From a08388cc72f9fc070565577b10f6eaf889438b44 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Thu, 20 Jul 2023 08:23:56 +0300
Subject: [PATCH 01/16] nixos/stage-1: fix stripping

got broken in 6ea1a2a1be4e93f938ff084863eab1bd13292f65 which changed
runCommandCC to runCommand but was not
noticed because it was failing silently

runCommand doesn't include CC or bintools

(cherry picked from commit 69267c22f169133a4c16a91212f109974740d17a)
---
 nixos/modules/system/boot/stage-1.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/system/boot/stage-1.nix b/nixos/modules/system/boot/stage-1.nix
index 1229f6357523..031de1a15f2f 100644
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@@ -91,7 +91,7 @@ let
   # we just copy what we need from Glibc and use patchelf to make it
   # work.
   extraUtils = pkgs.runCommand "extra-utils"
-    { nativeBuildInputs = [pkgs.buildPackages.nukeReferences];
+    { nativeBuildInputs = with pkgs.buildPackages; [ nukeReferences bintools ];
       allowedReferences = [ "out" ]; # prevent accidents like glibc being included in the initrd
     }
     ''

From fb8c7d06311270d383e4e5bdf01fc6510ad506d7 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Fri, 21 Jul 2023 10:36:29 +0300
Subject: [PATCH 02/16] nixos/tests/installer: fix after #244449

(cherry picked from commit f58e6874f3f06d4e5cdea58bec5da33f8b2f8ad3)
---
 nixos/tests/installer.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index dac6906762a4..590988d95986 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -422,6 +422,7 @@ let
           # The test cannot access the network, so any packages we
           # need must be included in the VM.
           system.extraDependencies = with pkgs; [
+            bintools
             brotli
             brotli.dev
             brotli.lib

From 248fabe4cbb21a82b7bdb00f62ef8fe656446f46 Mon Sep 17 00:00:00 2001
From: Mats <mats@mats.sh>
Date: Wed, 28 Jun 2023 17:05:30 +0200
Subject: [PATCH 03/16] linux-firmware: 20230515 -> 20230625

(cherry picked from commit 81a21160a29ce66d33bb1398e0cdd30800959c97)
---
 pkgs/os-specific/linux/firmware/linux-firmware/source.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/firmware/linux-firmware/source.nix b/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
index e1d77a03200f..01ea40a5089a 100644
--- a/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
@@ -1,6 +1,6 @@
 # This file is autogenerated! Run ./update.sh to regenerate.
 {
-  version = "20230515";
-  sourceHash = "sha256-VcA873r9jVYqDqEcvz/PVGfCAhLXr0sMXQincWNLEIs=";
-  outputHash = "sha256-h3KDK3KiD88dvTvLlLL2XczY1ZeEVnYEzh9sqbo1dZ8=";
+  version = "20230625";
+  sourceHash = "sha256-olRaUVnCri/sJU6ob+QgNxEZF8GzVxxEh8zdNJIZlYY=";
+  outputHash = "sha256-zSlMpAPbW7ewEBzDre47/7NJyy2pC0GSbkyOVVi+4gU=";
 }

From 718cc3faea3f92914ceba6bcf1daf4166d8386cf Mon Sep 17 00:00:00 2001
From: Robert James Hernandez <rob@sarcasticadmin.com>
Date: Mon, 24 Jul 2023 20:11:48 +0000
Subject: [PATCH 04/16] ax25-apps: set localstatedir to /var/lib

Previously, localstatedir was being defaulting to path inside /nix/store
so some AX.25 applications were not able to write their state to disk.

