From 321b7a8efe83bc0a02710698686be10d258526b2 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Sat, 23 Sep 2023 12:38:30 +0200
Subject: [PATCH 01/18] wasmtime: 10.0.1 -> 10.0.2

Fixes CVE-2023-41880.

Changelog:
https://github.com/bytecodealliance/wasmtime/blob/v10.0.2/RELEASES.md
---
 pkgs/development/interpreters/wasmtime/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/interpreters/wasmtime/default.nix b/pkgs/development/interpreters/wasmtime/default.nix
index 253325975ec7..527e7dc8119f 100644
--- a/pkgs/development/interpreters/wasmtime/default.nix
+++ b/pkgs/development/interpreters/wasmtime/default.nix
@@ -2,17 +2,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmtime";
-  version = "10.0.1";
+  version = "10.0.2";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-UqjJVAmqITh7ixo71jfdQNZ5OLjmmmrk4b0saU2kyYo=";
+    hash = "sha256-c9evMSNaY5vZ9NvuHuHoyi4o0nRtZ8G44XonAzYrBCk=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-fEDvxstvBP/e2G8KbTVQKdxafQXxz4mnqCAso16HYaY=";
+  cargoHash = "sha256-fms77FmD+hmNF/Ta3CbPNXd+bTrTaVrDlsHEPNiPc1U=";
 
   cargoBuildFlags = [ "--package" "wasmtime-cli" "--package" "wasmtime-c-api" ];
 

From d37146b8c60fb791fe6be233a3e453eeada772af Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@tweag.io>
Date: Sat, 23 Sep 2023 00:09:26 +0200
Subject: [PATCH 02/18] tests.nixpkgs-check-by-name: Fix non-reproducible test
 failures

This was an oversight in https://github.com/NixOS/nixpkgs/pull/254435

(cherry picked from commit 1fe58cb05088030f4350662f5f04fe4bf3940656)
---
 pkgs/test/nixpkgs-check-by-name/default.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/test/nixpkgs-check-by-name/default.nix b/pkgs/test/nixpkgs-check-by-name/default.nix
index cb8a672bc990..f69a134f568f 100644
--- a/pkgs/test/nixpkgs-check-by-name/default.nix
+++ b/pkgs/test/nixpkgs-check-by-name/default.nix
@@ -26,10 +26,13 @@ let
         export NIX_STATE_DIR=$TEST_ROOT/var/nix
         export NIX_STORE_DIR=$TEST_ROOT/store
 
-        # cargo tests run in parallel by default, which would then run into
-        # https://github.com/NixOS/nix/issues/2706 unless the store is initialised first
+        # Ensure that even if tests run in parallel, we don't get an error
+        # We'd run into https://github.com/NixOS/nix/issues/2706 unless the store is initialised first
         nix-store --init
       '';
+      # The tests use the shared environment variables,
+      # so we cannot run them in parallel
+      dontUseCargoParallelTests = true;
       postCheck = ''
         cargo fmt --check
         cargo clippy -- -D warnings

From 6b4dbb449d7140d2676116f4bf78ab21506cf657 Mon Sep 17 00:00:00 2001
From: hubofeverything
 <53921912+the-furry-hubofeverything@users.noreply.github.com>
Date: Sat, 16 Sep 2023 05:54:08 -0700
Subject: [PATCH 03/18] linux-kernel: Add HP drivers on 6.1+

(cherry picked from commit 7eb259b1fb37bc65dc8aafc3a6c9cdf109eb7e59)
---
 pkgs/os-specific/linux/kernel/common-config.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 19bc82394b14..a828f0d08fd5 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -966,6 +966,7 @@ let
 
       X86_AMD_PLATFORM_DEVICE = yes;
       X86_PLATFORM_DRIVERS_DELL = whenAtLeast "5.12" yes;
+      X86_PLATFORM_DRIVERS_HP = whenAtLeast "6.1" yes;
 
       LIRC = mkMerge [ (whenOlder "4.16" module) (whenAtLeast "4.17" yes) ];
 

From 6f0efe6202d4f7ed69ecda24092b65300345c012 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 19 Sep 2023 15:12:10 +0300
Subject: [PATCH 04/18] linux: rewrite updater-script, make data-driven

Co-authored-by: Raito Bezarius <masterancpp@gmail.com>
(cherry picked from commit 662a2c460d7316c8bed626d420646373da467185)
---
 .../os-specific/linux/kernel/kernels-org.json |  38 +++++++
 pkgs/os-specific/linux/kernel/linux-4.14.nix  |  18 ---
 pkgs/os-specific/linux/kernel/linux-4.19.nix  |  18 ---
 pkgs/os-specific/linux/kernel/linux-5.10.nix  |  18 ---
 pkgs/os-specific/linux/kernel/linux-5.15.nix  |  18 ---
 pkgs/os-specific/linux/kernel/linux-5.4.nix   |  18 ---
 pkgs/os-specific/linux/kernel/linux-6.1.nix   |  18 ---
 pkgs/os-specific/linux/kernel/linux-6.4.nix   |  18 ---
 pkgs/os-specific/linux/kernel/linux-6.5.nix   |  18 ---
 .../linux/kernel/linux-testing.nix            |  20 ----
 pkgs/os-specific/linux/kernel/mainline.nix    |  18 +++
 .../linux/kernel/update-mainline.py           | 104 ++++++++++++++++++
 pkgs/os-specific/linux/kernel/update.sh       |  76 ++-----------
 pkgs/top-level/linux-kernels.nix              |  29 +++--
 14 files changed, 189 insertions(+), 240 deletions(-)
 create mode 100644 pkgs/os-specific/linux/kernel/kernels-org.json
 delete mode 100644 pkgs/os-specific/linux/kernel/linux-4.14.nix
 delete mode 100644 pkgs/os-specific/linux/kernel/linux-4.19.nix
 delete mode 100644 pkgs/os-specific/linux/kernel/linux-5.10.nix
 delete mode 100644 pkgs/os-specific/linux/kernel/linux-5.15.nix
 delete mode 100644 pkgs/os-specific/linux/kernel/linux-5.4.nix
 delete mode 100644 pkgs/os-specific/linux/kernel/linux-6.1.nix
 delete mode 100644 pkgs/os-specific/linux/kernel/linux-6.4.nix
 delete mode 100644 pkgs/os-specific/linux/kernel/linux-6.5.nix
 delete mode 100644 pkgs/os-specific/linux/kernel/linux-testing.nix
 create mode 100644 pkgs/os-specific/linux/kernel/mainline.nix
 create mode 100755 pkgs/os-specific/linux/kernel/update-mainline.py

