content area loses its margins, on the assumption that
+# you're doing something special.
+
+# Kind of sidebar (panel on the left, showing progress).
+#  - "widget" or unset, use traditional sidebar (logo, items)
+#  - "none", hide it entirely
+#  - "qml", use calamares-sidebar.qml from branding folder
+# In addition, you **may** specify a side, separated by a comma,
+# from the kind. Valid sides are:
+#  - "left" (if not specified, uses this)
+#  - "right"
+#  - "top"
+#  - "bottom"
+# For instance, "widget,right" is valid; so is "qml", which defaults
+# to putting the sidebar on the left. Also valid is "qml,top".
+# While "widget,top" is valid, the widgets code is **not** flexible
+# and results will be terrible.
+sidebar: widget
+
+# Kind of navigation (button panel on the bottom).
+#  - "widget" or unset, use traditional navigation
+#  - "none", hide it entirely
+#  - "qml", use calamares-navigation.qml from branding folder
+# In addition, you **may** specify a side, separated by a comma,
+# from the kind. The same sides are valid as for *sidebar*,
+# except the default is *bottom*.
+navigation: widget
+
+
+### STRINGS, IMAGES AND COLORS
+#
+# This section contains the "branding proper" of names
+# and images, rather than global-look settings.
+
+# These are strings shown to the user in the user interface.
+# There is no provision for translating them -- since they
+# are names, the string is included as-is.
+#
+# The four Url strings are the Urls used by the buttons in
+# the welcome screen, and are not shown to the user. Clicking
+# on the "Support" button, for instance, opens the link supportUrl.
+# If a Url is empty, the corresponding button is not shown.
+#
+# bootloaderEntryName is how this installation / distro is named
+# in the boot loader (e.g. in the GRUB menu).
+#
+# These strings support substitution from /etc/os-release
+# if KDE Frameworks 5.58 are available at build-time. When
+# enabled, ${varname} is replaced by the equivalent value
+# from os-release. All the supported var-names are in all-caps,
+# and are listed on the FreeDesktop.org site,
+#       https://www.freedesktop.org/software/systemd/man/os-release.html
+# Note that ANSI_COLOR and CPE_NAME don't make sense here, and
+# are not supported (the rest are). Remember to quote the string
+# if it contains substitutions, or you'll get YAML exceptions.
+#
+# The *Url* entries are used on the welcome page, and they
+# are visible as buttons there if the corresponding *show* keys
+# are set to "true" (they can also be overridden).
+strings:
+    productName:         "${NAME}"
+    shortProductName:    NixOS
+    version:
+    shortVersion:
+    versionedName:       NixOS
+    shortVersionedName:  NixOS
+    bootloaderEntryName: NixOS
+    productUrl:          https://nixos.org/
+    supportUrl:          https://nixos.org/manual/nixos
+    knownIssuesUrl:      https://github.com/NixOS/nixpkgs/issues
+    releaseNotesUrl:     https://nixos.org/manual/nixos/stable/release-notes.html
+    donateUrl:           https://nixos.org/donate.html
+
+# These images are loaded from the branding module directory.
+#
+# productBanner is an optional image, which if present, will be shown
+#       on the welcome page of the application, above the welcome text.
+#       It is intended to have a width much greater than height.
+#       It is displayed at 64px height (also on HiDPI).
+#       Recommended size is 64px tall, and up to 460px wide.
+# productIcon is used as the window icon, and will (usually) be used
+#       by the window manager to represent the application. This image
+#       should be square, and may be displayed by the window manager
+#       as small as 16x16 (but possibly larger).
+# productLogo is used as the logo at the top of the left-hand column
+#       which shows the steps to be taken. The image should be square,
+#       and is displayed at 80x80 pixels (also on HiDPI).
+# productWallpaper is an optional image, which if present, will replace
+#       the normal solid background on every page of the application.
+#       It can be any size and proportion,
+#       and will be tiled to fit the entire window.
+#       For a non-tiled wallpaper, the size should be the same as
+#       the overall window, see *windowSize* above (800x520).
+# productWelcome is shown on the welcome page of the application in
+#       the middle of the window, below the welcome text. It can be
+#       any size and proportion, and will be scaled to fit inside
+#       the window. Use `welcomeExpandingLogo` to make it non-scaled.
+#       Recommended size is 320x150.
+#
+# These filenames can also use substitutions from os-release (see above).
+images:
+    # productBanner:       "banner.png"
+    productIcon:         "nix-snowflake.svg"
+    productLogo:         "white.png"
+    # productWallpaper:    "wallpaper.png"
+    productWelcome:      "nix-snowflake.svg"
+
+# Colors for text and background components.
+#
+#  - SidebarBackground is the background of the sidebar
+#  - SidebarText is the (foreground) text color
+#  - SidebarBackgroundCurrent sets the background of the current step.
+#    Optional, and defaults to the application palette.
+#  - SidebarTextCurrent is the text color of the current step.
+#
+# These colors can **also** be set through the stylesheet, if the
+# branding component also ships a stylesheet.qss. Then they are
+# the corresponding CSS attributes of #sidebarApp.
+style:
+   SidebarBackground:        "#5277C3"
+   SidebarText:              "#FFFFFF"
+   SidebarTextCurrent:       "#292F34"
+   SidebarBackgroundCurrent: "#7EBAE4"
+
+### SLIDESHOW
+#
+# The slideshow is displayed during execution steps (e.g. when the
+# installer is actually writing to disk and doing other slow things).
+
+# The slideshow can be a QML file (recommended) which can display
+# arbitrary things -- text, images, animations, or even play a game --
+# during the execution step. The QML **is** abruptly stopped when the
+# execution step is done, though, so maybe a game isn't a great idea.
+#
+# The slideshow can also be a sequence of images (not recommended unless
+# you don't want QML at all in your Calamares). The images are displayed
+# at a rate of 1 every 2 seconds during the execution step.
+#
+# To configure a QML file, list a single filename:
+#   slideshow:               "show.qml"
+# To configure images, like the filenames (here, as an inline list):
+#   slideshow: [ "/etc/calamares/slideshow/0.png", "/etc/logo.png" ]
+slideshow:               "show.qml"
+
+# There are two available APIs for a QML slideshow:
+#  - 1 (the default) loads the entire slideshow when the installation-
+#      slideshow page is shown and starts the QML then. The QML
+#      is never stopped (after installation is done, times etc.
+#      continue to fire).
+#  - 2 loads the slideshow on startup and calls onActivate() and
+#      onLeave() in the root object. After the installation is done,
+#      the show is stopped (first by calling onLeave(), then destroying
+#      the QML components).
+#
+# An image slideshow does not need to have the API defined.
+slideshowAPI: 2
+
+
+# These options are to customize online uploading of logs to pastebins:
+#  - type      : Defines the kind of pastebin service to be used. Currently
+#                it accepts two values:
+#                - none    :    disables the pastebin functionality
+#                - fiche   :    use fiche pastebin server
+#  - url       : Defines the address of pastebin service to be used.
+#                Takes string as input. Important bits are the host and port,
+#                the scheme is not used.
+#  - sizeLimit : Defines maximum size limit (in KiB) of log file to be pasted.
+#                The option must be set, to have the log option work.
+#                Takes integer as input. If < 0, no limit will be forced,
+#                else only last (approximately) 'n' KiB of log file will be pasted.
+#                Please note that upload size may be slightly over the limit (due
+#                to last minute logging), so provide a suitable value.
+uploadServer :
+    type :    "fiche"
+    url :     "http://termbin.com:9999"
+    sizeLimit : -1

