Merge cb26667f94 into haskell-updates

.git-blame-ignore-revs

@@ -235,3 +235,6 @@ ef85e0daa092c9eae0d32c7ce16b889728a5fbc0
 d89ad6c70e0e89aaae75e9f886878ea4e103965a
 e0fe216f4912dd88a021d12a44155fd2cfeb31c8
 80d5b411f6397d5c3e755a0635d95742f76f3c75
+
+# nixos/movim: format with nixfmt-rfc-style
+43c1654cae47cbf987cb63758c06245fa95c1e3b

doc/build-helpers/testers.chapter.md

@@ -165,6 +165,64 @@ testers.shellcheck {
 A derivation that runs `shellcheck` on the given script(s).
 The build will fail if `shellcheck` finds any issues.
 
+## `shfmt` {#tester-shfmt}
+
+Run files through `shfmt`, a shell script formatter, failing if any files are reformatted.
+
+:::{.example #ex-shfmt}
+# Run `testers.shfmt`
+
+A single script
+
+```nix
+testers.shfmt {
+  name = "script";
+  src = ./script.sh;
+}
+```
+
+Multiple files
+
+```nix
+let
+  inherit (lib) fileset;
+in
+testers.shfmt {
+  name = "nixbsd";
+  src = fileset.toSource {
+    root = ./.;
+    fileset = fileset.unions [
+      ./lib.sh
+      ./nixbsd-activate
+    ];
+  };
+}
+```
+
+:::
+
+### Inputs {#tester-shfmt-inputs}
+
+`name` (string)
+: The name of the test.
+  `name` is required because it massively improves traceability of test failures.
+  The name of the derivation produced by the tester is `shfmt-${name}`.
+
+`src` (path-like)
+: The path to the shell script(s) to check.
+  This can be a single file or a directory containing shell files.
+  All files in `src` will be checked, so you may want to provide `fileset`-based source instead of a whole directory.
+
+`indent` (integer, optional)
+: The number of spaces to use for indentation.
+  Defaults to `2`.
+  A value of `0` indents with tabs.
+
+### Return value {#tester-shfmt-return}
+
+A derivation that runs `shfmt` on the given script(s), producing an empty output upon success.
+The build will fail if `shfmt` reformats anything.
+
 ## `testVersion` {#tester-testVersion}
 
 Checks that the output from running a command contains the specified version string in it as a whole word.
@@ -347,6 +405,97 @@ testers.testEqualContents {
 
 :::
 
+## `testEqualArrayOrMap` {#tester-testEqualArrayOrMap}
+
+Check that bash arrays (including associative arrays, referred to as "maps") are populated correctly.
+
+This can be used to ensure setup hooks are registered in a certain order, or to write unit tests for shell functions which transform arrays.
+
+:::{.example #ex-testEqualArrayOrMap-test-function-add-cowbell}
+
+# Test a function which appends a value to an array
+
+```nix
+testers.testEqualArrayOrMap {
+  name = "test-function-add-cowbell";
+  valuesArray = [
+    "cowbell"
+    "cowbell"
+  ];
+  expectedArray = [
+    "cowbell"
+    "cowbell"
+    "cowbell"
+  ];
+  script = ''
+    addCowbell() {
+      local -rn arrayNameRef="$1"
+      arrayNameRef+=( "cowbell" )
+    }
+
+    nixLog "appending all values in valuesArray to actualArray"
+    for value in "''${valuesArray[@]}"; do
+      actualArray+=( "$value" )
+    done
+
+    nixLog "applying addCowbell"
+    addCowbell actualArray
+  '';
+}
+```
+
+:::
+
+### Inputs {#tester-testEqualArrayOrMap-inputs}
+
+NOTE: Internally, this tester uses `__structuredAttrs` to handle marshalling between Nix expressions and shell variables.
+This imposes the restriction that arrays and "maps" have values which are string-like.
+
+NOTE: At least one of `expectedArray` and `expectedMap` must be provided.
+
+`name` (string)
+
+: The name of the test.
+
+`script` (string)
+
+: The singular task of `script` is to populate `actualArray` or `actualMap` (it may populate both).
+  To do this, `script` may access the following shell variables:
+
+  - `valuesArray` (available when `valuesArray` is provided to the tester)
+  - `valuesMap` (available when `valuesMap` is provided to the tester)
+  - `actualArray` (available when `expectedArray` is provided to the tester)
+  - `actualMap` (available when `expectedMap` is provided to the tester)
+
+  While both `expectedArray` and `expectedMap` are in scope during the execution of `script`, they *must not* be accessed or modified from within `script`.
+
+`valuesArray` (array of string-like values, optional)
+
+: An array of string-like values.
+  This array may be used within `script`.
+
+`valuesMap` (attribute set of string-like values, optional)
+
+: An attribute set of string-like values.
+  This attribute set may be used within `script`.
+
+`expectedArray` (array of string-like values, optional)
+
+: An array of string-like values.
+  This array *must not* be accessed or modified from within `script`.
+  When provided, `script` is expected to populate `actualArray`.
+
+`expectedMap` (attribute set of string-like values, optional)
+
+: An attribute set of string-like values.
+  This attribute set *must not* be accessed or modified from within `script`.
+  When provided, `script` is expected to populate `actualMap`.
+
+### Return value {#tester-testEqualArrayOrMap-return}
+
+The tester produces an empty output and only succeeds when `expectedArray` and `expectedMap` match `actualArray` and `actualMap`, respectively, when non-null.
+The build log will contain differences encountered.
+
 ## `testEqualDerivation` {#tester-testEqualDerivation}
 
 Checks that two packages produce the exact same build instructions.

doc/redirects.json

@@ -8,9 +8,15 @@
   "ex-build-helpers-extendMkDerivation": [
     "index.html#ex-build-helpers-extendMkDerivation"
   ],
+  "ex-shfmt": [
+    "index.html#ex-shfmt"
+  ],
   "ex-testBuildFailurePrime-doc-example": [
     "index.html#ex-testBuildFailurePrime-doc-example"
   ],
+  "ex-testEqualArrayOrMap-test-function-add-cowbell": [
+    "index.html#ex-testEqualArrayOrMap-test-function-add-cowbell"
+  ],
   "neovim": [
     "index.html#neovim"
   ],
@@ -335,6 +341,15 @@
   "footnote-stdenv-find-inputs-location.__back.0": [
     "index.html#footnote-stdenv-find-inputs-location.__back.0"
   ],
+  "tester-shfmt": [
+    "index.html#tester-shfmt"
+  ],
+  "tester-shfmt-inputs": [
+    "index.html#tester-shfmt-inputs"
+  ],
+  "tester-shfmt-return": [
+    "index.html#tester-shfmt-return"
+  ],
   "tester-testBuildFailurePrime": [
     "index.html#tester-testBuildFailurePrime"
   ],
@@ -344,6 +359,15 @@
   "tester-testBuildFailurePrime-return": [
     "index.html#tester-testBuildFailurePrime-return"
   ],
+  "tester-testEqualArrayOrMap": [
+    "index.html#tester-testEqualArrayOrMap"
+  ],
+  "tester-testEqualArrayOrMap-inputs": [
+    "index.html#tester-testEqualArrayOrMap-inputs"
+  ],
+  "tester-testEqualArrayOrMap-return": [
+    "index.html#tester-testEqualArrayOrMap-return"
+  ],
   "variables-specifying-dependencies": [
     "index.html#variables-specifying-dependencies"
   ],

doc/release-notes/rl-2505.section.md

@@ -26,6 +26,13 @@
   It should generally be replaced with `rustPlatform.fetchCargoVendor`, but `rustPlatform.importCargoLock` may also be appropriate in some circumstances.
   `rustPlatform.buildRustPackage` users must set `useFetchCargoVendor` to `true` and regenerate the `cargoHash`.
 
+- NetBox was updated to `>= 4.2.0`. Have a look at the breaking changes
+  of the [4.1 release](https://github.com/netbox-community/netbox/releases/tag/v4.1.0)
+  and the [4.2 release](https://github.com/netbox-community/netbox/releases/tag/v4.2.0),
+  make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_2;` in your configuration.
+
+- NetBox version 4.0.X available as `netbox_4_0` was removed. Please upgrade to `4.2`.
+
 - Default ICU version updated from 74 to 76
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/doc/manual/redirects.json

@@ -1289,6 +1289,12 @@
   "module-services-foundationdb-full-docs": [
     "index.html#module-services-foundationdb-full-docs"
   ],
+  "module-service-umurmur": [
+    "index.html#module-service-umurmur"
+  ],
+  "module-service-umurmur-quick-start": [
+    "index.html#module-service-umurmur-quick-start"
+  ],
   "module-borgbase": [
     "index.html#module-borgbase"
   ],

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -80,6 +80,8 @@
 
 - [Yggdrasil-Jumper](https://github.com/one-d-wide/yggdrasil-jumper) is an independent project that aims to transparently reduce latency of a connection over Yggdrasil network, utilizing NAT traversal to automatically bypass intermediary nodes.
 
+- [uMurmur](https://umurmur.net), minimalistic Mumble server primarily targeted to run on embedded computers. Available as [services.umurmur](options.html#opt-services.umurmur).
+
 - [Zenoh](https://zenoh.io/), a pub/sub/query protocol with low overhead. The Zenoh router daemon is available as [services.zenohd](options.html#opt-services.zenohd.enable)
 
 - [ytdl-sub](https://github.com/jmbannon/ytdl-sub), a tool that downloads media via yt-dlp and prepares it for your favorite media player, including Kodi, Jellyfin, Plex, Emby, and modern music players. Available as [services.ytdl-sub](options.html#opt-services.ytdl-sub.instances).
@@ -124,6 +126,8 @@
 
 - [vivid](https://github.com/sharkdp/vivid), a generator for LS_COLOR. Available as [programs.vivid](#opt-programs.vivid.enable).
 
+- [matrix-alertmanager](https://github.com/jaywink/matrix-alertmanager), a bot to receive Alertmanager webhook events and forward them to chosen Matrix rooms. Available as [services.matrix-alertmanager](options.html#opt-services.matrix-alertmanager.enable).
+
 - [waagent](https://github.com/Azure/WALinuxAgent), the Microsoft Azure Linux Agent (waagent) manages Linux provisioning and VM interaction with the Azure Fabric Controller. Available with [services.waagent](options.html#opt-services.waagent.enable).
 
 - [nfc-nci](https://github.com/StarGate01/ifdnfc-nci), an alternative NFC stack and PC/SC driver for the NXP PN54x chipset, commonly found in Lenovo systems as NXP1001 (NPC300). Available as [hardware.nfc-nci](#opt-hardware.nfc-nci.enable).
@@ -313,6 +317,8 @@
 
 - `hardware.pulseaudio` has been renamed to `services.pulseaudio`.  The deprecated option names will continue to work, but causes a warning.
 
+- `services.nextcloud` now uses systemd's credential mechanism to read in secret files. The `nextcloud-occ` wrapper script implements this using `systemd-run`, as such it now also requires root privileges or `$CREDENTIALS_DIRECTORY` set where running it as user `nextcloud` was enough previously.
+
 - `minetest` has been renamed to `luanti` to match the upstream name change but aliases have been added. The new name hasn't resulted in many changes as of yet but older references to minetest should be sunset. See the [new name announcement](https://blog.minetest.net/2024/10/13/Introducing-Our-New-Name/) for more details.
 
 - `poac` has been renamed to `cabinpkg` to match the upstream name change but an alias has been added. See the [new name announcement](https://github.com/orgs/cabinpkg/discussions/1052) for more details.

nixos/modules/config/users-groups.nix

@@ -557,6 +557,7 @@ let
   sdInitrdGidsAreUnique = idsAreUnique (filterAttrs (n: g: g.gid != null) config.boot.initrd.systemd.groups) "gid";
   groupNames = lib.mapAttrsToList (n: g: g.name) cfg.groups;
   usersWithoutExistingGroup = lib.filterAttrs (n: u: u.group != "" && !lib.elem u.group groupNames) cfg.users;
+  usersWithNullShells = attrNames (filterAttrs (name: cfg: cfg.shell == null) cfg.users);
 
   spec = pkgs.writeText "users-groups.json" (builtins.toJSON {
     inherit (cfg) mutableUsers;
@@ -910,12 +911,21 @@ in {
               ${lib.concatStringsSep "\n  " (map mkConfigHint missingGroups)}
           '';
       }
+      {
+        assertion = !cfg.mutableUsers -> length usersWithNullShells == 0;
+        message = ''
+          users.mutableUsers = false has been set,
+          but found users that have their shell set to null.
+          If you wish to disable login, set their shell to pkgs.shadow (the default).
+          Misconfigured users: ${lib.concatStringsSep " " usersWithNullShells}
+        '';
+      }
       { # If mutableUsers is false, to prevent users creating a
         # configuration that locks them out of the system, ensure that
         # there is at least one "privileged" account that has a
         # password or an SSH authorized key. Privileged accounts are
         # root and users in the wheel group.
-        # The check does not apply when users.disableLoginPossibilityAssertion
+        # The check does not apply when users.allowNoPasswordLogin
         # The check does not apply when users.mutableUsers
         assertion = !cfg.mutableUsers -> !cfg.allowNoPasswordLogin ->
           any id (mapAttrsToList (name: cfg:

nixos/modules/module-list.nix

@@ -742,6 +742,7 @@
   ./services/matrix/dendrite.nix
   ./services/matrix/hebbot.nix
   ./services/matrix/hookshot.nix
+  ./services/matrix/matrix-alertmanager.nix
   ./services/matrix/maubot.nix
   ./services/matrix/mautrix-meta.nix
   ./services/matrix/mautrix-signal.nix
@@ -1315,6 +1316,7 @@
   ./services/networking/trickster.nix
   ./services/networking/twingate.nix
   ./services/networking/ucarp.nix
+  ./services/networking/umurmur.nix
   ./services/networking/unbound.nix
   ./services/networking/unifi.nix
   ./services/networking/uptermd.nix

nixos/modules/programs/wireshark.nix

@@ -16,13 +16,32 @@ in
         type = lib.types.bool;
         default = false;
         description = ''
-          Whether to add Wireshark to the global environment and configure a
-          setcap wrapper for 'dumpcap' for users in the 'wireshark' group.
+          Whether to add Wireshark to the global environment and create a 'wireshark'
+          group. To configure what users can capture, set the `dumpcap.enable` and
+          `usbmon.enable` options. By default, users in the 'wireshark' group are
+          allowed to capture network traffic but not USB traffic.
         '';
       };
       package = lib.mkPackageOption pkgs "wireshark-cli" {
         example = "wireshark";
       };
+      dumpcap.enable = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether to allow users in the 'wireshark' group to capture network traffic. This
+          configures a setcap wrapper for 'dumpcap' for users in the 'wireshark' group.
+        '';
+      };
+      usbmon.enable = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Whether to allow users in the 'wireshark' group to capture USB traffic. This adds
+          udev rules to give users in the 'wireshark' group read permissions to all devices
+          in the usbmon subsystem.
+        '';
+      };
     };
   };
 
@@ -30,12 +49,18 @@ in
     environment.systemPackages = [ wireshark ];
     users.groups.wireshark = { };
 
-    security.wrappers.dumpcap = {
+    security.wrappers.dumpcap = lib.mkIf cfg.dumpcap.enable {
       source = "${wireshark}/bin/dumpcap";
       capabilities = "cap_net_raw,cap_net_admin+eip";
       owner = "root";
       group = "wireshark";
       permissions = "u+rx,g+x";
     };
+
+    services.udev.packages = lib.mkIf cfg.usbmon.enable [
+      (pkgs.writeTextDir "etc/udev/rules.d/85-wireshark-usbmon.rules" ''
+        SUBSYSTEM=="usbmon", MODE="0640", GROUP="wireshark"
+      '')
+    ];
   };
 }

nixos/modules/services/home-automation/evcc.nix

@@ -1,10 +1,19 @@
 {
+  config,
   lib,
   pkgs,
-  config,
+  utils,
   ...
 }:
 let
+  inherit (lib)
+    getExe
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    ;
+
   cfg = config.services.evcc;
 
   format = pkgs.formats.yaml { };
@@ -17,27 +26,40 @@ in
   meta.maintainers = with lib.maintainers; [ hexa ];
 
   options.services.evcc = with lib.types; {
-    enable = lib.mkEnableOption "EVCC, the extensible EV Charge Controller with PV integration";
+    enable = mkEnableOption "EVCC, the extensible EV Charge Controller and Home Energy Management System";
 
-    extraArgs = lib.mkOption {
+    package = mkPackageOption pkgs "evcc" { };
+
+    extraArgs = mkOption {
       type = listOf str;
       default = [ ];
       description = ''
-        Extra arguments to pass to the evcc executable.
+        Extra arguments to pass to the `evcc` executable.
       '';
     };
 
-    settings = lib.mkOption {
+    environmentFile = mkOption {
+      type = nullOr path;
+      default = null;
+      example = /run/keys/evcc;
+      description = ''
+        File with environment variables to pass into the runtime environment.
+
+        Useful to pass secrets into the configuration, that get applied using `envsubst`.
+      '';
+    };
+
+    settings = mkOption {
       type = format.type;
       description = ''
-        evcc configuration as a Nix attribute set.
+        evcc configuration as a Nix attribute set. Supports substitution of secrets using `envsubst` from the `environmentFile`.
 
         Check for possible options in the sample [evcc.dist.yaml](https://github.com/andig/evcc/blob/${package.version}/evcc.dist.yaml).
       '';
     };
   };
 
-  config = lib.mkIf cfg.enable {
+  config = mkIf cfg.enable {
     systemd.services.evcc = {
       wants = [ "network-online.target" ];
       after = [
@@ -52,7 +74,21 @@ in
         getent
       ];
       serviceConfig = {
-        ExecStart = "${package}/bin/evcc --config ${configFile} ${lib.escapeShellArgs cfg.extraArgs}";
+        EnvironmentFile = lib.optionals (cfg.environmentFile != null) [ cfg.environmentFile ];
+        ExecStartPre = utils.escapeSystemdExecArgs [
+          (getExe pkgs.envsubst)
+          "-i"
+          configFile
+          "-o"
+          "/run/evcc/config.yaml"
+        ];
+        ExecStart = utils.escapeSystemdExecArgs (
+          [
+            (getExe cfg.package)
+            "--config=/run/evcc/config.yaml"
+          ]
+          ++ cfg.extraArgs
+        );
         CapabilityBoundingSet = [ "" ];
         DeviceAllow = [
           "char-ttyUSB"
@@ -61,14 +97,6 @@ in
         DynamicUser = true;
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
-        Restart = "on-failure";
-        RestrictAddressFamilies = [
-          "AF_INET"
-          "AF_INET6"
-          "AF_UNIX"
-        ];
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
         PrivateTmp = true;
         PrivateUsers = true;
         ProcSubset = "pid";
@@ -80,6 +108,15 @@ in
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectProc = "invisible";
+        Restart = "on-failure";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RuntimeDirectory = "evcc";
         StateDirectory = "evcc";
         SystemCallArchitectures = "native";
         SystemCallFilter = [

nixos/modules/services/matrix/matrix-alertmanager.nix

@@ -0,0 +1,124 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.matrix-alertmanager;
+  rooms = room: lib.concatStringsSep "/" (room.receivers ++ [ room.roomId ]);
+  concatenatedRooms = lib.concatStringsSep "|" (map rooms cfg.matrixRooms);
+in
+{
+  meta.maintainers = [ lib.maintainers.erethon ];
+
+  options.services.matrix-alertmanager = {
+    enable = lib.mkEnableOption "matrix-alertmanager";
+    package = lib.mkPackageOption pkgs "matrix-alertmanager" { };
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 3000;
+      description = "Port that matrix-alertmanager listens on.";
+    };
+    homeserverUrl = lib.mkOption {
+      type = lib.types.str;
+      description = "URL of the Matrix homeserver to use.";
+      example = "https://matrix.example.com";
+    };
+    matrixUser = lib.mkOption {
+      type = lib.types.str;
+      description = "Matrix user to use for the bot.";
+      example = "@alertmanageruser:example.com";
+    };
+    matrixRooms = lib.mkOption {
+      type = lib.types.listOf (
+        lib.types.submodule {
+          options = {
+            receivers = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              description = "List of receivers for this room";
+            };
+            roomId = lib.mkOption {
+              type = lib.types.str;
+              description = "Matrix room ID";
+              apply =
+                x:
+                assert lib.assertMsg (lib.hasPrefix "!" x) "Matrix room ID must start with a '!'. Got: ${x}";
+                x;
+            };
+          };
+        }
+      );
+      description = ''
+        Combination of Alertmanager receiver(s) and rooms for the bot to join.
+        Each Alertmanager receiver can be mapped to post to a matrix room.
+
+        Note, you must use a room ID and not a room alias/name. Room IDs start
+        with a "!".
+      '';
+      example = [
+        {
+          receivers = [
+            "receiver1"
+            "receiver2"
+          ];
+          roomId = "!roomid@example.com";
+        }
+        {
+          receivers = [ "receiver3" ];
+          roomId = "!differentroomid@example.com";
+        }
+      ];
+    };
+    mention = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Makes the bot mention @room when posting an alert";
+    };
+    tokenFile = lib.mkOption {
+      type = lib.types.pathWith {
+        inStore = false;
+        absolute = true;
+      };
+      description = "File that contains a valid Matrix token for the Matrix user.";
+    };
+    secretFile = lib.mkOption {
+      type = lib.types.pathWith {
+        inStore = false;
+        absolute = true;
+      };
+      description = "File that contains a secret for the Alertmanager webhook.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.matrix-alertmanager = {
+      description = "A bot to receive Alertmanager webhook events and forward them to chosen rooms.";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        DynamicUser = true;
+        Restart = "always";
+        RestartSec = "10s";
+        LoadCredential = [
+          "token:${cfg.tokenFile}"
+          "secret:${cfg.secretFile}"
+        ];
+      };
+
+      environment = {
+        APP_PORT = toString cfg.port;
+        MATRIX_HOMESERVER_URL = cfg.homeserverUrl;
+        MATRIX_ROOMS = concatenatedRooms;
+        MATRIX_USER = cfg.matrixUser;
+        MENTION_ROOM = if cfg.mention then "1" else "0";
+      };
+
+      script = ''
+        export APP_ALERTMANAGER_SECRET=$(cat "''${CREDENTIALS_DIRECTORY}/secret")
+        export MATRIX_TOKEN=$(cat "''${CREDENTIALS_DIRECTORY}/token")
+        exec ${lib.getExe cfg.package}
+      '';
+    };
+  };
+}

nixos/modules/services/networking/umurmur.md

@@ -0,0 +1,33 @@
+# uMurmur {#module-service-umurmur}
+
+[uMurmur](http://umurmur.net/) is a minimalistic Mumble server primarily targeted to run on embedded computers. This module enables it (`umurmurd`).
+
+## Quick Start {#module-service-umurmur-quick-start}
+
+```nix
+{
+  services.umurmur = {
+    enable = true;
+    openFirewall = true;
+    settings = {
+      port = 7365;
+      channels = [
+        {
+          name = "root";
+          parent = "";
+          description = "Root channel. No entry.";
+          noenter = true;
+        }
+        {
+          name = "lobby";
+          parent = "root";
+          description = "Lobby channel";
+        }
+      ];
+      default_channel = "lobby";
+    };
+  };
+}
+```
+
+See a full configuration in [umurmur.conf.example](https://github.com/umurmur/umurmur/blob/master/umurmur.conf.example)

nixos/modules/services/networking/umurmur.nix

@@ -0,0 +1,244 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.umurmur;
+  dumpAttrset =
+    x: top_level:
+    (lib.optionalString (!top_level) "{")
+    + (lib.concatLines (lib.mapAttrsToList (name: value: "${name} = ${toConfigValue value false};") x))
+    + (lib.optionalString (!top_level) "}");
+  dumpList = x: top_level: "(${lib.concatStringsSep ",\n" (map (y: "${toConfigValue y false}") x)})";
+
+  toConfigValue =
+    x: top_level:
+    if builtins.isList x then
+      dumpList x top_level
+    else if builtins.isAttrs x then
+      dumpAttrset x top_level
+    else
+      builtins.toJSON x;
+  dumpCfg = x: toConfigValue x true;
+  configAttrs = lib.filterAttrsRecursive (name: value: value != null) cfg.settings;
+  configFile = pkgs.writeTextFile {
+    name = "umurmur.conf";
+    checkPhase = ''
+      ${lib.getExe cfg.package} -t -c "$target"
+    '';
+    text = "\n" + (dumpCfg configAttrs) + "\n";
+  };
+in
+{
+  options = {
+    services.umurmur = {
+      enable = lib.mkEnableOption "uMurmur Mumble server";
+
+      package = lib.mkPackageOption pkgs "umurmur" { };
+
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Open ports in the firewall for the uMurmur Mumble server.
+        '';
+      };
+
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType =
+            let
+              valueType =
+                with lib.types;
+                oneOf [
+                  bool
+                  int
+                  float
+                  str
+                  path
+                  (listOf (attrsOf valueType))
+                ]
+                // {
+                  description = "uMurmur config value";
+                };
+            in
+            valueType;
+          options = {
+            welcometext = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = "Welcome to uMurmur!";
+              description = "Welcome message for connected clients.";
+            };
+
+            bindaddr = lib.mkOption {
+              type = lib.types.str;
+              default = "0.0.0.0";
+              description = "IPv4 address to bind to. Defaults binding on all addresses.";
+            };
+
+            bindaddr6 = lib.mkOption {
+              type = lib.types.str;
+              default = "::";
+              description = "IPv6 address to bind to. Defaults binding on all addresses.";
+            };
+
+            bindport = lib.mkOption {
+              type = lib.types.port;
+              default = 64739;
+              description = "Port to bind to (UDP and TCP).";
+            };
+
+            password = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+              description = "Required password to join server, if specified.";
+            };
+
+            max_bandwidth = lib.mkOption {
+              type = lib.types.int;
+              default = 48000;
+              description = ''
+                Maximum bandwidth (in bits per second) that clients may send
+                speech at.
+              '';
+            };
+
+            max_users = lib.mkOption {
+              type = lib.types.int;
+              default = 10;
+              description = "Maximum number of concurrent clients allowed.";
+            };
+
+            certificate = lib.mkOption {
+              type = lib.types.str;
+              default = "/var/lib/private/umurmur/cert.crt";
+              description = "Path to your SSL certificate. Generates self-signed automatically if not exists.";
+            };
+
+            private_key = lib.mkOption {
+              type = lib.types.str;
+              default = "/var/lib/private/umurmur/key.key";
+              description = "Path to your SSL key. Generates self-signed automatically if not exists.";
+            };
+
+            ca_path = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+              description = "Path to your SSL CA certificate.";
+            };
+
+            channels = lib.mkOption {
+              type = lib.types.listOf lib.types.attrs;
+              default = [
+                {
+                  name = "root";
+                  parent = "";
+                  description = "Root channel.";
+                  noenter = false;
+                }
+              ];
+              description = "Channel tree definitions.";
+            };
+
+            channel_links = lib.mkOption {
+              type = lib.types.listOf lib.types.attrs;
+              default = [ ];
+              example = [
+                {
+                  source = "Lobby";
+                  destination = "Red team";
+                }
+              ];
+              description = "Channel tree definitions.";
+            };
+
+            default_channel = lib.mkOption {
+              type = lib.types.str;
+              default = "root";
+              description = "The channel in which users will appear in when connecting.";
+            };
+
+          };
+        };
+        default = { };
+        description = "Settings of uMurmur. For reference see https://github.com/umurmur/umurmur/blob/master/umurmur.conf.example";
+      };
+
+      configFile = lib.mkOption rec {
+        type = lib.types.path;
+        default = configFile;
+        description = "Configuration file, default is generated from config.service.umurmur.settings";
+        defaultText = description;
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.settings.bindport ];
+      allowedUDPPorts = [ cfg.settings.bindport ];
+    };
+
+    systemd.services.umurmur = {
+      description = "uMurmur Mumble Server";
+      wants = [ "network.target" ];
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "exec";
+        ExecStart = "${lib.getExe cfg.package} -d -c ${cfg.configFile}";
+        Restart = "on-failure";
+        DynamicUser = true;
+        StateDirectory = "umurmur";
+        ReadWritePaths = "/dev/shm";
+
+        # hardening
+        UMask = 27;
+        MemoryDenyWriteExecute = true;
+        AmbientCapabilities = [ "" ];
+        CapabilityBoundingSet = [ "" ];
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectSystem = "full";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProcSubset = "pid";
+        ProtectProc = "invisible";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@cpu-emulation"
+          "~@debug"
+          "~@mount"
+          "~@obsolete"
+          "~@privileged"
+          "~@resources"
+        ];
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ _3JlOy-PYCCKUi ];
+  meta.doc = ./umurmur.md;
+}

nixos/modules/services/web-apps/movim.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   inherit (lib)
@@ -28,97 +33,123 @@ let
     "opcache.fast_shutdown" = 1;
   };
 