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
new file mode 100644
index 000000000000..b2d4b1fa83b8
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -0,0 +1,38 @@
+{
+    "testing": {
+        "version": "6.6-rc1",
+        "hash": "02zh3dnikyhhlas9xccia963d4yqmzq0m4b8s10x8mjng3na45hd"
+    },
+    "6.5": {
+        "version": "6.5.4",
+        "hash": "0s8nzd8yaq06bq8byk7aakbk95gh0rhlif26h1biw94v48anrxxx"
+    },
+    "6.4": {
+        "version": "6.4.16",
+        "hash": "0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln"
+    },
+    "6.1": {
+        "version": "6.1.54",
+        "hash": "09sfrq2l8f777mx2n9mhb6bgz1064bl04921byqnmk87si31w653"
+    },
+    "5.15": {
+        "version": "5.15.132",
+        "hash": "1b0qjsaqjw2rk86shmmrj2aasblkn27acjmc761vnjg7sv2baxs1"
+    },
+    "5.10": {
+        "version": "5.10.195",
+        "hash": "0n4vg2i9sq89wnz85arlyvwysh9s83cgzs5bk2wh98bivi5fwfs1"
+    },
+    "5.4": {
+        "version": "5.4.256",
+        "hash": "0fim5q9xakwnjfg48bpsic9r2r8dvrjlalqqkm9vh1rml9mhi967"
+    },
+    "4.19": {
+        "version": "4.19.294",
+        "hash": "03x0xsb8a369zdr81hg6xdl5n5v48k6iwnhj6r29725777lvvbfc"
+    },
+    "4.14": {
+        "version": "4.14.325",
+        "hash": "117p1mdha57f6d3kdwac9jrbmib7g77q4xhir8ghl6fmrs1f2sav"
+    }
+}
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
deleted file mode 100644
index dc0ead44be43..000000000000
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "4.14.325";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = versions.pad 3 version;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "117p1mdha57f6d3kdwac9jrbmib7g77q4xhir8ghl6fmrs1f2sav";
-  };
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
deleted file mode 100644
index 6048caf8fa86..000000000000
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "4.19.294";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = versions.pad 3 version;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "03x0xsb8a369zdr81hg6xdl5n5v48k6iwnhj6r29725777lvvbfc";
-  };
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
deleted file mode 100644
index 213bf7e670f3..000000000000
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "5.10.195";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = versions.pad 3 version;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0n4vg2i9sq89wnz85arlyvwysh9s83cgzs5bk2wh98bivi5fwfs1";
-  };
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
deleted file mode 100644
index d86b0cf0ce64..000000000000
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "5.15.132";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = versions.pad 3 version;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1b0qjsaqjw2rk86shmmrj2aasblkn27acjmc761vnjg7sv2baxs1";
-  };
-} // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
deleted file mode 100644
index 0013636076a0..000000000000
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "5.4.256";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = versions.pad 3 version;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0fim5q9xakwnjfg48bpsic9r2r8dvrjlalqqkm9vh1rml9mhi967";
-  };
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.1.nix b/pkgs/os-specific/linux/kernel/linux-6.1.nix
deleted file mode 100644
index df99c9868510..000000000000
--- a/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "6.1.54";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = versions.pad 3 version;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "09sfrq2l8f777mx2n9mhb6bgz1064bl04921byqnmk87si31w653";
-  };
-} // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.4.nix b/pkgs/os-specific/linux/kernel/linux-6.4.nix
deleted file mode 100644
index d41cd21fbef9..000000000000
--- a/pkgs/os-specific/linux/kernel/linux-6.4.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ lib, fetchurl, buildLinux, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "6.4.16";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = versions.pad 3 version;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln";
-  };
-} // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.5.nix b/pkgs/os-specific/linux/kernel/linux-6.5.nix
deleted file mode 100644
index 28557090de61..000000000000
--- a/pkgs/os-specific/linux/kernel/linux-6.5.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ lib, fetchurl, buildLinux, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "6.5.4";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = versions.pad 3 version;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "0s8nzd8yaq06bq8byk7aakbk95gh0rhlif26h1biw94v48anrxxx";
-  };
-} // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
deleted file mode 100644
index 9a3b32a7f2d2..000000000000
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ lib, buildPackages, fetchzip, perl, buildLinux, nixosTests, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "6.6-rc1";
-  extraMeta.branch = lib.versions.majorMinor version;
-
-  # modDirVersion needs to be x.y.z, will always add .0
-  modDirVersion = versions.pad 3 version;
-
-  src = fetchzip {
-    url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    hash = "sha256-DRai7HhWVtRB0GiRCvCv2JM2TFKRsZ60ohD6GW0b8As=";
-  };
-
-  # Should the testing kernels ever be built on Hydra?
-  extraMeta.hydraPlatforms = [];
-
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/mainline.nix b/pkgs/os-specific/linux/kernel/mainline.nix
new file mode 100644
index 000000000000..50053e620e46
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/mainline.nix
@@ -0,0 +1,18 @@
+{ branch, lib, fetchurl, buildLinux, ... } @ args:
+
+let
+  allKernels = builtins.fromJSON (builtins.readFile ./kernels-org.json);
+  thisKernel = allKernels.${branch};
+
+  args' = (builtins.removeAttrs args ["branch"]) // rec {
+    inherit (thisKernel) version;
+    modDirVersion = lib.versions.pad 3 version;
+    extraMeta.branch = branch;
+
+    src = fetchurl {
+      url = "mirror://kernel/linux/kernel/v${lib.versions.major version}.x/linux-${version}.tar.xz";
+      sha256 = thisKernel.hash;
+    };
+  } // (args.argsOverride or {});
+in
+buildLinux args'
diff --git a/pkgs/os-specific/linux/kernel/update-mainline.py b/pkgs/os-specific/linux/kernel/update-mainline.py
new file mode 100755
index 000000000000..e7c37e9ab999
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/update-mainline.py
@@ -0,0 +1,104 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i python3 -p "python3.withPackages (ps: [ ps.beautifulsoup4 ps.lxml ])"
+from enum import Enum
+from bs4 import BeautifulSoup, NavigableString, Tag
+from dataclasses import dataclass
+import json
+import pathlib
+import re
+import subprocess
+import urllib.request
+import sys
+
+
+HERE = pathlib.Path(__file__).parent
+ROOT = HERE.parent.parent.parent.parent
+VERSIONS_FILE = HERE / "kernels-org.json"
+
+class KernelNature(Enum):
+    MAINLINE = 1
+    STABLE = 2
+    LONGTERM = 3
+
+@dataclass
+class KernelRelease:
+    nature: KernelNature
+    version: str
+    date: str
+    link: str
+    eol: bool = False
+
+def parse_release(release: Tag) -> KernelRelease | None:
+    columns: list[Tag] = list(release.find_all('td'))
+    try:
+        nature = KernelNature[columns[0].get_text().rstrip(':').upper()]
+    except KeyError:
+        return None
+
+    version = columns[1].get_text().rstrip(' [EOL]')
+    date = columns[2].get_text()
+    link = columns[3].find('a')
+    if link is not None and isinstance(link, Tag):
+        link = link.attrs.get('href')
+    assert link is not None, f'link for kernel {version} is non-existent'
+    eol = bool(release.find(class_='eolkernel'))
+
+    return KernelRelease(nature=nature, version=version, date=date, link=link, eol=eol)
+
+def get_branch(version: str):
+    # This is a testing kernel.
+    if 'rc' in version:
+        return 'testing'
+    else:
+        major, minor, *_ = version.split(".")
+        return f"{major}.{minor}"
+
+
+def get_hash(url: str):
+    return subprocess.check_output(["nix-prefetch-url", url]).decode().strip()
+
+
+def commit(message):
+    return subprocess.check_call(["git", "commit", "-m", message, VERSIONS_FILE])
+
+
+def main():
+    kernel_org = urllib.request.urlopen("https://kernel.org/")
+    soup = BeautifulSoup(kernel_org.read().decode(), "lxml")
+    release_table = soup.find(id='releases')
+    if not release_table or isinstance(release_table, NavigableString):
+        print(release_table)
+        print('Failed to find the release table on https://kernel.org')
+        sys.exit(1)
+
+    releases = release_table.find_all('tr')
+    parsed_releases = filter(None, [parse_release(release) for release in releases])
+    all_kernels = json.load(VERSIONS_FILE.open())
+
+    for kernel in parsed_releases:
+        branch = get_branch(kernel.version)
+        nixpkgs_branch = branch.replace('.', '_')
+
+        old_version = all_kernels.get(branch, {}).get("version")
+        if old_version == kernel.version:
+            print(f"linux_{nixpkgs_branch}: {kernel.version} is latest, skipping...")
+            continue
+
+        if old_version is None:
+            message = f"linux_{nixpkgs_branch}: init at {kernel.version}"
+        else:
+            message = f"linux_{nixpkgs_branch}: {old_version} -> {kernel.version}"
+
+        print(message)
+
+        all_kernels[branch] = {"version": kernel.version, "hash": get_hash(kernel.link)}
+
+        with VERSIONS_FILE.open("w") as fd:
+            json.dump(all_kernels, fd, indent=4)
+            fd.write("\n")  # makes editorconfig happy
+
+        commit(message)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/pkgs/os-specific/linux/kernel/update.sh b/pkgs/os-specific/linux/kernel/update.sh
index 4171b7492b7b..37e1cc1a5cd4 100755
--- a/pkgs/os-specific/linux/kernel/update.sh
+++ b/pkgs/os-specific/linux/kernel/update.sh
@@ -1,72 +1,14 @@
 #!/usr/bin/env bash
-set -e
+cd "$(dirname "$(readlink -f "$0")")" || exit
 