(cherry picked from commit 1269a601e3253b99026aa473c7a5faef472ea62e)
---
 pkgs/applications/radio/ax25-apps/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/applications/radio/ax25-apps/default.nix b/pkgs/applications/radio/ax25-apps/default.nix
index 4f9ecd3580f8..ea53d7c38b5a 100644
--- a/pkgs/applications/radio/ax25-apps/default.nix
+++ b/pkgs/applications/radio/ax25-apps/default.nix
@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--sysconfdir=/etc"
+    "--localstatedir=/var/lib"
     "--program-transform-name=s@^call$@ax&@;s@^listen$@ax&@"
   ];
 

From ec3fd44c2d99da69ec8002b9ef3a13f242ab827e Mon Sep 17 00:00:00 2001
From: Robert James Hernandez <rob@sarcasticadmin.com>
Date: Mon, 24 Jul 2023 19:49:37 +0000
Subject: [PATCH 05/16] ax25-tools: set localstatedir to /var/lib

Previously, localstatedir was being defaulting to path inside /nix/store
so some AX.25 applications were not able to write their state to disk.

(cherry picked from commit 0d75120022142ce867f2fa386853e84c471be18b)
---
 pkgs/applications/radio/ax25-tools/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/radio/ax25-tools/default.nix b/pkgs/applications/radio/ax25-tools/default.nix
index 0e806c1107e5..80c42da9a3d1 100644
--- a/pkgs/applications/radio/ax25-tools/default.nix
+++ b/pkgs/applications/radio/ax25-tools/default.nix
@@ -17,7 +17,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-kqnLi1iobcufVWMPxUyaRsWKIPyTvtUkuMERGQs2qgY=";
   };
 
-  configureFlags = [ "--sysconfdir=/etc" ];
+  configureFlags = [
+    "--sysconfdir=/etc"
+    "--localstatedir=/var/lib"
+  ];
 
   meta = with lib; {
     description = "Non-GUI tools used to configure an AX.25 enabled computer";

From 9c7ef4098544c9002449c68cc344d7ee7b2e911c Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Tue, 18 Jul 2023 07:09:04 +0200
Subject: [PATCH 06/16] =?UTF-8?q?ocamlPackages.dypgen:=20init=20at=200.2?=
 =?UTF-8?q?=20for=20OCaml=20=E2=89=A5=204.07?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(cherry picked from commit 192af63a3db618ba26dc847c53ff82d3686a2b5c)
---
 .../ocaml-modules/dypgen/default.nix          | 35 +++++++++++--------
 1 file changed, 20 insertions(+), 15 deletions(-)

diff --git a/pkgs/development/ocaml-modules/dypgen/default.nix b/pkgs/development/ocaml-modules/dypgen/default.nix
index f504e3d7ca46..d47b78307769 100644
--- a/pkgs/development/ocaml-modules/dypgen/default.nix
+++ b/pkgs/development/ocaml-modules/dypgen/default.nix
@@ -1,21 +1,26 @@
-{stdenv, lib, fetchurl, ocaml, findlib}:
+{ stdenv, lib, fetchFromGitHub, fetchurl, ocaml, findlib }:
 
-let
-  pname = "dypgen";
-in
-
-if lib.versionAtLeast ocaml.version "4.06"
-then throw "${pname} is not available for OCaml ${ocaml.version}"
-else
+let params =
+  if lib.versionAtLeast ocaml.version "4.07" then rec {
+    version = "0.2";
+    src = fetchFromGitHub {
+      owner = "grain-lang";
+      repo = "dypgen";
+      rev = version;
+      hash = "sha256-fKuO/e5YbA2B7XcghWl9pXxwvKw9YlhnmZDZcuKe3cs=";
+    };
+  } else if lib.versionOlder ocaml.version "4.06" then {
+    version = "20120619-1";
+    src = fetchurl {
+      url = "http://dypgen.free.fr/dypgen-20120619-1.tar.bz2";
+      sha256 = "ecb53d6e469e9ec4d57ee6323ff498d45b78883ae13618492488e7c5151fdd97";
+    };
+  } else throw "dypgen is not available for OCaml ${ocaml.version}"
+; in
 
 stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
-  version = "20120619-1";
-
-  src = fetchurl {
-    url = "http://dypgen.free.fr/dypgen-20120619-1.tar.bz2";
-    sha256 = "ecb53d6e469e9ec4d57ee6323ff498d45b78883ae13618492488e7c5151fdd97";
-  };
+  pname = "ocaml${ocaml.version}-dypgen";
+  inherit (params) src version;
 
   nativeBuildInputs = [ ocaml findlib ];
 