-  phpCfg = generators.toKeyValue
-    { mkKeyValue = generators.mkKeyValueDefault { } " = "; }
-    (defaultPHPCfg // cfg.phpCfg);
+  phpCfg = generators.toKeyValue { mkKeyValue = generators.mkKeyValueDefault { } " = "; } (
+    defaultPHPCfg // cfg.phpCfg
+  );
 
   podConfigFlags =
     let
       bevalue = a: lib.escapeShellArg (generators.mkValueStringDefault { } a);
     in
-    lib.concatStringsSep " "
-      (lib.attrsets.foldlAttrs
-        (acc: k: v: acc ++ lib.optional (v != null) "--${k}=${bevalue v}")
-        [ ]
-        cfg.podConfig);
+    lib.concatStringsSep " " (
+      lib.attrsets.foldlAttrs (
+        acc: k: v:
+        acc ++ lib.optional (v != null) "--${k}=${bevalue v}"
+      ) [ ] cfg.podConfig
+    );
 
   package =
     let
-      p = cfg.package.override
-        ({
+      p = cfg.package.override (
+        {
           inherit phpCfg;
           withPgsql = cfg.database.type == "pgsql";
           withMysql = cfg.database.type == "mysql";
           inherit (cfg) minifyStaticFiles;
-        } // lib.optionalAttrs (lib.isAttrs cfg.minifyStaticFiles) (with cfg.minifyStaticFiles; {
-          esbuild = esbuild.package;
-          lightningcss = lightningcss.package;
-          scour = scour.package;
-        }));
+        }
+        // lib.optionalAttrs (lib.isAttrs cfg.minifyStaticFiles) (
+          with cfg.minifyStaticFiles;
+          {
+            esbuild = esbuild.package;
+            lightningcss = lightningcss.package;
+            scour = scour.package;
+          }
+        )
+      );
     in
-    p.overrideAttrs (finalAttrs: prevAttrs:
+    p.overrideAttrs (
+      finalAttrs: prevAttrs:
       let
         appDir = "$out/share/php/${finalAttrs.pname}";
 
-        stateDirectories = /* sh */ ''
-          # Symlinking in our state directories
-          rm -rf $out/{.env,cache} ${appDir}/{log,public/cache}
-          ln -s ${cfg.dataDir}/.env ${appDir}/.env
-          ln -s ${cfg.dataDir}/public/cache ${appDir}/public/cache
-          ln -s ${cfg.logDir} ${appDir}/log
-          ln -s ${cfg.runtimeDir}/cache ${appDir}/cache
-        '';
+        stateDirectories = # sh
+          ''
+            # Symlinking in our state directories
+            rm -rf $out/{.env,cache} ${appDir}/{log,public/cache}
+            ln -s ${cfg.dataDir}/.env ${appDir}/.env
+            ln -s ${cfg.dataDir}/public/cache ${appDir}/public/cache
+            ln -s ${cfg.logDir} ${appDir}/log
+            ln -s ${cfg.runtimeDir}/cache ${appDir}/cache
+          '';
 
-        exposeComposer = /* sh */ ''
-          # Expose PHP Composer for scripts
-          mkdir -p $out/bin
-          echo "#!${lib.getExe pkgs.dash}" > $out/bin/movim-composer
-          echo "${finalAttrs.php.packages.composer}/bin/composer --working-dir="${appDir}" \"\$@\"" >> $out/bin/movim-composer
-          chmod +x $out/bin/movim-composer
-        '';
+        exposeComposer = # sh
+          ''
+            # Expose PHP Composer for scripts
+            mkdir -p $out/bin
+            echo "#!${lib.getExe pkgs.dash}" > $out/bin/movim-composer
+            echo "${finalAttrs.php.packages.composer}/bin/composer --working-dir="${appDir}" \"\$@\"" >> $out/bin/movim-composer
+            chmod +x $out/bin/movim-composer
+          '';
 
-        podConfigInputDisableReplace = lib.optionalString (podConfigFlags != "")
-          (lib.concatStringsSep "\n"
-            (lib.attrsets.foldlAttrs
-              (acc: k: v:
-                acc ++ lib.optional (v != null)
+        podConfigInputDisableReplace = lib.optionalString (podConfigFlags != "") (
+          lib.concatStringsSep "\n" (
+            lib.attrsets.foldlAttrs (
+              acc: k: v:
+              acc
+              ++
+                lib.optional (v != null)
                   # Disable all Admin panel options that were set in the
                   # `cfg.podConfig` to prevent confusing situtions where the
                   # values are rewritten on server reboot
-                  /* sh */ ''
-                  substituteInPlace ${appDir}/app/Widgets/AdminMain/adminmain.tpl \
-                    --replace-warn 'name="${k}"' 'name="${k}" readonly'
-                '')
-              [ ]
-              cfg.podConfig));
+                  # sh
+                  ''
+                    substituteInPlace ${appDir}/app/Widgets/AdminMain/adminmain.tpl \
+                      --replace-warn 'name="${k}"' 'name="${k}" readonly'
+                  ''
+            ) [ ] cfg.podConfig
+          )
+        );
 
         precompressStaticFilesJobs =
           let
             inherit (cfg.precompressStaticFiles) brotli gzip;
 
-            findTextFileNames = lib.concatStringsSep " -o "
-              (builtins.map (n: ''-iname "*.${n}"'')
-                [ "css" "ini" "js" "json" "manifest" "mjs" "svg" "webmanifest" ]);
+            findTextFileNames = lib.concatStringsSep " -o " (
+              builtins.map (n: ''-iname "*.${n}"'') [
+                "css"
+                "ini"
+                "js"
+                "json"
+                "manifest"
+                "mjs"
+                "svg"
+                "webmanifest"
+              ]
+            );
           in
           lib.concatStringsSep "\n" [
-            (lib.optionalString brotli.enable /* sh */ ''
-              echo -n "Precompressing static files with Brotli …"
-              find ${appDir}/public -type f ${findTextFileNames} -print0 \
-                | xargs -0 -n 1 -P $NIX_BUILD_CORES ${pkgs.writeShellScript "movim_precompress_broti" ''
+            (lib.optionalString brotli.enable # sh
+              ''
+                echo -n "Precompressing static files with Brotli …"
+                find ${appDir}/public -type f ${findTextFileNames} -print0 \
+                  | xargs -0 -n 1 -P $NIX_BUILD_CORES ${pkgs.writeShellScript "movim_precompress_broti" ''
                     file="$1"
                     ${lib.getExe brotli.package} --keep --quality=${builtins.toString brotli.compressionLevel} --output=$file.br $file
                   ''}
-              echo " done."
-            '')
-            (lib.optionalString gzip.enable /* sh */ ''
-              echo -n "Precompressing static files with Gzip …"
-              find ${appDir}/public -type f ${findTextFileNames} -print0 \
-                | xargs -0 -n 1 -P $NIX_BUILD_CORES ${pkgs.writeShellScript "movim_precompress_gzip" ''
+                echo " done."
+              ''
+            )
+            (lib.optionalString gzip.enable # sh
+              ''
+                echo -n "Precompressing static files with Gzip …"
+                find ${appDir}/public -type f ${findTextFileNames} -print0 \
+                  | xargs -0 -n 1 -P $NIX_BUILD_CORES ${pkgs.writeShellScript "movim_precompress_gzip" ''
                     file="$1"
                     ${lib.getExe gzip.package} -c -${builtins.toString gzip.compressionLevel} $file > $file.gz
                   ''}
-              echo " done."
-            '')
+                echo " done."
+              ''
+            )
           ];
       in
       {
@@ -129,7 +160,8 @@ let
           podConfigInputDisableReplace
           precompressStaticFilesJobs
         ];
-      });
+      }
+    );
 
   configFile = pipe cfg.settings [
     (filterAttrsRecursive (_: v: v != null))
@@ -141,10 +173,12 @@ let
   fpm = config.services.phpfpm.pools.${pool};
   phpExecutionUnit = "phpfpm-${pool}";
 
-  dbService = {
-    "postgresql" = "postgresql.service";
-    "mysql" = "mysql.service";
-  }.${cfg.database.type};
+  dbService =
+    {
+      "postgresql" = "postgresql.service";
+      "mysql" = "mysql.service";
+    }
+    .${cfg.database.type};
 in
 {
   options.services = {
@@ -154,7 +188,13 @@ in
       phpPackage = mkPackageOption pkgs "php" { };
 
       phpCfg = mkOption {
-        type = with types; attrsOf (oneOf [ int str bool ]);
+        type =
+          with types;
+          attrsOf (oneOf [
+            int
+            str
+            bool
+          ]);
         defaultText = literalExpression (generators.toPretty { } defaultPHPCfg);
         default = { };
         description = "Extra PHP INI options such as `memory_limit`, `max_execution_time`, etc.";
@@ -214,69 +254,73 @@ in
       };
 
       minifyStaticFiles = mkOption {
-        type = with types; either bool (submodule {
-          options = {
-            script = mkOption {
-              type = types.submodule {
-                options = {
-                  enable = mkEnableOption "Script minification";
-                  package = mkPackageOption pkgs "esbuild" { };
-                  target = mkOption {
-                    type = with types; nullOr nonEmptyStr;
-                    default = null;
+        type =
+          with types;
+          either bool (submodule {
+            options = {
+              script = mkOption {
+                type = types.submodule {
+                  options = {
+                    enable = mkEnableOption "Script minification";
+                    package = mkPackageOption pkgs "esbuild" { };
+                    target = mkOption {
+                      type = with types; nullOr nonEmptyStr;
+                      default = null;
+                    };
+                  };
+                };
+              };
+              style = mkOption {
+                type = types.submodule {
+                  options = {
+                    enable = mkEnableOption "Script minification";
+                    package = mkPackageOption pkgs "lightningcss" { };
+                    target = mkOption {
+                      type = with types; nullOr nonEmptyStr;
+                      default = null;
+                    };
+                  };
+                };
+              };
+              svg = mkOption {
+                type = types.submodule {
+                  options = {
+                    enable = mkEnableOption "SVG minification";
+                    package = mkPackageOption pkgs "scour" { };
                   };
                 };
               };
             };
-            style = mkOption {
-              type = types.submodule {
-                options = {
-                  enable = mkEnableOption "Script minification";
-                  package = mkPackageOption pkgs "lightningcss" { };
-                  target = mkOption {
-                    type = with types; nullOr nonEmptyStr;
-                    default = null;
-                  };
-                };
-              };
-            };
-            svg = mkOption {
-              type = types.submodule {
-                options = {
-                  enable = mkEnableOption "SVG minification";
-                  package = mkPackageOption pkgs "scour" { };
-                };
-              };
-            };
-          };
-        });
+          });
         default = true;
         description = "Do minification on public static files";
       };
 
       precompressStaticFiles = mkOption {
-        type = with types; submodule {
-          options = {
-            brotli = {
-              enable = mkEnableOption "Brotli precompression";
-              package = mkPackageOption pkgs "brotli" { };
-              compressionLevel = mkOption {
-                type = types.ints.between 0 11;
-                default = 11;
-                description = "Brotli compression level";
+        type =
+          with types;
+          submodule {
+            options = {
+              brotli = {
+                enable = mkEnableOption "Brotli precompression";
+                package = mkPackageOption pkgs "brotli" { };
+                compressionLevel = mkOption {
+                  type = types.ints.between 0 11;
+                  default = 11;
+                  description = "Brotli compression level";
+                };
               };
-            };
-            gzip = {
-              enable = mkEnableOption "Gzip precompression";
-              package = mkPackageOption pkgs "gzip" { };
-              compressionLevel = mkOption {
-                type = types.ints.between 1 9;
-                default = 9;
-                description = "Gzip compression level";
+              gzip = {
+                enable = mkEnableOption "Gzip precompression";
+                package = mkPackageOption pkgs "gzip" { };
+                compressionLevel = mkOption {
+                  type = types.ints.between 1 9;
+                  default = 9;
+                  description = "Gzip compression level";
+                };
               };
             };
           };
-        };
         default = {
           brotli.enable = true;
           gzip.enable = false;
@@ -362,7 +406,15 @@ in
       };
 
       settings = mkOption {
-        type = with types; attrsOf (nullOr (oneOf [ int str bool ]));
+        type =
+          with types;
+          attrsOf (
+            nullOr (oneOf [
+              int
+              str
+              bool
+            ])
+          );
         default = { };
         description = ".env settings for Movim. Secrets should use `secretFile` option instead. `null`s will be culled.";
       };
@@ -375,7 +427,10 @@ in
 
       database = {
         type = mkOption {
-          type = types.enum [ "mysql" "postgresql" ];
+          type = types.enum [
+            "mysql"
+            "postgresql"
+          ];
           example = "mysql";
           default = "postgresql";
           description = "Database engine to use.";
@@ -401,20 +456,27 @@ in
       };
 
       nginx = mkOption {
-        type = with types; nullOr (submodule
-          (import ../web-servers/nginx/vhost-options.nix {
-            inherit config lib;
-          }));
+        type =
+          with types;
+          nullOr (
+            submodule (
+              import ../web-servers/nginx/vhost-options.nix {
+                inherit config lib;
+              }
+            )
+          );
         default = null;
-        example = lib.literalExpression /* nginx */ ''
-          {
-            serverAliases = [
-              "pics.''${config.networking.domain}"
-            ];
-            enableACME = true;
-            forceHttps = true;
-          }
-        '';
+        example =
+          lib.literalExpression # nginx
+            ''
+              {
+                serverAliases = [
+                  "pics.''${config.networking.domain}"
+                ];
+                enableACME = true;
+                forceHttps = true;
+              }
+            '';
         description = ''
           With this option, you can customize an nginx virtual host which already has sensible defaults for Movim.
           Set to `{ }` if you do not need any customization to the virtual host.
@@ -424,7 +486,13 @@ in
       };
 
       poolConfig = mkOption {
-        type = with types; attrsOf (oneOf [ int str bool ]);
+        type =
+          with types;
+          attrsOf (oneOf [
+            int
+            str
+            bool
+          ]);
         default = { };
         description = "Options for Movim’s PHP-FPM pool.";
       };
@@ -435,14 +503,16 @@ in
     environment.systemPackages = [ cfg.package ];
 
     users = {
-      users = {
-        movim = mkIf (cfg.user == "movim") {
-          isSystemUser = true;
-          group = cfg.group;
+      users =
+        {
+          movim = mkIf (cfg.user == "movim") {
+            isSystemUser = true;
+            group = cfg.group;
+          };
+        }
+        // lib.optionalAttrs (cfg.nginx != null) {
+          "${config.services.nginx.user}".extraGroups = [ cfg.group ];
         };
-      } // lib.optionalAttrs (cfg.nginx != null) {
-        "${config.services.nginx.user}".extraGroups = [ cfg.group ];
-      };
       groups = {
         ${cfg.group} = { };
       };
@@ -459,10 +529,12 @@ in
             DAEMON_VERBOSE = cfg.verbose;
           }
           (mkIf cfg.database.createLocally {
-            DB_DRIVER = {
-              "postgresql" = "pgsql";
-              "mysql" = "mysql";
-            }.${cfg.database.type};
+            DB_DRIVER =
+              {
+                "postgresql" = "pgsql";
+                "mysql" = "mysql";
+              }
+              .${cfg.database.type};
             DB_HOST = "localhost";
             DB_PORT = config.services.${cfg.database.type}.settings.port;
             DB_DATABASE = cfg.database.name;
@@ -484,16 +556,17 @@ in
         };
       };
 
-      nginx = mkIf (cfg.nginx != null)
-        {
+      nginx =
+        mkIf (cfg.nginx != null) {
           enable = true;
           recommendedOptimisation = mkDefault true;
           recommendedProxySettings = true;
           # TODO: recommended cache options already in Nginx⁇
-          appendHttpConfig = /* nginx */ ''
-            fastcgi_cache_path /tmp/nginx_cache levels=1:2 keys_zone=nginx_cache:100m inactive=60m;
-            fastcgi_cache_key "$scheme$request_method$host$request_uri";
-          '';
+          appendHttpConfig = # nginx
+            ''
+              fastcgi_cache_path /tmp/nginx_cache levels=1:2 keys_zone=nginx_cache:100m inactive=60m;
+              fastcgi_cache_key "$scheme$request_method$host$request_uri";
+            '';
           virtualHosts."${cfg.domain}" = mkMerge [
             cfg.nginx
             {
@@ -501,94 +574,110 @@ in
               locations = {
                 "/favicon.ico" = {
                   priority = 100;
-                  extraConfig = /* nginx */ ''
-                    access_log off;
-                    log_not_found off;
-                  '';
+                  extraConfig = # nginx
+                    ''
+                      access_log off;
+                      log_not_found off;
+                    '';
                 };
                 "/robots.txt" = {
                   priority = 100;
-                  extraConfig = /* nginx */ ''
-                    access_log off;
-                    log_not_found off;
-                  '';
+                  extraConfig = # nginx
+                    ''
+                      access_log off;
+                      log_not_found off;
+                    '';
                 };
                 "~ /\\.(?!well-known).*" = {
                   priority = 210;
-                  extraConfig = /* nginx */ ''
-                    deny all;
-                  '';
+                  extraConfig = # nginx
+                    ''
+                      deny all;
+                    '';
                 };
                 # Ask nginx to cache every URL starting with "/picture"
                 "/picture" = {
                   priority = 400;
                   tryFiles = "$uri $uri/ /index.php$is_args$args";
-                  extraConfig = /* nginx */ ''
-                    set $no_cache 0; # Enable cache only there
-                  '';
+                  extraConfig = # nginx
+                    ''
+                      set $no_cache 0; # Enable cache only there
+                    '';
                 };
                 "/" = {
                   priority = 490;
                   tryFiles = "$uri $uri/ /index.php$is_args$args";
-                  extraConfig = /* nginx */ ''
-                    # https://github.com/movim/movim/issues/314
-                    add_header Content-Security-Policy "default-src 'self'; img-src 'self' aesgcm: https:; media-src 'self' aesgcm: https:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline';";
-                    set $no_cache 1;
-                  '';
+                  extraConfig = # nginx
+                    ''
+                      # https://github.com/movim/movim/issues/314
+                      add_header Content-Security-Policy "default-src 'self'; img-src 'self' aesgcm: https:; media-src 'self' aesgcm: https:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline';";
+                      set $no_cache 1;
+                    '';
                 };
                 "~ \\.php$" = {
                   priority = 500;
                   tryFiles = "$uri =404";
-                  extraConfig = /* nginx */ ''
-                    include ${config.services.nginx.package}/conf/fastcgi.conf;
-                    add_header X-Cache $upstream_cache_status;
-                    fastcgi_ignore_headers "Cache-Control" "Expires" "Set-Cookie";
-                    fastcgi_cache nginx_cache;
-                    fastcgi_cache_valid any 7d;
-                    fastcgi_cache_bypass $no_cache;
-                    fastcgi_no_cache $no_cache;
-                    fastcgi_split_path_info ^(.+\.php)(/.+)$;
-                    fastcgi_index index.php;
-                    fastcgi_pass unix:${fpm.socket};
-                  '';
+                  extraConfig = # nginx
+                    ''
+                      include ${config.services.nginx.package}/conf/fastcgi.conf;
+                      add_header X-Cache $upstream_cache_status;
+                      fastcgi_ignore_headers "Cache-Control" "Expires" "Set-Cookie";
+                      fastcgi_cache nginx_cache;
+                      fastcgi_cache_valid any 7d;
+                      fastcgi_cache_bypass $no_cache;
+                      fastcgi_no_cache $no_cache;
+                      fastcgi_split_path_info ^(.+\.php)(/.+)$;
+                      fastcgi_index index.php;
+                      fastcgi_pass unix:${fpm.socket};
+                    '';
                 };
                 "/ws/" = {
                   priority = 900;
                   proxyPass = "http://${cfg.settings.DAEMON_INTERFACE}:${builtins.toString cfg.port}/";
                   proxyWebsockets = true;
                   recommendedProxySettings = true;
-                  extraConfig = /* nginx */ ''
-                    proxy_set_header X-Forwarded-Proto $scheme;
-                    proxy_redirect off;
-                  '';
+                  extraConfig = # nginx
+                    ''
+                      proxy_set_header X-Forwarded-Proto $scheme;
+                      proxy_redirect off;
+                    '';
                 };
               };
-              extraConfig = /* ngnix */ ''
-                index index.php;
-              '';
+              extraConfig = # ngnix
+                ''
+                  index index.php;
+                '';
             }
           ];
         }
-      // lib.optionalAttrs (cfg.precompressStaticFiles.gzip.enable) { recommendedGzipSettings = mkDefault true; }
-      // lib.optionalAttrs (cfg.precompressStaticFiles.brotli.enable) { recommendedBrotliSettings = mkDefault true; };
+        // lib.optionalAttrs (cfg.precompressStaticFiles.gzip.enable) {
+          recommendedGzipSettings = mkDefault true;
+        }
+        // lib.optionalAttrs (cfg.precompressStaticFiles.brotli.enable) {
+          recommendedBrotliSettings = mkDefault true;
+        };
 
       mysql = mkIf (cfg.database.createLocally && cfg.database.type == "mysql") {
         enable = mkDefault true;
         package = mkDefault pkgs.mariadb;
         ensureDatabases = [ cfg.database.name ];
-        ensureUsers = [{
-          name = cfg.database.user;
-          ensureDBOwnership = true;
-        }];
+        ensureUsers = [
+          {
+            name = cfg.database.user;
+            ensureDBOwnership = true;
+          }
+        ];
       };
 
       postgresql = mkIf (cfg.database.createLocally && cfg.database.type == "postgresql") {
         enable = mkDefault true;
         ensureDatabases = [ cfg.database.name ];
-        ensureUsers = [{
-          name = cfg.database.user;
-          ensureDBOwnership = true;
-        }];
+        ensureUsers = [
+          {
+            name = cfg.database.user;
+            ensureDBOwnership = true;
+          }
+        ];
         authentication = ''
           host ${cfg.database.name} ${cfg.database.user} localhost trust
         '';
@@ -596,10 +685,7 @@ in
 
       phpfpm.pools.${pool} =
         let
-          socketOwner =
-            if (cfg.nginx != null)
-            then config.services.nginx.user
-            else cfg.user;
+          socketOwner = if (cfg.nginx != null) then config.services.nginx.user else cfg.user;
         in
         {
           phpPackage = package.php;
@@ -629,56 +715,59 @@ in
         after = lib.optional cfg.database.createLocally dbService;
         requires = lib.optional cfg.database.createLocally dbService;
 
-        serviceConfig = {
-          Type = "oneshot";
-          User = cfg.user;
-          Group = cfg.group;
-          UMask = "077";
-        } // lib.optionalAttrs (cfg.secretFile != null) {
-          LoadCredential = "env-secrets:${cfg.secretFile}";
-        };
+        serviceConfig =
+          {
+            Type = "oneshot";
+            User = cfg.user;
+            Group = cfg.group;
+            UMask = "077";
+          }
+          // lib.optionalAttrs (cfg.secretFile != null) {
+            LoadCredential = "env-secrets:${cfg.secretFile}";
+          };
 
-        script = /* sh */ ''
-          # Env vars
-          rm -f ${cfg.dataDir}/.env
-          cp --no-preserve=all ${configFile} ${cfg.dataDir}/.env
-          echo -e '\n' >> ${cfg.dataDir}/.env
-          if [[ -f "$CREDENTIALS_DIRECTORY/env-secrets"  ]]; then
-            cat "$CREDENTIALS_DIRECTORY/env-secrets" >> ${cfg.dataDir}/.env
+        script = # sh
+          ''
+            # Env vars
+            rm -f ${cfg.dataDir}/.env
+            cp --no-preserve=all ${configFile} ${cfg.dataDir}/.env
             echo -e '\n' >> ${cfg.dataDir}/.env
-          fi
+            if [[ -f "$CREDENTIALS_DIRECTORY/env-secrets"  ]]; then
+              cat "$CREDENTIALS_DIRECTORY/env-secrets" >> ${cfg.dataDir}/.env
+              echo -e '\n' >> ${cfg.dataDir}/.env
+            fi
 
-          # Caches, logs
-          mkdir -p ${cfg.dataDir}/public/cache ${cfg.logDir} ${cfg.runtimeDir}/cache
-          chmod -R ug+rw ${cfg.dataDir}/public/cache
-          chmod -R ug+rw ${cfg.logDir}
-          chmod -R ug+rwx ${cfg.runtimeDir}/cache
+            # Caches, logs
+            mkdir -p ${cfg.dataDir}/public/cache ${cfg.logDir} ${cfg.runtimeDir}/cache
+            chmod -R ug+rw ${cfg.dataDir}/public/cache
+            chmod -R ug+rw ${cfg.logDir}
+            chmod -R ug+rwx ${cfg.runtimeDir}/cache
 