pkgs/by-name/ca/calamares-nixos-extensions/src/branding/nixos/nix-snowflake.svg

@@ -0,0 +1,513 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:xlink="http://www.w3.org/1999/xlink"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="141.5919mm"
+   height="122.80626mm"
+   viewBox="0 0 501.70361 435.14028"
+   id="svg2"
+   version="1.1"
+   inkscape:version="0.92.0 r15299"
+   sodipodi:docname="nix-snowflake.svg">
+  <defs
+     id="defs4">
+    <linearGradient
+       inkscape:collect="always"
+       id="linearGradient5562">
+      <stop
+         style="stop-color:#699ad7;stop-opacity:1"
+         offset="0"
+         id="stop5564" />
+      <stop
+         id="stop5566"
+         offset="0.24345198"
+         style="stop-color:#7eb1dd;stop-opacity:1" />
+      <stop
+         style="stop-color:#7ebae4;stop-opacity:1"
+         offset="1"
+         id="stop5568" />
+    </linearGradient>
+    <linearGradient
+       inkscape:collect="always"
+       id="linearGradient5053">
+      <stop
+         style="stop-color:#415e9a;stop-opacity:1"
+         offset="0"
+         id="stop5055" />
+      <stop
+         id="stop5057"
+         offset="0.23168644"
+         style="stop-color:#4a6baf;stop-opacity:1" />
+      <stop
+         style="stop-color:#5277c3;stop-opacity:1"
+         offset="1"
+         id="stop5059" />
+    </linearGradient>
+    <linearGradient
+       id="linearGradient5960"
+       inkscape:collect="always">
+      <stop
+         id="stop5962"
+         offset="0"
+         style="stop-color:#637ddf;stop-opacity:1" />
+      <stop
+         style="stop-color:#649afa;stop-opacity:1"
+         offset="0.23168644"
+         id="stop5964" />
+      <stop
+         id="stop5966"
+         offset="1"
+         style="stop-color:#719efa;stop-opacity:1" />
+    </linearGradient>
+    <linearGradient
+       inkscape:collect="always"
+       id="linearGradient5867">
+      <stop
+         style="stop-color:#7363df;stop-opacity:1"
+         offset="0"
+         id="stop5869" />
+      <stop
+         id="stop5871"
+         offset="0.23168644"
+         style="stop-color:#6478fa;stop-opacity:1" />
+      <stop
+         style="stop-color:#719efa;stop-opacity:1"
+         offset="1"
+         id="stop5873" />
+    </linearGradient>
+    <linearGradient
+       y2="515.97058"
+       x2="282.26105"
+       y1="338.62445"
+       x1="213.95642"
+       gradientTransform="translate(983.36076,601.38885)"
+       gradientUnits="userSpaceOnUse"
+       id="linearGradient5855"
+       xlink:href="#linearGradient5960"
+       inkscape:collect="always" />
+    <linearGradient
+       y2="515.97058"
+       x2="282.26105"
+       y1="338.62445"
+       x1="213.95642"
+       gradientTransform="translate(-197.75174,-337.1451)"
+       gradientUnits="userSpaceOnUse"
+       id="linearGradient5855-8"
+       xlink:href="#linearGradient5867"
+       inkscape:collect="always" />
+    <linearGradient
+       y2="247.58188"
+       x2="-702.75317"
+       y1="102.74675"
+       x1="-775.20807"
+       gradientTransform="translate(983.36076,601.38885)"
+       gradientUnits="userSpaceOnUse"
+       id="linearGradient4544"
+       xlink:href="#linearGradient5960"
+       inkscape:collect="always" />
+    <clipPath
+       id="clipPath4501"
+       clipPathUnits="userSpaceOnUse">
+      <circle
+         r="241.06563"
+         cy="686.09473"
+         cx="335.13995"
+         id="circle4503"
+         style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#adadad;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate" />
+    </clipPath>
+    <clipPath
+       id="clipPath5410"
+       clipPathUnits="userSpaceOnUse">
+      <circle
+         r="241.13741"
+         cy="340.98975"
+         cx="335.98114"
+         id="circle5412"
+         style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#ffffff;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate" />
+    </clipPath>
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient5053"
+       id="linearGradient5137"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="translate(864.55062,-2197.497)"
+       x1="-584.19934"
+       y1="782.33563"
+       x2="-496.29703"
+       y2="937.71399" />
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient5053"
+       id="linearGradient5147"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="translate(864.55062,-2197.497)"
+       x1="-584.19934"
+       y1="782.33563"
+       x2="-496.29703"
+       y2="937.71399" />
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient5562"