From 68ff3000eae2a6291b9ba284e756c62adb058f38 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 25 Jul 2023 07:37:28 +0300
Subject: [PATCH 07/16] linux: 4.19.288 -> 4.19.289

(cherry picked from commit 16c27410de37364f08f2997231727089b29f23cb)
---
 pkgs/os-specific/linux/kernel/linux-4.19.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 47c8cc9cbe05..e71cdee98da8 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.288";
+  version = "4.19.289";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1sz3jp6kx0axdwp0wsq903q1090rbav9d12m5128335m8p2d1srk";
+    sha256 = "1cx33aa9v2071gixvp68pqpp4vxcx61dqg04rf6xns1qg48p93qi";
   };
 } // (args.argsOverride or {}))

From 93790a46b2b59634cf66ce9161a68c2fab3e49c7 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 25 Jul 2023 07:37:34 +0300
Subject: [PATCH 08/16] linux: 5.10.186 -> 5.10.187

(cherry picked from commit d5cddc3d2f0accbea6525c394855b4d5674f724d)
---
 pkgs/os-specific/linux/kernel/linux-5.10.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
index f550778eac90..cf7390609895 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.186";
+  version = "5.10.187";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1qqv91r13akgik1q4jybf8czskxxizk6lpv4rsvjn9sx2dm2jq0y";
+    sha256 = "1fwbz5xg3jxfzji9jlxqwf5rz9acgn4sm2inp3l017iy1chm957n";
   };
 } // (args.argsOverride or {}))

From 4d8ae6086a0edfc66f97bd06cbc6b4131770088f Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 25 Jul 2023 07:37:38 +0300
Subject: [PATCH 09/16] linux: 5.15.121 -> 5.15.122

(cherry picked from commit c28af224b5e2598ac76b30b8a5f44b84cb7cea17)
---
 pkgs/os-specific/linux/kernel/linux-5.15.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index 3bf19de28338..8c66af32b442 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.121";
+  version = "5.15.122";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "07f3a68r1yb4p19z1azjwp2vhjb3ayh31hz9hfb4a98dn2ywxq07";
+    sha256 = "0b9ljdi9vgwzw4wa8gx1ia5fmb1pm8lnslx0q2l2kqhwrl0mhx9q";
   };
 } // (args.argsOverride or { }))

From 5265fa55c430cd7b2f03d5975039a9cbe36ccc17 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 25 Jul 2023 07:37:42 +0300
Subject: [PATCH 10/16] linux: 5.4.249 -> 5.4.250

(cherry picked from commit 6da374098b4d6b53b434e63f80338aaec6ba62f2)
---
 pkgs/os-specific/linux/kernel/linux-5.4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 99205ad33962..daa4385b7614 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.249";
+  version = "5.4.250";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "079mylc5j7hk5xn59q3z2xydyh88pq7yipn67x3y7nvf5i35hm6w";
+    sha256 = "1ywil04x3mw62n53pkrkxrhkg1xyi3g9ssvg6igbyqk0a9v8hnqg";
   };
 } // (args.argsOverride or {}))

From db0f37a15c062a01befa06a74cae17bf54f47282 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 25 Jul 2023 07:37:47 +0300
Subject: [PATCH 11/16] linux: 6.1.40 -> 6.1.41