-# Get the latest versions from kernel.org
-LINUXSED='s/.*linux-\([0-9]\+\(.[0-9]\+\)*\).*/\1/p'
-KDATA="$(curl -s https://www.kernel.org | sed -n -e '/Download complete/p')"
-VERSIONS=($(sed -n -e $LINUXSED <<< "$KDATA" | sort -Vr))
+echo "Update linux (mainline)"
+COMMIT=1 ./update-mainline.py || echo "update-mainline failed with exit code $?"
 
-# Remove mainline version if there is a stable update
-# Note due to sorting these two will always exist at the bottom
-if grep -q "^${VERSIONS[1]}" <<< "${VERSIONS[0]}"; then
-  VERSIONS=(${VERSIONS[@]:0:1} ${VERSIONS[@]:2})
-fi
+echo "Update linux-rt"
+COMMIT=1 ./update-rt.sh || echo "update-rt failed with exit code $?"
 
-# Inspect each file and see if it has the latest version
-NIXPKGS="$(git rev-parse --show-toplevel)"
-ls $NIXPKGS/pkgs/os-specific/linux/kernel | while read FILE; do
-  KERNEL="$(sed -n -e $LINUXSED <<< "$FILE")"
-  [ -z "$KERNEL" ] && continue
+echo "Update linux-libre"
+COMMIT=1 ./update-libre.sh || echo "update-libre failed with exit code $?"
 