-          # Migrations
-          MOVIM_VERSION="${package.version}"
-          if [[ ! -f "${cfg.dataDir}/.migration-version" ]] || [[ "$MOVIM_VERSION" != "$(<${cfg.dataDir}/.migration-version)" ]]; then
-            ${package}/bin/movim-composer movim:migrate && echo $MOVIM_VERSION > ${cfg.dataDir}/.migration-version
-          fi
-        ''
-        + lib.optionalString (podConfigFlags != "") (
-          let
-            flags = lib.concatStringsSep " "
-              ([ "--no-interaction" ]
+            # Migrations
+            MOVIM_VERSION="${package.version}"
+            if [[ ! -f "${cfg.dataDir}/.migration-version" ]] || [[ "$MOVIM_VERSION" != "$(<${cfg.dataDir}/.migration-version)" ]]; then
+              ${package}/bin/movim-composer movim:migrate && echo $MOVIM_VERSION > ${cfg.dataDir}/.migration-version
+            fi
+          ''
+          + lib.optionalString (podConfigFlags != "") (
+            let
+              flags = lib.concatStringsSep " " (
+                [ "--no-interaction" ]
                 ++ lib.optional cfg.debug "-vvv"
-                ++ lib.optional (!cfg.debug && cfg.verbose) "-v");
-          in
-          ''
-            ${lib.getExe package} config ${podConfigFlags}
-          ''
-        );
+                ++ lib.optional (!cfg.debug && cfg.verbose) "-v"
+              );
+            in
+            ''
+              ${lib.getExe package} config ${podConfigFlags}
+            ''
+          );
       };
 
       services.movim = {
         description = "Movim daemon";
         wantedBy = [ "multi-user.target" ];
         after = [ "movim-data-setup.service" ];
-        requires = [ "movim-data-setup.service" ]
-          ++ lib.optional cfg.database.createLocally dbService;
+        requires = [ "movim-data-setup.service" ] ++ lib.optional cfg.database.createLocally dbService;
         environment = {
           PUBLIC_URL = "//${cfg.domain}";
           WS_PORT = builtins.toString cfg.port;
@@ -694,17 +783,34 @@ in
 
       services.${phpExecutionUnit} = {
         after = [ "movim-data-setup.service" ];
-        requires = [ "movim-data-setup.service" ]
-          ++ lib.optional cfg.database.createLocally dbService;
+        requires = [ "movim-data-setup.service" ] ++ lib.optional cfg.database.createLocally dbService;
       };
 
       tmpfiles.settings."10-movim" = with cfg; {
-        "${dataDir}".d = { inherit user group; mode = "0710"; };
-        "${dataDir}/public".d = { inherit user group; mode = "0750"; };
-        "${dataDir}/public/cache".d = { inherit user group; mode = "0750"; };
-        "${runtimeDir}".d = { inherit user group; mode = "0700"; };
-        "${runtimeDir}/cache".d = { inherit user group; mode = "0700"; };
-        "${logDir}".d = { inherit user group; mode = "0700"; };
+        "${dataDir}".d = {
+          inherit user group;
+          mode = "0710";
+        };
+        "${dataDir}/public".d = {
+          inherit user group;
+          mode = "0750";
+        };
+        "${dataDir}/public/cache".d = {
+          inherit user group;
+          mode = "0750";
+        };
+        "${runtimeDir}".d = {
+          inherit user group;
+          mode = "0700";
+        };
+        "${runtimeDir}/cache".d = {
+          inherit user group;
+          mode = "0700";
+        };
+        "${logDir}".d = {
+          inherit user group;
+          mode = "0700";
+        };
       };
     };
   };

nixos/modules/services/web-apps/netbox.nix

@@ -102,7 +102,9 @@ in
     package = lib.mkOption {
       type = lib.types.package;
       default =
-        if lib.versionAtLeast config.system.stateVersion "24.11" then
+        if lib.versionAtLeast config.system.stateVersion "25.05" then
+          pkgs.netbox_4_2
+        else if lib.versionAtLeast config.system.stateVersion "24.11" then
           pkgs.netbox_4_1
         else if lib.versionAtLeast config.system.stateVersion "24.05" then
           pkgs.netbox_3_7

nixos/modules/services/web-apps/nextcloud-notify_push.nix

@@ -78,60 +78,75 @@ in
     );
 
   config = lib.mkIf cfg.enable {
-    systemd.services.nextcloud-notify_push = {
-      description = "Push daemon for Nextcloud clients";
-      documentation = [ "https://github.com/nextcloud/notify_push" ];
-      after = [
-        "phpfpm-nextcloud.service"
-        "redis-nextcloud.service"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      environment = {
-        NEXTCLOUD_URL = cfg.nextcloudUrl;
-        SOCKET_PATH = cfg.socketPath;
-        DATABASE_PREFIX = cfg.dbtableprefix;
-        LOG = cfg.logLevel;
+    systemd.services = {
+      nextcloud-notify_push = {
+        description = "Push daemon for Nextcloud clients";
+        documentation = [ "https://github.com/nextcloud/notify_push" ];
+        after = [
+          "phpfpm-nextcloud.service"
+          "redis-nextcloud.service"
+        ];
+        wantedBy = [ "multi-user.target" ];
+        environment = {
+          NEXTCLOUD_URL = cfg.nextcloudUrl;
+          SOCKET_PATH = cfg.socketPath;
+          DATABASE_PREFIX = cfg.dbtableprefix;
+          LOG = cfg.logLevel;
+        };
+        script =
+          let
+            dbType = if cfg.dbtype == "pgsql" then "postgresql" else cfg.dbtype;
+            dbUser = lib.optionalString (cfg.dbuser != null) cfg.dbuser;
+            dbPass = lib.optionalString (cfg.dbpassFile != null) ":$DATABASE_PASSWORD";
+            dbHostHasPrefix = prefix: lib.hasPrefix prefix (toString cfg.dbhost);
+            isPostgresql = dbType == "postgresql";
+            isMysql = dbType == "mysql";
+            isSocket = (isPostgresql && dbHostHasPrefix "/") || (isMysql && dbHostHasPrefix "localhost:/");
+            dbHost = lib.optionalString (cfg.dbhost != null) (
+              if isSocket then lib.optionalString isMysql "@localhost" else "@${cfg.dbhost}"
+            );
+            dbOpts = lib.optionalString (cfg.dbhost != null && isSocket) (
+              if isPostgresql then
+                "?host=${cfg.dbhost}"
+              else if isMysql then
+                "?socket=${lib.removePrefix "localhost:" cfg.dbhost}"
+              else
+                throw "unsupported dbtype"
+            );
+            dbName = lib.optionalString (cfg.dbname != null) "/${cfg.dbname}";
+            dbUrl = "${dbType}://${dbUser}${dbPass}${dbHost}${dbName}${dbOpts}";
+          in
+          lib.optionalString (cfg.dbpassFile != null) ''
+            export DATABASE_PASSWORD="$(<"$CREDENTIALS_DIRECTORY/dbpass")"
+          ''
+          + ''
+            export DATABASE_URL="${dbUrl}"
+            exec ${cfg.package}/bin/notify_push '${cfgN.datadir}/config/config.php'
+          '';
+        serviceConfig = {
+          User = "nextcloud";
+          Group = "nextcloud";
+          RuntimeDirectory = [ "nextcloud-notify_push" ];
+          Restart = "on-failure";
+          RestartSec = "5s";
+          Type = "notify";
+          LoadCredential = lib.optional (cfg.dbpassFile != null) "dbpass:${cfg.dbpassFile}";
+        };
       };
-      postStart = ''
-        ${cfgN.occ}/bin/nextcloud-occ notify_push:setup ${cfg.nextcloudUrl}/push
-      '';
-      script =
-        let
-          dbType = if cfg.dbtype == "pgsql" then "postgresql" else cfg.dbtype;
-          dbUser = lib.optionalString (cfg.dbuser != null) cfg.dbuser;
-          dbPass = lib.optionalString (cfg.dbpassFile != null) ":$DATABASE_PASSWORD";
-          dbHostHasPrefix = prefix: lib.hasPrefix prefix (toString cfg.dbhost);
-          isPostgresql = dbType == "postgresql";
-          isMysql = dbType == "mysql";
-          isSocket = (isPostgresql && dbHostHasPrefix "/") || (isMysql && dbHostHasPrefix "localhost:/");
-          dbHost = lib.optionalString (cfg.dbhost != null) (
-            if isSocket then lib.optionalString isMysql "@localhost" else "@${cfg.dbhost}"
-          );
-          dbOpts = lib.optionalString (cfg.dbhost != null && isSocket) (
-            if isPostgresql then
-              "?host=${cfg.dbhost}"
-            else if isMysql then
-              "?socket=${lib.removePrefix "localhost:" cfg.dbhost}"
-            else
-              throw "unsupported dbtype"
-          );
-          dbName = lib.optionalString (cfg.dbname != null) "/${cfg.dbname}";
-          dbUrl = "${dbType}://${dbUser}${dbPass}${dbHost}${dbName}${dbOpts}";
-        in
-        lib.optionalString (dbPass != "") ''
-          export DATABASE_PASSWORD="$(<"${cfg.dbpassFile}")"
-        ''
-        + ''
-          export DATABASE_URL="${dbUrl}"
-          exec ${cfg.package}/bin/notify_push '${cfgN.datadir}/config/config.php'
-        '';
-      serviceConfig = {
-        User = "nextcloud";
-        Group = "nextcloud";
-        RuntimeDirectory = [ "nextcloud-notify_push" ];
-        Restart = "on-failure";
-        RestartSec = "5s";
-        Type = "notify";
+
+      nextcloud-notify_push_setup = {
+        wantedBy = [ "multi-user.target" ];
+        requiredBy = [ "nextcloud-notify_push.service" ];
+        after = [ "nextcloud-notify_push.service" ];
+        serviceConfig = {
+          Type = "oneshot";
+          User = "nextcloud";
+          Group = "nextcloud";
+          ExecStart = "${lib.getExe cfgN.occ} notify_push:setup ${cfg.nextcloudUrl}/push";
+          LoadCredential = config.systemd.services.nextcloud-cron.serviceConfig.LoadCredential;
+          RestartMode = "direct";
+          Restart = "on-failure";
+        };
       };
     };
 

nixos/modules/services/web-apps/nextcloud.nix

@@ -85,18 +85,60 @@ let
     "-dmemory_limit=${cfg.cli.memoryLimit}"
   ]);
 
-  occ = pkgs.writeScriptBin "nextcloud-occ" ''
-    #! ${pkgs.runtimeShell}
-    cd ${webroot}
-    sudo=exec
-    if [[ "$USER" != nextcloud ]]; then
-      sudo='exec /run/wrappers/bin/sudo -u nextcloud'
-    fi
-    $sudo ${pkgs.coreutils}/bin/env \
-      NEXTCLOUD_CONFIG_DIR="${datadir}/config" \
-      ${phpCli} \
-      occ "$@"
-  '';
+  # NOTE: The credentials required by all services at runtime, not including things like the
+  #       admin password which is only needed by the setup service.
+  runtimeSystemdCredentials = []
+    ++ (lib.optional (cfg.config.dbpassFile != null) "dbpass:${cfg.config.dbpassFile}")
+    ++ (lib.optional (cfg.config.objectstore.s3.enable) "s3_secret:${cfg.config.objectstore.s3.secretFile}")
+    ++ (lib.optional (cfg.config.objectstore.s3.sseCKeyFile != null) "s3_sse_c_key:${cfg.config.objectstore.s3.sseCKeyFile}");
+
+  requiresRuntimeSystemdCredentials = (lib.length runtimeSystemdCredentials) != 0;
+
+  occ = pkgs.writeShellApplication {
+    name = "nextcloud-occ";
+
+    text = let
+      command = ''
+        ${lib.getExe' pkgs.coreutils "env"} \
+          NEXTCLOUD_CONFIG_DIR="${datadir}/config" \
+          ${phpCli} \
+          occ "$@"
+      '';
+    in ''
+      cd ${webroot}
+
+      # NOTE: This is templated at eval time
+      requiresRuntimeSystemdCredentials=${lib.boolToString requiresRuntimeSystemdCredentials}
+
+      # NOTE: This wrapper is both used in the internal nextcloud service units
+      #       and by users outside a service context for administration. As such,
+      #       when there's an existing CREDENTIALS_DIRECTORY, we inherit it for use
+      #       in the nix_read_secret() php function.
+      #       When there's no CREDENTIALS_DIRECTORY we try to use systemd-run to
+      #       load the credentials just as in a service unit.
+      # NOTE: If there are no credentials that are required at runtime then there's no need
+      #       to load any credentials.
+      if [[ $requiresRuntimeSystemdCredentials == true && -z "''${CREDENTIALS_DIRECTORY:-}" ]]; then
+        exec ${lib.getExe' config.systemd.package "systemd-run"} \
+          ${lib.escapeShellArgs (map (credential: "--property=LoadCredential=${credential}") runtimeSystemdCredentials)} \
+          --uid=nextcloud \
+          --same-dir \
+          --pty \
+          --wait \
+          --collect \
+          --service-type=exec \
+          --quiet \
+          ${command}
+      elif [[ "$USER" != nextcloud ]]; then
+        exec /run/wrappers/bin/sudo \
+          --preserve-env=CREDENTIALS_DIRECTORY \
+          --user=nextcloud \
+          ${command}
+      else
+        exec ${command}
+      fi
+    '';
+  };
 
   inherit (config.system) stateVersion;
 
@@ -120,13 +162,13 @@ let
           'bucket' => '${s3.bucket}',
           'autocreate' => ${boolToString s3.autocreate},
           'key' => '${s3.key}',
-          'secret' => nix_read_secret('${s3.secretFile}'),
+          'secret' => nix_read_secret('s3_secret'),
           ${optionalString (s3.hostname != null) "'hostname' => '${s3.hostname}',"}
           ${optionalString (s3.port != null) "'port' => ${toString s3.port},"}
           'use_ssl' => ${boolToString s3.useSsl},
           ${optionalString (s3.region != null) "'region' => '${s3.region}',"}
           'use_path_style' => ${boolToString s3.usePathStyle},
-          ${optionalString (s3.sseCKeyFile != null) "'sse_c_key' => nix_read_secret('${s3.sseCKeyFile}'),"}
+          ${optionalString (s3.sseCKeyFile != null) "'sse_c_key' => nix_read_secret('s3_sse_c_key'),"}
         ],
       ]
     '';
@@ -143,16 +185,26 @@ let
   in pkgs.writeText "nextcloud-config.php" ''
     <?php
     ${optionalString requiresReadSecretFunction ''
-      function nix_read_secret($file) {
-        if (!file_exists($file)) {
-          throw new \RuntimeException(sprintf(
-            "Cannot start Nextcloud, secret file %s set by NixOS doesn't seem to "
-            . "exist! Please make sure that the file exists and has appropriate "
-            . "permissions for user & group 'nextcloud'!",
-            $file
+      function nix_read_secret($credential_name) {
+        $credentials_directory = getenv("CREDENTIALS_DIRECTORY");
+        if (!$credentials_directory) {
+          error_log(sprintf(
+            "Cannot read credential '%s' passed by NixOS, \$CREDENTIALS_DIRECTORY is not set!",
+            $credential_name
           ));
+          exit(1);
         }
-        return trim(file_get_contents($file));
+
+        $credential_path = $credentials_directory . "/" . $credential_name;
+        if (!is_readable($credential_path)) {
+          error_log(sprintf(
+            "Cannot read credential '%s' passed by NixOS, it does not exist or is not readable!",
+            $credential_path,
+          ));
+          exit(1);
+        }
+
+        return trim(file_get_contents($credential_path));
       }''}
     function nix_decode_json_file($file, $error) {
       if (!file_exists($file)) {
@@ -176,12 +228,7 @@ let
       ${optionalString (c.dbhost != null) "'dbhost' => '${c.dbhost}',"}
       ${optionalString (c.dbuser != null) "'dbuser' => '${c.dbuser}',"}
       ${optionalString (c.dbtableprefix != null) "'dbtableprefix' => '${toString c.dbtableprefix}',"}
-      ${optionalString (c.dbpassFile != null) ''
-          'dbpassword' => nix_read_secret(
-            "${c.dbpassFile}"
-          ),
-        ''
-      }
+      ${optionalString (c.dbpassFile != null) "'dbpassword' => nix_read_secret('dbpass'),"}
       'dbtype' => '${c.dbtype}',
       ${objectstoreConfig}
     ];
@@ -490,9 +537,8 @@ in {
       adminpassFile = mkOption {
         type = types.str;
         description = ''
-          The full path to a file that contains the admin's password. Must be
-          readable by user `nextcloud`. The password is set only in the initial
-          setup of Nextcloud by the systemd service `nextcloud-setup.service`.
+          The full path to a file that contains the admin's password. The password is
+          set only in the initial setup of Nextcloud by the systemd service `nextcloud-setup.service`.
         '';
       };
       objectstore = {
@@ -530,8 +576,7 @@ in {
             type = types.str;
             example = "/var/nextcloud-objectstore-s3-secret";
             description = ''
-              The full path to a file that contains the access secret. Must be
-              readable by user `nextcloud`.
+              The full path to a file that contains the access secret.
             '';
           };
           hostname = mkOption {
@@ -592,8 +637,6 @@ in {
               openssl rand 32 | base64
               ```
 
-              Must be readable by user `nextcloud`.
-
               [1]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html
             '';
           };
@@ -944,11 +987,6 @@ in {
       services.nextcloud.finalPackage = webroot;
 
       systemd.services = {
-        # When upgrading the Nextcloud package, Nextcloud can report errors such as
-        # "The files of the app [all apps in /var/lib/nextcloud/apps] were not replaced correctly"
-        # Restarting phpfpm on Nextcloud package update fixes these issues (but this is a workaround).
-        phpfpm-nextcloud.restartTriggers = [ webroot overrideConfig ];
-
         nextcloud-setup = let
           c = cfg.config;
           occInstallCmd = let
@@ -959,12 +997,12 @@ in {
             dbpass = {
               arg = "DBPASS";
               value = if c.dbpassFile != null
-                then ''"$(<"${toString c.dbpassFile}")"''
+                then ''"$(<"$CREDENTIALS_DIRECTORY/dbpass")"''
                 else ''""'';
             };
             adminpass = {
               arg = "ADMINPASS";
-              value = ''"$(<"${toString c.adminpassFile}")"'';
+              value = ''"$(<"$CREDENTIALS_DIRECTORY/adminpass")"'';
             };
             installFlags = concatStringsSep " \\\n    "
               (mapAttrsToList (k: v: "${k} ${toString v}") {
@@ -983,12 +1021,12 @@ in {
           in ''
             ${mkExport dbpass}
             ${mkExport adminpass}
-            ${occ}/bin/nextcloud-occ maintenance:install \
+            ${lib.getExe occ} maintenance:install \
                 ${installFlags}
           '';
           occSetTrustedDomainsCmd = concatStringsSep "\n" (imap0
             (i: v: ''
-              ${occ}/bin/nextcloud-occ config:system:set trusted_domains \
+              ${lib.getExe occ} config:system:set trusted_domains \
                 ${toString i} --value="${toString v}"
             '') ([ cfg.hostName ] ++ cfg.settings.trusted_domains));
 
@@ -1002,20 +1040,12 @@ in {
           restartTriggers = [ overrideConfig ];
           script = ''
             ${optionalString (c.dbpassFile != null) ''
-              if [ ! -r "${c.dbpassFile}" ]; then
-                echo "dbpassFile ${c.dbpassFile} is not readable by nextcloud:nextcloud! Aborting..."
-                exit 1
-              fi
-              if [ -z "$(<${c.dbpassFile})" ]; then
+              if [ -z "$(<$CREDENTIALS_DIRECTORY/dbpass)" ]; then
                 echo "dbpassFile ${c.dbpassFile} is empty!"
                 exit 1
               fi
             ''}
-            if [ ! -r "${c.adminpassFile}" ]; then
-              echo "adminpassFile ${c.adminpassFile} is not readable by nextcloud:nextcloud! Aborting..."
-              exit 1
-            fi
-            if [ -z "$(<${c.adminpassFile})" ]; then
+            if [ -z "$(<$CREDENTIALS_DIRECTORY/adminpass)" ]; then
               echo "adminpassFile ${c.adminpassFile} is empty!"
               exit 1
             fi
@@ -1032,57 +1062,102 @@ in {
               ${occInstallCmd}
             fi
 
-            ${occ}/bin/nextcloud-occ upgrade
+            ${lib.getExe occ} upgrade
 
-            ${occ}/bin/nextcloud-occ config:system:delete trusted_domains
+            ${lib.getExe occ} config:system:delete trusted_domains
 
             ${optionalString (cfg.extraAppsEnable && cfg.extraApps != { }) ''
                 # Try to enable apps
-                ${occ}/bin/nextcloud-occ app:enable ${concatStringsSep " " (attrNames cfg.extraApps)}
+                ${lib.getExe occ} app:enable ${concatStringsSep " " (attrNames cfg.extraApps)}
             ''}
 
             ${occSetTrustedDomainsCmd}
           '';
           serviceConfig.Type = "oneshot";
           serviceConfig.User = "nextcloud";
+          serviceConfig.LoadCredential = [ "adminpass:${cfg.config.adminpassFile}" ] ++ runtimeSystemdCredentials;
           # On Nextcloud ≥ 26, it is not necessary to patch the database files to prevent
           # an automatic creation of the database user.
           environment.NC_setup_create_db_user = lib.mkIf (nextcloudGreaterOrEqualThan "26") "false";
         };
         nextcloud-cron = {
           after = [ "nextcloud-setup.service" ];
+          # NOTE: In contrast to the occ wrapper script running phpCli directly will not
+          #       set NEXTCLOUD_CONFIG_DIR by itself currently.
           environment.NEXTCLOUD_CONFIG_DIR = "${datadir}/config";
+          script = ''
+            # NOTE: This early returns the script when nextcloud is in maintenance mode
+            #       or needs `occ upgrade`. Using ExecCondition= is not possible here
+            #       because it doesn't work with systemd credentials.
+            if [[ $(${lib.getExe occ} status --output=json | ${lib.getExe pkgs.jq} '. | if .maintenance or .needsDbUpgrade then "skip" else "" end' --raw-output) == "skip" ]]; then
+              echo "Nextcloud is in maintenance mode or needs DB upgrade, exiting."
+              exit 0
+            fi
+
+            ${phpCli} -f ${webroot}/cron.php
+          '';
           serviceConfig = {
             Type = "exec";
             User = "nextcloud";
-            ExecCondition = "${phpCli} -f ${webroot}/occ status -e";
-            ExecStart = "${phpCli} -f ${webroot}/cron.php";
             KillMode = "process";
+            LoadCredential = runtimeSystemdCredentials;
           };
         };
         nextcloud-update-plugins = mkIf cfg.autoUpdateApps.enable {
           after = [ "nextcloud-setup.service" ];
           serviceConfig = {
             Type = "oneshot";
-            ExecStart = "${occ}/bin/nextcloud-occ app:update --all";
+            ExecStart = "${lib.getExe occ} app:update --all";
             User = "nextcloud";
+            LoadCredential = runtimeSystemdCredentials;
           };
           startAt = cfg.autoUpdateApps.startAt;
         };
         nextcloud-update-db = {
           after = [ "nextcloud-setup.service" ];
-          environment.NEXTCLOUD_CONFIG_DIR = "${datadir}/config";
           script = ''
-            ${occ}/bin/nextcloud-occ db:add-missing-columns
-            ${occ}/bin/nextcloud-occ db:add-missing-indices
-            ${occ}/bin/nextcloud-occ db:add-missing-primary-keys
+            # NOTE: This early returns the script when nextcloud is in maintenance mode
+            #       or needs `occ upgrade`. Using ExecCondition= is not possible here
+            #       because it doesn't work with systemd credentials.
+            if [[ $(${lib.getExe occ} status --output=json | ${lib.getExe pkgs.jq} '. | if .maintenance or .needsDbUpgrade then "skip" else "" end' --raw-output) == "skip" ]]; then
+              echo "Nextcloud is in maintenance mode or needs DB upgrade, exiting."
+              exit 0
+            fi
+
+            ${lib.getExe occ} db:add-missing-columns
+            ${lib.getExe occ} db:add-missing-indices
+            ${lib.getExe occ} db:add-missing-primary-keys
           '';
           serviceConfig = {
             Type = "exec";
             User = "nextcloud";
-            ExecCondition = "${phpCli} -f ${webroot}/occ status -e";
+            LoadCredential = runtimeSystemdCredentials;
           };
         };
+
+        phpfpm-nextcloud = {
+          # When upgrading the Nextcloud package, Nextcloud can report errors such as
+          # "The files of the app [all apps in /var/lib/nextcloud/apps] were not replaced correctly"
+          # Restarting phpfpm on Nextcloud package update fixes these issues (but this is a workaround).
+          restartTriggers = [ webroot overrideConfig ];
+        } // lib.optionalAttrs requiresRuntimeSystemdCredentials {
+          serviceConfig.LoadCredential = runtimeSystemdCredentials;
+
+          # FIXME: We use a hack to make the credential files readable by the nextcloud
+          #        user by copying them somewhere else and overriding CREDENTIALS_DIRECTORY
+          #        for php. This is currently necessary as the unit runs as root.
+          serviceConfig.RuntimeDirectory = lib.mkForce "phpfpm phpfpm-nextcloud";
+          preStart = ''
+            umask 0077
+
+            # NOTE: Runtime directories for this service are currently preserved
+            #       between restarts.
+            rm -rf /run/phpfpm-nextcloud/credentials/
+            mkdir -p /run/phpfpm-nextcloud/credentials/
+            cp "$CREDENTIALS_DIRECTORY"/* /run/phpfpm-nextcloud/credentials/
+            chown -R nextcloud:nextcloud /run/phpfpm-nextcloud/credentials/
+          '';
+        };
       };
 
       services.phpfpm = {
@@ -1091,6 +1166,7 @@ in {
           group = "nextcloud";
           phpPackage = phpPackage;
           phpEnv = {
+            CREDENTIALS_DIRECTORY = "/run/phpfpm-nextcloud/credentials/";
             NEXTCLOUD_CONFIG_DIR = "${datadir}/config";
             PATH = "/run/wrappers/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:/usr/bin:/bin";
           };

nixos/tests/all-tests.nix

@@ -643,6 +643,7 @@ in {
   mate-wayland = handleTest ./mate-wayland.nix {};
   matter-server = handleTest ./matter-server.nix {};
   matomo = runTest ./matomo.nix;
+  matrix-alertmanager = runTest ./matrix/matrix-alertmanager.nix;
   matrix-appservice-irc = runTest ./matrix/appservice-irc.nix;
   matrix-conduit = handleTest ./matrix/conduit.nix {};
   matrix-synapse = handleTest ./matrix/synapse.nix {};
@@ -735,8 +736,8 @@ in {
   networking.networkmanager = handleTest ./networking/networkmanager.nix {};
   netbox_3_6 = handleTest ./web-apps/netbox.nix { netbox = pkgs.netbox_3_6; };
   netbox_3_7 = handleTest ./web-apps/netbox.nix { netbox = pkgs.netbox_3_7; };
-  netbox_4_0 = handleTest ./web-apps/netbox.nix { netbox = pkgs.netbox_4_0; };
   netbox_4_1 = handleTest ./web-apps/netbox.nix { netbox = pkgs.netbox_4_1; };
+  netbox_4_2 = handleTest ./web-apps/netbox.nix { netbox = pkgs.netbox_4_2; };
   netbox-upgrade = handleTest ./web-apps/netbox-upgrade.nix {};
   # TODO: put in networking.nix after the test becomes more complete
   networkingProxy = handleTest ./networking-proxy.nix {};
@@ -1186,6 +1187,7 @@ in {
   ucarp = handleTest ./ucarp.nix {};
   udisks2 = handleTest ./udisks2.nix {};
   ulogd = handleTest ./ulogd/ulogd.nix {};
+  umurmur = handleTest ./umurmur.nix {};
   unbound = handleTest ./unbound.nix {};
   unifi = handleTest ./unifi.nix {};
   unit-php = handleTest ./web-servers/unit-php.nix {};

nixos/tests/evcc.nix

@@ -1,5 +1,8 @@
 { pkgs, lib, ... }:
 