+       id="linearGradient5162"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="translate(70.505061,-1761.3076)"
+       x1="200.59668"
+       y1="351.41116"
+       x2="290.08701"
+       y2="506.18814" />
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient5562"
+       id="linearGradient5172"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="translate(70.505061,-1761.3076)"
+       x1="200.59668"
+       y1="351.41116"
+       x2="290.08701"
+       y2="506.18814" />
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient5562"
+       id="linearGradient5182"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="translate(70.505061,-1761.3076)"
+       x1="200.59668"
+       y1="351.41116"
+       x2="290.08701"
+       y2="506.18814" />
+    <linearGradient
+       y2="506.18814"
+       x2="290.08701"
+       y1="351.41116"
+       x1="200.59668"
+       gradientTransform="translate(70.505061,-1761.3076)"
+       gradientUnits="userSpaceOnUse"
+       id="linearGradient5201"
+       xlink:href="#linearGradient5562"
+       inkscape:collect="always" />
+    <linearGradient
+       y2="937.71399"
+       x2="-496.29703"
+       y1="782.33563"
+       x1="-584.19934"
+       gradientTransform="translate(864.55062,-2197.497)"
+       gradientUnits="userSpaceOnUse"
+       id="linearGradient5205"
+       xlink:href="#linearGradient5053"
+       inkscape:collect="always" />
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient5562"
+       id="linearGradient4328"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="translate(70.650339,-1055.1511)"
+       x1="200.59668"
+       y1="351.41116"
+       x2="290.08701"
+       y2="506.18814" />
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient5053"
+       id="linearGradient4330"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="translate(864.69589,-1491.3405)"
+       x1="-584.19934"
+       y1="782.33563"
+       x2="-496.29703"
+       y2="937.71399" />
+  </defs>
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="0.98318225"
+     inkscape:cx="113.58176"
+     inkscape:cy="-45.193301"
+     inkscape:document-units="px"
+     inkscape:current-layer="layer3"
+     showgrid="false"
+     inkscape:window-width="2560"
+     inkscape:window-height="1577"
+     inkscape:window-x="0"
+     inkscape:window-y="0"
+     inkscape:window-maximized="1"
+     inkscape:snap-global="true"
+     fit-margin-top="0"
+     fit-margin-left="0"
+     fit-margin-right="0"
+     fit-margin-bottom="0" />
+  <metadata
+     id="metadata7">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title />
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     inkscape:groupmode="layer"
+     id="layer7"
+     inkscape:label="bg"
+     style="display:none"
+     transform="translate(-23.75651,-24.84972)">
+    <rect
+       transform="translate(-132.5822,958.04022)"
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#ffffff;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       id="rect5389"
+       width="1543.4283"
+       height="483.7439"
+       x="132.5822"
+       y="-957.77832" />
+  </g>
+  <g
+     inkscape:groupmode="layer"
+     id="layer6"
+     inkscape:label="logo-guide"
+     style="display:none"
+     transform="translate(-156.33871,933.1905)">
+    <rect
+       y="-958.02759"
+       x="132.65129"
+       height="484.30399"
+       width="550.41602"
+       id="rect5379"
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#5c201e;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       inkscape:export-filename="/home/tim/dev/nix/homepage/logo/nix-wiki.png"
+       inkscape:export-xdpi="22.07"
+       inkscape:export-ydpi="22.07" />
+    <rect
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#c24a46;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       id="rect5372"
+       width="501.94415"
+       height="434.30405"
+       x="156.12303"
+       y="-933.02759"
+       inkscape:export-filename="/home/tim/dev/nix/homepage/logo/nixos-logo-only-hires-print.png"
+       inkscape:export-xdpi="212.2"
+       inkscape:export-ydpi="212.2" />
+    <rect
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#d98d8a;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       id="rect5381"
+       width="24.939611"
+       height="24.939611"
+       x="658.02826"
+       y="-958.04022" />
+  </g>
+  <g
+     inkscape:label="print-logo"
+     inkscape:groupmode="layer"
+     id="layer1"
+     style="display:inline"
+     transform="translate(-156.33871,933.1905)"
+     sodipodi:insensitive="true">
+    <path