-  # Find the matching new kernel version
-  MATCHING=""
-  for V in "${VERSIONS[@]}"; do
-    if grep -q "^$KERNEL" <<< "$V"; then
-      MATCHING="$V"
-      break
-    fi
-  done
-  if [ -z "$MATCHING" ]; then
-    echo "Out-of-support $KERNEL"
-    continue
-  fi
-
-  # Inspect the nix expression to check for changes
-  DATA="$(<$NIXPKGS/pkgs/os-specific/linux/kernel/$FILE)"
-  URL="$(sed -n -e 's/.*url = "\(.*\)";.*/\1/p' <<< "$DATA" | sed -e "s/\${version}/$MATCHING/g")"
-  OLDVER=$(sed -n -e 's/.*version = "\(.*\)".*/\1/p' <<< "$DATA")
-  if [ "$OLDVER" = "$V" ]; then
-    echo "No updates for $KERNEL"
-    continue
-  fi
-
-  # Download the new file for the hash
-  if ! HASH="$(nix-prefetch-url $URL 2>/dev/null)"; then
-    echo "Failed to get hash of $URL"
-    continue
-  fi
-  sed -i -e "s/sha256 = \".*\"/sha256 = \"$HASH\"/g" $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
-
-  # Rewrite the expression
-  sed -i -e '/version = /d' $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
-  sed -i -e "\#buildLinux (args // rec {#a \  version = \"$V\";" $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
-
-  # Commit the changes
-  git add -u $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
-  git commit -m "linux: $OLDVER -> $V" >/dev/null 2>&1
-
-  echo "Updated $OLDVER -> $V"
-done
-
-# Allowing errors again: one broken update script shouldn't inhibit the
-# update of other kernel variants.
-set +e
-
-echo Update linux-rt
-COMMIT=1 $NIXPKGS/pkgs/os-specific/linux/kernel/update-rt.sh || echo "update-rt failed with exit code $?"
-
-echo Update linux-libre
-COMMIT=1 $NIXPKGS/pkgs/os-specific/linux/kernel/update-libre.sh || echo "update-libre failed with exit code $?"
-
-echo Update linux-hardened
-COMMIT=1 $NIXPKGS/pkgs/os-specific/linux/kernel/hardened/update.py || echo "update-hardened failed with exit code $?"
+echo "Update linux-hardened"
+COMMIT=1 ./hardened/update.py || echo "update-hardened failed with exit code $?"
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 81bb641736a7..8dfe20c1768f 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -96,7 +96,8 @@ in {
       rpiVersion = 4;
     };
 
-    linux_4_14 = callPackage ../os-specific/linux/kernel/linux-4.14.nix {
+    linux_4_14 = callPackage ../os-specific/linux/kernel/mainline.nix {
+      branch = "4.14";
       kernelPatches =
         [ kernelPatches.bridge_stp_helper
           kernelPatches.request_key_helper
@@ -107,7 +108,8 @@ in {
         ];
     };
 
-    linux_4_19 = callPackage ../os-specific/linux/kernel/linux-4.19.nix {
+    linux_4_19 = callPackage ../os-specific/linux/kernel/mainline.nix {
+      branch = "4.19";
       kernelPatches =
         [ kernelPatches.bridge_stp_helper
           kernelPatches.request_key_helper
@@ -115,7 +117,8 @@ in {
         ];
     };
 
-    linux_5_4 = callPackage ../os-specific/linux/kernel/linux-5.4.nix {
+    linux_5_4 = callPackage ../os-specific/linux/kernel/mainline.nix {
+      branch = "5.4";
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
@@ -130,7 +133,8 @@ in {
       ];
     };
 
-    linux_5_10 = callPackage ../os-specific/linux/kernel/linux-5.10.nix {
+    linux_5_10 = callPackage ../os-specific/linux/kernel/mainline.nix {
+      branch = "5.10";
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
@@ -145,7 +149,8 @@ in {
       ];
     };
 
-    linux_5_15 = callPackage ../os-specific/linux/kernel/linux-5.15.nix {
+    linux_5_15 = callPackage ../os-specific/linux/kernel/mainline.nix {
+      branch = "5.15";
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
@@ -160,7 +165,8 @@ in {
       ];
     };
 
-    linux_6_1 = callPackage ../os-specific/linux/kernel/linux-6.1.nix {
+    linux_6_1 = callPackage ../os-specific/linux/kernel/mainline.nix {
+      branch = "6.1";
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
@@ -177,7 +183,8 @@ in {
       ];
     };
 
-    linux_6_4 = callPackage ../os-specific/linux/kernel/linux-6.4.nix {
+    linux_6_4 = callPackage ../os-specific/linux/kernel/mainline.nix {
+      branch = "6.4";
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
@@ -185,7 +192,8 @@ in {
       ];
     };
 
-    linux_6_5 = callPackage ../os-specific/linux/kernel/linux-6.5.nix {
+    linux_6_5 = callPackage ../os-specific/linux/kernel/mainline.nix {
+      branch = "6.5";
       kernelPatches = [
         kernelPatches.bridge_stp_helper
         kernelPatches.request_key_helper
@@ -194,7 +202,10 @@ in {
     };
 
     linux_testing = let
-      testing = callPackage ../os-specific/linux/kernel/linux-testing.nix {
+      testing = callPackage ../os-specific/linux/kernel/mainline.nix {
+        # A special branch that tracks the kernel under the release process
+        # i.e. which has at least a public rc1 and is not released yet.
+        branch = "testing";
         kernelPatches = [
           kernelPatches.bridge_stp_helper
           kernelPatches.request_key_helper

From f50a014a17b2269b1ad3be22cece649ffeb99d70 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Fri, 22 Sep 2023 14:28:05 +0300
Subject: [PATCH 05/18] linux: more update-script cleanups/fixes

- special case linux-testing fetching
- use hash instead of sha256 everywhere
- respect COMMIT envvar

This causes rebuilds, so should go in with the next bump probably.