+let
+  port = "1234";
+in
 {
   name = "evcc";
   meta.maintainers = with lib.maintainers; [ hexa ];
@@ -8,11 +11,15 @@
     machine = {
       services.evcc = {
         enable = true;
+        # This is NOT a safe way to deal with secrets in production
+        environmentFile = pkgs.writeText "evcc-secrets" ''
+          PORT=${toString port}
+        '';
         settings = {
           network = {
             schema = "http";
             host = "localhost";
-            port = 7070;
+            port = "$PORT";
           };
 
           log = "info";
@@ -82,14 +89,14 @@
     start_all()
 
     machine.wait_for_unit("evcc.service")
-    machine.wait_for_open_port(7070)
+    machine.wait_for_open_port(${port})
 
     with subtest("Check package version propagates into frontend"):
         machine.fail(
-            "curl --fail http://localhost:7070 | grep '0.0.1-alpha'"
+            "curl --fail http://localhost:${port} | grep '0.0.1-alpha'"
         )
         machine.succeed(
-            "curl --fail http://localhost:7070 | grep '${pkgs.evcc.version}'"
+            "curl --fail http://localhost:${port} | grep '${pkgs.evcc.version}'"
         )
 
     with subtest("Check journal for errors"):

nixos/tests/matrix/matrix-alertmanager.nix

@@ -0,0 +1,132 @@
+{ pkgs, ... }:
+let
+  secret-files = pkgs.runCommandLocal "secret-files" { } ''
+    mkdir -p $out
+    echo -n faketoken > $out/token.txt
+    echo -n wontbeused > $out/secret.txt
+  '';
+in
+{
+  name = "matrix-alertmanager";
+  meta.maintainers = with pkgs.lib.maintainers; [ erethon ];
+
+  nodes = {
+    homeserver =
+      { pkgs, ... }:
+      {
+        services.matrix-synapse = {
+          enable = true;
+          settings = {
+            database.name = "sqlite3";
+            tls_certificate_path = "../common/acme/server/acme.test.cert.pem";
+            tls_private_key_path = "../common/acme/server/acme.test.key.pem";
+            enable_registration = true;
+            enable_registration_without_verification = true;
+            registration_shared_secret = "supersecret-registration";
+            listeners = [
+              {
+                # The default but tls=false
+                bind_addresses = [
+                  "0.0.0.0"
+                ];
+                port = 8448;
+                resources = [
+                  {
+                    compress = true;
+                    names = [ "client" ];
+                  }
+                  {
+                    compress = false;
+                    names = [ "federation" ];
+                  }
+                ];
+                tls = false;
+                type = "http";
+                x_forwarded = false;
+              }
+            ];
+          };
+        };
+
+        networking.firewall.allowedTCPPorts = [ 8448 ];
+
+        environment.systemPackages = [
+          (pkgs.writeShellScriptBin "register_alertmanager_user" ''
+            exec ${pkgs.matrix-synapse}/bin/register_new_matrix_user \
+              -u alertmanager \
+              -p alertmanager-password \
+              --admin \
+              --shared-secret supersecret-registration \
+              http://localhost:8448
+          '')
+          # This is needed to solve a chicken and egg
+          # problem. Matrix-alertmanager expects a token for authentication,
+          # but a token is created after the user has been registered. This
+          # changes the token in the database to match the one specified in
+          # the service settings.
+          (pkgs.writers.writePython3Bin "hardcode_matrix_values"
+            {
+              libraries = with pkgs.python3Packages; [
+                sqlite-utils
+              ];
+            }
+            ''
+              import sqlite3
+              con = sqlite3.connect("/var/lib/matrix-synapse/homeserver.db")
+              cur = con.cursor()
+              cur.execute(
+                  "update access_tokens set token='%s' where user_id = '%s'"
+                  % ("faketoken", "@alertmanager:homeserver")
+              )
+              con.commit()
+              con.close()
+            ''
+          )
+        ];
+      };
+
+    matrix_alertmanager =
+      { config, pkgs, ... }:
+      {
+        environment.etc.token-file.source = "${secret-files}/token.txt";
+        environment.etc.secret-file.source = "${secret-files}/secret.txt";
+        services.matrix-alertmanager = {
+          enable = true;
+          tokenFile = "/etc/${config.environment.etc.token-file.target}";
+          secretFile = "/etc/${config.environment.etc.secret-file.target}";
+          homeserverUrl = "http://homeserver:8448";
+          # Matrix-alertmanager expects at least a room in its configuration
+          # in order to start. However, the room doesn't have to exist for
+          # matrix-alertmanager to start, so this is a configuration only
+          # placeholder.
+          matrixRooms = [
+            {
+              receivers = [ "matrix" ];
+              roomId = "!room_id:homeserver";
+            }
+          ];
+          matrixUser = "alertmanager";
+        };
+      };
+  };
+
+  testScript = ''
+    with subtest("start homeserver"):
+      homeserver.start()
+      homeserver.wait_for_unit("matrix-synapse.service")
+      homeserver.wait_until_succeeds("curl --fail -L http://localhost:8448/")
+
+    with subtest("register user"):
+      # register alertmanager user
+      homeserver.succeed("register_alertmanager_user")
+
+    with subtest("hardcode matrix values for matrix-alertmanager to use"):
+      homeserver.succeed("hardcode_matrix_values")
+
+    with subtest("start matrix_alertmanager"):
+      matrix_alertmanager.start()
+      matrix_alertmanager.wait_for_unit("matrix-alertmanager.service")
+      matrix_alertmanager.wait_until_succeeds("curl --fail -L http://localhost:3000/")
+      matrix_alertmanager.wait_for_console_text("matrix-alertmanager initialized and ready")
+  '';
+}

nixos/tests/nextcloud/basic.nix

@@ -8,10 +8,10 @@
 
 with import ../../lib/testing-python.nix { inherit system pkgs; };
 runTest (
-  { config, ... }:
+  { config, lib, ... }:
   {
     inherit name;
-    meta = with pkgs.lib.maintainers; {
+    meta = with lib.maintainers; {
       maintainers = [
         globin
         eqyiel

nixos/tests/nextcloud/with-declarative-redis-and-secrets.nix

@@ -8,13 +8,13 @@
 
 with import ../../lib/testing-python.nix { inherit system pkgs; };
 runTest (
-  { config, ... }:
+  { config, lib, ... }:
   let
     inherit (config) adminuser;
   in
   {
     inherit name;
-    meta = with pkgs.lib.maintainers; {
+    meta = with lib.maintainers; {
       maintainers = [
         eqyiel
         ma27
@@ -34,6 +34,13 @@ runTest (
               redis = true;
               memcached = false;
             };
+            notify_push = {
+              enable = true;
+              bendDomainToLocalhost = true;
+              logLevel = "debug";
+            };
+            extraAppsEnable = true;
+            extraApps.notify_push = config.services.nextcloud.package.packages.apps.notify_push;
             # This test also validates that we can use an "external" database
             database.createLocally = false;
             config = {
@@ -70,7 +77,7 @@ runTest (
           services.postgresql = {
             enable = true;
           };
-          systemd.services.postgresql.postStart = pkgs.lib.mkAfter ''
+          systemd.services.postgresql.postStart = lib.mkAfter ''
             password=$(cat ${config.services.nextcloud.config.dbpassFile})
             ${config.services.postgresql.package}/bin/psql <<EOF
               CREATE ROLE ${adminuser} WITH LOGIN PASSWORD '$password' CREATEDB;
@@ -95,7 +102,13 @@ runTest (
     test-helpers.extraTests = ''
       with subtest("non-empty redis cache"):
           # redis cache should not be empty
-          nextcloud.fail('test 0 -lt "$(redis-cli --pass secret --json KEYS "*" | jq "len")"')
+          assert nextcloud.succeed('redis-cli --pass secret --json KEYS "*" | jq length').strip() != "0", """
+            redis-cli for keys * returned 0 entries
+          """
+
+      with subtest("notify-push"):
+          client.execute("${lib.getExe pkgs.nextcloud-notify_push.passthru.test_client} http://nextcloud ${config.adminuser} ${config.adminpass} >&2 &")
+          nextcloud.wait_until_succeeds("journalctl -u nextcloud-notify_push | grep -q \"Sending ping to ${config.adminuser}\"")
     '';
   }
 )

nixos/tests/nextcloud/with-mysql-and-memcached.nix

@@ -8,10 +8,10 @@
 
 with import ../../lib/testing-python.nix { inherit system pkgs; };
 runTest (
-  { config, ... }:
+  { config, lib, ... }:
   {
     inherit name;
-    meta = with pkgs.lib.maintainers; {
+    meta = with lib.maintainers; {
       maintainers = [ eqyiel ];
     };
 

nixos/tests/nextcloud/with-objectstore.nix

@@ -20,7 +20,7 @@ runTest (
   in
   {
     inherit name;
-    meta = with pkgs.lib.maintainers; {
+    meta = with lib.maintainers; {
       maintainers = [
         onny
         ma27

nixos/tests/nextcloud/with-postgresql-and-redis.nix

@@ -8,10 +8,10 @@
 
 with import ../../lib/testing-python.nix { inherit system pkgs; };
 runTest (
-  { config, ... }:
+  { config, lib, ... }:
   {
     inherit name;
-    meta = with pkgs.lib.maintainers; {
+    meta = with lib.maintainers; {
       maintainers = [
         eqyiel
         ma27
@@ -29,6 +29,7 @@ runTest (
           ...
         }:
         {
+          environment.systemPackages = [ pkgs.jq ];
           services.nextcloud = {
             caching = {
               apcu = false;
@@ -68,12 +69,14 @@ runTest (
 
     test-helpers.extraTests = ''
       with subtest("notify-push"):
-          client.execute("${pkgs.lib.getExe pkgs.nextcloud-notify_push.passthru.test_client} http://nextcloud ${config.adminuser} ${config.adminpass} >&2 &")
+          client.execute("${lib.getExe pkgs.nextcloud-notify_push.passthru.test_client} http://nextcloud ${config.adminuser} ${config.adminpass} >&2 &")
           nextcloud.wait_until_succeeds("journalctl -u nextcloud-notify_push | grep -q \"Sending ping to ${config.adminuser}\"")
 
       with subtest("Redis is used for caching"):
           # redis cache should not be empty
-          nextcloud.fail('test "[]" = "$(redis-cli --json KEYS "*")"')
+          assert nextcloud.succeed('redis-cli --json KEYS "*" | jq length').strip() != "0", """
+            redis-cli for keys * returned 0 entries
+          """
 
       with subtest("No code is returned when requesting PHP files (regression test)"):
           nextcloud.fail("curl -f http://nextcloud/nix-apps/notes/lib/AppInfo/Application.php")

nixos/tests/umurmur.nix

@@ -0,0 +1,99 @@
+import ./make-test-python.nix (
+  { pkgs, ... }:
+
+  let
+    client =
+      { pkgs, ... }:
+      {
+        imports = [ ./common/x11.nix ];
+        environment.systemPackages = [ pkgs.mumble ];
+      };
+    port = 56457;
+  in
+  {
+    name = "mumble";
+    meta = with pkgs.lib.maintainers; {
+      maintainers = [ _3JlOy-PYCCKUi ];
+    };
+
+    nodes = {
+      server =
+        { ... }:
+        {
+          services.umurmur = {
+            enable = true;
+            openFirewall = true;
+            settings = {
+              password = "testpassword";
+              channels = [
+                {
+                  name = "root";
+                  parent = "";
+                  description = "Root channel. No entry.";
+                  noenter = true;
+                }
+                {
+                  name = "lobby";
+                  parent = "root";
+                  description = "Lobby channel";
+                }
+              ];
+              default_channel = "lobby";
+              bindport = port;
+            };
+          };
+        };
+
+      client1 = client;
+      client2 = client;
+    };
+
+    testScript = ''
+      start_all()
+
+      server.wait_for_unit("umurmur.service")
+      client1.wait_for_x()
+      client2.wait_for_x()
+
+      client1.execute("mumble mumble://client1:testpassword\@server:${toString port}/lobby >&2 &")
+      client2.execute("mumble mumble://client2:testpassword\@server:${toString port}/lobby >&2 &")
+
+      # cancel client audio configuration
+      client1.wait_for_window(r"Audio Tuning Wizard")
+      client2.wait_for_window(r"Audio Tuning Wizard")
+      server.sleep(5)  # wait because mumble is slow to register event handlers
+      client1.send_key("esc")
+      client2.send_key("esc")
+
+      # cancel client cert configuration
+      client1.wait_for_window(r"Certificate Management")
+      client2.wait_for_window(r"Certificate Management")
+      server.sleep(5)  # wait because mumble is slow to register event handlers
+      client1.send_key("esc")
+      client2.send_key("esc")
+
+      # accept server certificate
+      client1.wait_for_window(r"^Mumble$")
+      client2.wait_for_window(r"^Mumble$")
+      server.sleep(5)  # wait because mumble is slow to register event handlers
+      client1.send_chars("y")
+      client2.send_chars("y")
+      server.sleep(5)  # wait because mumble is slow to register event handlers
+
+      # sometimes the wrong of the 2 windows is focused, we switch focus and try pressing "y" again
+      client1.send_key("alt-tab")
+      client2.send_key("alt-tab")
+      server.sleep(5)  # wait because mumble is slow to register event handlers
+      client1.send_chars("y")
+      client2.send_chars("y")
+
+      # Find clients in logs
+      server.wait_until_succeeds(
+          "journalctl -eu umurmur -o cat | grep -q 'User client1 authenticated'"
+      )
+      server.wait_until_succeeds(
+          "journalctl -eu umurmur -o cat | grep -q 'User client2 authenticated'"
+      )
+    '';
+  }
+)

nixos/tests/user-enable-option.nix

@@ -57,7 +57,7 @@ in
     machine.wait_for_unit("getty@tty1.service")
 
     with subtest("${normal-enabled} exists"):
-        check_fn = f"id ${normal-enabled}"
+        check_fn = "id ${normal-enabled}"
         machine.succeed(check_fn)
         machine.wait_until_tty_matches("1", "login: ")
         machine.send_chars("${normal-enabled}\n")
@@ -66,17 +66,17 @@ in
 
     with subtest("${normal-disabled} does not exist"):
         switch_to_tty(2)
-        check_fn = f"id ${normal-disabled}"
+        check_fn = "id ${normal-disabled}"
         machine.fail(check_fn)
 
     with subtest("${system-enabled} exists"):
         switch_to_tty(3)
-        check_fn = f"id ${system-enabled}"
+        check_fn = "id ${system-enabled}"
         machine.succeed(check_fn)
 
     with subtest("${system-disabled} does not exist"):
         switch_to_tty(4)
-        check_fn = f"id ${system-disabled}"
+        check_fn = "id ${system-disabled}"
         machine.fail(check_fn)
   '';
 }

pkgs/applications/blockchains/bitcoin/default.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch2,
   autoreconfHook,
   pkg-config,
   installShellFiles,
@@ -21,6 +20,7 @@
   qtbase ? null,
   qttools ? null,
   python3,
+  versionCheckHook,
   nixosTests,
   withGui,
   withWallet ? true,
@@ -33,13 +33,13 @@ let
     sha256 = "0cpna0nxcd1dw3nnzli36nf9zj28d2g9jf5y0zl9j18lvanvniha";
   };
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = if withGui then "bitcoin" else "bitcoind";
   version = "28.1";
 
   src = fetchurl {
     urls = [
-      "https://bitcoincore.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
+      "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/bitcoin-${finalAttrs.version}.tar.gz"
     ];
     # hash retrieved from signed SHA256SUMS
     sha256 = "c5ae2dd041c7f9d9b7c722490ba5a9d624f7e9a089c67090615e1ba4ad0883ba";
@@ -100,7 +100,7 @@ stdenv.mkDerivation rec {
       "--with-boost-libdir=${boost.out}/lib"
       "--disable-bench"
     ]
-    ++ lib.optionals (!doCheck) [
+    ++ lib.optionals (!finalAttrs.doCheck) [
       "--disable-tests"
       "--disable-gui-tests"
     ]
@@ -124,11 +124,20 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  __darwinAllowLocalNetworking = true;
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/bitcoin-cli";
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
   passthru.tests = {
     smoke-test = nixosTests.bitcoind;
   };
 
-  meta = with lib; {
+  meta = {
     description = "Peer-to-peer electronic cash system";
     longDescription = ''
       Bitcoin is a free open source peer-to-peer electronic cash system that is
@@ -137,13 +146,13 @@ stdenv.mkDerivation rec {
       with each other, with the help of a P2P network to check for double-spending.
     '';
     homepage = "https://bitcoin.org/en/";
-    downloadPage = "https://bitcoincore.org/bin/bitcoin-core-${version}/";
-    changelog = "https://bitcoincore.org/en/releases/${version}/";
-    maintainers = with maintainers; [
+    downloadPage = "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/";
+    changelog = "https://bitcoincore.org/en/releases/${finalAttrs.version}/";
+    maintainers = with lib.maintainers; [
       prusnak
       roconnor
     ];
-    license = licenses.mit;
-    platforms = platforms.unix;
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
   };
-}
+})

pkgs/applications/display-managers/ly/default.nix

@@ -31,7 +31,11 @@ stdenv.mkDerivation {
   ];
 
   postPatch = ''
-    ln -s ${callPackage ./deps.nix { }} $ZIG_GLOBAL_CACHE_DIR/p
+    ln -s ${
+      callPackage ./deps.nix {
+        zig = zig_0_12;
+      }
+    } $ZIG_GLOBAL_CACHE_DIR/p
   '';
 
   passthru.tests = { inherit (nixosTests) ly; };

pkgs/applications/editors/emacs/sources.nix

@@ -155,6 +155,11 @@ in
         name = "inhibit-lexical-cookie-warning-67916.patch";
         path = ./inhibit-lexical-cookie-warning-67916-30.patch;
       })
+      (fetchpatch {
+        # bug#63288 and bug#76523
+        url = "https://git.savannah.gnu.org/cgit/emacs.git/patch/?id=53a5dada413662389a17c551a00d215e51f5049f";
+        hash = "sha256-AEvsQfpdR18z6VroJkWoC3sBoApIYQQgeF/P2DprPQ8=";
+      })
     ];
   });
 

pkgs/applications/editors/focuswriter/default.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "focuswriter";
-  version = "1.8.10";
+  version = "1.8.11";
 
   src = fetchFromGitHub {
     owner = "gottcode";
     repo = "focuswriter";
     rev = "v${version}";
-    hash = "sha256-p+0upsmEMkqMRsIcPWq4pelPdlqrzHaNL5PNFtuiecY=";
+    hash = "sha256-oivhrDF3HikbEtS1cOlHwmQYNYf3IkX+gQGW0V55IWU=";
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/jetbrains/bin/versions.json