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#5277c3;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       d="m 309.40365,-710.2521 122.19683,211.6751 -56.15706,0.5268 -32.6236,-56.8692 -32.85645,56.5653 -27.90237,-0.011 -14.29086,-24.6896 46.81047,-80.4902 -33.22946,-57.8256 z"
+       id="path4861"
+       inkscape:connector-curvature="0"
+       sodipodi:nodetypes="cccccccccc" />
+    <path
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#7ebae4;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       d="m 353.50926,-797.4433 -122.21756,211.6631 -28.53477,-48.37 32.93839,-56.6875 -65.41521,-0.1719 -13.9414,-24.1698 14.23637,-24.721 93.11177,0.2939 33.46371,-57.6903 z"
+       id="use4863"
+       inkscape:connector-curvature="0"
+       sodipodi:nodetypes="cccccccccc" />
+    <path
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#7ebae4;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       d="m 362.88537,-628.243 244.41439,0.012 -27.62229,48.8968 -65.56199,-0.1817 32.55876,56.7371 -13.96098,24.1585 -28.52722,0.032 -46.3013,-80.7841 -66.69317,-0.1353 z"
+       id="use4865"
+       inkscape:connector-curvature="0"
+       sodipodi:nodetypes="cccccccccc" />
+    <path
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#7ebae4;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       d="m 505.14318,-720.9886 -122.19683,-211.6751 56.15706,-0.5268 32.6236,56.8692 32.85645,-56.5653 27.90237,0.011 14.29086,24.6896 -46.81047,80.4902 33.22946,57.8256 z"
+       id="use4867"
+       inkscape:connector-curvature="0"
+       sodipodi:nodetypes="cccccccccc" />
+    <path
+       sodipodi:nodetypes="cccccccccc"
+       inkscape:connector-curvature="0"
+       id="path4873"
+       d="m 309.40365,-710.2521 122.19683,211.6751 -56.15706,0.5268 -32.6236,-56.8692 -32.85645,56.5653 -27.90237,-0.011 -14.29086,-24.6896 46.81047,-80.4902 -33.22946,-57.8256 z"
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#5277c3;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate" />
+    <path
+       sodipodi:nodetypes="cccccccccc"
+       inkscape:connector-curvature="0"
+       id="use4875"
+       d="m 451.3364,-803.53264 -244.4144,-0.012 27.62229,-48.89685 65.56199,0.18175 -32.55875,-56.73717 13.96097,-24.15851 28.52722,-0.0315 46.3013,80.78414 66.69317,0.13524 z"
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#5277c3;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate" />
+    <path
+       sodipodi:nodetypes="cccccccccc"
+       inkscape:connector-curvature="0"
+       id="use4877"
+       d="m 460.87178,-633.8425 122.21757,-211.66304 28.53477,48.37003 -32.93839,56.68751 65.4152,0.1718 13.9414,24.1698 -14.23636,24.7211 -93.11177,-0.294 -33.46371,57.6904 z"
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#5277c3;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate" />
+    <g
+       id="layer2"
+       inkscape:label="guides"
+       style="display:none"
+       transform="translate(72.039038,-1799.4476)">
+      <path
+         d="M 460.60629,594.72881 209.74183,594.7288 84.309616,377.4738 209.74185,160.21882 l 250.86446,1e-5 125.43222,217.255 z"
+         inkscape:randomized="0"
+         inkscape:rounded="0"
+         inkscape:flatsided="true"
+         sodipodi:arg2="1.5707963"
+         sodipodi:arg1="1.0471976"
+         sodipodi:r2="217.25499"
+         sodipodi:r1="250.86446"
+         sodipodi:cy="377.47382"
+         sodipodi:cx="335.17407"
+         sodipodi:sides="6"
+         id="path6032"
+         style="color:#000000;display:inline;overflow:visible;visibility:visible;opacity:0.23600003;fill:#4e4d52;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;enable-background:accumulate"
+         sodipodi:type="star" />
+      <path
+         transform="translate(0,-308.26772)"
+         sodipodi:type="star"
+         style="color:#000000;display:inline;overflow:visible;visibility:visible;opacity:1;fill:#4e4d52;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;enable-background:accumulate"
+         id="path5875"
+         sodipodi:sides="6"
+         sodipodi:cx="335.17407"
+         sodipodi:cy="685.74158"
+         sodipodi:r1="100.83495"
+         sodipodi:r2="87.32563"
+         sodipodi:arg1="1.0471976"
+         sodipodi:arg2="1.5707963"
+         inkscape:flatsided="true"
+         inkscape:rounded="0"
+         inkscape:randomized="0"
+         d="m 385.59154,773.06721 -100.83495,0 -50.41747,-87.32564 50.41748,-87.32563 100.83495,10e-6 50.41748,87.32563 z" />
+      <path
+         transform="translate(0,-308.26772)"
+         sodipodi:nodetypes="ccccccccc"
+         inkscape:connector-curvature="0"