(cherry picked from commit 04141e9828f4ad2db272f1aaca5a5ec5bc4f9247)
---
 pkgs/os-specific/linux/kernel/linux-6.1.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-6.1.nix b/pkgs/os-specific/linux/kernel/linux-6.1.nix
index c8ecfc95f355..7fade741a748 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1.40";
+  version = "6.1.41";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "1w474pia4pxz4qbfai27ary1y1h2fnn7kvx7yz7wszd0jwhzrsj3";
+    sha256 = "1dqbawgcpwxszqqnf7a66db8xlldxnr4f3sqlq42l1gaiskhja1i";
   };
 } // (args.argsOverride or { }))

From 4a07b4575e6cb19d2965aff240e431ff64785926 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 25 Jul 2023 07:37:52 +0300
Subject: [PATCH 12/16] linux: 6.4.5 -> 6.4.6

(cherry picked from commit e998e5216c0ce4a2b0c5c2f05e083df01f4c4cd3)
---
 pkgs/os-specific/linux/kernel/linux-6.4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-6.4.nix b/pkgs/os-specific/linux/kernel/linux-6.4.nix
index b87269589ae3..aaa568ff2b32 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.4.5";
+  version = "6.4.6";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "1dz9inr1bf7jx5s9n0dfa0srfzrwnz1zmdq42bbxyl9w8q3jqkip";
+    sha256 = "192ya79h3lw781ka22ibgbvdcx6maa74nyk0lqjsz2n4xybc9v71";
   };
 } // (args.argsOverride or { }))

From beb6196e9ed1f59fa9c8884b2b9e2d0eafb67bbc Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 25 Jul 2023 09:21:08 +0300
Subject: [PATCH 13/16] linux-firmware: 20230625 -> unstable-2023-07-24, sync
 with master

This is a manual backport of #245305.
---
 .../linux/firmware/linux-firmware/source.nix      |  6 +++---
 .../linux/firmware/linux-firmware/update.sh       | 15 ++++++++++-----
 2 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/pkgs/os-specific/linux/firmware/linux-firmware/source.nix b/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
index 01ea40a5089a..4fcf64fae355 100644
--- a/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
@@ -1,6 +1,6 @@
 # This file is autogenerated! Run ./update.sh to regenerate.
 {
-  version = "20230625";
-  sourceHash = "sha256-olRaUVnCri/sJU6ob+QgNxEZF8GzVxxEh8zdNJIZlYY=";
-  outputHash = "sha256-zSlMpAPbW7ewEBzDre47/7NJyy2pC0GSbkyOVVi+4gU=";
+  version = "unstable-2023-07-24";
+  sourceHash = "sha256-WyO/+fxQljfo6OXLC8/BomGmKtUQaJ1Lt9V5Fdv172g=";
+  outputHash = "sha256-wHWPSyqxP+MGmerbc2v/hclFFJ7qKCDsupK5GASjp8s=";
 }
diff --git a/pkgs/os-specific/linux/firmware/linux-firmware/update.sh b/pkgs/os-specific/linux/firmware/linux-firmware/update.sh
index cd711db7de40..0f11b7d069d1 100755
--- a/pkgs/os-specific/linux/firmware/linux-firmware/update.sh
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/update.sh
@@ -2,19 +2,24 @@
 set -euo pipefail
 cd "$(dirname "$(readlink -f "$0")")" || exit
 
-# step 1: figure out the latest version from the tags
 repo="https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git"
-latestTag="$(git ls-remote --refs --tags --sort refname "$repo" | tail -n1 | cut -f2 | cut -d '/' -f3)"
+
+# step 1: figure out the latest version from the tags
+if [ -z "${1:-}" ]; then
+  version="$(git ls-remote --refs --tags --sort refname "$repo" | tail -n1 | cut -f2 | cut -d '/' -f3)"
+else
+  version=$1
+fi
 
 # step 2: prefetch the source tarball
-snapshotUrl="$repo/snapshot/linux-firmware-$latestTag.tar.gz"
+snapshotUrl="$repo/snapshot/linux-firmware-$version.tar.gz"
 hash="$(nix-prefetch-url --unpack "$snapshotUrl")"
 sriHash="$(nix --experimental-features nix-command hash to-sri "sha256:$hash")"
 