(cherry picked from commit c08efe1438362d2cdcb64849bd7e28dd688b55f6)
---
 .../os-specific/linux/kernel/kernels-org.json | 20 ++++++------
 pkgs/os-specific/linux/kernel/mainline.nix    | 25 ++++++++++-----
 .../linux/kernel/update-mainline.py           | 32 ++++++++++++++++---
 3 files changed, 54 insertions(+), 23 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index b2d4b1fa83b8..7b212cbdda35 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,38 +1,38 @@
 {
     "testing": {
-        "version": "6.6-rc1",
-        "hash": "02zh3dnikyhhlas9xccia963d4yqmzq0m4b8s10x8mjng3na45hd"
+        "version": "6.6-rc2",
+        "hash": "sha256:1hbva5vsfi48h82ll4kmhzm5hxp7340bj2smwgvjikam26icaj54"
     },
     "6.5": {
         "version": "6.5.4",
-        "hash": "0s8nzd8yaq06bq8byk7aakbk95gh0rhlif26h1biw94v48anrxxx"
+        "hash": "sha256:0s8nzd8yaq06bq8byk7aakbk95gh0rhlif26h1biw94v48anrxxx"
     },
     "6.4": {
         "version": "6.4.16",
-        "hash": "0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln"
+        "hash": "sha256:0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln"
     },
     "6.1": {
         "version": "6.1.54",
-        "hash": "09sfrq2l8f777mx2n9mhb6bgz1064bl04921byqnmk87si31w653"
+        "hash": "sha256:09sfrq2l8f777mx2n9mhb6bgz1064bl04921byqnmk87si31w653"
     },
     "5.15": {
         "version": "5.15.132",
-        "hash": "1b0qjsaqjw2rk86shmmrj2aasblkn27acjmc761vnjg7sv2baxs1"
+        "hash": "sha256:1b0qjsaqjw2rk86shmmrj2aasblkn27acjmc761vnjg7sv2baxs1"
     },
     "5.10": {
         "version": "5.10.195",
-        "hash": "0n4vg2i9sq89wnz85arlyvwysh9s83cgzs5bk2wh98bivi5fwfs1"
+        "hash": "sha256:0n4vg2i9sq89wnz85arlyvwysh9s83cgzs5bk2wh98bivi5fwfs1"
     },
     "5.4": {
         "version": "5.4.256",
-        "hash": "0fim5q9xakwnjfg48bpsic9r2r8dvrjlalqqkm9vh1rml9mhi967"
+        "hash": "sha256:0fim5q9xakwnjfg48bpsic9r2r8dvrjlalqqkm9vh1rml9mhi967"
     },
     "4.19": {
         "version": "4.19.294",
-        "hash": "03x0xsb8a369zdr81hg6xdl5n5v48k6iwnhj6r29725777lvvbfc"
+        "hash": "sha256:03x0xsb8a369zdr81hg6xdl5n5v48k6iwnhj6r29725777lvvbfc"
     },
     "4.14": {
         "version": "4.14.325",
-        "hash": "117p1mdha57f6d3kdwac9jrbmib7g77q4xhir8ghl6fmrs1f2sav"
+        "hash": "sha256:117p1mdha57f6d3kdwac9jrbmib7g77q4xhir8ghl6fmrs1f2sav"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/mainline.nix b/pkgs/os-specific/linux/kernel/mainline.nix
index 50053e620e46..4e1d5b8a9e87 100644
--- a/pkgs/os-specific/linux/kernel/mainline.nix
+++ b/pkgs/os-specific/linux/kernel/mainline.nix
@@ -1,18 +1,27 @@
-{ branch, lib, fetchurl, buildLinux, ... } @ args:
+{ branch, lib, fetchurl, fetchzip, buildLinux, ... } @ args:
 
 let
   allKernels = builtins.fromJSON (builtins.readFile ./kernels-org.json);
   thisKernel = allKernels.${branch};
+  inherit (thisKernel) version;
+
+  src =
+    # testing kernels are a special case because they don't have tarballs on the CDN
+    if branch == "testing"
+      then fetchzip {
+        url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
+        inherit (thisKernel) hash;
+      }
+      else fetchurl {
+        url = "mirror://kernel/linux/kernel/v${lib.versions.major version}.x/linux-${version}.tar.xz";
+        inherit (thisKernel) hash;
+      };
+
+  args' = (builtins.removeAttrs args ["branch"]) // {
+    inherit src version;
 
-  args' = (builtins.removeAttrs args ["branch"]) // rec {
-    inherit (thisKernel) version;
     modDirVersion = lib.versions.pad 3 version;
     extraMeta.branch = branch;
-
-    src = fetchurl {
-      url = "mirror://kernel/linux/kernel/v${lib.versions.major version}.x/linux-${version}.tar.xz";
-      sha256 = thisKernel.hash;
-    };
   } // (args.argsOverride or {});
 in
 buildLinux args'
diff --git a/pkgs/os-specific/linux/kernel/update-mainline.py b/pkgs/os-specific/linux/kernel/update-mainline.py
index e7c37e9ab999..8fac82e6633e 100755
--- a/pkgs/os-specific/linux/kernel/update-mainline.py
+++ b/pkgs/os-specific/linux/kernel/update-mainline.py
@@ -9,6 +9,7 @@ import re
 import subprocess
 import urllib.request
 import sys
+import os
 
 
 HERE = pathlib.Path(__file__).parent
@@ -24,6 +25,7 @@ class KernelNature(Enum):
 class KernelRelease:
     nature: KernelNature
     version: str
+    branch: str
     date: str
     link: str
     eol: bool = False
@@ -43,7 +45,14 @@ def parse_release(release: Tag) -> KernelRelease | None:
     assert link is not None, f'link for kernel {version} is non-existent'
     eol = bool(release.find(class_='eolkernel'))
 
-    return KernelRelease(nature=nature, version=version, date=date, link=link, eol=eol)
+    return KernelRelease(
+        nature=nature,
+        branch=get_branch(version),
+        version=version,
+        date=date,
+        link=link,
+        eol=eol,
+    )
 
 def get_branch(version: str):
     # This is a testing kernel.
@@ -53,9 +62,18 @@ def get_branch(version: str):
         major, minor, *_ = version.split(".")
         return f"{major}.{minor}"
 