@@ -11,26 +11,26 @@
     "clion": {
       "update-channel": "CLion RELEASE",
       "url-template": "https://download.jetbrains.com/cpp/CLion-{version}.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "a221d8c602452775df6ff09adad39f2b057a367f7616b7c739df33204b103a4a",
-      "url": "https://download.jetbrains.com/cpp/CLion-2024.3.3.tar.gz",
-      "build_number": "243.24978.55"
+      "version": "2024.3.4",
+      "sha256": "c23b9aeb1fdd9f88ab977186e9e4558cdb9bdb5e498b7716f4255a845f8880fd",
+      "url": "https://download.jetbrains.com/cpp/CLion-2024.3.4.tar.gz",
+      "build_number": "243.25659.42"
     },
     "datagrip": {
       "update-channel": "DataGrip RELEASE",
       "url-template": "https://download.jetbrains.com/datagrip/datagrip-{version}.tar.gz",
-      "version": "2024.3.4",
-      "sha256": "34f20d0aba3b0ecbad39cf2c8fdf326ff8d4abb6202d9cff60a2622cf8b241a2",
-      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.3.4.tar.gz",
-      "build_number": "243.23654.183"
+      "version": "2024.3.5",
+      "sha256": "aafe50930e565e4b94dc6af43140d7bb68b937b8f1dc3d3235d2054071397b0f",
+      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.3.5.tar.gz",
+      "build_number": "243.24978.79"
     },
     "dataspell": {
       "update-channel": "DataSpell RELEASE",
       "url-template": "https://download.jetbrains.com/python/dataspell-{version}.tar.gz",
-      "version": "2024.3.1.1",
-      "sha256": "37e0985cd3bac79cc74962edba726ccdde61101fc4e8876ed060396584332aa3",
-      "url": "https://download.jetbrains.com/python/dataspell-2024.3.1.1.tar.gz",
-      "build_number": "243.22562.236"
+      "version": "2024.3.2",
+      "sha256": "2a59cb71f21f43ff05b385352e51c3670a13dcf2f287034185d4af101880c68f",
+      "url": "https://download.jetbrains.com/python/dataspell-2024.3.2.tar.gz",
+      "build_number": "243.25659.44"
     },
     "gateway": {
       "update-channel": "Gateway RELEASE",
@@ -43,91 +43,91 @@
     "goland": {
       "update-channel": "GoLand RELEASE",
       "url-template": "https://download.jetbrains.com/go/goland-{version}.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "fb0908ce2b4e43222758cc5c9b7498677f924271ca5d9a790e794e8ade28177d",
-      "url": "https://download.jetbrains.com/go/goland-2024.3.3.tar.gz",
-      "build_number": "243.24978.59"
+      "version": "2024.3.4",
+      "sha256": "f474f1f19fb04f7de73596c51b49f2675b3fc11df6a7aaba325c3ad98477d1df",
+      "url": "https://download.jetbrains.com/go/goland-2024.3.4.tar.gz",
+      "build_number": "243.25659.52"
     },
     "idea-community": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIC-{version}.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "ae3c45fe515fef672f52ce5c4701bc40a5f82cb94f21fed2c6e66c22e3dc91db",
-      "url": "https://download.jetbrains.com/idea/ideaIC-2024.3.3.tar.gz",
-      "build_number": "243.24978.46"
+      "version": "2024.3.4",
+      "sha256": "c6cf5f591854d29e4005549188b04a8174ce07a922b4d54150182f813bbaadf5",
+      "url": "https://download.jetbrains.com/idea/ideaIC-2024.3.4.tar.gz",
+      "build_number": "243.25659.39"
     },
     "idea-ultimate": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIU-{version}.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "9860a8d2a15c1033a8fcac9ffdabd797403318b516b63fdee474fa82ff0d738d",
-      "url": "https://download.jetbrains.com/idea/ideaIU-2024.3.3.tar.gz",
-      "build_number": "243.24978.46"
+      "version": "2024.3.4",
+      "sha256": "3765f4619f7ab8c28a6d523f741a4492d31d7d7d9ac8f5e7d8212dd2a71fdf9c",
+      "url": "https://download.jetbrains.com/idea/ideaIU-2024.3.4.tar.gz",
+      "build_number": "243.25659.39"
     },
     "mps": {
       "update-channel": "MPS RELEASE",
       "url-template": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}.tar.gz",
-      "version": "2024.3",
-      "sha256": "449048a9cdb944d4c3addf8156545c363be237ceb2b6f8516d72cb53eb00a37c",
-      "url": "https://download.jetbrains.com/mps/2024.3/MPS-2024.3.tar.gz",
-      "build_number": "243.21565.447"
+      "version": "2024.3.1",
+      "sha256": "b0e1f7bbc56ddf706510a420783418bc61e80bc4ea3c23ae60fb09cee846f01b",
+      "url": "https://download.jetbrains.com/mps/2024.3/MPS-2024.3.1.tar.gz",
+      "build_number": "243.24978.546"
     },
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "274001fc0e628ed9b5496f24da11d3e97f07b0fe3f45303235c37d124121a14a",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2024.3.3.tar.gz",
-      "build_number": "243.24978.50",
+      "version": "2024.3.4",
+      "sha256": "9344d68dda2c0062d9f6f03e27e959346f2f2bba2bce9f1c108653090d2dfb85",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2024.3.4.tar.gz",
+      "build_number": "243.25659.45",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-community-{version}.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "fbcbb8c5a23f5eabb1ab4b8e66ffb3b00988eab39df0b547c41ffbb1fc13968e",
-      "url": "https://download.jetbrains.com/python/pycharm-community-2024.3.3.tar.gz",
-      "build_number": "243.24978.54"
+      "version": "2024.3.4",
+      "sha256": "c61dd7aa1b5f9c6f7a0943aeec79c56d0aa0f5ed29591b7eb3007169e2545621",
+      "url": "https://download.jetbrains.com/python/pycharm-community-2024.3.4.tar.gz",
+      "build_number": "243.25659.43"
     },
     "pycharm-professional": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-professional-{version}.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "044029b647711a8b9d3e377e97ee4df8502c1894951981719c9ee0a19d81dbdb",
-      "url": "https://download.jetbrains.com/python/pycharm-professional-2024.3.3.tar.gz",
-      "build_number": "243.24978.54"
+      "version": "2024.3.4",
+      "sha256": "793bfdcbe38251678bc2fe07a026a594efa5af459137fb70dd786edb340c6430",
+      "url": "https://download.jetbrains.com/python/pycharm-professional-2024.3.4.tar.gz",
+      "build_number": "243.25659.43"
     },
     "rider": {
       "update-channel": "Rider RELEASE",
       "url-template": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}.tar.gz",
-      "version": "2024.3.5",
-      "sha256": "f2a78ee6d23eb580bc73f6005f9a069f2785786e0b39c88108d882ab9c9b925f",
-      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2024.3.5.tar.gz",
-      "build_number": "243.24978.27"
+      "version": "2024.3.6",
+      "sha256": "1f9db9f3f90c71fe476e3e17ac78be9fcc982e3f017c598f631b5cd600e6da43",
+      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2024.3.6.tar.gz",
+      "build_number": "243.25659.34"
     },
     "ruby-mine": {
       "update-channel": "RubyMine RELEASE",
       "url-template": "https://download.jetbrains.com/ruby/RubyMine-{version}.tar.gz",
-      "version": "2024.3.2.1",
-      "sha256": "94c68e534f420648316867470271d9a3111f3c2afa7fcde6a4e3986058b2cdd2",
-      "url": "https://download.jetbrains.com/ruby/RubyMine-2024.3.2.1.tar.gz",
-      "build_number": "243.23654.167"
+      "version": "2024.3.4",
+      "sha256": "9454aaf0877516b2047bc21517b5459860bdb4cbc797d66612760a336c011ee3",
+      "url": "https://download.jetbrains.com/ruby/RubyMine-2024.3.4.tar.gz",
+      "build_number": "243.25659.41"
     },
     "rust-rover": {
       "update-channel": "RustRover RELEASE",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}.tar.gz",
-      "version": "2024.3.4",
-      "sha256": "1e7347b37a26715f5afdf101208342e6088d0d8421c9ee1661f48efb38cac8b4",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-2024.3.4.tar.gz",
-      "build_number": "243.23654.180"
+      "version": "2024.3.5",
+      "sha256": "2815a48b28387dea4e3a0eb48a4fd3d903c403e0e8c6e938dee75fccf686e59c",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-2024.3.5.tar.gz",
+      "build_number": "243.24978.86"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webstorm/WebStorm-{version}.tar.gz",
-      "version": "2024.3.2.1",
-      "sha256": "9857bdcd2c05eb215e3974b4df2a5a9b0fc8c1df929d31c9c9dae4c87496de60",
-      "url": "https://download.jetbrains.com/webstorm/WebStorm-2024.3.2.1.tar.gz",
-      "build_number": "243.23654.157"
+      "version": "2024.3.4",
+      "sha256": "206a5e6b6fd3e603d62a7bbb26b0bf3b7ff7939b3e0cd136d360cdb80ec455f8",
+      "url": "https://download.jetbrains.com/webstorm/WebStorm-2024.3.4.tar.gz",
+      "build_number": "243.25659.40"
     },
     "writerside": {
       "update-channel": "Writerside EAP",
@@ -150,26 +150,26 @@
     "clion": {
       "update-channel": "CLion RELEASE",
       "url-template": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "c30c7d94c65d093d65099ce5a4e99358972710875d266759263e1f6cb39bb80a",
-      "url": "https://download.jetbrains.com/cpp/CLion-2024.3.3-aarch64.tar.gz",
-      "build_number": "243.24978.55"
+      "version": "2024.3.4",
+      "sha256": "336d19b695392e9a7bf426ae2d93b864ade48216e8df8f96ecfc9b2e9b9afa4f",
+      "url": "https://download.jetbrains.com/cpp/CLion-2024.3.4-aarch64.tar.gz",
+      "build_number": "243.25659.42"
     },
     "datagrip": {
       "update-channel": "DataGrip RELEASE",
       "url-template": "https://download.jetbrains.com/datagrip/datagrip-{version}-aarch64.tar.gz",
-      "version": "2024.3.4",
-      "sha256": "d5ec9d34302baf51efc2450d23efd5ed2384bf9c649900fca56746d89ecf5038",
-      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.3.4-aarch64.tar.gz",
-      "build_number": "243.23654.183"
+      "version": "2024.3.5",
+      "sha256": "20bae6b26f1aa6c88db1779103c8cceacb690caa776d10ef155ef1c17f25f37c",
+      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.3.5-aarch64.tar.gz",
+      "build_number": "243.24978.79"
     },
     "dataspell": {
       "update-channel": "DataSpell RELEASE",
       "url-template": "https://download.jetbrains.com/python/dataspell-{version}-aarch64.tar.gz",
-      "version": "2024.3.1.1",
-      "sha256": "31a564e58285a84b226017f18e658684720aa0a615f068447edbe817e6337f76",
-      "url": "https://download.jetbrains.com/python/dataspell-2024.3.1.1-aarch64.tar.gz",
-      "build_number": "243.22562.236"
+      "version": "2024.3.2",
+      "sha256": "708e2037711b6bcb6e155ce24082d4347c07295250feabb9715366c7da4d45ba",
+      "url": "https://download.jetbrains.com/python/dataspell-2024.3.2-aarch64.tar.gz",
+      "build_number": "243.25659.44"
     },
     "gateway": {
       "update-channel": "Gateway RELEASE",
@@ -182,91 +182,91 @@
     "goland": {
       "update-channel": "GoLand RELEASE",
       "url-template": "https://download.jetbrains.com/go/goland-{version}-aarch64.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "5235a1dfeb4df21f42baa77c2ba47f9c3e2ef2c744bbb3612baa7bc7a33feee0",
-      "url": "https://download.jetbrains.com/go/goland-2024.3.3-aarch64.tar.gz",
-      "build_number": "243.24978.59"
+      "version": "2024.3.4",
+      "sha256": "9e1a8921c92e3cd396d81f9a8011ed279d303565fe69b8c2322dedf9a6164643",
+      "url": "https://download.jetbrains.com/go/goland-2024.3.4-aarch64.tar.gz",
+      "build_number": "243.25659.52"
     },
     "idea-community": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIC-{version}-aarch64.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "9ce7e15135e97e92601654f456a6211127c165b35f62784886c4ec3b466af8f9",
-      "url": "https://download.jetbrains.com/idea/ideaIC-2024.3.3-aarch64.tar.gz",
-      "build_number": "243.24978.46"
+      "version": "2024.3.4",
+      "sha256": "b5b7227d785832bff65243fe9e2517e3645e6d67c8e7640b6b012d05dafddbc9",
+      "url": "https://download.jetbrains.com/idea/ideaIC-2024.3.4-aarch64.tar.gz",
+      "build_number": "243.25659.39"
     },
     "idea-ultimate": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIU-{version}-aarch64.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "e730c61185146c8afc181d058873932dd1ea7ef528d3dc3eaba2d3c4337b6b3b",
-      "url": "https://download.jetbrains.com/idea/ideaIU-2024.3.3-aarch64.tar.gz",
-      "build_number": "243.24978.46"
+      "version": "2024.3.4",
+      "sha256": "6928108d6481f1c827a6a5c994cd225229b9131b53f0c8dc03854aa585006648",
+      "url": "https://download.jetbrains.com/idea/ideaIU-2024.3.4-aarch64.tar.gz",
+      "build_number": "243.25659.39"
     },
     "mps": {
       "update-channel": "MPS RELEASE",
       "url-template": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}.tar.gz",
-      "version": "2024.3",
-      "sha256": "449048a9cdb944d4c3addf8156545c363be237ceb2b6f8516d72cb53eb00a37c",
-      "url": "https://download.jetbrains.com/mps/2024.3/MPS-2024.3.tar.gz",
-      "build_number": "243.21565.447"
+      "version": "2024.3.1",
+      "sha256": "b0e1f7bbc56ddf706510a420783418bc61e80bc4ea3c23ae60fb09cee846f01b",
+      "url": "https://download.jetbrains.com/mps/2024.3/MPS-2024.3.1.tar.gz",
+      "build_number": "243.24978.546"
     },
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}-aarch64.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "933472aab8dbf1f27ad04c32d2f5857f14f252a1bd75a4cbeb9d0a6864ee58e8",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2024.3.3-aarch64.tar.gz",
-      "build_number": "243.24978.50",
+      "version": "2024.3.4",
+      "sha256": "061dcd7f2972d4d9efc74cce29950929e1fdd02531e1f6365551649c8a254b1a",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2024.3.4-aarch64.tar.gz",
+      "build_number": "243.25659.45",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-community-{version}-aarch64.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "8a2c6064ac71769164f896ab4a6a72fffcadd6350875d43dbcf45ff853b6e5ce",
-      "url": "https://download.jetbrains.com/python/pycharm-community-2024.3.3-aarch64.tar.gz",
-      "build_number": "243.24978.54"
+      "version": "2024.3.4",
+      "sha256": "6cd540a586692f8784e0889ad83ce497eaf3052a3a319b9d53fa9594572409ee",
+      "url": "https://download.jetbrains.com/python/pycharm-community-2024.3.4-aarch64.tar.gz",
+      "build_number": "243.25659.43"
     },
     "pycharm-professional": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-professional-{version}-aarch64.tar.gz",
-      "version": "2024.3.3",
-      "sha256": "96108ca87d9def71143f88bf72033811cfe32812e0755f5778b4335a47353038",
-      "url": "https://download.jetbrains.com/python/pycharm-professional-2024.3.3-aarch64.tar.gz",
-      "build_number": "243.24978.54"
+      "version": "2024.3.4",
+      "sha256": "d4755118db79ff68be149619a2e0b8d480dd56694de131228a7d5ebbd0f82240",
+      "url": "https://download.jetbrains.com/python/pycharm-professional-2024.3.4-aarch64.tar.gz",
+      "build_number": "243.25659.43"
     },
     "rider": {
       "update-channel": "Rider RELEASE",
       "url-template": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}-aarch64.tar.gz",
-      "version": "2024.3.5",
-      "sha256": "572be78c88f925d35ec4521f1459780774c523c59a6257db2be4a465abb4088e",
-      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2024.3.5-aarch64.tar.gz",
-      "build_number": "243.24978.27"
+      "version": "2024.3.6",
+      "sha256": "f8c459c77327e97812507ba4724e6e9911e918425f5a187707cb66efafa47c45",
+      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2024.3.6-aarch64.tar.gz",
+      "build_number": "243.25659.34"
     },
     "ruby-mine": {
       "update-channel": "RubyMine RELEASE",
       "url-template": "https://download.jetbrains.com/ruby/RubyMine-{version}-aarch64.tar.gz",
-      "version": "2024.3.2.1",
-      "sha256": "eacd0a8b9c8e5445bc52bac7094667b6d9f1973d951ae47878ced4af97c95a0b",
-      "url": "https://download.jetbrains.com/ruby/RubyMine-2024.3.2.1-aarch64.tar.gz",
-      "build_number": "243.23654.167"
+      "version": "2024.3.4",
+      "sha256": "c63ca3230cecd887e9810500f466c51ee9d7430193f4feda315a6fdfc60c0447",
+      "url": "https://download.jetbrains.com/ruby/RubyMine-2024.3.4-aarch64.tar.gz",
+      "build_number": "243.25659.41"
     },
     "rust-rover": {
       "update-channel": "RustRover RELEASE",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}-aarch64.tar.gz",
-      "version": "2024.3.4",
-      "sha256": "a1b3626907930d32f256d14598e1013ce6999fae28a61f71013be2a7e7c52a1d",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-2024.3.4-aarch64.tar.gz",
-      "build_number": "243.23654.180"
+      "version": "2024.3.5",
+      "sha256": "00b097ca83268d06dbccffec7fdbaee788cdd683c65b4f0b5fd80aa01e22e92d",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-2024.3.5-aarch64.tar.gz",
+      "build_number": "243.24978.86"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webstorm/WebStorm-{version}-aarch64.tar.gz",
-      "version": "2024.3.2.1",
-      "sha256": "82ba3c43848e8a16ce2b9c4df4d8b3e8717e42b46328cebdcf09a51545b6a24e",
-      "url": "https://download.jetbrains.com/webstorm/WebStorm-2024.3.2.1-aarch64.tar.gz",
-      "build_number": "243.23654.157"
+      "version": "2024.3.4",
+      "sha256": "498efb5b3e79a0f71dc7f44f54a2155a17b5d53d8b7a71ae6aaef87abc59bfce",
+      "url": "https://download.jetbrains.com/webstorm/WebStorm-2024.3.4-aarch64.tar.gz",
+      "build_number": "243.25659.40"
     },
     "writerside": {
       "update-channel": "Writerside EAP",
@@ -289,26 +289,26 @@
     "clion": {
       "update-channel": "CLion RELEASE",
       "url-template": "https://download.jetbrains.com/cpp/CLion-{version}.dmg",
-      "version": "2024.3.3",
-      "sha256": "a5c50b3d615e93ee3461a420bb151b1af31a1f21356333522f4211f7c34bdc3e",
-      "url": "https://download.jetbrains.com/cpp/CLion-2024.3.3.dmg",
-      "build_number": "243.24978.55"
+      "version": "2024.3.4",
+      "sha256": "e92dc5ba5a2c59d09e3751de60ed31b0af012210f8381ffd1c5c3e254cc11718",
+      "url": "https://download.jetbrains.com/cpp/CLion-2024.3.4.dmg",
+      "build_number": "243.25659.42"
     },
     "datagrip": {
       "update-channel": "DataGrip RELEASE",
       "url-template": "https://download.jetbrains.com/datagrip/datagrip-{version}.dmg",
-      "version": "2024.3.4",
-      "sha256": "d56e34743ceaa76ee1fb5fa7a9da383dee83789dbab356c6267c912983b57029",
-      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.3.4.dmg",
-      "build_number": "243.23654.183"
+      "version": "2024.3.5",
+      "sha256": "224a58410ef3e067b0c848607d34f5ac180e76ef95ebd1a9f7a34202d36ea278",
+      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.3.5.dmg",
+      "build_number": "243.24978.79"
     },
     "dataspell": {
       "update-channel": "DataSpell RELEASE",
       "url-template": "https://download.jetbrains.com/python/dataspell-{version}.dmg",
-      "version": "2024.3.1.1",
-      "sha256": "eb5fd54f193f2c94de46c91957a4d36eedce8009cd272c5d8e4fc4763d9dafe3",
-      "url": "https://download.jetbrains.com/python/dataspell-2024.3.1.1.dmg",
-      "build_number": "243.22562.236"
+      "version": "2024.3.2",
+      "sha256": "474c8a04a699cd1538b9c1c882d0215a79932ed45baf8f0f3ec3be09e8ec9a1f",
+      "url": "https://download.jetbrains.com/python/dataspell-2024.3.2.dmg",
+      "build_number": "243.25659.44"
     },
     "gateway": {
       "update-channel": "Gateway RELEASE",
@@ -321,91 +321,91 @@
     "goland": {
       "update-channel": "GoLand RELEASE",
       "url-template": "https://download.jetbrains.com/go/goland-{version}.dmg",
-      "version": "2024.3.3",
-      "sha256": "a31af21ba0c08465e815e79c37bf90910af085bdf5f362ebc77e8879b5d18e8d",
-      "url": "https://download.jetbrains.com/go/goland-2024.3.3.dmg",
-      "build_number": "243.24978.59"
+      "version": "2024.3.4",
+      "sha256": "d621d2130f2f4b602c69a1d62c68112fcea189405ce1d7f6cbd75c7584ccf96c",
+      "url": "https://download.jetbrains.com/go/goland-2024.3.4.dmg",
+      "build_number": "243.25659.52"
     },
     "idea-community": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIC-{version}.dmg",
-      "version": "2024.3.3",
-      "sha256": "f5c94cc249e231464e0ad9497e2638d758ed16c6d260bac838cef771d244ea58",
-      "url": "https://download.jetbrains.com/idea/ideaIC-2024.3.3.dmg",
-      "build_number": "243.24978.46"
+      "version": "2024.3.4",
+      "sha256": "bc8944def81cc68b3920fbdfd8a880307c255fb0241b61c8816ec065f3657241",
+      "url": "https://download.jetbrains.com/idea/ideaIC-2024.3.4.dmg",
+      "build_number": "243.25659.39"
     },
     "idea-ultimate": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIU-{version}.dmg",
-      "version": "2024.3.3",
-      "sha256": "c48b52537f23c3fe9647406beee4e2c7af2fcd39008d69beef0627b7d4b63c38",
-      "url": "https://download.jetbrains.com/idea/ideaIU-2024.3.3.dmg",
-      "build_number": "243.24978.46"
+      "version": "2024.3.4",
+      "sha256": "2b4a62df4b4735c3a8d5ea0baba390f89d6a2342b561658d94310a767b17ba8b",
+      "url": "https://download.jetbrains.com/idea/ideaIU-2024.3.4.dmg",
+      "build_number": "243.25659.39"
     },
     "mps": {
       "update-channel": "MPS RELEASE",
       "url-template": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}-macos.dmg",
-      "version": "2024.3",
-      "sha256": "a5476c8aa604f3c37c192a5301eebf1c33d2ae733be018f485f3bf48d2a52366",
-      "url": "https://download.jetbrains.com/mps/2024.3/MPS-2024.3-macos.dmg",
-      "build_number": "243.21565.447"
+      "version": "2024.3.1",
+      "sha256": "a36d46d6a29f5f86991b1d1e8272bbc27bf00a2c5e562fe7fb3f95075badc85c",
+      "url": "https://download.jetbrains.com/mps/2024.3/MPS-2024.3.1-macos.dmg",
+      "build_number": "243.24978.546"
     },
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}.dmg",
-      "version": "2024.3.3",
-      "sha256": "358f3a161ef31279bd7bc44325266864d57f79a00e5b5139a9cd52caa76e66da",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2024.3.3.dmg",
-      "build_number": "243.24978.50",
+      "version": "2024.3.4",
+      "sha256": "32c0e7faaeb6c90c25192688d9f03c888f7bb957c91796713783b41805c65956",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2024.3.4.dmg",
+      "build_number": "243.25659.45",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-community-{version}.dmg",
-      "version": "2024.3.3",
-      "sha256": "b32d12edbc56c4bfb071bc13a657499db1294d727a020017874b4da60f9b0e9a",
-      "url": "https://download.jetbrains.com/python/pycharm-community-2024.3.3.dmg",
-      "build_number": "243.24978.54"
+      "version": "2024.3.4",
+      "sha256": "468914b3f03f8df651a9ac48df163b1fdee2b7f33ab64a71bed899da5427feab",
+      "url": "https://download.jetbrains.com/python/pycharm-community-2024.3.4.dmg",
+      "build_number": "243.25659.43"
     },
     "pycharm-professional": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-professional-{version}.dmg",
-      "version": "2024.3.3",
-      "sha256": "b31ed5d07c435146df5a48b5c77caf5b635396ebb023c8acd7ebbd76b8901cde",
-      "url": "https://download.jetbrains.com/python/pycharm-professional-2024.3.3.dmg",
-      "build_number": "243.24978.54"
+      "version": "2024.3.4",
+      "sha256": "7441c8878953c6e46177d9a99d09b328f7c2d493b4f1967ea67276f2f8f9f025",
+      "url": "https://download.jetbrains.com/python/pycharm-professional-2024.3.4.dmg",
+      "build_number": "243.25659.43"
     },
     "rider": {
       "update-channel": "Rider RELEASE",
       "url-template": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}.dmg",
-      "version": "2024.3.5",
-      "sha256": "1ae18866cb007a1133aba937f1c46a98de7e3f881a23da3b6ad736a38e3500f7",
-      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2024.3.5.dmg",
-      "build_number": "243.24978.27"
+      "version": "2024.3.6",
+      "sha256": "1677f8b1274149407799ba025f6a9316749a7b8d86ba142f77c807b52874f9fa",
+      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2024.3.6.dmg",
+      "build_number": "243.25659.34"
     },
     "ruby-mine": {
       "update-channel": "RubyMine RELEASE",
       "url-template": "https://download.jetbrains.com/ruby/RubyMine-{version}.dmg",
-      "version": "2024.3.2.1",
-      "sha256": "93b58637964adbb7b8be9f69f64546cdf66420c3f4b9ef8548a0a3cf6c80b9c7",
-      "url": "https://download.jetbrains.com/ruby/RubyMine-2024.3.2.1.dmg",
-      "build_number": "243.23654.167"
+      "version": "2024.3.4",
+      "sha256": "8cb255a6b66f77c5233cb2dd4c47cd4c8564c48cee3b1bb40128677a93cc39c8",
+      "url": "https://download.jetbrains.com/ruby/RubyMine-2024.3.4.dmg",
+      "build_number": "243.25659.41"
     },
     "rust-rover": {
       "update-channel": "RustRover RELEASE",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}.dmg",
-      "version": "2024.3.4",
-      "sha256": "8a883cc59218904bdc21facf08719e4afb5f8d4c160742bf242d6dba1a35ae57",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-2024.3.4.dmg",
-      "build_number": "243.23654.180"
+      "version": "2024.3.5",
+      "sha256": "eeaf1a2f88ffd5404d699dd0ea1dc9c6037649db797f0b333ea5f2b66875db5b",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-2024.3.5.dmg",
+      "build_number": "243.24978.86"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webstorm/WebStorm-{version}.dmg",
-      "version": "2024.3.2.1",
-      "sha256": "89a4fc730cdba15d09146d15e9f7fededef2f9ef10a748a386aaddaeb56cbe27",
-      "url": "https://download.jetbrains.com/webstorm/WebStorm-2024.3.2.1.dmg",
-      "build_number": "243.23654.157"
+      "version": "2024.3.4",
+      "sha256": "337f80f0a5a9179b64ac4552a89ffc93a1e3f1b5c8a1b94a04a9cad9d0d18808",
+      "url": "https://download.jetbrains.com/webstorm/WebStorm-2024.3.4.dmg",
+      "build_number": "243.25659.40"
     },
     "writerside": {
       "update-channel": "Writerside EAP",
@@ -428,26 +428,26 @@
     "clion": {
       "update-channel": "CLion RELEASE",
       "url-template": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.dmg",
-      "version": "2024.3.3",
-      "sha256": "6784b68f9c827a5cacd9247376b17229a8ce6514a6142caa96ceb9df2f47fd0d",
-      "url": "https://download.jetbrains.com/cpp/CLion-2024.3.3-aarch64.dmg",
-      "build_number": "243.24978.55"
+      "version": "2024.3.4",
+      "sha256": "e9d601aaed26d8efa82137649acb24c24fdc8d555c42afa9226ed08d3a19fe4d",
+      "url": "https://download.jetbrains.com/cpp/CLion-2024.3.4-aarch64.dmg",
+      "build_number": "243.25659.42"
     },
     "datagrip": {
       "update-channel": "DataGrip RELEASE",
       "url-template": "https://download.jetbrains.com/datagrip/datagrip-{version}-aarch64.dmg",
-      "version": "2024.3.4",
-      "sha256": "d968a1fcb1f34b59ce06103e05b20a582346e5cc81c3cf3f799dfc8940e7d79b",
-      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.3.4-aarch64.dmg",
-      "build_number": "243.23654.183"
+      "version": "2024.3.5",
+      "sha256": "1ba33de8b5595a7ab3ab683ed21200c6c884c7c9299a9dfe4414ae29b219dc09",
+      "url": "https://download.jetbrains.com/datagrip/datagrip-2024.3.5-aarch64.dmg",
+      "build_number": "243.24978.79"
     },
     "dataspell": {
       "update-channel": "DataSpell RELEASE",
       "url-template": "https://download.jetbrains.com/python/dataspell-{version}-aarch64.dmg",
-      "version": "2024.3.1.1",
-      "sha256": "cd2d146b54036d657b68343efb9c5f7cf234353f5ffdc9af85e05f63dbf7777c",
-      "url": "https://download.jetbrains.com/python/dataspell-2024.3.1.1-aarch64.dmg",
-      "build_number": "243.22562.236"
+      "version": "2024.3.2",
+      "sha256": "172a8641249784afe4f73359adb1419c2eb8b00bddfa4182bf691e44b3c4baa4",
+      "url": "https://download.jetbrains.com/python/dataspell-2024.3.2-aarch64.dmg",
+      "build_number": "243.25659.44"
     },
     "gateway": {
       "update-channel": "Gateway RELEASE",
@@ -460,91 +460,91 @@
     "goland": {
       "update-channel": "GoLand RELEASE",
       "url-template": "https://download.jetbrains.com/go/goland-{version}-aarch64.dmg",
-      "version": "2024.3.3",
-      "sha256": "a66df6461724bcd1b2d4ada74ae4fafced3cfb6f9e2206554d786655cb067cc3",
-      "url": "https://download.jetbrains.com/go/goland-2024.3.3-aarch64.dmg",
-      "build_number": "243.24978.59"
+      "version": "2024.3.4",
+      "sha256": "4c5e5f50b9209f673ed165c4c1fcb1bc88f4fd3ab2f4ad9740bc8855bb6f4e22",
+      "url": "https://download.jetbrains.com/go/goland-2024.3.4-aarch64.dmg",
+      "build_number": "243.25659.52"
     },
     "idea-community": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIC-{version}-aarch64.dmg",
-      "version": "2024.3.3",
-      "sha256": "02c436d5cbccee9ac9f2aa50f8254d9352b971296322a3b8efbcb990298b98d0",
-      "url": "https://download.jetbrains.com/idea/ideaIC-2024.3.3-aarch64.dmg",
-      "build_number": "243.24978.46"
+      "version": "2024.3.4",
+      "sha256": "bb5b4dc13f4a7ae5fc1416a54ad65ed7e682ea478aee68b1f7c3d3c70426e136",
+      "url": "https://download.jetbrains.com/idea/ideaIC-2024.3.4-aarch64.dmg",
+      "build_number": "243.25659.39"
     },
     "idea-ultimate": {
       "update-channel": "IntelliJ IDEA RELEASE",
       "url-template": "https://download.jetbrains.com/idea/ideaIU-{version}-aarch64.dmg",
-      "version": "2024.3.3",
-      "sha256": "d20b880918218b5dd75812a34817d4016f1109a23977f1de8aaf1fbad89ad06e",
-      "url": "https://download.jetbrains.com/idea/ideaIU-2024.3.3-aarch64.dmg",
-      "build_number": "243.24978.46"
+      "version": "2024.3.4",
+      "sha256": "2ce20f6414baf15283d745aea06bcd44213e5b3e0940f8485d1b92e446ca9262",
+      "url": "https://download.jetbrains.com/idea/ideaIU-2024.3.4-aarch64.dmg",
+      "build_number": "243.25659.39"
     },
     "mps": {
       "update-channel": "MPS RELEASE",
       "url-template": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}-macos-aarch64.dmg",
-      "version": "2024.3",
-      "url": "https://download.jetbrains.com/mps/2024.3/MPS-2024.3-macos-aarch64.dmg",
-      "sha256": "9c7118db757ba4fa7b6725efa5b006f4e6db47ca2b2948a92e43c435329c9c79",
-      "build_number": "243.21565.447"
+      "version": "2024.3.1",
+      "url": "https://download.jetbrains.com/mps/2024.3/MPS-2024.3.1-macos-aarch64.dmg",
+      "sha256": "d5000f7309d36ce65929bcdc85b36f543cadb2a5cc2f0675b35edb69489bde8e",
+      "build_number": "243.24978.546"
     },
     "phpstorm": {
       "update-channel": "PhpStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webide/PhpStorm-{version}-aarch64.dmg",
-      "version": "2024.3.3",
-      "sha256": "48bee7b2dd008ab5fe81052336da2030ac45f6a2de9e2650005f3f3edddb0204",
-      "url": "https://download.jetbrains.com/webide/PhpStorm-2024.3.3-aarch64.dmg",
-      "build_number": "243.24978.50",
+      "version": "2024.3.4",
+      "sha256": "9f5586b202165002f8ecbb6b6ffa332d6116c605eb487e49d50ba4d6b68b8785",
+      "url": "https://download.jetbrains.com/webide/PhpStorm-2024.3.4-aarch64.dmg",
+      "build_number": "243.25659.45",
       "version-major-minor": "2022.3"
     },
     "pycharm-community": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-community-{version}-aarch64.dmg",
-      "version": "2024.3.3",
-      "sha256": "4737c340527ebe7b434010d21aac57b3e23625739a06130d7b1058773a2306a9",
-      "url": "https://download.jetbrains.com/python/pycharm-community-2024.3.3-aarch64.dmg",
-      "build_number": "243.24978.54"
+      "version": "2024.3.4",
+      "sha256": "b8f585ff95cfa31a97db3ba98ff84843455b0a89790ea4abbcc8da05c6fa6f4d",
+      "url": "https://download.jetbrains.com/python/pycharm-community-2024.3.4-aarch64.dmg",
+      "build_number": "243.25659.43"
     },
     "pycharm-professional": {
       "update-channel": "PyCharm RELEASE",
       "url-template": "https://download.jetbrains.com/python/pycharm-professional-{version}-aarch64.dmg",
-      "version": "2024.3.3",
-      "sha256": "9ae7ed7aac293c86db6b7210ff8a53099b4a76d017fc76c24a8b5f73109cacbb",
-      "url": "https://download.jetbrains.com/python/pycharm-professional-2024.3.3-aarch64.dmg",
-      "build_number": "243.24978.54"
+      "version": "2024.3.4",
+      "sha256": "243d94467cfaeccbfcb21976d2bcf262beb31a9d52bb2cf8c6ab998987e4e49c",
+      "url": "https://download.jetbrains.com/python/pycharm-professional-2024.3.4-aarch64.dmg",
+      "build_number": "243.25659.43"
     },
     "rider": {
       "update-channel": "Rider RELEASE",
       "url-template": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}-aarch64.dmg",
-      "version": "2024.3.5",
-      "sha256": "e0b1a2b44c9943b2fa00536ee9f311c5738d711dad60bba6b779dc75fb3d8113",
-      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2024.3.5-aarch64.dmg",
-      "build_number": "243.24978.27"
+      "version": "2024.3.6",
+      "sha256": "bf3f08040194b1280a857886ac40c6518f83b40f60a6ee990d348a7e14b2c023",
+      "url": "https://download.jetbrains.com/rider/JetBrains.Rider-2024.3.6-aarch64.dmg",
+      "build_number": "243.25659.34"
     },
     "ruby-mine": {
       "update-channel": "RubyMine RELEASE",
       "url-template": "https://download.jetbrains.com/ruby/RubyMine-{version}-aarch64.dmg",
-      "version": "2024.3.2.1",
-      "sha256": "68235be97430c0e2e18b7bdc997604b63c092fa9f0e6529f11d488c44167fb51",
-      "url": "https://download.jetbrains.com/ruby/RubyMine-2024.3.2.1-aarch64.dmg",
-      "build_number": "243.23654.167"
+      "version": "2024.3.4",
+      "sha256": "7d93ff5df263a1526c0cb901e6df2abee547f9e9116f355cfc13a93a20b8ea4a",
+      "url": "https://download.jetbrains.com/ruby/RubyMine-2024.3.4-aarch64.dmg",
+      "build_number": "243.25659.41"
     },
     "rust-rover": {
       "update-channel": "RustRover RELEASE",
       "url-template": "https://download.jetbrains.com/rustrover/RustRover-{version}-aarch64.dmg",
-      "version": "2024.3.4",
-      "sha256": "32687e28d478ec052444578c4625d441265896e3e297c46b5474d2050663ad37",
-      "url": "https://download.jetbrains.com/rustrover/RustRover-2024.3.4-aarch64.dmg",
-      "build_number": "243.23654.180"
+      "version": "2024.3.5",
+      "sha256": "0f1c0470eaf046daeb1f1a3a1fa23a90dad94b8b3479d377600e38e4bae14e10",
+      "url": "https://download.jetbrains.com/rustrover/RustRover-2024.3.5-aarch64.dmg",
+      "build_number": "243.24978.86"
     },
     "webstorm": {
       "update-channel": "WebStorm RELEASE",
       "url-template": "https://download.jetbrains.com/webstorm/WebStorm-{version}-aarch64.dmg",
-      "version": "2024.3.2.1",
-      "sha256": "cc69e6ec0ecf8ecfae47afd17240637a89da8a51a3f77698bd08c611b8d1a9e8",
-      "url": "https://download.jetbrains.com/webstorm/WebStorm-2024.3.2.1-aarch64.dmg",
-      "build_number": "243.23654.157"
+      "version": "2024.3.4",
+      "sha256": "7e7745429e3541bd6cfaffda84aba4bcfe252db5cf93c7b2e2c75205217af57a",
+      "url": "https://download.jetbrains.com/webstorm/WebStorm-2024.3.4-aarch64.dmg",
+      "build_number": "243.25659.40"
     },
     "writerside": {
       "update-channel": "Writerside EAP",

pkgs/applications/editors/jetbrains/default.nix

@@ -403,8 +403,6 @@ rec {
               xargs patchelf \
                 --replace-needed libssl.so.10 libssl.so \
                 --replace-needed libcrypto.so.10 libcrypto.so
-
-              chmod +x $PWD/plugins/intellij-rust/bin/linux/*/intellij-rust-native-helper
             )
           '';
       });

pkgs/applications/editors/vscode/extensions/castwide.solargraph/default.nix

@@ -0,0 +1,17 @@
+{ lib, vscode-utils }:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "solargraph";
+    publisher = "castwide";
+    version = "0.24.1";
+    hash = "sha256-M96kGuCKo232rIwLovDU+C/rhEgZWT4s/zsR7CUYPnk=";
+  };
+  meta = {
+    description = "Ruby language server featuring code completion, intellisense, and inline documentation";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=castwide.solargraph";
+    homepage = "https://github.com/castwide/vscode-solargraph";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.bbenno ];
+  };
+}

pkgs/applications/editors/vscode/extensions/default.nix

@@ -391,8 +391,8 @@ let
         mktplcRef = {
           name = "astro-vscode";
           publisher = "astro-build";
-          version = "2.10.2";
-          hash = "sha256-lmqbZnCpkNN+i877hURRkPuRtuxRKD29bDppGBAEMGs=";
+          version = "2.15.4";
+          hash = "sha256-gpDbEasdrpY9Djd6g9lUYXcMFZRBMn7P4wW0/iU+qz8=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/astro-build.astro-vscode/changelog";
@@ -870,6 +870,8 @@ let
         };
       };
 