 # step 3: rebuild as a non-FO derivation to get the right hash
 cat > source.nix << EOF
 {
-  version = "$latestTag";
+  version = "$version";
   sourceHash = "$sriHash";
   outputHash = null;
 }
@@ -27,7 +32,7 @@ outHash="$(nix --experimental-features nix-command hash path "$outPath")"
 cat > source.nix << EOF
 # This file is autogenerated! Run ./update.sh to regenerate.
 {
-  version = "$latestTag";
+  version = "$version";
   sourceHash = "$sriHash";
   outputHash = "$outHash";
 }

From 1d37712cf0bc845caff2c6f218ac94a7c5c98885 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 25 Jul 2023 10:42:28 +0300
Subject: [PATCH 14/16] linux-firmware: fix build, add explicit revision

(cherry picked from commit 5a5ddf79cc75e2f10a8d5b5dbaa31587ad8b6883)
---
 .../linux/firmware/linux-firmware/default.nix      |  2 +-
 .../linux/firmware/linux-firmware/source.nix       |  1 +
 .../linux/firmware/linux-firmware/update.sh        | 14 +++++++++++---
 3 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/pkgs/os-specific/linux/firmware/linux-firmware/default.nix b/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
index a2229a0a60ce..b76a77fb3a60 100644
--- a/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
@@ -11,7 +11,7 @@ stdenvNoCC.mkDerivation rec {
   version = source.version;
 
   src = fetchzip {
-    url = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/snapshot/linux-firmware-${version}.tar.gz";
+    url = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/snapshot/linux-firmware-${source.revision}.tar.gz";
     hash = source.sourceHash;
   };
 
diff --git a/pkgs/os-specific/linux/firmware/linux-firmware/source.nix b/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
index 4fcf64fae355..7cd541402bd1 100644
--- a/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
@@ -1,6 +1,7 @@
 # This file is autogenerated! Run ./update.sh to regenerate.
 {
   version = "unstable-2023-07-24";
+  revision = "59fbffa9ec8e4b0b31d2d13e715cf6580ad0e99c";
   sourceHash = "sha256-WyO/+fxQljfo6OXLC8/BomGmKtUQaJ1Lt9V5Fdv172g=";
   outputHash = "sha256-wHWPSyqxP+MGmerbc2v/hclFFJ7qKCDsupK5GASjp8s=";
 }
diff --git a/pkgs/os-specific/linux/firmware/linux-firmware/update.sh b/pkgs/os-specific/linux/firmware/linux-firmware/update.sh
index 0f11b7d069d1..4b28d6e1374f 100755
--- a/pkgs/os-specific/linux/firmware/linux-firmware/update.sh
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/update.sh
@@ -6,13 +6,19 @@ repo="https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.gi
 
 # step 1: figure out the latest version from the tags
 if [ -z "${1:-}" ]; then
-  version="$(git ls-remote --refs --tags --sort refname "$repo" | tail -n1 | cut -f2 | cut -d '/' -f3)"
+  revision="$(git ls-remote --refs --tags --sort refname "$repo" | tail -n1 | cut -f2 | cut -d '/' -f3)"
+  version=$revision
 else
-  version=$1
+  revision=$1
+  if [ -z "${2:-}" ]; then
+    version="unstable-$(date "+%Y-%m-%d")"
+  else
+    version=$2
+  fi
 fi
 
 # step 2: prefetch the source tarball
-snapshotUrl="$repo/snapshot/linux-firmware-$version.tar.gz"
+snapshotUrl="$repo/snapshot/linux-firmware-$revision.tar.gz"
 hash="$(nix-prefetch-url --unpack "$snapshotUrl")"
 sriHash="$(nix --experimental-features nix-command hash to-sri "sha256:$hash")"
 