+def get_hash(kernel: KernelRelease):
+    if kernel.branch == "testing":
+        args = ["--unpack"]
+    else:
+        args = []
 
-def get_hash(url: str):
-    return subprocess.check_output(["nix-prefetch-url", url]).decode().strip()
+    hash = (
+        subprocess.check_output(["nix-prefetch-url", kernel.link] + args)
+        .decode()
+        .strip()
+    )
+    return f"sha256:{hash}"
 
 
 def commit(message):
@@ -91,13 +109,17 @@ def main():
 
         print(message)
 
-        all_kernels[branch] = {"version": kernel.version, "hash": get_hash(kernel.link)}
+        all_kernels[branch] = {
+            "version": kernel.version,
+            "hash": get_hash(kernel),
+        }
 
         with VERSIONS_FILE.open("w") as fd:
             json.dump(all_kernels, fd, indent=4)
             fd.write("\n")  # makes editorconfig happy
 
-        commit(message)
+        if os.environ.get("COMMIT") == "1":
+            commit(message)
 
 
 if __name__ == "__main__":

From dc8355fc0c3bb5aae092fe94537b4b97c48d4afb Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Fri, 22 Sep 2023 16:10:21 +0300
Subject: [PATCH 06/18] linux/update-script: format with black + isort

(cherry picked from commit eadfc7b13133c0f23dd4717f25f65ea981b40344)
---
 .../linux/kernel/update-mainline.py           | 46 ++++++++++---------
 1 file changed, 25 insertions(+), 21 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/update-mainline.py b/pkgs/os-specific/linux/kernel/update-mainline.py
index 8fac82e6633e..df8257fa0ef0 100755
--- a/pkgs/os-specific/linux/kernel/update-mainline.py
+++ b/pkgs/os-specific/linux/kernel/update-mainline.py
@@ -1,26 +1,27 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i python3 -p "python3.withPackages (ps: [ ps.beautifulsoup4 ps.lxml ])"
-from enum import Enum
-from bs4 import BeautifulSoup, NavigableString, Tag
-from dataclasses import dataclass
 import json
-import pathlib
-import re
-import subprocess
-import urllib.request
-import sys
 import os
+import pathlib
+import subprocess
+import sys
+import urllib.request
+from dataclasses import dataclass
+from enum import Enum
 
+from bs4 import BeautifulSoup, NavigableString, Tag
 
 HERE = pathlib.Path(__file__).parent
 ROOT = HERE.parent.parent.parent.parent
 VERSIONS_FILE = HERE / "kernels-org.json"
 
+
 class KernelNature(Enum):
     MAINLINE = 1
     STABLE = 2
     LONGTERM = 3
 
+
 @dataclass
 class KernelRelease:
     nature: KernelNature
@@ -30,20 +31,21 @@ class KernelRelease:
     link: str
     eol: bool = False
 
+
 def parse_release(release: Tag) -> KernelRelease | None:
-    columns: list[Tag] = list(release.find_all('td'))
+    columns: list[Tag] = list(release.find_all("td"))
     try:
-        nature = KernelNature[columns[0].get_text().rstrip(':').upper()]
+        nature = KernelNature[columns[0].get_text().rstrip(":").upper()]
     except KeyError:
         return None
 
-    version = columns[1].get_text().rstrip(' [EOL]')
+    version = columns[1].get_text().rstrip(" [EOL]")
     date = columns[2].get_text()
-    link = columns[3].find('a')
+    link = columns[3].find("a")
     if link is not None and isinstance(link, Tag):
-        link = link.attrs.get('href')
-    assert link is not None, f'link for kernel {version} is non-existent'
-    eol = bool(release.find(class_='eolkernel'))
+        link = link.attrs.get("href")
+    assert link is not None, f"link for kernel {version} is non-existent"
+    eol = bool(release.find(class_="eolkernel"))
 
     return KernelRelease(
         nature=nature,
@@ -54,14 +56,16 @@ def parse_release(release: Tag) -> KernelRelease | None:
         eol=eol,
     )
 
+
 def get_branch(version: str):
     # This is a testing kernel.
-    if 'rc' in version:
-        return 'testing'
+    if "rc" in version:
+        return "testing"
     else:
         major, minor, *_ = version.split(".")
         return f"{major}.{minor}"
 
+
 def get_hash(kernel: KernelRelease):
     if kernel.branch == "testing":
         args = ["--unpack"]
@@ -83,19 +87,19 @@ def commit(message):
 def main():
     kernel_org = urllib.request.urlopen("https://kernel.org/")
     soup = BeautifulSoup(kernel_org.read().decode(), "lxml")
-    release_table = soup.find(id='releases')
+    release_table = soup.find(id="releases")
     if not release_table or isinstance(release_table, NavigableString):
         print(release_table)
-        print('Failed to find the release table on https://kernel.org')
+        print("Failed to find the release table on https://kernel.org")
         sys.exit(1)
 
-    releases = release_table.find_all('tr')
+    releases = release_table.find_all("tr")
     parsed_releases = filter(None, [parse_release(release) for release in releases])
     all_kernels = json.load(VERSIONS_FILE.open())
 
     for kernel in parsed_releases:
         branch = get_branch(kernel.version)
-        nixpkgs_branch = branch.replace('.', '_')
+        nixpkgs_branch = branch.replace(".", "_")
 
         old_version = all_kernels.get(branch, {}).get("version")
         if old_version == kernel.version:

From 325832228f9ffcee2b5f5b909a12253ca6479835 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 23 Sep 2023 18:21:53 +0300
Subject: [PATCH 07/18] linux_6_5: 6.5.4 -> 6.5.5

(cherry picked from commit 868b04dde7730acdf5380134709e544b572ed2e0)
---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 7b212cbdda35..ed6596ab935d 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -4,8 +4,8 @@
         "hash": "sha256:1hbva5vsfi48h82ll4kmhzm5hxp7340bj2smwgvjikam26icaj54"
     },
     "6.5": {
-        "version": "6.5.4",
-        "hash": "sha256:0s8nzd8yaq06bq8byk7aakbk95gh0rhlif26h1biw94v48anrxxx"
+        "version": "6.5.5",
+        "hash": "sha256:15gg8sb6cfgk1afwj7fl7mj4nkj14w43vzwvw0qsg3nzyxwh7wcc"
     },
     "6.4": {
         "version": "6.4.16",