+         id="path5851"
+         d="m 1216.5591,938.53395 123.0545,228.14035 -42.6807,-1.2616 -43.4823,-79.7725 -39.6506,80.3267 -32.6875,-19.7984 53.4737,-100.2848 -37.1157,-73.88955 z"
+         style="fill:url(#linearGradient5855);fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+      <rect
+         style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:0.41499999;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#c53a3a;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+         id="rect5884"
+         width="48.834862"
+         height="226.22897"
+         x="-34.74221"
+         y="446.17056"
+         transform="rotate(-30)" />
+      <path
+         transform="translate(0,-308.26772)"
+         sodipodi:type="star"
+         style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:0.50899999;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#000000;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+         id="path3428"
+         sodipodi:sides="6"
+         sodipodi:cx="223.93674"
+         sodipodi:cy="878.63831"
+         sodipodi:r1="28.048939"
+         sodipodi:r2="24.291094"
+         sodipodi:arg1="0"
+         sodipodi:arg2="0.52359878"
+         inkscape:flatsided="true"
+         inkscape:rounded="0"
+         inkscape:randomized="0"
+         d="m 251.98568,878.63831 -14.02447,24.29109 h -28.04894 l -14.02447,-24.29109 14.02447,-24.2911 h 28.04894 z" />
+      <use
+         x="0"
+         y="0"
+         xlink:href="#rect5884"
+         id="use4252"
+         transform="rotate(60,268.29786,489.4515)"
+         width="100%"
+         height="100%" />
+      <rect
+         style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#000000;fill-opacity:0.6507937;fill-rule:evenodd;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker:none;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+         id="rect4254"
+         width="5.3947482"
+         height="115.12564"
+         x="545.71014"
+         y="467.07007"
+         transform="rotate(30,575.23539,-154.13386)" />
+    </g>
+  </g>
+  <g
+     inkscape:groupmode="layer"
+     id="layer3"
+     inkscape:label="gradient-logo"
+     style="display:inline;opacity:1"
+     sodipodi:insensitive="true"
+     transform="translate(-156.33871,933.1905)">
+    <path
+       sodipodi:nodetypes="cccccccccc"
+       inkscape:connector-curvature="0"
+       id="path3336-6"
+       d="m 309.54892,-710.38827 122.19683,211.67512 -56.15706,0.5268 -32.6236,-56.8692 -32.85645,56.5653 -27.90237,-0.011 -14.29086,-24.6896 46.81047,-80.4901 -33.22946,-57.8257 z"
+       style="opacity:1;fill:url(#linearGradient4328);fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1" />
+    <use
+       height="100%"
+       width="100%"
+       transform="rotate(60,407.11155,-715.78724)"
+       id="use3439-6"
+       inkscape:transform-center-y="151.59082"
+       inkscape:transform-center-x="124.43045"
+       xlink:href="#path3336-6"
+       y="0"
+       x="0" />
+    <use
+       height="100%"
+       width="100%"
+       transform="rotate(-60,407.31177,-715.70016)"
+       id="use3445-0"
+       inkscape:transform-center-y="75.573958"
+       inkscape:transform-center-x="-168.20651"
+       xlink:href="#path3336-6"
+       y="0"
+       x="0" />
+    <use
+       height="100%"
+       width="100%"
+       transform="rotate(180,407.41868,-715.7565)"
+       id="use3449-5"
+       inkscape:transform-center-y="-139.94592"
+       inkscape:transform-center-x="59.669705"
+       xlink:href="#path3336-6"
+       y="0"
+       x="0" />
+    <path
+       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:url(#linearGradient4330);fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:3;stroke-linecap:butt;stroke-linejoin:round;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
+       d="m 309.54892,-710.38827 122.19683,211.67512 -56.15706,0.5268 -32.6236,-56.8692 -32.85645,56.5653 -27.90237,-0.011 -14.29086,-24.6896 46.81047,-80.4901 -33.22946,-57.8256 z"
+       id="path4260-0"
+       inkscape:connector-curvature="0"
+       sodipodi:nodetypes="cccccccccc" />
+    <use
+       height="100%"
+       width="100%"
+       transform="rotate(120,407.33916,-716.08356)"
+       id="use4354-5"
+       xlink:href="#path4260-0"
+       y="0"
+       x="0"
+       style="display:inline" />
+    <use
+       height="100%"
+       width="100%"
+       transform="rotate(-120,407.28823,-715.86995)"
+       id="use4362-2"
+       xlink:href="#path4260-0"
+       y="0"
+       x="0"
+       style="display:inline" />
+  </g>
+</svg>