+      castwide.solargraph = callPackage ./castwide.solargraph { };
+
       catppuccin = {
         catppuccin-vsc = buildVscodeMarketplaceExtension {
           mktplcRef = {
@@ -1083,26 +1085,26 @@ let
             sources = {
               "x86_64-linux" = {
                 arch = "linux-x64";
-                hash = "sha256-+/0ZQkRS6AD8u5+t2hiPwQxzwhEc+n2F0GVk1s0n74U=";
+                hash = "sha256-0NSmyu+whQOSqaYQIt2C651k5CW1D9zmdn+0aLJF+CQ=";
               };
               "x86_64-darwin" = {
                 arch = "darwin-x64";
-                hash = "sha256-FZbTBPn12pv9bQWqfWwPapFLTpp5nclp0RH/WZc6/r4=";
+                hash = "sha256-Ek5WswTcrHHC3E3zABYz1afC3oic7msq5ddSBLT2+dY=";
               };
               "aarch64-linux" = {
                 arch = "linux-arm64";
-                hash = "sha256-e6zfflFgxVuikWwQuU6ImEuVk8xgi2HyY8uZwBoQiLU=";
+                hash = "sha256-e/vVKvOdt+mHp9gs+Kse13aFWX6DELeUtPdYLeuh9hE=";
               };
               "aarch64-darwin" = {
                 arch = "darwin-arm64";
-                hash = "sha256-SfA9wkvYT2Vb3GpJRjWE6lzZAXdFCnEKoKl0hjT0Llw=";
+                hash = "sha256-1oJ41WBlVUm7AUIwsIOyoucx9EtkReG8pxpYqgdZx5w=";
               };
             };
           in
           {
             name = "continue";
             publisher = "Continue";
-            version = "0.8.54";
+            version = "0.8.68";
           }
           // sources.${stdenv.system};
         nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
@@ -1270,8 +1272,8 @@ let
         mktplcRef = {
           name = "vscode-markdownlint";
           publisher = "DavidAnson";
-          version = "0.56.0";
-          hash = "sha256-ITSpPe032XcGIlfRQtJSR0iNTizs85qwfRaTtKwNn50=";
+          version = "0.58.2";
+          hash = "sha256-YAlh5aZN4wqmlyfV+HSOYwmLrrC8SRe8AnYwtSqbtlE=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DavidAnson.vscode-markdownlint/changelog";
@@ -1649,8 +1651,8 @@ let
         mktplcRef = {
           name = "EditorConfig";
           publisher = "EditorConfig";
-          version = "0.16.4";
-          sha256 = "0fa4h9hk1xq6j3zfxvf483sbb4bd17fjl5cdm3rll7z9kaigdqwg";
+          version = "0.17.0";
+          hash = "sha256-/NW/0KYVF0sCgat21aR/5nbVyoTHpDoqCPz+6zc0HHs=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/EditorConfig.EditorConfig/changelog";
@@ -2103,8 +2105,8 @@ let
           publisher = "github";
           name = "copilot";
           # Verify which version is available with nix run nixpkgs#vsce -- show github.copilot --json
-          version = "1.275.0"; # compatible with vscode ^1.97
-          hash = "sha256-pxH8hHRN36/ggqfMWOUYxANrblJ6S5GfslN15ZttumQ=";
+          version = "1.279.1416"; # compatible with vscode ^1.97
+          hash = "sha256-t6d+YkOElpeggwZ86VDftVz2bjDx5Rl/yOn5L5+1R/g=";
         };
 
         meta = {
@@ -2121,8 +2123,8 @@ let
           publisher = "github";
           name = "copilot-chat";
           # Verify which version is available with nix run nixpkgs#vsce -- show github.copilot-chat --json
-          version = "0.24.2025021302"; # latest compatible with vscode ^1.97
-          hash = "sha256-+lb+fo5PvEvWrQlyMi72SJ8bVwd8zTU2tDK+jJJSkPA=";
+          version = "0.26.2025030506"; # latest compatible with vscode ^1.98
+          hash = "sha256-mCmZs5xGxcqHyo8NyMjk2mu9LmxFlMb2NGUwjXg27JA=";
         };
         meta = {
           description = "GitHub Copilot Chat is a companion extension to GitHub Copilot that houses experimental chat features";
@@ -2808,6 +2810,8 @@ let
         };
       };
 
+      johnpapa.winteriscoming = callPackage ./johnpapa.winteriscoming { };
+
       jgclark.vscode-todo-highlight = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "vscode-todo-highlight";
@@ -4103,7 +4107,11 @@ let
           hash = "sha256-3cuonI98gVFE/GwPA7QCA1LfSC8oXqgtV4i6iOngwhk=";
         };
         meta = {
+          description = "YAML Language Support by Red Hat, with built-in Kubernetes syntax support";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=redhat.vscode-yaml";
+          homepage = "https://github.com/redhat-developer/vscode-yaml";
           license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.raroh73 ];
         };
       };
 

pkgs/applications/editors/vscode/extensions/johnpapa.winteriscoming/default.nix

@@ -0,0 +1,17 @@
+{ lib, vscode-utils }:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "winteriscoming";
+    publisher = "johnpapa";
+    version = "1.4.4";
+    hash = "sha256-47zCB7VDj+gYXUeblbNsWnGMJt4U4UMyqU1NYTmz2Jc=";
+  };
+  meta = {
+    description = "Preferred dark/light themes by John Papa";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=johnpapa.winteriscoming";
+    homepage = "https://github.com/johnpapa/vscode-winteriscoming";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.therobot2105 ];
+  };
+}

pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix

@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "mongodb-vscode";
     publisher = "mongodb";
-    version = "1.12.0";
-    hash = "sha256-Lb4eixqR/ifwZD3cV1rSJ8mK2dH4ZFghLHINGJILmRQ=";
+    version = "1.12.1";
+    hash = "sha256-jbR6NGYgDYArCHqMHKPXuht7UViw0Ii3Uc8IqTGTe8k=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix

@@ -22,7 +22,7 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
     name = "python";
     publisher = "ms-python";
     version = "2025.2.0";
-    hash = "sha256-bq6xcNTzGsnoAcwjn4yyCVN7n4kXOPULHu0V2Vgzu68=";
+    hash = "sha256-f573A/7s8jVfH1f3ZYZSTftrfBs6iyMWewhorX4Z0Nc=";
   };
 
   buildInputs = [ icu ];

pkgs/applications/graphics/hydrus/default.nix

@@ -1,146 +0,0 @@
-{ lib
-, fetchFromGitHub
-, wrapQtAppsHook
-, miniupnpc
-, ffmpeg
-, enableSwftools ? false
-, swftools
-, python3Packages
-, pythonOlder
-, qtbase
-, qtcharts
-, makeDesktopItem
-, copyDesktopItems
-}:
-
-python3Packages.buildPythonPackage rec {
-  pname = "hydrus";
-  version = "609";
-  format = "other";
-
-  src = fetchFromGitHub {
-    owner = "hydrusnetwork";
-    repo = "hydrus";
-    tag = "v${version}";
-    hash = "sha256-yHRYGZ38H3nlOlo3NrSqG+2Z3kUiKMfHpMFvAM+T80U=";
-  };
-
-  nativeBuildInputs = [
-    wrapQtAppsHook
-    python3Packages.mkdocs-material
-    copyDesktopItems
-  ];
-
-  buildInputs = [
-    qtbase
-    qtcharts
-  ];
-
-  desktopItems = [
-    (makeDesktopItem {
-      name = "hydrus-client";
-      exec = "hydrus-client";
-      desktopName = "Hydrus Client";
-      icon = "hydrus-client";
-      comment = meta.description;
-      terminal = false;
-      type = "Application";
-      categories = [ "FileTools" "Utility" ];
-    })
-  ];
-
-
-  propagatedBuildInputs = with python3Packages; [
-    beautifulsoup4
-    cbor2
-    chardet
-    cloudscraper
-    dateparser
-    html5lib
-    lxml
-    lz4
-    numpy
-    opencv4
-    olefile
-    pillow
-    pillow-heif
-    psutil
-    psd-tools
-    pympler
-    pyopenssl
-    pyqt6
-    pyqt6-charts
-    pysocks
-    python-dateutil
-    python3Packages.mpv
-    pyyaml
-    qtpy
-    requests
-    show-in-file-manager
-    send2trash
-    service-identity
-    twisted
-  ];
-
-  nativeCheckInputs = with python3Packages; [
-    mock
-    httmock
-  ];
-
-  outputs = [ "out" "doc" ];
-
-  installPhase = ''
-    runHook preInstall
-
-    # Move the hydrus module and related directories
-    mkdir -p $out/${python3Packages.python.sitePackages}
-    mv {hydrus,static,db} $out/${python3Packages.python.sitePackages}
-    # Fix random files being marked with execute permissions
-    chmod -x $out/${python3Packages.python.sitePackages}/static/*.{png,svg,ico}
-    # Build docs
-    mkdocs build -d help
-    mkdir -p $doc/share/doc
-    mv help $doc/share/doc/hydrus
-
-    # install the hydrus binaries
-    mkdir -p $out/bin
-    install -m0755 hydrus_server.py $out/bin/hydrus-server
-    install -m0755 hydrus_client.py $out/bin/hydrus-client
-    install -m0755 hydrus_test.py $out/bin/hydrus-test
-
-    # desktop item
-    mkdir -p "$out/share/icons/hicolor/scalable/apps"
-    ln -s "$doc/share/doc/hydrus/assets/hydrus-white.svg" "$out/share/icons/hicolor/scalable/apps/hydrus-client.svg"
-  '' + lib.optionalString enableSwftools ''
-    mkdir -p $out/${python3Packages.python.sitePackages}/bin
-    # swfrender seems to have to be called sfwrender_linux
-    # not sure if it can be loaded through PATH, but this is simpler
-    # $out/python3Packages.python.sitePackages/bin is correct NOT .../hydrus/bin
-    ln -s ${swftools}/bin/swfrender $out/${python3Packages.python.sitePackages}/bin/swfrender_linux
-  '' + ''
-    runHook postInstall
-  '';
-
-  checkPhase = ''
-    runHook preCheck
-
-    export QT_QPA_PLATFORM=offscreen
-    export HOME=$(mktemp -d)
-    $out/bin/hydrus-test
-
-    runHook postCheck
-  '';
-
-  dontWrapQtApps = true;
-  preFixup = ''
-    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
-    makeWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ ffmpeg miniupnpc ]})
-  '';
-
-  meta = with lib; {
-    description = "Danbooru-like image tagging and searching system for the desktop";
-    license = licenses.wtfpl;
-    homepage = "https://hydrusnetwork.github.io/hydrus/";
-    maintainers = with maintainers; [ dandellion evanjs ];
-  };
-}

pkgs/applications/misc/meerk40t/default.nix

@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "MeerK40t";
-  version = "0.9.7010";
+  version = "0.9.7020";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "meerk40t";
     repo = pname;
     tag = version;
-    hash = "sha256-pH1sVY8YVpg4gHU8/K87QcR7bGKgblRp2HpgKkb3+NQ=";
+    hash = "sha256-mdl/zW53OM3MtyFoWbTI1yGY2yW72mglO5djHqKx4Fw=";
   };
 
   nativeBuildInputs =

pkgs/applications/misc/organicmaps/default.nix

@@ -30,13 +30,13 @@ let
   };
 in stdenv.mkDerivation (finalAttrs: {
   pname = "organicmaps";
-  version = "2025.02.17-3";
+  version = "2025.03.02-7";
 
   src = fetchFromGitHub {
     owner = "organicmaps";
     repo = "organicmaps";
     tag = "${finalAttrs.version}-android";
-    hash = "sha256-9IDj+vkwSHsqX6Fe7siZV/RAxC242+4hDhXLjwc0tpg=";
+    hash = "sha256-5WX+YDgu8Ll5+rZWWxfbNW0pBFz+2XWkw/ahM14Ml08=";
     fetchSubmodules = true;
   };
 

pkgs/applications/networking/browsers/chromium/common.nix

@@ -479,18 +479,11 @@ let
         # Rebased variant of patch to build M126+ with LLVM 17.
         # staging-next will bump LLVM to 18, so we will be able to drop this soon.
         ./patches/chromium-126-llvm-17.patch
-      ]
-      ++ lib.optionals (versionRange "126" "129") [
         # Partial revert of https://github.com/chromium/chromium/commit/3687976b0c6d36cf4157419a24a39f6770098d61
         # allowing us to use our rustc and our clang.
-        # Rebased variant of patch right above to build M126+ with our rust and our clang.
-        ./patches/chromium-126-rust.patch
-      ]
-      ++ lib.optionals (chromiumVersionAtLeast "129") [
-        # Rebased variant of patch right above to build M129+ with our rust and our clang.
         ./patches/chromium-129-rust.patch
       ]
-      ++ lib.optionals (chromiumVersionAtLeast "130" && !ungoogled) [
+      ++ lib.optionals (!ungoogled) [
         # Our rustc.llvmPackages is too old for std::hardware_destructive_interference_size
         # and std::hardware_constructive_interference_size.
         # So let's revert the change for now and hope that our rustc.llvmPackages and

pkgs/applications/networking/browsers/chromium/default.nix

@@ -77,27 +77,23 @@ let
         pulseSupport
         ungoogled
         ;
-      gnChromium = buildPackages.gn.overrideAttrs (
-        oldAttrs:
-        {
-          version = if (upstream-info.deps.gn ? "version") then upstream-info.deps.gn.version else "0";
-          src = fetchgit {
-            url = "https://gn.googlesource.com/gn";
-            inherit (upstream-info.deps.gn) rev hash;
-          };
+      gnChromium = buildPackages.gn.overrideAttrs (oldAttrs: {
+        version = if (upstream-info.deps.gn ? "version") then upstream-info.deps.gn.version else "0";
+        src = fetchgit {
+          url = "https://gn.googlesource.com/gn";
+          inherit (upstream-info.deps.gn) rev hash;
+        };
 
-          # Relax hardening as otherwise gn unstable 2024-06-06 and later fail with:
-          # cc1plus: error: '-Wformat-security' ignored without '-Wformat' [-Werror=format-security]
-          hardeningDisable = [ "format" ];
-        }
-        // lib.optionalAttrs (chromiumVersionAtLeast "130") {
-          # At the time of writing, gn is at v2024-05-13 and has a backported patch.
-          # This patch appears to be already present in v2024-09-09 (from M130), which
-          # results in the patch not applying and thus failing the build.
-          # As a work around until gn is updated again, we filter specifically that patch out.
-          patches = lib.filter (e: lib.getName e != "LFS64.patch") oldAttrs.patches;
-        }
-      );
+        # Relax hardening as otherwise gn unstable 2024-06-06 and later fail with:
+        # cc1plus: error: '-Wformat-security' ignored without '-Wformat' [-Werror=format-security]
+        hardeningDisable = [ "format" ];
+
+        # At the time of writing, gn is at v2024-05-13 and has a backported patch.
+        # This patch appears to be already present in v2024-09-09 (from M130), which
+        # results in the patch not applying and thus failing the build.
+        # As a work around until gn is updated again, we filter specifically that patch out.
+        patches = lib.filter (e: lib.getName e != "LFS64.patch") oldAttrs.patches;
+      });
     });
 
     browser = callPackage ./browser.nix {

pkgs/applications/networking/browsers/chromium/patches/chromium-126-rust.patch

@@ -1,21 +0,0 @@
-diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
-index 6efe967eb0a1c..2ddae4efacbfa 100644
---- a/build/config/compiler/BUILD.gn
-+++ b/build/config/compiler/BUILD.gn
-@@ -1653,16 +1653,6 @@ config("runtime_library") {
-     configs += [ "//build/config/c++:runtime_library" ]
-   }
- 
--  # Rust and C++ both provide intrinsics for LLVM to call for math operations. We
--  # want to use the C++ intrinsics, not the ones in the Rust compiler_builtins
--  # library. The Rust symbols are marked as weak, so that they can be replaced by
--  # the C++ symbols. This config ensures the C++ symbols exist and are strong in
--  # order to cause that replacement to occur by explicitly linking in clang's
--  # compiler-rt library.
--  if (is_clang && toolchain_has_rust) {
--    configs += [ "//build/config/clang:compiler_builtins" ]
--  }
--
-   # TODO(crbug.com/40570904): Come up with a better name for is POSIX + Fuchsia
-   # configuration.
-   if (is_posix || is_fuchsia) {

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -45,11 +45,11 @@
     "vendorHash": "sha256-NO7e8S+UhbbGWeBm4+bzm6HqqA3G3WZwj3wJmug0aSA="
   },
   "alicloud": {
-    "hash": "sha256-87QLXAIIBZ4EDdN28Ti4QGtnCDqMoj/D6kGoeyjgHHM=",
+    "hash": "sha256-wMoS45YbnDCbjhEE/Mv7oDH7RMixri5mxtG6G/pavDY=",
     "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
     "owner": "aliyun",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.243.0",
+    "rev": "v1.244.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -117,13 +117,13 @@
     "vendorHash": null
   },
   "aws": {
-    "hash": "sha256-SqBPe7/FYK4ybCQsEOq81/gg/mgvQYxYaYUkgg6O3w0=",
+    "hash": "sha256-4vRXU7FtSMrh/Zou3+agXqXXARFdZ0h6hxglKlY9+YU=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v5.88.0",
+    "rev": "v5.90.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-C3/2Kw66b37OUctT0/SdHNshs0r3wnVNP6Z3VuTwsw0="
+    "vendorHash": "sha256-zjb8SQ6ALQryN7wE4MKn3nhhqEvoeq8CyZd8PlkZJt4="
   },
   "azuread": {
     "hash": "sha256-UV6jgVS8tzWiEBC/C/U7/2bGZ1sqk2MnS8xNRBuL+C8=",
@@ -507,13 +507,13 @@
     "vendorHash": "sha256-VPJ0ekrGEzhIZ6ExrU5sLb2meFHT9cak53BO7z6BCC4="
   },
   "google": {
-    "hash": "sha256-l3zmkCKI8qjYsQMXL38h00Mz/+PMS6OWjlh4qv89y2s=",
+    "hash": "sha256-qpqpb1uXREMMtd/3TyXIdn3e2TjLSTSP5if+g/e4XhU=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "repo": "terraform-provider-google",
-    "rev": "v6.21.0",
+    "rev": "v6.24.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-c4xM36A4wuYyy08+KSPYG4bKikSfAP0QSQ3ni1IszAI="
+    "vendorHash": "sha256-UzoyVVBSrpxQnTfTJvGHIGR0wSFx8cSVVuTpo9tio2A="
   },
   "google-beta": {
     "hash": "sha256-bxL3ufwXuioA73my5G89YSbvhHSz/DjzNbN3CfxarF8=",
@@ -1291,11 +1291,11 @@
     "vendorHash": "sha256-0B2XRpvUk0mgDu3inz37LLJijwH3aQyoSb8IaHr6was="
   },
   "tencentcloud": {
-    "hash": "sha256-zTH4s6PuYarQHvtFHB0yrFmsFLuoY0PmMjVD/FKnCkM=",
+    "hash": "sha256-UO3Gjz5+h4YIj62gCJccFWW8k7qNbmmBzFlT1WWdXl8=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.81.168",
+    "rev": "v1.81.171",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1463,12 +1463,12 @@
     "vendorHash": "sha256-GRnVhGpVgFI83Lg34Zv1xgV5Kp8ioKTFV5uaqS80ATg="
   },
   "yandex": {
-    "hash": "sha256-7qnPqw969SwWdn0aCmJtcYuBDMRspL8lTzI/EC+8FkU=",
+    "hash": "sha256-NPwDdTHKvQVfGDfR0kv0KvjJrjiRs8JcPtMcb3qcm5k=",
     "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
     "owner": "yandex-cloud",
     "repo": "terraform-provider-yandex",
-    "rev": "v0.138.0",
+    "rev": "v0.139.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-eKB5SPGRLG50lcR2f4g7SFIB04RtyfqFbK3FXFJBvxg="
+    "vendorHash": "sha256-2UnAigHaUj1d1UV/bsLnf2MF1I26N6242n6O8xh7U1s="
   }
 }

pkgs/build-support/testers/default.nix

@@ -69,6 +69,10 @@
     fi
   '';
 
+  # See https://nixos.org/manual/nixpkgs/unstable/#tester-testEqualArrayOrMap
+  # or doc/build-helpers/testers.chapter.md
+  testEqualArrayOrMap = callPackage ./testEqualArrayOrMap { };
+
   # See https://nixos.org/manual/nixpkgs/unstable/#tester-testVersion
   # or doc/build-helpers/testers.chapter.md
   testVersion =
@@ -190,4 +194,6 @@
   testMetaPkgConfig = callPackage ./testMetaPkgConfig/tester.nix { };
 
   shellcheck = callPackage ./shellcheck/tester.nix { };
+
+  shfmt = callPackage ./shfmt { };
 }

pkgs/build-support/testers/shfmt/default.nix

@@ -0,0 +1,29 @@
+{
+  lib,
+  shfmt,
+  stdenvNoCC,
+}:
+# See https://nixos.org/manual/nixpkgs/unstable/#tester-shfmt
+# or doc/build-helpers/testers.chapter.md
+{
+  name,
+  src,
+  indent ? 2,
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  __structuredAttrs = true;
+  strictDeps = true;
+  inherit src indent;
+  name = "shfmt-${name}";
+  dontUnpack = true; # Unpack phase tries to extract archive
+  nativeBuildInputs = [ shfmt ];
+  doCheck = true;
+  dontConfigure = true;
+  dontBuild = true;
+  checkPhase = ''
+    shfmt --diff --indent $indent --simplify "$src"
+  '';
+  installPhase = ''
+    touch "$out"
+  '';
+})

pkgs/build-support/testers/shfmt/src/indent2.sh

@@ -0,0 +1,3 @@
+hello() {
+  echo "hello"
+}

pkgs/build-support/testers/shfmt/tests.nix

@@ -0,0 +1,43 @@
+{ lib, testers }:
+lib.recurseIntoAttrs {
+  # Positive tests
+  indent2 = testers.shfmt {
+    name = "indent2";
+    indent = 2;
+    src = ./src/indent2.sh;
+  };
+  indent2Bin = testers.shfmt {
+    name = "indent2Bin";
+    indent = 2;
+    src = ./src;
+  };
+  # Negative tests
+  indent2With0 = testers.testBuildFailure' {
+    drv = testers.shfmt {
+      name = "indent2";
+      indent = 0;
+      src = ./src/indent2.sh;
+    };
+  };
+  indent2BinWith0 = testers.testBuildFailure' {
+    drv = testers.shfmt {
+      name = "indent2Bin";
+      indent = 0;
+      src = ./src;
+    };
+  };
+  indent2With4 = testers.testBuildFailure' {
+    drv = testers.shfmt {
+      name = "indent2";
+      indent = 4;
+      src = ./src/indent2.sh;
+    };
+  };
+  indent2BinWith4 = testers.testBuildFailure' {
+    drv = testers.shfmt {
+      name = "indent2Bin";
+      indent = 4;
+      src = ./src;
+    };
+  };
+}

pkgs/build-support/testers/test/default.nix

@@ -39,6 +39,8 @@ lib.recurseIntoAttrs {
 
   shellcheck = pkgs.callPackage ../shellcheck/tests.nix { };
 
+  shfmt = pkgs.callPackages ../shfmt/tests.nix { };
+
   runCommand = lib.recurseIntoAttrs {
     bork = pkgs.python3Packages.bork.tests.pytest-network;
 