From 4875c8ffaa04bd6a113899e9499c797a0c8b359f Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 23 Sep 2023 18:21:59 +0300
Subject: [PATCH 08/18] linux_6_1: 6.1.54 -> 6.1.55

(cherry picked from commit eec1a86870d2c27500727bf780f594b428f11a65)
---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index ed6596ab935d..41b1c41e1585 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -12,8 +12,8 @@
         "hash": "sha256:0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln"
     },
     "6.1": {
-        "version": "6.1.54",
-        "hash": "sha256:09sfrq2l8f777mx2n9mhb6bgz1064bl04921byqnmk87si31w653"
+        "version": "6.1.55",
+        "hash": "sha256:1h0mzx52q9pvdv7rhnvb8g68i7bnlc9rf8gy9qn4alsxq4g28zm8"
     },
     "5.15": {
         "version": "5.15.132",

From eee9329487a75c789daf41bf1828093bb5a2abfd Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 23 Sep 2023 18:25:29 +0300
Subject: [PATCH 09/18] linux_5_15: 5.15.132 -> 5.15.133

(cherry picked from commit 66f40f1d26ab697022d23d5ebabb753c2cd77c7d)
---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 41b1c41e1585..e3d412bc56a3 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -16,8 +16,8 @@
         "hash": "sha256:1h0mzx52q9pvdv7rhnvb8g68i7bnlc9rf8gy9qn4alsxq4g28zm8"
     },
     "5.15": {
-        "version": "5.15.132",
-        "hash": "sha256:1b0qjsaqjw2rk86shmmrj2aasblkn27acjmc761vnjg7sv2baxs1"
+        "version": "5.15.133",
+        "hash": "sha256:1paxzzcagc7s8i491zjny43rxhfamafyly438kj8hyw96iwmx17g"
     },
     "5.10": {
         "version": "5.10.195",

From 506fcbb467bd9e988e9b4210067fded1c6acf9ad Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 23 Sep 2023 18:25:34 +0300
Subject: [PATCH 10/18] linux_5_10: 5.10.195 -> 5.10.197

(cherry picked from commit b6431552d53593d9505c9e2bc7f64f63438172aa)
---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index e3d412bc56a3..c398bb56fc17 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -20,8 +20,8 @@
         "hash": "sha256:1paxzzcagc7s8i491zjny43rxhfamafyly438kj8hyw96iwmx17g"
     },
     "5.10": {
-        "version": "5.10.195",
-        "hash": "sha256:0n4vg2i9sq89wnz85arlyvwysh9s83cgzs5bk2wh98bivi5fwfs1"
+        "version": "5.10.197",
+        "hash": "sha256:1awkm7lln5gf6kld9z5h4mg39bd778jsdswwlwb7iv7bn03lafhq"
     },
     "5.4": {
         "version": "5.4.256",

From dcc9e20a3035f725f8faf287735ee06162180a40 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 23 Sep 2023 18:25:37 +0300
Subject: [PATCH 11/18] linux_5_4: 5.4.256 -> 5.4.257

(cherry picked from commit aea13fa34fc3ef0a74ce0b42cf3b7c5a2b352f61)
---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index c398bb56fc17..fa69594e0ea4 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -24,8 +24,8 @@
         "hash": "sha256:1awkm7lln5gf6kld9z5h4mg39bd778jsdswwlwb7iv7bn03lafhq"
     },
     "5.4": {
-        "version": "5.4.256",
-        "hash": "sha256:0fim5q9xakwnjfg48bpsic9r2r8dvrjlalqqkm9vh1rml9mhi967"
+        "version": "5.4.257",
+        "hash": "sha256:1w1x91slzg9ggakqhyxnmvz77v2cwfk8bz0knrpgz9qya9q5jxrf"
     },
     "4.19": {
         "version": "4.19.294",

From b41408095f3c7a2fad06a3df0a7af58a300aa1e8 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 23 Sep 2023 18:25:42 +0300
Subject: [PATCH 12/18] linux_4_19: 4.19.294 -> 4.19.295

(cherry picked from commit 1ab54076a380dee9d5f3054da471c10adbc6ab76)
---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index fa69594e0ea4..535cdadd2786 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -28,8 +28,8 @@
         "hash": "sha256:1w1x91slzg9ggakqhyxnmvz77v2cwfk8bz0knrpgz9qya9q5jxrf"
     },
     "4.19": {
-        "version": "4.19.294",
-        "hash": "sha256:03x0xsb8a369zdr81hg6xdl5n5v48k6iwnhj6r29725777lvvbfc"
+        "version": "4.19.295",
+        "hash": "sha256:1b1qslpk1kka7nxam48s22xsqd9qmp716hmibgfsjxl5y3jc4cmp"
     },
     "4.14": {
         "version": "4.14.325",

From da8168eec7f7057dd35f17265f33570ab092b576 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 23 Sep 2023 18:25:45 +0300
Subject: [PATCH 13/18] linux_4_14: 4.14.325 -> 4.14.326

(cherry picked from commit 1f81a011a78ac19dc305b5cce7713af2a2f9a4c3)
---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 535cdadd2786..0019a7c5f38c 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -32,7 +32,7 @@
         "hash": "sha256:1b1qslpk1kka7nxam48s22xsqd9qmp716hmibgfsjxl5y3jc4cmp"
     },
     "4.14": {
-        "version": "4.14.325",
-        "hash": "sha256:117p1mdha57f6d3kdwac9jrbmib7g77q4xhir8ghl6fmrs1f2sav"
+        "version": "4.14.326",
+        "hash": "sha256:0y0lvzidw775mgx211wnc1c6223iqv8amz5y9jkz9h7l3l7y8p2m"
     }
 }