@@ -20,6 +26,7 @@ sriHash="$(nix --experimental-features nix-command hash to-sri "sha256:$hash")"
 cat > source.nix << EOF
 {
   version = "$version";
+  revision = "$revision";
   sourceHash = "$sriHash";
   outputHash = null;
 }
@@ -33,6 +40,7 @@ cat > source.nix << EOF
 # This file is autogenerated! Run ./update.sh to regenerate.
 {
   version = "$version";
+  revision = "$revision";
   sourceHash = "$sriHash";
   outputHash = "$outHash";
 }

From f9e764d7bbb428eb15ba5cd339c2185448ac690c Mon Sep 17 00:00:00 2001
From: Atemu <atemu.main@gmail.com>
Date: Fri, 7 Jul 2023 17:48:48 +0200
Subject: [PATCH 15/16] nixos/paperless: use toShellVars for paperless-manage

The homebrewed snippet didn't escape vars properly which is an issue because
PAPERLESS_OCR_USER_ARGS requires a JSON string. This also meant a discrepancy
between the services' env vars and paperless-manage's.

Just use the correctly functioning library function for this instead.

(cherry picked from commit 44f637aa8d933ec682b461877f12125d5857657c)
---
 nixos/modules/services/misc/paperless.nix | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index afdc19532dce..b2b5c54db182 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -26,14 +26,11 @@ let
     lib.mapAttrs (_: toString) cfg.extraConfig
   );
 
-  manage =
-    let
-      setupEnv = lib.concatStringsSep "\n" (mapAttrsToList (name: val: "export ${name}=\"${val}\"") env);
-    in
-    pkgs.writeShellScript "manage" ''
-      ${setupEnv}
-      exec ${pkg}/bin/paperless-ngx "$@"
-    '';
+  manage = pkgs.writeShellScript "manage" ''
+    set -o allexport # Export the following env vars
+    ${lib.toShellVars env}
+    exec ${pkg}/bin/paperless-ngx "$@"
+  '';
 
   # Secure the services
   defaultServiceConfig = {

From 621b93aea95958b7b9399caa44c92b6ada847389 Mon Sep 17 00:00:00 2001
From: Atemu <atemu.main@gmail.com>
Date: Sun, 9 Jul 2023 19:47:58 +0200
Subject: [PATCH 16/16] nixos/paperless: explain how to set JSON env vars

Co-authored-by: Christian Theune <ct@flyingcircus.io>
Co-authored-by: Erik Arvstedt <erik.arvstedt@gmail.com>
(cherry picked from commit 2616bb762b6834a2f20109aebab2c29317084469)
---
 nixos/modules/services/misc/paperless.nix | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index b2b5c54db182..0ecfcb895c0c 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -169,6 +169,7 @@ in
       description = lib.mdDoc "Web interface port.";
     };
 
+    # FIXME this should become an RFC42-style settings attr
     extraConfig = mkOption {
       type = types.attrs;
       default = { };
@@ -177,11 +178,23 @@ in
 
         See [the documentation](https://paperless-ngx.readthedocs.io/en/latest/configuration.html)
         for available options.
+
+        Note that some options such as `PAPERLESS_CONSUMER_IGNORE_PATTERN` expect JSON values. Use `builtins.toJSON` to ensure proper quoting.
+      '';
+      example = literalExpression ''
+        {
+          PAPERLESS_OCR_LANGUAGE = "deu+eng";
+
+          PAPERLESS_DBHOST = "/run/postgresql";
+
+          PAPERLESS_CONSUMER_IGNORE_PATTERN = builtins.toJSON [ ".DS_STORE/*" "desktop.ini" ];
+
+          PAPERLESS_OCR_USER_ARGS = builtins.toJSON {
+            optimize = 1;
+            pdfa_image_compression = "lossless";
+          };
+        };
       '';
-      example = {
-        PAPERLESS_OCR_LANGUAGE = "deu+eng";
-        PAPERLESS_DBHOST = "/run/postgresql";
-      };
     };
 
     user = mkOption {