@@ -356,4 +358,6 @@ lib.recurseIntoAttrs {
         touch -- "$out"
       '';
   };
+
+  testEqualArrayOrMap = pkgs.callPackages ../testEqualArrayOrMap/tests.nix { };
 }

pkgs/build-support/testers/testEqualArrayOrMap/assert-equal-array.sh

@@ -0,0 +1,71 @@
+# shellcheck shell=bash
+
+# Tests if an array is declared.
+isDeclaredArray() {
+  # shellcheck disable=SC2034
+  local -nr arrayRef="$1" && [[ ${!arrayRef@a} =~ a ]]
+}
+
+# Asserts that two arrays are equal, printing out differences if they are not.
+# Does not short circuit on the first difference.
+assertEqualArray() {
+  if (($# != 2)); then
+    nixErrorLog "expected two arguments!"
+    nixErrorLog "usage: assertEqualArray expectedArrayRef actualArrayRef"
+    exit 1
+  fi
+
+  local -nr expectedArrayRef="$1"
+  local -nr actualArrayRef="$2"
+
+  if ! isDeclaredArray "${!expectedArrayRef}"; then
+    nixErrorLog "first arugment expectedArrayRef must be an array reference to a declared array"
+    exit 1
+  fi
+
+  if ! isDeclaredArray "${!actualArrayRef}"; then
+    nixErrorLog "second arugment actualArrayRef must be an array reference to a declared array"
+    exit 1
+  fi
+
+  local -ir expectedLength=${#expectedArrayRef[@]}
+  local -ir actualLength=${#actualArrayRef[@]}
+
+  local -i hasDiff=0
+
+  if ((expectedLength != actualLength)); then
+    nixErrorLog "arrays differ in length: expectedArray has length $expectedLength but actualArray has length $actualLength"
+    hasDiff=1
+  fi
+
+  local -i idx=0
+  local expectedValue
+  local actualValue
+
+  # We iterate so long as at least one array has indices we've not considered.
+  # This means that `idx` is a valid index to *at least one* of the arrays.
+  for ((idx = 0; idx < expectedLength || idx < actualLength; idx++)); do
+    # Update values for variables which are still in range/valid.
+    if ((idx < expectedLength)); then
+      expectedValue="${expectedArrayRef[idx]}"
+    fi
+
+    if ((idx < actualLength)); then
+      actualValue="${actualArrayRef[idx]}"
+    fi
+
+    # Handle comparisons.
+    if ((idx >= expectedLength)); then
+      nixErrorLog "arrays differ at index $idx: expectedArray has no such index but actualArray has value ${actualValue@Q}"
+      hasDiff=1
+    elif ((idx >= actualLength)); then
+      nixErrorLog "arrays differ at index $idx: expectedArray has value ${expectedValue@Q} but actualArray has no such index"
+      hasDiff=1
+    elif [[ $expectedValue != "$actualValue" ]]; then
+      nixErrorLog "arrays differ at index $idx: expectedArray has value ${expectedValue@Q} but actualArray has value ${actualValue@Q}"
+      hasDiff=1
+    fi
+  done
+
+  ((hasDiff)) && exit 1 || return 0
+}

pkgs/build-support/testers/testEqualArrayOrMap/assert-equal-map.sh

@@ -0,0 +1,102 @@
+# shellcheck shell=bash
+
+# Tests if a map is declared.
+isDeclaredMap() {
+  # shellcheck disable=SC2034
+  local -nr mapRef="$1" && [[ ${!mapRef@a} =~ A ]]
+}
+
+# Asserts that two maps are equal, printing out differences if they are not.
+# Does not short circuit on the first difference.
+assertEqualMap() {
+  if (($# != 2)); then
+    nixErrorLog "expected two arguments!"
+    nixErrorLog "usage: assertEqualMap expectedMapRef actualMapRef"
+    exit 1
+  fi
+
+  local -nr expectedMapRef="$1"
+  local -nr actualMapRef="$2"
+
+  if ! isDeclaredMap "${!expectedMapRef}"; then
+    nixErrorLog "first arugment expectedMapRef must be an associative array reference to a declared associative array"
+    exit 1
+  fi
+
+  if ! isDeclaredMap "${!actualMapRef}"; then
+    nixErrorLog "second arugment actualMapRef must be an associative array reference to a declared associative array"
+    exit 1
+  fi
+
+  # NOTE:
+  # From the `sort` manpage: "The locale specified by the environment affects sort order. Set LC_ALL=C to get the
+  # traditional sort order that uses native byte values."
+  # We specify the environment variable in a subshell to avoid polluting the caller's environment.
+
+  local -a sortedExpectedKeys
+  mapfile -d '' -t sortedExpectedKeys < <(printf '%s\0' "${!expectedMapRef[@]}" | LC_ALL=C sort --stable --zero-terminated)
+
+  local -a sortedActualKeys
+  mapfile -d '' -t sortedActualKeys < <(printf '%s\0' "${!actualMapRef[@]}" | LC_ALL=C sort --stable --zero-terminated)
+
+  local -ir expectedLength=${#expectedMapRef[@]}
+  local -ir actualLength=${#actualMapRef[@]}
+
+  local -i hasDiff=0
+
+  if ((expectedLength != actualLength)); then
+    nixErrorLog "maps differ in length: expectedMap has length $expectedLength but actualMap has length $actualLength"
+    hasDiff=1
+  fi
+
+  local -i expectedKeyIdx=0
+  local expectedKey
+  local expectedValue
+  local -i actualKeyIdx=0
+  local actualKey
+  local actualValue
+
+  # We iterate so long as at least one map has keys we've not considered.
+  while ((expectedKeyIdx < expectedLength || actualKeyIdx < actualLength)); do
+    # Update values for variables which are still in range/valid.
+    if ((expectedKeyIdx < expectedLength)); then
+      expectedKey="${sortedExpectedKeys["$expectedKeyIdx"]}"
+      expectedValue="${expectedMapRef["$expectedKey"]}"
+    fi
+
+    if ((actualKeyIdx < actualLength)); then
+      actualKey="${sortedActualKeys["$actualKeyIdx"]}"
+      actualValue="${actualMapRef["$actualKey"]}"
+    fi
+
+    # In the case actualKeyIdx is valid and expectedKey comes after actualKey or expectedKeyIdx is invalid, actualMap
+    # has an extra key relative to expectedMap.
+    # NOTE: In Bash, && and || have the same precedence, so use the fact they're left-associative to enforce groups.
+    if ((actualKeyIdx < actualLength)) && [[ $expectedKey > $actualKey ]] || ((expectedKeyIdx >= expectedLength)); then
+      nixErrorLog "maps differ at key ${actualKey@Q}: expectedMap has no such key but actualMap has value ${actualValue@Q}"
+      hasDiff=1
+      actualKeyIdx+=1
+
+    # In the case actualKeyIdx is invalid or expectedKey comes before actualKey, expectedMap has an extra key relative
+    # to actualMap.
+    # NOTE: By virtue of the previous condition being false, we know the negation is true. Namely, expectedKeyIdx is
+    # valid AND (actualKeyIdx is invalid OR expectedKey <= actualKey).
+    elif ((actualKeyIdx >= actualLength)) || [[ $expectedKey < $actualKey ]]; then
+      nixErrorLog "maps differ at key ${expectedKey@Q}: expectedMap has value ${expectedValue@Q} but actualMap has no such key"
+      hasDiff=1
+      expectedKeyIdx+=1
+
+    # In the case where both key indices are valid and the keys are equal.
+    else
+      if [[ $expectedValue != "$actualValue" ]]; then
+        nixErrorLog "maps differ at key ${expectedKey@Q}: expectedMap has value ${expectedValue@Q} but actualMap has value ${actualValue@Q}"
+        hasDiff=1
+      fi
+
+      expectedKeyIdx+=1
+      actualKeyIdx+=1
+    fi
+  done
+
+  ((hasDiff)) && exit 1 || return 0
+}

pkgs/build-support/testers/testEqualArrayOrMap/build-command.sh

@@ -0,0 +1,61 @@
+# shellcheck shell=bash
+
+set -eu
+
+# NOTE: If neither expectedArray nor expectedMap are declared, the test is meaningless.
+# This precondition is checked in the Nix expression through an assert.
+
+preScript() {
+  if isDeclaredArray valuesArray; then
+    # shellcheck disable=SC2154
+    nixLog "using valuesArray: $(declare -p valuesArray)"
+  fi
+
+  if isDeclaredMap valuesMap; then
+    # shellcheck disable=SC2154
+    nixLog "using valuesMap: $(declare -p valuesMap)"
+  fi
+
+  if isDeclaredArray expectedArray; then
+    # shellcheck disable=SC2154
+    nixLog "using expectedArray: $(declare -p expectedArray)"
+    declare -ag actualArray=()
+  fi
+
+  if isDeclaredMap expectedMap; then
+    # shellcheck disable=SC2154
+    nixLog "using expectedMap: $(declare -p expectedMap)"
+    declare -Ag actualMap=()
+  fi
+
+  return 0
+}
+
+scriptPhase() {
+  runHook preScript
+
+  runHook script
+
+  runHook postScript
+}
+
+postScript() {
+  if isDeclaredArray expectedArray; then
+    nixLog "using actualArray: $(declare -p actualArray)"
+    nixLog "comparing actualArray against expectedArray"
+    assertEqualArray expectedArray actualArray
+    nixLog "actualArray matches expectedArray"
+  fi
+
+  if isDeclaredMap expectedMap; then
+    nixLog "using actualMap: $(declare -p actualMap)"
+    nixLog "comparing actualMap against expectedMap"
+    assertEqualMap expectedMap actualMap
+    nixLog "actualMap matches expectedMap"
+  fi
+
+  return 0
+}
+
+runHook scriptPhase
+touch "${out:?}"

pkgs/build-support/testers/testEqualArrayOrMap/default.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  stdenvNoCC,
+}:
+lib.makeOverridable (
+  {
+    name,
+    valuesArray ? null,
+    valuesMap ? null,
+    expectedArray ? null,
+    expectedMap ? null,
+    script,
+  }:
+  assert lib.assertMsg (
+    expectedArray != null || expectedMap != null
+  ) "testEqualArrayOrMap: at least one of 'expectedArray' or 'expectedMap' must be provided";
+  stdenvNoCC.mkDerivation {
+    __structuredAttrs = true;
+    strictDeps = true;
+
+    inherit name;
+
+    nativeBuildInputs = [
+      ./assert-equal-array.sh
+      ./assert-equal-map.sh
+    ];
+
+    inherit valuesArray valuesMap;
+    inherit expectedArray expectedMap;
+
+    inherit script;
+
+    buildCommandPath = ./build-command.sh;
+  }
+)

pkgs/build-support/testers/testEqualArrayOrMap/tests.nix

@@ -0,0 +1,202 @@
+# NOTE: We must use `pkgs.runCommand` instead of `testers.runCommand` for negative tests -- those wrapped with
+# `testers.testBuildFailure`. This is due to the fact that `testers.testBuildFailure` modifies the derivation such that
+# it produces an output containing the exit code, logs, and other things. Since `testers.runCommand` expects the empty
+# derivation, it produces a hash mismatch.
+{ lib, testers }:
+let
+  inherit (lib.attrsets) recurseIntoAttrs;
+  inherit (testers) testBuildFailure' testEqualArrayOrMap;
+  concatValuesArrayToActualArray = ''
+    nixLog "appending all values in valuesArray to actualArray"
+    for value in "''${valuesArray[@]}"; do
+      actualArray+=( "$value" )
+    done
+  '';
+  concatValuesMapToActualMap = ''
+    nixLog "adding all values in valuesMap to actualMap"
+    for key in "''${!valuesMap[@]}"; do
+      actualMap["$key"]="''${valuesMap["$key"]}"
+    done
+  '';
+in
+recurseIntoAttrs {
+  # NOTE: This particular test is used in the docs:
+  # See https://nixos.org/manual/nixpkgs/unstable/#tester-testEqualArrayOrMap
+  # or doc/build-helpers/testers.chapter.md
+  docs-test-function-add-cowbell = testEqualArrayOrMap {
+    name = "test-function-add-cowbell";
+    valuesArray = [
+      "cowbell"
+      "cowbell"
+    ];
+    expectedArray = [
+      "cowbell"
+      "cowbell"
+      "cowbell"
+    ];
+    script = ''
+      addCowbell() {
+        local -rn arrayNameRef="$1"
+        arrayNameRef+=( "cowbell" )
+      }
+
+      nixLog "appending all values in valuesArray to actualArray"
+      for value in "''${valuesArray[@]}"; do
+        actualArray+=( "$value" )
+      done
+
+      nixLog "applying addCowbell"
+      addCowbell actualArray
+    '';
+  };
+  array-append = testEqualArrayOrMap {
+    name = "testEqualArrayOrMap-array-append";
+    valuesArray = [
+      "apple"
+      "bee"
+      "cat"
+    ];
+    expectedArray = [
+      "apple"
+      "bee"
+      "cat"
+      "dog"
+    ];
+    script = ''
+      ${concatValuesArrayToActualArray}
+      actualArray+=( "dog" )
+    '';
+  };
+  array-prepend = testEqualArrayOrMap {
+    name = "testEqualArrayOrMap-array-prepend";
+    valuesArray = [
+      "apple"
+      "bee"
+      "cat"
+    ];
+    expectedArray = [
+      "dog"
+      "apple"
+      "bee"
+      "cat"
+    ];
+    script = ''
+      actualArray+=( "dog" )
+      ${concatValuesArrayToActualArray}
+    '';
+  };
+  array-empty = testEqualArrayOrMap {
+    name = "testEqualArrayOrMap-array-empty";
+    valuesArray = [
+      "apple"
+      "bee"
+      "cat"
+    ];
+    expectedArray = [ ];
+    script = ''
+      # doing nothing
+    '';
+  };
+  array-missing-value = testBuildFailure' {
+    drv = testEqualArrayOrMap {
+      name = "testEqualArrayOrMap-array-missing-value";
+      valuesArray = [ "apple" ];
+      expectedArray = [ ];
+      script = concatValuesArrayToActualArray;
+    };
+    expectedBuilderLogEntries = [
+      "ERROR: assertEqualArray: arrays differ in length: expectedArray has length 0 but actualArray has length 1"
+      "ERROR: assertEqualArray: arrays differ at index 0: expectedArray has no such index but actualArray has value 'apple'"
+    ];
+  };
+  map-insert = testEqualArrayOrMap {
+    name = "testEqualArrayOrMap-map-insert";
+    valuesMap = {
+      apple = "0";
+      bee = "1";
+      cat = "2";
+    };
+    expectedMap = {
+      apple = "0";
+      bee = "1";
+      cat = "2";
+      dog = "3";
+    };
+    script = ''
+      ${concatValuesMapToActualMap}
+      actualMap["dog"]="3"
+    '';
+  };
+  map-remove = testEqualArrayOrMap {
+    name = "testEqualArrayOrMap-map-remove";
+    valuesMap = {
+      apple = "0";
+      bee = "1";
+      cat = "2";
+      dog = "3";
+    };
+    expectedMap = {
+      apple = "0";
+      cat = "2";
+      dog = "3";
+    };
+    script = ''
+      ${concatValuesMapToActualMap}
+      unset 'actualMap[bee]'
+    '';
+  };
+  map-missing-key = testBuildFailure' {
+    drv = testEqualArrayOrMap {
+      name = "testEqualArrayOrMap-map-missing-key";
+      valuesMap = {
+        bee = "1";
+        cat = "2";
+        dog = "3";
+      };
+      expectedMap = {
+        apple = "0";
+        bee = "1";
+        cat = "2";
+        dog = "3";
+      };
+      script = concatValuesMapToActualMap;
+    };
+    expectedBuilderLogEntries = [
+      "ERROR: assertEqualMap: maps differ in length: expectedMap has length 4 but actualMap has length 3"
+      "ERROR: assertEqualMap: maps differ at key 'apple': expectedMap has value '0' but actualMap has no such key"
+    ];
+  };
+  map-missing-key-with-empty = testBuildFailure' {
+    drv = testEqualArrayOrMap {
+      name = "testEqualArrayOrMap-map-missing-key-with-empty";
+      valuesArray = [ ];
+      expectedMap.apple = 1;
+      script = "";
+    };
+    expectedBuilderLogEntries = [
+      "ERROR: assertEqualMap: maps differ in length: expectedMap has length 1 but actualMap has length 0"
+      "ERROR: assertEqualMap: maps differ at key 'apple': expectedMap has value '1' but actualMap has no such key"
+    ];
+  };
+  map-extra-key = testBuildFailure' {
+    drv = testEqualArrayOrMap {
+      name = "testEqualArrayOrMap-map-extra-key";
+      valuesMap = {
+        apple = "0";
+        bee = "1";
+        cat = "2";
+        dog = "3";
+      };
+      expectedMap = {
+        apple = "0";
+        bee = "1";
+        dog = "3";
+      };
+      script = concatValuesMapToActualMap;
+    };
+    expectedBuilderLogEntries = [
+      "ERROR: assertEqualMap: maps differ in length: expectedMap has length 3 but actualMap has length 4"
+      "ERROR: assertEqualMap: maps differ at key 'cat': expectedMap has no such key but actualMap has value '2'"
+    ];
+  };
+}

pkgs/by-name/aa/aapt/package.nix

@@ -52,6 +52,10 @@ stdenvNoCC.mkDerivation rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ linsui ];
     platforms = lib.platforms.unix;
+    badPlatforms = [
+      # The linux executable only supports x86_64
+      "aarch64-linux"
+    ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
 }

pkgs/by-name/ab/above/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "above";
-  version = "2.7";
+  version = "2.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "casterbyte";
     repo = "Above";
     tag = "v${version}";
-    hash = "sha256-tOSAci9aIALNCL3nLui96EdvqjNxnnuj2/dMdWLY9yI=";
+    hash = "sha256-kG+eaTT72jmeC9R9IKwfd/+9oLAzHLJoKfFJhJDJzDM=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
@@ -33,7 +33,7 @@ python3.pkgs.buildPythonApplication rec {
   meta = {
     description = "Invisible network protocol sniffer";
     homepage = "https://github.com/casterbyte/Above";
-    changelog = "https://github.com/casterbyte/Above/releases/tag/v${version}";
+    changelog = "https://github.com/casterbyte/Above/releases/tag/${src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "above";

pkgs/by-name/ae/aerospike/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aerospike-server";
-  version = "8.0.0.2";
+  version = "8.0.0.4";
 
   src = fetchFromGitHub {
     owner = "aerospike";
     repo = "aerospike-server";
     rev = version;
-    hash = "sha256-Wto0C4q/x0VD9kHSOFuquh/vXC7pSEBFqpZJxRAa2Cg=";
+    hash = "sha256-1wZDp754MGHxH2Dmlz9dUDxAWpevoEyEh2nk8QZvgi8=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/ai/aider-chat/package.nix

@@ -1,3 +1,9 @@
-{ python3Packages }:
+{
+  python3Packages,
+  withPlaywright ? false,
+}:
 
-python3Packages.toPythonApplication python3Packages.aider-chat
+if withPlaywright then
+  python3Packages.toPythonApplication python3Packages.aider-chat.passthru.withPlaywright
+else
+  python3Packages.toPythonApplication python3Packages.aider-chat

pkgs/by-name/al/alire/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "alire";
-  version = "2.0.2";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "alire-project";
     repo = "alire";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-m4EPiqh7KCeNgq4G727jrW5ABb+uecvvpmZyskqtml4=";
+    hash = "sha256-DfzCQu9xOe9JgX6RTrYOGTIS6EcPimLnd5pfXMtfRss=";
 
     fetchSubmodules = true;
   };

pkgs/by-name/ap/apache-directory-studio/package.nix

@@ -56,10 +56,20 @@ stdenv.mkDerivation rec {
     patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
         "$dest/ApacheDirectoryStudio"
 
+    # About `/tmp/SWT-GDBusServer`, see
+    # https://github.com/adoptium/adoptium-support/issues/785#issuecomment-1866680133
+    # and
+    # https://github.com/adoptium/adoptium-support/issues/785#issuecomment-2387481967.
     makeWrapper "$dest/ApacheDirectoryStudio" \
         "$out/bin/ApacheDirectoryStudio" \
         --prefix PATH : "${jdk}/bin" \
-        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath ([ webkitgtk_4_0 ])}
+        --prefix LD_LIBRARY_PATH : ${
+          lib.makeLibraryPath [
+            glib
+            webkitgtk_4_0
+          ]
+        } \
+        --run "mkdir -p /tmp/SWT-GDBusServer"
     install -D icon.xpm "$out/share/pixmaps/apache-directory-studio.xpm"
     install -D -t "$out/share/applications" ${desktopItem}/share/applications/*
   '';

pkgs/by-name/ap/apcupsd/package.nix

@@ -4,7 +4,8 @@
   fetchurl,
   pkg-config,
   systemd,
-  util-linux,
+  unixtools,
+  libusb-compat-0_1,
   coreutils,
   wall,
   hostname,
@@ -28,14 +29,29 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     pkg-config
     man
-    util-linux
+    unixtools.col
   ];
-  buildInputs = lib.optional enableCgiScripts gd;
 
-  prePatch = ''
-    sed -e "s,\$(INSTALL_PROGRAM) \$(STRIP),\$(INSTALL_PROGRAM)," \
-        -i ./src/apcagent/Makefile ./autoconf/targets.mak
-  '';
+  buildInputs =
+    lib.optional enableCgiScripts gd
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      libusb-compat-0_1
+    ];
+
+  prePatch =
+    ''
+      sed -e "s,\$(INSTALL_PROGRAM) \$(STRIP),\$(INSTALL_PROGRAM)," \
+          -i ./src/apcagent/Makefile ./autoconf/targets.mak
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      substituteInPlace src/apcagent/Makefile \
+        --replace-fail "Applications" "$out/Applications"
+      substituteInPlace include/libusb.h.in \
+        --replace-fail "@LIBUSBH@" "${libusb-compat-0_1.dev}/include/usb.h"
+      substituteInPlace platforms/darwin/Makefile \
+        --replace-fail "/Library/LaunchDaemons" "$out/Library/LaunchDaemons" \
+        --replace-fail "/System/Library/Extensions" "$out/System/Library/Extensions"
+    '';
 
   preConfigure = ''
     sed -i 's|/bin/cat|${coreutils}/bin/cat|' configure
@@ -57,20 +73,29 @@ stdenv.mkDerivation rec {
       "--with-lock-dir=/run/lock"
       "--with-pid-dir=/run"
       "--enable-usb"
-      "ac_cv_path_SHUTDOWN=${systemd}/sbin/shutdown"
       "ac_cv_path_WALL=${wall}/bin/wall"
     ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      "ac_cv_path_SHUTDOWN=${systemd}/sbin/shutdown"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      "ac_cv_path_SHUTDOWN=/sbin/shutdown"
+      "ac_cv_func_which_gethostbyname_r=no"
+    ]
     ++ lib.optionals enableCgiScripts [
       "--enable-cgi"
       "--with-cgi-bin=${placeholder "out"}/libexec/cgi-bin"
     ];
 
+  enableParallelBuilding = true;
+
   postInstall = ''
     for file in "$out"/etc/apcupsd/*; do
         sed -i -e 's|^WALL=.*|WALL="${wall}/bin/wall"|g' \
                -e 's|^HOSTNAME=.*|HOSTNAME=`${hostname}/bin/hostname`|g' \
                "$file"
     done
+    rm -f "$out/bin/apcupsd-uninstall"
   '';
 
   passthru.tests.smoke = nixosTests.apcupsd;
@@ -79,7 +104,7 @@ stdenv.mkDerivation rec {
     description = "Daemon for controlling APC UPSes";
     homepage = "http://www.apcupsd.com/";
     license = licenses.gpl2Only;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
     maintainers = [ maintainers.bjornfor ];
   };
 }

pkgs/by-name/ca/cargo-bolero/package.nix

@@ -10,15 +10,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-bolero";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-ta0H6V7Zg/Jnu3973eYJXGwwQcqZnDTlsmWAHkQr2EA=";
+    hash = "sha256-xmSPIHD9wZoABv+6LZK3SCdakavGchjcRxhZPmSNAaE=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-XndJm7nkOxY/4tJZIdv1HYxhsju667G1x8FSW1fb4BI=";
+  cargoHash = "sha256-vh/EIMrpolwd/o0ihcjVlJy2XTp7JzlUkoZj0sCnQKg=";
 
   buildInputs = [
     libbfd

pkgs/by-name/ca/cargo-lambda/package.nix

@@ -8,7 +8,7 @@
   pkg-config,
   openssl,
   stdenv,
-  zig,
+  zig_0_13,
   nix-update-script,
 }:
 
@@ -48,7 +48,7 @@ rustPlatform.buildRustPackage rec {
   '';
 
   postInstall = ''
-    wrapProgram $out/bin/cargo-lambda --prefix PATH : ${lib.makeBinPath [ zig ]}
+    wrapProgram $out/bin/cargo-lambda --prefix PATH : ${lib.makeBinPath [ zig_0_13 ]}
   '';
 
   CARGO_LAMBDA_BUILD_INFO = "(nixpkgs)";

pkgs/by-name/ca/cartridges/package.nix

@@ -19,14 +19,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "cartridges";
-  version = "2.11";
+  version = "2.11.1";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "kra-mo";
     repo = "cartridges";
     tag = "v${version}";
-    hash = "sha256-6v/R83eYq993epcAkcf9jyNakKuGmSsGXrQYQMro6nI=";
+    hash = "sha256-2w7qHTEaRnVDRa0e39Dg9H7pjhgM2UATe8pGYncYILE=";
   };
 
   strictDeps = true;

pkgs/by-name/ca/castero/package.nix

@@ -17,6 +17,7 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   build-system = with python3.pkgs; [
+    setuptools
     wheel
   ];
 
@@ -48,6 +49,11 @@ python3.pkgs.buildPythonApplication rec {
     "test_datafile_download"
     "test_display_get_input_str"
     "test_display_get_y_n"
+    # > assert mymenu.metadata == episode1.metadata
+    # E AssertionError: assert '' == <MagicMock name='mock.metadata' id='140737279137104'>
+    # E  +  where '' = <castero.menus.episodemenu.EpisodeMenu object at 0x7ffff3acd0d0>.metadata
+    # E  +  and   <MagicMock name='mock.metadata' id='140737279137104'> = episode1.metadata
+    "test_menu_episode_metadata"
   ];
 
   pythonImportsCheck = [

pkgs/by-name/ca/catppuccin/package.nix

@@ -3,6 +3,7 @@ let
     "bat"
     "bottom"
     "btop"
+    "element"
     "grub"
     "hyprland"
     "k9s"
@@ -78,6 +79,14 @@ let
       hash = "sha256-mEGZwScVPWGu+Vbtddc/sJ+mNdD2kKienGZVUcTSl+c=";
     };
 
+    element = fetchFromGitHub {
+      name = "element";
+      owner = "catppuccin";
+      repo = "element";
+      rev = "ddced941a2014107918484263b63e030889777fe";
+      hash = "sha256-8EP/IQW3rdtomHBfnQNIjGbiD6OapPzXPFLjziNDcmc=";
+    };
+
     grub = fetchFromGitHub {
       name = "grub";
       owner = "catppuccin";
@@ -228,6 +237,11 @@ lib.checkListOfEnum "${pname}: variant" validVariants [ variant ] lib.checkListO
         mkdir -p "$out/bottom"
         cp "${sources.bottom}/themes/${variant}.toml" "$out/bottom/"
 