From 4b5ece92e35ca34b8b1d276f75899c2816dccfb2 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 23 Sep 2023 18:26:26 +0300
Subject: [PATCH 14/18] linux-rt_5_10: 5.10.186-rt91 -> 5.10.180-rt89

(cherry picked from commit bbe6d96631a60cbbc55f93ddb776a6aa4a46542b)
---
 pkgs/os-specific/linux/kernel/linux-rt-5.10.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index 19b46d873086..eb2031b129da 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.10.186-rt91"; # updated by ./update-rt.sh
+  version = "5.10.180-rt89"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -17,14 +17,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1qqv91r13akgik1q4jybf8czskxxizk6lpv4rsvjn9sx2dm2jq0y";
+    sha256 = "0a8cicvcyl5w4vi7gxhgd59ny44gj9cbv4z5pnwn9jgny55rm0ys";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1h5p0p3clq0gmaszvddmfll17adv02wfp2bfrd5x3aigvigwfmjb";
+      sha256 = "00m6psnjam26x70f8wpssvjp6v49dyllp356fpfbhjqmj7y142bm";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 

From 5f7800a1b26d498368abcba4f8d162ab5d5c0e7c Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 23 Sep 2023 18:26:59 +0300
Subject: [PATCH 15/18] linux-rt_6_1: 6.1.46-rt14 -> 6.1.54-rt15

(cherry picked from commit 21bcf5be49733a878b50bd93f165440eb806d791)
---
 pkgs/os-specific/linux/kernel/linux-rt-6.1.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
index d599c3bda311..f45926020b5b 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "6.1.46-rt14"; # updated by ./update-rt.sh
+  version = "6.1.54-rt15"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-    sha256 = "15m228bllks2p8gpsmvplx08yxzp7bij9fnmnafqszylrk7ppxpm";
+    sha256 = "09sfrq2l8f777mx2n9mhb6bgz1064bl04921byqnmk87si31w653";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "0mrpsy175iz0b51hwgqbj15w83lm3m57il3gqwb489gln7mpzy17";
+      sha256 = "0ihdid1ihg26kjini66j87vh4220gl8xm9dai7zignha2zh238kh";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 

From a3f1f3020183bf786e67222a9e440a1b0f98ebcb Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Fri, 18 Aug 2023 10:48:28 +0200
Subject: [PATCH 16/18] mutt: 2.2.10 -> 2.2.11

(cherry picked from commit e95c64de4ebbb48700fac130617fa342c73fd9f5)
---
 pkgs/applications/networking/mailreaders/mutt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/mailreaders/mutt/default.nix b/pkgs/applications/networking/mailreaders/mutt/default.nix
index d449ae7db817..f800ac02d5f6 100644
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@@ -23,12 +23,12 @@ assert gpgmeSupport -> sslSupport;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
-  version = "2.2.10";
+  version = "2.2.11";
   outputs = [ "out" "doc" "info" ];
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    sha256 = "sha256-TXc/IkIveQlve5S1e+5FZUrZolFl27NkY8WClbTNPYg=";
+    hash = "sha256-EjJc9m1f+KxL2H+sjbUshp3lLdJ4/DAc/VfVofn0Zcw=";
   };
 
   patches = lib.optional smimeSupport (fetchpatch {

From 131a00a65d44f0eb111157320bb3a87a48ccc2de Mon Sep 17 00:00:00 2001
From: Muhammad Falak R Wani <falakreyaz@gmail.com>
Date: Sun, 10 Sep 2023 12:49:58 +0530
Subject: [PATCH 17/18] mutt: 2.2.11 -> 2.2.12

Changelog: https://gitlab.com/muttmua/mutt/-/blob/mutt-2-2-12-rel/ChangeLog
(cherry picked from commit ba254c17d5887d8eadd4bd378029ad9f36939d35)
---
 pkgs/applications/networking/mailreaders/mutt/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/mailreaders/mutt/default.nix b/pkgs/applications/networking/mailreaders/mutt/default.nix
index f800ac02d5f6..6c2b2290f47b 100644
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@@ -23,12 +23,12 @@ assert gpgmeSupport -> sslSupport;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
-  version = "2.2.11";
+  version = "2.2.12";
   outputs = [ "out" "doc" "info" ];
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    hash = "sha256-EjJc9m1f+KxL2H+sjbUshp3lLdJ4/DAc/VfVofn0Zcw=";
+    hash = "sha256-BDrzEvZLjlb3/Qv3f4SiBdTEmAML2VhkV2ZcR7sYzjg=";
   };
 
   patches = lib.optional smimeSupport (fetchpatch {
@@ -100,6 +100,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A small but very powerful text-based mail client";
     homepage = "http://www.mutt.org";
+    mainProgram = "mutt";
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
     maintainers = with maintainers; [ rnhmjoj ];

From 2b0b8565d50286a44c761fb436f8ae5fd3e0f0c4 Mon Sep 17 00:00:00 2001
From: Aaron Jheng <wentworth@outlook.com>
Date: Wed, 13 Sep 2023 21:30:20 +0800
Subject: [PATCH 18/18] routinator: 0.12.1 -> 0.12.2

(cherry picked from commit 1940468c6febc0cbb465dfb1e91c84a78335970c)
---
 pkgs/servers/routinator/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/routinator/default.nix b/pkgs/servers/routinator/default.nix
index b971d2def92b..a56a5e491a03 100644
--- a/pkgs/servers/routinator/default.nix
+++ b/pkgs/servers/routinator/default.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "routinator";
-  version = "0.12.1";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-QH4M6Kr6UiDJAaDtEn2GXQT9oSSz3lqkf+VE0GfOqeg=";
+    hash = "sha256-fblUr2gtlGMRAFbpWYDafskLmIls56e9b2GFD7ASZHM=";
   };
 
-  cargoSha256 = "sha256-lzw26aat+Zk0E70H7/xwZ6azRMkknfQmTrE4wOJRwfo=";
+  cargoHash = "sha256-pvb/tZW4jqNSLgp+Ktakd3J1KVfCRtPgE0bgNst6ImQ=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];