pkgs/by-name/ca/calamares-nixos-extensions/src/branding/nixos/notesqml@unfree.qml

@@ -0,0 +1,34 @@
+import io.calamares.core
+
+import QtQuick
+import QtQuick.Controls
+import QtQuick.Layouts
+import org.kde.kirigami as Kirigami
+
+Page {
+    width: parent.width
+    height: parent.height
+
+    ColumnLayout {
+        width: parent.width
+        spacing: Kirigami.Units.smallSpacing
+
+        Column {
+            Layout.fillWidth: true
+
+            Text {
+                text: qsTr("NixOS is fully open source, but it also provides optional software packages that do not respect users' freedom to run, copy, distribute, study, change and improve the software, and are commonly not open source. By default such \"unfree\" packages are not allowed, but you can enable it here. If you check this box, you agree that unfree software may be installed which might have additional End User License Agreements (EULAs) that you need to agree to. If not enabled, some hardware (notably Nvidia GPUs and some WiFi chips) might not work or not work optimally.<br/>")
+                width: parent.width
+                wrapMode: Text.WordWrap
+            }
+
+            CheckBox {
+                text: qsTr("Allow unfree software")
+
+                onCheckedChanged: {
+                    Global.insert("nixos_allow_unfree", checked)
+                }
+            }
+        }
+    }
+}

pkgs/by-name/ca/calamares-nixos-extensions/src/branding/nixos/show.qml

@@ -0,0 +1,122 @@
+import QtQuick 2.0;
+import calamares.slideshow 1.0;
+
+Presentation
+{
+    id: presentation
+
+    function nextSlide() {
+        presentation.goToNextSlide();
+    }
+
+    Timer {
+        id: advanceTimer
+        interval: 20000
+        running: presentation.activatedInCalamares
+        repeat: true
+        onTriggered: nextSlide()
+    }
+
+    Slide {
+        Text {
+            id: text1
+            anchors.centerIn: parent
+            text: "Reproducible"
+            font.pixelSize: 30
+            wrapMode: Text.WordWrap
+            width: presentation.width
+            horizontalAlignment: Text.Center
+            color: "#6586C8"
+        }
+        Image {
+            id: background1
+            source: "gfx-landing-reproducible.png"
+            width: 200; height: 200
+            fillMode: Image.PreserveAspectFit
+            anchors.bottom: text1.top
+            anchors.horizontalCenter: parent.horizontalCenter
+        }
+        Text {
+            anchors.horizontalCenter: background1.horizontalCenter
+            anchors.top: text1.bottom
+            text: "Nix builds packages in isolation from each other.<br/>"+
+                  "This ensures that they are reproducible and don't<br/>"+
+                  "have undeclared dependencies, so <b>if a package<br/>"+
+                  "works on one machine, it will also work on another.</b>"
+            wrapMode: Text.WordWrap
+            width: presentation.width
+            horizontalAlignment: Text.Center
+        }
+    }
+
+    Slide {
+        Text {
+            id: text2
+            anchors.centerIn: parent
+            text: "Declarative"
+            font.pixelSize: 30
+            wrapMode: Text.WordWrap
+            width: presentation.width
+            horizontalAlignment: Text.Center
+            color: "#6586C8"
+        }
+        Image {
+            id: background2
+            source: "gfx-landing-declarative.png"
+            width: 200; height: 200
+            fillMode: Image.PreserveAspectFit
+            anchors.bottom: text2.top
+            anchors.horizontalCenter: parent.horizontalCenter
+        }
+        Text {
+            anchors.horizontalCenter: background2.horizontalCenter
+            anchors.top: text2.bottom
+            text: "Nix makes it <b>trivial to share development and build<br/>"+
+                  "environments</b> for your projects, regardless of what<br/>"+
+                  "programming languages and tools you’re using."
+            wrapMode: Text.WordWrap
+            width: presentation.width
+            horizontalAlignment: Text.Center
+        }
+    }
+
+    Slide {
+        Text {
+            id: text3
+            anchors.centerIn: parent
+            text: "Reliable"
+            font.pixelSize: 30
+            wrapMode: Text.WordWrap
+            width: presentation.width
+            horizontalAlignment: Text.Center
+            color: "#6586C8"
+        }
+        Image {
+            id: background3
+            source: "gfx-landing-reliable.png"
+            width: 200; height: 200
+            fillMode: Image.PreserveAspectFit
+            anchors.bottom: text3.top
+            anchors.horizontalCenter: parent.horizontalCenter
+        }
+        Text {
+            anchors.horizontalCenter: background3.horizontalCenter
+            anchors.top: text3.bottom
+            text: "Nix ensures that installing or upgrading one package<br/>"+
+                  "<b>cannot break other packages.</b> It allows you to <b>roll<br/>"+
+                  "back to previous versions,</b> and ensures that no<br/>"+
+                  "package is in an inconsistent state during an<br/>"+
+                  "upgrade."
+            wrapMode: Text.WordWrap
+            width: presentation.width
+            horizontalAlignment: Text.Center
+        }
+    }
+
+    function onActivate() {
+        presentation.currentSlide = 0;
+    }
+
+    function onLeave() {
+    }
+}

pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/finished.conf

@@ -0,0 +1,4 @@
+# https://codeberg.org/Calamares/calamares/src/branch/calamares/src/modules/finished/finished.conf
+restartNowMode: user-unchecked
+restartNowCommand: "systemctl -i reboot"
+notifyOnFinished: true

pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/keyboard.conf

@@ -0,0 +1,7 @@
+# https://codeberg.org/Calamares/calamares/src/branch/calamares/src/modules/keyboard/keyboard.conf
+xOrgConfFileName: "/etc/X11/xorg.conf.d/00-keyboard.conf"
+writeEtcDefaultKeyboard: false
+
+# Use special code path to configure GNOME keyboard settings
+configure:
+    gnome: true

pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/locale.conf

@@ -0,0 +1,11 @@
+# https://codeberg.org/Calamares/calamares/src/branch/calamares/src/modules/locale/locale.conf
+useSystemTimezone: true
+
+# Isn't supported on NixOS
+adjustLiveTimezone: false
+
+localeGenPath: @glibcLocales@/share/i18n/SUPPORTED
+
+geoip:
+    style: "json"
+    url: "https://geoip.kde.org/v1/calamares"

pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/mount.conf

@@ -0,0 +1,27 @@
+# https://codeberg.org/Calamares/calamares/src/branch/calamares/src/modules/mount/mount.conf
+extraMounts:
+    - device: proc
+      fs: proc
+      mountPoint: /proc
+    - device: sys
+      fs: sysfs
+      mountPoint: /sys
+    - device: /dev
+      mountPoint: /dev
+      options: [ bind ]
+    - device: tmpfs
+      fs: tmpfs
+      mountPoint: /run
+    - device: /run/udev
+      mountPoint: /run/udev
+      options: [ bind ]
+    - device: efivarfs
+      fs: efivarfs
+      mountPoint: /sys/firmware/efi/efivars
+      efi: true
+
+# Ensure the right fmask/dmask is set on the ESP, as it will be
+# picked up by nixos-generate-config later
+mountOptions:
+    - filesystem: efi
+      options: [ fmask=0077, dmask=0077 ]

pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/packagechooser.conf

@@ -0,0 +1,105 @@
+# https://codeberg.org/Calamares/calamares/src/branch/calamares/src/modules/packagechooser/packagechooser.conf
+mode: required
+
+# FIXME: what's the correct way of doing this now?
+method: legacy
+
+labels:
+    step: "Desktop"
+
+default: gnome
+
+items:
+    - id: gnome
+      packages: [ gnome ]
+      name: GNOME
+      description: "<html>Every part of GNOME has been designed to make it simple and easy to use. It provides a focused working environment that helps you get things done. GNOME is a popular choice and well tested on NixOS.<br/>
+                    <br/>
+                    Learn more at <a href=\"https://www.gnome.org/\">gnome.org</a></html>"
+      screenshot: "images/gnome.png"
+
+    - id: plasma6
+      packages: [ plasma6 ]
+      name: Plasma
+      description: "<html>Plasma is made to stay out of the way as it helps you get things done. But under its light and intuitive surface, it's a highly customizable. So you're free to choose ways of usage right as you need them and when you need them. Plasma is a popular choice and well tested on NixOS.<br/>
+                    <br/>
+                    Learn more at <a href=\"https://kde.org/plasma-desktop/\">kde.org/plasma-desktop</a></html>"
+      screenshot: "images/plasma6.png"
+
+    - id: xfce
+      packages: [ xfce ]
+      name: Xfce
+      description: "<html>Xfce is a lightweight desktop environment. It aims to be fast and low on system resources, while still being visually appealing and user friendly.<br/>
+                    <br/>
+                    Learn more at <a href=\"https://www.xfce.org/\">xfce.org</a></html>"
+      screenshot: "images/xfce.png"
+
+    - id: pantheon
+      packages: [ pantheon ]
+      name: Pantheon
+      description: "<html>Pantheon is the default desktop of Elementary OS. It provides a productive and intuitive user experience while also being visually appealing.<br/>
+                    <br/>
+                    Learn more at <a href=\"https://elementary.io/docs/learning-the-basics\">elementary.io/docs/learning-the-basics</a></html>"
+      screenshot: "images/pantheon.png"
+
+    - id: cinnamon
+      packages: [ cinnamon ]
+      name: Cinnamon
+      description: "<html>Cinnamon is a desktop which provides advanced innovative features and a traditional user experience. The emphasis is put on making users feel at home and providing them with an easy to use and comfortable desktop experience.<br/>
+                    <br/>
+                    Learn more at <a href=\"https://projects.linuxmint.com/cinnamon/\">projects.linuxmint.com/cinnamon</a></html>"
+      screenshot: "images/cinnamon.png"
+
+    - id: mate
+      packages: [ mate ]
+      name: MATE
+      description: "<html>The MATE Desktop Environment is the continuation of GNOME 2. It provides an intuitive and attractive desktop environment.<br/>
+                    <br/>
+                    Learn more at <a href=\"https://mate-desktop.org/\">mate-desktop.org</a></html>"
+      screenshot: "images/mate.png"
+
+    - id: enlightenment
+      packages: [ enlightenment ]
+      name: Enlightenment
+      description: "<html>Enlightenment is a Window Manager, Compositor and Minimal Desktop. Enlightenment is classed as a desktop shell as it provides everything you need to operate your desktop or laptop, but it is not a full application suite.<br/>
+                    <br/>
+                    Learn more at <a href=\"https://www.enlightenment.org/\">enlightenment.org</a></html>"
+      screenshot: "images/enlightenment.png"
+
+    - id: lxqt
+      packages: [ lxqt ]
+      name: LXQt
+      description: "<html>LXQt is a lightweight Qt desktop environment. It will not get in your way. It will not hang or slow down your system. It is focused on being a classic desktop with a modern look and feel.<br/>
+                    <br/>
+                    Learn more at <a href=\"https://lxqt-project.org/\">lxqt-project.org</a></html>"
+      screenshot: "images/lxqt.png"
+
+    # Lumina is not yet stable enough, once it is, simply uncommenting the lines below is all that's needed to enable it as an option
+    #- id: lumina
+    #  packages: [ lumina ]
+    #  name: Lumina
+    #  description: "<html>Lumina is designed to have a small footprint, giving your system the best performance possible. It is built to flow seamlessly between computer tasks and offers several integrated utilities in one convenient package.<br/>
+    #                - Learn more at <a href=\"https://lumina-desktop.org/\">lumina-desktop.org</a></html>"
+    #  screenshot: "images/lumina.png"
+
+    - id: budgie
+      packages: [ budgie ]
+      name: Budgie
+      description: "<html>The Budgie Desktop is a feature-rich, modern desktop designed to keep out the way of the user.<br/>
+                    <br/>
+                    Learn more at <a href=\"https://docs.buddiesofbudgie.org/\">buddiesofbudgie.org</a></html>"
+      screenshot: "images/budgie.png"
+
+    - id: deepin
+      packages: [ deepin ]
+      name: Deepin
+      description: "<html>The Deepin Desktop Environment is an elegant, easy to use and reliable desktop environment.<br/>
+                    <br/>
+                    Learn more at <a href=\"https://www.deepin.org/\">deepin.org</a></html>"
+      screenshot: "images/deepin.png"
+
+    - id: ""
+      packages: []
+      name: "No desktop"
+      screenshot: "images/nodesktop.png"
+      description: "A minimal system without a graphical user interface will be installed. This is great for servers or custom setups with window managers. The configuration can be changed after installation."

pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/partition.conf

@@ -0,0 +1,22 @@
+# https://codeberg.org/Calamares/calamares/src/branch/calamares/src/modules/partition/partition.conf
+efi:
+    mountPoint: "/boot"
+    recommendedSize: 1GiB
+    minimumSize: 32MiB
+    label: "EFI"
+
+userSwapChoices:
+    - none
+    - small
+    - suspend
+
+luksGeneration: luks2
+
+showNotEncryptedBootMessage: false
+
+partitionLayout:
+    - name: "root"
+      filesystem: "ext4"
+      noEncrypt: false
+      mountPoint: "/"
+      size: 100%

pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/unfree.conf

@@ -0,0 +1,5 @@
+---
+qmlSearch: branding
+
+qmlLabel:
+    notes: "Unfree software"

pkgs/by-name/ca/calamares-nixos-extensions/src/config/modules/users.conf

@@ -0,0 +1,32 @@
+# https://codeberg.org/Calamares/calamares/src/branch/calamares/src/modules/users/users.conf
+defaultGroups:
+    - users
+    - networkmanager
+    - wheel
+
+setRootPassword: true
+doReusePassword: false
+doAutologin: false
+
+# Recommended libpwquality settings from upstream
+passwordRequirements:
+    minLength: 8
+    maxLength: 64
+    libpwquality:
+        - minlen=8
+        - maxrepeat=3
+        - maxsequence=3
+        - usersubstr=4
+        - badwords=linux
+
+allowWeakPasswords: true
+allowWeakPasswordsDefault: false
+
+user:
+  shell: /run/current-system/sw/bin/bash
+  forbidden_names: [ root ]
+
+hostname:
+  location: None
+  writeHostsFile: false
+  forbidden_names: [ localhost ]