+      ''
+      + lib.optionalString (lib.elem "element" themeList) ''
+        mkdir -p "$out/element"
+        cp -r "${sources.element}/themes/Catppuccin-${variant}.json" "$out/element/"
+
       ''
       + lib.optionalString (lib.elem "grub" themeList) ''
         mkdir -p "$out/grub"

pkgs/by-name/ce/ceph-csi/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ceph-csi";
-  version = "3.13.0";
+  version = "3.13.1";
 
   src = fetchFromGitHub {
     owner = "ceph";
     repo = "ceph-csi";
     rev = "v${version}";
-    hash = "sha256-11Y6oI5uFO4DM9Ei4W3cOAXm33D5RiFW51Zpf0PQBv0=";
+    hash = "sha256-Wa5elZbQotgeb4pH9DIZd48CQyBJ0O5y1SidIb/iyGY=";
   };
 
   preConfigure = ''

pkgs/by-name/ch/checkov/package.nix

@@ -25,14 +25,14 @@ with py.pkgs;
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.381";
+  version = "3.2.382";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     tag = version;
-    hash = "sha256-sIIA24yz3sAHXdUgzVoNxpwA4o8BObZ9+RN7hFKbgno=";
+    hash = "sha256-OsLKLRjMJuDe/NH1Ttip4FjBAWo7n9GaM5CoGFvVJhI=";
   };
 
   pythonRelaxDeps = [

pkgs/by-name/cl/clever-tools/package.nix

@@ -11,7 +11,7 @@
 buildNpmPackage rec {
   pname = "clever-tools";
 
-  version = "3.11.0";
+  version = "3.12.0";
 
   nodejs = nodejs_18;
 
@@ -19,10 +19,10 @@ buildNpmPackage rec {
     owner = "CleverCloud";
     repo = "clever-tools";
     rev = version;
-    hash = "sha256-3u96bPdXGArvNZPs12uF48zR/15AQNNHXyUWnMgxMmI=";
+    hash = "sha256-n4rmgOeooLPGLkgBjSBKkevbDPujAORc2i63LiINpcU=";
   };
 
-  npmDepsHash = "sha256-zmhGpsRoMHgsq/XKOMGNIgxxsiMju9bG//Qd72HrMSE=";
+  npmDepsHash = "sha256-M7sHNszz2uiD4PVVFRBhaUmKde0s7Cnbr8XQBVlnpLo=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/cp/cpptrace/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cpptrace";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "jeremy-rifkin";
     repo = "cpptrace";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8WXYgOa54R0Db7WA+KdEAz7/FCtgDdrRyYFxuThT9Zs=";
+    hash = "sha256-3BnAWRpKJR5lsokpmbOLUIQGuiH46AM1NQwOtBl28AA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/dd/ddns-go/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "ddns-go";
-  version = "6.8.1";
+  version = "6.9.0";
 
   src = fetchFromGitHub {
     owner = "jeessy2";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-a8torNtFdBq19a4eb0uMgivtF7FUF1DX6g8kyCc4Gxg=";
+    hash = "sha256-eHJVd7PHUrswF1j4MrsUmle0vB8/CtH43p5ILZGljrs=";
   };
 
-  vendorHash = "sha256-D66uremGVcTcyBlCA9vrQM5zGPFR96FqVak6tATEdI0=";
+  vendorHash = "sha256-5XrwVIaQ2dMizx3Pj0dmLkpYwypUVnfxLNxmNsVhVzY=";
 
   ldflags = [
     "-X main.version=${version}"

pkgs/by-name/dr/dracula-theme/package.nix

@@ -8,7 +8,7 @@
 
 let
   themeName = "Dracula";
-  version = "4.0.0-unstable-2025-02-14";
+  version = "4.0.0-unstable-2025-03-04";
 in
 stdenvNoCC.mkDerivation {
   pname = "dracula-theme";
@@ -17,8 +17,8 @@ stdenvNoCC.mkDerivation {
   src = fetchFromGitHub {
     owner = "dracula";
     repo = "gtk";
-    rev = "fbc19694354e918f2a0df4a10b02f2127f69c441";
-    hash = "sha256-KR9kQpXofvcHJBm7DRYI7FPm5bC751pM1TSJgu7p6ng=";
+    rev = "285ff8f10084b5fdae045a8e8d09352be9af4452";
+    hash = "sha256-DGUEHKlQqJ3yt6Anm+LIhSgaUjE+CvdIQZyrrPGV8HQ=";
   };
 
   propagatedUserEnvPkgs = [

pkgs/by-name/dt/dtools/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dtools";
-  version = "2.109.1";
+  version = "2.110.0";
 
   src = fetchFromGitHub {
     owner = "dlang";
     repo = "tools";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Pfj8Kwf5AlcrHhLs5A/0vIFWLZaNR3ro+esbs7oWN9I=";
+    hash = "sha256-xMEHnrstL5hAkhp8+/z1I2KZWZ7eztWZnUGLTKCfbBI=";
     name = "dtools";
   };
 

pkgs/by-name/dy/dyff/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "dyff";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "homeport";
     repo = "dyff";
     rev = "v${version}";
-    sha256 = "sha256-y5gep3v+totupFbsAuGhySUbcESmQeGHWteQFFXj2Kw=";
+    sha256 = "sha256-MVqj/RgUwN7andCPMo7Tp4zBhEaSNM0loWnQ/E5U1S8=";
   };
 
-  vendorHash = "sha256-cRPAjFVvjCgT+m8ceAQJt5ZE8ax7jefzdVWPGM45LpY=";
+  vendorHash = "sha256-PH3huLNc0jFBvo3/Z/BNCeL0HxTUc5OaNysa54wKthY=";
 
   subPackages = [
     "cmd/dyff"

pkgs/by-name/ev/evcc/package.nix

@@ -17,13 +17,13 @@
 }:
 
 let
-  version = "0.200.6";
+  version = "0.200.7";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     tag = version;
-    hash = "sha256-IXfEqFqm/vzm3zA1j3QajpcXTn3v0/HlXkHHb9Vwki8=";
+    hash = "sha256-+bCFAZZPcQx3aj+YnNQN0hgAJdntjD5/eKLedW1GxYw=";
   };
 
   vendorHash = "sha256-zWHysXjBNAAZfrVGzn39pdDqQrLUc1uYVLO/U7q0g04=";
@@ -117,5 +117,6 @@ buildGo124Module rec {
     description = "EV Charge Controller";
     homepage = "https://evcc.io";
     changelog = "https://github.com/evcc-io/evcc/releases/tag/${version}";
+    mainProgram = "evcc";
   };
 }

pkgs/by-name/fc/fcft/package.nix

@@ -34,14 +34,14 @@ in
 
 stdenv.mkDerivation rec {
   pname = "fcft";
-  version = "3.1.10";
+  version = "3.2.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "dnkl";
     repo = "fcft";
     rev = version;
-    hash = "sha256:0hydhpw31c28lq7v5yvknm3dzvkkls98hcmpp0z2h9m9f32nq4s9";
+    hash = "sha256-VMNjTOil50/GslSzZnBPkSoy0Vg0729ndaEAeXk00GI=";
   };
 
   depsBuildBuild = [ pkg-config ];

pkgs/by-name/fi/fiddler-everywhere/package.nix

@@ -8,11 +8,11 @@
 
 let
   pname = "fiddler-everywhere";
-  version = "6.1.0";
+  version = "6.2.0";
 
   src = fetchurl {
     url = "https://downloads.getfiddler.com/linux/fiddler-everywhere-${version}.AppImage";
-    hash = "sha256-fxGwOt/+3T7LDK69H/Nm1dyGiT588YhSR4D5xO36xKk=";
+    hash = "sha256-bUFogQkMOr0n95wYd/M9eq9Y6xxVFJTaznBnmFMvjC4=";
   };
 
   appimageContents = appimageTools.extract {

pkgs/by-name/fi/filebot/package.nix

@@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "filebot";
-  version = "5.1.6";
+  version = "5.1.7";
 
   src = fetchurl {
     url = "https://web.archive.org/web/20230917142929/https://get.filebot.net/filebot/FileBot_${finalAttrs.version}/FileBot_${finalAttrs.version}-portable.tar.xz";
-    hash = "sha256-9XRYhedCDWtNPjAKzK4lOprHwbJjOgF6HN2MZnlZ9IE=";
+    hash = "sha256-GpjWo2+AsT0hD3CJJ8Pf/K5TbWtG0ZE2tIpH/UEGTws=";
   };
 
   unpackPhase = "tar xvf $src";

pkgs/by-name/fl/flow-editor/package.nix

@@ -17,7 +17,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-D1pFP5tw323UJgWvLvh2sTiZG1hq5DP0FakdXEISRxs=";
   };
   postPatch = ''
-    ln -s ${callPackage ./build.zig.zon.nix { }} $ZIG_GLOBAL_CACHE_DIR/p
+    ln -s ${
+      callPackage ./build.zig.zon.nix {
+        zig = zig_0_13;
+      }
+    } $ZIG_GLOBAL_CACHE_DIR/p
   '';
 
   nativeBuildInputs = [

pkgs/by-name/fr/frp/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "frp";
-  version = "0.61.1";
+  version = "0.61.2";
 
   src = fetchFromGitHub {
     owner = "fatedier";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-HPhT+crjQELQMDpBywWy+POplKxfLrHCAWkTRRhogqA=";
+    hash = "sha256-speKU15zsg7jpPP3X6/QovHWtQxzHbVMWz4YLsZhE8A=";
   };
 
-  vendorHash = "sha256-Pwa5idGOn1kTxhouxYwNlKafYU541/rQolm+2CJnLo4=";
+  vendorHash = "sha256-ZKhOBD6rLcZtllSQxkpYbHLyb3Ga2teZnGr8jJcETKQ=";
 
   doCheck = false;
 

pkgs/by-name/ga/gancio/package.nix

@@ -19,14 +19,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gancio";
-  version = "1.23.1";
+  version = "1.24.0";
 
   src = fetchFromGitLab {
     domain = "framagit.org";
     owner = "les";
     repo = "gancio";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-mX+6MhuvfrQFiqheM2iWrXZAzQcAzGfjSSVGX60pfXs=";
+    hash = "sha256-PczJFh4tODwtocDSY0UHok8tgBmVvSVHDRjLG6Cor5s=";
   };
 
   offlineCache = fetchYarnDeps {

pkgs/by-name/ge/geesefs/package.nix

@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "0.42.4";
+  version = "0.43.0";
 in
 buildGoModule {
   pname = "geesefs";
@@ -15,7 +15,7 @@ buildGoModule {
     owner = "yandex-cloud";
     repo = "geesefs";
     rev = "v${version}";
-    hash = "sha256-INCsDMFhVRkNSPkhVPJkLP+8zBinYcj8S6C0rYO1h6M=";
+    hash = "sha256-KkKdqSev6xpYfEjDSLVs/gKc3NCvLrzukNEQT2Wuk+A=";
   };
 
   # hashes differ per architecture otherwise.

pkgs/by-name/gg/gg/package.nix

@@ -1,43 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-  installShellFiles,
-}:
-buildGoModule rec {
-  pname = "gg";
-  version = "0.2.19";
-
-  src = fetchFromGitHub {
-    owner = "mzz2017";
-    repo = "gg";
-    rev = "v${version}";
-    hash = "sha256-DXW0NtFYvcCX4CgMs5/5HPaO9f9eFtw401wmJdCbHPU=";
-  };
-
-  vendorHash = "sha256-fnM4ycqDyruCdCA1Cr4Ki48xeQiTG4l5dLVuAafEm14=";
-
-  ldflags = [
-    "-s"
-    "-w"
-  ];
-
-  nativeBuildInputs = [ installShellFiles ];
-
-  postInstall = ''
-    installShellCompletion --cmd gg \
-    --bash completion/bash/gg \
-    --fish completion/fish/gg.fish \
-    --zsh completion/zsh/_gg
-  '';
-
-  meta = with lib; {
-    homepage = "https://github.com/mzz2017/gg";
-    changelog = "https://github.com/mzz2017/gg/releases/tag/${src.rev}";
-    description = "Command-line tool for one-click proxy in your research and development";
-    license = licenses.agpl3Only;
-    mainProgram = "gg";
-    maintainers = with maintainers; [ oluceps ];
-    platforms = platforms.linux;
-  };
-}

pkgs/by-name/gh/ghostty/package.nix

@@ -60,6 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   deps = callPackage ./deps.nix {
     name = "${finalAttrs.pname}-cache-${finalAttrs.version}";
+    zig = zig_0_13;
   };
 
   strictDeps = true;

pkgs/by-name/gl/globalping-cli/package.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "globalping-cli";
-  version = "1.4.4";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "jsdelivr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-pViqoycOh1RfSqaAEST6m1v3mEcTX76dbL80bCp5aKo=";
+    hash = "sha256-UB2vYdyJ2+H8rFyJn1KBNnWoGUlRjwYorWXqoB9WDu0=";
   };
 
-  vendorHash = "sha256-V6DwV2KukFfFK0PK9MacoHH0sB5qNV315jn0T+4rhfA=";
+  vendorHash = "sha256-dJAuN5srL5EvMaRg8rHaTsurjYrdH45p965DeubpB0E=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/gn/gnome-commander/package.nix

@@ -7,10 +7,7 @@
   pkg-config,
   flex,
   itstool,
-  rustPlatform,
-  rustc,
-  cargo,
-  wrapGAppsHook4,
+  wrapGAppsHook3,
   desktop-file-utils,
   exiv2,
   libgsf,
@@ -22,14 +19,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-commander";
-  version = "1.18.1-unstable-2024-10-18";
+  version = "1.18.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "gnome-commander";
-    rev = "28dadb1ef9342bb1a5f9a65b1a5bf3bd80e3d30a";
-    hash = "sha256-DxsZJht+PD3vY5vc1vzpRD8FHBPKcjK4qfke5nhvHS0=";
+    tag = finalAttrs.version;
+    hash = "sha256-dNZDlpvpN5hh/3YccZPJDEFkBLv9I8YOdFT/COp7+Uw=";
   };
 
   # hard-coded schema paths
@@ -40,21 +37,13 @@ stdenv.mkDerivation (finalAttrs: {
         '/share/gsettings-schemas/${finalAttrs.finalPackage.name}/glib-2.0/schemas'
   '';
 
-  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) pname version src;
-    hash = "sha256-dOd/4n8G/zEsF0ClqhI2QBLosEz3uyzC9q5sHDVWAx4=";
-  };
-
   nativeBuildInputs = [
     meson
     ninja
     pkg-config
     flex
     itstool
-    rustPlatform.cargoSetupHook
-    rustc
-    cargo
-    wrapGAppsHook4
+    wrapGAppsHook3
     desktop-file-utils
   ];
 

pkgs/by-name/go/go-graft/package.nix

@@ -1,4 +1,9 @@
-{ lib, fetchFromGitHub, buildGoModule }:
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  installShellFiles,
+}:
 
 buildGoModule rec {
   pname = "go-graft";
@@ -8,20 +13,37 @@ buildGoModule rec {
     owner = "mzz2017";
     repo = "gg";
     rev = "v${version}";
-    sha256 = "sha256-DXW0NtFYvcCX4CgMs5/5HPaO9f9eFtw401wmJdCbHPU=";
+    hash = "sha256-DXW0NtFYvcCX4CgMs5/5HPaO9f9eFtw401wmJdCbHPU=";
   };
 
   env.CGO_ENABLED = 0;
 
-  ldflags = [ "-X github.com/mzz2017/gg/cmd.Version=${version}" "-s" "-w" ];
+  ldflags = [
+    "-X github.com/mzz2017/gg/cmd.Version=${version}"
+    "-s"
+    "-w"
+  ];
+
   vendorHash = "sha256-fnM4ycqDyruCdCA1Cr4Ki48xeQiTG4l5dLVuAafEm14=";
-  subPackages = [ "." ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd gg \
+    --bash completion/bash/gg \
+    --fish completion/fish/gg.fish \
+    --zsh completion/zsh/_gg
+  '';
 
   meta = with lib; {
     description = "Command-line tool for one-click proxy in your research and development without installing v2ray or anything else";
+    changelog = "https://github.com/mzz2017/gg/releases/tag/${src.rev}";
     homepage = "https://github.com/mzz2017/gg";
-    license = licenses.agpl3Plus;
-    maintainers = with maintainers; [ xyenon ];
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [
+      xyenon
+      oluceps
+    ];
     mainProgram = "gg";
     platforms = platforms.linux;
   };

pkgs/by-name/hu/hurl/package.nix

@@ -2,12 +2,10 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  fetchpatch,
   pkg-config,
   installShellFiles,
   libxml2,
   openssl,
-  stdenv,
   curl,
   versionCheckHook,
 }:
@@ -31,14 +29,11 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
   ];
 
-  buildInputs =
-    [
-      libxml2
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      curl
-    ];
+  buildInputs = [
+    libxml2
+    openssl
+    curl
+  ];
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 

pkgs/by-name/hy/hydrus/package.nix

@@ -0,0 +1,171 @@
+{
+  lib,
+  stdenv,
+  python3Packages,
+  fetchFromGitHub,
+  qt6,
+  copyDesktopItems,
+  makeDesktopItem,
+  writableTmpDirAsHomeHook,
+  swftools,
+  ffmpeg,
+  miniupnpc,
+
+  enableSwftools ? false,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "hydrus";
+  version = "612";
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "hydrusnetwork";
+    repo = "hydrus";
+    tag = "v${version}";
+    hash = "sha256-zRaabW1QwNNgA3F84CFSDbxyALV74T3t8u8WdL8GwG0=";
+  };
+
+  nativeBuildInputs = [
+    qt6.wrapQtAppsHook
+    python3Packages.mkdocs-material
+    copyDesktopItems
+  ];
+
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtcharts
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "hydrus-client";
+      exec = "hydrus-client";
+      desktopName = "Hydrus Client";
+      icon = "hydrus-client";
+      comment = meta.description;
+      terminal = false;
+      type = "Application";
+      categories = [
+        "FileTools"
+        "Utility"
+      ];
+    })
+  ];
+
+  dependencies = with python3Packages; [
+    beautifulsoup4
+    cbor2
+    chardet
+    cloudscraper
+    dateparser
+    html5lib
+    lxml
+    lz4
+    numpy
+    opencv4
+    olefile
+    pillow
+    pillow-heif
+    psutil
+    psd-tools
+    pympler
+    pyopenssl
+    pyqt6
+    pyqt6-charts
+    pysocks
+    python-dateutil
+    python3Packages.mpv
+    pyyaml
+    qtpy
+    requests
+    show-in-file-manager
+    send2trash
+    service-identity
+    twisted
+  ];
+
+  nativeCheckInputs =
+    (with python3Packages; [
+      mock
+      httmock
+    ])
+    ++ [
+      writableTmpDirAsHomeHook
+    ];
+
+  outputs = [
+    "out"
+    "doc"
+  ];
+
+  installPhase =
+    ''
+      runHook preInstall
+
+      # Move the hydrus module and related directories
+      mkdir -p $out/${python3Packages.python.sitePackages}
+      mv {hydrus,static,db} $out/${python3Packages.python.sitePackages}
+      # Fix random files being marked with execute permissions
+      chmod -x $out/${python3Packages.python.sitePackages}/static/*.{png,svg,ico}
+      # Build docs
+      mkdocs build -d help
+      mkdir -p $doc/share/doc
+      mv help $doc/share/doc/hydrus
+
+      # install the hydrus binaries
+      mkdir -p $out/bin
+      install -m0755 hydrus_server.py $out/bin/hydrus-server
+      install -m0755 hydrus_client.py $out/bin/hydrus-client
+      install -m0755 hydrus_test.py $out/bin/hydrus-test
+
+      # desktop item
+      mkdir -p "$out/share/icons/hicolor/scalable/apps"
+      ln -s "$doc/share/doc/hydrus/assets/hydrus-white.svg" "$out/share/icons/hicolor/scalable/apps/hydrus-client.svg"
+    ''
+    + lib.optionalString enableSwftools ''
+      mkdir -p $out/${python3Packages.python.sitePackages}/bin
+      # swfrender seems to have to be called sfwrender_linux
+      # not sure if it can be loaded through PATH, but this is simpler
+      # $out/python3Packages.python.sitePackages/bin is correct NOT .../hydrus/bin
+      ln -s ${swftools}/bin/swfrender $out/${python3Packages.python.sitePackages}/bin/swfrender_linux
+    ''
+    + ''
+      runHook postInstall
+    '';
+
+  checkPhase = ''
+    runHook preCheck
+
+    export QT_QPA_PLATFORM=offscreen
+    $out/bin/hydrus-test
+
+    runHook postCheck
+  '';
+
+  # Tests crash even with __darwinAllowLocalNetworking enabled
+  # hydrus.core.HydrusExceptions.DataMissing: That service was not found!
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
+  dontWrapQtApps = true;
+  preFixup = ''
+    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
+    makeWrapperArgs+=(--prefix PATH : ${
+      lib.makeBinPath [
+        ffmpeg
+        miniupnpc
+      ]
+    })
+  '';
+
+  meta = {
+    description = "Danbooru-like image tagging and searching system for the desktop";
+    license = lib.licenses.wtfpl;
+    homepage = "https://hydrusnetwork.github.io/hydrus/";
+    changelog = "https://github.com/hydrusnetwork/hydrus/releases/tag/v${version}";
+    maintainers = with lib.maintainers; [
+      dandellion
+      evanjs
+    ];
+  };
+}

pkgs/by-name/ig/ignite-cli/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "ignite-cli";
-  version = "28.8.0";
+  version = "28.8.1";
 
   src = fetchFromGitHub {
     repo = "cli";
     owner = "ignite";
     rev = "v${version}";
-    hash = "sha256-vLb3whalkOsP4CotTQjqNtHjHDCjTjZD7KSjKDWu2G0=";
+    hash = "sha256-tecoeYQ+rWH36AwkcvO5W7mqVxc9fGHcUiQ+dZvUQP0=";
   };
 
-  vendorHash = "sha256-Efz2IzW/7NiaagzUpr37BGhiU8WcFvRIa61E91hwqGk=";
+  vendorHash = "sha256-4Ab3xgP1fK2QA+qL3DyNESkOl6MeQlhhjpaWO6oRFlg=";
 
   nativeBuildInputs = [ makeWrapper ];
 

pkgs/by-name/in/interactive-html-bom/package.nix

@@ -0,0 +1,39 @@
+{
+  fetchFromGitHub,
+  kicad-small,
+  lib,
+  python3Packages,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "interactive-html-bom";
+  version = "2.9.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "openscopeproject";
+    repo = "InteractiveHtmlBom";
+    tag = "v${version}";
+    hash = "sha256-jUHEI0dWMFPQlXei3+0m1ruHzpG1hcRnxptNOXzXDqQ=";
+  };
+
+  build-system = [ python3Packages.hatchling ];
+
+  dependencies = [
+    python3Packages.jsonschema
+    python3Packages.wxpython
+    kicad-small
+  ];
+
+  # has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Interactive HTML BOM generation for KiCad, EasyEDA, Eagle, Fusion360 and Allegro PCB designer";
+    homepage = "https://github.com/openscopeproject/InteractiveHtmlBom/";
+    license = lib.licenses.mit;
+    changelog = "https://github.com/openscopeproject/InteractiveHtmlBom/releases/tag/v${version}";
+    maintainers = with lib.maintainers; [ wuyoli ];
+    mainProgram = "generate_interactive_bom";
+  };
+}

pkgs/by-name/je/jenkins/package.nix

@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jenkins";
-  version = "2.492.1";
+  version = "2.492.2";
 
   src = fetchurl {
     url = "https://get.jenkins.io/war-stable/${version}/jenkins.war";
-    hash = "sha256-wFNPna+QJa5AVOwwUYsbifxdl7Mvr9tVa5s6YOn//8g=";
+    hash = "sha256-rmD71fB8pM1COkc37XHztU7PFGZruYoMv/anc1QMInU=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/jx/jx/package.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "jx";
-  version = "3.11.52";
+  version = "3.11.56";
 
   src = fetchFromGitHub {
     owner = "jenkins-x";
     repo = "jx";
     rev = "v${version}";
-    sha256 = "sha256-6yCo0emc/R0r0grPcI8+DylbwqOlfU9ouUZboi+yWE4=";
+    sha256 = "sha256-zBv6j27UYRcMqDLINe8zEqANmlSks3OqwGzTSFisnP4=";
   };
 
   vendorHash = "sha256-8I4yTzLAL7E0ozHcBZDNsJLHkTh+SjT0SjDSECGRYIc=";

pkgs/by-name/ka/kargo/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "kargo";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "akuity";
     repo = "kargo";
     tag = "v${version}";
-    hash = "sha256-GC3u4v8qrVi8+Ne08f074DvPh0RFmpmCOdJ5XD3kk+o=";
+    hash = "sha256-OnkEl00oNe2sM/4zlV3ZD2wj3TJH6AdcAMGa5RvAEVM=";
   };
 
   vendorHash = "sha256-Xb+9zu2uivOYETtz3ryMnBUJ3gJ/1ta1dLEpsD00jpU=";

pkgs/by-name/ka/karmor/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "karmor";
-  version = "1.3.1";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "kubearmor";
     repo = "kubearmor-client";
     rev = "v${version}";
-    hash = "sha256-XZ/FGZK6whh32sO7TuBooPRB1u2I0p5aDePcZ5AaY/8=";
+    hash = "sha256-sn2Zpr/Z63MAf0d9FnT3GJW48DI/aynC1naAHsMYGR4=";
   };
 
   vendorHash = "sha256-HH3U1reZXG9w7uwnXbY33hsKlPCxbVb2yvw4KmBfOa0=";

pkgs/by-name/ka/karp/package.nix

@@ -13,14 +13,14 @@
 
 stdenv.mkDerivation {
   pname = "karp";
-  version = "0-unstable-2025-02-21";
+  version = "0-unstable-2025-03-05";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     owner = "graphics";
     repo = "karp";
-    rev = "1da7f1e3f9b291c5031916a213d9c71ed6c39323";
-    hash = "sha256-PxiwJ9SCq6uG2F5CJFp6ta5zPLp8FnRe1jcHIs7Eg6w=";
+    rev = "de6d42447c3ed15a102ec81c56c55ec5a0111a59";
+    hash = "sha256-5mXD4qOL+gJn0kCHpnp4kp0E2SCCYfeI7A3oScX1uf8=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/kd/kdlfmt/package.nix

@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kdlfmt";
-  version = "0.0.13";
+  version = "0.0.14";
 
   src = fetchFromGitHub {
     owner = "hougesen";
     repo = "kdlfmt";
     rev = "v${version}";
-    hash = "sha256-bBb+uWU8RuLRmosBaOdx9yZkWhARTn3ObxwART8wTE0=";
+    hash = "sha256-90sGzc+UBy3Va/FYXHTVcwIkbx01avp4Z/aHiOxMj6w=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-g3GjAwnY9khwnTVoUEWJuY95YCNyRedGXISQtpguI8g=";
+  cargoHash = "sha256-ocH8o2prf+1POZknbl5+svo0JU7sX0k8NvOkkidhOqA=";
 
   meta = {
     description = "Formatter for kdl documents";

pkgs/by-name/ke/kermit/package.nix

@@ -39,6 +39,8 @@ stdenv.mkDerivation {
     make -f makefile install
   '';
 
+  env.NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration -Wno-implicit-int";
+
   meta = with lib; {
     homepage = "https://www.kermitproject.org/ck90.html";
     description = "Portable Scriptable Network and Serial Communication Software";